From daea5b76742c7f999c096fa1009dd46b71e53cbb Mon Sep 17 00:00:00 2001
From: Andrei Vagin <avagin@google.com>
Date: Tue, 25 Jan 2022 23:14:19 -0800
Subject: [PATCH] kvm: Check that VMX and SVM are disabled in guest PCID

PiperOrigin-RevId: 424267563
---
 pkg/sentry/platform/kvm/BUILD             |  1 +
 pkg/sentry/platform/kvm/kvm_amd64_test.go | 17 +++++++++++++++++
 2 files changed, 18 insertions(+)

diff --git a/pkg/sentry/platform/kvm/BUILD b/pkg/sentry/platform/kvm/BUILD
index abdb6c383..b5eccb920 100644
--- a/pkg/sentry/platform/kvm/BUILD
+++ b/pkg/sentry/platform/kvm/BUILD
@@ -131,6 +131,7 @@ go_test(
     ],
     deps = [
         "//pkg/abi/linux",
+        "//pkg/cpuid",
         "//pkg/hostarch",
         "//pkg/memutil",
         "//pkg/ring0",
diff --git a/pkg/sentry/platform/kvm/kvm_amd64_test.go b/pkg/sentry/platform/kvm/kvm_amd64_test.go
index c3fbbdc75..163e0d58e 100644
--- a/pkg/sentry/platform/kvm/kvm_amd64_test.go
+++ b/pkg/sentry/platform/kvm/kvm_amd64_test.go
@@ -21,6 +21,7 @@ import (
 	"testing"
 
 	"gvisor.dev/gvisor/pkg/abi/linux"
+	"gvisor.dev/gvisor/pkg/cpuid"
 	"gvisor.dev/gvisor/pkg/ring0"
 	"gvisor.dev/gvisor/pkg/ring0/pagetables"
 	"gvisor.dev/gvisor/pkg/sentry/arch"
@@ -88,3 +89,19 @@ func TestMXCSR(t *testing.T) {
 		return false
 	})
 }
+
+//go:nosplit
+func nestedVirtIsOn(c *vCPU, fs *cpuid.FeatureSet) bool {
+	bluepill(c)
+	return fs.HasFeature(cpuid.X86FeatureVMX) || fs.HasFeature(cpuid.X86FeatureSVM)
+
+}
+
+func TestKernelCPUID(t *testing.T) {
+	bluepillTest(t, func(c *vCPU) {
+		fs := cpuid.HostFeatureSet()
+		if nestedVirtIsOn(c, &fs) {
+			t.Fatalf("Nested virtualization is enabled")
+		}
+	})
+}