KUSER_SHARED_DATA structure (ntddk.h)

This topic describes the KUSER_SHARED_DATA structure.

Syntax

typedef struct _KUSER_SHARED_DATA {
  ULONG                         TickCountLowDeprecated;
  ULONG                         TickCountMultiplier;
  KSYSTEM_TIME                  InterruptTime;
  KSYSTEM_TIME                  SystemTime;
  KSYSTEM_TIME                  TimeZoneBias;
  USHORT                        ImageNumberLow;
  USHORT                        ImageNumberHigh;
  WCHAR                         NtSystemRoot[260];
  ULONG                         MaxStackTraceDepth;
  ULONG                         CryptoExponent;
  ULONG                         TimeZoneId;
  ULONG                         LargePageMinimum;
  ULONG                         AitSamplingValue;
  ULONG                         AppCompatFlag;
  ULONGLONG                     RNGSeedVersion;
  ULONG                         GlobalValidationRunlevel;
  LONG                          TimeZoneBiasStamp;
  ULONG                         NtBuildNumber;
  NT_PRODUCT_TYPE               NtProductType;
  BOOLEAN                       ProductTypeIsValid;
  BOOLEAN                       Reserved0[1];
  USHORT                        NativeProcessorArchitecture;
  ULONG                         NtMajorVersion;
  ULONG                         NtMinorVersion;
  BOOLEAN                       ProcessorFeatures[PROCESSOR_FEATURE_MAX];
  ULONG                         Reserved1;
  ULONG                         Reserved3;
  ULONG                         TimeSlip;
  ALTERNATIVE_ARCHITECTURE_TYPE AlternativeArchitecture;
  ULONG                         BootId;
  LARGE_INTEGER                 SystemExpirationDate;
  ULONG                         SuiteMask;
  BOOLEAN                       KdDebuggerEnabled;
  union {
    UCHAR MitigationPolicies;
    struct {
      UCHAR NXSupportPolicy : 2;
      UCHAR SEHValidationPolicy : 2;
      UCHAR CurDirDevicesSkippedForDlls : 2;
      UCHAR Reserved : 2;
    };
  };
  USHORT                        CyclesPerYield;
  ULONG                         ActiveConsoleId;
  ULONG                         DismountCount;
  ULONG                         ComPlusPackage;
  ULONG                         LastSystemRITEventTickCount;
  ULONG                         NumberOfPhysicalPages;
  BOOLEAN                       SafeBootMode;
  union {
    UCHAR VirtualizationFlags;
    struct {
      UCHAR ArchStartedInEl2 : 1;
      UCHAR QcSlIsSupported : 1;
    };
  };
  UCHAR                         Reserved12[2];
  union {
    ULONG SharedDataFlags;
    struct {
      ULONG DbgErrorPortPresent : 1;
      ULONG DbgElevationEnabled : 1;
      ULONG DbgVirtEnabled : 1;
      ULONG DbgInstallerDetectEnabled : 1;
      ULONG DbgLkgEnabled : 1;
      ULONG DbgDynProcessorEnabled : 1;
      ULONG DbgConsoleBrokerEnabled : 1;
      ULONG DbgSecureBootEnabled : 1;
      ULONG DbgMultiSessionSku : 1;
      ULONG DbgMultiUsersInSessionSku : 1;
      ULONG DbgStateSeparationEnabled : 1;
      ULONG SpareBits : 21;
    } DUMMYSTRUCTNAME2;
  } DUMMYUNIONNAME2;
  ULONG                         DataFlagsPad[1];
  ULONGLONG                     TestRetInstruction;
  LONGLONG                      QpcFrequency;
  ULONG                         SystemCall;
  ULONG                         Reserved2;
  ULONGLONG                     SystemCallPad[2];
  union {
    KSYSTEM_TIME TickCount;
    ULONG64      TickCountQuad;
    struct {
      ULONG ReservedTickCountOverlay[3];
      ULONG TickCountPad[1];
    } DUMMYSTRUCTNAME;
  } DUMMYUNIONNAME3;
  ULONG                         Cookie;
  ULONG                         CookiePad[1];
  LONGLONG                      ConsoleSessionForegroundProcessId;
  ULONGLONG                     TimeUpdateLock;
  ULONGLONG                     BaselineSystemTimeQpc;
  ULONGLONG                     BaselineInterruptTimeQpc;
  ULONGLONG                     QpcSystemTimeIncrement;
  ULONGLONG                     QpcInterruptTimeIncrement;
  UCHAR                         QpcSystemTimeIncrementShift;
  UCHAR                         QpcInterruptTimeIncrementShift;
  USHORT                        UnparkedProcessorCount;
  ULONG                         EnclaveFeatureMask[4];
  ULONG                         TelemetryCoverageRound;
  USHORT                        UserModeGlobalLogger[16];
  ULONG                         ImageFileExecutionOptions;
  ULONG                         LangGenerationCount;
  ULONGLONG                     Reserved4;
  ULONGLONG                     InterruptTimeBias;
  ULONGLONG                     QpcBias;
  ULONG                         ActiveProcessorCount;
  UCHAR                         ActiveGroupCount;
  UCHAR                         Reserved9;
  union {
    USHORT QpcData;
    struct {
      UCHAR QpcBypassEnabled;
      UCHAR QpcShift;
    };
  };
  LARGE_INTEGER                 TimeZoneBiasEffectiveStart;
  LARGE_INTEGER                 TimeZoneBiasEffectiveEnd;
  XSTATE_CONFIGURATION          XState;
  KSYSTEM_TIME                  FeatureConfigurationChangeStamp;
  ULONG                         Spare;
  ULONG64                       UserPointerAuthMask;
} KUSER_SHARED_DATA, *PKUSER_SHARED_DATA;

Members

TickCountLowDeprecated

Current low 32-bit of tick count.

TickCountMultiplier

Tick count multiplier.

InterruptTime

Current 64-bit interrupt time in 100ns units.

SystemTime

Current 64-bit system time in 100ns units.

TimeZoneBias

Current 64-bit time zone bias.

ImageNumberLow

Low image magic number for the host system.

ImageNumberHigh

High image magic number for the host system.

NtSystemRoot[260]

Copy of system root in unicode. This field must be accessed via the RtlGetNtSystemRoot API for an accurate result.

MaxStackTraceDepth

Maximum stack trace depth if tracing enabled.

CryptoExponent

Crypto exponent value.

TimeZoneId

Time zone ID.

LargePageMinimum

Defines the ULONG member LargePageMinimum.

AitSamplingValue

This value controls the AIT sampling rate.

AppCompatFlag

This value controls switchback processing.

RNGSeedVersion

Current kernel root RNG state seed version.

GlobalValidationRunlevel

This value controls assertion failure handling.

TimeZoneBiasStamp

Defines the LONG member TimeZoneBiasStamp.

NtBuildNumber

The shared collective build number undecorated with C or F. GetVersionEx hides the real number.

NtProductType

Product type. This field must be accessed via the RtlGetNtProductType API for an accurate result.

ProductTypeIsValid

Defines the BOOLEAN member ProductTypeIsValid.

Reserved0[1]

Reserved for future use.

NativeProcessorArchitecture

Defines the USHORT member NativeProcessorArchitecture.

NtMajorVersion

The NT major version. Each process sees a version from its PEB, but if the process is running with an altered view of the system version, this field is used to correctly identify the version.

NtMinorVersion

The NT minor version. Each process sees a version from its PEB, but if the process is running with an altered view of the system version, this field is used to correctly identify the version.

ProcessorFeatures[PROCESSOR_FEATURE_MAX]

Processor features.

Reserved1

Reserved for future use.

Reserved3

Reserved for future use.

TimeSlip

Time slippage while in debugger.

AlternativeArchitecture

Alternative system architecture. For example, NEC PC98xx on x86.

BootId

Boot sequence, incremented for each boot attempt by the OS loader.

SystemExpirationDate

If the system is an evaluation unit, the following field contains the date and time that the evaluation unit expires. A value of 0 indicates that there is no expiration. A non-zero value is the UTC absolute time that the system expires.

SuiteMask

Suite support. This field must be accessed via the RtlGetSuiteMask API for an accurate result.

KdDebuggerEnabled

TRUE if a kernel debugger is connected/enabled.

MitigationPolicies

Mitigation policies.

NXSupportPolicy

Defines the UCHAR member NXSupportPolicy.

SEHValidationPolicy

Defines the UCHAR member SEHValidationPolicy.

CurDirDevicesSkippedForDlls

Defines the UCHAR member CurDirDevicesSkippedForDlls.

Reserved

Reserved for future use.

CyclesPerYield

Measured duration of a single processor yield, in cycles. This is used by lock packages to determine how many times to spin waiting for a state change before blocking.

ActiveConsoleId

Current console session Id. Always zero on non-TS systems. This field must be accessed via the RtlGetActiveConsoleId API for an accurate result.

DismountCount

Force-dismounts cause handles to become invalid. Rather than always probe handles, a serial number of dismounts is maintained that clients can use to see if they need to probe handles.

ComPlusPackage

This field indicates the status of the 64-bit COM+ package on the system. It indicates whether the Intermediate Language (IL) COM+ images need to use the 64-bit COM+ runtime or the 32-bit COM+ runtime.

LastSystemRITEventTickCount

Time in tick count for system-wide last user input across all terminal sessions. For MP performance, it is not updated all the time (for example, once a minute per session). It is used for idle detection.

NumberOfPhysicalPages

Number of physical pages in the system. This can dynamically change as physical memory can be added or removed from a running system.

SafeBootMode

True if the system was booted in safe boot mode.

VirtualizationFlags

Virtualization flags.

ArchStartedInEl2

Keep this bitfield in sync with the one in arc.w.

QcSlIsSupported

Keep this bitfield in sync with the one in arc.w.

Reserved12[2]

Reserved for future use.

DUMMYUNIONNAME2

This is a packed bitfield that contains various flags concerning the system state. They must be manipulated using interlocked operations. DbgMultiSessionSku must be accessed via the RtlIsMultiSessionSku API for an accurate result.

DUMMYUNIONNAME2.SharedDataFlags

Defines the ULONG member SharedDataFlags.

DUMMYUNIONNAME2.DUMMYSTRUCTNAME2

Defines the DUMMYSTRUCTNAME2 structure.

DUMMYUNIONNAME2.DUMMYSTRUCTNAME2.DbgErrorPortPresent

For debugger only. Do not use. Use the bit definitions instead.

DUMMYUNIONNAME2.DUMMYSTRUCTNAME2.DbgElevationEnabled

For debugger only. Do not use. Use the bit definitions instead.

DUMMYUNIONNAME2.DUMMYSTRUCTNAME2.DbgVirtEnabled

For debugger only. Do not use. Use the bit definitions instead.

DUMMYUNIONNAME2.DUMMYSTRUCTNAME2.DbgInstallerDetectEnabled

For debugger only. Do not use. Use the bit definitions instead.

DUMMYUNIONNAME2.DUMMYSTRUCTNAME2.DbgLkgEnabled

For debugger only. Do not use. Use the bit definitions instead.

DUMMYUNIONNAME2.DUMMYSTRUCTNAME2.DbgDynProcessorEnabled

For debugger only. Do not use. Use the bit definitions instead.

DUMMYUNIONNAME2.DUMMYSTRUCTNAME2.DbgConsoleBrokerEnabled

For debugger only. Do not use. Use the bit definitions instead.

DUMMYUNIONNAME2.DUMMYSTRUCTNAME2.DbgSecureBootEnabled

For debugger only. Do not use. Use the bit definitions instead.

DUMMYUNIONNAME2.DUMMYSTRUCTNAME2.DbgMultiSessionSku

For debugger only. Do not use. Use the bit definitions instead.

DUMMYUNIONNAME2.DUMMYSTRUCTNAME2.DbgMultiUsersInSessionSku

For debugger only. Do not use. Use the bit definitions instead.

DUMMYUNIONNAME2.DUMMYSTRUCTNAME2.DbgStateSeparationEnabled

For debugger only. Do not use. Use the bit definitions instead.

DUMMYUNIONNAME2.DUMMYSTRUCTNAME2.SpareBits

For the debugger only. Do not use. Use the bit definitions instead.

DataFlagsPad[1]

Defines the ULONG member DataFlagsPad.

TestRetInstruction

Depending on the processor, the code for fast system call will differ. This field is only used on 32-bit systems.

QpcFrequency

Defines the LONGLONG member QpcFrequency.

SystemCall

On AMD64, this value is initialized to a nonzero value if the system operates with an altered view of the system service call mechanism.

Reserved2

Reserved for future use.

SystemCallPad[2]

Reserved for future use.

DUMMYUNIONNAME3

The 64-bit tick count.

DUMMYUNIONNAME3.TickCount

Defines the KSYSTEM_TIME member TickCount.

DUMMYUNIONNAME3.TickCountQuad

Defines the ULONG64 member TickCountQuad.

DUMMYUNIONNAME3.DUMMYSTRUCTNAME

Defines DUMMYSTRUCTNAME.

DUMMYUNIONNAME3.DUMMYSTRUCTNAME.ReservedTickCountOverlay[3]

Defines the ULONG member ReservedTickCountOverlay.

DUMMYUNIONNAME3.DUMMYSTRUCTNAME.TickCountPad[1]

Defines the ULONG member TickCountPad.

Cookie

Cookie for encoding pointers system wide.

CookiePad[1]

Reserved for future use.

ConsoleSessionForegroundProcessId

Client id of the process having the focus in the current active console session id. This field must be accessed via the RtlGetConsoleSessionForegroundProcessId API for an accurate result.

TimeUpdateLock

Placeholder for the (internal) time update lock. This data is used to implement the precise time services. It is aligned on a 64-byte cache-line boundary and arranged in the order of typical accesses.

BaselineSystemTimeQpc

The performance counter value used to establish the current system time.

BaselineInterruptTimeQpc

The performance counter value used to compute the last interrupt time.

QpcSystemTimeIncrement

The scaled number of system time seconds represented by a single performance count (this value may vary to achieve time synchronization).

QpcInterruptTimeIncrement

The scaled number of interrupt time seconds represented by a single performance count (this value is constant after the system is booted).

QpcSystemTimeIncrementShift

The scaling shift count applied to the performance counter system time increment.

QpcInterruptTimeIncrementShift

The scaling shift count applied to the performance counter interrupt time increment.

UnparkedProcessorCount

The count of unparked processors.

EnclaveFeatureMask[4]

A bitmask of enclave features supported on this system. This field must be accessed via the RtlIsEnclareFeaturePresent API for an accurate result.

TelemetryCoverageRound

Current coverage round for telemetry based coverage.

UserModeGlobalLogger[16]

The following field is used for ETW user mode global logging (UMGL).

ImageFileExecutionOptions

Settings that can enable the use of Image File Execution Options from HKCU in addition to the original HKLM.

LangGenerationCount

Generation of the kernel structure holding system language information.

Reserved4

Reserved for future use.

InterruptTimeBias

Current 64-bit interrupt time bias in 100ns units.

QpcBias

Current 64-bit performance counter bias, in performance counter units before the shift is applied.

ActiveProcessorCount

Number of active processors.

ActiveGroupCount

Number of active groups.

Reserved9

Reserved for future use.

QpcData

Defines the USHORT member QpcData.

QpcBypassEnabled

A boolean indicating whether performance counter queries can read the counter directly (bypassing the system call).

QpcShift

Shift applied to the raw counter value to derive the QPC count.

TimeZoneBiasEffectiveStart

Defines the LARGE_INTEGER member TimeZoneBiasEffectiveStart.

TimeZoneBiasEffectiveEnd

Defines the LARGE_INTEGER member TimeZoneBiasEffectiveEnd.

XState

Extended processor state configuration.

FeatureConfigurationChangeStamp

Defines the KSYSTEM_TIME member FeatureConfigurationChangeStamp.

Spare

Defines the ULONG member Spare.

UserPointerAuthMask

Defines the ULONG64 member UserPointerAuthMask.

Requirements

   
Header ntddk.h (include Ntddk.h)