usbcomdebug

[busuanzi] 2023-02-01

字数统计: 992字 | 阅读时长≈ 5分

环境

win 10客户端
USB转串口

现象

重定向失败，重定向线程直接卡住

测试

已经尝试，纯净版PC 设备没有任何驱动，依然有这个问题存在

代码

USBDK

分析

报错日志问题点

static void connect_cb(GObject *gobject, GAsyncResult *res, gpointer user_data)
{
    SpiceUsbDeviceManager *manager = SPICE_USB_DEVICE_MANAGER(gobject);
    connect_cb_data *data = user_data;
    SpiceUsbDeviceWidget *self = data->self;
    SpiceUsbDeviceWidgetPrivate *priv = self->priv;
    SpiceUsbDevice *device;
    GError *err = NULL;
    gchar *desc;

    spice_usb_device_manager_connect_device_finish(manager, res, &err);
    if (err) {
        device = g_object_get_data(G_OBJECT(data->check), "usb-device");
        desc = spice_usb_device_get_description(device,
                                                priv->device_format_string);
        g_prefix_error(&err, "Could not redirect %s: ", desc);
        g_free(desc);

        SPICE_DEBUG("%s", err->message);
        g_signal_emit(self, signals[CONNECT_FAILED], 0, device, err);
        g_error_free(err);

        /* don't trigger a disconnect if connect failed */
        g_signal_handlers_block_by_func(GTK_TOGGLE_BUTTON(data->check),
                                        checkbox_clicked_cb, self);
        gtk_toggle_button_set_active(GTK_TOGGLE_BUTTON(data->check), FALSE);
        g_signal_handlers_unblock_by_func(GTK_TOGGLE_BUTTON(data->check),
                                        checkbox_clicked_cb, self);
    } else {
        device = g_object_get_data(G_OBJECT(data->check), "usb-device");
        update_usb_redirect_info(priv, device, USB_REDIRECT_ADD);
    }
    connect_cb_data_free(data);
}

调用入口

static void checkbox_clicked_cb(GtkWidget *check, gpointer user_data)
{
    SpiceUsbDeviceWidget *self = SPICE_USB_DEVICE_WIDGET(user_data);
    SpiceUsbDeviceWidgetPrivate *priv = self->priv;
    SpiceUsbDevice *device;

    device = g_object_get_data(G_OBJECT(check), "usb-device");
    connect_cb_data *data = g_new(connect_cb_data, 1);
    data->check = g_object_ref(check);
    data->self  = g_object_ref(self);

    if (gtk_toggle_button_get_active(GTK_TOGGLE_BUTTON(check))) {
        spice_usb_device_manager_connect_device_async(priv->manager,
                                                      device,
                                                      NULL,
                                                      connect_cb,
                                                      data);
    } else {
        spice_usb_device_manager_disconnect_device_async(priv->manager,
                                                         device,
                                                         NULL,
                                                         _disconnect_cb,
                                                         data);

    }
    spice_usb_device_widget_update_status(self);
}

spice_usb_device_manager_connect_device_async
- spice_usb_backend_device_get_libdev
- spice_usbredir_channel_connect_device_async
  - spice_usbredir_channel_open_acl_cb
    - spice_usbredir_channel_open_device
      - spice_usb_backend_channel_attach
        
        libusb_open
libusb_open
- UsbDk_StartRedirect
  - UsbDkDriverAccess::AddRedirect
    - SendIoctlWithDeviceId(IOCTL_USBDK_ADD_REDIRECT, DeviceID, &RedirectorHandle);

驱动层

IOCTL_USBDK_ADD_REDIRECT

#CUsbDkControlDeviceQueue::DeviceControl
        case IOCTL_USBDK_ADD_REDIRECT:
        {
            AddRedirect(WdfRequest, Queue);
            break;
        }

AddRedirect
- CUsbDkControlDeviceQueue::AddRedirect
  - devExt->UsbDkControl->AddRedirect

void CUsbDkControlDeviceQueue::AddRedirect(CControlRequest &Request, WDFQUEUE Queue)
{
    NTSTATUS status;

    PUSB_DK_DEVICE_ID DeviceId;
    PULONG64 RedirectorDevice;

    auto TargetProcessHandle = Request.Context()->CallerProcessHandle;
    if (TargetProcessHandle != WDF_NO_HANDLE)
    {
        if (FetchBuffersForAddRedirectRequest(Request, DeviceId, RedirectorDevice))
        {
            auto devExt = UsbDkControlGetContext(WdfIoQueueGetDevice(Queue));
            status = devExt->UsbDkControl->AddRedirect(*DeviceId, TargetProcessHandle, reinterpret_cast<PHANDLE>(RedirectorDevice));
        }
        else
        {
            status = STATUS_BUFFER_TOO_SMALL;
        }

        ZwClose(TargetProcessHandle);
    }
    else
    {
        //May happen if IoInCallerContext callback
        //wasn't called due to low memory conditions
        status = STATUS_INSUFFICIENT_RESOURCES;
    }

    Request.SetOutputDataLen(NT_SUCCESS(status) ? sizeof(*RedirectorDevice) : 0);
    Request.SetStatus(status);
}

使用命令调试

直接用UsbDkController 操控设备，也是一样第二次重定向直接失败

static int Controller_RedirectDevice(TCHAR *DeviceID, TCHAR *InstanceID)
{
    USB_DK_DEVICE_ID   deviceID;
    UsbDkFillIDStruct(&deviceID, tstring2wstring(DeviceID), tstring2wstring(InstanceID));

    tcout << TEXT("Redirect USB device ") << deviceID.DeviceID << TEXT(", ") << deviceID.InstanceID << endl;

    HANDLE redirectedDevice = UsbDk_StartRedirect(&deviceID);
    if (INVALID_HANDLE_VALUE == redirectedDevice)
    {
        tcout << TEXT("Redirect of USB device failed") << endl;
        return 100;
    }
    tcout << TEXT("USB device was redirected successfully. Redirected device handle = ") << redirectedDevice << endl;
    tcout << TEXT("Press any key to stop redirection");
    getchar();

    // STOP redirect
    tcout << TEXT("Restore USB device ") << redirectedDevice << endl;
    if (TRUE == UsbDk_StopRedirect(redirectedDevice))
    {
        tcout << TEXT("USB device redirection was stopped successfully.") << endl;
        return 0;
    }
    else
    {
        tcout << TEXT("Stopping of USB device redirection failed.") << endl;
        return 101;
    }

}

日志

00000138    UsbDk    540    1524    0    138    02\10\2023-10:24:11:454    Do IoControlCode 0xC350E150
00000139    UsbDk    540    1524    0    139    02\10\2023-10:24:11:454    CUsbDkControlDevice::AddRedirectionToSet Adding new redirection
00000140    UsbDk    540    1524    0    140    02\10\2023-10:24:11:454    CUsbDkRedirection::Dump   DevID: USB\VID_067B&PID_23C3, InstanceID: BDEHf103Y23
00000141    UsbDk    540    1524    0    141    02\10\2023-10:24:11:454    CUsbDkControlDevice::AddRedirect Success. New redirections list:
00000142    UsbDk    540    1524    0    142    02\10\2023-10:24:11:454    CUsbDkRedirection::Dump   DevID: USB\VID_067B&PID_23C3, InstanceID: BDEHf103Y23
00000143    UsbDk    540    1524    0    143    02\10\2023-10:24:11:455    CWdmUsbDeviceAccess::Reset device power state D3
00000144    UsbDk    4    200    0    144    02\10\2023-10:24:11:455    PowerRequestCompletion -> D0
00000145    UsbDk    540    1524    0    145    02\10\2023-10:26:11:453    CUsbDkControlDevice::AddRedirect Wait for redirector attachment failed. 0x00000102(STATUS_TIMEOUT)
00000146    UsbDk    540    1524    0    146    02\10\2023-10:26:11:453    CUsbDkRedirection::Dump Deleting  DevID: USB\VID_067B&PID_23C3, InstanceID: BDEHf103Y23

NTSTATUS CUsbDkControlDevice::AddRedirect(const USB_DK_DEVICE_ID &DeviceId, HANDLE RequestorProcess, PHANDLE RedirectorDevice)
{
    CUsbDkRedirection *Redirection;
    auto addRes = AddRedirectionToSet(DeviceId, &Redirection);
    if (!NT_SUCCESS(addRes))
    {
        return addRes;
    }
    Redirection->AddRef();
    CObjHolder<CUsbDkRedirection, CRefCountingDeleter> dereferencer(Redirection);

    TraceEvents(TRACE_LEVEL_INFORMATION, TRACE_CONTROLDEVICE, "%!FUNC! Success. New redirections list:");
    m_Redirections.Dump();

    auto resetRes = ResetUsbDevice(DeviceId, true);
    if (!NT_SUCCESS(resetRes))
    {
        TraceEvents(TRACE_LEVEL_ERROR, TRACE_CONTROLDEVICE, "%!FUNC! Reset after start redirection failed. %!STATUS!", resetRes);
        AddRedirectRollBack(DeviceId, false);
        return resetRes;iyan.baidu.com
    }

    auto waitRes = Redirection->WaitForAttachment();
    if ((waitRes == STATUS_TIMEOUT) || !NT_SUCCESS(waitRes))
    {
        TraceEvents(TRACE_LEVEL_ERROR, TRACE_CONTROLDEVICE, "%!FUNC! Wait for redirector attachment failed. %!STATUS!", waitRes);
        AddRedirectRollBack(DeviceId, true);
        return (waitRes == STATUS_TIMEOUT) ? STATUS_DEVICE_NOT_CONNECTED : waitRes;
    }

    auto status = Redirection->CreateRedirectorHandle(RequestorProcess, RedirectorDevice);
    if (!NT_SUCCESS(status))
    {
        TraceEvents(TRACE_LEVEL_ERROR, TRACE_CONTROLDEVICE, "%!FUNC! CreateRedirectorHandle() failed. %!STATUS!", status);
        AddRedirectRollBack(DeviceId, true);
        return STATUS_DEVICE_NOT_CONNECTED;
    }

    return STATUS_SUCCESS;
}

经过调试，已经确认是执行ResetUsbDevice操作后 WaitForAttachment等不到相应事件导致卡死
经过最后一次bushound抓包分析，目前确定，问题设备，在终止重定向后，hub驱动约10s左右，有一个IRP触发。如果在该IRP触发前插入设备，就回重定向失败

本文作者： crazyboy
本文链接： http://crazyboy.www.crazyboy.info/blog/blog/2023/02/01/kylin/debug/usbcomdebug/
版权声明： 本博客所有文章除特别声明外，均采用 MIT 许可协议。转载请注明出处！