event.h

#pragma once
// @test: rename to "event_trace.h"?
// @todo: no bit/version selection

#pragma pack(push, 8)
#if Q_NT_VERSION >= Q_NT_VISTA
#ifndef _TRACEHANDLE_DEFINED
#define _TRACEHANDLE_DEFINED
using TRACEHANDLE = std::uint64_t;
#endif

using EVENT_TRACE_INFORMATION_CLASS = enum _EVENT_TRACE_INFORMATION_CLASS : std::uint32_t
{
	EventTraceKernelVersionInformation = 0, // EVENT_TRACE_VERSION_INFORMATION
	EventTraceGroupMaskInformation = 1, // EVENT_TRACE_GROUPMASK_INFORMATION
	EventTracePerformanceInformation = 2, // EVENT_TRACE_PERFORMANCE_INFORMATION
	EventTraceTimeProfileInformation = 3, // EVENT_TRACE_TIME_PROFILE_INFORMATION
	EventTraceSessionSecurityInformation = 4, // EVENT_TRACE_SESSION_SECURITY_INFORMATION
#if Q_NT_VERSION >= Q_NT_WIN7
	EventTraceSpinlockInformation = 5, // EVENT_TRACE_SPINLOCK_INFORMATION
	EventTraceStackTracingInformation = 6, // EVENT_TRACE_STACK_TRACING_INFORMATION
	EventTraceExecutiveResourceInformation = 7, // EVENT_TRACE_EXECUTIVE_RESOURCE_INFORMATION
	EventTraceHeapTracingInformation = 8, // EVENT_TRACE_HEAP_TRACING_INFORMATION
	EventTraceHeapSummaryTracingInformation = 9, // EVENT_TRACE_HEAP_TRACING_INFORMATION
	EventTracePoolTagFilterInformation = 10, // EVENT_TRACE_POOLTAG_FILTER_INFORMATION
#endif
#if Q_NT_VERSION >= Q_NT_WIN8
	EventTracePebsTracingInformation = 11, // EVENT_TRACE_PEBS_TRACING_INFORMATION
	EventTraceProfileConfigInformation = 12, // EVENT_TRACE_PROFILE_CONFIG_INFORMATION
	EventTraceProfileSourceListInformation = 13, // EVENT_TRACE_PROFILE_LIST_INFORMATION
	EventTraceProfileEventListInformation = 14, // EVENT_TRACE_PROFILE_EVENT_INFORMATION
	EventTraceProfileCounterListInformation = 15, // EVENT_TRACE_PROFILE_COUNTER_INFORMATION
	EventTraceStackCachingInformation = 16, // EVENT_TRACE_STACK_CACHING_INFORMATION
	EventTraceObjectTypeFilterInformation = 17, // EVENT_TRACE_OBJECT_TYPE_FILTER_INFORMATION
#endif
#if Q_NT_VERSION >= Q_NT_WIN10_RS1
	EventTraceSoftRestartInformation = 18, // EVENT_TRACE_SOFT_RESTART_INFORMATION
#endif
#if Q_NT_VERSION >= Q_NT_WIN10_RS3
	EventTraceLastBranchConfigurationInformation = 19,
	EventTraceLastBranchEventListInformation = 20, // EVENT_TRACE_PROFILE_EVENT_INFORMATION
#endif
#if Q_NT_VERSION >= Q_NT_WIN10_RS4
	EventTraceProfileSourceAddInformation = 21, // EVENT_TRACE_PROFILE_ADD_INFORMATION
	EventTraceProfileSourceRemoveInformation = 22, // EVENT_TRACE_PROFILE_REMOVE_INFORMATION
	EventTraceProcessorTraceConfigurationInformation = 23,
	EventTraceProcessorTraceEventListInformation = 24, // EVENT_TRACE_PROFILE_EVENT_INFORMATION
	EventTraceCoverageSamplerInformation = 25, // EVENT_TRACE_COVERAGE_SAMPLER_INFORMATION
#endif
#if Q_NT_VERSION >= Q_NT_WIN10_21H1
	EventTraceUnifiedStackCachingInformation = 26,
#endif
#if Q_NT_VERSION >= Q_NT_WIN11_24H2
	EventTraceContextRegisterTraceInformation = 27, // TRACE_CONTEXT_REGISTER_INFO
#endif
	MaxEventTraceInfoClass
};

struct EVENT_TRACE_VERSION_INFORMATION
{
	EVENT_TRACE_INFORMATION_CLASS EventTraceInformationClass;
	std::uint32_t EventTraceKernelVersion;
};

struct PERFINFO_GROUPMASK
{
	std::uint32_t Masks[8];
};

struct EVENT_TRACE_GROUPMASK_INFORMATION
{
	EVENT_TRACE_INFORMATION_CLASS EventTraceInformationClass;
	TRACEHANDLE TraceHandle;
	PERFINFO_GROUPMASK EventTraceGroupMasks;
};

struct EVENT_TRACE_PERFORMANCE_INFORMATION
{
	EVENT_TRACE_INFORMATION_CLASS EventTraceInformationClass;
	LARGE_INTEGER LogfileBytesWritten;
};

struct EVENT_TRACE_TIME_PROFILE_INFORMATION
{
	EVENT_TRACE_INFORMATION_CLASS EventTraceInformationClass;
	std::uint32_t ProfileInterval;
};

struct EVENT_TRACE_SESSION_SECURITY_INFORMATION
{
	EVENT_TRACE_INFORMATION_CLASS EventTraceInformationClass;
	std::uint32_t SecurityInformation;
	TRACEHANDLE TraceHandle;
	std::uint8_t SecurityDescriptor[ANYSIZE_ARRAY];
};

struct EVENT_TRACE_SPINLOCK_INFORMATION
{
	EVENT_TRACE_INFORMATION_CLASS EventTraceInformationClass;
	std::uint32_t SpinLockSpinThreshold;
	std::uint32_t SpinLockAcquireSampleRate;
	std::uint32_t SpinLockContentionSampleRate;
	std::uint32_t SpinLockHoldThreshold;
};

struct EVENT_TRACE_SYSTEM_EVENT_INFORMATION
{
	EVENT_TRACE_INFORMATION_CLASS EventTraceInformationClass;
	TRACEHANDLE TraceHandle;
	std::uint32_t HookId[ANYSIZE_ARRAY];
};
using EVENT_TRACE_STACK_TRACING_INFORMATION = EVENT_TRACE_SYSTEM_EVENT_INFORMATION;
using EVENT_TRACE_PEBS_TRACING_INFORMATION = EVENT_TRACE_SYSTEM_EVENT_INFORMATION;
using EVENT_TRACE_PROFILE_EVENT_INFORMATION = EVENT_TRACE_SYSTEM_EVENT_INFORMATION;

struct EVENT_TRACE_EXECUTIVE_RESOURCE_INFORMATION
{
	EVENT_TRACE_INFORMATION_CLASS EventTraceInformationClass;
	std::uint32_t ReleaseSamplingRate;
	std::uint32_t ContentionSamplingRate;
	std::uint32_t NumberOfExcessiveTimeouts;
};

struct EVENT_TRACE_HEAP_TRACING_INFORMATION
{
	EVENT_TRACE_INFORMATION_CLASS EventTraceInformationClass;
	std::uint32_t ProcessId[ANYSIZE_ARRAY];
};

struct EVENT_TRACE_TAG_FILTER_INFORMATION
{
	EVENT_TRACE_INFORMATION_CLASS EventTraceInformationClass;
	TRACEHANDLE TraceHandle;
	std::uint32_t Filter[ANYSIZE_ARRAY];
};
using EVENT_TRACE_POOLTAG_FILTER_INFORMATION = EVENT_TRACE_TAG_FILTER_INFORMATION;
using EVENT_TRACE_OBJECT_TYPE_FILTER_INFORMATION = EVENT_TRACE_TAG_FILTER_INFORMATION;

#define ETW_MAX_PROFILING_SOURCES 4
#define ETW_MAX_PMC_EVENTS 4
#define ETW_MAX_PMC_COUNTERS 4

struct EVENT_TRACE_PROFILE_COUNTER_INFORMATION
{
	EVENT_TRACE_INFORMATION_CLASS EventTraceInformationClass;
	TRACEHANDLE TraceHandle;
	std::uint32_t ProfileSource[ANYSIZE_ARRAY];
};
using EVENT_TRACE_PROFILE_CONFIG_INFORMATION = EVENT_TRACE_PROFILE_COUNTER_INFORMATION;

struct PROFILE_SOURCE_INFO
{
	std::uint32_t NextEntryOffset;
	std::uint32_t Source;
	std::uint32_t MinInterval;
	std::uint32_t MaxInterval;
	void* Reserved;
	wchar_t Description[ANYSIZE_ARRAY];
};

struct EVENT_TRACE_PROFILE_LIST_INFORMATION
{
	EVENT_TRACE_INFORMATION_CLASS EventTraceInformationClass;
	std::uint32_t Spare;
	PROFILE_SOURCE_INFO* Profile[ANYSIZE_ARRAY];
};

struct EVENT_TRACE_STACK_CACHING_INFORMATION
{
	EVENT_TRACE_INFORMATION_CLASS EventTraceInformationClass;
	TRACEHANDLE TraceHandle;
	bool Enabled;
	std::uint8_t Reserved[3];
	std::uint32_t CacheSize;
	std::uint32_t BucketCount;
};

struct EVENT_TRACE_SOFT_RESTART_INFORMATION
{
	EVENT_TRACE_INFORMATION_CLASS EventTraceInformationClass;
	TRACEHANDLE TraceHandle;
	bool PersistTraceBuffers;
	wchar_t FileName[ANYSIZE_ARRAY];
};

using EVENT_TRACE_PROFILE_ADD_INFORMATION_VERSIONS = enum _EVENT_TRACE_PROFILE_ADD_INFORMATION_VERSIONS
{
	EventTraceProfileAddInformationV2 = 0x2,
	EventTraceProfileAddInformationV3 = 0x3,
	EventTraceProfileAddInformationMinVersion = EventTraceProfileAddInformationV2,
	EventTraceProfileAddInformationMaxVersion = EventTraceProfileAddInformationV3
};

union EVENT_TRACE_PROFILE_ADD_INFORMATION_V2
{
	struct
	{
		std::uint8_t PerfEvtEventSelect;
		std::uint8_t PerfEvtUnitSelect;
		std::uint8_t PerfEvtCMask;
		std::uint8_t PerfEvtCInv;
		std::uint8_t PerfEvtAnyThread;
		std::uint8_t PerfEvtEdgeDetect;
	} Intel;
	struct
	{
		std::uint8_t PerfEvtEventSelect;
		std::uint8_t PerfEvtUnitSelect;
	} Amd;
	struct
	{
		std::uint32_t PerfEvtType;
		std::uint8_t AllowsHalt;
	} Arm;
};

union EVENT_TRACE_PROFILE_ADD_INFORMATION_V3
{
	struct
	{
		std::uint8_t PerfEvtEventSelect;
		std::uint8_t PerfEvtUnitSelect;
		std::uint8_t PerfEvtCMask;
		std::uint8_t PerfEvtCInv;
		std::uint8_t PerfEvtAnyThread;
		std::uint8_t PerfEvtEdgeDetect;
	} Intel;
	struct
	{
		std::uint16_t PerfEvtEventSelect;
		std::uint8_t PerfEvtUnitSelect;
		std::uint8_t PerfEvtCMask;
		std::uint8_t PerfEvtCInv;
		std::uint8_t PerfEvtEdgeDetect;
		std::uint8_t PerfEvtHostGuest;
		std::uint8_t PerfPmuType;
	} Amd;
	struct
	{
		std::uint32_t PerfEvtType;
		std::uint8_t AllowsHalt;
	} Arm;
};

struct EVENT_TRACE_PROFILE_ADD_INFORMATION
{
	EVENT_TRACE_INFORMATION_CLASS EventTraceInformationClass;
	std::uint8_t Version;
	union
	{
		EVENT_TRACE_PROFILE_ADD_INFORMATION_V2 V2;
		EVENT_TRACE_PROFILE_ADD_INFORMATION_V3 V3;
	};
	std::uint32_t CpuInfoHierarchy[0x3];
	std::uint32_t InitialInterval;
	bool Persist;
	wchar_t ProfileSourceDescription[0x1];
};

struct EVENT_TRACE_PROFILE_REMOVE_INFORMATION
{
	EVENT_TRACE_INFORMATION_CLASS EventTraceInformationClass;
	KPROFILE_SOURCE ProfileSource;
	std::uint32_t CpuInfoHierarchy[3];
};

struct EVENT_TRACE_COVERAGE_SAMPLER_INFORMATION
{
	EVENT_TRACE_INFORMATION_CLASS EventTraceInformationClass;
	std::uint8_t CoverageSamplerInformationClass;
	std::uint8_t MajorVersion;
	std::uint8_t MinorVersion;
	std::uint8_t Reserved;
	HANDLE SamplerHandle;
};
#endif
#pragma pack(pop)