Since usbview opens a handle to the host controller to enumerate the root
hub, I’m guessing that my driver needs to send the
IOCTL_USB_GET_ROOT_HUB_NAME irp to the HCD fdo.
However, when I do that I get an access violation in
USBD!USBD_CompleteRequest.
Here’s a simplified (sans error-checking) snippet of what my driver does,
followed by the output from !analyze -v:
// Get the name of our host controller, by sending
// IOCTL_INTERNAL_USB_GET_CONTROLLER_NAME irp to our lower device object
UNICODE_STRING HostControllerName;
GetHostControllerName ( pdx_, &HostControllerName );
// Get a pointer to the host controller’s device object
PDEVICE_OBJECT pHCD_FDO = NULL;
PFILE_OBJECT pHCD_FO = NULL;
NTSTATUS status = IoGetDeviceObjectPointer (
&HostControllerName,
GENERIC_ALL,
&pHCD_FDO,
&pHCD_FO );
SIZE_T sztRequiredLength = 0x1000; // <– arbitrary value for this
snippet
// Allocate memory for pstRootHubName
PUSB_ROOT_HUB_NAME pstRootHubName =
(PUSB_ROOT_HUB_NAME) ExAllocatePool ( NonPagedPool,
sztRequiredLength );
RtlZeroMemory ( (PVOID) pstRootHubName, sztRequiredLength );
// Construct the IRP to determine how much memory is needed for the name
// (I’m guessing at what is required for IOCTL_USB_GET_ROOT_HUB_NAME,
// since it’s not documented)
PIRP Irp = IoBuildDeviceIoControlRequest
IOCTL_USB_GET_ROOT_HUB_NAME,
pHCD_FDO,
NULL, 0,
pstRootHubName, sztRequiredLength,
TRUE,
&event,
&iostatus );
// Send it and wait for a response (or the access violation that
// I get instead…)
status = IoCallDriver ( pHCD_FDO, Irp );
****************************************************************************
***
*
*
* Bugcheck Analysis
*
*
*
****************************************************************************
***
Unknown bugcheck code (0)
Unknown bugcheck description
Arguments:
Arg1: 00000000
Arg2: 00000000
Arg3: 00000000
Arg4: 00000000
Debugging Details:
FAULTING_IP:
USBD!USBD_CompleteRequest+18
edf31c1a f6460c02 test byte ptr [esi+0xc],0x2
EXCEPTION_RECORD: ffffffff – (.exr ffffffffffffffff)
ExceptionAddress: edf31c1a (USBD!USBD_CompleteRequest+0x00000018)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000008
NumberParameters: 2
Parameter[0]: 00000000
Parameter[1]: 0000100c
Attempt to read from address 0000100c
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at “0x%08lx”
referenced memory at “0x%08lx”. The memory could not be “%s”.
READ_ADDRESS: 0000100c
BUGCHECK_STR: ACCESS_VIOLATION
DEFAULT_BUCKET_ID: DRIVER_FAULT
LAST_CONTROL_TRANSFER: from edf19534 to edf31c1a
STACK_TEXT:
ee03f8c4 edf19534 a9690f20 00000000 818469e8 USBD!USBD_CompleteRequest+0x18
ee03f8e0 edf18577 81846930 a9690f20 00000000 uhcd!UHCD_CompleteIrp+0xba
ee03f918 80530510 81846930 a9690f20 a9690f20 uhcd!UHCD_Dispatch+0x191
ee03f964 8052fcd5 815a1000 80063124 816b09b0 nt!IovSpecialIrpCallDriver+0xcd
ee03f980 f733d467 81654020 80063124 816b09b0 nt!IovCallDriver+0x31
ee03f9e4 f733c628 81846930 ee03fa1c 81654020 ngpsusb!GetRootHubName+0x18a
[d:\generation4_linda2100d79\osdrivers\2kdriver\ngpsusb\driverentry.cpp @
1174]
ee03fa44 f733326f 816540d8 81654020 80063124 ngpsusb!GetUsbPortId+0x163
[d:\generation4_linda2100d79\osdrivers\2kdriver\ngpsusb\driverentry.cpp @
891]
ee03fb84 f7337168 81654020 81654020 00000000 ngpsusb!StartDevice+0x362
[d:\generation4_linda2100d79\osdrivers\2kdriver\ngpsusb\driverentry.cpp @
480]
ee03fba0 f73355ca 81654020 a9660f00 00000010
ngpsusb!FdoHandleStartDevice+0xb3
[d:\generation4_linda2100d79\osdrivers\2kdriver\ngpsusb\plugplayfdo.cpp @
403]
ee03fbc4 f7335064 81654020 a9660f00 816540d8 ngpsusb!DispatchPnpFdo+0x142
[d:\generation4_linda2100d79\osdrivers\2kdriver\ngpsusb\plugplayfdo.cpp @
152]
ee03fbd8 80530510 81654020 a9660f00 a9660f00 ngpsusb!DispatchPnp+0x72
[d:\generation4_linda2100d79\osdrivers\2kdriver\ngpsusb\plugplay.cpp @ 52]
ee03fc24 804c6521 00020000 8165abe8 00000000 nt!IovSpecialIrpCallDriver+0xcd
ee03fc50 80428bfc 81654020 ee03fc70 ee03fc98 nt!IopSynchronousCall+0xca
ee03fc9c 80491b23 81699810 00000000 8165abe8 nt!IopStartDevice+0x127
ee03fcd0 80491af9 8165abe8 ee03fd24 00000000
nt!IopStartAndEnumerateDevice+0x22
ee03fcf0 804af9a1 8165abe8 ee03fd24 81803b30
nt!IopProcessStartDevicesWorker+0x72
ee03fd0c 804af930 00000000 ee03fd24 8187f1e8 nt!IopProcessStartDevices+0x43
ee03fd30 8042672d 00000000 00000000 00000000 nt!IopBusCheck+0x77
ee03fd78 80418c49 00000000 00000000 00000000 nt!IopDeviceActionWorker+0x3fb
ee03fda8 80454faf 00000000 00000000 00000000 nt!ExpWorkerThread+0xae
ee03fddc 80468ec2 80418b84 00000001 00000000 nt!PspSystemThreadStartup+0x69
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16
FOLLOWUP_IP:
USBD!USBD_CompleteRequest+18
edf31c1a f6460c02 test byte ptr [esi+0xc],0x2
FOLLOWUP_NAME: MachineOwner
SYMBOL_NAME: USBD!USBD_CompleteRequest+18
MODULE_NAME: USBD
IMAGE_NAME: USBD.SYS
DEBUG_FLR_IMAGE_TIMESTAMP: 3a037183
STACK_COMMAND: kb
BUCKET_ID: ACCESS_VIOLATION_USBD!USBD_CompleteRequest+18
Followup: MachineOwner
“Linda Marcellus” wrote in message
news:xxxxx@ntdev…
>
> Hi Mark,
>
> I was expecting STATUS_BUFFER_TOO_SMALL as well, but got STATUS_SUCCESS.
>
> My device is plugged into a hub. I was thinking that the ioctl would
either
> get passed down to
> the nearest hub device object, or it would get passed all the way down to
> the root hub, but I wasn’t
> sure which (I’m new and haven’t yet developed a “ddk intuition”).
>
> Maybe it would be easier if I just told you what I’m trying to do.
>
> My driver is acting like a bus which creates several PDO’s. In response
to
> an IRP_MN_QUERY_ID
> BusQueryDeviceID request, I want to return a device id which uniquely
> indicates which usb port my
> device is plugged into, taking into account daisy-chained hubs.
>
> For instance, if I have two devices plugged into the following tree:
> My Computer
> - VIA USB Universal Host Controller
> - RootHub
> - [Port1] DeviceConnected: Generic USB Hub
> - [Port1] DeviceConnected: My Device
> - [Port2] DeviceConnected: Generic USB Hub
> - [Port1] NoDeviceConnected
> - [Port2] NoDeviceConnected
> - [Port3] NoDeviceConnected
> - [Port4] DeviceConnected: My Device
> - [Port3] NoDeviceConnected
> - [Port4] NoDeviceConnected
> - [Port2] DeviceConnected: Generic USB Hub
>
> My two devices would report device ids ‘UsbPort-111’ and ‘UsbPort-1124’,
> the first digit identfying the controller,
> and the rest providing a path up the tree.
>
> I’m using the usbview source as an example. It uses
> IOCTL_USB_GET_ROOT_HUB_NAME, which isn’t documented (sigh…).
>
> Since I don’t really like relying on undocumented code, I used
> IOCTL_INTERNAL_USB_GET_HUB_NAME instead.
> I tried sending it directly to the HCD but got a DRIVER_FAULT in
> USBD!USBD_CompleteRequest+0x18.
> So then I tried just sending it down the stack, and got STATUS_SUCCESS,
but
> ActualLength of 6.
>
> Stooping to rely on undocumented code, I tried sending
> IOCTL_USB_GET_ROOT_HUB_NAME down the stack, but the status returned was
> STATUS_INVALID_PARAMETER.
> Finally, I tried sending IOCTL_USB_GET_ROOT_HUB_NAME to the HCD as
described
> earlier, but got a DRIVER_FAULT
> as above.
>
> I’m stumped and dead-ended in my development. Where do I go from here?
> Linda
>
> “Roddy, Mark” wrote in message
news:xxxxx@ntdev…
> >
> > I assumed that the status returned was STATUS_BUFFER_TOO_SMALL, is this
> > correct?
> > Also, what version of the OS are you testing agains?
> >
> > Hmmm… Actually I’m guessing that the status returned is STATUS_SUCCESS
> and
> > that in this case you should of course interpret the results as
indicating
> > that the device either is not a hub, or does not have a symbolic link
> name.
> > Isn’t that obvious :-?
> >
> >
> > =====================
> > Mark Roddy
> >
> >
> > > -----Original Message-----
> > > From: Linda Marcellus [mailto:xxxxx@novatel.ca]
> > > Sent: Monday, September 22, 2003 2:13 PM
> > > To: Windows System Software Devs Interest List
> > > Subject: [ntdev] Re: Problem using IOCTL_INTERNAL_USB_GET_HUB_NAME
> > >
> > >
> > > Hi Mark,
> > > Thanks for the response. I was originally using
> > > ActualLength, but it came back as 6 as well.
> > >
> > > So that’s why I thought maybe I was sending it to the wrong
> > > device object. Should I just send it down the stack via my
> > > LowerObject pointer, or should I send it directly to the host
> > > controller (using IOCTL_INTERNAL_USB_GET_CONTROLLER_NAME and
> > > then calling IoGetDeviceObjectPointer()).
> > >
> > > Linda
> > >
> > > “Roddy, Mark” wrote in message
> > > news:xxxxx@ntdev…
> > > >
> > > > Why is IoStatus.Information always 6? Because this would be another
> > > example
> > > > of an undocumented feature, which appears to be todays
> > > theme on NTDEV
> > > > (although html mail is threatening to replace it.)
> > > >
> > > > The value in IoStatus.Information indicates how much valid data is
> > > returned
> > > > in your outputbuffer. That would be sizeof(USB_HUB_NAME).
> > > > USB_HUB_NAME.ActualLength ought to be the value for which you are
> > > > desperately seeking. Intuitively obvious, yes?
> > > >
> > > > I’d suggest that there are no stupid questions, but I think
> > > this list
> > > > has proven this adage to be false 
> > > >
> > > > =====================
> > > > Mark Roddy
> > > >
> > > >
> > > > > -----Original Message-----
> > > > > From: Linda Marcellus [mailto:xxxxx@novatel.ca]
> > > > > Sent: Monday, September 22, 2003 12:05 PM
> > > > > To: Windows System Software Devs Interest List
> > > > > Subject: [ntdev] Re: Problem using IOCTL_INTERNAL_USB_GET_HUB_NAME
> > > > >
> > > > >
> > > > > hmmm… either this was a really stupid question, or nobody knows
> > > > > the answer…
> > > > >
> > > > > “Linda Marcellus” wrote in message
> > > > > news:xxxxx@ntdev…
> > > > > >
> > > > > > I am using IOCTL_INTERNAL_USB_GET_HUB_NAME to get the name
> > > > > of the root
> > > > > > hub my usb device is connected to. I send the ioctl twice,
> > > > > the first
> > > > > > time
> > > > > just
> > > > > > to see how much memory to allocate for the
> > > PUSB_ROOT_HUB_NAME to
> > > > > > be sent with the second call.
> > > > > >
> > > > > > However, the value returned in iostatus.Information is
> > > > > always 6, which
> > > > > > is equivalent to sizeof(USB_ROOT_HUB_NAME).
> > > > > >
> > > > > > I am sending the ioctl to my lower device object as returned by
> > > > > > the IoAttachDeviceToDeviceStack call.
> > > > > >
> > > > > > Is this the correct device object? I tried sending it
> > > > > directly to the
> > > > > > HCD device object, only to be graced with a BSOD.
> > > > > >
> > > > > > Any help would be greatly appreciated!
> > > > > >
> > > > > > Here’s a code snippet of what I’m doing:
> > > > > >
> > > > > > USB_ROOT_HUB_NAME stPartialRootHubName; //
> > > minimally sized
> > > > > > structure used to see how big a structure we need
> > > > > > PUSB_ROOT_HUB_NAME pstFullRootHubName = NULL; // will
> > > > > contain the
> > > > > entire
> > > > > > hub name
> > > > > >
> > > > > > // Zero out stPartialRootHubName
> > > > > >
> > > > > > RtlZeroMemory ( &stPartialRootHubName,
> > > > > sizeof(stPartialRootHubName) );
> > > > > > stPartialRootHubName.ActualLength =
> > > > > > sizeof(stPartialRootHubName);
> > > > > >
> > > > > > // Initialize the event to the non-signalled state
> > > > > >
> > > > > > KeInitializeEvent ( &event, NotificationEvent, FALSE );
> > > > > >
> > > > > > // Construct the IRP to determine how much memory is
> > > > > needed for the
> > > > > name
> > > > > >
> > > > > > Irp = IoBuildDeviceIoControlRequest
> > > > > >
> > > > > > IOCTL_INTERNAL_USB_GET_HUB_NAME,
> > > > > > pFdo_,
> > > > > > NULL, 0,
> > > > > > &stPartialRootHubName,
> > > > > sizeof(stPartialRootHubName),
> > > > > > TRUE,
> > > > > > &event,
> > > > > > &iostatus );
> > > > > >
> > > > > > if ( !Irp )
> > > > > > {
> > > > > > DumpDebug
> > > > > >
> > > > > > DBG_ERROR,
> > > > > > (DRIVERNAME " - Unable to allocate IRP for getting
> > > > > > RootHub
> > > > > > name\n") );
> > > > > > return;
> > > > > > }
> > > > > >
> > > > > > // Send it and wait for a response
> > > > > >
> > > > > > NTSTATUS status = IoCallDriver ( pFdo_, Irp );
> > > > > > if ( status == STATUS_PENDING )
> > > > > > {
> > > > > > KeWaitForSingleObject ( &event, Executive, KernelMode,
> > > > > > FALSE,
> > > > > NULL );
> > > > > > status = iostatus.Status;
> > > > > > }
> > > > > >
> > > > > > ULONG ulBytesNeeded = iostatus.Information; // <– this
> > > > > is always
> > > > > > 6! Why???
> > > > > >
> > > > > >
> > > > > >
> > > > > >
> > > > > >
> > > > > >
> > > > >
> > > > >
> > > > >
> > > > > —
> > > > > Questions? First check the Kernel Driver FAQ at
> > > > http://www.osronline.com/article.cfm?id=256
> > > >
> > > > You are currently subscribed to ntdev as: xxxxx@stratus.com To
> > > > unsubscribe send a blank email to xxxxx@lists.osr.com
> > > >
> > > >
> > >
> > >
> > >
> > > —
> > > Questions? First check the Kernel Driver FAQ at
> > http://www.osronline.com/article.cfm?id=256
> >
> > You are currently subscribed to ntdev as: xxxxx@stratus.com To
> > unsubscribe send a blank email to xxxxx@lists.osr.com
> >
> >
>
>
>
>