1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
|
// Copyright 2024 The Chromium Authors
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
#ifdef UNSAFE_BUFFERS_BUILD
// TODO(crbug.com/40285824): Remove this and convert code to safer constructs.
#pragma allow_unsafe_buffers
#endif
#include "components/tracing/common/etw_system_data_source_win.h"
#include <windows.h>
#include <evntcons.h>
#include <evntrace.h>
#include <ios>
#include "base/check.h"
#include "base/logging.h"
#include "base/task/thread_pool.h"
#include "components/tracing/common/etw_consumer_win.h"
#include "third_party/perfetto/include/perfetto/ext/tracing/core/trace_writer.h"
#include "third_party/perfetto/include/perfetto/tracing/core/data_source_descriptor.h"
#include "third_party/perfetto/protos/perfetto/config/etw/etw_config.gen.h"
namespace tracing {
namespace {
ULONG EtwSystemFlagsFromEnum(
perfetto::protos::gen::EtwConfig::KernelFlag flag) {
switch (flag) {
case perfetto::protos::gen::EtwConfig::CSWITCH:
return EVENT_TRACE_FLAG_CSWITCH;
case perfetto::protos::gen::EtwConfig::DISPATCHER:
return EVENT_TRACE_FLAG_DISPATCHER;
}
}
} // namespace
// static
void EtwSystemDataSource::Register(base::ProcessId client_pid) {
perfetto::DataSourceDescriptor desc;
desc.set_name("org.chromium.etw_system");
perfetto::DataSource<EtwSystemDataSource>::Register(desc, client_pid);
}
EtwSystemDataSource::EtwSystemDataSource(base::ProcessId client_pid)
: client_pid_(client_pid),
consume_task_runner_(base::ThreadPool::CreateSequencedTaskRunner(
{base::MayBlock(),
base::TaskShutdownBehavior::CONTINUE_ON_SHUTDOWN})),
consumer_{nullptr, base::OnTaskRunnerDeleter(nullptr)} {
DETACH_FROM_SEQUENCE(sequence_checker_);
}
EtwSystemDataSource::~EtwSystemDataSource() {
DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
}
void EtwSystemDataSource::OnSetup(const SetupArgs& args) {
DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
data_source_config_ = *args.config;
}
void EtwSystemDataSource::OnStart(const StartArgs&) {
static constexpr wchar_t kEtwSystemSessionName[] = L"org.chromium.etw_system";
DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
if (data_source_config_.etw_config_raw().empty()) {
DLOG(ERROR) << "Skipping empty etw_config";
return;
}
perfetto::protos::gen::EtwConfig etw_config;
if (!etw_config.ParseFromString(data_source_config_.etw_config_raw())) {
DLOG(ERROR) << "Failed to parse etw_config";
return;
}
base::win::EtwTraceProperties ignore;
HRESULT hr =
base::win::EtwTraceController::Stop(kEtwSystemSessionName, &ignore);
if (FAILED(hr) && hr != HRESULT_FROM_WIN32(ERROR_WMI_INSTANCE_NOT_FOUND)) {
DLOG(ERROR) << "Failed to stop previous trace session: 0x" << std::hex
<< hr;
return;
}
// MD5 hash of "org.chromium.etw_system".
// 696e5ace-ff06-bfc6-4e63-0198f5b3bc99
static constexpr GUID kChromeEtwSystemGuid = {
0x696e5ace,
0xff06,
0xbfc6,
{0x4e, 0x63, 0x01, 0x98, 0xf5, 0xb3, 0xbc, 0x99}};
base::win::EtwTraceProperties prop;
EVENT_TRACE_PROPERTIES& p = *prop.get();
// QPC timer accuracy.
// https://learn.microsoft.com/en-us/windows/win32/etw/wnode-header
p.Wnode.ClientContext = 1;
// Windows 8 and later supports SystemTraceProvider in multiple
// private session that's not NT Kernel Logger.
// https://learn.microsoft.com/en-us/windows/win32/etw/configuring-and-starting-a-systemtraceprovider-session#enable-a-systemtraceprovider-session
prop.SetLoggerName(kEtwSystemSessionName);
p.Wnode.Guid = kChromeEtwSystemGuid;
p.LogFileMode = EVENT_TRACE_REAL_TIME_MODE | EVENT_TRACE_SYSTEM_LOGGER_MODE;
p.MinimumBuffers = 16;
p.BufferSize = 16;
p.FlushTimer = 1; // flush every second.
// Enable process and thread events for categorization and filtering.
p.EnableFlags = EVENT_TRACE_FLAG_PROCESS | EVENT_TRACE_FLAG_THREAD;
for (auto flag : etw_config.kernel_flags()) {
p.EnableFlags |= EtwSystemFlagsFromEnum(flag);
}
hr = etw_controller_.Start(kEtwSystemSessionName, &prop);
if (FAILED(hr)) {
DLOG(ERROR) << "Failed to start system trace session: 0x" << std::hex << hr;
return;
}
consumer_ = {new EtwConsumer(client_pid_, CreateTraceWriter()),
base::OnTaskRunnerDeleter(consume_task_runner_)};
hr = consumer_->OpenRealtimeSession(kEtwSystemSessionName);
if (FAILED(hr)) {
etw_controller_.Stop(nullptr);
consumer_.reset();
DLOG(ERROR) << "Failed to open system trace session: 0x" << std::hex << hr;
return;
}
consume_task_runner_->PostTask(
FROM_HERE, base::BindOnce(&EtwConsumer::ConsumeEvents,
base::Unretained(consumer_.get())));
}
void EtwSystemDataSource::OnStop(const StopArgs&) {
DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
etw_controller_.Stop(nullptr);
consumer_.reset();
}
} // namespace tracing
PERFETTO_DEFINE_DATA_SOURCE_STATIC_MEMBERS_WITH_ATTRS(
TRACING_EXPORT,
tracing::EtwSystemDataSource);
// This should go after PERFETTO_DEFINE_DATA_SOURCE_STATIC_MEMBERS_WITH_ATTRS
// to avoid instantiation of type() template method before specialization.
std::unique_ptr<perfetto::TraceWriterBase>
tracing::EtwSystemDataSource::CreateTraceWriter() {
perfetto::internal::DataSourceStaticState* static_state =
perfetto::DataSourceHelper<EtwSystemDataSource>::type().static_state();
// EtwSystemDataSource disallows multiple instances, so our instance will
// always have index 0.
perfetto::internal::DataSourceState* instance_state = static_state->TryGet(0);
CHECK(instance_state);
return perfetto::internal::TracingMuxer::Get()->CreateTraceWriter(
static_state, data_source_config_.target_buffer(), instance_state,
perfetto::BufferExhaustedPolicy::kDrop);
}
|
