re: BSOD Chrome & FF while using Flash - Windows 7 x64
My apologies, I clicked on the perfmon report thinking it was one link but the zip folder that contains the dumps was in the other link.
Anyway, this is interesting.
I'm actually unsure about the cause at the moment.
So, we have our standard common bugcheck, 0xA...
Code:
BugCheck A, {[COLOR="#FF0000"]fffff88002f9db30[/COLOR], [COLOR="#800080"]d[/COLOR], 0, [COLOR="#008000"]fffff80002e9019c[/COLOR]}
Invalid memory was referenced at an IRQL too high, in fact the IRQL was at D which is 13 in hexadecimal which is the clock level IRQL, this is used to send out a clock interrupt to synchronise the processors or update the system time, which is what is being done here.
Code:
fffff880`02f8d6b8 fffff800`02e84169 : 00000000`0000000a fffff880`02f9db30 00000000`0000000d 00000000`00000000 : [COLOR="#0000FF"]nt!KeBugCheckEx[/COLOR]
fffff880`02f8d6c0 fffff800`02e82de0 : fffff880`02f69fc0 00000000`00000022 fffff880`02f8d920 fffff880`02f65180 : [COLOR="#0000FF"]nt!KiBugCheckDispatch+0x69[/COLOR]
fffff880`02f8d800 fffff800`02e9019c : fffff800`0315e000 fffff880`02f70040 00000000`00002711 fffffa80`06549300 : [COLOR="#FF0000"]nt!KiPageFault+0x260[/COLOR]
fffff880`02f8d990 fffff800`02e8ff41 : 00000000`00000000 fffff880`02f8da40 fffff880`02f65180 00000000`00000001 : [COLOR="#FF0000"]nt!KeUpdateRunTime+0x9c[/COLOR]
fffff880`02f8d9c0 fffff880`11fae7f2 : fffff800`02e8d709 00000000`00342834 fffffa80`06549448 fffff880`02f70040 : [COLOR="#800080"]nt!KiSecondaryClockInterrupt+0x131[/COLOR]
fffff880`02f8db58 fffff800`02e8d709 : 00000000`00342834 fffffa80`06549448 fffff880`02f70040 00000000`00000001 : amdppm!C1Halt+0x2
fffff880`02f8db60 fffff800`02e7c89c : fffff880`02f65180 fffff880`00000000 00000000`00000000 fffff880`06c7b588 : nt!PoIdle+0x52a
fffff880`02f8dc40 00000000`00000000 : fffff880`02f8e000 fffff880`02f88000 fffff880`02f8dc00 00000000`00000000 : nt!KiIdleLoop+0x2c
AFAIK this is done by using a counter on an executing thread, to determine how long it has been running for it decrements a counter on the thread, when the counter reaches 0 the threads quantum expires and the kernel might need to reschedule the processor. To reschedule the processor the IRQL must be at DPC/dispatch level as this function is put into the DPC queue as the IRQL, if you remember is still at clock level so it can't service the schedule just yet.
However, a page fault has been initiated but I'm unsure why.
The KeUpdateRunTime has called into a page fault directly.
Code:
2: kd> .trap 0xfffff88002f8d800
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=000000139f0b69bd
rdx=00000000000005c0 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002e9019c rsp=fffff88002f8d990 rbp=0000000000000000
[COLOR="#800080"]r8=0000000000083e2e[/COLOR] r9=0000000000083e2e r10=00000000000263d0
r11=00000000002f5f00 [COLOR="#FF0000"]r12=0000000000000000[/COLOR] r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl zr na po nc
nt!KeUpdateRunTime+0x9c:
fffff800`02e9019c 450fb6842470010000 [COLOR="#800080"]movzx[/COLOR] [COLOR="#800080"]r8d[/COLOR],[COLOR="#00FFFF"]byte[/COLOR] ptr [[COLOR="#FF0000"]r12+170h[/COLOR]] ds:[COLOR="#FF0000"]00000000`00000170[/COLOR]=??
So a move with zero extend function was called to move a byte value from r8 to an address that equals the value of the r12 register + 170 which results in a memory write to 0x170 which is completely invalid.
But what I'm failing to understand is that fffff88002f9db30 supposedly caused the page fault which results in a bugcheck.
I suspect it's due to the context not being fully saved.
We then have the exact same bugcheck with the same parameters (so the memory being referenced was the same with the same function)
That's never good... Driver Verifier is also enabled.
Code:
2: kd> [COLOR="#008000"]!verifier[/COLOR]
Verify Flags Level 0x00000fbb
STANDARD FLAGS:
[COLOR="#FF0000"] [X] (0x00000000) Automatic Checks
[X] (0x00000001) Special pool
[X] (0x00000002) Force IRQL checking
[X] (0x00000008) Pool tracking
[X] (0x00000010) I/O verification
[X] (0x00000020) Deadlock detection
[X] (0x00000080) DMA checking
[X] (0x00000100) Security checks
[X] (0x00000800) Miscellaneous checks[/COLOR]
ADDITIONAL FLAGS:
[ ] (0x00000004) Randomized low resources simulation
[COLOR="#FF0000"] [X] (0x00000200) Force pending I/O requests[/COLOR]
[COLOR="#FF0000"] [X] (0x00000400) IRP logging[/COLOR]
[B][COLOR="#FF0000"] [X] Indicates flag is enabled[/COLOR][/B]
Looks like we're dealing with a hardware issue here.
Code:
BugCheck 3B, {[COLOR="#FF0000"]c0000005[/COLOR], [COLOR="#008000"]fffff80002ef9f36[/COLOR], [COLOR="#800080"]fffff880039edd30[/COLOR], 0}
We're seeing some bad memory corruption here, the trap frame wasn't even saved properly.
Code:
4: kd> .cxr 0xfffff880039edd30;r
rax=00000000fffffdde rbx=fffff6b2db32dab0 rcx=0000000000000b76
rdx=0000000000065bd8 rsi=0000000000065bd8 rdi=0000000000065bd6
rip=fffff80002ef9f36 rsp=fffff880039ee710 rbp=65b765b665b565b4
r8=0000000000000001 r9=0000000000000000 r10=fffff880009b3b20
r11=00000000000065ad r12=0000000000000200 r13=0000000000000800
r14=0000000008000000 r15=0000000000000002
iopl=0 nv up ei pl zr na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010246
nt!MmUnlockPages+0xc6:
fffff800`02ef9f36 664121460a [COLOR="#800080"]and[/COLOR] [COLOR="#00FFFF"]word[/COLOR] ptr [[COLOR="#FF0000"]r14+0Ah[/COLOR]],ax ds:002b:[COLOR="#FF0000"]00000000`0800000a[/COLOR]=????
We're seeing an and instruction which AFAIK is to check the logic and report if both operands are true, if they are then the result is true.
It seems this is the faulting instruction, trying to unlock pages which don't exist/invalid.
How long did you run memtest86 for?
You need to run it for at leats 8 passes.
Check your temperatures as well.
I will say that I'd recommend you remove this software as it causes lotf of issues, including BSODs.
Code:
[COLOR="#FF0000"]DAEMON Tools Lite[/COLOR] "c:\program files (x86)\daemon tools lite\dtlite.exe" -autorun Shafranko-PC\Šafranko HKU\S-1-5-21-694894617-964478755-1571260234-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
My second guess is a bad CPU.
I wonder if I can find anything else with a Kernel memory dump.
Could I have one please.
Go the Start
Right click My Computer
Select Properties
Click Advanced system settings
Click on the Advanced tab
Select Settings under Startup and Recovery
Then under Write debugging information select Kernel memory dump.
Once a dump is created go to:
Copy the file to the desktop, zip it up and upload it to a file sharing site like Onedrive. After the upload is done post the download link in your next reply.
Just be careful when you read my replys.