ConEmu causing kernel debug log to fill

[timrprobocom]

Versions

ConEmu build: 170819 alpha x64 OS version: Windows 10 1703 (15063) x64 Used shell version (Far Manager, git-bash, cmd, powershell, cygwin, whatever): cmd

Problem description

Something in ConEmu64 is causing ConhostV2.dll to issue dozens of kernel debugger messages every second. That makes it very difficult to do any kind of debug log monitoring on this system.

The messages are coming from the conhost.exe process that ConEmu launches. Strictly speaking, that's not your process, but the problem does not happen when cmd.exe is run by itself, and it also launches conhost.exe.

Steps to reproduce

1. Bring up dbgview
2. Make sure "Capture Win32" is selected
3. Watch

Actual results

00000001 0.00000000 [14952] windows\core\console\open\src\server\apidispatchersinternal.cpp(21)\ConhostV2.dll!00007FF90C6607E6: (caller: 00007FF90C660628) ReturnHr(35848764) tid(5d0) 80004001 Not implemented     
00000002 0.00000000 [14952]     Msg:[Deprecated API attempted: 0x00000007]  
00000003 0.00007577 [14952] windows\core\console\open\src\server\apidispatchers.cpp(544)\ConhostV2.dll!00007FF90C65E7C4: (caller: 00007FF90C660628) ReturnHr(35848765) tid(5d0) 80070006 The handle is invalid.     

(14952 is the process ID for the conhost.exe process that ConEmu launches. If I have multiple tabs, I get these messages for each conhost.)

Expected results

No impact.

Additional files

TIMR3.TXT Sample debug log attached

[Maximus5]

That is not a ConEmu issue. @miniksa can you check this?

[ddiukariev]

I have the same issue. Moreover I have a PC and a laptop. And issue happens only on laptop. But I have same ConEmu on both (settings for conEmu are also identical). OS version where issue happens Window 10.0.15063 OS version where no issue Windows 10.0.14393

This forces me to close conEmu any time I need to debug as conhost spawned by ConEmu generates ~3K messages per second.

Also connhost thread where issue happens puts extra load on CPU (4% comparing to 0.01% on machine where no issue)

Stack trace for thread where issue happens: ntoskrnl.exe!KeSynchronizeExecution+0x3f46 ntoskrnl.exe!KeWaitForSingleObject+0xfda ntoskrnl.exe!KeWaitForSingleObject+0x9a1 ntoskrnl.exe!KeWaitForSingleObject+0x2b8 ntoskrnl.exe!KeCheckProcessorGroupAffinity+0xb64 ntoskrnl.exe!KeWaitForSingleObject+0x2a3e ntoskrnl.exe!KeWaitForSingleObject+0x11a7 ntoskrnl.exe!KeWaitForSingleObject+0x9a1 ntoskrnl.exe!KeWaitForSingleObject+0x2b8 ntoskrnl.exe!NtWaitForSingleObject+0xf8 ntoskrnl.exe!setjmpex+0x3b83 ntdll.dll!ZwWaitForSingleObject+0x14 KERNELBASE.dll!DeviceIoControl+0x7f KERNEL32.DLL!DeviceIoControl+0x80 ConhostV2.dll!ConsoleCreateIoThread+0xe053 ConhostV2.dll!ConsoleCreateIoThread+0x3cdd KERNEL32.DLL!BaseThreadInitThunk+0x14 ntdll.dll!RtlUserThreadStart+0x21

[Maximus5]

As not ConEmu generates these messages I can't do anything to stop them.

[miniksa]

00000001 0.00000000 [14952] windows\core\console\open\src\server\apidispatchersinternal.cpp(21)\ConhostV2.dll!00007FF90C6607E6: (caller: 00007FF90C660628) ReturnHr(35848764) tid(5d0) 80004001 Not implemented
00000002 0.00000000 [14952] Msg:[Deprecated API attempted: 0x00000007]

It looks like ConEmu is polling the private API GetConsoleKeyboardLayoutName in a tight loop. This API is private and isn't supported for public calls. I need ConEmu to stop calling it when it receives the message that it is unimplemented.

00000003 0.00007577 [14952] windows\core\console\open\src\server\apidispatchers.cpp(544)\ConhostV2.dll!00007FF90C65E7C4: (caller: 00007FF90C660628) ReturnHr(35848765) tid(5d0) 80070006 The handle is invalid.

This one is ConEmu calling GetConsoleDisplayMode public API in a tight loop. It doesn't look like this API allows passing of a handle, so I will file a bug and investigate why the handle seems to be suddenly invalid. MSFT: 13479101

[lordjeb]

I would like to fix this bug and submit a PR. What I have found is that the call to KERNEL32!GetConsoleKeyboardLayoutNameW results in a call to KERNEL32!ConsoleCallServer which returns 0x80004001, which is a status not implemented error code. But then the function uses RtlNtStatusToDosError to try to convert error code to a DOS/Win32 code. There is not a mapping for that, so it returns ERROR_MR_MID_NOT_FOUND to ConEmu. (And prints some additional error output in a kernel debugger that is not mentioned in this issue currently.)

So ConEmu could key off that return code and never call the API again after it hits that. There are a handful of places where this function gets dynamically loaded and called, but the one that calls over and over is in IsKeyboardLayoutChanged in ConsoleMain.cpp.

So should I...

(a) Change only the function IsKeyboardLayoutChanged, have it recognize the error code, set a static variable to not make the call any more.

(b) Make a wrapper function for GetConsoleKeyboardLayoutName that can make it so none of the other places get called multiply as well. Change all the other locations to call this wrapper.

(c) Other?

[Maximus5]

IsKeyboardLayoutChanged is a good place.

Of course it would be much better if console applications have proper API to determine the keyboard layout. Nowadays there is absolutely no way to do that. Standard GUI functions aren't working for obvious reason, console variant was broken in Win10.

[santagada]

Having the same problem, anyone know of a workaround or a version of conemu that doesn't suffer from this? Right now I had to stop using it because I can't use the debug console anymore.

[Maximus5]

PR was not successful. At the moment only commit 1638b9b5 fixes it, but there is no corresponding build yet.