Upper filter driver on xHCI stack doesn't work

Ramanagouda_patil · June 21, 2016, 2:39pm

Hi,

I implemented Upper filter driver for our device which exposes itself as Hub and upon sending Vendor Commands it enables built-in device on port 1.

I could make it working on windows USB 2.0 stack but same driver when loaded on USB 3.0 Stack my vendor commands are not reaching my device. I am sending my vendor command URBs in IOCTL_INTERNAL_USB_SUBMIT_URB to lower driver.

Do we have to do special handling on USB 3.0 stack? Can that be the reason for my driver not working on xHCI stack on windows 10?

Patil

Doron_Holan · June 21, 2016, 2:53pm

Where in the in the stack is your filter? On the PDO of the device attached to the bus? Or are you filtering the controller or root hub stacks?

-----Original Message-----
From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of xxxxx@yahoo.com
Sent: Tuesday, June 21, 2016 11:39 AM
To: Windows System Software Devs Interest List
Subject: [ntdev] Upper filter driver on xHCI stack doesn’t work

Hi,

I implemented Upper filter driver for our device which exposes itself as Hub and upon sending Vendor Commands it enables built-in device on port 1.

I could make it working on windows USB 2.0 stack but same driver when loaded on USB 3.0 Stack my vendor commands are not reaching my device. I am sending my vendor command URBs in IOCTL_INTERNAL_USB_SUBMIT_URB to lower driver.

Do we have to do special handling on USB 3.0 stack? Can that be the reason for my driver not working on xHCI stack on windows 10?

Patil

—
NTDEV is sponsored by OSR

Visit the list online at: http:

MONTHLY seminars on crash dump analysis, WDF, Windows internals and software drivers!
Details at http:

To unsubscribe, visit the List Server section of OSR Online at http:</http:></http:></http:>

Ramanagouda_patil · June 21, 2016, 3:04pm

Hi Doron,

My driver is Upper filter which is filtering my hub device on Root Hub stacks.

Patil

Ramanagouda_patil · June 22, 2016, 2:15am

Hi Doron,

i am attaching WinDbg output for my driver HubFltUpClsDrv.

2: kd> !devobj 0x9335d8d8
Device object (9335d8d8) is for:
\Driver\USBHUB3 DriverObject 8cacb030
Current Irp 00000000 RefCount 0 Type 00000022 Flags 00002804
Dacl 87d0aeb8 DevExt 8dbf77a8 DevObjExt 9335d9b0
ExtensionFlags (0x00000800) DOE_DEFAULT_SD_PRESENT
Characteristics (0x00000100) FILE_DEVICE_SECURE_OPEN
AttachedDevice (Upper) 90d7e2f8 \Driver\HubFltUpClsDrv
AttachedTo (Lower) 8bc30718 \Driver\ACPI
Device queue is not busy.
2: kd> !devobj 0xc4a12790
Device object (c4a12790) is for:
USBPDO-8 \Driver\USBHUB3 DriverObject 8cacb030
Current Irp 00000000 RefCount 0 Type 00000022 Flags 00003044
Dacl 8c126d10 DevExt 89ce7820 DevObjExt c4a12868 DevNode 8d467bc8
ExtensionFlags (0000000000)
Characteristics (0x00000100) FILE_DEVICE_SECURE_OPEN
AttachedDevice (Upper) 8bc30718 \Driver\ACPI
Device queue is not busy.

My driver is sitting atop USB3 hub as filter.

Thanks,
Patil

Tim_Roberts · June 22, 2016, 12:32pm

xxxxx@yahoo.com wrote:

i am attaching WinDbg output for my driver HubFltUpClsDrv.

2: kd> !devobj 0x9335d8d8
Device object (9335d8d8) is for:
\Driver\USBHUB3 DriverObject 8cacb030
Current Irp 00000000 RefCount 0 Type 00000022 Flags 00002804
Dacl 87d0aeb8 DevExt 8dbf77a8 DevObjExt 9335d9b0
ExtensionFlags (0x00000800) DOE_DEFAULT_SD_PRESENT
Characteristics (0x00000100) FILE_DEVICE_SECURE_OPEN
AttachedDevice (Upper) 90d7e2f8 \Driver\HubFltUpClsDrv
AttachedTo (Lower) 8bc30718 \Driver\ACPI
Device queue is not busy.
…

My driver is sitting atop USB3 hub as filter.

Yes, but USBHUB3 is sitting on top of ACPI. How is that possible?
USBHUB3 should be sitting on top of either another hub or an XHCI
driver. Is this a real XHCI controller, or is it some faked virtual
controller serving some other purpose?

–
Tim Roberts, xxxxx@probo.com
Providenza & Boekelheide, Inc.

Doron_Holan · June 22, 2016, 12:45pm

Acpi can (invasively) insert itself down stream of the hardware as a bus filter. I don’t know if this is the case here or not, but it is possible

-----Original Message-----
From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of Tim Roberts
Sent: Wednesday, June 22, 2016 9:33 AM
To: Windows System Software Devs Interest List
Subject: Re: [ntdev] Upper filter driver on xHCI stack doesn’t work

xxxxx@yahoo.com wrote:
> i am attaching WinDbg output for my driver HubFltUpClsDrv.
>
> 2: kd> !devobj 0x9335d8d8
> Device object (9335d8d8) is for:
> \Driver\USBHUB3 DriverObject 8cacb030 Current Irp 00000000 RefCount
> 0 Type 00000022 Flags 00002804 Dacl 87d0aeb8 DevExt 8dbf77a8 DevObjExt
> 9335d9b0 ExtensionFlags (0x00000800) DOE_DEFAULT_SD_PRESENT
> Characteristics (0x00000100) FILE_DEVICE_SECURE_OPEN AttachedDevice
> (Upper) 90d7e2f8 \Driver\HubFltUpClsDrv AttachedTo (Lower) 8bc30718
> \Driver\ACPI Device queue is not busy.
> …
>
> My driver is sitting atop USB3 hub as filter.

Yes, but USBHUB3 is sitting on top of ACPI. How is that possible?
USBHUB3 should be sitting on top of either another hub or an XHCI driver. Is this a real XHCI controller, or is it some faked virtual controller serving some other purpose?

–
Tim Roberts, xxxxx@probo.com
Providenza & Boekelheide, Inc.

—
NTDEV is sponsored by OSR

Visit the list online at: http:

MONTHLY seminars on crash dump analysis, WDF, Windows internals and software drivers!
Details at http:

To unsubscribe, visit the List Server section of OSR Online at http:</http:></http:></http:>

JiaBang_Lin · June 22, 2016, 11:01pm

>

Yes, but USBHUB3 is sitting on top of ACPI. How is that possible?
USBHUB3 should be sitting on top of either another hub or an XHCI
driver. Is this a real XHCI controller, or is it some faked virtual
controller serving some other purpose?

yes, it is how it is when the XHC is built-in to motherboard, and the BIOS
advertises its existence in one of the ACPI tables .
Microsoft mentioned “Bus Filter Driver”, and did not give details on how
bus filter driver works. I learned this when I was working on my first “bus
filter driver”.

Ramanagouda_patil · July 13, 2016, 3:29pm

Hi Doron,

I am refering to your article on “Formatting a WDFREQUEST for any IRP_MJ code” to send vendor commands on MS USB 2.0 stack to my custom Hub device (my driver is Hub device filter) which works fine. but same doesn’t work for USB 3.0 stack on windows 10.

I am wondering do i need to use new “URB Allocation APIs in Windows 8” such as USBD_UrbAllocate and others to send IOCTL_INTERNAL_USB_SUBMIT_URB to my Hub device.

Following is the windbg output on USB 3.0 stack in windows 10. My device is USB 2.0 custom Hub(my driver is Hub device filter)

2: kd> !usb3kd.device_info 0xc9c20068

Dumping Device Information c9c20068

dt USBHUB3!_DEVICE_CONTEXT 0xc9c20068
dt USBHUB3!_HUB_PDO_CONTEXT 0xfb8c27e8
!idle_info 0xfb8c2814 (dt USBHUB3!_ISM_CONTEXT 0xfb8c2814)
Parent !hub_info 0xb1e68850 (dt USBHUB3!_HUB_FDO_CONTEXT 0xb1e68850)
!hub_info 0x0 (dt USBHUB3!_HUB_FDO_CONTEXT 0x0)
!port_info 0x921ea580 (dt USBHUB3!_PORT_CONTEXT 0x921ea580)
!rcdrlogdump usbhub3 -a 0x90abe740
!ucx_device 0x93978908 !xhci_deviceslots 0x8d686dc0 20 !xhci_info 0x8d686dc0

U1Timeout: 0, U2Timeout: 0
DeviceFlags: DeviceIsHub MsOsDescriptorNotSupported UsbWakeupSupport DeviceSupportsSelectiveSuspend DeviceIsHighSpeedCapable
DeviceStateFlags: DeviceAttachSuccessful DeviceIsKnown ConfigurationIsValid DecorateSerialNumber
ConfigDescIsValid DeviceStarted InstallMSOSExtEventProcessed
DeviceHackFlags: DisableOnSoftRemove

Descriptors:
!configdescriptor 0x95b32270
dt _USB_INTERFACE_DESCRIPTOR 0x95b32279

DeviceDescriptor: VID xxxx PID yyyy REV 0004, Class: (9)Class_UsbHUB BcdUsb: 0200

UcxRequest: !wdfrequest 0x4e1dbc68,
ControlRequest: !wdfrequest 0x6a06f4f8, !irp 0x95b86008 !urb 0xc9c200f0, NumberOfBytes 0
Device working at FullSpeed
Current Device State: ConfiguredSuspended.SuspendedWithHubSuspended.SuspendedInHubSuspend

Device State History: NewState ((),…) :

[61] SuspendedInHubSuspend
[60] SuspendedWithHubSuspended
[59] Suspended
[58] ConfiguredSuspended
[57] ConfiguredSuspending
[56] ReturningOperationSuccessInSuspending
[55] SuspendingWithArmedForWake
[54] PurgingDeviceIoInSuspendingAfterArmingForWake
[53] ArmingDeviceForWake
[52] AbortingDeviceIoInSuspendingBeforeArmingForWakeFailure
[51] CheckingIfDeviceArmedForWakeOnSuspending
[50] ConfiguredSuspending
[49] CheckingIfBootDeviceOnD0Exit
[48] ConfiguredInD0
[47] CheckingIfDeviceHasReceivedFirstStart
[46] CompletingClientRequestInConfigured
[45] SettingConfigurationInformationInClientRequest
[44] ConfiguringOnSelectConfiguration
[43] ReturningOperationSuccessInReConfiguring
[42] ProgrammingEndpointsInControllerForDeviceConfigurationFor20Devices
[41] ProgrammingEndpointsAndSettingLPMValuesrForDeviceConfiguration
[40] CreatingNewEndpoints
[39] CheckingIfAnyAlternateInterfaceLeft
[38] ConfiguringDevice
[37] DeletingEndpointsForOldConfiguration
[36] DeconfiguringEndpointsInControllerForDeviceConfiguration
[35] ConfiguringOnSelectConfiguration
[34] PreparingEndpointAndInterfaceListsOnSelectConfiguration
[33] ValidatingSelectConfigUrbFromUnConfigured
[32] UnConfiguredInD0
[31] CompletingD0EntryInUnconfigured
[30] StoppedEnumerated
[29] WaitingForInstallMSOSExt
[28] SignalingPnpEventForMSOSExtInstall
[27] CheckingIfMsOs20RegistryValuesShouldBeInstalled
[26] CheckingIfMSOSExtendedPropertyDescriptorShouldBeQueried
[25] WaitingForInstallMSOSExt
[24] StoppedEnumerated
[23] AckingPdoPreStart
[22] StoppedEnumerated
[21] WaitingForInstallMSOSExt
[20] SignalingPnpEventForMSOSExtInstall
[19] CheckingIfMsOs20RegistryValuesShouldBeInstalled
[18] CheckingIfMSOSExtendedPropertyDescriptorShouldBeQueried
[17] WaitingForInstallMSOSExt
[16] StoppedEnumerated
[15] AckingPdoPreStart
[14] StoppedEnumerated
[13] WaitingForInstallMSOSExt
[12] StoppedEnumerated
[11] AckingPdoPreStart
[10] StoppedEnumerated
[9] WaitingForInstallMSOSExt
[8] StoppedEnumerated
[7] ReportingDeviceToPnp
[6] ReturningOperationSuccessInReportingToPnp
[5] CreatingChildPDOAndReportingToPnp
[4] AddingDeviceToGlobalChildList
[3] InitializingAddDeviceToGlobalListRetryCount
[2] ReportingDeviceToPnp
[1] ReleasingPowerReferenceOnHubOnDetachOnEnumSuccess
[0] Enumerating
[63] ReturningOperationSuccessInEnum
[62] CheckingIfDevicePDChargingPolicySupported

Device Event History:
[15] HubSuspend
[14] PortSuspended
[13] UCXIoctlSuccess
[12] TransferSuccess
[11] UCXIoctlSuccess
[10] PDOD0Exit
[9] UCXIoctlSuccess
[8] TransferSuccess
[7] UCXIoctlSuccess
[6] ClientRequestSelectConfiguration
[5] PDOD0Entry
[4] PDOInstallMSOSExt
[3] PDOPreStart
[2] PDOInstallMSOSExt
[1] PDOPreStart
[0] PDOPreStart
2: kd> !wdfkd.wdfrequest 0x6a06f4f8
Treating handle as a KMDF handle!
!irp 0x95b86008

State: Allocated by driver, IRP allocated by WDF
!wdfiotarget 0x760d6e80

2: kd> !irp 0x95b86008
Irp is active with 13 stacks 14 is current (= 0x95b8624c)
No Mdl: No System Buffer: Thread 00000000: Irp is completed.
cmd flg cl Device File Completion-Context
[N/A(0), N/A(0)]
0 0 00000000 00000000 00000000-00000000

Args: 00000000 00000000 00000000 00000000
[N/A(0), N/A(0)]
0 0 00000000 00000000 00000000-00000000

Args: 00000000 00000000 00000000 00000000
[N/A(0), N/A(0)]
0 0 00000000 00000000 00000000-00000000

Args: 00000000 00000000 00000000 00000000
[N/A(0), N/A(0)]
0 0 00000000 00000000 00000000-00000000

Args: 00000000 00000000 00000000 00000000
[N/A(0), N/A(0)]
0 0 00000000 00000000 00000000-00000000

Args: 00000000 00000000 00000000 00000000
[N/A(0), N/A(0)]
0 0 00000000 00000000 00000000-00000000

Args: 00000000 00000000 00000000 00000000
[N/A(0), N/A(0)]
0 0 00000000 00000000 00000000-00000000

Args: 00000000 00000000 00000000 00000000
[N/A(0), N/A(0)]
0 0 00000000 00000000 00000000-00000000

Args: 00000000 00000000 00000000 00000000
[N/A(0), N/A(0)]
0 0 00000000 00000000 00000000-00000000

Args: 00000000 00000000 00000000 00000000
[N/A(0), N/A(0)]
0 0 00000000 00000000 00000000-00000000

Args: 00000000 00000000 00000000 00000000
[N/A(0), N/A(0)]
0 0 00000000 00000000 00000000-00000000

Args: 00000000 00000000 00000000 00000000
[N/A(0), N/A(0)]
0 0 00000000 00000000 00000000-00000000

Args: 00000000 00000000 00000000 00000000
[N/A(0), N/A(0)]
0 0 00000000 00000000 00000000-00000000

Args: 00000000 00000000 00000000 00000000

Tim_Roberts · July 13, 2016, 3:59pm

xxxxx@yahoo.com wrote:

I am refering to your article on “Formatting a WDFREQUEST for any IRP_MJ code” to send vendor commands on MS USB 2.0 stack to my custom Hub device (my driver is Hub device filter) which works fine. but same doesn’t work for USB 3.0 stack on windows 10.

What do you mean by “doesn’t work”?

I am wondering do i need to use new “URB Allocation APIs in Windows 8” such as USBD_UrbAllocate and others to send IOCTL_INTERNAL_USB_SUBMIT_URB to my Hub device.

No.

–
Tim Roberts, xxxxx@probo.com
Providenza & Boekelheide, Inc.

Ramanagouda_patil · July 13, 2016, 4:05pm

Hi Tim,

What do you mean by “doesn’t work”?
The Irp is getting cancelled and vendor commands doesn’t reach device.

Thanks,
Patil

Ramanagouda_patil · July 14, 2016, 10:20am

Hi Tim,

What do you mean by “doesn’t work”?
One correction The irp is completing and in completion routine status is STATUS_UNSUCCESSFUL( 0xC000001).

Thanks,
Patil

Tim_Roberts · July 14, 2016, 1:51pm

xxxxx@yahoo.com wrote:

> What do you mean by “doesn’t work”?
One correction The irp is completing and in completion routine status is STATUS_UNSUCCESSFUL( 0xC000001).

What kind of a request are you trying to send? Vendor command to the
control pipe?

Did you notice that your hub has been suspended? Theoretically, if you
are sending requests into the stack as an upper filter, that should
trigger a power up, but there are lots of ways to screw that up. Are
you using KMDF or WDM?

–
Tim Roberts, xxxxx@probo.com
Providenza & Boekelheide, Inc.

Ramanagouda_patil · July 21, 2016, 2:57pm

Tim,

What kind of a request are you trying to send? Vendor command to the
control pipe?

yes i am sending Vendor command to the control pipe.

Did you notice that your hub has been suspended? Theoretically, if you
are sending requests into the stack as an upper filter, that should
trigger a power up, but there are lots of ways to screw that up. Are
you using KMDF or WDM?

No Hub is not suspended and my driver is a KMDF driver. Is there a way to check if Hub is powered up or i can trigger that from filter driver?

Thanks,
Patil

Tim_Roberts · July 21, 2016, 4:03pm

xxxxx@yahoo.com wrote:

> Did you notice that your hub has been suspended?
No Hub is not suspended

Um, yes, it absolutely HAS been suspended. Did you read the dump you
provided originally? Note the “current device state”, and notice the
“device state history”, which appears in reverse time order, with newest
at the top:

UcxRequest: !wdfrequest 0x4e1dbc68,
ControlRequest: !wdfrequest 0x6a06f4f8, !irp 0x95b86008 !urb 0xc9c200f0, NumberOfBytes 0
Device working at FullSpeed
Current Device State: ConfiguredSuspended.SuspendedWithHubSuspended.SuspendedInHubSuspend

Device State History: NewState ((),…) :

[61] SuspendedInHubSuspend
[60] SuspendedWithHubSuspended
[59] Suspended
[58] ConfiguredSuspended
[57] ConfiguredSuspending
[56] ReturningOperationSuccessInSuspending
[55] SuspendingWithArmedForWake
[54] PurgingDeviceIoInSuspendingAfterArmingForWake
[53] ArmingDeviceForWake
[52] AbortingDeviceIoInSuspendingBeforeArmingForWakeFailure
[51] CheckingIfDeviceArmedForWakeOnSuspending
[50] ConfiguredSuspending
[49] CheckingIfBootDeviceOnD0Exit
[48] ConfiguredInD0

Device Event History:
[15] HubSuspend
[14] PortSuspended
[13] UCXIoctlSuccess
[12] TransferSuccess
[11] UCXIoctlSuccess
[10] PDOD0Exit

> is a KMDF driver. Is there a way to check if Hub is powered up or i can trigger that from filter driver?

You should be able to track this yourself from the power manager
callbacks. Sending a vendor command should trigger a wakeup. How are
sending your request, exactly?

–
Tim Roberts, xxxxx@probo.com
Providenza & Boekelheide, Inc.