Google Groups no longer supports new Usenet posts or subscriptions. Historical content remains viewable.
Dismiss

I need help to understand a double fault

22 views
Skip to first unread message

dLopesp

unread,
Jun 30, 2009, 8:32:01 AM6/30/09
to

Hi,

thanks for your time reading my post.

I'm facing some problems to understand a IRQL_NOT_LESS_OR_EQUAL (a) BSOD
that has no mention to my driver on the stack.

Please take a look on the stack text:
STACK_TEXT:
808a3478 8083d653 badb0d00 00000100 886e9eb8 nt!KiTrap0E+0x2a7
808a34f0 8083d2b0 00000000 ffdffa40 ffdff120 nt!KiUnwaitThread+0xe
808a35a8 8083d47c 00000000 00000000 0205d8e6 nt!KiTimerExpiration+0x178
808a3600 80839b2f 00000000 0000000e 00000000 nt!KiRetireDpcList+0x65
808a3604 00000000 0000000e 00000000 00000000 nt!KiIdleLoop+0x37

After that I was instructed to run the "dps esp - 3000 esp + 3000" command
which resulted in (irrelevant part suppressed):

808a33dc 808a3400 nt!KiDoubleFaultStack+0x2b50
808a33e0 8947b6d8
808a33e4 00000002
808a33e8 808a3440 nt!KiDoubleFaultStack+0x2b90
808a33ec 89793a00
808a33f0 8089b8b5 nt!ExFreePoolWithTag+0x810
808a33f4 0000f4ec
808a33f8 892cf428
808a33fc 8089b708 nt!ExFreePoolWithTag
808a3400 80a7e44b hal!KfReleaseSpinLock+0xb
808a3404 bac2aa97 wdf01000!FxSpinLock::ReleaseLock+0x184
808a3408 892cf400
808a340c 00000000
808a3410 ffdff120
808a3414 00000000
808a3418 00000002
808a341c 00000001
808a3420 c0300000
808a3424 c0000000
808a3428 80801a6c nt!MmAccessFault+0x278
808a342c 00000001
808a3430 88bdd630
808a3434 808a34f0 nt!KiDoubleFaultStack+0x2c40
808a3438 808b9802 nt!KiTimerTableLock+0x342
808a343c 808a3458 nt!KiDoubleFaultStack+0x2ba8
808a3440 8083d60c nt!KiExitDispatcher+0x130
808a3444 c0000000
808a3448 886e9e90
808a344c 00000000
808a3450 fffe7960
808a3454 0000bb40
808a3458 808a3478 nt!KiDoubleFaultStack+0x2bc8
808a345c 80836de5 nt!KiTrap0E+0x2a7
808a3460 0000000a
808a3464 00000001
808a3468 d000001b
808a346c 00000000
808a3470 8083d653 nt!KiUnwaitThread+0xe
808a3474 808a3478 nt!KiDoubleFaultStack+0x2bc8
808a3478 808a34f0 nt!KiDoubleFaultStack+0x2c40
808a347c 8083d653 nt!KiUnwaitThread+0xe
808a3480 badb0d00
808a3484 00000100
808a3488 886e9eb8
808a348c 808a349c nt!KiDoubleFaultStack+0x2bec
808a3490 babde091 wdf01000!imp_WdfTimerStart+0x2f
808a3494 fffe7960
808a3498 ffffffff
808a349c 808a34bc nt!KiDoubleFaultStack+0x2c0c
808a34a0 baba7314 mydriver!MyDriverTimerRoutine+0xcc [C:\myTimers.c @ 352]
808a34a4 00000000
808a34a8 886e0000
808a34ac fffe0023
808a34b0 ffff0023
808a34b4 00000100
808a34b8 88bdd630
808a34bc 00000001
808a34c0 babfbf10 wdf01000!FxTimer::TimerHandler+0x63
808a34c4 ffffffff
808a34c8 808a0030 nt!KdPitchDebugger+0x2788
808a34cc 88bdd6a8
808a34d0 88bdd630
808a34d4 00000000
808a34d8 808a34f0 nt!KiDoubleFaultStack+0x2c40
808a34dc 00000000
808a34e0 8083d653 nt!KiUnwaitThread+0xe
808a34e4 00000008
808a34e8 00010206
808a34ec 88bdd6a0
808a34f0 808a35a8 nt!KiDoubleFaultStack+0x2cf8
808a34f4 8083d2b0 nt!KiTimerExpiration+0x178
808a34f8 00000000
808a34fc ffdffa40
808a3500 ffdff120
808a3504 00000000
808a3508 88c75238
808a350c babfbf1a wdf01000!FxTimer::FxTimerDpcThunk
808a3510 88c751d8
808a3514 8874dfa8
808a3518 babfbf1a wdf01000!FxTimer::FxTimerDpcThunk
808a351c 8874df48
808a3520 8931cb58
808a3524 babfbf1a wdf01000!FxTimer::FxTimerDpcThunk
808a3528 8931caf8
808a352c 886e9eb8
808a3530 babfbf1a wdf01000!FxTimer::FxTimerDpcThunk
808a3534 886e9e58
808a3538 f7aa4044
808a353c 892cf428
808a3540 89352860
808a3544 808a3564 nt!KiDoubleFaultStack+0x2cb4
808a3548 000000e7
808a354c 89352860
808a3550 808a3560 nt!KiDoubleFaultStack+0x2cb0
808a3554 808a3570 nt!KiDoubleFaultStack+0x2cc0
808a3558 80a8057e hal!HalEndSystemInterrupt+0x6e
808a355c 00000510
808a3560 808a3570 nt!KiDoubleFaultStack+0x2cc0
808a3564 8083c604 nt!KeUpdateSystemTime+0x104
808a3568 00000000
808a356c 00000000
808a3570 00000000
808a3574 f7549ca2 intelppm!AcpiC1Idle+0x12
808a3578 badb0d00
808a357c ffdff120
808a3580 6e558c0e
808a3584 01c9f48c
808a3588 f0e4af36
808a358c 0000000d
808a3590 000000e6
808a3594 00000e60
808a3598 00000017
808a359c 00000003
808a35a0 00000000
808a35a4 00000000
808a35a8 808a3600 nt!KiDoubleFaultStack+0x2d50
808a35ac 8083d47c nt!KiRetireDpcList+0x65
808a35b0 00000000
808a35b4 00000000
808a35b8 0205d8e6
808a35bc 00000000
808a35c0 88611628
808a35c4 808a68c0 nt!KiInitialThread
808a35c8 ffdff000
808a35cc ffdffee0
808a35d0 808a3600 nt!KiDoubleFaultStack+0x2d50
808a35d4 00000000
808a35d8 808a3600 nt!KiDoubleFaultStack+0x2d50
808a35dc 00000000
808a35e0 00000000
808a35e4 ffdffee0
808a35e8 ffdff120
808a35ec ffdff000
808a35f0 88611628
808a35f4 808a68c0 nt!KiInitialThread
808a35f8 00000000
808a35fc 00000000
808a3600 808a6b40 nt!KiInitialProcess
808a3604 80839b2f nt!KiIdleLoop+0x37

And this is the faulting code (C:\myTimers.c @ 352):

// Resetting timer
if (pDeviceContext->deviceTimer)
{
WdfTimerStart(pDeviceContext->deviceTimer, PERIOD_10_MS);
}

Does anyone have a clue on what might cause that double fault?
Thanks again.
Douglas

Pavel A.

unread,
Jun 30, 2009, 1:06:40 PM6/30/09
to

Probably I was wrong when suggested a double fault.
It doesn't really looks so.

--pa

Scott Noone

unread,
Jun 30, 2009, 1:47:40 PM6/30/09
to

Hi,

What's the full !analyze -v output? Looks to me like you might have trashed
your timer object somehow (freed it while active maybe?), I suggest you
enable Driver Verifier and WdfVerifier on your driver and see if you get any
errors.

-scott

--
Scott Noone
Consulting Associate
OSR Open Systems Resources, Inc.
http://www.osronline.com


"dLopesp" <dLo...@discussions.microsoft.com> wrote in message
news:1538057F-3AE5-4E99...@microsoft.com...

dLopesp

unread,
Jul 1, 2009, 1:14:01 PM7/1/09
to

Hi Scott,

This is the full BSOD analysis from the dump:

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 00000001, memory referenced
Arg2: d000001b, IRQL
Arg3: 00000000, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on
chips which support this level of status)
Arg4: 8083d653, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS: 00000001

CURRENT_IRQL: 1b

FAULTING_IP:
nt!KiUnwaitThread+e
8083d653 8b08 mov ecx,dword ptr [eax]

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0xA

PROCESS_NAME: Idle

TRAP_FRAME: 808a3478 -- (.trap 0xffffffff808a3478)
ErrCode = 00000000
eax=00000001 ebx=00000000 ecx=88bdd630 edx=00000100 esi=88bdd630 edi=88bdd6a8
eip=8083d653 esp=808a34ec ebp=808a34f0 iopl=0 nv up ei pl nz na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010206
nt!KiUnwaitThread+0xe:
8083d653 8b08 mov ecx,dword ptr [eax]
ds:0023:00000001=????????
Resetting default scope

LAST_CONTROL_TRANSFER: from 8083d653 to 80836de5

STACK_TEXT:
808a3478 8083d653 badb0d00 00000100 886e9eb8 nt!KiTrap0E+0x2a7
808a34f0 8083d2b0 00000000 ffdffa40 ffdff120 nt!KiUnwaitThread+0xe
808a35a8 8083d47c 00000000 00000000 0205d8e6 nt!KiTimerExpiration+0x178
808a3600 80839b2f 00000000 0000000e 00000000 nt!KiRetireDpcList+0x65
808a3604 00000000 0000000e 00000000 00000000 nt!KiIdleLoop+0x37


STACK_COMMAND: kb

FOLLOWUP_IP:
nt!KiUnwaitThread+e
8083d653 8b08 mov ecx,dword ptr [eax]

SYMBOL_STACK_INDEX: 1

SYMBOL_NAME: nt!KiUnwaitThread+e

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 45ec14ca

FAILURE_BUCKET_ID: 0xA_nt!KiUnwaitThread+e

BUCKET_ID: 0xA_nt!KiUnwaitThread+e

Followup: MachineOwner
---------

Should it be a problem if I compile my driver on Windows Vista build
environment to run it on Windows 2003?

Scott, this problem only happens no my windows 2003 machine. The same driver
is running on windows vista (both 32 and 64bit version) with no problem.

Do you have anything else in mind?

Thanks,
Douglas

Volodymyr Shcherbyna

unread,
Jul 2, 2009, 5:38:06 AM7/2/09
to

"dLopesp" <dLo...@discussions.microsoft.com> wrote in message
news:B8E78365-7BB8-410F...@microsoft.com...

> Should it be a problem if I compile my driver on Windows Vista build
> environment to run it on Windows 2003?

Theoretically could be, but practically ... If you would compile driver for
Vista and compiler would put unknown kernel routine which does not exist in
2003 Server kernel, you driver simply would not load (i.e., DriverEntry not
called, and error is written into Even Log).

> Scott, this problem only happens no my windows 2003 machine. The same
> driver
> is running on windows vista (both 32 and 64bit version) with no problem.

As many suggested here, setup verifier and make tests. It should give you
enough information about the problem. If I would met such problem, I would
setup verifier, and if this would not help, I would setup verifier and
Windows 2003 Checked/Debug build. It does not take much time, 1 hour to
setup machine and you, hopefully, will have more information.

I hope this helps,

--
Volodymyr M. Shcherbyna, blog: http://www.shcherbyna.com/
(This posting is provided "AS IS" with no warranties, and confers no
rights)


dLopesp

unread,
Jul 2, 2009, 9:21:02 AM7/2/09
to

Thanks for your time Mr. Volodymyr.

I ran my driver compiled in a Windows Server 2003 Checked environment for
more than 22 hours. When I was about to stop my test scenario I got the
following BSOD:

BugCheck 8E, {c0000005, ba949ac9, b82a99b4, 0}

Page 75bb4 not present in the dump file. Type ".hh dbgerr004" for details
Page 71c76 not present in the dump file. Type ".hh dbgerr004" for details
PEB is paged out (Peb.Ldr = 7ffd400c). Type ".hh dbgerr001" for details
PEB is paged out (Peb.Ldr = 7ffd400c). Type ".hh dbgerr001" for details
Probably caused by : mydriver.sys ( mydriver!WdfRequestSetInformation+1a )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************

KERNEL_MODE_EXCEPTION_NOT_HANDLED (8e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: ba949ac9, The address that the exception occurred at
Arg3: b82a99b4, Trap Frame
Arg4: 00000000

Debugging Details:
------------------

Page 75bb4 not present in the dump file. Type ".hh dbgerr004" for details
Page 71c76 not present in the dump file. Type ".hh dbgerr004" for details
PEB is paged out (Peb.Ldr = 7ffd400c). Type ".hh dbgerr001" for details
PEB is paged out (Peb.Ldr = 7ffd400c). Type ".hh dbgerr001" for details

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - A instru o no "0x%08lx" fez refer
ncia mem ria no "0x%08lx". A mem ria n o p de ser "%s".

FAULTING_IP:
wdf01000!FxRequest::SetInformation+69
ba949ac9 89481c mov dword ptr [eax+1Ch],ecx

TRAP_FRAME: b82a99b4 -- (.trap 0xffffffffb82a99b4)
ErrCode = 00000002
eax=00000000 ebx=89818730 ecx=00000000 edx=89818730 esi=886e8d00 edi=89818678
eip=ba949ac9 esp=b82a9a28 ebp=b82a9a30 iopl=0 nv up ei pl zr na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010246
wdf01000!FxRequest::SetInformation+0x69:
ba949ac9 89481c mov dword ptr [eax+1Ch],ecx
ds:0023:0000001c=????????
Resetting default scope

DEFAULT_BUCKET_ID: INTEL_CPU_MICROCODE_ZERO

BUGCHECK_STR: 0x8E

PROCESS_NAME: testaplication.exe

CURRENT_IRQL: 0

LAST_CONTROL_TRANSFER: from 8085bba7 to 8087c480

STACK_TEXT:
b82a9580 8085bba7 0000008e c0000005 ba949ac9 nt!KeBugCheckEx+0x1b
b82a9944 808346b4 b82a9960 00000000 b82a99b4 nt!KiDispatchException+0x3a2
b82a99ac 80834668 b82a9a30 ba949ac9 badb0d00 nt!CommonDispatchException+0x4a
b82a99cc 80a801ae 00000000 8980b800 00000202 nt!Kei386EoiHelper+0x186
b82a9a30 ba9358ac 00000000 00000000 886e8d54
hal!HalpDispatchSoftwareInterrupt+0x5e
b82a9a48 ba8eb2ca 886e8d00 779172f8 00000000
wdf01000!imp_WdfRequestSetInformation+0x7c
b82a9a5c ba8f4c47 779172f8 00000000 00000000
mydriver!WdfRequestSetInformation+0x1a
[c:\winddk\6001.18001\inc\wdf\kmdf\1.7\wdfrequest.h @ 1277]
b82a9a8c ba95b45b 779172f8 8980b7f0 886e8d00
mydriver!MyDriverEvtRequestCancel+0x157 [d:\myDriverUtil.c @ 1575]
b82a9aa4 ba95d573 00000000 779172f8 8980b7f0
wdf01000!FxRequestCancelAndCompletion::InvokeCancel+0x2f
b82a9acc ba95ed95 b82a9af4 00000000 8980b7f0
wdf01000!FxIoQueue::ProcessCancelledRequests+0x15b
b82a9aec ba960929 8980b700 8980b7f0 885f4cb0
wdf01000!FxIoQueue::DispatchEvents+0x2c6
b82a9b08 ba961b4b 885f4cb0 ba986188 89818678
wdf01000!FxIoQueue::QueueRequestFromForward+0x1e3
b82a9b2c ba943972 8980c640 885f4cb0 767f39b8
wdf01000!FxPkgIo::EnqueueRequest+0x21d
b82a9b40 ba8f4eea 885f4cb0 8980c640 77a0b348
wdf01000!imp_WdfDeviceEnqueueRequest+0x49
b82a9b54 ba8f4f38 767f39b8 77a0b348 898110d8
mydriver!WdfDeviceEnqueueRequest+0x1a
[c:\winddk\6001.18001\inc\wdf\kmdf\1.7\wdfdevice.h @ 3181]
b82a9b68 ba96172f 767f39b8 77a0b348 8980bc10
mydriver!MyDriverEvtIoInCallerContext+0x38 [d:\myDriverUtil.c @ 1772]
b82a9b90 ba940fbc 898c9e60 8980bc10 0000000e wdf01000!FxPkgIo::Dispatch+0x249
b82a9ba8 ba8f50ca 8980c640 767f39b8 898c9e60
wdf01000!imp_WdfDeviceWdmDispatchPreprocessedIrp+0xf1
b82a9bbc ba8f509b 767f39b8 898c9e60 b82a9c14
mydriver!WdfDeviceWdmDispatchPreprocessedIrp+0x1a
[c:\winddk\6001.18001\inc\wdf\kmdf\1.7\wdfdevice.h @ 1480]
b82a9be8 ba94ff4b 767f39b8 898c9e60 80a7ff00
mydriver!MyDriverEvtWdmIrpPreprocess+0x13b [d:\myDriverUtil.c @ 1866]
b82a9c08 ba950618 898c9e60 b82a9c44 809d657d
wdf01000!FxDevice::PreprocessIrp+0x7b
b82a9c14 809d657d 8980bc10 898c9e60 898c9e60 wdf01000!FxDevice::Dispatch+0x32
b82a9c44 80859d70 8092b50f b82a9c64 8092b50f nt!IovCallDriver+0x112
b82a9c50 8092b50f 898c9ef4 8831fd20 898c9e60 nt!IofCallDriver+0x13
b82a9c64 8092b444 8980bc10 898c9e60 8831fd20
nt!IopSynchronousServiceTail+0x10b
b82a9d00 8092b564 00002778 00000000 00000000 nt!IopXxxControlFile+0x60f
b82a9d34 80833bdf 00002778 00000000 00000000 nt!NtDeviceIoControlFile+0x2a
b82a9d34 7c8285ec 00002778 00000000 00000000 nt!KiFastCallEntry+0xfc
WARNING: Frame IP not in any known module. Following frames may be wrong.
0012fa0c 00000000 00000000 00000000 00000000 0x7c8285ec


STACK_COMMAND: kb

FOLLOWUP_IP:
mydriver!WdfRequestSetInformation+1a
[c:\winddk\6001.18001\inc\wdf\kmdf\1.7\wdfrequest.h @ 1277]
ba8eb2ca 5d pop ebp

FAULTING_SOURCE_CODE:
1273: ULONG_PTR Information
1274: )
1275: {
1276: ((PFN_WDFREQUESTSETINFORMATION)
WdfFunctions[WdfRequestSetInformationTableIndex])(WdfDriverGlobals, Request,
Information);
> 1277: }
1278:
1279: //
1280: // WDF Function: WdfRequestGetInformation
1281: //
1282: typedef


SYMBOL_STACK_INDEX: 6

SYMBOL_NAME: mydriver!WdfRequestSetInformation+1a

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: mydriver

IMAGE_NAME: mydriver.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 4a4b58a8

FAILURE_BUCKET_ID: 0x8E_VRF_mydriver!WdfRequestSetInformation+1a

BUCKET_ID: 0x8E_VRF_mydriver!WdfRequestSetInformation+1a

Followup: MachineOwner
---------

Unfortunately, after analysing the dump, I was unable to understand what
caused that BSOD. This is the code on my EvtRequestCancel routine:

WdfRequestSetInformation(request, info);
WdfRequestUnmarkCancelable(request);
WdfRequestCompleteWithPriorityBoost(request,status,IO_NO_INCREMENT);

Is there a possibility of concurrency? Something like the cancel was invoked
and just after that my driver completed the request then I got back to
process the cancel request.

Thanks for all your help.
Regards,
Douglas

Volodymyr Shcherbyna

unread,
Jul 2, 2009, 9:50:59 AM7/2/09
to

Hello,

I am not sure I understand what exactly is going on in your code. As the
only thing I see is a small snippet of code and a stack trace :). However,
as I saw it, I reminded this case:
http://blogs.msdn.com/doronh/archive/2008/06/29/how-do-i-cancel-an-irp-that-another-thread-may-be-completing-at-the-same-time.aspx

> Is there a possibility of concurrency? Something like the cancel was
> invoked
> and just after that my driver completed the request then I got back to
> process the cancel request.

Yep, it can happen like this as well. But, I need to see more code to
answer. Or, at least, explain how do you process IRP and under which
condition you decide to cancel it.

--
Volodymyr M. Shcherbyna, blog: http://www.shcherbyna.com/
(This posting is provided "AS IS" with no warranties, and confers no
rights)

"dLopesp" <dLo...@discussions.microsoft.com> a écrit dans le message de
news:34881C9E-B7FB-46E8...@microsoft.com...

> __________ Information from ESET Smart Security, version of virus
> signature database 4209 (20090702) __________
>
> The message was checked by ESET Smart Security.
>
> http://www.eset.com
>
>
>


__________ Information from ESET Smart Security, version of virus signature database 4209 (20090702) __________

The message was checked by ESET Smart Security.

http://www.eset.com

dLopesp

unread,
Jul 2, 2009, 2:24:13 PM7/2/09
to

Hi Volodymyr,

I added a check to the code that was causing the BSOD. Now my driver will
only cancel the request if it is still in one of my driver's queues (meaning
the request is still in the driver since I don't remove requests from queue
while processing them). Otherwise my driver will do nothing. This is what it
looks like:

EvtCancelFunction()
{
...

if (WdfRequestGetIoQueue(request))
{
WdfRequestSetInformation(request, info);
WdfRequestUnmarkCancelable(request);
WdfRequestCompleteWithPriorityBoost(request,status,IO_NO_INCREMENT);
}

// end of EvtCancelFunction()
}

The good news is that with this modification the BSOD has not happened.
The bad news is that my test application is stucked. It looks like the
request that was not cancelled is stucked in my driver preventing my
application to close successfully.

Can anyone propose a more elegant (and efficient) solution?

Thanks for your colaboration.
Best regards,
Douglas

dLopesp

unread,
Jul 2, 2009, 4:34:00 PM7/2/09
to

Hi,

unfortunately, there is something else wrong with my driver (or with my
machine/board):

Please, take a look in the kernel dump analysis:

Could anyone take help me to understand this? After googling about this
error code I saw that this error might be related to overclocking (which is
not the case) or bad motherboards.

I'm kind of lost here.
Thanks for any help.
Regards,
Douglas

dLopesp

unread,
Jul 2, 2009, 4:37:01 PM7/2/09
to

Forgot to include kernel dump:

"dLopesp" wrote:

> Hi,
>
> unfortunately, there is something else wrong with my driver (or with my
> machine/board):
>
> Please, take a look in the kernel dump analysis:

BugCheck 9C, {0, 808a07a0, b2000000, 1040080f}

PEB is paged out (Peb.Ldr = 7ffdc00c). Type ".hh dbgerr001" for details
PEB is paged out (Peb.Ldr = 7ffdc00c). Type ".hh dbgerr001" for details
Probably caused by : Unknown_Image ( ANALYSIS_INCONCLUSIVE )

Followup: MachineOwner
---------

0: kd> !analyze -v


*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************

MACHINE_CHECK_EXCEPTION (9c)
A fatal Machine Check Exception has occurred.
KeBugCheckEx parameters;
x86 Processors
If the processor has ONLY MCE feature available (For example Intel
Pentium), the parameters are:
1 - Low 32 bits of P5_MC_TYPE MSR
2 - Address of MCA_EXCEPTION structure
3 - High 32 bits of P5_MC_ADDR MSR
4 - Low 32 bits of P5_MC_ADDR MSR
If the processor also has MCA feature available (For example Intel
Pentium Pro), the parameters are:
1 - Bank number
2 - Address of MCA_EXCEPTION structure
3 - High 32 bits of MCi_STATUS MSR for the MCA bank that had the error
4 - Low 32 bits of MCi_STATUS MSR for the MCA bank that had the error
IA64 Processors
1 - Bugcheck Type
1 - MCA_ASSERT
2 - MCA_GET_STATEINFO
SAL returned an error for SAL_GET_STATEINFO while processing
MCA.
3 - MCA_CLEAR_STATEINFO
SAL returned an error for SAL_CLEAR_STATEINFO while
processing MCA.
4 - MCA_FATAL
FW reported a fatal MCA.
5 - MCA_NONFATAL
SAL reported a recoverable MCA and we don't support currently
support recovery or SAL generated an MCA and then couldn't
produce an error record.
0xB - INIT_ASSERT
0xC - INIT_GET_STATEINFO
SAL returned an error for SAL_GET_STATEINFO while
processing INIT event.
0xD - INIT_CLEAR_STATEINFO
SAL returned an error for SAL_CLEAR_STATEINFO while
processing INIT event.
0xE - INIT_FATAL
Not used.
2 - Address of log
3 - Size of log
4 - Error code in the case of x_GET_STATEINFO or x_CLEAR_STATEINFO
AMD64 Processors
1 - Bank number
2 - Address of MCA_EXCEPTION structure
3 - High 32 bits of MCi_STATUS MSR for the MCA bank that had the error
4 - Low 32 bits of MCi_STATUS MSR for the MCA bank that had the error
Arguments:
Arg1: 00000000
Arg2: 808a07a0
Arg3: b2000000
Arg4: 1040080f

Debugging Details:
------------------

NOTE: This is a hardware error. This error was reported by the CPU
via Interrupt 18. This analysis will provide more information about
the specific error. Please contact the manufacturer for additional
information about this error and troubleshooting assistance.

This error is documented in the following publication:

- IA-32 Intel(r) Architecture Software Developer's Manual
Volume 3: System Programming Guide

Bit Mask:

MA Model Specific MCA
O ID Other Information Error Code Error Code
VV SDP ___________|____________ _______|_______ _______|______
AEUECRC| | | |
LRCNVVC| | | |
^^^^^^^| | | |
6 5 4 3 2 1
3210987654321098765432109876543210987654321098765432109876543210
----------------------------------------------------------------
1011001000000000000000000000000000010000010000000000100000001111


VAL - MCi_STATUS register is valid
Indicates that the information contained within the IA32_MCi_STATUS
register is valid. When this flag is set, the processor follows the
rules given for the OVER flag in the IA32_MCi_STATUS register when
overwriting previously valid entries. The processor sets the VAL
flag and software is responsible for clearing it.

UC - Error Uncorrected
Indicates that the processor did not or was not able to correct the
error condition. When clear, this flag indicates that the processor
was able to correct the error condition.

EN - Error Enabled
Indicates that the error was enabled by the associated EEj bit of the
IA32_MCi_CTL register.

PCC - Processor Context Corrupt
Indicates that the state of the processor might have been corrupted
by the error condition detected and that reliable restarting of the
processor may not be possible.

BUSCONNERR - Bus and Interconnect Error BUS{LL}_{PP}_{RRRR}_{II}_{T}_err
These errors match the format 0000 1PPT RRRR IILL

Concatenated Error Code:
--------------------------
_VAL_UC_EN_PCC_BUSCONNERR_F

This error code can be reported back to the manufacturer.
They may be able to provide additional information based upon
this error. All questions regarding STOP 0x9C should be
directed to the hardware manufacturer.
PEB is paged out (Peb.Ldr = 7ffdc00c). Type ".hh dbgerr001" for details
PEB is paged out (Peb.Ldr = 7ffdc00c). Type ".hh dbgerr001" for details

BUGCHECK_STR: 0x9C_GenuineIntel

DEFAULT_BUCKET_ID: DRIVER_FAULT

PROCESS_NAME: testapplication.exe

CURRENT_IRQL: 0

LAST_CONTROL_TRANSFER: from 80a84154 to 8087c480

STACK_TEXT:
808a0770 80a84154 0000009c 00000000 808a07a0 nt!KeBugCheckEx+0x1b
808a08a4 80a7b86f 80042000 00000000 00000000 hal!HalpMcaExceptionHandler+0x11e
808a08a4 10216177 80042000 00000000 00000000
hal!HalpMcaExceptionHandlerWrapper+0x77


WARNING: Frame IP not in any known module. Following frames may be wrong.

0770fd80 00000000 00000000 00000000 00000000 0x10216177


STACK_COMMAND: kb

SYMBOL_NAME: ANALYSIS_INCONCLUSIVE

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: Unknown_Module

IMAGE_NAME: Unknown_Image

DEBUG_FLR_IMAGE_TIMESTAMP: 0

FAILURE_BUCKET_ID: 0x9C_GenuineIntel_VRF_ANALYSIS_INCONCLUSIVE

BUCKET_ID: 0x9C_GenuineIntel_VRF_ANALYSIS_INCONCLUSIVE

Followup: MachineOwner
---------

Volodymyr Shcherbyna

unread,
Jul 3, 2009, 4:03:39 AM7/3/09
to

Try to show raw stack, and if you have several CPU's on machine, switch to
different cpu stack (Alt + F9), as the second CPU stack might be also
useful. The only thing which is obvious from your dump is that it is caused
by machine check exception code which is calling HalHandleMcheck and it all
ends up like this.

So, try to get raw stack, and put it here. Does this issue came out only at
one particular 2k03 machine? Or it is repeatable on other machines?

--
Volodymyr M. Shcherbyna, blog: http://www.shcherbyna.com/
(This posting is provided "AS IS" with no warranties, and confers no
rights)
"dLopesp" <dLo...@discussions.microsoft.com> a écrit dans le message de

news:EBDBAB3B-3FB9-4483...@microsoft.com...

> __________ Information from ESET Smart Security, version of virus

> signature database 4210 (20090702) __________


>
> The message was checked by ESET Smart Security.
>
> http://www.eset.com
>
>
>


__________ Information from ESET Smart Security, version of virus signature database 4211 (20090702) __________

Volodymyr Shcherbyna

unread,
Jul 3, 2009, 4:10:36 AM7/3/09
to

> Try to show raw stack, and if you have several CPU's on machine, switch to
> different cpu stack (Alt + F9),

Sorry, Alt + 9

--
Volodymyr M. Shcherbyna, blog: http://www.shcherbyna.com/
(This posting is provided "AS IS" with no warranties, and confers no
rights)

"Volodymyr Shcherbyna" <v_sch...@online.mvps.org> a écrit dans le message
de news:eB4nNT7%23JHA...@TK2MSFTNGP05.phx.gbl...

Tim Roberts

unread,
Jul 3, 2009, 2:09:30 PM7/3/09
to

dLopesp <dLo...@discussions.microsoft.com> wrote:
>
>Forgot to include kernel dump:
>...

>MACHINE_CHECK_EXCEPTION (9c)
>A fatal Machine Check Exception has occurred.

This is a hardware problem: memory failure, bus parity error, processor
malfunction, etc.

Of course, it can also be triggered by a process randomly overwriting
memory. That kind of thing is nearly impossible to chase down.
--
Tim Roberts, ti...@probo.com
Providenza & Boekelheide, Inc.

0 new messages