Windows® Internals, Sixth Edition, Part 2

Power management A device driver or an operating system function running in kernel mode is in an inconsistent or invalid power state. Most frequently, some component has failed to complete a power management I/O request operation within the default period of 10 minutes. The common stop code is:

0x9F - DRIVER_POWER_STATE_FAILURE

Exceptions and traps A device driver or an operating system function running in kernel mode incurs an unexpected exception or trap. The common stop codes are:

0x1E - KMODE_EXCEPTION_NOT_HANDLED

0x3B - SYSTEM_SERVICE_EXCEPTION

0x7E - SYSTEM_THREAD_EXCEPTION_NOT_HANDLED

0x7F - UNEXPECTED_KERNEL_MODE_TRAP

0x8E - KERNEL_MODE_EXCEPTION_NOT_HANDLED with P1 != 0xC0000005 STATUS_ACCESS_VIOLATION

Access violations A device driver or an operating system function running in kernel mode incurs a memory access violation, which is caused either by attempting to write to a read-only page or by attempting to read an address that isn’t currently mapped and therefore is not a valid memory location. The common stop codes are:

0x50 - PAGE_FAULT_IN_NONPAGED_AREA

0x8E - KERNEL_MODE_EXCEPTION_NOT_HANDLED with P1 = 0xC0000005 STATUS_ACCESS_VIOLATION

Display The display device driver detects that it can no longer control the graphics processing unit. This indicates that an attempt to reset the display driver failed. The common stop code is:

0x116 - VIDEO_TDR_FAILURE

Pool The kernel pool manager detects a corrupt pool header or an improper pool reference. The common stop codes are:

0x19 - BAD_POOL_HEADER

0xC2 - BAD_POOL_CALLER

0xC5 - DRIVER_CORRUPTED_EXPOOL

Memory management The kernel memory manager detects a corruption of memory management data structures or an improper memory management request. The common stop codes are:

0x1A - MEMORY_MANAGEMENT

0x4E - PFN_LIST_CORRUPT

Hardware A hardware error, such as a machine check or a nonmaskable interrupt (NMI), occurs. This category also includes disk failures when the memory manager is attempting to read data to satisfy page faults. The common stop codes are:

0x7A - KERNEL_DATA_INPAGE_ERROR

0x124 - WHEA_UNCORRECTABLE_ERROR

USB An unrecoverable error occurs in a universal serial bus operation. The common stop code is:

0xFE - BUGCODE_USB_DRIVER

Critical object A fatal error occurs in a critical object without which Windows cannot continue to run. The common stop code is:

0xF4 - CRITICAL_OBJECT_TERMINATION

NTFS file system A fatal error is detected by the NTFS file system. The common stop code is:

0x24 - NTFS_FILE_SYSTEM

Figure 14-2 shows the distribution of these categories for Windows 7 and Windows 7 SP1 in May 2012:

Figure 14-2. Distribution of top 20 stop codes by category for Windows 7 and Windows 7 SP1 in May 2012.

Troubleshooting Crashes

You often begin seeing blue screens after you install a new software product or piece of hardware. If you’ve just added a driver, rebooted, and gotten a blue screen early in system initialization, you can reset the machine, press the F8 key when instructed, and then select Last Known Good Configuration. Enabling last known good causes Windows to revert to a copy of the registry’s device driver registration key (HKLM\SYSTEM\CurrentControlSet\Services) from the last successful boot (before you installed the driver). From the perspective of last known good, a successful boot is one in which all services and drivers have finished loading and at least one logon has succeeded. (Last known good is further described in Chapter 13.)

During the reboot after a crash, the Boot Manager (Bootmgr) will automatically detect that Windows did not shut down properly and display a Windows Error Recovery message similar to the one shown in Figure 14-3. This screen gives you the option to attempt booting into safe mode so that you can disable or uninstall the software component that might be broken.

Figure 14-3. An example of a Windows Error Recovery message

If you keep getting blue screens, an obvious approach is to uninstall the components you added just before the first blue screen appeared. If some time has passed since you added something new or you added several things at about the same time, you need to note the names of the device drivers referenced in any of the parameters. If you recognize any of the names as being related to something you just added (such as Storport.sys if you installed a new SCSI drive), you’ve possibly found your culprit.