On Fri, May 20, 2022 at 8:33 PM Maciej S. Szmigiero <mail@xxxxxxxxxxxxxxxxxxxxx> wrote: > > From: "Maciej S. Szmigiero" <maciej.szmigiero@xxxxxxxxxx> > > Since KVM commit 5f76f6f5ff96 ("KVM: nVMX: Do not expose MPX VMX controls when guest MPX disabled") > it is not possible to disable MPX on a "-cpu host" just by adding "-mpx" > there if the host CPU does indeed support MPX. > QEMU will fail to set MSR_IA32_VMX_TRUE_{EXIT,ENTRY}_CTLS MSRs in this case > and so trigger an assertion failure. > > Instead, besides "-mpx" one has to explicitly add also > "-vmx-exit-clear-bndcfgs" and "-vmx-entry-load-bndcfgs" to QEMU command > line to make it work, which is a bit convoluted. > > Sanitize MPX-related bits in MSR_IA32_VMX_TRUE_{EXIT,ENTRY}_CTLS after > setting the vCPU CPUID instead so such workarounds are no longer necessary. Can you use feature_dependencies instead? See for example { .from = { FEAT_7_0_EBX, CPUID_7_0_EBX_RDSEED }, .to = { FEAT_VMX_SECONDARY_CTLS, VMX_SECONDARY_EXEC_RDSEED_EXITING }, }, Paolo