Geoff Chappell - Software Analyst
The HviGetDebugDeviceOptions function reads a Microsoft hypervisor’s model-specific register 0x400000FF.
VOID HviGetDebugDeviceOptions (ULONGLONG *);
The one argument provides the address at which to receive the 64-bit contents of the register.
The HviGetDebugDeviceOptions function is exported by name from the kernel in version 10.0 and higher.
The HviGetDebugDeviceOptions function is not documented. Neither is 0x400000FF among the synthetic MSRs that Microsoft documents in the Hypervisor Top-Level Functional Specification (TLFS) of Microsoft’s hypervisor.
If a hypervisor is present and its vendor is “Microsoft Hv”—see HviIsHypervisorVendorMicrosoft—the function reads the Model-Specific Register (MSR) 0x400000FF to the given address.
Otherwise, the function sets 0 at the given address. This, in effect, is the function’s indication of failure.
The only known caller of this function at the time of its introduction, i.e., in the original Windows 10, is the 64-bit KDNET.DLL. It tests only for bit 2 and only then if the DebugRegsAvailable flag is set in the HV_X64_HYPERVISOR_FEATURES that are loaded from cpuid leaf 0x40000003. Except for this brief aide memoire, this topic of what the debug device options can mean is left to future research.