Bugcheck 7b during restart after installing volume filter driver on win2008 R2

Hi,

I have the windows 2008 R2 build 7600 on a VM hosted on ESX machine. I
installed my volume filter driver( manual start ) through the INF file(
works fine with 32-bit machines ). On restarting the system bugchecks.The
debugger shows the following.

*******************************************************************************
*
*
* Bugcheck Analysis
*
*
*
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 7B, {fffff880009a9928, ffffffffc0000034, 0, 0}

Probably caused by : ntkrnlmp.exe ( nt!PnpBootDeviceWait+136 )

Followup: MachineOwner

analyse -v

DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

BUGCHECK_STR: 0x7B

PROCESS_NAME: System

CURRENT_IRQL: 2

LAST_CONTROL_TRANSFER: from fffff8000157a6d2 to fffff8000147cf60

STACK_TEXT:
fffff880009a9178 fffff8000157a6d2 : fffff880009a9928 fffffa8003cb3b60
0000000000000065 fffff800014c3314 : nt!DbgBreakPointWithStatus
fffff880009a9180 fffff8000157b4be : 0000000000000003 0000000000000000
fffff800014bfee0 000000000000007b : nt!KiBugCheckDebugBreak+0x12
fffff880009a91e0 fffff80001485004 : 0000000000000003 fffff800014806f0
0000000000000010 0000000000000086 : nt!KeBugCheck2+0x71e
fffff880009a98b0 fffff800015990d6 : 000000000000007b fffff880009a9928
ffffffffc0000034 0000000000000000 : nt!KeBugCheckEx+0x104
fffff880009a98f0 fffff800019b2034 : 0000000000000001 ffffffff80000104
0000000000000046 fffff8a000208980 : nt!PnpBootDeviceWait+0x136
fffff880009a9970 fffff800019b2921 : fffff8a0001590e0 fffff8000080e560
0000000000000003 ffffffff800000bc : nt!IopInitializeBootDrivers+0x624
fffff880009a9a40 fffff800019b5b20 : 0000000000000000 0000000000000010
ffffffff80000028 fffff8000080e560 : nt!IoInitSystem+0x801
fffff880009a9b40 fffff80001906419 : 44104f8b482f7401 fffffa8003cb3b60
0000000000000080 fffffa8003cb3040 : nt!Phase1InitializationDiscard+0x1290
fffff880009a9d10 fffff80001728166 : 3844104f8b484aeb 0000000000000080
4805b200000024b9 fffff80001463479 : nt!Phase1Initialization+0x9
fffff880009a9d40 fffff80001463486 : fffff800015fde80 fffffa8003cb3b60
fffff8000160bc40 8b487174c43b4900 : nt!PspSystemThreadStartup+0x5a
fffff880009a9d80 0000000000000000 : fffff880009aa000 fffff880009a4000
fffff880009a9650 0000000000000000 : nt!KxStartSystemThread+0x16

STACK_COMMAND: kb

FOLLOWUP_IP:
nt!PnpBootDeviceWait+136
fffff800`015990d6 cc int 3

SYMBOL_STACK_INDEX: 4

SYMBOL_NAME: nt!PnpBootDeviceWait+136

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 4a5bc600

FAILURE_BUCKET_ID: X64_0x7B_nt!PnpBootDeviceWait+136

BUCKET_ID: X64_0x7B_nt!PnpBootDeviceWait+136

Followup: MachineOwner

Some googling told me that it is due to some decoration related stuff
required to install driver in 64-bit m/c. I found a work-around
http://www.microsoft.com/communities/newsgroups/en-us/default.aspx?dg=microsoft.public.windows.developer.winfx.general&tid=9b3b9d84-00df-4b94-a3b8-ab7271b11f55&cat=〈=en&cr=US&sloc=&p=1http:

- To turn off the undecorated models check for AMD64, create the
following non-zero number registry value:
HKLM\Software\Microsoft\Windows\CurrentVersion\Setup: REG_DWORD:
DisableDecoratedModelsRequirement
Set it to say 1, reboot, and then you will be able to install undecorated
INFs on amd64.

I applied this, still the result is the same. Is there any way to avoid this
problem? Or decorating my INF files the only way out?

Thanks in advance

-Nitesh</http:>

A volume filter should really be boot start, otherwise the boot volume can’t
start due to the missing filter driver. I’m surprised that this worked on
32bit.

Also, is your driver signed? Unsigned drivers won’t load on 64bit Windows,
which would also explain the crash.

-scott


Scott Noone
Consulting Associate
OSR Open Systems Resources, Inc.
http://www.osronline.com

“Nitesh Agrawal” wrote in message news:xxxxx@ntdev…
Hi,

I have the windows 2008 R2 build 7600 on a VM hosted on ESX machine. I
installed my volume filter driver( manual start ) through the INF file(
works fine with 32-bit machines ). On restarting the system bugchecks.The
debugger shows the following.




Bugcheck Analysis



******

Use !analyze -v to get detailed debugging information.

BugCheck 7B, {fffff880009a9928, ffffffffc0000034, 0, 0}

Probably caused by : ntkrnlmp.exe ( nt!PnpBootDeviceWait+136 )

Followup: MachineOwner
---------

>analyse -v



DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

BUGCHECK_STR: 0x7B

PROCESS_NAME: System

CURRENT_IRQL: 2

LAST_CONTROL_TRANSFER: from fffff8000157a6d2 to fffff8000147cf60

STACK_TEXT:
fffff880009a9178 fffff8000157a6d2 : fffff880009a9928 fffffa8003cb3b60
0000000000000065 fffff800014c3314 : nt!DbgBreakPointWithStatus
fffff880009a9180 fffff8000157b4be : 0000000000000003 0000000000000000
fffff800014bfee0 000000000000007b : nt!KiBugCheckDebugBreak+0x12
fffff880009a91e0 fffff80001485004 : 0000000000000003 fffff800014806f0
0000000000000010 0000000000000086 : nt!KeBugCheck2+0x71e
fffff880009a98b0 fffff800015990d6 : 000000000000007b fffff880009a9928
ffffffffc0000034 0000000000000000 : nt!KeBugCheckEx+0x104
fffff880009a98f0 fffff800019b2034 : 0000000000000001 ffffffff80000104
0000000000000046 fffff8a000208980 : nt!PnpBootDeviceWait+0x136
fffff880009a9970 fffff800019b2921 : fffff8a0001590e0 fffff8000080e560
0000000000000003 ffffffff800000bc : nt!IopInitializeBootDrivers+0x624
fffff880009a9a40 fffff800019b5b20 : 0000000000000000 0000000000000010
ffffffff80000028 fffff8000080e560 : nt!IoInitSystem+0x801
fffff880009a9b40 fffff80001906419 : 44104f8b482f7401 fffffa8003cb3b60
0000000000000080 fffffa8003cb3040 : nt!Phase1InitializationDiscard+0x1290
fffff880009a9d10 fffff80001728166 : 3844104f8b484aeb 0000000000000080
4805b200000024b9 fffff80001463479 : nt!Phase1Initialization+0x9
fffff880009a9d40 fffff80001463486 : fffff800015fde80 fffffa8003cb3b60
fffff8000160bc40 8b487174c43b4900 : nt!PspSystemThreadStartup+0x5a
fffff880009a9d80 0000000000000000 : fffff880009aa000 fffff880009a4000
fffff880009a9650 0000000000000000 : nt!KxStartSystemThread+0x16

STACK_COMMAND: kb

FOLLOWUP_IP:
nt!PnpBootDeviceWait+136
fffff800`015990d6 cc int 3

SYMBOL_STACK_INDEX: 4

SYMBOL_NAME: nt!PnpBootDeviceWait+136

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 4a5bc600

FAILURE_BUCKET_ID: X64_0x7B_nt!PnpBootDeviceWait+136

BUCKET_ID: X64_0x7B_nt!PnpBootDeviceWait+136

Followup: MachineOwner
---------

Some googling told me that it is due to some decoration related stuff
required to install driver in 64-bit m/c. I found a work-around
http://www.microsoft.com/communities/newsgroups/en-us/default.aspx?dg=microsoft.public.windows.developer.winfx.general&amp;tid=9b3b9d84-00df-4b94-a3b8-ab7271b11f55&amp;cat=?=en&amp;cr=US&amp;sloc=&amp;p=1

- To turn off the undecorated models check for AMD64, create the
following non-zero number registry value:
HKLM\Software\Microsoft\Windows\CurrentVersion\Setup: REG_DWORD:
DisableDecoratedModelsRequirement
Set it to say 1, reboot, and then you will be able to install undecorated
INFs on amd64.

I applied this, still the result is the same. Is there any way to avoid this
problem? Or decorating my INF files the only way out?

Thanks in advance

-Nitesh

Thanks for the reply Scott…You are right… I am aware because the driver
is a volume filter it should be boot start…sorry I forgot to mention that
on 32-bit I made the driver boot start and it was working fine. On 64-bit I
did the same, but after seeing that crash is happening, as a workaround I
made the driver manual start so that it does not interfere with boot
process. Then I planned to attach it as a filter to a volume by adding a
volume after boot( by deleting a partition and creating a new one from disk
management ) just to test if my filtering functionality is working. It is
doing the required functionality, but as soon as I restart the system, it
crashes…despite the fact that it is not boot start.

The driver is still in development process, and so it is not signed. But I
was able to install it as a manual start and loading it by “net start
mydriver”. Still do you mean to say that it would bugcheck on restart?

Thanks
-Nitesh

On Fri, Oct 30, 2009 at 8:40 PM, Scott Noone wrote:

> A volume filter should really be boot start, otherwise the boot volume
> can’t
> start due to the missing filter driver. I’m surprised that this worked on
> 32bit.
>
> Also, is your driver signed? Unsigned drivers won’t load on 64bit Windows,
> which would also explain the crash.
>
> -scott
>
> –
> Scott Noone
> Consulting Associate
> OSR Open Systems Resources, Inc.
> http://www.osronline.com
>
>
> “Nitesh Agrawal” wrote in message news:xxxxx@ntdev.
> …
> Hi,
>
>
> I have the windows 2008 R2 build 7600 on a VM hosted on ESX machine. I
> installed my volume filter driver( manual start ) through the INF file(
> works fine with 32-bit machines ). On restarting the system bugchecks.The
> debugger shows the following.
>
>
>
> *****
>
>
> * Bugcheck Analysis
>
>
>
>
>

>
>
> Use !analyze -v to get detailed debugging information.
>
>
> BugCheck 7B, {fffff880009a9928, ffffffffc0000034, 0, 0}
>
>
> Probably caused by : ntkrnlmp.exe ( nt!PnpBootDeviceWait+136 )
>
>
> Followup: MachineOwner
> ---------
>
>
> >analyse -v
>
>
> …
>
>
>
>
> DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
>
>
> BUGCHECK_STR: 0x7B
>
>
> PROCESS_NAME: System
>
>
> CURRENT_IRQL: 2
>
>
> LAST_CONTROL_TRANSFER: from fffff8000157a6d2 to fffff8000147cf60
>
>
> STACK_TEXT:
> fffff880009a9178 fffff8000157a6d2 : fffff880009a9928 fffffa8003cb3b60
> 0000000000000065 fffff800014c3314 : nt!DbgBreakPointWithStatus
> fffff880009a9180 fffff8000157b4be : 0000000000000003 0000000000000000
> fffff800014bfee0 000000000000007b : nt!KiBugCheckDebugBreak+0x12
> fffff880009a91e0 fffff80001485004 : 0000000000000003 fffff800014806f0
> 0000000000000010 0000000000000086 : nt!KeBugCheck2+0x71e
> fffff880009a98b0 fffff800015990d6 : 000000000000007b fffff880009a9928
> ffffffffc0000034 0000000000000000 : nt!KeBugCheckEx+0x104
> fffff880009a98f0 fffff800019b2034 : 0000000000000001 ffffffff80000104
> 0000000000000046 fffff8a000208980 : nt!PnpBootDeviceWait+0x136
> fffff880009a9970 fffff800019b2921 : fffff8a0001590e0 fffff8000080e560
> 0000000000000003 ffffffff800000bc : nt!IopInitializeBootDrivers+0x624
> fffff880009a9a40 fffff800019b5b20 : 0000000000000000 0000000000000010
> ffffffff80000028 fffff8000080e560 : nt!IoInitSystem+0x801
> fffff880009a9b40 fffff80001906419 : 44104f8b482f7401 fffffa8003cb3b60
> 0000000000000080 fffffa8003cb3040 : nt!Phase1InitializationDiscard+0x1290
> fffff880009a9d10 fffff80001728166 : 3844104f8b484aeb 0000000000000080
> 4805b200000024b9 fffff80001463479 : nt!Phase1Initialization+0x9
> fffff880009a9d40 fffff80001463486 : fffff800015fde80 fffffa8003cb3b60
> fffff8000160bc40 8b487174c43b4900 : nt!PspSystemThreadStartup+0x5a
> fffff880009a9d80 0000000000000000 : fffff880009aa000 fffff880009a4000
> fffff880009a9650 0000000000000000 : nt!KxStartSystemThread+0x16
>
>
>
>
> STACK_COMMAND: kb
>
>
> FOLLOWUP_IP:
> nt!PnpBootDeviceWait+136
> fffff800`015990d6 cc int 3
>
>
> SYMBOL_STACK_INDEX: 4
>
>
> SYMBOL_NAME: nt!PnpBootDeviceWait+136
>
>
> FOLLOWUP_NAME: MachineOwner
>
>
> MODULE_NAME: nt
>
>
> IMAGE_NAME: ntkrnlmp.exe
>
>
> DEBUG_FLR_IMAGE_TIMESTAMP: 4a5bc600
>
>
> FAILURE_BUCKET_ID: X64_0x7B_nt!PnpBootDeviceWait+136
>
>
> BUCKET_ID: X64_0x7B_nt!PnpBootDeviceWait+136
>
>
> Followup: MachineOwner
> ---------
>
>
>
>
>
>
> Some googling told me that it is due to some decoration related stuff
> required to install driver in 64-bit m/c. I found a work-around
>
> http://www.microsoft.com/communities/newsgroups/en-us/default.aspx?dg=microsoft.public.windows.developer.winfx.general&amp;tid=9b3b9d84-00df-4b94-a3b8-ab7271b11f55&amp;cat=?=en&amp;cr=US&amp;sloc=&amp;p=1
>
>
> - To turn off the undecorated models check for AMD64, create the
> following non-zero number registry value:
> HKLM\Software\Microsoft\Windows\CurrentVersion\Setup: REG_DWORD:
> DisableDecoratedModelsRequirement
> Set it to say 1, reboot, and then you will be able to install undecorated
> INFs on amd64.
>
>
> I applied this, still the result is the same. Is there any way to avoid
> this
> problem? Or decorating my INF files the only way out?
>
>
>
>
> Thanks in advance
>
>
> -Nitesh
>
>
>
> —
> NTDEV is sponsored by OSR
>
> For our schedule of WDF, WDM, debugging and other seminars visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer
>

>It is doing the required functionality, but as soon as I restart the

system, it crashes…despite the fact that it is not boot start.

If you put yourself as a filter to a boot start driver then you also have to
be boot start; that driver can’t start without its filters loaded.

The driver is still in development process, and so it is not signed…Still
do you mean to say that it would bugcheck on restart?

If the O/S can’t load your filter for any reason then the system might not
be able to boot. You can test sign your driver or disable signature
enforcement during boot with F8.

-scott


Scott Noone
Consulting Associate
OSR Open Systems Resources, Inc.
http://www.osronline.com

“Nitesh Agrawal” wrote in message news:xxxxx@ntdev…
Thanks for the reply Scott…You are right… I am aware because the driver
is a volume filter it should be boot start…sorry I forgot to mention that
on 32-bit I made the driver boot start and it was working fine. On 64-bit I
did the same, but after seeing that crash is happening, as a workaround I
made the driver manual start so that it does not interfere with boot
process. Then I planned to attach it as a filter to a volume by adding a
volume after boot( by deleting a partition and creating a new one from disk
management ) just to test if my filtering functionality is working. It is
doing the required functionality, but as soon as I restart the system, it
crashes…despite the fact that it is not boot start.

The driver is still in development process, and so it is not signed. But I
was able to install it as a manual start and loading it by “net start
mydriver”. Still do you mean to say that it would bugcheck on restart?

Thanks
-Nitesh

On Fri, Oct 30, 2009 at 8:40 PM, Scott Noone wrote:

A volume filter should really be boot start, otherwise the boot volume can’t
start due to the missing filter driver. I’m surprised that this worked on
32bit.

Also, is your driver signed? Unsigned drivers won’t load on 64bit Windows,
which would also explain the crash.

-scott


Scott Noone
Consulting Associate
OSR Open Systems Resources, Inc.
http://www.osronline.com

“Nitesh Agrawal” wrote in message news:xxxxx@ntdev…

Hi,

I have the windows 2008 R2 build 7600 on a VM hosted on ESX machine. I
installed my volume filter driver( manual start ) through the INF file(
works fine with 32-bit machines ). On restarting the system bugchecks.The
debugger shows the following.




Bugcheck Analysis



******

Use !analyze -v to get detailed debugging information.

BugCheck 7B, {fffff880009a9928, ffffffffc0000034, 0, 0}

Probably caused by : ntkrnlmp.exe ( nt!PnpBootDeviceWait+136 )

Followup: MachineOwner
---------

>analyse -v



DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

BUGCHECK_STR: 0x7B

PROCESS_NAME: System

CURRENT_IRQL: 2

LAST_CONTROL_TRANSFER: from fffff8000157a6d2 to fffff8000147cf60

STACK_TEXT:
fffff880009a9178 fffff8000157a6d2 : fffff880009a9928 fffffa8003cb3b60
0000000000000065 fffff800014c3314 : nt!DbgBreakPointWithStatus
fffff880009a9180 fffff8000157b4be : 0000000000000003 0000000000000000
fffff800014bfee0 000000000000007b : nt!KiBugCheckDebugBreak+0x12
fffff880009a91e0 fffff80001485004 : 0000000000000003 fffff800014806f0
0000000000000010 0000000000000086 : nt!KeBugCheck2+0x71e
fffff880009a98b0 fffff800015990d6 : 000000000000007b fffff880009a9928
ffffffffc0000034 0000000000000000 : nt!KeBugCheckEx+0x104
fffff880009a98f0 fffff800019b2034 : 0000000000000001 ffffffff80000104
0000000000000046 fffff8a000208980 : nt!PnpBootDeviceWait+0x136
fffff880009a9970 fffff800019b2921 : fffff8a0001590e0 fffff8000080e560
0000000000000003 ffffffff800000bc : nt!IopInitializeBootDrivers+0x624
fffff880009a9a40 fffff800019b5b20 : 0000000000000000 0000000000000010
ffffffff80000028 fffff8000080e560 : nt!IoInitSystem+0x801
fffff880009a9b40 fffff80001906419 : 44104f8b482f7401 fffffa8003cb3b60
0000000000000080 fffffa8003cb3040 : nt!Phase1InitializationDiscard+0x1290
fffff880009a9d10 fffff80001728166 : 3844104f8b484aeb 0000000000000080
4805b200000024b9 fffff80001463479 : nt!Phase1Initialization+0x9
fffff880009a9d40 fffff80001463486 : fffff800015fde80 fffffa8003cb3b60
fffff8000160bc40 8b487174c43b4900 : nt!PspSystemThreadStartup+0x5a
fffff880009a9d80 0000000000000000 : fffff880009aa000 fffff880009a4000
fffff880009a9650 0000000000000000 : nt!KxStartSystemThread+0x16

STACK_COMMAND: kb

FOLLOWUP_IP:
nt!PnpBootDeviceWait+136
fffff800`015990d6 cc int 3

SYMBOL_STACK_INDEX: 4

SYMBOL_NAME: nt!PnpBootDeviceWait+136

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 4a5bc600

FAILURE_BUCKET_ID: X64_0x7B_nt!PnpBootDeviceWait+136

BUCKET_ID: X64_0x7B_nt!PnpBootDeviceWait+136

Followup: MachineOwner
---------

Some googling told me that it is due to some decoration related stuff
required to install driver in 64-bit m/c. I found a work-around
http://www.microsoft.com/communities/newsgroups/en-us/default.aspx?dg=microsoft.public.windows.developer.winfx.general&amp;tid=9b3b9d84-00df-4b94-a3b8-ab7271b11f55&amp;cat=?=en&amp;cr=US&amp;sloc=&amp;p=1

- To turn off the undecorated models check for AMD64, create the
following non-zero number registry value:
HKLM\Software\Microsoft\Windows\CurrentVersion\Setup: REG_DWORD:
DisableDecoratedModelsRequirement
Set it to say 1, reboot, and then you will be able to install undecorated
INFs on amd64.

I applied this, still the result is the same. Is there any way to avoid this
problem? Or decorating my INF files the only way out?

Thanks in advance

-Nitesh


NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:

http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

>I have the windows 2008 R2 build 7600 on a VM hosted on ESX machine. I installed my volume filter

driver( manual start )

Must be boot start.


Maxim S. Shatskih
Windows DDK MVP
xxxxx@storagecraft.com
http://www.storagecraft.com

> On restarting the system bugchecks.The debugger shows the following.
The debugger shows that boot volume is not available. Change your filter to Start=0.

Igor Sharovar

Yeah that worked…had to disable driver signing check from boot menu upon
F8…

Will test sign the driver to avoid further problems.

Thanks
-Nitesh

On Sat, Oct 31, 2009 at 4:46 PM, wrote:

> > On restarting the system bugchecks.The debugger shows the following.
> The debugger shows that boot volume is not available. Change your filter to
> Start=0.
>
> Igor Sharovar
>
>
> —
> NTDEV is sponsored by OSR
>
> For our schedule of WDF, WDM, debugging and other seminars visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer
>