KPROFILE_SOURCE

The KPROFILE_SOURCE enumeration is used throughout the kernel’s support for profiling. Its numerical value selects from the available sources of a profile interrupt that the kernel can use for sampling where the processor had been executing. The original and still typical source is simply time, such that the profile interrupt recurs periodically. Others, even very many others, are counters of events as kept by the processor itself.

Scope

The KPROFILE_SOURCE is remarkable for being immediately meaningful through a large range of Windows functionality. At one end, it is exposed to user-mode callers. Not only do these get to choose the source when calling NtCreateProfile or NtCreateProfileEx to specify what execution they want profiled, but they also have NtQueryIntervalProfile and NtSetIntervalProfile to manage the recurrence of profile interrupts from different sources. Modern Windows versions provide yet more interfaces through various information classes of TraceQueryInformation and TraceSetInformation. At the lower end, the KPROFILE_SOURCE is shared with the HAL, which has the job of managing the processor’s performance-monitoring counters and the hardware’s timers, and then of setting up the profile interrupt at the kernel’s direction. The kernel learns of each profile interrupt from the HAL via KeProfileInterruptWithSource.

Documentation Status

The KPROFILE _SOURCE enumeration is not documented, but a C-language definition is in NTDDK.H from the Device Driver Kit (DDK) for Windows NT 3.51 and is repeated in the DDK or Windows Driver Kit (WDK) for all versions since, though it moves to WDM.H in later kits. It has perhaps tended to be overlooked since it has never changed and is never referenced from any other header or from sample code. No C-language definition is known to have been published for user-mode programming, but the C-language definition from kernel-mode programming presumably is reproduced in headers that Microsoft makes available to its own user-mode programmers but does not publish for others: how else does type information for KPROFILE_SOURCE appear in symbol files for such high-level modules as the URLMON.DLL from Internet Explorer?

And there it might be left, with documentation at this site simply directing you to the C-language header—except that the definition in the published header and as may be inferred from type information in symbol files is not the whole of what any modern HAL implements.

Enumeration

Very plausibly, the published definition was intended from the start as the whole that is intended as common to all types of processor.

Value Name
0x00 ProfileTime
0x01 ProfileAlignmentFixup
0x02 ProfileTotalIssues
0x03 ProfilePipelineDry
0x04 ProfileLoadInstructions
0x05 ProfilePipelineFrozen
0x06 ProfileBranchInstructions
0x07 ProfileTotalNonissues
0x08 ProfileDcacheMisses
0x09 ProfileIcacheMisses
0x0A ProfileCacheMisses
0x0B ProfileBranchMispredictions
0x0C ProfileStoreInstructions
0x0D ProfileFpInstructions
0x0E ProfileIntegerInstructions
0x0F Profile2Issue
0x10 Profile3Issue
0x11 Profile4Issue
0x12 ProfileSpecialInstructions
0x13 ProfileTotalCycles
0x14 ProfileIcacheIssues
0x15 ProfileDcacheAccesses
0x16 ProfileMemoryBarrierCycles
0x17 ProfileLoadLinkedIssues
0x18 ProfileMaximum
0x19 and higher processor-specific profile sources, e.g., Amd64 and Emon

The first known addition of processor-specific profile sources is for the 64-bit Windows Server 2003 SP1, and only then for processors whose cpuid vendor string is AuthenticAMD. A separate set for GenuineIntel processors begins with 64-bit Windows Vista. No 32-bit HAL implements even the generally defined values other than ProfileTime until Windows 8.