How do I trace 'Processes' during entry of S4(hibernation)? RRS feed

  • Question

  • Hi! I'm an engineer developing NVMe. My main job is verifying reliability of our NVMe device during variant of power cylcling on Windows 8.1.

    In these days, I'm having trouble to analyze our device's failure that has occurred during entry of S4, which is hibernation.

    As you guys already know, Windows 8.1 has a kind of bug that is when the Pc system gets into S4, the Win 8.1 does not change D state of NVMe device(this is related to PCIe 3.1 Specification). Instead of that, the OS makes an IO queue pair on NVMe and issues few Write commands, and then Flush command(NVMe commands).

    On my S4 test 1000 power cycles are done, and with approximately 30% this test fails. To analyze this failure, I used Protocol Analyzer, and I found that the OS never sends the Flush command. Finally, the whole PC system stops doing nothing, but showing black screen. 

    At this point, I would like to know what the OS does during entry of S4 and what process makes sending the Flush command. In my opinion, this is impossible since this is powering off procedure.

    If anyone has good idea to trace or record all 'Processes' when powering off, please let me know.

    Thank you all.

    Thursday, March 19, 2015 3:10 AM


  • The best tool for this job would be to use Windows Performance Analyzer (WPA) on data collected using either XPERF or Windows Performance Recorder (WPR). XPERF gives you a lot more control over what is collected than WPR, but WPR is easier to use. If you don't know much about Windows internals, then this will be a chore and you should start by reading the Windows Internals book or watching Windows Internals videos on Channel 9. XPERF/WPR give you access to an astounding number of performance counters and data points. There is quite a bit of documentation on these tools, but I'd recommend starting with the videos on Channel 9 (search for WPA or performance). There is also a forum for asking questions.


    Azius Developer Training Windows device driver, internals, security, & forensics training and consulting. Blog at

    Thursday, March 19, 2015 4:44 AM