Re: [PATCH v12 00/16] Direct Map Removal Support for guest_memfd

[Lorenzo Stoakes <ljs@kernel.org>]

On Fri, Apr 10, 2026 at 03:17:47PM +0000, Kalyazin, Nikita wrote:
> From: Nikita Kalyazin <nikita.kalyazin@linux.dev>
>
> [ based on kvm/next ]

Hm, given this touches a fair bit of mm, I wonder if we shouldn't try to do this
through the mm tree?

In any case, we definitely need a rebase on something not-next :) if not mm then
Linus's tree at least maybe?

I'm seeing a lot of conflicts against mm-unstable, it can't b4 shazam even patch
1 and in Linus's tree it's failing at an mm patch (mm: introduce
AS_NO_DIRECT_MAP).

That and 'KVM: selftests: Add guest_memfd based vm_mem_backing_src_types' won't
apply, but that one's trivial at least.

Obviously we're in the merge window right now so maybe best to do any rebasing a
little after 7.1-rc1?

Cheers, Lorenzo

>
> Unmapping virtual machine guest memory from the host kernel's direct map
> is a successful mitigation against Spectre-style transient execution
> issues: if the kernel page tables do not contain entries pointing to
> guest memory, then any attempted speculative read through the direct map
> will necessarily be blocked by the MMU before any observable
> microarchitectural side-effects happen.  This means that Spectre-gadgets
> and similar cannot be used to target virtual machine memory.  Roughly
> 60% of speculative execution issues fall into this category [1, Table
> 1].
>
> This patch series extends guest_memfd with the ability to remove its
> memory from the host kernel's direct map, to be able to attain the above
> protection for KVM guests running inside guest_memfd.
>
> Additionally, a Firecracker branch with support for these VMs can be
> found on GitHub [2].
>
> For more details, please refer to the v5 cover letter.  No substantial
> changes in design have taken place since.
>
> See also related write() syscall support in guest_memfd [3] where
> the interoperation between the two features is described.
>
> Changes since v11:
>  - Ackerley/Sashiko: fix previously missed __set_pages_* argument update
>    in __kernel_map_pages (patch 1)
>  - David: disallow large folios in folio_zap_direct_map (patch 2)
>  - David/Sashiko: check for folio_is_zone_device if mapping is NULL in
>    gup_fast_folio_allowed (patch 4)
>  - Ackerley/Sashiko: kvm_arch_gmem_supports_no_direct_map to return
>    false for SEV-SNP (patch 8).
>  - David: replace a redundant check for GUEST_MEMFD_FLAG_NO_DIRECT_MAP
>    with a WARN_ON_ONCE (patch 10)
>  - David: assert the folio is locked when zapping direct map (patch 10)
>  - Ackerley/Sashiko: reorder operations to "zap then prepare" and
>    "invalidate then restore" (patch 10)
>
> v11: https://lore.kernel.org/kvm/20260317141031.514-1-kalyazin@amazon.com
> v10: https://lore.kernel.org/kvm/20260126164445.11867-1-kalyazin@amazon.com
> v9: https://lore.kernel.org/kvm/20260114134510.1835-1-kalyazin@amazon.com
> v8: https://lore.kernel.org/kvm/20251205165743.9341-1-kalyazin@amazon.com
> v7: https://lore.kernel.org/kvm/20250924151101.2225820-1-patrick.roy@campus.lmu.de
> v6: https://lore.kernel.org/kvm/20250912091708.17502-1-roypat@amazon.co.uk
> v5: https://lore.kernel.org/kvm/20250828093902.2719-1-roypat@amazon.co.uk
> v4: https://lore.kernel.org/kvm/20250221160728.1584559-1-roypat@amazon.co.uk
> RFCv3: https://lore.kernel.org/kvm/20241030134912.515725-1-roypat@amazon.co.uk
> RFCv2: https://lore.kernel.org/kvm/20240910163038.1298452-1-roypat@amazon.co.uk
> RFCv1: https://lore.kernel.org/kvm/20240709132041.3625501-1-roypat@amazon.co.uk
>
> [1] https://download.vusec.net/papers/quarantine_raid23.pdf
> [2] https://github.com/firecracker-microvm/firecracker/tree/feature/secret-hiding
> [3] https://lore.kernel.org/kvm/20251114151828.98165-1-kalyazin@amazon.com
>
> Nikita Kalyazin (4):
>   set_memory: set_direct_map_* to take address
>   set_memory: add folio_{zap,restore}_direct_map helpers
>   mm/secretmem: make use of folio_{zap,restore}_direct_map
>   mm/gup: drop local variable in gup_fast_folio_allowed
>
> Patrick Roy (12):
>   mm/gup: drop secretmem optimization from gup_fast_folio_allowed
>   mm: introduce AS_NO_DIRECT_MAP
>   KVM: guest_memfd: Add stub for kvm_arch_gmem_invalidate
>   KVM: x86: define kvm_arch_gmem_supports_no_direct_map()
>   KVM: arm64: define kvm_arch_gmem_supports_no_direct_map()
>   KVM: guest_memfd: Add flag to remove from direct map
>   KVM: selftests: load elf via bounce buffer
>   KVM: selftests: set KVM_MEM_GUEST_MEMFD in vm_mem_add() if guest_memfd
>     != -1
>   KVM: selftests: Add guest_memfd based vm_mem_backing_src_types
>   KVM: selftests: cover GUEST_MEMFD_FLAG_NO_DIRECT_MAP in existing
>     selftests
>   KVM: selftests: stuff vm_mem_backing_src_type into vm_shape
>   KVM: selftests: Test guest execution from direct map removed gmem
>
>  Documentation/virt/kvm/api.rst                | 21 +++---
>  arch/arm64/include/asm/kvm_host.h             | 13 ++++
>  arch/arm64/include/asm/set_memory.h           |  7 +-
>  arch/arm64/mm/pageattr.c                      | 19 +++--
>  arch/loongarch/include/asm/set_memory.h       |  7 +-
>  arch/loongarch/mm/pageattr.c                  | 25 +++----
>  arch/riscv/include/asm/set_memory.h           |  7 +-
>  arch/riscv/mm/pageattr.c                      | 17 +++--
>  arch/s390/include/asm/set_memory.h            |  7 +-
>  arch/s390/mm/pageattr.c                       | 13 ++--
>  arch/x86/include/asm/kvm_host.h               |  6 ++
>  arch/x86/include/asm/set_memory.h             |  7 +-
>  arch/x86/kvm/x86.c                            |  7 ++
>  arch/x86/mm/pat/set_memory.c                  | 27 +++----
>  include/linux/kvm_host.h                      | 14 ++++
>  include/linux/pagemap.h                       | 16 ++++
>  include/linux/secretmem.h                     | 18 -----
>  include/linux/set_memory.h                    | 22 +++++-
>  include/uapi/linux/kvm.h                      |  1 +
>  kernel/power/snapshot.c                       |  4 +-
>  lib/buildid.c                                 |  8 +-
>  mm/execmem.c                                  |  6 +-
>  mm/gup.c                                      | 47 ++++++------
>  mm/memory.c                                   | 45 +++++++++++
>  mm/mlock.c                                    |  2 +-
>  mm/secretmem.c                                | 18 ++---
>  mm/vmalloc.c                                  | 11 ++-
>  .../testing/selftests/kvm/guest_memfd_test.c  | 17 ++++-
>  .../testing/selftests/kvm/include/kvm_util.h  | 37 ++++++---
>  .../testing/selftests/kvm/include/test_util.h |  8 ++
>  tools/testing/selftests/kvm/lib/elf.c         |  8 +-
>  tools/testing/selftests/kvm/lib/io.c          | 23 ++++++
>  tools/testing/selftests/kvm/lib/kvm_util.c    | 59 ++++++++-------
>  tools/testing/selftests/kvm/lib/test_util.c   |  8 ++
>  tools/testing/selftests/kvm/lib/x86/sev.c     |  1 +
>  .../selftests/kvm/pre_fault_memory_test.c     |  1 +
>  .../selftests/kvm/set_memory_region_test.c    | 52 ++++++++++++-
>  .../kvm/x86/private_mem_conversions_test.c    |  7 +-
>  virt/kvm/guest_memfd.c                        | 75 +++++++++++++++++--
>  39 files changed, 489 insertions(+), 202 deletions(-)
>
>
> base-commit: 24f9515de8778410e4b84c85b196c9850d2c1e18
> --
> 2.50.1
>