[XEN][PATCH 4/5] x86: pvh: allow to disable 32-bit interface support

[Grygorii Strashko <grygorii_strashko@xxxxxxxx>]

From: Grygorii Strashko <grygorii_strashko@xxxxxxxx>

For x86 Xen safety certification only PVH Gusts are selected to be allowed
which are started by using direct Direct Kernel Boot only. There is also an
assumption that x86 Guest's (OS) early boot code (which is running not in
64-bit mode) does not access Xen interfaces (hypercalls, shared_info, ..).

In this case the Xen HVM 32-bit COMPAT interface become unused and leaves
gaps in terms of coverage.

Hence now all prerequisite changes are in place, introduce a
CONFIG_HVM_COMPAT option through which HVM(PVH) 32-bit interface support on
64-bit Xen can be disabled.

By default, CONFIG_HVM_COMPAT is ("y") enabled and accessible only in
EXPERT mode.

Signed-off-by: Grygorii Strashko <grygorii_strashko@xxxxxxxx>
---
 xen/arch/x86/hvm/Kconfig | 19 ++++++++++++++++++-
 1 file changed, 18 insertions(+), 1 deletion(-)

diff --git a/xen/arch/x86/hvm/Kconfig b/xen/arch/x86/hvm/Kconfig
index f10a2b374448..33152f2a6bbe 100644
--- a/xen/arch/x86/hvm/Kconfig
+++ b/xen/arch/x86/hvm/Kconfig
@@ -2,7 +2,6 @@ menuconfig HVM
        bool "HVM support"
        depends on !PV_SHIM_EXCLUSIVE
        default !PV_SHIM
-       select COMPAT
        select IOREQ_SERVER
        select MEM_ACCESS_ALWAYS_ON
        help
@@ -70,4 +69,22 @@ config MEM_PAGING
 config MEM_SHARING
        bool "Xen memory sharing support (UNSUPPORTED)" if UNSUPPORTED
 
+config HVM_COMPAT
+    bool "HVM 32-bit interface support on 64-bit Xen" if EXPERT
+    select COMPAT
+    default y
+    help
+      The HVM 32-bit interface must be enabled for HVM domains to be able to
+      make hypercalls in 32bit mode. Non-PVH domains unconditionally need this
+      option so that hvmloader may issue hypercalls in 32bit mode.
+
+      The HVM 32-bit interface can be disabled if:
+      - Only PVH domains are used
+      - Guests (OS) are started by using direct Direct Kernel Boot
+      - Guests (OS) are 64-bit and Guest early boot code, which is running not
+        in 64-bit mode, does not access Xen interfaces
+        (hypercalls, shared_info, ..)
+
+      If unsure, say Y.
+
 endif
-- 
2.34.1