v1: https://lore.kernel.org/r/20251023185913.2923322-1-peterx@redhat.com
v2: https://lore.kernel.org/r/20251119172913.577392-1-peterx@redhat.com
v3: https://lore.kernel.org/r/20251215205203.1185099-1-peterx@redhat.com/
v4: https://lore.kernel.org/qemu-devel/20260812201938.198915-1-michael.roth@amd.com/
v5: https://lore.kernel.org/qemu-devel/20260908133151.836685-1-michael.roth@amd.com/
v6:
- Rename the hostmem property to 'x-guest-memfd' since initial users
  are expected to be developers or early enablers (Markus)
- Introduce accompanying 'guest-memfd' RST doc and reference it in
  the QAPI schema documentation for x-guest-memfd (Markus)
- Move all renaming patches toward beginning of the series for
  consistency (David)
- Fix mispellings in commit messages (David)
- Drop ramlist lock in new ram_block_add() error path
- Collect Reviewed-by's
- Rebase on QEMU master

This patchset is also available at:

  https://github.com/amdese/qemu/commits/gmem-shared-mem-v6

and is based on top of qemu master (19b46407ee)


OVERVIEW
========

(cover letter shamelessly adapted from Peter's prior postings)

Recent kernels allow guest_memfd to be initialized with an 'init-shared'
flag that will default to allocating normal/non-private memory that can be
used to back non-confidential VMs.

This allows QEMU to make use of these init-shared guest_memfd instances via
a common memory backend that's usable for either provide a common memory
backend.

On the QEMU side, before this series, guest_memfd was only used for private
guest memory (and thus only applied to confidential VMs), and the guest_memfd
FDs would be created implicitly whenever a confidential environment was
detected/specified.

With this series, users can now explicitly configure QEMU to use guest_memfd
for non-private memory; thus, it can be used for non-confidential
VMs. It also has implications for confidential VMs, since with this series an
init-shared guest_memfd instance can now be specified for the shared memory
while the internally-allocated guest_memfd continues to be used for private
memory. This same infrastructure will also be used as the base for enabling
in-place conversion for confidential VMs, where these separate shared/private
paths will be modified to act on the same underlying guest_memfd instance and
use a unified pool of shared/private memory.

This is initially added as a experimental option since guest-memfd is not a
drop-in replacement for memfd (e.g. no hugepage support), however it will
be useful for non-experimental purposes once in-place conversion support is
added to QEMU for Confidential Guests[1], and is useful for early
enablement/testing of other features relating guest-memfd. The
guest-memfd.rst documentation introduced in this series documents these in
more detail.


IMPLEMENTATION
==============

In the current patchset, I reused the memory-backend-memfd object, rather
than creating a new type of object.  After all, guest-memfd (at least from
userspace POV) works similarly like a memfd, except that it was tailored
for VM's use case. While there is potential that new guest_memfd features
may eventually necessitate introducing a dedicated guest_memfd memory
backend object, for now the memory-backend-memfd object is a good fit for
the current feature set.

This will also make it easier when in-place conversion comes around, since
confidential VMs typically already use memory-backend-memfd for their shared
memory, so by also making using that approach to specify the guest_memfd
backend for in-place conversion the command-line syntax remains similar, and
even allow choosing between memfd vs. guest_memfd to be handled automatically
based on whether or not we're dealing with a Confidential VM with in-place
conversion enabled.

Now, instead of using a normal memfd backend using:

  -object memory-backend-memfd,id=ID,size=SIZE,share=on

One can also boot a VM with guest-memfd:

  -object memory-backend-memfd,id=ID,size=SIZE,share=on,x-guest-memfd=on

The init-shared guest-memfd relies on a recent kernel (6.18+). When run it on
an older qemu, you'll see errors like:

  qemu-system-x86_64: KVM does not support guest_memfd

One thing to mention is live migration is by default supported, however
postcopy is still currently not supported.  The postcopy support will have
some kernel dependency work to be merged in Linux first.

REFERENCES
==========

[0] https://lore.kernel.org/qemu-devel/20260908205236.838281-1-michael.roth@amd.com/

Thanks,

Mike

----------------------------------------------------------------
Peter Xu (11):
      kvm: Detect guest-memfd flags supported
      kvm: Provide explicit error for kvm_create_guest_memfd()
      ramblock: Rename guest_memfd to guest_memfd_private
      memory: Rename RAM_GUEST_MEMFD to RAM_GUEST_MEMFD_PRIVATE
      memory: Rename memory_region_has_guest_memfd() to *_private()
      hostmem: Rename guest_memfd to guest_memfd_private
      machine: Rename machine_require_guest_memfd() to *_private()
      memory: Rename memory_region_init_ram_guest_memfd() to *_private()
      hostmem: Support fully shared guest memfd to back a VM
      tests/migration-test: Support guest-memfd init shared mem type
      tests/migration-test: Add a precopy test for guest-memfd

Xiaoyao Li (1):
      kvm: Decouple memory attribute check from kvm_guest_memfd_supported

 accel/kvm/kvm-all.c                        | 37 +++++++++++++---
 accel/stubs/kvm-stub.c                     |  6 +++
 backends/hostmem-file.c                    |  2 +-
 backends/hostmem-memfd.c                   | 69 +++++++++++++++++++++++++++---
 backends/hostmem-ram.c                     |  2 +-
 backends/hostmem-shm.c                     |  2 +-
 backends/hostmem.c                         |  2 +-
 backends/igvm.c                            |  4 +-
 docs/system/confidential-guest-support.rst |  2 +
 docs/system/guest-memfd.rst                | 60 ++++++++++++++++++++++++++
 docs/system/index.rst                      |  1 +
 hw/core/machine.c                          |  2 +-
 hw/i386/pc.c                               |  6 +--
 hw/i386/pc_sysfw.c                         |  8 ++--
 hw/i386/x86-common.c                       |  8 ++--
 include/hw/core/boards.h                   |  2 +-
 include/system/hostmem.h                   |  2 +-
 include/system/kvm.h                       |  1 +
 include/system/memory.h                    | 27 ++++++------
 include/system/ramblock.h                  |  9 +++-
 qapi/qom.json                              |  7 ++-
 system/memory.c                            | 14 +++---
 system/physmem.c                           | 52 +++++++++++++---------
 target/i386/kvm/kvm.c                      |  3 +-
 tests/qtest/migration/framework.c          | 60 ++++++++++++++++++++++++++
 tests/qtest/migration/framework.h          |  4 ++
 tests/qtest/migration/precopy-tests.c      |  9 ++++
 27 files changed, 325 insertions(+), 76 deletions(-)
 create mode 100644 docs/system/guest-memfd.rst

On Thu, Sep 24, 2026 at 08:43:06PM -0500, Michael Roth wrote:
> v1: https://lore.kernel.org/r/20251023185913.2923322-1-peterx@redhat.com
> v2: https://lore.kernel.org/r/20251119172913.577392-1-peterx@redhat.com
> v3: https://lore.kernel.org/r/20251215205203.1185099-1-peterx@redhat.com/
> v4: https://lore.kernel.org/qemu-devel/20260812201938.198915-1-michael.roth@amd.com/
> v5: https://lore.kernel.org/qemu-devel/20260908133151.836685-1-michael.roth@amd.com/
> v6:
> - Rename the hostmem property to 'x-guest-memfd' since initial users
>   are expected to be developers or early enablers (Markus)
> - Introduce accompanying 'guest-memfd' RST doc and reference it in
>   the QAPI schema documentation for x-guest-memfd (Markus)
> - Move all renaming patches toward beginning of the series for
>   consistency (David)
> - Fix mispellings in commit messages (David)
> - Drop ramlist lock in new ram_block_add() error path
> - Collect Reviewed-by's
> - Rebase on QEMU master

Michael,

Sorry, I missed your very last discussion with Markus..  only notice until
I saw the repost.  I agree we can mark it experimental, but just to mention
we should have moved to use "unstable" rather than prefix "x-", then we
don't need to bother with the ABI change, see:

    commit a3c45b3e62962f99338716b1347cfb0d427cea44
    Author: Markus Armbruster <armbru@redhat.com>
    Date:   Thu Oct 28 12:25:12 2021 +0200

    qapi: New special feature flag "unstable"

No need for another repost, I can manage that with two fixups when queue,
please shoot if there's any objections.  Attached at the end.

Thanks,

===8<===
From 94884f136d9d42044e3f4cfcf440df8016ad3e99 Mon Sep 17 00:00:00 2001
From: Peter Xu <peterx@redhat.com>
Date: Fri, 25 Sep 2026 08:51:13 -0400
Subject: [PATCH 1/2] fixup! hostmem: Support fully shared guest memfd to back
 a VM

Signed-off-by: Peter Xu <peterx@redhat.com>
---
 docs/system/guest-memfd.rst |  4 ++--
 qapi/qom.json               |  9 +++++++--
 backends/hostmem-memfd.c    | 10 +++++-----
 3 files changed, 14 insertions(+), 9 deletions(-)

diff --git a/docs/system/guest-memfd.rst b/docs/system/guest-memfd.rst
index f7cef19283..d62a214a91 100644
--- a/docs/system/guest-memfd.rst
+++ b/docs/system/guest-memfd.rst
@@ -38,10 +38,10 @@ exposed by QEMU command-line options.
 For non-Confidential guests, guest-memfd can be used in a manner that
 is somewhat interchangeable with a normal memfd. Currently, this is
 handled by using the same memory-backend implementation as memfd, but
-with an additional 'x-guest-memfd=on' option. E.g.::
+with an additional 'guest-memfd=on' option. E.g.::
 
     qemu ... \
-      -object memory-backend-memfd,id=ID,size=SIZE,share=on,x-guest-memfd=on
+      -object memory-backend-memfd,id=ID,size=SIZE,share=on,guest-memfd=on
 
 Note that the share=on option is required for guest-memfd, since it
 does not support anonymous memory allocations or COW-like semantics.
diff --git a/qapi/qom.json b/qapi/qom.json
index 602b17ad83..7423acea8f 100644
--- a/qapi/qom.json
+++ b/qapi/qom.json
@@ -780,10 +780,14 @@
 # @seal: if true, create a sealed-file, which will block further
 #     resizing of the memory (default: true)
 #
-# @x-guest-memfd: if 'on', use guest-memfd to back the memory region.
+# @guest-memfd: if 'on', use guest-memfd to back the memory region.
 #     See the "guest-memfd" QEMU documentation for more details.
 #     (default: auto, since: 11.2)
 #
+# Features:
+#
+# @unstable: Member @guest-memfd is experimental.
+#
 # Since: 2.12
 ##
 { 'struct': 'MemoryBackendMemfdProperties',
@@ -791,7 +795,8 @@
   'data': { '*hugetlb': 'bool',
             '*hugetlbsize': 'size',
             '*seal': 'bool',
-            '*x-guest-memfd': 'OnOffAuto' },
+            '*guest-memfd': { 'type': 'OnOffAuto',
+                              'features': [ 'unstable' ] } },
   'if': 'CONFIG_LINUX' }
 
 ##
diff --git a/backends/hostmem-memfd.c b/backends/hostmem-memfd.c
index a164bb659f..666593ff6c 100644
--- a/backends/hostmem-memfd.c
+++ b/backends/hostmem-memfd.c
@@ -59,14 +59,14 @@ memfd_backend_memory_alloc(HostMemoryBackend *backend, Error **errp)
 
     if (m->guest_memfd == ON_OFF_AUTO_ON) {
         /*
-         * NOTE: x-guest-memfd ignores seal=on/off because it always
+         * NOTE: guest-memfd ignores seal=on/off because it always
          * implicitly seals the FD by definition.
          */
         if (!backend->share) {
-            error_setg(errp, "x-guest-memfd=on must be used with share=on");
+            error_setg(errp, "guest-memfd=on must be used with share=on");
             return false;
         } else if (m->hugetlb) {
-            error_setg(errp, "x-guest-memfd=on doesn't support hugetlb=on");
+            error_setg(errp, "guest-memfd=on doesn't support hugetlb=on");
             return false;
         }
 
@@ -203,10 +203,10 @@ memfd_backend_class_init(ObjectClass *oc, const void *data)
                                               "Huge pages size (ex: 2M, 1G)");
     }
 
-    object_class_property_add(oc, "x-guest-memfd", "OnOffAuto",
+    object_class_property_add(oc, "guest-memfd", "OnOffAuto",
                               memfd_backend_get_guest_memfd,
                               memfd_backend_set_guest_memfd, NULL, NULL);
-    object_class_property_set_description(oc, "x-guest-memfd",
+    object_class_property_set_description(oc, "guest-memfd",
                                           "Use guest memfd");
 
     object_class_property_add_bool(oc, "seal",
-- 
2.55.0


From efb5a9d33373e0dcedbfec3dce28844164ccb8c8 Mon Sep 17 00:00:00 2001
From: Peter Xu <peterx@redhat.com>
Date: Fri, 25 Sep 2026 08:51:26 -0400
Subject: [PATCH 2/2] fixup! tests/migration-test: Support guest-memfd init
 shared mem type

Signed-off-by: Peter Xu <peterx@redhat.com>
---
 tests/qtest/migration/framework.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tests/qtest/migration/framework.c b/tests/qtest/migration/framework.c
index 93225e3720..b7aef6b21c 100644
--- a/tests/qtest/migration/framework.c
+++ b/tests/qtest/migration/framework.c
@@ -301,7 +301,7 @@ static char *migrate_mem_type_get_opts(MemType type, const char *memory_size)
         backend = g_strdup("-object memory-backend-memfd");
         break;
     case MEM_TYPE_GUEST_MEMFD:
-        backend = g_strdup("-object memory-backend-memfd,x-guest-memfd=on");
+        backend = g_strdup("-object memory-backend-memfd,guest-memfd=on");
         break;
     default:
         g_assert_not_reached();
-- 
2.55.0



-- 
Peter Xu