[RFC] USBdump patches

[Weongyo Jeong]

On Wed, Nov 24, 2010 at 07:35:30PM +1300, Andrew Thompson wrote:
> On 24 November 2010 18:46, Weongyo Jeong <weongyo.jeong at gmail.com> wrote:
> > On Wed, Nov 24, 2010 at 01:59:47PM +1300, Andrew Thompson wrote:
> >> On 24 November 2010 13:36, Jung-uk Kim <jkim at freebsd.org> wrote:
> >> > On Tuesday 23 November 2010 07:18 pm, Weongyo Jeong wrote:
> >> >>    - BPF was normally for ethernet frames (most operations were
> >> >> based on mbuf including the machine filter and there were a lot of
> >> >> assumptions the input buffer is mbuf type.  For example, handling
> >> >> BPF_LD|BPF_W|BPF_ABS).  However the USB packet isn't like mbuf
> >> >> style that it's just a linear buffer.  So the most important code
> >> >> or assumption wasn't compatible.
> >> >
> >> > BPF can deal with linear buffer just fine.  For example, ng_bpf(4)
> >> > does it.  Please see sys/netgraph/ng_bpf.c.
> >> >
> >> >>    - Just making the patch for BPF code, it looked like a trick or
> >> >> a hack to me because I couldn't define what BPF should be.
> >> >
> >> > If you don't want to touch bpf.c for some reason, netgraph(4) (->
> >> > ng_bpf) may be an alternate solution for you.
> >> >
> >> >>    - I could not define BPF exactly myself that what BPF should
> >> >> cover. I agreed with that BPF is for ethernet packet filtering but
> >> >> could not make sure myself that BPF could cover USB packets.
> >> >
> >> > BPF is a generic packet filter machine, i.e., bytecode is generic
> >> > enough for any type of data stream.
> >>
> >> I agree that this is the best way forward, if it can be achieved.
> >
> > Attached is what I really wanted to do.  USB pf is greatly simplified
> > and perfectly satisfy me.  It'll fully benefit from changes of BPF code.
> >
> > I'll commit this version into HEAD if no objections.
> 
> Looks good. Is this compatible with the wireshark pcap format?

Not yet.  I think it could happen soon.

regards,
Weongyo Jeong