Windows System Software -- Consulting, Training, Development -- Unique Expertise, Guaranteed Results
Before Posting...
Please check out the Community Guidelines in the Announcements and Administration Category.More Info on Driver Writing and Debugging
The free OSR Learning Library has more than 50 articles on a wide variety of topics about writing and debugging device drivers and Minifilters. From introductory level to advanced. All the articles have been recently reviewed and updated, and are written using the clear and definitive style you've come to expect from OSR over the years.
Check out The OSR Learning Library at: https://www.osr.com/osr-learning-library/
Help on analyzing the ERESOURCE status
Hi,
On a xp-x64 machine, ocasionally the system becomes slow. I triggered a blue screen to dump all kernal data. From the dump file, the ERESOURCE [0xfffffadf37c52800] was already exclusively acquired by thread [fffffadf379117a0]. It seems the ERESOURCE [0xfffffadf37c52800] is for the VCB data. Could you please give some suggestions about what is the thread [fffffadf379117a0] doing? Trying to accquire the same eresource or another eresource?
Our driver is not invloved in all the threads for the ERESOURCE [0xfffffadf37c52800].
========================================================
0: kd> !thread fffffadf379117a0
THREAD fffffadf379117a0 Cid 0364.05b8 Teb: 000007fffff6a000 Win32Thread: 0000000000000000 STANDBY
IRP List:
fffffadf35b3b010: (0006,03a0) Flags: 00000404 Mdl: 00000000
Impersonation token: fffffa800331ebb0 (Level Impersonation)
Owning Process fffffadf39dd86c0 Image: svchost.exe
Attached Process N/A Image: N/A
Wait Start TickCount 32144 Ticks: 15 (0:00:00:00.234)
Context Switch Count 156
UserTime 00:00:00.000
KernelTime 00:00:00.000
Start Address 0x000007ff769360d0
Stack Init fffffadf2a50ce00 Current fffffadf2a50c410
Base fffffadf2a50d000 Limit fffffadf2a507000 Call 0
Priority 9 BasePriority 8 PriorityDecrement 1
Child-SP RetAddr : Args to Child : Call Site
fffffadf`2a50c450 fffff800`01027602 : fffffadf`2a50c6d8 fffffadf`2ac92b27 fffffadf`37bb70c0 fffffadf`36c3e010 : nt!KiSwapContext+0x85
fffffadf`2a50c5d0 fffff800`0102820e : 00000001`2dbf9ea0 fffff800`011b5dc0 fffffadf`37911838 fffffadf`379117a0 : nt!KiSwapThread+0x3c9
fffffadf`2a50c630 fffff800`010b0343 : 00000000`00000090 fffffadf`0000001b fffffadf`37bb7000 00000000`00000000 : nt!KeWaitForSingleObject+0x5a6
fffffadf`2a50c6b0 fffff800`01047549 : fffffadf`37c52800 00000000`00000000 00000000`00000001 fffffadf`379117a0 : nt!ExpWaitForResource+0x275 ===> it is waiting for [fffffadf`37c52800]. Isn't it already owned the thread?
fffffadf`2a50c720 fffffadf`2ab9aa74 : fffffadf`36c715f0 fffffadf`2a50c970 00000000`00000000 fffffa80`0084ab00 : nt!ExAcquireResourceExclusiveLite+0x1ab
fffffadf`2a50c750 fffffadf`2abb2915 : fffffadf`36c715f0 fffffa80`0084ac00 fffffa80`0084ab00 fffffadf`37c521c8 : Ntfs!NtfsCommonClose+0xcd
fffffadf`2a50c7f0 fffffadf`2ac96542 : fffffadf`35b3b000 fffffadf`35b3b010 fffffadf`35b3b010 fffffadf`39e789e0 : Ntfs!NtfsFsdClose+0x392
fffffadf`2a50c8e0 fffffadf`2ac968df : 00000000`00000000 fffffadf`35b3b010 fffffadf`35b3b000 fffffadf`35b3b010 : fltMgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x3f2
fffffadf`2a50c950 fffffadf`2b71cff7 : 00000005`00000000 fffffadf`367dac10 fffffadf`35c95050 fffffadf`35b3b010 : fltMgr!FltpDispatch+0x17f
fffffadf`2a50c9b0 fffffadf`2b7245ba : 00000000`00000001 00000000`00000000 00000000`00000001 fffffadf`3787f460 : TmPreFlt!TmpAddRdr+0xc87
fffffadf`2a50c9e0 fffff800`01284120 : fffffadf`35c95050 fffffadf`35c95050 fffffadf`35c95050 00000000`00000000 : TmPreFlt!TmpQueryFullName+0x7526
fffffadf`2a50ca10 fffff800`01284e30 : fffffadf`35c95020 fffffadf`35c95050 fffffadf`35c95050 00000000`00000000 : nt!IopDeleteFile+0x301
fffffadf`2a50cab0 fffff800`0103c22e : fffffadf`35c95020 00000000`0000075c fffffadf`35c95050 00000000`00000000 : nt!ObpRemoveObjectRoutine+0x14f
fffffadf`2a50cb20 fffff800`01288e97 : fffffa80`035d2d70 fffffa80`035d2d70 fffffa80`02cac770 00000000`00000000 : nt!ObfDereferenceObject+0x83
fffffadf`2a50cb50 fffff800`01285a54 : fffffadf`379117a0 00000000`0000075c fffffadf`39dd86c0 fffffadf`379117a0 : nt!ObpCloseHandleTableEntry+0x24b
fffffadf`2a50cbf0 fffff800`0102e2bd : fffffadf`379117a0 fffffadf`2a50ccf0 00000000`00000000 00000000`00000000 : nt!ObpCloseHandle+0xb0
fffffadf`2a50cc70 00000000`77ef0ada : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x3 (TrapFrame @ fffffadf`2a50cc70)
00000000`02edf018 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x77ef0ada
=================================================
0: kd> !locks -v 0xfffffadf37c52800
Resource @ 0xfffffadf37c52800 Exclusively owned
Contention Count = 3214
NumberOfSharedWaiters = 10
Threads: fffffadf379117a0-01<*>
THREAD fffffadf379117a0 Cid 0364.05b8 Teb: 000007fffff6a000 Win32Thread: 0000000000000000 STANDBY
IRP List:
fffffadf35b3b010: (0006,03a0) Flags: 00000404 Mdl: 00000000
Impersonation token: fffffa800331ebb0 (Level Impersonation)
Owning Process fffffadf39dd86c0 Image: svchost.exe
Attached Process N/A Image: N/A
Wait Start TickCount 32144 Ticks: 15 (0:00:00:00.234)
Context Switch Count 156
UserTime 00:00:00.000
KernelTime 00:00:00.000
Start Address 0x000007ff769360d0
Stack Init fffffadf2a50ce00 Current fffffadf2a50c410
Base fffffadf2a50d000 Limit fffffadf2a507000 Call 0
Priority 9 BasePriority 8 PriorityDecrement 1
Child-SP RetAddr Call Site
fffffadf`2a50c450 fffff800`01027602 nt!KiSwapContext+0x85
fffffadf`2a50c5d0 fffff800`0102820e nt!KiSwapThread+0x3c9
fffffadf`2a50c630 fffff800`010b0343 nt!KeWaitForSingleObject+0x5a6
fffffadf`2a50c6b0 fffff800`01047549 nt!ExpWaitForResource+0x275
fffffadf`2a50c720 fffffadf`2ab9aa74 nt!ExAcquireResourceExclusiveLite+0x1ab
fffffadf`2a50c750 fffffadf`2abb2915 Ntfs!NtfsCommonClose+0xcd
fffffadf`2a50c7f0 fffffadf`2ac96542 Ntfs!NtfsFsdClose+0x392
fffffadf`2a50c8e0 fffffadf`2ac968df fltMgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x3f2
fffffadf`2a50c950 fffffadf`2b71cff7 fltMgr!FltpDispatch+0x17f
fffffadf`2a50c9b0 fffffadf`2b7245ba TmPreFlt!TmpAddRdr+0xc87
fffffadf`2a50c9e0 fffff800`01284120 TmPreFlt!TmpQueryFullName+0x7526
fffffadf`2a50ca10 fffff800`01284e30 nt!IopDeleteFile+0x301
fffffadf`2a50cab0 fffff800`0103c22e nt!ObpRemoveObjectRoutine+0x14f
fffffadf`2a50cb20 fffff800`01288e97 nt!ObfDereferenceObject+0x83
fffffadf`2a50cb50 fffff800`01285a54 nt!ObpCloseHandleTableEntry+0x24b
fffffadf`2a50cbf0 fffff800`0102e2bd nt!ObpCloseHandle+0xb0
fffffadf`2a50cc70 00000000`77ef0ada nt!KiSystemServiceCopyEnd+0x3 (TrapFrame @ fffffadf`2a50cc70)
00000000`02edf018 00000000`00000000 0x77ef0ada
fffffadf368c3a50-01
THREAD fffffadf368c3a50 Cid 0388.0d50 Teb: 000007fffff8a000 Win32Thread: fffffa8004fc5010 WAIT: (Unknown) KernelMode Non-Alertable
fffffadf39f4a330 Semaphore Limit 0x7fffffff
fffffadf368c3b08 NotificationTimer
IRP List:
fffffadf367da870: (0006,03a0) Flags: 00000404 Mdl: 00000000
Not impersonating
DeviceMap fffffa8002d356d0
Owning Process fffffadf36ce4040 Image: explorer.exe
Attached Process N/A Image: N/A
Wait Start TickCount 32159 Ticks: 0
Context Switch Count 6088 LargeStack
UserTime 00:00:00.343
KernelTime 00:00:00.515
Start Address 0x0000000077d6b6a0
Stack Init fffffadf1220be00 Current fffffadf1220b3f0
Base fffffadf1220c000 Limit fffffadf12205000 Call 0
Priority 8 BasePriority 8 PriorityDecrement 0
Child-SP RetAddr Call Site
fffffadf`1220b430 fffff800`01027602 nt!KiSwapContext+0x85
fffffadf`1220b5b0 fffff800`0102820e nt!KiSwapThread+0x3c9
fffffadf`1220b610 fffff800`010474c8 nt!KeWaitForSingleObject+0x5a6
fffffadf`1220b690 fffff800`01010fd4 nt!ExpWaitForResource+0x48
fffffadf`1220b700 fffffadf`2abb2a3f nt!ExAcquireResourceSharedLite+0x32e
fffffadf`1220b750 fffffadf`2abb2915 Ntfs!NtfsCommonClose+0xa3
fffffadf`1220b7f0 fffffadf`2ac96542 Ntfs!NtfsFsdClose+0x392
fffffadf`1220b8e0 fffffadf`2ac968df fltMgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x3f2
fffffadf`1220b950 fffffadf`2b71cff7 fltMgr!FltpDispatch+0x17f
fffffadf`1220b9b0 fffffadf`2b7245ba TmPreFlt!TmpAddRdr+0xc87
fffffadf`1220b9e0 fffff800`01284120 TmPreFlt!TmpQueryFullName+0x7526
fffffadf`1220ba10 fffff800`01284e30 nt!IopDeleteFile+0x301
fffffadf`1220bab0 fffff800`0103c22e nt!ObpRemoveObjectRoutine+0x14f
fffffadf`1220bb20 fffff800`01288e97 nt!ObfDereferenceObject+0x83
fffffadf`1220bb50 fffff800`01285a54 nt!ObpCloseHandleTableEntry+0x24b
fffffadf`1220bbf0 fffff800`0102e2bd nt!ObpCloseHandle+0xb0
fffffadf`1220bc70 00000000`77ef0ada nt!KiSystemServiceCopyEnd+0x3 (TrapFrame @ fffffadf`1220bc70)
00000000`043ed798 00000000`00000000 0x77ef0ada
fffffadf36a7ba40-01
THREAD fffffadf36a7ba40 Cid 0b20.0d64 Teb: 000000007ef9d000 Win32Thread: fffffa80007b5920 WAIT: (Unknown) KernelMode Non-Alertable
fffffadf39f4a330 Semaphore Limit 0x7fffffff
fffffadf36a7baf8 NotificationTimer
IRP List:
fffffadf35bb4b50: (0006,03a0) Flags: 00000884 Mdl: 00000000
Not impersonating
DeviceMap fffffa8002d356d0
Owning Process fffffadf37bc6870 Image: vmware-tray.exe
Attached Process N/A Image: N/A
Wait Start TickCount 31952 Ticks: 207 (0:00:00:03.234)
Context Switch Count 1140 LargeStack
UserTime 00:00:00.000
KernelTime 00:00:00.000
Win32 Start Address 0x0000000003a4ac60
Start Address 0x000000007d4d1504
Stack Init fffffadf15382e00 Current fffffadf153818a0
Base fffffadf15383000 Limit fffffadf1537c000 Call 0
Priority 14 BasePriority 8 PriorityDecrement 6
Child-SP RetAddr Call Site
fffffadf`153818e0 fffff800`01027602 nt!KiSwapContext+0x85
fffffadf`15381a60 fffff800`0102820e nt!KiSwapThread+0x3c9
fffffadf`15381ac0 fffff800`010b0343 nt!KeWaitForSingleObject+0x5a6
fffffadf`15381b40 fffff800`01010fd4 nt!ExpWaitForResource+0x275
fffffadf`15381bb0 fffffadf`2abbad9c nt!ExAcquireResourceSharedLite+0x32e
fffffadf`15381c00 fffffadf`2abbb228 Ntfs!NtfsAcquireSharedVcb+0x2c
fffffadf`15381c40 fffffadf`2abbd2c6 Ntfs!NtfsCommonCreate+0x200
fffffadf`15382020 fffffadf`2ac96542 Ntfs!NtfsFsdCreate+0x218
fffffadf`153821b0 fffffadf`2acb1e1d fltMgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x3f2
fffffadf`15382220 fffffadf`2ac79289 fltMgr!FltpCreate+0x3bd
fffffadf`153822b0 fffffadf`2b72455d sr!SrCreate+0x1c9
fffffadf`15382350 fffff800`01283749 TmPreFlt!TmpQueryFullName+0x74c9
fffffadf`15382460 fffff800`012810e4 nt!IopParseDevice+0x1088
fffffadf`15382610 fffff800`01285807 nt!ObpLookupObjectName+0x931
fffffadf`15382720 fffff800`01292dcd nt!ObOpenObjectByName+0x180
fffffadf`15382910 fffff800`01299e87 nt!IopCreateFile+0x630
fffffadf`15382aa0 fffff800`01295889 nt!IoCreateFile+0x12f
fffffadf`15382b80 fffff800`0102e2bd nt!NtOpenFile+0x49
fffffadf`15382c00 00000000`77ef0d1a nt!KiSystemServiceCopyEnd+0x3 (TrapFrame @ fffffadf`15382c70)
00000000`03f1e798 00000000`00000000 0x77ef0d1a
fffffadf36825040-01
THREAD fffffadf36825040 Cid 0ba4.0ac8 Teb: 000007fffff7e000 Win32Thread: 0000000000000000 WAIT: (Unknown) KernelMode Non-Alertable
fffffadf39f4a330 Semaphore Limit 0x7fffffff
fffffadf368250f8 NotificationTimer
IRP List:
fffffadf35c15010: (0006,03a0) Flags: 00000884 Mdl: 00000000
Not impersonating
DeviceMap fffffa80000037b0
Owning Process fffffadf36bc2040 Image: TmListen.exe
Attached Process N/A Image: N/A
Wait Start TickCount 31966 Ticks: 193 (0:00:00:03.015)
Context Switch Count 117
UserTime 00:00:00.000
KernelTime 00:00:00.000
Start Address 0x0000000077d6b6a0
Stack Init fffffadf2a5bbe00 Current fffffadf2a5ba8a0
Base fffffadf2a5bc000 Limit fffffadf2a5b6000 Call 0
Priority 14 BasePriority 8 PriorityDecrement 6
Child-SP RetAddr Call Site
fffffadf`2a5ba8e0 fffff800`01027602 nt!KiSwapContext+0x85
fffffadf`2a5baa60 fffff800`0102820e nt!KiSwapThread+0x3c9
fffffadf`2a5baac0 fffff800`010b0343 nt!KeWaitForSingleObject+0x5a6
fffffadf`2a5bab40 fffff800`01010fd4 nt!ExpWaitForResource+0x275
fffffadf`2a5babb0 fffffadf`2abbad9c nt!ExAcquireResourceSharedLite+0x32e
fffffadf`2a5bac00 fffffadf`2abbb228 Ntfs!NtfsAcquireSharedVcb+0x2c
fffffadf`2a5bac40 fffffadf`2abbd2c6 Ntfs!NtfsCommonCreate+0x200
fffffadf`2a5bb020 fffffadf`2ac96542 Ntfs!NtfsFsdCreate+0x218
fffffadf`2a5bb1b0 fffffadf`2acb1e1d fltMgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x3f2
fffffadf`2a5bb220 fffffadf`2ac79289 fltMgr!FltpCreate+0x3bd
fffffadf`2a5bb2b0 fffffadf`2b72455d sr!SrCreate+0x1c9
fffffadf`2a5bb350 fffff800`01283749 TmPreFlt!TmpQueryFullName+0x74c9
fffffadf`2a5bb460 fffff800`012810e4 nt!IopParseDevice+0x1088
fffffadf`2a5bb610 fffff800`01285807 nt!ObpLookupObjectName+0x931
fffffadf`2a5bb720 fffff800`01292dcd nt!ObOpenObjectByName+0x180
fffffadf`2a5bb910 fffff800`01299e87 nt!IopCreateFile+0x630
fffffadf`2a5bbaa0 fffff800`01295889 nt!IoCreateFile+0x12f
fffffadf`2a5bbb80 fffff800`0102e2bd nt!NtOpenFile+0x49
fffffadf`2a5bbc00 00000000`77ef0d1a nt!KiSystemServiceCopyEnd+0x3 (TrapFrame @ fffffadf`2a5bbc70)
00000000`064cf298 00000000`00000000 0x77ef0d1a
fffffadf3a5f9040-01
THREAD fffffadf3a5f9040 Cid 0004.0024 Teb: 0000000000000000 Win32Thread: 0000000000000000 WAIT: (Unknown) KernelMode Non-Alertable
fffffadf39f4a330 Semaphore Limit 0x7fffffff
fffffadf3a5f90f8 NotificationTimer
IRP List:
fffffadf35c13c60: (0006,03a0) Flags: 00000004 Mdl: 00000000
Not impersonating
DeviceMap fffffa80000037b0
Owning Process fffffadf3a5fe040 Image: System
Attached Process N/A Image: N/A
Wait Start TickCount 31972 Ticks: 187 (0:00:00:02.921)
Context Switch Count 8746
UserTime 00:00:00.000
KernelTime 00:00:00.093
Start Address nt!ExpWorkerThread (0xfffff80001003970)
Stack Init fffffadf2ba63e00 Current fffffadf2ba63350
Base fffffadf2ba64000 Limit fffffadf2ba5e000 Call 0
Priority 14 BasePriority 12 PriorityDecrement 1
Child-SP RetAddr Call Site
fffffadf`2ba63390 fffff800`01027602 nt!KiSwapContext+0x85
fffffadf`2ba63510 fffff800`0102820e nt!KiSwapThread+0x3c9
fffffadf`2ba63570 fffff800`010b0343 nt!KeWaitForSingleObject+0x5a6
fffffadf`2ba635f0 fffff800`01010fd4 nt!ExpWaitForResource+0x275
fffffadf`2ba63660 fffffadf`2abbad9c nt!ExAcquireResourceSharedLite+0x32e
fffffadf`2ba636b0 fffffadf`2aba106e Ntfs!NtfsAcquireSharedVcb+0x2c
fffffadf`2ba636f0 fffffadf`2aba153a Ntfs!NtfsCommonFlushBuffers+0x1ac
fffffadf`2ba637b0 fffffadf`2ac96922 Ntfs!NtfsFsdFlushBuffers+0xc3
fffffadf`2ba63830 fffffadf`2b71cff7 fltMgr!FltpDispatch+0x1c2
fffffadf`2ba63890 fffff800`01264b2b TmPreFlt!TmpAddRdr+0xc87
fffffadf`2ba638c0 fffff800`0102e2bd nt!NtFlushBuffersFile+0x2bd
fffffadf`2ba63950 fffff800`0102e780 nt!KiSystemServiceCopyEnd+0x3 (TrapFrame @ fffffadf`2ba63950)
fffffadf`2ba63ae8 fffff800`0125a3c5 nt!KiServiceLinkage
fffffadf`2ba63af0 fffff800`0125e49b nt!CmpFileFlush+0x68
fffffadf`2ba63b40 fffff800`0125999f nt!HvpWriteLog+0x20f
fffffadf`2ba63c10 fffff800`0125e33c nt!HvSyncHive+0x94
fffffadf`2ba63c40 fffff800`0125d42d nt!CmpDoFlushNextHive+0xf0
fffffadf`2ba63cc0 fffff800`0103754a nt!CmpLazyFlushWorker+0xef
fffffadf`2ba63d00 fffff800`0124b932 nt!ExpWorkerThread+0x13b
fffffadf`2ba63d70 fffff800`01020196 nt!PspSystemThreadStartup+0x3e
fffffadf`2ba63dd0 00000000`00000000 nt!KxStartSystemThread+0x16
fffffadf367d9bf0-01
THREAD fffffadf367d9bf0 Cid 0448.0f30 Teb: 000007fffff88000 Win32Thread: 0000000000000000 WAIT: (Unknown) KernelMode Non-Alertable
fffffadf39f4a330 Semaphore Limit 0x7fffffff
fffffadf367d9ca8 NotificationTimer
Not impersonating
DeviceMap fffffa80000037b0
Owning Process fffffadf3787ac20 Image: spoolsv.exe
Attached Process N/A Image: N/A
Wait Start TickCount 31974 Ticks: 185 (0:00:00:02.890)
Context Switch Count 8
UserTime 00:00:00.000
KernelTime 00:00:00.000
Win32 Start Address 0x00000000000bed80
Start Address 0x0000000077d6b6a0
Stack Init fffffadf153c8e00 Current fffffadf153c7970
Base fffffadf153c9000 Limit fffffadf153c3000 Call 0
Priority 14 BasePriority 8 PriorityDecrement 6
*** ERROR: Module load completed but symbols could not be loaded for sptd.sys
Child-SP RetAddr Call Site
fffffadf`153c79b0 fffff800`01027602 nt!KiSwapContext+0x85
fffffadf`153c7b30 fffff800`0102820e nt!KiSwapThread+0x3c9
fffffadf`153c7b90 fffff800`010b0343 nt!KeWaitForSingleObject+0x5a6
fffffadf`153c7c10 fffff800`01010fd4 nt!ExpWaitForResource+0x275
fffffadf`153c7c80 fffffadf`2abbad9c nt!ExAcquireResourceSharedLite+0x32e
fffffadf`153c7cd0 fffffadf`2abbb228 Ntfs!NtfsAcquireSharedVcb+0x2c
fffffadf`153c7d10 fffffadf`2abaa0cb Ntfs!NtfsCommonCreate+0x200
fffffadf`153c80f0 fffffadf`2b129313 Ntfs!NtfsNetworkOpenCreate+0xcc
fffffadf`153c83a0 fffffadf`2ac94d27 sptd+0x69313
fffffadf`153c83d0 fffffadf`2ac95041 fltMgr!FltpPerformFastIoCall+0x457
fffffadf`153c8440 fffffadf`2acb0b2a fltMgr!FltpPassThroughFastIo+0xa1
fffffadf`153c8480 fffffadf`2ac7daba fltMgr!FltpFastIoQueryOpen+0x16a
fffffadf`153c8520 fffffadf`2b72529f sr!SrFastIoQueryOpen+0x5a
fffffadf`153c8550 fffff800`0129a56d TmPreFlt!TmpQueryFullName+0x820b
fffffadf`153c8580 fffff800`012810e4 nt!IopParseDevice+0xf52
fffffadf`153c8730 fffff800`01285807 nt!ObpLookupObjectName+0x931
fffffadf`153c8840 fffff800`012959cd nt!ObOpenObjectByName+0x180
fffffadf`153c8a30 fffff800`0102e2bd nt!NtQueryAttributesFile+0x133
fffffadf`153c8c70 00000000`77ef0dba nt!KiSystemServiceCopyEnd+0x3 (TrapFrame @ fffffadf`153c8c70)
00000000`0302f158 00000000`00000000 0x77ef0dba
fffffadf36983bf0-01
THREAD fffffadf36983bf0 Cid 0b68.0d38 Teb: 000007fffff98000 Win32Thread: 0000000000000000 WAIT: (Unknown) KernelMode Non-Alertable
fffffadf39f4a330 Semaphore Limit 0x7fffffff
fffffadf36983ca8 NotificationTimer
IRP List:
fffffadf35b3bc60: (0006,03a0) Flags: 00000884 Mdl: 00000000
Not impersonating
DeviceMap fffffa8002d356d0
Owning Process fffffadf36b34040 Image: PccNTMon.exe
Attached Process N/A Image: N/A
Wait Start TickCount 32039 Ticks: 120 (0:00:00:01.875)
Context Switch Count 113
UserTime 00:00:00.000
KernelTime 00:00:00.000
Start Address 0x0000000077d6b6a0
Stack Init fffffadf11a0ae00 Current fffffadf11a098a0
Base fffffadf11a0b000 Limit fffffadf11a05000 Call 0
Priority 14 BasePriority 8 PriorityDecrement 6
Child-SP RetAddr Call Site
fffffadf`11a098e0 fffff800`01027602 nt!KiSwapContext+0x85
fffffadf`11a09a60 fffff800`0102820e nt!KiSwapThread+0x3c9
fffffadf`11a09ac0 fffff800`010b0343 nt!KeWaitForSingleObject+0x5a6
fffffadf`11a09b40 fffff800`01010fd4 nt!ExpWaitForResource+0x275
fffffadf`11a09bb0 fffffadf`2abbad9c nt!ExAcquireResourceSharedLite+0x32e
fffffadf`11a09c00 fffffadf`2abbb228 Ntfs!NtfsAcquireSharedVcb+0x2c
fffffadf`11a09c40 fffffadf`2abbd2c6 Ntfs!NtfsCommonCreate+0x200
fffffadf`11a0a020 fffffadf`2ac96542 Ntfs!NtfsFsdCreate+0x218
fffffadf`11a0a1b0 fffffadf`2acb1e1d fltMgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x3f2
fffffadf`11a0a220 fffffadf`2ac79289 fltMgr!FltpCreate+0x3bd
fffffadf`11a0a2b0 fffffadf`2b72455d sr!SrCreate+0x1c9
fffffadf`11a0a350 fffff800`01283749 TmPreFlt!TmpQueryFullName+0x74c9
fffffadf`11a0a460 fffff800`012810e4 nt!IopParseDevice+0x1088
fffffadf`11a0a610 fffff800`01285807 nt!ObpLookupObjectName+0x931
fffffadf`11a0a720 fffff800`01292dcd nt!ObOpenObjectByName+0x180
fffffadf`11a0a910 fffff800`01299e87 nt!IopCreateFile+0x630
fffffadf`11a0aaa0 fffff800`01295889 nt!IoCreateFile+0x12f
fffffadf`11a0ab80 fffff800`0102e2bd nt!NtOpenFile+0x49
fffffadf`11a0ac00 00000000`77ef0d1a nt!KiSystemServiceCopyEnd+0x3 (TrapFrame @ fffffadf`11a0ac70)
00000000`03bcf4b8 00000000`00000000 0x77ef0d1a
fffffadf37883890-01
THREAD fffffadf37883890 Cid 0f20.0390 Teb: 000000007efdb000 Win32Thread: fffffa8006b08620 WAIT: (Unknown) KernelMode Non-Alertable
fffffadf39f4a330 Semaphore Limit 0x7fffffff
fffffadf37883948 NotificationTimer
Not impersonating
DeviceMap fffffa8002d356d0
Owning Process fffffadf36ade870 Image: EventMonitor.exe
Attached Process N/A Image: N/A
Wait Start TickCount 32043 Ticks: 116 (0:00:00:01.812)
Context Switch Count 11389 LargeStack
UserTime 00:00:00.328
KernelTime 00:00:00.312
Win32 Start Address 0x00000000004137d1
Start Address 0x0000000077d59620
Stack Init fffffadf2b40e570 Current fffffadf2b40d0e0
Base fffffadf2b410000 Limit fffffadf2b404000 Call fffffadf2b40e770
Priority 14 BasePriority 8 PriorityDecrement 5
Child-SP RetAddr Call Site
fffffadf`2b40d120 fffff800`01027602 nt!KiSwapContext+0x85
fffffadf`2b40d2a0 fffff800`0102820e nt!KiSwapThread+0x3c9
fffffadf`2b40d300 fffff800`010b0343 nt!KeWaitForSingleObject+0x5a6
fffffadf`2b40d380 fffff800`01010fd4 nt!ExpWaitForResource+0x275
fffffadf`2b40d3f0 fffffadf`2abbad9c nt!ExAcquireResourceSharedLite+0x32e
fffffadf`2b40d440 fffffadf`2abbb228 Ntfs!NtfsAcquireSharedVcb+0x2c
fffffadf`2b40d480 fffffadf`2abaa0cb Ntfs!NtfsCommonCreate+0x200
fffffadf`2b40d860 fffffadf`2b129313 Ntfs!NtfsNetworkOpenCreate+0xcc
fffffadf`2b40db10 fffffadf`2ac94d27 sptd+0x69313
fffffadf`2b40db40 fffffadf`2ac95041 fltMgr!FltpPerformFastIoCall+0x457
fffffadf`2b40dbb0 fffffadf`2acb0b2a fltMgr!FltpPassThroughFastIo+0xa1
fffffadf`2b40dbf0 fffffadf`2ac7daba fltMgr!FltpFastIoQueryOpen+0x16a
fffffadf`2b40dc90 fffffadf`2b72529f sr!SrFastIoQueryOpen+0x5a
fffffadf`2b40dcc0 fffff800`0129a56d TmPreFlt!TmpQueryFullName+0x820b
fffffadf`2b40dcf0 fffff800`012810e4 nt!IopParseDevice+0xf52
fffffadf`2b40dea0 fffff800`01285807 nt!ObpLookupObjectName+0x931
fffffadf`2b40dfb0 fffff800`012959cd nt!ObOpenObjectByName+0x180
fffffadf`2b40e1a0 fffff800`0102e2bd nt!NtQueryAttributesFile+0x133
fffffadf`2b40e3e0 00000000`77ef0dba nt!KiSystemServiceCopyEnd+0x3 (TrapFrame @ fffffadf`2b40e3e0)
00000000`0012c508 fffff800`010265c0 0x77ef0dba
fffffadf`2b40e770 fffffadf`2b40ef50 nt!KiCallUserMode
fffffadf`2b40e778 00000000`0012d578 0xfffffadf`2b40ef50
fffffadf`2b40e780 00000000`0012d4b0 0x12d578
fffffadf`2b40e788 00000000`00000000 0x12d4b0
fffffadf36b3a7f0-01
THREAD fffffadf36b3a7f0 Cid 0b68.0b6c Teb: 000007fffffdb000 Win32Thread: fffffa8002a86d80 WAIT: (Unknown) KernelMode Non-Alertable
fffffadf39f4a330 Semaphore Limit 0x7fffffff
fffffadf36b3a8a8 NotificationTimer
Not impersonating
DeviceMap fffffa8002d356d0
Owning Process fffffadf36b34040 Image: PccNTMon.exe
Attached Process N/A Image: N/A
Wait Start TickCount 32071 Ticks: 88 (0:00:00:01.375)
Context Switch Count 7789 LargeStack
UserTime 00:00:00.015
KernelTime 00:00:00.109
Win32 Start Address 0x00000001400a4100
Start Address 0x0000000077d59620
Stack Init fffffadf1547ae00 Current fffffadf15479970
Base fffffadf1547b000 Limit fffffadf15470000 Call 0
Priority 14 BasePriority 8 PriorityDecrement 2
Child-SP RetAddr Call Site
fffffadf`154799b0 fffff800`01027602 nt!KiSwapContext+0x85
fffffadf`15479b30 fffff800`0102820e nt!KiSwapThread+0x3c9
fffffadf`15479b90 fffff800`010b0343 nt!KeWaitForSingleObject+0x5a6
fffffadf`15479c10 fffff800`01010fd4 nt!ExpWaitForResource+0x275
fffffadf`15479c80 fffffadf`2abbad9c nt!ExAcquireResourceSharedLite+0x32e
fffffadf`15479cd0 fffffadf`2abbb228 Ntfs!NtfsAcquireSharedVcb+0x2c
fffffadf`15479d10 fffffadf`2abaa0cb Ntfs!NtfsCommonCreate+0x200
fffffadf`1547a0f0 fffffadf`2b129313 Ntfs!NtfsNetworkOpenCreate+0xcc
fffffadf`1547a3a0 fffffadf`2ac94d27 sptd+0x69313
fffffadf`1547a3d0 fffffadf`2ac95041 fltMgr!FltpPerformFastIoCall+0x457
fffffadf`1547a440 fffffadf`2acb0b2a fltMgr!FltpPassThroughFastIo+0xa1
fffffadf`1547a480 fffffadf`2ac7daba fltMgr!FltpFastIoQueryOpen+0x16a
fffffadf`1547a520 fffffadf`2b72529f sr!SrFastIoQueryOpen+0x5a
fffffadf`1547a550 fffff800`0129a56d TmPreFlt!TmpQueryFullName+0x820b
fffffadf`1547a580 fffff800`012810e4 nt!IopParseDevice+0xf52
fffffadf`1547a730 fffff800`01285807 nt!ObpLookupObjectName+0x931
fffffadf`1547a840 fffff800`012959cd nt!ObOpenObjectByName+0x180
fffffadf`1547aa30 fffff800`0102e2bd nt!NtQueryAttributesFile+0x133
fffffadf`1547ac70 00000000`77ef0dba nt!KiSystemServiceCopyEnd+0x3 (TrapFrame @ fffffadf`1547ac70)
00000000`0023f608 00000000`00000000 0x77ef0dba
fffffadf39d9b880-01
THREAD fffffadf39d9b880 Cid 0a3c.0a44 Teb: 000000007efdb000 Win32Thread: fffffa8005352190 WAIT: (Unknown) KernelMode Non-Alertable
fffffadf39f4a330 Semaphore Limit 0x7fffffff
fffffadf39d9b938 NotificationTimer
Not impersonating
DeviceMap fffffa8000b19f00
Owning Process fffffadf36ae3890 Image: Dbgview.exe
Attached Process N/A Image: N/A
Wait Start TickCount 32071 Ticks: 88 (0:00:00:01.375)
Context Switch Count 15962 LargeStack
UserTime 00:00:00.531
KernelTime 00:00:00.828
Win32 Start Address 0x00000000004153b7
Start Address 0x0000000077d59620
Stack Init fffffadf10afc010 Current fffffadf10afab80
Base fffffadf10afd000 Limit fffffadf10af2000 Call fffffadf10afc210
Priority 14 BasePriority 8 PriorityDecrement 6
Child-SP RetAddr Call Site
fffffadf`10afabc0 fffff800`01027602 nt!KiSwapContext+0x85
fffffadf`10afad40 fffff800`0102820e nt!KiSwapThread+0x3c9
fffffadf`10afada0 fffff800`010b0343 nt!KeWaitForSingleObject+0x5a6
fffffadf`10afae20 fffff800`01010fd4 nt!ExpWaitForResource+0x275
fffffadf`10afae90 fffffadf`2abbad9c nt!ExAcquireResourceSharedLite+0x32e
fffffadf`10afaee0 fffffadf`2abbb228 Ntfs!NtfsAcquireSharedVcb+0x2c
fffffadf`10afaf20 fffffadf`2abaa0cb Ntfs!NtfsCommonCreate+0x200
fffffadf`10afb300 fffffadf`2b129313 Ntfs!NtfsNetworkOpenCreate+0xcc
fffffadf`10afb5b0 fffffadf`2ac94d27 sptd+0x69313
fffffadf`10afb5e0 fffffadf`2ac95041 fltMgr!FltpPerformFastIoCall+0x457
fffffadf`10afb650 fffffadf`2acb0b2a fltMgr!FltpPassThroughFastIo+0xa1
fffffadf`10afb690 fffffadf`2ac7daba fltMgr!FltpFastIoQueryOpen+0x16a
fffffadf`10afb730 fffffadf`2b72529f sr!SrFastIoQueryOpen+0x5a
fffffadf`10afb760 fffff800`0129a56d TmPreFlt!TmpQueryFullName+0x820b
fffffadf`10afb790 fffff800`012810e4 nt!IopParseDevice+0xf52
fffffadf`10afb940 fffff800`01285807 nt!ObpLookupObjectName+0x931
fffffadf`10afba50 fffff800`012959cd nt!ObOpenObjectByName+0x180
fffffadf`10afbc40 fffff800`0102e2bd nt!NtQueryAttributesFile+0x133
fffffadf`10afbe80 00000000`77ef0dba nt!KiSystemServiceCopyEnd+0x3 (TrapFrame @ fffffadf`10afbe80)
00000000`0012d468 fffff800`010265c0 0x77ef0dba
fffffadf`10afc210 00000000`00000000 nt!KiCallUserMode
fffffadf36cbbbf0-01
THREAD fffffadf36cbbbf0 Cid 0388.086c Teb: 000007fffffd5000 Win32Thread: fffffa80045b4d80 WAIT: (Unknown) KernelMode Non-Alertable
fffffadf39f4a330 Semaphore Limit 0x7fffffff
fffffadf36cbbca8 NotificationTimer
Not impersonating
DeviceMap fffffa8002d356d0
Owning Process fffffadf36ce4040 Image: explorer.exe
Attached Process N/A Image: N/A
Wait Start TickCount 32107 Ticks: 52 (0:00:00:00.812)
Context Switch Count 19024 LargeStack
UserTime 00:00:00.046
KernelTime 00:00:00.203
Win32 Start Address 0x00000000000afb90
Start Address 0x0000000077d6b6a0
Stack Init fffffadf15669100 Current fffffadf15667c70
Base fffffadf1566a000 Limit fffffadf1565f000 Call fffffadf15669300
Priority 14 BasePriority 9 PriorityDecrement 1
Child-SP RetAddr Call Site
fffffadf`15667cb0 fffff800`01027602 nt!KiSwapContext+0x85
fffffadf`15667e30 fffff800`0102820e nt!KiSwapThread+0x3c9
fffffadf`15667e90 fffff800`010b0343 nt!KeWaitForSingleObject+0x5a6
fffffadf`15667f10 fffff800`01010fd4 nt!ExpWaitForResource+0x275
fffffadf`15667f80 fffffadf`2abbad9c nt!ExAcquireResourceSharedLite+0x32e
fffffadf`15667fd0 fffffadf`2abbb228 Ntfs!NtfsAcquireSharedVcb+0x2c
fffffadf`15668010 fffffadf`2abaa0cb Ntfs!NtfsCommonCreate+0x200
fffffadf`156683f0 fffffadf`2b129313 Ntfs!NtfsNetworkOpenCreate+0xcc
fffffadf`156686a0 fffffadf`2ac94d27 sptd+0x69313
fffffadf`156686d0 fffffadf`2ac95041 fltMgr!FltpPerformFastIoCall+0x457
fffffadf`15668740 fffffadf`2acb0b2a fltMgr!FltpPassThroughFastIo+0xa1
fffffadf`15668780 fffffadf`2ac7daba fltMgr!FltpFastIoQueryOpen+0x16a
fffffadf`15668820 fffffadf`2b72529f sr!SrFastIoQueryOpen+0x5a
fffffadf`15668850 fffff800`0129a56d TmPreFlt!TmpQueryFullName+0x820b
fffffadf`15668880 fffff800`012810e4 nt!IopParseDevice+0xf52
fffffadf`15668a30 fffff800`01285807 nt!ObpLookupObjectName+0x931
fffffadf`15668b40 fffff800`012959cd nt!ObOpenObjectByName+0x180
fffffadf`15668d30 fffff800`0102e2bd nt!NtQueryAttributesFile+0x133
fffffadf`15668f70 00000000`77ef0dba nt!KiSystemServiceCopyEnd+0x3 (TrapFrame @ fffffadf`15668f70)
00000000`02b7e2a8 fffff800`010265c0 0x77ef0dba
fffffadf`15669300 fffffadf`15658000 nt!KiCallUserMode
fffffadf`15669308 00000000`00000000 0xfffffadf`15658000
1 total locks, 1 locks currently held
On a xp-x64 machine, ocasionally the system becomes slow. I triggered a blue screen to dump all kernal data. From the dump file, the ERESOURCE [0xfffffadf37c52800] was already exclusively acquired by thread [fffffadf379117a0]. It seems the ERESOURCE [0xfffffadf37c52800] is for the VCB data. Could you please give some suggestions about what is the thread [fffffadf379117a0] doing? Trying to accquire the same eresource or another eresource?
Our driver is not invloved in all the threads for the ERESOURCE [0xfffffadf37c52800].
========================================================
0: kd> !thread fffffadf379117a0
THREAD fffffadf379117a0 Cid 0364.05b8 Teb: 000007fffff6a000 Win32Thread: 0000000000000000 STANDBY
IRP List:
fffffadf35b3b010: (0006,03a0) Flags: 00000404 Mdl: 00000000
Impersonation token: fffffa800331ebb0 (Level Impersonation)
Owning Process fffffadf39dd86c0 Image: svchost.exe
Attached Process N/A Image: N/A
Wait Start TickCount 32144 Ticks: 15 (0:00:00:00.234)
Context Switch Count 156
UserTime 00:00:00.000
KernelTime 00:00:00.000
Start Address 0x000007ff769360d0
Stack Init fffffadf2a50ce00 Current fffffadf2a50c410
Base fffffadf2a50d000 Limit fffffadf2a507000 Call 0
Priority 9 BasePriority 8 PriorityDecrement 1
Child-SP RetAddr : Args to Child : Call Site
fffffadf`2a50c450 fffff800`01027602 : fffffadf`2a50c6d8 fffffadf`2ac92b27 fffffadf`37bb70c0 fffffadf`36c3e010 : nt!KiSwapContext+0x85
fffffadf`2a50c5d0 fffff800`0102820e : 00000001`2dbf9ea0 fffff800`011b5dc0 fffffadf`37911838 fffffadf`379117a0 : nt!KiSwapThread+0x3c9
fffffadf`2a50c630 fffff800`010b0343 : 00000000`00000090 fffffadf`0000001b fffffadf`37bb7000 00000000`00000000 : nt!KeWaitForSingleObject+0x5a6
fffffadf`2a50c6b0 fffff800`01047549 : fffffadf`37c52800 00000000`00000000 00000000`00000001 fffffadf`379117a0 : nt!ExpWaitForResource+0x275 ===> it is waiting for [fffffadf`37c52800]. Isn't it already owned the thread?
fffffadf`2a50c720 fffffadf`2ab9aa74 : fffffadf`36c715f0 fffffadf`2a50c970 00000000`00000000 fffffa80`0084ab00 : nt!ExAcquireResourceExclusiveLite+0x1ab
fffffadf`2a50c750 fffffadf`2abb2915 : fffffadf`36c715f0 fffffa80`0084ac00 fffffa80`0084ab00 fffffadf`37c521c8 : Ntfs!NtfsCommonClose+0xcd
fffffadf`2a50c7f0 fffffadf`2ac96542 : fffffadf`35b3b000 fffffadf`35b3b010 fffffadf`35b3b010 fffffadf`39e789e0 : Ntfs!NtfsFsdClose+0x392
fffffadf`2a50c8e0 fffffadf`2ac968df : 00000000`00000000 fffffadf`35b3b010 fffffadf`35b3b000 fffffadf`35b3b010 : fltMgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x3f2
fffffadf`2a50c950 fffffadf`2b71cff7 : 00000005`00000000 fffffadf`367dac10 fffffadf`35c95050 fffffadf`35b3b010 : fltMgr!FltpDispatch+0x17f
fffffadf`2a50c9b0 fffffadf`2b7245ba : 00000000`00000001 00000000`00000000 00000000`00000001 fffffadf`3787f460 : TmPreFlt!TmpAddRdr+0xc87
fffffadf`2a50c9e0 fffff800`01284120 : fffffadf`35c95050 fffffadf`35c95050 fffffadf`35c95050 00000000`00000000 : TmPreFlt!TmpQueryFullName+0x7526
fffffadf`2a50ca10 fffff800`01284e30 : fffffadf`35c95020 fffffadf`35c95050 fffffadf`35c95050 00000000`00000000 : nt!IopDeleteFile+0x301
fffffadf`2a50cab0 fffff800`0103c22e : fffffadf`35c95020 00000000`0000075c fffffadf`35c95050 00000000`00000000 : nt!ObpRemoveObjectRoutine+0x14f
fffffadf`2a50cb20 fffff800`01288e97 : fffffa80`035d2d70 fffffa80`035d2d70 fffffa80`02cac770 00000000`00000000 : nt!ObfDereferenceObject+0x83
fffffadf`2a50cb50 fffff800`01285a54 : fffffadf`379117a0 00000000`0000075c fffffadf`39dd86c0 fffffadf`379117a0 : nt!ObpCloseHandleTableEntry+0x24b
fffffadf`2a50cbf0 fffff800`0102e2bd : fffffadf`379117a0 fffffadf`2a50ccf0 00000000`00000000 00000000`00000000 : nt!ObpCloseHandle+0xb0
fffffadf`2a50cc70 00000000`77ef0ada : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x3 (TrapFrame @ fffffadf`2a50cc70)
00000000`02edf018 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x77ef0ada
=================================================
0: kd> !locks -v 0xfffffadf37c52800
Resource @ 0xfffffadf37c52800 Exclusively owned
Contention Count = 3214
NumberOfSharedWaiters = 10
Threads: fffffadf379117a0-01<*>
THREAD fffffadf379117a0 Cid 0364.05b8 Teb: 000007fffff6a000 Win32Thread: 0000000000000000 STANDBY
IRP List:
fffffadf35b3b010: (0006,03a0) Flags: 00000404 Mdl: 00000000
Impersonation token: fffffa800331ebb0 (Level Impersonation)
Owning Process fffffadf39dd86c0 Image: svchost.exe
Attached Process N/A Image: N/A
Wait Start TickCount 32144 Ticks: 15 (0:00:00:00.234)
Context Switch Count 156
UserTime 00:00:00.000
KernelTime 00:00:00.000
Start Address 0x000007ff769360d0
Stack Init fffffadf2a50ce00 Current fffffadf2a50c410
Base fffffadf2a50d000 Limit fffffadf2a507000 Call 0
Priority 9 BasePriority 8 PriorityDecrement 1
Child-SP RetAddr Call Site
fffffadf`2a50c450 fffff800`01027602 nt!KiSwapContext+0x85
fffffadf`2a50c5d0 fffff800`0102820e nt!KiSwapThread+0x3c9
fffffadf`2a50c630 fffff800`010b0343 nt!KeWaitForSingleObject+0x5a6
fffffadf`2a50c6b0 fffff800`01047549 nt!ExpWaitForResource+0x275
fffffadf`2a50c720 fffffadf`2ab9aa74 nt!ExAcquireResourceExclusiveLite+0x1ab
fffffadf`2a50c750 fffffadf`2abb2915 Ntfs!NtfsCommonClose+0xcd
fffffadf`2a50c7f0 fffffadf`2ac96542 Ntfs!NtfsFsdClose+0x392
fffffadf`2a50c8e0 fffffadf`2ac968df fltMgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x3f2
fffffadf`2a50c950 fffffadf`2b71cff7 fltMgr!FltpDispatch+0x17f
fffffadf`2a50c9b0 fffffadf`2b7245ba TmPreFlt!TmpAddRdr+0xc87
fffffadf`2a50c9e0 fffff800`01284120 TmPreFlt!TmpQueryFullName+0x7526
fffffadf`2a50ca10 fffff800`01284e30 nt!IopDeleteFile+0x301
fffffadf`2a50cab0 fffff800`0103c22e nt!ObpRemoveObjectRoutine+0x14f
fffffadf`2a50cb20 fffff800`01288e97 nt!ObfDereferenceObject+0x83
fffffadf`2a50cb50 fffff800`01285a54 nt!ObpCloseHandleTableEntry+0x24b
fffffadf`2a50cbf0 fffff800`0102e2bd nt!ObpCloseHandle+0xb0
fffffadf`2a50cc70 00000000`77ef0ada nt!KiSystemServiceCopyEnd+0x3 (TrapFrame @ fffffadf`2a50cc70)
00000000`02edf018 00000000`00000000 0x77ef0ada
fffffadf368c3a50-01
THREAD fffffadf368c3a50 Cid 0388.0d50 Teb: 000007fffff8a000 Win32Thread: fffffa8004fc5010 WAIT: (Unknown) KernelMode Non-Alertable
fffffadf39f4a330 Semaphore Limit 0x7fffffff
fffffadf368c3b08 NotificationTimer
IRP List:
fffffadf367da870: (0006,03a0) Flags: 00000404 Mdl: 00000000
Not impersonating
DeviceMap fffffa8002d356d0
Owning Process fffffadf36ce4040 Image: explorer.exe
Attached Process N/A Image: N/A
Wait Start TickCount 32159 Ticks: 0
Context Switch Count 6088 LargeStack
UserTime 00:00:00.343
KernelTime 00:00:00.515
Start Address 0x0000000077d6b6a0
Stack Init fffffadf1220be00 Current fffffadf1220b3f0
Base fffffadf1220c000 Limit fffffadf12205000 Call 0
Priority 8 BasePriority 8 PriorityDecrement 0
Child-SP RetAddr Call Site
fffffadf`1220b430 fffff800`01027602 nt!KiSwapContext+0x85
fffffadf`1220b5b0 fffff800`0102820e nt!KiSwapThread+0x3c9
fffffadf`1220b610 fffff800`010474c8 nt!KeWaitForSingleObject+0x5a6
fffffadf`1220b690 fffff800`01010fd4 nt!ExpWaitForResource+0x48
fffffadf`1220b700 fffffadf`2abb2a3f nt!ExAcquireResourceSharedLite+0x32e
fffffadf`1220b750 fffffadf`2abb2915 Ntfs!NtfsCommonClose+0xa3
fffffadf`1220b7f0 fffffadf`2ac96542 Ntfs!NtfsFsdClose+0x392
fffffadf`1220b8e0 fffffadf`2ac968df fltMgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x3f2
fffffadf`1220b950 fffffadf`2b71cff7 fltMgr!FltpDispatch+0x17f
fffffadf`1220b9b0 fffffadf`2b7245ba TmPreFlt!TmpAddRdr+0xc87
fffffadf`1220b9e0 fffff800`01284120 TmPreFlt!TmpQueryFullName+0x7526
fffffadf`1220ba10 fffff800`01284e30 nt!IopDeleteFile+0x301
fffffadf`1220bab0 fffff800`0103c22e nt!ObpRemoveObjectRoutine+0x14f
fffffadf`1220bb20 fffff800`01288e97 nt!ObfDereferenceObject+0x83
fffffadf`1220bb50 fffff800`01285a54 nt!ObpCloseHandleTableEntry+0x24b
fffffadf`1220bbf0 fffff800`0102e2bd nt!ObpCloseHandle+0xb0
fffffadf`1220bc70 00000000`77ef0ada nt!KiSystemServiceCopyEnd+0x3 (TrapFrame @ fffffadf`1220bc70)
00000000`043ed798 00000000`00000000 0x77ef0ada
fffffadf36a7ba40-01
THREAD fffffadf36a7ba40 Cid 0b20.0d64 Teb: 000000007ef9d000 Win32Thread: fffffa80007b5920 WAIT: (Unknown) KernelMode Non-Alertable
fffffadf39f4a330 Semaphore Limit 0x7fffffff
fffffadf36a7baf8 NotificationTimer
IRP List:
fffffadf35bb4b50: (0006,03a0) Flags: 00000884 Mdl: 00000000
Not impersonating
DeviceMap fffffa8002d356d0
Owning Process fffffadf37bc6870 Image: vmware-tray.exe
Attached Process N/A Image: N/A
Wait Start TickCount 31952 Ticks: 207 (0:00:00:03.234)
Context Switch Count 1140 LargeStack
UserTime 00:00:00.000
KernelTime 00:00:00.000
Win32 Start Address 0x0000000003a4ac60
Start Address 0x000000007d4d1504
Stack Init fffffadf15382e00 Current fffffadf153818a0
Base fffffadf15383000 Limit fffffadf1537c000 Call 0
Priority 14 BasePriority 8 PriorityDecrement 6
Child-SP RetAddr Call Site
fffffadf`153818e0 fffff800`01027602 nt!KiSwapContext+0x85
fffffadf`15381a60 fffff800`0102820e nt!KiSwapThread+0x3c9
fffffadf`15381ac0 fffff800`010b0343 nt!KeWaitForSingleObject+0x5a6
fffffadf`15381b40 fffff800`01010fd4 nt!ExpWaitForResource+0x275
fffffadf`15381bb0 fffffadf`2abbad9c nt!ExAcquireResourceSharedLite+0x32e
fffffadf`15381c00 fffffadf`2abbb228 Ntfs!NtfsAcquireSharedVcb+0x2c
fffffadf`15381c40 fffffadf`2abbd2c6 Ntfs!NtfsCommonCreate+0x200
fffffadf`15382020 fffffadf`2ac96542 Ntfs!NtfsFsdCreate+0x218
fffffadf`153821b0 fffffadf`2acb1e1d fltMgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x3f2
fffffadf`15382220 fffffadf`2ac79289 fltMgr!FltpCreate+0x3bd
fffffadf`153822b0 fffffadf`2b72455d sr!SrCreate+0x1c9
fffffadf`15382350 fffff800`01283749 TmPreFlt!TmpQueryFullName+0x74c9
fffffadf`15382460 fffff800`012810e4 nt!IopParseDevice+0x1088
fffffadf`15382610 fffff800`01285807 nt!ObpLookupObjectName+0x931
fffffadf`15382720 fffff800`01292dcd nt!ObOpenObjectByName+0x180
fffffadf`15382910 fffff800`01299e87 nt!IopCreateFile+0x630
fffffadf`15382aa0 fffff800`01295889 nt!IoCreateFile+0x12f
fffffadf`15382b80 fffff800`0102e2bd nt!NtOpenFile+0x49
fffffadf`15382c00 00000000`77ef0d1a nt!KiSystemServiceCopyEnd+0x3 (TrapFrame @ fffffadf`15382c70)
00000000`03f1e798 00000000`00000000 0x77ef0d1a
fffffadf36825040-01
THREAD fffffadf36825040 Cid 0ba4.0ac8 Teb: 000007fffff7e000 Win32Thread: 0000000000000000 WAIT: (Unknown) KernelMode Non-Alertable
fffffadf39f4a330 Semaphore Limit 0x7fffffff
fffffadf368250f8 NotificationTimer
IRP List:
fffffadf35c15010: (0006,03a0) Flags: 00000884 Mdl: 00000000
Not impersonating
DeviceMap fffffa80000037b0
Owning Process fffffadf36bc2040 Image: TmListen.exe
Attached Process N/A Image: N/A
Wait Start TickCount 31966 Ticks: 193 (0:00:00:03.015)
Context Switch Count 117
UserTime 00:00:00.000
KernelTime 00:00:00.000
Start Address 0x0000000077d6b6a0
Stack Init fffffadf2a5bbe00 Current fffffadf2a5ba8a0
Base fffffadf2a5bc000 Limit fffffadf2a5b6000 Call 0
Priority 14 BasePriority 8 PriorityDecrement 6
Child-SP RetAddr Call Site
fffffadf`2a5ba8e0 fffff800`01027602 nt!KiSwapContext+0x85
fffffadf`2a5baa60 fffff800`0102820e nt!KiSwapThread+0x3c9
fffffadf`2a5baac0 fffff800`010b0343 nt!KeWaitForSingleObject+0x5a6
fffffadf`2a5bab40 fffff800`01010fd4 nt!ExpWaitForResource+0x275
fffffadf`2a5babb0 fffffadf`2abbad9c nt!ExAcquireResourceSharedLite+0x32e
fffffadf`2a5bac00 fffffadf`2abbb228 Ntfs!NtfsAcquireSharedVcb+0x2c
fffffadf`2a5bac40 fffffadf`2abbd2c6 Ntfs!NtfsCommonCreate+0x200
fffffadf`2a5bb020 fffffadf`2ac96542 Ntfs!NtfsFsdCreate+0x218
fffffadf`2a5bb1b0 fffffadf`2acb1e1d fltMgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x3f2
fffffadf`2a5bb220 fffffadf`2ac79289 fltMgr!FltpCreate+0x3bd
fffffadf`2a5bb2b0 fffffadf`2b72455d sr!SrCreate+0x1c9
fffffadf`2a5bb350 fffff800`01283749 TmPreFlt!TmpQueryFullName+0x74c9
fffffadf`2a5bb460 fffff800`012810e4 nt!IopParseDevice+0x1088
fffffadf`2a5bb610 fffff800`01285807 nt!ObpLookupObjectName+0x931
fffffadf`2a5bb720 fffff800`01292dcd nt!ObOpenObjectByName+0x180
fffffadf`2a5bb910 fffff800`01299e87 nt!IopCreateFile+0x630
fffffadf`2a5bbaa0 fffff800`01295889 nt!IoCreateFile+0x12f
fffffadf`2a5bbb80 fffff800`0102e2bd nt!NtOpenFile+0x49
fffffadf`2a5bbc00 00000000`77ef0d1a nt!KiSystemServiceCopyEnd+0x3 (TrapFrame @ fffffadf`2a5bbc70)
00000000`064cf298 00000000`00000000 0x77ef0d1a
fffffadf3a5f9040-01
THREAD fffffadf3a5f9040 Cid 0004.0024 Teb: 0000000000000000 Win32Thread: 0000000000000000 WAIT: (Unknown) KernelMode Non-Alertable
fffffadf39f4a330 Semaphore Limit 0x7fffffff
fffffadf3a5f90f8 NotificationTimer
IRP List:
fffffadf35c13c60: (0006,03a0) Flags: 00000004 Mdl: 00000000
Not impersonating
DeviceMap fffffa80000037b0
Owning Process fffffadf3a5fe040 Image: System
Attached Process N/A Image: N/A
Wait Start TickCount 31972 Ticks: 187 (0:00:00:02.921)
Context Switch Count 8746
UserTime 00:00:00.000
KernelTime 00:00:00.093
Start Address nt!ExpWorkerThread (0xfffff80001003970)
Stack Init fffffadf2ba63e00 Current fffffadf2ba63350
Base fffffadf2ba64000 Limit fffffadf2ba5e000 Call 0
Priority 14 BasePriority 12 PriorityDecrement 1
Child-SP RetAddr Call Site
fffffadf`2ba63390 fffff800`01027602 nt!KiSwapContext+0x85
fffffadf`2ba63510 fffff800`0102820e nt!KiSwapThread+0x3c9
fffffadf`2ba63570 fffff800`010b0343 nt!KeWaitForSingleObject+0x5a6
fffffadf`2ba635f0 fffff800`01010fd4 nt!ExpWaitForResource+0x275
fffffadf`2ba63660 fffffadf`2abbad9c nt!ExAcquireResourceSharedLite+0x32e
fffffadf`2ba636b0 fffffadf`2aba106e Ntfs!NtfsAcquireSharedVcb+0x2c
fffffadf`2ba636f0 fffffadf`2aba153a Ntfs!NtfsCommonFlushBuffers+0x1ac
fffffadf`2ba637b0 fffffadf`2ac96922 Ntfs!NtfsFsdFlushBuffers+0xc3
fffffadf`2ba63830 fffffadf`2b71cff7 fltMgr!FltpDispatch+0x1c2
fffffadf`2ba63890 fffff800`01264b2b TmPreFlt!TmpAddRdr+0xc87
fffffadf`2ba638c0 fffff800`0102e2bd nt!NtFlushBuffersFile+0x2bd
fffffadf`2ba63950 fffff800`0102e780 nt!KiSystemServiceCopyEnd+0x3 (TrapFrame @ fffffadf`2ba63950)
fffffadf`2ba63ae8 fffff800`0125a3c5 nt!KiServiceLinkage
fffffadf`2ba63af0 fffff800`0125e49b nt!CmpFileFlush+0x68
fffffadf`2ba63b40 fffff800`0125999f nt!HvpWriteLog+0x20f
fffffadf`2ba63c10 fffff800`0125e33c nt!HvSyncHive+0x94
fffffadf`2ba63c40 fffff800`0125d42d nt!CmpDoFlushNextHive+0xf0
fffffadf`2ba63cc0 fffff800`0103754a nt!CmpLazyFlushWorker+0xef
fffffadf`2ba63d00 fffff800`0124b932 nt!ExpWorkerThread+0x13b
fffffadf`2ba63d70 fffff800`01020196 nt!PspSystemThreadStartup+0x3e
fffffadf`2ba63dd0 00000000`00000000 nt!KxStartSystemThread+0x16
fffffadf367d9bf0-01
THREAD fffffadf367d9bf0 Cid 0448.0f30 Teb: 000007fffff88000 Win32Thread: 0000000000000000 WAIT: (Unknown) KernelMode Non-Alertable
fffffadf39f4a330 Semaphore Limit 0x7fffffff
fffffadf367d9ca8 NotificationTimer
Not impersonating
DeviceMap fffffa80000037b0
Owning Process fffffadf3787ac20 Image: spoolsv.exe
Attached Process N/A Image: N/A
Wait Start TickCount 31974 Ticks: 185 (0:00:00:02.890)
Context Switch Count 8
UserTime 00:00:00.000
KernelTime 00:00:00.000
Win32 Start Address 0x00000000000bed80
Start Address 0x0000000077d6b6a0
Stack Init fffffadf153c8e00 Current fffffadf153c7970
Base fffffadf153c9000 Limit fffffadf153c3000 Call 0
Priority 14 BasePriority 8 PriorityDecrement 6
*** ERROR: Module load completed but symbols could not be loaded for sptd.sys
Child-SP RetAddr Call Site
fffffadf`153c79b0 fffff800`01027602 nt!KiSwapContext+0x85
fffffadf`153c7b30 fffff800`0102820e nt!KiSwapThread+0x3c9
fffffadf`153c7b90 fffff800`010b0343 nt!KeWaitForSingleObject+0x5a6
fffffadf`153c7c10 fffff800`01010fd4 nt!ExpWaitForResource+0x275
fffffadf`153c7c80 fffffadf`2abbad9c nt!ExAcquireResourceSharedLite+0x32e
fffffadf`153c7cd0 fffffadf`2abbb228 Ntfs!NtfsAcquireSharedVcb+0x2c
fffffadf`153c7d10 fffffadf`2abaa0cb Ntfs!NtfsCommonCreate+0x200
fffffadf`153c80f0 fffffadf`2b129313 Ntfs!NtfsNetworkOpenCreate+0xcc
fffffadf`153c83a0 fffffadf`2ac94d27 sptd+0x69313
fffffadf`153c83d0 fffffadf`2ac95041 fltMgr!FltpPerformFastIoCall+0x457
fffffadf`153c8440 fffffadf`2acb0b2a fltMgr!FltpPassThroughFastIo+0xa1
fffffadf`153c8480 fffffadf`2ac7daba fltMgr!FltpFastIoQueryOpen+0x16a
fffffadf`153c8520 fffffadf`2b72529f sr!SrFastIoQueryOpen+0x5a
fffffadf`153c8550 fffff800`0129a56d TmPreFlt!TmpQueryFullName+0x820b
fffffadf`153c8580 fffff800`012810e4 nt!IopParseDevice+0xf52
fffffadf`153c8730 fffff800`01285807 nt!ObpLookupObjectName+0x931
fffffadf`153c8840 fffff800`012959cd nt!ObOpenObjectByName+0x180
fffffadf`153c8a30 fffff800`0102e2bd nt!NtQueryAttributesFile+0x133
fffffadf`153c8c70 00000000`77ef0dba nt!KiSystemServiceCopyEnd+0x3 (TrapFrame @ fffffadf`153c8c70)
00000000`0302f158 00000000`00000000 0x77ef0dba
fffffadf36983bf0-01
THREAD fffffadf36983bf0 Cid 0b68.0d38 Teb: 000007fffff98000 Win32Thread: 0000000000000000 WAIT: (Unknown) KernelMode Non-Alertable
fffffadf39f4a330 Semaphore Limit 0x7fffffff
fffffadf36983ca8 NotificationTimer
IRP List:
fffffadf35b3bc60: (0006,03a0) Flags: 00000884 Mdl: 00000000
Not impersonating
DeviceMap fffffa8002d356d0
Owning Process fffffadf36b34040 Image: PccNTMon.exe
Attached Process N/A Image: N/A
Wait Start TickCount 32039 Ticks: 120 (0:00:00:01.875)
Context Switch Count 113
UserTime 00:00:00.000
KernelTime 00:00:00.000
Start Address 0x0000000077d6b6a0
Stack Init fffffadf11a0ae00 Current fffffadf11a098a0
Base fffffadf11a0b000 Limit fffffadf11a05000 Call 0
Priority 14 BasePriority 8 PriorityDecrement 6
Child-SP RetAddr Call Site
fffffadf`11a098e0 fffff800`01027602 nt!KiSwapContext+0x85
fffffadf`11a09a60 fffff800`0102820e nt!KiSwapThread+0x3c9
fffffadf`11a09ac0 fffff800`010b0343 nt!KeWaitForSingleObject+0x5a6
fffffadf`11a09b40 fffff800`01010fd4 nt!ExpWaitForResource+0x275
fffffadf`11a09bb0 fffffadf`2abbad9c nt!ExAcquireResourceSharedLite+0x32e
fffffadf`11a09c00 fffffadf`2abbb228 Ntfs!NtfsAcquireSharedVcb+0x2c
fffffadf`11a09c40 fffffadf`2abbd2c6 Ntfs!NtfsCommonCreate+0x200
fffffadf`11a0a020 fffffadf`2ac96542 Ntfs!NtfsFsdCreate+0x218
fffffadf`11a0a1b0 fffffadf`2acb1e1d fltMgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x3f2
fffffadf`11a0a220 fffffadf`2ac79289 fltMgr!FltpCreate+0x3bd
fffffadf`11a0a2b0 fffffadf`2b72455d sr!SrCreate+0x1c9
fffffadf`11a0a350 fffff800`01283749 TmPreFlt!TmpQueryFullName+0x74c9
fffffadf`11a0a460 fffff800`012810e4 nt!IopParseDevice+0x1088
fffffadf`11a0a610 fffff800`01285807 nt!ObpLookupObjectName+0x931
fffffadf`11a0a720 fffff800`01292dcd nt!ObOpenObjectByName+0x180
fffffadf`11a0a910 fffff800`01299e87 nt!IopCreateFile+0x630
fffffadf`11a0aaa0 fffff800`01295889 nt!IoCreateFile+0x12f
fffffadf`11a0ab80 fffff800`0102e2bd nt!NtOpenFile+0x49
fffffadf`11a0ac00 00000000`77ef0d1a nt!KiSystemServiceCopyEnd+0x3 (TrapFrame @ fffffadf`11a0ac70)
00000000`03bcf4b8 00000000`00000000 0x77ef0d1a
fffffadf37883890-01
THREAD fffffadf37883890 Cid 0f20.0390 Teb: 000000007efdb000 Win32Thread: fffffa8006b08620 WAIT: (Unknown) KernelMode Non-Alertable
fffffadf39f4a330 Semaphore Limit 0x7fffffff
fffffadf37883948 NotificationTimer
Not impersonating
DeviceMap fffffa8002d356d0
Owning Process fffffadf36ade870 Image: EventMonitor.exe
Attached Process N/A Image: N/A
Wait Start TickCount 32043 Ticks: 116 (0:00:00:01.812)
Context Switch Count 11389 LargeStack
UserTime 00:00:00.328
KernelTime 00:00:00.312
Win32 Start Address 0x00000000004137d1
Start Address 0x0000000077d59620
Stack Init fffffadf2b40e570 Current fffffadf2b40d0e0
Base fffffadf2b410000 Limit fffffadf2b404000 Call fffffadf2b40e770
Priority 14 BasePriority 8 PriorityDecrement 5
Child-SP RetAddr Call Site
fffffadf`2b40d120 fffff800`01027602 nt!KiSwapContext+0x85
fffffadf`2b40d2a0 fffff800`0102820e nt!KiSwapThread+0x3c9
fffffadf`2b40d300 fffff800`010b0343 nt!KeWaitForSingleObject+0x5a6
fffffadf`2b40d380 fffff800`01010fd4 nt!ExpWaitForResource+0x275
fffffadf`2b40d3f0 fffffadf`2abbad9c nt!ExAcquireResourceSharedLite+0x32e
fffffadf`2b40d440 fffffadf`2abbb228 Ntfs!NtfsAcquireSharedVcb+0x2c
fffffadf`2b40d480 fffffadf`2abaa0cb Ntfs!NtfsCommonCreate+0x200
fffffadf`2b40d860 fffffadf`2b129313 Ntfs!NtfsNetworkOpenCreate+0xcc
fffffadf`2b40db10 fffffadf`2ac94d27 sptd+0x69313
fffffadf`2b40db40 fffffadf`2ac95041 fltMgr!FltpPerformFastIoCall+0x457
fffffadf`2b40dbb0 fffffadf`2acb0b2a fltMgr!FltpPassThroughFastIo+0xa1
fffffadf`2b40dbf0 fffffadf`2ac7daba fltMgr!FltpFastIoQueryOpen+0x16a
fffffadf`2b40dc90 fffffadf`2b72529f sr!SrFastIoQueryOpen+0x5a
fffffadf`2b40dcc0 fffff800`0129a56d TmPreFlt!TmpQueryFullName+0x820b
fffffadf`2b40dcf0 fffff800`012810e4 nt!IopParseDevice+0xf52
fffffadf`2b40dea0 fffff800`01285807 nt!ObpLookupObjectName+0x931
fffffadf`2b40dfb0 fffff800`012959cd nt!ObOpenObjectByName+0x180
fffffadf`2b40e1a0 fffff800`0102e2bd nt!NtQueryAttributesFile+0x133
fffffadf`2b40e3e0 00000000`77ef0dba nt!KiSystemServiceCopyEnd+0x3 (TrapFrame @ fffffadf`2b40e3e0)
00000000`0012c508 fffff800`010265c0 0x77ef0dba
fffffadf`2b40e770 fffffadf`2b40ef50 nt!KiCallUserMode
fffffadf`2b40e778 00000000`0012d578 0xfffffadf`2b40ef50
fffffadf`2b40e780 00000000`0012d4b0 0x12d578
fffffadf`2b40e788 00000000`00000000 0x12d4b0
fffffadf36b3a7f0-01
THREAD fffffadf36b3a7f0 Cid 0b68.0b6c Teb: 000007fffffdb000 Win32Thread: fffffa8002a86d80 WAIT: (Unknown) KernelMode Non-Alertable
fffffadf39f4a330 Semaphore Limit 0x7fffffff
fffffadf36b3a8a8 NotificationTimer
Not impersonating
DeviceMap fffffa8002d356d0
Owning Process fffffadf36b34040 Image: PccNTMon.exe
Attached Process N/A Image: N/A
Wait Start TickCount 32071 Ticks: 88 (0:00:00:01.375)
Context Switch Count 7789 LargeStack
UserTime 00:00:00.015
KernelTime 00:00:00.109
Win32 Start Address 0x00000001400a4100
Start Address 0x0000000077d59620
Stack Init fffffadf1547ae00 Current fffffadf15479970
Base fffffadf1547b000 Limit fffffadf15470000 Call 0
Priority 14 BasePriority 8 PriorityDecrement 2
Child-SP RetAddr Call Site
fffffadf`154799b0 fffff800`01027602 nt!KiSwapContext+0x85
fffffadf`15479b30 fffff800`0102820e nt!KiSwapThread+0x3c9
fffffadf`15479b90 fffff800`010b0343 nt!KeWaitForSingleObject+0x5a6
fffffadf`15479c10 fffff800`01010fd4 nt!ExpWaitForResource+0x275
fffffadf`15479c80 fffffadf`2abbad9c nt!ExAcquireResourceSharedLite+0x32e
fffffadf`15479cd0 fffffadf`2abbb228 Ntfs!NtfsAcquireSharedVcb+0x2c
fffffadf`15479d10 fffffadf`2abaa0cb Ntfs!NtfsCommonCreate+0x200
fffffadf`1547a0f0 fffffadf`2b129313 Ntfs!NtfsNetworkOpenCreate+0xcc
fffffadf`1547a3a0 fffffadf`2ac94d27 sptd+0x69313
fffffadf`1547a3d0 fffffadf`2ac95041 fltMgr!FltpPerformFastIoCall+0x457
fffffadf`1547a440 fffffadf`2acb0b2a fltMgr!FltpPassThroughFastIo+0xa1
fffffadf`1547a480 fffffadf`2ac7daba fltMgr!FltpFastIoQueryOpen+0x16a
fffffadf`1547a520 fffffadf`2b72529f sr!SrFastIoQueryOpen+0x5a
fffffadf`1547a550 fffff800`0129a56d TmPreFlt!TmpQueryFullName+0x820b
fffffadf`1547a580 fffff800`012810e4 nt!IopParseDevice+0xf52
fffffadf`1547a730 fffff800`01285807 nt!ObpLookupObjectName+0x931
fffffadf`1547a840 fffff800`012959cd nt!ObOpenObjectByName+0x180
fffffadf`1547aa30 fffff800`0102e2bd nt!NtQueryAttributesFile+0x133
fffffadf`1547ac70 00000000`77ef0dba nt!KiSystemServiceCopyEnd+0x3 (TrapFrame @ fffffadf`1547ac70)
00000000`0023f608 00000000`00000000 0x77ef0dba
fffffadf39d9b880-01
THREAD fffffadf39d9b880 Cid 0a3c.0a44 Teb: 000000007efdb000 Win32Thread: fffffa8005352190 WAIT: (Unknown) KernelMode Non-Alertable
fffffadf39f4a330 Semaphore Limit 0x7fffffff
fffffadf39d9b938 NotificationTimer
Not impersonating
DeviceMap fffffa8000b19f00
Owning Process fffffadf36ae3890 Image: Dbgview.exe
Attached Process N/A Image: N/A
Wait Start TickCount 32071 Ticks: 88 (0:00:00:01.375)
Context Switch Count 15962 LargeStack
UserTime 00:00:00.531
KernelTime 00:00:00.828
Win32 Start Address 0x00000000004153b7
Start Address 0x0000000077d59620
Stack Init fffffadf10afc010 Current fffffadf10afab80
Base fffffadf10afd000 Limit fffffadf10af2000 Call fffffadf10afc210
Priority 14 BasePriority 8 PriorityDecrement 6
Child-SP RetAddr Call Site
fffffadf`10afabc0 fffff800`01027602 nt!KiSwapContext+0x85
fffffadf`10afad40 fffff800`0102820e nt!KiSwapThread+0x3c9
fffffadf`10afada0 fffff800`010b0343 nt!KeWaitForSingleObject+0x5a6
fffffadf`10afae20 fffff800`01010fd4 nt!ExpWaitForResource+0x275
fffffadf`10afae90 fffffadf`2abbad9c nt!ExAcquireResourceSharedLite+0x32e
fffffadf`10afaee0 fffffadf`2abbb228 Ntfs!NtfsAcquireSharedVcb+0x2c
fffffadf`10afaf20 fffffadf`2abaa0cb Ntfs!NtfsCommonCreate+0x200
fffffadf`10afb300 fffffadf`2b129313 Ntfs!NtfsNetworkOpenCreate+0xcc
fffffadf`10afb5b0 fffffadf`2ac94d27 sptd+0x69313
fffffadf`10afb5e0 fffffadf`2ac95041 fltMgr!FltpPerformFastIoCall+0x457
fffffadf`10afb650 fffffadf`2acb0b2a fltMgr!FltpPassThroughFastIo+0xa1
fffffadf`10afb690 fffffadf`2ac7daba fltMgr!FltpFastIoQueryOpen+0x16a
fffffadf`10afb730 fffffadf`2b72529f sr!SrFastIoQueryOpen+0x5a
fffffadf`10afb760 fffff800`0129a56d TmPreFlt!TmpQueryFullName+0x820b
fffffadf`10afb790 fffff800`012810e4 nt!IopParseDevice+0xf52
fffffadf`10afb940 fffff800`01285807 nt!ObpLookupObjectName+0x931
fffffadf`10afba50 fffff800`012959cd nt!ObOpenObjectByName+0x180
fffffadf`10afbc40 fffff800`0102e2bd nt!NtQueryAttributesFile+0x133
fffffadf`10afbe80 00000000`77ef0dba nt!KiSystemServiceCopyEnd+0x3 (TrapFrame @ fffffadf`10afbe80)
00000000`0012d468 fffff800`010265c0 0x77ef0dba
fffffadf`10afc210 00000000`00000000 nt!KiCallUserMode
fffffadf36cbbbf0-01
THREAD fffffadf36cbbbf0 Cid 0388.086c Teb: 000007fffffd5000 Win32Thread: fffffa80045b4d80 WAIT: (Unknown) KernelMode Non-Alertable
fffffadf39f4a330 Semaphore Limit 0x7fffffff
fffffadf36cbbca8 NotificationTimer
Not impersonating
DeviceMap fffffa8002d356d0
Owning Process fffffadf36ce4040 Image: explorer.exe
Attached Process N/A Image: N/A
Wait Start TickCount 32107 Ticks: 52 (0:00:00:00.812)
Context Switch Count 19024 LargeStack
UserTime 00:00:00.046
KernelTime 00:00:00.203
Win32 Start Address 0x00000000000afb90
Start Address 0x0000000077d6b6a0
Stack Init fffffadf15669100 Current fffffadf15667c70
Base fffffadf1566a000 Limit fffffadf1565f000 Call fffffadf15669300
Priority 14 BasePriority 9 PriorityDecrement 1
Child-SP RetAddr Call Site
fffffadf`15667cb0 fffff800`01027602 nt!KiSwapContext+0x85
fffffadf`15667e30 fffff800`0102820e nt!KiSwapThread+0x3c9
fffffadf`15667e90 fffff800`010b0343 nt!KeWaitForSingleObject+0x5a6
fffffadf`15667f10 fffff800`01010fd4 nt!ExpWaitForResource+0x275
fffffadf`15667f80 fffffadf`2abbad9c nt!ExAcquireResourceSharedLite+0x32e
fffffadf`15667fd0 fffffadf`2abbb228 Ntfs!NtfsAcquireSharedVcb+0x2c
fffffadf`15668010 fffffadf`2abaa0cb Ntfs!NtfsCommonCreate+0x200
fffffadf`156683f0 fffffadf`2b129313 Ntfs!NtfsNetworkOpenCreate+0xcc
fffffadf`156686a0 fffffadf`2ac94d27 sptd+0x69313
fffffadf`156686d0 fffffadf`2ac95041 fltMgr!FltpPerformFastIoCall+0x457
fffffadf`15668740 fffffadf`2acb0b2a fltMgr!FltpPassThroughFastIo+0xa1
fffffadf`15668780 fffffadf`2ac7daba fltMgr!FltpFastIoQueryOpen+0x16a
fffffadf`15668820 fffffadf`2b72529f sr!SrFastIoQueryOpen+0x5a
fffffadf`15668850 fffff800`0129a56d TmPreFlt!TmpQueryFullName+0x820b
fffffadf`15668880 fffff800`012810e4 nt!IopParseDevice+0xf52
fffffadf`15668a30 fffff800`01285807 nt!ObpLookupObjectName+0x931
fffffadf`15668b40 fffff800`012959cd nt!ObOpenObjectByName+0x180
fffffadf`15668d30 fffff800`0102e2bd nt!NtQueryAttributesFile+0x133
fffffadf`15668f70 00000000`77ef0dba nt!KiSystemServiceCopyEnd+0x3 (TrapFrame @ fffffadf`15668f70)
00000000`02b7e2a8 fffff800`010265c0 0x77ef0dba
fffffadf`15669300 fffffadf`15658000 nt!KiCallUserMode
fffffadf`15669308 00000000`00000000 0xfffffadf`15658000
1 total locks, 1 locks currently held
Howdy, Stranger!
| Upcoming OSR Seminars | ||
|---|---|---|
| OSR has suspended in-person seminars due to the Covid-19 outbreak. But, don't miss your training! Attend via the internet instead! | ||
| Kernel Debugging | 30 January 2023 | Live, Online |
| Developing Minifilters | 20 March 2023 | Live, Online |
| Internals & Software Drivers | 17 April 2023 | Live, Online |
| Writing WDF Drivers | 22 May 2023 | Live, Online |
Comments
fffffadf`2a50c720 fffffadf`2ab9aa74 : [fffffadf`36c715f0] fffffadf`2a50c970 00000000`00000000 fffffa80`0084ab00 : nt!ExAcquireResourceExclusiveLite+0x1ab
0: kd> dt _ERESOURCE fffffadf`36c715f0
nt!_ERESOURCE
+0x000 SystemResourcesList : _LIST_ENTRY [ 0x00000000`0178070a - 0x180001 ]
+0x010 OwnerTable : 0x00000002`00000000 _OWNER_ENTRY
+0x018 ActiveCount : 0n0
+0x01a Flag : 0
+0x020 SharedWaiters : (null)
+0x028 ExclusiveWaiters : 0xfffffadf`37c521c8 _KEVENT
+0x030 OwnerThreads : [2] _OWNER_ENTRY
+0x050 ContentionCount : 0x36c71640
+0x054 NumberOfSharedWaiters : 0xfadf
+0x056 NumberOfExclusiveWaiters : 0xffff
+0x058 Address : 0xfffffadf`36c71640 Void
+0x058 CreatorBackTraceIndex : 0xfffffadf`36c71640
+0x060 SpinLock : 0
0: kd> !locks -v fffffadf`36c715f0
200000000: Unable to read TableSize for resource
0 total locks
Reinstall the machine to have ONLY a) the OS b) your software.
Then corellate the moments of slowness to the activities of your software.
This is a hard time-consuming task. It is 100% not a good idea to spend time investigating _1 particular machine_ if the issue does not manifest constantly (unless this is a personal laptop of your serious business partner).
!locks will not help. FCB locks are constantly acquired and released, and the OS is usually not slow, regardless of this.
The question of "what this particular svchost is doing"? can be solved by using ".process /p" and then investigating the user space of the svchost process, yes, the symbols for user EXE/DLLs will also be auto-loaded.
Also, look at CPU usage. If the machine is slow and you have a CPU usage peak of 100% in your code - then this is a classic computation perf issue, related to some things being O(N^2) instead of O(N) or something like.
BTW, my favourite example of slow code:
- some VSS client code, directly borrowed from MS's VSHADOW source, calls "get volume GUID name" kind of call for each and every file in the system32 dir (i.e. for each and every file listed by the System VSS Writer).
- IIRC (some time passed since I was deeply into this) it was even something worse, like O(N^2) and not O(N) number of DeviceIoControl calls, since it was used to join the 2 sets of pathnames (thousands) on the attribute extracted by the "get volume GUID name" aka DeviceIoControl call.
- this call is DeviceIoControl to MountMgr.sys
- if you have Driver Verifier on, then it adds instrumentation to IOCTL calls and makes them slower.
- this slowdown is especially noticeable if you have huge number (like 10K or more) IOCTL calls, each being very simple of "get the string property of this file" kind.
- so, if you turn DV on and run the VSS client copy/pasted from VSHADOW, then your VSS state machine takes something like 10 minutes and then fails.
- without DV, it is a sudden 100% CPU usage peak for 2-3 seconds, and nothing worse.
--
Maxim S. Shatskih
Microsoft MVP on File System And Storage
[email protected]
http://www.storagecraft.com