1 // Licensed to the .NET Foundation under one or more agreements.
2 // The .NET Foundation licenses this file to you under the MIT license.
3 // See the LICENSE file in the project root for more information.
4 
5 using System;
6 using System.Runtime.InteropServices;
7 
8 internal static partial class Interop
9 {
10     internal static partial class Advapi32
11     {
12         [DllImport(Interop.Libraries.Advapi32)]
EventRegister(ref Guid ProviderId, EtwEnableCallback EnableCallback, IntPtr CallbackContext, out ulong RegHandle)13         internal extern static uint EventRegister(ref Guid ProviderId, EtwEnableCallback EnableCallback, IntPtr CallbackContext, out ulong RegHandle);
14 
EtwEnableCallback( ref Guid sourceId, int isEnabled, byte level, ulong matchAnyKeywords, ulong matchAllKeywords, Interop.Kernel32.EVENT_FILTER_DESCRIPTOR* filterData, IntPtr callbackContext )15         internal unsafe delegate void EtwEnableCallback(
16             ref Guid sourceId,
17             int isEnabled,
18             byte level,
19             ulong matchAnyKeywords,
20             ulong matchAllKeywords,
21             Interop.Kernel32.EVENT_FILTER_DESCRIPTOR* filterData,
22             IntPtr callbackContext
23             );
24 
25         [StructLayout(LayoutKind.Sequential)]
26         internal struct EVENT_FILTER_DESCRIPTOR
27         {
28             internal ulong Ptr;
29             internal uint Size;
30             internal uint Type;
31         }
32 
33         //
34         // Constants error coded returned by ETW APIs
35         //
36 
37         // The event size is larger than the allowed maximum (64k - header).
38         internal const int ERROR_ARITHMETIC_OVERFLOW = 534;
39 
40         // Occurs when filled buffers are trying to flush to disk,
41         // but disk IOs are not happening fast enough.
42         // This happens when the disk is slow and event traffic is heavy.
43         // Eventually, there are no more free (empty) buffers and the event is dropped.
44         internal const int ERROR_NOT_ENOUGH_MEMORY = 8;
45 
46         internal const int ERROR_MORE_DATA = 0xEA;
47         internal const int ERROR_NOT_SUPPORTED = 50;
48         internal const int ERROR_INVALID_PARAMETER = 0x57;
49 
50         //
51         // ETW Methods
52         //
53 
54         internal const int EVENT_CONTROL_CODE_DISABLE_PROVIDER = 0;
55         internal const int EVENT_CONTROL_CODE_ENABLE_PROVIDER = 1;
56         internal const int EVENT_CONTROL_CODE_CAPTURE_STATE = 2;
57     }
58 }
59