We have a serial port driver for usb device (usb 1.1 - CDC ACM modem) developed in KMDF very similar to usbser.sys with few modifications. This driver is used for different device hardwares with same usb configuration. The win2k bugcheck only occurs on few of those hardwares and not all of them and also only on W2k.
Here are steps with which this issue can be consistently reproduced:
- Use Hyperterminal to connect to the device (USB modem) and communicate. Close connection and leave hyperterminal open. Device is left connected.
- Sleep or hibernate and then resume.
- Open connection again in hyperterminal and the bugcheck occurs
Analyze -v output is attached. Looks like sending a usb control request urb down the stack causes this bugcheck. It doesnt matter how long I wait after resume, the bugcheck always occurs. If l leave the hyperterminal connection open, I am able to communicate after resuming, but the bugcheck occurs when I close the connection (similar control request is sent down).
Also, when the UHCI stack is bypassed by using a 2.0 hub, the bugcheck doesnt occur at all. So is this a bug in UHCD.sys ? Any idea what is going on here ?
Let me know if more information is required.
Thanks,
Bala
kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 00000071, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000000, value 0 = read operation, 1 = write operation
Arg4: eb2b167c, address which referenced memory
Debugging Details:
READ_ADDRESS: 00000071
CURRENT_IRQL: 2
FAULTING_IP:
uhcd!UHCD_URB_Dispatch+140
eb2b167c 3b4270 cmp eax,[edx+0x70]
DEFAULT_BUCKET_ID: DRIVER_FAULT
BUGCHECK_STR: 0xD1
LAST_CONTROL_TRANSFER: from eb2b167c to 80467df7
STACK_TEXT:
baf843f8 eb2b167c eb2c84e5 85b4c93c 00000000 nt!KiTrap0E+0x20b
baf84484 eb2b046e 85e81af0 00000001 85e81af0 uhcd!UHCD_URB_Dispatch+0x140
baf844b0 8041dded 85e81af0 85796d88 00000008 uhcd!UHCD_Dispatch+0x88
baf844c4 eb0c0539 eb0c1fd2 85796d88 85e81af0 nt!IopfCallDriver+0x35
baf844c8 eb0c1fd2 85796d88 85e81af0 85796d88 usbhub!USBH_PassIrp+0x15
baf844e4 eb0c228a 85e2ce28 85796d88 857f5b10 usbhub!USBH_PdoUrbFilter+0x64
baf84500 eb0c069a 00020a00 85796d88 baf84558 usbhub!USBH_PdoDispatch+0xd8
baf84510 8041dded 857f5b10 85796d88 bffde44a usbhub!USBH_HubDispatch+0x46
baf84524 bffde471 85ea2b88 bffde677 858269b0 nt!IopfCallDriver+0x35
baf8452c bffde677 858269b0 85796d88 858269b0 ACPI!ACPIDispatchForwardIrp+0x27
baf84558 8041dded 858269b0 85796d88 baf845a4 ACPI!ACPIDispatchIrp+0x123
baf8456c ba8e315c 00000000 7a950fe8 eb2e11e2 nt!IopfCallDriver+0x35
baf84580 eb2e1608 00000005 856de590 856af010 Wdf01000!imp_WdfRequestSend+0x3b7
baf845cc eb2e1812 85ad41c8 7a921a68 85752490 usbser2!SetControlLineState+0x114 [c:\usbser2\ioctl.c @ 1022]
baf84604 ba906ba4 7a8adb68 7a921a68 00000000 usbser2!EvtIoDeviceControl+0x1d0 [c:\usbser2\ioctl.c @ 520]
baf84628 ba907f7c 7a8adb68 7a921a68 00000000 Wdf01000!FxIoQueueIoDeviceControl::Invoke+0x30
baf84658 ba90a598 7a921a68 856de590 85752490 Wdf01000!FxIoQueue::DispatchRequestToDriver+0x445
baf84674 ba90bd2c 85752400 ba931188 85752490 Wdf01000!FxIoQueue::DispatchEvents+0x485
baf84690 ba90ce67 00000000 857685f0 85796d88 Wdf01000!FxIoQueue::QueueRequest+0x237
baf846b4 ba8ec705 85796d88 857685f0 0000000e Wdf01000!FxPkgIo::Dispatch+0x377
baf846cc eb2e0f65 85ad4000 7a52bff8 85796d88 Wdf01000!imp_WdfDeviceWdmDispatchPreprocessedIrp+0xf1
baf846ec ba8fb680 7a52bff8 85796d88 857685f0 usbser2!EvtPreprocessIoctl+0x9d [c:\usbser2\ioctl.c @ 202]
baf8470c ba8fbd4d 85796d88 baf84754 8041dded Wdf01000!FxDevice::PreprocessIrp+0x7b
baf84718 8041dded 857685f0 85796d88 85761c28 Wdf01000!FxDevice::Dispatch+0x32
baf8472c eb3121d6 00000001 85761c28 00040000 nt!IopfCallDriver+0x35
baf84754 eb3128e2 85761c28 00000001 85761c28 Modem!SetDtr+0x4a
baf84884 eb31227e 85761c28 85768b68 85761b70 Modem!UniOpenStarter+0x4a8
baf848a0 8041dded 00000000 85768b68 85768b78 Modem!UniOpen+0x56
baf848b4 804bfb28 804825a0 804bf06a baf84bb8 nt!IopfCallDriver+0x35
baf84a44 80450893 857f5b10 00000000 baf84afc nt!IopParseDevice+0xabe
baf84abc 804d5b3e 00000000 85ea1300 00000040 nt!ObpLookupObjectName+0x4e7
baf84bcc 8049fadd 00000000 00000000 019aee01 nt!ObOpenObjectByName+0xc8
baf84ca8 8049f682 019aef88 c0100080 019aef24 nt!IopCreateFile+0x407
baf84cf0 804a719a 019aef88 c0100080 019aef24 nt!IoCreateFile+0x36
baf84d30 80465014 019aef88 c0100080 019aef24 nt!NtCreateFile+0x2e
baf84d30 77f88283 019aef88 c0100080 019aef24 nt!KiSystemService+0xc4
019aeee4 7c58c588 019aef88 c0100080 019aef24 ntdll!NtCreateFile+0xb
019aef80 7c58c241 00000000 c0000000 00000003 KERNEL32!CreateFileW+0x343
019aefa4 66726d8e 019aefcc c0000000 00000003 KERNEL32!CreateFileA+0x2e
019af0d8 66726b17 00e12028 00000648 00000001 unimdmat!OpenDeviceHandle+0xa4
019af1fc 644ec1d4 6672c2e0 00000013 00000648 unimdmat!UmOpenModem+0x1d9
019af244 644ee466 019af80c 019af80c 00db2720 unimdm!CTspDev::mfn_LoadLLDev+0xe8
019af274 644e7dc4 0000000c 00000000 00000001 unimdm!CTspDev::mfn_OpenLLDev+0x5f
019af2a8 644ea50a 800c0000 00db2138 00000001 unimdm!CTspDev::mfn_TH_CallMakePassthroughCall+0x11f
019af2dc 644eb444 644f54f0 00db2118 00010188 unimdm!CTspDev::mfn_StartRootTask+0x109
019af318 644dc336 00020022 019af83c 019af860 unimdm!CTspDev::mfn_accept_tsp_call_for_HDRVLINE+0x616
019af3d8 644e2044 00000000 00020022 019af83c unimdm!CTspDev::AcceptTspCall+0x191
019af408 644e3383 00020022 019af83c 00000000 unimdm!tspSubmitTSPCallWithHDRVLINE+0x7b
019af864 66e00de4 00010188 00000000 00010177 unimdm!TSPI_lineMakeCall+0x7f
019af8c0 66e0c66c 00bb6ed8 00bb6aa8 00bb6c18 tapisrv!LMakeCall+0x16c
019af8e4 77d79290 000101dd 00bb6a68 000000b0 tapisrv!ClientRequest+0x8b
019af908 77d96aee 66e0c5e1 019afaac 00000004 RPCRT4!Invoke+0x30
019afd00 77d96486 00000000 00000000 000d4f98 RPCRT4!NdrStubCall2+0x664
019afd1c 77d543a6 000d4f98 0009f100 000d4f98 RPCRT4!NdrServerCall2+0x17
019afd54 77d393c3 66e12c5e 000d4f98 019afe00 RPCRT4!DispatchToStubInC+0x32
019afdac 77d39297 00000001 00000000 019afe00 RPCRT4!RPC_INTERFACE::DispatchToStubWorker+0x100
019afdcc 77d5ad3f 000d4f98 00000000 019afe00 RPCRT4!RPC_INTERFACE::DispatchToStub+0x5e
019afe04 77d59239 000cb780 0008d368 80060001 RPCRT4!LRPC_SCALL::DealWithRequestMessage+0x220
019afe28 77d5978e 000d4e98 019afe50 000cb780 RPCRT4!LRPC_ADDRESS::DealWithLRPCRequest+0x11b
019aff74 77d58e4a 77d3aeed 0008d368 ffffffff RPCRT4!LRPC_ADDRESS::ReceiveLotsaCalls+0x229
019aff78 77d3aeed 0008d368 ffffffff 00c7fa8c RPCRT4!RecvLotsaCallsWrapper+0x9
019affa8 77d37de8 000983b0 019affec 7c57b396 RPCRT4!BaseCachedThreadRoutine+0x4f
019affb4 7c57b396 00097ce8 ffffffff 00c7fa8c RPCRT4!ThreadStartRoutine+0x18
019affec 00000000 77d37dd0 00097ce8 00000000 KERNEL32!BaseThreadStart+0x52
STACK_COMMAND: .bugcheck ; kb
FOLLOWUP_IP:
uhcd!UHCD_URB_Dispatch+140
eb2b167c 3b4270 cmp eax,[edx+0x70]
FAULTING_SOURCE_CODE:
SYMBOL_STACK_INDEX: 1
FOLLOWUP_NAME: MachineOwner
SYMBOL_NAME: uhcd!UHCD_URB_Dispatch+140
MODULE_NAME: uhcd
IMAGE_NAME: uhcd.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 3e25ba6e
FAILURE_BUCKET_ID: 0xD1_uhcd!UHCD_URB_Dispatch+140
BUCKET_ID: 0xD1_uhcd!UHCD_URB_Dispatch+140
Followup: MachineOwner
kd> lm kv m uhcd
start end module name
eb2b0000 eb2b7f40 uhcd (pdb symbols) c:\websymbols\uhcd.pdb\3D5CE88C6\uhcd.pdb
Loaded symbol image file: c:\websymbols\uhcd.dbg\3E25BA6E7f40\uhcd.dbg
Image path: \SystemRoot\System32\DRIVERS\uhcd.sys
Image name: uhcd.sys
Timestamp: Wed Jan 15 13:45:50 2003 (3E25BA6E)
CheckSum: 00012D50
ImageSize: 00007F40
File version: 5.0.2195.6655
Product version: 5.0.2195.6655
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 2.0 Dll
File date: 00000000.00000000
Translations: 0409.04b0
CompanyName: Microsoft Corporation
ProductName: Microsoft(R) Windows (R) 2000 Operating System
InternalName: uhcd.sys
OriginalFilename: uhcd.sys
ProductVersion: 5.00.2195.6655
FileVersion: 5.00.2195.6655
FileDescription: Universal Host Controller Driver
LegalCopyright: Copyright (C) Microsoft Corp. 1981-1999