How to debug 0x7B

All,

we are experiencing the BSOD 0x7B, inaccessible boot device after moving an
OS image from one computer to another. it was done through a commercially
available backup/recovery product which apparently advertises that it
supports dissimilar hardware restores.

The product makes this happen by injecting the right drivers into the OS
being restored. It probes the PNP IDs of hte devices and asks us to supply
the drivers which are required for the platform we are performing the
restore upon. We have been using the product for a while now, and all works.

We faced a problem the first time with one particular Win2k3 sp2 32 bit
machine when we tried to restore it. Before we go any further I should let
u all know that we have tried restores of other win2k3 images on the same
hardware and it works without any problems. However this particular image
blue screens.

Now coming to the scenario:

we see the blue screen when the os tries to set the boot partition
*IoMarkBootPartition
*and after debugging through the function I see that the call ZwOpenFile
returns status invalid parameter. It then proceeds to show us the blue
screen.

The arc name passed to the function seems to be correct and it indeed is
the boot device, and upon checking for the active flag we see that it is
set as well.

Can some one please help us with how to debug this further and to know what
is going wrong. If you need further information please do let me know I
will furnish you the same.

Do ‘lmi’ command, see if the driver for the boot adapter is loaded.

0x7B is usually caused by a mismatch of storage controller settings in the Firmware/BIOS.
If the backup was created on a system with ATA emulation and being restored to AHCI/RAID enabled controller the system will stop with a 7B. There is nothing wrong with the driver itself.

To correct the issue, the registry setting for the driver load has to be altered in order for Windows to load the correct storage controller driver, or the BIOS/Firmware controller settings have to be changed to match the settings from the source system.

@grigora - How do I know which module name to pass to !lmi?

@berhard - thanks for reminding this. however, that was the first thing I
did, checked whether the BIOS access modes matched. the source machine is a
very old one with an integrated IDE controller and has only onboard
settings. (Primary IDE channel : enabled/Disabled master and Slave device)
the target is a new machine and the IDE mode is set to compatibility. it is
an IBM server, and it has dual mode BIOS and UEFI. We are using the BIOS
mode here.

below is the stack trace…(though it wont help much)

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0x7B

PROCESS_NAME: System

CURRENT_IRQL: 0

ANALYSIS_VERSION: 6.3.9600.17029 (debuggers(dbg).140219-1702) x86fre

LAST_CONTROL_TRANSFER: from 80826c77 to 80873724

STACK_TEXT:
f789e644 80826c77 00000003 00000003 00000000
nt!RtlpBreakWithStatusInstruction
f789e690 80827b84 00000003 00000000 80084000 nt!KiBugCheckDebugBreak+0x19
f789ea28 80827f7d 0000007b f789ea94 c0000034 nt!KeBugCheck2+0x5ea
f789ea48 80a0983f 0000007b f789ea94 c0000034 nt!KeBugCheckEx+0x1b
f789ebb0 80a0bd15 80084000 00000000 80084000 nt!IopMarkBootPartition+0xf7
f789ec00 80a085d3 80084000 f789ec44 00000000
nt!IopInitializeBootDrivers+0x4bb
f789ec70 80a0672a 80084000 00000000 91318940 nt!IoInitSystem+0x663
f789eda0 808eab3f 80084000 f789eddc 8094c16a
nt!Phase1InitializationDiscard+0xad0
f789edac 8094c16a 80084000 00000000 00000000 nt!Phase1Initialization+0xd
f789eddc 8088fe2e 808eab32 80084000 00000000 nt!PspSystemThreadStartup+0x2e
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16

On Wed, May 14, 2014 at 10:42 PM, wrote:

> 0x7B is usually caused by a mismatch of storage controller settings in the
> Firmware/BIOS.
> If the backup was created on a system with ATA emulation and being
> restored to AHCI/RAID enabled controller the system will stop with a 7B.
> There is nothing wrong with the driver itself.
>
> To correct the issue, the registry setting for the driver load has to be
> altered in order for Windows to load the correct storage controller driver,
> or the BIOS/Firmware controller settings have to be changed to match the
> settings from the source system.
>
> —
> NTDEV is sponsored by OSR
>
> Visit the list at: http://www.osronline.com/showlists.cfm?list=ntdev
>
> OSR is HIRING!! See http://www.osr.com/careers
>
> For our schedule of WDF, WDM, debugging and other seminars visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer
>

Is the correct driver binary loaded by the kernel?
“Bedanto” wrote in message news:xxxxx@ntdev…
All,

we are experiencing the BSOD 0x7B, inaccessible boot device after moving an OS image from one computer to another. it was done through a commercially available backup/recovery product which apparently advertises that it supports dissimilar hardware restores.

The product makes this happen by injecting the right drivers into the OS being restored. It probes the PNP IDs of hte devices and asks us to supply the drivers which are required for the platform we are performing the restore upon. We have been using the product for a while now, and all works.

We faced a problem the first time with one particular Win2k3 sp2 32 bit machine when we tried to restore it. Before we go any further I should let u all know that we have tried restores of other win2k3 images on the same hardware and it works without any problems. However this particular image blue screens.

Now coming to the scenario:

we see the blue screen when the os tries to set the boot partition IoMarkBootPartition and after debugging through the function I see that the call ZwOpenFile returns status invalid parameter. It then proceeds to show us the blue screen.

The arc name passed to the function seems to be correct and it indeed is the boot device, and upon checking for the active flag we see that it is set as well.

Can some one please help us with how to debug this further and to know what is going wrong. If you need further information please do let me know I will furnish you the same.

> If the backup was created on a system with ATA emulation and being restored to AHCI/RAID

enabled controller the system will stop with a 7B

Just enable MSAHCI.SYS in the registry.

Also, you can put the proprietary driver to system32\drivers, also to the SC database registry and to CriticalDeviceDatabase registry.

The latter is a quick replacement for INF files available early at boot.

Then, after the OS will boot, you need to install the real driver package with an INF to the boot storage controller, and reboot once more.

Most backup products go this way.


Maxim S. Shatskih
Microsoft MVP on File System And Storage
xxxxx@storagecraft.com
http://www.storagecraft.com

When the system prompted for the driver at restore time we pointed it to
the inf of the raid hardware present and the PNP manager picked the driver
itself…so I am guessing it should be the right one. But that is not the
only reason for my confidence here, the other image we restored, the one
which worked chose the same driver and that boots up.

I am not sure, but is there some sort of a coinstaller that should be
invoked but isn’t getting called due to an error and hence certain registry
keys may be missing. But that also doesn’t hold true, we diffed the
registry of the failing is and the booting one and as far as I can tell
both are similar. Buy I don’t know if I am looking at alp the relevant info
sections in the registry or missing out on some…

On Thursday, May 15, 2014, Maxim S. Shatskih wrote:

> Is the correct driver binary loaded by the kernel?
>
> “Bedanto” >
> wrote in message news:xxxxx@ntdev…
> All,
>
> we are experiencing the BSOD 0x7B, inaccessible boot device after moving
> an OS image from one computer to another. it was done through a
> commercially available backup/recovery product which apparently advertises
> that it supports dissimilar hardware restores.
>
> The product makes this happen by injecting the right drivers into the OS
> being restored. It probes the PNP IDs of hte devices and asks us to supply
> the drivers which are required for the platform we are performing the
> restore upon. We have been using the product for a while now, and all works.
>
> We faced a problem the first time with one particular Win2k3 sp2 32 bit
> machine when we tried to restore it. Before we go any further I should let
> u all know that we have tried restores of other win2k3 images on the same
> hardware and it works without any problems. However this particular image
> blue screens.
>
> Now coming to the scenario:
>
> we see the blue screen when the os tries to set the boot partition *IoMarkBootPartition
> *and after debugging through the function I see that the call ZwOpenFile
> returns status invalid parameter. It then proceeds to show us the blue
> screen.
>
> The arc name passed to the function seems to be correct and it indeed is
> the boot device, and upon checking for the active flag we see that it is
> set as well.
>
>
> Can some one please help us with how to debug this further and to know
> what is going wrong. If you need further information please do let me know
> I will furnish you the same.
>
>
>
> —
> NTDEV is sponsored by OSR
>
> Visit the list at: http://www.osronline.com/showlists.cfm?list=ntdev
>
> OSR is HIRING!! See http://www.osr.com/careers
>
> For our schedule of WDF, WDM, debugging and other seminars visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer
>

@maxim…do u mean to say I enable msahci even when the machine isn’t in
ahci mode? Would this service entry be present and disabled or would I have
to create it?

We have put the entries in the critical device database as well but no luck.

On Thursday, May 15, 2014, Maxim S. Shatskih wrote:

> > If the backup was created on a system with ATA emulation and being
> restored to AHCI/RAID
> >enabled controller the system will stop with a 7B
>
> Just enable MSAHCI.SYS in the registry.
>
> Also, you can put the proprietary driver to system32\drivers, also to the
> SC database registry and to CriticalDeviceDatabase registry.
>
> The latter is a quick replacement for INF files available early at boot.
>
> Then, after the OS will boot, you need to install the real driver package
> with an INF to the boot storage controller, and reboot once more.
>
> Most backup products go this way.
>
> –
> Maxim S. Shatskih
> Microsoft MVP on File System And Storage
> xxxxx@storagecraft.com <javascript:>
> http://www.storagecraft.com
>
>
> —
> NTDEV is sponsored by OSR
>
> Visit the list at: http://www.osronline.com/showlists.cfm?list=ntdev
>
> OSR is HIRING!! See http://www.osr.com/careers
>
> For our schedule of WDF, WDM, debugging and other seminars visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer
></javascript:>

You can boot to WinRE and import the registry hife.
Enable HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Msahci by setting the value to “0”

If it is however an older IDE controller, then you have to disable
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\msahci
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\iaStorV
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\iaStor
by setting each value to “3”

‘lmi’ (not ‘!lmi’ - without the bang) will list all loaded modules.

I think there was a separate “enable AHCI” registry value
“Bedanto” wrote in message news:xxxxx@ntdev…
@maxim…do u mean to say I enable msahci even when the machine isn’t in ahci mode? Would this service entry be present and disabled or would I have to create it?

We have put the entries in the critical device database as well but no luck.

On Thursday, May 15, 2014, Maxim S. Shatskih wrote:

> If the backup was created on a system with ATA emulation and being restored to AHCI/RAID
>enabled controller the system will stop with a 7B

Just enable MSAHCI.SYS in the registry.

Also, you can put the proprietary driver to system32\drivers, also to the SC database registry and to CriticalDeviceDatabase registry.

The latter is a quick replacement for INF files available early at boot.

Then, after the OS will boot, you need to install the real driver package with an INF to the boot storage controller, and reboot once more.

Most backup products go this way.


Maxim S. Shatskih
Microsoft MVP on File System And Storage
xxxxx@storagecraft.com
http://www.storagecraft.com


NTDEV is sponsored by OSR

Visit the list at: http://www.osronline.com/showlists.cfm?list=ntdev

OSR is HIRING!! See http://www.osr.com/careers

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

After a lot of debugging finally we could fix the issue. I am posting the
root cause for the benefit of the future reader.

Thanks to everyone here at OSR forums who tried to help even though there
wasn’t much to proceed with…

The backed up machine had the registry value: HackFlags = 32. This means
system from which we took this backup had PNP PCI setting in BIOS to limit
resource allocation to 0x00000020 (32 decimal) and OS was able to allocate
resources to all PCI devices and boot properly.

However, while doing Bare metal restore, on the restored machine BIOS PNP
PCI setting may have a higher value than 32. In your case this value on
the target machine was 64 (and this is lowest setting in BIOS of target
machine). Hence during restart OS was not able to allocate resource for all

64 PCI devices and resulted in BSOD.

From inputs gained from multiple forum discussions, it seems that if this
key is present then the OS will limit resource allocation according to the
value present in key. If this regvalue is not present then OS allocates
resource based on need and hence by deleting this key we allowed the OS to
allocate the resources as needed.

To summarize:

Fix for this issue would be to either delete this RegValue or set value
according to BIOS value from target machine.

Backed up machine’s value for this key:

[HKEY_LOCAL_MACHINE\target_hive\ControlSet001\Control\PnP\Pci]

“HackFlags”=dword:00000020

The restored machine will boot with either of the below values
[HKEY_LOCAL_MACHINE\target_hive\ControlSet001\Control\PnP\Pci]

“HackFlags”=dword:00000040

[HKEY_LOCAL_MACHINE\target_hive\ControlSet001\Control\PnP\Pci]

“HackFlags”=- ;This will delete key from hive

On Thu, May 15, 2014 at 1:42 PM, Maxim S. Shatskih
wrote:

> I think there was a separate “enable AHCI” registry value
>
> “Bedanto” wrote in message news:xxxxx@ntdev…
> @maxim…do u mean to say I enable msahci even when the machine isn’t in
> ahci mode? Would this service entry be present and disabled or would I have
> to create it?
>
> We have put the entries in the critical device database as well but no
> luck.
>
> On Thursday, May 15, 2014, Maxim S. Shatskih
> wrote:
>
>> > If the backup was created on a system with ATA emulation and being
>> restored to AHCI/RAID
>> >enabled controller the system will stop with a 7B
>>
>> Just enable MSAHCI.SYS in the registry.
>>
>> Also, you can put the proprietary driver to system32\drivers, also to the
>> SC database registry and to CriticalDeviceDatabase registry.
>>
>> The latter is a quick replacement for INF files available early at boot.
>>
>> Then, after the OS will boot, you need to install the real driver package
>> with an INF to the boot storage controller, and reboot once more.
>>
>> Most backup products go this way.
>>
>> –
>> Maxim S. Shatskih
>> Microsoft MVP on File System And Storage
>> xxxxx@storagecraft.com
>> http://www.storagecraft.com
>>
>>
>> —
>> NTDEV is sponsored by OSR
>>
>> Visit the list at: http://www.osronline.com/showlists.cfm?list=ntdev
>>
>> OSR is HIRING!! See http://www.osr.com/careers
>>
>> For our schedule of WDF, WDM, debugging and other seminars visit:
>> http://www.osr.com/seminars
>>
>> To unsubscribe, visit the List Server section of OSR Online at
>> http://www.osronline.com/page.cfm?name=ListServer
>>
>
> —
> NTDEV is sponsored by OSR
>
> Visit the list at: http://www.osronline.com/showlists.cfm?list=ntdev
>
> OSR is HIRING!! See http://www.osr.com/careers
>
> For our schedule of WDF, WDM, debugging and other seminars visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer
>

It can be problematic to move an OS image between physical systems, as there is a bunch of state about the hardware persistently stored. For example, the errata manager (uses errata.inf) on detecting buggy hardware can set assorted hack flags to get things like the PCI bus driver to correctly deal with the buggy hardware. Another example of hardware state stored in the image is the memory bad block list, which is stored in the BCD file, and is updated when the OS detects things like correctable memory errors. Correctable memory errors are a good predictor of uncorrectable ones, so to maximize system reliability, you do want to track the history and take pages of memory that are at risk of failing out of service.

I know some people seem to treat disk images on physical systems as if they were on VMs. On a VM, a bunch of the underlying hardware reality is smoothed out by the hypervisor, running the VM image in a “logically perfect” virtual environment.

The official way to make reference Windows OS images involves the sysprep utility, which clears out a bunch of hardware specific state. On booting a reference image on new hardware, a variety of hardware detection can then be run without leftover data from some previous system.

Jan

From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of Bedanto
Sent: Monday, May 19, 2014 11:10 PM
To: Windows System Software Devs Interest List
Subject: Re: [ntdev] How to debug 0x7B

After a lot of debugging finally we could fix the issue. I am posting the root cause for the benefit of the future reader.

Thanks to everyone here at OSR forums who tried to help even though there wasn’t much to proceed with…

The backed up machine had the registry value: HackFlags = 32. This means system from which we took this backup had PNP PCI setting in BIOS to limit resource allocation to 0x00000020 (32 decimal) and OS was able to allocate resources to all PCI devices and boot properly.

However, while doing Bare metal restore, on the restored machine BIOS PNP PCI setting may have a higher value than 32. In your case this value on the target machine was 64 (and this is lowest setting in BIOS of target machine). Hence during restart OS was not able to allocate resource for all
64 PCI devices and resulted in BSOD.

From inputs gained from multiple forum discussions, it seems that if this key is present then the OS will limit resource allocation according to the value present in key. If this regvalue is not present then OS allocates resource based on need and hence by deleting this key we allowed the OS to allocate the resources as needed.

To summarize:
Fix for this issue would be to either delete this RegValue or set value according to BIOS value from target machine.

Backed up machine’s value for this key:
[HKEY_LOCAL_MACHINE\target_hive\ControlSet001\Control\PnP\Pci]
“HackFlags”=dword:00000020

The restored machine will boot with either of the below values [HKEY_LOCAL_MACHINE\target_hive\ControlSet001\Control\PnP\Pci]
“HackFlags”=dword:00000040

[HKEY_LOCAL_MACHINE\target_hive\ControlSet001\Control\PnP\Pci]
“HackFlags”=- ;This will delete key from hive

On Thu, May 15, 2014 at 1:42 PM, Maxim S. Shatskih > wrote:
I think there was a separate “enable AHCI” registry value
“Bedanto” > wrote in message news:xxxxx@ntdev…
@maxim…do u mean to say I enable msahci even when the machine isn’t in ahci mode? Would this service entry be present and disabled or would I have to create it?

We have put the entries in the critical device database as well but no luck.

On Thursday, May 15, 2014, Maxim S. Shatskih > wrote:
> If the backup was created on a system with ATA emulation and being restored to AHCI/RAID
>enabled controller the system will stop with a 7B

Just enable MSAHCI.SYS in the registry.

Also, you can put the proprietary driver to system32\drivers, also to the SC database registry and to CriticalDeviceDatabase registry.

The latter is a quick replacement for INF files available early at boot.

Then, after the OS will boot, you need to install the real driver package with an INF to the boot storage controller, and reboot once more.

Most backup products go this way.


Maxim S. Shatskih
Microsoft MVP on File System And Storage
xxxxx@storagecraft.commailto:xxxxx
http://www.storagecraft.com


NTDEV is sponsored by OSR

Visit the list at: http://www.osronline.com/showlists.cfm?list=ntdev

OSR is HIRING!! See http://www.osr.com/careers

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer


NTDEV is sponsored by OSR

Visit the list at: http://www.osronline.com/showlists.cfm?list=ntdev

OSR is HIRING!! See http://www.osr.com/careers

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

— NTDEV is sponsored by OSR Visit the list at: http://www.osronline.com/showlists.cfm?list=ntdev OSR is HIRING!! See http://www.osr.com/careers For our schedule of WDF, WDM, debugging and other seminars visit: http://www.osr.com/seminars To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer</mailto:xxxxx>