usbmon-5.4/000075500000000000000000000000001213266437600126755ustar00rootroot00000000000000usbmon-5.4/COPYING000064400000000000000000000431031213266437600137310ustar00rootroot00000000000000 GNU GENERAL PUBLIC LICENSE Version 2, June 1991 Copyright (C) 1989, 1991 Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA Everyone is permitted to copy and distribute verbatim copies of this license document, but changing it is not allowed. Preamble The licenses for most software are designed to take away your freedom to share and change it. By contrast, the GNU General Public License is intended to guarantee your freedom to share and change free software--to make sure the software is free for all its users. This General Public License applies to most of the Free Software Foundation's software and to any other program whose authors commit to using it. (Some other Free Software Foundation software is covered by the GNU Lesser General Public License instead.) You can apply it to your programs, too. When we speak of free software, we are referring to freedom, not price. Our General Public Licenses are designed to make sure that you have the freedom to distribute copies of free software (and charge for this service if you wish), that you receive source code or can get it if you want it, that you can change the software or use pieces of it in new free programs; and that you know you can do these things. To protect your rights, we need to make restrictions that forbid anyone to deny you these rights or to ask you to surrender the rights. These restrictions translate to certain responsibilities for you if you distribute copies of the software, or if you modify it. For example, if you distribute copies of such a program, whether gratis or for a fee, you must give the recipients all the rights that you have. You must make sure that they, too, receive or can get the source code. And you must show them these terms so they know their rights. We protect your rights with two steps: (1) copyright the software, and (2) offer you this license which gives you legal permission to copy, distribute and/or modify the software. Also, for each author's protection and ours, we want to make certain that everyone understands that there is no warranty for this free software. If the software is modified by someone else and passed on, we want its recipients to know that what they have is not the original, so that any problems introduced by others will not reflect on the original authors' reputations. Finally, any free program is threatened constantly by software patents. We wish to avoid the danger that redistributors of a free program will individually obtain patent licenses, in effect making the program proprietary. To prevent this, we have made it clear that any patent must be licensed for everyone's free use or not licensed at all. The precise terms and conditions for copying, distribution and modification follow. GNU GENERAL PUBLIC LICENSE TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION 0. This License applies to any program or other work which contains a notice placed by the copyright holder saying it may be distributed under the terms of this General Public License. The "Program", below, refers to any such program or work, and a "work based on the Program" means either the Program or any derivative work under copyright law: that is to say, a work containing the Program or a portion of it, either verbatim or with modifications and/or translated into another language. (Hereinafter, translation is included without limitation in the term "modification".) Each licensee is addressed as "you". Activities other than copying, distribution and modification are not covered by this License; they are outside its scope. The act of running the Program is not restricted, and the output from the Program is covered only if its contents constitute a work based on the Program (independent of having been made by running the Program). Whether that is true depends on what the Program does. 1. You may copy and distribute verbatim copies of the Program's source code as you receive it, in any medium, provided that you conspicuously and appropriately publish on each copy an appropriate copyright notice and disclaimer of warranty; keep intact all the notices that refer to this License and to the absence of any warranty; and give any other recipients of the Program a copy of this License along with the Program. You may charge a fee for the physical act of transferring a copy, and you may at your option offer warranty protection in exchange for a fee. 2. You may modify your copy or copies of the Program or any portion of it, thus forming a work based on the Program, and copy and distribute such modifications or work under the terms of Section 1 above, provided that you also meet all of these conditions: a) You must cause the modified files to carry prominent notices stating that you changed the files and the date of any change. b) You must cause any work that you distribute or publish, that in whole or in part contains or is derived from the Program or any part thereof, to be licensed as a whole at no charge to all third parties under the terms of this License. c) If the modified program normally reads commands interactively when run, you must cause it, when started running for such interactive use in the most ordinary way, to print or display an announcement including an appropriate copyright notice and a notice that there is no warranty (or else, saying that you provide a warranty) and that users may redistribute the program under these conditions, and telling the user how to view a copy of this License. (Exception: if the Program itself is interactive but does not normally print such an announcement, your work based on the Program is not required to print an announcement.) These requirements apply to the modified work as a whole. If identifiable sections of that work are not derived from the Program, and can be reasonably considered independent and separate works in themselves, then this License, and its terms, do not apply to those sections when you distribute them as separate works. But when you distribute the same sections as part of a whole which is a work based on the Program, the distribution of the whole must be on the terms of this License, whose permissions for other licensees extend to the entire whole, and thus to each and every part regardless of who wrote it. Thus, it is not the intent of this section to claim rights or contest your rights to work written entirely by you; rather, the intent is to exercise the right to control the distribution of derivative or collective works based on the Program. In addition, mere aggregation of another work not based on the Program with the Program (or with a work based on the Program) on a volume of a storage or distribution medium does not bring the other work under the scope of this License. 3. You may copy and distribute the Program (or a work based on it, under Section 2) in object code or executable form under the terms of Sections 1 and 2 above provided that you also do one of the following: a) Accompany it with the complete corresponding machine-readable source code, which must be distributed under the terms of Sections 1 and 2 above on a medium customarily used for software interchange; or, b) Accompany it with a written offer, valid for at least three years, to give any third party, for a charge no more than your cost of physically performing source distribution, a complete machine-readable copy of the corresponding source code, to be distributed under the terms of Sections 1 and 2 above on a medium customarily used for software interchange; or, c) Accompany it with the information you received as to the offer to distribute corresponding source code. (This alternative is allowed only for noncommercial distribution and only if you received the program in object code or executable form with such an offer, in accord with Subsection b above.) The source code for a work means the preferred form of the work for making modifications to it. For an executable work, complete source code means all the source code for all modules it contains, plus any associated interface definition files, plus the scripts used to control compilation and installation of the executable. However, as a special exception, the source code distributed need not include anything that is normally distributed (in either source or binary form) with the major components (compiler, kernel, and so on) of the operating system on which the executable runs, unless that component itself accompanies the executable. If distribution of executable or object code is made by offering access to copy from a designated place, then offering equivalent access to copy the source code from the same place counts as distribution of the source code, even though third parties are not compelled to copy the source along with the object code. 4. You may not copy, modify, sublicense, or distribute the Program except as expressly provided under this License. Any attempt otherwise to copy, modify, sublicense or distribute the Program is void, and will automatically terminate your rights under this License. However, parties who have received copies, or rights, from you under this License will not have their licenses terminated so long as such parties remain in full compliance. 5. You are not required to accept this License, since you have not signed it. However, nothing else grants you permission to modify or distribute the Program or its derivative works. These actions are prohibited by law if you do not accept this License. Therefore, by modifying or distributing the Program (or any work based on the Program), you indicate your acceptance of this License to do so, and all its terms and conditions for copying, distributing or modifying the Program or works based on it. 6. Each time you redistribute the Program (or any work based on the Program), the recipient automatically receives a license from the original licensor to copy, distribute or modify the Program subject to these terms and conditions. You may not impose any further restrictions on the recipients' exercise of the rights granted herein. You are not responsible for enforcing compliance by third parties to this License. 7. If, as a consequence of a court judgment or allegation of patent infringement or for any other reason (not limited to patent issues), conditions are imposed on you (whether by court order, agreement or otherwise) that contradict the conditions of this License, they do not excuse you from the conditions of this License. If you cannot distribute so as to satisfy simultaneously your obligations under this License and any other pertinent obligations, then as a consequence you may not distribute the Program at all. For example, if a patent license would not permit royalty-free redistribution of the Program by all those who receive copies directly or indirectly through you, then the only way you could satisfy both it and this License would be to refrain entirely from distribution of the Program. If any portion of this section is held invalid or unenforceable under any particular circumstance, the balance of the section is intended to apply and the section as a whole is intended to apply in other circumstances. It is not the purpose of this section to induce you to infringe any patents or other property right claims or to contest validity of any such claims; this section has the sole purpose of protecting the integrity of the free software distribution system, which is implemented by public license practices. Many people have made generous contributions to the wide range of software distributed through that system in reliance on consistent application of that system; it is up to the author/donor to decide if he or she is willing to distribute software through any other system and a licensee cannot impose that choice. This section is intended to make thoroughly clear what is believed to be a consequence of the rest of this License. 8. If the distribution and/or use of the Program is restricted in certain countries either by patents or by copyrighted interfaces, the original copyright holder who places the Program under this License may add an explicit geographical distribution limitation excluding those countries, so that distribution is permitted only in or among countries not thus excluded. In such case, this License incorporates the limitation as if written in the body of this License. 9. The Free Software Foundation may publish revised and/or new versions of the General Public License from time to time. Such new versions will be similar in spirit to the present version, but may differ in detail to address new problems or concerns. Each version is given a distinguishing version number. If the Program specifies a version number of this License which applies to it and "any later version", you have the option of following the terms and conditions either of that version or of any later version published by the Free Software Foundation. If the Program does not specify a version number of this License, you may choose any version ever published by the Free Software Foundation. 10. If you wish to incorporate parts of the Program into other free programs whose distribution conditions are different, write to the author to ask for permission. For software which is copyrighted by the Free Software Foundation, write to the Free Software Foundation; we sometimes make exceptions for this. Our decision will be guided by the two goals of preserving the free status of all derivatives of our free software and of promoting the sharing and reuse of software generally. NO WARRANTY 11. BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING, REPAIR OR CORRECTION. 12. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR REDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. END OF TERMS AND CONDITIONS How to Apply These Terms to Your New Programs If you develop a new program, and you want it to be of the greatest possible use to the public, the best way to achieve this is to make it free software which everyone can redistribute and change under these terms. To do so, attach the following notices to the program. It is safest to attach them to the start of each source file to most effectively convey the exclusion of warranty; and each file should have at least the "copyright" line and a pointer to where the full notice is found. Copyright (C) This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version. This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with this program; if not, write to the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. Also add information on how to contact you by electronic and paper mail. If the program is interactive, make it output a short notice like this when it starts in an interactive mode: Gnomovision version 69, Copyright (C) year name of author Gnomovision comes with ABSOLUTELY NO WARRANTY; for details type `show w'. This is free software, and you are welcome to redistribute it under certain conditions; type `show c' for details. The hypothetical commands `show w' and `show c' should show the appropriate parts of the General Public License. Of course, the commands you use may be called something other than `show w' and `show c'; they could even be mouse-clicks or menu items--whatever suits your program. You should also get your employer (if you work as a programmer) or your school, if any, to sign a "copyright disclaimer" for the program, if necessary. Here is a sample; alter the names: Yoyodyne, Inc., hereby disclaims all copyright interest in the program `Gnomovision' (which makes passes at compilers) written by James Hacker. , 1 April 1989 Ty Coon, President of Vice This General Public License does not permit incorporating your program into proprietary programs. If your program is a subroutine library, you may consider it more useful to permit linking proprietary applications with the library. If this is what you want to do, use the GNU Lesser General Public License instead of this License. usbmon-5.4/Makefile000064400000000000000000000002621213266437600143350ustar00rootroot00000000000000## ## usbmon - simple front-end for in-kernel usbmon ## CFLAGS += -Wall -O2 -Wp,-D_FORTIFY_SOURCE=2 all: usbmon usbmon: usbmon.o usbmon.o: usbmon.c clean: rm -f *.o usbmon usbmon-5.4/README000064400000000000000000000005571213266437600135640ustar00rootroot00000000000000 usbmon Version 5.4 The usbmon(8) utility is a user interface to its namesake "usbmon", a facility in Linux kernel. The usbmon facility may also be accessed with tcpdump(1), Wireshark, or cat(1). Isn't the choice wonderful? This software program is licensed for use under terms of GNU General Public License, version 2. See file "COPYING" for the complete terms. usbmon-5.4/usbmon.8000064400000000000000000000174651213266437600143060ustar00rootroot00000000000000.TH usbmon 8 "10 April 2007" .IX usbmon .SH NAME usbmon \- monitor USB traffic .SH SYNOPSIS .B usbmon [ .B -i .I bus_num ] [ .B -s .I length ] [ .B -f0 | .B -fu | .B -fh ] [ .B -a0 | .B -a1 ] .SH DESCRIPTION .B usbmon allows to capture USB traffic for analysis in the manner similar to .BR tcpdump (8). To make use of this program, you need to have a Linux kernel which supports the binary "usbmon" interface (e.g., Linux kernel 2.6.20 or newer). .SH OPTIONS .TP .B \-i Listen on \fIbus_num\fP. If unspecified, .I usbmon attempts to listen on the pseudo-bus number zero, which is supposed to capture all packets on all buses. The default is a convenient mode because the user does not have to figure out the bus number where a specific device is attached. Also, listening on pseudo-bus zero allows to capture events which happen when a bus is initialized. However, it may be necessary to specify a specific bus number to tap. Kernels before 2.6.22 do not implement the pseudo-bus zero at all. Performance of USB stack and the usbmon is greater when a specific bus is monitored. In such case, the desired bus number may be determined by examining the output of lsusb(8). .TP .B \-s Set the maximum length of USB data to print. The default is to print 32 bytes just like the kernel's text interface would. The capture size is automatically adjusted to match unless set explicitly. .TP .B \-f Select the output format as one of: '0' for legacy format, 'u' for so-called "1u" format, 'h' for "human-readable" format. The human-readable format is the default. Also, it changes over time, so programs should parse the "1u" format. Selecting the 1u format forces .I usbmon to use the API which may not be available in the kernel before version 2.6.22. .TP .B \-a Force the binary API version to use: '0' for the legacy API in kernel 2.6.20 and up, '1' for the newer API in kernels after 2.6.22. Selection of output format may force the API to the minimum required to support the format. In general, this option is only used when testing the kernel component of usbmon. .SH OUTPUT FORMAT .LP The output of .I usbmon contains one text line per an event. The event corresponds to I/O operations on the boundary of Host Controller Driver (HCD). This includes events of the following types: Submission, Callback, Error. Every line consists of whitespace separated words. The number or position of words may depend on the event type, but there is a set of words, common for all types. .LP Most commonly used format is the human-readable format. Its words, from left to right, are: .PP - URB Tag. A single URB generates several monitoring events during its life cycle. The tag allows to corellate events with the URB. Tag is usually derived from a kernel mode address. Human-readable format shortens the tag to make the output more readable, so it's not the complete address. .PP - Timestamp. It consistes of the number of seconds, period, and the fraction in microseconds. .PP - Event Type. This type refers to the format of the event, not URB type. Available types are: S - submission, C - callback, E - submission error. .PP - "Pipe word" (the name is historical and has nothing to do with pipes). This is a composite word. It consists of four fields, separated by colons: URB type and direction, Bus number, Device address, Endpoint number. Type and direction are encoded with two bytes in the following manner: .PP Ci Co Control input and output Zi Zo Isochronous input and output Ii Io Interrupt input and output Bi Bo Bulk input and output .PP The address information fields may contain leading zeros. If the bus is specified with -i, the Bus number field is redundant, but is kept for the ease of parsing. .PP - Status word. This word may have several fields, depending on the transfer type. Most transfers only have the status field. Interrupt and Isochronous transfers add an interval. For Isochronous, start frame and error count may be present. For callback and error events, the status field contains an integer number, which represents a "status" field of the URB. For a submission event, status makes no sense, so the field contains a single dash. .PP Control submissions are an exception, because they may have a setup packet. In such case, the event contains a letter in place of the status word. The letter is called "setup tag". .PP - Setup packet, if present, consists of 5 words: one of each for bmRequestType, bRequest, wValue, wIndex, wLength, as specified by the USB Specification 2.0. These words are safe to decode if Setup Tag was 's'. Otherwise, the setup packet was present, but not captured, and the fields contain filler. .PP - The number of isochronous frame descriptors (optional). .PP - Isochronous descriptors (optional). This is a new feature of usbmon, poorly understood, and poorly documented. XXX .PP - Data Tag .PP - Data (if Data Tag is '=') .LP The following is the list of words for the legacy format, from left to right: .PP - URB Tag. This is normally a kernel mode address of the URB structure. .PP - Timestamp in microseconds, a decimal number. The timestamp's resolution depends on available clock, and so it can be much worse than a microsecond (if the implementation uses jiffies, for example). The number of microseconds is usually truncated, so it can wrap if usbmon runs long enough. .PP - Event Type. This type refers to the format of the event, not URB type. Available types are: S - submission, C - callback, E - submission error. .PP - "Pipe". The pipe concept is deprecated. This is a composite word, used to be derived from information in pipes. It consists of three fields, separated by colons: URB type and direction, Device address, Endpoint number. Type and direction are encoded with two bytes in the following manner: .PP Ci Co Control input and output Zi Zo Isochronous input and output Ii Io Interrupt input and output Bi Bo Bulk input and output .PP Device address and Endpoint number are 3-digit and 2-digit (respectively) decimal numbers, with leading zeroes. .PP - URB Status. In most cases, this field contains a number, sometimes negative, which represents a "status" field of the URB. This field makes no sense for submissions, but is present anyway to help scripts with parsing. When an error occurs, the field contains the error code. In case of a submission of a Control packet, this field contains a Setup Tag instead of an error code. It is easy to tell whether the Setup Tag is present because it is never a number. Thus if scripts find a number in this field, they proceed to read Data Length. If they find something else, like a letter, they read the setup packet before reading the Data Length. .PP - Setup packet, if present, consists of 5 words: one of each for bmRequestType, bRequest, wValue, wIndex, wLength, as specified by the USB Specification 2.0. These words are safe to decode if Setup Tag was 's'. Otherwise, the setup packet was present, but not captured, and the fields contain filler. .PP - Data Length. For submissions, this is the requested length. For callbacks, this is the actual length. .PP - Data tag. The usbmon may not always capture data, even if length is nonzero. The data words are present only if this tag is '='. .PP - Data words follow, in big endian hexadecimal format. Notice that they are not machine words, but really just a byte stream split into words to make it easier to read. Thus, the last word may contain from one to four bytes. The length of collected data is limited (see the .I \-s parameter) and can be less than the data length report in the Data Length word. .SH FILES .TP .B /proc/devices This file is read to determine the major of /dev/usbmonN if such node does not exist in the system. .TP .B /dev/usbmonN The .I usbmon attempts to open .I /dev/usbmon{N}, where N is the bus number. If the node does not exist, .I usbmon creates it. .SH SEE ALSO .BR lsusb (8) .SH AUTHOR Pete Zaitcev, . usbmon-5.4/usbmon.c000064400000000000000000000553131213266437600143530ustar00rootroot00000000000000/* * usbmon: Front-end for usbmon * * Copyright (C) 2005 Pete Zaitcev (zaitcev@redhat.com) * Copyright (c) 2007 Red Hat, Inc. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 as * published by the Free Software Foundation. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License along * with this program; if not, write to the Free Software Foundation, Inc., * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. * * The function print_48 is a fork of mon_text_read from ancient kernels * (thus we are perfectly compatible with '1t' format), so we use GPL v2. * If someone rewrites print_XXX from scratch, we can use any GPL >= 2. */ #include #include #include #include #include #include #include #include #include #include #include #include #define TAG "usbmon" #ifdef __GNUC__ #define __unused __attribute__((unused)) #else #define __unused /**/ #endif #define usb_typeint(type) (((type)&0x3) == PIPE_INTERRUPT) #define usb_typeisoc(type) (((type)&0x3) == PIPE_ISOCHRONOUS) struct usbmon_packet { uint64_t id; /* URB ID - from submission to callback */ unsigned char type; /* Same as in text API; extensible. */ unsigned char xfer_type; /* ISO, Intr, Control, Bulk */ unsigned char epnum; /* Endpoint number; 0x80 IN */ unsigned char devnum; /* Device address */ unsigned short busnum; /* Bus number */ char flag_setup; char flag_data; int64_t ts_sec; /* gettimeofday */ int32_t ts_usec; /* gettimeofday */ int status; unsigned int length; /* Length of data (submitted or actual) */ unsigned int len_cap; /* Delivered length */ unsigned char setup[8]; /* Only for Control S-type */ }; struct usbmon_packet_1 { uint64_t id; /* URB ID - from submission to callback */ unsigned char type; /* Same as in text API; extensible. */ unsigned char xfer_type; /* ISO, Intr, Control, Bulk */ unsigned char epnum; /* Endpoint number; 0x80 IN */ unsigned char devnum; /* Device address */ unsigned short busnum; /* Bus number */ char flag_setup; char flag_data; int64_t ts_sec; /* gettimeofday */ int32_t ts_usec; /* gettimeofday */ int status; unsigned int length; /* Length of data (submitted or actual) */ unsigned int len_cap; /* Delivered length */ union { unsigned char setup[8]; /* Only for Control S-type */ struct iso_rec { int error_count; int numdesc; /* Number from the URB */ } iso; } s; int interval; int start_frame; unsigned int xfer_flags; unsigned int ndesc; /* Actual number of ISO descriptors */ }; struct usbmon_isodesc { int iso_stat; unsigned int iso_off; unsigned int iso_len; int iso_pad; }; /* * Size this so that we see data even if many descriptors are used. * Notice that we reserve enough print buffer for all of them. */ #define ISODESC_MAX 8 #define PIPE_ISOCHRONOUS 0 #define PIPE_INTERRUPT 1 #define PIPE_CONTROL 2 #define PIPE_BULK 3 #define MON_IOC_MAGIC 0x92 #define MON_IOCG_STATS _IOR(MON_IOC_MAGIC, 3, struct usbmon_stats) #define MON_IOCT_RING_SIZE _IO(MON_IOC_MAGIC, 4) #define MON_IOCQ_RING_SIZE _IO(MON_IOC_MAGIC, 5) struct usbmon_get_arg { struct usbmon_packet_1 *hdr; /* Only 48 bytes, not 64. */ void *data; size_t alloc; /* Length of data (can be zero) */ }; #define MON_IOCX_GET _IOW(MON_IOC_MAGIC, 6, struct usbmon_get_arg) #define MON_IOCX_GETX _IOW(MON_IOC_MAGIC, 10, struct usbmon_get_arg) /* */ enum text_format { TFMT_OLD, /* The v0 text API aka "1t" */ TFMT_1U, /* The "1u" text format */ TFMT_HUMAN /* Human-oriented format, changes over time. */ }; enum usbmon_api { API_ANY, API_B0, /* Old binary (48 bytes usbmon_packet) */ API_B1 /* New binary (64 bytes usbmon_packet_1) */ }; struct params { int ifnum; /* USB bus number */ char *devname; /* /dev/usbmonN */ int data_size; /* How many bytes to fetch, including ISO descriptors */ int data_max; /* How many bytes to print as data (<= data_size) */ enum text_format format; enum usbmon_api api; char *print_buf; int print_size; }; enum { DATA_MAX = 32 }; /* Old limit used with 1t format (print_48) */ struct print_cursor { char *pbuf; int size; int count; /* without the terminating nul */ }; void Usage(void); void print_48(const struct params *, const struct usbmon_packet *ep, const unsigned char *data); void print_1u(const struct params *, const struct usbmon_packet_1 *ep, const unsigned char *data); void print_human(const struct params *, const struct usbmon_packet_1 *ep, const unsigned char *data); static void print_start(struct print_cursor *, char *buf, int size0); static void print_safe(struct print_cursor *, const char *fmt, ...); static int print_done(struct print_cursor *); void parse_params(struct params *p, char **argv); void make_device(const struct params *p); int find_major(void); struct params par; int main(int argc __unused, char **argv) { int fd; uint64_t start_sec = 0; struct usbmon_packet_1 hdrb; struct usbmon_get_arg getb; unsigned char *data_buff; int rc; if (sizeof(struct usbmon_packet) != 48) { extern void usbmon_packet_size_is_bolixed(void); usbmon_packet_size_is_bolixed(); /* link-time error */ } if (sizeof(struct usbmon_packet_1) != 64) { extern void usbmon_packet_1_size_is_bolixed(void); usbmon_packet_1_size_is_bolixed(); /* link-time error */ } parse_params(&par, argv+1); /* * Two reasons to do this: * 1. Reduce weird error messages. * 2. If we create device nodes, we want them owned by root. */ if (geteuid() != 0) { fprintf(stderr, TAG ": Must run as root\n"); exit(1); } if ((fd = open(par.devname, O_RDWR)) == -1) { if (errno == ENOENT) { make_device(&par); fd = open(par.devname, O_RDWR); } if (fd == -1) { if (errno == ENODEV && par.ifnum == 0) { fprintf(stderr, TAG ": Can't open pseudo-bus zero at %s" " (probably not supported by kernel)\n", par.devname); } else { fprintf(stderr, TAG ": Can't open %s: %s\n", par.devname, strerror(errno)); } exit(1); } } // rc = ioctl(fd, MON_IOCQ_RING_SIZE, 0); // printf("Ring size: %d\n", rc); if ((data_buff = malloc(par.data_size)) == NULL) { fprintf(stderr, TAG ": No core\n"); exit(1); } if (par.format == TFMT_HUMAN && par.api == API_B0) { /* * Zero fields which are not present in old (zero) API */ memset(&hdrb, 0, sizeof(struct usbmon_packet_1)); } else { /* * Make uninitialized fields visible. */ memset(&hdrb, 0xdb, sizeof(struct usbmon_packet_1)); } for (;;) { getb.hdr = &hdrb; getb.data = data_buff; getb.alloc = par.data_size; if (par.api == API_B0) { if ((rc = ioctl(fd, MON_IOCX_GET, &getb)) != 0) { fprintf(stderr, TAG ": MON_IOCX_GET: %s\n", strerror(errno)); exit(1); } } else if (par.api == API_B1) { if ((rc = ioctl(fd, MON_IOCX_GETX, &getb)) != 0) { fprintf(stderr, TAG ": MON_IOCX_GETX: %s\n", strerror(errno)); exit(1); } } else { if ((rc = ioctl(fd, MON_IOCX_GETX, &getb)) != 0) { if (errno == ENOTTY) { par.api = API_B0; rc = ioctl(fd, MON_IOCX_GET, &getb); if (rc != 0) { fprintf(stderr, TAG ": MON_IOCX_GET: %s\n", strerror(errno)); exit(1); } } else { fprintf(stderr, TAG ": MON_IOCX_GETX: %s\n", strerror(errno)); exit(1); } } } switch (par.format) { case TFMT_OLD: /* * Old and new APIs are made compatible just so we * can cast like this. */ print_48(&par, (struct usbmon_packet *) &hdrb, data_buff); break; case TFMT_1U: print_1u(&par, &hdrb, data_buff); break; default: /* TFMT_HUMAN */ if (start_sec == 0) start_sec = hdrb.ts_sec; hdrb.ts_sec -= start_sec; print_human(&par, &hdrb, data_buff); } } // return 0; } void print_48(const struct params *prm, const struct usbmon_packet *ep, const unsigned char *data) { struct print_cursor pcur; char udir, utype; int data_len, i; int cnt; ssize_t rc; print_start(&pcur, prm->print_buf, prm->print_size); udir = ((ep->epnum & 0x80) != 0) ? 'i' : 'o'; switch (ep->xfer_type & 0x3) { case PIPE_ISOCHRONOUS: utype = 'Z'; break; case PIPE_INTERRUPT: utype = 'I'; break; case PIPE_CONTROL: utype = 'C'; break; default: /* PIPE_BULK */ utype = 'B'; } print_safe(&pcur, "%llx %u %c %c%c:%03u:%02u", (long long) ep->id, (unsigned int)(ep->ts_sec & 0xFFFF) * 1000000 + ep->ts_usec, ep->type, utype, udir, ep->devnum, ep->epnum & 0x7f); if (ep->flag_setup == 0) { /* Setup packet is present and captured */ print_safe(&pcur, " s %02x %02x %04x %04x %04x", ep->setup[0], ep->setup[1], (ep->setup[3] << 8) | ep->setup[2], (ep->setup[5] << 8) | ep->setup[4], (ep->setup[7] << 8) | ep->setup[6]); } else if (ep->flag_setup != '-') { /* Unable to capture setup packet */ print_safe(&pcur, " %c __ __ ____ ____ ____", ep->flag_setup); } else { /* No setup for this kind of URB */ print_safe(&pcur, " %d", ep->status); } print_safe(&pcur, " %d", ep->length); if (ep->length > 0) { if (ep->flag_data == 0) { print_safe(&pcur, " ="); if ((data_len = ep->len_cap) >= DATA_MAX) data_len = DATA_MAX; for (i = 0; i < data_len; i++) { if (i % 4 == 0) { print_safe(&pcur, " "); } print_safe(&pcur, "%02x", data[i]); } print_safe(&pcur, "\n"); } else { print_safe(&pcur, " %c\n", ep->flag_data); } } else { print_safe(&pcur, "\n"); } cnt = print_done(&pcur); if ((rc = write(1, prm->print_buf, cnt)) < cnt) { if (rc < 0) { fprintf(stderr, TAG ": Write error: %s\n", strerror(errno)); } else { fprintf(stderr, TAG ": Short write\n"); } exit(1); } } void print_1u(const struct params *prm, const struct usbmon_packet_1 *ep, const unsigned char *data) { struct print_cursor pcur; char udir, utype; int data_len, i; int ndesc; /* Display this many */ const struct usbmon_isodesc *dp; int cnt; ssize_t rc; print_start(&pcur, prm->print_buf, prm->print_size); if ((data_len = ep->len_cap) < 0) { /* Overflow */ data_len = 0; } udir = ((ep->epnum & 0x80) != 0) ? 'i' : 'o'; switch (ep->xfer_type & 0x3) { case PIPE_ISOCHRONOUS: utype = 'Z'; break; case PIPE_INTERRUPT: utype = 'I'; break; case PIPE_CONTROL: utype = 'C'; break; default: /* PIPE_BULK */ utype = 'B'; } print_safe(&pcur, "%llx %u %c %c%c:%u:%03u:%u", (long long) ep->id, (unsigned int)(ep->ts_sec & 0xFFFF) * 1000000 + ep->ts_usec, ep->type, utype, udir, ep->busnum, ep->devnum, ep->epnum & 0x7f); if (ep->type == 'E') { print_safe(&pcur, " %d", ep->status); } else { if (ep->flag_setup == 0) { /* Setup packet is present and captured */ print_safe(&pcur, " s %02x %02x %04x %04x %04x", ep->s.setup[0], ep->s.setup[1], (ep->s.setup[3] << 8) | ep->s.setup[2], (ep->s.setup[5] << 8) | ep->s.setup[4], (ep->s.setup[7] << 8) | ep->s.setup[6]); } else if (ep->flag_setup != '-') { /* Unable to capture setup packet */ print_safe(&pcur, " %c __ __ ____ ____ ____", ep->flag_setup); } else { /* No setup for this kind of URB */ print_safe(&pcur, " %d", ep->status); if (usb_typeisoc(ep->xfer_type) || usb_typeint(ep->xfer_type)) { print_safe(&pcur, ":%d", ep->interval); } if (usb_typeisoc(ep->xfer_type)) { print_safe(&pcur, ":%d", ep->start_frame); if (ep->type == 'C') { print_safe(&pcur, ":%d", ep->s.iso.error_count); } } } if (usb_typeisoc(ep->xfer_type)) { /* * This is the number of descriptors used by HC. */ print_safe(&pcur, " %d", ep->s.iso.numdesc); /* * This is the number of descriptors which we print. */ ndesc = ep->ndesc; if (ndesc > ISODESC_MAX) ndesc = ISODESC_MAX; if (ndesc * sizeof(struct usbmon_isodesc) > data_len) { ndesc = data_len / sizeof(struct usbmon_isodesc); } /* This is aligned by malloc */ dp = (struct usbmon_isodesc *) data; for (i = 0; i < ndesc; i++) { print_safe(&pcur, " %d:%u:%u", dp->iso_stat, dp->iso_off, dp->iso_len); dp++; } /* * The number of descriptors captured is used to * find where the data starts. */ ndesc = ep->ndesc; if (ndesc * sizeof(struct usbmon_isodesc) > data_len) { data_len = 0; } else { data += ndesc * sizeof(struct usbmon_isodesc); data_len -= ndesc * sizeof(struct usbmon_isodesc); } } } print_safe(&pcur, " %d", ep->length); if (ep->length > 0) { if (ep->flag_data == 0) { print_safe(&pcur, " ="); if (data_len >= prm->data_max) data_len = prm->data_max; for (i = 0; i < data_len; i++) { if (i % 4 == 0) { print_safe(&pcur, " "); } print_safe(&pcur, "%02x", data[i]); } print_safe(&pcur, "\n"); } else { print_safe(&pcur, " %c\n", ep->flag_data); } } else { print_safe(&pcur, "\n"); } cnt = print_done(&pcur); if ((rc = write(1, prm->print_buf, cnt)) < cnt) { if (rc < 0) { fprintf(stderr, TAG ": Write error: %s\n", strerror(errno)); } else { fprintf(stderr, TAG ": Short write\n"); } exit(1); } } void print_human(const struct params *prm, const struct usbmon_packet_1 *ep, const unsigned char *data) { struct print_cursor pcur; char udir, utype; int data_len, i; int ndesc; /* Display this many */ const struct usbmon_isodesc *dp; int cnt; ssize_t rc; print_start(&pcur, prm->print_buf, prm->print_size); if ((data_len = ep->len_cap) < 0) { /* Overflow */ data_len = 0; } #if 0 enum { TAG_BUF_SIZE = 17 }; char tag_buf[TAG_BUF_SIZE]; print_human_tag(tag_buf, TAG_BUF_SIZE, prm->tagp, ep); #endif /* * We cast into a truncated type for readability. * The danger of collisions is negligible. */ print_safe(&pcur, "%08x", (unsigned int) ep->id); udir = ((ep->epnum & 0x80) != 0) ? 'i' : 'o'; switch (ep->xfer_type & 0x3) { case PIPE_ISOCHRONOUS: utype = 'Z'; break; case PIPE_INTERRUPT: utype = 'I'; break; case PIPE_CONTROL: utype = 'C'; break; default: /* PIPE_BULK */ utype = 'B'; } print_safe(&pcur, " %u.%06u %c %c%c:%u:%03u:%u", (unsigned int)ep->ts_sec, ep->ts_usec, ep->type, utype, udir, ep->busnum, ep->devnum, ep->epnum & 0x7f); if (ep->type == 'E') { print_safe(&pcur, " %d", ep->status); } else { if (ep->flag_setup == 0) { /* Setup packet is present and captured */ print_safe(&pcur, " s %02x %02x %04x %04x %04x", ep->s.setup[0], ep->s.setup[1], (ep->s.setup[3] << 8) | ep->s.setup[2], (ep->s.setup[5] << 8) | ep->s.setup[4], (ep->s.setup[7] << 8) | ep->s.setup[6]); } else if (ep->flag_setup != '-') { /* Unable to capture setup packet */ print_safe(&pcur, " %c __ __ ____ ____ ____", ep->flag_setup); } else { /* No setup for this kind of URB */ if (ep->type == 'S' && ep->status == -EINPROGRESS) { print_safe(&pcur, " -"); } else { print_safe(&pcur, " %d", ep->status); } if (usb_typeisoc(ep->xfer_type) || usb_typeint(ep->xfer_type)) { print_safe(&pcur, ":%d", ep->interval); } if (usb_typeisoc(ep->xfer_type)) { print_safe(&pcur, ":%d", ep->start_frame); if (ep->type == 'C') { print_safe(&pcur, ":%d", ep->s.iso.error_count); } } } if (usb_typeisoc(ep->xfer_type)) { /* * This is the number of descriptors used by HC. */ print_safe(&pcur, " %d", ep->s.iso.numdesc); /* * This is the number of descriptors which we print. */ ndesc = ep->ndesc; if (ndesc > ISODESC_MAX) ndesc = ISODESC_MAX; if (ndesc * sizeof(struct usbmon_isodesc) > data_len) { ndesc = data_len / sizeof(struct usbmon_isodesc); } /* This is aligned by malloc */ dp = (struct usbmon_isodesc *) data; for (i = 0; i < ndesc; i++) { print_safe(&pcur, " %d:%u:%u", dp->iso_stat, dp->iso_off, dp->iso_len); dp++; } /* * The number of descriptors captured is used to * find where the data starts. */ ndesc = ep->ndesc; if (ndesc * sizeof(struct usbmon_isodesc) > data_len) { data_len = 0; } else { data += ndesc * sizeof(struct usbmon_isodesc); data_len -= ndesc * sizeof(struct usbmon_isodesc); } } } print_safe(&pcur, " %d", ep->length); if (ep->length > 0) { if (ep->flag_data == 0) { print_safe(&pcur, " ="); if (data_len >= prm->data_max) data_len = prm->data_max; for (i = 0; i < data_len; i++) { if (i % 4 == 0) { print_safe(&pcur, " "); } print_safe(&pcur, "%02x", data[i]); } print_safe(&pcur, "\n"); } else { print_safe(&pcur, " %c\n", ep->flag_data); } } else { print_safe(&pcur, "\n"); } cnt = print_done(&pcur); if ((rc = write(1, prm->print_buf, cnt)) < cnt) { if (rc < 0) { fprintf(stderr, TAG ": Write error: %s\n", strerror(errno)); } else { fprintf(stderr, TAG ": Short write\n"); } exit(1); } } /* * This code works perfectly, but it's a stupendously bad idea. The reason is, * everyone doing any serious investigation uses a text editor. And in such * a case, omitting a variable size prefix from a tag makes searching hard. * Hit "*" in vim to highlight identical tags. */ #if 0 struct tag_state { uint64_t common_bits; unsigned int mask_length; /* Mask for common_bits */ char format[sizeof("..%0NNllx")]; }; /* * Print a usbmon event tag into a buffer. */ static void print_human_tag(char *tag_buf, int tag_buf_size, struct tag_state *p, const struct usbmon_packet_1 *ep) { uint64_t mask = (~(uint64_t)0) << (64 - p->mask_length); if (p->common_bits == 0) { snprintf(tag_buf, tag_buf_size, "%016llx", (long long) ep->id); p->common_bits = ep->id; p->mask_length = 48; sprintf(p->format, "..%%0%dllx", (64 - p->mask_length) / 4); return; } if ((ep->id & mask) != (p->common_bits & mask)) { while ((ep->id & mask) != (p->common_bits & mask) && p->mask_length != 0) { mask <<= 8; p->mask_length -= 8; } if (p->mask_length != 0) { sprintf(p->format, "..%%0%dllx", (64 - p->mask_length) / 4); } else { strcpy(p->format, "%016llx"); } } snprintf(tag_buf, tag_buf_size, p->format, (long long) ep->id & ~mask); } #endif static void print_start(struct print_cursor *t, char *buf, int size0) { t->pbuf = buf; t->size = size0; t->count = 0; } static void print_safe(struct print_cursor *t, const char *fmt, ...) { va_list ap; int len; if (t->count+1 >= t->size) return; va_start(ap, fmt); len = vsnprintf(t->pbuf + t->count, t->size - t->count, fmt, ap); t->count += len; va_end(ap); } static int print_done(struct print_cursor *t) { return t->count; } void parse_params(struct params *p, char **argv) { char *arg; long num; memset(p, 0, sizeof(struct params)); p->data_max = DATA_MAX; /* Same as 1t text API. */ p->format = TFMT_HUMAN; p->api = API_ANY; while ((arg = *argv++) != NULL) { if (arg[0] == '-') { if (arg[1] == 0) Usage(); switch (arg[1]) { case 'i': if (arg[2] != 0) Usage(); if ((arg = *argv++) == NULL) Usage(); if (strncmp(arg, "usb", 3) == 0) arg += 3; if (!isdigit(arg[0])) Usage(); errno = 0; num = strtol(arg, NULL, 10); if (errno != 0) Usage(); if (num < 0 || num >= 128) { fprintf(stderr, TAG ": Bus number %ld" " is out of bounds\n", num); exit(2); } p->ifnum = num; break; case 'f': switch (arg[2]) { case '0': p->format = TFMT_OLD; break; case 'u': p->format = TFMT_1U; break; case 'h': p->format = TFMT_HUMAN; break; default: Usage(); } break; case 'a': switch (arg[2]) { case '0': p->api = API_B0; break; case '1': p->api = API_B1; break; default: Usage(); } break; case 's': if (arg[2] != 0) Usage(); if ((arg = *argv++) == NULL) Usage(); if (!isdigit(arg[0])) Usage(); errno = 0; num = strtol(arg, NULL, 10); if (errno != 0) Usage(); if (num < 0) { fprintf(stderr, TAG ": negative size %ld\n", num); exit(1); } p->data_max = num; break; default: Usage(); } } else { Usage(); } } if (p->data_size == 0) { p->data_size = p->data_max + 96; } if (p->devname == NULL) { if ((p->devname = malloc(100)) == NULL) { fprintf(stderr, TAG ": No core\n"); exit(1); } snprintf(p->devname, 100, "/dev/usbmon%d", p->ifnum); } if (p->format == TFMT_1U) p->api = API_B1; /* * This is somewhat approximate, but seems like not overflowing. * We cannot rely on print_safe, because when it triggers it violates * the documented output format. It only exists to prevent crashes. */ if (p->format == TFMT_OLD) { if (p->data_max != DATA_MAX) { fprintf(stderr, TAG ": -f0 requires -s 32\n"); exit(1); } p->print_size = 160; } else { p->print_size = 100; p->print_size += (p->data_max+3)/4 * 9; p->print_size += 10 + ISODESC_MAX*26; /* " %d:%u:%u" */ } if ((p->print_buf = malloc(p->print_size)) == NULL) { fprintf(stderr, TAG ": No core\n"); exit(1); } } void make_device(const struct params *p) { int major; dev_t dev; major = find_major(); dev = makedev(major, p->ifnum); if (mknod(p->devname, S_IFCHR|S_IRUSR|S_IWUSR, dev) != 0) { fprintf(stderr, TAG ": Can't make device %s: %s\n", p->devname, strerror(errno)); exit(1); } } int find_major(void) { long num; FILE *df; enum { LEN = 50 }; char buff[LEN], c, *p; char *major, *mname; if ((df = fopen("/proc/devices", "r")) == NULL) { fprintf(stderr, TAG ": Can't open /proc/devices\n"); exit(1); } num = -1; while (fgets(buff, LEN, df) != NULL) { p = buff; major = NULL; mname = NULL; for (p = buff; (c = *p) != 0; p++) { if (major == NULL) { if (c != ' ') { major = p; } } else if (mname == NULL) { if (!isdigit(c) && c != ' ') { mname = p; } } else { if (c == '\n') { *p = 0; break; } } } if (major != NULL && mname != NULL) { if (strcmp(mname, "usbmon") == 0) { errno = 0; num = strtol(major, NULL, 10); if (errno != 0) { fprintf(stderr, TAG ": Syntax error " "in /proc/devices\n"); exit(1); } break; } } } fclose(df); if (num == -1) { fprintf(stderr, TAG ": Can't find usbmon in /proc/devices\n"); exit(1); } if (num <= 0 || num > INT_MAX) { fprintf(stderr, TAG ": Weird major %ld in /proc/devices\n", num); exit(1); } return (int) num; } void Usage(void) { fprintf(stderr, "Usage: " "usbmon [-i usbN] [-f0|-fu|-fh] [-a0|-a1] [-s len]\n"); exit(2); }