I’m just analyzing a crashdump. There is a deadlock and my code is waiting for an event. I’d like to know how long it waits. Following thread fields are promising:
THREAD 81bc9aa8 Cid 0004.0014 Teb: 00000000 Win32Thread: 00000000 WAIT: (Executive) KernelMode Non-Alertable
f9e6ccf8 NotificationEvent
Not impersonating
DeviceMap e1001090
Owning Process 81bcc660
Wait Start TickCount 14793 Elapsed Ticks: 49135
but I’m not sure what these numbers exactly mean. The suspicious things is most worker threads display exactly the same numbers. Above thread is also one of them and was used to process a callback. However, I don’t believe waiting for the event started in the same tick as other worker threads started waiting for a request. WinDbg docs doesn’t explain it. Does anybody know what these numbers mean? And if there is a way how to find correct waiting time?
BTW (symbol server is correctly set and all symbols were downloaded so message is bogus):
kd> !threadfields
ETHREAD structure offsets: (use ‘dt ETHREAD’)
kd> dt ETHREAD
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: ETHREAD ***
*** ***
*************************************************************************
Symbol ETHREAD not found.
Best regards,
Michal Vodicka
UPEK, Inc.
[xxxxx@upek.com, http://www.upek.com]
> kd> dt ETHREAD
should be kd>dt _ETHREAD
Calvin Guan Software Engineer
ATI Technologies Inc. www.ati.com
-----Original Message-----
From: Michal Vodicka [mailto:xxxxx@upek.com]
Sent: Tuesday, August 31, 2004 6:38 PM
To: Windows System Software Devs Interest List
Subject: [ntdev] Wait Start TickCount?
I’m just analyzing a crashdump. There is a deadlock and my
code is waiting for an event. I’d like to know how long it
waits. Following thread fields are promising:
THREAD 81bc9aa8 Cid 0004.0014 Teb: 00000000 Win32Thread:
00000000 WAIT: (Executive) KernelMode Non-Alertable
f9e6ccf8 NotificationEvent
Not impersonating
DeviceMap e1001090
Owning Process 81bcc660
Wait Start TickCount 14793 Elapsed Ticks: 49135
but I’m not sure what these numbers exactly mean. The
suspicious things is most worker threads display exactly the
same numbers. Above thread is also one of them and was used
to process a callback. However, I don’t believe waiting for
the event started in the same tick as other worker threads
started waiting for a request. WinDbg docs doesn’t explain
it. Does anybody know what these numbers mean? And if there
is a way how to find correct waiting time?
BTW (symbol server is correctly set and all symbols were
downloaded so message is bogus):
kd> !threadfields
ETHREAD structure offsets: (use ‘dt ETHREAD’)
kd> dt ETHREAD
**************************************************************
***********
***
***
***
***
*** Your debugger is not using the correct symbols
***
***
***
*** In order for this command to work properly, your
symbol path ***
*** must point to .pdb files that have full type
information. ***
***
***
*** Certain .pdb files (such as the public OS symbols) do
not ***
*** contain the required information. Contact the group
that ***
*** provided you with these symbols if you need this
command to ***
*** work.
***
***
***
*** Type referenced: ETHREAD
***
***
***
**************************************************************
***********
Symbol ETHREAD not found.
Best regards,
Michal Vodicka
UPEK, Inc.
[xxxxx@upek.com, http://www.upek.com]
Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256
You are currently subscribed to ntdev as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com
Thanks, I already found it. But it was WinDbg who claimed it is ETHREAD 
And display ugly message every time a symbol isn’t found is just stupid. Well, I should probably subscribe windbg list.
Best regards,
Michal Vodicka
UPEK, Inc.
[xxxxx@upek.com, http://www.upek.com]
From: xxxxx@lists.osr.com[SMTP:xxxxx@lists.osr.com] on behalf of Calvin Guan[SMTP:xxxxx@ati.com]
Reply To: Windows System Software Devs Interest List
Sent: Wednesday, September 01, 2004 12:51 AM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] Wait Start TickCount?
> kd> dt ETHREAD
should be kd>dt _ETHREAD
Calvin Guan Software Engineer
ATI Technologies Inc. www.ati.com
> kd> !threadfields
ETHREAD structure offsets: (use ‘dt ETHREAD’)
kd> dt ETHREAD
*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: ETHREAD ***
*** ***
*************************************************************************
Symbol ETHREAD not found.
I think their instructions are just erroneous. Try using _ETHREAD instead
of ETHREAD:
kd> !thread
THREAD 8046fff0 Cid 0.0 Teb: 00000000 Win32Thread: 00000000 RUNNING
…
kd> dt nt!_ETHREAD 8046fff0
+0x000 Tcb : _KTHREAD
+0x1b0 CreateTime : _LARGE_INTEGER 0x0
+0x1b0 NestedFaultCount : 0y00
…
kd> dt nt!_KTHREAD 8046fff0
+0x000 Header : _DISPATCHER_HEADER
+0x010 MutantListHead : _LIST_ENTRY [0x80470000 - 0x80470000]
+0x018 InitialStack : 0x80474240
+0x01c StackLimit : 0x80471240
…
For what it’s worth, I forwarded this thread on to our debugger team.
-p
-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Michal Vodicka
Sent: Tuesday, August 31, 2004 3:59 PM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] Wait Start TickCount?
Thanks, I already found it. But it was WinDbg who claimed it
is ETHREAD And display ugly message every time a symbol
isn’t found is just stupid. Well, I should probably subscribe
windbg list.
Best regards,
Michal Vodicka
UPEK, Inc.
[xxxxx@upek.com, http://www.upek.com]
> ----------
> From:
xxxxx@lists.osr.com[SMTP:xxxxx@lis
ts.osr.com] on behalf of Calvin Guan[SMTP:xxxxx@ati.com]
> Reply To: Windows System Software Devs Interest List
> Sent: Wednesday, September 01, 2004 12:51 AM
> To: Windows System Software Devs Interest List
> Subject: RE: [ntdev] Wait Start TickCount?
>
> > kd> dt ETHREAD
>
> should be kd>dt _ETHREAD
>
> -
> Calvin Guan Software Engineer
> ATI Technologies Inc. www.ati.com
>
Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256
You are currently subscribed to ntdev as: unknown lmsubst tag
argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com
Ouch
Best regards,
Michal Vodicka
UPEK, Inc.
[xxxxx@upek.com, http://www.upek.com]
From: xxxxx@lists.osr.com[SMTP:xxxxx@lists.osr.com] on behalf of Peter Wieland[SMTP:xxxxx@windows.microsoft.com]
Reply To: Windows System Software Devs Interest List
Sent: Wednesday, September 01, 2004 1:10 AM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] Wait Start TickCount?
For what it’s worth, I forwarded this thread on to our debugger team.
-p
> -----Original Message-----
> From: xxxxx@lists.osr.com
> [mailto:xxxxx@lists.osr.com] On Behalf Of Michal Vodicka
> Sent: Tuesday, August 31, 2004 3:59 PM
> To: Windows System Software Devs Interest List
> Subject: RE: [ntdev] Wait Start TickCount?
>
> Thanks, I already found it. But it was WinDbg who claimed it
> is ETHREAD And display ugly message every time a symbol
> isn’t found is just stupid. Well, I should probably subscribe
> windbg list.
>
> Best regards,
>
> Michal Vodicka
> UPEK, Inc.
> [xxxxx@upek.com, http://www.upek.com]
>
>
> > ----------
> > From:
> xxxxx@lists.osr.com[SMTP:xxxxx@lis
> ts.osr.com] on behalf of Calvin Guan[SMTP:xxxxx@ati.com]
> > Reply To: Windows System Software Devs Interest List
> > Sent: Wednesday, September 01, 2004 12:51 AM
> > To: Windows System Software Devs Interest List
> > Subject: RE: [ntdev] Wait Start TickCount?
> >
> > > kd> dt ETHREAD
> >
> > should be kd>dt _ETHREAD
> >
> > -
> > Calvin Guan Software Engineer
> > ATI Technologies Inc. www.ati.com
> >
>
> —
> Questions? First check the Kernel Driver FAQ at
> http://www.osronline.com/article.cfm?id=256
>
> You are currently subscribed to ntdev as: unknown lmsubst tag
> argument: ‘’
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>
Questions? First check the Kernel Driver FAQ at http://www.osronline.com/article.cfm?id=256
You are currently subscribed to ntdev as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com