USB EVENT TRACING - WINDOWS MESSAGE ANALYZER

WINDOWS MESSAGE ANALYZER:

INTRODUCTION

Windows Message Analyzer is a free tool provided by Microsoft which has combined capablities of event tracing and viewing the trace under one user interface. It is simpler to analyze USB event traces in Windows Message Analyzer.
In the previous method .etl generation is done separately using logman tool and .etl viewing is done separately through event viewer or network monitor or any other tools. So message analyzer combines these discrete steps into a single window and makes the process simpler. You can also use export option to view the same trace using network monitor as well if in case netmon is your prefered trace viewer.

DOWNLOADING WINDOWS MESSAGE ANALYZER

Follow this link Windows message analyzer download to download. The installation process is simple.

STEPS FOR USB TRACING

• Open the Windows message analyzer and select 'capture/trace' option from the left pane.

• From the 'trace scenarios' column we can select either USB 2.0 or USB 3.0.

• As already known USB 3.0 tracing support (for XHCI) will only be provided by windows 8+ pc which has necessary trace providers.

• Select the necessary trace providers from the list in 'trace scenario configuration' pane.

• We can select the filter parameters for the particular trace provider using message type(information, error etc.) and keywords (parameters available for particular trace provider) from box below the trace scenario configuration pane.

• Filters can also be added before starting an event trace in the 'trace filter' pane.

• After all these configurations are complete, 'start with' button can be pressed to start the trace.

• After starting the trace a new window with all trace information will open.

• Restart, stop, pause options are available and can be used according to necessities.

• There is also a filter option in this window which can be used to filter traced data.

• Each and every message can be expanded to view the field data which contains the information about data packets and stack data which contains the event id, process id etc.

• After finishing the tracing part, we can save it for future reference as .matp file for viewing it in message analyzer.

• If you wish to view a particular trace using any other tools like netmon, export option should be used which saves the traced file as .cap.

TWO METHODS OF FILTERING

• Right click button can be best utilized for filtering a trace according to particular parameters.
• Right click can be used in any of the columns of the message window separately or inside the field and stack data.

COLUMN FILTERING

A rightclick in any one of the columns will filter according to data in that column. We can also add columns of our choice and then add a filter with the column data available. For example, we can add a column call usb device and filter messages from a particular usb device connected.

FIELD OR STACK FILTERING

A right click in any data on field or stack information will add the corresponding filter to the view filter box.

Comment and criticize our mistakes !!

-ARUN

Embedded Engineer

USB 2.0 & 3.0 DRIVER STACK AND TRACE LEVELS IN WINDOWS 7 & 8

TRACE PROVIDERS OF WINDOWS 7 AND 8 FOR USB DRIVERS

USB Driver Stack Architecture :

The following figure shows the architectural block diagram of the USB driver stack for Windows 8. The diagram shows separate USB driver stacks for USB 2.0 and USB 3.0. Windows loads the USB 3.0 driver stack when a device is attached to an xHCI controller. The USB 3.0 stack is new in Windows 8.Windows loads the USB 2.0 driver stack for devices that are attached to eHCI, oHCI, or uHCI controllers.

About Event Tracing for Windows(ETW)

Event Tracing for Windows (ETW) is a general-purpose, high-speed tracing facility that is provided by the operating system. It uses a buffering and logging mechanism that is implemented in the kernel to provide a tracing mechanism for events that are raised by both user-mode applications and kernel-mode device drivers. Additionally, ETW provides the ability to dynamically enable and disable logging, which makes it easy to perform detailed tracing in production environments without requiring reboots or application restarts.

USB ETW Support in Windows 7

Windows 7, added ETW logging to the USB host controller drivers and to the USB hub driver in Windows 7. The USB host controller driver layer includes the host controller port driver (usbport.sys) and the miniport drivers (usbehci.sys, usbohci.sys, and usbuhci.sys). The USB hub driver layer consists of the USB hub driver (usbhub.sys). The USB driver ETW event providers are included in all editions and SKUs of Windows 7.

USB Hub Events

While USB event collection is enabled, the USB hub event provider reports the addition and removal of USB hubs, the device summary events of all hubs, and port status changes. You can use these events to determine the root cause of most device enumeration failures.

USB Port Events

While USB event collection is enabled, the USB port event provider reports I/O from client drivers, opening and closing of device endpoints, and miniport state transitions such as miniport start and stop. Logged I/O includes requests for the state of physical USB ports. State transitions on physical USB ports are one of the key initiators of activity in the core USB driver stack.

USB ETW Support in Windows 8

Windows 8 provides a USB driver stack to support USB 3.0 devices. The Microsoft-provided USB 3.0 driver stack consists of three drivers: Usbxhci.sys, Ucx01000.sys, and Usbhub3.sys. All three drivers work together to add native support to Windows for most USB 3.0 host controllers. The new driver stack supports SuperSpeed, high-speed, full-speed, and low-speed devices. The USB 2.0 driver stack is supported on Windows 8. Through event traces, the USB 3.0 driver stack provides a view into the fine-grained activity of the host controller and all devices connected to it.

USB Hub3 Events

While USB event collection is enabled, the USB Hub3 event provider reports the addition and removal of USB hubs, the device summary events of all hubs, port status changes, and power states of USB devices and hubs. Port status changes are state transitions on physical USB ports and are one of the key initiators of activity in the core USB driver stack. Hub3 reports the stages of the enumeration process, which point to the root cause most device enumeration failures. With the StateMachine keyword enabled, Hub3 reports the internal state machine activity for software device, hub, and port objects, which provide deeper visibility into the logic of the driver.

USB UCX Events

While USB event collection is enabled, the USB UCX event provider reports I/O from client drivers and opening and closing of device endpoints and endpoint streams. With the StateMachine keyword enabled, UCX reports internal state machine activity for host controller and endpoint objects, which provide deeper visibility into the logic of the driver.

USB xHCI Events

While USB event collection is enabled, the USB xHCI event provider reports the properties of the system's xHCI controllers and low-level details of xHCI operation. xHCI reports command requests sent to and completed by the xHCI hardware, including xHCI-specific completion codes.

Comment and criticize our mistakes !!

-
ARUN
Embedded Engineer