<table cellspacing="0" cellpadding="0" border="0" ><tr><td valign="top" style="font: inherit;">inside windbg, click Disassembly window, it will display assembly code, then you can set a breakpoint by click the left side of the code line.<BR><BR>--- On <B>Tue, 3/13/12, Ribhi Kamal <I><rbhkamal@gmail.com></I></B> wrote:<BR>
<BLOCKQUOTE style="BORDER-LEFT: rgb(16,16,255) 2px solid; PADDING-LEFT: 5px; MARGIN-LEFT: 5px"><BR>From: Ribhi Kamal <rbhkamal@gmail.com><BR>Subject: Re: [vbox-dev] IoGetDeviceObjectPointer hangs vboxusbmon<BR>To: "Huihong Luo" <huisinro@yahoo.com><BR>Cc: "vbox-dev" <vbox-dev@virtualbox.org><BR>Date: Tuesday, March 13, 2012, 12:29 PM<BR><BR>
<DIV id=yiv437442502>The \Device\USBPDO-11 physical device is a sprint hub driver BcmBusCtr.SYS. But I've seen it happen with other devices as well (Apple trackpad)
<DIV><BR></DIV>
<DIV>Will update you once I get windbg working.</DIV>
<DIV><BR>Thanks</DIV>
<DIV><BR>
<DIV class=yiv437442502gmail_quote>On Tue, Mar 13, 2012 at 3:08 PM, Ribhi Kamal <SPAN dir=ltr><<A href="http://us.mc1603.mail.yahoo.com/mc/compose?to=rbhkamal@gmail.com" rel=nofollow target=_blank ymailto="mailto:rbhkamal@gmail.com">rbhkamal@gmail.com</A>></SPAN> wrote:<BR>
<BLOCKQUOTE style="BORDER-LEFT: #ccc 1px solid; MARGIN: 0px 0px 0px 0.8ex; PADDING-LEFT: 1ex" class=yiv437442502gmail_quote>The hubwalker loops through PDO devices 0-15 and it hangs at number 11. So the device name (hub name) should be "\Device\USBPDO-11". Is that what you wanted?<BR><BR>I'm still trying to figure out how to step through assembly code in windbg. I just started windows in debug mode and connected windbg.
<DIV><BR></DIV>
<DIV>In the mean time, I found the link below which suggests queuing a work item to call IoGetDeviceObjectPointer using ioallocateworkitem routine, should I give that a try?</DIV>
<DIV><A href="http://www.osronline.com/article.cfm?id=24" rel=nofollow target=_blank>http://www.osronline.com/article.cfm?id=24</A><BR></DIV>
<DIV><BR></DIV>
<DIV>Here is a little snippet:</DIV>
<DIV style="TEXT-ALIGN: center">
<P style="MARGIN: 0in 0in 0pt; FONT-FAMILY: Arial, Helvetica, sans-serif; COLOR: rgb(51,51,51); FONT-SIZE: 13px" class=yiv437442502MsoNormal align=center><B>Figure 5 – The <U>wrong</U> way to write a PnP Notification Callback</B></DIV>
<P style="MARGIN: 0in 0in 0pt; FONT-FAMILY: Arial, Helvetica, sans-serif; COLOR: rgb(51,51,51); FONT-SIZE: 13px" class=yiv437442502MsoNormal align=center><B> </B></DIV>
<P style="TEXT-ALIGN: justify; MARGIN: 0in 0in 0pt; FONT-FAMILY: Arial, Helvetica, sans-serif; COLOR: rgb(51,51,51); FONT-SIZE: 13px" class=yiv437442502MsoNormal>And, while you’d be partially right, you <I>do</I> get a pointer to a device object using its name by calling <B>IoGetDeviceObject Pointer</B>, you’d also get bitten by one of the conditions of PnP Notification routines. As it very clearly states in the documentation:</DIV>
<P style="TEXT-ALIGN: justify; MARGIN: 0in 0in 0pt; FONT-FAMILY: Arial, Helvetica, sans-serif; COLOR: rgb(51,51,51); FONT-SIZE: 13px" class=yiv437442502MsoNormal> </DIV>
<P style="TEXT-ALIGN: justify; MARGIN: 0in 12.95pt 0pt 8.65pt; FONT-FAMILY: Arial, Helvetica, sans-serif; COLOR: rgb(51,51,51); FONT-SIZE: 13px" class=yiv437442502MsoNormal><I>A callback routine must not open the device directly. If the provider of the interface causes blocking PnP events, the notification callback routine can cause a deadlock if it tries to open the device in the callback thread.</I></DIV>
<P style="TEXT-ALIGN: justify; MARGIN: 0in 12.95pt 0pt 8.65pt; FONT-FAMILY: Arial, Helvetica, sans-serif; COLOR: rgb(51,51,51); FONT-SIZE: 13px" class=yiv437442502MsoNormal><I> </I></DIV>
<P style="TEXT-ALIGN: justify; MARGIN: 0in 0in 0pt; FONT-FAMILY: Arial, Helvetica, sans-serif; COLOR: rgb(51,51,51); FONT-SIZE: 13px" class=yiv437442502MsoNormal>When you call <B>IoGetDeviceObjectPointer, </B>you’re actually issuing an open (IRP_MJ_CREATE) for the specified device. That’s why you get back a File Object pointer, in addition to the Device Object pointer that you wanted. So, the proper thing to do is queue a work item that does the call to <B>IoGetDeviceObjectPointer</B>, as shown in <I>Figure 6</I>.</DIV></DIV>
<DIV><BR></DIV>
<DIV>
<DIV>
<DIV><BR>
<DIV class=yiv437442502gmail_quote>On Tue, Mar 13, 2012 at 2:10 PM, Huihong Luo <SPAN dir=ltr><<A href="http://us.mc1603.mail.yahoo.com/mc/compose?to=huisinro@yahoo.com" rel=nofollow target=_blank ymailto="mailto:huisinro@yahoo.com">huisinro@yahoo.com</A>></SPAN> wrote:<BR>
<BLOCKQUOTE style="BORDER-LEFT: #ccc 1px solid; MARGIN: 0px 0px 0px 0.8ex; PADDING-LEFT: 1ex" class=yiv437442502gmail_quote>
<TABLE border=0 cellSpacing=0 cellPadding=0>
<TBODY>
<TR>
<TD vAlign=top>
<DIV>This api simply returns a device object from a name, and usually does not block. What is the <BR>device name? you can examine <FONT size=+0>ObjectName unicode string.</FONT></DIV>
<DIV><FONT size=+0> <FONT size=+0></FONT></FONT></DIV>
<DIV>IoGetDeviceObjectPointer() does the following thing:</DIV>
<DIV> <FONT size=+0></FONT></DIV>
<DIV>ZwOpenFile(ObjectName) to get a handle</DIV><FONT size=+0>
<DIV>ObReferenceObjectByHandle(handle) to get the FileObject</DIV><FONT size=+0>
<DIV>IoGetRelatedDeviceObject(FileObject) to get the device object</DIV>
<DIV> </DIV>
<DIV>you can further step into the assembly code to nail down which function call causes the lock.</DIV>
<DIV> </DIV>
<DIV>you can also list all locks using these commands in windbg:</DIV>
<DIV> </DIV>
<DIV>!locks</DIV>
<DIV>!deadlock</DIV></FONT></FONT>
<DIV> <BR>--- On <B>Tue, 3/13/12, Ribhi Kamal <I><<A href="http://us.mc1603.mail.yahoo.com/mc/compose?to=rbhkamal@gmail.com" rel=nofollow target=_blank ymailto="mailto:rbhkamal@gmail.com">rbhkamal@gmail.com</A>></I></B> wrote:<BR></DIV>
<BLOCKQUOTE style="BORDER-LEFT: rgb(16,16,255) 2px solid; PADDING-LEFT: 5px; MARGIN-LEFT: 5px"><BR>From: Ribhi Kamal <<A href="http://us.mc1603.mail.yahoo.com/mc/compose?to=rbhkamal@gmail.com" rel=nofollow target=_blank ymailto="mailto:rbhkamal@gmail.com">rbhkamal@gmail.com</A>><BR>Subject: Re: [vbox-dev] IoGetDeviceObjectPointer hangs vboxusbmon<BR>To: "vbox-dev" <<A href="http://us.mc1603.mail.yahoo.com/mc/compose?to=vbox-dev@virtualbox.org" rel=nofollow target=_blank ymailto="mailto:vbox-dev@virtualbox.org">vbox-dev@virtualbox.org</A>><BR>Date: Tuesday, March 13, 2012, 10:49 AM
<DIV>
<DIV><BR><BR>
<DIV>Sorry, actually the IRQL == PASSIVE_LEVEL is okay. So just ignore that bit.<BR><BR>
<DIV>On Tue, Mar 13, 2012 at 1:27 PM, Ribhi Kamal <SPAN dir=ltr><<A href="http://us.mc1603.mail.yahoo.com/mc/compose?to=rbhkamal@gmail.com" rel=nofollow target=_blank>rbhkamal@gmail.com</A>></SPAN> wrote:<BR>
<BLOCKQUOTE style="BORDER-LEFT: #ccc 1px solid; MARGIN: 0px 0px 0px 0.8ex; PADDING-LEFT: 1ex">
<DIV>
<DIV>
<DIV>I've been troubleshooting an issue that prevents vbox from capturing USB devices when other specific USB devices are plugged in (i.e. Sprint USB crap). I finally managed to track down the problem to IoGetDeviceObjectPointer in VboxUsbMonHubDevWalk. IoGetDeviceObjectPointer was getting called, however, it never returned.
<DIV><BR></DIV>
<DIV>I'm not an expert in windows driver development so I'd like to run things by you before I start fixing it.</DIV>
<DIV><BR></DIV>
<DIV>Firstly, I'm not really sure why it hangs (deadlocks?) there for some devices and not others. However, I believe that it may be due to the fact that some driver interfaces cause blocking PnP events. Due to that, vboxusbmon runs into a deadlock when executing IoGetDeviceObjectPointer because it is being used directly from a callback function, VBoxUsbMonDeviceControl, and IRQL==PASSIVE_LEVEL.<BR>
<DIV>
<DIV><BR></DIV>
<DIV>What led me to that conclusion is that right after IoGetDeviceObjectPointer is executed, I start seeing lots of PnP events.</DIV>
<DIV>
<DIV>USBMon::vboxUsbMonHubDevWalk: </DIV>
<DIV>IoGetDeviceObjectPointer - Starting </DIV>
<DIV><BR></DIV>
<DIV>USBMon::VBoxUsbMonPnPHook: </DIV>
<DIV>VBoxUsbMonPnPHook In </DIV>
<DIV><BR></DIV>
<DIV>USBMon::VBoxUsbMonPnPHook: </DIV>
<DIV>==>PnP: Mn(IRP_MN_QUERY_DEVICE_RELATIONS), PDO(0x8833d028), IRP(0x882a71a8), Status(0xc00000bb) </DIV>
<DIV><BR></DIV>
<DIV>See attached for complete debug view.</DIV>
<DIV><BR></DIV>
<DIV>Are my assumptions correct? If so how would you go about fixing the problem.<BR></DIV></DIV>
<DIV><BR></DIV>
<DIV>Thanks!</DIV></DIV></DIV></DIV>
<DIV><BR></DIV>-- <BR>-- Ribhi<BR></DIV></DIV></BLOCKQUOTE></DIV><BR><BR clear=all>
<DIV><BR></DIV>-- <BR>-- Ribhi<BR></DIV><BR></DIV></DIV>-----Inline Attachment Follows-----<BR><BR>
<DIV>_______________________________________________<BR>vbox-dev mailing list<BR><A href="http://us.mc1603.mail.yahoo.com/mc/compose?to=vbox-dev@virtualbox.org" rel=nofollow target=_blank>vbox-dev@virtualbox.org</A><BR><A href="https://www.virtualbox.org/mailman/listinfo/vbox-dev" rel=nofollow target=_blank>https://www.virtualbox.org/mailman/listinfo/vbox-dev</A><BR></DIV></BLOCKQUOTE></TD></TR></TBODY></TABLE></BLOCKQUOTE></DIV><BR><BR clear=all>
<DIV><BR></DIV></DIV></DIV><SPAN><FONT color=#888888>-- <BR>-- Ribhi<BR></FONT></SPAN></DIV></BLOCKQUOTE></DIV><BR><BR clear=all>
<DIV><BR></DIV>-- <BR>-- Ribhi<BR></DIV></DIV></BLOCKQUOTE></td></tr></table>