* Deepak Gupta:

In case of shadow stack, it similar situation. If enabled compiler
decides to insert sspush and sspopchk. They necessarily won't be
prologue or epilogue but somewhere in function body as deemed fit by
compiler, thus increasing the complexity of runtime patching.

More so, here are wishing for kernel to do this patching for usermode
vDSO when there is no guarantee of such of rest of usermode (which if
was compiled with shadow stack would have faulted before vDSO's
sspush/sspopchk if ran on pre-zimop hardware)

I think this capability is desirable so that you can use a distribution
kernel during CFI userspace bringup.

Thanks,
Florian