On 2/14/25 2:14 AM, Steven Price wrote:
For protected memory read only isn't supported. While it may be possible
to support read only for unprotected memory, this isn't supported at the
present time.
Signed-off-by: Steven Price <steven.price@xxxxxxx>
---
arch/arm64/kvm/arm.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
It's worthy to explain why KVM_CAP_READONLY_MEM isn't supported and its
negative impact. It's something to be done in the future if I'm correct.
From QEMU's perspective, all ROM data, which is populated by it, can
be written. It conflicts to the natural limit: all ROM data should be
read-only.
QEMU
====
rom_add_blob
rom_set_mr
memory_region_set_readonly
memory_region_transaction_commit
kvm_region_commit
kvm_set_phys_mem
kvm_mem_flags // flag KVM_MEM_READONLY is missed
kvm_set_user_memory_region
kvm_vm_ioctl(KVM_SET_USER_MEMORY_REGION2)
non-secure host
===============
rec_exit_sync_dabt
kvm_handle_guest_abort
user_mem_abort
__kvm_faultin_pfn // writable == true
realm_map_ipa
WARN_ON(!(prot & KVM_PGTABLE_PROT_W)
non-secure host
===============
kvm_realm_enable_cap(KVM_CAP_ARM_RME_POPULATE_REALM)
kvm_populate_realm
__kvm_faultin_pfn // writable == true
realm_create_protected_data_page
diff --git a/arch/arm64/kvm/arm.c b/arch/arm64/kvm/arm.c
index 1f3674e95f03..0f1d65f87e2b 100644
--- a/arch/arm64/kvm/arm.c
+++ b/arch/arm64/kvm/arm.c
@@ -348,7 +348,6 @@ int kvm_vm_ioctl_check_extension(struct kvm *kvm, long ext)
case KVM_CAP_ONE_REG:
case KVM_CAP_ARM_PSCI:
case KVM_CAP_ARM_PSCI_0_2:
- case KVM_CAP_READONLY_MEM:
case KVM_CAP_MP_STATE:
case KVM_CAP_IMMEDIATE_EXIT:
case KVM_CAP_VCPU_EVENTS:
@@ -362,6 +361,7 @@ int kvm_vm_ioctl_check_extension(struct kvm *kvm, long ext)
case KVM_CAP_COUNTER_OFFSET:
r = 1;
break;
+ case KVM_CAP_READONLY_MEM:
case KVM_CAP_SET_GUEST_DEBUG:
r = !kvm_is_realm(kvm);
break;
Thanks,
Gavin
