|
| 1 | +// ==++== |
| 2 | +// |
| 3 | +// Copyright (c) Microsoft Corporation. All rights reserved. |
| 4 | +// |
| 5 | +// ==--== |
| 6 | +/*============================================================ |
| 7 | +** |
| 8 | +** Class: UnsafeNativeMethods |
| 9 | +** |
| 10 | +============================================================*/ |
| 11 | +namespace Microsoft.Win32 { |
| 12 | + using Microsoft.Win32; |
| 13 | + using Microsoft.Win32.SafeHandles; |
| 14 | + using System; |
| 15 | + using System.Runtime.CompilerServices; |
| 16 | + using System.Runtime.ConstrainedExecution; |
| 17 | + using System.Runtime.InteropServices; |
| 18 | + using System.Runtime.Serialization; |
| 19 | + using System.Runtime.Versioning; |
| 20 | + using System.Security; |
| 21 | + using System.Security.Permissions; |
| 22 | + using System.Text; |
| 23 | + using System.Diagnostics.Tracing; |
| 24 | + |
| 25 | + [System.Security.SecurityCritical] // auto-generated |
| 26 | + [SuppressUnmanagedCodeSecurityAttribute()] |
| 27 | + internal static class UnsafeNativeMethods |
| 28 | + { |
| 29 | + [SecurityCritical] |
| 30 | + [SuppressUnmanagedCodeSecurityAttribute()] |
| 31 | + internal static unsafe class ManifestEtw |
| 32 | + { |
| 33 | + // |
| 34 | + // Constants error coded returned by ETW APIs |
| 35 | + // |
| 36 | + |
| 37 | + // The event size is larger than the allowed maximum (64k - header). |
| 38 | + internal const int ERROR_ARITHMETIC_OVERFLOW = 534; |
| 39 | + |
| 40 | + // Occurs when filled buffers are trying to flush to disk, |
| 41 | + // but disk IOs are not happening fast enough. |
| 42 | + // This happens when the disk is slow and event traffic is heavy. |
| 43 | + // Eventually, there are no more free (empty) buffers and the event is dropped. |
| 44 | + internal const int ERROR_NOT_ENOUGH_MEMORY = 8; |
| 45 | + |
| 46 | + internal const int ERROR_MORE_DATA = 0xEA; |
| 47 | + internal const int ERROR_NOT_SUPPORTED = 50; |
| 48 | + internal const int ERROR_INVALID_PARAMETER = 0x57; |
| 49 | + |
| 50 | + // |
| 51 | + // ETW Methods |
| 52 | + // |
| 53 | + |
| 54 | + internal const int EVENT_CONTROL_CODE_DISABLE_PROVIDER = 0; |
| 55 | + internal const int EVENT_CONTROL_CODE_ENABLE_PROVIDER = 1; |
| 56 | + internal const int EVENT_CONTROL_CODE_CAPTURE_STATE = 2; |
| 57 | + |
| 58 | + // |
| 59 | + // Callback |
| 60 | + // |
| 61 | + [SecurityCritical] |
| 62 | + internal unsafe delegate void EtwEnableCallback( |
| 63 | + [In] ref Guid sourceId, |
| 64 | + [In] int isEnabled, |
| 65 | + [In] byte level, |
| 66 | + [In] long matchAnyKeywords, |
| 67 | + [In] long matchAllKeywords, |
| 68 | + [In] EVENT_FILTER_DESCRIPTOR* filterData, |
| 69 | + [In] void* callbackContext |
| 70 | + ); |
| 71 | + |
| 72 | + // |
| 73 | + // Registration APIs |
| 74 | + // |
| 75 | + [SecurityCritical] |
| 76 | + [DllImport(Win32Native.ADVAPI32, ExactSpelling = true, EntryPoint = "EventRegister", CharSet = System.Runtime.InteropServices.CharSet.Unicode)] |
| 77 | + internal static extern unsafe uint EventRegister( |
| 78 | + [In] ref Guid providerId, |
| 79 | + [In]EtwEnableCallback enableCallback, |
| 80 | + [In]void* callbackContext, |
| 81 | + [In][Out]ref long registrationHandle |
| 82 | + ); |
| 83 | + |
| 84 | + // |
| 85 | + [SecurityCritical] |
| 86 | + [System.Diagnostics.CodeAnalysis.SuppressMessage("Microsoft.Security", "CA2118:ReviewSuppressUnmanagedCodeSecurityUsage")] |
| 87 | + [DllImport(Win32Native.ADVAPI32, ExactSpelling = true, EntryPoint = "EventUnregister", CharSet = System.Runtime.InteropServices.CharSet.Unicode)] |
| 88 | + internal static extern uint EventUnregister([In] long registrationHandle); |
| 89 | + |
| 90 | + // |
| 91 | + // Writing (Publishing/Logging) APIs |
| 92 | + // |
| 93 | + // |
| 94 | + [SecurityCritical] |
| 95 | + [System.Diagnostics.CodeAnalysis.SuppressMessage("Microsoft.Security", "CA2118:ReviewSuppressUnmanagedCodeSecurityUsage")] |
| 96 | + [DllImport(Win32Native.ADVAPI32, ExactSpelling = true, EntryPoint = "EventWrite", CharSet = System.Runtime.InteropServices.CharSet.Unicode)] |
| 97 | + internal static extern unsafe int EventWrite( |
| 98 | + [In] long registrationHandle, |
| 99 | + [In] ref EventDescriptor eventDescriptor, |
| 100 | + [In] int userDataCount, |
| 101 | + [In] EventProvider.EventData* userData |
| 102 | + ); |
| 103 | + |
| 104 | + [SecurityCritical] |
| 105 | + [System.Diagnostics.CodeAnalysis.SuppressMessage("Microsoft.Security", "CA2118:ReviewSuppressUnmanagedCodeSecurityUsage")] |
| 106 | + [DllImport(Win32Native.ADVAPI32, ExactSpelling = true, EntryPoint = "EventWriteString", CharSet = System.Runtime.InteropServices.CharSet.Unicode)] |
| 107 | + internal static extern unsafe int EventWriteString( |
| 108 | + [In] long registrationHandle, |
| 109 | + [In] byte level, |
| 110 | + [In] long keyword, |
| 111 | + [In] string msg |
| 112 | + ); |
| 113 | + |
| 114 | + [StructLayout(LayoutKind.Sequential)] |
| 115 | + unsafe internal struct EVENT_FILTER_DESCRIPTOR |
| 116 | + { |
| 117 | + public long Ptr; |
| 118 | + public int Size; |
| 119 | + public int Type; |
| 120 | + }; |
| 121 | + |
| 122 | + /// <summary> |
| 123 | + /// Call the ETW native API EventWriteTransfer and checks for invalid argument error. |
| 124 | + /// The implementation of EventWriteTransfer on some older OSes (Windows 2008) does not accept null relatedActivityId. |
| 125 | + /// So, for these cases we will retry the call with an empty Guid. |
| 126 | + /// </summary> |
| 127 | + internal static int EventWriteTransferWrapper(long registrationHandle, |
| 128 | + ref EventDescriptor eventDescriptor, |
| 129 | + Guid* activityId, |
| 130 | + Guid* relatedActivityId, |
| 131 | + int userDataCount, |
| 132 | + EventProvider.EventData* userData) |
| 133 | + { |
| 134 | + int HResult = EventWriteTransfer(registrationHandle, ref eventDescriptor, activityId, relatedActivityId, userDataCount, userData); |
| 135 | + if (HResult == ERROR_INVALID_PARAMETER && relatedActivityId == null) |
| 136 | + { |
| 137 | + Guid emptyGuid = Guid.Empty; |
| 138 | + HResult = EventWriteTransfer(registrationHandle, ref eventDescriptor, activityId, &emptyGuid, userDataCount, userData); |
| 139 | + } |
| 140 | + |
| 141 | + return HResult; |
| 142 | + } |
| 143 | + |
| 144 | + [System.Diagnostics.CodeAnalysis.SuppressMessage("Microsoft.Security", "CA2118:ReviewSuppressUnmanagedCodeSecurityUsage")] |
| 145 | + [DllImport(Win32Native.ADVAPI32, ExactSpelling = true, EntryPoint = "EventWriteTransfer", CharSet = System.Runtime.InteropServices.CharSet.Unicode)] |
| 146 | + [SuppressUnmanagedCodeSecurityAttribute] // Don't do security checks |
| 147 | + private static extern int EventWriteTransfer( |
| 148 | + [In] long registrationHandle, |
| 149 | + [In] ref EventDescriptor eventDescriptor, |
| 150 | + [In] Guid* activityId, |
| 151 | + [In] Guid* relatedActivityId, |
| 152 | + [In] int userDataCount, |
| 153 | + [In] EventProvider.EventData* userData |
| 154 | + ); |
| 155 | + |
| 156 | + internal enum ActivityControl : uint |
| 157 | + { |
| 158 | + EVENT_ACTIVITY_CTRL_GET_ID = 1, |
| 159 | + EVENT_ACTIVITY_CTRL_SET_ID = 2, |
| 160 | + EVENT_ACTIVITY_CTRL_CREATE_ID = 3, |
| 161 | + EVENT_ACTIVITY_CTRL_GET_SET_ID = 4, |
| 162 | + EVENT_ACTIVITY_CTRL_CREATE_SET_ID = 5 |
| 163 | + }; |
| 164 | + |
| 165 | + [System.Diagnostics.CodeAnalysis.SuppressMessage("Microsoft.Security", "CA2118:ReviewSuppressUnmanagedCodeSecurityUsage")] |
| 166 | + [DllImport(Win32Native.ADVAPI32, ExactSpelling = true, EntryPoint = "EventActivityIdControl", CharSet = System.Runtime.InteropServices.CharSet.Unicode)] |
| 167 | + [SuppressUnmanagedCodeSecurityAttribute] // Don't do security checks |
| 168 | + internal static extern int EventActivityIdControl([In] ActivityControl ControlCode, [In][Out] ref Guid ActivityId); |
| 169 | + |
| 170 | + internal enum EVENT_INFO_CLASS |
| 171 | + { |
| 172 | + BinaryTrackInfo, |
| 173 | + SetEnableAllKeywords, |
| 174 | + SetTraits, |
| 175 | + } |
| 176 | + |
| 177 | + [System.Diagnostics.CodeAnalysis.SuppressMessage("Microsoft.Security", "CA2118:ReviewSuppressUnmanagedCodeSecurityUsage")] |
| 178 | + [DllImport(Win32Native.ADVAPI32, ExactSpelling = true, EntryPoint = "EventSetInformation", CharSet = System.Runtime.InteropServices.CharSet.Unicode)] |
| 179 | + [SuppressUnmanagedCodeSecurityAttribute] // Don't do security checks |
| 180 | + internal static extern int EventSetInformation( |
| 181 | + [In] long registrationHandle, |
| 182 | + [In] EVENT_INFO_CLASS informationClass, |
| 183 | + [In] void* eventInformation, |
| 184 | + [In] int informationLength); |
| 185 | + |
| 186 | + // Support for EnumerateTraceGuidsEx |
| 187 | + internal enum TRACE_QUERY_INFO_CLASS |
| 188 | + { |
| 189 | + TraceGuidQueryList, |
| 190 | + TraceGuidQueryInfo, |
| 191 | + TraceGuidQueryProcess, |
| 192 | + TraceStackTracingInfo, |
| 193 | + MaxTraceSetInfoClass |
| 194 | + }; |
| 195 | + |
| 196 | + internal struct TRACE_GUID_INFO |
| 197 | + { |
| 198 | + public int InstanceCount; |
| 199 | + public int Reserved; |
| 200 | + }; |
| 201 | + |
| 202 | + internal struct TRACE_PROVIDER_INSTANCE_INFO |
| 203 | + { |
| 204 | + public int NextOffset; |
| 205 | + public int EnableCount; |
| 206 | + public int Pid; |
| 207 | + public int Flags; |
| 208 | + }; |
| 209 | + |
| 210 | + internal struct TRACE_ENABLE_INFO |
| 211 | + { |
| 212 | + public int IsEnabled; |
| 213 | + public byte Level; |
| 214 | + public byte Reserved1; |
| 215 | + public ushort LoggerId; |
| 216 | + public int EnableProperty; |
| 217 | + public int Reserved2; |
| 218 | + public long MatchAnyKeyword; |
| 219 | + public long MatchAllKeyword; |
| 220 | + }; |
| 221 | + |
| 222 | + [System.Diagnostics.CodeAnalysis.SuppressMessage("Microsoft.Security", "CA2118:ReviewSuppressUnmanagedCodeSecurityUsage")] |
| 223 | + [DllImport(Win32Native.ADVAPI32, ExactSpelling = true, EntryPoint = "EnumerateTraceGuidsEx", CharSet = System.Runtime.InteropServices.CharSet.Unicode)] |
| 224 | + [SuppressUnmanagedCodeSecurityAttribute] // Don't do security checks |
| 225 | + internal static extern int EnumerateTraceGuidsEx( |
| 226 | + TRACE_QUERY_INFO_CLASS TraceQueryInfoClass, |
| 227 | + void* InBuffer, |
| 228 | + int InBufferSize, |
| 229 | + void* OutBuffer, |
| 230 | + int OutBufferSize, |
| 231 | + ref int ReturnLength); |
| 232 | + |
| 233 | + } |
| 234 | + } |
| 235 | +} |
0 commit comments