new file mode 100644
@@ -0,0 +1,10 @@
+#ifndef QEMU_MMAP_ALLOC
+#define QEMU_MMAP_ALLOC
+
+#include "qemu-common.h"
+
+void *qemu_ram_mmap(int fd, size_t size, size_t align);
+
+void qemu_ram_munmap(void *ptr, size_t size);
+
+#endif
@@ -84,9 +84,9 @@ static MemoryRegion io_mem_unassigned;
*/
#define RAM_RESIZEABLE (1 << 2)
-/* An extra page is mapped on top of this RAM.
+/* RAM is backed by an mmapped file.
*/
-#define RAM_EXTRA (1 << 3)
+#define RAM_FILE (1 << 3)
#endif
struct CPUTailQ cpus = QTAILQ_HEAD_INITIALIZER(cpus);
@@ -1250,40 +1250,14 @@ static void *file_ram_alloc(RAMBlock *block,
perror("ftruncate");
}
- ptr = mmap(0, total, PROT_NONE, MAP_PRIVATE | MAP_ANONYMOUS,
- -1, 0);
- if (ptr == MAP_FAILED) {
- error_setg_errno(errp, errno,
- "unable to allocate memory range for hugepages");
- close(fd);
- goto error;
- }
-
- offset = QEMU_ALIGN_UP((uintptr_t)ptr, hpagesize) - (uintptr_t)ptr;
-
- area = mmap(ptr + offset, memory, PROT_READ | PROT_WRITE,
- (block->flags & RAM_SHARED ? MAP_SHARED : MAP_PRIVATE) |
- MAP_FIXED,
- fd, 0);
+ area = qemu_ram_mmap(fd, memory, hpagesize);
if (area == MAP_FAILED) {
error_setg_errno(errp, errno,
"unable to map backing store for hugepages");
- munmap(ptr, total);
close(fd);
goto error;
}
- if (offset > 0) {
- munmap(ptr, offset);
- }
- ptr += offset;
- total -= offset;
-
- if (total > memory + getpagesize()) {
- munmap(ptr + memory + getpagesize(),
- total - memory - getpagesize());
- }
-
if (mem_prealloc) {
os_mem_prealloc(fd, area, memory);
}
@@ -1601,7 +1575,7 @@ ram_addr_t qemu_ram_alloc_from_file(ram_addr_t size, MemoryRegion *mr,
new_block->used_length = size;
new_block->max_length = size;
new_block->flags = share ? RAM_SHARED : 0;
- new_block->flags |= RAM_EXTRA;
+ new_block->flags |= RAM_FILE;
new_block->host = file_ram_alloc(new_block, size,
mem_path, errp);
if (!new_block->host) {
@@ -1703,8 +1677,8 @@ static void reclaim_ramblock(RAMBlock *block)
xen_invalidate_map_cache_entry(block->host);
#ifndef _WIN32
} else if (block->fd >= 0) {
- if (block->flags & RAM_EXTRA) {
- munmap(block->host, block->max_length + getpagesize());
+ if (block->flags & RAM_FILE) {
+ qemu_ram_munmap(block->host, block->max_length);
} else {
munmap(block->host, block->max_length);
}
new file mode 100644
@@ -0,0 +1,56 @@
+/*
+ * Support for RAM backed by mmaped host memory.
+ *
+ * Copyright (c) 2015 Red Hat, Inc.
+ *
+ * Authors:
+ * Michael S. Tsirkin <mst@redhat.com>
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2 or
+ * later. See the COPYING file in the top-level directory.
+ */
+#include <qemu/mmap-alloc.h>
+#include <sys/types.h>
+#include <sys/mman.h>
+
+void *qemu_ram_mmap(int fd, size_t size, size_t align)
+{
+ size_t total = size + align;
+ void *ptr = mmap(0, total, PROT_NONE, MAP_ANONYMOUS | MAP_PRIVATE, -1, 0);
+ size_t offset = QEMU_ALIGN_UP((uintptr_t)ptr, align) - (uintptr_t)ptr;
+ void *ptr1;
+
+ if (ptr == MAP_FAILED) {
+ return NULL;
+ }
+
+ if (alignment) {
+ *alignment = align;
+ }
+
+ ptr1 = mmap(ptr + offset, size, PROT_READ | PROT_WRITE,
+ MAP_FIXED | MAP_ANONYMOUS | MAP_PRIVATE, fd, 0);
+ if (ptr1 == MAP_FAILED) {
+ munmap(ptr, total);
+ return NULL;
+ }
+
+ ptr += offset;
+ total -= offset;
+
+ if (offset > 0) {
+ munmap(ptr - offset, offset);
+ }
+ if (total > size + getpagesize()) {
+ munmap(ptr + size + getpagesize(), total - size - getpagesize());
+ }
+
+ return ptr;
+}
+
+void qemu_ram_munmap(void *ptr)
+{
+ if (ptr) {
+ munmap(ptr, size + getpagesize());
+ }
+}
@@ -72,6 +72,8 @@ extern int daemon(int, int);
#include <sys/sysctl.h>
#endif
+#include <qemu/mmap-alloc.h>
+
int qemu_get_thread_id(void)
{
#if defined(__linux__)
@@ -128,10 +130,7 @@ void *qemu_memalign(size_t alignment, size_t size)
void *qemu_anon_ram_alloc(size_t size, uint64_t *alignment)
{
size_t align = QEMU_VMALLOC_ALIGN;
- size_t total = size + align;
- void *ptr = mmap(0, total, PROT_NONE, MAP_ANONYMOUS | MAP_PRIVATE, -1, 0);
- size_t offset = QEMU_ALIGN_UP((uintptr_t)ptr, align) - (uintptr_t)ptr;
- void *ptr1;
+ void *ptr = qemu_ram_mmap(-1, size, align);
if (ptr == MAP_FAILED) {
return NULL;
@@ -141,23 +140,6 @@ void *qemu_anon_ram_alloc(size_t size, uint64_t *alignment)
*alignment = align;
}
- ptr1 = mmap(ptr + offset, size, PROT_READ | PROT_WRITE,
- MAP_FIXED | MAP_ANONYMOUS | MAP_PRIVATE, -1, 0);
- if (ptr1 == MAP_FAILED) {
- munmap(ptr, total);
- return NULL;
- }
-
- ptr += offset;
- total -= offset;
-
- if (offset > 0) {
- munmap(ptr - offset, offset);
- }
- if (total > size + getpagesize()) {
- munmap(ptr + size + getpagesize(), total - size - getpagesize());
- }
-
trace_qemu_anon_ram_alloc(size, ptr);
return ptr;
}
@@ -171,9 +153,7 @@ void qemu_vfree(void *ptr)
void qemu_anon_ram_free(void *ptr, size_t size)
{
trace_qemu_anon_ram_free(ptr, size);
- if (ptr) {
- munmap(ptr, size + getpagesize());
- }
+ qemu_ram_munmap(ptr, size);
}
void qemu_set_block(int fd)
@@ -1,6 +1,6 @@
util-obj-y = osdep.o cutils.o unicode.o qemu-timer-common.o
util-obj-$(CONFIG_WIN32) += oslib-win32.o qemu-thread-win32.o event_notifier-win32.o
-util-obj-$(CONFIG_POSIX) += oslib-posix.o qemu-thread-posix.o event_notifier-posix.o qemu-openpty.o
+util-obj-$(CONFIG_POSIX) += oslib-posix.o qemu-thread-posix.o event_notifier-posix.o qemu-openpty.o mmap-alloc.o
util-obj-y += envlist.o path.o module.o
util-obj-$(call lnot,$(CONFIG_INT128)) += host-utils.o
util-obj-y += bitmap.o bitops.o hbitmap.o
Anonymous and file-backed RAM allocation are now almost exactly the same. Reduce code duplication by moving RAM mmap code out of oslib-posix.c and exec.c. Signed-off-by: Michael S. Tsirkin <mst@redhat.com> --- This is on top of the patchset: add mitigation against buffer overflows include/qemu/mmap-alloc.h | 10 +++++++++ exec.c | 38 +++++--------------------------- util/mmap-alloc.c | 56 +++++++++++++++++++++++++++++++++++++++++++++++ util/oslib-posix.c | 28 ++++-------------------- util/Makefile.objs | 2 +- 5 files changed, 77 insertions(+), 57 deletions(-) create mode 100644 include/qemu/mmap-alloc.h create mode 100644 util/mmap-alloc.c