diff --git a/sdk-api-src/content/winternl/nf-winternl-ntquerysysteminformation.md b/sdk-api-src/content/winternl/nf-winternl-ntquerysysteminformation.md index 73131ef443a..61693099ead 100644 --- a/sdk-api-src/content/winternl/nf-winternl-ntquerysysteminformation.md +++ b/sdk-api-src/content/winternl/nf-winternl-ntquerysysteminformation.md @@ -2,12 +2,12 @@ UID: NF:winternl.NtQuerySystemInformation title: NtQuerySystemInformation function (winternl.h) description: Retrieves the specified system information. -helpviewer_keywords: ["NtQuerySystemInformation","NtQuerySystemInformation function","SYSTEM_BASIC_INFORMATION","SYSTEM_CODEINTEGRITY_INFORMATION","SYSTEM_EXCEPTION_INFORMATION","SYSTEM_INFORMATION_CLASS","SYSTEM_INTERRUPT_INFORMATION","SYSTEM_KERNEL_VA_SHADOW_INFORMATION","SYSTEM_LEAP_SECOND_INFORMATION","SYSTEM_LOOKASIDE_INFORMATION","SYSTEM_PERFORMANCE_INFORMATION","SYSTEM_POLICY_INFORMATION","SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION","SYSTEM_PROCESS_INFORMATION","SYSTEM_QUERY_PERFORMANCE_COUNTER_INFORMATION","SYSTEM_REGISTRY_QUOTA_INFORMATION","SYSTEM_SPECULATION_CONTROL_INFORMATION","SYSTEM_THREAD_INFORMATION","SYSTEM_TIMEOFDAY_INFORMATION","SYSTEM_VHD_BOOT_INFORMATION","SystemBasicInformation","SystemCodeIntegrityInformation","SystemExceptionInformation","SystemInterruptInformation","SystemKernelVaShadowInformation","SystemLeapSecondInformation","SystemLookasideInformation","SystemPerformanceInformation","SystemPolicyInformation","SystemProcessInformation","SystemProcessorPerformanceInformation","SystemQueryPerformanceCounterInformation","SystemRegistryQuotaInformation","SystemSpeculationControlInformation","SystemTimeOfDayInformation","base.ntquerysysteminformation","winternl/NtQuerySystemInformation"] +helpviewer_keywords: ["NtQuerySystemInformation","NtQuerySystemInformation function","SYSTEM_BASIC_INFORMATION","SYSTEM_CODEINTEGRITY_INFORMATION","SYSTEM_EXCEPTION_INFORMATION","SYSTEM_INFORMATION_CLASS","SYSTEM_INTERRUPT_INFORMATION","SYSTEM_KERNEL_VA_SHADOW_INFORMATION","SYSTEM_LEAP_SECOND_INFORMATION","SYSTEM_LOOKASIDE_INFORMATION","SYSTEM_PERFORMANCE_INFORMATION","SYSTEM_PMU_SOURCE_ADD_INFORMATION","SYSTEM_PMU_SOURCE_REMOVE_INFORMATION","SYSTEM_POLICY_INFORMATION","SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION","SYSTEM_PROCESS_INFORMATION","SYSTEM_QUERY_PERFORMANCE_COUNTER_INFORMATION","SYSTEM_REGISTRY_QUOTA_INFORMATION","SYSTEM_SPECULATION_CONTROL_INFORMATION","SYSTEM_THREAD_INFORMATION","SYSTEM_TIMEOFDAY_INFORMATION","SYSTEM_VHD_BOOT_INFORMATION","SystemBasicInformation","SystemCodeIntegrityInformation","SystemExceptionInformation","SystemInterruptInformation","SystemKernelVaShadowInformation","SystemLeapSecondInformation","SystemLookasideInformation","SystemPerformanceInformation","SystemPmuSourceAddInformation","SystemPmuSourceRemoveInformation","SystemPolicyInformation","SystemProcessInformation","SystemProcessorPerformanceInformation","SystemQueryPerformanceCounterInformation","SystemRegistryQuotaInformation","SystemSpeculationControlInformation","SystemTimeOfDayInformation","base.ntquerysysteminformation","winternl/NtQuerySystemInformation"] old-location: base\ntquerysysteminformation.htm tech.root: winprog ms.assetid: 553ec7b9-c5eb-4955-8dc0-f1c06f59fe31 ms.date: 12/05/2018 -ms.keywords: NtQuerySystemInformation, NtQuerySystemInformation function, SYSTEM_BASIC_INFORMATION, SYSTEM_CODEINTEGRITY_INFORMATION, SYSTEM_EXCEPTION_INFORMATION, SYSTEM_INFORMATION_CLASS, SYSTEM_INTERRUPT_INFORMATION, SYSTEM_KERNEL_VA_SHADOW_INFORMATION, SYSTEM_LEAP_SECOND_INFORMATION, SYSTEM_LOOKASIDE_INFORMATION, SYSTEM_PERFORMANCE_INFORMATION, SYSTEM_POLICY_INFORMATION, SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION, SYSTEM_PROCESS_INFORMATION, SYSTEM_QUERY_PERFORMANCE_COUNTER_INFORMATION, SYSTEM_REGISTRY_QUOTA_INFORMATION, SYSTEM_SPECULATION_CONTROL_INFORMATION, SYSTEM_THREAD_INFORMATION, SYSTEM_TIMEOFDAY_INFORMATION, SYSTEM_VHD_BOOT_INFORMATION, SystemBasicInformation, SystemCodeIntegrityInformation, SystemExceptionInformation, SystemInterruptInformation, SystemKernelVaShadowInformation, SystemLeapSecondInformation, SystemLookasideInformation, SystemPerformanceInformation, SystemPolicyInformation, SystemProcessInformation, SystemProcessorPerformanceInformation, SystemQueryPerformanceCounterInformation, SystemRegistryQuotaInformation, SystemSpeculationControlInformation, SystemTimeOfDayInformation, base.ntquerysysteminformation, winternl/NtQuerySystemInformation +ms.keywords: NtQuerySystemInformation, NtQuerySystemInformation function, SYSTEM_BASIC_INFORMATION, SYSTEM_CODEINTEGRITY_INFORMATION, SYSTEM_EXCEPTION_INFORMATION, SYSTEM_INFORMATION_CLASS, SYSTEM_INTERRUPT_INFORMATION, SYSTEM_KERNEL_VA_SHADOW_INFORMATION, SYSTEM_LEAP_SECOND_INFORMATION, SYSTEM_LOOKASIDE_INFORMATION, SYSTEM_PERFORMANCE_INFORMATION, SYSTEM_PMU_SOURCE_ADD_INFORMATION, SYSTEM_PMU_SOURCE_REMOVE_INFORMATION, SYSTEM_POLICY_INFORMATION, SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION, SYSTEM_PROCESS_INFORMATION, SYSTEM_QUERY_PERFORMANCE_COUNTER_INFORMATION, SYSTEM_REGISTRY_QUOTA_INFORMATION, SYSTEM_SPECULATION_CONTROL_INFORMATION, SYSTEM_THREAD_INFORMATION, SYSTEM_TIMEOFDAY_INFORMATION, SYSTEM_VHD_BOOT_INFORMATION, SystemBasicInformation, SystemCodeIntegrityInformation, SystemExceptionInformation, SystemInterruptInformation, SystemKernelVaShadowInformation, SystemLeapSecondInformation, SystemLookasideInformation, SystemPerformanceInformation, SystemPmuSourceAddInformation, SystemPmuSourceRemoveInformation, SystemPolicyInformation, SystemProcessInformation, SystemProcessorPerformanceInformation, SystemQueryPerformanceCounterInformation, SystemRegistryQuotaInformation, SystemSpeculationControlInformation, SystemTimeOfDayInformation, base.ntquerysysteminformation, winternl/NtQuerySystemInformation req.header: winternl.h req.include-header: req.target-type: Windows @@ -120,6 +120,18 @@ used to generate an unpredictable seed for a random number generator. Use the +#### SystemPmuSourceAddInformation + +Accepts a SYSTEM_PMU_SOURCE_ADD_INFORMATION structure that describes a PMU (Performance Monitoring Unit) profile source to add. + + + +#### SystemPmuSourceRemoveInformation + +Accepts a SYSTEM_PMU_SOURCE_REMOVE_INFORMATION structure that identifies a PMU (Performance Monitoring Unit) profile source to remove. + + + #### SystemPolicyInformation Returns policy information in a SYSTEM_POLICY_INFORMATION structure. Use the SLGetWindowsInformation function instead to obtain policy information. @@ -662,6 +674,170 @@ function instead to generate cryptographically random data. +#### SYSTEM_PMU_SOURCE_ADD_INFORMATION + +When the SystemInformationClass parameter is +SystemPmuSourceAddInformation, the buffer pointed to by +the SystemInformation parameter should be large enough +to hold a single SYSTEM_PMU_SOURCE_ADD_INFORMATION structure +having the following layout: + + + +``` syntax +typedef struct _SYSTEM_PMU_SOURCE_ADD_INFORMATION { + union { + struct { + UCHAR PerfEvtEventSelect; + UCHAR PerfEvtUnitSelect; + UCHAR PerfEvtCMask; + UCHAR PerfEvtCInv; + UCHAR PerfEvtAnyThread; + UCHAR PerfEvtEdgeDetect; + } Intel; + struct { + USHORT PerfEvtEventSelect; + UCHAR PerfEvtUnitSelect; + UCHAR PerfEvtCMask; + UCHAR PerfEvtCInv; + UCHAR PerfEvtEdgeDetect; + UCHAR PerfEvtHostGuest; + UCHAR PerfPmuType; + } Amd; + struct { + ULONG PerfEvtType; + BOOLEAN AllowsHalt; + } Arm; + }; + ULONG CpuInfoHierarchy[3]; + ULONG InitialInterval; + BOOLEAN Persist; + WCHAR ProfileSourceDescription[ANYSIZE_ARRAY]; +} SYSTEM_PMU_SOURCE_ADD_INFORMATION, *PSYSTEM_PMU_SOURCE_ADD_INFORMATION; +``` + +The architecture-specific union at the start of the structure contains the PMC (Performance Monitoring Counter) event configuration. The appropriate union member is selected based on the processor architecture. + +The Intel member is used on Intel processors and contains the following fields: + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
FieldMeaning
PerfEvtEventSelectThe PMC event select value.
PerfEvtUnitSelectThe PMC logical unit select value.
PerfEvtCMaskAn optional non-zero counter mask.
PerfEvtCInvAn optional counter mask invert bit.
PerfEvtAnyThreadAn optional AnyThread bit.
PerfEvtEdgeDetectAn optional edge detection bit.
+ +The Amd member is used on AMD processors and contains the following fields: + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
FieldMeaning
PerfEvtEventSelectThe PMC event select value.
PerfEvtUnitSelectThe PMC logical unit select value.
PerfEvtCMaskAn optional non-zero counter mask.
PerfEvtCInvAn optional counter mask invert bit.
PerfEvtEdgeDetectAn optional edge detection bit.
PerfEvtHostGuestAn optional host/guest only bit.
PerfPmuTypeAn optional PMU type of the event.
+ +The Arm member is used on ARM processors and contains the following fields: + + + + + + + + + + + + + + +
FieldMeaning
PerfEvtTypeThe PMC event type.
AllowsHaltToggles profiling across halt states.
+ +The CpuInfoHierarchy member is an array of three ULONG values that identify the target processor microarchitecture. For x86/x64/AMD64 processors, the values represent Family, Model, and Stepping. For ARM/ARM64 processors, the values represent Vendor, Model, and Revision. A value of -1 indicates "Not Specified". + +The InitialInterval member contains the initial sampling interval for the profile source. + +The Persist member indicates whether the profile source should persist across reboots by saving the configuration to the registry. + +The ProfileSourceDescription member contains a variable-length null-terminated Unicode string that provides a human-readable description of the profile source. + + + +#### SYSTEM_PMU_SOURCE_REMOVE_INFORMATION + +When the SystemInformationClass parameter is +SystemPmuSourceRemoveInformation, the buffer pointed to by +the SystemInformation parameter should be large enough +to hold a single SYSTEM_PMU_SOURCE_REMOVE_INFORMATION structure +having the following layout: + + + +``` syntax +typedef struct _SYSTEM_PMU_SOURCE_REMOVE_INFORMATION { + ULONG ProfileSource; + ULONG CpuInfoHierarchy[3]; +} SYSTEM_PMU_SOURCE_REMOVE_INFORMATION, *PSYSTEM_PMU_SOURCE_REMOVE_INFORMATION; +``` + +The ProfileSource member identifies the profile source to remove. + +The CpuInfoHierarchy member is an array of three ULONG values that identify the target processor microarchitecture. For x86/x64/AMD64 processors, the values represent Family, Model, and Stepping. For ARM/ARM64 processors, the values represent Vendor, Model, and Revision. A value of -1 indicates "Not Specified". + + + #### SYSTEM_POLICY_INFORMATION When the SystemInformationClass parameter is