[RFC] USBdump patches

[Weongyo Jeong]

On Tue, Nov 23, 2010 at 07:36:47PM -0500, Jung-uk Kim wrote:
> On Tuesday 23 November 2010 07:18 pm, Weongyo Jeong wrote:
> > On Tue, Nov 23, 2010 at 06:52:36PM -0500, Jung-uk Kim wrote:
> > > On Tuesday 23 November 2010 06:31 pm, Jung-uk Kim wrote:
> > > > [CC sanitized]
> > > >
> > > > On Tuesday 23 November 2010 06:01 pm, Hans Petter Selasky wrote:
> > > > > Dear Weongyo,
> > > > >
> > > > > > NACK.  You already could recognize that the patch is quite
> > > > > > big and multiple patches are mixed into one.  Please
> > > > > > separate into smallest pieces then send freebsd-usb@ again.
> > > > > >  I don't want to do a jumbo jump.
> > >
> > > Technically, I don't like the copy-and-pasted code from bpf.c and
> > > bpf_filter.c.  Was it really necessary?  Is the dump file in PCAP
> > > format?
> > >
> > > Please enlighten me if I missed something.
> >
> > The following paragraph is extracted from email I sent to rwatson@
> > because he also asked same question to me.  And I added CC to
> > freebsd-usb@ to share my story with other developers who might
> > think similar.
> >
> >   Hello Roberts,
> >
> >   I understand what you're worry and agree with you that if I could
> > remove this duplication it'd be best one.  I think it could be
> > happen enough later if we could reach the consensus.
> >
> >   The biggest confusions I encountered during implementing?
> > (porting) it for USB packet filter were as follows.  Please let me
> > know if there are something I missed:
> >
> >    - BPF was normally for ethernet frames (most operations were
> > based on mbuf including the machine filter and there were a lot of
> > assumptions the input buffer is mbuf type.  For example, handling
> > BPF_LD|BPF_W|BPF_ABS).  However the USB packet isn't like mbuf
> > style that it's just a linear buffer.  So the most important code
> > or assumption wasn't compatible.
> 
> BPF can deal with linear buffer just fine.  For example, ng_bpf(4) 
> does it.  Please see sys/netgraph/ng_bpf.c.
> 
> >    - Just making the patch for BPF code, it looked like a trick or
> > a hack to me because I couldn't define what BPF should be.
> 
> If you don't want to touch bpf.c for some reason, netgraph(4) (-> 
> ng_bpf) may be an alternate solution for you.
> 
> >    - I could not define BPF exactly myself that what BPF should
> > cover. I agreed with that BPF is for ethernet packet filtering but
> > could not make sure myself that BPF could cover USB packets.
> 
> BPF is a generic packet filter machine, i.e., bytecode is generic 
> enough for any type of data stream.

Oh I see what you mean.   `buflen' was a key variable whether the buffer
is mbuf or linear buffer that I missed it.  You saved my enough time.
:-)

I think we could reduce significant code of USB pf.  And I'll provide a
second patch for this.  Please forgive my ignorance.  Thank you!

regards,
Weongyo Jeong