Question Can a guest VM crash the Windows 10 host?

[paolone67]

Hi,
I have a Windows 10 PC with 1903 build on it. The PC acts as Hyper-v host running some VMs. I'm experiencing frequent annoying BSODs on the host OS. Can a malfunctioning driver on a guest VM crash the hosting machine?

 

[Math Geek]

absolutely it can. a VM is not only software but it takes some of the hardware resources for itself as well. a chunk of ram, some cpu cores, hard drive space and so on. normally you can crash a VM without effecting the host machine but in extreme cases it can crash the host as well

in my experience, leaving too little resources for the host is the cause for many crashes. look at event viewer and and the reliability monitor to see what they say caused the crash. that's a good place to start as it may not even be the VM but a coincidence

 

[paolone67]

absolutely it can. a VM is not only software but it takes some of the hardware resources for itself as well. a chunk of ram, some cpu cores, hard drive space and so on. normally you can crash a VM without effecting the host machine but in extreme cases it can crash the host as well

in my experience, leaving too little resources for the host is the cause for many crashes. look at event viewer and and the reliability monitor to see what they say caused the crash. that's a good place to start as it may not even be the VM but a coincidence

Hi and thank you for your answer.

Regarding the crashes, my resouces did not change in the recent past. I started having frequent (2 or more per day) BSODs after the upgrade from 1803 to 1809 and thery are still there now that I'm on 1903. Dump files tell me the BSODs are all caused by ntoskrnl.exe, hal.dll or both.

I checked HW on my host machine (RAM and disks and they appear to be OK) and I checked all the divers I could think of. Unfortunately the crash events continue to happen. The only relevant process that is always running is Hyper-v with a couple of VMs (both on Windows 10 build 1903). That's the reason of my question.

I'm stuck: I don't know how to get rid of the BSODs. My last option is a complete reinstall of both host and guest OS. But I'm understendingly reluctant to do this.

Do you have any suggestion?

Thank you. Regards.

 

[Math Geek]

both hal and ntoskrnl are hardware issues. which is generally what would cause a crash.

check the event viewer and see if it tells you specifically what crashed. what are the specs of the host pc? and what have you allotted for each VM? something in the system is not happy running with the VM and just have to figure out what it is.

you can also try running 1 VM at a time and turning off resources one by one to see if you can isolate where the hardware issue might be. things like sound, network and other stuff is not 100% essential to the OS running and can be turned off in the VM just like on the host. same basic troubleshooting as you slowly narrow down where the issue is

 

[paolone67]

I checked carefully the Event Log and before each BSOD there are 3 to 10 minutes completely free of whatsoever event.

Consider that the PC, before the BSOD, hangs completely for about 1 minute. Well, in that minute and for some minutes before, no events are recorded in event log and all previuos events are informational (no warnings and no errors). Actually there is no clue about what is crashing my PC, even though I noticed it crashes more often when I'm working in a VM. My last attempt was to upgrade all VM to version 9.0, I'm waiting to see if it helps.

I read some tens of information articles on Google and many people say that an ntoskrnl or hal crash normally hides a driver crash (usually a low level driver that interacts directly with the system core, such as chipset driver or video adapter driver).

Do you know if there anyone on internet that can help me to analyze dump files at a reasonable price and suggest me some action to perform?

 

[Math Geek]

lots of tools for diving into dump files but many will simply point back at a kernel issue and are not that helpful.

never seen a service that will read them for a price so not sure there.

is there anything weird going on in the VM before it crashes? have you checked those event viewers to see if they recorded anything? sounds like the VM could be failing severly and then taking the host with it which may not appear in the hosts logs since it happened in the VM.