Need help with Windows 7 BSOD on Lenovo T500

[dlcrow]

My system is crashing several times a day and I need your help in figuring out why.

I have the Windows 7 RTM build installed on a Lenovo T500. The only hardware I've customized is replacing the 160 GB drive with a 320 GB drive.

The system specs are

Lenovo T500
Core 2 Duo T9600 @ 2.8 Ghz
4 GB RAM
2 GB Turbomeory
ATI Mobile Radeon 3650
Intel Wifi 5300 agn
Integrated camera, bluetooth, and WWAN

I am running the latest BIOS: 3.01-1.03.

The laptop came with Vista 32-bit, but I immediately installed Vista Ultimate 64-bit on the 320 GB drive. I had occasonal BSOD's in Vista, mostly while running on battery, and not often enough to be completely annoying (once a week or so).

Since I've installed Windows 7 Ultimate 64-bit, the BSODs are pretty regular (several times a day).

With the exception of two drivers, the only ones I've installed are from Windows 7 or Windows Update. The two I installed were from the Lenovo Windows 7 beta drivers web site to resovle the "unknonw driver" indication in the Devices control panel for a device labeled "PCI Simple Communications Controller" and another similarly named (sorry I didn't write down the exact name).

Below is the WinDBG "analyze" output from the full memory dump. All the dumps look exactly the same: "BugCheck D1, {22, 2, 8, 22}" and the stack trace is the same.

At this point, I don't know what my next steps should be to determine what the issues are. Unfortunately, if I don't figure something out, I'm going to have to go back to Vista or XP, but I don't really want to. My co-workers are losing patience watching reboots in meetings :-(. I'm a software developer for my day job, but not at this low of a level in the software stck. If necessary, I figure I could likely setup a remote kernel debugger, but I thought the memory dump was supposed to have enough to diagnose.

Thoughts, suggestions?

Microsoft (R) Windows Debugger Version 6.11.0001.404 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [L:\200908161904-MEMORY.DMP]
Kernel Summary Dump File: Only kernel address space is available

Symbol search path is: L:\Symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16385.amd64fre.win7_rtm.090713-1255
Machine Name:
Kernel base = 0xfffff800`02a0a000 PsLoadedModuleList = 0xfffff800`02c47e50
Debug session time: Sun Aug 16 19:02:43.499 2009 (GMT-5)
System Uptime: 0 days 9:17:20.760
Loading Kernel Symbols
...............................................................
................................................................
.................................................
Loading User Symbols

Loading unloaded module list
........................
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck D1, {22, 2, 8, 22}

Probably caused by : ntkrnlmp.exe ( nt!KiPageFault+260 )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 0000000000000022, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000008, value 0 = read operation, 1 = write operation
Arg4: 0000000000000022, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS:  0000000000000022 

CURRENT_IRQL:  2

FAULTING_IP: 
+0
00000000`00000022 ??              ???

PROCESS_NAME:  System

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0xD1

TRAP_FRAME:  fffff88002f1bb10 -- (.trap 0xfffff88002f1bb10)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000050 rbx=0000000000000000 rcx=fffffa8000000001
rdx=fffffa8000000000 rsi=0000000000000000 rdi=0000000000000000
rip=0000000000000022 rsp=fffff88002f1bca0 rbp=0000000000000000
 r8=0000000000000000  r9=0000000000000000 r10=0000000000000000
r11=fffff88002f1b9e0 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up di pl zr na po nc
00000000`00000022 ??              ???
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80002a7b469 to fffff80002a7bf00

FAILED_INSTRUCTION_ADDRESS: 
+0
00000000`00000022 ??              ???

STACK_TEXT:  
fffff880`02f1b9c8 fffff800`02a7b469 : 00000000`0000000a 00000000`00000022 00000000`00000002 00000000`00000008 : nt!KeBugCheckEx
fffff880`02f1b9d0 fffff800`02a7a0e0 : 00000015`b91da5c9 fffffa80`00000002 00000015`b91da5c9 00000abc`b91d9b22 : nt!KiBugCheckDispatch+0x69
fffff880`02f1bb10 00000000`00000022 : 00000000`00000000 00000000`00000000 fffffa80`07684ae0 00000000`00000000 : nt!KiPageFault+0x260
fffff880`02f1bca0 00000000`00000000 : 00000000`00000000 fffffa80`07684ae0 00000000`00000000 fffffa80`07684cf8 : 0x22


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!KiPageFault+260
fffff800`02a7a0e0 440f20c0        mov     rax,cr8

SYMBOL_STACK_INDEX:  2

SYMBOL_NAME:  nt!KiPageFault+260

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  4a5bc600

FAILURE_BUCKET_ID:  X64_0xD1_CODE_AV_BAD_IP_nt!KiPageFault+260

BUCKET_ID:  X64_0xD1_CODE_AV_BAD_IP_nt!KiPageFault+260

Followup: MachineOwner
---------

 

[zigzag3143]

dlcrrow

Hi we have some ppl who are excellant at BSOD dump files and Im sure they could tell more if you zipped the dump and upload it to us. I know your running 6 bit and the faulting module is ntkrnlmp.exe, but wihout the dump I/we cant tell much. Also do you have your page file off or set small?

Im going to Pm someone with this thread in the mean time

Ken

 

[TGSoldier]

Make a memtest bootable CD and scan your memory for errors...

 

[dlcrow]

I ran the tests from memtest86+ v2.11 and all passed.

When you boot memtest86 v3.5, you get three choices: 1) single CPU, 2) multi CPU, and 3) old version (3.4). Using the single CPU choice, it always fails at 41% of Test 1 (test 0 passes). The title for Test 1 is "Address test, own address". If I skip test 1, the rest of the tests pass. All tests pass running the multi CPU choice and all tests pass running the v3.4 choice.

By "fail", I mean that system reboots. The memtest application does not capture the failure and provide any feedback.

"Single CPU Test #1" does pass on my Dell desktop.

I also ran through all of the tests including the memory tests in the Lenovo-provided PC Doctor for DOS v2.0.1769 (the latest on the Lenovo web site) and there were no failures.

I did re-seat the memory, but I have not tried removing either of the sticks or replacing it with other memory.

 

[usasma]

Please zip up the contents of C:\Windows\Mindump and upload the .zip file with your next post.

 

[dlcrow]

Please zip up the contents of C:\Windows\Mindump and upload the .zip file with your next post.

Attached.

 

[usasma]

A quick look at the dump files suggests that netw5v64.sys is likely to be the culprit.
This belongs to your Intel WiFi Link 5300 AGN adapter.

Please download new drivers from the Intel website,
then uninstall the current drivers from Control Panel...Programs...Uninstall a program,
then install the freshly downloaded drivers,
then test to see if this has fixed it.

The dump file summary is remarkably free of any evidence, it does point to this driver as being from May 31, 2007: ibmpmdrv.sys
This belongs to the IBM ThinkPad Power Management driver.
I'd advise updating it also.


After updating these 2 drivers, please test the system to see if there are any more BSOD's. If so, upload the dump files and we'll see where we can go from there.

 

[dlcrow]

Intel doesn't have Windows 7 specific versions of their drivers that I could find. I assume the Vista 64-bit drivers are OK?

I've upgraded from 12.4.1.4 from Microsoft to 12.4.3.9 from Intel.

Rather than change two things at once, I'll go with this change for a while and see what that does. If there is still failure, then I'll update the IBM PM driver.

Thanks!

 

[usasma]

Sounds like a plan to me. Please let us know what happens!

 

[dlcrow]

I updated the wireless driver from Intel and had a crash 3-4 hours later. I then installed the Lenovo Power Management software. It did not replace ibmpmdrv.sys, but since I installed that package, no BSODs!

Thanks for your assistance!

 

[usasma]

The presence of older drivers on a system doesn't mean that that driver is causing the problem. It's only an indication that the driver is old - which also means (IMO) that the package that was installed with it was old also.

In this instance, I suspect that an issue with the power management software was probably affecting your network card and causing the BSOD's. The updating of the power management software probably fixed this issue without updating the particular driver that was mentioned (it updated some other file that wasn't listed in the memory dump).

A memory dump is a "snapshot" of the system's state at a particular point in time.

For example: If your power management software placed information in an improper location in memory (that belongs to the networking software) and then exited - there'd be no evidence of this instruction in the stack text. Then later, when the network card went to look at that address, it'd crash because the data it expected to find wasn't there (was corrupted).

 

[dlcrow]

I'm back with the same problem: while using wireless networking while on battery, I can guarantee a BSOD within 15 minutes. Plugged in using wireless or wired network, I can last all day without a BSOD.

I'm running the latest official Windows 7 software from Lenovo now which includes

IBMPMDRV.SYS 1.55.0.0 8/24/2009
NETw5v64.sys 12.4.3.9 5/28/2009

I have tried the 13.0.0.107 version of the network driver from Intel, but nothing changed. I've also uninstalled and re-installed the Power Management Driver and Power Manager.

I've attached the dump from c:\windows\minidump.

What are my choices at this point? Contact Lenovo and hope for a newer power management driver?

 

[usasma]

This memory dump blames Windows files.


I'd first suggest updating these older drivers:

MarvinBus64.sys Fri Sep 23 17:17:03 2005
mdmxsdk.sys  Mon Jun 19 17:27:26 2006
Tppwr64v.sys Wed Oct 18 04:40:21 2006
pnetmdm64.sys Wed Mar 07 13:13:19 2007
VMNET.SYS    Thu May 22 06:33:54 2008
vmnetbridge.sys Thu May 22 06:34:05 2008
psadd.sys    Thu Aug 14 04:55:22 2008
smiifx64.sys Mon May 12 05:01:13 2008
e1y60x64.sys Fri Aug 22 18:09:50 2008
vstor2-ws60.sys Mon Dec 01 14:26:32 2008

 

[dlcrow]

I re-installed from scratch with all the latest Lenovo drivers and haven't had a crash since - knock on wood.

My initial install was Win RTM, but with beta Lenovo drivers. I think that installing the latest drivers must not have fully updated things. All the older files in %windir%\system32\drivers are now gone replaced with newer ones.

 

[dlcrow]

Apparently, I did not knock on wood hard enough. I've been crashing again this week. Most of the crashes have a "BugCheck D1, {22, 2, 8, 22}" signature, but I got a different looking one last night.

Attached is a zip file with two minidumps.

 

[usasma]

I would suggest running Driver Verifier on all 3rd party drivers. To do this, please stop any running instances of Driver Verifier. To do this go to an elevated (Run as administrator) Command Prompt and type in "verifier /reset" (without the quotes) and press Enter - then reboot the system.

Then follow these directions to run Driver Verifier:

Using Driver Verifier is an iffy proposition. Most times it'll crash and it'll tell you what the driver is. But sometimes it'll crash and won't tell you the driver. Other times it'll crash before you can log in to Windows. If you can't get to Safe Mode, then you'll have to resort to offline editing of the registry to disable Driver Verifier.

So, I'd suggest that you first backup your stuff and then make sure you've got access to another computer so you can contact us if problems arise. Then make a System Restore point (so you can restore the system using the Vista/Win7 Startup Repair feature).

Then, here's the procedure:
- Go to Start and type in "verifier" (without the quotes) and press Enter
- Select "Create custom settings (for code developers)" and click "Next"
- Select "Select individual settings from a full list" and click "Next"
- Select everything EXCEPT FOR "Low Resource Simulation" and click "Next"
- Select "Select driver names from a list" and click "Next"
Then select all drivers NOT provided by Microsoft and click "Next"
- Select "Finish" on the next page.

Reboot the system and wait for it to crash to the Blue Screen. Continue to use your system normally, and if you know what causes the crash, do that repeatedly. The objective here is to get the system to crash because Driver Verifier is stressing the drivers out. If it doesn't crash for you, then let it run for at least 36 hours of continuous operation (an estimate on my part).

Reboot into Windows (after the crash) and turn off Driver Verifier by going back in and selecting "Delete existing settings" on the first page, then locate and zip up the memory dump file and upload it with your next post.

If you can't get into Windows because it crashes too soon, try it in Safe Mode.
If you can't get into Safe Mode, try using System Restore from your installation DVD to set the system back to the previous restore point that you created.
If that doesn't work, post back and we'll have to see about fixing the registry entry off-line.

More info on this at this link: Using Driver Verifier to identify issues with Windows drivers for advanced users