IRQL Not Less Or Equal crash, win32k.sys

rodrigo.uchoa · 11-05-2008

I have a sony vaio laptiop with Windows Vista Home Premium with 4 gigs of
RAM. I have been frequently getting blue screen crashes right after start-up
and shut-down.

The complete dump file for the error is the following:

------------------------------------------------------------------
IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 00000000, memory referenced
Arg2: 0000001b, IRQL
Arg3: 00000000, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on
chips which support this level of status)
Arg4: 82100cba, address which referenced memory

Debugging Details:
------------------

READ_ADDRESS: GetPointerFromAddress: unable to read from 82184868
Unable to read MiSystemVaType memory at 82164420
00000000

CURRENT_IRQL: 1b

FAULTING_IP:
nt!KiUnwaitThread+14
82100cba 8b08 mov ecx,dword ptr [eax]

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

BUGCHECK_STR: 0xA

PROCESS_NAME: taskeng.exe

TRAP_FRAME: b2281c34 -- (.trap 0xffffffffb2281c34)
ErrCode = 00000000
eax=00000000 ebx=00000001 ecx=84d6bce8 edx=84d6bce8 esi=a6f99ac8 edi=84d4fed8
eip=82100cba esp=b2281ca8 ebp=b2281cbc iopl=0 nv up ei pl nz na pe cy
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010207
nt!KiUnwaitThread+0x14:
82100cba 8b08 mov ecx,dword ptr [eax]
ds:0023:00000000=????????
Resetting default scope

LAST_CONTROL_TRANSFER: from 82100cba to 820a7d84

STACK_TEXT:
b2281c34 82100cba badb0d00 84d6bce8 dee619a0 nt!KiTrap0E+0x2ac
b2281cbc 82100c60 00000002 0000c046 ff790008 nt!KiUnwaitThread+0x14
b2281ce4 95f9184e 84d4fed0 00000002 00000000 nt!KeSetEvent+0xa0
b2281d00 95f65285 ff790008 00000108 ff790008 win32k!SetWakeBit+0xda
b2281d1c 95f653cf ff790008 0000c046 00000000 win32k!_PostThreadMessage+0xb7
b2281d4c 820a4a7a 00000c0c 0000c046 00000000
win32k!NtUserPostThreadMessage+0x10e
b2281d4c 77479a94 00000c0c 0000c046 00000000 nt!KiFastCallEntry+0x12a
WARNING: Frame IP not in any known module. Following frames may be wrong.
0262e484 00000000 00000000 00000000 00000000 0x77479a94

STACK_COMMAND: kb

FOLLOWUP_IP:
win32k!SetWakeBit+da
95f9184e 5e pop esi

SYMBOL_STACK_INDEX: 3

SYMBOL_NAME: win32k!SetWakeBit+da

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: win32k

IMAGE_NAME: win32k.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 47c78851

FAILURE_BUCKET_ID: 0xA_win32k!SetWakeBit+da

BUCKET_ID: 0xA_win32k!SetWakeBit+da

Followup: MachineOwner
---------

Any tips on solving this will be highly appreciated. I have already

Rick Rogers · 12-05-2008

Hi,

Something in Task Scheduler is trying to run and falling over, or something
is trying to load TS and it's crashing. The memory address being accessed is
invalid (arg 1), and the hardware is using a virtual IRQ, number 27 (arg 2).
Two approaches to this might help diagnose the problem:

1) Check TS for tasks trying to run at startup and shutdown. Check event
viewer as well for mention of what's falling over.

2) Run msinfo32 from the start/search line and go to hardware resources/IRQ
and see if there is a device using #27. If so, see if there is an updated
driver for that device from the manufacturer.

rodrigo.uchoa · 12-05-2008

Hello,

For starters, thank you for trying to help. I do however have some questions
regarding the solution you provided.

1) The task scheduler have like dozens of tasks that are triggered by
'start-up' or 'user log on', most of them are windows tasks. Should I look
for any in particular?

2) The event viewer also has millions of events stored. What exactly should
I look for?

3) I did look in msinfo32 but there are no devices using IRQ #27.

Rick Rogers · 12-05-2008

Hi,

1) Selectively begin disabling them until the problem stops.

2) Under Windows Logs, check the System and Application logs at the time of
the startup errors.

3) Not surprised, as it may be that the issue could be that it is trying to
invoke an IRQ that's not allocated.