此问题已向微软公司反馈,仅供学习参考
这是微软内核的一个Bug.发生在内核函数 MmEnumerateAddressSpaceAndReferenceImages 和 MiCreateEnclave之间,如果时机不当会造成这两个函数之间死锁,而且还是一个pushlock死锁问题,十分罕见,这也是导致系统开机黑屏,系统突然卡死的元凶之一。Win10被骂了很久了,这次真的被我遇上了,系统无缘无故卡死了。抓了个dump分析了一番,以下是分析结论。
A Funciton is MiCreateEnclave,B Funciton is MmEnumerateAddressSpaceAndReferenceImages
This is my ntkrnlmp Version
0:000> !lmi ntkrnlmp
Loaded Module Info: [ntkrnlmp]
Module: ntkrnlmp
Base Address: 0000000140000000
Image Name: ntkrnlmp.exe
Machine Type: 34404 (X64)
Time Stamp: 59dc593b Mon Oct 9 22:23:07 2017
Size: 8d2000
CheckSum: 83d03d
Characteristics: 22
Debug Data Dirs: Type Size VA Pointer
CODEVIEW 25, 2d7230, 2d5830 RSDS - GUID: {69655CA1-59E3-4511-BF7B-EB82660886E3}
Age: 1, Pdb: ntkrnlmp.pdb
POGO d84, 2d7258, 2d5858 [Data not mapped]
Image Type: FILE - Image read successfully from debugger.
ntkrnlmp.exe
Symbol Type: PDB - Symbols loaded successfully from image path.
e:\myserversymbols\ntkrnlmp.pdb\69655CA159E34511BF7BEB82660886E31\ntkrnlmp.pdb
Load Report: public symbols , not source indexed
e:\myserversymbols\ntkrnlmp.pdb\69655CA159E34511BF7BEB82660886E31\ntkrnlmp.pdb
首先我们看下Func B