From 4394801ae66257972483fa8a2eeb6a503171cf79 Mon Sep 17 00:00:00 2001
From: Andrei Vagin <avagin@google.com>
Date: Wed, 15 Jan 2025 14:20:43 -0800
Subject: [PATCH] platform/kvm: enable User-Mode Instruction Prevention (UMIP)

This causes SGDT, SIDT, SLDT, SMSW, and STR to raise a #GP exception when
executed from CPL > 0.

PiperOrigin-RevId: 715944097
---
 pkg/ring0/kernel_amd64.go | 3 +++
 pkg/ring0/lib_amd64.go    | 2 ++
 pkg/ring0/x86.go          | 1 +
 3 files changed, 6 insertions(+)

diff --git a/pkg/ring0/kernel_amd64.go b/pkg/ring0/kernel_amd64.go
index 1fb6ba6f3..4b8e5aa43 100644
--- a/pkg/ring0/kernel_amd64.go
+++ b/pkg/ring0/kernel_amd64.go
@@ -202,6 +202,9 @@ func (c *CPU) CR4() uint64 {
 	if hasFSGSBASE {
 		cr4 |= _CR4_FSGSBASE
 	}
+	if hasUMIP {
+		cr4 |= _CR4_UMIP
+	}
 	return cr4
 }
 
diff --git a/pkg/ring0/lib_amd64.go b/pkg/ring0/lib_amd64.go
index fe69b6988..f8cdad35e 100644
--- a/pkg/ring0/lib_amd64.go
+++ b/pkg/ring0/lib_amd64.go
@@ -83,6 +83,7 @@ func rdmsr(reg uintptr) uintptr
 var (
 	hasSMEP       bool
 	hasSMAP       bool
+	hasUMIP       bool
 	hasPCID       bool
 	hasXSAVEOPT   bool
 	hasXSAVE      bool
@@ -113,6 +114,7 @@ func Init(fs cpuid.FeatureSet) {
 	// Initialize all functions.
 	hasSMEP = fs.HasFeature(cpuid.X86FeatureSMEP)
 	hasSMAP = fs.HasFeature(cpuid.X86FeatureSMAP)
+	hasUMIP = fs.HasFeature(cpuid.X86FeatureUMIP)
 	hasPCID = fs.HasFeature(cpuid.X86FeaturePCID)
 	hasXSAVEOPT = fs.UseXsaveopt()
 	hasXSAVE = fs.UseXsave()
diff --git a/pkg/ring0/x86.go b/pkg/ring0/x86.go
index bd49f6bed..469c67401 100644
--- a/pkg/ring0/x86.go
+++ b/pkg/ring0/x86.go
@@ -30,6 +30,7 @@ const (
 	_CR4_PGE        = 1 << 7
 	_CR4_OSFXSR     = 1 << 9
 	_CR4_OSXMMEXCPT = 1 << 10
+	_CR4_UMIP       = 1 << 11
 	_CR4_FSGSBASE   = 1 << 16
 	_CR4_PCIDE      = 1 << 17
 	_CR4_OSXSAVE    = 1 << 18