Re: [PATCH v12 00/16] Direct Map Removal Support for guest_memfd

Lorenzo Stoakes
2026-04-21T13:40:23Z

On Fri, Apr 10, 2026 at 03:17:47PM +0000, Kalyazin, Nikita wrote:
> From: Nikita Kalyazin <nikita.kalyazin@linux.dev>
>
> [ based on kvm/next ]

Hm, given this touches a fair bit of mm, I wonder if we shouldn't try to do this
through the mm tree?

In any case, we definitely need a rebase on something not-next :) if not mm then
Linus's tree at least maybe?

I'm seeing a lot of conflicts against mm-unstable, it can't b4 shazam even patch
1 and in Linus's tree it's failing at an mm patch (mm: introduce
AS_NO_DIRECT_MAP).

That and 'KVM: selftests: Add guest_memfd based vm_mem_backing_src_types' won't
apply, but that one's trivial at least.

Obviously we're in the merge window right now so maybe best to do any rebasing a
little after 7.1-rc1?

Cheers, Lorenzo

>
> Unmapping virtual machine guest memory from the host kernel's direct map
> is a successful mitigation against Spectre-style transient execution
> issues: if the kernel page tables do not contain entries pointing to
> guest memory, then any attempted speculative read through the direct map
> will necessarily be blocked by the MMU before any observable
> microarchitectural side-effects happen. This means that Spectre-gadgets
> and similar cannot be used to target virtual machine memory. Roughly
> 60% of speculative execution issues fall into this category [1, Table
> 1].
>
> This patch series extends guest_memfd with the ability to remove its
> memory from the host kernel's direct map, to be able to attain the above
> protection for KVM guests running inside guest_memfd.
>
> Additionally, a Firecracker branch with support for these VMs can be
> found on GitHub [2].
>
> For more details, please refer to the v5 cover letter. No substantial
> changes in design have taken place since.
>
> See also related write() syscall support in guest_memfd [3] where
> the interoperation between the two features is described.
>
> Changes since v11:
> - Ackerley/Sashiko: fix previously missed __set_pages_* argument update
> in __kernel_map_pages (patch 1)
> - David: disallow large folios in folio_zap_direct_map (patch 2)
> - David/Sashiko: check for folio_is_zone_device if mapping is NULL in
> gup_fast_folio_allowed (patch 4)
> - Ackerley/Sashiko: kvm_arch_gmem_supports_no_direct_map to return
> false for SEV-SNP (patch 8).
> - David: replace a redundant check for GUEST_MEMFD_FLAG_NO_DIRECT_MAP
> with a WARN_ON_ONCE (patch 10)
> - David: assert the folio is locked when zapping direct map (patch 10)
> - Ackerley/Sashiko: reorder operations to "zap then prepare" and
> "invalidate then restore" (patch 10)
>
> v11: https://lore.kernel.org/kvm/20260317141031.514-1-kalyazin@amazon.com
> v10: https://lore.kernel.org/kvm/20260126164445.11867-1-kalyazin@amazon.com
> v9: https://lore.kernel.org/kvm/20260114134510.1835-1-kalyazin@amazon.com
> v8: https://lore.kernel.org/kvm/20251205165743.9341-1-kalyazin@amazon.com
> v7: https://lore.kernel.org/kvm/20250924151101.2225820-1-patrick.roy@campus.lmu.de
> v6: https://lore.kernel.org/kvm/20250912091708.17502-1-roypat@amazon.co.uk
> v5: https://lore.kernel.org/kvm/20250828093902.2719-1-roypat@amazon.co.uk
> v4: https://lore.kernel.org/kvm/20250221160728.1584559-1-roypat@amazon.co.uk
> RFCv3: https://lore.kernel.org/kvm/20241030134912.515725-1-roypat@amazon.co.uk
> RFCv2: https://lore.kernel.org/kvm/20240910163038.1298452-1-roypat@amazon.co.uk
> RFCv1: https://lore.kernel.org/kvm/20240709132041.3625501-1-roypat@amazon.co.uk
>
> [1] https://download.vusec.net/papers/quarantine_raid23.pdf
> [2] https://github.com/firecracker-microvm/firecracker/tree/feature/secret-hiding
> [3] https://lore.kernel.org/kvm/20251114151828.98165-1-kalyazin@amazon.com
>
> Nikita Kalyazin (4):
> set_memory: set_direct_map_* to take address
> set_memory: add folio_{zap,restore}_direct_map helpers
> mm/secretmem: make use of folio_{zap,restore}_direct_map
> mm/gup: drop local variable in gup_fast_folio_allowed
>
> Patrick Roy (12):
> mm/gup: drop secretmem optimization from gup_fast_folio_allowed
> mm: introduce AS_NO_DIRECT_MAP
> KVM: guest_memfd: Add stub for kvm_arch_gmem_invalidate
> KVM: x86: define kvm_arch_gmem_supports_no_direct_map()
> KVM: arm64: define kvm_arch_gmem_supports_no_direct_map()
> KVM: guest_memfd: Add flag to remove from direct map
> KVM: selftests: load elf via bounce buffer
> KVM: selftests: set KVM_MEM_GUEST_MEMFD in vm_mem_add() if guest_memfd
> != -1
> KVM: selftests: Add guest_memfd based vm_mem_backing_src_types
> KVM: selftests: cover GUEST_MEMFD_FLAG_NO_DIRECT_MAP in existing
> selftests
> KVM: selftests: stuff vm_mem_backing_src_type into vm_shape
> KVM: selftests: Test guest execution from direct map removed gmem
>
> Documentation/virt/kvm/api.rst | 21 +++---
> arch/arm64/include/asm/kvm_host.h | 13 ++++
> arch/arm64/include/asm/set_memory.h | 7 +-
> arch/arm64/mm/pageattr.c | 19 +++--
> arch/loongarch/include/asm/set_memory.h | 7 +-
> arch/loongarch/mm/pageattr.c | 25 +++----
> arch/riscv/include/asm/set_memory.h | 7 +-
> arch/riscv/mm/pageattr.c | 17 +++--
> arch/s390/include/asm/set_memory.h | 7 +-
> arch/s390/mm/pageattr.c | 13 ++--
> arch/x86/include/asm/kvm_host.h | 6 ++
> arch/x86/include/asm/set_memory.h | 7 +-
> arch/x86/kvm/x86.c | 7 ++
> arch/x86/mm/pat/set_memory.c | 27 +++----
> include/linux/kvm_host.h | 14 ++++
> include/linux/pagemap.h | 16 ++++
> include/linux/secretmem.h | 18 -----
> include/linux/set_memory.h | 22 +++++-
> include/uapi/linux/kvm.h | 1 +
> kernel/power/snapshot.c | 4 +-
> lib/buildid.c | 8 +-
> mm/execmem.c | 6 +-
> mm/gup.c | 47 ++++++------
> mm/memory.c | 45 +++++++++++
> mm/mlock.c | 2 +-
> mm/secretmem.c | 18 ++---
> mm/vmalloc.c | 11 ++-
> .../testing/selftests/kvm/guest_memfd_test.c | 17 ++++-
> .../testing/selftests/kvm/include/kvm_util.h | 37 ++++++---
> .../testing/selftests/kvm/include/test_util.h | 8 ++
> tools/testing/selftests/kvm/lib/elf.c | 8 +-
> tools/testing/selftests/kvm/lib/io.c | 23 ++++++
> tools/testing/selftests/kvm/lib/kvm_util.c | 59 ++++++++-------
> tools/testing/selftests/kvm/lib/test_util.c | 8 ++
> tools/testing/selftests/kvm/lib/x86/sev.c | 1 +
> .../selftests/kvm/pre_fault_memory_test.c | 1 +
> .../selftests/kvm/set_memory_region_test.c | 52 ++++++++++++-
> .../kvm/x86/private_mem_conversions_test.c | 7 +-
> virt/kvm/guest_memfd.c | 75 +++++++++++++++++--
> 39 files changed, 489 insertions(+), 202 deletions(-)
>
>
> base-commit: 24f9515de8778410e4b84c85b196c9850d2c1e18
> --
> 2.50.1
>