Sudden Blue screens (0x7A, 0x7B) - please help

[Guest]

Hi,

I have a problem with blue screens and I have no more ideas what I can do,
I'm really at my wits' end. Maybe one of you can help me to out of this hell.

The blue-screens...
* always occour after windows is running
* are in most of cases 0x7A's or 0x7B's, somtimes 0x77's
* time periods reaches from once per day up to sporadic
* in most cases the system works fine for a while after a reboot
(in rare cases systems 've gone down completely)

I already tried to:
* swap HDDs and cabling
* reinstall the clone
* re-create the image with QFE-updated database (new image with SP2
currently under testing)
* viewed half the www to find more help (with no success, of course)

Additional information:
* We also use Windows XP Pro (MUI too) and never had as hard problems as
with XPe, the hardware is the same
* In paste, we thought it's better to use NTFS than FAT32 since EWF is used
(seems it hasn't unendorsed) and switched the FS
* EWF aggravates the debugging since I can't acces the data in the overlay
if the system won't boot any more

Does anybody know the reason of this bluescreens or does anyone have some
useful tips how to came closer to the cause of the problems?

Thanks in before.

P.S: Here are some of the messages:

STOP:0x0000007A ( 0xC000000E, 0x8057ADA4, 0x03E0C860 )
STOP:0x0000007A (0xC02015F4, 0x00000000E, 0x8057D032, 0x05E2C860)
STOP:0x0000007A (0xC020189C, 0xC0000000E, 0x805675C6, 0x00221860)
STOP:0x00000077 (0x000000E,0x000000E,0x00000000,0x00720000)

regarding Status codes: I scanned half the www for this status codes but I
couldn't find at least one of them.

 

[Brad Combs]

Here are some links to information about the errors...

http://www.microsoft.com/resources/...Windows/XP/all/reskit/en-us/prmd_stp_fvlq.asp

http://support.microsoft.com/kb/130801

Based on these two articles I would try two things....

1) If you have the ability to do so, swap your IDE controller drivers with
the Standard IDE/ESDI Hard Disk Controller component. This is the same IDE
driver that the Minlogon Macro uses and it works on alot of systems. I would
also try to go back to the previous version of driver for your controller if
your using the latest. If your not using the latest go and get it.

2) If you have no pagefile in your system (since you have EWF I'm assuming
not) then try removing EWF and add a pagefile. (If you have the available
disk space)

HTH,
Brad

 

[Guest]

Hello Brad,

thanks for your reply.
Regarding the links, I've already read them, but they didn't brought me
closer to a solution (I think the possible reasons are too "common").

Regarding Tip 1 I have to look into the SLX-File. I used TAP to gather the
HW-informations, and I just remember that there was a "Disk drive" component.

Regarding Tip 2: Yes, I have a pagefile (managed by system). It sounds that
I should not use a pagefile when EWF is enabled??? If so, is there an
explanation why?

However, once more, have much thanks!

BR XPeApplicator@BE

 

[KM]

Regarding Tip 2: Yes, I have a pagefile (managed by system). It sounds that

I should not use a pagefile when EWF is enabled??? If so, is there an
explanation why?

You should NOT use pagefile on EWF protected volume.
Although there are some uncertainties on how the page fault are getting written to disk when EWF enabled but it has been proved that
EWF does affect pagefile writes.
With EWF enabled you either move your pagefile to an unprotected volume or get rid of it completely (review your system
requirements, it may be unnecessary to have the pagefile support on your target).

If you want to know more tech.details on the pagefile/EWF, please read some related threads:
http://groups-beta.google.com/group...blic.windowsxp.embedded&q=EWF+pagefile&qt_g=1

 

[Guest]

Hello,

I have a assumption that moving the pagefile out of the protected volume
could be the solution I'm looking for. It seems that I've oversight the EWF
design rule "pagefile should be stored in a non-protected volume", I found
this also in the MSDN.

I tried to disable the pagefiles (using the System control Panel) and I also
ensured that "HKLM\System\CurrentControlSet\Session Manager\Memory
Management\PagingFiles" is empty, and I also deleted the file pagefile.sys
and ensured that it doesn't return after a reboot.

But when I look into the "Performance"-tab of the target-manager there still
a "PF usage" is reported. What at all I've done wrong?

 

[KM]

Did you commit the changes (deleting the pagefile and cleaning up its settings in registry) with EWF and then reboot?

 

[Guest]

Yes, I did. With other words: I disabled EWF before reconfiguring the
pagefile. However, in TD the info under pagefile-size tells me that always
some data will be paged. Let's return to bluescreens again.

I'm looking for some debugging strategies how to find out why or what BSODs
the computer. This raised some new questions:

* I was informed that it is nearly impossible to debug if there is no
memory-dump-file. When I enabled the dump-file I revieved errors in
EventViewer - this was since I forget to add the component (with other words:
I didn't know that this requires an extra component; the same theatre as with
safe mode). But:

- KB-articles tell that a page-file must be in boot-volume in order to make
dump-files, but otherwise I should not use a pagefile on boot-volume if EWF
is used (?). Is there still a chance to get a memory-dump in case of BSOD?
- is it possible to add the missing component(s) to a target? If yes, how?
- how can I test if the memory-dump is created (with other words: how to
produce a blue-screen)

* EWF: I've seen that some of the devices have much data in the overlay. Is
it possible that windows BSODs if the overlay is full? We commited all data
before we send the computers to the customers, after a few months the
overlay-usage is up to 2GB (from 4GB). Should customers commit data from time
to time??

 

[KM]

Yes, I did. With other words: I disabled EWF before reconfiguring the

pagefile. However, in TD the info under pagefile-size tells me that always
some data will be paged. Let's return to bluescreens again.

TD? Why do you mention TD her? Don't you change and commit the pagefile support at run time?

I'm looking for some debugging strategies how to find out why or what BSODs
the computer. This raised some new questions:

* I was informed that it is nearly impossible to debug if there is no memory-dump-file.

+ KD (Kernel Debugger)

When I enabled the dump-file I revieved errors in
EventViewer - this was since I forget to add the component (with other words:
I didn't know that this requires an extra component; the same theatre as with
safe mode). But:

- KB-articles tell that a page-file must be in boot-volume in order to make
dump-files, but otherwise I should not use a pagefile on boot-volume if EWF is used (?).

Well.. You don't want the pagefile on the boot (protected) volume on production. But for testing purposes you can probably have it
there. At least to turn on the memory dumps.
I don't know whether and how this is going to work for you. :-(

Is there still a chance to get a memory-dump in case of BSOD?
- is it possible to add the missing component(s) to a target? If yes, how?

Add "Disk Dump Drivers" and "Save Dump" components.
Also, follow the registry settings for memory dump from here: http://support.microsoft.com/default.aspx?scid=kb;en-us;254649
But make sure to specefy the actual path to memory dump (don't use %System...%).

- how can I test if the memory-dump is created (with other words: how to
produce a blue-screen)

If you add [HKLM\SYSTEM\CurrentControlSet\Services\i8042prt\Parameters],"CrashOnCtrlScroll"=dword:1 registry value, you will be able
to generate a memory dump file by holding down the right CTRL key and pressing the SCROLL LOCK key twice:
http://support.microsoft.com/kb/244139

This thread may also be helpful to you:
http://groups-beta.google.com/group...80e56ab1fcb/dfd77fbf8603eb3a#dfd77fbf8603eb3a

* EWF: I've seen that some of the devices have much data in the overlay. Is
it possible that windows BSODs if the overlay is full? We commited all data

Well.. With RAM EWF the overlay will be limitted by the memory available to EWF.
With DISK EWF - by the free space on disk.
In either case you (or your customers) will likely be seeing the Dalyed Write Error messages first.

before we send the computers to the customers, after a few months the
overlay-usage is up to 2GB (from 4GB).

Wow.. Why such huge overlay usage? You should investigate this first.
Probably you did not disable evertyhing that may [should] be disabled to lower the EWF overlay usage.
Use tips from this page http://msdn.microsoft.com/embedded/community/community/tips/xp/ramewf/default.aspx

Should customers commit data from time to time??

You are using CF, therefore you don't want to commit to it often.

 

[Guest]

TD? Why do you mention TD her? Don't you change and commit the pagefile support at run time?

XPeApplicator: Of course, I made the changes at the run-time. I just
remembered that there was something written in the pagefile settings when I
created ca new image a few days before.

+ KD (Kernel Debugger)

XPeApplicator: I already heard from KD. I first have to get experienced with.

Well.. You don't want the pagefile on the boot (protected) volume on production. But for testing purposes you can probably have it
there. At least to turn on the memory dumps.
I don't know whether and how this is going to work for you. :-(

XPeApplicator: I would do anything that might blow that BSODs to hell!!!

Add "Disk Dump Drivers" and "Save Dump" components.
Also, follow the registry settings for memory dump from here: http://support.microsoft.com/default.aspx?scid=kb;en-us;254649
But make sure to specefy the actual path to memory dump (don't use %System...%).

XPeApplicator: This is for TD, is it? I want to add it at the run-time, is
there a chance?

- how can I test if the memory-dump is created (with other words: how to
produce a blue-screen)

If you add [HKLM\SYSTEM\CurrentControlSet\Services\i8042prt\Parameters],"CrashOnCtrlScroll"=dword:1 registry value, you will be able
to generate a memory dump file by holding down the right CTRL key and pressing the SCROLL LOCK key twice:
http://support.microsoft.com/kb/244139

XPeApplicator: Cool!

This thread may also be helpful to you:
http://groups-beta.google.com/group...80e56ab1fcb/dfd77fbf8603eb3a#dfd77fbf8603eb3a

XPeApplicator: Thanks, I'll read it, I'm thankful for every tip.

* EWF: I've seen that some of the devices have much data in the overlay. Is
it possible that windows BSODs if the overlay is full? We commited all data

Well.. With RAM EWF the overlay will be limitted by the memory available to EWF.
With DISK EWF - by the free space on disk.
In either case you (or your customers) will likely be seeing the Dalyed Write Error messages first.

before we send the computers to the customers, after a few months the
overlay-usage is up to 2GB (from 4GB).

Wow.. Why such huge overlay usage? You should investigate this first.
Probably you did not disable evertyhing that may [should] be disabled to lower the EWF overlay usage.
Use tips from this page http://msdn.microsoft.com/embedded/community/community/tips/xp/ramewf/default.aspx

XPeApplicator: Hm, I was teached to dim the overlay as big as the protected
volume. Why? I don't know.
I only learned from others.

Besides: Where does your good knowledge come from? I'm looking for some good
courses - but all I found were basic courses that teach much less than I
already know.

 

[KM]

XPEApplicator,

XPeApplicator: I already heard from KD. I first have to get experienced with.
XPeApplicator: This is for TD, is it? I want to add it at the run-time, is
there a chance?

Well.. all the registry settings you can add in TD (use your own component or TD COnfiguration Extra Registry section).

But the CrashControl settings can also be edited in the "Computer Prototype" component Registry section.

* EWF: I've seen that some of the devices have much data in the overlay. Is
it possible that windows BSODs if the overlay is full? We commited all data

Well.. With RAM EWF the overlay will be limitted by the memory available to EWF.
With DISK EWF - by the free space on disk.
In either case you (or your customers) will likely be seeing the Dalyed Write Error messages first.

before we send the computers to the customers, after a few months the
overlay-usage is up to 2GB (from 4GB).

Wow.. Why such huge overlay usage? You should investigate this first.
Probably you did not disable evertyhing that may [should] be disabled to lower the EWF overlay usage.
Use tips from this page http://msdn.microsoft.com/embedded/community/community/tips/xp/ramewf/default.aspx

XPeApplicator: Hm, I was teached to dim the overlay as big as the protected volume. Why? I don't know.
I only learned from others.

Your should learn from Product documentaiton first as it is somtimes more reliable source.
This especially applies to new EWF documentaion in SP2.

Besides: Where does your good knowledge come from?

From this NG
http://groups-beta.google.com/group/microsoft.public.windowsxp.embedded?hl=en&lr=&ie=UTF-8

I'm looking for some good courses - but all I found were basic courses that teach much less than I already know.

http://www.bsquare.com/training_support/windowsxpe.asp

--
Regards,
KM, BSquare Corp.