Geoff Chappell, Software Analyst
The HV_HYPERVISOR_SVM_FEATURES structure collects the flags that a Microsoft-compatible hypervisor’s cpuid leaf 0x40000008 produces in the eax, ebx, ecx and edx registers. It is defined for Windows 10, for which the Secure Virtual Mode (SVM) is new.
The HV_HYPERVISOR_SVM_FEATURES structure is not documented. The hypervisor’s cpuid implementation is documented in the Hypervisor Top-Level Functional Specification, which Microsoft provides under the Microsoft Open Specification Promise. What’s offered there today (12th November 2016) as the specification’s most recent version is a PDF that is three years old and extends only to leaf 0x40000006.
The HV_HYPERVISOR_SVM_FEATURES is 0x10 bytes. Names and definitions are from type information in the symbol file for URLMON.DLL in both 32-bit and 64-bit Windows 10.
UINT SvmSupported : 1; // 0x00000001 UINT Reserved0 : 10; UINT MaxPasidSpacePasidCount : 21; // 0xFFFFF800
The kernel reads cpuid leaf 0x40000008 when called through the SvmGetSystemCapabilities member of a HAL_ENLIGHTENMENT_INFORMATION structure such as gets filled by calling through the HalGetEnlightenmentInformation member of the kernel’s HAL_PRIVATE_DISPATCH which is exported as HalPrivateDispatchTable.