Question hal.dll causing bsod

[merc476]

Hi,

I've been having the bsod happening consistently daily for the past 2 weeks or so. Today I finally had time to thoroughly make sure all my drivers, bios, disk and everything is up to date and checked for errors. I'm still getting it. When I run Bluescreen viewer, it's being caused by hal.dll. I attached a screen shot of the report. Is there any way I can get further detail to help me narrow this down? This system is my recording studio pc which has a few drives, firewire audio interface, a state raven touch and its running 3 total monitors using the onboard intel card which is up to date and i've used with no problems in the past. Any suggestions welcome!

bluescreen viewer report

 

[PC Tailor]

I tend to recommend avoiding using third party software for debugging, they more just display information, rather than actually debug the dump file, and often blame the wrong thing. Bluescreen is better, but still only really a translator. A full debug is the best way to approach it.

The example here being ntoskrnl.exe or hal.dll - likelihood this isn't the cause at all, only simply what actually crashed at the time, something else caused it to crash, which is usually third party drivers or hardware.

Can you post a link to the raw minidump file?
Also what is your full system spec including PSU make and model?
Are you running any overclock or XMP at all?

 

[merc476]

Thanks so much for the quick reply. Here is the most recent from a few minutes ago. THANKS!MINIDUMP FILE

 

[Colif]

I guessed it was a WHEA error just by seeing hal mentioned. hal.dll & ntoskrnl always show up when BSV reports are shown.
Machine check exception = whea error. No idea why windows has 2 names for same error.

hal - hardware abstraction layer
ntoskrnl - windows kernel. it was what crashed but it was victim, as usual

what are specs of pc?

 

[merc476]

Here are the specs. Thanks

OS Name Microsoft Windows 10 Pro
Version 10.0.18362 Build 18362
Other OS Description Not Available
OS Manufacturer Microsoft Corporation
System Name DESKTOP-EKHCD2N
System Manufacturer Gigabyte Technology Co., Ltd.
System Model Z97X-UD3H-BK
System Type x64-based PC
System SKU To be filled by O.E.M.
Processor Intel(R) Core(TM) i7-4790K CPU @ 4.00GHz, 4000 Mhz, 4 Core(s), 4 Logical Processor(s)
BIOS Version/Date American Megatrends Inc. F8, 9/19/2015
SMBIOS Version 2.7
Embedded Controller Version 255.255
BIOS Mode Legacy
BaseBoard Manufacturer Gigabyte Technology Co., Ltd.
BaseBoard Product Z97X-UD3H-BK-CF
BaseBoard Version x.x
Platform Role Desktop
Secure Boot State Unsupported
PCR7 Configuration Binding Not Possible
Windows Directory C:\WINDOWS
System Directory C:\WINDOWS\system32
Boot Device \Device\HarddiskVolume2
Locale United States
Hardware Abstraction Layer Version = "10.0.18362.267"
User Name DESKTOP-EKHCD2N\HDD2
Time Zone Eastern Daylight Time
Installed Physical Memory (RAM) 32.0 GB
Total Physical Memory 31.8 GB
Available Physical Memory 28.6 GB
Total Virtual Memory 36.7 GB
Available Virtual Memory 33.5 GB
Page File Space 4.86 GB
Page File C:\pagefile.sys
Kernel DMA Protection Off
Virtualization-based security Not enabled
Device Encryption Support Reasons for failed automatic device encryption: TPM is not usable, PCR7 binding is not supported, Hardware Security Test Interface failed and device is not Modern Standby, Un-allowed DMA capable bus/device(s) detected, TPM is not usable
Hyper-V - VM Monitor Mode Extensions Yes
Hyper-V - Second Level Address Translation Extensions Yes
Hyper-V - Virtualization Enabled in Firmware Yes
Hyper-V - Data Execution Protection Yes

 

[merc476]

Not sure if this helps any but while in my system summary page, I clicked on "conflicts/sharing. I see the amd radeon hd 5450 there but that card is not even in use. Should I remove that card altogether from my computer? in device manager, I have it disabled. Please excuse my ignorance to all of this!

I/O Port 0x00000000-0x00000CF7 PCI Express Root Complex
I/O Port 0x00000000-0x00000CF7 Direct memory access controller

Memory Address 0xF7800000-0xF78FFFFF PCI-to-PCI Bridge
Memory Address 0xF7800000-0xF78FFFFF Intel(R) 9 Series Chipset Family PCI Express Root Port 6 - 8C9A
Memory Address 0xF7800000-0xF78FFFFF Texas Instruments 1394 OHCI Compliant Host Controller

I/O Port 0x000004D0-0x000004D1 Programmable interrupt controller
I/O Port 0x000004D0-0x000004D1 Motherboard resources

Memory Address 0xF7A00000-0xF7A01FFF Renesas USB 3.0 eXtensible Host Controller - 1.0 (Microsoft)
Memory Address 0xF7A00000-0xF7A01FFF Intel(R) 9 Series Chipset Family PCI Express Root Port 8 - 8C9E

Memory Address 0xFF000000-0xFFFFFFFF Motherboard resources
Memory Address 0xFF000000-0xFFFFFFFF Legacy device

IRQ 16 High Definition Audio Controller
IRQ 16 Standard Enhanced PCI to USB Host Controller

IRQ 17 High Definition Audio Controller
IRQ 17 Texas Instruments 1394 OHCI Compliant Host Controller

Memory Address 0xE0000000-0xEFFFFFFF PCI-to-PCI Bridge
Memory Address 0xE0000000-0xEFFFFFFF AMD Radeon HD 5450

Memory Address 0xA0000-0xBFFFF PCI Express Root Complex
Memory Address 0xA0000-0xBFFFF Intel(R) HD Graphics 4600

 

[merc476]

I've heard the term in the past for audio pc's that you can't have two things sharing the same IRQ'S. Whatever that means. I'm too much of a novice when it comes to this. I just have a guy build the pc for me and I do some minor tweaks for my DAW to run good. I'm wondering if this may be what's causing it......What do I know? i'm just frustrated trying to figure it out. Thanks for your help guys

 

[Colif]

I was waiting for PC tailor to look at dump files, until he can see what drivers are running, its hard to tell if this is a hardware or software problem. The error can be either.

there are only a few types of drivers it is normally caused by
Overclocking software can set it off. programs like MSI Afterburner, Intel Extreme tuning utility
Heat can too

what devices are attached to PC? I can see 3 screens in your description.

I am not sure about the IRQ thing with audio PC.

 

[merc476]

As far as devices, I have an
Apollo audio device that is connected via firewire,
I have a Slate Digital Raven Touchscreen monitor as well as 2 other regular monitors
2 external hard drives
2 usb dongles for my software to run
wired keyboard and wired mouse

That's about it.

 

[PC Tailor]

I have run the dump file and you can see the full report here: https://pste.eu/p/iOjO.html

Summary of Findings:

BugCheck 9C, {0, ffffd48079672c50, 0, 0}
Probably caused by : intelppm.sys ( intelppm!MWaitIdle+1f )

MACHINE_CHECK_EXCEPTION (9c)
A fatal Machine Check Exception has occurred.

Third party modules:

ModuleName	Time Stamp	Company	Description
UAD2System.sys	7/17/2019, 7:16:11 PM	Universal Audio	Universal Audio System Service
UAD2WdmAudio.sys	7/17/2019, 7:16:52 PM	Universal Audio	Universal Audio System Service
atikmpag.sys	11/4/2015, 9:16:43 PM	ATI	ATI video card driver
diginet.sys	1/30/2015, 5:09:24 AM	Avid	Avid Technolgoy Pro Tools Driver
igdkmd64.sys	10/29/2018, 8:47:00 PM	Intel	Intel Graphics Driver
TeeDriverW8x64.sys	7/18/2017, 3:15:12 PM	Intel	Intel Management Engine Interface driver
e1d68x64.sys	10/4/2018, 7:41:10 AM	Intel	Intel Ethernet Driver??
intelppm.pdb	4/1/2034, 2:57:36 PM	Intel / Microsoft	Intel Processor PDB
tbupddsu.sys	5/29/2019, 9:22:56 PM	Touch Base Ltd (Microsoft?)	Win 7 UPDD
bomebus.sys	5/16/2018, 1:56:45 PM	Bome	Bome MIDI Bus Enumerator
NIWinCDEmu.sys	9/26/2012, 12:40:33 PM	Native Instruments	Native Instruments ISO Mount Driver
bomemidi.sys	5/16/2018, 1:56:47 PM	Bome	Bome Virtual MIDI Port Driver
IntcDAud.sys	4/26/2018, 12:32:29 PM	Intel	Intel Graphics Accelerator Driver
UAFWAudio.sys	11/21/2016, 4:20:05 PM	Universal Audio	Universal Audio Apollo Service
UAD2Fw.sys	7/17/2019, 7:16:11 PM	Universal Audio	Universal Audio Driver
iLokDrvr.sys	12/12/2016, 10:33:49 PM	iLok	Windows USB iLok Driver
synusb64.sys	6/26/2009, 2:30:11 PM	Suyin	Suyin USB Webcam Driver (or Steinberg elicense)
nikksm2usb.sys	6/23/2017, 10:36:24 AM	Native Instruments	Komplete Kontrol MK2 Native Instruments USB Driver
nikksm2midi.sys	6/23/2017, 10:36:22 AM	Native Instruments	Komplete Kontrol MK2 Native Instruments MIDI Driver
UAFWAudioAudio.sys	11/21/2016, 4:20:01 PM	Universal Audio	Universal Audio Driver
atikmdag.sys	11/4/2015, 9:39:32 PM	ATI	ATI Video driver

 

[merc476]

Thank you so much for this. Me being the novice that I am, im not sure how to determine which one of these devices on the list is the culprit. Is it possible to tell from the report? Again, please excuse my ignorance 🤦🏽‍♂️

 

[PC Tailor]

Apologies my friend, I have been improving my debugging process and seemed to have mostly automated it, so it generates a slightly new style of report (doesn't give you any more info, but saves me a LOT of time in the background) - so you can see the improved process report here: https://pste.eu/p/qXCp.html

Summary of findings:

BugCheck 9C, {0, ffffd48079672c50, 0, 0}
Probably caused by : intelppm.sys ( intelppm!MWaitIdle+1f )

Bugcheck Description:
MACHINE_CHECK_EXCEPTION
"The MACHINE_CHECK_EXCEPTION bug check has a value of 0x0000009C. This bug check indicates that a fatal machine check exception has occurred.
In Windows Vista and later operating systems, this bug check occurs only in the following circumstances.

• WHEA is not fully initialized.
• All processors that rendezvous have no errors in their registers.

For other circumstances, this bug check has been replaced with bug Check 0x124: WHEA_UNCORRECTABLE_ERROR in Windows Vista and later operating systems.
For more information about Machine Check Architecture (MCA), see the Intel or AMD Web sites."

About your bugcheck:
A machine check exception is almost solely hardware based. This is actually replaced by a WHEA error in later operating systems. It is possible in rare circumstances for this to be a driver, however it is very unlikely. It is often caused by:

• Component overheating
• Unstable overclocking or XMP profile
• Faulty hardware

Some things to consider:

• You have a very out of date ATI Video Card driver - if you have an ATI card, you'll either need to update this or remove it if it is not necessary. This GPU conflict could be a big culprit.
• You have quite a few drivers I am not too experienced with such as BOME, Universal Audio, and Native Instruments, @Colif may be able to add more, but you may want to disable these using AutoRuns.

• Verify that the temperatures of your key components (CPU/GPU etc.) using HWInfo and report back.
• If you have any overclock or XMP enabled, disable it and see if the issue persists.
• Have you added or changed any hardware at all recently?
• I can see you have latest BIOS installed.
• You may want to run memtest for at least 8 passes to verify the integrity of your RAM modules.
• Depending on how these turn out, you may need to resort to testing the CPU, GPU, and PSU.

 

[Colif]

one of the Native Instruments drivers is from 2012, but then looking at their website,I can't honestly tell which of these is for you - https://www.native-instruments.com/en/support/downloads/drivers-other-files/

intel has a time machine?

intelppm.pdb

4/1/2034, 2:57:36 PM

Intel / Microsoft

Intel Processor PDB

i don't know what that is but its not a driver? think you need to add to Microsoft drivers list

@PC Tailor sometimes we get musicians that bring all sorts of strange drivers along
BOME = https://www.bome.com/products/bmidi
Universal Audio - op told you what this is: Apollo audio device that is connected via firewire,
Native instruments - seems to tie into dongles he uses

See if there is newer software for this as its had its 10th birthday -

synusb64.sys

6/26/2009, 2:30:11 PM

Suyin

Suyin USB Webcam Driver (or Steinberg elicense)

 

[PC Tailor]

one of the Native Instruments drivers is from 2012, but then looking at their website,I can't honestly tell which of these is for you - https://www.native-instruments.com/en/support/downloads/drivers-other-files/

intel has a time machine?

intelppm.pdb

4/1/2034, 2:57:36 PM

Intel / Microsoft

Intel Processor PDB

i don't know what that is but its not a driver? think you need to add to Microsoft drivers list

It's how the software works - basically when you run the debugger and it's a kernel or core service, it gives you a HEX file hash, not a timestamp. But the formatting is the same so it THINKS it's a timestamp, translates it, but it isn't.

Yes, if you look at my second (and improved report as it's now more automated) it is removed as the algorithms I use are more accurate at pulling apart info

 

[merc476]

Thanks guys for the thorough info. So i've made sure all my intel drivers were up to date which they were already according to the intel tool. Prior to that, I did a registry clean with ccleaner. After that, I did an sfc /scannow and it found some errors and for the first time was able to fix them. Before, it would find errors and say that it could not fix them. I then removed the ATI card that was installed that was not being used.

The Native Instruments drivers are for a midi keyboard. I had just updated those drivers. I just checked again and it says that i'm up to date. After all this, I just got another BSOD. Here is the new file. Not sure if it will help much. Could it be possible that a software is causing this? It's been consistently crashing on a particular project that i'm working on. I've been removing plugins from different vendors one by one to see if I can get through the project without a crash but it still happens. While working on other projects today, I did not get the crash until I started working on this particular project. Thanks again for the help guys

todays minidump

 

[PC Tailor]

I did a registry clean with ccleaner.

Just for the record, I would avoid doing this. Registry cleaners can only really cause harm. I've yet to see any of them do anything good, but I've seen them cause problems. There is nothing about a registry cleaning that is useful or helpful, and fiddling with the registry can cause more problems.

In fact I've seen people with prolonged use of Registry Cleaners cause OS corruption.

The Native Instruments drivers are for a midi keyboard.

I would disable these with autoruns temporarily as I know some MIDI devices can cause these issues. Autoruns just disables them so that you can re-enable them later.

Could it be possible that a software is causing this?

Possible? Yes.
Likely? No.

Machine Checks are WHEA bugchecks, which are almost solely hardware based. It can be caused by software, but it's much less likely. Myself and Colif initially are just trying to eliminate software before jumping to getting upgrades/warranty replacements. But probability would say we are going to end up that way.

Do the BSOD occur outside of that one project? Does that project instigate more CPU usage or anything?

I'll post the report to the dump file momentarily.

 

[PC Tailor]

I have ran the dump file and you can see the full report here: https://pste.eu/p/OL9p.html

Summary of findings:

BugCheck 9C, {0, ffffe080e72d0c50, 0, 0}
Probably caused by : ntkrnlmp.exe ( nt!KiHandleMcheck+10 )

Bugcheck Description:
MACHINE_CHECK_EXCEPTION
"The MACHINE_CHECK_EXCEPTION bug check has a value of 0x0000009C. This bug check indicates that a fatal machine check exception has occurred.
In Windows Vista and later operating systems, this bug check occurs only in the following circumstances.

• WHEA is not fully initialized.
• All processors that rendezvous have no errors in their registers.

For other circumstances, this bug check has been replaced with bug Check 0x124: WHEA_UNCORRECTABLE_ERROR in Windows Vista and later operating systems.
For more information about Machine Check Architecture (MCA), see the Intel or AMD Web sites."

About your bugcheck:
"A machine check exception is almost solely hardware based. This is actually replaced by a WHEA error in later operating systems. It is possible in rare circumstances for this to be a driver, however it is very unlikely. It is often caused by:

• Component overheating
• Unstable overclocking or XMP profile
• Faulty hardware"

Being as this is another machine check exception, it further enhances the likelihood is you've got some hardware playing up.

• You may want to run memtest for at least 8 passes to verify the integrity of your RAM modules.
• Depending on how these turn out, you may need to resort to testing the CPU, GPU, and PSU.

 

[merc476]

Thanks again. The BSOD does not just happen on that project. However, it does happen when the project is running pretty intense workload. I will most likely run a few tests again tomorrow morning and see what happens.

 

[Colif]

WIn 10 still includes Machine check exceptions as a separate error to WHEA

https://docs.microsoft.com/en-us/wi...ugger/bug-check-0x9c--machine-check-exception

In Windows Vista and later operating systems, this bug check occurs only in the following circumstances.

WHEA is not fully initialized.
All processors that rendezvous have no errors in their registers.
For other circumstances, this bug check has been replaced with bug Check 0x124: WHEA_UNCORRECTABLE_ERROR in Windows Vista and later operating systems.

top line makes it sound like it only happens at boot and yet op says it happens during operation?
not sure what "All processors that rendezvous have no errors in their registers." as that may allude to it being other hardware... that is problem with WHEA errors, that can be any hardware.

I would think if it always crashes in a particular project, what are you using hardware wise that is different on it to the other ones?

 

[merc476]

Thanks for the suggestions and info. So I uninstalled the Bome drivers and proceeded to work on the project that was constantly causing the crash within minutes and I was able to work on it with no problems. Proceeded to work on another project with no issues. I then re-opened the buggy project and without even doing anything, I got the dreaded bsod again. I feel like i'm making progress and i'm learning thanks to you guys but i'm starting to feel like tossing this damn thing out the window. No pun intended. Time for a new system anyway.

New dump file

 

[PC Tailor]

What about the answer to Colif's question:

I would think if it always crashes in a particular project, what are you using hardware wise that is different on it to the other ones?

Is there a difference? Do you use a certain MIDI for example?

I will run the dump file now

 

[PC Tailor]

I have ran the dump file and you can see the full report here:https://pste.eu/p/2PqU.html

Summary of findings:

BugCheck 9C, {0, ffffe080e72d0c50, 0, 0}
Probably caused by : ntkrnlmp.exe ( nt!KiHandleMcheck+10 )

Bugcheck Description:
MACHINE_CHECK_EXCEPTION
"The MACHINE_CHECK_EXCEPTION bug check has a value of 0x0000009C. This bug check indicates that a fatal machine check exception has occurred.
In Windows Vista and later operating systems, this bug check occurs only in the following circumstances.

• WHEA is not fully initialized.
• All processors that rendezvous have no errors in their registers.

For other circumstances, this bug check has been replaced with bug Check 0x124: WHEA_UNCORRECTABLE_ERROR in Windows Vista and later operating systems.
For more information about Machine Check Architecture (MCA), see the Intel or AMD Web sites."

About your bugcheck:
"A machine check exception is almost solely hardware based. This is actually replaced by a WHEA error in later operating systems. It is possible in rare circumstances for this to be a driver, however it is very unlikely. It is often caused by:

• Component overheating
• Unstable overclocking or XMP profile
• Faulty hardware"

I'm trying to make sure I've not accidentally debugged the same file as the same drivers have appeared, including the BOME drivers. But it is definitely the same dump file debugged that you have linked (being as I have no automated most of this it's making me paranoid the process is incorrect) but on manually checking, I can't see any issue.

It may be worth running autoruns and disabling the services/drivers in questions, sometimes not all services clear when you just uninstall the drivers.

 

[merc476]

Sorry...I put the wrong one. I'm using the same hardware for both projects. This happens on different projects. Not just that particular one. However, that particular one it's almost guaranteed that I can recreate the bsod if I work in it for a few minutes. Thanks again guys

todays dump

 

[Colif]

All processors that rendezvous have no errors in their registers. - When certain errors are detected in a multiprocessor system, a single processor takes control of the system while other processors enter a rendezvous state. The single processor performs error handling and then releases the other processors from the rendezvous state.

I don't know if that helps, I just wanted to know what it meant

@gardenman can you convert dumps and see if there is anything obvious? I wish axe wasn't so busy

 

[PC Tailor]

I have ran the dump file and you can see the full report here: https://pste.eu/p/IABi.html

Summary of findings:

BugCheck 9C, {0, ffffa00165985c50, 0, 0}
Probably caused by : intelppm.sys ( intelppm!MWaitIdle+1f )

Bugcheck Description:
MACHINE_CHECK_EXCEPTION
"The MACHINE_CHECK_EXCEPTION bug check has a value of 0x0000009C. This bug check indicates that a fatal machine check exception has occurred.
In Windows Vista and later operating systems, this bug check occurs only in the following circumstances.

• WHEA is not fully initialized.
• All processors that rendezvous have no errors in their registers.

For other circumstances, this bug check has been replaced with bug Check 0x124: WHEA_UNCORRECTABLE_ERROR in Windows Vista and later operating systems.
For more information about Machine Check Architecture (MCA), see the Intel or AMD Web sites."

About your bugcheck:
"A machine check exception is almost solely hardware based. This is actually replaced by a WHEA error in later operating systems. It is possible in rare circumstances for this to be a driver, however it is very unlikely. It is often caused by:

• Component overheating
• Unstable overclocking or XMP profile
• Faulty hardware"

Same drivers typically, the BOME ones are now gone, but the MIDI and Instrument drivers are present - I too like Colif am wondering if one of the external hardware devices are causing it. If we can eliminate those, then we pretty much know it's hardware.