We don't support actually using ETW on windows/arm, but to make things
easier for downstream dependencies, we want to still allow the package
to compile and just no-op on this architecture. We do this by returning
a nil Provider, and implementing its methods to no-op when the receiver
is nil.
Previously this was implemented by putting NewProviderWithID in
provider_unsupported.go, but when we refactored the code so that the
actual work was done in NewProviderWithOptions instead, we didn't fix up
provider_unsupported. This change fixes this by putting only
NewProviderWithOptions in provider_unsupported.go, since the other
provider creation functions call into this one.
Signed-off-by: Kevin Parsons <kevpar@microsoft.com>
This moves all the current users of
$GOROOT/src/syscall/mksyscall_windows.go to instead use
golang.org/x/sys/windows/mkwinsyscall, as directed by the version of the
former in Go 1.15.
It also syncs the local forks of mksyscall_windows.go with the latest
version of golang.org/x/sys/windows/mkwinsyscall/mkwinsyscall.go, so
that the local patches can be easily seen in a side-by-side comparison.
Significant changes compared to the in-tree forked versions:
* *bool parameters are read back through a temp-var, not directly like
other pointer parameters.
* ?-suffixed function names support testing for function presence before
calling. This replaces a local implementation of this in
pkg/security, which was not actually used anyway. The upstream version
correctly supports functions that don't already have an error return.
* `errnoErr(0)` is now useful, so each call of `errnoErr` doesn't need
to be protected with a check for 0 first.
* The generated functions are now sorted. This of course produced a
*lot* of churn in the generated files.
vhd\vhd.go was changed to generate syscalls into zvhd_windows.go, since
regeneration removes the build tag added by hand in
9d8277341f.
After all that, I also ran
```
go generate . .\pkg\etw\ .\pkg\process\ .\pkg\security\ .\vhd\
```
to update all the existing generated code.
Signed-off-by: Paul "TBBle" Hampson <Paul.Hampson@Pobox.com>
This change adds support for encoding time.Time values as FILETIME
values in tracelogging events. FILETIME has slightly less precision than
time.Time (100ns vs 1ns), but it is the closest availble match.
The ETW registration handle is defined to be 64-bits on all platforms. The Go
type previously used a uintptr which created problems on 32-bit systems. This
change adds a new wrapper file which receives a 64-bit handle for the functions
defined in it, and correctly passes it to the native ETW functions either as-is
(on 64-bit) or as two 32-bit values (on 32-bit).
This required a minor change in mksyscall_windows.go, to allow multiple syscalls
that map to the same underlying function without causing a duplicate definition
error in the generated file.
Proper support for ETW on ARM will require additional changes in Go to support
more than 16 bytes of arguments to a syscall callback. Until this work is done,
the ETW package is being changed to no-op on ARM.
There is a cleanup function deferred to remove the provider from the global
provider map. However, this function didn't bind the value of provider ahead of
time, so when the provider creation returned with nil for provider, we tried to
cleanup a nil provider, and panicked.
Kyle Wojtaszek