Qemu: implement readonly memory

let it not depend on __KVM_HAVE_READONLY_MEM to make it friendly to userspace

Signed-off-by Xiao Guangrong <[email protected]>

---
 arch/x86/kvm/x86.c  |    2 ++
 include/linux/kvm.h |    2 --
 virt/kvm/kvm_main.c |    2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

arch/x86/kvm/x86.c +2 -0

index ec07cd3..0fd220b 100644
@@ -2189,7 +2189,9 @@ int kvm_dev_ioctl_check_extension(long ext)
 	case KVM_CAP_GET_TSC_KHZ:
 	case KVM_CAP_PCI_2_3:
 	case KVM_CAP_KVMCLOCK_CTRL:
+#ifdef __KVM_HAVE_READONLY_MEM
 	case KVM_CAP_READONLY_MEM:
+#endif
 	case KVM_CAP_IRQFD_RESAMPLE:
 		r = 1;
 		break;

include/linux/kvm.h +0 -2

index 494a84c..a9001c1 100644
@@ -629,9 +629,7 @@ struct kvm_ppc_smmu_info {
 #define KVM_CAP_PPC_GET_SMMU_INFO 78
 #define KVM_CAP_S390_COW 79
 #define KVM_CAP_PPC_ALLOC_HTAB 80
-#ifdef __KVM_HAVE_READONLY_MEM
 #define KVM_CAP_READONLY_MEM 81
-#endif
 #define KVM_CAP_IRQFD_RESAMPLE 82
 #define KVM_CAP_PPC_BOOKE_WATCHDOG 83
 

virt/kvm/kvm_main.c +0 -0

index e26a55f..55f12a1 100644

Sync the header files by using scripts/update-linux-headers.sh

In isapc, no i440x device exists in guest that means seabios can not make 0xc0000 to 0x1000000 writable

It works fine in current code since the guest can happily write readonly memory. In order to support readonly slot in Qemu, we do not make the bios readonly anymore

Signed-off-by Xiao Guangrong <[email protected]>

---
 hw/pc_sysfw.c |    2 --
 1 files changed, 0 insertions(+), 2 deletions(-)

hw/pc_sysfw.c +0 -1

index b45f0ac..2d56fc7 100644
@@ -156,7 +156,6 @@ static void old_pc_system_rom_init(MemoryRegion *rom_memory)
     bios = g_malloc(sizeof(*bios));
     memory_region_init_ram(bios, "pc.bios", bios_size);
     vmstate_register_ram_global(bios);
-    memory_region_set_readonly(bios, true);
     ret = rom_add_file_fixed(bios_name, (uint32_t)(-bios_size), -1);
     if (ret != 0) {
     bios_error:

This has two problems: We know it breaks at least Win 95 that overwrites its F-segment during boot. And it applies changes to the shadowed area (below 1 MB) also to the ROM area - I don't think that is the original behaviour on real hardware.

What we need is paravirtual shadow write control for the ISA PC. It's on my todo list, maybe I will be able to look into this during the next week.

BTW, your patch series should allow to drop the KVM special case from pc_system_firmware_init. That version, btw, treats high and low BIOS areas separately - but only reloads the upper area. Hmm...

Jan,

Quoted 4 lines · Jan Kiszka

This has two problems: We know it breaks at least Win 95 that overwrites its F-segment during boot. And it applies changes to the shadowed area (below 1 MB) also to the ROM area - I don't think that is the original behaviour on real hardware.

So what is the problem? It can break Win95's running?

I tried to install win95 guest but it failed to boot regardless my patchset was applied or not. I found the information that win 95 is not supported at
http://www.linux-kvm.org/page/Guest_Support_Status

Note: before my patchset, Win 95 still can happily something into ROM area because readonly memory is actually writable on KVM. And win95 can not run on isapc with --no-kvm since it is no way to enable shadow ROM.

Quoted 5 lines

What we need is paravirtual shadow write control for the ISA PC. It's on my todo list, maybe I will be able to look into this during the next week.

You idea is that modify the code of seabios and use a special way (PV) to notify Qemu to make the bios writable?

Actually, I am confused why the guest (including bios) persistently uses shadow ROM even if it is not supported (on ISA PC), i think the right way is move itself to RAM under this case, no?

Quoted 5 lines

BTW, your patch series should allow to drop the KVM special case from pc_system_firmware_init. That version, btw, treats high and low BIOS areas separately - but only reloads the upper area. Hmm...

You mean that also allow Qemu to use pflash to load bios if kvm is enabled?

We can not do that for pflash is a RD device which can not be directly written, kvm can not emulate the instruction which implicitly write the memory. (e.g:
using this area as stack).

Quoted 15 lines · Xiao Guangrong

Jan,

Quoted 4 lines · Jan Kiszka

This has two problems: We know it breaks at least Win 95 that overwrites its F-segment during boot. And it applies changes to the shadowed area (below 1 MB) also to the ROM area - I don't think that is the original behaviour on real hardware.

So what is the problem? It can break Win95's running?

I tried to install win95 guest but it failed to boot regardless my patchset was applied or not. I found the information that win 95 is not supported at
http://www.linux-kvm.org/page/Guest_Support_Status

Quoted 3 lines

Note: before my patchset, Win 95 still can happily something into ROM area because readonly memory is actually writable on KVM. And win95 can not run on isapc with --no-kvm since it is no way to enable shadow ROM.

Your patches causes regressions on TCG mode as that is perfectly fine with booting Win95 so far.

Quoted 9 lines

Quoted 6 lines

What we need is paravirtual shadow write control for the ISA PC. It's on my todo list, maybe I will be able to look into this during the next week.

You idea is that modify the code of seabios and use a special way (PV) to notify Qemu to make the bios writable?

Yes.

Quoted 1 line

Quoted 3 lines

Actually, I am confused why the guest (including bios) persistently uses shadow ROM even if it is not supported (on ISA PC), i think the right way is move itself to RAM under this case, no?

I've been told that Seabios has been built around that assumption and the PV shadow control would be simpler to realize.

Quoted 8 lines

Quoted 6 lines

BTW, your patch series should allow to drop the KVM special case from pc_system_firmware_init. That version, btw, treats high and low BIOS areas separately - but only reloads the upper area. Hmm...

You mean that also allow Qemu to use pflash to load bios if kvm is enabled?

Yes.

Quoted 3 lines

We can not do that for pflash is a RD device which can not be directly written, kvm can not emulate the instruction which implicitly write the memory. (e.g:
using this area as stack).

Isn't enabling ROMD support for KVM that whole point of your patches? I

do not see yet what prevents this still, but it should be fixed first.

Quoted 20 lines · Jan Kiszka

Quoted 18 lines · Xiao Guangrong

Jan,

Quoted 4 lines · Jan Kiszka

This has two problems: We know it breaks at least Win 95 that overwrites its F-segment during boot. And it applies changes to the shadowed area (below 1 MB) also to the ROM area - I don't think that is the original behaviour on real hardware.

So what is the problem? It can break Win95's running?

I tried to install win95 guest but it failed to boot regardless my patchset was applied or not. I found the information that win 95 is not supported at
http://www.linux-kvm.org/page/Guest_Support_Status

Note: before my patchset, Win 95 still can happily something into ROM area because readonly memory is actually writable on KVM. And win95 can not run on isapc with --no-kvm since it is no way to enable shadow ROM.

Quoted 2 lines

Your patches causes regressions on TCG mode as that is perfectly fine with booting Win95 so far.

Aha, i tried accel=tcg, before my patchset, it works for -machine pc but failed for -machine isapc (known issue for seabios). After my patchset, it works fine for both -machine pc and isapc. :)

Quoted 18 lines

Quoted 10 lines

Quoted 7 lines

What we need is paravirtual shadow write control for the ISA PC. It's on my todo list, maybe I will be able to look into this during the next week.

You idea is that modify the code of seabios and use a special way (PV) to notify Qemu to make the bios writable?

Yes.

Quoted 4 lines

Actually, I am confused why the guest (including bios) persistently uses shadow ROM even if it is not supported (on ISA PC), i think the right way is move itself to RAM under this case, no?

Quoted 2 lines

I've been told that Seabios has been built around that assumption and the PV shadow control would be simpler to realize.

Sounds the PV is complexer that directly making the bios area writable (if it works).

Quoted 12 lines

Quoted 9 lines

Quoted 7 lines

BTW, your patch series should allow to drop the KVM special case from pc_system_firmware_init. That version, btw, treats high and low BIOS areas separately - but only reloads the upper area. Hmm...

You mean that also allow Qemu to use pflash to load bios if kvm is enabled?

Yes.

Quoted 5 lines

Quoted 3 lines

We can not do that for pflash is a RD device which can not be directly written, kvm can not emulate the instruction which implicitly write the memory. (e.g:
using this area as stack).

Isn't enabling ROMD support for KVM that whole point of your patches? I

It can generate MMIO exit if ROMD be written, that means the instruction needs kvm's help to be finished if it explicitly/implicitly write the memory.

Quoted 2 lines

do not see yet what prevents this still, but it should be fixed first.

For the explicitly write memory access, it is easy to be fixed - we just need to fetch the instruction from EIP and emulate it. But for the implicitly memory access, fixing its emulation is really hard work. Really worth doing it?

Quoted 21 lines · Xiao Guangrong

Quoted 20 lines · Jan Kiszka

Quoted 18 lines · Xiao Guangrong

Jan,

Quoted 4 lines · Jan Kiszka

This has two problems: We know it breaks at least Win 95 that overwrites its F-segment during boot. And it applies changes to the shadowed area (below 1 MB) also to the ROM area - I don't think that is the original behaviour on real hardware.

So what is the problem? It can break Win95's running?

I tried to install win95 guest but it failed to boot regardless my patchset was applied or not. I found the information that win 95 is not supported at
http://www.linux-kvm.org/page/Guest_Support_Status

Note: before my patchset, Win 95 still can happily something into ROM area because readonly memory is actually writable on KVM. And win95 can not run on isapc with --no-kvm since it is no way to enable shadow ROM.

Quoted 6 lines

Quoted 2 lines

Your patches causes regressions on TCG mode as that is perfectly fine with booting Win95 so far.

Aha, i tried accel=tcg, before my patchset, it works for -machine pc but failed for -machine isapc (known issue for seabios). After my patchset, it works fine for both -machine pc and isapc. :)

Indeed, looks like I'm on the wrong track regarding what breaks Win95 in KVM mode.

However: This patch inappropriately allows the guest to change the BIOS content during runtime. And that not only in the lower ISA range, not only for our stepchild isapc but for the high ROM range as well, even with PCI chipset enabled. So this is nothing more than a hack.

Quoted 22 lines

Quoted 21 lines

Quoted 11 lines

Quoted 8 lines

What we need is paravirtual shadow write control for the ISA PC. It's on my todo list, maybe I will be able to look into this during the next week.

You idea is that modify the code of seabios and use a special way (PV) to notify Qemu to make the bios writable?

Yes.

Quoted 4 lines

Actually, I am confused why the guest (including bios) persistently uses shadow ROM even if it is not supported (on ISA PC), i think the right way is move itself to RAM under this case, no?

I've been told that Seabios has been built around that assumption and the PV shadow control would be simpler to realize.

Quoted 2 lines

Sounds the PV is complexer that directly making the bios area writable (if it works).

But it is the only correct solution. In fact, shadowing means mapping RAM above the ROM, not enabling writability, and then copying necessary bits from the high ROM part to that RAM. Seabios does this when PAM is available, we just need to pull in those bits for PV shadow control.

Quoted 17 lines

Quoted 17 lines

Quoted 10 lines

Quoted 8 lines

BTW, your patch series should allow to drop the KVM special case from pc_system_firmware_init. That version, btw, treats high and low BIOS areas separately - but only reloads the upper area. Hmm...

You mean that also allow Qemu to use pflash to load bios if kvm is enabled?

Yes.

Quoted 3 lines

We can not do that for pflash is a RD device which can not be directly written, kvm can not emulate the instruction which implicitly write the memory. (e.g:
using this area as stack).

Quoted 4 lines

Quoted 1 line

Isn't enabling ROMD support for KVM that whole point of your patches? I

It can generate MMIO exit if ROMD be written, that means the instruction needs kvm's help to be finished if it explicitly/implicitly write the memory.

I was assuming that this is what you already do. If you trap write accesses, why not allowing user space to handle them?

Quoted 7 lines

Quoted 3 lines

do not see yet what prevents this still, but it should be fixed first.

For the explicitly write memory access, it is easy to be fixed - we just need to fetch the instruction from EIP and emulate it. But for the implicitly memory access, fixing its emulation is really hard work. Really worth doing it?

Aren't the read-only regions also marked read-only on the host side to avoid that the guest writes to it? Or how is this implemented?

Support for flash emulation in KVM mode is increasingly important, for embedded platform virtualization but also for classic x86 server-like targets. The pflash-backed system firmware device was added for a reason...

Quoted 6 lines

Quoted 6 lines

Quoted 5 lines

Quoted 3 lines

We can not do that for pflash is a RD device which can not be directly written, kvm can not emulate the instruction which implicitly write the memory. (e.g:
using this area as stack).

Isn't enabling ROMD support for KVM that whole point of your patches? I

Quoted 5 lines

Quoted 2 lines

It can generate MMIO exit if ROMD be written, that means the instruction needs kvm's help to be finished if it explicitly/implicitly write the memory.

I was assuming that this is what you already do. If you trap write accesses, why not allowing user space to handle them?

Already have done that, guest write ROMD -> vmexit -> return to userspace with MMIO Exit.

Quoted 9 lines

Quoted 8 lines

Quoted 4 lines

do not see yet what prevents this still, but it should be fixed first.

For the explicitly write memory access, it is easy to be fixed - we just need to fetch the instruction from EIP and emulate it. But for the implicitly memory access, fixing its emulation is really hard work. Really worth doing it?

Quoted 6 lines

Aren't the read-only regions also marked read-only on the host side to avoid that the guest writes to it? Or how is this implemented?

Support for flash emulation in KVM mode is increasingly important, for embedded platform virtualization but also for classic x86 server-like targets. The pflash-backed system firmware device was added for a reason...

Please allow me to clarify it more clearly.

The flash is ROMD device means guest can not write it, any kinds of guest write access on this device can cause vmexit to kvm and return to userspace.

We should pay more attention on it if we execute the code in ROMD since we can not use ROMD as stack/page table/IDT table and all other implicitly write access. Of course, if you do not use ROM as those purposes, it is okay. :)

Quoted 5 lines

Please allow me to clarify it more clearly.

The flash is ROMD device means guest can not write it, any kinds of guest write access on this device can cause vmexit to kvm and return to userspace.

Quoted 3 lines

We should pay more attention on it if we execute the code in ROMD since we can not use ROMD as stack/page table/IDT table and all other implicitly write access. Of course, if you do not use ROM as those purposes, it is okay. :)

So the problem is that there is KVM code that still blindly writes to guest memory and does not take the memory regions' protection flag into account? And we cannot mark those regions read only in the host's page table?

Quoted 9 lines · Jan Kiszka

Quoted 8 lines

Please allow me to clarify it more clearly.

The flash is ROMD device means guest can not write it, any kinds of guest write access on this device can cause vmexit to kvm and return to userspace.

We should pay more attention on it if we execute the code in ROMD since we can not use ROMD as stack/page table/IDT table and all other implicitly write access. Of course, if you do not use ROM as those purposes, it is okay. :)

Quoted 4 lines

So the problem is that there is KVM code that still blindly writes to guest memory and does not take the memory regions' protection flag into account? And we cannot mark those regions read only in the host's page table?

KVM has the ability to catch this kind of write access on ROMD, it is just hard to emulate the implicitly memory access.