static int
safe_read (void *data, size_t length, FILE* file)
{
	int status = fread(data, length, 1, file);
 
	if (status == -1) error_report("%s: read packet (%lu) data on stream %p "
								   "failed (%d): %s",
								   __FUNCTION__, length, file,
								   status, strerror(errno));
	status = fflush(file);
	return status;
}
 
static int
safe_write (void *data, size_t length, FILE* file)
{
	int status = fwrite(data, length, 1, file);
 
	if (status == -1) error_report("%s: writing packet (%lu) data on stream %p "
								   "failed (%d): %s",
								   __FUNCTION__, length, file,
								   status, strerror(errno));
	status = fflush(file);
	return status;
}

Now you might want to deduplicate the code and make it one big and two small functions:

 
static int
safe_operation (size_t (func) (void *, size_t, size_t, FILE*), void *data, size_t length, FILE* file)
{
	int status = func(data, length, 1, file);
	const char *funcstr = "undeclared";
 
//	switch (*func) {
//		case fread:
//			funcstr = "read";
//			break;
//		case fwrite:
//			funcstr = "write";
//			break;
//		default:
//			funcstr = "?";
//			break;
//	}
 
	if (status == -1) error_report("%s: %s (%p) packet (%lu) data on stream %p "
								   "failed (%d): %s",
								   __FUNCTION__, funcstr, *func, length, file,
								   status, strerror(errno));
	status = fflush(file);
	return status;
}

but it wouldn’t compile because fread and fwrite have slightly different signatures.
The solution is to:

 
typedef size_t (*fwrite_fn)(const void * __restrict, size_t, size_t, FILE * __restrict);
 
static int
safe_operation (fwrite_fn func, void *data, size_t length, FILE* file)
{
        int status = func(data, length, 1, file);
        const char *funcstr = "undeclared";
 
        if (status == -1) error_report("%s: %s (%p) packet (%lu) data on stream %p "
                                                                   "failed (%d): %s",
                                                                   __FUNCTION__, funcstr, *func, length, file,
                                                                   status, strerror(errno));
        status = fflush(file);
        return status;
}
 
int
main(void)
{
        int x;
 
        safe_operation((fwrite_fn)fread, &x, sizeof x, stderr);
        safe_operation(fwrite, &x, sizeof x, stderr);
        return 0;
}

Thanks to Roland for pointing that out.

muelli@bigbox ~/git/linux-2.6 $ time make 
  CHK     include/linux/version.h
  CHK     include/generated/utsrelease.h
  CALL    scripts/checksyscalls.sh
  CHK     include/generated/compile.h
  CHK     include/linux/version.h
make[2]: `scripts/unifdef' is up to date.
  TEST    posttest
Succeed: decoded and checked 1382728 instructions
Kernel: arch/x86/boot/bzImage is ready  (#14)
  Building modules, stage 2.
  MODPOST 2107 modules
WARNING: modpost: Found 4 section mismatch(es).
To see full details build your kernel with:
'make CONFIG_DEBUG_SECTION_MISMATCH=y'

real	14m7.842s
user	1m33.747s
sys	0m25.388s
muelli@bigbox ~/git/linux-2.6 $ 

I then threw together this shellscript:

##!/bin/bash
 
MOD_DIR=/tmp/linux-modules/
FAT_IMAGE=/tmp/modules.$$.fat
FAT_MOUNT=/tmp/share/
FAT_TARGET_IMAGE=/tmp/modules.fat
 
make modules_install INSTALL_MOD_PATH="$MOD_DIR" &&
 
bytes=$(( $(du -s $MOD_DIR | awk '{print $1}') + $(( 20 * 1024)) ))
#
# create FAT image
dd if=/dev/zero of=$FAT_IMAGE bs=1024 count=$bytes &&
mkfs.vfat $FAT_IMAGE &&
fusefat -o nonempty -o rw+ $FAT_IMAGE $FAT_MOUNT &&
cp -dRx $MOD_DIR/* $FAT_MOUNT
fusermount -u $FAT_MOUNT &&
echo $FAT_IMAGE &&
ln -sf $FAT_IMAGE $FAT_TARGET_IMAGE

and I start qemu like that:

/opt/muelli/qemu/bin/qemu-system-x86_64 -drive file=/tmp/ubuntu-snapshots.qcow2,if=virtio -kernel ~/git/linux-2.6/arch/x86_64/boot/bzImage -append 'selinux=0 root=/dev/vda init=/sbin/init' -m 1G -drive file=/tmp/modules.fat,if=virtio,readonly=on -monitor stdio -loadvm 1

which allows me to access the module on the FAT drive on /dev/vdb. I can also snapshot the booted machine which saves me an awful lot of time for booting. But it took me quite a while to make QEmu do that, because the snapshot parameter for the disk does not save snapshots! Also, the FAT drive has to marked as readonly for QEmu to only save snapshots on the only remaining writable drive. But QEmu fails to make a drive readonly if the selected interface is IDE. Thus, you need virtio… Thanks to the helpful folks on IRC…

• Rhythmbox crashed again (hacking without music is dreadful)
• Weird SELinux problems after resuming from suspend

I hope the video works. If it doesn’t, please download first. So we can replace packets on the fly, in and out. And of course, you could design a more complex scenario: Let the first read pass by unmodified but after that modify the packets.

typedef struct pcap_hdr_s {
        guint32 magic_number;   /* magic number */
        guint16 version_major;  /* major version number */
        guint16 version_minor;  /* minor version number */
        gint32  thiszone;       /* GMT to local correction */
        guint32 sigfigs;        /* accuracy of timestamps */
        guint32 snaplen;        /* max length of captured packets, in octets */
        guint32 network;        /* data link type */
} pcap_hdr_t;

Wirehsark dumps the following:

0000000: d4 c3 b2 a1 02 00 04 00 00 00 00 00 00 00 00 00  ................
0000010: ff ff 00 00 dc 00 00 00 43 8e 44 4c d7 96 05 00  ........C.DL....

So I might be able to implement saving to PCap at some stage.

muelli@bigbox ~/git/qemu $ git rebase setup_fds 
First, rewinding head to replay your work on top of it...
Applying: Temporary migration to usb_packet_filter_setup_fds
Using index info to reconstruct a base tree...
Falling back to patching base and 3-way merge...
Auto-merging usb-linux.c
CONFLICT (content): Merge conflict in usb-linux.c
Failed to merge in the changes.
Patch failed at 0001 Temporary migration to usb_packet_filter_setup_fds

When you have resolved this problem run "git rebase --continue".
If you would prefer to skip this patch, instead run "git rebase --skip".
To restore the original branch and stop rebasing run "git rebase --abort".


muelli@bigbox ~/git/qemu $ nano usb-linux.c # hack hack hack
muelli@bigbox ~/git/qemu $ git add usb-linux.c
muelli@bigbox ~/git/qemu $ git rebase --continue
Applying: Temporary migration to usb_packet_filter_setup_fds
No changes - did you forget to use 'git add'?

When you have resolved this problem run "git rebase --continue".
If you would prefer to skip this patch, instead run "git rebase --skip".
To restore the original branch and stop rebasing run "git rebase --abort".

muelli@bigbox ~/git/qemu $ 

WTF?!

That one is brilliant, too:

muelli@bigbox ~/git/qemu $ git rebase -i setup_fds
# Stupid me: I selected "f" for the very first entry in that edit window
Cannot 'fixup' without a previous commit
# Fair enough, let me restart then:
muelli@bigbox ~/git/qemu $ git rebase setup_fds 
Interactive rebase already started
# O_o WTF? What else, besides aborting, could I possibly do anyway?!
muelli@bigbox ~/git/qemu $ git rebase --abort
muelli@bigbox ~/git/qemu $ git rebase setup_fds 
# Now it works...

That replace filter produced interesting results. I replaced every “A” transmitted by a “B”. On the host, I created a file on a mass storage with 4KB “A”s. When “cat”ting the file from the guest, I saw “A”s. But copying the file in the guest resulted in the new file having all “B”s. I expected the “cat” showing all “B”s, too. And as far as I can see, the “A”s are actually replaced for the “cat”.

Of course, Istanbul crashed while trying to make that screencast.
Note that the filter code actually changed by now, not only because I enhanced the protocol (in the version you’re seeing, only USB payload is exchanged. In the new version, also the PID, device address and device endpoint are filtered) but also because I refactored the communication bits into a USBPacket class.
I missed to show the pen drive from the host point of view after having copied the file in the guest, but the “bbbb” file is full of “B”s.