The Amd64 Profile Interface

If the HAL’s initialisation of Hardware Performance Counters establishes that the boot processor is from AMD, has 64-bit architecture, and that its support for performance monitoring counters is not masked from Windows by a Microsoft-compatible hypervisor, the HAL chooses the Amd64 profile interface.

Profile Sources

For the purpose of interaction with the kernel, and indeed all the way to user mode through such functions as NtCreateProfile and NtCreateProfileEx, these performance events are abstracted as profile sources, represented numerically by a KPROFILE_SOURCE enumeration. Microsoft’s public definition of this enumeration goes only to 0x18 as ProfileMaximum, presumably having covered sources that are anticipated for arbitrary processor architectures. The Amd64 profile interface in the HAL from the original release of Windows 10 continues with many more:

Microsoft’s names for values below 0x19 are known from the enumeration’s C-language definition in WDM.H from the Windows Driver Kit (WDK). Presumably, the values from 0x19 and higher are omitted from that definition because they are processor-specific and the definition is meant to be general. Names for the Amd64-specific profile sources are inferred from descriptive strings in the HAL, which can be obtained even from user mode through ZwQuerySystemInformation when given the information class SystemPerformanceTraceInformation (0x1F) and the secondary information class EventTraceProfileSourceListInformation (0x0D) as the first dword in the information buffer. For the values that Microsoft names in KPROFILE_SOURCE, each name is this descriptive string but with Profile as a prefix. Extrapolation of this relationship to the extra values seems at least a reasonable guess.

To each profile source there corresponds a value that must be loaded into a Performance Event Select Register to, well, select the corresponding performance event. The four Performance Event Select Registers are the model-specific registers 0xC0010000 to 0xC0040000. The counters themselves are the model-specific registers 0xC0010004 to 0xC0010007. Initially, the Amd64 profile interface loads zero into each of the declared Performance Event Select Registers.

Except for ProfileTime, which is handled separately, the Amd64-specific profile sources are the complete set. The generally defined profile sources, numbered below 0x19, that the Amd64 profile interface can support are just those that map to the Amd64-specific profile sources. The mapping is not one-to-one: very many more profile sources are available than are generally defined.

For the sake of completeness, note that the Amd64 profile interface requires 8 bytes per counter per processor. The number of counters per processor is fixed at four, as noted above. The number of processors is not known at the time and anyway can change. The HAL allows for the maximum possible number of registered processors, the meaning of which is a small topic in itself. Failure to get the memory, which is almost unthinkable, causes the HAL_MEMORY_ALLOCATION (0xAC) bug check.