Hi,
Just for historical perspective - the reason I think qemu didn't implement the pam "read from rom and write to memory" mode is that I don't think there's a good way to emulate that with page tables (and the range needs to be executable so just making it all device memory isn't practical).
A while back kvm got support for memory slots which allow read access and vmexit on write access. Flash emulation needs this, and I think it is possible to also implement the "read from rom and write to memory" mode using that.
cheers, Gerd