This just gets more and more interesting, doesn't it?
ATTEMPTED_EXECUTE_OF_NOEXECUTE_MEMORY (FC)
This indicates that an attempt was made to execute non-executable memory.
Code:
0: kd> k
Child-SP RetAddr Call Site
fffff801`7ec85ad8 fffff801`7d1c0020 nt!KeBugCheckEx
fffff801`7ec85ae0 fffff801`7d1c7fe8 nt! ?? ::FNODOBFM::`string'+0x46e70
fffff801`7ec85b20 fffff801`7d065e5c nt! ?? ::FNODOBFM::`string'+0x4ee38
fffff801`7ec85b60 fffff801`7d172f2f nt!MmAccessFault+0xd9c
fffff801`7ec85ca0 ffffe001`281af000 nt!KiPageFault+0x12f // Hit a pagefault as the nVidia video driver tried to execute non-executable memory.
fffff801`7ec85e38 fffff801`4ef68a6a 0xffffe001`281af000 // Non-executable memory.
fffff801`7ec85e40 fffff801`4ef68ada nvlddmkm+0xf9a6a // nVidia video driver.
fffff801`7ec85e48 fffff801`7d058613 nvlddmkm+0xf9ada // nVidia video driver.
fffff801`7ec85e50 00000000`00000000 nt!EtwpLogKernelEvent+0x273 // It looks like something was using Event Tracing to log a kernel event. We won't be able to tell what it was without a kernel dump. Maybe nVidia?
Code:
BugCheck FC, {ffffe001281af000, 80000001000009e3, fffff8017ec85ca0, 3}
Code:
0: kd> !pte ffffe001281af000
VA ffffe001281af000
PXE at FFFFF6FB7DBEDE00 PPE at FFFFF6FB7DBC0020 PDE at FFFFF6FB78004A00 PTE at FFFFF6F000940D78
contains 0000000000EE8863 contains 0000000000EE7863 contains 80000001000009E3 contains 0000000000000000
GetUlongFromAddress: unable to read from fffff8017d369104
pfn ee8 ---DA--KWEV pfn ee7 ---DA--KWEV pfn 100000 -GLDA--KWEV LARGE PAGE pfn 1001af
Here's the memory that the nVidia driver tried to execute when it hit the pagefault, we can see all the different kinds of status/protection bits.
D - Dirty, as in the page was previously written to.
A - Accessed, as in the page (or table) has been previously accessed (read).
K - This page is owned by kernel mode, not user mode.
W - Writable, as in the page is able to be written to (not just read).
E - Executable, as in the page is executable.
V - Valid, as in the page is located in physical memory.
G - Global, as in the TLB won't be flushed upon a context switch.
L - Large, as in this tells us that the page is a PDE and indicates whether or not the PDE is in the last table level.
Since we know we're dealing with a PDE:
Code:
0: kd> dt nt!_MMPTE u.Hard
+0x000 u :
+0x000 Hard : _MMPTE_HARDWARE
Code:
0: kd> dt _MMPTE_HARDWARE FFFFF6FB78004A00
nt!_MMPTE_HARDWARE
+0x000 Valid : 0y1
+0x000 Dirty1 : 0y1
+0x000 Owner : 0y0
+0x000 WriteThrough : 0y0
+0x000 CacheDisable : 0y0
+0x000 Accessed : 0y1
+0x000 Dirty : 0y1
+0x000 LargePage : 0y1
+0x000 Global : 0y1
+0x000 CopyOnWrite : 0y0
+0x000 Unused : 0y0
+0x000 Write : 0y1
+0x000 PageFrameNumber : 0y000000000000000100000000000000000000 (0x100000)
+0x000 reserved1 : 0y0000
+0x000 SoftwareWsIndex : 0y00000000000 (0)
+0x000 NoExecute : 0y1
Without a kernel dump it's pretty hard to say what actually went wrong here, but an nVidia driver issue is most certainly still a possibility given this bug check. I'm pretty sure we've tried just about every nVidia driver there is though, no?
Do me a favor and disable the nVidia Streaming Service in
services.msc if you haven't already, and then restart the system.
Regards,
Patrick