Monday, December 12, 2011

Troubleshooting 0x77 KERNEL_STACK_INPAGE_ERROR

The Debugging Tools for Windows are required to analyze crash dump files. If you do not have the Debugging Tools for Windows installed or dump files are not being generated on system crash, see this post for installation/configuration instructions:
http://mikemstech.blogspot.com/2011/11/windows-crash-dump-analysis.html

0x00000077, KERNEL_STACK_INPAGE_ERROR, is a similar bug check to KERNEL_DATA_INPAGE_ERROR. This error indicates that the memory manager could not read a page back into memory from disk. The two main causes of this bug check are failing hardware (hard drive and RAM are primary suspects) and viruses. Information obtained from the minidump is relatively straightforward from the !analyze -v.

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

KERNEL_STACK_INPAGE_ERROR (77)
The requested page of kernel data could not be read in.  Caused by
bad block in paging file or disk controller error.
In the case when the first arguments is 0 or 1, the stack signature
in the kernel stack was not found.  Again, bad hardware.
An I/O status of c000009c (STATUS_DEVICE_DATA_ERROR) or
C000016AL (STATUS_DISK_OPERATION_FAILED)  normally indicates
the data could not be read from the disk due to a bad
block.  Upon reboot autocheck will run and attempt to map out the bad
sector.  If the status is C0000185 (STATUS_IO_DEVICE_ERROR) and the paging
file is on a SCSI disk device, then the cabling and termination should be
checked.  See the knowledge base article on SCSI termination.
Arguments:
Arg1: 0000000000000000, (page was retrieved from page cache)
Arg2: 8013801280128013, value found in stack where signature should be
Arg3: 0000000000000000, 0
Arg4: fffff880147f8f90, address of signature on kernel stack

Debugging Details:
------------------


ERROR_CODE: (NTSTATUS) 0 - STATUS_WAIT_0

BUGCHECK_STR:  0x77_0

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  System

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from fffff80002d57773 to fffff80002cd2600

STACK_TEXT: 
... : nt!KeBugCheckEx
... : nt! ?? ::FNODOBFM::`string'+0x4e3b1
... : nt!MmInPageKernelStack+0x40
... : nt!KiInSwapKernelStacks+0x1f
... : nt!KeSwapProcessOrStack+0x84
... : nt!PspSystemThreadStartup+0x5a
... : nt!KxStartSystemThread+0x16


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt! ?? ::FNODOBFM::`string'+4e3b1
fffff800`02d57773 cc              int     3

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt! ?? ::FNODOBFM::`string'+4e3b1

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4b88cfeb

FAILURE_BUCKET_ID:  X64_0x77_0_nt!_??_::FNODOBFM::_string_+4e3b1

BUCKET_ID:  X64_0x77_0_nt!_??_::FNODOBFM::_string_+4e3b1

Followup: MachineOwner
---------
 
 
If this error is seen, next steps are to check the hard drive and memory for errors and perform a virus scan if neither the hard drive nor RAM report any errors.

See Also
Windows Crash Dump Analysis
Troubleshooting Memory Errors
How To Detect a Failing Hard Drive

No comments:

Post a Comment