Winload.efi and drivers for booting

DS1 · March 21, 2017, 1:01pm

This is not a driver development question, but looking for some insight in this forum on how winload.efi and driver installation work.

We have Windows 2012 R2 installed on a server with an Intel NIC with SR-IOV enabled and appropriate Intel driver (ixn64x64.sys) downloaded and installed. After doing a sysprep generalize on the installation and capturing an image, it is used in a VM (hypervisor is kvm) on a different physical host, but with the same hardware. The VM has a VF assigned to it.

Windows fails to start with the bugcheck 0x7b - INACCESSIBLE_BOOT_DEVICE; parameter 1 indicates it failed to access partition 4 on the disk.

Attaching a debugger to the VM during startup, I see that ntoskrnl gets loaded; winload.efi has loaded a bunch of drivers for booting including the physical NIC driver; the Ethernet device is detected, but is not started - the PCI device id indicates it is the virtual NIC.

Questions:

How does winload.efi determine what set of drivers to load before loading ntoskrnl? How does it know that some drivers are required for NT to boot? From looking at the ixn driver inf file, it is not marked as “boot-start”.
How is a driver configured to always load during boot? How can we force installation of the VF driver on the physical machine and configure it to be loaded during boot, so that when the VF shows up in the VM, the driver is available during boot?

Output from debugging the VM during boot is below:

0: kd> kcn

1: kd> !pcitree
Bus 0x0 (FDO Ext ffffe001ebb13320)
(d=0, f=0) 80861237 devext 0xffffe001ebb091b0 devstack 0xffffe001ebb09060 0600 Bridge/HOST to PCI
(d=1, f=0) 80867000 devext 0xffffe001ebb099d0 devstack 0xffffe001ebb09880 0601 Bridge/PCI to ISA
(d=1, f=1) 80867010 devext 0xffffe001ebb081b0 devstack 0xffffe001ebb08060 0101 Mass Storage Controller/IDE
(d=2, f=0) 12341111 devext 0xffffe001ebb071b0 devstack 0xffffe001ebb07060 0300 Display Controller/VGA
(d=3, f=0) 808610ed devext 0xffffe001ebb079d0 devstack 0xffffe001ebb07880 0200 Network Controller/Ethernet <----- device id 10ed indicates Intel NIC VF

1: kd> !devext 0xffffe001ebb079d0
PDO Extension, Bus 0x0, Device 3, Function 0.
DevObj 0xffffe001ebb07880 Parent FDO DevExt 0xffffe001ebb13320
Device State = PciNotStarted
Vendor ID 8086 (INTEL) Device ID 10ED
…

1: kd> !DevNode ffffe001ebabf010
DevNode 0xffffe001ebabf010 for PDO 0xffffe001ebb07880
Parent 0xffffe001ebaeed30 Sibling 0xffffe001ebabf940 Child 0000000000
InstancePath is “PCI\VEN_8086&DEV_10ED&SUBSYS_7B11108E&REV_01\3&13c0b0c5&0&18”
State = DeviceNodeInitialized (0x302)
Previous State = DeviceNodeUninitialized (0x301)
StateHistory[00] = DeviceNodeUninitialized (0x301)
…
…
Flags (0x000022f0) DNF_ENUMERATED, DNF_IDS_QUERIED,
DNF_HAS_BOOT_CONFIG, DNF_BOOT_CONFIG_RESERVED,
DNF_RESOURCE_REQUIREMENTS_NEED_FILTERED, DNF_HAS_PROBLEM
CapabilityFlags (0x00040018) EjectSupported, Removable
Unknown flags 0x00040000
Problem = CM_PROB_NOT_CONFIGURED

OSR_Community_User · March 21, 2017, 4:16pm

Are you using network debugging ?

DS1 · March 21, 2017, 4:54pm

No, I’m using serial debugging, with the default dbgsettings - com1,
115200.

On Tue, Mar 21, 2017 at 1:17 PM, wrote:

> Are you using network debugging ?
>
> —
> NTDEV is sponsored by OSR
>
> Visit the list online at: http:> showlists.cfm?list=ntdev>
>
> MONTHLY seminars on crash dump analysis, WDF, Windows internals and
> software drivers!
> Details at http:
>
> To unsubscribe, visit the List Server section of OSR Online at <
> http://www.osronline.com/page.cfm?name=ListServer>
></http:></http:>

OSR_Community_User · March 21, 2017, 6:39pm

>How does winload.efi determine what set of drivers to load before loading ntoskrnl?

These are the drivers whose StartType is set to SERVICE_BOOT_START (0x00000000). This is the service configuration of the driver and this configuration is present in the INF file of the driver package. The loader obtains the list of boot drivers from the registry. If the NIC card driver is loaded with the boot drivers while it is not configured as a boot driver, then I do not know why because according to MSDN:

“Driver whose start type is SERVICE_SYSTEM_START are also loaded in the order of the load order groups to which they belong. However, no system-start driver is loaded until after all boot drivers have been loaded.”

https://msdn.microsoft.com/fr-fr/windows/hardware/drivers/ifs/what-determines-when-a-driver-is-loaded

How does it know that some drivers are required for NT to boot?

Again, because the driver is configured with SERVICE_BOOT_START.

How is a driver configured to always load during boot?

Again, because the driver is configured with SERVICE_BOOT_START.

How can we force installation of the VF driver on the physical machine and configure it to be loaded during boot, so that when the VF shows up in the VM, the driver is available during boot?

Loading the driver in the physical machine won’t help the virtual machine. The driver must be installed on the VM and configured as a boot driver on the VM.

When the bugcheck occurs you should run the “!analyze -v” command and do what is indicated in the MSDN documentation page for the bugcheck code you have:

https://msdn.microsoft.com/en-us/library/windows/hardware/ff559218(v=vs.85).aspx

Why is the NIC card so important to you ? Bugcheck 7b is most of the time caused by a failure to load a storage driver (like an SCSI Controler driver).

Eytan_Heidingsfeld · March 22, 2017, 1:22pm

Unless you are booting over iSCSI, you don’t need to worry about the
network driver, but KVM uses it’s own storage driver which you need to
pre-install, you might also need to setup the device in the registry.

https://fedoraproject.org/wiki/Windows_Virtio_Drivers

On Wed, Mar 22, 2017 at 12:39 AM, wrote:

> >How does winload.efi determine what set of drivers to load before loading
> ntoskrnl?
>
> These are the drivers whose StartType is set to SERVICE_BOOT_START
> (0x00000000). This is the service configuration of the driver and this
> configuration is present in the INF file of the driver package. The loader
> obtains the list of boot drivers from the registry. If the NIC card driver
> is loaded with the boot drivers while it is not configured as a boot
> driver, then I do not know why because according to MSDN:
>
> “Driver whose start type is SERVICE_SYSTEM_START are also loaded in the
> order of the load order groups to which they belong. However, no
> system-start driver is loaded until after all boot drivers have been
> loaded.”
>
> https://msdn.microsoft.com/fr-fr/windows/hardware/drivers/
> ifs/what-determines-when-a-driver-is-loaded
>
> >How does it know that some drivers are required for NT to boot?
>
> Again, because the driver is configured with SERVICE_BOOT_START.
>
> >How is a driver configured to always load during boot?
>
> Again, because the driver is configured with SERVICE_BOOT_START.
>
> >How can we force installation of the VF driver on the physical machine
> and configure it to be loaded during boot, so that when the VF shows up in
> the VM, the driver is available during boot?
>
> Loading the driver in the physical machine won’t help the virtual machine.
> The driver must be installed on the VM and configured as a boot driver on
> the VM.
>
> When the bugcheck occurs you should run the “!analyze -v” command and do
> what is indicated in the MSDN documentation page for the bugcheck code you
> have:
>
> https://msdn.microsoft.com/en-us/library/windows/hardware/
> ff559218(v=vs.85).aspx
>
> Why is the NIC card so important to you ? Bugcheck 7b is most of the time
> caused by a failure to load a storage driver (like an SCSI Controler
> driver).
>
> —
> NTDEV is sponsored by OSR
>
> Visit the list online at: http:> showlists.cfm?list=ntdev>
>
> MONTHLY seminars on crash dump analysis, WDF, Windows internals and
> software drivers!
> Details at http:
>
> To unsubscribe, visit the List Server section of OSR Online at <
> http://www.osronline.com/page.cfm?name=ListServer>
></http:></http:>

Winload.efi and drivers for booting

Call Site