xref: /openbmc/qemu/linux-user/mmap.c (revision 97ef5f88)
1 /*
2  *  mmap support for qemu
3  *
4  *  Copyright (c) 2003 Fabrice Bellard
5  *
6  *  This program is free software; you can redistribute it and/or modify
7  *  it under the terms of the GNU General Public License as published by
8  *  the Free Software Foundation; either version 2 of the License, or
9  *  (at your option) any later version.
10  *
11  *  This program is distributed in the hope that it will be useful,
12  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
13  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
14  *  GNU General Public License for more details.
15  *
16  *  You should have received a copy of the GNU General Public License
17  *  along with this program; if not, see <http://www.gnu.org/licenses/>.
18  */
19 #include "qemu/osdep.h"
20 #include "trace.h"
21 #include "exec/log.h"
22 #include "qemu.h"
23 
24 static pthread_mutex_t mmap_mutex = PTHREAD_MUTEX_INITIALIZER;
25 static __thread int mmap_lock_count;
26 
27 void mmap_lock(void)
28 {
29     if (mmap_lock_count++ == 0) {
30         pthread_mutex_lock(&mmap_mutex);
31     }
32 }
33 
34 void mmap_unlock(void)
35 {
36     if (--mmap_lock_count == 0) {
37         pthread_mutex_unlock(&mmap_mutex);
38     }
39 }
40 
41 bool have_mmap_lock(void)
42 {
43     return mmap_lock_count > 0 ? true : false;
44 }
45 
46 /* Grab lock to make sure things are in a consistent state after fork().  */
47 void mmap_fork_start(void)
48 {
49     if (mmap_lock_count)
50         abort();
51     pthread_mutex_lock(&mmap_mutex);
52 }
53 
54 void mmap_fork_end(int child)
55 {
56     if (child)
57         pthread_mutex_init(&mmap_mutex, NULL);
58     else
59         pthread_mutex_unlock(&mmap_mutex);
60 }
61 
62 /*
63  * Validate target prot bitmask.
64  * Return the prot bitmask for the host in *HOST_PROT.
65  * Return 0 if the target prot bitmask is invalid, otherwise
66  * the internal qemu page_flags (which will include PAGE_VALID).
67  */
68 static int validate_prot_to_pageflags(int *host_prot, int prot)
69 {
70     int valid = PROT_READ | PROT_WRITE | PROT_EXEC | TARGET_PROT_SEM;
71     int page_flags = (prot & PAGE_BITS) | PAGE_VALID;
72 
73     /*
74      * For the host, we need not pass anything except read/write/exec.
75      * While PROT_SEM is allowed by all hosts, it is also ignored, so
76      * don't bother transforming guest bit to host bit.  Any other
77      * target-specific prot bits will not be understood by the host
78      * and will need to be encoded into page_flags for qemu emulation.
79      *
80      * Pages that are executable by the guest will never be executed
81      * by the host, but the host will need to be able to read them.
82      */
83     *host_prot = (prot & (PROT_READ | PROT_WRITE))
84                | (prot & PROT_EXEC ? PROT_READ : 0);
85 
86 #ifdef TARGET_AARCH64
87     {
88         ARMCPU *cpu = ARM_CPU(thread_cpu);
89 
90         /*
91          * The PROT_BTI bit is only accepted if the cpu supports the feature.
92          * Since this is the unusual case, don't bother checking unless
93          * the bit has been requested.  If set and valid, record the bit
94          * within QEMU's page_flags.
95          */
96         if ((prot & TARGET_PROT_BTI) && cpu_isar_feature(aa64_bti, cpu)) {
97             valid |= TARGET_PROT_BTI;
98             page_flags |= PAGE_BTI;
99         }
100         /* Similarly for the PROT_MTE bit. */
101         if ((prot & TARGET_PROT_MTE) && cpu_isar_feature(aa64_mte, cpu)) {
102             valid |= TARGET_PROT_MTE;
103             page_flags |= PAGE_MTE;
104         }
105     }
106 #endif
107 
108     return prot & ~valid ? 0 : page_flags;
109 }
110 
111 /* NOTE: all the constants are the HOST ones, but addresses are target. */
112 int target_mprotect(abi_ulong start, abi_ulong len, int target_prot)
113 {
114     abi_ulong end, host_start, host_end, addr;
115     int prot1, ret, page_flags, host_prot;
116 
117     trace_target_mprotect(start, len, target_prot);
118 
119     if ((start & ~TARGET_PAGE_MASK) != 0) {
120         return -TARGET_EINVAL;
121     }
122     page_flags = validate_prot_to_pageflags(&host_prot, target_prot);
123     if (!page_flags) {
124         return -TARGET_EINVAL;
125     }
126     len = TARGET_PAGE_ALIGN(len);
127     end = start + len;
128     if (!guest_range_valid_untagged(start, len)) {
129         return -TARGET_ENOMEM;
130     }
131     if (len == 0) {
132         return 0;
133     }
134 
135     mmap_lock();
136     host_start = start & qemu_host_page_mask;
137     host_end = HOST_PAGE_ALIGN(end);
138     if (start > host_start) {
139         /* handle host page containing start */
140         prot1 = host_prot;
141         for (addr = host_start; addr < start; addr += TARGET_PAGE_SIZE) {
142             prot1 |= page_get_flags(addr);
143         }
144         if (host_end == host_start + qemu_host_page_size) {
145             for (addr = end; addr < host_end; addr += TARGET_PAGE_SIZE) {
146                 prot1 |= page_get_flags(addr);
147             }
148             end = host_end;
149         }
150         ret = mprotect(g2h_untagged(host_start), qemu_host_page_size,
151                        prot1 & PAGE_BITS);
152         if (ret != 0) {
153             goto error;
154         }
155         host_start += qemu_host_page_size;
156     }
157     if (end < host_end) {
158         prot1 = host_prot;
159         for (addr = end; addr < host_end; addr += TARGET_PAGE_SIZE) {
160             prot1 |= page_get_flags(addr);
161         }
162         ret = mprotect(g2h_untagged(host_end - qemu_host_page_size),
163                        qemu_host_page_size, prot1 & PAGE_BITS);
164         if (ret != 0) {
165             goto error;
166         }
167         host_end -= qemu_host_page_size;
168     }
169 
170     /* handle the pages in the middle */
171     if (host_start < host_end) {
172         ret = mprotect(g2h_untagged(host_start),
173                        host_end - host_start, host_prot);
174         if (ret != 0) {
175             goto error;
176         }
177     }
178     page_set_flags(start, start + len, page_flags);
179     mmap_unlock();
180     return 0;
181 error:
182     mmap_unlock();
183     return ret;
184 }
185 
186 /* map an incomplete host page */
187 static int mmap_frag(abi_ulong real_start,
188                      abi_ulong start, abi_ulong end,
189                      int prot, int flags, int fd, abi_ulong offset)
190 {
191     abi_ulong real_end, addr;
192     void *host_start;
193     int prot1, prot_new;
194 
195     real_end = real_start + qemu_host_page_size;
196     host_start = g2h_untagged(real_start);
197 
198     /* get the protection of the target pages outside the mapping */
199     prot1 = 0;
200     for(addr = real_start; addr < real_end; addr++) {
201         if (addr < start || addr >= end)
202             prot1 |= page_get_flags(addr);
203     }
204 
205     if (prot1 == 0) {
206         /* no page was there, so we allocate one */
207         void *p = mmap(host_start, qemu_host_page_size, prot,
208                        flags | MAP_ANONYMOUS, -1, 0);
209         if (p == MAP_FAILED)
210             return -1;
211         prot1 = prot;
212     }
213     prot1 &= PAGE_BITS;
214 
215     prot_new = prot | prot1;
216     if (!(flags & MAP_ANONYMOUS)) {
217         /* msync() won't work here, so we return an error if write is
218            possible while it is a shared mapping */
219         if ((flags & MAP_TYPE) == MAP_SHARED &&
220             (prot & PROT_WRITE))
221             return -1;
222 
223         /* adjust protection to be able to read */
224         if (!(prot1 & PROT_WRITE))
225             mprotect(host_start, qemu_host_page_size, prot1 | PROT_WRITE);
226 
227         /* read the corresponding file data */
228         if (pread(fd, g2h_untagged(start), end - start, offset) == -1)
229             return -1;
230 
231         /* put final protection */
232         if (prot_new != (prot1 | PROT_WRITE))
233             mprotect(host_start, qemu_host_page_size, prot_new);
234     } else {
235         if (prot_new != prot1) {
236             mprotect(host_start, qemu_host_page_size, prot_new);
237         }
238         if (prot_new & PROT_WRITE) {
239             memset(g2h_untagged(start), 0, end - start);
240         }
241     }
242     return 0;
243 }
244 
245 #if HOST_LONG_BITS == 64 && TARGET_ABI_BITS == 64
246 #ifdef TARGET_AARCH64
247 # define TASK_UNMAPPED_BASE  0x5500000000
248 #else
249 # define TASK_UNMAPPED_BASE  (1ul << 38)
250 #endif
251 #else
252 # define TASK_UNMAPPED_BASE  0x40000000
253 #endif
254 abi_ulong mmap_next_start = TASK_UNMAPPED_BASE;
255 
256 unsigned long last_brk;
257 
258 /* Subroutine of mmap_find_vma, used when we have pre-allocated a chunk
259    of guest address space.  */
260 static abi_ulong mmap_find_vma_reserved(abi_ulong start, abi_ulong size,
261                                         abi_ulong align)
262 {
263     abi_ulong addr, end_addr, incr = qemu_host_page_size;
264     int prot;
265     bool looped = false;
266 
267     if (size > reserved_va) {
268         return (abi_ulong)-1;
269     }
270 
271     /* Note that start and size have already been aligned by mmap_find_vma. */
272 
273     end_addr = start + size;
274     if (start > reserved_va - size) {
275         /* Start at the top of the address space.  */
276         end_addr = ((reserved_va - size) & -align) + size;
277         looped = true;
278     }
279 
280     /* Search downward from END_ADDR, checking to see if a page is in use.  */
281     addr = end_addr;
282     while (1) {
283         addr -= incr;
284         if (addr > end_addr) {
285             if (looped) {
286                 /* Failure.  The entire address space has been searched.  */
287                 return (abi_ulong)-1;
288             }
289             /* Re-start at the top of the address space.  */
290             addr = end_addr = ((reserved_va - size) & -align) + size;
291             looped = true;
292         } else {
293             prot = page_get_flags(addr);
294             if (prot) {
295                 /* Page in use.  Restart below this page.  */
296                 addr = end_addr = ((addr - size) & -align) + size;
297             } else if (addr && addr + size == end_addr) {
298                 /* Success!  All pages between ADDR and END_ADDR are free.  */
299                 if (start == mmap_next_start) {
300                     mmap_next_start = addr;
301                 }
302                 return addr;
303             }
304         }
305     }
306 }
307 
308 /*
309  * Find and reserve a free memory area of size 'size'. The search
310  * starts at 'start'.
311  * It must be called with mmap_lock() held.
312  * Return -1 if error.
313  */
314 abi_ulong mmap_find_vma(abi_ulong start, abi_ulong size, abi_ulong align)
315 {
316     void *ptr, *prev;
317     abi_ulong addr;
318     int wrapped, repeat;
319 
320     align = MAX(align, qemu_host_page_size);
321 
322     /* If 'start' == 0, then a default start address is used. */
323     if (start == 0) {
324         start = mmap_next_start;
325     } else {
326         start &= qemu_host_page_mask;
327     }
328     start = ROUND_UP(start, align);
329 
330     size = HOST_PAGE_ALIGN(size);
331 
332     if (reserved_va) {
333         return mmap_find_vma_reserved(start, size, align);
334     }
335 
336     addr = start;
337     wrapped = repeat = 0;
338     prev = 0;
339 
340     for (;; prev = ptr) {
341         /*
342          * Reserve needed memory area to avoid a race.
343          * It should be discarded using:
344          *  - mmap() with MAP_FIXED flag
345          *  - mremap() with MREMAP_FIXED flag
346          *  - shmat() with SHM_REMAP flag
347          */
348         ptr = mmap(g2h_untagged(addr), size, PROT_NONE,
349                    MAP_ANONYMOUS|MAP_PRIVATE|MAP_NORESERVE, -1, 0);
350 
351         /* ENOMEM, if host address space has no memory */
352         if (ptr == MAP_FAILED) {
353             return (abi_ulong)-1;
354         }
355 
356         /* Count the number of sequential returns of the same address.
357            This is used to modify the search algorithm below.  */
358         repeat = (ptr == prev ? repeat + 1 : 0);
359 
360         if (h2g_valid(ptr + size - 1)) {
361             addr = h2g(ptr);
362 
363             if ((addr & (align - 1)) == 0) {
364                 /* Success.  */
365                 if (start == mmap_next_start && addr >= TASK_UNMAPPED_BASE) {
366                     mmap_next_start = addr + size;
367                 }
368                 return addr;
369             }
370 
371             /* The address is not properly aligned for the target.  */
372             switch (repeat) {
373             case 0:
374                 /* Assume the result that the kernel gave us is the
375                    first with enough free space, so start again at the
376                    next higher target page.  */
377                 addr = ROUND_UP(addr, align);
378                 break;
379             case 1:
380                 /* Sometimes the kernel decides to perform the allocation
381                    at the top end of memory instead.  */
382                 addr &= -align;
383                 break;
384             case 2:
385                 /* Start over at low memory.  */
386                 addr = 0;
387                 break;
388             default:
389                 /* Fail.  This unaligned block must the last.  */
390                 addr = -1;
391                 break;
392             }
393         } else {
394             /* Since the result the kernel gave didn't fit, start
395                again at low memory.  If any repetition, fail.  */
396             addr = (repeat ? -1 : 0);
397         }
398 
399         /* Unmap and try again.  */
400         munmap(ptr, size);
401 
402         /* ENOMEM if we checked the whole of the target address space.  */
403         if (addr == (abi_ulong)-1) {
404             return (abi_ulong)-1;
405         } else if (addr == 0) {
406             if (wrapped) {
407                 return (abi_ulong)-1;
408             }
409             wrapped = 1;
410             /* Don't actually use 0 when wrapping, instead indicate
411                that we'd truly like an allocation in low memory.  */
412             addr = (mmap_min_addr > TARGET_PAGE_SIZE
413                      ? TARGET_PAGE_ALIGN(mmap_min_addr)
414                      : TARGET_PAGE_SIZE);
415         } else if (wrapped && addr >= start) {
416             return (abi_ulong)-1;
417         }
418     }
419 }
420 
421 /* NOTE: all the constants are the HOST ones */
422 abi_long target_mmap(abi_ulong start, abi_ulong len, int target_prot,
423                      int flags, int fd, abi_ulong offset)
424 {
425     abi_ulong ret, end, real_start, real_end, retaddr, host_offset, host_len;
426     int page_flags, host_prot;
427 
428     mmap_lock();
429     trace_target_mmap(start, len, target_prot, flags, fd, offset);
430 
431     if (!len) {
432         errno = EINVAL;
433         goto fail;
434     }
435 
436     page_flags = validate_prot_to_pageflags(&host_prot, target_prot);
437     if (!page_flags) {
438         errno = EINVAL;
439         goto fail;
440     }
441 
442     /* Also check for overflows... */
443     len = TARGET_PAGE_ALIGN(len);
444     if (!len) {
445         errno = ENOMEM;
446         goto fail;
447     }
448 
449     if (offset & ~TARGET_PAGE_MASK) {
450         errno = EINVAL;
451         goto fail;
452     }
453 
454     real_start = start & qemu_host_page_mask;
455     host_offset = offset & qemu_host_page_mask;
456 
457     /* If the user is asking for the kernel to find a location, do that
458        before we truncate the length for mapping files below.  */
459     if (!(flags & MAP_FIXED)) {
460         host_len = len + offset - host_offset;
461         host_len = HOST_PAGE_ALIGN(host_len);
462         start = mmap_find_vma(real_start, host_len, TARGET_PAGE_SIZE);
463         if (start == (abi_ulong)-1) {
464             errno = ENOMEM;
465             goto fail;
466         }
467     }
468 
469     /* When mapping files into a memory area larger than the file, accesses
470        to pages beyond the file size will cause a SIGBUS.
471 
472        For example, if mmaping a file of 100 bytes on a host with 4K pages
473        emulating a target with 8K pages, the target expects to be able to
474        access the first 8K. But the host will trap us on any access beyond
475        4K.
476 
477        When emulating a target with a larger page-size than the hosts, we
478        may need to truncate file maps at EOF and add extra anonymous pages
479        up to the targets page boundary.  */
480 
481     if ((qemu_real_host_page_size < qemu_host_page_size) &&
482         !(flags & MAP_ANONYMOUS)) {
483         struct stat sb;
484 
485        if (fstat (fd, &sb) == -1)
486            goto fail;
487 
488        /* Are we trying to create a map beyond EOF?.  */
489        if (offset + len > sb.st_size) {
490            /* If so, truncate the file map at eof aligned with
491               the hosts real pagesize. Additional anonymous maps
492               will be created beyond EOF.  */
493            len = REAL_HOST_PAGE_ALIGN(sb.st_size - offset);
494        }
495     }
496 
497     if (!(flags & MAP_FIXED)) {
498         unsigned long host_start;
499         void *p;
500 
501         host_len = len + offset - host_offset;
502         host_len = HOST_PAGE_ALIGN(host_len);
503 
504         /* Note: we prefer to control the mapping address. It is
505            especially important if qemu_host_page_size >
506            qemu_real_host_page_size */
507         p = mmap(g2h_untagged(start), host_len, host_prot,
508                  flags | MAP_FIXED | MAP_ANONYMOUS, -1, 0);
509         if (p == MAP_FAILED) {
510             goto fail;
511         }
512         /* update start so that it points to the file position at 'offset' */
513         host_start = (unsigned long)p;
514         if (!(flags & MAP_ANONYMOUS)) {
515             p = mmap(g2h_untagged(start), len, host_prot,
516                      flags | MAP_FIXED, fd, host_offset);
517             if (p == MAP_FAILED) {
518                 munmap(g2h_untagged(start), host_len);
519                 goto fail;
520             }
521             host_start += offset - host_offset;
522         }
523         start = h2g(host_start);
524     } else {
525         if (start & ~TARGET_PAGE_MASK) {
526             errno = EINVAL;
527             goto fail;
528         }
529         end = start + len;
530         real_end = HOST_PAGE_ALIGN(end);
531 
532         /*
533          * Test if requested memory area fits target address space
534          * It can fail only on 64-bit host with 32-bit target.
535          * On any other target/host host mmap() handles this error correctly.
536          */
537         if (end < start || !guest_range_valid_untagged(start, len)) {
538             errno = ENOMEM;
539             goto fail;
540         }
541 
542         /* worst case: we cannot map the file because the offset is not
543            aligned, so we read it */
544         if (!(flags & MAP_ANONYMOUS) &&
545             (offset & ~qemu_host_page_mask) != (start & ~qemu_host_page_mask)) {
546             /* msync() won't work here, so we return an error if write is
547                possible while it is a shared mapping */
548             if ((flags & MAP_TYPE) == MAP_SHARED &&
549                 (host_prot & PROT_WRITE)) {
550                 errno = EINVAL;
551                 goto fail;
552             }
553             retaddr = target_mmap(start, len, target_prot | PROT_WRITE,
554                                   MAP_FIXED | MAP_PRIVATE | MAP_ANONYMOUS,
555                                   -1, 0);
556             if (retaddr == -1)
557                 goto fail;
558             if (pread(fd, g2h_untagged(start), len, offset) == -1)
559                 goto fail;
560             if (!(host_prot & PROT_WRITE)) {
561                 ret = target_mprotect(start, len, target_prot);
562                 assert(ret == 0);
563             }
564             goto the_end;
565         }
566 
567         /* handle the start of the mapping */
568         if (start > real_start) {
569             if (real_end == real_start + qemu_host_page_size) {
570                 /* one single host page */
571                 ret = mmap_frag(real_start, start, end,
572                                 host_prot, flags, fd, offset);
573                 if (ret == -1)
574                     goto fail;
575                 goto the_end1;
576             }
577             ret = mmap_frag(real_start, start, real_start + qemu_host_page_size,
578                             host_prot, flags, fd, offset);
579             if (ret == -1)
580                 goto fail;
581             real_start += qemu_host_page_size;
582         }
583         /* handle the end of the mapping */
584         if (end < real_end) {
585             ret = mmap_frag(real_end - qemu_host_page_size,
586                             real_end - qemu_host_page_size, end,
587                             host_prot, flags, fd,
588                             offset + real_end - qemu_host_page_size - start);
589             if (ret == -1)
590                 goto fail;
591             real_end -= qemu_host_page_size;
592         }
593 
594         /* map the middle (easier) */
595         if (real_start < real_end) {
596             void *p;
597             unsigned long offset1;
598             if (flags & MAP_ANONYMOUS)
599                 offset1 = 0;
600             else
601                 offset1 = offset + real_start - start;
602             p = mmap(g2h_untagged(real_start), real_end - real_start,
603                      host_prot, flags, fd, offset1);
604             if (p == MAP_FAILED)
605                 goto fail;
606         }
607     }
608  the_end1:
609     if (flags & MAP_ANONYMOUS) {
610         page_flags |= PAGE_ANON;
611     }
612     page_flags |= PAGE_RESET;
613     page_set_flags(start, start + len, page_flags);
614  the_end:
615     trace_target_mmap_complete(start);
616     if (qemu_loglevel_mask(CPU_LOG_PAGE)) {
617         log_page_dump(__func__);
618     }
619     tb_invalidate_phys_range(start, start + len);
620     mmap_unlock();
621     return start;
622 fail:
623     mmap_unlock();
624     return -1;
625 }
626 
627 static void mmap_reserve(abi_ulong start, abi_ulong size)
628 {
629     abi_ulong real_start;
630     abi_ulong real_end;
631     abi_ulong addr;
632     abi_ulong end;
633     int prot;
634 
635     real_start = start & qemu_host_page_mask;
636     real_end = HOST_PAGE_ALIGN(start + size);
637     end = start + size;
638     if (start > real_start) {
639         /* handle host page containing start */
640         prot = 0;
641         for (addr = real_start; addr < start; addr += TARGET_PAGE_SIZE) {
642             prot |= page_get_flags(addr);
643         }
644         if (real_end == real_start + qemu_host_page_size) {
645             for (addr = end; addr < real_end; addr += TARGET_PAGE_SIZE) {
646                 prot |= page_get_flags(addr);
647             }
648             end = real_end;
649         }
650         if (prot != 0)
651             real_start += qemu_host_page_size;
652     }
653     if (end < real_end) {
654         prot = 0;
655         for (addr = end; addr < real_end; addr += TARGET_PAGE_SIZE) {
656             prot |= page_get_flags(addr);
657         }
658         if (prot != 0)
659             real_end -= qemu_host_page_size;
660     }
661     if (real_start != real_end) {
662         mmap(g2h_untagged(real_start), real_end - real_start, PROT_NONE,
663                  MAP_FIXED | MAP_ANONYMOUS | MAP_PRIVATE | MAP_NORESERVE,
664                  -1, 0);
665     }
666 }
667 
668 int target_munmap(abi_ulong start, abi_ulong len)
669 {
670     abi_ulong end, real_start, real_end, addr;
671     int prot, ret;
672 
673     trace_target_munmap(start, len);
674 
675     if (start & ~TARGET_PAGE_MASK)
676         return -TARGET_EINVAL;
677     len = TARGET_PAGE_ALIGN(len);
678     if (len == 0 || !guest_range_valid_untagged(start, len)) {
679         return -TARGET_EINVAL;
680     }
681 
682     mmap_lock();
683     end = start + len;
684     real_start = start & qemu_host_page_mask;
685     real_end = HOST_PAGE_ALIGN(end);
686 
687     if (start > real_start) {
688         /* handle host page containing start */
689         prot = 0;
690         for(addr = real_start; addr < start; addr += TARGET_PAGE_SIZE) {
691             prot |= page_get_flags(addr);
692         }
693         if (real_end == real_start + qemu_host_page_size) {
694             for(addr = end; addr < real_end; addr += TARGET_PAGE_SIZE) {
695                 prot |= page_get_flags(addr);
696             }
697             end = real_end;
698         }
699         if (prot != 0)
700             real_start += qemu_host_page_size;
701     }
702     if (end < real_end) {
703         prot = 0;
704         for(addr = end; addr < real_end; addr += TARGET_PAGE_SIZE) {
705             prot |= page_get_flags(addr);
706         }
707         if (prot != 0)
708             real_end -= qemu_host_page_size;
709     }
710 
711     ret = 0;
712     /* unmap what we can */
713     if (real_start < real_end) {
714         if (reserved_va) {
715             mmap_reserve(real_start, real_end - real_start);
716         } else {
717             ret = munmap(g2h_untagged(real_start), real_end - real_start);
718         }
719     }
720 
721     if (ret == 0) {
722         page_set_flags(start, start + len, 0);
723         tb_invalidate_phys_range(start, start + len);
724     }
725     mmap_unlock();
726     return ret;
727 }
728 
729 abi_long target_mremap(abi_ulong old_addr, abi_ulong old_size,
730                        abi_ulong new_size, unsigned long flags,
731                        abi_ulong new_addr)
732 {
733     int prot;
734     void *host_addr;
735 
736     if (!guest_range_valid_untagged(old_addr, old_size) ||
737         ((flags & MREMAP_FIXED) &&
738          !guest_range_valid_untagged(new_addr, new_size)) ||
739         ((flags & MREMAP_MAYMOVE) == 0 &&
740          !guest_range_valid_untagged(old_addr, new_size))) {
741         errno = ENOMEM;
742         return -1;
743     }
744 
745     mmap_lock();
746 
747     if (flags & MREMAP_FIXED) {
748         host_addr = mremap(g2h_untagged(old_addr), old_size, new_size,
749                            flags, g2h_untagged(new_addr));
750 
751         if (reserved_va && host_addr != MAP_FAILED) {
752             /* If new and old addresses overlap then the above mremap will
753                already have failed with EINVAL.  */
754             mmap_reserve(old_addr, old_size);
755         }
756     } else if (flags & MREMAP_MAYMOVE) {
757         abi_ulong mmap_start;
758 
759         mmap_start = mmap_find_vma(0, new_size, TARGET_PAGE_SIZE);
760 
761         if (mmap_start == -1) {
762             errno = ENOMEM;
763             host_addr = MAP_FAILED;
764         } else {
765             host_addr = mremap(g2h_untagged(old_addr), old_size, new_size,
766                                flags | MREMAP_FIXED,
767                                g2h_untagged(mmap_start));
768             if (reserved_va) {
769                 mmap_reserve(old_addr, old_size);
770             }
771         }
772     } else {
773         int prot = 0;
774         if (reserved_va && old_size < new_size) {
775             abi_ulong addr;
776             for (addr = old_addr + old_size;
777                  addr < old_addr + new_size;
778                  addr++) {
779                 prot |= page_get_flags(addr);
780             }
781         }
782         if (prot == 0) {
783             host_addr = mremap(g2h_untagged(old_addr),
784                                old_size, new_size, flags);
785 
786             if (host_addr != MAP_FAILED) {
787                 /* Check if address fits target address space */
788                 if (!guest_range_valid_untagged(h2g(host_addr), new_size)) {
789                     /* Revert mremap() changes */
790                     host_addr = mremap(g2h_untagged(old_addr),
791                                        new_size, old_size, flags);
792                     errno = ENOMEM;
793                     host_addr = MAP_FAILED;
794                 } else if (reserved_va && old_size > new_size) {
795                     mmap_reserve(old_addr + old_size, old_size - new_size);
796                 }
797             }
798         } else {
799             errno = ENOMEM;
800             host_addr = MAP_FAILED;
801         }
802     }
803 
804     if (host_addr == MAP_FAILED) {
805         new_addr = -1;
806     } else {
807         new_addr = h2g(host_addr);
808         prot = page_get_flags(old_addr);
809         page_set_flags(old_addr, old_addr + old_size, 0);
810         page_set_flags(new_addr, new_addr + new_size,
811                        prot | PAGE_VALID | PAGE_RESET);
812     }
813     tb_invalidate_phys_range(new_addr, new_addr + new_size);
814     mmap_unlock();
815     return new_addr;
816 }
817