Hi,
My QA engineer reported a mysterious event ID that was generated supposedly
by my kernel driver.
The event ID is 54, and after browsing and re-checking my driver code, I
ascertained that we don’t have such error/warning code (Unless there is a
memory walk somewhere…).
Browsing the microsoft site I found in the link
http://support.microsoft.com/default.aspx?scid=kb;en-us;290312 some info
about this event.
The article claims that " This behavior occurs because the Windows Driver
Model (WDM) audio driver (Wdmaud.sys) does not provide an I/O Request Packet
(IRP) cancellation routine. "
I am a little confused by this message, does this mean that anyone who
doesn’t provide a canclletion routine for any IRP will get an error log
entry?Also, this is the first time I saw this message and my driver is
running for 3 years.
Regarding IRP cancellation, I am installing a cancel routine only for IOCTL
IRPs that are going to pend for an indefinite amount of time, for all other
IRPs, I am assuming that they are going to finish in a timely manner and I
am not setting a cancel routine for them.
Does anyone know what triggers this message?
Below is the event viewer message text.
Thanks,
Eran.
Here is the message:
Event Type: Warning
Event Source: TDPS_R2_2
Event Category: None
Event ID: 54
Date: 11/29/2005
Time: 3:56:46 AM
User: N/A
Computer: LAB-22
Description:
The description for Event ID ( 54 ) in Source ( TDPS_R2_2 ) cannot be found.
The local computer may not have the necessary registry information or
message DLL files to display messages from a remote computer. You may be
able to use the /AUXSOURCE= flag to retrieve this description; see Help and
Support for details. The following information is part of the event:
\Device\TDPS_R2_2.
Data:
0000: 00 00 00 00 01 00 5c 00 ….
0008: 00 00 00 00 36 00 04 80 …6…?
0010: 00 00 00 00 00 00 00 00 …
0018: 00 00 00 00 00 00 00 00 …
0020: 00 00 00 00 00 00 00 00 …