The following Stop error descriptions can help you to troubleshoot problems that cause Stop errors. If errors persist after you have
followed the recommendations given, request assistance from your
hardware manufacturer or a Microsoft support engineer.
1. Stop 0xA or IRQL_NOT_LESS_OR_EQUAL
The Stop 0xA message
indicates that a kernel-mode process or driver attempted to access a
memory location to which it did not have permission or at a kernel IRQL
that was too high. A kernel-mode process can access only other processes
that have an IRQL lower than or equal to its own. This Stop message is
typically the result of faulty or incompatible hardware or software.
1.1. Interpreting the Message
This Stop message has four parameters:
Memory address that was improperly referenced
IRQL that was required to access the memory
Type of access (0x00 = read operation, 0x01 = write operation)
Address of the instruction that attempted to reference memory specified in parameter 1
If the last parameter is
within the address range of a device driver used on your system, you can
determine which device driver was running when the memory access
occurred. You can typically determine the driver name by reading the
line that begins with
**Address 0xZZZZZZZZ has base at <address>- <driver name>
If the third parameter is
the same as the first parameter, a special condition exists in which a
system worker routine—carried out by a worker thread to handle
background tasks known as work items—returned at a higher IRQL. In that case, some of the four parameters take on new meanings:
Address of the worker routine
Address of the worker routine
1.2. Resolving the Problem
The following
suggestions are specific to Stop 0xA errors. For additional
troubleshooting suggestions that apply to all Stop errors.
To resolve an error caused by a faulty device driver, system service, or basic input/output system (BIOS), follow these steps:
Press F8 at the character-based menu that displays the operating system choices.
Select
the Last Known Good Configuration option from the Windows Advanced
Options menu. This option is most effective when only one driver or
service is added at a time.
To resolve an error caused by an incompatible device driver, system service, virus scanner, or backup tool, follow these steps:
Check the System Log in Event Viewer for error messages that might identify the device or driver that caused the error.
Try disabling memory caching of the BIOS.
Run
the hardware diagnostics supplied by the system manufacturer,
especially the memory scanner. For details on these procedures, see the
owner's manual for your computer.
Make sure the latest Service Pack is installed.
If
your system has small computer system interface (SCSI) adapters,
contact the adapter manufacturer to obtain updated Windows drivers. Try
disabling sync negotiation in the SCSI BIOS, checking the cabling and
the SCSI IDs of each device, and confirming proper termination.
For
integrated device electronics (IDE) devices, define the onboard IDE
port as Primary only. Also, check each IDE device for the proper
master/subordinate/stand-alone setting. Try removing all IDE devices
except for hard disks.
If
you encounter a Stop 0xA message while upgrading to Windows 7, the
problem might be due to an incompatible driver, system service, virus
scanner, or backup. To avoid problems while upgrading, simplify your
hardware configuration and remove all third-party device drivers and
system services (including virus scanners) prior to running setup. After
you have successfully installed Windows, contact the hardware
manufacturer to obtain compatible updates.
If the Stop error occurs when resuming from hibernation or suspend, read Knowledge Base articles 941492 at http://support.microsoft.com/kb/941492 and 945577 at http://support.microsoft.com/kb/945577.
If the Stop error occurs when starting a mobile computer that has the lid closed, refer to Knowledge Base article 941507 at http://support.microsoft.com/kb/941507.
Note:
MORE INFO For more information about Stop 0xA messages, see the Knowledge Base at http://support.microsoft.com/. Search the Knowledge Base using the keywords 0x0000000A and 0xA.
2. Stop 0x1E or KMODE_EXCEPTION_NOT_HANDLED
The Stop 0x1E message
indicates that the Windows kernel detected an illegal or unknown
processor instruction. The problems that cause Stop 0x1E messages share
similarities with those that generate Stop 0xA errors in that they can
be due to invalid memory and access violations. This default Windows
error handler typically intercepts these problems if error-handling
routines are not present in the code itself.
2.1. Interpreting the Message
This Stop message has four parameters:
Exception code that was not handled
Address at which the exception occurred
Parameter 0 of the exception
Parameter 1 of the exception
The first parameter identifies the exception generated. Common exception codes include:
0x80000002: STATUS_DATATYPE_MISALIGNMENT An unaligned data reference was encountered. The trap frame supplies additional information.
0x80000003: STATUS_BREAKPOINT A breakpoint or ASSERT was encountered when no kernel debugger was attached to the system.
0xC0000005: STATUS_ACCESS_VIOLATION
A memory access violation occurred. Parameter 4 of the Stop error
(which is Parameter 1 of the exception) is the address that the driver
attempted to access.
0xC0000044: STATUS_QUOTA_EXCEEDED
The text Insufficient Quota Exists To Complete The Operation indicates a
pool memory leak. A quota allocation attempt necessary for the system
to continue operating normally was unsuccessful because of a program or
driver memory leak.
The second parameter
identifies the address of the module in which the error occurred.
Frequently, the address points to an individual driver or faulty
hardware named on the third parameter of the Stop message. Make a note
of this address and the link date of the driver or image that contains
it.
The last two Stop message
parameters vary, depending on the exception that has occurred. If the
error code has no parameters, the last two parameters of the Stop
message are listed as 0x00.
2.2. Resolving the Problem
The following suggestions
are specific to Stop 0x1E errors. For additional troubleshooting
suggestions that apply to all Stop errors.
Stop 0x1E messages
typically occur after you install faulty drivers or system services, or
they can indicate hardware problems, such as memory and interrupt
request (IRQ) conflicts. If a Stop message lists a driver by name,
disable, remove, or roll back that driver to correct the problem. If
disabling or removing applications and drivers resolves the issue,
contact the hardware manufacturer about a possible update. Using updated
software is especially important for multimedia applications, antivirus
scanners, and CD mastering tools.
If
the Stop message mentions the file Win32k.sys, the source of the error
might be a third-party remote control program. If such software is
installed, you might be able to disable it by starting the system in
safe mode. If not, use Startup Repair to manually delete the system
service file that is causing the problem.
Problems
can result from system firmware incompatibilities. You can resolve many
Advanced Configuration and Power Interface (ACPI) issues by updating to
the latest firmware.
Other
possible causes include insufficient disk space while installing
applications or performing certain functions that require more memory.
You can free up space by deleting unneeded files. Use Disk Cleanup to
increase available disk space.
The
problem might be due to a memory leak caused by an application or
service that is not releasing memory correctly. Poolmon (Poolmon.exe)
helps you to isolate the features that are causing kernel memory leaks.
For more information about troubleshooting memory leaks, see Knowledge
Base articles 177415, "How to Use Memory Pool Monitor (Poolmon.exe) to
Troubleshoot Kernel Mode Memory Leaks," at http://support.microsoft.com/kb/177415 and 298102, "How to Find Pool Tags That Are Used by Third-Party Drivers," at http://support.microsoft.com/kb/298102.
Note:
MORE INFO To find additional articles, search using the keywords poolmon, pool tag, pooltag, and memory leak. For more information about Stop 0x1E messages, see the Knowledge Base at http://support.microsoft.com/. Search the Knowledge Base using the keyword 0x1E.
|
Understanding Kernel Stack Overflows
Omer Amin, Escalation Engineer
Microsoft Global Escalation Services Team
Kernel
stack overflows are a common error in many cases reported to us by
customers. These are caused by drivers taking up too much space on the
kernel stack. This results in a kernel stack overflow, which will then
crash the system with one of the following bugchecks:
STOP 0x7F:
UNEXPECTED_KERNEL_MODE_TRAP with Parameter 1 set to
EXCEPTION_DOUBLE_FAULT, which is caused by running off the end of a
kernel stack. STOP
0x1E: KMODE_EXCEPTION_NOT_HANDLED, 0x7E:
SYSTEM_THREAD_EXCEPTION_NOT_HANDLED, or 0x8E:
KERNEL_MODE_EXCEPTION_NOT_HANDLED, with an exception code of
STATUS_ACCESS_VIOLATION, which indicates a memory access violation. STOP 0x2B: PANIC_STACK_SWITCH, which usually occurs when a kernel-mode driver uses too much stack space.
Each thread in the system is
allocated with a kernel mode stack. Code running on any kernel-mode
thread (whether it is a system thread or a thread created by a driver)
uses that thread's kernel-mode stack unless the code is a deferred
procedure call (DPC), in which case it uses the processor's DPC stack on
certain platforms.
The stack grows negatively.
This means that the beginning (bottom) of the stack has a higher address
than the end (top) of the stack. For example, let's say the beginning
of your stack is 0x80f1000, and this is where your stack pointer (ESP)
is pointing. If you push a DWORD value onto the stack, its address would
be 0x80f0ffc. The next DWORD value would be stored at 0x80f0ff8 and so
on up to the limit (top) of the allocated stack. The top of the stack is
bordered by a guard page to detect overruns.
The size of the kernel-mode
stack varies among different hardware platforms. For example, on 32-bit
platforms, the kernel-mode stack is 12 KB, and on 64-bit platforms, the
kernel-mode stack is 24 KB. The stack sizes are hard limits that are
imposed by the system, and all drivers need to use space conservatively
so that they can coexist. When we reach the top of the stack, one more
push instruction is going to cause an exception, which in turn can lead
to a Stop error. This could be either a simple push instruction or
something along the lines of a call instruction that also pushes the
return address onto the stack.
|
3. Stop 0x24 or NTFS_FILE_SYSTEM
The Stop 0x24 message
indicates that a problem occurred within Ntfs.sys, the driver file that
allows the system to read and write to NTFS File System (NTFS) drives. A
similar Stop message, 0x23, exists for the file allocation table (FAT16
or FAT32) file system.
3.1. Interpreting the Message
This Stop message has four parameters:
Source file and line number
A non-zero value that contains the address of the exception record (optional)
A non-zero value that contains the address of the context record (optional)
A non-zero value that contains the address where the original exception occurred (optional)
Parameters for this Stop
message are useful only to Microsoft technical support with access to
Windows source code. Stop messages resulting from file system issues
have the source file and the line number within the source file that
generated the error encoded in their first parameter. The first four
hexadecimal digits (also known as the high 16 bits) after the 0x
identify the source file number, and the last four hexadecimal digits
(the low 16 bits) identify the source line in the file where the stop
occurred.
3.2. Resolving the Problem
The following suggestions
are specific to Stop 0x24 errors. For additional troubleshooting
suggestions that apply to all Stop errors.
Malfunctioning
SCSI and Advanced Technology Attachment (ATA) hardware or drivers can
also adversely affect the system's ability to read and write to disk,
causing errors. If using SCSI hard disks, check for cabling and
termination problems between the SCSI controller and the disks.
Periodically check Event Viewer for error messages related to SCSI or
FASTFAT in the System Log or any messages in the Applications And
Services Logs\Microsoft\Windows\DiskDiagnostic\Operational log.
Verify
that the tools you use to continually monitor your system—such as virus
scanners, backup programs, or disk defragmenters—are compatible with
Windows. Some disks and adapters come packaged with diagnostic software
that you can use to run hardware tests. For more information, see the
documentation for your computer, hard disk, or controller.
Check your hard disk for problems.
Nonpaged
pool memory might be depleted, which can cause the system to stop. You
can resolve this situation by adding more RAM, which increases the
quantity of nonpaged pool memory available to the kernel.
Note:
MORE INFO For more information about Stop 0x24 messages, see the Knowledge Base at http://support.microsoft.com/. Search the Knowledge Base using the keywords 0x00000024 and 0x24.
4. Stop 0x2E or DATA_BUS_ERROR
The Stop 0x2E message
indicates a system memory parity error. The cause is typically failed or
defective RAM (including motherboard, Level 2 (L2) cache, or video
memory), incompatible or mismatched memory hardware, or a device driver
attempting to access an address in the 0x8xxxxxxx
range that does not exist (meaning that it does not map to a physical
address). A Stop 0x2E message can also indicate hard disk damage caused
by viruses or other problems.
4.1. Interpreting the Message
This Stop message has four parameters:
Virtual address that caused the fault
Physical address that caused the fault
Processor status register
Faulting instruction register
4.2. Resolving the Problem
The following suggestions are
specific to Stop 0x2E errors. For additional troubleshooting suggestions
that apply to all Stop errors.
Stop 0x2E is
typically the result of defective, malfunctioning, or failed memory
hardware, such as memory modules, L2 SRAM cache, or video adapter RAM.
If you added new hardware recently, remove the hardware and replace it
to determine whether it is causing or contributing to the problem.
Stop
0x2E messages can also occur after you install faulty drivers or system
services. If a driver file name is given, you need to disable, remove,
or roll back that driver. Disable the service or application and confirm
that this resolves the error. If so, contact the hardware manufacturer
about a possible update. Using updated software is especially important
for backup programs, multimedia applications, antivirus scanners, and CD
mastering tools.
Hard disk corruption can also cause this Stop message.
The
problem might also be due to cracks, scratched traces, or defective
features on the motherboard. If all else fails, take the system
motherboard to a repair facility for diagnostic testing.
Note:
MORE INFO For more information about Stop 0x2E messages, see the Knowledge Base at http://support.microsoft.com/. Search the Knowledge Base using the keywords 0x0000002E and 0x2E.
