Haxm causes Win10 BSOD when I am putting my computer to sleep

[AradiPatrik]

I read through this issue: #55 and did the suggested fix listed there, but I think in my case something else causes the problem.
Please help.
BSOD info:

Windows 8 Kernel Version 17134 MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 17134.1.amd64fre.rs4_release.180410-1804
Machine Name:
Kernel base = 0xfffff802`9d00d000 PsLoadedModuleList = 0xfffff802`9d3c71f0
Debug session time: Wed Jun 20 11:50:56.893 2018 (UTC - 4:00)
System Uptime: 0 days 0:50:20.716
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

MEMORY_MANAGEMENT (1a)
    # Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000018011544, The subtype of the bugcheck.
Arg2: ffffd0cac004a7f8
Arg3: ffffffffc000001d
Arg4: 0000000000000000

Debugging Details:
------------------

TRIAGER: Could not open triage file : e:\dump_analysis\program\triage\modclass.ini, error 2

BUGCHECK_STR:  0x1a_18011544

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN8_DRIVER_FAULT

PROCESS_NAME:  WUDFHost.exe

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from fffff8029d76d826 to fffff8029d1a5330

STACK_TEXT:  
ffffea0a`ad147498 fffff802`9d76d826 : 00000000`0000001a 00000000`18011544 ffffd0ca`c004a7f8 ffffffff`c000001d : nt!KeBugCheckEx
ffffea0a`ad1474a0 fffff802`9d081be5 : 00000000`000b9c42 00000000`000b9c42 00000000`01d0070a 00000000`00000001 : nt!MiDeleteEnclavePages+0x96
ffffea0a`ad1474e0 fffff802`9d0e5f36 : 00000000`1c6e8fff 00000000`1c6e8000 00000000`00000000 fffff802`9d0ba0ab : nt!MiDeleteVad+0x125
ffffea0a`ad147810 fffff802`9d4cceeb : 00000000`00000000 00000000`00000000 ffffc089`78093110 fffff802`9d0ba4bf : nt!MiFreeVadRange+0x92
ffffea0a`ad147870 fffff802`9d4ccb3b : 00000000`00000000 00000000`00000000 0000006d`2ca7ec30 000001c6`e7335c30 : nt!MmFreeVirtualMemory+0x37b
ffffea0a`ad1479a0 fffff802`9d1b5943 : ffffc089`6a5f2040 000001c6`e7312550 00007ff9`11b9d138 00007ff9`11b9d130 : nt!NtFreeVirtualMemory+0x8b
ffffea0a`ad147a00 00007ff9`17ada274 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
0000006d`2ca7ee58 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x7ff9`17ada274


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!MiDeleteEnclavePages+96
fffff802`9d76d826 cc              int     3

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt!MiDeleteEnclavePages+96

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP:  5b1a4590

IMAGE_NAME:  memory_corruption

FAILURE_BUCKET_ID:  X64_0x1a_18011544_nt!MiDeleteEnclavePages+96

BUCKET_ID:  X64_0x1a_18011544_nt!MiDeleteEnclavePages+96

Followup: MachineOwner
---------

OS: Windows 10 pro,
CPU: Intel i7 8550U @ 1.8GHz
HAXM: 7.2.0
AVD: Nexus 5X API 25, Android 7.1.1 Google Play, CPU/ABI x86 (these are the defaults)
( I am on a dell xps 13 9370 uhd model )
link to my dump file: https://drive.google.com/open?id=1AJYcjimewO_9lkzYR3-SuXp-6ZQUj3Mm
Thank you for your support in advance.

[raphaelning]

Thank you for the report and analysis. It seems to me you have exactly the same issue as #55, because:

a) You have the same CPU model, Intel Core i7-8550U. (In #55 @pacemoan didn't mention their CPU model, but their crash dump shows the same CPUID family, model and stepping. I believe their laptop is Huawei MateBook X Pro.)
b) You have the same Windows version, 1803 (build 17134).
c) The BSOD is identified by the same bugcheck type (1A, MEMORY_MANAGEMENT) and subtype (0000000018011544, a value not even documented on MSDN).
d) The BSOD happens at the same location in the Windows kernel:

FOLLOWUP_IP: 
nt!MiDeleteEnclavePages+96
fffff800`40e06826 cc              int     3

This is a function that makes use of the Intel SGX hardware feature. There must be a device driver that relies on SGX, and although we can't identify it from your crash dump (PROCESS_NAME: WUDFHost.exe is the process that runs on behalf of all user-mode drivers), I'd first try to disable the fingerprint sensor as we did with #55, because I see this in the Dell XPS 13 spec:

The following options and default selections are included with your order.

Backlit English Keyboard w/ Fingerprint Reader
...

[AradiPatrik]

Thank you for the support, I will try the solution mentioned in #55 again, with a full restart, right after work. I thought the issue was different because the PROCESS_NAME was different.

[raphaelning]

You're welcome. Interestingly, a simple Google search reveals a third report of the same issue:

https://answers.microsoft.com/zh-hans/windows/forum/windows_10-hardware/%E5%86%8D%E6%89%93%E5%BC%80android-studio/3cb3328d-8036-4da8-9df7-f5b7d4081af9

The post is in Chinese, but basically the four said points remain valid, except that:

a') The CPU model is Intel Core i7-8750H, which is also an 8th-gen Core.

Now it's pretty clear that the issue is somehow related to HAXM, even though there is no trace of the HAXM driver (intelhaxm.sys) in any of the crash dumps. Either we have a bug in HAXM that gets exposed by the SGX-specific code path in Windows kernel, or the other way round.

We have a Dell Inspiron laptop with Intel Core i7-8550U and Windows 10 Pro v1803, but have never seen this issue. Let me read more about SGX and try to understand why.

[AradiPatrik]

Meanwhile I tried the solution in: #55 again, but the BSOD still persists
I turned off all biometric authentication service, ( I tested them, they are really offline, the facial recognition lights not flickering, fingerprint sensor not working ).
Thank you for the help.

[AradiPatrik]

I am currently in touch with dell support too, because I thought, it might be a hardware problem, although when I ran the hardware tests, they all returned that everything is ok. Do you think, that I should have my laptop replaced, or is this more likely caused by software bugs?

[raphaelning]

I turned off all biometric authentication service

Did you also locate the corresponding devices in Device Manager and disable them? I'd like to know what they are (manufacturer, etc.), so could you post a screenshot of each device you found (see #55 for an example)?

Do you think, that I should have my laptop replaced, or is this more likely caused by software bugs?

I'd always put my bet on software ;-) After all, we were able to work around the same issue (#55) without replacing any hardware. One could argue that we might have disabled a defective fingerprint sensor, but then that defect could still lie in a buggy fingerprint sensor driver. So the possible culprits are:

• HAXM
• SGX-related code in Windows kernel
• Whatever device driver that relies on SGX

It might be more helpful if you reported the issue to Microsoft, because I think they are in the best position to debug it:

1. The immediate cause of the BSOD is a Windows kernel routine. The user process that ultimately calls that kernel routine is also part of Windows (WUDFHost.exe).
2. The bugcheck subtype 0000000018011544 is undocumented. Only Microsoft knows what it means.
3. Even if the root cause is a HAXM bug, I wonder how we can debug it when the crash dump shows no trace of HAXM. Maybe Microsoft could improve the crash dump to reveal the real villain for this bugcheck case?

[AradiPatrik]

Yes!
Disabling the Goodix fingerprint device in the device manager, finally fixed the issue.
Thank you very much for your support.
But it would be really nice if I wouldn't have to do this workaround, so I want to report this issue. Do you know how can I contact Microsoft and Goodix about the issue?

[raphaelning]

That's great! I should also thank you for relieving us of the pressure to debug this issue ;-) It's fair to say the Goodix driver team should look into it first, based on the evidence so far (here and #55, and let's see if the third reporter also finds a Goodix fingerprint sensor on his Dell G7.)

But I wouldn't contact Goodix directly; they will be more motivated when the issue is escalated by Dell and Microsoft. You could call Dell and Microsoft support and ask them what's the best way to report a driver issue.

[AradiPatrik]

I tried speaking with the Dell US support but they denied to service me, because I am Hungarian, and they only support devices with US service number. I contacted the Hungarian support about this issue and I am currently waiting for their response.
Hope they will be able to help.
Thank you for your support!
Edit: By the way, for those who are on a dell xps 13 9370 like me. It isn't necessary to disable Windows Biometric Service, It's enough to disable Goodix fingerprint in the device manager, this way you can still use face id while working with AVDs.

[ghost]

that's rellay a great resolution.My Friend,I am the guy who asked the question on the Microsoft Community,in the address ahead.My English is less becase I am a Chinese,I want you can understand what I said.
I opened the x86 Android Emulator on Android Studio,then BOSD,which code is same as yours.My computer is Dell G7,which cpu is i7-8750H.However,I opened the arm Android Emulator on Android Studio,my computer is safe,no any problem,but you know,arm Emulator is lower than x86,what I do is unloading the haxm(mine version is 7.2),loading the Genymotion.Now my pc is really stable.
I will try to unload Goodix to check if the BOSD.(I have tried to load drivers one by one to check them which cause the BOSD,unfortunatelly,failed.I ignored the Goodix.)

[raphaelning]

Thanks for confirming the presence of a Goodix fingerprint sensor on your laptop. So clearly, there's a conflict between the Goodix driver and HAXM.

The bug may be on either side, but Goodix and Microsoft are in a much better position to investigate the BSOD crash dump than we are--because of the reasons I listed above, plus Windows kernel and Goodix driver are closed source.

@AradiPatrik @WayneSimon We will try to contact the Goodix driver team. Meanwhile, hopefully you can get Dell's attention on this issue, so they can escalate it to Goodix.

BTW, our Dell Inspiron doesn't have a fingerprint sensor, which is why we can't reproduce the issue.

[wcwang]

We have contacted Goodix headquarter and sent the laptop models to Goodix, but there is no response from them. Goodix said a formal approach to report issue was the user provided feedback to laptop vendors and they will contact sales representatives from Goodix, and then they will report bugs in the internal tracking system according to the product line. Since there is no issue reporting system of Goodix for public, it is hard for all to raise problems from outside.

[ghost]

Thaks for what you do for customers，I am very happy to get your surpport for our problems.I have feedbacked to Dell Supporter by Wechat,and the supporter told me that problems will be reported to Dell engineer,but I am not sure if they did。There is a solution for me to develop Android by Genymotion.I have abandoned the AVD on Android Studio. 发送自 Windows 10 版邮件应用 发件人: Wenchao Wang 发送时间: 2018年6月28日 15:35 收件人: intel/haxm 抄送: WayneZhang; Mention 主题: Re: [intel/haxm] Haxm causes Win10 BSOD when I am putting my computerto sleep (#68) We have contacted Goodix headquarter and sent the laptop models to Goodix, but there is no response from them. Goodix said a formal approach to report issue was the user provided feedback to laptop vendors and they will contact sales representatives from Goodix, and then they will report bugs in the internal tracking system according to the product line. Since there is no issue reporting system of Goodix for public, it is hard for all to raise problems from outside. — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub, or mute the thread.

[stozk]

Same problem here, I noticed it when I tried to put my XPS 13 9370 (same model as the OP I guess, i7-8550U, UHD) into hybernation after running Android Studio respectively an AVD. As soon as I touch the fingerprint reader after using a AVD with HAXM it will result in that bluescreen (MEMORY_MANAGEMENT). Good to see it's a "common problem" and not a specific one on my machine.

[AradiPatrik]

Hey Daniel, could you report the problem to Dell Support? The more people they here this problem from the better!

[stozk]

Do they have come central address or forum thread for this?

I'm in Germany and even depending on the day of time I'll be forwarded to support branches in France and I'm not sure they share information/resources?

I left a Thread in their German Support Forum:

https://www.dell.com/community/XPS/XPS13-9370-Bluescreen-quot-MEMORY-MANAGEMENT-quot-HAXM/m-p/6108412

For now it seems to have been marked as spam....

[raphaelning]

For now it seems to have been marked as spam....

Yeah, that link gives me a "friendly" 404 page in German :-(

It was a good attempt though. @stozk Could you try to post on the English XPS forum instead? (Maybe you need to manually switch languages using the menu on the top.) And if the post survives their spam filter, @AradiPatrik can reply to it, and hopefully we get Dell's attention.

[stozk]

I have also submitted it to the english forum in english to reach a wider audience to find out if anyone else is experiencing this, especially on other models.

https://www.dell.com/community/XPS/XPS13-9370-Bluescreen-quot-MEMORY-MANAGEMENT-quot-HAXM/m-p/6108812#M13238

Both threads have been unlocked now by the mods and are showing up.

PS: I have compared our minidumps, looks like the same problem according to the addresses.

[AradiPatrik]

I have replied to your thread! It's good to see progress on this issue. It would be nice if I could leave the fingerprint sensor on while developing android 😄

[stozk]

Yeah, other people have replied too and it seems like the XPS 15 9570 is also affected.
The mod in the German support forum is forwarding the issue because the minidumps are not very conclusive.

[dashart-ke]

I can confirm XPS 15 9570 with i7-8750h (win10 1803 (build 17134)) is affected by this bug too.
Issues occurs if screen gets locked during running HAXM AVD.
BSOD occurs also in case app getting restarted in AVD during debugging.

Very frustrating.

[raphaelning]

It's good to see someone from Dell support reply to the English thread, although he is not yet able to reproduce the BSOD.

We managed to find an 8th-gen Core laptop with a different fingerprint sensor vendor: it's a Lenovo Ideapad 720S, with Core i7-8550U CPU, Synaptics fingerprint sensor (Synaptics WBDI - SGX as shown in Device Manager), and Windows 10 v1803. Tried the repro steps from @stozk , issue not reproduced. The Synaptics device is not integrated into the laptop's power button.

If anyone else is able to reproduce this issue with a non-Goodix fingerprint sensor, please let us know.

[stozk]

Dell was now able to reproduce the error on their XPS13 9370 i7 CPU device on Windows 10 1803:

https://www.dell.com/community/XPS/XPS13-9370-Bluescreen-quot-MEMORY-MANAGEMENT-quot-HAXM/m-p/6113162/highlight/true#M13535

[HaHoYou]

I did not reproduced this error on Huawei Laptop.
Details:
Hardware:
Laptop: HUAWEI, MateBook X Pro
CPU: Intel i5-8250U https://ark.intel.com/products/124967/Intel-Core-i5-8250U-Processor-6M-Cache-up-to-3_40-GHz
Fingerprint sensor(Biometric devices): Goodix Fingerprint SPI Device, version 1.1.11.18

Software:
Windows 10 pro: v1803, 10.0.17134.167, 64b
Intel CPU SGX(by command: services.msc: service Intel SGX AESM): Running
HAXM: 7.2.0

Actions:
Touch fingerprint sensor; sleep; reboot, close lid;
Launch API27/25, Pixel 2/Nexus 5x Emulator.

[ThomasTangShiMing]

"memory_corruption ( nt!MiDeleteEnclavePages+96 ) " called by "sgx_destroy_enclave", called by Goodix driver or Huawei App MBAMessageCenter.exe.
I think on a system with intel Haxm, BSOD happens when any app that calls sgx_destroy_enclave exits S0.
Could anyone have the setup to give it a try?

[raphaelning]

@ThomasTangShiMing Thanks for the idea. But if you watch the video that @stozk posted on the Dell forum:

https://photos.app.goo.gl/nAAdhMHvyjJfSm9W8

he was able to reproduce the BSOD without ever putting his laptop to sleep. So presumably the system never leaves the ACPI S0 state?

Actually, we've received an important piece of information from another Intel team, and can now investigate this issue from HAXM side. I'll post a more detailed update tomorrow.

[raphaelning]

The tip we got from the other Intel team is that, HAXM has probably done something that causes SGX to be disabled. Then, any attempt to use SGX without first making sure it's enabled will fail. Because only the Windows kernel can run SGX instructions (EDIT: in fact a few SGX instructions are not privileged and thus can be used by applications), such a failure will result in a kernel bug check, i.e. BSOD (EDIT: in case an application executes an SGX instruction when SGX is disabled, the application will crash).

We have identified the HAXM code that interferes with SGX. Basically, a bug in load_guest_msr() can accidentally clear the IA32_MC0_CTL MSR, which in turn will disable SGX until the next system reboot (cf. Intel SDM Vol. 3D 42.15.2).

Right now we're running our tests on a Dell Inspiron laptop that lacks a fingerprint sensor, so we can't reproduce the BSOD. However, our system can reproduce the following behavior (which is a result of the said HAXM bug) consistently:

1. Run test-sgx.exe to confirm SGX is enabled: sgx 1 supported: 1.
2. Launch an Android API 27 x86 AVD.
3. Close the AVD. (It can be closed as soon as the emulator window pops up.)
4. Run test-sgx.exe again to confirm SGX is now disabled: sgx 1 supported: 0.

where test-sgx.exe is a simple tool to check SGX status using the CPUID instruction: https://github.com/ayeks/SGX-hardware

I've built it using mingw64 gcc: test-sgx.zip

Could you guys also try the above steps and report back if you see the same behavior? Of course, you need to avoid BSOD at step 2, e.g. by not touching your fingerprint sensor, or just disabling it in Device Manager beforehand.

[aztechnoob]

I tried and see the same behavior,this is the outputs:
test-sgx-output.txt.

[AradiPatrik]

I observed the same behavior

With fingerprint sensor disabled, before running AVD:

eax: 806ea ebx: 3100800 ecx: 7ffafbbf edx: bfebfbff
stepping 10
model 14
family 6
processor type 0
extended model 8
extended family 0
smx: 0

Extended feature bits (EAX=07H, ECX=0H)
eax: 0 ebx: 29c67af ecx: 0 edx: 9c000000
sgx available: 1

CPUID Leaf 12H, Sub-Leaf 0 of Intel SGX Capabilities (EAX=12H,ECX=0)
eax: 1 ebx: 0 ecx: 0 edx: 241f
sgx 1 supported: 1
sgx 2 supported: 0
MaxEnclaveSize_Not64: 1f
MaxEnclaveSize_64: 24

CPUID Leaf 12H, Sub-Leaf 1 of Intel SGX Capabilities (EAX=12H,ECX=1)
eax: 36 ebx: 0 ecx: 1f edx: 0

CPUID Leaf 12H, Sub-Leaf 2 of Intel SGX Capabilities (EAX=12H,ECX=2)
eax: 40200001 ebx: 0 ecx: 5d80001 edx: 0

CPUID Leaf 12H, Sub-Leaf 3 of Intel SGX Capabilities (EAX=12H,ECX=3)
eax: 0 ebx: 0 ecx: 0 edx: 0

CPUID Leaf 12H, Sub-Leaf 4 of Intel SGX Capabilities (EAX=12H,ECX=4)
eax: 0 ebx: 0 ecx: 0 edx: 0

CPUID Leaf 12H, Sub-Leaf 5 of Intel SGX Capabilities (EAX=12H,ECX=5)
eax: 0 ebx: 0 ecx: 0 edx: 0

CPUID Leaf 12H, Sub-Leaf 6 of Intel SGX Capabilities (EAX=12H,ECX=6)
eax: 0 ebx: 0 ecx: 0 edx: 0

CPUID Leaf 12H, Sub-Leaf 7 of Intel SGX Capabilities (EAX=12H,ECX=7)
eax: 0 ebx: 0 ecx: 0 edx: 0

CPUID Leaf 12H, Sub-Leaf 8 of Intel SGX Capabilities (EAX=12H,ECX=8)
eax: 0 ebx: 0 ecx: 0 edx: 0

CPUID Leaf 12H, Sub-Leaf 9 of Intel SGX Capabilities (EAX=12H,ECX=9)
eax: 0 ebx: 0 ecx: 0 edx: 0

After running avd:

eax: 806ea ebx: 2100800 ecx: 7ffafbbf edx: bfebfbff
stepping 10
model 14
family 6
processor type 0
extended model 8
extended family 0
smx: 0

Extended feature bits (EAX=07H, ECX=0H)
eax: 0 ebx: 29c67af ecx: 0 edx: 9c000000
sgx available: 1

CPUID Leaf 12H, Sub-Leaf 0 of Intel SGX Capabilities (EAX=12H,ECX=0)
eax: 0 ebx: 0 ecx: 0 edx: 0
sgx 1 supported: 0
sgx 2 supported: 0
MaxEnclaveSize_Not64: 0
MaxEnclaveSize_64: 0

CPUID Leaf 12H, Sub-Leaf 1 of Intel SGX Capabilities (EAX=12H,ECX=1)
eax: 0 ebx: 0 ecx: 0 edx: 0

CPUID Leaf 12H, Sub-Leaf 2 of Intel SGX Capabilities (EAX=12H,ECX=2)
eax: 0 ebx: 0 ecx: 0 edx: 0

CPUID Leaf 12H, Sub-Leaf 3 of Intel SGX Capabilities (EAX=12H,ECX=3)
eax: 0 ebx: 0 ecx: 0 edx: 0

CPUID Leaf 12H, Sub-Leaf 4 of Intel SGX Capabilities (EAX=12H,ECX=4)
eax: 0 ebx: 0 ecx: 0 edx: 0

CPUID Leaf 12H, Sub-Leaf 5 of Intel SGX Capabilities (EAX=12H,ECX=5)
eax: 0 ebx: 0 ecx: 0 edx: 0

CPUID Leaf 12H, Sub-Leaf 6 of Intel SGX Capabilities (EAX=12H,ECX=6)
eax: 0 ebx: 0 ecx: 0 edx: 0

CPUID Leaf 12H, Sub-Leaf 7 of Intel SGX Capabilities (EAX=12H,ECX=7)
eax: 0 ebx: 0 ecx: 0 edx: 0

CPUID Leaf 12H, Sub-Leaf 8 of Intel SGX Capabilities (EAX=12H,ECX=8)
eax: 0 ebx: 0 ecx: 0 edx: 0

CPUID Leaf 12H, Sub-Leaf 9 of Intel SGX Capabilities (EAX=12H,ECX=9)
eax: 0 ebx: 0 ecx: 0 edx: 0

[raphaelning]

@pacemoan @AradiPatrik Thanks a lot! I've fixed the SGX getting accidentally disabled issue, and I want to ask for your help to verify that this patch also fixes the BSOD (I'm now pretty confident that it does). However, we're having problem getting our latest Windows driver build signed (Windows 10 drivers must be digitally signed by Microsoft). Hopefully we'll receive the signed driver binary from Microsoft tomorrow morning.

[AradiPatrik]

Wow, great to hear! I will be sure to check it out when it arrives.
Thank you for the support!

[aztechnoob]

Great,can't wait to.Thanks for the support.

[wcwang]

We have built a temporary installer haxm-windows_v7_2_55.zip for testing #68. Note that this is not a formal release and has not been well tested. Just for verification and expect your feedback.

[aztechnoob]

I just tested this new version,no bsod happened on my laptop when i putted it off or restarted or putted it to sleep，and no other error showed up.My laptop model is Huawei Matebook X Pro(i5-8250u+MX150+Goodix FP).
The bug has been fixed on my laptop, thanks a lot.

[raphaelning]

Awesome, thank you! Please feel free to use this HAXM build until we roll out a new formal release :-)

[AradiPatrik]

It works! Installed temporary build, enabled fingerprint sensor, and no BSOD after going to sleep, after working with AVD.
Thank You!

[raphaelning]

Glad to hear that! Could you update the discussion thread on the Dell forum? I think there are a few other affected users there who may not be watching this GitHub issue.

[stozk]

Looks like Dell/Goodix were also active, I just got a driver update for the fingerprint reader.