[NTOSKRNL] Implement KeQueryValuesProcess().

And make use of it.
This commit is contained in:
Pierre Schweitzer 2018-05-25 21:40:39 +02:00
parent b0b7437882
commit f15afdbc43
No known key found for this signature in database
GPG key ID: 7545556C3D585B0B
4 changed files with 80 additions and 17 deletions

View file

@ -36,6 +36,13 @@ typedef struct _DISPATCH_INFO
PKINTERRUPT_ROUTINE *FlatDispatch;
} DISPATCH_INFO, *PDISPATCH_INFO;
typedef struct _PROCESS_VALUES
{
LARGE_INTEGER TotalKernelTime;
LARGE_INTEGER TotalUserTime;
IO_COUNTERS IoInfo;
} PROCESS_VALUES, *PPROCESS_VALUES;
typedef struct _DEFERRED_REVERSE_BARRIER
{
ULONG Barrier;
@ -710,6 +717,11 @@ NTAPI
KeQueryRuntimeProcess(IN PKPROCESS Process,
OUT PULONG UserTime);
VOID
NTAPI
KeQueryValuesProcess(IN PKPROCESS Process,
PPROCESS_VALUES Values);
/* INITIALIZATION FUNCTIONS *************************************************/
BOOLEAN

View file

@ -517,6 +517,58 @@ KeSetPriorityAndQuantumProcess(IN PKPROCESS Process,
return OldPriority;
}
VOID
NTAPI
KeQueryValuesProcess(IN PKPROCESS Process,
PPROCESS_VALUES Values)
{
PEPROCESS EProcess;
PLIST_ENTRY NextEntry;
ULONG TotalKernel, TotalUser;
KLOCK_QUEUE_HANDLE ProcessLock;
ASSERT_PROCESS(Process);
ASSERT(KeGetCurrentIrql() <= DISPATCH_LEVEL);
/* Lock the process */
KiAcquireProcessLock(Process, &ProcessLock);
/* Initialize user and kernel times */
TotalKernel = Process->KernelTime;
TotalUser = Process->UserTime;
/* Copy the IO_COUNTERS from the process */
EProcess = (PEPROCESS)Process;
Values->IoInfo.ReadOperationCount = EProcess->ReadOperationCount.QuadPart;
Values->IoInfo.WriteOperationCount = EProcess->WriteOperationCount.QuadPart;
Values->IoInfo.OtherOperationCount = EProcess->OtherOperationCount.QuadPart;
Values->IoInfo.ReadTransferCount = EProcess->ReadTransferCount.QuadPart;
Values->IoInfo.WriteTransferCount = EProcess->WriteTransferCount.QuadPart;
Values->IoInfo.OtherTransferCount = EProcess->OtherTransferCount.QuadPart;
/* Loop all child threads and sum up their times */
for (NextEntry = Process->ThreadListHead.Flink;
NextEntry != &Process->ThreadListHead;
NextEntry = NextEntry->Flink)
{
PKTHREAD Thread;
/* Get the thread */
Thread = CONTAINING_RECORD(NextEntry, KTHREAD, ThreadListEntry);
/* Sum up times */
TotalKernel += Thread->KernelTime;
TotalUser += Thread->UserTime;
}
/* Release the process lock */
KiReleaseProcessLock(&ProcessLock);
/* Compute total times */
Values->TotalKernelTime.QuadPart = TotalKernel * (LONGLONG)KeMaximumIncrement;
Values->TotalUserTime.QuadPart = TotalUser * (LONGLONG)KeMaximumIncrement;
}
/* PUBLIC FUNCTIONS **********************************************************/
/*

View file

@ -631,16 +631,17 @@ NtQueryInformationJobObject (
Process = CONTAINING_RECORD(NextEntry, EPROCESS, JobLinks);
if (!BooleanFlagOn(Process->JobStatus, 2))
{
/* FIXME: Call KeQueryValuesProcess()
* We should sum BasicInfo values here,
* but we don't have them
*/
BasicAndIo.IoInfo.ReadOperationCount += Process->ReadOperationCount.QuadPart;
BasicAndIo.IoInfo.WriteOperationCount += Process->WriteOperationCount.QuadPart;
BasicAndIo.IoInfo.OtherOperationCount += Process->OtherOperationCount.QuadPart;
BasicAndIo.IoInfo.ReadTransferCount += Process->ReadTransferCount.QuadPart;
BasicAndIo.IoInfo.WriteTransferCount += Process->WriteTransferCount.QuadPart;
BasicAndIo.IoInfo.OtherTransferCount += Process->OtherTransferCount.QuadPart;
PROCESS_VALUES Values;
KeQueryValuesProcess(&Process->Pcb, &Values);
BasicAndIo.BasicInfo.TotalUserTime.QuadPart += Values.TotalUserTime.QuadPart;
BasicAndIo.BasicInfo.TotalKernelTime.QuadPart += Values.TotalKernelTime.QuadPart;
BasicAndIo.IoInfo.ReadOperationCount += Values.IoInfo.ReadOperationCount;
BasicAndIo.IoInfo.WriteOperationCount += Values.IoInfo.WriteOperationCount;
BasicAndIo.IoInfo.OtherOperationCount += Values.IoInfo.OtherOperationCount;
BasicAndIo.IoInfo.ReadTransferCount += Values.IoInfo.ReadTransferCount;
BasicAndIo.IoInfo.WriteTransferCount += Values.IoInfo.WriteTransferCount;
BasicAndIo.IoInfo.OtherTransferCount += Values.IoInfo.OtherTransferCount;
}
}

View file

@ -82,6 +82,7 @@ NtQueryInformationProcess(IN HANDLE ProcessHandle,
PUNICODE_STRING ImageName;
ULONG Cookie, ExecuteOptions = 0;
ULONG_PTR Wow64 = 0;
PROCESS_VALUES ProcessValues;
PAGED_CODE();
/* Check for user-mode caller */
@ -251,15 +252,12 @@ NtQueryInformationProcess(IN HANDLE ProcessHandle,
NULL);
if (!NT_SUCCESS(Status)) break;
/* Query IO counters from the process */
KeQueryValuesProcess(&Process->Pcb, &ProcessValues);
_SEH2_TRY
{
/* FIXME: Call KeQueryValuesProcess */
IoCounters->ReadOperationCount = Process->ReadOperationCount.QuadPart;
IoCounters->ReadTransferCount = Process->ReadTransferCount.QuadPart;
IoCounters->WriteOperationCount = Process->WriteOperationCount.QuadPart;
IoCounters->WriteTransferCount = Process->WriteTransferCount.QuadPart;
IoCounters->OtherOperationCount = Process->OtherOperationCount.QuadPart;
IoCounters->OtherTransferCount = Process->OtherTransferCount.QuadPart;
RtlCopyMemory(IoCounters, &ProcessValues.IoInfo, sizeof(IO_COUNTERS));
}
_SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
{