CeLogImportTable (Windows Embedded CE 6.0)

1/5/2010

This structure contains function pointers and data provided by the kernel for use by CeLog.

Syntax

typedef struct _CeLogImportTable {
  DWORD dwVersion;
  FARPROC pCreateEventW;
  FARPROC pEventModify;
  FARPROC pCreateFileMappingW;
  FARPROC pMapViewOfFile;
  FARPROC pUnmapViewOfFile;
  FARPROC pCloseHandle;
  FARPROC pLockPages;
  FARPROC pUnlockPages;
  FARPROC pVirtualAlloc;
  FARPROC pVirtualFree;
  FARPROC pMapPtrToProcess;
  FARPROC pQueryPerformanceCounter;
  FARPROC pQueryPerformanceFrequency;
  FARPROC pNKDbgPrintfW;
  FARPROC pCeLogReSync;
  FARPROC pGetLastError;
  FARPROC pSetLastError;
  FARPROC pGetThreadCallStack;
  FARPROC pInSysCall;
  DWORD* pdwCeLogTLBMiss;
  DWORD dwCeLogLargeBuf;
  DWORD dwCeLogSmallBuf;
  DWORD dwDefaultThreadQuantum;
} CeLogImportTable;

Members

• dwVersion
  Version of this structure.

  Must be set to 4.

• pCreateEventW
  Pointer to the DLL's version of CreateEvent.

• pEventModify
  Pointer to the DLL's version of EventModify.

  EventModify is used to implement the SetEvent, ResetEvent, and PulseEvent functions. The equivalent calls for these are:

  SetEvent(h)->pEventModify(h, EVENT_SET)

  ResetEvent(h)->pEventModify(h, EVENT_RESET)

  PulseEvent(h)->pEventModify(h, EVENT_PULSE)

  The pEventModify function that you pass as part of CeLogImportTable does nothing if you call it during a KCall. A CeLog DLL can test whether it's in a KCall by using the pInSysCall function that's part of CeLogImportTable too. See KCall Check section in Remarks.

• pCreateFileMappingW
  Pointer to the DLL's version of CreateFileMapping.

• pMapViewOfFile
  Pointer to the DLL's version of MapViewOfFile.

  This pointer will be NULL if the kernel does not include support for memory-mapped files.

• pUnmapViewOfFile
  Pointer to the DLL's version of UnmapViewOfFile.

• pCloseHandle
  Pointer to the DLL's version of CloseHandle.

• pLockPages
  Pointer to the DLL's version of LockPages.

• pUnlockPages
  Pointer to the DLL's version of UnlockPages.

• pVirtualAlloc
  Pointer to the DLL's version of VirtualAlloc.

• pVirtualFree
  Pointer to the DLL's version of VirtualFree.

• pMapPtrToProcess
  Pointer to the DLL's version of MapPtrToProcess.

• pQueryPerformanceCounter
  Pointer to the DLL's version of QueryPerformanceCounter.

• pQueryPerformanceFrequency
  Pointer to the DLL's version of QueryPerformanceFrequency.

• pNKDbgPrintfW
  Pointer to the DLL's version of NKDbgPrintf.

• pCeLogReSync
  Pointer to the DLL's version of CeLogReSync.

• pGetLastError
  Pointer to the DLL's version of GetLastError.

• pSetLastError
  Pointer to the DLL's version of SetLastError.

• pGetThreadCallStack
  Pointer to the DLL's version of GetThreadCallStack.

• pInSysCall
  Pointer to the DLL's version of the InSysCall wrapper function.

  For information about important restrictions for this function, see the Remarks section.

• pdwCeLogTLBMiss
  Pointer to the translation look-aside buffer (TLB) miss count.

  The kernel software TLB miss handler maintains this pointer, if applicable. Only MIPS and SHx use software TLB miss handlers.

• dwCeLogLargeBuf
  OEM-changeable large buffer size.

• dwCeLogSmallBuf
  OEM-changeable small buffer size.

• dwDefaultThreadQuantum
  Scheduler's default thread quantum.

Remarks

CeLogImportTable is used in conjunction with IOCTL_CELOG_IMPORT, which is the IOCTL used by the CeLog DLL to request information about the kernel.

Because an event tracking library loads into the kernel, the kernel often calls CeLogData from within parts of the kernel where it is not safe to make system calls. These restrictions mean that it is not safe to interact with the kernel debugger to perform activities such as setting a breakpoint, or stepping through the code in the debugger.

In addition, it is not safe to call the functions in the CeLogImportTable that are logged during restricted parts of the kernel. Failing to follow these restrictions might cause an unrecoverable system crash.

The following list shows the CeLog events which are logged during restricted parts of the kernel; that is, the following list shows the CeLog events for which the CeLogImportTablepInSysCall() function will return TRUE.

• CELID_THREAD_SWITCH
• CELID_THREAD_QUANTUMEXPIRE
• CELID_SYSTEM_INVERT
• CELID_THREAD_PRIORITY
• CELID_THREAD_QUANTUM
• CELID_THREAD_SUSPEND
• CELID_THREAD_RESUME
• CELID_PROCESS_CREATE CELID_EXTRA_PROCESS_INFO
• CELID_THREAD_CREATE
• CELID_MODULE_LOAD
• CELID_EXTRA_MODULE_INFO
• CELID_MODULE_REFERENCES
• CELID_LOG_MARKER
• CELID_SYNC_END

KCall check

CeLogImportTable g_PubImports;  // Initialization not shown
HANDLE hEvent;  // Initialization not shown
BOOL g_NeedToSetEvent = FALSE;
//
// Note: This code is not thread safe
if (g_NeedToSetEvent || <detect a need to set the event>) {  // If we need to set the event
     if (g_PubImports.pInSysCall()) {
         // We can't set the event now... do it on our next call
         g_NeedToSetEvent = TRUE;
     } else {
         g_PubImports.pEventModify(hEvent, EVENT_SET);
         g_NeedToSetEvent = FALSE;
     }
}
//

Requirements

See Also

Reference

OAL Structures
IOCTL_CELOG_IMPORT

Other Resources

CreateFileMapping
MapViewOfFile
UnmapViewOfFile
CloseHandle
LockPages
UnlockPages
VirtualAlloc
VirtualFree
MapPtrToProcess
QueryPerformanceCounter
QueryPerformanceFrequency
CeLogReSync
GetLastError
SetLastError
GetThreadCallStack