This is the output from WinDBG. I receive this bugcheck pretty frequently.
What does it mean? How can I find the cause of the problem?
UNEXPECTED_KERNEL_MODE_TRAP (7f)
This means a trap occurred in kernel mode, and it’s a trap of a kind
that the kernel isn’t allowed to have/catch (bound trap) or that
is always instant death (double fault). The first number in the
bugcheck parens is the number of the trap (8 = double fault, etc)
Consult an Intel x86 family manual to learn more about what these
traps are. Here is a *portion* of those codes:
If kv shows a taskGate
use .tss on the part before the colon, then kv.
Else if kv shows a trapframe
use .trap on that value
Else
.trap on the appropriate frame will show where the trap was taken
(on x86, this will be the ebp that goes with the procedure KiTrap)
Endif
kb will then show the corrected stack.
Arguments:
Arg1: 00000008, EXCEPTION_DOUBLE_FAULT
Arg2: 00000000
Arg3: 00000000
Arg4: 00000000
Debugging Details:
BUGCHECK_STR: 7f_8
TSS: 00000028 – (.tss 28)
eax=f981aa0c ebx=c0000074 ecx=c0000060 edx=00000000 esi=00000000
edi=00000000
eip=8044005a esp=bffffca8 ebp=c0000044 iopl=0 nv up ei ng nz na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010282
nt!KiDispatchException+25:
8044005a 53 push ebx
Resetting default context
DEFAULT_BUCKET_ID: DRIVER_FAULT
LAST_CONTROL_TRANSFER: from fffff480 to 8044005a
STACK_TEXT:
c0000044 fffff480 fffff480 fffff480 fffff480 nt!KiDispatchException+0x25
fffff480 00000000 00000000 00000000 00000000 0xfffff480
FOLLOWUP_IP:
nt!KiDispatchException+25
8044005a 53 push ebx
FOLLOWUP_NAME: MachineOwner
SYMBOL_NAME: nt!KiDispatchException+25
MODULE_NAME: nt
IMAGE_NAME: ntoskrnl.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 3ad7783f
STACK_COMMAND: .tss 28 ; kb
BUCKET_ID: ZEROED_STACK
Followup: MachineOwner
Alexey,
Ok the !analyze -v is telling you some information.
I suggest do a .reload /f /v and the !analyze -v again as well as the
.tss 28 followed by kb
As per the double fault (Interrupt #8 or #DF) means that that uP
encounter yet another exception while processing the first one.
If you have the WinDbg connected at the time of the faults make sure
that you set the all your events filter to output and set verbose from
the WinDbg UI.
You need to be able to capture that original fault first to start
working on your issue.
Thanks,
Juan
This is just my personal opinion.
No warrantees of any kind are explicit or implied.
-----Original Message-----
From: Alexey Logachyov [mailto:xxxxx@vba.com.by]
Sent: Wednesday, June 12, 2002 8:30 AM
To: Kernel Debugging Interest List
Subject: [windbg] UNEXPECTED_KERNEL_MODE_TRAP
This is the output from WinDBG. I receive this bugcheck pretty
frequently.
What does it mean? How can I find the cause of the problem?
UNEXPECTED_KERNEL_MODE_TRAP (7f)
This means a trap occurred in kernel mode, and it’s a trap of a kind
that the kernel isn’t allowed to have/catch (bound trap) or that
is always instant death (double fault). The first number in the
bugcheck parens is the number of the trap (8 = double fault, etc)
Consult an Intel x86 family manual to learn more about what these
traps are. Here is a *portion* of those codes:
If kv shows a taskGate
use .tss on the part before the colon, then kv.
Else if kv shows a trapframe
use .trap on that value
Else
.trap on the appropriate frame will show where the trap was taken
(on x86, this will be the ebp that goes with the procedure KiTrap)
Endif
kb will then show the corrected stack.
Arguments:
Arg1: 00000008, EXCEPTION_DOUBLE_FAULT
Arg2: 00000000
Arg3: 00000000
Arg4: 00000000
Debugging Details:
BUGCHECK_STR: 7f_8
TSS: 00000028 – (.tss 28)
eax=f981aa0c ebx=c0000074 ecx=c0000060 edx=00000000 esi=00000000
edi=00000000
eip=8044005a esp=bffffca8 ebp=c0000044 iopl=0 nv up ei ng nz na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010282
nt!KiDispatchException+25:
8044005a 53 push ebx
Resetting default context
DEFAULT_BUCKET_ID: DRIVER_FAULT
LAST_CONTROL_TRANSFER: from fffff480 to 8044005a
STACK_TEXT:
c0000044 fffff480 fffff480 fffff480 fffff480 nt!KiDispatchException+0x25
fffff480 00000000 00000000 00000000 00000000 0xfffff480
FOLLOWUP_IP:
nt!KiDispatchException+25
8044005a 53 push ebx
FOLLOWUP_NAME: MachineOwner
SYMBOL_NAME: nt!KiDispatchException+25
MODULE_NAME: nt
IMAGE_NAME: ntoskrnl.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 3ad7783f
STACK_COMMAND: .tss 28 ; kb
BUCKET_ID: ZEROED_STACK
Followup: MachineOwner
You are currently subscribed to windbg as: martinez@hp.com
To unsubscribe send a blank email to %%email.unsub%%
I’m not experienced in WinDBG. How could I ‘set the all my events filter to
output’? Enabling only verbose mode does not catch first fault.
----- Original Message -----
From: “Martinez, Juan (Cons)”
To: “Kernel Debugging Interest List”
Sent: Thursday, June 13, 2002 5:02 PM
Subject: [windbg] RE: UNEXPECTED_KERNEL_MODE_TRAP
Alexey,
Ok the !analyze -v is telling you some information.
I suggest do a .reload /f /v and the !analyze -v again as well as the
.tss 28 followed by kb
As per the double fault (Interrupt #8 or #DF) means that that uP
encounter yet another exception while processing the first one.
If you have the WinDbg connected at the time of the faults make sure
that you set the all your events filter to output and set verbose from
the WinDbg UI.
You need to be able to capture that original fault first to start
working on your issue.
Thanks,
Juan
__________________________________
This is just my personal opinion.
No warrantees of any kind are explicit or implied.
-----Original Message-----
From: Alexey Logachyov [mailto:xxxxx@vba.com.by]
Sent: Wednesday, June 12, 2002 8:30 AM
To: Kernel Debugging Interest List
Subject: [windbg] UNEXPECTED_KERNEL_MODE_TRAP
This is the output from WinDBG. I receive this bugcheck pretty
frequently.
What does it mean? How can I find the cause of the problem?
UNEXPECTED_KERNEL_MODE_TRAP (7f)
This means a trap occurred in kernel mode, and it’s a trap of a kind
that the kernel isn’t allowed to have/catch (bound trap) or that
is always instant death (double fault). The first number in the
bugcheck parens is the number of the trap (8 = double fault, etc)
Consult an Intel x86 family manual to learn more about what these
traps are. Here is a portion of those codes:
If kv shows a taskGate
use .tss on the part before the colon, then kv.
Else if kv shows a trapframe
use .trap on that value
Else
.trap on the appropriate frame will show where the trap was taken
(on x86, this will be the ebp that goes with the procedure KiTrap)
Endif
kb will then show the corrected stack.
Arguments:
Arg1: 00000008, EXCEPTION_DOUBLE_FAULT
Arg2: 00000000
Arg3: 00000000
Arg4: 00000000
Debugging Details:
------------------
BUGCHECK_STR: 7f_8
TSS: 00000028 – (.tss 28)
eax=f981aa0c ebx=c0000074 ecx=c0000060 edx=00000000 esi=00000000
edi=00000000
eip=8044005a esp=bffffca8 ebp=c0000044 iopl=0 nv up ei ng nz na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010282
nt!KiDispatchException+25:
8044005a 53 push ebx
Resetting default context
DEFAULT_BUCKET_ID: DRIVER_FAULT
LAST_CONTROL_TRANSFER: from fffff480 to 8044005a
STACK_TEXT:
c0000044 fffff480 fffff480 fffff480 fffff480 nt!KiDispatchException+0x25
fffff480 00000000 00000000 00000000 00000000 0xfffff480
FOLLOWUP_IP:
nt!KiDispatchException+25
8044005a 53 push ebx
FOLLOWUP_NAME: MachineOwner
SYMBOL_NAME: nt!KiDispatchException+25
MODULE_NAME: nt
IMAGE_NAME: ntoskrnl.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 3ad7783f
STACK_COMMAND: .tss 28 ; kb
BUCKET_ID: ZEROED_STACK
Followup: MachineOwner
---------
—
You are currently subscribed to windbg as: martinez@hp.com
To unsubscribe send a blank email to %%email.unsub%%
—
You are currently subscribed to windbg as: xxxxx@vba.com.by
To unsubscribe send a blank email to %%email.unsub%%
Alexey,
Open with the UI, Debug Tab select Event Filters and set them to output
one by one.
Also use verbose mode Ctrl+Alt+V
And please read the help file.
Thanks,
Juan
This is just my personal opinion.
No warrantees of any kind are explicit or implied.
-----Original Message-----
From: Alexey Logachyov [mailto:xxxxx@vba.com.by]
Sent: Friday, June 14, 2002 5:28 AM
To: Kernel Debugging Interest List
Subject: [windbg] RE: UNEXPECTED_KERNEL_MODE_TRAP
I’m not experienced in WinDBG. How could I ‘set the all my events filter
to
output’? Enabling only verbose mode does not catch first fault.
----- Original Message -----
From: “Martinez, Juan (Cons)”
To: “Kernel Debugging Interest List”
Sent: Thursday, June 13, 2002 5:02 PM
Subject: [windbg] RE: UNEXPECTED_KERNEL_MODE_TRAP
Alexey,
Ok the !analyze -v is telling you some information.
I suggest do a .reload /f /v and the !analyze -v again as well as the
.tss 28 followed by kb
As per the double fault (Interrupt #8 or #DF) means that that uP
encounter yet another exception while processing the first one.
If you have the WinDbg connected at the time of the faults make sure
that you set the all your events filter to output and set verbose from
the WinDbg UI.
You need to be able to capture that original fault first to start
working on your issue.
Thanks,
Juan
__________________________________
This is just my personal opinion.
No warrantees of any kind are explicit or implied.
-----Original Message-----
From: Alexey Logachyov [mailto:xxxxx@vba.com.by]
Sent: Wednesday, June 12, 2002 8:30 AM
To: Kernel Debugging Interest List
Subject: [windbg] UNEXPECTED_KERNEL_MODE_TRAP
This is the output from WinDBG. I receive this bugcheck pretty
frequently.
What does it mean? How can I find the cause of the problem?
UNEXPECTED_KERNEL_MODE_TRAP (7f)
This means a trap occurred in kernel mode, and it’s a trap of a kind
that the kernel isn’t allowed to have/catch (bound trap) or that
is always instant death (double fault). The first number in the
bugcheck parens is the number of the trap (8 = double fault, etc)
Consult an Intel x86 family manual to learn more about what these
traps are. Here is a portion of those codes:
If kv shows a taskGate
use .tss on the part before the colon, then kv.
Else if kv shows a trapframe
use .trap on that value
Else
.trap on the appropriate frame will show where the trap was taken
(on x86, this will be the ebp that goes with the procedure KiTrap)
Endif
kb will then show the corrected stack.
Arguments:
Arg1: 00000008, EXCEPTION_DOUBLE_FAULT
Arg2: 00000000
Arg3: 00000000
Arg4: 00000000
Debugging Details:
------------------
BUGCHECK_STR: 7f_8
TSS: 00000028 – (.tss 28)
eax=f981aa0c ebx=c0000074 ecx=c0000060 edx=00000000 esi=00000000
edi=00000000
eip=8044005a esp=bffffca8 ebp=c0000044 iopl=0 nv up ei ng nz na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010282
nt!KiDispatchException+25:
8044005a 53 push ebx
Resetting default context
DEFAULT_BUCKET_ID: DRIVER_FAULT
LAST_CONTROL_TRANSFER: from fffff480 to 8044005a
STACK_TEXT:
c0000044 fffff480 fffff480 fffff480 fffff480 nt!KiDispatchException+0x25
fffff480 00000000 00000000 00000000 00000000 0xfffff480
FOLLOWUP_IP:
nt!KiDispatchException+25
8044005a 53 push ebx
FOLLOWUP_NAME: MachineOwner
SYMBOL_NAME: nt!KiDispatchException+25
MODULE_NAME: nt
IMAGE_NAME: ntoskrnl.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 3ad7783f
STACK_COMMAND: .tss 28 ; kb
BUCKET_ID: ZEROED_STACK
Followup: MachineOwner
---------
—
You are currently subscribed to windbg as: martinez@hp.com
To unsubscribe send a blank email to %%email.unsub%%
—
You are currently subscribed to windbg as: xxxxx@vba.com.by
To unsubscribe send a blank email to %%email.unsub%%
—
You are currently subscribed to windbg as: martinez@hp.com
To unsubscribe send a blank email to %%email.unsub%%
It didn’t reveal the first fault. But I found the bug though. From time to
time I freed the object before using it.
----- Original Message -----
From: “Martinez, Juan (Cons)”
To: “Kernel Debugging Interest List”
Sent: Monday, June 17, 2002 4:33 PM
Subject: [windbg] RE: UNEXPECTED_KERNEL_MODE_TRAP
Alexey,
Open with the UI, Debug Tab select Event Filters and set them to output
one by one.
Also use verbose mode Ctrl+Alt+V
And please read the help file.
Thanks,
Juan
__________________________________________________
This is just my personal opinion.
No warrantees of any kind are explicit or implied.
-----Original Message-----
From: Alexey Logachyov [mailto:xxxxx@vba.com.by]
Sent: Friday, June 14, 2002 5:28 AM
To: Kernel Debugging Interest List
Subject: [windbg] RE: UNEXPECTED_KERNEL_MODE_TRAP
I’m not experienced in WinDBG. How could I ‘set the all my events filter
to
output’? Enabling only verbose mode does not catch first fault.
----- Original Message -----
From: “Martinez, Juan (Cons)”
To: “Kernel Debugging Interest List”
Sent: Thursday, June 13, 2002 5:02 PM
Subject: [windbg] RE: UNEXPECTED_KERNEL_MODE_TRAP
Alexey,
Ok the !analyze -v is telling you some information.
I suggest do a .reload /f /v and the !analyze -v again as well as the
.tss 28 followed by kb
As per the double fault (Interrupt #8 or #DF) means that that uP
encounter yet another exception while processing the first one.
If you have the WinDbg connected at the time of the faults make sure
that you set the all your events filter to output and set verbose from
the WinDbg UI.
You need to be able to capture that original fault first to start
working on your issue.
Thanks,
Juan
__________________________________
This is just my personal opinion.
No warrantees of any kind are explicit or implied.
-----Original Message-----
From: Alexey Logachyov [mailto:xxxxx@vba.com.by]
Sent: Wednesday, June 12, 2002 8:30 AM
To: Kernel Debugging Interest List
Subject: [windbg] UNEXPECTED_KERNEL_MODE_TRAP
This is the output from WinDBG. I receive this bugcheck pretty
frequently.
What does it mean? How can I find the cause of the problem?
UNEXPECTED_KERNEL_MODE_TRAP (7f)
This means a trap occurred in kernel mode, and it’s a trap of a kind
that the kernel isn’t allowed to have/catch (bound trap) or that
is always instant death (double fault). The first number in the
bugcheck parens is the number of the trap (8 = double fault, etc)
Consult an Intel x86 family manual to learn more about what these
traps are. Here is a portion of those codes:
If kv shows a taskGate
use .tss on the part before the colon, then kv.
Else if kv shows a trapframe
use .trap on that value
Else
.trap on the appropriate frame will show where the trap was taken
(on x86, this will be the ebp that goes with the procedure KiTrap)
Endif
kb will then show the corrected stack.
Arguments:
Arg1: 00000008, EXCEPTION_DOUBLE_FAULT
Arg2: 00000000
Arg3: 00000000
Arg4: 00000000
Debugging Details:
------------------
BUGCHECK_STR: 7f_8
TSS: 00000028 – (.tss 28)
eax=f981aa0c ebx=c0000074 ecx=c0000060 edx=00000000 esi=00000000
edi=00000000
eip=8044005a esp=bffffca8 ebp=c0000044 iopl=0 nv up ei ng nz na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010282
nt!KiDispatchException+25:
8044005a 53 push ebx
Resetting default context
DEFAULT_BUCKET_ID: DRIVER_FAULT
LAST_CONTROL_TRANSFER: from fffff480 to 8044005a
STACK_TEXT:
c0000044 fffff480 fffff480 fffff480 fffff480 nt!KiDispatchException+0x25
fffff480 00000000 00000000 00000000 00000000 0xfffff480
FOLLOWUP_IP:
nt!KiDispatchException+25
8044005a 53 push ebx
FOLLOWUP_NAME: MachineOwner
SYMBOL_NAME: nt!KiDispatchException+25
MODULE_NAME: nt
IMAGE_NAME: ntoskrnl.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 3ad7783f
STACK_COMMAND: .tss 28 ; kb
BUCKET_ID: ZEROED_STACK
Followup: MachineOwner
---------
—
You are currently subscribed to windbg as: martinez@hp.com
To unsubscribe send a blank email to %%email.unsub%%
—
You are currently subscribed to windbg as: xxxxx@vba.com.by
To unsubscribe send a blank email to %%email.unsub%%
—
You are currently subscribed to windbg as: martinez@hp.com
To unsubscribe send a blank email to %%email.unsub%%
—
You are currently subscribed to windbg as: xxxxx@vba.com.by
To unsubscribe send a blank email to %%email.unsub%%