Geoff Chappell - Software Analyst
The KPROFILE_SOURCE enumeration (formally _KPROFILE_SOURCE) is used throughout the kernel’s support for profiling. Its numerical value selects from the available sources of a profile interrupt that the kernel can use for sampling where the processor has been executing. The original and still typical source is simply time, such that the profile interrupt recurs periodically. Others, even very many others, are counters of events as kept by the processor itself.
For a simple enumeration of well-known constants, KPROFILE_SOURCE is remarkable for being immediately meaningful through a large range of Windows functionality. At one end, it is exposed to user-mode callers. Not only do these get to choose the source when calling NtCreateProfile or NtCreateProfileEx to specify what execution they want profiled, but they also have NtQueryIntervalProfile and NtSetIntervalProfile to manage the recurrence of profile interrupts from different sources. Modern Windows versions provide yet more interfaces through various information classes of TraceQueryInformation and TraceSetInformation. At the lower end, KPROFILE_SOURCE is shared with the HAL, which has the job of managing the processor’s performance-monitoring counters and the hardware’s timers, and then of setting up the profile interrupt at the kernel’s direction. It is from the HAL that the kernel learns of each occurrence of a profile interrupt, via KeProfileInterruptWithSource.
The KPROFILE _SOURCE enumeration is not documented, but a C-language definition is in NTDDK.H from the Device Driver Kit (DDK) for Windows NT 3.51 and is repeated in the DDK or Windows Driver Kit (WDK) for all versions since, though it moves to WDM.H in later kits. It has perhaps tended to be overlooked since it has never changed and is never referenced from any other header or from sample code.
Though no C-language definition of KPROFILE_SOURCE has been published for user-mode programming, the C-language definition for kernel-mode programming is reproduced in headers that Microsoft makes available to its own user-mode programmers but does not publish for others. How else does type information for KPROFILE_SOURCE appear in symbol files for such high-level modules as the URLMON.DLL from Internet Explorer? (The answer, of course is known. Those public symbol files name the unpublished header as ntkeapi_x.h.)
And there it might be left, with documentation at this site simply directing you to the WDK—except that the definition in the published header and as may be inferred from type information in symbol files is not the whole of what any modern HAL implements.
The discrepancy between definition and implementation very plausibly exists simply because the published definition was intended from the start as what’s common to all types of processor.
| Value | Name |
|---|---|
| 0x00 | ProfileTime |
| 0x01 | ProfileAlignmentFixup |
| 0x02 | ProfileTotalIssues |
| 0x03 | ProfilePipelineDry |
| 0x04 | ProfileLoadInstructions |
| 0x05 | ProfilePipelineFrozen |
| 0x06 | ProfileBranchInstructions |
| 0x07 | ProfileTotalNonissues |
| 0x08 | ProfileDcacheMisses |
| 0x09 | ProfileIcacheMisses |
| 0x0A | ProfileCacheMisses |
| 0x0B | ProfileBranchMispredictions |
| 0x0C | ProfileStoreInstructions |
| 0x0D | ProfileFpInstructions |
| 0x0E | ProfileIntegerInstructions |
| 0x0F | Profile2Issue |
| 0x10 | Profile3Issue |
| 0x11 | Profile4Issue |
| 0x12 | ProfileSpecialInstructions |
| 0x13 | ProfileTotalCycles |
| 0x14 | ProfileIcacheIssues |
| 0x15 | ProfileDcacheAccesses |
| 0x16 | ProfileMemoryBarrierCycles |
| 0x17 | ProfileLoadLinkedIssues |
| 0x18 | ProfileMaximum |
| 0x19 and higher | processor-specific profile sources, e.g., Amd64 and Emon |
The first known addition of processor-specific profile sources is for 64-bit Windows, right from its start with Windows Server 2003 SP1, but only then for processors whose cpuid vendor string is AuthenticAMD. A separate set for GenuineIntel processors begins with 64-bit Windows Vista. No 32-bit HAL implements even the generally defined values other than ProfileTime until Windows 8.