CET MSRs include:
MSR_IA32_U_CET - user mode CET control bits.
MSR_IA32_S_CET - supervisor mode CET control bits.
MSR_IA32_PL{0,1,2,3}_SSP - linear addresses of SSPs for user/kernel modes.
MSR_IA32_SSP_TBL_ADDR - linear address of interrupt SSP table
MSR_KVM_GUEST_SSP - current shadow stack pointer

Signed-off-by: Yang Weijiang <weijiang.yang@intel.com>
---
 target/i386/cpu.h     | 18 +++++++++++++
 target/i386/kvm/kvm.c | 59 +++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 77 insertions(+)

diff --git a/target/i386/cpu.h b/target/i386/cpu.h
index 06855e0926..ef1f3d6138 100644
--- a/target/i386/cpu.h
+++ b/target/i386/cpu.h
@@ -545,6 +545,15 @@ typedef enum X86Seg {
 #define MSR_IA32_VMX_TRUE_ENTRY_CTLS     0x00000490
 #define MSR_IA32_VMX_VMFUNC             0x00000491
 
+#define MSR_IA32_U_CET                  0x000006a0
+#define MSR_IA32_S_CET                  0x000006a2
+#define MSR_IA32_PL0_SSP                0x000006a4
+#define MSR_IA32_PL1_SSP                0x000006a5
+#define MSR_IA32_PL2_SSP                0x000006a6
+#define MSR_IA32_PL3_SSP                0x000006a7
+#define MSR_IA32_SSP_TBL_ADDR           0x000006a8
+#define MSR_KVM_GUEST_SSP               0x4b564d09
+
 #define XSTATE_FP_BIT                   0
 #define XSTATE_SSE_BIT                  1
 #define XSTATE_YMM_BIT                  2
@@ -1766,6 +1775,15 @@ typedef struct CPUArchState {
 
     uintptr_t retaddr;
 
+    uint64_t u_cet;
+    uint64_t s_cet;
+    uint64_t pl0_ssp;
+    uint64_t pl1_ssp;
+    uint64_t pl2_ssp;
+    uint64_t pl3_ssp;
+    uint64_t ssp_table_addr;
+    uint64_t guest_ssp;
+
     /* Fields up to this point are cleared by a CPU reset */
     struct {} end_reset_fields;
 
diff --git a/target/i386/kvm/kvm.c b/target/i386/kvm/kvm.c
index de531842f6..ab3a755b97 100644
--- a/target/i386/kvm/kvm.c
+++ b/target/i386/kvm/kvm.c
@@ -3591,6 +3591,24 @@ static int kvm_put_msrs(X86CPU *cpu, int level)
                               env->msr_ia32_sgxlepubkeyhash[3]);
         }
 
+        if ((env->features[FEAT_XSAVE_XSS_LO] & XSTATE_CET_U_MASK) &&
+            (env->features[FEAT_XSAVE_XSS_LO] & XSTATE_CET_S_MASK)) {
+            if (env->features[FEAT_7_0_ECX] & CPUID_7_0_ECX_CET_SHSTK) {
+                kvm_msr_entry_add(cpu, MSR_IA32_U_CET, env->u_cet);
+                kvm_msr_entry_add(cpu, MSR_IA32_S_CET, env->s_cet);
+                kvm_msr_entry_add(cpu, MSR_KVM_GUEST_SSP, env->guest_ssp);
+                kvm_msr_entry_add(cpu, MSR_IA32_PL0_SSP, env->pl0_ssp);
+                kvm_msr_entry_add(cpu, MSR_IA32_PL1_SSP, env->pl1_ssp);
+                kvm_msr_entry_add(cpu, MSR_IA32_PL2_SSP, env->pl2_ssp);
+                kvm_msr_entry_add(cpu, MSR_IA32_PL3_SSP, env->pl3_ssp);
+                kvm_msr_entry_add(cpu, MSR_IA32_SSP_TBL_ADDR,
+                                  env->ssp_table_addr);
+            } else if (env->features[FEAT_7_0_EDX] & CPUID_7_0_EDX_CET_IBT) {
+                kvm_msr_entry_add(cpu, MSR_IA32_U_CET, env->u_cet);
+                kvm_msr_entry_add(cpu, MSR_IA32_S_CET, env->s_cet);
+            }
+        }
+
         if (env->features[FEAT_XSAVE] & CPUID_D_1_EAX_XFD) {
             kvm_msr_entry_add(cpu, MSR_IA32_XFD,
                               env->msr_xfd);
@@ -4024,6 +4042,23 @@ static int kvm_get_msrs(X86CPU *cpu)
         kvm_msr_entry_add(cpu, MSR_IA32_SGXLEPUBKEYHASH3, 0);
     }
 
+    if ((env->features[FEAT_XSAVE_XSS_LO] & XSTATE_CET_U_MASK) &&
+        (env->features[FEAT_XSAVE_XSS_LO] & XSTATE_CET_S_MASK)) {
+            if (env->features[FEAT_7_0_ECX] & CPUID_7_0_ECX_CET_SHSTK) {
+                kvm_msr_entry_add(cpu, MSR_IA32_U_CET, 0);
+                kvm_msr_entry_add(cpu, MSR_IA32_S_CET, 0);
+                kvm_msr_entry_add(cpu, MSR_KVM_GUEST_SSP, 0);
+                kvm_msr_entry_add(cpu, MSR_IA32_PL0_SSP, 0);
+                kvm_msr_entry_add(cpu, MSR_IA32_PL1_SSP, 0);
+                kvm_msr_entry_add(cpu, MSR_IA32_PL2_SSP, 0);
+                kvm_msr_entry_add(cpu, MSR_IA32_PL3_SSP, 0);
+                kvm_msr_entry_add(cpu, MSR_IA32_SSP_TBL_ADDR, 0);
+             } else if (env->features[FEAT_7_0_EDX] & CPUID_7_0_EDX_CET_IBT) {
+                kvm_msr_entry_add(cpu, MSR_IA32_U_CET, 0);
+                kvm_msr_entry_add(cpu, MSR_IA32_S_CET, 0);
+            }
+    }
+
     if (env->features[FEAT_XSAVE] & CPUID_D_1_EAX_XFD) {
         kvm_msr_entry_add(cpu, MSR_IA32_XFD, 0);
         kvm_msr_entry_add(cpu, MSR_IA32_XFD_ERR, 0);
@@ -4346,6 +4381,30 @@ static int kvm_get_msrs(X86CPU *cpu)
             env->msr_ia32_sgxlepubkeyhash[index - MSR_IA32_SGXLEPUBKEYHASH0] =
                            msrs[i].data;
             break;
+        case MSR_IA32_U_CET:
+            env->u_cet = msrs[i].data;
+            break;
+        case MSR_IA32_S_CET:
+            env->s_cet = msrs[i].data;
+            break;
+        case MSR_KVM_GUEST_SSP:
+            env->guest_ssp = msrs[i].data;
+            break;
+        case MSR_IA32_PL0_SSP:
+            env->pl0_ssp = msrs[i].data;
+            break;
+        case MSR_IA32_PL1_SSP:
+            env->pl1_ssp = msrs[i].data;
+            break;
+        case MSR_IA32_PL2_SSP:
+            env->pl2_ssp = msrs[i].data;
+            break;
+        case MSR_IA32_PL3_SSP:
+            env->pl3_ssp = msrs[i].data;
+            break;
+        case MSR_IA32_SSP_TBL_ADDR:
+            env->ssp_table_addr = msrs[i].data;
+            break;
         case MSR_IA32_XFD:
             env->msr_xfd = msrs[i].data;
             break;
-- 
2.27.0