Figuring out what's causing specific LiveKernelEvent 144

Question

Figuring out what's causing specific LiveKernelEvent 144

Erik Johansson 0

I have had issues for a while that my USB devices simultaneously turn off for a few seconds. This can seemingly happen at any time but I have noticed that I'm getting a LiveKernelEvent 144 every time the issue occurs.

From reading up on the error, it seems like it might have something to do with USB drivers.

This is what I've tried to do so far:

Reinstall Windows 11.
Remove and reinstall graphics card drivers (Using Display Driver Uninstaller).
Update all drivers for my USB devices to what the manufacturers supply.

At this point I feel like I can't progress with my troubleshooting without knowing what causes the error. Since the error happens fairly sporadically unplugging one USB device at a time does not seem like an efficient way to go about it so I would like to know if anyone here could help me figure out the issue.

Said error report from the reliability history:

Source

Windows

Summary

Hardware error

Date

‎2023-‎08-‎05 06:56

Status

Not reported

Description

A problem with your hardware caused Windows to stop working correctly.

Problem signature

Problem Event Name: LiveKernelEvent

Code: 144

Parameter 1: 1001

Parameter 2: fffffe039451f730

Parameter 3: 0

Parameter 4: 0

OS version: 10_0_22621

Service Pack: 0_0

Product: 768_1

OS Version: 10.0.22621.2.0.0.768.101

Locale ID: 3072

Gary Nebbett 6,201 Reputation points

2023-08-05T09:46:49.64+00:00

Hello Erik,

This could be a tricky task - unless you have some experience with debugging and tracing under Windows, it might be more effective to try your less "efficient" troubleshooting strategy.

The first problem is that the "useful" data associated with the LiveKernelEvent is quickly deleted (a minidump is created from the live dump and sent to Microsoft (unless you have opted out) by the Windows Error Reporting system and then the source data is deleted).

There are a few hints/tricks to be found in the web about how to preserve the dump file, but I don't have any personal experience about their efficacy.

One could also consider using Event Tracing for Windows to get some more information about the conditions under which the problem occurs; there are several manifest based ETW providers for USB and even more TraceLogging and WPP providers. It would be difficult to know which provider(s) would be most helpful and to manage the volume of trace data if the problem is very sporadic.

My suggestion would be to explore the live dump preservation tips/hints (https://stackoverflow.com/questions/52540110/how-do-you-get-windows-error-reporting-wer-to-save-memory-dumps-for-hangs),,) and https://techcommunity.microsoft.com/t5/failover-clustering/troubleshooting-hangs-using-live-dump/ba-p/372080 look like helpful sources) and also try tracing with the Microsoft-Windows-USB-USBXHCI provider.

If you manage to obtain a dump or a trace, I would be happy to help with the analysis.

Gary
Erik Johansson 0 Reputation points

2023-08-05T13:05:19.7966667+00:00

Thanks for your quick response Gary! I've set up my system so that it will hopefully preserve a dump the next time this happens and will continue the troubleshooting from there.

Will add the new information I get in this thread, but it might take a few days for the error to happen again.

Edit: Annoyingly it happened but the report was not preserved but I can see that it is in the report archive. Have done some more changes so hopefully it works next time.

Erik Johansson 0

Ok, I may have gotten some useful information now. I did not manage to get the specific WER report folder that I wanted to stay unarchived, but I think a minidump containing what I wanted to know was actually created this time.

So for reference for anyone in the future having a similar problem: Control Panel->Security and Maintenance->Reliability History, open the error and if you're lucky a dump file is referenced in the section "Files that help describe the problem". Should also mention that I did not see this section for previous errors, so clearly something is different now.

Now to the actual error. This is the content of the analyzed minidump:


*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

BUGCODE_USB3_DRIVER (144)
This BugCheck usually happens when the USB3 core stack detects an invalid
operation being performed by a USB client. This BugCheck may also occur
due to hardware failure on a USB Boot Device.
Arguments:
Arg1: 0000000000001001, USB3_WER_BUGCODE_USBXHCI_HOST_SYSTEM_ERROR
	The xHCI controller asserted the HSE bit, which indicates a
	host system error.
Arg2: ffffba09e0267730, XHCI_LIVEDUMP_CONTEXT
Arg3: 0000000000000000, 0
Arg4: 0000000000000000, 0

Debugging Details:
------------------

*** WARNING: Check Image - Checksum mismatch - Dump: 0xafb4d, File: 0xb28e1 - C:\ProgramData\Dbg\sym\USBXHCI.SYS\DCB3F193a3000\USBXHCI.SYS

KEY_VALUES_STRING: 1

    Key  : Analysis.CPU.mSec
    Value: 1171

    Key  : Analysis.Elapsed.mSec
    Value: 1203

    Key  : Analysis.IO.Other.Mb
    Value: 0

    Key  : Analysis.IO.Read.Mb
    Value: 0

    Key  : Analysis.IO.Write.Mb
    Value: 0

    Key  : Analysis.Init.CPU.mSec
    Value: 202

    Key  : Analysis.Init.Elapsed.mSec
    Value: 9214

    Key  : Analysis.Memory.CommitPeak.Mb
    Value: 113

    Key  : Bugcheck.Code.LegacyAPI
    Value: 0x144

    Key  : Dump.Attributes.AsUlong
    Value: 18

    Key  : Dump.Attributes.KernelGeneratedTriageDump
    Value: 1

    Key  : Failure.Bucket
    Value: LKD_0x144_HOST_SYSTEM_ERROR_USBXHCI!TelemetryData_CreateReport

    Key  : Failure.Hash
    Value: {6b21322f-9427-afa9-383d-0832a823a0a1}

    Key  : Hardware.DeviceID
    Value: DEV_7A60

    Key  : Hardware.HardwareID
    Value: VEN_8086&DEV_7A60&REV_0011

    Key  : Hardware.RevisionID
    Value: REV_0011

    Key  : Hardware.VendorID
    Value: VEN_8086


BUGCHECK_CODE:  144

BUGCHECK_P1: 1001

BUGCHECK_P2: ffffba09e0267730

BUGCHECK_P3: 0

BUGCHECK_P4: 0

FILE_IN_CAB:  USBXHCI-20230826-0614.dmp

DUMP_FILE_ATTRIBUTES: 0x18
  Kernel Generated Triage Dump
  Live Generated Dump

HARDWARE_ID:  VEN_8086&DEV_7A60&REV_0011

HARDWARE_VENDOR_ID:  VEN_8086

HARDWARE_DEVICE_ID:  DEV_7A60

HARDWARE_REV_ID:  REV_0011

PROCESS_NAME:  System

STACK_TEXT:  
ffffba09`e02671b0 fffff800`93484c69     : 00000000`00000005 ffffbb0a`4961d540 fffff800`934a91e8 ffffffff`ffffffff : USBXHCI!TelemetryData_CreateReport+0xd0
ffffba09`e02676e0 fffff800`9348513c     : ffffbb0a`2defcee0 ffffba09`e0267810 ffffbb0a`2dabdd80 fffff800`4ce5c3c4 : USBXHCI!Controller_TelemetryReport+0x161
ffffba09`e02677d0 fffff800`50205aa8     : ffffbb0a`2defcde0 00000000`00000002 ffffbb0a`00000002 ffffbb0a`31402206 : USBXHCI!Controller_TelemetryReportWorker+0x28c
ffffba09`e0267850 fffff800`50206919     : ffffbb0a`31402000 ffffbb0a`2defcde0 00000000`00000000 fffff800`00000001 : Wdf01000!FxWorkItem::WorkItemHandler+0x80 [minkernel\wdf\framework\shared\core\fxworkitem.cpp @ 374] 
ffffba09`e0267890 fffff800`4ce13f30     : ffffbb0a`2e4fdd10 ffffbb0a`2e662030 00000000`00000000 00000000`00000000 : Wdf01000!FxWorkItem::WorkItemThunk+0x29 [minkernel\wdf\framework\shared\core\fxworkitem.cpp @ 439] 
ffffba09`e02678d0 fffff800`4ce176a5     : ffffbb0a`0c2c0bf0 ffffbb0a`31402080 ffffba09`e0267a40 00000000`00000000 : nt!IopProcessWorkItem+0x100
ffffba09`e0267940 fffff800`4cf24e47     : ffffbb0a`31402080 00000000`00000182 ffffbb0a`31402080 fffff800`4ce17550 : nt!ExpWorkerThread+0x155
ffffba09`e0267b30 fffff800`4d0361b4     : ffffe201`da78a180 ffffbb0a`31402080 fffff800`4cf24df0 00000000`00000000 : nt!PspSystemThreadStartup+0x57
ffffba09`e0267b80 00000000`00000000     : ffffba09`e0268000 ffffba09`e0261000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x34


SYMBOL_NAME:  USBXHCI!TelemetryData_CreateReport+d0

MODULE_NAME: USBXHCI

IMAGE_NAME:  USBXHCI.SYS

IMAGE_VERSION:  10.0.22621.2050

STACK_COMMAND:  .cxr; .ecxr ; kb

BUCKET_ID_FUNC_OFFSET:  d0

FAILURE_BUCKET_ID:  LKD_0x144_HOST_SYSTEM_ERROR_USBXHCI!TelemetryData_CreateReport

OSPLATFORM_TYPE:  x64

OSNAME:  Windows 10

FAILURE_ID_HASH:  {6b21322f-9427-afa9-383d-0832a823a0a1}

Followup:     MachineOwner
---------

My untrained eyes looked at the hardware vendor id and device id. 8086 for vendor is apparently Intel and according to them (https://edc.intel.com/content/www/es/es/design/products-and-solutions/processors-and-chipsets/700-series-chipset-family-platform-controller-hub-datasheet-volume-1-of/002/device-and-revision-id/) 7A60 seems to be the USB 3.2 ports.

My next steps will probably be to reinstall the chipset drivers, though I am fairly certain I have already done so previously. If anyone can help me interpret the above minidump information and tell me if I have made any wrong assumptions it would be greatly appreciated.

5 answers

Your answer

Gary Nebbett 6,201 Reputation points

2023-08-05T09:46:49.64+00:00

Hello Erik,

This could be a tricky task - unless you have some experience with debugging and tracing under Windows, it might be more effective to try your less "efficient" troubleshooting strategy.

The first problem is that the "useful" data associated with the LiveKernelEvent is quickly deleted (a minidump is created from the live dump and sent to Microsoft (unless you have opted out) by the Windows Error Reporting system and then the source data is deleted).

There are a few hints/tricks to be found in the web about how to preserve the dump file, but I don't have any personal experience about their efficacy.

One could also consider using Event Tracing for Windows to get some more information about the conditions under which the problem occurs; there are several manifest based ETW providers for USB and even more TraceLogging and WPP providers. It would be difficult to know which provider(s) would be most helpful and to manage the volume of trace data if the problem is very sporadic.

My suggestion would be to explore the live dump preservation tips/hints (https://stackoverflow.com/questions/52540110/how-do-you-get-windows-error-reporting-wer-to-save-memory-dumps-for-hangs),,) and https://techcommunity.microsoft.com/t5/failover-clustering/troubleshooting-hangs-using-live-dump/ba-p/372080 look like helpful sources) and also try tracing with the Microsoft-Windows-USB-USBXHCI provider.

If you manage to obtain a dump or a trace, I would be happy to help with the analysis.

Gary
Erik Johansson 0 Reputation points

2023-08-05T13:05:19.7966667+00:00

Thanks for your quick response Gary! I've set up my system so that it will hopefully preserve a dump the next time this happens and will continue the troubleshooting from there.

Will add the new information I get in this thread, but it might take a few days for the error to happen again.

Edit: Annoyingly it happened but the report was not preserved but I can see that it is in the report archive. Have done some more changes so hopefully it works next time.

Answer 1

LiveKernelEvent 144 is a hardware error that occurs when Windows detects a problem with your hardware 1. It is a common error that can occur due to various reasons, including outdated drivers, hardware failure, or overheating.

As you have already updated all drivers for your USB devices to what the manufacturers supply, it is possible that the error is caused by outdated or corrupted USB drivers. You can try updating your USB drivers to the latest version by following these steps:

Press Windows key + X and select Device Manager.
Expand the Universal Serial Bus controllers category.
Right-click on the USB driver and select Update driver.
Select Search automatically for updated driver software and follow the on-screen instructions.

If updating the USB drivers does not resolve the issue, you can try running a hardware diagnostic test to check for any hardware failures 1. You can also try checking your computer’s temperature using a temperature monitoring tool to ensure that it is not overheating 1.

I hope this helps you resolve the issue. Let me know if you have any further questions or concerns.

Erik Johansson 0 Reputation points

2023-08-28T19:38:13.6666667+00:00

Thank you for your suggestions and for your help!

I've done most of the things that you have listed with the exception of keeping an eye on the computer temperature. Will monitor that from now on and update this thread with any new findings.

I will also add that at this point I have replaced every USB device connected to the computer, but the error still occurs.

Answer 2

Docs 15,561

Please run the V2 log collector and post a share link into this thread using one drive, drop box, or google drive.

https://www.tenforums.com/bsod-crashes-debugging/2198-bsod-posting-instructions.html

https://www.elevenforum.com/t/bsod-posting-instructions.103/

.

--please don't forget to upvote and Accept as answer if the reply is helpful--

.

Erik Johansson 0 Reputation points

2023-08-29T15:03:49.0033333+00:00

Here is a link to what was generated when I ran the log collector: https://www.dropbox.com/scl/fi/jlztqk05m2d2zzrgj4r2f/V2LOG-2023-08-29_16-53-00.zip?rlkey=iuz0j27c6ngj4omtgirvm6l3d&dl=0

Answer 3

Deleted

This answer has been deleted due to a violation of our Code of Conduct. The answer was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.

Comments have been turned off. Learn more

Answer 4

Docs 15,561

Website malfunction test.

Answer 5

Docs 15,561

The post to provide help did not appear.

This problem has continued since the website update in January 2023.

It's unknown when it may appear or it will ever appear.

Share via

Figuring out what's causing specific LiveKernelEvent 144

5 answers

Your answer