Hello. We're debugging a problem with a PCIe device that only happens on a cold boot. It appears that ETW tracing via the autologger for the PCIE device's driver (ours). Create a log file, but it doesn't seem to contain any trace records. I've tried to see if the GlobalLogger is any better for cold boot debugging, but following the docs doesn't seem to produce any output at all - not even empty files.
Has anyone had any luck with this?
Any help is GREATLY appreciated!
PS. The Firmware on the card behaves the same way for a warm or cold start.
IFR is excellent for always on tracing, and can be used on any driver model.
See Inflight Trace Recorder (IFR) for Logging Traces - Windows drivers | Microsoft Learn.
windbg should not have any problem attaching to a 'cold boot' system, but when windbg attaches during boot depends on how you set bcdedit. You did set /bootdebug, right?
Did you set 'cycle initial break' to break on first module load? (-d command line, or CTRL-K, or the Debug menu.)
Also a serial port debug session might be active earlier than a net debug session?
Maybe describe in more detail what you observe windbg doing during 'cold boot'.
Hi Mark. Thanks for the reply. I did not have /bootdebug on. I did figure that one out and edit my post here. I'm familiar with IFR, but have had issues with being able to increase the default number of entries, as by default it's quite small. Thanks for the shout though, and it may actually be enough for this issue. Thanks again!
-Wade
Setting LogPages in the device parameters worked for me.
Thanks. That's done it.
Hi Mark. even with a LogPages value of 512 (presumably a 2mb buffer), the log starts with ~entry 1250 or so. I initially thought LogPages was too small so it was wrapping around, but even a massive LogPages results in the same behavior. I call WPP_INIT nearly first thing in DriverEntry. Unfortunately, its the very early entries that I need to see.
EDIT: I see there's a limit of 16 pages
Hmmm. That sounds familiar. I'll enter the wayback machine and see if how I resolved it is still something I can look at.