Operating System

Windows 7 x32 bit

Hardware Used

HCL Notebook Orion 2

Problem

Laptop showed blue screen error while connecting to network environment. Without network the laptop working fine without any problem. 

Solution

The HCL notebook Orion -2 preloaded with windows 7 x 32 bit. So we can suspects anything related to network causes the issue. But this is assumption only. We have to find out the root cause of this issue.
Before going to analysis just check there is any previous case history for any similar issues. If yes what are the workarounds for that. 
We can collect the system logs for any serious errors pointed. The logs are the best friends for helping to find out the root cause. 
Every time when we connect the network, it will crash and showing the blue screen error codes. 
Collecting those minidump files will help us to pointing the exact faulty driver.
The actual path for minidump file is %systemroot%\Minidump folder.
Most of these cases there will be the same BSOD error code like STOP 0x0000000A.
The STOP 0x0000000A, IRQL_NOT_LESS_OR_EQUAL which means an attempt was made to access a pageable (or completely invalid) address at an interrupt request level (IRQL) that is too high. 
This is usually caused by drivers using improper addresses.

Analysis the given logs one by one for find out the conflicted driver files

During  dump analysing, after executing the command !analyze –v  the output will generate like below.


*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 905980e4, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000001, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: 82c74db1, address which referenced memory

Debugging Details:
------------------


WRITE_ADDRESS: GetPointerFromAddress: unable to read from 82d73718
Unable to read MiSystemVaType memory at 82d53160
 905980e4 

CURRENT_IRQL:  2

FAULTING_IP: 
nt!KiTimerExpiration+15f
82c74db1 894a04          mov     dword ptr [edx+4],ecx

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0xA

PROCESS_NAME:  svchost.exe

TRAP_FRAME:  8078aedc -- (.trap 0xffffffff8078aedc)
ErrCode = 00000002
eax=97aec7d0 ebx=82d377d0 ecx=82d377d4 edx=905980e0 esi=82d377d4 edi=82d36680
eip=82c74db1 esp=8078af50 ebp=8078afac iopl=0         nv up ei ng nz na pe cy
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010287
nt!KiTimerExpiration+0x15f:
82c74db1 894a04          mov     dword ptr [edx+4],ecx ds:0023:905980e4=????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from 82c74db1 to 82c517eb

STACK_TEXT:  
8078aedc 82c74db1 badb0d00 905980e0 8078afa4 nt!KiTrap0E+0x2cf
8078afac 82c7320e 000014b6 8a299d34 00000000 nt!KiTimerExpiration+0x15f
8078aff4 82c729dc 8a299ce4 00000000 00000000 nt!KiRetireDpcList+0xcb
8078aff8 8a299ce4 00000000 00000000 00000000 nt!KiDispatchInterrupt+0x2c
WARNING: Frame IP not in any known module. Following frames may be wrong.
82c729dc 00000000 0000001a 00d6850f bb830000 0x8a299ce4


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!KiTimerExpiration+15f
82c74db1 894a04          mov     dword ptr [edx+4],ecx

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt!KiTimerExpiration+15f

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrpamp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4a5bc007

FAILURE_BUCKET_ID:  0xA_nt!KiTimerExpiration+15f

BUCKET_ID:  0xA_nt!KiTimerExpiration+15f

Followup: MachineOwner
---------

For this case we noticed STOP 0x0000000A is created and the caused file is ntkrpamp.exe.

It means the system is Multiprocessor x86 architecture systems with PAE support.

Microsoft released the hot fix for these kinds of issues. Download the hot fix and install from the below link
     http://hotfixv4.microsoft.com/Windows%207/WindowsServer%202008%20R2/sp1/Fix302249/7600/free/404160_intl_i386_zip.exe.


For next dump file the !analyze –v  command gives the below output again

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 905380dc, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000000, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: 82cb197f, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS: GetPointerFromAddress: unable to read from 82dae718
Unable to read MiSystemVaType memory at 82d8e160
 905380dc 

CURRENT_IRQL:  2

FAULTING_IP: 
nt!KiInsertTimerTable+19b
82cb197f 3b4ffc          cmp     ecx,dword ptr [edi-4]

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0xA

PROCESS_NAME:  System

TRAP_FRAME:  82d6c974 -- (.trap 0xffffffff82d6c974)
ErrCode = 00000000
eax=82d72a44 ebx=00000000 ecx=00000013 edx=9057b470 esi=82d71680 edi=905380e0
eip=82cb197f esp=82d6c9e8 ebp=82d6ca30 iopl=0         nv up ei pl nz ac pe nc
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010216
nt!KiInsertTimerTable+0x19b:
82cb197f 3b4ffc          cmp     ecx,dword ptr [edi-4] ds:0023:905380dc=????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from 82cb197f to 82c8c7eb

STACK_TEXT:  
82d6c974 82cb197f badb0d00 9057b470 0000001d nt!KiTrap0E+0x2cf
82d6ca30 82cb17aa 9057b470 000000d0 82d6fd20 nt!KiInsertTimerTable+0x19b
82d6ca44 82cb1775 82d6fd20 000000d0 00000000 nt!KiInsertOrSignalTimer+0x14
82d6ca74 82c826c0 fff63c00 ffffffff 00000000 nt!KiSetTimerEx+0x6a
82d6ca94 88c326ad 9057b470 fff63c00 ffffffff nt!KeSetTimerEx+0x1c
82d6cab8 8e894ef8 9057b460 fff63c00 ffffffff ndis!NdisSetTimerObject+0xa2
WARNING: Stack unwind information not available. Following frames may be wrong.
82d6cb08 88c32774 00000000 0000000a 00000000 JME+0x5ef8
82d6cb38 82cb004d 9057b498 0057b460 c03a013c ndis!ndisMTimerObjectDpc+0xbc
82d6cb7c 82cafff1 82d6fd20 82d6cca8 00000001 nt!KiProcessTimerDpcTable+0x50
82d6cc68 82cafeae 82d6fd20 82d6cca8 00000000 nt!KiProcessExpiredTimerList+0x101
82d6ccdc 82cae20e 00081ecc 84db4020 82d79280 nt!KiTimerExpiration+0x25c
82d6cd20 82cae038 00000000 0000000e 00000000 nt!KiRetireDpcList+0xcb
82d6cd24 00000000 0000000e 00000000 00000000 nt!KiIdleLoop+0x38


STACK_COMMAND:  kb

FOLLOWUP_IP: 
JME+5ef8
8e894ef8 ??              ???

SYMBOL_STACK_INDEX:  6

SYMBOL_NAME:  JME+5ef8

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: JME

IMAGE_NAME:  JME.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4d7875ed

FAILURE_BUCKET_ID:  0xA_JME+5ef8

BUCKET_ID:  0xA_JME+5ef8

Followup: MachineOwner

The image name pointing to JME.sys file, its a network driver file. JMicron is the vendor who provided the PCI Express Ethernet Adapter for HCL note book Orion 2.

The lmvm JME command shows the module name JME.sys which is located at  

%SystemRoot%system32\DRIVERS\JME.sys
SO for this case we have to update the latest network driver from the vendor website

Latest Network driver provided form the below link: ftp://211.75.121.162/Ethernet/Windows/JMC2xx_WinDrv_R0.0.33.3_WHQL.zip.

If there is no Service pack installed for windows 7. So it recommends for updating windows 7 Service pack 1 from the below Microsoft Download link: 

http://download.microsoft.com/download/0/A/F/0AFB5316-3062-494A-AB78-7FB0D4461357/windows6.1-KB976932-X86.exe.