platform/kvm: enable User-Mode Instruction Prevention (UMIP)

This causes SGDT, SIDT, SLDT, SMSW, and STR to raise a #GP exception when
executed from CPL > 0.

PiperOrigin-RevId: 715944097

pkg/ring0/kernel_amd64.go

@@ -202,6 +202,9 @@ func (c *CPU) CR4() uint64 {
 	if hasFSGSBASE {
 		cr4 |= _CR4_FSGSBASE
 	}
+	if hasUMIP {
+		cr4 |= _CR4_UMIP
+	}
 	return cr4
 }
 

pkg/ring0/lib_amd64.go

@@ -83,6 +83,7 @@ func rdmsr(reg uintptr) uintptr
 var (
 	hasSMEP       bool
 	hasSMAP       bool
+	hasUMIP       bool
 	hasPCID       bool
 	hasXSAVEOPT   bool
 	hasXSAVE      bool
@@ -113,6 +114,7 @@ func Init(fs cpuid.FeatureSet) {
 	// Initialize all functions.
 	hasSMEP = fs.HasFeature(cpuid.X86FeatureSMEP)
 	hasSMAP = fs.HasFeature(cpuid.X86FeatureSMAP)
+	hasUMIP = fs.HasFeature(cpuid.X86FeatureUMIP)
 	hasPCID = fs.HasFeature(cpuid.X86FeaturePCID)
 	hasXSAVEOPT = fs.UseXsaveopt()
 	hasXSAVE = fs.UseXsave()

pkg/ring0/x86.go

@@ -30,6 +30,7 @@ const (
 	_CR4_PGE        = 1 << 7
 	_CR4_OSFXSR     = 1 << 9
 	_CR4_OSXMMEXCPT = 1 << 10
+	_CR4_UMIP       = 1 << 11
 	_CR4_FSGSBASE   = 1 << 16
 	_CR4_PCIDE      = 1 << 17
 	_CR4_OSXSAVE    = 1 << 18