mirror of
https://gitlab.com/qemu-project/qemu
synced 2024-09-06 09:55:55 +00:00
e92666b0ba
For now, "share=off,readonly=on" would always result in us opening the
file R/O and mmap'ing the opened file MAP_PRIVATE R/O -- effectively
turning it into ROM.
Especially for VM templating, "share=off" is a common use case. However,
that use case is impossible with files that lack write permissions,
because "share=off,readonly=on" will not give us writable RAM.
The sole user of ROM via memory-backend-file are R/O NVDIMMs, but as we
have users (Kata Containers) that rely on the existing behavior --
malicious VMs should not be able to consume COW memory for R/O NVDIMMs --
we cannot change the semantics of "share=off,readonly=on"
So let's add a new "rom" property with on/off/auto values. "auto" is
the default and what most people will use: for historical reasons, to not
change the old semantics, it defaults to the value of the "readonly"
property.
For VM templating, one can now use:
-object memory-backend-file,share=off,readonly=on,rom=off,...
But we'll disallow:
-object memory-backend-file,share=on,readonly=on,rom=off,...
because we would otherwise get an error when trying to mmap the R/O file
shared and writable. An explicit error message is cleaner.
We will also disallow for now:
-object memory-backend-file,share=off,readonly=off,rom=on,...
-object memory-backend-file,share=on,readonly=off,rom=on,...
It's not harmful, but also not really required for now.
Alternatives that were abandoned:
* Make "unarmed=on" for the NVDIMM set the memory region container
readonly. We would still see a change of ROM->RAM and possibly run
into memslot limits with vhost-user. Further, there might be use cases
for "unarmed=on" that should still allow writing to that memory
(temporary files, system RAM, ...).
* Add a new "readonly=on/off/auto" parameter for NVDIMMs. Similar issues
as with "unarmed=on".
* Make "readonly" consume "on/off/file" instead of being a 'bool' type.
This would slightly changes the behavior of the "readonly" parameter:
values like true/false (as accepted by a 'bool'type) would no longer be
accepted.
Message-ID: <20230906120503.359863-4-david@redhat.com>
Acked-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: David Hildenbrand <david@redhat.com>
|
||
|---|---|---|
| .. | ||
| acpi.json | ||
| audio.json | ||
| authz.json | ||
| block-core.json | ||
| block-export.json | ||
| block.json | ||
| char.json | ||
| common.json | ||
| compat.json | ||
| control.json | ||
| crypto.json | ||
| cryptodev.json | ||
| cxl.json | ||
| dump.json | ||
| error.json | ||
| introspect.json | ||
| job.json | ||
| machine-target.json | ||
| machine.json | ||
| meson.build | ||
| migration.json | ||
| misc-target.json | ||
| misc.json | ||
| net.json | ||
| opts-visitor.c | ||
| pci.json | ||
| pragma.json | ||
| qapi-clone-visitor.c | ||
| qapi-dealloc-visitor.c | ||
| qapi-forward-visitor.c | ||
| qapi-schema.json | ||
| qapi-type-helpers.c | ||
| qapi-util.c | ||
| qapi-visit-core.c | ||
| qdev.json | ||
| qmp-dispatch.c | ||
| qmp-event.c | ||
| qmp-registry.c | ||
| qobject-input-visitor.c | ||
| qobject-output-visitor.c | ||
| qom.json | ||
| rdma.json | ||
| replay.json | ||
| rocker.json | ||
| run-state.json | ||
| sockets.json | ||
| stats.json | ||
| string-input-visitor.c | ||
| string-output-visitor.c | ||
| tpm.json | ||
| trace-events | ||
| trace.h | ||
| trace.json | ||
| transaction.json | ||
| ui.json | ||
| virtio.json | ||
| yank.json | ||