qemu/backends
David Hildenbrand e92666b0ba backends/hostmem-file: Add "rom" property to support VM templating with R/O files
For now, "share=off,readonly=on" would always result in us opening the
file R/O and mmap'ing the opened file MAP_PRIVATE R/O -- effectively
turning it into ROM.

Especially for VM templating, "share=off" is a common use case. However,
that use case is impossible with files that lack write permissions,
because "share=off,readonly=on" will not give us writable RAM.

The sole user of ROM via memory-backend-file are R/O NVDIMMs, but as we
have users (Kata Containers) that rely on the existing behavior --
malicious VMs should not be able to consume COW memory for R/O NVDIMMs --
we cannot change the semantics of "share=off,readonly=on"

So let's add a new "rom" property with on/off/auto values. "auto" is
the default and what most people will use: for historical reasons, to not
change the old semantics, it defaults to the value of the "readonly"
property.

For VM templating, one can now use:
    -object memory-backend-file,share=off,readonly=on,rom=off,...

But we'll disallow:
    -object memory-backend-file,share=on,readonly=on,rom=off,...
because we would otherwise get an error when trying to mmap the R/O file
shared and writable. An explicit error message is cleaner.

We will also disallow for now:
    -object memory-backend-file,share=off,readonly=off,rom=on,...
    -object memory-backend-file,share=on,readonly=off,rom=on,...
It's not harmful, but also not really required for now.

Alternatives that were abandoned:
* Make "unarmed=on" for the NVDIMM set the memory region container
  readonly. We would still see a change of ROM->RAM and possibly run
  into memslot limits with vhost-user. Further, there might be use cases
  for "unarmed=on" that should still allow writing to that memory
  (temporary files, system RAM, ...).
* Add a new "readonly=on/off/auto" parameter for NVDIMMs. Similar issues
  as with "unarmed=on".
* Make "readonly" consume "on/off/file" instead of being a 'bool' type.
  This would slightly changes the behavior of the "readonly" parameter:
  values like true/false (as accepted by a 'bool'type) would no longer be
  accepted.

Message-ID: <20230906120503.359863-4-david@redhat.com>
Acked-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: David Hildenbrand <david@redhat.com>
2023-09-19 10:23:21 +02:00
..
tpm tpm: fix crash when FD >= 1024 and unnecessary errors due to EINTR 2023-09-13 08:42:57 -04:00
confidential-guest-support.c confidential guest support: Introduce new confidential guest support class 2021-02-08 16:57:37 +11:00
cryptodev-builtin.c cryptodev: Use CryptoDevBackendOpInfo for operation 2023-03-07 12:38:59 -05:00
cryptodev-hmp-cmds.c hmp: add cryptodev info command 2023-03-07 12:38:59 -05:00
cryptodev-lkcf.c cryptodev: Use CryptoDevBackendOpInfo for operation 2023-03-07 12:38:59 -05:00
cryptodev-vhost-user.c cryptodev-vhost-user: add asymmetric crypto support 2023-06-23 02:54:44 -04:00
cryptodev-vhost.c cryptodev: Introduce cryptodev.json 2023-03-07 12:38:59 -05:00
cryptodev.c cryptodev: Handle unexpected request to avoid crash 2023-08-03 16:16:17 -04:00
dbus-vmstate.c dbus-vmstate: Restrict error checks to registered proxies in dbus_get_proxies 2022-08-18 10:35:44 +04:00
dbus-vmstate1.xml docs: move D-Bus VMState documentation to source XML 2021-12-21 10:50:21 +04:00
hostmem-epc.c Fix non-first inclusions of qemu/osdep.h 2023-02-08 07:28:05 +01:00
hostmem-file.c backends/hostmem-file: Add "rom" property to support VM templating with R/O files 2023-09-19 10:23:21 +02:00
hostmem-memfd.c hostmem: Wire up RAM_NORESERVE via "reserve" property 2021-06-15 20:27:38 +02:00
hostmem-ram.c hostmem: Wire up RAM_NORESERVE via "reserve" property 2021-06-15 20:27:38 +02:00
hostmem.c hostmem: Honor multiple preferred nodes if possible 2022-12-28 14:59:55 +01:00
Kconfig tpm: Move backend code under the 'backends/' directory 2020-06-19 07:25:55 -04:00
meson.build meson: Replace softmmu_ss -> system_ss 2023-06-20 10:01:30 +02:00
rng-builtin.c replay: rng-builtin support 2021-02-08 15:15:32 +01:00
rng-egd.c backends: Improve error messages when property can no longer be set 2022-10-27 07:56:56 +02:00
rng-random.c backends: Improve error messages when property can no longer be set 2022-10-27 07:56:56 +02:00
rng.c error: Drop superfluous #include "qapi/qmp/qerror.h" 2023-02-23 13:56:14 +01:00
trace-events docs: fix references to docs/devel/tracing.rst 2021-06-02 06:51:09 +02:00
trace.h trace: switch position of headers to what Meson requires 2020-08-21 06:18:24 -04:00
vhost-user.c backends/vhost-user: remove the ioeventfd check 2023-03-02 03:10:47 -05:00