via Start-Process -Verb RunAs, or run manually from an Administrator prompt.\r
\r
What this installs / configures:\r
+ - OpenSSH Client capability (the ssh.exe rsync shells out to, and the\r
+ System32 libcrypto.dll the release's own ssh.exe links against)\r
- ssh-agent set to automatic + started\r
- OpenSSH Server (sshd) capability: automatic + started + inbound TCP 22\r
- - rsync for Windows (nuket/rsync-windows) in C:\Tools\rsync, on the machine PATH\r
+ - rsync for Windows (nuket/rsync-windows) in C:\Tools\rsync, on the machine\r
+ PATH: rsync.exe plus the ssh.exe it runs, out of the release zip for this\r
+ architecture\r
- Visual Studio 2022 Community (C++ desktop workload, Spectre libs, WDK VSIX,\r
Win11 SDK 26100, Clang/LLVM, and the v141 + Windows XP targeting toolset)\r
- Windows Driver Kit 10.0.26100\r
+ - Windows Performance Toolkit - xperf, wpr and Windows Performance Analyzer\r
+ (wpa.exe) - on the machine PATH\r
+ - Performance Log Users membership for one ordinary account, so it can run\r
+ user-mode ETW sessions (xperf -start ... -on <provider>) without elevation.\r
+ Kernel traces are NOT covered - the NT Kernel Logger is admin-only; see the\r
+ step for what was measured.\r
\r
Change $VsInstallerUrl below to the Professional or Enterprise bootstrapper if needed:\r
Professional : https://aka.ms/vs/17/release/vs_professional.exe\r
Enterprise : https://aka.ms/vs/17/release/vs_enterprise.exe\r
#>\r
\r
+param(\r
+ # Account to put in Performance Log Users (see the "ETW session control"\r
+ # step, which runs first). Defaults to the interactive console user, but\r
+ # setup-windows.bat passes it explicitly: with over-the-shoulder elevation\r
+ # THIS script runs as the administrator whose credentials went into the UAC\r
+ # prompt, not as the user who started the batch file, so $env:USERNAME here\r
+ # is the wrong answer.\r
+ #\r
+ # Pass an empty string to skip it; adding an account later is one\r
+ # `net localgroup` away.\r
+ [string] $TraceUser = '',\r
+\r
+ # Do the ETW step and nothing else. It is a group membership and no\r
+ # downloads, where a full run is dominated by the three Visual Studio\r
+ # passes, which take minutes even when they have nothing to do. It is why\r
+ # that step runs FIRST: -EtwRightsOnly is then just an early exit rather\r
+ # than a set of guards down the rest of the script.\r
+ [switch] $EtwRightsOnly\r
+)\r
+\r
$ErrorActionPreference = 'Stop'\r
\r
function Write-Step([string]$Msg) {\r
\r
try {\r
\r
+# ---------------------------------------------------------------------------\r
+# ETW session control for an ordinary account\r
+#\r
+# Creating or controlling an event tracing session - even a user-mode one naming\r
+# a single provider - is checked against the security descriptor ETW keeps per\r
+# provider GUID under HKLM\SYSTEM\CurrentControlSet\Control\WMI\Security. The\r
+# default grants the session-control rights (TRACELOG_CREATE_ONDISK,\r
+# TRACELOG_CREATE_REALTIME, TRACELOG_GUID_ENABLE, TRACELOG_LOG_EVENT) to SYSTEM,\r
+# Administrators, the service accounts and BUILTIN\Performance Log Users, and to\r
+# nobody else. Its own description says members "may ... enable trace providers,\r
+# and collect event traces", and that is what membership buys:\r
+#\r
+# xperf -start MySession -on Microsoft-Windows-Kernel-Process -f trace.etl\r
+# xperf -stop MySession\r
+#\r
+# runs unelevated for a member and is "Access is denied. (0x5)" for everyone\r
+# else. Enough to trace your own application's providers without a UAC prompt.\r
+#\r
+# Membership is read into the access token at LOGON, so the account has to sign\r
+# out and back in. Any NEW logon does it - an ssh login into this box is one,\r
+# which is the quick way to check without dropping the desktop.\r
+#\r
+# WHAT THIS DOES NOT BUY: system-wide kernel traces. `xperf -on base` and\r
+# `wpr -start` drive the NT Kernel Logger, which is reserved for Administrators\r
+# and LocalSystem - Microsoft documents Performance Log Users access as\r
+# explicitly NOT extending to it. Measured here, so that nobody repeats it: with\r
+# the account in the group, SeSystemProfilePrivilege ("Profile system\r
+# performance") granted to that group, and an explicit ACE giving the group\r
+# TRACELOG_ACCESS_KERNEL_LOGGER on SystemTraceControlGuid - all three in place,\r
+# across a reboot - xperf still answered\r
+#\r
+# xperf: error: NT Kernel Logger: Access is denied. (0x5).\r
+#\r
+# It is not a check an ACE overrides. Those two grants were dropped again rather\r
+# than left on the box earning nothing, and CPU sampling and whole-system traces\r
+# are elevated work: run xperf, wpr or VTune from an Administrator prompt.\r
+#\r
+# Analysis needs none of this either way - wpa.exe opens an existing .etl as a\r
+# plain user.\r
+# ---------------------------------------------------------------------------\r
+Write-Step 'ETW session control (non-elevated user-mode tracing)'\r
+$PerfLogUsersSid = 'S-1-5-32-559' # BUILTIN\Performance Log Users\r
+try {\r
+ # Fall back to the console user when the caller did not name one: with\r
+ # over-the-shoulder elevation that is the person who started\r
+ # setup-windows.bat, which is who wants to trace.\r
+ $target = $TraceUser\r
+ if (-not $target) {\r
+ $target = (Get-CimInstance Win32_ComputerSystem -ErrorAction SilentlyContinue).UserName\r
+ if ($target) { Write-Host " No -TraceUser given; using the console user $target" }\r
+ }\r
+\r
+ if (-not $target) {\r
+ Write-Warning 'No account to add to Performance Log Users (pass -TraceUser DOMAIN\user).'\r
+ Write-Warning 'To do it later:'\r
+ Write-Warning ' net localgroup "Performance Log Users" DOMAIN\user /add'\r
+ } else {\r
+ # Resolve to a SID first: it validates the name, and it is what the\r
+ # membership check compares, so a member spelled ".\claude" in one place\r
+ # and "LATISLAB\claude" in another is still recognised as the same account.\r
+ $targetSid = (New-Object System.Security.Principal.NTAccount($target)).Translate(\r
+ [System.Security.Principal.SecurityIdentifier])\r
+\r
+ # By SID, never by name: "Performance Log Users" is localised, and\r
+ # Get-LocalGroup -SID is how this stays correct on a non-English box.\r
+ $group = Get-LocalGroup -SID $PerfLogUsersSid\r
+\r
+ # Get-LocalGroupMember throws on a group holding a SID that no longer\r
+ # resolves (a known Windows 10 bug), so a failure to READ the membership\r
+ # must not stop us from writing it - fall through and let the add report.\r
+ $already = $false\r
+ try {\r
+ $already = @(Get-LocalGroupMember -SID $PerfLogUsersSid |\r
+ Where-Object { $_.SID.Value -eq $targetSid.Value }).Count -gt 0\r
+ } catch {\r
+ Write-Host " (could not enumerate $($group.Name) members: $($_.Exception.Message))" -ForegroundColor DarkGray\r
+ }\r
+\r
+ if ($already) {\r
+ Write-Host " OK: $target is already in $($group.Name)"\r
+ } else {\r
+ try {\r
+ Add-LocalGroupMember -SID $PerfLogUsersSid -Member $targetSid.Value\r
+ } catch {\r
+ # "already a member" is only reachable when the enumeration above\r
+ # failed, and is not an error. Matched on the type NAME rather\r
+ # than in a typed catch clause: catch types are resolved when the\r
+ # script is PARSED, before the LocalAccounts module has been\r
+ # autoloaded, so naming the type there is a parse error that\r
+ # would take the whole script down.\r
+ if ($_.Exception.GetType().Name -ne 'MemberExistsException') { throw }\r
+ }\r
+ Write-Host " Added $target to $($group.Name)"\r
+ }\r
+\r
+ Write-Host ''\r
+ Write-Host " $target must sign out and back in before this takes effect." -ForegroundColor Yellow\r
+ Write-Host ' Then, from that account (NOT elevated):' -ForegroundColor Yellow\r
+ Write-Host ' xperf -start T -on Microsoft-Windows-Kernel-Process -f trace.etl' -ForegroundColor Yellow\r
+ Write-Host ' xperf -stop T' -ForegroundColor Yellow\r
+ }\r
+} catch {\r
+ Write-Warning "Performance Log Users membership failed: $($_.Exception.Message)"\r
+ Write-Warning 'Do it by hand with:'\r
+ Write-Warning ' net localgroup "Performance Log Users" <user> /add'\r
+}\r
+\r
+if ($EtwRightsOnly) {\r
+ # `exit` inside the try still runs the finally below, so the transcript is\r
+ # stopped and the log is left readable by the non-elevated caller.\r
+ Write-Host "`n-EtwRightsOnly: skipping the installs." -ForegroundColor Green\r
+ exit 0\r
+}\r
+\r
+\r
# ---------------------------------------------------------------------------\r
# Base tools via winget\r
# ---------------------------------------------------------------------------\r
+\r
+# ---------------------------------------------------------------------------\r
+# OpenSSH Client\r
+#\r
+# Present by default on Windows 10 1809+ / Windows 11, but removable, and absent\r
+# from some Server images. Two things below want it: rsync does not speak ssh\r
+# itself, it execs an ssh binary, and the release's own ssh.exe links against the\r
+# libcrypto.dll this capability puts in System32. It also owns the ssh-agent\r
+# service configured next, so a missing client is why that step would fail.\r
+#\r
+# Non-fatal, like the server half below: a box that cannot have it should still\r
+# finish provisioning.\r
+# ---------------------------------------------------------------------------\r
+Write-Step 'OpenSSH Client'\r
+try {\r
+ $sshc = Get-WindowsCapability -Online -Name 'OpenSSH.Client*' |\r
+ Select-Object -First 1\r
+ if (-not $sshc) {\r
+ Write-Warning 'OpenSSH.Client capability not offered by this Windows image - skipping.'\r
+ } elseif ($sshc.State -eq 'Installed') {\r
+ Write-Host " OK: $($sshc.Name) already installed"\r
+ } else {\r
+ Write-Host " Installing $($sshc.Name) ..."\r
+ $r = Add-WindowsCapability -Online -Name $sshc.Name\r
+ if ($r.RestartNeeded) { Write-Host ' [reboot required after OpenSSH Client]' -ForegroundColor Yellow }\r
+ }\r
+} catch {\r
+ Write-Warning "OpenSSH Client setup failed: $($_.Exception.Message)"\r
+}\r
+\r
# ---------------------------------------------------------------------------\r
# SSH agent\r
# ---------------------------------------------------------------------------\r
# Windows' OpenSSH ships the transport only - no rsync - so pushing test data\r
# from a Linux box needs an rsync.exe on the Windows side.\r
#\r
+# The release is one zip per architecture - rsync-windows-x64.zip and\r
+# rsync-windows-x86.zip - each holding rsync.exe, the ssh.exe it runs, and the\r
+# licence texts under exactly those names. Both exes are installed, together:\r
+# rsync.exe prefers an ssh.exe in its own directory, and the release's build is\r
+# what makes a push FROM this box run at line rate. The ssh.exe Windows ships\r
+# reads its stdin 3KB at a time, which holds a send at ~17MB/s however fast the\r
+# link is. Nothing else about it differs - same ~/.ssh, same ssh-agent, same\r
+# known_hosts - and a bare `ssh` still resolves to the in-box client, which sits\r
+# ahead of C:\Tools\rsync on the machine PATH.\r
+#\r
+# That ssh.exe links against the libcrypto.dll the OpenSSH Client capability\r
+# above puts in System32: Windows' own LibreSSL, and the fast one, since it uses\r
+# AES-NI. No copy of it ships in the zip, so where the capability is missing we\r
+# unpack rsync alone rather than an ssh.exe that will not start.\r
+#\r
# Installed to C:\Tools\rsync (NOT under "Program Files"): the remote end is\r
# invoked as `rsync --server ...` through cmd.exe, and a path with spaces makes\r
# the client-side --rsync-path escape hatch painful to quote. Added to the\r
# Non-fatal: a download failure only warns.\r
# ---------------------------------------------------------------------------\r
Write-Step 'rsync for Windows'\r
-$RsyncUrl = 'https://github.com/nuket/rsync-windows/releases/download/v3.5.0-g521ad8ad/rsync.exe'\r
-$RsyncDir = 'C:\Tools\rsync'\r
+$RsyncRepo = 'nuket/rsync-windows'\r
+$RsyncAsset = if ([Environment]::Is64BitOperatingSystem) { 'rsync-windows-x64.zip' } else { 'rsync-windows-x86.zip' }\r
+# The /releases/latest/download/ redirect rather than the API: unauthenticated\r
+# API calls are rate-limited to 60/hour per IP, which a provisioning run behind a\r
+# shared NAT can genuinely exhaust, and the redirect costs none of that budget.\r
+# To hold a box on a known build, pin the tag instead:\r
+# .../releases/download/v3.5.0-gABCDEF0/$RsyncAsset\r
+$RsyncUrl = "https://github.com/$RsyncRepo/releases/latest/download/$RsyncAsset"\r
+$RsyncDir = 'C:\Tools\rsync'\r
try {\r
New-Item -ItemType Directory -Force -Path $RsyncDir | Out-Null\r
$RsyncExe = Join-Path $RsyncDir 'rsync.exe'\r
- # Download to a temp name first so an interrupted transfer can't leave a\r
- # truncated rsync.exe sitting on the PATH.\r
- $tmpExe = "$RsyncExe.download"\r
+\r
+ # Does the release's ssh.exe have the libcrypto it needs? Decided before the\r
+ # download so the answer can also gate what comes out of the zip.\r
+ $SysCrypto = Join-Path $env:WINDIR 'System32\libcrypto.dll'\r
+ $WantSsh = Test-Path $SysCrypto\r
+ if (-not $WantSsh) {\r
+ Write-Warning "$SysCrypto is missing - the OpenSSH Client capability is not installed - and the release's ssh.exe needs it. Installing rsync.exe only; rsync will use the ssh on the PATH."\r
+ } else {\r
+ $v = (Get-Item $SysCrypto).VersionInfo.FileVersion\r
+ if ($v -and ([version]($v -replace '[^0-9.]', '')) -lt [version]'3.8.2') {\r
+ Write-Warning "$SysCrypto is LibreSSL $v; the release's ssh.exe is built against 3.8.2 (Windows OpenSSH Client 9.5). Update Windows, or expect ssh.exe not to start."\r
+ }\r
+ }\r
+\r
+ # Download and unpack beside the targets, not over them, so an interrupted\r
+ # transfer can't leave a truncated rsync.exe sitting on the PATH. The scratch\r
+ # name still has to END in .zip: Windows PowerShell 5.1's Expand-Archive\r
+ # refuses any other extension outright ("*.download is not a supported\r
+ # archive file format"), where PowerShell 7 just reads the file.\r
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12\r
- Invoke-WebRequest -Uri $RsyncUrl -OutFile $tmpExe -UseBasicParsing\r
- Move-Item -Path $tmpExe -Destination $RsyncExe -Force\r
- Write-Host " Downloaded rsync.exe to $RsyncExe"\r
+ $tmpZip = Join-Path $RsyncDir "download-$RsyncAsset"\r
+ Invoke-WebRequest -Uri $RsyncUrl -OutFile $tmpZip -UseBasicParsing\r
+ Write-Host " Downloaded $RsyncAsset ($([math]::Round((Get-Item $tmpZip).Length / 1MB, 2)) MB)"\r
+\r
+ # Verify against the .sha256 published beside it. Same origin, so this is an\r
+ # integrity check on the transfer rather than a defence against a hostile\r
+ # release - but a truncated or proxy-mangled download is the failure that\r
+ # actually happens, and it fails here instead of mid-transfer later.\r
+ #\r
+ # -OutFile, not .Content: GitHub serves the .sha256 as\r
+ # application/octet-stream, and Invoke-WebRequest hands back a byte[] rather\r
+ # than a string for any non-text content type, so .Content would compare the\r
+ # first BYTE against the hash and fail on every correct download.\r
+ $tmpSha = "$tmpZip.sha256"\r
+ Invoke-WebRequest -Uri "$RsyncUrl.sha256" -OutFile $tmpSha -UseBasicParsing\r
+ $want = (((Get-Content $tmpSha -Raw) -split '\s+')[0]).Trim().ToLower()\r
+ Remove-Item $tmpSha -Force -ErrorAction SilentlyContinue\r
+ $got = (Get-FileHash $tmpZip -Algorithm SHA256).Hash.ToLower()\r
+ if ($want -and $want -ne $got) {\r
+ Remove-Item $tmpZip -Force\r
+ throw "SHA-256 mismatch for ${RsyncAsset}: expected $want, got $got"\r
+ }\r
+ Write-Host " SHA-256 verified: $got"\r
+\r
+ # Unpack to a scratch directory and move out the files we asked for, rather\r
+ # than expanding straight over the install directory: the zip is the unit\r
+ # that was checksummed, and this way a future release adding something to it\r
+ # cannot quietly drop that something onto the machine PATH.\r
+ $unpack = Join-Path $RsyncDir '.unpack'\r
+ if (Test-Path $unpack) { Remove-Item -Recurse -Force $unpack }\r
+ Expand-Archive -Path $tmpZip -DestinationPath $unpack -Force\r
+ Remove-Item $tmpZip -Force\r
+ foreach ($f in 'rsync.exe', 'ssh.exe', 'COPYING.txt', 'NOTICE-ssh.txt') {\r
+ $src = Join-Path $unpack $f\r
+ if (-not (Test-Path $src)) { continue }\r
+ if ($f -eq 'ssh.exe' -and -not $WantSsh) { continue }\r
+ Move-Item -Path $src -Destination (Join-Path $RsyncDir $f) -Force\r
+ }\r
+ Remove-Item -Recurse -Force $unpack\r
+ Write-Host " Installed $RsyncExe$(if ($WantSsh) { ' and the ssh.exe it runs' })"\r
\r
# Machine PATH (HKLM environment). Idempotent: only appends if absent.\r
$m = [Environment]::GetEnvironmentVariable('Path', 'Machine')\r
& $RsyncExe --version | Select-Object -First 1\r
} catch {\r
Write-Warning "rsync install failed: $($_.Exception.Message)"\r
- Write-Warning "Download manually from $RsyncUrl and drop it in $RsyncDir."\r
+ Write-Warning "Download $RsyncAsset from https://github.com/$RsyncRepo/releases manually"\r
+ Write-Warning "and unpack it into $RsyncDir, keeping rsync.exe and ssh.exe together."\r
}\r
\r
# ---------------------------------------------------------------------------\r
}\r
\r
# ---------------------------------------------------------------------------\r
-# Windows Performance Toolkit (xperf / WPA / wpr) -- ETW CPU + loader profiling,\r
-# used by the perf/ measurement scripts. WPT is an OPTIONAL Windows SDK feature\r
-# that the VS "Windows 11 SDK" component does NOT select, so a fresh box lacks it.\r
-# The Windows ADK bundles WPT and winget owns the (versioned) download URL, so it\r
-# is the most reliable source. Idempotent (skips if xperf is already present in\r
-# either the SDK or ADK location) and non-fatal so it never aborts provisioning.\r
-# Lighter alternative if you don't want the full ADK: install the Windows SDK's\r
-# "Windows Performance Toolkit" optional feature via winsdksetup.exe /features\r
-# OptionId.WindowsPerformanceToolkit.\r
+# Windows Performance Toolkit: xperf, wpr, and Windows Performance Analyzer\r
+# (wpa.exe) -- ETW CPU + loader profiling and the GUI that reads the traces.\r
+#\r
+# WPA is NOT a Visual Studio component and has no relationship to VS's own\r
+# Performance Profiler (a separate, .diagsession-based tool that cannot open an\r
+# .etl). It ships in exactly two places: as an optional FEATURE of the Windows\r
+# SDK ("Windows Performance Toolkit", OptionId.WindowsPerformanceToolkit), and\r
+# in the Windows ADK, which bundles the same toolkit. Whether the SDK install\r
+# that Visual Studio performs happens to select that feature varies with the VS\r
+# and SDK version - when it does, WPT lands in\r
+# %ProgramFiles(x86)%\Windows Kits\10\Windows Performance Toolkit and the SDK\r
+# puts that directory on the machine PATH itself - so this step DETECTS first\r
+# and only falls back to installing the ADK (winget owns the versioned download\r
+# URL, which makes it the reliable source) when nothing is there. That fallback\r
+# is a large download; to install just the toolkit instead, run the standalone\r
+# SDK setup with\r
+# winsdksetup.exe /features OptionId.WindowsPerformanceToolkit /q\r
+#\r
+# There is also a newer WPA in the Microsoft Store (`winget install --id\r
+# 9N0W1B2BXGNZ --source msstore`), which updates independently of the SDK. It is\r
+# not installed here: the Store package needs an interactive, signed-in session,\r
+# which is exactly what this elevated, unattended half does not have.\r
+#\r
+# Idempotent and non-fatal - it never aborts provisioning.\r
# ---------------------------------------------------------------------------\r
-Write-Step 'Windows Performance Toolkit (xperf / WPA)'\r
-$wptRoots = @(\r
- (Join-Path ${env:ProgramFiles(x86)} 'Windows Kits\10\Windows Performance Toolkit\xperf.exe'),\r
- (Join-Path $env:ProgramFiles 'Windows Kits\10\Windows Performance Toolkit\xperf.exe'),\r
- (Join-Path ${env:ProgramFiles(x86)} 'Windows Kits\10\Assessment and Deployment Kit\Windows Performance Toolkit\xperf.exe')\r
+Write-Step 'Windows Performance Toolkit (xperf / wpr / WPA)'\r
+$WptDirs = @(\r
+ (Join-Path ${env:ProgramFiles(x86)} 'Windows Kits\10\Windows Performance Toolkit'),\r
+ (Join-Path $env:ProgramFiles 'Windows Kits\10\Windows Performance Toolkit'),\r
+ (Join-Path ${env:ProgramFiles(x86)} 'Windows Kits\10\Assessment and Deployment Kit\Windows Performance Toolkit')\r
)\r
-$xperf = $wptRoots | Where-Object { Test-Path $_ } | Select-Object -First 1\r
-if ($xperf) {\r
- Write-Host " OK: WPT already present ($xperf)" -ForegroundColor Green\r
+function Find-WptDir { $script:WptDirs | Where-Object { Test-Path (Join-Path $_ 'xperf.exe') } | Select-Object -First 1 }\r
+\r
+$WptDir = Find-WptDir\r
+if ($WptDir) {\r
+ Write-Host " OK: WPT already present ($WptDir)" -ForegroundColor Green\r
} else {\r
try {\r
winget install --id Microsoft.WindowsADK --exact --silent --disable-interactivity `\r
--accept-source-agreements --accept-package-agreements\r
Write-Host ' Windows ADK (includes Windows Performance Toolkit) installed.'\r
+ $WptDir = Find-WptDir\r
} catch {\r
Write-Warning "WPT install failed: $($_.Exception.Message)"\r
Write-Warning 'Install manually: winget install Microsoft.WindowsADK, or add the'\r
}\r
}\r
\r
+if ($WptDir) {\r
+ # Report what actually landed. wpa.exe is the piece people come looking for\r
+ # and it is the one that is absent if a trimmed toolkit ever shows up.\r
+ foreach ($tool in 'xperf.exe', 'wpr.exe', 'wpa.exe', 'wpaexporter.exe') {\r
+ $p = Join-Path $WptDir $tool\r
+ if (Test-Path $p) {\r
+ Write-Host " $tool $((Get-Item $p).VersionInfo.ProductVersion)"\r
+ } else {\r
+ Write-Warning "$tool is missing from $WptDir"\r
+ }\r
+ }\r
+\r
+ # The WPT installer normally adds this to the machine PATH itself (and the\r
+ # Start Menu gets "Windows Kits > Windows Performance Toolkit" shortcuts for\r
+ # WPA and WPR). Re-assert it anyway: on the machine PATH rather than a user\r
+ # one so it also resolves for the non-interactive sshd sessions this box is\r
+ # driven through, which build their environment from the registry PATH.\r
+ # Compared trailing-backslash-insensitively - the installer's own entry has\r
+ # one, and adding a second spelling of the same directory is just noise.\r
+ $m = [Environment]::GetEnvironmentVariable('Path', 'Machine')\r
+ if (-not $m) { $m = '' }\r
+ $have = ($m -split ';') | Where-Object { $_.TrimEnd('\') -eq $WptDir.TrimEnd('\') }\r
+ if ($have) {\r
+ Write-Host " OK: $WptDir already in the machine PATH"\r
+ } else {\r
+ $new = if ($m.Trim()) { $m.TrimEnd(';') + ';' + $WptDir } else { $WptDir }\r
+ [Environment]::SetEnvironmentVariable('Path', $new, 'Machine')\r
+ Write-Host " Added $WptDir to the machine PATH (restart shells to pick it up)."\r
+ }\r
+}\r
+\r
+\r
+# ---------------------------------------------------------------------------\r
+# Intel VTune Profiler - reported, not installed\r
+#\r
+# Deliberately NOT automated, unlike everything above. The offline installer is\r
+# a ~750 MB download from a URL carrying a per-release GUID\r
+# (registrationcenter-download.intel.com/akdlm/IRC_NAS/<guid>/intel-vtune-<ver>_offline.exe)\r
+# with no "latest" redirect behind it, so every new build means editing a\r
+# hard-coded link in here - and it is only worth having on Intel silicon, since\r
+# hardware event-based sampling reads Intel PMU counters. Not a good trade for a\r
+# script that has to keep working unattended on any box.\r
+#\r
+# So this step only reports. To install it, take the Windows offline installer\r
+# from\r
+# https://www.intel.com/content/www/us/en/developer/tools/oneapi/vtune-profiler-download.html\r
+# and run it elevated; it installs unattended with\r
+# intel-vtune-<version>_offline.exe -a --silent --cli --eula accept\r
+# ---------------------------------------------------------------------------\r
+Write-Step 'Intel VTune Profiler (status only)'\r
+$UninstallKeys = @(\r
+ 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*'\r
+ 'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*'\r
+)\r
+$vtune = Get-ItemProperty $UninstallKeys -ErrorAction SilentlyContinue |\r
+ Where-Object { $_.DisplayName -match 'VTune' } |\r
+ Select-Object -First 1\r
+if ($vtune) {\r
+ Write-Host " Installed: $($vtune.DisplayName.Trim()) $($vtune.DisplayVersion)" -ForegroundColor Green\r
+ # The oneAPI layout keeps a `latest` junction beside the versioned directory,\r
+ # so this path stays right across upgrades.\r
+ $VTuneCli = Join-Path $vtune.InstallLocation 'vtune\latest\bin64\vtune.exe'\r
+ if (Test-Path $VTuneCli) { Write-Host " CLI: $VTuneCli" }\r
+} else {\r
+ Write-Host ' Not installed.' -ForegroundColor Yellow\r
+ Write-Host ' https://www.intel.com/content/www/us/en/developer/tools/oneapi/vtune-profiler-download.html' -ForegroundColor Yellow\r
+ $cpu = (Get-CimInstance Win32_Processor -ErrorAction SilentlyContinue | Select-Object -First 1).Manufacturer\r
+ if ($cpu -and $cpu -notmatch 'Intel') {\r
+ Write-Host " (This CPU reports itself as '$cpu' - VTune's hardware event-based sampling wants Intel silicon.)" -ForegroundColor Yellow\r
+ }\r
+}\r
+\r
# ---------------------------------------------------------------------------\r
Write-Host "`nAll done." -ForegroundColor Green\r
Write-Host 'If a reboot was flagged above, restart before opening VS or building drivers.'\r
vilimpoc.org / repos / dotfiles / blobdiff