Geoff Chappell - Software Analyst
The HviIsIommuInUse function tells whether the hypervisor is using two particular hardware features that are expected of an I/O Memory Management Unit (IOMMU).
BOOLEAN HviIsIommuInUse (VOID);
The function returns TRUE or FALSE according to whether the features are used.
The HviIsIommuInUse function is exported by name from the kernel in version 10.0 and higher.
There’s a good opportunity that this function—else something very like it for also interpreting hypervisor hardware features—is defined as an inline routine for the version 6.3 kernel but is not used in the binary. Public symbol files for the version 6.3 kernel name HviGetHardwareFeatures as an internal routine but the binary has nothing that fits the name or its later implementation as an exported function. For it to have got into the public symbol files, it must have been seen as used when compiling the source file (ntsym.c) for merging type information into the public symbol file. This use would almost certainly be picked up from an included header, most likely from being called by another inline routine. This caller may have been HviIsIommuInUse as known for Windows 10 but defined in a header as an inline routine. Only if it too had a caller, which apparently it did not, would it be named in public symbol files for the version 6.3 kernel. It’s all speculation, of course, but it is striking that even the most obscure of the Windows 10 Hvi functions can be explained as inline routines that got exported.
The HviIsIommuInUse function is not documented.
If a hypervisor is present and implements cpuid leaf 0x40000006—see HviGetHardwareFeatures—the function returns TRUE if both the DmaRemappingInUse and InterruptRemappingInUse flags are set in the cpuid output.
Otherwise, the function returns FALSE.