profile.c File Reference

#include <ntoskrnl.h>
#include <debug.h>

Include dependency graph for profile.c:

Go to the source code of this file.

Macros
#define	NDEBUG

Functions
VOID NTAPI	ExpDeleteProfile (PVOID ObjectBody)
BOOLEAN NTAPI	ExpInitializeProfileImplementation (VOID)
NTSTATUS NTAPI	NtCreateProfile (OUT PHANDLE ProfileHandle, IN HANDLE Process OPTIONAL, IN PVOID RangeBase, IN SIZE_T RangeSize, IN ULONG BucketSize, IN PVOID Buffer, IN ULONG BufferSize, IN KPROFILE_SOURCE ProfileSource, IN KAFFINITY Affinity)
NTSTATUS NTAPI	NtQueryPerformanceCounter (OUT PLARGE_INTEGER PerformanceCounter, OUT PLARGE_INTEGER PerformanceFrequency OPTIONAL)
NTSTATUS NTAPI	NtStartProfile (IN HANDLE ProfileHandle)
NTSTATUS NTAPI	NtStopProfile (IN HANDLE ProfileHandle)
NTSTATUS NTAPI	NtQueryIntervalProfile (IN KPROFILE_SOURCE ProfileSource, OUT PULONG Interval)
NTSTATUS NTAPI	NtSetIntervalProfile (IN ULONG Interval, IN KPROFILE_SOURCE Source)

Variables
POBJECT_TYPE	ExProfileObjectType = NULL
KMUTEX	ExpProfileMutex
GENERIC_MAPPING	ExpProfileMapping

Macro Definition Documentation

NDEBUG

#define NDEBUG

Definition at line 13 of file profile.c.

Function Documentation

ExpDeleteProfile()

VOID NTAPI ExpDeleteProfile

(

PVOID

ObjectBody

)

Definition at line 33 of file profile.c.

{
    PEPROFILE Profile;
    ULONG State;
 
    /* Typecast the Object */
    Profile = ObjectBody;
 
    /* Check if there if the Profile was started */
    if (Profile->LockedBufferAddress)
    {
        /* Stop the Profile */
        State = KeStopProfile(Profile->ProfileObject);
        ASSERT(State != FALSE);
 
        /* Unmap the Locked Buffer */
        MmUnmapLockedPages(Profile->LockedBufferAddress, Profile->Mdl);
        MmUnlockPages(Profile->Mdl);
        IoFreeMdl(Profile->Mdl);
        ExFreePoolWithTag(Profile->ProfileObject, TAG_PROFILE);
    }
 
    /* Check if a Process is associated and reference it */
    if (Profile->Process) ObDereferenceObject(Profile->Process);
}

Referenced by ExpInitializeProfileImplementation().

ExpInitializeProfileImplementation()

BOOLEAN NTAPI ExpInitializeProfileImplementation

(

VOID

)

Definition at line 62 of file profile.c.

{
    OBJECT_TYPE_INITIALIZER ObjectTypeInitializer;
    UNICODE_STRING Name;
    NTSTATUS Status;
    DPRINT("Creating Profile Object Type\n");
 
    /* Initialize the Mutex to lock the States */
    KeInitializeMutex(&ExpProfileMutex, 64);
 
    /* Create the Event Pair Object Type */
    RtlZeroMemory(&ObjectTypeInitializer, sizeof(ObjectTypeInitializer));
    RtlInitUnicodeString(&Name, L"Profile");
    ObjectTypeInitializer.Length = sizeof(ObjectTypeInitializer);
    ObjectTypeInitializer.DefaultNonPagedPoolCharge = sizeof(KPROFILE);
    ObjectTypeInitializer.GenericMapping = ExpProfileMapping;
    ObjectTypeInitializer.PoolType = NonPagedPool;
    ObjectTypeInitializer.DeleteProcedure = ExpDeleteProfile;
    ObjectTypeInitializer.ValidAccessMask = PROFILE_ALL_ACCESS;
    ObjectTypeInitializer.InvalidAttributes = OBJ_OPENLINK;
    Status = ObCreateObjectType(&Name, &ObjectTypeInitializer, NULL, &ExProfileObjectType);
    if (!NT_SUCCESS(Status)) return FALSE;
    return TRUE;
}

Referenced by ExpInitSystemPhase1().

NtCreateProfile()

NTSTATUS NTAPI NtCreateProfile	(	OUT PHANDLE	ProfileHandle,
		IN HANDLE Process	OPTIONAL,
		IN PVOID	RangeBase,
		IN SIZE_T	RangeSize,
		IN ULONG	BucketSize,
		IN PVOID	Buffer,
		IN ULONG	BufferSize,
		IN KPROFILE_SOURCE	ProfileSource,
		IN KAFFINITY	Affinity
	)

Definition at line 89 of file profile.c.

{
    HANDLE hProfile;
    PEPROFILE Profile;
    PEPROCESS pProcess;
    KPROCESSOR_MODE PreviousMode = ExGetPreviousMode();
    OBJECT_ATTRIBUTES ObjectAttributes;
    NTSTATUS Status;
    ULONG Log2 = 0;
    ULONG_PTR Segment = 0;
    PAGED_CODE();
 
    /* Easy way out */
    if(!BufferSize) return STATUS_INVALID_PARAMETER_7;
 
    /* Check if this is a low-memory profile */
    if ((!BucketSize) && (RangeBase < (PVOID)(0x10000)))
    {
        /* Validate size */
        if (BufferSize < sizeof(ULONG)) return STATUS_INVALID_PARAMETER_7;
 
        /* This will become a segmented profile object */
        Segment = (ULONG_PTR)RangeBase;
        RangeBase = 0;
 
        /* Recalculate the bucket size */
        BucketSize = RangeSize / (BufferSize / sizeof(ULONG));
 
        /* Convert it to log2 */
        BucketSize--;
        while (BucketSize >>= 1) Log2++;
        BucketSize += Log2 + 1;
    }
 
    /* Validate bucket size */
    if ((BucketSize > 31) || (BucketSize < 2))
    {
        DPRINT1("Bucket size invalid\n");
        return STATUS_INVALID_PARAMETER;
    }
 
    /* Make sure that the buckets can map the range */
    if ((RangeSize >> (BucketSize - 2)) > BufferSize)
    {
        DPRINT1("Bucket size too small\n");
        return STATUS_BUFFER_TOO_SMALL;
    }
 
    /* Make sure that the range isn't too gigantic */
    if (((ULONG_PTR)RangeBase + RangeSize) < RangeSize)
    {
        DPRINT1("Range too big\n");
        return STATUS_BUFFER_OVERFLOW;
    }
 
    /* Check if we were called from user-mode */
    if(PreviousMode != KernelMode)
    {
        /* Entry SEH */
        _SEH2_TRY
        {
            /* Make sure that the handle pointer is valid */
            ProbeForWriteHandle(ProfileHandle);
 
            /* Check if the buffer is valid */
            ProbeForWrite(Buffer,
                          BufferSize,
                          sizeof(ULONG));
        }
        _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
        {
            /* Return the exception code */
            _SEH2_YIELD(return _SEH2_GetExceptionCode());
        }
        _SEH2_END;
    }
 
    /* Check if a process was specified */
    if (Process)
    {
        /* Reference it */
        Status = ObReferenceObjectByHandle(Process,
                                           PROCESS_QUERY_INFORMATION,
                                           PsProcessType,
                                           PreviousMode,
                                           (PVOID*)&pProcess,
                                           NULL);
        if (!NT_SUCCESS(Status)) return(Status);
    }
    else
    {
        /* Segmented profile objects cannot be used system-wide */
        if (Segment) return STATUS_INVALID_PARAMETER;
 
        /* No process was specified, which means a System-Wide Profile */
        pProcess = NULL;
 
        /* For this, we need to check the Privilege */
        if(!SeSinglePrivilegeCheck(SeSystemProfilePrivilege, PreviousMode))
        {
            DPRINT1("NtCreateProfile: Caller requires the SeSystemProfilePrivilege privilege!\n");
            return STATUS_PRIVILEGE_NOT_HELD;
        }
    }
 
    /* Create the object */
    InitializeObjectAttributes(&ObjectAttributes,
                               NULL,
                               0,
                               NULL,
                               NULL);
    Status = ObCreateObject(KernelMode,
                            ExProfileObjectType,
                            &ObjectAttributes,
                            PreviousMode,
                            NULL,
                            sizeof(EPROFILE),
                            0,
                            sizeof(EPROFILE) + sizeof(KPROFILE),
                            (PVOID*)&Profile);
    if (!NT_SUCCESS(Status))
    {
        /* Dereference the process object if it was specified */
        if (pProcess) ObDereferenceObject(pProcess);
 
        /* Return Status */
        return Status;
    }
 
    /* Initialize it */
    Profile->RangeBase = RangeBase;
    Profile->RangeSize = RangeSize;
    Profile->Buffer = Buffer;
    Profile->BufferSize = BufferSize;
    Profile->BucketSize = BucketSize;
    Profile->LockedBufferAddress = NULL;
    Profile->Segment = Segment;
    Profile->ProfileSource = ProfileSource;
    Profile->Affinity = Affinity;
    Profile->Process = pProcess;
 
    /* Insert into the Object Tree */
    Status = ObInsertObject ((PVOID)Profile,
                             NULL,
                             PROFILE_CONTROL,
                             0,
                             NULL,
                             &hProfile);
 
    /* Check for Success */
    if (!NT_SUCCESS(Status))
    {
        /* Dereference Process on failure */
        if (pProcess) ObDereferenceObject(pProcess);
        return Status;
    }
 
    /* Enter SEH */
    _SEH2_TRY
    {
        /* Copy the created handle back to the caller*/
        *ProfileHandle = hProfile;
    }
    _SEH2_EXCEPT(ExSystemExceptionFilter())
    {
        Status = _SEH2_GetExceptionCode();
    }
    _SEH2_END;
 
    /* Return Status */
    return Status;
}

NtQueryIntervalProfile()

NTSTATUS NTAPI NtQueryIntervalProfile	(	IN KPROFILE_SOURCE	ProfileSource,
		OUT PULONG	Interval
	)

Definition at line 465 of file profile.c.

{
    KPROCESSOR_MODE PreviousMode = ExGetPreviousMode();
    ULONG ReturnInterval;
    NTSTATUS Status = STATUS_SUCCESS;
    PAGED_CODE();
 
    /* Check if we were called from user-mode */
    if (PreviousMode != KernelMode)
    {
        /* Enter SEH Block */
        _SEH2_TRY
        {
            /* Validate interval */
            ProbeForWriteUlong(Interval);
        }
        _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
        {
            /* Return the exception code */
            _SEH2_YIELD(return _SEH2_GetExceptionCode());
        }
        _SEH2_END;
    }
 
    /* Query the Interval */
    ReturnInterval = (ULONG)KeQueryIntervalProfile(ProfileSource);
 
    /* Enter SEH block for return */
    _SEH2_TRY
    {
        /* Return the data */
        *Interval = ReturnInterval;
    }
    _SEH2_EXCEPT(ExSystemExceptionFilter())
    {
        /* Get the exception code */
        Status = _SEH2_GetExceptionCode();
    }
    _SEH2_END;
 
    /* Return Success */
    return Status;
}

NtQueryPerformanceCounter()

NTSTATUS NTAPI NtQueryPerformanceCounter	(	OUT PLARGE_INTEGER	PerformanceCounter,
		OUT PLARGE_INTEGER PerformanceFrequency	OPTIONAL
	)

Definition at line 272 of file profile.c.

{
    KPROCESSOR_MODE PreviousMode = ExGetPreviousMode();
    LARGE_INTEGER PerfFrequency;
    NTSTATUS Status = STATUS_SUCCESS;
 
    /* Check if we were called from user-mode */
    if (PreviousMode != KernelMode)
    {
        /* Entry SEH Block */
        _SEH2_TRY
        {
            /* Make sure the counter and frequency are valid */
            ProbeForWriteLargeInteger(PerformanceCounter);
            if (PerformanceFrequency)
            {
                ProbeForWriteLargeInteger(PerformanceFrequency);
            }
        }
        _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
        {
            /* Return the exception code */
            _SEH2_YIELD(return _SEH2_GetExceptionCode());
        }
        _SEH2_END;
    }
 
    /* Enter a new SEH Block */
    _SEH2_TRY
    {
        /* Query the Kernel */
        *PerformanceCounter = KeQueryPerformanceCounter(&PerfFrequency);
 
        /* Return Frequency if requested */
        if (PerformanceFrequency) *PerformanceFrequency = PerfFrequency;
    }
    _SEH2_EXCEPT(ExSystemExceptionFilter())
    {
        /* Get the exception code */
        Status = _SEH2_GetExceptionCode();
    }
    _SEH2_END;
 
    /* Return status to caller */
    return Status;
}

Referenced by ClockInitialize(), ClockUpdate(), EnableHardwareTimer(), LdrpInitSecurityCookie(), PulseSample(), QueryPerformanceCounter(), QueryPerformanceFrequency(), queue_current_time(), and SpeakerInitialize().

NtSetIntervalProfile()

NTSTATUS NTAPI NtSetIntervalProfile	(	IN ULONG	Interval,
		IN KPROFILE_SOURCE	Source
	)

Definition at line 512 of file profile.c.

{
    /* Let the Kernel do the job */
    KeSetIntervalProfile(Interval, Source);
 
    /* Nothing can go wrong */
    return STATUS_SUCCESS;
}

NtStartProfile()

NTSTATUS NTAPI NtStartProfile

(

IN HANDLE

ProfileHandle

)

Definition at line 322 of file profile.c.

{
    PEPROFILE Profile;
    PKPROFILE ProfileObject;
    KPROCESSOR_MODE PreviousMode = ExGetPreviousMode();
    PVOID TempLockedBufferAddress;
    NTSTATUS Status;
    PAGED_CODE();
 
    /* Get the Object */
    Status = ObReferenceObjectByHandle(ProfileHandle,
                                       PROFILE_CONTROL,
                                       ExProfileObjectType,
                                       PreviousMode,
                                       (PVOID*)&Profile,
                                       NULL);
    if (!NT_SUCCESS(Status)) return(Status);
 
    /* To avoid a Race, wait on the Mutex */
    KeWaitForSingleObject(&ExpProfileMutex,
                          Executive,
                          KernelMode,
                          FALSE,
                          NULL);
 
    /* The Profile can still be enabled though, so handle that */
    if (Profile->LockedBufferAddress)
    {
        /* Release our lock, dereference and return */
        KeReleaseMutex(&ExpProfileMutex, FALSE);
        ObDereferenceObject(Profile);
        return STATUS_PROFILING_NOT_STOPPED;
    }
 
    /* Allocate a Kernel Profile Object. */
    ProfileObject = ExAllocatePoolWithTag(NonPagedPool,
                                          sizeof(*ProfileObject),
                                          TAG_PROFILE);
    if (!ProfileObject)
    {
        /* Out of memory, fail */
        KeReleaseMutex(&ExpProfileMutex, FALSE);
        ObDereferenceObject(Profile);
        return STATUS_INSUFFICIENT_RESOURCES;
    }
 
    /* Allocate the Mdl Structure */
    Profile->Mdl = IoAllocateMdl(Profile->Buffer, Profile->BufferSize, FALSE, FALSE, NULL);
 
    /* Protect this in SEH as we might raise an exception */
    _SEH2_TRY
    {
        /* Probe and Lock for Write Access */
        MmProbeAndLockPages(Profile->Mdl, PreviousMode, IoWriteAccess);
    }
    _SEH2_EXCEPT(ExSystemExceptionFilter())
    {
        /* Release our lock, free the buffer, dereference and return */
        KeReleaseMutex(&ExpProfileMutex, FALSE);
        ObDereferenceObject(Profile);
        ExFreePoolWithTag(ProfileObject, TAG_PROFILE);
        _SEH2_YIELD(return _SEH2_GetExceptionCode());
    }
    _SEH2_END;
 
    /* Map the pages */
    TempLockedBufferAddress = MmMapLockedPages(Profile->Mdl, KernelMode);
 
    /* Initialize the Kernel Profile Object */
    Profile->ProfileObject = ProfileObject;
    KeInitializeProfile(ProfileObject,
                        &Profile->Process->Pcb,
                        Profile->RangeBase,
                        Profile->RangeSize,
                        Profile->BucketSize,
                        Profile->ProfileSource,
                        Profile->Affinity);
 
    /* Start the Profiling */
    KeStartProfile(ProfileObject, TempLockedBufferAddress);
 
    /* Now it's safe to save this */
    Profile->LockedBufferAddress = TempLockedBufferAddress;
 
    /* Release mutex, dereference and return */
    KeReleaseMutex(&ExpProfileMutex, FALSE);
    ObDereferenceObject(Profile);
    return STATUS_SUCCESS;
}

NtStopProfile()

NTSTATUS NTAPI NtStopProfile

(

IN HANDLE

ProfileHandle

)

Definition at line 414 of file profile.c.

{
    PEPROFILE Profile;
    KPROCESSOR_MODE PreviousMode = ExGetPreviousMode();
    NTSTATUS Status;
    PAGED_CODE();
 
    /* Get the Object */
    Status = ObReferenceObjectByHandle(ProfileHandle,
                                       PROFILE_CONTROL,
                                       ExProfileObjectType,
                                       PreviousMode,
                                       (PVOID*)&Profile,
                                       NULL);
    if (!NT_SUCCESS(Status)) return(Status);
 
    /* Get the Mutex */
    KeWaitForSingleObject(&ExpProfileMutex,
                          Executive,
                          KernelMode,
                          FALSE,
                          NULL);
 
    /* Make sure the Profile Object is really Started */
    if (!Profile->LockedBufferAddress)
    {
        Status = STATUS_PROFILING_NOT_STARTED;
        goto Exit;
    }
 
    /* Stop the Profile */
    KeStopProfile(Profile->ProfileObject);
 
    /* Unlock the Buffer */
    MmUnmapLockedPages(Profile->LockedBufferAddress, Profile->Mdl);
    MmUnlockPages(Profile->Mdl);
    IoFreeMdl(Profile->Mdl);
    ExFreePoolWithTag(Profile->ProfileObject, TAG_PROFILE);
 
    /* Clear the Locked Buffer pointer, meaning the Object is Stopped */
    Profile->LockedBufferAddress = NULL;
 
Exit:
    /* Release Mutex, Dereference and Return */
    KeReleaseMutex(&ExpProfileMutex, FALSE);
    ObDereferenceObject(Profile);
    return Status;
}

Variable Documentation

ExpProfileMapping

GENERIC_MAPPING ExpProfileMapping

Initial value:

=
{
    STANDARD_RIGHTS_READ    | PROFILE_CONTROL,
    STANDARD_RIGHTS_WRITE   | PROFILE_CONTROL,
    STANDARD_RIGHTS_EXECUTE | PROFILE_CONTROL,
    PROFILE_ALL_ACCESS
}

Definition at line 21 of file profile.c.

Referenced by ExpInitializeProfileImplementation().

ExpProfileMutex

KMUTEX ExpProfileMutex

Definition at line 19 of file profile.c.

Referenced by ExpInitializeProfileImplementation(), NtStartProfile(), and NtStopProfile().

ExProfileObjectType

POBJECT_TYPE ExProfileObjectType = NULL

Definition at line 18 of file profile.c.

Referenced by ExpInitializeProfileImplementation(), NtCreateProfile(), NtStartProfile(), and NtStopProfile().