Go on Microsoft.com and look at how to use the symbol server. Microsoft
has created an environment for us that will automatically load symbols
across the web that match your operating system. WINDBG can be setup
with a symbol path that uses the symbol server (see below). This is
very nice, particularly when you are installing service packs and such.
Here is the link:
http://www.microsoft.com/whdc/ddk/debugging/symbols.mspx
Example symbol path that gets Microsoft symbols from the symbol server
and local symbols (for you driver and stuff) from c:\symbols\sys.
c:\symbols;srv*c:\websymbols*Symbol information
As Tony states, you do need to learn about debugging kernel mode
components. This isn't like falling off a log - but it isn't rocket
science either. Learn how to setup your debugging environment and
things will become easier. It always take a little time to get setup -
but it is a MUST.
-----Original Message-----
From: Tony Mason [mailto:xxxxx@osr.com]
Sent: Thursday, July 17, 2003 11:22 AM
To: File Systems Developers
Subject: [ntfsd] Re: Page Fault during IoPageRead
OK. This one takes the cake. Does the following error mean ANYTHING to
you:
***** Kernel symbols are WRONG. Please fix symbols to do analysis.
We really do try to help people out on this list, but it is very
difficult
when they won't try to do any of the work themselves.
FIX YOUR SYMBOLS. This is so clearly documented that you should not
have a
problem doing so. Once you have done this, you will find a valid stack
and
information for debugging.
Regards,
Tony
Tony Mason
Consulting Partner
OSR Open Systems Resources, Inc.
-----Original Message-----
From: Nagaraja M.L [mailto:xxxxx@integramicro.com]
Sent: Thursday, July 17, 2003 10:57 AM
To: File Systems Developers
Subject: [ntfsd] Re: Page Fault during IoPageRead
Hi Nick Ryan,
I tried debugging using WinDbg. Following is the dump what i got when i
used
!analyze command
************************************************* WinDbg Start
************************************************************************
**
Microsoft (R) Windows Debugger Version 6.0.0017.0
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\WINDOWS\GSL1.dmp]
Kernel Dump File: Full address space is available
Symbol search path is: c:\windows\debug\symbols
Executable search path is:
*** ERROR: Symbol file could not be found. Defaulted to export symbols
for
ntoskrnl.exe - Windows XP Kernel Version 2600 (Service Pack 1) UP Free
x86
compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp1.020828-1920
Kernel base = 0x804d6000 PsLoadedModuleList = 0x8054de30
Debug session time: Thu Jul 17 08:13:47 2003
System Uptime: 0 days 0:01:25.718
*** ERROR: Symbol file could not be found. Defaulted to export symbols
for
ntoskrnl.exe - Loading Kernel Symbols
........................................................................
....
...............................
Loading unloaded module list
............
Loading User Symbols
************************************************************************
****
***
*
*
* Bugcheck Analysis
*
*
*
************************************************************************
****
***
Use !analyze -v to get detailed debugging information.
BugCheck A, {0, 2, 0, 804f33ac}
***** Kernel symbols are WRONG. Please fix symbols to do analysis.
Probably caused by : ntoskrnl.exe ( nt!IoPageRead+4e8 )
Followup: MachineOwner
kd> !analyze -v
************************************************************************
****
***
*
*
* Bugcheck Analysis
*
*
*
************************************************************************
****
***
IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pagable (or completely invalid) address
at
an interrupt request level (IRQL) that is too high. This is usually
caused
by drivers using improper addresses. If a kernel debugger is available
get
the stack backtrace.
Arguments:
Arg1: 00000000, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000000, value 0 = read operation, 1 = write operation
Arg4: 804f33ac, address which referenced memory
Debugging Details:
***** Kernel symbols are WRONG. Please fix symbols to do analysis.
READ_ADDRESS: unable to get nt!MmPoolCodeEnd
unable to get nt!MmSpecialPoolEnd
unable to get nt!MmPagedPoolEnd
unable to get nt!MmNonPagedPoolEnd
unable to get nt!MmNonPagedPoolStart
unable to get nt!MmSpecialPoolStart
unable to get nt!MmPagedPoolStart
unable to get nt!MiSessionPoolStart
unable to get nt!MiSessionPoolEnd
unable to get nt!MmNonPagedPoolExpansionStart
unable to get nt!MmPoolCodeStart
00000000
CURRENT_IRQL: 2
FAULTING_IP:
nt!IoPageRead+4e8
804f33ac 8b00 mov eax,[eax]
DEFAULT_BUCKET_ID: DRIVER_FAULT
BUGCHECK_STR: 0xA
LAST_CONTROL_TRANSFER: from 804dee53 to 805286db
STACK_TEXT:
WARNING: Stack unwind information not available. Following frames may be
wrong. f968fbc8 804dee53 0000000a 00000000 00000002 nt!KeBugCheckEx+0x19
f968fbe4 00000000 e24042d0 ffac68c0 c0040000 nt!Kei386EoiHelper+0x251c
FOLLOWUP_IP:
nt!IoPageRead+4e8
804f33ac 8b00 mov eax,[eax]
FOLLOWUP_NAME: MachineOwner
SYMBOL_NAME: nt!IoPageRead+4e8
MODULE_NAME: nt
IMAGE_NAME: ntoskrnl.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 3d6de35c
STACK_COMMAND: kb
BUCKET_ID: WRONG_SYMBOLS
Followup: MachineOwner
************************************************* WinDbg End
************************************************************************
**
I just guessed paging memory what i'm using may be getting paged out
during
dispatch level, so changed my all paged allocation to nonpaged but i'm
getting the same result.
Can you please tell me whats happening here??
Thanks for the help
Sincerely
ML
----- Original Message -----
From: "Nick Ryan"
To: "File Systems Developers"
Sent: Tuesday, July 15, 2003 11:15 PM
Subject: [ntfsd] Re: Page Fault during IoPageRead
> Your symbols are incorrect. You really need to install WinDbg and give
> us the !analyze -v with the correct symbols (WinDbg can automatically
> download them for you). You don't have to buy a cable and set it up on
> your test machine, you just have to use it on your main machine to
> open the crash dump file. Trust me that you will have an infinitely
> easier time debugging system failures like this with WinDbg.
>
> Nagaraja M.L wrote:
>
> > Hi Nick Ryan ,
> >
> > Thanks for the reply.
> >
> > The OS is Windows Xp and the SP is Service pack1.
> >
> > I used Driver verifier on my driver but still i'm getting the same
> > page fault. I'm checking on checked build.
> >
> > Sincerely
> > ML
> > ----- Original Message -----
> > From: "Nick Ryan"
> > To: "File Systems Developers"
> > Sent: Thursday, July 10, 2003 9:37 PM
> > Subject: [ntfsd] Re: Page Fault during IoPageRead
> >
> >
> >
> >>SoftIce is bad at diagnosing system failures like this. I suggest
> >>you learn WinDbg and how to use the !analyze command (with -v). It
> >>will provide you with far more information.
> >>
> >>It looks like your FSD corrupted the system while processing a
> >>paging I/O read. Run Driver Verifier on your driver. Which OS are
> >>you running (with SP, and it is checked or free)?
> >>
> >>Nagaraja M.L wrote:
> >>
> >>
> >>>Dear All,
> >>>
> >>>I've developed a File system driver which does both read and write
> >>>(on CD media) . While copying large number of files for eg 1000,
> >>>i'm getting a page fault.
> >>>
> >>>Break due to Page Fault (0Eh) Fault = 0000
> >>>
> >>>Stack dump is:
> >>>
> >>>ntoskrnl !IoPageRead + 04E8
> >>>ntoskrnl !CCFlushCache + 03AB
> >>>ntoskrnl !MmSetAddressRangeModified + 028F
> >>>ntoskrnl !KeReadStateSemaphore + 00A5
> >>>ntoskrnl !KeInsertQueue + 00FC
> >>>ntoskrnl !CcUnpinDataForThread + 066D
> >>>ntoskrnl !KeProfileInterruptWithSource + 028E
> >>>
> >>>What does this Page Fault means?? Also how do you know which
> >>>function
of
> >>>your driver causing this to happen.
> >>>As the stack dump does not show any driver function, i''m finding
> >>>it difficult to trace the problem. How do you debug such problems
> >>>using Soft Ice??
> >>>
> >>>Thanks for the help.
> >>>
> >>>Sincerely
> >>>ML
> >>>---
> >>>You are currently subscribed to ntfsd as: xxxxx@nryan.com To
> >>>unsubscribe send a blank email to xxxxx@lists.osr.com
> >>
> >>--
> >>- Nick Ryan (MVP for DDK)
> >>
> >>
> >>
> >>---
> >>You are currently subscribed to ntfsd as:
> >>xxxxx@integramicro.com To unsubscribe send a blank email to
> >>xxxxx@lists.osr.com
> >>
> >
> >
> >
> >
> > ---
> > You are currently subscribed to ntfsd as: xxxxx@nryan.com To
> > unsubscribe send a blank email to xxxxx@lists.osr.com
> >
>
> --
> - Nick Ryan (MVP for DDK)
>
>
>
> ---
> You are currently subscribed to ntfsd as: xxxxx@integramicro.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>
---
You are currently subscribed to ntfsd as: xxxxx@osr.com
To unsubscribe send a blank email to xxxxx@lists.osr.com
---
You are currently subscribed to ntfsd as: xxxxx@exagrid.com
To unsubscribe send a blank email to xxxxx@lists.osr.com