NTKERNELAPI
NTSTATUS
WmiTraceKernelEvent(
  IN  ULONG GroupType,         	// Group/type code for kernel event,
  IN  PVOID EventInfo,         	// Event data as defined in MOF,
  IN  ULONG EventInfoLen,      	// Length of the event data,
  IN  PETHREAD Thread
  );

Routine Description:

    This routine is used by trace kernel events only. These events can
    be charged to the given thread instead of the running thread. Because
    it can be called by I/O events at DPC level, this routine cannot be
    pageable when tracing is on.

    This routine works at IRQL <= DISPATCH_LEVEL

Arguments:

    GroupType       a ULONG key to indicate the action to be taken

    EventInfo       a pointer to contiguous memory containing information
                    to be attached to event trace

    EventInfoLen    length of EventInfo

    Thread          Pointer to thread where event is to be charged.
                    Currently used by disk IO and thread events.

Return Value:

    The status of performing the action requested