I have a BSOD, it looks like this “http://bbs.themex.net/showthread.php?p=1187149”
Could you tell me what’s the reason?
Thank you
1: kd> !analyze -v
********************************************************************
* *
* Bugcheck Analysis *
* *
*********************************************************************
MEMORY_MANAGEMENT (1a)
Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 00041790, The subtype of the bugcheck.
Arg2: c0802706
Arg3: 0000ffff
Arg4: 00000000
Debugging Details:
BUGCHECK_STR: 0x1a_41790
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
PROCESS_NAME: wermgr.exe
CURRENT_IRQL: 0
Arg 1 == 0x41790
A page table page has been corrupted. On a 64 bit version of Windows, parameter 2 contains the address of the PFN for the corrupted page table page. On a 32 bit version of Windows, parameter 2 contains a pointer to the number of used PTEs, and parameter 3 contains the number of used PTEs.
In this case, used PTEs count is 0xffff so it underflowed. This typically happens when for some reason (bad memory, driver or firmware bugs, etc) one or more PTEs in a page table page unexpectedly change from zero to non-zero.
You should run a memory checker on this machine (either built-in Windows memory diagnostics or something like memtest86). If you have reason to believe this is not due to bad memory (e.g. if this happens on multiple systems, or only when a certain driver is installed) you can try reproducing this under win8 which will typically preserve the corrupted PTE value before issuing a bugcheck so it’ll be easier to analyze.
From: xxxxx@lists.osr.com [xxxxx@lists.osr.com] on behalf of xxxxx@gmail.com [xxxxx@gmail.com]
Sent: Monday, June 18, 2012 1:22 PM
To: Windows System Software Devs Interest List
Subject: RE:[ntdev] About MEMORY_MANAGEMENT BSOD
Arg 1 == 0x41790
A page table page has been corrupted. On a 64 bit version of Windows, parameter 2 contains the address of the PFN for the corrupted page table page. On a 32 bit version of Windows, parameter 2 contains a pointer to the number of used PTEs, and parameter 3 contains the number of used PTEs.
NTDEV is sponsored by OSR
For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars
To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer
Pavel & Jeff
Thank you for your answer.
Could you give me the declare about the functins in the stack.
MiDeleteVirtualAddresses
MiRemoveMappedView
MiRemoveVadAndView
MiUnmapViewOfSection
STACK_TEXT:
8fa5aba8 83ee62b4 02e30002 0323ffff 8695b360 nt!MiDeleteVirtualAddresses+0x41a
8fa5ac78 83ee5f69 8695b360 86cdcbd8 871bd588 nt!MiRemoveMappedView+0x325
8fa5aca0 8408d33f 871bd588 00000000 ffffffff nt!MiRemoveVadAndView+0xe5
8fa5ad04 840ab737 8695b360 02e30000 00000000 nt!MiUnmapViewOfSection+0x265
8fa5ad24 83e841fa ffffffff 02e30000 0280f79c nt!NtUnmapViewOfSection+0x55
8fa5ad24 775c70b4 ffffffff 02e30000 0280f79c nt!KiFastCallEntry+0x12a
WARNING: Frame IP not in any known module. Following frames may be wrong.
0280f79c 00000000 00000000 00000000 00000000 0x775c70b4
By the way, Could you tell What does it mean about the GUID(“53846F5B-74F1-48C5-8046-AEC984BE5EC4”) in the WERInternalMetadata.xml. It looks like this:
<?xml version="1.0" encoding="UTF-16"?>
-
…
-
53846F5B-74F1-48C5-8046-AEC984BE5EC4
…
xxxxx@sina.com wrote:
Pavel & Jeff
Thank you for your answer.
Could you give me the declare about the functins in the stack.
MiDeleteVirtualAddresses
MiRemoveMappedView
MiRemoveVadAndView
MiUnmapViewOfSection
No. Those are internal to the kernel. Their parameters are not
documents. You can make some educated guesses, but that’s about it.
By the way, Could you tell What does it mean about the GUID(“53846F5B-74F1-48C5-8046-AEC984BE5EC4”) in the WERInternalMetadata.xml. It looks like this:
<?xml version="1.0" encoding="UTF-16"?>
-
> …
> -
> 53846F5B-74F1-48C5-8046-AEC984BE5EC4
The schema for WERReportMetadata is also not documented. That must be
some kind of machine identifier, probably from the registry somewhere.
–
Tim Roberts, xxxxx@probo.com
Providenza & Boekelheide, Inc.
Looks like this is a frequent complain for Windows 7. A quick search shows many hits for this code.
This may be caused by some defective driver. Try to update your video driver.
If you have a crash dump, can you post ‘lmi’ command output here?