My apologies, I failed to mention it would be too large to upload here and you'd need to upload it 3rd party.. glad you've done that.
CLOCK_WATCHDOG_TIMEOUT (101)
This indicates that an expected clock interrupt on a secondary processor, in a multi-processor system, was not received within the allocated interval.
Code:
BugCheck 101, {[COLOR=#ff0000]19[/COLOR], 0, [COLOR=#4b0082]fffff880009b2180[/COLOR], 4}
19 clock ticks in regards to the timeout.
fffff880009b2180 is the PRCB address of the hung processor, let's keep this address in mind.
Code:
0: kd> !prcb 4
PRCB for Processor 4 at [COLOR=#4b0082]fffff880009b2180[/COLOR]:
Current IRQL -- 0
Threads-- Current fffffa8009d9fb50 Next fffffa8009db2b50 Idle fffff880009bd0c0
Processor Index 4 Number (0, 4) GroupSetMember 10
Interrupt Count -- 0004f42c
Times -- Dpc 00000003 Interrupt 0000000b
Kernel 00009214 User 0000215e
As this matches the 3rd parameter of the bug check, processor #4 is the responsible processor. Now with the information we have here thus far, we know that processor #4 reached 19 clock ticks without responding, therefore the system crashed. Before we go further, what is a clock tick? A clock interrupt is a form of interrupt which involves counting the the cycles of the processor core, which is running a clock on the processors to keep them all in sync. A clock interrupt is handed out to all processors and then they must report in, and when one doesn't report in, you then crash.
Code:
0: kd> kv
Child-SP RetAddr : Args to Child : Call Site
fffff800`00b9c138 fffff800`02b1fa4a : 00000000`00000101 00000000`00000019 00000000`00000000 fffff880`009b2180 : nt!KeBugCheckEx
fffff800`00b9c140 fffff800`02ad26f7 : fffffa80`00000000 fffff800`00000004 00000000`00026160 fffffa80`0a840080 : nt! ?? ::FNODOBFM::`string'+0x4e3e
fffff800`00b9c1d0 fffff800`02a14895 : fffff800`02a3a460 fffff800`00b9c380 fffff800`02a3a460 fffff800`00000000 : nt!KeUpdateSystemTime+0x377
fffff800`00b9c2d0 fffff800`02ac5113 : 00000000`215e4830 fffff800`00b9c380 fffff800`00b9c548 00000000`00b9c600 : hal!HalpHpetClockInterrupt+0x8d
fffff800`00b9c300 fffff800`02af9640 : fffff800`00b9cc58 00000000`00000006 fffffa80`0a34c1a0 fffff880`01030551 : [COLOR=#ff0000]nt!KiInterruptDispatchNoLock+0x163[/COLOR] ([COLOR=#006400]TrapFrame @ fffff800`00b9c300[/COLOR])
fffff800`00b9c490 fffff800`02ad1c6e : fffffa80`0a34d3f0 00000000`00000000 fffff800`00b9c578 fffff880`0103089c : [COLOR=#ff0000]nt!KxWaitForLockOwnerShip+0x34[/COLOR]
fffff800`00b9c4c0 fffff880`0102c907 : fffff800`00b9c600 fffffa80`0a34c1a0 fffffa80`0a3721b0 fffff800`02c43e80 : [COLOR=#ff0000]nt!KeAcquireInStackQueuedSpinLockAtDpcLevel+0x7e[/COLOR]
fffff800`00b9c510 fffff800`02ad385c : fffff800`00b9c600 fffff800`00000001 00000000`00000005 00000000`00000000 :[COLOR=#ff0000] ataport!IdePortTickHandler+0xbb[/COLOR]
fffff800`00b9c570 fffff800`02ad36f6 : fffff800`02c6af70 00000000`0000b3b7 00000000`00000000 00000000`00000000 : nt!KiProcessTimerDpcTable+0x6c
fffff800`00b9c5e0 fffff800`02ad35de : 00000001`abcca40d fffff800`00b9cc58 00000000`0000b3b7 fffff800`02c47968 : nt!KiProcessExpiredTimerList+0xc6
fffff800`00b9cc30 fffff800`02ad33c7 : 00000000`6fcfedc5 00000000`0000b3b7 00000000`6fcfed8d 00000000`000000b7 : nt!KiTimerExpiration+0x1be
fffff800`00b9ccd0 fffff800`02ac08ca : fffff800`02c43e80 fffff800`02c51cc0 00000000`00000000 fffff800`02be9a90 : nt!KiRetireDpcList+0x277
fffff800`00b9cd80 00000000`00000000 : fffff800`00b9d000 fffff800`00b97000 fffff800`00b9cd40 00000000`00000000 : nt!KiIdleLoop+0x5a
Code:
0: kd> .trap fffff800`00b9c300
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffffa800a3721b0 rbx=0000000000000000 rcx=fffffa800a34d3f1
rdx=fffff88008ce6758 rsi=0000000000000000 rdi=0000000000000000
[COLOR=#ff0000]rip=fffff80002af9640[/COLOR] rsp=fffff80000b9c490 rbp=fffff80000b9c600
r8=fffff80000b9c548 r9=0000000000000001 r10=0000000000000000
r11=0000000000000002 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz na pe nc
nt!KxWaitForLockOwnerShip+0x34:
[COLOR=#ff0000]fffff800`02af9640[/COLOR] f6c101 test cl,1
Code:
0: kd> u @rip
nt!KxWaitForLockOwnerShip+0x34:
fffff800`02af9640 f6c101 test cl,1
fffff800`02af9643 75e7 [COLOR=#0000cd]jne[/COLOR] [COLOR=#0000cd]nt!KxWaitForLockOwnerShip+0x20[/COLOR] [COLOR=#0000cd](fffff800`02af962c)[/COLOR]
fffff800`02af9645 f0830c2400 lock or dword ptr [rsp],0
fffff800`02af964a 0faee8 lfence
fffff800`02af964d 8bc3 mov eax,ebx
fffff800`02af964f 488b5c2430 mov rbx,qword ptr [rsp+30h]
fffff800`02af9654 4883c420 add rsp,20h
fffff800`02af9658 5f pop rdi
ataport.sys (IDE storage port driver) calls
KeAcquireInStackQueuedSpinLockAtDpcLevel which acquired a queued spin lock as it was already running at IRQL >= DISPATCH_LEVEL. Afterwards we're waiting for lock ownership until the crash because the lock was never given up.
Great, so this is actually pretty helpful considering we know something software is causing conflicts with your IDE file system, and not allowing the release of a lock. Let's go one step further and dump the raw stack for the problematic processor (4):
Code:
4: kd> !thread
THREAD fffffa8009d9fb50 Cid 0004.0038 Teb: 0000000000000000 Win32Thread: 0000000000000000 RUNNING on processor 4
IRP List:
fffffa800bd55230: (0006,03a0) Flags: 00060a01 Mdl: fffffa800c00c2e0
Not impersonating
DeviceMap fffff8a000008c10
Owning Process fffffa8009d42890 Image: System
Attached Process N/A Image: N/A
Wait Start TickCount 45996 Ticks: 412 (0:00:00:06.427)
Context Switch Count 3412 IdealProcessor: 4
UserTime 00:00:00.000
KernelTime 00:00:01.107
Win32 Start Address nt!ExpWorkerThread (0xfffff80002ad2150)
Stack Init fffff88008ce6fb0 Current fffff8800336fed0
Base [COLOR=#4b0082]fffff88008ce7000 [/COLOR]Limit [COLOR=#0000cd]fffff88008ce1000 [/COLOR]Call 0
Priority 12 BasePriority 12 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5
Child-SP RetAddr : Args to Child : Call Site
00000000`00000000 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x0
Code:
fffff880`08ce4f18 fffff880`03fbde42*** ERROR: Module load completed but symbols could not be loaded for [COLOR=#ff0000]avgidsdrivera.sys[/COLOR]
[COLOR=#ff0000]avgidsdrivera+0x18e42[/COLOR] [COLOR=#4b0082]<-- Bingo, here's the driver -- AVG IDS Application Activity Monitor driver.[/COLOR]
fffff880`08ce4f20 fffffa80`0c75a8b0
fffff880`08ce5010 00000000`00001764
fffff880`08ce5018 fffff800`02ab741f [COLOR=#0000cd]nt!MiRebalanceNode+0x4f[/COLOR]
fffff880`08ce5020 00000000`00000000
fffff880`08ce5028 fffff800`00000000
fffff880`08ce5030 [COLOR=#ff0000]ffffffff`ffffffff[/COLOR] [COLOR=#4b0082]<--- Kernel-mode driver zeroing the memory as it's going to be visible to user-mode software (prevents leaks).[/COLOR]
fffff880`08ce5038 fffff800`02bfcd0e [COLOR=#006400]nt!ExAllocatePoolWithTag+0xfe[/COLOR] [COLOR=#4b0082]<--- Allocating a pool of memory and returning the pointer to the allocated block.[/COLOR]
fffff880`08ce5040 [COLOR=#ff0000]ffffffff`ffffffff[/COLOR] [COLOR=#4b0082]<--- Kernel-mode driver zeroing the memory as it's going to be visible to user-mode software (prevents leaks).[/COLOR]
fffff880`08ce5048 fffff800`02bfcd0e [COLOR=#006400]nt!ExAllocatePoolWithTag+0xfe[/COLOR] [COLOR=#4b0082]<--- Allocating a pool of memory and returning the pointer to the allocated block.[/COLOR]
fffff880`08ce5138 fffff800`02dc26ba [COLOR=#0000cd]nt!NtAllocateVirtualMemory+0x1cba[/COLOR] [COLOR=#4b0082]<--- A kernel-mode driver is calling this to reserve a range of its virtual address space without consuming physical storage until it is needed.[/COLOR]
1. Remove and replace AVG with Microsoft Security Essentials for temporary troubleshooting purposes as it's causing IDE file system conflicts:
AVG removal - http://www.avg.com/us-en/utilities
MSE - Microsoft Security Essentials - Microsoft Windows
2.
Code:
7: kd> lmvm asacpi
start end module name
fffff880`040fe000 fffff880`04106000 ASACPI (deferred)
Image path: \SystemRoot\system32\DRIVERS\ASACPI.sys
Image name: ASACPI.sys
Timestamp: Sun Mar 27 22:30:36 [COLOR=#ff0000]2005[/COLOR]
Asus ATK0110 ACPI Utility driver, dated from 2005. All pre-2009 versions of this driver are known to cause crashes, so please update ASAP via Asus' website -
Motherboards - P6T - ASUS
Regards,
Patrick
