bool (*xsaves_supported)(void);
        bool (*umip_emulated)(void);
        bool (*pt_supported)(void);
-       bool (*pku_supported)(void);
 
        int (*check_nested_events)(struct kvm_vcpu *vcpu);
        void (*request_immediate_exit)(struct kvm_vcpu *vcpu);
 
 {
        unsigned f_intel_pt = kvm_x86_ops->pt_supported() ? F(INTEL_PT) : 0;
        unsigned f_la57;
-       unsigned f_pku = kvm_x86_ops->pku_supported() ? F(PKU) : 0;
 
        /* cpuid 7.0.ebx */
        const u32 kvm_cpuid_7_0_ebx_x86_features =
                cpuid_entry_mask(entry, CPUID_7_ECX);
                /* Set LA57 based on hardware capability. */
                entry->ecx |= f_la57;
-               entry->ecx |= f_pku;
-               /* PKU is not yet implemented for shadow paging. */
-               if (!tdp_enabled || !boot_cpu_has(X86_FEATURE_OSPKE))
-                       cpuid_entry_clear(entry, X86_FEATURE_PKU);
 
                entry->edx &= kvm_cpuid_7_0_edx_x86_features;
                cpuid_entry_mask(entry, CPUID_7_EDX);
 
        return true;
 }
 
-static bool svm_pku_supported(void)
-{
-       return false;
-}
-
 #define PRE_EX(exit)  { .exit_code = (exit), \
                        .stage = X86_ICPT_PRE_EXCEPT, }
 #define POST_EX(exit) { .exit_code = (exit), \
        .xsaves_supported = svm_xsaves_supported,
        .umip_emulated = svm_umip_emulated,
        .pt_supported = svm_pt_supported,
-       .pku_supported = svm_pku_supported,
 
        .set_supported_cpuid = svm_set_supported_cpuid,
 
 
                SECONDARY_EXEC_DESC;
 }
 
-static inline bool vmx_pku_supported(void)
-{
-       return boot_cpu_has(X86_FEATURE_PKU);
-}
-
 static inline bool cpu_has_vmx_rdtscp(void)
 {
        return vmcs_config.cpu_based_2nd_exec_ctrl &
 
                        cpuid_entry_set(entry, X86_FEATURE_INVPCID);
                if (vmx_umip_emulated())
                        cpuid_entry_set(entry, X86_FEATURE_UMIP);
+
+               /* PKU is not yet implemented for shadow paging. */
+               if (enable_ept && boot_cpu_has(X86_FEATURE_PKU) &&
+                   boot_cpu_has(X86_FEATURE_OSPKE))
+                       cpuid_entry_set(entry, X86_FEATURE_PKU);
                break;
        default:
                break;
        .xsaves_supported = vmx_xsaves_supported,
        .umip_emulated = vmx_umip_emulated,
        .pt_supported = vmx_pt_supported,
-       .pku_supported = vmx_pku_supported,
 
        .request_immediate_exit = vmx_request_immediate_exit,