Groups > Microsoft > WinDbg > Re: Big Brains on this BSOD from disk.sys please!




Big Brains on this BSOD from disk.sys please!

Big Brains on this BSOD from disk.sys please!
Tue, 8 Apr 2008 12:02:35 +0200
Since SP1 this ~1 year old OEM installed Vista HP laptop has taken to 
BSOD'ing ~every workday when woken from sleep after moving from home to a 
wifi hotspot.

MS' advice is to do a clean install of Vista... which would be such a pain 
I'm only going to do it if all else fails.

I attach the results of windbg on the latest minidump file, which is typical 
of most in indicating the fault occured in disk.sys [Vista OS program 
modified date 19/01/2008, i.e. updated by MS recently!]. I've also tried to 
give as much information as I think is relevant.about h/w, s/w, and what 
exactly happens... sorry if this makes it a bit long...

I would apreciate any help I can get on driving windbg better to identify 
the cause or any other insights!

Many thanks for your input...

Julian

***************************************************

Other Info:

Laptop Hardware: Rock Xtreme CTX Pro with SATA hardrive, SONY DVD RW 
DW-Q520A ATA Device, 2GB RAM, T7200 Dual Core, nVidia Go 7950 GTX, Intel® 
PROWireless 3945ABG, Realtek RTL8169/8110 Family PCI Gigabit Ethernet NIC 
(NDIS 6.0) and RealTek High Definition Audio. NO Firewire/IEE 1394 (But I do 
have a Lexar USB stick with its own drivers...)

Software (running at the time of BSOD): Acronis True Image Home, MS Outlook 
2002,TrueCrypt 5.1a, Skype, Firefox, AVG Free 7.5 & AVG Antivirus, RegRun 
5.7, WinZip QuickPick; SP1 as delviered by WU, no outstanding updates.

Fault Process and Debugging/Resolution Actions: At home, the laptop is 
connected to a 1Gb/s wired lan to an iSCSI target, with other mounted 
network drives; it is also connected wirelessly to a Netgear DG834 Router 
(the two connections are on different subnets, both use DHCP; IPv6 is 
disabled on wired/wireless and in the registry the 
DhcpConnForceBroadcastFlag = 0 and DhcpConnEnableBcastFlagToggle = 1 for 
wifi). When I leave home I put the laptop to sleep and *then* unplug the 
wired lan. At the wifi hotspot, I connect to a Netgear WPN824... 10-30 
minutes later the laptop BSOD's on ~80% of occasions.

I have updated nVidia drivers to v7.15.11.6745 (nVidia was the source of 
other post SP1 problems that are now resolved) and two days ago the wireless 
drivers for the Intel® PROWireless 3945ABG to the latest v11.5.0.0 (not 
offered by Windows Update!). The only outstanding WU driver is the "CXT - 
Network - HDAUDIO Soft Data Fax Modem with SmartCP" (I never use the modem

so I have ignored this... is this my mistake?) The laptop is absolutely fine 
on sleep @hotspot then wake @home...

Google searching on "probably caused by: disk.sys", bugcheck codes,
etc. 
etc. haven't turned up anything apparently relevant; sigverify showed no 
errors...

Windbg Output...

BugCheck 9F, {3, d065e758, 84697ac8, df27cd98}
Probably caused by : disk.sys

Followup: MachineOwner
---------
0: kd> !analyze -v
DRIVER_POWER_STATE_FAILURE (9f)
A driver is causing an inconsistent power state.
Arguments:
Arg1: 00000003, A device object has been blocking an Irp for too long a time
Arg2: d065e758, Physical Device Object of the stack
Arg3: 84697ac8, Functional Device Object of the stack
Arg4: df27cd98, The blocked IRP

Debugging Details:
------------------
DRVPOWERSTATE_SUBCODE:  3
DEVICE_OBJECT: 84697ac8
DRIVER_OBJECT: 8524c3b8
IMAGE_NAME:  disk.sys
DEBUG_FLR_IMAGE_TIMESTAMP:  47918f7b
MODULE_NAME: disk
FAULTING_MODULE: 87fdb000 disk
CUSTOMER_CRASH_COUNT:  1
DEFAULT_BUCKET_ID:  INTEL_CPU_MICROCODE_ZERO
BUGCHECK_STR:  0x9F
PROCESS_NAME:  System
CURRENT_IRQL:  2
LAST_CONTROL_TRANSFER:  from 81e7fb6c to 81f19163

STACK_TEXT:
81f41acc 81e7fb6c 0000009f 00000003 d065e758 nt!KeBugCheckEx+0x1e
81f41b28 81e7f6bc 81f41b94 81f41c50 81f5a401 nt!PopCheckIrpWatchdog+0x1ad
81f41b68 81f02d00 81f5a4e0 00000000 e9df9e50 nt!PopCheckForIdleness+0x343
81f41c88 81f02936 81f41cd0 de64fe02 81f41cd8 nt!KiTimerListExpire+0x367
81f41ce8 81f02483 00000000 00000000 0054ce16 nt!KiTimerExpiration+0x2a0
81f41d50 81f00f9d 00000000 0000000e 00000000 nt!KiRetireDpcList+0xba
81f41d54 00000000 0000000e 00000000 00000000 nt!KiIdleLoop+0x49

STACK_COMMAND:  kb
FOLLOWUP_NAME:  MachineOwner
FAILURE_BUCKET_ID:  0x9F_IMAGE_disk.sys
BUCKET_ID:  0x9F_IMAGE_disk.sys
Followup: MachineOwner
---------
0: kd> !devobj ffffffff84697ac8 f
81f5b524: Unable to get value of ObpRootDirectoryObject
Device object (84697ac8) is for:
  \Driver\disk DriverObject 8524c3b8
Current Irp 00000000 RefCount 0 Type 00000007 Flags 00002050
Vpb 9dfe76b8 DevExt 84697b80 DevObjExt 84697fc0
AttachedDevice (Upper) a0dfe020 \Driver\partmgr
Device queue is not busy.

-- 
Julian I-Do-Stuff

Some Vista stuff, but mostly just Stuff at http://berossus,blogspot.com 
Post Reply
Re: Big Brains on this BSOD from disk.sys please!
Tue, 8 Apr 2008 12:35:22 +0200
The bug is strange in itself, because such a simple test-case should be 
tested in the first time. The problem might be not in the disk.sys, but in 
some driver in the stack. I noticed, that there is partmgr.sys filtering IO 
of disk.sys, try to verify partmgr.sys (using driver verifier) - and in case 
of BSOD report dump here. Or try to de-install Partition Manager product and 
repeate the test case.

-- 
V.
This posting is provided "AS IS" with no warranties, and confers no
rights.
"Julian" <msforums@tiger2.notthisbit.demon.co.uk> wrote in
message 
news:%23I9Dt%23VmIHA.1204@TK2MSFTNGP03.phx.gbl...
> Since SP1 this ~1 year old OEM installed Vista HP laptop has taken to 
> BSOD'ing ~every workday when woken from sleep after moving from home to a 
> wifi hotspot.
>
> MS' advice is to do a clean install of Vista... which would be such a pain

> I'm only going to do it if all else fails.
>
> I attach the results of windbg on the latest minidump file, which is 
> typical of most in indicating the fault occured in disk.sys [Vista OS 
> program modified date 19/01/2008, i.e. updated by MS recently!]. I've also

> tried to give as much information as I think is relevant.about h/w, s/w, 
> and what exactly happens... sorry if this makes it a bit long...
>
> I would apreciate any help I can get on driving windbg better to identify 
> the cause or any other insights!
>
> Many thanks for your input...
>
> Julian
>
> ***************************************************
>
> Other Info:
>
> Laptop Hardware: Rock Xtreme CTX Pro with SATA hardrive, SONY DVD RW 
> DW-Q520A ATA Device, 2GB RAM, T7200 Dual Core, nVidia Go 7950 GTX, Intel® 
> PROWireless 3945ABG, Realtek RTL8169/8110 Family PCI Gigabit Ethernet NIC 
> (NDIS 6.0) and RealTek High Definition Audio. NO Firewire/IEE 1394 (But I 
> do have a Lexar USB stick with its own drivers...)
>
> Software (running at the time of BSOD): Acronis True Image Home, MS 
> Outlook 2002,TrueCrypt 5.1a, Skype, Firefox, AVG Free 7.5 & AVG
Antivirus, 
> RegRun 5.7, WinZip QuickPick; SP1 as delviered by WU, no outstanding 
> updates.
>
> Fault Process and Debugging/Resolution Actions: At home, the laptop is 
> connected to a 1Gb/s wired lan to an iSCSI target, with other mounted 
> network drives; it is also connected wirelessly to a Netgear DG834 Router 
> (the two connections are on different subnets, both use DHCP; IPv6 is 
> disabled on wired/wireless and in the registry the 
> DhcpConnForceBroadcastFlag = 0 and DhcpConnEnableBcastFlagToggle = 1 for 
> wifi). When I leave home I put the laptop to sleep and *then* unplug the 
> wired lan. At the wifi hotspot, I connect to a Netgear WPN824... 10-30 
> minutes later the laptop BSOD's on ~80% of occasions.
>
> I have updated nVidia drivers to v7.15.11.6745 (nVidia was the source of 
> other post SP1 problems that are now resolved) and two days ago the 
> wireless drivers for the Intel® PROWireless 3945ABG to the latest 
> v11.5.0.0 (not offered by Windows Update!). The only outstanding WU driver

> is the "CXT - Network - HDAUDIO Soft Data Fax Modem with SmartCP"
(I never 
> use the modem so I have ignored this... is this my mistake?) The laptop is

> absolutely fine on sleep @hotspot then wake @home...
>
> Google searching on "probably caused by: disk.sys", bugcheck
codes, etc. 
> etc. haven't turned up anything apparently relevant; sigverify showed no 
> errors...
>
> Windbg Output...
>
> BugCheck 9F, {3, d065e758, 84697ac8, df27cd98}
> Probably caused by : disk.sys
>
> Followup: MachineOwner
> ---------
> 0: kd> !analyze -v
> DRIVER_POWER_STATE_FAILURE (9f)
> A driver is causing an inconsistent power state.
> Arguments:
> Arg1: 00000003, A device object has been blocking an Irp for too long a 
> time
> Arg2: d065e758, Physical Device Object of the stack
> Arg3: 84697ac8, Functional Device Object of the stack
> Arg4: df27cd98, The blocked IRP
>
> Debugging Details:
> ------------------
> DRVPOWERSTATE_SUBCODE:  3
> DEVICE_OBJECT: 84697ac8
> DRIVER_OBJECT: 8524c3b8
> IMAGE_NAME:  disk.sys
> DEBUG_FLR_IMAGE_TIMESTAMP:  47918f7b
> MODULE_NAME: disk
> FAULTING_MODULE: 87fdb000 disk
> CUSTOMER_CRASH_COUNT:  1
> DEFAULT_BUCKET_ID:  INTEL_CPU_MICROCODE_ZERO
> BUGCHECK_STR:  0x9F
> PROCESS_NAME:  System
> CURRENT_IRQL:  2
> LAST_CONTROL_TRANSFER:  from 81e7fb6c to 81f19163
>
> STACK_TEXT:
> 81f41acc 81e7fb6c 0000009f 00000003 d065e758 nt!KeBugCheckEx+0x1e
> 81f41b28 81e7f6bc 81f41b94 81f41c50 81f5a401 nt!PopCheckIrpWatchdog+0x1ad
> 81f41b68 81f02d00 81f5a4e0 00000000 e9df9e50 nt!PopCheckForIdleness+0x343
> 81f41c88 81f02936 81f41cd0 de64fe02 81f41cd8 nt!KiTimerListExpire+0x367
> 81f41ce8 81f02483 00000000 00000000 0054ce16 nt!KiTimerExpiration+0x2a0
> 81f41d50 81f00f9d 00000000 0000000e 00000000 nt!KiRetireDpcList+0xba
> 81f41d54 00000000 0000000e 00000000 00000000 nt!KiIdleLoop+0x49
>
> STACK_COMMAND:  kb
> FOLLOWUP_NAME:  MachineOwner
> FAILURE_BUCKET_ID:  0x9F_IMAGE_disk.sys
> BUCKET_ID:  0x9F_IMAGE_disk.sys
> Followup: MachineOwner
> ---------
> 0: kd> !devobj ffffffff84697ac8 f
> 81f5b524: Unable to get value of ObpRootDirectoryObject
> Device object (84697ac8) is for:
>  \Driver\disk DriverObject 8524c3b8
> Current Irp 00000000 RefCount 0 Type 00000007 Flags 00002050
> Vpb 9dfe76b8 DevExt 84697b80 DevObjExt 84697fc0
> AttachedDevice (Upper) a0dfe020 \Driver\partmgr
> Device queue is not busy.
>
> -- 
> Julian I-Do-Stuff
>
> Some Vista stuff, but mostly just Stuff at http://berossus,blogspot.com 

Post Reply
Re: Big Brains on this BSOD from disk.sys please!
Tue, 8 Apr 2008 23:25:15 +0200
Thanks for quck response! Sorry I couldn't get back earlier... I appreciate 
your input since it has me (and MS) stumped...

[A Quick Correction to previous post - there is FireWire/ IEE 1394 - I just 
didn't notice because I haven't used it]

Re: partmgr.sys - this is a MS OS file; it didn't appear in the sigverif 
list, but it is signed (checked via properties) (not a 3rd party "Partition

Manager" and not uninstallable AFAIK)

Re: disk.sys...

Since the windbg indicates the fault as being "probably" in disk.sys I
have 
looked for it... I have noticed that there are FOUR copies of disk.sys on 
the system and that two are  recently created, I would guess as a result of 
a Windows Update - as part of SP1 by the inferred version numbers and the 
creation date.

in C:\Windows\System32\drivers disk.sys has a modified date of 19 Jan 2008 
and was created on 23 Mar 2008
in C:\Windows\System32\DriverStore\FileRepository\disk.inf_90722180 disk.sys 
has a modified date of 19 Jan 2008 (inf file suggests the version is 
6.0.6001.18000) and was created on 23 mar 2008
in 
C:\Windows\winsxs\x86_disk.inf_31bf3856ad364e35_6.0.6001.18000_none_f9c681e4742c
835a 
disk.sys has a modified date of 19 Jan 2008 (inf file suggests the version 
is 6.0.6001.18000) and was created on 23 mar 2008

in C:\Windows\System32\DriverStore\FileRepository\disk.inf_e0b0b355 disk.sys 
has a modified date of 2 Nov 2006 (inf file suggests the version is 
6.0.6000.16386)

No file has version information on the Details tab of File Properties; all 
are signed by Microsoft. 23 March 2008 was the date of the concluding part 
of the SP1 installation.

Could I "roll back" disk.sys somehow???

Re other drivers: I agree... I note from Device Manager that my Lexar USB 
device is a disk driver that has as drivers disk.sys, partmgr.sys and the 
Acronis snapman.sys. (When the USB device is safely removed this item does 
not appear on the list) but the system BSOD's without the USB being plugged 
in so this is not my 1st choice of cause...

Results of running sigverif.exe -

Microsoft Signature Verification

Log file generated on 08/04/2008 at 23:05
OS Platform:  Windows (x86), Version:  6.0, Build: 6001, CSDVersion: 
Service Pack 1
Scan Results:  Total Files: 262, Signed: 161, Unsigned: 101, Not Scanned: 0

File                      Modified       Version             Status 
Catalog              Signed By
------------------      ------------   -----------        ------------       
  -----------          -------------------
disk.sys                 19/01/2008     2:5.1               Signed 
Package_30_for_KB936Microsoft Windows

No entries in the log for partmgr.sys or snapman.sys (?!)

I also ran verifier.exe monitoring disk.sys, partmgr.sys and snapman.sys 
with my USB device plugged in, and I turned on Low Resource Simulation... 
(in fact everything except Force Pending I/O)

I don't know how to interpret the various counters though so I'm not sure 
what to report.... nothing *seemed* amiss (I assume that "Faults
Injected" 
refer to faults created for test purposes? there were 39 of them on the 
global counter in a half-hour period...) and the system hasn't died (yet!).

I suspected the network drivers because the BSOD only occured when I moved 
the laptop to a new location, but they have been updated to the latest on 
the Intel site to no effect.

All thoughts gratefully received.

Julian

"Volodymyr M. Shcherbyna" <v_scherbina@online.mvps.org> wrote in
message
news:uAjEJRWmIHA.5084@TK2MSFTNGP04.phx.gbl...
> The bug is strange in itself, because such a simple test-case should be
> tested in the first time. The problem might be not in the disk.sys, but in
> some driver in the stack. I noticed, that there is partmgr.sys filtering
> IO of disk.sys, try to verify partmgr.sys (using driver verifier) - and in
> case of BSOD report dump here. Or try to de-install Partition Manager
> product and repeate the test case.
>
> -- 
> V.
> This posting is provided "AS IS" with no warranties, and confers
no
> rights.
> "Julian" <msforums@tiger2.notthisbit.demon.co.uk> wrote in
message
> news:%23I9Dt%23VmIHA.1204@TK2MSFTNGP03.phx.gbl...
>> Since SP1 this ~1 year old OEM installed Vista HP laptop has taken to
>> BSOD'ing ~every workday when woken from sleep after moving from home to
a
>> wifi hotspot.
>>
>> MS' advice is to do a clean install of Vista... which would be such a
>> pain I'm only going to do it if all else fails.
>>
>> I attach the results of windbg on the latest minidump file, which is
>> typical of most in indicating the fault occured in disk.sys [Vista OS
>> program modified date 19/01/2008, i.e. updated by MS recently!]. I've
>> also tried to give as much information as I think is relevant.about
h/w,
>> s/w, and what exactly happens... sorry if this makes it a bit long...
>>
>> I would apreciate any help I can get on driving windbg better to
identify
>> the cause or any other insights!
>>
>> Many thanks for your input...
>>
>> Julian
>>
>> ***************************************************
>>
>> Other Info:
>>
>> Laptop Hardware: Rock Xtreme CTX Pro with SATA hardrive, SONY DVD RW
>> DW-Q520A ATA Device, 2GB RAM, T7200 Dual Core, nVidia Go 7950 GTX,
Intel®
>> PROWireless 3945ABG, Realtek RTL8169/8110 Family PCI Gigabit Ethernet
NIC
>> (NDIS 6.0) and RealTek High Definition Audio. NO Firewire/IEE 1394 (But
I
>> do have a Lexar USB stick with its own drivers...)
>>
>> Software (running at the time of BSOD): Acronis True Image Home, MS
>> Outlook 2002,TrueCrypt 5.1a, Skype, Firefox, AVG Free 7.5 & AVG
>> Antivirus, RegRun 5.7, WinZip QuickPick; SP1 as delviered by WU, no
>> outstanding updates.
>>
>> Fault Process and Debugging/Resolution Actions: At home, the laptop is
>> connected to a 1Gb/s wired lan to an iSCSI target, with other mounted
>> network drives; it is also connected wirelessly to a Netgear DG834
Router
>> (the two connections are on different subnets, both use DHCP; IPv6 is
>> disabled on wired/wireless and in the registry the
>> DhcpConnForceBroadcastFlag = 0 and DhcpConnEnableBcastFlagToggle = 1
for
>> wifi). When I leave home I put the laptop to sleep and *then* unplug
the
>> wired lan. At the wifi hotspot, I connect to a Netgear WPN824... 10-30
>> minutes later the laptop BSOD's on ~80% of occasions.
>>
>> I have updated nVidia drivers to v7.15.11.6745 (nVidia was the source
of
>> other post SP1 problems that are now resolved) and two days ago the
>> wireless drivers for the Intel® PROWireless 3945ABG to the latest
>> v11.5.0.0 (not offered by Windows Update!). The only outstanding WU
>> driver is the "CXT - Network - HDAUDIO Soft Data Fax Modem with
SmartCP"
>> (I never use the modem so I have ignored this... is this my mistake?)
The
>> laptop is absolutely fine on sleep @hotspot then wake @home...
>>
>> Google searching on "probably caused by: disk.sys", bugcheck
codes, etc.
>> etc. haven't turned up anything apparently relevant; sigverify showed
no
>> errors...
>>
>> Windbg Output...
>>
>> BugCheck 9F, {3, d065e758, 84697ac8, df27cd98}
>> Probably caused by : disk.sys
>>
>> Followup: MachineOwner
>> ---------
>> 0: kd> !analyze -v
>> DRIVER_POWER_STATE_FAILURE (9f)
>> A driver is causing an inconsistent power state.
>> Arguments:
>> Arg1: 00000003, A device object has been blocking an Irp for too long
a
>> time
>> Arg2: d065e758, Physical Device Object of the stack
>> Arg3: 84697ac8, Functional Device Object of the stack
>> Arg4: df27cd98, The blocked IRP
>>
>> Debugging Details:
>> ------------------
>> DRVPOWERSTATE_SUBCODE:  3
>> DEVICE_OBJECT: 84697ac8
>> DRIVER_OBJECT: 8524c3b8
>> IMAGE_NAME:  disk.sys
>> DEBUG_FLR_IMAGE_TIMESTAMP:  47918f7b
>> MODULE_NAME: disk
>> FAULTING_MODULE: 87fdb000 disk
>> CUSTOMER_CRASH_COUNT:  1
>> DEFAULT_BUCKET_ID:  INTEL_CPU_MICROCODE_ZERO
>> BUGCHECK_STR:  0x9F
>> PROCESS_NAME:  System
>> CURRENT_IRQL:  2
>> LAST_CONTROL_TRANSFER:  from 81e7fb6c to 81f19163
>>
>> STACK_TEXT:
>> 81f41acc 81e7fb6c 0000009f 00000003 d065e758 nt!KeBugCheckEx+0x1e
>> 81f41b28 81e7f6bc 81f41b94 81f41c50 81f5a401
nt!PopCheckIrpWatchdog+0x1ad
>> 81f41b68 81f02d00 81f5a4e0 00000000 e9df9e50
nt!PopCheckForIdleness+0x343
>> 81f41c88 81f02936 81f41cd0 de64fe02 81f41cd8
nt!KiTimerListExpire+0x367
>> 81f41ce8 81f02483 00000000 00000000 0054ce16
nt!KiTimerExpiration+0x2a0
>> 81f41d50 81f00f9d 00000000 0000000e 00000000 nt!KiRetireDpcList+0xba
>> 81f41d54 00000000 0000000e 00000000 00000000 nt!KiIdleLoop+0x49
>>
>> STACK_COMMAND:  kb
>> FOLLOWUP_NAME:  MachineOwner
>> FAILURE_BUCKET_ID:  0x9F_IMAGE_disk.sys
>> BUCKET_ID:  0x9F_IMAGE_disk.sys
>> Followup: MachineOwner
>> ---------
>> 0: kd> !devobj ffffffff84697ac8 f
>> 81f5b524: Unable to get value of ObpRootDirectoryObject
>> Device object (84697ac8) is for:
>>  \Driver\disk DriverObject 8524c3b8
>> Current Irp 00000000 RefCount 0 Type 00000007 Flags 00002050
>> Vpb 9dfe76b8 DevExt 84697b80 DevObjExt 84697fc0
>> AttachedDevice (Upper) a0dfe020 \Driver\partmgr
>> Device queue is not busy.
>>
>> -- 
>> Julian I-Do-Stuff
>>
>> Some Vista stuff, but mostly just Stuff at
http://berossus,blogspot.com
>
>

-- 
Julian I-Do-Stuff

Some Vista stuff, but mostly just Stuff at http://berossus,blogspot.com
Post Reply
about | contact