Can't we even use the hypercall page early in boot? Surely we have to know whether we're running on an Intel or AMD CPU before we get to the point where we can enable any of the new control-flow integrity support? Do we need to jump through those hoops do do that early detection and setup? Enabling the hypercall page is also one of the two points where Xen will 'latch' that the guest is 64-bit, which affects the layout of the shared_info, vcpu_info and runstate structures. The other such latching point is when the guest sets HVM_PARAM_CALLBACK_IRQ, and I *think* that should work in all implementations of the Xen ABI (including QEMU/KVM and EC2). But would want to test. But perhaps it wouldn't hurt for maximal compatibility for Linux to set the hypercall page *anyway*, even if Linux doesn't then use it -- or only uses it during early boot?