[scudo] Use MAP_NORESERVE to release pages

[vitalybuka]

Summary

This allows to avoid memset in workaround
of QEMU-user implementation of MADV_DONTNEED.

[cryptoad]

compiler-rt/lib/scudo/standalone/linux.cpp

124

Looks like Data is still UNUSED

compiler-rt/lib/scudo/standalone/secondary.h

162

Maybe move that up a block since it's common to the if & else

compiler-rt/lib/scudo/standalone/tests/common_test.cpp

1

There is a misalignment of - compared to the bottom one. Not sure which one has the right count.

18–20

Can this be put in SCUDO_LINUX block and a UNREACHABLE or equivalent for other systems?

37

= {};
Not important for Linux but will be for Fuchsia.

[vitalybuka]

addressing @cryptoad comments

[vitalybuka]

compiler-rt/lib/scudo/standalone/tests/common_test.cpp

37

This file is done on D102994

[hctim]

compiler-rt/lib/scudo/standalone/primary64.h

267

More descriptive defaults: MAP_ALLOWNOMEM | MAP_RESIZABLE?

357

MTE mode can change at runtime after initLinkerInitialized is called, so we do need to re-check useMemoryTagging<>() every time we allocate. Maybe call the member PersistentMapFlags (i.e. it persists across the allocator and is once-init), and add a member getMapFlags() that returns PersistentMapFlags | (useMemoryTagging<>() ? MAP_MEMTAG : 0).

[pcc]

TBH, I'm not sure it's worth going to this much effort to work around this QEMU bug. It seems better to figure out a way to use QEMU in system mode instead.

compiler-rt/lib/scudo/standalone/primary64.h

358

This will continue to create mappings with PROT_MTE after MTE is disabled.

compiler-rt/lib/scudo/standalone/secondary.h

385–386

This will break the split mapping of MTE enabled secondary allocations. The first few pages need to have MTE enabled and the rest have MTE disabled.

[pcc]

compiler-rt/lib/scudo/standalone/primary64.h

267

Initialize to 0 so that the combined allocator remains in bss.

[vitalybuka]

In D102979#2777588, @pcc wrote:

TBH, I'm not sure it's worth going to this much effort to work around this QEMU bug. It seems better to figure out a way to use QEMU in system mode instead.

This does not looks like a lot of work to maintain this, but I propose to threat this as default behavior D102980.
Let's chat about if we need QEMU-user later today.

compiler-rt/lib/scudo/standalone/primary64.h

267

I replaced with function which will return flags.

357

Actually missed this point, and tried to keep same protection.
If so I can just read Options when create ReleaseRecorder.

compiler-rt/lib/scudo/standalone/secondary.h

385–386

Thanks, I missed this one. Seems easy to fix.
Before that I'd like to NFC refactor this code to make it more obvious.

[vitalybuka]

addressed most comments

[vitalybuka]

Avoid tracking Prot flags in allocators

[vitalybuka]

fix x86 build

[vitalybuka]

need reconsider as I found another related issue

compiler-rt/lib/scudo/standalone/common.h

 #define UNMAP_ALL (1U << 0)
 
 void unmap(void *Addr, uptr Size, uptr Flags = 0,
            MapPlatformData *Data = nullptr);
 
 void setMemoryPermission(uptr Addr, uptr Size, uptr Flags,
                          MapPlatformData *Data = nullptr);
 
-void releasePagesToOS(uptr BaseAddress, uptr Offset, uptr Size,
-                      MapPlatformData *Data = nullptr);
+void releasePagesToOS(uptr BaseAddress, uptr Offset, uptr Size, uptr Flags,
+                      MapPlatformData *Data);
 
 // Internal map & unmap fatal error. This must not call map().
 void NORETURN dieOnMapUnmapError(bool OutOfMemory = false);
 
 // Logging related functions.
 
 void setAbortMessage(const char *Message);
 

compiler-rt/lib/scudo/standalone/fuchsia.cpp

const zx_vm_option_t Prot =
       (Flags & MAP_NOACCESS) ? 0 : (ZX_VM_PERM_READ | ZX_VM_PERM_WRITE);
   DCHECK(Data);
   DCHECK_NE(Data->Vmar, ZX_HANDLE_INVALID);
   if (_zx_vmar_protect(Data->Vmar, Prot, Addr, Size) != ZX_OK)
     dieOnMapUnmapError();
 }
 
 void releasePagesToOS(UNUSED uptr BaseAddress, uptr Offset, uptr Size,
-                      MapPlatformData *Data) {
+                      UNUSED uptr Flags, MapPlatformData *Data) {
   DCHECK(Data);
   DCHECK_NE(Data->Vmar, ZX_HANDLE_INVALID);
   DCHECK_NE(Data->Vmo, ZX_HANDLE_INVALID);
   const zx_status_t Status =
       _zx_vmo_op_range(Data->Vmo, ZX_VMO_OP_DECOMMIT, Offset, Size, NULL, 0);
   CHECK_EQ(Status, ZX_OK);
 }
 

compiler-rt/lib/scudo/standalone/linux.cpp

 
 #if SCUDO_ANDROID
 #include <sys/prctl.h>
 // Definitions of prctl arguments to set a vma name in Android kernels.
 #define ANDROID_PR_SET_VMA 0x53564d41
 #define ANDROID_PR_SET_VMA_ANON_NAME 0
 #endif
 
+#if defined(__aarch64__)
+#ifndef PROT_MTE
+#define PROT_MTE 0x20
+#endif
+#endif
+
 namespace scudo {
 
 uptr getPageSize() { return static_cast<uptr>(sysconf(_SC_PAGESIZE)); }
 
 void NORETURN die() { abort(); }
 
 void *map(void *Addr, uptr Size, UNUSED const char *Name, uptr Flags,
           UNUSED MapPlatformData *Data) {
   int MmapFlags = MAP_PRIVATE | MAP_ANONYMOUS;
   int MmapProt;
   if (Flags & MAP_NOACCESS) {
     MmapFlags |= MAP_NORESERVE;
     MmapProt = PROT_NONE;
   } else {
     MmapProt = PROT_READ | PROT_WRITE;
   }
 #if defined(__aarch64__)
-#ifndef PROT_MTE
-#define PROT_MTE 0x20
-#endif
   if (Flags & MAP_MEMTAG)
     MmapProt |= PROT_MTE;
 #endif
   if (Addr) {
     // Currently no scenario for a noaccess mapping with a fixed address.
     DCHECK_EQ(Flags & MAP_NOACCESS, 0);
     MmapFlags |= MAP_FIXED;
   }
static bool madviseNeedsMemsetCached() {
   State NeedsMemset = static_cast<State>(atomic_load_relaxed(&Cache));
   if (NeedsMemset == Unknown) {
     NeedsMemset = madviseNeedsMemset() ? Yes : No;
     atomic_store_relaxed(&Cache, NeedsMemset);
   }
   return NeedsMemset == Yes;
 }
 
-void releasePagesToOS(uptr BaseAddress, uptr Offset, uptr Size,
+void releasePagesToOS(uptr BaseAddress, uptr Offset, uptr Size, uptr Flags,
                       UNUSED MapPlatformData *Data) {
   void *Addr = reinterpret_cast<void *>(BaseAddress + Offset);
   if (madviseNeedsMemsetCached()) {
     // Workaround for QEMU-user ignoring MADV_DONTNEED.
     // https://github.com/qemu/qemu/blob/b1cffefa1b163bce9aebc3416f562c1d3886eeaa/linux-user/syscall.c#L11941
     // https://bugs.launchpad.net/qemu/+bug/1926521
-    memset(Addr, 0, Size);
+    int Prot = (Flags & MAP_NOACCESS) ? PROT_NONE : (PROT_READ | PROT_WRITE);
+#if defined(__aarch64__)
+    if (Flags & MAP_MEMTAG)
+      Prot |= PROT_MTE;
+#endif
+    void *P =
+        mmap(Addr, Size, Prot,
+             MAP_FIXED | MAP_PRIVATE | MAP_ANONYMOUS | MAP_NORESERVE, -1, 0);
+    if (P != Addr)
+      dieOnMapUnmapError();
+    return;
   }
   while (madvise(Addr, Size, MADV_DONTNEED) == -1 && errno == EAGAIN) {
   }
 }
 
 // Calling getenv should be fine (c)(tm) at any time.
 const char *getEnv(const char *Name) { return getenv(Name); }
 

compiler-rt/lib/scudo/standalone/primary32.h

public:
   AtomicOptions Options;
 
 private:
   static const uptr NumClasses = SizeClassMap::NumClasses;
   static const uptr RegionSize = 1UL << Config::PrimaryRegionSizeLog;
   static const uptr NumRegions =
       SCUDO_MMAP_RANGE_SIZE >> Config::PrimaryRegionSizeLog;
   static const u32 MaxNumBatches = SCUDO_ANDROID ? 4U : 8U;
+  static const uptr MapFlags = MAP_ALLOWNOMEM;
   typedef FlatByteMap<NumRegions> ByteMap;
 
   struct SizeClassStats {
     uptr PoppedBlocks;
     uptr PushedBlocks;
   };
 
   struct ReleaseToOsInfo {
uptr computeRegionId(uptr Mem) {
     const uptr Id = Mem >> Config::PrimaryRegionSizeLog;
     CHECK_LT(Id, NumRegions);
     return Id;
   }
 
   uptr allocateRegionSlow() {
     uptr MapSize = 2 * RegionSize;
     const uptr MapBase = reinterpret_cast<uptr>(
-        map(nullptr, MapSize, "scudo:primary", MAP_ALLOWNOMEM));
+        map(nullptr, MapSize, "scudo:primary", MapFlags));
     if (!MapBase)
       return 0;
     const uptr MapEnd = MapBase + MapSize;
     uptr Region = MapBase;
     if (isAligned(Region, RegionSize)) {
       ScopedLock L(RegionsStashMutex);
       if (NumberOfStashedRegions < MaxStashedRegions)
         RegionsStash[NumberOfStashedRegions++] = MapBase + RegionSize;
NOINLINE uptr releaseToOSMaybe(SizeClassInfo *Sci, uptr ClassId,
 
     const uptr First = Sci->MinRegionIndex;
     const uptr Last = Sci->MaxRegionIndex;
     DCHECK_NE(Last, 0U);
     DCHECK_LE(First, Last);
     uptr TotalReleasedBytes = 0;
     const uptr Base = First * RegionSize;
     const uptr NumberOfRegions = Last - First + 1U;
-    ReleaseRecorder Recorder(Base);
+    ReleaseRecorder Recorder(Base, MapFlags, nullptr);
     auto SkipRegion = [this, First, ClassId](uptr RegionIndex) {
       return (PossibleRegions[First + RegionIndex] - 1U) != ClassId;
     };
     auto DecompactPtr = [](CompactPtrT CompactPtr) {
       return reinterpret_cast<uptr>(CompactPtr);
     };
     releaseFreeMemoryToOS(Sci->FreeList, RegionSize, NumberOfRegions, BlockSize,
                           &Recorder, DecompactPtr, SkipRegion);

compiler-rt/lib/scudo/standalone/primary64.h

public:
   }
 
   AtomicOptions Options;
 
 private:
   static const uptr RegionSize = 1UL << Config::PrimaryRegionSizeLog;
   static const uptr NumClasses = SizeClassMap::NumClasses;
   static const uptr PrimarySize = RegionSize * NumClasses;
+  uptr GetMapFlags() const {
+    return MAP_ALLOWNOMEM | MAP_RESIZABLE |
+           (useMemoryTagging<Config>(Options.load()) ? MAP_MEMTAG : 0);
+  }
 
   // Call map for user memory with at least this size.
   static const uptr MapSizeIncrement = 1UL << 18;
   // Fill at most this number of batches from the newly map'd memory.
   static const u32 MaxNumBatches = SCUDO_ANDROID ? 4U : 8U;
 
   struct RegionStats {
     uptr PoppedBlocks;
if (TotalUserBytes > MappedUser) {
               "Scudo OOM: The process has exhausted %zuM for size class %zu.\n",
               RegionSize >> 20, Size);
           Str.output();
         }
         return nullptr;
       }
       if (MappedUser == 0)
         Region->Data = Data;
-      if (UNLIKELY(!map(
-              reinterpret_cast<void *>(RegionBeg + MappedUser), MapSize,
-              "scudo:primary",
-              MAP_ALLOWNOMEM | MAP_RESIZABLE |
-                  (useMemoryTagging<Config>(Options.load()) ? MAP_MEMTAG : 0),
+      if (UNLIKELY(!map(reinterpret_cast<void *>(RegionBeg + MappedUser),
+                        MapSize, "scudo:primary", GetMapFlags(),
                         &Region->Data)))
         return nullptr;
       Region->MappedUser += MapSize;
       C->getStats().add(StatMapped, MapSize);
     }
 
     const u32 NumberOfBlocks = Min(
         MaxNumBatches * MaxCount,
         static_cast<u32>((Region->MappedUser - Region->AllocatedUser) / Size));
if (!Force) {
         return 0;
       if (Region->ReleaseInfo.LastReleaseAtNs +
               static_cast<u64>(IntervalMs) * 1000000 >
           getMonotonicTime()) {
         return 0; // Memory was returned recently.
       }
     }
 
-    ReleaseRecorder Recorder(Region->RegionBeg, &Region->Data);
+    ReleaseRecorder Recorder(Region->RegionBeg, GetMapFlags(), &Region->Data);
     const uptr CompactPtrBase = getCompactPtrBaseByClassId(ClassId);
     auto DecompactPtr = [CompactPtrBase](CompactPtrT CompactPtr) {
       return decompactPtrInternal(CompactPtrBase, CompactPtr);
     };
     auto SkipRegion = [](UNUSED uptr RegionIndex) { return false; };
     releaseFreeMemoryToOS(Region->FreeList, Region->AllocatedUser, 1U,
                           BlockSize, &Recorder, DecompactPtr, SkipRegion);
 

compiler-rt/lib/scudo/standalone/release.h

 #include "common.h"
 #include "list.h"
 #include "mutex.h"
 
 namespace scudo {
 
 class ReleaseRecorder {
 public:
-  ReleaseRecorder(uptr Base, MapPlatformData *Data = nullptr)
-      : Base(Base), Data(Data) {}
+  ReleaseRecorder(uptr Base, uptr Flags, MapPlatformData *Data)
+      : Base(Base), Flags(Flags), Data(Data) {}
 
   uptr getReleasedRangesCount() const { return ReleasedRangesCount; }
 
   uptr getReleasedBytes() const { return ReleasedBytes; }
 
   uptr getBase() const { return Base; }
 
   // Releases [From, To) range of pages back to OS.
   void releasePageRangeToOS(uptr From, uptr To) {
     const uptr Size = To - From;
-    releasePagesToOS(Base, From, Size, Data);
+    releasePagesToOS(Base, From, Size, Flags, Data);
     ReleasedRangesCount++;
     ReleasedBytes += Size;
   }
 
 private:
   uptr ReleasedRangesCount = 0;
   uptr ReleasedBytes = 0;
   uptr Base = 0;
+  uptr Flags = MAP_NOACCESS;
   MapPlatformData *Data = nullptr;
 };
 
 // A packed array of Counters. Each counter occupies 2^N bits, enough to store
 // counter's MaxValue. Ctor will try to use a static buffer first, and if that
 // fails (the buffer is too small or already locked), will allocate the
 // required Buffer via map(). The caller is expected to check whether the
 // initialization was successful by checking isAllocated() result. For

compiler-rt/lib/scudo/standalone/secondary.h

struct alignas(Max<uptr>(archSupportsMemoryTagging()
                              : 1,
                          1U << SCUDO_MIN_ALIGNMENT_LOG)) Header {
   LargeBlock::Header *Prev;
   LargeBlock::Header *Next;
   uptr CommitBase;
   uptr CommitSize;
   uptr MapBase;
   uptr MapSize;
+  uptr MapFlags;
   [[no_unique_address]] MapPlatformData Data;
 };
 
 static_assert(sizeof(Header) % (1U << SCUDO_MIN_ALIGNMENT_LOG) == 0, "");
 static_assert(!archSupportsMemoryTagging() ||
                   sizeof(Header) % archMemoryTagGranuleSize() == 0,
               "");
 
void store(Options Options, LargeBlock::Header *H) {
     const s32 Interval = atomic_load_relaxed(&ReleaseToOsIntervalMs);
     const u64 Time = getMonotonicTime();
     const u32 MaxCount = atomic_load_relaxed(&MaxEntriesCount);
     CachedBlock Entry;
     Entry.CommitBase = H->CommitBase;
     Entry.CommitSize = H->CommitSize;
     Entry.MapBase = H->MapBase;
     Entry.MapSize = H->MapSize;
+    Entry.MapFlags = H->MapFlags;
     Entry.BlockBegin = reinterpret_cast<uptr>(H + 1);
     Entry.Data = H->Data;
     Entry.Time = Time;
     if (useMemoryTagging<Config>(Options)) {
+      Entry.MapFlags = MAP_NOACCESS;
       if (Interval == 0 && !SCUDO_FUCHSIA) {
         // Release the memory and make it inaccessible at the same time by
         // creating a new MAP_NOACCESS mapping on top of the existing mapping.
         // Fuchsia does not support replacing mappings by creating a new mapping
         // on top so we just do the two syscalls there.
         Entry.Time = 0;
         mapSecondary<Config>(Options, Entry.CommitBase, Entry.CommitSize,
-                             Entry.CommitBase, MAP_NOACCESS, &Entry.Data);
+                             Entry.CommitBase, Entry.MapFlags, &Entry.Data);
       } else {
-        setMemoryPermission(Entry.CommitBase, Entry.CommitSize, MAP_NOACCESS,
+        setMemoryPermission(Entry.CommitBase, Entry.CommitSize, Entry.MapFlags,
                             &Entry.Data);
       }
     } else if (Interval == 0) {
-      releasePagesToOS(Entry.CommitBase, 0, Entry.CommitSize, &Entry.Data);
+      releasePagesToOS(Entry.CommitBase, 0, Entry.CommitSize, Entry.MapFlags,
+                       &Entry.Data);
       Entry.Time = 0;
     }
     do {
       ScopedLock L(Mutex);
       if (useMemoryTagging<Config>(Options) && QuarantinePos == -1U) {
         // If we get here then memory tagging was disabled in between when we
         // read Options and when we locked Mutex. We can't insert our entry into
         // the quarantine or the cache because the permissions would be wrong so
uptr HeaderPos;
         Entries[I].CommitBase = 0;
         break;
       }
     }
     if (Found) {
       *H = reinterpret_cast<LargeBlock::Header *>(
           LargeBlock::addHeaderTag<Config>(HeaderPos));
       *Zeroed = Entry.Time == 0;
-      if (useMemoryTagging<Config>(Options))
-        setMemoryPermission(Entry.CommitBase, Entry.CommitSize, 0, &Entry.Data);
+      if (useMemoryTagging<Config>(Options)) {
+        Entry.MapFlags = 0;
+        setMemoryPermission(Entry.CommitBase, Entry.CommitSize, Entry.MapFlags,
+                            &Entry.Data);
+      }
       uptr NewBlockBegin = reinterpret_cast<uptr>(*H + 1);
       if (useMemoryTagging<Config>(Options)) {
         if (*Zeroed)
           storeTags(LargeBlock::addHeaderTag<Config>(Entry.CommitBase),
                     NewBlockBegin);
         else if (Entry.BlockBegin < NewBlockBegin)
           storeTags(Entry.BlockBegin, NewBlockBegin);
         else
           storeTags(untagPointer(NewBlockBegin),
                     untagPointer(Entry.BlockBegin));
       }
       (*H)->CommitBase = Entry.CommitBase;
       (*H)->CommitSize = Entry.CommitSize;
       (*H)->MapBase = Entry.MapBase;
       (*H)->MapSize = Entry.MapSize;
       (*H)->Data = Entry.Data;
+      (*H)->MapFlags = Entry.MapFlags;
       EntriesCount--;
     }
     return Found;
   }
 
   bool canCache(uptr Size) {
     return atomic_load_relaxed(&MaxEntriesCount) != 0U &&
            Size <= atomic_load_relaxed(&MaxEntrySize);
for (u32 I = 0; I != Config::SecondaryCacheQuarantineSize; ++I) {
       if (Quarantine[I].CommitBase) {
         unmap(reinterpret_cast<void *>(Quarantine[I].MapBase),
               Quarantine[I].MapSize, UNMAP_ALL, &Quarantine[I].Data);
         Quarantine[I].CommitBase = 0;
       }
     }
     const u32 MaxCount = atomic_load_relaxed(&MaxEntriesCount);
     for (u32 I = 0; I < MaxCount; I++)
-      if (Entries[I].CommitBase)
-        setMemoryPermission(Entries[I].CommitBase, Entries[I].CommitSize, 0,
-                            &Entries[I].Data);
+      if (Entries[I].CommitBase) {
+        Entries[I].MapFlags = 0;
+        setMemoryPermission(Entries[I].CommitBase, Entries[I].CommitSize,
+                            Entries[I].MapFlags, &Entries[I].Data);
+      }
     QuarantinePos = -1U;
   }
 
   void disable() { Mutex.lock(); }
 
   void enable() { Mutex.unlock(); }
 
 private:
private:
   }
 
   struct CachedBlock {
     uptr CommitBase;
     uptr CommitSize;
     uptr MapBase;
     uptr MapSize;
     uptr BlockBegin;
+    uptr MapFlags;
     [[no_unique_address]] MapPlatformData Data;
     u64 Time;
   };
 
   void releaseIfOlderThan(CachedBlock &Entry, u64 Time) {
     if (!Entry.CommitBase || !Entry.Time)
       return;
     if (Entry.Time > Time) {
       if (OldestTime == 0 || Entry.Time < OldestTime)
         OldestTime = Entry.Time;
       return;
     }
-    releasePagesToOS(Entry.CommitBase, 0, Entry.CommitSize, &Entry.Data);
+    releasePagesToOS(Entry.CommitBase, 0, Entry.CommitSize, Entry.MapFlags,
+                     &Entry.Data);
     Entry.Time = 0;
   }
 
   void releaseOlderThan(u64 Time) {
     ScopedLock L(Mutex);
     if (!EntriesCount || OldestTime == 0 || OldestTime > Time)
       return;
     OldestTime = 0;
if (UNLIKELY(Alignment >= PageSize)) {
     if (SCUDO_WORDSIZE == 32U && NewMapEnd != MapEnd) {
       unmap(reinterpret_cast<void *>(NewMapEnd), MapEnd - NewMapEnd, 0, &Data);
       MapEnd = NewMapEnd;
     }
   }
 
   const uptr CommitSize = MapEnd - PageSize - CommitBase;
   const uptr AllocPos = roundDownTo(CommitBase + CommitSize - Size, Alignment);
-  mapSecondary<Config>(Options, CommitBase, CommitSize, AllocPos, 0, &Data);
+  const uptr MapFlags = 0;
+  mapSecondary<Config>(Options, CommitBase, CommitSize, AllocPos, MapFlags,
+                       &Data);
   const uptr HeaderPos =
       AllocPos - Chunk::getHeaderSize() - LargeBlock::getHeaderSize();
   LargeBlock::Header *H = reinterpret_cast<LargeBlock::Header *>(
       LargeBlock::addHeaderTag<Config>(HeaderPos));
   if (useMemoryTagging<Config>(Options))
     storeTags(LargeBlock::addHeaderTag<Config>(CommitBase),
               reinterpret_cast<uptr>(H + 1));
   H->MapBase = MapBase;
   H->MapSize = MapEnd - MapBase;
   H->CommitBase = CommitBase;
   H->CommitSize = CommitSize;
   H->Data = Data;
+  H->MapFlags = MapFlags;
   if (BlockEndPtr)
     *BlockEndPtr = CommitBase + CommitSize;
   {
     ScopedLock L(Mutex);
     InUseBlocks.push_back(H);
     AllocatedBytes += CommitSize;
     if (LargestSize < CommitSize)
       LargestSize = CommitSize;

compiler-rt/lib/scudo/standalone/tests/common_test.cpp

 //===-- common_test.cpp -----------------------------------------*- C++ -*-===//
 //
 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
 // See https://llvm.org/LICENSE.txt for license information.
 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
 //
 //===----------------------------------------------------------------------===//
 
 #include "internal_defs.h"
 #include "tests/scudo_unit_test.h"
 
 #include "common.h"
 #include <algorithm>
 #include <fstream>
 
 namespace scudo {
 
 static uptr getResidentMemorySize() {
   if (!SCUDO_LINUX)
     UNREACHABLE("Not implemented!");
   uptr Size;
   uptr Resident;
   std::ifstream IFS("/proc/self/statm");
   IFS >> Size;
   IFS >> Resident;
   return Resident * getPageSizeCached();
 }
 
 // Fuchsia needs getResidentMemorySize implementation.
 TEST(ScudoCommonTest, SKIP_ON_FUCHSIA(ResidentMemorySize)) {
   uptr OnStart = getResidentMemorySize();
   EXPECT_GT(OnStart, 0);
 
   const uptr Size = 1ull << 30;
   const uptr Threshold = Size >> 3;
 
   MapPlatformData Data = {};
   uptr *P = reinterpret_cast<uptr *>(
       map(nullptr, Size, "ResidentMemorySize", 0, &Data));
   const uptr N = Size / sizeof(*P);
   ASSERT_NE(nullptr, P);
   EXPECT_EQ(std::count(P, P + N, 0), N);
   EXPECT_LT(getResidentMemorySize() - OnStart, Threshold);
 
   memset(P, 1, Size);
   EXPECT_EQ(std::count(P, P + N, 0), 0);
   EXPECT_LT(getResidentMemorySize() - Size, Threshold);
 
-  releasePagesToOS((uptr)P, 0, Size, &Data);
+  releasePagesToOS((uptr)P, 0, Size, 0, &Data);
   EXPECT_EQ(std::count(P, P + N, 0), N);
-  // FIXME: does not work with QEMU-user.
-  // EXPECT_LT(getResidentMemorySize() - OnStart, Threshold);
+  EXPECT_LT(getResidentMemorySize() - OnStart, Threshold);
 
   memset(P, 1, Size);
   EXPECT_EQ(std::count(P, P + N, 0), 0);
   EXPECT_LT(getResidentMemorySize() - Size, Threshold);
 }
 
 } // namespace scudo