Windows Hardware driver submission问题记录

Driver Update failure (rejected) 问题分析

背景描述：

V10700 + Hardware ID：PCI\VEN_1217&DEV_8621&SUBSYS_389517aa

在windows hardware driver submission被reject，提交单和关键信息如下：

https://partner.microsoft.com/en-us/dashboard/hardware/driver/14391505706251263/submission/1152921505697924694/ShippingLabel/401531646

Rejection Theme: Measure Failure Rejection Reason: Systemic Measure Failure Provide Measure ID(s): 26387215 ADO bugId: 55312863: Bug ID(s) and Partner ID(s): Link to documentation: Link to reliability report (if applicable): Details: Rejected because Measure ID 26387215 (Percent of machines where the driver install process completes successfully) is failing. Please read more on “https://docs.microsoft.com/en-us/windows-hardware/drivers/dashboard/pct-machines-where-driver-install-completes-successfully“ See the Plug and Play Extended Flight Report document for additional information on the failures. The “driver flight report” bug can be found by searching on Collaborate with the Submission ID. More info: https://docs.microsoft.com/en-us/windows-hardware/drivers/dashboard/pnp-failure-report and https://docs.microsoft.com/en-us/collaborate/feedback-items-search#search

报告分析

根据以上信息，在Microsoft partner center的feedback/bugs页面找到提交单对应的failure报告：

Windows Driver – 通过IDA逆向分析.sys

背景：因业务需要规划下一代PCIe SD host的Windows驱动，要支持Win11和以后的最新特性，因为现有的SD驱动是基于Storport-miniport架构，在Win11上有诸多限制严重影响业务，因此决定转型为WDF驱动。本文浅显分析Realtek的Win11 PCIe SD Card reader驱动是用什么架构，内部如何实现。

IDA反汇编工具

IDA能将二进制文件反汇编(disassemble)成为汇编代码，还支持将汇编代码进一步显示成C代码(decompile)。

下载IDA free版本就够用

https://hex-rays.com/products/ida/support/%20download_freeware%20/

IDA分析驱动.sys文件

IDA常用快捷键

F5：汇编代码转C代码显示（IDA称为伪代码，因为不是纯C）

Shift + F12：显示所有符号的字符串。可以全览所有函数，弄清用的什么技术栈

windows PC开发环境配置

多桌面和分屏

Win+Ctrl+D， 新建桌面窗口

Win+Ctrl + ←/→，切换桌面窗口

win+Tab， 任务视图，常用操作：拖动程序到指定窗口

win键+←/→，快速分屏成两列

win键 + ←/→ + ↑/↓，快速4分屏

注意：多个桌面的相同应用是独立的，例如某桌面打开chrome很多页面，其他桌面打开chrome会是新网页

区分Linux文件大小写

需要4个条件：

Windows Driver Model Architecture for SD Host projects

Driver Pair Model和Device Driver Interface(DDI)的概念

Driver Pair Model

Microsoft provides the general driver, and typically an independent hardware vendor provides the specific driver.

Driver Pair Model有两种不同层次的实现方式：

(1) Microsoft定义的某类设备的driver pair model: Microsoft实现XX device port driver + 设备厂商实现XX device miniport driver。这类driver pair model包括：

• (display miniport driver, display port driver)
• (audio miniport driver, audio port driver)
• (storage miniport driver, storage port driver)
• (battery miniclass driver, battery class driver)
• (HID minidriver, HID class driver)
• (changer miniclass driver, changer port driver)
• (NDIS miniport driver, NDIS library)

Miniport Driver Pair Model：https://learn.microsoft.com/en-us/windows-hardware/drivers/gettingstarted/minidrivers-and-driver-pairs

(2) Microsoft定义的general driver pair model：Microsoft实现WDF框架 + 设备厂商实现KMDF(Kernel Mode WDF)驱动。

• The driver is split into two pieces: one that handles general processing and one that handles processing that is specific to a particular device.
• The general piece, called the Framework, is written by Microsoft.
• The specific piece, called the KMDF driver, may be written by Microsoft or an independent hardware vendor.

ubuntu搭建跨平台markdown写作环境

ubuntu安装picgo

下载picgo安装包：

github：https://github.com/Molunerfinn/PicGo/releases/tag/v2.3.1

下载慢可以搜索国内镜像，bing搜索安装包名能找到国内镜像：

https://mirrors.sdu.edu.cn/github-release/Molunerfinn_PicGo/v2.3.1/

注意：安装PicGo AppImage，不要使用snap包，否则typora配置上传功能有问题

安装PicGo AppImage

AppImage是可以直接运行而不需要安装的包：Unlike other applications, AppImages do not need to be installed before they can be used. However, they need to be marked as executable before they can be run. This is a Linux security feature.

1
2

chmod +x PicGo-2.3.1.AppImage 
 ./PicGo-2.3.1.AppImage

Cursor 环境配置和简单使用

Cursor配置

free trial续杯

Cursor website: https://www.cursor.com

Cursor’s free trial for Pro(Premium models) has limitation for two weeks time and up to 500 request count. Use below steps to get more free-trial.

(1) In Account Setting, Detele wasted account, and re-register account with same email address. Log in Cursor desktop and 500 pro request is supported for more two weeks.

refer to guide: https://www.bilibili.com/video/BV1YAtReqEkH?spm_id_from=333.788.videopod.sections

(2) After several times re-register account, Cursor record your PC’s MAC and refuse to re-register, use below tool to re-fresh MAC.

https://github.com/yuaotian/go-cursor-help

Windows BSOD 0xCA Analysis.

根据 Windbg Dump 分析，这个 BSOD 是由 IOMMU 操作失败导致的。具体来看：

错误发生在设备初始化阶段：

1
2

DevNode State = DeviceNodeResourcesAssigned (0x306)
Previous State = DeviceNodeDriversAdded (0x305)

关键问题点：

1
2
3

BUGCHECK_CODE: ca (PNP_DETECTED_FATAL_ERROR)
Arg1: 13 (IOMMU operation failure)
Arg2: 1000 (Unblock operation)

解决 IOMMU 操作失败的问题。主要通过：

1. 正确初始化 DMA/IOMMU 映射（当前代码已支持，不需修改）

2. 确保状态转换时 DMA 操作安全完成 （当前代码待修改）

代码改动：

设备进入D3/D0以前Complete所有I/O请求（SRB），使用Storport miniport要求的API RequestComplete ： We do not recommend that writers of Storport miniport drivers use this particular Storport interface routine. Instead, the miniport driver should call StorPortNotification( RequestComplete ) for each outstanding request.

BH202 ARM windows的Pofx->D3 & Fast removal/insert issue.

issue现象和driver分析

客户问题：

客户高通平台5/100的平台有首次插卡不弹卡问题，复现测试发现快速插拔卡可以等效复现，有概率性插卡不识别问题，且不识别后再插拔卡也不识别。

WH lab分析：

1.BH202状态机可能有问题，卡侧和Host侧的通信方向不一致导致CMD8持续报错。

2.Workaround：通过Driver的error recovery flow的power cycle操作（power off + power on）去复位硬件状态。

Driver问题分析和优化点：

1.快速插拔卡后设备不能进D3（power off），原因是BH202 driver的pofx-> D3\pofx-> D0流程有问题，按driver issue fix architecture修改后问题解决。

3.BH202 driver的card change -> pofx request流程需要优化，确保pofx->D state时序正确

BH20x问题记录

Balur项目 - Qcom Android 14 bazel编译系统

关于GKI和KMI的概念(需要clash梯子)：GKI划分common kernel和platform module，是platform能使用bazel的根本原因

https://source.android.com/docs/core/architecture/kernel/generic-kernel-image

bazel用于安卓14以上的platform kernel module编译：

https://android.googlesource.com/kernel/build/+/refs/heads/main-kernel/kleaf/docs/impl.md#Step-2_Define-targets-to-build-external-kernel-modules

bazel语法（CN）

https://bazel.google.cn/versions/7.4.0/reference/be/c-cpp?hl=zh-cn

编译问题和方案

Bazel编译sdhci-msm.c中的#include语句时，找不到bayhub.c和bayhub.c

飞腾派Linux SD驱动分析和调试

SD初始化流程分析

SD初始化的起始点

带SD卡启动系统时，初始化SD host和card的调用链：

probe -> mmc_alloc_host -> mmc_start_host -> _mmc_detect_change -> mmc_schedule_delayed_work(&host->detect) -> mmc_rescan（注释1）-> mmc_rescan_try_freq（注释2）

注释1：mmc_alloc_host时用INIT_DELAYED_WORK绑定delayed_work detect和mmc_rescan回调函数

1

INIT_DELAYED_WORK(&host->detect, mmc_rescan);

注释2：这里可能执行多次，从SD接口最低频率开始初始化，一般是400KHz，代码如下。 注意host->f_min是host driver设置。

1
2
3
4
5
6
7
8

static const unsigned freqs[] = { 400000, 300000, 200000, 100000 };

for (i = 0; i < ARRAY_SIZE(freqs); i++) {
    if (!mmc_rescan_try_freq(host, max(freqs[i], host->f_min)))
        break;
    if (freqs[i] <= host->f_min)
        break;
}

SD初始化的过程