/*++
Copyright (c) 1997 Microsoft Corporation
Module Name:
logsup.c
Abstract:
WMI logger api set. The routines here will need to appear like they
are system calls. They are necessary to do the necessary error checking
and do most of the legwork that can be done outside the kernel. The
kernel portion will subsequently only deal with the actual logging
and tracing.
Author:
28-May-1997 JeePang
Revision History:
--*/
#ifndef MEMPHIS
#include <nt.h>
#include <ntrtl.h> // for ntutrl.h
#include <nturtl.h> // for RTL_CRITICAL_SECTION in winbase.h/wtypes.h
#include <wtypes.h> // for LPGUID in wmium.h
#include "wmiump.h"
#include "evntrace.h"
#include "traceump.h"
#include "tracelib.h"
#include <math.h>
#include "trcapi.h"
NTSTATUS
WmipProcessRunDown(
IN PWMI_LOGGER_CONTEXT Logger,
IN ULONG StartFlag,
IN ULONG fEnableFlags
);
NTSTATUS
WmipThreadRunDown(
IN PWMI_LOGGER_CONTEXT Logger,
IN PSYSTEM_PROCESS_INFORMATION pProcessInfo,
IN ULONG StartFlag,
IN BOOLEAN bExtended
);
ULONG WmiTraceAlignment = DEFAULT_TRACE_ALIGNMENT;
/*
ULONG
WmipStartLogger(
IN OUT PWMI_LOGGER_INFORMATION LoggerInfo
)
/*++
Routine Description:
This is the actual routine to communicate with the kernel to start
the logger. All the required parameters must be in LoggerInfo.
Arguments:
LoggerInfo The actual parameters to be passed to and return from
kernel.
Return Value:
The status of performing the action requested.
--*//*
{
ULONG Status;
ULONG BufferSize;
ACCESS_MASK DesiredAccess = 0;
LPGUID Guid;
PVOID SavedChecksum;
ULONG SavedLogFileMode;
BOOLEAN IsKernelTrace = FALSE;
BOOLEAN bLogFile = FALSE;
BOOLEAN bRealTime = FALSE;
Guid = &LoggerInfo->Wnode.Guid;
if (IsEqualGUID(Guid, &SystemTraceControlGuid) ||
IsEqualGUID(Guid, &WmiEventLoggerGuid)) {
IsKernelTrace = TRUE;
DesiredAccess |= TRACELOG_ACCESS_KERNEL_LOGGER;
}
if ((LoggerInfo->LogFileName.Length > 0) &&
(LoggerInfo->LogFileName.Buffer != NULL)) {
DesiredAccess |= TRACELOG_CREATE_ONDISK;
bLogFile = TRUE;
}
SavedLogFileMode = LoggerInfo->LogFileMode;
if (SavedLogFileMode & EVENT_TRACE_REAL_TIME_MODE) {
DesiredAccess |= TRACELOG_CREATE_REALTIME;
bRealTime = TRUE;
}
Status = WmipCheckGuidAccess( Guid, DesiredAccess );
if (Status != ERROR_SUCCESS) {
return Status;
}
//
// Set the Default Clock Type
//
if (LoggerInfo->Wnode.ClientContext != EVENT_TRACE_CLOCK_SYSTEMTIME) {
LoggerInfo->Wnode.ClientContext = EVENT_TRACE_CLOCK_PERFCOUNTER;
}
if (SavedLogFileMode & EVENT_TRACE_PRIVATE_LOGGER_MODE) {
Status = WmipSendUmLogRequest(
WmiStartLoggerCode,
LoggerInfo
);
}
else if (IsKernelTrace) {
//
// In order to capture the process/thread rundown accurately, we need to
// start kernel logger in two steps. Start logger with delay write,
// do rundown from user mode and then updatelogger with filename.
//
WMI_LOGGER_INFORMATION DelayLoggerInfo;
ULONG EnableFlags = LoggerInfo->EnableFlags;
LARGE_INTEGER Frequency;
WMI_REF_CLOCK RefClock;
//
// If it's only realtime start logger in one step
//
if (bRealTime && !bLogFile) {
BufferSize = LoggerInfo->BufferSize * 1024;
Status = WmipSendWmiKMRequest(
NULL,
IOCTL_WMI_START_LOGGER,
LoggerInfo,
LoggerInfo->Wnode.BufferSize,
LoggerInfo,
LoggerInfo->Wnode.BufferSize,
&BufferSize,
NULL
);
return WmipSetDosError(Status);
}
if (EnableFlags & EVENT_TRACE_FLAG_EXTENSION) {
PTRACE_ENABLE_FLAG_EXTENSION tFlagExt;
tFlagExt = (PTRACE_ENABLE_FLAG_EXTENSION)
&LoggerInfo->EnableFlags;
EnableFlags = *(PULONG)((PCHAR)LoggerInfo + tFlagExt->Offset);
}
//
// Take a reference timestamp before actually starting the logger
//
RefClock.StartTime.QuadPart = WmipGetSystemTime();
if (LoggerInfo->Wnode.ClientContext == EVENT_TRACE_CLOCK_PERFCOUNTER) {
Status = NtQueryPerformanceCounter(&RefClock.StartPerfClock, &Frequency);
}
else {
RefClock.StartPerfClock = RefClock.StartTime;
}
RtlCopyMemory(&DelayLoggerInfo, LoggerInfo, sizeof(WMI_LOGGER_INFORMATION));
RtlZeroMemory(&DelayLoggerInfo.LogFileName, sizeof(UNICODE_STRING) );
DelayLoggerInfo.Wnode.BufferSize = sizeof(WMI_LOGGER_INFORMATION);
DelayLoggerInfo.LogFileMode |= EVENT_TRACE_DELAY_OPEN_FILE_MODE;
//
// Since there's no filename in step 1 of StartLogger we need to mask
// the NEWFILE mode to prevent kernel trying to generate a file
//
DelayLoggerInfo.LogFileMode &= ~EVENT_TRACE_FILE_MODE_NEWFILE;
DelayLoggerInfo.EnableFlags = (EVENT_TRACE_FLAG_PROCESS & EnableFlags);
DelayLoggerInfo.EnableFlags |= (EVENT_TRACE_FLAG_THREAD & EnableFlags);
DelayLoggerInfo.EnableFlags |= (EVENT_TRACE_FLAG_IMAGE_LOAD & EnableFlags);
BufferSize = DelayLoggerInfo.BufferSize * 1024;
Status = WmipSendWmiKMRequest(
NULL,
IOCTL_WMI_START_LOGGER,
&DelayLoggerInfo,
DelayLoggerInfo.Wnode.BufferSize,
&DelayLoggerInfo,
DelayLoggerInfo.Wnode.BufferSize,
&BufferSize,
NULL
);
if (Status != ERROR_SUCCESS) {
return Status;
}
//
// We need to pick up any parameter adjustment done by the kernel
// here so UpdateTrace does not fail.
//
LoggerInfo->Wnode.HistoricalContext = DelayLoggerInfo.Wnode.HistoricalContext;
LoggerInfo->MinimumBuffers = DelayLoggerInfo.MinimumBuffers;
LoggerInfo->MaximumBuffers = DelayLoggerInfo.MaximumBuffers;
LoggerInfo->NumberOfBuffers = DelayLoggerInfo.NumberOfBuffers;
LoggerInfo->BufferSize = DelayLoggerInfo.BufferSize;
LoggerInfo->AgeLimit = DelayLoggerInfo.AgeLimit;
BufferSize = LoggerInfo->BufferSize * 1024;
//
// Add the LogHeader
//
LoggerInfo->Checksum = NULL;
Status = WmipAddLogHeaderToLogFile(LoggerInfo, &RefClock, FALSE);
if (Status == ERROR_SUCCESS) {
SavedChecksum = LoggerInfo->Checksum;
//
// Update the logger with the filename
//
Status = WmipSendWmiKMRequest(
NULL,
IOCTL_WMI_UPDATE_LOGGER,
LoggerInfo,
LoggerInfo->Wnode.BufferSize,
LoggerInfo,
LoggerInfo->Wnode.BufferSize,
&BufferSize,
NULL
);
if (LoggerInfo->Checksum != NULL) {
WmipFree(LoggerInfo->Checksum);
}
}
if (Status != ERROR_SUCCESS) {
ULONG lStatus;
//
// Logger must be stopped now
//
lStatus = WmipSendWmiKMRequest(
NULL,
IOCTL_WMI_STOP_LOGGER,
LoggerInfo,
LoggerInfo->Wnode.BufferSize,
LoggerInfo,
LoggerInfo->Wnode.BufferSize,
&BufferSize,
NULL
);
LoggerInfo->LogFileMode = SavedLogFileMode;
return WmipSetDosError(Status);
}
else {
if (LoggerInfo->LogFileHandle != NULL) {
NtClose(LoggerInfo->LogFileHandle);
LoggerInfo->LogFileHandle = NULL;
}
}
}
else {
LoggerInfo->Checksum = NULL;
Status = WmipAddLogHeaderToLogFile(LoggerInfo, NULL, FALSE);
if (Status != ERROR_SUCCESS) {
return WmipSetDosError(Status);
}
BufferSize = LoggerInfo->BufferSize * 1024;
SavedChecksum = LoggerInfo->Checksum;
Status = WmipSendWmiKMRequest( // actually start the logger here
NULL,
IOCTL_WMI_START_LOGGER,
LoggerInfo,
LoggerInfo->Wnode.BufferSize,
LoggerInfo,
LoggerInfo->Wnode.BufferSize,
&BufferSize,
NULL
);
if (Status == ERROR_SUCCESS) {
if (LoggerInfo->LogFileHandle != NULL) {
NtClose(LoggerInfo->LogFileHandle);
LoggerInfo->LogFileHandle = NULL;
}
}
if (SavedChecksum != NULL) {
WmipFree(SavedChecksum);
}
}
//
// Restore the LogFileMode
//
LoggerInfo->LogFileMode = SavedLogFileMode;
return WmipSetDosError(Status);
}*/
ULONG
WmipFinalizeLogFileHeader(
IN PWMI_LOGGER_INFORMATION LoggerInfo
)
{
ULONG Status = ERROR_SUCCESS;
ULONG ErrorCode = ERROR_SUCCESS;
HANDLE LogFile = INVALID_HANDLE_VALUE;
LARGE_INTEGER CurrentTime;
ULONG BuffersWritten;
WMI_LOGGER_CONTEXT Logger;
IO_STATUS_BLOCK IoStatus;
FILE_POSITION_INFORMATION FileInfo;
FILE_STANDARD_INFORMATION FileSize;
PWMI_BUFFER_HEADER Buffer; // need to initialize buffer first
SYSTEM_BASIC_INFORMATION SystemInfo;
ULONG EnableFlags;
RtlZeroMemory(&Logger, sizeof(WMI_LOGGER_CONTEXT));
Logger.BufferSpace = NULL;
if (LoggerInfo->LogFileName.Length > 0 ) {
// open the file for writing synchronously for the logger
// others may want to read it as well.
//
LogFile = WmipCreateFileW(
(LPWSTR)LoggerInfo->LogFileName.Buffer,
GENERIC_READ | GENERIC_WRITE,
FILE_SHARE_READ,
NULL,
OPEN_EXISTING,
FILE_ATTRIBUTE_NORMAL,
NULL
);
if (LogFile == INVALID_HANDLE_VALUE) {
ErrorCode = WmipSetDosError(WmipGetLastError());
goto cleanup;
}
Logger.BuffersWritten = LoggerInfo->BuffersWritten;
Logger.BufferSpace = WmipAlloc(LoggerInfo->BufferSize * 1024);
if (Logger.BufferSpace == NULL) {
ErrorCode = WmipSetDosError(ERROR_NOT_ENOUGH_MEMORY);
goto cleanup;
}
Buffer = (PWMI_BUFFER_HEADER) Logger.BufferSpace;
RtlZeroMemory(Buffer, LoggerInfo->BufferSize * 1024);
Buffer->Wnode.BufferSize = LoggerInfo->BufferSize * 1024;
Buffer->ClientContext.Alignment = (UCHAR)WmiTraceAlignment;
Buffer->EventsLost = 0;
Buffer->Offset = sizeof(WMI_BUFFER_HEADER);
Buffer->Wnode.Guid = LoggerInfo->Wnode.Guid;
Status = NtQuerySystemInformation(
SystemBasicInformation,
&SystemInfo, sizeof (SystemInfo), NULL);
if (!NT_SUCCESS(Status)) {
ErrorCode = WmipSetNtStatus(Status);
goto cleanup;
}
Logger.TimerResolution = SystemInfo.TimerResolution;
Logger.LogFileHandle = LogFile;
Logger.BufferSize = LoggerInfo->BufferSize * 1024;
// For Circular LogFile the process rundown data is appended at the
// last buffer written and not to the end of file.
//
Status = NtQueryInformationFile(
LogFile,
&IoStatus,
&FileSize,
sizeof(FILE_STANDARD_INFORMATION),
FileStandardInformation
);
if (!NT_SUCCESS(Status)) {
ErrorCode = WmipSetNtStatus(Status);
goto cleanup;
}
if (IsEqualGUID(&LoggerInfo->Wnode.Guid, &SystemTraceControlGuid)) {
if (LoggerInfo->LogFileMode != EVENT_TRACE_FILE_MODE_CIRCULAR) {
FileInfo.CurrentByteOffset = FileSize.EndOfFile;
}
else {
ULONG BufferSize = LoggerInfo->BufferSize; // in KB
ULONG BuffersWritten = LoggerInfo->BuffersWritten;
ULONG maxBuffers = (LoggerInfo->MaximumFileSize * 1024) / BufferSize;
ULONG LastBuffer;
ULONG StartBuffers;
FileInfo.CurrentByteOffset.QuadPart =
LOGFILE_FIELD_OFFSET(StartBuffers);
Status = NtSetInformationFile(
LogFile,
&IoStatus,
&FileInfo,
sizeof(FILE_POSITION_INFORMATION),
FilePositionInformation
);
if (!NT_SUCCESS(Status)) {
ErrorCode = WmipSetNtStatus(Status);
goto cleanup;
}
Status = NtReadFile(
LogFile,
NULL,
NULL,
NULL,
&IoStatus,
&StartBuffers,
sizeof(ULONG),
NULL,
NULL
);
if (!NT_SUCCESS(Status)) {
ErrorCode = WmipSetNtStatus(Status);
goto cleanup;
}
LastBuffer = (maxBuffers > StartBuffers) ?
(StartBuffers + (BuffersWritten - StartBuffers)
% (maxBuffers - StartBuffers))
: 0;
FileInfo.CurrentByteOffset.QuadPart = LastBuffer *
BufferSize * 1024;
}
Status = NtSetInformationFile(
LogFile,
&IoStatus,
&FileInfo,
sizeof(FILE_POSITION_INFORMATION),
FilePositionInformation
);
if (!NT_SUCCESS(Status)) {
ErrorCode = WmipSetNtStatus(Status);
goto cleanup;
}
EnableFlags = LoggerInfo->EnableFlags;
if (EnableFlags & EVENT_TRACE_FLAG_EXTENSION) {
PTRACE_ENABLE_FLAG_EXTENSION tFlagExt;
tFlagExt = (PTRACE_ENABLE_FLAG_EXTENSION)
&LoggerInfo->EnableFlags;
if (LoggerInfo->Wnode.BufferSize >= (tFlagExt->Offset + sizeof(ULONG)) ) {
EnableFlags = *(PULONG)((PCHAR)LoggerInfo + tFlagExt->Offset);
}
else {
EnableFlags = 0; // Should not happen.
}
}
if (LoggerInfo->Wnode.ClientContext != EVENT_TRACE_CLOCK_SYSTEMTIME) {
LoggerInfo->Wnode.ClientContext = EVENT_TRACE_CLOCK_PERFCOUNTER;
}
Logger.UsePerfClock = LoggerInfo->Wnode.ClientContext;
WmipProcessRunDown(&Logger, FALSE, EnableFlags);
{
PWMI_BUFFER_HEADER Buffer1 =
(PWMI_BUFFER_HEADER) Logger.BufferSpace;
if (Buffer1->Offset < Logger.BufferSize) {
RtlFillMemory(
(char *) Logger.BufferSpace + Buffer1->Offset,
Logger.BufferSize - Buffer1->Offset,
0xFF);
}
}
Status = NtWriteFile(
LogFile,
NULL,
NULL,
NULL,
&IoStatus,
Logger.BufferSpace,
Logger.BufferSize,
NULL,
NULL);
if (NT_SUCCESS(Status)) {
NtFlushBuffersFile(Logger.LogFileHandle, &IoStatus);
Logger.BuffersWritten++;
}
}
else { // For Application Traces, need to dump the guidmaps again.
// Set the FilePointer to end of file so that Rundown data may be appended.
//
FileInfo.CurrentByteOffset = FileSize.EndOfFile;
Status = NtSetInformationFile(
LogFile,
&IoStatus,
&FileInfo,
sizeof(FILE_POSITION_INFORMATION),
FilePositionInformation
);
if (!NT_SUCCESS(Status)) {
ErrorCode = WmipSetNtStatus(Status);
goto cleanup;
}
// Dump the Guid Maps once more at the End.
//
Buffer->EventsLost = 0;
Buffer->Offset = sizeof(WMI_BUFFER_HEADER);
BuffersWritten = Logger.BuffersWritten;
if (WmipDumpGuidMaps(&Logger, NULL, FALSE) > 0) {
if (Buffer->Offset < Logger.BufferSize) {
RtlFillMemory(
(char *) Logger.BufferSpace + Buffer->Offset,
Logger.BufferSize - Buffer->Offset,
0xFF);
}
Status = NtWriteFile(
LogFile,
NULL,
NULL,
NULL,
&IoStatus,
Logger.BufferSpace,
Logger.BufferSize,
NULL,
NULL);
if (NT_SUCCESS(Status)) {
NtFlushBuffersFile(Logger.LogFileHandle, &IoStatus);
Logger.BuffersWritten = BuffersWritten;
}
}
}
// TODO: should use memory-mapped file
// Update the EndTime stamp field in LogFile.
//
FileInfo.CurrentByteOffset.QuadPart =
LOGFILE_FIELD_OFFSET(EndTime);
Status = NtSetInformationFile(
LogFile,
&IoStatus,
&FileInfo,
sizeof(FILE_POSITION_INFORMATION),
FilePositionInformation
);
if (!NT_SUCCESS(Status)) {
ErrorCode = WmipSetNtStatus(Status);
goto cleanup;
}
// End Time is always wallclock time.
//
CurrentTime.QuadPart = WmipGetSystemTime();
Status = NtWriteFile(
LogFile,
NULL,
NULL,
NULL,
&IoStatus,
&CurrentTime,
sizeof(ULONGLONG),
NULL,
NULL
);
if (NT_SUCCESS(Status)) {
NtFlushBuffersFile(Logger.LogFileHandle, &IoStatus);
}
// Update the Number of Buffers Written field in the header
//
FileInfo.CurrentByteOffset.QuadPart =
LOGFILE_FIELD_OFFSET(BuffersWritten);
Status = NtSetInformationFile(
LogFile,
&IoStatus,
&FileInfo,
sizeof(FILE_POSITION_INFORMATION),
FilePositionInformation
);
if (!NT_SUCCESS(Status)) {
ErrorCode = WmipSetNtStatus(Status);
goto cleanup;
}
Status = NtWriteFile(
LogFile,
NULL,
NULL,
NULL,
&IoStatus,
&Logger.BuffersWritten,
sizeof(ULONG),
NULL,
NULL
);
if (NT_SUCCESS(Status)) {
NtFlushBuffersFile(Logger.LogFileHandle, &IoStatus);
}
ErrorCode = RtlNtStatusToDosError(Status);
LoggerInfo->BuffersWritten = Logger.BuffersWritten;
//
// Write the BuffersLost information into the logfile
//
FileInfo.CurrentByteOffset.QuadPart =
LOGFILE_FIELD_OFFSET(BuffersLost);
Status = NtSetInformationFile(
LogFile,
&IoStatus,
&FileInfo,
sizeof(FILE_POSITION_INFORMATION),
FilePositionInformation
);
if (!NT_SUCCESS(Status)) {
ErrorCode = WmipSetNtStatus(Status);
goto cleanup;
}
Status = NtWriteFile(
LogFile,
NULL,
NULL,
NULL,
&IoStatus,
&LoggerInfo->LogBuffersLost,
sizeof(ULONG),
NULL,
NULL
);
if (NT_SUCCESS(Status)) {
NtFlushBuffersFile(Logger.LogFileHandle, &IoStatus);
}
//
// Write the EventsLost information into the logfile
//
FileInfo.CurrentByteOffset.QuadPart =
LOGFILE_FIELD_OFFSET(EventsLost);
Status = NtSetInformationFile(
LogFile,
&IoStatus,
&FileInfo,
sizeof(FILE_POSITION_INFORMATION),
FilePositionInformation
);
if (!NT_SUCCESS(Status)) {
ErrorCode = WmipSetNtStatus(Status);
goto cleanup;
}
Status = NtWriteFile(
LogFile,
NULL,
NULL,
NULL,
&IoStatus,
&LoggerInfo->EventsLost,
sizeof(ULONG),
NULL,
NULL
);
if (NT_SUCCESS(Status)) {
NtFlushBuffersFile(Logger.LogFileHandle, &IoStatus);
}
}
cleanup:
if (LogFile != INVALID_HANDLE_VALUE) {
NtClose(LogFile);
}
if (Logger.BufferSpace != NULL) {
WmipFree(Logger.BufferSpace);
}
return WmipSetDosError(ErrorCode);
}
ULONG
WmipStopLogger(
IN OUT PWMI_LOGGER_INFORMATION LoggerInfo
)
/*++
Routine Description:
This is the actual routine to communicate with the kernel to stop
the logger. All the properties of the logger will be returned in LoggerInfo.
Arguments:
LoggerInfo The actual parameters to be passed to and return from
kernel.
Return Value:
The status of performing the action requested.
--*/
{
ULONG ErrorCode, ReturnSize;
PTRACE_ENABLE_CONTEXT pContext;
if (LoggerInfo == NULL)
return WmipSetDosError(ERROR_INVALID_PARAMETER);
if (LoggerInfo->Wnode.BufferSize < sizeof(WMI_LOGGER_INFORMATION))
return WmipSetDosError(ERROR_INVALID_PARAMETER);
if ( !(LoggerInfo->Wnode.Flags & WNODE_FLAG_TRACED_GUID) )
return WmipSetDosError(ERROR_INVALID_PARAMETER);
pContext = (PTRACE_ENABLE_CONTEXT) & LoggerInfo->Wnode.HistoricalContext;
if ( (pContext->InternalFlag != 0)
&& (pContext->InternalFlag != EVENT_TRACE_INTERNAL_FLAG_PRIVATE)) {
// Currently only one possible InternalFlag value. This will filter
// out some bogus LoggerHandle
//
return WmipSetDosError(ERROR_INVALID_HANDLE);
}
if (LoggerInfo->LogFileMode & EVENT_TRACE_PRIVATE_LOGGER_MODE) {
ErrorCode = WmipSendUmLogRequest(WmiStopLoggerCode, LoggerInfo);
pContext->InternalFlag |= EVENT_TRACE_INTERNAL_FLAG_PRIVATE;
pContext->LoggerId = 1;
}
else {
ErrorCode = WmipSendWmiKMRequest(
NULL,
IOCTL_WMI_STOP_LOGGER,
LoggerInfo,
LoggerInfo->Wnode.BufferSize,
LoggerInfo,
LoggerInfo->Wnode.BufferSize,
&ReturnSize,
NULL
);
//
// if logging to a file, then update the EndTime, BuffersWritten and do
// process rundown for kernel trace.
//
if (ErrorCode == ERROR_SUCCESS) {
ErrorCode = WmipFinalizeLogFileHeader(LoggerInfo);
}
}
return WmipSetDosError(ErrorCode);
}
ULONG
WmipQueryLogger(
IN OUT PWMI_LOGGER_INFORMATION LoggerInfo,
IN ULONG Update
)
/*++
Routine Description:
This is the actual routine to communicate with the kernel to query
the logger. All the properties of the logger will be returned in LoggerInfo.
Arguments:
LoggerInfo The actual parameters to be passed to and return from
kernel.
Return Value:
The status of performing the action requested.
--*/
{
ULONG Status, ReturnSize;
HANDLE LogFileHandle = NULL;
PTRACE_ENABLE_CONTEXT pContext;
BOOLEAN bAddAppendFlag = FALSE;
ULONG SavedLogFileMode;
if (LoggerInfo == NULL)
return WmipSetDosError(ERROR_INVALID_PARAMETER);
if (LoggerInfo->Wnode.BufferSize < sizeof(WMI_LOGGER_INFORMATION))
return WmipSetDosError(ERROR_INVALID_PARAMETER);
if ( !(LoggerInfo->Wnode.Flags & WNODE_FLAG_TRACED_GUID) )
return WmipSetDosError(ERROR_INVALID_PARAMETER);
LoggerInfo->Checksum = NULL;
LoggerInfo->LogFileHandle = NULL;
pContext = (PTRACE_ENABLE_CONTEXT) &LoggerInfo->Wnode.HistoricalContext;
if ( (pContext->InternalFlag != 0)
&& (pContext->InternalFlag != EVENT_TRACE_INTERNAL_FLAG_PRIVATE)) {
// Currently only one possible InternalFlag value. This will filter
// out some bogus LoggerHandle
//
return WmipSetDosError(ERROR_INVALID_HANDLE);
}
//
// If UPDATE and a new logfile is given throw in the LogFileHeader
//
if ( Update
&& LoggerInfo->LogFileName.Length > 0
&& !( (LoggerInfo->LogFileMode & EVENT_TRACE_PRIVATE_LOGGER_MODE)
|| (pContext->InternalFlag & EVENT_TRACE_INTERNAL_FLAG_PRIVATE))) {
Status = WmipAddLogHeaderToLogFile(LoggerInfo, NULL, Update);
if (Status != ERROR_SUCCESS) {
return WmipSetDosError(Status);
}
LogFileHandle = LoggerInfo->LogFileHandle;
bAddAppendFlag = TRUE;
//
// If we are switching to a new file, make sure it is append mode
//
SavedLogFileMode = LoggerInfo->LogFileMode;
}
if (LoggerInfo->LogFileMode & EVENT_TRACE_PRIVATE_LOGGER_MODE ||
pContext->InternalFlag & EVENT_TRACE_INTERNAL_FLAG_PRIVATE) {
pContext->InternalFlag |= EVENT_TRACE_INTERNAL_FLAG_PRIVATE;
pContext->LoggerId = 1;
Status = WmipSendUmLogRequest(
(Update) ? (WmiUpdateLoggerCode) : (WmiQueryLoggerCode),
LoggerInfo
);
}
else {
Status = WmipSendWmiKMRequest(
NULL,
(Update ? IOCTL_WMI_UPDATE_LOGGER : IOCTL_WMI_QUERY_LOGGER),
LoggerInfo,
LoggerInfo->Wnode.BufferSize,
LoggerInfo,
LoggerInfo->Wnode.BufferSize,
&ReturnSize,
NULL
);
if (LoggerInfo->Checksum != NULL) {
WmipFree(LoggerInfo->Checksum);
}
}
if (bAddAppendFlag) {
LoggerInfo->LogFileMode = SavedLogFileMode;
}
return WmipSetDosError(Status);
}
PVOID
WmipGetTraceBuffer(
IN PWMI_LOGGER_CONTEXT Logger,
IN PSYSTEM_THREAD_INFORMATION pThread,
IN ULONG GroupType,
IN ULONG RequiredSize
)
{
PSYSTEM_TRACE_HEADER Header;
PWMI_BUFFER_HEADER Buffer;
THREAD_BASIC_INFORMATION ThreadInfo;
KERNEL_USER_TIMES ThreadCpu;
NTSTATUS Status;
ULONG BytesUsed;
PCLIENT_ID Cid;
RequiredSize += sizeof (SYSTEM_TRACE_HEADER); // add in header
RequiredSize = (ULONG) ALIGN_TO_POWER2(RequiredSize, WmiTraceAlignment);
Buffer = (PWMI_BUFFER_HEADER) Logger->BufferSpace;
if (RequiredSize > Logger->BufferSize - sizeof(WMI_BUFFER_HEADER)) {
WmipSetDosError(ERROR_BUFFER_OVERFLOW);
return NULL;
}
if (RequiredSize > (Logger->BufferSize - Buffer->Offset)) {
ULONG Status;
IO_STATUS_BLOCK IoStatus;
if (Buffer->Offset < Logger->BufferSize) {
RtlFillMemory(
(char *) Buffer + Buffer->Offset,
Logger->BufferSize - Buffer->Offset,
0xFF);
}
Status = NtWriteFile(
Logger->LogFileHandle,
NULL,
NULL,
NULL,
&IoStatus,
Buffer,
Logger->BufferSize,
NULL,
NULL);
Buffer->EventsLost = 0;
Buffer->Offset = sizeof(WMI_BUFFER_HEADER);
if (!NT_SUCCESS(Status)) {
return NULL;
}
Logger->BuffersWritten++;
}
Header = (PSYSTEM_TRACE_HEADER) ((char*)Buffer + Buffer->Offset);
if (Logger->UsePerfClock == EVENT_TRACE_CLOCK_PERFCOUNTER) {
LARGE_INTEGER Frequency;
ULONGLONG Counter = 0;
Status = NtQueryPerformanceCounter((PLARGE_INTEGER)&Counter,
&Frequency);
Header->SystemTime.QuadPart = Counter;
}
else {
Header->SystemTime.QuadPart = WmipGetSystemTime();
}
Header->Header = (GroupType << 16) + RequiredSize;
Header->Marker = SYSTEM_TRACE_MARKER;
if (pThread == NULL) {
Status = NtQueryInformationThread(
NtCurrentThread(),
ThreadBasicInformation,
&ThreadInfo,
sizeof ThreadInfo, NULL);
if (NT_SUCCESS(Status)) {
Cid = &ThreadInfo.ClientId;
Header->ThreadId = HandleToUlong(Cid->UniqueThread);
Header->ProcessId = HandleToUlong(Cid->UniqueProcess);
}
Status = NtQueryInformationThread(
NtCurrentThread(),
ThreadTimes,
&ThreadCpu, sizeof ThreadCpu, NULL);
if (NT_SUCCESS(Status)) {
Header->KernelTime = (ULONG) (ThreadCpu.KernelTime.QuadPart
/ Logger->TimerResolution);
Header->UserTime = (ULONG) (ThreadCpu.UserTime.QuadPart
/ Logger->TimerResolution);
}
}
else {
Cid = &pThread->ClientId;
Header->ThreadId = HandleToUlong(Cid->UniqueThread);
Header->ProcessId = HandleToUlong(Cid->UniqueProcess);
Header->KernelTime = (ULONG) (pThread->KernelTime.QuadPart
/ Logger->TimerResolution);
Header->UserTime = (ULONG) (pThread->UserTime.QuadPart
/ Logger->TimerResolution);
}
Buffer->Offset += RequiredSize;
// If there is room, throw in a end of buffer marker.
BytesUsed = Buffer->Offset;
if ( BytesUsed <= (Logger->BufferSize-sizeof(ULONG)) ) {
*((long*)((char*)Buffer+Buffer->Offset)) = -1;
}
return (PVOID) ( (char*) Header + sizeof(SYSTEM_TRACE_HEADER) );
}
VOID
WmipCopyPropertiesToInfo(
IN PEVENT_TRACE_PROPERTIES Properties,
IN PWMI_LOGGER_INFORMATION Info
)
{
ULONG SavedBufferSize = Info->Wnode.BufferSize;
RtlCopyMemory(&Info->Wnode, &Properties->Wnode, sizeof(WNODE_HEADER));
Info->Wnode.BufferSize = SavedBufferSize;
Info->BufferSize = Properties->BufferSize;
Info->MinimumBuffers = Properties->MinimumBuffers;
Info->MaximumBuffers = Properties->MaximumBuffers;
Info->NumberOfBuffers = Properties->NumberOfBuffers;
Info->FreeBuffers = Properties->FreeBuffers;
Info->EventsLost = Properties->EventsLost;
Info->BuffersWritten = Properties->BuffersWritten;
Info->LoggerThreadId = Properties->LoggerThreadId;
Info->MaximumFileSize = Properties->MaximumFileSize;
Info->EnableFlags = Properties->EnableFlags;
Info->LogFileMode = Properties->LogFileMode;
Info->FlushTimer = Properties->FlushTimer;
Info->LogBuffersLost = Properties->LogBuffersLost;
Info->AgeLimit = Properties->AgeLimit;
Info->RealTimeBuffersLost = Properties->RealTimeBuffersLost;
}
VOID
WmipCopyInfoToProperties(
IN PWMI_LOGGER_INFORMATION Info,
IN PEVENT_TRACE_PROPERTIES Properties
)
{
ULONG SavedSize = Properties->Wnode.BufferSize;
RtlCopyMemory(&Properties->Wnode, &Info->Wnode, sizeof(WNODE_HEADER));
Properties->Wnode.BufferSize = SavedSize;
Properties->BufferSize = Info->BufferSize;
Properties->MinimumBuffers = Info->MinimumBuffers;
Properties->MaximumBuffers = Info->MaximumBuffers;
Properties->NumberOfBuffers = Info->NumberOfBuffers;
Properties->FreeBuffers = Info->FreeBuffers;
Properties->EventsLost = Info->EventsLost;
Properties->BuffersWritten = Info->BuffersWritten;
Properties->LoggerThreadId = Info->LoggerThreadId;
Properties->MaximumFileSize = Info->MaximumFileSize;
Properties->EnableFlags = Info->EnableFlags;
Properties->LogFileMode = Info->LogFileMode;
Properties->FlushTimer = Info->FlushTimer;
Properties->LogBuffersLost = Info->LogBuffersLost;
Properties->AgeLimit = Info->AgeLimit;
Properties->RealTimeBuffersLost = Info->RealTimeBuffersLost;
}
NTSTATUS
WmipThreadRunDown(
IN PWMI_LOGGER_CONTEXT Logger,
IN PSYSTEM_PROCESS_INFORMATION pProcessInfo,
IN ULONG StartFlag,
IN BOOLEAN bExtended
)
{
PSYSTEM_THREAD_INFORMATION pThreadInfo;
ULONG GroupType;
ULONG i;
ULONG Size;
ULONG SystemThreadInfoSize;
PWMI_EXTENDED_THREAD_INFORMATION ThreadInfo;
pThreadInfo = (PSYSTEM_THREAD_INFORMATION) (pProcessInfo+1);
GroupType = EVENT_TRACE_GROUP_THREAD +
((StartFlag) ? EVENT_TRACE_TYPE_DC_START
: EVENT_TRACE_TYPE_DC_END);
Size = sizeof(WMI_EXTENDED_THREAD_INFORMATION);
SystemThreadInfoSize = (bExtended) ? sizeof(SYSTEM_EXTENDED_THREAD_INFORMATION)
: sizeof(SYSTEM_THREAD_INFORMATION);
for (i=0; i < pProcessInfo->NumberOfThreads; i++) {
if (pThreadInfo == NULL)
break;
ThreadInfo = (PWMI_EXTENDED_THREAD_INFORMATION)
WmipGetTraceBuffer( Logger,
pThreadInfo,
GroupType,
Size );
if (ThreadInfo) {
ThreadInfo->ProcessId =
HandleToUlong(pThreadInfo->ClientId.UniqueProcess);
ThreadInfo->ThreadId =
HandleToUlong(pThreadInfo->ClientId.UniqueThread);
if (bExtended) {
PSYSTEM_EXTENDED_THREAD_INFORMATION pExtThreadInfo;
pExtThreadInfo = (PSYSTEM_EXTENDED_THREAD_INFORMATION) pThreadInfo;
ThreadInfo->StackBase = pExtThreadInfo->StackBase;
ThreadInfo->StackLimit = pExtThreadInfo->StackLimit;
ThreadInfo->StartAddr = pExtThreadInfo->ThreadInfo.StartAddress;
ThreadInfo->Win32StartAddr = pExtThreadInfo->Win32StartAddress;
ThreadInfo->UserStackBase = NULL;
ThreadInfo->UserStackLimit = NULL;
ThreadInfo->WaitMode = -1;
}
else {
ThreadInfo->StackBase = NULL;
ThreadInfo->StackLimit = NULL;
ThreadInfo->StartAddr = NULL;
ThreadInfo->Win32StartAddr = NULL;
ThreadInfo->UserStackBase = NULL;
ThreadInfo->UserStackLimit = NULL;
ThreadInfo->WaitMode = -1;
}
}
pThreadInfo = (PSYSTEM_THREAD_INFORMATION)( (char*)pThreadInfo + SystemThreadInfoSize );
}
return STATUS_SUCCESS;
}
void
WmipLogImageLoadEvent(
IN HANDLE ProcessID,
IN PWMI_LOGGER_CONTEXT pLogger,
IN PRTL_PROCESS_MODULE_INFORMATION pModuleInfo,
IN PSYSTEM_THREAD_INFORMATION pThreadInfo
)
{
UNICODE_STRING wstrModuleName;
ANSI_STRING astrModuleName;
ULONG sizeModuleName;
ULONG sizeBuffer;
PCHAR pAuxInfo;
PWMI_IMAGELOAD_INFORMATION ImageLoadInfo;
if ((pLogger == NULL) || (pModuleInfo == NULL) || (pThreadInfo == NULL))
return;
RtlInitAnsiString( & astrModuleName, pModuleInfo->FullPathName);
sizeModuleName = sizeof(WCHAR) * (astrModuleName.Length);
sizeBuffer = sizeModuleName + sizeof(WCHAR)
+ FIELD_OFFSET (WMI_IMAGELOAD_INFORMATION, FileName);
ImageLoadInfo = (PWMI_IMAGELOAD_INFORMATION)
WmipGetTraceBuffer(
pLogger,
pThreadInfo,
EVENT_TRACE_GROUP_PROCESS + EVENT_TRACE_TYPE_LOAD,
sizeBuffer);
if (ImageLoadInfo == NULL) {
return;
}
ImageLoadInfo->ImageBase = pModuleInfo->ImageBase;
ImageLoadInfo->ImageSize = pModuleInfo->ImageSize;
ImageLoadInfo->ProcessId = HandleToUlong(ProcessID);
wstrModuleName.Buffer = (LPWSTR) &ImageLoadInfo->FileName[0];
wstrModuleName.MaximumLength = (USHORT) sizeModuleName + sizeof(WCHAR);
RtlAnsiStringToUnicodeString(& wstrModuleName, & astrModuleName, FALSE);
}
ULONG
WmipSysModuleRunDown(
IN PWMI_LOGGER_CONTEXT pLogger,
IN PSYSTEM_THREAD_INFORMATION pThreadInfo
)
{
NTSTATUS status = STATUS_SUCCESS;
char * pLargeBuffer1;
ULONG ReturnLength;
ULONG CurrentBufferSize;
ULONG i;
PRTL_PROCESS_MODULES pModules;
PRTL_PROCESS_MODULE_INFORMATION pModuleInfo;
pLargeBuffer1 = WmipMemReserve(MAX_BUFFER_SIZE);
if (pLargeBuffer1 == NULL)
{
status = STATUS_NO_MEMORY;
goto Cleanup;
}
if (WmipMemCommit(pLargeBuffer1, BUFFER_SIZE) == NULL)
{
status = STATUS_NO_MEMORY;
goto Cleanup;
}
CurrentBufferSize = BUFFER_SIZE;
retry:
status = NtQuerySystemInformation(
SystemModuleInformation,
pLargeBuffer1,
CurrentBufferSize,
&ReturnLength);
if (status == STATUS_INFO_LENGTH_MISMATCH)
{
// Increase buffer size.
//
CurrentBufferSize += 8192;
if (WmipMemCommit(pLargeBuffer1, CurrentBufferSize) == NULL)
{
status = STATUS_NO_MEMORY;
goto Cleanup;
}
goto retry;
}
if (!NT_SUCCESS(status))
{
goto Cleanup;
}
pModules = (PRTL_PROCESS_MODULES) pLargeBuffer1;
for (i = 0, pModuleInfo = & (pModules->Modules[0]);
i < pModules->NumberOfModules;
i ++, pModuleInfo ++)
{
WmipLogImageLoadEvent(NULL, pLogger, pModuleInfo, pThreadInfo);
}
Cleanup:
if (pLargeBuffer1)
{
WmipMemFree(pLargeBuffer1);
}
return WmipSetNtStatus(status);
}
ULONG
WmipProcessModuleRunDown(
IN PWMI_LOGGER_CONTEXT pLogger,
IN HANDLE ProcessID,
IN PSYSTEM_THREAD_INFORMATION pThreadInfo)
{
NTSTATUS status = STATUS_SUCCESS;
ULONG i;
PRTL_DEBUG_INFORMATION pLargeBuffer1 = NULL;
pLargeBuffer1 = RtlCreateQueryDebugBuffer(0, FALSE);
if (pLargeBuffer1 == NULL)
{
status = STATUS_NO_MEMORY;
goto Cleanup;
}
status = RtlQueryProcessDebugInformation(
ProcessID,
RTL_QUERY_PROCESS_MODULES,
pLargeBuffer1);
if ( !NT_SUCCESS(status) || (pLargeBuffer1->Modules == NULL) )
{
goto Cleanup;
}
for (i = 0; i < pLargeBuffer1->Modules->NumberOfModules; i ++)
{
WmipLogImageLoadEvent(
ProcessID,
pLogger,
& (pLargeBuffer1->Modules->Modules[i]),
pThreadInfo);
}
Cleanup:
if (pLargeBuffer1)
{
RtlDestroyQueryDebugBuffer(pLargeBuffer1);
}
return WmipSetNtStatus(status);
}
NTSTATUS
WmipProcessRunDown(
IN PWMI_LOGGER_CONTEXT Logger,
IN ULONG StartFlag,
IN ULONG fEnableFlags
)
{
PSYSTEM_PROCESS_INFORMATION pProcessInfo;
PSYSTEM_THREAD_INFORMATION pThreadInfo;
char* LargeBuffer1;
NTSTATUS status;
ULONG ReturnLength;
ULONG CurrentBufferSize;
ULONG GroupType;
ULONG TotalOffset = 0;
OBJECT_ATTRIBUTES objectAttributes;
BOOLEAN WasEnabled = TRUE;
BOOLEAN bExtended = TRUE;
LargeBuffer1 = WmipMemReserve ( MAX_BUFFER_SIZE );
if (LargeBuffer1 == NULL) {
return STATUS_NO_MEMORY;
}
if (WmipMemCommit (LargeBuffer1, BUFFER_SIZE) == NULL) {
return STATUS_NO_MEMORY;
}
CurrentBufferSize = BUFFER_SIZE;
retry:
if (bExtended) {
status = NtQuerySystemInformation(
SystemExtendedProcessInformation,
LargeBuffer1,
CurrentBufferSize,
&ReturnLength
);
}
else {
status = NtQuerySystemInformation(
SystemProcessInformation,
LargeBuffer1,
CurrentBufferSize,
&ReturnLength
);
}
if (status == STATUS_INFO_LENGTH_MISMATCH) {
//
// Increase buffer size.
//
CurrentBufferSize += 8192;
if (WmipMemCommit (LargeBuffer1, CurrentBufferSize) == NULL) {
return STATUS_NO_MEMORY;
}
goto retry;
}
if (!NT_SUCCESS(status)) {
if (bExtended) {
bExtended = FALSE;
goto retry;
}
WmipMemFree(LargeBuffer1);
return(status);
}
//
// Adjust Privileges to obtain the module information
//
if (fEnableFlags & EVENT_TRACE_FLAG_IMAGE_LOAD) {
status = RtlAdjustPrivilege(SE_DEBUG_PRIVILEGE,
TRUE, FALSE, &WasEnabled);
if (!NT_SUCCESS(status)) {
WmipMemFree(LargeBuffer1);
return (status);
}
}
TotalOffset = 0;
pProcessInfo = (SYSTEM_PROCESS_INFORMATION *) LargeBuffer1;
while (TRUE) {
ULONG Size;
ULONG Length = 0;
ULONG SidLength = 0;
PUCHAR AuxPtr;
PULONG_PTR AuxInfo;
ANSI_STRING s;
HANDLE Token;
HANDLE pProcess;
PCLIENT_ID Cid;
ULONG TempInfo[128];
PWMI_PROCESS_INFORMATION WmiProcessInfo;
Size = FIELD_OFFSET(WMI_PROCESS_INFORMATION, Sid);
GroupType = EVENT_TRACE_GROUP_PROCESS +
((StartFlag) ? EVENT_TRACE_TYPE_DC_START
: EVENT_TRACE_TYPE_DC_END);
pThreadInfo = (PSYSTEM_THREAD_INFORMATION) (pProcessInfo+1);
if (pProcessInfo->NumberOfThreads > 0) {
Cid = (PCLIENT_ID) &pThreadInfo->ClientId;
}
else {
Cid = NULL;
}
// if at termination, rundown thread first before process
if ( (!StartFlag) &&
(fEnableFlags & EVENT_TRACE_FLAG_THREAD) ){
status = WmipThreadRunDown(Logger,
pProcessInfo,
StartFlag,
bExtended);
if (!NT_SUCCESS(status)) {
break;
}
}
if (fEnableFlags & EVENT_TRACE_FLAG_PROCESS) {
if ( pProcessInfo->ImageName.Buffer &&
pProcessInfo->ImageName.Length > 0 ) {
RtlUnicodeStringToAnsiString(
&s,
(PUNICODE_STRING)&pProcessInfo->ImageName,
TRUE);
Length = s.Length + 1;
}
else {
Length = 1;
}
InitializeObjectAttributes(
&objectAttributes, 0, 0, NULL, NULL);
status = NtOpenProcess(
&pProcess,
PROCESS_QUERY_INFORMATION,
&objectAttributes,
Cid);
if (NT_SUCCESS(status)) {
status = NtOpenProcessToken(
pProcess,
TOKEN_READ,
&Token);
if (NT_SUCCESS(status)) {
status = NtQueryInformationToken(
Token,
TokenUser,
TempInfo,
256,
&SidLength);
NtClose(Token);
}
NtClose(pProcess);
}
if ( (!NT_SUCCESS(status)) || SidLength <= 0) {
TempInfo[0] = 0;
SidLength = sizeof(ULONG);
}
Size += Length + SidLength;
WmiProcessInfo = (PWMI_PROCESS_INFORMATION)
WmipGetTraceBuffer( Logger,
pThreadInfo,
GroupType,
Size);
if (WmiProcessInfo == NULL) {
status = STATUS_NO_MEMORY;
break;
}
WmiProcessInfo->ProcessId = HandleToUlong(pProcessInfo->UniqueProcessId);
WmiProcessInfo->ParentId = HandleToUlong(pProcessInfo->InheritedFromUniqueProcessId);
WmiProcessInfo->SessionId = pProcessInfo->SessionId;
WmiProcessInfo->PageDirectoryBase = pProcessInfo->PageDirectoryBase;
WmiProcessInfo->ExitStatus = 0;
AuxPtr = (PUCHAR) (&WmiProcessInfo->Sid);
RtlCopyMemory(AuxPtr, &TempInfo, SidLength);
AuxPtr += SidLength;
if ( Length > 1) {
RtlCopyMemory(AuxPtr, s.Buffer, Length);
AuxPtr += Length;
RtlFreeAnsiString(&s);
}
*AuxPtr = '\0';
AuxPtr++;
}
// if at beginning, trace threads after process
if (StartFlag) {
if (fEnableFlags & EVENT_TRACE_FLAG_THREAD) {
WmipThreadRunDown(Logger, pProcessInfo, StartFlag, bExtended);
}
if (fEnableFlags & EVENT_TRACE_FLAG_IMAGE_LOAD) {
if (pProcessInfo->UniqueProcessId == 0) {
WmipSysModuleRunDown(Logger, pThreadInfo);
}
else
WmipProcessModuleRunDown(
Logger,
(HANDLE) pProcessInfo->UniqueProcessId,
pThreadInfo);
}
}
if (pProcessInfo->NextEntryOffset == 0) {
break;
}
TotalOffset += pProcessInfo->NextEntryOffset;
pProcessInfo = (PSYSTEM_PROCESS_INFORMATION)&LargeBuffer1[TotalOffset];
}
//
// Restore privileges back to what it was before
//
if (fEnableFlags & EVENT_TRACE_FLAG_IMAGE_LOAD) {
status = RtlAdjustPrivilege(SE_DEBUG_PRIVILEGE,
WasEnabled,
FALSE,
&WasEnabled);
}
WmipMemFree(LargeBuffer1);
return status;
}
VOID
WmipInitString(
IN PVOID Destination,
IN PVOID Buffer,
IN ULONG Size
)
{
PSTRING s = (PSTRING) Destination;
s->Buffer = Buffer;
s->Length = 0;
if (Buffer != NULL)
s->MaximumLength = (USHORT) Size;
else
s->MaximumLength = 0;
}
VOID
WmipGenericTraceEnable(
IN ULONG RequestCode,
IN PVOID Buffer,
IN OUT PVOID *RequestAddress
)
{
PGUIDMAPENTRY pControlGMEntry = *RequestAddress;
PWNODE_HEADER Wnode = (PWNODE_HEADER) Buffer;
PTRACE_REG_INFO pTraceRegInfo;
PTRACE_ENABLE_CONTEXT pContext = (PTRACE_ENABLE_CONTEXT)&Wnode->HistoricalContext;
*RequestAddress = NULL;
if (Wnode == NULL || pControlGMEntry == NULL)
return;
if (!Wnode->Flags & WNODE_FLAG_TRACED_GUID)
return;
pTraceRegInfo = pControlGMEntry->pControlGuidData;
WmipAssert(pTraceRegInfo != NULL);
if (pTraceRegInfo->InProgressEvent != NULL) {
LARGE_INTEGER Timeout = {(ULONG)(-NOTIFY_RETRY_COUNT * 1000 * 10), -1};
// TODO: Raghu - what if it times out??
NtWaitForSingleObject(pTraceRegInfo->InProgressEvent, 0, &Timeout);
}
*RequestAddress = pTraceRegInfo->NotifyRoutine;
if (RequestCode == WMI_ENABLE_EVENTS) {
pControlGMEntry->LoggerContext = Wnode->HistoricalContext;
if (pContext->InternalFlag & EVENT_TRACE_INTERNAL_FLAG_PRIVATE) {
pTraceRegInfo->EnabledState = TRUE;
if (!WmipIsPrivateLoggerOn())
*RequestAddress = NULL; // Do not notify if the logger is not up.
}
}
else if (RequestCode == WMI_DISABLE_EVENTS) {
if (pContext->InternalFlag & EVENT_TRACE_INTERNAL_FLAG_PRIVATE) {
pTraceRegInfo->EnabledState = FALSE;
}
pControlGMEntry->LoggerContext = 0;
}
}
ULONG
WmipAddLogHeaderToLogFile(
IN OUT PWMI_LOGGER_INFORMATION LoggerInfo,
IN PWMI_REF_CLOCK RefClock,
IN ULONG Update
)
{
NTSTATUS Status;
HANDLE LogFile = INVALID_HANDLE_VALUE;
ULONG BufferSize;
ULONG MemorySize;
ULONG TraceKernel;
SYSTEM_BASIC_INFORMATION SystemInfo;
WMI_LOGGER_CONTEXT Logger;
IO_STATUS_BLOCK IoStatus;
PWMI_BUFFER_HEADER Buffer;
FILE_POSITION_INFORMATION FileInfo;
LPWSTR FileName = NULL;
LPWSTR FileNameBuffer = NULL;
ULONG HeaderSize;
struct WMI_LOGFILE_HEADER {
WMI_BUFFER_HEADER BufferHeader;
SYSTEM_TRACE_HEADER SystemHeader;
TRACE_LOGFILE_HEADER LogFileHeader;
};
struct WMI_LOGFILE_HEADER LoggerBuffer;
BOOLEAN bLogFileAppend =
(LoggerInfo->LogFileMode & EVENT_TRACE_FILE_MODE_APPEND)
? (TRUE) : (FALSE);
if (LoggerInfo == NULL)
return WmipSetDosError(ERROR_INVALID_PARAMETER);
if (LoggerInfo->Wnode.BufferSize < sizeof(WMI_LOGGER_INFORMATION))
return WmipSetDosError(ERROR_INVALID_PARAMETER);
if ( !(LoggerInfo->Wnode.Flags & WNODE_FLAG_TRACED_GUID) )
return WmipSetDosError(ERROR_INVALID_PARAMETER);
if ((LoggerInfo->LogFileMode & EVENT_TRACE_FILE_MODE_NEWFILE) &&
(LoggerInfo->LogFileName.Length > 0)) {
FileName = (LPWSTR) WmipAlloc(LoggerInfo->LogFileName.Length + 64);
if (FileName == NULL) {
return WmipSetDosError(ERROR_NOT_ENOUGH_MEMORY);
}
swprintf(FileName, LoggerInfo->LogFileName.Buffer, 1);
FileNameBuffer = FileName;
}
if (FileName == NULL)
FileName = (LPWSTR) LoggerInfo->LogFileName.Buffer;
//
// If it is Append Mode, we need to open the file and make sure the
// pick up the BufferSize
//
if ( bLogFileAppend ) {
ULONG ReadSize = sizeof(WMI_BUFFER_HEADER)
+ sizeof(SYSTEM_TRACE_HEADER)
+ sizeof(TRACE_LOGFILE_HEADER);
ULONG nBytesRead = 0;
//
// Update and Append do not mix. To Append LoggerInfo
// must have LogFileName
//
if ( (Update) || (LoggerInfo->LogFileName.Length <= 0) ) {
if (FileNameBuffer != NULL) {
WmipFree(FileNameBuffer);
}
return WmipSetDosError(ERROR_INVALID_PARAMETER);
}
LogFile = WmipCreateFileW(FileName,
GENERIC_READ | GENERIC_WRITE,
FILE_SHARE_READ,
NULL,
OPEN_EXISTING,
FILE_ATTRIBUTE_NORMAL,
NULL);
if (LogFile == INVALID_HANDLE_VALUE) {
// cannot OPEN_EXISTING, assume that logfile is not there and
// create a new one.
//
bLogFileAppend = FALSE;
LoggerInfo->LogFileMode = LoggerInfo->LogFileMode
& (~ (EVENT_TRACE_FILE_MODE_APPEND));
}
else {
// read TRACE_LOGFILE_HEADER structure and update LoggerInfo
// members.
//
Status = WmipReadFile(LogFile,
(LPVOID) & LoggerBuffer,
ReadSize,
& nBytesRead,
NULL);
if (nBytesRead < ReadSize) {
NtClose(LogFile);
if (FileNameBuffer != NULL) {
WmipFree(FileNameBuffer);
}
return WmipSetDosError(ERROR_BAD_PATHNAME);
}
if ( LoggerBuffer.LogFileHeader.LogFileMode
& EVENT_TRACE_FILE_MODE_CIRCULAR) {
NtClose(LogFile);
if (FileNameBuffer != NULL) {
WmipFree(FileNameBuffer);
}
return WmipSetDosError(ERROR_BAD_PATHNAME);
}
LoggerInfo->BufferSize =
LoggerBuffer.LogFileHeader.BufferSize / 1024;
LoggerInfo->BuffersWritten =
LoggerBuffer.LogFileHeader.BuffersWritten;
LoggerInfo->MaximumFileSize =
LoggerBuffer.LogFileHeader.MaximumFileSize;
// Write back logfile append mode so WmipFinalizeLogFile() correctly
// update BuffersWritten field
//
FileInfo.CurrentByteOffset.QuadPart =
LOGFILE_FIELD_OFFSET(EndTime);
Status = NtSetInformationFile(LogFile,
& IoStatus,
& FileInfo,
sizeof(FILE_POSITION_INFORMATION),
FilePositionInformation);
if (!NT_SUCCESS(Status)) {
NtClose(LogFile);
if (FileNameBuffer != NULL) {
WmipFree(FileNameBuffer);
}
return WmipSetNtStatus(Status);
}
LoggerBuffer.LogFileHeader.EndTime.QuadPart = 0;
Status = NtWriteFile(LogFile,
NULL,
NULL,
NULL,
& IoStatus,
& LoggerBuffer.LogFileHeader.EndTime,
sizeof(LARGE_INTEGER),
NULL,
NULL);
if (! NT_SUCCESS(Status)) {
NtClose(LogFile);
if (FileNameBuffer != NULL) {
WmipFree(FileNameBuffer);
}
return WmipSetNtStatus(Status);
}
// build checksum structure
//
if (LoggerInfo->LogFileMode & EVENT_TRACE_PRIVATE_LOGGER_MODE) {
LoggerInfo->Checksum = NULL;
}
else {
LoggerInfo->Checksum = WmipAlloc(
sizeof(WNODE_HEADER) + sizeof(TRACE_LOGFILE_HEADER));
if (LoggerInfo->Checksum != NULL) {
PBYTE ptrChecksum = LoggerInfo->Checksum;
RtlCopyMemory(ptrChecksum,
& LoggerBuffer.BufferHeader,
sizeof(WNODE_HEADER));
ptrChecksum += sizeof(WNODE_HEADER);
RtlCopyMemory(ptrChecksum,
& LoggerBuffer.LogFileHeader,
sizeof(TRACE_LOGFILE_HEADER));
}
else {
if (FileNameBuffer != NULL) {
WmipFree(FileNameBuffer);
}
return WmipSetDosError(ERROR_NOT_ENOUGH_MEMORY);
}
}
}
}
// get the system parameters first
LoggerInfo->LogFileHandle = NULL;
Status = NtQuerySystemInformation(
SystemBasicInformation,
&SystemInfo, sizeof (SystemInfo), NULL);
if (!NT_SUCCESS(Status)) {
if (FileNameBuffer != NULL) {
WmipFree(FileNameBuffer);
}
return WmipSetNtStatus(Status);
}
// choose some logical default value for buffer size if user
// has not provided one
MemorySize = SystemInfo.NumberOfPhysicalPages * SystemInfo.PageSize
/ 1024 / 1024;
if (MemorySize <= 32)
BufferSize = SystemInfo.PageSize;
else if (MemorySize <= 64)
BufferSize = SystemInfo.PageSize;
else if (MemorySize <= 128)
BufferSize = SystemInfo.PageSize * 2;
else if (MemorySize <= 256)
BufferSize = SystemInfo.PageSize * 2;
else if (MemorySize > 512)
BufferSize = SystemInfo.PageSize * 2;
else if (MemorySize <= 256)
BufferSize = SystemInfo.PageSize * 2;
else if (MemorySize > 512)
BufferSize = 64 * 1024; // allocation size
else // > 256 && < 512
BufferSize = SystemInfo.PageSize * 2;
if (LoggerInfo->BufferSize > 1024) // limit to 1Mb
BufferSize = 1024 * 1024;
else if (LoggerInfo->BufferSize > 0)
BufferSize = LoggerInfo->BufferSize * 1024;
TraceKernel = IsEqualGUID(&LoggerInfo->Wnode.Guid, &SystemTraceControlGuid);
if (!TraceKernel) {
GUID guid;
RtlZeroMemory(&guid, sizeof(GUID));
if (IsEqualGUID(&LoggerInfo->Wnode.Guid, &guid)) {
// Generate a Guid for this logger stream
// This will ensure buffer filtering at the WMI service
// based on this GUID.
UUID uid;
WmipUuidCreate(&uid);
LoggerInfo->Wnode.Guid = uid;
}
}
if (!Update) {
// don't want to update BufferSize information if the request is
// to update logger session
//
LoggerInfo->BufferSize = BufferSize / 1024;
}
if (LoggerInfo->LogFileName.Length <= 0)
return ERROR_SUCCESS; //goto SendToKm;
//
// We assumed the exposed API has checked for either RealTime or FileName
// is provided
//
// open the file for writing synchronously for the logger
// others may want to read it as well.
// For logfile append mode, logfile has been opened previously
//
if (! bLogFileAppend) {
/* LogFile = WmipCreateFileW(
(PWCHAR) LoggerInfo->LogFileName.Buffer,
GENERIC_WRITE,
FILE_SHARE_READ,
NULL,
CREATE_ALWAYS,
FILE_ATTRIBUTE_NORMAL,
NULL
); */
LogFile = WmipCreateFile(
FileName,
FILE_GENERIC_WRITE,
FILE_SHARE_READ,
FILE_OVERWRITE_IF,
0);
if (LogFile == INVALID_HANDLE_VALUE) {
if (FileNameBuffer != NULL) {
WmipFree(FileNameBuffer);
}
return WmipSetDosError(ERROR_BAD_PATHNAME);
}
}
LoggerInfo->LogFileHandle = LogFile;
//
// If this is an Update call, then we need to pick up the original
// buffer size for the LogFileHeader.
//
if (Update) {
PWMI_LOGGER_INFORMATION pTempLoggerInfo;
PWCHAR strLoggerName = NULL;
PWCHAR strLogFileName = NULL;
ULONG ErrCode;
ULONG SizeNeeded = sizeof(WMI_LOGGER_INFORMATION) + MAXSTR * sizeof(WCHAR) * 2;
SizeNeeded = (SizeNeeded +7) & ~7;
pTempLoggerInfo = WmipAlloc(SizeNeeded);
if (pTempLoggerInfo == NULL) {
return WmipSetDosError(ERROR_NOT_ENOUGH_MEMORY);
}
RtlZeroMemory(pTempLoggerInfo, SizeNeeded);
pTempLoggerInfo->Wnode.BufferSize = SizeNeeded;
pTempLoggerInfo->Wnode.Flags |= WNODE_FLAG_TRACED_GUID;
pTempLoggerInfo->Wnode.HistoricalContext = LoggerInfo->Wnode.HistoricalContext;
pTempLoggerInfo->Wnode.Guid = LoggerInfo->Wnode.Guid;
if (LoggerInfo->LogFileMode & EVENT_TRACE_PRIVATE_LOGGER_MODE) {
pTempLoggerInfo->LogFileMode |= EVENT_TRACE_PRIVATE_LOGGER_MODE;
}
strLoggerName = (PWCHAR) ( ((PUCHAR) pTempLoggerInfo)
+ sizeof(WMI_LOGGER_INFORMATION));
WmipInitString(&pTempLoggerInfo->LoggerName,
strLoggerName,
MAXSTR * sizeof(WCHAR));
if (LoggerInfo->LoggerName.Length > 0) {
RtlCopyUnicodeString( &pTempLoggerInfo->LoggerName,
&LoggerInfo->LoggerName);
}
strLogFileName = (PWCHAR) ( ((PUCHAR) pTempLoggerInfo)
+ sizeof(WMI_LOGGER_INFORMATION)
+ MAXSTR * sizeof(WCHAR) );
WmipInitString(&pTempLoggerInfo->LogFileName,
strLogFileName,
MAXSTR * sizeof(WCHAR) );
//
// Call QueryLogger
//
ErrCode = WmipQueryLogger(pTempLoggerInfo, FALSE);
BufferSize = pTempLoggerInfo->BufferSize * 1024;
WmipFree(pTempLoggerInfo);
if (ErrCode != ERROR_SUCCESS) {
return ErrCode;
}
}
//
// Before Allocating the Buffer for Logfile Header make
// sure the buffer size is atleast as large as the LogFileHeader
//
HeaderSize = sizeof(LoggerBuffer)
+ LoggerInfo->LoggerName.Length + sizeof(WCHAR)
+ LoggerInfo->LogFileName.Length + sizeof(WCHAR);
if (HeaderSize > BufferSize) {
//
// Round it to the nearest power of 2 and check for max size 1 MB
//
double dTemp = log (HeaderSize / 1024.0) / log (2.0);
ULONG lTemp = (ULONG) (dTemp + 0.99);
HeaderSize = (1 << lTemp);
if (HeaderSize > 1024) {
NtClose(LogFile);
if (FileNameBuffer != NULL) {
WmipFree(FileNameBuffer);
}
return WmipSetDosError(ERROR_NOT_ENOUGH_MEMORY);
}
LoggerInfo->BufferSize = HeaderSize;
BufferSize = HeaderSize * 1024;
}
// allocate a buffer to write logger header and process/thread
// rundown information
//
Logger.LogFileHandle = LogFile;
Logger.BufferSize = BufferSize;
Logger.TimerResolution = SystemInfo.TimerResolution;
Logger.BufferSpace = WmipAlloc(BufferSize);
if (Logger.BufferSpace == NULL) {
NtClose(LogFile);
if (FileNameBuffer != NULL) {
WmipFree(FileNameBuffer);
}
return WmipSetDosError(ERROR_NOT_ENOUGH_MEMORY);
}
if (LoggerInfo->Wnode.ClientContext != EVENT_TRACE_CLOCK_SYSTEMTIME) {
LoggerInfo->Wnode.ClientContext = EVENT_TRACE_CLOCK_PERFCOUNTER;
}
Logger.UsePerfClock = LoggerInfo->Wnode.ClientContext;
// initialize buffer first
RtlZeroMemory(Logger.BufferSpace, BufferSize);
Buffer = (PWMI_BUFFER_HEADER) Logger.BufferSpace;
Buffer->Offset = sizeof(WMI_BUFFER_HEADER);
if (TraceKernel) {
Buffer->Wnode.Guid = SystemTraceControlGuid;
}
else {
Buffer->Wnode.Guid = LoggerInfo->Wnode.Guid;
}
Buffer->Wnode.BufferSize = BufferSize;
Buffer->ClientContext.Alignment = (UCHAR)WmiTraceAlignment;
Buffer->Wnode.Flags = WNODE_FLAG_TRACED_GUID;
if (bLogFileAppend) {
Logger.BuffersWritten = LoggerBuffer.LogFileHeader.BuffersWritten;
WmipSetFilePointer(LogFile, 0, NULL, FILE_END);
}
else {
PTRACE_LOGFILE_HEADER LogfileHeader;
OSVERSIONINFO sVersionInfo;
Logger.BuffersWritten = 0;
HeaderSize = sizeof(TRACE_LOGFILE_HEADER)
+ LoggerInfo->LoggerName.Length + sizeof(WCHAR)
+ LoggerInfo->LogFileName.Length + sizeof(WCHAR);
LogfileHeader = (PTRACE_LOGFILE_HEADER)
WmipGetTraceBuffer(
&Logger,
NULL,
EVENT_TRACE_GROUP_HEADER + EVENT_TRACE_TYPE_INFO,
HeaderSize
);
if (LogfileHeader == NULL) {
NtClose(LogFile);
WmipFree(Logger.BufferSpace);
if (FileNameBuffer != NULL) {
WmipFree(FileNameBuffer);
}
return WmipSetDosError(ERROR_NOT_ENOUGH_MEMORY);
}
if (Logger.UsePerfClock == EVENT_TRACE_CLOCK_PERFCOUNTER) {
LARGE_INTEGER CurrentTime;
LARGE_INTEGER Frequency;
Status = NtQueryPerformanceCounter(&CurrentTime, &Frequency);
LogfileHeader->PerfFreq = Frequency;
LogfileHeader->ReservedFlags = EVENT_TRACE_CLOCK_PERFCOUNTER;
}
//
// Start and End Times are wall clock time
//
if (RefClock != NULL) {
PSYSTEM_TRACE_HEADER Header;
LogfileHeader->StartTime = RefClock->StartTime;
Header = (PSYSTEM_TRACE_HEADER) ( (char *) LogfileHeader - sizeof(SYSTEM_TRACE_HEADER) );
Header->SystemTime = RefClock->StartPerfClock;
}
else {
LogfileHeader->StartTime.QuadPart = WmipGetSystemTime();
}
RtlZeroMemory(&sVersionInfo, sizeof(OSVERSIONINFO));
sVersionInfo.dwOSVersionInfoSize = sizeof(OSVERSIONINFO);
WmipGetVersionExA(&sVersionInfo);
LogfileHeader->BufferSize = BufferSize;
LogfileHeader->VersionDetail.MajorVersion =
(UCHAR)sVersionInfo.dwMajorVersion;
LogfileHeader->VersionDetail.MinorVersion =
(UCHAR)sVersionInfo.dwMinorVersion;
LogfileHeader->VersionDetail.SubVersion = TRACE_VERSION_MAJOR;
LogfileHeader->VersionDetail.SubMinorVersion = TRACE_VERSION_MINOR;
LogfileHeader->ProviderVersion = sVersionInfo.dwBuildNumber;
LogfileHeader->StartBuffers = 1;
LogfileHeader->LogFileMode
= LoggerInfo->LogFileMode & (~(EVENT_TRACE_REAL_TIME_MODE));
LogfileHeader->NumberOfProcessors = SystemInfo.NumberOfProcessors;
if (LoggerInfo->LogFileMode & EVENT_TRACE_PRIVATE_LOGGER_MODE)
{
if ( (LoggerInfo->NumberOfProcessors > 0) &&
(LoggerInfo->LogFileMode & EVENT_TRACE_RELOG_MODE) ) {
LogfileHeader->NumberOfProcessors = LoggerInfo->NumberOfProcessors;
}
else {
LoggerInfo->NumberOfProcessors = SystemInfo.NumberOfProcessors;
}
}
LogfileHeader->MaximumFileSize = LoggerInfo->MaximumFileSize;
LogfileHeader->TimerResolution = SystemInfo.TimerResolution;
LogfileHeader->LoggerName = (PWCHAR) ( (PUCHAR) LogfileHeader
+ sizeof(TRACE_LOGFILE_HEADER) );
LogfileHeader->LogFileName = (PWCHAR) ((PUCHAR)LogfileHeader->LoggerName
+ LoggerInfo->LoggerName.Length
+ sizeof (WCHAR));
RtlCopyMemory(LogfileHeader->LoggerName,
LoggerInfo->LoggerName.Buffer,
LoggerInfo->LoggerName.Length + sizeof(WCHAR));
RtlCopyMemory(LogfileHeader->LogFileName,
LoggerInfo->LogFileName.Buffer,
LoggerInfo->LogFileName.Length + sizeof(WCHAR));
WmipGetTimeZoneInformation(&LogfileHeader->TimeZone);
LogfileHeader->PointerSize = sizeof(PVOID);
if (LoggerInfo->LogFileMode & EVENT_TRACE_PRIVATE_LOGGER_MODE) {
LoggerInfo->Checksum = NULL;
}
else {
LoggerInfo->Checksum = WmipAlloc(
sizeof(WNODE_HEADER)
+ sizeof(TRACE_LOGFILE_HEADER));
if (LoggerInfo->Checksum != NULL) {
PBYTE ptrChecksum = LoggerInfo->Checksum;
RtlCopyMemory(ptrChecksum, Buffer, sizeof(WNODE_HEADER));
ptrChecksum += sizeof(WNODE_HEADER);
RtlCopyMemory(
ptrChecksum, LogfileHeader, sizeof(TRACE_LOGFILE_HEADER));
}
else {
NtClose(LogFile);
WmipFree(Logger.BufferSpace);
if (FileNameBuffer != NULL) {
WmipFree(FileNameBuffer);
}
return WmipSetDosError(ERROR_NOT_ENOUGH_MEMORY);
}
}
}
// Dump the GuidMaps to File at the Start
//
if (!Update) {
if (TraceKernel) {
ULONG EnableFlags = LoggerInfo->EnableFlags;
if (EnableFlags & EVENT_TRACE_FLAG_EXTENSION) {
PTRACE_ENABLE_FLAG_EXTENSION tFlagExt;
tFlagExt = (PTRACE_ENABLE_FLAG_EXTENSION)
&LoggerInfo->EnableFlags;
EnableFlags = *(PULONG)((PCHAR)LoggerInfo + tFlagExt->Offset);
}
WmipDumpHardwareConfig(&Logger);
WmipProcessRunDown( &Logger, TRUE, EnableFlags );
}
else {
WmipDumpGuidMaps(&Logger, NULL, FALSE);
}
}
Buffer = (PWMI_BUFFER_HEADER) Logger.BufferSpace;
// flush the last buffer
if (Buffer->Offset < Logger.BufferSize) {
RtlFillMemory(
(char *) Buffer + Buffer->Offset,
Logger.BufferSize - Buffer->Offset,
0xFF);
}
Status = NtWriteFile(
LogFile,
NULL,
NULL,
NULL,
&IoStatus,
Logger.BufferSpace,
BufferSize,
NULL,
NULL);
Logger.BuffersWritten++;
if ((LoggerInfo->LogFileMode == EVENT_TRACE_FILE_MODE_CIRCULAR) ) {
//
// We need to write the number of StartBuffers in the
// Circular Logfile header to process it properly.
FileInfo.CurrentByteOffset.QuadPart =
LOGFILE_FIELD_OFFSET(StartBuffers);
Status = NtSetInformationFile(
LogFile,
&IoStatus,
&FileInfo,
sizeof(FILE_POSITION_INFORMATION),
FilePositionInformation
);
if (!NT_SUCCESS(Status)) {
NtClose(LogFile);
if (FileNameBuffer != NULL) {
WmipFree(FileNameBuffer);
}
return WmipSetNtStatus(Status);
}
Status = NtWriteFile(
LogFile,
NULL,
NULL,
NULL,
&IoStatus,
&Logger.BuffersWritten,
sizeof(ULONG),
NULL,
NULL
);
if (NT_SUCCESS(Status)) {
PTRACE_LOGFILE_HEADER pLogFileHeader;
NtFlushBuffersFile(Logger.LogFileHandle, &IoStatus);
// update StartBuffers in Checksum
//
pLogFileHeader = (PTRACE_LOGFILE_HEADER)
(((PUCHAR) LoggerInfo->Checksum) + sizeof(WNODE_HEADER));
pLogFileHeader->StartBuffers = Logger.BuffersWritten;
}
}
//
// As a last thing update the Number of BuffersWritten so far
// in the header and also update the checksum. This is to prevent
// Logger failing Update calls under high load.
//
FileInfo.CurrentByteOffset.QuadPart =
LOGFILE_FIELD_OFFSET(BuffersWritten);
Status = NtSetInformationFile(
LogFile,
&IoStatus,
&FileInfo,
sizeof(FILE_POSITION_INFORMATION),
FilePositionInformation
);
if (!NT_SUCCESS(Status)) {
NtClose(LogFile);
return WmipSetNtStatus(Status);
}
Status = NtWriteFile(
LogFile,
NULL,
NULL,
NULL,
&IoStatus,
&Logger.BuffersWritten,
sizeof(ULONG),
NULL,
NULL
);
if (NT_SUCCESS(Status)) {
PTRACE_LOGFILE_HEADER pLogFileHeader;
NtFlushBuffersFile(Logger.LogFileHandle, &IoStatus);
// update StartBuffers in Checksum
//
if ( !(LoggerInfo->LogFileMode & EVENT_TRACE_PRIVATE_LOGGER_MODE) ) {
pLogFileHeader = (PTRACE_LOGFILE_HEADER)
(((PUCHAR) LoggerInfo->Checksum) + sizeof(WNODE_HEADER));
pLogFileHeader->BuffersWritten = Logger.BuffersWritten;
}
}
NtClose(LogFile);
LogFile = WmipCreateFileW(
FileName,
GENERIC_WRITE,
FILE_SHARE_READ,
NULL,
OPEN_EXISTING,
FILE_FLAG_NO_BUFFERING,
NULL
);
/* LogFile = WmipCreateFile(
FileName,
FILE_GENERIC_WRITE,
FILE_SHARE_READ,
FILE_OPEN,
FILE_NO_INTERMEDIATE_BUFFERING);
*/
if (FileNameBuffer != NULL) {
WmipFree(FileNameBuffer);
}
if (LogFile == INVALID_HANDLE_VALUE) {
return WmipGetLastError();
}
LoggerInfo->LogFileHandle = LogFile;
LoggerInfo->BuffersWritten = Logger.BuffersWritten;
WmipFree(Logger.BufferSpace);
return ERROR_SUCCESS;
}
ULONG
WmipDumpGuidMaps(
IN PWMI_LOGGER_CONTEXT Logger,
IN PLIST_ENTRY GuidMapListHeadPtr,
IN ULONG RealTimeFlag
)
/*++
Routine Description:
This routine communicates with the WMI Service and obtains all the
Trace Guids that are currently registered and those guids that unregistered
in the middle of a Logging session.
The GuidMaps are dumped to the logfile or added to the current GuidMapList
for real time processing.
Arguments:
Logger Logger Context.
RealTimeFlag Flag to denote real time processing.
Return Value:
Returns the number of Trace GUIDS obtained from the WMI service.
--*/
{
#if 0
ULONG Status;
PTRACEGUIDMAP GuidMapList = NULL;
ULONG MaxGuidCount;
ULONG TotalGuidCount;
ULONG ReturnGuidCount;
ULONG BusyRetries;
// Ensure that wmi service is around and willing to send us notifications
Status = WmipEnableNotifications();
if (Status != ERROR_SUCCESS)
{
WmipSetLastError(Status);
return(0);
}
MaxGuidCount = 10;
retry:
TotalGuidCount = 0;
ReturnGuidCount = 0;
GuidMapList = WmipAlloc(MaxGuidCount * sizeof(TRACEGUIDMAP));
if (GuidMapList == NULL)
{
WmipSetLastError(ERROR_NOT_ENOUGH_MEMORY);
return (0);
}
RtlZeroMemory(GuidMapList, MaxGuidCount * sizeof(TRACEGUIDMAP));
BusyRetries = 0;
do
{
try
{
#if 0
Status = EnumerateTraceGuidMap(WmipDcCtxHandle,
MaxGuidCount,
&TotalGuidCount,
&ReturnGuidCount,
GuidMapList);
#endif
} except(EXCEPTION_EXECUTE_HANDLER) {
Status = GetExceptionCode();
if (Status == STATUS_ACCESS_VIOLATION)
{
Status = ERROR_NOACCESS;
WmipFree(GuidMapList);
WmipSetLastError(Status);
return (0);
}
}
if (Status == RPC_S_SERVER_TOO_BUSY)
{
WmipDebugPrint(("WMI: EnumerateTraceGuidMap too busy for the %d time\n",
BusyRetries));
WmipSleep(RPC_BUSY_WAIT_TIMER);
BusyRetries++;
}
} while ((Status == RPC_S_SERVER_TOO_BUSY) &&
(BusyRetries < RPC_BUSY_WAIT_RETRIES));
//
// If RPC was successful, then write out these events to logfile.
//
if (Status == ERROR_MORE_DATA) {
MaxGuidCount = TotalGuidCount;
WmipFree(GuidMapList);
goto retry;
}
else if (Status == ERROR_SUCCESS) {
ULONG GroupType;
ULONG i;
ULONG Size;
PULONG AuxInfo;
PTRACEGUIDMAP pTraceGuidMap = GuidMapList;
GroupType = EVENT_TRACE_GROUP_HEADER + EVENT_TRACE_TYPE_GUIDMAP;
Size = sizeof(TRACEGUIDMAP);
for (i=0; i < ReturnGuidCount; i++) {
if (RealTimeFlag) {
WmipAddGuidHandleToGuidMapList(GuidMapListHeadPtr, pTraceGuidMap->GuidMapHandle,
&pTraceGuidMap->Guid);
}
else {
AuxInfo = (PULONG) WmipGetTraceBuffer(
Logger,
NULL,
GroupType,
Size);
if (AuxInfo == NULL) {
WmipFree(GuidMapList);
WmipSetLastError(ERROR_NOT_ENOUGH_MEMORY);
return(0);
}
RtlCopyMemory(AuxInfo, pTraceGuidMap, sizeof(TRACEGUIDMAP));
}
pTraceGuidMap++;
}
}
WmipFree(GuidMapList);
WmipSetLastError(Status);
return(ReturnGuidCount);
#else
WmipSetLastError(ERROR_INVALID_PARAMETER);
return(0);
#endif
}
ULONG
WmiUnregisterGuids(
IN WMIHANDLE WMIHandle,
IN LPGUID Guid,
OUT ULONG64 *LoggerContext
)
/*++
Routine Description:
This routine informs WMI that a data provider is no longer available
to receive requests for the guids previously registered. WMI will
unregister any guids registered with this handle.
Arguments:
WMIHandle - Handle returned from WMIRegisterGuids that represents
the guids whose data is not longer available.
Guid - Pointer to the control Guid which is unregistering
LoggerContext - Returned value of the LoggerContext
Return Value:
Returns status code
--*/
{
ULONG Status;
ULONG ReturnSize;
WMIUNREGGUIDS UnregGuids;
UnregGuids.RequestHandle.Handle = WMIHandle;
UnregGuids.Guid = *Guid;
Status = WmipSendWmiKMRequest(NULL,
IOCTL_WMI_UNREGISTER_GUIDS,
&UnregGuids,
sizeof(WMIUNREGGUIDS),
&UnregGuids,
sizeof(WMIUNREGGUIDS),
&ReturnSize,
NULL);
WmipSetLastError(Status);
return(Status);
}
ULONG
WmipFlushLogger(
IN OUT PWMI_LOGGER_INFORMATION LoggerInfo
)
/*++
Routine Description:
This is the actual routine to communicate with the kernel to start
the logger. All the required parameters must be in LoggerInfo.
Arguments:
LoggerInfo The actual parameters to be passed to and return from
kernel.
Return Value:
The status of performing the action requested.
--*/
{
ULONG Status;
ULONG BufferSize;
PTRACE_ENABLE_CONTEXT pContext;
if ( (LoggerInfo == NULL)
|| (LoggerInfo->Wnode.BufferSize < sizeof(WMI_LOGGER_INFORMATION))
|| (! (LoggerInfo->Wnode.Flags & WNODE_FLAG_TRACED_GUID))) {
return WmipSetDosError(ERROR_INVALID_PARAMETER);
}
pContext = (PTRACE_ENABLE_CONTEXT) & LoggerInfo->Wnode.HistoricalContext;
if ( (pContext->InternalFlag != 0)
&& (pContext->InternalFlag != EVENT_TRACE_INTERNAL_FLAG_PRIVATE)) {
// Currently only one possible InternalFlag value. This will filter
// out some bogus LoggerHandle
//
return WmipSetDosError(ERROR_INVALID_HANDLE);
}
if (LoggerInfo->LogFileMode & EVENT_TRACE_PRIVATE_LOGGER_MODE) {
Status = WmipSendUmLogRequest(
WmiFlushLoggerCode,
LoggerInfo
);
}
else {
Status = WmipSendWmiKMRequest( // actually start the logger here
NULL,
IOCTL_WMI_FLUSH_LOGGER,
LoggerInfo,
LoggerInfo->Wnode.BufferSize,
LoggerInfo,
LoggerInfo->Wnode.BufferSize,
&BufferSize,
NULL
);
}
return WmipSetDosError(Status);
}
#endif