HalBugCheckSystem

This function stops the system because of an uncorrectable hardware error.

Declaration

VOID HalBugCheckSystem (PVOID ErrorRecord);

Parameters

The ErrorRecord argument is the address of a buffer that contains a WHEA_ERROR_RECORD structure followed by other data to describe the error.

Behaviour

The function processes the first WHEA_ERROR_PACKET in the descriptive data. The offset of this structure from the beginning of the buffer is given by the SectionOffset member of the first WHEA_ERROR_HEADER_SECTION_DESCRIPTOR in the WHEA_ERROR_RECORD. Microsoft does not document the WHEA_ERROR_PACKET structure, but a definition is in NTDDK.H. The handling varies with the type of error source as given by the structure’s ErrorSourceType member. The following error sources are recognised:

WheaErrSrcTypeMCE (0), for a Machine Check Exception (MCE);
WheaErrSrcTypeCMC (1), for a Corrected Machine Check (CMC);
WheaErrSrcNMI (3), for a Non-Maskable Interrupt (NMI);
WheaErrSrcTypePCIe (4), for a PCI Express Error (PCIe).

For any other type of error source, the function returns without having done anything.

NMI

When the error source is WheaErrSrcNMI (3), the function displays the following few lines of text:

*** Hardware Malfunction

Call your hardware vendor for support

description

*** The system has halted ***

in which description may be omitted but ordinarily stands for either of the following:

NMI: Channel Check / IOCHK	if the first byte of the RawData in the WHEA_ERROR_PACKET has the 0x40 bit set
NMI: Parity Check / Memory Parity Error	if the first byte of the RawData in the WHEA_ERROR_PACKET has the 0x80 bit set

If a boot video driver is installed, the function will have first put the display in text mode for a screen of bright white text on a blue background.

With the message displayed, the function either raises the bug check NMI_HARDWARE_FAILURE (0x80) or halts the system. The choice is configurable, through the following registry entry:

Key:	HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\CrashControl
Value:	NMICrashDump

This registry value is read when the HAL function HalReportResourceUsage executes during system initialisation. The data is accepted if it is exactly four bytes. If the first byte is non-zero, then this function will raise the bug check through the kernel instead of performing its own halt. The most notable effect is that the kernel may be able to write a crash dump.

To halt the system, the function simply executes an instruction that jumps to itself. If a debugger is present and enabled, the function first breaks to the debugger. Since this is done by calling KeEnterKernelDebugger, the status code on entry to the debugger has the distinctive value DBG_STATUS_FATAL (5).

Other Error Sources

For all the other recognised types of error source, the function raises the bug check WHEA_UNRECOVERABLE_ERROR (0x0124). The first two arguments are:

the ErrorSrcType;
the address of the WHEA_ERROR_RECORD.

For PCI Express errors, the third and fourth arguments are both zero. When the source is an MCE or CMC, the third and fourth arguments are respectively the high and low dwords of a 64-bit status that the function expects to have been provided at offset 0x20 in the error packet’s RawData.

Known Use

The only known use of the HalBugCheckSystem function is to provide the whole implementation of the PSHED function PshedBugCheckSystem. This, in turn, seems to exist only to be used by the kernel for its WheaReportHwError function in the cases where either

the error severity is WheaErrSevFatal (1)
or the error severity is WheaErrSevRecoverable (0) but PshedAttemptErrorRecovery does not change the error severity to WheaErrSevCorrected (2).

The kernel function and the two PSHED functions just mentioned are undocumented, but again, declarations are given in NTDDK.H.

Availability

The HalBugCheckSystem function is exported from the HAL in version 6.0 and higher. It is declared in NTDDK.H but is otherwise undocumented.