VT系列二：检测是否支持虚拟化

本文只是学习此视频后的一些总结不当之处还请指出

视频作者：小宝来了

视频连接：http://bbs.pediy.com/showthread.php?t=211973

约定：

本文中出现的名词

虚拟机客户机 GUEST 都是被监控的操作系统或应用程序

宿主机 HOST Hypervisor都是指监控虚拟机的“原”操作系统

VMM:当客户机发生退出事件时,进入的就是VMM

VM：当客户机正常运行时就是VM

VMM监控VM

步骤在Intel手册35.1章

1.使用CPUID指令查看CPU信息

需要关注的是ECX(RCX)寄存器

这里只讲x86

返回的ecx是一个

typedefunion
{
struct
{
           unsigned SSE3:1;
           unsigned PCLMULQDQ:1;
           unsigned DTES64:1;
           unsigned MONITOR:1;
           unsigned DS_CPL:1;
           unsigned VMX:1;
           unsigned SMX:1;
           unsigned EIST:1;
           unsigned TM2:1;
           unsigned SSSE3:1;
           unsigned Reserved:22;
};
 
}_CPUID_ECX;

我们需要判断其中VMX位是否为1 是支持VT 否则不支持

2.查看CR0 CR4控制寄存器

CR0寄存器的PE、PG、NE位必须为1

如果不为1 则是在BIOS中没有启用VT

CR4寄存器的VMXE位是否为1

如果为1则说明已经有VT存在了

用到的结构圷：

typedefunion
{
struct
{
           unsigned PE:1;
           unsigned MP:1;
           unsigned EM:1;
           unsigned TS:1;
           unsigned ET:1;
           unsigned NE:1;
           unsigned Reserved_1:10;
           unsigned WP:1;
           unsigned Reserved_2:1;
           unsigned AM:1;
           unsigned Reserved_3:10;
           unsigned NW:1;
           unsigned CD:1;
           unsigned PG:1;
           //unsigned Reserved_64:32;
};
 
}_CR0;
 
typedef union
{
struct{
           unsigned VME:1;
           unsigned PVI:1;
           unsigned TSD:1;
           unsigned DE:1;
           unsigned PSE:1;
           unsigned PAE:1;
           unsigned MCE:1;
           unsigned PGE:1;
           unsigned PCE:1;
           unsigned OSFXSR:1;
           unsigned PSXMMEXCPT:1;
           unsigned UNKONOWN_1:1;             //These are zero
           unsigned UNKONOWN_2:1;             //These are zero
           unsigned VMXE:1;                     //It's zero in normal
           unsigned Reserved:18;             //These are zero
           //unsigned Reserved_64:32;
};
}_CR4;

3.检查MSR寄存器(MSR_IA32_FEATURE_CONTROL)

MSR_IA32_FEATURE_CONTROL的lock位是否为1

如果不为1则VT指令没有开启无法使用某些VT指令

用到的结构如下：

typedefstruct _IA32_FEATURE_CONTROL_MSR
{
unsigned Lock                    :1;              // Bit 0 is the lock bit - cannotbe modified once lock is set
unsigned Reserved1                  :1;              //Undefined
unsigned EnableVmxon   :1;              // Bit 2. Ifthis bit is clear, VMXON causes a general protection exception
unsigned Reserved2                  :29;  //Undefined
unsigned Reserved3                  :32;  //Undefined
 
} IA32_FEATURE_CONTROL_MSR;

代码如下：

#pragma once

#include <ntddk.h>
#include "vtsystem.h"
#include "vtasm.h"


BOOLEAN bCheckCpuSuppert()
{

	//1.执行CPUID

	ULONG uRet_Eax, uRet_Ebx, uRet_Ecx , uRet_Edx;
	_CR0 cr0;
	_CR4 cr4;
	_CPUID_ECX uCpuId_Ecx;
	IA32_FEATURE_CONTROL_MSR msr;

	Asm_CPUID(1, &uRet_Eax, &uRet_Ebx, &uRet_Ecx, &uRet_Edx);

	*((PULONG)&uCpuId_Ecx) = uRet_Ecx;

	if (uCpuId_Ecx.VMX != 1)
	{
		DbgPrint("当前CPU不支持VT!\n");
		return FALSE;
	}


	//2.CR0 CR4

	cr0 = Asm_GetCr0Ex();

	if (cr0.PE != 1 || cr0.PG != 1 || cr0.NE != 1)
	{
		DbgPrint("请在Bios里面设置VT选项!\n");
		return FALSE;
	}

	cr4 = Asm_GetCr4Ex();

	if (cr4.VMXE == 1)
	{
		DbgPrint("已经有VT啦!\n");
		return FALSE;
	}

	//3.Msr
	Asm_ReadMsrEx(MSR_IA32_FEATURE_CONTROL, (PMSR)&msr);

	if (msr.Lock != 1)
	{
		DbgPrint("VT 指令没有锁定!\n");
		return FALSE;
	}

	DbgPrint("当前CPU支持VT!\n");

	return TRUE;
}

下一章将讲退出事件的分发

VT系列二：检测是否支持虚拟化

猜你喜欢