static PPH_PROCESS_RECORD PhSipReferenceMaxCpuRecord(
_In_ LONG Index
)
{
LARGE_INTEGER time;
ULONG maxProcessId;
// Find the process record for the max. CPU process for the particular time.
maxProcessId = PhGetItemCircularBuffer_ULONG(SystemStatistics.MaxCpuHistory, Index);
if (!maxProcessId)
return NULL;
// Note that the time we get has its components beyond seconds cleared.
// For example:
// * At 2.5 seconds a process is started.
// * At 2.75 seconds our process provider is fired, and the process is determined
// to have 75% CPU usage, which happens to be the maximum CPU usage.
// * However the 2.75 seconds is recorded as 2 seconds due to
// RtlTimeToSecondsSince1980.
// * If we call PhFindProcessRecord, it cannot find the process because it was
// started at 2.5 seconds, not 2 seconds or older.
//
// This mean we must add one second minus one tick (100ns) to the time, giving us
// 2.9999999 seconds. This will then make sure we find the process.
PhGetStatisticsTime(NULL, Index, &time);
time.QuadPart += PH_TICKS_PER_SEC - 1;
return PhFindProcessRecord(UlongToHandle(maxProcessId), &time);
}
PPH_PROCESS_RECORD EtpReferenceMaxNodeRecord(
__in LONG Index
)
{
LARGE_INTEGER time;
ULONG maxProcessId;
maxProcessId = PhGetItemCircularBuffer_ULONG(&EtMaxGpuNodeHistory, Index);
if (!maxProcessId)
return NULL;
PhGetStatisticsTime(NULL, Index, &time);
time.QuadPart += PH_TICKS_PER_SEC - 1;
return PhFindProcessRecord((HANDLE)maxProcessId, &time);
}
static PPH_PROCESS_RECORD PhSipReferenceMaxIoRecord(
_In_ LONG Index
)
{
LARGE_INTEGER time;
ULONG maxProcessId;
// Find the process record for the max. I/O process for the particular time.
maxProcessId = PhGetItemCircularBuffer_ULONG(SystemStatistics.MaxIoHistory, Index);
if (!maxProcessId)
return NULL;
// See above for the explanation.
PhGetStatisticsTime(NULL, Index, &time);
time.QuadPart += PH_TICKS_PER_SEC - 1;
return PhFindProcessRecord(UlongToHandle(maxProcessId), &time);
}
