Re: [RFC][PATCH 24/24] [DO NOT MERGE] x86/shstk: Depend out everything incompatible with kernel shadow stacks

[Andrew Cooper]

On 21/10/2026 8:51 pm, Dave Hansen wrote:
> diff -puN arch/x86/Kconfig~kshstk-kconfig-depend-out-incompatible arch/x86/Kconfig
> --- a/arch/x86/Kconfig~kshstk-kconfig-depend-out-incompatible	2026-10-21 12:36:44.598893837 -0700
> +++ b/arch/x86/Kconfig	2026-10-21 12:36:44.601893842 -0700
> @@ -1873,6 +1907,79 @@ config X86_KERN_SHADOW_STACK
>  	depends on VMAP_STACK
>  	depends on AS_WRUSS
>  	select X86_CET
> <snip>
> +	# PV guests run the kernel in ring 3 without FRED. Kernel shadow
> +	# stacks are FRED-only.
> +	depends on !XEN_PV

Xen PV guests will not see FRET or CET_SS/CET_IBT in CPUID, because the
features as a whole are incompatible with a kernel running in Ring3.

This is not a restriction/dependency that Linux should be putting in place.

~Andrew