Adding upstream version 6.0.4-dfsg.upstream/6.0.4-dfsgupstream

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>

9 files changed, 4027 insertions, 0 deletions

diff --git a/src/VBox/HostDrivers/VBoxUSB/win/mon/Makefile.kup b/src/VBox/HostDrivers/VBoxUSB/win/mon/Makefile.kup
new file mode 100644
index 00000000..e69de29b
--- /dev/null
+++ b/src/VBox/HostDrivers/VBoxUSB/win/mon/Makefile.kup
diff --git a/src/VBox/HostDrivers/VBoxUSB/win/mon/VBoxUSBMon.inf b/src/VBox/HostDrivers/VBoxUSB/win/mon/VBoxUSBMon.inf
new file mode 100644
index 00000000..a3cb6b68
--- /dev/null
+++ b/src/VBox/HostDrivers/VBoxUSB/win/mon/VBoxUSBMon.inf
@@ -0,0 +1,88 @@
+; $Id: VBoxUSBMon.inf $
+;; @file
+; VBox USB Monitor driver - Installation file
+;
+
+;
+; Copyright (C) 2011-2019 Oracle Corporation
+;
+; This file is part of VirtualBox Open Source Edition (OSE), as
+; available from http://www.virtualbox.org. This file is free software;
+; you can redistribute it and/or modify it under the terms of the GNU
+; General Public License (GPL) as published by the Free Software
+; Foundation, in version 2 as it comes in the "COPYING" file of the
+; VirtualBox OSE distribution. VirtualBox OSE is distributed in the
+; hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
+;
+; The contents of this file may alternatively be used under the terms
+; of the Common Development and Distribution License Version 1.0
+; (CDDL) only, as it comes in the "COPYING.CDDL" file of the
+; VirtualBox OSE distribution, in which case the provisions of the
+; CDDL are applicable instead of those of the GPL.
+;
+; You may elect to license modified versions of this file under the
+; terms and conditions of either the GPL or the CDDL or both.
+;
+
+[Version]
+Signature="$Windows NT$"
+Class=System
+ClassGuid={4d36e97d-e325-11ce-bfc1-08002be10318}
+Provider=%ORACLE%
+;edit-DriverVer=08/26/2008,2.00.0000
+DriverPackageType=KernelService
+;cat CatalogFile=VBoxUSBMon.cat
+
+[DestinationDirs]
+DefaultDestDir = 12
+
+[DefaultInstall@DOT-NT-ARCH@]
+CopyFiles=VBoxUSBMon_CopyFiles
+
+[DefaultInstall@DOT-NT-ARCH@.Services]
+AddService=VBoxUSBMon,0x00000002,VBoxUSBMon_Service,VBoxUSBMon_AddEventLog
+
+;; Cannot get this to work (same works fine for VBoxDrv):
+;; [Manufacturer]
+;; %ORACLE%=Oracle@COMMA-NT-ARCH@
+;;
+;; ; Models section (referenced by [Manufacturer]).
+;; [Oracle@DOT-NT-ARCH@]
+;; %VBoxUSBMon.DRVDESC%=VBoxUSBMonInstall,root\VBoxUSBMon
+;;
+;; [VBoxUSBMonInstall@DOT-NT-ARCH@]
+;; CopyFiles=VBoxUSBMon_CopyFiles
+;;
+;; [VBoxUSBMonInstall@DOT-NT-ARCH@.Services]
+;; AddService=VBoxUSBMon,0x00000002,VBoxUSBMon_Service,VBoxUSBMon_AddEventLog
+
+[SourceDisksFiles]
+VBoxUSBMon.sys=1
+
+[SourceDisksNames]
+1=%VBoxUSBMon.DSKDESC%,
+
+[VBoxUSBMon_CopyFiles]
+VBoxUSBMon.sys
+
+[VBoxUSBMon_Service]
+DisplayName    = %VBoxUSBMon.SVCDESC%
+ServiceType    = 1                  ; SERVICE_KERNEL_DRIVER
+;StartType      = 3                  ; SERVICE_DEMAND_START
+StartType      = 1                  ; autostart to fix Vista problem
+ErrorControl   = 1                  ; SERVICE_ERROR_NORMAL
+ServiceBinary  = %12%\VBoxUSBMon.sys
+
+[VBoxUSBMon_AddEventLog]
+AddReg         = VBoxUSBMon_AddEventLogRegistry
+
+[VBoxUSBMon_AddEventLogRegistry]
+HKR,,EventMessageFile,0x00020000,"%%SystemRoot%%\System32\IoLogMsg.dll"
+HKR,,TypesSupported,0x00010001,7
+
+[Strings]
+ORACLE = "Oracle Corporation"
+VBoxUSBMon.SVCDESC = "VirtualBox USB Monitor Service"
+VBoxUSBMon.DRVDESC = "VirtualBox USB Monitor Driver"
+VBoxUSBMon.DSKDESC = "VirtualBox USB Monitor Driver Installation Disk"
+
diff --git a/src/VBox/HostDrivers/VBoxUSB/win/mon/VBoxUsbFlt.cpp b/src/VBox/HostDrivers/VBoxUSB/win/mon/VBoxUsbFlt.cpp
new file mode 100644
index 00000000..232150ee
--- /dev/null
+++ b/src/VBox/HostDrivers/VBoxUSB/win/mon/VBoxUsbFlt.cpp
@@ -0,0 +1,1457 @@
+/* $Id: VBoxUsbFlt.cpp $ */
+/** @file
+ * VBox USB Monitor Device Filtering functionality
+ */
+/*
+ * Copyright (C) 2011-2019 Oracle Corporation
+ *
+ * This file is part of VirtualBox Open Source Edition (OSE), as
+ * available from http://www.virtualbox.org. This file is free software;
+ * you can redistribute it and/or modify it under the terms of the GNU
+ * General Public License (GPL) as published by the Free Software
+ * Foundation, in version 2 as it comes in the "COPYING" file of the
+ * VirtualBox OSE distribution. VirtualBox OSE is distributed in the
+ * hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
+ *
+ * The contents of this file may alternatively be used under the terms
+ * of the Common Development and Distribution License Version 1.0
+ * (CDDL) only, as it comes in the "COPYING.CDDL" file of the
+ * VirtualBox OSE distribution, in which case the provisions of the
+ * CDDL are applicable instead of those of the GPL.
+ *
+ * You may elect to license modified versions of this file under the
+ * terms and conditions of either the GPL or the CDDL or both.
+ */
+
+
+/*********************************************************************************************************************************
+*   Header Files                                                                                                                 *
+*********************************************************************************************************************************/
+#include "VBoxUsbMon.h"
+#include "../cmn/VBoxUsbTool.h"
+
+#include <VBox/cdefs.h>
+#include <VBox/types.h>
+#include <iprt/process.h>
+#include <iprt/assert.h>
+#include <iprt/errcore.h>
+
+#include <iprt/assert.h>
+
+#pragma warning(disable : 4200)
+#include "usbdi.h"
+#pragma warning(default : 4200)
+#include "usbdlib.h"
+#include "VBoxUSBFilterMgr.h"
+#include <VBox/usblib.h>
+#include <devguid.h>
+
+/*
+ * Note: Must match the VID & PID in the USB driver .inf file!!
+ */
+/*
+  BusQueryDeviceID USB\Vid_80EE&Pid_CAFE
+  BusQueryInstanceID 2
+  BusQueryHardwareIDs USB\Vid_80EE&Pid_CAFE&Rev_0100
+  BusQueryHardwareIDs USB\Vid_80EE&Pid_CAFE
+  BusQueryCompatibleIDs USB\Class_ff&SubClass_00&Prot_00
+  BusQueryCompatibleIDs USB\Class_ff&SubClass_00
+  BusQueryCompatibleIDs USB\Class_ff
+*/
+
+#define szBusQueryDeviceId                  L"USB\\Vid_80EE&Pid_CAFE"
+#define szBusQueryHardwareIDs               L"USB\\Vid_80EE&Pid_CAFE&Rev_0100\0USB\\Vid_80EE&Pid_CAFE\0\0"
+#define szBusQueryCompatibleIDs             L"USB\\Class_ff&SubClass_00&Prot_00\0USB\\Class_ff&SubClass_00\0USB\\Class_ff\0\0"
+
+#define szDeviceTextDescription             L"VirtualBox USB"
+
+/* Possible USB bus driver names. */
+static LPWSTR lpszStandardControllerName[1] =
+{
+    L"\\Driver\\usbhub",
+};
+
+/*
+ * state transitions:
+ *
+ *           (we are not filtering this device )
+ * ADDED --> UNCAPTURED ------------------------------->-
+ *       |                                              |
+ *       |   (we are filtering this device,             | (the device is being
+ *       |    waiting for our device driver             |  re-plugged to perform
+ *       |    to pick it up)                            |  capture-uncapture transition)
+ *       |-> CAPTURING -------------------------------->|---> REPLUGGING -----
+ *            ^  |    (device driver picked             |                    |
+ *            |  |     up the device)                   | (remove cased      |  (device is removed
+ *            |  ->---> CAPTURED ---------------------->|  by "real" removal |   the device info is removed form the list)
+ *            |            |                            |------------------->->--> REMOVED
+ *            |            |                            |
+ *            |-----------<->---> USED_BY_GUEST ------->|
+ *            |                         |
+ *            |------------------------<-
+ *
+ * NOTE: the order of enums DOES MATTER!!
+ * Do not blindly modify!! as the code assumes the state is ordered this way.
+ */
+typedef enum
+{
+    VBOXUSBFLT_DEVSTATE_UNKNOWN = 0,
+    VBOXUSBFLT_DEVSTATE_REMOVED,
+    VBOXUSBFLT_DEVSTATE_REPLUGGING,
+    VBOXUSBFLT_DEVSTATE_ADDED,
+    VBOXUSBFLT_DEVSTATE_UNCAPTURED,
+    VBOXUSBFLT_DEVSTATE_CAPTURING,
+    VBOXUSBFLT_DEVSTATE_CAPTURED,
+    VBOXUSBFLT_DEVSTATE_USED_BY_GUEST,
+    VBOXUSBFLT_DEVSTATE_32BIT_HACK = 0x7fffffff
+} VBOXUSBFLT_DEVSTATE;
+
+typedef struct VBOXUSBFLT_DEVICE
+{
+    LIST_ENTRY      GlobalLe;
+    /* auxiliary list to be used for gathering devices to be re-plugged
+     * only thread that puts the device to the REPLUGGING state can use this list */
+    LIST_ENTRY      RepluggingLe;
+    /* Owning session. Each matched device has an owning session. */
+    struct VBOXUSBFLTCTX *pOwner;
+    /* filter id - if NULL AND device has an owner - the filter is destroyed */
+    uintptr_t uFltId;
+    /* true iff device is filtered with a one-shot filter */
+    bool fIsFilterOneShot;
+    /* The device state. If the non-owner session is requesting the state while the device is grabbed,
+     * the USBDEVICESTATE_USED_BY_HOST is returned. */
+    VBOXUSBFLT_DEVSTATE  enmState;
+    volatile uint32_t cRefs;
+    PDEVICE_OBJECT  Pdo;
+    uint16_t        idVendor;
+    uint16_t        idProduct;
+    uint16_t        bcdDevice;
+    uint8_t         bClass;
+    uint8_t         bSubClass;
+    uint8_t         bProtocol;
+    char            szSerial[MAX_USB_SERIAL_STRING];
+    char            szMfgName[MAX_USB_SERIAL_STRING];
+    char            szProduct[MAX_USB_SERIAL_STRING];
+#if 0
+    char            szDrvKeyName[512];
+    BOOLEAN         fHighSpeed;
+#endif
+} VBOXUSBFLT_DEVICE, *PVBOXUSBFLT_DEVICE;
+
+#define PVBOXUSBFLT_DEVICE_FROM_LE(_pLe) ( (PVBOXUSBFLT_DEVICE)( ((uint8_t*)(_pLe)) - RT_OFFSETOF(VBOXUSBFLT_DEVICE, GlobalLe) ) )
+#define PVBOXUSBFLT_DEVICE_FROM_REPLUGGINGLE(_pLe)  ( (PVBOXUSBFLT_DEVICE)( ((uint8_t*)(_pLe)) - RT_OFFSETOF(VBOXUSBFLT_DEVICE, RepluggingLe) ) )
+#define PVBOXUSBFLTCTX_FROM_LE(_pLe) ( (PVBOXUSBFLTCTX)( ((uint8_t*)(_pLe)) - RT_OFFSETOF(VBOXUSBFLTCTX, ListEntry) ) )
+
+typedef struct VBOXUSBFLT_LOCK
+{
+    KSPIN_LOCK Lock;
+    KIRQL OldIrql;
+} VBOXUSBFLT_LOCK, *PVBOXUSBFLT_LOCK;
+
+#define VBOXUSBFLT_LOCK_INIT() \
+    KeInitializeSpinLock(&g_VBoxUsbFltGlobals.Lock.Lock)
+#define VBOXUSBFLT_LOCK_TERM() do { } while (0)
+#define VBOXUSBFLT_LOCK_ACQUIRE() \
+    KeAcquireSpinLock(&g_VBoxUsbFltGlobals.Lock.Lock, &g_VBoxUsbFltGlobals.Lock.OldIrql);
+#define VBOXUSBFLT_LOCK_RELEASE() \
+    KeReleaseSpinLock(&g_VBoxUsbFltGlobals.Lock.Lock, g_VBoxUsbFltGlobals.Lock.OldIrql);
+
+
+typedef struct VBOXUSBFLT_BLDEV
+{
+    LIST_ENTRY ListEntry;
+    uint16_t   idVendor;
+    uint16_t   idProduct;
+    uint16_t   bcdDevice;
+} VBOXUSBFLT_BLDEV, *PVBOXUSBFLT_BLDEV;
+
+#define PVBOXUSBFLT_BLDEV_FROM_LE(_pLe) ( (PVBOXUSBFLT_BLDEV)( ((uint8_t*)(_pLe)) - RT_OFFSETOF(VBOXUSBFLT_BLDEV, ListEntry) ) )
+
+typedef struct VBOXUSBFLTGLOBALS
+{
+    LIST_ENTRY DeviceList;
+    LIST_ENTRY ContextList;
+    /* devices known to misbehave */
+    LIST_ENTRY BlackDeviceList;
+    VBOXUSBFLT_LOCK Lock;
+} VBOXUSBFLTGLOBALS, *PVBOXUSBFLTGLOBALS;
+static VBOXUSBFLTGLOBALS g_VBoxUsbFltGlobals;
+
+static bool vboxUsbFltBlDevMatchLocked(uint16_t idVendor, uint16_t idProduct, uint16_t bcdDevice)
+{
+    for (PLIST_ENTRY pEntry = g_VBoxUsbFltGlobals.BlackDeviceList.Flink;
+            pEntry != &g_VBoxUsbFltGlobals.BlackDeviceList;
+            pEntry = pEntry->Flink)
+    {
+        PVBOXUSBFLT_BLDEV pDev = PVBOXUSBFLT_BLDEV_FROM_LE(pEntry);
+        if (pDev->idVendor != idVendor)
+            continue;
+        if (pDev->idProduct != idProduct)
+            continue;
+        if (pDev->bcdDevice != bcdDevice)
+            continue;
+
+        return true;
+    }
+    return false;
+}
+
+static NTSTATUS vboxUsbFltBlDevAddLocked(uint16_t idVendor, uint16_t idProduct, uint16_t bcdDevice)
+{
+    if (vboxUsbFltBlDevMatchLocked(idVendor, idProduct, bcdDevice))
+        return STATUS_SUCCESS;
+    PVBOXUSBFLT_BLDEV pDev = (PVBOXUSBFLT_BLDEV)VBoxUsbMonMemAllocZ(sizeof (*pDev));
+    if (!pDev)
+    {
+        AssertFailed();
+        return STATUS_INSUFFICIENT_RESOURCES;
+    }
+
+    pDev->idVendor = idVendor;
+    pDev->idProduct = idProduct;
+    pDev->bcdDevice = bcdDevice;
+    InsertHeadList(&g_VBoxUsbFltGlobals.BlackDeviceList, &pDev->ListEntry);
+    return STATUS_SUCCESS;
+}
+
+static void vboxUsbFltBlDevClearLocked()
+{
+    PLIST_ENTRY pNext;
+    for (PLIST_ENTRY pEntry = g_VBoxUsbFltGlobals.BlackDeviceList.Flink;
+            pEntry != &g_VBoxUsbFltGlobals.BlackDeviceList;
+            pEntry = pNext)
+    {
+        pNext = pEntry->Flink;
+        VBoxUsbMonMemFree(pEntry);
+    }
+}
+
+static void vboxUsbFltBlDevPopulateWithKnownLocked()
+{
+    /* this one halts when trying to get string descriptors from it */
+    vboxUsbFltBlDevAddLocked(0x5ac, 0x921c, 0x115);
+}
+
+
+DECLINLINE(void) vboxUsbFltDevRetain(PVBOXUSBFLT_DEVICE pDevice)
+{
+    Assert(pDevice->cRefs);
+    ASMAtomicIncU32(&pDevice->cRefs);
+}
+
+static void vboxUsbFltDevDestroy(PVBOXUSBFLT_DEVICE pDevice)
+{
+    Assert(!pDevice->cRefs);
+    Assert(pDevice->enmState == VBOXUSBFLT_DEVSTATE_REMOVED);
+    VBoxUsbMonMemFree(pDevice);
+}
+
+DECLINLINE(void) vboxUsbFltDevRelease(PVBOXUSBFLT_DEVICE pDevice)
+{
+    uint32_t cRefs = ASMAtomicDecU32(&pDevice->cRefs);
+    Assert(cRefs < UINT32_MAX/2);
+    if (!cRefs)
+    {
+        vboxUsbFltDevDestroy(pDevice);
+    }
+}
+
+static void vboxUsbFltDevOwnerSetLocked(PVBOXUSBFLT_DEVICE pDevice, PVBOXUSBFLTCTX pContext, uintptr_t uFltId, bool fIsOneShot)
+{
+    ASSERT_WARN(!pDevice->pOwner, ("device 0x%p has an owner(0x%p)", pDevice, pDevice->pOwner));
+    ++pContext->cActiveFilters;
+    pDevice->pOwner = pContext;
+    pDevice->uFltId = uFltId;
+    pDevice->fIsFilterOneShot = fIsOneShot;
+}
+
+static void vboxUsbFltDevOwnerClearLocked(PVBOXUSBFLT_DEVICE pDevice)
+{
+    ASSERT_WARN(pDevice->pOwner, ("no owner for device 0x%p", pDevice));
+    --pDevice->pOwner->cActiveFilters;
+    ASSERT_WARN(pDevice->pOwner->cActiveFilters < UINT32_MAX/2, ("cActiveFilters (%d)", pDevice->pOwner->cActiveFilters));
+    pDevice->pOwner = NULL;
+    pDevice->uFltId = 0;
+}
+
+static void vboxUsbFltDevOwnerUpdateLocked(PVBOXUSBFLT_DEVICE pDevice, PVBOXUSBFLTCTX pContext, uintptr_t uFltId, bool fIsOneShot)
+{
+    if (pDevice->pOwner != pContext)
+    {
+        if (pDevice->pOwner)
+            vboxUsbFltDevOwnerClearLocked(pDevice);
+        if (pContext)
+            vboxUsbFltDevOwnerSetLocked(pDevice, pContext, uFltId, fIsOneShot);
+    }
+    else if (pContext)
+    {
+        pDevice->uFltId = uFltId;
+        pDevice->fIsFilterOneShot = fIsOneShot;
+    }
+}
+
+static PVBOXUSBFLT_DEVICE vboxUsbFltDevGetLocked(PDEVICE_OBJECT pPdo)
+{
+#ifdef VBOX_USB_WITH_VERBOSE_LOGGING
+    for (PLIST_ENTRY pEntry = g_VBoxUsbFltGlobals.DeviceList.Flink;
+            pEntry != &g_VBoxUsbFltGlobals.DeviceList;
+            pEntry = pEntry->Flink)
+    {
+        PVBOXUSBFLT_DEVICE pDevice = PVBOXUSBFLT_DEVICE_FROM_LE(pEntry);
+        for (PLIST_ENTRY pEntry2 = pEntry->Flink;
+                pEntry2 != &g_VBoxUsbFltGlobals.DeviceList;
+                pEntry2 = pEntry2->Flink)
+        {
+            PVBOXUSBFLT_DEVICE pDevice2 = PVBOXUSBFLT_DEVICE_FROM_LE(pEntry2);
+            ASSERT_WARN(    pDevice->idVendor  != pDevice2->idVendor
+                    || pDevice->idProduct != pDevice2->idProduct
+                    || pDevice->bcdDevice != pDevice2->bcdDevice, ("duplicate devices in a list!!"));
+        }
+    }
+#endif
+    for (PLIST_ENTRY pEntry = g_VBoxUsbFltGlobals.DeviceList.Flink;
+            pEntry != &g_VBoxUsbFltGlobals.DeviceList;
+            pEntry = pEntry->Flink)
+    {
+        PVBOXUSBFLT_DEVICE pDevice = PVBOXUSBFLT_DEVICE_FROM_LE(pEntry);
+        ASSERT_WARN(    pDevice->enmState == VBOXUSBFLT_DEVSTATE_REPLUGGING
+                || pDevice->enmState == VBOXUSBFLT_DEVSTATE_UNCAPTURED
+                || pDevice->enmState == VBOXUSBFLT_DEVSTATE_CAPTURING
+                || pDevice->enmState == VBOXUSBFLT_DEVSTATE_CAPTURED
+                || pDevice->enmState == VBOXUSBFLT_DEVSTATE_USED_BY_GUEST,
+                ("Invalid device state(%d) for device(0x%p) PDO(0x%p)", pDevice->enmState, pDevice, pDevice->Pdo));
+        if (pDevice->Pdo == pPdo)
+            return pDevice;
+    }
+    return NULL;
+}
+
+PVBOXUSBFLT_DEVICE vboxUsbFltDevGet(PDEVICE_OBJECT pPdo)
+{
+    PVBOXUSBFLT_DEVICE pDevice;
+
+    VBOXUSBFLT_LOCK_ACQUIRE();
+    pDevice = vboxUsbFltDevGetLocked(pPdo);
+    /*
+     * Prevent a host crash when vboxUsbFltDevGetLocked fails to locate the matching PDO
+     * in g_VBoxUsbFltGlobals.DeviceList (see @bugref{6509}).
+     */
+    if (pDevice == NULL)
+    {
+        WARN(("failed to get device for PDO(0x%p)", pPdo));
+    }
+    else if (pDevice->enmState > VBOXUSBFLT_DEVSTATE_ADDED)
+    {
+        vboxUsbFltDevRetain(pDevice);
+        LOG(("found device (0x%p), state(%d) for PDO(0x%p)", pDevice, pDevice->enmState, pPdo));
+    }
+    else
+    {
+        LOG(("found replugging device (0x%p), state(%d) for PDO(0x%p)", pDevice, pDevice->enmState, pPdo));
+        pDevice = NULL;
+    }
+    VBOXUSBFLT_LOCK_RELEASE();
+
+    return pDevice;
+}
+
+static NTSTATUS vboxUsbFltPdoReplug(PDEVICE_OBJECT pDo)
+{
+    LOG(("Replugging PDO(0x%p)", pDo));
+    NTSTATUS Status = VBoxUsbToolIoInternalCtlSendSync(pDo, IOCTL_INTERNAL_USB_CYCLE_PORT, NULL, NULL);
+    ASSERT_WARN(Status == STATUS_SUCCESS, ("replugging PDO(0x%p) failed Status(0x%x)", pDo, Status));
+    LOG(("Replugging PDO(0x%p) done with Status(0x%x)", pDo, Status));
+    return Status;
+}
+
+static bool vboxUsbFltDevCanBeCaptured(PVBOXUSBFLT_DEVICE pDevice)
+{
+    if (pDevice->bClass == USB_DEVICE_CLASS_HUB)
+    {
+        LOG(("device (0x%p), pdo (0x%p) is a hub, can not be captured", pDevice, pDevice->Pdo));
+        return false;
+    }
+    return true;
+}
+
+static PVBOXUSBFLTCTX vboxUsbFltDevMatchLocked(PVBOXUSBFLT_DEVICE pDevice, uintptr_t *puId, bool fRemoveFltIfOneShot, bool *pfFilter, bool *pfIsOneShot)
+{
+    *puId = 0;
+    *pfFilter = false;
+    *pfIsOneShot = false;
+    if (!vboxUsbFltDevCanBeCaptured(pDevice))
+    {
+        LOG(("vboxUsbFltDevCanBeCaptured returned false"));
+        return NULL;
+    }
+
+    USBFILTER DevFlt;
+    USBFilterInit(&DevFlt, USBFILTERTYPE_CAPTURE);
+    USBFilterSetNumExact(&DevFlt, USBFILTERIDX_VENDOR_ID, pDevice->idVendor, true);
+    USBFilterSetNumExact(&DevFlt, USBFILTERIDX_PRODUCT_ID, pDevice->idProduct, true);
+    USBFilterSetNumExact(&DevFlt, USBFILTERIDX_DEVICE_REV, pDevice->bcdDevice, true);
+    USBFilterSetNumExact(&DevFlt, USBFILTERIDX_DEVICE_CLASS, pDevice->bClass, true);
+    USBFilterSetNumExact(&DevFlt, USBFILTERIDX_DEVICE_SUB_CLASS, pDevice->bSubClass, true);
+    USBFilterSetNumExact(&DevFlt, USBFILTERIDX_DEVICE_PROTOCOL, pDevice->bProtocol, true);
+    USBFilterSetStringExact(&DevFlt, USBFILTERIDX_MANUFACTURER_STR, pDevice->szMfgName, true /*fMustBePresent*/, true /*fPurge*/);
+    USBFilterSetStringExact(&DevFlt, USBFILTERIDX_PRODUCT_STR, pDevice->szProduct, true /*fMustBePresent*/, true /*fPurge*/);
+    USBFilterSetStringExact(&DevFlt, USBFILTERIDX_SERIAL_NUMBER_STR, pDevice->szSerial, true /*fMustBePresent*/, true /*fPurge*/);
+
+    /* Run filters on the thing. */
+    PVBOXUSBFLTCTX pOwner = VBoxUSBFilterMatchEx(&DevFlt, puId, fRemoveFltIfOneShot, pfFilter, pfIsOneShot);
+    USBFilterDelete(&DevFlt);
+    return pOwner;
+}
+
+static void vboxUsbFltDevStateMarkReplugLocked(PVBOXUSBFLT_DEVICE pDevice)
+{
+    vboxUsbFltDevOwnerUpdateLocked(pDevice, NULL, 0, false);
+    pDevice->enmState = VBOXUSBFLT_DEVSTATE_REPLUGGING;
+}
+
+static bool vboxUsbFltDevStateIsNotFiltered(PVBOXUSBFLT_DEVICE pDevice)
+{
+    return pDevice->enmState == VBOXUSBFLT_DEVSTATE_UNCAPTURED;
+}
+
+static bool vboxUsbFltDevStateIsFiltered(PVBOXUSBFLT_DEVICE pDevice)
+{
+    return pDevice->enmState >= VBOXUSBFLT_DEVSTATE_CAPTURING;
+}
+
+#define VBOXUSBMON_POPULATE_REQUEST_TIMEOUT_MS 10000
+
+static NTSTATUS vboxUsbFltDevPopulate(PVBOXUSBFLT_DEVICE pDevice, PDEVICE_OBJECT pDo /*, BOOLEAN bPopulateNonFilterProps*/)
+{
+    NTSTATUS Status;
+    PUSB_DEVICE_DESCRIPTOR pDevDr = 0;
+
+    pDevice->Pdo = pDo;
+
+    LOG(("Populating Device(0x%p) for PDO(0x%p)", pDevice, pDo));
+
+    pDevDr = (PUSB_DEVICE_DESCRIPTOR)VBoxUsbMonMemAllocZ(sizeof(*pDevDr));
+    if (pDevDr == NULL)
+    {
+        WARN(("Failed to alloc mem for urb"));
+        return STATUS_INSUFFICIENT_RESOURCES;
+    }
+
+    do
+    {
+        Status = VBoxUsbToolGetDescriptor(pDo, pDevDr, sizeof(*pDevDr), USB_DEVICE_DESCRIPTOR_TYPE, 0, 0, VBOXUSBMON_POPULATE_REQUEST_TIMEOUT_MS);
+        if (!NT_SUCCESS(Status))
+        {
+            WARN(("getting device descriptor failed, Status (0x%x)", Status));
+            break;
+        }
+
+        if (vboxUsbFltBlDevMatchLocked(pDevDr->idVendor, pDevDr->idProduct, pDevDr->bcdDevice))
+        {
+            WARN(("found a known black list device, vid(0x%x), pid(0x%x), rev(0x%x)", pDevDr->idVendor, pDevDr->idProduct, pDevDr->bcdDevice));
+            Status = STATUS_UNSUCCESSFUL;
+            break;
+        }
+
+        LOG(("Device pid=%x vid=%x rev=%x", pDevDr->idVendor, pDevDr->idProduct, pDevDr->bcdDevice));
+        pDevice->idVendor     = pDevDr->idVendor;
+        pDevice->idProduct    = pDevDr->idProduct;
+        pDevice->bcdDevice    = pDevDr->bcdDevice;
+        pDevice->bClass       = pDevDr->bDeviceClass;
+        pDevice->bSubClass    = pDevDr->bDeviceSubClass;
+        pDevice->bProtocol    = pDevDr->bDeviceProtocol;
+        pDevice->szSerial[0]  = 0;
+        pDevice->szMfgName[0] = 0;
+        pDevice->szProduct[0] = 0;
+
+        /* If there are no strings, don't even try to get any string descriptors. */
+        if (pDevDr->iSerialNumber || pDevDr->iManufacturer || pDevDr->iProduct)
+        {
+            int             langId;
+
+            Status = VBoxUsbToolGetLangID(pDo, &langId, VBOXUSBMON_POPULATE_REQUEST_TIMEOUT_MS);
+            if (!NT_SUCCESS(Status))
+            {
+                WARN(("reading language ID failed"));
+                if (Status == STATUS_CANCELLED)
+                {
+                    WARN(("found a new black list device, vid(0x%x), pid(0x%x), rev(0x%x)", pDevDr->idVendor, pDevDr->idProduct, pDevDr->bcdDevice));
+                    vboxUsbFltBlDevAddLocked(pDevDr->idVendor, pDevDr->idProduct, pDevDr->bcdDevice);
+                    Status = STATUS_UNSUCCESSFUL;
+                }
+                break;
+            }
+
+            if (pDevDr->iSerialNumber)
+            {
+                Status = VBoxUsbToolGetStringDescriptor(pDo, pDevice->szSerial, sizeof (pDevice->szSerial), pDevDr->iSerialNumber, langId, VBOXUSBMON_POPULATE_REQUEST_TIMEOUT_MS);
+                if (!NT_SUCCESS(Status))
+                {
+                    WARN(("reading serial number failed"));
+                    ASSERT_WARN(pDevice->szSerial[0] == '\0', ("serial is not zero!!"));
+                    if (Status == STATUS_CANCELLED)
+                    {
+                        WARN(("found a new black list device, vid(0x%x), pid(0x%x), rev(0x%x)", pDevDr->idVendor, pDevDr->idProduct, pDevDr->bcdDevice));
+                        vboxUsbFltBlDevAddLocked(pDevDr->idVendor, pDevDr->idProduct, pDevDr->bcdDevice);
+                        Status = STATUS_UNSUCCESSFUL;
+                        break;
+                    }
+                    LOG(("pretending success.."));
+                    Status = STATUS_SUCCESS;
+                }
+            }
+
+            if (pDevDr->iManufacturer)
+            {
+                Status = VBoxUsbToolGetStringDescriptor(pDo, pDevice->szMfgName, sizeof (pDevice->szMfgName), pDevDr->iManufacturer, langId, VBOXUSBMON_POPULATE_REQUEST_TIMEOUT_MS);
+                if (!NT_SUCCESS(Status))
+                {
+                    WARN(("reading manufacturer name failed"));
+                    ASSERT_WARN(pDevice->szMfgName[0] == '\0', ("szMfgName is not zero!!"));
+                    if (Status == STATUS_CANCELLED)
+                    {
+                        WARN(("found a new black list device, vid(0x%x), pid(0x%x), rev(0x%x)", pDevDr->idVendor, pDevDr->idProduct, pDevDr->bcdDevice));
+                        vboxUsbFltBlDevAddLocked(pDevDr->idVendor, pDevDr->idProduct, pDevDr->bcdDevice);
+                        Status = STATUS_UNSUCCESSFUL;
+                        break;
+                    }
+                    LOG(("pretending success.."));
+                    Status = STATUS_SUCCESS;
+                }
+            }
+
+            if (pDevDr->iProduct)
+            {
+                Status = VBoxUsbToolGetStringDescriptor(pDo, pDevice->szProduct, sizeof (pDevice->szProduct), pDevDr->iProduct, langId, VBOXUSBMON_POPULATE_REQUEST_TIMEOUT_MS);
+                if (!NT_SUCCESS(Status))
+                {
+                    WARN(("reading product name failed"));
+                    ASSERT_WARN(pDevice->szProduct[0] == '\0', ("szProduct is not zero!!"));
+                    if (Status == STATUS_CANCELLED)
+                    {
+                        WARN(("found a new black list device, vid(0x%x), pid(0x%x), rev(0x%x)", pDevDr->idVendor, pDevDr->idProduct, pDevDr->bcdDevice));
+                        vboxUsbFltBlDevAddLocked(pDevDr->idVendor, pDevDr->idProduct, pDevDr->bcdDevice);
+                        Status = STATUS_UNSUCCESSFUL;
+                        break;
+                    }
+                    LOG(("pretending success.."));
+                    Status = STATUS_SUCCESS;
+                }
+            }
+
+            LOG((": strings: '%s':'%s':'%s' (lang ID %x)",
+                        pDevice->szMfgName, pDevice->szProduct, pDevice->szSerial, langId));
+        }
+
+        LOG(("Populating Device(0x%p) for PDO(0x%p) Succeeded", pDevice, pDo));
+        Status = STATUS_SUCCESS;
+    } while (0);
+
+    VBoxUsbMonMemFree(pDevDr);
+    LOG(("Populating Device(0x%p) for PDO(0x%p) Done, Status (0x%x)", pDevice, pDo, Status));
+    return Status;
+}
+
+static void vboxUsbFltSignalChangeLocked()
+{
+    for (PLIST_ENTRY pEntry = g_VBoxUsbFltGlobals.ContextList.Flink;
+            pEntry != &g_VBoxUsbFltGlobals.ContextList;
+            pEntry = pEntry->Flink)
+    {
+        PVBOXUSBFLTCTX pCtx = PVBOXUSBFLTCTX_FROM_LE(pEntry);
+        /* the removed context can not be in a list */
+        Assert(!pCtx->bRemoved);
+        if (pCtx->pChangeEvent)
+        {
+            KeSetEvent(pCtx->pChangeEvent,
+                    0, /* increment*/
+                    FALSE /* wait */);
+        }
+    }
+}
+
+static bool vboxUsbFltDevCheckReplugLocked(PVBOXUSBFLT_DEVICE pDevice, PVBOXUSBFLTCTX pContext)
+{
+    ASSERT_WARN(pContext, ("context is NULL!"));
+
+    LOG(("Current context is (0x%p)", pContext));
+    LOG(("Current Device owner is (0x%p)", pDevice->pOwner));
+
+    /* check if device is already replugging */
+    if (pDevice->enmState <= VBOXUSBFLT_DEVSTATE_ADDED)
+    {
+        LOG(("Device (0x%p) is already replugging, return..", pDevice));
+        /* it is, do nothing */
+        ASSERT_WARN(pDevice->enmState == VBOXUSBFLT_DEVSTATE_REPLUGGING,
+                ("Device (0x%p) state is NOT REPLUGGING (%d)", pDevice, pDevice->enmState));
+        return false;
+    }
+
+    if (pDevice->pOwner && pContext != pDevice->pOwner)
+    {
+        LOG(("Device (0x%p) is owned by another context(0x%p), current is(0x%p)", pDevice, pDevice->pOwner, pContext));
+        /* this device is owned by another context, we're not allowed to do anything */
+        return false;
+    }
+
+    uintptr_t uId = 0;
+    bool bNeedReplug = false;
+    bool fFilter = false;
+    bool fIsOneShot = false;
+    PVBOXUSBFLTCTX pNewOwner = vboxUsbFltDevMatchLocked(pDevice, &uId,
+            false, /* do not remove a one-shot filter */
+            &fFilter, &fIsOneShot);
+    LOG(("Matching Info: Filter (0x%p), NewOwner(0x%p), fFilter(%d), fIsOneShot(%d)", uId, pNewOwner, (int)fFilter, (int)fIsOneShot));
+    if (pDevice->pOwner && pNewOwner && pDevice->pOwner != pNewOwner)
+    {
+        LOG(("Matching: Device (0x%p) is requested another owner(0x%p), current is(0x%p)", pDevice, pNewOwner, pDevice->pOwner));
+        /* the device is owned by another owner, we can not change the owner here */
+        return false;
+    }
+
+    if (!fFilter)
+    {
+        LOG(("Matching: Device (0x%p) should NOT be filtered", pDevice));
+        /* the device should NOT be filtered, check the current state  */
+        if (vboxUsbFltDevStateIsNotFiltered(pDevice))
+        {
+            LOG(("Device (0x%p) is NOT filtered", pDevice));
+            /* no changes */
+            if (fIsOneShot)
+            {
+                ASSERT_WARN(pNewOwner, ("no new owner"));
+                LOG(("Matching: This is a one-shot filter (0x%p), removing..", uId));
+                /* remove a one-shot filter and keep the original filter data */
+                int tmpRc = VBoxUSBFilterRemove(pNewOwner, uId);
+                ASSERT_WARN(RT_SUCCESS(tmpRc), ("remove filter failed, rc (%d)", tmpRc));
+                if (!pDevice->pOwner)
+                {
+                    LOG(("Matching: updating the one-shot owner to (0x%p), fltId(0x%p)", pNewOwner, uId));
+                    /* update owner for one-shot if the owner is changed (i.e. assigned) */
+                    vboxUsbFltDevOwnerUpdateLocked(pDevice, pNewOwner, uId, true);
+                }
+                else
+                {
+                    LOG(("Matching: device already has owner (0x%p) assigned", pDevice->pOwner));
+                }
+            }
+            else
+            {
+                LOG(("Matching: This is NOT a one-shot filter (0x%p), newOwner(0x%p)", uId, pNewOwner));
+                if (pNewOwner)
+                {
+                    vboxUsbFltDevOwnerUpdateLocked(pDevice, pNewOwner, uId, false);
+                }
+            }
+        }
+        else
+        {
+            LOG(("Device (0x%p) IS filtered", pDevice));
+            /* the device is currently filtered, we should release it only if
+             * 1. device does not have an owner
+             * or
+             * 2. it should be released bue to a one-shot filter
+             * or
+             * 3. it is NOT grabbed by a one-shot filter */
+            if (!pDevice->pOwner || fIsOneShot || !pDevice->fIsFilterOneShot)
+            {
+                LOG(("Matching: Need replug"));
+                bNeedReplug = true;
+            }
+        }
+    }
+    else
+    {
+        LOG(("Matching: Device (0x%p) SHOULD be filtered", pDevice));
+        /* the device should be filtered, check the current state  */
+        ASSERT_WARN(uId, ("zero uid"));
+        ASSERT_WARN(pNewOwner, ("zero pNewOwner"));
+        if (vboxUsbFltDevStateIsFiltered(pDevice))
+        {
+            LOG(("Device (0x%p) IS filtered", pDevice));
+            /* the device is filtered */
+            if (pNewOwner == pDevice->pOwner)
+            {
+                LOG(("Device owner match"));
+                /* no changes */
+                if (fIsOneShot)
+                {
+                    LOG(("Matching: This is a one-shot filter (0x%p), removing..", uId));
+                    /* remove a one-shot filter and keep the original filter data */
+                    int tmpRc = VBoxUSBFilterRemove(pNewOwner, uId);
+                    ASSERT_WARN(RT_SUCCESS(tmpRc), ("remove filter failed, rc (%d)", tmpRc));
+                }
+                else
+                {
+                    LOG(("Matching: This is NOT a one-shot filter (0x%p), Owner(0x%p)", uId, pDevice->pOwner));
+                    vboxUsbFltDevOwnerUpdateLocked(pDevice, pDevice->pOwner, uId, false);
+                }
+            }
+            else
+            {
+                ASSERT_WARN(!pDevice->pOwner, ("device should NOT have owner"));
+                LOG(("Matching: Need replug"));
+                /* the device needs to be filtered, but the owner changes, replug needed */
+                bNeedReplug = true;
+            }
+        }
+        else
+        {
+            /* the device is currently NOT filtered,
+             * we should replug it only if
+             * 1. device does not have an owner
+             * or
+             * 2. it should be captured due to a one-shot filter
+             * or
+             * 3. it is NOT released by a one-shot filter */
+            if (!pDevice->pOwner || fIsOneShot || !pDevice->fIsFilterOneShot)
+            {
+                bNeedReplug = true;
+                LOG(("Matching: Need replug"));
+            }
+        }
+    }
+
+    if (bNeedReplug)
+    {
+        LOG(("Matching: Device needs replugging, marking as such"));
+        vboxUsbFltDevStateMarkReplugLocked(pDevice);
+    }
+    else
+    {
+        LOG(("Matching: Device does NOT need replugging"));
+    }
+
+    return bNeedReplug;
+}
+
+static void vboxUsbFltReplugList(PLIST_ENTRY pList)
+{
+    PLIST_ENTRY pNext;
+    for (PLIST_ENTRY pEntry = pList->Flink;
+            pEntry != pList;
+            pEntry = pNext)
+    {
+        pNext = pEntry->Flink;
+        PVBOXUSBFLT_DEVICE pDevice = PVBOXUSBFLT_DEVICE_FROM_REPLUGGINGLE(pEntry);
+        LOG(("replugging matched PDO(0x%p), pDevice(0x%p)", pDevice->Pdo, pDevice));
+        ASSERT_WARN(pDevice->enmState == VBOXUSBFLT_DEVSTATE_REPLUGGING
+                || pDevice->enmState == VBOXUSBFLT_DEVSTATE_REMOVED,
+                ("invalid state(0x%x) for device(0x%p)", pDevice->enmState, pDevice));
+
+        vboxUsbFltPdoReplug(pDevice->Pdo);
+        ObDereferenceObject(pDevice->Pdo);
+        vboxUsbFltDevRelease(pDevice);
+    }
+}
+
+typedef struct VBOXUSBFLTCHECKWALKER
+{
+    PVBOXUSBFLTCTX pContext;
+} VBOXUSBFLTCHECKWALKER, *PVBOXUSBFLTCHECKWALKER;
+
+static DECLCALLBACK(BOOLEAN) vboxUsbFltFilterCheckWalker(PFILE_OBJECT pFile, PDEVICE_OBJECT pTopDo,
+                                                         PDEVICE_OBJECT pHubDo, PVOID pvContext)
+{
+    RT_NOREF1(pHubDo);
+    PVBOXUSBFLTCHECKWALKER pData = (PVBOXUSBFLTCHECKWALKER)pvContext;
+    PVBOXUSBFLTCTX pContext = pData->pContext;
+
+    LOG(("Visiting pFile(0x%p), pTopDo(0x%p), pHubDo(0x%p), oContext(0x%p)", pFile, pTopDo, pHubDo, pContext));
+    KIRQL Irql = KeGetCurrentIrql();
+    ASSERT_WARN(Irql == PASSIVE_LEVEL, ("unexpected IRQL (%d)", Irql));
+
+    PDEVICE_RELATIONS pDevRelations = NULL;
+
+    NTSTATUS Status = VBoxUsbMonQueryBusRelations(pTopDo, pFile, &pDevRelations);
+    if (Status == STATUS_SUCCESS && pDevRelations)
+    {
+        ULONG cReplugPdos = pDevRelations->Count;
+        LIST_ENTRY ReplugDevList;
+        InitializeListHead(&ReplugDevList);
+        for (ULONG k = 0; k < pDevRelations->Count; ++k)
+        {
+            PDEVICE_OBJECT pDevObj = pDevRelations->Objects[k];
+
+            LOG(("Found existing USB PDO 0x%p", pDevObj));
+            VBOXUSBFLT_LOCK_ACQUIRE();
+            PVBOXUSBFLT_DEVICE pDevice = vboxUsbFltDevGetLocked(pDevObj);
+            if (pDevice)
+            {
+                LOG(("Found existing device info (0x%p) for PDO 0x%p", pDevice, pDevObj));
+                bool bReplug = vboxUsbFltDevCheckReplugLocked(pDevice, pContext);
+                if (bReplug)
+                {
+                    LOG(("Replug needed for device (0x%p)", pDevice));
+                    InsertHeadList(&ReplugDevList, &pDevice->RepluggingLe);
+                    vboxUsbFltDevRetain(pDevice);
+                    /* do not dereference object since we will use it later */
+                }
+                else
+                {
+                    LOG(("Replug NOT needed for device (0x%p)", pDevice));
+                    ObDereferenceObject(pDevObj);
+                }
+
+                VBOXUSBFLT_LOCK_RELEASE();
+
+                pDevRelations->Objects[k] = NULL;
+                --cReplugPdos;
+                ASSERT_WARN((uint32_t)cReplugPdos < UINT32_MAX/2, ("cReplugPdos(%d) state broken", cReplugPdos));
+                continue;
+            }
+            VBOXUSBFLT_LOCK_RELEASE();
+
+            LOG(("NO device info found for PDO 0x%p", pDevObj));
+            VBOXUSBFLT_DEVICE Device;
+            Status = vboxUsbFltDevPopulate(&Device, pDevObj /*, FALSE /* only need filter properties */);
+            if (NT_SUCCESS(Status))
+            {
+                uintptr_t uId = 0;
+                bool fFilter = false;
+                bool fIsOneShot = false;
+                VBOXUSBFLT_LOCK_ACQUIRE();
+                PVBOXUSBFLTCTX pCtx = vboxUsbFltDevMatchLocked(&Device, &uId,
+                                                               false, /* do not remove a one-shot filter */
+                                                               &fFilter, &fIsOneShot);
+                VBOXUSBFLT_LOCK_RELEASE();
+                NOREF(pCtx);
+                LOG(("Matching Info: Filter (0x%p), pCtx(0x%p), fFilter(%d), fIsOneShot(%d)", uId, pCtx, (int)fFilter, (int)fIsOneShot));
+                if (fFilter)
+                {
+                    LOG(("Matching: This device SHOULD be filtered"));
+                    /* this device needs to be filtered, but it's not,
+                     * leave the PDO in array to issue a replug request for it
+                     * later on */
+                    continue;
+                }
+            }
+            else
+            {
+                WARN(("vboxUsbFltDevPopulate for PDO 0x%p failed with Status 0x%x", pDevObj, Status));
+            }
+
+            LOG(("Matching: This device should NOT be filtered"));
+            /* this device should not be filtered, and it's not */
+            ObDereferenceObject(pDevObj);
+            pDevRelations->Objects[k] = NULL;
+            --cReplugPdos;
+            ASSERT_WARN((uint32_t)cReplugPdos < UINT32_MAX/2, ("cReplugPdos is %d", cReplugPdos));
+        }
+
+        LOG(("(%d) non-matched PDOs to be replugged", cReplugPdos));
+
+        if (cReplugPdos)
+        {
+            for (ULONG k = 0; k < pDevRelations->Count; ++k)
+            {
+                if (!pDevRelations->Objects[k])
+                    continue;
+
+                Status = vboxUsbFltPdoReplug(pDevRelations->Objects[k]);
+                ASSERT_WARN(Status == STATUS_SUCCESS, ("vboxUsbFltPdoReplug ailed Status(0x%x)", Status));
+                ObDereferenceObject(pDevRelations->Objects[k]);
+                if (!--cReplugPdos)
+                    break;
+            }
+
+            ASSERT_WARN(!cReplugPdos, ("cReplugPdosreached zero!"));
+        }
+
+        vboxUsbFltReplugList(&ReplugDevList);
+
+        ExFreePool(pDevRelations);
+    }
+    else
+    {
+        WARN(("VBoxUsbMonQueryBusRelations failed for DO(0x%p), Status(0x%x), pDevRelations(0x%p)",
+                pTopDo, Status, pDevRelations));
+    }
+
+    LOG(("Done Visiting pFile(0x%p), pTopDo(0x%p), pHubDo(0x%p), oContext(0x%p)", pFile, pTopDo, pHubDo, pContext));
+
+    return TRUE;
+}
+
+NTSTATUS VBoxUsbFltFilterCheck(PVBOXUSBFLTCTX pContext)
+{
+    KIRQL Irql = KeGetCurrentIrql();
+    ASSERT_WARN(Irql == PASSIVE_LEVEL, ("unexpected IRQL (%d)", Irql));
+
+    LOG(("Running filters, Context (0x%p)..", pContext));
+
+    VBOXUSBFLTCHECKWALKER Data;
+    Data.pContext = pContext;
+    vboxUsbMonHubDevWalk(vboxUsbFltFilterCheckWalker, &Data, VBOXUSBMONHUBWALK_F_FDO);
+
+    LOG(("DONE Running filters, Context (0x%p)", pContext));
+
+    return STATUS_SUCCESS;
+}
+
+NTSTATUS VBoxUsbFltClose(PVBOXUSBFLTCTX pContext)
+{
+    LOG(("Closing context(0x%p)", pContext));
+    LIST_ENTRY ReplugDevList;
+    InitializeListHead(&ReplugDevList);
+
+    ASSERT_WARN(pContext, ("null context"));
+
+    KIRQL Irql = KeGetCurrentIrql();
+    ASSERT_WARN(Irql == PASSIVE_LEVEL, ("irql==(%d)", Irql));
+
+    VBOXUSBFLT_LOCK_ACQUIRE();
+
+    pContext->bRemoved = TRUE;
+    if (pContext->pChangeEvent)
+    {
+        LOG(("seting & closing change event (0x%p)", pContext->pChangeEvent));
+        KeSetEvent(pContext->pChangeEvent,
+                0, /* increment*/
+                FALSE /* wait */);
+        ObDereferenceObject(pContext->pChangeEvent);
+        pContext->pChangeEvent = NULL;
+    }
+    else
+        LOG(("no change event"));
+    RemoveEntryList(&pContext->ListEntry);
+
+    LOG(("removing owner filters"));
+    /* now re-arrange the filters */
+    /* 1. remove filters */
+    VBoxUSBFilterRemoveOwner(pContext);
+
+    LOG(("enumerating devices.."));
+    /* 2. check if there are devices owned */
+    for (PLIST_ENTRY pEntry = g_VBoxUsbFltGlobals.DeviceList.Flink;
+         pEntry != &g_VBoxUsbFltGlobals.DeviceList;
+         pEntry = pEntry->Flink)
+    {
+        PVBOXUSBFLT_DEVICE pDevice = PVBOXUSBFLT_DEVICE_FROM_LE(pEntry);
+        if (pDevice->pOwner != pContext)
+            continue;
+
+        LOG(("found device(0x%p), pdo(0x%p), state(%d), filter id(0x%p), oneshot(%d)",
+                pDevice, pDevice->Pdo, pDevice->enmState, pDevice->uFltId, (int)pDevice->fIsFilterOneShot));
+        ASSERT_WARN(pDevice->enmState != VBOXUSBFLT_DEVSTATE_ADDED, ("VBOXUSBFLT_DEVSTATE_ADDED state for device(0x%p)", pDevice));
+        ASSERT_WARN(pDevice->enmState != VBOXUSBFLT_DEVSTATE_REMOVED, ("VBOXUSBFLT_DEVSTATE_REMOVED state for device(0x%p)", pDevice));
+
+        vboxUsbFltDevOwnerClearLocked(pDevice);
+
+        if (vboxUsbFltDevCheckReplugLocked(pDevice, pContext))
+        {
+            LOG(("device needs replug"));
+            InsertHeadList(&ReplugDevList, &pDevice->RepluggingLe);
+            /* retain to ensure the device is not removed before we issue a replug */
+            vboxUsbFltDevRetain(pDevice);
+            /* keep the PDO alive */
+            ObReferenceObject(pDevice->Pdo);
+        }
+        else
+        {
+            LOG(("device does NOT need replug"));
+        }
+    }
+
+    VBOXUSBFLT_LOCK_RELEASE();
+
+    /* this should replug all devices that were either skipped or grabbed due to the context's */
+    vboxUsbFltReplugList(&ReplugDevList);
+
+    LOG(("SUCCESS done context(0x%p)", pContext));
+    return STATUS_SUCCESS;
+}
+
+NTSTATUS VBoxUsbFltCreate(PVBOXUSBFLTCTX pContext)
+{
+    LOG(("Creating context(0x%p)", pContext));
+    memset(pContext, 0, sizeof (*pContext));
+    pContext->Process = RTProcSelf();
+    VBOXUSBFLT_LOCK_ACQUIRE();
+    InsertHeadList(&g_VBoxUsbFltGlobals.ContextList, &pContext->ListEntry);
+    VBOXUSBFLT_LOCK_RELEASE();
+    LOG(("SUCCESS context(0x%p)", pContext));
+    return STATUS_SUCCESS;
+}
+
+int VBoxUsbFltAdd(PVBOXUSBFLTCTX pContext, PUSBFILTER pFilter, uintptr_t *pId)
+{
+    LOG(("adding filter, Context (0x%p)..", pContext));
+    *pId = 0;
+    /* LOG the filter details. */
+    LOG((__FUNCTION__": %s %s %s",
+        USBFilterGetString(pFilter, USBFILTERIDX_MANUFACTURER_STR)  ? USBFilterGetString(pFilter, USBFILTERIDX_MANUFACTURER_STR)  : "<null>",
+        USBFilterGetString(pFilter, USBFILTERIDX_PRODUCT_STR)       ? USBFilterGetString(pFilter, USBFILTERIDX_PRODUCT_STR)       : "<null>",
+        USBFilterGetString(pFilter, USBFILTERIDX_SERIAL_NUMBER_STR) ? USBFilterGetString(pFilter, USBFILTERIDX_SERIAL_NUMBER_STR) : "<null>"));
+#ifdef VBOX_USB_WITH_VERBOSE_LOGGING
+    LOG(("VBoxUSBClient::addFilter: idVendor=%#x idProduct=%#x bcdDevice=%#x bDeviceClass=%#x bDeviceSubClass=%#x bDeviceProtocol=%#x bBus=%#x bPort=%#x Type%#x",
+              USBFilterGetNum(pFilter, USBFILTERIDX_VENDOR_ID),
+              USBFilterGetNum(pFilter, USBFILTERIDX_PRODUCT_ID),
+              USBFilterGetNum(pFilter, USBFILTERIDX_DEVICE_REV),
+              USBFilterGetNum(pFilter, USBFILTERIDX_DEVICE_CLASS),
+              USBFilterGetNum(pFilter, USBFILTERIDX_DEVICE_SUB_CLASS),
+              USBFilterGetNum(pFilter, USBFILTERIDX_DEVICE_PROTOCOL),
+              USBFilterGetNum(pFilter, USBFILTERIDX_BUS),
+              USBFilterGetNum(pFilter, USBFILTERIDX_PORT),
+              USBFilterGetFilterType(pFilter)));
+#endif
+
+    /* We can't get the bus/port numbers. Ignore them while matching. */
+    USBFilterSetMustBePresent(pFilter, USBFILTERIDX_BUS, false);
+    USBFilterSetMustBePresent(pFilter, USBFILTERIDX_PORT, false);
+
+    uintptr_t uId = 0;
+    VBOXUSBFLT_LOCK_ACQUIRE();
+    /* Add the filter. */
+    int rc = VBoxUSBFilterAdd(pFilter, pContext, &uId);
+    VBOXUSBFLT_LOCK_RELEASE();
+    if (RT_SUCCESS(rc))
+    {
+        LOG(("ADDED filer id 0x%p", uId));
+        ASSERT_WARN(uId, ("uid is NULL"));
+#ifdef VBOX_USBMON_WITH_FILTER_AUTOAPPLY
+        VBoxUsbFltFilterCheck();
+#endif
+    }
+    else
+    {
+        WARN(("VBoxUSBFilterAdd failed rc (%d)", rc));
+        ASSERT_WARN(!uId, ("uid is not NULL"));
+    }
+
+    *pId = uId;
+    return rc;
+}
+
+int VBoxUsbFltRemove(PVBOXUSBFLTCTX pContext, uintptr_t uId)
+{
+    LOG(("removing filter id(0x%p), Context (0x%p)..", pContext, uId));
+    Assert(uId);
+
+    VBOXUSBFLT_LOCK_ACQUIRE();
+    int rc = VBoxUSBFilterRemove(pContext, uId);
+    if (!RT_SUCCESS(rc))
+    {
+        WARN(("VBoxUSBFilterRemove failed rc (%d)", rc));
+        VBOXUSBFLT_LOCK_RELEASE();
+        return rc;
+    }
+
+    LOG(("enumerating devices.."));
+    for (PLIST_ENTRY pEntry = g_VBoxUsbFltGlobals.DeviceList.Flink;
+            pEntry != &g_VBoxUsbFltGlobals.DeviceList;
+            pEntry = pEntry->Flink)
+    {
+        PVBOXUSBFLT_DEVICE pDevice = PVBOXUSBFLT_DEVICE_FROM_LE(pEntry);
+        if (pDevice->fIsFilterOneShot)
+        {
+            ASSERT_WARN(!pDevice->uFltId, ("oneshot filter on device(0x%p): unexpected uFltId(%d)", pDevice, pDevice->uFltId));
+        }
+
+        if (pDevice->uFltId != uId)
+            continue;
+
+        ASSERT_WARN(pDevice->pOwner == pContext, ("Device(0x%p) owner(0x%p) not match to (0x%p)", pDevice, pDevice->pOwner, pContext));
+        if (pDevice->pOwner != pContext)
+            continue;
+
+        LOG(("found device(0x%p), pdo(0x%p), state(%d), filter id(0x%p), oneshot(%d)",
+                pDevice, pDevice->Pdo, pDevice->enmState, pDevice->uFltId, (int)pDevice->fIsFilterOneShot));
+        ASSERT_WARN(!pDevice->fIsFilterOneShot, ("device(0x%p) is filtered with a oneshot filter", pDevice));
+        pDevice->uFltId = 0;
+        /* clear the fIsFilterOneShot flag to ensure the device is replugged on the next VBoxUsbFltFilterCheck call */
+        pDevice->fIsFilterOneShot = false;
+    }
+    VBOXUSBFLT_LOCK_RELEASE();
+
+    LOG(("done enumerating devices"));
+
+    if (RT_SUCCESS(rc))
+    {
+#ifdef VBOX_USBMON_WITH_FILTER_AUTOAPPLY
+        VBoxUsbFltFilterCheck();
+#endif
+    }
+    return rc;
+}
+
+NTSTATUS VBoxUsbFltSetNotifyEvent(PVBOXUSBFLTCTX pContext, HANDLE hEvent)
+{
+    NTSTATUS Status = STATUS_SUCCESS;
+    PKEVENT pEvent = NULL;
+    PKEVENT pOldEvent = NULL;
+    if (hEvent)
+    {
+        Status = ObReferenceObjectByHandle(hEvent,
+                    EVENT_MODIFY_STATE,
+                    *ExEventObjectType, UserMode,
+                    (PVOID*)&pEvent,
+                    NULL);
+        Assert(Status == STATUS_SUCCESS);
+        if (!NT_SUCCESS(Status))
+            return Status;
+    }
+
+    VBOXUSBFLT_LOCK_ACQUIRE();
+    pOldEvent = pContext->pChangeEvent;
+    pContext->pChangeEvent = pEvent;
+    VBOXUSBFLT_LOCK_RELEASE();
+
+    if (pOldEvent)
+    {
+        ObDereferenceObject(pOldEvent);
+    }
+
+    return STATUS_SUCCESS;
+}
+
+static USBDEVICESTATE vboxUsbDevGetUserState(PVBOXUSBFLTCTX pContext, PVBOXUSBFLT_DEVICE pDevice)
+{
+    if (vboxUsbFltDevStateIsNotFiltered(pDevice))
+        return USBDEVICESTATE_USED_BY_HOST_CAPTURABLE;
+
+    /* the device is filtered, or replugging */
+    if (pDevice->enmState == VBOXUSBFLT_DEVSTATE_REPLUGGING)
+    {
+        ASSERT_WARN(!pDevice->pOwner, ("replugging device(0x%p) still has an owner(0x%p)", pDevice, pDevice->pOwner));
+        ASSERT_WARN(!pDevice->uFltId, ("replugging device(0x%p) still has filter(0x%p)", pDevice, pDevice->uFltId));
+        /* no user state for this, we should not return it tu the user */
+        return USBDEVICESTATE_USED_BY_HOST;
+    }
+
+    /* the device is filtered, if owner differs from the context, return as USED_BY_HOST */
+    ASSERT_WARN(pDevice->pOwner, ("device(0x%p) has noowner", pDevice));
+    /* the id can be null if a filter is removed */
+//    Assert(pDevice->uFltId);
+
+    if (pDevice->pOwner != pContext)
+    {
+        LOG(("Device owner differs from the current context, returning used by host"));
+        return USBDEVICESTATE_USED_BY_HOST;
+    }
+
+    switch (pDevice->enmState)
+    {
+        case VBOXUSBFLT_DEVSTATE_UNCAPTURED:
+        case VBOXUSBFLT_DEVSTATE_CAPTURING:
+            return USBDEVICESTATE_USED_BY_HOST_CAPTURABLE;
+        case VBOXUSBFLT_DEVSTATE_CAPTURED:
+            return USBDEVICESTATE_HELD_BY_PROXY;
+        case VBOXUSBFLT_DEVSTATE_USED_BY_GUEST:
+            return USBDEVICESTATE_USED_BY_GUEST;
+        default:
+            WARN(("unexpected device state(%d) for device(0x%p)", pDevice->enmState, pDevice));
+            return USBDEVICESTATE_UNSUPPORTED;
+    }
+}
+
+NTSTATUS VBoxUsbFltGetDevice(PVBOXUSBFLTCTX pContext, HVBOXUSBDEVUSR hDevice, PUSBSUP_GETDEV_MON pInfo)
+{
+    Assert(hDevice);
+
+    memset (pInfo, 0, sizeof (*pInfo));
+    VBOXUSBFLT_LOCK_ACQUIRE();
+    for (PLIST_ENTRY pEntry = g_VBoxUsbFltGlobals.DeviceList.Flink;
+            pEntry != &g_VBoxUsbFltGlobals.DeviceList;
+            pEntry = pEntry->Flink)
+    {
+        PVBOXUSBFLT_DEVICE pDevice = PVBOXUSBFLT_DEVICE_FROM_LE(pEntry);
+        Assert(pDevice->enmState != VBOXUSBFLT_DEVSTATE_REMOVED);
+        Assert(pDevice->enmState != VBOXUSBFLT_DEVSTATE_ADDED);
+
+        if (pDevice != hDevice)
+            continue;
+
+        USBDEVICESTATE enmUsrState = vboxUsbDevGetUserState(pContext, pDevice);
+        pInfo->enmState = enmUsrState;
+        VBOXUSBFLT_LOCK_RELEASE();
+        return STATUS_SUCCESS;
+    }
+
+    VBOXUSBFLT_LOCK_RELEASE();
+
+    /* this should not occur */
+    AssertFailed();
+
+    return STATUS_INVALID_PARAMETER;
+}
+
+NTSTATUS VBoxUsbFltPdoAdd(PDEVICE_OBJECT pPdo, BOOLEAN *pbFiltered)
+{
+    *pbFiltered = FALSE;
+    PVBOXUSBFLT_DEVICE pDevice;
+
+    /* first check if device is in the a already */
+    VBOXUSBFLT_LOCK_ACQUIRE();
+    pDevice = vboxUsbFltDevGetLocked(pPdo);
+    if (pDevice)
+    {
+        LOG(("found device (0x%p), state(%d) for PDO(0x%p)", pDevice, pDevice->enmState, pPdo));
+        ASSERT_WARN(pDevice->enmState != VBOXUSBFLT_DEVSTATE_ADDED, ("VBOXUSBFLT_DEVSTATE_ADDED state for device(0x%p)", pDevice));
+        ASSERT_WARN(pDevice->enmState != VBOXUSBFLT_DEVSTATE_REMOVED, ("VBOXUSBFLT_DEVSTATE_REMOVED state for device(0x%p)", pDevice));
+        *pbFiltered = pDevice->enmState >= VBOXUSBFLT_DEVSTATE_CAPTURING;
+        VBOXUSBFLT_LOCK_RELEASE();
+        return STATUS_SUCCESS;
+    }
+    VBOXUSBFLT_LOCK_RELEASE();
+    pDevice = (PVBOXUSBFLT_DEVICE)VBoxUsbMonMemAllocZ(sizeof (*pDevice));
+    if (!pDevice)
+    {
+        WARN(("VBoxUsbMonMemAllocZ failed"));
+        return STATUS_NO_MEMORY;
+    }
+
+    pDevice->enmState = VBOXUSBFLT_DEVSTATE_ADDED;
+    pDevice->cRefs = 1;
+    NTSTATUS Status = vboxUsbFltDevPopulate(pDevice, pPdo /* , TRUE /* need all props */);
+    if (!NT_SUCCESS(Status))
+    {
+        WARN(("vboxUsbFltDevPopulate failed, Status 0x%x", Status));
+        VBoxUsbMonMemFree(pDevice);
+        return Status;
+    }
+
+    uintptr_t uId;
+    bool fFilter = false;
+    bool fIsOneShot = false;
+    PVBOXUSBFLTCTX pCtx;
+    PVBOXUSBFLT_DEVICE pTmpDev;
+    VBOXUSBFLT_LOCK_ACQUIRE();
+    /* (paranoia) re-check the device is still not here */
+    pTmpDev = vboxUsbFltDevGetLocked(pPdo);
+    if (pTmpDev)
+    {
+        LOG(("second try: found device (0x%p), state(%d) for PDO(0x%p)", pDevice, pDevice->enmState, pPdo));
+        ASSERT_WARN(pDevice->enmState != VBOXUSBFLT_DEVSTATE_ADDED, ("second try: VBOXUSBFLT_DEVSTATE_ADDED state for device(0x%p)", pDevice));
+        ASSERT_WARN(pDevice->enmState != VBOXUSBFLT_DEVSTATE_REMOVED, ("second try: VBOXUSBFLT_DEVSTATE_REMOVED state for device(0x%p)", pDevice));
+        *pbFiltered = pTmpDev->enmState >= VBOXUSBFLT_DEVSTATE_CAPTURING;
+        VBOXUSBFLT_LOCK_RELEASE();
+        VBoxUsbMonMemFree(pDevice);
+        return STATUS_SUCCESS;
+    }
+
+    LOG(("Created Device 0x%p for PDO 0x%p", pDevice, pPdo));
+
+    pCtx = vboxUsbFltDevMatchLocked(pDevice, &uId,
+            true, /* remove a one-shot filter */
+            &fFilter, &fIsOneShot);
+    LOG(("Matching Info: Filter (0x%p), pCtx(0x%p), fFilter(%d), fIsOneShot(%d)", uId, pCtx, (int)fFilter, (int)fIsOneShot));
+    if (fFilter)
+    {
+        LOG(("Created Device 0x%p should be filtered", pDevice));
+        ASSERT_WARN(pCtx, ("zero ctx"));
+        ASSERT_WARN(uId, ("zero uId"));
+        pDevice->enmState = VBOXUSBFLT_DEVSTATE_CAPTURING;
+    }
+    else
+    {
+        LOG(("Created Device 0x%p should NOT be filtered", pDevice));
+        ASSERT_WARN(!uId == !pCtx, ("invalid uid(0x%p) - ctx(0x%p) pair", uId, pCtx)); /* either both zero or both not */
+        pDevice->enmState = VBOXUSBFLT_DEVSTATE_UNCAPTURED;
+    }
+
+    if (pCtx)
+        vboxUsbFltDevOwnerSetLocked(pDevice, pCtx, fIsOneShot ? 0 : uId, fIsOneShot);
+
+    InsertHeadList(&g_VBoxUsbFltGlobals.DeviceList, &pDevice->GlobalLe);
+
+    /* do not need to signal anything here -
+     * going to do that once the proxy device object starts */
+    VBOXUSBFLT_LOCK_RELEASE();
+
+    *pbFiltered = fFilter;
+
+    return STATUS_SUCCESS;
+}
+
+NTSTATUS VBoxUsbFltPdoAddCompleted(PDEVICE_OBJECT pPdo)
+{
+    RT_NOREF1(pPdo);
+    VBOXUSBFLT_LOCK_ACQUIRE();
+    vboxUsbFltSignalChangeLocked();
+    VBOXUSBFLT_LOCK_RELEASE();
+    return STATUS_SUCCESS;
+}
+
+BOOLEAN VBoxUsbFltPdoIsFiltered(PDEVICE_OBJECT pPdo)
+{
+    VBOXUSBFLT_DEVSTATE enmState = VBOXUSBFLT_DEVSTATE_REMOVED;
+    VBOXUSBFLT_LOCK_ACQUIRE();
+
+    PVBOXUSBFLT_DEVICE pDevice = vboxUsbFltDevGetLocked(pPdo);
+    if (pDevice)
+        enmState = pDevice->enmState;
+
+    VBOXUSBFLT_LOCK_RELEASE();
+
+    return enmState >= VBOXUSBFLT_DEVSTATE_CAPTURING;
+}
+
+NTSTATUS VBoxUsbFltPdoRemove(PDEVICE_OBJECT pPdo)
+{
+    PVBOXUSBFLT_DEVICE pDevice;
+    VBOXUSBFLT_DEVSTATE enmOldState;
+
+    VBOXUSBFLT_LOCK_ACQUIRE();
+    pDevice = vboxUsbFltDevGetLocked(pPdo);
+    if (pDevice)
+    {
+        RemoveEntryList(&pDevice->GlobalLe);
+        enmOldState = pDevice->enmState;
+        pDevice->enmState = VBOXUSBFLT_DEVSTATE_REMOVED;
+        if (enmOldState != VBOXUSBFLT_DEVSTATE_REPLUGGING)
+        {
+            vboxUsbFltSignalChangeLocked();
+        }
+        else
+        {
+            /* the device *should* reappear, do signlling on re-appear only
+             * to avoid extra signaling. still there might be a situation
+             * when the device will not re-appear if it gets physically removed
+             * before it re-appears
+             * @todo: set a timer callback to do a notification from it */
+        }
+    }
+    VBOXUSBFLT_LOCK_RELEASE();
+    if (pDevice)
+        vboxUsbFltDevRelease(pDevice);
+    return STATUS_SUCCESS;
+}
+
+HVBOXUSBFLTDEV VBoxUsbFltProxyStarted(PDEVICE_OBJECT pPdo)
+{
+    PVBOXUSBFLT_DEVICE pDevice;
+    VBOXUSBFLT_LOCK_ACQUIRE();
+    pDevice = vboxUsbFltDevGetLocked(pPdo);
+    /*
+     * Prevent a host crash when vboxUsbFltDevGetLocked fails to locate the matching PDO
+     * in g_VBoxUsbFltGlobals.DeviceList (see @bugref{6509}).
+     */
+    if (pDevice == NULL)
+    {
+        WARN(("failed to get device for PDO(0x%p)", pPdo));
+    }
+    else if (pDevice->enmState = VBOXUSBFLT_DEVSTATE_CAPTURING)
+    {
+        pDevice->enmState = VBOXUSBFLT_DEVSTATE_CAPTURED;
+        LOG(("The proxy notified proxy start for the captured device 0x%x", pDevice));
+        vboxUsbFltDevRetain(pDevice);
+        vboxUsbFltSignalChangeLocked();
+    }
+    else
+    {
+        WARN(("invalid state, %d", pDevice->enmState));
+        pDevice = NULL;
+    }
+    VBOXUSBFLT_LOCK_RELEASE();
+    return pDevice;
+}
+
+void VBoxUsbFltProxyStopped(HVBOXUSBFLTDEV hDev)
+{
+    PVBOXUSBFLT_DEVICE pDevice = (PVBOXUSBFLT_DEVICE)hDev;
+    /*
+     * Prevent a host crash when VBoxUsbFltProxyStarted fails, returning NULL.
+     * See @bugref{6509}.
+     */
+    if (pDevice == NULL)
+    {
+        WARN(("VBoxUsbFltProxyStopped called with NULL device pointer"));
+        return;
+    }
+    VBOXUSBFLT_LOCK_ACQUIRE();
+    if (pDevice->enmState == VBOXUSBFLT_DEVSTATE_CAPTURED
+            || pDevice->enmState == VBOXUSBFLT_DEVSTATE_USED_BY_GUEST)
+    {
+        /* this is due to devie was physically removed */
+        LOG(("The proxy notified proxy stop for the captured device 0x%x, current state %d", pDevice, pDevice->enmState));
+        pDevice->enmState = VBOXUSBFLT_DEVSTATE_CAPTURING;
+        vboxUsbFltSignalChangeLocked();
+    }
+    else
+    {
+        if (pDevice->enmState != VBOXUSBFLT_DEVSTATE_REPLUGGING)
+        {
+            WARN(("invalid state, %d", pDevice->enmState));
+        }
+    }
+    VBOXUSBFLT_LOCK_RELEASE();
+
+    vboxUsbFltDevRelease(pDevice);
+}
+
+NTSTATUS VBoxUsbFltInit()
+{
+    int rc = VBoxUSBFilterInit();
+    if (RT_FAILURE(rc))
+    {
+        WARN(("VBoxUSBFilterInit failed, rc (%d)", rc));
+        return STATUS_UNSUCCESSFUL;
+    }
+
+    memset(&g_VBoxUsbFltGlobals, 0, sizeof (g_VBoxUsbFltGlobals));
+    InitializeListHead(&g_VBoxUsbFltGlobals.DeviceList);
+    InitializeListHead(&g_VBoxUsbFltGlobals.ContextList);
+    InitializeListHead(&g_VBoxUsbFltGlobals.BlackDeviceList);
+    vboxUsbFltBlDevPopulateWithKnownLocked();
+    VBOXUSBFLT_LOCK_INIT();
+    return STATUS_SUCCESS;
+}
+
+NTSTATUS VBoxUsbFltTerm()
+{
+    bool bBusy = false;
+    VBOXUSBFLT_LOCK_ACQUIRE();
+    do
+    {
+        if (!IsListEmpty(&g_VBoxUsbFltGlobals.ContextList))
+        {
+            AssertFailed();
+            bBusy = true;
+            break;
+        }
+
+        PLIST_ENTRY pNext = NULL;
+        for (PLIST_ENTRY pEntry = g_VBoxUsbFltGlobals.DeviceList.Flink;
+                pEntry != &g_VBoxUsbFltGlobals.DeviceList;
+                pEntry = pNext)
+        {
+            pNext = pEntry->Flink;
+            PVBOXUSBFLT_DEVICE pDevice = PVBOXUSBFLT_DEVICE_FROM_LE(pEntry);
+            Assert(!pDevice->uFltId);
+            Assert(!pDevice->pOwner);
+            if (pDevice->cRefs != 1)
+            {
+                AssertFailed();
+                bBusy = true;
+                break;
+            }
+        }
+    } while (0);
+
+    VBOXUSBFLT_LOCK_RELEASE()
+
+    if (bBusy)
+    {
+        return STATUS_DEVICE_BUSY;
+    }
+
+    for (PLIST_ENTRY pEntry = g_VBoxUsbFltGlobals.DeviceList.Flink;
+            pEntry != &g_VBoxUsbFltGlobals.DeviceList;
+            pEntry = g_VBoxUsbFltGlobals.DeviceList.Flink)
+    {
+        RemoveEntryList(pEntry);
+        PVBOXUSBFLT_DEVICE pDevice = PVBOXUSBFLT_DEVICE_FROM_LE(pEntry);
+        pDevice->enmState = VBOXUSBFLT_DEVSTATE_REMOVED;
+        vboxUsbFltDevRelease(pDevice);
+    }
+
+    vboxUsbFltBlDevClearLocked();
+
+    VBOXUSBFLT_LOCK_TERM();
+
+    VBoxUSBFilterTerm();
+
+    return STATUS_SUCCESS;
+}
+
diff --git a/src/VBox/HostDrivers/VBoxUSB/win/mon/VBoxUsbFlt.h b/src/VBox/HostDrivers/VBoxUSB/win/mon/VBoxUsbFlt.h
new file mode 100644
index 00000000..f1249bdb
--- /dev/null
+++ b/src/VBox/HostDrivers/VBoxUSB/win/mon/VBoxUsbFlt.h
@@ -0,0 +1,68 @@
+/* $Id: VBoxUsbFlt.h $ */
+/** @file
+ * VBox USB Monitor Device Filtering functionality
+ */
+
+/*
+ * Copyright (C) 2011-2019 Oracle Corporation
+ *
+ * This file is part of VirtualBox Open Source Edition (OSE), as
+ * available from http://www.virtualbox.org. This file is free software;
+ * you can redistribute it and/or modify it under the terms of the GNU
+ * General Public License (GPL) as published by the Free Software
+ * Foundation, in version 2 as it comes in the "COPYING" file of the
+ * VirtualBox OSE distribution. VirtualBox OSE is distributed in the
+ * hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
+ *
+ * The contents of this file may alternatively be used under the terms
+ * of the Common Development and Distribution License Version 1.0
+ * (CDDL) only, as it comes in the "COPYING.CDDL" file of the
+ * VirtualBox OSE distribution, in which case the provisions of the
+ * CDDL are applicable instead of those of the GPL.
+ *
+ * You may elect to license modified versions of this file under the
+ * terms and conditions of either the GPL or the CDDL or both.
+ */
+
+#ifndef VBOX_INCLUDED_SRC_VBoxUSB_win_mon_VBoxUsbFlt_h
+#define VBOX_INCLUDED_SRC_VBoxUSB_win_mon_VBoxUsbFlt_h
+#ifndef RT_WITHOUT_PRAGMA_ONCE
+# pragma once
+#endif
+
+#include "VBoxUsbMon.h"
+#include <VBoxUSBFilterMgr.h>
+
+#include <VBox/usblib-win.h>
+
+typedef struct VBOXUSBFLTCTX
+{
+    LIST_ENTRY ListEntry;
+    PKEVENT pChangeEvent;
+    RTPROCESS Process;
+    uint32_t cActiveFilters;
+    BOOLEAN bRemoved;
+} VBOXUSBFLTCTX, *PVBOXUSBFLTCTX;
+
+NTSTATUS VBoxUsbFltInit();
+NTSTATUS VBoxUsbFltTerm();
+NTSTATUS VBoxUsbFltCreate(PVBOXUSBFLTCTX pContext);
+NTSTATUS VBoxUsbFltClose(PVBOXUSBFLTCTX pContext);
+int VBoxUsbFltAdd(PVBOXUSBFLTCTX pContext, PUSBFILTER pFilter, uintptr_t *pId);
+int VBoxUsbFltRemove(PVBOXUSBFLTCTX pContext, uintptr_t uId);
+NTSTATUS VBoxUsbFltSetNotifyEvent(PVBOXUSBFLTCTX pContext, HANDLE hEvent);
+NTSTATUS VBoxUsbFltFilterCheck(PVBOXUSBFLTCTX pContext);
+
+NTSTATUS VBoxUsbFltGetDevice(PVBOXUSBFLTCTX pContext, HVBOXUSBDEVUSR hDevice, PUSBSUP_GETDEV_MON pInfo);
+
+typedef void* HVBOXUSBFLTDEV;
+HVBOXUSBFLTDEV VBoxUsbFltProxyStarted(PDEVICE_OBJECT pPdo);
+void VBoxUsbFltProxyStopped(HVBOXUSBFLTDEV hDev);
+
+NTSTATUS VBoxUsbFltPdoAdd(PDEVICE_OBJECT pPdo, BOOLEAN *pbFiltered);
+NTSTATUS VBoxUsbFltPdoAddCompleted(PDEVICE_OBJECT pPdo);
+NTSTATUS VBoxUsbFltPdoRemove(PDEVICE_OBJECT pPdo);
+BOOLEAN VBoxUsbFltPdoIsFiltered(PDEVICE_OBJECT pPdo);
+
+#endif /* !VBOX_INCLUDED_SRC_VBoxUSB_win_mon_VBoxUsbFlt_h */
+
diff --git a/src/VBox/HostDrivers/VBoxUSB/win/mon/VBoxUsbHook.cpp b/src/VBox/HostDrivers/VBoxUSB/win/mon/VBoxUsbHook.cpp
new file mode 100644
index 00000000..3061d5cf
--- /dev/null
+++ b/src/VBox/HostDrivers/VBoxUSB/win/mon/VBoxUsbHook.cpp
@@ -0,0 +1,208 @@
+/* $Id: VBoxUsbHook.cpp $ */
+/** @file
+ * Driver Dispatch Table Hooking API
+ */
+
+/*
+ * Copyright (C) 2011-2019 Oracle Corporation
+ *
+ * This file is part of VirtualBox Open Source Edition (OSE), as
+ * available from http://www.virtualbox.org. This file is free software;
+ * you can redistribute it and/or modify it under the terms of the GNU
+ * General Public License (GPL) as published by the Free Software
+ * Foundation, in version 2 as it comes in the "COPYING" file of the
+ * VirtualBox OSE distribution. VirtualBox OSE is distributed in the
+ * hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
+ *
+ * The contents of this file may alternatively be used under the terms
+ * of the Common Development and Distribution License Version 1.0
+ * (CDDL) only, as it comes in the "COPYING.CDDL" file of the
+ * VirtualBox OSE distribution, in which case the provisions of the
+ * CDDL are applicable instead of those of the GPL.
+ *
+ * You may elect to license modified versions of this file under the
+ * terms and conditions of either the GPL or the CDDL or both.
+ */
+
+
+/*********************************************************************************************************************************
+*   Header Files                                                                                                                 *
+*********************************************************************************************************************************/
+#include "VBoxUsbMon.h"
+
+
+/*********************************************************************************************************************************
+*   Defined Constants And Macros                                                                                                 *
+*********************************************************************************************************************************/
+#define VBOXUSBHOOK_MEMTAG 'HUBV'
+
+
+NTSTATUS VBoxUsbHookInstall(PVBOXUSBHOOK_ENTRY pHook)
+{
+    KIRQL Irql;
+    KeAcquireSpinLock(&pHook->Lock, &Irql);
+    if (pHook->fIsInstalled)
+    {
+        WARN(("hook is marked installed, returning failure"));
+        KeReleaseSpinLock(&pHook->Lock, Irql);
+        return STATUS_UNSUCCESSFUL;
+    }
+
+    pHook->pfnOldHandler = (PDRIVER_DISPATCH)InterlockedExchangePointer((PVOID*)&pHook->pDrvObj->MajorFunction[pHook->iMjFunction], pHook->pfnHook);
+    Assert(pHook->pfnOldHandler);
+    Assert(pHook->pfnHook != pHook->pfnOldHandler);
+    pHook->fIsInstalled = TRUE;
+    KeReleaseSpinLock(&pHook->Lock, Irql);
+    return STATUS_SUCCESS;
+
+}
+NTSTATUS VBoxUsbHookUninstall(PVBOXUSBHOOK_ENTRY pHook)
+{
+    KIRQL Irql;
+    KeAcquireSpinLock(&pHook->Lock, &Irql);
+    if (!pHook->fIsInstalled)
+    {
+        KeReleaseSpinLock(&pHook->Lock, Irql);
+        return STATUS_SUCCESS;
+    }
+
+    PDRIVER_DISPATCH pfnOldVal = (PDRIVER_DISPATCH)InterlockedCompareExchangePointer((PVOID*)&pHook->pDrvObj->MajorFunction[pHook->iMjFunction], pHook->pfnOldHandler, pHook->pfnHook);
+    Assert(pfnOldVal == pHook->pfnHook);
+    if (pfnOldVal != pHook->pfnHook)
+    {
+        AssertMsgFailed(("unhook failed!!!\n"));
+        /* this is bad! this could happen if someone else has chained another hook,
+         * or (which is even worse) restored the "initial" entry value it saved when doing a hooking before us
+         * return the failure and don't do anything else
+         * the best thing to do if this happens is to leave everything as is
+         * and to prevent the driver from being unloaded to ensure no one references our unloaded hook routine */
+        KeReleaseSpinLock(&pHook->Lock, Irql);
+        return STATUS_UNSUCCESSFUL;
+    }
+
+    pHook->fIsInstalled = FALSE;
+    KeReleaseSpinLock(&pHook->Lock, Irql);
+
+    /* wait for the current handlers to exit */
+    VBoxDrvToolRefWaitEqual(&pHook->HookRef, 1);
+
+    return STATUS_SUCCESS;
+}
+
+BOOLEAN VBoxUsbHookIsInstalled(PVBOXUSBHOOK_ENTRY pHook)
+{
+    KIRQL Irql;
+    BOOLEAN fIsInstalled;
+    KeAcquireSpinLock(&pHook->Lock, &Irql);
+    fIsInstalled = pHook->fIsInstalled;
+    KeReleaseSpinLock(&pHook->Lock, Irql);
+    return fIsInstalled;
+}
+
+VOID VBoxUsbHookInit(PVBOXUSBHOOK_ENTRY pHook, PDRIVER_OBJECT pDrvObj, UCHAR iMjFunction, PDRIVER_DISPATCH pfnHook)
+{
+    Assert(pDrvObj);
+    Assert(iMjFunction <= IRP_MJ_MAXIMUM_FUNCTION);
+    Assert(pfnHook);
+    memset(pHook, 0, sizeof (*pHook));
+    InitializeListHead(&pHook->RequestList);
+    KeInitializeSpinLock(&pHook->Lock);
+    VBoxDrvToolRefInit(&pHook->HookRef);
+    pHook->pDrvObj = pDrvObj;
+    pHook->iMjFunction = iMjFunction;
+    pHook->pfnHook = pfnHook;
+    Assert(!pHook->pfnOldHandler);
+    Assert(!pHook->fIsInstalled);
+
+}
+
+static void vboxUsbHookRequestRegisterCompletion(PVBOXUSBHOOK_ENTRY pHook, PDEVICE_OBJECT pDevObj, PIRP pIrp, PIO_COMPLETION_ROUTINE pfnCompletion, PVBOXUSBHOOK_REQUEST pRequest)
+{
+    Assert(pfnCompletion);
+    Assert(pRequest);
+    Assert(pDevObj);
+    Assert(pIrp);
+    PIO_STACK_LOCATION pSl = IoGetCurrentIrpStackLocation(pIrp);
+    memset(pRequest, 0, sizeof (*pRequest));
+    pRequest->pHook = pHook;
+    pRequest->OldLocation = *pSl;
+    pRequest->pDevObj = pDevObj;
+    pRequest->pIrp = pIrp;
+    pRequest->bCompletionStopped = FALSE;
+    pSl->CompletionRoutine = pfnCompletion;
+    pSl->Context = pRequest;
+    pSl->Control = SL_INVOKE_ON_SUCCESS | SL_INVOKE_ON_ERROR | SL_INVOKE_ON_CANCEL;
+
+    KIRQL oldIrql;
+    KeAcquireSpinLock(&pHook->Lock, &oldIrql);
+    InsertTailList(&pHook->RequestList, &pRequest->ListEntry);
+    KeReleaseSpinLock(&pHook->Lock, oldIrql);
+}
+
+NTSTATUS VBoxUsbHookRequestPassDownHookCompletion(PVBOXUSBHOOK_ENTRY pHook, PDEVICE_OBJECT pDevObj, PIRP pIrp, PIO_COMPLETION_ROUTINE pfnCompletion, PVBOXUSBHOOK_REQUEST pRequest)
+{
+    Assert(pfnCompletion);
+    vboxUsbHookRequestRegisterCompletion(pHook, pDevObj, pIrp, pfnCompletion, pRequest);
+    return pHook->pfnOldHandler(pDevObj, pIrp);
+}
+
+NTSTATUS VBoxUsbHookRequestPassDownHookSkip(PVBOXUSBHOOK_ENTRY pHook, PDEVICE_OBJECT pDevObj, PIRP pIrp)
+{
+    return pHook->pfnOldHandler(pDevObj, pIrp);
+}
+
+NTSTATUS VBoxUsbHookRequestMoreProcessingRequired(PVBOXUSBHOOK_ENTRY pHook, PDEVICE_OBJECT pDevObj, PIRP pIrp,
+                                                  PVBOXUSBHOOK_REQUEST pRequest)
+{
+    RT_NOREF3(pHook, pDevObj, pIrp);
+    Assert(!pRequest->bCompletionStopped);
+    pRequest->bCompletionStopped = TRUE;
+    return STATUS_MORE_PROCESSING_REQUIRED;
+}
+
+NTSTATUS VBoxUsbHookRequestComplete(PVBOXUSBHOOK_ENTRY pHook, PDEVICE_OBJECT pDevObj, PIRP pIrp, PVBOXUSBHOOK_REQUEST pRequest)
+{
+    NTSTATUS Status = STATUS_SUCCESS;
+
+    if (pRequest->OldLocation.CompletionRoutine && pRequest->OldLocation.Control)
+    {
+        Status = pRequest->OldLocation.CompletionRoutine(pDevObj, pIrp, pRequest->OldLocation.Context);
+    }
+
+    if (Status != STATUS_MORE_PROCESSING_REQUIRED)
+    {
+        if (pRequest->bCompletionStopped)
+        {
+            IoCompleteRequest(pIrp, IO_NO_INCREMENT);
+        }
+    }
+    /*
+     * else - in case driver returned STATUS_MORE_PROCESSING_REQUIRED,
+     * it will call IoCompleteRequest itself
+     */
+
+    KIRQL oldIrql;
+    KeAcquireSpinLock(&pHook->Lock, &oldIrql);
+    RemoveEntryList(&pRequest->ListEntry);
+    KeReleaseSpinLock(&pHook->Lock, oldIrql);
+    return Status;
+}
+
+#define PVBOXUSBHOOK_REQUEST_FROM_LE(_pLe) ( (PVBOXUSBHOOK_REQUEST)( ((uint8_t*)(_pLe)) - RT_OFFSETOF(VBOXUSBHOOK_REQUEST, ListEntry) ) )
+
+VOID VBoxUsbHookVerifyCompletion(PVBOXUSBHOOK_ENTRY pHook, PVBOXUSBHOOK_REQUEST pRequest, PIRP pIrp)
+{
+    KIRQL oldIrql;
+    KeAcquireSpinLock(&pHook->Lock, &oldIrql);
+    for (PLIST_ENTRY pLe = pHook->RequestList.Flink; pLe != &pHook->RequestList; pLe = pLe->Flink)
+    {
+        PVBOXUSBHOOK_REQUEST pCur = PVBOXUSBHOOK_REQUEST_FROM_LE(pLe);
+        if (pCur != pRequest)
+            continue;
+        if (pCur->pIrp != pIrp)
+            continue;
+        WARN(("found pending IRP(0x%p) when it should not be", pIrp));
+    }
+    KeReleaseSpinLock(&pHook->Lock, oldIrql);
+
+}
diff --git a/src/VBox/HostDrivers/VBoxUSB/win/mon/VBoxUsbHook.h b/src/VBox/HostDrivers/VBoxUSB/win/mon/VBoxUsbHook.h
new file mode 100644
index 00000000..b730ef60
--- /dev/null
+++ b/src/VBox/HostDrivers/VBoxUSB/win/mon/VBoxUsbHook.h
@@ -0,0 +1,86 @@
+/* $Id: VBoxUsbHook.h $ */
+/** @file
+ * Driver Dispatch Table Hooking API impl
+ */
+/*
+ * Copyright (C) 2011-2019 Oracle Corporation
+ *
+ * This file is part of VirtualBox Open Source Edition (OSE), as
+ * available from http://www.virtualbox.org. This file is free software;
+ * you can redistribute it and/or modify it under the terms of the GNU
+ * General Public License (GPL) as published by the Free Software
+ * Foundation, in version 2 as it comes in the "COPYING" file of the
+ * VirtualBox OSE distribution. VirtualBox OSE is distributed in the
+ * hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
+ *
+ * The contents of this file may alternatively be used under the terms
+ * of the Common Development and Distribution License Version 1.0
+ * (CDDL) only, as it comes in the "COPYING.CDDL" file of the
+ * VirtualBox OSE distribution, in which case the provisions of the
+ * CDDL are applicable instead of those of the GPL.
+ *
+ * You may elect to license modified versions of this file under the
+ * terms and conditions of either the GPL or the CDDL or both.
+ */
+
+#ifndef VBOX_INCLUDED_SRC_VBoxUSB_win_mon_VBoxUsbHook_h
+#define VBOX_INCLUDED_SRC_VBoxUSB_win_mon_VBoxUsbHook_h
+#ifndef RT_WITHOUT_PRAGMA_ONCE
+# pragma once
+#endif
+
+#include "VBoxUsbMon.h"
+
+typedef struct VBOXUSBHOOK_ENTRY
+{
+    LIST_ENTRY RequestList;
+    KSPIN_LOCK Lock;
+    BOOLEAN fIsInstalled;
+    PDRIVER_DISPATCH pfnOldHandler;
+    VBOXDRVTOOL_REF HookRef;
+    PDRIVER_OBJECT pDrvObj;
+    UCHAR iMjFunction;
+    PDRIVER_DISPATCH pfnHook;
+} VBOXUSBHOOK_ENTRY, *PVBOXUSBHOOK_ENTRY;
+
+typedef struct VBOXUSBHOOK_REQUEST
+{
+    LIST_ENTRY ListEntry;
+    PVBOXUSBHOOK_ENTRY pHook;
+    IO_STACK_LOCATION OldLocation;
+    PDEVICE_OBJECT pDevObj;
+    PIRP pIrp;
+    BOOLEAN bCompletionStopped;
+} VBOXUSBHOOK_REQUEST, *PVBOXUSBHOOK_REQUEST;
+
+DECLINLINE(BOOLEAN) VBoxUsbHookRetain(PVBOXUSBHOOK_ENTRY pHook)
+{
+    KIRQL Irql;
+    KeAcquireSpinLock(&pHook->Lock, &Irql);
+    if (!pHook->fIsInstalled)
+    {
+        KeReleaseSpinLock(&pHook->Lock, Irql);
+        return FALSE;
+    }
+
+    VBoxDrvToolRefRetain(&pHook->HookRef);
+    KeReleaseSpinLock(&pHook->Lock, Irql);
+    return TRUE;
+}
+
+DECLINLINE(VOID) VBoxUsbHookRelease(PVBOXUSBHOOK_ENTRY pHook)
+{
+    VBoxDrvToolRefRelease(&pHook->HookRef);
+}
+
+VOID VBoxUsbHookInit(PVBOXUSBHOOK_ENTRY pHook, PDRIVER_OBJECT pDrvObj, UCHAR iMjFunction, PDRIVER_DISPATCH pfnHook);
+NTSTATUS VBoxUsbHookInstall(PVBOXUSBHOOK_ENTRY pHook);
+NTSTATUS VBoxUsbHookUninstall(PVBOXUSBHOOK_ENTRY pHook);
+BOOLEAN VBoxUsbHookIsInstalled(PVBOXUSBHOOK_ENTRY pHook);
+NTSTATUS VBoxUsbHookRequestPassDownHookCompletion(PVBOXUSBHOOK_ENTRY pHook, PDEVICE_OBJECT pDevObj, PIRP pIrp, PIO_COMPLETION_ROUTINE pfnCompletion, PVBOXUSBHOOK_REQUEST pRequest);
+NTSTATUS VBoxUsbHookRequestPassDownHookSkip(PVBOXUSBHOOK_ENTRY pHook, PDEVICE_OBJECT pDevObj, PIRP pIrp);
+NTSTATUS VBoxUsbHookRequestMoreProcessingRequired(PVBOXUSBHOOK_ENTRY pHook, PDEVICE_OBJECT pDevObj, PIRP pIrp, PVBOXUSBHOOK_REQUEST pRequest);
+NTSTATUS VBoxUsbHookRequestComplete(PVBOXUSBHOOK_ENTRY pHook, PDEVICE_OBJECT pDevObj, PIRP pIrp, PVBOXUSBHOOK_REQUEST pRequest);
+VOID VBoxUsbHookVerifyCompletion(PVBOXUSBHOOK_ENTRY pHook, PVBOXUSBHOOK_REQUEST pRequest, PIRP pIrp);
+
+#endif /* !VBOX_INCLUDED_SRC_VBoxUSB_win_mon_VBoxUsbHook_h */
diff --git a/src/VBox/HostDrivers/VBoxUSB/win/mon/VBoxUsbMon.cpp b/src/VBox/HostDrivers/VBoxUSB/win/mon/VBoxUsbMon.cpp
new file mode 100644
index 00000000..0dd0a5c4
--- /dev/null
+++ b/src/VBox/HostDrivers/VBoxUSB/win/mon/VBoxUsbMon.cpp
@@ -0,0 +1,1986 @@
+/* $Id: VBoxUsbMon.cpp $ */
+/** @file
+ * VBox USB Monitor
+ */
+
+/*
+ * Copyright (C) 2011-2019 Oracle Corporation
+ *
+ * This file is part of VirtualBox Open Source Edition (OSE), as
+ * available from http://www.virtualbox.org. This file is free software;
+ * you can redistribute it and/or modify it under the terms of the GNU
+ * General Public License (GPL) as published by the Free Software
+ * Foundation, in version 2 as it comes in the "COPYING" file of the
+ * VirtualBox OSE distribution. VirtualBox OSE is distributed in the
+ * hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
+ *
+ * The contents of this file may alternatively be used under the terms
+ * of the Common Development and Distribution License Version 1.0
+ * (CDDL) only, as it comes in the "COPYING.CDDL" file of the
+ * VirtualBox OSE distribution, in which case the provisions of the
+ * CDDL are applicable instead of those of the GPL.
+ *
+ * You may elect to license modified versions of this file under the
+ * terms and conditions of either the GPL or the CDDL or both.
+ */
+
+
+/*********************************************************************************************************************************
+*   Header Files                                                                                                                 *
+*********************************************************************************************************************************/
+#include "VBoxUsbMon.h"
+#include "../cmn/VBoxUsbIdc.h"
+#include <iprt/errcore.h>
+#include <VBox/usblib.h>
+#include <excpt.h>
+
+
+/*********************************************************************************************************************************
+*   Defined Constants And Macros                                                                                                 *
+*********************************************************************************************************************************/
+/*
+ * Note: Must match the VID & PID in the USB driver .inf file!!
+ */
+/*
+  BusQueryDeviceID USB\Vid_80EE&Pid_CAFE
+  BusQueryInstanceID 2
+  BusQueryHardwareIDs USB\Vid_80EE&Pid_CAFE&Rev_0100
+  BusQueryHardwareIDs USB\Vid_80EE&Pid_CAFE
+  BusQueryCompatibleIDs USB\Class_ff&SubClass_00&Prot_00
+  BusQueryCompatibleIDs USB\Class_ff&SubClass_00
+  BusQueryCompatibleIDs USB\Class_ff
+*/
+
+#define szBusQueryDeviceId       L"USB\\Vid_80EE&Pid_CAFE"
+#define szBusQueryHardwareIDs    L"USB\\Vid_80EE&Pid_CAFE&Rev_0100\0USB\\Vid_80EE&Pid_CAFE\0\0"
+#define szBusQueryCompatibleIDs  L"USB\\Class_ff&SubClass_00&Prot_00\0USB\\Class_ff&SubClass_00\0USB\\Class_ff\0\0"
+
+#define szDeviceTextDescription          L"VirtualBox USB"
+
+
+#define VBOXUSBMON_MEMTAG 'MUBV'
+
+
+/*********************************************************************************************************************************
+*   Structures and Typedefs                                                                                                      *
+*********************************************************************************************************************************/
+typedef struct VBOXUSBMONINS
+{
+    void * pvDummy;
+} VBOXUSBMONINS, *PVBOXUSBMONINS;
+
+typedef struct VBOXUSBMONCTX
+{
+    VBOXUSBFLTCTX FltCtx;
+} VBOXUSBMONCTX, *PVBOXUSBMONCTX;
+
+typedef struct VBOXUSBHUB_PNPHOOK
+{
+    VBOXUSBHOOK_ENTRY Hook;
+    bool fUninitFailed;
+} VBOXUSBHUB_PNPHOOK, *PVBOXUSBHUB_PNPHOOK;
+
+typedef struct VBOXUSBHUB_PNPHOOK_COMPLETION
+{
+    VBOXUSBHOOK_REQUEST Rq;
+} VBOXUSBHUB_PNPHOOK_COMPLETION, *PVBOXUSBHUB_PNPHOOK_COMPLETION;
+
+/*
+ * Comment out VBOX_USB3PORT definition to disable hooking to multiple drivers (#6509)
+ */
+#define VBOX_USB3PORT
+
+#ifdef VBOX_USB3PORT
+#define VBOXUSBMON_MAXDRIVERS 5
+typedef struct VBOXUSB_PNPDRIVER
+{
+    PDRIVER_OBJECT     DriverObject;
+    VBOXUSBHUB_PNPHOOK UsbHubPnPHook;
+    PDRIVER_DISPATCH   pfnHookStub;
+} VBOXUSB_PNPDRIVER, *PVBOXUSB_PNPDRIVER;
+#endif /* !VBOX_USB3PORT */
+
+typedef struct VBOXUSBMONGLOBALS
+{
+    PDEVICE_OBJECT pDevObj;
+#ifdef VBOX_USB3PORT
+    VBOXUSB_PNPDRIVER pDrivers[VBOXUSBMON_MAXDRIVERS];
+#else /* !VBOX_USB3PORT */
+    VBOXUSBHUB_PNPHOOK UsbHubPnPHook;
+#endif /* !VBOX_USB3PORT */
+    KEVENT OpenSynchEvent;
+    IO_REMOVE_LOCK RmLock;
+    uint32_t cOpens;
+    volatile LONG ulPreventUnloadOn;
+    PFILE_OBJECT pPreventUnloadFileObj;
+} VBOXUSBMONGLOBALS, *PVBOXUSBMONGLOBALS;
+
+
+/*********************************************************************************************************************************
+*   Global Variables                                                                                                             *
+*********************************************************************************************************************************/
+static VBOXUSBMONGLOBALS g_VBoxUsbMonGlobals;
+
+
+
+PVOID VBoxUsbMonMemAlloc(SIZE_T cbBytes)
+{
+    PVOID pvMem = ExAllocatePoolWithTag(NonPagedPool, cbBytes, VBOXUSBMON_MEMTAG);
+    Assert(pvMem);
+    return pvMem;
+}
+
+PVOID VBoxUsbMonMemAllocZ(SIZE_T cbBytes)
+{
+    PVOID pvMem = VBoxUsbMonMemAlloc(cbBytes);
+    if (pvMem)
+    {
+        RtlZeroMemory(pvMem, cbBytes);
+    }
+    return pvMem;
+}
+
+VOID VBoxUsbMonMemFree(PVOID pvMem)
+{
+    ExFreePoolWithTag(pvMem, VBOXUSBMON_MEMTAG);
+}
+
+#define VBOXUSBDBG_STRCASE(_t) \
+        case _t: return #_t
+#define VBOXUSBDBG_STRCASE_UNKNOWN(_v) \
+        default: LOG((__FUNCTION__": Unknown Value (0n%d), (0x%x)", _v, _v)); return "Unknown"
+
+static const char* vboxUsbDbgStrPnPMn(UCHAR uMn)
+{
+    switch (uMn)
+    {
+        VBOXUSBDBG_STRCASE(IRP_MN_START_DEVICE);
+        VBOXUSBDBG_STRCASE(IRP_MN_QUERY_REMOVE_DEVICE);
+        VBOXUSBDBG_STRCASE(IRP_MN_REMOVE_DEVICE);
+        VBOXUSBDBG_STRCASE(IRP_MN_CANCEL_REMOVE_DEVICE);
+        VBOXUSBDBG_STRCASE(IRP_MN_STOP_DEVICE);
+        VBOXUSBDBG_STRCASE(IRP_MN_QUERY_STOP_DEVICE);
+        VBOXUSBDBG_STRCASE(IRP_MN_CANCEL_STOP_DEVICE);
+        VBOXUSBDBG_STRCASE(IRP_MN_QUERY_DEVICE_RELATIONS);
+        VBOXUSBDBG_STRCASE(IRP_MN_QUERY_INTERFACE);
+        VBOXUSBDBG_STRCASE(IRP_MN_QUERY_CAPABILITIES);
+        VBOXUSBDBG_STRCASE(IRP_MN_QUERY_RESOURCES);
+        VBOXUSBDBG_STRCASE(IRP_MN_QUERY_RESOURCE_REQUIREMENTS);
+        VBOXUSBDBG_STRCASE(IRP_MN_QUERY_DEVICE_TEXT);
+        VBOXUSBDBG_STRCASE(IRP_MN_FILTER_RESOURCE_REQUIREMENTS);
+        VBOXUSBDBG_STRCASE(IRP_MN_READ_CONFIG);
+        VBOXUSBDBG_STRCASE(IRP_MN_WRITE_CONFIG);
+        VBOXUSBDBG_STRCASE(IRP_MN_EJECT);
+        VBOXUSBDBG_STRCASE(IRP_MN_SET_LOCK);
+        VBOXUSBDBG_STRCASE(IRP_MN_QUERY_ID);
+        VBOXUSBDBG_STRCASE(IRP_MN_QUERY_PNP_DEVICE_STATE);
+        VBOXUSBDBG_STRCASE(IRP_MN_QUERY_BUS_INFORMATION);
+        VBOXUSBDBG_STRCASE(IRP_MN_DEVICE_USAGE_NOTIFICATION);
+        VBOXUSBDBG_STRCASE(IRP_MN_SURPRISE_REMOVAL);
+        VBOXUSBDBG_STRCASE_UNKNOWN(uMn);
+    }
+}
+
+void vboxUsbDbgPrintUnicodeString(PUNICODE_STRING pUnicodeString)
+{
+    RT_NOREF1(pUnicodeString);
+    Log(("%.*ls", pUnicodeString->Length / 2, pUnicodeString->Buffer));
+}
+
+/**
+ * Send IRP_MN_QUERY_DEVICE_RELATIONS
+ *
+ * @returns NT Status
+ * @param   pDevObj         USB device pointer
+ * @param   pFileObj        Valid file object pointer
+ * @param   pDevRelations   Pointer to DEVICE_RELATIONS pointer (out)
+ */
+NTSTATUS VBoxUsbMonQueryBusRelations(PDEVICE_OBJECT pDevObj, PFILE_OBJECT pFileObj, PDEVICE_RELATIONS *pDevRelations)
+{
+    IO_STATUS_BLOCK IoStatus;
+    KEVENT Event;
+    NTSTATUS Status;
+    PIRP pIrp;
+    PIO_STACK_LOCATION pSl;
+
+    KeInitializeEvent(&Event, NotificationEvent, FALSE);
+
+    Assert(pDevRelations);
+    *pDevRelations = NULL;
+
+    pIrp = IoBuildSynchronousFsdRequest(IRP_MJ_PNP, pDevObj, NULL, 0, NULL, &Event, &IoStatus);
+    if (!pIrp)
+    {
+        WARN(("IoBuildDeviceIoControlRequest failed!!"));
+        return STATUS_INSUFFICIENT_RESOURCES;
+    }
+    pIrp->IoStatus.Status = STATUS_NOT_SUPPORTED;
+
+    pSl = IoGetNextIrpStackLocation(pIrp);
+    pSl->MajorFunction = IRP_MJ_PNP;
+    pSl->MinorFunction = IRP_MN_QUERY_DEVICE_RELATIONS;
+    pSl->Parameters.QueryDeviceRelations.Type = BusRelations;
+    pSl->FileObject = pFileObj;
+
+    Status = IoCallDriver(pDevObj, pIrp);
+    if (Status == STATUS_PENDING)
+    {
+        LOG(("IoCallDriver returned STATUS_PENDING!!"));
+        KeWaitForSingleObject(&Event, Executive, KernelMode, FALSE, NULL);
+        Status = IoStatus.Status;
+    }
+
+    if (Status == STATUS_SUCCESS)
+    {
+        PDEVICE_RELATIONS pRel = (PDEVICE_RELATIONS)IoStatus.Information;
+        LOG(("pRel = %p", pRel));
+        if (VALID_PTR(pRel))
+        {
+            *pDevRelations = pRel;
+        }
+        else
+        {
+            WARN(("Invalid pointer %p", pRel));
+        }
+    }
+    else
+    {
+        WARN(("IRP_MN_QUERY_DEVICE_RELATIONS failed Status(0x%x)", Status));
+    }
+
+    LOG(("IoCallDriver returned %x", Status));
+    return Status;
+}
+
+RT_C_DECLS_BEGIN
+/* these two come from IFS Kit, which is not included in 2K DDK we use,
+ * although they are documented and exported in ntoskrnl,
+ * and both should be present for >= XP according to MSDN */
+NTKERNELAPI
+NTSTATUS
+ObQueryNameString(
+    __in PVOID Object,
+    __out_bcount_opt(Length) POBJECT_NAME_INFORMATION ObjectNameInfo,
+    __in ULONG Length,
+    __out PULONG ReturnLength
+    );
+
+NTKERNELAPI
+PDEVICE_OBJECT
+IoGetLowerDeviceObject(
+    __in  PDEVICE_OBJECT  DeviceObject
+    );
+
+RT_C_DECLS_END
+
+typedef DECLCALLBACK(VOID) FNVBOXUSBDEVNAMEMATCHER(PDEVICE_OBJECT pDo, PUNICODE_STRING pName, PVOID pvMatcher);
+typedef FNVBOXUSBDEVNAMEMATCHER *PFNVBOXUSBDEVNAMEMATCHER;
+
+static NTSTATUS vboxUsbObjCheckName(PDEVICE_OBJECT pDo, PFNVBOXUSBDEVNAMEMATCHER pfnMatcher, PVOID pvMatcher)
+{
+    union
+    {
+        OBJECT_NAME_INFORMATION Info;
+        char buf[1024];
+    } buf;
+    ULONG cbLength = 0;
+
+    POBJECT_NAME_INFORMATION pInfo = &buf.Info;
+    NTSTATUS Status = ObQueryNameString(pDo, &buf.Info, sizeof (buf), &cbLength);
+    if (!NT_SUCCESS(Status))
+    {
+        if (STATUS_INFO_LENGTH_MISMATCH != Status)
+        {
+            WARN(("ObQueryNameString failed 0x%x", Status));
+            return Status;
+        }
+
+        LOG(("ObQueryNameString returned STATUS_INFO_LENGTH_MISMATCH, required size %d", cbLength));
+
+        pInfo = (POBJECT_NAME_INFORMATION)VBoxUsbMonMemAlloc(cbLength);
+        if (!pInfo)
+        {
+            WARN(("VBoxUsbMonMemAlloc failed"));
+            return STATUS_NO_MEMORY;
+        }
+        Status = ObQueryNameString(pDo, pInfo, cbLength, &cbLength);
+        if (!NT_SUCCESS(Status))
+        {
+            WARN(("ObQueryNameString second try failed 0x%x", Status));
+            VBoxUsbMonMemFree(pInfo);
+            return Status;
+        }
+    }
+
+    /* we've got the name! */
+    LOG(("got the name:"));
+    LOG_USTR(&pInfo->Name);
+    pfnMatcher(pDo, &pInfo->Name, pvMatcher);
+
+    if (&buf.Info != pInfo)
+    {
+        LOG(("freeing allocated pInfo(0x%p)", pInfo));
+        VBoxUsbMonMemFree(pInfo);
+    }
+    else
+    {
+        LOG(("no freeing info needed"));
+    }
+
+    return STATUS_SUCCESS;
+}
+
+
+typedef DECLCALLBACK(BOOLEAN) FNVBOXUSBDEVSTACKWALKER(PDEVICE_OBJECT pTopDo, PDEVICE_OBJECT pCurDo, PVOID pvContext);
+typedef FNVBOXUSBDEVSTACKWALKER *PFNVBOXUSBDEVSTACKWALKER;
+
+VOID vboxUsbObjDevStackWalk(PDEVICE_OBJECT pDo, PFNVBOXUSBDEVSTACKWALKER pfnWalker, PVOID pvWalker)
+{
+    LOG(("==>tree walk for Do 0x%p", pDo));
+    PDEVICE_OBJECT pCurDo = pDo;
+    ObReferenceObject(pCurDo); /* <- to make sure the dereferencing logic below works correctly */
+    do
+    {
+        LOG(("==Do 0x%p", pCurDo));
+#ifdef VBOX_USB_WITH_VERBOSE_LOGGING
+        {
+            union
+            {
+                OBJECT_NAME_INFORMATION Info;
+                char buf[1024];
+            } buf;
+            ULONG cbLength = 0;
+
+            NTSTATUS tmpStatus = ObQueryNameString(pCurDo, &buf.Info, sizeof (buf), &cbLength);
+            if (NT_SUCCESS(tmpStatus))
+            {
+                LOG(("  Obj name:"));
+                LOG_USTR(&buf.Info.Name);
+            }
+            else
+            {
+                if (STATUS_INFO_LENGTH_MISMATCH != tmpStatus)
+                {
+                    WARN(("ObQueryNameString failed 0x%x", tmpStatus));
+                }
+                else
+                {
+                    WARN(("ObQueryNameString STATUS_INFO_LENGTH_MISMATCH, required %d", cbLength));
+                }
+            }
+
+            if (pCurDo->DriverObject
+                && pCurDo->DriverObject->DriverName.Buffer
+                && pCurDo->DriverObject->DriverName.Length)
+            {
+                LOG(("  Drv Obj(0x%p), name:", pCurDo->DriverObject));
+                LOG_USTR(&pCurDo->DriverObject->DriverName);
+            }
+            else
+            {
+                LOG(("  No Drv Name, Drv Obj(0x%p)", pCurDo->DriverObject));
+                if (pCurDo->DriverObject)
+                {
+                    LOG(("  driver name is zero, Length(%d), Buffer(0x%p)",
+                                pCurDo->DriverObject->DriverName.Length, pCurDo->DriverObject->DriverName.Buffer));
+                }
+                else
+                {
+                    LOG(("  driver object is NULL"));
+                }
+            }
+        }
+#endif
+        if (!pfnWalker(pDo, pCurDo, pvWalker))
+        {
+            LOG(("the walker said to stop"));
+            ObDereferenceObject(pCurDo);
+            break;
+        }
+
+        PDEVICE_OBJECT pLowerDo = IoGetLowerDeviceObject(pCurDo);
+        ObDereferenceObject(pCurDo);
+        if (!pLowerDo)
+        {
+            LOG(("IoGetLowerDeviceObject returnned NULL, stop"));
+            break;
+        }
+        pCurDo = pLowerDo;
+    } while (1);
+
+    LOG(("<==tree walk"));
+}
+
+static DECLCALLBACK(BOOLEAN) vboxUsbObjNamePrefixMatch(PUNICODE_STRING pName, PUNICODE_STRING pNamePrefix, BOOLEAN fCaseInSensitive)
+{
+    LOG(("Matching prefix:"));
+    LOG_USTR(pNamePrefix);
+    if (pNamePrefix->Length > pName->Length)
+    {
+        LOG(("Pregix Length(%d) > Name Length(%d)", pNamePrefix->Length, pName->Length));
+        return FALSE;
+    }
+
+    LOG(("Pregix Length(%d) <= Name Length(%d)", pNamePrefix->Length, pName->Length));
+
+    UNICODE_STRING NamePrefix = *pName;
+    NamePrefix.Length = pNamePrefix->Length;
+    LONG rc = RtlCompareUnicodeString(&NamePrefix, pNamePrefix, fCaseInSensitive);
+
+    if (!rc)
+    {
+        LOG(("prefix MATCHED!"));
+        return TRUE;
+    }
+
+    LOG(("prefix NOT matched!"));
+    return FALSE;
+}
+
+typedef struct VBOXUSBOBJNAMEPREFIXMATCHER
+{
+    PUNICODE_STRING pNamePrefix;
+    BOOLEAN fMatched;
+} VBOXUSBOBJNAMEPREFIXMATCHER, *PVBOXUSBOBJNAMEPREFIXMATCHER;
+
+static DECLCALLBACK(VOID) vboxUsbObjDevNamePrefixMatcher(PDEVICE_OBJECT pDo, PUNICODE_STRING pName, PVOID pvMatcher)
+{
+    RT_NOREF1(pDo);
+    PVBOXUSBOBJNAMEPREFIXMATCHER pData = (PVBOXUSBOBJNAMEPREFIXMATCHER)pvMatcher;
+    PUNICODE_STRING pNamePrefix = pData->pNamePrefix;
+    ASSERT_WARN(!pData->fMatched, ("match flag already set!"));
+    pData->fMatched = vboxUsbObjNamePrefixMatch(pName, pNamePrefix, TRUE /* fCaseInSensitive */);
+    LOG(("match result (%d)", (int)pData->fMatched));
+}
+
+typedef struct VBOXUSBOBJDRVOBJSEARCHER
+{
+    PDEVICE_OBJECT pDevObj;
+    PUNICODE_STRING pDrvName;
+    PUNICODE_STRING pPdoNamePrefix;
+    ULONG fFlags;
+} VBOXUSBOBJDRVOBJSEARCHER, *PVBOXUSBOBJDRVOBJSEARCHER;
+
+static DECLCALLBACK(BOOLEAN) vboxUsbObjDevObjSearcherWalker(PDEVICE_OBJECT pTopDo, PDEVICE_OBJECT pCurDo, PVOID pvContext)
+{
+    RT_NOREF1(pTopDo);
+    PVBOXUSBOBJDRVOBJSEARCHER pData = (PVBOXUSBOBJDRVOBJSEARCHER)pvContext;
+    ASSERT_WARN(!pData->pDevObj, ("non-null dev object (0x%p) on enter", pData->pDevObj));
+    pData->pDevObj = NULL;
+    if (pCurDo->DriverObject
+        && pCurDo->DriverObject->DriverName.Buffer
+        && pCurDo->DriverObject->DriverName.Length
+        && !RtlCompareUnicodeString(pData->pDrvName, &pCurDo->DriverObject->DriverName, TRUE /* case insensitive */))
+    {
+        LOG(("MATCHED driver:"));
+        LOG_USTR(&pCurDo->DriverObject->DriverName);
+        if ((pData->fFlags & VBOXUSBMONHUBWALK_F_ALL) != VBOXUSBMONHUBWALK_F_ALL)
+        {
+            VBOXUSBOBJNAMEPREFIXMATCHER Data = {0};
+            Data.pNamePrefix = pData->pPdoNamePrefix;
+            NTSTATUS Status = vboxUsbObjCheckName(pCurDo, vboxUsbObjDevNamePrefixMatcher, &Data);
+            if (!NT_SUCCESS(Status))
+            {
+                WARN(("vboxUsbObjCheckName failed Status (0x%x)", Status));
+                return TRUE;
+            }
+
+
+            LOG(("prefix match result (%d)", Data.fMatched));
+            if ((pData->fFlags & VBOXUSBMONHUBWALK_F_FDO) == VBOXUSBMONHUBWALK_F_FDO)
+            {
+                LOG(("VBOXUSBMONHUBWALK_F_FDO"));
+                if (Data.fMatched)
+                {
+                    LOG(("this is a PDO object, skip it and stop search"));
+                    /* stop search as we will not find FDO here */
+                    return FALSE;
+                }
+
+                LOG(("this is a FDO object, MATCHED!!"));
+            }
+            else if ((pData->fFlags & VBOXUSBMONHUBWALK_F_PDO) == VBOXUSBMONHUBWALK_F_PDO)
+            {
+                LOG(("VBOXUSBMONHUBWALK_F_PDO"));
+                if (!Data.fMatched)
+                {
+                    LOG(("this is a FDO object, skip it and continue search"));
+                    /* continue seach since since this could be a nested hub that would have a usbhub-originated PDO */
+                    return TRUE;
+                }
+
+                LOG(("this is a PDO object, MATCHED!!"));
+            }
+
+        }
+        else
+        {
+            LOG(("VBOXUSBMONHUBWALK_F_ALL"));
+            LOG(("either PDO or FDO, MATCHED!!"));
+        }
+
+        /* ensure the dev object is not destroyed */
+        ObReferenceObject(pCurDo);
+        pData->pDevObj = pCurDo;
+        /* we are done */
+        return FALSE;
+    }
+    else
+    {
+        LOG(("driver object (0x%p) no match", pCurDo->DriverObject));
+        if (pCurDo->DriverObject)
+        {
+            if (   pCurDo->DriverObject->DriverName.Buffer
+                && pCurDo->DriverObject->DriverName.Length)
+            {
+                LOG(("driver name not match, was:"));
+                LOG_USTR(&pCurDo->DriverObject->DriverName);
+                LOG(("but expected:"));
+                LOG_USTR(pData->pDrvName);
+            }
+            else
+            {
+                LOG(("driver name is zero, Length(%d), Buffer(0x%p)",
+                        pCurDo->DriverObject->DriverName.Length, pCurDo->DriverObject->DriverName.Buffer));
+            }
+        }
+        else
+        {
+            LOG(("driver object is NULL"));
+        }
+    }
+    return TRUE;
+}
+
+VOID vboxUsbMonHubDevWalk(PFNVBOXUSBMONDEVWALKER pfnWalker, PVOID pvWalker, ULONG fFlags)
+{
+    NTSTATUS Status = STATUS_UNSUCCESSFUL;
+#ifndef VBOX_USB3PORT
+    UNICODE_STRING szStandardHubName;
+    PDRIVER_OBJECT pDrvObj = NULL;
+    szStandardHubName.Length = 0;
+    szStandardHubName.MaximumLength = 0;
+    szStandardHubName.Buffer = 0;
+    RtlInitUnicodeString(&szStandardHubName, L"\\Driver\\usbhub");
+    UNICODE_STRING szStandardHubPdoNamePrefix;
+    szStandardHubPdoNamePrefix.Length = 0;
+    szStandardHubPdoNamePrefix.MaximumLength = 0;
+    szStandardHubPdoNamePrefix.Buffer = 0;
+    RtlInitUnicodeString(&szStandardHubPdoNamePrefix, L"\\Device\\USBPDO-");
+
+    for (int i = 0; i < 16; i++)
+    {
+        WCHAR           szwHubName[32] = {0};
+        char            szHubName[32] = {0};
+        ANSI_STRING     AnsiName;
+        UNICODE_STRING  UnicodeName;
+        PDEVICE_OBJECT  pHubDevObj;
+        PFILE_OBJECT    pHubFileObj;
+
+        sprintf(szHubName, "\\Device\\USBPDO-%d", i);
+
+        RtlInitAnsiString(&AnsiName, szHubName);
+
+        UnicodeName.Length = 0;
+        UnicodeName.MaximumLength = sizeof (szwHubName);
+        UnicodeName.Buffer = szwHubName;
+
+        RtlInitAnsiString(&AnsiName, szHubName);
+        Status = RtlAnsiStringToUnicodeString(&UnicodeName, &AnsiName, FALSE);
+        if (Status == STATUS_SUCCESS)
+        {
+            Status = IoGetDeviceObjectPointer(&UnicodeName, FILE_READ_DATA, &pHubFileObj, &pHubDevObj);
+            if (Status == STATUS_SUCCESS)
+            {
+                LOG(("IoGetDeviceObjectPointer for \\Device\\USBPDO-%d returned %p %p", i, pHubDevObj, pHubFileObj));
+
+                VBOXUSBOBJDRVOBJSEARCHER Data = {0};
+                Data.pDrvName = &szStandardHubName;
+                Data.pPdoNamePrefix = &szStandardHubPdoNamePrefix;
+                Data.fFlags = fFlags;
+
+                vboxUsbObjDevStackWalk(pHubDevObj, vboxUsbObjDevObjSearcherWalker, &Data);
+                if (Data.pDevObj)
+                {
+                    LOG(("found hub dev obj (0x%p)", Data.pDevObj));
+                    if (!pfnWalker(pHubFileObj, pHubDevObj, Data.pDevObj, pvWalker))
+                    {
+                        LOG(("the walker said to stop"));
+                        ObDereferenceObject(Data.pDevObj);
+                        ObDereferenceObject(pHubFileObj);
+                        break;
+                    }
+
+                    LOG(("going forward.."));
+                    ObDereferenceObject(Data.pDevObj);
+                }
+                else
+                {
+                    LOG(("no hub driver obj found"));
+                    ASSERT_WARN(!Data.pDevObj, ("non-null dev obj poiter returned (0x%p)", Data.pDevObj));
+                }
+
+                /* this will dereference both file and dev obj */
+                ObDereferenceObject(pHubFileObj);
+            }
+            else
+            {
+                LOG(("IoGetDeviceObjectPointer returned Status (0x%x) for (\\Device\\USBPDO-%d)", Status, i));
+            }
+        }
+        else
+        {
+            WARN(("RtlAnsiStringToUnicodeString failed, Status (0x%x) for Ansu name (\\Device\\USBPDO-%d)", Status, i));
+        }
+    }
+#else /* VBOX_USB3PORT */
+    RT_NOREF1(fFlags);
+    PWSTR szwHubList;
+    Status = IoGetDeviceInterfaces(&GUID_DEVINTERFACE_USB_HUB, NULL, 0, &szwHubList);
+    if (Status != STATUS_SUCCESS)
+    {
+        LOG(("IoGetDeviceInterfaces failed with %d\n", Status));
+        return;
+    }
+    if (szwHubList)
+    {
+        UNICODE_STRING  UnicodeName;
+        PDEVICE_OBJECT  pHubDevObj;
+        PFILE_OBJECT    pHubFileObj;
+        PWSTR           szwHubName = szwHubList;
+        while (*szwHubName != UNICODE_NULL)
+        {
+            RtlInitUnicodeString(&UnicodeName, szwHubName);
+            Status = IoGetDeviceObjectPointer(&UnicodeName, FILE_READ_DATA, &pHubFileObj, &pHubDevObj);
+            if (Status == STATUS_SUCCESS)
+            {
+                /* We could not log hub name here.
+                 * It is the paged memory and we cannot use it in logger cause it increases the IRQL
+                 */
+                LOG(("IoGetDeviceObjectPointer returned %p %p", pHubDevObj, pHubFileObj));
+                if (!pfnWalker(pHubFileObj, pHubDevObj, pHubDevObj, pvWalker))
+                {
+                    LOG(("the walker said to stop"));
+                    ObDereferenceObject(pHubFileObj);
+                    break;
+                }
+
+                LOG(("going forward.."));
+                ObDereferenceObject(pHubFileObj);
+            }
+            szwHubName += wcslen(szwHubName) + 1;
+        }
+        ExFreePool(szwHubList);
+    }
+#endif /* VBOX_USB3PORT */
+}
+
+typedef struct VBOXUSBMONFINDHUBWALKER
+{
+    PDRIVER_OBJECT pDrvObj;
+} VBOXUSBMONFINDHUBWALKER, *PVBOXUSBMONFINDHUBWALKER;
+
+static DECLCALLBACK(BOOLEAN) vboxUsbMonFindHubDrvObjWalker(PFILE_OBJECT pFile, PDEVICE_OBJECT pTopDo, PDEVICE_OBJECT pHubDo, PVOID pvContext)
+{
+    RT_NOREF2(pFile, pTopDo);
+    PVBOXUSBMONFINDHUBWALKER pData = (PVBOXUSBMONFINDHUBWALKER)pvContext;
+    PDRIVER_OBJECT pDrvObj = pHubDo->DriverObject;
+
+    ASSERT_WARN(!pData->pDrvObj, ("pDrvObj expected null on enter, but was(0x%p)", pData->pDrvObj));
+    if (pDrvObj)
+    {
+        LOG(("found driver object 0x%p", pDrvObj));
+        ObReferenceObject(pDrvObj);
+        pData->pDrvObj = pDrvObj;
+        return FALSE;
+    }
+
+    WARN(("null pDrvObj!"));
+    return TRUE;
+}
+
+static PDRIVER_OBJECT vboxUsbMonHookFindHubDrvObj()
+{
+    UNICODE_STRING szStandardHubName;
+    szStandardHubName.Length = 0;
+    szStandardHubName.MaximumLength = 0;
+    szStandardHubName.Buffer = 0;
+    RtlInitUnicodeString(&szStandardHubName, L"\\Driver\\usbhub");
+
+    LOG(("Search USB hub"));
+    VBOXUSBMONFINDHUBWALKER Data = {0};
+    vboxUsbMonHubDevWalk(vboxUsbMonFindHubDrvObjWalker, &Data, VBOXUSBMONHUBWALK_F_ALL);
+    if (Data.pDrvObj)
+        LOG(("returning driver object 0x%p", Data.pDrvObj));
+    else
+        WARN(("no hub driver object found!"));
+    return Data.pDrvObj;
+}
+
+/* NOTE: the stack location data is not the "actual" IRP stack location,
+ * but a copy being preserved on the IRP way down.
+ * See the note in VBoxUsbPnPCompletion for detail */
+static NTSTATUS vboxUsbMonHandlePnPIoctl(PDEVICE_OBJECT pDevObj, PIO_STACK_LOCATION pSl, PIO_STATUS_BLOCK pIoStatus)
+{
+    LOG(("IRQL = %d", KeGetCurrentIrql()));
+    switch(pSl->MinorFunction)
+    {
+        case IRP_MN_QUERY_DEVICE_TEXT:
+        {
+            LOG(("IRP_MN_QUERY_DEVICE_TEXT: pIoStatus->Status = %x", pIoStatus->Status));
+            if (pIoStatus->Status == STATUS_SUCCESS)
+            {
+                WCHAR *pId = (WCHAR *)pIoStatus->Information;
+                if (VALID_PTR(pId))
+                {
+                    KIRQL Iqrl = KeGetCurrentIrql();
+                    /* IRQL should be always passive here */
+                    ASSERT_WARN(Iqrl == PASSIVE_LEVEL, ("irql is not PASSIVE"));
+                    switch(pSl->Parameters.QueryDeviceText.DeviceTextType)
+                    {
+                        case DeviceTextLocationInformation:
+                            LOG(("DeviceTextLocationInformation"));
+                            LOG_STRW(pId);
+                            break;
+
+                        case DeviceTextDescription:
+                            LOG(("DeviceTextDescription"));
+                            LOG_STRW(pId);
+                            if (VBoxUsbFltPdoIsFiltered(pDevObj))
+                            {
+                                LOG(("PDO (0x%p) is filtered", pDevObj));
+                                WCHAR *pId = (WCHAR *)ExAllocatePool(PagedPool, sizeof(szDeviceTextDescription));
+                                if (!pId)
+                                {
+                                    AssertFailed();
+                                    break;
+                                }
+                                memcpy(pId, szDeviceTextDescription, sizeof(szDeviceTextDescription));
+                                LOG(("NEW szDeviceTextDescription"));
+                                LOG_STRW(pId);
+                                ExFreePool((PVOID)pIoStatus->Information);
+                                pIoStatus->Information = (ULONG_PTR)pId;
+                            }
+                            else
+                            {
+                                LOG(("PDO (0x%p) is NOT filtered", pDevObj));
+                            }
+                            break;
+                        default:
+                            LOG(("DeviceText %d", pSl->Parameters.QueryDeviceText.DeviceTextType));
+                            break;
+                    }
+                }
+                else
+                    LOG(("Invalid pointer %p", pId));
+            }
+            break;
+        }
+
+        case IRP_MN_QUERY_ID:
+        {
+            LOG(("IRP_MN_QUERY_ID: Irp->pIoStatus->Status = %x", pIoStatus->Status));
+            if (pIoStatus->Status == STATUS_SUCCESS &&  pDevObj)
+            {
+                WCHAR *pId = (WCHAR *)pIoStatus->Information;
+#ifdef VBOX_USB_WITH_VERBOSE_LOGGING
+                WCHAR *pTmp;
+#endif
+                if (VALID_PTR(pId))
+                {
+                    KIRQL Iqrl = KeGetCurrentIrql();
+                    /* IRQL should be always passive here */
+                    ASSERT_WARN(Iqrl == PASSIVE_LEVEL, ("irql is not PASSIVE"));
+
+                    switch (pSl->Parameters.QueryId.IdType)
+                    {
+                        case BusQueryInstanceID:
+                            LOG(("BusQueryInstanceID"));
+                            LOG_STRW(pId);
+                            break;
+
+                        case BusQueryDeviceID:
+                        {
+                            LOG(("BusQueryDeviceID"));
+                            pId = (WCHAR *)ExAllocatePool(PagedPool, sizeof(szBusQueryDeviceId));
+                            if (!pId)
+                            {
+                                WARN(("ExAllocatePool failed"));
+                                break;
+                            }
+
+                            BOOLEAN bFiltered = FALSE;
+                            NTSTATUS Status = VBoxUsbFltPdoAdd(pDevObj, &bFiltered);
+                            if (Status != STATUS_SUCCESS || !bFiltered)
+                            {
+                                if (Status == STATUS_SUCCESS)
+                                {
+                                    LOG(("PDO (0x%p) is NOT filtered", pDevObj));
+                                }
+                                else
+                                {
+                                    WARN(("VBoxUsbFltPdoAdd for PDO (0x%p) failed Status 0x%x", pDevObj, Status));
+                                }
+                                ExFreePool(pId);
+                                break;
+                            }
+
+                            LOG(("PDO (0x%p) is filtered", pDevObj));
+                            ExFreePool((PVOID)pIoStatus->Information);
+                            memcpy(pId, szBusQueryDeviceId, sizeof(szBusQueryDeviceId));
+                            pIoStatus->Information = (ULONG_PTR)pId;
+                            break;
+                        }
+                    case BusQueryHardwareIDs:
+                    {
+                        LOG(("BusQueryHardwareIDs"));
+#ifdef VBOX_USB_WITH_VERBOSE_LOGGING
+                        while (*pId) //MULTI_SZ
+                        {
+                            LOG_STRW(pId);
+                            while (*pId) pId++;
+                            pId++;
+                        }
+#endif
+                        pId = (WCHAR *)ExAllocatePool(PagedPool, sizeof(szBusQueryHardwareIDs));
+                        if (!pId)
+                        {
+                            WARN(("ExAllocatePool failed"));
+                            break;
+                        }
+
+                        BOOLEAN bFiltered = FALSE;
+                        NTSTATUS Status = VBoxUsbFltPdoAdd(pDevObj, &bFiltered);
+                        if (Status != STATUS_SUCCESS || !bFiltered)
+                        {
+                            if (Status == STATUS_SUCCESS)
+                            {
+                                LOG(("PDO (0x%p) is NOT filtered", pDevObj));
+                            }
+                            else
+                            {
+                                WARN(("VBoxUsbFltPdoAdd for PDO (0x%p) failed Status 0x%x", pDevObj, Status));
+                            }
+                            ExFreePool(pId);
+                            break;
+                        }
+
+                        LOG(("PDO (0x%p) is filtered", pDevObj));
+
+                        memcpy(pId, szBusQueryHardwareIDs, sizeof(szBusQueryHardwareIDs));
+#ifdef VBOX_USB_WITH_VERBOSE_LOGGING
+                        LOG(("NEW BusQueryHardwareIDs"));
+                        pTmp = pId;
+                        while (*pTmp) //MULTI_SZ
+                        {
+
+                            LOG_STRW(pTmp);
+                            while (*pTmp) pTmp++;
+                            pTmp++;
+                        }
+#endif
+                        ExFreePool((PVOID)pIoStatus->Information);
+                        pIoStatus->Information = (ULONG_PTR)pId;
+                        break;
+                    }
+                    case BusQueryCompatibleIDs:
+                        LOG(("BusQueryCompatibleIDs"));
+#ifdef VBOX_USB_WITH_VERBOSE_LOGGING
+                        while (*pId) //MULTI_SZ
+                        {
+                            LOG_STRW(pId);
+                            while (*pId) pId++;
+                            pId++;
+                        }
+#endif
+                        if (VBoxUsbFltPdoIsFiltered(pDevObj))
+                        {
+                            LOG(("PDO (0x%p) is filtered", pDevObj));
+                            pId = (WCHAR *)ExAllocatePool(PagedPool, sizeof(szBusQueryCompatibleIDs));
+                            if (!pId)
+                            {
+                                WARN(("ExAllocatePool failed"));
+                                break;
+                            }
+                            memcpy(pId, szBusQueryCompatibleIDs, sizeof(szBusQueryCompatibleIDs));
+#ifdef VBOX_USB_WITH_VERBOSE_LOGGING
+                            LOG(("NEW BusQueryCompatibleIDs"));
+                            pTmp = pId;
+                            while (*pTmp) //MULTI_SZ
+                            {
+                                LOG_STRW(pTmp);
+                                while (*pTmp) pTmp++;
+                                pTmp++;
+                            }
+#endif
+                            ExFreePool((PVOID)pIoStatus->Information);
+                            pIoStatus->Information = (ULONG_PTR)pId;
+                        }
+                        else
+                        {
+                            LOG(("PDO (0x%p) is NOT filtered", pDevObj));
+                        }
+                        break;
+
+                        default:
+                            /** @todo r=bird: handle BusQueryContainerID and whatever else we might see  */
+                            break;
+                    }
+                }
+                else
+                {
+                    LOG(("Invalid pointer %p", pId));
+                }
+            }
+            break;
+        }
+
+#ifdef VBOX_USB_WITH_VERBOSE_LOGGING
+        case IRP_MN_QUERY_DEVICE_RELATIONS:
+        {
+            switch(pSl->Parameters.QueryDeviceRelations.Type)
+            {
+                case BusRelations:
+                    LOG(("BusRelations"));
+
+                    if (pIoStatus->Status == STATUS_SUCCESS)
+                    {
+                        PDEVICE_RELATIONS pRel = (PDEVICE_RELATIONS)pIoStatus->Information;
+                        LOG(("pRel = %p", pRel));
+                        if (VALID_PTR(pRel))
+                        {
+                            for (unsigned i=0;i<pRel->Count;i++)
+                            {
+                                if (VBoxUsbFltPdoIsFiltered(pDevObj))
+                                    LOG(("New PDO %p", pRel->Objects[i]));
+                            }
+                        }
+                        else
+                            LOG(("Invalid pointer %p", pRel));
+                    }
+                    break;
+                case TargetDeviceRelation:
+                    LOG(("TargetDeviceRelation"));
+                    break;
+                case RemovalRelations:
+                    LOG(("RemovalRelations"));
+                    break;
+                case EjectionRelations:
+                    LOG(("EjectionRelations"));
+                    break;
+                default:
+                    LOG(("QueryDeviceRelations.Type=%d", pSl->Parameters.QueryDeviceRelations.Type));
+            }
+            break;
+        }
+
+        case IRP_MN_QUERY_CAPABILITIES:
+        {
+            LOG(("IRP_MN_QUERY_CAPABILITIES: pIoStatus->Status = %x", pIoStatus->Status));
+            if (pIoStatus->Status == STATUS_SUCCESS)
+            {
+                PDEVICE_CAPABILITIES pCaps = pSl->Parameters.DeviceCapabilities.Capabilities;
+                if (VALID_PTR(pCaps))
+                {
+                    LOG(("Caps.SilentInstall  = %d", pCaps->SilentInstall));
+                    LOG(("Caps.UniqueID       = %d", pCaps->UniqueID ));
+                    LOG(("Caps.Address        = %d", pCaps->Address ));
+                    LOG(("Caps.UINumber       = %d", pCaps->UINumber ));
+                }
+                else
+                    LOG(("Invalid pointer %p", pCaps));
+            }
+            break;
+        }
+
+        default:
+            break;
+#endif
+    } /*switch */
+
+    LOG(("Done returns %x (IRQL = %d)", pIoStatus->Status, KeGetCurrentIrql()));
+    return pIoStatus->Status;
+}
+
+NTSTATUS _stdcall VBoxUsbPnPCompletion(DEVICE_OBJECT *pDevObj, IRP *pIrp, void *pvContext)
+{
+    LOG(("Completion PDO(0x%p), IRP(0x%p), Status(0x%x)", pDevObj, pIrp, pIrp->IoStatus.Status));
+    ASSERT_WARN(pvContext, ("zero context"));
+
+    PVBOXUSBHOOK_REQUEST pRequest = (PVBOXUSBHOOK_REQUEST)pvContext;
+    /* NOTE: despite a regular IRP processing the stack location in our completion
+     * differs from those of the PnP hook since the hook is invoked in the "context" of the calle,
+     * while the completion is in the "coller" context in terms of IRP,
+     * so the completion stack location is one level "up" here.
+     *
+     * Moreover we CAN NOT access irp stack location in the completion because we might not have one at all
+     * in case the hooked driver is at the top of the irp call stack
+     *
+     * This is why we use the stack location we saved on IRP way down.
+     * */
+    PIO_STACK_LOCATION pSl = &pRequest->OldLocation;
+    ASSERT_WARN(pIrp == pRequest->pIrp, ("completed IRP(0x%x) not match request IRP(0x%x)", pIrp, pRequest->pIrp));
+    /* NOTE: we can not rely on pDevObj passed in IoCompletion since it may be zero
+     * in case IRP was created with extra stack locations and the caller did not initialize
+     * the IO_STACK_LOCATION::DeviceObject */
+    DEVICE_OBJECT *pRealDevObj = pRequest->pDevObj;
+//    Assert(!pDevObj || pDevObj == pRealDevObj);
+//    Assert(pSl->DeviceObject == pDevObj);
+
+    switch(pSl->MinorFunction)
+    {
+        case IRP_MN_QUERY_DEVICE_TEXT:
+        case IRP_MN_QUERY_ID:
+#ifdef VBOX_USB_WITH_VERBOSE_LOGGING
+        case IRP_MN_QUERY_DEVICE_RELATIONS:
+        case IRP_MN_QUERY_CAPABILITIES:
+#endif
+            if (NT_SUCCESS(pIrp->IoStatus.Status))
+            {
+                vboxUsbMonHandlePnPIoctl(pRealDevObj, pSl, &pIrp->IoStatus);
+            }
+            else
+            {
+                ASSERT_WARN(pIrp->IoStatus.Status == STATUS_NOT_SUPPORTED, ("Irp failed with status(0x%x)", pIrp->IoStatus.Status));
+            }
+            break;
+
+        case IRP_MN_SURPRISE_REMOVAL:
+        case IRP_MN_REMOVE_DEVICE:
+            if (NT_SUCCESS(pIrp->IoStatus.Status))
+            {
+                VBoxUsbFltPdoRemove(pRealDevObj);
+            }
+            else
+            {
+                AssertFailed();
+            }
+            break;
+
+        /* These two IRPs are received when the PnP subsystem has determined the id of the newly arrived device */
+        /* IRP_MN_START_DEVICE only arrives if it's a USB device of a known class or with a present host driver */
+        case IRP_MN_QUERY_RESOURCE_REQUIREMENTS:
+        case IRP_MN_QUERY_RESOURCES:
+            if (NT_SUCCESS(pIrp->IoStatus.Status) || pIrp->IoStatus.Status == STATUS_NOT_SUPPORTED)
+            {
+                VBoxUsbFltPdoAddCompleted(pRealDevObj);
+            }
+            else
+            {
+                AssertFailed();
+            }
+            break;
+
+        default:
+            break;
+    }
+
+    LOG(("<==PnP: Mn(%s), PDO(0x%p), IRP(0x%p), Status(0x%x), Sl PDO(0x%p), Compl PDO(0x%p)",
+                            vboxUsbDbgStrPnPMn(pSl->MinorFunction),
+                            pRealDevObj, pIrp, pIrp->IoStatus.Status,
+                            pSl->DeviceObject, pDevObj));
+#ifdef DEBUG_misha
+    NTSTATUS tmpStatus = pIrp->IoStatus.Status;
+#endif
+#ifdef VBOX_USB3PORT
+    PVBOXUSBHOOK_ENTRY pHook = pRequest->pHook;
+#else /* !VBOX_USB3PORT */
+    PVBOXUSBHOOK_ENTRY pHook = &g_VBoxUsbMonGlobals.UsbHubPnPHook.Hook;
+#endif /* !VBOX_USB3PORT */
+    NTSTATUS Status = VBoxUsbHookRequestComplete(pHook, pDevObj, pIrp, pRequest);
+    VBoxUsbMonMemFree(pRequest);
+#ifdef DEBUG_misha
+    if (Status != STATUS_MORE_PROCESSING_REQUIRED)
+    {
+        Assert(pIrp->IoStatus.Status == tmpStatus);
+    }
+#endif
+    VBoxUsbHookRelease(pHook);
+    return Status;
+}
+
+/**
+ * Device PnP hook
+ *
+ * @param   pDevObj     Device object.
+ * @param   pIrp         Request packet.
+ */
+#ifdef VBOX_USB3PORT
+static NTSTATUS vboxUsbMonPnPHook(IN PVBOXUSBHOOK_ENTRY pHook, IN PDEVICE_OBJECT pDevObj, IN PIRP pIrp)
+#else /* !VBOX_USB3PORT */
+NTSTATUS _stdcall VBoxUsbMonPnPHook(IN PDEVICE_OBJECT pDevObj, IN PIRP pIrp)
+#endif /* !VBOX_USB3PORT */
+{
+#ifndef VBOX_USB3PORT
+    PVBOXUSBHOOK_ENTRY pHook = &g_VBoxUsbMonGlobals.UsbHubPnPHook.Hook;
+#endif /* !VBOX_USB3PORT */
+    LOG(("==>PnP: Mn(%s), PDO(0x%p), IRP(0x%p), Status(0x%x)", vboxUsbDbgStrPnPMn(IoGetCurrentIrpStackLocation(pIrp)->MinorFunction), pDevObj, pIrp, pIrp->IoStatus.Status));
+
+    if (!VBoxUsbHookRetain(pHook))
+    {
+        WARN(("VBoxUsbHookRetain failed"));
+        return VBoxUsbHookRequestPassDownHookSkip(pHook, pDevObj, pIrp);
+    }
+
+    PVBOXUSBHUB_PNPHOOK_COMPLETION pCompletion = (PVBOXUSBHUB_PNPHOOK_COMPLETION)VBoxUsbMonMemAlloc(sizeof (*pCompletion));
+    if (!pCompletion)
+    {
+        WARN(("VBoxUsbMonMemAlloc failed"));
+        VBoxUsbHookRelease(pHook);
+        pIrp->IoStatus.Status = STATUS_INSUFFICIENT_RESOURCES;
+        pIrp->IoStatus.Information = 0;
+        IoCompleteRequest(pIrp, IO_NO_INCREMENT);
+        return STATUS_INSUFFICIENT_RESOURCES;
+    }
+
+    NTSTATUS Status = VBoxUsbHookRequestPassDownHookCompletion(pHook, pDevObj, pIrp, VBoxUsbPnPCompletion, &pCompletion->Rq);
+#ifdef VBOX_USB_WITH_VERBOSE_LOGGING
+    if (Status != STATUS_PENDING)
+    {
+        LOG(("Request completed, Status(0x%x)", Status));
+        VBoxUsbHookVerifyCompletion(pHook, &pCompletion->Rq, pIrp);
+    }
+    else
+    {
+        LOG(("Request pending"));
+    }
+#endif
+    return Status;
+}
+
+#ifdef VBOX_USB3PORT
+/**
+ * Device PnP hook stubs.
+ *
+ * @param   pDevObj     Device object.
+ * @param   pIrp         Request packet.
+ */
+#define VBOX_PNPHOOKSTUB(n) NTSTATUS _stdcall VBoxUsbMonPnPHook##n(IN PDEVICE_OBJECT pDevObj, IN PIRP pIrp) \
+{ \
+    return vboxUsbMonPnPHook(&g_VBoxUsbMonGlobals.pDrivers[n].UsbHubPnPHook.Hook, pDevObj, pIrp); \
+}
+
+#define VBOX_PNPHOOKSTUB_INIT(n) g_VBoxUsbMonGlobals.pDrivers[n].pfnHookStub = VBoxUsbMonPnPHook##n
+
+VBOX_PNPHOOKSTUB(0)
+VBOX_PNPHOOKSTUB(1)
+VBOX_PNPHOOKSTUB(2)
+VBOX_PNPHOOKSTUB(3)
+VBOX_PNPHOOKSTUB(4)
+AssertCompile(VBOXUSBMON_MAXDRIVERS == 5);
+
+typedef struct VBOXUSBMONHOOKDRIVERWALKER
+{
+    PDRIVER_OBJECT pDrvObj;
+} VBOXUSBMONHOOKDRIVERWALKER, *PVBOXUSBMONHOOKDRIVERWALKER;
+
+/**
+ * Logs an error to the system event log.
+ *
+ * @param   ErrCode        Error to report to event log.
+ * @param   ReturnedStatus Error that was reported by the driver to the caller.
+ * @param   uErrId         Unique error id representing the location in the driver.
+ * @param   cbDumpData     Number of bytes at pDumpData.
+ * @param   pDumpData      Pointer to data that will be added to the message (see 'details' tab).
+ */
+static void vboxUsbMonLogError(NTSTATUS ErrCode, NTSTATUS ReturnedStatus, ULONG uErrId, USHORT cbDumpData, PVOID pDumpData)
+{
+    PIO_ERROR_LOG_PACKET pErrEntry;
+
+
+    /* Truncate dumps that do not fit into IO_ERROR_LOG_PACKET. */
+    if (FIELD_OFFSET(IO_ERROR_LOG_PACKET, DumpData) + cbDumpData > ERROR_LOG_MAXIMUM_SIZE)
+        cbDumpData = ERROR_LOG_MAXIMUM_SIZE - FIELD_OFFSET(IO_ERROR_LOG_PACKET, DumpData);
+
+    pErrEntry = (PIO_ERROR_LOG_PACKET)IoAllocateErrorLogEntry(g_VBoxUsbMonGlobals.pDevObj,
+                                                              FIELD_OFFSET(IO_ERROR_LOG_PACKET, DumpData) + cbDumpData);
+    if (pErrEntry)
+    {
+        uint8_t *pDump = (uint8_t *)pErrEntry->DumpData;
+        if (cbDumpData)
+            memcpy(pDump, pDumpData, cbDumpData);
+        pErrEntry->MajorFunctionCode = 0;
+        pErrEntry->RetryCount = 0;
+        pErrEntry->DumpDataSize = cbDumpData;
+        pErrEntry->NumberOfStrings = 0;
+        pErrEntry->StringOffset = 0;
+        pErrEntry->ErrorCode = ErrCode;
+        pErrEntry->UniqueErrorValue = uErrId;
+        pErrEntry->FinalStatus = ReturnedStatus;
+        pErrEntry->IoControlCode = 0;
+        IoWriteErrorLogEntry(pErrEntry);
+    }
+    else
+    {
+        LOG(("Failed to allocate error log entry (cb=%d)\n", FIELD_OFFSET(IO_ERROR_LOG_PACKET, DumpData) + cbDumpData));
+    }
+}
+
+static DECLCALLBACK(BOOLEAN) vboxUsbMonHookDrvObjWalker(PFILE_OBJECT pFile, PDEVICE_OBJECT pTopDo, PDEVICE_OBJECT pHubDo, PVOID pvContext)
+{
+    RT_NOREF3(pFile, pTopDo, pvContext);
+    PDRIVER_OBJECT pDrvObj = pHubDo->DriverObject;
+
+    /* First we try to figure out if we are already hooked to this driver. */
+    for (int i = 0; i < VBOXUSBMON_MAXDRIVERS; i++)
+        if (pDrvObj == g_VBoxUsbMonGlobals.pDrivers[i].DriverObject)
+        {
+            LOG(("Found %p at pDrivers[%d]\n", pDrvObj, i));
+            /* We've already hooked to this one -- nothing to do. */
+            return TRUE;
+        }
+    /* We are not hooked yet, find an empty slot. */
+    for (int i = 0; i < VBOXUSBMON_MAXDRIVERS; i++)
+    {
+        if (!g_VBoxUsbMonGlobals.pDrivers[i].DriverObject)
+        {
+            /* Found an emtpy slot, use it. */
+            g_VBoxUsbMonGlobals.pDrivers[i].DriverObject = pDrvObj;
+            ObReferenceObject(pDrvObj);
+            LOG(("pDrivers[%d] = %p, installing the hook...\n", i, pDrvObj));
+            VBoxUsbHookInit(&g_VBoxUsbMonGlobals.pDrivers[i].UsbHubPnPHook.Hook,
+                            pDrvObj,
+                            IRP_MJ_PNP,
+                            g_VBoxUsbMonGlobals.pDrivers[i].pfnHookStub);
+            VBoxUsbHookInstall(&g_VBoxUsbMonGlobals.pDrivers[i].UsbHubPnPHook.Hook);
+            return TRUE; /* Must continue to find all drivers. */
+        }
+        if (pDrvObj == g_VBoxUsbMonGlobals.pDrivers[i].DriverObject)
+        {
+            LOG(("Found %p at pDrivers[%d]\n", pDrvObj, i));
+            /* We've already hooked to this one -- nothing to do. */
+            return TRUE;
+        }
+    }
+    /* No empty slots! No reason to continue. */
+    LOG(("No empty slots!\n"));
+    ANSI_STRING ansiDrvName;
+    NTSTATUS Status = RtlUnicodeStringToAnsiString(&ansiDrvName, &pDrvObj->DriverName, true);
+    if (Status != STATUS_SUCCESS)
+    {
+        ansiDrvName.Length = 0;
+        LOG(("RtlUnicodeStringToAnsiString failed with 0x%x", Status));
+    }
+    vboxUsbMonLogError(IO_ERR_INSUFFICIENT_RESOURCES, STATUS_SUCCESS, 1, ansiDrvName.Length, ansiDrvName.Buffer);
+    if (Status == STATUS_SUCCESS)
+        RtlFreeAnsiString(&ansiDrvName);
+    return FALSE;
+}
+
+/**
+ * Finds all USB drivers in the system and installs hooks if haven't done already.
+ */
+static NTSTATUS vboxUsbMonInstallAllHooks()
+{
+    vboxUsbMonHubDevWalk(vboxUsbMonHookDrvObjWalker, NULL, VBOXUSBMONHUBWALK_F_ALL);
+    return STATUS_SUCCESS;
+}
+#endif /* VBOX_USB3PORT */
+
+static NTSTATUS vboxUsbMonHookCheckInit()
+{
+    static bool fIsHookInited = false;
+    if (fIsHookInited)
+    {
+        LOG(("hook inited already, success"));
+        return STATUS_SUCCESS;
+    }
+#ifdef VBOX_USB3PORT
+    return vboxUsbMonInstallAllHooks();
+#else /* !VBOX_USB3PORT */
+    PDRIVER_OBJECT pDrvObj = vboxUsbMonHookFindHubDrvObj();
+    if (pDrvObj)
+    {
+        VBoxUsbHookInit(&g_VBoxUsbMonGlobals.UsbHubPnPHook.Hook, pDrvObj, IRP_MJ_PNP, VBoxUsbMonPnPHook);
+        fIsHookInited = true;
+        LOG(("SUCCESS"));
+        return STATUS_SUCCESS;
+    }
+    WARN(("hub drv obj not found, fail"));
+    return STATUS_UNSUCCESSFUL;
+#endif /* !VBOX_USB3PORT */
+}
+
+static NTSTATUS vboxUsbMonHookInstall()
+{
+#ifdef VBOX_USB3PORT
+    /* Nothing to do here as we have already installed all hooks in vboxUsbMonHookCheckInit(). */
+    return STATUS_SUCCESS;
+#else /* !VBOX_USB3PORT */
+#ifdef VBOXUSBMON_DBG_NO_PNPHOOK
+    return STATUS_SUCCESS;
+#else
+    if (g_VBoxUsbMonGlobals.UsbHubPnPHook.fUninitFailed)
+    {
+        WARN(("trying to hook usbhub pnp after the unhook failed, do nothing & pretend success"));
+        return STATUS_SUCCESS;
+    }
+    return VBoxUsbHookInstall(&g_VBoxUsbMonGlobals.UsbHubPnPHook.Hook);
+#endif
+#endif /* !VBOX_USB3PORT */
+}
+
+static NTSTATUS vboxUsbMonHookUninstall()
+{
+#ifdef VBOXUSBMON_DBG_NO_PNPHOOK
+    return STATUS_SUCCESS;
+#else
+#ifdef VBOX_USB3PORT
+    NTSTATUS Status = STATUS_SUCCESS;
+    for (int i = 0; i < VBOXUSBMON_MAXDRIVERS; i++)
+    {
+        if (g_VBoxUsbMonGlobals.pDrivers[i].DriverObject)
+        {
+            Assert(g_VBoxUsbMonGlobals.pDrivers[i].DriverObject == g_VBoxUsbMonGlobals.pDrivers[i].UsbHubPnPHook.Hook.pDrvObj);
+            LOG(("Unhooking from %p...\n", g_VBoxUsbMonGlobals.pDrivers[i].DriverObject));
+            Status = VBoxUsbHookUninstall(&g_VBoxUsbMonGlobals.pDrivers[i].UsbHubPnPHook.Hook);
+            if (!NT_SUCCESS(Status))
+            {
+                /*
+                 * We failed to uninstall the hook, so we keep the reference to the driver
+                 * in order to prevent another driver re-using this slot because we are
+                 * going to mark this hook as fUninitFailed.
+                 */
+                //AssertMsgFailed(("usbhub pnp unhook failed, setting the fUninitFailed flag, the current value of fUninitFailed (%d)", g_VBoxUsbMonGlobals.UsbHubPnPHook.fUninitFailed));
+                LOG(("usbhub pnp unhook failed, setting the fUninitFailed flag, the current value of fUninitFailed (%d)", g_VBoxUsbMonGlobals.pDrivers[i].UsbHubPnPHook.fUninitFailed));
+                g_VBoxUsbMonGlobals.pDrivers[i].UsbHubPnPHook.fUninitFailed = true;
+            }
+            else
+            {
+                /* The hook was removed successfully, now we can forget about this driver. */
+                ObDereferenceObject(g_VBoxUsbMonGlobals.pDrivers[i].DriverObject);
+                g_VBoxUsbMonGlobals.pDrivers[i].DriverObject = NULL;
+            }
+        }
+    }
+#else /* !VBOX_USB3PORT */
+    NTSTATUS Status = VBoxUsbHookUninstall(&g_VBoxUsbMonGlobals.UsbHubPnPHook.Hook);
+    if (!NT_SUCCESS(Status))
+    {
+        AssertMsgFailed(("usbhub pnp unhook failed, setting the fUninitFailed flag, the current value of fUninitFailed (%d)", g_VBoxUsbMonGlobals.UsbHubPnPHook.fUninitFailed));
+        g_VBoxUsbMonGlobals.UsbHubPnPHook.fUninitFailed = true;
+    }
+#endif /* !VBOX_USB3PORT */
+    return Status;
+#endif
+}
+
+
+static NTSTATUS vboxUsbMonCheckTermStuff()
+{
+    NTSTATUS Status = KeWaitForSingleObject(&g_VBoxUsbMonGlobals.OpenSynchEvent,
+            Executive, KernelMode,
+            FALSE, /* BOOLEAN Alertable */
+            NULL /* IN PLARGE_INTEGER Timeout */
+            );
+    AssertRelease(Status == STATUS_SUCCESS);
+
+    do
+    {
+        if (--g_VBoxUsbMonGlobals.cOpens)
+            break;
+
+        Status = vboxUsbMonHookUninstall();
+
+        NTSTATUS tmpStatus = VBoxUsbFltTerm();
+        if (!NT_SUCCESS(tmpStatus))
+        {
+            /* this means a driver state is screwed up, KeBugCheckEx here ? */
+            AssertReleaseFailed();
+        }
+    } while (0);
+
+    KeSetEvent(&g_VBoxUsbMonGlobals.OpenSynchEvent, 0, FALSE);
+
+    return Status;
+}
+
+static NTSTATUS vboxUsbMonCheckInitStuff()
+{
+    NTSTATUS Status = KeWaitForSingleObject(&g_VBoxUsbMonGlobals.OpenSynchEvent,
+            Executive, KernelMode,
+            FALSE, /* BOOLEAN Alertable */
+            NULL /* IN PLARGE_INTEGER Timeout */
+        );
+    if (Status == STATUS_SUCCESS)
+    {
+        do
+        {
+            if (g_VBoxUsbMonGlobals.cOpens++)
+            {
+                LOG(("opens: %d, success", g_VBoxUsbMonGlobals.cOpens));
+                break;
+            }
+
+            Status = VBoxUsbFltInit();
+            if (NT_SUCCESS(Status))
+            {
+                Status = vboxUsbMonHookCheckInit();
+                if (NT_SUCCESS(Status))
+                {
+                    Status = vboxUsbMonHookInstall();
+                    if (NT_SUCCESS(Status))
+                    {
+                        Status = STATUS_SUCCESS;
+                        LOG(("succeded!!"));
+                        break;
+                    }
+                    else
+                    {
+                        WARN(("vboxUsbMonHookInstall failed, Status (0x%x)", Status));
+                    }
+                }
+                else
+                {
+                    WARN(("vboxUsbMonHookCheckInit failed, Status (0x%x)", Status));
+                }
+                VBoxUsbFltTerm();
+            }
+            else
+            {
+                WARN(("VBoxUsbFltInit failed, Status (0x%x)", Status));
+            }
+
+            --g_VBoxUsbMonGlobals.cOpens;
+            Assert(!g_VBoxUsbMonGlobals.cOpens);
+        } while (0);
+
+        KeSetEvent(&g_VBoxUsbMonGlobals.OpenSynchEvent, 0, FALSE);
+    }
+    else
+    {
+        WARN(("KeWaitForSingleObject failed, Status (0x%x)", Status));
+    }
+    return Status;
+}
+
+static NTSTATUS vboxUsbMonContextCreate(PVBOXUSBMONCTX *ppCtx)
+{
+    NTSTATUS Status;
+    *ppCtx = NULL;
+    PVBOXUSBMONCTX pFileCtx = (PVBOXUSBMONCTX)VBoxUsbMonMemAllocZ(sizeof (*pFileCtx));
+    if (pFileCtx)
+    {
+        Status = vboxUsbMonCheckInitStuff();
+        if (Status == STATUS_SUCCESS)
+        {
+            Status = VBoxUsbFltCreate(&pFileCtx->FltCtx);
+            if (Status == STATUS_SUCCESS)
+            {
+                *ppCtx = pFileCtx;
+                LOG(("succeeded!!"));
+                return STATUS_SUCCESS;
+            }
+            else
+            {
+                WARN(("VBoxUsbFltCreate failed"));
+            }
+            vboxUsbMonCheckTermStuff();
+        }
+        else
+        {
+            WARN(("vboxUsbMonCheckInitStuff failed"));
+        }
+        VBoxUsbMonMemFree(pFileCtx);
+    }
+    else
+    {
+        WARN(("VBoxUsbMonMemAllocZ failed"));
+        Status = STATUS_NO_MEMORY;
+    }
+
+    return Status;
+}
+
+static NTSTATUS vboxUsbMonContextClose(PVBOXUSBMONCTX pCtx)
+{
+    NTSTATUS Status = VBoxUsbFltClose(&pCtx->FltCtx);
+    if (Status == STATUS_SUCCESS)
+    {
+        Status = vboxUsbMonCheckTermStuff();
+        Assert(Status == STATUS_SUCCESS);
+        /* ignore the failure */
+        VBoxUsbMonMemFree(pCtx);
+    }
+
+    return Status;
+}
+
+static NTSTATUS _stdcall VBoxUsbMonClose(PDEVICE_OBJECT pDevObj, PIRP pIrp)
+{
+    PIO_STACK_LOCATION pStack = IoGetCurrentIrpStackLocation(pIrp);
+    PFILE_OBJECT pFileObj = pStack->FileObject;
+    Assert(pFileObj->FsContext);
+    PVBOXUSBMONCTX pCtx = (PVBOXUSBMONCTX)pFileObj->FsContext;
+
+    LOG(("VBoxUsbMonClose"));
+
+    NTSTATUS Status = vboxUsbMonContextClose(pCtx);
+    if (Status != STATUS_SUCCESS)
+    {
+        WARN(("vboxUsbMonContextClose failed, Status (0x%x), prefent unload", Status));
+        if (!InterlockedExchange(&g_VBoxUsbMonGlobals.ulPreventUnloadOn, 1))
+        {
+            LOGREL(("ulPreventUnloadOn not set, preventing unload"));
+            UNICODE_STRING UniName;
+            PDEVICE_OBJECT pTmpDevObj;
+            RtlInitUnicodeString(&UniName, USBMON_DEVICE_NAME_NT);
+            NTSTATUS tmpStatus = IoGetDeviceObjectPointer(&UniName, FILE_ALL_ACCESS, &g_VBoxUsbMonGlobals.pPreventUnloadFileObj, &pTmpDevObj);
+            AssertRelease(NT_SUCCESS(tmpStatus));
+            AssertRelease(pTmpDevObj == pDevObj);
+        }
+        else
+        {
+            WARN(("ulPreventUnloadOn already set"));
+        }
+        LOG(("success!!"));
+        Status = STATUS_SUCCESS;
+    }
+    pFileObj->FsContext = NULL;
+    pIrp->IoStatus.Status = Status;
+    pIrp->IoStatus.Information  = 0;
+    IoCompleteRequest(pIrp, IO_NO_INCREMENT);
+    return Status;
+}
+
+
+static NTSTATUS _stdcall VBoxUsbMonCreate(PDEVICE_OBJECT pDevObj, PIRP pIrp)
+{
+    RT_NOREF1(pDevObj);
+    PIO_STACK_LOCATION pStack = IoGetCurrentIrpStackLocation(pIrp);
+    PFILE_OBJECT pFileObj = pStack->FileObject;
+    NTSTATUS Status;
+
+    LOG(("VBoxUSBMonCreate"));
+
+    if (pStack->Parameters.Create.Options & FILE_DIRECTORY_FILE)
+    {
+        WARN(("trying to open as a directory"));
+        pIrp->IoStatus.Status = STATUS_NOT_A_DIRECTORY;
+        pIrp->IoStatus.Information = 0;
+        IoCompleteRequest(pIrp, IO_NO_INCREMENT);
+        return STATUS_NOT_A_DIRECTORY;
+    }
+
+    pFileObj->FsContext = NULL;
+    PVBOXUSBMONCTX pCtx = NULL;
+    Status = vboxUsbMonContextCreate(&pCtx);
+    if (Status == STATUS_SUCCESS)
+    {
+        Assert(pCtx);
+        pFileObj->FsContext = pCtx;
+    }
+    else
+    {
+        WARN(("vboxUsbMonContextCreate failed Status (0x%x)", Status));
+    }
+
+    pIrp->IoStatus.Status = Status;
+    pIrp->IoStatus.Information  = 0;
+    IoCompleteRequest(pIrp, IO_NO_INCREMENT);
+    return Status;
+}
+
+static int VBoxUsbMonSetNotifyEvent(PVBOXUSBMONCTX pContext, HANDLE hEvent)
+{
+    int rc = VBoxUsbFltSetNotifyEvent(&pContext->FltCtx, hEvent);
+    return rc;
+}
+
+static int VBoxUsbMonFltAdd(PVBOXUSBMONCTX pContext, PUSBFILTER pFilter, uintptr_t *pId)
+{
+#ifdef VBOXUSBMON_DBG_NO_FILTERS
+    static uintptr_t idDummy = 1;
+    *pId = idDummy;
+    ++idDummy;
+    return VINF_SUCCESS;
+#else
+    int rc = VBoxUsbFltAdd(&pContext->FltCtx, pFilter, pId);
+    return rc;
+#endif
+}
+
+static int VBoxUsbMonFltRemove(PVBOXUSBMONCTX pContext, uintptr_t uId)
+{
+#ifdef VBOXUSBMON_DBG_NO_FILTERS
+    return VINF_SUCCESS;
+#else
+    int rc = VBoxUsbFltRemove(&pContext->FltCtx, uId);
+    return rc;
+#endif
+}
+
+static NTSTATUS VBoxUsbMonRunFilters(PVBOXUSBMONCTX pContext)
+{
+    NTSTATUS Status = VBoxUsbFltFilterCheck(&pContext->FltCtx);
+    return Status;
+}
+
+static NTSTATUS VBoxUsbMonGetDevice(PVBOXUSBMONCTX pContext, HVBOXUSBDEVUSR hDevice, PUSBSUP_GETDEV_MON pInfo)
+{
+    NTSTATUS Status = VBoxUsbFltGetDevice(&pContext->FltCtx, hDevice, pInfo);
+    return Status;
+}
+
+static NTSTATUS vboxUsbMonIoctlDispatch(PVBOXUSBMONCTX pContext, ULONG Ctl, PVOID pvBuffer, ULONG cbInBuffer,
+                                        ULONG cbOutBuffer, ULONG_PTR *pInfo)
+{
+    NTSTATUS Status = STATUS_SUCCESS;
+    ULONG_PTR Info = 0;
+    switch (Ctl)
+    {
+        case SUPUSBFLT_IOCTL_GET_VERSION:
+        {
+            PUSBSUP_VERSION pOut = (PUSBSUP_VERSION)pvBuffer;
+
+            LOG(("SUPUSBFLT_IOCTL_GET_VERSION"));
+            if (!pvBuffer || cbOutBuffer != sizeof(*pOut) || cbInBuffer != 0)
+            {
+                WARN(("SUPUSBFLT_IOCTL_GET_VERSION: Invalid input/output sizes. cbIn=%d expected %d. cbOut=%d expected %d.",
+                        cbInBuffer, 0, cbOutBuffer, sizeof (*pOut)));
+                Status = STATUS_INVALID_PARAMETER;
+                break;
+            }
+            pOut->u32Major = USBMON_MAJOR_VERSION;
+            pOut->u32Minor = USBMON_MINOR_VERSION;
+            Info = sizeof (*pOut);
+            ASSERT_WARN(Status == STATUS_SUCCESS, ("unexpected status, 0x%x", Status));
+            break;
+        }
+
+        case SUPUSBFLT_IOCTL_ADD_FILTER:
+        {
+            PUSBFILTER pFilter = (PUSBFILTER)pvBuffer;
+            PUSBSUP_FLTADDOUT pOut = (PUSBSUP_FLTADDOUT)pvBuffer;
+            uintptr_t uId = 0;
+            int rc;
+            if (RT_UNLIKELY(!pvBuffer || cbInBuffer != sizeof (*pFilter) || cbOutBuffer != sizeof (*pOut)))
+            {
+                WARN(("SUPUSBFLT_IOCTL_ADD_FILTER: Invalid input/output sizes. cbIn=%d expected %d. cbOut=%d expected %d.",
+                        cbInBuffer, sizeof (*pFilter), cbOutBuffer, sizeof (*pOut)));
+                Status = STATUS_INVALID_PARAMETER;
+                break;
+            }
+
+            rc = VBoxUsbMonFltAdd(pContext, pFilter, &uId);
+            pOut->rc  = rc;
+            pOut->uId = uId;
+            Info = sizeof (*pOut);
+            ASSERT_WARN(Status == STATUS_SUCCESS, ("unexpected status, 0x%x", Status));
+            break;
+        }
+
+        case SUPUSBFLT_IOCTL_REMOVE_FILTER:
+        {
+            uintptr_t *pIn = (uintptr_t *)pvBuffer;
+            int *pRc = (int *)pvBuffer;
+
+            if (!pvBuffer || cbInBuffer != sizeof (*pIn) || (cbOutBuffer && cbOutBuffer != sizeof (*pRc)))
+            {
+                WARN(("SUPUSBFLT_IOCTL_REMOVE_FILTER: Invalid input/output sizes. cbIn=%d expected %d. cbOut=%d expected %d.",
+                        cbInBuffer, sizeof (*pIn), cbOutBuffer, 0));
+                Status = STATUS_INVALID_PARAMETER;
+                break;
+            }
+            LOG(("SUPUSBFLT_IOCTL_REMOVE_FILTER %x", *pIn));
+            int rc = VBoxUsbMonFltRemove(pContext, *pIn);
+            if (cbOutBuffer)
+            {
+                /* we've validated that already */
+                Assert(cbOutBuffer == (ULONG)*pRc);
+                *pRc = rc;
+                Info = sizeof (*pRc);
+            }
+            ASSERT_WARN(Status == STATUS_SUCCESS, ("unexpected status, 0x%x", Status));
+            break;
+        }
+
+        case SUPUSBFLT_IOCTL_RUN_FILTERS:
+        {
+            if (pvBuffer || cbInBuffer || cbOutBuffer)
+            {
+                WARN(("SUPUSBFLT_IOCTL_RUN_FILTERS: Invalid input/output sizes. cbIn=%d expected %d. cbOut=%d expected %d.",
+                        cbInBuffer, 0, cbOutBuffer, 0));
+                Status = STATUS_INVALID_PARAMETER;
+                break;
+            }
+            LOG(("SUPUSBFLT_IOCTL_RUN_FILTERS "));
+            Status = VBoxUsbMonRunFilters(pContext);
+            ASSERT_WARN(Status != STATUS_PENDING, ("status pending!"));
+            break;
+        }
+
+        case SUPUSBFLT_IOCTL_GET_DEVICE:
+        {
+            HVBOXUSBDEVUSR hDevice = *((HVBOXUSBDEVUSR*)pvBuffer);
+            PUSBSUP_GETDEV_MON pOut = (PUSBSUP_GETDEV_MON)pvBuffer;
+            if (!pvBuffer || cbInBuffer != sizeof (hDevice) || cbOutBuffer < sizeof (*pOut))
+            {
+                WARN(("SUPUSBFLT_IOCTL_GET_DEVICE: Invalid input/output sizes. cbIn=%d expected %d. cbOut=%d expected >= %d.",
+                        cbInBuffer, sizeof (hDevice), cbOutBuffer, sizeof (*pOut)));
+                Status = STATUS_INVALID_PARAMETER;
+                break;
+            }
+
+            Status = VBoxUsbMonGetDevice(pContext, hDevice, pOut);
+
+            if (NT_SUCCESS(Status))
+            {
+                Info = sizeof (*pOut);
+            }
+            else
+            {
+                WARN(("VBoxUsbMonGetDevice fail 0x%x", Status));
+            }
+            break;
+        }
+
+        case SUPUSBFLT_IOCTL_SET_NOTIFY_EVENT:
+        {
+            PUSBSUP_SET_NOTIFY_EVENT pSne = (PUSBSUP_SET_NOTIFY_EVENT)pvBuffer;
+            if (!pvBuffer || cbInBuffer != sizeof (*pSne) || cbOutBuffer != sizeof (*pSne))
+            {
+                WARN(("SUPUSBFLT_IOCTL_SET_NOTIFY_EVENT: Invalid input/output sizes. cbIn=%d expected %d. cbOut=%d expected %d.",
+                        cbInBuffer, sizeof (*pSne), cbOutBuffer, sizeof (*pSne)));
+                Status = STATUS_INVALID_PARAMETER;
+                break;
+            }
+
+            pSne->u.rc = VBoxUsbMonSetNotifyEvent(pContext, pSne->u.hEvent);
+            Info = sizeof (*pSne);
+            ASSERT_WARN(Status == STATUS_SUCCESS, ("unexpected status, 0x%x", Status));
+            break;
+        }
+
+        default:
+            WARN(("Unknown code 0x%x", Ctl));
+            Status = STATUS_INVALID_PARAMETER;
+            break;
+    }
+
+    ASSERT_WARN(Status != STATUS_PENDING, ("Status pending!"));
+
+    *pInfo = Info;
+    return Status;
+}
+
+static NTSTATUS _stdcall VBoxUsbMonDeviceControl(PDEVICE_OBJECT pDevObj, PIRP pIrp)
+{
+    ULONG_PTR Info = 0;
+    NTSTATUS Status = IoAcquireRemoveLock(&g_VBoxUsbMonGlobals.RmLock, pDevObj);
+    if (NT_SUCCESS(Status))
+    {
+        PIO_STACK_LOCATION pSl = IoGetCurrentIrpStackLocation(pIrp);
+        PFILE_OBJECT pFileObj = pSl->FileObject;
+        Assert(pFileObj);
+        Assert(pFileObj->FsContext);
+        PVBOXUSBMONCTX pCtx = (PVBOXUSBMONCTX)pFileObj->FsContext;
+        Assert(pCtx);
+        Status = vboxUsbMonIoctlDispatch(pCtx,
+                    pSl->Parameters.DeviceIoControl.IoControlCode,
+                    pIrp->AssociatedIrp.SystemBuffer,
+                    pSl->Parameters.DeviceIoControl.InputBufferLength,
+                    pSl->Parameters.DeviceIoControl.OutputBufferLength,
+                    &Info);
+        ASSERT_WARN(Status != STATUS_PENDING, ("Status pending"));
+
+        IoReleaseRemoveLock(&g_VBoxUsbMonGlobals.RmLock, pDevObj);
+    }
+    else
+    {
+        WARN(("IoAcquireRemoveLock failed Status (0x%x)", Status));
+    }
+
+    pIrp->IoStatus.Information = Info;
+    pIrp->IoStatus.Status = Status;
+    IoCompleteRequest (pIrp, IO_NO_INCREMENT);
+    return Status;
+}
+
+static NTSTATUS vboxUsbMonInternalIoctlDispatch(ULONG Ctl, PVOID pvBuffer,  ULONG_PTR *pInfo)
+{
+    NTSTATUS Status = STATUS_SUCCESS;
+    *pInfo = 0;
+    switch (Ctl)
+    {
+        case VBOXUSBIDC_INTERNAL_IOCTL_GET_VERSION:
+        {
+            PVBOXUSBIDC_VERSION pOut = (PVBOXUSBIDC_VERSION)pvBuffer;
+
+            LOG(("VBOXUSBIDC_INTERNAL_IOCTL_GET_VERSION"));
+            if (!pvBuffer)
+            {
+                WARN(("VBOXUSBIDC_INTERNAL_IOCTL_GET_VERSION: Buffer is NULL"));
+                Status = STATUS_INVALID_PARAMETER;
+                break;
+            }
+            pOut->u32Major = VBOXUSBIDC_VERSION_MAJOR;
+            pOut->u32Minor = VBOXUSBIDC_VERSION_MINOR;
+            ASSERT_WARN(Status == STATUS_SUCCESS, ("unexpected status, 0x%x", Status));
+            break;
+        }
+
+        case VBOXUSBIDC_INTERNAL_IOCTL_PROXY_STARTUP:
+        {
+            PVBOXUSBIDC_PROXY_STARTUP pOut = (PVBOXUSBIDC_PROXY_STARTUP)pvBuffer;
+
+            LOG(("VBOXUSBIDC_INTERNAL_IOCTL_PROXY_STARTUP"));
+            if (!pvBuffer)
+            {
+                WARN(("VBOXUSBIDC_INTERNAL_IOCTL_PROXY_STARTUP: Buffer is NULL"));
+                Status = STATUS_INVALID_PARAMETER;
+                break;
+            }
+
+            pOut->u.hDev = VBoxUsbFltProxyStarted(pOut->u.pPDO);
+            ASSERT_WARN(pOut->u.hDev, ("zero hDev"));
+            ASSERT_WARN(Status == STATUS_SUCCESS, ("unexpected status, 0x%x", Status));
+            break;
+        }
+
+        case VBOXUSBIDC_INTERNAL_IOCTL_PROXY_TEARDOWN:
+        {
+            PVBOXUSBIDC_PROXY_TEARDOWN pOut = (PVBOXUSBIDC_PROXY_TEARDOWN)pvBuffer;
+
+            LOG(("VBOXUSBIDC_INTERNAL_IOCTL_PROXY_TEARDOWN"));
+            if (!pvBuffer)
+            {
+                WARN(("VBOXUSBIDC_INTERNAL_IOCTL_PROXY_TEARDOWN: Buffer is NULL"));
+                Status = STATUS_INVALID_PARAMETER;
+                break;
+            }
+
+            ASSERT_WARN(pOut->hDev, ("zero hDev"));
+            VBoxUsbFltProxyStopped(pOut->hDev);
+            ASSERT_WARN(Status == STATUS_SUCCESS, ("unexpected status, 0x%x", Status));
+            break;
+        }
+
+        default:
+        {
+            WARN(("Unknown code 0x%x", Ctl));
+            Status = STATUS_INVALID_PARAMETER;
+            break;
+        }
+    }
+
+    return Status;
+}
+
+static NTSTATUS _stdcall VBoxUsbMonInternalDeviceControl(PDEVICE_OBJECT pDevObj, PIRP pIrp)
+{
+    ULONG_PTR Info = 0;
+    NTSTATUS Status = IoAcquireRemoveLock(&g_VBoxUsbMonGlobals.RmLock, pDevObj);
+    if (NT_SUCCESS(Status))
+    {
+        PIO_STACK_LOCATION pSl = IoGetCurrentIrpStackLocation(pIrp);
+        Status = vboxUsbMonInternalIoctlDispatch(pSl->Parameters.DeviceIoControl.IoControlCode,
+                        pSl->Parameters.Others.Argument1,
+                        &Info);
+        Assert(Status != STATUS_PENDING);
+
+        IoReleaseRemoveLock(&g_VBoxUsbMonGlobals.RmLock, pDevObj);
+    }
+
+    pIrp->IoStatus.Information = Info;
+    pIrp->IoStatus.Status = Status;
+    IoCompleteRequest (pIrp, IO_NO_INCREMENT);
+    return Status;
+}
+
+/**
+ * Unload the driver.
+ *
+ * @param   pDrvObj     Driver object.
+ */
+static void _stdcall VBoxUsbMonUnload(PDRIVER_OBJECT pDrvObj)
+{
+    RT_NOREF1(pDrvObj);
+    LOG(("VBoxUSBMonUnload pDrvObj (0x%p)", pDrvObj));
+
+    IoReleaseRemoveLockAndWait(&g_VBoxUsbMonGlobals.RmLock, &g_VBoxUsbMonGlobals);
+
+    Assert(!g_VBoxUsbMonGlobals.cOpens);
+
+    UNICODE_STRING DosName;
+    RtlInitUnicodeString(&DosName, USBMON_DEVICE_NAME_DOS);
+    IoDeleteSymbolicLink(&DosName);
+
+    IoDeleteDevice(g_VBoxUsbMonGlobals.pDevObj);
+
+    /* cleanup the logger */
+    PRTLOGGER pLogger = RTLogRelSetDefaultInstance(NULL);
+    if (pLogger)
+        RTLogDestroy(pLogger);
+    pLogger = RTLogSetDefaultInstance(NULL);
+    if (pLogger)
+        RTLogDestroy(pLogger);
+}
+
+RT_C_DECLS_BEGIN
+NTSTATUS _stdcall DriverEntry(PDRIVER_OBJECT pDrvObj, PUNICODE_STRING pRegPath);
+RT_C_DECLS_END
+
+/**
+ * Driver entry point.
+ *
+ * @returns appropriate status code.
+ * @param   pDrvObj     Pointer to driver object.
+ * @param   pRegPath    Registry base path.
+ */
+NTSTATUS _stdcall DriverEntry(PDRIVER_OBJECT pDrvObj, PUNICODE_STRING pRegPath)
+{
+    RT_NOREF1(pRegPath);
+#ifdef VBOX_USB_WITH_VERBOSE_LOGGING
+    RTLogGroupSettings(0, "+default.e.l.f.l2.l3");
+    RTLogDestinations(0, "debugger");
+#endif
+
+    LOGREL(("Built %s %s", __DATE__, __TIME__));
+
+    memset (&g_VBoxUsbMonGlobals, 0, sizeof (g_VBoxUsbMonGlobals));
+#ifdef VBOX_USB3PORT
+    VBOX_PNPHOOKSTUB_INIT(0);
+    VBOX_PNPHOOKSTUB_INIT(1);
+    VBOX_PNPHOOKSTUB_INIT(2);
+    VBOX_PNPHOOKSTUB_INIT(3);
+    VBOX_PNPHOOKSTUB_INIT(4);
+    AssertCompile(VBOXUSBMON_MAXDRIVERS == 5);
+#endif /* VBOX_USB3PORT */
+    KeInitializeEvent(&g_VBoxUsbMonGlobals.OpenSynchEvent, SynchronizationEvent, TRUE /* signaled */);
+    IoInitializeRemoveLock(&g_VBoxUsbMonGlobals.RmLock, VBOXUSBMON_MEMTAG, 1, 100);
+    UNICODE_STRING DevName;
+    PDEVICE_OBJECT pDevObj;
+    /* create the device */
+    RtlInitUnicodeString(&DevName, USBMON_DEVICE_NAME_NT);
+    NTSTATUS Status = IoAcquireRemoveLock(&g_VBoxUsbMonGlobals.RmLock, &g_VBoxUsbMonGlobals);
+    if (NT_SUCCESS(Status))
+    {
+        Status = IoCreateDevice(pDrvObj, sizeof (VBOXUSBMONINS), &DevName, FILE_DEVICE_UNKNOWN, 0, FALSE, &pDevObj);
+        if (NT_SUCCESS(Status))
+        {
+            UNICODE_STRING DosName;
+            RtlInitUnicodeString(&DosName, USBMON_DEVICE_NAME_DOS);
+            Status = IoCreateSymbolicLink(&DosName, &DevName);
+            if (NT_SUCCESS(Status))
+            {
+                PVBOXUSBMONINS pDevExt = (PVBOXUSBMONINS)pDevObj->DeviceExtension;
+                memset(pDevExt, 0, sizeof(*pDevExt));
+
+                pDrvObj->DriverUnload = VBoxUsbMonUnload;
+                pDrvObj->MajorFunction[IRP_MJ_CREATE] = VBoxUsbMonCreate;
+                pDrvObj->MajorFunction[IRP_MJ_CLOSE] = VBoxUsbMonClose;
+                pDrvObj->MajorFunction[IRP_MJ_DEVICE_CONTROL] = VBoxUsbMonDeviceControl;
+                pDrvObj->MajorFunction[IRP_MJ_INTERNAL_DEVICE_CONTROL] = VBoxUsbMonInternalDeviceControl;
+
+                g_VBoxUsbMonGlobals.pDevObj = pDevObj;
+                LOG(("VBoxUSBMon::DriverEntry returning STATUS_SUCCESS"));
+                return STATUS_SUCCESS;
+            }
+            IoDeleteDevice(pDevObj);
+        }
+        IoReleaseRemoveLockAndWait(&g_VBoxUsbMonGlobals.RmLock, &g_VBoxUsbMonGlobals);
+    }
+
+    return Status;
+}
diff --git a/src/VBox/HostDrivers/VBoxUSB/win/mon/VBoxUsbMon.h b/src/VBox/HostDrivers/VBoxUSB/win/mon/VBoxUsbMon.h
new file mode 100644
index 00000000..ffd32894
--- /dev/null
+++ b/src/VBox/HostDrivers/VBoxUSB/win/mon/VBoxUsbMon.h
@@ -0,0 +1,74 @@
+/* $Id: VBoxUsbMon.h $ */
+/** @file
+ * VBox USB Monitor
+ */
+/*
+ * Copyright (C) 2011-2019 Oracle Corporation
+ *
+ * This file is part of VirtualBox Open Source Edition (OSE), as
+ * available from http://www.virtualbox.org. This file is free software;
+ * you can redistribute it and/or modify it under the terms of the GNU
+ * General Public License (GPL) as published by the Free Software
+ * Foundation, in version 2 as it comes in the "COPYING" file of the
+ * VirtualBox OSE distribution. VirtualBox OSE is distributed in the
+ * hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
+ *
+ * The contents of this file may alternatively be used under the terms
+ * of the Common Development and Distribution License Version 1.0
+ * (CDDL) only, as it comes in the "COPYING.CDDL" file of the
+ * VirtualBox OSE distribution, in which case the provisions of the
+ * CDDL are applicable instead of those of the GPL.
+ *
+ * You may elect to license modified versions of this file under the
+ * terms and conditions of either the GPL or the CDDL or both.
+ */
+
+#ifndef VBOX_INCLUDED_SRC_VBoxUSB_win_mon_VBoxUsbMon_h
+#define VBOX_INCLUDED_SRC_VBoxUSB_win_mon_VBoxUsbMon_h
+#ifndef RT_WITHOUT_PRAGMA_ONCE
+# pragma once
+#endif
+
+#include <VBox/cdefs.h>
+#include <VBox/types.h>
+#include <iprt/assert.h>
+#include <VBox/sup.h>
+#include <iprt/asm.h>
+#include <VBox/log.h>
+
+#ifdef DEBUG
+/* disables filters */
+//#define VBOXUSBMON_DBG_NO_FILTERS
+/* disables pnp hooking */
+//#define VBOXUSBMON_DBG_NO_PNPHOOK
+#endif
+
+#include "../../../win/VBoxDbgLog.h"
+#include "../cmn/VBoxDrvTool.h"
+#include "../cmn/VBoxUsbTool.h"
+
+#include "VBoxUsbHook.h"
+#include "VBoxUsbFlt.h"
+
+PVOID VBoxUsbMonMemAlloc(SIZE_T cbBytes);
+PVOID VBoxUsbMonMemAllocZ(SIZE_T cbBytes);
+VOID VBoxUsbMonMemFree(PVOID pvMem);
+
+NTSTATUS VBoxUsbMonGetDescriptor(PDEVICE_OBJECT pDevObj, void *buffer, int size, int type, int index, int language_id);
+NTSTATUS VBoxUsbMonQueryBusRelations(PDEVICE_OBJECT pDevObj, PFILE_OBJECT pFileObj, PDEVICE_RELATIONS *pDevRelations);
+
+void vboxUsbDbgPrintUnicodeString(PUNICODE_STRING pUnicodeString);
+
+/* visit usbhub-originated device PDOs */
+#define VBOXUSBMONHUBWALK_F_PDO 0x00000001
+/* visit usbhub device FDOs */
+#define VBOXUSBMONHUBWALK_F_FDO 0x00000002
+/* visit all usbhub-originated device objects */
+#define VBOXUSBMONHUBWALK_F_ALL (VBOXUSBMONHUBWALK_F_FDO | VBOXUSBMONHUBWALK_F_PDO)
+
+typedef DECLCALLBACK(BOOLEAN) FNVBOXUSBMONDEVWALKER(PFILE_OBJECT pFile, PDEVICE_OBJECT pTopDo, PDEVICE_OBJECT pHubDo, PVOID pvContext);
+typedef FNVBOXUSBMONDEVWALKER *PFNVBOXUSBMONDEVWALKER;
+
+VOID vboxUsbMonHubDevWalk(PFNVBOXUSBMONDEVWALKER pfnWalker, PVOID pvWalker, ULONG fFlags);
+
+#endif /* !VBOX_INCLUDED_SRC_VBoxUSB_win_mon_VBoxUsbMon_h */
diff --git a/src/VBox/HostDrivers/VBoxUSB/win/mon/VBoxUsbMon.rc b/src/VBox/HostDrivers/VBoxUSB/win/mon/VBoxUsbMon.rc
new file mode 100644
index 00000000..cab1b055
--- /dev/null
+++ b/src/VBox/HostDrivers/VBoxUSB/win/mon/VBoxUsbMon.rc
@@ -0,0 +1,60 @@
+/* $Id: VBoxUsbMon.rc $ */
+/** @file
+ * VBoxUSBMon - Resource file containing version info and icon.
+ */
+
+/*
+ * Copyright (C) 2011-2019 Oracle Corporation
+ *
+ * This file is part of VirtualBox Open Source Edition (OSE), as
+ * available from http://www.virtualbox.org. This file is free software;
+ * you can redistribute it and/or modify it under the terms of the GNU
+ * General Public License (GPL) as published by the Free Software
+ * Foundation, in version 2 as it comes in the "COPYING" file of the
+ * VirtualBox OSE distribution. VirtualBox OSE is distributed in the
+ * hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
+ *
+ * The contents of this file may alternatively be used under the terms
+ * of the Common Development and Distribution License Version 1.0
+ * (CDDL) only, as it comes in the "COPYING.CDDL" file of the
+ * VirtualBox OSE distribution, in which case the provisions of the
+ * CDDL are applicable instead of those of the GPL.
+ *
+ * You may elect to license modified versions of this file under the
+ * terms and conditions of either the GPL or the CDDL or both.
+ */
+
+#include <windows.h>
+#include <VBox/version.h>
+
+LANGUAGE LANG_ENGLISH, SUBLANG_ENGLISH_US
+
+VS_VERSION_INFO VERSIONINFO
+  FILEVERSION      VBOX_RC_FILE_VERSION
+  PRODUCTVERSION   VBOX_RC_FILE_VERSION
+  FILEFLAGSMASK    VS_FFI_FILEFLAGSMASK
+  FILEFLAGS        VBOX_RC_FILE_FLAGS
+  FILEOS           VBOX_RC_FILE_OS
+  FILETYPE         VBOX_RC_TYPE_DRV
+  FILESUBTYPE      VFT2_DRV_SYSTEM
+BEGIN
+  BLOCK "StringFileInfo"
+  BEGIN
+    BLOCK "040904b0" // Lang=US English, CharSet=Unicode
+    BEGIN
+      VALUE "FileDescription",  "VirtualBox USB Monitor Driver\0"
+      VALUE "InternalName",     "VBoxUSBMon\0"
+      VALUE "OriginalFilename", "VBoxUSBMon.sys\0"
+      VALUE "CompanyName",      VBOX_RC_COMPANY_NAME
+      VALUE "FileVersion",      VBOX_RC_FILE_VERSION_STR
+      VALUE "LegalCopyright",   VBOX_RC_LEGAL_COPYRIGHT
+      VALUE "ProductName",      VBOX_RC_PRODUCT_NAME_STR
+      VALUE "ProductVersion",   VBOX_RC_PRODUCT_VERSION_STR
+      VBOX_RC_MORE_STRINGS
+    END
+  END
+  BLOCK "VarFileInfo"
+  BEGIN
+    VALUE "Translation", 0x409, 1200
+  END
+END