Why Qubes/Xen is masking cet

User Support
1

My Xen CPUID dump shows them:

cet-ibt
cet-ss
cet-sss

Kernel has CONFIG_X86_CET=y

but ibt/shstk is absent in /proc/cpuinfo.

So:

  1. Why it is masked?
  2. Any security drawback to expose it?
  3. When not, is there a way to expose it?