Jump to content

Compiling ACPI v2.0 driver for Windows XP SP3 and Windows 2003 SP2 (x32/x64)


Mov AX, 0xDEAD

Recommended Posts


@Mov AX, 0xDEAD

Here is the log related to debugging by choosing the "KDNET Checked" option in boot.ini after replacing the free acpi.sys and acpi.pdb files with the debug version (SHA-1: DE3B6993BBAADEE0F875DD234BBC65C87E9ACA52   and   2F62065C1520EF31246BEFDF133650B605A17AE0).
The configurations of the target and host systems are the same.
I do not understand the reason for the error regarding symbols not found if nothing has changed from the "KDNET FREE" option (except the version of acpi.sys and acpi.pdb).

Quote

Microsoft (R) Windows Debugger Version 6.3.9600.17200 X86
Copyright (c) Microsoft Corporation. All rights reserved.

Using NET for debugging
Opened WinSock 2.0
Waiting to reconnect...
Connected to target 192.168.1.3 on port 50000 on local IP 192.168.1.1.
Connected to Windows XP 2600 x86 compatible target at (Fri Dec 16 15:25:25.078 2022 (UTC - 6:00)), ptr64 FALSE
Kernel Debugger connection established.

************* Symbol Path validation summary **************
Response                         Time (ms)     Location
OK                                             W:\Symbols2
Deferred                                       srv*W:\Symbols4*http://msdl.microsoft.com/download/symbols
Symbol search path is: W:\Symbols2;srv*W:\Symbols4*http://msdl.microsoft.com/download/symbols
Executable search path is:
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for ntkrpamp.exe -
Windows XP Kernel Version 2600 MP (1 procs) Checked x86 compatible
Built by: 2600.xpsp.080413-2133
Machine Name:
Kernel base = 0x80a02000 PsLoadedModuleList = 0x80b019e8
System Uptime: not available
Break instruction exception - code 80000003 (first chance)
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for ntkrpamp.exe -
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for HAL3.DLL -
nt!DbgBreakPoint:
80ac37e0 cc              int     3
kd> kd> bu acpi!DriverEntry
Numeric expression missing from '> bu acpi!DriverEntry'
kd> g
MM: Loader/HAL memory block indicates large pages cannot be used for 80100000->8012777F

*** Assertion failed: IopInitHalResources == NULL
***   Source File: d:\xpsp\base\ntos\io\pnpmgr\pnpinit.c, line 1455

Break repeatedly, break Once, Ignore, terminate Process, or terminate Thread (boipt)? i
ACPI0007 def #2
ACPI0007 def #2
ACPI0007 def #2
ACPI0007 def #2
ACPI0007 def #2
ACPI0007 def #2
ACPI0007 def #2
ACPI0007 def #2
ACPI0007 def #2
ACPI0007 def #2
ACPI0007 def #2
ACPI0007 def #2
ACPI0007 def #2
ACPI0007 def #2
ACPI0007 def #2
ACPI0007 def #2
ACPI0007 def #2
ACPI0007 def #2
ACPI0007 def #2
ACPI0007 def #2
ACPI0007 def #2
ACPI0007 def #2
ACPI0007 def #2
ACPI0007 def #2
ACPI0007 def #2
ACPI0007 def #2
ACPI0007 def #2
ACPI0007 def #2
ACPI0007 def #2
ACPI0007 def #2
ACPI0007 def #2
ACPI0007 def #2
ACPI0007 def #2
ACPI0007 def #2
ACPI0007 def #2
ACPI0007 def #2
ACPI0007 def #2
ACPI0007 def #2
ACPI0007 def #2
ACPI0007 def #2
ACPI0007 def #2
ACPI0007 def #2
ACPI0007 def #2
ACPI0007 def #2
ACPI0007 def #2
ACPI0007 def #2
ACPI0007 def #2
ACPI0007 def #2
ACPI0007 def #2
ACPI0007 def #2
ACPI0007 def #2
ACPI0007 def #2
ACPI0007 def #2
ACPI0007 def #2
ACPI0007 def #2
ACPI0007 def #2
ACPI0007 def #2
ACPI0007 def #2
ACPI0007 def #2
ACPI0007 def #2
ACPI0007 def #2
ACPI0007 def #2
ACPI0007 def #2
ACPI0007 def #2
ACPI0007 def #2
ACPI0007 def #2
ACPI0007 def #2
ACPI0007 def #2
ACPI0007 def #2
ACPI0007 def #2
ACPI0007 def #2
ACPI0007 def #2
ACPI0007 def #2
ACPI0007 def #2
ACPI0007 def #2
ACPI0007 def #2
ACPI0007 def #2
ACPI0007 def #2
ACPI0007 def #2
ACPI0007 def #2
ACPI0007 def #2
ACPI0007 def #2
ACPI0007 def #2

*** Fatal System Error: 0x000000a5
                       (0x00000003,0x53414448,0xC0000034,0x494E495F)

Break instruction exception - code 80000003 (first chance)

A fatal system error has occurred.
Debugger entered on first try; Bugcheck callbacks have not been invoked.

A fatal system error has occurred.

Connected to Windows XP 2600 x86 compatible target at (Fri Dec 16 15:28:44.000 2022 (UTC - 6:00)), ptr64 FALSE
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for ntkrpamp.exe -
Loading Kernel Symbols
..........................
Loading User Symbols


************* Symbol Loading Error Summary **************
Module name            Error
ntkrpamp               The system cannot find the file specified

You can troubleshoot most symbol related issues by turning on symbol loading diagnostics (!sym noisy) and repeating the command that caused symbols to be loaded.
You should also verify that your symbol search path (.sympath) is correct.
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck A5, {3, 53414448, c0000034, 494e495f}

***** Kernel symbols are WRONG. Please fix symbols to do analysis.

*************************************************************************
***                                                                   ***
***                                                                   ***
***    Either you specified an unqualified symbol, or your debugger   ***
***    doesn't have full symbol information.  Unqualified symbol      ***
***    resolution is turned off by default. Please either specify a   ***
***    fully qualified symbol module!symbolname, or enable resolution ***
***    of unqualified symbols by typing ".symopt- 100". Note that   ***
***    enabling unqualified symbol resolution with network symbol     ***
***    server shares in the symbol path may cause the debugger to     ***
***    appear to hang for long periods of time when an incorrect      ***
***    symbol name is typed or the network symbol server is down.     ***
***                                                                   ***
***    For some commands to work properly, your symbol path           ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: nt!_KPRCB                                     ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Either you specified an unqualified symbol, or your debugger   ***
***    doesn't have full symbol information.  Unqualified symbol      ***
***    resolution is turned off by default. Please either specify a   ***
***    fully qualified symbol module!symbolname, or enable resolution ***
***    of unqualified symbols by typing ".symopt- 100". Note that   ***
***    enabling unqualified symbol resolution with network symbol     ***
***    server shares in the symbol path may cause the debugger to     ***
***    appear to hang for long periods of time when an incorrect      ***
***    symbol name is typed or the network symbol server is down.     ***
***                                                                   ***
***    For some commands to work properly, your symbol path           ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: nt!_KPRCB                                     ***
***                                                                   ***
*************************************************************************
Probably caused by : ACPI.sys ( ACPI!ACPIBuildCompleteMustSucceed+43 )

Followup: MachineOwner
---------

nt!DbgBreakPointWithStatus+0x4:
80ac37ec cc              int     3
2: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

ACPI_BIOS_ERROR (a5)
The ACPI Bios in the system is not fully compliant with the ACPI specification.
The first value indicates where the incompatibility lies:
This bug check covers a great variety of ACPI problems.  If a kernel debugger
is attached, use "!analyze -v".  This command will analyze the precise problem,
and display whatever information is most useful for debugging the specific
error.
Arguments:
Arg1: 00000003, ACPI_FAILED_MUST_SUCCEED_METHOD
    ACPI tried to run a control method while creating device extensions
    to represent the ACPI namespace, but this control method failed.
Arg2: 53414448, The ACPI Object that was being run
Arg3: c0000034, return value from the interpreter
Arg4: 494e495f, Name of the control method (in ULONG format)

Debugging Details:
------------------

***** Kernel symbols are WRONG. Please fix symbols to do analysis.

*************************************************************************
***                                                                   ***
***                                                                   ***
***    Either you specified an unqualified symbol, or your debugger   ***
***    doesn't have full symbol information.  Unqualified symbol      ***
***    resolution is turned off by default. Please either specify a   ***
***    fully qualified symbol module!symbolname, or enable resolution ***
***    of unqualified symbols by typing ".symopt- 100". Note that   ***
***    enabling unqualified symbol resolution with network symbol     ***
***    server shares in the symbol path may cause the debugger to     ***
***    appear to hang for long periods of time when an incorrect      ***
***    symbol name is typed or the network symbol server is down.     ***
***                                                                   ***
***    For some commands to work properly, your symbol path           ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: nt!_KPRCB                                     ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Either you specified an unqualified symbol, or your debugger   ***
***    doesn't have full symbol information.  Unqualified symbol      ***
***    resolution is turned off by default. Please either specify a   ***
***    fully qualified symbol module!symbolname, or enable resolution ***
***    of unqualified symbols by typing ".symopt- 100". Note that   ***
***    enabling unqualified symbol resolution with network symbol     ***
***    server shares in the symbol path may cause the debugger to     ***
***    appear to hang for long periods of time when an incorrect      ***
***    symbol name is typed or the network symbol server is down.     ***
***                                                                   ***
***    For some commands to work properly, your symbol path           ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: nt!_KPRCB                                     ***
***                                                                   ***
*************************************************************************

ADDITIONAL_DEBUG_TEXT:  

You can run '.symfix; .reload' to try to fix the symbol path and load symbols.

MODULE_NAME: ACPI

FAULTING_MODULE: 80a02000 nt

DEBUG_FLR_IMAGE_TIMESTAMP:  639b3d8b

ACPI_OBJECT:  53414448

DEFAULT_BUCKET_ID:  DRIVER_FAULT

BUGCHECK_STR:  0xA5

ANALYSIS_VERSION: 6.3.9600.17237 (debuggers(dbg).140716-0327) x86fre

LAST_CONTROL_TRANSFER:  from 80a319e6 to 80ac37ec

STACK_TEXT:  
WARNING: Stack unwind information not available. Following frames may be wrong.
f7b458a4 80a319e6 00000003 85f24008 85f6f000 nt!DbgBreakPointWithStatus+0x4
f7b45c84 80a31f77 000000a5 00000003 53414448 nt!KeRegisterBugCheckReasonCallback+0x7fc
f7b45ca4 f745e953 000000a5 00000003 53414448 nt!KeBugCheckEx+0x1b
f7b45cc0 f7485129 85f2e420 c0000034 00000000 ACPI!ACPIBuildCompleteMustSucceed+0x43 [c:\nt\base\busdrv\acpi\driver\nt\buildsrc.c @ 433]
f7b45cf8 f7482f89 f745e910 c0000034 00000000 ACPI!AsyncCallBack+0xe5 [c:\nt\base\busdrv\acpi\driver\amlinew\sync.c @ 82]
f7b45d1c f7485f07 c0000034 4556414c 85f6f000 ACPI!RunContext+0x1f5 [c:\nt\base\busdrv\acpi\driver\amlinew\ctxt.c @ 649]
f7b45d44 f7486033 85f6f000 00000000 f74a4588 ACPI!InsertReadyQueue+0x15a [c:\nt\base\busdrv\acpi\driver\amlinew\sched.c @ 275]
f7b45d64 f7477153 85fb3070 00000000 85fc09a0 ACPI!RestartCtxtPassive+0x54 [c:\nt\base\busdrv\acpi\driver\amlinew\sched.c @ 384]
f7b45dac 80bd81ac 00000000 00000000 00000000 ACPI!ACPIWorker+0xbf [c:\nt\base\busdrv\acpi\driver\nt\worker.c @ 302]
f7b45ddc 80ae4212 f7477094 00000000 00000000 nt!PsRemoveCreateThreadNotifyRoutine+0x364
00000000 00000000 00000000 00000000 00000000 nt!KiDispatchInterrupt+0x802


STACK_COMMAND:  kb

FOLLOWUP_IP:
ACPI!ACPIBuildCompleteMustSucceed+43 [c:\nt\base\busdrv\acpi\driver\nt\buildsrc.c @ 433]
f745e953 c7401802000000  mov     dword ptr [eax+18h],2

FAULTING_SOURCE_LINE:  c:\nt\base\busdrv\acpi\driver\nt\buildsrc.c

FAULTING_SOURCE_FILE:  c:\nt\base\busdrv\acpi\driver\nt\buildsrc.c

FAULTING_SOURCE_LINE_NUMBER:  433

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  ACPI!ACPIBuildCompleteMustSucceed+43

FOLLOWUP_NAME:  MachineOwner

IMAGE_NAME:  ACPI.sys

IMAGE_VERSION:  5.1.2600.7777

BUCKET_ID:  WRONG_SYMBOLS

FAILURE_BUCKET_ID:  WRONG_SYMBOLS

ANALYSIS_SOURCE:  KM

FAILURE_ID_HASH_STRING:  km:wrong_symbols

FAILURE_ID_HASH:  {70b057e8-2462-896f-28e7-ac72d4d365f8}

Followup: MachineOwner
---------

2: kd> lmvm ACPI
start    end        module name
f745e000 f74c8d80   ACPI       (private pdb symbols)  c:\nt\base\busdrv\acpi\driver\nt\obj\i386\acpi.pdb
    Loaded symbol image file: ACPI.sys
    Image path: ACPI.sys
    Image name: ACPI.sys
    Timestamp:        Thu Dec 15 09:30:19 2022 (639B3D8B)
    CheckSum:         0006EC74
    ImageSize:        0006AD80
    File version:     5.1.2600.7777
    Product version:  5.1.2600.1106
    File flags:       9 (Mask 3F) Debug Private
    File OS:          40004 NT Win32
    File type:        3.7 Driver
    File date:        00000000.00000000
    Translations:     0409.04b0
    CompanyName:      Microsoft Corporation
    ProductName:      Microsoft® Windows® Operating System
    InternalName:     ACPI.sys
    OriginalFilename: ACPI.sys
    ProductVersion:   5.1.2600.1106
    FileVersion:      5,1,2600,7777 built by: Administrator
    FileDescription:  ACPI 2.0 Driver for NT
    LegalCopyright:   © Microsoft Corporation. All rights reserved.

 

Edited by Andalu
Link to comment
Share on other sites

@Dietmar

Thanks,

Unfortunately your acpi.sys gave BSOD A5 0x11 0x08

I'm going to need to refresh my memory for how to properly setup KDNET - I have admittedly been very slack on this regard.

If it helps for reference, the last working acpi.sys for me was compiled by @George King on 4 dec 2022. and the only issue with it was that processors 1A to 1F would not auto install - they did work with a brute force install but just had the name "processor".

Link to comment
Share on other sites

1 hour ago, Andalu said:

@Mov AX, 0xDEAD

I do not understand the reason for the error regarding symbols not found if nothing has changed from the "KDNET FREE" option (except the version of acpi.sys and acpi.pdb).

kd> kd> bu acpi!DriverEntry
Numeric expression missing from '> bu acpi!DriverEntry'
kd> g
MM: Loader/HAL memory block indicates large pages cannot be used for 80100000->8012777F

breakpoint was failed to set

Why need .pdb at proper place? Because on target PC you need acpi.sys, on host PC need acpi.pdb

Open your acpi.sys,  look for string ".pdb", you will see path where windbg will look for acpi.pdb on host PC.

I compile always to c:\acpi\acpi_sp1\base\busdrv\acpi\driver\nt\obj\i386\acpi.pdb, Dietmar compiles to other path, that's why  need two files in a bundle for debugging, you need place .pdb to same path where it was compiled

 

Link to comment
Share on other sites

@Mov AX, 0xDEAD

Before, I always updated my acpi files by hand.

This time for the first I use your patch.

I noticed, that in bus.c you changed in         status = PnpBiosResourcesToNtResources(

       ASSERT(NT_SUCCESS(status));  ==>  //ASSERT(NT_SUCCESS(status));

Dietmar

Link to comment
Share on other sites

1 minute ago, Dietmar said:

@Mov AX, 0xDEAD

Before, I always updated my acpi files by hand.

This time for the first I use your patch.

I noticed, that in bus.c you changed in         status = PnpBiosResourcesToNtResources(

       ASSERT(NT_SUCCESS(status));  ==>  //ASSERT(NT_SUCCESS(status));

Dietmar

@Dietmar

To avoid every time when debugging:

Quote

PnpBiosResourcesToNtResources: No Resources to Report

*** Assertion failed: NT_SUCCESS(status)
***   Source File: c:\nt\base\busdrv\acpi\driver\nt\bus.c, line 2550

Break repeatedly, break Once, Ignore, terminate Process, or terminate Thread (boipt)? i

As i remember some devices in dsdt return zero resources and acpi detect it as Assertion

Link to comment
Share on other sites

@Mov AX, 0xDEAD @Dietmar

please let me know what is wrong or what is missing in my configuration:

Target system (here with the letter D: because the boot was executed from another system disk):
1-Target-H470.png


Host system (the log continues by giving the input "g" but the result is the same as in my previous post):
2-Host-Q87.png

Edited by Andalu
Link to comment
Share on other sites

@Dietmar

It doesn't work.

Just a note for clarification that my disk drive with the host system configuration is the same one that worked for debugging eight months ago. I kept that drive intact precisely so as not to repeat the procedure from the beginning. At that time I no longer had the error of the symbols not found.

 

Edited by Andalu
Link to comment
Share on other sites

3 hours ago, Dietmar said:

@Andalu

So just change the debug acpi.sys and debug acpi.pdb at the place on the host system,

where it works last time

Dietmar

I don't think that will solve the problem. Inside the acpi.sys file is the path to the pdb file which is certainly different from the one already present on my disk.
So, changing the path to the folder on my disk to match the path within acpi.sys remains the easier way. I don't know if changing the hex values of acpi.sys can help.

Edited by Andalu
Link to comment
Share on other sites

13 hours ago, Andalu said:

@Mov AX, 0xDEAD @Dietmar

please let me know what is wrong or what is missing in my configuration:

Target system (here with the letter D: because the boot was executed from another system disk):

in boot.ini boot from c:\windows, strange, but OK

unfortunately your windbg print "Could't resolve error at 'ed Kd_ACPI_Mask 0xFFFFFFFF' ", i never get this error

 

I recommend:

1) set ONE directory for symbols

_NT_SYMBOL_PATH = srv*c:\ACPI\SYMBOLS*http://msdl.microsoft.com/download/symbols

c:\ACPI\SYMBOLS change to your favorite path, for example W:\Symbols4 (you must have W: on usb-drive/ other partition/etc)

place halmacpi.pdb and ntkrnlmp.pdb/ntkrpamp.pdb  at c:\ACPI\SYMBOLS\halmacpi.pdb\9875FD697ECA4BBB8A475825F6BF885E1\halmacpi.pdb, c:\ACPI\SYMBOLS\ntkrnlmp.pdb\FB6BF595C0344379B369466C1ED25FCB2\ntkrnlmp.pdb, c:\ACPI\SYMBOLS\ntkrpamp.pdb\7D6290E03E32455BB0E035E38816124F1\ntkrpamp.pdb

9875FD697ECA4BBB8A475825F6BF885E1 - internal hash of original halmacpi.dll, XP sp3 v5512, english, size= 134400

FB6BF595C0344379B369466C1ED25FCB2 - ntkrnlmp.exe, v5512, size= 2 145 280

7D6290E03E32455BB0E035E38816124F1 - ntkrpamp.exe, v5512, size= 2 023 936

 

2) auto download pdb on host PC, but halmacpi.dll/ntkrnlmp.exe/ntkrpamp.exe/hal3.dll/renamed.exe must be taken from target pc:

"C:\Program Files (x86)\Windows Kits\8.1\Debuggers\x86\symchk.exe" /v halmacpi.dll

"C:\Program Files (x86)\Windows Kits\8.1\Debuggers\x86\symchk.exe" /v ntkrnlmp.exe

"C:\Program Files (x86)\Windows Kits\8.1\Debuggers\x86\symchk.exe" /v ntkrpamp.exe
 

symchk.exe place files to _NT_SYMBOL_PATH environment path, but better recheck where files stored

3) if you place .pdb properly, you will not see "Symbol file could not be found ntkrpamp/hal3"

 

Quote

 

Setting the Component Filter Mask

There are two ways to set a component filter mask:

  • The component filter mask can be accessed in the registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Debug Print Filter. Using a registry editor, create or open this key. Under this key, create a value with the name of the desired component, in uppercase. Set it equal to the DWORD value that you wish to use as the component filter mask.

  • If a kernel debugger is active, it can access the component filter mask value by dereferencing the address stored in the symbol Kd_XXXX_Mask, where XXXX is the desired component name. You can display the value of this mask in WinDbg or KD with the dd (Display DWORD) command, or enter a new component filter mask with the ed (Enter DWORD) command. If there is a danger of symbol ambiguity, you may wish to specify this symbol as nt!Kd_XXXX_Mask.

Filter masks stored in the registry take effect during boot. Filter masks created by the debugger take effect immediately, and persist until Windows is rebooted. A value set in the registry can be overridden by the debugger, but the component filter mask will return to the value specified in the registry if the system is rebooted.

 

 

 

Edited by Mov AX, 0xDEAD
Link to comment
Share on other sites

@Mov AX, 0xDEAD

I change in acpi only the files in driver from the original acpi XP SP1 Source files against yours.

This seems to work

Dietmar

https://ufile.io/gluf73e7

EDIT: @Damnation tells me, that it gives the same Bsod A5 (0x11,0x08,..)

as the acpi.sys before. Because I set back in Source files all to the acpi.sys version before, let only the new 0007 definition,

the double name in DSDT, SSDT1 of processor may be the reason on AMD boards.

On all of my z690 boards also my acpi.sys creation above works.

I noticed, that I get the same Bsod, when I modd my DSDT on any z690 board to the old processor definition together

with the new acpi.sys. This is true for any of the new 0007 acpi.sys.

 

Edited by Dietmar
Link to comment
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
  • Recently Browsing   0 members

    • No registered users viewing this page.
×
×
  • Create New...