Unusual high cpu utilization in ntkrnlpa:FsRtlAreNamesEqual and ntkrnlpa:RtlUpcaseUnicodeString

Question

I am profiling a networking workload application on Windows XP. The VTune profiling result shows unusual high utilization on ntkrnlpa:FsRtlAreNamesEqual and ntkrnlpa:RtlUpcaseUnicodeString functions. From the module level, the workload spends 73% cpu time in ntkrnlpa.exe. In ntkrnlpa.exe module, 42% time is spent in FsRtlAreNamesEqual function and 36% time is spent in RtlUpcaseUnicodeString function. Apparently these two functions are kernel functions, so they must be triggered by some system call or device driver activites. Please help me identify the possible cause of the high utilization of these functions, thanks!

Answer 1

Are you sure that you have correct symbols? I suspect that those two functions are just the nearest export.

Answer 2

Can you run it under an IDE such as VS or Eclipse and reproduce the problem? If so, this technique will tell you what's going on. If you're spending a lot of time in certain utility routines, what you want to know is why are they being called.