Doubt regarding memory allocation in KVM

Doubt regarding memory allocation in KVM

[Shivank Garg]

Hi,
I'm learning about qemu KVM, looking into code and experimenting on
it. I have the following doubts regarding it, I would be grateful if
you help me to get some idea on them.

1. I observe that KVM allocates memory to guests when it needs it but
doesn't take it back (except for ballooning case).
Also, the Qemu/KVM process does not free the memory even when the
guest is rebooted. In this case,  Does the Guest VM get access to
memory already pre-filled with some garbage from the previous run??
(Since the host would allocate zeroed pages to guests the first time
it requests but after that it's up to guests). Can it be a security
issue?

2. How does the KVM know if GPFN (guest physical frame number) is
backed by an actual machine frame number in host? If not mapped, then
it faults in the host and allocates a physical frame for guests in the
host. (kvm_mmu_page_fault)

3. How/where can I access the GPFNs in the host? Is "gfn_t gfn = gpa
>> PAGE_SHIFT" and "gpa_t cr2_or_gpa" in the KVM page fault handler,
x86 is the same as GPFN. (that is can I use pfn_to_page in guest VM to
access the struct page in Guest)

Thank You.

Best Regards,
Shivank Garg
M.Tech Student,
IIT Kanpur

Re: Doubt regarding memory allocation in KVM

[Paolo Bonzini]

On 20/04/21 07:45, Shivank Garg wrote:
> Hi,
> I'm learning about qemu KVM, looking into code and experimenting on
> it. I have the following doubts regarding it, I would be grateful if
> you help me to get some idea on them.
> 
> 1. I observe that KVM allocates memory to guests when it needs it but
> doesn't take it back (except for ballooning case).
> Also, the Qemu/KVM process does not free the memory even when the
> guest is rebooted. In this case,  Does the Guest VM get access to
> memory already pre-filled with some garbage from the previous run??

Yes.

> (Since the host would allocate zeroed pages to guests the first time
> it requests but after that it's up to guests). Can it be a security
> issue?

No, it's the same that happens on non-virtual machine.

> 2. How does the KVM know if GPFN (guest physical frame number) is
> backed by an actual machine frame number in host? If not mapped, then
> it faults in the host and allocates a physical frame for guests in the
> host. (kvm_mmu_page_fault)

It's all handled by Linux.  KVM only does a call to get_user_pages.  See 
functions whose name starts with hva_to_pfn in virt/kvm/kvm_main.c

Given a GPA, the GFN is simply the guest physical address minus bits 
0:11, so shifted right by 12.

Paolo