WinUSB Control Transfer

NTDEV
1

Hello Guys, We have one USB device whose driver was written in KMDF some years back. Now we are planning to convert it to WinUsb and get rid of driver. Well via WinUsb I am able to get device descriptor and interfaces. We used to copy firmware from our driver to our device. For which we were using below command.

UsbBuildVendorRequest( pUrb,
URB_FUNCTION_VENDOR_DEVICE,
siz,
0,
0,
req, // reguest, ID
value, // Value
index, // Index
fw,
NULL,
fwsize,
NULL
);

WDF_REQUEST_SEND_OPTIONS_INIT(&reqSendOptions,
WDF_REQUEST_SEND_OPTION_TIMEOUT |
WDF_REQUEST_SEND_OPTION_SYNCHRONOUS |
WDF_REQUEST_SEND_OPTION_IGNORE_TARGET_STATE);
reqSendOptions.Timeout = WDF_REL_TIMEOUT_IN_MS(100);

ntStatus = WdfUsbTargetDeviceSendUrbSynchronously(WdfUsbTargetDevice,
NULL,
&reqSendOptions,
pUrb);

Now for this purpose we have written following code

WINUSB_SETUP_PACKET SetupPacket;
SetupPacket.RequestType = 0x40;
SetupPacket.Request = req;
SetupPacket.Index = 0;
SetupPacket.Value = value;
SetupPacket.Length = size;

bResult = WinUsb_ControlTransfer(hDeviceHandle, SetupPacket, fw, size, &cbSent, NULL);

But it returns me an error code of 998 which is “Invalid access to memory location.”
Am I missing something over or am i doing something wrong here?

2

xxxxx@yahoo.co.in wrote:

Hello Guys, We have one USB device whose driver was written in KMDF some years back. Now we are planning to convert it to WinUsb and get rid of driver. Well via WinUsb I am able to get device descriptor and interfaces. We used to copy firmware from our driver to our device. For which we were using below command.
…
Now for this purpose we have written following code

WINUSB_SETUP_PACKET SetupPacket;
SetupPacket.RequestType = 0x40;
SetupPacket.Request = req;
SetupPacket.Index = 0;
SetupPacket.Value = value;
SetupPacket.Length = size;

bResult = WinUsb_ControlTransfer(hDeviceHandle, SetupPacket, fw, size, &cbSent, NULL);

But it returns me an error code of 998 which is “Invalid access to memory location.”
Am I missing something over or am i doing something wrong here?

Well, ERROR_NOACCESS can be used for other access-type errors as well.

How large is “size”? The API is limited to 4k bytes at a time.

–
Tim Roberts, xxxxx@probo.com
Providenza & Boekelheide, Inc.

3

size of exactly 4k (4096)

4

xxxxx@yahoo.co.in wrote:

size of exactly 4k (4096)

Is this for loading an FX2? Perhaps you should show us the entire function.

–
Tim Roberts, xxxxx@probo.com
Providenza & Boekelheide, Inc.

5

This is the function which I had written.

BOOL UploadFW(WINUSB_INTERFACE_HANDLE hDeviceHandle)
{
if (hDeviceHandle == INVALID_HANDLE_VALUE)
{
return FALSE;
}

BOOL bResult = TRUE;

UCHAR *image = (UCHAR *)FwImage;;
ULONG uCodeOfst = 0x200000;
DWORD dwError = 0;
ULONG cbSent = 0;

ULONG translen = 4096;
WINUSB_SETUP_PACKET SetupPacket;
SetupPacket.RequestType = 0x40;
SetupPacket.Request = 0x30;
SetupPacket.Index = 0;
SetupPacket.Value = (USHORT)(uCodeOfst >> 8);
SetupPacket.Length = (USHORT)translen;

bResult = WinUsb_ControlTransfer(hDeviceHandle, SetupPacket, ptr, translen, &cbSent, NULL);
if (!bResult)
{
dwError = GetLastError();
goto done;
}

done:
return bResult;
}

6

Sorry its like this…

BOOL UploadFW(WINUSB_INTERFACE_HANDLE hDeviceHandle)
{
if (hDeviceHandle == INVALID_HANDLE_VALUE)
{
return FALSE;
}

BOOL bResult = TRUE;

UCHAR *image = (UCHAR *)FwImage;;
ULONG uCodeOfst = 0x200000;
DWORD dwError = 0;
ULONG cbSent = 0;

ULONG translen = 4096;
WINUSB_SETUP_PACKET SetupPacket;
SetupPacket.RequestType = 0x40;
SetupPacket.Request = 0x30;
SetupPacket.Index = 0;
SetupPacket.Value = (USHORT)(uCodeOfst >> 8);
SetupPacket.Length = (USHORT)translen;

bResult = WinUsb_ControlTransfer(hDeviceHandle, SetupPacket, image, translen,
&cbSent, NULL);
if (!bResult)
{
dwError = GetLastError();
goto done;
}

done:
return bResult;
}

7

xxxxx@yahoo.co.in wrote:

Sorry its like this…

BOOL UploadFW(WINUSB_INTERFACE_HANDLE hDeviceHandle)
{
if (hDeviceHandle == INVALID_HANDLE_VALUE)
{
return FALSE;
}

BOOL bResult = TRUE;

UCHAR *image = (UCHAR *)FwImage;;

I doubt this is related, but how is FwImage defined?

Is it possible some other application has also opened a handle to the
device?

Do you see any evidence that the request is getting to the device?

–
Tim Roberts, xxxxx@probo.com
Providenza & Boekelheide, Inc.