problem with shutdown, please help!

OSR_Community_User · August 25, 2002, 10:08am

Hi,

When my filter driver is loaded the system can not be shuted down properly.

Winlogon thread, which calls NtShutdownSystem causes a page
fault, which turns to NTFS read request to disk which never completes.

Filter driver do nothing for read requests except:
IoSkipCurrentIrpStackLocation(Irp);
status = IoCallDriver(DeviceExtension->TargetDevice, Irp);

Driver Verifier does not detect any errors.

I am very appreciated with any advise on how to resolve this situation or
what should I look for to find why it happens. Thanks in advance.

Leonid.

P.S. Here is the information from Windbg, which could be helpfull:

THREAD fc9e6da0 Cid c0.a8 Teb: 7ffde000 Win32Thread: e1a247e8 WAIT:
(Executive) KernelMode Non-Alertable
eb18f600 NotificationEvent
Not impersonating
Owning Process fc9e6020
WaitTime (seconds) 8945
Context Switch Count 912 LargeStack
UserTime 0:00:00.0030
KernelTime 0:00:00.0580
Start Address 0x01001674
Stack Init eb190000 Current eb18f26c Base eb190000 Limit eb18b000 Call 0
Priority 15 BasePriority 15 PriorityDecrement 0 DecrementCount 0

ChildEBP RetAddr Args to Child
eb18f284 8042d61c fcda90f0 fc9dfc08 ff535948 nt!KiSwapThread+0xc5
eb18f2ac fc8ab6d6 eb18f600 00000000 00000000 nt!KeWaitForSingleObject+0x1a1
eb18f2c8 fc8ab30b fc9dfc08 00008000 00008000 Ntfs!NtfsWaitSync+0x18
eb18f47c fc8af5e4 fc9dfc08 ff535948 e138d7d8 Ntfs!NtfsNonCachedIo+0x230
eb18f694 fc8aed8d fc9dfc08 ff535948 00000001 Ntfs!NtfsCommonRead+0xf1a
eb18f730 8041f54b fcda9020 ff535948 000000c9 Ntfs!NtfsFsdRead+0x201
eb18f744 8052c81b fcda6300 ff535948 fcda6300 nt!IopfCallDriver+0x35
eb18f760 eb0391d6 fcda6300 ff535948 fcda6300 nt!IovCallDriver+0x77
eb18f7a4 eb038c52 fcda6300 ff535948 00000002
I2kfilt!I2kLogicalVolumeFilterDispatch+0x106
eb18f7c0 8041f54b fcda6300 ff535948 fcc7ed28 I2kfilt!I2kIrpDispatch+0x62
eb18f7d4 80420890 00000000 80062f00 00000000 nt!IopfCallDriver+0x35
eb18f7e8 8043ed53 fcc7ed28 ff53b3e0 ff53b3c0 nt!IoPageRead+0xb1
eb18f828 80447434 00000000 a01330ea c02804cc nt!MiDispatchFault+0x231
eb18f874 80464966 00000000 00000000 00000000 nt!MmAccessFault+0x67b
eb18f874 a01330ea 00000000 00000000 00000000 nt!KiTrap0E+0xc3
eb18f900 a000dea9 00000001 00000000 e19d0308 win32k!HmgSafeNextObjt+0x2e
eb18f910 a0111f7a 00000001 e139d83c e139d828 win32k!PDEVOBJ::bDisabled+0x2c
eb18f928 a0111ffb e19d0308 00000006 00000000 win32k!DrvDisableDisplay+0x75
eb18f944 a00eb359 e19d0308 00000001 00000000 win32k!DrvDisableMDEV+0x35
eb18fa54 a00b7726 eb18fad8 ff529f88 eb18fa84
win32k!xxxUserPowerEventCalloutWorker+0x106
eb18fa70 a00b7614 ff572648 ff55cbe8 00000000
win32k!xxxUserPowerCalloutWorker+0x4e
eb18fa90 a00b751a eb18fad8 805361ac eb18fad8 win32k!QueuePowerRequest+0xce
eb18fa98 805361ac eb18fad8 ff572648 ff55cbe8
win32k!UserPowerEventCallout+0x22
eb18fac0 80451059 a00b74f7 a00b74f7 eb18fad8 nt!MmDispatchWin32Callout+0x1ab
eb18fae0 8048914b 00000008 00000006 00000001 nt!PopEventCalloutDispatch+0x24
eb18fb04 80488c70 00000000 eb18fbf4 eb18fc78
nt!PopSetDevicesSystemState+0xe3
eb18fbe0 80461691 00000005 00000004 c0000004 nt!NtSetSystemPowerState+0x320
eb18fbe0 804014d5 00000005 00000004 c0000004 nt!KiSystemService+0xc4
eb18fc64 804889c3 00000005 00000004 c0000004 nt!ZwSetSystemPowerState+0xb
eb18fd48 804c61a9 00000005 00000004 c0000004 nt!NtSetSystemPowerState+0x70
eb18fd58 80461691 00000001 00000000 00000000 nt!NtShutdownSystem+0x2e
eb18fd58 77f9a5bd 00000001 00000000 00000000 nt!KiSystemService+0xc4
77f9a5b2 00000000 00000000 00000000 00000000 ntdll!NtShutdownSystem+0xb

Irp is active with 9 stacks 6 is current (= 0xff535a6c)
Mdl = ff53b3e0 Thread fc9e6da0: Irp stack trace.
Flags = 00000043
ThreadListEntry.Flink = ff535958
ThreadListEntry.Blink = ff535958
IoStatus.Status = 00000000
IoStatus.Information = 00000000
RequestorMode = 00000000
Cancel = 00
CancelIrql = 0
ApcEnvironment = 00
UserIosb = ff53b3b8
UserEvent = ff53b3a8
Overlay.AsynchronousParameters.UserApcRoutine = 00000000
Overlay.AsynchronousParameters.UserApcContext = 00000000
Overlay.AllocationSize = 00000000 - 00000000
CancelRoutine = 00000000
UserBuffer = f177b000
&Tail.Overlay.DeviceQueueEntry = 0087c84c
Tail.Overlay.Thread = fc9e6da0
Tail.Overlay.AuxiliaryBuffer = 00000000
Tail.Overlay.ListEntry.Flink = 00000000
Tail.Overlay.ListEntry.Blink = 00000000
Tail.Overlay.CurrentStackLocation = ff535a6c
Tail.Overlay.OriginalFileObject = fcc7ed28
Tail.Apc = 00000000
Tail.CompletionKey = 00000000
cmd flg cl Device File Completion-Context
[0, 0] 0 0 00000000 00000000 00000000-00000000

Args: 00000000 00000000 00000000 00000000
[0, 0] 0 0 00000000 00000000 00000000-00000000

Args: 00000000 00000000 00000000 00000000

[f, 0] 0 e1 fcd7c3d0 00000000 eb021184-ff51b008 Success Error Cancel
pending
\Driver\atapi CLASSPNP!ClassIoComplete
Args: ff51b008 00000000 00000000 fcd7c488
[3,34] 0 e0 fcdae030 00000000 fc975a20-fcdac168 Success Error Cancel
\Driver\Disk ftdisk!FtpRefCountCompletionRoutine
Args: 00008000 00000000 6f6f2e00 00000004
[3, 0] 0 e1 fcdac0b0 00000000 fc8ac276-eb18f5f4 Success Error Cancel
pending
\Driver\Ftdisk Ntfs!NtfsSingleSyncCompletionRoutine
Args: 00008000 00000000 6f6eb000 00000001
[3, 0] 0 0 fcda9020 fcc7ed28 00000000-00000000
\FileSystem\Ntfs
Args: 00008000 00000000 00133000 00000000

OSR_Community_User · August 26, 2002, 10:06am

Seems like you’re having a dead lock somewhere. Did you try using
!locks command to see all the locks held? This may give you a clue
on where to look at. !process 0 6 also may be useful in this situation.

Best regards,

Vladimir

-----Original Message-----
From: Leonid Zhigunov [mailto:xxxxx@progate.spb.ru]
Sent: Sunday, August 25, 2002 7:13 AM
To: File Systems Developers
Subject: [ntfsd] problem with shutdown, please help!

Hi,

When my filter driver is loaded the system can not be shuted down properly.

Winlogon thread, which calls NtShutdownSystem causes a page
fault, which turns to NTFS read request to disk which never completes.

Filter driver do nothing for read requests except:
IoSkipCurrentIrpStackLocation(Irp);
status = IoCallDriver(DeviceExtension->TargetDevice, Irp);

Driver Verifier does not detect any errors.

I am very appreciated with any advise on how to resolve this situation or
what should I look for to find why it happens. Thanks in advance.

Leonid.

P.S. Here is the information from Windbg, which could be helpfull:

THREAD fc9e6da0 Cid c0.a8 Teb: 7ffde000 Win32Thread: e1a247e8 WAIT:
(Executive) KernelMode Non-Alertable
eb18f600 NotificationEvent
Not impersonating
Owning Process fc9e6020
WaitTime (seconds) 8945
Context Switch Count 912 LargeStack
UserTime 0:00:00.0030
KernelTime 0:00:00.0580
Start Address 0x01001674
Stack Init eb190000 Current eb18f26c Base eb190000 Limit eb18b000 Call 0
Priority 15 BasePriority 15 PriorityDecrement 0 DecrementCount 0

ChildEBP RetAddr Args to Child
eb18f284 8042d61c fcda90f0 fc9dfc08 ff535948 nt!KiSwapThread+0xc5
eb18f2ac fc8ab6d6 eb18f600 00000000 00000000 nt!KeWaitForSingleObject+0x1a1
eb18f2c8 fc8ab30b fc9dfc08 00008000 00008000 Ntfs!NtfsWaitSync+0x18
eb18f47c fc8af5e4 fc9dfc08 ff535948 e138d7d8 Ntfs!NtfsNonCachedIo+0x230
eb18f694 fc8aed8d fc9dfc08 ff535948 00000001 Ntfs!NtfsCommonRead+0xf1a
eb18f730 8041f54b fcda9020 ff535948 000000c9 Ntfs!NtfsFsdRead+0x201
eb18f744 8052c81b fcda6300 ff535948 fcda6300 nt!IopfCallDriver+0x35
eb18f760 eb0391d6 fcda6300 ff535948 fcda6300 nt!IovCallDriver+0x77
eb18f7a4 eb038c52 fcda6300 ff535948 00000002
I2kfilt!I2kLogicalVolumeFilterDispatch+0x106
eb18f7c0 8041f54b fcda6300 ff535948 fcc7ed28 I2kfilt!I2kIrpDispatch+0x62
eb18f7d4 80420890 00000000 80062f00 00000000 nt!IopfCallDriver+0x35
eb18f7e8 8043ed53 fcc7ed28 ff53b3e0 ff53b3c0 nt!IoPageRead+0xb1
eb18f828 80447434 00000000 a01330ea c02804cc nt!MiDispatchFault+0x231
eb18f874 80464966 00000000 00000000 00000000 nt!MmAccessFault+0x67b
eb18f874 a01330ea 00000000 00000000 00000000 nt!KiTrap0E+0xc3
eb18f900 a000dea9 00000001 00000000 e19d0308 win32k!HmgSafeNextObjt+0x2e
eb18f910 a0111f7a 00000001 e139d83c e139d828 win32k!PDEVOBJ::bDisabled+0x2c
eb18f928 a0111ffb e19d0308 00000006 00000000 win32k!DrvDisableDisplay+0x75
eb18f944 a00eb359 e19d0308 00000001 00000000 win32k!DrvDisableMDEV+0x35
eb18fa54 a00b7726 eb18fad8 ff529f88 eb18fa84
win32k!xxxUserPowerEventCalloutWorker+0x106
eb18fa70 a00b7614 ff572648 ff55cbe8 00000000
win32k!xxxUserPowerCalloutWorker+0x4e
eb18fa90 a00b751a eb18fad8 805361ac eb18fad8 win32k!QueuePowerRequest+0xce
eb18fa98 805361ac eb18fad8 ff572648 ff55cbe8
win32k!UserPowerEventCallout+0x22
eb18fac0 80451059 a00b74f7 a00b74f7 eb18fad8 nt!MmDispatchWin32Callout+0x1ab
eb18fae0 8048914b 00000008 00000006 00000001 nt!PopEventCalloutDispatch+0x24
eb18fb04 80488c70 00000000 eb18fbf4 eb18fc78
nt!PopSetDevicesSystemState+0xe3
eb18fbe0 80461691 00000005 00000004 c0000004 nt!NtSetSystemPowerState+0x320
eb18fbe0 804014d5 00000005 00000004 c0000004 nt!KiSystemService+0xc4
eb18fc64 804889c3 00000005 00000004 c0000004 nt!ZwSetSystemPowerState+0xb
eb18fd48 804c61a9 00000005 00000004 c0000004 nt!NtSetSystemPowerState+0x70
eb18fd58 80461691 00000001 00000000 00000000 nt!NtShutdownSystem+0x2e
eb18fd58 77f9a5bd 00000001 00000000 00000000 nt!KiSystemService+0xc4
77f9a5b2 00000000 00000000 00000000 00000000 ntdll!NtShutdownSystem+0xb

Irp is active with 9 stacks 6 is current (= 0xff535a6c)
Mdl = ff53b3e0 Thread fc9e6da0: Irp stack trace.
Flags = 00000043
ThreadListEntry.Flink = ff535958
ThreadListEntry.Blink = ff535958
IoStatus.Status = 00000000
IoStatus.Information = 00000000
RequestorMode = 00000000
Cancel = 00
CancelIrql = 0
ApcEnvironment = 00
UserIosb = ff53b3b8
UserEvent = ff53b3a8
Overlay.AsynchronousParameters.UserApcRoutine = 00000000
Overlay.AsynchronousParameters.UserApcContext = 00000000
Overlay.AllocationSize = 00000000 - 00000000
CancelRoutine = 00000000
UserBuffer = f177b000
&Tail.Overlay.DeviceQueueEntry = 0087c84c
Tail.Overlay.Thread = fc9e6da0
Tail.Overlay.AuxiliaryBuffer = 00000000
Tail.Overlay.ListEntry.Flink = 00000000
Tail.Overlay.ListEntry.Blink = 00000000
Tail.Overlay.CurrentStackLocation = ff535a6c
Tail.Overlay.OriginalFileObject = fcc7ed28
Tail.Apc = 00000000
Tail.CompletionKey = 00000000
cmd flg cl Device File Completion-Context
[0, 0] 0 0 00000000 00000000 00000000-00000000

Args: 00000000 00000000 00000000 00000000
[0, 0] 0 0 00000000 00000000 00000000-00000000

Args: 00000000 00000000 00000000 00000000

[f, 0] 0 e1 fcd7c3d0 00000000 eb021184-ff51b008 Success Error Cancel
pending
\Driver\atapi CLASSPNP!ClassIoComplete
Args: ff51b008 00000000 00000000 fcd7c488
[3,34] 0 e0 fcdae030 00000000 fc975a20-fcdac168 Success Error Cancel
\Driver\Disk ftdisk!FtpRefCountCompletionRoutine
Args: 00008000 00000000 6f6f2e00 00000004
[3, 0] 0 e1 fcdac0b0 00000000 fc8ac276-eb18f5f4 Success Error Cancel
pending
\Driver\Ftdisk Ntfs!NtfsSingleSyncCompletionRoutine
Args: 00008000 00000000 6f6eb000 00000001
[3, 0] 0 0 fcda9020 fcc7ed28 00000000-00000000
\FileSystem\Ntfs
Args: 00008000 00000000 00133000 00000000

You are currently subscribed to ntfsd as: xxxxx@Starbase.com
To unsubscribe send a blank email to %%email.unsub%%

OSR_Community_User · August 26, 2002, 10:39am

RE: [ntfsd] problem with shutdown, please help!Yes,

I did it. The !lock command did not show any lock contention.
The !process 0 7 command showed that all threads were in
WAIT state. System worker threads were waiting on the queue,
while other threads did not show any interesting in their stack
trace.

Leonid.

“Vladimir Chtchetkine” wrote in message news:xxxxx@ntfsd…
Seems like you’re having a dead lock somewhere. Did you try using
!locks command to see all the locks held? This may give you a clue
on where to look at. !process 0 6 also may be useful in this situation.

Best regards,

Vladimir

-----Original Message-----
From: Leonid Zhigunov [mailto:xxxxx@progate.spb.ru]
Sent: Sunday, August 25, 2002 7:13 AM
To: File Systems Developers
Subject: [ntfsd] problem with shutdown, please help!

Hi,

When my filter driver is loaded the system can not be shuted down properly.

Winlogon thread, which calls NtShutdownSystem causes a page
fault, which turns to NTFS read request to disk which never completes.

Filter driver do nothing for read requests except:
IoSkipCurrentIrpStackLocation(Irp);
status = IoCallDriver(DeviceExtension->TargetDevice, Irp);

Driver Verifier does not detect any errors.

I am very appreciated with any advise on how to resolve this situation or
what should I look for to find why it happens. Thanks in advance.

Leonid.

P.S. Here is the information from Windbg, which could be helpfull:

THREAD fc9e6da0 Cid c0.a8 Teb: 7ffde000 Win32Thread: e1a247e8 WAIT:
(Executive) KernelMode Non-Alertable
eb18f600 NotificationEvent
Not impersonating
Owning Process fc9e6020
WaitTime (seconds) 8945
Context Switch Count 912 LargeStack
UserTime 0:00:00.0030
KernelTime 0:00:00.0580
Start Address 0x01001674
Stack Init eb190000 Current eb18f26c Base eb190000 Limit eb18b000 Call 0
Priority 15 BasePriority 15 PriorityDecrement 0 DecrementCount 0

ChildEBP RetAddr Args to Child
eb18f284 8042d61c fcda90f0 fc9dfc08 ff535948 nt!KiSwapThread+0xc5
eb18f2ac fc8ab6d6 eb18f600 00000000 00000000 nt!KeWaitForSingleObject+0x1a1
eb18f2c8 fc8ab30b fc9dfc08 00008000 00008000 Ntfs!NtfsWaitSync+0x18
eb18f47c fc8af5e4 fc9dfc08 ff535948 e138d7d8 Ntfs!NtfsNonCachedIo+0x230
eb18f694 fc8aed8d fc9dfc08 ff535948 00000001 Ntfs!NtfsCommonRead+0xf1a
eb18f730 8041f54b fcda9020 ff535948 000000c9 Ntfs!NtfsFsdRead+0x201
eb18f744 8052c81b fcda6300 ff535948 fcda6300 nt!IopfCallDriver+0x35
eb18f760 eb0391d6 fcda6300 ff535948 fcda6300 nt!IovCallDriver+0x77
eb18f7a4 eb038c52 fcda6300 ff535948 00000002
I2kfilt!I2kLogicalVolumeFilterDispatch+0x106
eb18f7c0 8041f54b fcda6300 ff535948 fcc7ed28 I2kfilt!I2kIrpDispatch+0x62
eb18f7d4 80420890 00000000 80062f00 00000000 nt!IopfCallDriver+0x35
eb18f7e8 8043ed53 fcc7ed28 ff53b3e0 ff53b3c0 nt!IoPageRead+0xb1
eb18f828 80447434 00000000 a01330ea c02804cc nt!MiDispatchFault+0x231
eb18f874 80464966 00000000 00000000 00000000 nt!MmAccessFault+0x67b
eb18f874 a01330ea 00000000 00000000 00000000 nt!KiTrap0E+0xc3
eb18f900 a000dea9 00000001 00000000 e19d0308 win32k!HmgSafeNextObjt+0x2e
eb18f910 a0111f7a 00000001 e139d83c e139d828 win32k!PDEVOBJ::bDisabled+0x2c
eb18f928 a0111ffb e19d0308 00000006 00000000 win32k!DrvDisableDisplay+0x75
eb18f944 a00eb359 e19d0308 00000001 00000000 win32k!DrvDisableMDEV+0x35
eb18fa54 a00b7726 eb18fad8 ff529f88 eb18fa84
win32k!xxxUserPowerEventCalloutWorker+0x106
eb18fa70 a00b7614 ff572648 ff55cbe8 00000000
win32k!xxxUserPowerCalloutWorker+0x4e
eb18fa90 a00b751a eb18fad8 805361ac eb18fad8 win32k!QueuePowerRequest+0xce
eb18fa98 805361ac eb18fad8 ff572648 ff55cbe8
win32k!UserPowerEventCallout+0x22
eb18fac0 80451059 a00b74f7 a00b74f7 eb18fad8 nt!MmDispatchWin32Callout+0x1ab
eb18fae0 8048914b 00000008 00000006 00000001 nt!PopEventCalloutDispatch+0x24
eb18fb04 80488c70 00000000 eb18fbf4 eb18fc78
nt!PopSetDevicesSystemState+0xe3
eb18fbe0 80461691 00000005 00000004 c0000004 nt!NtSetSystemPowerState+0x320
eb18fbe0 804014d5 00000005 00000004 c0000004 nt!KiSystemService+0xc4
eb18fc64 804889c3 00000005 00000004 c0000004 nt!ZwSetSystemPowerState+0xb
eb18fd48 804c61a9 00000005 00000004 c0000004 nt!NtSetSystemPowerState+0x70
eb18fd58 80461691 00000001 00000000 00000000 nt!NtShutdownSystem+0x2e
eb18fd58 77f9a5bd 00000001 00000000 00000000 nt!KiSystemService+0xc4
77f9a5b2 00000000 00000000 00000000 00000000 ntdll!NtShutdownSystem+0xb

Irp is active with 9 stacks 6 is current (= 0xff535a6c)
Mdl = ff53b3e0 Thread fc9e6da0: Irp stack trace.
Flags = 00000043
ThreadListEntry.Flink = ff535958
ThreadListEntry.Blink = ff535958
IoStatus.Status = 00000000
IoStatus.Information = 00000000
RequestorMode = 00000000
Cancel = 00
CancelIrql = 0
ApcEnvironment = 00
UserIosb = ff53b3b8
UserEvent = ff53b3a8
Overlay.AsynchronousParameters.UserApcRoutine = 00000000
Overlay.AsynchronousParameters.UserApcContext = 00000000
Overlay.AllocationSize = 00000000 - 00000000
CancelRoutine = 00000000
UserBuffer = f177b000
&Tail.Overlay.DeviceQueueEntry = 0087c84c
Tail.Overlay.Thread = fc9e6da0
Tail.Overlay.AuxiliaryBuffer = 00000000
Tail.Overlay.ListEntry.Flink = 00000000
Tail.Overlay.ListEntry.Blink = 00000000
Tail.Overlay.CurrentStackLocation = ff535a6c
Tail.Overlay.OriginalFileObject = fcc7ed28
Tail.Apc = 00000000
Tail.CompletionKey = 00000000
cmd flg cl Device File Completion-Context
[0, 0] 0 0 00000000 00000000 00000000-00000000

Args: 00000000 00000000 00000000 00000000
[0, 0] 0 0 00000000 00000000 00000000-00000000

Args: 00000000 00000000 00000000 00000000
[0, 0] 0 0 00000000 00000000 00000000-00000000

Args: 00000000 00000000 00000000 00000000
[0, 0] 0 0 00000000 00000000 00000000-00000000

Args: 00000000 00000000 00000000 00000000
[0, 0] 0 0 00000000 00000000 00000000-00000000

Args: 00000000 00000000 00000000 00000000
>[f, 0] 0 e1 fcd7c3d0 00000000 eb021184-ff51b008 Success Error Cancel
pending
\Driver\atapi CLASSPNP!ClassIoComplete
Args: ff51b008 00000000 00000000 fcd7c488
[3,34] 0 e0 fcdae030 00000000 fc975a20-fcdac168 Success Error Cancel
\Driver\Disk ftdisk!FtpRefCountCompletionRoutine
Args: 00008000 00000000 6f6f2e00 00000004
[3, 0] 0 e1 fcdac0b0 00000000 fc8ac276-eb18f5f4 Success Error Cancel
pending
\Driver\Ftdisk Ntfs!NtfsSingleSyncCompletionRoutine
Args: 00008000 00000000 6f6eb000 00000001
[3, 0] 0 0 fcda9020 fcc7ed28 00000000-00000000
\FileSystem\Ntfs
Args: 00008000 00000000 00133000 00000000

—
You are currently subscribed to ntfsd as: xxxxx@Starbase.com
To unsubscribe send a blank email to %%email.unsub%%

OSR_Community_User · August 26, 2002, 11:56am

do a “!object eb18f600”. This is the first parameter to
KeWaitForSingleObject. The thread that owns this is probably blocked on
something that THREAD fc9e6da0 has.

ChildEBP RetAddr Args to Child
eb18f284 8042d61c fcda90f0 fc9dfc08 ff535948 nt!KiSwapThread+0xc5
eb18f2ac fc8ab6d6 eb18f600 00000000 00000000 nt!KeWaitForSingleObject+0x1a1

-----Original Message-----
From: Leonid Zhigunov [mailto:xxxxx@progate.spb.ru]
Sent: Monday, August 26, 2002 8:44 AM
To: File Systems Developers
Subject: [ntfsd] Re: problem with shutdown, please help!

Yes,

I did it. The !lock command did not show any lock contention.
The !process 0 7 command showed that all threads were in
WAIT state. System worker threads were waiting on the queue,
while other threads did not show any interesting in their stack
trace.

Leonid.

“Vladimir Chtchetkine” < xxxxx@starbase.com
mailto:xxxxx > wrote in message
news:xxxxx@ntfsd news:xxxxx …

Seems like you’re having a dead lock somewhere. Did you try using
!locks command to see all the locks held? This may give you a clue
on where to look at. !process 0 6 also may be useful in this situation.

Best regards,

Vladimir

-----Original Message-----
From: Leonid Zhigunov [mailto:xxxxx@progate.spb.ru
mailto:xxxxx]
Sent: Sunday, August 25, 2002 7:13 AM
To: File Systems Developers
Subject: [ntfsd] problem with shutdown, please help!

Hi,

When my filter driver is loaded the system can not be shuted down properly.

Winlogon thread, which calls NtShutdownSystem causes a page
fault, which turns to NTFS read request to disk which never completes.

Filter driver do nothing for read requests except:
IoSkipCurrentIrpStackLocation(Irp);
status = IoCallDriver(DeviceExtension->TargetDevice, Irp);

Driver Verifier does not detect any errors.

I am very appreciated with any advise on how to resolve this situation or
what should I look for to find why it happens. Thanks in advance.

Leonid.

P.S. Here is the information from Windbg, which could be helpfull:

THREAD fc9e6da0 Cid c0.a8 Teb: 7ffde000 Win32Thread: e1a247e8 WAIT:
(Executive) KernelMode Non-Alertable
eb18f600 NotificationEvent
Not impersonating
Owning Process fc9e6020
WaitTime (seconds) 8945
Context Switch Count 912 LargeStack
UserTime 0:00:00.0030
KernelTime 0:00:00.0580
Start Address 0x01001674
Stack Init eb190000 Current eb18f26c Base eb190000 Limit eb18b000 Call 0
Priority 15 BasePriority 15 PriorityDecrement 0 DecrementCount 0

ChildEBP RetAddr Args to Child
eb18f284 8042d61c fcda90f0 fc9dfc08 ff535948 nt!KiSwapThread+0xc5
eb18f2ac fc8ab6d6 eb18f600 00000000 00000000 nt!KeWaitForSingleObject+0x1a1
eb18f2c8 fc8ab30b fc9dfc08 00008000 00008000 Ntfs!NtfsWaitSync+0x18
eb18f47c fc8af5e4 fc9dfc08 ff535948 e138d7d8 Ntfs!NtfsNonCachedIo+0x230
eb18f694 fc8aed8d fc9dfc08 ff535948 00000001 Ntfs!NtfsCommonRead+0xf1a
eb18f730 8041f54b fcda9020 ff535948 000000c9 Ntfs!NtfsFsdRead+0x201
eb18f744 8052c81b fcda6300 ff535948 fcda6300 nt!IopfCallDriver+0x35
eb18f760 eb0391d6 fcda6300 ff535948 fcda6300 nt!IovCallDriver+0x77
eb18f7a4 eb038c52 fcda6300 ff535948 00000002
I2kfilt!I2kLogicalVolumeFilterDispatch+0x106
eb18f7c0 8041f54b fcda6300 ff535948 fcc7ed28 I2kfilt!I2kIrpDispatch+0x62
eb18f7d4 80420890 00000000 80062f00 00000000 nt!IopfCallDriver+0x35
eb18f7e8 8043ed53 fcc7ed28 ff53b3e0 ff53b3c0 nt!IoPageRead+0xb1
eb18f828 80447434 00000000 a01330ea c02804cc nt!MiDispatchFault+0x231
eb18f874 80464966 00000000 00000000 00000000 nt!MmAccessFault+0x67b
eb18f874 a01330ea 00000000 00000000 00000000 nt!KiTrap0E+0xc3
eb18f900 a000dea9 00000001 00000000 e19d0308 win32k!HmgSafeNextObjt+0x2e
eb18f910 a0111f7a 00000001 e139d83c e139d828 win32k!PDEVOBJ::bDisabled+0x2c
eb18f928 a0111ffb e19d0308 00000006 00000000 win32k!DrvDisableDisplay+0x75
eb18f944 a00eb359 e19d0308 00000001 00000000 win32k!DrvDisableMDEV+0x35
eb18fa54 a00b7726 eb18fad8 ff529f88 eb18fa84
win32k!xxxUserPowerEventCalloutWorker+0x106
eb18fa70 a00b7614 ff572648 ff55cbe8 00000000
win32k!xxxUserPowerCalloutWorker+0x4e
eb18fa90 a00b751a eb18fad8 805361ac eb18fad8 win32k!QueuePowerRequest+0xce
eb18fa98 805361ac eb18fad8 ff572648 ff55cbe8
win32k!UserPowerEventCallout+0x22
eb18fac0 80451059 a00b74f7 a00b74f7 eb18fad8 nt!MmDispatchWin32Callout+0x1ab

eb18fae0 8048914b 00000008 00000006 00000001 nt!PopEventCalloutDispatch+0x24

eb18fb04 80488c70 00000000 eb18fbf4 eb18fc78
nt!PopSetDevicesSystemState+0xe3
eb18fbe0 80461691 00000005 00000004 c0000004 nt!NtSetSystemPowerState+0x320
eb18fbe0 804014d5 00000005 00000004 c0000004 nt!KiSystemService+0xc4
eb18fc64 804889c3 00000005 00000004 c0000004 nt!ZwSetSystemPowerState+0xb
eb18fd48 804c61a9 00000005 00000004 c0000004 nt!NtSetSystemPowerState+0x70
eb18fd58 80461691 00000001 00000000 00000000 nt!NtShutdownSystem+0x2e
eb18fd58 77f9a5bd 00000001 00000000 00000000 nt!KiSystemService+0xc4
77f9a5b2 00000000 00000000 00000000 00000000 ntdll!NtShutdownSystem+0xb

Irp is active with 9 stacks 6 is current (= 0xff535a6c)
Mdl = ff53b3e0 Thread fc9e6da0: Irp stack trace.
Flags = 00000043
ThreadListEntry.Flink = ff535958
ThreadListEntry.Blink = ff535958
IoStatus.Status = 00000000
IoStatus.Information = 00000000
RequestorMode = 00000000
Cancel = 00
CancelIrql = 0
ApcEnvironment = 00
UserIosb = ff53b3b8
UserEvent = ff53b3a8
Overlay.AsynchronousParameters.UserApcRoutine = 00000000
Overlay.AsynchronousParameters.UserApcContext = 00000000
Overlay.AllocationSize = 00000000 - 00000000
CancelRoutine = 00000000
UserBuffer = f177b000
&Tail.Overlay.DeviceQueueEntry = 0087c84c
Tail.Overlay.Thread = fc9e6da0
Tail.Overlay.AuxiliaryBuffer = 00000000
Tail.Overlay.ListEntry.Flink = 00000000
Tail.Overlay.ListEntry.Blink = 00000000
Tail.Overlay.CurrentStackLocation = ff535a6c
Tail.Overlay.OriginalFileObject = fcc7ed28
Tail.Apc = 00000000
Tail.CompletionKey = 00000000
cmd flg cl Device File Completion-Context
[0, 0] 0 0 00000000 00000000 00000000-00000000

Args: 00000000 00000000 00000000 00000000
[0, 0] 0 0 00000000 00000000 00000000-00000000

Args: 00000000 00000000 00000000 00000000
[0, 0] 0 0 00000000 00000000 00000000-00000000

Args: 00000000 00000000 00000000 00000000
[0, 0] 0 0 00000000 00000000 00000000-00000000

Args: 00000000 00000000 00000000 00000000
[0, 0] 0 0 00000000 00000000 00000000-00000000

Args: 00000000 00000000 00000000 00000000
>[f, 0] 0 e1 fcd7c3d0 00000000 eb021184-ff51b008 Success Error Cancel
pending
\Driver\atapi CLASSPNP!ClassIoComplete
Args: ff51b008 00000000 00000000 fcd7c488
[3,34] 0 e0 fcdae030 00000000 fc975a20-fcdac168 Success Error Cancel
\Driver\Disk ftdisk!FtpRefCountCompletionRoutine
Args: 00008000 00000000 6f6f2e00 00000004
[3, 0] 0 e1 fcdac0b0 00000000 fc8ac276-eb18f5f4 Success Error Cancel
pending
\Driver\Ftdisk Ntfs!NtfsSingleSyncCompletionRoutine
Args: 00008000 00000000 6f6eb000 00000001
[3, 0] 0 0 fcda9020 fcc7ed28 00000000-00000000
\FileSystem\Ntfs
Args: 00008000 00000000 00133000 00000000

—
You are currently subscribed to ntfsd as: xxxxx@Starbase.com
To unsubscribe send a blank email to %%email.unsub%%

—
You are currently subscribed to ntfsd as: xxxxx@1vision.com
To unsubscribe send a blank email to %%email.unsub%%</mailto:xxxxx></news:xxxxx></mailto:xxxxx>

OSR_Community_User · August 26, 2002, 11:56am

Make sure that you process any changes to the DO_POWER_PAGABLE flag. Check out the XP DDK toaster filter sample source (filter.c) that handles IRP_MN_DEVICE_USAGE_NOTIFICATION - See how it propogates changes to DO_POWER_PAGABLE. The W2K DDK version of the toaster filter driver didn’t do this properly, and the system would hang during shutdown/reboot (on some systems), similar to what you’re experiencing. The XP version works just fine (thanks to Eliyas).

Nate

-----Original Message-----
From: Leonid Zhigunov [mailto:xxxxx@progate.spb.ru]
Sent: Sunday, August 25, 2002 8:13 AM
To: File Systems Developers
Subject: [ntfsd] problem with shutdown, please help!

Hi,

When my filter driver is loaded the system can not be shuted down properly.

Winlogon thread, which calls NtShutdownSystem causes a page
fault, which turns to NTFS read request to disk which never completes.

Filter driver do nothing for read requests except:
IoSkipCurrentIrpStackLocation(Irp);
status = IoCallDriver(DeviceExtension->TargetDevice, Irp);

Driver Verifier does not detect any errors.

I am very appreciated with any advise on how to resolve this situation or
what should I look for to find why it happens. Thanks in advance.

Leonid.

P.S. Here is the information from Windbg, which could be helpfull:

THREAD fc9e6da0 Cid c0.a8 Teb: 7ffde000 Win32Thread: e1a247e8 WAIT:
(Executive) KernelMode Non-Alertable
eb18f600 NotificationEvent
Not impersonating
Owning Process fc9e6020
WaitTime (seconds) 8945
Context Switch Count 912 LargeStack
UserTime 0:00:00.0030
KernelTime 0:00:00.0580
Start Address 0x01001674
Stack Init eb190000 Current eb18f26c Base eb190000 Limit eb18b000 Call 0
Priority 15 BasePriority 15 PriorityDecrement 0 DecrementCount 0

ChildEBP RetAddr Args to Child
eb18f284 8042d61c fcda90f0 fc9dfc08 ff535948 nt!KiSwapThread+0xc5
eb18f2ac fc8ab6d6 eb18f600 00000000 00000000 nt!KeWaitForSingleObject+0x1a1
eb18f2c8 fc8ab30b fc9dfc08 00008000 00008000 Ntfs!NtfsWaitSync+0x18
eb18f47c fc8af5e4 fc9dfc08 ff535948 e138d7d8 Ntfs!NtfsNonCachedIo+0x230
eb18f694 fc8aed8d fc9dfc08 ff535948 00000001 Ntfs!NtfsCommonRead+0xf1a
eb18f730 8041f54b fcda9020 ff535948 000000c9 Ntfs!NtfsFsdRead+0x201
eb18f744 8052c81b fcda6300 ff535948 fcda6300 nt!IopfCallDriver+0x35
eb18f760 eb0391d6 fcda6300 ff535948 fcda6300 nt!IovCallDriver+0x77
eb18f7a4 eb038c52 fcda6300 ff535948 00000002
I2kfilt!I2kLogicalVolumeFilterDispatch+0x106
eb18f7c0 8041f54b fcda6300 ff535948 fcc7ed28 I2kfilt!I2kIrpDispatch+0x62
eb18f7d4 80420890 00000000 80062f00 00000000 nt!IopfCallDriver+0x35
eb18f7e8 8043ed53 fcc7ed28 ff53b3e0 ff53b3c0 nt!IoPageRead+0xb1
eb18f828 80447434 00000000 a01330ea c02804cc nt!MiDispatchFault+0x231
eb18f874 80464966 00000000 00000000 00000000 nt!MmAccessFault+0x67b
eb18f874 a01330ea 00000000 00000000 00000000 nt!KiTrap0E+0xc3
eb18f900 a000dea9 00000001 00000000 e19d0308 win32k!HmgSafeNextObjt+0x2e
eb18f910 a0111f7a 00000001 e139d83c e139d828 win32k!PDEVOBJ::bDisabled+0x2c
eb18f928 a0111ffb e19d0308 00000006 00000000 win32k!DrvDisableDisplay+0x75
eb18f944 a00eb359 e19d0308 00000001 00000000 win32k!DrvDisableMDEV+0x35
eb18fa54 a00b7726 eb18fad8 ff529f88 eb18fa84
win32k!xxxUserPowerEventCalloutWorker+0x106
eb18fa70 a00b7614 ff572648 ff55cbe8 00000000
win32k!xxxUserPowerCalloutWorker+0x4e
eb18fa90 a00b751a eb18fad8 805361ac eb18fad8 win32k!QueuePowerRequest+0xce
eb18fa98 805361ac eb18fad8 ff572648 ff55cbe8
win32k!UserPowerEventCallout+0x22
eb18fac0 80451059 a00b74f7 a00b74f7 eb18fad8 nt!MmDispatchWin32Callout+0x1ab
eb18fae0 8048914b 00000008 00000006 00000001 nt!PopEventCalloutDispatch+0x24
eb18fb04 80488c70 00000000 eb18fbf4 eb18fc78
nt!PopSetDevicesSystemState+0xe3
eb18fbe0 80461691 00000005 00000004 c0000004 nt!NtSetSystemPowerState+0x320
eb18fbe0 804014d5 00000005 00000004 c0000004 nt!KiSystemService+0xc4
eb18fc64 804889c3 00000005 00000004 c0000004 nt!ZwSetSystemPowerState+0xb
eb18fd48 804c61a9 00000005 00000004 c0000004 nt!NtSetSystemPowerState+0x70
eb18fd58 80461691 00000001 00000000 00000000 nt!NtShutdownSystem+0x2e
eb18fd58 77f9a5bd 00000001 00000000 00000000 nt!KiSystemService+0xc4
77f9a5b2 00000000 00000000 00000000 00000000 ntdll!NtShutdownSystem+0xb

Irp is active with 9 stacks 6 is current (= 0xff535a6c)
Mdl = ff53b3e0 Thread fc9e6da0: Irp stack trace.
Flags = 00000043
ThreadListEntry.Flink = ff535958
ThreadListEntry.Blink = ff535958
IoStatus.Status = 00000000
IoStatus.Information = 00000000
RequestorMode = 00000000
Cancel = 00
CancelIrql = 0
ApcEnvironment = 00
UserIosb = ff53b3b8
UserEvent = ff53b3a8
Overlay.AsynchronousParameters.UserApcRoutine = 00000000
Overlay.AsynchronousParameters.UserApcContext = 00000000
Overlay.AllocationSize = 00000000 - 00000000
CancelRoutine = 00000000
UserBuffer = f177b000
&Tail.Overlay.DeviceQueueEntry = 0087c84c
Tail.Overlay.Thread = fc9e6da0
Tail.Overlay.AuxiliaryBuffer = 00000000
Tail.Overlay.ListEntry.Flink = 00000000
Tail.Overlay.ListEntry.Blink = 00000000
Tail.Overlay.CurrentStackLocation = ff535a6c
Tail.Overlay.OriginalFileObject = fcc7ed28
Tail.Apc = 00000000
Tail.CompletionKey = 00000000
cmd flg cl Device File Completion-Context
[0, 0] 0 0 00000000 00000000 00000000-00000000

Args: 00000000 00000000 00000000 00000000
[0, 0] 0 0 00000000 00000000 00000000-00000000

Args: 00000000 00000000 00000000 00000000

[f, 0] 0 e1 fcd7c3d0 00000000 eb021184-ff51b008 Success Error Cancel
pending
\Driver\atapi CLASSPNP!ClassIoComplete
Args: ff51b008 00000000 00000000 fcd7c488
[3,34] 0 e0 fcdae030 00000000 fc975a20-fcdac168 Success Error Cancel
\Driver\Disk ftdisk!FtpRefCountCompletionRoutine
Args: 00008000 00000000 6f6f2e00 00000004
[3, 0] 0 e1 fcdac0b0 00000000 fc8ac276-eb18f5f4 Success Error Cancel
pending
\Driver\Ftdisk Ntfs!NtfsSingleSyncCompletionRoutine
Args: 00008000 00000000 6f6eb000 00000001
[3, 0] 0 0 fcda9020 fcc7ed28 00000000-00000000
\FileSystem\Ntfs
Args: 00008000 00000000 00133000 00000000

You are currently subscribed to ntfsd as: xxxxx@powerquest.com
To unsubscribe send a blank email to %%email.unsub%%

OSR_Community_User · August 27, 2002, 3:17am

Hi,

Thanks to all for your help. I will continue to investigate this problem.

Leonid.

“Leonid Zhigunov” wrote in message
news:xxxxx@ntfsd…
>
> Hi,
>
> When my filter driver is loaded the system can not be shuted down
properly.
>
> Winlogon thread, which calls NtShutdownSystem causes a page
> fault, which turns to NTFS read request to disk which never completes.
>
> Filter driver do nothing for read requests except:
> IoSkipCurrentIrpStackLocation(Irp);
> status = IoCallDriver(DeviceExtension->TargetDevice, Irp);
>
> Driver Verifier does not detect any errors.
>
> I am very appreciated with any advise on how to resolve this situation or
> what should I look for to find why it happens. Thanks in advance.
>
> Leonid.
>
> P.S. Here is the information from Windbg, which could be helpfull:
>
> THREAD fc9e6da0 Cid c0.a8 Teb: 7ffde000 Win32Thread: e1a247e8 WAIT:
> (Executive) KernelMode Non-Alertable
> eb18f600 NotificationEvent
> Not impersonating
> Owning Process fc9e6020
> WaitTime (seconds) 8945
> Context Switch Count 912 LargeStack
> UserTime 0:00:00.0030
> KernelTime 0:00:00.0580
> Start Address 0x01001674
> Stack Init eb190000 Current eb18f26c Base eb190000 Limit eb18b000 Call 0
> Priority 15 BasePriority 15 PriorityDecrement 0 DecrementCount 0
>
> ChildEBP RetAddr Args to Child
> eb18f284 8042d61c fcda90f0 fc9dfc08 ff535948 nt!KiSwapThread+0xc5
> eb18f2ac fc8ab6d6 eb18f600 00000000 00000000
nt!KeWaitForSingleObject+0x1a1
> eb18f2c8 fc8ab30b fc9dfc08 00008000 00008000 Ntfs!NtfsWaitSync+0x18
> eb18f47c fc8af5e4 fc9dfc08 ff535948 e138d7d8 Ntfs!NtfsNonCachedIo+0x230
> eb18f694 fc8aed8d fc9dfc08 ff535948 00000001 Ntfs!NtfsCommonRead+0xf1a
> eb18f730 8041f54b fcda9020 ff535948 000000c9 Ntfs!NtfsFsdRead+0x201
> eb18f744 8052c81b fcda6300 ff535948 fcda6300 nt!IopfCallDriver+0x35
> eb18f760 eb0391d6 fcda6300 ff535948 fcda6300 nt!IovCallDriver+0x77
> eb18f7a4 eb038c52 fcda6300 ff535948 00000002
> I2kfilt!I2kLogicalVolumeFilterDispatch+0x106
> eb18f7c0 8041f54b fcda6300 ff535948 fcc7ed28 I2kfilt!I2kIrpDispatch+0x62
> eb18f7d4 80420890 00000000 80062f00 00000000 nt!IopfCallDriver+0x35
> eb18f7e8 8043ed53 fcc7ed28 ff53b3e0 ff53b3c0 nt!IoPageRead+0xb1
> eb18f828 80447434 00000000 a01330ea c02804cc nt!MiDispatchFault+0x231
> eb18f874 80464966 00000000 00000000 00000000 nt!MmAccessFault+0x67b
> eb18f874 a01330ea 00000000 00000000 00000000 nt!KiTrap0E+0xc3
> eb18f900 a000dea9 00000001 00000000 e19d0308 win32k!HmgSafeNextObjt+0x2e
> eb18f910 a0111f7a 00000001 e139d83c e139d828
win32k!PDEVOBJ::bDisabled+0x2c
> eb18f928 a0111ffb e19d0308 00000006 00000000 win32k!DrvDisableDisplay+0x75
> eb18f944 a00eb359 e19d0308 00000001 00000000 win32k!DrvDisableMDEV+0x35
> eb18fa54 a00b7726 eb18fad8 ff529f88 eb18fa84
> win32k!xxxUserPowerEventCalloutWorker+0x106
> eb18fa70 a00b7614 ff572648 ff55cbe8 00000000
> win32k!xxxUserPowerCalloutWorker+0x4e
> eb18fa90 a00b751a eb18fad8 805361ac eb18fad8 win32k!QueuePowerRequest+0xce
> eb18fa98 805361ac eb18fad8 ff572648 ff55cbe8
> win32k!UserPowerEventCallout+0x22
> eb18fac0 80451059 a00b74f7 a00b74f7 eb18fad8
nt!MmDispatchWin32Callout+0x1ab
> eb18fae0 8048914b 00000008 00000006 00000001
nt!PopEventCalloutDispatch+0x24
> eb18fb04 80488c70 00000000 eb18fbf4 eb18fc78
> nt!PopSetDevicesSystemState+0xe3
> eb18fbe0 80461691 00000005 00000004 c0000004
nt!NtSetSystemPowerState+0x320
> eb18fbe0 804014d5 00000005 00000004 c0000004 nt!KiSystemService+0xc4
> eb18fc64 804889c3 00000005 00000004 c0000004 nt!ZwSetSystemPowerState+0xb
> eb18fd48 804c61a9 00000005 00000004 c0000004 nt!NtSetSystemPowerState+0x70
> eb18fd58 80461691 00000001 00000000 00000000 nt!NtShutdownSystem+0x2e
> eb18fd58 77f9a5bd 00000001 00000000 00000000 nt!KiSystemService+0xc4
> 77f9a5b2 00000000 00000000 00000000 00000000 ntdll!NtShutdownSystem+0xb
>
> Irp is active with 9 stacks 6 is current (= 0xff535a6c)
> Mdl = ff53b3e0 Thread fc9e6da0: Irp stack trace.
> Flags = 00000043
> ThreadListEntry.Flink = ff535958
> ThreadListEntry.Blink = ff535958
> IoStatus.Status = 00000000
> IoStatus.Information = 00000000
> RequestorMode = 00000000
> Cancel = 00
> CancelIrql = 0
> ApcEnvironment = 00
> UserIosb = ff53b3b8
> UserEvent = ff53b3a8
> Overlay.AsynchronousParameters.UserApcRoutine = 00000000
> Overlay.AsynchronousParameters.UserApcContext = 00000000
> Overlay.AllocationSize = 00000000 - 00000000
> CancelRoutine = 00000000
> UserBuffer = f177b000
> &Tail.Overlay.DeviceQueueEntry = 0087c84c
> Tail.Overlay.Thread = fc9e6da0
> Tail.Overlay.AuxiliaryBuffer = 00000000
> Tail.Overlay.ListEntry.Flink = 00000000
> Tail.Overlay.ListEntry.Blink = 00000000
> Tail.Overlay.CurrentStackLocation = ff535a6c
> Tail.Overlay.OriginalFileObject = fcc7ed28
> Tail.Apc = 00000000
> Tail.CompletionKey = 00000000
> cmd flg cl Device File Completion-Context
> [0, 0] 0 0 00000000 00000000 00000000-00000000
>
> Args: 00000000 00000000 00000000 00000000
> [0, 0] 0 0 00000000 00000000 00000000-00000000
>
> Args: 00000000 00000000 00000000 00000000
> [0, 0] 0 0 00000000 00000000 00000000-00000000
>
> Args: 00000000 00000000 00000000 00000000
> [0, 0] 0 0 00000000 00000000 00000000-00000000
>
> Args: 00000000 00000000 00000000 00000000
> [0, 0] 0 0 00000000 00000000 00000000-00000000
>
> Args: 00000000 00000000 00000000 00000000
> >[f, 0] 0 e1 fcd7c3d0 00000000 eb021184-ff51b008 Success Error Cancel
> pending
> \Driver\atapi CLASSPNP!ClassIoComplete
> Args: ff51b008 00000000 00000000 fcd7c488
> [3,34] 0 e0 fcdae030 00000000 fc975a20-fcdac168 Success Error Cancel
> \Driver\Disk ftdisk!FtpRefCountCompletionRoutine
> Args: 00008000 00000000 6f6f2e00 00000004
> [3, 0] 0 e1 fcdac0b0 00000000 fc8ac276-eb18f5f4 Success Error Cancel
> pending
> \Driver\Ftdisk Ntfs!NtfsSingleSyncCompletionRoutine
> Args: 00008000 00000000 6f6eb000 00000001
> [3, 0] 0 0 fcda9020 fcc7ed28 00000000-00000000
> \FileSystem\Ntfs
> Args: 00008000 00000000 00133000 00000000
>
>
>
>
>
>

OSR_Community_User · August 27, 2002, 10:19am

RE: [ntfsd] problem with shutdown, please help!
KeWaitForSingleObject expected a pointer to the dispatcher object,
which can be KEVENT, KMUTEX, KSEMAPHORE, KTIMER or KTHREAD. They
have DISPATCHER_HEADER as the first field.
!object command does not work with them.

This object here is the NotificationEvent, which should be set
by CompletionRoutine. But it do not get executed.

At the same time !devobj command on \Device\atapi’s object
shows that its queue is busy (something like):

kd> !devobj fcd67ad0
Device object (fcd67ad0) is for:
IdeDeviceP0T0L0-2 \Driver\atapi DriverObject fcd8f310
Current Irp 00000000 RefCount 0 Type 00000007 Flags 00005050
DevExt fcd67b88 DevObjExt fcd67ce8 Dope fcd67fa8 DevNode fcd8f628
ExtensionFlags (0000000000)
AttachedDevice (Upper) fcd679b0 \Driver\ACPI
Device queue is busy - Queue flink = blink

Does anyone know what it means?
Have it finished processing IRP or not?

Leonid.

“Kurt Godwin” wrote in message news:xxxxx@ntfsd…
do a “!object eb18f600”. This is the first parameter to KeWaitForSingleObject. The thread that owns this is probably blocked on something that THREAD fc9e6da0 has.

ChildEBP RetAddr Args to Child
eb18f284 8042d61c fcda90f0 fc9dfc08 ff535948 nt!KiSwapThread+0xc5
eb18f2ac fc8ab6d6 eb18f600 00000000 00000000 nt!KeWaitForSingleObject+0x1a1
-----Original Message-----
From: Leonid Zhigunov [mailto:xxxxx@progate.spb.ru]
Sent: Monday, August 26, 2002 8:44 AM
To: File Systems Developers
Subject: [ntfsd] Re: problem with shutdown, please help!

Yes,

I did it. The !lock command did not show any lock contention.
The !process 0 7 command showed that all threads were in
WAIT state. System worker threads were waiting on the queue,
while other threads did not show any interesting in their stack
trace.

Leonid.

“Vladimir Chtchetkine” wrote in message news:xxxxx@ntfsd…
Seems like you’re having a dead lock somewhere. Did you try using
!locks command to see all the locks held? This may give you a clue
on where to look at. !process 0 6 also may be useful in this situation.

Best regards,

Vladimir

-----Original Message-----
From: Leonid Zhigunov [mailto:xxxxx@progate.spb.ru]
Sent: Sunday, August 25, 2002 7:13 AM
To: File Systems Developers
Subject: [ntfsd] problem with shutdown, please help!

Hi,

When my filter driver is loaded the system can not be shuted down properly.

Winlogon thread, which calls NtShutdownSystem causes a page
fault, which turns to NTFS read request to disk which never completes.

Filter driver do nothing for read requests except:
IoSkipCurrentIrpStackLocation(Irp);
status = IoCallDriver(DeviceExtension->TargetDevice, Irp);

Driver Verifier does not detect any errors.

I am very appreciated with any advise on how to resolve this situation or
what should I look for to find why it happens. Thanks in advance.

Leonid.

P.S. Here is the information from Windbg, which could be helpfull:

THREAD fc9e6da0 Cid c0.a8 Teb: 7ffde000 Win32Thread: e1a247e8 WAIT:
(Executive) KernelMode Non-Alertable
eb18f600 NotificationEvent
Not impersonating
Owning Process fc9e6020
WaitTime (seconds) 8945
Context Switch Count 912 LargeStack
UserTime 0:00:00.0030
KernelTime 0:00:00.0580
Start Address 0x01001674
Stack Init eb190000 Current eb18f26c Base eb190000 Limit eb18b000 Call 0
Priority 15 BasePriority 15 PriorityDecrement 0 DecrementCount 0

ChildEBP RetAddr Args to Child
eb18f284 8042d61c fcda90f0 fc9dfc08 ff535948 nt!KiSwapThread+0xc5
eb18f2ac fc8ab6d6 eb18f600 00000000 00000000 nt!KeWaitForSingleObject+0x1a1
eb18f2c8 fc8ab30b fc9dfc08 00008000 00008000 Ntfs!NtfsWaitSync+0x18
eb18f47c fc8af5e4 fc9dfc08 ff535948 e138d7d8 Ntfs!NtfsNonCachedIo+0x230
eb18f694 fc8aed8d fc9dfc08 ff535948 00000001 Ntfs!NtfsCommonRead+0xf1a
eb18f730 8041f54b fcda9020 ff535948 000000c9 Ntfs!NtfsFsdRead+0x201
eb18f744 8052c81b fcda6300 ff535948 fcda6300 nt!IopfCallDriver+0x35
eb18f760 eb0391d6 fcda6300 ff535948 fcda6300 nt!IovCallDriver+0x77
eb18f7a4 eb038c52 fcda6300 ff535948 00000002
I2kfilt!I2kLogicalVolumeFilterDispatch+0x106
eb18f7c0 8041f54b fcda6300 ff535948 fcc7ed28 I2kfilt!I2kIrpDispatch+0x62
eb18f7d4 80420890 00000000 80062f00 00000000 nt!IopfCallDriver+0x35
eb18f7e8 8043ed53 fcc7ed28 ff53b3e0 ff53b3c0 nt!IoPageRead+0xb1
eb18f828 80447434 00000000 a01330ea c02804cc nt!MiDispatchFault+0x231
eb18f874 80464966 00000000 00000000 00000000 nt!MmAccessFault+0x67b
eb18f874 a01330ea 00000000 00000000 00000000 nt!KiTrap0E+0xc3
eb18f900 a000dea9 00000001 00000000 e19d0308 win32k!HmgSafeNextObjt+0x2e
eb18f910 a0111f7a 00000001 e139d83c e139d828 win32k!PDEVOBJ::bDisabled+0x2c
eb18f928 a0111ffb e19d0308 00000006 00000000 win32k!DrvDisableDisplay+0x75
eb18f944 a00eb359 e19d0308 00000001 00000000 win32k!DrvDisableMDEV+0x35
eb18fa54 a00b7726 eb18fad8 ff529f88 eb18fa84
win32k!xxxUserPowerEventCalloutWorker+0x106
eb18fa70 a00b7614 ff572648 ff55cbe8 00000000
win32k!xxxUserPowerCalloutWorker+0x4e
eb18fa90 a00b751a eb18fad8 805361ac eb18fad8 win32k!QueuePowerRequest+0xce
eb18fa98 805361ac eb18fad8 ff572648 ff55cbe8
win32k!UserPowerEventCallout+0x22
eb18fac0 80451059 a00b74f7 a00b74f7 eb18fad8 nt!MmDispatchWin32Callout+0x1ab
eb18fae0 8048914b 00000008 00000006 00000001 nt!PopEventCalloutDispatch+0x24
eb18fb04 80488c70 00000000 eb18fbf4 eb18fc78
nt!PopSetDevicesSystemState+0xe3
eb18fbe0 80461691 00000005 00000004 c0000004 nt!NtSetSystemPowerState+0x320
eb18fbe0 804014d5 00000005 00000004 c0000004 nt!KiSystemService+0xc4
eb18fc64 804889c3 00000005 00000004 c0000004 nt!ZwSetSystemPowerState+0xb
eb18fd48 804c61a9 00000005 00000004 c0000004 nt!NtSetSystemPowerState+0x70
eb18fd58 80461691 00000001 00000000 00000000 nt!NtShutdownSystem+0x2e
eb18fd58 77f9a5bd 00000001 00000000 00000000 nt!KiSystemService+0xc4
77f9a5b2 00000000 00000000 00000000 00000000 ntdll!NtShutdownSystem+0xb

Irp is active with 9 stacks 6 is current (= 0xff535a6c)
Mdl = ff53b3e0 Thread fc9e6da0: Irp stack trace.
Flags = 00000043
ThreadListEntry.Flink = ff535958
ThreadListEntry.Blink = ff535958
IoStatus.Status = 00000000
IoStatus.Information = 00000000
RequestorMode = 00000000
Cancel = 00
CancelIrql = 0
ApcEnvironment = 00
UserIosb = ff53b3b8
UserEvent = ff53b3a8
Overlay.AsynchronousParameters.UserApcRoutine = 00000000
Overlay.AsynchronousParameters.UserApcContext = 00000000
Overlay.AllocationSize = 00000000 - 00000000
CancelRoutine = 00000000
UserBuffer = f177b000
&Tail.Overlay.DeviceQueueEntry = 0087c84c
Tail.Overlay.Thread = fc9e6da0
Tail.Overlay.AuxiliaryBuffer = 00000000
Tail.Overlay.ListEntry.Flink = 00000000
Tail.Overlay.ListEntry.Blink = 00000000
Tail.Overlay.CurrentStackLocation = ff535a6c
Tail.Overlay.OriginalFileObject = fcc7ed28
Tail.Apc = 00000000
Tail.CompletionKey = 00000000
cmd flg cl Device File Completion-Context
[0, 0] 0 0 00000000 00000000 00000000-00000000

Args: 00000000 00000000 00000000 00000000
[0, 0] 0 0 00000000 00000000 00000000-00000000

Args: 00000000 00000000 00000000 00000000
[0, 0] 0 0 00000000 00000000 00000000-00000000

Args: 00000000 00000000 00000000 00000000
[0, 0] 0 0 00000000 00000000 00000000-00000000

Args: 00000000 00000000 00000000 00000000
[0, 0] 0 0 00000000 00000000 00000000-00000000

Args: 00000000 00000000 00000000 00000000
>[f, 0] 0 e1 fcd7c3d0 00000000 eb021184-ff51b008 Success Error Cancel
pending
\Driver\atapi CLASSPNP!ClassIoComplete
Args: ff51b008 00000000 00000000 fcd7c488
[3,34] 0 e0 fcdae030 00000000 fc975a20-fcdac168 Success Error Cancel
\Driver\Disk ftdisk!FtpRefCountCompletionRoutine
Args: 00008000 00000000 6f6f2e00 00000004
[3, 0] 0 e1 fcdac0b0 00000000 fc8ac276-eb18f5f4 Success Error Cancel
pending
\Driver\Ftdisk Ntfs!NtfsSingleSyncCompletionRoutine
Args: 00008000 00000000 6f6eb000 00000001
[3, 0] 0 0 fcda9020 fcc7ed28 00000000-00000000
\FileSystem\Ntfs
Args: 00008000 00000000 00133000 00000000

—
You are currently subscribed to ntfsd as: xxxxx@Starbase.com
To unsubscribe send a blank email to %%email.unsub%%

—
You are currently subscribed to ntfsd as: xxxxx@1vision.com
To unsubscribe send a blank email to %%email.unsub%%

OSR_Community_User · August 27, 2002, 2:19pm

Leonid, I’ve seen your shutdown/reboot bug in three other filter drivers, and each time the cause of the bug was that the driver was not properly propagating the DO_POWER_PAGABLE bit. I mentioned this to you earlier but you didn’t seem to notice. If you are indeed interested in fixing your bug then you should take a look at the difference between the W2K DDK Toaster filter sample code and the XP DDK Toaster filter sample code. The W2K sample had the same bug that you have, and the XP sample has the fix to this bug… look at how the XP toaster filter sample (filter.c) handles IRP_MN_DEVICE_USAGE_NOTIFICATION in relation to setting the DO_POWER_PAGABLE flag, and also see the FilterDeviceUsageNotificationCompletionRoutine() completion routine. If you use the same technique in your filter driver your bug will likely go away.

Nate Bushman
PowerQuest Corp.

-----Original Message-----
From: Leonid Zhigunov [mailto:xxxxx@progate.spb.ru]
Sent: Tuesday, August 27, 2002 8:24 AM
To: File Systems Developers
Subject: [ntfsd] Re: problem with shutdown, please help!

KeWaitForSingleObject expected a pointer to the dispatcher object,
which can be KEVENT, KMUTEX, KSEMAPHORE, KTIMER or KTHREAD. They
have DISPATCHER_HEADER as the first field.
!object command does not work with them.

This object here is the NotificationEvent, which should be set
by CompletionRoutine. But it do not get executed.

At the same time !devobj command on \Device\atapi’s object
shows that its queue is busy (something like):

kd> !devobj fcd67ad0
Device object (fcd67ad0) is for:
IdeDeviceP0T0L0-2 \Driver\atapi DriverObject fcd8f310
Current Irp 00000000 RefCount 0 Type 00000007 Flags 00005050
DevExt fcd67b88 DevObjExt fcd67ce8 Dope fcd67fa8 DevNode fcd8f628
ExtensionFlags (0000000000)
AttachedDevice (Upper) fcd679b0 \Driver\ACPI
Device queue is busy - Queue flink = blink

Does anyone know what it means?
Have it finished processing IRP or not?

Leonid.

“Kurt Godwin” < xxxxx@1vision.com> wrote in message news:xxxxx@ntfsd…
do a “!object eb18f600”. This is the first parameter to KeWaitForSingleObject. The thread that owns this is probably blocked on something that THREAD fc9e6da0 has.

ChildEBP RetAddr Args to Child
eb18f284 8042d61c fcda90f0 fc9dfc08 ff535948 nt!KiSwapThread+0xc5
eb18f2ac fc8ab6d6 eb18f600 00000000 00000000 nt!KeWaitForSingleObject+0x1a1

-----Original Message-----
From: Leonid Zhigunov [mailto:xxxxx@progate.spb.ru]
Sent: Monday, August 26, 2002 8:44 AM
To: File Systems Developers
Subject: [ntfsd] Re: problem with shutdown, please help!

Yes,

I did it. The !lock command did not show any lock contention.
The !process 0 7 command showed that all threads were in
WAIT state. System worker threads were waiting on the queue,
while other threads did not show any interesting in their stack
trace.

Leonid.

“Vladimir Chtchetkine” < xxxxx@starbase.com> wrote in message news:xxxxx@ntfsd…

Seems like you’re having a dead lock somewhere. Did you try using
!locks command to see all the locks held? This may give you a clue
on where to look at. !process 0 6 also may be useful in this situation.

Best regards,

Vladimir

-----Original Message-----
From: Leonid Zhigunov [mailto:xxxxx@progate.spb.ru]
Sent: Sunday, August 25, 2002 7:13 AM
To: File Systems Developers
Subject: [ntfsd] problem with shutdown, please help!

Hi,

When my filter driver is loaded the system can not be shuted down properly.

Winlogon thread, which calls NtShutdownSystem causes a page
fault, which turns to NTFS read request to disk which never completes.

Filter driver do nothing for read requests except:
IoSkipCurrentIrpStackLocation(Irp);
status = IoCallDriver(DeviceExtension->TargetDevice, Irp);

Driver Verifier does not detect any errors.

I am very appreciated with any advise on how to resolve this situation or
what should I look for to find why it happens. Thanks in advance.

Leonid.

P.S. Here is the information from Windbg, which could be helpfull:

THREAD fc9e6da0 Cid c0.a8 Teb: 7ffde000 Win32Thread: e1a247e8 WAIT:
(Executive) KernelMode Non-Alertable
eb18f600 NotificationEvent
Not impersonating
Owning Process fc9e6020
WaitTime (seconds) 8945
Context Switch Count 912 LargeStack
UserTime 0:00:00.0030
KernelTime 0:00:00.0580
Start Address 0x01001674
Stack Init eb190000 Current eb18f26c Base eb190000 Limit eb18b000 Call 0
Priority 15 BasePriority 15 PriorityDecrement 0 DecrementCount 0

ChildEBP RetAddr Args to Child
eb18f284 8042d61c fcda90f0 fc9dfc08 ff535948 nt!KiSwapThread+0xc5
eb18f2ac fc8ab6d6 eb18f600 00000000 00000000 nt!KeWaitForSingleObject+0x1a1
eb18f2c8 fc8ab30b fc9dfc08 00008000 00008000 Ntfs!NtfsWaitSync+0x18
eb18f47c fc8af5e4 fc9dfc08 ff535948 e138d7d8 Ntfs!NtfsNonCachedIo+0x230
eb18f694 fc8aed8d fc9dfc08 ff535948 00000001 Ntfs!NtfsCommonRead+0xf1a
eb18f730 8041f54b fcda9020 ff535948 000000c9 Ntfs!NtfsFsdRead+0x201
eb18f744 8052c81b fcda6300 ff535948 fcda6300 nt!IopfCallDriver+0x35
eb18f760 eb0391d6 fcda6300 ff535948 fcda6300 nt!IovCallDriver+0x77
eb18f7a4 eb038c52 fcda6300 ff535948 00000002
I2kfilt!I2kLogicalVolumeFilterDispatch+0x106
eb18f7c0 8041f54b fcda6300 ff535948 fcc7ed28 I2kfilt!I2kIrpDispatch+0x62
eb18f7d4 80420890 00000000 80062f00 00000000 nt!IopfCallDriver+0x35
eb18f7e8 8043ed53 fcc7ed28 ff53b3e0 ff53b3c0 nt!IoPageRead+0xb1
eb18f828 80447434 00000000 a01330ea c02804cc nt!MiDispatchFault+0x231
eb18f874 80464966 00000000 00000000 00000000 nt!MmAccessFault+0x67b
eb18f874 a01330ea 00000000 00000000 00000000 nt!KiTrap0E+0xc3
eb18f900 a000dea9 00000001 00000000 e19d0308 win32k!HmgSafeNextObjt+0x2e
eb18f910 a0111f7a 00000001 e139d83c e139d828 win32k!PDEVOBJ::bDisabled+0x2c
eb18f928 a0111ffb e19d0308 00000006 00000000 win32k!DrvDisableDisplay+0x75
eb18f944 a00eb359 e19d0308 00000001 00000000 win32k!DrvDisableMDEV+0x35
eb18fa54 a00b7726 eb18fad8 ff529f88 eb18fa84
win32k!xxxUserPowerEventCalloutWorker+0x106
eb18fa70 a00b7614 ff572648 ff55cbe8 00000000
win32k!xxxUserPowerCalloutWorker+0x4e
eb18fa90 a00b751a eb18fad8 805361ac eb18fad8 win32k!QueuePowerRequest+0xce
eb18fa98 805361ac eb18fad8 ff572648 ff55cbe8
win32k!UserPowerEventCallout+0x22
eb18fac0 80451059 a00b74f7 a00b74f7 eb18fad8 nt!MmDispatchWin32Callout+0x1ab
eb18fae0 8048914b 00000008 00000006 00000001 nt!PopEventCalloutDispatch+0x24
eb18fb04 80488c70 00000000 eb18fbf4 eb18fc78
nt!PopSetDevicesSystemState+0xe3
eb18fbe0 80461691 00000005 00000004 c0000004 nt!NtSetSystemPowerState+0x320
eb18fbe0 804014d5 00000005 00000004 c0000004 nt!KiSystemService+0xc4
eb18fc64 804889c3 00000005 00000004 c0000004 nt!ZwSetSystemPowerState+0xb
eb18fd48 804c61a9 00000005 00000004 c0000004 nt!NtSetSystemPowerState+0x70
eb18fd58 80461691 00000001 00000000 00000000 nt!NtShutdownSystem+0x2e
eb18fd58 77f9a5bd 00000001 00000000 00000000 nt!KiSystemService+0xc4
77f9a5b2 00000000 00000000 00000000 00000000 ntdll!NtShutdownSystem+0xb

Irp is active with 9 stacks 6 is current (= 0xff535a6c)
Mdl = ff53b3e0 Thread fc9e6da0: Irp stack trace.
Flags = 00000043
ThreadListEntry.Flink = ff535958
ThreadListEntry.Blink = ff535958
IoStatus.Status = 00000000
IoStatus.Information = 00000000
RequestorMode = 00000000
Cancel = 00
CancelIrql = 0
ApcEnvironment = 00
UserIosb = ff53b3b8
UserEvent = ff53b3a8
Overlay.AsynchronousParameters.UserApcRoutine = 00000000
Overlay.AsynchronousParameters.UserApcContext = 00000000
Overlay.AllocationSize = 00000000 - 00000000
CancelRoutine = 00000000
UserBuffer = f177b000
&Tail.Overlay.DeviceQueueEntry = 0087c84c
Tail.Overlay.Thread = fc9e6da0
Tail.Overlay.AuxiliaryBuffer = 00000000
Tail.Overlay.ListEntry.Flink = 00000000
Tail.Overlay.ListEntry.Blink = 00000000
Tail.Overlay.CurrentStackLocation = ff535a6c
Tail.Overlay.OriginalFileObject = fcc7ed28
Tail.Apc = 00000000
Tail.CompletionKey = 00000000
cmd flg cl Device File Completion-Context
[0, 0] 0 0 00000000 00000000 00000000-00000000

Args: 00000000 00000000 00000000 00000000
[0, 0] 0 0 00000000 00000000 00000000-00000000

Args: 00000000 00000000 00000000 00000000

[f, 0] 0 e1 fcd7c3d0 00000000 eb021184-ff51b008 Success Error Cancel
pending
\Driver\atapi CLASSPNP!ClassIoComplete
Args: ff51b008 00000000 00000000 fcd7c488
[3,34] 0 e0 fcdae030 00000000 fc975a20-fcdac168 Success Error Cancel
\Driver\Disk ftdisk!FtpRefCountCompletionRoutine
Args: 00008000 00000000 6f6f2e00 00000004
[3, 0] 0 e1 fcdac0b0 00000000 fc8ac276-eb18f5f4 Success Error Cancel
pending
\Driver\Ftdisk Ntfs!NtfsSingleSyncCompletionRoutine
Args: 00008000 00000000 6f6eb000 00000001
[3, 0] 0 0 fcda9020 fcc7ed28 00000000-00000000
\FileSystem\Ntfs
Args: 00008000 00000000 00133000 00000000

You are currently subscribed to ntfsd as: xxxxx@Starbase.com
To unsubscribe send a blank email to %%email.unsub%%

You are currently subscribed to ntfsd as: xxxxx@1vision.com
To unsubscribe send a blank email to %%email.unsub%%

You are currently subscribed to ntfsd as: xxxxx@powerquest.com
To unsubscribe send a blank email to %%email.unsub%%

Alexei_Jelvis-2 · August 27, 2002, 5:12pm

Hi,

sample code. The W2K sample had the same bug that you have, and the XP =
sample has the fix to this bug… look at how the XP toaster filter =
sample (filter.c) handles IRP_MN_DEVICE_USAGE_NOTIFICATION in relation =
to setting the DO_POWER_PAGABLE flag, and also see the =
FilterDeviceUsageNotificationCompletionRoutine() completion routine. If =
you use the same technique in your filter driver your bug will likely go
=

Leonid is developing File System filter driver.
As far as I know DO_POWER_PAGABLE flag is irrelevant for FILE SYSTEM
filter.

Alexei.

OSR_Community_User · August 27, 2002, 5:35pm

Whoops. My bad. Thanks for pointing that out.

-----Original Message-----
From: Alexei Jelvis [mailto:xxxxx@mondenet.com]
Sent: Tuesday, August 27, 2002 3:13 PM
To: File Systems Developers
Subject: [ntfsd] Re: problem with shutdown, please help!

Hi,

sample code. The W2K sample had the same bug that you have, and the XP =
sample has the fix to this bug… look at how the XP toaster filter =
sample (filter.c) handles IRP_MN_DEVICE_USAGE_NOTIFICATION in relation =
to setting the DO_POWER_PAGABLE flag, and also see the =
FilterDeviceUsageNotificationCompletionRoutine() completion routine. If =
you use the same technique in your filter driver your bug will likely go
=

Leonid is developing File System filter driver.
As far as I know DO_POWER_PAGABLE flag is irrelevant for FILE SYSTEM
filter.

Alexei.

You are currently subscribed to ntfsd as: xxxxx@powerquest.com
To unsubscribe send a blank email to %%email.unsub%%