Windows Driver 1_Setting Environment to Remote Debug

In this article, I will discuss how to set up the environment on Host/Target Computer to remote debug the driver running on target computer.
(p.s Target Computer is a virtual computer to test your driver )

A. Environment
Host Computer : Windows7 SP1 x86
                         WDK (Windows Driver Kit)8.1
                         Visual Studio 2013
Target Computer : Windows7 SP1 x86 (Run on VMware Player)
                             Debug View
                             osrLoader

B. Settings on VS2013
      (1) [ Driver] menu-> Test->Computer Configuration
      (2) select [Add New Computer] button -> choose [Manually configure debuggers and do not provision], remember to give it a name!
         

      (3)  choose [Kernel Mode] and set the values as the picture shows->next->finish

      (4) finally you will get the settings as follow

C. Settings on VM

     (1) open [Virtual Machine Settings]

     (2) delete the Printer in order to let new serial port=1

     (3) [add] -> serial port -> choose [output to named pipe] as its serial port type -> in the Named pipe field enter "\\.\pipe\com_1" and choose [this end is the server],[the other end is an application ] -> finish

Your settings may look the same as follow, and remember to check out the [Yield CPU on poll]

D.  After those settings, turn on the target computer on VM (i.e your target computer=windows7)

     (1) use system manager's identity to open the command line and enter "bcdedit" to open the Windows Boot Manager (以系統管理員身分執行)

     (2) enter a command bcdedit  /copy  {current}  /d  "Windows 7 Kernel Debug Mode". 

This command will copy current boot settings and give it a new name, i.e Windows 7 Kernel Debug Mode, and you will see 2 booting selections in boot manager.

       (3) press WIN+R and open "msconfig" service -> choose [boot] (開機) menu, you'll see Windows 7 Kenel Debug Mode in it. Select to boot it as a default selection.(設定成預設值) Now choose it and click 進階選項-> check out  the debug(偵錯) box, and select debug serial port(com1), finally select transmit rate to 115200 -> OK -> reboot your target computer.

E. Wow!!! Get ready to remote debug

     (1) Go back to VS2013 and click [Debugging Tools for Windows-Kernel Debugger]

     (2) select I know what I'm doing, continue debugging

   (3) then you can see your debugging progress in Debugger Immediate Window, if it keeps waiting to reconnect for too long, trying to  reboot your vm again and the connection will be success.

Hurray!!!!!  You can remote debug your driver on target computer right now!

[Reference]

1. http://blog.csdn.net/iceamber2012/article/details/18809813

2. http://blog.csdn.net/iceamber2012/article/details/17963649

Write your own system call

Linux Version 2.6.35.4

(CentOS)

目錄前的Linux代表kernel source code的根目錄

我的Linux= /usr/src/kernels/linux-2.6.35.4

A.      加一個自己的system call

1.      新增一筆syscall service routine name到 syscall table中

Linux/arch/x86/kernel/syscall_table_32.S 中加 “.long sys_process_switch_info”

當syscall call發生時kernel會到此table中找到對應的service routine name

2.      定義syscall number

Linux/arch/x86/include/asm/unistd_32.h

把新的number加上去，並將__NR_syscalls +1

(__NR_syscalls代表maximum的syscalls number)

3.      定義syscall的prototype

Linux/include/syscalls.h 這裡定義所有的syscall prototype

(asmlinkage是一種語法，用來與不同compiler間溝通)

 4.      Syscall 真正的code

此syscall中我自己定義的一個structure (在這裡不重要)

真正的syscall從SYSCALL_DEFINE[0-6](….)開始

SYSCALL_DEFINE可以接受0到6個參數, 第一個參數是SYSCALL NAME不算在內。定義形式是這樣的:

SYSCALL_DEFINE[參數個數](SYSCALL NAME, 參數1型態, 參數1, 參數2型態,參數2….)

因為我的syscall只有一個型態為 process_switch_info*的參數 psi, 因此我是

SYSCALL_DEFINE1(……)

(若沒有參數的話在第3步裡面參數地方要寫void不然會有錯)

5.      加入Makefile(把object檔放入 source code tree中)

Linux/kernel/Makefile

(新增的syscall放在哪一層，就加在該層的Makefile中)

6.   重編kernel

make

make modules_install

make install

B.      測試system call

1.      syscall(__NR_process_switch_info, psi)是呼叫syscall的方法

第一個參數為syscall name, 後面的參數放該syscall所需的參數

可以直接寫在.c中，這裡定義了get_process_switch_info()讓.c中的function name有意義，因此傳了一個自訂的structure進來才呼叫syscall

Ftrace 追蹤kernel process

為了確認process到底是怎麼context switch以及context switch幾次，花了些時間研究了Ftrace。有些地方仍不是很了解，要再查資料研究
Linux version : 2.6.35.4 (CentOS)

1.     Ftrace 是內建的tracker，在編譯核心時可以到選單裡的<kernel hacking>選擇 (因為不太熟悉各選項的用途，因次我全選了= _=)

2.   選完後開始編譯

make à make modules_install à make install àreboot

3.    到 /sys/kernel/debug , 將 debugfs mount上去

# mount –t debugfs nodev /sys/kernel/debug 

4.     現在可以到 /sys/kernel/debug/tracing下, 會看到一大堆檔案

可以查看 available_tracers 看看有那些tracer可以用

5.     使用 tracer的步驟

(a)  關閉 tracing_enabled (0是closed, 1 是 opened)

# echo 0 > tracing_enabled

(b) 打開 ftraced_enabled (不太清楚原因

# echo 1 > /proc/sys/kernel/ftrace_enabled

(c)  選擇目前要用的tracer

# echo … > current_tracer

(d) 設定要跟蹤的函數到 set_ftrace_filter

# echo … > set_ftrace_filter

(e)  打開 tracing enabled

# echo 1 > tracing_enabled

(f)   執行想要追蹤的程式或做其他事, ftrace會開始追蹤kernel

(g)  結束追蹤

# echo 0 > tracing_enabled

或暫停追蹤(tracer只是暫停沒有結束

# echo 0 > tracing_on

(h) 看結果囉!

# cat trace

可以搭配 grep指令列出想看的東西

# cat trace | grep test (test是我剛剛執行的執行檔)

或是 >> 將 trace輸出成自己的檔案

# cat trace >> /trace1 (輸出到跟目錄下 檔名為 trace1)

6.     我這一次觀察了2種 tracer

(a)  Function

會列出function執行的順序

下圖是我執行 test 之後的tracer, 我有用 filter鎖定我要看的函數, 也就是主要做context_switch的schedule了

欄位意思大概是這樣

TASK-PID	Cpu#	TIMESTAMP	FUNCTION
<test>-5049	000	13211.469334	Scheduleßwork_resched

Process test pid 5049正在執行, 使用編號 0的CPU, 時間是timestamp, 正由work_resched呼叫schedule function

看樣子應該是準備進行contest switch了

我的test就是會讓他睡8次的一支程式(作業需要XD)

所以可以看到8個nanosleep呼叫schedule準備把控制權交出來然後去睡覺

(a)  Sched_switch

列出 context switch的info

下圖是使用sched_switch看process 做context switchc的情況

我用 grep test 過濾出我想看的, 欄位意思大概是

TASK-PID	Cpu#	TIMESTAMP	FUNCTION
<test>-5182	000	14456.847013	(*)

(*): 5182:120:S == > [000] 0:120:R <idle>

   pid 5182, priority 120,目前狀態S代表 TASK_INTERRUPTIBLE可中斷睡眠狀態

== >代表轉移控制權( + 可能是代表正在叫醒某Process)

7.     Reference

http://www.ibm.com/developerworks/cn/linux/l-cn-ftrace2/

http://jayiist.blog.163.com/blog/static/18715931120122555631948/

http://events.linuxfoundation.org/slides/2010/linuxcon_japan/linuxcon_jp2010_rostedt.pdf

week4- 形容詞&副詞子句應用

module 1:
I live in Taiwan, which has plenty of delicious food and beautiful landscapes. Although Taiwan is a tiny island surrounded by ocean, it  is still abundant in natural resources. Due to the limitation of ground where people can live, the cities in Taiwan usually have high population. Therefore, the culture of night market grows rapidly in Taiwan such that people can enjoy  a variety of small eats even though it's midnight. "Taipei travel essentials: passport, cash, extra stomach",  which CNN had published before, recommends 40 Taiwanese foods we can't live without. For instance, Bubble tea, the most fabulous drink with tapioca balls, is one of the most representative small food in Taiwan.  Except for small food, Taiwanese also wins reputation of being hospitable and enthusiastic. You can experience our enthusiasm wherever you go, so come and visit our beautiful island, Taiwan.

module 2 :
In my opinion, natural disasters are a huge disadvantage of Taiwan. One of natural disasters is typhoon, consisting of a tropical cyclone. In summer, typhoons, bringing an enormous rainfall and a strong breeze, will come and cause a serious damage to our crops. On account of the damage, our agricultural economic losses hundreds of million dollars each year. Besides, concerning about the shortage of fruits and vegetables, people will buy lots of food before the coming of typhoon, leading to a rise of food prices. Furthermore, villages beside the mountains will risk losing their houses due to mudflows and landslides. To ensure security of residents, government will withdraw all of them by a strong hand to the safer place. Another natural disaster is earthquake,known for its unpredictable occurrence and intense destructive power. People cannot run out of the house immediately while earthquake occurs.When it comes to an huge earthquake, the ground will rumble with house shaking violently. Few seconds later, the houses will collapse rapidly that almost no one can survive. Natural disasters are unavoidable, the most important thing to do is to reduce the damages as best as we can.