-
Notifications
You must be signed in to change notification settings - Fork 170
/
ntwmi.h
5917 lines (5204 loc) · 211 KB
/
ntwmi.h
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
/*
* Trace Control support functions
*
* This file is part of System Informer.
*/
#ifndef _NTWMI_H
#define _NTWMI_H
EXTERN_C_START
#ifndef _TRACEHANDLE_DEFINED
#define _TRACEHANDLE_DEFINED
// Obsolete - prefer PROCESSTRACE_HANDLE or CONTROLTRACE_ID.
typedef ULONG64 TRACEHANDLE, *PTRACEHANDLE;
#endif
// Used to read the events from a trace file or real-time trace session (via
// ProcessTrace). The handle is invalid if it contains the value
// INVALID_PROCESSTRACE_HANDLE. Obtain the handle by calling an OpenTrace
// function (e.g. OpenTrace, OpenTraceFromFile, OpenTraceFromRealTimeLogger).
// Close the handle by calling CloseTrace.
typedef ULONG64 PROCESSTRACE_HANDLE;
// Used to identify a trace collection session. The id is invalid if it
// contains the value (CONTROLTRACE_ID)0. Obtain the id from StartTrace or from
// the Wnode.HistoricalContext field of the EVENT_TRACE_PROPERTIES returned by
// ControlTrace(0, sessionName, ...). The id is valid until the trace stops and
// does not need to be closed by the user.
typedef ULONG64 CONTROLTRACE_ID;
//
// Maximum supported buffer size in KB - Win8 (16MB)
//
// N.B. Prior to Win8 the value was 1MB (1024KB).
#define MIN_ETW_BUFFER_SIZE 1 // in KBytes
#define MAX_ETW_BUFFER_SIZE (16 * 1024) // in KBytes
#define MAX_ETW_BUFFER_SIZE_WIN7 (1 * 1024) // in KBytes
#define MAX_ETW_EVENT_SIZE 0xFFFF // MAX_USHORT
// SystemTraceControlGuid
#define ETW_KERNEL_RUNDOWN_START 0x00000001
#define ETW_KERNEL_RUNDOWN_STOP 0x00000002
#define ETW_CKCL_RUNDOWN_START 0x00000004
#define ETW_CKCL_RUNDOWN_STOP 0x00000008
#define ETW_FILENAME_RUNDOWN 0x00000010
//
// Alignment macros
//
#define DEFAULT_TRACE_ALIGNMENT 8 // 8 byte alignment
#define ALIGN_TO_POWER2( x, n ) (((ULONG)(x) + ((n)-1)) & ~((ULONG)(n)-1))
//
// The predefined event groups or families for NT subsystems
//
#define EVENT_TRACE_GROUP_HEADER 0x0000
#define EVENT_TRACE_GROUP_IO 0x0100
#define EVENT_TRACE_GROUP_MEMORY 0x0200
#define EVENT_TRACE_GROUP_PROCESS 0x0300
#define EVENT_TRACE_GROUP_FILE 0x0400
#define EVENT_TRACE_GROUP_THREAD 0x0500
#define EVENT_TRACE_GROUP_TCPIP 0x0600
#define EVENT_TRACE_GROUP_JOB 0x0700
#define EVENT_TRACE_GROUP_UDPIP 0x0800
#define EVENT_TRACE_GROUP_REGISTRY 0x0900
#define EVENT_TRACE_GROUP_DBGPRINT 0x0A00
#define EVENT_TRACE_GROUP_CONFIG 0x0B00
#define EVENT_TRACE_GROUP_SPARE1 0x0C00 // Spare1
#define EVENT_TRACE_GROUP_WNF 0x0D00
#define EVENT_TRACE_GROUP_POOL 0x0E00
#define EVENT_TRACE_GROUP_PERFINFO 0x0F00
#define EVENT_TRACE_GROUP_HEAP 0x1000
#define EVENT_TRACE_GROUP_OBJECT 0x1100
#define EVENT_TRACE_GROUP_POWER 0x1200
#define EVENT_TRACE_GROUP_MODBOUND 0x1300
#define EVENT_TRACE_GROUP_IMAGE 0x1400
#define EVENT_TRACE_GROUP_DPC 0x1500
#define EVENT_TRACE_GROUP_CC 0x1600
#define EVENT_TRACE_GROUP_CRITSEC 0x1700
#define EVENT_TRACE_GROUP_STACKWALK 0x1800
#define EVENT_TRACE_GROUP_UMS 0x1900
#define EVENT_TRACE_GROUP_ALPC 0x1A00
#define EVENT_TRACE_GROUP_SPLITIO 0x1B00
#define EVENT_TRACE_GROUP_THREAD_POOL 0x1C00
#define EVENT_TRACE_GROUP_HYPERVISOR 0x1D00
#define EVENT_TRACE_GROUP_HYPERVISORX 0x1E00
//
// If you add any new groups, you must bump up MAX_KERNEL_TRACE_EVENTS
// and make sure post processing is fixed up.
//
#define MAX_KERNEL_TRACE_EVENTS 0x1F
//
// The highest order bit of a data block is set if trace, WNODE otherwise
//
#define TRACE_HEADER_FLAG 0x80000000
// Header type for tracing messages
// | Marker(8) | Reserved(8) | Size(16) | MessageNumber(16) | Flags(16)
#define TRACE_MESSAGE 0x10000000
// | MARKER(16) | SIZE (16) | ULONG 32 | TIME_STAMP ...
#define TRACE_HEADER_ULONG32_TIME 0xB0000000
//
// The second bit is set if the trace is used by PM & CP (fixed headers)
// If not, the data block is used by for finer data for performance analysis
//
#define TRACE_HEADER_EVENT_TRACE 0x40000000
//
// If set, the data block is SYSTEM_TRACE_HEADER
//
#define TRACE_HEADER_ENUM_MASK 0x00FF0000
//
// The following are various header type
//
#define TRACE_HEADER_TYPE_SYSTEM32 1
#define TRACE_HEADER_TYPE_SYSTEM64 2
#define TRACE_HEADER_TYPE_COMPACT32 3
#define TRACE_HEADER_TYPE_COMPACT64 4
#define TRACE_HEADER_TYPE_FULL_HEADER32 10
#define TRACE_HEADER_TYPE_INSTANCE32 11
#define TRACE_HEADER_TYPE_TIMED 12 // Not used
#define TRACE_HEADER_TYPE_ERROR 13 // Error while logging event
#define TRACE_HEADER_TYPE_WNODE_HEADER 14 // Not used
#define TRACE_HEADER_TYPE_MESSAGE 15
#define TRACE_HEADER_TYPE_PERFINFO32 16
#define TRACE_HEADER_TYPE_PERFINFO64 17
#define TRACE_HEADER_TYPE_EVENT_HEADER32 18
#define TRACE_HEADER_TYPE_EVENT_HEADER64 19
#define TRACE_HEADER_TYPE_FULL_HEADER64 20
#define TRACE_HEADER_TYPE_INSTANCE64 21
#define EVENT_HEADER_SIZE_MASK 0x0000FFFF
#define SYSTEM_TRACE_VERSION 2
//
// The following two are used for defining LogFile layout version.
//
// 1.2 -- Add per-processor event streams.
// 1.3 -- Remove rundown and context/switch streams.
// 1.4 -- Add header stream.
// 1.5 -- Include QPC and Platform clock source in the header.
//
// 2.0 -- Larger Buffers (over 1MB) / 256+ Processors / Compression (Win8).
//
#define TRACE_VERSION_MAJOR_WIN7 1
#define TRACE_VERSION_MINOR_WIN7 5
#define TRACE_VERSION_MAJOR 2
#define TRACE_VERSION_MINOR 0
#define SYSTEM_TRACE_MARKER32 (TRACE_HEADER_FLAG | TRACE_HEADER_EVENT_TRACE | (TRACE_HEADER_TYPE_SYSTEM32 << 16))
#define SYSTEM_TRACE_MARKER64 (TRACE_HEADER_FLAG | TRACE_HEADER_EVENT_TRACE | (TRACE_HEADER_TYPE_SYSTEM64 << 16))
#define COMPACT_TRACE_MARKER32 (TRACE_HEADER_FLAG | TRACE_HEADER_EVENT_TRACE | (TRACE_HEADER_TYPE_COMPACT32 << 16))
#define COMPACT_TRACE_MARKER64 (TRACE_HEADER_FLAG | TRACE_HEADER_EVENT_TRACE | (TRACE_HEADER_TYPE_COMPACT64 << 16))
#define PERFINFO_TRACE_MARKER32 (TRACE_HEADER_FLAG | TRACE_HEADER_EVENT_TRACE | (TRACE_HEADER_TYPE_PERFINFO32 << 16))
#define PERFINFO_TRACE_MARKER64 (TRACE_HEADER_FLAG | TRACE_HEADER_EVENT_TRACE | (TRACE_HEADER_TYPE_PERFINFO64 << 16))
#define TRACE_HEADER_PEBS_INDEX_FLAG 0x00008000
#define TRACE_HEADER_SPARE_FLAG1 0x00004000
#define TRACE_HEADER_SPARE_FLAG2 0x00002000
#define TRACE_HEADER_SPARE_FLAG3 0x00001000
#define TRACE_HEADER_SPARE_FLAG4 0x00000800
#define TRACE_HEADER_PMC_COUNTERS_MASK 0x00000700
#define TRACE_HEADER_PMC_COUNTERS_SHIFT 8
#define TRACE_HEADER_EXT_ITEMS_MASK (TRACE_HEADER_PEBS_INDEX_FLAG | TRACE_HEADER_PMC_COUNTERS_MASK)
#ifdef _WIN64
#define SYSTEM_TRACE_MARKER SYSTEM_TRACE_MARKER64
#define COMPACT_TRACE_MARKER COMPACT_TRACE_MARKER64
#define PERFINFO_TRACE_MARKER PERFINFO_TRACE_MARKER64
#else
#define SYSTEM_TRACE_MARKER SYSTEM_TRACE_MARKER32
#define COMPACT_TRACE_MARKER COMPACT_TRACE_MARKER32
#define PERFINFO_TRACE_MARKER PERFINFO_TRACE_MARKER32
#endif
//
// Support a maximum of 64 logger instances.
//
#define MAXLOGGERS 64
//
// Set of Internal Flags passed to the Logger via ClientContext during StartTrace
//
#define EVENT_TRACE_CLOCK_RAW 0 // Use Raw timestamp
#define EVENT_TRACE_CLOCK_PERFCOUNTER 1 // Use HighPerfClock (Default)
#define EVENT_TRACE_CLOCK_SYSTEMTIME 2 // Use SystemTime
#define EVENT_TRACE_CLOCK_CPUCYCLE 3 // Use CPU cycle counter
#define EVENT_TRACE_CLOCK_MAX 4 // Max number of clock types
//
// NOTE: The following should not overlap with other bits in the LogFileMode
// or LoggerMode defined in evntrace.h. Placed here since it is for internal
// use only.
//
#define EVENT_TRACE_KD_FILTER_MODE 0x00080000 // KD_FILTER
#define EVENT_TRACE_BUFFER_INTERFACE_MODE 0x00040000
//
// LoggerMode flags on Win7 and above.
//
#define EVENT_TRACE_USE_MS_FLUSH_TIMER 0x00000010 // FlushTimer value in milliseconds
#define EVENT_TRACE_BLOCKING_MODE 0x20000000 // Private loggers wait for buffers
//
// LoggerMode flags on Win8 and above.
//
#define EVENT_TRACE_REALTIME_RELOG_MODE 0x00100000 // Private logger, relogging real-time events
// This is same as EVENT_TRACE_MODE_RESERVED
#define EVENT_TRACE_LOST_EVENTS_DEBUG_MODE 0x00200000 // Break on lost events
#define EVENT_TRACE_COMPRESSED_MODE 0x04000000 // Compress relogged file
//
// see evntrace.h for pre-defined generic event types (0-10)
//
typedef struct _WMI_TRACE_PACKET
{
USHORT Size;
union
{
USHORT HookId;
struct
{
UCHAR Type;
UCHAR Group;
} DUMMYSTRUCTNAME;
} DUMMYUNIONNAME;
} WMI_TRACE_PACKET, *PWMI_TRACE_PACKET;
static_assert(sizeof(WMI_TRACE_PACKET) == sizeof(ULONG), "WMI_TRACE_PACKET must equal sizeof(ULONG)");
// New struct that replaces EVENT_INSTANCE_GUID_HEADER. It is basically
// EVENT_TRACE_HEADER + 2 Guids.
// For XP, we will not publish this struct and hide it from users.
// TRACE_VERSION in LOG_FILE_HEADER will tell the consumer APIs to use
// this struct instead of EVENT_TRACE_HEADER.
typedef struct _EVENT_INSTANCE_GUID_HEADER
{
USHORT Size; // Size of entire record
union
{
USHORT FieldTypeFlags; // Indicates valid fields
struct
{
UCHAR HeaderType; // Header type - internal use only
UCHAR MarkerFlags; // Marker - internal use only
} DUMMYSTRUCTNAME;
} DUMMYUNIONNAME;
union
{
ULONG Version;
struct
{
UCHAR Type; // event type
UCHAR Level; // trace instrumentation level
USHORT Version; // version of trace record
} Class;
} DUMMYUNIONNAME2;
ULONG ThreadId; // Thread Id
ULONG ProcessId; // Process Id
LARGE_INTEGER TimeStamp; // time when event happens
union
{
GUID Guid; // Guid that identifies event
ULONGLONG GuidPtr; // use with WNODE_FLAG_USE_GUID_PTR
} DUMMYUNIONNAME3;
union
{
struct
{
ULONG ClientContext; // Reserved
ULONG Flags; // Flags for header
} DUMMYSTRUCTNAME;
struct
{
ULONG KernelTime; // Kernel Mode CPU ticks
ULONG UserTime; // User mode CPU ticks
} DUMMYSTRUCTNAME2;
ULONG64 ProcessorTime; // Processor Clock
} DUMMYUNIONNAME4;
ULONG InstanceId;
ULONG ParentInstanceId;
GUID ParentGuid; // Guid that identifies event
} EVENT_INSTANCE_GUID_HEADER, *PEVENT_INSTANCE_GUID_HEADER;
typedef ULONGLONG PERFINFO_TIMESTAMP;
typedef struct _PERFINFO_TRACE_HEADER PERFINFO_TRACE_ENTRY, *PPERFINFO_TRACE_ENTRY;
//
// 64-bit Trace header for NTPERF events
//
// Note. The field "Version" will temporary be used to log CPU Id when log to PerfMem.
// This will be removed after we change the buffer management to be the same as WMI.
// i.e., Each CPU will allocate a block of memory for logging and CPU id is in the header
// of each block.
//
typedef struct _PERFINFO_TRACE_HEADER
{
union
{
ULONG Marker;
struct
{
USHORT Version;
UCHAR HeaderType;
UCHAR Flags; //WMI uses this flag to identify event types
} DUMMYSTRUCTNAME;
} DUMMYUNIONNAME;
union
{
ULONG Header; // both sizes must be the same!
WMI_TRACE_PACKET Packet;
} DUMMYUNIONNAME2;
union
{
PERFINFO_TIMESTAMP TS;
LARGE_INTEGER SystemTime;
} DUMMYUNIONNAME3;
UCHAR Data[1];
} PERFINFO_TRACE_HEADER, *PPERFINFO_TRACE_HEADER;
//
// 64-bit Trace header for kernel events
//
typedef struct _SYSTEM_TRACE_HEADER
{
union
{
ULONG Marker;
struct
{
USHORT Version;
UCHAR HeaderType;
UCHAR Flags;
} DUMMYSTRUCTNAME;
} DUMMYUNIONNAME;
union
{
ULONG Header; // both sizes must be the same!
WMI_TRACE_PACKET Packet;
} DUMMYUNIONNAME2;
ULONG ThreadId;
ULONG ProcessId;
LARGE_INTEGER SystemTime;
ULONG KernelTime;
ULONG UserTime;
} SYSTEM_TRACE_HEADER, *PSYSTEM_TRACE_HEADER;
//
// System header with no User/Kernel time.
//
#define COMPACT_HEADER_SIZE (RTL_SIZEOF_THROUGH_FIELD(SYSTEM_TRACE_HEADER, SystemTime))
//
// 64-bit Trace Header for Tracing Messages
//
typedef struct _WMI_TRACE_MESSAGE_PACKET
{
USHORT MessageNumber; // The message Number, index of messages by GUID
// Or ComponentID
USHORT OptionFlags ; // Flags associated with the message
} WMI_TRACE_MESSAGE_PACKET, *PWMI_TRACE_MESSAGE_PACKET;
static_assert(sizeof(WMI_TRACE_MESSAGE_PACKET) == sizeof(ULONG), "WMI_TRACE_MESSAGE_PACKET must equal sizeof(ULONG)");
typedef struct _MESSAGE_TRACE_HEADER
{
union
{
ULONG Marker;
struct
{
USHORT Size; // Total Size of the message including header
UCHAR Reserved; // Unused and reserved
UCHAR Version; // The message structure type (TRACE_MESSAGE_FLAG)
} DUMMYSTRUCTNAME;
} DUMMYUNIONNAME;
union
{
ULONG Header; // both sizes must be the same!
WMI_TRACE_MESSAGE_PACKET Packet;
} DUMMYUNIONNAME2;
} MESSAGE_TRACE_HEADER, *PMESSAGE_TRACE_HEADER;
typedef struct _MESSAGE_TRACE
{
MESSAGE_TRACE_HEADER MessageHeader;
UCHAR Data;
} MESSAGE_TRACE, *PMESSAGE_TRACE;
#define TRACE_MESSAGE_USERMODE 0x40 // flag indicating message came from user mode
#define TRACE_MESSAGE_WOW 0x80
//
// Structure used to pass user log messages to the kernel
//
typedef struct DECLSPEC_ALIGN(8) _MESSAGE_TRACE_USER
{
MESSAGE_TRACE_HEADER MessageHeader;
GUID MessageGuid;
ULONG MessageFlags;
ULONG DataSize;
ULONG64 Data;
} MESSAGE_TRACE_USER, *PMESSAGE_TRACE_USER;
//
// N.B. ETW_REF_CLOCK needs to be available for WOW64, thus the trick with defines for ETW_WOW64.
//
typedef struct _ETW_REF_CLOCK
{
LARGE_INTEGER StartTime;
LARGE_INTEGER StartPerfClock;
} ETW_REF_CLOCK, *PETW_REF_CLOCK;
#ifndef ETW_WOW6432
typedef enum _ETW_BUFFER_STATE
{
EtwBufferStateFree,
EtwBufferStateGeneralLogging,
EtwBufferStateCSwitch,
EtwBufferStateFlush,
EtwBufferStateMaximum //MaxState should always be the last enum
} ETW_BUFFER_STATE, *PETW_BUFFER_STATE;
#define ETW_BUFFER_TYPE_GENERIC 0
#define ETW_BUFFER_TYPE_RUNDOWN 1
#define ETW_BUFFER_TYPE_CTX_SWAP 2
#define ETW_BUFFER_TYPE_REFTIME 3
#define ETW_BUFFER_TYPE_HEADER 4
#define ETW_BUFFER_TYPE_BATCHED 5
#define ETW_BUFFER_TYPE_EMPTY_MARKER 6
#define ETW_BUFFER_TYPE_DBG_INFO 7
#define ETW_BUFFER_TYPE_MAXIMUM 8
#define ETW_BUFFER_FLAG_NORMAL 0x0000
#define ETW_BUFFER_FLAG_FLUSH_MARKER 0x0001
#define ETW_BUFFER_FLAG_EVENTS_LOST 0x0002
#define ETW_BUFFER_FLAG_BUFFER_LOST 0x0004
#define ETW_BUFFER_FLAG_RTBACKUP_CORRUPT 0x0008
#define ETW_BUFFER_FLAG_RTBACKUP 0x0010
#define ETW_BUFFER_FLAG_PROC_INDEX 0x0020
#define ETW_BUFFER_FLAG_COMPRESSED 0x0040
#define ETW_PROCESSOR_INDEX_MASK 0x07FF
//
// The following constants for real time event loss reasons should be
// in sync with the messages in admin\wmi\events\service\eventlog.man.
//
#define ETW_RT_LOSS_EVENT 0x20
#define ETW_RT_LOSS_BUFFER 0x21
#define ETW_RT_LOSS_BACKUP 0x22
typedef enum _ETW_RT_EVENT_LOSS
{
EtwRtEventNoLoss,
EtwRtEventLost,
EtwRtBufferLost,
EtwRtBackupLost,
EtwRtEventLossMax
} ETW_RT_EVENT_LOSS, *PETW_RT_EVENT_LOSS;
typedef struct _WMI_BUFFER_HEADER *PWMI_BUFFER_HEADER;
typedef struct _WMI_BUFFER_HEADER
{
ULONG BufferSize; // BufferSize
ULONG SavedOffset; // Temp saved offset
volatile ULONG CurrentOffset; // Current offset
volatile LONG ReferenceCount; // Reference count
LARGE_INTEGER TimeStamp; // Flush time stamp
LONGLONG SequenceNumber; // Buffer sequence number
union
{
struct
{ // DBG_INFO buffers send to debugger
ULONGLONG ClockType : 3;
ULONGLONG Frequency : 61;
} DUMMYSTRUCTNAME;
SINGLE_LIST_ENTRY SlistEntry; // Local list when flushing
PWMI_BUFFER_HEADER NextBuffer; // FlushList
} DUMMYUNIONNAME;
ETW_BUFFER_CONTEXT ClientContext; // LoggerId/ProcessorIndex
ETW_BUFFER_STATE State; // (Free/GeneralLogging/Flush)
ULONG Offset; // Offset when flushing (can overlap SavedOffset)
USHORT BufferFlag; // (flush marker, events lost)
USHORT BufferType; // (generic/rundown/cswitch/reftime)
union
{
ULONG Padding1[4];
ETW_REF_CLOCK ReferenceTime; // persistent real-time
LIST_ENTRY GlobalEntry; // Global list entry
struct
{
PVOID Pointer0;
PVOID Pointer1;
} DUMMYSTRUCTNAME2;
} DUMMYUNIONNAME2;
} WMI_BUFFER_HEADER, *PWMI_BUFFER_HEADER;
static_assert(sizeof(WMI_BUFFER_HEADER) == 0x48, "WMI_BUFFER_HEADER must equal 0x48");
C_ASSERT(FIELD_OFFSET(WMI_BUFFER_HEADER, BufferSize) == 0x0);
C_ASSERT(FIELD_OFFSET(WMI_BUFFER_HEADER, SavedOffset) == 0x4);
C_ASSERT(FIELD_OFFSET(WMI_BUFFER_HEADER, CurrentOffset) == 0x8);
C_ASSERT(FIELD_OFFSET(WMI_BUFFER_HEADER, TimeStamp) == 0x10);
C_ASSERT(FIELD_OFFSET(WMI_BUFFER_HEADER, SlistEntry) == 0x20);
C_ASSERT(FIELD_OFFSET(WMI_BUFFER_HEADER, ClientContext) == 0x28);
C_ASSERT(FIELD_OFFSET(WMI_BUFFER_HEADER, State) == 0x2c); // Compression
C_ASSERT(FIELD_OFFSET(WMI_BUFFER_HEADER, Offset) == 0x30);
C_ASSERT(FIELD_OFFSET(WMI_BUFFER_HEADER, BufferFlag) == 0x34);
C_ASSERT(FIELD_OFFSET(WMI_BUFFER_HEADER, BufferType) == 0x36);
typedef struct _TRACE_ENABLE_FLAG_EXTENSION
{
USHORT Offset; // Offset to the flag array in structure
UCHAR Length; // Length of flag array in ULONGs
UCHAR Flag; // Must be set to EVENT_TRACE_FLAG_EXTENSION
} TRACE_ENABLE_FLAG_EXTENSION, *PTRACE_ENABLE_FLAG_EXTENSION;
typedef struct _TRACE_ENABLE_FLAG_EXT_HEADER
{
USHORT Length; // Length in ULONGs
USHORT Items; // # of items
} TRACE_ENABLE_FLAG_EXT_HEADER, *PTRACE_ENABLE_FLAG_EXT_HEADER;
typedef struct _TRACE_ENABLE_FLAG_EXT_ITEM
{
USHORT Offset; // Offset to the next block
USHORT Type; // Extension type
} TRACE_ENABLE_FLAG_EXT_ITEM, *PTRACE_ENABLE_FLAG_EXT_ITEM;
#define EVENT_TRACE_FLAG_EXT_ITEMS 0x80FF0000 // New extension structure
#define EVENT_TRACE_FLAG_EXT_LEN_NEW_STRUCT 0xFF // Pseudo length to denote new struct format
#define ETW_MINIMUM_CACHED_STACK_LENGTH 4
#define ETW_SW_ARRAY_SIZE 256 // Frame Count allocated in lookaside list
#define ETW_STACK_SW_ARRAY_SIZE 192 // Frame Count allocated in stack
#define ETW_MAX_STACKWALK_FILTER 256 // Max number of HookId's
#define ETW_MAX_TAG_FILTER 4
#define ETW_MAX_POOLTAG_FILTER ETW_MAX_TAG_FILTER
#define ETW_EXT_ENABLE_FLAGS 0x0001
#define ETW_EXT_PIDS 0x0002
#define ETW_EXT_STACKWALK_FILTER 0x0003
#define ETW_EXT_POOLTAG_FILTER 0x0004
#define ETW_EXT_STACK_CACHING 0x0005
//
// Extended item for configuring stack caching.
//
typedef struct _ETW_STACK_CACHING_CONFIG
{
ULONG CacheSize;
ULONG BucketCount;
} ETW_STACK_CACHING_CONFIG, *PETW_STACK_CACHING_CONFIG;
#endif // ifndef ETW_WOW6432
#define PERFINFO_APPLY_OFFSET_GIVING_TYPE(_Base, _Offset, _Type) ((_Type) (((PPERF_BYTE) (_Base)) + (_Offset)))
#define PERFINFO_ROUND_UP(Size, Amount) (((ULONG)(Size) + ((Amount) - 1)) & ~((Amount) - 1))
//
// Enable flags, hook id's, etc...
//
#define PERF_MASK_INDEX (0xe0000000)
#define PERF_MASK_GROUP (~PERF_MASK_INDEX)
#define PERF_NUM_MASKS 8
typedef ULONG PERFINFO_MASK;
//
// This structure holds a group mask for all the PERF_NUM_MASKS sets (see PERF_MASK_INDEX above).
//
typedef struct _PERFINFO_GROUPMASK
{
ULONG Masks[PERF_NUM_MASKS];
} PERFINFO_GROUPMASK, *PPERFINFO_GROUPMASK;
#define PERF_GET_MASK_INDEX(GM) (((GM) & PERF_MASK_INDEX) >> 29)
#define PERF_GET_MASK_GROUP(GM) ((GM) & PERF_MASK_GROUP)
#define PERFINFO_CLEAR_GROUPMASK(GroupMask) RtlZeroMemory((GroupMask), sizeof(PERFINFO_GROUPMASK))
#define PERFINFO_OR_GROUP_WITH_GROUPMASK(Group, GroupMask) (GroupMask)->Masks[PERF_GET_MASK_INDEX(Group)] |= PERF_GET_MASK_GROUP(Group)
#define PERFINFO_CLEAR_GROUP_IN_GROUPMASK(Group, GroupMask) (GroupMask)->Masks[PERF_GET_MASK_INDEX(Group)] &= (~PERF_GET_MASK_GROUP(Group))
/*++
Routine Description:
Determines whether any group is on in a group mask
Arguments:
Group - Group index to check.
GroupMask - pointer to group mask to check.
Return Value:
Boolean indicating whether it is set or not.
Environment:
User mode.
--*/
FORCEINLINE
BOOLEAN
PerfIsGroupOnInGroupMask(
_In_ ULONG Group,
_In_ PPERFINFO_GROUPMASK GroupMask
)
{
PPERFINFO_GROUPMASK TestMask = GroupMask;
return (BOOLEAN)(((TestMask) != NULL) && (((TestMask)->Masks[PERF_GET_MASK_INDEX((Group))] & PERF_GET_MASK_GROUP((Group))) != 0));
}
// Group Masks (enabling flags) are used to determine the type of
// events to be logged. Each hook type is controlled by one bit in the
// Group masks.
//
// Currently we have 8 sets of global masks available. Each set is a ULONG with
// the highest 3 bits reserved for PERF_MASK_INDEX, which is used to index to
// the particular set of masks. For example,
//
// #define PERF_GROUP1 0x0XXXXXXX in the 0th set (0x10000000 is the last bit in this set)
// #define PERF_GROUP2 0x2XXXXXXX in the 1st set (0x30000000 is the last bit in this set)
// #define PERF_GROUP3 0x4XXXXXXX in the 2nd set (0x50000000 is the last bit in this set)
// ...
// #define PERF_GROUP7 0xeXXXXXXX in the 7th set (0xf0000000 is the last bit in this set)
//
// See ntperf.h for the manipulations of flags.
//
// Externally published group masks (only in the 0th set) are defined in envtrace.h.
// This section contains extended group masks which are private.
//
// The highest set of GROUP_MASK (0xeXXXXXXX) is currently reserved for
// modifying system behaviors (e.g., turn off page fault clustering, limit
// process working set when BigFoot is turned on, etc.) when trace is
// turned on.
//
//
//
// NOTE: In LongHorn we decided to expose some of the flags outside of group 0.
// We did that by adding the following flags which are treated as aliases:
//
// EVENT_TRACE_FLAG_CSWITCH
// EVENT_TRACE_FLAG_DPC
// EVENT_TRACE_FLAG_INTERRUPT
// EVENT_TRACE_FLAG_SYSTEMCALL
// EVENT_TRACE_FLAG_DRIVER
// EVENT_TRACE_FLAG_PROFILE
//
//
// GlobalMask 0 (Masks[0])
//
#define PERF_REGISTRY EVENT_TRACE_FLAG_REGISTRY
#define PERF_HARD_FAULTS EVENT_TRACE_FLAG_MEMORY_HARD_FAULTS
#define PERF_JOB EVENT_TRACE_FLAG_JOB
#define PERF_PROC_THREAD EVENT_TRACE_FLAG_PROCESS | EVENT_TRACE_FLAG_THREAD
#define PERF_PROCESS EVENT_TRACE_FLAG_PROCESS
#define PERF_THREAD EVENT_TRACE_FLAG_THREAD
#define PERF_DISK_IO EVENT_TRACE_FLAG_DISK_FILE_IO | EVENT_TRACE_FLAG_DISK_IO
#define PERF_DISK_IO_INIT EVENT_TRACE_FLAG_DISK_IO_INIT
#define PERF_LOADER EVENT_TRACE_FLAG_IMAGE_LOAD
#define PERF_ALL_FAULTS EVENT_TRACE_FLAG_MEMORY_PAGE_FAULTS
#define PERF_FILENAME EVENT_TRACE_FLAG_DISK_FILE_IO
#define PERF_NETWORK EVENT_TRACE_FLAG_NETWORK_TCPIP
#define PERF_ALPC EVENT_TRACE_FLAG_ALPC
#define PERF_SPLIT_IO EVENT_TRACE_FLAG_SPLIT_IO
#define PERF_PERF_COUNTER EVENT_TRACE_FLAG_PROCESS_COUNTERS
#define PERF_FILE_IO EVENT_TRACE_FLAG_FILE_IO
#define PERF_FILE_IO_INIT EVENT_TRACE_FLAG_FILE_IO_INIT
#define PERF_DBGPRINT EVENT_TRACE_FLAG_DBGPRINT
#define PERF_NO_SYSCONFIG EVENT_TRACE_FLAG_NO_SYSCONFIG
#define PERF_VAMAP EVENT_TRACE_FLAG_VAMAP
#define PERF_DEBUG_EVENTS EVENT_TRACE_FLAG_DEBUG_EVENTS
//
// GlobalMask 1 (Masks[1])
//
#define PERF_MEMORY 0x20000001 // High level WS manager activities, PFN changes
#define PERF_PROFILE 0x20000002 // Sysprof // equivalent to EVENT_TRACE_FLAG_PROFILE
#define PERF_CONTEXT_SWITCH 0x20000004 // Context Switch // equivalent to EVENT_TRACE_FLAG_CSWITCH
#define PERF_FOOTPRINT 0x20000008 // Flush WS on every mark_with_flush
#define PERF_DRIVERS 0x20000010 // equivalent to EVENT_TRACE_FLAG_DRIVER
#define PERF_REFSET 0x20000020 // PERF_FOOTPRINT + log AutoMark on trace start/stop.
#define PERF_POOL 0x20000040
#define PERF_POOLTRACE 0x20000041
#define PERF_DPC 0x20000080 // equivalent to EVENT_TRACE_FLAG_DPC
#define PERF_COMPACT_CSWITCH 0x20000100
#define PERF_DISPATCHER 0x20000200 // equivalent to EVENT_TRACE_FLAG_DISPATCHER
#define PERF_PMC_PROFILE 0x20000400
#define PERF_PROFILING 0x20000402
#define PERF_PROCESS_INSWAP 0x20000800
#define PERF_AFFINITY 0x20001000
#define PERF_PRIORITY 0x20002000
#define PERF_INTERRUPT 0x20004000 // equivalent to EVENT_TRACE_FLAG_INTERRUPT
#define PERF_VIRTUAL_ALLOC 0x20008000 // equivalent to EVENT_TRACE_FLAG_VIRTUAL_ALLOC
#define PERF_SPINLOCK 0x20010000
#define PERF_SYNC_OBJECTS 0x20020000
#define PERF_DPC_QUEUE 0x20040000
#define PERF_MEMINFO 0x20080000
#define PERF_CONTMEM_GEN 0x20100000
#define PERF_SPINLOCK_CNTRS 0x20200000
#define PERF_SPININSTR 0x20210000
#define PERF_SESSION 0x20400000
#define PERF_PFSECTION PERF_SESSION // Bits in this group are scarce and so use SESSION for PFSECTION events.
#define PERF_MEMINFO_WS 0x20800000 // Logs Workingset/Commit information on MemInfo DPC
#define PERF_KERNEL_QUEUE 0x21000000
#define PERF_INTERRUPT_STEER 0x22000000
#define PERF_SHOULD_YIELD 0x24000000
#define PERF_WS 0x28000000
//#define PERF_POOLTRACE (PERF_MEMORY | PERF_POOL)
//#define PERF_PROFILING (PERF_PROFILE | PERF_PMC_PROFILE)
//#define PERF_SPININSTR (PERF_SPINLOCK | PERF_SPINLOCK_CNTRS)
//
// GlobalMask 2 (Masks[2])
//
#define PERF_ANTI_STARVATION 0x40000001
#define PERF_PROCESS_FREEZE 0x40000002
#define PERF_PFN_LIST 0x40000004
#define PERF_WS_DETAIL 0x40000008
#define PERF_WS_ENTRY 0x40000010
#define PERF_HEAP 0x40000020
#define PERF_SYSCALL 0x40000040
#define PERF_UMS 0x40000080
#define PERF_BACKTRACE 0x40000100
#define PERF_VULCAN 0x40000200
#define PERF_OBJECTS 0x40000400
#define PERF_EVENTS 0x40000800
#define PERF_FULLTRACE 0x40001000
#define PERF_DFSS 0x40002000 // spare
#define PERF_PREFETCH 0x40004000
#define PERF_PROCESSOR_IDLE 0x40008000
#define PERF_CPU_CONFIG 0x40010000
#define PERF_TIMER 0x40020000
#define PERF_CLOCK_INTERRUPT 0x40040000
#define PERF_LOAD_BALANCER 0x40080000 // spare
#define PERF_CLOCK_TIMER 0x40100000
#define PERF_IDLE_SELECTION 0x40200000
#define PERF_IPI 0x40400000
#define PERF_IO_TIMER 0x40800000
#define PERF_REG_HIVE 0x41000000
#define PERF_REG_NOTIF 0x42000000
#define PERF_PPM_EXIT_LATENCY 0x44000000
#define PERF_WORKER_THREAD 0x48000000
//
// GlobalMask 3 (Masks[3])
//
// Reserved 0x60000001
// Reserved 0x60000002
// Reserved 0x60000004
// Reserved 0x60000008
// ...
//
// GlobalMask 4 (Masks[4])
//
#define PERF_OPTICAL_IO 0x80000001
#define PERF_OPTICAL_IO_INIT 0x80000002
// Reserved 0x80000004
#define PERF_DLL_INFO 0x80000008
#define PERF_DLL_FLUSH_WS 0x80000010
// Reserved 0x80000020
#define PERF_OB_HANDLE 0x80000040
#define PERF_OB_OBJECT 0x80000080
// Reserved 0x80000100
#define PERF_WAKE_DROP 0x80000200
#define PERF_WAKE_EVENT 0x80000400
#define PERF_DEBUGGER 0x80000800
#define PERF_PROC_ATTACH 0x80001000
#define PERF_WAKE_COUNTER 0x80002000
// Reserved 0x80004000
#define PERF_POWER 0x80008000
#define PERF_SOFT_TRIM 0x80010000
#define PERF_CC 0x80020000
// Reserved 0x80040000
#define PERF_FLT_IO_INIT 0x80080000
#define PERF_FLT_IO 0x80100000
#define PERF_FLT_FASTIO 0x80200000
#define PERF_FLT_IO_FAILURE 0x80400000
#define PERF_HV_PROFILE 0x80800000
#define PERF_WDF_DPC 0x81000000
#define PERF_WDF_INTERRUPT 0x82000000
#define PERF_CACHE_FLUSH 0x84000000
//
// GlobalMask 5:
//
#define PERF_HIBER_RUNDOWN 0xA0000001
// Reserved 0xA0000002
// Reserved 0xA0000004
// Reserved 0xA0000008
// ...
//
// GlobalMask 6:
//
#define PERF_SYSCFG_SYSTEM 0xC0000001
#define PERF_SYSCFG_GRAPHICS 0xC0000002
#define PERF_SYSCFG_STORAGE 0xC0000004
#define PERF_SYSCFG_NETWORK 0xC0000008
#define PERF_SYSCFG_SERVICES 0xC0000010
#define PERF_SYSCFG_PNP 0xC0000020
#define PERF_SYSCFG_OPTICAL 0xC0000040
// Reserved 0xC0000080
// Reserved 0xC0000100
#define PERF_SYSCFG_ALL 0xDFFFFFFF
//
// GlobalMask 7: The mark is a control mask. All flags that changes system
// behaviors go here.
//
#define PERF_CLUSTER_OFF 0xe0000001
#define PERF_MEMORY_CONTROL 0xe0000002
//
// Converting old PERF hooks into WMI format. More clean up to be done.
//
// WHEN YOU ADD NEW TYPES UPDATE THE NAME TABLE in perfgroups.c:
// PerfLogTypeNames ALSO UPDATE VERIFICATION TABLE IN PERFPOSTTBLS.C
//
//
// Event for header
//
#define WMI_LOG_TYPE_HEADER (EVENT_TRACE_GROUP_HEADER | EVENT_TRACE_TYPE_INFO)
#define WMI_LOG_TYPE_HEADER_EXTENSION (EVENT_TRACE_GROUP_HEADER | EVENT_TRACE_TYPE_EXTENSION)
#define WMI_LOG_TYPE_RUNDOWN_COMPLETE (EVENT_TRACE_GROUP_HEADER | EVENT_TRACE_TYPE_CHECKPOINT)
#define WMI_LOG_TYPE_GROUP_MASKS_END (EVENT_TRACE_GROUP_HEADER | 0x20)
#define WMI_LOG_TYPE_RUNDOWN_BEGIN (EVENT_TRACE_GROUP_HEADER | 0x30)
#define WMI_LOG_TYPE_RUNDOWN_END (EVENT_TRACE_GROUP_HEADER | 0x31)
#define WMI_LOG_TYPE_DBGID_RSDS (EVENT_TRACE_GROUP_HEADER | EVENT_TRACE_TYPE_DBGID_RSDS)
#define WMI_LOG_TYPE_DBGID_NB10 (EVENT_TRACE_GROUP_HEADER | 0x41)
#define WMI_LOG_TYPE_BUILD_LAB (EVENT_TRACE_GROUP_HEADER | 0x42)
#define WMI_LOG_TYPE_BINARY_PATH (EVENT_TRACE_GROUP_HEADER | 0x43)
//
// Event for system config
//
#define WMI_LOG_TYPE_CONFIG_CPU (EVENT_TRACE_GROUP_CONFIG | EVENT_TRACE_TYPE_CONFIG_CPU)
#define WMI_LOG_TYPE_CONFIG_PHYSICALDISK (EVENT_TRACE_GROUP_CONFIG | EVENT_TRACE_TYPE_CONFIG_PHYSICALDISK)
#define WMI_LOG_TYPE_CONFIG_LOGICALDISK (EVENT_TRACE_GROUP_CONFIG | EVENT_TRACE_TYPE_CONFIG_LOGICALDISK)
#define WMI_LOG_TYPE_CONFIG_OPTICALMEDIA (EVENT_TRACE_GROUP_CONFIG | EVENT_TRACE_TYPE_CONFIG_OPTICALMEDIA)
#define WMI_LOG_TYPE_CONFIG_NIC (EVENT_TRACE_GROUP_CONFIG | EVENT_TRACE_TYPE_CONFIG_NIC)
#define WMI_LOG_TYPE_CONFIG_VIDEO (EVENT_TRACE_GROUP_CONFIG | EVENT_TRACE_TYPE_CONFIG_VIDEO)
#define WMI_LOG_TYPE_CONFIG_SERVICES (EVENT_TRACE_GROUP_CONFIG | EVENT_TRACE_TYPE_CONFIG_SERVICES)
#define WMI_LOG_TYPE_CONFIG_POWER (EVENT_TRACE_GROUP_CONFIG | EVENT_TRACE_TYPE_CONFIG_POWER)
//#define WMI_LOG_TYPE_CONFIG_OSVERSION (EVENT_TRACE_GROUP_CONFIG | EVENT_TRACE_TYPE_CONFIG_OSVERSION)
//#define WMI_LOG_TYPE_CONFIG_VISUALTHEME (EVENT_TRACE_GROUP_CONFIG | EVENT_TRACE_TYPE_CONFIG_VISUALTHEME)
//#define WMI_LOG_TYPE_CONFIG_SYSTEMRANGE (EVENT_TRACE_GROUP_CONFIG | EVENT_TRACE_TYPE_CONFIG_SYSTEMRANGE)
//#define WMI_LOG_TYPE_CONFIG_SYSDLLINFO (EVENT_TRACE_GROUP_CONFIG | EVENT_TRACE_TYPE_CONFIG_SYSDLLINFO)
#define WMI_LOG_TYPE_CONFIG_IRQ (EVENT_TRACE_GROUP_CONFIG | EVENT_TRACE_TYPE_CONFIG_IRQ)
#define WMI_LOG_TYPE_CONFIG_PNP (EVENT_TRACE_GROUP_CONFIG | EVENT_TRACE_TYPE_CONFIG_PNP)
#define WMI_LOG_TYPE_CONFIG_IDECHANNEL (EVENT_TRACE_GROUP_CONFIG | EVENT_TRACE_TYPE_CONFIG_IDECHANNEL)
#define WMI_LOG_TYPE_CONFIG_NUMANODE (EVENT_TRACE_GROUP_CONFIG | EVENT_TRACE_TYPE_CONFIG_NUMANODE)
#define WMI_LOG_TYPE_CONFIG_PLATFORM (EVENT_TRACE_GROUP_CONFIG | EVENT_TRACE_TYPE_CONFIG_PLATFORM)
#define WMI_LOG_TYPE_CONFIG_PROCESSORGROUP (EVENT_TRACE_GROUP_CONFIG | EVENT_TRACE_TYPE_CONFIG_PROCESSORGROUP)
#define WMI_LOG_TYPE_CONFIG_PROCESSORNUMBER (EVENT_TRACE_GROUP_CONFIG | EVENT_TRACE_TYPE_CONFIG_PROCESSORNUMBER)
#define WMI_LOG_TYPE_CONFIG_DPI (EVENT_TRACE_GROUP_CONFIG | EVENT_TRACE_TYPE_CONFIG_DPI)
#define WMI_LOG_TYPE_CONFIG_CODEINTEGRITY (EVENT_TRACE_GROUP_CONFIG | EVENT_TRACE_TYPE_CONFIG_CI_INFO)
#define WMI_LOG_TYPE_CONFIG_MACHINEID (EVENT_TRACE_GROUP_CONFIG | EVENT_TRACE_TYPE_CONFIG_MACHINEID)
//
// Event for Image and File Name
//
#define PERFINFO_LOG_TYPE_FILENAME (EVENT_TRACE_GROUP_FILE | EVENT_TRACE_TYPE_INFO)
#define PERFINFO_LOG_TYPE_FILENAME_CREATE (EVENT_TRACE_GROUP_FILE | 0x20)
#define PERFINFO_LOG_TYPE_FILENAME_SAME (EVENT_TRACE_GROUP_FILE | 0x21)
#define PERFINFO_LOG_TYPE_FILENAME_NULL (EVENT_TRACE_GROUP_FILE | 0x22)
#define PERFINFO_LOG_TYPE_FILENAME_DELETE (EVENT_TRACE_GROUP_FILE | 0x23)
#define PERFINFO_LOG_TYPE_FILENAME_RUNDOWN (EVENT_TRACE_GROUP_FILE | 0x24)
#define PERFINFO_LOG_TYPE_MAPFILE (EVENT_TRACE_GROUP_FILE | 0x25)
#define PERFINFO_LOG_TYPE_UNMAPFILE (EVENT_TRACE_GROUP_FILE | 0x26)
#define PERFINFO_LOG_TYPE_MAPFILE_DC_START (EVENT_TRACE_GROUP_FILE | 0x27)
#define PERFINFO_LOG_TYPE_MAPFILE_DC_END (EVENT_TRACE_GROUP_FILE | 0x28)
#define PERFINFO_LOG_TYPE_FILE_IO_CREATE (EVENT_TRACE_GROUP_FILE | 0x40)
#define PERFINFO_LOG_TYPE_FILE_IO_CLEANUP (EVENT_TRACE_GROUP_FILE | 0x41)
#define PERFINFO_LOG_TYPE_FILE_IO_CLOSE (EVENT_TRACE_GROUP_FILE | 0x42)
#define PERFINFO_LOG_TYPE_FILE_IO_READ (EVENT_TRACE_GROUP_FILE | 0x43)
#define PERFINFO_LOG_TYPE_FILE_IO_WRITE (EVENT_TRACE_GROUP_FILE | 0x44)
#define PERFINFO_LOG_TYPE_FILE_IO_SET_INFORMATION (EVENT_TRACE_GROUP_FILE | 0x45)
#define PERFINFO_LOG_TYPE_FILE_IO_DELETE (EVENT_TRACE_GROUP_FILE | 0x46)
#define PERFINFO_LOG_TYPE_FILE_IO_RENAME (EVENT_TRACE_GROUP_FILE | 0x47)
#define PERFINFO_LOG_TYPE_FILE_IO_DIRENUM (EVENT_TRACE_GROUP_FILE | 0x48)
#define PERFINFO_LOG_TYPE_FILE_IO_FLUSH (EVENT_TRACE_GROUP_FILE | 0x49)
#define PERFINFO_LOG_TYPE_FILE_IO_QUERY_INFORMATION (EVENT_TRACE_GROUP_FILE | 0x4A)
#define PERFINFO_LOG_TYPE_FILE_IO_FS_CONTROL (EVENT_TRACE_GROUP_FILE | 0x4B)
#define PERFINFO_LOG_TYPE_FILE_IO_OPERATION_END (EVENT_TRACE_GROUP_FILE | 0x4C)
#define PERFINFO_LOG_TYPE_FILE_IO_DIRNOTIFY (EVENT_TRACE_GROUP_FILE | 0x4D)
#define PERFINFO_LOG_TYPE_FILE_IO_CREATE_NEW (EVENT_TRACE_GROUP_FILE | 0x4E)
#define PERFINFO_LOG_TYPE_FILE_IO_DELETE_PATH (EVENT_TRACE_GROUP_FILE | 0x4F)
#define PERFINFO_LOG_TYPE_FILE_IO_RENAME_PATH (EVENT_TRACE_GROUP_FILE | 0x50)
#define PERFINFO_LOG_TYPE_FILE_IO_SETLINK_PATH (EVENT_TRACE_GROUP_FILE | 0x51)
#define PERFINFO_LOG_TYPE_FILE_IO_SETLINK (EVENT_TRACE_GROUP_FILE | 0x52)
//
// Event types for minifilter callbacks
//
#define PERFINFO_LOG_TYPE_FLT_PREOP_INIT (EVENT_TRACE_GROUP_FILE | EVENT_TRACE_TYPE_FLT_PREOP_INIT)
#define PERFINFO_LOG_TYPE_FLT_POSTOP_INIT (EVENT_TRACE_GROUP_FILE | EVENT_TRACE_TYPE_FLT_POSTOP_INIT)
#define PERFINFO_LOG_TYPE_FLT_PREOP_COMPLETION (EVENT_TRACE_GROUP_FILE | EVENT_TRACE_TYPE_FLT_PREOP_COMPLETION)
#define PERFINFO_LOG_TYPE_FLT_POSTOP_COMPLETION (EVENT_TRACE_GROUP_FILE | EVENT_TRACE_TYPE_FLT_POSTOP_COMPLETION)
#define PERFINFO_LOG_TYPE_FLT_PREOP_FAILURE (EVENT_TRACE_GROUP_FILE | EVENT_TRACE_TYPE_FLT_PREOP_FAILURE)
#define PERFINFO_LOG_TYPE_FLT_POSTOP_FAILURE (EVENT_TRACE_GROUP_FILE | EVENT_TRACE_TYPE_FLT_POSTOP_FAILURE)
//
// Event types for Job
//
#define WMI_LOG_TYPE_JOB_CREATE (EVENT_TRACE_GROUP_JOB | 0x20)
#define WMI_LOG_TYPE_JOB_TERMINATE (EVENT_TRACE_GROUP_JOB | 0x21)
#define WMI_LOG_TYPE_JOB_OPEN (EVENT_TRACE_GROUP_JOB | 0x22)
#define WMI_LOG_TYPE_JOB_ASSIGN_PROCESS (EVENT_TRACE_GROUP_JOB | 0x23)
#define WMI_LOG_TYPE_JOB_REMOVE_PROCESS (EVENT_TRACE_GROUP_JOB | 0x24)
#define WMI_LOG_TYPE_JOB_SET (EVENT_TRACE_GROUP_JOB | 0x25)
#define WMI_LOG_TYPE_JOB_QUERY (EVENT_TRACE_GROUP_JOB | 0x26)
#define WMI_LOG_TYPE_JOB_SET_FAILED (EVENT_TRACE_GROUP_JOB | 0x27)
#define WMI_LOG_TYPE_JOB_QUERY_FAILED (EVENT_TRACE_GROUP_JOB | 0x28)
#define WMI_LOG_TYPE_JOB_SET_NOTIFICATION (EVENT_TRACE_GROUP_JOB | 0x29)
#define WMI_LOG_TYPE_JOB_SEND_NOTIFICATION (EVENT_TRACE_GROUP_JOB | 0x2A)
#define WMI_LOG_TYPE_JOB_QUERY_VIOLATION (EVENT_TRACE_GROUP_JOB | 0x2B)
#define WMI_LOG_TYPE_JOB_SET_CPU_RATE (EVENT_TRACE_GROUP_JOB | 0x2C)
#define WMI_LOG_TYPE_JOB_SET_NET_RATE (EVENT_TRACE_GROUP_JOB | 0x2D)
//
// Event types for Process
//
#define WMI_LOG_TYPE_PROCESS_CREATE (EVENT_TRACE_GROUP_PROCESS | EVENT_TRACE_TYPE_START)
#define WMI_LOG_TYPE_PROCESS_DELETE (EVENT_TRACE_GROUP_PROCESS | EVENT_TRACE_TYPE_END)
#define WMI_LOG_TYPE_PROCESS_DC_START (EVENT_TRACE_GROUP_PROCESS | EVENT_TRACE_TYPE_DC_START)
#define WMI_LOG_TYPE_PROCESS_DC_END (EVENT_TRACE_GROUP_PROCESS | EVENT_TRACE_TYPE_DC_END)
#define WMI_LOG_TYPE_PROCESS_LOAD_IMAGE (EVENT_TRACE_GROUP_PROCESS | EVENT_TRACE_TYPE_LOAD)
#define WMI_LOG_TYPE_PROCESS_TERMINATE (EVENT_TRACE_GROUP_PROCESS | EVENT_TRACE_TYPE_TERMINATE)
#define PERFINFO_LOG_TYPE_PROCESS_PERFCTR_END (EVENT_TRACE_GROUP_PROCESS | 0x20)
#define PERFINFO_LOG_TYPE_PROCESS_PERFCTR_RD (EVENT_TRACE_GROUP_PROCESS | 0x21)
// Reserved (EVENT_TRACE_GROUP_PROCESS | 0x22)
#define PERFINFO_LOG_TYPE_INSWAPPROCESS (EVENT_TRACE_GROUP_PROCESS | 0x23)
#define PERFINFO_LOG_TYPE_PROCESS_FREEZE (EVENT_TRACE_GROUP_PROCESS | 0x24)
#define PERFINFO_LOG_TYPE_PROCESS_THAW (EVENT_TRACE_GROUP_PROCESS | 0x25)
#define PERFINFO_LOG_TYPE_BOOT_PHASE_START (EVENT_TRACE_GROUP_PROCESS | 0x26)
#define PERFINFO_LOG_TYPE_ZOMBIE_PROCESS (EVENT_TRACE_GROUP_PROCESS | 0x27)
#define PERFINFO_LOG_TYPE_PROCESS_SET_AFFINITY (EVENT_TRACE_GROUP_PROCESS | 0x28)
#define PERFINFO_LOG_TYPE_CHARGE_WAKE_COUNTER_USER (EVENT_TRACE_GROUP_PROCESS | 0x30)
#define PERFINFO_LOG_TYPE_CHARGE_WAKE_COUNTER_EXECUTION (EVENT_TRACE_GROUP_PROCESS | 0x31)
#define PERFINFO_LOG_TYPE_CHARGE_WAKE_COUNTER_KERNEL (EVENT_TRACE_GROUP_PROCESS | 0x32)
#define PERFINFO_LOG_TYPE_CHARGE_WAKE_COUNTER_INSTRUMENTATION (EVENT_TRACE_GROUP_PROCESS | 0x33)
#define PERFINFO_LOG_TYPE_CHARGE_WAKE_COUNTER_PRESERVE_PROCESS (EVENT_TRACE_GROUP_PROCESS | 0x34)
#define PERFINFO_LOG_TYPE_RELEASE_WAKE_COUNTER_USER (EVENT_TRACE_GROUP_PROCESS | 0x40)
#define PERFINFO_LOG_TYPE_RELEASE_WAKE_COUNTER_EXECUTION (EVENT_TRACE_GROUP_PROCESS | 0x41)
#define PERFINFO_LOG_TYPE_RELEASE_WAKE_COUNTER_KERNEL (EVENT_TRACE_GROUP_PROCESS | 0x42)
#define PERFINFO_LOG_TYPE_RELEASE_WAKE_COUNTER_INSTRUMENTATION (EVENT_TRACE_GROUP_PROCESS | 0x43)
#define PERFINFO_LOG_TYPE_RELEASE_WAKE_COUNTER_PRESERVE_PROCESS (EVENT_TRACE_GROUP_PROCESS | 0x44)
#define PERFINFO_LOG_TYPE_WAKE_DROP_USER (EVENT_TRACE_GROUP_PROCESS | 0x50)
#define PERFINFO_LOG_TYPE_WAKE_DROP_EXECUTION (EVENT_TRACE_GROUP_PROCESS | 0x51)
#define PERFINFO_LOG_TYPE_WAKE_DROP_KERNEL (EVENT_TRACE_GROUP_PROCESS | 0x52)
#define PERFINFO_LOG_TYPE_WAKE_DROP_INSTRUMENTATION (EVENT_TRACE_GROUP_PROCESS | 0x53)
#define PERFINFO_LOG_TYPE_WAKE_DROP_PRESERVE_PROCESS (EVENT_TRACE_GROUP_PROCESS | 0x54)
#define PERFINFO_LOG_TYPE_WAKE_EVENT_USER (EVENT_TRACE_GROUP_PROCESS | 0x60)
#define PERFINFO_LOG_TYPE_WAKE_EVENT_EXECUTION (EVENT_TRACE_GROUP_PROCESS | 0x61)
#define PERFINFO_LOG_TYPE_WAKE_EVENT_KERNEL (EVENT_TRACE_GROUP_PROCESS | 0x62)
#define PERFINFO_LOG_TYPE_WAKE_EVENT_INSTRUMENTATION (EVENT_TRACE_GROUP_PROCESS | 0x63)
#define PERFINFO_LOG_TYPE_WAKE_EVENT_PRESERVE_PROCESS (EVENT_TRACE_GROUP_PROCESS | 0x64)
#define PERFINFO_LOG_TYPE_DEBUG_EVENT (EVENT_TRACE_GROUP_PROCESS | 0x70)