+#Requires -RunAsAdministrator\r
+<#\r
+ setup-windows-with-uac.ps1\r
+ Elevated portion of BlockBox Windows provisioning. Invoked by setup-windows.bat\r
+ via Start-Process -Verb RunAs, or run manually from an Administrator prompt.\r
+\r
+ What this installs / configures:\r
+ - ssh-agent set to automatic + started\r
+ - Visual Studio 2022 Community (C++ desktop workload, Spectre libs, WDK VSIX,\r
+ Win11 SDK 26100, Clang/LLVM, and the v141 + Windows XP targeting toolset)\r
+ - Windows Driver Kit 10.0.26100\r
+\r
+ Change $VsInstallerUrl below to the Professional or Enterprise bootstrapper if needed:\r
+ Professional : https://aka.ms/vs/17/release/vs_professional.exe\r
+ Enterprise : https://aka.ms/vs/17/release/vs_enterprise.exe\r
+#>\r
+\r
+$ErrorActionPreference = 'Stop'\r
+\r
+function Write-Step([string]$Msg) {\r
+ Write-Host "`n==> $Msg" -ForegroundColor Cyan\r
+}\r
+\r
+function Assert-ExitCode([int]$Code, [string]$Step) {\r
+ # 0 = success, 3010 = success + reboot required\r
+ if ($Code -notin @(0, 3010)) {\r
+ throw "$Step failed with exit code $Code"\r
+ }\r
+ if ($Code -eq 3010) {\r
+ Write-Host " [reboot required after $Step]" -ForegroundColor Yellow\r
+ }\r
+}\r
+\r
+function Show-VsSetupLogs {\r
+ # The VS Installer writes dd_*.log to the invoking user's %TEMP%. Because\r
+ # this script runs elevated, that %TEMP% belongs to the elevated user and is\r
+ # readable here even when it is NOT readable by the non-elevated caller. Fold\r
+ # only the NEWEST installer + bootstrapper log into the transcript (the setup\r
+ # engine log is where per-component / product errors actually appear) and\r
+ # keep it short so the transcript stays readable.\r
+ Write-Host "`n==> Collecting VS Installer logs from $env:TEMP" -ForegroundColor Cyan\r
+ $recent = Get-ChildItem $env:TEMP -Filter 'dd_*.log' -ErrorAction SilentlyContinue |\r
+ Where-Object { $_.LastWriteTime -gt (Get-Date).AddMinutes(-15) }\r
+ $picks = @()\r
+ $picks += $recent | Where-Object { $_.Name -like 'dd_installer_*' } | Sort-Object LastWriteTime | Select-Object -Last 1\r
+ $picks += $recent | Where-Object { $_.Name -like 'dd_bootstrapper_*' } | Sort-Object LastWriteTime | Select-Object -Last 1\r
+ $picks = $picks | Where-Object { $_ }\r
+ if (-not $picks) {\r
+ Write-Host ' (no VS Installer logs modified in the last 15 minutes)' -ForegroundColor Yellow\r
+ return\r
+ }\r
+ foreach ($l in $picks) {\r
+ Write-Host "`n----- $($l.Name) (tail) -----" -ForegroundColor Yellow\r
+ Get-Content $l.FullName -Tail 40\r
+ }\r
+}\r
+\r
+function Invoke-VsModify {\r
+ # Run one VS install/modify pass for a named group of components. Splitting\r
+ # the install into separate passes makes it obvious WHICH group fails: each\r
+ # call prints its label and exit code before Assert-ExitCode throws.\r
+ param(\r
+ [string] $Label,\r
+ [string[]] $Ids\r
+ )\r
+ Write-Step "VS2022: $Label"\r
+ $addStr = ($Ids | ForEach-Object { "--add $_" }) -join ' '\r
+ # --installPath must be quoted: it contains spaces ("C:\Program Files\...").\r
+ # Windows PowerShell 5.1's Start-Process does not quote array elements, so we\r
+ # hand-build a single string. Component IDs / flags have no spaces.\r
+ $common = '--includeRecommended --quiet --norestart --wait'\r
+ if ($script:InstallPath) {\r
+ $argString = "modify --installPath `"$script:InstallPath`" $addStr $common --force"\r
+ } else {\r
+ # No existing install yet -> this first pass performs the base install.\r
+ $argString = "$addStr $common"\r
+ }\r
+ Write-Host " > $script:VsBootstrapper $argString" -ForegroundColor DarkGray\r
+ $p = Start-Process -FilePath $script:VsBootstrapper -ArgumentList $argString -Wait -PassThru -NoNewWindow\r
+ Write-Host " exit code: $($p.ExitCode)"\r
+ Assert-ExitCode $p.ExitCode "VS2022 ($Label)"\r
+\r
+ # After the first (fresh) install, re-detect the install path so subsequent\r
+ # passes use `modify`.\r
+ if (-not $script:InstallPath -and (Test-Path $script:VsWhere)) {\r
+ $script:InstallPath = & $script:VsWhere -products '*' -property installationPath -format value |\r
+ Select-Object -First 1\r
+ }\r
+}\r
+\r
+# ---------------------------------------------------------------------------\r
+# This runs in a separate elevated window that closes the moment it exits, so\r
+# the non-elevated caller (setup-windows.bat) can't see what happened. Mirror\r
+# all output to a log next to the script and exit with a real code so the\r
+# caller can detect success/failure and show the log.\r
+# ---------------------------------------------------------------------------\r
+$LogFile = Join-Path $PSScriptRoot 'setup-windows-uac.log'\r
+$ExitCode = 0\r
+try { Start-Transcript -Path $LogFile -Force | Out-Null } catch {}\r
+\r
+try {\r
+\r
+# ---------------------------------------------------------------------------\r
+# Base tools via winget\r
+# ---------------------------------------------------------------------------\r
+# ---------------------------------------------------------------------------\r
+# SSH agent\r
+# ---------------------------------------------------------------------------\r
+Write-Step 'Enabling ssh-agent'\r
+Set-Service -Name ssh-agent -StartupType Automatic\r
+if ((Get-Service ssh-agent).Status -ne 'Running') { Start-Service ssh-agent }\r
+\r
+# ---------------------------------------------------------------------------\r
+# Visual Studio 2022 Community\r
+# ---------------------------------------------------------------------------\r
+$TempDir = Join-Path $env:TEMP 'dev_install'\r
+New-Item -ItemType Directory -Force -Path $TempDir | Out-Null\r
+\r
+# Component IDs split into independent groups so each can be installed in its\r
+# own pass. The base group is the known-good set; Clang and the Windows XP\r
+# toolset are layered on afterwards so a failure clearly identifies the culprit.\r
+# Component reference: https://learn.microsoft.com/visualstudio/install/workload-component-id-vs-community\r
+$BaseComponents = @(\r
+ # Core C++ desktop workload\r
+ 'Microsoft.VisualStudio.Workload.NativeDesktop'\r
+\r
+ # Spectre-mitigated MSVC runtime libs\r
+ 'Microsoft.VisualStudio.Component.VC.Runtimes.x86.x64.Spectre'\r
+ 'Microsoft.VisualStudio.Component.VC.Runtimes.ARM64.Spectre'\r
+\r
+ # Spectre-mitigated ATL (needed for many driver/COM projects)\r
+ 'Microsoft.VisualStudio.Component.VC.ATL.Spectre'\r
+\r
+ # Windows 11 SDK — build number must match the WDK below\r
+ 'Microsoft.VisualStudio.Component.Windows11SDK.26100'\r
+\r
+ # WDK Visual Studio extension (VSIX). The silent wdksetup.exe /quiet does NOT\r
+ # install this (it only prompts interactively), so it must be added here.\r
+ 'Component.Microsoft.Windows.DriverKit'\r
+)\r
+\r
+# Clang/LLVM toolset (ClangCL, used in CMakePresets.json). Two parts: the Clang\r
+# compiler itself, plus the MSBuild integration providing the "ClangCL" toolset.\r
+$ClangComponents = @(\r
+ 'Microsoft.VisualStudio.Component.VC.Llvm.Clang'\r
+ 'Microsoft.VisualStudio.Component.VC.Llvm.ClangToolset'\r
+)\r
+\r
+# Windows XP targeting (v141_xp toolset, used in CMakePresets.json). The v141\r
+# (VS2017) build tools provide the 14.16 compiler that the XP toolset wraps;\r
+# WinXP layers the XP-compatible CRT/SDK on top of it.\r
+$XpComponents = @(\r
+ 'Microsoft.VisualStudio.Component.VC.v141.x86.x64'\r
+ 'Microsoft.VisualStudio.Component.WinXP'\r
+)\r
+\r
+# Detect an existing VS install via vswhere (ships with the VS Installer).\r
+# These are referenced by Invoke-VsModify via $script: scope.\r
+$VsWhere = Join-Path ${env:ProgramFiles(x86)} 'Microsoft Visual Studio\Installer\vswhere.exe'\r
+$InstallPath = $null\r
+if (Test-Path $VsWhere) {\r
+ $InstallPath = & $VsWhere -products '*' -property installationPath -format value |\r
+ Select-Object -First 1\r
+}\r
+\r
+Write-Step 'Downloading VS2022 Community bootstrapper'\r
+$VsInstallerUrl = 'https://aka.ms/vs/17/release/vs_community.exe'\r
+$VsBootstrapper = Join-Path $TempDir 'vs_community.exe'\r
+Invoke-WebRequest -Uri $VsInstallerUrl -OutFile $VsBootstrapper -UseBasicParsing\r
+\r
+# Install in three sequential passes. The base set is installed first (this is\r
+# the configuration that previously worked); Clang and the XP toolset are added\r
+# afterwards. If one fails, its label pinpoints which group is responsible.\r
+Invoke-VsModify -Label 'base toolset + workload' -Ids $BaseComponents\r
+Invoke-VsModify -Label 'Clang / LLVM' -Ids $ClangComponents\r
+Invoke-VsModify -Label 'Windows XP (v141 + WinXP)' -Ids $XpComponents\r
+\r
+# ---------------------------------------------------------------------------\r
+# Verify the v141 / XP toolset actually landed. Earlier runs silently skipped\r
+# it and the failure only surfaced at build time, so check on disk and fail\r
+# loudly here instead.\r
+# ---------------------------------------------------------------------------\r
+Write-Step 'Verifying v141 / XP toolset'\r
+$InstallPath = & $VsWhere -products '*' -property installationPath -format value |\r
+ Select-Object -First 1\r
+$V141 = if ($InstallPath) {\r
+ Get-ChildItem (Join-Path $InstallPath 'VC\Tools\MSVC') -Directory -ErrorAction SilentlyContinue |\r
+ Where-Object { $_.Name -like '14.16.*' } | Select-Object -First 1\r
+}\r
+if ($V141) {\r
+ Write-Host " OK: v141 toolset present ($($V141.Name))" -ForegroundColor Green\r
+} else {\r
+ Write-Warning 'v141 (14.16.x) toolset NOT found - the XP build presets will fail.'\r
+ Write-Warning 'Add it via Visual Studio Installer > Modify > Individual components:'\r
+ Write-Warning ' - MSVC v141 - VS 2017 C++ x64/x86 build tools (v14.16)'\r
+ Write-Warning ' - C++ Windows XP Support for VS 2017 (v141) tools'\r
+}\r
+\r
+# ---------------------------------------------------------------------------\r
+# Windows Driver Kit (WDK 10.0.26100)\r
+# Build 26100 matches the Windows 11 SDK installed above.\r
+# Provides IddCx (iddcx.h / iddcx.lib) and UMDF 2.x for Indirect Display Drivers.\r
+# linkid=2335869 -> WDK 26100.6584 (per Microsoft "Other WDK Downloads").\r
+# ---------------------------------------------------------------------------\r
+$WdkVersion = '10.0.26100'\r
+$WdkInstalledRoot = (Get-ItemProperty 'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows Kits\Installed Roots' `\r
+ -ErrorAction SilentlyContinue).WdkBinRootVersioned\r
+\r
+if ($WdkInstalledRoot -and $WdkInstalledRoot -match [regex]::Escape($WdkVersion)) {\r
+ # Re-running wdksetup.exe for an already-present version returns exit code\r
+ # 2008 (maintenance mode / nothing to do), which is not a real failure.\r
+ Write-Step "WDK $WdkVersion already installed - skipping ($WdkInstalledRoot)"\r
+} else {\r
+ Write-Step 'Downloading WDK installer'\r
+ $WdkUrl = 'https://go.microsoft.com/fwlink/?linkid=2335869'\r
+ $WdkInstaller = Join-Path $TempDir 'wdksetup.exe'\r
+ Invoke-WebRequest -Uri $WdkUrl -OutFile $WdkInstaller -UseBasicParsing\r
+\r
+ Write-Step 'Installing WDK'\r
+ $proc = Start-Process -FilePath $WdkInstaller -ArgumentList '/quiet /norestart' -Wait -PassThru -NoNewWindow\r
+ Write-Host " WDK installer exit code: $($proc.ExitCode)"\r
+ if ($proc.ExitCode -eq 2008) {\r
+ # 2008 = the WDK is already present; the installer has nothing to do.\r
+ Write-Host ' [WDK already installed (exit 2008) - treating as success]' -ForegroundColor Yellow\r
+ } else {\r
+ Assert-ExitCode $proc.ExitCode 'WDK'\r
+ }\r
+}\r
+\r
+# ---------------------------------------------------------------------------\r
+# Windows Performance Toolkit (xperf / WPA / wpr) -- ETW CPU + loader profiling,\r
+# used by the perf/ measurement scripts. WPT is an OPTIONAL Windows SDK feature\r
+# that the VS "Windows 11 SDK" component does NOT select, so a fresh box lacks it.\r
+# The Windows ADK bundles WPT and winget owns the (versioned) download URL, so it\r
+# is the most reliable source. Idempotent (skips if xperf is already present in\r
+# either the SDK or ADK location) and non-fatal so it never aborts provisioning.\r
+# Lighter alternative if you don't want the full ADK: install the Windows SDK's\r
+# "Windows Performance Toolkit" optional feature via winsdksetup.exe /features\r
+# OptionId.WindowsPerformanceToolkit.\r
+# ---------------------------------------------------------------------------\r
+Write-Step 'Windows Performance Toolkit (xperf / WPA)'\r
+$wptRoots = @(\r
+ (Join-Path ${env:ProgramFiles(x86)} 'Windows Kits\10\Windows Performance Toolkit\xperf.exe'),\r
+ (Join-Path $env:ProgramFiles 'Windows Kits\10\Windows Performance Toolkit\xperf.exe'),\r
+ (Join-Path ${env:ProgramFiles(x86)} 'Windows Kits\10\Assessment and Deployment Kit\Windows Performance Toolkit\xperf.exe')\r
+)\r
+$xperf = $wptRoots | Where-Object { Test-Path $_ } | Select-Object -First 1\r
+if ($xperf) {\r
+ Write-Host " OK: WPT already present ($xperf)" -ForegroundColor Green\r
+} else {\r
+ try {\r
+ winget install --id Microsoft.WindowsADK --exact --silent --disable-interactivity `\r
+ --accept-source-agreements --accept-package-agreements\r
+ Write-Host ' Windows ADK (includes Windows Performance Toolkit) installed.'\r
+ } catch {\r
+ Write-Warning "WPT install failed: $($_.Exception.Message)"\r
+ Write-Warning 'Install manually: winget install Microsoft.WindowsADK, or add the'\r
+ Write-Warning 'Windows SDK "Windows Performance Toolkit" optional feature.'\r
+ }\r
+}\r
+\r
+# ---------------------------------------------------------------------------\r
+Write-Host "`nAll done." -ForegroundColor Green\r
+Write-Host 'If a reboot was flagged above, restart before opening VS or building drivers.'\r
+\r
+}\r
+catch {\r
+ $ExitCode = 1\r
+ Write-Host "`n==> SETUP FAILED: $($_.Exception.Message)" -ForegroundColor Red\r
+ if ($_.ScriptStackTrace) { Write-Host $_.ScriptStackTrace -ForegroundColor DarkGray }\r
+ # Only fold in the VS Installer logs when a VS step actually failed; for other\r
+ # steps (e.g. WDK) those logs are stale and misleading, so the message above\r
+ # is what matters.\r
+ if ($_.Exception.Message -match 'VS2022') {\r
+ try { Show-VsSetupLogs } catch {}\r
+ }\r
+}\r
+finally {\r
+ try { Stop-Transcript | Out-Null } catch {}\r
+\r
+ # This log was created by the elevated (admin) process, so by default the\r
+ # non-elevated caller can't delete it (their token has Administrators marked\r
+ # deny-only). Grant BUILTIN\Users Modify rights so the user account that runs\r
+ # setup-windows.bat can remove the log later. S-1-5-32-545 is the well-known\r
+ # Users SID, used here so this is locale-independent.\r
+ try {\r
+ if (Test-Path $LogFile) {\r
+ $usersSid = New-Object System.Security.Principal.SecurityIdentifier('S-1-5-32-545')\r
+ $acl = Get-Acl -Path $LogFile\r
+ $rule = New-Object System.Security.AccessControl.FileSystemAccessRule(\r
+ $usersSid, 'Modify', 'Allow')\r
+ $acl.AddAccessRule($rule)\r
+ Set-Acl -Path $LogFile -AclObject $acl\r
+ }\r
+ } catch {\r
+ Write-Host " [warning] could not relax ACL on $LogFile : $($_.Exception.Message)" -ForegroundColor Yellow\r
+ }\r
+}\r
+\r
+exit $ExitCode\r
vilimpoc.org / repos / dotfiles / commitdiff