[XEN][PATCH v2 4/4] x86: pvh: allow to disable 32-bit interface support

[Grygorii Strashko <grygorii_strashko@epam.com>]

From: Grygorii Strashko <grygorii_strashko@epam.com>

For x86 Xen safety certification only PVH Gusts are selected to be allowed
which are started by using direct Direct Kernel Boot only. There is also an
assumption that x86 Guest's (OS) early boot code (which is running not in
64-bit mode) does not access Xen interfaces (hypercalls, shared_info, ..).

In this case the Xen HVM 32-bit COMPAT interface become unused and leaves
gaps in terms of coverage.

Hence now all prerequisite changes are in place, introduce a
CONFIG_HVM_COMPAT option through which HVM(PVH) 32-bit interface support on
64-bit Xen can be disabled.

By default, CONFIG_HVM_COMPAT is ("y") enabled and accessible only in
EXPERT mode.

Signed-off-by: Grygorii Strashko <grygorii_strashko@epam.com>
---
changes in v2:
- fix format and move above HVM_FEP

 xen/arch/x86/hvm/Kconfig | 19 ++++++++++++++++++-
 1 file changed, 18 insertions(+), 1 deletion(-)

diff --git a/xen/arch/x86/hvm/Kconfig b/xen/arch/x86/hvm/Kconfig
index c323d767e77c..88090f5b3965 100644
--- a/xen/arch/x86/hvm/Kconfig
+++ b/xen/arch/x86/hvm/Kconfig
@@ -2,7 +2,6 @@ menuconfig HVM
 	bool "HVM support"
 	depends on !PV_SHIM_EXCLUSIVE
 	default !PV_SHIM
-	select COMPAT
 	select IOREQ_SERVER
 	select MEM_ACCESS_ALWAYS_ON
 	help
@@ -35,6 +34,24 @@ config INTEL_VMX
 	  If your system includes a processor with Intel VT-x support, say Y.
 	  If in doubt, say Y.
 
+config HVM_COMPAT
+	bool "HVM 32-bit hypercalls interface support" if EXPERT
+	select COMPAT
+	default y
+	help
+	  The HVM 32-bit interface must be enabled for HVM domains to be able to
+	  make hypercalls in 32bit mode. Non-PVH domains unconditionally need this
+	  option so that hvmloader may issue hypercalls in 32bit mode.
+
+	  The HVM 32-bit interface can be disabled if:
+	  - Only PVH domains are used
+	  - Guests (OS) are started by using direct Direct Kernel Boot
+	  - Guests (OS) are 64-bit and Guest early boot code, which is running not
+	    in 64-bit mode, does not access Xen interfaces
+	    (hypercalls, shared_info, ..)
+
+	  If unsure, say Y.
+
 config HVM_FEP
 	bool "HVM Forced Emulation Prefix support (UNSUPPORTED)" if UNSUPPORTED
 	default DEBUG
-- 
2.34.1