vmbus_server: allow channels to require pinned memory

[Sven Groot (SvenGroot)]

This changes adds the ability for a channel to specify, as part of its offer flags, that it requires all external memory used (GPA direct packets and non-ring-buffer GPADLs) to be pinned. This can be used by OpenHCL in case some or all of the VM's memory is VA-backed.

Devices that require pinned memory will have to be updated to set this flag, which is not done in this change. This change only provides the VMBus protocol support, and an environment variable used for testing that enables it for all channels.

[Copilot]

Pull request overview

This PR adds VMBus protocol support for channels to advertise that external memory (GPA direct packets and non-ring-buffer GPADLs) must be pinned, gated behind a negotiated feature flag and optional server-side support. It also introduces an OpenHCL testing knob (env var) to force the offer flag on all channels when the platform supports GPA pinning.

Changes:

• Add a new negotiated feature flag (gpa_pinning) and a new offer flag (require_pinned_external_memory) in the VMBus protocol.
• Plumb server configuration to conditionally advertise/support GPA pinning and optionally force the offer flag for testing.
• Add unit tests validating negotiation behavior and offer-flag masking when the feature is not negotiated.

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
vm/devices/vmbus/vmbus_server/src/lib.rs	Adds builder/control plumbing for “support GPA pinning” and a test-only “force GPA pinning” path during channel offers.
vm/devices/vmbus/vmbus_server/src/channels.rs	Gates negotiation of the new feature flag on server support and masks the new offer flag unless the feature was negotiated.
vm/devices/vmbus/vmbus_server/src/channels/tests.rs	Adds coverage for negotiation gating and offer-flag suppression when not negotiated; updates test harness parameters.
vm/devices/vmbus/vmbus_core/src/protocol.rs	Extends protocol bitfields with FeatureFlags::gpa_pinning and OfferFlags::require_pinned_external_memory.
openhcl/underhill_core/src/worker.rs	Detects platform support and wires it into the VMBus server builder; enables the feature in max-version gating for compatible SKUs.
openhcl/underhill_core/src/options.rs	Adds OPENHCL_VMBUS_FORCE_GPA_PINNING option parsing and documentation for test forcing.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[github-actions]

2 Petri tests failed (0 unstable)

[Copilot]

Pull request overview

Copilot reviewed 8 out of 8 changed files in this pull request and generated no new comments.

[Copilot]

Pull request overview

Copilot reviewed 9 out of 9 changed files in this pull request and generated no new comments.

Suppressed comments (1)

vm/devices/vmbus/vmbus_channel/src/bus.rs:215

• The doc comment says this can only be true for “paravisor channels”, but OpenRequest::new computes is_external_memory_pinned purely from negotiated feature flags + offer flags, and OpenRequest is constructed for all channels (including non-paravisor paths in vmbus_server). This makes the comment misleading; it should describe the actual conditions without asserting a paravisor-only invariant that isn’t enforced here.

    /// Indicates if the currently connected vmbus client is expected to pin any external memory
    /// used by the channel. This is only true if the vmbus client supports GPA pinning and the
    /// channel indicated it requires pinned external memory. It can only be true for paravisor
    /// channels in a VM that supports the GPA pinning hypercalls.

[github-actions]

10 Petri tests failed (0 unstable)

[Copilot]

Pull request overview

Copilot reviewed 9 out of 9 changed files in this pull request and generated no new comments.

Suppressed comments (2)

vm/devices/vmbus/vmbus_channel/src/bus.rs:215

• The doc comment states this can only be true for paravisor channels / when GPA-pinning hypercalls are available, but the value is computed purely from negotiated feature flags and the offer flag. To avoid misleading API docs (and to match what the code actually enforces), reword the comment to describe the precise condition without the extra architectural assertion.

    /// Indicates if the currently connected vmbus client is expected to pin any external memory
    /// used by the channel. This is only true if the vmbus client supports GPA pinning and the
    /// channel indicated it requires pinned external memory. It can only be true for paravisor
    /// channels in a VM that supports the GPA pinning hypercalls.

openhcl/underhill_core/src/options.rs:205

• This test-only flag is analogous to OPENHCL_VMBUS_FORCE_CONFIDENTIAL_EXTERNAL_MEMORY, but it lacks the same warning that enabling it can break devices that don’t implement the feature. Adding an N.B. here helps prevent accidental misuse during testing.

    /// (OPENHCL_VMBUS_FORCE_GPA_PINNING=1)
    /// Force all vmbus channels to use pinned GPA ranges if the guest supports that feature. Used
    /// for testing purposes only.
    pub vmbus_force_gpa_pinning: bool,

[github-actions]

42 Petri tests failed (4 unstable)