[ros-kernel] Q2 Bug (210 in bugzilla) Fix or bigger bug?

[Hartmut Birr]

Hi,

I think that the stack trace is ok. At the end of the read request there
is called IoReadWriteCompletion which copies the status to a user
buffer. This buffer is paged out and triggers a pagin operation which
results in a second call into vfat. IoReadWriteCompletion is called from
an apc (see the old debug message from vfat). Your system freez because
it is in a low memory situation. Currently ros can't handle low memory
situations. It runs in a deadlock where one user page is switched
between two threads over a page in/out operations. 

- Hartmut

> (misc.c:135) Vfat is entered at irql = 1
> Bug detected (code 29a param 0 0 0 0)    <---- I putted this 
> in order to
> get the stack trace because I'm inside a driver
>   No message text found!
> Pid: 9 <quake2> Thrd: c13d7988 Tid: 30
> Frames: <ntoskrnl.exe: 971b> KeBugCheck ( I did this :) )
> <vfatfs: b326>        VfatBuildRequest        <----------
> <ntoskrnl.exe: 30417> IofCallDriver                      |
> <ntoskrnl.exe: 3133c> IoPageRead                         |
> <ntoskrnl.exe: 45b43> MmReadFromSwapPage                 |
> <ntoskrnl.exe: 5306b> MmNotPresentFaultVirtualMemory     |
> <ntoskrnl.exe: 43084> MmNotPresentFault                  | 
> <ntoskrnl.exe: 7d2d>  ExAllocatePagedPoolWithTag         |
 
ExAllocatePagedPoolWithTag ? Should be MmPageFault.

> <ntoskrnl.exe: 1df1>  KiTrapHandler                      |---- Hmmm 2
> times?!
> <ntoskrnl.exe: 3031>  KiTrapProlog                       |
> <ntoskrnl.exe: 5bc1>  MmSafeCopyToUserUnsafeStart        |
> <ntoskrnl.exe: 2a997> IoSecondStageCompletion            |     
> <ntoskrnl.exe: 3082c> IofCompleteRequest                 |
> <ntoskrnl.exe: 3085c> IoCompleteRequest                  |
> <vfatfs: 9eac>        VfatRead                           |
> <vfatfs: b2cd>        VfatBuildRequest        <----------
> <ntoskrnl.exe: 30417> IofCallDriver
> <ntoskrnl.exe: 3042d> IoCallDriver
> <ntoskrnl.exe: 35acd> NtReadFile
> <ntoskrnl.exe: 32ac>  new_serviceInRange
> When it is copied to the Buffer in the paged pool the IRQL is 
> still the
> same! And seems there was a page not present in memory while the file
> was being loaded. This got to be a bug. Any Ideas where is 
> this bug?