Work_Thread_Returned_At_Bad_IRQL

[Lotus 0]

This is my error message during my everyday memory dumps. (Starting since SP3)

 

I finally had time to write it down.

 

STOP: 0x000000E1 Work_Thread_Returned_At_Bad_IRQL

 

Address 80421FB0 base at 80400000

 

Datestamp: 3ee6c002 - ntoskrnl.exe

 

 

 

Does the error message mean anything to anyone? It was the reason I asked about multiple devices sharing IRQ's.

[sapiens74 0]

http://msdn.microsoft.com/library/default.asp?url=/library/en-us/ddtools/hh/ddtools/bccodes_6zvr.asp

 

this explains how to fix it

[Lotus 0]

I can't get the LN command to work in debug. Am I missing something here?

[sapiens74 0]

whats the command you are using?

[Lotus 0]

I downloaded the debugging tools from microsoft, but have never done a debug before. I typed in

 

 

 

kd> ln "Address"

 

 

It says use positive decimal value

[Lotus 0]

How do I trace the address to the driver? I can't figure this one out.

[Lotus 0]

*bump* =)

 

I need to track this problem down!

[DS3Circuit 0]

Seems to be a hardware / driver issue. All drivers been updated to the latest?

 

This has helped me before with INTEL NIC drivers.

http://is-it-true.org/nt/atips/atips300.shtml

[Lotus 0]

Will dumpchk.exe for Win NT 4.0 work with 2000 Pro? If not is there a dumpchk.exe for Win2k? I don't see it listed on the Win2k Resource Kit download page.

[DS3Circuit 0]

Few more helpful links

 

How to Use Dumpchk.exe to Check a Memory Dump File

http://support.microsoft.com/default.aspx?scid=kb;en-us;Q156280

 

Gathering Blue Screen Information After Memory Dump in Windows 2000 or Windows NT

http://support.microsoft.com/default.aspx?scid=kb;en-us;Q192463

 

Download Pstat here

Pstat.exe: Process and Thread Status

http://www.microsoft.com/windows2000/techinfo/reskit/tools/existing/pstat-o.asp

 

Dumpchk.exe is part of the windows 2000 support tools found on your CD of windows 2000. Keep in my other required files include Kdextx86.dll and Msdis110.dll

 

Anything else I can help ya with?

[Lotus 0]

Thanks

[Lotus 0]

Well, I'm having no luck. It says it can't initialize the dump file. Is there another way to trace the address to a driver?

[Lotus 0]

The file is a mini dump file...does that make a diff?

[Lotus 0]

Is there a switch I should be using with dumpchk.exe? This is really annoying. I keep losing work do to the comp going blue screen on me. Any additional advice would be greatly appreciated.

[CUViper 0]

You will need to set it to at least a kernel dump, and preferably a complete dump. Look for it in the System Properties -> Advanced tab...

[Lotus 0]

Ok, I need to get this thread going again. The problem is getting worse and worse. I opened up Windows Debugger and then opened my memory.dmp file. Below is what was listed after opening:

 

 

Thread Create: Process=0, Thread=0

DMKD: Unable to get address of debugger data list

Module Load: D:\WINNT\system32\NTOSKRNL.EXE (no symbols loaded)

Could not get address of KiProcessorBlock

Module Unload: D:\WINNT\system32\NTOSKRNL.EXE

Module Load: D:\WINNT\system32\NTOSKRNL.EXE (no symbols loaded)

Module Load: HALACPI.DLL (no symbols loaded)

Module Load: D:\WINNT\system32\BOOTVID.DLL (symbol loading deferred)

Module Load: ACPI.SYS (symbol loading deferred)

Module Load: WMILIB.SYS (symbol loading deferred)

Module Load: PCI.SYS (symbol loading deferred)

Module Load: ISAPNP.SYS (symbol loading deferred)

Module Load: COMPBATT.SYS (symbol loading deferred)

Module Load: BATTC.SYS (symbol loading deferred)

Module Load: INTELIDE.SYS (symbol loading deferred)

Module Load: PCIIDEX.SYS (symbol loading deferred)

Module Load: FTDISK.SYS (symbol loading deferred)

Module Load: DISKPERF.SYS (symbol loading deferred)

Module Load: DMLOAD.SYS (symbol loading deferred)

Module Load: DMIO.SYS (symbol loading deferred)

Module Load: PARTMGR.SYS (symbol loading deferred)

Module Load: MOUNTMGR.SYS (symbol loading deferred)

Module Load: ATAPI.SYS (symbol loading deferred)

Module Load: DISK.SYS (symbol loading deferred)

Module Load: CLASSPNP.SYS (symbol loading deferred)

Module Load: FASTFAT.SYS (symbol loading deferred)

Module Load: KSECDD.SYS (symbol loading deferred)

Module Load: DNBUDF.SYS (symbol loading deferred)

Module Load: NDIS.SYS (symbol loading deferred)

Module Load: MUP.SYS (symbol loading deferred)

Module Load: IOMDISK.SYS (symbol loading deferred)

Module Load: VIDEOPRT.SYS (symbol loading deferred)

Module Load: I81XNT5.SYS (symbol loading deferred)

Module Load: USBD.SYS (symbol loading deferred)

Module Load: UHCD.SYS (symbol loading deferred)

Module Load: OUSBEHCI.SYS (symbol loading deferred)

Module Load: KS.SYS (symbol loading deferred)

Module Load: PORTCLS.SYS (symbol loading deferred)

Module Load: SBPCI.SYS (symbol loading deferred)

Module Load: EL90XBC5.SYS (symbol loading deferred)

Module Load: I8042PRT.SYS (symbol loading deferred)

Module Load: MOUCLASS.SYS (symbol loading deferred)

Module Load: KBDCLASS.SYS (symbol loading deferred)

Module Load: FDC.SYS (symbol loading deferred)

Module Load: SERIAL.SYS (symbol loading deferred)

Module Load: SERENUM.SYS (symbol loading deferred)

Module Load: PARPORT.SYS (symbol loading deferred)

Module Load: CDR4_2K.SYS (symbol loading deferred)

Module Load: CDROM.SYS (symbol loading deferred)

Module Load: CDRALW2K.SYS (symbol loading deferred)

Module Load: AUDSTUB.SYS (symbol loading deferred)

Module Load: RASL2TP.SYS (symbol loading deferred)

Module Load: NDISTAPI.SYS (symbol loading deferred)

Module Load: NDISWAN.SYS (symbol loading deferred)

Module Load: TDI.SYS (symbol loading deferred)

Module Load: RASPPTP.SYS (symbol loading deferred)

Module Load: PTILINK.SYS (symbol loading deferred)

Module Load: RASPTI.SYS (symbol loading deferred)

Module Load: PARALLEL.SYS (symbol loading deferred)

Module Load: SWENUM.SYS (symbol loading deferred)

Module Load: UPDATE.SYS (symbol loading deferred)

Module Load: USBHUB.SYS (symbol loading deferred)

Module Load: D:\WINNT\system32\OUSB2HUB.SYS (symbol loading deferred)

Module Load: FLPYDISK.SYS (symbol loading deferred)

Module Load: NDPROXY.SYS (symbol loading deferred)

Module Load: USBSTOR.SYS (symbol loading deferred)

Module Load: USBPRINT.SYS (symbol loading deferred)

Module Load: USBSCAN.SYS (symbol loading deferred)

Module Load: HIDPARSE.SYS (symbol loading deferred)

Module Load: HIDCLASS.SYS (symbol loading deferred)

Module Load: HIDUSB.SYS (symbol loading deferred)

Module Load: FS_REC.SYS (symbol loading deferred)

Module Load: NULL.SYS (symbol loading deferred)

Module Load: BEEP.SYS (symbol loading deferred)

Module Load: VGA.SYS (symbol loading deferred)

Module Load: MNMDD.SYS (symbol loading deferred)

Module Load: MSFS.SYS (symbol loading deferred)

Module Load: NPFS.SYS (symbol loading deferred)

Module Load: RASACD.SYS (symbol loading deferred)

Module Load: TCPIP.SYS (symbol loading deferred)

Module Load: MSGPC.SYS (symbol loading deferred)

Module Load: WANARP.SYS (symbol loading deferred)

Module Load: NETBT.SYS (symbol loading deferred)

Module Load: NETBIOS.SYS (symbol loading deferred)

Module Load: RDBSS.SYS (symbol loading deferred)

Module Load: MRXSMB.SYS (symbol loading deferred)

Module Load: NTFS.SYS (symbol loading deferred)

Module Load: EFS.SYS (symbol loading deferred)

Module Load: DUMP_WMILIB.SYS (symbol loading deferred)

Module Load: DUMP_ATAPI.SYS (symbol loading deferred)

Module Load: D:\WINNT\system32\WIN32K.SYS (symbol loading deferred)

Module Load: VCHNT5.DLL (symbol loading deferred)

Module Load: CH7XXNT5.DLL (symbol loading deferred)

Module Load: SIINT5.DLL (symbol loading deferred)

Module Load: ATV01NT5.DLL (symbol loading deferred)

Module Load: ADV01NT5.DLL (symbol loading deferred)

Module Load: ATV02NT5.DLL (symbol loading deferred)

Module Load: ADV02NT5.DLL (symbol loading deferred)

Module Load: ATV04NT5.DLL (symbol loading deferred)

Module Load: ADV05NT5.DLL (symbol loading deferred)

Module Load: ATV06NT5.DLL (symbol loading deferred)

Module Load: ADV07NT5.DLL (symbol loading deferred)

Module Load: ADV08NT5.DLL (symbol loading deferred)

Module Load: ADV09NT5.DLL (symbol loading deferred)

Module Load: ATV10NT5.DLL (symbol loading deferred)

Module Load: ADV11NT5.DLL (symbol loading deferred)

Module Load: D:\WINNT\system32\I81XDNT5.DLL (symbol loading deferred)

Module Load: SYMTDI.SYS (symbol loading deferred)

Module Load: NETPROBE.SYS (symbol loading deferred)

Module Load: AFD.SYS (symbol loading deferred)

Module Load: WDMAUD.SYS (symbol loading deferred)

Module Load: SYSAUDIO.SYS (symbol loading deferred)

Module Load: PARVDM.SYS (symbol loading deferred)

Module Load: FIPS.SYS (symbol loading deferred)

Module Load: SRV.SYS (symbol loading deferred)

cannot complete modload 0000ff50

Could not get address of KiProcessorBlock

Finished re-loading kernel modules

Kernel Debugger connection established for D:\WINNT\MEMORY.DMP

Kernel Version 2195 Free loaded @ ffffffff80400000

Bugcheck 000000e1 : 80421fb0 00000002 fcb40a68 fcb40a68

Stopped at an unexpected exception: code=80000003 addr=ffffffff804191fa

Hard coded breakpoint hit

>

 

 

 

 

Can anyone make sense of this? I am very new to debugging. I am still going to try and play around with this. But anyone with debugging experience would really be helpful.

 

I just tried an LN command like so:

 

> ln 80421FB0

 

and it said no symbols found. Going to try and find some symbols heh. Thought I downloaded them a month ago, but maybe I am mistaken. Any help is appreciated.

[Lotus 0]

Ok some good news I guess. I downloaded the new debugging tools and it works much better. Have it set to download the sybols I need on demand. This is what I got when debugging the dmp file:

 

*******************************************************************************

* *

* Bugcheck Analysis *

* *

*******************************************************************************

 

WORKER_THREAD_RETURNED_AT_BAD_IRQL (e1)

Arguments:

Arg1: 80421fb0, address of worker routine (do ln on this to find guilty driver)

Arg2: 00000002, IRQL returned at (should have been 0, but isn't).

Arg3: fcb40a68, workitem parameter

Arg4: fcb40a68, workitem address

 

Debugging Details:

------------------

 

 

FAULTING_IP:

nt+21fb0

80421fb0 8b442404 mov eax,[esp+0x4]

 

DEFAULT_BUCKET_ID: DRIVER_FAULT

 

BUGCHECK_STR: 0xE1

 

LAST_CONTROL_TRANSFER: from 80455a16 to 804191fa

 

STACK_TEXT:

WARNING: Stack unwind information not available. Following frames may be wrong.

f0833da8 80455a16 fcb40a68 00000000 00000000 nt+0x191fa

f0833ddc 80469bb2 804190f0 00000000 00000000 nt+0x55a16

00000000 00000000 00000000 00000000 00000000 nt+0x69bb2

 

 

FOLLOWUP_IP:

nt+21fb0

80421fb0 8b442404 mov eax,[esp+0x4]

 

FOLLOWUP_NAME: MachineOwner

 

SYMBOL_NAME: nt+21fb0

 

MODULE_NAME: nt

 

IMAGE_NAME:

 

DEBUG_FLR_IMAGE_TIMESTAMP: 3ee6c002

 

STACK_COMMAND: kb

 

BUCKET_ID: 0xE1_nt+21fb0

 

Followup: MachineOwner

---------

 

kd> ln 80421fb0

 

As you can see it said to find the guilty driver do an "ln" command. Which I did and it came up with nothing. I don't know where to go from here...