diff --git a/kern/arch/x86/ros/msr-index.h b/kern/arch/x86/ros/msr-index.h
index 0843304..b5773df 100644
--- a/kern/arch/x86/ros/msr-index.h
+++ b/kern/arch/x86/ros/msr-index.h
@@ -457,6 +457,8 @@
 #define MSR_IA32_MISC_ENABLE_IP_PREF_DISABLE	(1ULL << 39)
 
 #define MSR_IA32_TSC_DEADLINE		0x000006E0
+#define MSR_IA32_SPEC_CTRL		0x48
+#define MSR_IA32_PRED_CMD		0x49
 
 /* P4/Xeon+ specific */
 #define MSR_IA32_MCG_EAX		0x00000180
diff --git a/kern/arch/x86/vmm/intel/vmx.c b/kern/arch/x86/vmm/intel/vmx.c
index 28a827c..2e52b03 100644
--- a/kern/arch/x86/vmm/intel/vmx.c
+++ b/kern/arch/x86/vmm/intel/vmx.c
@@ -1316,6 +1316,10 @@
 	__vmx_disable_intercept_for_msr(msr_bitmap, MSR_STAR);
 	__vmx_disable_intercept_for_msr(msr_bitmap, MSR_SFMASK);
 
+	/* If we pretend to be a processor without this cpuid feature, we should
+	 * intercept and inject a GPF. */
+	__vmx_disable_intercept_for_msr(msr_bitmap, MSR_IA32_PRED_CMD);
+
 	/* TODO: this might be dangerous, since they can do more than just read
 	 * the CMOS */
 	__vmx_disable_intercept_for_io(io_bitmap, CMOS_RAM_IDX);