3 Copyright (c) Alex Ionescu. All rights reserved.
11 Type definitions for the Loader.
15 Alex Ionescu (alexi@tinykrnl.org) - Updated - 27-Feb-2006
26 #ifndef NTOS_MODE_USER
33 // A system call ID is formatted as such:
34 // .________________________________________________________________.
35 // | 14 | 13 | 12 | 11 | 10 | 9 | 8 | 7 | 6 | 5 | 4 | 3 | 2 | 1 | 0 |
36 // |--------------|-------------------------------------------------|
37 // | TABLE NUMBER | TABLE OFFSET |
38 // \----------------------------------------------------------------/
40 // The table number is then used as an index into the service descriptor table.
41 #define TABLE_NUMBER_BITS 1
42 #define TABLE_OFFSET_BITS 12
45 // There are 2 tables (kernel and shadow, used by Win32K)
47 #define NUMBER_SERVICE_TABLES 2
48 #define NTOS_SERVICE_INDEX 0
49 #define WIN32K_SERVICE_INDEX 1
52 // NB. From assembly code, the table number must be computed as an offset into
53 // the service descriptor table.
55 // Each entry into the table is 16 bytes long on 32-bit architectures, and
56 // 32 bytes long on 64-bit architectures.
58 // Thus, Table Number 1 is offset 16 (0x10) on x86, and offset 32 (0x20) on
62 #define BITS_PER_ENTRY 5 // (1 << 5) = 32 bytes
64 #define BITS_PER_ENTRY 4 // (1 << 4) = 16 bytes
68 // We want the table number, but leave some extra bits to we can have the offset
69 // into the descriptor table.
71 #define SERVICE_TABLE_SHIFT (12 - BITS_PER_ENTRY)
74 // Now the table number (as an offset) is corrupted with part of the table offset
75 // This mask will remove the extra unwanted bits, and give us the offset into the
76 // descriptor table proper.
78 #define SERVICE_TABLE_MASK (((1 << TABLE_NUMBER_BITS) - 1) << BITS_PER_ENTRY)
81 // To get the table offset (ie: the service call number), just keep the 12 bits
83 #define SERVICE_NUMBER_MASK ((1 << TABLE_OFFSET_BITS) - 1)
86 // We'll often need to check if this is a graphics call. This is done by comparing
87 // the table number offset with the known Win32K table number offset.
88 // This is usually index 1, so table number offset 0x10 (x86) or 0x20 (x64)
90 #define SERVICE_TABLE_TEST (WIN32K_SERVICE_INDEX << BITS_PER_ENTRY)
93 // Context Record Flags
95 #define CONTEXT_DEBUGGER (CONTEXT_FULL | CONTEXT_FLOATING_POINT)
98 // Maximum System Descriptor Table Entries
100 #define SSDT_MAX_ENTRIES 2
103 // Processor Architectures
105 #define PROCESSOR_ARCHITECTURE_INTEL 0
106 #define PROCESSOR_ARCHITECTURE_MIPS 1
107 #define PROCESSOR_ARCHITECTURE_ALPHA 2
108 #define PROCESSOR_ARCHITECTURE_PPC 3
109 #define PROCESSOR_ARCHITECTURE_SHX 4
110 #define PROCESSOR_ARCHITECTURE_ARM 5
111 #define PROCESSOR_ARCHITECTURE_IA64 6
112 #define PROCESSOR_ARCHITECTURE_ALPHA64 7
113 #define PROCESSOR_ARCHITECTURE_MSIL 8
114 #define PROCESSOR_ARCHITECTURE_AMD64 9
115 #define PROCESSOR_ARCHITECTURE_UNKNOWN 0xFFFF
118 // Object Type Mask for Kernel Dispatcher Objects
120 #define KOBJECT_TYPE_MASK 0x7F
121 #define KOBJECT_LOCK_BIT 0x80
124 // Dispatcher Priority increments
126 #define THREAD_ALERT_INCREMENT 2
129 // Physical memory offset of KUSER_SHARED_DATA
131 #define KI_USER_SHARED_DATA_PHYSICAL 0x41000
134 // Quantum values and decrements
136 #define MAX_QUANTUM 0x7F
137 #define WAIT_QUANTUM_DECREMENT 1
138 #define CLOCK_QUANTUM_DECREMENT 3
141 // Kernel Feature Bits
143 #define KF_V86_VIS 0x00000001
144 #define KF_RDTSC 0x00000002
145 #define KF_CR4 0x00000004
146 #define KF_CMOV 0x00000008
147 #define KF_GLOBAL_PAGE 0x00000010
148 #define KF_LARGE_PAGE 0x00000020
149 #define KF_MTRR 0x00000040
150 #define KF_CMPXCHG8B 0x00000080
151 #define KF_MMX 0x00000100
152 #define KF_WORKING_PTE 0x00000200
153 #define KF_PAT 0x00000400
154 #define KF_FXSR 0x00000800
155 #define KF_FAST_SYSCALL 0x00001000
156 #define KF_XMMI 0x00002000
157 #define KF_3DNOW 0x00004000
158 #define KF_AMDK6MTRR 0x00008000
159 #define KF_XMMI64 0x00010000
160 #define KF_DTS 0x00020000
161 #define KF_BRANCH 0x00020000 // from ksamd64.inc
162 #define KF_SSE3 0x00080000
163 #define KF_CMPXCHG16B 0x00100000
164 #define KF_XSTATE 0x00800000 // from ks386.inc, ksamd64.inc
165 #define KF_NX_BIT 0x20000000
166 #define KF_NX_DISABLED 0x40000000
167 #define KF_NX_ENABLED 0x80000000
169 #define KF_XSAVEOPT_BIT 15
170 #define KF_XSTATE_BIT 23
171 #define KF_RDWRFSGSBASE_BIT 28
174 // Internal Exception Codes
176 #define KI_EXCEPTION_INTERNAL 0x10000000
177 #define KI_EXCEPTION_ACCESS_VIOLATION (KI_EXCEPTION_INTERNAL | 0x04)
179 typedef struct _FIBER
/* Field offsets: */
181 PVOID FiberData
; /* 0x000 0x000 0x000 */
182 struct _EXCEPTION_REGISTRATION_RECORD
*ExceptionList
;/* 0x004 0x004 0x008 */
183 PVOID StackBase
; /* 0x008 0x008 0x010 */
184 PVOID StackLimit
; /* 0x00C 0x00C 0x018 */
185 PVOID DeallocationStack
; /* 0x010 0x010 0x020 */
186 CONTEXT FiberContext
; /* 0x014 0x018 0x030 */
187 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
188 PVOID Wx86Tib
; /* 0x2E0 0x1b8 0x500 */
189 struct _ACTIVATION_CONTEXT_STACK
*ActivationContextStackPointer
; /* 0x2E4 0x1bc 0x508 */
190 PVOID FlsData
; /* 0x2E8 0x1c0 0x510 */
191 ULONG GuaranteedStackBytes
; /* 0x2EC 0x1c4 0x518 */
192 ULONG TebFlags
; /* 0x2F0 0x1c8 0x51C */
194 ULONG GuaranteedStackBytes
; /* 0x2E0 */
195 PVOID FlsData
; /* 0x2E4 */
196 struct _ACTIVATION_CONTEXT_STACK
*ActivationContextStackPointer
;
200 #ifndef NTOS_MODE_USER
202 // Number of dispatch codes supported by KINTERRUPT
205 #define DISPATCH_LENGTH 4
206 #elif (NTDDI_VERSION >= NTDDI_LONGHORN)
207 #define DISPATCH_LENGTH 135
209 #define DISPATCH_LENGTH 106
215 // KPROCESSOR_MODE Type
217 typedef CCHAR KPROCESSOR_MODE
;
220 // Dereferencable pointer to KUSER_SHARED_DATA in User-Mode
222 #define SharedUserData ((KUSER_SHARED_DATA *)USER_SHARED_DATA)
225 // Maximum WOW64 Entries in KUSER_SHARED_DATA
227 #define MAX_WOW64_SHARED_ENTRIES 16
230 // Maximum Processor Features supported in KUSER_SHARED_DATA
232 #define PROCESSOR_FEATURE_MAX 64
237 typedef enum _EVENT_TYPE
246 typedef enum _TIMER_TYPE
255 typedef enum _WAIT_TYPE
262 // Processor Execution Modes
274 typedef enum _KWAIT_REASON
316 typedef enum _KPROFILE_SOURCE
319 ProfileAlignmentFixup
,
322 ProfileLoadInstructions
,
323 ProfilePipelineFrozen
,
324 ProfileBranchInstructions
,
325 ProfileTotalNonissues
,
329 ProfileBranchMispredictions
,
330 ProfileStoreInstructions
,
331 ProfileFpInstructions
,
332 ProfileIntegerInstructions
,
336 ProfileSpecialInstructions
,
339 ProfileDcacheAccesses
,
340 ProfileMemoryBarrierCycles
,
341 ProfileLoadLinkedIssues
,
346 // NT Product and Architecture Types
348 typedef enum _NT_PRODUCT_TYPE
353 } NT_PRODUCT_TYPE
, *PNT_PRODUCT_TYPE
;
355 typedef enum _ALTERNATIVE_ARCHITECTURE_TYPE
360 } ALTERNATIVE_ARCHITECTURE_TYPE
;
367 typedef enum _KTHREAD_STATE
377 #if (NTDDI_VERSION >= NTDDI_WS03)
380 } KTHREAD_STATE
, *PKTHREAD_STATE
;
383 // Kernel Object Types
385 typedef enum _KOBJECTS
387 EventNotificationObject
= 0,
388 EventSynchronizationObject
= 1,
395 TimerNotificationObject
= 8,
396 TimerSynchronizationObject
= 9,
407 DeviceQueueObject
= 20,
408 EventPairObject
= 21,
409 InterruptObject
= 22,
411 ThreadedDpcObject
= 24,
412 MaximumKernelObject
= 25
418 typedef enum _ADJUST_REASON
428 typedef enum _KCONTINUE_STATUS
432 ContinueProcessorReselected
,
433 ContinueNextProcessor
439 typedef enum _KPROCESS_STATE
446 } KPROCESS_STATE
, *PKPROCESS_STATE
;
449 // NtVdmControl Classes
451 typedef enum _VDMSERVICECLASS
453 VdmStartExecution
= 0,
454 VdmQueueInterrupt
= 1,
455 VdmDelayInterrupt
= 2,
458 VdmSetInt21Handler
= 5,
460 VdmPrinterDirectIoOpen
= 7,
461 VdmPrinterDirectIoClose
= 8,
462 VdmPrinterInitialize
= 9,
463 VdmSetLdtEntries
= 10,
464 VdmSetProcessLdtInfo
= 11,
465 VdmAdlibEmulation
= 12,
466 VdmPMCliControl
= 13,
467 VdmQueryVdmProcess
= 14,
470 #ifdef NTOS_MODE_USER
473 // APC Normal Routine
476 (NTAPI
*PKNORMAL_ROUTINE
)(
477 _In_ PVOID NormalContext
,
478 _In_ PVOID SystemArgument1
,
479 _In_ PVOID SystemArgument2
486 (NTAPI
*PTIMER_APC_ROUTINE
)(
487 _In_ PVOID TimerContext
,
488 _In_ ULONG TimerLowValue
,
489 _In_ LONG TimerHighValue
493 // System Time Structure
495 typedef struct _KSYSTEM_TIME
500 } KSYSTEM_TIME
, *PKSYSTEM_TIME
;
503 // Shared Kernel User Data
505 typedef struct _KUSER_SHARED_DATA
507 ULONG TickCountLowDeprecated
;
508 ULONG TickCountMultiplier
;
509 volatile KSYSTEM_TIME InterruptTime
;
510 volatile KSYSTEM_TIME SystemTime
;
511 volatile KSYSTEM_TIME TimeZoneBias
;
512 USHORT ImageNumberLow
;
513 USHORT ImageNumberHigh
;
514 WCHAR NtSystemRoot
[260];
515 ULONG MaxStackTraceDepth
;
516 ULONG CryptoExponent
;
518 ULONG LargePageMinimum
;
520 NT_PRODUCT_TYPE NtProductType
;
521 BOOLEAN ProductTypeIsValid
;
522 ULONG NtMajorVersion
;
523 ULONG NtMinorVersion
;
524 BOOLEAN ProcessorFeatures
[PROCESSOR_FEATURE_MAX
];
527 volatile ULONG TimeSlip
;
528 ALTERNATIVE_ARCHITECTURE_TYPE AlternativeArchitecture
;
529 LARGE_INTEGER SystemExpirationDate
;
531 BOOLEAN KdDebuggerEnabled
;
532 #if (NTDDI_VERSION >= NTDDI_WINXPSP2)
533 UCHAR NXSupportPolicy
;
535 volatile ULONG ActiveConsoleId
;
536 volatile ULONG DismountCount
;
537 ULONG ComPlusPackage
;
538 ULONG LastSystemRITEventTickCount
;
539 ULONG NumberOfPhysicalPages
;
540 BOOLEAN SafeBootMode
;
543 ULONGLONG TestRetInstruction
;
545 ULONG SystemCallReturn
;
546 ULONGLONG SystemCallPad
[3];
548 volatile KSYSTEM_TIME TickCount
;
549 volatile ULONG64 TickCountQuad
;
552 #if (NTDDI_VERSION >= NTDDI_WS03)
553 LONGLONG ConsoleSessionForegroundProcessId
;
554 ULONG Wow64SharedInformation
[MAX_WOW64_SHARED_ENTRIES
];
556 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
557 USHORT UserModeGlobalLogger
[8];
558 ULONG HeapTracingPid
[2];
559 ULONG CritSecTracingPid
[2];
562 ULONG SharedDataFlags
;
565 ULONG DbgErrorPortPresent
:1;
566 ULONG DbgElevationEnabled
:1;
567 ULONG DbgVirtEnabled
:1;
568 ULONG DbgInstallerDetectEnabled
:1;
572 ULONG ImageFileExecutionOptions
;
573 KAFFINITY ActiveProcessorAffinity
;
575 } KUSER_SHARED_DATA
, *PKUSER_SHARED_DATA
;
580 #include "pshpack1.h"
581 typedef struct _VdmVirtualIca
594 } VDMVIRTUALICA
, *PVDMVIRTUALICA
;
597 typedef struct _VdmIcaUserData
600 PVDMVIRTUALICA pIcaMaster
;
601 PVDMVIRTUALICA pIcaSlave
;
606 PULONG pAddrIretBopTable
;
607 PHANDLE phWowIdleEvent
;
608 PLARGE_INTEGER pIcaTimeout
;
609 PHANDLE phMainThreadSuspended
;
610 } VDMICAUSERDATA
, *PVDMICAUSERDATA
;
612 typedef struct _VDM_INITIALIZE_DATA
615 PVDMICAUSERDATA IcaUserData
;
616 } VDM_INITIALIZE_DATA
, *PVDM_INITIALIZE_DATA
;
621 // System Thread Start Routine
625 (NTAPI
*PKSYSTEM_ROUTINE
)(
626 PKSTART_ROUTINE StartRoutine
,
632 (NTAPI
*PKNORMAL_ROUTINE
)(
633 IN PVOID NormalContext OPTIONAL
,
634 IN PVOID SystemArgument1 OPTIONAL
,
635 IN PVOID SystemArgument2 OPTIONAL
);
638 (NTAPI
*PKRUNDOWN_ROUTINE
)(
639 IN
struct _KAPC
*Apc
);
642 (NTAPI
*PKKERNEL_ROUTINE
)(
643 IN
struct _KAPC
*Apc
,
644 IN OUT PKNORMAL_ROUTINE
*NormalRoutine OPTIONAL
,
645 IN OUT PVOID
*NormalContext OPTIONAL
,
646 IN OUT PVOID
*SystemArgument1 OPTIONAL
,
647 IN OUT PVOID
*SystemArgument2 OPTIONAL
);
651 // APC Environment Types
653 typedef enum _KAPC_ENVIRONMENT
655 OriginalApcEnvironment
,
656 AttachedApcEnvironment
,
657 CurrentApcEnvironment
,
661 typedef struct _KTIMER_TABLE_ENTRY
663 #if (NTDDI_VERSION >= NTDDI_LONGHORN) || defined(_M_ARM) || defined(_M_AMD64)
668 } KTIMER_TABLE_ENTRY
, *PKTIMER_TABLE_ENTRY
;
670 typedef struct _KTIMER_TABLE
672 PKTIMER TimerExpiry
[64];
673 KTIMER_TABLE_ENTRY TimerEntries
[256];
674 } KTIMER_TABLE
, *PKTIMER_TABLE
;
676 typedef struct _KDPC_LIST
678 SINGLE_LIST_ENTRY ListHead
;
679 SINGLE_LIST_ENTRY
* LastEntry
;
680 } KDPC_LIST
, *PKDPC_LIST
;
682 typedef struct _SYNCH_COUNTERS
684 ULONG SpinLockAcquireCount
;
685 ULONG SpinLockContentionCount
;
686 ULONG SpinLockSpinCount
;
687 ULONG IpiSendRequestBroadcastCount
;
688 ULONG IpiSendRequestRoutineCount
;
689 ULONG IpiSendSoftwareInterruptCount
;
690 ULONG ExInitializeResourceCount
;
691 ULONG ExReInitializeResourceCount
;
692 ULONG ExDeleteResourceCount
;
693 ULONG ExecutiveResourceAcquiresCount
;
694 ULONG ExecutiveResourceContentionsCount
;
695 ULONG ExecutiveResourceReleaseExclusiveCount
;
696 ULONG ExecutiveResourceReleaseSharedCount
;
697 ULONG ExecutiveResourceConvertsCount
;
698 ULONG ExAcqResExclusiveAttempts
;
699 ULONG ExAcqResExclusiveAcquiresExclusive
;
700 ULONG ExAcqResExclusiveAcquiresExclusiveRecursive
;
701 ULONG ExAcqResExclusiveWaits
;
702 ULONG ExAcqResExclusiveNotAcquires
;
703 ULONG ExAcqResSharedAttempts
;
704 ULONG ExAcqResSharedAcquiresExclusive
;
705 ULONG ExAcqResSharedAcquiresShared
;
706 ULONG ExAcqResSharedAcquiresSharedRecursive
;
707 ULONG ExAcqResSharedWaits
;
708 ULONG ExAcqResSharedNotAcquires
;
709 ULONG ExAcqResSharedStarveExclusiveAttempts
;
710 ULONG ExAcqResSharedStarveExclusiveAcquiresExclusive
;
711 ULONG ExAcqResSharedStarveExclusiveAcquiresShared
;
712 ULONG ExAcqResSharedStarveExclusiveAcquiresSharedRecursive
;
713 ULONG ExAcqResSharedStarveExclusiveWaits
;
714 ULONG ExAcqResSharedStarveExclusiveNotAcquires
;
715 ULONG ExAcqResSharedWaitForExclusiveAttempts
;
716 ULONG ExAcqResSharedWaitForExclusiveAcquiresExclusive
;
717 ULONG ExAcqResSharedWaitForExclusiveAcquiresShared
;
718 ULONG ExAcqResSharedWaitForExclusiveAcquiresSharedRecursive
;
719 ULONG ExAcqResSharedWaitForExclusiveWaits
;
720 ULONG ExAcqResSharedWaitForExclusiveNotAcquires
;
721 ULONG ExSetResOwnerPointerExclusive
;
722 ULONG ExSetResOwnerPointerSharedNew
;
723 ULONG ExSetResOwnerPointerSharedOld
;
724 ULONG ExTryToAcqExclusiveAttempts
;
725 ULONG ExTryToAcqExclusiveAcquires
;
726 ULONG ExBoostExclusiveOwner
;
727 ULONG ExBoostSharedOwners
;
728 ULONG ExEtwSynchTrackingNotificationsCount
;
729 ULONG ExEtwSynchTrackingNotificationsAccountedCount
;
730 } SYNCH_COUNTERS
, *PSYNCH_COUNTERS
;
735 typedef struct _KDPC_DATA
737 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
740 LIST_ENTRY DpcListHead
;
743 #if defined(_M_AMD64) || defined(_M_ARM)
744 volatile LONG DpcQueueDepth
;
746 volatile ULONG DpcQueueDepth
;
749 #if (NTDDI_VERSION >= NTDDI_LONGHORN) || defined(_M_ARM)
752 } KDPC_DATA
, *PKDPC_DATA
;
755 // Per-Processor Lookaside List
757 typedef struct _PP_LOOKASIDE_LIST
759 struct _GENERAL_LOOKASIDE
*P
;
760 struct _GENERAL_LOOKASIDE
*L
;
761 } PP_LOOKASIDE_LIST
, *PPP_LOOKASIDE_LIST
;
764 // Architectural Types
766 #include <arch/ketypes.h>
769 // Kernel Memory Node
771 #include <pshpack1.h>
772 typedef struct _KNODE
774 SLIST_HEADER DeadStackList
;
775 SLIST_HEADER PfnDereferenceSListHead
;
776 KAFFINITY ProcessorMask
;
781 ULONG MmShiftedColor
;
783 struct _SINGLE_LIST_ENTRY
*PfnDeferredList
;
788 // Structure for Get/SetContext APC
790 typedef struct _GETSETCONTEXT
794 KPROCESSOR_MODE Mode
;
796 } GETSETCONTEXT
, *PGETSETCONTEXT
;
799 // Kernel Profile Object
801 typedef struct _KPROFILE
805 LIST_ENTRY ProfileListEntry
;
806 struct _KPROCESS
*Process
;
813 KPROFILE_SOURCE Source
;
815 } KPROFILE
, *PKPROFILE
;
818 // Kernel Interrupt Object
820 typedef struct _KINTERRUPT
824 LIST_ENTRY InterruptListEntry
;
825 PKSERVICE_ROUTINE ServiceRoutine
;
826 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
827 PKSERVICE_ROUTINE MessageServiceRoutine
;
830 PVOID ServiceContext
;
833 PKSPIN_LOCK ActualLock
;
834 PKINTERRUPT_ROUTINE DispatchAddress
;
837 KIRQL SynchronizeIrql
;
838 BOOLEAN FloatingSave
;
842 KINTERRUPT_MODE Mode
;
843 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
844 KINTERRUPT_POLARITY Polarity
;
848 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
852 PKTRAP_FRAME TrapFrame
;
855 ULONG DispatchCode
[DISPATCH_LENGTH
];
859 // Kernel Event Pair Object
861 typedef struct _KEVENT_PAIR
867 } KEVENT_PAIR
, *PKEVENT_PAIR
;
870 // Kernel No Execute Options
872 typedef struct _KEXECUTE_OPTIONS
874 UCHAR ExecuteDisable
:1;
875 UCHAR ExecuteEnable
:1;
876 UCHAR DisableThunkEmulation
:1;
878 UCHAR ExecuteDispatchEnable
:1;
879 UCHAR ImageDispatchEnable
:1;
881 } KEXECUTE_OPTIONS
, *PKEXECUTE_OPTIONS
;
883 #if (NTDDI_VERSION >= NTDDI_WIN7)
884 typedef union _KWAIT_STATUS_REGISTER
897 } KWAIT_STATUS_REGISTER
, *PKWAIT_STATUS_REGISTER
;
899 typedef struct _COUNTER_READING
901 enum _HARDWARE_COUNTER_TYPE Type
;
905 }COUNTER_READING
, *PCOUNTER_READING
;
907 typedef struct _KTHREAD_COUNTERS
909 ULONG64 WaitReasonBitMap
;
910 struct _THREAD_PERFORMANCE_DATA
* UserData
;
912 ULONG ContextSwitches
;
913 ULONG64 CycleTimeBias
;
914 ULONG64 HardwareCounters
;
915 COUNTER_READING HwCounter
[16];
916 }KTHREAD_COUNTERS
, *PKTHREAD_COUNTERS
;
920 // Kernel Thread (KTHREAD)
922 typedef struct _KTHREAD
924 DISPATCHER_HEADER Header
;
925 #if (NTDDI_VERSION >= NTDDI_LONGHORN) // [
930 ULONGLONG QuantumTarget
;
932 LIST_ENTRY MutantListHead
;
935 ULONG_PTR StackLimit
; // FIXME: PVOID
937 KSPIN_LOCK ThreadLock
;
938 #if (NTDDI_VERSION >= NTDDI_WIN7) // [
939 KWAIT_STATUS_REGISTER WaitRegister
;
946 ULONG KernelStackResident
:1;
947 ULONG ReadyTransition
:1;
948 ULONG ProcessReadyQueue
:1;
950 ULONG SystemAffinityActive
:1;
952 ULONG GdiFlushActive
:1;
953 ULONG UserStackWalkActive
:1;
954 ULONG ApcInterruptRequest
:1;
955 ULONG ForceDeferSchedule
:1;
956 ULONG QuantumEndMigrate
:1;
957 ULONG UmsDirectedSwitchEnable
:1;
969 UCHAR ApcStateFill
[FIELD_OFFSET(KAPC_STATE
, UserApcPending
) + 1];
970 #if (NTDDI_VERSION >= NTDDI_LONGHORN) // [
972 #if (NTDDI_VERSION >= NTDDI_WIN7) // [
973 /* On x86, the following members "fall out" of the union */
974 volatile ULONG NextProcessor
;
975 volatile ULONG DeferredProcessor
;
977 /* On x86, the following members "fall out" of the union */
978 volatile USHORT NextProcessor
;
979 volatile USHORT DeferredProcessor
;
983 /* On x86, the following members "fall out" of the union */
984 volatile UCHAR NextProcessor
;
985 volatile UCHAR DeferredProcessor
;
987 SCHAR AdjustIncrement
;
991 KSPIN_LOCK ApcQueueLock
;
992 #ifndef _M_AMD64 // [
993 ULONG ContextSwitches
;
994 volatile UCHAR State
;
997 KPROCESSOR_MODE WaitMode
;
1000 #if (NTDDI_VERSION >= NTDDI_WIN7) // [
1001 PKWAIT_BLOCK WaitBlockList
;
1005 PKWAIT_BLOCK WaitBlockList
;
1008 #if (NTDDI_VERSION >= NTDDI_LONGHORN) // [
1013 ULONG KernelStackResident
:1;
1014 ULONG ReadyTransition
:1;
1015 ULONG ProcessReadyQueue
:1;
1017 ULONG SystemAffinityActive
:1;
1019 ULONG GdiFlushActive
:1;
1029 #if (NTDDI_VERSION < NTDDI_LONGHORN)
1031 BOOLEAN EnableStackSwap
;
1033 volatile UCHAR SwapBusy
;
1034 BOOLEAN Alerted
[MaximumMode
];
1038 LIST_ENTRY WaitListEntry
;
1039 SINGLE_LIST_ENTRY SwapListEntry
;
1042 #ifndef _M_AMD64 // [
1048 SHORT KernelApcDisable
;
1049 SHORT SpecialApcDisable
;
1051 ULONG CombinedApcDisable
;
1056 #if (NTDDI_VERSION >= NTDDI_WIN7) // [
1064 UCHAR TimerFill
[FIELD_OFFSET(KTIMER
, Period
) + sizeof(LONG
)];
1065 #if !defined(_WIN64) // [
1074 ULONG AutoAlignment
:1;
1075 ULONG DisableBoost
:1;
1076 #if (NTDDI_VERSION >= NTDDI_LONGHORN) // [
1077 ULONG EtwStackTraceApc1Inserted
:1;
1078 ULONG EtwStackTraceApc2Inserted
:1;
1079 ULONG CycleChargePending
:1;
1080 ULONG CalloutActive
:1;
1081 ULONG ApcQueueable
:1;
1082 ULONG EnableStackSwap
:1;
1084 ULONG ReservedFlags
:23;
1086 LONG ReservedFlags
:30;
1091 #if defined(_WIN64) && (NTDDI_VERSION < NTDDI_WIN7) // [
1095 #if (NTDDI_VERSION >= NTDDI_WIN7) // [
1096 #if defined(_WIN64) // [
1104 DECLSPEC_ALIGN(8) KWAIT_BLOCK WaitBlock
[THREAD_WAIT_OBJECTS
+ 1];
1105 #if (NTDDI_VERSION < NTDDI_WIN7) // [
1108 UCHAR WaitBlockFill0
[FIELD_OFFSET(KWAIT_BLOCK
, SpareByte
)]; // 32bit = 23, 64bit = 43
1109 #if (NTDDI_VERSION >= NTDDI_LONGHORN) // [
1110 UCHAR IdealProcessor
;
1112 BOOLEAN SystemAffinityActive
;
1117 UCHAR WaitBlockFill1
[1 * sizeof(KWAIT_BLOCK
) + FIELD_OFFSET(KWAIT_BLOCK
, SpareByte
)]; // 47 / 91
1122 UCHAR WaitBlockFill2
[2 * sizeof(KWAIT_BLOCK
) + FIELD_OFFSET(KWAIT_BLOCK
, SpareByte
)]; // 71 / 139
1123 UCHAR ResourceIndex
;
1127 UCHAR WaitBlockFill3
[3 * sizeof(KWAIT_BLOCK
) + FIELD_OFFSET(KWAIT_BLOCK
, SpareByte
)]; // 95 / 187
1131 #ifdef _M_AMD64 // [
1134 UCHAR WaitBlockFill4
[FIELD_OFFSET(KWAIT_BLOCK
, SpareLong
)];
1135 ULONG ContextSwitches
;
1139 UCHAR WaitBlockFill5
[1 * sizeof(KWAIT_BLOCK
) + FIELD_OFFSET(KWAIT_BLOCK
, SpareLong
)];
1147 UCHAR WaitBlockFill6
[2 * sizeof(KWAIT_BLOCK
) + FIELD_OFFSET(KWAIT_BLOCK
, SpareLong
)];
1150 #if (NTDDI_VERSION >= NTDDI_WIN7) // [
1153 UCHAR WaitBlockFill7
[168];
1154 PVOID TebMappedLowVa
;
1155 struct _UMS_CONTROL_BLOCK
* Ucb
;
1160 #if (NTDDI_VERSION >= NTDDI_WIN7) // [
1161 UCHAR WaitBlockFill8
[188];
1163 UCHAR WaitBlockFill7
[3 * sizeof(KWAIT_BLOCK
) + FIELD_OFFSET(KWAIT_BLOCK
, SpareLong
)];
1169 SHORT KernelApcDisable
;
1170 SHORT SpecialApcDisable
;
1172 ULONG CombinedApcDisable
;
1177 LIST_ENTRY QueueListEntry
;
1178 PKTRAP_FRAME TrapFrame
;
1179 #if (NTDDI_VERSION >= NTDDI_LONGHORN) // [
1180 PVOID FirstArgument
;
1181 union // 2 elements, 0x8 bytes (sizeof)
1183 PVOID CallbackStack
;
1184 ULONG_PTR CallbackDepth
;
1187 PVOID CallbackStack
;
1189 #if (NTDDI_VERSION < NTDDI_LONGHORN) || ((NTDDI_VERSION < NTDDI_WIN7) && !defined(_WIN64)) // [
1192 #if (NTDDI_VERSION < NTDDI_LONGHORN) && defined(_WIN64) // [
1195 UCHAR ApcStateIndex
;
1196 #if (NTDDI_VERSION < NTDDI_LONGHORN) // [
1197 UCHAR IdealProcessor
;
1199 BOOLEAN ProcessReadyQueue
;
1204 BOOLEAN KernelStackResident
;
1207 SCHAR PriorityDecrement
;
1208 #if (NTDDI_VERSION >= NTDDI_LONGHORN) // [
1211 CHAR AdjustIncrement
;
1212 #if (NTDDI_VERSION >= NTDDI_WIN7)
1219 #if (NTDDI_VERSION >= NTDDI_LONGHORN) // [
1220 ULONG SystemCallNumber
;
1221 #if (NTDDI_VERSION >= NTDDI_WIN7) // [
1227 #if (NTDDI_VERSION >= NTDDI_WIN7) // [
1228 GROUP_AFFINITY UserAffinity
;
1229 struct _KPROCESS
*Process
;
1230 GROUP_AFFINITY Affinity
;
1231 ULONG IdealProcessor
;
1232 ULONG UserIdealProcessor
;
1234 KAFFINITY UserAffinity
;
1235 struct _KPROCESS
*Process
;
1238 PKAPC_STATE ApcStatePointer
[2];
1241 KAPC_STATE SavedApcState
;
1244 UCHAR SavedApcStateFill
[FIELD_OFFSET(KAPC_STATE
, UserApcPending
) + 1];
1245 #if (NTDDI_VERSION >= NTDDI_WIN7) // [
1255 #if (NTDDI_VERSION >= NTDDI_WIN7) // [
1258 UCHAR UserIdealProcessor
;
1260 #if (NTDDI_VERSION >= NTDDI_WIN7) // [
1261 #elif (NTDDI_VERSION >= NTDDI_LONGHORN) // ][
1264 UCHAR CalloutActive
;
1267 UCHAR CodePatchInProgress
;
1271 #if defined(_M_IX86) // [
1272 #if (NTDDI_VERSION >= NTDDI_LONGHORN) // [
1273 UCHAR OtherPlatformFill
;
1285 UCHAR SuspendApcFill0
[1];
1286 #if (NTDDI_VERSION >= NTDDI_WIN7) // [
1287 UCHAR ResourceIndex
;
1288 #elif (NTDDI_VERSION >= NTDDI_LONGHORN) // ][
1296 UCHAR SuspendApcFill1
[3];
1301 UCHAR SuspendApcFill2
[4];
1306 UCHAR SuspendApcFill3
[FIELD_OFFSET(KAPC
, SystemArgument1
)];
1307 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
1315 UCHAR SuspendApcFill4
[FIELD_OFFSET(KAPC
, SystemArgument2
)]; // 40 / 72
1320 UCHAR SuspendApcFill5
[FIELD_OFFSET(KAPC
, Inserted
) + 1]; // 47 / 83
1321 #if (NTDDI_VERSION >= NTDDI_WIN7) // [
1336 KSEMAPHORE SuspendSemaphore
;
1339 UCHAR SuspendSemaphorefill
[FIELD_OFFSET(KSEMAPHORE
, Limit
) + 4]; // 20 / 28
1341 ULONG SListFaultCount
;
1346 ULONG SListFaultCount
;
1348 LIST_ENTRY ThreadListEntry
;
1349 #if (NTDDI_VERSION >= NTDDI_LONGHORN) // [
1350 LIST_ENTRY MutantListHead
;
1352 PVOID SListFaultAddress
;
1353 #ifdef _M_AMD64 // [
1354 LONG64 ReadOperationCount
;
1355 LONG64 WriteOperationCount
;
1356 LONG64 OtherOperationCount
;
1357 LONG64 ReadTransferCount
;
1358 LONG64 WriteTransferCount
;
1359 LONG64 OtherTransferCount
;
1361 #if (NTDDI_VERSION >= NTDDI_WIN7) // [
1362 PKTHREAD_COUNTERS ThreadCounters
;
1363 PXSTATE_SAVE XStateSave
;
1364 #elif (NTDDI_VERSION >= NTDDI_LONGHORN) // ][
1365 PVOID MdlForLockedTeb
;
1369 #define ASSERT_THREAD(object) \
1370 ASSERT((((object)->Header.Type & KOBJECT_TYPE_MASK) == ThreadObject))
1373 // Kernel Process (KPROCESS)
1375 typedef struct _KPROCESS
1377 DISPATCHER_HEADER Header
;
1378 LIST_ENTRY ProfileListHead
;
1379 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
1380 ULONG_PTR DirectoryTableBase
;
1383 ULONG_PTR DirectoryTableBase
[2];
1385 #if defined(_M_IX86)
1386 KGDTENTRY LdtDescriptor
;
1387 KIDTENTRY Int21Descriptor
;
1390 #if defined(_M_IX86)
1394 volatile ULONG ActiveProcessors
;
1397 LIST_ENTRY ReadyListHead
;
1398 SINGLE_LIST_ENTRY SwapListEntry
;
1399 PVOID VdmTrapcHandler
;
1400 LIST_ENTRY ThreadListHead
;
1401 KSPIN_LOCK ProcessLock
;
1407 LONG AutoAlignment
:1;
1408 LONG DisableBoost
:1;
1409 LONG DisableQuantum
:1;
1410 LONG ReservedFlags
:29;
1423 KEXECUTE_OPTIONS Flags
;
1424 UCHAR ExecuteOptions
;
1427 LIST_ENTRY ProcessListEntry
;
1428 #if (NTDDI_VERSION >= NTDDI_LONGHORN) // [
1429 ULONGLONG CycleTime
;
1433 #define ASSERT_PROCESS(object) \
1434 ASSERT((((object)->Header.Type & KOBJECT_TYPE_MASK) == ProcessObject))
1437 // System Service Table Descriptor
1439 typedef struct _KSERVICE_TABLE_DESCRIPTOR
1445 LONG TableBaseGpOffset
;
1448 } KSERVICE_TABLE_DESCRIPTOR
, *PKSERVICE_TABLE_DESCRIPTOR
;
1450 #if (NTDDI_VERSION >= NTDDI_WIN8)
1452 // Entropy Timing State
1454 typedef struct _KENTROPY_TIMING_STATE
1459 ULONG LastDeliveredBuffer
;
1460 PULONG RawDataBuffer
;
1461 } KENTROPY_TIMING_STATE
, *PKENTROPY_TIMING_STATE
;
1464 // Constants from ks386.inc, ksamd64.inc and ksarm.h
1466 #define KENTROPY_TIMING_INTERRUPTS_PER_BUFFER 0x400
1467 #define KENTROPY_TIMING_BUFFER_MASK 0x7ff
1468 #define KENTROPY_TIMING_ANALYSIS 0x0
1470 #endif /* (NTDDI_VERSION >= NTDDI_WIN8) */
1473 // Exported Loader Parameter Block
1475 extern struct _LOADER_PARAMETER_BLOCK NTSYSAPI
*KeLoaderBlock
;
1478 // Exported Hardware Data
1480 extern KAFFINITY NTSYSAPI KeActiveProcessors
;
1481 #if (NTDDI_VERSION >= NTDDI_LONGHORN)
1482 extern volatile CCHAR NTSYSAPI KeNumberProcessors
;
1484 #if (NTDDI_VERSION >= NTDDI_WINXP)
1485 extern CCHAR NTSYSAPI KeNumberProcessors
;
1487 //extern PCCHAR KeNumberProcessors;
1488 extern NTSYSAPI CCHAR KeNumberProcessors
; //FIXME: Note to Alex: I won't fix this atm, since I prefer to discuss this with you first.
1491 extern ULONG NTSYSAPI KiDmaIoCoherency
;
1492 extern ULONG NTSYSAPI KeMaximumIncrement
;
1493 extern ULONG NTSYSAPI KeMinimumIncrement
;
1494 extern ULONG NTSYSAPI KeDcacheFlushCount
;
1495 extern ULONG NTSYSAPI KeIcacheFlushCount
;
1496 extern ULONG_PTR NTSYSAPI KiBugCheckData
[];
1497 extern BOOLEAN NTSYSAPI KiEnableTimerWatchdog
;
1500 // Exported System Service Descriptor Tables
1502 extern KSERVICE_TABLE_DESCRIPTOR NTSYSAPI KeServiceDescriptorTable
[SSDT_MAX_ENTRIES
];
1503 extern KSERVICE_TABLE_DESCRIPTOR NTSYSAPI KeServiceDescriptorTableShadow
[SSDT_MAX_ENTRIES
];
1505 #endif // !NTOS_MODE_USER
1507 #endif // _KETYPES_H