[vm] restrict readonly page fault access