Fixing "page fault in nonpaged area" Windows 10 BSOD caused by installing spice-guest-tools

spice-guest-tools Windows 10 BSOD.md

Synopsis

Boot failure was caused by installing spice-guest-tools which, if you read details about it, also includes the QXL driver and the install broke my Windows 10 build 17134 guest somehow. This occured on Ubuntu 16.04 LTS with QEMU emulator version 2.5.0.

Error

BSOD with "page fault in nonpaged area" occurs after installing spice-guest-tools-latest.exe. It possibly clobbers other stable/good versions of drivers.

Automatic boot repair fails. After going through advanced options and getting to a command prompt, inspect the boot repair logs:

E:\Windows\System32\LogFiles\Srt>notepad.exe SrtTrail.txt

Error seen in SrtTrail.txt

Boot critical file e:\boot\resources\custom\bootres.dll is corrupt

Note, the above error can be misleading and at least one user correlated it to a bad graphics driver install - which was the root cause in this case as well.

References:

• How to fix corrupted bootres.dll file in Windows 10
• Example where bootres.dll issue might be related to graphics driver issues

Failed fix attempts

When restarting with advanced startup options, "Enable low resolution video" didn't help, nor did "Safe mode" or trying to force and set safeboot minimal as the default boot option from a recovery command line.

On the libvirt/KVM host, trying to switch from QXL to VGA video to avoid the BSOD graphics bug didn't work either.

Fix

What did work if forcing installing a different version of the driver not packaged with spice-guest-tools-latest.exe, but rather forcing installing the QXL dod w10 driver from the ISO provided via Fedora (https://fedorapeople.org/groups/virt/virtio-win/direct-downloads/). This can be done via the command prompt (accessed via advanced recovery options) using the pnputil command. E.g. from qxldod\w10\amd64 folder of ISO, run pnputil /add-driver /install qxldod.inf /force.

If it complians about there already being an up-to-date driver:

• Search the output of pnputil /enum-drivers to identify the "published" oem.inf name above the orginal qxldod.inf name.
• Use pnputil /delete-driver oem<num>.inf /force to get rid of it before installing the previously working version.

Additional cleanup

Force removing all previously installed versions. It's unfortunate that Add-WindowsDriver only works on offline windows images, so pnputil has to be used and it outputs normal line-delimited text instead of powershell objects, so the output has to be parsed as raw text.

$iso_inf=(Get-ChildItem *\w10\amd64\*.inf)
$driver_enum_lines=(pnputil.exe /enum-drivers)
ForEach ($i in (1 .. ($driver_enum_lines.Count - 1))) {
  if ($driver_enum_lines[$i] -match '^Original Name:\s+(?<orig_inf>.+?\.inf)$') {
    $orig_inf = $matches.orig_inf
    if ($orig_inf -in $iso_inf.Name) {
      if ($driver_enum_lines[$i - 1] -match '^Published Name:\s+(?<pub_inf>oem[0-9]+\.inf)$') {
        $pub_inf = $matches.pub_inf
        Write-Output "`n# Removing $orig_inf which was installed with Published name $pub_inf"
        pnputil /delete-driver $pub_inf /force
      }
    }
  }
}

Then force installing all windows 10 64bit drivers from the ISO

Get-ChildItem *\w10\amd64\*.inf | %{ Set-Location $_.DirectoryName; pnputil /add-driver $_.Name /install /force }; Set-Location \