kdumpctl: No memory reserved for crash kernel.

本文介绍了如何在CentOS 7中配置并成功启动kdump服务,以便在内核崩溃时捕获内存信息进行故障分析。文章详细记录了遇到的问题及解决步骤,包括设置crashkernel参数、安装kdump工具、修改grub配置等。

摘要生成于 C知道 ,由 DeepSeek-R1 满血版支持, 前往体验 >

kdump 是一种 kernel crash dump 的机制,它可以在内核 crash 时保存系统的内存信息用于后续的分析。kdump 是基于 kexec 的。
crash 是一个用于交互式地分析正在运行的 Linux 系统或者 kernel crash 后的 core dump 数据的工具。

记录一下问题及其解决方法:

在 centos7 中的 kdump.service 服务一直不能正常启动,如下:

[root@mesos-slave-dev001-cqdx ~]# systemctl status kdump.service
● kdump.service - Crash recovery kernel arming
   Loaded: loaded (/usr/lib/systemd/system/kdump.service; enabled; vendor preset: enabled)
   Active: failed (Result: exit-code) since 二 2016-07-19 14:07:37 CST; 1min 1s ago
  Process: 5416 ExecStart=/usr/bin/kdumpctl start (code=exited, status=1/FAILURE)
 Main PID: 5416 (code=exited, status=1/FAILURE)

719 14:07:35 mesos-slave-dev001-cqdx.qiyi.virtual systemd[1]: Starting Crash recovery kernel arming...
719 14:07:37 mesos-slave-dev001-cqdx.qiyi.virtual kdumpctl[5416]: No memory reserved for crash kernel.
719 14:07:37 mesos-slave-dev001-cqdx.qiyi.virtual kdumpctl[5416]: Starting kdump: [FAILED]
719 14:07:37 mesos-slave-dev001-cqdx.qiyi.virtual systemd[1]: kdump.service: main process exited, code=exited, status=1/FAILURE
719 14:07:37 mesos-slave-dev001-cqdx.qiyi.virtual systemd[1]: Failed to start Crash recovery kernel arming.
719 14:07:37 mesos-slave-dev001-cqdx.qiyi.virtual systemd[1]: Unit kdump.service entered failed state.
719 14:07:37 mesos-slave-dev001-cqdx.qiyi.virtual systemd[1]: kdump.service failed.

需要在 kernel 启动命令行参数中添加 crashkernel 参数,并启动 kdump 服务。
一般设置为 crashkernel=auto 表示根据系统内存自动 reserve 一些内存给 kernelcrash 用,在 x86_64 系统中内存大于等于 2GB 时会 reserve 内存,最小保留内存计算方法是:160 MB + 2 bits for every 4 KB of RAM.
当然,也可以设置 crashkernel=512M 这样的固定保留内存。

用 yum install kexec-tools 安装 kdump 工具和服务
用 systemctl start kdump 命令可以启动 kdump.service,用 systemctl enable kdump 让 dump 服务在开机时自动启动。
kdump.service 相关的配置文件 /etc/kdump.conf 里面可以修改一些默认的配置,比如 dump 完成后的动作(默认是 reboot)、dump 文件存放的方式(本地目录、NFS、scp 到另外服务器等)。

现在来看问题:

其实是需要设置一下 crashkernel=auto
检查后,发现 /etc/default/grub 文件并不存在,添加该文件的配置信息,如下:

GRUB_TIMEOUT=5
GRUB_DISTRIBUTOR="$(sed 's, release .*$,,g' /etc/system-release)"
GRUB_DEFAULT=saved
GRUB_DISABLE_SUBMENU=true
GRUB_TERMINAL_OUTPUT="console"
GRUB_CMDLINE_LINUX="crashkernel=auto net.ifnames=0 biosdevname=0 rhgb quiet"
GRUB_DISABLE_RECOVERY="true

然后让其生效:

# grub2-mkconfig -o /boot/grub2/grub.cfg

最后,reboot 机器即可。

[root@mesos-slave-dev001-cqdx ~]# systemctl status kdump.service
● kdump.service - Crash recovery kernel arming
   Loaded: loaded (/usr/lib/systemd/system/kdump.service; enabled; vendor preset: enabled)
   Active: active (exited) since 二 2016-07-19 14:15:16 CST; 14min ago
 Main PID: 1082 (code=exited, status=0/SUCCESS)
   Memory: 0B
   CGroup: /system.slice/kdump.service

719 14:15:13 mesos-slave-dev001-cqdx.qiyi.virtual systemd[1]: Starting Crash recovery kernel arming...
719 14:15:16 mesos-slave-dev001-cqdx.qiyi.virtual kdumpctl[1082]: kexec: loaded kdump kernel
719 14:15:16 mesos-slave-dev001-cqdx.qiyi.virtual kdumpctl[1082]: Starting kdump: [OK]
719 14:15:16 mesos-slave-dev001-cqdx.qiyi.virtual systemd[1]: Started Crash recovery kernel arming.
719 14:15:19 mesos-slave-dev001-cqdx.qiyi.virtual systemd[1]: Started Crash recovery kernel arming.
************* Preparing the environment for Debugger Extensions Gallery repositories ************** ExtensionRepository : Implicit UseExperimentalFeatureForNugetShare : true AllowNugetExeUpdate : true NonInteractiveNuget : true AllowNugetMSCredentialProviderInstall : true AllowParallelInitializationOfLocalRepositories : true EnableRedirectToChakraJsProvider : false -- Configuring repositories ----> Repository : LocalInstalled, Enabled: true ----> Repository : UserExtensions, Enabled: true >>>>>>>>>>>>> Preparing the environment for Debugger Extensions Gallery repositories completed, duration 0.000 seconds ************* Waiting for Debugger Extensions Gallery to Initialize ************** >>>>>>>>>>>>> Waiting for Debugger Extensions Gallery to Initialize completed, duration 0.015 seconds ----> Repository : UserExtensions, Enabled: true, Packages count: 0 ----> Repository : LocalInstalled, Enabled: true, Packages count: 44 Microsoft (R) Windows Debugger Version 10.0.27829.1001 AMD64 Copyright (c) Microsoft Corporation. All rights reserved. Loading Dump File [C:\Windows\Minidump\072425-40484-01.dmp] Mini Kernel Dump File: Only registers and stack trace are available ************* Path validation summary ************** Response Time (ms) Location Deferred srv* Symbol search path is: srv* Executable search path is: Windows 10 Kernel Version 26100 MP (16 procs) Free x64 Product: WinNt, suite: TerminalServer SingleUserTS Personal Kernel base = 0xfffff802`de600000 PsLoadedModuleList = 0xfffff802`df4f4c40 Debug session time: Thu Jul 24 13:19:52.572 2025 (UTC + 8:00) System Uptime: 0 days 0:38:49.409 Loading Kernel Symbols .. Press ctrl-c (cdb, kd, ntsd) or ctrl-break (windbg) to abort symbol loads that take too long. Run !sym noisy before .reload to track down problems loading symbols. ............................................................. ................................................................ ........................................................... Loading User Symbols Loading unloaded module list ........... For analysis of this file, run !analyze -v nt!KeBugCheckEx: fffff802`deb005d0 48894c2408 mov qword ptr [rsp+8],rcx ss:0018:fffff802`726a6e10=000000000000000a 0: kd> !analyze -v Loading Kernel Symbols ............................................................... ................................................................ ........................................................... Loading User Symbols Loading unloaded module list ........... ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* IRQL_NOT_LESS_OR_EQUAL (a) An attempt was made to access a pageable (or completely invalid) address at an interrupt request level (IRQL) that is too high. This is usually caused by drivers using improper addresses. If a kernel debugger is available get the stack backtrace. Arguments: Arg1: 0000000007e70010, memory referenced Arg2: 0000000000000002, IRQL Arg3: 0000000000000000, bitfield : bit 0 : value 0 = read operation, 1 = write operation bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status) Arg4: fffff802de8ff1f8, address which referenced memory Debugging Details: ------------------ *** WARNING: Unable to verify timestamp for aicusbwifi.sys KEY_VALUES_STRING: 1 Key : Analysis.CPU.mSec Value: 984 Key : Analysis.Elapsed.mSec Value: 11951 Key : Analysis.IO.Other.Mb Value: 1 Key : Analysis.IO.Read.Mb Value: 1 Key : Analysis.IO.Write.Mb Value: 2 Key : Analysis.Init.CPU.mSec Value: 453 Key : Analysis.Init.Elapsed.mSec Value: 127094 Key : Analysis.Memory.CommitPeak.Mb Value: 114 Key : Analysis.Version.DbgEng Value: 10.0.27829.1001 Key : Analysis.Version.Description Value: 10.2503.24.01 amd64fre Key : Analysis.Version.Ext Value: 1.2503.24.1 Key : Bugcheck.Code.LegacyAPI Value: 0xa Key : Bugcheck.Code.TargetModel Value: 0xa Key : Dump.Attributes.AsUlong Value: 0x2180c Key : Dump.Attributes.DiagDataWrittenToHeader Value: 1 Key : Dump.Attributes.ErrorCode Value: 0x0 Key : Dump.Attributes.InsufficientDumpfileSize Value: 1 Key : Dump.Attributes.KernelGeneratedTriageDump Value: 1 Key : Dump.Attributes.LastLine Value: Dump completed successfully. Key : Dump.Attributes.ProgressPercentage Value: 0 Key : Dump.Attributes.RequiredDumpfileSize Value: 0x458e9834 Key : Failure.Bucket Value: AV_aicusbwifi!unknown_function Key : Failure.Exception.IP.Address Value: 0xfffff802de8ff1f8 Key : Failure.Exception.IP.Module Value: nt Key : Failure.Exception.IP.Offset Value: 0x2ff1f8 Key : Failure.Hash Value: {88a7df4e-1779-d31a-2348-fb551a42f896} Key : Hypervisor.Enlightenments.ValueHex Value: 0x7497cf94 Key : Hypervisor.Flags.AnyHypervisorPresent Value: 1 Key : Hypervisor.Flags.ApicEnlightened Value: 1 Key : Hypervisor.Flags.ApicVirtualizationAvailable Value: 0 Key : Hypervisor.Flags.AsyncMemoryHint Value: 0 Key : Hypervisor.Flags.CoreSchedulerRequested Value: 0 Key : Hypervisor.Flags.CpuManager Value: 1 Key : Hypervisor.Flags.DeprecateAutoEoi Value: 0 Key : Hypervisor.Flags.DynamicCpuDisabled Value: 1 Key : Hypervisor.Flags.Epf Value: 0 Key : Hypervisor.Flags.ExtendedProcessorMasks Value: 1 Key : Hypervisor.Flags.HardwareMbecAvailable Value: 1 Key : Hypervisor.Flags.MaxBankNumber Value: 0 Key : Hypervisor.Flags.MemoryZeroingControl Value: 0 Key : Hypervisor.Flags.NoExtendedRangeFlush Value: 0 Key : Hypervisor.Flags.NoNonArchCoreSharing Value: 1 Key : Hypervisor.Flags.Phase0InitDone Value: 1 Key : Hypervisor.Flags.PowerSchedulerQos Value: 0 Key : Hypervisor.Flags.RootScheduler Value: 0 Key : Hypervisor.Flags.SynicAvailable Value: 1 Key : Hypervisor.Flags.UseQpcBias Value: 0 Key : Hypervisor.Flags.Value Value: 38408431 Key : Hypervisor.Flags.ValueHex Value: 0x24a10ef Key : Hypervisor.Flags.VpAssistPage Value: 1 Key : Hypervisor.Flags.VsmAvailable Value: 1 Key : Hypervisor.RootFlags.AccessStats Value: 1 Key : Hypervisor.RootFlags.CrashdumpEnlightened Value: 1 Key : Hypervisor.RootFlags.CreateVirtualProcessor Value: 1 Key : Hypervisor.RootFlags.DisableHyperthreading Value: 0 Key : Hypervisor.RootFlags.HostTimelineSync Value: 1 Key : Hypervisor.RootFlags.HypervisorDebuggingEnabled Value: 0 Key : Hypervisor.RootFlags.IsHyperV Value: 1 Key : Hypervisor.RootFlags.LivedumpEnlightened Value: 1 Key : Hypervisor.RootFlags.MapDeviceInterrupt Value: 1 Key : Hypervisor.RootFlags.MceEnlightened Value: 1 Key : Hypervisor.RootFlags.Nested Value: 0 Key : Hypervisor.RootFlags.StartLogicalProcessor Value: 1 Key : Hypervisor.RootFlags.Value Value: 1015 Key : Hypervisor.RootFlags.ValueHex Value: 0x3f7 Key : Stack.Pointer Value: NMI BUGCHECK_CODE: a BUGCHECK_P1: 7e70010 BUGCHECK_P2: 2 BUGCHECK_P3: 0 BUGCHECK_P4: fffff802de8ff1f8 FILE_IN_CAB: 072425-40484-01.dmp TAG_NOT_DEFINED_202b: *** Unknown TAG in analysis list 202b DUMP_FILE_ATTRIBUTES: 0x2180c Insufficient Dumpfile Size Kernel Generated Triage Dump FAULTING_THREAD: fffff802df5d1640 READ_ADDRESS: fffff802df5c44c0: Unable to get MiVisibleState Unable to get NonPagedPoolStart Unable to get NonPagedPoolEnd Unable to get PagedPoolStart Unable to get PagedPoolEnd unable to get nt!MmSpecialPagesInUse 0000000007e70010 BLACKBOXBSD: 1 (!blackboxbsd) BLACKBOXNTFS: 1 (!blackboxntfs) BLACKBOXPNP: 1 (!blackboxpnp) BLACKBOXWINLOGON: 1 CUSTOMER_CRASH_COUNT: 1 PROCESS_NAME: System DPC_STACK_BASE: FFFFF802726B0FB0 STACK_TEXT: fffff802`726a6e08 fffff802`decb96e9 : 00000000`0000000a 00000000`07e70010 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx fffff802`726a6e10 fffff802`decb49a8 : 00000000`00000001 ffffac07`e731c010 ffffac07`d3105490 00000000`00000002 : nt!KiBugCheckDispatch+0x69 fffff802`726a6f50 fffff802`de8ff1f8 : ffffac07`00000001 00000000`00000001 00000000`00000001 00000000`00000001 : nt!KiPageFault+0x468 fffff802`726a70e0 fffff802`de9bd2e5 : 00000000`00000618 00000000`00000001 ffffac07`d31002c0 ffffac07`e8024e48 : nt!RtlRbInsertNodeEx+0x3d8 fffff802`726a7140 fffff802`deaf749a : ffffac07`e91d4890 ffffac07`d3105480 ffffac07`00000000 00000000`0003a480 : nt!RtlpHpVsChunkSplit+0x905 fffff802`726a71e0 fffff802`de9bbede : ffffac07`d31002c3 fffff802`df4ee740 fffff802`0000002c fffff802`002c0000 : nt!RtlpHpVsSlotAllocate+0x29e fffff802`726a7240 fffff802`de8f91f3 : 00000000`0000028c fffff802`002c0000 00000000`0000002c fffff802`00000000 : nt!RtlpHpVsContextAllocate+0xd6 fffff802`726a72d0 fffff802`de8f7562 : 00000000`00000009 fffff802`df46ca40 00000000`486c7452 00000000`00000000 : nt!ExAllocateHeapPool+0x1c23 fffff802`726a7500 fffff802`df16b4fb : 00000000`00000042 00000000`0000028c 00000000`486c7452 fffff802`de8f92a1 : nt!ExpAllocatePoolWithTagFromNode+0x52 fffff802`726a7540 fffff802`dea5275a : 00000000`00000003 00000000`00000000 00000000`00000000 00000000`00000050 : nt!ExAllocatePool3+0xcb fffff802`726a75c0 fffff802`71963066 : ffffac07`e7169d88 fffff802`726a789a ffffac07`01500050 00000000`00000038 : nt!ExAllocatePoolWithTagPriority+0x11a fffff802`726a7610 fffff802`734b3a08 : ffffac07`dbf23910 fffff802`b503e068 00000000`00000000 00000000`00000000 : ndis!NdisAllocateMemoryWithTagPriority+0x26 fffff802`726a7640 ffffac07`dbf23910 : fffff802`b503e068 00000000`00000000 00000000`00000000 00000000`00000000 : aicusbwifi+0x53a08 fffff802`726a7648 fffff802`b503e068 : 00000000`00000000 00000000`00000000 00000000`00000000 000000e8`00000001 : 0xffffac07`dbf23910 fffff802`726a7650 fffff802`b503c798 : ffffac07`e7802200 00000000`00000000 00000000`00000000 fffff802`734985cb : USBXHCI!Bulk_MapStage+0xe8 fffff802`726a76c0 fffff802`7349933b : ffffac07`e551b030 ffffac07`e68576a0 fffff802`726a7800 00000000`00000000 : USBXHCI!Bulk_MapTransfers+0x88 fffff802`726a7730 ffffac07`e551b030 : ffffac07`e68576a0 fffff802`726a7800 00000000`00000000 00000001`00000000 : aicusbwifi+0x3933b fffff802`726a7738 ffffac07`e68576a0 : fffff802`726a7800 00000000`00000000 00000001`00000000 ffffac07`e780232e : 0xffffac07`e551b030 fffff802`726a7740 fffff802`726a7800 : 00000000`00000000 00000001`00000000 ffffac07`e780232e fffff802`726a789a : 0xffffac07`e68576a0 fffff802`726a7748 00000000`00000000 : 00000001`00000000 ffffac07`e780232e fffff802`726a789a fffff802`734c8d5a : 0xfffff802`726a7800 SYMBOL_NAME: aicusbwifi+53a08 MODULE_NAME: aicusbwifi IMAGE_NAME: aicusbwifi.sys STACK_COMMAND: .process /r /p 0xfffff802df5cef80; .thread 0xfffff802df5d1640 ; kb BUCKET_ID_FUNC_OFFSET: 53a08 FAILURE_BUCKET_ID: AV_aicusbwifi!unknown_function OSPLATFORM_TYPE: x64 OSNAME: Windows 10 FAILURE_ID_HASH: {88a7df4e-1779-d31a-2348-fb551a42f896} Followup: MachineOwner --------- NatVis script unloaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2504.15001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\atlmfc.natvis' NatVis script unloaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2504.15001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\concurrency.natvis' NatVis script unloaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2504.15001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\cpp_rest.natvis' NatVis script unloaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2504.15001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\Kernel.natvis' NatVis script unloaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2504.15001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\ObjectiveC.natvis' NatVis script unloaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2504.15001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\stl.natvis' NatVis script unloaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2504.15001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\Usb4Kd.natvis' NatVis script unloaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2504.15001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\Windows.Data.Json.natvis' NatVis script unloaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2504.15001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\Windows.Devices.Geolocation.natvis' NatVis script unloaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2504.15001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\Windows.Devices.Sensors.natvis' NatVis script unloaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2504.15001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\Windows.Media.natvis' NatVis script unloaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2504.15001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\windows.natvis' NatVis script unloaded from 'C:\Program Files\WindowsApps\Microsoft.WinDbg_1.2504.15001.0_x64__8wekyb3d8bbwe\amd64\Visualizers\winrt.natvis' ************* Preparing the environment for Debugger Extensions Gallery repositories ************** ExtensionRepository : Implicit UseExperimentalFeatureForNugetShare : true AllowNugetExeUpdate : true NonInteractiveNuget : true AllowNugetMSCredentialProviderInstall : true AllowParallelInitializationOfLocalRepositories : true EnableRedirectToChakraJsProvider : false -- Configuring repositories ----> Repository : LocalInstalled, Enabled: true ----> Repository : UserExtensions, Enabled: true >>>>>>>>>>>>> Preparing the environment for Debugger Extensions Gallery repositories completed, duration 0.000 seconds ************* Waiting for Debugger Extensions Gallery to Initialize ************** >>>>>>>>>>>>> Waiting for Debugger Extensions Gallery to Initialize completed, duration 0.016 seconds ----> Repository : UserExtensions, Enabled: true, Packages count: 0 ----> Repository : LocalInstalled, Enabled: true, Packages count: 44 Microsoft (R) Windows Debugger Version 10.0.27829.1001 AMD64 Copyright (c) Microsoft Corporation. All rights reserved. Loading Dump File [C:\Windows\Minidump\072425-40453-01.dmp] Mini Kernel Dump File: Only registers and stack trace are available ************* Path validation summary ************** Response Time (ms) Location Deferred srv* Symbol search path is: srv* Executable search path is: Windows 10 Kernel Version 26100 MP (16 procs) Free x64 Product: WinNt, suite: TerminalServer SingleUserTS Personal Kernel base = 0xfffff800`e7c00000 PsLoadedModuleList = 0xfffff800`e8af4c40 Debug session time: Thu Jul 24 16:42:59.836 2025 (UTC + 8:00) System Uptime: 0 days 2:19:17.673 Loading Kernel Symbols .. Press ctrl-c (cdb, kd, ntsd) or ctrl-break (windbg) to abort symbol loads that take too long. Run !sym noisy before .reload to track down problems loading symbols. ............................................................. ................................................................ ................................................................ ... Loading User Symbols Loading unloaded module list ............. For analysis of this file, run !analyze -v nt!KeBugCheckEx: fffff800`e81005d0 48894c2408 mov qword ptr [rsp+8],rcx ss:0018:fffff800`7be47450=000000000000000a 0: kd> !analyze -v Loading Kernel Symbols ............................................................... ................................................................ ................................................................ ... Loading User Symbols Loading unloaded module list ............. ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1) An attempt was made to access a pageable (or completely invalid) address at an interrupt request level (IRQL) that is too high. This is usually caused by drivers using improper addresses. If kernel debugger is available get stack backtrace. Arguments: Arg1: ffff920c833956a9, memory referenced Arg2: 0000000000000002, IRQL Arg3: 0000000000000000, value 0 = read operation, 1 = write operation Arg4: fffff8007c06c0ef, address which referenced memory Debugging Details: ------------------ *** WARNING: Unable to verify timestamp for aicusbwifi.sys KEY_VALUES_STRING: 1 Key : Analysis.CPU.mSec Value: 921 Key : Analysis.Elapsed.mSec Value: 11617 Key : Analysis.IO.Other.Mb Value: 0 Key : Analysis.IO.Read.Mb Value: 1 Key : Analysis.IO.Write.Mb Value: 0 Key : Analysis.Init.CPU.mSec Value: 437 Key : Analysis.Init.Elapsed.mSec Value: 254941 Key : Analysis.Memory.CommitPeak.Mb Value: 101 Key : Analysis.Version.DbgEng Value: 10.0.27829.1001 Key : Analysis.Version.Description Value: 10.2503.24.01 amd64fre Key : Analysis.Version.Ext Value: 1.2503.24.1 Key : Bugcheck.Code.LegacyAPI Value: 0xd1 Key : Bugcheck.Code.TargetModel Value: 0xd1 Key : Dump.Attributes.AsUlong Value: 0x2180c Key : Dump.Attributes.DiagDataWrittenToHeader Value: 1 Key : Dump.Attributes.ErrorCode Value: 0x0 Key : Dump.Attributes.InsufficientDumpfileSize Value: 1 Key : Dump.Attributes.KernelGeneratedTriageDump Value: 1 Key : Dump.Attributes.LastLine Value: Dump completed successfully. Key : Dump.Attributes.ProgressPercentage Value: 0 Key : Dump.Attributes.RequiredDumpfileSize Value: 0x57148ec0 Key : Failure.Bucket Value: AV_aicusbwifi!unknown_function Key : Failure.Exception.IP.Address Value: 0xfffff8007c06c0ef Key : Failure.Exception.IP.Module Value: aicusbwifi Key : Failure.Exception.IP.Offset Value: 0x6c0ef Key : Failure.Hash Value: {88a7df4e-1779-d31a-2348-fb551a42f896} Key : Hypervisor.Enlightenments.ValueHex Value: 0x7497cf94 Key : Hypervisor.Flags.AnyHypervisorPresent Value: 1 Key : Hypervisor.Flags.ApicEnlightened Value: 1 Key : Hypervisor.Flags.ApicVirtualizationAvailable Value: 0 Key : Hypervisor.Flags.AsyncMemoryHint Value: 0 Key : Hypervisor.Flags.CoreSchedulerRequested Value: 0 Key : Hypervisor.Flags.CpuManager Value: 1 Key : Hypervisor.Flags.DeprecateAutoEoi Value: 0 Key : Hypervisor.Flags.DynamicCpuDisabled Value: 1 Key : Hypervisor.Flags.Epf Value: 0 Key : Hypervisor.Flags.ExtendedProcessorMasks Value: 1 Key : Hypervisor.Flags.HardwareMbecAvailable Value: 1 Key : Hypervisor.Flags.MaxBankNumber Value: 0 Key : Hypervisor.Flags.MemoryZeroingControl Value: 0 Key : Hypervisor.Flags.NoExtendedRangeFlush Value: 0 Key : Hypervisor.Flags.NoNonArchCoreSharing Value: 1 Key : Hypervisor.Flags.Phase0InitDone Value: 1 Key : Hypervisor.Flags.PowerSchedulerQos Value: 0 Key : Hypervisor.Flags.RootScheduler Value: 0 Key : Hypervisor.Flags.SynicAvailable Value: 1 Key : Hypervisor.Flags.UseQpcBias Value: 0 Key : Hypervisor.Flags.Value Value: 38408431 Key : Hypervisor.Flags.ValueHex Value: 0x24a10ef Key : Hypervisor.Flags.VpAssistPage Value: 1 Key : Hypervisor.Flags.VsmAvailable Value: 1 Key : Hypervisor.RootFlags.AccessStats Value: 1 Key : Hypervisor.RootFlags.CrashdumpEnlightened Value: 1 Key : Hypervisor.RootFlags.CreateVirtualProcessor Value: 1 Key : Hypervisor.RootFlags.DisableHyperthreading Value: 0 Key : Hypervisor.RootFlags.HostTimelineSync Value: 1 Key : Hypervisor.RootFlags.HypervisorDebuggingEnabled Value: 0 Key : Hypervisor.RootFlags.IsHyperV Value: 1 Key : Hypervisor.RootFlags.LivedumpEnlightened Value: 1 Key : Hypervisor.RootFlags.MapDeviceInterrupt Value: 1 Key : Hypervisor.RootFlags.MceEnlightened Value: 1 Key : Hypervisor.RootFlags.Nested Value: 0 Key : Hypervisor.RootFlags.StartLogicalProcessor Value: 1 Key : Hypervisor.RootFlags.Value Value: 1015 Key : Hypervisor.RootFlags.ValueHex Value: 0x3f7 Key : Stack.Pointer Value: NMI BUGCHECK_CODE: d1 BUGCHECK_P1: ffff920c833956a9 BUGCHECK_P2: 2 BUGCHECK_P3: 0 BUGCHECK_P4: fffff8007c06c0ef FILE_IN_CAB: 072425-40453-01.dmp TAG_NOT_DEFINED_202b: *** Unknown TAG in analysis list 202b DUMP_FILE_ATTRIBUTES: 0x2180c Insufficient Dumpfile Size Kernel Generated Triage Dump FAULTING_THREAD: fffff800e8bd1640 READ_ADDRESS: fffff800e8bc44c0: Unable to get MiVisibleState Unable to get NonPagedPoolStart Unable to get NonPagedPoolEnd Unable to get PagedPoolStart Unable to get PagedPoolEnd unable to get nt!MmSpecialPagesInUse ffff920c833956a9 BLACKBOXBSD: 1 (!blackboxbsd) BLACKBOXNTFS: 1 (!blackboxntfs) BLACKBOXPNP: 1 (!blackboxpnp) BLACKBOXWINLOGON: 1 CUSTOMER_CRASH_COUNT: 1 PROCESS_NAME: System DPC_STACK_BASE: FFFFF8007BE50FB0 STACK_TEXT: fffff800`7be47448 fffff800`e82b96e9 : 00000000`0000000a ffff920c`833956a9 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx fffff800`7be47450 fffff800`e82b49a8 : fffff800`7be47720 ffff920c`0badb770 ffff920c`173e532e 00000000`00000000 : nt!KiBugCheckDispatch+0x69 fffff800`7be47590 fffff800`7c06c0ef : ffff920c`0fb90ba8 fffff800`7c004558 ffff920c`0b2b2648 00000000`00000000 : nt!KiPageFault+0x468 fffff800`7be47720 ffff920c`0fb90ba8 : fffff800`7c004558 ffff920c`0b2b2648 00000000`00000000 ffff920c`83395627 : aicusbwifi+0x6c0ef fffff800`7be47728 fffff800`7c004558 : ffff920c`0b2b2648 00000000`00000000 ffff920c`83395627 ffff920c`0fb90ba8 : 0xffff920c`0fb90ba8 fffff800`7be47730 ffff920c`0b2b2648 : 00000000`00000000 ffff920c`83395627 ffff920c`0fb90ba8 ffff920c`83395627 : aicusbwifi+0x4558 fffff800`7be47738 00000000`00000000 : ffff920c`83395627 ffff920c`0fb90ba8 ffff920c`83395627 ffff920c`173e532e : 0xffff920c`0b2b2648 SYMBOL_NAME: aicusbwifi+6c0ef MODULE_NAME: aicusbwifi IMAGE_NAME: aicusbwifi.sys STACK_COMMAND: .process /r /p 0xfffff800e8bcef80; .thread 0xfffff800e8bd1640 ; kb BUCKET_ID_FUNC_OFFSET: 6c0ef FAILURE_BUCKET_ID: AV_aicusbwifi!unknown_function OSPLATFORM_TYPE: x64 OSNAME: Windows 10 FAILURE_ID_HASH: {88a7df4e-1779-d31a-2348-fb551a42f896} Followup: MachineOwner
最新发布
07-25
************* Preparing the environment for Debugger Extensions Gallery repositories ************** ExtensionRepository : Implicit UseExperimentalFeatureForNugetShare : true AllowNugetExeUpdate : true NonInteractiveNuget : true AllowNugetMSCredentialProviderInstall : true AllowParallelInitializationOfLocalRepositories : true EnableRedirectToChakraJsProvider : false -- Configuring repositories ----> Repository : LocalInstalled, Enabled: true ----> Repository : UserExtensions, Enabled: true >>>>>>>>>>>>> Preparing the environment for Debugger Extensions Gallery repositories completed, duration 0.000 seconds ************* Waiting for Debugger Extensions Gallery to Initialize ************** >>>>>>>>>>>>> Waiting for Debugger Extensions Gallery to Initialize completed, duration 0.032 seconds ----> Repository : UserExtensions, Enabled: true, Packages count: 0 ----> Repository : LocalInstalled, Enabled: true, Packages count: 44 Microsoft (R) Windows Debugger Version 10.0.27829.1001 AMD64 Copyright (c) Microsoft Corporation. All rights reserved. Loading Dump File [C:\Users\86187\Desktop\052425-20093-01.dmp] Mini Kernel Dump File: Only registers and stack trace are available ************* Path validation summary ************** Response Time (ms) Location Deferred srv* Symbol search path is: srv* Executable search path is: Windows 10 Kernel Version 22621 MP (16 procs) Free x64 Product: WinNt, suite: TerminalServer SingleUserTS Personal Kernel base = 0xfffff807`59a0c000 PsLoadedModuleList = 0xfffff807`5a61f510 Debug session time: Sat May 24 00:12:56.102 2025 (UTC + 8:00) System Uptime: 0 days 0:16:19.782 Loading Kernel Symbols ............................................................... ................................................................ ................................................................ ................................................................ .. Loading User Symbols Loading unloaded module list ............... For analysis of this file, run !analyze -v nt!KeBugCheckEx: fffff807`59e23ba0 48894c2408 mov qword ptr [rsp+8],rcx ss:0018:fffff88b`b86d6dc0=000000000000001a 2: kd> !analyze -v Loading Kernel Symbols ............................................................... ................................................................ ................................................................ ................................................................ .. Loading User Symbols Loading unloaded module list ............... ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* MEMORY_MANAGEMENT (1a) # Any other values for parameter 1 must be individually examined. Arguments: Arg1: 0000000000001233, The subtype of the BugCheck. Arg2: 0000000000101603 Arg3: 0000000000000000 Arg4: 0000000000000000 Debugging Details: ------------------ *** WARNING: Unable to verify timestamp for ACE-CORE302706.sys KEY_VALUES_STRING: 1 Key : Analysis.CPU.mSec Value: 937 Key : Analysis.Elapsed.mSec Value: 15319 Key : Analysis.IO.Other.Mb Value: 0 Key : Analysis.IO.Read.Mb Value: 1 Key : Analysis.IO.Write.Mb Value: 0 Key : Analysis.Init.CPU.mSec Value: 15 Key : Analysis.Init.Elapsed.mSec Value: 10051 Key : Analysis.Memory.CommitPeak.Mb Value: 79 Key : Analysis.Version.DbgEng Value: 10.0.27829.1001 Key : Analysis.Version.Description Value: 10.2503.24.01 amd64fre Key : Analysis.Version.Ext Value: 1.2503.24.1 Key : Bugcheck.Code.LegacyAPI Value: 0x1a Key : Bugcheck.Code.TargetModel Value: 0x1a Key : Dump.Attributes.AsUlong Value: 0x1008 Key : Dump.Attributes.DiagDataWrittenToHeader Value: 1 Key : Dump.Attributes.ErrorCode Value: 0x0 Key : Dump.Attributes.KernelGeneratedTriageDump Value: 1 Key : Dump.Attributes.LastLine Value: Dump completed successfully. Key : Dump.Attributes.ProgressPercentage Value: 0 Key : Failure.Bucket Value: 0x1a_1233_ACE_CORE302706!unknown_function Key : Failure.Hash Value: {86ce45f4-5601-de55-b29f-a08345d23087} BUGCHECK_CODE: 1a BUGCHECK_P1: 1233 BUGCHECK_P2: 101603 BUGCHECK_P3: 0 BUGCHECK_P4: 0 FILE_IN_CAB: 052425-20093-01.dmp DUMP_FILE_ATTRIBUTES: 0x1008 Kernel Generated Triage Dump FAULTING_THREAD: ffff9d8a0d353080 BLACKBOXBSD: 1 (!blackboxbsd) BLACKBOXNTFS: 1 (!blackboxntfs) BLACKBOXPNP: 1 (!blackboxpnp) BLACKBOXWINLOGON: 1 CUSTOMER_CRASH_COUNT: 1 PROCESS_NAME: System STACK_TEXT: fffff88b`b86d6db8 fffff807`5a03d17a : 00000000`0000001a 00000000`00001233 00000000`00101603 00000000`00000000 : nt!KeBugCheckEx fffff88b`b86d6dc0 fffff807`59e9c6fe : 00000000`0000000f ffffd400`579c9180 00000000`00101603 00000000`00000000 : nt!MiShowBadMapper+0x28e fffff88b`b86d6ef0 fffff807`59c72cc8 : 00000000`00000000 fffff88b`b86d71b0 ffff8080`00000000 00000000`00000000 : nt!MiDeletePteRun+0x1fc58e fffff88b`b86d70e0 fffff807`59c73c9d : ffff8081`210ab220 00000000`00000000 00000000`00000002 fffff88b`b86d7210 : nt!MiDeleteVaTail+0x48 fffff88b`b86d7110 fffff807`59c6be0e : ffff9d89`f2187510 ffff9d8a`0d353080 fffff88b`b86d74b0 ffff9d8a`0d353780 : nt!MiDeletePagablePteRange+0x2ed fffff88b`b86d7420 fffff807`5a0bdbc7 : 00000000`00000000 ffff9d8a`00000001 ffff9d8a`092732a0 ffff9d89`f2187508 : nt!MiDeleteVirtualAddresses+0x4e fffff88b`b86d7470 fffff807`5a2c54c4 : 00000242`15643000 00000000`00000000 fffff88b`b86d7580 00000000`00000000 : nt!MiDeleteVad+0x1b7 fffff88b`b86d7530 fffff807`5a0c7acf : ffff9d89`f2187040 fffff807`00000008 ffff9d89`f21866c0 00000000`00000000 : nt!MiUnmapViewOfSection+0x1fd9c4 fffff88b`b86d7610 fffff807`5a0c7a1c : ffff9d8a`0d353080 00000000`00001000 ffffffff`80003964 ffff9d89`f2187040 : nt!NtUnmapViewOfSectionEx+0x9f fffff88b`b86d7660 fffff807`59e39205 : ffff9d8a`0d353080 ffff9d8a`0d353080 00000000`00000004 00000000`00000000 : nt!NtUnmapViewOfSection+0xc fffff88b`b86d7690 fffff807`59e29690 : fffff800`3b7ccb5b 00000000`00000000 00000000`00000000 00000000`00000002 : nt!KiSystemServiceCopyEnd+0x25 fffff88b`b86d7828 fffff800`3b7ccb5b : 00000000`00000000 00000000`00000000 00000000`00000002 00000002`47f9923b : nt!KiServiceLinkage fffff88b`b86d7830 00000000`00000000 : 00000000`00000000 00000000`00000002 00000002`47f9923b 00000000`00001000 : ACE_CORE302706+0x1cb5b SYMBOL_NAME: ACE_CORE302706+1cb5b MODULE_NAME: ACE_CORE302706 IMAGE_NAME: ACE-CORE302706.sys STACK_COMMAND: .process /r /p 0xffff9d89f2187040; .thread 0xffff9d8a0d353080 ; kb BUCKET_ID_FUNC_OFFSET: 1cb5b FAILURE_BUCKET_ID: 0x1a_1233_ACE_CORE302706!unknown_function OSPLATFORM_TYPE: x64 OSNAME: Windows 10 FAILURE_ID_HASH: {86ce45f4-5601-de55-b29f-a08345d23087} Followup: MachineOwner ---------
05-25
### 关于 Windows 10 Kernel Crash Dump Analysis 当分析与 `MEMORY_MANAGEMENT` (错误检查代码 0x1A) 相关的崩溃转储时,通常涉及内存管理子系统的严重问题。此特定错误检查可能由多种原因触发,包括驱动程序错误、硬件故障或操作系统内部逻辑异常[^1]。 #### 错误参数解释 对于 `MEMORY_MANAGEMENT` 的错误检查,其四个参数提供了关于崩溃的根本原因的重要线索: - **Parameter 1**: 表示具体的错误类型,在本例中为 `0x1233`,这通常指向内存分配失败或其他内存一致性问题。 - **Parameter 2**: 提供附加上下文信息,此处为 `0x101603`,可能是某个数据结构地址或状态标志位。 - **Parameter 3 和 Parameter 4**: 进一步细化错误场景的信息,具体含义依赖于前两个参数的内容。 这些参数的具体意义可以通过查阅 Microsoft 官方文档或调试工具中的帮助文件来确认[^2]。 #### 驱动程序关联分析 提到的 `ACE_CORE302706.sys` 是一个第三方设备驱动程序。如果该驱动程序被识别为潜在的原因之一,则需要重点审查以下几个方面: - **驱动版本兼容性**: 确认当前使用的驱动版本是否支持所运行的操作系统及其补丁级别。 - **调用堆栈跟踪**: 使用 WinDbg 工具加载崩溃转储文件后,通过命令 `.stacks`, `!analyze -v` 获取详细的调用链路,寻找是否有来自 `ACE_CORE302706.sys` 的可疑函数调用。 - **符号解析配置**: 正确设置符号路径以确保能够获取到完整的函数名称和源码位置信息。推荐使用如下命令初始化环境变量: ```cmd .sympath SRV*C:\Symbols*https://msdl.microsoft.com/download/symbols ``` 以下是执行初步分析的一个典型脚本片段: ```python import subprocess def analyze_dump(dump_file_path): command = f"windbg.exe -z {dump_file_path} -c \"!analyze -v; q\"" result = subprocess.run(command, shell=True, capture_output=True, text=True) return result.stdout.strip() print(analyze_dump(r"C:\path\to\memory.dmp")) ``` #### 建议措施 为了进一步诊断并解决问题,可以采取以下行动项: - 更新至最新版的 `ACE_CORE302706.sys` 或联系供应商获得技术支持。 - 启用高级启动选项下的“禁用自动重启”,以便捕获更多现场细节。 - 如果怀疑存在物理内存损坏,可借助 MemTest86 类型的应用进行全面测试。
评论
添加红包

请填写红包祝福语或标题

红包个数最小为10个

红包金额最低5元

当前余额3.43前往充值 >
需支付:10.00
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明:

1.余额是钱包充值的虚拟货币,按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载,可以购买VIP、付费专栏及课程。

余额充值