Unreliable Windows 7 Suspend and Hibernate - Eventual crash or Forced Shutdown

[TPFanatic]

This is on my T500 and W500 machines, always on AC power.

Problem: Windows 7 64 bit randomly fails to suspend or hibernate. This is a random problem, sometime suspension or hibernation is successful, other times not.

Symptoms: I press Fn+F4 or Fn+F12 and the screen blackens. Wireless light may or may not turn off. Battery and AC lights remain on. Sleep button never turns on. The computer is on. If I trip the lid closure magnet by closing and opening the lid, the screen backlight turns back on but screen displays a black image. 99% of events the computer eventually crashes (one time it stayed on entire night), I am not there when it crashes, or I can identify the problem and force shutdown with the power button. On bootup Windows 7 gives the safe mode or boot normally screen, upon reaching desktop it says "System has recovered from a serious error" and says there was a Blue Screen.

Lenovo forums and other places suggest a link to USB power saving preventing the computer from suspending.
See: https://forums.lenovo.com/t5/ThinkPad-X ... rue#M62264

Unsure if related, sometimes the Fingerprint Reader fails to work after a successful resume. Does palmrest connector count as a USB port? Is that device causing problems?

Often a specific software like Dropbox is found to be preventing suspension - but I don't have Dropbox.



Under Device Manager I unchecked "Allow the computer to turn off this device to save power" for both AuthenTec Inc. AES2810 (Fingerprint Reader) and all the USB Root Hubs under Universal Serial Bus controllers.

I also just installed the latest version of Power Manager.

I will see if this behavior ceases over continued normal use, then report back.

Any feedback from the experts or anyone who has this problem, and hopefully solved it, is appreciated.

[Puppy]

Check Event Log and minidump files.

[dr_st]

Exactly. This is usually a bugcheck 0x9F - power state transition failure. You need to find the driver responsible, and the minidumps are a good place to start.

[TPFanatic]

Sucks for me, I don't know how to use the Event Viewer.

Unchecking the above features did not prevent the problem from occurring again, this time just after playing a game. I'll play with the Viewer some more, I may check logs from the W500 since the problems occur much more there.

Wonder if it's related to the Switchable Graphics driver. My dad's T500 doesn't have these problems, it has an OEM Recovery CD environment, but just Intel graphics...

Need to do more digging.

[TPFanatic]

I have myself a log from the W500, viewing it on my machine. W500 user says the machine was suspended last night, and this morning... it was not suspended. Not suspend-to-hibernate suspended, but crashed.

Does this mean anything to anyone? (screenshots album: http://imgur.com/a/E5NHL) Please point me in the directions to get useful information. I don't know how to use the Event Viewer.



Log Name: System
Source: Microsoft-Windows-Kernel-Power
Date: 5/24/2016 12:21:08 PM
Event ID: 41
Task Category: (63)
Level: Critical
Keywords: (2)
User: SYSTEM
Computer: T500-D
Description:
The system has rebooted without cleanly shutting down first. This error could be caused if the system stopped responding, crashed, or lost power unexpectedly.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-Kernel-Power" Guid="{331C3B3A-2005-44C2-AC5E-77220C37D6B4}" />
<EventID>41</EventID>
<Version>2</Version>
<Level>1</Level>
<Task>63</Task>
<Opcode>0</Opcode>
<Keywords>0x8000000000000002</Keywords>
<TimeCreated SystemTime="2016-05-24T16:21:08.234417100Z" />
<EventRecordID>61492</EventRecordID>
<Correlation />
<Execution ProcessID="4" ThreadID="8" />
<Channel>System</Channel>
<Computer>T500-D</Computer>
<Security UserID="S-1-5-18" />
</System>
<EventData>
<Data Name="BugcheckCode">159</Data>
<Data Name="BugcheckParameter1">0x3</Data>
<Data Name="BugcheckParameter2">0xfffffa8004c51060</Data>
<Data Name="BugcheckParameter3">0xfffff80004895748</Data>
<Data Name="BugcheckParameter4">0xfffffa8008fcf010</Data>
<Data Name="SleepInProgress">true</Data>
<Data Name="PowerButtonTimestamp">0</Data>
</EventData>
</Event>

[dr_st]

See if you can find the relevant dump files inside the Minidump directory under the Windows directory. You can upload them to OSR Online for analysis. This may point out the actual driver at fault here.

Generally, I've seen network device drivers cause this behavior more frequently than other devices; that includes wired and wireless.

[Puppy]

0x9F bugcheck is not easy to diagnose. Minidump typically points to ACPI.SYS which is still too generic. You have to enable full memory dump (MEMORY.DMP file) and wait for the next BSOD occurence. Then you have to use Microsoft Kernel Debugger from Windows SDK (you can get it for free from Microsoft) to display the blocked IRP. See my post https://forums.lenovo.com/t5/ThinkPad-T ... rue#M31556

If you are not able to do that yourself you can ask someone else to diagnose it sending him/her the files but there is a privacy risk. The MEMORY.DMP file is a "raw" memory portion dump that may contain sensitive data including plain text form passwords etc.

[TPFanatic]

Had a new type of crash probably unrelated to the subject, but BSOD crash when watching a youtube video - I uploaded that dump to osronline and it points to netw5s64.sys, which is Intel Wireless.

Related to the subject: It makes sense that the wireless is preventing the computer from hibernating/suspending, when successful the wireless indicator light turns off, but when unsuccessful it stays on.

Gonna try and upload more dumps, specifically one from the actual subject problem - you've been very helpful, thanks dr_st and Puppy

Interesting, good information. I'll try getting an OEM wireless driver first, and keep observing....

edit: Went and installed the latest Intel 5300 AGN driver package as supplied by Lenovo for the T500. Now I know that "Proset/whatever software" refers to installing the drivers, I can pick up the one supplied by Intel as well. I had 2009 drivers, now I have dated 2011 drivers. I'll keep observing.



edit: Went and gabbed a dump from the W500. osronline says:

DRIVER_POWER_STATE_FAILURE (9f)
A driver has failed to complete a power IRP within a specific time (usually 10 minutes).
Arguments:
Arg1: 0000000000000003, A device object has been blocking an Irp for too long a time
Arg2: fffffa8004c51060, Physical Device Object of the stack
Arg3: fffff80004895748, nt!TRIAGE_9F_POWER on Win7, otherwise the Functional Device Object of the stack
Arg4: fffffa8008fcf010, The blocked IRP

Debugging Details:
------------------

TRIAGER: Could not open triage file : e:\dump_analysis\program\triage\modclass.ini, error 2

DRVPOWERSTATE_SUBCODE: 3

IMAGE_NAME: pci.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 4ce7928f

MODULE_NAME: pci

FAULTING_MODULE: fffff88000e6a000 pci

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: WIN7_DRIVER_FAULT

BUGCHECK_STR: 0x9F

PROCESS_NAME: svchost.exe

CURRENT_IRQL: 2

STACK_TEXT:
fffff800`048956f8 fffff800`03330930 : 00000000`0000009f 00000000`00000003 fffffa80`04c51060 fffff800`04895748 : nt!KeBugCheckEx
fffff800`04895700 fffff800`032cc16c : fffff800`04895830 fffff800`04895830 00000000`00000000 00000000`00000001 : nt! ?? ::FNODOBFM::`string'+0x32450
fffff800`048957a0 fffff800`032cc006 : fffff800`03476fe0 00000000`01813046 00000000`00000000 00000000`00000000 : nt!KiProcessTimerDpcTable+0x6c
fffff800`04895810 fffff800`032cbeee : 00000394`e5cae5b9 fffff800`04895e88 00000000`01813046 fffff800`03443b48 : nt!KiProcessExpiredTimerList+0xc6
fffff800`04895e60 fffff800`032cbcd7 : fffff800`03440ec1 00000000`01813046 fffff880`00e33f00 00000000`00000046 : nt!KiTimerExpiration+0x1be
fffff800`04895f00 fffff800`032c47d5 : 00000000`00000000 fffffa80`04d7e060 00000000`00000000 fffff880`00e11408 : nt!KiRetireDpcList+0x277
fffff800`04895fb0 fffff800`032c45ec : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KyRetireDpcList+0x5
fffff880`047789e0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiDispatchInterruptContinue


STACK_COMMAND: kb

FOLLOWUP_NAME: MachineOwner

FAILURE_BUCKET_ID: X64_0x9F_3_NETw5s64_IMAGE_pci.sys

BUCKET_ID: X64_0x9F_3_NETw5s64_IMAGE_pci.sys

Followup: MachineOwner



It mentions NETw5s64. I'd think that's the culprit to a number of my problems now?

[Puppy]

Arg4: fffffa8008fcf010, The blocked IRP

This is exactly what I was writing about in my last post. You need the MEMORY.DMP file for further diagnostics.

PROCESS_NAME: svchost.exe

This is actually interesting. Since you have Windows 7, do you have Lenovo Access Connections installed ? You probably don't need it so I would try to uninstall it and reboot. The same with Lenovo Power Manager.

[TPFanatic]

I have the Power Manager, although I quite like it....

Both my machine and the W are using the latest Intel wireless drivers and we have not encountered problems yet. Right now I'll keep observing and seeing if that solved the problem.

I'll try and get the MEMORY.DMP

[TPFanatic]

Just want to report that since installing the latest Wireless drivers none of my computers have been having unreliable suspend or hibernation issues, so I found my culprit! Odd that some computers were more unreliable than others, the only possible connection being some used memory and GFX more than others were more likely to fail - but it's solved now.

Thanks for your help guys!

[dr_st]

Just want to report that since installing the latest Wireless drivers none of my computers have been having unreliable suspend or hibernation issues, so I found my culprit

Sounds about right. I had the same experience with my T410. Hope your issues has gone away for good.