[PATCH 05/14] cpu_map: Add CET related CPU features

20 May 2026

From: Jiri Denemark <jdenemar@redhat.com>

QEMU commit 2f25476ae7f3b4c28fde64584a04734b14c8fd37

Signed-off-by: Jiri Denemark <jdenemar@redhat.com>
---
 src/cpu_map/sync_qemu_models_i386.py                 |  4 ++++
 src/cpu_map/x86_features.xml                         | 12 ++++++++++++
 .../x86_64-cpuid-Core-i7-1270P-disabled.xml          |  2 +-
 .../cputestdata/x86_64-cpuid-Core-i7-1270P-guest.xml |  2 ++
 .../cputestdata/x86_64-cpuid-Core-i7-1270P-host.xml  |  2 ++
 .../x86_64-cpuid-Core-i7-1365U-disabled.xml          |  2 +-
 .../cputestdata/x86_64-cpuid-Core-i7-1365U-guest.xml |  2 ++
 .../cputestdata/x86_64-cpuid-Core-i7-1365U-host.xml  |  2 ++
 .../x86_64-cpuid-EPYC-7713-64-Core-disabled.xml      |  2 +-
 .../x86_64-cpuid-EPYC-7713-64-Core-guest.xml         |  1 +
 .../x86_64-cpuid-EPYC-7713-64-Core-host.xml          |  1 +
 .../x86_64-cpuid-EPYC-9334-32-Core-disabled.xml      |  2 +-
 .../x86_64-cpuid-EPYC-9334-32-Core-guest.xml         |  1 +
 .../x86_64-cpuid-EPYC-9334-32-Core-host.xml          |  1 +
 .../x86_64-cpuid-Ryzen-9-9950X-16-Core-disabled.xml  |  2 +-
 .../x86_64-cpuid-Ryzen-9-9950X-16-Core-guest.xml     |  1 +
 .../x86_64-cpuid-Ryzen-9-9950X-16-Core-host.xml      |  1 +
 .../cputestdata/x86_64-cpuid-Xeon-6731E-disabled.xml |  2 +-
 tests/cputestdata/x86_64-cpuid-Xeon-6731E-guest.xml  |  2 ++
 tests/cputestdata/x86_64-cpuid-Xeon-6731E-host.xml   |  2 ++
 .../cputestdata/x86_64-cpuid-Xeon-6788P-disabled.xml |  2 +-
 tests/cputestdata/x86_64-cpuid-Xeon-6788P-guest.xml  |  2 ++
 tests/cputestdata/x86_64-cpuid-Xeon-6788P-host.xml   |  2 ++
 .../x86_64-cpuid-Xeon-Bronze-3408U-disabled.xml      |  2 +-
 .../x86_64-cpuid-Xeon-Bronze-3408U-guest.xml         |  2 ++
 .../x86_64-cpuid-Xeon-Bronze-3408U-host.xml          |  2 ++
 .../x86_64-cpuid-Xeon-Gold-6530-disabled.xml         |  2 +-
 .../x86_64-cpuid-Xeon-Gold-6530-guest.xml            |  2 ++
 .../cputestdata/x86_64-cpuid-Xeon-Gold-6530-host.xml |  2 ++
 .../x86_64-cpuid-Xeon-w7-3465X-disabled.xml          |  2 +-
 .../cputestdata/x86_64-cpuid-Xeon-w7-3465X-guest.xml |  2 ++
 .../cputestdata/x86_64-cpuid-Xeon-w7-3465X-host.xml  |  2 ++
 tests/domaincapsdata/qemu_11.0.0-q35.x86_64+sgx.xml  |  1 +
 tests/domaincapsdata/qemu_11.0.0-q35.x86_64.xml      |  1 +
 tests/domaincapsdata/qemu_11.0.0.x86_64+sgx.xml      |  1 +
 tests/domaincapsdata/qemu_11.0.0.x86_64.xml          |  1 +
 .../cpu-host-model-fallback-kvm.x86_64-11.0.0.args   |  2 +-
 .../cpu-host-model-fallback-kvm.x86_64-latest.args   |  2 +-
 .../cpu-host-model-features.x86_64-latest.args       |  2 +-
 .../cpu-host-model-kvm.x86_64-11.0.0.args            |  2 +-
 .../cpu-host-model-kvm.x86_64-latest.args            |  2 +-
 .../cpu-host-model-nofallback-kvm.x86_64-11.0.0.args |  2 +-
 .../cpu-host-model-nofallback-kvm.x86_64-latest.args |  2 +-
 43 files changed, 71 insertions(+), 17 deletions(-)

diff --git a/src/cpu_map/sync_qemu_models_i386.py b/src/cpu_map/sync_qemu_models_i386.py
index e778f99c65..36dadd8398 100755
--- a/src/cpu_map/sync_qemu_models_i386.py
+++ b/src/cpu_map/sync_qemu_models_i386.py
@@ -83,6 +83,8 @@ def translate_feature(name, model):
         "CPUID_7_0_EDX_STIBP": "stibp",
         "CPUID_7_0_EDX_TSX_LDTRK": "tsx-ldtrk",
         "CPUID_7_0_EDX_AVX512_VP2INTERSECT": "avx512-vp2intersect",
+        "CPUID_7_0_ECX_CET_SHSTK": "cet-ss",
+        "CPUID_7_0_EDX_CET_IBT": "cet-ibt",
         "CPUID_7_1_EAX_AMX_FP16": "amx-fp16",
         "CPUID_7_1_EAX_AVX512_BF16": "avx512-bf16",
         "CPUID_7_1_EAX_AVX_IFMA": "avx-ifma",
@@ -317,6 +319,7 @@ def translate_feature(name, model):
         "VMX_VM_EXIT_CLEAR_BNDCFGS": "vmx-exit-clear-bndcfgs",
         "VMX_VM_EXIT_CLEAR_IA32_RTIT_CTL": "vmx-exit-clear-rtit-ctl",
         "VMX_VM_EXIT_LOAD_IA32_PKRS": "vmx-exit-load-pkrs",
+        "VMX_VM_EXIT_SAVE_CET": "vmx-exit-save-cet",
 
         # FEAT_VMX_ENTRY_CTLS
         "VMX_VM_ENTRY_LOAD_DEBUG_CONTROLS": "vmx-entry-noload-debugctl",
@@ -327,6 +330,7 @@ def translate_feature(name, model):
         "VMX_VM_ENTRY_LOAD_BNDCFGS": "vmx-entry-load-bndcfgs",
         "VMX_VM_ENTRY_LOAD_IA32_RTIT_CTL": "vmx-entry-load-rtit-ctl",
         "VMX_VM_ENTRY_LOAD_IA32_PKRS": "vmx-entry-load-pkrs",
+        "VMX_VM_ENTRY_LOAD_CET": "vmx-entry-load-cet",
 
         # FEAT_VMX_MISC
         "MSR_VMX_MISC_STORE_LMA": "vmx-store-lma",
diff --git a/src/cpu_map/x86_features.xml b/src/cpu_map/x86_features.xml
index 0eb6a5c32c..69d908179b 100644
--- a/src/cpu_map/x86_features.xml
+++ b/src/cpu_map/x86_features.xml
@@ -317,6 +317,9 @@
   <feature name='avx512vbmi2'>
     <cpuid eax_in='0x00000007' ecx_in='0x00000000' ecx='0x00000040'/>
   </feature>
+  <feature name='cet-ss'>
+    <cpuid eax_in='0x00000007' ecx_in='0x00000000' ecx='0x00000080'/>
+  </feature>
   <feature name='gfni'>
     <cpuid eax_in='0x00000007' ecx_in='0x00000000' ecx='0x00000100'/>
   </feature>
@@ -389,6 +392,9 @@
   <feature name='arch-lbr'>
     <cpuid eax_in='0x00000007' ecx_in='0x00000000' edx='0x00080000'/>
   </feature>
+  <feature name='cet-ibt'>
+    <cpuid eax_in='0x00000007' ecx_in='0x00000000' edx='0x00100000'/>
+  </feature>
   <feature name='amx-bf16'>
     <cpuid eax_in='0x00000007' ecx_in='0x00000000' edx='0x00400000'/>
   </feature>
@@ -1244,6 +1250,9 @@
   <feature name='vmx-exit-clear-rtit-ctl'>
     <msr index='0x0000048f' edx='0x02000000' eax='0x00000000'/>
   </feature>
+  <feature name='vmx-exit-save-cet'>
+    <msr index='0x0000048f' edx='0x10000000' eax='0x00000000'/>
+  </feature>
   <feature name='vmx-exit-load-pkrs'>
     <msr index='0x0000048f' edx='0x20000000' eax='0x00000000'/>
   </feature>
@@ -1273,6 +1282,9 @@
   <feature name='vmx-entry-load-rtit-ctl'>
     <msr index='0x00000490' edx='0x00040000' eax='0x00000000'/>
   </feature>
+  <feature name='vmx-entry-load-cet'>
+    <msr index='0x00000490' edx='0x00100000' eax='0x00000000'/>
+  </feature>
   <feature name='vmx-entry-load-pkrs'>
     <msr index='0x00000490' edx='0x00400000' eax='0x00000000'/>
   </feature>
diff --git a/tests/cputestdata/x86_64-cpuid-Core-i7-1270P-disabled.xml b/tests/cputestdata/x86_64-cpuid-Core-i7-1270P-disabled.xml
index 7b9e338350..d34de36118 100644
--- a/tests/cputestdata/x86_64-cpuid-Core-i7-1270P-disabled.xml
+++ b/tests/cputestdata/x86_64-cpuid-Core-i7-1270P-disabled.xml
@@ -1,7 +1,7 @@
 <!-- Features disabled by QEMU -->
 <cpudata arch='x86'>
   <cpuid eax_in='0x00000001' ecx_in='0x00' eax='0x00000000' ebx='0x00000000' ecx='0x0800c1dc' edx='0xb0600000'/>
-  <cpuid eax_in='0x00000007' ecx_in='0x00' eax='0x00000000' ebx='0x02000000' ecx='0x80000010' edx='0x400c0000'/>
+  <cpuid eax_in='0x00000007' ecx_in='0x00' eax='0x00000000' ebx='0x02000000' ecx='0x80000090' edx='0x401c0000'/>
   <cpuid eax_in='0x80000007' ecx_in='0x00' eax='0x00000000' ebx='0x00000000' ecx='0x00000000' edx='0x00000100'/>
   <msr index='0xcf' edx='0x00000000' eax='0x00000020'/>
   <msr index='0x10a' edx='0x00000000' eax='0x00000100'/>
diff --git a/tests/cputestdata/x86_64-cpuid-Core-i7-1270P-guest.xml b/tests/cputestdata/x86_64-cpuid-Core-i7-1270P-guest.xml
index 2253a90cdb..0f050525f4 100644
--- a/tests/cputestdata/x86_64-cpuid-Core-i7-1270P-guest.xml
+++ b/tests/cputestdata/x86_64-cpuid-Core-i7-1270P-guest.xml
@@ -33,6 +33,7 @@
   <feature policy='require' name='pku'/>
   <feature policy='require' name='ospke'/>
   <feature policy='require' name='waitpkg'/>
+  <feature policy='require' name='cet-ss'/>
   <feature policy='require' name='vaes'/>
   <feature policy='require' name='vpclmulqdq'/>
   <feature policy='require' name='rdpid'/>
@@ -42,6 +43,7 @@
   <feature policy='require' name='serialize'/>
   <feature policy='require' name='pconfig'/>
   <feature policy='require' name='arch-lbr'/>
+  <feature policy='require' name='cet-ibt'/>
   <feature policy='require' name='stibp'/>
   <feature policy='require' name='flush-l1d'/>
   <feature policy='require' name='avx-vnni'/>
diff --git a/tests/cputestdata/x86_64-cpuid-Core-i7-1270P-host.xml b/tests/cputestdata/x86_64-cpuid-Core-i7-1270P-host.xml
index 9ede3ba04e..765cc63fde 100644
--- a/tests/cputestdata/x86_64-cpuid-Core-i7-1270P-host.xml
+++ b/tests/cputestdata/x86_64-cpuid-Core-i7-1270P-host.xml
@@ -30,6 +30,7 @@
   <feature name='pku'/>
   <feature name='ospke'/>
   <feature name='waitpkg'/>
+  <feature name='cet-ss'/>
   <feature name='gfni'/>
   <feature name='vaes'/>
   <feature name='vpclmulqdq'/>
@@ -42,6 +43,7 @@
   <feature name='serialize'/>
   <feature name='pconfig'/>
   <feature name='arch-lbr'/>
+  <feature name='cet-ibt'/>
   <feature name='stibp'/>
   <feature name='flush-l1d'/>
   <feature name='arch-capabilities'/>
diff --git a/tests/cputestdata/x86_64-cpuid-Core-i7-1365U-disabled.xml b/tests/cputestdata/x86_64-cpuid-Core-i7-1365U-disabled.xml
index 23295d1121..566c5d7e01 100644
--- a/tests/cputestdata/x86_64-cpuid-Core-i7-1365U-disabled.xml
+++ b/tests/cputestdata/x86_64-cpuid-Core-i7-1365U-disabled.xml
@@ -1,6 +1,6 @@
 <!-- Features disabled by QEMU -->
 <cpudata arch='x86'>
   <cpuid eax_in='0x00000001' ecx_in='0x00' eax='0x00000000' ebx='0x00000000' ecx='0x0800c1dc' edx='0xb0600000'/>
-  <cpuid eax_in='0x00000007' ecx_in='0x00' eax='0x00000000' ebx='0x02000000' ecx='0x80000010' edx='0x400c0000'/>
+  <cpuid eax_in='0x00000007' ecx_in='0x00' eax='0x00000000' ebx='0x02000000' ecx='0x80000090' edx='0x401c0000'/>
   <cpuid eax_in='0x80000007' ecx_in='0x00' eax='0x00000000' ebx='0x00000000' ecx='0x00000000' edx='0x00000100'/>
 </cpudata>
diff --git a/tests/cputestdata/x86_64-cpuid-Core-i7-1365U-guest.xml b/tests/cputestdata/x86_64-cpuid-Core-i7-1365U-guest.xml
index b55acf9c96..3962353e7d 100644
--- a/tests/cputestdata/x86_64-cpuid-Core-i7-1365U-guest.xml
+++ b/tests/cputestdata/x86_64-cpuid-Core-i7-1365U-guest.xml
@@ -33,6 +33,7 @@
   <feature policy='require' name='pku'/>
   <feature policy='require' name='ospke'/>
   <feature policy='require' name='waitpkg'/>
+  <feature policy='require' name='cet-ss'/>
   <feature policy='require' name='vaes'/>
   <feature policy='require' name='vpclmulqdq'/>
   <feature policy='require' name='rdpid'/>
@@ -42,6 +43,7 @@
   <feature policy='require' name='serialize'/>
   <feature policy='require' name='pconfig'/>
   <feature policy='require' name='arch-lbr'/>
+  <feature policy='require' name='cet-ibt'/>
   <feature policy='require' name='stibp'/>
   <feature policy='require' name='flush-l1d'/>
   <feature policy='require' name='avx-vnni'/>
diff --git a/tests/cputestdata/x86_64-cpuid-Core-i7-1365U-host.xml b/tests/cputestdata/x86_64-cpuid-Core-i7-1365U-host.xml
index 6b77828ee6..ad0c6ba4a1 100644
--- a/tests/cputestdata/x86_64-cpuid-Core-i7-1365U-host.xml
+++ b/tests/cputestdata/x86_64-cpuid-Core-i7-1365U-host.xml
@@ -30,6 +30,7 @@
   <feature name='pku'/>
   <feature name='ospke'/>
   <feature name='waitpkg'/>
+  <feature name='cet-ss'/>
   <feature name='gfni'/>
   <feature name='vaes'/>
   <feature name='vpclmulqdq'/>
@@ -42,6 +43,7 @@
   <feature name='serialize'/>
   <feature name='pconfig'/>
   <feature name='arch-lbr'/>
+  <feature name='cet-ibt'/>
   <feature name='stibp'/>
   <feature name='flush-l1d'/>
   <feature name='arch-capabilities'/>
diff --git a/tests/cputestdata/x86_64-cpuid-EPYC-7713-64-Core-disabled.xml b/tests/cputestdata/x86_64-cpuid-EPYC-7713-64-Core-disabled.xml
index b6507fe6b7..ae64d16082 100644
--- a/tests/cputestdata/x86_64-cpuid-EPYC-7713-64-Core-disabled.xml
+++ b/tests/cputestdata/x86_64-cpuid-EPYC-7713-64-Core-disabled.xml
@@ -1,7 +1,7 @@
 <!-- Features disabled by QEMU -->
 <cpudata arch='x86'>
   <cpuid eax_in='0x00000001' ecx_in='0x00' eax='0x00000000' ebx='0x00000000' ecx='0x08000008' edx='0x10000000'/>
-  <cpuid eax_in='0x00000007' ecx_in='0x00' eax='0x00000000' ebx='0x00001000' ecx='0x00000010' edx='0x00000000'/>
+  <cpuid eax_in='0x00000007' ecx_in='0x00' eax='0x00000000' ebx='0x00001000' ecx='0x00000090' edx='0x00000000'/>
   <cpuid eax_in='0x0000000f' ecx_in='0x01' eax='0x00000000' ebx='0x00000000' ecx='0x00000000' edx='0x00000006'/>
   <cpuid eax_in='0x80000001' ecx_in='0x00' eax='0x00000000' ebx='0x00000000' ecx='0x01423408' edx='0x00000000'/>
   <cpuid eax_in='0x80000007' ecx_in='0x00' eax='0x00000000' ebx='0x00000003' ecx='0x00000000' edx='0x00000100'/>
diff --git a/tests/cputestdata/x86_64-cpuid-EPYC-7713-64-Core-guest.xml b/tests/cputestdata/x86_64-cpuid-EPYC-7713-64-Core-guest.xml
index 42d9e148f7..2c85282b54 100644
--- a/tests/cputestdata/x86_64-cpuid-EPYC-7713-64-Core-guest.xml
+++ b/tests/cputestdata/x86_64-cpuid-EPYC-7713-64-Core-guest.xml
@@ -7,6 +7,7 @@
   <feature policy='require' name='ht'/>
   <feature policy='require' name='cmt'/>
   <feature policy='require' name='ospke'/>
+  <feature policy='require' name='cet-ss'/>
   <feature policy='require' name='vaes'/>
   <feature policy='require' name='vpclmulqdq'/>
   <feature policy='require' name='mbm_total'/>
diff --git a/tests/cputestdata/x86_64-cpuid-EPYC-7713-64-Core-host.xml b/tests/cputestdata/x86_64-cpuid-EPYC-7713-64-Core-host.xml
index db3d78dd5b..bd8186a8d6 100644
--- a/tests/cputestdata/x86_64-cpuid-EPYC-7713-64-Core-host.xml
+++ b/tests/cputestdata/x86_64-cpuid-EPYC-7713-64-Core-host.xml
@@ -9,6 +9,7 @@
   <feature name='ht'/>
   <feature name='cmt'/>
   <feature name='ospke'/>
+  <feature name='cet-ss'/>
   <feature name='mbm_total'/>
   <feature name='mbm_local'/>
   <feature name='cmp_legacy'/>
diff --git a/tests/cputestdata/x86_64-cpuid-EPYC-9334-32-Core-disabled.xml b/tests/cputestdata/x86_64-cpuid-EPYC-9334-32-Core-disabled.xml
index 0f9c7000b9..e04f1a86f6 100644
--- a/tests/cputestdata/x86_64-cpuid-EPYC-9334-32-Core-disabled.xml
+++ b/tests/cputestdata/x86_64-cpuid-EPYC-9334-32-Core-disabled.xml
@@ -1,7 +1,7 @@
 <!-- Features disabled by QEMU -->
 <cpudata arch='x86'>
   <cpuid eax_in='0x00000001' ecx_in='0x00' eax='0x00000000' ebx='0x00000000' ecx='0x08000008' edx='0x10000000'/>
-  <cpuid eax_in='0x00000007' ecx_in='0x00' eax='0x00000000' ebx='0x00001000' ecx='0x00000010' edx='0x00000000'/>
+  <cpuid eax_in='0x00000007' ecx_in='0x00' eax='0x00000000' ebx='0x00001000' ecx='0x00000090' edx='0x00000000'/>
   <cpuid eax_in='0x0000000f' ecx_in='0x01' eax='0x00000000' ebx='0x00000000' ecx='0x00000000' edx='0x00000006'/>
   <cpuid eax_in='0x80000001' ecx_in='0x00' eax='0x00000000' ebx='0x00000000' ecx='0x01423408' edx='0x00000000'/>
   <cpuid eax_in='0x80000007' ecx_in='0x00' eax='0x00000000' ebx='0x00000000' ecx='0x00000000' edx='0x00000100'/>
diff --git a/tests/cputestdata/x86_64-cpuid-EPYC-9334-32-Core-guest.xml b/tests/cputestdata/x86_64-cpuid-EPYC-9334-32-Core-guest.xml
index 07b1e59bc2..40b0f1a213 100644
--- a/tests/cputestdata/x86_64-cpuid-EPYC-9334-32-Core-guest.xml
+++ b/tests/cputestdata/x86_64-cpuid-EPYC-9334-32-Core-guest.xml
@@ -7,6 +7,7 @@
   <feature policy='require' name='ht'/>
   <feature policy='require' name='cmt'/>
   <feature policy='require' name='ospke'/>
+  <feature policy='require' name='cet-ss'/>
   <feature policy='require' name='flush-l1d'/>
   <feature policy='require' name='mbm_total'/>
   <feature policy='require' name='mbm_local'/>
diff --git a/tests/cputestdata/x86_64-cpuid-EPYC-9334-32-Core-host.xml b/tests/cputestdata/x86_64-cpuid-EPYC-9334-32-Core-host.xml
index 70307f4855..e884161f6c 100644
--- a/tests/cputestdata/x86_64-cpuid-EPYC-9334-32-Core-host.xml
+++ b/tests/cputestdata/x86_64-cpuid-EPYC-9334-32-Core-host.xml
@@ -9,6 +9,7 @@
   <feature name='ht'/>
   <feature name='cmt'/>
   <feature name='ospke'/>
+  <feature name='cet-ss'/>
   <feature name='flush-l1d'/>
   <feature name='mbm_total'/>
   <feature name='mbm_local'/>
diff --git a/tests/cputestdata/x86_64-cpuid-Ryzen-9-9950X-16-Core-disabled.xml b/tests/cputestdata/x86_64-cpuid-Ryzen-9-9950X-16-Core-disabled.xml
index 60880acf30..1a23b22bf2 100644
--- a/tests/cputestdata/x86_64-cpuid-Ryzen-9-9950X-16-Core-disabled.xml
+++ b/tests/cputestdata/x86_64-cpuid-Ryzen-9-9950X-16-Core-disabled.xml
@@ -1,7 +1,7 @@
 <!-- Features disabled by QEMU -->
 <cpudata arch='x86'>
   <cpuid eax_in='0x00000001' ecx_in='0x00' eax='0x00000000' ebx='0x00000000' ecx='0x08000008' edx='0x10000000'/>
-  <cpuid eax_in='0x00000007' ecx_in='0x00' eax='0x00000000' ebx='0x00001000' ecx='0x01000010' edx='0x00000000'/>
+  <cpuid eax_in='0x00000007' ecx_in='0x00' eax='0x00000000' ebx='0x00001000' ecx='0x01000090' edx='0x00000000'/>
   <cpuid eax_in='0x0000000f' ecx_in='0x01' eax='0x00000000' ebx='0x00000000' ecx='0x00000000' edx='0x00000006'/>
   <cpuid eax_in='0x80000001' ecx_in='0x00' eax='0x00000000' ebx='0x00000000' ecx='0x01423408' edx='0x00000000'/>
   <cpuid eax_in='0x80000007' ecx_in='0x00' eax='0x00000000' ebx='0x00000000' ecx='0x00000000' edx='0x00000100'/>
diff --git a/tests/cputestdata/x86_64-cpuid-Ryzen-9-9950X-16-Core-guest.xml b/tests/cputestdata/x86_64-cpuid-Ryzen-9-9950X-16-Core-guest.xml
index f405fed995..1cf862bfe6 100644
--- a/tests/cputestdata/x86_64-cpuid-Ryzen-9-9950X-16-Core-guest.xml
+++ b/tests/cputestdata/x86_64-cpuid-Ryzen-9-9950X-16-Core-guest.xml
@@ -7,6 +7,7 @@
   <feature policy='require' name='tsc_adjust'/>
   <feature policy='require' name='cmt'/>
   <feature policy='require' name='ospke'/>
+  <feature policy='require' name='cet-ss'/>
   <feature policy='require' name='bus-lock-detect'/>
   <feature policy='require' name='flush-l1d'/>
   <feature policy='require' name='mbm_total'/>
diff --git a/tests/cputestdata/x86_64-cpuid-Ryzen-9-9950X-16-Core-host.xml b/tests/cputestdata/x86_64-cpuid-Ryzen-9-9950X-16-Core-host.xml
index 48e5e03f03..65cee66c71 100644
--- a/tests/cputestdata/x86_64-cpuid-Ryzen-9-9950X-16-Core-host.xml
+++ b/tests/cputestdata/x86_64-cpuid-Ryzen-9-9950X-16-Core-host.xml
@@ -20,6 +20,7 @@
   <feature name='pku'/>
   <feature name='ospke'/>
   <feature name='avx512vbmi2'/>
+  <feature name='cet-ss'/>
   <feature name='gfni'/>
   <feature name='vaes'/>
   <feature name='vpclmulqdq'/>
diff --git a/tests/cputestdata/x86_64-cpuid-Xeon-6731E-disabled.xml b/tests/cputestdata/x86_64-cpuid-Xeon-6731E-disabled.xml
index bddd5488e1..03f93587b1 100644
--- a/tests/cputestdata/x86_64-cpuid-Xeon-6731E-disabled.xml
+++ b/tests/cputestdata/x86_64-cpuid-Xeon-6731E-disabled.xml
@@ -1,7 +1,7 @@
 <!-- Features disabled by QEMU -->
 <cpudata arch='x86'>
   <cpuid eax_in='0x00000001' ecx_in='0x00' eax='0x00000000' ebx='0x00000000' ecx='0x080441d8' edx='0xb0400000'/>
-  <cpuid eax_in='0x00000007' ecx_in='0x00' eax='0x00000000' ebx='0x02001004' ecx='0xc0000010' edx='0x400c0000'/>
+  <cpuid eax_in='0x00000007' ecx_in='0x00' eax='0x00000000' ebx='0x02001004' ecx='0xc0000090' edx='0x401c0000'/>
   <cpuid eax_in='0x00000007' ecx_in='0x01' eax='0x00080000' ebx='0x00000000' ecx='0x00000000' edx='0x00000000'/>
   <cpuid eax_in='0x0000000f' ecx_in='0x01' eax='0x00000000' ebx='0x00000000' ecx='0x00000000' edx='0x00000006'/>
   <cpuid eax_in='0x00000014' ecx_in='0x00' eax='0x00000000' ebx='0x00000000' ecx='0x80000000' edx='0x00000000'/>
diff --git a/tests/cputestdata/x86_64-cpuid-Xeon-6731E-guest.xml b/tests/cputestdata/x86_64-cpuid-Xeon-6731E-guest.xml
index b9481ff3d0..62495fc60b 100644
--- a/tests/cputestdata/x86_64-cpuid-Xeon-6731E-guest.xml
+++ b/tests/cputestdata/x86_64-cpuid-Xeon-6731E-guest.xml
@@ -26,6 +26,7 @@
   <feature policy='require' name='intel-pt'/>
   <feature policy='require' name='ospke'/>
   <feature policy='require' name='waitpkg'/>
+  <feature policy='require' name='cet-ss'/>
   <feature policy='require' name='cldemote'/>
   <feature policy='require' name='movdiri'/>
   <feature policy='require' name='movdir64b'/>
@@ -34,6 +35,7 @@
   <feature policy='require' name='md-clear'/>
   <feature policy='require' name='pconfig'/>
   <feature policy='require' name='arch-lbr'/>
+  <feature policy='require' name='cet-ibt'/>
   <feature policy='require' name='stibp'/>
   <feature policy='require' name='flush-l1d'/>
   <feature policy='require' name='core-capability'/>
diff --git a/tests/cputestdata/x86_64-cpuid-Xeon-6731E-host.xml b/tests/cputestdata/x86_64-cpuid-Xeon-6731E-host.xml
index f114f64c51..04104058f2 100644
--- a/tests/cputestdata/x86_64-cpuid-Xeon-6731E-host.xml
+++ b/tests/cputestdata/x86_64-cpuid-Xeon-6731E-host.xml
@@ -38,6 +38,7 @@
   <feature name='pku'/>
   <feature name='ospke'/>
   <feature name='waitpkg'/>
+  <feature name='cet-ss'/>
   <feature name='vaes'/>
   <feature name='vpclmulqdq'/>
   <feature name='rdpid'/>
@@ -49,6 +50,7 @@
   <feature name='serialize'/>
   <feature name='pconfig'/>
   <feature name='arch-lbr'/>
+  <feature name='cet-ibt'/>
   <feature name='stibp'/>
   <feature name='flush-l1d'/>
   <feature name='avx-vnni'/>
diff --git a/tests/cputestdata/x86_64-cpuid-Xeon-6788P-disabled.xml b/tests/cputestdata/x86_64-cpuid-Xeon-6788P-disabled.xml
index 5dd24f2d17..ee206ede5d 100644
--- a/tests/cputestdata/x86_64-cpuid-Xeon-6788P-disabled.xml
+++ b/tests/cputestdata/x86_64-cpuid-Xeon-6788P-disabled.xml
@@ -1,7 +1,7 @@
 <!-- Features disabled by QEMU -->
 <cpudata arch='x86'>
   <cpuid eax_in='0x00000001' ecx_in='0x00' eax='0x00000000' ebx='0x00000000' ecx='0x080441d8' edx='0xb0400000'/>
-  <cpuid eax_in='0x00000007' ecx_in='0x00' eax='0x00000000' ebx='0x02001004' ecx='0xc0000010' edx='0x400c0000'/>
+  <cpuid eax_in='0x00000007' ecx_in='0x00' eax='0x00000000' ebx='0x02001004' ecx='0xc0000090' edx='0x401c0000'/>
   <cpuid eax_in='0x0000000f' ecx_in='0x01' eax='0x00000000' ebx='0x00000000' ecx='0x00000000' edx='0x00000006'/>
   <cpuid eax_in='0x80000007' ecx_in='0x00' eax='0x00000000' ebx='0x00000000' ecx='0x00000000' edx='0x00000100'/>
   <msr index='0xcf' edx='0x00000000' eax='0x00000020'/>
diff --git a/tests/cputestdata/x86_64-cpuid-Xeon-6788P-guest.xml b/tests/cputestdata/x86_64-cpuid-Xeon-6788P-guest.xml
index f5d80aebf8..889b7ab798 100644
--- a/tests/cputestdata/x86_64-cpuid-Xeon-6788P-guest.xml
+++ b/tests/cputestdata/x86_64-cpuid-Xeon-6788P-guest.xml
@@ -26,6 +26,7 @@
   <feature policy='require' name='intel-pt'/>
   <feature policy='require' name='ospke'/>
   <feature policy='require' name='waitpkg'/>
+  <feature policy='require' name='cet-ss'/>
   <feature policy='require' name='cldemote'/>
   <feature policy='require' name='movdiri'/>
   <feature policy='require' name='movdir64b'/>
@@ -34,6 +35,7 @@
   <feature policy='require' name='md-clear'/>
   <feature policy='require' name='pconfig'/>
   <feature policy='require' name='arch-lbr'/>
+  <feature policy='require' name='cet-ibt'/>
   <feature policy='require' name='stibp'/>
   <feature policy='require' name='flush-l1d'/>
   <feature policy='require' name='core-capability'/>
diff --git a/tests/cputestdata/x86_64-cpuid-Xeon-6788P-host.xml b/tests/cputestdata/x86_64-cpuid-Xeon-6788P-host.xml
index 55fd746133..54dd35dbd1 100644
--- a/tests/cputestdata/x86_64-cpuid-Xeon-6788P-host.xml
+++ b/tests/cputestdata/x86_64-cpuid-Xeon-6788P-host.xml
@@ -30,6 +30,7 @@
   <feature name='sha-ni'/>
   <feature name='ospke'/>
   <feature name='waitpkg'/>
+  <feature name='cet-ss'/>
   <feature name='rdpid'/>
   <feature name='bus-lock-detect'/>
   <feature name='cldemote'/>
@@ -43,6 +44,7 @@
   <feature name='tsx-ldtrk'/>
   <feature name='pconfig'/>
   <feature name='arch-lbr'/>
+  <feature name='cet-ibt'/>
   <feature name='amx-bf16'/>
   <feature name='avx512-fp16'/>
   <feature name='amx-tile'/>
diff --git a/tests/cputestdata/x86_64-cpuid-Xeon-Bronze-3408U-disabled.xml b/tests/cputestdata/x86_64-cpuid-Xeon-Bronze-3408U-disabled.xml
index 718d8a325d..13b7a80ef3 100644
--- a/tests/cputestdata/x86_64-cpuid-Xeon-Bronze-3408U-disabled.xml
+++ b/tests/cputestdata/x86_64-cpuid-Xeon-Bronze-3408U-disabled.xml
@@ -1,7 +1,7 @@
 <!-- Features disabled by QEMU -->
 <cpudata arch='x86'>
   <cpuid eax_in='0x00000001' ecx_in='0x00' eax='0x00000000' ebx='0x00000000' ecx='0x080441d0' edx='0xb0400000'/>
-  <cpuid eax_in='0x00000007' ecx_in='0x00' eax='0x00000000' ebx='0x02001004' ecx='0xc0000010' edx='0x400c0000'/>
+  <cpuid eax_in='0x00000007' ecx_in='0x00' eax='0x00000000' ebx='0x02001004' ecx='0xc0000090' edx='0x401c0000'/>
   <cpuid eax_in='0x0000000f' ecx_in='0x01' eax='0x00000000' ebx='0x00000000' ecx='0x00000000' edx='0x00000006'/>
   <cpuid eax_in='0x80000007' ecx_in='0x00' eax='0x00000000' ebx='0x00000000' ecx='0x00000000' edx='0x00000100'/>
   <msr index='0xcf' edx='0x00000000' eax='0x00000020'/>
diff --git a/tests/cputestdata/x86_64-cpuid-Xeon-Bronze-3408U-guest.xml b/tests/cputestdata/x86_64-cpuid-Xeon-Bronze-3408U-guest.xml
index 65f9bc3641..38d98d2eb7 100644
--- a/tests/cputestdata/x86_64-cpuid-Xeon-Bronze-3408U-guest.xml
+++ b/tests/cputestdata/x86_64-cpuid-Xeon-Bronze-3408U-guest.xml
@@ -25,6 +25,7 @@
   <feature policy='require' name='intel-pt'/>
   <feature policy='require' name='ospke'/>
   <feature policy='require' name='waitpkg'/>
+  <feature policy='require' name='cet-ss'/>
   <feature policy='require' name='cldemote'/>
   <feature policy='require' name='movdiri'/>
   <feature policy='require' name='movdir64b'/>
@@ -33,6 +34,7 @@
   <feature policy='require' name='md-clear'/>
   <feature policy='require' name='pconfig'/>
   <feature policy='require' name='arch-lbr'/>
+  <feature policy='require' name='cet-ibt'/>
   <feature policy='require' name='stibp'/>
   <feature policy='require' name='flush-l1d'/>
   <feature policy='require' name='core-capability'/>
diff --git a/tests/cputestdata/x86_64-cpuid-Xeon-Bronze-3408U-host.xml b/tests/cputestdata/x86_64-cpuid-Xeon-Bronze-3408U-host.xml
index 4606d55522..4689d03ccb 100644
--- a/tests/cputestdata/x86_64-cpuid-Xeon-Bronze-3408U-host.xml
+++ b/tests/cputestdata/x86_64-cpuid-Xeon-Bronze-3408U-host.xml
@@ -29,6 +29,7 @@
   <feature name='sha-ni'/>
   <feature name='ospke'/>
   <feature name='waitpkg'/>
+  <feature name='cet-ss'/>
   <feature name='rdpid'/>
   <feature name='bus-lock-detect'/>
   <feature name='cldemote'/>
@@ -42,6 +43,7 @@
   <feature name='tsx-ldtrk'/>
   <feature name='pconfig'/>
   <feature name='arch-lbr'/>
+  <feature name='cet-ibt'/>
   <feature name='avx512-fp16'/>
   <feature name='stibp'/>
   <feature name='flush-l1d'/>
diff --git a/tests/cputestdata/x86_64-cpuid-Xeon-Gold-6530-disabled.xml b/tests/cputestdata/x86_64-cpuid-Xeon-Gold-6530-disabled.xml
index 7b2ee72dee..101a8b4f16 100644
--- a/tests/cputestdata/x86_64-cpuid-Xeon-Gold-6530-disabled.xml
+++ b/tests/cputestdata/x86_64-cpuid-Xeon-Gold-6530-disabled.xml
@@ -1,7 +1,7 @@
 <!-- Features disabled by QEMU -->
 <cpudata arch='x86'>
   <cpuid eax_in='0x00000001' ecx_in='0x00' eax='0x00000000' ebx='0x00000000' ecx='0x080441d8' edx='0xb0400000'/>
-  <cpuid eax_in='0x00000007' ecx_in='0x00' eax='0x00000000' ebx='0x02003044' ecx='0xc0000010' edx='0x400c0000'/>
+  <cpuid eax_in='0x00000007' ecx_in='0x00' eax='0x00000000' ebx='0x02003044' ecx='0xc0000090' edx='0x401c0000'/>
   <cpuid eax_in='0x00000007' ecx_in='0x02' eax='0x00000000' ebx='0x00000000' ecx='0x00000000' edx='0x0000001f'/>
   <cpuid eax_in='0x0000000f' ecx_in='0x01' eax='0x00000000' ebx='0x00000000' ecx='0x00000000' edx='0x00000006'/>
   <cpuid eax_in='0x80000007' ecx_in='0x00' eax='0x00000000' ebx='0x00000000' ecx='0x00000000' edx='0x00000100'/>
diff --git a/tests/cputestdata/x86_64-cpuid-Xeon-Gold-6530-guest.xml b/tests/cputestdata/x86_64-cpuid-Xeon-Gold-6530-guest.xml
index e3e2226361..2f05ee0e91 100644
--- a/tests/cputestdata/x86_64-cpuid-Xeon-Gold-6530-guest.xml
+++ b/tests/cputestdata/x86_64-cpuid-Xeon-Gold-6530-guest.xml
@@ -26,6 +26,7 @@
   <feature policy='require' name='intel-pt'/>
   <feature policy='require' name='ospke'/>
   <feature policy='require' name='waitpkg'/>
+  <feature policy='require' name='cet-ss'/>
   <feature policy='require' name='cldemote'/>
   <feature policy='require' name='movdiri'/>
   <feature policy='require' name='movdir64b'/>
@@ -34,6 +35,7 @@
   <feature policy='require' name='md-clear'/>
   <feature policy='require' name='pconfig'/>
   <feature policy='require' name='arch-lbr'/>
+  <feature policy='require' name='cet-ibt'/>
   <feature policy='require' name='stibp'/>
   <feature policy='require' name='flush-l1d'/>
   <feature policy='require' name='core-capability'/>
diff --git a/tests/cputestdata/x86_64-cpuid-Xeon-Gold-6530-host.xml b/tests/cputestdata/x86_64-cpuid-Xeon-Gold-6530-host.xml
index 18f9de15bc..b038a2c285 100644
--- a/tests/cputestdata/x86_64-cpuid-Xeon-Gold-6530-host.xml
+++ b/tests/cputestdata/x86_64-cpuid-Xeon-Gold-6530-host.xml
@@ -30,6 +30,7 @@
   <feature name='sha-ni'/>
   <feature name='ospke'/>
   <feature name='waitpkg'/>
+  <feature name='cet-ss'/>
   <feature name='rdpid'/>
   <feature name='bus-lock-detect'/>
   <feature name='cldemote'/>
@@ -43,6 +44,7 @@
   <feature name='tsx-ldtrk'/>
   <feature name='pconfig'/>
   <feature name='arch-lbr'/>
+  <feature name='cet-ibt'/>
   <feature name='amx-bf16'/>
   <feature name='avx512-fp16'/>
   <feature name='amx-tile'/>
diff --git a/tests/cputestdata/x86_64-cpuid-Xeon-w7-3465X-disabled.xml b/tests/cputestdata/x86_64-cpuid-Xeon-w7-3465X-disabled.xml
index ed220518bd..08ecdcdf41 100644
--- a/tests/cputestdata/x86_64-cpuid-Xeon-w7-3465X-disabled.xml
+++ b/tests/cputestdata/x86_64-cpuid-Xeon-w7-3465X-disabled.xml
@@ -1,7 +1,7 @@
 <!-- Features disabled by QEMU -->
 <cpudata arch='x86'>
   <cpuid eax_in='0x00000001' ecx_in='0x00' eax='0x00000000' ebx='0x00000000' ecx='0x080441d8' edx='0xb0400000'/>
-  <cpuid eax_in='0x00000007' ecx_in='0x00' eax='0x00000000' ebx='0x02003040' ecx='0x80000010' edx='0x400c0000'/>
+  <cpuid eax_in='0x00000007' ecx_in='0x00' eax='0x00000000' ebx='0x02003040' ecx='0x80000090' edx='0x401c0000'/>
   <cpuid eax_in='0x00000007' ecx_in='0x02' eax='0x00000000' ebx='0x00000000' ecx='0x00000000' edx='0x00000017'/>
   <cpuid eax_in='0x0000000f' ecx_in='0x01' eax='0x00000000' ebx='0x00000000' ecx='0x00000000' edx='0x00000006'/>
   <cpuid eax_in='0x80000007' ecx_in='0x00' eax='0x00000000' ebx='0x00000000' ecx='0x00000000' edx='0x00000100'/>
diff --git a/tests/cputestdata/x86_64-cpuid-Xeon-w7-3465X-guest.xml b/tests/cputestdata/x86_64-cpuid-Xeon-w7-3465X-guest.xml
index 8a77c50cb6..f48ffe2608 100644
--- a/tests/cputestdata/x86_64-cpuid-Xeon-w7-3465X-guest.xml
+++ b/tests/cputestdata/x86_64-cpuid-Xeon-w7-3465X-guest.xml
@@ -25,6 +25,7 @@
   <feature policy='require' name='intel-pt'/>
   <feature policy='require' name='ospke'/>
   <feature policy='require' name='waitpkg'/>
+  <feature policy='require' name='cet-ss'/>
   <feature policy='require' name='cldemote'/>
   <feature policy='require' name='movdiri'/>
   <feature policy='require' name='movdir64b'/>
@@ -32,6 +33,7 @@
   <feature policy='require' name='md-clear'/>
   <feature policy='require' name='pconfig'/>
   <feature policy='require' name='arch-lbr'/>
+  <feature policy='require' name='cet-ibt'/>
   <feature policy='require' name='stibp'/>
   <feature policy='require' name='flush-l1d'/>
   <feature policy='require' name='core-capability'/>
diff --git a/tests/cputestdata/x86_64-cpuid-Xeon-w7-3465X-host.xml b/tests/cputestdata/x86_64-cpuid-Xeon-w7-3465X-host.xml
index d488c3f971..004af41565 100644
--- a/tests/cputestdata/x86_64-cpuid-Xeon-w7-3465X-host.xml
+++ b/tests/cputestdata/x86_64-cpuid-Xeon-w7-3465X-host.xml
@@ -29,6 +29,7 @@
   <feature name='sha-ni'/>
   <feature name='ospke'/>
   <feature name='waitpkg'/>
+  <feature name='cet-ss'/>
   <feature name='rdpid'/>
   <feature name='bus-lock-detect'/>
   <feature name='cldemote'/>
@@ -41,6 +42,7 @@
   <feature name='tsx-ldtrk'/>
   <feature name='pconfig'/>
   <feature name='arch-lbr'/>
+  <feature name='cet-ibt'/>
   <feature name='amx-bf16'/>
   <feature name='avx512-fp16'/>
   <feature name='amx-tile'/>
diff --git a/tests/domaincapsdata/qemu_11.0.0-q35.x86_64+sgx.xml b/tests/domaincapsdata/qemu_11.0.0-q35.x86_64+sgx.xml
index 1d834a221e..83844c121b 100644
--- a/tests/domaincapsdata/qemu_11.0.0-q35.x86_64+sgx.xml
+++ b/tests/domaincapsdata/qemu_11.0.0-q35.x86_64+sgx.xml
@@ -59,6 +59,7 @@
       <feature policy='require' name='tsc-deadline'/>
       <feature policy='require' name='hypervisor'/>
       <feature policy='require' name='tsc_adjust'/>
+      <feature policy='require' name='cet-ss'/>
       <feature policy='require' name='spec-ctrl'/>
       <feature policy='require' name='stibp'/>
       <feature policy='require' name='flush-l1d'/>
diff --git a/tests/domaincapsdata/qemu_11.0.0-q35.x86_64.xml b/tests/domaincapsdata/qemu_11.0.0-q35.x86_64.xml
index 4b951a5ed4..a6881fcc76 100644
--- a/tests/domaincapsdata/qemu_11.0.0-q35.x86_64.xml
+++ b/tests/domaincapsdata/qemu_11.0.0-q35.x86_64.xml
@@ -59,6 +59,7 @@
       <feature policy='require' name='tsc-deadline'/>
       <feature policy='require' name='hypervisor'/>
       <feature policy='require' name='tsc_adjust'/>
+      <feature policy='require' name='cet-ss'/>
       <feature policy='require' name='spec-ctrl'/>
       <feature policy='require' name='stibp'/>
       <feature policy='require' name='flush-l1d'/>
diff --git a/tests/domaincapsdata/qemu_11.0.0.x86_64+sgx.xml b/tests/domaincapsdata/qemu_11.0.0.x86_64+sgx.xml
index 03b2d78fb5..9ab3a94fb6 100644
--- a/tests/domaincapsdata/qemu_11.0.0.x86_64+sgx.xml
+++ b/tests/domaincapsdata/qemu_11.0.0.x86_64+sgx.xml
@@ -56,6 +56,7 @@
       <feature policy='require' name='tsc-deadline'/>
       <feature policy='require' name='hypervisor'/>
       <feature policy='require' name='tsc_adjust'/>
+      <feature policy='require' name='cet-ss'/>
       <feature policy='require' name='spec-ctrl'/>
       <feature policy='require' name='stibp'/>
       <feature policy='require' name='flush-l1d'/>
diff --git a/tests/domaincapsdata/qemu_11.0.0.x86_64.xml b/tests/domaincapsdata/qemu_11.0.0.x86_64.xml
index 4648a3a071..4c0d3d7692 100644
--- a/tests/domaincapsdata/qemu_11.0.0.x86_64.xml
+++ b/tests/domaincapsdata/qemu_11.0.0.x86_64.xml
@@ -56,6 +56,7 @@
       <feature policy='require' name='tsc-deadline'/>
       <feature policy='require' name='hypervisor'/>
       <feature policy='require' name='tsc_adjust'/>
+      <feature policy='require' name='cet-ss'/>
       <feature policy='require' name='spec-ctrl'/>
       <feature policy='require' name='stibp'/>
       <feature policy='require' name='flush-l1d'/>
diff --git a/tests/qemuxmlconfdata/cpu-host-model-fallback-kvm.x86_64-11.0.0.args b/tests/qemuxmlconfdata/cpu-host-model-fallback-kvm.x86_64-11.0.0.args
index ed23d2bec4..9b336f1bfb 100644
--- a/tests/qemuxmlconfdata/cpu-host-model-fallback-kvm.x86_64-11.0.0.args
+++ b/tests/qemuxmlconfdata/cpu-host-model-fallback-kvm.x86_64-11.0.0.args
@@ -12,7 +12,7 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-QEMUGuest1/master-key.aes"}' \
 -machine pc,usb=off,dump-guest-core=off,memory-backend=pc.ram,acpi=off \
 -accel kvm \
--cpu EPYC-Turin,x2apic=on,tsc-deadline=on,hypervisor=on,tsc-adjust=on,spec-ctrl=on,stibp=on,flush-l1d=on,ssbd=on,virt-ssbd=on,tsa-sq-no=on,tsa-l1-no=on,pcid=off,rdseed=off,la57=off \
+-cpu EPYC-Turin,x2apic=on,tsc-deadline=on,hypervisor=on,tsc-adjust=on,cet-ss=on,spec-ctrl=on,stibp=on,flush-l1d=on,ssbd=on,virt-ssbd=on,tsa-sq-no=on,tsa-l1-no=on,pcid=off,rdseed=off,la57=off \
 -m size=219136k \
 -object '{"qom-type":"memory-backend-ram","id":"pc.ram","size":224395264}' \
 -overcommit mem-lock=off \
diff --git a/tests/qemuxmlconfdata/cpu-host-model-fallback-kvm.x86_64-latest.args b/tests/qemuxmlconfdata/cpu-host-model-fallback-kvm.x86_64-latest.args
index ed23d2bec4..9b336f1bfb 100644
--- a/tests/qemuxmlconfdata/cpu-host-model-fallback-kvm.x86_64-latest.args
+++ b/tests/qemuxmlconfdata/cpu-host-model-fallback-kvm.x86_64-latest.args
@@ -12,7 +12,7 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-QEMUGuest1/master-key.aes"}' \
 -machine pc,usb=off,dump-guest-core=off,memory-backend=pc.ram,acpi=off \
 -accel kvm \
--cpu EPYC-Turin,x2apic=on,tsc-deadline=on,hypervisor=on,tsc-adjust=on,spec-ctrl=on,stibp=on,flush-l1d=on,ssbd=on,virt-ssbd=on,tsa-sq-no=on,tsa-l1-no=on,pcid=off,rdseed=off,la57=off \
+-cpu EPYC-Turin,x2apic=on,tsc-deadline=on,hypervisor=on,tsc-adjust=on,cet-ss=on,spec-ctrl=on,stibp=on,flush-l1d=on,ssbd=on,virt-ssbd=on,tsa-sq-no=on,tsa-l1-no=on,pcid=off,rdseed=off,la57=off \
 -m size=219136k \
 -object '{"qom-type":"memory-backend-ram","id":"pc.ram","size":224395264}' \
 -overcommit mem-lock=off \
diff --git a/tests/qemuxmlconfdata/cpu-host-model-features.x86_64-latest.args b/tests/qemuxmlconfdata/cpu-host-model-features.x86_64-latest.args
index 1c8f99c8d5..d6e95be750 100644
--- a/tests/qemuxmlconfdata/cpu-host-model-features.x86_64-latest.args
+++ b/tests/qemuxmlconfdata/cpu-host-model-features.x86_64-latest.args
@@ -12,7 +12,7 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-QEMUGuest1/master-key.aes"}' \
 -machine pc,usb=off,dump-guest-core=off,memory-backend=pc.ram,acpi=off \
 -accel kvm \
--cpu EPYC-Turin,x2apic=on,tsc-deadline=on,hypervisor=on,tsc-adjust=on,spec-ctrl=on,stibp=on,flush-l1d=on,ssbd=on,virt-ssbd=on,tsa-sq-no=on,tsa-l1-no=on,pcid=off,rdseed=off,la57=off,abm=on,ds=on,invtsc=off \
+-cpu EPYC-Turin,x2apic=on,tsc-deadline=on,hypervisor=on,tsc-adjust=on,cet-ss=on,spec-ctrl=on,stibp=on,flush-l1d=on,ssbd=on,virt-ssbd=on,tsa-sq-no=on,tsa-l1-no=on,pcid=off,rdseed=off,la57=off,abm=on,ds=on,invtsc=off \
 -m size=219136k \
 -object '{"qom-type":"memory-backend-ram","id":"pc.ram","size":224395264}' \
 -overcommit mem-lock=off \
diff --git a/tests/qemuxmlconfdata/cpu-host-model-kvm.x86_64-11.0.0.args b/tests/qemuxmlconfdata/cpu-host-model-kvm.x86_64-11.0.0.args
index df7407e32b..1a77a95efd 100644
--- a/tests/qemuxmlconfdata/cpu-host-model-kvm.x86_64-11.0.0.args
+++ b/tests/qemuxmlconfdata/cpu-host-model-kvm.x86_64-11.0.0.args
@@ -12,7 +12,7 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-QEMUGuest1/master-key.aes"}' \
 -machine q35,usb=off,dump-guest-core=off,memory-backend=pc.ram,acpi=off \
 -accel kvm \
--cpu EPYC-Turin,x2apic=on,tsc-deadline=on,hypervisor=on,tsc-adjust=on,spec-ctrl=on,stibp=on,flush-l1d=on,ssbd=on,virt-ssbd=on,tsa-sq-no=on,tsa-l1-no=on,pcid=off,rdseed=off,la57=off \
+-cpu EPYC-Turin,x2apic=on,tsc-deadline=on,hypervisor=on,tsc-adjust=on,cet-ss=on,spec-ctrl=on,stibp=on,flush-l1d=on,ssbd=on,virt-ssbd=on,tsa-sq-no=on,tsa-l1-no=on,pcid=off,rdseed=off,la57=off \
 -m size=219136k \
 -object '{"qom-type":"memory-backend-ram","id":"pc.ram","size":224395264}' \
 -overcommit mem-lock=off \
diff --git a/tests/qemuxmlconfdata/cpu-host-model-kvm.x86_64-latest.args b/tests/qemuxmlconfdata/cpu-host-model-kvm.x86_64-latest.args
index df7407e32b..1a77a95efd 100644
--- a/tests/qemuxmlconfdata/cpu-host-model-kvm.x86_64-latest.args
+++ b/tests/qemuxmlconfdata/cpu-host-model-kvm.x86_64-latest.args
@@ -12,7 +12,7 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-QEMUGuest1/master-key.aes"}' \
 -machine q35,usb=off,dump-guest-core=off,memory-backend=pc.ram,acpi=off \
 -accel kvm \
--cpu EPYC-Turin,x2apic=on,tsc-deadline=on,hypervisor=on,tsc-adjust=on,spec-ctrl=on,stibp=on,flush-l1d=on,ssbd=on,virt-ssbd=on,tsa-sq-no=on,tsa-l1-no=on,pcid=off,rdseed=off,la57=off \
+-cpu EPYC-Turin,x2apic=on,tsc-deadline=on,hypervisor=on,tsc-adjust=on,cet-ss=on,spec-ctrl=on,stibp=on,flush-l1d=on,ssbd=on,virt-ssbd=on,tsa-sq-no=on,tsa-l1-no=on,pcid=off,rdseed=off,la57=off \
 -m size=219136k \
 -object '{"qom-type":"memory-backend-ram","id":"pc.ram","size":224395264}' \
 -overcommit mem-lock=off \
diff --git a/tests/qemuxmlconfdata/cpu-host-model-nofallback-kvm.x86_64-11.0.0.args b/tests/qemuxmlconfdata/cpu-host-model-nofallback-kvm.x86_64-11.0.0.args
index ed23d2bec4..9b336f1bfb 100644
--- a/tests/qemuxmlconfdata/cpu-host-model-nofallback-kvm.x86_64-11.0.0.args
+++ b/tests/qemuxmlconfdata/cpu-host-model-nofallback-kvm.x86_64-11.0.0.args
@@ -12,7 +12,7 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-QEMUGuest1/master-key.aes"}' \
 -machine pc,usb=off,dump-guest-core=off,memory-backend=pc.ram,acpi=off \
 -accel kvm \
--cpu EPYC-Turin,x2apic=on,tsc-deadline=on,hypervisor=on,tsc-adjust=on,spec-ctrl=on,stibp=on,flush-l1d=on,ssbd=on,virt-ssbd=on,tsa-sq-no=on,tsa-l1-no=on,pcid=off,rdseed=off,la57=off \
+-cpu EPYC-Turin,x2apic=on,tsc-deadline=on,hypervisor=on,tsc-adjust=on,cet-ss=on,spec-ctrl=on,stibp=on,flush-l1d=on,ssbd=on,virt-ssbd=on,tsa-sq-no=on,tsa-l1-no=on,pcid=off,rdseed=off,la57=off \
 -m size=219136k \
 -object '{"qom-type":"memory-backend-ram","id":"pc.ram","size":224395264}' \
 -overcommit mem-lock=off \
diff --git a/tests/qemuxmlconfdata/cpu-host-model-nofallback-kvm.x86_64-latest.args b/tests/qemuxmlconfdata/cpu-host-model-nofallback-kvm.x86_64-latest.args
index ed23d2bec4..9b336f1bfb 100644
--- a/tests/qemuxmlconfdata/cpu-host-model-nofallback-kvm.x86_64-latest.args
+++ b/tests/qemuxmlconfdata/cpu-host-model-nofallback-kvm.x86_64-latest.args
@@ -12,7 +12,7 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-QEMUGuest1/master-key.aes"}' \
 -machine pc,usb=off,dump-guest-core=off,memory-backend=pc.ram,acpi=off \
 -accel kvm \
--cpu EPYC-Turin,x2apic=on,tsc-deadline=on,hypervisor=on,tsc-adjust=on,spec-ctrl=on,stibp=on,flush-l1d=on,ssbd=on,virt-ssbd=on,tsa-sq-no=on,tsa-l1-no=on,pcid=off,rdseed=off,la57=off \
+-cpu EPYC-Turin,x2apic=on,tsc-deadline=on,hypervisor=on,tsc-adjust=on,cet-ss=on,spec-ctrl=on,stibp=on,flush-l1d=on,ssbd=on,virt-ssbd=on,tsa-sq-no=on,tsa-l1-no=on,pcid=off,rdseed=off,la57=off \
 -m size=219136k \
 -object '{"qom-type":"memory-backend-ram","id":"pc.ram","size":224395264}' \
 -overcommit mem-lock=off \
-- 
2.54.0

    