mirror of https://github.com/tongzx/nt5src
You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
1401 lines
60 KiB
1401 lines
60 KiB
/*++
|
|
|
|
Copyright (c) Microsoft Corporation. All rights reserved.
|
|
|
|
Module Name:
|
|
|
|
ntwmi.h
|
|
|
|
Abstract:
|
|
|
|
definitions for WMI Flags and Event Id's
|
|
|
|
Author:
|
|
|
|
Stephen Hsiao
|
|
|
|
Environment:
|
|
|
|
Kernel and User modes
|
|
|
|
Revision History:
|
|
|
|
|
|
--*/
|
|
|
|
#ifndef _NTWMI_
|
|
#define _NTWMI_
|
|
|
|
#ifndef ETW_WOW6432
|
|
|
|
#include <evntrace.h>
|
|
|
|
// Alignment macros
|
|
#define DEFAULT_TRACE_ALIGNMENT 8 // 8 byte alignment
|
|
#define ALIGN_TO_POWER2( x, n ) (((ULONG)(x) + ((n)-1)) & ~((ULONG)(n)-1))
|
|
|
|
//
|
|
// The predefined event groups or families for NT subsystems
|
|
//
|
|
|
|
#define EVENT_TRACE_GROUP_HEADER 0x0000
|
|
#define EVENT_TRACE_GROUP_IO 0x0100
|
|
#define EVENT_TRACE_GROUP_MEMORY 0x0200
|
|
#define EVENT_TRACE_GROUP_PROCESS 0x0300
|
|
#define EVENT_TRACE_GROUP_FILE 0x0400
|
|
#define EVENT_TRACE_GROUP_THREAD 0x0500
|
|
#define EVENT_TRACE_GROUP_TCPIP 0x0600
|
|
#define EVENT_TRACE_GROUP_IPXSPX 0x0700
|
|
#define EVENT_TRACE_GROUP_UDPIP 0x0800
|
|
#define EVENT_TRACE_GROUP_REGISTRY 0x0900
|
|
#define EVENT_TRACE_GROUP_DBGPRINT 0x0A00
|
|
#define EVENT_TRACE_GROUP_CONFIG 0x0B00
|
|
|
|
#define EVENT_TRACE_GROUP_POOL 0x0E00
|
|
#define EVENT_TRACE_GROUP_PERFINFO 0x0F00
|
|
#define EVENT_TRACE_GROUP_HEAP 0x1000
|
|
#define EVENT_TRACE_GROUP_OBJECT 0x1100
|
|
#define EVENT_TRACE_GROUP_POWER 0x1200
|
|
#define EVENT_TRACE_GROUP_MODBOUND 0x1300
|
|
#define EVENT_TRACE_GROUP_TBD 0x1400
|
|
#define EVENT_TRACE_GROUP_DPC 0x1500
|
|
#define EVENT_TRACE_GROUP_GDI 0x1600
|
|
#define EVENT_TRACE_GROUP_CRITSEC 0x1700
|
|
|
|
//
|
|
// The highest order bit of a data block is set if trace, WNODE otherwise
|
|
//
|
|
#define TRACE_HEADER_FLAG 0x80000000
|
|
|
|
// Header type for tracing messages
|
|
// | Marker(8) | Reserved(8) | Size(16) | MessageNumber(16) | Flags(16)
|
|
#define TRACE_MESSAGE 0x10000000
|
|
|
|
// | MARKER(16) | SIZE (16) | ULONG32 |
|
|
#define TRACE_HEADER_ULONG32 0xA0000000
|
|
|
|
// | MARKER(16) | SIZE (16) | ULONG 32 | TIME_STAMP ...
|
|
#define TRACE_HEADER_ULONG32_TIME 0xB0000000
|
|
|
|
//
|
|
// The second bit is set if the trace is used by PM & CP (fixed headers)
|
|
// If not, the data block is used by for finer data for performance analysis
|
|
//
|
|
#define TRACE_HEADER_EVENT_TRACE 0x40000000
|
|
//
|
|
// If set, the data block is SYSTEM_TRACE_HEADER
|
|
//
|
|
#define TRACE_HEADER_ENUM_MASK 0x00FF0000
|
|
|
|
//
|
|
// The following are various header type
|
|
//
|
|
#define TRACE_HEADER_TYPE_SYSTEM32 1
|
|
#define TRACE_HEADER_TYPE_SYSTEM64 2
|
|
#define TRACE_HEADER_TYPE_FULL_HEADER 10
|
|
#define TRACE_HEADER_TYPE_INSTANCE 11
|
|
#define TRACE_HEADER_TYPE_TIMED 12
|
|
#define TRACE_HEADER_TYPE_ULONG32 13
|
|
#define TRACE_HEADER_TYPE_WNODE_HEADER 14
|
|
#define TRACE_HEADER_TYPE_MESSAGE 15
|
|
#define TRACE_HEADER_TYPE_PERFINFO32 16
|
|
#define TRACE_HEADER_TYPE_PERFINFO64 17
|
|
|
|
#define SYSTEM_TRACE_VERSION 1
|
|
|
|
#ifdef _WIN64
|
|
#define PERFINFO_TRACE_MARKER TRACE_HEADER_FLAG | TRACE_HEADER_EVENT_TRACE \
|
|
| (TRACE_HEADER_TYPE_PERFINFO64 << 16) | SYSTEM_TRACE_VERSION
|
|
|
|
#define SYSTEM_TRACE_MARKER TRACE_HEADER_FLAG | TRACE_HEADER_EVENT_TRACE \
|
|
| (TRACE_HEADER_TYPE_SYSTEM64 << 16) | SYSTEM_TRACE_VERSION
|
|
#else
|
|
#define PERFINFO_TRACE_MARKER TRACE_HEADER_FLAG | TRACE_HEADER_EVENT_TRACE \
|
|
| (TRACE_HEADER_TYPE_PERFINFO32 << 16) | SYSTEM_TRACE_VERSION
|
|
|
|
#define SYSTEM_TRACE_MARKER TRACE_HEADER_FLAG | TRACE_HEADER_EVENT_TRACE \
|
|
| (TRACE_HEADER_TYPE_SYSTEM32 << 16) | SYSTEM_TRACE_VERSION
|
|
#endif
|
|
|
|
//
|
|
// Support a maximum of 64 logger instances. One is reserved for the kernel.
|
|
#define MAXLOGGERS 64
|
|
|
|
//
|
|
// Set of Internal Flags passed to the Logger via ClientContext during StartTrace
|
|
//
|
|
|
|
#define EVENT_TRACE_CLOCK_RAW 0x00000000 // Use Raw timestamp
|
|
#define EVENT_TRACE_CLOCK_PERFCOUNTER 0x00000001 // Use HighPerfClock (Default)
|
|
#define EVENT_TRACE_CLOCK_SYSTEMTIME 0x00000002 // Use SystemTime
|
|
#define EVENT_TRACE_CLOCK_CPUCYCLE 0x00000003 // Use CPU cycle counter
|
|
|
|
// begin_wmikm
|
|
//
|
|
// Public routines to break down the Loggerhandle
|
|
//
|
|
#define KERNEL_LOGGER_ID 0xFFFF // USHORT only
|
|
|
|
typedef struct _TRACE_ENABLE_CONTEXT {
|
|
USHORT LoggerId; // Actual Id of the logger
|
|
UCHAR Level; // Enable level passed by control caller
|
|
UCHAR InternalFlag; // Reserved
|
|
ULONG EnableFlags; // Enable flags passed by control caller
|
|
} TRACE_ENABLE_CONTEXT, *PTRACE_ENABLE_CONTEXT;
|
|
|
|
|
|
#define WmiGetLoggerId(LoggerContext) \
|
|
(((PTRACE_ENABLE_CONTEXT) (&LoggerContext))->LoggerId == \
|
|
(USHORT)KERNEL_LOGGER_ID) ? \
|
|
KERNEL_LOGGER_ID : \
|
|
((PTRACE_ENABLE_CONTEXT) (&LoggerContext))->LoggerId
|
|
|
|
#define WmiGetLoggerEnableFlags(LoggerContext) \
|
|
((PTRACE_ENABLE_CONTEXT) (&LoggerContext))->EnableFlags
|
|
#define WmiGetLoggerEnableLevel(LoggerContext) \
|
|
((PTRACE_ENABLE_CONTEXT) (&LoggerContext))->Level
|
|
|
|
#define WmiSetLoggerId(Id, Context) \
|
|
(((PTRACE_ENABLE_CONTEXT)Context)->LoggerId = (Id ? \
|
|
(USHORT)Id: (USHORT)KERNEL_LOGGER_ID));
|
|
|
|
// end_wmikm
|
|
|
|
//
|
|
// NOTE: The following should not overlap with other bits in the LogFileMode
|
|
// or LoggerMode defined in evntrace.h. Placed here since it is for internal
|
|
// use only.
|
|
//
|
|
|
|
#define EVENT_TRACE_KD_FILTER_MODE 0x00080000 // KD_FILTER
|
|
|
|
//
|
|
// see evntrace.h for pre-defined generic event types (0-10)
|
|
//
|
|
|
|
typedef struct _WMI_TRACE_PACKET { // must be ULONG!!
|
|
USHORT Size;
|
|
union{
|
|
USHORT HookId;
|
|
struct {
|
|
UCHAR Type;
|
|
UCHAR Group;
|
|
};
|
|
};
|
|
} WMI_TRACE_PACKET, *PWMI_TRACE_PACKET;
|
|
|
|
typedef struct _WMI_CLIENT_CONTEXT {
|
|
UCHAR ProcessorNumber;
|
|
UCHAR Alignment;
|
|
USHORT LoggerId;
|
|
} WMI_CLIENT_CONTEXT, *PWMI_CLIENT_CONTEXT;
|
|
|
|
typedef ULONGLONG PERFINFO_TIMESTAMP;
|
|
typedef struct _PERFINFO_TRACE_HEADER PERFINFO_TRACE_ENTRY, *PPERFINFO_TRACE_ENTRY;
|
|
|
|
//
|
|
// 64-bit Trace header for NTPERF events
|
|
//
|
|
// Note. The field "Version" will temporary be used to log CPU Id when log to PerfMem.
|
|
// This will be removed after we change the buffer management to be the same as WMI.
|
|
// i.e., Each CPU will allocate a block of memory for logging and CPU id is in the header
|
|
// of each block.
|
|
//
|
|
typedef struct _PERFINFO_TRACE_HEADER {
|
|
union {
|
|
ULONG Marker;
|
|
struct {
|
|
USHORT Version;
|
|
UCHAR HeaderType;
|
|
UCHAR Flags; //WMI uses this flag to identify event types
|
|
};
|
|
};
|
|
union {
|
|
ULONG Header; // both sizes must be the same!
|
|
WMI_TRACE_PACKET Packet;
|
|
};
|
|
union {
|
|
PERFINFO_TIMESTAMP TS;
|
|
LARGE_INTEGER SystemTime;
|
|
};
|
|
UCHAR Data[1];
|
|
} PERFINFO_TRACE_HEADER, *PPERFINFO_TRACE_HEADER;
|
|
|
|
//
|
|
// 64-bit Trace header for kernel events
|
|
//
|
|
typedef struct _SYSTEM_TRACE_HEADER {
|
|
union {
|
|
ULONG Marker;
|
|
struct {
|
|
USHORT Version;
|
|
UCHAR HeaderType;
|
|
UCHAR Flags;
|
|
};
|
|
};
|
|
union {
|
|
ULONG Header; // both sizes must be the same!
|
|
WMI_TRACE_PACKET Packet;
|
|
};
|
|
ULONG ThreadId;
|
|
ULONG ProcessId;
|
|
LARGE_INTEGER SystemTime;
|
|
ULONG KernelTime;
|
|
ULONG UserTime;
|
|
} SYSTEM_TRACE_HEADER, *PSYSTEM_TRACE_HEADER;
|
|
|
|
//
|
|
// 64-bit Trace Header for Tracing Messages
|
|
//
|
|
|
|
typedef struct _WMI_TRACE_MESSAGE_PACKET { // must be ULONG!!
|
|
USHORT MessageNumber; // The message Number, index of messages by GUID
|
|
// Or ComponentID
|
|
USHORT OptionFlags ; // Flags associated with the message
|
|
} WMI_TRACE_MESSAGE_PACKET, *PWMI_TRACE_MESSAGE_PACKET;
|
|
|
|
typedef struct _MESSAGE_TRACE_HEADER {
|
|
union {
|
|
ULONG Marker;
|
|
struct {
|
|
USHORT Size; // Total Size of the message including header
|
|
UCHAR Reserved; // Unused and reserved
|
|
UCHAR Version; // The message structure type (TRACE_MESSAGE_FLAG)
|
|
};
|
|
};
|
|
union {
|
|
ULONG Header; // both sizes must be the same!
|
|
WMI_TRACE_MESSAGE_PACKET Packet;
|
|
};
|
|
} MESSAGE_TRACE_HEADER, *PMESSAGE_TRACE_HEADER;
|
|
|
|
typedef struct _MESSAGE_TRACE {
|
|
MESSAGE_TRACE_HEADER MessageHeader ;
|
|
UCHAR Data ;
|
|
} MESSAGE_TRACE, *PMESSAGE_TRACE ;
|
|
|
|
//
|
|
// Structure used to pass user log messages to the kernel
|
|
//
|
|
typedef struct _MESSAGE_TRACE_USER {
|
|
MESSAGE_TRACE_HEADER MessageHeader ;
|
|
ULONG MessageFlags ;
|
|
ULONG64 LoggerHandle ;
|
|
GUID MessageGuid ;
|
|
ULONG DataSize ;
|
|
UCHAR Data ;
|
|
} MESSAGE_TRACE_USER, *PMESSAGE_TRACE_USER ;
|
|
|
|
|
|
#ifndef MEMPHIS
|
|
|
|
//
|
|
// Logger configuration and running statistics. This structure is used
|
|
// by WMI.DLL to convert to UNICODE_STRING
|
|
//
|
|
// begin_wmikm
|
|
typedef struct _WMI_LOGGER_INFORMATION {
|
|
WNODE_HEADER Wnode; // Had to do this since wmium.h comes later
|
|
//
|
|
// data provider by caller
|
|
ULONG BufferSize; // buffer size for logging (in kbytes)
|
|
ULONG MinimumBuffers; // minimum to preallocate
|
|
ULONG MaximumBuffers; // maximum buffers allowed
|
|
ULONG MaximumFileSize; // maximum logfile size (in MBytes)
|
|
ULONG LogFileMode; // sequential, circular
|
|
ULONG FlushTimer; // buffer flush timer, in seconds
|
|
ULONG EnableFlags; // trace enable flags
|
|
LONG AgeLimit; // aging decay time, in minutes
|
|
union {
|
|
HANDLE LogFileHandle; // handle to logfile
|
|
ULONG64 LogFileHandle64;
|
|
};
|
|
|
|
// data returned to caller
|
|
// end_wmikm
|
|
union {
|
|
// begin_wmikm
|
|
ULONG NumberOfBuffers; // no of buffers in use
|
|
// end_wmikm
|
|
ULONG InstanceCount; // Number of Provider Instances
|
|
};
|
|
union {
|
|
// begin_wmikm
|
|
ULONG FreeBuffers; // no of buffers free
|
|
// end_wmikm
|
|
ULONG InstanceId; // Current Provider's Id for UmLogger
|
|
};
|
|
union {
|
|
// begin_wmikm
|
|
ULONG EventsLost; // event records lost
|
|
// end_wmikm
|
|
ULONG NumberOfProcessors; // Passed on to UmLogger
|
|
};
|
|
// begin_wmikm
|
|
ULONG BuffersWritten; // no of buffers written to file
|
|
ULONG LogBuffersLost; // no of logfile write failures
|
|
ULONG RealTimeBuffersLost; // no of rt delivery failures
|
|
union {
|
|
HANDLE LoggerThreadId; // thread id of Logger
|
|
ULONG64 LoggerThreadId64; // thread is of Logger
|
|
};
|
|
union {
|
|
UNICODE_STRING LogFileName; // used only in WIN64
|
|
UNICODE_STRING64 LogFileName64; // Logfile name: only in WIN32
|
|
};
|
|
|
|
// mandatory data provided by caller
|
|
union {
|
|
UNICODE_STRING LoggerName; // Logger instance name in WIN64
|
|
UNICODE_STRING64 LoggerName64; // Logger Instance name in WIN32
|
|
};
|
|
|
|
// private
|
|
union {
|
|
PVOID Checksum;
|
|
ULONG64 Checksum64;
|
|
};
|
|
union {
|
|
PVOID LoggerExtension;
|
|
ULONG64 LoggerExtension64;
|
|
};
|
|
} WMI_LOGGER_INFORMATION, *PWMI_LOGGER_INFORMATION;
|
|
|
|
//
|
|
// structure for NTDLL tracing
|
|
//
|
|
|
|
typedef struct
|
|
{
|
|
BOOLEAN IsGet;
|
|
PWMI_LOGGER_INFORMATION LoggerInfo;
|
|
} WMINTDLLLOGGERINFO, *PWMINTDLLLOGGERINFO;
|
|
|
|
typedef struct _TIMED_TRACE_HEADER {
|
|
USHORT Size;
|
|
USHORT Marker;
|
|
ULONG32 EventId;
|
|
union {
|
|
LARGE_INTEGER TimeStamp;
|
|
ULONG64 LoggerId;
|
|
};
|
|
} TIMED_TRACE_HEADER, *PTIMED_TRACE_HEADER;
|
|
|
|
// end_wmikm
|
|
// the circular buffer pool, using forward linked list
|
|
|
|
#endif //!MEMPHIS
|
|
|
|
#define WMI_NON_BLOCKING
|
|
|
|
#ifdef WMI_NON_BLOCKING
|
|
typedef struct _WMI_BUFFER_STATE {
|
|
ULONG Free:1;
|
|
ULONG InUse:1;
|
|
ULONG Flush:1;
|
|
ULONG Unused:29;
|
|
} WMI_BUFFER_STATE, *PWMI_BUFFER_STATE;
|
|
#endif //WMI_NON_BLOCKING
|
|
|
|
#define WNODE_FLAG_THREAD_BUFFER 0x00800000
|
|
|
|
typedef struct _WMI_BUFFER_HEADER {
|
|
union {
|
|
WNODE_HEADER Wnode;
|
|
struct {
|
|
ULONG64 Reserved1;
|
|
ULONG64 Reserved2;
|
|
LARGE_INTEGER Reserved3;
|
|
#ifdef WMI_NON_BLOCKING
|
|
union{
|
|
struct {
|
|
PVOID Alignment;
|
|
SINGLE_LIST_ENTRY SlistEntry;
|
|
};
|
|
LIST_ENTRY Entry;
|
|
};
|
|
#else
|
|
LIST_ENTRY Entry;
|
|
#endif //WMI_NON_BLOCKING
|
|
};
|
|
struct {
|
|
LONG ReferenceCount; // Buffer reference count
|
|
ULONG SavedOffset; // Temp saved offset
|
|
ULONG CurrentOffset; // Current offset
|
|
ULONG UsePerfClock; // UsePerfClock flag
|
|
LARGE_INTEGER TimeStamp;
|
|
GUID Guid;
|
|
WMI_CLIENT_CONTEXT ClientContext;
|
|
#ifdef WMI_NON_BLOCKING
|
|
union {
|
|
WMI_BUFFER_STATE State;
|
|
ULONG Flags;
|
|
};
|
|
#else
|
|
ULONG Flags;
|
|
#endif //WMI_NON_BLOCKING
|
|
};
|
|
};
|
|
ULONG Offset;
|
|
ULONG EventsLost;
|
|
union {
|
|
GUID InstanceGuid;
|
|
struct {
|
|
PVOID LoggerContext;
|
|
#ifdef WMI_NON_BLOCKING
|
|
SINGLE_LIST_ENTRY GlobalEntry;
|
|
#endif //WMI_NON_BLOCKING
|
|
};
|
|
};
|
|
} WMI_BUFFER_HEADER, *PWMI_BUFFER_HEADER;
|
|
|
|
typedef struct _TRACE_ENABLE_FLAG_EXTENSION {
|
|
USHORT Offset; // Offset to the flag array in structure
|
|
UCHAR Length; // Length of flag array in ULONGs
|
|
UCHAR Flag; // Must be set to EVENT_TRACE_FLAG_EXTENSION
|
|
} TRACE_ENABLE_FLAG_EXTENSION, *PTRACE_ENABLE_FLAG_EXTENSION;
|
|
|
|
typedef struct _WMI_SET_MARK_INFORMATION {
|
|
ULONG Flag;
|
|
WCHAR Mark[1];
|
|
} WMI_SET_MARK_INFORMATION, *PWMI_SET_MARK_INFORMATION;
|
|
|
|
#define WMI_SET_MARK_WITH_FLUSH 0x00000001
|
|
|
|
#ifdef NTPERF
|
|
typedef struct _WMI_SWITCH_PERFMEM_BUFFER_INFORMATION {
|
|
PWMI_BUFFER_HEADER Buffer;
|
|
ULONG ProcessorId;
|
|
} WMI_SWITCH_PERFMEM_BUFFER_INFORMATION, *PWMI_SWITCH_PERFMEM_BUFFER_INFORMATION;
|
|
#endif //NTPERF
|
|
|
|
// Public Enable flags are defined in envtrace.h.
|
|
//
|
|
// This section contains extended enable flags whcih are private.
|
|
//
|
|
// Each PerfMacros Hook Contains a GlobalMask and a Hook Id.
|
|
// The Global Mask is Used For Grouping Hooks by logical type
|
|
// - I/O related Hooks are Grouped together under
|
|
// PERF_FILE_IO or PERF_DISK_IO
|
|
// - Loader related Hooks are grouped together
|
|
// under PERF_LOADER,
|
|
// - etc
|
|
// The data for a particular hook will only be logged
|
|
// if the Global Mask of the particular Hook is set.
|
|
//
|
|
// WHEN YOU ADD NEW GROUPS, UPDATE THE NAME TABLE in perfgroups.c:
|
|
// PerfGroupNames Note: If you modify numeric value of a group, update
|
|
// PerfKnownFlags table
|
|
//
|
|
// we have a set of 8 global masks available. the highest 3 bits in
|
|
// PERF_MASK_INDEX region determine to which set a particular
|
|
// global group belongs. if PERF_MASK_INDEX is 0xe0000000
|
|
// all of the following can be unique groups that can be
|
|
// turned on or of individually and used when logging data:
|
|
//
|
|
// #define PERF_GROUP1 0x00400000 in the 0th set
|
|
// #define PERF_GROUP2 0x20400000 in the 1st set
|
|
// #define PERF_GROUP3 0x40400000 in the 2nd set
|
|
// ...
|
|
// #define PERF_GROUP2 0xe0400000 in the 7th set
|
|
//
|
|
// See ntperf.h for the manupulation of flags
|
|
//
|
|
//
|
|
// Currently, no GlobalMask change is supported.
|
|
//
|
|
// Merging logging with WMI, we will use the first global mask for flags used
|
|
// by both PERF and WMI
|
|
//
|
|
// GlobalMask 0: ALL masks used in WMI defined in evntrace.h.
|
|
// These PERF_xxx are going away after we merge with WMI completely.
|
|
//
|
|
|
|
#define PERF_REGISTRY EVENT_TRACE_FLAG_REGISTRY
|
|
#define PERF_FILE_IO EVENT_TRACE_FLAG_MEMORY_HARD_FAULTS
|
|
#define PERF_PROC_THREAD EVENT_TRACE_FLAG_PROCESS | EVENT_TRACE_FLAG_THREAD
|
|
#define PERF_DISK_IO EVENT_TRACE_FLAG_DISK_FILE_IO | EVENT_TRACE_FLAG_DISK_IO
|
|
#define PERF_LOADER EVENT_TRACE_FLAG_IMAGE_LOAD
|
|
#define PERF_ALL_FAULTS EVENT_TRACE_FLAG_MEMORY_PAGE_FAULTS
|
|
#define PERF_FILENAME EVENT_TRACE_FLAG_DISK_FILE_IO
|
|
#define PERF_NETWORK EVENT_TRACE_FLAG_NETWORK_TCPIP
|
|
|
|
//
|
|
// GlobalMask 1: The candidates to be checked into retails
|
|
//
|
|
#define PERF_MEMORY 0x20000001 // High level WS manager activities, PFN changes
|
|
#define PERF_PROFILE 0x20000002 // Sysprof
|
|
#define PERF_CONTEXT_SWITCH 0x20000004 // Context Switch
|
|
#define PERF_FOOTPRINT 0x20000008 // Flush WS on every mark_with_flush
|
|
#define PERF_DRIVERS 0x20000010
|
|
#define PERF_ADDTOWS 0x20000020
|
|
#define PERF_VERSION 0x20000040
|
|
#define PERF_DPC 0x20000080
|
|
#define PERF_SHUTDOWN 0x20000100
|
|
#define PERF_HIBER 0x20000200
|
|
#define PERF_RESUME 0x20000400
|
|
#define PERF_EXCEPTION 0x20000800
|
|
#define PERF_FILENAME_ALL 0x20001000
|
|
#define PERF_INTERRUPT 0x20004000
|
|
|
|
//
|
|
// GlobalMask 2: The candidate to remain in NTPERF
|
|
//
|
|
|
|
#define PERF_UNDEFINED 0x40000001
|
|
#define PERF_POOL 0x40000002
|
|
#define PERF_FOOTPRINT_PROC 0x40000004 // Get details WS count or pfn
|
|
#define PERF_WS_DETAIL 0x40000008 //
|
|
#define PERF_WS_ENTRY 0x40000010 //
|
|
#define PERF_HEAP 0x40000020
|
|
#define PERF_SYSCALL 0x40000040
|
|
#define PERF_WMI_TRACE 0x40000080 // Indicate to log all WMI events
|
|
#define PERF_BACKTRACE 0x40000100
|
|
#define PERF_VULCAN 0x40000200
|
|
#define PERF_OBJECTS 0x40000400
|
|
#define PERF_EVENTS 0x40000800
|
|
#define PERF_FULLTRACE 0x40001000
|
|
#define PERF_FAILED_STKDUMP 0x40002000
|
|
#define PERF_PREFETCH 0x40004000
|
|
#define PERF_FONTS 0x40008000
|
|
|
|
//
|
|
// GlobalMask 3: The candidate to be removed soon
|
|
//
|
|
#define PERF_SERVICES 0x80000002
|
|
#define PERF_MASK_CHANGE 0x80000004
|
|
#define PERF_DLL_INFO 0x80000008
|
|
#define PERF_DLL_FLUSH_WS 0x80000010
|
|
#define PERF_CLEARWS 0x80000020
|
|
#define PERF_MEMORY_SNAPSHOT 0x80000040
|
|
#define PERF_NO_MASK_CHANGE 0x80000080
|
|
#define PERF_DATA_ACCESS 0x80000100
|
|
#define PERF_MISC 0x80000200
|
|
#define PERF_READYQUEUE 0x80000400
|
|
#define PERF_MULTIMEDIA 0x80000800
|
|
#define PERF_PROC_ATTACH 0x80001000
|
|
#define PERF_DSHOW_DETAILED 0x80002000
|
|
#define PERF_DSHOW_SAMPLES 0x80004000
|
|
#define PERF_POWER 0x80008000
|
|
#define PERF_SOFT_TRIM 0x80010000
|
|
#define PERF_DLL_THREAD_ATTACH_FLUSH_WS 0x80020000
|
|
#define PERF_DLL_THREAD_DETACH_FLUSH_WS 0x80040000
|
|
|
|
//
|
|
// GlobalMask 7: The mark is a control mask. All flags that changes system
|
|
// behaviors go here.
|
|
//
|
|
#define PERF_CLUSTER_OFF 0xe0000001
|
|
#define PERF_BIGFOOT 0xe0000002
|
|
|
|
//
|
|
// Converting old PERF hooks into WMI format. More clean up to be done.
|
|
//
|
|
// WHEN YOU ADD NEW TYPES UPDATE THE NAME TABLE in perfgroups.c:
|
|
// PerfLogTypeNames ALSO UPDATE VERIFICATION TABLE IN PERFPOSTTBLS.C
|
|
//
|
|
|
|
//
|
|
// Event for header
|
|
//
|
|
#define WMI_LOG_TYPE_HEADER (EVENT_TRACE_GROUP_HEADER | EVENT_TRACE_TYPE_INFO)
|
|
|
|
//
|
|
// Event for hardware config
|
|
//
|
|
#define WMI_LOG_TYPE_CONFIG_CPU (EVENT_TRACE_GROUP_CONFIG | EVENT_TRACE_TYPE_CONFIG_CPU)
|
|
#define WMI_LOG_TYPE_CONFIG_PHYSICALDISK (EVENT_TRACE_GROUP_CONFIG | EVENT_TRACE_TYPE_CONFIG_PHYSICALDISK)
|
|
#define WMI_LOG_TYPE_CONFIG_LOGICALDISK (EVENT_TRACE_GROUP_CONFIG | EVENT_TRACE_TYPE_CONFIG_LOGICALDISK)
|
|
#define WMI_LOG_TYPE_CONFIG_NIC (EVENT_TRACE_GROUP_CONFIG | EVENT_TRACE_TYPE_CONFIG_NIC)
|
|
#define WMI_LOG_TYPE_CONFIG_VIDEO (EVENT_TRACE_GROUP_CONFIG | EVENT_TRACE_TYPE_CONFIG_VIDEO)
|
|
//
|
|
//Event for Image and File Name
|
|
//
|
|
#define PERFINFO_LOG_TYPE_FILENAME (EVENT_TRACE_GROUP_FILE | EVENT_TRACE_TYPE_INFO)
|
|
#define PERFINFO_LOG_TYPE_FILENAME_CREATE (EVENT_TRACE_GROUP_FILE | 0x20)
|
|
#define PERFINFO_LOG_TYPE_FILENAME_SECTION1 (EVENT_TRACE_GROUP_FILE | 0x21)
|
|
|
|
|
|
//
|
|
//Event types for Process
|
|
//
|
|
#define WMI_LOG_TYPE_PROCESS_CREATE (EVENT_TRACE_GROUP_PROCESS | EVENT_TRACE_TYPE_START)
|
|
#define WMI_LOG_TYPE_PROCESS_DELETE (EVENT_TRACE_GROUP_PROCESS | EVENT_TRACE_TYPE_END)
|
|
#define WMI_LOG_TYPE_PROCESS_DC_START (EVENT_TRACE_GROUP_PROCESS | EVENT_TRACE_TYPE_DC_START)
|
|
#define WMI_LOG_TYPE_PROCESS_DC_END (EVENT_TRACE_GROUP_PROCESS | EVENT_TRACE_TYPE_DC_END)
|
|
#define WMI_LOG_TYPE_PROCESS_LOAD_IMAGE (EVENT_TRACE_GROUP_PROCESS | EVENT_TRACE_TYPE_LOAD)
|
|
|
|
#define PERFINFO_LOG_TYPE_PROCESSNAME (EVENT_TRACE_GROUP_PROCESS | 0x20) // To be replaced with WMI hooks
|
|
#define PERFINFO_LOG_TYPE_DIEDPROCESS (EVENT_TRACE_GROUP_PROCESS | 0x21) // To be replaced with WMI hooks
|
|
#define PERFINFO_LOG_TYPE_OUTSWAPPROCESS (EVENT_TRACE_GROUP_PROCESS | 0x22) // going away
|
|
#define PERFINFO_LOG_TYPE_INSWAPPROCESS (EVENT_TRACE_GROUP_PROCESS | 0x23)
|
|
#define PERFINFO_LOG_TYPE_IMAGELOAD (EVENT_TRACE_GROUP_PROCESS | 0x24) // To be replaced with WMI hooks
|
|
#define PERFINFO_LOG_TYPE_IMAGEUNLOAD (EVENT_TRACE_GROUP_PROCESS | 0x25)
|
|
#define PERFINFO_LOG_TYPE_BOOT_PHASE_START (EVENT_TRACE_GROUP_PROCESS | 0x26)
|
|
|
|
//
|
|
//Event types for Thread
|
|
//
|
|
#define WMI_LOG_TYPE_THREAD_CREATE (EVENT_TRACE_GROUP_THREAD | EVENT_TRACE_TYPE_START)
|
|
#define WMI_LOG_TYPE_THREAD_DELETE (EVENT_TRACE_GROUP_THREAD | EVENT_TRACE_TYPE_END)
|
|
#define WMI_LOG_TYPE_THREAD_DC_START (EVENT_TRACE_GROUP_THREAD | EVENT_TRACE_TYPE_DC_START)
|
|
#define WMI_LOG_TYPE_THREAD_DC_END (EVENT_TRACE_GROUP_THREAD | EVENT_TRACE_TYPE_DC_END)
|
|
|
|
#define PERFINFO_LOG_TYPE_CREATETHREAD (EVENT_TRACE_GROUP_THREAD | 0x20) // To be replaced with WMI hooks
|
|
#define PERFINFO_LOG_TYPE_TERMINATETHREAD (EVENT_TRACE_GROUP_THREAD | 0x21) // To be replaced with WMI hooks
|
|
#define PERFINFO_LOG_TYPE_GROWKERNELSTACK (EVENT_TRACE_GROUP_THREAD | 0x22)
|
|
#define PERFINFO_LOG_TYPE_CONVERTTOGUITHREAD (EVENT_TRACE_GROUP_THREAD | 0x23)
|
|
#define PERFINFO_LOG_TYPE_CONTEXTSWAP (EVENT_TRACE_GROUP_THREAD | 0x24) // new context swap struct
|
|
#define PERFINFO_LOG_TYPE_THREAD_RESERVED1 (EVENT_TRACE_GROUP_THREAD | 0x25)
|
|
#define PERFINFO_LOG_TYPE_THREAD_RESERVED2 (EVENT_TRACE_GROUP_THREAD | 0x26)
|
|
#define PERFINFO_LOG_TYPE_OUTSWAPSTACK (EVENT_TRACE_GROUP_THREAD | 0x27) // going away
|
|
#define PERFINFO_LOG_TYPE_INSWAPSTACK (EVENT_TRACE_GROUP_THREAD | 0x28) // going away
|
|
|
|
//
|
|
// Event types for IO subsystem
|
|
//
|
|
#define WMI_LOG_TYPE_TCPIP_SEND (EVENT_TRACE_GROUP_TCPIP | EVENT_TRACE_TYPE_SEND)
|
|
#define WMI_LOG_TYPE_TCPIP_RECEIVE (EVENT_TRACE_GROUP_TCPIP | EVENT_TRACE_TYPE_RECEIVE)
|
|
#define WMI_LOG_TYPE_TCPIP_CONNECT (EVENT_TRACE_GROUP_TCPIP | EVENT_TRACE_TYPE_CONNECT)
|
|
#define WMI_LOG_TYPE_TCPIP_DISCONNECT (EVENT_TRACE_GROUP_TCPIP | EVENT_TRACE_TYPE_DISCONNECT)
|
|
#define WMI_LOG_TYPE_TCPIP_RETRANSMIT (EVENT_TRACE_GROUP_TCPIP | EVENT_TRACE_TYPE_RETRANSMIT)
|
|
#define WMI_LOG_TYPE_TCPIP_ACCEPT (EVENT_TRACE_GROUP_TCPIP | EVENT_TRACE_TYPE_ACCEPT)
|
|
|
|
#define WMI_LOG_TYPE_UDP_SEND (EVENT_TRACE_GROUP_UDPIP | EVENT_TRACE_TYPE_SEND)
|
|
#define WMI_LOG_TYPE_UDP_RECEIVE (EVENT_TRACE_GROUP_UDPIP | EVENT_TRACE_TYPE_RECEIVE)
|
|
|
|
#define WMI_LOG_TYPE_IO_READ (EVENT_TRACE_GROUP_IO | EVENT_TRACE_TYPE_IO_READ)
|
|
#define WMI_LOG_TYPE_IO_WRITE (EVENT_TRACE_GROUP_IO | EVENT_TRACE_TYPE_IO_WRITE)
|
|
|
|
#define PERFINFO_LOG_TYPE_DRIVER_INIT (EVENT_TRACE_GROUP_IO | 0x20)
|
|
#define PERFINFO_LOG_TYPE_DRIVER_INIT_COMPLETE (EVENT_TRACE_GROUP_IO | 0x21)
|
|
#define PERFINFO_LOG_TYPE_DRIVER_MAJORFUNCTION_CALL (EVENT_TRACE_GROUP_IO | 0x22)
|
|
#define PERFINFO_LOG_TYPE_DRIVER_MAJORFUNCTION_RETURN (EVENT_TRACE_GROUP_IO | 0x23)
|
|
#define PERFINFO_LOG_TYPE_DRIVER_COMPLETIONROUTINE_CALL (EVENT_TRACE_GROUP_IO | 0x24)
|
|
#define PERFINFO_LOG_TYPE_DRIVER_COMPLETIONROUTINE_RETURN (EVENT_TRACE_GROUP_IO | 0x25)
|
|
#define PERFINFO_LOG_TYPE_DRIVER_ADD_DEVICE_CALL (EVENT_TRACE_GROUP_IO | 0x26)
|
|
#define PERFINFO_LOG_TYPE_DRIVER_ADD_DEVICE_RETURN (EVENT_TRACE_GROUP_IO | 0x27)
|
|
#define PERFINFO_LOG_TYPE_DRIVER_STARTIO_CALL (EVENT_TRACE_GROUP_IO | 0x28)
|
|
#define PERFINFO_LOG_TYPE_DRIVER_STARTIO_RETURN (EVENT_TRACE_GROUP_IO | 0x29)
|
|
#define PERFINFO_LOG_TYPE_WMI_DISKPERF_READ (EVENT_TRACE_GROUP_IO | 0x2a) // To be replaced with WMI hooks
|
|
#define PERFINFO_LOG_TYPE_WMI_DISKPERF_WRITE (EVENT_TRACE_GROUP_IO | 0x2b) // To be replaced with WMI hooks
|
|
#define PERFINFO_LOG_TYPE_WMI_DISKPERF_READ_COMPLETE (EVENT_TRACE_GROUP_IO | 0x2c) // To be replaced with WMI hooks
|
|
#define PERFINFO_LOG_TYPE_WMI_DISKPERF_WRITE_COMPLETE (EVENT_TRACE_GROUP_IO | 0x2d) // To be replaced with WMI hooks
|
|
#define PERFINFO_LOG_TYPE_WMI_DISKPERF_CACHED_READ_COMPLETE (EVENT_TRACE_GROUP_IO | 0x2e)
|
|
#define PERFINFO_LOG_TYPE_WMI_DISKPERF_CACHE_WARM_COMPLETE (EVENT_TRACE_GROUP_IO | 0x2f)
|
|
#define PERFINFO_LOG_TYPE_PREFETCH_ACTION (EVENT_TRACE_GROUP_IO | 0x30)
|
|
#define PERFINFO_LOG_TYPE_PREFETCH_REQUEST (EVENT_TRACE_GROUP_IO | 0x31)
|
|
#define PERFINFO_LOG_TYPE_PREFETCH_READLIST (EVENT_TRACE_GROUP_IO | 0x32)
|
|
#define PERFINFO_LOG_TYPE_PREFETCH_READ (EVENT_TRACE_GROUP_IO | 0x33)
|
|
#define PERFINFO_LOG_TYPE_DRIVER_COMPLETE_REQUEST (EVENT_TRACE_GROUP_IO | 0x34)
|
|
#define PERFINFO_LOG_TYPE_DRIVER_COMPLETE_REQUEST_RETURN (EVENT_TRACE_GROUP_IO | 0x35)
|
|
#define PERFINFO_LOG_TYPE_BOOT_PREFETCH_INFORMATION (EVENT_TRACE_GROUP_IO | 0x36)
|
|
|
|
//
|
|
// Event types for Memory subsystem
|
|
//
|
|
#define WMI_LOG_TYPE_PAGE_FAULT_TRANSITION (EVENT_TRACE_GROUP_MEMORY | EVENT_TRACE_TYPE_MM_TF)
|
|
#define WMI_LOG_TYPE_PAGE_FAULT_DEMAND_ZERO (EVENT_TRACE_GROUP_MEMORY | EVENT_TRACE_TYPE_MM_DZF)
|
|
#define WMI_LOG_TYPE_PAGE_FAULT_COPY_ON_WRITE (EVENT_TRACE_GROUP_MEMORY | EVENT_TRACE_TYPE_MM_COW)
|
|
#define WMI_LOG_TYPE_PAGE_FAULT_GUARD_PAGE (EVENT_TRACE_GROUP_MEMORY | EVENT_TRACE_TYPE_MM_GPF)
|
|
#define WMI_LOG_TYPE_PAGE_FAULT_HARD_PAGE_FAULT (EVENT_TRACE_GROUP_MEMORY | EVENT_TRACE_TYPE_MM_HPF)
|
|
|
|
#define PERFINFO_LOG_TYPE_HARDFAULT (EVENT_TRACE_GROUP_MEMORY | 0x20)
|
|
#define PERFINFO_LOG_TYPE_REMOVEPAGEBYCOLOR (EVENT_TRACE_GROUP_MEMORY | 0x21)
|
|
#define PERFINFO_LOG_TYPE_REMOVEPAGEFROMLIST (EVENT_TRACE_GROUP_MEMORY | 0x22)
|
|
#define PERFINFO_LOG_TYPE_PAGEINMEMORY (EVENT_TRACE_GROUP_MEMORY | 0x23)
|
|
#define PERFINFO_LOG_TYPE_INSERTINFREELIST (EVENT_TRACE_GROUP_MEMORY | 0x24)
|
|
#define PERFINFO_LOG_TYPE_SECTIONREMOVED (EVENT_TRACE_GROUP_MEMORY | 0x25)
|
|
#define PERFINFO_LOG_TYPE_INSERTINLIST (EVENT_TRACE_GROUP_MEMORY | 0x26)
|
|
#define PERFINFO_LOG_TYPE_INSERTATFRONT (EVENT_TRACE_GROUP_MEMORY | 0x28)
|
|
#define PERFINFO_LOG_TYPE_UNLINKFROMSTANDBY (EVENT_TRACE_GROUP_MEMORY | 0x29)
|
|
#define PERFINFO_LOG_TYPE_UNLINKFFREEORZERO (EVENT_TRACE_GROUP_MEMORY | 0x2a)
|
|
#define PERFINFO_LOG_TYPE_WORKINGSETMANAGER (EVENT_TRACE_GROUP_MEMORY | 0x2b)
|
|
#define PERFINFO_LOG_TYPE_TRIMPROCESS (EVENT_TRACE_GROUP_MEMORY | 0x2c)
|
|
#define PERFINFO_LOG_TYPE_MEMORYSNAP (EVENT_TRACE_GROUP_MEMORY | 0x2d)
|
|
#define PERFINFO_LOG_TYPE_ZEROSHARECOUNT (EVENT_TRACE_GROUP_MEMORY | 0x2e)
|
|
#define PERFINFO_LOG_TYPE_TRANSITIONFAULT (EVENT_TRACE_GROUP_MEMORY | 0x2f)
|
|
#define PERFINFO_LOG_TYPE_DEMANDZEROFAULT (EVENT_TRACE_GROUP_MEMORY | 0x30)
|
|
#define PERFINFO_LOG_TYPE_ADDVALIDPAGETOWS (EVENT_TRACE_GROUP_MEMORY | 0x31)
|
|
#define PERFINFO_LOG_TYPE_OUTWS_REPLACEUSED (EVENT_TRACE_GROUP_MEMORY | 0x32)
|
|
#define PERFINFO_LOG_TYPE_OUTWS_REPLACEUNUSED (EVENT_TRACE_GROUP_MEMORY | 0x33)
|
|
#define PERFINFO_LOG_TYPE_OUTWS_VOLUNTRIM (EVENT_TRACE_GROUP_MEMORY | 0x34)
|
|
#define PERFINFO_LOG_TYPE_OUTWS_FORCETRIM (EVENT_TRACE_GROUP_MEMORY | 0x35)
|
|
#define PERFINFO_LOG_TYPE_OUTWS_ADJUSTWS (EVENT_TRACE_GROUP_MEMORY | 0x36)
|
|
#define PERFINFO_LOG_TYPE_OUTWS_EMPTYQ (EVENT_TRACE_GROUP_MEMORY | 0x37)
|
|
#define PERFINFO_LOG_TYPE_WORKINGSETSNAP (EVENT_TRACE_GROUP_MEMORY | 0x38)
|
|
#define PERFINFO_LOG_TYPE_DECREFCNT (EVENT_TRACE_GROUP_MEMORY | 0x39)
|
|
#define PERFINFO_LOG_TYPE_DECSHARCNT (EVENT_TRACE_GROUP_MEMORY | 0x3a)
|
|
#define PERFINFO_LOG_TYPE_ZEROREFCOUNT (EVENT_TRACE_GROUP_MEMORY | 0x3b)
|
|
#define PERFINFO_LOG_TYPE_WSINFOPROCESS (EVENT_TRACE_GROUP_MEMORY | 0x3c)
|
|
#define PERFINFO_LOG_TYPE_ADDTOWORKINGSET (EVENT_TRACE_GROUP_MEMORY | 0x3d)
|
|
#define PERFINFO_LOG_TYPE_DELETEKERNELSTACK (EVENT_TRACE_GROUP_MEMORY | 0x3e)
|
|
#define PERFINFO_LOG_TYPE_PROTOPTEFAULT (EVENT_TRACE_GROUP_MEMORY | 0x3f)
|
|
#define PERFINFO_LOG_TYPE_ADDTOWS (EVENT_TRACE_GROUP_MEMORY | 0x40)
|
|
#define PERFINFO_LOG_TYPE_OUTWS_HASHFULL (EVENT_TRACE_GROUP_MEMORY | 0x41)
|
|
#define PERFINFO_LOG_TYPE_MOD_PAGE_WRITER1 (EVENT_TRACE_GROUP_MEMORY | 0x42)
|
|
#define PERFINFO_LOG_TYPE_MOD_PAGE_WRITER2 (EVENT_TRACE_GROUP_MEMORY | 0x43)
|
|
#define PERFINFO_LOG_TYPE_MOD_PAGE_WRITER3 (EVENT_TRACE_GROUP_MEMORY | 0x44)
|
|
#define PERFINFO_LOG_TYPE_FAULTADDR_WITH_IP (EVENT_TRACE_GROUP_MEMORY | 0x45)
|
|
#define PERFINFO_LOG_TYPE_TRIMSESSION (EVENT_TRACE_GROUP_MEMORY | 0x46)
|
|
#define PERFINFO_LOG_TYPE_MEMORYSNAPLITE (EVENT_TRACE_GROUP_MEMORY | 0x47)
|
|
#define PERFINFO_LOG_TYPE_WS_SESSION (EVENT_TRACE_GROUP_MEMORY | 0x48)
|
|
|
|
// (EVENT_TRACE_GROUP_POOL
|
|
//
|
|
//
|
|
// Event types for Registry subsystem
|
|
//
|
|
#define WMI_LOG_TYPE_REG_CREATE (EVENT_TRACE_GROUP_REGISTRY | EVENT_TRACE_TYPE_REGCREATE)
|
|
#define WMI_LOG_TYPE_REG_OPEN (EVENT_TRACE_GROUP_REGISTRY | EVENT_TRACE_TYPE_REGOPEN)
|
|
#define WMI_LOG_TYPE_REG_DELETE (EVENT_TRACE_GROUP_REGISTRY | EVENT_TRACE_TYPE_REGDELETE)
|
|
#define WMI_LOG_TYPE_REG_QUERY (EVENT_TRACE_GROUP_REGISTRY | EVENT_TRACE_TYPE_REGQUERY)
|
|
#define WMI_LOG_TYPE_REG_SET_VALUE (EVENT_TRACE_GROUP_REGISTRY | EVENT_TRACE_TYPE_REGSETVALUE)
|
|
#define WMI_LOG_TYPE_REG_DELETE_VALUE (EVENT_TRACE_GROUP_REGISTRY | EVENT_TRACE_TYPE_REGDELETEVALUE)
|
|
#define WMI_LOG_TYPE_REG_QUERY_VALUE (EVENT_TRACE_GROUP_REGISTRY | EVENT_TRACE_TYPE_REGQUERYVALUE)
|
|
#define WMI_LOG_TYPE_REG_ENUM_KEY (EVENT_TRACE_GROUP_REGISTRY | EVENT_TRACE_TYPE_REGENUMERATEKEY)
|
|
#define WMI_LOG_TYPE_REG_ENUM_VALUE (EVENT_TRACE_GROUP_REGISTRY | EVENT_TRACE_TYPE_REGENUMERATEVALUEKEY)
|
|
#define WMI_LOG_TYPE_REG_QUERY_MULTIVALUE (EVENT_TRACE_GROUP_REGISTRY | EVENT_TRACE_TYPE_REGQUERYMULTIPLEVALUE)
|
|
#define WMI_LOG_TYPE_REG_SET_INFO (EVENT_TRACE_GROUP_REGISTRY | EVENT_TRACE_TYPE_REGSETINFORMATION)
|
|
#define WMI_LOG_TYPE_REG_FLUSH (EVENT_TRACE_GROUP_REGISTRY | EVENT_TRACE_TYPE_REGFLUSH)
|
|
#define WMI_LOG_TYPE_REG_RUNDOWN (EVENT_TRACE_GROUP_REGISTRY | EVENT_TRACE_TYPE_REGKCBDMP)
|
|
|
|
#define PERFINFO_LOG_TYPE_CMCELLREFERRED (EVENT_TRACE_GROUP_REGISTRY | 0x20)
|
|
#define PERFINFO_LOG_TYPE_REG_KCB_KEYNAME (EVENT_TRACE_GROUP_REGISTRY | 0x21)
|
|
#define PERFINFO_LOG_TYPE_REG_KCB_CREATE (EVENT_TRACE_GROUP_REGISTRY | 0x22)
|
|
#define PERFINFO_LOG_TYPE_REG_PARSEKEY_START (EVENT_TRACE_GROUP_REGISTRY | 0x23)
|
|
#define PERFINFO_LOG_TYPE_REG_PARSEKEY_END (EVENT_TRACE_GROUP_REGISTRY | 0x24)
|
|
#define PERFINFO_LOG_TYPE_REG_DELETE_KEY (EVENT_TRACE_GROUP_REGISTRY | 0x25)
|
|
#define PERFINFO_LOG_TYPE_REG_DELETE_VALUE (EVENT_TRACE_GROUP_REGISTRY | 0x26)
|
|
#define PERFINFO_LOG_TYPE_REG_ENUM_KEY (EVENT_TRACE_GROUP_REGISTRY | 0x27)
|
|
#define PERFINFO_LOG_TYPE_REG_ENUM_VALUE (EVENT_TRACE_GROUP_REGISTRY | 0x28)
|
|
#define PERFINFO_LOG_TYPE_REG_QUERY_KEY (EVENT_TRACE_GROUP_REGISTRY | 0x29)
|
|
#define PERFINFO_LOG_TYPE_REG_QUERY_VALUE (EVENT_TRACE_GROUP_REGISTRY | 0x2a)
|
|
#define PERFINFO_LOG_TYPE_REG_QUERY_MULTIVALUE (EVENT_TRACE_GROUP_REGISTRY | 0x2b)
|
|
#define PERFINFO_LOG_TYPE_REG_SET_VALUE (EVENT_TRACE_GROUP_REGISTRY | 0x2c)
|
|
#define PERFINFO_LOG_TYPE_REG_NOTIFY_POST (EVENT_TRACE_GROUP_REGISTRY | 0x2d)
|
|
#define PERFINFO_LOG_TYPE_REG_NOTIFY_KCB (EVENT_TRACE_GROUP_REGISTRY | 0x2e)
|
|
|
|
//
|
|
// Event types for PERF tracing specific subsystem
|
|
//
|
|
#define PERFINFO_LOG_TYPE_PERFFREQUENCY (EVENT_TRACE_GROUP_PERFINFO | 0x20)
|
|
#define PERFINFO_LOG_TYPE_PERFCOUNTERSTART (EVENT_TRACE_GROUP_PERFINFO | 0x21)
|
|
#define PERFINFO_LOG_TYPE_MARK (EVENT_TRACE_GROUP_PERFINFO | 0x22)
|
|
#define PERFINFO_LOG_TYPE_VERSION (EVENT_TRACE_GROUP_PERFINFO | 0x23)
|
|
#define PERFINFO_LOG_TYPE_ASYNCMARK (EVENT_TRACE_GROUP_PERFINFO | 0x24)
|
|
#define PERFINFO_LOG_TYPE_FILENAMEBUFFER (EVENT_TRACE_GROUP_PERFINFO | 0x25) // to be cleaned up
|
|
#define PERFINFO_LOG_TYPE_IMAGENAME (EVENT_TRACE_GROUP_PERFINFO | 0x26)
|
|
#define PERFINFO_LOG_TYPE_RESERVED1 (EVENT_TRACE_GROUP_PERFINFO | 0x27)
|
|
#define PERFINFO_LOG_TYPE_RESERVED2 (EVENT_TRACE_GROUP_PERFINFO | 0x28)
|
|
#define PERFINFO_LOG_TYPE_RESERVED3 (EVENT_TRACE_GROUP_PERFINFO | 0x29)
|
|
#define PERFINFO_LOG_TYPE_WMI_TRACE_IO (EVENT_TRACE_GROUP_PERFINFO | 0x2a)
|
|
#define PERFINFO_LOG_TYPE_WMI_TRACE_FILENAME_EVENT (EVENT_TRACE_GROUP_PERFINFO | 0x2b)
|
|
#define PERFINFO_LOG_TYPE_GLOBAL_MASK_CHANGE (EVENT_TRACE_GROUP_PERFINFO | 0x2c)
|
|
#define PERFINFO_LOG_TYPE_TRACEINFO (EVENT_TRACE_GROUP_PERFINFO | 0x2d) // go away
|
|
#define PERFINFO_LOG_TYPE_SAMPLED_PROFILE (EVENT_TRACE_GROUP_PERFINFO | 0x2e)
|
|
#define PERFINFO_LOG_TYPE_TIMERDPC_ENTER (EVENT_TRACE_GROUP_PERFINFO | 0x2f)
|
|
#define PERFINFO_LOG_TYPE_TIMERDPC_EXIT (EVENT_TRACE_GROUP_PERFINFO | 0x30)
|
|
#define PERFINFO_LOG_TYPE_DPC_ENTER (EVENT_TRACE_GROUP_PERFINFO | 0x31)
|
|
#define PERFINFO_LOG_TYPE_DPC_EXIT (EVENT_TRACE_GROUP_PERFINFO | 0x32)
|
|
#define PERFINFO_LOG_TYPE_SYSCALL_ENTER (EVENT_TRACE_GROUP_PERFINFO | 0x33)
|
|
#define PERFINFO_LOG_TYPE_SYSCALL_EXIT (EVENT_TRACE_GROUP_PERFINFO | 0x34)
|
|
#define PERFINFO_LOG_TYPE_BACKTRACE (EVENT_TRACE_GROUP_PERFINFO | 0x35)
|
|
#define PERFINFO_LOG_TYPE_BACKTRACE_USERSTACK (EVENT_TRACE_GROUP_PERFINFO | 0x36)
|
|
#define PERFINFO_LOG_TYPE_SAMPLED_PROFILE_CACHE (EVENT_TRACE_GROUP_PERFINFO | 0x37)
|
|
#define PERFINFO_LOG_TYPE_EXCEPTION_STACK (EVENT_TRACE_GROUP_PERFINFO | 0x38)
|
|
#define PERFINFO_LOG_TYPE_BRANCH_TRACE (EVENT_TRACE_GROUP_PERFINFO | 0x39)
|
|
#define PERFINFO_LOG_TYPE_BRANCH_TRACE_DEBUG (EVENT_TRACE_GROUP_PERFINFO | 0x40)
|
|
#define PERFINFO_LOG_TYPE_BRANCH_ADDRESS_DEBUG (EVENT_TRACE_GROUP_PERFINFO | 0x41)
|
|
#define PERFINFO_LOG_TYPE_INTERRUPT (EVENT_TRACE_GROUP_PERFINFO | 0x43)
|
|
#define PERFINFO_LOG_TYPE_DPC (EVENT_TRACE_GROUP_PERFINFO | 0x44)
|
|
#define PERFINFO_LOG_TYPE_TIMERDPC (EVENT_TRACE_GROUP_PERFINFO | 0x45)
|
|
|
|
//
|
|
// Event types for Pool subsystem
|
|
//
|
|
|
|
#define PERFINFO_LOG_TYPE_ALLOCATEPOOL (EVENT_TRACE_GROUP_POOL | 0x20)
|
|
#define PERFINFO_LOG_TYPE_FREEPOOL (EVENT_TRACE_GROUP_POOL | 0x21)
|
|
#define PERFINFO_LOG_TYPE_POOLSTAT (EVENT_TRACE_GROUP_POOL | 0x22)
|
|
#define PERFINFO_LOG_TYPE_ADDPOOLPAGE (EVENT_TRACE_GROUP_POOL | 0x23)
|
|
#define PERFINFO_LOG_TYPE_FREEPOOLPAGE (EVENT_TRACE_GROUP_POOL | 0x24)
|
|
#define PERFINFO_LOG_TYPE_BIGPOOLPAGE (EVENT_TRACE_GROUP_POOL | 0x25)
|
|
#define PERFINFO_LOG_TYPE_POOLSNAP (EVENT_TRACE_GROUP_POOL | 0x26)
|
|
|
|
//
|
|
// Event types for Heap subsystem
|
|
//
|
|
#define PERFINFO_LOG_TYPE_HEAP_CREATE (EVENT_TRACE_GROUP_HEAP | 0x20)
|
|
#define PERFINFO_LOG_TYPE_HEAP_ALLOC (EVENT_TRACE_GROUP_HEAP | 0x21)
|
|
#define PERFINFO_LOG_TYPE_HEAP_REALLOC (EVENT_TRACE_GROUP_HEAP | 0x22)
|
|
#define PERFINFO_LOG_TYPE_HEAP_DESTROY (EVENT_TRACE_GROUP_HEAP | 0x23)
|
|
#define PERFINFO_LOG_TYPE_HEAP_FREE (EVENT_TRACE_GROUP_HEAP | 0x24)
|
|
#define PERFINFO_LOG_TYPE_HEAP_EXTEND (EVENT_TRACE_GROUP_HEAP | 0x25)
|
|
#define PERFINFO_LOG_TYPE_HEAP_SNAPSHOT (EVENT_TRACE_GROUP_HEAP | 0x26)
|
|
#define PERFINFO_LOG_TYPE_HEAP_CREATE_SNAPSHOT (EVENT_TRACE_GROUP_HEAP | 0x27)
|
|
#define PERFINFO_LOG_TYPE_HEAP_DESTROY_SNAPSHOT (EVENT_TRACE_GROUP_HEAP | 0x28)
|
|
#define PERFINFO_LOG_TYPE_HEAP_EXTEND_SNAPSHOT (EVENT_TRACE_GROUP_HEAP | 0x29)
|
|
#define PERFINFO_LOG_TYPE_HEAP_CONTRACT (EVENT_TRACE_GROUP_HEAP | 0x2a)
|
|
#define PERFINFO_LOG_TYPE_HEAP_LOCK (EVENT_TRACE_GROUP_HEAP | 0x2b)
|
|
#define PERFINFO_LOG_TYPE_HEAP_UNLOCK (EVENT_TRACE_GROUP_HEAP | 0x2c)
|
|
#define PERFINFO_LOG_TYPE_HEAP_VALIDATE (EVENT_TRACE_GROUP_HEAP | 0x2d)
|
|
#define PERFINFO_LOG_TYPE_HEAP_WALK (EVENT_TRACE_GROUP_HEAP | 0x2e)
|
|
|
|
//
|
|
// Event Types for Critical Section Subsystem
|
|
//
|
|
|
|
#define PERFINFO_LOG_TYPE_CRITSEC_ENTER (EVENT_TRACE_GROUP_CRITSEC | 0x20)
|
|
#define PERFINFO_LOG_TYPE_CRITSEC_LEAVE (EVENT_TRACE_GROUP_CRITSEC | 0x21)
|
|
#define PERFINFO_LOG_TYPE_CRITSEC_COLLISION (EVENT_TRACE_GROUP_CRITSEC | 0x22)
|
|
|
|
//
|
|
// Event types for Object subsystem
|
|
//
|
|
#define PERFINFO_LOG_TYPE_DECLARE_OBJECT (EVENT_TRACE_GROUP_OBJECT | 0x20)
|
|
#define PERFINFO_LOG_TYPE_WAIT_OBJECT (EVENT_TRACE_GROUP_OBJECT | 0x21)
|
|
#define PERFINFO_LOG_TYPE_UNWAIT_OBJECT (EVENT_TRACE_GROUP_OBJECT | 0x22)
|
|
#define PERFINFO_LOG_TYPE_SIGNAL_OBJECT (EVENT_TRACE_GROUP_OBJECT | 0x23)
|
|
#define PERFINFO_LOG_TYPE_CLEAR_OBJECT (EVENT_TRACE_GROUP_OBJECT | 0x24)
|
|
#define PERFINFO_LOG_TYPE_UNWAIT_SIGNALED_OBJECT (EVENT_TRACE_GROUP_OBJECT | 0x25)
|
|
|
|
//
|
|
// Event types for Power subsystem
|
|
//
|
|
#define PERFINFO_LOG_TYPE_BATTERY_LIFE_INFO (EVENT_TRACE_GROUP_POWER | 0x20)
|
|
#define PERFINFO_LOG_TYPE_IDLE_STATE_CHANGE (EVENT_TRACE_GROUP_POWER | 0x21)
|
|
#define PERFINFO_LOG_TYPE_SET_POWER_ACTION (EVENT_TRACE_GROUP_POWER | 0x22)
|
|
#define PERFINFO_LOG_TYPE_SET_POWER_ACTION_RET (EVENT_TRACE_GROUP_POWER | 0x23)
|
|
#define PERFINFO_LOG_TYPE_SET_DEVICES_STATE (EVENT_TRACE_GROUP_POWER | 0x24)
|
|
#define PERFINFO_LOG_TYPE_SET_DEVICES_STATE_RET (EVENT_TRACE_GROUP_POWER | 0x25)
|
|
#define PERFINFO_LOG_TYPE_PO_NOTIFY_DEVICE (EVENT_TRACE_GROUP_POWER | 0x26)
|
|
#define PERFINFO_LOG_TYPE_PO_NOTIFY_DEVICE_COMPLETE (EVENT_TRACE_GROUP_POWER | 0x27)
|
|
#define PERFINFO_LOG_TYPE_PO_SESSION_CALLOUT (EVENT_TRACE_GROUP_POWER | 0x28)
|
|
#define PERFINFO_LOG_TYPE_PO_SESSION_CALLOUT_RET (EVENT_TRACE_GROUP_POWER | 0x29)
|
|
#define PERFINFO_LOG_TYPE_PO_PRESLEEP (EVENT_TRACE_GROUP_POWER | 0x30)
|
|
#define PERFINFO_LOG_TYPE_PO_POSTSLEEP (EVENT_TRACE_GROUP_POWER | 0x31)
|
|
|
|
//
|
|
// Event types for MODBound subsystem
|
|
//
|
|
#define PERFINFO_LOG_TYPE_MODULEBOUND_ENT (EVENT_TRACE_GROUP_MODBOUND | 0x20)
|
|
#define PERFINFO_LOG_TYPE_MODULEBOUND_JUMP (EVENT_TRACE_GROUP_MODBOUND | 0x21)
|
|
#define PERFINFO_LOG_TYPE_MODULEBOUND_RET (EVENT_TRACE_GROUP_MODBOUND | 0x22)
|
|
#define PERFINFO_LOG_TYPE_MODULEBOUND_CALL (EVENT_TRACE_GROUP_MODBOUND | 0x23)
|
|
#define PERFINFO_LOG_TYPE_MODULEBOUND_CALLRET (EVENT_TRACE_GROUP_MODBOUND | 0x24)
|
|
#define PERFINFO_LOG_TYPE_MODULEBOUND_INT2E (EVENT_TRACE_GROUP_MODBOUND | 0x25)
|
|
#define PERFINFO_LOG_TYPE_MODULEBOUND_INT2B (EVENT_TRACE_GROUP_MODBOUND | 0x26)
|
|
#define PERFINFO_LOG_TYPE_MODULEBOUND_FULLTRACE (EVENT_TRACE_GROUP_MODBOUND | 0x27)
|
|
|
|
//
|
|
// Event types for gdi subsystem
|
|
#define PERFINFO_LOG_TYPE_FONT_REALIZE (EVENT_TRACE_GROUP_GDI | 0x20)
|
|
#define PERFINFO_LOG_TYPE_FONT_DELETE (EVENT_TRACE_GROUP_GDI | 0x21)
|
|
#define PERFINFO_LOG_TYPE_FONT_ACTIVATE (EVENT_TRACE_GROUP_GDI | 0x22)
|
|
#define PERFINFO_LOG_TYPE_FONT_FLUSH (EVENT_TRACE_GROUP_GDI | 0x23)
|
|
|
|
//
|
|
// Event types To be Decided if they are still needed?
|
|
//
|
|
|
|
#define PERFINFO_LOG_TYPE_DISPATCHMSG (EVENT_TRACE_GROUP_TBD | 0x00)
|
|
#define PERFINFO_LOG_TYPE_GLYPHCACHE (EVENT_TRACE_GROUP_TBD | 0x01)
|
|
#define PERFINFO_LOG_TYPE_GLYPHS (EVENT_TRACE_GROUP_TBD | 0x02)
|
|
#define PERFINFO_LOG_TYPE_READWRITE (EVENT_TRACE_GROUP_TBD | 0x03)
|
|
#define PERFINFO_LOG_TYPE_EXPLICIT_LOAD (EVENT_TRACE_GROUP_TBD | 0x04)
|
|
#define PERFINFO_LOG_TYPE_IMPLICIT_LOAD (EVENT_TRACE_GROUP_TBD | 0x05)
|
|
#define PERFINFO_LOG_TYPE_CHECKSUM (EVENT_TRACE_GROUP_TBD | 0x06)
|
|
#define PERFINFO_LOG_TYPE_DLL_INIT (EVENT_TRACE_GROUP_TBD | 0x07)
|
|
#define PERFINFO_LOG_TYPE_SERVICE_DD_START_INIT (EVENT_TRACE_GROUP_TBD | 0x08)
|
|
#define PERFINFO_LOG_TYPE_SERVICE_DD_DONE_INIT (EVENT_TRACE_GROUP_TBD | 0x09)
|
|
#define PERFINFO_LOG_TYPE_SERVICE_START_INIT (EVENT_TRACE_GROUP_TBD | 0x0a)
|
|
#define PERFINFO_LOG_TYPE_SERVICE_DONE_INIT (EVENT_TRACE_GROUP_TBD | 0x0b)
|
|
#define PERFINFO_LOG_TYPE_SERVICE_NAME (EVENT_TRACE_GROUP_TBD | 0x0c)
|
|
#define PERFINFO_LOG_TYPE_WSINFOSESSION (EVENT_TRACE_GROUP_TBD | 0x0d)
|
|
#define PERFINFO_LOG_TIMED_ENTER_ROUTINE (EVENT_TRACE_GROUP_TBD | 0x0e)
|
|
#define PERFINFO_LOG_TIMED_EXIT_ROUTINE (EVENT_TRACE_GROUP_TBD | 0x0f)
|
|
#define PERFINFO_LOG_TYPE_CTIME_STATS (EVENT_TRACE_GROUP_TBD | 0x10)
|
|
#define PERFINFO_LOG_TYPE_MARKED_DIRTY (EVENT_TRACE_GROUP_TBD | 0x11)
|
|
#define PERFINFO_LOG_TYPE_MARKED_CELL_DIRTY (EVENT_TRACE_GROUP_TBD | 0x12)
|
|
#define PERFINFO_LOG_TYPE_HIVE_WRITE_DIRTY (EVENT_TRACE_GROUP_TBD | 0x13)
|
|
#define PERFINFO_LOG_TYPE_DUMP_HIVECELL (EVENT_TRACE_GROUP_TBD | 0x14)
|
|
#define PERFINFO_LOG_TYPE_HIVE_STAT (EVENT_TRACE_GROUP_TBD | 0x16)
|
|
#define PERFINFO_LOG_TYPE_CLOCKREF (EVENT_TRACE_GROUP_TBD | 0x17)
|
|
#define PERFINFO_LOG_TYPE_COWHEADER (EVENT_TRACE_GROUP_TBD | 0x18)
|
|
#define PERFINFO_LOG_TYPE_COWBLOB (EVENT_TRACE_GROUP_TBD | 0x19)
|
|
#define PERFINFO_LOG_TYPE_COWBLOB_CLOSED (EVENT_TRACE_GROUP_TBD | 0x1a)
|
|
#define PERFINFO_LOG_TYPE_WMIPERFFREQUENCY (EVENT_TRACE_GROUP_TBD | 0x1d)
|
|
#define PERFINFO_LOG_TYPE_CDROM_READ (EVENT_TRACE_GROUP_TBD | 0x1e)
|
|
#define PERFINFO_LOG_TYPE_CDROM_READ_COMPLETE (EVENT_TRACE_GROUP_TBD | 0x1f)
|
|
#define PERFINFO_LOG_TYPE_KE_SET_EVENT (EVENT_TRACE_GROUP_TBD | 0x20)
|
|
#define PERFINFO_LOG_TYPE_REG_PARSEKEY (EVENT_TRACE_GROUP_TBD | 0x21)
|
|
#define PERFINFO_LOG_TYPE_REG_PARSEKEYEND (EVENT_TRACE_GROUP_TBD | 0x22)
|
|
#define PERFINFO_LOG_TYPE_ATTACH_PROCESS (EVENT_TRACE_GROUP_TBD | 0x24)
|
|
#define PERFINFO_LOG_TYPE_DETACH_PROCESS (EVENT_TRACE_GROUP_TBD | 0x25)
|
|
#define PERFINFO_LOG_TYPE_DATA_ACCESS (EVENT_TRACE_GROUP_TBD | 0x26)
|
|
#define PERFINFO_LOG_TYPE_KDHELP (EVENT_TRACE_GROUP_TBD | 0x27)
|
|
#define PERFINFO_LOG_TYPE_BOOT_OPTIONS (EVENT_TRACE_GROUP_TBD | 0x28)
|
|
#define PERFINFO_LOG_TYPE_FAILED_STKDUMP (EVENT_TRACE_GROUP_TBD | 0x2c)
|
|
#define PERFINFO_LOG_TYPE_SYSTEM_TIME (EVENT_TRACE_GROUP_TBD | 0x2f)
|
|
#define PERFINFO_LOG_TYPE_READYQUEUE (EVENT_TRACE_GROUP_TBD | 0x30)
|
|
|
|
//
|
|
// KMIXER hooks are in audio\filters\kmixer\pins.c
|
|
//
|
|
#define PERFINFO_LOG_TYPE_KMIXER_DRIVER_ENTRY (EVENT_TRACE_GROUP_TBD | 0x31)
|
|
#define PERFINFO_LOG_TYPE_KMIXER_DSOUND_STARVATION (EVENT_TRACE_GROUP_TBD | 0x32)
|
|
#define PERFINFO_LOG_TYPE_KMIXER_DPC_STARVATION (EVENT_TRACE_GROUP_TBD | 0x33)
|
|
#define PERFINFO_LOG_TYPE_KMIXER_WAVE_TOP_STARVATION (EVENT_TRACE_GROUP_TBD | 0x34)
|
|
|
|
#define PERFINFO_LOG_TYPE_OVERLAY_QUALITY (EVENT_TRACE_GROUP_TBD | 0x35)
|
|
// in amovie\filters\mixer\ovmixer\ominpin.cpp
|
|
#define PERFINFO_LOG_TYPE_DVD_RENDER_SAMPLE (EVENT_TRACE_GROUP_TBD | 0x36)
|
|
#define PERFINFO_LOG_TYPE_CDVD_SET_DISCONTINUITY (EVENT_TRACE_GROUP_TBD | 0x37)
|
|
// in amovie\filters\dvdnav\dvdnav\dvd.cpp
|
|
#define PERFINFO_LOG_TYPE_CSPLITTER_SET_DISCONTINUITY (EVENT_TRACE_GROUP_TBD | 0x38)
|
|
// in amovie\filters\dvdnav\base\splitter.cpp
|
|
|
|
// following hooks are in amovie\sdk\classes\base
|
|
#define PERFINFO_LOG_TYPE_DSHOW_CTOR (EVENT_TRACE_GROUP_TBD | 0x39)
|
|
#define PERFINFO_LOG_TYPE_DSHOW_DTOR (EVENT_TRACE_GROUP_TBD | 0x3a)
|
|
#define PERFINFO_LOG_TYPE_DSHOW_DELIVER (EVENT_TRACE_GROUP_TBD | 0x3b)
|
|
#define PERFINFO_LOG_TYPE_DSHOW_RECEIVE (EVENT_TRACE_GROUP_TBD | 0x3c)
|
|
#define PERFINFO_LOG_TYPE_DSHOW_RUN (EVENT_TRACE_GROUP_TBD | 0x3d)
|
|
#define PERFINFO_LOG_TYPE_DSHOW_PAUSE (EVENT_TRACE_GROUP_TBD | 0x3e)
|
|
#define PERFINFO_LOG_TYPE_DSHOW_STOP (EVENT_TRACE_GROUP_TBD | 0x3f)
|
|
#define PERFINFO_LOG_TYPE_DSHOW_JOINGRAPH (EVENT_TRACE_GROUP_TBD | 0x40)
|
|
#define PERFINFO_LOG_TYPE_DSHOW_GETBUFFER (EVENT_TRACE_GROUP_TBD | 0x41)
|
|
#define PERFINFO_LOG_TYPE_DSHOW_RELBUFFER (EVENT_TRACE_GROUP_TBD | 0x42)
|
|
#define PERFINFO_LOG_TYPE_DSHOW_CONNECT (EVENT_TRACE_GROUP_TBD | 0x43)
|
|
#define PERFINFO_LOG_TYPE_DSHOW_RXCONNECT (EVENT_TRACE_GROUP_TBD | 0x44)
|
|
#define PERFINFO_LOG_TYPE_DSHOW_DISCONNECT (EVENT_TRACE_GROUP_TBD | 0x45)
|
|
#define PERFINFO_LOG_TYPE_DSHOW_GETTIME (EVENT_TRACE_GROUP_TBD | 0x46)
|
|
#define PERFINFO_LOG_TYPE_DSHOW_AUDIOREND (EVENT_TRACE_GROUP_TBD | 0x47)
|
|
#define PERFINFO_LOG_TYPE_DSHOW_VIDEOREND (EVENT_TRACE_GROUP_TBD | 0x48)
|
|
#define PERFINFO_LOG_TYPE_DSHOW_FRAMEDROP (EVENT_TRACE_GROUP_TBD | 0x49)
|
|
#define PERFINFO_LOG_TYPE_DSHOW_AUDIOBREAK (EVENT_TRACE_GROUP_TBD | 0x4a)
|
|
#define PERFINFO_LOG_TYPE_DSHOW_SAMPLE_DATADISCONTINUITY (EVENT_TRACE_GROUP_TBD | 0x4b)
|
|
#define PERFINFO_LOG_TYPE_DSHOW_MEDIASAMPLE_SET_DISCONTINUITY (EVENT_TRACE_GROUP_TBD | 0x4c)
|
|
#define PERFINFO_LOG_TYPE_DSHOW_TRANSFORM_INITSAMPLE_SET_DISCONTINUITY (EVENT_TRACE_GROUP_TBD | 0x4d)
|
|
#define PERFINFO_LOG_TYPE_DSHOW_TRANSFORM_COPY_SET_DISCONTINUITY (EVENT_TRACE_GROUP_TBD | 0x4e)
|
|
#define PERFINFO_LOG_TYPE_DSHOW_SYNCOBJ_ADVICE_FRAME_SKIP (EVENT_TRACE_GROUP_TBD | 0x4f)
|
|
#define PERFINFO_LOG_TYPE_WMI_REFLECT_DISK_IO_READ (EVENT_TRACE_GROUP_TBD | 0x50)
|
|
#define PERFINFO_LOG_TYPE_WMI_REFLECT_DISK_IO_WRITE (EVENT_TRACE_GROUP_TBD | 0x51)
|
|
|
|
#if 0
|
|
//
|
|
// 2000-2199 reserved for SQL Server
|
|
//
|
|
|
|
#define PERFINFO_LOG_TYPE_SQLSERVER_FIRST (2000)
|
|
#define PERFINFO_LOG_TYPE_SQLSERVER_LAST (PERFINFO_LOG_TYPE_SQLSERVER_FIRST + 199)
|
|
|
|
//
|
|
// 2200-2299 reserved for reflection of WMI events
|
|
//
|
|
|
|
#define PERFINFO_LOG_TYPE_WMI_REFLECT_FIRST (2200)
|
|
#define PERFINFO_LOG_TYPE_WMI_REFLECT_LAST (PERFINFO_LOG_TYPE_WMI_REFLECT_FIRST + 199)
|
|
#endif //0
|
|
|
|
//
|
|
// Data structure used for WMI Kernel Events
|
|
//
|
|
// **NB** the hardware events are described in software traceing, if they
|
|
// change in layout please update sdktools\trace\tracefmt\default.tmf
|
|
|
|
|
|
#define MAX_DEVICE_ID_LENGTH 256
|
|
#define CONFIG_MAX_DOMAIN_NAME_LEN 132
|
|
|
|
|
|
typedef struct _CPU_CONFIG_RECORD {
|
|
ULONG ProcessorSpeed;
|
|
ULONG NumberOfProcessors;
|
|
ULONG MemorySize; // in MBytes
|
|
ULONG PageSize; // in Bytes
|
|
ULONG AllocationGranularity; // in Bytes
|
|
WCHAR ComputerName[MAX_DEVICE_ID_LENGTH];
|
|
WCHAR DomainName[CONFIG_MAX_DOMAIN_NAME_LEN];
|
|
} CPU_CONFIG_RECORD, *PCPU_CONFIG_RECORD;
|
|
|
|
#define CONFIG_WRITE_CACHE_ENABLED 0x00000001
|
|
#define CONFIG_FS_NAME_LEN 16
|
|
#define CONFIG_BOOT_DRIVE_LEN 3
|
|
typedef struct _PHYSICAL_DISK_RECORD {
|
|
ULONG DiskNumber;
|
|
ULONG BytesPerSector;
|
|
ULONG SectorsPerTrack;
|
|
ULONG TracksPerCylinder;
|
|
ULONGLONG Cylinders;
|
|
ULONG SCSIPortNumber;
|
|
ULONG SCSIPathId;
|
|
ULONG SCSITargetId;
|
|
ULONG SCSILun;
|
|
WCHAR Manufacturer[MAX_DEVICE_ID_LENGTH];
|
|
|
|
ULONG PartitionCount;
|
|
BOOLEAN WriteCacheEnabled;
|
|
WCHAR BootDriveLetter[CONFIG_BOOT_DRIVE_LEN];
|
|
} PHYSICAL_DISK_RECORD, *PPHYSICAL_DISK_RECORD;
|
|
|
|
//
|
|
// Types of logical drive
|
|
//
|
|
#define CONFIG_DRIVE_PARTITION 0x00000001
|
|
#define CONFIG_DRIVE_VOLUME 0x00000002
|
|
#define CONFIG_DRIVE_EXTENT 0x00000004
|
|
#define CONFIG_DRIVE_LETTER_LEN 4
|
|
|
|
typedef struct _LOGICAL_DISK_EXTENTS {
|
|
ULONGLONG StartingOffset;
|
|
ULONGLONG PartitionSize;
|
|
ULONG DiskNumber; // The physical disk number where the logical drive resides
|
|
|
|
ULONG Size; // The size in bytes of the structure.
|
|
ULONG DriveType; // Logical drive type partition/volume/extend-partition
|
|
WCHAR DriveLetterString[CONFIG_DRIVE_LETTER_LEN];
|
|
ULONG Pad;
|
|
ULONG PartitionNumber; // The partition number where the logical drive resides
|
|
ULONG SectorsPerCluster;
|
|
ULONG BytesPerSector;
|
|
LONGLONG NumberOfFreeClusters;
|
|
LONGLONG TotalNumberOfClusters;
|
|
WCHAR FileSystemType[CONFIG_FS_NAME_LEN];
|
|
ULONG VolumeExt; // Offset to VOLUME_DISK_EXTENTS structure
|
|
} LOGICAL_DISK_EXTENTS, *PLOGICAL_DISK_EXTENTS;
|
|
|
|
#define CONFIG_MAX_DNS_SERVER 4
|
|
#define CONFIG_MAX_ADAPTER_ADDRESS_LENGTH 8
|
|
|
|
//
|
|
// Note: Data is an array of structures of type IP_ADDRESS_STRING defined in iptypes.h
|
|
//
|
|
typedef struct _NIC_RECORD {
|
|
WCHAR NICName[MAX_DEVICE_ID_LENGTH];
|
|
ULONG Index;
|
|
ULONG PhysicalAddrLen;
|
|
WCHAR PhysicalAddr[CONFIG_MAX_ADAPTER_ADDRESS_LENGTH];
|
|
|
|
ULONG Size; // Size of the Data
|
|
LONG IpAddress; // IP Address offset. Copy bytes = sizeof(IP_ADDRESS_STRING)
|
|
LONG SubnetMask; // subnet mask offset. Copy bytes = sizeof(IP_ADDRESS_STRING)
|
|
LONG DhcpServer; // dhcp server offset. Copy bytes = sizeof(IP_ADDRESS_STRING)
|
|
LONG Gateway; // gateway offset. Copy bytes = sizeof(IP_ADDRESS_STRING)
|
|
LONG PrimaryWinsServer; // primary wins server offset. Copy bytes = sizeof(IP_ADDRESS_STRING)
|
|
LONG SecondaryWinsServer;// secondary wins server offset. Copy bytes = sizeof(IP_ADDRESS_STRING)
|
|
LONG DnsServer[CONFIG_MAX_DNS_SERVER]; // dns server offset. Copy bytes = sizeof(IP_ADDRESS_STRING)
|
|
ULONG Data; // Offset to an array of IP_ADDRESS_STRING
|
|
} NIC_RECORD, *PNIC_RECORD;
|
|
|
|
typedef struct _VIDEO_RECORD {
|
|
ULONG MemorySize;
|
|
ULONG XResolution;
|
|
ULONG YResolution;
|
|
ULONG BitsPerPixel;
|
|
ULONG VRefresh;
|
|
WCHAR ChipType[MAX_DEVICE_ID_LENGTH];
|
|
WCHAR DACType[MAX_DEVICE_ID_LENGTH];
|
|
WCHAR AdapterString[MAX_DEVICE_ID_LENGTH];
|
|
WCHAR BiosString[MAX_DEVICE_ID_LENGTH];
|
|
WCHAR DeviceId[MAX_DEVICE_ID_LENGTH];
|
|
ULONG StateFlags;
|
|
} VIDEO_RECORD, *PVIDEO_RECORD;
|
|
|
|
#define CONFIG_MAX_NAME_LENGTH 34
|
|
#define CONFIG_MAX_DISPLAY_NAME 256
|
|
|
|
typedef struct _WMI_SERVICE_INFO {
|
|
WCHAR ServiceName[CONFIG_MAX_NAME_LENGTH];
|
|
WCHAR DisplayName[CONFIG_MAX_DISPLAY_NAME];
|
|
WCHAR ProcessName[CONFIG_MAX_NAME_LENGTH];
|
|
ULONG ProcessId;
|
|
} WMI_SERVICE_INFO, *PWMI_SERVICE_INFO;
|
|
|
|
//
|
|
// Stores the ACPI Power Information
|
|
//
|
|
typedef struct _WMI_POWER_RECORD {
|
|
BOOLEAN SystemS1;
|
|
BOOLEAN SystemS2;
|
|
BOOLEAN SystemS3;
|
|
BOOLEAN SystemS4; // hibernate
|
|
BOOLEAN SystemS5; // off
|
|
CHAR Pad1;
|
|
CHAR Pad2;
|
|
CHAR Pad3;
|
|
} WMI_POWER_RECORD, *PWMI_POWER_RECORD;
|
|
|
|
typedef struct _WMI_PROCESS_INFORMATION {
|
|
ULONG_PTR PageDirectoryBase;
|
|
ULONG ProcessId;
|
|
ULONG ParentId;
|
|
ULONG SessionId;
|
|
NTSTATUS ExitStatus;
|
|
ULONG Sid;
|
|
// Filename is added at the ned of the structure.
|
|
// Since Sid is variable length field,
|
|
// FileName is not defined in the structure.
|
|
} WMI_PROCESS_INFORMATION, *PWMI_PROCESS_INFORMATION;
|
|
|
|
typedef struct _WMI_THREAD_INFORMATION {
|
|
ULONG ProcessId;
|
|
ULONG ThreadId;
|
|
} WMI_THREAD_INFORMATION, *PWMI_THREAD_INFORMATION;
|
|
|
|
typedef struct _WMI_EXTENDED_THREAD_INFORMATION {
|
|
ULONG ProcessId;
|
|
ULONG ThreadId;
|
|
PVOID StackBase;
|
|
PVOID StackLimit;
|
|
PVOID UserStackBase;
|
|
PVOID UserStackLimit;
|
|
PVOID StartAddr;
|
|
PVOID Win32StartAddr;
|
|
CHAR WaitMode;
|
|
} WMI_EXTENDED_THREAD_INFORMATION, *PWMI_EXTENDED_THREAD_INFORMATION;
|
|
|
|
typedef struct _WMI_IMAGELOAD_INFORMATION {
|
|
PVOID ImageBase;
|
|
SIZE_T ImageSize;
|
|
ULONG ProcessId;
|
|
WCHAR FileName[1];
|
|
} WMI_IMAGELOAD_INFORMATION, *PWMI_IMAGELOAD_INFORMATION;
|
|
|
|
typedef struct _WMI_DISKIO_READWRITE {
|
|
ULONG DiskNumber;
|
|
ULONG IrpFlags;
|
|
ULONG Size;
|
|
ULONG ResponseTime;
|
|
ULONGLONG ByteOffset;
|
|
PVOID FileObject;
|
|
ULONGLONG HighResResponseTime;
|
|
} WMI_DISKIO_READWRITE, *PWMI_DISKIO_READWRITE;
|
|
|
|
|
|
typedef struct _WMI_REGISTRY {
|
|
ULONG_PTR Status;
|
|
PVOID Kcb;
|
|
LONGLONG ElapsedTime;
|
|
union{
|
|
ULONG Index;
|
|
ULONG InfoClass;
|
|
};
|
|
WCHAR Name[1];
|
|
} WMI_REGISTRY, *PWMI_REGISTRY;
|
|
|
|
typedef struct _WMI_FILE_IO {
|
|
PVOID FileObject;
|
|
WCHAR FileName[1];
|
|
} WMI_FILE_IO, *PWMI_FILE_IO;
|
|
|
|
typedef struct _WMI_TCPIP {
|
|
|
|
ULONG Context;
|
|
ULONG Size;
|
|
ULONG DestAddr;
|
|
ULONG SrcAddr;
|
|
USHORT DestPort;
|
|
USHORT SrcPort;
|
|
|
|
} WMI_TCPIP, *PWMI_TCPIP;
|
|
|
|
typedef struct _WMI_UDP {
|
|
|
|
ULONG PID;
|
|
USHORT Size;
|
|
ULONG DestAddr;
|
|
ULONG SrcAddr;
|
|
USHORT DestPort;
|
|
USHORT SrcPort;
|
|
|
|
}WMI_UDP, *PWMI_UDP;
|
|
|
|
typedef struct _WMI_PAGE_FAULT {
|
|
PVOID VirtualAddress;
|
|
PVOID ProgramCounter;
|
|
} WMI_PAGE_FAULT, *PWMI_PAGE_FAULT;
|
|
|
|
typedef struct _WMI_CONTEXTSWAP {
|
|
|
|
ULONG NewThreadId;
|
|
ULONG OldThreadId;
|
|
|
|
CHAR NewThreadPriority;
|
|
CHAR OldThreadPriority;
|
|
CHAR NewThreadQuantum;
|
|
CHAR OldThreadQuantum;
|
|
|
|
UCHAR OldThreadWaitReason;
|
|
CHAR OldThreadWaitMode;
|
|
UCHAR OldThreadState;
|
|
UCHAR OldThreadIdealProcessor;
|
|
|
|
} WMI_CONTEXTSWAP, *PWMI_CONTEXTSWAP;
|
|
|
|
typedef struct _HEAP_EVENT_ALLOC {
|
|
|
|
PVOID HeapHandle; //Handle of Heap
|
|
SIZE_T Size; //Size of allocation in bytes
|
|
PVOID Address; //Address of Allocation
|
|
ULONG Source; //Type ie Lookaside, Lowfrag or main path
|
|
|
|
}HEAP_EVENT_ALLOC, *PHEAP_EVENT_ALLOC;
|
|
|
|
typedef struct _HEAP_EVENT_FREE {
|
|
|
|
PVOID HeapHandle; //Handle of Heap
|
|
PVOID Address; //Address to free
|
|
ULONG Source; //Type ie Lookaside, Lowfrag or main path
|
|
|
|
}HEAP_EVENT_FREE, *PHEAP_EVENT_FREE;
|
|
|
|
typedef struct _HEAP_EVENT_REALLOC {
|
|
|
|
PVOID HeapHandle; //Handle of Heap
|
|
PVOID NewAddress; //New Address returned to user
|
|
PVOID OldAddress; //Old Address got from user
|
|
SIZE_T NewSize; //New Size in bytes
|
|
SIZE_T OldSize; //Old Size in bytes
|
|
ULONG Source; //Type ie Lookaside, Lowfrag or main path
|
|
|
|
}HEAP_EVENT_REALLOC, *PHEAP_EVENT_REALLOC;
|
|
|
|
typedef struct _HEAP_EVENT_EXPANSION {
|
|
|
|
PVOID HeapHandle; //Handle of Heap
|
|
SIZE_T CommittedSize; //Memory Size in bytes actually committed
|
|
PVOID Address; //Address of free block or segment
|
|
SIZE_T FreeSpace; //Total free Space in Heap
|
|
SIZE_T CommittedSpace; //Memory Committed
|
|
SIZE_T ReservedSpace; //Memory reserved
|
|
ULONG NoOfUCRs; //Number of UnCommitted Ranges
|
|
|
|
}HEAP_EVENT_EXPANSION, *PHEAP_EVENT_EXPANSION;
|
|
|
|
typedef struct _HEAP_EVENT_CONTRACTION {
|
|
|
|
PVOID HeapHandle; //Handle of Heap
|
|
SIZE_T DeCommitSize; //The size of DeCommitted Block
|
|
PVOID DeCommitAddress; //Address of the Decommitted block
|
|
SIZE_T FreeSpace; //Total free Space in Heap in bytes
|
|
SIZE_T CommittedSpace; //Memory Committed in bytes
|
|
SIZE_T ReservedSpace; //Memory reserved in bytes
|
|
ULONG NoOfUCRs; //Number of UnCommitted Ranges
|
|
|
|
|
|
}HEAP_EVENT_CONTRACTION, *PHEAP_EVENT_CONTRACTION;
|
|
|
|
typedef struct _HEAP_EVENT_CREATE {
|
|
|
|
PVOID HeapHandle; //Handle of Heap
|
|
ULONG Flags; //Flags passed while creating heap.
|
|
|
|
}HEAP_EVENT_CREATE, *PHEAP_EVENT_CREATE;
|
|
|
|
typedef struct _CRIT_SEC_COLLISION_EVENT_DATA {
|
|
|
|
ULONG LockCount; //Lock Count
|
|
PVOID SpinCount; //Spin Count
|
|
PVOID OwningThread; //Thread having Lock
|
|
PVOID Address; //Adress of Critical Section
|
|
|
|
}CRIT_SEC_COLLISION_EVENT_DATA, *PCRIT_SEC_COLLISION_EVENT_DATA;
|
|
|
|
//
|
|
// Additional Guid used for NTPERF
|
|
//
|
|
|
|
DEFINE_GUID( /* 0268a8b6-74fd-4302-9dd0-6e8f1795c0cf */
|
|
PoolGuid,
|
|
0x0268a8b6,
|
|
0x74fd,
|
|
0x4302,
|
|
0x9d, 0xd0, 0x6e, 0x8f, 0x17, 0x95, 0xc0, 0xcf
|
|
);
|
|
|
|
DEFINE_GUID( /* ce1dbfb4-137e-4da6-87b0-3f59aa102cbc */
|
|
PerfinfoGuid,
|
|
0xce1dbfb4,
|
|
0x137e,
|
|
0x4da6,
|
|
0x87, 0xb0, 0x3f, 0x59, 0xaa, 0x10, 0x2c, 0xbc
|
|
);
|
|
|
|
DEFINE_GUID( /* 222962ab-6180-4b88-a825-346b75f2a24a */
|
|
HeapGuid,
|
|
0x222962ab,
|
|
0x6180,
|
|
0x4b88,
|
|
0xa8, 0x25, 0x34, 0x6b, 0x75, 0xf2, 0xa2, 0x4a
|
|
);
|
|
|
|
DEFINE_GUID ( /* 3AC66736-CC59-4cff-8115-8DF50E39816B */
|
|
CritSecGuid,
|
|
0x3ac66736,
|
|
0xcc59,
|
|
0x4cff,
|
|
0x81, 0x15, 0x8d, 0xf5, 0xe, 0x39, 0x81, 0x6b
|
|
);
|
|
|
|
DEFINE_GUID ( /* E21D2142-DF90-4d93-BBD9-30E63D5A4AD6 */
|
|
NtdllTraceGuid,
|
|
0xe21d2142,
|
|
0xdf90,
|
|
0x4d93,
|
|
0xbb, 0xd9, 0x30, 0xe6, 0x3d, 0x5a, 0x4a, 0xd6
|
|
);
|
|
|
|
DEFINE_GUID( /* 89497f50-effe-4440-8cf2-ce6b1cdcaca7 */
|
|
ObjectGuid,
|
|
0x89497f50,
|
|
0xeffe,
|
|
0x4440,
|
|
0x8c, 0xf2, 0xce, 0x6b, 0x1c, 0xdc, 0xac, 0xa7
|
|
);
|
|
|
|
DEFINE_GUID( /* a9152f00-3f58-4bee-92a1-70c7d079d5dd */
|
|
ModBoundGuid,
|
|
0xa9152f00,
|
|
0x3f58,
|
|
0x4bee,
|
|
0x92, 0xa1, 0x70, 0xc7, 0xd0, 0x79, 0xd5, 0xdd
|
|
);
|
|
|
|
DEFINE_GUID ( /* E43445E0-0903-48c3-B878-FF0FCCEBDD04 */
|
|
PowerGuid,
|
|
0xe43445e0,
|
|
0x903,
|
|
0x48c3,
|
|
0xb8, 0x78, 0xff, 0xf, 0xcc, 0xeb, 0xdd, 0x4
|
|
);
|
|
|
|
DEFINE_GUID ( /* b2d14872-7c5b-463d-8419-ee9bf7d23e04 */
|
|
DpcGuid,
|
|
0xb2d14872,
|
|
0x7c5b,
|
|
0x463d,
|
|
0x84, 0x19, 0xee, 0x9b, 0xf7, 0xd2, 0x3e, 0x04
|
|
);
|
|
|
|
#endif // ifndef ETW_WOW6432
|
|
|
|
//
|
|
// The following flags denotes what Fields actually contains
|
|
//
|
|
|
|
#define ETW_NT_FLAGS_TRACE_HEADER 0X00000001 // Contiguous Event Trace Header
|
|
#define ETW_NT_FLAGS_TRACE_MESSAGE 0X00000002 // Trace Message
|
|
|
|
NTSYSCALLAPI
|
|
NTSTATUS
|
|
NTAPI
|
|
NtTraceEvent(
|
|
IN HANDLE TraceHandle,
|
|
IN ULONG Flags,
|
|
IN ULONG FieldSize,
|
|
IN PVOID Fields
|
|
);
|
|
|
|
#endif // _NTWMI_
|