A user has just supplied me with the debugger output for a BugCheck 9F,
{4, 258, 84ef4580, 0}, but I can’t see a definition for parameter1 == 4,
and the docs make reference to ‘these errors are superseded by the
Driver Verifier tests’… any suggestions as to how to approach this?
According to the user he is testing under Vista.
Thanks
James
I have obtained the crash dump and run it through the debugger:
Microsoft (R) Windows Debugger Version 6.10.0003.233 X86
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Downloads\MEMORY.DMP]
Kernel Summary Dump File: Only kernel address space is available
Symbol search path is:
SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols;c:\Projects
\win-pvdrivers.hg\xenpci\objchk_wlh_x86\i386;c:\Projects\win-pvdrivers.h
g\xenvbd\objchk_wlh_x86\i386;c:\Projects\win-pvdrivers.hg\xennet\objchk_
wlh_x86\i386;c:\Projects\win-pvdrivers.hg\xenpci\objchk_wnet_x86\i386;c:
\Projects\win-pvdrivers.hg\xenvbd\objchk_wnet_x86\i386;c:\Projects\win-p
vdrivers.hg\xennet\objchk_wnet_x86\i386;c:\Projects\win-pvdrivers.hg\xen
pci\objchk_wxp_x86\i386;c:\Projects\win-pvdrivers.hg\xenvbd\objchk_wxp_x
86\i386;c:\Projects\win-pvdrivers.hg\xennet\objchk_wxp_x86\i386
Executable search path is:
Windows 7 Kernel Version 6002 (Service Pack 2) MP (4 procs) Free x86
compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 6002.18005.x86fre.lh_sp2rtm.090410-1830
Machine Name:
Kernel base = 0x82045000 PsLoadedModuleList = 0x8215cc70
Debug session time: Thu May 21 00:41:15.725 2009 (GMT+10)
System Uptime: 0 days 1:51:20.442
Loading Kernel Symbols
...............................................................
................................................................
.....................
Loading User Symbols
Loading unloaded module list
.....
************************************************************************
*******
*
*
* Bugcheck Analysis
*
*
*
************************************************************************
*******
Use !analyze -v to get detailed debugging information.
BugCheck 9F, {4, 258, 84ef4580, 0}
Could not read faulting driver name
Probably caused by : ntkrpamp.exe (
nt!PopBuildDeviceNotifyListWatchdog+34 )
0: kd> !analyze -v
************************************************************************
*******
*
*
* Bugcheck Analysis
*
*
*
************************************************************************
*******
DRIVER_POWER_STATE_FAILURE (9f)
A driver is causing an inconsistent power state.
Arguments:
Arg1: 00000004, The power transition timed out waiting to synchronize
with the Pnp
subsystem.
Arg2: 00000258, Timeout in seconds.
Arg3: 84ef4580
Arg4: 00000000
Could not read faulting driver name
DRVPOWERSTATE_SUBCODE: 4
DEVICE_OBJECT: 84ef4580
DRIVER_OBJECT: 84ef4588
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0x9F
PROCESS_NAME: System
CURRENT_IRQL: 2
LAST_CONTROL_TRANSFER: from 8231e096 to 82112b0d
STACK_TEXT:
8213ab4c 8231e096 0000009f 00000004 00000258 nt!KeBugCheckEx+0x1e
8213ab68 820ef2eb 8ea80a10 8ea80a00 0775f51c
nt!PopBuildDeviceNotifyListWatchdog+0x34
8213ac88 820eef21 8213acd0 8213ad02 8213acd8 nt!KiTimerListExpire+0x367
8213ace8 820ef615 00000000 00000000 0006861b nt!KiTimerExpiration+0x2a0
8213ad50 820ed87d 00000000 0000000e 00000000 nt!KiRetireDpcList+0xba
8213ad54 00000000 0000000e 00000000 00000000 nt!KiIdleLoop+0x49
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!PopBuildDeviceNotifyListWatchdog+34
8231e096 cc int 3
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt!PopBuildDeviceNotifyListWatchdog+34
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrpamp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 49e0199e
FAILURE_BUCKET_ID: 0x9F_nt!PopBuildDeviceNotifyListWatchdog+34
BUCKET_ID: 0x9F_nt!PopBuildDeviceNotifyListWatchdog+34
-----Original Message-----
From: xxxxx@lists.osr.com [mailto:bounce-367025-
xxxxx@lists.osr.com] On Behalf Of James Harper
Sent: Thursday, 21 May 2009 09:18
To: Windows System Software Devs Interest List
Subject: [ntdev] BugCheck 9F, {4, 258, 84ef4580, 0}A user has just supplied me with the debugger output for a BugCheck
9F,
{4, 258, 84ef4580, 0}, but I can't see a definition for parameter1 ==
4,
and the docs make reference to 'these errors are superseded by the
Driver Verifier tests'... any suggestions as to how to approach this?According to the user he is testing under Vista.
Thanks
James
NTDEV is sponsored by OSR
For our schedule of WDF, WDM, debugging and other seminars visit:
OSR Seminars – OSRTo unsubscribe, visit the List Server section of OSR Online at
ListServer/Forum
> According to the user he is testing under Vista.
What? Windows 7 service pack 2??
– pa
James Harper wrote:
I have obtained the crash dump and run it through the debugger:
Microsoft (R) Windows Debugger Version 6.10.0003.233 X86
Copyright (c) Microsoft Corporation. All rights reserved.Loading Dump File [C:\Downloads\MEMORY.DMP]
Kernel Summary Dump File: Only kernel address space is availableSymbol search path is:
SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols;c:\Projects
\win-pvdrivers.hg\xenpci\objchk_wlh_x86\i386;c:\Projects\win-pvdrivers.h
g\xenvbd\objchk_wlh_x86\i386;c:\Projects\win-pvdrivers.hg\xennet\objchk_
wlh_x86\i386;c:\Projects\win-pvdrivers.hg\xenpci\objchk_wnet_x86\i386;c:
\Projects\win-pvdrivers.hg\xenvbd\objchk_wnet_x86\i386;c:\Projects\win-p
vdrivers.hg\xennet\objchk_wnet_x86\i386;c:\Projects\win-pvdrivers.hg\xen
pci\objchk_wxp_x86\i386;c:\Projects\win-pvdrivers.hg\xenvbd\objchk_wxp_x
86\i386;c:\Projects\win-pvdrivers.hg\xennet\objchk_wxp_x86\i386
Executable search path is:
Windows 7 Kernel Version 6002 (Service Pack 2) MP (4 procs) Free x86
compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 6002.18005.x86fre.lh_sp2rtm.090410-1830
Machine Name:
Kernel base = 0x82045000 PsLoadedModuleList = 0x8215cc70
Run !poaction and then !irp on each of the outstanding power irps (ignore wait wake) it lists. Rune !devstack on a devobj listed by each irp and then start hunting for device stacks (!stacks 1) to see if you have a suspicious binary match
d
Sent from my phone with no t9, all spilling mistakes are not intentional.
-----Original Message-----
From: James Harper
Sent: Thursday, May 21, 2009 2:30 AM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] BugCheck 9F, {4, 258, 84ef4580, 0}
I have obtained the crash dump and run it through the debugger:
Microsoft (R) Windows Debugger Version 6.10.0003.233 X86
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Downloads\MEMORY.DMP]
Kernel Summary Dump File: Only kernel address space is available
Symbol search path is:
SRVc:\websymbolshttp://msdl.microsoft.com/download/symbols;c:\Projects
\win-pvdrivers.hg\xenpci\objchk_wlh_x86\i386;c:\Projects\win-pvdrivers.h
g\xenvbd\objchk_wlh_x86\i386;c:\Projects\win-pvdrivers.hg\xennet\objchk_
wlh_x86\i386;c:\Projects\win-pvdrivers.hg\xenpci\objchk_wnet_x86\i386;c:
\Projects\win-pvdrivers.hg\xenvbd\objchk_wnet_x86\i386;c:\Projects\win-p
vdrivers.hg\xennet\objchk_wnet_x86\i386;c:\Projects\win-pvdrivers.hg\xen
pci\objchk_wxp_x86\i386;c:\Projects\win-pvdrivers.hg\xenvbd\objchk_wxp_x
86\i386;c:\Projects\win-pvdrivers.hg\xennet\objchk_wxp_x86\i386
Executable search path is:
Windows 7 Kernel Version 6002 (Service Pack 2) MP (4 procs) Free x86
compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 6002.18005.x86fre.lh_sp2rtm.090410-1830
Machine Name:
Kernel base = 0x82045000 PsLoadedModuleList = 0x8215cc70
Debug session time: Thu May 21 00:41:15.725 2009 (GMT+10)
System Uptime: 0 days 1:51:20.442
Loading Kernel Symbols
…
…
…
Loading User Symbols
Loading unloaded module list
…
***********************************************************
Bugcheck Analysis
*****************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 9F, {4, 258, 84ef4580, 0}
Could not read faulting driver name
Probably caused by : ntkrpamp.exe (
nt!PopBuildDeviceNotifyListWatchdog+34 )
Followup: MachineOwner
---------
0: kd> !analyze -v
***********************************************************
Bugcheck Analysis
*****************************************************************
DRIVER_POWER_STATE_FAILURE (9f)
A driver is causing an inconsistent power state.
Arguments:
Arg1: 00000004, The power transition timed out waiting to synchronize
with the Pnp
subsystem.
Arg2: 00000258, Timeout in seconds.
Arg3: 84ef4580
Arg4: 00000000
Debugging Details:
------------------
Could not read faulting driver name
DRVPOWERSTATE_SUBCODE: 4
DEVICE_OBJECT: 84ef4580
DRIVER_OBJECT: 84ef4588
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0x9F
PROCESS_NAME: System
CURRENT_IRQL: 2
LAST_CONTROL_TRANSFER: from 8231e096 to 82112b0d
STACK_TEXT:
8213ab4c 8231e096 0000009f 00000004 00000258 nt!KeBugCheckEx+0x1e
8213ab68 820ef2eb 8ea80a10 8ea80a00 0775f51c
nt!PopBuildDeviceNotifyListWatchdog+0x34
8213ac88 820eef21 8213acd0 8213ad02 8213acd8 nt!KiTimerListExpire+0x367
8213ace8 820ef615 00000000 00000000 0006861b nt!KiTimerExpiration+0x2a0
8213ad50 820ed87d 00000000 0000000e 00000000 nt!KiRetireDpcList+0xba
8213ad54 00000000 0000000e 00000000 00000000 nt!KiIdleLoop+0x49
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!PopBuildDeviceNotifyListWatchdog+34
8231e096 cc int 3
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt!PopBuildDeviceNotifyListWatchdog+34
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrpamp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 49e0199e
FAILURE_BUCKET_ID: 0x9F_nt!PopBuildDeviceNotifyListWatchdog+34
BUCKET_ID: 0x9F_nt!PopBuildDeviceNotifyListWatchdog+34
Followup: MachineOwner
---------
> -----Original Message-----
> From: xxxxx@lists.osr.com [mailto:bounce-367025-
> xxxxx@lists.osr.com] On Behalf Of James Harper
> Sent: Thursday, 21 May 2009 09:18
> To: Windows System Software Devs Interest List
> Subject: [ntdev] BugCheck 9F, {4, 258, 84ef4580, 0}
>
> A user has just supplied me with the debugger output for a BugCheck
9F,
> {4, 258, 84ef4580, 0}, but I can’t see a definition for parameter1 ==
4,
> and the docs make reference to ‘these errors are superseded by the
> Driver Verifier tests’… any suggestions as to how to approach this?
>
> According to the user he is testing under Vista.
>
> Thanks
>
> James
>
>
> —
> NTDEV is sponsored by OSR
>
> For our schedule of WDF, WDM, debugging and other seminars visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer
—
NTDEV is sponsored by OSR
For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars
To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer
In addition, list all threads in the system (!process 0 7) and you can
find blocked one with your driver on the stack waiting for PO IRP
completion (depends on driver design).
It is unfortunately not uncommon problem. We encounetered it rather
often when doing stress tests with USB devices when selective suspend
and surprise removal were involved. Some were OS bugs and some of them
are already fixed in SP1 and hotfixes.
Best regards,
Michal Vodicka
UPEK, Inc.
[xxxxx@upek.com, http://www.upek.com]
-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Doron Holan
Sent: Thursday, May 21, 2009 3:15 PM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] BugCheck 9F, {4, 258, 84ef4580, 0}Run !poaction and then !irp on each of the outstanding power
irps (ignore wait wake) it lists. Rune !devstack on a devobj
listed by each irp and then start hunting for device stacks
(!stacks 1) to see if you have a suspicious binary matchd
Sent from my phone with no t9, all spilling mistakes are not
intentional.-----Original Message-----
From: James Harper
> Sent: Thursday, May 21, 2009 2:30 AM
> To: Windows System Software Devs Interest List
> Subject: RE: [ntdev] BugCheck 9F, {4, 258, 84ef4580, 0}
>
> I have obtained the crash dump and run it through the debugger:
>
>
> Microsoft (R) Windows Debugger Version 6.10.0003.233 X86
> Copyright (c) Microsoft Corporation. All rights reserved.
>
>
> Loading Dump File [C:\Downloads\MEMORY.DMP]
> Kernel Summary Dump File: Only kernel address space is available
>
> Symbol search path is:
> SRVc:\websymbolshttp://msdl.microsoft.com/download/symbols;c
> :\Projects
> \win-pvdrivers.hg\xenpci\objchk_wlh_x86\i386;c:\Projects\win-p
> vdrivers.h
> g\xenvbd\objchk_wlh_x86\i386;c:\Projects\win-pvdrivers.hg\xenn
> et\objchk_
> wlh_x86\i386;c:\Projects\win-pvdrivers.hg\xenpci\objchk_wnet_x
> 86\i386;c:
> \Projects\win-pvdrivers.hg\xenvbd\objchk_wnet_x86\i386;c:\Proj
> ects\win-p
> vdrivers.hg\xennet\objchk_wnet_x86\i386;c:\Projects\win-pvdriv
> ers.hg\xen
> pci\objchk_wxp_x86\i386;c:\Projects\win-pvdrivers.hg\xenvbd\ob
> jchk_wxp_x
> 86\i386;c:\Projects\win-pvdrivers.hg\xennet\objchk_wxp_x86\i386
> Executable search path is:
> Windows 7 Kernel Version 6002 (Service Pack 2) MP (4 procs) Free x86
> compatible
> Product: WinNt, suite: TerminalServer SingleUserTS
> Built by: 6002.18005.x86fre.lh_sp2rtm.090410-1830
> Machine Name:
> Kernel base = 0x82045000 PsLoadedModuleList = 0x8215cc70
> Debug session time: Thu May 21 00:41:15.725 2009 (GMT+10)
> System Uptime: 0 days 1:51:20.442
> Loading Kernel Symbols
> …
> …
> …
> Loading User Symbols
>
> Loading unloaded module list
> …
> **
>
>
>
>
> * Bugcheck Analysis
>
>
>
>
> ***
>
>
> Use !analyze -v to get detailed debugging information.
>
> BugCheck 9F, {4, 258, 84ef4580, 0}
>
>
> Could not read faulting driver name
> Probably caused by : ntkrpamp.exe (
> nt!PopBuildDeviceNotifyListWatchdog+34 )
>
> Followup: MachineOwner
> ---------
>
> 0: kd> !analyze -v
> **
>
>
>
>
> * Bugcheck Analysis
>
>
>
>
> ***
>
>
> DRIVER_POWER_STATE_FAILURE (9f)
> A driver is causing an inconsistent power state.
> Arguments:
> Arg1: 00000004, The power transition timed out waiting to synchronize
> with the Pnp
> subsystem.
> Arg2: 00000258, Timeout in seconds.
> Arg3: 84ef4580
> Arg4: 00000000
>
> Debugging Details:
> ------------------
>
>
> Could not read faulting driver name
>
> DRVPOWERSTATE_SUBCODE: 4
>
> DEVICE_OBJECT: 84ef4580
>
> DRIVER_OBJECT: 84ef4588
>
> DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
>
> BUGCHECK_STR: 0x9F
>
> PROCESS_NAME: System
>
> CURRENT_IRQL: 2
>
> LAST_CONTROL_TRANSFER: from 8231e096 to 82112b0d
>
> STACK_TEXT:
> 8213ab4c 8231e096 0000009f 00000004 00000258 nt!KeBugCheckEx+0x1e
> 8213ab68 820ef2eb 8ea80a10 8ea80a00 0775f51c
> nt!PopBuildDeviceNotifyListWatchdog+0x34
> 8213ac88 820eef21 8213acd0 8213ad02 8213acd8
> nt!KiTimerListExpire+0x367
> 8213ace8 820ef615 00000000 00000000 0006861b
> nt!KiTimerExpiration+0x2a0
> 8213ad50 820ed87d 00000000 0000000e 00000000 nt!KiRetireDpcList+0xba
> 8213ad54 00000000 0000000e 00000000 00000000 nt!KiIdleLoop+0x49
>
>
> STACK_COMMAND: kb
>
> FOLLOWUP_IP:
> nt!PopBuildDeviceNotifyListWatchdog+34
> 8231e096 cc int 3
>
> SYMBOL_STACK_INDEX: 1
>
> SYMBOL_NAME: nt!PopBuildDeviceNotifyListWatchdog+34
>
> FOLLOWUP_NAME: MachineOwner
>
> MODULE_NAME: nt
>
> IMAGE_NAME: ntkrpamp.exe
>
> DEBUG_FLR_IMAGE_TIMESTAMP: 49e0199e
>
> FAILURE_BUCKET_ID: 0x9F_nt!PopBuildDeviceNotifyListWatchdog+34
>
> BUCKET_ID: 0x9F_nt!PopBuildDeviceNotifyListWatchdog+34
>
> Followup: MachineOwner
> ---------
>
>
> > -----Original Message-----
> > From: xxxxx@lists.osr.com [mailto:bounce-367025-
> > xxxxx@lists.osr.com] On Behalf Of James Harper
> > Sent: Thursday, 21 May 2009 09:18
> > To: Windows System Software Devs Interest List
> > Subject: [ntdev] BugCheck 9F, {4, 258, 84ef4580, 0}
> >
> > A user has just supplied me with the debugger output for a BugCheck
> 9F,
> > {4, 258, 84ef4580, 0}, but I can’t see a definition for
> parameter1 ==
> 4,
> > and the docs make reference to ‘these errors are superseded by the
> > Driver Verifier tests’… any suggestions as to how to
> approach this?
> >
> > According to the user he is testing under Vista.
> >
> > Thanks
> >
> > James
> >
> >
> > —
> > NTDEV is sponsored by OSR
> >
> > For our schedule of WDF, WDM, debugging and other seminars visit:
> > http://www.osr.com/seminars
> >
> > To unsubscribe, visit the List Server section of OSR Online at
> > http://www.osronline.com/page.cfm?name=ListServer
>
> —
> NTDEV is sponsored by OSR
>
> For our schedule of WDF, WDM, debugging and other seminars visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online
> at http://www.osronline.com/page.cfm?name=ListServer
>
>
> —
> NTDEV is sponsored by OSR
>
> For our schedule of WDF, WDM, debugging and other seminars visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online
> at http://www.osronline.com/page.cfm?name=ListServer
>