In nested SVM, the sub-features of SVM are all part of CPUID, so we already have a user-space interface (KVM_GET_SUPPORTED_CPUID/KVM_SET_CPUID2) to set a guest's features - which is, for example, useful for dictating a fixed set of features across different hosts.

However, in nested VMX, the VMX sub-features offered or not to the guest are not in CPUID, but rather in MSRs, and currently the nested_vmx_setup_ctls_msrs() function determines their value - without any option for user space to control this. We need some sort of new KVM_SET_READONLY_MSRS ioctl for overriding  (downgrading) nested_vmx_setup_ctls_msrs()'s decisions for a particular guest.