What were you trying to do that didn't work?

As subject

Please provide the package NVR for which bug is seen:

host cpu: Intel(R) Xeon(R) Silver 4210R CPU @ 2.40GHz

qemu-kvm-8.2.0-2.el9.x86_64

libvirt-10.0.0-1.el9.x86_64

How reproducible:

100%

Steps to reproduce

1. Create the domain with the cpu mode='host-passthrough' check='full':

XML:

<domain type='kvm'>

...

  <cpu mode='host-passthrough' check='full'/>

...

</domain>

virsh create /tmp/avocado-vt-vm1.xml
error: Failed to create domain from /tmp/avocado-vt-vm1.xml
error: operation failed: guest CPU doesn't match specification: missing features: pku

However, it works when check='full'. And the pku flag is in the guest cpu flags.

virsh create /tmp/avocado-vt-vm1__none.xml --console 
Domain 'avocado-vt-vm1' created from /tmp/avocado-vt-vm1__none.xml
Connected to domain 'avocado-vt-vm1'

(guest) lscpu|grep pku
Flags:                              fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush mmx fxsr sse sse2 ss syscall nx pdpe1gb rdtscp lm constant_tsc ar
ch_perfmon rep_good nopl xtopology cpuid tsc_known_freq pni pclmulqdq vmx ssse3 fma cx16 pdcm pcid sse4_1 sse4_2 x2apic movbe popcnt tsc_deadline_timer aes xsave avx f16c rdrand hypervisor lahf_lm abm 3dnowprefetch cpuid_fault invpcid_single ssbd ibrs ibpb stibp ibrs_enhanced tpr_shadow flexpriority ept vpid ept_ad fsgsbase tsc_adjust bmi1 avx2 smep bmi2 erms 
invpcid mpx avx512f avx512dq rdseed adx smap clflushopt clwb avx512cd avx512bw avx512vl xsaveopt xsavec xgetbv1 xsaves arat vnmi umip pku ospke avx512_vnni md_clear flush_l1d arch_capabilities

Expected results

VM created without error

Actual results

As above

More info:

• Reproduced with qemu-kvm-8.0.0-16.el9_3.3.x86_64.rpm and libvirt-9.5.0-6.el9

• The domain XML and virtqemud log

bug-pku.tar.xz