Introduce the physaddr_abi flag to indicate that the guest uses
physical addresses (gpaddr) instead of virtual addresses when
performing hypercalls.

Signed-off-by: Teddy Astie <teddy.astie@vates.tech>
---
 xen/common/domain.c         | 10 +++++++++-
 xen/include/public/domctl.h |  4 +++-
 xen/include/xen/sched.h     |  6 ++++++
 3 files changed, 18 insertions(+), 2 deletions(-)

diff --git a/xen/common/domain.c b/xen/common/domain.c
index 585fd726a9..1a1e51c32d 100644
--- a/xen/common/domain.c
+++ b/xen/common/domain.c
@@ -716,12 +716,14 @@ static int sanitise_domain_config(struct xen_domctl_createdomain *config)
     bool hap = config->flags & XEN_DOMCTL_CDF_hap;
     bool iommu = config->flags & XEN_DOMCTL_CDF_iommu;
     bool vpmu = config->flags & XEN_DOMCTL_CDF_vpmu;
+    bool physaddr_abi = config->flags & XEN_DOMCTL_CDF_physaddr_abi;
 
     if ( config->flags &
          ~(XEN_DOMCTL_CDF_hvm | XEN_DOMCTL_CDF_hap |
            XEN_DOMCTL_CDF_s3_integrity | XEN_DOMCTL_CDF_oos_off |
            XEN_DOMCTL_CDF_xs_domain | XEN_DOMCTL_CDF_iommu |
-           XEN_DOMCTL_CDF_nested_virt | XEN_DOMCTL_CDF_vpmu) )
+           XEN_DOMCTL_CDF_nested_virt | XEN_DOMCTL_CDF_vpmu |
+           XEN_DOMCTL_CDF_physaddr_abi) )
     {
         dprintk(XENLOG_INFO, "Unknown CDF flags %#x\n", config->flags);
         return -EINVAL;
@@ -745,6 +747,12 @@ static int sanitise_domain_config(struct xen_domctl_createdomain *config)
         return -EINVAL;
     }
 
+    if ( physaddr_abi && !hvm )
+    {
+        dprintk(XENLOG_INFO, "Physical address ABI requested for non-HVM guest");
+        return -EINVAL;
+    }
+
     if ( iommu )
     {
         if ( config->iommu_opts & ~XEN_DOMCTL_IOMMU_no_sharept )
diff --git a/xen/include/public/domctl.h b/xen/include/public/domctl.h
index 5b2063eed9..3a77efe673 100644
--- a/xen/include/public/domctl.h
+++ b/xen/include/public/domctl.h
@@ -66,9 +66,11 @@ struct xen_domctl_createdomain {
 #define XEN_DOMCTL_CDF_nested_virt    (1U << _XEN_DOMCTL_CDF_nested_virt)
 /* Should we expose the vPMU to the guest? */
 #define XEN_DOMCTL_CDF_vpmu           (1U << 7)
+/* Do the guest use physical addresses for hypercalls ? */
+#define XEN_DOMCTL_CDF_physaddr_abi   (1U << 8)
 
 /* Max XEN_DOMCTL_CDF_* constant.  Used for ABI checking. */
-#define XEN_DOMCTL_CDF_MAX XEN_DOMCTL_CDF_vpmu
+#define XEN_DOMCTL_CDF_MAX XEN_DOMCTL_CDF_physaddr_abi
 
     uint32_t flags;
 
diff --git a/xen/include/xen/sched.h b/xen/include/xen/sched.h
index 559d201e0c..a29c63c737 100644
--- a/xen/include/xen/sched.h
+++ b/xen/include/xen/sched.h
@@ -1201,6 +1201,12 @@ static always_inline bool hap_enabled(const struct domain *d)
         evaluate_nospec(d->options & XEN_DOMCTL_CDF_hap);
 }
 
+static always_inline bool is_hvm_physaddr_abi(const struct domain *d)
+{
+    return IS_ENABLED(CONFIG_HVM) &&
+        evaluate_nospec(d->options & XEN_DOMCTL_CDF_physaddr_abi);
+}
+
 static inline bool is_hwdom_pinned_vcpu(const struct vcpu *v)
 {
     return (is_hardware_domain(v->domain) &&
-- 
2.47.2



Teddy Astie | Vates XCP-ng Developer

XCP-ng & Xen Orchestra - Vates solutions

web: https://vates.tech

On 18.04.2025 16:18, Teddy Astie wrote:
> @@ -745,6 +747,12 @@ static int sanitise_domain_config(struct xen_domctl_createdomain *config)
>          return -EINVAL;
>      }
>  
> +    if ( physaddr_abi && !hvm )
> +    {
> +        dprintk(XENLOG_INFO, "Physical address ABI requested for non-HVM guest");
> +        return -EINVAL;
> +    }

Why this restriction?

Jan

Le 30/04/2025 à 17:59, Jan Beulich a écrit :
> On 18.04.2025 16:18, Teddy Astie wrote:
>> @@ -745,6 +747,12 @@ static int sanitise_domain_config(struct xen_domctl_createdomain *config)
>>           return -EINVAL;
>>       }
>>   
>> +    if ( physaddr_abi && !hvm )
>> +    {
>> +        dprintk(XENLOG_INFO, "Physical address ABI requested for non-HVM guest");
>> +        return -EINVAL;
>> +    }

> 
> Why this restriction?
> 

physaddr_abi changes how copy_from/to_guest works to make it use GPA 
instead of GVA. As non-HVM probably means PV guest, it would mean 
something like PV guest hypercalls uses physical addresses (derived from 
MFN?) instead of virtual addresses, which would not really be practical 
for both the guest and the hypervisor.

> Jan
> 

Teddy


Teddy Astie | Vates XCP-ng Developer

XCP-ng & Xen Orchestra - Vates solutions

web: https://vates.tech

On 02.05.2025 13:55, Teddy Astie wrote:
> Le 30/04/2025 à 17:59, Jan Beulich a écrit :
>> On 18.04.2025 16:18, Teddy Astie wrote:
>>> @@ -745,6 +747,12 @@ static int sanitise_domain_config(struct xen_domctl_createdomain *config)
>>>           return -EINVAL;
>>>       }
>>>   
>>> +    if ( physaddr_abi && !hvm )
>>> +    {
>>> +        dprintk(XENLOG_INFO, "Physical address ABI requested for non-HVM guest");
>>> +        return -EINVAL;
>>> +    }
> 
>>
>> Why this restriction?
>>
> 
> physaddr_abi changes how copy_from/to_guest works to make it use GPA 
> instead of GVA. As non-HVM probably means PV guest, it would mean 
> something like PV guest hypercalls uses physical addresses (derived from 
> MFN?)

Machine addresses, yes (hence MFN). If it was PFNs / (pseudo-)physical
addresses, ...

> instead of virtual addresses, which would not really be practical 
> for both the guest and the hypervisor.

... I'd maybe agree here.

Jan