Dropped characters when writing to virtual serial port

Amir_Saro · November 19, 2012, 5:22am

I’m trying to write data over virtual serial port from a vm guest machine (Win7 and WinXP) to the host machine that is running VirtualBox.

And for some reason, I only see the first 2 bytes, and the last written byte - no matter how many bytes I attempt to write.

I tried to play with the baud rate on both the sender and the receiver machines: having them both running on the same rate, or have the sender running over a slower rate than the receiver, neither of my settings got me any where close.

One thing helped me though - but not always - is calling KeStallExecutionProcessor(50) every time I write a byte on COM1 port.

P.S. I’m trying to notify the host machine when the guest vm crashes using registered BugCheckCallback.

I’m using WRITE_PORT_XXX to send the data.

I would greatly appreciate your advice on how to do this properly, as I have no experience with serial ports…

OSR_Community_User · November 19, 2012, 5:56am

You can’t just repeatedly write to the serial output I/O port. It’s been a while since I looked at 16550 serial port programming, but as I remember you need to check the transmit register status register, and only write a byte when the register is empty. Controlling a serial port is more complex actually, as unless you want to spin waiting for an empty buffer, you need to use interrupts. I’d suggest you open the serial device and send it write irps, lettings the OS serial driver do all the right stuff.

Jan

-----Original Message-----
From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of xxxxx@gmail.com
Sent: Monday, November 19, 2012 2:21 AM
To: Windows System Software Devs Interest List
Subject: [ntdev] Dropped characters when writing to virtual serial port

I’m trying to write data over virtual serial port from a vm guest machine (Win7 and WinXP) to the host machine that is running VirtualBox.

And for some reason, I only see the first 2 bytes, and the last written byte - no matter how many bytes I attempt to write.

I tried to play with the baud rate on both the sender and the receiver machines: having them both running on the same rate, or have the sender running over a slower rate than the receiver, neither of my settings got me any where close.

One thing helped me though - but not always - is calling KeStallExecutionProcessor(50) every time I write a byte on COM1 port.

P.S. I’m trying to notify the host machine when the guest vm crashes using registered BugCheckCallback.

I’m using WRITE_PORT_XXX to send the data.

I would greatly appreciate your advice on how to do this properly, as I have no experience with serial ports…

NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

Amir_Saro · November 19, 2012, 6:29am

Thank you very much Jan for the good information … I will look into how to use the OS serial driver…

OSR_Community_User · November 19, 2012, 12:26pm

This is one of the many reasons you should not be trying to reinvent the
serial port driver. You MUST use interrupts, or stall not on some
randomly-selected time interval but on actusl serial port status. You
have to understand ALL of the 16550 data, control, and status registers,
every single bit in them, before you write a line of code. Why are you
doing this? The serial port driver is VERY complex, and for years had a
serious bug (which I hope is finally fixed): it signaled output completion
when it put the last byte into the Tx data register and STARTED the
transmission, instead of the correct action of signaling completion only
after the last byte was fully transmitted. This is not a device for
beginners.
joe

You can’t just repeatedly write to the serial output I/O port. It’s been a
while since I looked at 16550 serial port programming, but as I remember
you need to check the transmit register status register, and only write a
byte when the register is empty. Controlling a serial port is more complex
actually, as unless you want to spin waiting for an empty buffer, you need
to use interrupts. I’d suggest you open the serial device and send it
write irps, lettings the OS serial driver do all the right stuff.

Jan

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of
xxxxx@gmail.com
Sent: Monday, November 19, 2012 2:21 AM
To: Windows System Software Devs Interest List
Subject: [ntdev] Dropped characters when writing to virtual serial port

I’m trying to write data over virtual serial port from a vm guest machine
(Win7 and WinXP) to the host machine that is running VirtualBox.

And for some reason, I only see the first 2 bytes, and the last written
byte - no matter how many bytes I attempt to write.

I tried to play with the baud rate on both the sender and the receiver
machines: having them both running on the same rate, or have the sender
running over a slower rate than the receiver, neither of my settings got
me any where close.

One thing helped me though - but not always - is calling
KeStallExecutionProcessor(50) every time I write a byte on COM1 port.

P.S. I’m trying to notify the host machine when the guest vm crashes using
registered BugCheckCallback.

I’m using WRITE_PORT_XXX to send the data.

I would greatly appreciate your advice on how to do this properly, as I
have no experience with serial ports…

NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

Amir_Saro · November 20, 2012, 10:30am

@Joe: I have no intention to reinvent the wheel here, and I have no intention whatsoever to write a serial port driver! … all I wanted, is to notify the host machine when a VM guest system crashes from BugCheckCallback - that’s all.

Since VirtualBox provides a virtual serial port, I figured, it would be the easiest way for the guest to notify the host when it crashes.

My implementation now uses serial.sys to communicate with the serial port, as Jan has suggested, and it works perfectly.

Actually, while searching the net for further information about CheckBugCallbacks, I bumped into these 2 files:
https://forge.univention.org/svn/dev/branches/ucs-3.1/ucs/virtualization/univention-xen-gplpv/win-pvdrivers/xenpci/xenpci_dbgprint.c

http://svn.netlabs.org/repos/vbox/trunk/src/VBox/Additions/WINNT/VBoxGuest/HelperBugCheck.cpp

I don’t know if those are part of VirtualBox and Xen source code, but it seems they use WRITE_PORT_XXX, and inb/outb to write to the serial port, and that was what misled me in the first place to keep investigating the problem I had with writing directly to the port, rather than, using something like serial.sys.

Anyway, I’m using serial.sys now and it works!

P.S. please let me know if there is a better idea than notifying the host over a serial port from within the BugCheckCallback.

Thanks

OSR_Community_User · November 20, 2012, 1:52pm

Wait I minute, you can’t make standard requests to another driver DURING crash processing. You didn’t mention you’re in the extremely limited context of a crash dump, which has no interrupts, and runs at HIGH_LEVEL, and you can’t called ANY OS function except a tiny limited set. You can’t allocate IRPs during crash processing.

Talking directly to hardware is the only option.

Jan

-----Original Message-----
From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of xxxxx@gmail.com
Sent: Tuesday, November 20, 2012 7:30 AM
To: Windows System Software Devs Interest List
Subject: RE:[ntdev] Dropped characters when writing to virtual serial port

@Joe: I have no intention to reinvent the wheel here, and I have no intention whatsoever to write a serial port driver! … all I wanted, is to notify the host machine when a VM guest system crashes from BugCheckCallback - that’s all.

Since VirtualBox provides a virtual serial port, I figured, it would be the easiest way for the guest to notify the host when it crashes.

My implementation now uses serial.sys to communicate with the serial port, as Jan has suggested, and it works perfectly.

Actually, while searching the net for further information about CheckBugCallbacks, I bumped into these 2 files:
https://forge.univention.org/svn/dev/branches/ucs-3.1/ucs/virtualization/univention-xen-gplpv/win-pvdrivers/xenpci/xenpci_dbgprint.c

http://svn.netlabs.org/repos/vbox/trunk/src/VBox/Additions/WINNT/VBoxGuest/HelperBugCheck.cpp

I don’t know if those are part of VirtualBox and Xen source code, but it seems they use WRITE_PORT_XXX, and inb/outb to write to the serial port, and that was what misled me in the first place to keep investigating the problem I had with writing directly to the port, rather than, using something like serial.sys.

Anyway, I’m using serial.sys now and it works!

P.S. please let me know if there is a better idea than notifying the host over a serial port from within the BugCheckCallback.

Thanks

NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

Amir_Saro · November 21, 2012, 4:02am

@Jan my code is just testing and hacking around to see how this works, so I haven’t got the chance to read in depth the documentation and what is the IRQL that every API I’m using is called at, but now after you have mentioned it, I’m “surprised” to see that the APIs (IoBuildSynchronousFsdRequest, IoCallDriver, KeWaitForSingleObject) I’m using from within the BugCheckCallback can’t be called at IRQL HIGH_LEVEL, and yet I was able to allocate an IRP send it to the OS serial driver, and see the output written to the port!

Can you perhaps shed some light on why it worked for me - I mean why I’m able to allocate and call the serial driver at that high level?!

btw, I mentioned in my first message that I’m trying to notify the host when the guest crashes from within BugCheckCallback.

Doron_Holan · November 21, 2012, 9:09am

It works because you are being lucky. Irps can be cached behind the scenes, so you are probably allocating from the cache. As soon as you hit the case where allocating an irp requires hitting Mm, you will probably triple fault

d

debt from my phone

From: xxxxx@gmail.com
Sent: 11/21/2012 1:02 AM
To: Windows System Software Devs Interest List
Subject: RE:[ntdev] Dropped characters when writing to virtual serial port

@Jan my code is just testing and hacking around to see how this works, so I haven’t got the chance to read in depth the documentation and what is the IRQL that every API I’m using is called at, but now after you have mentioned it, I’m “surprised” to see that the APIs (IoBuildSynchronousFsdRequest, IoCallDriver, KeWaitForSingleObject) I’m using from within the BugCheckCallback can’t be called at IRQL HIGH_LEVEL, and yet I was able to allocate an IRP send it to the OS serial driver, and see the output written to the port!

Can you perhaps shed some light on why it worked for me - I mean why I’m able to allocate and call the serial driver at that high level?!

btw, I mentioned in my first message that I’m trying to notify the host when the guest crashes from within BugCheckCallback.

NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

Amir_Saro · November 21, 2012, 9:58am

Thanks Doron … I’m a lucky person by nature!

I will discard my code then, that calls the OS serial driver, and read more about the serial ports and how to communicate with, so I can at least send a signal to the host machine from the crashed vm guest, properly using WRITE_PORT_XXX … unless, someone has a better suggestion for how to signal the host machine from BugCheckCallback.

BTW, is there any documentation for how the Windows kernel send the BSoD information over the serial port to WinDbg for example?

Doron_Holan · November 21, 2012, 10:31am

The kernel polls with interrupts disabled

d

debt from my phone

From: xxxxx@gmail.com
Sent: 11/21/2012 6:58 AM
To: Windows System Software Devs Interest List
Subject: RE:[ntdev] Dropped characters when writing to virtual serial port

Thanks Doron … I’m a lucky person by nature!

I will discard my code then, that calls the OS serial driver, and read more about the serial ports and how to communicate with, so I can at least send a signal to the host machine from the crashed vm guest, properly using WRITE_PORT_XXX … unless, someone has a better suggestion for how to signal the host machine from BugCheckCallback.

BTW, is there any documentation for how the Windows kernel send the BSoD information over the serial port to WinDbg for example?

NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

Phil_Barila · November 21, 2012, 11:07am

Stop trying to communicate with the host from KM in the guest. Just stand up a UM service and communicate with that. You can make your watchdog interval short enough that it will give a first approximation of what you’ve been trying to do with the serial port, in a much cleaner and more reliable way.

Phil

Phil Barila | Senior Software Engineer
720.881.5364 (w)
LogRhythm, Inc.
A LEADER 2012 SIEM Magic Quadrant
WINNER of SC Magazine’s 2012 SIEM Best Buy

Not speaking for LogRhythm.

-----Original Message-----
From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of xxxxx@gmail.com
Sent: Wednesday, November 21, 2012 7:58 AM
To: Windows System Software Devs Interest List
Subject: RE:[ntdev] Dropped characters when writing to virtual serial port

Thanks Doron … I’m a lucky person by nature!

I will discard my code then, that calls the OS serial driver, and read more about the serial ports and how to communicate with, so I can at least send a signal to the host machine from the crashed vm guest, properly using WRITE_PORT_XXX … unless, someone has a better suggestion for how to signal the host machine from BugCheckCallback.

BTW, is there any documentation for how the Windows kernel send the BSoD information over the serial port to WinDbg for example?

NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

OSR_Community_User · November 21, 2012, 10:34pm

> The kernel polls with interrupts disabled

I presume you mean this happens when it is talking to WinDbg, and normal
serial port I/O is interrupt-driven.
joe

d

debt from my phone

From: xxxxx@gmail.com
Sent: 11/21/2012 6:58 AM
To: Windows System Software Devs Interest List
Subject: RE:[ntdev] Dropped characters when writing to virtual serial port

Thanks Doron … I’m a lucky person by nature!

I will discard my code then, that calls the OS serial driver, and read
more about the serial ports and how to communicate with, so I can at least
send a signal to the host machine from the crashed vm guest, properly
using WRITE_PORT_XXX … unless, someone has a better suggestion for how to
signal the host machine from BugCheckCallback.

BTW, is there any documentation for how the Windows kernel send the BSoD
information over the serial port to WinDbg for example?

NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

Doron_Holan · November 21, 2012, 10:49pm

I am talking about when the kernel tales over the serial port, not serial.sys

d

dent from pjone

From: xxxxx@flounder.com mailto:xxxxx
Sent: ?11/?21/?2012 7:34 PM
To: Windows System Software Devs Interest Listmailto:xxxxx
Subject: RE: [ntdev] Dropped characters when writing to virtual serial port

> The kernel polls with interrupts disabled

I presume you mean this happens when it is talking to WinDbg, and normal
serial port I/O is interrupt-driven.
joe

>
> d
>
> debt from my phone
> ________________________________
> From: xxxxx@gmail.com
> Sent: 11/21/2012 6:58 AM
> To: Windows System Software Devs Interest List
> Subject: RE:[ntdev] Dropped characters when writing to virtual serial port
>
> Thanks Doron … I’m a lucky person by nature!
>
> I will discard my code then, that calls the OS serial driver, and read
> more about the serial ports and how to communicate with, so I can at least
> send a signal to the host machine from the crashed vm guest, properly
> using WRITE_PORT_XXX … unless, someone has a better suggestion for how to
> signal the host machine from BugCheckCallback.
>
> BTW, is there any documentation for how the Windows kernel send the BSoD
> information over the serial port to WinDbg for example?
>
>
> —
> NTDEV is sponsored by OSR
>
> For our schedule of WDF, WDM, debugging and other seminars visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer
>
> —
> NTDEV is sponsored by OSR
>
> For our schedule of WDF, WDM, debugging and other seminars visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer

—
NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer</mailto:xxxxx></mailto:xxxxx>

OSR_Community_User · November 21, 2012, 10:57pm

So the real question is how to deermine if a VM crashes. I would have
thought there would be hypervisor support to give status information.
Maybe some hypervisor guru can jump in here.
joe

@Joe: I have no intention to reinvent the wheel here, and I have no
intention whatsoever to write a serial port driver! … all I wanted, is
to notify the host machine when a VM guest system crashes from
BugCheckCallback - that’s all.

Since VirtualBox provides a virtual serial port, I figured, it would be
the easiest way for the guest to notify the host when it crashes.

My implementation now uses serial.sys to communicate with the serial port,
as Jan has suggested, and it works perfectly.

Actually, while searching the net for further information about
CheckBugCallbacks, I bumped into these 2 files:
https://forge.univention.org/svn/dev/branches/ucs-3.1/ucs/virtualization/univention-xen-gplpv/win-pvdrivers/xenpci/xenpci_dbgprint.c

http://svn.netlabs.org/repos/vbox/trunk/src/VBox/Additions/WINNT/VBoxGuest/HelperBugCheck.cpp

I don’t know if those are part of VirtualBox and Xen source code, but it
seems they use WRITE_PORT_XXX, and inb/outb to write to the serial port,
and that was what misled me in the first place to keep investigating the
problem I had with writing directly to the port, rather than, using
something like serial.sys.

Anyway, I’m using serial.sys now and it works!

P.S. please let me know if there is a better idea than notifying the host
over a serial port from within the BugCheckCallback.

Thanks

NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

Maxim_S_Shatskih · November 22, 2012, 7:13am

> So the real question is how to deermine if a VM crashes. I would have

thought there would be hypervisor support to give status information.

Some WMI or PowerShell stuff?

–
Maxim S. Shatskih
Windows DDK MVP
xxxxx@storagecraft.com
http://www.storagecraft.com

OSR_Community_User · November 23, 2012, 1:32am

I was wondering if you set up a TCP/IP port in the guest, and an app on
the host connected to it, would the host app get a disconnect notification
when the VM crashed?
joe

Stop trying to communicate with the host from KM in the guest. Just stand
up a UM service and communicate with that. You can make your watchdog
interval short enough that it will give a first approximation of what
you’ve been trying to do with the serial port, in a much cleaner and more
reliable way.

Phil

Phil Barila | Senior Software Engineer
720.881.5364 (w)
LogRhythm, Inc.
A LEADER 2012 SIEM Magic Quadrant
WINNER of SC Magazine’s 2012 SIEM Best Buy

Not speaking for LogRhythm.

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of
xxxxx@gmail.com
Sent: Wednesday, November 21, 2012 7:58 AM
To: Windows System Software Devs Interest List
Subject: RE:[ntdev] Dropped characters when writing to virtual serial port

Thanks Doron … I’m a lucky person by nature!

I will discard my code then, that calls the OS serial driver, and read
more about the serial ports and how to communicate with, so I can at least
send a signal to the host machine from the crashed vm guest, properly
using WRITE_PORT_XXX … unless, someone has a better suggestion for how to
signal the host machine from BugCheckCallback.

BTW, is there any documentation for how the Windows kernel send the BSoD
information over the serial port to WinDbg for example?

NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

OSR_Community_User · November 27, 2012, 11:04pm

Joe, virtual networking is pretty much the same as physical networking. When a machine (virtual or physical) crashes, it stops communicating. TCP has timeouts. When those timeouts expire, apps get disconnected.

Jake Oshins
Windows Kernel Team
(Hyper-V guy)

-----Original Message-----
From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of xxxxx@flounder.com
Sent: Thursday, November 22, 2012 10:32 PM
To: Windows System Software Devs Interest List
Subject: RE: RE:[ntdev] Dropped characters when writing to virtual serial port

I was wondering if you set up a TCP/IP port in the guest, and an app on
the host connected to it, would the host app get a disconnect notification
when the VM crashed?
joe

Stop trying to communicate with the host from KM in the guest. Just stand
up a UM service and communicate with that. You can make your watchdog
interval short enough that it will give a first approximation of what
you’ve been trying to do with the serial port, in a much cleaner and more
reliable way.

Phil

Phil Barila | Senior Software Engineer
720.881.5364 (w)
LogRhythm, Inc.
A LEADER 2012 SIEM Magic Quadrant
WINNER of SC Magazine’s 2012 SIEM Best Buy

Not speaking for LogRhythm.

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of
xxxxx@gmail.com
Sent: Wednesday, November 21, 2012 7:58 AM
To: Windows System Software Devs Interest List
Subject: RE:[ntdev] Dropped characters when writing to virtual serial port

Thanks Doron … I’m a lucky person by nature!

I will discard my code then, that calls the OS serial driver, and read
more about the serial ports and how to communicate with, so I can at least
send a signal to the host machine from the crashed vm guest, properly
using WRITE_PORT_XXX … unless, someone has a better suggestion for how to
signal the host machine from BugCheckCallback.

BTW, is there any documentation for how the Windows kernel send the BSoD
information over the serial port to WinDbg for example?

NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

Amir_Saro · November 28, 2012, 8:15am

The system I’m working on, is an automated system for analyzing executables/“files” to detect malicious behavior … such system can be hammered everyday with thousands of samples running simultaneously on tens of VMs … and the reason I want to detect BSoD, is 1st it would be interesting to know that a sample has caused the system to crash, at the time it happened, so we can take a screen capture of the BSoD … also, it would be very useful to get information such the bugcheck code and the parameters sent out to the host, but it’s okay if we could at least send a signal to the host that the system has crashed.
2nd, the host fetches an events-log file from the VM and we should be able to tell why the system failed to fetch that file which contains the events generated by the analyzed sample.
3rd, there is no reason to wait for a timeout to expire if the system crashes, we could utilize this time to analyze more samples instead of waiting in vain - not critical though, because system crashes don’t occur often anyway.

For some reason I’m not comfortable with the TCP/IP solution, one reason maybe is that the user of the system can decide to completely isolate a particular VM from performing any network activity while the sample is being analyzed.

Don’t you agree that the serial port seems more reliable and better for my problem than relying on a TCP/IP connection to tell whether the system has crashed or not? it requires neither an app running and listening on the host, nor setting up a tcp/ip connection in the VM … While using serial port, seems a bit more neat, as VirtualBox can redirects the traffic on the port to a file, and the host can check this file to detect system crash only if it failed to fetch the events-log file from the VM machine.

BTW, if anyone interested, here is a very helpful article about detecting half-open TCP/IP connections, and the issues that one can stumble into while implementing this:
http://nitoprograms.blogspot.com/2009/05/detection-of-half-open-dropped.html

OSR_Community_User · November 28, 2012, 9:34am

> Joe, virtual networking is pretty much the same as physical networking.

When a machine (virtual or physical) crashes, it stops communicating. TCP
has timeouts. When those timeouts expire, apps get disconnected.

I suspected that was the case, so thank you for confirming it.

As usual, the OP asked how to implement what is probably a very poor
solution to an interesting problem, without defining the problem until far
into the thread. So what I’d probably do here is establish a connection,
and when the disconnect came in I;d know the guest had died. A trivial
system service could be the target, and it wouldn’t involve doing weird
and possibly undocumented things to a virtual serial port. (Yes, it could
mean the service had died, and the guest was still live, but that is far
less likely than the fact that the guest VM has died)

As a “Hyper-V guy” is there a better way to accomplish this?
joe

Jake Oshins
Windows Kernel Team
(Hyper-V guy)

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of
xxxxx@flounder.com
Sent: Thursday, November 22, 2012 10:32 PM
To: Windows System Software Devs Interest List
Subject: RE: RE:[ntdev] Dropped characters when writing to virtual serial
port

I was wondering if you set up a TCP/IP port in the guest, and an app on
the host connected to it, would the host app get a disconnect notification
when the VM crashed?
joe

> Stop trying to communicate with the host from KM in the guest. Just
> stand
> up a UM service and communicate with that. You can make your watchdog
> interval short enough that it will give a first approximation of what
> you’ve been trying to do with the serial port, in a much cleaner and
> more
> reliable way.
>
> Phil
>
> Phil Barila | Senior Software Engineer
> 720.881.5364 (w)
> LogRhythm, Inc.
> A LEADER 2012 SIEM Magic Quadrant
> WINNER of SC Magazine’s 2012 SIEM Best Buy
>
> Not speaking for LogRhythm.
>
> -----Original Message-----
> From: xxxxx@lists.osr.com
> [mailto:xxxxx@lists.osr.com] On Behalf Of
> xxxxx@gmail.com
> Sent: Wednesday, November 21, 2012 7:58 AM
> To: Windows System Software Devs Interest List
> Subject: RE:[ntdev] Dropped characters when writing to virtual serial
> port
>
> Thanks Doron … I’m a lucky person by nature!
>
> I will discard my code then, that calls the OS serial driver, and read
> more about the serial ports and how to communicate with, so I can at
> least
> send a signal to the host machine from the crashed vm guest, properly
> using WRITE_PORT_XXX … unless, someone has a better suggestion for how
> to
> signal the host machine from BugCheckCallback.
>
> BTW, is there any documentation for how the Windows kernel send the BSoD
> information over the serial port to WinDbg for example?
>
>
> —
> NTDEV is sponsored by OSR
>
> For our schedule of WDF, WDM, debugging and other seminars visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer
>
> —
> NTDEV is sponsored by OSR
>
> For our schedule of WDF, WDM, debugging and other seminars visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer
>

NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

Amir_Saro · November 28, 2012, 10:09am

@Joe, I’m not familiar with the serial port communication, and I don’t know the complications of using it yet, as I haven’t went through any documentation yet. However, how “unsafe” is to send only one byte from the guest to the host over serial port and make sure that it was successfully sent?

Based on Microsoft documentation:
http://msdn.microsoft.com/en-us/library/windows/hardware/ff540674(v=vs.85).aspx

“The routine can safely use the READ_PORT_XXX, READ_REGISTER_XXX, WRITE_PORT_XXX, and WRITE_REGISTER_XXX routines to interact with the device.” … and serial port is just one way to interact with a device, I guess.

And what about KeRegisterBugCheckReasonCallback?
http://msdn.microsoft.com/en-us/library/windows/hardware/ff540677(v=vs.85).aspx

“BugCheckDumpIoCallback routines are called each time data is written to the crash dump file. Drivers for devices that monitor the system state can register a BugCheckDumpIoCallback routine to copy the crash dump data to the monitoring device.”

How do you suggest to send the crash-dump to a device that communicates using a serial port?