Windows 7 Resource Kit- P34

the recommendations given, request assistance from your hardware manufacturer or a Microsoft support engineer .Stop 0xa or IRQL_NOT_LESS_OR_EQUaL The Stop 0xA message indicates that a ke

Trang 1

the recommendations given, request assistance from your hardware manufacturer or a Microsoft support engineer

Stop 0xa or IRQL_NOT_LESS_OR_EQUaL

The Stop 0xA message indicates that a kernel-mode process or driver attempted to access a memory location to which it did not have permission or at a kernel IRQL that was too high A kernel-mode process can access only other processes that have an IRQL lower than or equal

to its own This Stop message is typically the result of faulty or incompatible hardware or software

Interpreting the Message

This Stop message has four parameters:

1. Memory address that was improperly referenced

2. IRQL that was required to access the memory

3. Type of access (0x00 = read operation, 0x01 = write operation)

4. Address of the instruction that attempted to reference memory specified in parameter 1

If the last parameter is within the address range of a device driver used on your system, you can determine which device driver was running when the memory access occurred You can typically determine the driver name by reading the line that begins with

**Address 0xZZZZZZZZ has base at <address>- <driver name>

If the third parameter is the same as the first parameter, a special condition exists in which

a system worker routine—carried out by a worker thread to handle background tasks known

as work items—returned at a higher IRQL In that case, some of the four parameters take on

new meanings:

1. Address of the worker routine

2. Kernel IRQL

3. Address of the worker routine

4. Address of the work item

Resolving the problem

The following suggestions are specific to Stop 0xA errors For additional troubleshooting suggestions that apply to all Stop errors, see the section titled “Stop Message Checklist” later

in this chapter

n To resolve an error caused by a faulty device driver, system service, or basic input/output system (BIOS), follow these steps:

1. Restart your computer

2. Press F8 at the character-based menu that displays the operating system choices

Trang 2

3. Select the Last Known Good Configuration option from the Windows Advanced Options menu This option is most effective when only one driver or service is added at a time

n To resolve an error caused by an incompatible device driver, system service, virus scanner, or backup tool, follow these steps:

1. Check the System Log in Event Viewer for error messages that might identify the device or driver that caused the error

2. Try disabling memory caching of the BIOS

3. Run the hardware diagnostics supplied by the system manufacturer, especially the memory scanner For details on these procedures, see the owner’s manual for your computer

4. Make sure the latest Service Pack is installed

5. If your system has small computer system interface (SCSI) adapters, contact the adapter manufacturer to obtain updated Windows drivers Try disabling sync negotiation in the SCSI BIOS, checking the cabling and the SCSI IDs of each device, and confirming proper termination

6. For integrated device electronics (IDE) devices, define the onboard IDE port as Primary only Also, check each IDE device for the proper master/subordinate/stand-alone setting Try removing all IDE devices except for hard disks

n If you encounter a Stop 0xA message while upgrading to Windows 7, the problem might be due to an incompatible driver, system service, virus scanner, or backup To avoid problems while upgrading, simplify your hardware configuration and remove all third-party device drivers and system services (including virus scanners) prior to running setup After you have successfully installed Windows, contact the hardware manufacturer to obtain compatible updates For more information about simplifying your system for troubleshooting purposes, see Chapter 30

n If the Stop error occurs when resuming from hibernation or suspend, read Knowledge

Base articles 941492 at http://support.microsoft.com/kb/941492 and 945577 at

http://support.microsoft.com/kb/945577

n If the Stop error occurs when starting a mobile computer that has the lid closed, refer

to Knowledge Base article 941507 at http://support.microsoft.com/kb/941507

MoRe inFo For more information about Stop 0xa messages, see the Knowledge Base at

http://support.microsoft.com/ Search the Knowledge Base using the keywords 0x0000000A and 0xA.

Trang 3

Stop 0x1E or KMODE_EXCEpTION_NOT_HaNDLED

The Stop 0x1E message indicates that the Windows kernel detected an illegal or unknown processor instruction The problems that cause Stop 0x1E messages share similarities with those that generate Stop 0xA errors in that they can be due to invalid memory and access violations This default Windows error handler typically intercepts these problems if error-handling routines are not present in the code itself

1. Exception code that was not handled

2. Address at which the exception occurred

3. Parameter 0 of the exception

4. Parameter 1 of the exceptionThe first parameter identifies the exception generated Common exception codes include:

n 0x80000002: STATUS_DATATyPE_MISAlIgNMENT An unaligned data reference

was encountered The trap frame supplies additional information

n 0x80000003: STATUS_BREAKPOINT A breakpoint or ASSERT was encountered

when no kernel debugger was attached to the system

n 0xC0000005: STATUS_ACCESS_VIOlATION A memory access violation occurred

Parameter 4 of the Stop error (which is Parameter 1 of the exception) is the address that the driver attempted to access

n 0xC0000044: STATUS_QUOTA_EXCEEDED The text Insufficient Quota Exists To

Complete The Operation indicates a pool memory leak A quota allocation attempt necessary for the system to continue operating normally was unsuccessful because of

a program or driver memory leak The second parameter identifies the address of the module in which the error occurred Frequently, the address points to an individual driver or faulty hardware named on the third parameter of the Stop message Make a note of this address and the link date of the driver or image that contains it

The last two Stop message parameters vary, depending on the exception that has occurred

If the error code has no parameters, the last two parameters of the Stop message are listed as 0x00

The following suggestions are specific to Stop 0x1E errors For additional troubleshooting suggestions that apply to all Stop errors, see the section titled “Stop Message Checklist” later

in this chapter

Trang 4

n Stop 0x1E messages typically occur after you install faulty drivers or system services,

or they can indicate hardware problems, such as memory and interrupt request (IRQ) conflicts If a Stop message lists a driver by name, disable, remove, or roll back that driver to correct the problem If disabling or removing applications and drivers resolves the issue, contact the hardware manufacturer about a possible update Using updated software is especially important for multimedia applications, antivirus scanners, and CD mastering tools

n If the Stop message mentions the file Win32k sys, the source of the error might be a third-party remote control program If such software is installed, you might be able to disable it by starting the system in safe mode If not, use Startup Repair to manually delete the system service file that is causing the problem For more information about safe mode and Startup Repair, see Chapter 29

n Problems can result from system firmware incompatibilities You can resolve many Advanced Configuration and Power Interface (ACPI) issues by updating to the latest firmware

n Other possible causes include insufficient disk space while installing applications or performing certain functions that require more memory You can free up space by deleting unneeded files Use Disk Cleanup to increase available disk space For more information about Disk Cleanup, see Chapter 30

n The problem might be due to a memory leak caused by an application or service that

is not releasing memory correctly Poolmon (Poolmon exe) helps you to isolate the features that are causing kernel memory leaks For more information about trouble-shooting memory leaks, see Knowledge Base articles 177415, “How to Use Memory Pool Monitor (Poolmon exe) to Troubleshoot Kernel Mode Memory Leaks,” at

http://support.microsoft.com/kb/177415 and 298102, “How to Find Pool Tags That Are

Used by Third-Party Drivers,” at http://support.microsoft.com/kb/298102

MoRe inFo To find additional articles, search using the keywords poolmon, pool tag, pooltag, and memory leak For more information about Stop 0x1E messages, see the Knowledge Base at http://support.microsoft.com/ Search the Knowledge Base using the keyword 0x1E.

Trang 5

diReCt FRoM tHe SoURCe

Understanding Kernel Stack OverflowsOmer amin, Escalation Engineer

Microsoft Global Escalation Services Team

Kernel stack overflows are a common error in many cases reported to us by customers These are caused by drivers taking up too much space on the kernel stack This results in a kernel stack overflow, which will then crash the system with one of the following bugchecks:

n STOp 0x7F: UNEXpECTED_KERNEL_MODE_TRap with parameter 1 set to EXCEpTION_DOUBLE_FaULT, which is caused by running off the end of a kernel stack.

n STOp 0x1E: KMODE_EXCEpTION_NOT_HaNDLED, 0x7E: SYSTEM_THREaD_

EXCEpTION_NOT_HaNDLED, or 0x8E: KERNEL_MODE_EXCEpTION_NOT_

HaNDLED, with an exception code of STaTUS_aCCESS_VIOLaTION, which indicates a memory access violation.

n STOp 0x2B: paNIC_STaCK_SWITCH, which usually occurs when a kernel-mode driver uses too much stack space.

Each thread in the system is allocated with a kernel mode stack Code running on any kernel-mode thread (whether it is a system thread or a thread created by a driver) uses that thread’s kernel-mode stack unless the code is a deferred procedure call (DpC), in which case it uses the processor’s DpC stack on certain platforms.

The stack grows negatively This means that the beginning (bottom) of the stack has

a higher address than the end (top) of the stack For example, let’s say the beginning

of your stack is 0x80f1000, and this is where your stack pointer (ESp) is pointing If you push a DWORD value onto the stack, its address would be 0x80f0ffc The next DWORD value would be stored at 0x80f0ff8 and so on up to the limit (top) of the allocated stack The top of the stack is bordered by a guard page to detect overruns.

The size of the kernel-mode stack varies among different hardware platforms

For example, on 32-bit platforms, the kernel-mode stack is 12 KB, and on 64-bit platforms, the kernel-mode stack is 24 KB The stack sizes are hard limits that are imposed by the system, and all drivers need to use space conservatively so that they can coexist When we reach the top of the stack, one more push instruction is going

to cause an exception, which in turn can lead to a Stop error This could be either a simple push instruction or something along the lines of a call instruction that also pushes the return address onto the stack.

Trang 6

Stop 0x24 or NTFS_FILE_SYSTEM

The Stop 0x24 message indicates that a problem occurred within Ntfs sys, the driver file that allows the system to read and write to NTFS File System (NTFS) drives A similar Stop message, 0x23, exists for the file allocation table (FAT16 or FAT32) file system

1. Source file and line number

2. A non-zero value that contains the address of the exception record (optional)

3. A non-zero value that contains the address of the context record (optional)

4. A non-zero value that contains the address where the original exception occurred (optional)

Parameters for this Stop message are useful only to Microsoft technical support with access

to Windows source code Stop messages resulting from file system issues have the source file and the line number within the source file that generated the error encoded in their first parameter The first four hexadecimal digits (also known as the high 16 bits) after the 0x identify the source file number, and the last four hexadecimal digits (the low 16 bits) identify the source line in the file where the stop occurred

The following suggestions are specific to Stop 0x24 errors For additional troubleshooting suggestions that apply to all Stop errors, see the section titled “Stop Message Checklist” later

n Verify that the tools you use to continually monitor your system—such as virus ners, backup programs, or disk defragmenters—are compatible with Windows Some disks and adapters come packaged with diagnostic software that you can use to run hardware tests For more information, see the documentation for your computer, hard disk, or controller

scan-n Check your hard disk for problems For more information, see Chapter 30

n Nonpaged pool memory might be depleted, which can cause the system to stop You can resolve this situation by adding more RAM, which increases the quantity of nonpaged pool memory available to the kernel

Trang 7

MoRe inFo For more information about Stop 0x24 messages, see the Knowledge Base at

http://support.microsoft.com/ Search the Knowledge Base using the keywords 0x00000024 and 0x24.

Stop 0x2E or DaTa_BUS_ERROR

The Stop 0x2E message indicates a system memory parity error The cause is typically failed

or defective RAM (including motherboard, Level 2 (L2) cache, or video memory), ible or mismatched memory hardware, or a device driver attempting to access an address in

incompat-the 0x8xxxxxxx range that does not exist (meaning that it does not map to a physical address)

A Stop 0x2E message can also indicate hard disk damage caused by viruses or other problems

1. Virtual address that caused the fault

2. Physical address that caused the fault

3. Processor status register

4. Faulting instruction register

The following suggestions are specific to Stop 0x2E errors For additional troubleshooting suggestions that apply to all Stop errors, see the section titled “Stop Message Checklist” later

in this chapter

n Stop 0x2E is typically the result of defective, malfunctioning, or failed memory ware, such as memory modules, L2 SRAM cache, or video adapter RAM If you added new hardware recently, remove the hardware and replace it to determine whether it

hard-is causing or contributing to the problem Run Windows Memory Diagnostics as described in Chapter 30 to determine whether the feature has failed

n Stop 0x2E messages can also occur after you install faulty drivers or system services If

a driver file name is given, you need to disable, remove, or roll back that driver Disable the service or application and confirm that this resolves the error If so, contact the hardware manufacturer about a possible update Using updated software is especially important for backup programs, multimedia applications, antivirus scanners, and CD mastering tools

n Hard disk corruption can also cause this Stop message For more information about checking hard disk integrity, see Chapter 30

Trang 8

n The problem might also be due to cracks, scratched traces, or defective features on the motherboard If all else fails, take the system motherboard to a repair facility for diagnostic testing

MoRe inFo For more information about Stop 0x2E messages, see the Knowledge Base at

http://support.microsoft.com/ Search the Knowledge Base using the keywords 0x0000002E and 0x2E.

Stop 0x3B or SYSTEM_SERVICE_EXCEpTION

The Stop 0x3B message indicates that an exception happened while executing a routine that transitions from nonprivileged code to privileged code

This Stop message has three parameters:

1. The exception that caused the bugcheck

2. The address of the exception record for the exception that caused the bugcheck

3. The address of the context record for the exception that caused the bugcheck

This error has been linked to excessive paged pool usage and may occur due to user-mode graphics drivers crossing over and passing bad data to the kernel code To resolve the problem, update to the latest driver for your video card If you currently have the latest version installed, try rolling back to an earlier version

MoRe inFo For more information about Stop 0x3B messages, see the Knowledge Base at

http://support.microsoft.com/ Search the Knowledge Base using the keywords 0x0000003b and 0x3b.

Stop 0x3F or NO_MORE_SYSTEM_pTES

The Stop 0x3F message indicates one or more of the following problems:

n The system Page Table Entries (PTEs) are depleted or fragmented because the system

is performing a large number of input/output (I/O) actions

n A faulty device driver is not managing memory properly

n An application, such as a backup program, is improperly allocating large amounts of kernel memory

Trang 9

Depending on the configuration of your system, the value of the first parameter might vary The following are possible values for the first parameter and the information returned:

n 0x0A PTE type: 0x00 = system expansion, 0x01 = nonpaged pool expansion

n 0x0B Requested size

n 0x0C Total free system PTEs

n 0x0D Total system PTEs

The following suggestions are specific to Stop 0x3F errors For additional troubleshooting suggestions that apply to all Stop errors, see the section titled “Stop Message Checklist” later

in this chapter

n Stop 0x3F messages can occur after you install faulty drivers or system services If a driver file name is given, you need to disable, remove, or roll back that driver Disable the service or application and confirm that this resolves the error If so, contact the hardware manufacturer about a possible update Using updated software is especially important for backup programs, multimedia applications, antivirus scanners, and CD mastering tools

n The system might not actually be out of PTEs, but a contiguous memory block of ficient size may not be available to satisfy a driver or application request Check for the availability of updated driver or application files and consult the hardware or program documentation for minimum system requirements

suf-A related Stop message, 0xD8: DRIVER_USED_EXCESSIVE_PTES, is described in the section titled “Stop 0xD8 or DRIVER_USED_EXCESSIVE_PTES” later in this chapter

MoRe inFo For more information about Stop 0x3F messages, see the Knowledge Base at

http://support.microsoft.com/ Search the Knowledge Base using the keywords 0x0000003F and 0x3F.

Stop 0x50 or paGE_FaULT_IN_NONpaGED_aREa

The Stop 0x50 message indicates that requested data was not in memory The system generates an exception error when using a reference to an invalid system memory address Defective memory (including main memory, L2 RAM cache, and video RAM) or incompatible software (including remote control and antivirus software) might cause Stop 0x50 messages

Trang 10

1. Memory address that caused the fault

3. If not zero, the instruction address that referenced the address in parameter 0x01

4. This parameter is reserved (set aside for future use)

in this chapter

n If you added new hardware recently, remove and replace the hardware to determine whether it is causing or contributing to the problem Run Windows Memory Diagnostics

as described in Chapter 30 to determine whether the feature has failed

n Stop 0x50 messages can also occur after you install faulty drivers or system services

If the driver file name is listed, you need to disable, remove, or roll back that driver

If not, disable the recently installed service or application to determine whether this resolves the error If this does not resolve the problem, contact the hardware manu-facturer for updates Using updated drivers and software is especially important for network interface cards, video adapters, backup programs, multimedia applications, antivirus scanners, and CD mastering tools If an updated driver is not available, attempt

to use a driver from a similar device in the same family For example, if printing to a Model 1100C printer causes Stop 0x50 errors, using a printer driver meant for a Model 1100A or Model 1000 might temporarily resolve the problem

n Check your hard disk for problems For more information, see Chapter 30

http://support.microsoft.com/ Search the Knowledge Base using the keywords 0x00000050 and 0x50 Specifically, refer to Knowledge Base article 938239.

Stop 0x77 or KERNEL_STaCK_INpaGE_ERROR

The Stop 0x77 message indicates that a page of kernel data requested from the paging (virtual memory) file could not be found or read into memory This Stop message can also indicate disk hardware failure, disk data corruption, or possible virus infection

This Stop message has four parameters The following set of definitions applies only if the first and third parameters are both zero:

1. This value is 0x00 (zero)

Trang 11

2. Value found in the stack

4. Address of signature on kernel stack Otherwise, the following definitions apply:

1. Status code

2. I/O status code

3. Page file number

4. Offset into page fileFrequently, you can determine the cause of this error from the second parameter, the I/O status code Some common status codes include the following:

n 0xC000009A, or STATUS_INSUFFICIENT_RESOURCES, indicates a lack of nonpaged pool resources

n 0xC000009C, or STATUS_DEVICE_DATA_ERROR, generally indicates bad blocks (sectors)

on the hard disk

n 0xC000009D, or STATUS_DEVICE_NOT_CONNECTED, indicates defective or loose data

or power cables, a problem with SCSI termination, or improper controller or hard disk configuration

n 0xC000016A, or STATUS_DISK_OPERATION_FAILED, also indicates bad blocks (sectors)

on the hard disk

n 0xC0000185, or STATUS_IO_DEVICE_ERROR, indicates improper termination, defective storage controller hardware, defective disk cabling, or two devices attempting to use the same system resources

in this chapter

n Stop 0x77 messages can be caused by bad sectors in the virtual memory paging file

or a disk controller error In extremely rare cases, depleted nonpaged pool resources can cause this error If the first and third parameters are zero, the stack signature in the kernel stack is missing, an error that is typically caused by defective hardware If the I/O status is 0xC0000185 and the paging file is on a SCSI disk, check for cabling and termination issues An I/O status code of 0xC000009C or 0xC000016A indicates that the requested data could not be found You can try to correct this by restarting the computer Additionally, use ChkDsk to check the disk for problems For more informa-tion about ChkDsk, see Chapter 30

n Another cause of Stop 0x77 messages is defective, malfunctioning, or failed memory hardware, such as memory modules, L2 SRAM cache, or video adapter RAM If you

Trang 12

added new hardware recently, remove and replace the hardware to determine whether

it is causing or contributing to the problem Run Windows Memory Diagnostics as described in Chapter 30 to determine whether the feature has failed

n Problems that cause Stop 0x77 messages can also cause Stop 0x7A messages For more information about Stop 0x7A messages, see the following section, “Stop 0x7A or KERNEL_DATA_INPAGE_ERROR ”

http://support.microsoft.com/ Search the Knowledge Base using the keywords 0x00000077 and 0x77.

Stop 0x7a or KERNEL_DaTa_INpaGE_ERROR

The Stop 0x7A message indicates that a page of kernel data was not found in the paging (virtual memory) file and could not be read into memory This might be due to incompatible disk or controller drivers, firmware, or hardware

1. Lock type value (0x01, 0x02, 0x03, or PTE address)

2. I/O status code

3. If the lock type is 0x01, this parameter represents the current process; if the lock type is 0x03, this parameter represents the virtual address

4. The virtual address that could not be read into memory Frequently, the cause of this error can be determined from the second parameter, the I/O status code Some common status codes are the following:

n 0xC000009A, or STATUS_INSUFFICIENT_RESOURCES, indicates a lack of nonpaged pool resources

n 0xC000009C, or STATUS_DEVICE_DATA_ERROR, indicates bad blocks (sectors) on the hard disk

n 0xC000009D, or STATUS_DEVICE_NOT_CONNECTED, indicates defective or loose data

or power cables, a problem with SCSI termination, or improper controller or disk configuration

n 0xC000016A, or STATUS_DISK_OPERATION_FAILED, indicates bad blocks (sectors) on the hard disk

Trang 13

n 0xC0000185, or STATUS_IO_DEVICE_ERROR, indicates improper termination, defective storage controller hardware, defective disk cabling, or two devices attempting to use the same resources

The following suggestions are specific to Stop 0x7A errors For additional troubleshooting suggestions that apply to all Stop errors, see the section titled “Stop Message Checklist” later

in this chapter

n Stop 0x7A can be caused by bad sectors in the virtual memory paging file, disk troller error, virus infection, or memory hardware problems In extremely rare cases, depleted nonpaged pool resources can cause this error If the first and third parameters are zero, the stack signature in the kernel stack is missing, an error typically caused

con-by defective hardware If the I/O status is 0xC0000185 and the paging file is on a SCSI disk, check for cabling and termination issues An I/O status code of 0xC000009C or 0xC000016A indicates that the requested data could not be found You can try to cor-rect this by restarting the computer If a problem with disk integrity exists, Autochk—a program that attempts to mark bad disk sectors as defective so that they are not used

in the future—starts automatically If Autochk fails to run, you can manually perform the integrity check yourself by following the instructions to run ChkDsk provided in the section titled “Stop 0x24 or NTFS_FILE_SYSTEM” earlier in this chapter For more information about ChkDsk, see Chapter 30

n Another cause of Stop 0x7A messages is defective, malfunctioning, or failed memory hardware, such as memory modules, L2 SRAM cache, or video adapter RAM If you added new hardware recently, remove and replace the hardware to determine whether

it is causing or contributing to the problem Run Windows Memory Diagnostics as described in Chapter 30 to determine whether the feature has failed

n Check the hardware manufacturer’s Web site for updates to disk adapter firmware

or drivers that improve compatibility Verify that your disks and controller support the same set of advanced features, such as higher transfer rates If necessary, select a slower transfer rate if an update is not yet available Consult your hardware or device documentation for more information

n Problems that cause Stop 0x7A messages can also cause Stop 0x77 messages For more information about Stop 0x77 messages, see the section titled “Stop 0x77 or KERNEL_STACK_INPAGE_ERROR” earlier in this chapter

MoRe inFo For more information about Stop 0x7a messages, see the Knowledge Base at

http://support.microsoft.com/ Search the Knowledge Base using the keywords 0x0000007A and 0x7A.

Trang 14

Stop 0x7B or INaCCESSIBLE_BOOT_DEVICE

The Stop 0x7B message indicates that Windows has lost access to the system partition or boot volume during the startup process Installing incorrect device drivers when installing or upgrading storage adapter hardware typically causes Stop 0x7B errors Stop 0x7B errors could also indicate a possible virus infection

1. The address of a Unicode string data structure representing the Advanced RISC Computing (ARC) specification name of the device at which you attempted startup

2. Pointer to ARC name string in memory

4. This value is 0x00 (zero) The first parameter typically contains two separate pieces of data For example, if the parameter is 0x00800020, 0x0020 is the actual length of the Unicode string and 0x0080 is the maximum ARC name string length The next parameter contains the address of the buffer This address is in system space, so the high-order bit is set

If the file system is unable to mount the boot device or simply does not recognize the data

on the boot device as a file system structure, the following parameter definition applies:

1. The address of the device object that could not be mounted

2. Error code value or 0x00 (zero)

4. This value is 0x00 (zero) The value of the first parameter determines whether the parameter is a pointer to an ARC name string (ARC names are a generic method of identifying devices within the ARC environ-ment) or a device object because a Unicode string never has an odd number of bytes, and a device object always has a Type code of 0003

The second parameter is very important, because it can indicate whether the Stop 0x7B message was caused by file system issues or problems with storage hardware and drivers Values of 0xC000034 or 0xC000000E typically indicate:

n Disks or storage controllers that are failing, defective, or improperly configured

n Storage-related drivers or programs (tape management software, for example) that are not fully compatible with Windows

The following suggestions are specific to Stop 0x7B errors For additional troubleshooting suggestions that apply to all Stop errors, see the section titled “Stop Message Checklist” later

in this chapter

Trang 15

n During I/O system initialization, the controller or driver for the startup device (typically the hard disk) might have failed to initialize the necessary hardware File system initial-ization might have failed because of disk or controller failure or because the file system did not recognize the data on the boot device

n Repartitioning disks, adding new disks, or upgrading to a new disk controller might cause the information in the Windows Boot Manager or boot configuration data (BCD) file to become outdated If this Stop message occurs after you install new disks to your system, edit the BCD file or adjust the Boot Manager parameters to allow the system

to start If the error occurs after upgrading the disk controller, verify that the new hardware is functioning and correctly configured For more information about Windows Boot Manager, the BCD file, and automatically correcting configuration problems, see Chapter 29

n Verify that the system firmware and disk controller BIOS settings are correct and that the storage device was properly installed If you are unsure, consult your computer’s documentation about restoring default firmware settings or configuring your system

to auto-detect settings If the error occurs during Windows setup, the problem might

be due to unsupported disk controller hardware In some cases, drivers for new ware are not in the Driver cab library, and you need to provide additional drivers to complete Windows setup successfully If this is the case, follow the hardware manufac-turer’s instructions when installing drivers Periodically check for driver and firmware updates

hard-n Hard disk corruption can also cause this Stop message For more information about checking hard disk integrity, see the instructions provided in the section titled “Stop 0x24 or NTFS_FILE_SYSTEM” earlier in this chapter

n Problems that cause 0x7B errors might also cause Stop 0xED errors For more tion about Stop 0xED messages, see the section titled “Stop 0xED or UNMOUNTABLE_

informa-BOOT_VOLUME” later in this chapter

MoRe inFo For more information about Stop 0x7B messages, see the Knowledge

Base at http://support.microsoft.com/ Search the Knowledge Base using the keywords 0x0000007b, 0x7b, and Txtsetup.oem Specifically, refer to Knowledge Base article 935806.

Trang 16

1. Processor exception code

4. This value is 0x00 (zero) The first parameter is the most important and can have several different values, indicating different causes of this error You can find all conditions that cause a Stop 0x7F in any x86 microprocessor reference manual because they are specific to the x86 platform Some of the most common exception codes are the following:

n 0x00, or a divide-by-zero error, occurs when a divide (DIV) instruction is run and the divisor is 0 Memory corruption, other hardware failures, or software problems can cause this message

n 0x04, or Overflow, occurs when the processor carries out a call to an interrupt handler when the overflow (OF) flag is set

n 0x05, or Bounds Check Fault, indicates that the processor, while carrying out a BOUND instruction, found that the operand exceeded the specified limits BOUND instructions are used to ensure that a signed array index is within a certain range

n 0x06, or Invalid Opcode, is generated when the processor attempts to run an invalid instruction This typically occurs when the instruction pointer is corrupted as a result of

a hardware memory problem and is pointing to a wrong location

n 0x08, or Double Fault, indicates an exception while trying to call the handler for a prior exception Normally, two exceptions can be handled serially, but certain exceptions (almost always caused by hardware problems) cause the processor to signal a double fault

Less common codes include the following:

n 0x01 A system-debugger call

n 0x03 A debugger breakpoint

n 0x0A A corrupted Task State Segment

n 0x0B An access to a memory segment that was not present

n 0x0C An access to memory beyond the limits of a stack

n 0x0D An exception not covered by some other exception; a protection fault that

pertains to access violations for applications

Trang 17

in this chapter

n Stop 0x7F messages are typically the result of defective, malfunctioning, or failed memory hardware If you added new hardware recently, remove and replace the hard-ware to determine whether it is causing or contributing to the problem Run Windows Memory Diagnostics as described in Chapter 30 to determine whether the feature has failed

n Running the CPU beyond the rated specification, known as overclocking, can cause

Stop 0x7F or other error messages because of heat buildup When diagnosing lems on overclocked systems, first restore all clock and bus speed settings to the manufacturer-recommended values to determine whether this resolves the issues

prob-n The problem might also be due to cracks, scratched traces, or defective features on the motherboard If all else fails, take the system motherboard to a repair facility for diagnostic testing

n Stop 0x7F messages can occur after you install incompatible applications, drivers, or system services Contact the software manufacturer about possible Windows 7–specific updates Using updated software is especially important for backup programs, multi-media applications, antivirus scanners, and CD mastering tools

http://support.microsoft.com/ Search the Knowledge Base using the keywords 0x0000007F and 0x7F.

Stop 0x9F or DRIVER_pOWER_STaTE_FaILURE

The Stop 0x9F message indicates that a driver is in an inconsistent or invalid power state

Table 32-1 describes the information provided by Stop 0x9F messages The value of the first parameter indicates the type of violation (see the Description column) and determines the meaning of the next three parameters

Trang 18

TABlE 32-1 Parameter Listings for Stop Message 0x9F

PARAMETER 1 PARAMETER 2 PARAMETER 3 PARAMETER 4 DESCRIPTION

0x01 Pointer to

the device object

Reserved Reserved The device object being

freed still has an incomplete power request pending 0x02 Pointer to

the target device object

Pointer to the device object

Reserved The device object

complet-ed the I/O request packet for the system power state request but failed to call

PoStartNextPowerIrp

0x03 Pointer to

the target device object

Pointer to the device object

The I/O request packet

The device driver did not properly set the I/O request packets pending or complete the I/O request packet

0x00000100 Pointer

to the nonpaged device object

Pointer to the target device object

Pointer to the device object to notify

The device objects in the devnode were inconsistent

in their use of DO_POWER_PAGABLE 0x00000101 Child device

object

Child device object

Parent device object

A parent device object has detected that a child device has not set the

DO_POWER_PAGABLE bit

This Stop error typically occurs during events that involve power state transitions, such as shutting down, suspending, or resuming from sleep

in this chapter

n Stop 0x9F messages can occur after you install faulty applications, drivers, or system services If a file is listed by name and you can associate it with an application, unin-stall the application For drivers, disable, remove, or roll back that driver to determine whether this resolves the error If it does, contact the hardware manufacturer for a possible update Using updated software is especially important for backup programs, multimedia applications, antivirus scanners, and CD mastering tools

n Stop 0x9F messages can occur when you perform one of the following operations:

• Connect to a shared printer on the network, and then run the “Common Scenario Stress with IO” test in Driver Test Manager (DTM)

• Print to a shared printer on the network

Trang 19

• Perform a power management operation For example, put the computer to sleep

or into hibernation Or wake the computer from sleep or from hibernation

http://support.microsoft.com/ Search the Knowledge Base using the keywords 0x0000009F and 0x9F Specifically, refer to Knowledge Base articles 937322, 941858, 937322, 937500,

and 931671.

Stop 0xBE or aTTEMpTED_WRITE_TO_REaDONLY_MEMORY

The Stop 0xBE message indicates that a driver attempted to write to read-only memory

1. Virtual address of attempted write

2. PTE contents

3. Reserved

4. Reserved

A Stop 0xBE message might occur after you install a faulty device driver, system service, or firmware If a Stop message lists a driver by name, disable, remove, or roll back that driver

to correct the problem If disabling or removing drivers resolves the issues, contact the manufacturer about a possible update Using updated software is especially important for multimedia applications, antivirus scanners, DVD playback, and CD mastering tools

MoRe inFo For more information about Stop 0xBE messages, see the Knowledge Base at

http://support.microsoft.com/ Search the Knowledge Base using the keywords 0x000000bE and 0xbE.

Stop 0xC2 or BaD_pOOL_CaLLER

The Stop 0xC2 message indicates that a kernel-mode process or driver incorrectly attempted

to perform memory operations in the following ways:

n By allocating a memory pool size of zero bytes

n By allocating a memory pool that does not exist

n By attempting to free a memory pool that is already free

n By allocating or freeing a memory pool at an IRQL that was too highThis Stop message is typically the result of a faulty driver or software

Trang 20

Table 32-2 describes the information provided by Stop 0xC2 messages The value of the first parameter indicates the type of violation (see the Description column) and determines the meaning of the next three parameters

TABlE 32-2 Parameter Listings for Stop Message 0xC2

PARAMETER 1 PARAMETER 2 PARAMETER 3 PARAMETER 4 DESCRIPTION

0x00 This value is

always 0

The pool type being allocated

The pool tag being used

The caller is requesting a zero-byte pool allocation

0x01, 0x02,

or 0x04

Pointer to pool header

First part of pool header contents

This value is always zero

Pool header has been corrupted

0x06 Reserved Pointer to

pool header

Pool header contents

Attempt to free a memory pool that was already freed0x07 Reserved Pointer to

pool header

Attempt to free a memory pool that was already freed0x08 Current IRQL Pool type Size of

Attempt to free usermode address to kernel pool

0x41 Starting

address

Physical page frame

Highest physical page frame

Attempt to free a nonallocated nonpaged pool address

0x42 or 0x43

Address being freed

Attempt to free a virtual address that was never in any pool

0x50 Starting

address

Start offset in pages from beginning of paged pool

Size in bytes

of paged pool

Attempt to free a nonallocated paged pool address

0x99 Address

being freed

Attempt to free pool with invalid address or corruption in pool header0x9A Pool type Size of

allocation

in bytes

Allocation’s pool tag

Attempt to allocate must succeed

Trang 21

The following suggestions are specific to Stop 0xC2 errors For additional troubleshooting suggestions that apply to all Stop errors, see the section titled “Stop Message Checklist” later

in this chapter

n A Stop 0xC2 message might occur after you install a faulty device driver, system service,

or firmware If a Stop message lists a driver by name, disable, remove, or roll back that driver to correct the problem If disabling or removing drivers resolves the issues, contact the manufacturer about a possible update Using updated software is especially important for multimedia applications, antivirus scanners, DVD playback, and CD mastering tools

n A Stop 0xC2 message might also be due to failing or defective hardware If a Stop sage points to a category of devices (such as disk controllers, for example), try remov-ing or replacing the hardware to determine whether it is causing the problem For more information, see Chapter 30

mes-n If you encounter a Stop 0xC2 message while upgrading to Windows, the problem might be due to an incompatible driver, system service, virus scanner, or backup To avoid problems while upgrading, simplify your hardware configuration and remove all third-party device drivers and system services (including virus scanners) prior to running setup After you have successfully installed Windows, contact the hardware manufacturer to obtain compatible updates

MoRe inFo For more information about Stop 0xC2 messages, see the Knowledge Base at

http://support.microsoft.com/ Search the Knowledge Base using the keywords 0x000000C2 and 0xC2.

Stop 0xCE or DRIVER_UNLOaDED_WITHOUT_CaNCELLING_

pENDING_OpERaTIONS

This Stop message indicates that a driver failed to cancel pending operations before exiting

1. Memory address referenced

3. If non-zero, the address of the instruction that referenced the incorrect memory location

4. Reserved

Trang 22

Stop 0xCE messages can occur after you install faulty drivers or system services If a driver

is listed by name, disable, remove, or roll back that driver to resolve the error If disabling or removing drivers resolves the error, contact the manufacturer about a possible update Using updated software is especially important for backup programs, multimedia applications, antivirus scanners, DVD playback, and CD mastering tools

MoRe inFo For more information about Stop 0xCE messages, see the Knowledge Base at

http://support.microsoft.com/ Search the Knowledge Base using the keywords 0x000000CE and 0xCE.

Stop 0xD1 or IRQL_NOT_LESS_OR_EQUaL

The Stop 0xD1 message indicates that the system attempted to access pageable memory using a kernel process IRQL that was too high Drivers that have used improper addresses typically cause this error

1. Memory referenced

2. IRQL at time of reference

4. Address that referenced memory

Stop 0xD1 messages can occur after you install faulty drivers or system services If a driver

is listed by name, disable, remove, or roll back that driver to resolve the error If disabling or removing drivers resolves the error, contact the manufacturer about a possible update Using updated software is especially important for backup programs, multimedia applications, antivirus scanners, DVD playback, and CD mastering tools

MoRe inFo For more information about Stop 0xD1 messages, see the Knowledge Base at

http://support.microsoft.com/ Search the Knowledge Base using the keywords 0x000000D1 and 0xD1.

Trang 23

Stop 0xD8 or DRIVER_USED_EXCESSIVE_pTES

The Stop 0xD8 message typically occurs if your computer runs out of PTEs because a driver requests large amounts of kernel memory

Depending on the configuration of your system, the number of parameters returned might vary The four possible values are:

1. If this parameter has a non-null value, it contains the name of the driver that caused the Stop error

2. If the first parameter has a non-null value, this parameter contains the number of PTEs used by the driver that is causing the error

3. This parameter represents the total number of free system PTEs

4. This parameter represents the total number of system PTEs

For suggestions about resolving problems related to inadequate PTEs, see the section titled

“Stop 0x3F or NO_MORE_SYSTEM_PTES” earlier in this chapter

MoRe inFo For more information about Stop 0xD8 messages, see the Knowledge Base at

http://support.microsoft.com/ Search the Knowledge Base using the keywords 0x000000D8 and 0xD8.

Stop 0xEa or THREaD_STUCK_IN_DEVICE_DRIVER

In Stop 0xEA errors, a device driver problem is causing the system to pause indefinitely cally, this problem is caused by a display driver waiting for the video hardware to enter an idle state This might indicate a hardware problem with the video adapter or a faulty video driver

Typi-Interpreting the Message

1. Pointer to the thread object that is caught in an infinite loop

2. Pointer to a DEFERRED_WATCHDOG object, which is useful when using a kernel debugger to find out more information about this problem

3. Pointer to Graphics Device Interface (GDI)–supplied context

4. Additional debugging information

Trang 24

Stop 0xEA messages can occur after you install faulty drivers (especially video drivers) or system services If a driver is listed by name, disable, remove, or roll back that driver to resolve the error If disabling or removing drivers resolves the error, contact the manufacturer about a possible update Using updated software is especially important for backup programs, multi-media applications, antivirus scanners, DVD playback, and CD mastering tools

MoRe inFo For more information about Stop 0xEa messages, see the Knowledge Base at

http://support.microsoft.com/ Search the Knowledge Base using the keywords 0x000000EA and 0xEA.

Stop 0xED or UNMOUNTaBLE_BOOT_VOLUME

The kernel-mode I/O subsystem attempted to mount the boot volume and failed This error might also occur during an upgrade to Windows 7 on systems that use higher-throughput ATA disks or controllers with incorrect cabling In some cases, your system might appear to work normally after you restart

This Stop message has two parameters:

1. Device object of the boot volume

2. Status code from the file system on why it failed to mount the volume

The following suggestions are specific to Stop 0xED errors For additional troubleshooting suggestions that apply to all Stop errors, see the section titled “Stop Message Checklist” later

in this chapter

n If you are using higher-throughput ATA disks and controllers, which are those capable

of data transfer rates above 33 3 MB/sec, replace the standard 40-pin cable with an 80-pin cable Using an 80-pin cable is optional for transfer rates up to and including

33 3 MB/sec, but it is mandatory for higher transfer rates The additional grounded pins are required to avoid data loss

n Some firmware allows you to force higher transfer rates even when you are using the incorrect cable type Your firmware might issue a warning but allow the startup process

to proceed Restore the default firmware setting for ATA cable detection

n Problems that cause 0xED errors might also cause Stop 0x7B errors For more information about 0x7B Stop messages, see the section titled “Stop 0x7B or INACCESSIBLE_BOOT_DEVICE” earlier in this chapter

Trang 25

MoRe inFo For more information about Stop 0xED messages, see the Knowledge Base at

http://support.microsoft.com/ Search the Knowledge Base using the keywords 0x000000ED and 0xED.

Stop 0xFE or BUGCODE_USB_DRIVER

The Stop 0xFE message occurs if the kernel detects an error in a USB driver

This Stop message has four parameters Parameter 1 indicates the type of violation, whereas parameters 2 through 4 provide more information specific to that error type Typically, only parameter 1 is useful to system administrators, although parameters 2 through 4 might be useful to Microsoft developers, who will be able to extract that information from the memory dump

Parameter 1 can have a value of 0x1 to 0x5, as described here:

1. An internal error has occurred in the USB stack

2. The USB client driver has submitted a USB request block (URB) that is still attached to another I/O request packet (IRP) that is pending in the bus driver

3. The USB miniport driver has generated a Stop error This usually happens in response

to a catastrophic hardware failure

4. The caller has submitted an IRP that is already pending in the USB driver

5. A hardware failure has occurred because of a bad physical address found in a hardware data structure This is not due to a driver bug

The following suggestions are specific to Stop 0xFE errors For additional troubleshooting suggestions that apply to all Stop errors, see the section titled “Stop Message Checklist” later

in this chapter

To resolve this problem, follow these procedures:

1. Check the computer or motherboard manufacturer’s Web site for updated system firmware

2. Upgrade the firmware and drivers of all USB devices attached to the computer

3. Verify that all hardware is compatible with Windows 7

4. Remove USB devices and external hubs one by one and determine whether the Stop error reoccurs If the Stop error does not reoccur when a specific device is not at-tached, that device might be malfunctioning, or it might not be compatible with Windows Contact the device manufacturer for additional support

5. If problems persist, you might have a computer hardware failure Contact your computer manufacturer for additional assistance

Tiêu đề	Windows 7 Resource Kit - P34
Chuyên ngành	Computer Troubleshooting
Thể loại	Guide

Định dạng
Số trang	50
Dung lượng	0,92 MB