windows-server-2003/base/ntos/ke/bugcheck.c

/*++

Copyright (c) 1989-1993  Microsoft Corporation

Module Name:

    stubs.c

Abstract:

    This module implements bug check and system shutdown code.

Author:

    Mark Lucovsky (markl) 30-Aug-1990

Environment:

    Kernel mode only.

Revision History:

--*/

#include "ki.h"
#define NOEXTAPI
#include "wdbgexts.h"
#include <inbv.h>
#include <hdlsblk.h>
#include <hdlsterm.h>

//
//
//

extern KDDEBUGGER_DATA64 KdDebuggerDataBlock;

extern PVOID ExPoolCodeStart;
extern PVOID ExPoolCodeEnd;
extern PVOID MmPoolCodeStart;
extern PVOID MmPoolCodeEnd;
extern PVOID MmPteCodeStart;
extern PVOID MmPteCodeEnd;

extern PWD_HANDLER ExpWdHandler;
extern PVOID       ExpWdHandlerContext;

#if defined(_AMD64_)

#define PROGRAM_COUNTER(_trapframe) ((_trapframe)->Rip)

#elif defined(_X86_)

#define PROGRAM_COUNTER(_trapframe) ((_trapframe)->Eip)

#elif defined(_IA64_)

#define PROGRAM_COUNTER(_trapframe) ((_trapframe)->StIIP)

#else

#error "no target architecture"

#endif

//
// Define forward referenced prototypes.
//

VOID
KiScanBugCheckCallbackList (
    VOID
    );

VOID
KiInvokeBugCheckEntryCallbacks (
    VOID
    );

//
// Define bug count recursion counter and a context buffer.
//

LONG KeBugCheckCount = 1;


VOID
KeBugCheck (
    IN ULONG BugCheckCode
    )
{
    KeBugCheck2(BugCheckCode,0,0,0,0,NULL);
}

VOID
KeBugCheckEx (
    IN ULONG BugCheckCode,
    IN ULONG_PTR P1,
    IN ULONG_PTR P2,
    IN ULONG_PTR P3,
    IN ULONG_PTR P4
    )
{
    KeBugCheck2(BugCheckCode,P1,P2,P3,P4,NULL);
}

ULONG_PTR KiBugCheckData[5];
PUNICODE_STRING KiBugCheckDriver;

BOOLEAN
KeGetBugMessageText(
    IN ULONG MessageId,
    IN PANSI_STRING ReturnedString OPTIONAL
    )
{
    SIZE_T  i;
    PCHAR   s;
    PMESSAGE_RESOURCE_BLOCK MessageBlock;
    PCHAR Buffer;
    BOOLEAN Result;

    Result = FALSE;
    try {
        if (KiBugCodeMessages != NULL) {
            MmMakeKernelResourceSectionWritable ();
            MessageBlock = &KiBugCodeMessages->Blocks[0];
            for (i = KiBugCodeMessages->NumberOfBlocks; i; i -= 1) {
                if (MessageId >= MessageBlock->LowId &&
                    MessageId <= MessageBlock->HighId) {

                    s = (PCHAR)KiBugCodeMessages + MessageBlock->OffsetToEntries;
                    for (i = MessageId - MessageBlock->LowId; i; i -= 1) {
                        s += ((PMESSAGE_RESOURCE_ENTRY)s)->Length;
                    }

                    Buffer = (PCHAR)((PMESSAGE_RESOURCE_ENTRY)s)->Text;

                    i = strlen(Buffer) - 1;
                    while (i > 0 && (Buffer[i] == '\n'  ||
                                     Buffer[i] == '\r'  ||
                                     Buffer[i] == 0
                                    )
                          ) {
                        if (!ARGUMENT_PRESENT( ReturnedString )) {
                            Buffer[i] = 0;
                        }
                        i -= 1;
                    }

                    if (!ARGUMENT_PRESENT( ReturnedString )) {
                        InbvDisplayString((PUCHAR)Buffer);
                        InbvDisplayString((PUCHAR)"\r");
                        }
                    else {
                        ReturnedString->Buffer = Buffer;
                        ReturnedString->Length = (USHORT)(i+1);
                        ReturnedString->MaximumLength = (USHORT)(i+1);
                    }
                    Result = TRUE;
                    break;
                }
                MessageBlock += 1;
            }
        }
    } except ( EXCEPTION_EXECUTE_HANDLER ) {
        ;
    }

    return Result;
}



PCHAR
KeBugCheckUnicodeToAnsi(
    IN PUNICODE_STRING UnicodeString,
    OUT PCHAR AnsiBuffer,
    IN ULONG MaxAnsiLength
    )
{
    PCHAR Dst;
    PWSTR Src;
    ULONG Length;

    Length = UnicodeString->Length / sizeof( WCHAR );
    if (Length >= MaxAnsiLength) {
        Length = MaxAnsiLength - 1;
        }
    Src = UnicodeString->Buffer;
    Dst = AnsiBuffer;
    while (Length--) {
        *Dst++ = (UCHAR)*Src++;
        }
    *Dst = '\0';
    return AnsiBuffer;
}

VOID
KiBugCheckDebugBreak (
    IN ULONG    BreakStatus
    )
{
    do {

        try {

            //
            // Issue a breakpoint
            //

            DbgBreakPointWithStatus (BreakStatus);

        } except(EXCEPTION_EXECUTE_HANDLER) {

            HEADLESS_RSP_QUERY_INFO Response;
            NTSTATUS Status;
            SIZE_T Length;

            //
            // Failed to issue the breakpoint, must be no debugger.  Now, give
            // the headless terminal a chance to reboot the system, if there is one.
            //
            Length = sizeof(HEADLESS_RSP_QUERY_INFO);
            Status = HeadlessDispatch(HeadlessCmdQueryInformation,
                                      NULL,
                                      0,
                                      &Response,
                                      &Length
                                     );

            if (NT_SUCCESS(Status) &&
                (Response.PortType == HeadlessSerialPort) &&
                Response.Serial.TerminalAttached) {

                HeadlessDispatch(HeadlessCmdPutString,
                                 "\r\n",
                                 sizeof("\r\n"),
                                 NULL,
                                 NULL
                                );

                for (;;) {
                    HeadlessDispatch(HeadlessCmdDoBugCheckProcessing, NULL, 0, NULL, NULL);
                }

            }

            //
            // No terminal, or it failed, halt the system
            //

            try {

                HalHaltSystem();

            } except(EXCEPTION_EXECUTE_HANDLER) {

                for (;;) {
                }

            }
        }
    } while (BreakStatus != DBG_STATUS_BUGCHECK_FIRST);
}

PVOID
KiPcToFileHeader(
    IN PVOID PcValue,
    OUT PLDR_DATA_TABLE_ENTRY *DataTableEntry,
    IN LOGICAL DriversOnly,
    OUT PBOOLEAN InKernelOrHal
    )

/*++

Routine Description:

    This function returns the base of an image that contains the
    specified PcValue. An image contains the PcValue if the PcValue
    is within the ImageBase, and the ImageBase plus the size of the
    virtual image.

Arguments:

    PcValue - Supplies a PcValue.

    DataTableEntry - Supplies a pointer to a variable that receives the
        address of the data table entry that describes the image.

    DriversOnly - Supplies TRUE if the kernel and HAL should be skipped.

    InKernelOrHal - Set to TRUE if the PcValue is in the kernel or the HAL.
        This only has meaning if DriversOnly is FALSE.

Return Value:

    NULL - No image was found that contains the PcValue.

    NON-NULL - Returns the base address of the image that contains the
        PcValue.

--*/

{
    ULONG i;
    PLIST_ENTRY ModuleListHead;
    PLDR_DATA_TABLE_ENTRY Entry;
    PLIST_ENTRY Next;
    ULONG_PTR Bounds;
    PVOID ReturnBase, Base;

    //
    // If the module list has been initialized, then scan the list to
    // locate the appropriate entry.
    //

    if (KeLoaderBlock != NULL) {
        ModuleListHead = &KeLoaderBlock->LoadOrderListHead;

    } else {
        ModuleListHead = &PsLoadedModuleList;
    }

    *InKernelOrHal = FALSE;

    ReturnBase = NULL;
    Next = ModuleListHead->Flink;
    if (Next != NULL) {
        i = 0;
        while (Next != ModuleListHead) {
            if (MmIsAddressValid(Next) == FALSE) {
                return NULL;
            }
            i += 1;
            if ((i <= 2) && (DriversOnly == TRUE)) {
                Next = Next->Flink;
                continue;
            }

            Entry = CONTAINING_RECORD(Next,
                                      LDR_DATA_TABLE_ENTRY,
                                      InLoadOrderLinks);

            Next = Next->Flink;
            Base = Entry->DllBase;
            Bounds = (ULONG_PTR)Base + Entry->SizeOfImage;
            if ((ULONG_PTR)PcValue >= (ULONG_PTR)Base && (ULONG_PTR)PcValue < Bounds) {
                *DataTableEntry = Entry;
                ReturnBase = Base;
                if (i <= 2) {
                    *InKernelOrHal = TRUE;
                }
                break;
            }
        }
    }

    return ReturnBase;
}



VOID
KiDumpParameterImages(
    IN PCHAR Buffer,
    IN PULONG_PTR BugCheckParameters,
    IN ULONG NumberOfParameters,
    IN PKE_BUGCHECK_UNICODE_TO_ANSI UnicodeToAnsiRoutine
    )

/*++

Routine Description:

    This function formats and displays the image names of boogcheck parameters
    that happen to match an address in an image.

Arguments:

    Buffer - Supplies a pointer to a buffer to be used to output machine
        state information.

    BugCheckParameters - Supplies additional bugcheck information.

    NumberOfParameters - sizeof BugCheckParameters array.
        if just 1 parameter is passed in, just save the string.

    UnicodeToAnsiRoutine - Supplies a pointer to a routine to convert Unicode
        strings to Ansi strings without touching paged translation tables.

Return Value:

    None.

--*/

{
    PUNICODE_STRING BugCheckDriver;
    ULONG i;
    PLDR_DATA_TABLE_ENTRY DataTableEntry;
    PVOID ImageBase;
    CHAR AnsiBuffer[ 32 ];
    ULONG DateStamp;
    PIMAGE_NT_HEADERS NtHeaders;
    BOOLEAN FirstPrint = TRUE;
    BOOLEAN InKernelOrHal;
    PUNICODE_STRING DriverName;

    //
    // At this point the context record contains the machine state at the
    // call to bug check.
    //
    // Put out the system version and the title line with the PSR and FSR.
    //

    //
    // Check to see if any BugCheckParameters are valid code addresses.
    // If so, print them for the user.
    //

    DriverName = NULL;

    for (i = 0; i < NumberOfParameters; i += 1) {

        DateStamp = 0;
        ImageBase = KiPcToFileHeader((PVOID) BugCheckParameters[i],
                                     &DataTableEntry,
                                     TRUE,
                                     &InKernelOrHal);
        if (ImageBase == NULL) {
            BugCheckDriver = MmLocateUnloadedDriver ((PVOID)BugCheckParameters[i]);

            if (BugCheckDriver == NULL){
                continue;
            }

            DriverName = BugCheckDriver;
            ImageBase = (PVOID)BugCheckParameters[i];
            (*UnicodeToAnsiRoutine) (BugCheckDriver,
                                     AnsiBuffer,
                                     sizeof (AnsiBuffer));
        } else {

            if (MmIsAddressValid(DataTableEntry->DllBase) == TRUE) {

                NtHeaders = RtlImageNtHeader(DataTableEntry->DllBase);
                if (NtHeaders) {
                    DateStamp = NtHeaders->FileHeader.TimeDateStamp;
                }
            }
            DriverName = &DataTableEntry->BaseDllName;
            (*UnicodeToAnsiRoutine)( DriverName,
                                     AnsiBuffer,
                                     sizeof( AnsiBuffer ));
        }

        sprintf(Buffer, "%s**  %12s - Address %p base at %p, DateStamp %08lx\r\n",
                FirstPrint ? "\r\n*":"*",
                AnsiBuffer,
                (PVOID)BugCheckParameters[i],
                ImageBase,
                DateStamp);

        //
        // Only print the string if we are called to print multiple.
        //

        if (NumberOfParameters > 1) {
            InbvDisplayString((PUCHAR)Buffer);
        } else {
            KiBugCheckDriver = DriverName;
        }

        FirstPrint = FALSE;
    }

    return;
}


//
// Enable terminal output and turn on bugcheck processing.
//
VOID
KiEnableHeadlessBlueScreen(
    )
{
    HEADLESS_CMD_ENABLE_TERMINAL HeadlessCmd;
    HEADLESS_CMD_SEND_BLUE_SCREEN_DATA HeadlessCmdBlueScreen;

    HeadlessCmdBlueScreen.BugcheckCode = (ULONG)KiBugCheckData[0];

    HeadlessCmd.Enable = TRUE;

    HeadlessDispatch(HeadlessCmdStartBugCheck, NULL, 0, NULL, NULL);

    HeadlessDispatch(HeadlessCmdEnableTerminal,
         &HeadlessCmd,
         sizeof(HEADLESS_CMD_ENABLE_TERMINAL),
         NULL,
         NULL
        );

    HeadlessDispatch(HeadlessCmdSendBlueScreenData,
                     &HeadlessCmdBlueScreen,
                     sizeof(HEADLESS_CMD_SEND_BLUE_SCREEN_DATA),
                     NULL,
                     NULL
                    );

}

VOID
KiDisplayBlueScreen(
    IN ULONG PssMessage,
    IN BOOLEAN HardErrorCalled,
    IN PCHAR HardErrorCaption,
    IN PCHAR HardErrorMessage,
    IN PCHAR StateString
    )
/*++

Routine Description:

    Display the "Blue Screen of Death" with associated bluescreen information.
    The function is headless aware.

Arguments:

    PssMessage - PSS message id.

    HardErrorCalled - Supplies a flag specifying whether the bluescreen
            was generated as a result of a harderror or not.

    HardErrorCaption - If HardErrorCalled is TRUE, supplies the harderror
            caption.

    HardErrorMessage - If HardErrorCalled is TRUE, supplies the harderror
            message.

    StateString - String containing the bugcheck driver name or state
            information about the crash.

Return Value:

    None.

--*/
{
    CHAR Buffer [103];


    KiEnableHeadlessBlueScreen();

    //
    // Enable InbvDisplayString calls to make it through to bootvid driver.
    //

    if (InbvIsBootDriverInstalled()) {

        InbvAcquireDisplayOwnership();

        InbvResetDisplay();
        InbvSolidColorFill(0,0,639,479,4); // make the screen blue
        InbvSetTextColor(15);
        InbvInstallDisplayStringFilter((INBV_DISPLAY_STRING_FILTER)NULL);
        InbvEnableDisplayString(TRUE);     // enable display string
        InbvSetScrollRegion(0,0,639,475);  // set to use entire screen
    }

    if (!HardErrorCalled) {

        InbvDisplayString((PUCHAR)"\r\n");
        KeGetBugMessageText(BUGCHECK_MESSAGE_INTRO, NULL);
        InbvDisplayString((PUCHAR)"\r\n\r\n");

        if (KiBugCheckDriver) {

            //
            // Output the driver name.
            //

            KeGetBugMessageText(BUGCODE_ID_DRIVER, NULL);

            KeBugCheckUnicodeToAnsi (KiBugCheckDriver,
                                     Buffer,
                                     sizeof (Buffer));
            InbvDisplayString((PUCHAR)" ");
            InbvDisplayString ((PUCHAR)Buffer);
            InbvDisplayString((PUCHAR)"\r\n\r\n");
        }

        //
        // Display the PSS message.
        // If we have no special text, get the text for the bugcode
        // which will be the bugcode name.
        //

        if (PssMessage == BUGCODE_PSS_MESSAGE) {
            KeGetBugMessageText((ULONG)KiBugCheckData[0], NULL);
            InbvDisplayString((PUCHAR)"\r\n\r\n");

        }

        KeGetBugMessageText(PSS_MESSAGE_INTRO, NULL);
        InbvDisplayString((PUCHAR)"\r\n\r\n");
        KeGetBugMessageText(PssMessage, NULL);
        InbvDisplayString((PUCHAR)"\r\n\r\n");

        KeGetBugMessageText(BUGCHECK_TECH_INFO, NULL);

        sprintf(Buffer,
                "\r\n\r\n*** STOP: 0x%08lX (0x%p,0x%p,0x%p,0x%p)\r\n\r\n",
                (ULONG)KiBugCheckData[0],
                (PVOID)KiBugCheckData[1],
                (PVOID)KiBugCheckData[2],
                (PVOID)KiBugCheckData[3],
                (PVOID)KiBugCheckData[4]);

        InbvDisplayString((PUCHAR)Buffer);

        if (KiBugCheckDriver) {
            InbvDisplayString((PUCHAR)StateString);
        }

        if (!KiBugCheckDriver) {
            KiDumpParameterImages(StateString,
                                  &(KiBugCheckData[1]),
                                  4,
                                  KeBugCheckUnicodeToAnsi);
        }

    } else {

        if (HardErrorCaption) {
            InbvDisplayString((PUCHAR)HardErrorCaption);
        }

        if (HardErrorMessage) {
            InbvDisplayString((PUCHAR)HardErrorMessage);
        }
    }
}

#ifdef _X86_
#pragma optimize("y", off)      // RtlCaptureContext needs EBP to be correct
#endif

VOID
KeBugCheck2 (
    IN ULONG BugCheckCode,
    IN ULONG_PTR BugCheckParameter1,
    IN ULONG_PTR BugCheckParameter2,
    IN ULONG_PTR BugCheckParameter3,
    IN ULONG_PTR BugCheckParameter4,
    IN PVOID SaveDataPage
    )

/*++

Routine Description:

    This function crashes the system in a controlled manner.

Arguments:

    BugCheckCode - Supplies the reason for the bug check.

    BugCheckParameter1-4 - Supplies additional bug check information

Return Value:

    None.

--*/

{
//    CHAR Buffer[103];
    CONTEXT ContextSave;
    ULONG PssMessage;
    PCHAR HardErrorCaption;
    PCHAR HardErrorMessage;
    KIRQL OldIrql;
    PKTRAP_FRAME TrapInformation;
    PVOID ExecutionAddress;
    PVOID ImageBase;
    PVOID VirtualAddress;
    PLDR_DATA_TABLE_ENTRY DataTableEntry;
    CHAR AnsiBuffer[100];
    PKTHREAD Thread;
    BOOLEAN InKernelOrHal;
    BOOLEAN Reboot;
    BOOLEAN HardErrorCalled;

#if !defined(NT_UP)

    KAFFINITY TargetSet;

#endif

    HardErrorCalled = FALSE;
    HardErrorCaption = NULL;
    HardErrorMessage = NULL;
    ExecutionAddress = NULL;
    Thread = KeGetCurrentThread();

    //
    // Initialization
    //

    Reboot = FALSE;
    KiBugCheckDriver = NULL;

    //
    // Try to simulate a power failure for Cluster testing
    //

    if (BugCheckCode == POWER_FAILURE_SIMULATE) {
        KiScanBugCheckCallbackList();
        HalReturnToFirmware(HalRebootRoutine);
    }

    //
    // Save the current IRQL in the Prcb so the debugger can extract it
    // later on for debugging purposes.
    //

    KeGetCurrentPrcb()->DebuggerSavedIRQL = KeGetCurrentIrql();

    //
    // Capture the callers context as closely as possible into the debugger's
    // processor state area of the Prcb.
    //
    // N.B. There may be some prologue code that shuffles registers such that
    //      they get destroyed.
    //

#if defined(_X86_)

    KiSetHardwareTrigger();

#else

    InterlockedIncrement64((LONGLONG volatile *)&KiHardwareTrigger);

#endif

    RtlCaptureContext(&KeGetCurrentPrcb()->ProcessorState.ContextFrame);
    KiSaveProcessorControlState(&KeGetCurrentPrcb()->ProcessorState);

    //
    // This is necessary on machines where the virtual unwind that happens
    // during KeDumpMachineState() destroys the context record.
    //

    ContextSave = KeGetCurrentPrcb()->ProcessorState.ContextFrame;

    //
    // Stop the watchdog timer
    //

    if (ExpWdHandler != NULL) {
        ExpWdHandler( WdActionStopTimer, ExpWdHandlerContext, NULL, TRUE );
    }

    //
    // Get the correct string for bugchecks
    //


    switch (BugCheckCode) {

        case SYSTEM_THREAD_EXCEPTION_NOT_HANDLED:
        case KERNEL_MODE_EXCEPTION_NOT_HANDLED:
        case KMODE_EXCEPTION_NOT_HANDLED:
            PssMessage = KMODE_EXCEPTION_NOT_HANDLED;
            break;

        case DATA_BUS_ERROR:
        case NO_MORE_SYSTEM_PTES:
        case INACCESSIBLE_BOOT_DEVICE:
        case UNEXPECTED_KERNEL_MODE_TRAP:
        case ACPI_BIOS_ERROR:
        case ACPI_BIOS_FATAL_ERROR:
        case FAT_FILE_SYSTEM:
        case DRIVER_CORRUPTED_EXPOOL:
        case THREAD_STUCK_IN_DEVICE_DRIVER:
            PssMessage = BugCheckCode;
            break;

        case DRIVER_CORRUPTED_MMPOOL:
            PssMessage = DRIVER_CORRUPTED_EXPOOL;
            break;

        case NTFS_FILE_SYSTEM:
            PssMessage = FAT_FILE_SYSTEM;
            break;

        case STATUS_SYSTEM_IMAGE_BAD_SIGNATURE:
            PssMessage = BUGCODE_PSS_MESSAGE_SIGNATURE;
            break;
        default:
            PssMessage = BUGCODE_PSS_MESSAGE;
        break;
    }


    //
    // Do further processing on bugcheck codes
    //


    KiBugCheckData[0] = BugCheckCode;
    KiBugCheckData[1] = BugCheckParameter1;
    KiBugCheckData[2] = BugCheckParameter2;
    KiBugCheckData[3] = BugCheckParameter3;
    KiBugCheckData[4] = BugCheckParameter4;


    switch (BugCheckCode) {

    case FATAL_UNHANDLED_HARD_ERROR:
        //
        // If we are called by hard error then we don't want to dump the
        // processor state on the machine.
        //
        // We know that we are called by hard error because the bug check
        // code will be FATAL_UNHANDLED_HARD_ERROR.  If this is so then the
        // error status passed to harderr is the first parameter, and a pointer
        // to the parameter array from hard error is passed as the second
        // argument.
        //
        // The third argument is the OemCaption to be printed.
        // The last argument is the OemMessage to be printed.
        //
        {
        PULONG_PTR parameterArray;

        HardErrorCalled = TRUE;

        HardErrorCaption = (PCHAR)BugCheckParameter3;
        HardErrorMessage = (PCHAR)BugCheckParameter4;
        parameterArray = (PULONG_PTR)BugCheckParameter2;
        KiBugCheckData[0] = (ULONG)BugCheckParameter1;
        KiBugCheckData[1] = parameterArray[0];
        KiBugCheckData[2] = parameterArray[1];
        KiBugCheckData[3] = parameterArray[2];
        KiBugCheckData[4] = parameterArray[3];
        }
        break;

    case IRQL_NOT_LESS_OR_EQUAL:

        ExecutionAddress = (PVOID)BugCheckParameter4;

        if (ExecutionAddress >= ExPoolCodeStart && ExecutionAddress < ExPoolCodeEnd) {
            KiBugCheckData[0] = DRIVER_CORRUPTED_EXPOOL;
        }
        else if (ExecutionAddress >= MmPoolCodeStart && ExecutionAddress < MmPoolCodeEnd) {
            KiBugCheckData[0] = DRIVER_CORRUPTED_MMPOOL;
        }
        else if (ExecutionAddress >= MmPteCodeStart && ExecutionAddress < MmPteCodeEnd) {
            KiBugCheckData[0] = DRIVER_CORRUPTED_SYSPTES;
        }
        else {
            ImageBase = KiPcToFileHeader (ExecutionAddress,
                                          &DataTableEntry,
                                          FALSE,
                                          &InKernelOrHal);
            if (InKernelOrHal == TRUE) {

                //
                // The kernel faulted at raised IRQL.  Quite often this
                // is a driver that has unloaded without deleting its
                // lookaside lists or other resources.  Or its resources
                // are marked pagable and shouldn't be.  Detect both
                // cases here and identify the offending driver
                // whenever possible.
                //

                VirtualAddress = (PVOID)BugCheckParameter1;

                ImageBase = KiPcToFileHeader (VirtualAddress,
                                              &DataTableEntry,
                                              TRUE,
                                              &InKernelOrHal);

                if (ImageBase != NULL) {
                    KiBugCheckDriver = &DataTableEntry->BaseDllName;
                    KiBugCheckData[0] = DRIVER_PORTION_MUST_BE_NONPAGED;
                }
                else {
                    KiBugCheckDriver = MmLocateUnloadedDriver (VirtualAddress);
                    if (KiBugCheckDriver != NULL) {
                        KiBugCheckData[0] = SYSTEM_SCAN_AT_RAISED_IRQL_CAUGHT_IMPROPER_DRIVER_UNLOAD;
                    }
                }
            }
            else {
                KiBugCheckData[0] = DRIVER_IRQL_NOT_LESS_OR_EQUAL;
            }
        }

        ExecutionAddress = NULL;
        break;

    case ATTEMPTED_WRITE_TO_READONLY_MEMORY:
    case ATTEMPTED_EXECUTE_OF_NOEXECUTE_MEMORY:

        TrapInformation = (PKTRAP_FRAME)BugCheckParameter3;

        //
        // Extract the execution address from the trap frame to
        // identify the component.
        //

        if (TrapInformation != NULL) {
            ExecutionAddress = (PVOID) PROGRAM_COUNTER (TrapInformation);
        }

        break;

    case DRIVER_LEFT_LOCKED_PAGES_IN_PROCESS:

        ExecutionAddress = (PVOID)BugCheckParameter1;
        break;

    case DRIVER_USED_EXCESSIVE_PTES:

        DataTableEntry = (PLDR_DATA_TABLE_ENTRY)BugCheckParameter1;
        KiBugCheckDriver = &DataTableEntry->BaseDllName;

        break;

    case PAGE_FAULT_IN_NONPAGED_AREA:

        ImageBase = NULL;

        //
        // Extract the execution address from the trap frame to
        // identify the component.
        //

        if (BugCheckParameter3) {

            ExecutionAddress = (PVOID)PROGRAM_COUNTER
                ((PKTRAP_FRAME)BugCheckParameter3);

            KiBugCheckData[3] = (ULONG_PTR)ExecutionAddress;

            ImageBase = KiPcToFileHeader (ExecutionAddress,
                                          &DataTableEntry,
                                          FALSE,
                                          &InKernelOrHal);
        }
        else {

            //
            // No trap frame, so no execution address either.
            //

            InKernelOrHal = TRUE;
        }

        VirtualAddress = (PVOID)BugCheckParameter1;

        if (MmIsSpecialPoolAddress (VirtualAddress) == TRUE) {

            //
            // Update the bugcheck number so the administrator gets
            // useful feedback that enabling special pool has enabled
            // the system to locate the corruptor.
            //

            if (MmIsSpecialPoolAddressFree (VirtualAddress) == TRUE) {
                if (InKernelOrHal == TRUE) {
                    KiBugCheckData[0] = PAGE_FAULT_IN_FREED_SPECIAL_POOL;
                }
                else {
                    KiBugCheckData[0] = DRIVER_PAGE_FAULT_IN_FREED_SPECIAL_POOL;
                }
            }
            else {
                if (InKernelOrHal == TRUE) {
                    KiBugCheckData[0] = PAGE_FAULT_BEYOND_END_OF_ALLOCATION;
                }
                else {
                    KiBugCheckData[0] = DRIVER_PAGE_FAULT_BEYOND_END_OF_ALLOCATION;
                }
            }
        }
        else if ((ExecutionAddress == VirtualAddress) &&
                (MmIsSessionAddress (VirtualAddress) == TRUE) &&
                ((Thread->Teb == NULL) || (IS_SYSTEM_ADDRESS(Thread->Teb)))) {
            //
            // This is a driver reference to session space from a
            // worker thread.  Since the system process has no session
            // space this is illegal and the driver must be fixed.
            //

            KiBugCheckData[0] = TERMINAL_SERVER_DRIVER_MADE_INCORRECT_MEMORY_REFERENCE;
        }
        else if (ImageBase == NULL) {
            KiBugCheckDriver = MmLocateUnloadedDriver (VirtualAddress);
            if (KiBugCheckDriver != NULL) {
                KiBugCheckData[0] = DRIVER_UNLOADED_WITHOUT_CANCELLING_PENDING_OPERATIONS;
            }
        }

        break;

    case THREAD_STUCK_IN_DEVICE_DRIVER:

        KiBugCheckDriver = (PUNICODE_STRING) BugCheckParameter3;
        break;

    default:
        break;
    }

    if (KiBugCheckDriver) {
        KeBugCheckUnicodeToAnsi(KiBugCheckDriver,
                                AnsiBuffer,
                                sizeof(AnsiBuffer));
    } else {

        //
        // This will set KiBugCheckDriver to 1 if successful.
        //

        if (ExecutionAddress) {
            KiDumpParameterImages(AnsiBuffer,
                                  (PULONG_PTR)&ExecutionAddress,
                                  1,
                                  KeBugCheckUnicodeToAnsi);
        }
    }

    if (KdPitchDebugger == FALSE ) {
        KdDebuggerDataBlock.SavedContext = (ULONG_PTR) &ContextSave;
    }

    //
    // If the user manually crashed the machine, skips the DbgPrints and
    // go to the crashdump.
    // Trying to do DbgPrint causes us to reeeter the debugger which causes
    // some problems.
    //
    // Otherwise, if the debugger is enabled, print out the information and
    // stop.
    //

    if ((BugCheckCode != MANUALLY_INITIATED_CRASH) &&
        (KdDebuggerEnabled)) {

        DbgPrint("\n*** Fatal System Error: 0x%08lx\n"
                 "                       (0x%p,0x%p,0x%p,0x%p)\n\n",
                 (ULONG)KiBugCheckData[0],
                 KiBugCheckData[1],
                 KiBugCheckData[2],
                 KiBugCheckData[3],
                 KiBugCheckData[4]);

        //
        // If the debugger is not actually connected, or the user manually
        // crashed the machine by typing .crash in the debugger, proceed to
        // "blue screen" the system.
        //
        // The call to DbgPrint above will have set the state of
        // KdDebuggerNotPresent if the debugger has become disconnected
        // since the system was booted.
        //

        if (KdDebuggerNotPresent == FALSE) {

            if (KiBugCheckDriver != NULL) {
                DbgPrint("Driver at fault: %s.\n", AnsiBuffer);
            }

            if (HardErrorCalled != FALSE) {
                if (HardErrorCaption) {
                    DbgPrint(HardErrorCaption);
                }
                if (HardErrorMessage) {
                    DbgPrint(HardErrorMessage);
                }
            }

            KiBugCheckDebugBreak (DBG_STATUS_BUGCHECK_FIRST);
        }
    }

    //
    // Freeze execution of the system by disabling interrupts and looping.
    //

    KeDisableInterrupts();
    KeRaiseIrql(HIGH_LEVEL, &OldIrql);


    //
    // Don't attempt to display message more than once.
    //

    if (InterlockedDecrement (&KeBugCheckCount) == 0) {

#if !defined(NT_UP)

        //
        // Attempt to get the other processors frozen now, but don't wait
        // for them to freeze (in case someone is stuck).
        //

        TargetSet = KeActiveProcessors & ~KeGetCurrentPrcb()->SetMember;
        if (TargetSet != 0) {
            KiIpiSend((KAFFINITY) TargetSet, IPI_FREEZE);

            //
            // Give the other processors one second to flush their data caches.
            //
            // N.B. This cannot be synchronized since the reason for the bug
            //      may be one of the other processors failed.
            //

            KeStallExecutionProcessor(1000 * 1000);
        }

#endif

        //
        // Display the blue screen.
        //

        KiDisplayBlueScreen (PssMessage,
                             HardErrorCalled,
                             HardErrorCaption,
                             HardErrorMessage,
                             AnsiBuffer);

        //
        // Invoke bugcheck callbacks.
        //

        KiInvokeBugCheckEntryCallbacks();

        //
        // If the debugger is not enabled, attempt to enable it.
        //

        if (KdDebuggerEnabled == FALSE && KdPitchDebugger == FALSE ) {
            KdInitSystem(0, NULL);

        } else {
            InbvDisplayString((PUCHAR)"\r\n");
        }

        // Restore the original Context frame
        KeGetCurrentPrcb()->ProcessorState.ContextFrame = ContextSave;

        //
        // For some bugchecks we want to change the thread and context before
        // it is written to the dump file IFF it is a minidump.
        // Look at the original bugcheck data, not the processed data from
        // above
        //

#define MINIDUMP_BUGCHECK 0x10000000

        if (IoIsTriageDumpEnabled()) {

            switch (BugCheckCode) {

            //
            // System thread stores a context record as the 4th parameter.
            // use that.
            // Also save the context record in case someone needs to look
            // at it.
            //

            case SYSTEM_THREAD_EXCEPTION_NOT_HANDLED:
                if (BugCheckParameter4) {
                    ContextSave = *((PCONTEXT)BugCheckParameter4);

                    KiBugCheckData[0] |= MINIDUMP_BUGCHECK;
                }
                break;

#if defined (_X86_)

            //
            // 3rd parameter is a trap frame.
            //
            // Build a context record out of that only if it's a kernel mode
            // failure because esp may be wrong in that case ???.
            //

            case ATTEMPTED_WRITE_TO_READONLY_MEMORY:
            case ATTEMPTED_EXECUTE_OF_NOEXECUTE_MEMORY:
            case KERNEL_MODE_EXCEPTION_NOT_HANDLED:
            case PAGE_FAULT_IN_NONPAGED_AREA:

                if (BugCheckParameter3)
                {
                    PKTRAP_FRAME Trap = (PKTRAP_FRAME) BugCheckParameter3;

                    if ((Trap->SegCs & 1) ||
                        (Trap->EFlags & EFLAGS_V86_MASK))
                    {
                        ContextSave.Esp = Trap->HardwareEsp;
                    }
                    else
                    {
                        ContextSave.Esp = (ULONG)Trap +
                            FIELD_OFFSET(KTRAP_FRAME, HardwareEsp);
                    }
                    if (Trap->EFlags & EFLAGS_V86_MASK)
                    {
                        ContextSave.SegSs = Trap->HardwareSegSs & 0xffff;
                    }
                    else if (Trap->SegCs & 1)
                    {
                        //
                        // It's user mode.
                        // The HardwareSegSs contains R3 data selector.
                        //

                        ContextSave.SegSs =
                            (Trap->HardwareSegSs | 3) & 0xffff;
                    }
                    else
                    {
                        ContextSave.SegSs = KGDT_R0_DATA;
                    }

                    ContextSave.SegGs = Trap->SegGs & 0xffff;
                    ContextSave.SegFs = Trap->SegFs & 0xffff;
                    ContextSave.SegEs = Trap->SegEs & 0xffff;
                    ContextSave.SegDs = Trap->SegDs & 0xffff;
                    ContextSave.SegCs = Trap->SegCs & 0xffff;
                    ContextSave.Eip = Trap->Eip;
                    ContextSave.Ebp = Trap->Ebp;
                    ContextSave.Eax = Trap->Eax;
                    ContextSave.Ebx = Trap->Ebx;
                    ContextSave.Ecx = Trap->Ecx;
                    ContextSave.Edx = Trap->Edx;
                    ContextSave.Edi = Trap->Edi;
                    ContextSave.Esi = Trap->Esi;
                    ContextSave.EFlags = Trap->EFlags;

                    KiBugCheckData[0] |= MINIDUMP_BUGCHECK;
                }
                break;

            case THREAD_STUCK_IN_DEVICE_DRIVER:

                // Extract the address of the spinning code from the thread
                // object, so the dump is based off this thread.

                Thread = (PKTHREAD) BugCheckParameter1;

                if (Thread->State == Running)
                {
                    //
                    // If the thread was running, the thread is now in a
                    // frozen state and the registers are in the PRCB
                    // context
                    //
                    ULONG Processor = Thread->NextProcessor;
                    ASSERT(Processor < (ULONG) KeNumberProcessors);
                    ContextSave =
                      KiProcessorBlock[Processor]->ProcessorState.ContextFrame;
                }
                else
                {
                    //
                    // This should be a uniproc machine, and the thread
                    // should be suspended.  Just get the data off the
                    // switch frame.
                    //

                    PKSWITCHFRAME SwitchFrame = (PKSWITCHFRAME)Thread->KernelStack;

                    ASSERT(Thread->State == Ready);

                    ContextSave.Esp = (ULONG)Thread->KernelStack + sizeof(KSWITCHFRAME);
                    ContextSave.Ebp = *((PULONG)(ContextSave.Esp));
                    ContextSave.Eip = SwitchFrame->RetAddr;
                }

                KiBugCheckData[0] |= MINIDUMP_BUGCHECK;
                break;

            case UNEXPECTED_KERNEL_MODE_TRAP:

                //
                // Double fault
                //

                if (BugCheckParameter1 == 0x8)
                {
                    // The thread is correct in this case.
                    // Second parameter is the TSS.  If we have a TSS, convert
                    // the context and mark the bugcheck as converted.

                    PKTSS Tss = (PKTSS) BugCheckParameter2;

                    if (Tss)
                    {
                        if (Tss->EFlags & EFLAGS_V86_MASK)
                        {
                            ContextSave.SegSs = Tss->Ss & 0xffff;
                        }
                        else if (Tss->Cs & 1)
                        {
                            //
                            // It's user mode.
                            // The HardwareSegSs contains R3 data selector.
                            //

                            ContextSave.SegSs = (Tss->Ss | 3) & 0xffff;
                        }
                        else
                        {
                            ContextSave.SegSs = KGDT_R0_DATA;
                        }

                        ContextSave.SegGs = Tss->Gs & 0xffff;
                        ContextSave.SegFs = Tss->Fs & 0xffff;
                        ContextSave.SegEs = Tss->Es & 0xffff;
                        ContextSave.SegDs = Tss->Ds & 0xffff;
                        ContextSave.SegCs = Tss->Cs & 0xffff;
                        ContextSave.Esp = Tss->Esp;
                        ContextSave.Eip = Tss->Eip;
                        ContextSave.Ebp = Tss->Ebp;
                        ContextSave.Eax = Tss->Eax;
                        ContextSave.Ebx = Tss->Ebx;
                        ContextSave.Ecx = Tss->Ecx;
                        ContextSave.Edx = Tss->Edx;
                        ContextSave.Edi = Tss->Edi;
                        ContextSave.Esi = Tss->Esi;
                        ContextSave.EFlags = Tss->EFlags;
                    }

                    KiBugCheckData[0] |= MINIDUMP_BUGCHECK;
                    break;
                }
#endif
            default:
                break;
            }

            //
            // Write a crash dump and optionally reboot if the system has been
            // so configured.
            //

            IoAddTriageDumpDataBlock(PAGE_ALIGN(KiBugCheckData[1]), PAGE_SIZE);
            IoAddTriageDumpDataBlock(PAGE_ALIGN(KiBugCheckData[2]), PAGE_SIZE);
            IoAddTriageDumpDataBlock(PAGE_ALIGN(KiBugCheckData[3]), PAGE_SIZE);
            IoAddTriageDumpDataBlock(PAGE_ALIGN(KiBugCheckData[4]), PAGE_SIZE);
            IoAddTriageDumpDataBlock(PAGE_ALIGN(SaveDataPage), PAGE_SIZE);

            //
            // If the DPC stack is active, save that data page as well.
            //

#if defined (_X86_)
            if (KeGetCurrentPrcb()->DpcRoutineActive)
            {
                IoAddTriageDumpDataBlock(PAGE_ALIGN(KeGetCurrentPrcb()->DpcRoutineActive), PAGE_SIZE);
            }
#endif
        }

        IoWriteCrashDump((ULONG)KiBugCheckData[0],
                         KiBugCheckData[1],
                         KiBugCheckData[2],
                         KiBugCheckData[3],
                         KiBugCheckData[4],
                         &ContextSave,
                         Thread,
                         &Reboot);
    }

    //
    // Invoke bugcheck callbacks after crashdump, so the callbacks will
    // not prevent us from crashdumping.
    //

    KiScanBugCheckCallbackList();

    //
    // Start the watchdog timer
    //

    if (ExpWdHandler != NULL) {
        ExpWdHandler( WdActionStartTimer, ExpWdHandlerContext, NULL, TRUE );
    }

    //
    // Reboot the machine if necessary.
    //

    if (Reboot) {
        DbgUnLoadImageSymbols (NULL, (PVOID)-1, 0);
        HalReturnToFirmware (HalRebootRoutine);
    }


    //
    // Attempt to enter the kernel debugger.
    //

    KiBugCheckDebugBreak (DBG_STATUS_BUGCHECK_SECOND);
}
#ifdef _X86_
#pragma optimize("", on)
#endif


VOID
KeEnterKernelDebugger (
    VOID
    )

/*++

Routine Description:

    This function crashes the system in a controlled manner attempting
    to invoke the kernel debugger.

Arguments:

    None.

Return Value:

    None.

--*/

{

#if !defined(i386)
    KIRQL OldIrql;
#endif

    //
    // Freeze execution of the system by disabling interrupts and looping.
    //

    KiHardwareTrigger = 1;
    KeDisableInterrupts();
#if !defined(i386)
    KeRaiseIrql(HIGH_LEVEL, &OldIrql);
#endif
    if (InterlockedDecrement (&KeBugCheckCount) == 0) {
        if (KdDebuggerEnabled == FALSE) {
            if ( KdPitchDebugger == FALSE ) {
                KdInitSystem(0, NULL);
            }
        }
    }

    KiBugCheckDebugBreak (DBG_STATUS_FATAL);
}

NTKERNELAPI
BOOLEAN
KeDeregisterBugCheckCallback (
    IN PKBUGCHECK_CALLBACK_RECORD CallbackRecord
    )

/*++

Routine Description:

    This function deregisters a bug check callback record.

Arguments:

    CallbackRecord - Supplies a pointer to a bug check callback record.

Return Value:

    If the specified bug check callback record is successfully deregistered,
    then a value of TRUE is returned. Otherwise, a value of FALSE is returned.

--*/

{

    BOOLEAN Deregister;
    KIRQL OldIrql;

    //
    // Raise IRQL to HIGH_LEVEL and acquire the bug check callback list
    // spinlock.
    //

    KeRaiseIrql(HIGH_LEVEL, &OldIrql);
    KiAcquireSpinLock(&KeBugCheckCallbackLock);

    //
    // If the specified callback record is currently registered, then
    // deregister the callback record.
    //

    Deregister = FALSE;
    if (CallbackRecord->State == BufferInserted) {
        CallbackRecord->State = BufferEmpty;
        RemoveEntryList(&CallbackRecord->Entry);
        Deregister = TRUE;
    }

    //
    // Release the bug check callback spinlock, lower IRQL to its previous
    // value, and return whether the callback record was successfully
    // deregistered.
    //

    KiReleaseSpinLock(&KeBugCheckCallbackLock);
    KeLowerIrql(OldIrql);
    return Deregister;
}

NTKERNELAPI
BOOLEAN
KeRegisterBugCheckCallback (
    IN PKBUGCHECK_CALLBACK_RECORD CallbackRecord,
    IN PKBUGCHECK_CALLBACK_ROUTINE CallbackRoutine,
    IN PVOID Buffer,
    IN ULONG Length,
    IN PUCHAR Component
    )

/*++

Routine Description:

    This function registers a bug check callback record. If the system
    crashes, then the specified function will be called during bug check
    processing so it may dump additional state in the specified bug check
    buffer.

    N.B. Bug check callback routines are called in reverse order of
         registration, i.e., in LIFO order.

Arguments:

    CallbackRecord - Supplies a pointer to a callback record.

    CallbackRoutine - Supplies a pointer to the callback routine.

    Buffer - Supplies a pointer to the bug check buffer.

    Length - Supplies the length of the bug check buffer in bytes.

    Component - Supplies a pointer to a zero terminated component
        identifier.

Return Value:

    If the specified bug check callback record is successfully registered,
    then a value of TRUE is returned. Otherwise, a value of FALSE is returned.

--*/

{

    BOOLEAN Inserted;
    KIRQL OldIrql;

    //
    // Raise IRQL to HIGH_LEVEL and acquire the bug check callback list
    // spinlock.
    //

    KeRaiseIrql(HIGH_LEVEL, &OldIrql);
    KiAcquireSpinLock(&KeBugCheckCallbackLock);

    //
    // If the specified callback record is currently not registered, then
    // register the callback record.
    //

    Inserted = FALSE;
    if (CallbackRecord->State == BufferEmpty) {
        CallbackRecord->CallbackRoutine = CallbackRoutine;
        CallbackRecord->Buffer = Buffer;
        CallbackRecord->Length = Length;
        CallbackRecord->Component = Component;
        CallbackRecord->Checksum =
            ((ULONG_PTR)CallbackRoutine + (ULONG_PTR)Buffer + Length + (ULONG_PTR)Component);

        CallbackRecord->State = BufferInserted;
        InsertHeadList(&KeBugCheckCallbackListHead, &CallbackRecord->Entry);
        Inserted = TRUE;
    }

    //
    // Release the bug check callback spinlock, lower IRQL to its previous
    // value, and return whether the callback record was successfully
    // registered.
    //

    KiReleaseSpinLock(&KeBugCheckCallbackLock);
    KeLowerIrql(OldIrql);
    return Inserted;
}

VOID
KiScanBugCheckCallbackList (
    VOID
    )

/*++

Routine Description:

    This function scans the bug check callback list and calls each bug
    check callback routine so it can dump component specific information
    that may identify the cause of the bug check.

    N.B. The scan of the bug check callback list is performed VERY
        carefully. Bug check callback routines are called at HIGH_LEVEL
        and may not acquire ANY resources.

Arguments:

    None.

Return Value:

    None.

--*/

{

    PKBUGCHECK_CALLBACK_RECORD CallbackRecord;
    ULONG_PTR Checksum;
    ULONG Index;
    PLIST_ENTRY LastEntry;
    PLIST_ENTRY ListHead;
    PLIST_ENTRY NextEntry;
    PUCHAR Source;

    //
    // If the bug check callback listhead is not initialized, then the
    // bug check has occured before the system has gotten far enough
    // in the initialization code to enable anyone to register a callback.
    //

    ListHead = &KeBugCheckCallbackListHead;
    if ((ListHead->Flink != NULL) && (ListHead->Blink != NULL)) {

        //
        // Scan the bug check callback list.
        //

        LastEntry = ListHead;
        NextEntry = ListHead->Flink;
        while (NextEntry != ListHead) {

            //
            // The next entry address must be aligned properly, the
            // callback record must be readable, and the callback record
            // must have back link to the last entry.
            //

            if (((ULONG_PTR)NextEntry & (sizeof(ULONG_PTR) - 1)) != 0) {
                return;

            } else {
                CallbackRecord = CONTAINING_RECORD(NextEntry,
                                                   KBUGCHECK_CALLBACK_RECORD,
                                                   Entry);

                Source = (PUCHAR)CallbackRecord;
                for (Index = 0; Index < sizeof(KBUGCHECK_CALLBACK_RECORD); Index += 1) {
                    if (MmIsAddressValid((PVOID)Source) == FALSE) {
                        return;
                    }

                    Source += 1;
                }

                if (CallbackRecord->Entry.Blink != LastEntry) {
                    return;
                }

                //
                // If the callback record has a state of inserted and the
                // computed checksum matches the callback record checksum,
                // then call the specified bug check callback routine.
                //

                Checksum = (ULONG_PTR)CallbackRecord->CallbackRoutine;
                Checksum += (ULONG_PTR)CallbackRecord->Buffer;
                Checksum += CallbackRecord->Length;
                Checksum += (ULONG_PTR)CallbackRecord->Component;
                if ((CallbackRecord->State == BufferInserted) &&
                    (CallbackRecord->Checksum == Checksum)) {

                    //
                    // Call the specified bug check callback routine and
                    // handle any exceptions that occur.
                    //

                    CallbackRecord->State = BufferStarted;
                    try {
                        (CallbackRecord->CallbackRoutine)(CallbackRecord->Buffer,
                                                          CallbackRecord->Length);

                        CallbackRecord->State = BufferFinished;

                    } except(EXCEPTION_EXECUTE_HANDLER) {
                        CallbackRecord->State = BufferIncomplete;
                    }
                }
            }

            LastEntry = NextEntry;
            NextEntry = NextEntry->Flink;
        }
    }

    return;
}

NTKERNELAPI
BOOLEAN
KeDeregisterBugCheckReasonCallback (
    IN PKBUGCHECK_REASON_CALLBACK_RECORD CallbackRecord
    )

/*++

Routine Description:

    This function deregisters a bug check callback record.

Arguments:

    CallbackRecord - Supplies a pointer to a bug check callback record.

Return Value:

    If the specified bug check callback record is successfully deregistered,
    then a value of TRUE is returned. Otherwise, a value of FALSE is returned.

--*/

{

    BOOLEAN Deregister;
    KIRQL OldIrql;

    //
    // Raise IRQL to HIGH_LEVEL and acquire the bug check callback list
    // spinlock.
    //

    KeRaiseIrql(HIGH_LEVEL, &OldIrql);
    KiAcquireSpinLock(&KeBugCheckCallbackLock);

    //
    // If the specified callback record is currently registered, then
    // deregister the callback record.
    //

    Deregister = FALSE;
    if (CallbackRecord->State == BufferInserted) {
        CallbackRecord->State = BufferEmpty;
        RemoveEntryList(&CallbackRecord->Entry);
        Deregister = TRUE;
    }

    //
    // Release the bug check callback spinlock, lower IRQL to its previous
    // value, and return whether the callback record was successfully
    // deregistered.
    //

    KiReleaseSpinLock(&KeBugCheckCallbackLock);
    KeLowerIrql(OldIrql);
    return Deregister;
}

NTKERNELAPI
BOOLEAN
KeRegisterBugCheckReasonCallback (
    IN PKBUGCHECK_REASON_CALLBACK_RECORD CallbackRecord,
    IN PKBUGCHECK_REASON_CALLBACK_ROUTINE CallbackRoutine,
    IN KBUGCHECK_CALLBACK_REASON Reason,
    IN PUCHAR Component
    )

/*++

Routine Description:

    This function registers a bug check callback record. If the system
    crashes, then the specified function will be called during bug check
    processing.

    N.B. Bug check callback routines are called in reverse order of
         registration, i.e., in LIFO order.

Arguments:

    CallbackRecord - Supplies a pointer to a callback record.

    CallbackRoutine - Supplies a pointer to the callback routine.

    Reason - Specifies the conditions under which the callback
             should be called.

    Component - Supplies a pointer to a zero terminated component
        identifier.

Return Value:

    If the specified bug check callback record is successfully registered,
    then a value of TRUE is returned. Otherwise, a value of FALSE is returned.

--*/

{

    BOOLEAN Inserted;
    KIRQL OldIrql;

    //
    // Raise IRQL to HIGH_LEVEL and acquire the bug check callback list
    // spinlock.
    //

    KeRaiseIrql(HIGH_LEVEL, &OldIrql);
    KiAcquireSpinLock(&KeBugCheckCallbackLock);

    //
    // If the specified callback record is currently not registered, then
    // register the callback record.
    //

    Inserted = FALSE;
    if (CallbackRecord->State == BufferEmpty) {
        CallbackRecord->CallbackRoutine = CallbackRoutine;
        CallbackRecord->Reason = Reason;
        CallbackRecord->Component = Component;
        CallbackRecord->Checksum =
            ((ULONG_PTR)CallbackRoutine + Reason + (ULONG_PTR)Component);

        CallbackRecord->State = BufferInserted;
        InsertHeadList(&KeBugCheckReasonCallbackListHead,
                       &CallbackRecord->Entry);
        Inserted = TRUE;
    }

    //
    // Release the bug check callback spinlock, lower IRQL to its previous
    // value, and return whether the callback record was successfully
    // registered.
    //

    KiReleaseSpinLock(&KeBugCheckCallbackLock);
    KeLowerIrql(OldIrql);

    return Inserted;
}

VOID
KiInvokeBugCheckEntryCallbacks (
    VOID
    )
/*++

Routine Description:

    This function scans the bug check reason callback list and calls
    each bug check entry callback routine.

    This may seem like a duplication of KiScanBugCheckCallbackList
    but the critical difference is that the bug check entry callbacks
    are called immediately upon entry to KeBugCheck2 whereas
    KSBCCL does not invoke its callbacks until after all bug check
    processing has finished.

    In order to avoid people from abusing this callback it's
    semi-private and the reason -- KbCallbackReserved1 -- has
    an obscure name.

    N.B. The scan of the bug check callback list is performed VERY
        carefully. Bug check callback routines may be called at HIGH_LEVEL
        and may not acquire ANY resources.

Arguments:

    None.

Return Value:

    None.

--*/

{
    PKBUGCHECK_REASON_CALLBACK_RECORD CallbackRecord;
    ULONG_PTR Checksum;
    PLIST_ENTRY LastEntry;
    PLIST_ENTRY ListHead;
    PLIST_ENTRY NextEntry;
    PUCHAR Va;
    ULONG Pages;

    //
    // If the bug check callback listhead is not initialized, then the
    // bug check has occured before the system has gotten far enough
    // in the initialization code to enable anyone to register a callback.
    //

    ListHead = &KeBugCheckReasonCallbackListHead;
    if (ListHead->Flink == NULL || ListHead->Blink == NULL) {
        return;
    }

    //
    // Scan the bug check callback list.
    //

    LastEntry = ListHead;
    NextEntry = ListHead->Flink;
    while (NextEntry != ListHead) {

        //
        // The next entry address must be aligned properly, the
        // callback record must be readable, and the callback record
        // must have back link to the last entry.
        //

        if (((ULONG_PTR)NextEntry & (sizeof(ULONG_PTR) - 1)) != 0) {
            return;
        }

        CallbackRecord = CONTAINING_RECORD(NextEntry,
                                           KBUGCHECK_REASON_CALLBACK_RECORD,
                                           Entry);

        //
        // Verify that the callback record is still valid.
        //

        Va = (PUCHAR) PAGE_ALIGN (CallbackRecord);
        Pages = ADDRESS_AND_SIZE_TO_SPAN_PAGES (CallbackRecord,
                                                sizeof (*CallbackRecord));

        while (Pages) {
            if (!MmIsAddressValid (Va)) {
                return;
            }
            Va += PAGE_SIZE;
            Pages--;
        }

        if (CallbackRecord->Entry.Blink != LastEntry) {
            return;
        }

        LastEntry = NextEntry;
        NextEntry = NextEntry->Flink;

        //
        // If the callback record has a state of inserted and the
        // computed checksum matches the callback record checksum,
        // then call the specified bug check callback routine.
        //

        Checksum = (ULONG_PTR)CallbackRecord->CallbackRoutine;
        Checksum += (ULONG_PTR)CallbackRecord->Reason;
        Checksum += (ULONG_PTR)CallbackRecord->Component;
        if ((CallbackRecord->State != BufferInserted) ||
            (CallbackRecord->Checksum != Checksum) ||
            (CallbackRecord->Reason != KbCallbackReserved1) ||
            MmIsAddressValid((PVOID)(ULONG_PTR)CallbackRecord->
                             CallbackRoutine) == FALSE) {

            continue;
        }

        //
        // Call the specified bug check callback routine and
        // handle any exceptions that occur.
        //

        try {
            (CallbackRecord->CallbackRoutine)(KbCallbackReserved1,
                                              CallbackRecord,
                                              NULL, 0);
            CallbackRecord->State = BufferFinished;
        } except(EXCEPTION_EXECUTE_HANDLER) {
            CallbackRecord->State = BufferIncomplete;
        }
    }
}