Re: [RFC][PATCH 24/24] [DO NOT MERGE] x86/shstk: Depend out everything incompatible with kernel shadow stacks

[Andrew Cooper]

On 22/10/2026 10:35 pm, Andrew Cooper wrote:
> On 21/10/2026 8:51 pm, Dave Hansen wrote:
>> diff -puN arch/x86/Kconfig~kshstk-kconfig-depend-out-incompatible arch/x86/Kconfig
>> --- a/arch/x86/Kconfig~kshstk-kconfig-depend-out-incompatible	2026-10-21 12:36:44.598893837 -0700
>> +++ b/arch/x86/Kconfig	2026-10-21 12:36:44.601893842 -0700
>> @@ -1873,6 +1907,79 @@ config X86_KERN_SHADOW_STACK
>>  	depends on VMAP_STACK
>>  	depends on AS_WRUSS
>>  	select X86_CET
>> <snip>
>> +	# PV guests run the kernel in ring 3 without FRED. Kernel shadow
>> +	# stacks are FRED-only.
>> +	depends on !XEN_PV
> Xen PV guests will not see FRET or CET_SS/CET_IBT in CPUID, because the
> features as a whole are incompatible with a kernel running in Ring3.
>
> This is not a restriction/dependency that Linux should be putting in place.
>
> ~Andrew

P.S.  They won't see FRED either...