Windows Vista IRQL Not Less Or Equal crash, win32k.sys

  • Thread starter Thread starter rodrigo.uchoa
  • Start date Start date
R

rodrigo.uchoa

Guest
I have a sony vaio laptiop with Windows Vista Home Premium with 4 gigs of
RAM. I have been frequently getting blue screen crashes right after start-up
and shut-down.

The complete dump file for the error is the following:


------------------------------------------------------------------
IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 00000000, memory referenced
Arg2: 0000001b, IRQL
Arg3: 00000000, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on
chips which support this level of status)
Arg4: 82100cba, address which referenced memory

Debugging Details:
------------------




READ_ADDRESS: GetPointerFromAddress: unable to read from 82184868
Unable to read MiSystemVaType memory at 82164420
00000000

CURRENT_IRQL: 1b

FAULTING_IP:
nt!KiUnwaitThread+14
82100cba 8b08 mov ecx,dword ptr [eax]

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

BUGCHECK_STR: 0xA

PROCESS_NAME: taskeng.exe

TRAP_FRAME: b2281c34 -- (.trap 0xffffffffb2281c34)
ErrCode = 00000000
eax=00000000 ebx=00000001 ecx=84d6bce8 edx=84d6bce8 esi=a6f99ac8 edi=84d4fed8
eip=82100cba esp=b2281ca8 ebp=b2281cbc iopl=0 nv up ei pl nz na pe cy
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010207
nt!KiUnwaitThread+0x14:
82100cba 8b08 mov ecx,dword ptr [eax]
ds:0023:00000000=????????
Resetting default scope

LAST_CONTROL_TRANSFER: from 82100cba to 820a7d84

STACK_TEXT:
b2281c34 82100cba badb0d00 84d6bce8 dee619a0 nt!KiTrap0E+0x2ac
b2281cbc 82100c60 00000002 0000c046 ff790008 nt!KiUnwaitThread+0x14
b2281ce4 95f9184e 84d4fed0 00000002 00000000 nt!KeSetEvent+0xa0
b2281d00 95f65285 ff790008 00000108 ff790008 win32k!SetWakeBit+0xda
b2281d1c 95f653cf ff790008 0000c046 00000000 win32k!_PostThreadMessage+0xb7
b2281d4c 820a4a7a 00000c0c 0000c046 00000000
win32k!NtUserPostThreadMessage+0x10e
b2281d4c 77479a94 00000c0c 0000c046 00000000 nt!KiFastCallEntry+0x12a
WARNING: Frame IP not in any known module. Following frames may be wrong.
0262e484 00000000 00000000 00000000 00000000 0x77479a94


STACK_COMMAND: kb

FOLLOWUP_IP:
win32k!SetWakeBit+da
95f9184e 5e pop esi

SYMBOL_STACK_INDEX: 3

SYMBOL_NAME: win32k!SetWakeBit+da

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: win32k

IMAGE_NAME: win32k.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 47c78851

FAILURE_BUCKET_ID: 0xA_win32k!SetWakeBit+da

BUCKET_ID: 0xA_win32k!SetWakeBit+da

Followup: MachineOwner
---------



Any tips on solving this will be highly appreciated. I have already
 
Re: IRQL Not Less Or Equal crash, win32k.sys

Hi,

Something in Task Scheduler is trying to run and falling over, or something
is trying to load TS and it's crashing. The memory address being accessed is
invalid (arg 1), and the hardware is using a virtual IRQ, number 27 (arg 2).
Two approaches to this might help diagnose the problem:

1) Check TS for tasks trying to run at startup and shutdown. Check event
viewer as well for mention of what's falling over.

2) Run msinfo32 from the start/search line and go to hardware resources/IRQ
and see if there is a device using #27. If so, see if there is an updated
driver for that device from the manufacturer.

--
Best of Luck,

Rick Rogers, aka "Nutcase" - Microsoft MVP
http://mvp.support.microsoft.com/
Windows help - www.rickrogers.org
My thoughts http://rick-mvp.blogspot.com

"rodrigo.uchoa" <rodrigo.uchoa@discussions.microsoft.com> wrote in message
news:0A525DF0-63DC-4895-BEC7-B8FEB080649B@microsoft.com...
>I have a sony vaio laptiop with Windows Vista Home Premium with 4 gigs of
> RAM. I have been frequently getting blue screen crashes right after
> start-up
> and shut-down.
>
> The complete dump file for the error is the following:
>
>
> ------------------------------------------------------------------
> IRQL_NOT_LESS_OR_EQUAL (a)
> An attempt was made to access a pageable (or completely invalid) address
> at an
> interrupt request level (IRQL) that is too high. This is usually
> caused by drivers using improper addresses.
> If a kernel debugger is available get the stack backtrace.
> Arguments:
> Arg1: 00000000, memory referenced
> Arg2: 0000001b, IRQL
> Arg3: 00000000, bitfield :
> bit 0 : value 0 = read operation, 1 = write operation
> bit 3 : value 0 = not an execute operation, 1 = execute operation (only on
> chips which support this level of status)
> Arg4: 82100cba, address which referenced memory
>
> Debugging Details:
> ------------------
>
>
>
>
> READ_ADDRESS: GetPointerFromAddress: unable to read from 82184868
> Unable to read MiSystemVaType memory at 82164420
> 00000000
>
> CURRENT_IRQL: 1b
>
> FAULTING_IP:
> nt!KiUnwaitThread+14
> 82100cba 8b08 mov ecx,dword ptr [eax]
>
> CUSTOMER_CRASH_COUNT: 1
>
> DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
>
> BUGCHECK_STR: 0xA
>
> PROCESS_NAME: taskeng.exe
>
> TRAP_FRAME: b2281c34 -- (.trap 0xffffffffb2281c34)
> ErrCode = 00000000
> eax=00000000 ebx=00000001 ecx=84d6bce8 edx=84d6bce8 esi=a6f99ac8
> edi=84d4fed8
> eip=82100cba esp=b2281ca8 ebp=b2281cbc iopl=0 nv up ei pl nz na pe
> cy
> cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000
> efl=00010207
> nt!KiUnwaitThread+0x14:
> 82100cba 8b08 mov ecx,dword ptr [eax]
> ds:0023:00000000=????????
> Resetting default scope
>
> LAST_CONTROL_TRANSFER: from 82100cba to 820a7d84
>
> STACK_TEXT:
> b2281c34 82100cba badb0d00 84d6bce8 dee619a0 nt!KiTrap0E+0x2ac
> b2281cbc 82100c60 00000002 0000c046 ff790008 nt!KiUnwaitThread+0x14
> b2281ce4 95f9184e 84d4fed0 00000002 00000000 nt!KeSetEvent+0xa0
> b2281d00 95f65285 ff790008 00000108 ff790008 win32k!SetWakeBit+0xda
> b2281d1c 95f653cf ff790008 0000c046 00000000
> win32k!_PostThreadMessage+0xb7
> b2281d4c 820a4a7a 00000c0c 0000c046 00000000
> win32k!NtUserPostThreadMessage+0x10e
> b2281d4c 77479a94 00000c0c 0000c046 00000000 nt!KiFastCallEntry+0x12a
> WARNING: Frame IP not in any known module. Following frames may be wrong.
> 0262e484 00000000 00000000 00000000 00000000 0x77479a94
>
>
> STACK_COMMAND: kb
>
> FOLLOWUP_IP:
> win32k!SetWakeBit+da
> 95f9184e 5e pop esi
>
> SYMBOL_STACK_INDEX: 3
>
> SYMBOL_NAME: win32k!SetWakeBit+da
>
> FOLLOWUP_NAME: MachineOwner
>
> MODULE_NAME: win32k
>
> IMAGE_NAME: win32k.sys
>
> DEBUG_FLR_IMAGE_TIMESTAMP: 47c78851
>
> FAILURE_BUCKET_ID: 0xA_win32k!SetWakeBit+da
>
> BUCKET_ID: 0xA_win32k!SetWakeBit+da
>
> Followup: MachineOwner
> ---------
>
>
>
> Any tips on solving this will be highly appreciated. I have already
 
Re: IRQL Not Less Or Equal crash, win32k.sys

Hello,

For starters, thank you for trying to help. I do however have some questions
regarding the solution you provided.

1) The task scheduler have like dozens of tasks that are triggered by
'start-up' or 'user log on', most of them are windows tasks. Should I look
for any in particular?

2) The event viewer also has millions of events stored. What exactly should
I look for?

3) I did look in msinfo32 but there are no devices using IRQ #27.


Best regards,
Rodrigo.

"Rick Rogers" wrote:

> Hi,
>
> Something in Task Scheduler is trying to run and falling over, or something
> is trying to load TS and it's crashing. The memory address being accessed is
> invalid (arg 1), and the hardware is using a virtual IRQ, number 27 (arg 2).
> Two approaches to this might help diagnose the problem:
>
> 1) Check TS for tasks trying to run at startup and shutdown. Check event
> viewer as well for mention of what's falling over.
>
> 2) Run msinfo32 from the start/search line and go to hardware resources/IRQ
> and see if there is a device using #27. If so, see if there is an updated
> driver for that device from the manufacturer.
>
> --
> Best of Luck,
>
> Rick Rogers, aka "Nutcase" - Microsoft MVP
> http://mvp.support.microsoft.com/
> Windows help - www.rickrogers.org
> My thoughts http://rick-mvp.blogspot.com
>
> "rodrigo.uchoa" <rodrigo.uchoa@discussions.microsoft.com> wrote in message
> news:0A525DF0-63DC-4895-BEC7-B8FEB080649B@microsoft.com...
> >I have a sony vaio laptiop with Windows Vista Home Premium with 4 gigs of
> > RAM. I have been frequently getting blue screen crashes right after
> > start-up
> > and shut-down.
> >
> > The complete dump file for the error is the following:
> >
> >
> > ------------------------------------------------------------------
> > IRQL_NOT_LESS_OR_EQUAL (a)
> > An attempt was made to access a pageable (or completely invalid) address
> > at an
> > interrupt request level (IRQL) that is too high. This is usually
> > caused by drivers using improper addresses.
> > If a kernel debugger is available get the stack backtrace.
> > Arguments:
> > Arg1: 00000000, memory referenced
> > Arg2: 0000001b, IRQL
> > Arg3: 00000000, bitfield :
> > bit 0 : value 0 = read operation, 1 = write operation
> > bit 3 : value 0 = not an execute operation, 1 = execute operation (only on
> > chips which support this level of status)
> > Arg4: 82100cba, address which referenced memory
> >
> > Debugging Details:
> > ------------------
> >
> >
> >
> >
> > READ_ADDRESS: GetPointerFromAddress: unable to read from 82184868
> > Unable to read MiSystemVaType memory at 82164420
> > 00000000
> >
> > CURRENT_IRQL: 1b
> >
> > FAULTING_IP:
> > nt!KiUnwaitThread+14
> > 82100cba 8b08 mov ecx,dword ptr [eax]
> >
> > CUSTOMER_CRASH_COUNT: 1
> >
> > DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
> >
> > BUGCHECK_STR: 0xA
> >
> > PROCESS_NAME: taskeng.exe
> >
> > TRAP_FRAME: b2281c34 -- (.trap 0xffffffffb2281c34)
> > ErrCode = 00000000
> > eax=00000000 ebx=00000001 ecx=84d6bce8 edx=84d6bce8 esi=a6f99ac8
> > edi=84d4fed8
> > eip=82100cba esp=b2281ca8 ebp=b2281cbc iopl=0 nv up ei pl nz na pe
> > cy
> > cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000
> > efl=00010207
> > nt!KiUnwaitThread+0x14:
> > 82100cba 8b08 mov ecx,dword ptr [eax]
> > ds:0023:00000000=????????
> > Resetting default scope
> >
> > LAST_CONTROL_TRANSFER: from 82100cba to 820a7d84
> >
> > STACK_TEXT:
> > b2281c34 82100cba badb0d00 84d6bce8 dee619a0 nt!KiTrap0E+0x2ac
> > b2281cbc 82100c60 00000002 0000c046 ff790008 nt!KiUnwaitThread+0x14
> > b2281ce4 95f9184e 84d4fed0 00000002 00000000 nt!KeSetEvent+0xa0
> > b2281d00 95f65285 ff790008 00000108 ff790008 win32k!SetWakeBit+0xda
> > b2281d1c 95f653cf ff790008 0000c046 00000000
> > win32k!_PostThreadMessage+0xb7
> > b2281d4c 820a4a7a 00000c0c 0000c046 00000000
> > win32k!NtUserPostThreadMessage+0x10e
> > b2281d4c 77479a94 00000c0c 0000c046 00000000 nt!KiFastCallEntry+0x12a
> > WARNING: Frame IP not in any known module. Following frames may be wrong.
> > 0262e484 00000000 00000000 00000000 00000000 0x77479a94
> >
> >
> > STACK_COMMAND: kb
> >
> > FOLLOWUP_IP:
> > win32k!SetWakeBit+da
> > 95f9184e 5e pop esi
> >
> > SYMBOL_STACK_INDEX: 3
> >
> > SYMBOL_NAME: win32k!SetWakeBit+da
> >
> > FOLLOWUP_NAME: MachineOwner
> >
> > MODULE_NAME: win32k
> >
> > IMAGE_NAME: win32k.sys
> >
> > DEBUG_FLR_IMAGE_TIMESTAMP: 47c78851
> >
> > FAILURE_BUCKET_ID: 0xA_win32k!SetWakeBit+da
> >
> > BUCKET_ID: 0xA_win32k!SetWakeBit+da
> >
> > Followup: MachineOwner
> > ---------
> >
> >
> >
> > Any tips on solving this will be highly appreciated. I have already
>
>
 
Re: IRQL Not Less Or Equal crash, win32k.sys

Hi,

1) Selectively begin disabling them until the problem stops.

2) Under Windows Logs, check the System and Application logs at the time of
the startup errors.

3) Not surprised, as it may be that the issue could be that it is trying to
invoke an IRQ that's not allocated.

--
Best of Luck,

Rick Rogers, aka "Nutcase" - Microsoft MVP
http://mvp.support.microsoft.com/
Windows help - www.rickrogers.org
My thoughts http://rick-mvp.blogspot.com

"rodrigo.uchoa" <rodrigouchoa@discussions.microsoft.com> wrote in message
news:EE135592-E3EC-4C9B-8A17-1FACCF32767D@microsoft.com...
> Hello,
>
> For starters, thank you for trying to help. I do however have some
> questions
> regarding the solution you provided.
>
> 1) The task scheduler have like dozens of tasks that are triggered by
> 'start-up' or 'user log on', most of them are windows tasks. Should I look
> for any in particular?
>
> 2) The event viewer also has millions of events stored. What exactly
> should
> I look for?
>
> 3) I did look in msinfo32 but there are no devices using IRQ #27.
>
>
> Best regards,
> Rodrigo.
>
> "Rick Rogers" wrote:
>
>> Hi,
>>
>> Something in Task Scheduler is trying to run and falling over, or
>> something
>> is trying to load TS and it's crashing. The memory address being accessed
>> is
>> invalid (arg 1), and the hardware is using a virtual IRQ, number 27 (arg
>> 2).
>> Two approaches to this might help diagnose the problem:
>>
>> 1) Check TS for tasks trying to run at startup and shutdown. Check event
>> viewer as well for mention of what's falling over.
>>
>> 2) Run msinfo32 from the start/search line and go to hardware
>> resources/IRQ
>> and see if there is a device using #27. If so, see if there is an updated
>> driver for that device from the manufacturer.
>>
>> --
>> Best of Luck,
>>
>> Rick Rogers, aka "Nutcase" - Microsoft MVP
>> http://mvp.support.microsoft.com/
>> Windows help - www.rickrogers.org
>> My thoughts http://rick-mvp.blogspot.com
>>
>> "rodrigo.uchoa" <rodrigo.uchoa@discussions.microsoft.com> wrote in
>> message
>> news:0A525DF0-63DC-4895-BEC7-B8FEB080649B@microsoft.com...
>> >I have a sony vaio laptiop with Windows Vista Home Premium with 4 gigs
>> >of
>> > RAM. I have been frequently getting blue screen crashes right after
>> > start-up
>> > and shut-down.
>> >
>> > The complete dump file for the error is the following:
>> >
>> >
>> > ------------------------------------------------------------------
>> > IRQL_NOT_LESS_OR_EQUAL (a)
>> > An attempt was made to access a pageable (or completely invalid)
>> > address
>> > at an
>> > interrupt request level (IRQL) that is too high. This is usually
>> > caused by drivers using improper addresses.
>> > If a kernel debugger is available get the stack backtrace.
>> > Arguments:
>> > Arg1: 00000000, memory referenced
>> > Arg2: 0000001b, IRQL
>> > Arg3: 00000000, bitfield :
>> > bit 0 : value 0 = read operation, 1 = write operation
>> > bit 3 : value 0 = not an execute operation, 1 = execute operation (only
>> > on
>> > chips which support this level of status)
>> > Arg4: 82100cba, address which referenced memory
>> >
>> > Debugging Details:
>> > ------------------
>> >
>> >
>> >
>> >
>> > READ_ADDRESS: GetPointerFromAddress: unable to read from 82184868
>> > Unable to read MiSystemVaType memory at 82164420
>> > 00000000
>> >
>> > CURRENT_IRQL: 1b
>> >
>> > FAULTING_IP:
>> > nt!KiUnwaitThread+14
>> > 82100cba 8b08 mov ecx,dword ptr [eax]
>> >
>> > CUSTOMER_CRASH_COUNT: 1
>> >
>> > DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
>> >
>> > BUGCHECK_STR: 0xA
>> >
>> > PROCESS_NAME: taskeng.exe
>> >
>> > TRAP_FRAME: b2281c34 -- (.trap 0xffffffffb2281c34)
>> > ErrCode = 00000000
>> > eax=00000000 ebx=00000001 ecx=84d6bce8 edx=84d6bce8 esi=a6f99ac8
>> > edi=84d4fed8
>> > eip=82100cba esp=b2281ca8 ebp=b2281cbc iopl=0 nv up ei pl nz na
>> > pe
>> > cy
>> > cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000
>> > efl=00010207
>> > nt!KiUnwaitThread+0x14:
>> > 82100cba 8b08 mov ecx,dword ptr [eax]
>> > ds:0023:00000000=????????
>> > Resetting default scope
>> >
>> > LAST_CONTROL_TRANSFER: from 82100cba to 820a7d84
>> >
>> > STACK_TEXT:
>> > b2281c34 82100cba badb0d00 84d6bce8 dee619a0 nt!KiTrap0E+0x2ac
>> > b2281cbc 82100c60 00000002 0000c046 ff790008 nt!KiUnwaitThread+0x14
>> > b2281ce4 95f9184e 84d4fed0 00000002 00000000 nt!KeSetEvent+0xa0
>> > b2281d00 95f65285 ff790008 00000108 ff790008 win32k!SetWakeBit+0xda
>> > b2281d1c 95f653cf ff790008 0000c046 00000000
>> > win32k!_PostThreadMessage+0xb7
>> > b2281d4c 820a4a7a 00000c0c 0000c046 00000000
>> > win32k!NtUserPostThreadMessage+0x10e
>> > b2281d4c 77479a94 00000c0c 0000c046 00000000 nt!KiFastCallEntry+0x12a
>> > WARNING: Frame IP not in any known module. Following frames may be
>> > wrong.
>> > 0262e484 00000000 00000000 00000000 00000000 0x77479a94
>> >
>> >
>> > STACK_COMMAND: kb
>> >
>> > FOLLOWUP_IP:
>> > win32k!SetWakeBit+da
>> > 95f9184e 5e pop esi
>> >
>> > SYMBOL_STACK_INDEX: 3
>> >
>> > SYMBOL_NAME: win32k!SetWakeBit+da
>> >
>> > FOLLOWUP_NAME: MachineOwner
>> >
>> > MODULE_NAME: win32k
>> >
>> > IMAGE_NAME: win32k.sys
>> >
>> > DEBUG_FLR_IMAGE_TIMESTAMP: 47c78851
>> >
>> > FAILURE_BUCKET_ID: 0xA_win32k!SetWakeBit+da
>> >
>> > BUCKET_ID: 0xA_win32k!SetWakeBit+da
>> >
>> > Followup: MachineOwner
>> > ---------
>> >
>> >
>> >
>> > Any tips on solving this will be highly appreciated. I have already
>>
>>
 

Similar threads

BSchwarz
Windows 7 Blue screen error in Windows 7
Replies
0
Views
240
BSchwarz
BSchwarz
BSchwarz
Windows 7 Blue screen error in Windows 7
Replies
0
Views
226
BSchwarz
BSchwarz
L
BSOD referencing win32k.sys; please help
2
Replies
26
Views
234
devil_himself
D
G
Minidump analysis
Replies
0
Views
154
Gary Roach
G
P
Windows Vista STOP 0XD1 Error on XP SP2
Replies
2
Views
161
Mrs. Putzke
M
Back
Top