locked
关于ntoskrnl.exe(nt+75bc0)和hal.dll+4977的经常性蓝屏问题 RRS feed

  • 问题

  • 030314-12589-01.dmp 2014-3-3 星期一 22:15:01 IRQL_NOT_LESS_OR_EQUAL 0x0000000a 00000000`0100002c 00000000`00000002 00000000`00000000 fffff800`049f1977 

    hal.dll hal.dll+4977     x64 ntoskrnl.exe+75bc0     

    C:\Windows\Minidump\030314-12589-01.dmp 4 15 7601 304,116 2014-3-3 星期一 22:15:53 

    DUMP文件 http://pan.baidu.com/s/1c0GJCLa

    情况描述:多见于看视频,及视频多开的情况~

    2014年3月3日 14:32

答案

  • 您好,

    这是您的dump分析文件:

    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    
    Use !analyze -v to get detailed debugging information.
    
    BugCheck A, {100002c, 2, 0, fffff800049f1977}
    
    *** WARNING: Unable to verify timestamp for Rt64win7.sys
    *** ERROR: Module load completed but symbols could not be loaded for Rt64win7.sys
    Probably caused by : Rt64win7.sys ( Rt64win7+17a02 )
    
    Followup: MachineOwner
    ---------
    
    2: kd> !analyze -v
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    
    IRQL_NOT_LESS_OR_EQUAL (a)
    An attempt was made to access a pageable (or completely invalid) address at an
    interrupt request level (IRQL) that is too high.  This is usually
    caused by drivers using improper addresses.
    If a kernel debugger is available get the stack backtrace.
    Arguments:
    Arg1: 000000000100002c, memory referenced
    Arg2: 0000000000000002, IRQL
    Arg3: 0000000000000000, bitfield :
    	bit 0 : value 0 = read operation, 1 = write operation
    	bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
    Arg4: fffff800049f1977, address which referenced memory
    
    Debugging Details:
    ------------------
    
    
    READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800046b5100
    GetUlongFromAddress: unable to read from fffff800046b51c0
     000000000100002c Nonpaged pool
    
    CURRENT_IRQL:  2
    
    FAULTING_IP: 
    hal!HalpAllocateAdapterCallback+ef
    fffff800`049f1977 448b6f2c        mov     r13d,dword ptr [rdi+2Ch]
    
    CUSTOMER_CRASH_COUNT:  1
    
    DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT
    
    BUGCHECK_STR:  0xA
    
    PROCESS_NAME:  System
    
    ANALYSIS_VERSION: 6.3.9600.16384 (debuggers(dbg).130821-1623) amd64fre
    
    TRAP_FRAME:  fffff8800e0ef330 -- (.trap 0xfffff8800e0ef330)
    NOTE: The trap frame does not contain all registers.
    Some register values may be zeroed or incorrect.
    rax=00000000000004a4 rbx=0000000000000000 rcx=0000000000000200
    rdx=000000004261c200 rsi=0000000000000000 rdi=0000000000000000
    rip=fffff800049f1977 rsp=fffff8800e0ef4c0 rbp=fffffa800c739eb0
     r8=00000000000004a4  r9=0000000000000000 r10=00000000000fffff
    r11=fffff8800e0ef450 r12=0000000000000000 r13=0000000000000000
    r14=0000000000000000 r15=0000000000000000
    iopl=0         nv up ei pl nz na po nc
    hal!HalpAllocateAdapterCallback+0xef:
    fffff800`049f1977 448b6f2c        mov     r13d,dword ptr [rdi+2Ch] ds:00000000`0000002c=????????
    Resetting default scope
    
    LAST_CONTROL_TRANSFER:  from fffff8000447d169 to fffff8000447dbc0
    
    STACK_TEXT:  
    fffff880`0e0ef1e8 fffff800`0447d169 : 00000000`0000000a 00000000`0100002c 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
    fffff880`0e0ef1f0 fffff800`0447bde0 : fffffa80`00010000 fffffa80`0c8a0000 00000000`00000074 fffffa80`0c739ea0 : nt!KiBugCheckDispatch+0x69
    fffff880`0e0ef330 fffff800`049f1977 : 00000000`00000000 fffff800`049eefb9 00000000`00000000 00000000`00000002 : nt!KiPageFault+0x260
    fffff880`0e0ef4c0 fffff800`049f213d : fffffa80`0c518050 fffffa80`0be8bab0 fffffa80`0c1a0201 0c00e7db`00000000 : hal!HalpAllocateAdapterCallback+0xef
    fffff880`0e0ef560 fffff800`049f171f : fffffa80`0c739e40 00000000`000004f4 fffffa80`0be8bab0 fffffa80`0f2f7990 : hal!HalAllocateAdapterChannel+0x101
    fffff880`0e0ef5a0 fffff880`01904671 : fffffa80`0f2f78b0 fffffa80`0c8a0000 00000000`000000a0 fffff880`0629deca : hal!HalBuildScatterGatherList+0x2f3
    fffff880`0e0ef610 fffff880`05f12a02 : fffffa80`0c5181a0 00000000`00000103 fffffa80`0c72e370 fffffa80`0c8a0000 : ndis!NdisMAllocateNetBufferSGList+0x181
    fffff880`0e0ef6b0 fffffa80`0c5181a0 : 00000000`00000103 fffffa80`0c72e370 fffffa80`0c8a0000 fffffa80`0c739e40 : Rt64win7+0x17a02
    fffff880`0e0ef6b8 00000000`00000103 : fffffa80`0c72e370 fffffa80`0c8a0000 fffffa80`0c739e40 00000000`000001c0 : 0xfffffa80`0c5181a0
    fffff880`0e0ef6c0 fffffa80`0c72e370 : fffffa80`0c8a0000 fffffa80`0c739e40 00000000`000001c0 fffffa80`000004c0 : 0x103
    fffff880`0e0ef6c8 fffffa80`0c8a0000 : fffffa80`0c739e40 00000000`000001c0 fffffa80`000004c0 00000000`00000103 : 0xfffffa80`0c72e370
    fffff880`0e0ef6d0 fffffa80`0c739e40 : 00000000`000001c0 fffffa80`000004c0 00000000`00000103 00000000`0e0ef701 : 0xfffffa80`0c8a0000
    fffff880`0e0ef6d8 00000000`000001c0 : fffffa80`000004c0 00000000`00000103 00000000`0e0ef701 fffff880`0e0ea000 : 0xfffffa80`0c739e40
    fffff880`0e0ef6e0 fffffa80`000004c0 : 00000000`00000103 00000000`0e0ef701 fffff880`0e0ea000 00000000`00000019 : 0x1c0
    fffff880`0e0ef6e8 00000000`00000103 : 00000000`0e0ef701 fffff880`0e0ea000 00000000`00000019 00000004`00000001 : 0xfffffa80`000004c0
    fffff880`0e0ef6f0 00000000`0e0ef701 : fffff880`0e0ea000 00000000`00000019 00000004`00000001 001cfc66`00000014 : 0x103
    fffff880`0e0ef6f8 fffff880`0e0ea000 : 00000000`00000019 00000004`00000001 001cfc66`00000014 00001100`00000000 : 0xe0ef701
    fffff880`0e0ef700 00000000`00000019 : 00000004`00000001 001cfc66`00000014 00001100`00000000 00000000`00000000 : 0xfffff880`0e0ea000
    fffff880`0e0ef708 00000004`00000001 : 001cfc66`00000014 00001100`00000000 00000000`00000000 fffff800`0460d588 : 0x19
    fffff880`0e0ef710 001cfc66`00000014 : 00001100`00000000 00000000`00000000 fffff800`0460d588 00000000`00000002 : 0x00000004`00000001
    fffff880`0e0ef718 00001100`00000000 : 00000000`00000000 fffff800`0460d588 00000000`00000002 00000000`00000000 : 0x001cfc66`00000014
    fffff880`0e0ef720 00000000`00000000 : fffff800`0460d588 00000000`00000002 00000000`00000000 fffffa80`0f2f7780 : 0x00001100`00000000
    
    
    STACK_COMMAND:  kb
    
    FOLLOWUP_IP: 
    Rt64win7+17a02
    fffff880`05f12a02 ??              ???
    
    SYMBOL_STACK_INDEX:  7
    
    SYMBOL_NAME:  Rt64win7+17a02
    
    FOLLOWUP_NAME:  MachineOwner
    
    MODULE_NAME: Rt64win7
    
    IMAGE_NAME:  Rt64win7.sys
    
    DEBUG_FLR_IMAGE_TIMESTAMP:  52b114c6
    
    FAILURE_BUCKET_ID:  X64_0xA_Rt64win7+17a02
    
    BUCKET_ID:  X64_0xA_Rt64win7+17a02
    
    ANALYSIS_SOURCE:  KM
    
    FAILURE_ID_HASH_STRING:  km:x64_0xa_rt64win7+17a02
    
    FAILURE_ID_HASH:  {2933994c-a8ac-54f9-a8ec-4738637ed2c4}
    
    Followup: MachineOwner
    ---------
    
    2: kd> lmvm Rt64win7
    start             end                 module name
    fffff880`05efb000 fffff880`05fd6000   Rt64win7 T (no symbols)           
        Loaded symbol image file: Rt64win7.sys
        Image path: Rt64win7.sys
        Image name: Rt64win7.sys
        Timestamp:        Wed Dec 18 11:21:42 2013 (52B114C6)
        CheckSum:         000DCE9A
        ImageSize:        000DB000
        Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4
    

    从分析结果来看,蓝屏原因是Rt64win7.sys引起的。 Rt64win7.sys是 Realtek NIC 的驱动程序。关于Bugcheck A,此错误信息会在当中断优先级过高时访问分页内存或者无效内存时出现,通常这种情况发生在系统安装了错误的驱动程序,系统服务或者BIOS。详细信息,请参考:

    Bug Check 0xA: IRQL_NOT_LESS_OR_EQUAL

    另外请检查您的网卡是不是已经更新到最新的驱动,建议您到Realtek官方网站查看一下。

    http://www.realtek.com/downloads/downloadsView.aspx?Langid=1&PNid=7&PFid=10&Level=3&Conn=2

    希望这对您有帮助。


    Michael Shao
    TechNet Community Support

    • 已建议为答案 Michael_LS 2014年3月5日 1:47
    • 已标记为答案 blair deng 2014年3月14日 10:30
    2014年3月4日 7:43
  • 瑞昱网络适配器的 64 位 Windows 驱动有问题,请尝试重新安装此驱动。


    Alexis Zhang

    http://mvp.support.microsoft.com/profile/jie
    http://blogs.itecn.net/blogs/alexis

    本帖是回复帖,原帖作者是楼上的 <murongwuyan>;

    | 030314-12589-01.dmp 2014-3-3 星期一 22:15:01 IRQL_NOT_LESS_OR_EQUAL 0x0000000a 00000000`0100002c 00000000`00000002 00000000`00000000 fffff800`049f1977

    • 已标记为答案 blair deng 2014年3月14日 10:30
    2014年3月5日 7:26

全部回复

  • 您好,

    这是您的dump分析文件:

    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    
    Use !analyze -v to get detailed debugging information.
    
    BugCheck A, {100002c, 2, 0, fffff800049f1977}
    
    *** WARNING: Unable to verify timestamp for Rt64win7.sys
    *** ERROR: Module load completed but symbols could not be loaded for Rt64win7.sys
    Probably caused by : Rt64win7.sys ( Rt64win7+17a02 )
    
    Followup: MachineOwner
    ---------
    
    2: kd> !analyze -v
    *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *
    *******************************************************************************
    
    IRQL_NOT_LESS_OR_EQUAL (a)
    An attempt was made to access a pageable (or completely invalid) address at an
    interrupt request level (IRQL) that is too high.  This is usually
    caused by drivers using improper addresses.
    If a kernel debugger is available get the stack backtrace.
    Arguments:
    Arg1: 000000000100002c, memory referenced
    Arg2: 0000000000000002, IRQL
    Arg3: 0000000000000000, bitfield :
    	bit 0 : value 0 = read operation, 1 = write operation
    	bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
    Arg4: fffff800049f1977, address which referenced memory
    
    Debugging Details:
    ------------------
    
    
    READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800046b5100
    GetUlongFromAddress: unable to read from fffff800046b51c0
     000000000100002c Nonpaged pool
    
    CURRENT_IRQL:  2
    
    FAULTING_IP: 
    hal!HalpAllocateAdapterCallback+ef
    fffff800`049f1977 448b6f2c        mov     r13d,dword ptr [rdi+2Ch]
    
    CUSTOMER_CRASH_COUNT:  1
    
    DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT
    
    BUGCHECK_STR:  0xA
    
    PROCESS_NAME:  System
    
    ANALYSIS_VERSION: 6.3.9600.16384 (debuggers(dbg).130821-1623) amd64fre
    
    TRAP_FRAME:  fffff8800e0ef330 -- (.trap 0xfffff8800e0ef330)
    NOTE: The trap frame does not contain all registers.
    Some register values may be zeroed or incorrect.
    rax=00000000000004a4 rbx=0000000000000000 rcx=0000000000000200
    rdx=000000004261c200 rsi=0000000000000000 rdi=0000000000000000
    rip=fffff800049f1977 rsp=fffff8800e0ef4c0 rbp=fffffa800c739eb0
     r8=00000000000004a4  r9=0000000000000000 r10=00000000000fffff
    r11=fffff8800e0ef450 r12=0000000000000000 r13=0000000000000000
    r14=0000000000000000 r15=0000000000000000
    iopl=0         nv up ei pl nz na po nc
    hal!HalpAllocateAdapterCallback+0xef:
    fffff800`049f1977 448b6f2c        mov     r13d,dword ptr [rdi+2Ch] ds:00000000`0000002c=????????
    Resetting default scope
    
    LAST_CONTROL_TRANSFER:  from fffff8000447d169 to fffff8000447dbc0
    
    STACK_TEXT:  
    fffff880`0e0ef1e8 fffff800`0447d169 : 00000000`0000000a 00000000`0100002c 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
    fffff880`0e0ef1f0 fffff800`0447bde0 : fffffa80`00010000 fffffa80`0c8a0000 00000000`00000074 fffffa80`0c739ea0 : nt!KiBugCheckDispatch+0x69
    fffff880`0e0ef330 fffff800`049f1977 : 00000000`00000000 fffff800`049eefb9 00000000`00000000 00000000`00000002 : nt!KiPageFault+0x260
    fffff880`0e0ef4c0 fffff800`049f213d : fffffa80`0c518050 fffffa80`0be8bab0 fffffa80`0c1a0201 0c00e7db`00000000 : hal!HalpAllocateAdapterCallback+0xef
    fffff880`0e0ef560 fffff800`049f171f : fffffa80`0c739e40 00000000`000004f4 fffffa80`0be8bab0 fffffa80`0f2f7990 : hal!HalAllocateAdapterChannel+0x101
    fffff880`0e0ef5a0 fffff880`01904671 : fffffa80`0f2f78b0 fffffa80`0c8a0000 00000000`000000a0 fffff880`0629deca : hal!HalBuildScatterGatherList+0x2f3
    fffff880`0e0ef610 fffff880`05f12a02 : fffffa80`0c5181a0 00000000`00000103 fffffa80`0c72e370 fffffa80`0c8a0000 : ndis!NdisMAllocateNetBufferSGList+0x181
    fffff880`0e0ef6b0 fffffa80`0c5181a0 : 00000000`00000103 fffffa80`0c72e370 fffffa80`0c8a0000 fffffa80`0c739e40 : Rt64win7+0x17a02
    fffff880`0e0ef6b8 00000000`00000103 : fffffa80`0c72e370 fffffa80`0c8a0000 fffffa80`0c739e40 00000000`000001c0 : 0xfffffa80`0c5181a0
    fffff880`0e0ef6c0 fffffa80`0c72e370 : fffffa80`0c8a0000 fffffa80`0c739e40 00000000`000001c0 fffffa80`000004c0 : 0x103
    fffff880`0e0ef6c8 fffffa80`0c8a0000 : fffffa80`0c739e40 00000000`000001c0 fffffa80`000004c0 00000000`00000103 : 0xfffffa80`0c72e370
    fffff880`0e0ef6d0 fffffa80`0c739e40 : 00000000`000001c0 fffffa80`000004c0 00000000`00000103 00000000`0e0ef701 : 0xfffffa80`0c8a0000
    fffff880`0e0ef6d8 00000000`000001c0 : fffffa80`000004c0 00000000`00000103 00000000`0e0ef701 fffff880`0e0ea000 : 0xfffffa80`0c739e40
    fffff880`0e0ef6e0 fffffa80`000004c0 : 00000000`00000103 00000000`0e0ef701 fffff880`0e0ea000 00000000`00000019 : 0x1c0
    fffff880`0e0ef6e8 00000000`00000103 : 00000000`0e0ef701 fffff880`0e0ea000 00000000`00000019 00000004`00000001 : 0xfffffa80`000004c0
    fffff880`0e0ef6f0 00000000`0e0ef701 : fffff880`0e0ea000 00000000`00000019 00000004`00000001 001cfc66`00000014 : 0x103
    fffff880`0e0ef6f8 fffff880`0e0ea000 : 00000000`00000019 00000004`00000001 001cfc66`00000014 00001100`00000000 : 0xe0ef701
    fffff880`0e0ef700 00000000`00000019 : 00000004`00000001 001cfc66`00000014 00001100`00000000 00000000`00000000 : 0xfffff880`0e0ea000
    fffff880`0e0ef708 00000004`00000001 : 001cfc66`00000014 00001100`00000000 00000000`00000000 fffff800`0460d588 : 0x19
    fffff880`0e0ef710 001cfc66`00000014 : 00001100`00000000 00000000`00000000 fffff800`0460d588 00000000`00000002 : 0x00000004`00000001
    fffff880`0e0ef718 00001100`00000000 : 00000000`00000000 fffff800`0460d588 00000000`00000002 00000000`00000000 : 0x001cfc66`00000014
    fffff880`0e0ef720 00000000`00000000 : fffff800`0460d588 00000000`00000002 00000000`00000000 fffffa80`0f2f7780 : 0x00001100`00000000
    
    
    STACK_COMMAND:  kb
    
    FOLLOWUP_IP: 
    Rt64win7+17a02
    fffff880`05f12a02 ??              ???
    
    SYMBOL_STACK_INDEX:  7
    
    SYMBOL_NAME:  Rt64win7+17a02
    
    FOLLOWUP_NAME:  MachineOwner
    
    MODULE_NAME: Rt64win7
    
    IMAGE_NAME:  Rt64win7.sys
    
    DEBUG_FLR_IMAGE_TIMESTAMP:  52b114c6
    
    FAILURE_BUCKET_ID:  X64_0xA_Rt64win7+17a02
    
    BUCKET_ID:  X64_0xA_Rt64win7+17a02
    
    ANALYSIS_SOURCE:  KM
    
    FAILURE_ID_HASH_STRING:  km:x64_0xa_rt64win7+17a02
    
    FAILURE_ID_HASH:  {2933994c-a8ac-54f9-a8ec-4738637ed2c4}
    
    Followup: MachineOwner
    ---------
    
    2: kd> lmvm Rt64win7
    start             end                 module name
    fffff880`05efb000 fffff880`05fd6000   Rt64win7 T (no symbols)           
        Loaded symbol image file: Rt64win7.sys
        Image path: Rt64win7.sys
        Image name: Rt64win7.sys
        Timestamp:        Wed Dec 18 11:21:42 2013 (52B114C6)
        CheckSum:         000DCE9A
        ImageSize:        000DB000
        Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4
    

    从分析结果来看,蓝屏原因是Rt64win7.sys引起的。 Rt64win7.sys是 Realtek NIC 的驱动程序。关于Bugcheck A,此错误信息会在当中断优先级过高时访问分页内存或者无效内存时出现,通常这种情况发生在系统安装了错误的驱动程序,系统服务或者BIOS。详细信息,请参考:

    Bug Check 0xA: IRQL_NOT_LESS_OR_EQUAL

    另外请检查您的网卡是不是已经更新到最新的驱动,建议您到Realtek官方网站查看一下。

    http://www.realtek.com/downloads/downloadsView.aspx?Langid=1&PNid=7&PFid=10&Level=3&Conn=2

    希望这对您有帮助。


    Michael Shao
    TechNet Community Support

    • 已建议为答案 Michael_LS 2014年3月5日 1:47
    • 已标记为答案 blair deng 2014年3月14日 10:30
    2014年3月4日 7:43
  • 感谢大大的分析和解读~~致敬~~
    2014年3月4日 11:24
  • 瑞昱网络适配器的 64 位 Windows 驱动有问题,请尝试重新安装此驱动。


    Alexis Zhang

    http://mvp.support.microsoft.com/profile/jie
    http://blogs.itecn.net/blogs/alexis

    本帖是回复帖,原帖作者是楼上的 <murongwuyan>;

    | 030314-12589-01.dmp 2014-3-3 星期一 22:15:01 IRQL_NOT_LESS_OR_EQUAL 0x0000000a 00000000`0100002c 00000000`00000002 00000000`00000000 fffff800`049f1977

    • 已标记为答案 blair deng 2014年3月14日 10:30
    2014年3月5日 7:26