Doubt in !irpfind command output

NTDEV
1

Hi All

After entering following command
0: kd> !irpfind

…
9fdbd0d0 [89c452e8] irpStack: ( d, 0) 873e8418 [\FileSystem\Npfs]
9fdc7150 [00000000] irpStack: (16, 2) 850e5020 [\Driver\ACPI]
a3a31cc0 [89db5380] irpStack: ( 3, 0) 873e8418 [\FileSystem\Npfs]
…

What does thread [00000000] means?

Regards
Santosh K

2

My guess is that this is a driver created irp (IoAllocateIrp), which means it is not a threaded irp (http://blogs.msdn.com/doronh/archive/2006/07/27/681179.aspx)

d

From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of santosh katvate
Sent: Monday, November 17, 2008 10:34 PM
To: Windows System Software Devs Interest List
Subject: [ntdev] Doubt in !irpfind command output

Hi All

After entering following command
0: kd> !irpfind

…
9fdbd0d0 [89c452e8] irpStack: ( d, 0) 873e8418 [\FileSystem\Npfs]
9fdc7150 [00000000] irpStack: (16, 2) 850e5020 [\Driver\ACPI]
a3a31cc0 [89db5380] irpStack: ( 3, 0) 873e8418 [\FileSystem\Npfs]
…

What does thread [00000000] means?

Regards
Santosh K
— NTDEV is sponsored by OSR For our schedule of WDF, WDM, debugging and other seminars visit: http://www.osr.com/seminars To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

3

Hi Doran

Thanks for the earlier reply.
The power irp 9fdc7150 given below is stucked somewhere. And i think it is
sent by system for power down request.
How to get the stack dump that is executing above irp? As it has no thread
associated with it.

0: kd> !irp 9fdc7150
Irp is active with 3 stacks 2 is current (= 0x9fdc71e4)
No Mdl: No System Buffer: Thread 00000000: Irp stack trace.
cmd flg cl Device File Completion-Context
[0, 0] 0 0 00000000 00000000 00000000-00000000
Args: 00000000 00000000 00000000 00000000

[16, 2] 0 e1 850e5020 00000000 8211f143-a49603a8 Success Error Cancel
pending
\Driver\ACPI nt!PopSystemIrpCompletion
Args: 00051100 00000000 00000001 00000002
[0, 0] 0 0 00000000 00000000 00000000-a49603a8
Args: 00000000 00000000 00000000 00000000

On Tue, Nov 18, 2008 at 12:24 PM, Doron Holan wrote:

> My guess is that this is a driver created irp (IoAllocateIrp), which
> means it is not a threaded irp (
> http://blogs.msdn.com/doronh/archive/2006/07/27/681179.aspx)
>
> d
>
> From: xxxxx@lists.osr.com [mailto:
> xxxxx@lists.osr.com] *On Behalf Of *santosh katvate
> Sent: Monday, November 17, 2008 10:34 PM
> To: Windows System Software Devs Interest List
> Subject: [ntdev] Doubt in !irpfind command output
>
> Hi All
>
> After entering following command
>
> 0: kd> !irpfind
>
> …
>
> 9fdbd0d0 [89c452e8] irpStack: ( d, 0) 873e8418 [\FileSystem\Npfs]
> 9fdc7150 [00000000] irpStack: (16, 2) 850e5020 [\Driver\ACPI]
> a3a31cc0 [89db5380] irpStack: ( 3, 0) 873e8418 [\FileSystem\Npfs]
>
> …
>
> What does thread [00000000] means?
>
> Regards
>
> Santosh K
>