Re: [Xen-devel] [Qemu-devel] [PATCH v2 2/2] xen: add pvUSB backend

[Anthony PERARD <anthony.perard@xxxxxxxxxx>]

On Thu, Mar 10, 2016 at 04:19:30PM +0100, Juergen Gross wrote:
> Add a backend for para-virtualized USB devices for xen domains.
> 
> The backend is using host-libusb to forward USB requests from a
> domain via libusb to the real device(s) passed through.
> 
> Signed-off-by: Juergen Gross <jgross@xxxxxxxx>
> ---

[...]

> diff --git a/hw/usb/xen-usb.c b/hw/usb/xen-usb.c
> new file mode 100644
> index 0000000..b12077f
> --- /dev/null
> +++ b/hw/usb/xen-usb.c
> @@ -0,0 +1,1021 @@
> +/*
> + *  xen paravirt usb device backend
> + *
> + *  (c) Juergen Gross <jgross@xxxxxxxx>
> + *
> + *  This program is free software; you can redistribute it and/or modify
> + *  it under the terms of the GNU General Public License as published by
> + *  the Free Software Foundation; under version 2 of the License.
> + *
> + *  This program is distributed in the hope that it will be useful,
> + *  but WITHOUT ANY WARRANTY; without even the implied warranty of
> + *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
> + *  GNU General Public License for more details.
> + *
> + *  You should have received a copy of the GNU General Public License along
> + *  with this program; if not, see <http://www.gnu.org/licenses/>.
> + *
> + *  Contributions after 2012-01-13 are licensed under the terms of the
> + *  GNU GPL, version 2 or (at your option) any later version.
> + */
> +
> +#include <libusb.h>
> +#include <stdio.h>
> +#include <sys/types.h>
> +#include <sys/mman.h>
> +#include <sys/time.h>
> +
> +#include "qemu/osdep.h"
> +#include "qemu-common.h"
> +#include "qemu/config-file.h"
> +#include "hw/sysbus.h"
> +#include "hw/usb.h"
> +#include "hw/xen/xen_backend.h"
> +#include "monitor/qdev.h"
> +#include "qapi/qmp/qbool.h"
> +#include "qapi/qmp/qint.h"
> +#include "qapi/qmp/qstring.h"
> +#include "sys/user.h"
> +
> +#include <xen/io/ring.h>
> +#include <xen/io/usbif.h>
> +
> +#define TR(xendev, lvl, fmt, args...)                               \
> +    {                                                               \
> +        struct timeval tv;                                          \
> +                                                                    \
> +        gettimeofday(&tv, NULL);                                    \
> +        xen_be_printf(xendev, lvl, "%8ld.%06ld xen-usb(%s):" fmt,   \
> +                      tv.tv_sec, tv.tv_usec, __func__, ##args);     \
> +    }
> +#define TR_BUS(xendev, fmt, args...) TR(xendev, 2, fmt, ##args)
> +#define TR_REQ(xendev, fmt, args...) TR(xendev, 3, fmt, ##args)
> +
> +#define USBBACK_MAXPORTS        USBIF_PIPE_PORT_MASK
> +#define USB_DEV_ADDR_SIZE       (USBIF_PIPE_DEV_MASK + 1)
> +
> +/* USB wire protocol: structure describing control request parameter. */
> +struct usbif_ctrlrequest {
> +    uint8_t    bRequestType;
> +    uint8_t    bRequest;
> +    uint16_t   wValue;
> +    uint16_t   wIndex;
> +    uint16_t   wLength;
> +};
> +
> +struct usbback_info;
> +struct usbback_req;
> +
> +struct usbback_stub {
> +    USBDevice     *dev;
> +    USBPort       port;
> +    unsigned int  speed;
> +    bool          attached;
> +    QTAILQ_HEAD(submit_q_head, usbback_req) submit_q;
> +};
> +
> +struct usbback_req {
> +    struct usbback_info      *usbif;
> +    struct usbback_stub      *stub;
> +    struct usbif_urb_request req;
> +    USBPacket                packet;
> +
> +    unsigned int             nr_buffer_segs; /* # of transfer_buffer 
> segments */
> +    unsigned int             nr_extra_segs;  /* # of iso_frame_desc segments 
>  */
> +
> +    QTAILQ_ENTRY(usbback_req) q;
> +
> +    void                     *buffer;
> +    void                     *isoc_buffer;
> +    struct libusb_transfer   *xfer;
> +};
> +
> +struct usbback_info {
> +    struct XenDevice         xendev;  /* must be first */
> +    USBBus                   bus;
> +    void                     *urb_sring;
> +    void                     *conn_sring;
> +    struct usbif_urb_back_ring urb_ring;
> +    struct usbif_conn_back_ring conn_ring;
> +    int                      num_ports;
> +    int                      usb_ver;
> +    bool                     ring_error;
> +    QTAILQ_HEAD(req_free_q_head, usbback_req) req_free_q;
> +    struct usbback_stub      ports[USBBACK_MAXPORTS];
> +    struct usbback_stub      *addr_table[USB_DEV_ADDR_SIZE];
> +    QEMUBH                   *bh;
> +};
> +
> +static struct usbback_req *usbback_get_req(struct usbback_info *usbif)
> +{
> +    struct usbback_req *usbback_req;
> +
> +    if (QTAILQ_EMPTY(&usbif->req_free_q)) {
> +        usbback_req = g_malloc0(sizeof(*usbback_req));

You could use g_new0(struct usbback_req, 1) here.

> +    } else {
> +        usbback_req = QTAILQ_FIRST(&usbif->req_free_q);
> +        QTAILQ_REMOVE(&usbif->req_free_q, usbback_req, q);
> +    }
> +    return usbback_req;
> +}
> +
> +static void usbback_put_req(struct usbback_req *usbback_req)
> +{
> +    struct usbback_info *usbif;
> +
> +    usbif = usbback_req->usbif;
> +    memset(usbback_req, 0, sizeof(*usbback_req));
> +    QTAILQ_INSERT_HEAD(&usbif->req_free_q, usbback_req, q);
> +}
> +
> +static int usbback_gnttab_map(struct usbback_info *usbif,
> +                              struct usbback_req *usbback_req)

Looks like this function is the only one to have both usbif and usbback_req
as parameters.

> +{
> +    unsigned int nr_segs, i, prot;
> +    uint32_t ref[USBIF_MAX_SEGMENTS_PER_REQUEST];
> +    struct XenDevice *xendev = &usbif->xendev;
> +    struct usbif_request_segment *seg;
> +    void *addr;
> +
> +    nr_segs = usbback_req->nr_buffer_segs + usbback_req->nr_extra_segs;
> +    if (!nr_segs) {
> +        return 0;
> +    }
> +
> +    if (nr_segs > USBIF_MAX_SEGMENTS_PER_REQUEST) {
> +        xen_be_printf(xendev, 0, "bad number of segments in request (%d)\n",
> +                      nr_segs);
> +        return -EINVAL;
> +    }
> +
> +    for (i = 0; i < nr_segs; i++) {
> +        if ((unsigned)usbback_req->req.seg[i].offset +
> +            (unsigned)usbback_req->req.seg[i].length > PAGE_SIZE) {
> +            xen_be_printf(xendev, 0, "segment crosses page boundary\n");
> +            return -EINVAL;
> +        }
> +    }
> +
> +    if (usbback_req->nr_buffer_segs) {
> +        prot = PROT_READ;
> +        if (usbif_pipein(usbback_req->req.pipe)) {
> +                prot |= PROT_WRITE;
> +        }
> +        for (i = 0; i < usbback_req->nr_buffer_segs; i++) {
> +            ref[i] = usbback_req->req.seg[i].gref;
> +        }
> +        usbback_req->buffer = 
> xengnttab_map_domain_grant_refs(xendev->gnttabdev,
> +            usbback_req->nr_buffer_segs, xendev->dom, ref, prot);
> +
> +        if (!usbback_req->buffer) {
> +            return -ENOMEM;
> +        }
> +
> +        for (i = 0; i < usbback_req->nr_buffer_segs; i++) {
> +            seg = usbback_req->req.seg + i;
> +            addr = usbback_req->buffer + i * PAGE_SIZE + seg->offset;
> +            qemu_iovec_add(&usbback_req->packet.iov, addr, seg->length);
> +        }
> +    }
> +
> +    if (!usbif_pipeisoc(usbback_req->req.pipe)) {
> +        return 0;
> +    }

The code below would never be reached since isoc request are discared in
usbback_init_packet. Is this some left over from previous version?

> +    if (!usbback_req->nr_extra_segs) {
> +        xen_be_printf(xendev, 0, "iso request without descriptor 
> segments\n");
> +        return -EINVAL;
> +    }
> +
> +    prot = PROT_READ | PROT_WRITE;
> +    for (i = 0; i < usbback_req->nr_extra_segs; i++) {
> +        ref[i] = usbback_req->req.seg[i + 
> usbback_req->req.nr_buffer_segs].gref;
> +    }
> +    usbback_req->isoc_buffer = xengnttab_map_domain_grant_refs(
> +         xendev->gnttabdev, usbback_req->nr_extra_segs, xendev->dom, ref, 
> prot);
> +
> +    if (!usbback_req->isoc_buffer) {
> +        return -ENOMEM;
> +    }
> +
> +    return 0;
> +}
> +
> +static int usbback_init_packet(struct usbback_req *usbback_req)
> +{
> +    struct XenDevice *xendev = &usbback_req->usbif->xendev;
> +    USBPacket *packet = &usbback_req->packet;
> +    USBDevice *dev = usbback_req->stub->dev;
> +    USBEndpoint *ep;
> +    unsigned int pid, ep_nr;
> +    bool sok;
> +    int ret = 0;
> +
> +    qemu_iovec_init(&packet->iov, USBIF_MAX_SEGMENTS_PER_REQUEST);
> +    pid = usbif_pipein(usbback_req->req.pipe) ? USB_TOKEN_IN : USB_TOKEN_OUT;
> +    ep_nr = usbif_pipeendpoint(usbback_req->req.pipe);
> +    sok = !!(usbback_req->req.transfer_flags & 1);

Why 1, where this came from?

> +    if (usbif_pipetype(usbback_req->req.pipe) == USBIF_PIPE_TYPE_CTRL) {

usbif_pipectrl()?

> +        ep_nr = 0;
> +        sok = false;
> +    }
> +    ep = usb_ep_get(dev, pid, ep_nr);
> +    usb_packet_setup(packet, pid, ep, 0, 1, sok, true);
> +
> +    switch (usbif_pipetype(usbback_req->req.pipe)) {
> +    case USBIF_PIPE_TYPE_ISOC:
> +        TR_REQ(xendev, "iso transfer %s: buflen: %x, %d frames\n",
> +               (pid == USB_TOKEN_IN) ? "in" : "out",
> +               usbback_req->req.buffer_length,
> +               usbback_req->req.u.isoc.nr_frame_desc_segs);
> +        ret = -EINVAL;  /* isoc not implemented yet */
> +        break;
> +
> +    case USBIF_PIPE_TYPE_INT:
> +        TR_REQ(xendev, "int transfer %s: buflen: %x\n",
> +               (pid == USB_TOKEN_IN) ? "in" : "out",
> +               usbback_req->req.buffer_length);
> +        break;
> +
> +    case USBIF_PIPE_TYPE_CTRL:
> +        packet->parameter = *(uint64_t *)usbback_req->req.u.ctrl;
> +        TR_REQ(xendev, "ctrl parameter: %lx, buflen: %x\n", 
> packet->parameter,
> +               usbback_req->req.buffer_length);
> +        break;
> +
> +    case USBIF_PIPE_TYPE_BULK:
> +        TR_REQ(xendev, "bulk transfer %s: buflen: %x\n",
> +               (pid == USB_TOKEN_IN) ? "in" : "out",
> +               usbback_req->req.buffer_length);
> +        break;
> +    default:
> +        ret = -EINVAL;
> +        break;
> +    }
> +
> +    return ret;
> +}
> +
> +static void usbback_do_response(struct usbback_req *usbback_req, int32_t 
> status,
> +                                int32_t actual_length, int32_t error_count)
> +{
> +    struct usbback_info *usbif;
> +    struct usbif_urb_response *res;
> +    struct XenDevice *xendev;
> +    unsigned int notify;
> +
> +    usbif = usbback_req->usbif;
> +    xendev = &usbif->xendev;
> +
> +    TR_REQ(xendev, "id %d, status %d, length %d, errcnt %d\n",
> +           usbback_req->req.id, status, actual_length, error_count);
> +
> +    if (usbback_req->packet.iov.iov) {
> +        qemu_iovec_destroy(&usbback_req->packet.iov);
> +    }
> +
> +    if (usbback_req->buffer) {
> +        xengnttab_unmap(xendev->gnttabdev, usbback_req->buffer,
> +                        usbback_req->nr_buffer_segs);
> +        usbback_req->buffer = NULL;
> +    }
> +
> +    if (usbback_req->isoc_buffer) {
> +        xengnttab_unmap(xendev->gnttabdev, usbback_req->isoc_buffer,
> +                        usbback_req->nr_extra_segs);
> +        usbback_req->isoc_buffer = NULL;
> +    }
> +
> +    res = RING_GET_RESPONSE(&usbif->urb_ring, usbif->urb_ring.rsp_prod_pvt);

What happen if the ring is full?

> +    res->id = usbback_req->req.id;
> +    res->status = status;
> +    res->actual_length = actual_length;
> +    res->error_count = error_count;
> +    res->start_frame = 0;
> +    usbif->urb_ring.rsp_prod_pvt++;
> +    RING_PUSH_RESPONSES_AND_CHECK_NOTIFY(&usbif->urb_ring, notify);
> +
> +    if (notify) {
> +        xen_be_send_notify(xendev);
> +    }
> +
> +    usbback_put_req(usbback_req);
> +}
> +
> +static void usbback_do_response_ret(struct usbback_req *usbback_req,
> +                                    int32_t status)
> +{
> +    usbback_do_response(usbback_req, status, 0, 0);
> +}
> +
> +static int32_t usbback_xlat_status(int32_t status)

USBPacket->status is int, so I think the parameter status should be int as
well.

> +{
> +    int32_t ret = -ESHUTDOWN;
> +
> +    switch (status) {
> +    case USB_RET_SUCCESS:
> +        ret = 0;
> +        break;
> +    case USB_RET_NODEV:
> +        ret = -ENODEV;
> +        break;
> +    case USB_RET_STALL:
> +        ret = -EPIPE;
> +        break;
> +    case USB_RET_BABBLE:
> +        ret = -EOVERFLOW;
> +        break;
> +    case USB_RET_IOERROR:
> +        ret = -EPROTO;
> +        break;
> +    }

You could return from the switch instead of using a variable.

> +
> +    return ret;
> +}
> +
> +static void usbback_packet_complete(USBPacket *packet)
> +{
> +    struct usbback_req *usbback_req;
> +    int32_t status;
> +
> +    usbback_req = container_of(packet, struct usbback_req, packet);
> +
> +    QTAILQ_REMOVE(&usbback_req->stub->submit_q, usbback_req, q);
> +
> +    status = usbback_xlat_status(packet->status);
> +    usbback_do_response(usbback_req, status, packet->actual_length, 0);
> +}
> +
> +static void usbback_set_address(struct usbback_info *usbif,
> +                                struct usbback_stub *stub, int cur_addr,
> +                                int new_addr)

unsigned int for both cur_addr and new_addr?

> +{
> +    if (cur_addr) {
> +        usbif->addr_table[cur_addr] = NULL;
> +    }
> +    if (new_addr) {
> +        usbif->addr_table[new_addr] = stub;
> +    }
> +}
> +
> +static bool usbback_cancel_req(struct usbback_req *usbback_req)
> +{
> +    bool ret = false;
> +
> +    if (usb_packet_is_inflight(&usbback_req->packet)) {
> +        usb_cancel_packet(&usbback_req->packet);
> +        ret = true;
> +    }
> +    return ret;
> +}
> +
> +static void usbback_process_unlink_req(struct usbback_req *usbback_req)
> +{
> +    struct usbback_info *usbif;
> +    struct usbback_req *unlink_req;
> +    unsigned int id, devnum;
> +    int ret;
> +
> +    usbif = usbback_req->usbif;
> +    ret = 0;
> +    id = usbback_req->req.u.unlink.unlink_id;
> +    TR_REQ(&usbif->xendev, "unlink id %d\n", id);
> +    devnum = usbif_pipedevice(usbback_req->req.pipe);
> +    if (unlikely(devnum == 0)) {
> +        usbback_req->stub = usbif->ports +
> +                            usbif_pipeportnum(usbback_req->req.pipe);
> +        if (unlikely(!usbback_req->stub)) {
> +            ret = -ENODEV;
> +            goto fail_response;
> +        }
> +    } else {
> +        if (unlikely(!usbif->addr_table[devnum])) {
> +            ret = -ENODEV;
> +            goto fail_response;
> +        }
> +        usbback_req->stub = usbif->addr_table[devnum];
> +    }
> +
> +    QTAILQ_FOREACH(unlink_req, &usbback_req->stub->submit_q, q) {
> +        if (unlink_req->req.id == id) {
> +            if (usbback_cancel_req(unlink_req)) {
> +                usbback_do_response_ret(unlink_req, -EPROTO);
> +            }
> +            break;
> +        }
> +    }
> +
> +fail_response:
> +    usbback_do_response_ret(usbback_req, ret);
> +}
> +
> +/*
> + * Checks whether a request can be handled at once or should be forwarded
> + * to the usb framework.
> + * Return value is:
> + * 0 in case of usb framework is needed
> + * >0 in case of local handling (no error)
> + * <0 parameter error

The function only return 1 or 0. The comment those not match the function?

> + * The request response has been queued already if return value not 0.
> + */
> +static int usbback_check_and_submit(struct usbback_req *usbback_req)
> +{
> +    struct usbback_info *usbif;
> +    unsigned int devnum;
> +    struct usbback_stub *stub;
> +    struct usbif_ctrlrequest *ctrl;
> +    int ret;
> +    uint16_t wValue;
> +
> +    usbif = usbback_req->usbif;
> +    stub = NULL;
> +    devnum = usbif_pipedevice(usbback_req->req.pipe);
> +    ctrl = (struct usbif_ctrlrequest *)usbback_req->req.u.ctrl;
> +    wValue = le16_to_cpu(ctrl->wValue);
> +
> +    /*
> +     * When the device is first connected or resetted, USB device has no
> +     * address. In this initial state, following requests are sent to device
> +     * address (#0),
> +     *
> +     *  1. GET_DESCRIPTOR (with Descriptor Type is "DEVICE") is sent,
> +     *     and OS knows what device is connected to.
> +     *
> +     *  2. SET_ADDRESS is sent, and then device has its address.
> +     *
> +     * In the next step, SET_CONFIGURATION is sent to addressed device, and
> +     * then the device is finally ready to use.
> +     */
> +    if (unlikely(devnum == 0)) {
> +        stub = usbif->ports + usbif_pipeportnum(usbback_req->req.pipe) - 1;
> +        if (!stub->dev || !stub->attached) {
> +            ret = -ENODEV;
> +            goto do_response;
> +        }
> +
> +        switch (ctrl->bRequest) {
> +        case USB_REQ_GET_DESCRIPTOR:
> +            /*
> +             * GET_DESCRIPTOR request to device #0.
> +             * through normal transfer.
> +             */
> +            TR_REQ(&usbif->xendev, "devnum 0 GET_DESCRIPTOR\n");
> +            usbback_req->stub = stub;
> +            return 0;
> +        case USB_REQ_SET_ADDRESS:
> +            /*
> +             * SET_ADDRESS request to device #0.
> +             * add attached device to addr_table.
> +             */
> +            TR_REQ(&usbif->xendev, "devnum 0 SET_ADDRESS\n");
> +            usbback_set_address(usbif, stub, 0, wValue);
> +            ret = 0;
> +            break;
> +        default:
> +            ret = -EINVAL;
> +            break;
> +        }
> +        goto do_response;
> +    }
> +
> +    if (unlikely(!usbif->addr_table[devnum])) {
> +            ret = -ENODEV;
> +            goto do_response;
> +    }
> +    usbback_req->stub = usbif->addr_table[devnum];
> +
> +    /*
> +     * Check special request
> +     */
> +    if (ctrl->bRequest != USB_REQ_SET_ADDRESS) {
> +        return 0;
> +    }
> +
> +    /*
> +     * SET_ADDRESS request to addressed device.
> +     * change addr or remove from addr_table.
> +     */
> +    usbback_set_address(usbif, usbback_req->stub, devnum, wValue);
> +    ret = 0;
> +
> +do_response:
> +    usbback_do_response_ret(usbback_req, ret);
> +    return 1;
> +}
> +
> +static void usbback_dispatch(struct usbback_req *usbback_req)
> +{
> +    int ret;
> +    unsigned int devnum;
> +    struct usbback_info *usbif;
> +
> +    usbif = usbback_req->usbif;
> +
> +    TR_REQ(&usbif->xendev, "start req_id %d pipe %08x\n", 
> usbback_req->req.id,
> +           usbback_req->req.pipe);
> +
> +    /* unlink request */
> +    if (unlikely(usbif_pipeunlink(usbback_req->req.pipe))) {
> +        usbback_process_unlink_req(usbback_req);
> +        return;
> +    }
> +
> +    if (usbif_pipectrl(usbback_req->req.pipe)) {
> +        if (usbback_check_and_submit(usbback_req)) {
> +            return;
> +        }
> +    } else {
> +        devnum = usbif_pipedevice(usbback_req->req.pipe);
> +        usbback_req->stub = usbif->addr_table[devnum];
> +
> +        if (!usbback_req->stub || !usbback_req->stub->attached) {
> +            ret = -ENODEV;
> +            goto fail_response;
> +        }
> +    }
> +
> +    QTAILQ_INSERT_TAIL(&usbback_req->stub->submit_q, usbback_req, q);
> +
> +    usbback_req->nr_buffer_segs = usbback_req->req.nr_buffer_segs;
> +    usbback_req->nr_extra_segs = usbif_pipeisoc(usbback_req->req.pipe) ?
> +                                 usbback_req->req.u.isoc.nr_frame_desc_segs 
> : 0;
> +
> +    ret = usbback_init_packet(usbback_req);
> +    if (ret) {
> +        xen_be_printf(&usbif->xendev, 0, "invalid request\n");
> +        ret = -ESHUTDOWN;
> +        goto fail_free_urb;
> +    }
> +
> +    ret = usbback_gnttab_map(usbif, usbback_req);
> +    if (ret) {
> +        xen_be_printf(&usbif->xendev, 0, "invalid buffer, ret=%d\n", ret);
> +        ret = -ESHUTDOWN;
> +        goto fail_free_urb;
> +    }
> +
> +    usb_handle_packet(usbback_req->stub->dev, &usbback_req->packet);
> +    if (usbback_req->packet.status != USB_RET_ASYNC) {
> +        usbback_packet_complete(&usbback_req->packet);
> +    }
> +    return;
> +
> +fail_free_urb:
> +    QTAILQ_REMOVE(&usbback_req->stub->submit_q, usbback_req, q);
> +
> +fail_response:
> +    usbback_do_response_ret(usbback_req, ret);
> +}
> +
> +static void usbback_bh(void *opaque)
> +{
> +    struct usbback_info *usbif;
> +    struct usbif_urb_back_ring *urb_ring;
> +    struct usbback_req *usbback_req;
> +    RING_IDX rc, rp;
> +    unsigned int more_to_do;
> +
> +    usbif = opaque;
> +    if (usbif->ring_error) {
> +        return;
> +    }
> +
> +    urb_ring = &usbif->urb_ring;
> +    rc = urb_ring->req_cons;
> +    rp = urb_ring->sring->req_prod;

Maybe use atomic_read() here to avoid req_prod been read more than once.

> +    xen_rmb(); /* Ensure we see queued requests up to 'rp'. */
> +
> +    if (RING_REQUEST_PROD_OVERFLOW(urb_ring, rp)) {
> +        rc = urb_ring->rsp_prod_pvt;
> +        xen_be_printf(&usbif->xendev, 0, "domU provided bogus ring requests "
> +                      "(%#x - %#x = %u). Halting ring processing.\n",
> +                      rp, rc, rp - rc);
> +        usbif->ring_error = true;
> +        return;
> +    }
> +
> +    while (rc != rp) {
> +        if (RING_REQUEST_CONS_OVERFLOW(urb_ring, rc)) {
> +            break;
> +        }
> +        usbback_req = usbback_get_req(usbif);
> +
> +        usbback_req->req = *RING_GET_REQUEST(urb_ring, rc);
> +        usbback_req->usbif = usbif;
> +
> +        usbback_dispatch(usbback_req);
> +
> +        urb_ring->req_cons = ++rc;
> +    }
> +
> +    RING_FINAL_CHECK_FOR_REQUESTS(urb_ring, more_to_do);
> +    if (more_to_do) {
> +        qemu_bh_schedule(usbif->bh);
> +    }
> +}
> +
> +static void usbback_hotplug_notify(struct usbback_info *usbif, unsigned port)
> +{
> +    struct usbif_conn_back_ring *ring = &usbif->conn_ring;
> +    struct usbif_conn_request *req;
> +    struct usbif_conn_response *res;
> +    uint16_t id;
> +    unsigned int notify;
> +
> +    if (!usbif->conn_sring) {
> +        return;
> +    }
> +
> +    req = RING_GET_REQUEST(ring, ring->req_cons);

Should not we check if there is something to consume here?

> +    id = req->id;
> +    ring->req_cons++;
> +    ring->sring->req_event = ring->req_cons + 1;
> +
> +    res = RING_GET_RESPONSE(ring, ring->rsp_prod_pvt);

What if the ring is already full?

> +    res->id = id;
> +    res->portnum = port;
> +    res->speed = usbif->ports[port - 1].speed;
> +    ring->rsp_prod_pvt++;
> +    RING_PUSH_RESPONSES_AND_CHECK_NOTIFY(ring, notify);
> +
> +    if (notify) {
> +        xen_be_send_notify(&usbif->xendev);
> +    }
> +
> +    TR_BUS(&usbif->xendev, "hotplug port %d speed %d\n", port, res->speed);
> +}
> +

Thanks,

-- 
Anthony PERARD

_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxx
http://lists.xen.org/xen-devel