#ifndef _NTEXAPI_H

// private
/**
 * Decodes secure-kernel speculation mitigations returned by SystemSecureSpeculationControlInformation (213).
 * Flags is the raw first ULONG; the named fields occupy consecutive bits, not overlapping union members.
 * On x64, KeQuerySecureSpeculationInformation accepts at least 4 bytes,
 * clears the supplied output buffer, and populates bits 0-15. It reports ReturnLength == 8
 * even for a successful 4-byte query; additional returned bytes are zero in this implementation.
 * The Ssbs fields describe architecture-specific state; do not infer ARM behavior from x64 results.
 */
typedef union _SECURE_SPECULATION_CONTROL_INFORMATION
{
    ULONG Flags;
    struct
    {
        ULONG KvaShadowSupported : 1;
        ULONG KvaShadowEnabled : 1;
        ULONG KvaShadowUserGlobal : 1;
        ULONG KvaShadowPcid : 1;
        ULONG MbClearEnabled : 1;
        ULONG L1TFMitigated : 1; // since 20H2
        ULONG BpbEnabled : 1;
        ULONG IbrsPresent : 1;
        ULONG EnhancedIbrs : 1;
        ULONG StibpPresent : 1;
        ULONG SsbdSupported : 1;
        ULONG SsbdRequired : 1;
        ULONG BpbKernelToUser : 1;
        ULONG BpbUserToKernel : 1;
        ULONG ReturnSpeculate : 1;
        ULONG BranchConfusionSafe : 1;
        ULONG SsbsEnabledAlways : 1; // 24H2
        ULONG SsbsEnabledKernel : 1;
        ULONG Reserved : 14;
    } DUMMYSTRUCTNAME;
} SECURE_SPECULATION_CONTROL_INFORMATION, *PSECURE_SPECULATION_CONTROL_INFORMATION;

#endif
View code on GitHub