blue Screen on my WDF hid hidusbfx2 driver

NTDEV
1

I use the WDK WinDDK\7600.16385.1\src\hid\hidusbfx2\sys "WDF" sample and modify the source code for my device.
But I got BSOD in DTM Test.
It seems that remove device issue.
I am a weaker WDF Driver.
Anybody know about the issue and show me the right-way.
And it had two BSOD issues -0X0000000A and 0x0000007F
Thanks a lot.

1.Common Scenario stress With IO
Run Job-Common_Scenario_stress_With_IO -->0X0000000A
2.Common Scenario stress With IO(WDF Preview)
Run Job-Common_Scenario_stress_With_IO -->0X0000000A
3.CHAOS Hareware And OS Test
Run Job-Pnpdtest With concurrent IO in parellel with DevPathExer-Library Job -->0X0000000A
4.CHAOS Hareware And OS Test(WDF Preview)
Run Job-Pnpdtest With concurrent IO in parellel with DevPathExer-Library Job -->0X0000000A
5.WDF logo test -Final.
Excute Fault Injection -->0x0000007F
"WDF logo test-Final" seem can be filter by DTM.

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 91114e6c, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000001, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: 83c2ddfd, address which referenced memory

Debugging Details:

WRITE_ADDRESS: GetPointerFromAddress: unable to read from 83d6f718
Unable to read MiSystemVaType memory at 83d4f160
91114e6c

CURRENT_IRQL: 2

FAULTING_IP:
nt!IoCancelIrp+47
83c2ddfd c6472401 mov byte ptr [edi+24h],1

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: VERIFIER_ENABLED_VISTA_MINIDUMP

BUGCHECK_STR: 0xA

PROCESS_NAME: System

TRAP_FRAME: 8a317a14 -- (.trap 0xffffffff8a317a14)
ErrCode = 00000002
eax=00000000 ebx=00000000 ecx=8a317a9c edx=00000000 esi=88292460 edi=91114e48
eip=83c2ddfd esp=8a317a88 ebp=8a317a94 iopl=0 nv up ei ng nz na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010282
nt!IoCancelIrp+0x47:
83c2ddfd c6472401 mov byte ptr [edi+24h],1 ds:0023:91114e6c=??
Resetting default scope

LAST_CONTROL_TRANSFER: from 83c2ddfd to 83c4d7eb

STACK_TEXT:
8a317a14 83c2ddfd badb0d00 00000000 8a3179b4 nt!KiTrap0E+0x2cf
8a317a94 8eddbabb 91114e00 88292460 ab962e70 nt!IoCancelIrp+0x47
8a317aa8 8eddcca8 88292460 00000000 9017df00 mouclass!MouseClassRemoveDevice+0x3b
8a317ad0 83f366c3 882923a8 ab962fdc ab963000 mouclass!MousePnP+0x13c
8a317af4 83c43473 00000000 8a317b8c 882923a8 nt!IovCallDriver+0x258
8a317b08 83de3edf 8e0bc6a8 8e06d380 8e0bc6a8 nt!IofCallDriver+0x1b
8a317b38 83dbab3d 8e0bc6a8 00000000 8e06d380 nt!IopSynchronousCall+0xc2
8a317b90 83c1bc3a 8e0bc6a8 00000002 aa251e00 nt!IopRemoveDevice+0xd4
8a317bbc 83dba951 00000016 aa251e00 00000000 nt!PnpRemoveLockedDeviceNode+0x16c
8a317bd0 83dba8b7 00000002 00000016 00000000 nt!PnpDeleteLockedDeviceNode+0x2d
8a317c04 83dba238 8e0bc6a8 aa251e00 00000002 nt!PnpDeleteLockedDeviceNodes+0x4c
8a317cc4 83dbc210 8a317cf4 00000000 96c0b008 nt!PnpProcessQueryRemoveAndEject+0x946
8a317cdc 83dbdd58 00000000 8e06dee8 89e00020 nt!PnpProcessTargetDeviceEvent+0x38
8a317d00 83c74f2b 8e06dee8 00000000 89e00020 nt!PnpDeviceEventWorker+0x216
8a317d50 83e1566d 00000001 a66e084e 00000000 nt!ExpWorkerThread+0x10d
8a317d90 83cc70d9 83c74e1e 00000001 00000000 nt!PspSystemThreadStartup+0x9e
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x19

STACK_COMMAND: kb

FOLLOWUP_IP:
mouclass!MouseClassRemoveDevice+3b
8eddbabb 6a02 push 2

SYMBOL_STACK_INDEX: 2

SYMBOL_NAME: mouclass!MouseClassRemoveDevice+3b

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: mouclass

IMAGE_NAME: mouclass.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 4a5bbf13

FAILURE_BUCKET_ID: 0xA_VRF_mouclass!MouseClassRemoveDevice+3b

BUCKET_ID: 0xA_VRF_mouclass!MouseClassRemoveDevice+3b

Followup: MachineOwner

2

xxxxx@hotmail.com wrote:

I use the WDK WinDDK\7600.16385.1\src\hid\hidusbfx2\sys “WDF” sample and modify the source code for my device.
But I got BSOD in DTM Test.
It seems that remove device issue.
I am a weaker WDF Driver.
Anybody know about the issue and show me the right-way.
And it had two BSOD issues -0X0000000A and 0x0000007F

Are you creating any of your own requests to send to other drivers? The
dump looks like the mouse class driver is trying to cancel all of its
outstanding IRPs as your device is being removed, but one of those IRPs
no longer exists or has been cleared out.

How extensive were your modifications?

–
Tim Roberts, xxxxx@probo.com
Providenza & Boekelheide, Inc.

3

Hi Tim Roberts
Thanks replay.
i am a beginner of driverdevelopment.
My Driver structure use the WDK sample “hidusbfx2”.
hidkmdf.sys–>hidusbfx2.sys -> TP device
HidFx2EvtUsbInterruptPipeReadComplete call WdfMemoryGetBuffer to get the device data
and send the device data into WdfRequestRetrieveOutputBuffer’s buffer.
ya, this dump come form the MS WLK1.5 -“Common Scenario stress With IO” test.
power manager, device pnp and disable\enable test.
I fixed the inf file to install the device into mouse class.
Class=MOUSE
ClassGuid={4d36e96f-e325-11ce-bfc1-08002be10318}.
What function of WDF’s structure i need to add for my driver when the mouse class cancel the device is removed to pass the WLK test?

4

xxxxx@hotmail.com wrote:

i am a beginner of driverdevelopment.
My Driver structure use the WDK sample “hidusbfx2”.
hidkmdf.sys–>hidusbfx2.sys -> TP device

I don’t know what a TP device is.

HidFx2EvtUsbInterruptPipeReadComplete call WdfMemoryGetBuffer to get the device data
and send the device data into WdfRequestRetrieveOutputBuffer’s buffer.
ya, this dump come form the MS WLK1.5 -“Common Scenario stress With IO” test.
power manager, device pnp and disable\enable test.
I fixed the inf file to install the device into mouse class.
Class=MOUSE
ClassGuid={4d36e96f-e325-11ce-bfc1-08002be10318}.
What function of WDF’s structure i need to add for my driver when the mouse class cancel the device is removed to pass the WLK test?

It’s up to you to know what kind of modifications you have made to the
sample. They key is that your driver needs to be able to clean itself
up when it gets a “remove” signal. There are strict rules to be
followed. You can just leave requests hanging around. They have to be
cleaned up.

–
Tim Roberts, xxxxx@probo.com
Providenza & Boekelheide, Inc.

5

TP Device means Touch pannel device.
I thought WDF structure have auto control the signal?
It seems to do some setting about clean up “remove” signal .
Can you suggest some WDF sample of WDK 7600.16385.1 about clean up “remove” signal ?

6

i change my KMDF Driver inf file
Class= MOUSE
ClassGuid= {4d36e96f-e325-11ce-bfc1-08002be10318}
to
Class=HIDClass
ClassGuid={745a17a0-74d3-11d0-b6fe-00a0c90f57da}
Then it can pass the WLK1.5 unclassfied test common scenario stress io test and have no blue Screen.
I guess that is because of the KMDF not support HIDclass Driver to mouse class.
When testing the mouse class send or get the “Wrong” IRP. I am not sure the in detail.
Thank a lot.