Hi, All,
My driver got BSOD while the device is resetting. The dump file for me looks
like the driver was unloaded but I/O manager still try to call my driver’s
DispatchPnP
routine. How could that happen? Any ideas to debug it?
My device is a cardbus card with a USB controller.
1: kd> !analyze -v
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************
DRIVER_UNLOADED_WITHOUT_CANCELLING_PENDING_OPERATIONS (ce)
A driver unloaded without cancelling timers, DPCs, worker threads, etc.
The broken driver’s name is displayed on the screen.
Arguments:
Arg1: b405c5f0, memory referenced
Arg2: 00000000, value 0 = read operation, 1 = write operation
Arg3: b405c5f0, If non-zero, the instruction address which referenced the
bad memory
address.
Arg4: 00000000, Mm internal code.
Debugging Details:
*** Error in in reading nt!_ETHREAD @ 00000000
*** Error in in reading nt!_ETHREAD @ 00000000
*** Error in in reading nt!_ETHREAD @ 00000000
READ_ADDRESS: b405c5f0
FAULTING_IP:
swumx20+65f0
b405c5f0 ?? ???
DEFAULT_BUCKET_ID: DRIVER_FAULT
BUGCHECK_STR: 0xCE
LOCK_ADDRESS: 80560560 – (!locks 80560560)
Resource @ nt!IopDeviceTreeLock (0x80560560) Shared 1 owning threads
Contention Count = 81
Threads: 8a3fe3c8-01<*>
1 total locks, 1 locks currently held
PNP_TRIAGE:
Lock address : 0x80560560
Thread Count : 1
Thread address: 0x8a3fe3c8
Thread wait : 0x1dc35
IP_MODULE_UNLOADED:
devdriver+65f0
b405c5f0 ?? ???
LAST_CONTROL_TRANSFER: from 80528ef8 to 805371aa
FAILED_INSTRUCTION_ADDRESS:
devdriver+65f0
b405c5f0 ?? ???
STACK_TEXT:
f78eeacc 80528ef8 00000050 b405c5f0 00000000 nt!KeBugCheckEx+0x1b
f78eeb1c 804e0944 00000000 b405c5f0 00000000 nt!MmAccessFault+0x77e
f78eeb1c b405c5f0 00000000 b405c5f0 00000000 nt!KiTrap0E+0xd0
WARNING: Frame IP not in any known module. Following frames may be wrong.
f78eeba4 804e13d9 89655028 8a1d5650 f78eec30 <unloaded_devdriver.sys>+0x65f0
; This is my driver’s DispatchPnP routine
f78eebb4 8059e86e 8983faa8 8983faa8 00000002 nt!IopfCallDriver+0x31
f78eebe0 805aa766 89655028 f78eec0c 00000000 nt!IopSynchronousCall+0xb7
f78eec34 8050e5a9 8983faa8 00000002 00000000 nt!IopRemoveDevice+0x93
f78eec5c 805ab78e e2c93858 0000001f e2f2e2d8
nt!IopRemoveLockedDeviceNode+0x160
f78eec74 805aaa3c 897c43b0 00000002 e2f2e2d8
nt!IopDeleteLockedDeviceNode+0x34
f78eeca8 805f7114 8983faa8 02f2e2d8 00000002
nt!IopDeleteLockedDeviceNodes+0x3f
f78eed3c 805aad99 f78eed78 806ff974 e3abf228
nt!PiProcessQueryRemoveAndEject+0x76b
f78eed58 805a018f f78eed78 89d95828 805694fc
nt!PiProcessTargetDeviceEvent+0x2a
f78eed7c 804e23b5 89d95828 00000000 8a3fe3c8 nt!PiWalkDeviceList+0x122
f78eedac 80574128 89d95828 00000000 00000000 nt!ExpWorkerThread+0xef
f78eeddc 804efc81 804e22f1 00000001 00000000 nt!PspSystemThreadStartup+0x34
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16
STACK_COMMAND: .bugcheck ; kb
FOLLOWUP_IP:
devdriver+65f0
b405c5f0 ?? ???
FAULTING_SOURCE_CODE:
SYMBOL_STACK_INDEX: 3
FOLLOWUP_NAME: MachineOwner
SYMBOL_NAME: devdriver+65f0
MODULE_NAME: devdriver
IMAGE_NAME: devdriver.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 0
FAILURE_BUCKET_ID: 0xCE_BAD_IP_devdriver+65f0
BUCKET_ID: 0xCE_BAD_IP_devdriver+65f0
Followup: MachineOwner
---------</unloaded_devdriver.sys>