Standby / Hibernations leads to BSOD

[ESEF]

Hey there,

Standby causes some trouble on my just new installed Windows 7 x64 OS.

Whenever I try to wake up from standby my Lenovo X200t crashes after a few seconds and a BSOD is displayed.

I ran windbg.exe and it points to some problem w/ csrss.exe

Here's the complete debugging file. PW is problema.

http://rapidshare.com/files/397506014/debugger.zip.html

MD5: 726CA934F5536A23368802F436025206

I hope someone can help me out. I just installed Windos using the latest driver. And a laptop w/o Standby is pretty much useless...

thnaks in advance,

ESEF

[Tripredacus]

What is the STOP error you are getting?

[ESEF]

Thanks for the quick reply,

I'm getting a 0x000000F4 Stop error.

Edited June 10, 2010 by ESEF

[cluberti]

No, what you uploaded was the output of !analyze -v basically, along with module information. Also, it's a minidump, so there's no way we're going to be able to tell you anything more than yes, csrss.exe crashed due to a page fault, causing the F4 bugcheck.

At this point, if it's something that keeps happening, you might want to consider getting a full memory dump instead of a minidump. Once you get the next crash (and full memory.dmp), upload the actual .dmp file (zipped) next time somewhere we can get to it, and there's likely to be good data in there we can then pick out.

[ESEF]

Just hold on a sec and I'll get you the full dump file ;-)

[ESEF]

PW is win

http://rapidshare.com/files/397544650/MEMORY.zip.html

MD5: 381E8221D2428A8EAA2B15865E269626

Btw... this was the dmp I got around 2 hrs ago. There have been some more bsods (the same actually) but this time I got an error inside the bsod stating that it failed to create the dmp file.

In Windows (when I chose full dmp over minidump) it said that it might not be able to create a full dmp because there was only 200MB of paging file left. What's going on? Dunno if that's a complete different problem or if it realls is a problem actually or related to the one I have...)

Edited June 10, 2010 by ESEF

[cluberti]

Complete dump requires the max number for paging file size to be at least RAM+~48MB, and stored on the Windows volume. If you don't have enough paging file set it will complain to you like this. This is the main reason I recommend in my guides to set min and max to RAM+64MB at least, for this particular reason.

[ESEF]

Okay, I did increase the paging file.

But what can u say about the dump file?

Strange enough standby did just work... for the first time.

[cluberti]

So this is definitely not a complete dump, it's just a kernel summary (kernel only) dump. The problem with that is, there's a user-mode component to this dump that I cannot see because none of that memory was captured. However, I can tell you that the crash is likely being caused by a 32bit app running in user-mode, and it appears to be something that is loading right after logon (and potentially from the Intel video driver).

// Here's the error - it was an unhandled exception writing
// to a user-mode memory address, and likely in a 32bit app:
0: kd> .exr  0xfffff880`05fb9b38 
ExceptionAddress: 0000000077c359ad
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000001
   Parameter[1]: 00000000022a0a88
Attempt to write to address 00000000022a0a88

// Looking quickly at the trap frame, all of the registers
// have 32bit values - another indication it's a 32bit app:
0: kd> .trap  0xfffff880`05fb9be0 
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=00000000022a1660
rdx=00000000022a1170 rsi=0000000000000000 rdi=0000000000000000
rip=0000000077c359ad rsp=00000000022a0a90 rbp=00000000022a1170
 r8=0000000000000000  r9=0000000000000000 r10=0000000077d55010
r11=000007fefdbbc000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl zr na po nc
0033:00000000`77c359ad ??              ???

// There's a thread pending an LPC call in csrss:
0: kd> !thread fffffa80098f8b60
THREAD fffffa80098f8b60  Cid 0220.03e4  Teb: 000007fffffdc000 Win32Thread: fffff900c069cc30 WAIT: (WrLpcReply) UserMode Non-Alertable
    fffffa80098f8f20  Semaphore Limit 0x1
Waiting for reply to ALPC Message fffff8a00289cd00 : queued at port fffffa80098d93c0 : owned by process fffffa8008b32060
Not impersonating
DeviceMap                 fffff8a000008c10
Owning Process            fffffa80080ac1d0       Image:         csrss.exe
Attached Process          N/A            Image:         N/A
Wait Start TickCount      48502          Ticks: 1 (0:00:00:00.015)
Context Switch Count      268                 LargeStack
UserTime                  00:00:00.000
KernelTime                00:00:00.000
Win32 Start Address 0x000007fefdba3d44
Stack Init fffff880025c3d70 Current fffff880025c3650
Base fffff880025c4000 Limit fffff880025be000 Call 0
Priority 15 BasePriority 15 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5
 # Child-SP          RetAddr           Call Site
00 fffff880`025c3690 fffff800`02acd752 nt!KiSwapContext+0x7a
01 fffff880`025c37d0 fffff800`02acf8af nt!KiCommitThreadWait+0x1d2
02 fffff880`025c3860 fffff800`02ae4bef nt!KeWaitForSingleObject+0x19f
03 fffff880`025c3900 fffff800`02dcda36 nt!AlpcpSignalAndWait+0x8f
04 fffff880`025c39b0 fffff800`02dcb9c0 nt!AlpcpReceiveSynchronousReply+0x46
05 fffff880`025c3a10 fffff800`02dda36d nt!AlpcpProcessSynchronousRequest+0x33d
06 fffff880`025c3b30 fffff800`02dda446 nt!LpcpRequestWaitReplyPort+0x9c
07 fffff880`025c3b90 fffff800`02ac5853 nt!NtRequestWaitReplyPort+0x76
08 fffff880`025c3be0 00000000`77c700da nt!KiSystemServiceCopyEnd+0x13
09 00000000`0146fb88 00000000`00000000 0x77c700da

// It goes to lsm.exe:
0: kd> !thread  fffffa80098d0060 
THREAD fffffa80098d0060  Cid 0260.0378  Teb: 000007fffffda000 Win32Thread: 0000000000000000 WAIT: (WrLpcReceive) UserMode Non-Alertable
    fffffa80098d0420  Semaphore Limit 0x1
Not impersonating
DeviceMap                 fffff8a000008c10
Owning Process            fffffa8008b32060       Image:         lsm.exe
Attached Process          N/A            Image:         N/A
Wait Start TickCount      48502          Ticks: 1 (0:00:00:00.015)
Context Switch Count      31             
UserTime                  00:00:00.000
KernelTime                00:00:00.000
Win32 Start Address 0x0000000077c38f00
Stack Init fffff8800307ad70 Current fffff8800307a750
Base fffff8800307b000 Limit fffff88003075000 Call 0
Priority 9 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5
 # Child-SP          RetAddr           Call Site
00 fffff880`0307a790 fffff800`02acd752 nt!KiSwapContext+0x7a
01 fffff880`0307a8d0 fffff800`02acf8af nt!KiCommitThreadWait+0x1d2
02 fffff880`0307a960 fffff800`02dc6329 nt!KeWaitForSingleObject+0x19f
03 fffff880`0307aa00 fffff800`02dd8c78 nt!AlpcpReceiveMessagePort+0x189
04 fffff880`0307aa60 fffff800`02dd9037 nt!AlpcpReceiveLegacyMessage+0x127
05 fffff880`0307ab00 fffff800`02dd90af nt!NtReplyWaitReceivePortEx+0x106
06 fffff880`0307aba0 fffff800`02ac5853 nt!NtReplyWaitReceivePort+0xf
07 fffff880`0307abe0 00000000`77c6ff6a nt!KiSystemServiceCopyEnd+0x13
08 00000000`0096f628 00000000`00000000 0x77c6ff6a

// After walking the call through wininit.exe, svchost.exe, and
// services.exe, we end up here, in explorer.exe, where this likely
// started to fail:
0: kd> !thread fffffa8006d27b60
THREAD fffffa8006d27b60  Cid 02a0.0548  Teb: 000007fffff92000 Win32Thread: 0000000000000000 RUNNING on processor 1
Not impersonating
DeviceMap                 fffff8a001b689a0
Owning Process            fffffa8009d64660       Image:         explorer.exe
Attached Process          N/A            Image:         N/A
Wait Start TickCount      48503          Ticks: 0
Context Switch Count      1             
UserTime                  00:00:00.000
KernelTime                00:00:00.000
Win32 Start Address 0x000007fefe6fc7d4
Stack Init fffff8800911dd70 Current fffff8800911da60
Base fffff8800911e000 Limit fffff88009118000 Call 0
Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5
 # Child-SP          RetAddr           Call Site
00 fffff880`0911d3f0 fffff800`02aa541e nt!KeContextToKframes+0x11
01 fffff880`0911d4d0 fffff800`02aa517c nt!KiContinuePreviousModeUser+0xd6
02 fffff880`0911da30 fffff800`02ac80c7 nt!KiContinueEx+0xbc
03 fffff880`0911daa0 fffff800`02ac5853 nt!NtContinue+0x87
04 fffff880`0911dbe0 00000000`77c702ea nt!KiSystemServiceCopyEnd+0x13
05 00000000`0930f728 00000000`00000000 0x77c702ea

I know that the KiContinuePreviousModeUser is copying the context record to the stack for a switch to kernel-mode, but I can't see the user-mode portion of the stack to see if there was some sort of fail here. Given that igfxext.exe has just loaded right before the failure, and it has explorer shell extensions (and a kernel-mode video driver that it can interface with via processes like ScreenRotation.exe), I'm wondering if this is a problem with the (very new) Intel graphics driver and supporting software you have loaded?

I've actually had issues with the ATI Radeon driver since 10.x doing similar things if the user-mode explorer app was installed as well, so I wouldn't be surprised if the Intel explorer shell app wasn't part of (or the root cause of) the problem.

[ESEF]

Okay thanks for that info!

So you need a complete dump? Well the problem is, that my computer just doesn't feel like creating one anymore ;-)

I increased pagefile to 5GB like you said and deleted the old memory.dmp.

Now, when the BSOD appears, it says

collecting data for memory dump..

initializing hard drive for memory dump..

and then nothing happens (before that some numbers where rushing by on the screen...)

What can I do to get the dmp again?

As for the Intel Graphics (4500MHD). I did deinstall that driver and reinstalled the Intel driver on the Lenovo website (which seems to be an older version...just by a couple of months). No change... same BSOD.

As for screen rotation. I do have Active Protection system installed (it's a Lenovo program for Hard Disk protection). Since I have a SSD I don't need this program but actually for auto screen rotate I do...)

/EDIT

Okay I solved the problem with the dump file. And now it's there. 4GB Gotta ask... there're no personal information in that file? I've always been concerned about privacy.

Anyway... it's creating the zip and uploading it will take approx an hour or so.

Gee I feel like a detective investigating a crime scene and putting together all this littly pieces of clues... of course with the help of the FBI so to say

Edited June 10, 2010 by ESEF

[cluberti]

Well, anything that is stored in memory is in a memory dump. Personal? I dunno, hard to say. I'm not about to go poking through 4GB of binary text to find something though .

[ESEF]

Okay, that took a while. Eventually I had to go to sleep... but here it is:

memory dump part 1: http://rapidshare.com/files/397645329/MEMORY.zip.001.html

memory dump part 2: http://rapidshare.com/files/397721559/MEMORY.zip.002.html

Thanks again for your help Wouldn't know what else to do...

Edited June 11, 2010 by ESEF

[cluberti]

Rapidshare won't let me get at part 1, and I'm not paying $7 to download a file. Mind uploading it to my FTP? I've PMed you the details.

[cluberti]

What tool was used to split these files? I cannot get them to recombine to extract it.

[ESEF]

I used 7zip... I tried to recombine the files and on my computer using right click on 001 "extract to" it works w/ 7zip

Edited June 12, 2010 by ESEF