Geoff Chappell, Software Analyst
This function stops the system because of an uncorrectable hardware error.
VOID HalBugCheckSystem (PVOID ErrorRecord);
The ErrorRecord argument is the address of a buffer that contains a WHEA_ERROR_RECORD structure followed by other data to describe the error.
The function processes the first WHEA_ERROR_PACKET in the descriptive data. The offset of this structure from the beginning of the buffer is given by the SectionOffset member of the first WHEA_ERROR_HEADER_SECTION_DESCRIPTOR in the WHEA_ERROR_RECORD. Microsoft does not document the WHEA_ERROR_PACKET structure, but a definition is in NTDDK.H. The handling varies with the type of error source as given by the structure’s ErrorSourceType member. The following error sources are recognised:
For any other type of error source, the function returns without having done anything.
When the error source is WheaErrSrcNMI (3), the function displays the following few lines of text:
*** Hardware Malfunction Call your hardware vendor for support description *** The system has halted ***
in which description may be omitted but ordinarily stands for either of the following:
NMI: Channel Check / IOCHK
|if the first byte of the RawData in the WHEA_ERROR_PACKET has the 0x40 bit set|
|NMI: Parity Check / Memory Parity Error||if the first byte of the RawData in the WHEA_ERROR_PACKET has the 0x80 bit set|
If a boot video driver is installed, the function will have first put the display in text mode for a screen of bright white text on a blue background.
With the message displayed, the function either raises the bug check NMI_HARDWARE_FAILURE (0x80) or halts the system. The choice is configurable, through the following registry entry:
This registry value is read when the HAL function HalReportResourceUsage executes during system initialisation. The data is accepted if it is exactly four bytes. If the first byte is non-zero, then this function will raise the bug check through the kernel instead of performing its own halt. The most notable effect is that the kernel may be able to write a crash dump.
To halt the system, the function simply executes an instruction that jumps to itself. If a debugger is present and enabled, the function first breaks to the debugger. Since this is done by calling KeEnterKernelDebugger, the status code on entry to the debugger has the distinctive value DBG_STATUS_FATAL (5).
For all the other recognised types of error source, the function raises the bug check WHEA_UNRECOVERABLE_ERROR (0x0124). The first two arguments are:
For PCI Express errors, the third and fourth arguments are both zero. When the source is an MCE or CMC, the third and fourth arguments are respectively the high and low dwords of a 64-bit status that the function expects to have been provided at offset 0x20 in the error packet’s RawData.
The only known use of the HalBugCheckSystem function is to provide the whole implementation of the PSHED function PshedBugCheckSystem. This, in turn, seems to exist only to be used by the kernel for its WheaReportHwError function in the cases where either
The kernel function and the two PSHED functions just mentioned are undocumented, but again, declarations are given in NTDDK.H.
The HalBugCheckSystem function is exported from the HAL in version 6.0 and higher. It is declared in NTDDK.H but is otherwise undocumented.