"CPUID_7_0_EDX_STIBP": "stibp",
"CPUID_7_0_EDX_TSX_LDTRK": "tsx-ldtrk",
"CPUID_7_0_EDX_AVX512_VP2INTERSECT": "avx512-vp2intersect",
+ "CPUID_7_0_ECX_CET_SHSTK": "cet-ss",
+ "CPUID_7_0_EDX_CET_IBT": "cet-ibt",
"CPUID_7_1_EAX_AMX_FP16": "amx-fp16",
"CPUID_7_1_EAX_AVX512_BF16": "avx512-bf16",
"CPUID_7_1_EAX_AVX_IFMA": "avx-ifma",
"VMX_VM_EXIT_CLEAR_BNDCFGS": "vmx-exit-clear-bndcfgs",
"VMX_VM_EXIT_CLEAR_IA32_RTIT_CTL": "vmx-exit-clear-rtit-ctl",
"VMX_VM_EXIT_LOAD_IA32_PKRS": "vmx-exit-load-pkrs",
+ "VMX_VM_EXIT_SAVE_CET": "vmx-exit-save-cet",
# FEAT_VMX_ENTRY_CTLS
"VMX_VM_ENTRY_LOAD_DEBUG_CONTROLS": "vmx-entry-noload-debugctl",
"VMX_VM_ENTRY_LOAD_BNDCFGS": "vmx-entry-load-bndcfgs",
"VMX_VM_ENTRY_LOAD_IA32_RTIT_CTL": "vmx-entry-load-rtit-ctl",
"VMX_VM_ENTRY_LOAD_IA32_PKRS": "vmx-entry-load-pkrs",
+ "VMX_VM_ENTRY_LOAD_CET": "vmx-entry-load-cet",
# FEAT_VMX_MISC
"MSR_VMX_MISC_STORE_LMA": "vmx-store-lma",
<feature name='avx512vbmi2'>
<cpuid eax_in='0x00000007' ecx_in='0x00000000' ecx='0x00000040'/>
</feature>
+ <feature name='cet-ss'>
+ <cpuid eax_in='0x00000007' ecx_in='0x00000000' ecx='0x00000080'/>
+ </feature>
<feature name='gfni'>
<cpuid eax_in='0x00000007' ecx_in='0x00000000' ecx='0x00000100'/>
</feature>
<feature name='arch-lbr'>
<cpuid eax_in='0x00000007' ecx_in='0x00000000' edx='0x00080000'/>
</feature>
+ <feature name='cet-ibt'>
+ <cpuid eax_in='0x00000007' ecx_in='0x00000000' edx='0x00100000'/>
+ </feature>
<feature name='amx-bf16'>
<cpuid eax_in='0x00000007' ecx_in='0x00000000' edx='0x00400000'/>
</feature>
<feature name='vmx-exit-clear-rtit-ctl'>
<msr index='0x0000048f' edx='0x02000000' eax='0x00000000'/>
</feature>
+ <feature name='vmx-exit-save-cet'>
+ <msr index='0x0000048f' edx='0x10000000' eax='0x00000000'/>
+ </feature>
<feature name='vmx-exit-load-pkrs'>
<msr index='0x0000048f' edx='0x20000000' eax='0x00000000'/>
</feature>
<feature name='vmx-entry-load-rtit-ctl'>
<msr index='0x00000490' edx='0x00040000' eax='0x00000000'/>
</feature>
+ <feature name='vmx-entry-load-cet'>
+ <msr index='0x00000490' edx='0x00100000' eax='0x00000000'/>
+ </feature>
<feature name='vmx-entry-load-pkrs'>
<msr index='0x00000490' edx='0x00400000' eax='0x00000000'/>
</feature>
<!-- Features disabled by QEMU -->
<cpudata arch='x86'>
<cpuid eax_in='0x00000001' ecx_in='0x00' eax='0x00000000' ebx='0x00000000' ecx='0x0800c1dc' edx='0xb0600000'/>
- <cpuid eax_in='0x00000007' ecx_in='0x00' eax='0x00000000' ebx='0x02000000' ecx='0x80000010' edx='0x400c0000'/>
+ <cpuid eax_in='0x00000007' ecx_in='0x00' eax='0x00000000' ebx='0x02000000' ecx='0x80000090' edx='0x401c0000'/>
<cpuid eax_in='0x80000007' ecx_in='0x00' eax='0x00000000' ebx='0x00000000' ecx='0x00000000' edx='0x00000100'/>
<msr index='0xcf' edx='0x00000000' eax='0x00000020'/>
<msr index='0x10a' edx='0x00000000' eax='0x00000100'/>
<feature policy='require' name='pku'/>
<feature policy='require' name='ospke'/>
<feature policy='require' name='waitpkg'/>
+ <feature policy='require' name='cet-ss'/>
<feature policy='require' name='vaes'/>
<feature policy='require' name='vpclmulqdq'/>
<feature policy='require' name='rdpid'/>
<feature policy='require' name='serialize'/>
<feature policy='require' name='pconfig'/>
<feature policy='require' name='arch-lbr'/>
+ <feature policy='require' name='cet-ibt'/>
<feature policy='require' name='stibp'/>
<feature policy='require' name='flush-l1d'/>
<feature policy='require' name='avx-vnni'/>
<feature name='pku'/>
<feature name='ospke'/>
<feature name='waitpkg'/>
+ <feature name='cet-ss'/>
<feature name='gfni'/>
<feature name='vaes'/>
<feature name='vpclmulqdq'/>
<feature name='serialize'/>
<feature name='pconfig'/>
<feature name='arch-lbr'/>
+ <feature name='cet-ibt'/>
<feature name='stibp'/>
<feature name='flush-l1d'/>
<feature name='arch-capabilities'/>
<!-- Features disabled by QEMU -->
<cpudata arch='x86'>
<cpuid eax_in='0x00000001' ecx_in='0x00' eax='0x00000000' ebx='0x00000000' ecx='0x0800c1dc' edx='0xb0600000'/>
- <cpuid eax_in='0x00000007' ecx_in='0x00' eax='0x00000000' ebx='0x02000000' ecx='0x80000010' edx='0x400c0000'/>
+ <cpuid eax_in='0x00000007' ecx_in='0x00' eax='0x00000000' ebx='0x02000000' ecx='0x80000090' edx='0x401c0000'/>
<cpuid eax_in='0x80000007' ecx_in='0x00' eax='0x00000000' ebx='0x00000000' ecx='0x00000000' edx='0x00000100'/>
</cpudata>
<feature policy='require' name='pku'/>
<feature policy='require' name='ospke'/>
<feature policy='require' name='waitpkg'/>
+ <feature policy='require' name='cet-ss'/>
<feature policy='require' name='vaes'/>
<feature policy='require' name='vpclmulqdq'/>
<feature policy='require' name='rdpid'/>
<feature policy='require' name='serialize'/>
<feature policy='require' name='pconfig'/>
<feature policy='require' name='arch-lbr'/>
+ <feature policy='require' name='cet-ibt'/>
<feature policy='require' name='stibp'/>
<feature policy='require' name='flush-l1d'/>
<feature policy='require' name='avx-vnni'/>
<feature name='pku'/>
<feature name='ospke'/>
<feature name='waitpkg'/>
+ <feature name='cet-ss'/>
<feature name='gfni'/>
<feature name='vaes'/>
<feature name='vpclmulqdq'/>
<feature name='serialize'/>
<feature name='pconfig'/>
<feature name='arch-lbr'/>
+ <feature name='cet-ibt'/>
<feature name='stibp'/>
<feature name='flush-l1d'/>
<feature name='arch-capabilities'/>
<!-- Features disabled by QEMU -->
<cpudata arch='x86'>
<cpuid eax_in='0x00000001' ecx_in='0x00' eax='0x00000000' ebx='0x00000000' ecx='0x08000008' edx='0x10000000'/>
- <cpuid eax_in='0x00000007' ecx_in='0x00' eax='0x00000000' ebx='0x00001000' ecx='0x00000010' edx='0x00000000'/>
+ <cpuid eax_in='0x00000007' ecx_in='0x00' eax='0x00000000' ebx='0x00001000' ecx='0x00000090' edx='0x00000000'/>
<cpuid eax_in='0x0000000f' ecx_in='0x01' eax='0x00000000' ebx='0x00000000' ecx='0x00000000' edx='0x00000006'/>
<cpuid eax_in='0x80000001' ecx_in='0x00' eax='0x00000000' ebx='0x00000000' ecx='0x01423408' edx='0x00000000'/>
<cpuid eax_in='0x80000007' ecx_in='0x00' eax='0x00000000' ebx='0x00000003' ecx='0x00000000' edx='0x00000100'/>
<feature policy='require' name='ht'/>
<feature policy='require' name='cmt'/>
<feature policy='require' name='ospke'/>
+ <feature policy='require' name='cet-ss'/>
<feature policy='require' name='vaes'/>
<feature policy='require' name='vpclmulqdq'/>
<feature policy='require' name='mbm_total'/>
<feature name='ht'/>
<feature name='cmt'/>
<feature name='ospke'/>
+ <feature name='cet-ss'/>
<feature name='mbm_total'/>
<feature name='mbm_local'/>
<feature name='cmp_legacy'/>
<!-- Features disabled by QEMU -->
<cpudata arch='x86'>
<cpuid eax_in='0x00000001' ecx_in='0x00' eax='0x00000000' ebx='0x00000000' ecx='0x08000008' edx='0x10000000'/>
- <cpuid eax_in='0x00000007' ecx_in='0x00' eax='0x00000000' ebx='0x00001000' ecx='0x00000010' edx='0x00000000'/>
+ <cpuid eax_in='0x00000007' ecx_in='0x00' eax='0x00000000' ebx='0x00001000' ecx='0x00000090' edx='0x00000000'/>
<cpuid eax_in='0x0000000f' ecx_in='0x01' eax='0x00000000' ebx='0x00000000' ecx='0x00000000' edx='0x00000006'/>
<cpuid eax_in='0x80000001' ecx_in='0x00' eax='0x00000000' ebx='0x00000000' ecx='0x01423408' edx='0x00000000'/>
<cpuid eax_in='0x80000007' ecx_in='0x00' eax='0x00000000' ebx='0x00000000' ecx='0x00000000' edx='0x00000100'/>
<feature policy='require' name='ht'/>
<feature policy='require' name='cmt'/>
<feature policy='require' name='ospke'/>
+ <feature policy='require' name='cet-ss'/>
<feature policy='require' name='flush-l1d'/>
<feature policy='require' name='mbm_total'/>
<feature policy='require' name='mbm_local'/>
<feature name='ht'/>
<feature name='cmt'/>
<feature name='ospke'/>
+ <feature name='cet-ss'/>
<feature name='flush-l1d'/>
<feature name='mbm_total'/>
<feature name='mbm_local'/>
<!-- Features disabled by QEMU -->
<cpudata arch='x86'>
<cpuid eax_in='0x00000001' ecx_in='0x00' eax='0x00000000' ebx='0x00000000' ecx='0x08000008' edx='0x10000000'/>
- <cpuid eax_in='0x00000007' ecx_in='0x00' eax='0x00000000' ebx='0x00001000' ecx='0x01000010' edx='0x00000000'/>
+ <cpuid eax_in='0x00000007' ecx_in='0x00' eax='0x00000000' ebx='0x00001000' ecx='0x01000090' edx='0x00000000'/>
<cpuid eax_in='0x0000000f' ecx_in='0x01' eax='0x00000000' ebx='0x00000000' ecx='0x00000000' edx='0x00000006'/>
<cpuid eax_in='0x80000001' ecx_in='0x00' eax='0x00000000' ebx='0x00000000' ecx='0x01423408' edx='0x00000000'/>
<cpuid eax_in='0x80000007' ecx_in='0x00' eax='0x00000000' ebx='0x00000000' ecx='0x00000000' edx='0x00000100'/>
<feature policy='require' name='tsc_adjust'/>
<feature policy='require' name='cmt'/>
<feature policy='require' name='ospke'/>
+ <feature policy='require' name='cet-ss'/>
<feature policy='require' name='bus-lock-detect'/>
<feature policy='require' name='flush-l1d'/>
<feature policy='require' name='mbm_total'/>
<feature name='pku'/>
<feature name='ospke'/>
<feature name='avx512vbmi2'/>
+ <feature name='cet-ss'/>
<feature name='gfni'/>
<feature name='vaes'/>
<feature name='vpclmulqdq'/>
<!-- Features disabled by QEMU -->
<cpudata arch='x86'>
<cpuid eax_in='0x00000001' ecx_in='0x00' eax='0x00000000' ebx='0x00000000' ecx='0x080441d8' edx='0xb0400000'/>
- <cpuid eax_in='0x00000007' ecx_in='0x00' eax='0x00000000' ebx='0x02001004' ecx='0xc0000010' edx='0x400c0000'/>
+ <cpuid eax_in='0x00000007' ecx_in='0x00' eax='0x00000000' ebx='0x02001004' ecx='0xc0000090' edx='0x401c0000'/>
<cpuid eax_in='0x00000007' ecx_in='0x01' eax='0x00080000' ebx='0x00000000' ecx='0x00000000' edx='0x00000000'/>
<cpuid eax_in='0x0000000f' ecx_in='0x01' eax='0x00000000' ebx='0x00000000' ecx='0x00000000' edx='0x00000006'/>
<cpuid eax_in='0x00000014' ecx_in='0x00' eax='0x00000000' ebx='0x00000000' ecx='0x80000000' edx='0x00000000'/>
<feature policy='require' name='intel-pt'/>
<feature policy='require' name='ospke'/>
<feature policy='require' name='waitpkg'/>
+ <feature policy='require' name='cet-ss'/>
<feature policy='require' name='cldemote'/>
<feature policy='require' name='movdiri'/>
<feature policy='require' name='movdir64b'/>
<feature policy='require' name='md-clear'/>
<feature policy='require' name='pconfig'/>
<feature policy='require' name='arch-lbr'/>
+ <feature policy='require' name='cet-ibt'/>
<feature policy='require' name='stibp'/>
<feature policy='require' name='flush-l1d'/>
<feature policy='require' name='core-capability'/>
<feature name='pku'/>
<feature name='ospke'/>
<feature name='waitpkg'/>
+ <feature name='cet-ss'/>
<feature name='vaes'/>
<feature name='vpclmulqdq'/>
<feature name='rdpid'/>
<feature name='serialize'/>
<feature name='pconfig'/>
<feature name='arch-lbr'/>
+ <feature name='cet-ibt'/>
<feature name='stibp'/>
<feature name='flush-l1d'/>
<feature name='avx-vnni'/>
<!-- Features disabled by QEMU -->
<cpudata arch='x86'>
<cpuid eax_in='0x00000001' ecx_in='0x00' eax='0x00000000' ebx='0x00000000' ecx='0x080441d8' edx='0xb0400000'/>
- <cpuid eax_in='0x00000007' ecx_in='0x00' eax='0x00000000' ebx='0x02001004' ecx='0xc0000010' edx='0x400c0000'/>
+ <cpuid eax_in='0x00000007' ecx_in='0x00' eax='0x00000000' ebx='0x02001004' ecx='0xc0000090' edx='0x401c0000'/>
<cpuid eax_in='0x0000000f' ecx_in='0x01' eax='0x00000000' ebx='0x00000000' ecx='0x00000000' edx='0x00000006'/>
<cpuid eax_in='0x80000007' ecx_in='0x00' eax='0x00000000' ebx='0x00000000' ecx='0x00000000' edx='0x00000100'/>
<msr index='0xcf' edx='0x00000000' eax='0x00000020'/>
<feature policy='require' name='intel-pt'/>
<feature policy='require' name='ospke'/>
<feature policy='require' name='waitpkg'/>
+ <feature policy='require' name='cet-ss'/>
<feature policy='require' name='cldemote'/>
<feature policy='require' name='movdiri'/>
<feature policy='require' name='movdir64b'/>
<feature policy='require' name='md-clear'/>
<feature policy='require' name='pconfig'/>
<feature policy='require' name='arch-lbr'/>
+ <feature policy='require' name='cet-ibt'/>
<feature policy='require' name='stibp'/>
<feature policy='require' name='flush-l1d'/>
<feature policy='require' name='core-capability'/>
<feature name='sha-ni'/>
<feature name='ospke'/>
<feature name='waitpkg'/>
+ <feature name='cet-ss'/>
<feature name='rdpid'/>
<feature name='bus-lock-detect'/>
<feature name='cldemote'/>
<feature name='tsx-ldtrk'/>
<feature name='pconfig'/>
<feature name='arch-lbr'/>
+ <feature name='cet-ibt'/>
<feature name='amx-bf16'/>
<feature name='avx512-fp16'/>
<feature name='amx-tile'/>
<!-- Features disabled by QEMU -->
<cpudata arch='x86'>
<cpuid eax_in='0x00000001' ecx_in='0x00' eax='0x00000000' ebx='0x00000000' ecx='0x080441d0' edx='0xb0400000'/>
- <cpuid eax_in='0x00000007' ecx_in='0x00' eax='0x00000000' ebx='0x02001004' ecx='0xc0000010' edx='0x400c0000'/>
+ <cpuid eax_in='0x00000007' ecx_in='0x00' eax='0x00000000' ebx='0x02001004' ecx='0xc0000090' edx='0x401c0000'/>
<cpuid eax_in='0x0000000f' ecx_in='0x01' eax='0x00000000' ebx='0x00000000' ecx='0x00000000' edx='0x00000006'/>
<cpuid eax_in='0x80000007' ecx_in='0x00' eax='0x00000000' ebx='0x00000000' ecx='0x00000000' edx='0x00000100'/>
<msr index='0xcf' edx='0x00000000' eax='0x00000020'/>
<feature policy='require' name='intel-pt'/>
<feature policy='require' name='ospke'/>
<feature policy='require' name='waitpkg'/>
+ <feature policy='require' name='cet-ss'/>
<feature policy='require' name='cldemote'/>
<feature policy='require' name='movdiri'/>
<feature policy='require' name='movdir64b'/>
<feature policy='require' name='md-clear'/>
<feature policy='require' name='pconfig'/>
<feature policy='require' name='arch-lbr'/>
+ <feature policy='require' name='cet-ibt'/>
<feature policy='require' name='stibp'/>
<feature policy='require' name='flush-l1d'/>
<feature policy='require' name='core-capability'/>
<feature name='sha-ni'/>
<feature name='ospke'/>
<feature name='waitpkg'/>
+ <feature name='cet-ss'/>
<feature name='rdpid'/>
<feature name='bus-lock-detect'/>
<feature name='cldemote'/>
<feature name='tsx-ldtrk'/>
<feature name='pconfig'/>
<feature name='arch-lbr'/>
+ <feature name='cet-ibt'/>
<feature name='avx512-fp16'/>
<feature name='stibp'/>
<feature name='flush-l1d'/>
<!-- Features disabled by QEMU -->
<cpudata arch='x86'>
<cpuid eax_in='0x00000001' ecx_in='0x00' eax='0x00000000' ebx='0x00000000' ecx='0x080441d8' edx='0xb0400000'/>
- <cpuid eax_in='0x00000007' ecx_in='0x00' eax='0x00000000' ebx='0x02003044' ecx='0xc0000010' edx='0x400c0000'/>
+ <cpuid eax_in='0x00000007' ecx_in='0x00' eax='0x00000000' ebx='0x02003044' ecx='0xc0000090' edx='0x401c0000'/>
<cpuid eax_in='0x00000007' ecx_in='0x02' eax='0x00000000' ebx='0x00000000' ecx='0x00000000' edx='0x0000001f'/>
<cpuid eax_in='0x0000000f' ecx_in='0x01' eax='0x00000000' ebx='0x00000000' ecx='0x00000000' edx='0x00000006'/>
<cpuid eax_in='0x80000007' ecx_in='0x00' eax='0x00000000' ebx='0x00000000' ecx='0x00000000' edx='0x00000100'/>
<feature policy='require' name='intel-pt'/>
<feature policy='require' name='ospke'/>
<feature policy='require' name='waitpkg'/>
+ <feature policy='require' name='cet-ss'/>
<feature policy='require' name='cldemote'/>
<feature policy='require' name='movdiri'/>
<feature policy='require' name='movdir64b'/>
<feature policy='require' name='md-clear'/>
<feature policy='require' name='pconfig'/>
<feature policy='require' name='arch-lbr'/>
+ <feature policy='require' name='cet-ibt'/>
<feature policy='require' name='stibp'/>
<feature policy='require' name='flush-l1d'/>
<feature policy='require' name='core-capability'/>
<feature name='sha-ni'/>
<feature name='ospke'/>
<feature name='waitpkg'/>
+ <feature name='cet-ss'/>
<feature name='rdpid'/>
<feature name='bus-lock-detect'/>
<feature name='cldemote'/>
<feature name='tsx-ldtrk'/>
<feature name='pconfig'/>
<feature name='arch-lbr'/>
+ <feature name='cet-ibt'/>
<feature name='amx-bf16'/>
<feature name='avx512-fp16'/>
<feature name='amx-tile'/>
<!-- Features disabled by QEMU -->
<cpudata arch='x86'>
<cpuid eax_in='0x00000001' ecx_in='0x00' eax='0x00000000' ebx='0x00000000' ecx='0x080441d8' edx='0xb0400000'/>
- <cpuid eax_in='0x00000007' ecx_in='0x00' eax='0x00000000' ebx='0x02003040' ecx='0x80000010' edx='0x400c0000'/>
+ <cpuid eax_in='0x00000007' ecx_in='0x00' eax='0x00000000' ebx='0x02003040' ecx='0x80000090' edx='0x401c0000'/>
<cpuid eax_in='0x00000007' ecx_in='0x02' eax='0x00000000' ebx='0x00000000' ecx='0x00000000' edx='0x00000017'/>
<cpuid eax_in='0x0000000f' ecx_in='0x01' eax='0x00000000' ebx='0x00000000' ecx='0x00000000' edx='0x00000006'/>
<cpuid eax_in='0x80000007' ecx_in='0x00' eax='0x00000000' ebx='0x00000000' ecx='0x00000000' edx='0x00000100'/>
<feature policy='require' name='intel-pt'/>
<feature policy='require' name='ospke'/>
<feature policy='require' name='waitpkg'/>
+ <feature policy='require' name='cet-ss'/>
<feature policy='require' name='cldemote'/>
<feature policy='require' name='movdiri'/>
<feature policy='require' name='movdir64b'/>
<feature policy='require' name='md-clear'/>
<feature policy='require' name='pconfig'/>
<feature policy='require' name='arch-lbr'/>
+ <feature policy='require' name='cet-ibt'/>
<feature policy='require' name='stibp'/>
<feature policy='require' name='flush-l1d'/>
<feature policy='require' name='core-capability'/>
<feature name='sha-ni'/>
<feature name='ospke'/>
<feature name='waitpkg'/>
+ <feature name='cet-ss'/>
<feature name='rdpid'/>
<feature name='bus-lock-detect'/>
<feature name='cldemote'/>
<feature name='tsx-ldtrk'/>
<feature name='pconfig'/>
<feature name='arch-lbr'/>
+ <feature name='cet-ibt'/>
<feature name='amx-bf16'/>
<feature name='avx512-fp16'/>
<feature name='amx-tile'/>
<feature policy='require' name='tsc-deadline'/>
<feature policy='require' name='hypervisor'/>
<feature policy='require' name='tsc_adjust'/>
+ <feature policy='require' name='cet-ss'/>
<feature policy='require' name='spec-ctrl'/>
<feature policy='require' name='stibp'/>
<feature policy='require' name='flush-l1d'/>
<feature policy='require' name='tsc-deadline'/>
<feature policy='require' name='hypervisor'/>
<feature policy='require' name='tsc_adjust'/>
+ <feature policy='require' name='cet-ss'/>
<feature policy='require' name='spec-ctrl'/>
<feature policy='require' name='stibp'/>
<feature policy='require' name='flush-l1d'/>
<feature policy='require' name='tsc-deadline'/>
<feature policy='require' name='hypervisor'/>
<feature policy='require' name='tsc_adjust'/>
+ <feature policy='require' name='cet-ss'/>
<feature policy='require' name='spec-ctrl'/>
<feature policy='require' name='stibp'/>
<feature policy='require' name='flush-l1d'/>
<feature policy='require' name='tsc-deadline'/>
<feature policy='require' name='hypervisor'/>
<feature policy='require' name='tsc_adjust'/>
+ <feature policy='require' name='cet-ss'/>
<feature policy='require' name='spec-ctrl'/>
<feature policy='require' name='stibp'/>
<feature policy='require' name='flush-l1d'/>
-object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-QEMUGuest1/master-key.aes"}' \
-machine pc,usb=off,dump-guest-core=off,memory-backend=pc.ram,acpi=off \
-accel kvm \
--cpu EPYC-Turin,x2apic=on,tsc-deadline=on,hypervisor=on,tsc-adjust=on,spec-ctrl=on,stibp=on,flush-l1d=on,ssbd=on,virt-ssbd=on,tsa-sq-no=on,tsa-l1-no=on,pcid=off,rdseed=off,la57=off \
+-cpu EPYC-Turin,x2apic=on,tsc-deadline=on,hypervisor=on,tsc-adjust=on,cet-ss=on,spec-ctrl=on,stibp=on,flush-l1d=on,ssbd=on,virt-ssbd=on,tsa-sq-no=on,tsa-l1-no=on,pcid=off,rdseed=off,la57=off \
-m size=219136k \
-object '{"qom-type":"memory-backend-ram","id":"pc.ram","size":224395264}' \
-overcommit mem-lock=off \
-object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-QEMUGuest1/master-key.aes"}' \
-machine pc,usb=off,dump-guest-core=off,memory-backend=pc.ram,acpi=off \
-accel kvm \
--cpu EPYC-Turin,x2apic=on,tsc-deadline=on,hypervisor=on,tsc-adjust=on,spec-ctrl=on,stibp=on,flush-l1d=on,ssbd=on,virt-ssbd=on,tsa-sq-no=on,tsa-l1-no=on,pcid=off,rdseed=off,la57=off \
+-cpu EPYC-Turin,x2apic=on,tsc-deadline=on,hypervisor=on,tsc-adjust=on,cet-ss=on,spec-ctrl=on,stibp=on,flush-l1d=on,ssbd=on,virt-ssbd=on,tsa-sq-no=on,tsa-l1-no=on,pcid=off,rdseed=off,la57=off \
-m size=219136k \
-object '{"qom-type":"memory-backend-ram","id":"pc.ram","size":224395264}' \
-overcommit mem-lock=off \
-object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-QEMUGuest1/master-key.aes"}' \
-machine pc,usb=off,dump-guest-core=off,memory-backend=pc.ram,acpi=off \
-accel kvm \
--cpu EPYC-Turin,x2apic=on,tsc-deadline=on,hypervisor=on,tsc-adjust=on,spec-ctrl=on,stibp=on,flush-l1d=on,ssbd=on,virt-ssbd=on,tsa-sq-no=on,tsa-l1-no=on,pcid=off,rdseed=off,la57=off,abm=on,ds=on,invtsc=off \
+-cpu EPYC-Turin,x2apic=on,tsc-deadline=on,hypervisor=on,tsc-adjust=on,cet-ss=on,spec-ctrl=on,stibp=on,flush-l1d=on,ssbd=on,virt-ssbd=on,tsa-sq-no=on,tsa-l1-no=on,pcid=off,rdseed=off,la57=off,abm=on,ds=on,invtsc=off \
-m size=219136k \
-object '{"qom-type":"memory-backend-ram","id":"pc.ram","size":224395264}' \
-overcommit mem-lock=off \
-object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-QEMUGuest1/master-key.aes"}' \
-machine q35,usb=off,dump-guest-core=off,memory-backend=pc.ram,acpi=off \
-accel kvm \
--cpu EPYC-Turin,x2apic=on,tsc-deadline=on,hypervisor=on,tsc-adjust=on,spec-ctrl=on,stibp=on,flush-l1d=on,ssbd=on,virt-ssbd=on,tsa-sq-no=on,tsa-l1-no=on,pcid=off,rdseed=off,la57=off \
+-cpu EPYC-Turin,x2apic=on,tsc-deadline=on,hypervisor=on,tsc-adjust=on,cet-ss=on,spec-ctrl=on,stibp=on,flush-l1d=on,ssbd=on,virt-ssbd=on,tsa-sq-no=on,tsa-l1-no=on,pcid=off,rdseed=off,la57=off \
-m size=219136k \
-object '{"qom-type":"memory-backend-ram","id":"pc.ram","size":224395264}' \
-overcommit mem-lock=off \
-object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-QEMUGuest1/master-key.aes"}' \
-machine q35,usb=off,dump-guest-core=off,memory-backend=pc.ram,acpi=off \
-accel kvm \
--cpu EPYC-Turin,x2apic=on,tsc-deadline=on,hypervisor=on,tsc-adjust=on,spec-ctrl=on,stibp=on,flush-l1d=on,ssbd=on,virt-ssbd=on,tsa-sq-no=on,tsa-l1-no=on,pcid=off,rdseed=off,la57=off \
+-cpu EPYC-Turin,x2apic=on,tsc-deadline=on,hypervisor=on,tsc-adjust=on,cet-ss=on,spec-ctrl=on,stibp=on,flush-l1d=on,ssbd=on,virt-ssbd=on,tsa-sq-no=on,tsa-l1-no=on,pcid=off,rdseed=off,la57=off \
-m size=219136k \
-object '{"qom-type":"memory-backend-ram","id":"pc.ram","size":224395264}' \
-overcommit mem-lock=off \
-object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-QEMUGuest1/master-key.aes"}' \
-machine pc,usb=off,dump-guest-core=off,memory-backend=pc.ram,acpi=off \
-accel kvm \
--cpu EPYC-Turin,x2apic=on,tsc-deadline=on,hypervisor=on,tsc-adjust=on,spec-ctrl=on,stibp=on,flush-l1d=on,ssbd=on,virt-ssbd=on,tsa-sq-no=on,tsa-l1-no=on,pcid=off,rdseed=off,la57=off \
+-cpu EPYC-Turin,x2apic=on,tsc-deadline=on,hypervisor=on,tsc-adjust=on,cet-ss=on,spec-ctrl=on,stibp=on,flush-l1d=on,ssbd=on,virt-ssbd=on,tsa-sq-no=on,tsa-l1-no=on,pcid=off,rdseed=off,la57=off \
-m size=219136k \
-object '{"qom-type":"memory-backend-ram","id":"pc.ram","size":224395264}' \
-overcommit mem-lock=off \
-object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-QEMUGuest1/master-key.aes"}' \
-machine pc,usb=off,dump-guest-core=off,memory-backend=pc.ram,acpi=off \
-accel kvm \
--cpu EPYC-Turin,x2apic=on,tsc-deadline=on,hypervisor=on,tsc-adjust=on,spec-ctrl=on,stibp=on,flush-l1d=on,ssbd=on,virt-ssbd=on,tsa-sq-no=on,tsa-l1-no=on,pcid=off,rdseed=off,la57=off \
+-cpu EPYC-Turin,x2apic=on,tsc-deadline=on,hypervisor=on,tsc-adjust=on,cet-ss=on,spec-ctrl=on,stibp=on,flush-l1d=on,ssbd=on,virt-ssbd=on,tsa-sq-no=on,tsa-l1-no=on,pcid=off,rdseed=off,la57=off \
-m size=219136k \
-object '{"qom-type":"memory-backend-ram","id":"pc.ram","size":224395264}' \
-overcommit mem-lock=off \