Jump to content

WindowsPE has changed in how NVMe is detected


Tripredacus

Recommended Posts

While unknown as to what version this issue started with, the problem is replicated in WinPE v10.0.17763.1 but is not replicated in v10.0.14393.0. After much testing it appears that current WinPE detects an NVMe in an m.2 socket as a different type of disk (as expected) but then gives priority to other interfaces when it comes to disk numbering. The issue has been seen on 5 different boards so far, two different chipset manufacturers and 3 different board manufacturers.

Using a fixed driver set, WinPE v10.0.14393.0, booting via USB with a board where the only disk installed is in an M.2 socket, either SATA SSD or NVME, WinPE will give the M.2 device Disk 0 and the USB key Disk 1.

Using the same driver set, and WinPE v10.0.17763.1, booting via USB with a board where the M.2 socket has a SATA SSD, the M.2 device is Disk 0 and the USB key is Disk 1. If the device in the M.2 socket is an NVMe, the M.2 Device is Disk 1 and the USB key is Disk 0.

That is the problem. I have collected information relating to how the devices are detected on v10.0.17763.1, using a NUC10i3FNK with M.2 SATA and M.2 NVMe. In each scenario the USB key is removed prior to running the diskpart or wmic commands.

Quote

---------
NUC10i3FNK with Crucial MX500 M.2 SATA SSD
---------
Microsoft DiskPart version 10.0.17763.1

Copyright (C) Microsoft Corporation.
On computer: MININT-U8KOB3F

DISKPART> list disk

  Disk ###  Status         Size     Free     Dyn  Gpt
  --------  -------------  -------  -------  ---  ---
  Disk 0    Online          232 GB      0 B        *

DISKPART> sel disk 0

Disk 0 is now the selected disk.

DISKPART> detail disk

CT250MX500SSD4
Disk ID: {A5BFEC98-EA08-4F09-9568-043A4150E9C2}
Type   : SATA
Status : Online
Path   : 1
Target : 0
LUN ID : 0
Location Path : PCIROOT(0)#PCI(1700)#ATA(C01T00L00)
Current Read-only State : No
Read-only  : No
Boot Disk  : No
Pagefile Disk  : No
Hibernation File Disk  : No
Crashdump Disk  : No
Clustered Disk  : No

  Volume ###  Ltr  Label        Fs     Type        Size     Status     Info
  ----------  ---  -----------  -----  ----------  -------  ---------  --------
  Volume 0     N   Windows      NTFS   Partition    232 GB  Healthy
  Volume 1         SYSTEM       FAT32  Partition    260 MB  Healthy    Hidden

X:\windows\system32>wmic /namespace:\\root\microsoft\windows\storage path msft_disk get Model,BusType
BusType  Model
11       CT250MX500SSD4

---------
NUC10i3FNK with Samsung 950 PRO M.2 NVMe
---------

X:\windows\system32>diskpart

Microsoft DiskPart version 10.0.17763.1

Copyright (C) Microsoft Corporation.
On computer: MININT-A7B045E

DISKPART> list disk

  Disk ###  Status         Size     Free     Dyn  Gpt
  --------  -------------  -------  -------  ---  ---
  Disk 1    Online          476 GB      0 B        *

DISKPART> sel disk 1

Disk 1 is now the selected disk.

DISKPART> detail disk

AMD-RAID Samsung SSD 950 SCSI Disk Device
Disk ID: {6D23D8C0-4EA4-4923-9E0E-8988913D7006}
Type   : RAID
Status : Online
Path   : 8
Target : 2
LUN ID : 0
Location Path : UNAVAILABLE
Current Read-only State : No
Read-only  : No
Boot Disk  : No
Pagefile Disk  : No
Hibernation File Disk  : No
Crashdump Disk  : No
Clustered Disk  : No

  Volume ###  Ltr  Label        Fs     Type        Size     Status     Info
  ----------  ---  -----------  -----  ----------  -------  ---------  --------
  Volume 0     D   Windows      NTFS   Partition    476 GB  Healthy
  Volume 1         Recovery     NTFS   Partition    500 MB  Healthy
  Volume 2         SYSTEM       FAT32  Partition    260 MB  Healthy    Hidden

DISKPART> exit

Leaving DiskPart...

X:\windows\system32>wmic /namespace:\\root\microsoft\windows\storage path msft_disk get Model,BusType
BusType  Model
8        Samsung SSD 950

The NUC10i3FNK is set to AHCI and RAID is not an option. Yet the WinPE will detect the NVMe as BusType 8 aka RAID and have no location path. There is only one M.2 socket in the system and no settings were changed in between testing the SSD vs NVMe except for obviously removing one and installing the other.

Normal WinPE is not able to run the WMIC command listed above. It requires WinPE-WMI,  WinPE-NetFX, WinPE-Scripting, WinPE-PowerShell and WinPE-StorageWMI WinPE_OCs .cab files, installing the StorageWMI last.

WinPE component reference:
https://docs.microsoft.com/en-us/windows-hardware/manufacture/desktop/winpe-add-packages--optional-components-reference

WMI MSFT\_Disk class:
https://docs.microsoft.com/en-us/previous-versions/windows/desktop/stormgmt/msft-disk

Link to comment
Share on other sites


Side note, and probably irrelevant, but unless you partiioned differently than usual on purpose, the volume order doesn't seem the normal one, it seems "reversed", usually first partition is "System", second is "Windows" and - if any - "Recovery" is last.

https://docs.microsoft.com/en-us/windows-hardware/manufacture/desktop/configure-biosmbr-based-hard-drive-partitions

jaclaz

Link to comment
Share on other sites

The partition numbers would be correct. I suspect that the OS volume is getting Vol 0 simply because it is mountable, aka it is getting a drive letter.

Another observable, although it is not immediately obvious by looking at the output I posted. In the deployment system I manage, a system with a formatted hard disk should get the letter N. This is seen in the SATA SSD M.2 output, where Windows volume is letter N, and the NVME it is letter D. In the expected scenario when booting off USB, an existing volume would get C, USB would get D. Then a script is run to change any C drive to N. This script is an old one and dates back to instances where card readers would be given drive letters even when media wasn't present. So in the NVME example, the USB drive is C, the Windows volume is D, the USB drive is changed to N, but is removed prior to running the diskpart and wmic commands. The expected is that the Windows volume is C, the USB drive is D and the script changes C to N.

In any case, it would appear the volume order is not matching partition order. It is something else I can look at when I test on the older WinPE version noted. I also will re-run this test using an onboard RAID configuration using SATA spindle disks to see if there is any way to differentiate an m.2 in "RAID mode" vs an actual RAID array. If anyone knows of any other way to connection type with WMIC, it would be helpful. As I have not tested it yet, but knowing what goes through production, I am quite certain that actual RAID arrays are not being given Disk 1 and instead of Disk 0, as RAID1 are commonplace and I would have heard about those systems not being able to deploy. And I can't go on the presumption that a BusType 11 disk appearing as Disk 1 is an NVME because a RAID array on a controller card may appear the same way, if an onboard SATA, or RAID1/0 or M.2 SSD is detected as Disk 1.

Link to comment
Share on other sites

Another test, using RAID1 with 2 SATA disks.

Quote

----------
S1200KP with 2x SATA spindle HDDs in RAID1
----------
DISKPART> list disk

  Disk ###  Status         Size     Free     Dyn  Gpt
  --------  -------------  -------  -------  ---  ---
  Disk 0    Online           70 GB    70 GB

DISKPART> sel disk 0

Disk 0 is now the selected disk.

DISKPART> detail disk

Intel Raid 1 Volume
Disk ID: 00000000
Type   : RAID
Status : Online
Path   : 6
Target : 0
LUN ID : 0
Location Path : PCIROOT(0)#PCI(1F02)#RAID(P06T00L00)
Current Read-only State : No
Read-only  : No
Boot Disk  : No
Pagefile Disk  : No
Hibernation File Disk  : No
Crashdump Disk  : No
Clustered Disk  : No

There are no volumes.

DISKPART> exit

Leaving DiskPart...

X:\windows\system32>wmic /namespace:\\root\microsoft\windows\storage path msft_disk get Model,BusType
BusType  Model
8        Raid 1 Volume

So with this, a RAID volume is detected the same as the NVMe, as being BusType 8. However it is Disk 0 and has a location path. So unfortunately, I cannot find a way to programmatically tell the difference NVMe and a RAID volume besides what seems to be checking location path. And I have a feeling that wouldn't be a valid method anyways because that field should have data in it.

Other observations: the RAID vdisk doesn't have a valid Disk ID.

Link to comment
Share on other sites

Getting somewhere, maybe.... This could have been a perfect storm, a situation where something else was changed besides the WinPE version and caused this issue to appear...

Quote

----------
S1200KP RAID1 using 14393
----------

Microsoft DiskPart version 10.0.14393.0

Copyright (C) 1999-2013 Microsoft Corporation.
On computer: MININT-UKIAVCF

DISKPART> list disk

  Disk ###  Status         Size     Free     Dyn  Gpt
  --------  -------------  -------  -------  ---  ---
  Disk 0    Online           70 GB    70 GB

DISKPART> sel disk 0

Disk 0 is now the selected disk.

DISKPART> detail disk

Intel Raid 1 Volume
Disk ID: 00000000
Type   : RAID
Status : Online
Path   : 6
Target : 0
LUN ID : 0
Location Path : PCIROOT(0)#PCI(1F02)#RAID(P06T00L00)
Current Read-only State : No
Read-only  : No
Boot Disk  : No
Pagefile Disk  : No
Hibernation File Disk  : No
Crashdump Disk  : No
Clustered Disk  : No

There are no volumes.

DISKPART> exit

Leaving DiskPart...

X:\windows\system32>wmic /namespace:\\root\microsoft\windows\storage path msft_disk get Model,BusType
BusType  Model
8        Raid 1 Volume

X:\windows\system32>

The SK1200KP with a RAID 1 and spindle disks is the same in both WinPE versions. And then these results using 14393 on a PRIME B450M-A, since the NUC would not boot on that PE version.

Quote

----------
PRIME B450M-A CSM SATA M.2
----------

Microsoft DiskPart version 10.0.14393.0

Copyright (C) 1999-2013 Microsoft Corporation.
On computer: MININT-921AELJ

DISKPART> list disk

  Disk ###  Status         Size     Free     Dyn  Gpt
  --------  -------------  -------  -------  ---  ---
  Disk 0    Online          232 GB      0 B        *

DISKPART> sel disk 0

Disk 0 is now the selected disk.

DISKPART> detail disk

CT250MX500SSD4
Disk ID: {A5BFEC98-EA08-4F09-9568-043A4150E9C2}
Type   : SATA
Status : Online
Path   : 1
Target : 0
LUN ID : 0
Location Path : PCIROOT(0)#PCI(0802)#PCI(0000)#ATA(C01T00L00)
Current Read-only State : No
Read-only  : No
Boot Disk  : No
Pagefile Disk  : No
Hibernation File Disk  : No
Crashdump Disk  : No
Clustered Disk  : No

  Volume ###  Ltr  Label        Fs     Type        Size     Status     Info
  ----------  ---  -----------  -----  ----------  -------  ---------  --------
  Volume 0     N   Windows      NTFS   Partition    232 GB  Healthy
  Volume 1         SYSTEM       FAT32  Partition    260 MB  Healthy    Hidden

DISKPART> exit

Leaving DiskPart...

X:\windows\system32>wmic /namespace:\\root\microsoft\windows\storage path msft_disk get Model,BusType
BusType  Model
11       CT250MX500SSD4

----------
PRIME B450M-A CSM NVME M.2
----------

Microsoft DiskPart version 10.0.14393.0

Copyright (C) 1999-2013 Microsoft Corporation.
On computer: MININT-OET4EJT

DISKPART> list disk

  Disk ###  Status         Size     Free     Dyn  Gpt
  --------  -------------  -------  -------  ---  ---
  Disk 1    Online          476 GB      0 B        *

DISKPART> rescan

Please wait while DiskPart scans your configuration...

DiskPart has finished scanning your configuration.

DISKPART> list disk

  Disk ###  Status         Size     Free     Dyn  Gpt
  --------  -------------  -------  -------  ---  ---
  Disk 1    Online          476 GB      0 B        *

DISKPART> sel disk 1

Disk 1 is now the selected disk.

DISKPART> detail disk

AMD-RAID Samsung SSD 950 SCSI Disk Device
Disk ID: {6D23D8C0-4EA4-4923-9E0E-8988913D7006}
Type   : RAID
Status : Online
Path   : 8
Target : 2
LUN ID : 0
Location Path : UNAVAILABLE
Current Read-only State : No
Read-only  : No
Boot Disk  : No
Pagefile Disk  : No
Hibernation File Disk  : No
Crashdump Disk  : No
Clustered Disk  : No

  Volume ###  Ltr  Label        Fs     Type        Size     Status     Info
  ----------  ---  -----------  -----  ----------  -------  ---------  --------
  Volume 0     D   Windows      NTFS   Partition    476 GB  Healthy
  Volume 1         SYSTEM       FAT32  Partition    260 MB  Healthy    Hidden
  Volume 2         Recovery     NTFS   Partition    500 MB  Healthy    Hidden

DISKPART> exit

Leaving DiskPart...

X:\windows\system32>wmic /namespace:\\root\microsoft\windows\storage path msft_disk get Model,BusType
BusType  Model
8        Samsung SSD 950

As seen here, it is the same as 17763! But certainly NVMes were definately being detected as disk 0... how could that be? Well I am testing with local PEs not production PEs. They are mostly the same, but obviously there is something different. Production PEs have always detected NVMe as Disk 0 like all other disk types, and it was only the "local" PE that would detect NVMe as Disk 1... UNTIL 17763 came out, and then either build detected an NVMe as Disk 1. Here is the NVMe on the B450M-A using the production PE v14393 where it is detected as Disk 0:

Quote

----------
PRIME B450M-A CSM with NVME M.2 using production 14393 boot image
----------

Microsoft DiskPart version 10.0.14393.0

Copyright (C) 1999-2013 Microsoft Corporation.
On computer: MININT-G38IP98

DISKPART> list disk

  Disk ###  Status         Size     Free     Dyn  Gpt
  --------  -------------  -------  -------  ---  ---
  Disk 0    Online          476 GB      0 B        *

DISKPART> sel disk 0

Disk 0 is now the selected disk.

DISKPART> detail disk

AMD-RAID Samsung SSD 950 SCSI Disk Device
Disk ID: {6D23D8C0-4EA4-4923-9E0E-8988913D7006}
Type   : RAID
Status : Online
Path   : 8
Target : 2
LUN ID : 0
Location Path : UNAVAILABLE
Current Read-only State : No
Read-only  : No
Boot Disk  : No
Pagefile Disk  : No
Hibernation File Disk  : No
Crashdump Disk  : No
Clustered Disk  : No

  Volume ###  Ltr  Label        Fs     Type        Size     Status     Info
  ----------  ---  -----------  -----  ----------  -------  ---------  --------
  Volume 0     N   Windows      NTFS   Partition    476 GB  Healthy
  Volume 1         SYSTEM       FAT32  Partition    260 MB  Healthy    Hidden
  Volume 2         Recovery     NTFS   Partition    500 MB  Healthy    Hidden

I can't put the OCs into the production PE, so I can't run the wmic command. I can do this comparison between

B450M-A with NVMe using Production 14393 (detected as disk 0)

AMD-RAID Bottom Device	Advanced Micro Devices, Inc.	rcbottom	SCSIAdapter		PCI\VEN_144D&DEV_A802&SUBSYS_A801144D&REV_01\4&2074c63f&0&000E	@System32\drivers\pci.sys,#65536;PCI bus %1, device %2, function %3;(8,0,0)	0x00000000	0x00000000	No	Yes	5/14/2020 3:28:57 AM	5/14/2020 3:28:54 AM		AMD-RAID Bottom Device	9.2.0.87	oem17.inf	rcbottom_Inst.NT	9/21/2018	5/14/2020 3:28:53 AM	
AMD-RAID Controller [storport]	Advanced Micro Devices, Inc.	rcraid	SCSIAdapter		{54cb850d-a731-8590-0628-1992592bd448}\rcbottom\5&d1e0a6&0&131071		0x00000000	0x00000000	No	Yes	5/14/2020 3:28:56 AM	5/14/2020 3:28:54 AM		AMD-RAID Controller [storport]	9.2.0.87	oem19.inf	rcraid_Inst	9/21/2018	5/14/2020 3:28:54 AM	
AMD-RAID Samsung SSD 950 SCSI Disk Device	(Standard disk drives)	disk	DiskDrive		SCSI\Disk&Ven_AMD-RAID&Prod_Samsung_SSD_950\6&10c8e623&0&080200	Bus Number 8, Target Id 2, LUN 0	0x00000060	0x00000000	No	Yes	5/14/2020 3:28:57 AM	5/14/2020 3:28:57 AM	N:\	Disk drive	10.0.14393.0	disk.inf	disk_install.NT	6/21/2006	5/14/2020 3:28:56 AM	

and same but with local PE 14393 (detected as disk 1)

AMD-RAID Bottom Device	Advanced Micro Devices, Inc.	rcbottom	SCSIAdapter		PCI\VEN_144D&DEV_A802&SUBSYS_A801144D&REV_01\4&2074c63f&0&000E	@System32\drivers\pci.sys,#65536;PCI bus %1, device %2, function %3;(8,0,0)	0x00000000	0x00000000	No	Yes	5/14/2020 3:39:23 AM	5/14/2020 3:39:22 AM		AMD-RAID Bottom Device	9.2.0.127	oem11.inf	rcbottom_Inst.NT	7/5/2019	5/14/2020 3:39:21 AM	
AMD-RAID Controller [storport]	Advanced Micro Devices, Inc.	rcraid	SCSIAdapter		{54cb850d-a731-8590-0628-1992592bd448}\rcbottom\5&d1e0a6&0&131071		0x00000000	0x00000000	No	Yes	5/14/2020 3:39:22 AM	5/14/2020 3:39:22 AM		AMD-RAID Controller [storport]	9.2.0.127	oem13.inf	rcraid_Inst	7/5/2019	5/14/2020 3:39:22 AM	
AMD-RAID Samsung SSD 950 SCSI Disk Device	(Standard disk drives)	disk	DiskDrive		SCSI\Disk&Ven_AMD-RAID&Prod_Samsung_SSD_950\6&10c8e623&0&080200	Bus Number 8, Target Id 2, LUN 0	0x00000060	0x00000000	No	Yes	5/14/2020 3:39:26 AM	5/14/2020 3:39:26 AM	D:\	Disk drive	10.0.14393.0	disk.inf	disk_install.NT	6/21/2006	5/14/2020 3:39:26 AM	

Any M.2 shows up as a RAID device on AMD boards, since it does not use the SATA controller, rather to be able to detect the disk you set NVME mode to RAID.

A comparison of just the driver info (from Nirsoft's Devmanview) shows that two different RAID driver versions are being used. I could see that as being related to this issue happening on an AMD board, but not the Intel based boards. I will have to do some tests with those AMD drivers removed and see if it makes any difference.

Link to comment
Share on other sites

I did a compare to the three main WinPEs, the 14393 prod, 14393 local and the 17763 prod to figure out which drivers were in each and which were unique. It brought me back to the AMD drivers again. It would seem logical to do that after the end of the last post, however I had to check all of the drivers specifically because I was seeing the issue on non-AMD boards. The logic would be that Windows would not load an AMD storage driver on a non-AMD storage controller, right?

I did a compare on the working and non-working driver set.

9.2.0.87 Working (all NVMe is Disk 0 on any controller) seems to be the newest, also tested 8.1.0.26 (which does not load the AMD driver onto the NVMe)
9.2.0.127 Not working (all NVMe is Disk 1 on any controller)

Looking specifically at rcbottom.inf, the meat of the three drivers in my experience... (AMD RAID drivers have 3 infs, rcbottom, rccfg and rcraid)

e9AY7lzl.jpg

Ok some difference. My first thought it to look at that yellow line that I have clicked on. It has a Hardware ID of CC_010802. I did a recheck of the device properties again using new injections and only with the v17763 of WinPE using the 8.1.0.26 vs 9.2.0.127 drivers.... but that data is similar to what is in the end of the last post. I did a search and NirSoft's DevManView does not have any record of CC_010802. This is a compat? flag. But look at that driver data, you can see rcbottom.inf is loaded on a non-AMD vendor ID. AMD is VEN_1022, what is VEN_144D? It is Samsung. So rcbottom.inf is loaded on the physical hardware device for the NVMe, and then the NVMe (as a disk that can have volumes) is loaded under disk.inf. So here is the proof that Windows will load the AMD RAID driver onto a non-AMD controller because it is loading it for the storage device and not the controller. This is why an NVME can be seen as an AMD RAID device on non-AMD boards.

Since we already know that DevManView won't show the whole slew of additional HwID or compat IDs that is actually tied to the device (from WMI), we can boot into the OS and use Device Manager. In this scenario, the PC has Windows 10 Pro but does not have the AMD drivers installed. Hence it appears as "Standard NVM Express Controller" in the Storage Controllers section.

VXcUlKOl.jpg

hMRJV0Hl.jpg

And there it is.

Link to comment
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
  • Recently Browsing   0 members

    • No registered users viewing this page.
×
×
  • Create New...