A
ab_530
Lenovo 495 bugchecks after sleeping when closing the top. Event Log and dbg !analyze -v
Event Log:
Log Name: System
Source: Microsoft-Windows-WER-SystemErrorReporting
Date: 12/18/2020 7:01:56 PM
Event ID: 1001
Task Category: None
Level: Error
Keywords: Classic
User: N/A
Computer: T495
Description:
The computer has rebooted from a bugcheck. The bugcheck was: 0x00000133 (0x0000000000000000, 0x0000000000000501, 0x0000000000000500, 0xfffff80369cfa320). A dump was saved in: C:\WINDOWS\MEMORY.DMP. Report Id: 3bb5a5b8-7a50-4d17-8fea-d9e3ef36de74.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-WER-SystemErrorReporting" Guid="{ABCE23E7-DE45-4366-8631-84FA6C525952}" EventSourceName="BugCheck" />
<EventID Qualifiers="16384">1001</EventID>
<Version>0</Version>
<Level>2</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2020-12-19T00:01:56.6838311Z" />
<EventRecordID>48596</EventRecordID>
<Correlation />
<Execution ProcessID="0" ThreadID="0" />
<Channel>System</Channel>
<Computer>T495</Computer>
<Security />
</System>
<EventData>
<Data Name="param1">0x00000133 (0x0000000000000000, 0x0000000000000501, 0x0000000000000500, 0xfffff80369cfa320)</Data>
<Data Name="param2">C:\WINDOWS\MEMORY.DMP</Data>
<Data Name="param3">3bb5a5b8-7a50-4d17-8fea-d9e3ef36de74</Data>
</EventData>
</Event>
2: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
DPC_WATCHDOG_VIOLATION (133)
The DPC watchdog detected a prolonged run time at an IRQL of DISPATCH_LEVEL
or above.
Arguments:
Arg1: 0000000000000000, A single DPC or ISR exceeded its time allotment. The offending
component can usually be identified with a stack trace.
Arg2: 0000000000000501, The DPC time count (in ticks).
Arg3: 0000000000000500, The DPC time allotment (in ticks).
Arg4: fffff80369cfa320, cast to nt!DPC_WATCHDOG_GLOBAL_TRIAGE_BLOCK, which contains
additional information regarding this single DPC timeout
Debugging Details:
------------------
*************************************************************************
*** ***
*** ***
*** Either you specified an unqualified symbol, or your debugger ***
*** doesn't have full symbol information. Unqualified symbol ***
*** resolution is turned off by default. Please either specify a ***
*** fully qualified symbol module!symbolname, or enable resolution ***
*** of unqualified symbols by typing ".symopt- 100". Note that ***
*** enabling unqualified symbol resolution with network symbol ***
*** server shares in the symbol path may cause the debugger to ***
*** appear to hang for long periods of time when an incorrect ***
*** symbol name is typed or the network symbol server is down. ***
*** ***
*** For some commands to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: TickPeriods ***
*** ***
*************************************************************************
DBGHELP: SharedUserData - virtual symbol module
SYMSRV: BYINDEX: 0x5
C:\ProgramData\Dbg\sym
win32k.sys
E87370BB9a000
SYMSRV: PATH: C:\ProgramData\Dbg\sym\win32k.sys\E87370BB9a000\win32k.sys
SYMSRV: RESULT: 0x00000000
DBGHELP: C:\ProgramData\Dbg\sym\win32k.sys\E87370BB9a000\win32k.sys - OK
DBGENG: C:\ProgramData\Dbg\sym\win32k.sys\E87370BB9a000\win32k.sys - Mapped image memory
SYMSRV: BYINDEX: 0x6
C:\ProgramData\Dbg\sym
win32k.pdb
ED706A38659240A066E6FB19B994BAAA1
SYMSRV: PATH: C:\ProgramData\Dbg\sym\win32k.pdb\ED706A38659240A066E6FB19B994BAAA1\win32k.pdb
SYMSRV: RESULT: 0x00000000
DBGHELP: win32k - public symbols
C:\ProgramData\Dbg\sym\win32k.pdb\ED706A38659240A066E6FB19B994BAAA1\win32k.pdb
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 3796
Key : Analysis.DebugAnalysisProvider.CPP
Value: Create: 8007007e on T495
Key : Analysis.DebugData
Value: CreateObject
Key : Analysis.DebugModel
Value: CreateObject
Key : Analysis.Elapsed.mSec
Value: 3929
Key : Analysis.Memory.CommitPeak.Mb
Value: 77
Key : Analysis.System
Value: CreateObject
Key : WER.OS.Branch
Value: vb_release
Key : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z
Key : WER.OS.Version
Value: 10.0.19041.1
ADDITIONAL_XML: 1
OS_BUILD_LAYERS: 1
BUGCHECK_CODE: 133
BUGCHECK_P1: 0
BUGCHECK_P2: 501
BUGCHECK_P3: 500
BUGCHECK_P4: fffff80369cfa320
DPC_TIMEOUT_TYPE: SINGLE_DPC_TIMEOUT_EXCEEDED
TRAP_FRAME: fffff08013a37650 -- (.trap 0xfffff08013a37650)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=000000002dc1d782 rbx=0000000000000000 rcx=fffff08013a37868
rdx=fffff0801a1d4650 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80369244567 rsp=fffff08013a377e0 rbp=ffff958811907080
r8=fffff0801a1d4480 r9=fffff0801a1d4490 r10=0000fffff8036938
r11=ffffb7fdefe00000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz na po nc
nt!KeYieldProcessorEx+0x17:
fffff803`69244567 4883c420 add rsp,20h
Resetting default scope
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
PROCESS_NAME: System
STACK_TEXT:
ffffc800`def7de18 fffff803`6943a988 : 00000000`00000133 00000000`00000000 00000000`00000501 00000000`00000500 : nt!KeBugCheckEx
ffffc800`def7de20 fffff803`6926f9a3 : 00000c81`a5324b46 ffffc800`def80180 00000000`00000000 ffffc800`def80180 : nt!KeAccumulateTicks+0x1c8788
ffffc800`def7de80 fffff803`6926f48a : ffff9587`f5ad90e0 fffff080`13a376d0 fffff803`656e3c00 00000000`0000b801 : nt!KeClockInterruptNotify+0x453
ffffc800`def7df30 fffff803`69327ef5 : ffff9587`f5ad90e0 ffffc800`def7df40 00000000`0000000c ffffabaf`4b00bc76 : nt!HalpTimerClockIpiRoutine+0x1a
ffffc800`def7df60 fffff803`693f722a : fffff080`13a376d0 ffff9587`f5ad90e0 00000000`80000000 00000000`00000000 : nt!KiCallInterruptServiceRoutine+0xa5
ffffc800`def7dfb0 fffff803`693f7797 : 00000000`00000000 ffff932f`86541566 fffff080`1a1d4490 fffff803`693f77a4 : nt!KiInterruptSubDispatchNoLockNoEtw+0xfa
fffff080`13a37650 fffff803`69244567 : ffffffff`ffffffd2 fffff803`69384b52 00000000`00000010 00000000`00000286 : nt!KiInterruptDispatchNoLockNoEtw+0x37
fffff080`13a377e0 fffff803`69384b63 : fffff080`13a37b38 fffff080`13a37b31 fffff080`13a37b60 00000000`00000000 : nt!KeYieldProcessorEx+0x17
fffff080`13a37810 fffff803`6920781e : ffffc800`def83240 ffff9587`2dc1d782 fffff080`13a37b20 ffffc800`00000002 : nt!KiSwapDirectoryTableBaseTarget+0x53
fffff080`13a37860 fffff803`69206b04 : 00000000`00000000 fffff803`69332d15 00000000`00140001 00000000`00000000 : nt!KiExecuteAllDpcs+0x30e
fffff080`13a379d0 fffff803`693f92ee : ffffffff`00000000 ffffc800`def80180 ffffc800`def8b240 ffff9588`12cc1040 : nt!KiRetireDpcList+0x1f4
fffff080`13a37c60 00000000`00000000 : fffff080`13a38000 fffff080`13a32000 00000000`00000000 00000000`00000000 : nt!KiIdleLoop+0x9e
SYMBOL_NAME: nt!KeAccumulateTicks+1c8788
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
STACK_COMMAND: .thread ; .cxr ; kb
BUCKET_ID_FUNC_OFFSET: 1c8788
FAILURE_BUCKET_ID: 0x133_DPC_nt!KeAccumulateTicks
OS_VERSION: 10.0.19041.1
BUILDLAB_STR: vb_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {88dc98ce-f842-4daa-98d0-858621db6b0f}
Followup: MachineOwner
---------
Continue reading...
Event Log:
Log Name: System
Source: Microsoft-Windows-WER-SystemErrorReporting
Date: 12/18/2020 7:01:56 PM
Event ID: 1001
Task Category: None
Level: Error
Keywords: Classic
User: N/A
Computer: T495
Description:
The computer has rebooted from a bugcheck. The bugcheck was: 0x00000133 (0x0000000000000000, 0x0000000000000501, 0x0000000000000500, 0xfffff80369cfa320). A dump was saved in: C:\WINDOWS\MEMORY.DMP. Report Id: 3bb5a5b8-7a50-4d17-8fea-d9e3ef36de74.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-WER-SystemErrorReporting" Guid="{ABCE23E7-DE45-4366-8631-84FA6C525952}" EventSourceName="BugCheck" />
<EventID Qualifiers="16384">1001</EventID>
<Version>0</Version>
<Level>2</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2020-12-19T00:01:56.6838311Z" />
<EventRecordID>48596</EventRecordID>
<Correlation />
<Execution ProcessID="0" ThreadID="0" />
<Channel>System</Channel>
<Computer>T495</Computer>
<Security />
</System>
<EventData>
<Data Name="param1">0x00000133 (0x0000000000000000, 0x0000000000000501, 0x0000000000000500, 0xfffff80369cfa320)</Data>
<Data Name="param2">C:\WINDOWS\MEMORY.DMP</Data>
<Data Name="param3">3bb5a5b8-7a50-4d17-8fea-d9e3ef36de74</Data>
</EventData>
</Event>
2: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
DPC_WATCHDOG_VIOLATION (133)
The DPC watchdog detected a prolonged run time at an IRQL of DISPATCH_LEVEL
or above.
Arguments:
Arg1: 0000000000000000, A single DPC or ISR exceeded its time allotment. The offending
component can usually be identified with a stack trace.
Arg2: 0000000000000501, The DPC time count (in ticks).
Arg3: 0000000000000500, The DPC time allotment (in ticks).
Arg4: fffff80369cfa320, cast to nt!DPC_WATCHDOG_GLOBAL_TRIAGE_BLOCK, which contains
additional information regarding this single DPC timeout
Debugging Details:
------------------
*************************************************************************
*** ***
*** ***
*** Either you specified an unqualified symbol, or your debugger ***
*** doesn't have full symbol information. Unqualified symbol ***
*** resolution is turned off by default. Please either specify a ***
*** fully qualified symbol module!symbolname, or enable resolution ***
*** of unqualified symbols by typing ".symopt- 100". Note that ***
*** enabling unqualified symbol resolution with network symbol ***
*** server shares in the symbol path may cause the debugger to ***
*** appear to hang for long periods of time when an incorrect ***
*** symbol name is typed or the network symbol server is down. ***
*** ***
*** For some commands to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: TickPeriods ***
*** ***
*************************************************************************
DBGHELP: SharedUserData - virtual symbol module
SYMSRV: BYINDEX: 0x5
C:\ProgramData\Dbg\sym
win32k.sys
E87370BB9a000
SYMSRV: PATH: C:\ProgramData\Dbg\sym\win32k.sys\E87370BB9a000\win32k.sys
SYMSRV: RESULT: 0x00000000
DBGHELP: C:\ProgramData\Dbg\sym\win32k.sys\E87370BB9a000\win32k.sys - OK
DBGENG: C:\ProgramData\Dbg\sym\win32k.sys\E87370BB9a000\win32k.sys - Mapped image memory
SYMSRV: BYINDEX: 0x6
C:\ProgramData\Dbg\sym
win32k.pdb
ED706A38659240A066E6FB19B994BAAA1
SYMSRV: PATH: C:\ProgramData\Dbg\sym\win32k.pdb\ED706A38659240A066E6FB19B994BAAA1\win32k.pdb
SYMSRV: RESULT: 0x00000000
DBGHELP: win32k - public symbols
C:\ProgramData\Dbg\sym\win32k.pdb\ED706A38659240A066E6FB19B994BAAA1\win32k.pdb
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 3796
Key : Analysis.DebugAnalysisProvider.CPP
Value: Create: 8007007e on T495
Key : Analysis.DebugData
Value: CreateObject
Key : Analysis.DebugModel
Value: CreateObject
Key : Analysis.Elapsed.mSec
Value: 3929
Key : Analysis.Memory.CommitPeak.Mb
Value: 77
Key : Analysis.System
Value: CreateObject
Key : WER.OS.Branch
Value: vb_release
Key : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z
Key : WER.OS.Version
Value: 10.0.19041.1
ADDITIONAL_XML: 1
OS_BUILD_LAYERS: 1
BUGCHECK_CODE: 133
BUGCHECK_P1: 0
BUGCHECK_P2: 501
BUGCHECK_P3: 500
BUGCHECK_P4: fffff80369cfa320
DPC_TIMEOUT_TYPE: SINGLE_DPC_TIMEOUT_EXCEEDED
TRAP_FRAME: fffff08013a37650 -- (.trap 0xfffff08013a37650)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=000000002dc1d782 rbx=0000000000000000 rcx=fffff08013a37868
rdx=fffff0801a1d4650 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80369244567 rsp=fffff08013a377e0 rbp=ffff958811907080
r8=fffff0801a1d4480 r9=fffff0801a1d4490 r10=0000fffff8036938
r11=ffffb7fdefe00000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz na po nc
nt!KeYieldProcessorEx+0x17:
fffff803`69244567 4883c420 add rsp,20h
Resetting default scope
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
PROCESS_NAME: System
STACK_TEXT:
ffffc800`def7de18 fffff803`6943a988 : 00000000`00000133 00000000`00000000 00000000`00000501 00000000`00000500 : nt!KeBugCheckEx
ffffc800`def7de20 fffff803`6926f9a3 : 00000c81`a5324b46 ffffc800`def80180 00000000`00000000 ffffc800`def80180 : nt!KeAccumulateTicks+0x1c8788
ffffc800`def7de80 fffff803`6926f48a : ffff9587`f5ad90e0 fffff080`13a376d0 fffff803`656e3c00 00000000`0000b801 : nt!KeClockInterruptNotify+0x453
ffffc800`def7df30 fffff803`69327ef5 : ffff9587`f5ad90e0 ffffc800`def7df40 00000000`0000000c ffffabaf`4b00bc76 : nt!HalpTimerClockIpiRoutine+0x1a
ffffc800`def7df60 fffff803`693f722a : fffff080`13a376d0 ffff9587`f5ad90e0 00000000`80000000 00000000`00000000 : nt!KiCallInterruptServiceRoutine+0xa5
ffffc800`def7dfb0 fffff803`693f7797 : 00000000`00000000 ffff932f`86541566 fffff080`1a1d4490 fffff803`693f77a4 : nt!KiInterruptSubDispatchNoLockNoEtw+0xfa
fffff080`13a37650 fffff803`69244567 : ffffffff`ffffffd2 fffff803`69384b52 00000000`00000010 00000000`00000286 : nt!KiInterruptDispatchNoLockNoEtw+0x37
fffff080`13a377e0 fffff803`69384b63 : fffff080`13a37b38 fffff080`13a37b31 fffff080`13a37b60 00000000`00000000 : nt!KeYieldProcessorEx+0x17
fffff080`13a37810 fffff803`6920781e : ffffc800`def83240 ffff9587`2dc1d782 fffff080`13a37b20 ffffc800`00000002 : nt!KiSwapDirectoryTableBaseTarget+0x53
fffff080`13a37860 fffff803`69206b04 : 00000000`00000000 fffff803`69332d15 00000000`00140001 00000000`00000000 : nt!KiExecuteAllDpcs+0x30e
fffff080`13a379d0 fffff803`693f92ee : ffffffff`00000000 ffffc800`def80180 ffffc800`def8b240 ffff9588`12cc1040 : nt!KiRetireDpcList+0x1f4
fffff080`13a37c60 00000000`00000000 : fffff080`13a38000 fffff080`13a32000 00000000`00000000 00000000`00000000 : nt!KiIdleLoop+0x9e
SYMBOL_NAME: nt!KeAccumulateTicks+1c8788
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
STACK_COMMAND: .thread ; .cxr ; kb
BUCKET_ID_FUNC_OFFSET: 1c8788
FAILURE_BUCKET_ID: 0x133_DPC_nt!KeAccumulateTicks
OS_VERSION: 10.0.19041.1
BUILDLAB_STR: vb_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {88dc98ce-f842-4daa-98d0-858621db6b0f}
Followup: MachineOwner
---------
Continue reading...