Bluescreen STOP 0x000000d1 [Dump log]

chumba · 4th March 2005

Can you tell from the dump what hardware device is causing the stop errors ?

Opened log file 'c:\debuglog.txt'

Microsoft (R) Windows Debugger Version 6.4.0007.2
Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [C:\Documents and Settings\dewing\Desktop\MEMORY.DMP]
Kernel Summary Dump File: Only kernel address space is available

Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: C:\WINDOWS;C:\WINDOWS\system32;C:\WINDOWS\system32\drivers
Windows Server 2003 Kernel Version 3790 MP (4 procs) Free x86 compatible
Product: Server, suite: TerminalServer SingleUserTS
Built by: 3790.srv03_rtm.030324-2048
Kernel base = 0x804de000 PsLoadedModuleList = 0x8057b6a8
Debug session time: Thu Mar 3 02:55:04.257 2005 (GMT-5)
System Uptime: 4 days 19:33:07.016
Loading Kernel Symbols
........................................................................... ...............................
Loading unloaded module list
.....
Loading User Symbols
PEB is paged out (Peb.Ldr = 7ffdf00c). Type ".hh dbgerr001" for details
*************************************************************************** ****
* *
* Bugcheck Analysis *
* *
*************************************************************************** ****

Use !analyze -v to get detailed debugging information.

BugCheck D1, {e000, ff, 0, 0}

Probably caused by : hardware

Followup: MachineOwner
---------
*** Possible invalid call from 80747715 ( hal!HalpIpiHandler+0xad )
*** Expected target 807484dc ( hal!HalEndSystemInterrupt+0x0 )

1: kd> !analyze -v;r;kv;lmtn;.logclose;q
*************************************************************************** ****
* *
* Bugcheck Analysis *
* *
*************************************************************************** ****

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 0000e000, memory referenced
Arg2: 000000ff, IRQL
Arg3: 00000000, value 0 = read operation, 1 = write operation
Arg4: 00000000, address which referenced memory

Debugging Details:
------------------

READ_ADDRESS: 0000e000

CURRENT_IRQL: 1d

FAULTING_IP:
+0
00000000 ?? ???

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0xD1

LAST_CONTROL_TRANSFER: from 8074771a to 00000000

STACK_TEXT:
b3fcdbfc 8074771a b3fcdc1b 000000e1 00000000 0x0

POSSIBLE_INVALID_CONTROL_TRANSFER: from 80747715 to 807484dc

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: hardware

IMAGE_NAME: hardware

DEBUG_FLR_IMAGE_TIMESTAMP: 0

STACK_COMMAND: .trap ffffffffb3fcdb8c ; kb

BUCKET_ID: CPU_CALL_ERROR

Followup: MachineOwner
---------
*** Possible invalid call from 80747715 ( hal!HalpIpiHandler+0xad )
*** Expected target 807484dc ( hal!HalEndSystemInterrupt+0x0 )

eax=f772713c ebx=0000000a ecx=89938360 edx=00000000 esi=f7727120 edi=0000e000
eip=805435b9 esp=b3fcdb58 ebp=b3fcdb70 iopl=0 nv up ei ng nz na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00000286
nt!KeBugCheckEx+0x19:
805435b9 5d pop ebp
ChildEBP RetAddr Args to Child
b3fcdb70 804e2f58 0000000a 0000e000 000000ff nt!KeBugCheckEx+0x19 (FPO: [Non-Fpo])
b3fcdb70 00000000 0000000a 0000e000 000000ff nt!KiTrap0E+0x224 (FPO: [0,0] TrapFrame @ b3fcdb8c)
b3fcdbfc 8074771a b3fcdc1b 000000e1 00000000 0x0
start end module name
804de000 80744000 nt ntkrnlmp.exe Tue Mar 25 03:39:34 2003 (3E8015C6)
80744000 8076c000 hal halmacpi.dll Tue Mar 25 02:07:28 2003 (3E800030)
b3c5f000 b3c73440 naiavf5x naiavf5x.sys Mon Aug 04 21:08:00 2003 (3F2F0370)
b3d8c000 b3dae000 RDPWD RDPWD.SYS Tue Mar 25 02:03:00 2003 (3E7FFF24)
b44b6000 b4515000 srv srv.sys Tue Mar 25 03:49:51 2003 (3E80182F)
b4565000 b45bd000 HTTP HTTP.sys Tue Mar 25 03:55:21 2003 (3E801979)
b46ad000 b46dc000 afd afd.sys Tue Mar 25 02:40:50 2003 (3E800802)
b46dc000 b46f4000 Cdfs Cdfs.SYS Tue Mar 25 03:17:19 2003 (3E80108F)
b4c64000 b4c70000 dump_mraid35x dump_mraid35x.sys Fri Dec 12 01:13:16 2003 (3FD95C7C)
b4c74000 b4c7d000 dump_diskdump dump_diskdump.sys Tue Mar 25 02:05:15 2003 (3E7FFFAB)
b4ce4000 b4ced000 ndisuio ndisuio.sys Tue Mar 25 02:09:47 2003 (3E8000BB)
b7fee000 b8001000 Fips Fips.SYS Tue Mar 25 03:54:59 2003 (3E801963)
b8001000 b806e000 mrxsmb mrxsmb.sys Tue Mar 25 02:09:09 2003 (3E800095)
b806e000 b809a000 rdbss rdbss.sys Tue Mar 25 02:09:06 2003 (3E800092)
b809a000 b80cf000 netbt netbt.sys Fri Jul 18 13:16:03 2003 (3F182B53)
b8147000 b81a9000 tcpip tcpip.sys Tue Mar 25 03:04:01 2003 (3E800D71)
b81a9000 b81c5000 ipsec ipsec.sys Tue Mar 25 02:55:45 2003 (3E800B81)
b8a53000 b8a66000 usbhub usbhub.sys Tue Mar 25 02:10:46 2003 (3E8000F6)
b8a8d000 b8a95000 rasacd rasacd.sys Tue Mar 25 02:11:50 2003 (3E800136)
b8abd000 b8ac5000 RDPCDD RDPCDD.sys Tue Mar 25 02:03:05 2003 (3E7FFF29)
b8ac5000 b8acd000 mnmdd mnmdd.SYS Tue Mar 25 02:07:53 2003 (3E800049)
b8ad5000 b8adaf00 HIDPARSE HIDPARSE.SYS Tue Mar 25 02:10:13 2003 (3E8000D5)
b8ba6000 b8bb0000 Dxapi Dxapi.sys Tue Mar 25 02:06:01 2003 (3E7FFFD9)
b8bd6000 b8be0000 TDTCP TDTCP.SYS Tue Mar 25 02:02:52 2003 (3E7FFF1C)
b8fea000 b8ff1100 usbccgp usbccgp.sys Tue Mar 25 02:10:52 2003 (3E8000FC)
b8ff2000 b8ffa000 mouhid mouhid.sys Tue Mar 25 02:03:12 2003 (3E7FFF30)
b9e23000 b9e31000 HIDCLASS HIDCLASS.SYS Tue Mar 25 02:10:17 2003 (3E8000D9)
b9e95000 b9ec8000 update update.sys Tue Mar 25 03:59:59 2003 (3E801A8F)
b9ec8000 b9efc000 rdpdr rdpdr.sys Tue Mar 25 02:09:30 2003 (3E8000AA)
b9f30000 b9f3c000 Npfs Npfs.SYS Tue Mar 25 02:08:59 2003 (3E80008B)
b9f40000 b9f4d000 netbios netbios.sys Tue Mar 25 02:09:53 2003 (3E8000C1)
b9f80000 b9f8c000 vga vga.sys Tue Mar 25 02:08:03 2003 (3E800053)
ba1b5000 ba1c2000 wanarp wanarp.sys Tue Mar 25 02:11:22 2003 (3E80011A)
ba1c5000 ba1d4000 msgpc msgpc.sys Tue Mar 25 02:10:12 2003 (3E8000D4)
ba1f5000 ba203000 NDProxy NDProxy.SYS Tue Mar 25 02:11:30 2003 (3E800122)
ba225000 ba23a000 raspptp raspptp.sys Tue Mar 25 03:19:09 2003 (3E8010FD)
ba23a000 ba255000 ndiswan ndiswan.sys Tue Mar 25 03:48:19 2003 (3E8017D3)
ba497000 ba4ae000 rasl2tp rasl2tp.sys Tue Mar 25 02:54:46 2003 (3E800B46)
ba4ae000 ba4d8000 ks ks.sys Tue Mar 25 03:47:36 2003 (3E8017A8)
ba4d8000 ba4ec000 redbook redbook.sys Tue Mar 25 02:04:38 2003 (3E7FFF86)
ba4ec000 ba504000 serial serial.sys Tue Mar 25 02:40:08 2003 (3E8007D8)
ba504000 ba5c2000 ati2mtag ati2mtag.sys Tue Jan 20 22:48:06 2004 (400DF676)
ba5c2000 ba5d6000 cdrom cdrom.sys Tue Mar 25 02:05:18 2003 (3E7FFFAE)
ba5d6000 ba5e9000 rac4ser rac4ser.sys Sun Apr 18 13:13:06 2004 (4082B722)
ba5e9000 ba60ae80 USBPORT USBPORT.SYS Tue Mar 25 02:10:43 2003 (3E8000F3)
ba60b000 ba629c00 e1000325 e1000325.sys Mon Mar 15 17:40:58 2004 (405630FA)
ba62a000 ba643000 VIDEOPRT VIDEOPRT.SYS Tue Mar 25 02:08:02 2003 (3E800052)
ba7e1000 ba7e1840 idisw2km idisw2km.sys Mon Jun 28 00:58:38 2004 (40DFA57E)
ba8ef000 ba8f0580 USBD USBD.SYS Tue Mar 25 02:10:39 2003 (3E8000EF)
ba9c9000 ba9cde80 usbuhci usbuhci.sys Tue Mar 25 02:10:43 2003 (3E8000F3)
baa09000 baa10000 dxgthk dxgthk.sys Tue Mar 25 02:05:52 2003 (3E7FFFD0)
baa5b000 baa64000 ndistapi ndistapi.sys Tue Mar 25 02:11:28 2003 (3E800120)
baaab000 baab5000 serenum serenum.sys Tue Mar 25 02:04:01 2003 (3E7FFF61)
baabb000 baac6000 fdc fdc.sys Tue Mar 25 02:04:31 2003 (3E7FFF7F)
baacb000 baad7000 processr processr.sys Tue Mar 25 02:07:36 2003 (3E800038)
baadb000 baae5000 mouclass mouclass.sys Tue Mar 25 02:03:09 2003 (3E7FFF2D)
baccb000 bacd2000 Null Null.SYS Tue Mar 25 02:03:05 2003 (3E7FFF29)
bacdb000 bace3000 audstub audstub.sys Tue Mar 25 02:09:12 2003 (3E800098)
bf800000 bf9c6000 win32k win32k.sys Tue Mar 25 03:40:49 2003 (3E801611)
bf9c6000 bfa29000 ati2dvag ati2dvag.dll Tue Jan 20 22:48:31 2004 (400DF68F)
bfa29000 bfafd420 ati3d1ag ati3d1ag.dll Tue Jan 20 22:04:17 2004 (400DEC31)
bff80000 bff96000 dxg dxg.sys Tue Mar 25 04:46:23 2003 (3E80256F)
f7225000 f7247000 Mup Mup.sys Tue Mar 25 03:55:58 2003 (3E80199E)
f7247000 f7288000 NDIS NDIS.sys Tue Mar 25 03:45:35 2003 (3E80172F)
f7288000 f7325000 Ntfs Ntfs.sys Tue Mar 25 02:40:05 2003 (3E8007D5)
f7325000 f7346000 KSecDD KSecDD.sys Tue Mar 25 02:05:39 2003 (3E7FFFC3)
f7346000 f735c000 CLASSPNP CLASSPNP.SYS Tue Mar 25 02:38:14 2003 (3E800766)
f735c000 f736d7c0 afamgt afamgt.sys Mon Nov 24 18:39:49 2003 (3FC296C5)
f736e000 f7394000 SCSIPORT SCSIPORT.SYS Tue Mar 25 03:01:25 2003 (3E800CD5)
f7394000 f73b0000 atapi atapi.sys Tue Mar 25 02:04:48 2003 (3E7FFF90)
f73b0000 f73d1000 volsnap volsnap.sys Tue Mar 25 02:05:47 2003 (3E7FFFCB)
f73d1000 f73fb000 dmio dmio.sys Tue Mar 25 02:08:14 2003 (3E80005E)
f73fb000 f7420000 ftdisk ftdisk.sys Tue Mar 25 02:05:26 2003 (3E7FFFB6)
f7420000 f7435000 pci pci.sys Tue Mar 25 02:16:40 2003 (3E800258)
f7435000 f7466000 ACPI ACPI.sys Tue Mar 25 02:16:21 2003 (3E800245)
f7487000 f7490000 WMILIB WMILIB.SYS Tue Mar 25 02:13:00 2003 (3E80017C)
f7497000 f74a6000 isapnp isapnp.sys Tue Mar 25 02:16:35 2003 (3E800253)
f74a7000 f74b4000 PCIIDEX PCIIDEX.SYS Tue Mar 25 02:04:44 2003 (3E7FFF8C)
f74b7000 f74c6000 MountMgr MountMgr.sys Tue Mar 25 02:03:05 2003 (3E7FFF29)
f74c7000 f74d5000 PartMgr PartMgr.sys Tue Mar 25 03:04:02 2003 (3E800D72)
f74d7000 f74e3000 mraid35x mraid35x.sys Fri Dec 12 01:13:16 2003 (3FD95C7C)
f74e7000 f74f6000 disk disk.sys Tue Mar 25 02:05:20 2003 (3E7FFFB0)
f74f7000 f7503000 Dfs Dfs.sys Tue Mar 25 02:09:52 2003 (3E8000C0)
f7507000 f7511000 dcdbas32 dcdbas32.sys Thu Jul 15 12:51:22 2004 (40F6B60A)
f7517000 f7520000 crcdisk crcdisk.sys Tue Mar 25 02:07:23 2003 (3E80002B)
f7527000 f7530000 hidusb hidusb.sys Tue Mar 25 02:10:17 2003 (3E8000D9)
f7587000 f7591000 Msfs Msfs.SYS Tue Mar 25 02:08:56 2003 (3E800088)
f7597000 f75a0000 kbdhid kbdhid.sys Tue Mar 25 02:03:14 2003 (3E7FFF32)
f75a7000 f75b6000 termdd termdd.sys Tue Mar 25 02:02:52 2003 (3E7FFF1C)
f75b7000 f75c3000 dcdipm32 dcdipm32.sys Thu Jul 15 12:54:10 2004 (40F6B6B2)
f75c7000 f75d0000 watchdog watchdog.sys Tue Mar 25 02:09:01 2003 (3E80008D)
f75d7000 f75e1000 kbdclass kbdclass.sys Tue Mar 25 02:03:10 2003 (3E7FFF2E)
f7617000 f7625000 raspppoe raspppoe.sys Tue Mar 25 02:11:37 2003 (3E800129)
f7627000 f7632000 TDI TDI.SYS Tue Mar 25 02:14:28 2003 (3E8001D4)
f7637000 f7642000 ptilink ptilink.sys Tue Mar 25 02:03:51 2003 (3E7FFF57)
f7647000 f7650000 raspti raspti.sys Tue Mar 25 02:11:36 2003 (3E800128)
f7707000 f770f000 kdcom kdcom.dll Tue Mar 25 02:08:00 2003 (3E800050)
f770f000 f7717000 BOOTVID BOOTVID.dll Tue Mar 25 02:07:58 2003 (3E80004E)
f7717000 f771e000 pciide pciide.sys Tue Mar 25 02:04:46 2003 (3E7FFF8E)
f771f000 f7726000 dmload dmload.sys Tue Mar 25 02:08:08 2003 (3E800058)
f779f000 f77a7000 Fs_Rec Fs_Rec.SYS Tue Mar 25 02:08:36 2003 (3E800074)
f77bf000 f77c6000 Beep Beep.SYS Tue Mar 25 02:03:04 2003 (3E7FFF28)
f77e7000 f77ebe00 usbehci usbehci.sys Tue Mar 25 02:10:40 2003 (3E8000F0)
f794b000 f794ee40 ASPI32 ASPI32.SYS Fri Sep 10 19:46:10 1999 (37D99842)
f7991000 f7992200 swenum swenum.sys Tue Mar 25 02:03:22 2003 (3E7FFF3A)
f79f1000 f79f2300 kbstuff5 kbstuff5.sys Mon Jun 28 00:57:56 2004 (40DFA554)
f7a54000 f7a54c60 PORTACCESSOR PORTACCESSOR.sys Thu Mar 11 17:21:14 2004 (4050E65A)

Unloaded modules:
b9f10000 b9f1e000 imapi.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ba1e5000 ba1ee000 kbdhid.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
b856a000 b8580000 i8042prt.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
b8fea000 b8ff2000 Sfloppy.SYS
Timestamp: unavailable (00000000)
Checksum: 00000000
b9dc3000 b9dcd000 Flpydisk.SYS
Timestamp: unavailable (00000000)
Checksum: 00000000
Closing open log file c:\debuglog.txt

bigjoe · 4th March 2005

Chumba,

Had the same issue with a server here recently. Here is the KB article you are looking for; http://support.microsoft.com/kb/890554

Bigjoe

**JoeHobart** · 5th March 2005

I'm not sure if the KB article bigjoe references is applicable to this dump. That hotfix is for a D1, but its an RDBSS/MRXSMB fix, which are not on the stack for this crash.

There is something in the dump that me ben and timeout were discussing in these two threads:
Win2003 Server DUMP DATA
BugCheck A, {18756c0, ff, 0, 8074867e }

This particular crash is pretty far hosed up, and not one of the ones i can do just by lookin at it. I can tell you that it was in the middle of processing an interrupt when something referenced a bad location, which threw a page fault and a bugcheck. The interrupt is 1D, the IPI interrupt, so this certainly looks like the same thing we were talking about in those other threads. You should see if your CPU model and stepping match what ben referenced.

It would be interesting to see another dump to see if it also has a reference to an HalpIpiHandler crash. If it does, you should try that hotfix.