Hi Guy, For the initial release I’m planning to use 0x0100 for the bcdVersion. All length values are in bytes.
tAppleUSBHostPacketFilterRequestType doesn’t exist in public domain at this point. It tracks when a request was enqueued and when it completed and it is defined as follows: enum tAppleUSBHostPacketFilterRequestType { kAppleUSBHostPacketFilterRequestSubmit = 0, kAppleUSBHostPacketFilterRequestComplete = 1 }; The deviceSpeed is an enumerated value defined in IOUSBHostFamily.h enum { kUSBHostConnectionSpeedLow = 0, kUSBHostConnectionSpeedFull = 1, kUSBHostConnectionSpeedHigh = 2, kUSBHostConnectionSpeedSuper = 3, kUSBHostConnectionSpeedSuperPlus = 4, kUSBHostConnectionSpeedCount = 5 }; The deviceAddress is the 7-bit USB device address as you described. The endpointAddress encodes both number and direction in the same manor as the bEndpointAddress field of an endpoint descriptor as described in section 9.6.6 of the USB 2.0 spec. The endpointType is an enumerated value defined in IOUSBHostFamily.h and corresponds to the transfer type portion of the bmAttributes field of an endpoint descriptor. enum tEndpointType { kEndpointTypeControl = (kEndpointDescriptorTransferTypeControl >> kEndpointDescriptorTransferTypePhase), kEndpointTypeIsochronous = (kEndpointDescriptorTransferTypeIsochronous >> kEndpointDescriptorTransferTypePhase), kEndpointTypeBulk = (kEndpointDescriptorTransferTypeBulk >> kEndpointDescriptorTransferTypePhase), kEndpointTypeInterrupt = (kEndpointDescriptorTransferTypeInterrupt >> kEndpointDescriptorTransferTypePhase) }; which evaluates to: enum tEndpointType { kEndpointTypeControl = 0, kEndpointTypeIsochronous = 1, kEndpointTypeBulk = 2, kEndpointTypeInterrupt = 3 }; The additional information is indeed expected to increase the header length and bcdVersion should it ever be required. Correct, the captured data would be the data field of a usb packet as described in section 8.3.4. Finally, the multi-byte fields are currently enforced to be little-endian but this can be changed to big or host if desired. —scott > On Dec 9, 2016, at 5:40 PM, Guy Harris <g...@alum.mit.edu> wrote: > > On Dec 9, 2016, at 1:37 PM, Scott Deandrea <sdeand...@apple.com> wrote: > >> The link-layer header format is as follows: >> struct >> { >> // Control information >> uint16_t bcdVersion; // version of this structure > > What's the current version? 0, 1, or something else? > >> uint8_t headerLength; // length of this structure > > Presumably length in bytes. > >> uint8_t requestType; // tAppleUSBHostPacketFilterRequestType > > So what are the possible values for requestType? (I don't see > tAppleUSBHostPacketFilterRequestType anywhere in the public XNU source or any > header from Xcode.) > >> // Transfer information >> uint32_t ioLength; // amount of data requested/transferred > > Presumably length in bytes. > >> uint32_t ioStatus; // IOReturn >> uint32_t ioFrameCount; // number of isoch frames following >> uint64_t ioID; // unique id for this I/O >> >> // Device information >> uint32_t deviceLocation; // locationID of the device >> uint8_t deviceSpeed; // tEndpointSpeed > > Is this an enumerated value, a bits/second value, or something else? > >> uint8_t deviceAddress; // tUSBHostDeviceAddress > > So that's just a standard 7-bit USB device address, presumably, as per the > USB 3.1 spec: > > A 7-bit value representing the address of a device on the USB. The > device address is the default address (00H) when the USB device is first > powered or the device is reset. Devices are assigned a unique device address > by the USB system software. > > with the 8th bit zero? > >> uint8_t endpointAddress; // Address and Direction > > So that's the endpoint in the lower 4 bits, and the direction somewhere in > the upper 4 bits? What are the representations for IN and OUT? > >> uint8_t endpointType; // tEndpointType > > So what are the values for bulk, control, interrupt, and isochronous? > >> // Additional information > > So the additional information's presence would be indicated by a greater > headerLength and possibly also by a different bcdVersion value? > >> } __attribute__((packed, aligned(sizeof(uint32_t)))); >> >> The packet payload is the raw USB data that was sent/received for I/O >> request. > > So that would be the "data field" from section 8.3.4 "Data Field" from the > USB 2.0 spec and the DWORDs following the 16-byte header from the USB 3.1 > spec? _______________________________________________ tcpdump-workers mailing list tcpdump-workers@lists.tcpdump.org https://lists.sandelman.ca/mailman/listinfo/tcpdump-workers