From 2c3d8a8d6bc9888529ffadaa48a4b0dd5211f884 Mon Sep 17 00:00:00 2001
From: Piotr Bartman-Szwarc <prbartman@invisiblethingslab.com>
Date: Thu, 2 Apr 2026 14:16:45 +0200
Subject: [PATCH 1/2] q-dev: avoid zombie device

After detaching from the frontend vm, the device remained under the control of the usbip driver. This caused the device to remain visible in the backend vm but unusable there (zombie). The issue is that, for example, a USB stick would not expose its partitions to the backend, preventing us from using them (e.g. attaching partition to frontend vm).
---
 qubes-rpc/qubes.USBDetach | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/qubes-rpc/qubes.USBDetach b/qubes-rpc/qubes.USBDetach
index 1c9e7cd..995a1d1 100644
--- a/qubes-rpc/qubes.USBDetach
+++ b/qubes-rpc/qubes.USBDetach
@@ -9,6 +9,18 @@ if [ -z "$busid" ]; then
     usbip_sockfd="/sys/bus/usb/devices/$busid/usbip_sockfd"
     if [ -w "$usbip_sockfd" ]; then
         echo -1 > "$usbip_sockfd"
+
+        # avoid zombie usb (visible from backend but held by usbip driver)
+        # disconnect usbip driver
+        if ! echo "$busid" > "/sys/bus/usb/drivers/usbip-host/unbind" 2>/dev/null; then
+            echo "Failed to unbind USB device $busid from usbip-host driver" >&2
+            exit 1
+        fi
+        # reload driver to make it available in backend again
+        if ! echo "$busid" > "/sys/bus/usb/drivers_probe"; then
+            echo "Failed to reload USB device $busid driver" >&2
+            exit 1
+        fi
     else
         echo "Device $busid not found or not attached to any VM!" >&2
         exit 1

From 74a059a6cfdf0504710619546d1d152f567007ba Mon Sep 17 00:00:00 2001
From: Piotr Bartman-Szwarc <prbartman@invisiblethingslab.com>
Date: Wed, 27 May 2026 12:03:04 +0200
Subject: [PATCH 2/2] q-dev: add usb-reset

minimize chance of device persistent state attack
---
 qubes-rpc/qubes.USBDetach | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/qubes-rpc/qubes.USBDetach b/qubes-rpc/qubes.USBDetach
index 995a1d1..9493529 100644
--- a/qubes-rpc/qubes.USBDetach
+++ b/qubes-rpc/qubes.USBDetach
@@ -16,7 +16,14 @@ if [ -z "$busid" ]; then
             echo "Failed to unbind USB device $busid from usbip-host driver" >&2
             exit 1
         fi
-        # reload driver to make it available in backend again
+
+        # reset
+        if ! /usr/lib/qubes/usb-reset "/sys/bus/usb/devices/$busid"; then
+            echo "Failed to reset USB device $busid" >&2
+            exit 1
+        fi
+
+        # reload driver to make it fully available in backend again
         if ! echo "$busid" > "/sys/bus/usb/drivers_probe"; then
             echo "Failed to reload USB device $busid driver" >&2
             exit 1