[PATCH] x86/reboot: Disable CET in machine_real_restart()

[Jialin Wang]

When a kernel panic occurs in an environment without ACPI reboot or
8042 keyboard reset support (such as QEMU microvm),
native_machine_emergency_restart() falls back through BOOT_ACPI,
BOOT_KBD, BOOT_EFI, and eventually invokes machine_real_restart(MRR_BIOS)
to switch back to real mode for a BIOS reboot.

When kernel IBT is enabled, the indirect far jump (ljmpl) in
machine_real_restart() jumps to the 32-bit compatibility mode entry point
(pa_machine_real_restart_asm). Because machine_real_restart_asm does not
begin with an ENDBR32 instruction, an indirect branch tracking #CP fault
is triggered. Since ibt_fatal is true, do_kernel_cp_fault() triggers:

  Missing ENDBR: 0x9a230
  kernel BUG at arch/x86/kernel/cet.c:133!

This issue can be reproduced with virtme-ng:

  vng -v -r -- 'echo c >/proc/sysrq-trigger'

which launches QEMU with the microvm architecture:

  qemu-system-x86_64 -M microvm,accel=kvm,pcie=on,rtc=on \
    -cpu host,topoext=on -smp 16 -no-reboot \
    -kernel <vmlinuz> -append '... panic=-1 ...'

Invoke cet_disable() in machine_real_restart() before loading the
trampoline page table and executing the far jump, ensuring IBT is disabled
and avoiding the #CP fault.

Assisted-by: LLM
Signed-off-by: Jialin Wang <wjl.linux@xxxxxxxxx>
---
 arch/x86/kernel/reboot.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/arch/x86/kernel/reboot.c b/arch/x86/kernel/reboot.c
index 0fed6d0d7e32..eb23b8977de5 100644
--- a/arch/x86/kernel/reboot.c
+++ b/arch/x86/kernel/reboot.c
@@ -114,6 +114,13 @@ void __noreturn machine_real_restart(unsigned int type)
 	CMOS_WRITE(0x00, 0x8f);
 	spin_unlock(&rtc_lock);
 
+	/*
+	 * Disable CET before loading the trampoline page table and jumping
+	 * to the real-mode trampoline. This avoids missing-ENDBR #CP faults
+	 * during the far jump.
+	 */
+	cet_disable();
+
 	/*
 	 * Switch to the trampoline page table.
 	 */
-- 
2.56.0