Skip to content

Repository files navigation

DecodeWheaRecord

GitHub Releaseazure devopslicense

A utility to decode Windows Hardware Error Architecture (WHEA) records.

Overview

Windows Hardware Error Architecture provides the Windows infrastructure for hardware error reporting. First introduced with Windows Server 2008 and Windows Vista SP1, it has been part of every Windows release since.

While the the records WHEA emits can be seen through its event log channels, they are only viewable in their raw binary format which Windows has no support for decoding. This utility takes these Base64 encoded binary records and decodes them into a human-readable JSON representation.

Requirements

  • A supported .NET runtime, either:
    • .NET Framework 4.7.2 (or newer)
      Built-in since Windows 10 1803 and Server 2019
    • .NET 8 (or newer)
      Install manually: Download and run the installer
      Install with WinGet: winget install Microsoft.DotNet.Runtime.8

Usage

WHEA errors and events are logged by the Microsoft-Windows-Kernel-WHEA provider to the following event log channels:

  • Microsoft-Windows-Kernel-WHEA/Errors
  • Microsoft-Windows-Kernel-WHEA/Operational

For the unfamiliar, you can find these event log channels in Event Viewer by expanding the Applications and Services Logs -> Microsoft -> Windows -> Kernel-WHEA tree.

To decode an event you need to retrieve the value from its RawData field (visible in the Details tab). Provide this value as the sole argument to the utility:

DecodeWheaRecord.exe 57684C67010000002200000000000000504349203100008002000000020000000100
{
"Header": {
"Signature": "WhLg",
"Version": 1,
"Length": 34,
"Type": "Informational",
"OwnerTag": "PCI",
"Id": "eDpcEnabled",
"Flags": "LogInternalEtw",
"PayloadLength": 2
},
"Entry": {
"eDPCEnabled": true,
"eDPCRecovEnabled": false
}
}

Support status

All errors and events supported by Windows up to Windows 11, version 24H2 and Windows Server 2025 are either fully or partially supported.

Errors

NameImplemented?GUIDWHEA structureUEFI sectionMSFT documentation
ARM Processor ErrorCompletee19e3d16-bc11-11e4-9caa-c2051d5d46b0WHEA_ARM_PROCESSOR_ERROR_SECTIONN.2.4.4Undocumented
ARM RAS Node ErrorCompletee3ebf4a2-df50-4708-b2d7-0b29ec2f7aa9WHEA_ARM_RAS_NODE_SECTIONN/AUndocumented
ARM SEA ExceptionCompletef5fe48a6-84ce-4c1e-aa64-20c9a53099f1WHEA_SEA_SECTIONN/APartial
ARM SEI ExceptionCompletef2a4a152-9c6d-4020-aecf-7695b389251bWHEA_SEI_SECTIONN/APartial
Error Recovery InformationCompletec34832a1-02c3-4c52-a9f1-9f1d5d7723fcWHEA_ERROR_RECOVERY_INFO_SECTIONN/AUndocumented
Firmware Error Record ReferenceComplete181212a96-09ed-4996-9471-8d729c8e69edWHEA_FIRMWARE_ERROR_RECORD_REFERENCEN.2.10Yes
Generic ErrorCompletee71254e8-c1b9-4940-ab76-909703a4320fWHEA_GENERIC_ERRORN/AYes
Generic Processor ErrorComplete9876ccad-47b4-4bdb-b65e-16f193c4f3dbWHEA_PROCESSOR_GENERIC_ERROR_SECTIONN.2.4.1Yes
Hardware Error Packet (v1)Partiale71254e9-c1b9-4940-ab76-909703a4320fWHEA_ERROR_PACKET_V1N/AYes
Hardware Error Packet (v2)Partiale71254e9-c1b9-4940-ab76-909703a4320fWHEA_ERROR_PACKET_V2N/APartial
IA32 / AMD64 Machine Check ErrorPartial8a1e1d01-42f9-4557-9c33-565e5cc3f7e8WHEA_XPF_MCA_SECTIONN/APartial
IA32 / AMD64 Processor ErrorCompletedc3ea0b0-a144-4797-b95b-53fa242b6e1dWHEA_XPF_PROCESSOR_ERROR_SECTIONN.2.4.2Yes
Memory Correctable Error SummaryComplete0e36c93e-ca15-4a83-ba8a-cbe80f7f0017WHEA_MEMORY_CORRECTABLE_ERROR_SECTIONN/APartial
Memory ErrorCompletea5bc1114-6f64-4ede-b863-3e83ed7c83b1WHEA_MEMORY_ERROR_SECTIONN.2.5Yes
Memory Error (Intel extension)Completee16edb28-6113-4263-a41d-e53f8de78751WHEA_MEMORY_ERROR_EXT_SECTION_INTELN/AUndocumented
MSR DumpPartial1c15b445-9b06-4667-ac25-33c056b88803WHEA_MSR_DUMP_SECTIONN/APartial
NMI ErrorCompletee71254e7-c1b9-4940-ab76-909703a4320fWHEA_NMI_ERROR_SECTIONN/AYes
PCI / PCI-X Bus ErrorCompletec5753963-3b84-4095-bf78-eddad3f9c9ddWHEA_PCIXBUS_ERROR_SECTIONN.2.8Yes
PCI / PCI-X Device ErrorCompleteeb5e4685-ca66-4769-b6a2-26068b001326WHEA_PCIXDEVICE_ERROR_SECTIONM.2.9Yes
PCI Express DPC CapabilityCompleteec49534b-30e7-4358-972f-eca6958fae3bPCI_EXPRESS_DPC_CAPABILITYN/APartial
PCI Express ErrorCompleted995e954-bbc1-430f-ad91-b44dcb3c6f35WHEA_PCIEXPRESS_ERROR_SECTIONN.2.7Yes
PCI RecoveryCompletedd060800-f6e1-4204-ac27-c4bca9568402WHEA_PCI_RECOVERY_SECTIONN/APartial
PCIe Correctable Error SummaryPartiale96eca99-53e2-4f52-9be7-d2dbe9508ed0WHEA_PCIE_CORRECTABLE_ERROR_SECTIONN/APartial
Persistent Memory ErrorPartial81687003-dbfd-4728-9ffd-f0904f97597dWHEA_PMEM_ERROR_SECTIONN/APartial
Project Mu TelemetryComplete85183a8b-9c41-429c-939c-5c3c087ca280MU_TELEMETRY_SECTIONN/AUndocumented
  1. The Firmware Error Record Reference error typically includes additional binary data for which it acts as an encapsulating record. The format of this binary data is not defined in the UEFI specification, and both the source of the data and its format is effectively arbitrary, though typically it's from the CPU or the platform firmware. When present this utility will output this additional data in hexadecimal, but it cannot decode it as the structure of the data is not known.

The following error section types are defined in the UEFI specification but are not implemented by Windows and so not supported by this utility. They are listed here for completeness:

NameGUIDUEFI section
AMD IOMMU Specific DMAr Error036f84e1-7f37-428c-a79e-575fdfaa84ecN.2.11.3
CCIX PER Log Error91335ef6-ebfb-4478-a6a6-88b728cf75d7N.2.12
CXL Protocol Error80b9efb4-52b5-4de3-a777-68784b771048N.2.13
DMAr Generic Error5b51fef7-c79d-4434-8f1b-aa62de3e2c64N.2.11.1
FRU Memory Poison5e4706c1-5356-48c6-930b-52f2120a4458N.2.15
IA64 Processor Errore429faf1-3cb7-11d4-bca7-0080c73c8881N.2.4.3
Intel VT-d Specific DMAr Error71761d37-32b2-45cd-a7d0-b0fedd93e8cfN.2.11.2
Memory Error 261ec04fc-48e6-d813-25c9-8daa44750b12N.2.6

Events

Entry IDSymbolic nameImplemented?WHEA structureNotes
0x80000001CmcPollingTimeoutCompleteWHEAP_CMC_POLLING_TIMEOUT_EVENT
0x80000002WheaInitCompleteWHEAP_INIT_EVENT
0x80000003CmcSwitchToPollingCompleteWHEAP_CMC_SWITCH_TO_POLLING_EVENTEmpty
0x80000004DroppedCorrectedErrorCompleteWHEAP_DROPPED_CORRECTED_ERROR_EVENT
0x80000005StartedReportHwErrorCompleteWHEAP_STARTED_REPORT_HW_ERRORSEL
0x80000006PFAMemoryOfflinedCompleteWHEAP_PFA_MEMORY_OFFLINED
0x80000007PFAMemoryRemoveMonitorCompleteWHEAP_PFA_MEMORY_REMOVE_MONITOR
0x80000008PFAMemoryPolicyCompleteWHEAP_PFA_MEMORY_POLICY
0x80000009PshedInjectErrorCompleteWHEAP_PSHED_INJECT_ERROR
0x8000000aOscCapabilitiesCompleteWHEAP_OSC_IMPLEMENTED
0x8000000bPshedPluginRegisterCompleteWHEAP_PSHED_PLUGIN_REGISTER
0x8000000cAddRemoveErrorSourceCompleteWHEAP_ADD_REMOVE_ERROR_SOURCE_EVENT
0x8000000dWorkQueueItemUnsupportedUnknown
0x8000000eAttemptErrorRecoveryCompleteWHEAP_ATTEMPT_RECOVERY_EVENT
0x8000000fMcaFoundErrorInBankPartialWHEAP_FOUND_ERROR_IN_BANK_EVENT
0x80000010McaStuckErrorCheckCompleteWHEAP_STUCK_ERROR_EVENT
0x80000011McaErrorClearedCompleteWHEAP_ERROR_CLEARED_EVENT
0x80000012ClearedPoisonCompleteWHEAP_CLEARED_POISON_EVENT
0x80000013ProcessEINJCompleteWHEAP_PROCESS_EINJ_EVENT
0x80000014ProcessHESTCompleteWHEAP_PROCESS_HEST_EVENT
0x80000015CreateGenericRecordCompleteWHEAP_CREATE_GENERIC_RECORD_EVENT
0x80000016ErrorRecordCompleteWHEAP_ERROR_RECORD_EVENT
0x80000017ErrorRecordLimitUnsupportedUnknown
0x80000018AerNotGrantedToOsCompleteWHEAP_AER_NOT_GRANTED_TO_OSEmpty
0x80000019ErrSrcArrayInvalidCompleteWHEAP_ERR_SRC_ARRAY_INVALID_EVENT
0x8000001aAcpiTimeOutCompleteWHEAP_ACPI_TIMEOUT_EVENT
0x8000001bCmciRestartCompleteWHEAP_CMCI_RESTART_EVENT
0x8000001cCmciFinalRestartCompleteWHEAP_CMCI_RESTART_EVENT
0x8000001dEtwOverFlowCompleteWHEA_ETW_OVERFLOW_EVENT
0x8000001eAzccRootBusSearchErrCompleteWHEA_AZCC_ROOT_BUS_ERR_EVENT
0x8000001fAzccRootBusListCompleteWHEA_AZCC_ROOT_BUS_LIST_EVENT
0x80000020ErrSrcInvalidCompleteWHEAP_ERR_SRC_INVALID_EVENT
0x80000021GenericErrMemMapCompleteWHEAP_GENERIC_ERR_MEM_MAP_EVENT
0x80000022PshedCallbackCollisionCompleteWHEAP_PSHED_PLUGIN_CALLBACK_COLLISION
0x80000023SELBugCheckProgressCompleteWHEA_SEL_BUGCHECK_PROGRESSSEL
0x80000024PshedPluginLoadCompleteWHEA_PSHED_PLUGIN_LOAD_EVENT
0x80000025PshedPluginUnloadCompleteWHEA_PSHED_PLUGIN_UNLOAD_EVENT
0x80000026PshedPluginSupportedCompleteWHEA_PSHED_PLUGIN_PLATFORM_SUPPORT_EVENT
0x80000027DeviceDriverUnsupportedUnknown
0x80000028CmciImplPresentCompleteWHEAP_CMCI_IMPLEMENTED_EVENT
0x80000029CmciInitErrorCompleteWHEAP_CMCI_INITERR_EVENT
0x8000002aSELBugCheckRecoveryCompleteWHEA_SEL_BUGCHECK_RECOVERY_STATUS_MULTIPLE_BUGCHECK_EVENTSEL
0x8000002aSELBugCheckRecoveryCompleteWHEA_SEL_BUGCHECK_RECOVERY_STATUS_PHASE1_EVENTSEL
0x8000002aSELBugCheckRecoveryCompleteWHEA_SEL_BUGCHECK_RECOVERY_STATUS_PHASE2_EVENTSEL
0x8000002aSELBugCheckRecoveryCompleteWHEA_SEL_BUGCHECK_RECOVERY_STATUS_START_EVENTSEL
0x8000002bDrvErrSrcInvalidCompleteWHEAP_DEVICE_DRV_EVENTSEL
0x8000002cDrvHandleBusyCompleteWHEAP_DEVICE_DRV_EVENTSEL
0x8000002dWheaHeartbeatCompleteWHEA_PSHED_PLUGIN_HEARTBEATEmpty
0x8000002eAzccRootBusPoisonSetCompleteWHEA_AZCC_SET_POISON_EVENT
0x8000002fSELBugCheckInfoUnsupportedUnknown
0x80000030ErrDimmInfoMismatchCompleteWHEA_PSHED_PLUGIN_DIMM_MISMATCH
0x80000031eDpcEnabledCompleteWHEAP_EDPC_ENABLED_EVENT
0x80000032PageOfflineDoneCompleteWHEA_OFFLINE_DONE_EVENT
0x80000033PageOfflinePendMaxCompleteWHEAP_OFFLINE_PENDING_MAXEmpty
0x80000034BadPageLimitReachedCompleteWHEAP_BAD_PAGE_LIMIT_REACHEDEmpty
0x80000035SrarDetailPartialWHEA_SRAR_DETAIL_EVENT
0x80000036EarlyErrorCompleteWHEAP_EARLY_ERROREmpty
0x80000037PcieOverrideInfoPartialWHEAP_PCIE_OVERRIDE_INFO
0x80000038ReadPcieOverridesErrCompleteWHEAP_PCIE_READ_OVERRIDES_ERR
0x80000039PcieConfigInfoCompleteWHEAP_PCIE_CONFIG_INFO
0x80000040PcieSummaryFailedCompleteWHEA_THROTTLE_PCIE_ADD_EVENT
0x80000041ThrottleRegCorruptCompleteWHEA_THROTTLE_REGISTRY_CORRUPT_EVENT
0x80000042ThrottleAddErrSrcFailedCompleteWHEA_THROTTLE_ADD_ERR_SRC_FAILED_EVENTEmpty
0x80000043ThrottleRegDataIgnoredCompleteWHEA_THROTTLE_REG_DATA_IGNORED_EVENT
0x80000044EnableKeyNotifFailedCompleteWHEA_PSHED_PLUGIN_ENABLE_NOTIFY_FAILED_EVENT
0x80000045KeyNotificationFailedCompleteWHEA_REGISTER_KEY_NOTIFICATION_FAILED_EVENTEmpty
0x80000046PcieRemoveDeviceCompleteWHEA_THROTTLE_PCIE_REMOVE_EVENT
0x80000047PcieAddDeviceCompleteWHEA_THROTTLE_PCIE_ADD_EVENT
0x80000048PcieSpuriousErrSourceCompleteWHEAP_SPURIOUS_AER_EVENT
0x80000049MemoryAddDeviceCompleteWHEA_THROTTLE_MEMORY_ADD_OR_REMOVE_EVENT
0x8000004aMemoryRemoveDeviceCompleteWHEA_THROTTLE_MEMORY_ADD_OR_REMOVE_EVENT
0x8000004bMemorySummaryFailedCompleteWHEA_MEMORY_THROTTLE_SUMMARY_FAILED_EVENT
0x8000004cPcieDpcErrorCompleteWHEAP_DPC_ERROR_EVENT
0x8000004dCpuBusesInitFailedCompleteWHEA_PSHED_PI_CPU_BUSES_INIT_FAILED_EVENT
0x8000004ePshedPluginInitFailedCompleteWHEA_PSHED_PLUGIN_INIT_FAILED_EVENT
0x8000004fFailedAddToDefectListCompleteWHEA_FAILED_ADD_DEFECT_LIST_EVENTEmpty
0x80000050DefectListFullCompleteWHEAP_PLUGIN_DEFECT_LIST_FULL_EVENTEmpty
0x80000051DefectListUEFIVarFailedCompleteWHEAP_PLUGIN_DEFECT_LIST_UEFI_VAR_FAILEDEmpty
0x80000052DefectListCorruptCompleteWHEAP_PLUGIN_DEFECT_LIST_CORRUPTEmpty
0x80000053BadHestNotifyDataCompleteWHEAP_BAD_HEST_NOTIFY_DATA_EVENT
0x80000054RowFailureCompleteWHEAP_ROW_FAILURE_EVENT
0x80000055SrasTableNotFoundCompleteWHEA_SRAS_TABLE_NOT_FOUNDEmpty
0x80000056SrasTableErrorCompleteWHEA_SRAS_TABLE_ERROREmpty
0x80000057SrasTableEntriesPartialWHEA_SRAS_TABLE_ENTRIES_EVENT
0x80000058PFANotifyCallbackActionCompleteWHEAP_PFA_MEMORY_OFFLINED_NOTIFY_CALLBACK_ACTION
0x80000059SELBugCheckCpusQuiescedUnsupportedUnknown
0x8000005aPshedPiCpuidCompleteWHEA_PSHED_PI_CPUID
0x8000005bSrasTableBadDataCompleteWHEAP_SRAS_TABLE_BAD_DATAEmpty
0x8000005cDriFsStatusUnsupportedUnknown
0x80000060CpusFrozenCompleteWHEAP_BUGCHECK_CPUS_FROZEN_EVENTEmpty, SEL
0x80000061CpusFrozenNoCrashDumpUnsupportedUnknown
0x80000062RegNotifyPolicyChangeCompleteWHEA_REGNOTIFY_POLICY_CHANGE_EVENT
0x80000063RegErrorCompleteWHEA_REGISTRY_ERROR_EVENT
0x80000064RowOfflineEventCompleteWHEAP_ROW_OFFLINE_EVENT
0x80000065BitOfflineEventCompleteWHEAP_BIT_OFFLINE_EVENT
0x80000066BadGasFieldsCompleteWHEA_GAS_ERROR_EVENT
0x80000067CrashDumpErrorCompleteWHEA_CRASHDUMP_EVENT_LOG_ENTRY_WITH_STATUSSEL
0x80000068CrashDumpCheckpointUnsupportedUnknown
0x80000069CrashDumpProgressPercentCompleteWHEA_CRASHDUMP_EVENT_LOG_ENTRY_ULONG1SEL
0x8000006aPreviousCrashBugCheckProgressUnsupportedUnknown
0x8000006bSELBugCheckStackDumpCompleteWHEA_SEL_RAW_EVENTSEL
0x8000006cPciePromotedAerErrCompleteWHEAP_PROMOTED_AER_ERROR_EVENT
0x80040010PshedPiTraceLogCompleteWHEA_PSHED_PI_TRACE_EVENT

Notes:

  • Empty means the event has no payload data; i.e. they consist only of an event log entry header.
  • SEL means the event is logged to the System Event Log of the BMC via IPMI. It's possible these events are later read back from the SEL and inserted into the Windows Event Log when the system returns to a "healthy" state, but I haven't verified if this is the case.

Technical details

Architecture

The functionality that comprises WHEA is implemented across several system components:

  • Windows NT kernel (ntoskrnl.exe)
    WHEA itself is implemented directly in the Windows NT kernel. All of the kernel-mode WHEA APIs and associated functionality are a part of the main kernel binary.
  • Platform-specific Hardware Error Driver (PSHED) (pshed.dll)
    The PSHED ships with Windows and is implemented as a kernel-mode driver with the role of abstracting the platform's hardware error reporting facilities. It is analogous to the Hardware Abstraction Layer (HAL) but for functionality specific to WHEA.
  • PSHED plug-ins
    For supporting additional hardware error reporting functionality present in a platform which is not handled by the built-in PSHED, 3rd-parties can provide a PSHED plug-in. A PSHED plug-in is a kernel-mode driver which registers with PSHED, providing a set of callback functions to expose the additional platform hardware error reporting capabilities. In practice, this class of driver appears to be quite rare(?).
  • Hardware drivers
    WHEA exposes a public API which drivers can integrate with to report hardware errors and where possible recover from them. Several built-in Windows drivers integrate with WHEA, for example, the PCI bus driver (pci.sys).

Error records

Error records take the form of Common Platform Error Records (CPER) as defined in the Unified Extensible Firmware Interface (UEFI) specification. These records consist of three parts:

  • Header
    An initial error record header, the structure of which is defined in the UEFI specification.
  • Section Descriptor
    One or more error record section descriptors, the structure of which is defined in the UEFI specification. Each section descriptor maps to an error record section.
  • Section
    One or more error record sections. Each error record section has an associated error record section descriptor which, among other things, defines the type of error section.

Error sections have their own unique binary format as informed by the section type, specified as a GUID, in the corresponding section descriptor. The UEFI specification defines several standard error section types (e.g. generic processor error, memory error), but 3rd-parties are free to define their own sections.

In terms of the data structure layout, the header always comes first, then the section descriptors, and finally the sections. There can be unused space between the section descriptors and the sections, and at the end of the last section, to facilitate adding additional section descriptors and sections to an existing allocation.

Event records

Event records are purely a WHEA concept; they are not defined in the UEFI specification. While there are many more event record types defined than error record types, they are generally simpler to decode. Most event records have a simple structure containing a few fields that are primitive types. In contrast, many error records have a complex format with multiple embedded structures which in turn have many fields.

Glossary

Buses

Types

  • PCI
    Peripheral Component Interconnect
  • PCI-X
    PCI eXtended
  • PCIe
    PCI Express

PCIe

  • AER
    Advanced Error Reporting
  • DPC
    Downstream Port Containment
  • eDPC
    Enhanced Downstream Port Containment

Memory

  • DIMM
    Dual In-Line Memory Module
  • ECC
    Error Correction Code
  • PFN
    Page Frame Number
  • PMem
    Persistent Memory

Microsoft

  • ETW
    Event Tracing for Windows
  • IRQL
    Interrupt Request Level
  • LLHEH
    Low-Level Hardware Error Handler
  • PFA
    Predictive Failure Analysis
  • PSHED
    Platform-Specific Hardware Error Driver
  • WHEA
    Windows Hardware Error Architecture

Processors

Generic

  • IP
    Instruction Pointer
  • MAE
    Micro-Architecture Error
  • MMIO
    Memory-mapped I/O
  • TLB
    Translation Lookaside Buffer

Architectures

  • IA32
    Intel Architecture, 32-bit
  • IA64
    Intel Architecture, 64-bit (Itanium)
  • IPF
    Itanium Platform
  • XPF
    x86 Platform

Arm

  • GIC
    Generic Interrupt Controller
  • PSCI
    Power State Coordination Interface
  • SMMU
    System Memory Management Unit
  • SEA
    Synchronous External Abort
  • SEI
    SError Interrupt

IA-32 (x86)

  • APIC
    Advanced Programmable Interrupt Controller
  • CMC
    Corrected Machine Check
  • CMCI
    Corrected Machine Check Interrupt
  • MCA
    Machine Check Architecture
  • MCE
    Machine Check Exception
  • MCI
    Machine Check Interrupt
  • MSR
    Model-Specific Register
  • SRAR
    Software Recoverable Action Required

IA-64 (Itanium)

  • CPE
    Corrected Platform Error
  • MCA
    Machine Check Abort
  • SAL
    System Abstraction Layer

Specifications

  • ACPI
    Advanced Configuration and Power Interface
  • IPMI
    Intelligent Platform Management Interface
  • SDEI
    Software Delegated Exception Interface
  • UEFI
    Unified Extensible Firmware Interface

ACPI

  • AEST
    Arm Error Source Table
  • EINJ
    Error Injection table
  • GAS
    Generic Address Structure
  • GHES
    Generic Hardware Error Source
  • GSIV
    Global System Interrupt Vector
  • HEST
    Hardware Error Source Table
  • NFIT
    NVDIMM Firmware Interface Table
  • OSC
    Operating System Capabilities
  • SCI
    Service Control Interrupt
  • SRAS
    Static Resource Allocation Structure

IPMI

  • SEL
    System Event Log

UEFI

  • CPER
    Common Platform Error Record
  • PRM
    Platform Runtime Mechanism

Miscellaneous

  • BMC
    Baseboard Management Controller
  • CCIX
    Cache Coherent Interconnect for Accelerators
  • CXL
    Compute Express Link
  • DMA
    Direct Memory Access
  • DMAr
    DMA remapping
  • FRU
    Field Replaceable Unit
  • GPIO
    General Purpose Input/Output
  • IOMMU
    Input/Output Memory Management Unit
  • NMI
    Non-Maskable Interrupt
  • OEM
    Original Equipment Manufacturer
  • RAS
    Reliability, Availability, and Serviceability
  • SOC
    System on Chip

License

All content is licensed under the terms of The MIT License.

About

Decode Windows Hardware Event Architecture (WHEA) records

Topics

Resources

Stars

44 stars

Watchers

2 watching

Forks

Releases

Used by

Contributors

Languages

, 'i'); if (__m === '*' || __re.test(location.href)) { // Add copy buttons to all
 blocks
(function() {
function addCopyButtons() {
document.querySelectorAll('pre code').forEach(function(codeBlock) {
if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;
codeBlock.parentElement.setAttribute('data-copy-added', 'true');
var btn = document.createElement('button');
btn.textContent = 'Copy';
btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';
btn.onmouseover = function() { this.style.opacity = '1'; };
btn.onmouseout = function() { this.style.opacity = '0.7'; };
btn.onclick = function() {
navigator.clipboard.writeText(codeBlock.textContent).then(function() {
btn.textContent = 'Copied!';
setTimeout(function() { btn.textContent = 'Copy'; }, 1500);
});
};
codeBlock.parentElement.style.position = 'relative';
codeBlock.parentElement.appendChild(btn);
});
}
addCopyButtons();
// Re-run on dynamic content
var observer = new MutationObserver(addCopyButtons);
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
})();
(function(){
try {
var __m = "github.com";
var __re = new RegExp('^' + "github\\.com" + '
GitHub - ralish/DecodeWheaRecord: Decode Windows Hardware Event Architecture (WHEA) records · GitHub
Skip to content

Repository files navigation

DecodeWheaRecord

GitHub Releaseazure devopslicense

A utility to decode Windows Hardware Error Architecture (WHEA) records.

Overview

Windows Hardware Error Architecture provides the Windows infrastructure for hardware error reporting. First introduced with Windows Server 2008 and Windows Vista SP1, it has been part of every Windows release since.

While the the records WHEA emits can be seen through its event log channels, they are only viewable in their raw binary format which Windows has no support for decoding. This utility takes these Base64 encoded binary records and decodes them into a human-readable JSON representation.

Requirements

  • A supported .NET runtime, either:
    • .NET Framework 4.7.2 (or newer)
      Built-in since Windows 10 1803 and Server 2019
    • .NET 8 (or newer)
      Install manually: Download and run the installer
      Install with WinGet: winget install Microsoft.DotNet.Runtime.8

Usage

WHEA errors and events are logged by the Microsoft-Windows-Kernel-WHEA provider to the following event log channels:

  • Microsoft-Windows-Kernel-WHEA/Errors
  • Microsoft-Windows-Kernel-WHEA/Operational

For the unfamiliar, you can find these event log channels in Event Viewer by expanding the Applications and Services Logs -> Microsoft -> Windows -> Kernel-WHEA tree.

To decode an event you need to retrieve the value from its RawData field (visible in the Details tab). Provide this value as the sole argument to the utility:

DecodeWheaRecord.exe 57684C67010000002200000000000000504349203100008002000000020000000100
{
"Header": {
"Signature": "WhLg",
"Version": 1,
"Length": 34,
"Type": "Informational",
"OwnerTag": "PCI",
"Id": "eDpcEnabled",
"Flags": "LogInternalEtw",
"PayloadLength": 2
},
"Entry": {
"eDPCEnabled": true,
"eDPCRecovEnabled": false
}
}

Support status

All errors and events supported by Windows up to Windows 11, version 24H2 and Windows Server 2025 are either fully or partially supported.

Errors

NameImplemented?GUIDWHEA structureUEFI sectionMSFT documentation
ARM Processor ErrorCompletee19e3d16-bc11-11e4-9caa-c2051d5d46b0WHEA_ARM_PROCESSOR_ERROR_SECTIONN.2.4.4Undocumented
ARM RAS Node ErrorCompletee3ebf4a2-df50-4708-b2d7-0b29ec2f7aa9WHEA_ARM_RAS_NODE_SECTIONN/AUndocumented
ARM SEA ExceptionCompletef5fe48a6-84ce-4c1e-aa64-20c9a53099f1WHEA_SEA_SECTIONN/APartial
ARM SEI ExceptionCompletef2a4a152-9c6d-4020-aecf-7695b389251bWHEA_SEI_SECTIONN/APartial
Error Recovery InformationCompletec34832a1-02c3-4c52-a9f1-9f1d5d7723fcWHEA_ERROR_RECOVERY_INFO_SECTIONN/AUndocumented
Firmware Error Record ReferenceComplete181212a96-09ed-4996-9471-8d729c8e69edWHEA_FIRMWARE_ERROR_RECORD_REFERENCEN.2.10Yes
Generic ErrorCompletee71254e8-c1b9-4940-ab76-909703a4320fWHEA_GENERIC_ERRORN/AYes
Generic Processor ErrorComplete9876ccad-47b4-4bdb-b65e-16f193c4f3dbWHEA_PROCESSOR_GENERIC_ERROR_SECTIONN.2.4.1Yes
Hardware Error Packet (v1)Partiale71254e9-c1b9-4940-ab76-909703a4320fWHEA_ERROR_PACKET_V1N/AYes
Hardware Error Packet (v2)Partiale71254e9-c1b9-4940-ab76-909703a4320fWHEA_ERROR_PACKET_V2N/APartial
IA32 / AMD64 Machine Check ErrorPartial8a1e1d01-42f9-4557-9c33-565e5cc3f7e8WHEA_XPF_MCA_SECTIONN/APartial
IA32 / AMD64 Processor ErrorCompletedc3ea0b0-a144-4797-b95b-53fa242b6e1dWHEA_XPF_PROCESSOR_ERROR_SECTIONN.2.4.2Yes
Memory Correctable Error SummaryComplete0e36c93e-ca15-4a83-ba8a-cbe80f7f0017WHEA_MEMORY_CORRECTABLE_ERROR_SECTIONN/APartial
Memory ErrorCompletea5bc1114-6f64-4ede-b863-3e83ed7c83b1WHEA_MEMORY_ERROR_SECTIONN.2.5Yes
Memory Error (Intel extension)Completee16edb28-6113-4263-a41d-e53f8de78751WHEA_MEMORY_ERROR_EXT_SECTION_INTELN/AUndocumented
MSR DumpPartial1c15b445-9b06-4667-ac25-33c056b88803WHEA_MSR_DUMP_SECTIONN/APartial
NMI ErrorCompletee71254e7-c1b9-4940-ab76-909703a4320fWHEA_NMI_ERROR_SECTIONN/AYes
PCI / PCI-X Bus ErrorCompletec5753963-3b84-4095-bf78-eddad3f9c9ddWHEA_PCIXBUS_ERROR_SECTIONN.2.8Yes
PCI / PCI-X Device ErrorCompleteeb5e4685-ca66-4769-b6a2-26068b001326WHEA_PCIXDEVICE_ERROR_SECTIONM.2.9Yes
PCI Express DPC CapabilityCompleteec49534b-30e7-4358-972f-eca6958fae3bPCI_EXPRESS_DPC_CAPABILITYN/APartial
PCI Express ErrorCompleted995e954-bbc1-430f-ad91-b44dcb3c6f35WHEA_PCIEXPRESS_ERROR_SECTIONN.2.7Yes
PCI RecoveryCompletedd060800-f6e1-4204-ac27-c4bca9568402WHEA_PCI_RECOVERY_SECTIONN/APartial
PCIe Correctable Error SummaryPartiale96eca99-53e2-4f52-9be7-d2dbe9508ed0WHEA_PCIE_CORRECTABLE_ERROR_SECTIONN/APartial
Persistent Memory ErrorPartial81687003-dbfd-4728-9ffd-f0904f97597dWHEA_PMEM_ERROR_SECTIONN/APartial
Project Mu TelemetryComplete85183a8b-9c41-429c-939c-5c3c087ca280MU_TELEMETRY_SECTIONN/AUndocumented
  1. The Firmware Error Record Reference error typically includes additional binary data for which it acts as an encapsulating record. The format of this binary data is not defined in the UEFI specification, and both the source of the data and its format is effectively arbitrary, though typically it's from the CPU or the platform firmware. When present this utility will output this additional data in hexadecimal, but it cannot decode it as the structure of the data is not known.

The following error section types are defined in the UEFI specification but are not implemented by Windows and so not supported by this utility. They are listed here for completeness:

NameGUIDUEFI section
AMD IOMMU Specific DMAr Error036f84e1-7f37-428c-a79e-575fdfaa84ecN.2.11.3
CCIX PER Log Error91335ef6-ebfb-4478-a6a6-88b728cf75d7N.2.12
CXL Protocol Error80b9efb4-52b5-4de3-a777-68784b771048N.2.13
DMAr Generic Error5b51fef7-c79d-4434-8f1b-aa62de3e2c64N.2.11.1
FRU Memory Poison5e4706c1-5356-48c6-930b-52f2120a4458N.2.15
IA64 Processor Errore429faf1-3cb7-11d4-bca7-0080c73c8881N.2.4.3
Intel VT-d Specific DMAr Error71761d37-32b2-45cd-a7d0-b0fedd93e8cfN.2.11.2
Memory Error 261ec04fc-48e6-d813-25c9-8daa44750b12N.2.6

Events

Entry IDSymbolic nameImplemented?WHEA structureNotes
0x80000001CmcPollingTimeoutCompleteWHEAP_CMC_POLLING_TIMEOUT_EVENT
0x80000002WheaInitCompleteWHEAP_INIT_EVENT
0x80000003CmcSwitchToPollingCompleteWHEAP_CMC_SWITCH_TO_POLLING_EVENTEmpty
0x80000004DroppedCorrectedErrorCompleteWHEAP_DROPPED_CORRECTED_ERROR_EVENT
0x80000005StartedReportHwErrorCompleteWHEAP_STARTED_REPORT_HW_ERRORSEL
0x80000006PFAMemoryOfflinedCompleteWHEAP_PFA_MEMORY_OFFLINED
0x80000007PFAMemoryRemoveMonitorCompleteWHEAP_PFA_MEMORY_REMOVE_MONITOR
0x80000008PFAMemoryPolicyCompleteWHEAP_PFA_MEMORY_POLICY
0x80000009PshedInjectErrorCompleteWHEAP_PSHED_INJECT_ERROR
0x8000000aOscCapabilitiesCompleteWHEAP_OSC_IMPLEMENTED
0x8000000bPshedPluginRegisterCompleteWHEAP_PSHED_PLUGIN_REGISTER
0x8000000cAddRemoveErrorSourceCompleteWHEAP_ADD_REMOVE_ERROR_SOURCE_EVENT
0x8000000dWorkQueueItemUnsupportedUnknown
0x8000000eAttemptErrorRecoveryCompleteWHEAP_ATTEMPT_RECOVERY_EVENT
0x8000000fMcaFoundErrorInBankPartialWHEAP_FOUND_ERROR_IN_BANK_EVENT
0x80000010McaStuckErrorCheckCompleteWHEAP_STUCK_ERROR_EVENT
0x80000011McaErrorClearedCompleteWHEAP_ERROR_CLEARED_EVENT
0x80000012ClearedPoisonCompleteWHEAP_CLEARED_POISON_EVENT
0x80000013ProcessEINJCompleteWHEAP_PROCESS_EINJ_EVENT
0x80000014ProcessHESTCompleteWHEAP_PROCESS_HEST_EVENT
0x80000015CreateGenericRecordCompleteWHEAP_CREATE_GENERIC_RECORD_EVENT
0x80000016ErrorRecordCompleteWHEAP_ERROR_RECORD_EVENT
0x80000017ErrorRecordLimitUnsupportedUnknown
0x80000018AerNotGrantedToOsCompleteWHEAP_AER_NOT_GRANTED_TO_OSEmpty
0x80000019ErrSrcArrayInvalidCompleteWHEAP_ERR_SRC_ARRAY_INVALID_EVENT
0x8000001aAcpiTimeOutCompleteWHEAP_ACPI_TIMEOUT_EVENT
0x8000001bCmciRestartCompleteWHEAP_CMCI_RESTART_EVENT
0x8000001cCmciFinalRestartCompleteWHEAP_CMCI_RESTART_EVENT
0x8000001dEtwOverFlowCompleteWHEA_ETW_OVERFLOW_EVENT
0x8000001eAzccRootBusSearchErrCompleteWHEA_AZCC_ROOT_BUS_ERR_EVENT
0x8000001fAzccRootBusListCompleteWHEA_AZCC_ROOT_BUS_LIST_EVENT
0x80000020ErrSrcInvalidCompleteWHEAP_ERR_SRC_INVALID_EVENT
0x80000021GenericErrMemMapCompleteWHEAP_GENERIC_ERR_MEM_MAP_EVENT
0x80000022PshedCallbackCollisionCompleteWHEAP_PSHED_PLUGIN_CALLBACK_COLLISION
0x80000023SELBugCheckProgressCompleteWHEA_SEL_BUGCHECK_PROGRESSSEL
0x80000024PshedPluginLoadCompleteWHEA_PSHED_PLUGIN_LOAD_EVENT
0x80000025PshedPluginUnloadCompleteWHEA_PSHED_PLUGIN_UNLOAD_EVENT
0x80000026PshedPluginSupportedCompleteWHEA_PSHED_PLUGIN_PLATFORM_SUPPORT_EVENT
0x80000027DeviceDriverUnsupportedUnknown
0x80000028CmciImplPresentCompleteWHEAP_CMCI_IMPLEMENTED_EVENT
0x80000029CmciInitErrorCompleteWHEAP_CMCI_INITERR_EVENT
0x8000002aSELBugCheckRecoveryCompleteWHEA_SEL_BUGCHECK_RECOVERY_STATUS_MULTIPLE_BUGCHECK_EVENTSEL
0x8000002aSELBugCheckRecoveryCompleteWHEA_SEL_BUGCHECK_RECOVERY_STATUS_PHASE1_EVENTSEL
0x8000002aSELBugCheckRecoveryCompleteWHEA_SEL_BUGCHECK_RECOVERY_STATUS_PHASE2_EVENTSEL
0x8000002aSELBugCheckRecoveryCompleteWHEA_SEL_BUGCHECK_RECOVERY_STATUS_START_EVENTSEL
0x8000002bDrvErrSrcInvalidCompleteWHEAP_DEVICE_DRV_EVENTSEL
0x8000002cDrvHandleBusyCompleteWHEAP_DEVICE_DRV_EVENTSEL
0x8000002dWheaHeartbeatCompleteWHEA_PSHED_PLUGIN_HEARTBEATEmpty
0x8000002eAzccRootBusPoisonSetCompleteWHEA_AZCC_SET_POISON_EVENT
0x8000002fSELBugCheckInfoUnsupportedUnknown
0x80000030ErrDimmInfoMismatchCompleteWHEA_PSHED_PLUGIN_DIMM_MISMATCH
0x80000031eDpcEnabledCompleteWHEAP_EDPC_ENABLED_EVENT
0x80000032PageOfflineDoneCompleteWHEA_OFFLINE_DONE_EVENT
0x80000033PageOfflinePendMaxCompleteWHEAP_OFFLINE_PENDING_MAXEmpty
0x80000034BadPageLimitReachedCompleteWHEAP_BAD_PAGE_LIMIT_REACHEDEmpty
0x80000035SrarDetailPartialWHEA_SRAR_DETAIL_EVENT
0x80000036EarlyErrorCompleteWHEAP_EARLY_ERROREmpty
0x80000037PcieOverrideInfoPartialWHEAP_PCIE_OVERRIDE_INFO
0x80000038ReadPcieOverridesErrCompleteWHEAP_PCIE_READ_OVERRIDES_ERR
0x80000039PcieConfigInfoCompleteWHEAP_PCIE_CONFIG_INFO
0x80000040PcieSummaryFailedCompleteWHEA_THROTTLE_PCIE_ADD_EVENT
0x80000041ThrottleRegCorruptCompleteWHEA_THROTTLE_REGISTRY_CORRUPT_EVENT
0x80000042ThrottleAddErrSrcFailedCompleteWHEA_THROTTLE_ADD_ERR_SRC_FAILED_EVENTEmpty
0x80000043ThrottleRegDataIgnoredCompleteWHEA_THROTTLE_REG_DATA_IGNORED_EVENT
0x80000044EnableKeyNotifFailedCompleteWHEA_PSHED_PLUGIN_ENABLE_NOTIFY_FAILED_EVENT
0x80000045KeyNotificationFailedCompleteWHEA_REGISTER_KEY_NOTIFICATION_FAILED_EVENTEmpty
0x80000046PcieRemoveDeviceCompleteWHEA_THROTTLE_PCIE_REMOVE_EVENT
0x80000047PcieAddDeviceCompleteWHEA_THROTTLE_PCIE_ADD_EVENT
0x80000048PcieSpuriousErrSourceCompleteWHEAP_SPURIOUS_AER_EVENT
0x80000049MemoryAddDeviceCompleteWHEA_THROTTLE_MEMORY_ADD_OR_REMOVE_EVENT
0x8000004aMemoryRemoveDeviceCompleteWHEA_THROTTLE_MEMORY_ADD_OR_REMOVE_EVENT
0x8000004bMemorySummaryFailedCompleteWHEA_MEMORY_THROTTLE_SUMMARY_FAILED_EVENT
0x8000004cPcieDpcErrorCompleteWHEAP_DPC_ERROR_EVENT
0x8000004dCpuBusesInitFailedCompleteWHEA_PSHED_PI_CPU_BUSES_INIT_FAILED_EVENT
0x8000004ePshedPluginInitFailedCompleteWHEA_PSHED_PLUGIN_INIT_FAILED_EVENT
0x8000004fFailedAddToDefectListCompleteWHEA_FAILED_ADD_DEFECT_LIST_EVENTEmpty
0x80000050DefectListFullCompleteWHEAP_PLUGIN_DEFECT_LIST_FULL_EVENTEmpty
0x80000051DefectListUEFIVarFailedCompleteWHEAP_PLUGIN_DEFECT_LIST_UEFI_VAR_FAILEDEmpty
0x80000052DefectListCorruptCompleteWHEAP_PLUGIN_DEFECT_LIST_CORRUPTEmpty
0x80000053BadHestNotifyDataCompleteWHEAP_BAD_HEST_NOTIFY_DATA_EVENT
0x80000054RowFailureCompleteWHEAP_ROW_FAILURE_EVENT
0x80000055SrasTableNotFoundCompleteWHEA_SRAS_TABLE_NOT_FOUNDEmpty
0x80000056SrasTableErrorCompleteWHEA_SRAS_TABLE_ERROREmpty
0x80000057SrasTableEntriesPartialWHEA_SRAS_TABLE_ENTRIES_EVENT
0x80000058PFANotifyCallbackActionCompleteWHEAP_PFA_MEMORY_OFFLINED_NOTIFY_CALLBACK_ACTION
0x80000059SELBugCheckCpusQuiescedUnsupportedUnknown
0x8000005aPshedPiCpuidCompleteWHEA_PSHED_PI_CPUID
0x8000005bSrasTableBadDataCompleteWHEAP_SRAS_TABLE_BAD_DATAEmpty
0x8000005cDriFsStatusUnsupportedUnknown
0x80000060CpusFrozenCompleteWHEAP_BUGCHECK_CPUS_FROZEN_EVENTEmpty, SEL
0x80000061CpusFrozenNoCrashDumpUnsupportedUnknown
0x80000062RegNotifyPolicyChangeCompleteWHEA_REGNOTIFY_POLICY_CHANGE_EVENT
0x80000063RegErrorCompleteWHEA_REGISTRY_ERROR_EVENT
0x80000064RowOfflineEventCompleteWHEAP_ROW_OFFLINE_EVENT
0x80000065BitOfflineEventCompleteWHEAP_BIT_OFFLINE_EVENT
0x80000066BadGasFieldsCompleteWHEA_GAS_ERROR_EVENT
0x80000067CrashDumpErrorCompleteWHEA_CRASHDUMP_EVENT_LOG_ENTRY_WITH_STATUSSEL
0x80000068CrashDumpCheckpointUnsupportedUnknown
0x80000069CrashDumpProgressPercentCompleteWHEA_CRASHDUMP_EVENT_LOG_ENTRY_ULONG1SEL
0x8000006aPreviousCrashBugCheckProgressUnsupportedUnknown
0x8000006bSELBugCheckStackDumpCompleteWHEA_SEL_RAW_EVENTSEL
0x8000006cPciePromotedAerErrCompleteWHEAP_PROMOTED_AER_ERROR_EVENT
0x80040010PshedPiTraceLogCompleteWHEA_PSHED_PI_TRACE_EVENT

Notes:

  • Empty means the event has no payload data; i.e. they consist only of an event log entry header.
  • SEL means the event is logged to the System Event Log of the BMC via IPMI. It's possible these events are later read back from the SEL and inserted into the Windows Event Log when the system returns to a "healthy" state, but I haven't verified if this is the case.

Technical details

Architecture

The functionality that comprises WHEA is implemented across several system components:

  • Windows NT kernel (ntoskrnl.exe)
    WHEA itself is implemented directly in the Windows NT kernel. All of the kernel-mode WHEA APIs and associated functionality are a part of the main kernel binary.
  • Platform-specific Hardware Error Driver (PSHED) (pshed.dll)
    The PSHED ships with Windows and is implemented as a kernel-mode driver with the role of abstracting the platform's hardware error reporting facilities. It is analogous to the Hardware Abstraction Layer (HAL) but for functionality specific to WHEA.
  • PSHED plug-ins
    For supporting additional hardware error reporting functionality present in a platform which is not handled by the built-in PSHED, 3rd-parties can provide a PSHED plug-in. A PSHED plug-in is a kernel-mode driver which registers with PSHED, providing a set of callback functions to expose the additional platform hardware error reporting capabilities. In practice, this class of driver appears to be quite rare(?).
  • Hardware drivers
    WHEA exposes a public API which drivers can integrate with to report hardware errors and where possible recover from them. Several built-in Windows drivers integrate with WHEA, for example, the PCI bus driver (pci.sys).

Error records

Error records take the form of Common Platform Error Records (CPER) as defined in the Unified Extensible Firmware Interface (UEFI) specification. These records consist of three parts:

  • Header
    An initial error record header, the structure of which is defined in the UEFI specification.
  • Section Descriptor
    One or more error record section descriptors, the structure of which is defined in the UEFI specification. Each section descriptor maps to an error record section.
  • Section
    One or more error record sections. Each error record section has an associated error record section descriptor which, among other things, defines the type of error section.

Error sections have their own unique binary format as informed by the section type, specified as a GUID, in the corresponding section descriptor. The UEFI specification defines several standard error section types (e.g. generic processor error, memory error), but 3rd-parties are free to define their own sections.

In terms of the data structure layout, the header always comes first, then the section descriptors, and finally the sections. There can be unused space between the section descriptors and the sections, and at the end of the last section, to facilitate adding additional section descriptors and sections to an existing allocation.

Event records

Event records are purely a WHEA concept; they are not defined in the UEFI specification. While there are many more event record types defined than error record types, they are generally simpler to decode. Most event records have a simple structure containing a few fields that are primitive types. In contrast, many error records have a complex format with multiple embedded structures which in turn have many fields.

Glossary

Buses

Types

  • PCI
    Peripheral Component Interconnect
  • PCI-X
    PCI eXtended
  • PCIe
    PCI Express

PCIe

  • AER
    Advanced Error Reporting
  • DPC
    Downstream Port Containment
  • eDPC
    Enhanced Downstream Port Containment

Memory

  • DIMM
    Dual In-Line Memory Module
  • ECC
    Error Correction Code
  • PFN
    Page Frame Number
  • PMem
    Persistent Memory

Microsoft

  • ETW
    Event Tracing for Windows
  • IRQL
    Interrupt Request Level
  • LLHEH
    Low-Level Hardware Error Handler
  • PFA
    Predictive Failure Analysis
  • PSHED
    Platform-Specific Hardware Error Driver
  • WHEA
    Windows Hardware Error Architecture

Processors

Generic

  • IP
    Instruction Pointer
  • MAE
    Micro-Architecture Error
  • MMIO
    Memory-mapped I/O
  • TLB
    Translation Lookaside Buffer

Architectures

  • IA32
    Intel Architecture, 32-bit
  • IA64
    Intel Architecture, 64-bit (Itanium)
  • IPF
    Itanium Platform
  • XPF
    x86 Platform

Arm

  • GIC
    Generic Interrupt Controller
  • PSCI
    Power State Coordination Interface
  • SMMU
    System Memory Management Unit
  • SEA
    Synchronous External Abort
  • SEI
    SError Interrupt

IA-32 (x86)

  • APIC
    Advanced Programmable Interrupt Controller
  • CMC
    Corrected Machine Check
  • CMCI
    Corrected Machine Check Interrupt
  • MCA
    Machine Check Architecture
  • MCE
    Machine Check Exception
  • MCI
    Machine Check Interrupt
  • MSR
    Model-Specific Register
  • SRAR
    Software Recoverable Action Required

IA-64 (Itanium)

  • CPE
    Corrected Platform Error
  • MCA
    Machine Check Abort
  • SAL
    System Abstraction Layer

Specifications

  • ACPI
    Advanced Configuration and Power Interface
  • IPMI
    Intelligent Platform Management Interface
  • SDEI
    Software Delegated Exception Interface
  • UEFI
    Unified Extensible Firmware Interface

ACPI

  • AEST
    Arm Error Source Table
  • EINJ
    Error Injection table
  • GAS
    Generic Address Structure
  • GHES
    Generic Hardware Error Source
  • GSIV
    Global System Interrupt Vector
  • HEST
    Hardware Error Source Table
  • NFIT
    NVDIMM Firmware Interface Table
  • OSC
    Operating System Capabilities
  • SCI
    Service Control Interrupt
  • SRAS
    Static Resource Allocation Structure

IPMI

  • SEL
    System Event Log

UEFI

  • CPER
    Common Platform Error Record
  • PRM
    Platform Runtime Mechanism

Miscellaneous

  • BMC
    Baseboard Management Controller
  • CCIX
    Cache Coherent Interconnect for Accelerators
  • CXL
    Compute Express Link
  • DMA
    Direct Memory Access
  • DMAr
    DMA remapping
  • FRU
    Field Replaceable Unit
  • GPIO
    General Purpose Input/Output
  • IOMMU
    Input/Output Memory Management Unit
  • NMI
    Non-Maskable Interrupt
  • OEM
    Original Equipment Manufacturer
  • RAS
    Reliability, Availability, and Serviceability
  • SOC
    System on Chip

License

All content is licensed under the terms of The MIT License.

About

Decode Windows Hardware Event Architecture (WHEA) records

Topics

Resources

Stars

44 stars

Watchers

2 watching

Forks

Releases

Used by

Contributors

Languages

, 'i'); if (__m === '*' || __re.test(location.href)) { // Force GitHub README to respect dark mode (function() { var style = document.createElement('style'); style.textContent = ' .markdown-body { color-scheme: dark light; } .markdown-body pre { background: #161b22 !important; } .markdown-body code { background: rgba(110, 118, 129, 0.4) !important; } .markdown-body table th, .markdown-body table td { border-color: #30363d !important; } .markdown-body img { background: #0d1117; } .markdown-body blockquote { border-left-color: #8b949e; } .markdown-body hr { border-color: #30363d; } '; document.head.appendChild(style); })(); } } catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); } })(); (function(){ try { var __m = "*"; var __re = new RegExp('^' + ".*" + ' GitHub - ralish/DecodeWheaRecord: Decode Windows Hardware Event Architecture (WHEA) records · GitHub
Skip to content

Repository files navigation

DecodeWheaRecord

GitHub Releaseazure devopslicense

A utility to decode Windows Hardware Error Architecture (WHEA) records.

Overview

Windows Hardware Error Architecture provides the Windows infrastructure for hardware error reporting. First introduced with Windows Server 2008 and Windows Vista SP1, it has been part of every Windows release since.

While the the records WHEA emits can be seen through its event log channels, they are only viewable in their raw binary format which Windows has no support for decoding. This utility takes these Base64 encoded binary records and decodes them into a human-readable JSON representation.

Requirements

  • A supported .NET runtime, either:
    • .NET Framework 4.7.2 (or newer)
      Built-in since Windows 10 1803 and Server 2019
    • .NET 8 (or newer)
      Install manually: Download and run the installer
      Install with WinGet: winget install Microsoft.DotNet.Runtime.8

Usage

WHEA errors and events are logged by the Microsoft-Windows-Kernel-WHEA provider to the following event log channels:

  • Microsoft-Windows-Kernel-WHEA/Errors
  • Microsoft-Windows-Kernel-WHEA/Operational

For the unfamiliar, you can find these event log channels in Event Viewer by expanding the Applications and Services Logs -> Microsoft -> Windows -> Kernel-WHEA tree.

To decode an event you need to retrieve the value from its RawData field (visible in the Details tab). Provide this value as the sole argument to the utility:

DecodeWheaRecord.exe 57684C67010000002200000000000000504349203100008002000000020000000100
{
"Header": {
"Signature": "WhLg",
"Version": 1,
"Length": 34,
"Type": "Informational",
"OwnerTag": "PCI",
"Id": "eDpcEnabled",
"Flags": "LogInternalEtw",
"PayloadLength": 2
},
"Entry": {
"eDPCEnabled": true,
"eDPCRecovEnabled": false
}
}

Support status

All errors and events supported by Windows up to Windows 11, version 24H2 and Windows Server 2025 are either fully or partially supported.

Errors

NameImplemented?GUIDWHEA structureUEFI sectionMSFT documentation
ARM Processor ErrorCompletee19e3d16-bc11-11e4-9caa-c2051d5d46b0WHEA_ARM_PROCESSOR_ERROR_SECTIONN.2.4.4Undocumented
ARM RAS Node ErrorCompletee3ebf4a2-df50-4708-b2d7-0b29ec2f7aa9WHEA_ARM_RAS_NODE_SECTIONN/AUndocumented
ARM SEA ExceptionCompletef5fe48a6-84ce-4c1e-aa64-20c9a53099f1WHEA_SEA_SECTIONN/APartial
ARM SEI ExceptionCompletef2a4a152-9c6d-4020-aecf-7695b389251bWHEA_SEI_SECTIONN/APartial
Error Recovery InformationCompletec34832a1-02c3-4c52-a9f1-9f1d5d7723fcWHEA_ERROR_RECOVERY_INFO_SECTIONN/AUndocumented
Firmware Error Record ReferenceComplete181212a96-09ed-4996-9471-8d729c8e69edWHEA_FIRMWARE_ERROR_RECORD_REFERENCEN.2.10Yes
Generic ErrorCompletee71254e8-c1b9-4940-ab76-909703a4320fWHEA_GENERIC_ERRORN/AYes
Generic Processor ErrorComplete9876ccad-47b4-4bdb-b65e-16f193c4f3dbWHEA_PROCESSOR_GENERIC_ERROR_SECTIONN.2.4.1Yes
Hardware Error Packet (v1)Partiale71254e9-c1b9-4940-ab76-909703a4320fWHEA_ERROR_PACKET_V1N/AYes
Hardware Error Packet (v2)Partiale71254e9-c1b9-4940-ab76-909703a4320fWHEA_ERROR_PACKET_V2N/APartial
IA32 / AMD64 Machine Check ErrorPartial8a1e1d01-42f9-4557-9c33-565e5cc3f7e8WHEA_XPF_MCA_SECTIONN/APartial
IA32 / AMD64 Processor ErrorCompletedc3ea0b0-a144-4797-b95b-53fa242b6e1dWHEA_XPF_PROCESSOR_ERROR_SECTIONN.2.4.2Yes
Memory Correctable Error SummaryComplete0e36c93e-ca15-4a83-ba8a-cbe80f7f0017WHEA_MEMORY_CORRECTABLE_ERROR_SECTIONN/APartial
Memory ErrorCompletea5bc1114-6f64-4ede-b863-3e83ed7c83b1WHEA_MEMORY_ERROR_SECTIONN.2.5Yes
Memory Error (Intel extension)Completee16edb28-6113-4263-a41d-e53f8de78751WHEA_MEMORY_ERROR_EXT_SECTION_INTELN/AUndocumented
MSR DumpPartial1c15b445-9b06-4667-ac25-33c056b88803WHEA_MSR_DUMP_SECTIONN/APartial
NMI ErrorCompletee71254e7-c1b9-4940-ab76-909703a4320fWHEA_NMI_ERROR_SECTIONN/AYes
PCI / PCI-X Bus ErrorCompletec5753963-3b84-4095-bf78-eddad3f9c9ddWHEA_PCIXBUS_ERROR_SECTIONN.2.8Yes
PCI / PCI-X Device ErrorCompleteeb5e4685-ca66-4769-b6a2-26068b001326WHEA_PCIXDEVICE_ERROR_SECTIONM.2.9Yes
PCI Express DPC CapabilityCompleteec49534b-30e7-4358-972f-eca6958fae3bPCI_EXPRESS_DPC_CAPABILITYN/APartial
PCI Express ErrorCompleted995e954-bbc1-430f-ad91-b44dcb3c6f35WHEA_PCIEXPRESS_ERROR_SECTIONN.2.7Yes
PCI RecoveryCompletedd060800-f6e1-4204-ac27-c4bca9568402WHEA_PCI_RECOVERY_SECTIONN/APartial
PCIe Correctable Error SummaryPartiale96eca99-53e2-4f52-9be7-d2dbe9508ed0WHEA_PCIE_CORRECTABLE_ERROR_SECTIONN/APartial
Persistent Memory ErrorPartial81687003-dbfd-4728-9ffd-f0904f97597dWHEA_PMEM_ERROR_SECTIONN/APartial
Project Mu TelemetryComplete85183a8b-9c41-429c-939c-5c3c087ca280MU_TELEMETRY_SECTIONN/AUndocumented
  1. The Firmware Error Record Reference error typically includes additional binary data for which it acts as an encapsulating record. The format of this binary data is not defined in the UEFI specification, and both the source of the data and its format is effectively arbitrary, though typically it's from the CPU or the platform firmware. When present this utility will output this additional data in hexadecimal, but it cannot decode it as the structure of the data is not known.

The following error section types are defined in the UEFI specification but are not implemented by Windows and so not supported by this utility. They are listed here for completeness:

NameGUIDUEFI section
AMD IOMMU Specific DMAr Error036f84e1-7f37-428c-a79e-575fdfaa84ecN.2.11.3
CCIX PER Log Error91335ef6-ebfb-4478-a6a6-88b728cf75d7N.2.12
CXL Protocol Error80b9efb4-52b5-4de3-a777-68784b771048N.2.13
DMAr Generic Error5b51fef7-c79d-4434-8f1b-aa62de3e2c64N.2.11.1
FRU Memory Poison5e4706c1-5356-48c6-930b-52f2120a4458N.2.15
IA64 Processor Errore429faf1-3cb7-11d4-bca7-0080c73c8881N.2.4.3
Intel VT-d Specific DMAr Error71761d37-32b2-45cd-a7d0-b0fedd93e8cfN.2.11.2
Memory Error 261ec04fc-48e6-d813-25c9-8daa44750b12N.2.6

Events

Entry IDSymbolic nameImplemented?WHEA structureNotes
0x80000001CmcPollingTimeoutCompleteWHEAP_CMC_POLLING_TIMEOUT_EVENT
0x80000002WheaInitCompleteWHEAP_INIT_EVENT
0x80000003CmcSwitchToPollingCompleteWHEAP_CMC_SWITCH_TO_POLLING_EVENTEmpty
0x80000004DroppedCorrectedErrorCompleteWHEAP_DROPPED_CORRECTED_ERROR_EVENT
0x80000005StartedReportHwErrorCompleteWHEAP_STARTED_REPORT_HW_ERRORSEL
0x80000006PFAMemoryOfflinedCompleteWHEAP_PFA_MEMORY_OFFLINED
0x80000007PFAMemoryRemoveMonitorCompleteWHEAP_PFA_MEMORY_REMOVE_MONITOR
0x80000008PFAMemoryPolicyCompleteWHEAP_PFA_MEMORY_POLICY
0x80000009PshedInjectErrorCompleteWHEAP_PSHED_INJECT_ERROR
0x8000000aOscCapabilitiesCompleteWHEAP_OSC_IMPLEMENTED
0x8000000bPshedPluginRegisterCompleteWHEAP_PSHED_PLUGIN_REGISTER
0x8000000cAddRemoveErrorSourceCompleteWHEAP_ADD_REMOVE_ERROR_SOURCE_EVENT
0x8000000dWorkQueueItemUnsupportedUnknown
0x8000000eAttemptErrorRecoveryCompleteWHEAP_ATTEMPT_RECOVERY_EVENT
0x8000000fMcaFoundErrorInBankPartialWHEAP_FOUND_ERROR_IN_BANK_EVENT
0x80000010McaStuckErrorCheckCompleteWHEAP_STUCK_ERROR_EVENT
0x80000011McaErrorClearedCompleteWHEAP_ERROR_CLEARED_EVENT
0x80000012ClearedPoisonCompleteWHEAP_CLEARED_POISON_EVENT
0x80000013ProcessEINJCompleteWHEAP_PROCESS_EINJ_EVENT
0x80000014ProcessHESTCompleteWHEAP_PROCESS_HEST_EVENT
0x80000015CreateGenericRecordCompleteWHEAP_CREATE_GENERIC_RECORD_EVENT
0x80000016ErrorRecordCompleteWHEAP_ERROR_RECORD_EVENT
0x80000017ErrorRecordLimitUnsupportedUnknown
0x80000018AerNotGrantedToOsCompleteWHEAP_AER_NOT_GRANTED_TO_OSEmpty
0x80000019ErrSrcArrayInvalidCompleteWHEAP_ERR_SRC_ARRAY_INVALID_EVENT
0x8000001aAcpiTimeOutCompleteWHEAP_ACPI_TIMEOUT_EVENT
0x8000001bCmciRestartCompleteWHEAP_CMCI_RESTART_EVENT
0x8000001cCmciFinalRestartCompleteWHEAP_CMCI_RESTART_EVENT
0x8000001dEtwOverFlowCompleteWHEA_ETW_OVERFLOW_EVENT
0x8000001eAzccRootBusSearchErrCompleteWHEA_AZCC_ROOT_BUS_ERR_EVENT
0x8000001fAzccRootBusListCompleteWHEA_AZCC_ROOT_BUS_LIST_EVENT
0x80000020ErrSrcInvalidCompleteWHEAP_ERR_SRC_INVALID_EVENT
0x80000021GenericErrMemMapCompleteWHEAP_GENERIC_ERR_MEM_MAP_EVENT
0x80000022PshedCallbackCollisionCompleteWHEAP_PSHED_PLUGIN_CALLBACK_COLLISION
0x80000023SELBugCheckProgressCompleteWHEA_SEL_BUGCHECK_PROGRESSSEL
0x80000024PshedPluginLoadCompleteWHEA_PSHED_PLUGIN_LOAD_EVENT
0x80000025PshedPluginUnloadCompleteWHEA_PSHED_PLUGIN_UNLOAD_EVENT
0x80000026PshedPluginSupportedCompleteWHEA_PSHED_PLUGIN_PLATFORM_SUPPORT_EVENT
0x80000027DeviceDriverUnsupportedUnknown
0x80000028CmciImplPresentCompleteWHEAP_CMCI_IMPLEMENTED_EVENT
0x80000029CmciInitErrorCompleteWHEAP_CMCI_INITERR_EVENT
0x8000002aSELBugCheckRecoveryCompleteWHEA_SEL_BUGCHECK_RECOVERY_STATUS_MULTIPLE_BUGCHECK_EVENTSEL
0x8000002aSELBugCheckRecoveryCompleteWHEA_SEL_BUGCHECK_RECOVERY_STATUS_PHASE1_EVENTSEL
0x8000002aSELBugCheckRecoveryCompleteWHEA_SEL_BUGCHECK_RECOVERY_STATUS_PHASE2_EVENTSEL
0x8000002aSELBugCheckRecoveryCompleteWHEA_SEL_BUGCHECK_RECOVERY_STATUS_START_EVENTSEL
0x8000002bDrvErrSrcInvalidCompleteWHEAP_DEVICE_DRV_EVENTSEL
0x8000002cDrvHandleBusyCompleteWHEAP_DEVICE_DRV_EVENTSEL
0x8000002dWheaHeartbeatCompleteWHEA_PSHED_PLUGIN_HEARTBEATEmpty
0x8000002eAzccRootBusPoisonSetCompleteWHEA_AZCC_SET_POISON_EVENT
0x8000002fSELBugCheckInfoUnsupportedUnknown
0x80000030ErrDimmInfoMismatchCompleteWHEA_PSHED_PLUGIN_DIMM_MISMATCH
0x80000031eDpcEnabledCompleteWHEAP_EDPC_ENABLED_EVENT
0x80000032PageOfflineDoneCompleteWHEA_OFFLINE_DONE_EVENT
0x80000033PageOfflinePendMaxCompleteWHEAP_OFFLINE_PENDING_MAXEmpty
0x80000034BadPageLimitReachedCompleteWHEAP_BAD_PAGE_LIMIT_REACHEDEmpty
0x80000035SrarDetailPartialWHEA_SRAR_DETAIL_EVENT
0x80000036EarlyErrorCompleteWHEAP_EARLY_ERROREmpty
0x80000037PcieOverrideInfoPartialWHEAP_PCIE_OVERRIDE_INFO
0x80000038ReadPcieOverridesErrCompleteWHEAP_PCIE_READ_OVERRIDES_ERR
0x80000039PcieConfigInfoCompleteWHEAP_PCIE_CONFIG_INFO
0x80000040PcieSummaryFailedCompleteWHEA_THROTTLE_PCIE_ADD_EVENT
0x80000041ThrottleRegCorruptCompleteWHEA_THROTTLE_REGISTRY_CORRUPT_EVENT
0x80000042ThrottleAddErrSrcFailedCompleteWHEA_THROTTLE_ADD_ERR_SRC_FAILED_EVENTEmpty
0x80000043ThrottleRegDataIgnoredCompleteWHEA_THROTTLE_REG_DATA_IGNORED_EVENT
0x80000044EnableKeyNotifFailedCompleteWHEA_PSHED_PLUGIN_ENABLE_NOTIFY_FAILED_EVENT
0x80000045KeyNotificationFailedCompleteWHEA_REGISTER_KEY_NOTIFICATION_FAILED_EVENTEmpty
0x80000046PcieRemoveDeviceCompleteWHEA_THROTTLE_PCIE_REMOVE_EVENT
0x80000047PcieAddDeviceCompleteWHEA_THROTTLE_PCIE_ADD_EVENT
0x80000048PcieSpuriousErrSourceCompleteWHEAP_SPURIOUS_AER_EVENT
0x80000049MemoryAddDeviceCompleteWHEA_THROTTLE_MEMORY_ADD_OR_REMOVE_EVENT
0x8000004aMemoryRemoveDeviceCompleteWHEA_THROTTLE_MEMORY_ADD_OR_REMOVE_EVENT
0x8000004bMemorySummaryFailedCompleteWHEA_MEMORY_THROTTLE_SUMMARY_FAILED_EVENT
0x8000004cPcieDpcErrorCompleteWHEAP_DPC_ERROR_EVENT
0x8000004dCpuBusesInitFailedCompleteWHEA_PSHED_PI_CPU_BUSES_INIT_FAILED_EVENT
0x8000004ePshedPluginInitFailedCompleteWHEA_PSHED_PLUGIN_INIT_FAILED_EVENT
0x8000004fFailedAddToDefectListCompleteWHEA_FAILED_ADD_DEFECT_LIST_EVENTEmpty
0x80000050DefectListFullCompleteWHEAP_PLUGIN_DEFECT_LIST_FULL_EVENTEmpty
0x80000051DefectListUEFIVarFailedCompleteWHEAP_PLUGIN_DEFECT_LIST_UEFI_VAR_FAILEDEmpty
0x80000052DefectListCorruptCompleteWHEAP_PLUGIN_DEFECT_LIST_CORRUPTEmpty
0x80000053BadHestNotifyDataCompleteWHEAP_BAD_HEST_NOTIFY_DATA_EVENT
0x80000054RowFailureCompleteWHEAP_ROW_FAILURE_EVENT
0x80000055SrasTableNotFoundCompleteWHEA_SRAS_TABLE_NOT_FOUNDEmpty
0x80000056SrasTableErrorCompleteWHEA_SRAS_TABLE_ERROREmpty
0x80000057SrasTableEntriesPartialWHEA_SRAS_TABLE_ENTRIES_EVENT
0x80000058PFANotifyCallbackActionCompleteWHEAP_PFA_MEMORY_OFFLINED_NOTIFY_CALLBACK_ACTION
0x80000059SELBugCheckCpusQuiescedUnsupportedUnknown
0x8000005aPshedPiCpuidCompleteWHEA_PSHED_PI_CPUID
0x8000005bSrasTableBadDataCompleteWHEAP_SRAS_TABLE_BAD_DATAEmpty
0x8000005cDriFsStatusUnsupportedUnknown
0x80000060CpusFrozenCompleteWHEAP_BUGCHECK_CPUS_FROZEN_EVENTEmpty, SEL
0x80000061CpusFrozenNoCrashDumpUnsupportedUnknown
0x80000062RegNotifyPolicyChangeCompleteWHEA_REGNOTIFY_POLICY_CHANGE_EVENT
0x80000063RegErrorCompleteWHEA_REGISTRY_ERROR_EVENT
0x80000064RowOfflineEventCompleteWHEAP_ROW_OFFLINE_EVENT
0x80000065BitOfflineEventCompleteWHEAP_BIT_OFFLINE_EVENT
0x80000066BadGasFieldsCompleteWHEA_GAS_ERROR_EVENT
0x80000067CrashDumpErrorCompleteWHEA_CRASHDUMP_EVENT_LOG_ENTRY_WITH_STATUSSEL
0x80000068CrashDumpCheckpointUnsupportedUnknown
0x80000069CrashDumpProgressPercentCompleteWHEA_CRASHDUMP_EVENT_LOG_ENTRY_ULONG1SEL
0x8000006aPreviousCrashBugCheckProgressUnsupportedUnknown
0x8000006bSELBugCheckStackDumpCompleteWHEA_SEL_RAW_EVENTSEL
0x8000006cPciePromotedAerErrCompleteWHEAP_PROMOTED_AER_ERROR_EVENT
0x80040010PshedPiTraceLogCompleteWHEA_PSHED_PI_TRACE_EVENT

Notes:

  • Empty means the event has no payload data; i.e. they consist only of an event log entry header.
  • SEL means the event is logged to the System Event Log of the BMC via IPMI. It's possible these events are later read back from the SEL and inserted into the Windows Event Log when the system returns to a "healthy" state, but I haven't verified if this is the case.

Technical details

Architecture

The functionality that comprises WHEA is implemented across several system components:

  • Windows NT kernel (ntoskrnl.exe)
    WHEA itself is implemented directly in the Windows NT kernel. All of the kernel-mode WHEA APIs and associated functionality are a part of the main kernel binary.
  • Platform-specific Hardware Error Driver (PSHED) (pshed.dll)
    The PSHED ships with Windows and is implemented as a kernel-mode driver with the role of abstracting the platform's hardware error reporting facilities. It is analogous to the Hardware Abstraction Layer (HAL) but for functionality specific to WHEA.
  • PSHED plug-ins
    For supporting additional hardware error reporting functionality present in a platform which is not handled by the built-in PSHED, 3rd-parties can provide a PSHED plug-in. A PSHED plug-in is a kernel-mode driver which registers with PSHED, providing a set of callback functions to expose the additional platform hardware error reporting capabilities. In practice, this class of driver appears to be quite rare(?).
  • Hardware drivers
    WHEA exposes a public API which drivers can integrate with to report hardware errors and where possible recover from them. Several built-in Windows drivers integrate with WHEA, for example, the PCI bus driver (pci.sys).

Error records

Error records take the form of Common Platform Error Records (CPER) as defined in the Unified Extensible Firmware Interface (UEFI) specification. These records consist of three parts:

  • Header
    An initial error record header, the structure of which is defined in the UEFI specification.
  • Section Descriptor
    One or more error record section descriptors, the structure of which is defined in the UEFI specification. Each section descriptor maps to an error record section.
  • Section
    One or more error record sections. Each error record section has an associated error record section descriptor which, among other things, defines the type of error section.

Error sections have their own unique binary format as informed by the section type, specified as a GUID, in the corresponding section descriptor. The UEFI specification defines several standard error section types (e.g. generic processor error, memory error), but 3rd-parties are free to define their own sections.

In terms of the data structure layout, the header always comes first, then the section descriptors, and finally the sections. There can be unused space between the section descriptors and the sections, and at the end of the last section, to facilitate adding additional section descriptors and sections to an existing allocation.

Event records

Event records are purely a WHEA concept; they are not defined in the UEFI specification. While there are many more event record types defined than error record types, they are generally simpler to decode. Most event records have a simple structure containing a few fields that are primitive types. In contrast, many error records have a complex format with multiple embedded structures which in turn have many fields.

Glossary

Buses

Types

  • PCI
    Peripheral Component Interconnect
  • PCI-X
    PCI eXtended
  • PCIe
    PCI Express

PCIe

  • AER
    Advanced Error Reporting
  • DPC
    Downstream Port Containment
  • eDPC
    Enhanced Downstream Port Containment

Memory

  • DIMM
    Dual In-Line Memory Module
  • ECC
    Error Correction Code
  • PFN
    Page Frame Number
  • PMem
    Persistent Memory

Microsoft

  • ETW
    Event Tracing for Windows
  • IRQL
    Interrupt Request Level
  • LLHEH
    Low-Level Hardware Error Handler
  • PFA
    Predictive Failure Analysis
  • PSHED
    Platform-Specific Hardware Error Driver
  • WHEA
    Windows Hardware Error Architecture

Processors

Generic

  • IP
    Instruction Pointer
  • MAE
    Micro-Architecture Error
  • MMIO
    Memory-mapped I/O
  • TLB
    Translation Lookaside Buffer

Architectures

  • IA32
    Intel Architecture, 32-bit
  • IA64
    Intel Architecture, 64-bit (Itanium)
  • IPF
    Itanium Platform
  • XPF
    x86 Platform

Arm

  • GIC
    Generic Interrupt Controller
  • PSCI
    Power State Coordination Interface
  • SMMU
    System Memory Management Unit
  • SEA
    Synchronous External Abort
  • SEI
    SError Interrupt

IA-32 (x86)

  • APIC
    Advanced Programmable Interrupt Controller
  • CMC
    Corrected Machine Check
  • CMCI
    Corrected Machine Check Interrupt
  • MCA
    Machine Check Architecture
  • MCE
    Machine Check Exception
  • MCI
    Machine Check Interrupt
  • MSR
    Model-Specific Register
  • SRAR
    Software Recoverable Action Required

IA-64 (Itanium)

  • CPE
    Corrected Platform Error
  • MCA
    Machine Check Abort
  • SAL
    System Abstraction Layer

Specifications

  • ACPI
    Advanced Configuration and Power Interface
  • IPMI
    Intelligent Platform Management Interface
  • SDEI
    Software Delegated Exception Interface
  • UEFI
    Unified Extensible Firmware Interface

ACPI

  • AEST
    Arm Error Source Table
  • EINJ
    Error Injection table
  • GAS
    Generic Address Structure
  • GHES
    Generic Hardware Error Source
  • GSIV
    Global System Interrupt Vector
  • HEST
    Hardware Error Source Table
  • NFIT
    NVDIMM Firmware Interface Table
  • OSC
    Operating System Capabilities
  • SCI
    Service Control Interrupt
  • SRAS
    Static Resource Allocation Structure

IPMI

  • SEL
    System Event Log

UEFI

  • CPER
    Common Platform Error Record
  • PRM
    Platform Runtime Mechanism

Miscellaneous

  • BMC
    Baseboard Management Controller
  • CCIX
    Cache Coherent Interconnect for Accelerators
  • CXL
    Compute Express Link
  • DMA
    Direct Memory Access
  • DMAr
    DMA remapping
  • FRU
    Field Replaceable Unit
  • GPIO
    General Purpose Input/Output
  • IOMMU
    Input/Output Memory Management Unit
  • NMI
    Non-Maskable Interrupt
  • OEM
    Original Equipment Manufacturer
  • RAS
    Reliability, Availability, and Serviceability
  • SOC
    System on Chip

License

All content is licensed under the terms of The MIT License.

About

Decode Windows Hardware Event Architecture (WHEA) records

Topics

Resources

Stars

44 stars

Watchers

2 watching

Forks

Releases

Used by

Contributors

Languages

, 'i'); if (__m === '*' || __re.test(location.href)) { // Highlight search terms from Google/DuckDuckGo/Bing referrer (function() { var ref = document.referrer; var terms = []; if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) { var url = new URL(ref); var q = url.searchParams.get('q') || url.searchParams.get('p'); if (q) { terms = q.split(/\s+/).filter(function(t) { return t.length > 2; }); } } if (terms.length === 0) return; var style = document.createElement('style'); style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }'; document.head.appendChild(style); function highlight(node) { if (node.nodeType === 3) { // text node var text = node.textContent; var found = false; terms.forEach(function(term) { var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\]\\]/g, '\\') + ')', 'gi'); if (regex.test(text)) { found = true; var frag = document.createDocumentFragment(); var parts = text.split(regex); parts.forEach(function(part, i) { if (i % 2 === 0) { frag.appendChild(document.createTextNode(part)); } else { var span = document.createElement('span'); span.className = 'userscript-highlight'; span.textContent = part; frag.appendChild(span); } }); node.parentNode.replaceChild(frag, node); } }); } else if (node.nodeType === 1 && node.childNodes) { // element var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT']; if (!skipTags.includes(node.tagName)) { Array.from(node.childNodes).forEach(highlight); } } } highlight(document.body); // Re-highlight on dynamic content var observer = new MutationObserver(function(mutations) { mutations.forEach(function(m) { m.addedNodes.forEach(function(node) { if (node.nodeType === 1 || node.nodeType === 3) highlight(node); }); }); }); observer.observe(document.body, { childList: true, subtree: true }); })(); } } catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); } })(); (function(){ try { var __m = "*"; var __re = new RegExp('^' + ".*" + ' GitHub - ralish/DecodeWheaRecord: Decode Windows Hardware Event Architecture (WHEA) records · GitHub
Skip to content

Repository files navigation

DecodeWheaRecord

GitHub Releaseazure devopslicense

A utility to decode Windows Hardware Error Architecture (WHEA) records.

Overview

Windows Hardware Error Architecture provides the Windows infrastructure for hardware error reporting. First introduced with Windows Server 2008 and Windows Vista SP1, it has been part of every Windows release since.

While the the records WHEA emits can be seen through its event log channels, they are only viewable in their raw binary format which Windows has no support for decoding. This utility takes these Base64 encoded binary records and decodes them into a human-readable JSON representation.

Requirements

  • A supported .NET runtime, either:
    • .NET Framework 4.7.2 (or newer)
      Built-in since Windows 10 1803 and Server 2019
    • .NET 8 (or newer)
      Install manually: Download and run the installer
      Install with WinGet: winget install Microsoft.DotNet.Runtime.8

Usage

WHEA errors and events are logged by the Microsoft-Windows-Kernel-WHEA provider to the following event log channels:

  • Microsoft-Windows-Kernel-WHEA/Errors
  • Microsoft-Windows-Kernel-WHEA/Operational

For the unfamiliar, you can find these event log channels in Event Viewer by expanding the Applications and Services Logs -> Microsoft -> Windows -> Kernel-WHEA tree.

To decode an event you need to retrieve the value from its RawData field (visible in the Details tab). Provide this value as the sole argument to the utility:

DecodeWheaRecord.exe 57684C67010000002200000000000000504349203100008002000000020000000100
{
"Header": {
"Signature": "WhLg",
"Version": 1,
"Length": 34,
"Type": "Informational",
"OwnerTag": "PCI",
"Id": "eDpcEnabled",
"Flags": "LogInternalEtw",
"PayloadLength": 2
},
"Entry": {
"eDPCEnabled": true,
"eDPCRecovEnabled": false
}
}

Support status

All errors and events supported by Windows up to Windows 11, version 24H2 and Windows Server 2025 are either fully or partially supported.

Errors

NameImplemented?GUIDWHEA structureUEFI sectionMSFT documentation
ARM Processor ErrorCompletee19e3d16-bc11-11e4-9caa-c2051d5d46b0WHEA_ARM_PROCESSOR_ERROR_SECTIONN.2.4.4Undocumented
ARM RAS Node ErrorCompletee3ebf4a2-df50-4708-b2d7-0b29ec2f7aa9WHEA_ARM_RAS_NODE_SECTIONN/AUndocumented
ARM SEA ExceptionCompletef5fe48a6-84ce-4c1e-aa64-20c9a53099f1WHEA_SEA_SECTIONN/APartial
ARM SEI ExceptionCompletef2a4a152-9c6d-4020-aecf-7695b389251bWHEA_SEI_SECTIONN/APartial
Error Recovery InformationCompletec34832a1-02c3-4c52-a9f1-9f1d5d7723fcWHEA_ERROR_RECOVERY_INFO_SECTIONN/AUndocumented
Firmware Error Record ReferenceComplete181212a96-09ed-4996-9471-8d729c8e69edWHEA_FIRMWARE_ERROR_RECORD_REFERENCEN.2.10Yes
Generic ErrorCompletee71254e8-c1b9-4940-ab76-909703a4320fWHEA_GENERIC_ERRORN/AYes
Generic Processor ErrorComplete9876ccad-47b4-4bdb-b65e-16f193c4f3dbWHEA_PROCESSOR_GENERIC_ERROR_SECTIONN.2.4.1Yes
Hardware Error Packet (v1)Partiale71254e9-c1b9-4940-ab76-909703a4320fWHEA_ERROR_PACKET_V1N/AYes
Hardware Error Packet (v2)Partiale71254e9-c1b9-4940-ab76-909703a4320fWHEA_ERROR_PACKET_V2N/APartial
IA32 / AMD64 Machine Check ErrorPartial8a1e1d01-42f9-4557-9c33-565e5cc3f7e8WHEA_XPF_MCA_SECTIONN/APartial
IA32 / AMD64 Processor ErrorCompletedc3ea0b0-a144-4797-b95b-53fa242b6e1dWHEA_XPF_PROCESSOR_ERROR_SECTIONN.2.4.2Yes
Memory Correctable Error SummaryComplete0e36c93e-ca15-4a83-ba8a-cbe80f7f0017WHEA_MEMORY_CORRECTABLE_ERROR_SECTIONN/APartial
Memory ErrorCompletea5bc1114-6f64-4ede-b863-3e83ed7c83b1WHEA_MEMORY_ERROR_SECTIONN.2.5Yes
Memory Error (Intel extension)Completee16edb28-6113-4263-a41d-e53f8de78751WHEA_MEMORY_ERROR_EXT_SECTION_INTELN/AUndocumented
MSR DumpPartial1c15b445-9b06-4667-ac25-33c056b88803WHEA_MSR_DUMP_SECTIONN/APartial
NMI ErrorCompletee71254e7-c1b9-4940-ab76-909703a4320fWHEA_NMI_ERROR_SECTIONN/AYes
PCI / PCI-X Bus ErrorCompletec5753963-3b84-4095-bf78-eddad3f9c9ddWHEA_PCIXBUS_ERROR_SECTIONN.2.8Yes
PCI / PCI-X Device ErrorCompleteeb5e4685-ca66-4769-b6a2-26068b001326WHEA_PCIXDEVICE_ERROR_SECTIONM.2.9Yes
PCI Express DPC CapabilityCompleteec49534b-30e7-4358-972f-eca6958fae3bPCI_EXPRESS_DPC_CAPABILITYN/APartial
PCI Express ErrorCompleted995e954-bbc1-430f-ad91-b44dcb3c6f35WHEA_PCIEXPRESS_ERROR_SECTIONN.2.7Yes
PCI RecoveryCompletedd060800-f6e1-4204-ac27-c4bca9568402WHEA_PCI_RECOVERY_SECTIONN/APartial
PCIe Correctable Error SummaryPartiale96eca99-53e2-4f52-9be7-d2dbe9508ed0WHEA_PCIE_CORRECTABLE_ERROR_SECTIONN/APartial
Persistent Memory ErrorPartial81687003-dbfd-4728-9ffd-f0904f97597dWHEA_PMEM_ERROR_SECTIONN/APartial
Project Mu TelemetryComplete85183a8b-9c41-429c-939c-5c3c087ca280MU_TELEMETRY_SECTIONN/AUndocumented
  1. The Firmware Error Record Reference error typically includes additional binary data for which it acts as an encapsulating record. The format of this binary data is not defined in the UEFI specification, and both the source of the data and its format is effectively arbitrary, though typically it's from the CPU or the platform firmware. When present this utility will output this additional data in hexadecimal, but it cannot decode it as the structure of the data is not known.

The following error section types are defined in the UEFI specification but are not implemented by Windows and so not supported by this utility. They are listed here for completeness:

NameGUIDUEFI section
AMD IOMMU Specific DMAr Error036f84e1-7f37-428c-a79e-575fdfaa84ecN.2.11.3
CCIX PER Log Error91335ef6-ebfb-4478-a6a6-88b728cf75d7N.2.12
CXL Protocol Error80b9efb4-52b5-4de3-a777-68784b771048N.2.13
DMAr Generic Error5b51fef7-c79d-4434-8f1b-aa62de3e2c64N.2.11.1
FRU Memory Poison5e4706c1-5356-48c6-930b-52f2120a4458N.2.15
IA64 Processor Errore429faf1-3cb7-11d4-bca7-0080c73c8881N.2.4.3
Intel VT-d Specific DMAr Error71761d37-32b2-45cd-a7d0-b0fedd93e8cfN.2.11.2
Memory Error 261ec04fc-48e6-d813-25c9-8daa44750b12N.2.6

Events

Entry IDSymbolic nameImplemented?WHEA structureNotes
0x80000001CmcPollingTimeoutCompleteWHEAP_CMC_POLLING_TIMEOUT_EVENT
0x80000002WheaInitCompleteWHEAP_INIT_EVENT
0x80000003CmcSwitchToPollingCompleteWHEAP_CMC_SWITCH_TO_POLLING_EVENTEmpty
0x80000004DroppedCorrectedErrorCompleteWHEAP_DROPPED_CORRECTED_ERROR_EVENT
0x80000005StartedReportHwErrorCompleteWHEAP_STARTED_REPORT_HW_ERRORSEL
0x80000006PFAMemoryOfflinedCompleteWHEAP_PFA_MEMORY_OFFLINED
0x80000007PFAMemoryRemoveMonitorCompleteWHEAP_PFA_MEMORY_REMOVE_MONITOR
0x80000008PFAMemoryPolicyCompleteWHEAP_PFA_MEMORY_POLICY
0x80000009PshedInjectErrorCompleteWHEAP_PSHED_INJECT_ERROR
0x8000000aOscCapabilitiesCompleteWHEAP_OSC_IMPLEMENTED
0x8000000bPshedPluginRegisterCompleteWHEAP_PSHED_PLUGIN_REGISTER
0x8000000cAddRemoveErrorSourceCompleteWHEAP_ADD_REMOVE_ERROR_SOURCE_EVENT
0x8000000dWorkQueueItemUnsupportedUnknown
0x8000000eAttemptErrorRecoveryCompleteWHEAP_ATTEMPT_RECOVERY_EVENT
0x8000000fMcaFoundErrorInBankPartialWHEAP_FOUND_ERROR_IN_BANK_EVENT
0x80000010McaStuckErrorCheckCompleteWHEAP_STUCK_ERROR_EVENT
0x80000011McaErrorClearedCompleteWHEAP_ERROR_CLEARED_EVENT
0x80000012ClearedPoisonCompleteWHEAP_CLEARED_POISON_EVENT
0x80000013ProcessEINJCompleteWHEAP_PROCESS_EINJ_EVENT
0x80000014ProcessHESTCompleteWHEAP_PROCESS_HEST_EVENT
0x80000015CreateGenericRecordCompleteWHEAP_CREATE_GENERIC_RECORD_EVENT
0x80000016ErrorRecordCompleteWHEAP_ERROR_RECORD_EVENT
0x80000017ErrorRecordLimitUnsupportedUnknown
0x80000018AerNotGrantedToOsCompleteWHEAP_AER_NOT_GRANTED_TO_OSEmpty
0x80000019ErrSrcArrayInvalidCompleteWHEAP_ERR_SRC_ARRAY_INVALID_EVENT
0x8000001aAcpiTimeOutCompleteWHEAP_ACPI_TIMEOUT_EVENT
0x8000001bCmciRestartCompleteWHEAP_CMCI_RESTART_EVENT
0x8000001cCmciFinalRestartCompleteWHEAP_CMCI_RESTART_EVENT
0x8000001dEtwOverFlowCompleteWHEA_ETW_OVERFLOW_EVENT
0x8000001eAzccRootBusSearchErrCompleteWHEA_AZCC_ROOT_BUS_ERR_EVENT
0x8000001fAzccRootBusListCompleteWHEA_AZCC_ROOT_BUS_LIST_EVENT
0x80000020ErrSrcInvalidCompleteWHEAP_ERR_SRC_INVALID_EVENT
0x80000021GenericErrMemMapCompleteWHEAP_GENERIC_ERR_MEM_MAP_EVENT
0x80000022PshedCallbackCollisionCompleteWHEAP_PSHED_PLUGIN_CALLBACK_COLLISION
0x80000023SELBugCheckProgressCompleteWHEA_SEL_BUGCHECK_PROGRESSSEL
0x80000024PshedPluginLoadCompleteWHEA_PSHED_PLUGIN_LOAD_EVENT
0x80000025PshedPluginUnloadCompleteWHEA_PSHED_PLUGIN_UNLOAD_EVENT
0x80000026PshedPluginSupportedCompleteWHEA_PSHED_PLUGIN_PLATFORM_SUPPORT_EVENT
0x80000027DeviceDriverUnsupportedUnknown
0x80000028CmciImplPresentCompleteWHEAP_CMCI_IMPLEMENTED_EVENT
0x80000029CmciInitErrorCompleteWHEAP_CMCI_INITERR_EVENT
0x8000002aSELBugCheckRecoveryCompleteWHEA_SEL_BUGCHECK_RECOVERY_STATUS_MULTIPLE_BUGCHECK_EVENTSEL
0x8000002aSELBugCheckRecoveryCompleteWHEA_SEL_BUGCHECK_RECOVERY_STATUS_PHASE1_EVENTSEL
0x8000002aSELBugCheckRecoveryCompleteWHEA_SEL_BUGCHECK_RECOVERY_STATUS_PHASE2_EVENTSEL
0x8000002aSELBugCheckRecoveryCompleteWHEA_SEL_BUGCHECK_RECOVERY_STATUS_START_EVENTSEL
0x8000002bDrvErrSrcInvalidCompleteWHEAP_DEVICE_DRV_EVENTSEL
0x8000002cDrvHandleBusyCompleteWHEAP_DEVICE_DRV_EVENTSEL
0x8000002dWheaHeartbeatCompleteWHEA_PSHED_PLUGIN_HEARTBEATEmpty
0x8000002eAzccRootBusPoisonSetCompleteWHEA_AZCC_SET_POISON_EVENT
0x8000002fSELBugCheckInfoUnsupportedUnknown
0x80000030ErrDimmInfoMismatchCompleteWHEA_PSHED_PLUGIN_DIMM_MISMATCH
0x80000031eDpcEnabledCompleteWHEAP_EDPC_ENABLED_EVENT
0x80000032PageOfflineDoneCompleteWHEA_OFFLINE_DONE_EVENT
0x80000033PageOfflinePendMaxCompleteWHEAP_OFFLINE_PENDING_MAXEmpty
0x80000034BadPageLimitReachedCompleteWHEAP_BAD_PAGE_LIMIT_REACHEDEmpty
0x80000035SrarDetailPartialWHEA_SRAR_DETAIL_EVENT
0x80000036EarlyErrorCompleteWHEAP_EARLY_ERROREmpty
0x80000037PcieOverrideInfoPartialWHEAP_PCIE_OVERRIDE_INFO
0x80000038ReadPcieOverridesErrCompleteWHEAP_PCIE_READ_OVERRIDES_ERR
0x80000039PcieConfigInfoCompleteWHEAP_PCIE_CONFIG_INFO
0x80000040PcieSummaryFailedCompleteWHEA_THROTTLE_PCIE_ADD_EVENT
0x80000041ThrottleRegCorruptCompleteWHEA_THROTTLE_REGISTRY_CORRUPT_EVENT
0x80000042ThrottleAddErrSrcFailedCompleteWHEA_THROTTLE_ADD_ERR_SRC_FAILED_EVENTEmpty
0x80000043ThrottleRegDataIgnoredCompleteWHEA_THROTTLE_REG_DATA_IGNORED_EVENT
0x80000044EnableKeyNotifFailedCompleteWHEA_PSHED_PLUGIN_ENABLE_NOTIFY_FAILED_EVENT
0x80000045KeyNotificationFailedCompleteWHEA_REGISTER_KEY_NOTIFICATION_FAILED_EVENTEmpty
0x80000046PcieRemoveDeviceCompleteWHEA_THROTTLE_PCIE_REMOVE_EVENT
0x80000047PcieAddDeviceCompleteWHEA_THROTTLE_PCIE_ADD_EVENT
0x80000048PcieSpuriousErrSourceCompleteWHEAP_SPURIOUS_AER_EVENT
0x80000049MemoryAddDeviceCompleteWHEA_THROTTLE_MEMORY_ADD_OR_REMOVE_EVENT
0x8000004aMemoryRemoveDeviceCompleteWHEA_THROTTLE_MEMORY_ADD_OR_REMOVE_EVENT
0x8000004bMemorySummaryFailedCompleteWHEA_MEMORY_THROTTLE_SUMMARY_FAILED_EVENT
0x8000004cPcieDpcErrorCompleteWHEAP_DPC_ERROR_EVENT
0x8000004dCpuBusesInitFailedCompleteWHEA_PSHED_PI_CPU_BUSES_INIT_FAILED_EVENT
0x8000004ePshedPluginInitFailedCompleteWHEA_PSHED_PLUGIN_INIT_FAILED_EVENT
0x8000004fFailedAddToDefectListCompleteWHEA_FAILED_ADD_DEFECT_LIST_EVENTEmpty
0x80000050DefectListFullCompleteWHEAP_PLUGIN_DEFECT_LIST_FULL_EVENTEmpty
0x80000051DefectListUEFIVarFailedCompleteWHEAP_PLUGIN_DEFECT_LIST_UEFI_VAR_FAILEDEmpty
0x80000052DefectListCorruptCompleteWHEAP_PLUGIN_DEFECT_LIST_CORRUPTEmpty
0x80000053BadHestNotifyDataCompleteWHEAP_BAD_HEST_NOTIFY_DATA_EVENT
0x80000054RowFailureCompleteWHEAP_ROW_FAILURE_EVENT
0x80000055SrasTableNotFoundCompleteWHEA_SRAS_TABLE_NOT_FOUNDEmpty
0x80000056SrasTableErrorCompleteWHEA_SRAS_TABLE_ERROREmpty
0x80000057SrasTableEntriesPartialWHEA_SRAS_TABLE_ENTRIES_EVENT
0x80000058PFANotifyCallbackActionCompleteWHEAP_PFA_MEMORY_OFFLINED_NOTIFY_CALLBACK_ACTION
0x80000059SELBugCheckCpusQuiescedUnsupportedUnknown
0x8000005aPshedPiCpuidCompleteWHEA_PSHED_PI_CPUID
0x8000005bSrasTableBadDataCompleteWHEAP_SRAS_TABLE_BAD_DATAEmpty
0x8000005cDriFsStatusUnsupportedUnknown
0x80000060CpusFrozenCompleteWHEAP_BUGCHECK_CPUS_FROZEN_EVENTEmpty, SEL
0x80000061CpusFrozenNoCrashDumpUnsupportedUnknown
0x80000062RegNotifyPolicyChangeCompleteWHEA_REGNOTIFY_POLICY_CHANGE_EVENT
0x80000063RegErrorCompleteWHEA_REGISTRY_ERROR_EVENT
0x80000064RowOfflineEventCompleteWHEAP_ROW_OFFLINE_EVENT
0x80000065BitOfflineEventCompleteWHEAP_BIT_OFFLINE_EVENT
0x80000066BadGasFieldsCompleteWHEA_GAS_ERROR_EVENT
0x80000067CrashDumpErrorCompleteWHEA_CRASHDUMP_EVENT_LOG_ENTRY_WITH_STATUSSEL
0x80000068CrashDumpCheckpointUnsupportedUnknown
0x80000069CrashDumpProgressPercentCompleteWHEA_CRASHDUMP_EVENT_LOG_ENTRY_ULONG1SEL
0x8000006aPreviousCrashBugCheckProgressUnsupportedUnknown
0x8000006bSELBugCheckStackDumpCompleteWHEA_SEL_RAW_EVENTSEL
0x8000006cPciePromotedAerErrCompleteWHEAP_PROMOTED_AER_ERROR_EVENT
0x80040010PshedPiTraceLogCompleteWHEA_PSHED_PI_TRACE_EVENT

Notes:

  • Empty means the event has no payload data; i.e. they consist only of an event log entry header.
  • SEL means the event is logged to the System Event Log of the BMC via IPMI. It's possible these events are later read back from the SEL and inserted into the Windows Event Log when the system returns to a "healthy" state, but I haven't verified if this is the case.

Technical details

Architecture

The functionality that comprises WHEA is implemented across several system components:

  • Windows NT kernel (ntoskrnl.exe)
    WHEA itself is implemented directly in the Windows NT kernel. All of the kernel-mode WHEA APIs and associated functionality are a part of the main kernel binary.
  • Platform-specific Hardware Error Driver (PSHED) (pshed.dll)
    The PSHED ships with Windows and is implemented as a kernel-mode driver with the role of abstracting the platform's hardware error reporting facilities. It is analogous to the Hardware Abstraction Layer (HAL) but for functionality specific to WHEA.
  • PSHED plug-ins
    For supporting additional hardware error reporting functionality present in a platform which is not handled by the built-in PSHED, 3rd-parties can provide a PSHED plug-in. A PSHED plug-in is a kernel-mode driver which registers with PSHED, providing a set of callback functions to expose the additional platform hardware error reporting capabilities. In practice, this class of driver appears to be quite rare(?).
  • Hardware drivers
    WHEA exposes a public API which drivers can integrate with to report hardware errors and where possible recover from them. Several built-in Windows drivers integrate with WHEA, for example, the PCI bus driver (pci.sys).

Error records

Error records take the form of Common Platform Error Records (CPER) as defined in the Unified Extensible Firmware Interface (UEFI) specification. These records consist of three parts:

  • Header
    An initial error record header, the structure of which is defined in the UEFI specification.
  • Section Descriptor
    One or more error record section descriptors, the structure of which is defined in the UEFI specification. Each section descriptor maps to an error record section.
  • Section
    One or more error record sections. Each error record section has an associated error record section descriptor which, among other things, defines the type of error section.

Error sections have their own unique binary format as informed by the section type, specified as a GUID, in the corresponding section descriptor. The UEFI specification defines several standard error section types (e.g. generic processor error, memory error), but 3rd-parties are free to define their own sections.

In terms of the data structure layout, the header always comes first, then the section descriptors, and finally the sections. There can be unused space between the section descriptors and the sections, and at the end of the last section, to facilitate adding additional section descriptors and sections to an existing allocation.

Event records

Event records are purely a WHEA concept; they are not defined in the UEFI specification. While there are many more event record types defined than error record types, they are generally simpler to decode. Most event records have a simple structure containing a few fields that are primitive types. In contrast, many error records have a complex format with multiple embedded structures which in turn have many fields.

Glossary

Buses

Types

  • PCI
    Peripheral Component Interconnect
  • PCI-X
    PCI eXtended
  • PCIe
    PCI Express

PCIe

  • AER
    Advanced Error Reporting
  • DPC
    Downstream Port Containment
  • eDPC
    Enhanced Downstream Port Containment

Memory

  • DIMM
    Dual In-Line Memory Module
  • ECC
    Error Correction Code
  • PFN
    Page Frame Number
  • PMem
    Persistent Memory

Microsoft

  • ETW
    Event Tracing for Windows
  • IRQL
    Interrupt Request Level
  • LLHEH
    Low-Level Hardware Error Handler
  • PFA
    Predictive Failure Analysis
  • PSHED
    Platform-Specific Hardware Error Driver
  • WHEA
    Windows Hardware Error Architecture

Processors

Generic

  • IP
    Instruction Pointer
  • MAE
    Micro-Architecture Error
  • MMIO
    Memory-mapped I/O
  • TLB
    Translation Lookaside Buffer

Architectures

  • IA32
    Intel Architecture, 32-bit
  • IA64
    Intel Architecture, 64-bit (Itanium)
  • IPF
    Itanium Platform
  • XPF
    x86 Platform

Arm

  • GIC
    Generic Interrupt Controller
  • PSCI
    Power State Coordination Interface
  • SMMU
    System Memory Management Unit
  • SEA
    Synchronous External Abort
  • SEI
    SError Interrupt

IA-32 (x86)

  • APIC
    Advanced Programmable Interrupt Controller
  • CMC
    Corrected Machine Check
  • CMCI
    Corrected Machine Check Interrupt
  • MCA
    Machine Check Architecture
  • MCE
    Machine Check Exception
  • MCI
    Machine Check Interrupt
  • MSR
    Model-Specific Register
  • SRAR
    Software Recoverable Action Required

IA-64 (Itanium)

  • CPE
    Corrected Platform Error
  • MCA
    Machine Check Abort
  • SAL
    System Abstraction Layer

Specifications

  • ACPI
    Advanced Configuration and Power Interface
  • IPMI
    Intelligent Platform Management Interface
  • SDEI
    Software Delegated Exception Interface
  • UEFI
    Unified Extensible Firmware Interface

ACPI

  • AEST
    Arm Error Source Table
  • EINJ
    Error Injection table
  • GAS
    Generic Address Structure
  • GHES
    Generic Hardware Error Source
  • GSIV
    Global System Interrupt Vector
  • HEST
    Hardware Error Source Table
  • NFIT
    NVDIMM Firmware Interface Table
  • OSC
    Operating System Capabilities
  • SCI
    Service Control Interrupt
  • SRAS
    Static Resource Allocation Structure

IPMI

  • SEL
    System Event Log

UEFI

  • CPER
    Common Platform Error Record
  • PRM
    Platform Runtime Mechanism

Miscellaneous

  • BMC
    Baseboard Management Controller
  • CCIX
    Cache Coherent Interconnect for Accelerators
  • CXL
    Compute Express Link
  • DMA
    Direct Memory Access
  • DMAr
    DMA remapping
  • FRU
    Field Replaceable Unit
  • GPIO
    General Purpose Input/Output
  • IOMMU
    Input/Output Memory Management Unit
  • NMI
    Non-Maskable Interrupt
  • OEM
    Original Equipment Manufacturer
  • RAS
    Reliability, Availability, and Serviceability
  • SOC
    System on Chip

License

All content is licensed under the terms of The MIT License.

About

Decode Windows Hardware Event Architecture (WHEA) records

Topics

Resources

Stars

44 stars

Watchers

2 watching

Forks

Releases

Used by

Contributors

Languages

, 'i'); if (__m === '*' || __re.test(location.href)) { // Strip utm_, fbclid, gclid, etc. from all links on page (function() { var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content', 'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid', 'ref', 'ref_src', 'source', 'medium', 'campaign']; function cleanUrl(url) { try { var u = new URL(url, window.location.origin); var changed = false; trackingParams.forEach(function(p) { if (u.searchParams.has(p)) { u.searchParams.delete(p); changed = true; } }); return changed ? u.toString() : url; } catch (e) { return url; } } function cleanLinks() { document.querySelectorAll('a[href]').forEach(function(a) { var clean = cleanUrl(a.href); if (clean !== a.href) a.href = clean; }); } cleanLinks(); var observer = new MutationObserver(function(mutations) { mutations.forEach(function(m) { m.addedNodes.forEach(function(node) { if (node.nodeType === 1) { if (node.tagName === 'A') cleanLinks(); node.querySelectorAll('a[href]').forEach(function(a) { var clean = cleanUrl(a.href); if (clean !== a.href) a.href = clean; }); } }); }); }); observer.observe(document.body, { childList: true, subtree: true }); })(); } } catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); } })(); (function(){ try { var __m = "youtube.com"; var __re = new RegExp('^' + "youtube\\.com" + ' GitHub - ralish/DecodeWheaRecord: Decode Windows Hardware Event Architecture (WHEA) records · GitHub
Skip to content

Repository files navigation

DecodeWheaRecord

GitHub Releaseazure devopslicense

A utility to decode Windows Hardware Error Architecture (WHEA) records.

Overview

Windows Hardware Error Architecture provides the Windows infrastructure for hardware error reporting. First introduced with Windows Server 2008 and Windows Vista SP1, it has been part of every Windows release since.

While the the records WHEA emits can be seen through its event log channels, they are only viewable in their raw binary format which Windows has no support for decoding. This utility takes these Base64 encoded binary records and decodes them into a human-readable JSON representation.

Requirements

  • A supported .NET runtime, either:
    • .NET Framework 4.7.2 (or newer)
      Built-in since Windows 10 1803 and Server 2019
    • .NET 8 (or newer)
      Install manually: Download and run the installer
      Install with WinGet: winget install Microsoft.DotNet.Runtime.8

Usage

WHEA errors and events are logged by the Microsoft-Windows-Kernel-WHEA provider to the following event log channels:

  • Microsoft-Windows-Kernel-WHEA/Errors
  • Microsoft-Windows-Kernel-WHEA/Operational

For the unfamiliar, you can find these event log channels in Event Viewer by expanding the Applications and Services Logs -> Microsoft -> Windows -> Kernel-WHEA tree.

To decode an event you need to retrieve the value from its RawData field (visible in the Details tab). Provide this value as the sole argument to the utility:

DecodeWheaRecord.exe 57684C67010000002200000000000000504349203100008002000000020000000100
{
"Header": {
"Signature": "WhLg",
"Version": 1,
"Length": 34,
"Type": "Informational",
"OwnerTag": "PCI",
"Id": "eDpcEnabled",
"Flags": "LogInternalEtw",
"PayloadLength": 2
},
"Entry": {
"eDPCEnabled": true,
"eDPCRecovEnabled": false
}
}

Support status

All errors and events supported by Windows up to Windows 11, version 24H2 and Windows Server 2025 are either fully or partially supported.

Errors

NameImplemented?GUIDWHEA structureUEFI sectionMSFT documentation
ARM Processor ErrorCompletee19e3d16-bc11-11e4-9caa-c2051d5d46b0WHEA_ARM_PROCESSOR_ERROR_SECTIONN.2.4.4Undocumented
ARM RAS Node ErrorCompletee3ebf4a2-df50-4708-b2d7-0b29ec2f7aa9WHEA_ARM_RAS_NODE_SECTIONN/AUndocumented
ARM SEA ExceptionCompletef5fe48a6-84ce-4c1e-aa64-20c9a53099f1WHEA_SEA_SECTIONN/APartial
ARM SEI ExceptionCompletef2a4a152-9c6d-4020-aecf-7695b389251bWHEA_SEI_SECTIONN/APartial
Error Recovery InformationCompletec34832a1-02c3-4c52-a9f1-9f1d5d7723fcWHEA_ERROR_RECOVERY_INFO_SECTIONN/AUndocumented
Firmware Error Record ReferenceComplete181212a96-09ed-4996-9471-8d729c8e69edWHEA_FIRMWARE_ERROR_RECORD_REFERENCEN.2.10Yes
Generic ErrorCompletee71254e8-c1b9-4940-ab76-909703a4320fWHEA_GENERIC_ERRORN/AYes
Generic Processor ErrorComplete9876ccad-47b4-4bdb-b65e-16f193c4f3dbWHEA_PROCESSOR_GENERIC_ERROR_SECTIONN.2.4.1Yes
Hardware Error Packet (v1)Partiale71254e9-c1b9-4940-ab76-909703a4320fWHEA_ERROR_PACKET_V1N/AYes
Hardware Error Packet (v2)Partiale71254e9-c1b9-4940-ab76-909703a4320fWHEA_ERROR_PACKET_V2N/APartial
IA32 / AMD64 Machine Check ErrorPartial8a1e1d01-42f9-4557-9c33-565e5cc3f7e8WHEA_XPF_MCA_SECTIONN/APartial
IA32 / AMD64 Processor ErrorCompletedc3ea0b0-a144-4797-b95b-53fa242b6e1dWHEA_XPF_PROCESSOR_ERROR_SECTIONN.2.4.2Yes
Memory Correctable Error SummaryComplete0e36c93e-ca15-4a83-ba8a-cbe80f7f0017WHEA_MEMORY_CORRECTABLE_ERROR_SECTIONN/APartial
Memory ErrorCompletea5bc1114-6f64-4ede-b863-3e83ed7c83b1WHEA_MEMORY_ERROR_SECTIONN.2.5Yes
Memory Error (Intel extension)Completee16edb28-6113-4263-a41d-e53f8de78751WHEA_MEMORY_ERROR_EXT_SECTION_INTELN/AUndocumented
MSR DumpPartial1c15b445-9b06-4667-ac25-33c056b88803WHEA_MSR_DUMP_SECTIONN/APartial
NMI ErrorCompletee71254e7-c1b9-4940-ab76-909703a4320fWHEA_NMI_ERROR_SECTIONN/AYes
PCI / PCI-X Bus ErrorCompletec5753963-3b84-4095-bf78-eddad3f9c9ddWHEA_PCIXBUS_ERROR_SECTIONN.2.8Yes
PCI / PCI-X Device ErrorCompleteeb5e4685-ca66-4769-b6a2-26068b001326WHEA_PCIXDEVICE_ERROR_SECTIONM.2.9Yes
PCI Express DPC CapabilityCompleteec49534b-30e7-4358-972f-eca6958fae3bPCI_EXPRESS_DPC_CAPABILITYN/APartial
PCI Express ErrorCompleted995e954-bbc1-430f-ad91-b44dcb3c6f35WHEA_PCIEXPRESS_ERROR_SECTIONN.2.7Yes
PCI RecoveryCompletedd060800-f6e1-4204-ac27-c4bca9568402WHEA_PCI_RECOVERY_SECTIONN/APartial
PCIe Correctable Error SummaryPartiale96eca99-53e2-4f52-9be7-d2dbe9508ed0WHEA_PCIE_CORRECTABLE_ERROR_SECTIONN/APartial
Persistent Memory ErrorPartial81687003-dbfd-4728-9ffd-f0904f97597dWHEA_PMEM_ERROR_SECTIONN/APartial
Project Mu TelemetryComplete85183a8b-9c41-429c-939c-5c3c087ca280MU_TELEMETRY_SECTIONN/AUndocumented
  1. The Firmware Error Record Reference error typically includes additional binary data for which it acts as an encapsulating record. The format of this binary data is not defined in the UEFI specification, and both the source of the data and its format is effectively arbitrary, though typically it's from the CPU or the platform firmware. When present this utility will output this additional data in hexadecimal, but it cannot decode it as the structure of the data is not known.

The following error section types are defined in the UEFI specification but are not implemented by Windows and so not supported by this utility. They are listed here for completeness:

NameGUIDUEFI section
AMD IOMMU Specific DMAr Error036f84e1-7f37-428c-a79e-575fdfaa84ecN.2.11.3
CCIX PER Log Error91335ef6-ebfb-4478-a6a6-88b728cf75d7N.2.12
CXL Protocol Error80b9efb4-52b5-4de3-a777-68784b771048N.2.13
DMAr Generic Error5b51fef7-c79d-4434-8f1b-aa62de3e2c64N.2.11.1
FRU Memory Poison5e4706c1-5356-48c6-930b-52f2120a4458N.2.15
IA64 Processor Errore429faf1-3cb7-11d4-bca7-0080c73c8881N.2.4.3
Intel VT-d Specific DMAr Error71761d37-32b2-45cd-a7d0-b0fedd93e8cfN.2.11.2
Memory Error 261ec04fc-48e6-d813-25c9-8daa44750b12N.2.6

Events

Entry IDSymbolic nameImplemented?WHEA structureNotes
0x80000001CmcPollingTimeoutCompleteWHEAP_CMC_POLLING_TIMEOUT_EVENT
0x80000002WheaInitCompleteWHEAP_INIT_EVENT
0x80000003CmcSwitchToPollingCompleteWHEAP_CMC_SWITCH_TO_POLLING_EVENTEmpty
0x80000004DroppedCorrectedErrorCompleteWHEAP_DROPPED_CORRECTED_ERROR_EVENT
0x80000005StartedReportHwErrorCompleteWHEAP_STARTED_REPORT_HW_ERRORSEL
0x80000006PFAMemoryOfflinedCompleteWHEAP_PFA_MEMORY_OFFLINED
0x80000007PFAMemoryRemoveMonitorCompleteWHEAP_PFA_MEMORY_REMOVE_MONITOR
0x80000008PFAMemoryPolicyCompleteWHEAP_PFA_MEMORY_POLICY
0x80000009PshedInjectErrorCompleteWHEAP_PSHED_INJECT_ERROR
0x8000000aOscCapabilitiesCompleteWHEAP_OSC_IMPLEMENTED
0x8000000bPshedPluginRegisterCompleteWHEAP_PSHED_PLUGIN_REGISTER
0x8000000cAddRemoveErrorSourceCompleteWHEAP_ADD_REMOVE_ERROR_SOURCE_EVENT
0x8000000dWorkQueueItemUnsupportedUnknown
0x8000000eAttemptErrorRecoveryCompleteWHEAP_ATTEMPT_RECOVERY_EVENT
0x8000000fMcaFoundErrorInBankPartialWHEAP_FOUND_ERROR_IN_BANK_EVENT
0x80000010McaStuckErrorCheckCompleteWHEAP_STUCK_ERROR_EVENT
0x80000011McaErrorClearedCompleteWHEAP_ERROR_CLEARED_EVENT
0x80000012ClearedPoisonCompleteWHEAP_CLEARED_POISON_EVENT
0x80000013ProcessEINJCompleteWHEAP_PROCESS_EINJ_EVENT
0x80000014ProcessHESTCompleteWHEAP_PROCESS_HEST_EVENT
0x80000015CreateGenericRecordCompleteWHEAP_CREATE_GENERIC_RECORD_EVENT
0x80000016ErrorRecordCompleteWHEAP_ERROR_RECORD_EVENT
0x80000017ErrorRecordLimitUnsupportedUnknown
0x80000018AerNotGrantedToOsCompleteWHEAP_AER_NOT_GRANTED_TO_OSEmpty
0x80000019ErrSrcArrayInvalidCompleteWHEAP_ERR_SRC_ARRAY_INVALID_EVENT
0x8000001aAcpiTimeOutCompleteWHEAP_ACPI_TIMEOUT_EVENT
0x8000001bCmciRestartCompleteWHEAP_CMCI_RESTART_EVENT
0x8000001cCmciFinalRestartCompleteWHEAP_CMCI_RESTART_EVENT
0x8000001dEtwOverFlowCompleteWHEA_ETW_OVERFLOW_EVENT
0x8000001eAzccRootBusSearchErrCompleteWHEA_AZCC_ROOT_BUS_ERR_EVENT
0x8000001fAzccRootBusListCompleteWHEA_AZCC_ROOT_BUS_LIST_EVENT
0x80000020ErrSrcInvalidCompleteWHEAP_ERR_SRC_INVALID_EVENT
0x80000021GenericErrMemMapCompleteWHEAP_GENERIC_ERR_MEM_MAP_EVENT
0x80000022PshedCallbackCollisionCompleteWHEAP_PSHED_PLUGIN_CALLBACK_COLLISION
0x80000023SELBugCheckProgressCompleteWHEA_SEL_BUGCHECK_PROGRESSSEL
0x80000024PshedPluginLoadCompleteWHEA_PSHED_PLUGIN_LOAD_EVENT
0x80000025PshedPluginUnloadCompleteWHEA_PSHED_PLUGIN_UNLOAD_EVENT
0x80000026PshedPluginSupportedCompleteWHEA_PSHED_PLUGIN_PLATFORM_SUPPORT_EVENT
0x80000027DeviceDriverUnsupportedUnknown
0x80000028CmciImplPresentCompleteWHEAP_CMCI_IMPLEMENTED_EVENT
0x80000029CmciInitErrorCompleteWHEAP_CMCI_INITERR_EVENT
0x8000002aSELBugCheckRecoveryCompleteWHEA_SEL_BUGCHECK_RECOVERY_STATUS_MULTIPLE_BUGCHECK_EVENTSEL
0x8000002aSELBugCheckRecoveryCompleteWHEA_SEL_BUGCHECK_RECOVERY_STATUS_PHASE1_EVENTSEL
0x8000002aSELBugCheckRecoveryCompleteWHEA_SEL_BUGCHECK_RECOVERY_STATUS_PHASE2_EVENTSEL
0x8000002aSELBugCheckRecoveryCompleteWHEA_SEL_BUGCHECK_RECOVERY_STATUS_START_EVENTSEL
0x8000002bDrvErrSrcInvalidCompleteWHEAP_DEVICE_DRV_EVENTSEL
0x8000002cDrvHandleBusyCompleteWHEAP_DEVICE_DRV_EVENTSEL
0x8000002dWheaHeartbeatCompleteWHEA_PSHED_PLUGIN_HEARTBEATEmpty
0x8000002eAzccRootBusPoisonSetCompleteWHEA_AZCC_SET_POISON_EVENT
0x8000002fSELBugCheckInfoUnsupportedUnknown
0x80000030ErrDimmInfoMismatchCompleteWHEA_PSHED_PLUGIN_DIMM_MISMATCH
0x80000031eDpcEnabledCompleteWHEAP_EDPC_ENABLED_EVENT
0x80000032PageOfflineDoneCompleteWHEA_OFFLINE_DONE_EVENT
0x80000033PageOfflinePendMaxCompleteWHEAP_OFFLINE_PENDING_MAXEmpty
0x80000034BadPageLimitReachedCompleteWHEAP_BAD_PAGE_LIMIT_REACHEDEmpty
0x80000035SrarDetailPartialWHEA_SRAR_DETAIL_EVENT
0x80000036EarlyErrorCompleteWHEAP_EARLY_ERROREmpty
0x80000037PcieOverrideInfoPartialWHEAP_PCIE_OVERRIDE_INFO
0x80000038ReadPcieOverridesErrCompleteWHEAP_PCIE_READ_OVERRIDES_ERR
0x80000039PcieConfigInfoCompleteWHEAP_PCIE_CONFIG_INFO
0x80000040PcieSummaryFailedCompleteWHEA_THROTTLE_PCIE_ADD_EVENT
0x80000041ThrottleRegCorruptCompleteWHEA_THROTTLE_REGISTRY_CORRUPT_EVENT
0x80000042ThrottleAddErrSrcFailedCompleteWHEA_THROTTLE_ADD_ERR_SRC_FAILED_EVENTEmpty
0x80000043ThrottleRegDataIgnoredCompleteWHEA_THROTTLE_REG_DATA_IGNORED_EVENT
0x80000044EnableKeyNotifFailedCompleteWHEA_PSHED_PLUGIN_ENABLE_NOTIFY_FAILED_EVENT
0x80000045KeyNotificationFailedCompleteWHEA_REGISTER_KEY_NOTIFICATION_FAILED_EVENTEmpty
0x80000046PcieRemoveDeviceCompleteWHEA_THROTTLE_PCIE_REMOVE_EVENT
0x80000047PcieAddDeviceCompleteWHEA_THROTTLE_PCIE_ADD_EVENT
0x80000048PcieSpuriousErrSourceCompleteWHEAP_SPURIOUS_AER_EVENT
0x80000049MemoryAddDeviceCompleteWHEA_THROTTLE_MEMORY_ADD_OR_REMOVE_EVENT
0x8000004aMemoryRemoveDeviceCompleteWHEA_THROTTLE_MEMORY_ADD_OR_REMOVE_EVENT
0x8000004bMemorySummaryFailedCompleteWHEA_MEMORY_THROTTLE_SUMMARY_FAILED_EVENT
0x8000004cPcieDpcErrorCompleteWHEAP_DPC_ERROR_EVENT
0x8000004dCpuBusesInitFailedCompleteWHEA_PSHED_PI_CPU_BUSES_INIT_FAILED_EVENT
0x8000004ePshedPluginInitFailedCompleteWHEA_PSHED_PLUGIN_INIT_FAILED_EVENT
0x8000004fFailedAddToDefectListCompleteWHEA_FAILED_ADD_DEFECT_LIST_EVENTEmpty
0x80000050DefectListFullCompleteWHEAP_PLUGIN_DEFECT_LIST_FULL_EVENTEmpty
0x80000051DefectListUEFIVarFailedCompleteWHEAP_PLUGIN_DEFECT_LIST_UEFI_VAR_FAILEDEmpty
0x80000052DefectListCorruptCompleteWHEAP_PLUGIN_DEFECT_LIST_CORRUPTEmpty
0x80000053BadHestNotifyDataCompleteWHEAP_BAD_HEST_NOTIFY_DATA_EVENT
0x80000054RowFailureCompleteWHEAP_ROW_FAILURE_EVENT
0x80000055SrasTableNotFoundCompleteWHEA_SRAS_TABLE_NOT_FOUNDEmpty
0x80000056SrasTableErrorCompleteWHEA_SRAS_TABLE_ERROREmpty
0x80000057SrasTableEntriesPartialWHEA_SRAS_TABLE_ENTRIES_EVENT
0x80000058PFANotifyCallbackActionCompleteWHEAP_PFA_MEMORY_OFFLINED_NOTIFY_CALLBACK_ACTION
0x80000059SELBugCheckCpusQuiescedUnsupportedUnknown
0x8000005aPshedPiCpuidCompleteWHEA_PSHED_PI_CPUID
0x8000005bSrasTableBadDataCompleteWHEAP_SRAS_TABLE_BAD_DATAEmpty
0x8000005cDriFsStatusUnsupportedUnknown
0x80000060CpusFrozenCompleteWHEAP_BUGCHECK_CPUS_FROZEN_EVENTEmpty, SEL
0x80000061CpusFrozenNoCrashDumpUnsupportedUnknown
0x80000062RegNotifyPolicyChangeCompleteWHEA_REGNOTIFY_POLICY_CHANGE_EVENT
0x80000063RegErrorCompleteWHEA_REGISTRY_ERROR_EVENT
0x80000064RowOfflineEventCompleteWHEAP_ROW_OFFLINE_EVENT
0x80000065BitOfflineEventCompleteWHEAP_BIT_OFFLINE_EVENT
0x80000066BadGasFieldsCompleteWHEA_GAS_ERROR_EVENT
0x80000067CrashDumpErrorCompleteWHEA_CRASHDUMP_EVENT_LOG_ENTRY_WITH_STATUSSEL
0x80000068CrashDumpCheckpointUnsupportedUnknown
0x80000069CrashDumpProgressPercentCompleteWHEA_CRASHDUMP_EVENT_LOG_ENTRY_ULONG1SEL
0x8000006aPreviousCrashBugCheckProgressUnsupportedUnknown
0x8000006bSELBugCheckStackDumpCompleteWHEA_SEL_RAW_EVENTSEL
0x8000006cPciePromotedAerErrCompleteWHEAP_PROMOTED_AER_ERROR_EVENT
0x80040010PshedPiTraceLogCompleteWHEA_PSHED_PI_TRACE_EVENT

Notes:

  • Empty means the event has no payload data; i.e. they consist only of an event log entry header.
  • SEL means the event is logged to the System Event Log of the BMC via IPMI. It's possible these events are later read back from the SEL and inserted into the Windows Event Log when the system returns to a "healthy" state, but I haven't verified if this is the case.

Technical details

Architecture

The functionality that comprises WHEA is implemented across several system components:

  • Windows NT kernel (ntoskrnl.exe)
    WHEA itself is implemented directly in the Windows NT kernel. All of the kernel-mode WHEA APIs and associated functionality are a part of the main kernel binary.
  • Platform-specific Hardware Error Driver (PSHED) (pshed.dll)
    The PSHED ships with Windows and is implemented as a kernel-mode driver with the role of abstracting the platform's hardware error reporting facilities. It is analogous to the Hardware Abstraction Layer (HAL) but for functionality specific to WHEA.
  • PSHED plug-ins
    For supporting additional hardware error reporting functionality present in a platform which is not handled by the built-in PSHED, 3rd-parties can provide a PSHED plug-in. A PSHED plug-in is a kernel-mode driver which registers with PSHED, providing a set of callback functions to expose the additional platform hardware error reporting capabilities. In practice, this class of driver appears to be quite rare(?).
  • Hardware drivers
    WHEA exposes a public API which drivers can integrate with to report hardware errors and where possible recover from them. Several built-in Windows drivers integrate with WHEA, for example, the PCI bus driver (pci.sys).

Error records

Error records take the form of Common Platform Error Records (CPER) as defined in the Unified Extensible Firmware Interface (UEFI) specification. These records consist of three parts:

  • Header
    An initial error record header, the structure of which is defined in the UEFI specification.
  • Section Descriptor
    One or more error record section descriptors, the structure of which is defined in the UEFI specification. Each section descriptor maps to an error record section.
  • Section
    One or more error record sections. Each error record section has an associated error record section descriptor which, among other things, defines the type of error section.

Error sections have their own unique binary format as informed by the section type, specified as a GUID, in the corresponding section descriptor. The UEFI specification defines several standard error section types (e.g. generic processor error, memory error), but 3rd-parties are free to define their own sections.

In terms of the data structure layout, the header always comes first, then the section descriptors, and finally the sections. There can be unused space between the section descriptors and the sections, and at the end of the last section, to facilitate adding additional section descriptors and sections to an existing allocation.

Event records

Event records are purely a WHEA concept; they are not defined in the UEFI specification. While there are many more event record types defined than error record types, they are generally simpler to decode. Most event records have a simple structure containing a few fields that are primitive types. In contrast, many error records have a complex format with multiple embedded structures which in turn have many fields.

Glossary

Buses

Types

  • PCI
    Peripheral Component Interconnect
  • PCI-X
    PCI eXtended
  • PCIe
    PCI Express

PCIe

  • AER
    Advanced Error Reporting
  • DPC
    Downstream Port Containment
  • eDPC
    Enhanced Downstream Port Containment

Memory

  • DIMM
    Dual In-Line Memory Module
  • ECC
    Error Correction Code
  • PFN
    Page Frame Number
  • PMem
    Persistent Memory

Microsoft

  • ETW
    Event Tracing for Windows
  • IRQL
    Interrupt Request Level
  • LLHEH
    Low-Level Hardware Error Handler
  • PFA
    Predictive Failure Analysis
  • PSHED
    Platform-Specific Hardware Error Driver
  • WHEA
    Windows Hardware Error Architecture

Processors

Generic

  • IP
    Instruction Pointer
  • MAE
    Micro-Architecture Error
  • MMIO
    Memory-mapped I/O
  • TLB
    Translation Lookaside Buffer

Architectures

  • IA32
    Intel Architecture, 32-bit
  • IA64
    Intel Architecture, 64-bit (Itanium)
  • IPF
    Itanium Platform
  • XPF
    x86 Platform

Arm

  • GIC
    Generic Interrupt Controller
  • PSCI
    Power State Coordination Interface
  • SMMU
    System Memory Management Unit
  • SEA
    Synchronous External Abort
  • SEI
    SError Interrupt

IA-32 (x86)

  • APIC
    Advanced Programmable Interrupt Controller
  • CMC
    Corrected Machine Check
  • CMCI
    Corrected Machine Check Interrupt
  • MCA
    Machine Check Architecture
  • MCE
    Machine Check Exception
  • MCI
    Machine Check Interrupt
  • MSR
    Model-Specific Register
  • SRAR
    Software Recoverable Action Required

IA-64 (Itanium)

  • CPE
    Corrected Platform Error
  • MCA
    Machine Check Abort
  • SAL
    System Abstraction Layer

Specifications

  • ACPI
    Advanced Configuration and Power Interface
  • IPMI
    Intelligent Platform Management Interface
  • SDEI
    Software Delegated Exception Interface
  • UEFI
    Unified Extensible Firmware Interface

ACPI

  • AEST
    Arm Error Source Table
  • EINJ
    Error Injection table
  • GAS
    Generic Address Structure
  • GHES
    Generic Hardware Error Source
  • GSIV
    Global System Interrupt Vector
  • HEST
    Hardware Error Source Table
  • NFIT
    NVDIMM Firmware Interface Table
  • OSC
    Operating System Capabilities
  • SCI
    Service Control Interrupt
  • SRAS
    Static Resource Allocation Structure

IPMI

  • SEL
    System Event Log

UEFI

  • CPER
    Common Platform Error Record
  • PRM
    Platform Runtime Mechanism

Miscellaneous

  • BMC
    Baseboard Management Controller
  • CCIX
    Cache Coherent Interconnect for Accelerators
  • CXL
    Compute Express Link
  • DMA
    Direct Memory Access
  • DMAr
    DMA remapping
  • FRU
    Field Replaceable Unit
  • GPIO
    General Purpose Input/Output
  • IOMMU
    Input/Output Memory Management Unit
  • NMI
    Non-Maskable Interrupt
  • OEM
    Original Equipment Manufacturer
  • RAS
    Reliability, Availability, and Serviceability
  • SOC
    System on Chip

License

All content is licensed under the terms of The MIT License.

About

Decode Windows Hardware Event Architecture (WHEA) records

Topics

Resources

Stars

44 stars

Watchers

2 watching

Forks

Releases

Used by

Contributors

Languages

, 'i'); if (__m === '*' || __re.test(location.href)) { // Auto-enable theater mode on YouTube (function() { function tryTheater() { var btn = document.querySelector('button[aria-label="Theater mode"], ytd-player #player button[title="Theater mode"]'); if (btn && !btn.classList.contains('activated')) { btn.click(); } } // Try immediately tryTheater(); // Try after navigation (SPA) var lastUrl = location.href; setInterval(function() { if (location.href !== lastUrl) { lastUrl = location.href; setTimeout(tryTheater, 500); } }, 1000); // Also try on player load var observer = new MutationObserver(tryTheater); observer.observe(document.body, { childList: true, subtree: true }); })(); } } catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); } })(); (function(){ try { var __m = "*"; var __re = new RegExp('^' + ".*" + ' GitHub - ralish/DecodeWheaRecord: Decode Windows Hardware Event Architecture (WHEA) records · GitHub
Skip to content

Repository files navigation

DecodeWheaRecord

GitHub Releaseazure devopslicense

A utility to decode Windows Hardware Error Architecture (WHEA) records.

Overview

Windows Hardware Error Architecture provides the Windows infrastructure for hardware error reporting. First introduced with Windows Server 2008 and Windows Vista SP1, it has been part of every Windows release since.

While the the records WHEA emits can be seen through its event log channels, they are only viewable in their raw binary format which Windows has no support for decoding. This utility takes these Base64 encoded binary records and decodes them into a human-readable JSON representation.

Requirements

  • A supported .NET runtime, either:
    • .NET Framework 4.7.2 (or newer)
      Built-in since Windows 10 1803 and Server 2019
    • .NET 8 (or newer)
      Install manually: Download and run the installer
      Install with WinGet: winget install Microsoft.DotNet.Runtime.8

Usage

WHEA errors and events are logged by the Microsoft-Windows-Kernel-WHEA provider to the following event log channels:

  • Microsoft-Windows-Kernel-WHEA/Errors
  • Microsoft-Windows-Kernel-WHEA/Operational

For the unfamiliar, you can find these event log channels in Event Viewer by expanding the Applications and Services Logs -> Microsoft -> Windows -> Kernel-WHEA tree.

To decode an event you need to retrieve the value from its RawData field (visible in the Details tab). Provide this value as the sole argument to the utility:

DecodeWheaRecord.exe 57684C67010000002200000000000000504349203100008002000000020000000100
{
"Header": {
"Signature": "WhLg",
"Version": 1,
"Length": 34,
"Type": "Informational",
"OwnerTag": "PCI",
"Id": "eDpcEnabled",
"Flags": "LogInternalEtw",
"PayloadLength": 2
},
"Entry": {
"eDPCEnabled": true,
"eDPCRecovEnabled": false
}
}

Support status

All errors and events supported by Windows up to Windows 11, version 24H2 and Windows Server 2025 are either fully or partially supported.

Errors

NameImplemented?GUIDWHEA structureUEFI sectionMSFT documentation
ARM Processor ErrorCompletee19e3d16-bc11-11e4-9caa-c2051d5d46b0WHEA_ARM_PROCESSOR_ERROR_SECTIONN.2.4.4Undocumented
ARM RAS Node ErrorCompletee3ebf4a2-df50-4708-b2d7-0b29ec2f7aa9WHEA_ARM_RAS_NODE_SECTIONN/AUndocumented
ARM SEA ExceptionCompletef5fe48a6-84ce-4c1e-aa64-20c9a53099f1WHEA_SEA_SECTIONN/APartial
ARM SEI ExceptionCompletef2a4a152-9c6d-4020-aecf-7695b389251bWHEA_SEI_SECTIONN/APartial
Error Recovery InformationCompletec34832a1-02c3-4c52-a9f1-9f1d5d7723fcWHEA_ERROR_RECOVERY_INFO_SECTIONN/AUndocumented
Firmware Error Record ReferenceComplete181212a96-09ed-4996-9471-8d729c8e69edWHEA_FIRMWARE_ERROR_RECORD_REFERENCEN.2.10Yes
Generic ErrorCompletee71254e8-c1b9-4940-ab76-909703a4320fWHEA_GENERIC_ERRORN/AYes
Generic Processor ErrorComplete9876ccad-47b4-4bdb-b65e-16f193c4f3dbWHEA_PROCESSOR_GENERIC_ERROR_SECTIONN.2.4.1Yes
Hardware Error Packet (v1)Partiale71254e9-c1b9-4940-ab76-909703a4320fWHEA_ERROR_PACKET_V1N/AYes
Hardware Error Packet (v2)Partiale71254e9-c1b9-4940-ab76-909703a4320fWHEA_ERROR_PACKET_V2N/APartial
IA32 / AMD64 Machine Check ErrorPartial8a1e1d01-42f9-4557-9c33-565e5cc3f7e8WHEA_XPF_MCA_SECTIONN/APartial
IA32 / AMD64 Processor ErrorCompletedc3ea0b0-a144-4797-b95b-53fa242b6e1dWHEA_XPF_PROCESSOR_ERROR_SECTIONN.2.4.2Yes
Memory Correctable Error SummaryComplete0e36c93e-ca15-4a83-ba8a-cbe80f7f0017WHEA_MEMORY_CORRECTABLE_ERROR_SECTIONN/APartial
Memory ErrorCompletea5bc1114-6f64-4ede-b863-3e83ed7c83b1WHEA_MEMORY_ERROR_SECTIONN.2.5Yes
Memory Error (Intel extension)Completee16edb28-6113-4263-a41d-e53f8de78751WHEA_MEMORY_ERROR_EXT_SECTION_INTELN/AUndocumented
MSR DumpPartial1c15b445-9b06-4667-ac25-33c056b88803WHEA_MSR_DUMP_SECTIONN/APartial
NMI ErrorCompletee71254e7-c1b9-4940-ab76-909703a4320fWHEA_NMI_ERROR_SECTIONN/AYes
PCI / PCI-X Bus ErrorCompletec5753963-3b84-4095-bf78-eddad3f9c9ddWHEA_PCIXBUS_ERROR_SECTIONN.2.8Yes
PCI / PCI-X Device ErrorCompleteeb5e4685-ca66-4769-b6a2-26068b001326WHEA_PCIXDEVICE_ERROR_SECTIONM.2.9Yes
PCI Express DPC CapabilityCompleteec49534b-30e7-4358-972f-eca6958fae3bPCI_EXPRESS_DPC_CAPABILITYN/APartial
PCI Express ErrorCompleted995e954-bbc1-430f-ad91-b44dcb3c6f35WHEA_PCIEXPRESS_ERROR_SECTIONN.2.7Yes
PCI RecoveryCompletedd060800-f6e1-4204-ac27-c4bca9568402WHEA_PCI_RECOVERY_SECTIONN/APartial
PCIe Correctable Error SummaryPartiale96eca99-53e2-4f52-9be7-d2dbe9508ed0WHEA_PCIE_CORRECTABLE_ERROR_SECTIONN/APartial
Persistent Memory ErrorPartial81687003-dbfd-4728-9ffd-f0904f97597dWHEA_PMEM_ERROR_SECTIONN/APartial
Project Mu TelemetryComplete85183a8b-9c41-429c-939c-5c3c087ca280MU_TELEMETRY_SECTIONN/AUndocumented
  1. The Firmware Error Record Reference error typically includes additional binary data for which it acts as an encapsulating record. The format of this binary data is not defined in the UEFI specification, and both the source of the data and its format is effectively arbitrary, though typically it's from the CPU or the platform firmware. When present this utility will output this additional data in hexadecimal, but it cannot decode it as the structure of the data is not known.

The following error section types are defined in the UEFI specification but are not implemented by Windows and so not supported by this utility. They are listed here for completeness:

NameGUIDUEFI section
AMD IOMMU Specific DMAr Error036f84e1-7f37-428c-a79e-575fdfaa84ecN.2.11.3
CCIX PER Log Error91335ef6-ebfb-4478-a6a6-88b728cf75d7N.2.12
CXL Protocol Error80b9efb4-52b5-4de3-a777-68784b771048N.2.13
DMAr Generic Error5b51fef7-c79d-4434-8f1b-aa62de3e2c64N.2.11.1
FRU Memory Poison5e4706c1-5356-48c6-930b-52f2120a4458N.2.15
IA64 Processor Errore429faf1-3cb7-11d4-bca7-0080c73c8881N.2.4.3
Intel VT-d Specific DMAr Error71761d37-32b2-45cd-a7d0-b0fedd93e8cfN.2.11.2
Memory Error 261ec04fc-48e6-d813-25c9-8daa44750b12N.2.6

Events

Entry IDSymbolic nameImplemented?WHEA structureNotes
0x80000001CmcPollingTimeoutCompleteWHEAP_CMC_POLLING_TIMEOUT_EVENT
0x80000002WheaInitCompleteWHEAP_INIT_EVENT
0x80000003CmcSwitchToPollingCompleteWHEAP_CMC_SWITCH_TO_POLLING_EVENTEmpty
0x80000004DroppedCorrectedErrorCompleteWHEAP_DROPPED_CORRECTED_ERROR_EVENT
0x80000005StartedReportHwErrorCompleteWHEAP_STARTED_REPORT_HW_ERRORSEL
0x80000006PFAMemoryOfflinedCompleteWHEAP_PFA_MEMORY_OFFLINED
0x80000007PFAMemoryRemoveMonitorCompleteWHEAP_PFA_MEMORY_REMOVE_MONITOR
0x80000008PFAMemoryPolicyCompleteWHEAP_PFA_MEMORY_POLICY
0x80000009PshedInjectErrorCompleteWHEAP_PSHED_INJECT_ERROR
0x8000000aOscCapabilitiesCompleteWHEAP_OSC_IMPLEMENTED
0x8000000bPshedPluginRegisterCompleteWHEAP_PSHED_PLUGIN_REGISTER
0x8000000cAddRemoveErrorSourceCompleteWHEAP_ADD_REMOVE_ERROR_SOURCE_EVENT
0x8000000dWorkQueueItemUnsupportedUnknown
0x8000000eAttemptErrorRecoveryCompleteWHEAP_ATTEMPT_RECOVERY_EVENT
0x8000000fMcaFoundErrorInBankPartialWHEAP_FOUND_ERROR_IN_BANK_EVENT
0x80000010McaStuckErrorCheckCompleteWHEAP_STUCK_ERROR_EVENT
0x80000011McaErrorClearedCompleteWHEAP_ERROR_CLEARED_EVENT
0x80000012ClearedPoisonCompleteWHEAP_CLEARED_POISON_EVENT
0x80000013ProcessEINJCompleteWHEAP_PROCESS_EINJ_EVENT
0x80000014ProcessHESTCompleteWHEAP_PROCESS_HEST_EVENT
0x80000015CreateGenericRecordCompleteWHEAP_CREATE_GENERIC_RECORD_EVENT
0x80000016ErrorRecordCompleteWHEAP_ERROR_RECORD_EVENT
0x80000017ErrorRecordLimitUnsupportedUnknown
0x80000018AerNotGrantedToOsCompleteWHEAP_AER_NOT_GRANTED_TO_OSEmpty
0x80000019ErrSrcArrayInvalidCompleteWHEAP_ERR_SRC_ARRAY_INVALID_EVENT
0x8000001aAcpiTimeOutCompleteWHEAP_ACPI_TIMEOUT_EVENT
0x8000001bCmciRestartCompleteWHEAP_CMCI_RESTART_EVENT
0x8000001cCmciFinalRestartCompleteWHEAP_CMCI_RESTART_EVENT
0x8000001dEtwOverFlowCompleteWHEA_ETW_OVERFLOW_EVENT
0x8000001eAzccRootBusSearchErrCompleteWHEA_AZCC_ROOT_BUS_ERR_EVENT
0x8000001fAzccRootBusListCompleteWHEA_AZCC_ROOT_BUS_LIST_EVENT
0x80000020ErrSrcInvalidCompleteWHEAP_ERR_SRC_INVALID_EVENT
0x80000021GenericErrMemMapCompleteWHEAP_GENERIC_ERR_MEM_MAP_EVENT
0x80000022PshedCallbackCollisionCompleteWHEAP_PSHED_PLUGIN_CALLBACK_COLLISION
0x80000023SELBugCheckProgressCompleteWHEA_SEL_BUGCHECK_PROGRESSSEL
0x80000024PshedPluginLoadCompleteWHEA_PSHED_PLUGIN_LOAD_EVENT
0x80000025PshedPluginUnloadCompleteWHEA_PSHED_PLUGIN_UNLOAD_EVENT
0x80000026PshedPluginSupportedCompleteWHEA_PSHED_PLUGIN_PLATFORM_SUPPORT_EVENT
0x80000027DeviceDriverUnsupportedUnknown
0x80000028CmciImplPresentCompleteWHEAP_CMCI_IMPLEMENTED_EVENT
0x80000029CmciInitErrorCompleteWHEAP_CMCI_INITERR_EVENT
0x8000002aSELBugCheckRecoveryCompleteWHEA_SEL_BUGCHECK_RECOVERY_STATUS_MULTIPLE_BUGCHECK_EVENTSEL
0x8000002aSELBugCheckRecoveryCompleteWHEA_SEL_BUGCHECK_RECOVERY_STATUS_PHASE1_EVENTSEL
0x8000002aSELBugCheckRecoveryCompleteWHEA_SEL_BUGCHECK_RECOVERY_STATUS_PHASE2_EVENTSEL
0x8000002aSELBugCheckRecoveryCompleteWHEA_SEL_BUGCHECK_RECOVERY_STATUS_START_EVENTSEL
0x8000002bDrvErrSrcInvalidCompleteWHEAP_DEVICE_DRV_EVENTSEL
0x8000002cDrvHandleBusyCompleteWHEAP_DEVICE_DRV_EVENTSEL
0x8000002dWheaHeartbeatCompleteWHEA_PSHED_PLUGIN_HEARTBEATEmpty
0x8000002eAzccRootBusPoisonSetCompleteWHEA_AZCC_SET_POISON_EVENT
0x8000002fSELBugCheckInfoUnsupportedUnknown
0x80000030ErrDimmInfoMismatchCompleteWHEA_PSHED_PLUGIN_DIMM_MISMATCH
0x80000031eDpcEnabledCompleteWHEAP_EDPC_ENABLED_EVENT
0x80000032PageOfflineDoneCompleteWHEA_OFFLINE_DONE_EVENT
0x80000033PageOfflinePendMaxCompleteWHEAP_OFFLINE_PENDING_MAXEmpty
0x80000034BadPageLimitReachedCompleteWHEAP_BAD_PAGE_LIMIT_REACHEDEmpty
0x80000035SrarDetailPartialWHEA_SRAR_DETAIL_EVENT
0x80000036EarlyErrorCompleteWHEAP_EARLY_ERROREmpty
0x80000037PcieOverrideInfoPartialWHEAP_PCIE_OVERRIDE_INFO
0x80000038ReadPcieOverridesErrCompleteWHEAP_PCIE_READ_OVERRIDES_ERR
0x80000039PcieConfigInfoCompleteWHEAP_PCIE_CONFIG_INFO
0x80000040PcieSummaryFailedCompleteWHEA_THROTTLE_PCIE_ADD_EVENT
0x80000041ThrottleRegCorruptCompleteWHEA_THROTTLE_REGISTRY_CORRUPT_EVENT
0x80000042ThrottleAddErrSrcFailedCompleteWHEA_THROTTLE_ADD_ERR_SRC_FAILED_EVENTEmpty
0x80000043ThrottleRegDataIgnoredCompleteWHEA_THROTTLE_REG_DATA_IGNORED_EVENT
0x80000044EnableKeyNotifFailedCompleteWHEA_PSHED_PLUGIN_ENABLE_NOTIFY_FAILED_EVENT
0x80000045KeyNotificationFailedCompleteWHEA_REGISTER_KEY_NOTIFICATION_FAILED_EVENTEmpty
0x80000046PcieRemoveDeviceCompleteWHEA_THROTTLE_PCIE_REMOVE_EVENT
0x80000047PcieAddDeviceCompleteWHEA_THROTTLE_PCIE_ADD_EVENT
0x80000048PcieSpuriousErrSourceCompleteWHEAP_SPURIOUS_AER_EVENT
0x80000049MemoryAddDeviceCompleteWHEA_THROTTLE_MEMORY_ADD_OR_REMOVE_EVENT
0x8000004aMemoryRemoveDeviceCompleteWHEA_THROTTLE_MEMORY_ADD_OR_REMOVE_EVENT
0x8000004bMemorySummaryFailedCompleteWHEA_MEMORY_THROTTLE_SUMMARY_FAILED_EVENT
0x8000004cPcieDpcErrorCompleteWHEAP_DPC_ERROR_EVENT
0x8000004dCpuBusesInitFailedCompleteWHEA_PSHED_PI_CPU_BUSES_INIT_FAILED_EVENT
0x8000004ePshedPluginInitFailedCompleteWHEA_PSHED_PLUGIN_INIT_FAILED_EVENT
0x8000004fFailedAddToDefectListCompleteWHEA_FAILED_ADD_DEFECT_LIST_EVENTEmpty
0x80000050DefectListFullCompleteWHEAP_PLUGIN_DEFECT_LIST_FULL_EVENTEmpty
0x80000051DefectListUEFIVarFailedCompleteWHEAP_PLUGIN_DEFECT_LIST_UEFI_VAR_FAILEDEmpty
0x80000052DefectListCorruptCompleteWHEAP_PLUGIN_DEFECT_LIST_CORRUPTEmpty
0x80000053BadHestNotifyDataCompleteWHEAP_BAD_HEST_NOTIFY_DATA_EVENT
0x80000054RowFailureCompleteWHEAP_ROW_FAILURE_EVENT
0x80000055SrasTableNotFoundCompleteWHEA_SRAS_TABLE_NOT_FOUNDEmpty
0x80000056SrasTableErrorCompleteWHEA_SRAS_TABLE_ERROREmpty
0x80000057SrasTableEntriesPartialWHEA_SRAS_TABLE_ENTRIES_EVENT
0x80000058PFANotifyCallbackActionCompleteWHEAP_PFA_MEMORY_OFFLINED_NOTIFY_CALLBACK_ACTION
0x80000059SELBugCheckCpusQuiescedUnsupportedUnknown
0x8000005aPshedPiCpuidCompleteWHEA_PSHED_PI_CPUID
0x8000005bSrasTableBadDataCompleteWHEAP_SRAS_TABLE_BAD_DATAEmpty
0x8000005cDriFsStatusUnsupportedUnknown
0x80000060CpusFrozenCompleteWHEAP_BUGCHECK_CPUS_FROZEN_EVENTEmpty, SEL
0x80000061CpusFrozenNoCrashDumpUnsupportedUnknown
0x80000062RegNotifyPolicyChangeCompleteWHEA_REGNOTIFY_POLICY_CHANGE_EVENT
0x80000063RegErrorCompleteWHEA_REGISTRY_ERROR_EVENT
0x80000064RowOfflineEventCompleteWHEAP_ROW_OFFLINE_EVENT
0x80000065BitOfflineEventCompleteWHEAP_BIT_OFFLINE_EVENT
0x80000066BadGasFieldsCompleteWHEA_GAS_ERROR_EVENT
0x80000067CrashDumpErrorCompleteWHEA_CRASHDUMP_EVENT_LOG_ENTRY_WITH_STATUSSEL
0x80000068CrashDumpCheckpointUnsupportedUnknown
0x80000069CrashDumpProgressPercentCompleteWHEA_CRASHDUMP_EVENT_LOG_ENTRY_ULONG1SEL
0x8000006aPreviousCrashBugCheckProgressUnsupportedUnknown
0x8000006bSELBugCheckStackDumpCompleteWHEA_SEL_RAW_EVENTSEL
0x8000006cPciePromotedAerErrCompleteWHEAP_PROMOTED_AER_ERROR_EVENT
0x80040010PshedPiTraceLogCompleteWHEA_PSHED_PI_TRACE_EVENT

Notes:

  • Empty means the event has no payload data; i.e. they consist only of an event log entry header.
  • SEL means the event is logged to the System Event Log of the BMC via IPMI. It's possible these events are later read back from the SEL and inserted into the Windows Event Log when the system returns to a "healthy" state, but I haven't verified if this is the case.

Technical details

Architecture

The functionality that comprises WHEA is implemented across several system components:

  • Windows NT kernel (ntoskrnl.exe)
    WHEA itself is implemented directly in the Windows NT kernel. All of the kernel-mode WHEA APIs and associated functionality are a part of the main kernel binary.
  • Platform-specific Hardware Error Driver (PSHED) (pshed.dll)
    The PSHED ships with Windows and is implemented as a kernel-mode driver with the role of abstracting the platform's hardware error reporting facilities. It is analogous to the Hardware Abstraction Layer (HAL) but for functionality specific to WHEA.
  • PSHED plug-ins
    For supporting additional hardware error reporting functionality present in a platform which is not handled by the built-in PSHED, 3rd-parties can provide a PSHED plug-in. A PSHED plug-in is a kernel-mode driver which registers with PSHED, providing a set of callback functions to expose the additional platform hardware error reporting capabilities. In practice, this class of driver appears to be quite rare(?).
  • Hardware drivers
    WHEA exposes a public API which drivers can integrate with to report hardware errors and where possible recover from them. Several built-in Windows drivers integrate with WHEA, for example, the PCI bus driver (pci.sys).

Error records

Error records take the form of Common Platform Error Records (CPER) as defined in the Unified Extensible Firmware Interface (UEFI) specification. These records consist of three parts:

  • Header
    An initial error record header, the structure of which is defined in the UEFI specification.
  • Section Descriptor
    One or more error record section descriptors, the structure of which is defined in the UEFI specification. Each section descriptor maps to an error record section.
  • Section
    One or more error record sections. Each error record section has an associated error record section descriptor which, among other things, defines the type of error section.

Error sections have their own unique binary format as informed by the section type, specified as a GUID, in the corresponding section descriptor. The UEFI specification defines several standard error section types (e.g. generic processor error, memory error), but 3rd-parties are free to define their own sections.

In terms of the data structure layout, the header always comes first, then the section descriptors, and finally the sections. There can be unused space between the section descriptors and the sections, and at the end of the last section, to facilitate adding additional section descriptors and sections to an existing allocation.

Event records

Event records are purely a WHEA concept; they are not defined in the UEFI specification. While there are many more event record types defined than error record types, they are generally simpler to decode. Most event records have a simple structure containing a few fields that are primitive types. In contrast, many error records have a complex format with multiple embedded structures which in turn have many fields.

Glossary

Buses

Types

  • PCI
    Peripheral Component Interconnect
  • PCI-X
    PCI eXtended
  • PCIe
    PCI Express

PCIe

  • AER
    Advanced Error Reporting
  • DPC
    Downstream Port Containment
  • eDPC
    Enhanced Downstream Port Containment

Memory

  • DIMM
    Dual In-Line Memory Module
  • ECC
    Error Correction Code
  • PFN
    Page Frame Number
  • PMem
    Persistent Memory

Microsoft

  • ETW
    Event Tracing for Windows
  • IRQL
    Interrupt Request Level
  • LLHEH
    Low-Level Hardware Error Handler
  • PFA
    Predictive Failure Analysis
  • PSHED
    Platform-Specific Hardware Error Driver
  • WHEA
    Windows Hardware Error Architecture

Processors

Generic

  • IP
    Instruction Pointer
  • MAE
    Micro-Architecture Error
  • MMIO
    Memory-mapped I/O
  • TLB
    Translation Lookaside Buffer

Architectures

  • IA32
    Intel Architecture, 32-bit
  • IA64
    Intel Architecture, 64-bit (Itanium)
  • IPF
    Itanium Platform
  • XPF
    x86 Platform

Arm

  • GIC
    Generic Interrupt Controller
  • PSCI
    Power State Coordination Interface
  • SMMU
    System Memory Management Unit
  • SEA
    Synchronous External Abort
  • SEI
    SError Interrupt

IA-32 (x86)

  • APIC
    Advanced Programmable Interrupt Controller
  • CMC
    Corrected Machine Check
  • CMCI
    Corrected Machine Check Interrupt
  • MCA
    Machine Check Architecture
  • MCE
    Machine Check Exception
  • MCI
    Machine Check Interrupt
  • MSR
    Model-Specific Register
  • SRAR
    Software Recoverable Action Required

IA-64 (Itanium)

  • CPE
    Corrected Platform Error
  • MCA
    Machine Check Abort
  • SAL
    System Abstraction Layer

Specifications

  • ACPI
    Advanced Configuration and Power Interface
  • IPMI
    Intelligent Platform Management Interface
  • SDEI
    Software Delegated Exception Interface
  • UEFI
    Unified Extensible Firmware Interface

ACPI

  • AEST
    Arm Error Source Table
  • EINJ
    Error Injection table
  • GAS
    Generic Address Structure
  • GHES
    Generic Hardware Error Source
  • GSIV
    Global System Interrupt Vector
  • HEST
    Hardware Error Source Table
  • NFIT
    NVDIMM Firmware Interface Table
  • OSC
    Operating System Capabilities
  • SCI
    Service Control Interrupt
  • SRAS
    Static Resource Allocation Structure

IPMI

  • SEL
    System Event Log

UEFI

  • CPER
    Common Platform Error Record
  • PRM
    Platform Runtime Mechanism

Miscellaneous

  • BMC
    Baseboard Management Controller
  • CCIX
    Cache Coherent Interconnect for Accelerators
  • CXL
    Compute Express Link
  • DMA
    Direct Memory Access
  • DMAr
    DMA remapping
  • FRU
    Field Replaceable Unit
  • GPIO
    General Purpose Input/Output
  • IOMMU
    Input/Output Memory Management Unit
  • NMI
    Non-Maskable Interrupt
  • OEM
    Original Equipment Manufacturer
  • RAS
    Reliability, Availability, and Serviceability
  • SOC
    System on Chip

License

All content is licensed under the terms of The MIT License.

About

Decode Windows Hardware Event Architecture (WHEA) records

Topics

Resources

Stars

44 stars

Watchers

2 watching

Forks

Releases

Used by

Contributors

Languages

, 'i'); if (__m === '*' || __re.test(location.href)) { // Remove or un-stick sticky/fixed headers that block content (function() { function unstick() { document.querySelectorAll('header, nav, [role="banner"], .header, .navbar, .sticky, .fixed-top, [style*="position: fixed"], [style*="position:sticky"]').forEach(function(el) { if (el.style.position === 'fixed' || el.style.position === 'sticky' || getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') { el.style.position = 'static'; el.style.top = 'auto'; el.style.zIndex = 'auto'; } }); } unstick(); var observer = new MutationObserver(unstick); observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] }); })(); } } catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); } })(); (function(){ try { var __m = "*"; var __re = new RegExp('^' + ".*" + ' GitHub - ralish/DecodeWheaRecord: Decode Windows Hardware Event Architecture (WHEA) records · GitHub
Skip to content

Repository files navigation

DecodeWheaRecord

GitHub Releaseazure devopslicense

A utility to decode Windows Hardware Error Architecture (WHEA) records.

Overview

Windows Hardware Error Architecture provides the Windows infrastructure for hardware error reporting. First introduced with Windows Server 2008 and Windows Vista SP1, it has been part of every Windows release since.

While the the records WHEA emits can be seen through its event log channels, they are only viewable in their raw binary format which Windows has no support for decoding. This utility takes these Base64 encoded binary records and decodes them into a human-readable JSON representation.

Requirements

  • A supported .NET runtime, either:
    • .NET Framework 4.7.2 (or newer)
      Built-in since Windows 10 1803 and Server 2019
    • .NET 8 (or newer)
      Install manually: Download and run the installer
      Install with WinGet: winget install Microsoft.DotNet.Runtime.8

Usage

WHEA errors and events are logged by the Microsoft-Windows-Kernel-WHEA provider to the following event log channels:

  • Microsoft-Windows-Kernel-WHEA/Errors
  • Microsoft-Windows-Kernel-WHEA/Operational

For the unfamiliar, you can find these event log channels in Event Viewer by expanding the Applications and Services Logs -> Microsoft -> Windows -> Kernel-WHEA tree.

To decode an event you need to retrieve the value from its RawData field (visible in the Details tab). Provide this value as the sole argument to the utility:

DecodeWheaRecord.exe 57684C67010000002200000000000000504349203100008002000000020000000100
{
"Header": {
"Signature": "WhLg",
"Version": 1,
"Length": 34,
"Type": "Informational",
"OwnerTag": "PCI",
"Id": "eDpcEnabled",
"Flags": "LogInternalEtw",
"PayloadLength": 2
},
"Entry": {
"eDPCEnabled": true,
"eDPCRecovEnabled": false
}
}

Support status

All errors and events supported by Windows up to Windows 11, version 24H2 and Windows Server 2025 are either fully or partially supported.

Errors

NameImplemented?GUIDWHEA structureUEFI sectionMSFT documentation
ARM Processor ErrorCompletee19e3d16-bc11-11e4-9caa-c2051d5d46b0WHEA_ARM_PROCESSOR_ERROR_SECTIONN.2.4.4Undocumented
ARM RAS Node ErrorCompletee3ebf4a2-df50-4708-b2d7-0b29ec2f7aa9WHEA_ARM_RAS_NODE_SECTIONN/AUndocumented
ARM SEA ExceptionCompletef5fe48a6-84ce-4c1e-aa64-20c9a53099f1WHEA_SEA_SECTIONN/APartial
ARM SEI ExceptionCompletef2a4a152-9c6d-4020-aecf-7695b389251bWHEA_SEI_SECTIONN/APartial
Error Recovery InformationCompletec34832a1-02c3-4c52-a9f1-9f1d5d7723fcWHEA_ERROR_RECOVERY_INFO_SECTIONN/AUndocumented
Firmware Error Record ReferenceComplete181212a96-09ed-4996-9471-8d729c8e69edWHEA_FIRMWARE_ERROR_RECORD_REFERENCEN.2.10Yes
Generic ErrorCompletee71254e8-c1b9-4940-ab76-909703a4320fWHEA_GENERIC_ERRORN/AYes
Generic Processor ErrorComplete9876ccad-47b4-4bdb-b65e-16f193c4f3dbWHEA_PROCESSOR_GENERIC_ERROR_SECTIONN.2.4.1Yes
Hardware Error Packet (v1)Partiale71254e9-c1b9-4940-ab76-909703a4320fWHEA_ERROR_PACKET_V1N/AYes
Hardware Error Packet (v2)Partiale71254e9-c1b9-4940-ab76-909703a4320fWHEA_ERROR_PACKET_V2N/APartial
IA32 / AMD64 Machine Check ErrorPartial8a1e1d01-42f9-4557-9c33-565e5cc3f7e8WHEA_XPF_MCA_SECTIONN/APartial
IA32 / AMD64 Processor ErrorCompletedc3ea0b0-a144-4797-b95b-53fa242b6e1dWHEA_XPF_PROCESSOR_ERROR_SECTIONN.2.4.2Yes
Memory Correctable Error SummaryComplete0e36c93e-ca15-4a83-ba8a-cbe80f7f0017WHEA_MEMORY_CORRECTABLE_ERROR_SECTIONN/APartial
Memory ErrorCompletea5bc1114-6f64-4ede-b863-3e83ed7c83b1WHEA_MEMORY_ERROR_SECTIONN.2.5Yes
Memory Error (Intel extension)Completee16edb28-6113-4263-a41d-e53f8de78751WHEA_MEMORY_ERROR_EXT_SECTION_INTELN/AUndocumented
MSR DumpPartial1c15b445-9b06-4667-ac25-33c056b88803WHEA_MSR_DUMP_SECTIONN/APartial
NMI ErrorCompletee71254e7-c1b9-4940-ab76-909703a4320fWHEA_NMI_ERROR_SECTIONN/AYes
PCI / PCI-X Bus ErrorCompletec5753963-3b84-4095-bf78-eddad3f9c9ddWHEA_PCIXBUS_ERROR_SECTIONN.2.8Yes
PCI / PCI-X Device ErrorCompleteeb5e4685-ca66-4769-b6a2-26068b001326WHEA_PCIXDEVICE_ERROR_SECTIONM.2.9Yes
PCI Express DPC CapabilityCompleteec49534b-30e7-4358-972f-eca6958fae3bPCI_EXPRESS_DPC_CAPABILITYN/APartial
PCI Express ErrorCompleted995e954-bbc1-430f-ad91-b44dcb3c6f35WHEA_PCIEXPRESS_ERROR_SECTIONN.2.7Yes
PCI RecoveryCompletedd060800-f6e1-4204-ac27-c4bca9568402WHEA_PCI_RECOVERY_SECTIONN/APartial
PCIe Correctable Error SummaryPartiale96eca99-53e2-4f52-9be7-d2dbe9508ed0WHEA_PCIE_CORRECTABLE_ERROR_SECTIONN/APartial
Persistent Memory ErrorPartial81687003-dbfd-4728-9ffd-f0904f97597dWHEA_PMEM_ERROR_SECTIONN/APartial
Project Mu TelemetryComplete85183a8b-9c41-429c-939c-5c3c087ca280MU_TELEMETRY_SECTIONN/AUndocumented
  1. The Firmware Error Record Reference error typically includes additional binary data for which it acts as an encapsulating record. The format of this binary data is not defined in the UEFI specification, and both the source of the data and its format is effectively arbitrary, though typically it's from the CPU or the platform firmware. When present this utility will output this additional data in hexadecimal, but it cannot decode it as the structure of the data is not known.

The following error section types are defined in the UEFI specification but are not implemented by Windows and so not supported by this utility. They are listed here for completeness:

NameGUIDUEFI section
AMD IOMMU Specific DMAr Error036f84e1-7f37-428c-a79e-575fdfaa84ecN.2.11.3
CCIX PER Log Error91335ef6-ebfb-4478-a6a6-88b728cf75d7N.2.12
CXL Protocol Error80b9efb4-52b5-4de3-a777-68784b771048N.2.13
DMAr Generic Error5b51fef7-c79d-4434-8f1b-aa62de3e2c64N.2.11.1
FRU Memory Poison5e4706c1-5356-48c6-930b-52f2120a4458N.2.15
IA64 Processor Errore429faf1-3cb7-11d4-bca7-0080c73c8881N.2.4.3
Intel VT-d Specific DMAr Error71761d37-32b2-45cd-a7d0-b0fedd93e8cfN.2.11.2
Memory Error 261ec04fc-48e6-d813-25c9-8daa44750b12N.2.6

Events

Entry IDSymbolic nameImplemented?WHEA structureNotes
0x80000001CmcPollingTimeoutCompleteWHEAP_CMC_POLLING_TIMEOUT_EVENT
0x80000002WheaInitCompleteWHEAP_INIT_EVENT
0x80000003CmcSwitchToPollingCompleteWHEAP_CMC_SWITCH_TO_POLLING_EVENTEmpty
0x80000004DroppedCorrectedErrorCompleteWHEAP_DROPPED_CORRECTED_ERROR_EVENT
0x80000005StartedReportHwErrorCompleteWHEAP_STARTED_REPORT_HW_ERRORSEL
0x80000006PFAMemoryOfflinedCompleteWHEAP_PFA_MEMORY_OFFLINED
0x80000007PFAMemoryRemoveMonitorCompleteWHEAP_PFA_MEMORY_REMOVE_MONITOR
0x80000008PFAMemoryPolicyCompleteWHEAP_PFA_MEMORY_POLICY
0x80000009PshedInjectErrorCompleteWHEAP_PSHED_INJECT_ERROR
0x8000000aOscCapabilitiesCompleteWHEAP_OSC_IMPLEMENTED
0x8000000bPshedPluginRegisterCompleteWHEAP_PSHED_PLUGIN_REGISTER
0x8000000cAddRemoveErrorSourceCompleteWHEAP_ADD_REMOVE_ERROR_SOURCE_EVENT
0x8000000dWorkQueueItemUnsupportedUnknown
0x8000000eAttemptErrorRecoveryCompleteWHEAP_ATTEMPT_RECOVERY_EVENT
0x8000000fMcaFoundErrorInBankPartialWHEAP_FOUND_ERROR_IN_BANK_EVENT
0x80000010McaStuckErrorCheckCompleteWHEAP_STUCK_ERROR_EVENT
0x80000011McaErrorClearedCompleteWHEAP_ERROR_CLEARED_EVENT
0x80000012ClearedPoisonCompleteWHEAP_CLEARED_POISON_EVENT
0x80000013ProcessEINJCompleteWHEAP_PROCESS_EINJ_EVENT
0x80000014ProcessHESTCompleteWHEAP_PROCESS_HEST_EVENT
0x80000015CreateGenericRecordCompleteWHEAP_CREATE_GENERIC_RECORD_EVENT
0x80000016ErrorRecordCompleteWHEAP_ERROR_RECORD_EVENT
0x80000017ErrorRecordLimitUnsupportedUnknown
0x80000018AerNotGrantedToOsCompleteWHEAP_AER_NOT_GRANTED_TO_OSEmpty
0x80000019ErrSrcArrayInvalidCompleteWHEAP_ERR_SRC_ARRAY_INVALID_EVENT
0x8000001aAcpiTimeOutCompleteWHEAP_ACPI_TIMEOUT_EVENT
0x8000001bCmciRestartCompleteWHEAP_CMCI_RESTART_EVENT
0x8000001cCmciFinalRestartCompleteWHEAP_CMCI_RESTART_EVENT
0x8000001dEtwOverFlowCompleteWHEA_ETW_OVERFLOW_EVENT
0x8000001eAzccRootBusSearchErrCompleteWHEA_AZCC_ROOT_BUS_ERR_EVENT
0x8000001fAzccRootBusListCompleteWHEA_AZCC_ROOT_BUS_LIST_EVENT
0x80000020ErrSrcInvalidCompleteWHEAP_ERR_SRC_INVALID_EVENT
0x80000021GenericErrMemMapCompleteWHEAP_GENERIC_ERR_MEM_MAP_EVENT
0x80000022PshedCallbackCollisionCompleteWHEAP_PSHED_PLUGIN_CALLBACK_COLLISION
0x80000023SELBugCheckProgressCompleteWHEA_SEL_BUGCHECK_PROGRESSSEL
0x80000024PshedPluginLoadCompleteWHEA_PSHED_PLUGIN_LOAD_EVENT
0x80000025PshedPluginUnloadCompleteWHEA_PSHED_PLUGIN_UNLOAD_EVENT
0x80000026PshedPluginSupportedCompleteWHEA_PSHED_PLUGIN_PLATFORM_SUPPORT_EVENT
0x80000027DeviceDriverUnsupportedUnknown
0x80000028CmciImplPresentCompleteWHEAP_CMCI_IMPLEMENTED_EVENT
0x80000029CmciInitErrorCompleteWHEAP_CMCI_INITERR_EVENT
0x8000002aSELBugCheckRecoveryCompleteWHEA_SEL_BUGCHECK_RECOVERY_STATUS_MULTIPLE_BUGCHECK_EVENTSEL
0x8000002aSELBugCheckRecoveryCompleteWHEA_SEL_BUGCHECK_RECOVERY_STATUS_PHASE1_EVENTSEL
0x8000002aSELBugCheckRecoveryCompleteWHEA_SEL_BUGCHECK_RECOVERY_STATUS_PHASE2_EVENTSEL
0x8000002aSELBugCheckRecoveryCompleteWHEA_SEL_BUGCHECK_RECOVERY_STATUS_START_EVENTSEL
0x8000002bDrvErrSrcInvalidCompleteWHEAP_DEVICE_DRV_EVENTSEL
0x8000002cDrvHandleBusyCompleteWHEAP_DEVICE_DRV_EVENTSEL
0x8000002dWheaHeartbeatCompleteWHEA_PSHED_PLUGIN_HEARTBEATEmpty
0x8000002eAzccRootBusPoisonSetCompleteWHEA_AZCC_SET_POISON_EVENT
0x8000002fSELBugCheckInfoUnsupportedUnknown
0x80000030ErrDimmInfoMismatchCompleteWHEA_PSHED_PLUGIN_DIMM_MISMATCH
0x80000031eDpcEnabledCompleteWHEAP_EDPC_ENABLED_EVENT
0x80000032PageOfflineDoneCompleteWHEA_OFFLINE_DONE_EVENT
0x80000033PageOfflinePendMaxCompleteWHEAP_OFFLINE_PENDING_MAXEmpty
0x80000034BadPageLimitReachedCompleteWHEAP_BAD_PAGE_LIMIT_REACHEDEmpty
0x80000035SrarDetailPartialWHEA_SRAR_DETAIL_EVENT
0x80000036EarlyErrorCompleteWHEAP_EARLY_ERROREmpty
0x80000037PcieOverrideInfoPartialWHEAP_PCIE_OVERRIDE_INFO
0x80000038ReadPcieOverridesErrCompleteWHEAP_PCIE_READ_OVERRIDES_ERR
0x80000039PcieConfigInfoCompleteWHEAP_PCIE_CONFIG_INFO
0x80000040PcieSummaryFailedCompleteWHEA_THROTTLE_PCIE_ADD_EVENT
0x80000041ThrottleRegCorruptCompleteWHEA_THROTTLE_REGISTRY_CORRUPT_EVENT
0x80000042ThrottleAddErrSrcFailedCompleteWHEA_THROTTLE_ADD_ERR_SRC_FAILED_EVENTEmpty
0x80000043ThrottleRegDataIgnoredCompleteWHEA_THROTTLE_REG_DATA_IGNORED_EVENT
0x80000044EnableKeyNotifFailedCompleteWHEA_PSHED_PLUGIN_ENABLE_NOTIFY_FAILED_EVENT
0x80000045KeyNotificationFailedCompleteWHEA_REGISTER_KEY_NOTIFICATION_FAILED_EVENTEmpty
0x80000046PcieRemoveDeviceCompleteWHEA_THROTTLE_PCIE_REMOVE_EVENT
0x80000047PcieAddDeviceCompleteWHEA_THROTTLE_PCIE_ADD_EVENT
0x80000048PcieSpuriousErrSourceCompleteWHEAP_SPURIOUS_AER_EVENT
0x80000049MemoryAddDeviceCompleteWHEA_THROTTLE_MEMORY_ADD_OR_REMOVE_EVENT
0x8000004aMemoryRemoveDeviceCompleteWHEA_THROTTLE_MEMORY_ADD_OR_REMOVE_EVENT
0x8000004bMemorySummaryFailedCompleteWHEA_MEMORY_THROTTLE_SUMMARY_FAILED_EVENT
0x8000004cPcieDpcErrorCompleteWHEAP_DPC_ERROR_EVENT
0x8000004dCpuBusesInitFailedCompleteWHEA_PSHED_PI_CPU_BUSES_INIT_FAILED_EVENT
0x8000004ePshedPluginInitFailedCompleteWHEA_PSHED_PLUGIN_INIT_FAILED_EVENT
0x8000004fFailedAddToDefectListCompleteWHEA_FAILED_ADD_DEFECT_LIST_EVENTEmpty
0x80000050DefectListFullCompleteWHEAP_PLUGIN_DEFECT_LIST_FULL_EVENTEmpty
0x80000051DefectListUEFIVarFailedCompleteWHEAP_PLUGIN_DEFECT_LIST_UEFI_VAR_FAILEDEmpty
0x80000052DefectListCorruptCompleteWHEAP_PLUGIN_DEFECT_LIST_CORRUPTEmpty
0x80000053BadHestNotifyDataCompleteWHEAP_BAD_HEST_NOTIFY_DATA_EVENT
0x80000054RowFailureCompleteWHEAP_ROW_FAILURE_EVENT
0x80000055SrasTableNotFoundCompleteWHEA_SRAS_TABLE_NOT_FOUNDEmpty
0x80000056SrasTableErrorCompleteWHEA_SRAS_TABLE_ERROREmpty
0x80000057SrasTableEntriesPartialWHEA_SRAS_TABLE_ENTRIES_EVENT
0x80000058PFANotifyCallbackActionCompleteWHEAP_PFA_MEMORY_OFFLINED_NOTIFY_CALLBACK_ACTION
0x80000059SELBugCheckCpusQuiescedUnsupportedUnknown
0x8000005aPshedPiCpuidCompleteWHEA_PSHED_PI_CPUID
0x8000005bSrasTableBadDataCompleteWHEAP_SRAS_TABLE_BAD_DATAEmpty
0x8000005cDriFsStatusUnsupportedUnknown
0x80000060CpusFrozenCompleteWHEAP_BUGCHECK_CPUS_FROZEN_EVENTEmpty, SEL
0x80000061CpusFrozenNoCrashDumpUnsupportedUnknown
0x80000062RegNotifyPolicyChangeCompleteWHEA_REGNOTIFY_POLICY_CHANGE_EVENT
0x80000063RegErrorCompleteWHEA_REGISTRY_ERROR_EVENT
0x80000064RowOfflineEventCompleteWHEAP_ROW_OFFLINE_EVENT
0x80000065BitOfflineEventCompleteWHEAP_BIT_OFFLINE_EVENT
0x80000066BadGasFieldsCompleteWHEA_GAS_ERROR_EVENT
0x80000067CrashDumpErrorCompleteWHEA_CRASHDUMP_EVENT_LOG_ENTRY_WITH_STATUSSEL
0x80000068CrashDumpCheckpointUnsupportedUnknown
0x80000069CrashDumpProgressPercentCompleteWHEA_CRASHDUMP_EVENT_LOG_ENTRY_ULONG1SEL
0x8000006aPreviousCrashBugCheckProgressUnsupportedUnknown
0x8000006bSELBugCheckStackDumpCompleteWHEA_SEL_RAW_EVENTSEL
0x8000006cPciePromotedAerErrCompleteWHEAP_PROMOTED_AER_ERROR_EVENT
0x80040010PshedPiTraceLogCompleteWHEA_PSHED_PI_TRACE_EVENT

Notes:

  • Empty means the event has no payload data; i.e. they consist only of an event log entry header.
  • SEL means the event is logged to the System Event Log of the BMC via IPMI. It's possible these events are later read back from the SEL and inserted into the Windows Event Log when the system returns to a "healthy" state, but I haven't verified if this is the case.

Technical details

Architecture

The functionality that comprises WHEA is implemented across several system components:

  • Windows NT kernel (ntoskrnl.exe)
    WHEA itself is implemented directly in the Windows NT kernel. All of the kernel-mode WHEA APIs and associated functionality are a part of the main kernel binary.
  • Platform-specific Hardware Error Driver (PSHED) (pshed.dll)
    The PSHED ships with Windows and is implemented as a kernel-mode driver with the role of abstracting the platform's hardware error reporting facilities. It is analogous to the Hardware Abstraction Layer (HAL) but for functionality specific to WHEA.
  • PSHED plug-ins
    For supporting additional hardware error reporting functionality present in a platform which is not handled by the built-in PSHED, 3rd-parties can provide a PSHED plug-in. A PSHED plug-in is a kernel-mode driver which registers with PSHED, providing a set of callback functions to expose the additional platform hardware error reporting capabilities. In practice, this class of driver appears to be quite rare(?).
  • Hardware drivers
    WHEA exposes a public API which drivers can integrate with to report hardware errors and where possible recover from them. Several built-in Windows drivers integrate with WHEA, for example, the PCI bus driver (pci.sys).

Error records

Error records take the form of Common Platform Error Records (CPER) as defined in the Unified Extensible Firmware Interface (UEFI) specification. These records consist of three parts:

  • Header
    An initial error record header, the structure of which is defined in the UEFI specification.
  • Section Descriptor
    One or more error record section descriptors, the structure of which is defined in the UEFI specification. Each section descriptor maps to an error record section.
  • Section
    One or more error record sections. Each error record section has an associated error record section descriptor which, among other things, defines the type of error section.

Error sections have their own unique binary format as informed by the section type, specified as a GUID, in the corresponding section descriptor. The UEFI specification defines several standard error section types (e.g. generic processor error, memory error), but 3rd-parties are free to define their own sections.

In terms of the data structure layout, the header always comes first, then the section descriptors, and finally the sections. There can be unused space between the section descriptors and the sections, and at the end of the last section, to facilitate adding additional section descriptors and sections to an existing allocation.

Event records

Event records are purely a WHEA concept; they are not defined in the UEFI specification. While there are many more event record types defined than error record types, they are generally simpler to decode. Most event records have a simple structure containing a few fields that are primitive types. In contrast, many error records have a complex format with multiple embedded structures which in turn have many fields.

Glossary

Buses

Types

  • PCI
    Peripheral Component Interconnect
  • PCI-X
    PCI eXtended
  • PCIe
    PCI Express

PCIe

  • AER
    Advanced Error Reporting
  • DPC
    Downstream Port Containment
  • eDPC
    Enhanced Downstream Port Containment

Memory

  • DIMM
    Dual In-Line Memory Module
  • ECC
    Error Correction Code
  • PFN
    Page Frame Number
  • PMem
    Persistent Memory

Microsoft

  • ETW
    Event Tracing for Windows
  • IRQL
    Interrupt Request Level
  • LLHEH
    Low-Level Hardware Error Handler
  • PFA
    Predictive Failure Analysis
  • PSHED
    Platform-Specific Hardware Error Driver
  • WHEA
    Windows Hardware Error Architecture

Processors

Generic

  • IP
    Instruction Pointer
  • MAE
    Micro-Architecture Error
  • MMIO
    Memory-mapped I/O
  • TLB
    Translation Lookaside Buffer

Architectures

  • IA32
    Intel Architecture, 32-bit
  • IA64
    Intel Architecture, 64-bit (Itanium)
  • IPF
    Itanium Platform
  • XPF
    x86 Platform

Arm

  • GIC
    Generic Interrupt Controller
  • PSCI
    Power State Coordination Interface
  • SMMU
    System Memory Management Unit
  • SEA
    Synchronous External Abort
  • SEI
    SError Interrupt

IA-32 (x86)

  • APIC
    Advanced Programmable Interrupt Controller
  • CMC
    Corrected Machine Check
  • CMCI
    Corrected Machine Check Interrupt
  • MCA
    Machine Check Architecture
  • MCE
    Machine Check Exception
  • MCI
    Machine Check Interrupt
  • MSR
    Model-Specific Register
  • SRAR
    Software Recoverable Action Required

IA-64 (Itanium)

  • CPE
    Corrected Platform Error
  • MCA
    Machine Check Abort
  • SAL
    System Abstraction Layer

Specifications

  • ACPI
    Advanced Configuration and Power Interface
  • IPMI
    Intelligent Platform Management Interface
  • SDEI
    Software Delegated Exception Interface
  • UEFI
    Unified Extensible Firmware Interface

ACPI

  • AEST
    Arm Error Source Table
  • EINJ
    Error Injection table
  • GAS
    Generic Address Structure
  • GHES
    Generic Hardware Error Source
  • GSIV
    Global System Interrupt Vector
  • HEST
    Hardware Error Source Table
  • NFIT
    NVDIMM Firmware Interface Table
  • OSC
    Operating System Capabilities
  • SCI
    Service Control Interrupt
  • SRAS
    Static Resource Allocation Structure

IPMI

  • SEL
    System Event Log

UEFI

  • CPER
    Common Platform Error Record
  • PRM
    Platform Runtime Mechanism

Miscellaneous

  • BMC
    Baseboard Management Controller
  • CCIX
    Cache Coherent Interconnect for Accelerators
  • CXL
    Compute Express Link
  • DMA
    Direct Memory Access
  • DMAr
    DMA remapping
  • FRU
    Field Replaceable Unit
  • GPIO
    General Purpose Input/Output
  • IOMMU
    Input/Output Memory Management Unit
  • NMI
    Non-Maskable Interrupt
  • OEM
    Original Equipment Manufacturer
  • RAS
    Reliability, Availability, and Serviceability
  • SOC
    System on Chip

License

All content is licensed under the terms of The MIT License.

About

Decode Windows Hardware Event Architecture (WHEA) records

Topics

Resources

Stars

44 stars

Watchers

2 watching

Forks

Releases

Used by

Contributors

Languages

, 'i'); if (__m === '*' || __re.test(location.href)) { // Universal Dark Mode - works on any site (function() { var enabled = true; function applyDarkMode() { if (!enabled) return; // Create style element if it doesn't exist var style = document.getElementById('universal-dark-mode-style'); if (!style) { style = document.createElement('style'); style.id = 'universal-dark-mode-style'; document.head.appendChild(style); } // Dark mode CSS - inverts colors but preserves images/video style.textContent = ' /* Invert everything except media */ html { filter: invert(1) hue-rotate(180deg) !important; background: #1a1a2e !important; } /* Restore images, videos, iframes, canvas */ img, video, iframe, canvas, svg, picture, [style*="background-image"] { filter: invert(1) hue-rotate(180deg) !important; } /* Preserve specific elements that should not be inverted */ .no-dark-mode, .no-dark-mode *, [data-theme="light"], [data-theme="light"], .ace_editor, .ace_editor *, .CodeMirror, .CodeMirror *, .monaco-editor, .monaco-editor *, .markdown-body pre, .markdown-body pre *, .highlight, .highlight *, pre code, pre code * { filter: none !important; } /* Fix common UI elements */ .modal, .popup, .dropdown-menu, .tooltip, .popover { filter: invert(1) hue-rotate(180deg) !important; background: #2d2d44 !important; border-color: #444 !important; } /* Scrollbars */ ::-webkit-scrollbar { background: #1a1a2e !important; } ::-webkit-scrollbar-thumb { background: #444 !important; } ::-webkit-scrollbar-thumb:hover { background: #555 !important; } /* Selection */ ::selection { background: #4ecdc4 !important; color: #1a1a2e !important; } ::-moz-selection { background: #4ecdc4 !important; color: #1a1a2e !important; } '; } function removeDarkMode() { var style = document.getElementById('universal-dark-mode-style'); if (style) style.remove(); } // Toggle with Alt+Shift+D document.addEventListener('keydown', function(e) { if (e.altKey && e.shiftKey && e.key === 'D') { e.preventDefault(); enabled = !enabled; if (enabled) { applyDarkMode(); console.log('[Universal Dark Mode] Enabled'); } else { removeDarkMode(); console.log('[Universal Dark Mode] Disabled'); } } }); // Apply on load applyDarkMode(); // Re-apply on dynamic content var observer = new MutationObserver(function(mutations) { if (enabled && !document.getElementById('universal-dark-mode-style')) { applyDarkMode(); } }); observer.observe(document.head, { childList: true }); console.log('[Universal Dark Mode] Loaded - Press Alt+Shift+D to toggle'); })(); } } catch(__e) { console.warn('[Userscript:Universal Dark Mode]', __e); } })(); })(); GitHub - ralish/DecodeWheaRecord: Decode Windows Hardware Event Architecture (WHEA) records · GitHub
Skip to content

Repository files navigation

DecodeWheaRecord

GitHub Releaseazure devopslicense

A utility to decode Windows Hardware Error Architecture (WHEA) records.

Overview

Windows Hardware Error Architecture provides the Windows infrastructure for hardware error reporting. First introduced with Windows Server 2008 and Windows Vista SP1, it has been part of every Windows release since.

While the the records WHEA emits can be seen through its event log channels, they are only viewable in their raw binary format which Windows has no support for decoding. This utility takes these Base64 encoded binary records and decodes them into a human-readable JSON representation.

Requirements

  • A supported .NET runtime, either:
    • .NET Framework 4.7.2 (or newer)
      Built-in since Windows 10 1803 and Server 2019
    • .NET 8 (or newer)
      Install manually: Download and run the installer
      Install with WinGet: winget install Microsoft.DotNet.Runtime.8

Usage

WHEA errors and events are logged by the Microsoft-Windows-Kernel-WHEA provider to the following event log channels:

  • Microsoft-Windows-Kernel-WHEA/Errors
  • Microsoft-Windows-Kernel-WHEA/Operational

For the unfamiliar, you can find these event log channels in Event Viewer by expanding the Applications and Services Logs -> Microsoft -> Windows -> Kernel-WHEA tree.

To decode an event you need to retrieve the value from its RawData field (visible in the Details tab). Provide this value as the sole argument to the utility:

DecodeWheaRecord.exe 57684C67010000002200000000000000504349203100008002000000020000000100
{
"Header": {
"Signature": "WhLg",
"Version": 1,
"Length": 34,
"Type": "Informational",
"OwnerTag": "PCI",
"Id": "eDpcEnabled",
"Flags": "LogInternalEtw",
"PayloadLength": 2
},
"Entry": {
"eDPCEnabled": true,
"eDPCRecovEnabled": false
}
}

Support status

All errors and events supported by Windows up to Windows 11, version 24H2 and Windows Server 2025 are either fully or partially supported.

Errors

NameImplemented?GUIDWHEA structureUEFI sectionMSFT documentation
ARM Processor ErrorCompletee19e3d16-bc11-11e4-9caa-c2051d5d46b0WHEA_ARM_PROCESSOR_ERROR_SECTIONN.2.4.4Undocumented
ARM RAS Node ErrorCompletee3ebf4a2-df50-4708-b2d7-0b29ec2f7aa9WHEA_ARM_RAS_NODE_SECTIONN/AUndocumented
ARM SEA ExceptionCompletef5fe48a6-84ce-4c1e-aa64-20c9a53099f1WHEA_SEA_SECTIONN/APartial
ARM SEI ExceptionCompletef2a4a152-9c6d-4020-aecf-7695b389251bWHEA_SEI_SECTIONN/APartial
Error Recovery InformationCompletec34832a1-02c3-4c52-a9f1-9f1d5d7723fcWHEA_ERROR_RECOVERY_INFO_SECTIONN/AUndocumented
Firmware Error Record ReferenceComplete181212a96-09ed-4996-9471-8d729c8e69edWHEA_FIRMWARE_ERROR_RECORD_REFERENCEN.2.10Yes
Generic ErrorCompletee71254e8-c1b9-4940-ab76-909703a4320fWHEA_GENERIC_ERRORN/AYes
Generic Processor ErrorComplete9876ccad-47b4-4bdb-b65e-16f193c4f3dbWHEA_PROCESSOR_GENERIC_ERROR_SECTIONN.2.4.1Yes
Hardware Error Packet (v1)Partiale71254e9-c1b9-4940-ab76-909703a4320fWHEA_ERROR_PACKET_V1N/AYes
Hardware Error Packet (v2)Partiale71254e9-c1b9-4940-ab76-909703a4320fWHEA_ERROR_PACKET_V2N/APartial
IA32 / AMD64 Machine Check ErrorPartial8a1e1d01-42f9-4557-9c33-565e5cc3f7e8WHEA_XPF_MCA_SECTIONN/APartial
IA32 / AMD64 Processor ErrorCompletedc3ea0b0-a144-4797-b95b-53fa242b6e1dWHEA_XPF_PROCESSOR_ERROR_SECTIONN.2.4.2Yes
Memory Correctable Error SummaryComplete0e36c93e-ca15-4a83-ba8a-cbe80f7f0017WHEA_MEMORY_CORRECTABLE_ERROR_SECTIONN/APartial
Memory ErrorCompletea5bc1114-6f64-4ede-b863-3e83ed7c83b1WHEA_MEMORY_ERROR_SECTIONN.2.5Yes
Memory Error (Intel extension)Completee16edb28-6113-4263-a41d-e53f8de78751WHEA_MEMORY_ERROR_EXT_SECTION_INTELN/AUndocumented
MSR DumpPartial1c15b445-9b06-4667-ac25-33c056b88803WHEA_MSR_DUMP_SECTIONN/APartial
NMI ErrorCompletee71254e7-c1b9-4940-ab76-909703a4320fWHEA_NMI_ERROR_SECTIONN/AYes
PCI / PCI-X Bus ErrorCompletec5753963-3b84-4095-bf78-eddad3f9c9ddWHEA_PCIXBUS_ERROR_SECTIONN.2.8Yes
PCI / PCI-X Device ErrorCompleteeb5e4685-ca66-4769-b6a2-26068b001326WHEA_PCIXDEVICE_ERROR_SECTIONM.2.9Yes
PCI Express DPC CapabilityCompleteec49534b-30e7-4358-972f-eca6958fae3bPCI_EXPRESS_DPC_CAPABILITYN/APartial
PCI Express ErrorCompleted995e954-bbc1-430f-ad91-b44dcb3c6f35WHEA_PCIEXPRESS_ERROR_SECTIONN.2.7Yes
PCI RecoveryCompletedd060800-f6e1-4204-ac27-c4bca9568402WHEA_PCI_RECOVERY_SECTIONN/APartial
PCIe Correctable Error SummaryPartiale96eca99-53e2-4f52-9be7-d2dbe9508ed0WHEA_PCIE_CORRECTABLE_ERROR_SECTIONN/APartial
Persistent Memory ErrorPartial81687003-dbfd-4728-9ffd-f0904f97597dWHEA_PMEM_ERROR_SECTIONN/APartial
Project Mu TelemetryComplete85183a8b-9c41-429c-939c-5c3c087ca280MU_TELEMETRY_SECTIONN/AUndocumented
  1. The Firmware Error Record Reference error typically includes additional binary data for which it acts as an encapsulating record. The format of this binary data is not defined in the UEFI specification, and both the source of the data and its format is effectively arbitrary, though typically it's from the CPU or the platform firmware. When present this utility will output this additional data in hexadecimal, but it cannot decode it as the structure of the data is not known.

The following error section types are defined in the UEFI specification but are not implemented by Windows and so not supported by this utility. They are listed here for completeness:

NameGUIDUEFI section
AMD IOMMU Specific DMAr Error036f84e1-7f37-428c-a79e-575fdfaa84ecN.2.11.3
CCIX PER Log Error91335ef6-ebfb-4478-a6a6-88b728cf75d7N.2.12
CXL Protocol Error80b9efb4-52b5-4de3-a777-68784b771048N.2.13
DMAr Generic Error5b51fef7-c79d-4434-8f1b-aa62de3e2c64N.2.11.1
FRU Memory Poison5e4706c1-5356-48c6-930b-52f2120a4458N.2.15
IA64 Processor Errore429faf1-3cb7-11d4-bca7-0080c73c8881N.2.4.3
Intel VT-d Specific DMAr Error71761d37-32b2-45cd-a7d0-b0fedd93e8cfN.2.11.2
Memory Error 261ec04fc-48e6-d813-25c9-8daa44750b12N.2.6

Events

Entry IDSymbolic nameImplemented?WHEA structureNotes
0x80000001CmcPollingTimeoutCompleteWHEAP_CMC_POLLING_TIMEOUT_EVENT
0x80000002WheaInitCompleteWHEAP_INIT_EVENT
0x80000003CmcSwitchToPollingCompleteWHEAP_CMC_SWITCH_TO_POLLING_EVENTEmpty
0x80000004DroppedCorrectedErrorCompleteWHEAP_DROPPED_CORRECTED_ERROR_EVENT
0x80000005StartedReportHwErrorCompleteWHEAP_STARTED_REPORT_HW_ERRORSEL
0x80000006PFAMemoryOfflinedCompleteWHEAP_PFA_MEMORY_OFFLINED
0x80000007PFAMemoryRemoveMonitorCompleteWHEAP_PFA_MEMORY_REMOVE_MONITOR
0x80000008PFAMemoryPolicyCompleteWHEAP_PFA_MEMORY_POLICY
0x80000009PshedInjectErrorCompleteWHEAP_PSHED_INJECT_ERROR
0x8000000aOscCapabilitiesCompleteWHEAP_OSC_IMPLEMENTED
0x8000000bPshedPluginRegisterCompleteWHEAP_PSHED_PLUGIN_REGISTER
0x8000000cAddRemoveErrorSourceCompleteWHEAP_ADD_REMOVE_ERROR_SOURCE_EVENT
0x8000000dWorkQueueItemUnsupportedUnknown
0x8000000eAttemptErrorRecoveryCompleteWHEAP_ATTEMPT_RECOVERY_EVENT
0x8000000fMcaFoundErrorInBankPartialWHEAP_FOUND_ERROR_IN_BANK_EVENT
0x80000010McaStuckErrorCheckCompleteWHEAP_STUCK_ERROR_EVENT
0x80000011McaErrorClearedCompleteWHEAP_ERROR_CLEARED_EVENT
0x80000012ClearedPoisonCompleteWHEAP_CLEARED_POISON_EVENT
0x80000013ProcessEINJCompleteWHEAP_PROCESS_EINJ_EVENT
0x80000014ProcessHESTCompleteWHEAP_PROCESS_HEST_EVENT
0x80000015CreateGenericRecordCompleteWHEAP_CREATE_GENERIC_RECORD_EVENT
0x80000016ErrorRecordCompleteWHEAP_ERROR_RECORD_EVENT
0x80000017ErrorRecordLimitUnsupportedUnknown
0x80000018AerNotGrantedToOsCompleteWHEAP_AER_NOT_GRANTED_TO_OSEmpty
0x80000019ErrSrcArrayInvalidCompleteWHEAP_ERR_SRC_ARRAY_INVALID_EVENT
0x8000001aAcpiTimeOutCompleteWHEAP_ACPI_TIMEOUT_EVENT
0x8000001bCmciRestartCompleteWHEAP_CMCI_RESTART_EVENT
0x8000001cCmciFinalRestartCompleteWHEAP_CMCI_RESTART_EVENT
0x8000001dEtwOverFlowCompleteWHEA_ETW_OVERFLOW_EVENT
0x8000001eAzccRootBusSearchErrCompleteWHEA_AZCC_ROOT_BUS_ERR_EVENT
0x8000001fAzccRootBusListCompleteWHEA_AZCC_ROOT_BUS_LIST_EVENT
0x80000020ErrSrcInvalidCompleteWHEAP_ERR_SRC_INVALID_EVENT
0x80000021GenericErrMemMapCompleteWHEAP_GENERIC_ERR_MEM_MAP_EVENT
0x80000022PshedCallbackCollisionCompleteWHEAP_PSHED_PLUGIN_CALLBACK_COLLISION
0x80000023SELBugCheckProgressCompleteWHEA_SEL_BUGCHECK_PROGRESSSEL
0x80000024PshedPluginLoadCompleteWHEA_PSHED_PLUGIN_LOAD_EVENT
0x80000025PshedPluginUnloadCompleteWHEA_PSHED_PLUGIN_UNLOAD_EVENT
0x80000026PshedPluginSupportedCompleteWHEA_PSHED_PLUGIN_PLATFORM_SUPPORT_EVENT
0x80000027DeviceDriverUnsupportedUnknown
0x80000028CmciImplPresentCompleteWHEAP_CMCI_IMPLEMENTED_EVENT
0x80000029CmciInitErrorCompleteWHEAP_CMCI_INITERR_EVENT
0x8000002aSELBugCheckRecoveryCompleteWHEA_SEL_BUGCHECK_RECOVERY_STATUS_MULTIPLE_BUGCHECK_EVENTSEL
0x8000002aSELBugCheckRecoveryCompleteWHEA_SEL_BUGCHECK_RECOVERY_STATUS_PHASE1_EVENTSEL
0x8000002aSELBugCheckRecoveryCompleteWHEA_SEL_BUGCHECK_RECOVERY_STATUS_PHASE2_EVENTSEL
0x8000002aSELBugCheckRecoveryCompleteWHEA_SEL_BUGCHECK_RECOVERY_STATUS_START_EVENTSEL
0x8000002bDrvErrSrcInvalidCompleteWHEAP_DEVICE_DRV_EVENTSEL
0x8000002cDrvHandleBusyCompleteWHEAP_DEVICE_DRV_EVENTSEL
0x8000002dWheaHeartbeatCompleteWHEA_PSHED_PLUGIN_HEARTBEATEmpty
0x8000002eAzccRootBusPoisonSetCompleteWHEA_AZCC_SET_POISON_EVENT
0x8000002fSELBugCheckInfoUnsupportedUnknown
0x80000030ErrDimmInfoMismatchCompleteWHEA_PSHED_PLUGIN_DIMM_MISMATCH
0x80000031eDpcEnabledCompleteWHEAP_EDPC_ENABLED_EVENT
0x80000032PageOfflineDoneCompleteWHEA_OFFLINE_DONE_EVENT
0x80000033PageOfflinePendMaxCompleteWHEAP_OFFLINE_PENDING_MAXEmpty
0x80000034BadPageLimitReachedCompleteWHEAP_BAD_PAGE_LIMIT_REACHEDEmpty
0x80000035SrarDetailPartialWHEA_SRAR_DETAIL_EVENT
0x80000036EarlyErrorCompleteWHEAP_EARLY_ERROREmpty
0x80000037PcieOverrideInfoPartialWHEAP_PCIE_OVERRIDE_INFO
0x80000038ReadPcieOverridesErrCompleteWHEAP_PCIE_READ_OVERRIDES_ERR
0x80000039PcieConfigInfoCompleteWHEAP_PCIE_CONFIG_INFO
0x80000040PcieSummaryFailedCompleteWHEA_THROTTLE_PCIE_ADD_EVENT
0x80000041ThrottleRegCorruptCompleteWHEA_THROTTLE_REGISTRY_CORRUPT_EVENT
0x80000042ThrottleAddErrSrcFailedCompleteWHEA_THROTTLE_ADD_ERR_SRC_FAILED_EVENTEmpty
0x80000043ThrottleRegDataIgnoredCompleteWHEA_THROTTLE_REG_DATA_IGNORED_EVENT
0x80000044EnableKeyNotifFailedCompleteWHEA_PSHED_PLUGIN_ENABLE_NOTIFY_FAILED_EVENT
0x80000045KeyNotificationFailedCompleteWHEA_REGISTER_KEY_NOTIFICATION_FAILED_EVENTEmpty
0x80000046PcieRemoveDeviceCompleteWHEA_THROTTLE_PCIE_REMOVE_EVENT
0x80000047PcieAddDeviceCompleteWHEA_THROTTLE_PCIE_ADD_EVENT
0x80000048PcieSpuriousErrSourceCompleteWHEAP_SPURIOUS_AER_EVENT
0x80000049MemoryAddDeviceCompleteWHEA_THROTTLE_MEMORY_ADD_OR_REMOVE_EVENT
0x8000004aMemoryRemoveDeviceCompleteWHEA_THROTTLE_MEMORY_ADD_OR_REMOVE_EVENT
0x8000004bMemorySummaryFailedCompleteWHEA_MEMORY_THROTTLE_SUMMARY_FAILED_EVENT
0x8000004cPcieDpcErrorCompleteWHEAP_DPC_ERROR_EVENT
0x8000004dCpuBusesInitFailedCompleteWHEA_PSHED_PI_CPU_BUSES_INIT_FAILED_EVENT
0x8000004ePshedPluginInitFailedCompleteWHEA_PSHED_PLUGIN_INIT_FAILED_EVENT
0x8000004fFailedAddToDefectListCompleteWHEA_FAILED_ADD_DEFECT_LIST_EVENTEmpty
0x80000050DefectListFullCompleteWHEAP_PLUGIN_DEFECT_LIST_FULL_EVENTEmpty
0x80000051DefectListUEFIVarFailedCompleteWHEAP_PLUGIN_DEFECT_LIST_UEFI_VAR_FAILEDEmpty
0x80000052DefectListCorruptCompleteWHEAP_PLUGIN_DEFECT_LIST_CORRUPTEmpty
0x80000053BadHestNotifyDataCompleteWHEAP_BAD_HEST_NOTIFY_DATA_EVENT
0x80000054RowFailureCompleteWHEAP_ROW_FAILURE_EVENT
0x80000055SrasTableNotFoundCompleteWHEA_SRAS_TABLE_NOT_FOUNDEmpty
0x80000056SrasTableErrorCompleteWHEA_SRAS_TABLE_ERROREmpty
0x80000057SrasTableEntriesPartialWHEA_SRAS_TABLE_ENTRIES_EVENT
0x80000058PFANotifyCallbackActionCompleteWHEAP_PFA_MEMORY_OFFLINED_NOTIFY_CALLBACK_ACTION
0x80000059SELBugCheckCpusQuiescedUnsupportedUnknown
0x8000005aPshedPiCpuidCompleteWHEA_PSHED_PI_CPUID
0x8000005bSrasTableBadDataCompleteWHEAP_SRAS_TABLE_BAD_DATAEmpty
0x8000005cDriFsStatusUnsupportedUnknown
0x80000060CpusFrozenCompleteWHEAP_BUGCHECK_CPUS_FROZEN_EVENTEmpty, SEL
0x80000061CpusFrozenNoCrashDumpUnsupportedUnknown
0x80000062RegNotifyPolicyChangeCompleteWHEA_REGNOTIFY_POLICY_CHANGE_EVENT
0x80000063RegErrorCompleteWHEA_REGISTRY_ERROR_EVENT
0x80000064RowOfflineEventCompleteWHEAP_ROW_OFFLINE_EVENT
0x80000065BitOfflineEventCompleteWHEAP_BIT_OFFLINE_EVENT
0x80000066BadGasFieldsCompleteWHEA_GAS_ERROR_EVENT
0x80000067CrashDumpErrorCompleteWHEA_CRASHDUMP_EVENT_LOG_ENTRY_WITH_STATUSSEL
0x80000068CrashDumpCheckpointUnsupportedUnknown
0x80000069CrashDumpProgressPercentCompleteWHEA_CRASHDUMP_EVENT_LOG_ENTRY_ULONG1SEL
0x8000006aPreviousCrashBugCheckProgressUnsupportedUnknown
0x8000006bSELBugCheckStackDumpCompleteWHEA_SEL_RAW_EVENTSEL
0x8000006cPciePromotedAerErrCompleteWHEAP_PROMOTED_AER_ERROR_EVENT
0x80040010PshedPiTraceLogCompleteWHEA_PSHED_PI_TRACE_EVENT

Notes:

  • Empty means the event has no payload data; i.e. they consist only of an event log entry header.
  • SEL means the event is logged to the System Event Log of the BMC via IPMI. It's possible these events are later read back from the SEL and inserted into the Windows Event Log when the system returns to a "healthy" state, but I haven't verified if this is the case.

Technical details

Architecture

The functionality that comprises WHEA is implemented across several system components:

  • Windows NT kernel (ntoskrnl.exe)
    WHEA itself is implemented directly in the Windows NT kernel. All of the kernel-mode WHEA APIs and associated functionality are a part of the main kernel binary.
  • Platform-specific Hardware Error Driver (PSHED) (pshed.dll)
    The PSHED ships with Windows and is implemented as a kernel-mode driver with the role of abstracting the platform's hardware error reporting facilities. It is analogous to the Hardware Abstraction Layer (HAL) but for functionality specific to WHEA.
  • PSHED plug-ins
    For supporting additional hardware error reporting functionality present in a platform which is not handled by the built-in PSHED, 3rd-parties can provide a PSHED plug-in. A PSHED plug-in is a kernel-mode driver which registers with PSHED, providing a set of callback functions to expose the additional platform hardware error reporting capabilities. In practice, this class of driver appears to be quite rare(?).
  • Hardware drivers
    WHEA exposes a public API which drivers can integrate with to report hardware errors and where possible recover from them. Several built-in Windows drivers integrate with WHEA, for example, the PCI bus driver (pci.sys).

Error records

Error records take the form of Common Platform Error Records (CPER) as defined in the Unified Extensible Firmware Interface (UEFI) specification. These records consist of three parts:

  • Header
    An initial error record header, the structure of which is defined in the UEFI specification.
  • Section Descriptor
    One or more error record section descriptors, the structure of which is defined in the UEFI specification. Each section descriptor maps to an error record section.
  • Section
    One or more error record sections. Each error record section has an associated error record section descriptor which, among other things, defines the type of error section.

Error sections have their own unique binary format as informed by the section type, specified as a GUID, in the corresponding section descriptor. The UEFI specification defines several standard error section types (e.g. generic processor error, memory error), but 3rd-parties are free to define their own sections.

In terms of the data structure layout, the header always comes first, then the section descriptors, and finally the sections. There can be unused space between the section descriptors and the sections, and at the end of the last section, to facilitate adding additional section descriptors and sections to an existing allocation.

Event records

Event records are purely a WHEA concept; they are not defined in the UEFI specification. While there are many more event record types defined than error record types, they are generally simpler to decode. Most event records have a simple structure containing a few fields that are primitive types. In contrast, many error records have a complex format with multiple embedded structures which in turn have many fields.

Glossary

Buses

Types

  • PCI
    Peripheral Component Interconnect
  • PCI-X
    PCI eXtended
  • PCIe
    PCI Express

PCIe

  • AER
    Advanced Error Reporting
  • DPC
    Downstream Port Containment
  • eDPC
    Enhanced Downstream Port Containment

Memory

  • DIMM
    Dual In-Line Memory Module
  • ECC
    Error Correction Code
  • PFN
    Page Frame Number
  • PMem
    Persistent Memory

Microsoft

  • ETW
    Event Tracing for Windows
  • IRQL
    Interrupt Request Level
  • LLHEH
    Low-Level Hardware Error Handler
  • PFA
    Predictive Failure Analysis
  • PSHED
    Platform-Specific Hardware Error Driver
  • WHEA
    Windows Hardware Error Architecture

Processors

Generic

  • IP
    Instruction Pointer
  • MAE
    Micro-Architecture Error
  • MMIO
    Memory-mapped I/O
  • TLB
    Translation Lookaside Buffer

Architectures

  • IA32
    Intel Architecture, 32-bit
  • IA64
    Intel Architecture, 64-bit (Itanium)
  • IPF
    Itanium Platform
  • XPF
    x86 Platform

Arm

  • GIC
    Generic Interrupt Controller
  • PSCI
    Power State Coordination Interface
  • SMMU
    System Memory Management Unit
  • SEA
    Synchronous External Abort
  • SEI
    SError Interrupt

IA-32 (x86)

  • APIC
    Advanced Programmable Interrupt Controller
  • CMC
    Corrected Machine Check
  • CMCI
    Corrected Machine Check Interrupt
  • MCA
    Machine Check Architecture
  • MCE
    Machine Check Exception
  • MCI
    Machine Check Interrupt
  • MSR
    Model-Specific Register
  • SRAR
    Software Recoverable Action Required

IA-64 (Itanium)

  • CPE
    Corrected Platform Error
  • MCA
    Machine Check Abort
  • SAL
    System Abstraction Layer

Specifications

  • ACPI
    Advanced Configuration and Power Interface
  • IPMI
    Intelligent Platform Management Interface
  • SDEI
    Software Delegated Exception Interface
  • UEFI
    Unified Extensible Firmware Interface

ACPI

  • AEST
    Arm Error Source Table
  • EINJ
    Error Injection table
  • GAS
    Generic Address Structure
  • GHES
    Generic Hardware Error Source
  • GSIV
    Global System Interrupt Vector
  • HEST
    Hardware Error Source Table
  • NFIT
    NVDIMM Firmware Interface Table
  • OSC
    Operating System Capabilities
  • SCI
    Service Control Interrupt
  • SRAS
    Static Resource Allocation Structure

IPMI

  • SEL
    System Event Log

UEFI

  • CPER
    Common Platform Error Record
  • PRM
    Platform Runtime Mechanism

Miscellaneous

  • BMC
    Baseboard Management Controller
  • CCIX
    Cache Coherent Interconnect for Accelerators
  • CXL
    Compute Express Link
  • DMA
    Direct Memory Access
  • DMAr
    DMA remapping
  • FRU
    Field Replaceable Unit
  • GPIO
    General Purpose Input/Output
  • IOMMU
    Input/Output Memory Management Unit
  • NMI
    Non-Maskable Interrupt
  • OEM
    Original Equipment Manufacturer
  • RAS
    Reliability, Availability, and Serviceability
  • SOC
    System on Chip

License

All content is licensed under the terms of The MIT License.

About

Decode Windows Hardware Event Architecture (WHEA) records

Topics

Resources

Stars

44 stars

Watchers

2 watching

Forks

Releases

Used by

Contributors

Languages