G
Guest
Hey,
I am annoyed by the random bluescreen on Windows XP-SP2 when I plug in a
RNDIS device, I am using the Dell D610 laptop. Sometimes, it is pretty good
and there is no any issue of using the device. Here is the windbg analysis of
the dump file when system is crashed.
==========================================================
Loading Dump File [D:\Mini111506-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: set
_NT_SYMBOL_PATH=srv*D:\WINDOWSSymbols\Download*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp2_gdr.050301-1519
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055a420
Debug session time: Wed Nov 15 10:46:27.418 2006 (GMT+8)
System Uptime: 0 days 1:00:26.813
Loading Kernel Symbols
...............................................................................................................................................................................................
Loading User Symbols
Loading unloaded module list
.......................................
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck C2, {7, cd4, 21e0004, 85e444e8}
Unable to load image eacfilt.sys, Win32 error 2
*** WARNING: Unable to verify timestamp for eacfilt.sys
*** ERROR: Module load completed but symbols could not be loaded for
eacfilt.sys
Probably caused by : eacfilt.sys ( eacfilt+bc6 )
Followup: MachineOwner
---------
kd> !analyze -v
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************
BAD_POOL_CALLER (c2)
The current thread is making a bad pool request. Typically this is at a bad
IRQL level or double freeing the same allocation, etc.
Arguments:
Arg1: 00000007, Attempt to free pool which was already freed
Arg2: 00000cd4, (reserved)
Arg3: 021e0004, Memory contents of the pool block
Arg4: 85e444e8, Address of the block of pool being deallocated
Debugging Details:
------------------
POOL_ADDRESS: 85e444e8
FREED_POOL_TAG: aPmI
BUGCHECK_STR: 0xc2_7_aPmI
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: DRIVER_FAULT
PROCESS_NAME: System
LAST_CONTROL_TRANSFER: from 8054b741 to 8053331e
STACK_TEXT:
f7c8bb98 8054b741 000000c2 00000007 00000cd4 nt!KeBugCheckEx+0x1b
f7c8bbe8 f74c360f 85e444e8 00000000 f7c8bc2c nt!ExFreePoolWithTag+0x2be
f7c8bbf8 f7d0cbc6 85e444e8 00000084 00000000 NDIS!NdisFreeMemory+0x3b
WARNING: Stack unwind information not available. Following frames may be
wrong.
f7c8bc2c f74c9fe4 00000000 f7c8bc54 863ae42c eacfilt+0xbc6
f7c8bcc8 f74cc63d 806ed0b8 856f2680 804e4a15 NDIS!ndisInitializeBinding+0x189
f7c8bd50 f74cc6d6 85875098 80561440 86d6c020
NDIS!ndisCheckAdapterBindings+0x13a
f7c8bd64 f74c8bfe 85875090 006f2680 f7c8bdac
NDIS!ndisQueuedCheckAdapterBindings+0x83
f7c8bd74 804e426b 85875090 00000000 86d6c020 NDIS!ndisWorkItemHandler+0xe
f7c8bdac 8057be15 85875090 00000000 00000000 nt!ExpWorkerThread+0x100
f7c8bddc 804fa4da 804e4196 80000000 00000000 nt!PspSystemThreadStartup+0x34
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16
STACK_COMMAND: kb
FOLLOWUP_IP:
eacfilt+bc6
f7d0cbc6 ?? ???
SYMBOL_STACK_INDEX: 3
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: eacfilt
IMAGE_NAME: eacfilt.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 3da72b4e
SYMBOL_NAME: eacfilt+bc6
FAILURE_BUCKET_ID: 0xc2_7_aPmI_eacfilt+bc6
BUCKET_ID: 0xc2_7_aPmI_eacfilt+bc6
Followup: MachineOwner
---------
kd> lmvm eacfilt
start end module name
f7d0c000 f7d0e000 eacfilt T (no symbols)
Loaded symbol image file: eacfilt.sys
Image path: eacfilt.sys
Image name: eacfilt.sys
Timestamp: Sat Oct 12 03:49:34 2002 (3DA72B4E)
CheckSum: 0000DCA2
ImageSize: 00002000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
kd> k
ChildEBP RetAddr
f7c8bb98 8054b741 nt!KeBugCheckEx+0x1b
f7c8bbe8 f74c360f nt!ExFreePoolWithTag+0x2be
f7c8bbf8 f7d0cbc6 NDIS!NdisFreeMemory+0x3b
WARNING: Stack unwind information not available. Following frames may be
wrong.
f7c8bc2c f74c9fe4 eacfilt+0xbc6
f7c8bcc8 f74cc63d NDIS!ndisInitializeBinding+0x189
f7c8bd50 f74cc6d6 NDIS!ndisCheckAdapterBindings+0x13a
f7c8bd64 f74c8bfe NDIS!ndisQueuedCheckAdapterBindings+0x83
f7c8bd74 804e426b NDIS!ndisWorkItemHandler+0xe
f7c8bdac 8057be15 nt!ExpWorkerThread+0x100
f7c8bddc 804fa4da nt!PspSystemThreadStartup+0x34
00000000 00000000 nt!KiThreadStartup+0x16
=============================================================
I checked the file c:\windows\system32\drivers\eacfilt.sys, here is the
detailed info of that file:
Version:4.60.0.0
Description NDIS Filter Intermediate Driver
Size: 9,049bytes
this is the in-box file with XP-SP2, so it SHOULD be ok , but from above
result, it is not the case .
My question is: where can I get the latest version of eacfilt.sys, with bug
fix, if there is. I can not get one from www.nortel.com somehow.
Thanks a lot.
I am annoyed by the random bluescreen on Windows XP-SP2 when I plug in a
RNDIS device, I am using the Dell D610 laptop. Sometimes, it is pretty good
and there is no any issue of using the device. Here is the windbg analysis of
the dump file when system is crashed.
==========================================================
Loading Dump File [D:\Mini111506-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: set
_NT_SYMBOL_PATH=srv*D:\WINDOWSSymbols\Download*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows XP Kernel Version 2600 (Service Pack 2) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp2_gdr.050301-1519
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055a420
Debug session time: Wed Nov 15 10:46:27.418 2006 (GMT+8)
System Uptime: 0 days 1:00:26.813
Loading Kernel Symbols
...............................................................................................................................................................................................
Loading User Symbols
Loading unloaded module list
.......................................
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck C2, {7, cd4, 21e0004, 85e444e8}
Unable to load image eacfilt.sys, Win32 error 2
*** WARNING: Unable to verify timestamp for eacfilt.sys
*** ERROR: Module load completed but symbols could not be loaded for
eacfilt.sys
Probably caused by : eacfilt.sys ( eacfilt+bc6 )
Followup: MachineOwner
---------
kd> !analyze -v
*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************
BAD_POOL_CALLER (c2)
The current thread is making a bad pool request. Typically this is at a bad
IRQL level or double freeing the same allocation, etc.
Arguments:
Arg1: 00000007, Attempt to free pool which was already freed
Arg2: 00000cd4, (reserved)
Arg3: 021e0004, Memory contents of the pool block
Arg4: 85e444e8, Address of the block of pool being deallocated
Debugging Details:
------------------
POOL_ADDRESS: 85e444e8
FREED_POOL_TAG: aPmI
BUGCHECK_STR: 0xc2_7_aPmI
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: DRIVER_FAULT
PROCESS_NAME: System
LAST_CONTROL_TRANSFER: from 8054b741 to 8053331e
STACK_TEXT:
f7c8bb98 8054b741 000000c2 00000007 00000cd4 nt!KeBugCheckEx+0x1b
f7c8bbe8 f74c360f 85e444e8 00000000 f7c8bc2c nt!ExFreePoolWithTag+0x2be
f7c8bbf8 f7d0cbc6 85e444e8 00000084 00000000 NDIS!NdisFreeMemory+0x3b
WARNING: Stack unwind information not available. Following frames may be
wrong.
f7c8bc2c f74c9fe4 00000000 f7c8bc54 863ae42c eacfilt+0xbc6
f7c8bcc8 f74cc63d 806ed0b8 856f2680 804e4a15 NDIS!ndisInitializeBinding+0x189
f7c8bd50 f74cc6d6 85875098 80561440 86d6c020
NDIS!ndisCheckAdapterBindings+0x13a
f7c8bd64 f74c8bfe 85875090 006f2680 f7c8bdac
NDIS!ndisQueuedCheckAdapterBindings+0x83
f7c8bd74 804e426b 85875090 00000000 86d6c020 NDIS!ndisWorkItemHandler+0xe
f7c8bdac 8057be15 85875090 00000000 00000000 nt!ExpWorkerThread+0x100
f7c8bddc 804fa4da 804e4196 80000000 00000000 nt!PspSystemThreadStartup+0x34
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16
STACK_COMMAND: kb
FOLLOWUP_IP:
eacfilt+bc6
f7d0cbc6 ?? ???
SYMBOL_STACK_INDEX: 3
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: eacfilt
IMAGE_NAME: eacfilt.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 3da72b4e
SYMBOL_NAME: eacfilt+bc6
FAILURE_BUCKET_ID: 0xc2_7_aPmI_eacfilt+bc6
BUCKET_ID: 0xc2_7_aPmI_eacfilt+bc6
Followup: MachineOwner
---------
kd> lmvm eacfilt
start end module name
f7d0c000 f7d0e000 eacfilt T (no symbols)
Loaded symbol image file: eacfilt.sys
Image path: eacfilt.sys
Image name: eacfilt.sys
Timestamp: Sat Oct 12 03:49:34 2002 (3DA72B4E)
CheckSum: 0000DCA2
ImageSize: 00002000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
kd> k
ChildEBP RetAddr
f7c8bb98 8054b741 nt!KeBugCheckEx+0x1b
f7c8bbe8 f74c360f nt!ExFreePoolWithTag+0x2be
f7c8bbf8 f7d0cbc6 NDIS!NdisFreeMemory+0x3b
WARNING: Stack unwind information not available. Following frames may be
wrong.
f7c8bc2c f74c9fe4 eacfilt+0xbc6
f7c8bcc8 f74cc63d NDIS!ndisInitializeBinding+0x189
f7c8bd50 f74cc6d6 NDIS!ndisCheckAdapterBindings+0x13a
f7c8bd64 f74c8bfe NDIS!ndisQueuedCheckAdapterBindings+0x83
f7c8bd74 804e426b NDIS!ndisWorkItemHandler+0xe
f7c8bdac 8057be15 nt!ExpWorkerThread+0x100
f7c8bddc 804fa4da nt!PspSystemThreadStartup+0x34
00000000 00000000 nt!KiThreadStartup+0x16
=============================================================
I checked the file c:\windows\system32\drivers\eacfilt.sys, here is the
detailed info of that file:
Version:4.60.0.0
Description NDIS Filter Intermediate Driver
Size: 9,049bytes
this is the in-box file with XP-SP2, so it SHOULD be ok , but from above
result, it is not the case .
My question is: where can I get the latest version of eacfilt.sys, with bug
fix, if there is. I can not get one from www.nortel.com somehow.
Thanks a lot.