linux-kernel - Re: Doubt regarding memory allocation in KVM

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Tue, 20 Apr 2021 08:52:00 +0200
From:   Paolo Bonzini <pbonzini@...hat.com>
To:     Shivank Garg <shivankgarg98@...il.com>,
        Sean Christopherson <sean.j.christopherson@...el.com>,
        Vitaly Kuznetsov <vkuznets@...hat.com>,
        Wanpeng Li <wanpengli@...cent.com>,
        Jim Mattson <jmattson@...gle.com>,
        Joerg Roedel <joro@...tes.org>,
        Thomas Gleixner <tglx@...utronix.de>,
        Ingo Molnar <mingo@...hat.com>, Borislav Petkov <bp@...en8.de>,
        "H. Peter Anvin" <hpa@...or.com>, x86@...nel.org,
        kvm@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: Doubt regarding memory allocation in KVM

On 20/04/21 07:45, Shivank Garg wrote:
> Hi,
> I'm learning about qemu KVM, looking into code and experimenting on
> it. I have the following doubts regarding it, I would be grateful if
> you help me to get some idea on them.
> 
> 1. I observe that KVM allocates memory to guests when it needs it but
> doesn't take it back (except for ballooning case).
> Also, the Qemu/KVM process does not free the memory even when the
> guest is rebooted. In this case,  Does the Guest VM get access to
> memory already pre-filled with some garbage from the previous run??

Yes.

> (Since the host would allocate zeroed pages to guests the first time
> it requests but after that it's up to guests). Can it be a security
> issue?

No, it's the same that happens on non-virtual machine.

> 2. How does the KVM know if GPFN (guest physical frame number) is
> backed by an actual machine frame number in host? If not mapped, then
> it faults in the host and allocates a physical frame for guests in the
> host. (kvm_mmu_page_fault)

It's all handled by Linux.  KVM only does a call to get_user_pages.  See 
functions whose name starts with hva_to_pfn in virt/kvm/kvm_main.c

Given a GPA, the GFN is simply the guest physical address minus bits 
0:11, so shifted right by 12.

Paolo