Hi,
I am developing Usb driver using wdf. Getting the following error, during completion write routine i.e WdfRequestUnmarkCancelable.
Even before start write i set as mark (WdfRequestmarkCancelable).
*** Fatal System Error: 0x000000be
(0xF7365BDC,0x16C37121,0xF8AC5DD0,0x0000000A)
Driver at fault:
*** wdf01000.sys - Address F73323F5 base at F730D000, DateStamp 4a5bbf28
.
WARNING: This break is not a step/trace completion.
The last command has been cleared to prevent
accidental continuation of this unrelated event.
Check the event, location and thread before resuming.
Break instruction exception - code 80000003 (first chance)
A fatal system error has occurred.
Debugger entered on first try; Bugcheck callbacks have not been invoked.
A fatal system error has occurred.
Connected to Windows XP 2600 x86 compatible target at (Mon Nov 22 16:25:05.609 2010 (UTC + 5:30)), ptr64 FALSE
Loading Kernel Symbols
…
…
Loading User Symbols
…
Loading unloaded module list
…
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck BE, {f7365bdc, 16c37121, f8ac5dd0, a}
Probably caused by : PLP2KUS.sys ( PLP2KUS!WdfRequestUnmarkCancelable+16 )
Followup: MachineOwner
nt!RtlpBreakWithStatusInstruction:
80527bdc cc int 3
kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
ATTEMPTED_WRITE_TO_READONLY_MEMORY (be)
An attempt was made to write to readonly memory. The guilty driver is on the
stack trace (and is typically the current instruction pointer).
When possible, the guilty driver’s name (Unicode string) is printed on
the bugcheck screen and saved in KiBugCheckDriver.
Arguments:
Arg1: f7365bdc, Virtual address for the attempted write.
Arg2: 16c37121, PTE contents.
Arg3: f8ac5dd0, (reserved)
Arg4: 0000000a, (reserved)
Debugging Details:
DEFAULT_BUCKET_ID: DRIVER_FAULT
BUGCHECK_STR: 0xBE
PROCESS_NAME: ddl.exe
TRAP_FRAME: f8ac5dd0 – (.trap 0xfffffffff8ac5dd0)
ErrCode = 00000003
eax=82183c00 ebx=00000000 ecx=820de490 edx=820a2038 esi=f7365bdc edi=82183ba8
eip=f73323f5 esp=f8ac5e44 ebp=f8ac5e48 iopl=0 nv up ei ng nz ac pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010296
wdf01000!FxIrpQueue::RemoveIrpFromListEntry+0x11:
f73323f5 8916 mov dword ptr [esi],edx ds:0023:f7365bdc={wdf01000!FxRequestOutputBuffer::GetBuffer (f73394ba)}
Resetting default scope
LAST_CONTROL_TRANSFER: from 804f7b9d to 80527bdc
STACK_TEXT:
f8ac590c 804f7b9d 00000003 f8ac5c68 00000000 nt!RtlpBreakWithStatusInstruction
f8ac5958 804f878a 00000003 00000080 c07b9b28 nt!KiBugCheckDebugBreak+0x19
f8ac5d38 804f8cb5 000000be f7365bdc 16c37121 nt!KeBugCheck2+0x574
f8ac5d58 8051cc4f 000000be f7365bdc 16c37121 nt!KeBugCheckEx+0x1b
f8ac5db8 8054051c 00000001 f7365bdc 00000001 nt!MmAccessFault+0x8e7
f8ac5db8 f73323f5 00000001 f7365bdc 00000001 nt!KiTrap0E+0xcc
f8ac5e48 f7332515 82183ba8 81ef6438 82183b70 wdf01000!FxIrpQueue::RemoveIrpFromListEntry+0x11
f8ac5e5c f732d4ef 82183ba8 820de418 82183b70 wdf01000!FxIrpQueue::RemoveIrpFromQueueByContext+0x22
f8ac5e70 f733e992 820de490 7de7c488 81ef6438 wdf01000!FxRequest::RemoveFromIrpQueue+0x18
f8ac5e90 f732239b 82183b02 00000000 00000000 wdf01000!FxIoQueue::RequestCancelable+0x1f3
f8ac5eb4 f76e1d86 82183b70 00000000 f8ac5ee8 wdf01000!imp_WdfRequestUnmarkCancelable+0xc1
f8ac5ec4 f76e1ca9 7de7c488 ffdff000 f8ac5ee8 PLP2KUS!WdfRequestUnmarkCancelable+0x16 [c:\winddk\7600.16385.1\inc\wdf\kmdf\1.9\wdfrequest.h @ 775]
f8ac5ee8 f76e0976 7de7c488 00000001 00000000 PLP2KUS!UsbClearCancelRoutine+0x49 [d:\project\veri\code\verixwdfwrite\t_ioctl.c @ 421]
f8ac5f3c f76e0bed 81dc2d18 00000000 7dea7668 PLP2KUS!UsbRundownIrpRefs+0x96 [d:\project\veri\code\verixwdfwrite\utils.c @ 464]
f8ac5f74 f76e6928 81dc2c60 00000000 00000000 PLP2KUS!UsbTryToCompleteCurrent+0xcd [d:\project\veri\code\verixwdfwrite\utils.c @ 594]
f8ac5fa8 f73392d3 7dd148b0 00000000 822eb702 PLP2KUS!UsbCompleteWrite+0x68 [d:\project\veri\code\verixwdfwrite\write.c @ 243]
f8ac5fbc f7339311 822eb780 00000000 00000000 wdf01000!FxDpc::DpcHandler+0x36
f8ac5fd0 80541b8d 822eb780 822eb748 00000000 wdf01000!FxDpc::FxDpcThunk+0x16
f8ac5ff4 8054185a f7bfcb0c 00000000 00000000 nt!KiRetireDpcList+0x46
f8ac5ff8 f7bfcb0c 00000000 00000000 00000000 nt!KiDispatchInterrupt+0x2a
WARNING: Frame IP not in any known module. Following frames may be wrong.
8054185a 00000000 00000009 bb835675 00000128 0xf7bfcb0c
STACK_COMMAND: kb
FOLLOWUP_IP:
PLP2KUS!WdfRequestUnmarkCancelable+16 [c:\winddk\7600.16385.1\inc\wdf\kmdf\1.9\wdfrequest.h @ 775]
f76e1d86 5d pop ebp
FAULTING_SOURCE_CODE:
771: WDFREQUEST Request
772: )
773: {
774: return ((PFN_WDFREQUESTUNMARKCANCELABLE) WdfFunctions[WdfRequestUnmarkCancelableTableIndex])(WdfDriverGlobals, Request);
775: }
776:
777: //
778: // WDF Function: WdfRequestIsCanceled
779: //
780: typedef
SYMBOL_STACK_INDEX: b
SYMBOL_NAME: PLP2KUS!WdfRequestUnmarkCancelable+16
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: PLP2KUS
IMAGE_NAME: PLP2KUS.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 4cea484a
FAILURE_BUCKET_ID: 0xBE_PLP2KUS!WdfRequestUnmarkCancelable+16
BUCKET_ID: 0xBE_PLP2KUS!WdfRequestUnmarkCancelable+16