BSOD - DRIVER_VERIFIER_DMA_VIOLATION (e6)

Question

Hello

One of our Lenovo P53 Notebooks threw this bluescreen today, out of nowhere (the user was typing in notepad). It is not reproducable.

Driver verifier is disabled. I have a minidmup and a memorydump, please tell me what's needed. I tried analyzing them using WinDBG preview but could not get to the source of the bluescreen (see bugcheck analysis at the bottom).

According to this website https://askbob.tech/why-am-i-getting-a-stop-e6/ the error means there is an I/O Violation which can occur even with driver verifier disabled.

OS is WIndows 10 2004, all the latest Windows Updates are installed. All drivers are at most 2 weeks old, the device is basically brand new (hardware as well as OS install).

The Notebook is connected to a "Lenovo ThinkPad Thunderbolt 3 Dock Gen 2"

The BSOD cannot be reproduced, but I really need to know what caused it to prevent such a thing in the future.

Ran SFC and DISM and they finished without fixing any errors ,reporting all good.

Any help is greatly appreciated

*******************************************************************************

*                                                                             *

*                        Bugcheck Analysis                                    *

*                                                                             *

*******************************************************************************

DRIVER_VERIFIER_DMA_VIOLATION (e6)

An illegal DMA operation was attempted by a driver being verified.

Arguments:

Arg1: 0000000000000026, IOMMU detected DMA violation.

Arg2: ffffb98bc64790a0, Device Object of faulting device.

Arg3: 00000000000000a0, Faulting information (usually faulting physical address).

Arg4: 0000000000000005, Fault type (hardware specific).

Debugging Details:

---

*** WARNING: Unable to verify timestamp for win32k.sys

KEY_VALUES_STRING: 1

    Key  : Analysis.CPU.mSec

    Value: 5671

    Key  : Analysis.DebugAnalysisProvider.CPP

    Value: Create: 8007007e on myComputer

    Key  : Analysis.DebugData

    Value: CreateObject

    Key  : Analysis.DebugModel

    Value: CreateObject

    Key  : Analysis.Elapsed.mSec

    Value: 11105

    Key  : Analysis.Memory.CommitPeak.Mb

    Value: 80

    Key  : Analysis.System

    Value: CreateObject

    Key  : WER.OS.Branch

    Value: vb_release

    Key  : WER.OS.Timestamp

    Value: 2019-12-06T14:06:00Z

    Key  : WER.OS.Version

    Value: 10.0.19041.1

ADDITIONAL_XML: 1

OS_BUILD_LAYERS: 1

BUGCHECK_CODE:  e6

BUGCHECK_P1: 26

BUGCHECK_P2: ffffb98bc64790a0

BUGCHECK_P3: a0

BUGCHECK_P4: 5

CUSTOMER_CRASH_COUNT:  1

PROCESS_NAME:  System

STACK_TEXT:  

fffff8074369eea8 fffff8073eada6e7     : 00000000000000e6 0000000000000026 ffffb98bc64790a0 00000000000000a0 : nt!KeBugCheckEx

fffff8074369eeb0 fffff8073eac660b     : 0000000000000000 0000000000000000 fffff8073f249c30 fffff8073f249c30 : nt!IvtHandleInterrupt+0x1a7

fffff8074369ef10 fffff8073e880795     : fffff8073f2f3a80 fffff8074368fa50 fffff8073f2f3b30 fffff8074369efc0 : nt!HalpIommuInterruptRoutine+0x4b

fffff8074369ef40 fffff8073e9f581c     : fffff8074368fa50 fffff8073f2f3a80 00000000000001bc fffff8073e9fab90 : nt!KiCallInterruptServiceRoutine+0xa5

fffff8074369ef90 fffff8073e9f5c27     : fffff8074368faf0 0000000000000001 0000000000040046 fffff8073e907018 : nt!KiInterruptSubDispatchNoLock+0x11c

fffff8074368f9d0 fffff8073e9f79ca     : 0000000000000000 fffff8073f326600 ffffb98bc4c7f040 00000000000001bc : nt!KiInterruptDispatchNoLock+0x37

fffff8074368fb60 0000000000000000     : fffff80743690000 fffff80743689000 0000000000000000 0000000000000000 : nt!KiIdleLoop+0x5a

SYMBOL_NAME:  nt!IvtHandleInterrupt+1a7

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

IMAGE_VERSION:  10.0.19041.508

STACK_COMMAND:  .thread ; .cxr ; kb

BUCKET_ID_FUNC_OFFSET:  1a7

FAILURE_BUCKET_ID:  0xE6_nt!IvtHandleInterrupt

OS_VERSION:  10.0.19041.1

BUILDLAB_STR:  vb_release

OSPLATFORM_TYPE:  x64

OSNAME:  Windows 10

FAILURE_ID_HASH:  {2cafa897-b47c-7b20-cee6-b1b68f30ec38}

Followup:     MachineOwner

---

Answer 1

Turns out it was a faulty USB device driver for the connected lenovo thunderbolt 3 dock. We finally solved it by manually uninstalling all devices named "Intel USBeXtensible Host Controller" in the windows device manager and rebooting windows.

How did we find out? Using the windbg command !devobj with the id from "Device Object of faulting device" will give you more information, including "AttachedDevice". This may point to the faulting device, in this case "USBXHCI" which google revealed is the eXtensible Host Controller.Note: The devobj here does not correspond with the one from my initial post (because weirdly we had 2 devices with this exact issue).

0: kd> !devobj ffffc686d37f2060

Device object (ffffc686d37f2060) is for:

NTPNP_PCI0037 \Driver\pci DriverObject ffffc686d36be6c0

Current Irp 00000000 RefCount 0 Type 00000022 Flags 00001040

SecurityDescriptor ffff818e7570ace0 DevExt ffffc686d37f21b0 DevObjExt ffffc686d37f28d8 DevNode ffffc686d37f29a0

ExtensionFlags (0x00000800)  DOE_DEFAULT_SD_PRESENT

Characteristics (0x00000100)  FILE_DEVICE_SECURE_OPEN

AttachedDevice (Upper) ffffc686d7c3e520 \Driver\USBXHCI

Device queue is not busy.

Answer 2

Had the blue screen come up as I was trying to back up camera cards on a film shoot I was on. The client provided OWC Thunderblade drives which I connected to my Razer Blade TB3 port. The computer just kept crashing and the drives were no longer readable. Almost lost a whole days shoot worth of data, it was extremely stressful and embarrassing in front of the client. I won't be surprised if they don't hire me again.

Luckily I had a few Lacie Rugged disks in my bag and could provide them the data at the end of the day but it too 4 hours longer than it should. 

Done with Microsoft, Windows Pro and all it's associated bloatware is not fit for professional use. Customer service is non existant. 

Here's the big middle finger to you Microsoft. Get your **** together!

Answer 3

I can give you the whole solution straight up and down but it must be applied via Microsoft Deployment Toolkit or Microsoft System Center Configuration Manager and this solution is completely customized only for companies

it's probably true what you say but there are things you still need to do because this does not seem to work

out-out the box

Lenovo has not updated SCCM package for Windows 10 for (Version 2009) ThinkPad P53

Lenovo has not updated SCCM package for Windows 10 for (Version 2009) ThinkPad P53s

SCCM package for Windows 10 (Version 1709, 1803, 1809, 1903, 1909, 2004 2009) - ThinkPad P53

SCCM package for Windows 10 (Version 1709, 1803, 1809, 1903, 1909, 2004 2009) - ThinkPad P53s

but guess it's about the models

Thinkpad P53 20QN 20QQ

Thinkpad P53S 20N6 20N7

but can give different examples of exactly how it is intended as I understand it all to be applied

Warning Message: 

Please keep the notebook in normal working status during FW updating, avoid being turned to power off or other sleep mode.

Please make sure Dock would not unplug from notebook during FW upgrading.

Please make sure the USB device and display content on dock monitor has been saved before execute.

Notes: 

1. Recommend to remove monitor which connected on Down-stream Type C port.
2. Ensure to install system graphics driver prior to dock FW update.
3. Recommend to remove power adapter and plug in again after FW upgrade completed

(In general, power adapter plug/unplug is not required, just for trouble shooting purpose)

4. Recommend to attach only one external monitor for FW update

Answer 4

Hi,

I'm Independent Advisor not Microsoft employee or support person. But I'm in contact with Windows developers since 1995 - as a one of the best Windows beta-testers till 2009 when program was closed, as an MVP in 2005-2017 including Windows System & Performance nomination. So I have deep enough Windows knowledge and you may trust me. It's a pleasure for me to help others and I'll do all my best to help you.

See parameters' description at https://docs.microsoft.com/en-us/windows-hardwa... and analyse situation or share memory dump to OneDrive for analysis.

https://answers.microsoft.com/en-us/windows/for...

Answer 5

Same issue here after upgrade to 1909.

0: kd> !devobj ffffc10cec3c5060
ffffc10cec3c5060: Could not read device object or _DEVICE_OBJECT not found
0: kd> !devobj ffff97865c6a3060
Device object (ffff97865c6a3060) is for:
 NTPNP_PCI0034 \Driver\pci DriverObject ffff97865b0c76c0
Current Irp 00000000 RefCount 0 Type 00000022 Flags 00001040
SecurityDescriptor ffffac8a44729de0 DevExt ffff97865c6a31b0 DevObjExt ffff97865c6a38a8 DevNode ffff97865c6a39a0 
ExtensionFlags (0x00000804)  DOE_REMOVE_PENDING, DOE_DEFAULT_SD_PRESENT
Characteristics (0x00000100)  FILE_DEVICE_SECURE_OPEN
AttachedDevice (Upper) ffff97865c531c40 \Driver\USBXHCI
Device queue is not busy.