Help on analyzing the ERESOURCE status

Hi,

On a xp-x64 machine, ocasionally the system becomes slow. I triggered a blue screen to dump all kernal data. From the dump file, the ERESOURCE [0xfffffadf37c52800] was already exclusively acquired by thread [fffffadf379117a0]. It seems the ERESOURCE [0xfffffadf37c52800] is for the VCB data. Could you please give some suggestions about what is the thread [fffffadf379117a0] doing? Trying to accquire the same eresource or another eresource?

Our driver is not invloved in all the threads for the ERESOURCE [0xfffffadf37c52800].

========================================================

0: kd> !thread fffffadf379117a0
THREAD fffffadf379117a0 Cid 0364.05b8 Teb: 000007fffff6a000 Win32Thread: 0000000000000000 STANDBY
IRP List:
fffffadf35b3b010: (0006,03a0) Flags: 00000404 Mdl: 00000000
Impersonation token: fffffa800331ebb0 (Level Impersonation)
Owning Process fffffadf39dd86c0 Image: svchost.exe
Attached Process N/A Image: N/A
Wait Start TickCount 32144 Ticks: 15 (0:00:00:00.234)
Context Switch Count 156
UserTime 00:00:00.000
KernelTime 00:00:00.000
Start Address 0x000007ff769360d0
Stack Init fffffadf2a50ce00 Current fffffadf2a50c410
Base fffffadf2a50d000 Limit fffffadf2a507000 Call 0
Priority 9 BasePriority 8 PriorityDecrement 1
Child-SP RetAddr : Args to Child : Call Site
fffffadf2a50c450 fffff80001027602 : fffffadf2a50c6d8 fffffadf2ac92b27 fffffadf37bb70c0 fffffadf36c3e010 : nt!KiSwapContext+0x85
fffffadf2a50c5d0 fffff8000102820e : 000000012dbf9ea0 fffff800011b5dc0 fffffadf37911838 fffffadf379117a0 : nt!KiSwapThread+0x3c9
fffffadf2a50c630 fffff800010b0343 : 0000000000000090 fffffadf0000001b fffffadf37bb7000 0000000000000000 : nt!KeWaitForSingleObject+0x5a6

fffffadf2a50c6b0 fffff80001047549 : fffffadf37c52800 0000000000000000 0000000000000001 fffffadf379117a0 : nt!ExpWaitForResource+0x275 ===> it is waiting for [fffffadf`37c52800]. Isn’t it already owned the thread?

fffffadf2a50c720 fffffadf2ab9aa74 : fffffadf36c715f0 fffffadf2a50c970 0000000000000000 fffffa800084ab00 : nt!ExAcquireResourceExclusiveLite+0x1ab
fffffadf2a50c750 fffffadf2abb2915 : fffffadf36c715f0 fffffa800084ac00 fffffa800084ab00 fffffadf37c521c8 : Ntfs!NtfsCommonClose+0xcd
fffffadf2a50c7f0 fffffadf2ac96542 : fffffadf35b3b000 fffffadf35b3b010 fffffadf35b3b010 fffffadf39e789e0 : Ntfs!NtfsFsdClose+0x392
fffffadf2a50c8e0 fffffadf2ac968df : 0000000000000000 fffffadf35b3b010 fffffadf35b3b000 fffffadf35b3b010 : fltMgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x3f2
fffffadf2a50c950 fffffadf2b71cff7 : 0000000500000000 fffffadf367dac10 fffffadf35c95050 fffffadf35b3b010 : fltMgr!FltpDispatch+0x17f
fffffadf2a50c9b0 fffffadf2b7245ba : 0000000000000001 0000000000000000 0000000000000001 fffffadf3787f460 : TmPreFlt!TmpAddRdr+0xc87
fffffadf2a50c9e0 fffff80001284120 : fffffadf35c95050 fffffadf35c95050 fffffadf35c95050 0000000000000000 : TmPreFlt!TmpQueryFullName+0x7526
fffffadf2a50ca10 fffff80001284e30 : fffffadf35c95020 fffffadf35c95050 fffffadf35c95050 0000000000000000 : nt!IopDeleteFile+0x301
fffffadf2a50cab0 fffff8000103c22e : fffffadf35c95020 000000000000075c fffffadf35c95050 0000000000000000 : nt!ObpRemoveObjectRoutine+0x14f
fffffadf2a50cb20 fffff80001288e97 : fffffa80035d2d70 fffffa80035d2d70 fffffa8002cac770 0000000000000000 : nt!ObfDereferenceObject+0x83
fffffadf2a50cb50 fffff80001285a54 : fffffadf379117a0 000000000000075c fffffadf39dd86c0 fffffadf379117a0 : nt!ObpCloseHandleTableEntry+0x24b
fffffadf2a50cbf0 fffff8000102e2bd : fffffadf379117a0 fffffadf2a50ccf0 0000000000000000 0000000000000000 : nt!ObpCloseHandle+0xb0
fffffadf2a50cc70 0000000077ef0ada : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : nt!KiSystemServiceCopyEnd+0x3 (TrapFrame @ fffffadf2a50cc70) 0000000002edf018 0000000000000000 : 0000000000000000 0000000000000000 0000000000000000 00000000`00000000 : 0x77ef0ada

=================================================
0: kd> !locks -v 0xfffffadf37c52800

Resource @ 0xfffffadf37c52800 Exclusively owned
Contention Count = 3214
NumberOfSharedWaiters = 10
Threads: fffffadf379117a0-01<*>

THREAD fffffadf379117a0 Cid 0364.05b8 Teb: 000007fffff6a000 Win32Thread: 0000000000000000 STANDBY
IRP List:
fffffadf35b3b010: (0006,03a0) Flags: 00000404 Mdl: 00000000
Impersonation token: fffffa800331ebb0 (Level Impersonation)
Owning Process fffffadf39dd86c0 Image: svchost.exe
Attached Process N/A Image: N/A
Wait Start TickCount 32144 Ticks: 15 (0:00:00:00.234)
Context Switch Count 156
UserTime 00:00:00.000
KernelTime 00:00:00.000
Start Address 0x000007ff769360d0
Stack Init fffffadf2a50ce00 Current fffffadf2a50c410
Base fffffadf2a50d000 Limit fffffadf2a507000 Call 0
Priority 9 BasePriority 8 PriorityDecrement 1
Child-SP RetAddr Call Site
fffffadf2a50c450 fffff80001027602 nt!KiSwapContext+0x85
fffffadf2a50c5d0 fffff8000102820e nt!KiSwapThread+0x3c9
fffffadf2a50c630 fffff800010b0343 nt!KeWaitForSingleObject+0x5a6
fffffadf2a50c6b0 fffff80001047549 nt!ExpWaitForResource+0x275
fffffadf2a50c720 fffffadf2ab9aa74 nt!ExAcquireResourceExclusiveLite+0x1ab
fffffadf2a50c750 fffffadf2abb2915 Ntfs!NtfsCommonClose+0xcd
fffffadf2a50c7f0 fffffadf2ac96542 Ntfs!NtfsFsdClose+0x392
fffffadf2a50c8e0 fffffadf2ac968df fltMgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x3f2
fffffadf2a50c950 fffffadf2b71cff7 fltMgr!FltpDispatch+0x17f
fffffadf2a50c9b0 fffffadf2b7245ba TmPreFlt!TmpAddRdr+0xc87
fffffadf2a50c9e0 fffff80001284120 TmPreFlt!TmpQueryFullName+0x7526
fffffadf2a50ca10 fffff80001284e30 nt!IopDeleteFile+0x301
fffffadf2a50cab0 fffff8000103c22e nt!ObpRemoveObjectRoutine+0x14f
fffffadf2a50cb20 fffff80001288e97 nt!ObfDereferenceObject+0x83
fffffadf2a50cb50 fffff80001285a54 nt!ObpCloseHandleTableEntry+0x24b
fffffadf2a50cbf0 fffff8000102e2bd nt!ObpCloseHandle+0xb0
fffffadf2a50cc70 0000000077ef0ada nt!KiSystemServiceCopyEnd+0x3 (TrapFrame @ fffffadf2a50cc70) 0000000002edf018 00000000`00000000 0x77ef0ada

fffffadf368c3a50-01

THREAD fffffadf368c3a50 Cid 0388.0d50 Teb: 000007fffff8a000 Win32Thread: fffffa8004fc5010 WAIT: (Unknown) KernelMode Non-Alertable
fffffadf39f4a330 Semaphore Limit 0x7fffffff
fffffadf368c3b08 NotificationTimer
IRP List:
fffffadf367da870: (0006,03a0) Flags: 00000404 Mdl: 00000000
Not impersonating
DeviceMap fffffa8002d356d0
Owning Process fffffadf36ce4040 Image: explorer.exe
Attached Process N/A Image: N/A
Wait Start TickCount 32159 Ticks: 0
Context Switch Count 6088 LargeStack
UserTime 00:00:00.343
KernelTime 00:00:00.515
Start Address 0x0000000077d6b6a0
Stack Init fffffadf1220be00 Current fffffadf1220b3f0
Base fffffadf1220c000 Limit fffffadf12205000 Call 0
Priority 8 BasePriority 8 PriorityDecrement 0
Child-SP RetAddr Call Site
fffffadf1220b430 fffff80001027602 nt!KiSwapContext+0x85
fffffadf1220b5b0 fffff8000102820e nt!KiSwapThread+0x3c9
fffffadf1220b610 fffff800010474c8 nt!KeWaitForSingleObject+0x5a6
fffffadf1220b690 fffff80001010fd4 nt!ExpWaitForResource+0x48
fffffadf1220b700 fffffadf2abb2a3f nt!ExAcquireResourceSharedLite+0x32e
fffffadf1220b750 fffffadf2abb2915 Ntfs!NtfsCommonClose+0xa3
fffffadf1220b7f0 fffffadf2ac96542 Ntfs!NtfsFsdClose+0x392
fffffadf1220b8e0 fffffadf2ac968df fltMgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x3f2
fffffadf1220b950 fffffadf2b71cff7 fltMgr!FltpDispatch+0x17f
fffffadf1220b9b0 fffffadf2b7245ba TmPreFlt!TmpAddRdr+0xc87
fffffadf1220b9e0 fffff80001284120 TmPreFlt!TmpQueryFullName+0x7526
fffffadf1220ba10 fffff80001284e30 nt!IopDeleteFile+0x301
fffffadf1220bab0 fffff8000103c22e nt!ObpRemoveObjectRoutine+0x14f
fffffadf1220bb20 fffff80001288e97 nt!ObfDereferenceObject+0x83
fffffadf1220bb50 fffff80001285a54 nt!ObpCloseHandleTableEntry+0x24b
fffffadf1220bbf0 fffff8000102e2bd nt!ObpCloseHandle+0xb0
fffffadf1220bc70 0000000077ef0ada nt!KiSystemServiceCopyEnd+0x3 (TrapFrame @ fffffadf1220bc70) 00000000043ed798 00000000`00000000 0x77ef0ada

fffffadf36a7ba40-01

THREAD fffffadf36a7ba40 Cid 0b20.0d64 Teb: 000000007ef9d000 Win32Thread: fffffa80007b5920 WAIT: (Unknown) KernelMode Non-Alertable
fffffadf39f4a330 Semaphore Limit 0x7fffffff
fffffadf36a7baf8 NotificationTimer
IRP List:
fffffadf35bb4b50: (0006,03a0) Flags: 00000884 Mdl: 00000000
Not impersonating
DeviceMap fffffa8002d356d0
Owning Process fffffadf37bc6870 Image: vmware-tray.exe
Attached Process N/A Image: N/A
Wait Start TickCount 31952 Ticks: 207 (0:00:00:03.234)
Context Switch Count 1140 LargeStack
UserTime 00:00:00.000
KernelTime 00:00:00.000
Win32 Start Address 0x0000000003a4ac60
Start Address 0x000000007d4d1504
Stack Init fffffadf15382e00 Current fffffadf153818a0
Base fffffadf15383000 Limit fffffadf1537c000 Call 0
Priority 14 BasePriority 8 PriorityDecrement 6
Child-SP RetAddr Call Site
fffffadf153818e0 fffff80001027602 nt!KiSwapContext+0x85
fffffadf15381a60 fffff8000102820e nt!KiSwapThread+0x3c9
fffffadf15381ac0 fffff800010b0343 nt!KeWaitForSingleObject+0x5a6
fffffadf15381b40 fffff80001010fd4 nt!ExpWaitForResource+0x275
fffffadf15381bb0 fffffadf2abbad9c nt!ExAcquireResourceSharedLite+0x32e
fffffadf15381c00 fffffadf2abbb228 Ntfs!NtfsAcquireSharedVcb+0x2c
fffffadf15381c40 fffffadf2abbd2c6 Ntfs!NtfsCommonCreate+0x200
fffffadf15382020 fffffadf2ac96542 Ntfs!NtfsFsdCreate+0x218
fffffadf153821b0 fffffadf2acb1e1d fltMgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x3f2
fffffadf15382220 fffffadf2ac79289 fltMgr!FltpCreate+0x3bd
fffffadf153822b0 fffffadf2b72455d sr!SrCreate+0x1c9
fffffadf15382350 fffff80001283749 TmPreFlt!TmpQueryFullName+0x74c9
fffffadf15382460 fffff800012810e4 nt!IopParseDevice+0x1088
fffffadf15382610 fffff80001285807 nt!ObpLookupObjectName+0x931
fffffadf15382720 fffff80001292dcd nt!ObOpenObjectByName+0x180
fffffadf15382910 fffff80001299e87 nt!IopCreateFile+0x630
fffffadf15382aa0 fffff80001295889 nt!IoCreateFile+0x12f
fffffadf15382b80 fffff8000102e2bd nt!NtOpenFile+0x49
fffffadf15382c00 0000000077ef0d1a nt!KiSystemServiceCopyEnd+0x3 (TrapFrame @ fffffadf15382c70) 0000000003f1e798 00000000`00000000 0x77ef0d1a

fffffadf36825040-01

THREAD fffffadf36825040 Cid 0ba4.0ac8 Teb: 000007fffff7e000 Win32Thread: 0000000000000000 WAIT: (Unknown) KernelMode Non-Alertable
fffffadf39f4a330 Semaphore Limit 0x7fffffff
fffffadf368250f8 NotificationTimer
IRP List:
fffffadf35c15010: (0006,03a0) Flags: 00000884 Mdl: 00000000
Not impersonating
DeviceMap fffffa80000037b0
Owning Process fffffadf36bc2040 Image: TmListen.exe
Attached Process N/A Image: N/A
Wait Start TickCount 31966 Ticks: 193 (0:00:00:03.015)
Context Switch Count 117
UserTime 00:00:00.000
KernelTime 00:00:00.000
Start Address 0x0000000077d6b6a0
Stack Init fffffadf2a5bbe00 Current fffffadf2a5ba8a0
Base fffffadf2a5bc000 Limit fffffadf2a5b6000 Call 0
Priority 14 BasePriority 8 PriorityDecrement 6
Child-SP RetAddr Call Site
fffffadf2a5ba8e0 fffff80001027602 nt!KiSwapContext+0x85
fffffadf2a5baa60 fffff8000102820e nt!KiSwapThread+0x3c9
fffffadf2a5baac0 fffff800010b0343 nt!KeWaitForSingleObject+0x5a6
fffffadf2a5bab40 fffff80001010fd4 nt!ExpWaitForResource+0x275
fffffadf2a5babb0 fffffadf2abbad9c nt!ExAcquireResourceSharedLite+0x32e
fffffadf2a5bac00 fffffadf2abbb228 Ntfs!NtfsAcquireSharedVcb+0x2c
fffffadf2a5bac40 fffffadf2abbd2c6 Ntfs!NtfsCommonCreate+0x200
fffffadf2a5bb020 fffffadf2ac96542 Ntfs!NtfsFsdCreate+0x218
fffffadf2a5bb1b0 fffffadf2acb1e1d fltMgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x3f2
fffffadf2a5bb220 fffffadf2ac79289 fltMgr!FltpCreate+0x3bd
fffffadf2a5bb2b0 fffffadf2b72455d sr!SrCreate+0x1c9
fffffadf2a5bb350 fffff80001283749 TmPreFlt!TmpQueryFullName+0x74c9
fffffadf2a5bb460 fffff800012810e4 nt!IopParseDevice+0x1088
fffffadf2a5bb610 fffff80001285807 nt!ObpLookupObjectName+0x931
fffffadf2a5bb720 fffff80001292dcd nt!ObOpenObjectByName+0x180
fffffadf2a5bb910 fffff80001299e87 nt!IopCreateFile+0x630
fffffadf2a5bbaa0 fffff80001295889 nt!IoCreateFile+0x12f
fffffadf2a5bbb80 fffff8000102e2bd nt!NtOpenFile+0x49
fffffadf2a5bbc00 0000000077ef0d1a nt!KiSystemServiceCopyEnd+0x3 (TrapFrame @ fffffadf2a5bbc70) 00000000064cf298 00000000`00000000 0x77ef0d1a

fffffadf3a5f9040-01

THREAD fffffadf3a5f9040 Cid 0004.0024 Teb: 0000000000000000 Win32Thread: 0000000000000000 WAIT: (Unknown) KernelMode Non-Alertable
fffffadf39f4a330 Semaphore Limit 0x7fffffff
fffffadf3a5f90f8 NotificationTimer
IRP List:
fffffadf35c13c60: (0006,03a0) Flags: 00000004 Mdl: 00000000
Not impersonating
DeviceMap fffffa80000037b0
Owning Process fffffadf3a5fe040 Image: System
Attached Process N/A Image: N/A
Wait Start TickCount 31972 Ticks: 187 (0:00:00:02.921)
Context Switch Count 8746
UserTime 00:00:00.000
KernelTime 00:00:00.093
Start Address nt!ExpWorkerThread (0xfffff80001003970)
Stack Init fffffadf2ba63e00 Current fffffadf2ba63350
Base fffffadf2ba64000 Limit fffffadf2ba5e000 Call 0
Priority 14 BasePriority 12 PriorityDecrement 1
Child-SP RetAddr Call Site
fffffadf2ba63390 fffff80001027602 nt!KiSwapContext+0x85
fffffadf2ba63510 fffff8000102820e nt!KiSwapThread+0x3c9
fffffadf2ba63570 fffff800010b0343 nt!KeWaitForSingleObject+0x5a6
fffffadf2ba635f0 fffff80001010fd4 nt!ExpWaitForResource+0x275
fffffadf2ba63660 fffffadf2abbad9c nt!ExAcquireResourceSharedLite+0x32e
fffffadf2ba636b0 fffffadf2aba106e Ntfs!NtfsAcquireSharedVcb+0x2c
fffffadf2ba636f0 fffffadf2aba153a Ntfs!NtfsCommonFlushBuffers+0x1ac
fffffadf2ba637b0 fffffadf2ac96922 Ntfs!NtfsFsdFlushBuffers+0xc3
fffffadf2ba63830 fffffadf2b71cff7 fltMgr!FltpDispatch+0x1c2
fffffadf2ba63890 fffff80001264b2b TmPreFlt!TmpAddRdr+0xc87
fffffadf2ba638c0 fffff8000102e2bd nt!NtFlushBuffersFile+0x2bd
fffffadf2ba63950 fffff8000102e780 nt!KiSystemServiceCopyEnd+0x3 (TrapFrame @ fffffadf2ba63950) fffffadf2ba63ae8 fffff8000125a3c5 nt!KiServiceLinkage fffffadf2ba63af0 fffff8000125e49b nt!CmpFileFlush+0x68 fffffadf2ba63b40 fffff8000125999f nt!HvpWriteLog+0x20f fffffadf2ba63c10 fffff8000125e33c nt!HvSyncHive+0x94 fffffadf2ba63c40 fffff8000125d42d nt!CmpDoFlushNextHive+0xf0 fffffadf2ba63cc0 fffff8000103754a nt!CmpLazyFlushWorker+0xef fffffadf2ba63d00 fffff8000124b932 nt!ExpWorkerThread+0x13b fffffadf2ba63d70 fffff80001020196 nt!PspSystemThreadStartup+0x3e fffffadf2ba63dd0 00000000`00000000 nt!KxStartSystemThread+0x16

fffffadf367d9bf0-01

THREAD fffffadf367d9bf0 Cid 0448.0f30 Teb: 000007fffff88000 Win32Thread: 0000000000000000 WAIT: (Unknown) KernelMode Non-Alertable
fffffadf39f4a330 Semaphore Limit 0x7fffffff
fffffadf367d9ca8 NotificationTimer
Not impersonating
DeviceMap fffffa80000037b0
Owning Process fffffadf3787ac20 Image: spoolsv.exe
Attached Process N/A Image: N/A
Wait Start TickCount 31974 Ticks: 185 (0:00:00:02.890)
Context Switch Count 8
UserTime 00:00:00.000
KernelTime 00:00:00.000
Win32 Start Address 0x00000000000bed80
Start Address 0x0000000077d6b6a0
Stack Init fffffadf153c8e00 Current fffffadf153c7970
Base fffffadf153c9000 Limit fffffadf153c3000 Call 0
Priority 14 BasePriority 8 PriorityDecrement 6
*** ERROR: Module load completed but symbols could not be loaded for sptd.sys
Child-SP RetAddr Call Site
fffffadf153c79b0 fffff80001027602 nt!KiSwapContext+0x85
fffffadf153c7b30 fffff8000102820e nt!KiSwapThread+0x3c9
fffffadf153c7b90 fffff800010b0343 nt!KeWaitForSingleObject+0x5a6
fffffadf153c7c10 fffff80001010fd4 nt!ExpWaitForResource+0x275
fffffadf153c7c80 fffffadf2abbad9c nt!ExAcquireResourceSharedLite+0x32e
fffffadf153c7cd0 fffffadf2abbb228 Ntfs!NtfsAcquireSharedVcb+0x2c
fffffadf153c7d10 fffffadf2abaa0cb Ntfs!NtfsCommonCreate+0x200
fffffadf153c80f0 fffffadf2b129313 Ntfs!NtfsNetworkOpenCreate+0xcc
fffffadf153c83a0 fffffadf2ac94d27 sptd+0x69313
fffffadf153c83d0 fffffadf2ac95041 fltMgr!FltpPerformFastIoCall+0x457
fffffadf153c8440 fffffadf2acb0b2a fltMgr!FltpPassThroughFastIo+0xa1
fffffadf153c8480 fffffadf2ac7daba fltMgr!FltpFastIoQueryOpen+0x16a
fffffadf153c8520 fffffadf2b72529f sr!SrFastIoQueryOpen+0x5a
fffffadf153c8550 fffff8000129a56d TmPreFlt!TmpQueryFullName+0x820b
fffffadf153c8580 fffff800012810e4 nt!IopParseDevice+0xf52
fffffadf153c8730 fffff80001285807 nt!ObpLookupObjectName+0x931
fffffadf153c8840 fffff800012959cd nt!ObOpenObjectByName+0x180
fffffadf153c8a30 fffff8000102e2bd nt!NtQueryAttributesFile+0x133
fffffadf153c8c70 0000000077ef0dba nt!KiSystemServiceCopyEnd+0x3 (TrapFrame @ fffffadf153c8c70) 000000000302f158 00000000`00000000 0x77ef0dba

fffffadf36983bf0-01

THREAD fffffadf36983bf0 Cid 0b68.0d38 Teb: 000007fffff98000 Win32Thread: 0000000000000000 WAIT: (Unknown) KernelMode Non-Alertable
fffffadf39f4a330 Semaphore Limit 0x7fffffff
fffffadf36983ca8 NotificationTimer
IRP List:
fffffadf35b3bc60: (0006,03a0) Flags: 00000884 Mdl: 00000000
Not impersonating
DeviceMap fffffa8002d356d0
Owning Process fffffadf36b34040 Image: PccNTMon.exe
Attached Process N/A Image: N/A
Wait Start TickCount 32039 Ticks: 120 (0:00:00:01.875)
Context Switch Count 113
UserTime 00:00:00.000
KernelTime 00:00:00.000
Start Address 0x0000000077d6b6a0
Stack Init fffffadf11a0ae00 Current fffffadf11a098a0
Base fffffadf11a0b000 Limit fffffadf11a05000 Call 0
Priority 14 BasePriority 8 PriorityDecrement 6
Child-SP RetAddr Call Site
fffffadf11a098e0 fffff80001027602 nt!KiSwapContext+0x85
fffffadf11a09a60 fffff8000102820e nt!KiSwapThread+0x3c9
fffffadf11a09ac0 fffff800010b0343 nt!KeWaitForSingleObject+0x5a6
fffffadf11a09b40 fffff80001010fd4 nt!ExpWaitForResource+0x275
fffffadf11a09bb0 fffffadf2abbad9c nt!ExAcquireResourceSharedLite+0x32e
fffffadf11a09c00 fffffadf2abbb228 Ntfs!NtfsAcquireSharedVcb+0x2c
fffffadf11a09c40 fffffadf2abbd2c6 Ntfs!NtfsCommonCreate+0x200
fffffadf11a0a020 fffffadf2ac96542 Ntfs!NtfsFsdCreate+0x218
fffffadf11a0a1b0 fffffadf2acb1e1d fltMgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x3f2
fffffadf11a0a220 fffffadf2ac79289 fltMgr!FltpCreate+0x3bd
fffffadf11a0a2b0 fffffadf2b72455d sr!SrCreate+0x1c9
fffffadf11a0a350 fffff80001283749 TmPreFlt!TmpQueryFullName+0x74c9
fffffadf11a0a460 fffff800012810e4 nt!IopParseDevice+0x1088
fffffadf11a0a610 fffff80001285807 nt!ObpLookupObjectName+0x931
fffffadf11a0a720 fffff80001292dcd nt!ObOpenObjectByName+0x180
fffffadf11a0a910 fffff80001299e87 nt!IopCreateFile+0x630
fffffadf11a0aaa0 fffff80001295889 nt!IoCreateFile+0x12f
fffffadf11a0ab80 fffff8000102e2bd nt!NtOpenFile+0x49
fffffadf11a0ac00 0000000077ef0d1a nt!KiSystemServiceCopyEnd+0x3 (TrapFrame @ fffffadf11a0ac70) 0000000003bcf4b8 00000000`00000000 0x77ef0d1a

fffffadf37883890-01

THREAD fffffadf37883890 Cid 0f20.0390 Teb: 000000007efdb000 Win32Thread: fffffa8006b08620 WAIT: (Unknown) KernelMode Non-Alertable
fffffadf39f4a330 Semaphore Limit 0x7fffffff
fffffadf37883948 NotificationTimer
Not impersonating
DeviceMap fffffa8002d356d0
Owning Process fffffadf36ade870 Image: EventMonitor.exe
Attached Process N/A Image: N/A
Wait Start TickCount 32043 Ticks: 116 (0:00:00:01.812)
Context Switch Count 11389 LargeStack
UserTime 00:00:00.328
KernelTime 00:00:00.312
Win32 Start Address 0x00000000004137d1
Start Address 0x0000000077d59620
Stack Init fffffadf2b40e570 Current fffffadf2b40d0e0
Base fffffadf2b410000 Limit fffffadf2b404000 Call fffffadf2b40e770
Priority 14 BasePriority 8 PriorityDecrement 5
Child-SP RetAddr Call Site
fffffadf2b40d120 fffff80001027602 nt!KiSwapContext+0x85
fffffadf2b40d2a0 fffff8000102820e nt!KiSwapThread+0x3c9
fffffadf2b40d300 fffff800010b0343 nt!KeWaitForSingleObject+0x5a6
fffffadf2b40d380 fffff80001010fd4 nt!ExpWaitForResource+0x275
fffffadf2b40d3f0 fffffadf2abbad9c nt!ExAcquireResourceSharedLite+0x32e
fffffadf2b40d440 fffffadf2abbb228 Ntfs!NtfsAcquireSharedVcb+0x2c
fffffadf2b40d480 fffffadf2abaa0cb Ntfs!NtfsCommonCreate+0x200
fffffadf2b40d860 fffffadf2b129313 Ntfs!NtfsNetworkOpenCreate+0xcc
fffffadf2b40db10 fffffadf2ac94d27 sptd+0x69313
fffffadf2b40db40 fffffadf2ac95041 fltMgr!FltpPerformFastIoCall+0x457
fffffadf2b40dbb0 fffffadf2acb0b2a fltMgr!FltpPassThroughFastIo+0xa1
fffffadf2b40dbf0 fffffadf2ac7daba fltMgr!FltpFastIoQueryOpen+0x16a
fffffadf2b40dc90 fffffadf2b72529f sr!SrFastIoQueryOpen+0x5a
fffffadf2b40dcc0 fffff8000129a56d TmPreFlt!TmpQueryFullName+0x820b
fffffadf2b40dcf0 fffff800012810e4 nt!IopParseDevice+0xf52
fffffadf2b40dea0 fffff80001285807 nt!ObpLookupObjectName+0x931
fffffadf2b40dfb0 fffff800012959cd nt!ObOpenObjectByName+0x180
fffffadf2b40e1a0 fffff8000102e2bd nt!NtQueryAttributesFile+0x133
fffffadf2b40e3e0 0000000077ef0dba nt!KiSystemServiceCopyEnd+0x3 (TrapFrame @ fffffadf2b40e3e0) 000000000012c508 fffff800010265c0 0x77ef0dba fffffadf2b40e770 fffffadf2b40ef50 nt!KiCallUserMode fffffadf2b40e778 000000000012d578 0xfffffadf2b40ef50
fffffadf2b40e780 000000000012d4b0 0x12d578
fffffadf2b40e788 0000000000000000 0x12d4b0

fffffadf36b3a7f0-01

THREAD fffffadf36b3a7f0 Cid 0b68.0b6c Teb: 000007fffffdb000 Win32Thread: fffffa8002a86d80 WAIT: (Unknown) KernelMode Non-Alertable
fffffadf39f4a330 Semaphore Limit 0x7fffffff
fffffadf36b3a8a8 NotificationTimer
Not impersonating
DeviceMap fffffa8002d356d0
Owning Process fffffadf36b34040 Image: PccNTMon.exe
Attached Process N/A Image: N/A
Wait Start TickCount 32071 Ticks: 88 (0:00:00:01.375)
Context Switch Count 7789 LargeStack
UserTime 00:00:00.015
KernelTime 00:00:00.109
Win32 Start Address 0x00000001400a4100
Start Address 0x0000000077d59620
Stack Init fffffadf1547ae00 Current fffffadf15479970
Base fffffadf1547b000 Limit fffffadf15470000 Call 0
Priority 14 BasePriority 8 PriorityDecrement 2
Child-SP RetAddr Call Site
fffffadf154799b0 fffff80001027602 nt!KiSwapContext+0x85
fffffadf15479b30 fffff8000102820e nt!KiSwapThread+0x3c9
fffffadf15479b90 fffff800010b0343 nt!KeWaitForSingleObject+0x5a6
fffffadf15479c10 fffff80001010fd4 nt!ExpWaitForResource+0x275
fffffadf15479c80 fffffadf2abbad9c nt!ExAcquireResourceSharedLite+0x32e
fffffadf15479cd0 fffffadf2abbb228 Ntfs!NtfsAcquireSharedVcb+0x2c
fffffadf15479d10 fffffadf2abaa0cb Ntfs!NtfsCommonCreate+0x200
fffffadf1547a0f0 fffffadf2b129313 Ntfs!NtfsNetworkOpenCreate+0xcc
fffffadf1547a3a0 fffffadf2ac94d27 sptd+0x69313
fffffadf1547a3d0 fffffadf2ac95041 fltMgr!FltpPerformFastIoCall+0x457
fffffadf1547a440 fffffadf2acb0b2a fltMgr!FltpPassThroughFastIo+0xa1
fffffadf1547a480 fffffadf2ac7daba fltMgr!FltpFastIoQueryOpen+0x16a
fffffadf1547a520 fffffadf2b72529f sr!SrFastIoQueryOpen+0x5a
fffffadf1547a550 fffff8000129a56d TmPreFlt!TmpQueryFullName+0x820b
fffffadf1547a580 fffff800012810e4 nt!IopParseDevice+0xf52
fffffadf1547a730 fffff80001285807 nt!ObpLookupObjectName+0x931
fffffadf1547a840 fffff800012959cd nt!ObOpenObjectByName+0x180
fffffadf1547aa30 fffff8000102e2bd nt!NtQueryAttributesFile+0x133
fffffadf1547ac70 0000000077ef0dba nt!KiSystemServiceCopyEnd+0x3 (TrapFrame @ fffffadf1547ac70) 000000000023f608 00000000`00000000 0x77ef0dba

fffffadf39d9b880-01

THREAD fffffadf39d9b880 Cid 0a3c.0a44 Teb: 000000007efdb000 Win32Thread: fffffa8005352190 WAIT: (Unknown) KernelMode Non-Alertable
fffffadf39f4a330 Semaphore Limit 0x7fffffff
fffffadf39d9b938 NotificationTimer
Not impersonating
DeviceMap fffffa8000b19f00
Owning Process fffffadf36ae3890 Image: Dbgview.exe
Attached Process N/A Image: N/A
Wait Start TickCount 32071 Ticks: 88 (0:00:00:01.375)
Context Switch Count 15962 LargeStack
UserTime 00:00:00.531
KernelTime 00:00:00.828
Win32 Start Address 0x00000000004153b7
Start Address 0x0000000077d59620
Stack Init fffffadf10afc010 Current fffffadf10afab80
Base fffffadf10afd000 Limit fffffadf10af2000 Call fffffadf10afc210
Priority 14 BasePriority 8 PriorityDecrement 6
Child-SP RetAddr Call Site
fffffadf10afabc0 fffff80001027602 nt!KiSwapContext+0x85
fffffadf10afad40 fffff8000102820e nt!KiSwapThread+0x3c9
fffffadf10afada0 fffff800010b0343 nt!KeWaitForSingleObject+0x5a6
fffffadf10afae20 fffff80001010fd4 nt!ExpWaitForResource+0x275
fffffadf10afae90 fffffadf2abbad9c nt!ExAcquireResourceSharedLite+0x32e
fffffadf10afaee0 fffffadf2abbb228 Ntfs!NtfsAcquireSharedVcb+0x2c
fffffadf10afaf20 fffffadf2abaa0cb Ntfs!NtfsCommonCreate+0x200
fffffadf10afb300 fffffadf2b129313 Ntfs!NtfsNetworkOpenCreate+0xcc
fffffadf10afb5b0 fffffadf2ac94d27 sptd+0x69313
fffffadf10afb5e0 fffffadf2ac95041 fltMgr!FltpPerformFastIoCall+0x457
fffffadf10afb650 fffffadf2acb0b2a fltMgr!FltpPassThroughFastIo+0xa1
fffffadf10afb690 fffffadf2ac7daba fltMgr!FltpFastIoQueryOpen+0x16a
fffffadf10afb730 fffffadf2b72529f sr!SrFastIoQueryOpen+0x5a
fffffadf10afb760 fffff8000129a56d TmPreFlt!TmpQueryFullName+0x820b
fffffadf10afb790 fffff800012810e4 nt!IopParseDevice+0xf52
fffffadf10afb940 fffff80001285807 nt!ObpLookupObjectName+0x931
fffffadf10afba50 fffff800012959cd nt!ObOpenObjectByName+0x180
fffffadf10afbc40 fffff8000102e2bd nt!NtQueryAttributesFile+0x133
fffffadf10afbe80 0000000077ef0dba nt!KiSystemServiceCopyEnd+0x3 (TrapFrame @ fffffadf10afbe80) 000000000012d468 fffff800010265c0 0x77ef0dba fffffadf10afc210 00000000`00000000 nt!KiCallUserMode

fffffadf36cbbbf0-01

THREAD fffffadf36cbbbf0 Cid 0388.086c Teb: 000007fffffd5000 Win32Thread: fffffa80045b4d80 WAIT: (Unknown) KernelMode Non-Alertable
fffffadf39f4a330 Semaphore Limit 0x7fffffff
fffffadf36cbbca8 NotificationTimer
Not impersonating
DeviceMap fffffa8002d356d0
Owning Process fffffadf36ce4040 Image: explorer.exe
Attached Process N/A Image: N/A
Wait Start TickCount 32107 Ticks: 52 (0:00:00:00.812)
Context Switch Count 19024 LargeStack
UserTime 00:00:00.046
KernelTime 00:00:00.203
Win32 Start Address 0x00000000000afb90
Start Address 0x0000000077d6b6a0
Stack Init fffffadf15669100 Current fffffadf15667c70
Base fffffadf1566a000 Limit fffffadf1565f000 Call fffffadf15669300
Priority 14 BasePriority 9 PriorityDecrement 1
Child-SP RetAddr Call Site
fffffadf15667cb0 fffff80001027602 nt!KiSwapContext+0x85
fffffadf15667e30 fffff8000102820e nt!KiSwapThread+0x3c9
fffffadf15667e90 fffff800010b0343 nt!KeWaitForSingleObject+0x5a6
fffffadf15667f10 fffff80001010fd4 nt!ExpWaitForResource+0x275
fffffadf15667f80 fffffadf2abbad9c nt!ExAcquireResourceSharedLite+0x32e
fffffadf15667fd0 fffffadf2abbb228 Ntfs!NtfsAcquireSharedVcb+0x2c
fffffadf15668010 fffffadf2abaa0cb Ntfs!NtfsCommonCreate+0x200
fffffadf156683f0 fffffadf2b129313 Ntfs!NtfsNetworkOpenCreate+0xcc
fffffadf156686a0 fffffadf2ac94d27 sptd+0x69313
fffffadf156686d0 fffffadf2ac95041 fltMgr!FltpPerformFastIoCall+0x457
fffffadf15668740 fffffadf2acb0b2a fltMgr!FltpPassThroughFastIo+0xa1
fffffadf15668780 fffffadf2ac7daba fltMgr!FltpFastIoQueryOpen+0x16a
fffffadf15668820 fffffadf2b72529f sr!SrFastIoQueryOpen+0x5a
fffffadf15668850 fffff8000129a56d TmPreFlt!TmpQueryFullName+0x820b
fffffadf15668880 fffff800012810e4 nt!IopParseDevice+0xf52
fffffadf15668a30 fffff80001285807 nt!ObpLookupObjectName+0x931
fffffadf15668b40 fffff800012959cd nt!ObOpenObjectByName+0x180
fffffadf15668d30 fffff8000102e2bd nt!NtQueryAttributesFile+0x133
fffffadf15668f70 0000000077ef0dba nt!KiSystemServiceCopyEnd+0x3 (TrapFrame @ fffffadf15668f70) 0000000002b7e2a8 fffff800010265c0 0x77ef0dba fffffadf15669300 fffffadf15658000 nt!KiCallUserMode fffffadf15669308 0000000000000000 0xfffffadf15658000

1 total locks, 1 locks currently held

In the stack of thread [fffffadf379117a0], it is trying to acquire eresource [fffffadf`36c715f0]? However it looks fields are not in valid value scope.

fffffadf2a50c720 fffffadf2ab9aa74 : [fffffadf36c715f0] fffffadf2a50c970 0000000000000000 fffffa800084ab00 : nt!ExAcquireResourceExclusiveLite+0x1ab

0: kd> dt _ERESOURCE fffffadf36c715f0 nt!_ERESOURCE +0x000 SystemResourcesList : _LIST_ENTRY [0x000000000178070a - 0x180001]
+0x010 OwnerTable : 0x0000000200000000 _OWNER_ENTRY +0x018 ActiveCount : 0n0 +0x01a Flag : 0 +0x020 SharedWaiters : (null) +0x028 ExclusiveWaiters : 0xfffffadf37c521c8 _KEVENT
+0x030 OwnerThreads : [2] _OWNER_ENTRY
+0x050 ContentionCount : 0x36c71640
+0x054 NumberOfSharedWaiters : 0xfadf
+0x056 NumberOfExclusiveWaiters : 0xffff
+0x058 Address : 0xfffffadf36c71640 Void +0x058 CreatorBackTraceIndex : 0xfffffadf36c71640
+0x060 SpinLock : 0

0: kd> !locks -v fffffadf`36c715f0

200000000: Unable to read TableSize for resource
0 total locks

> On a xp-x64 machine, ocasionally the system becomes slow

Reinstall the machine to have ONLY a) the OS b) your software.

Then corellate the moments of slowness to the activities of your software.

This is a hard time-consuming task. It is 100% not a good idea to spend time investigating 1 particular machine if the issue does not manifest constantly (unless this is a personal laptop of your serious business partner).

!locks will not help. FCB locks are constantly acquired and released, and the OS is usually not slow, regardless of this.

The question of “what this particular svchost is doing”? can be solved by using “.process /p” and then investigating the user space of the svchost process, yes, the symbols for user EXE/DLLs will also be auto-loaded.

Also, look at CPU usage. If the machine is slow and you have a CPU usage peak of 100% in your code - then this is a classic computation perf issue, related to some things being O(N^2) instead of O(N) or something like.

BTW, my favourite example of slow code:

  • some VSS client code, directly borrowed from MS’s VSHADOW source, calls “get volume GUID name” kind of call for each and every file in the system32 dir (i.e. for each and every file listed by the System VSS Writer).
  • IIRC (some time passed since I was deeply into this) it was even something worse, like O(N^2) and not O(N) number of DeviceIoControl calls, since it was used to join the 2 sets of pathnames (thousands) on the attribute extracted by the “get volume GUID name” aka DeviceIoControl call.
  • this call is DeviceIoControl to MountMgr.sys
  • if you have Driver Verifier on, then it adds instrumentation to IOCTL calls and makes them slower.
  • this slowdown is especially noticeable if you have huge number (like 10K or more) IOCTL calls, each being very simple of “get the string property of this file” kind.
  • so, if you turn DV on and run the VSS client copy/pasted from VSHADOW, then your VSS state machine takes something like 10 minutes and then fails.
  • without DV, it is a sudden 100% CPU usage peak for 2-3 seconds, and nothing worse.


Maxim S. Shatskih
Microsoft MVP on File System And Storage
xxxxx@storagecraft.com
http://www.storagecraft.com