注册 PSHED 插件
PSHED 插件通过调用 PshedRegisterPlugin 函数将自身注册到 PSHED ,并将指针传递到初始化 WHEA_PSHED_PLUGIN_REGISTRATION_PACKET 结构。 PSHED 插件通常从其 DriverEntry 函数或 AddDevice 函数内部调用 PshedRegisterPlugin 函数。
PSHED 插件可以调用 PshedIsSystemWheaEnabled 来检查系统是否已启用 WHEA,然后再调用 PshedRegisterPlugin。
有两个版本的 PSHED 插件。 两者的主要区别在于可以取消注册 V2 插件。 V1 PSHED 插件成功向 PSHED 注册后,在操作系统会话期间无法取消注册。 因此,不得从系统卸载已注册的 PSHED 插件,否则可能会出现 bug 检查。 V2 插件允许取消注册。
下面的代码示例演示如何注册参与错误信息检索和错误记录持久性的 PSHED 插件。 请注意 V1 和 V2 的差异。
// Prototypes for the callback functions for
// participating in error information retrieval
NTSTATUS
RetrieveErrorInfo(
IN OUT PVOID PluginContext,
IN PWHEA_ERROR_SOURCE_DESCRIPTOR ErrorSource,
IN ULONG64 BufferLength,
IN OUT PWHEA_ERROR_PACKET Packet
);
NTSTATUS
FinalizeErrorRecord(
IN OUT PVOID PluginContext,
IN PWHEA_ERROR_SOURCE_DESCRIPTOR ErrorSource,
IN ULONG BufferLength,
IN OUT PWHEA_ERROR_RECORD ErrorRecord
);
NTSTATUS
ClearErrorStatus(
IN OUT PVOID PluginContext,
IN PWHEA_ERROR_SOURCE_DESCRIPTOR ErrorSource,
IN ULONG BufferLength,
IN PWHEA_ERROR_RECORD ErrorRecord
);
// Prototypes for the callback functions for
// participating in error record persistence.
NTSTATUS
WriteErrorRecord(
IN OUT PVOID PluginContext,
IN ULONG Flags,
IN ULONG RecordLength,
IN PWHEA_ERROR_RECORD ErrorRecord
);
NTSTATUS
ReadErrorRecord(
IN OUT PVOID PluginContext,
IN ULONG Flags,
IN ULONGLONG ErrorRecordId
IN PULONGLONG NextErrorRecordId
IN OUT PULONG RecordLength,
OUT PWHEA_ERROR_RECORD *ErrorRecord
);
NTSTATUS
ClearErrorRecord(
IN OUT PVOID PluginContext,
IN ULONG Flags,
IN ULONGLONG ErrorRecordId
);
// The PSHED plug-in registration packet for a V1 PSHED plugin
WHEA_PSHED_PLUGIN_REGISTRATION_PACKET_V1 RegPacket =
{
sizeof(WHEA_PSHED_PLUGIN_REGISTRATION_PACKET_V1),
WHEA_PSHED_PLUGIN_REGISTRATION_PACKET_V1,
NULL,
PshedFAErrorInfoRetrieval | PshedFAErrorRecordPersistence,
0,
{
NULL,
NULL,
NULL,
NULL,
NULL,
NULL,
WriteErrorRecord,
ReadErrorRecord,
ClearErrorRecord,
RetrieveErrorInfo,
FinalizeErrorRecord,
ClearErrorStatus,
NULL,
NULL,
NULL
}
}
// The PSHED plug-in registration packet for a V2 PSHED plugin
WHEA_PSHED_PLUGIN_REGISTRATION_PACKET RegPacket =
{
sizeof(WHEA_PSHED_PLUGIN_REGISTRATION_PACKET),
WHEA_PLUGIN_REGISTRATION_PACKET_VERSION,
NULL,
PshedFAErrorInfoRetrieval | PshedFAErrorRecordPersistence,
0,
{
NULL,
NULL,
NULL,
NULL,
NULL,
NULL,
WriteErrorRecord,
ReadErrorRecord,
ClearErrorRecord,
RetrieveErrorInfo,
FinalizeErrorRecord,
ClearErrorStatus,
NULL,
NULL,
NULL
},
PluginHandle
}
//
// The PSHED plug-in's DriverEntry function for a V1 PSHED Plugin
//
NTSTATUS
DriverEntry(
IN PDRIVER_OBJECT DriverObject,
IN PUNICODE_STRING RegistryPath
)
{
BOOLEAN IsWheaEnabled;
NTSTATUS Status;
...
// No unload function for V1 PSHED plugins
DriverObject->DriverUnload = NULL;
// Query if the system is WHEA-enabled
IsWheaEnabled =
PshedIsSystemWheaEnabled(
);
// Check result
if (IsWheaEnabled == FALSE)
{
// Return "not supported" status
return STATUS_NOT_SUPPORTED;
}
// Register the PSHED plug-in
Status =
PshedRegisterPlugin(
&RegPacket
);
// Check status
if (Status != STATUS_SUCCESS)
{
// Handle error
...
}
...
// Return success
return STATUS_SUCCESS;
}
//
// The PSHED plug-in's DriverEntry function for a V2 PSHED Plugin
//
NTSTATUS
DriverEntry(
IN PDRIVER_OBJECT DriverObject,
IN PUNICODE_STRING RegistryPath
)
{
BOOLEAN IsWheaEnabled;
NTSTATUS Status;
...
// There is an unload function for V2 PSHED plugin
DriverObject->DriverUnload = PluginUnload;
// Query if the system is WHEA-enabled
IsWheaEnabled =
PshedIsSystemWheaEnabled(
);
// Check result
if (IsWheaEnabled == FALSE)
{
// Return "not supported" status
return STATUS_NOT_SUPPORTED;
}
// Register the PSHED plug-in
Status =
PshedRegisterPlugin(
&RegPacket
);
// Check status
if (Status != STATUS_SUCCESS)
{
// Handle error
...
}
...
// Return success
return STATUS_SUCCESS;
}