Share via

issues with KBUGCHECK_REASON_CALLBACK_ROUTINE

zephyr 0 Reputation points
2024-01-12T06:41:49.6466667+00:00

I am currently working on a driver for a device that monitors system state primarily by using the KBUGCHECK_REASON_CALLBACK_ROUTINE callback to report when the system issues a bug check and to provide a crash dump for analysis. However, I encountered unexpected behavior when attempting to write crash dump data to devices other than the disk by implementing the KbCallbackDumpIo routine.

According to the documentation, when the system issues a bug check, it will call the registered KBUGCHECK_REASON_CALLBACK_ROUTINE multiple times with a KBUGCHECK_DUMP_IO structure in this case. The data inside should eventually form a complete dump file. In my implementation, each time the system calls the bug check function, it transfers the buffer in the input parameter ReasonSpecificData (which, in this situation, should be a KBUGCHECK_DUMP_IO struct type) to the device. However, after the system completes the entire bug check process, only mini dumps are in a valid format (containing correct information), while core dumps and full dumps, although appearing to have correct file sizes, are actually invalid files that cannot be used. Two details may be relevant:

  1. When I print out the addresses of the buffers (referring to three parts of the dump file), only a small part of the address for the body type buffer appears valid. Starting from a certain buffer, all addresses for the body type buffer become 0x00.
  2. The data read from address 0x00 is consistently 0xff, indicating that no useful and correct information is being written to the dump file.

I also used binary comparison software to compare the dump file I wrote to the device with the corresponding dump file on the hard drive generated by the system. Aside from a small amount of matching header and secondary information, the rest of the information was incorrect. Could there be an issue with the usage of KBUGCHECK_REASON_CALLBACK_ROUTINE, or are there system limitations during bug check that are not mentioned in the documentation? Page URL

kbugcheck_reason_callback_routine Content source URL

nc-wdm-kbugcheck_reason_callback_routine

Windows Hardware Performance
Windows Hardware Performance
Windows: A family of Microsoft operating systems that run across personal computers, tablets, laptops, phones, internet of things devices, self-contained mixed reality headsets, large collaboration screens, and other devices.Hardware Performance: Delivering / providing hardware or hardware systems or adjusting / adapting hardware or hardware systems.
1,559 questions
0 comments