Windows Driver 3_ Provision Computer For Driver Deployment And Testing

In the previous discussion, I used [manually configure debuggers and do not provision], but in this way, the driver files must be installed by myself. In order to save time, I use [Provision computer and choose debugger settings], the more details is in 
http://msdn.microsoft.com/en-us/library/windows/hardware/hh698272(v=vs.85).aspx

I'll show steps briefly...
Assume that the driver has built already and the things we have to do is to  deploy and test it.

1. Go to C:\Program Files\Windows Kits\8.1\Remote\x86, then copy [WDK Test Target Setup x86-x86_en-us] into your target computer and install it. 


2. In Host Computer (Visual Studio 2013)

   [Driver] menu -> test-> Configure Computer

   choose second one, and notice that the computer name must as same as the name of your target computer,

you can find your target computer's name just like second pictures:

After clicking next, you have to set the pipe name. 

Note that the pipe name must as same as the pipename you set in vmware. The picture below shows the pipe name that I set at VMware before.

(We create this serial port to let virtual computer know that there's a port it can use. This serial port is a virtual port and VMware will receive the data from virtual computer through this port, then send the data out to the host computer according to the pipe name, the host computer must have the same pipe name to receive these data from VMware and handle them, and that's why we set a pipe name in Visual Studio and in VMware both the same.)

After finishing the configuration, system will connect to your target computer, and if success, it will show "complete" at last.

3. Now go back to the Visual Studio and in the Solution Manager Window(方案總管), right click [HelloWorld Package]-> properties -> Driver Install -> Deployment
Click [Enable deployment] and [Remove previous driver versions before deployment]
Then, entering Target Computer Name
Finally, in the [Hardware ID Driver Update], Type "Root\HelloWorld". Hardware ID does not identify a real hardware, it identifies an virtual device, and we must give it a place in the devie tree as child of the root node. The doc in Microsoft mentioned that we do not need to select [Hardware ID Driver Update] if it's a real hardware. Instead, we should choose [Install and Verify]

4. When you click F5 in your visual studio trying to remote debug to the target computer, this program will control the target computer, create a WDKRemoteUser account and move the driver packages, even run the driver automatically.


From now on, you don't need to copy your driver packages into the target computer manually, the debugger in Visual Studio will do it for U. Hurray!!!!!!

Windows Driver 2 _ HelloWorld Driver

It's time to write my first driver "HelloWorld"

I write this code in VS2013 and here's my steps

A. Create a new project

    (1) [File] menu->[New]->[Project], in the left pane, select [Installed]->[WDF], in the middle pane, select [Kernel Mode Driver, Empty(KMDF)]. Fill in "HelloWorld" in the name field and choose the project's location in the location field. Check out Create directory for solution. Finally click OK ! 

(Note that the name field can only be equal or less than 32 characters string, mentioned in Microsoft Official Doc)

    (2) In the Solution Explorer(方案總管), right click [HelloWorld]->add->new Item(新增項目). In the middle pane, select C++ File, and name "main.c" in the name field, then click add. Finally, you will see main.c under the Source Files

(Note that the file name extension is .c !!)

Here's the code:

-------------------------------------------------------------------------------------------------------

#include <ntddk.h>  

VOID DriverUnload(PDRIVER_OBJECT driver)

{

DbgPrint("first:HelloWorld End！");

}

NTSTATUS DriverEntry(PDRIVER_OBJECT pDriverObject, PUNICODE_STRING pUnicodeString)

{

DbgPrint("first:HelloWorld Begin！");

pDriverObject->DriverUnload = DriverUnload;

return STATUS_SUCCESS;

}

-------------------------------------------------------------------------------------------------------

     (3) Right click Solution'HelloWorld'(2 Solutions)(方案'HelloWorld')-> configuration manager(組態管理員). Choose configuration and platform both HelloWorld and HelloWorld Package

     (4) Cancel Wpp Tracing

Solution Explorer->right click HelloWorld -> Properties -> set Run Wpp tracing to No -> OK

      (5) also in Properties->C/C++ -> middle pane 警告視為錯誤->否

    (6) Build project

Choose Build Solution->Build to build driver and create a driver package, the ouput window will show the build progress.

      (7) Navigate in Windows Explorer to your HelloWorld folder(..\Visual Studio 2013\Projects\HelloWorld), then go into win7Debug\HelloWorld Package folder, there will have several files:

HelloWorld.sys : the kernel mode driver file

HelloWorld.inf : an information file that Windows uses when driver is installed

HelloWorld.cat : a catalog file that the installer uses to verify the test signature for the driver package

WdfCoinstaller01011.dll : A co-installer for the Windows Driver Frameworks(WDF)

B. After building your project, it's time to test it on target computer.

Before testing your driver, you must copy your [HelloWorld Package]folder into your target computer.

Normally, you will have 4 files in your HelloWorld folder that I mentioned in last article.

     (1) Let's start from setting the DebugView 

          Run -> regedit -> open key :[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager] -> create a key [Debug Print Filter] under this folder -> add a DEFAULT DWORD value and set a value 0x0f on it -> reboot

     (2) open DebugView and check out [capture]->[capture kernel]

     (3) open osrloader and select the sys file you want to load. Then click [Register Service] and [Start Service] then you will see "first:HelloWorld Begin" in DebugView.
Click [Stop Service] then you will see "first:HelloWorld End". If you want to remove the driver, click [Unregister Service].

     P.s You don't need to install the osrloader to load the driver, just find out your inf file, and right click on it, click [install]. However, it's up to you to use osrloader or not.
Another way to load your driver is using command, just entering sc create HelloWorld binPath= "your_sys_file's_location" type= "kernel" start= "demand" error= "normal" Displayname= "HelloWorld", press Enter
then entering sc start HelloWorld


     If you use remote debug, you will see your string at Debugger Immediate Window in VS2013 

[Reference]
1. http://home.educities.edu.tw/fushiyun2000/driver_nt_style_c_tutorial_hello_world.htm

2. http://eagle-sw.blogspot.tw/2011/10/win7debugview.html
3. http://blogs.microsoft.co.il/sasha/2011/06/04/baby-steps-in-windows-device-driver-development-part-2-hello-world-driver/
4. http://blog.csdn.net/wsye88/article/details/26375459

Windows Driver 1_Setting Environment to Remote Debug

In this article, I will discuss how to set up the environment on Host/Target Computer to remote debug the driver running on target computer.
(p.s Target Computer is a virtual computer to test your driver )

A. Environment
Host Computer : Windows7 SP1 x86
                         WDK (Windows Driver Kit)8.1
                         Visual Studio 2013
Target Computer : Windows7 SP1 x86 (Run on VMware Player)
                             Debug View
                             osrLoader

B. Settings on VS2013
      (1) [ Driver] menu-> Test->Computer Configuration
      (2) select [Add New Computer] button -> choose [Manually configure debuggers and do not provision], remember to give it a name!
         

      (3)  choose [Kernel Mode] and set the values as the picture shows->next->finish

      (4) finally you will get the settings as follow

C. Settings on VM

     (1) open [Virtual Machine Settings]

     (2) delete the Printer in order to let new serial port=1

     (3) [add] -> serial port -> choose [output to named pipe] as its serial port type -> in the Named pipe field enter "\\.\pipe\com_1" and choose [this end is the server],[the other end is an application ] -> finish

Your settings may look the same as follow, and remember to check out the [Yield CPU on poll]

D.  After those settings, turn on the target computer on VM (i.e your target computer=windows7)

     (1) use system manager's identity to open the command line and enter "bcdedit" to open the Windows Boot Manager (以系統管理員身分執行)

     (2) enter a command bcdedit  /copy  {current}  /d  "Windows 7 Kernel Debug Mode". 

This command will copy current boot settings and give it a new name, i.e Windows 7 Kernel Debug Mode, and you will see 2 booting selections in boot manager.

       (3) press WIN+R and open "msconfig" service -> choose [boot] (開機) menu, you'll see Windows 7 Kenel Debug Mode in it. Select to boot it as a default selection.(設定成預設值) Now choose it and click 進階選項-> check out  the debug(偵錯) box, and select debug serial port(com1), finally select transmit rate to 115200 -> OK -> reboot your target computer.

E. Wow!!! Get ready to remote debug

     (1) Go back to VS2013 and click [Debugging Tools for Windows-Kernel Debugger]

     (2) select I know what I'm doing, continue debugging

   (3) then you can see your debugging progress in Debugger Immediate Window, if it keeps waiting to reconnect for too long, trying to  reboot your vm again and the connection will be success.

Hurray!!!!!  You can remote debug your driver on target computer right now!

[Reference]

1. http://blog.csdn.net/iceamber2012/article/details/18809813

2. http://blog.csdn.net/iceamber2012/article/details/17963649

Write your own system call

Linux Version 2.6.35.4

(CentOS)

目錄前的Linux代表kernel source code的根目錄

我的Linux= /usr/src/kernels/linux-2.6.35.4

A.      加一個自己的system call

1.      新增一筆syscall service routine name到 syscall table中

Linux/arch/x86/kernel/syscall_table_32.S 中加 “.long sys_process_switch_info”

當syscall call發生時kernel會到此table中找到對應的service routine name

2.      定義syscall number

Linux/arch/x86/include/asm/unistd_32.h

把新的number加上去，並將__NR_syscalls +1

(__NR_syscalls代表maximum的syscalls number)

3.      定義syscall的prototype

Linux/include/syscalls.h 這裡定義所有的syscall prototype

(asmlinkage是一種語法，用來與不同compiler間溝通)

 4.      Syscall 真正的code

此syscall中我自己定義的一個structure (在這裡不重要)

真正的syscall從SYSCALL_DEFINE[0-6](….)開始

SYSCALL_DEFINE可以接受0到6個參數, 第一個參數是SYSCALL NAME不算在內。定義形式是這樣的:

SYSCALL_DEFINE[參數個數](SYSCALL NAME, 參數1型態, 參數1, 參數2型態,參數2….)

因為我的syscall只有一個型態為 process_switch_info*的參數 psi, 因此我是

SYSCALL_DEFINE1(……)

(若沒有參數的話在第3步裡面參數地方要寫void不然會有錯)

5.      加入Makefile(把object檔放入 source code tree中)

Linux/kernel/Makefile

(新增的syscall放在哪一層，就加在該層的Makefile中)

6.   重編kernel

make

make modules_install

make install

B.      測試system call

1.      syscall(__NR_process_switch_info, psi)是呼叫syscall的方法

第一個參數為syscall name, 後面的參數放該syscall所需的參數

可以直接寫在.c中，這裡定義了get_process_switch_info()讓.c中的function name有意義，因此傳了一個自訂的structure進來才呼叫syscall

Ftrace 追蹤kernel process

為了確認process到底是怎麼context switch以及context switch幾次，花了些時間研究了Ftrace。有些地方仍不是很了解，要再查資料研究
Linux version : 2.6.35.4 (CentOS)

1.     Ftrace 是內建的tracker，在編譯核心時可以到選單裡的<kernel hacking>選擇 (因為不太熟悉各選項的用途，因次我全選了= _=)

2.   選完後開始編譯

make à make modules_install à make install àreboot

3.    到 /sys/kernel/debug , 將 debugfs mount上去

# mount –t debugfs nodev /sys/kernel/debug 

4.     現在可以到 /sys/kernel/debug/tracing下, 會看到一大堆檔案

可以查看 available_tracers 看看有那些tracer可以用

5.     使用 tracer的步驟

(a)  關閉 tracing_enabled (0是closed, 1 是 opened)

# echo 0 > tracing_enabled

(b) 打開 ftraced_enabled (不太清楚原因

# echo 1 > /proc/sys/kernel/ftrace_enabled

(c)  選擇目前要用的tracer

# echo … > current_tracer

(d) 設定要跟蹤的函數到 set_ftrace_filter

# echo … > set_ftrace_filter

(e)  打開 tracing enabled

# echo 1 > tracing_enabled

(f)   執行想要追蹤的程式或做其他事, ftrace會開始追蹤kernel

(g)  結束追蹤

# echo 0 > tracing_enabled

或暫停追蹤(tracer只是暫停沒有結束

# echo 0 > tracing_on

(h) 看結果囉!

# cat trace

可以搭配 grep指令列出想看的東西

# cat trace | grep test (test是我剛剛執行的執行檔)

或是 >> 將 trace輸出成自己的檔案

# cat trace >> /trace1 (輸出到跟目錄下 檔名為 trace1)

6.     我這一次觀察了2種 tracer

(a)  Function

會列出function執行的順序

下圖是我執行 test 之後的tracer, 我有用 filter鎖定我要看的函數, 也就是主要做context_switch的schedule了

欄位意思大概是這樣

TASK-PID	Cpu#	TIMESTAMP	FUNCTION
<test>-5049	000	13211.469334	Scheduleßwork_resched

Process test pid 5049正在執行, 使用編號 0的CPU, 時間是timestamp, 正由work_resched呼叫schedule function

看樣子應該是準備進行contest switch了

我的test就是會讓他睡8次的一支程式(作業需要XD)

所以可以看到8個nanosleep呼叫schedule準備把控制權交出來然後去睡覺

(a)  Sched_switch

列出 context switch的info

下圖是使用sched_switch看process 做context switchc的情況

我用 grep test 過濾出我想看的, 欄位意思大概是

TASK-PID	Cpu#	TIMESTAMP	FUNCTION
<test>-5182	000	14456.847013	(*)

(*): 5182:120:S == > [000] 0:120:R <idle>

   pid 5182, priority 120,目前狀態S代表 TASK_INTERRUPTIBLE可中斷睡眠狀態

== >代表轉移控制權( + 可能是代表正在叫醒某Process)

7.     Reference

http://www.ibm.com/developerworks/cn/linux/l-cn-ftrace2/

http://jayiist.blog.163.com/blog/static/18715931120122555631948/

http://events.linuxfoundation.org/slides/2010/linuxcon_japan/linuxcon_jp2010_rostedt.pdf