Question BSOD Memory Management: When shutting down or restarting the computer (Help to understand MEMORY.DMP)

[Darkle]

Hello everyone! I'm new here, hopefully someone can help with this. I've been crazy about a problem with my PC for a few months now but because of work I've barely been able to find the time to look into it until a few weeks ago. The error is as follows, ALWAYS when I turn off or restart the computer I get a memory management BSOD, it doesn't fail for a single day.

Probably at this point you think it is a RAM problem, I would say for sure it is not, at least at hardware level, I have done different RAM tests for hours and hours without errors and in my day to day I use the 16GB at 100% of its capacity with really heavy programs and I have never received a BSOD in those moments of stress, Drivers? everything is up to date.

After enough desperation I decided to do a completely clean install and I'm not talking about a soft format, I completely wiped the hard drives with a removable drive with a Linux Live and after that I did the install, extremely long process but no problems that same day when I shut down the computer, surprise surprise the <Mod Edit> BSOD.

At this point I had no idea what to do, a friend who works with Windows Servers recommended me to install WinDbg as he told me is what is used to discover the specific reason for crashes, I have done it and here I have the results of my MEMORY.DMP:

Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\tomas\Desktop\MEMORY.DMP]
Kernel Bitmap Dump File: Kernel address space is available, User address space may not be available.

Symbol search path is: srv*
Executable search path is:
Windows 10 Kernel Version 19041 MP (12 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 19041.1.amd64fre.vb_release.191206-1406
Machine Name:
Kernel base = 0xfffff80110200000 PsLoadedModuleList = 0xfffff80110e2a390
Debug session time: Fri Feb 19 05:47:13.306 2021 (UTC + 1:00)
System Uptime: 0 days 8:24:20.001
Loading Kernel Symbols
...............................................................
..................Page 2840d7 not present in the dump file. Type ".hh dbgerr004" for details
..............................................
.....................................Page 294fac not present in the dump file. Type ".hh dbgerr004" for details
...........................
..............
Loading User Symbols
PEB is paged out (Peb.Ldr = 0000000165497018). Type ".hh dbgerr001" for details
Loading unloaded module list
..............................
For analysis of this file, run !analyze -v
9: kd> !analyze -v
*******************************************************************************
[LIST]
[*]*
[*]Bugcheck Analysis *
[*]*
[/LIST]
*******************************************************************************

MEMORY_MANAGEMENT (1a)
# Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000018011544, The subtype of the bugcheck.
Arg2: fffffc4000bed8f8
Arg3: ffffffffc000001d
Arg4: 0000000000000000

Debugging Details:
------------------


KEY_VALUES_STRING: 1

Key : Analysis.CPU.Sec
Value: 9

Key : Analysis.DebugAnalysisProvider.CPP
Value: Create: 8007007e on DELL

Key : Analysis.DebugData
Value: CreateObject

Key : Analysis.DebugModel
Value: CreateObject

Key : Analysis.Elapsed.Sec
Value: 27

Key : Analysis.Memory.CommitPeak.Mb
Value: 90

Key : Analysis.System
Value: CreateObject


BUGCHECK_CODE: 1a

BUGCHECK_P1: 18011544

BUGCHECK_P2: fffffc4000bed8f8

BUGCHECK_P3: ffffffffc000001d

BUGCHECK_P4: 0

PROCESS_NAME: aesm_service.exe

STACK_TEXT:
ffff96081422f8f8 fffff80110bacf46 : 000000000000001a 0000000018011544 fffffc4000bed8f8 ffffffffc000001d : nt!KeBugCheckEx
ffff96081422f900 fffff80110bace01 : ffffffffffffffff ffffe106901eb8e0 ffffe106901eb958 ffffe10692581040 : nt!MiDeleteEnclavePages+0xb6
ffff96081422f940 fffff80110bac1c1 : 0000000000000000 fffff80110bad290 fffff80110e50fd0 ffff96080d94f960 : nt!MiDeleteAllHardwareEnclaves+0x111
ffff96081422f9c0 fffff80110bac4c3 : ffffe10692581040 fffff80110bad290 ffffe1066be97ce0 0000000000000000 : nt!MiShutdownSystem+0xd9
ffff96081422fa00 fffff80110bad49d : ffffe10692581040 fffff80110bad290 ffffe1066be97ce0 0000000000000000 : nt!MmShutdownSystem+0x13
ffff96081422fa30 fffff80110425975 : ffffe10692581040 fffff8011052a520 ffffe1066be97ce0 ffffe10600000000 : nt!PopGracefulShutdown+0x20d
ffff96081422fa70 fffff80110517e25 : ffffe10692581040 0000000000000080 ffffe1066be9c040 0000000000000000 : nt!ExpWorkerThread+0x105
ffff96081422fb10 fffff801105fd0d8 : ffff80017aa44180 ffffe10692581040 fffff80110517dd0 0000000000000246 : nt!PspSystemThreadStartup+0x55
ffff96081422fb60 0000000000000000 : ffff960814230000 ffff960814229000 0000000000000000 00000000`00000000 : nt!KiStartSystemThread+0x28
SYMBOL_NAME: nt!MiDeleteEnclavePages+b6

MODULE_NAME: nt

STACK_COMMAND: .thread ; .cxr ; kb

IMAGE_NAME: memory_corruption

BUCKET_ID_FUNC_OFFSET: b6

FAILURE_BUCKET_ID: 0x1a_18011544_nt!MiDeleteEnclavePages

OS_VERSION: 10.0.19041.1

BUILDLAB_STR: vb_release

OSPLATFORM_TYPE: x64

OSNAME: Windows 10

FAILURE_ID_HASH: {70ee176e-1781-c320-228f-bb9b4e5e5b08}

Followup: MachineOwner
---------

I honestly have no idea what it says, but according to what I have read there could be the culprit and therefore the solution.

Thank you for your attention, sorry for so much text (I have summarized it a lot) but I'm fed up with the problem, too many hours lost...

 

[Colif]

Can you follow option one on the following link - here - and then do this step below: Small memory dumps - Have Windows Create a Small Memory Dump (Minidump) on BSOD - that creates a file in c windows/minidump after the next BSOD

Open Windows File Explorer

Navigate to C:\Windows\Minidump

Copy the mini-dump files out onto your Desktop

Do not use Winzip, use the built in facility in Windows

Select those files on your Desktop, right click them and choose 'Send to' - Compressed (zipped) folder

Upload the zip file to the Cloud (OneDrive, DropBox . . . etc.)

Then post a link here to the zip file, so we can take a look for you . . .

 

[Darkle]

Can you follow option one on the following link - here - and then do this step below: Small memory dumps - Have Windows Create a Small Memory Dump (Minidump) on BSOD - that creates a file in c windows/minidump after the next BSOD

Open Windows File Explorer

Navigate to C:\Windows\Minidump

Copy the mini-dump files out onto your Desktop

Do not use Winzip, use the built in facility in Windows

Select those files on your Desktop, right click them and choose 'Send to' - Compressed (zipped) folder

Upload the zip file to the Cloud (OneDrive, DropBox . . . etc.)

Then post a link here to the zip file, so we can take a look for you . . .

Thank you for your answer, here is the link to Google Drive

Inside there are 2 minidumps from today (in case it's more useful than just one)

 

[gardenman]

Hi, I ran the dump files through the debugger and got the following information: https://jsfiddle.net/dbf0n795/show This link is for anyone wanting to help. You do not have to view it. It is safe to "run the fiddle" as the page asks.

Spoiler: Dump File Results

File information:	021921-18437-01.dmp (Feb 19 2021 - 16:38:57)
Bugcheck:	MEMORY_MANAGEMENT (1A)
Probably caused by:	memory_corruption (Process: aesm_service.exe)
Uptime:	0 Day(s), 7 Hour(s), 21 Min(s), and 52 Sec(s)

File information:	021921-18375-01.dmp (Feb 18 2021 - 23:47:13)
Bugcheck:	MEMORY_MANAGEMENT (1A)
Probably caused by:	memory_corruption (Process: aesm_service.exe)
Uptime:	0 Day(s), 8 Hour(s), 24 Min(s), and 20 Sec(s)

BIOS info was not included in the dump files. This can sometimes mean an outdated BIOS is being used. Tip: Updating your BIOS can be risky. Never try it when you might lose power (lightning storms, recent power outages, etc).

This information can be used by others to help you. Someone else will post with more information. Please wait for additional answers. Good luck.

 

[Darkle]

Yes the BIOS update has been very important to me, in fact while I have been experiencing the problem I have done two BIOS updates the last one just a few days ago when Dell released 2.5.1 this February 5th, so with 3 different BIOS versions the problem has been experienced in the same way.

Would it be useful to upload the large MEMORY.DMP file to Google Drive too?

 

[gardenman]

Memory.dmp's are useful only if some of our other regulars happen to pop in and see this thread (which is very unlikely). For me, a 4GB file takes about 4 hours to download, and the memory.dmp files are usually corrupt therefore I waste 4 hours for pretty much nothing. So I probably won't download it.

So for now, let's hold off on the memory.dmp unless another member requests it.

 

[Colif]

Intel® SGX Application Enclave Services Manager is what crashed, I was just curious
SGX = https://en.wikipedia.org/wiki/Software_Guard_Extensions
They allow user-level as well as operating system code to define private regions of memory, called enclaves, whose contents are protected and unable to be either read or saved by any process outside the enclave itself, including processes running at higher privilege levels.[1][2]
https://inst.eecs.berkeley.edu/~cs261/fa18/slides/Hardware_Enclaves.pdf

both crashes happened after deletion of enclave pages. I hadn't ever heard of them until now. so I don't know what process SGX is part of
It might be part of Intel Management Engine Interface and if you updating bios, it helps to have a new version of it that matches.

What model dell is this?

 

[Darkle]

Dell Inspiron 5680, configuration:

Motherboard: Dell 0PXWHK
CPU: Intel Core i7 8700
GPU: Nvidia GTX 1060 6GB
RAM: DDR4 (2x8GB)16GB

It seems complicated... so it could be due to an update of Intel SGX or Intel Management Engine Interface?

 

[Colif]

Have you run the updater? https://www.dell.com/support/home/en-au/product-support/product/inspiron-5680-gaming-desktop/drivers

there is a new version of Intel management Engine interface dated 12 Nov marked urgent on that site.

I would think SGX is part of IMEI, SGX is built into the CPU and its likely controlled by IMEI

 

[Darkle]

Yes, everything is up to date. I also passed the Dell SupportAssist error test and it didn't fix it either, I really appreciate your help but I'm completely blank with this problem, I don't know what to do after ruling out hardware problems, updates and formatting, as a user I can't think of anything. It's really weird.

 

[Colif]

hmmm, i could be on wrong tangent, it wouldn't be the first time

try running this and see if it offers anything new - https://www.intel.com.au/content/www/au/en/support/intel-driver-support-assistant.html

if you get any more errors, please give us the dumps.

 

[Darkle]

All in order regarding the Intel Driver Support Assistant, no new updates. Here are two new minidumps in Google Drive. I hope they are helpful, I did some research and found this problem on GitHub I installed the trial version that supposedly fixed the bug and it didn't fix it either so we can rule out problems between Intel SGX and Intel Hamx as well.

 

[gardenman]

I ran the dump files through the debugger and got the following information: https://jsfiddle.net/ncjgve6d/show This link is for anyone wanting to help. You do not have to view it. It is safe to "run the fiddle" as the page asks.

Spoiler: Dump File Results

File information:	022021-9203-01.dmp (Feb 19 2021 - 23:57:26)
Bugcheck:	MEMORY_MANAGEMENT (1A)
Probably caused by:	memory_corruption (Process: aesm_service.exe)
Uptime:	0 Day(s), 7 Hour(s), 01 Min(s), and 42 Sec(s)

File information:	022021-8968-01.dmp (Feb 20 2021 - 13:19:02)
Bugcheck:	MEMORY_MANAGEMENT (1A)
Probably caused by:	memory_corruption (Process: aesm_service.exe)
Uptime:	0 Day(s), 3 Hour(s), 37 Min(s), and 54 Sec(s)

This information can be used by others to help you. Someone else will post with more information. Please wait for additional answers. Good luck.

 

[Colif]

they both happened at shutdown?

Its consistent, its same as the last 2

do you have a fingerprint scanner?
https://github.com/intel/haxm/issues/55

The tip we got from the other Intel team is that, HAXM has probably done something that causes SGX to be disabled. Then, any attempt to use SGX without first making sure it's enabled will fail. Because only the Windows kernel can run SGX instructions (EDIT: in fact a few SGX instructions are not privileged and thus can be used by applications), such a failure will result in a kernel bug check, i.e. BSOD (EDIT: in case an application executes an SGX instruction when SGX is disabled, the application will crash).

We have identified the HAXM code that interferes with SGX. Basically, a bug in load_guest_msr() can accidentally clear the IA32_MC0_CTL MSR, which in turn will disable SGX until the next system reboot (cf. Intel SDM Vol. 3D 42.15.2).

Above is from the link you found.

Intel's Hardware Accelerated Execution Manager (HAXM). HAXM is a virtualization engine for computers running Intel CPUs.

https://docs.microsoft.com/en-us/xamarin/android/get-started/installation/android-emulator/hardware-acceleration?pivots=windows

I don't feel like I am getting closer to an answer here, just less sure whats happening. Could be a Dell problem

 

[Darkle]

If I'm not mistaken, one of them happened when I rebooted and the other one when I turned it off at night. The truth is that I completely forgot a detail that I don't know if it is really relevant but I find it curious, I forgot it because I am so used to it that it almost seems normal when it is definitely not, this happens to me since the failure started a long time ago.

When I turn off the computer and the BSOD happens the computer doesn't really turn off, at least the motherboard is still receiving power, my mouse that has a light stays on, external hard drives also, the ethernet port has its light on.... Otherwise apparently it stays off, I am not able to hear the hard drives so I would say for sure they are off as well as the fans. It's a weird thing that has never happened to me before with a BSOD...

No, I don't have a fingerprint scanner definitely forget that link, I don't think it has anything to do with it as after a good look I never had HAMX installed so it doesn't make sense.

You say the minidumps are exactly the same as the previous ones, so again Intel SGX is the culprit? Is there a possibility to disable Intel SGX, if it can be done it should stop the error?

I really don't know if it is possible and if Intel SGX is necessary for the computer to work.

 

[Colif]

idea 1: Try turning fast startup off, I am not sure if it will help but I am curious - https://www.tenforums.com/tutorials/4189-turn-off-fast-startup-windows-10-a.html

if it doesn't help...


aesm_service.exe is the program crashing, knowing what drivers or other files were associated with it might give some clues

Idea 2: hmm, if its running auto then we should be able to see it
Download Process explorer and run it as admin (it comes from Microsoft so its safe)

now this program is just a super powered task manager. it shows way more info, I normally use it to find memory problems. This page shows what all the colours and headings mean, link at bottom of it shows how to use it to find problems

I am only using this to see if you can find aesm_service.exe running. I think default view is tree, if you click on the Process header it sorts the columns alphabetically by name,

• find aesm_service,
• highlight it by selecting it
• and then click Process header again to put it back in tree view,

This will show anything running underneath the application (although if its anything like chrome, it may not help as it just shows itself running underneath). If it shows anything other than itself, the name of the files might help.

If you do find it, right click the program and choose properties
on the image tab, what is the path so we at least know where it is on PC


Idea 3: Try a clean boot and see if it changes anything - make sure to read instructions and make sure NOT to disable any Microsoft services or windows won't load right - https://support.microsoft.com/en-au/help/929135/how-to-perform-a-clean-boot-in-windows

if clean boot fixes it, it shows its likely a startup program. You should, over a number of startups. restart the programs you stopped to isolate the one that is to blame.

Since it happens at shutdown, it has to be a program running all the time that is the cause. Because of way fast startup works, it actually effects shutdown as well. So it might help.



I am not sure what SGX is part of, HAXIM might not be involved

SGX seems to tie into whether or not you can run a certain Blue ray disks as well.
It seem IMEI is involved but Microsoft told him to remove SGX and use a newer version but we don't even know what runs it.

https://answers.microsoft.com/en-us/windows/forum/all/windows-10-intel-sgx-aesm-platform-services/042da655-7a38-4fc3-8a57-bdc96103ee61

unrelated but What is this for?

Sep 09 2005

ssgdio64.sys

ATI Diagnostics Hardware Abstraction System driver