Debugging Stop 0x124 - !sysinfo, !cpuinfo, !whea and !errpkt

Another blog post about Stop 0x124, as always said, these bugchecks are probably one of the hardest to debug due to the lack of information they retain, thereby it's very important to understand how to gather as much as possible from these seemingly barren dump files. I'm going to explain the rest of the !sysinfo extensions, !cpuinfo, !whea and !errpkt.

In regards to !sysinfo, I'm going to discuss the flags to the extension highlighted with the red box.

Let's begin with the !cpuinfo extension, which will show some basic information about the CPU. By default, it will display information about all the processors in the system, however, since this is a Mindump so one processor; the processor which was last running will be shown.

The MHz field shows the clockspeed of the processor. The Manufacturer field is used to show that the processor is a real Intel processor.

The CP field shows the current processor number. The F indicates the processor family number; the M indicates the processor model number and the S indicates the stepping size.

A processor family (F) is a form of categorisation used by CPU vendors to group their products, and therefore make comparison of the different features between processors of a similar feature set much easier. In a debugging sense, this just makes it easily to identify the processor, and find the relevant documentation for it.

The Model number is shows the specific type of processor within that family.

 The Stepping Size (S) is the version number of a CPU. 

The MSR (Machine/Model Specific Register) Signature Features is used to show the set debugging features and performance monitoring. It can refer to any of the Control Registers used. These are usually displayed as cr8 or a another number. See Volume 3 Chapter 35 of the Intel Developers Manual.

The !sysinfo cpuinfo extension is used to display similar information.

The !sysinfo cpumicrocode shows the processor family, model and stepping information.
This only works for Intel processors.

The CPUID string shows the name of the processor, and the MaxSpeed and CurrentSpeed of the processor. This is very useful for checking for overclocking.

The !sysinfo gbl used to provide ACPI Table information, and only works on systems which support ACPI. The ACPI Specifications can be found here - ACPI - Advanced Configuration and Power Interface

The !sysinfo machineid extension is used for displaying basic motherboard and BIOS date information.

The !sysinfo registers extension is used to display information about the MSRs, here I would consult the Intel Developers Manual to gather more information. This extension only works on processors which are not Itanium processors.

The !sysinfo smbios extension explains information related to the BIOS, such as memory, BIOS Version information, processor information and power information.

Again, the above is only a partial view of the extension due to size limitations. This only works on systems which support SMBIOS.

The !whea extension never seems to produce much with a Minidump, since it's part of the higher levels of the WHEA structure and therefore I'll advise to check the WinDbg documentation.

The Error Source indicates the hardware which notified WHEA of the hardware error condition. This do not mean that the Error Source is necessarily the culprit of the crash.

 There is also the !errpkt extension which displays information about a WHEA Hardware Error Packet, however, this information is converted into a WHEA Error Record (!errrec) by the Windows Kernel, by being given the Error Packet from the LLHEH (Low Level Hardware Error Handler).