When a kernel panic occurs in an environment without ACPI reboot or
8042 keyboard reset support (such as QEMU microvm),
native_machine_emergency_restart() falls back through BOOT_ACPI,
BOOT_KBD, BOOT_EFI, and eventually invokes machine_real_restart(MRR_BIOS)
to switch back to real mode for a BIOS reboot.

When kernel IBT is enabled, the indirect far jump (ljmpl) in
machine_real_restart() jumps to the 32-bit compatibility mode entry point
(pa_machine_real_restart_asm). Because machine_real_restart_asm does not
begin with an ENDBR32 instruction, an indirect branch tracking #CP fault
is triggered. Since ibt_fatal is true, do_kernel_cp_fault() triggers:

  Missing ENDBR: 0x9a230
  kernel BUG at arch/x86/kernel/cet.c:133!

This issue can be reproduced with virtme-ng:

  vng -v -r -- 'echo c >/proc/sysrq-trigger'

which launches QEMU with the microvm architecture:

  qemu-system-x86_64 -M microvm,accel=kvm,pcie=on,rtc=on \
    -cpu host,topoext=on -smp 16 -no-reboot \
    -kernel <vmlinuz> -append '... panic=-1 ...'

Invoke cet_disable() in machine_real_restart() before loading the
trampoline page table and executing the far jump, ensuring IBT is disabled
and avoiding the #CP fault.

Assisted-by: LLM
Signed-off-by: Jialin Wang <wjl.linux@gmail.com>
---
 arch/x86/kernel/reboot.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/arch/x86/kernel/reboot.c b/arch/x86/kernel/reboot.c
index 0fed6d0d7e32..eb23b8977de5 100644
--- a/arch/x86/kernel/reboot.c
+++ b/arch/x86/kernel/reboot.c
@@ -114,6 +114,13 @@ void __noreturn machine_real_restart(unsigned int type)
 	CMOS_WRITE(0x00, 0x8f);
 	spin_unlock(&rtc_lock);
 
+	/*
+	 * Disable CET before loading the trampoline page table and jumping
+	 * to the real-mode trampoline. This avoids missing-ENDBR #CP faults
+	 * during the far jump.
+	 */
+	cet_disable();
+
 	/*
 	 * Switch to the trampoline page table.
 	 */
-- 
2.56.0

On October 11, 2026 8:18:03 AM PDT, Jialin Wang <wjl.linux@gmail.com> wrote:
>When a kernel panic occurs in an environment without ACPI reboot or
>8042 keyboard reset support (such as QEMU microvm),
>native_machine_emergency_restart() falls back through BOOT_ACPI,
>BOOT_KBD, BOOT_EFI, and eventually invokes machine_real_restart(MRR_BIOS)
>to switch back to real mode for a BIOS reboot.
>
>When kernel IBT is enabled, the indirect far jump (ljmpl) in
>machine_real_restart() jumps to the 32-bit compatibility mode entry point
>(pa_machine_real_restart_asm). Because machine_real_restart_asm does not
>begin with an ENDBR32 instruction, an indirect branch tracking #CP fault
>is triggered. Since ibt_fatal is true, do_kernel_cp_fault() triggers:
>
>  Missing ENDBR: 0x9a230
>  kernel BUG at arch/x86/kernel/cet.c:133!
>
>This issue can be reproduced with virtme-ng:
>
>  vng -v -r -- 'echo c >/proc/sysrq-trigger'
>
>which launches QEMU with the microvm architecture:
>
>  qemu-system-x86_64 -M microvm,accel=kvm,pcie=on,rtc=on \
>    -cpu host,topoext=on -smp 16 -no-reboot \
>    -kernel <vmlinuz> -append '... panic=-1 ...'
>
>Invoke cet_disable() in machine_real_restart() before loading the
>trampoline page table and executing the far jump, ensuring IBT is disabled
>and avoiding the #CP fault.
>
>Assisted-by: LLM
>Signed-off-by: Jialin Wang <wjl.linux@gmail.com>
>---
> arch/x86/kernel/reboot.c | 7 +++++++
> 1 file changed, 7 insertions(+)
>
>diff --git a/arch/x86/kernel/reboot.c b/arch/x86/kernel/reboot.c
>index 0fed6d0d7e32..eb23b8977de5 100644
>--- a/arch/x86/kernel/reboot.c
>+++ b/arch/x86/kernel/reboot.c
>@@ -114,6 +114,13 @@ void __noreturn machine_real_restart(unsigned int type)
> 	CMOS_WRITE(0x00, 0x8f);
> 	spin_unlock(&rtc_lock);
> 
>+	/*
>+	 * Disable CET before loading the trampoline page table and jumping
>+	 * to the real-mode trampoline. This avoids missing-ENDBR #CP faults
>+	 * during the far jump.
>+	 */
>+	cet_disable();
>+
> 	/*
> 	 * Switch to the trampoline page table.
> 	 */

Indeed, this is very correct.

Reviewed-by: H. Peter Anvin (Rosaic) <hpa@zytor.com>