Moron ETW

So after the lengthy discussion two weeks ago regarding ETW I decided it was
high time to convert a batch of kernel software to use ETW in the free
build. I expected the conversion process to take half a day or so. Three
days later the task is still not complete.

Here are some of the issues I ran into.

  1. white space appears to have some sort of meaning to the RUN_WPP statement
    in a sources file. For example:

RUN_WPP=$(SOURCES) \
-km \
-func:gsDebugPrintEx(NULL, LEVEL, MSG,…)

Appears to confuse WPP, resulting on all of the LEVEL flags being undefined.
Everything is bliss if you amend the above statement as follows:

RUN_WPP=$(SOURCES) \
-km \
-func:gsDebugPrintEx(NULL,LEVEL,MSG,…)

This minor undocumented feature added about 1-day to the conversion process.

  1. As far as I can tell, Henry’s hint about how to use the !UNDOCUMENTED!
    level and flag support in WPP does not work. If I amend my sources file as
    follows:

RUN_WPP=$(SOURCES) \
-km \
-func:gsDebugPrintEx(LEVEL,FLAG,MSG,…)

And add the following to a global include file:

#define WPP_LEVEL_FLAGS_LOGGER(lvl,flags) WPP_LEVEL_LOGGER(flags)

#define WPP_LEVEL_FLAGS_ENABLED(lvl,flags) \
(WPP_LEVEL_ENABLED(flags) && WPP_CONTROL(WPP_BIT_##flags).Level >= lvl)

#define WPP_CONTROL_GUIDS \
WPP_DEFINE_CONTROL_GUID(someguid,\
(42F45982,818A,41dd,ADD3,DEB1A24DE686),\
WPP_DEFINE_BIT(flag1) \
WPP_DEFINE_BIT(flag2) \
)

I get the usual badness of the control bit flags being undefined. I also
get:

WPP_LEVEL_FLAG_ENABLED’: identifier not found, even with argument-dependent
lookup

And

‘WPP_LEVEL_FLAG_LOGGER’: identifier not found, even with argument-dependent
lookup

This consumed a day of randomly mucking with stuff. Lucky for me it was
concurrent, more or less, with the day spent discovering that white space
has meaning to RUN_WPP. Of course it would help if this stuff were actually
documented somewhere. I finally gave up and reverted to the ‘NULL’ syntax,
which is also undocumented, but it at least works.

  1. The documentation and the ‘sample driver’ are horrible. The documentation
    might as well not exist, and the sample tracedriver is so simple that, while
    it works, it does not address any of the real-world issues people might
    encounter. The only other sample in the ddk is one version of toaster, and
    it too borders on the uselessly simple.

  2. Your debugprint routine can’t actually exist in your source code if WPP
    is enabled. On reflection, this one was obvious, but guess what? It isn’t
    actually documented anywhere. So you have to have a conditional compilation
    flag to eliminate your debugprint function from your source code if you are
    building for ETW.

  3. the ‘munged flags’ (those under the control of WPP_DEFINE_BIT) cannot be
    used outside of calls to the munged function(s) defined in RUN_WPP. So for
    example having code that does something like:

GlobalDebugType = flag1;

Results in an error because flag1 us undefined. Badness! WPP ought to
generate the premunged flag1 names as valid symbols. Oddly, this feature is
undocumented.

=====================
Mark Roddy
Windows .NET/XP/2000 Consulting
Hollis Technology Solutions 603-321-1032
www.hollistech.com

> ----------

From: xxxxx@hollistech.com[SMTP:xxxxx@hollistech.com]
Reply To: xxxxx@lists.osr.com
Sent: Monday, February 16, 2004 2:31 PM
To: xxxxx@lists.osr.com
Subject: [ntdev] Moron ETW

So after the lengthy discussion two weeks ago regarding ETW I decided it
was
high time to convert a batch of kernel software to use ETW in the free
build.

Sorry :wink: I only wonder how you could make the decision after that
discussion. My personal conclusion was to not even try to use ETW until most
questions (not only mine) which were raised are satisfactorily answered.
Here, in docs, in examples or anywhere else.

Call me lazy but Mark’s post only confirms ETW is half baked or under
documented.

Best regards,

Michal Vodicka
STMicroelectronics Design and Application s.r.o.
[michal.vodicka@st.com, http:://www.st.com]

Well I havent’ given up yet, as I am a persistent son of a bitch, but it has
so far been a fairly complete waste of time. As to why I bothered, mostly it
is because conceptually logging makes sense, and if Microsoft has
implemented a generic logging facility that can readily be used for kernel
components, that makes even more sense. Also, it is part of my skill set to
know everything there is to know about windows kernel development, hideous
or not.

My latest nightmare is how to expose log based debugging from a software
library to the clients of that library. And once again this appears to be a
bit on the undocumented side.

I am however intimately acquainted with error messages such as “error C2065:
‘WPP_BIT_3’ : undeclared identifier” :slight_smile:

P.S. the title of the original post was meant to express my frustration over
my experiment in ETW. For all I know all of these issues are documented
somewhere and I’m the moron :slight_smile:

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Michal Vodicka
Sent: Monday, February 16, 2004 1:37 PM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] Moron ETW

> ----------
> From: xxxxx@hollistech.com[SMTP:xxxxx@hollistech.com]
> Reply To: xxxxx@lists.osr.com
> Sent: Monday, February 16, 2004 2:31 PM
> To: xxxxx@lists.osr.com
> Subject: [ntdev] Moron ETW
>
> So after the lengthy discussion two weeks ago regarding ETW
I decided
> it was high time to convert a batch of kernel software to
use ETW in
> the free build.
>
Sorry :wink: I only wonder how you could make the decision after
that discussion. My personal conclusion was to not even try
to use ETW until most questions (not only mine) which were
raised are satisfactorily answered.
Here, in docs, in examples or anywhere else.

Call me lazy but Mark’s post only confirms ETW is half baked
or under documented.

Best regards,

Michal Vodicka
STMicroelectronics Design and Application s.r.o.
[michal.vodicka@st.com, http:://www.st.com]


Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as:
xxxxx@hollistech.com To unsubscribe send a blank email to
xxxxx@lists.osr.com

> ----------

From: xxxxx@hollistech.com[SMTP:xxxxx@hollistech.com]
Reply To: xxxxx@lists.osr.com
Sent: Monday, February 16, 2004 7:59 PM
To: xxxxx@lists.osr.com
Subject: RE: [ntdev] Moron ETW

Well I havent’ given up yet, as I am a persistent son of a bitch, but it
has
so far been a fairly complete waste of time. As to why I bothered, mostly
it
is because conceptually logging makes sense, and if Microsoft has
implemented a generic logging facility that can readily be used for kernel
components, that makes even more sense.

Yes, I’m interested about it for equal reasons. In my experience tracing is
superior debugging technique for anybody who doesn’t make beginners’ coding
errors. I’m eager to use generic logging facility but only if everything I’m
accustomed to use now can be done with it.

Best regards,

Michal Vodicka
STMicroelectronics Design and Application s.r.o.
[michal.vodicka@st.com, http:://www.st.com]

If you guys can post some of the specific questions I will try and get
them answered for you in as timely a fashion as possible.

Most you seem to have resolved yourselves, but let me know what is
outstanding?

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Michal Vodicka
Sent: Monday, February 16, 2004 11:32 AM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] Moron ETW


From: xxxxx@hollistech.com[SMTP:xxxxx@hollistech.com]
Reply To: xxxxx@lists.osr.com
Sent: Monday, February 16, 2004 7:59 PM
To: xxxxx@lists.osr.com
Subject: RE: [ntdev] Moron ETW

Well I havent’ given up yet, as I am a persistent son of a bitch, but
it
has
so far been a fairly complete waste of time. As to why I bothered,
mostly
it
is because conceptually logging makes sense, and if Microsoft has
implemented a generic logging facility that can readily be used for
kernel
components, that makes even more sense.

Yes, I’m interested about it for equal reasons. In my experience tracing
is
superior debugging technique for anybody who doesn’t make beginners’
coding
errors. I’m eager to use generic logging facility but only if everything
I’m
accustomed to use now can be done with it.

Best regards,

Michal Vodicka
STMicroelectronics Design and Application s.r.o.
[michal.vodicka@st.com, http:://www.st.com]


Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: xxxxx@windows.microsoft.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

Ian,

I haven’t really resolved much at all, other than the whitespace issue.

As I wrote originally:

  1. As far as I can tell, Henry’s hint about how to use the !UNDOCUMENTED!
    level and flag support in WPP does not work. If I amend my sources file as
    follows:

RUN_WPP=$(SOURCES) \
-km \
-func:gsDebugPrintEx(LEVEL,FLAG,MSG,…)

And add the following to a global include file:

#define WPP_LEVEL_FLAGS_LOGGER(lvl,flags) WPP_LEVEL_LOGGER(flags)

#define WPP_LEVEL_FLAGS_ENABLED(lvl,flags) \
(WPP_LEVEL_ENABLED(flags) && WPP_CONTROL(WPP_BIT_##flags).Level >= lvl)

#define WPP_CONTROL_GUIDS \
WPP_DEFINE_CONTROL_GUID(someguid,\
(42F45982,818A,41dd,ADD3,DEB1A24DE686),\
WPP_DEFINE_BIT(flag1) \
WPP_DEFINE_BIT(flag2) \
)

I get the usual badness of the control bit flags being undefined. I also
get:

WPP_LEVEL_FLAG_ENABLED’: identifier not found, even with argument-dependent
lookup

And

‘WPP_LEVEL_FLAG_LOGGER’: identifier not found, even with argument-dependent
lookup

  1. the ‘munged flags’ (those under the control of WPP_DEFINE_BIT) cannot be
    used outside of calls to the munged function(s) defined in RUN_WPP. So for
    example having code that does something like:

GlobalDebugType = flag1;

Results in an error because flag1 us undefined. Badness! WPP ought to
generate the premunged flag1 names as valid symbols. Oddly, this feature is
undocumented.

And my latest addition:

  1. My latest nightmare is how to expose log based debugging from a software
    library to the clients of that library. And once again this appears to be a
    bit on the undocumented side.

I am however intimately acquainted with error messages such as “error C2065:
‘WPP_BIT_3’ : undeclared identifier” :slight_smile:

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Ian Service
Sent: Monday, February 16, 2004 2:48 PM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] Moron ETW

If you guys can post some of the specific questions I will
try and get them answered for you in as timely a fashion as possible.

Most you seem to have resolved yourselves, but let me know
what is outstanding?

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Michal Vodicka
Sent: Monday, February 16, 2004 11:32 AM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] Moron ETW

> ----------
> From: xxxxx@hollistech.com[SMTP:xxxxx@hollistech.com]
> Reply To: xxxxx@lists.osr.com
> Sent: Monday, February 16, 2004 7:59 PM
> To: xxxxx@lists.osr.com
> Subject: RE: [ntdev] Moron ETW
>
> Well I havent’ given up yet, as I am a persistent son of a
bitch, but
it
> has
> so far been a fairly complete waste of time. As to why I bothered,
mostly
> it
> is because conceptually logging makes sense, and if Microsoft has
> implemented a generic logging facility that can readily be used for
kernel
> components, that makes even more sense.
>
Yes, I’m interested about it for equal reasons. In my
experience tracing is superior debugging technique for
anybody who doesn’t make beginners’
coding
errors. I’m eager to use generic logging facility but only if
everything I’m accustomed to use now can be done with it.

Best regards,

Michal Vodicka
STMicroelectronics Design and Application s.r.o.
[michal.vodicka@st.com, http:://www.st.com]


Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as:
xxxxx@windows.microsoft.com To unsubscribe send a blank
email to xxxxx@lists.osr.com


Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as:
xxxxx@hollistech.com To unsubscribe send a blank email to
xxxxx@lists.osr.com

> ----------

From:
xxxxx@windows.microsoft.com[SMTP:xxxxx@windows.microsoft.com]
Reply To: xxxxx@lists.osr.com
Sent: Monday, February 16, 2004 8:47 PM
To: xxxxx@lists.osr.com
Subject: RE: [ntdev] Moron ETW

If you guys can post some of the specific questions I will try and get
them answered for you in as timely a fashion as possible.

Most you seem to have resolved yourselves, but let me know what is
outstanding?

If you could look into previous discussion, there were a lot unanswerred
questions.

The one which is the most important for me: is there a way how to redirect
ETW traces to debug output in real time? I’m not interested how to do it
with windbg because prefer SoftICE or DbgView. By real time I mean trace is
formatted and printed out before original call in the driver returns. Note
conditions compilation isn’t an acceptable solution because binaries differ
and I want to use the same binary for both development and testing.

Best regards,

Michal Vodicka
STMicroelectronics Design and Application s.r.o.
[michal.vodicka@st.com, http:://www.st.com]

Well it turns out that sometimes we all play the moron.

Forget my issue number 6 (clients can’t use library’s tracing,) that was
operator error on my part.

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Mark Roddy
Sent: Monday, February 16, 2004 3:09 PM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] Moron ETW

Ian,

I haven’t really resolved much at all, other than the
whitespace issue.

As I wrote originally:

  1. As far as I can tell, Henry’s hint about how to use the
    !UNDOCUMENTED!
    level and flag support in WPP does not work. If I amend my
    sources file as
    follows:

RUN_WPP=$(SOURCES) \
-km \
-func:gsDebugPrintEx(LEVEL,FLAG,MSG,…)

And add the following to a global include file:

#define WPP_LEVEL_FLAGS_LOGGER(lvl,flags) WPP_LEVEL_LOGGER(flags)

#define WPP_LEVEL_FLAGS_ENABLED(lvl,flags) \
(WPP_LEVEL_ENABLED(flags) &&
WPP_CONTROL(WPP_BIT_##flags).Level >= lvl)

#define WPP_CONTROL_GUIDS \
WPP_DEFINE_CONTROL_GUID(someguid,\
(42F45982,818A,41dd,ADD3,DEB1A24DE686),\
WPP_DEFINE_BIT(flag1) \
WPP_DEFINE_BIT(flag2) \
)

I get the usual badness of the control bit flags being
undefined. I also
get:

WPP_LEVEL_FLAG_ENABLED’: identifier not found, even with
argument-dependent lookup

And

‘WPP_LEVEL_FLAG_LOGGER’: identifier not found, even with
argument-dependent lookup

  1. the ‘munged flags’ (those under the control of
    WPP_DEFINE_BIT) cannot be used outside of calls to the munged
    function(s) defined in RUN_WPP. So for example having code
    that does something like:

GlobalDebugType = flag1;

Results in an error because flag1 us undefined. Badness! WPP
ought to generate the premunged flag1 names as valid symbols.
Oddly, this feature is undocumented.

And my latest addition:

  1. My latest nightmare is how to expose log based debugging
    from a software library to the clients of that library. And
    once again this appears to be a bit on the undocumented side.

I am however intimately acquainted with error messages such
as “error C2065:
‘WPP_BIT_3’ : undeclared identifier” :slight_smile:

> -----Original Message-----
> From: xxxxx@lists.osr.com
> [mailto:xxxxx@lists.osr.com] On Behalf Of Ian Service
> Sent: Monday, February 16, 2004 2:48 PM
> To: Windows System Software Devs Interest List
> Subject: RE: [ntdev] Moron ETW
>
> If you guys can post some of the specific questions I will
try and get
> them answered for you in as timely a fashion as possible.
>
> Most you seem to have resolved yourselves, but let me know what is
> outstanding?
>
> -----Original Message-----
> From: xxxxx@lists.osr.com
> [mailto:xxxxx@lists.osr.com] On Behalf Of
Michal Vodicka
> Sent: Monday, February 16, 2004 11:32 AM
> To: Windows System Software Devs Interest List
> Subject: RE: [ntdev] Moron ETW
>
> > ----------
> > From: xxxxx@hollistech.com[SMTP:xxxxx@hollistech.com]
> > Reply To: xxxxx@lists.osr.com
> > Sent: Monday, February 16, 2004 7:59 PM
> > To: xxxxx@lists.osr.com
> > Subject: RE: [ntdev] Moron ETW
> >
> > Well I havent’ given up yet, as I am a persistent son of a
> bitch, but
> it
> > has
> > so far been a fairly complete waste of time. As to why I bothered,
> mostly
> > it
> > is because conceptually logging makes sense, and if Microsoft has
> > implemented a generic logging facility that can readily
be used for
> kernel
> > components, that makes even more sense.
> >
> Yes, I’m interested about it for equal reasons. In my experience
> tracing is superior debugging technique for anybody who
doesn’t make
> beginners’
> coding
> errors. I’m eager to use generic logging facility but only if
> everything I’m accustomed to use now can be done with it.
>
> Best regards,
>
> Michal Vodicka
> STMicroelectronics Design and Application s.r.o.
> [michal.vodicka@st.com, http:://www.st.com]
>
>
> —
> Questions? First check the Kernel Driver FAQ at
> http://www.osronline.com/article.cfm?id=256
>
> You are currently subscribed to ntdev as:
> xxxxx@windows.microsoft.com To unsubscribe send a blank email to
> xxxxx@lists.osr.com
>
> —
> Questions? First check the Kernel Driver FAQ at
> http://www.osronline.com/article.cfm?id=256
>
> You are currently subscribed to ntdev as:
> xxxxx@hollistech.com To unsubscribe send a blank email to
> xxxxx@lists.osr.com
>


Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as:
xxxxx@hollistech.com To unsubscribe send a blank email to
xxxxx@lists.osr.com

In my opinion this functionality is a classic example of Microsoft
overengineering at its worst. Using WPP/ETW to debug a driver is like
using a claymore mine to unclog a toilet. Microsoft should expend their
effort simplifying things at a fundamental level instead of fruitlessly
attempting to hide complexity with ever yet more elaborate frameworks
and debugging tools. You can still get 99% of the performance and 99% of
the flexibility with an infrastructure that is easily half as complex;
anything more is just intellectual self-gratification.

Mark Roddy wrote:

So after the lengthy discussion two weeks ago regarding ETW I decided it was
high time to convert a batch of kernel software to use ETW in the free
build. I expected the conversion process to take half a day or so. Three
days later the task is still not complete.

Here are some of the issues I ran into.

  1. white space appears to have some sort of meaning to the RUN_WPP statement
    in a sources file. For example:

RUN_WPP=$(SOURCES) \
-km \
-func:gsDebugPrintEx(NULL, LEVEL, MSG,…)

Appears to confuse WPP, resulting on all of the LEVEL flags being undefined.
Everything is bliss if you amend the above statement as follows:

RUN_WPP=$(SOURCES) \
-km \
-func:gsDebugPrintEx(NULL,LEVEL,MSG,…)

This minor undocumented feature added about 1-day to the conversion process.

  1. As far as I can tell, Henry’s hint about how to use the !UNDOCUMENTED!
    level and flag support in WPP does not work. If I amend my sources file as
    follows:

RUN_WPP=$(SOURCES) \
-km \
-func:gsDebugPrintEx(LEVEL,FLAG,MSG,…)

And add the following to a global include file:

#define WPP_LEVEL_FLAGS_LOGGER(lvl,flags) WPP_LEVEL_LOGGER(flags)

#define WPP_LEVEL_FLAGS_ENABLED(lvl,flags) \
(WPP_LEVEL_ENABLED(flags) && WPP_CONTROL(WPP_BIT_##flags).Level >= lvl)

#define WPP_CONTROL_GUIDS \
WPP_DEFINE_CONTROL_GUID(someguid,\
(42F45982,818A,41dd,ADD3,DEB1A24DE686),\
WPP_DEFINE_BIT(flag1) \
WPP_DEFINE_BIT(flag2) \
)

I get the usual badness of the control bit flags being undefined. I also
get:

WPP_LEVEL_FLAG_ENABLED’: identifier not found, even with argument-dependent
lookup

And

‘WPP_LEVEL_FLAG_LOGGER’: identifier not found, even with argument-dependent
lookup

This consumed a day of randomly mucking with stuff. Lucky for me it was
concurrent, more or less, with the day spent discovering that white space
has meaning to RUN_WPP. Of course it would help if this stuff were actually
documented somewhere. I finally gave up and reverted to the ‘NULL’ syntax,
which is also undocumented, but it at least works.

  1. The documentation and the ‘sample driver’ are horrible. The documentation
    might as well not exist, and the sample tracedriver is so simple that, while
    it works, it does not address any of the real-world issues people might
    encounter. The only other sample in the ddk is one version of toaster, and
    it too borders on the uselessly simple.

  2. Your debugprint routine can’t actually exist in your source code if WPP
    is enabled. On reflection, this one was obvious, but guess what? It isn’t
    actually documented anywhere. So you have to have a conditional compilation
    flag to eliminate your debugprint function from your source code if you are
    building for ETW.

  3. the ‘munged flags’ (those under the control of WPP_DEFINE_BIT) cannot be
    used outside of calls to the munged function(s) defined in RUN_WPP. So for
    example having code that does something like:

GlobalDebugType = flag1;

Results in an error because flag1 us undefined. Badness! WPP ought to
generate the premunged flag1 names as valid symbols. Oddly, this feature is
undocumented.

=====================
Mark Roddy
Windows .NET/XP/2000 Consulting
Hollis Technology Solutions 603-321-1032
www.hollistech.com

  • Nick Ryan
  • Microsoft MVP for DDK

When I went to use the macros that Henry documented I ran into errors also,
when I started looking around, I noticed that the macro names were
incorrect, Here are the corrected macros.

#define WPP_LEVEL_FLAG_LOGGER(lvl,flags) \

WPP_LEVEL_LOGGER(flags)

#define WPP_LEVEL_FLAG_ENABLED(lvl, flags) \

(WPP_LEVEL_ENABLED(flags) && WPP_CONTROL(WPP_BIT_##flags).Level >= lvl)

For my tracing I use the following style: (If I compile with
WPP_TRACING_ENABLED it uses WPP tracing, if not it uses DbgPrint)…

#if WPP_TRACING_ENABLED

#define WPP_LEVEL_FLAG_LOGGER(lvl,flags) \

WPP_LEVEL_LOGGER(flags)

#define WPP_LEVEL_FLAG_ENABLED(lvl, flags) \

(WPP_LEVEL_ENABLED(flags) && WPP_CONTROL(WPP_BIT_##flags).Level >= lvl)

#define WPP_CONTROL_GUIDS \

WPP_DEFINE_CONTROL_GUID(S150,(A_TRACING_GUID), \

WPP_DEFINE_BIT(A_FUNCTRACE) \

WPP_DEFINE_BIT(A_COMMAND_RECEIVED) \

WPP_DEFINE_BIT(A_INFO) \

WPP_DEFINE_BIT(A_ERROR) \

WPP_DEFINE_BIT(A_ALARM) \

)

#else // WPP_TRACING_ENABLED

#define A_FUNCTRACE 0x00000001

#define A_COMMAND_RECEIVED 0x00000002

#define A_INFO 0x00000004

#define A_ERROR 0x00000008

#define A_ALARM 0x00000010

#define ATrace(FLAG,LEVEL, XYZ) \

DbgPrint XYZ

#endif // WPP_TRACING_ENABLED

In my sources file I have the following:

RUN_WPP=$(SOURCES)\

-km\

-dll\

-func:ATrace(LEVEL,FLAG,(MSG,…))

(the -dll is necessary if you are using .cpp files.)

Also note that you need to include the .tmh files when compling for WPP
Tracing and to initialize wpp tracing in your driver entry and unitialize
it in your driver unload.

I have been using WPP for a long time and really like using it.


Mark Cariddi
Consulting Associate
OSR, Open Systems Resources, Inc.
http://www.osr.com/
“Mark Roddy” wrote in message news:xxxxx@ntdev…
> So after the lengthy discussion two weeks ago regarding ETW I decided it
was
> high time to convert a batch of kernel software to use ETW in the free
> build. I expected the conversion process to take half a day or so. Three
> days later the task is still not complete.
>
> Here are some of the issues I ran into.
>
> 1) white space appears to have some sort of meaning to the RUN_WPP
statement
> in a sources file. For example:
>
> RUN_WPP=$(SOURCES) <br>> -km <br>> -func:gsDebugPrintEx(NULL, LEVEL, MSG,…)
>
> Appears to confuse WPP, resulting on all of the LEVEL flags being
undefined.
> Everything is bliss if you amend the above statement as follows:
>
> RUN_WPP=$(SOURCES) <br>> -km <br>> -func:gsDebugPrintEx(NULL,LEVEL,MSG,…)
>
> This minor undocumented feature added about 1-day to the conversion
process.
>
> 2) As far as I can tell, Henry’s hint about how to use the !UNDOCUMENTED!
> level and flag support in WPP does not work. If I amend my sources file as
> follows:
>
> RUN_WPP=$(SOURCES) <br>> -km <br>> -func:gsDebugPrintEx(LEVEL,FLAG,MSG,…)
>
> And add the following to a global include file:
>
> #define WPP_LEVEL_FLAGS_LOGGER(lvl,flags) WPP_LEVEL_LOGGER(flags)
>
> #define WPP_LEVEL_FLAGS_ENABLED(lvl,flags) <br>> (WPP_LEVEL_ENABLED(flags) && WPP_CONTROL(WPP_BIT_##flags).Level >=
lvl)
>
> #define WPP_CONTROL_GUIDS <br>> WPP_DEFINE_CONTROL_GUID(someguid,<br>> (42F45982,818A,41dd,ADD3,DEB1A24DE686),<br>> WPP_DEFINE_BIT(flag1) <br>> WPP_DEFINE_BIT(flag2) <br>> )
>
> I get the usual badness of the control bit flags being undefined. I also
> get:
>
> WPP_LEVEL_FLAG_ENABLED’: identifier not found, even with
argument-dependent
> lookup
>
> And
>
> ‘WPP_LEVEL_FLAG_LOGGER’: identifier not found, even with
argument-dependent
> lookup
>
> This consumed a day of randomly mucking with stuff. Lucky for me it was
> concurrent, more or less, with the day spent discovering that white space
> has meaning to RUN_WPP. Of course it would help if this stuff were
actually
> documented somewhere. I finally gave up and reverted to the ‘NULL’ syntax,
> which is also undocumented, but it at least works.
>
> 3. The documentation and the ‘sample driver’ are horrible. The
documentation
> might as well not exist, and the sample tracedriver is so simple that,
while
> it works, it does not address any of the real-world issues people might
> encounter. The only other sample in the ddk is one version of toaster, and
> it too borders on the uselessly simple.
>
> 4. Your debugprint routine can’t actually exist in your source code if WPP
> is enabled. On reflection, this one was obvious, but guess what? It isn’t
> actually documented anywhere. So you have to have a conditional
compilation
> flag to eliminate your debugprint function from your source code if you
are
> building for ETW.
>
> 5. the ‘munged flags’ (those under the control of WPP_DEFINE_BIT) cannot
be
> used outside of calls to the munged function(s) defined in RUN_WPP. So for
> example having code that does something like:
>
> GlobalDebugType = flag1;
>
> Results in an error because flag1 us undefined. Badness! WPP ought to
> generate the premunged flag1 names as valid symbols. Oddly, this feature
is
> undocumented.
>
>
> =====================
> Mark Roddy
> Windows .NET/XP/2000 Consulting
> Hollis Technology Solutions 603-321-1032
> www.hollistech.com
>
>

I’ve used WPP tracing over a year and a half now. Yes it takes getting used
to, I found that keeping things simple at first helped alot, i.e. follow the
basic examples, don’t go crazy with flags and levels. My biggest complaint
had been the tools to manage the tracing, but Traceview fixed most of the
problems. Personally, I seperate my debug prints from the tracing, they may
look similar but I use seperate statements and keep things simple again.


Don Burn (MVP, Windows DDK)
Windows 2k/XP/2k3 Filesystem and Driver Consulting