HAL_PLATFORM_TIMER_SOURCE

The HAL_PLATFORM_TIMER_SOURCE (formally _HAL_PLATFORM_TIMER_SOURCE) is an enumeration that the HAL uses to tell the kernel something of what hardware is the source of two important measures of time. Its values persist most noticeably in the TRACE_LOGFILE_HEADER near the start of every kernel-mode Event Trace Log (ETL) file.

The kernel learns of the two timer sources by querying the HAL through the HalQuerySystemInformation pointer in the HAL_DISPATCH, giving HalPlatformTimerInformation as the HAL_QUERY_INFORMATION_CLASS. This fills a HAL_PLATFORM_TIMER_INFORMATION whose ClockInterruptSource and PerformanceCounterSource are each a HAL_PLATFORM_TIMER_SOURCE.

The information class HalPlatformTimerInformation was introduced for Windows 7. The kernel’s one known use of it is to record the sources in the TRACE_LOGFILE_HEADER when prepared as the event-specific data for the system event WMI_LOG_TYPE_HEADER (0x0000). Perhaps bizarrely, the sources go into the LoggerName and LogFileName members. In earlier versions, these actually are the addresses of strings

Documentation Status

The HAL_PLATFORM_TIMER_SOURCE enumeration is not documented. The only C-language definition that Microsoft is known to have published is in a header file named NTOSP.H from the original and Version 1511 editions of the Windows Driver Kit (WDK) for Windows 10.

If not for the possibly accidental disclosure of NTOSP.H, then even the existence of the HAL_PLATFORM_TIMER_SOURCE as an enumeration might still be unknown outside Microsoft: no symbol files are known to have type information for this enumeration.

That said, it turns out that type information for the HAL_PLATFORM_TIMER_SOURCE has long been present in relatively plain sight—not in symbol files but in a statically linked library, named CLFSMGMT.LIB, which Microsoft distributes with the Software Development Kit for user-mode programming.

Values

The defined values and Microsoft’s names for them are known from the NTOSP.H for just the two releases of Windows 10. Which earlier and later versions these values are defined for, and whether later versions define more values, is in some sense an open question. Inspection of any HAL tells only of which values are implemented by that HAL, not which values might have been defined for a HAL to report if implementing more types of clock. Type information in statically linked libraries tells of what was defined in whatever headers the library was built with, whenever and however the library was built, which need not match exactly with the operating system the library is said to target. Still, these various sources happen to agree:

Value	Name	Versions
0	HalPlatformTimerNotSpecified	6.1 and higher
1	HalPlatformTimer8254	6.1 and higher
2	HalPlatformTimerRtc	6.1 and higher
3	HalPlatformTimerAcpi	6.1 and higher
4	HalPlatformTimerAcpiBroken	6.1 and higher
5	HalPlatformTimerHpet	6.1 and higher
6	HalPlatformTimerProcessorCounter	6.1 and higher
7	HalPlatformTimerHvReferenceTime	6.1 and higher
8	HalPlatformTimerSfi	6.2 and higher
9	HalPlatformTimerApic	6.2 and higher
10	HalPlatformTimerHvSynthetic	6.2 and higher
11	HalPlatformTimerCustom	6.2 and higher
12	HalPlatformTimerCycleCounter	6.2 and higher
13	HalPlatformTimerGit	6.2 and higher