| 222 | } |
| 223 | |
| 224 | int TraceManager::UpdateEventConfig() { |
| 225 | ULONG error = ERROR_SUCCESS; |
| 226 | bool isWin8Plus = ::IsWindows8OrGreater(); |
| 227 | typedef struct _PERFINFO_GROUPMASK { |
| 228 | ULONG Masks[8]; |
| 229 | }PERINFO_GROUPMASK; |
| 230 | |
| 231 | PERFINFO_GROUPMASK gm{}; |
| 232 | gm.Masks[0] = EVENT_TRACE_FLAG_PROCESS; |
| 233 | for (auto type : _kernelEventTypes) { |
| 234 | gm.Masks[((uint64_t)type) >> 32] |= (ULONG)type; |
| 235 | } |
| 236 | error = ::TraceSetInformation(_handle, TraceSystemTraceEnableFlagsInfo, &gm, sizeof(gm)); |
| 237 | if (error != ERROR_SUCCESS) |
| 238 | return error; |
| 239 | |
| 240 | std::vector<CLASSIC_EVENT_ID> stacks; |
| 241 | stacks.reserve(32); |
| 242 | for (auto& name : _kernelEventStacks) { |
| 243 | auto cat = KernelEventCategory::GetCategory(name.c_str()); |
| 244 | assert(cat); |
| 245 | for (auto& evt : cat->Events) { |
| 246 | CLASSIC_EVENT_ID id{}; |
| 247 | id.EventGuid = *cat->Guid; |
| 248 | id.Type = evt.Opcode; |
| 249 | stacks.push_back(id); |
| 250 | } |
| 251 | } |
| 252 | error = ::TraceSetInformation(_handle, TraceStackTracingInfo, stacks.data(), (ULONG)stacks.size() * sizeof(CLASSIC_EVENT_ID)); |
| 253 | |
| 254 | return error; |
| 255 | } |
| 256 | |
| 257 | void TraceManager::OnEventRecord(PEVENT_RECORD rec) { |
| 258 | if (_handle == 0 || _isPaused) |
no test coverage detected