Haxm causes Win10 BSOD when I am putting my computer to sleep

[AradiPatrik]

I read through this issue: #55 and did the suggested fix listed there, but I think in my case something else causes the problem.
Please help.
BSOD info:

Windows 8 Kernel Version 17134 MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 17134.1.amd64fre.rs4_release.180410-1804
Machine Name:
Kernel base = 0xfffff802`9d00d000 PsLoadedModuleList = 0xfffff802`9d3c71f0
Debug session time: Wed Jun 20 11:50:56.893 2018 (UTC - 4:00)
System Uptime: 0 days 0:50:20.716
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

MEMORY_MANAGEMENT (1a)
    # Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000018011544, The subtype of the bugcheck.
Arg2: ffffd0cac004a7f8
Arg3: ffffffffc000001d
Arg4: 0000000000000000

Debugging Details:
------------------

TRIAGER: Could not open triage file : e:\dump_analysis\program\triage\modclass.ini, error 2

BUGCHECK_STR:  0x1a_18011544

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN8_DRIVER_FAULT

PROCESS_NAME:  WUDFHost.exe

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from fffff8029d76d826 to fffff8029d1a5330

STACK_TEXT:  
ffffea0a`ad147498 fffff802`9d76d826 : 00000000`0000001a 00000000`18011544 ffffd0ca`c004a7f8 ffffffff`c000001d : nt!KeBugCheckEx
ffffea0a`ad1474a0 fffff802`9d081be5 : 00000000`000b9c42 00000000`000b9c42 00000000`01d0070a 00000000`00000001 : nt!MiDeleteEnclavePages+0x96
ffffea0a`ad1474e0 fffff802`9d0e5f36 : 00000000`1c6e8fff 00000000`1c6e8000 00000000`00000000 fffff802`9d0ba0ab : nt!MiDeleteVad+0x125
ffffea0a`ad147810 fffff802`9d4cceeb : 00000000`00000000 00000000`00000000 ffffc089`78093110 fffff802`9d0ba4bf : nt!MiFreeVadRange+0x92
ffffea0a`ad147870 fffff802`9d4ccb3b : 00000000`00000000 00000000`00000000 0000006d`2ca7ec30 000001c6`e7335c30 : nt!MmFreeVirtualMemory+0x37b
ffffea0a`ad1479a0 fffff802`9d1b5943 : ffffc089`6a5f2040 000001c6`e7312550 00007ff9`11b9d138 00007ff9`11b9d130 : nt!NtFreeVirtualMemory+0x8b
ffffea0a`ad147a00 00007ff9`17ada274 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
0000006d`2ca7ee58 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x7ff9`17ada274


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!MiDeleteEnclavePages+96
fffff802`9d76d826 cc              int     3

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt!MiDeleteEnclavePages+96

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP:  5b1a4590

IMAGE_NAME:  memory_corruption

FAILURE_BUCKET_ID:  X64_0x1a_18011544_nt!MiDeleteEnclavePages+96

BUCKET_ID:  X64_0x1a_18011544_nt!MiDeleteEnclavePages+96

Followup: MachineOwner
---------

OS: Windows 10 pro,
CPU: Intel i7 8550U @ 1.8GHz
HAXM: 7.2.0
AVD: Nexus 5X API 25, Android 7.1.1 Google Play, CPU/ABI x86 (these are the defaults)
( I am on a dell xps 13 9370 uhd model )
link to my dump file: https://drive.google.com/open?id=1AJYcjimewO_9lkzYR3-SuXp-6ZQUj3Mm
Thank you for your support in advance.

[raphaelning]

Thank you for the report and analysis. It seems to me you have exactly the same issue as #55, because:

a) You have the same CPU model, Intel Core i7-8550U. (In #55 @pacemoan didn't mention their CPU model, but their crash dump shows the same CPUID family, model and stepping. I believe their laptop is Huawei MateBook X Pro.)
b) You have the same Windows version, 1803 (build 17134).
c) The BSOD is identified by the same bugcheck type (1A, MEMORY_MANAGEMENT) and subtype (0000000018011544, a value not even documented on MSDN).
d) The BSOD happens at the same location in the Windows kernel:

FOLLOWUP_IP: 
nt!MiDeleteEnclavePages+96
fffff800`40e06826 cc              int     3

This is a function that makes use of the Intel SGX hardware feature. There must be a device driver that relies on SGX, and although we can't identify it from your crash dump (PROCESS_NAME: WUDFHost.exe is the process that runs on behalf of all user-mode drivers), I'd first try to disable the fingerprint sensor as we did with #55, because I see this in the Dell XPS 13 spec:

The following options and default selections are included with your order.

Backlit English Keyboard w/ Fingerprint Reader
...

[AradiPatrik]

Thank you for the support, I will try the solution mentioned in #55 again, with a full restart, right after work. I thought the issue was different because the PROCESS_NAME was different.

[raphaelning]

You're welcome. Interestingly, a simple Google search reveals a third report of the same issue:

https://answers.microsoft.com/zh-hans/windows/forum/windows_10-hardware/%E5%86%8D%E6%89%93%E5%BC%80android-studio/3cb3328d-8036-4da8-9df7-f5b7d4081af9

The post is in Chinese, but basically the four said points remain valid, except that:

a') The CPU model is Intel Core i7-8750H, which is also an 8th-gen Core.

Now it's pretty clear that the issue is somehow related to HAXM, even though there is no trace of the HAXM driver (intelhaxm.sys) in any of the crash dumps. Either we have a bug in HAXM that gets exposed by the SGX-specific code path in Windows kernel, or the other way round.

We have a Dell Inspiron laptop with Intel Core i7-8550U and Windows 10 Pro v1803, but have never seen this issue. Let me read more about SGX and try to understand why.

[AradiPatrik]

Meanwhile I tried the solution in: #55 again, but the BSOD still persists
I turned off all biometric authentication service, ( I tested them, they are really offline, the facial recognition lights not flickering, fingerprint sensor not working ).
Thank you for the help.

[AradiPatrik]

I am currently in touch with dell support too, because I thought, it might be a hardware problem, although when I ran the hardware tests, they all returned that everything is ok. Do you think, that I should have my laptop replaced, or is this more likely caused by software bugs?

[raphaelning]

I turned off all biometric authentication service

Did you also locate the corresponding devices in Device Manager and disable them? I'd like to know what they are (manufacturer, etc.), so could you post a screenshot of each device you found (see #55 for an example)?

Do you think, that I should have my laptop replaced, or is this more likely caused by software bugs?

I'd always put my bet on software ;-) After all, we were able to work around the same issue (#55) without replacing any hardware. One could argue that we might have disabled a defective fingerprint sensor, but then that defect could still lie in a buggy fingerprint sensor driver. So the possible culprits are:

• HAXM
• SGX-related code in Windows kernel
• Whatever device driver that relies on SGX

It might be more helpful if you reported the issue to Microsoft, because I think they are in the best position to debug it:

1. The immediate cause of the BSOD is a Windows kernel routine. The user process that ultimately calls that kernel routine is also part of Windows (WUDFHost.exe).
2. The bugcheck subtype 0000000018011544 is undocumented. Only Microsoft knows what it means.
3. Even if the root cause is a HAXM bug, I wonder how we can debug it when the crash dump shows no trace of HAXM. Maybe Microsoft could improve the crash dump to reveal the real villain for this bugcheck case?

[AradiPatrik]

Yes!
Disabling the Goodix fingerprint device in the device manager, finally fixed the issue.
Thank you very much for your support.
But it would be really nice if I wouldn't have to do this workaround, so I want to report this issue. Do you know how can I contact Microsoft and Goodix about the issue?

[raphaelning]

That's great! I should also thank you for relieving us of the pressure to debug this issue ;-) It's fair to say the Goodix driver team should look into it first, based on the evidence so far (here and #55, and let's see if the third reporter also finds a Goodix fingerprint sensor on his Dell G7.)

But I wouldn't contact Goodix directly; they will be more motivated when the issue is escalated by Dell and Microsoft. You could call Dell and Microsoft support and ask them what's the best way to report a driver issue.

[AradiPatrik]

I tried speaking with the Dell US support but they denied to service me, because I am Hungarian, and they only support devices with US service number. I contacted the Hungarian support about this issue and I am currently waiting for their response.
Hope they will be able to help.
Thank you for your support!
Edit: By the way, for those who are on a dell xps 13 9370 like me. It isn't necessary to disable Windows Biometric Service, It's enough to disable Goodix fingerprint in the device manager, this way you can still use face id while working with AVDs.

that's rellay a great resolution.My Friend,I am the guy who asked the question on the Microsoft Community,in the address ahead.My English is less becase I am a Chinese,I want you can understand what I said.
I opened the x86 Android Emulator on Android Studio,then BOSD,which code is same as yours.My computer is Dell G7,which cpu is i7-8750H.However,I opened the arm Android Emulator on Android Studio,my computer is safe,no any problem,but you know,arm Emulator is lower than x86,what I do is unloading the haxm(mine version is 7.2),loading the Genymotion.Now my pc is really stable.
I will try to unload Goodix to check if the BOSD.(I have tried to load drivers one by one to check them which cause the BOSD,unfortunatelly,failed.I ignored the Goodix.)

[raphaelning]

Thanks for confirming the presence of a Goodix fingerprint sensor on your laptop. So clearly, there's a conflict between the Goodix driver and HAXM.

The bug may be on either side, but Goodix and Microsoft are in a much better position to investigate the BSOD crash dump than we are--because of the reasons I listed above, plus Windows kernel and Goodix driver are closed source.

@AradiPatrik @WayneSimon We will try to contact the Goodix driver team. Meanwhile, hopefully you can get Dell's attention on this issue, so they can escalate it to Goodix.

BTW, our Dell Inspiron doesn't have a fingerprint sensor, which is why we can't reproduce the issue.

[wcwang]

We have contacted Goodix headquarter and sent the laptop models to Goodix, but there is no response from them. Goodix said a formal approach to report issue was the user provided feedback to laptop vendors and they will contact sales representatives from Goodix, and then they will report bugs in the internal tracking system according to the product line. Since there is no issue reporting system of Goodix for public, it is hard for all to raise problems from outside.