Quantcast
Viewing all articles
Browse latest Browse all 10386

Troubleshooting : Help pinpoint driver in IRQL_NOT_LESS_OR_EQUAL

Author: BSOD2600
Subject: Help pinpoint driver in IRQL_NOT_LESS_OR_EQUAL
Posted: 12 June 2013 at 5:54pm

In our environment, we've got a bunch of WinXP SP3 workstations which all exhibit the same BSOD signature (details below).  I'm fairly certain it's the Hypercom vendors old RS232ToUsb.sys driver as the cause, however I'm lacking definitive proof.

As the crash appears to be caused regarding USB transfers, and the only USB devices plugged in are HP keyboard, mice, and Hypercom signature capture devices.

The PCs have the latest Windows updates, Intel system/chipset drivers, and a range of BIOS revisions among the different hardware models.

All of the BSOD's have the same call stack as below.

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 000000e8, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000001, bitfield :
    bit 0 : value 0 = read operation, 1 = write operation
    bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: 80702a16, address which referenced memory

Debugging Details:
------------------


WRITE_ADDRESS:  000000e8

CURRENT_IRQL:  2

FAULTING_IP:
hal!KeAcquireInStackQueuedSpinLock+26
80702a16 8711            xchg    edx,dword ptr [ecx]

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  DRIVER_FAULT

BUGCHECK_STR:  0xA

PROCESS_NAME:  System

LAST_CONTROL_TRANSFER:  from 804e5cff to 80702a16

STACK_TEXT: 
b9d27bf0 804e5cff 89a3d710 89a3d6d0 00000000 hal!KeAcquireInStackQueuedSpinLock+0x26
b9d27c10 804f2cef 89a3d710 00000000 00000000 nt!KeInsertQueueApc+0x20
b9d27c44 b99c10d5 804e571c 8a0f0be0 8a66d028 nt!IopfCompleteRequest+0x1d8
b9d27cac b99c143d 8b028480 c0010000 804e571c USBPORT!USBPORT_CompleteTransfer+0x373
b9d27ce8 b99be7c3 8a66d0ec 804e571c 8a0f0be0 USBPORT!USBPORT_FlushCancelList+0x287
b9d27d10 b99c0b7c 8a66d028 804e571c 8a0f0be0 USBPORT!USBPORT_DmaEndpointWorker+0x1b9
b9d27d38 b99c45ea 8a66d028 00000002 8a66d028 USBPORT!USBPORT_CoreEndpointWorker+0x6d2
b9d27d7c b99bd1b0 8a66d028 00000000 8a402da0 USBPORT!USBPORT_Worker+0x212
b9d27dac 80576330 8a66d028 00000000 00000000 USBPORT!USBPORT_WorkerThread+0x12a
b9d27ddc 804ec259 b99bd086 8a66d028 00000000 nt!PspSystemThreadStartup+0x34
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16


STACK_COMMAND:  kb

FOLLOWUP_IP:
USBPORT!USBPORT_CompleteTransfer+373
b99c10d5 8a4dd7          mov     cl,byte ptr [ebp-29h]

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  USBPORT!USBPORT_CompleteTransfer+373

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: USBPORT

IMAGE_NAME:  USBPORT.SYS

DEBUG_FLR_IMAGE_TIMESTAMP:  480254ce

FAILURE_BUCKET_ID:  0xA_USBPORT!USBPORT_CompleteTransfer+373

BUCKET_ID:  0xA_USBPORT!USBPORT_CompleteTransfer+373

Followup: MachineOwner
---------

0: kd> lmvm rs232*
start    end        module name
a8b9d000 a8bb8780   RS232ToUsb   (deferred)            
    Image path: RS232ToUsb.sys
    Image name: RS232ToUsb.sys
    Timestamp:        Wed Aug 12 05:20:00 2009 (4A82B370)
    CheckSum:         0001DBB1
    ImageSize:        0001B780
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

0: kd> lmvm USBPORT
start    end        module name
b99b7000 b99da200   USBPORT    (pdb symbols)          c:\symbols\usbport.pdb\6E97B8D0ED8C4CA8B7BF1E0924887F551\usbport.pdb
    Loaded symbol image file: USBPORT.SYS
    Mapped memory image file: c:\symbols\USBPORT.SYS\480254CE23200\USBPORT.SYS
    Image path: USBPORT.SYS
    Image name: USBPORT.SYS
    Timestamp:        Sun Apr 13 11:45:34 2008 (480254CE)
    CheckSum:         0002AAEC
    ImageSize:        00023200
    File version:     5.1.2600.5512
    Product version:  5.1.2600.5512
    File flags:       0 (Mask 3F)
    File OS:          40004 NT Win32
    File type:        2.0 Dll
    File date:        00000000.00000000
    Translations:     0409.04b0
    CompanyName:      Microsoft Corporation
    ProductName:      Microsoft® Windows® Operating System
    InternalName:     usbport.sys
    OriginalFilename: usbport.sys
    ProductVersion:   5.1.2600.5512
    FileVersion:      5.1.2600.5512 (xpsp.080413-2108)
    FileDescription:  USB 1.1 & 2.0 Port Driver
    LegalCopyright:   © Microsoft Corporation. All rights reserved.



I doubt it's the Microsoft USBPORT driver.  I cannot take the shotgun approach and blanket upgrade the driver on all production workstations without definitive proof it's the root cause of these random BSODs.  They're random enough that if I did enable driver verification, I could be waiting for weeks before it could occur again on the same workstation.

What are some additional Windbg commands/techniques I can use to help pinpoint the root cause?

Viewing all articles
Browse latest Browse all 10386

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>