feat(memfd): allow using memfd to back guest memory

Allow backing guest memory using memfd regardless of vhost-user setup.
The option is controlled by a field in the memory backend property of the
/snapshot/load endpoint. Using memfd is currently valid only for the
UFFD backend.

Author: bchalios

blah.sh

@@ -0,0 +1 @@
+claude --resume 683a5ffd-bcab-425e-9434-2ff90a83a8ad

src/firecracker/src/api_server/request/snapshot.rs

@@ -91,13 +91,21 @@ fn parse_put_snapshot_load(body: &Body) -> Result<ParsedRequest, RequestError> {
     // If `mem_file_path` is specified instead of `mem_backend`, we construct the
     // `MemBackendConfig` object from the path specified, with `File` as backend type.
     let mem_backend = match snapshot_config.mem_backend {
-        Some(backend_cfg) => backend_cfg,
+        Some(backend_cfg) => {
+            if backend_cfg.use_memfd && backend_cfg.backend_type != MemBackendType::Uffd {
+                return Err(RequestError::SerdeJson(serde_json::Error::custom(
+                    "use_memfd is only valid when backend_type is Uffd",
+                )));
+            }
+            backend_cfg
+        }
         None => {
             MemBackendConfig {
                 // This is safe to unwrap() because we ensure above that one of the two:
                 // either `mem_file_path` or `mem_backend` field is always specified.
                 backend_path: snapshot_config.mem_file_path.unwrap(),
                 backend_type: MemBackendType::File,
+                use_memfd: false,
             }
         }
     };
@@ -184,6 +192,7 @@ mod tests {
             mem_backend: MemBackendConfig {
                 backend_path: PathBuf::from("bar"),
                 backend_type: MemBackendType::File,
+                use_memfd: false,
             },
             track_dirty_pages: false,
             resume_vm: false,
@@ -215,6 +224,7 @@ mod tests {
             mem_backend: MemBackendConfig {
                 backend_path: PathBuf::from("bar"),
                 backend_type: MemBackendType::File,
+                use_memfd: false,
             },
             track_dirty_pages: true,
             resume_vm: false,
@@ -246,6 +256,7 @@ mod tests {
             mem_backend: MemBackendConfig {
                 backend_path: PathBuf::from("bar"),
                 backend_type: MemBackendType::Uffd,
+                use_memfd: false,
             },
             track_dirty_pages: false,
             resume_vm: true,
@@ -283,6 +294,7 @@ mod tests {
             mem_backend: MemBackendConfig {
                 backend_path: PathBuf::from("bar"),
                 backend_type: MemBackendType::Uffd,
+                use_memfd: false,
             },
             track_dirty_pages: false,
             resume_vm: true,
@@ -314,6 +326,7 @@ mod tests {
             mem_backend: MemBackendConfig {
                 backend_path: PathBuf::from("bar"),
                 backend_type: MemBackendType::File,
+                use_memfd: false,
             },
             track_dirty_pages: false,
             resume_vm: true,
@@ -401,6 +414,45 @@ mod tests {
         );
         parse_put_snapshot(&Body::new(body), Some("invalid")).unwrap_err();
         parse_put_snapshot(&Body::new(body), None).unwrap_err();
+
+        // use_memfd=true with Uffd backend must be accepted and propagated.
+        let body = r#"{
+            "snapshot_path": "foo",
+            "mem_backend": {
+                "backend_path": "bar",
+                "backend_type": "Uffd",
+                "use_memfd": true
+            }
+        }"#;
+        let expected_config = LoadSnapshotParams {
+            snapshot_path: PathBuf::from("foo"),
+            mem_backend: MemBackendConfig {
+                backend_path: PathBuf::from("bar"),
+                backend_type: MemBackendType::Uffd,
+                use_memfd: true,
+            },
+            track_dirty_pages: false,
+            resume_vm: false,
+            network_overrides: vec![],
+            clock_realtime: false,
+        };
+        let mut parsed_request = parse_put_snapshot(&Body::new(body), Some("load")).unwrap();
+        assert!(parsed_request.parsing_info().take_deprecation_message().is_none());
+        assert_eq!(
+            vmm_action_from_request(parsed_request),
+            VmmAction::LoadSnapshot(expected_config)
+        );
+
+        // use_memfd=true with File backend must be rejected.
+        let body = r#"{
+            "snapshot_path": "foo",
+            "mem_backend": {
+                "backend_path": "bar",
+                "backend_type": "File",
+                "use_memfd": true
+            }
+        }"#;
+        parse_put_snapshot(&Body::new(body), Some("load")).unwrap_err();
     }
 
     #[test]

src/firecracker/swagger/firecracker.yaml

@@ -1542,6 +1542,13 @@ definitions:
           2) Path to the UDS where a process is listening for a UFFD initialization
           control payload and open file descriptor that it can use to serve this
           process's guest memory page faults
+      use_memfd:
+        type: boolean
+        description:
+          When true, guest memory is backed by a memfd and its file descriptor is
+          sent to the UFFD handler over the UFFD socket alongside the UFFD itself.
+          Only valid when 'backend_type' is 'Uffd'.
+        default: false
 
   Metrics:
     type: object

src/vmm/src/devices/virtio/vhost_user.rs

@@ -485,7 +485,7 @@ pub(crate) mod tests {
             memory::create(
                 regions.iter().copied(),
                 libc::MAP_PRIVATE,
-                Some(file),
+                Some(Arc::new(file)),
                 false,
             )
             .unwrap()