WinXP BSOD IRQL_NOT_LESS_OR_EQUAL

S

Sarge

Adept
Hi guys,

Off late I have been getting a lot of these BSOD's stating the following error.

Code: 
IRQL_NOT_LESS_OR_EQUAL

Followed by some usual system recomendations like if u have recently added a hardware or software .. blah blah.

Now the thing is I have searched the net and found out that most of the times it is a Memory problem but just to make sure has anyone here ever had this BSOD and resolved it ?

PS: I have recently reinstalled WinXP and added 2 New SATA HDDs. Also I had removed and changed my 1gb DDR from one slot to another.
 
I had the same error message...turned out to be filesystem corruption and HDD RMA....
If you can see the screen(ie for a few sec. bfore restart), make a note of the error detail in the bottom of the blue screen
for me, it came as ntfs.sys corrupt.....so turned out to be a HDD issue

It might also be a driver problem
 
mostly this points to driver issues. check if any drivers are sharing same IRQs, google for more info. try uninstalling n reinstalling any newly connected devices.
 
if you read the bsod message below, you will find the faulting module. if its thirdparty, uninstalling that driver will solve the problem. :)
you can also find the faulting module from the crash mini dump file. they are usually present in the windows folder. with a .dmp extention
 
techie_007 said:
mostly this points to driver issues. check if any drivers are sharing same IRQs, google for more info. try uninstalling n reinstalling any newly connected devices.
Click to expand...

IRQL is not related to IRQ :)
 
booo said:
IRQL is not related to IRQ :)
Click to expand...

i think i read somewhere that it was :ashamed: and could be caused by two devices sharing the same IRQs. Nz, too lazy to look ofr the same now, so maybe i was mistaken :)
 
afaik, windows drivers work at certain irql levels and at certain irql levels, certain APIs are not available. when that happens windows crashes the system with this message.

basically you cant use higher irql apis at lower irqls.
 
pcgamer said:
I had the same error message...turned out to be filesystem corruption and HDD RMA....

If you can see the screen(ie for a few sec. bfore restart), make a note of the error detail in the bottom of the blue screen

for me, it came as ntfs.sys corrupt.....so turned out to be a HDD issue

It might also be a driver problem
Click to expand...

Yes the screen does stay for sometime .. I'll try to read the whole thing next time it occurs.

As for memtest I suppose it takes a lot of time .. shud try that pretty soon.

I guess it must be something related to drivers as boo points out but cant think of any new drivers installed.

But as I mentioned I have added new HDDs and changed my RAM slot.
 
Doesn't have to be driver related, could be due to memory (or anything else) corrupting a driver. Bad memory could do it. IRQL_NOT_LESS_OR_EQUAL as a result of bad drivers is pretty rare nowadays.
 
if you can search the c:\windows folder for any .dmp files and attach it here, I can tell you exactly which driver faulted.

if its a minidump file it would be around 64kb. if its a full memory dump. it will be the size of your ram.

OR

1. install windbg from microsoft site. (Debugging tools for windows)
2. open the dump file from windbg. (open windbg and press ctrl+d and select the dump file.)
3. in the command window of windbg type "!analyze -v"
you will get the analysis of the crash with the faulting module.
IMO, its definitely not memory issue or any hardware issue.
 
Ah, so you want to debug the kernel crash dump, eh? I'd advise you to install the symbols too then...

Memory corruption can cause these errors, though I'd be surprised if it consistently caused the same error repeatedly. If you are always getting an IRQL_NOT_LESS_OR_EQUAL, then it might be a driver fault. But as I said... the kind that cause IRQL_NOT_LESS_OR_EQUAL are really rare now.

Actually, with the crash dump and symbols, it'd actually be possible to figure out exactly which function was called, that caused the error.
 
KingKrool said:
Ah, so you want to debug the kernel crash dump, eh? I'd advise you to install the symbols too then...
Memory corruption can cause these errors, though I'd be surprised if it consistently caused the same error repeatedly. If you are always getting an IRQL_NOT_LESS_OR_EQUAL, then it might be a driver fault. But as I said... the kind that cause IRQL_NOT_LESS_OR_EQUAL are really rare now.
Actually, with the crash dump and symbols, it'd actually be possible to figure out exactly which function was called, that caused the error.
Click to expand...

Lets make some things clear....

1. I suggested analyze just to findout the faulting module. if the faulting module is thirdparty, then you cannot, in no way debug the kernel since they wont supply the symbols for that module.
2. memory corruption can cause these issues, accepted. but it necessarily not the memory module. memory corruption (kernel memory space) usually happens due to badly written drivers.
3. kernel crashes are not really rare... install dscaler in vista, while searching for tv channels just kill the application to get a blue screen. Now, its not the problem with vista but a driver installed by dscaler causing the core. you can reproduce this every time...
But as I said... the kind that cause IRQL_NOT_LESS_OR_EQUAL are really rare now.
Click to expand...
I would really like to know on what basis you concluded that.

4. installing symbols is not really tough... ".symfix c:\symbols" will do it.

at last, if you say someone that his ram is faulty without even looking into what really went wrong will cause some panic. and I dont think he is overclocking his ram to really cause the ram corruption.

peace...
 
@ boo

My bad that I did not read the BSOD completely but I do remember something like this included

Code: 
Physical Memory dump has been started.

Physical memory dump completed.

It then mentioned what I think was the name and path of the dump file of which I did not make a note.

I shall do it the very next time that I get the BSOD ( I'll just have to wait on this one for it since it is not under my control ).

I did manage to install windbg and open one ( and this was the only dmp file on my c: ) "user.dmp". But it wasn't related to the BSOD.

I also remember the BSOD mentioning a .dll filename.

GOSH :mad::mad: my bad shud have noted evthing down.

Now I am desperately waiting for the BSOD to happen. I want to track this one down :mad:
 
booo said:
I would really like to know on what basis you concluded that.
Click to expand...

I said drivers which cause IRQL_NOT_LESS_OR_EQUAL are rare (not that all kernel crashes are rare, just this one). Why? Because of a nice little tool called Driver Verifier.. It is pretty difficult for a driver to sneak a bad API past it, and since its been out for ages, most driver devs use it (it is part of the win ddk for XP/2003).

In my last post I agreed that memory corruption which manifested itself in the same way over and over again was not likely to be a hardware problem, but seeing as how we still don't know what error he gets consistently, running memtest is probably the easiest thing to do in the meanwhile. Especially since he doesn't remember installing any new drivers (it is unlikely an old driver exhibits this behavior after working flawlessly for months).

Personally I prefer the use of a symbol server, but that can be challenging on a slow (or even a fast!) connection.
 
try removing all the add on cards from the mobo. first think of wat u did last before u got this error. reverse it and c if it works
 
well, I am not really sure about this.... but driver verifier works at run time. i.e., you have to run all the possible code paths with driver verifier to properly test the driver. if you missout on a path that has bug then i guess it cant catch. I have experience using the app verifier but not driver verifier...
correct me if I am wrong...

I have seen several instances of this error in our driver but I am sure that our driver folks use the verifier.

I am pretty confident that there are cowboy coders everywhere so I dont trust anyone :)

@ranjitpai: enable minidumps, I dont think there is any need for full memory dumps in this case.
you can set the path and minidump from my computer->right click->advanced tab->settings button of startup and recovery. the default path is usually "%SystemRoot%\MEMORY.DMP"
 
You are right that driver verifier is dynamic, but there is a static version too now. Possibly that is Vista only (I have never used it, last time I programmed the DDK was circa 2005 early 2006)
 
:hap2: Got the BSOD pretty quickly. Here it goes

Code: 
A problem has been detected and Windows has been shut down to prevent damage to your computer.

IRQL_NOT_LESS_OR_EQUAL

If this is the first time you have seen the Stop error screen, restart your computer. If this screen appears again follow these steps:

Check to make sure any new hardware or software is properly installed. If this is a new installation, ask your hardware or software manufacturer for any windows update you might need.

If problems continue, disable or remove any newly installed hardware or software. Disable BIOS memory options such as caching or shadowing. If you need safe mode to remove or disable components restart your computer, press F8 to select Advanced Startup Options, and then select safe mode.

Technical Information

*** STOP: 0x0000000A (0x003F0001, 0x0000001C, 0x00000001, 0x80502000)

Beginning dump of Physical memory

Physical memory dump complete

Contact your system administrator or technical support group for further assistance.

Now as I mentioned before the only new hardware I installed were my new HDDs but I know for sure these aren't causing the error since I have been getting errors before installing the HDDs.

And this winxp is a relatively new install.

I had changed the RAM slots but I also did change it back to my original setup.

Also it is interesting to note that these BSODs have occured only when I am AFK and my system goes into the screen saver mode.

Now when I restarted my computer I got the following error reporting messages :

Code: 
Error signature

BCCode : 1000000a     BCP1 : 003F0001     BCP2 : 0000001C     BCP3 : 00000001

BCP4 : 80502000     OSVer : 5_1_2600     SP : 2_0     Product : 256_1

And it said the following files will be included in the report.

C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\WERbc6e.dir00\Mini050808-01.dmp

C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\WERbc6e.dir00\sysdata.xml

I am including the dump file which I opened in windbg but understood nothing other than it mentioning the following files

ntoskrnl.dll

mssmbios.sys

snpstd3.sys

Will try and run a memtest today.
 

Attachments

  • Mini050808-01.zip
    25.6 KB · Views: 116
Oops unreadable .. posting the messages again :

THE BSOD

A problem has been detected and Windows has been shut down to prevent damage to your computer.

IRQL_NOT_LESS_OR_EQUAL

If this is the first time you have seen the Stop error screen, restart your computer. If this screen appears again follow these steps:

Check to make sure any new hardware or software is properly installed. If this is a new installation, ask your hardware or software manufacturer for any windows update you might need.

If problems continue, disable or remove any newly installed hardware or software. Disable BIOS memory options such as caching or shadowing. If you need safe mode to remove or disable components restart your computer, press F8 to select Advanced Startup Options, and then select safe mode.

Technical Information

*** STOP: 0x0000000A (0x003F0001, 0x0000001C, 0x00000001, 0x80502000)

Beginning dump of Physical memory

Physical memory dump complete

Contact your system administrator or technical support group for further assistance.
Click to expand...

Windows Message

Error signature

BCCode : 1000000a BCP1 : 003F0001 BCP2 : 0000001C BCP3 : 00000001

BCP4 : 80502000 OSVer : 5_1_2600 SP : 2_0 Product : 256_1
Click to expand...
 
Back
Top