REGISTERED_INTERRUPT_CONTROLLER

The REGISTERED_INTERRUPT_CONTROLLER (formally _REGISTERED_INTERRUPT_CONTROLLER) is the HAL’s abstraction of an interrupt controller.

Documentation Status

The REGISTERED_INTERRUPT_CONTROLLER is not documented. Neither is Microsoft known to have ever published a C-language definition in any Windows Driver Kit (WDK).

The practical equivalent of a C-language definition is available as type information in public symbol files for the HAL, starting with Windows 8. The merging of the HAL into the kernel for the 2004 release of 64-bit Windows moves this type information into the public symbols for the kernel.

Exactly why the public symbols have type information for the REGISTERED_INTERRUPT_CONTROLLER is unclear. That it’s unintended is not impossible. When compiling the separate source file, HALSYM.C, to merge type information into the public symbols for the already built HAL, what the compiler counted as this structure’s use is a reference by pointer—but this pointer type is itself unreferenced. This situation can have been produced by as little as the pointer type’s use in an inline routine or just its appearance in the declaration of an internal routine that is in turn called from an inline routine. On the other hand, HALSYM.C can have used the pointer type explicitly, e.g., by defining a variable of this type. A reason to do this would be that the KDEXTS debugger extension’s !gicr_findapending and !ioapic commands depend on having type information for the REGISTERED_INTERRUPT_CONTROLLER. Intention is hard to gauge. It’s not as if either command is documented—at all, let alone as intended to work for those outside Microsoft who are not blessed with access to private symbols.

Variability

For a structure that looks to be used only within the HAL (not that any effort has yet been put into the looking), the REGISTERED_INTERRUPT_CONTROLLER is remarkably stable. The structure has grown, but only because one sub-structure pushes subsequent members ever further along:

Layout

The sizes in the preceding table and the offsets and definitions in the next are from type information in public symbols as noted above for Windows 8 and higher. Whether the structure even exists in earlier versions is left for another time.

LIST_ENTRY ListEntry;

PVOID InternalData;

ULONG InternalDataSize;

INTERRUPT_FUNCTION_TABLE FunctionTable;

KNOWN_CONTROLLER_TYPE KnownType;

ULONG Capabilities;

ULONG Flags;

ULONG MaxPriority;

ULONG UnitId;

LIST_ENTRY LinesHead;

LIST_ENTRY OutputLinesHead;

LONG MinLine;

LONG MaxLine;

ULONG MaxClusterSize;

ULONG MaxClusters;

ULONG InterruptReplayDataSize;

INTERRUPT_PROBLEM Problem;

NTSTATUS ProblemStatus;

PCSTR ProblemSourceFile;

ULONG ProblemSourceLine;

ULONG CustomProblem;

NTSTATUS CustomProblemStatus;

UNICODE_STRING ResourceId;

POHANDLE PowerHandle;