Geoff Chappell - Software Analyst
The HV_IMPLEMENTATION_LIMITS structure (formally _HV_IMPLEMENTATION_LIMITS) collects the information that a hypervisor’s cpuid leaf 0x40000005 produces in the eax, ebx, ecx and edx registers.
The HV_IMPLEMENTATION_LIMITS is defined in version 6.3 and higher, having developed from what had been an unnamed structure that versions 6.0 to 6.2 define for the MsHvImplementationLimits member of the HV_CPUID_RESULT union.
The kernel provides two ways to get the whole output from cpuid leaf 0x40000005 into a caller-supplied HV_IMPLEMENTATION_LIMITS:
Both are available only in version 10.0 or higher.
The HV_IMPLEMENTATION_LIMITS structure itself is not documented. Some of its members, having previously been defined in the HV_CPUID_RESULT, are documented in the Windows Driver Kit (WDK) for Windows 7, which also provided a C-language definition (of the structure’s unnamed ancestor) in the HVGDK.H header file. Except that documentation continued to a separately downloadable package for merging into Visual Studio 2012, later kits have neither the documentation nor the header.
The structure anyway repackages material that Microsoft does document—or represents as documented—in the Hypervisor Top-Level Functional Specification (TLFS). If the structure or its members’ previous definitions have become undocumented, it may be just that Microsoft regards the structure as no more than a convenience for Microsoft’s own programming in the loader and kernel, if not in the hypervisor itself.
The HV_IMPLEMENTATION_LIMITS is 0x10 bytes in both 32-bit and 64-bit Windows.
Offsets and definitions below are from type information in symbol files for the kernel in Windows 8.1 (only) and for URLMON.DLL in Windows 8.1 through to the 1709 release of Windows 10. Well might you wonder what URLMON.DLL has to do with the hypervisor such that its symbol files have type information for this structure but the kernel’s don’t! Offsets and definitions for later versions, presently up to and including Version 2004, are checked against type information in a statically linked library named KDHV.LIB which Microsoft distributes with programming samples in the Debugging Tools for Windows.
Also checked are earlier versions for which the HV_IMPLEMENTATION_LIMITS was not yet a named structure. Offsets, names and types are from (in roughly decreasing order of forensic quality): the C-language definition of the HV_CPUID_RESULT in the WDK for Windows 7; type information in symbol files for URLMON.DLL for Windows 8; and type information in the (32-bit) statically linked library CLFSMGMT.LIB from the Software Development Kit (SDK) for Windows Vista.
|6.0 and higher|
|6.0 and higher|
|6.0 to 6.1|
|6.2 and higher|
|6.0 to 6.3|
|10.0 and higher|
Version numbers before 6.3 refer to prior appearance in the MsHvImplementationLimits member of the HV_CPUID_RESULT.