Probably caused by : ntkrpamp.exe ( nt!IopProcessWorkItem+0 )
saveoncompu...@discussions.microsoft.com
2k8 Terminal Server
I get this bug check with a BSOD. It indicates "Probably caused by :
ntkrpamp.exe ( nt!IopProcessWorkItem+0 )" which translates to a hardware
driver or memory or ???
I've run several mem checks and they are sucessfull. I've updated all
drivers but no change.
It only happens when users are using ithe system.
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck E1, {81a65218, 2, 85915a48, 85915a48}
Probably caused by : ntkrpamp.exe ( nt!IopProcessWorkItem+0 )
Followup: MachineOwner
---------
2: kd> !analyze -v
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************
WORKER_THREAD_RETURNED_AT_BAD_IRQL (e1)
Arguments:
Arg1: 81a65218, address of worker routine (do ln on this to find guilty
driver)
Arg2: 00000002, IRQL returned at (should have been 0, but isn't).
Arg3: 85915a48, workitem parameter
Arg4: 85915a48, workitem address
Debugging Details:
------------------
FAULTING_IP:
nt!IopProcessWorkItem+0
81a65218 8bff mov edi,edi
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0xE1
PROCESS_NAME: System
CURRENT_IRQL: 2
LAST_CONTROL_TRANSFER: from 81881561 to 81916163
STACK_TEXT:
835edd34 81881561 000000e1 81a65218 00000002 nt!KeBugCheckEx+0x1e
835edd7c 81a1ea1c 85915a48 81fe00f6 00000000 nt!ExpWorkerThread+0x241
835eddc0 81877a3e 81881320 00000001 00000000 nt!PspSystemThreadStartup+0x9d
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16
STACK_COMMAND: .bugcheck ; kb
FOLLOWUP_IP:
nt!IopProcessWorkItem+0
81a65218 8bff mov edi,edi
SYMBOL_NAME: nt!IopProcessWorkItem+0
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrpamp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 47918b12
FAILURE_BUCKET_ID: 0xE1_nt!IopProcessWorkItem+0
BUCKET_ID: 0xE1_nt!IopProcessWorkItem+0
Followup: MachineOwner
---------
2: kd>
2: kd> ln 81a65218
(81a65218) nt!IopProcessWorkItem | (81a65256)
nt!NtQueryInformationThread
Exact matches:
nt!IopProcessWorkItem = <no type information>
Anyone want to take a stab at the cause?
Thanks,
Robert
John Lan
should exist something, fortunately.
"saveonc...@yahoo.com"
<saveoncompu...@discussions.microsoft.com> 写入消息
news:0AAF549B-B7FE-4D8C...@microsoft.com...
saveoncompu...@discussions.microsoft.com
This is the DPS but I don't know what it tells us. Do you see anything?
2: kd> dps 835eddc0
835eddc0 00000000
835eddc4 81877a3e nt!KiThreadStartup+0x16
835eddc8 81881320 nt!ExpWorkerThread
835eddcc 00000001
835eddd0 00000000
835eddd4 00000000
835eddd8 00300043
835edddc 00460034
835edde0 00320043
835edde4 00350039
835edde8 00450045
835eddec 0202027d
835eddf0 0000027f
835eddf4 00000000
835eddf8 00000000
835eddfc 00000000
835ede00 00000000
835ede04 00000000
835ede08 00001f80
835ede0c 0000ffff
835ede10 00000000
835ede14 00000000
835ede18 00000000
835ede1c 00000000
835ede20 00000000
835ede24 00000000
835ede28 00000000
835ede2c 00000000
835ede30 00000000
835ede34 00000000
835ede38 00000000
835ede3c 00000000
Thanks,
Robert
John Lan
stack,
the worker thread crash when invoked work item return, so old trace should
be
in lower address, dps (835eddc0 - 2000) continue... at least this will
display
what driver was there in most cases. Here is a dump analysis sample
http://www.dumpanalysis.org/blog/index.php/2007/07/15/interrupts-and-exceptions-explained-part-4/,
pay attention to those red parts, the author use `dds` command instead
though.
"saveonc...@yahoo.com"
<saveoncompu...@discussions.microsoft.com> 写入消息
news:E9CD2640-2DBC-4327...@microsoft.com...
saveoncompu...@discussions.microsoft.com
I ran these DPSs and followed the !locks but I still don't see the smoking
gun. Nothing seems to point to a particular driver or files.
ALSO: THE BSOD SHOWS:
WORKER_THREAD_RETURNED_AT_BAD_IRQL
STOP: 0x000000E1 (0X81A50218,0X00000002,0X85908D80,0X85908D80)
These are the suggested DPSs:
3: kd> dps (835eddc0 - 1000)
835ecdc0 835ece40
835ecdc4 81fb6491*** ERROR: Module load completed but symbols could not be
loaded for netvsc60.sys
netvsc60+0xc491
835ecdc8 8bcd050c
835ecdcc 835ece20
835ecdd0 00000004
835ecdd4 8590c018
835ecdd8 8595b950
835ecddc 00000004
835ecde0 0003decc
835ecde4 835ece64
835ecde8 81fb6491 netvsc60+0xc491
835ecdec 8bcdaecc
835ecdf0 835ece44
835ecdf4 00000004
835ecdf8 8590c018
835ecdfc 8595b5a8
835ece00 818a54e8 nt!__InterlockedIncrement
835ece04 0003dea0
835ece08 0003de68
835ece0c 8595c660
835ece10 835ece64
835ece14 00020006
835ece18 00010006
835ece1c 8595b5a8
835ece20 00000000
835ece24 0003ded8
835ece28 0003de68
835ece2c 000334e0
835ece30 00033518
835ece34 0003dea0
835ece38 0003de68
835ece3c 8595c660
3: kd> dps (835eddc0 - 2000)
835ebdc0 001d38c1
835ebdc4 61e0f9de
835ebdc8 fbcef55f
835ebdcc fd523662
835ebdd0 c1596db5
835ebdd4 0a0ebbb3
835ebdd8 7d5f285e
835ebddc eb7a1ca7
835ebde0 2f1c45c7
835ebde4 1f6e5113
835ebde8 1d4e06a0
835ebdec 882f7d62
835ebdf0 776fffd2
835ebdf4 290e5471
835ebdf8 169c2602
835ebdfc 459e5a18
835ebe00 fa4644c2
835ebe04 a695b18b
835ebe08 28a69e67
835ebe0c d52bf7cc
835ebe10 b1a81b8b
835ebe14 0554e16d
835ebe18 43e40655
835ebe1c f708d5b4
835ebe20 4e307494
835ebe24 64d05580
835ebe28 f825d7bf
835ebe2c 72c2d26d
835ebe30 6620af16
835ebe34 097c5d80
835ebe38 12f91fe2
835ebe3c 50941670