HAL_PRIVATE_DISPATCH

The HAL_PRIVATE_DISPATCH structure is a table of pointers to optional HAL functionality. The kernel keeps the one instance of this table. It’s in the kernel’s read-write data section and its address is exported as HalPrivateDispatchTable. The table initially has the kernel’s built-in implementations for most (but not all) of the functions. The HAL overrides most. No known HAL overrides all. Functionality that has no meaning to a particular HAL is left to the kernel’s default (and HAL programmers are spared from writing even dummy code for nothing that matters to them). Moreover, since the address is exported, rather than communicated specifically to the HAL, it seems to have been intended all along—whatever might be inferred from the word private—that the functionality is exposed to other kernel-mode modules such as drivers not only for them to call but also to override further.

Though all Windows versions since 3.51 have a HalPrivateDispatchTable in the kernel and have the HAL override at least some functions, no calling of these functions through the table is known until Windows 2000 (which suggests that more research is required on this point). In that version and since, the kernel and the HAL each call through the table, and so do other kernel-mode modules. In Windows 2000, these others are BOOTVID.DLL (which calls through the table) and PCI.SYS (which overrides functionality in the table).

Documentation Status

Both the HAL_PRIVATE_DISPATCH structure and he HalPrivateDispatchTable variable have always been undocumented.

As with many functions, structures can be left without formal documentation but still be known a little from C-language definitions in headers that Microsoft publishes with one or another programming kit. This has happened for the HAL_PRIVATE_DISPATCH in a header named NTOSP.H in the original and Version 1511 editions of the Windows Driver Kit (WDK) for Windows 10. It comes with no conditional compilation blocks for accommodating earlier versions. It is immediately useful only for programming that targets these specific versions of Windows 10, yet doesn’t say so. Add that this header appears under a directory named “um”, surely standing for user mode, even though the definition is meaningful only in kernel mode, and one might wonder if Microsoft disclosed it by mistake.

Many undocumented structures for which Microsoft publishes no C-language definition have the practical equivalent disclosed as type information in the public symbol files that Microsoft distributes to help with debugging. When this article was first prepared in 2016, the HAL_PRIVATE_DISPATCH did not yet have type information in any of Microsoft’s published symbol files for any known Windows version. How it happens that type information for the HAL_PRIVATE_DISPATCH turns up in public symbol files for the kernel in the 1803 release of Windows 10, having escaped such disclosure for most of two decades, I do not yet know, but published it is—and this has continued at least to the 2004 release.

In the other direction, time-wise, type information turns out to have been available from as long ago as Windows Vista—just not in symbol files but instead in a statically linked library, named CLFSMGMT.LIB, which Microsoft distributes with the Software Development Kit (SDK) for user-mode programming. How it has type information for something at the lowest levels of kernel-mode programming is that the library’s few intended object files are compiled with a pre-compiled header that is itself built from a source file such that an object file was produced as output and then got archived into the library. Do this with a pre-compiled header that you throw everything but the kitchen sink into and you risk publishing a library that contains type information for everything but the kitchen sink. Surely an oversight, but published it is.

Also likely as a disclosure by mistake is that where the NTDDK.H file, back as far as the Device Driver Kit (DDK) for Windows 2000, defines types for function pointers in the HAL_DISPATCH structure, it has others that can only be for function pointers in the otherwise unmentioned HAL_PRIVATE_DISPATCH. Thus, for instance, the Windows 2000 DDK defines pHalTranslateBusAddress and the Windows XP DDK defines pKdSetupPciDeviceForDebugging, yet uses them nowhere. They are instead the types for the HalPciTranslateBusAddress and KdSetupPciDeviceForDebugging members of the HAL_PRIVATE_DISPATCH. The information that’s disclosed this way is nowhere near complete and is sometimes fleeting: though the two preceding examples survive into the WDK for Windows 10, the pHalGetVectorInput type disappears betwen the WDKs for Windows Vista and Windows 7. Still, combined with symbols for the implementations in the kernel, the HAL and elsewhere, these type definitions have long sufficed for reverse engineers to make relatively easy and confident work of reconstructing what must be a close approximation to Microsoft’s own (evolving) definition of HAL_PRIVATE_DISPATCH. The structure may not have been defined in public until recently, but it has certainly not been unknown to those who fiddle around in the bowels of kernel-mode Windows. It’s not impossible that some have even used the information constructively (and, sadly, otherwise) in real-world kernel-mode code.

Variability

Part of knowing HAL_PRIVATE_DISPATCH, especially if imagining that you actually do have good cause to contemplate real-world use of it, is to appreciate how susceptible is its layout to change from one build of Windows to another. Being touched by many hands—not just shared between the kernel and HAL but also with bus drivers and others—it is far more stable than is any structure that’s internal to one module. Indeed, of all kernel-mode structures that are both long-lived and undocumented, the HAL_PRIVATE_DISPATCH has some of the best backwards compatibility. Yet it does change, including in ways that break the backwards compatibility.

Versions

If only so that the kernel and HAL can check that they agree on their expectations of the HAL_PRIVATE_DISPATCH, the very first member is a Version number. From the definition in the WDK for Windows 10, one might get the impression that the HAL_PRIVATE_DISPATCH structure accumulated functions in lock step with an increasing Version number, but this would be to misread what Microsoft has disclosed. A comment that “changes to this interface need to be backward-compatible” looks, with access to the historical record, to have been added as a warning, or even as admonishment, after the desired backward-compability had been broken more than a few times. Comments pick up the increasing Version only at 14, by when the changes were indeed more orderly.

The earliest history is a special shambles. Through the first three Windows versions that have the structure, the Version stayed at 1 while functions were not just added but redefined. During the life of the second Version, a function was inserted, thus changing the offsets of others. No third or fourth Version is observed in any formal release, but although Version 5 does extend the structure just by adding members, Version 6 not only adds but redefines, and additions for Version 7 get shifted by later insertions.

The definition in NTOSP.H breaks the member list into blocks for successive Version numbers, but only starting with 14. Whether this is for a late build of version 6.1 or, perhaps more likely, for pre-release development of version 6.2, it does mark the onset of stability. Offsets become reliable because the structure grows only by adding at its end, and functions that fall out of use are not removed but are instead changed to placeholders. Even so, functions do change type and no trace of this remains in Microsoft’s header to alert (even Microsoft’s own) programmers to the variability. Indeed, since functions continue to change type between releases of Windows 10, the header’s comment that “changes to this interface need to be backward-compatible” evidently isn’t heeded.

The following table summarises the correspondence between the Version member and the Windows version, as known from formal releases, giving in each case the size of the structure as a rough guide to its growth. Note that by far the most substantial growth was for Windows 8.

Layout

The detailed layout below combines the “official” definitions from the NTOSP.H in early editions of the WDK for Windows 10 and the public symbol files for later releases of Windows 10 with the completely unofficial, meaning what I can add from old notes and new inspection. For no version before Windows 10 are Microsoft’s names for members known with certainty. The type of function that a member points to can often be deduced either from a known call through the pointer or from a known implementation of the function. Where the type has not changed on the way to Windows 10 I infer that the name has not changed either. Continuity of the name often seems reasonable even if the type has changed (as when arguments are added) and even if the member has moved (because of insertion or removal earlier in the structure). Still, you should understand that this attempt at conveying two decades of missing historical record cannot be perfect.

Original

ULONG Version;

BUS_HANDLER *
(FASTCALL *HalHandlerForBus) (
    INTERFACE_TYPE,
    ULONG);

BUS_HANDLER *
(FASTCALL *HalHandlerForConfigSpace) (
    BUS_DATA_TYPE,
    ULONG);

VOID
(*HalCompleteSlotControl) (
    SLOT_CONTROL_CONTEXT *);

VOID
(*HalCompleteDeviceControl) (
    DEVICE_CONTROL_CONTEXT *);

VOID
(*HalLocateHiberRanges) (
    PVOID);

NTSTATUS
(*HalRegisterBusHandler) (
    INTERFACE_TYPE,
    BUS_DATA_TYPE,
    ULONG,
    INTERFACE_TYPE,
    ULONG,
    ULONG,
    PINSTALL_BUS_HANDLER,
    BUS_HANDLER **);

VOID
(*HalSetWakeEnable) (
    BOOLEAN);

NTSTATUS 
(*HalSuspendHibernateSystem) (
    <unknown-arguments>);

NTSTATUS
(*HalSetWakeAlarm) (
    ULONGLONG,
    TIME_FIELDS *);

NTSTATUS
(*HalSetWakeAlarm) (
    ULONGLONG,
    ULONGLONG);

Appended for Windows 2000

BOOLEAN
(*HalPciTranslateBusAddress) (
    INTERFACE_TYPE,
    ULONG,
    PHYSICAL_ADDRESS,
    ULONG *,
    PHYSICAL_ADDRESS *);

NTSTATUS
(*HalPciAssignSlotResources) ( 
    UNICODE_STRING *,
    UNICODE_STRING *,
    DRIVER_OBJECT *,
    DEVICE_OBJECT *,
    INTERFACE_TYPE,
    ULONG,
    ULONG,
    CM_RESOURCE_LIST **);

VOID
(*HalHaltSystem) (
    VOID);

BOOLEAN
(*HalFindBusAddressTranslation) (
    PHYSICAL_ADDRESS,
    ULONG *,
    PHYSICAL_ADDRESS *,
    ULONG_PTR *,
    BOOLEAN);

BOOLEAN
(*HalResetDisplay) (
    VOID);

Inserted for Windows Server 2003

NTSTATUS
(*HalAllocateMapRegisters) (
    ADAPTER_OBJECT *,
    ULONG,
    ULONG,
    MAP_REGISTER_ENTRY *);

Appended for Windows XP

NTSTATUS
(*KdSetupPciDeviceForDebugging) (
    PVOID,
    DEBUG_DEVICE_DESCRIPTOR *);

NTSTATUS
(*KdReleasePciDeviceForDebugging) (
    DEBUG_DEVICE_DESCRIPTOR *);

PVOID
(*KdGetAcpiTablePhase0) (
    LOADER_PARAMETER_BLOCK *,
    ULONG);

VOID
(*KdCheckPowerButton) (
    VOID);

UCHAR
(*HalVectorToIDTEntry) (
    ULONG);

PVOID
(*KdMapPhysicalMemory64) (
    PHYSICAL_ADDRESS,
    ULONG);

PVOID
(*KdMapPhysicalMemory64) (
    PHYSICAL_ADDRESS,
    ULONG,
    BOOLEAN);

VOID
(*KdUnmapVirtualAddress) (
    PVOID,
    ULONG);

VOID
(*KdUnmapVirtualAddress) (
    PVOID,
    ULONG,
    BOOLEAN);

Appended for Windows Vista

ULONG
(*KdGetPciDataByOffset) (
    ULONG,
    ULONG,
    PVOID,
    ULONG,
    ULONG);

ULONG
(*KdSetPciDataByOffset) (
    ULONG,
    ULONG,
    PVOID,
    ULONG,
    ULONG);

ULONG
(*HalGetInterruptVectorOverride) (
    INTERFACE_TYPE,
    ULONG,
    ULONG,
    ULONG,
    KIRQL *,
    KAFFINITY *);

NTSTATUS
(*HalGetVectorInputOverride) (
    ULONG,
    KAFFINITY,
    ULONG *,
    KINTERRUPT_POLARITY *);

NTSTATUS
(*HalGetVectorInputOverride) (
    ULONG,
    GROUP_AFFINITY *,
    ULONG *,
    KINTERRUPT_POLARITY *,
    INTERRUPT_REMAPPING_INFO *);

NTSTATUS
(*HalLoadMicrocode) (
    PVOID);

NTSTATUS
(*HalUnloadMicrocode) (
    VOID);

NTSTATUS
(*HalPostMicrocodeUpdate) (
    VOID);

Appended for Windows Vista SP1

NTSTATUS
(*HalAllocateMessageTargetOverride) (
    DEVICE_OBJECT *,
    KAFFINITY,
    ULONG,
    KINTERRUPT_MODE,
    BOOLEAN,
    ULONG *,
    KIRQL *,
    ULONG *);

NTSTATUS
(*HalAllocateMessageTargetOverride) (
    DEVICE_OBJECT *,
    GROUP_AFFINITY *,
    ULONG,
    KINTERRUPT_MODE,
    BOOLEAN,
    ULONG *,
    KIRQL *,
    ULONG *);

VOID
(*HalFreeMessageTargetOverride) (
    DEVICE_OBJECT *,
    ULONG,
    KAFFINITY);

VOID
(*HalFreeMessageTargetOverride) (
    DEVICE_OBJECT *,
    ULONG,
    GROUP_AFFINITY *);

NTSTATUS
(*HalDpReplaceBegin) (
    HAL_DP_REPLACE_PARAMETERS *,
    PVOID *);

VOID
(*HalDpReplaceTarget) (
    PVOID);

NTSTATUS
(*HalDpReplaceControl) (
    ULONG,
    PVOID);

VOID
(*HalDpReplaceEnd) (
    PVOID);

VOID
(*HalPrepareForBugcheck) (
    ULONG);

Inserted for Windows 7

NTSTATUS
(*HalQueryWakeTime) (
    ULONGLONG *);

BOOLEAN
(*HalQueryWakeTime) (
    ULONGLONG *,
    ULONGLONG *);

VOID
(*HalReportIdleStateUsage) (
    UCHAR,
    AFFINITY_EX *);

VOID
(*HalTscSynchronization) (
    BOOLEAN,
    ULONG *);

NTSTATUS
(*HalWheaInitProcessorGenericSection) (
    WHEA_ERROR_RECORD_SECTION_DESCRIPTOR *,
    WHEA_PROCESSOR_GENERIC_ERROR_SECTION *);

VOID
(*HalStopLegacyUsbInterrupts) (
    VOID);

VOID
(*HalStopLegacyUsbInterrupts) (
    SYSTEM_POWER_STATE);

Appended for Windows Vista SP2

NTSTATUS
(*HalReadWheaPhysicalMemory) (
    PHYSICAL_ADDRESS,
    ULONG,
    PVOID);

NTSTATUS
(*HalWriteWheaPhysicalMemory) (
    PHYSICAL_ADDRESS,
    ULONG,
    PVOID);

Appended for Windows 7

NTSTATUS
(*HalDpMaskLevelTriggeredInterrupts) (
    VOID);

NTSTATUS
(*HalDpUnmaskLevelTriggeredInterrupts) (
    VOID);

NTSTATUS
(*HalDpGetInterruptReplayState) (
    PVOID,
    PVOID *);

NTSTATUS
(*HalDpReplayInterrupts) (
    PVOID);

BOOLEAN
(*HalQueryIoPortAccessSupported) (
    VOID);

Appended for Windows 8

To go the Version member, the HAL_PRIVATE_DISPATCH was worked on very actively between Windows 7 and Windows 8. The Version is 13 for both the original Windows 7 and the first release of its only service pack, but it’s 21 for the released Windows 8. Comments in the C-language definition from NTOSP.H record the development.

The following were added for Version 14:

NTSTATUS
(*KdSetupIntegratedDeviceForDebugging) (
    PVOID,
    DEBUG_DEVICE_DESCRIPTOR *);

NTSTATUS
(*KdReleaseIntegratedDeviceForDebugging) (
    DEBUG_DEVICE_DESCRIPTOR *);

VOID
(*HalGetEnlightenmentInformation) (
    HAL_INTEL_ENLIGHTENMENT_INFORMATION *);

PVOID
(*HalAllocateEarlyPages) (
    LOADER_PARAMETER_BLOCK *,
    ULONG,
    ULONG64 *,
    ULONG);

PVOID
(*HalMapEarlyPages) (
    ULONG64,
    ULONG,
    ULONG);

ULONG
(*HalGetClockOwner) (
    VOID);

PVOID Dummy1;

VOID
(*HalGetClockConfiguration) (
    ULONG *,
    ULONG *,
    UCHAR *);

PVOID Dummy2;

VOID
(*HalNotifyProcessorFreeze) (
    BOOLEAN);

VOID
(*HalNotifyProcessorFreeze) (
    BOOLEAN,
    BOOLEAN);

NTSTATUS
(*HalPrepareProcessorForIdle) (
    ULONG,
    ULONG,
    ULONG);

NTSTATUS
(*HalPrepareProcessorForIdle) (
    ULONG);

VOID
(*HalRegisterLogRoutine) (
    HAL_LOG_REGISTER_CONTEXT *);

VOID
(*HalResumeProcessorFromIdle) (
    ULONG *);

VOID
(*HalResumeProcessorFromIdle) (
    VOID);

PVOID Dummy;

What is meant by conditional about the default for HalGetEnlightenmentInformation is that the member starts as NULL in the kernel’s HalPrivateDispatchTable but the kernel may set a default while initialising.

The next set were added for Version 15:

ULONG
(*HalVectorToIDTEntryEx) (
    ULONG);

NTSTATUS
(*HalSecondaryInterruptQueryPrimaryInformation) (
    INTERRUPT_VECTOR_DATA *,
    ULONG *);

NTSTATUS
(*HalMaskInterrupt) (
    ULONG,
    ULONG);

NTSTATUS
(*HalUnmaskInterrupt) (
    ULONG,
    ULONG);

BOOLEAN
(*HalIsInterruptTypeSecondary) (
    ULONG,
    ULONG);

NTSTATUS
(*HalAllocateGsivForSecondaryInterrupt) (
    PCHAR,
    USHORT,
    ULONG *);

NTSTATUS
(*HalAddInterruptRemapping) (
    ULONG,
    ULONG,
    PCI_BUSMASTER_DESCRIPTOR *,
    UCHAR,
    INTERRUPT_VECTOR_DATA *,
    ULONG);

VOID
(*HalRemoveInterruptRemapping) (
    ULONG,
    ULONG,
    PCI_BUSMASTER_DESCRIPTOR *,
    UCHAR,
    INTERRUPT_VECTOR_DATA *,
    ULONG);

VOID
(*HalSaveAndDisableHvEnlightenment) (
    VOID);

VOID
(*HalRestoreHvEnlightenment) (
    VOID);

Only two were added for Version 16:

VOID
(*HalFlushIoBuffersExternalCache) (
    MDL *,
    BOOLEAN);

VOID
(*HalFlushExternalCache) (
    BOOLEAN);

The advance was larger for Version 17:

NTSTATUS
(*HalPciEarlyRestore) (
    SYSTEM_POWER_STATE);

NTSTATUS
(*HalGetProcessorId) (
    ULONG,
    ULONG *);

NTSTATUS
(*HalAllocatePmcCounterSet) (
    ULONG,
    KPROFILE_SOURCE *,
    ULONG,
    HAL_PMC_COUNTERS **);

VOID
(*HalCollectPmcCounters) (
    HAL_PMC_COUNTERS *,
    ULONG64 *);

VOID
(*HalFreePmcCounterSet) (
    HAL_PMC_COUNTERS *);

NTSTATUS
(*HalProcessorHalt) (
    ULONG,
    PVOID,
    PPROCESSOR_HALT_ROUTINE);

ULONG
(*HalTimerQueryCycleCounter) (
    ULONGLONG *);

VOID
(*HalGetNextTickDuration) (
    KPRCB *,
    BOOLEAN,
    ULONG,
    ULONG64,
    ULONGLONG *);

PVOID Dummy3;

VOID
(*HalPciMarkHiberPhase) (
    VOID);

NTSTATUS
(*HalQueryProcessorRestartEntryPoint) (
    PHYSICAL_ADDRESS *);

NTSTATUS
(*HalRequestInterrupt) (
    ULONG);

NTSTATUS
(*HalEnumerateUnmaskedInterrupts) (
    PHAL_ENUMERATE_INTERRUPT_SOURCE_CALLBACK,
    PVOID,
    HAL_UNMASKED_INTERRUPT_INFORMATION *);

The additions then seem to have settled as Windows 8 neared release. There are two for Version 18:

VOID
(*HalFlushAndInvalidatePageExternalCache) (
    PHYSICAL_ADDRESS);

NTSTATUS
(*KdEnumerateDebuggingDevices) (
    PVOID,
    DEBUG_DEVICE_DESCRIPTOR *,
    PDEBUG_DEVICE_FOUND_FUNCTION);

Just one for Version 19:

VOID
(*HalFlushIoRectangleExternalCache) (
    MDL *,
    ULONG,
    ULONG,
    ULONG,
    ULONG,
    BOOLEAN);

One more for Version 20:

VOID
(*HalPowerEarlyRestore) (
    ULONG);

Microsoft’s history adds twelve for Version 21, but the original release of Windows 8 has Version 21 and adds only five:

NTSTATUS
(*HalQueryCapsuleCapabilities) (
    PVOID,
    ULONG,
    ULONGLONG *,
    ULONG *);

NTSTATUS
(*HalUpdateCapsule) (
    PVOID,
    ULONG,
    PHYSICAL_ADDRESS);

BOOLEAN
(*HalPciMultiStageResumeCapable) (
    VOID);

VOID
(*HalDmaFreeCrashDumpRegisters) (
    ULONG);

BOOLEAN
(*HalAcpiAoacCapable) (
    VOID);

Appended for Windows 8.1

Although the comments in the NTOSP.H definition places the following members after the “Start of version 21 functions” and before the “Start of version 22 functions”, testing for Version 21 to establish these members’ existence is unsound. Certainly there exist Windows 8 kernels that have Version 21 but do not provide their HalPrivateDispatchTable with space for the following:

NTSTATUS
(*HalInterruptSetDestination) (
    INTERRUPT_CONNECTION_DATA *,
    GROUP_AFFINITY *);

NTSTATUS
(*HalInterruptSetDestination) (
    ULONG,
    INTERRUPT_VECTOR_DATA *,
    GROUP_AFFINITY *);

NTSTATUS
(*HalInterruptSetDestination) (
    INTERRUPT_VECTOR_DATA *,
    GROUP_AFFINITY *,
    ULONG *);

VOID
(*HalGetClockConfiguration) (
    HAL_CLOCK_TIMER_CONFIGURATION *);

VOID
(*HalClockTimerActivate) (
    BOOLEAN);

VOID
(*HalClockTimerInitialize) (
    VOID);

VOID
(*HalClockTimerStop) (
    VOID);

NTSTATUS
(*HalClockTimerArm) (
    HAL_CLOCK_TIMER_MODE,
    ULONG64,
    ULONG64 *);

BOOLEAN
(*HalTimerOnlyClockInterruptPending) (
    VOID);

Added for Version 22:

PVOID
(*HalAcpiGetMultiNode) (
    VOID);

PHALREBOOTHANDLER
(*HalPowerSetRebootHandler) (
    PHALREBOOTHANDLER);

The original release of Windows 8.1 has Version 23. It got six more by then, but see that three have a change of type sooner or later:

VOID
(*HalIommuRegisterDispatchTable) (
    HAL_IOMMU_DISPATCH *);

NTSTATUS
(*HalTimerWatchdogStart) (
    VOID);

VOID 
(*HalTimerWatchdogStart) (
    VOID);

VOID
(*HalTimerWatchdogResetCountdown) (
    VOID);

VOID
(*HalTimerWatchdogResetCountdown) (
    LOGICAL);

VOID
(*HalTimerWatchdogResetCountdown) (
    VOID);

NTSTATUS
(*HalTimerWatchdogStop) (
    VOID);

VOID 
(*HalTimerWatchdogStop) (
    VOID);

BOOLEAN
(*HalTimerWatchdogGeneratedLastReset) (
    VOID);

NTSTATUS
(*HalTimerWatchdogTriggerSystemReset) (
    BOOLEAN);

Appended for Windows 10

The first release of Windows 10 has Version 32, up from 23 for Windows 8.1. Microsoft’s history records that the Version didn’t simply leap ahead, but was incremented for each new member (almost).

Added for Version 24:

NTSTATUS
(*HalInterruptVectorDataToGsiv) (
    INTERRUPT_VECTOR_DATA *,
    ULONG *);

Added for Version 25:

NTSTATUS
(*HalInterruptGetHighestPriorityInterrupt) (
    ULONG *,
    BOOLEAN *);

Added for Version 26:

NTSTATUS
(*HalProcessorOn) (
    ULONG);

NTSTATUS
(*HalProcessorOff) (
    VOID);

Added for Version 27:

NTSTATUS
(*HalProcessorFreeze) (
    VOID);

Added for Version 28:

NTSTATUS
(*HalDmaLinkDeviceObjectByToken) (
    ULONG_PTR,
    DEVICE_OBJECT *);

Added for Version 29:

NTSTATUS
(*HalDmaCheckAdapterToken) (
    ULONG_PTR);

Added for Version 30:

VOID
(*HalPciLateRestore) (
    VOID);

PVOID Dummy4;

NTSTATUS
(*HalTimerConvertPerformanceCounterToAuxiliaryCounter) (
    ULONG64,
    ULONG64 *,
    ULONG64 *);

NTSTATUS
(*HalTimerConvertAuxiliaryCounterToPerformanceCounter) (
    ULONG64,
    ULONG64 *,
    ULONG64 *);

NTSTATUS
(*HalTimerQueryAuxiliaryCounterFrequency) (
    ULONG64 *);

Added for Version 31:

NTSTATUS
(*HalConnectThermalInterrupt) (
    PKSERVICE_ROUTINE);

Added for Version 32:

BOOLEAN
(*HalIsEFIRuntimeActive) (
    VOID);

Appended for Windows 10 Version 1607

BOOLEAN 
(*HalTimerQueryAndResetRtcErrors) (
    BOOLEAN);

VOID 
(*HalAcpiLateRestore) (
    VOID);

NTSTATUS 
(*KdWatchdogDelayExpiration) (
    ULONG64 *);

Appended for Windows 10 Version 1703

NTSTATUS 
(*HalGetProcessorStats) (
    HAL_PROCESSOR_STAT_TYPE, 
    ULONG, 
    ULONG, 
    ULONG_PTR *);

ULONG64 
(*HalTimerWatchdogQueryDueTime) (
    VOID);

NTSTATUS 
(*HalConnectSyntheticInterrupt) (
    PKSERVICE_ROUTINE);

VOID 
(*HalPreprocessNmi) (
    ULONG);

Appended for Windows 10 Version 1709

NTSTATUS 
(*HalEnumerateEnvironmentVariablesWithFilter) (
    ULONG,
    BOOLEAN (*) (GUID const *, PCWSTR), 
    PVOID, 
    ULONG *);

NTSTATUS 
(*HalCaptureLastBranchRecordStack) (
    ULONG, 
    HAL_LBR_ENTRY *, 
    ULONG *);

BOOLEAN 
(*HalClearLastBranchRecordStack) (
    VOID);

NTSTATUS 
(*HalConfigureLastBranchRecord) (
    ULONG, 
    ULONG);

BOOLEAN 
(*HalGetLastBranchInformation) (
    ULONG *, 
    ULONG *);

VOID 
(*HalResumeLastBranchRecord) (
    BOOLEAN);

NTSTATUS 
(*HalStartLastBranchRecord) (
    ULONG, 
    ULONG *);

NTSTATUS 
(*HalStopLastBranchRecord) (
    ULONG);

NTSTATUS 
(*HalIommuBlockDevice) (
    PVOID);

NTSTATUS 
(*HalIommuUnblockDevice) (
    EXT_IOMMU_DEVICE_ID *,
    PVOID *);

Appended for Windows 10 Version 1803

NTSTATUS 
(*HalGetIommuInterface) (
    ULONG,
    DMA_IOMMU_INTERFACE *);

NTSTATUS 
(*HalRequestGenericErrorRecovery) (
    PVOID, 
    ULONG *);

NTSTATUS 
(*HalTimerQueryHostPerformanceCounter) (
    ULONG64 *);

Appended for Windows 10 Version 1809

LONG 
(*HalTopologyQueryProcessorRelationships) (
    ULONG, 
    ULONG, 
    UCHAR *, 
    UCHAR *, 
    UCHAR *, 
    ULONG *, 
    ULONG *);

VOID 
(*HalInitPlatformDebugTriggers) (
    VOID);

VOID 
(*HalRunPlatformDebugTriggers) (
    BOOLEAN);

PVOID 
(*HalTimerGetReferencePage) (
    VOID);

Appended for Windows 10 Version 1903

NTSTATUS 
(*HalGetHiddenProcessorPowerInterface) (
    HIDDEN_PROCESSOR_POWER_INTERFACE *);

ULONG 
(*HalGetHiddenProcessorPackageId) (
    ULONG);

ULONG 
(*HalGetHiddenPackageProcessorCount) (
    ULONG);

NTSTATUS 
(*HalGetHiddenProcessorApicIdByIndex) (
    ULONG, 
    ULONG *);

NTSTATUS 
(*HalRegisterHiddenProcessorIdleState) (
    ULONG, 
    ULONGLONG);

Appended for Windows 10 Version 2004

VOID 
(*HalIommuReportIommuFault) (
    ULONGLONG, 
    FAULT_INFORMATION *);

BOOLEAN 
(*HalIommuDmaRemappingCapable) (
    EXT_IOMMU_DEVICE_ID *, 
    ULONG *);

Function Pointers

All non-obvious types in the preceding table are structures or enumerations except for the following function pointers (all of which are Microsoft’s type definitions from NTOSP.H):

typedef
NTSTATUS
(*PINSTALL_BUS_HANDLER) (
    BUS_HANDLER *);

typedef
NTSTATUS 
(*PPROCESSOR_HALT_ROUTINE) (
    PVOID);
    
typedef
BOOLEAN
(*PHAL_ENUMERATE_INTERRUPT_SOURCE_CALLBACK) (
    PVOID,
    HAL_UNMASKED_INTERRUPT_INFORMATION *);

typedef
KD_CALLBACK_ACTION
(*PDEBUG_DEVICE_FOUND_FUNCTION) (
    DEBUG_DEVICE_DESCRIPTOR *);

typedef
VOID 
(*PHALREBOOTHANDLER) (
    ULONG,
    LONG volatile *);

typedef
BOOLEAN
(*PKSERVICE_ROUTINE) (
    KINTERRUPT *,
    PVOID);

Of course, almost all members of the HAL_PRIVATE_DISPATCH are function pointers, and Microsoft’s NTOSP.H does define types for them too. Those that I use here are just the ones that can be given as arguments: function pointers in function pointers get just a bit too complicated for easy presentation.