kvm: Check that VMX and SVM are disabled in guest PCID

PiperOrigin-RevId: 424267563

pkg/sentry/platform/kvm/BUILD

@@ -131,6 +131,7 @@ go_test(
     ],
     deps = [
         "//pkg/abi/linux",
+        "//pkg/cpuid",
         "//pkg/hostarch",
         "//pkg/memutil",
         "//pkg/ring0",

pkg/sentry/platform/kvm/kvm_amd64_test.go

@@ -21,6 +21,7 @@ import (
 	"testing"
 
 	"gvisor.dev/gvisor/pkg/abi/linux"
+	"gvisor.dev/gvisor/pkg/cpuid"
 	"gvisor.dev/gvisor/pkg/ring0"
 	"gvisor.dev/gvisor/pkg/ring0/pagetables"
 	"gvisor.dev/gvisor/pkg/sentry/arch"
@@ -88,3 +89,19 @@ func TestMXCSR(t *testing.T) {
 		return false
 	})
 }
+
+//go:nosplit
+func nestedVirtIsOn(c *vCPU, fs *cpuid.FeatureSet) bool {
+	bluepill(c)
+	return fs.HasFeature(cpuid.X86FeatureVMX) || fs.HasFeature(cpuid.X86FeatureSVM)
+
+}
+
+func TestKernelCPUID(t *testing.T) {
+	bluepillTest(t, func(c *vCPU) {
+		fs := cpuid.HostFeatureSet()
+		if nestedVirtIsOn(c, &fs) {
+			t.Fatalf("Nested virtualization is enabled")
+		}
+	})
+}