M
Matthew Vazquez
Hello,
I'm currently try to troubleshoot DPC_WATCHDOG_VIOLATION (133) BSOD on Windows Server 2012 R2.
I'm trying to track down the file that is causing the issue.
Dropbox Link: Dropbox - ME1 Large DMP.zip
This is what I've done so far, but I don't know if I'm using windebug correctly
1. KnL
# Child-SP RetAddr Call Site
00 ffffd001`f6fc9c88 fffff802`b55fd46c nt!KeBugCheckEx
01 ffffd001`f6fc9c90 fffff802`b54fc5e1 nt! ?? ::FNODOBFM::`string'+0x1203c
02 ffffd001`f6fc9d20 fffff802`b5417ac5 nt!KeClockInterruptNotify+0x91
03 ffffd001`f6fc9f40 fffff802`b55559e3 hal!HalpTimerClockIpiRoutine+0x15
04 ffffd001`f6fc9f70 fffff802`b55d57da nt!KiCallInterruptServiceRoutine+0xa3
05 ffffd001`f6fc9fb0 fffff802`b55d5ca7 nt!KiInterruptSubDispatchNoLockNoEtw+0xea
06 ffffd001`fab51f40 fffff802`b5564e69 nt!KiInterruptDispatchNoLockNoEtw+0x37
07 ffffd001`fab520d0 fffff802`b5515450 nt!KiSwapDirectoryTableBaseTarget+0x79
08 ffffd001`fab52110 fffff802`b5514797 nt!KiExecuteAllDpcs+0x1b0
09 ffffd001`fab52260 fffff802`b55d810a nt!KiRetireDpcList+0xd7
0a ffffd001`fab524e0 00000000`00000000 nt!KiIdleLoop+0x5a
2. .fnent fffff800`ce7015e1
Debugger function entry 000001d6`f37398c8 for:
(fffff800`ce701550) nt!KeClockInterruptNotify+0x91 | (fffff800`ce702240) nt!KeAccumulateTicks
BeginAddress = 00000000`0007d550
EndAddress = 00000000`0007d693
UnwindInfoAddress = 00000000`00246bf4
Unwind info at fffff800`ce8cabf4, 24 bytes
version 2, flags 3, prolog 23, codes b
handler routine: nt!_GSHandlerCheck (fffff800`ce7cbfa0), data 1d0
00: offs a, unwind op 6, op info 0 UWOP_EPILOG Length: a. Flags: 0
01: offs 2e, unwind op 6, op info 0 UWOP_EPILOG Offset from end: 2e (FFFFF800CE701665)
02: offs 11, unwind op 1, op info 0 UWOP_ALLOC_LARGE FrameOffset: 1e0.
04: offs a, unwind op 0, op info e UWOP_PUSH_NONVOL reg: r14.
05: offs 8, unwind op 0, op info c UWOP_PUSH_NONVOL reg: r12.
06: offs 6, unwind op 0, op info 7 UWOP_PUSH_NONVOL reg: rdi.
07: offs 5, unwind op 0, op info 6 UWOP_PUSH_NONVOL reg: rsi.
08: offs 4, unwind op 0, op info 5 UWOP_PUSH_NONVOL reg: rbp.
09: offs 3, unwind op 0, op info 3 UWOP_PUSH_NONVOL reg: rbx.
0a: offs 2, unwind op 2, op info 0 UWOP_ALLOC_SMALL.
3. ln nt+0007d550
Browse module
Set bu breakpoint
(fffff800`ce701550) nt!KeClockInterruptNotify | (fffff800`ce702240) nt!KeAccumulateTicks
Exact matches:
nt!KeClockInterruptNotify (<no parameter info>)
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
DPC_WATCHDOG_VIOLATION (133)
The DPC watchdog detected a prolonged run time at an IRQL of DISPATCH_LEVEL
or above.
Arguments:
Arg1: 0000000000000000, A single DPC or ISR exceeded its time allotment. The offending
component can usually be identified with a stack trace.
Arg2: 0000000000000501, The DPC time count (in ticks).
Arg3: 0000000000000500, The DPC time allotment (in ticks).
Arg4: 0000000000000000, cast to nt!DPC_WATCHDOG_GLOBAL_TRIAGE_BLOCK, which contains
additional information regarding this single DPC timeout
Debugging Details:
------------------
KEY_VALUES_STRING: 1
TIMELINE_ANALYSIS: 1
DUMP_CLASS: 1
DUMP_QUALIFIER: 401
BUILD_VERSION_STRING: 9600.18969.amd64fre.winblue_ltsb.180309-0600
SYSTEM_MANUFACTURER: HPE
SYSTEM_PRODUCT_NAME: ProLiant DL380 Gen10
SYSTEM_SKU: 869118-B21
BIOS_VENDOR: HPE
BIOS_VERSION: U30
BIOS_DATE: 02/15/2018
BASEBOARD_MANUFACTURER: HPE
BASEBOARD_PRODUCT: ProLiant DL380 Gen10
DUMP_TYPE: 1
BUGCHECK_P1: 0
BUGCHECK_P2: 501
BUGCHECK_P3: 500
BUGCHECK_P4: 0
DPC_TIMEOUT_TYPE: SINGLE_DPC_TIMEOUT_EXCEEDED
CPU_COUNT: 14
CPU_MHZ: 893
CPU_VENDOR: GenuineIntel
CPU_FAMILY: 6
CPU_MODEL: 55
CPU_STEPPING: 4
CPU_MICROCODE: 6,55,4,0 (F,M,S,R) SIG: 2000043'00000000 (cache) 2000043'00000000 (init)
DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT
BUGCHECK_STR: 0x133
PROCESS_NAME: System
CURRENT_IRQL: d
ANALYSIS_SESSION_HOST: LAPTOP-61NTFUBR
ANALYSIS_SESSION_TIME: 06-03-2018 01:24:12.0684
ANALYSIS_VERSION: 10.0.17134.12 amd64fre
LAST_CONTROL_TRANSFER: from fffff800ce80246c to fffff800ce7d92a0
STACK_TEXT:
ffffd000`90b37c88 fffff800`ce80246c : 00000000`00000133 00000000`00000000 00000000`00000501 00000000`00000500 : nt!KeBugCheckEx
ffffd000`90b37c90 fffff800`ce7015e1 : ffffd000`90b37d30 00000000`0011caba 00000000`00000000 00001f80`002c0780 : nt! ?? ::FNODOBFM::`string'+0x1203c
ffffd000`90b37d20 fffff800`ce61cac5 : ffffd000`917b97a0 00000000`00000001 ffffd000`94400180 ffffd000`90b00180 : nt!KeClockInterruptNotify+0x91
ffffd000`90b37f40 fffff800`ce75a9e3 : ffffebac`cf50098c fffff800`ce777f01 ffffd000`917b9700 00000009`150dc584 : hal!HalpTimerClockIpiRoutine+0x15
ffffd000`90b37f70 fffff800`ce7da7da : ffffe001`ee0fd1e0 ffffd000`94400180 ffffd000`90b00180 00000000`00000001 : nt!KiCallInterruptServiceRoutine+0xa3
ffffd000`90b37fb0 fffff800`ce7daca7 : 00000000`00000000 00000000`00000002 ffffe001`eef03ad8 fffff800`4590c1a3 : nt!KiInterruptSubDispatchNoLockNoEtw+0xea
ffffd000`909f9010 fffff800`ce78081f : 00000000`00140001 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiInterruptDispatchNoLockNoEtw+0x37
ffffd000`909f91a0 fffff800`ce719f5a : ffffe001`ee2f3800 ffffe001`ee2f3880 00000000`00000000 00000000`00000003 : nt!KiDeferredReadyThread+0x92f
ffffd000`909f9260 fffff800`ce7dd10a : ffffd000`90b00180 ffffd000`90b00180 ffffd000`90b0e780 ffffe001`f24fd5c0 : nt!KiRetireDpcList+0x89a
ffffd000`909f94e0 00000000`00000000 : ffffd000`909fa000 ffffd000`909f3000 00000000`00000000 00000000`00000000 : nt!KiIdleLoop+0x5a
THREAD_SHA1_HASH_MOD_FUNC: 462a510eab1c27ef93100957e18b5cdf55619ed2
THREAD_SHA1_HASH_MOD_FUNC_OFFSET: 11c0f60ebc35096add6c4731ddc905fb41effc78
THREAD_SHA1_HASH_MOD: 692dc177616b23b31c5615392ac069be10b8455d
FOLLOWUP_IP:
nt! ?? ::FNODOBFM::`string'+1203c
fffff800`ce80246c cc int 3
FAULT_INSTR_CODE: 442ccdcc
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt! ?? ::FNODOBFM::`string'+1203c
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 5aa29c76
STACK_COMMAND: .thread ; .cxr ; kb
BUCKET_ID_FUNC_OFFSET: 1203c
FAILURE_BUCKET_ID: 0x133_DPC_nt!_??_::FNODOBFM::_string_
BUCKET_ID: 0x133_DPC_nt!_??_::FNODOBFM::_string_
PRIMARY_PROBLEM_CLASS: 0x133_DPC_nt!_??_::FNODOBFM::_string_
TARGET_TIME: 2018-06-02T13:10:51.000Z
OSBUILD: 9600
OSSERVICEPACK: 0
SERVICEPACK_NUMBER: 0
OS_REVISION: 0
SUITE_MASK: 272
PRODUCT_TYPE: 3
OSPLATFORM_TYPE: x64
OSNAME: Windows 8.1
OSEDITION: Windows 8.1 Server TerminalServer SingleUserTS
OS_LOCALE:
USER_LCID: 0
OSBUILD_TIMESTAMP: 2018-03-09 06:38:46
BUILDDATESTAMP_STR: 180309-0600
BUILDLAB_STR: winblue_ltsb
BUILDOSVER_STR: 6.3.9600.18969.amd64fre.winblue_ltsb.180309-0600
ANALYSIS_SESSION_ELAPSED_TIME: 8fc
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:0x133_dpc_nt!_??_::fnodobfm::_string_
FAILURE_ID_HASH: {12e2b1b6-39a2-9cfe-dc70-25086917b8e2}
Followup: MachineOwner
---------
Continue reading...
I'm currently try to troubleshoot DPC_WATCHDOG_VIOLATION (133) BSOD on Windows Server 2012 R2.
I'm trying to track down the file that is causing the issue.
Dropbox Link: Dropbox - ME1 Large DMP.zip
This is what I've done so far, but I don't know if I'm using windebug correctly
1. KnL
# Child-SP RetAddr Call Site
00 ffffd001`f6fc9c88 fffff802`b55fd46c nt!KeBugCheckEx
01 ffffd001`f6fc9c90 fffff802`b54fc5e1 nt! ?? ::FNODOBFM::`string'+0x1203c
02 ffffd001`f6fc9d20 fffff802`b5417ac5 nt!KeClockInterruptNotify+0x91
03 ffffd001`f6fc9f40 fffff802`b55559e3 hal!HalpTimerClockIpiRoutine+0x15
04 ffffd001`f6fc9f70 fffff802`b55d57da nt!KiCallInterruptServiceRoutine+0xa3
05 ffffd001`f6fc9fb0 fffff802`b55d5ca7 nt!KiInterruptSubDispatchNoLockNoEtw+0xea
06 ffffd001`fab51f40 fffff802`b5564e69 nt!KiInterruptDispatchNoLockNoEtw+0x37
07 ffffd001`fab520d0 fffff802`b5515450 nt!KiSwapDirectoryTableBaseTarget+0x79
08 ffffd001`fab52110 fffff802`b5514797 nt!KiExecuteAllDpcs+0x1b0
09 ffffd001`fab52260 fffff802`b55d810a nt!KiRetireDpcList+0xd7
0a ffffd001`fab524e0 00000000`00000000 nt!KiIdleLoop+0x5a
2. .fnent fffff800`ce7015e1
Debugger function entry 000001d6`f37398c8 for:
(fffff800`ce701550) nt!KeClockInterruptNotify+0x91 | (fffff800`ce702240) nt!KeAccumulateTicks
BeginAddress = 00000000`0007d550
EndAddress = 00000000`0007d693
UnwindInfoAddress = 00000000`00246bf4
Unwind info at fffff800`ce8cabf4, 24 bytes
version 2, flags 3, prolog 23, codes b
handler routine: nt!_GSHandlerCheck (fffff800`ce7cbfa0), data 1d0
00: offs a, unwind op 6, op info 0 UWOP_EPILOG Length: a. Flags: 0
01: offs 2e, unwind op 6, op info 0 UWOP_EPILOG Offset from end: 2e (FFFFF800CE701665)
02: offs 11, unwind op 1, op info 0 UWOP_ALLOC_LARGE FrameOffset: 1e0.
04: offs a, unwind op 0, op info e UWOP_PUSH_NONVOL reg: r14.
05: offs 8, unwind op 0, op info c UWOP_PUSH_NONVOL reg: r12.
06: offs 6, unwind op 0, op info 7 UWOP_PUSH_NONVOL reg: rdi.
07: offs 5, unwind op 0, op info 6 UWOP_PUSH_NONVOL reg: rsi.
08: offs 4, unwind op 0, op info 5 UWOP_PUSH_NONVOL reg: rbp.
09: offs 3, unwind op 0, op info 3 UWOP_PUSH_NONVOL reg: rbx.
0a: offs 2, unwind op 2, op info 0 UWOP_ALLOC_SMALL.
3. ln nt+0007d550
Browse module
Set bu breakpoint
(fffff800`ce701550) nt!KeClockInterruptNotify | (fffff800`ce702240) nt!KeAccumulateTicks
Exact matches:
nt!KeClockInterruptNotify (<no parameter info>)
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
DPC_WATCHDOG_VIOLATION (133)
The DPC watchdog detected a prolonged run time at an IRQL of DISPATCH_LEVEL
or above.
Arguments:
Arg1: 0000000000000000, A single DPC or ISR exceeded its time allotment. The offending
component can usually be identified with a stack trace.
Arg2: 0000000000000501, The DPC time count (in ticks).
Arg3: 0000000000000500, The DPC time allotment (in ticks).
Arg4: 0000000000000000, cast to nt!DPC_WATCHDOG_GLOBAL_TRIAGE_BLOCK, which contains
additional information regarding this single DPC timeout
Debugging Details:
------------------
KEY_VALUES_STRING: 1
TIMELINE_ANALYSIS: 1
DUMP_CLASS: 1
DUMP_QUALIFIER: 401
BUILD_VERSION_STRING: 9600.18969.amd64fre.winblue_ltsb.180309-0600
SYSTEM_MANUFACTURER: HPE
SYSTEM_PRODUCT_NAME: ProLiant DL380 Gen10
SYSTEM_SKU: 869118-B21
BIOS_VENDOR: HPE
BIOS_VERSION: U30
BIOS_DATE: 02/15/2018
BASEBOARD_MANUFACTURER: HPE
BASEBOARD_PRODUCT: ProLiant DL380 Gen10
DUMP_TYPE: 1
BUGCHECK_P1: 0
BUGCHECK_P2: 501
BUGCHECK_P3: 500
BUGCHECK_P4: 0
DPC_TIMEOUT_TYPE: SINGLE_DPC_TIMEOUT_EXCEEDED
CPU_COUNT: 14
CPU_MHZ: 893
CPU_VENDOR: GenuineIntel
CPU_FAMILY: 6
CPU_MODEL: 55
CPU_STEPPING: 4
CPU_MICROCODE: 6,55,4,0 (F,M,S,R) SIG: 2000043'00000000 (cache) 2000043'00000000 (init)
DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT
BUGCHECK_STR: 0x133
PROCESS_NAME: System
CURRENT_IRQL: d
ANALYSIS_SESSION_HOST: LAPTOP-61NTFUBR
ANALYSIS_SESSION_TIME: 06-03-2018 01:24:12.0684
ANALYSIS_VERSION: 10.0.17134.12 amd64fre
LAST_CONTROL_TRANSFER: from fffff800ce80246c to fffff800ce7d92a0
STACK_TEXT:
ffffd000`90b37c88 fffff800`ce80246c : 00000000`00000133 00000000`00000000 00000000`00000501 00000000`00000500 : nt!KeBugCheckEx
ffffd000`90b37c90 fffff800`ce7015e1 : ffffd000`90b37d30 00000000`0011caba 00000000`00000000 00001f80`002c0780 : nt! ?? ::FNODOBFM::`string'+0x1203c
ffffd000`90b37d20 fffff800`ce61cac5 : ffffd000`917b97a0 00000000`00000001 ffffd000`94400180 ffffd000`90b00180 : nt!KeClockInterruptNotify+0x91
ffffd000`90b37f40 fffff800`ce75a9e3 : ffffebac`cf50098c fffff800`ce777f01 ffffd000`917b9700 00000009`150dc584 : hal!HalpTimerClockIpiRoutine+0x15
ffffd000`90b37f70 fffff800`ce7da7da : ffffe001`ee0fd1e0 ffffd000`94400180 ffffd000`90b00180 00000000`00000001 : nt!KiCallInterruptServiceRoutine+0xa3
ffffd000`90b37fb0 fffff800`ce7daca7 : 00000000`00000000 00000000`00000002 ffffe001`eef03ad8 fffff800`4590c1a3 : nt!KiInterruptSubDispatchNoLockNoEtw+0xea
ffffd000`909f9010 fffff800`ce78081f : 00000000`00140001 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiInterruptDispatchNoLockNoEtw+0x37
ffffd000`909f91a0 fffff800`ce719f5a : ffffe001`ee2f3800 ffffe001`ee2f3880 00000000`00000000 00000000`00000003 : nt!KiDeferredReadyThread+0x92f
ffffd000`909f9260 fffff800`ce7dd10a : ffffd000`90b00180 ffffd000`90b00180 ffffd000`90b0e780 ffffe001`f24fd5c0 : nt!KiRetireDpcList+0x89a
ffffd000`909f94e0 00000000`00000000 : ffffd000`909fa000 ffffd000`909f3000 00000000`00000000 00000000`00000000 : nt!KiIdleLoop+0x5a
THREAD_SHA1_HASH_MOD_FUNC: 462a510eab1c27ef93100957e18b5cdf55619ed2
THREAD_SHA1_HASH_MOD_FUNC_OFFSET: 11c0f60ebc35096add6c4731ddc905fb41effc78
THREAD_SHA1_HASH_MOD: 692dc177616b23b31c5615392ac069be10b8455d
FOLLOWUP_IP:
nt! ?? ::FNODOBFM::`string'+1203c
fffff800`ce80246c cc int 3
FAULT_INSTR_CODE: 442ccdcc
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt! ?? ::FNODOBFM::`string'+1203c
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 5aa29c76
STACK_COMMAND: .thread ; .cxr ; kb
BUCKET_ID_FUNC_OFFSET: 1203c
FAILURE_BUCKET_ID: 0x133_DPC_nt!_??_::FNODOBFM::_string_
BUCKET_ID: 0x133_DPC_nt!_??_::FNODOBFM::_string_
PRIMARY_PROBLEM_CLASS: 0x133_DPC_nt!_??_::FNODOBFM::_string_
TARGET_TIME: 2018-06-02T13:10:51.000Z
OSBUILD: 9600
OSSERVICEPACK: 0
SERVICEPACK_NUMBER: 0
OS_REVISION: 0
SUITE_MASK: 272
PRODUCT_TYPE: 3
OSPLATFORM_TYPE: x64
OSNAME: Windows 8.1
OSEDITION: Windows 8.1 Server TerminalServer SingleUserTS
OS_LOCALE:
USER_LCID: 0
OSBUILD_TIMESTAMP: 2018-03-09 06:38:46
BUILDDATESTAMP_STR: 180309-0600
BUILDLAB_STR: winblue_ltsb
BUILDOSVER_STR: 6.3.9600.18969.amd64fre.winblue_ltsb.180309-0600
ANALYSIS_SESSION_ELAPSED_TIME: 8fc
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:0x133_dpc_nt!_??_::fnodobfm::_string_
FAILURE_ID_HASH: {12e2b1b6-39a2-9cfe-dc70-25086917b8e2}
Followup: MachineOwner
---------
Continue reading...