RE: [ntdev] WPP tracing (ETW) and Win2kThanks very much for your suggestion. Using your idea, I finally got basic tracing to work on Win2k. I got tracelog and tracefmt to work. Tracelog 2.0.14 works with my .ctl and .TMF files. But traceview 2.0.14 does not want to work with my PDB. It says “cannot find PDB file”. Weird.
I did the following for registration and system_control handling for Win2k, should anyone be interested (this applies to my WPP non PnP device_object, created for now at start_device time).
Some relevant structures:
WMIGUIDREGINFO:
m_WMIGUIDRegInfo[0].Guid = &WPP_TRACE_CONTROL_NULL_GUID;
m_WMIGUIDRegInfo[0].InstanceCount = 1;
m_WMIGUIDRegInfo[0].Flags = 0;
WMILIB_CONTEXT:
m_WMIContext.GuidCount = 1;
m_WMIContext.GuidList = m_WMIGUIDRegInfo;
m_WMIContext.QueryWmiRegInfo = QueryRegInfo;
m_WMIContext.QueryWmiDataBlock = NULL;
m_WMIContext.SetWmiDataBlock = NULL;
m_WMIContext.SetWmiDataItem = NULL;
m_WMIContext.ExecuteWmiMethod = NULL;
m_WMIContext.WmiFunctionControl = NULL;
I register as such (QueryRegInfo routine):
reference for non PnP object: http://www.osronline.com/lists_archive/ntdev/thread9173.html
*flags = WMIREG_FLAG_INSTANCE_BASENAME;
*regpath = RegistryPath();
*pdo = NULL;
#define INSTANCENAME L"Sample"
ULONG size;
size = sizeof(INSTANCENAME) ;
instname->Buffer = (PWSTR)ExAllocatePoolWithTag (PagedPool,
size,
(ULONG) ‘CSAM’);
if(instname->Buffer)
{
instname->Length = size;
instname->MaximumLength = size;
RtlCopyMemory(instname->Buffer, INSTANCENAME, size);
}
else
{
instname->Length = 0;
instname->MaximumLength = 0;
status = STATUS_INSUFFICIENT_RESOURCES;
}
My SYSTEM_CONTROL routine of my WPP non PnP device_object :
SYSCTL_IRP_DISPOSITION disposition;
status = WmiSystemControl(&m_WMIContext,
pWPPDevObj),
Irp,
&disposition);
if ((disposition != IrpProcessed) &&
(pWPPDevObj ==
(PDEVICE_OBJECT)stack->Parameters.WMI.ProviderId))
{
ULONG returnSize=0;
KdPrint((“Calling WPP_TRACE_CONTROL\n”));
status = WPP_TRACE_CONTROL(stack->MinorFunction,
stack->Parameters.WMI.Buffer,
stack->Parameters.WMI.BufferSize,
returnSize);
}
switch (disposition)
{ // finish handling IRP
case IrpProcessed:
break;
case IrpNotCompleted:
IoCompleteRequest(Irp, IO_NO_INCREMENT);
break;
default:
// we don’t have a lower device…
IoCompleteRequest(Irp, IO_NO_INCREMENT);
break;
}
return status;
Finnally works on 2k SP4, I’ll try it on WinXP SP1/2. Since the extra device_object code does not exist for WinXP, I may have double registration issues (but WPP_INIT_TRACING for WinXP uses a DRIVER_OBJECT so maybe not!).
thanks,
Philip Lukidis
“Calvin Guan” wrote in message news:xxxxx@ntdev…
Calling IoWMIRegistrationControl on the very same device object in WXP would get STATUS_OBJECT_NAME_EXISTS as well. Only one IRP_MN_REGINFO will be sent to the driver. At least, this is observed in wxpsp1 IIRC.
I used to use the similar approach as the toaster driver did in my unified W2K driver but the tracing doesn’t seemed to work in WXP due to that reason. Finally, I gave up and use a dedicated device object for ETW in my unified driver. Of course, properly creating/deleting the object is necessary. My unified tracing works on w2k/wxp/2003/lh.
HTH,
Calvin
-
Calvin Guan Software Engineer
ATI Technologies Inc. www.ati.com
-----Original Message-----
From: Philip Lukidis [mailto:xxxxx@hotmail.com]
Sent: September 16, 2004 12:13 PM
To: Windows System Software Devs Interest List
Subject: Re:[ntdev] WPP tracing (ETW) and Win2k
“Philip Lukidis” wrote in message
news:xxxxx@ntdev…
> Hmm, I have an additional question on this WPP tracing for Win2k (SP4). I
> observed that I have no traces on Win2k at all. So I stepped into
> WppInitKm, which called IoWMIRegistrationControl. I got an error of
> 0x40000000, which is STATUS_OBJECT_NAME_EXISTS. I had previously
registered
> with WMI myself, as the toaster does (and as I do on WinXP SP2 with no
> issues). Does anyone have a clue what may be the problem?
>
> thanks,
>
> Philip Lukidis
>
>
>
Hmm, with the checked kernel/HAL on Win2k SP4, I get the following dbgprint:
“WMI: Device Object 81c3b030 attempting to register twice”. I never had
this problem on WinXP (well, perhaps I should say that tracing worked, I
should try again with the checked kernel/HAL on WinXP SP2). Is this simply
not allowed with Win2k? I can’t believe so, as the toaster sample registers
with WMI as well, just before calling WPP_INIT_TRACING (which registers as
well, with the passed DEVICE_OBJECT).
Worse, I get a “Bug Check 0xCC: PAGE_FAULT_IN_FREED_SPECIAL_POOL” when
verifying my driver (though never on the free build of Win2k SP4!). Stack
trace as follows:
1: kd> kb 100
ChildEBP RetAddr Args to Child
f7392704 804397da 00000003 c02ec42c 00000001
nt!NtNotifyChangeDirectoryFile+0x18e
f7392a90 80493c40 00000001 bb10b016 00000001 nt!MmSetKernelDumpRange+0x42
f7392ae0 804c34b3 00000001 bb10b016 00000000 nt!NtQueryDefaultLocale+0x10e
f7392af8 80539237 badb0d00 01dc503a 00000000
nt!IopDeleteLockedDeviceNode+0x305
01d35eea 00000000 00000000 00000000 00000000 nt!WmipSwitchBuffer
(nt+0x139237)
Anyone have any ideas? I can try and not register for WMI for Win2k at all,
but that just hides the issue, which admittedly I have no idea about yet.
Philip Lukidis
—
Questions? First check the Kernel Driver FAQ at http://www.osronline.com/article.cfm?id=256
You are currently subscribed to ntdev as: xxxxx@ati.com
To unsubscribe send a blank email to xxxxx@lists.osr.com