Geoff Chappell - Software Analyst
This page lists all the functions and variables that appear in the export directory of any known i386 (x86) or amd64 (x64) build of the Hardware Abstraction Layer (HAL) in Windows. Many have been or still are exported from the HAL for other processor architectures, but x86 and x64 account for very nearly all Windows computers whose users actually do think of and use their computers as computers, in contrast to phones, devices and things. So, only x86 and x64 matter to this study.
Many HAL functions are arguably a private matter between the HAL and the kernel, and would not usefully be documented for programmers outside Microsoft’s few who work on the HAL and kernel. As a quick summary, you may care to know that just under one half of all HAL exports are documented, and the majority of these are documented as reserved or obsolete. Indeed, since Windows 2000 made many of the early functions obsolete, there have been 55 additions to the HAL’s interface but only five are documented for non-Microsoft use.
This page’s table is intended only as a master list. For each name, the table gives just a brief summary of the applicable HAL versions and a colour-coded summary of status with respect to Microsoft’s documentation. Details of an export’s availability and documentation history may be found by looking for the export in other lists, according to its first version as shown here. In the Table of Contents, expand the HAL’s entry for History to get pages on the exports for each version.
Documentation status is summarised by colour coding. (To decode a colour, hover for a tooltip.) (Had the website’s scripts run as expected, then hovering over any colour-coded text would produce a tooltip that shows why the text is coloured.)
Functions that have their own non-trivial documentation are shown with no background colour, this documentation status being completely unremarkable.
Functions that are documented as reserved or obsolete are shaded red or shaded grey, respectively, as quick indications that they are better avoided.
To make an obvious contrast, which is used throughout this website, functions that appear to be completely undocumented are highlighted yellow. If a function is documented now but was not documented in the first contemporaneous Device Driver Kit (DDK), Windows Driver Kit (WDK) or Installable File System (IFS) Kit, then it is shaded yellow to retain some of its previous status.
Many undocumented functions do at least have C-language declarations in one or another header file from the WDK. These are shaded orange. They are not formally documented, nor formally reserved, but neither are they completely undocumented: indeed, history shows they’re often on the way to getting documented. Some undocumented functions aren’t declared in any WDK header now but had declarations disclosed by Microsoft in a “minwin” subdirectory of early editions of the WDK for Windows 10 which seem since to have been withdrawn. These are highlighted orange to indicate that public disclosure even of the declaration was exceptional.
That a function or variable is exported in all versions of the applicable architecture is often some sign of its being fundamental and seems deserving of an easy indication. The shorthand “all” means “3.10 and higher” for the x86 and “5.2 SP1 and higher” for the x64. When clearly limited just to the x64, version 5.2 is treated as beginning with SP1.
More notes follow the table.
The buttons that show immediately below are an experiment at deferring the large table’s presentation until you want it and at letting you select how much of it to see at any one time. You can show all the exports as one table or you can have it separated into categories which you can show and hide individually.
If scripts run as expected, there are buttons here to control the table’s presentation.
| Function | Architecture | Versions |
|---|---|---|
| ExAcquireFastMutex | x86 | 3.50 and higher; also from kernel in 6.2 and higher |
| x64 | see kernel in all | |
| ExReleaseFastMutex | x86 | 3.50 and higher; also from kernel in 6.2 and higher |
| x64 | see kernel in all | |
| ExTryToAcquireFastMutex | x86 | 3.50 and higher; also from kernel in 6.2 and higher |
| x64 | see kernel in all | |
| HalAcpiGetTableEx | 6.2 and higher; also from kernel in 2004 and higher (x64 only) |
|
| HalAcquireDisplayOwnership | all; also from kernel in 2004 and higher (x64 only) |
|
| HalAdjustResourceList | 3.50 and higher; also from kernel in 2004 and higher (x64 only) |
|
| HalAllProcessorsStarted | 3.50 and higher; also from kernel in 2004 and higher (x64 only) |
|
| HalAllocateAdapterChannel | all; also from kernel in 2004 and higher (x64 only) |
|
| HalAllocateCommonBuffer | all; also from kernel in 2004 and higher (x64 only) |
|
| HalAllocateCrashDumpRegisters | 3.50 and higher; also from kernel in 2004 and higher (x64 only) |
|
| HalAllocateHardwareCounters | 6.1 and higher; also from kernel in 2004 and higher (x64 only) |
|
| HalAssignSlotResources | 3.50 and higher; also from kernel in 2004 and higher (x64 only) |
|
| HalBeginSystemInterrupt | x86 | all |
| HalBugCheckSystem | 6.0 and higher; also from kernel in 2004 and higher (x64 only) |
|
| HalCalibratePerformanceCounter | all; also from kernel in 2004 and higher (x64 only) |
|
| HalCallBios | x64 | 5.2 to 6.1 |
| HalClearSoftwareInterrupt | 3.50 and higher; also from kernel in 2004 and higher (x64 only) |
|
| HalConvertDeviceIdtToIrql | 6.0 and higher; also from kernel in 2004 and higher (x64 only) |
|
| HalDisableInterrupt | 6.0 and higher; also from kernel in 2004 and higher (x64 only) |
|
| HalDisableSystemInterrupt | 3.10 to 5.2 | |
| HalDisplayString | all; also from kernel in 2004 and higher (x64 only) |
|
| HalDmaAllocateCrashDumpRegistersEx | 6.2 and higher; also from kernel in 2004 and higher (x64 only) |
|
| HalDmaFreeCrashDumpRegistersEx | 6.2 and higher; also from kernel in 2004 and higher (x64 only) |
|
| HalDynamicProcessorStarted | 6.0 before SP1 | |
| HalEnableInterrupt | 6.0 and higher; also from kernel in 2004 and higher (x64 only) |
|
| HalEnableSystemInterrupt | 3.10 to 5.2 | |
| HalEndSystemInterrupt | x86 | all |
| HalEnumerateEnvironmentVariablesEx | 6.0 and higher; also from kernel in 2004 and higher (x64 only) |
|
| HalEnumerateProcessors | x64 | 6.0 and higher; also from kernel in 2004 and higher |
| x86 | 10.0 and higher | |
| HalFlushCommonBuffer | all; also from kernel in 2004 and higher (x64 only) |
|
| HalFreeCommonBuffer | all; also from kernel in 2004 and higher (x64 only) |
|
| HalFreeHardwareCounters | 6.1 and higher; also from kernel in 2004 and higher (x64 only) |
|
| HalGetAdapter | all; also from kernel in 2004 and higher (x64 only) |
|
| HalGetBusData | all; also from kernel in 2004 and higher (x64 only) |
|
| HalGetBusDataByOffset | 3.50 and higher; also from kernel in 2004 and higher (x64 only) |
|
| HalGetEnvironmentVariable | all; also from kernel in 2004 and higher (x64 only) |
|
| HalGetEnvironmentVariableEx | 6.0 and higher; also from kernel in 2004 and higher (x64 only) |
|
| HalGetInterruptTargetInformation | 6.0 and higher; also from kernel in 2004 and higher (x64 only) |
|
| HalGetInterruptVector | all; also from kernel in 2004 and higher (x64 only) |
|
| HalGetMemoryCachingRequirements | 6.1 and higher; also from kernel in 2004 and higher (x64 only) |
|
| HalGetMessageRoutingInfo | 6.0 and higher; also from kernel in 2004 and higher (x64 only) |
|
| HalGetProcessorIdByNtNumber | 6.0 SP1 and higher; also from kernel in 2004 and higher (x64 only) |
|
| HalGetVectorInput | 6.0 and higher; also from kernel in 2004 and higher (x64 only) |
|
| HalHandleMcheck | x64 | all; also from kernel in 2004 and higher |
| HalHandleNMI | all; also from kernel in 2004 and higher (x64 only) |
|
| HalInitSystem | all; also from kernel in 2004 and higher (x64 only) |
|
| HalInitializeBios | 6.0 and higher; also from kernel in 2004 and higher (x64 only) |
|
| HalInitializeOnResume | 6.0 SP1 and higher; also from kernel in 2004 and higher (x64 only) |
|
| HalInitializeProcessor | all; also from kernel in 2004 and higher (x64 only) |
|
| HalIsHyperThreadingEnabled | x64 | all; also from kernel in 2004 and higher |
| HalMakeBeep | all; also from kernel in 2004 and higher (x64 only) |
|
| HalMcUpdateReadPCIConfig | 6.1 only | |
| HalPerformEndOfInterrupt | x64 | 6.1 and higher; also from kernel in 2004 and higher (x64 only) |
| HalProcessorIdle | 3.50 and higher; also from kernel in 2004 and higher (x64 only) |
|
| HalQueryDisplayParameters | all; also from kernel in 2004 and higher (x64 only) |
|
| HalQueryEnvironmentVariableInfoEx | 6.0 SP1 and higher; also from kernel in 2004 and higher (x64 only) |
|
| HalQueryMaximumProcessorCount | 6.0 SP1 and higher; also from kernel in 2004 and higher (x64 only) |
|
| HalQueryRealTimeClock | all; also from kernel in 2004 and higher (x64 only) |
|
| HalReadDmaCounter | all; also from kernel in 2004 and higher (x64 only) |
|
| HalRegisterDynamicProcessor | 6.0 SP1 and higher; also from kernel in 2004 and higher (x64 only) |
|
| HalRegisterErrataCallbacks | 6.0 and higher; also from kernel in 2004 and higher (x64 only) |
|
| HalReportResourceUsage | all; also from kernel in 2004 and higher (x64 only) |
|
| HalRequestClockInterrupt | 6.1 and higher; also from kernel in 2004 and higher (x64 only) |
|
| HalRequestDeferredRecoveryServiceInterrupt | x64 | 6.1 and higher; also from kernel in 2004 and higher |
| HalRequestIpi | all; also from kernel in 2004 and higher (x64 only) |
|
| HalRequestIpiSpecifyVector | 6.2 and higher; also from kernel in 2004 and higher (x64 only) |
|
| HalRequestSoftwareInterrupt | all; also from kernel in 2004 and higher (x64 only) |
|
| HalReturnToFirmware | all; also from kernel in 2004 and higher (x64 only) |
|
| HalSendNMI | x64 | all; also from kernel in 2004 and higher |
| HalSendSoftwareInterrupt | x64 | all; also from kernel in 2004 and higher |
| x86 | 10.0 and higher | |
| HalSetBusData | 3.50 and higher; also from kernel in 2004 and higher (x64 only) |
|
| HalSetBusDataByOffset | 3.50 and higher; also from kernel in 2004 and higher (x64 only) |
|
| HalSetDisplayParameters | all; also from kernel in 2004 and higher (x64 only) |
|
| HalSetEnvironmentVariable | all; also from kernel in 2004 and higher (x64 only) |
|
| HalSetEnvironmentVariableEx | 6.0 and higher; also from kernel in 2004 and higher (x64 only) |
|
| HalSetProfileInterval | all; also from kernel in 2004 and higher (x64 only) |
|
| HalSetRealTimeClock | all; also from kernel in 2004 and higher (x64 only) |
|
| HalSetTimeIncrement | 3.50 to 6.2 | |
| HalStartDynamicProcessor | 6.0 and higher; also from kernel in 2004 and higher (x64 only) |
|
| HalStartNextProcessor | all; also from kernel in 2004 and higher (x64 only) |
|
| HalStartProfileInterrupt | all; also from kernel in 2004 and higher (x64 only) |
|
| HalStopProfileInterrupt | all; also from kernel in 2004 and higher (x64 only) |
|
| HalSystemVectorDispatchEntry | 4.0 and higher; also from kernel in 2004 and higher (x64 only) |
|
| HalTranslateBusAddress | all; also from kernel in 2004 and higher (x64 only) |
|
| HalWheaUpdateCmciPolicy | 2004 and higher; also from kernel in 2004 and higher (x64 only) |
|
| HalpMcaExceptionHandler | x86 | 2004 and higher |
| IoAssignDriveLetters | 3.10 to 6.0; also from kernel in 5.1 to 6.0 |
|
| IoFlushAdapterBuffers | all; also from kernel in 2004 and higher (x64 only) |
|
| IoFreeAdapterChannel | all; also from kernel in 2004 and higher (x64 only) |
|
| IoFreeMapRegisters | all; also from kernel in 2004 and higher (x64 only) |
|
| IoMapTransfer | all; also from kernel in 2004 and higher (x64 only) |
|
| IoReadPartitionTable | all; also from kernel in 5.1 and higher |
|
| IoSetPartitionInformation | all; also from kernel in 5.1 and higher |
|
| IoWritePartitionTable | all; also from kernel in 5.1 and higher |
|
| KdComPortInUse (data) | all; also from kernel in 2004 and higher (x64 only) |
|
| KdHvComPortInUse (data) | 6.2 and higher; also from kernel in 2004 and higher (x64 only) |
|
| KdPortGetByte | 3.10 to 5.0 | |
| KdPortInitialize | 3.10 to 5.0 | |
| KdPortPollByte | 3.10 to 5.0 | |
| KdPortPutByte | 3.10 to 5.0 | |
| KdPortRestore | 3.10 to 5.0 | |
| KdPortSave | 3.10 to 5.0 | |
| KeAcquireInStackQueuedSpinLock | x86 | 5.1 and higher; also from kernel in 6.2 and higher |
| x64 | see kernel in all | |
| KeAcquireInStackQueuedSpinLockRaiseToSynch | x86 | 5.1 and higher; also from kernel in 6.2 and higher |
| x64 | see kernel in all | |
| KeAcquireQueuedSpinLock | x86 | 5.0 and higher; also from kernel in 6.2 and higher |
| x64 | see kernel in all | |
| KeAcquireQueuedSpinLockRaiseToSynch | x86 | 5.0 and higher; also from kernel in 6.2 and higher |
| x64 | see kernel in all | |
| KeAcquireSpinLock | x86 | all; also from kernel in 6.2 and higher |
| KeAcquireSpinLockRaiseToSynch | x86 | 4.0 and higher; also from kernel in 6.2 and higher |
| x64 | see kernel in all | |
| KeFlushWriteBuffer | all; also from kernel in 2004 and higher (x64 only) |
|
| KeGetCurrentIrql | x86 | all |
| x64 | see kernel in all | |
| KeLowerIrql | x86 | all |
| x64 | see kernel in all | |
| KeQueryPerformanceCounter | all; also from kernel in 2004 and higher (x64 only) |
|
| KeRaiseIrql | x86 | all |
| KeRaiseIrqlToDpcLevel | x86 | 4.0 and higher |
| x64 | see kernel in all | |
| KeRaiseIrqlToSynchLevel | x86 | 4.0 and higher |
| KeReleaseInStackQueuedSpinLock | x86 | 5.1 and higher; also from kernel in 6.2 and higher |
| x64 | see kernel in all | |
| KeReleaseQueuedSpinLock | x86 | 5.0 and higher; also from kernel in 6.2 and higher |
| x64 | see kernel in all | |
| KeReleaseSpinLock | x86 | all; also from kernel in 6.2 and higher |
| x64 | see kernel in all | |
| KeStallExecutionProcessor | all; also from kernel in 2004 and higher (x64 only) |
|
| KeTryToAcquireQueuedSpinLock | x86 | 5.0 and higher; also from kernel in 6.2 and higher |
| x64 | see kernel in all | |
| KeTryToAcquireQueuedSpinLockRaiseToSynch | x86 | 5.0 and higher; also from kernel in 6.2 and higher |
| x64 | see kernel in all | |
| KfAcquireSpinLock | x86 | 3.50 and higher; also from kernel in 6.2 and higher |
| KfLowerIrql | x86 | 3.50 and higher |
| KfRaiseIrql | x86 | 3.50 and higher |
| x64 | see kernel in all | |
| KfReleaseSpinLock | x86 | 3.50 and higher; also from kernel in 6.2 and higher |
| READ_PORT_BUFFER_UCHAR | x86 | all |
| READ_PORT_BUFFER_ULONG | x86 | all |
| READ_PORT_BUFFER_USHORT | x86 | all |
| READ_PORT_UCHAR | x86 | all |
| READ_PORT_ULONG | x86 | all |
| READ_PORT_USHORT | x86 | all |
| WRITE_PORT_BUFFER_UCHAR | x86 | all |
| WRITE_PORT_BUFFER_ULONG | x86 | all |
| WRITE_PORT_BUFFER_USHORT | x86 | all |
| WRITE_PORT_UCHAR | x86 | all |
| WRITE_PORT_ULONG | x86 | all |
| WRITE_PORT_USHORT | x86 | all |
| x86BiosAllocateBuffer | 6.0 and higher; also from kernel in 2004 and higher (x64 only) |
|
| x86BiosCall | 6.0 and higher; also from kernel in 2004 and higher (x64 only) |
|
| x86BiosExecuteInterrupt | x64 | 5.2 only |
| x86BiosFreeBuffer | 6.0 and higher; also from kernel in 2004 and higher (x64 only) |
|
| x86BiosInitializeBiosEx | x64 | 5.2 only |
| x86BiosReadMemory | 6.0 and higher; also from kernel in 2004 and higher (x64 only) |
|
| x86BiosTranslateAddress | x64 | 5.2 only |
| x86BiosWriteMemory | 6.0 and higher; also from kernel in 2004 and higher (x64 only) |
There has been a slow migration of functionality from the HAL to the kernel. Starting with Windows XP, some HAL functions are also exported from the kernel. The overlap of names is indicated below by an “also from kernel” annotation. For details of whether the HAL retains an implementation or merely forwards its export to the kernel, follow the function into the History lists.
The introduction of x64 support brought with it such a rethink of functional division between the kernel and HAL that some of the x86 HAL’s exports never are taken up by the x64 HAL but are instead exported only from the kernel. Since they are not HAL exports, they might be omitted from the table, but to help with cross-referencing they are indicated below by an x64-specific direction to “see kernel”.
The 2004 release of Windows 10 reduces the x64 HAL to a stub. All exports from the x64 HAL for 2004 and higher are also exported from the kernel. They are exported from the HAL only as forwards to the same-named export from the kernel. The x86 HAL is, as yet, unaffected.
Names are reproduced from the export directory of the HAL.DLL executable. All exports from the HAL are by name.
A few exports are of variables rather than functions. They are marked above by the word “data” in parentheses. These notes talk of all as functions, hoping no confusion will be caused by the loose terminology.
Since experience shows that this table is not always read with the knowledge of an advanced programmer, it must be stressed that a function’s presence in the export directory does not mean that the function is implemented non-trivially, let alone that it will work satisfactorily if called. It means just that the function can be imported by other modules, and be called by them, for better or worse. That a function is first exported in some version does not mean that Microsoft supports its use in that version, even if such support is documented for later versions.
The HAL versions shown for each function are inferred from a study of public releases such as I have managed to find on MSDN discs or downloaded from Microsoft’s websites, whether free or requiring what is nowadays called a Visual Studio subscription. My holdings are incomplete, especially for service packs of the earliest versions, and I anyway have no time for (or interest in) examining pre-release builds or post-release fixes, patches and updates. Of necessity then, the table makes what I hope are reasonable assumptions about likely continuity, especially to suppose that a function will exist in future versions or that a function exists in all builds of a version if no counter-example is yet known. If you want more accurate or comprehensive information, try getting it from Microsoft.
The foundation for all comment on Microsoft’s documentation of exported HAL functions is what looks to be Microsoft’s last packaging of WDK documentation to download for offline reference through Visual Studio under the heading “Windows Driver Kit (WDK)”. As this documentation says: “Windows Driver Kit (WDK) 10 is integrated with Microsoft Visual Studio 2015”. The large file, named v2Windows_Development_Windows_Driver_Development_B974_VS_85_en-us_3.mshc, from which this integrated content is drawn appears to be as close as Microsoft now comes to publishing WDK documentation as a self-standing, explicitly dated collection. The file’s last modification date is 6th August 2015, which to my mind means it can reasonably be taken as Microsoft’s definitive offering of documentation for Windows 10 as first released on 29th July 2015.
What I know of any later WDK documentation is whatever I happen to have found at Microsoft’s website in occasional visits for which I can’t summon much commitment. Perhaps there is a better way, perhaps there are still packages to download for integration into Visual Studio, but I never have welcomed downloading the WDK and then having to go hunting for the related documentation.