Solved BSOD Happens while I am multi tasking across various programs

[dr3amw3av3r]

Hi all,

first off... thank you for taking out the time to help me.

Here's what's happening. I will be working away with my default programs open (Outlook 2013, Chrome and Windows Explorer) when all of a sudden I get a BSOD. This can happen while I am switching between applications, Scrolling up or down a window, watching a video file online....

I am at my wits end with my Laptop, here is what the issue is and what I have done.

Background on Laptop:
I have a HP Pavilion dv6 i7 and the following has been done to it in the last month.
1. The Cooling fan has been replaced
2. Hard Drive has been replaced
3. Motherboard has been replaced
4. A clean install of Windows has been done twice
5. All available Windows Updates have been installed
6. All drivers have been updated to the latest version
7. I have also uninstalled the Video Drivers, rebooted and done a reinstall

As per the instructions I am attaching the log files. Can someone please help me out with what to do next?

Thank you for your time!

Kind regards,
Jainesh.

 

[Thedoctor44]

BugCheck [COLOR="Red"]101[/COLOR], {[COLOR="Green"]19[/COLOR], 0, fffff88003565180, 2}

Probably caused by : Unknown_Image ( ANALYSIS_INCONCLUSIVE )

Hmm, I've noticed with all the dump files the same time interval is 19 ticks which is interesting...

For 0x101 bugchecks I need Kernel Memory Dumps.

Follow these instructions on how to change to Kernel Memory Dumps.

http://www.sevenforums.com/tutorials/174459-dump-files-configure-windows-create-bsod.html

Once changed wait for another BSOD, then upload the new dump file to a file sharing website like OneDrive.
The new dump file will be located in C:/Windows/memory.dmp.

Don't zip it up as it corrupts the dump file by compressing it.

 

[dr3amw3av3r]

Hello Thedoctor44

Thank you so much for coming onboard to help with my problem... here is the link to the file you have requested.

https://www.dropbox.com/s/6ipqotcecaerz1u/MEMORY.DMP

Regards,
Jainesh.

 

[Thedoctor44]

Okay lets begin.

BugCheck 101, {[COLOR="Blue"]19[/COLOR], 0, [COLOR="Green"]fffff880009b3180[/COLOR], [COLOR="Red"]4[/COLOR]}

Probably caused by : Unknown_Image ( ANALYSIS_INCONCLUSIVE )

Processor 4 is the problematic processor here, it didn't respond to a clock interrupt within the allocated time interval which was 19 ticks.

The problematic processor has the address of fffff880009b3180.
This is processor 4.

Here's the thing though, I'm looking at the Inter Processor Interrupts and I see this.

0: kd> [COLOR="green"]!ipi[/COLOR]
IPI State for Processor 0

    As a sender, awaiting IPI completion from processor(s) [COLOR="red"]4[/COLOR], [COLOR="Red"]5[/COLOR].

    TargetCount          2  PacketBarrier        1  IpiFrozen     0 [Running]


IPI State for Processor 1
    TargetCount          0  PacketBarrier        0  IpiFrozen     2 [Frozen]


IPI State for Processor 2
    TargetCount          0  PacketBarrier        0  IpiFrozen     2 [Frozen]


IPI State for Processor 3

    As a sender, awaiting IPI completion from processor(s) [COLOR="red"]4[/COLOR], [COLOR="red"]5[/COLOR].

    TargetCount          2  PacketBarrier        1  IpiFrozen     2 [Frozen]


IPI State for Processor 4

    As a receiver, unhandled requests are pending from processor(s) 0, 3.

    TargetCount          0  PacketBarrier        0  IpiFrozen     2 [Frozen]

    From processor 0, active request of type: packet ready
        WorkerRoutine fffff80002eb3e10 ([COLOR="red"]nt!xHalReportIdleStateUsage[/COLOR])
        Parameter[0] 0  Parameter[1] 0  Parameter[2] 0
    From processor 3, active request of type: flush all

IPI State for Processor 5

    As a receiver, unhandled requests are pending from processor(s) 0, 3.

    TargetCount          0  PacketBarrier        0  IpiFrozen     2 [Frozen]

    From processor 0, active request of type: packet ready
        WorkerRoutine fffff80002eb3e10 ([COLOR="red"]nt!xHalReportIdleStateUsage[/COLOR])
        Parameter[0] 0  Parameter[1] 0  Parameter[2] 0
    From processor 3, active request of type: flush all

IPI State for Processor 6
    TargetCount          0  PacketBarrier        0  IpiFrozen     2 [Frozen]


IPI State for Processor 7
    TargetCount          0  PacketBarrier        0  IpiFrozen     2 [Frozen]

Both are ready to report but they aren't for some reason, they're hung so the clock interrupt cannot be completed hence the bugcheck.

I thought it would be best to look at the raw stack for both of those CPUs.

I'm not going to post the raw stack as it will fill a lot of the page but processors 4 and 5 have a lot of network routines including hal PCI config routines, and their network drivers being flagged.

Your Realtek Network driver could do with an update.
Download it here.

0: kd> [COLOR="Green"]lmvm rt64win7[/COLOR]
start             end                 module name
fffff880`05210000 fffff880`052ea000   Rt64win7   (no symbols)           
    Loaded symbol image file: Rt64win7.sys
    Image path: \SystemRoot\system32\DRIVERS\Rt64win7.sys
    Image name: Rt64win7.sys
    Timestamp:        [COLOR="red"]Mon Oct 28 02:35:06 2013[/COLOR] (526DCD5A)
    CheckSum:         000DB1D7
    ImageSize:        000DA000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

Your Intel WiFi Link 1000 BGN driver is very outdated which you probably use seen as it's a laptop.
Update it here.

0: kd> [COLOR="Green"]lmvm netwns64[/COLOR]
start             end                 module name
fffff880`06afa000 fffff880`07380000   NETwNs64   (no symbols)           
    Loaded symbol image file: NETwNs64.sys
    Image path: \SystemRoot\system32\DRIVERS\NETwNs64.sys
    Image name: NETwNs64.sys
    Timestamp:        [COLOR="Red"]Thu Aug 04 01:28:26 2011[/COLOR] (4E39E7AA)
    CheckSum:         0083C028
    ImageSize:        00886000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

Bit Defender appears to be causing a few issues as well.

At least as a test I recommend you replace it with MSE and Malwarebytes.

   Tip

Make sure you don't enable the free trial of malwarebytes pro, deselect the option when prompted.

 

[dr3amw3av3r]

Hello Thedoctor44

Thank you so much for your help and I have done all that you've recommended. If the blue screening continues, what would you like me to post next?

Regards,
Me.

 

[Thedoctor44]

Just the dump files, and I'll try and see if anything in particular is causing the issue.

when you feel the issue has been resolved mark the thread as solved

Keep me posted.

 

[dr3amw3av3r]

Hello Thedoctor44

I shall keep you posted. I'll keep the system on test for two weeks and if BSOD does not occur I shall mark this problem as solved.

Thank you so much for your help, thus far!

 

[Thedoctor44]

Sounds good

 

[dr3amw3av3r]

Hello TheDoctor44,

Well it appears that Im still facing the BSOD issue... here is the latest memory.dmp... https://www.dropbox.com/s/6ipqotcecaerz1u/MEMORY.DMP

Regards,
Jainesh

 

[Thedoctor44]

0: kd> [COLOR="Green"]!ipi[/COLOR]
IPI State for Processor 0
    TargetCount          0  PacketBarrier        0  IpiFrozen     0 [Running]


IPI State for Processor 1
    TargetCount          0  PacketBarrier        0  IpiFrozen     2 [Frozen]


IPI State for Processor 2
    TargetCount          0  PacketBarrier        0  IpiFrozen     2 [Frozen]


IPI State for Processor 3
    TargetCount          0  PacketBarrier        0  IpiFrozen     2 [Frozen]


IPI State for Processor 4

    As a sender, awaiting IPI completion from processor(s) [COLOR="red"]6[/COLOR], [COLOR="Red"]7[/COLOR].

    TargetCount          2  PacketBarrier        1  IpiFrozen     2 [Frozen]


IPI State for Processor 5
    TargetCount          0  PacketBarrier        0  IpiFrozen     2 [Frozen]


IPI State for Processor 6

    [COLOR="red"]As a receiver, unhandled requests are pending from processor(s) 4[/COLOR].

    TargetCount          0  PacketBarrier        0  IpiFrozen     2 [Frozen]

    From processor 4, active request of type: flush all

IPI State for Processor 7

    [COLOR="red"]As a receiver, unhandled requests are pending from processor(s) 4[/COLOR].

    TargetCount          0  PacketBarrier        0  IpiFrozen     2 [Frozen]

    From processor 4, active request of type: flush all

Processor 6 and 7 are not responding to requests.

Looking at the stack I see network errors and your display driver causing issues.

6: kd> [COLOR="Green"]lmvm rt64win7[/COLOR]
start             end                 module name
fffff880`054dc000 fffff880`055c3000   Rt64win7   (no symbols)           
    Loaded symbol image file: Rt64win7.sys
    Image path: \SystemRoot\system32\DRIVERS\Rt64win7.sys
    Image name: Rt64win7.sys
    Timestamp:        [COLOR="red"]Wed Apr 23 03:11:19 2014[/COLOR] (53572147)
    CheckSum:         000E7D7B
    ImageSize:        000E7000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

It seems to be the most up to date, are you using a wired connection?
If not I would disable it.

7: kd> [COLOR="Green"]lmvm atikmdag[/COLOR]
start             end                 module name
fffff880`05a21000 fffff880`063f8000   atikmdag   (no symbols)           
    Loaded symbol image file: atikmdag.sys
    Image path: \SystemRoot\system32\DRIVERS\atikmdag.sys
    Image name: atikmdag.sys
    Timestamp:        [COLOR="Red"]Sat Oct 01 02:59:04 2011[/COLOR] (4E8673E8)
    CheckSum:         00993C69
    ImageSize:        009D7000
    File version:     8.1.1.1178
    Product version:  8.1.1.1178
    File flags:       8 (Mask 3F) Private
    File OS:          40004 NT Win32
    File type:        3.4 Driver
    File date:        00000000.00000000
    Translations:     0409.04b0
    CompanyName:      ATI Technologies Inc.
    ProductName:      ATI Radeon Family
    InternalName:     atikmdag.sys
    OriginalFilename: atikmdag.sys
    ProductVersion:   8.01.01.1178
    FileVersion:      8.01.01.1178
    FileDescription:  ATI Radeon Kernel Mode Driver
    LegalCopyright:   Copyright (C) 1998-2006 ATI Technologies Inc.

I would suggest a display driver update but because you're on a laptop I would uninstall all AMD software, then run Windows Update and install that driver.

I've just looked at your I/O Request Packets and found a lot by HP Mobile Data Protection System Disk Filter and Intel Rapid Storage Technology, my bet is they're conflicting with each other.

4: kd> [COLOR="Green"]!irp fffffa8008083610[/COLOR]
Irp is active with 4 stacks 5 is current (= 0xfffffa8008083800)
 Mdl=fffffa80080834c0: No System Buffer: Thread 00000000:  Irp is completed.  Pending has been returned
     cmd  flg cl Device   File     Completion-Context
 [  0, 0]   0  0 00000000 00000000 00000000-00000000    

			Args: 00000000 00000000 00000000 00000000
 [  0, 0]   0  0 00000000 00000000 00000000-00000000    

			Args: 00000000 00000000 00000000 00000000
*** ERROR: Module load completed but symbols could not be loaded for [COLOR="red"]hpdskflt.sys[/COLOR]
 [  f, 0]   0  0 fffffa8007292900 00000000 fffff88001bf8398-fffffa80082c6c60    
	      *** ERROR: Module load completed but symbols could not be loaded for [COLOR="Red"]iaStorA.sys[/COLOR]
 \Driver\iaStorA	hpdskflt
			Args: 00000000 00000000 00000000 fffffa8007292a50
 [  f, 0]   0  0 fffffa80082c6b10 00000000 fffff880011cea00-fffffa8008083810    
	       \Driver\hpdskflt	CLASSPNP!TransferPktComplete
			Args: 00000000 00000000 00000000 00000000

Remove both, to uninstall IRST follow these instructions.
Uninstall it from Control Panel > Programs and Features. Then Uninstall the driver from device manager.

1. Right click on "my computer" icon and click "manage" on the context menu.
2. It will open the "computer management" window.
3. Select "Device Manager" in the left pane, It will list all the existing devices up.
4. Expand "Disc Drives" by clicking on the triangle in front of it.
5. Select one item under it, right click, uninstall.
6. Continue the process for all items under "Disc Drives"
7. Now restart the computer. At restart, windows will auto configure the appropriate system driver, msahci.sys.

I'm also seeing issues with your NEC Electronics USB 3.0 Host Controller Driver.
Remove it completely.

*** ERROR: Module load completed but symbols could not be loaded for [COLOR="Red"]nusb3hub.sys[/COLOR]

 

[dr3amw3av3r]

Hey Doctor,

Thanks for all your help!

In regards to my Network Card I am using a Cable Connection so can't disable that... I have however switched the wifi off as I don't really need it atm.
I've done as suggested for the display driver
I could not find " HP Mobile Data Protection System Disk Filter" but I was able to uninstall IRST.
I lost the usability of the USB3.0 Ports altogether after drier removal so I had to reinstall it, however I went and got the latest drivers possible...

I shall again put this system on test and let you know when I next have a BSOD... which I am really hoping that I wont.

Regards,
Me.

 

[dr3amw3av3r]

Hello TheDoctor44,

Well I h ave not been able to sit in front of the laptop and really drive it for the last week as I had more pressing issues, so I decided to do so tonight to see if it would still Bluescreen... well it did... I am uploading the dump file at the moment so it won't be there completely for atleast 4 hours but here is the link anyway.

https://www.dropbox.com/s/6ipqotcecaerz1u/MEMORY.DMP

Can you please have a look as to whats happening now?

In regards to the last suggestions you gave me here is what I did and repurcussions of each action if any:

1. I have removed all AMD software and am just using the one from Windows Update
2. I am unable to find the " HP Mobile Data Protection System Disk Filter" so don't know how to uninstall it... I have however removed IRST
3. When I removed the driver for the USB 3.0 ports, the ports stopped working altogether. When I rebooted, the OS automatically reinstalled the driver.
4. I am using a wired LAN connection and have disabled the WiFi connection

Thats all I can think off at the moment and I'd love to know what I can do next.

Thank you for your help...

-
Regards,
Jainesh

 

[Thedoctor44]

BugCheck 101, {[COLOR="Red"]19[/COLOR], 0, [COLOR="Green"]fffff88003517180[/COLOR], [COLOR="Blue"]6[/COLOR]}

This bugcheck indicates that a clock interrupt failed to synchronize all the processors within the allocated time interval which in this case was 19 ticks.

So what is a clock interrupt?

Well a clock interrupt is a synchronization mechanism that calls all the processors and asks them to call in within the allocated time interval, when one doesn't respond the system bugchecks.

The 3rd parameter is the PRCB address for the faulting processor that didn't respond to the clock interrupt.
Which we shall get around to soon.

Most of the time the 4th parameter is the faulting processor which in this case is processor #6.

To keep this simple for you the problem appears to come from your Realtek Ethernet Controller.

6: kd> [COLOR="Green"]lmvm rt64win7[/COLOR]
start             end                 module name
fffff880`054dc000 fffff880`055c3000   Rt64win7   (no symbols)           
    Loaded symbol image file: Rt64win7.sys
    Image path: \SystemRoot\system32\DRIVERS\Rt64win7.sys
    Image name: Rt64win7.sys
    Timestamp:        [COLOR="Red"]Wed Apr 23 03:11:19 2014[/COLOR] (53572147)
    CheckSum:         000E7D7B
    ImageSize:        000E7000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

You could try removing it and letting windows install the driver for you, see if that makes a difference.
If not try an older version, I've seen a couple of issues with this latest version, whether it's a coincidence or not I don't know.

Realtek

Here's my analysis which you don't have to read all of this but I thought I'd do one anyway.

4: kd> [COLOR="Green"]!prcb 6[/COLOR]
PRCB for Processor 6 at [COLOR="Red"]fffff88003517180[/COLOR]:
Current IRQL -- 0
Threads--  Current fffff880035220c0 Next fffffa8007a20b50 Idle fffff880035220c0
Processor Index 6 Number (0, 6) GroupSetMember 40
Interrupt Count -- 001d49e6
Times -- Dpc    00000087 Interrupt 00000028 
         Kernel 0001791a User      0000216d

That matches the 3rd parameter so we can confirm that's the faulty processor.

Lets take a look at the callstack and trap frames for the primary processor (#0)

0: kd> kv
Child-SP          RetAddr           : Args to Child                                                           : Call Site
fffff880`0e49aca8 fffff800`02f18a4a : 00000000`00000101 00000000`00000019 00000000`00000000 fffff880`03517180 : nt!KeBugCheckEx
fffff880`0e49acb0 fffff800`02ecb6f7 : 00000000`00000000 fffff800`00000006 00000000`00002710 fffff880`00000002 : nt! ?? ::FNODOBFM::`string'+0x4e3e
fffff880`0e49ad40 fffff800`02e0d895 : fffff800`02e33460 fffff880`0e49aef0 fffff800`02e33460 fffffa80`00000000 : nt!KeUpdateSystemTime+0x377
fffff880`0e49ae40 fffff800`02ebe113 : 00000000`37f3b484 fffffa80`00f0e580 ffff0000`0fe69fd9 fffff880`054e2221 : hal!HalpHpetClockInterrupt+0x8d
fffff880`0e49ae70 fffff800`02ef74b7 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiInterruptDispatchNoLock+0x163 (TrapFrame @ [COLOR="Green"]fffff880`0e49ae70[/COLOR])
fffff880`0e49b000 fffff800`02ef63cd : 00000000`00000000 00000000`00000001 fa80075b`75c004c0 fffffa80`07722980 : nt!KxFlushEntireTb+0xc7
fffff880`0e49b040 fffff800`02f1a9b0 : 00000000`00000001 fffff8a0`0eb2ca88 00000000`00000001 fffff6fc`c00e3288 : nt!KeFlushTb+0x119
fffff880`0e49b0c0 fffff800`02ed77b4 : 00000000`00000006 fffff880`0e49b140 fffff880`0e49b140 fffff6fc`c00e3288 : nt! ?? ::FNODOBFM::`string'+0xada2
fffff880`0e49b100 fffff800`02ee6bd4 : fffff980`1c651000 00000000`00000001 00000000`00000001 fffff800`02eeafcf : nt!MmCheckCachedPageStates+0x734
fffff880`0e49b2b0 fffff800`02ee6050 : fffffa80`07a72380 fffffa80`00000006 fffff880`0e49b401 fffffa80`07a84400 : nt!CcMapAndRead+0xc4
fffff880`0e49b310 fffff800`02f0b997 : fffffa80`00030000 fffff880`0e49b450 fffffa80`00001200 fffff880`01820a01 : nt!CcPinFileData+0x570
fffff880`0e49b3d0 fffff800`03117a2a : 00000000`00001200 00000000`05821401 00000000`000001ff fffff880`0e49b528 : nt!CcZeroDataInCache+0x87
fffff880`0e49b480 fffff880`018fd80b : 00000000`00d50e00 fffffa80`0b044bd0 00000000`00008000 fffff880`0e49b780 : nt!CcZeroData+0xee
fffff880`0e49b4e0 fffff880`0182e5c3 : fffffa80`0e52c680 fffff8a0`0eaeb140 fffffa80`07a72380 00000000`00000000 : Ntfs!NtfsZeroData+0xeb
fffff880`0e49b5a0 fffff880`0182ec93 : fffffa80`0e52c680 fffffa80`0b044bd0 fffff880`0e49b701 fffff880`0e49b700 : Ntfs!NtfsCommonWrite+0x3291
fffff880`0e49b750 fffff880`01402bcf : fffffa80`0b044fb8 fffffa80`0b044bd0 fffffa80`0b04b4d0 00000000`00000001 : Ntfs!NtfsFsdWrite+0x1c3
fffff880`0e49b810 fffff880`014016df : fffffa80`0843e8e0 00000000`00000001 fffffa80`0843e800 fffffa80`0b044bd0 : fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x24f
fffff880`0e49b8a0 fffff800`031cbc3b : 00000000`00000001 fffffa80`07a72380 00000000`00000001 fffffa80`0b044bd0 : fltmgr!FltpDispatch+0xcf
fffff880`0e49b900 fffff800`031d6643 : fffffa80`0b045000 00000000`00000000 fffffa80`07a72380 fffff880`009ea180 : nt!IopSynchronousServiceTail+0xfb
fffff880`0e49b970 fffff800`02ec0e53 : 00000000`00000f01 00000000`00000000 00000000`00000000 00000000`00000000 : nt!NtWriteFile+0x7e2
fffff880`0e49ba70 00000000`74cb2e09 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`0e49bae0)
00000000`03e7eda8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x74cb2e09

Lets take a look at the trap frame.

0: kd> [COLOR="Green"].trap fffff880`0e49ae70[/COLOR]
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=00000000000c3e33 rbx=0000000000000000 rcx=0000000000000003
rdx=0000000000000001 rsi=0000000000000000 rdi=0000000000000000
rip=[COLOR="red"]fffff80002ef74b7[/COLOR] rsp=fffff8800e49b000 rbp=0000000000000001
 r8=0000000000000006  r9=0000000000000000 r10=0000000000000000
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl nz na po nc
nt!KxFlushEntireTb+0xc7:
[COLOR="Red"]fffff800`02ef74b7 [/COLOR]8b05c3e61400    [COLOR="green"]mov[/COLOR]     eax,dword ptr [nt!KiTbFlushTimeStamp (fffff800`03045b80)] ds:fffff800`03045b80=000c3e33

0: kd> [COLOR="green"]knL[/COLOR]
  *** Stack trace for last set context - .thread/.cxr resets it
 # Child-SP          RetAddr           Call Site
00 fffff880`0e49b000 fffff800`02ef63cd nt!KxFlushEntireTb+0xc7
01 fffff880`0e49b040 fffff800`02f1a9b0 nt!KeFlushTb+0x119
02 fffff880`0e49b0c0 fffff800`02ed77b4 nt! ?? ::FNODOBFM::`string'+0xada2
03 fffff880`0e49b100 fffff800`02ee6bd4 nt!MmCheckCachedPageStates+0x734
04 fffff880`0e49b2b0 fffff800`02ee6050 nt!CcMapAndRead+0xc4
05 fffff880`0e49b310 fffff800`02f0b997 nt!CcPinFileData+0x570
06 fffff880`0e49b3d0 fffff800`03117a2a nt!CcZeroDataInCache+0x87
07 fffff880`0e49b480 fffff880`018fd80b nt!CcZeroData+0xee
08 fffff880`0e49b4e0 fffff880`0182e5c3 Ntfs!NtfsZeroData+0xeb
09 fffff880`0e49b5a0 fffff880`0182ec93 Ntfs!NtfsCommonWrite+0x3291
0a fffff880`0e49b750 fffff880`01402bcf Ntfs!NtfsFsdWrite+0x1c3
0b fffff880`0e49b810 fffff880`014016df fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x24f
0c fffff880`0e49b8a0 fffff800`031cbc3b fltmgr!FltpDispatch+0xcf
0d fffff880`0e49b900 fffff800`031d6643 nt!IopSynchronousServiceTail+0xfb
0e fffff880`0e49b970 fffff800`02ec0e53 nt!NtWriteFile+0x7e2
0f fffff880`0e49ba70 00000000`74cb2e09 nt!KiSystemServiceCopyEnd+0x13
10 00000000`03e7eda8 00000000`00000000 0x74cb2e09

This is the stack at the time of the interrupt.

Lets disassemble the instructions.

0: kd> [COLOR="green"]u @rip[/COLOR]
nt!KxFlushEntireTb+0xc7:
fffff800`02ef74b7 8b05c3e61400    [COLOR="Red"]mov[/COLOR]     eax,dword ptr [nt!KiTbFlushTimeStamp (fffff800`03045b80)]
fffff800`02ef74bd a801            test    al,1
fffff800`02ef74bf 75e6            [COLOR="red"]jne[/COLOR]     nt!KxFlushEntireTb+0xb7 (fffff800`02ef74a7)
fffff800`02ef74c1 f00fba2db6e6140000 lock bts dword ptr [nt!KiTbFlushTimeStamp (fffff800`03045b80)],0
fffff800`02ef74ca 0f834bffffff    jae     nt!KxFlushEntireTb+0x2b (fffff800`02ef741b)
fffff800`02ef74d0 ebd5            jmp     nt!KxFlushEntireTb+0xb7 ([COLOR="green"]fffff800`02ef74a7[/COLOR])
[COLOR="green"]fffff800`02ef74d2[/COLOR] 90              nop
fffff800`02ef74d3 90              nop

0: kd> [COLOR="Green"]u fffff800`02ef74a7 fffff800`02ef74d2[/COLOR]
nt!KxFlushEntireTb+0xb7:
fffff800`02ef74a7 ffc3            inc     ebx
fffff800`02ef74a9 851d191f2000    test    dword ptr [nt!HvlLongSpinCountMask (fffff800`030f93c8)],ebx [COLOR="Blue"]<-- testing to see if it's not zero[/COLOR]
fffff800`02ef74af 0f840ee1f5ff    je      nt! ?? ::FNODOBFM::`string'+0x7400 (fffff800`02e555c3) [COLOR="blue"]<-- jump if not zero[/COLOR]
fffff800`02ef74b5 f390            [COLOR="Red"]pause[/COLOR]
fffff800`02ef74b7 8b05c3e61400    [COLOR="red"]mov[/COLOR]     eax,dword ptr [nt!KiTbFlushTimeStamp (fffff800`03045b80)]
fffff800`02ef74bd a801            test    al,1
fffff800`02ef74bf 75e6            jne     nt!KxFlushEntireTb+0xb7 (fffff800`02ef74a7)
fffff800`02ef74c1 f00fba2db6e6140000 lock bts dword ptr [nt!KiTbFlushTimeStamp (fffff800`03045b80)],0
fffff800`02ef74ca 0f834bffffff    jae     nt!KxFlushEntireTb+0x2b (fffff800`02ef741b)
fffff800`02ef74d0 ebd5            jmp     nt!KxFlushEntireTb+0xb7 (fffff800`02ef74a7)
fffff800`02ef74d2 90              nop

It looks like the thread was executing the pause function at the time of the interrupt in a look waiting for a release.

Well processor #0 was interrupted whilst perform a flush of the Trnaslation Lookaside Buffers which improve translation speed between virtual memory addresses.

Lets take a look at Processor 1s call stack then.

1: kd> [COLOR="green"]kv[/COLOR]
Child-SP          RetAddr           : Args to Child                                                           : Call Site
fffff880`04a86790 fffff800`02ef63cd : 00000000`00000000 00000000`00000001 fffff6fb`40000170 fffffa80`07a17b50 : nt!KxFlushEntireTb+0xbf
fffff880`04a867d0 fffff800`02f1a9b0 : 00000000`00000001 fffff680`0002e210 00000000`00000001 00000000`00001cd0 : nt!KeFlushTb+0x119
fffff880`04a86850 fffff800`02ed178f : fffff680`0002e210 fffff880`04a86900 fffff700`01080000 fffffa80`0755bec8 : nt! ?? ::FNODOBFM::`string'+0xada2
fffff880`04a86890 fffff800`02ece3fe : 00000000`00000001 00000000`05c42fff fffff880`04a86ae0 fffff680`0002e210 : nt!MiResolveDemandZeroFault+0x1ff
fffff880`04a86980 fffff800`02ebfcee : 00000000`00000001 00000000`05c42fff 00000000`00000001 00000000`000000ec : nt!MmAccessFault+0x5de
fffff880`04a86ae0 00000000`045fbf12 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x16e (TrapFrame @ [COLOR="Green"]fffff880`04a86ae0[/COLOR])
00000000`002ede04 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x45fbf12

1: kd> [COLOR="green"].trap fffff880`04a86ae0[/COLOR]
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000005c43000 rbx=0000000000000000 rcx=0000000000000004
rdx=0000000005c42ffc rsi=0000000000000000 rdi=0000000000000000
rip=00000000045fbf12 rsp=00000000002ede04 rbp=00000000002ede0c
 r8=000000000000002b  r9=000000007737004a r10=0000000000000000
r11=000000000012e2c0 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl nz ac po nc
0023:045fbf12 ??              ???

1: kd> [COLOR="green"]u @rip[/COLOR]
00000000`045fbf12 ??              ???
            [COLOR="Red"]^ Memory access error in 'u @rip'[/COLOR]

Can't seem to access the rip register, looks like the Translation Lookaside Buffer flush function is looping.

2: kd> [COLOR="green"]kv[/COLOR]
Child-SP          RetAddr           : Args to Child                                                           : Call Site
fffff880`0e625790 fffff800`02ef63cd : 00000000`00000000 00000000`00000001 00000000`74cb2450 00000000`0349f170 : nt!KxFlushEntireTb+0xc5
fffff880`0e6257d0 fffff800`02f1a9b0 : 00000000`00000001 fffff680`00061b08 00000000`00000001 00000000`00000003 : nt!KeFlushTb+0x119
fffff880`0e625850 fffff800`02ed178f : fffff680`00061b08 fffff880`0e625900 00000000`00000000 fffffa80`0e708ec8 : nt! ?? ::FNODOBFM::`string'+0xada2
fffff880`0e625890 fffff800`02ece3fe : 00000000`00000001 00000000`0c361000 fffff880`0e625ae0 fffff680`00061b08 : nt!MiResolveDemandZeroFault+0x1ff
fffff880`0e625980 fffff800`02ebfcee : 00000000`00000001 00000000`0c361000 00000000`00000001 00000000`00003131 : nt!MmAccessFault+0x5de
fffff880`0e625ae0 00000000`00571190 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x16e (TrapFrame @ [COLOR="Green"]fffff880`0e625ae0[/COLOR])
00000000`0359fdf0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x571190

Same thing with processor #2.

3: kd> [COLOR="green"]kv[/COLOR]
Child-SP          RetAddr           : Args to Child                                                           : Call Site
fffff880`033ffb58 fffff800`02eca709 : 00000000`001dbc57 fffffa80`0cc9a9b8 00000000`00000000 00000000`00000000 : [COLOR="green"]intelppm!MWaitIdle+0x19[/COLOR]
fffff880`033ffb60 fffff800`02eb989c : fffff880`033d7180 fffff880`00000002 00000000`00000002 fffff800`00000000 : nt!PoIdle+0x52a
fffff880`033ffc40 00000000`00000000 : fffff880`03400000 fffff880`033fa000 fffff880`033ffc00 00000000`00000000 : [COLOR="Green"]nt!KiIdleLoop+0x2c[/COLOR]

Processor #3 is asleep waiting to be woken.

4: kd> [COLOR="Green"]kv[/COLOR]
Child-SP          RetAddr           : Args to Child                                                           : Call Site
fffff880`20f01680 fffff800`02ef63cd : 00000000`00000000 00000000`00000001 00000000`00001761 fffff800`02ed3fd2 : nt!KxFlushEntireTb+0x93
fffff880`20f016c0 fffff800`02f1a9b0 : 00000000`00000001 fffff680`0016ddc0 00000000`00000001 00000000`00000000 : nt!KeFlushTb+0x119
fffff880`20f01740 fffff800`02ed178f : fffff680`0016ddc0 fffff880`20f017c0 fa800796`9dc80460 fffffa80`08621ec8 : nt! ?? ::FNODOBFM::`string'+0xada2
fffff880`20f01780 fffff800`02edebfe : 00000000`00000001 00000000`2dbb8000 fffff880`20f01ae0 fffff680`0016ddc0 : nt!MiResolveDemandZeroFault+0x1ff
fffff880`20f01870 fffff800`02ece179 : 00000000`00000001 ffffffff`ffffffff fffffa80`0b339b50 fffff680`00171c60 : nt!MiDispatchFault+0x8ce
fffff880`20f01980 fffff800`02ebfcee : 00000000`00000001 00000000`2dbb8000 00000000`26639401 00000000`01af0010 : nt!MmAccessFault+0x359
fffff880`20f01ae0 00000000`0f6c1e89 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x16e (TrapFrame @ [COLOR="green"]fffff880`20f01ae0[/COLOR])
00000000`0033eca8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0xf6c1e89

Processor #4 is the same as #1 and #2.

5: kd> [COLOR="green"]kv[/COLOR]
Child-SP          RetAddr           : Args to Child                                                           : Call Site
fffff880`034cdb58 fffff800`02eca709 : 00000000`001dbc57 fffffa80`08210c68 00000000`00000000 00000000`00000000 : [COLOR="green"]intelppm!MWaitIdle+0x19[/COLOR]
fffff880`034cdb60 fffff800`02eb989c : fffff880`034a5180 fffff880`00000002 00000000`00000002 fffff800`00000000 : nt!PoIdle+0x52a
fffff880`034cdc40 00000000`00000000 : fffff880`034ce000 fffff880`034c8000 fffff880`034cdc00 00000000`00000000 : [COLOR="Green"]nt!KiIdleLoop+0x2c[/COLOR]

Processor #5 is asleep.

Lets take a look at the problematic processor which is #6.

6: kd> [COLOR="Green"]kv[/COLOR]
Child-SP          RetAddr           : Args to Child                                                           : Call Site
fffff880`0353fb58 fffff800`02eca709 : 00000000`001dbc57 fffffa80`0821a4f8 fffff880`03517180 00000000`00000000 : [COLOR="Red"]intelppm!MWaitIdle+0x19[/COLOR]
fffff880`0353fb60 fffff800`02eb989c : fffff880`03517180 fffff880`00000002 00000000`00000002 fffff880`00000000 : nt!PoIdle+0x52a
fffff880`0353fc40 00000000`00000000 : fffff880`03540000 fffff880`0353a000 fffff880`0353fc00 00000000`00000000 : nt!KiIdleLoop+0x2c

It's sleeping and not responding.

Lets dump the raw stack.

There appears to be a lot of network routines involving your realtek ethernet controller.

fffff880`0353f9a8  fffff880`054e39a7 [COLOR="Red"]Rt64win7+0x79a7[/COLOR]
fffff880`0353f9b0  00000000`00000003
fffff880`0353f9b8  fffffa80`0c11c6a8
fffff880`0353f9c0  00000000`00000000
fffff880`0353f9c8  00000000`00000003
fffff880`0353f9d0  fffffa80`0c4a1010
fffff880`0353f9d8  fffff880`054e392a [COLOR="red"]Rt64win7+0x792a[/COLOR]
fffff880`0353f9e0  fffffa80`0c11c000
fffff880`0353f9e8  fffff880`054e287c [COLOR="red"]Rt64win7+0x687c[/COLOR]

As stated earlier it's the most up to date.

Lastly processor 7 is also asleep.

7: kd> [COLOR="green"]kv[/COLOR]
Child-SP          RetAddr           : Args to Child                                                           : Call Site
fffff880`035b1b58 fffff800`02eca709 : 00000000`001dbc57 fffffa80`082134f8 00000000`00000000 00000000`00000000 : [COLOR="Green"]intelppm!MWaitIdle+0x19[/COLOR]
fffff880`035b1b60 fffff800`02eb989c : fffff880`03589180 fffff880`00000002 00000000`00000002 fffff800`00000000 : nt!PoIdle+0x52a
fffff880`035b1c40 00000000`00000000 : fffff880`035b2000 fffff880`035ac000 fffff880`035b1c00 00000000`00000000 : [COLOR="Green"]nt!KiIdleLoop+0x2c[/COLOR]

 

[dr3amw3av3r]

Hi Doctor

Thanks for all your help and analysis! So just to confirm, you're saying that I also have a fault with my processor? If so I will open a support case with HP and get them to replace that also...

Regards,
Jainesh

 

[Thedoctor44]

No, that's not what I was saying, there was a processor that didn't wake to respond to clock interrupt, something I stopping it normally with consistent clock interrupt failures I would lean towards a bad CPU but the cores each time are different which makes me think otherwise.
Try changing your Realtek Ethernet controller as I suggested above.

 

[dr3amw3av3r]

Hey Doctor,

Thanks for clarifying... I have done as you have suggested and I'm waiting now to see if the BS happens again... Somehow my video driver is still crashing despite several reinstalls... I'll let you know soon as to what happens.

Regards,
me.

 

[dr3amw3av3r]

Hey TheDoctor44,

Well a while ago I did push the machine and it did indeed shit itself again.... here is the link for the dump file: https://www.dropbox.com/s/6ipqotcecaerz1u/MEMORY.DMP but it probably won't be accessible for 4 to 6 hours as it is still uploading.

Regards,
Jainesh

 

[dr3amw3av3r]

Hello TheDoctor44,

I have uploaded a new memory dump file here: https://www.dropbox.com/s/jioxi3tzqphlb1j/MEMORY_2.DMP could you please let me know what I can do next?

Regards,
Me

 

[dr3amw3av3r]

Hey Doctor44

Any ideas? I am on the verge of doing a bare metal install from scratch... Not using the HP Image this time... Would love any other pointers before I take this drastic step...
Thank you.

- Jainesh

 

[dr3amw3av3r]

I've done a bare-metal install.... lets see how things go now... so far so good.