1 #include <kern/zalloc.h>
2 #include <kern/thread_test_context.h>
3
4 #include "vm_parameter_validation.h"
5
6 #pragma clang diagnostic ignored "-Wdeclaration-after-statement"
7 #pragma clang diagnostic ignored "-Wincompatible-function-pointer-types"
8 #pragma clang diagnostic ignored "-Wmissing-prototypes"
9 #pragma clang diagnostic ignored "-Wpedantic"
10 #pragma clang diagnostic ignored "-Wgcc-compat"
11
12
13 // Kernel sysctl test prints its output into a userspace buffer.
14 // fixme these global variables prevent test concurrency
15
16 static user_addr_t SYSCTL_OUTPUT_BUF;
17 static user_addr_t SYSCTL_OUTPUT_END;
18
19 // This is a read/write fd passed from userspace.
20 // It's passed to make it easier for kernel tests to interact with a file.
21 static int file_descriptor;
22
23 // Output to create a golden test result in kern test, controlled by
24 // MSB in file_descriptor and set by GENERATE_GOLDEN_IMAGE from userspace.
25 bool kernel_generate_golden = FALSE;
26
27 // vprintf() to a userspace buffer
28 // output is incremented to point at the new nul terminator
29 static void
user_vprintf(user_addr_t * output,user_addr_t output_end,const char * format,va_list args)30 user_vprintf(user_addr_t *output, user_addr_t output_end, const char *format, va_list args) __printflike(3, 0)
31 {
32 extern int vsnprintf(char *, size_t, const char *, va_list) __printflike(3, 0);
33 char linebuf[1024];
34 size_t printed;
35
36 printed = vsnprintf(linebuf, sizeof(linebuf), format, args);
37 assert(printed < sizeof(linebuf) - 1);
38 assert(*output + printed + 1 < output_end);
39 copyout(linebuf, *output, printed + 1);
40 *output += printed;
41 }
42
43 void
testprintf(const char * format,...)44 testprintf(const char *format, ...)
45 {
46 va_list args;
47 va_start(args, format);
48 user_vprintf(&SYSCTL_OUTPUT_BUF, SYSCTL_OUTPUT_END, format, args);
49 va_end(args);
50 }
51
52 // Utils
53
54 static mach_port_t
make_a_mem_object(vm_size_t size)55 make_a_mem_object(vm_size_t size)
56 {
57 ipc_port_t out_handle;
58 kern_return_t kr = mach_memory_object_memory_entry_64((host_t)1, /*internal=*/ true, size, VM_PROT_READ | VM_PROT_WRITE, 0, &out_handle);
59 assert(kr == 0);
60 return out_handle;
61 }
62
63 static mach_port_t
make_a_mem_entry(MAP_T map,vm_size_t size)64 make_a_mem_entry(MAP_T map, vm_size_t size)
65 {
66 mach_port_t port;
67 memory_object_size_t s = (memory_object_size_t)size;
68 kern_return_t kr = mach_make_memory_entry_64(map, &s, (memory_object_offset_t)0, MAP_MEM_NAMED_CREATE | MAP_MEM_LEDGER_TAGGED, &port, MACH_PORT_NULL);
69 assert(kr == 0);
70 return port;
71 }
72
73 // Test functions
74
75 static results_t *
test_vm_map_copy_overwrite(kern_return_t (* func)(MAP_T dst_map,vm_map_copy_t copy,mach_vm_address_t start,mach_vm_size_t size),const char * testname)76 test_vm_map_copy_overwrite(kern_return_t (*func)(MAP_T dst_map, vm_map_copy_t copy, mach_vm_address_t start, mach_vm_size_t size), const char * testname)
77 {
78 // source map: has an allocation bigger than our
79 // "reasonable" trial sizes, to copy from
80 MAP_T src_map SMART_MAP;
81 allocation_t src_alloc SMART_ALLOCATE_VM(src_map, TEST_ALLOC_SIZE, VM_PROT_READ);
82
83 // dest map: has an allocation bigger than our
84 // "reasonable" trial sizes, to copy-overwrite on
85 MAP_T dst_map SMART_MAP;
86 allocation_t dst_alloc SMART_ALLOCATE_VM(dst_map, TEST_ALLOC_SIZE, VM_PROT_DEFAULT);
87
88 // We test dst/size parameters.
89 // We don't test the contents of the vm_map_copy_t.
90 start_size_trials_t *trials SMART_START_SIZE_TRIALS(dst_alloc.addr);
91 results_t *results = alloc_results(testname, eSMART_START_SIZE_TRIALS, dst_alloc.addr, trials->count);
92
93 for (unsigned i = 0; i < trials->count; i++) {
94 start_size_trial_t trial = trials->list[i];
95
96 // Copy from the source.
97 vm_map_copy_t copy;
98 kern_return_t kr = vm_map_copyin(src_map, src_alloc.addr, src_alloc.size, false, ©);
99 assert(kr == 0);
100 assert(copy); // null copy won't exercise the sanitization path
101
102 // Copy-overwrite to the destination.
103 kern_return_t ret = func(dst_map, copy, trial.start, trial.size);
104
105 if (ret != KERN_SUCCESS) {
106 vm_map_copy_discard(copy);
107 }
108 append_result(results, ret, trial.name);
109 }
110 return results;
111 }
112
113 /*
114 * This function temporarily allocates a writeable allocation in kernel_map, and a read only allocation in a temporary map.
115 * It's used to test a function such as vm_map_read_user which copies in data to a kernel pointer that must be writeable.
116 */
117 static results_t *
test_src_kerneldst_size(kern_return_t (* func)(MAP_T map,vm_map_offset_t src,void * dst,vm_size_t length),const char * testname)118 test_src_kerneldst_size(kern_return_t (*func)(MAP_T map, vm_map_offset_t src, void * dst, vm_size_t length), const char * testname)
119 {
120 MAP_T map SMART_MAP;
121 allocation_t src_base SMART_ALLOCATE_VM(map, TEST_ALLOC_SIZE, VM_PROT_READ);
122 allocation_t dst_base SMART_ALLOCATE_VM(kernel_map, TEST_ALLOC_SIZE, VM_PROT_DEFAULT);
123 src_dst_size_trials_t * trials SMART_SRC_DST_SIZE_TRIALS();
124 results_t *results = alloc_results(testname, eSMART_SRC_DST_SIZE_TRIALS, trials->count);
125
126 for (unsigned i = 0; i < trials->count; i++) {
127 src_dst_size_trial_t trial = trials->list[i];
128 trial = slide_trial_src(trial, src_base.addr);
129 trial = slide_trial_dst(trial, dst_base.addr);
130 int ret = func(map, trial.src, (void *)trial.dst, trial.size);
131 append_result(results, ret, trial.name);
132 }
133 return results;
134 }
135
136 /*
137 * This function temporarily allocates a read only allocation in kernel_map, and a writeable allocation in a temporary map.
138 * It's used to test a function such as vm_map_write_user which copies data from a kernel pointer to a writeable userspace address.
139 */
140 static results_t *
test_kernelsrc_dst_size(kern_return_t (* func)(MAP_T map,void * src,vm_map_offset_t dst,vm_size_t length),const char * testname)141 test_kernelsrc_dst_size(kern_return_t (*func)(MAP_T map, void *src, vm_map_offset_t dst, vm_size_t length), const char * testname)
142 {
143 MAP_T map SMART_MAP;
144 allocation_t src_base SMART_ALLOCATE_VM(kernel_map, TEST_ALLOC_SIZE, VM_PROT_READ);
145 allocation_t dst_base SMART_ALLOCATE_VM(map, TEST_ALLOC_SIZE, VM_PROT_DEFAULT);
146 src_dst_size_trials_t * trials SMART_SRC_DST_SIZE_TRIALS();
147 results_t *results = alloc_results(testname, eSMART_SRC_DST_SIZE_TRIALS, trials->count);
148
149 for (unsigned i = 0; i < trials->count; i++) {
150 src_dst_size_trial_t trial = trials->list[i];
151 trial = slide_trial_src(trial, src_base.addr);
152 trial = slide_trial_dst(trial, dst_base.addr);
153 int ret = func(map, (void *)trial.src, trial.dst, trial.size);
154 append_result(results, ret, trial.name);
155 }
156 return results;
157 }
158
159
160 /////////////////////////////////////////////////////
161 // Mach tests
162
163
164 static kern_return_t
call_mach_vm_read(MAP_T map,mach_vm_address_t start,mach_vm_size_t size)165 call_mach_vm_read(MAP_T map, mach_vm_address_t start, mach_vm_size_t size)
166 {
167 vm_offset_t out_addr;
168 mach_msg_type_number_t out_size;
169 kern_return_t kr = mach_vm_read(map, start, size, &out_addr, &out_size);
170 if (kr == 0) {
171 // we didn't call through MIG so out_addr is really a vm_map_copy_t
172 vm_map_copy_discard((vm_map_copy_t)out_addr);
173 }
174 return kr;
175 }
176
177 static inline void
check_vm_map_copyin_outparam_changes(kern_return_t * kr,vm_map_copy_t copy,vm_map_copy_t saved_copy)178 check_vm_map_copyin_outparam_changes(kern_return_t * kr, vm_map_copy_t copy, vm_map_copy_t saved_copy)
179 {
180 if (*kr == KERN_SUCCESS) {
181 if (copy == saved_copy) {
182 *kr = OUT_PARAM_BAD;
183 }
184 } else {
185 if (copy != saved_copy) {
186 *kr = OUT_PARAM_BAD;
187 }
188 }
189 }
190
191 static kern_return_t
call_vm_map_copyin(MAP_T map,mach_vm_address_t start,mach_vm_size_t size)192 call_vm_map_copyin(MAP_T map, mach_vm_address_t start, mach_vm_size_t size)
193 {
194 vm_map_copy_t invalid_initial_value = INVALID_VM_MAP_COPY;
195 vm_map_copy_t copy = invalid_initial_value;
196 kern_return_t kr = vm_map_copyin(map, start, size, false, ©);
197 if (kr == 0) {
198 vm_map_copy_discard(copy);
199 }
200 check_vm_map_copyin_outparam_changes(&kr, copy, invalid_initial_value);
201 return kr;
202 }
203
204 static kern_return_t
call_copyoutmap_atomic32(MAP_T map,vm_map_offset_t addr)205 call_copyoutmap_atomic32(MAP_T map, vm_map_offset_t addr)
206 {
207 uint32_t data = 0;
208 kern_return_t kr = copyoutmap_atomic32(map, data, addr);
209 return kr;
210 }
211
212
213 static kern_return_t
call_mach_vm_allocate__flags(MAP_T map,mach_vm_address_t * start,mach_vm_size_t size,int flags)214 call_mach_vm_allocate__flags(MAP_T map, mach_vm_address_t * start, mach_vm_size_t size, int flags)
215 {
216 mach_vm_address_t saved_start = *start;
217 kern_return_t kr = mach_vm_allocate_external(map, start, size, flags);
218 check_mach_vm_allocate_outparam_changes(&kr, *start, size, saved_start, flags, map);
219 return kr;
220 }
221
222 static kern_return_t
call_mach_vm_allocate__start_size_fixed(MAP_T map,mach_vm_address_t * start,mach_vm_size_t size)223 call_mach_vm_allocate__start_size_fixed(MAP_T map, mach_vm_address_t * start, mach_vm_size_t size)
224 {
225 mach_vm_address_t saved_start = *start;
226 kern_return_t kr = mach_vm_allocate_external(map, start, size, VM_FLAGS_FIXED);
227 check_mach_vm_allocate_outparam_changes(&kr, *start, size, saved_start, VM_FLAGS_FIXED, map);
228 return kr;
229 }
230
231 static kern_return_t
call_mach_vm_allocate__start_size_anywhere(MAP_T map,mach_vm_address_t * start,mach_vm_size_t size)232 call_mach_vm_allocate__start_size_anywhere(MAP_T map, mach_vm_address_t * start, mach_vm_size_t size)
233 {
234 mach_vm_address_t saved_start = *start;
235 kern_return_t kr = mach_vm_allocate_external(map, start, size, VM_FLAGS_ANYWHERE);
236 check_mach_vm_allocate_outparam_changes(&kr, *start, size, saved_start, VM_FLAGS_ANYWHERE, map);
237 return kr;
238 }
239
240 static kern_return_t
call_mach_vm_allocate_kernel__flags(MAP_T map,mach_vm_address_t * start,mach_vm_size_t size,int flags)241 call_mach_vm_allocate_kernel__flags(MAP_T map, mach_vm_address_t * start, mach_vm_size_t size, int flags)
242 {
243 mach_vm_address_t saved_start = *start;
244 kern_return_t kr = mach_vm_allocate_kernel(map, start, size,
245 FLAGS_AND_TAG(flags, VM_KERN_MEMORY_OSFMK));
246 check_mach_vm_allocate_outparam_changes(&kr, *start, size, saved_start, flags, map);
247 return kr;
248 }
249
250 static kern_return_t
call_mach_vm_allocate_kernel__start_size_fixed(MAP_T map,mach_vm_address_t * start,mach_vm_size_t size)251 call_mach_vm_allocate_kernel__start_size_fixed(MAP_T map, mach_vm_address_t * start, mach_vm_size_t size)
252 {
253 if (dealloc_would_time_out(*start, size, map)) {
254 return ACCEPTABLE;
255 }
256
257 mach_vm_address_t saved_start = *start;
258 kern_return_t kr = mach_vm_allocate_kernel(map, start, size,
259 FLAGS_AND_TAG(VM_FLAGS_FIXED, VM_KERN_MEMORY_OSFMK));
260 check_mach_vm_allocate_outparam_changes(&kr, *start, size, saved_start, VM_FLAGS_FIXED, map);
261 return kr;
262 }
263
264 static kern_return_t
call_mach_vm_allocate_kernel__start_size_anywhere(MAP_T map,mach_vm_address_t * start,mach_vm_size_t size)265 call_mach_vm_allocate_kernel__start_size_anywhere(MAP_T map, mach_vm_address_t * start, mach_vm_size_t size)
266 {
267 if (dealloc_would_time_out(*start, size, map)) {
268 return ACCEPTABLE;
269 }
270
271 mach_vm_address_t saved_start = *start;
272 kern_return_t kr = mach_vm_allocate_kernel(map, start, size,
273 FLAGS_AND_TAG(VM_FLAGS_ANYWHERE, VM_KERN_MEMORY_OSFMK));
274 check_mach_vm_allocate_outparam_changes(&kr, *start, size, saved_start, VM_FLAGS_ANYWHERE, map);
275 return kr;
276 }
277
278
279
280 static kern_return_t
call_vm_allocate__flags(MAP_T map,mach_vm_address_t * start,mach_vm_size_t size,int flags)281 call_vm_allocate__flags(MAP_T map, mach_vm_address_t * start, mach_vm_size_t size, int flags)
282 {
283 mach_vm_address_t saved_start = *start;
284 kern_return_t kr = vm_allocate(map, (vm_address_t *) start, (vm_size_t) size, flags);
285 check_mach_vm_allocate_outparam_changes(&kr, *start, size, saved_start, flags, map);
286 return kr;
287 }
288
289 static kern_return_t
call_vm_allocate__start_size_fixed(MAP_T map,mach_vm_address_t * start,mach_vm_size_t size)290 call_vm_allocate__start_size_fixed(MAP_T map, mach_vm_address_t * start, mach_vm_size_t size)
291 {
292 mach_vm_address_t saved_start = *start;
293 kern_return_t kr = vm_allocate(map, (vm_address_t *) start, (vm_size_t) size, VM_FLAGS_FIXED);
294 check_mach_vm_allocate_outparam_changes(&kr, *start, size, saved_start, VM_FLAGS_FIXED, map);
295 return kr;
296 }
297
298 static kern_return_t
call_vm_allocate__start_size_anywhere(MAP_T map,mach_vm_address_t * start,mach_vm_size_t size)299 call_vm_allocate__start_size_anywhere(MAP_T map, mach_vm_address_t * start, mach_vm_size_t size)
300 {
301 mach_vm_address_t saved_start = *start;
302 kern_return_t kr = vm_allocate(map, (vm_address_t *) start, (vm_size_t) size, VM_FLAGS_ANYWHERE);
303 check_mach_vm_allocate_outparam_changes(&kr, *start, size, saved_start, VM_FLAGS_ANYWHERE, map);
304 return kr;
305 }
306
307 static kern_return_t
call_mach_vm_deallocate(MAP_T map,mach_vm_address_t start,mach_vm_size_t size)308 call_mach_vm_deallocate(MAP_T map, mach_vm_address_t start, mach_vm_size_t size)
309 {
310 kern_return_t kr = mach_vm_deallocate(map, start, size);
311 return kr;
312 }
313
314 static kern_return_t
call_vm_deallocate(MAP_T map,mach_vm_address_t start,mach_vm_size_t size)315 call_vm_deallocate(MAP_T map, mach_vm_address_t start, mach_vm_size_t size)
316 {
317 kern_return_t kr = vm_deallocate(map, (vm_address_t) start, (vm_size_t) size);
318 return kr;
319 }
320
321 // Including sys/systm.h caused things to blow up
322 int vslock(user_addr_t addr, user_size_t len);
323 int vsunlock(user_addr_t addr, user_size_t len, int dirtied);
324 static int
call_vslock(void * start,size_t size)325 call_vslock(void * start, size_t size)
326 {
327 int kr = vslock((user_addr_t) start, (user_size_t) size);
328 if (kr == KERN_SUCCESS) {
329 (void) vsunlock((user_addr_t) start, (user_size_t) size, 0);
330 }
331
332 return kr;
333 }
334
335 static int
call_vsunlock_undirtied(void * start,size_t size)336 call_vsunlock_undirtied(void * start, size_t size)
337 {
338 int kr = vslock((user_addr_t) start, (user_size_t) size);
339 if (kr == EINVAL) {
340 // Invalid vslock arguments should also be
341 // invalid vsunlock arguments. Test it.
342 } else if (kr != KERN_SUCCESS) {
343 // vslock failed, and vsunlock of non-locked memory panics
344 return PANIC;
345 }
346 kr = vsunlock((user_addr_t) start, (user_size_t) size, 0);
347 return kr;
348 }
349
350 static int
call_vsunlock_dirtied(void * start,size_t size)351 call_vsunlock_dirtied(void * start, size_t size)
352 {
353 int kr = vslock((user_addr_t) start, (user_size_t) size);
354 if (kr == EINVAL) {
355 // Invalid vslock arguments should also be
356 // invalid vsunlock arguments. Test it.
357 } else if (kr != KERN_SUCCESS) {
358 // vslock failed, and vsunlock of non-locked memory panics
359 return PANIC;
360 }
361 kr = vsunlock((user_addr_t) start, (user_size_t) size, 1);
362 return kr;
363 }
364
365 extern kern_return_t vm_map_wire_external(
366 vm_map_t map,
367 vm_map_offset_t start,
368 vm_map_offset_t end,
369 vm_prot_t access_type,
370 boolean_t user_wire);
371
372
373 typedef kern_return_t (*wire_fn_t)(
374 vm_map_t task,
375 mach_vm_address_t start,
376 mach_vm_address_t end,
377 vm_prot_t prot,
378 vm_tag_t tag,
379 boolean_t user_wire);
380
381
382 /*
383 * Tell vm_tag_bt() to change its behavior so our calls to
384 * vm_map_wire_external and vm_map_wire_and_extract do not panic.
385 */
386 static void
prevent_wire_tag_panic(bool prevent)387 prevent_wire_tag_panic(bool prevent)
388 {
389 thread_set_test_option(test_option_vm_prevent_wire_tag_panic, prevent);
390 }
391
392 #if XNU_PLATFORM_MacOSX
393 // vm_map_wire_and_extract() implemented on macOS only
394
395
396 /*
397 * wire_nested requires a range of exactly one page when passed a physpage pointer.
398 * wire_and_extract is meant to provide that, but as a result of round introduced, unaligned values don't follow that.
399 */
400 static bool
will_vm_map_wire_nested_panic_due_to_invalid_range_size(MAP_T map,mach_vm_address_t start)401 will_vm_map_wire_nested_panic_due_to_invalid_range_size(MAP_T map, mach_vm_address_t start)
402 {
403 mach_vm_address_t end = start + VM_MAP_PAGE_SIZE(map);
404 if (round_up_map(map, end) - trunc_down_map(map, start) != VM_MAP_PAGE_SIZE(map)) {
405 return true;
406 }
407 return false;
408 }
409
410 static inline void
check_vm_map_wire_and_extract_outparam_changes(kern_return_t * kr,ppnum_t physpage)411 check_vm_map_wire_and_extract_outparam_changes(kern_return_t * kr, ppnum_t physpage)
412 {
413 if (*kr != KERN_SUCCESS) {
414 if (physpage != 0) {
415 *kr = OUT_PARAM_BAD;
416 }
417 }
418 }
419
420 static kern_return_t
vm_map_wire_and_extract_retyped(vm_map_t map,mach_vm_address_t start,mach_vm_address_t end __unused,vm_prot_t prot,vm_tag_t tag __unused,boolean_t user_wire)421 vm_map_wire_and_extract_retyped(
422 vm_map_t map,
423 mach_vm_address_t start,
424 mach_vm_address_t end __unused,
425 vm_prot_t prot,
426 vm_tag_t tag __unused,
427 boolean_t user_wire)
428 {
429 if (will_vm_map_wire_nested_panic_due_to_invalid_range_size(map, start)) {
430 return PANIC;
431 }
432
433 ppnum_t physpage = UNLIKELY_INITIAL_PPNUM;
434 kern_return_t kr = vm_map_wire_and_extract(map, start, prot, user_wire, &physpage);
435 check_vm_map_wire_and_extract_outparam_changes(&kr, physpage);
436 return kr;
437 }
438 #endif // XNU_PLATFORM_MacOSX
439
440
441 static kern_return_t
vm_map_wire_external_retyped(vm_map_t map,mach_vm_address_t start,mach_vm_address_t end,vm_prot_t prot,vm_tag_t tag __unused,boolean_t user_wire)442 vm_map_wire_external_retyped(
443 vm_map_t map,
444 mach_vm_address_t start,
445 mach_vm_address_t end,
446 vm_prot_t prot,
447 vm_tag_t tag __unused,
448 boolean_t user_wire)
449 {
450 return vm_map_wire_external(map, start, end, prot, user_wire);
451 }
452
453 static kern_return_t
wire_call_impl(wire_fn_t fn,MAP_T map,mach_vm_address_t start,mach_vm_size_t end,vm_prot_t prot,vm_tag_t tag,bool user_wire)454 wire_call_impl(wire_fn_t fn, MAP_T map, mach_vm_address_t start, mach_vm_size_t end, vm_prot_t prot, vm_tag_t tag, bool user_wire)
455 {
456 if (tag == VM_KERN_MEMORY_NONE) {
457 return PANIC;
458 }
459 prevent_wire_tag_panic(true);
460 kern_return_t kr = fn(map, start, end, prot, tag, user_wire);
461 prevent_wire_tag_panic(false);
462 if (kr == KERN_SUCCESS) {
463 (void) vm_map_unwire(map, start, end, user_wire);
464 }
465 return kr;
466 }
467
468 #define WIRE_IMPL(FN, user_wire) \
469 static kern_return_t \
470 __attribute__((used)) \
471 call_ ## FN ## __start_end__user_wired_ ## user_wire ## _(MAP_T map, mach_vm_address_t start, mach_vm_address_t end) \
472 { \
473 return wire_call_impl(FN, map, start, end, VM_PROT_DEFAULT, VM_KERN_MEMORY_OSFMK, user_wire); \
474 } \
475 static kern_return_t \
476 __attribute__((used)) \
477 call_ ## FN ## __prot__user_wired_ ## user_wire ## _(MAP_T map, mach_vm_address_t start, mach_vm_size_t size, vm_prot_t prot) \
478 { \
479 mach_vm_address_t end; \
480 if (__builtin_add_overflow(start, size, &end)) { \
481 return BUSTED; \
482 } \
483 return wire_call_impl(FN, map, start, end, prot, VM_KERN_MEMORY_OSFMK, user_wire); \
484 } \
485 static kern_return_t \
486 __attribute__((used)) \
487 call_ ## FN ## __tag__user_wired_ ## user_wire ## _(MAP_T map, mach_vm_address_t start, mach_vm_address_t end, vm_tag_t tag) \
488 { \
489 kern_return_t kr = wire_call_impl(FN, map, start, end, VM_PROT_DEFAULT, tag, user_wire); \
490 return kr; \
491 } \
492 static kern_return_t \
493 __attribute__((used)) \
494 call_ ## FN ## __start__user_wired_ ## user_wire ## _(MAP_T map, mach_vm_address_t start) \
495 { \
496 return wire_call_impl(FN, map, start, 0, VM_PROT_DEFAULT, VM_KERN_MEMORY_OSFMK, user_wire); \
497 } \
498
WIRE_IMPL(vm_map_wire_external_retyped,true)499 WIRE_IMPL(vm_map_wire_external_retyped, true)
500 WIRE_IMPL(vm_map_wire_external_retyped, false)
501 WIRE_IMPL(vm_map_wire_kernel, true)
502 WIRE_IMPL(vm_map_wire_kernel, false)
503
504 #if XNU_PLATFORM_MacOSX
505 WIRE_IMPL(vm_map_wire_and_extract_retyped, true)
506 WIRE_IMPL(vm_map_wire_and_extract_retyped, false)
507 #endif
508
509 static kern_return_t
510 call_mach_vm_wire_level_monitor(int64_t requested_pages)
511 {
512 kern_return_t kr = mach_vm_wire_level_monitor(requested_pages);
513 return kr;
514 }
515
516 static kern_return_t
call_vm_map_unwire_user_wired(MAP_T map,mach_vm_address_t start,mach_vm_address_t end)517 call_vm_map_unwire_user_wired(MAP_T map, mach_vm_address_t start, mach_vm_address_t end)
518 {
519 kern_return_t kr = vm_map_unwire(map, start, end, TRUE);
520 return kr;
521 }
522
523
524 static kern_return_t
call_vm_map_unwire_non_user_wired(MAP_T map,mach_vm_address_t start,mach_vm_address_t end)525 call_vm_map_unwire_non_user_wired(MAP_T map, mach_vm_address_t start, mach_vm_address_t end)
526 {
527 kern_return_t kr = vm_map_wire_kernel(map, start, end, VM_PROT_DEFAULT, VM_KERN_MEMORY_OSFMK, FALSE);
528 if (kr) {
529 return PANIC;
530 }
531 kr = vm_map_unwire(map, start, end, FALSE);
532 return kr;
533 }
534
535 #ifndef __x86_64__
536 extern const vm_map_address_t physmap_base;
537 extern const vm_map_address_t physmap_end;
538 #endif
539
540 /*
541 * This function duplicates the panicking checks done in copy_validate.
542 * size==0 is returned as success earlier in copyin/out than copy_validate is called, so we ignore that case.
543 */
544 static bool
will_copyio_panic_in_copy_validate(void * kernel_addr,vm_size_t size)545 will_copyio_panic_in_copy_validate(void *kernel_addr, vm_size_t size)
546 {
547 if (size == 0) {
548 return false;
549 }
550 extern const int copysize_limit_panic;
551 if (size > copysize_limit_panic) {
552 return true;
553 }
554
555 /*
556 * copyio is architecture specific and has different checks per arch.
557 */
558 #ifdef __x86_64__
559 if ((vm_offset_t) kernel_addr < VM_MIN_KERNEL_AND_KEXT_ADDRESS) {
560 return true;
561 }
562 #else /* not __x86_64__ */
563 uintptr_t kernel_addr_last;
564 if (os_add_overflow((uintptr_t) kernel_addr, size, &kernel_addr_last)) {
565 return true;
566 }
567
568 bool in_kva = (VM_KERNEL_STRIP_UPTR(kernel_addr) >= VM_MIN_KERNEL_ADDRESS) &&
569 (VM_KERNEL_STRIP_UPTR(kernel_addr_last) <= VM_MAX_KERNEL_ADDRESS);
570 bool in_physmap = (VM_KERNEL_STRIP_UPTR(kernel_addr) >= physmap_base) &&
571 (VM_KERNEL_STRIP_UPTR(kernel_addr_last) <= physmap_end);
572
573 if (!(in_kva || in_physmap)) {
574 return true;
575 }
576 #endif /* not __x86_64__ */
577
578 return false;
579 }
580
581 static kern_return_t
call_copyinmap(MAP_T map,vm_map_offset_t fromaddr,void * todata,vm_size_t length)582 call_copyinmap(MAP_T map, vm_map_offset_t fromaddr, void * todata, vm_size_t length)
583 {
584 if (will_copyio_panic_in_copy_validate(todata, length)) {
585 return PANIC;
586 }
587
588 kern_return_t kr = copyinmap(map, fromaddr, todata, length);
589 return kr;
590 }
591
592 static kern_return_t
call_copyoutmap(MAP_T map,void * fromdata,vm_map_offset_t toaddr,vm_size_t length)593 call_copyoutmap(MAP_T map, void * fromdata, vm_map_offset_t toaddr, vm_size_t length)
594 {
595 if (will_copyio_panic_in_copy_validate(fromdata, length)) {
596 return PANIC;
597 }
598
599 kern_return_t kr = copyoutmap(map, fromdata, toaddr, length);
600 return kr;
601 }
602
603 static kern_return_t
call_vm_map_read_user(MAP_T map,vm_map_address_t src_addr,void * ptr,vm_size_t size)604 call_vm_map_read_user(MAP_T map, vm_map_address_t src_addr, void * ptr, vm_size_t size)
605 {
606 if (will_copyio_panic_in_copy_validate(ptr, size)) {
607 return PANIC;
608 }
609
610 kern_return_t kr = vm_map_read_user(map, src_addr, ptr, size);
611 return kr;
612 }
613
614 static kern_return_t
call_vm_map_write_user(MAP_T map,void * ptr,vm_map_address_t dst_addr,vm_size_t size)615 call_vm_map_write_user(MAP_T map, void * ptr, vm_map_address_t dst_addr, vm_size_t size)
616 {
617 if (will_copyio_panic_in_copy_validate(ptr, size)) {
618 return PANIC;
619 }
620
621 kern_return_t kr = vm_map_write_user(map, ptr, dst_addr, size);
622 return kr;
623 }
624
625 static kern_return_t
call_vm_map_copy_overwrite_interruptible(MAP_T dst_map,vm_map_copy_t copy,mach_vm_address_t dst_addr,mach_vm_size_t copy_size)626 call_vm_map_copy_overwrite_interruptible(MAP_T dst_map, vm_map_copy_t copy, mach_vm_address_t dst_addr, mach_vm_size_t copy_size)
627 {
628 kern_return_t kr = vm_map_copy_overwrite(dst_map, dst_addr, copy, copy_size, TRUE);
629 return kr;
630 }
631
632 static kern_return_t
call_mach_vm_protect__start_size(MAP_T map,mach_vm_address_t start,mach_vm_size_t size)633 call_mach_vm_protect__start_size(MAP_T map, mach_vm_address_t start, mach_vm_size_t size)
634 {
635 kern_return_t kr = mach_vm_protect(map, start, size, 0, VM_PROT_READ | VM_PROT_WRITE);
636 return kr;
637 }
638 static kern_return_t
call_mach_vm_protect__vm_prot(MAP_T map,mach_vm_address_t start,mach_vm_size_t size,vm_prot_t prot)639 call_mach_vm_protect__vm_prot(MAP_T map, mach_vm_address_t start, mach_vm_size_t size, vm_prot_t prot)
640 {
641 kern_return_t kr = mach_vm_protect(map, start, size, 0, prot);
642 return kr;
643 }
644
645 static kern_return_t
call_vm_protect__start_size(MAP_T map,vm_address_t start,vm_size_t size)646 call_vm_protect__start_size(MAP_T map, vm_address_t start, vm_size_t size)
647 {
648 kern_return_t kr = vm_protect(map, start, size, 0, VM_PROT_READ | VM_PROT_WRITE);
649 return kr;
650 }
651
652 static kern_return_t
call_vm_protect__vm_prot(MAP_T map,vm_address_t start,vm_size_t size,vm_prot_t prot)653 call_vm_protect__vm_prot(MAP_T map, vm_address_t start, vm_size_t size, vm_prot_t prot)
654 {
655 kern_return_t kr = vm_protect(map, start, size, 0, prot);
656 return kr;
657 }
658
659 /*
660 * VME_OFFSET_SET will panic due to an assertion if passed an address that is not aligned to VME_ALIAS_BITS
661 * VME_OFFSET_SET is called by _vm_map_clip_(start/end)
662 * vm_map_protect -> vm_map_clip_end -> _vm_map_clip_end -> VME_OFFSET_SET
663 */
664 static bool
will_vm_map_protect_panic(mach_vm_address_t start,mach_vm_address_t end)665 will_vm_map_protect_panic(mach_vm_address_t start, mach_vm_address_t end)
666 {
667 bool start_aligned = start == ((start >> VME_ALIAS_BITS) << VME_ALIAS_BITS);
668 bool end_aligned = end == ((end >> VME_ALIAS_BITS) << VME_ALIAS_BITS);
669 return !(start_aligned && end_aligned);
670 }
671
672 static kern_return_t
call_vm_map_protect__start_size__no_max(MAP_T map,mach_vm_address_t start,mach_vm_size_t size)673 call_vm_map_protect__start_size__no_max(MAP_T map, mach_vm_address_t start, mach_vm_size_t size)
674 {
675 mach_vm_address_t end = start + size;
676 if (will_vm_map_protect_panic(start, end)) {
677 return PANIC;
678 }
679
680 kern_return_t kr = vm_map_protect(map, start, end, 0, VM_PROT_READ | VM_PROT_WRITE);
681 return kr;
682 }
683
684 static kern_return_t
call_vm_map_protect__start_size__set_max(MAP_T map,mach_vm_address_t start,mach_vm_size_t size)685 call_vm_map_protect__start_size__set_max(MAP_T map, mach_vm_address_t start, mach_vm_size_t size)
686 {
687 mach_vm_address_t end = start + size;
688 if (will_vm_map_protect_panic(start, end)) {
689 return PANIC;
690 }
691
692 kern_return_t kr = vm_map_protect(map, start, end, 1, VM_PROT_READ | VM_PROT_WRITE);
693 return kr;
694 }
695
696 static kern_return_t
call_vm_map_protect__vm_prot__no_max(MAP_T map,mach_vm_address_t start,mach_vm_size_t size,vm_prot_t prot)697 call_vm_map_protect__vm_prot__no_max(MAP_T map, mach_vm_address_t start, mach_vm_size_t size, vm_prot_t prot)
698 {
699 mach_vm_address_t end = start + size;
700 if (will_vm_map_protect_panic(start, end)) {
701 return PANIC;
702 }
703
704 kern_return_t kr = vm_map_protect(map, start, end, 0, prot);
705 return kr;
706 }
707
708 static kern_return_t
call_vm_map_protect__vm_prot__set_max(MAP_T map,mach_vm_address_t start,mach_vm_size_t size,vm_prot_t prot)709 call_vm_map_protect__vm_prot__set_max(MAP_T map, mach_vm_address_t start, mach_vm_size_t size, vm_prot_t prot)
710 {
711 mach_vm_address_t end = start + size;
712 if (will_vm_map_protect_panic(start, end)) {
713 return PANIC;
714 }
715
716 kern_return_t kr = vm_map_protect(map, start, end, 0, prot);
717 return kr;
718 }
719
720 // Fwd decl to avoid including bsd headers
721 int useracc(user_addr_t addr, user_size_t len, int prot);
722
723 static int
call_useracc__start_size(void * start,size_t size)724 call_useracc__start_size(void * start, size_t size)
725 {
726 int result = useracc((user_addr_t) start, (user_addr_t) size, VM_PROT_READ);
727 return result;
728 }
729
730 static int
call_useracc__vm_prot(void * start,size_t size,int prot)731 call_useracc__vm_prot(void * start, size_t size, int prot)
732 {
733 return useracc((user_addr_t) start, (user_addr_t) size, prot);
734 }
735
736 static int
call_vm_map_purgable_control__address__get(MAP_T map,mach_vm_address_t addr)737 call_vm_map_purgable_control__address__get(MAP_T map, mach_vm_address_t addr)
738 {
739 int state = INVALID_PURGABLE_STATE;
740 int initial_state = state;
741 kern_return_t kr = vm_map_purgable_control(map, addr, VM_PURGABLE_GET_STATE, &state);
742 check_mach_vm_purgable_control_outparam_changes(&kr, state, initial_state, VM_PURGABLE_GET_STATE);
743 return kr;
744 }
745
746 static int
call_vm_map_purgable_control__address__purge_all(MAP_T map,mach_vm_address_t addr)747 call_vm_map_purgable_control__address__purge_all(MAP_T map, mach_vm_address_t addr)
748 {
749 int state = INVALID_PURGABLE_STATE;
750 int initial_state = state;
751 kern_return_t kr = vm_map_purgable_control(map, addr, VM_PURGABLE_PURGE_ALL, &state);
752 check_mach_vm_purgable_control_outparam_changes(&kr, state, initial_state, VM_PURGABLE_PURGE_ALL);
753 return kr;
754 }
755
756 static int
call_vm_map_purgable_control__purgeable_state(MAP_T map,vm_address_t addr,vm_purgable_t control,int state)757 call_vm_map_purgable_control__purgeable_state(MAP_T map, vm_address_t addr, vm_purgable_t control, int state)
758 {
759 int state_copy = state;
760 kern_return_t kr = vm_map_purgable_control(map, addr, control, &state_copy);
761 check_mach_vm_purgable_control_outparam_changes(&kr, state_copy, state, control);
762
763 return kr;
764 }
765
766 #if XNU_PLATFORM_MacOSX
767 static void
check_vm_region_object_create_outparam_changes(kern_return_t * kr,ipc_port_t handle)768 check_vm_region_object_create_outparam_changes(kern_return_t * kr, ipc_port_t handle)
769 {
770 if (handle == NULL) {
771 *kr = OUT_PARAM_BAD;
772 }
773 }
774
775 static kern_return_t
call_vm_region_object_create(MAP_T map,vm_size_t size)776 call_vm_region_object_create(MAP_T map, vm_size_t size)
777 {
778 ipc_port_t handle = NULL;
779 kern_return_t kr = vm_region_object_create(map, size, &handle);
780 check_vm_region_object_create_outparam_changes(&kr, handle);
781
782 if (kr == KERN_SUCCESS) {
783 mach_memory_entry_port_release(handle);
784 }
785
786 return kr;
787 }
788 #endif /* #if XNU_PLATFORM_MacOSX */
789
790 static kern_return_t
call_vm_map_page_info(MAP_T map,mach_vm_address_t addr)791 call_vm_map_page_info(MAP_T map, mach_vm_address_t addr)
792 {
793 vm_page_info_flavor_t flavor = VM_PAGE_INFO_BASIC;
794 mach_msg_type_number_t count = VM_PAGE_INFO_BASIC_COUNT;
795 mach_msg_type_number_t saved_count = count;
796 vm_page_info_basic_data_t info = {0};
797 info.depth = -1;
798 vm_page_info_basic_data_t saved_info = info;
799
800 /*
801 * If this test is invoked from a rosetta process,
802 * vm_map_page_range_info_internal doesn't know what
803 * effective_page_shift to use and returns KERN_INVALID_ARGUMENT.
804 * To fix this, we can set the region_page_shift to the page_shift
805 * used for map
806 */
807 int saved_page_shift = thread_self_region_page_shift();
808 if (PAGE_SIZE == KB16) {
809 if (VM_MAP_PAGE_SHIFT(current_map()) != VM_MAP_PAGE_SHIFT(map)) {
810 thread_self_region_page_shift_set(VM_MAP_PAGE_SHIFT(map));
811 }
812 }
813
814 kern_return_t kr = vm_map_page_info(map, addr, flavor, (vm_page_info_t)&info, &count);
815
816 thread_self_region_page_shift_set(saved_page_shift);
817
818 check_mach_vm_page_info_outparam_changes(&kr, info, saved_info, count, saved_count);
819
820 return kr;
821 }
822
823 #if CONFIG_MAP_RANGES
824 static kern_return_t
call_mach_vm_range_create(MAP_T map,mach_vm_address_t start,mach_vm_size_t size,mach_vm_address_t second_start,mach_vm_size_t second_size)825 call_mach_vm_range_create(MAP_T map, mach_vm_address_t start, mach_vm_size_t size, mach_vm_address_t second_start, mach_vm_size_t second_size)
826 {
827 mach_vm_range_recipe_v1_t array[2];
828 array[0] = (mach_vm_range_recipe_v1_t){
829 .range = { start, start + size }, .range_tag = MACH_VM_RANGE_FIXED,
830 };
831 array[1] = (mach_vm_range_recipe_v1_t){
832 .range = { second_start, second_start + second_size }, .range_tag = MACH_VM_RANGE_FIXED,
833 };
834
835 // mach_vm_range_create requires map == current_map(). Patch it up, do the call, and then restore it.
836 vm_map_t saved_map = swap_task_map(current_task(), current_thread(), map);
837
838 kern_return_t kr = mach_vm_range_create(map, MACH_VM_RANGE_FLAVOR_V1, (mach_vm_range_recipes_raw_t)array, sizeof(array[0]) * 2);
839
840 swap_task_map(current_task(), current_thread(), saved_map);
841
842 return kr;
843 }
844 #endif /* CONFIG_MAP_RANGES */
845
846 // Mach memory entry ownership
847
848 extern kern_return_t
849 mach_memory_entry_ownership(
850 ipc_port_t entry_port,
851 task_t owner,
852 int ledger_tag,
853 int ledger_flags);
854
855 static kern_return_t
call_mach_memory_entry_ownership__ledger_tag(MAP_T map __unused,int ledger_tag)856 call_mach_memory_entry_ownership__ledger_tag(MAP_T map __unused, int ledger_tag)
857 {
858 mach_port_t mementry = make_a_mem_entry(map, TEST_ALLOC_SIZE + 1);
859 kern_return_t kr = mach_memory_entry_ownership(mementry, TASK_NULL, ledger_tag, 0);
860 mach_memory_entry_port_release(mementry);
861 return kr;
862 }
863
864 static kern_return_t
call_mach_memory_entry_ownership__ledger_flag(MAP_T map __unused,int ledger_flag)865 call_mach_memory_entry_ownership__ledger_flag(MAP_T map __unused, int ledger_flag)
866 {
867 mach_port_t mementry = make_a_mem_entry(map, TEST_ALLOC_SIZE + 1);
868 kern_return_t kr = mach_memory_entry_ownership(mementry, TASK_NULL, VM_LEDGER_TAG_DEFAULT, ledger_flag);
869 mach_memory_entry_port_release(mementry);
870 return kr;
871 }
872
873 static inline void
check_mach_memory_entry_map_size_outparam_changes(kern_return_t * kr,mach_vm_size_t map_size,mach_vm_size_t invalid_initial_size)874 check_mach_memory_entry_map_size_outparam_changes(kern_return_t * kr, mach_vm_size_t map_size,
875 mach_vm_size_t invalid_initial_size)
876 {
877 if (*kr == KERN_SUCCESS) {
878 if (map_size == invalid_initial_size) {
879 *kr = OUT_PARAM_BAD;
880 }
881 } else {
882 if (map_size != 0) {
883 *kr = OUT_PARAM_BAD;
884 }
885 }
886 }
887
888 static kern_return_t
call_mach_memory_entry_map_size__start_size(MAP_T map,mach_vm_address_t start,mach_vm_size_t size)889 call_mach_memory_entry_map_size__start_size(MAP_T map, mach_vm_address_t start, mach_vm_size_t size)
890 {
891 mach_port_t mementry;
892 mach_vm_address_t addr;
893 memory_object_size_t s = (memory_object_size_t)TEST_ALLOC_SIZE + 1;
894 /*
895 * UNLIKELY_INITIAL_SIZE is guaranteed to never be the correct map_size
896 * from the mach_memory_entry_map_size calls we make. map_size should represent the size of the
897 * copy that would result, and UNLIKELY_INITIAL_SIZE is completely unrelated to the sizes we pass
898 * and not page aligned.
899 */
900 mach_vm_size_t invalid_initial_size = UNLIKELY_INITIAL_SIZE;
901
902 mach_vm_size_t map_size = invalid_initial_size;
903
904 kern_return_t kr = mach_vm_allocate_kernel(map, &addr, s, FLAGS_AND_TAG(VM_FLAGS_ANYWHERE, VM_KERN_MEMORY_OSFMK));
905 assert(kr == 0);
906 kr = mach_make_memory_entry_64(map, &s, (memory_object_offset_t)addr, MAP_MEM_VM_SHARE, &mementry, MACH_PORT_NULL);
907 assert(kr == 0);
908 kr = mach_memory_entry_map_size(mementry, map, start, size, &map_size);
909 check_mach_memory_entry_map_size_outparam_changes(&kr, map_size, invalid_initial_size);
910 mach_memory_entry_port_release(mementry);
911 (void)mach_vm_deallocate(map, addr, s);
912 return kr;
913 }
914
915 struct file_control_return {
916 void * control;
917 void * fp;
918 void * vp;
919 int fd;
920 };
921 struct file_control_return get_control_from_fd(int fd);
922 void cleanup_control_related_data(struct file_control_return info);
923 uint32_t vnode_vid(void * vp);
924
925 static void
check_task_find_region_details_outparam_changes(int * result,uintptr_t vp,uintptr_t saved_vp,uint32_t vid,bool is_map_shared,uint64_t start,uint64_t saved_start,uint64_t len,uint64_t saved_len)926 check_task_find_region_details_outparam_changes(int * result,
927 uintptr_t vp, uintptr_t saved_vp,
928 uint32_t vid,
929 bool is_map_shared,
930 uint64_t start, uint64_t saved_start,
931 uint64_t len, uint64_t saved_len)
932 {
933 // task_find_region_details returns a bool. 0 means failure, 1 success
934 if (*result == 0) {
935 if (vp != 0 || vid != 0 || is_map_shared != 0 || start != 0 || len != 0) {
936 *result = OUT_PARAM_BAD;
937 }
938 } else {
939 if (vp == saved_vp || start == saved_start || len == saved_len) {
940 *result = OUT_PARAM_BAD;
941 }
942 if (vid != (uint32_t)vnode_vid((void *)vp)) {
943 *result = OUT_PARAM_BAD;
944 }
945 // is_map_shared seems to check if the relevant entry is shadowed by another
946 // we don't set up any shadow entries for this test
947 if (is_map_shared) {
948 // *result = OUT_PARAM_BAD;
949 }
950 }
951 }
952
953
954 static int
call_task_find_region_details(MAP_T map,mach_vm_address_t addr)955 call_task_find_region_details(MAP_T map, mach_vm_address_t addr)
956 {
957 (void) map;
958 uint64_t len = UNLIKELY_INITIAL_SIZE, start = UNLIKELY_INITIAL_ADDRESS;
959 uint64_t saved_len = len, saved_start = start;
960 bool is_map_shared = true;
961 uintptr_t vp = (uintptr_t) INVALID_VNODE_PTR;
962 uintptr_t saved_vp = vp;
963 uint32_t vid = UNLIKELY_INITIAL_VID;
964
965 /*
966 * task_find_region_details operates on task->map. Our setup code does allocations
967 * that otherwise could theoretically overwrite existing ones, so we don't want to
968 * operate on current_map
969 */
970 vm_map_t saved_map = swap_task_map(current_task(), current_thread(), map);
971
972 int kr = task_find_region_details(current_task(), addr, FIND_REGION_DETAILS_AT_OFFSET, &vp, &vid, &is_map_shared, &start, &len);
973
974 swap_task_map(current_task(), current_thread(), saved_map);
975
976 check_task_find_region_details_outparam_changes(&kr, vp, saved_vp, vid, is_map_shared, start, saved_start, len, saved_len);
977 return kr;
978 }
979
980 static results_t * __attribute__((used))
test_kext_unix_with_allocated_vnode_addr(kern_return_t (* func)(MAP_T dst_map,mach_vm_address_t start),const char * testname)981 test_kext_unix_with_allocated_vnode_addr(kern_return_t (*func)(MAP_T dst_map, mach_vm_address_t start), const char *testname)
982 {
983 MAP_T map SMART_MAP;
984 allocation_t base SMART_ALLOCATE_VM(map, TEST_ALLOC_SIZE, VM_PROT_DEFAULT);
985 addr_trials_t *trials SMART_ADDR_TRIALS(base.addr);
986 results_t *results = alloc_results(testname, eSMART_ADDR_TRIALS, base.addr, trials->count);
987
988 for (unsigned i = 0; i < trials->count; i++) {
989 mach_vm_address_t addr = (mach_vm_address_t)trials->list[i].addr;
990
991 struct file_control_return control_info = get_control_from_fd(file_descriptor);
992 vm_map_kernel_flags_t vmk_flags = VM_MAP_KERNEL_FLAGS_FIXED(.vmf_overwrite = true);
993 kern_return_t kr = vm_map_enter_mem_object_control(map, &addr, TEST_ALLOC_SIZE, 0, vmk_flags, (memory_object_control_t) control_info.control, 0, false, VM_PROT_DEFAULT, VM_PROT_DEFAULT, VM_INHERIT_DEFAULT);
994 if (kr == KERN_INVALID_ARGUMENT) {
995 // can't map a file at that address, so we can't pass
996 // such a mapping to the function being tested
997 append_result(results, IGNORED, trials->list[i].name);
998 cleanup_control_related_data(control_info);
999 continue;
1000 }
1001 assert(kr == KERN_SUCCESS);
1002
1003 kern_return_t ret = func(map, addr);
1004 append_result(results, ret, trials->list[i].name);
1005 cleanup_control_related_data(control_info);
1006 }
1007 return results;
1008 }
1009
1010 extern uint64_t vm_reclaim_max_threshold;
1011
1012 static kern_return_t
test_mach_vm_deferred_reclamation_buffer_init(MAP_T map __unused,mach_vm_address_t address,mach_vm_size_t size)1013 test_mach_vm_deferred_reclamation_buffer_init(MAP_T map __unused, mach_vm_address_t address, mach_vm_size_t size)
1014 {
1015 uint64_t vm_reclaim_max_threshold_orig = vm_reclaim_max_threshold;
1016 kern_return_t kr = 0;
1017
1018 vm_reclaim_max_threshold = KB16;
1019 kr = call_mach_vm_deferred_reclamation_buffer_init(current_task(), address, size);
1020 vm_reclaim_max_threshold = vm_reclaim_max_threshold_orig;
1021
1022 return kr;
1023 }
1024
1025
1026 // mach_make_memory_entry and variants
1027
1028 static inline void
check_mach_memory_entry_outparam_changes(kern_return_t * kr,mach_vm_size_t size,mach_port_t out_handle)1029 check_mach_memory_entry_outparam_changes(kern_return_t * kr, mach_vm_size_t size,
1030 mach_port_t out_handle)
1031 {
1032 /*
1033 * mach_make_memory_entry overwrites *size to be 0 on failure.
1034 */
1035 if (*kr != KERN_SUCCESS) {
1036 if (size != 0) {
1037 *kr = OUT_PARAM_BAD;
1038 }
1039 if (out_handle != 0) {
1040 *kr = OUT_PARAM_BAD;
1041 }
1042 }
1043 }
1044
1045 #define IMPL(FN, T) \
1046 static kern_return_t \
1047 call_ ## FN ## __start_size__memonly(MAP_T map, T start, T size) \
1048 { \
1049 mach_port_t memobject = make_a_mem_object(TEST_ALLOC_SIZE + 1); \
1050 T io_size = size; \
1051 mach_port_t invalid_handle_value = UNLIKELY_INITIAL_MACH_PORT; \
1052 mach_port_t out_handle = invalid_handle_value; \
1053 kern_return_t kr = FN(map, &io_size, start, \
1054 VM_PROT_READ | MAP_MEM_ONLY, &out_handle, memobject); \
1055 if (kr == 0) { \
1056 if (out_handle) mach_memory_entry_port_release(out_handle); \
1057 } \
1058 mach_memory_entry_port_release(memobject); \
1059 check_mach_memory_entry_outparam_changes(&kr, io_size, out_handle); \
1060 return kr; \
1061 } \
1062 \
1063 static kern_return_t \
1064 call_ ## FN ## __start_size__namedcreate(MAP_T map, T start, T size) \
1065 { \
1066 mach_port_t memobject = make_a_mem_object(TEST_ALLOC_SIZE + 1); \
1067 T io_size = size; \
1068 mach_port_t invalid_handle_value = UNLIKELY_INITIAL_MACH_PORT; \
1069 mach_port_t out_handle = invalid_handle_value; \
1070 kern_return_t kr = FN(map, &io_size, start, \
1071 VM_PROT_READ | MAP_MEM_NAMED_CREATE, &out_handle, memobject); \
1072 if (kr == 0) { \
1073 if (out_handle) mach_memory_entry_port_release(out_handle); \
1074 } \
1075 mach_memory_entry_port_release(memobject); \
1076 check_mach_memory_entry_outparam_changes(&kr, io_size, out_handle); \
1077 return kr; \
1078 } \
1079 \
1080 static kern_return_t \
1081 call_ ## FN ## __start_size__copy(MAP_T map, T start, T size) \
1082 { \
1083 mach_port_t memobject = make_a_mem_object(TEST_ALLOC_SIZE + 1); \
1084 T io_size = size; \
1085 mach_port_t invalid_handle_value = UNLIKELY_INITIAL_MACH_PORT; \
1086 mach_port_t out_handle = invalid_handle_value; \
1087 kern_return_t kr = FN(map, &io_size, start, \
1088 VM_PROT_READ | MAP_MEM_VM_COPY, &out_handle, memobject); \
1089 if (kr == 0) { \
1090 if (out_handle) mach_memory_entry_port_release(out_handle); \
1091 } \
1092 mach_memory_entry_port_release(memobject); \
1093 check_mach_memory_entry_outparam_changes(&kr, io_size, out_handle); \
1094 return kr; \
1095 } \
1096 \
1097 static kern_return_t \
1098 call_ ## FN ## __start_size__share(MAP_T map, T start, T size) \
1099 { \
1100 mach_port_t memobject = make_a_mem_object(TEST_ALLOC_SIZE + 1); \
1101 T io_size = size; \
1102 mach_port_t invalid_handle_value = UNLIKELY_INITIAL_MACH_PORT; \
1103 mach_port_t out_handle = invalid_handle_value; \
1104 kern_return_t kr = FN(map, &io_size, start, \
1105 VM_PROT_READ | MAP_MEM_VM_SHARE, &out_handle, memobject); \
1106 if (kr == 0) { \
1107 if (out_handle) mach_memory_entry_port_release(out_handle); \
1108 } \
1109 mach_memory_entry_port_release(memobject); \
1110 check_mach_memory_entry_outparam_changes(&kr, io_size, out_handle); \
1111 return kr; \
1112 } \
1113 \
1114 static kern_return_t \
1115 call_ ## FN ## __start_size__namedreuse(MAP_T map, T start, T size) \
1116 { \
1117 mach_port_t memobject = make_a_mem_object(TEST_ALLOC_SIZE + 1); \
1118 T io_size = size; \
1119 mach_port_t invalid_handle_value = UNLIKELY_INITIAL_MACH_PORT; \
1120 mach_port_t out_handle = invalid_handle_value; \
1121 kern_return_t kr = FN(map, &io_size, start, \
1122 VM_PROT_READ | MAP_MEM_NAMED_REUSE, &out_handle, memobject); \
1123 if (kr == 0) { \
1124 if (out_handle) mach_memory_entry_port_release(out_handle); \
1125 } \
1126 mach_memory_entry_port_release(memobject); \
1127 check_mach_memory_entry_outparam_changes(&kr, io_size, out_handle); \
1128 return kr; \
1129 } \
1130 \
1131 static kern_return_t \
1132 call_ ## FN ## __vm_prot(MAP_T map, T start, T size, vm_prot_t prot) \
1133 { \
1134 mach_port_t memobject = make_a_mem_object(TEST_ALLOC_SIZE + 1); \
1135 T io_size = size; \
1136 mach_port_t invalid_handle_value = UNLIKELY_INITIAL_MACH_PORT; \
1137 mach_port_t out_handle = invalid_handle_value; \
1138 kern_return_t kr = FN(map, &io_size, start, \
1139 prot, &out_handle, memobject); \
1140 if (kr == 0) { \
1141 if (out_handle) mach_memory_entry_port_release(out_handle); \
1142 } \
1143 mach_memory_entry_port_release(memobject); \
1144 check_mach_memory_entry_outparam_changes(&kr, io_size, out_handle); \
1145 return kr; \
1146 }
1147
IMPL(mach_make_memory_entry_64,mach_vm_address_t)1148 IMPL(mach_make_memory_entry_64, mach_vm_address_t)
1149 IMPL(mach_make_memory_entry, vm_size_t)
1150 static kern_return_t
1151 mach_make_memory_entry_internal_retyped(
1152 vm_map_t target_map,
1153 memory_object_size_t *size,
1154 memory_object_offset_t offset,
1155 vm_prot_t permission,
1156 ipc_port_t *object_handle,
1157 ipc_port_t parent_handle)
1158 {
1159 vm_named_entry_kernel_flags_t vmne_kflags = VM_NAMED_ENTRY_KERNEL_FLAGS_NONE;
1160 if (permission & MAP_MEM_LEDGER_TAGGED) {
1161 vmne_kflags.vmnekf_ledger_tag = VM_LEDGER_TAG_DEFAULT;
1162 }
1163 return mach_make_memory_entry_internal(target_map, size, offset, permission, vmne_kflags, object_handle, parent_handle);
1164 }
1165 IMPL(mach_make_memory_entry_internal_retyped, mach_vm_address_t)
1166
1167 #undef IMPL
1168
1169 // mach_vm_map/mach_vm_map_external/mach_vm_map_kernel/vm_map/vm_map_external infra
1170
1171 typedef kern_return_t (*map_fn_t)(vm_map_t target_task,
1172 mach_vm_address_t *address,
1173 mach_vm_size_t size,
1174 mach_vm_offset_t mask,
1175 int flags,
1176 mem_entry_name_port_t object,
1177 memory_object_offset_t offset,
1178 boolean_t copy,
1179 vm_prot_t cur_protection,
1180 vm_prot_t max_protection,
1181 vm_inherit_t inheritance);
1182
1183 static kern_return_t
call_map_fn__allocate_fixed(map_fn_t fn,MAP_T map,mach_vm_address_t start,mach_vm_size_t size)1184 call_map_fn__allocate_fixed(map_fn_t fn, MAP_T map, mach_vm_address_t start, mach_vm_size_t size)
1185 {
1186 mach_vm_address_t out_addr = start;
1187 kern_return_t kr = fn(map, &out_addr, size, 0, VM_FLAGS_FIXED | VM_FLAGS_OVERWRITE,
1188 0, 0, 0, 0, 0, VM_INHERIT_NONE);
1189 // fixed-overwrite with pre-existing allocation, don't deallocate
1190 return kr;
1191 }
1192
1193 static kern_return_t
call_map_fn__allocate_fixed_copy(map_fn_t fn,MAP_T map,mach_vm_address_t start,mach_vm_size_t size)1194 call_map_fn__allocate_fixed_copy(map_fn_t fn, MAP_T map, mach_vm_address_t start, mach_vm_size_t size)
1195 {
1196 mach_vm_address_t out_addr = start;
1197 kern_return_t kr = fn(map, &out_addr, size, 0, VM_FLAGS_FIXED | VM_FLAGS_OVERWRITE,
1198 0, 0, true, 0, 0, VM_INHERIT_NONE);
1199 // fixed-overwrite with pre-existing allocation, don't deallocate
1200 return kr;
1201 }
1202
1203 static kern_return_t
call_map_fn__allocate_anywhere(map_fn_t fn,MAP_T map,mach_vm_address_t start_hint,mach_vm_size_t size)1204 call_map_fn__allocate_anywhere(map_fn_t fn, MAP_T map, mach_vm_address_t start_hint, mach_vm_size_t size)
1205 {
1206 mach_vm_address_t out_addr = start_hint;
1207 kern_return_t kr = fn(map, &out_addr, size, 0, VM_FLAGS_ANYWHERE, 0, 0, 0, 0, 0, VM_INHERIT_NONE);
1208 if (kr == 0) {
1209 (void)mach_vm_deallocate(map, out_addr, size);
1210 }
1211 return kr;
1212 }
1213
1214 static kern_return_t
call_map_fn__memobject_fixed(map_fn_t fn,MAP_T map,mach_vm_address_t start,mach_vm_size_t size)1215 call_map_fn__memobject_fixed(map_fn_t fn, MAP_T map, mach_vm_address_t start, mach_vm_size_t size)
1216 {
1217 mach_port_t memobject = make_a_mem_object(TEST_ALLOC_SIZE + 1);
1218 mach_vm_address_t out_addr = start;
1219 kern_return_t kr = fn(map, &out_addr, size, 0, VM_FLAGS_FIXED | VM_FLAGS_OVERWRITE,
1220 memobject, KB16, false, VM_PROT_DEFAULT, VM_PROT_DEFAULT, VM_INHERIT_DEFAULT);
1221 // fixed-overwrite with pre-existing allocation, don't deallocate
1222 mach_memory_entry_port_release(memobject);
1223 return kr;
1224 }
1225
1226 static kern_return_t
call_map_fn__memobject_fixed_copy(map_fn_t fn,MAP_T map,mach_vm_address_t start,mach_vm_size_t size)1227 call_map_fn__memobject_fixed_copy(map_fn_t fn, MAP_T map, mach_vm_address_t start, mach_vm_size_t size)
1228 {
1229 mach_port_t memobject = make_a_mem_object(TEST_ALLOC_SIZE + 1);
1230 mach_vm_address_t out_addr = start;
1231 kern_return_t kr = fn(map, &out_addr, size, 0, VM_FLAGS_FIXED | VM_FLAGS_OVERWRITE,
1232 memobject, KB16, true, VM_PROT_DEFAULT, VM_PROT_DEFAULT, VM_INHERIT_DEFAULT);
1233 // fixed-overwrite with pre-existing allocation, don't deallocate
1234 mach_memory_entry_port_release(memobject);
1235 return kr;
1236 }
1237
1238 static kern_return_t
call_map_fn__memobject_anywhere(map_fn_t fn,MAP_T map,mach_vm_address_t start_hint,mach_vm_size_t size)1239 call_map_fn__memobject_anywhere(map_fn_t fn, MAP_T map, mach_vm_address_t start_hint, mach_vm_size_t size)
1240 {
1241 mach_port_t memobject = make_a_mem_object(TEST_ALLOC_SIZE + 1);
1242 mach_vm_address_t out_addr = start_hint;
1243 kern_return_t kr = fn(map, &out_addr, size, 0, VM_FLAGS_ANYWHERE, memobject,
1244 KB16, false, VM_PROT_DEFAULT, VM_PROT_DEFAULT, VM_INHERIT_DEFAULT);
1245 if (kr == 0) {
1246 (void)mach_vm_deallocate(map, out_addr, size);
1247 }
1248 mach_memory_entry_port_release(memobject);
1249 return kr;
1250 }
1251
1252 static kern_return_t
helper_call_map_fn__memobject__ssoo(map_fn_t fn,MAP_T map,int flags,bool copy,mach_vm_address_t start,mach_vm_size_t size,vm_object_offset_t offset,mach_vm_size_t obj_size)1253 helper_call_map_fn__memobject__ssoo(map_fn_t fn, MAP_T map, int flags, bool copy, mach_vm_address_t start, mach_vm_size_t size, vm_object_offset_t offset, mach_vm_size_t obj_size)
1254 {
1255 mach_port_t memobject = make_a_mem_object(obj_size);
1256 mach_vm_address_t out_addr = start;
1257 kern_return_t kr = fn(map, &out_addr, size, 0, flags, memobject,
1258 offset, copy, VM_PROT_DEFAULT, VM_PROT_DEFAULT, VM_INHERIT_DEFAULT);
1259 deallocate_if_not_fixed_overwrite(kr, map, out_addr, size, flags);
1260 mach_memory_entry_port_release(memobject);
1261 return kr;
1262 }
1263
1264 static kern_return_t
call_map_fn__memobject_fixed__start_size_offset_object(map_fn_t fn,MAP_T map,mach_vm_address_t start,mach_vm_size_t size,vm_object_offset_t offset,mach_vm_size_t obj_size)1265 call_map_fn__memobject_fixed__start_size_offset_object(map_fn_t fn, MAP_T map, mach_vm_address_t start, mach_vm_size_t size, vm_object_offset_t offset, mach_vm_size_t obj_size)
1266 {
1267 return helper_call_map_fn__memobject__ssoo(fn, map, VM_FLAGS_FIXED | VM_FLAGS_OVERWRITE, false, start, size, offset, obj_size);
1268 }
1269
1270 static kern_return_t
call_map_fn__memobject_fixed_copy__start_size_offset_object(map_fn_t fn,MAP_T map,mach_vm_address_t start,mach_vm_size_t size,vm_object_offset_t offset,mach_vm_size_t obj_size)1271 call_map_fn__memobject_fixed_copy__start_size_offset_object(map_fn_t fn, MAP_T map, mach_vm_address_t start, mach_vm_size_t size, vm_object_offset_t offset, mach_vm_size_t obj_size)
1272 {
1273 return helper_call_map_fn__memobject__ssoo(fn, map, VM_FLAGS_FIXED | VM_FLAGS_OVERWRITE, true, start, size, offset, obj_size);
1274 }
1275
1276 static kern_return_t
call_map_fn__memobject_anywhere__start_size_offset_object(map_fn_t fn,MAP_T map,mach_vm_address_t start,mach_vm_size_t size,vm_object_offset_t offset,mach_vm_size_t obj_size)1277 call_map_fn__memobject_anywhere__start_size_offset_object(map_fn_t fn, MAP_T map, mach_vm_address_t start, mach_vm_size_t size, vm_object_offset_t offset, mach_vm_size_t obj_size)
1278 {
1279 return helper_call_map_fn__memobject__ssoo(fn, map, VM_FLAGS_ANYWHERE, false, start, size, offset, obj_size);
1280 }
1281
1282 static kern_return_t
help_call_map_fn__allocate__inherit(map_fn_t fn,MAP_T map,int flags,bool copy,mach_vm_address_t start,mach_vm_size_t size,vm_inherit_t inherit)1283 help_call_map_fn__allocate__inherit(map_fn_t fn, MAP_T map, int flags, bool copy, mach_vm_address_t start, mach_vm_size_t size, vm_inherit_t inherit)
1284 {
1285 mach_vm_address_t out_addr = start;
1286 kern_return_t kr = fn(map, &out_addr, size, 0, flags,
1287 0, KB16, copy, VM_PROT_DEFAULT, VM_PROT_DEFAULT, inherit);
1288 deallocate_if_not_fixed_overwrite(kr, map, out_addr, size, flags);
1289 return kr;
1290 }
1291
1292 static kern_return_t
call_map_fn__allocate_fixed__inherit(map_fn_t fn,MAP_T map,mach_vm_address_t start,mach_vm_size_t size,vm_inherit_t inherit)1293 call_map_fn__allocate_fixed__inherit(map_fn_t fn, MAP_T map, mach_vm_address_t start, mach_vm_size_t size, vm_inherit_t inherit)
1294 {
1295 return help_call_map_fn__allocate__inherit(fn, map, VM_FLAGS_FIXED | VM_FLAGS_OVERWRITE, false, start, size, inherit);
1296 }
1297
1298 static kern_return_t
call_map_fn__allocate_fixed_copy__inherit(map_fn_t fn,MAP_T map,mach_vm_address_t start,mach_vm_size_t size,vm_inherit_t inherit)1299 call_map_fn__allocate_fixed_copy__inherit(map_fn_t fn, MAP_T map, mach_vm_address_t start, mach_vm_size_t size, vm_inherit_t inherit)
1300 {
1301 return help_call_map_fn__allocate__inherit(fn, map, VM_FLAGS_FIXED | VM_FLAGS_OVERWRITE, true, start, size, inherit);
1302 }
1303
1304 static kern_return_t
call_map_fn__allocate_anywhere__inherit(map_fn_t fn,MAP_T map,mach_vm_address_t start,mach_vm_size_t size,vm_inherit_t inherit)1305 call_map_fn__allocate_anywhere__inherit(map_fn_t fn, MAP_T map, mach_vm_address_t start, mach_vm_size_t size, vm_inherit_t inherit)
1306 {
1307 return help_call_map_fn__allocate__inherit(fn, map, VM_FLAGS_ANYWHERE, false, start, size, inherit);
1308 }
1309
1310 static kern_return_t
help_call_map_fn__memobject__inherit(map_fn_t fn,MAP_T map,int flags,bool copy,mach_vm_address_t start,mach_vm_size_t size,vm_inherit_t inherit)1311 help_call_map_fn__memobject__inherit(map_fn_t fn, MAP_T map, int flags, bool copy, mach_vm_address_t start, mach_vm_size_t size, vm_inherit_t inherit)
1312 {
1313 mach_port_t memobject = make_a_mem_object(TEST_ALLOC_SIZE + 1);
1314 mach_vm_address_t out_addr = start;
1315 kern_return_t kr = fn(map, &out_addr, size, 0, flags,
1316 memobject, KB16, copy, VM_PROT_DEFAULT, VM_PROT_DEFAULT, inherit);
1317 deallocate_if_not_fixed_overwrite(kr, map, out_addr, size, flags);
1318 mach_memory_entry_port_release(memobject);
1319 return kr;
1320 }
1321
1322 static kern_return_t
call_map_fn__memobject_fixed__inherit(map_fn_t fn,MAP_T map,mach_vm_address_t start,mach_vm_size_t size,vm_inherit_t inherit)1323 call_map_fn__memobject_fixed__inherit(map_fn_t fn, MAP_T map, mach_vm_address_t start, mach_vm_size_t size, vm_inherit_t inherit)
1324 {
1325 return help_call_map_fn__memobject__inherit(fn, map, VM_FLAGS_FIXED | VM_FLAGS_OVERWRITE, false, start, size, inherit);
1326 }
1327
1328 static kern_return_t
call_map_fn__memobject_fixed_copy__inherit(map_fn_t fn,MAP_T map,mach_vm_address_t start,mach_vm_size_t size,vm_inherit_t inherit)1329 call_map_fn__memobject_fixed_copy__inherit(map_fn_t fn, MAP_T map, mach_vm_address_t start, mach_vm_size_t size, vm_inherit_t inherit)
1330 {
1331 return help_call_map_fn__memobject__inherit(fn, map, VM_FLAGS_FIXED | VM_FLAGS_OVERWRITE, true, start, size, inherit);
1332 }
1333
1334 static kern_return_t
call_map_fn__memobject_anywhere__inherit(map_fn_t fn,MAP_T map,mach_vm_address_t start,mach_vm_size_t size,vm_inherit_t inherit)1335 call_map_fn__memobject_anywhere__inherit(map_fn_t fn, MAP_T map, mach_vm_address_t start, mach_vm_size_t size, vm_inherit_t inherit)
1336 {
1337 return help_call_map_fn__memobject__inherit(fn, map, VM_FLAGS_ANYWHERE, false, start, size, inherit);
1338 }
1339
1340 static kern_return_t
call_map_fn__allocate__flags(map_fn_t fn,MAP_T map,mach_vm_address_t * start,mach_vm_size_t size,int flags)1341 call_map_fn__allocate__flags(map_fn_t fn, MAP_T map, mach_vm_address_t * start, mach_vm_size_t size, int flags)
1342 {
1343 kern_return_t kr = fn(map, start, size, 0, flags,
1344 0, KB16, false, VM_PROT_DEFAULT, VM_PROT_DEFAULT, VM_INHERIT_DEFAULT);
1345 deallocate_if_not_fixed_overwrite(kr, map, *start, size, flags);
1346 return kr;
1347 }
1348
1349 static kern_return_t
call_map_fn__allocate_copy__flags(map_fn_t fn,MAP_T map,mach_vm_address_t * start,mach_vm_size_t size,int flags)1350 call_map_fn__allocate_copy__flags(map_fn_t fn, MAP_T map, mach_vm_address_t * start, mach_vm_size_t size, int flags)
1351 {
1352 kern_return_t kr = fn(map, start, size, 0, flags,
1353 0, KB16, false, VM_PROT_DEFAULT, VM_PROT_DEFAULT, VM_INHERIT_DEFAULT);
1354 deallocate_if_not_fixed_overwrite(kr, map, *start, size, flags);
1355 return kr;
1356 }
1357
1358 static kern_return_t
call_map_fn__memobject__flags(map_fn_t fn,MAP_T map,mach_vm_address_t * start,mach_vm_size_t size,int flags)1359 call_map_fn__memobject__flags(map_fn_t fn, MAP_T map, mach_vm_address_t * start, mach_vm_size_t size, int flags)
1360 {
1361 mach_port_t memobject = make_a_mem_object(TEST_ALLOC_SIZE + 1);
1362 kern_return_t kr = fn(map, start, size, 0, flags,
1363 memobject, KB16, false, VM_PROT_DEFAULT, VM_PROT_DEFAULT, VM_INHERIT_DEFAULT);
1364 deallocate_if_not_fixed_overwrite(kr, map, *start, size, flags);
1365 mach_memory_entry_port_release(memobject);
1366 return kr;
1367 }
1368
1369 static kern_return_t
call_map_fn__memobject_copy__flags(map_fn_t fn,MAP_T map,mach_vm_address_t * start,mach_vm_size_t size,int flags)1370 call_map_fn__memobject_copy__flags(map_fn_t fn, MAP_T map, mach_vm_address_t * start, mach_vm_size_t size, int flags)
1371 {
1372 mach_port_t memobject = make_a_mem_object(TEST_ALLOC_SIZE + 1);
1373 kern_return_t kr = fn(map, start, size, 0, flags,
1374 memobject, KB16, true, VM_PROT_DEFAULT, VM_PROT_DEFAULT, VM_INHERIT_DEFAULT);
1375 deallocate_if_not_fixed_overwrite(kr, map, *start, size, flags);
1376 mach_memory_entry_port_release(memobject);
1377 return kr;
1378 }
1379
1380 static kern_return_t
help_call_map_fn__allocate__prot_pairs(map_fn_t fn,MAP_T map,int flags,bool copy,vm_prot_t cur,vm_prot_t max)1381 help_call_map_fn__allocate__prot_pairs(map_fn_t fn, MAP_T map, int flags, bool copy, vm_prot_t cur, vm_prot_t max)
1382 {
1383 mach_vm_address_t out_addr = 0;
1384 kern_return_t kr = fn(map, &out_addr, KB16, 0, flags,
1385 0, KB16, copy, cur, max, VM_INHERIT_DEFAULT);
1386 deallocate_if_not_fixed_overwrite(kr, map, out_addr, KB16, flags);
1387 return kr;
1388 }
1389
1390 static kern_return_t
call_map_fn__allocate_fixed__prot_pairs(map_fn_t fn,MAP_T map,vm_prot_t cur,vm_prot_t max)1391 call_map_fn__allocate_fixed__prot_pairs(map_fn_t fn, MAP_T map, vm_prot_t cur, vm_prot_t max)
1392 {
1393 return help_call_map_fn__allocate__prot_pairs(fn, map, VM_FLAGS_FIXED | VM_FLAGS_OVERWRITE, false, cur, max);
1394 }
1395
1396 static kern_return_t
call_map_fn__allocate_fixed_copy__prot_pairs(map_fn_t fn,MAP_T map,vm_prot_t cur,vm_prot_t max)1397 call_map_fn__allocate_fixed_copy__prot_pairs(map_fn_t fn, MAP_T map, vm_prot_t cur, vm_prot_t max)
1398 {
1399 return help_call_map_fn__allocate__prot_pairs(fn, map, VM_FLAGS_FIXED | VM_FLAGS_OVERWRITE, true, cur, max);
1400 }
1401
1402 static kern_return_t
call_map_fn__allocate_anywhere__prot_pairs(map_fn_t fn,MAP_T map,vm_prot_t cur,vm_prot_t max)1403 call_map_fn__allocate_anywhere__prot_pairs(map_fn_t fn, MAP_T map, vm_prot_t cur, vm_prot_t max)
1404 {
1405 return help_call_map_fn__allocate__prot_pairs(fn, map, VM_FLAGS_ANYWHERE, false, cur, max);
1406 }
1407
1408 static kern_return_t
help_call_map_fn__memobject__prot_pairs(map_fn_t fn,MAP_T map,int flags,bool copy,vm_prot_t cur,vm_prot_t max)1409 help_call_map_fn__memobject__prot_pairs(map_fn_t fn, MAP_T map, int flags, bool copy, vm_prot_t cur, vm_prot_t max)
1410 {
1411 mach_port_t memobject = make_a_mem_object(TEST_ALLOC_SIZE + 1);
1412 mach_vm_address_t out_addr = 0;
1413 kern_return_t kr = fn(map, &out_addr, KB16, 0, flags,
1414 memobject, KB16, copy, cur, max, VM_INHERIT_DEFAULT);
1415 deallocate_if_not_fixed_overwrite(kr, map, out_addr, KB16, flags);
1416 mach_memory_entry_port_release(memobject);
1417 return kr;
1418 }
1419
1420 static kern_return_t
call_map_fn__memobject_fixed__prot_pairs(map_fn_t fn,MAP_T map,vm_prot_t cur,vm_prot_t max)1421 call_map_fn__memobject_fixed__prot_pairs(map_fn_t fn, MAP_T map, vm_prot_t cur, vm_prot_t max)
1422 {
1423 return help_call_map_fn__memobject__prot_pairs(fn, map, VM_FLAGS_FIXED | VM_FLAGS_OVERWRITE, false, cur, max);
1424 }
1425
1426 static kern_return_t
call_map_fn__memobject_fixed_copy__prot_pairs(map_fn_t fn,MAP_T map,vm_prot_t cur,vm_prot_t max)1427 call_map_fn__memobject_fixed_copy__prot_pairs(map_fn_t fn, MAP_T map, vm_prot_t cur, vm_prot_t max)
1428 {
1429 return help_call_map_fn__memobject__prot_pairs(fn, map, VM_FLAGS_FIXED | VM_FLAGS_OVERWRITE, true, cur, max);
1430 }
1431
1432 static kern_return_t
call_map_fn__memobject_anywhere__prot_pairs(map_fn_t fn,MAP_T map,vm_prot_t cur,vm_prot_t max)1433 call_map_fn__memobject_anywhere__prot_pairs(map_fn_t fn, MAP_T map, vm_prot_t cur, vm_prot_t max)
1434 {
1435 return help_call_map_fn__memobject__prot_pairs(fn, map, VM_FLAGS_ANYWHERE, false, cur, max);
1436 }
1437
1438 // wrappers
1439
1440 kern_return_t
mach_vm_map_wrapped(vm_map_t target_task,mach_vm_address_t * address,mach_vm_size_t size,mach_vm_offset_t mask,int flags,mem_entry_name_port_t object,memory_object_offset_t offset,boolean_t copy,vm_prot_t cur_protection,vm_prot_t max_protection,vm_inherit_t inheritance)1441 mach_vm_map_wrapped(vm_map_t target_task,
1442 mach_vm_address_t *address,
1443 mach_vm_size_t size,
1444 mach_vm_offset_t mask,
1445 int flags,
1446 mem_entry_name_port_t object,
1447 memory_object_offset_t offset,
1448 boolean_t copy,
1449 vm_prot_t cur_protection,
1450 vm_prot_t max_protection,
1451 vm_inherit_t inheritance)
1452 {
1453 if (dealloc_would_time_out(*address, size, target_task)) {
1454 return ACCEPTABLE;
1455 }
1456
1457 mach_vm_address_t saved_addr = *address;
1458 kern_return_t kr = mach_vm_map(target_task, address, size, mask, flags, object, offset, copy, cur_protection, max_protection, inheritance);
1459 check_mach_vm_map_outparam_changes(&kr, *address, saved_addr, flags, target_task);
1460 return kr;
1461 }
1462
1463 // missing forward declaration
1464 kern_return_t
1465 mach_vm_map_external(
1466 vm_map_t target_map,
1467 mach_vm_offset_t *address,
1468 mach_vm_size_t initial_size,
1469 mach_vm_offset_t mask,
1470 int flags,
1471 ipc_port_t port,
1472 vm_object_offset_t offset,
1473 boolean_t copy,
1474 vm_prot_t cur_protection,
1475 vm_prot_t max_protection,
1476 vm_inherit_t inheritance);
1477 kern_return_t
mach_vm_map_external_wrapped(vm_map_t target_task,mach_vm_address_t * address,mach_vm_size_t size,mach_vm_offset_t mask,int flags,mem_entry_name_port_t object,memory_object_offset_t offset,boolean_t copy,vm_prot_t cur_protection,vm_prot_t max_protection,vm_inherit_t inheritance)1478 mach_vm_map_external_wrapped(vm_map_t target_task,
1479 mach_vm_address_t *address,
1480 mach_vm_size_t size,
1481 mach_vm_offset_t mask,
1482 int flags,
1483 mem_entry_name_port_t object,
1484 memory_object_offset_t offset,
1485 boolean_t copy,
1486 vm_prot_t cur_protection,
1487 vm_prot_t max_protection,
1488 vm_inherit_t inheritance)
1489 {
1490 if (dealloc_would_time_out(*address, size, target_task)) {
1491 return ACCEPTABLE;
1492 }
1493
1494 mach_vm_address_t saved_addr = *address;
1495 kern_return_t kr = mach_vm_map_external(target_task, address, size, mask, flags, object, offset, copy, cur_protection, max_protection, inheritance);
1496 check_mach_vm_map_outparam_changes(&kr, *address, saved_addr, flags, target_task);
1497 return kr;
1498 }
1499
1500 kern_return_t
mach_vm_map_kernel_wrapped(vm_map_t target_task,mach_vm_address_t * address,mach_vm_size_t size,mach_vm_offset_t mask,int flags,mem_entry_name_port_t object,memory_object_offset_t offset,boolean_t copy,vm_prot_t cur_protection,vm_prot_t max_protection,vm_inherit_t inheritance)1501 mach_vm_map_kernel_wrapped(vm_map_t target_task,
1502 mach_vm_address_t *address,
1503 mach_vm_size_t size,
1504 mach_vm_offset_t mask,
1505 int flags,
1506 mem_entry_name_port_t object,
1507 memory_object_offset_t offset,
1508 boolean_t copy,
1509 vm_prot_t cur_protection,
1510 vm_prot_t max_protection,
1511 vm_inherit_t inheritance)
1512 {
1513 if (dealloc_would_time_out(*address, size, target_task)) {
1514 return ACCEPTABLE;
1515 }
1516
1517 vm_map_kernel_flags_t vmk_flags = VM_MAP_KERNEL_FLAGS_NONE;
1518
1519 vm_map_kernel_flags_set_vmflags(&vmk_flags, flags);
1520 mach_vm_address_t saved_addr = *address;
1521 kern_return_t kr = mach_vm_map_kernel(target_task, address, size, mask, vmk_flags, object, offset, copy, cur_protection, max_protection, inheritance);
1522 check_mach_vm_map_outparam_changes(&kr, *address, saved_addr, flags, target_task);
1523 return kr;
1524 }
1525
1526 static inline void
check_vm_map_enter_mem_object_control_outparam_changes(kern_return_t * kr,mach_vm_address_t addr,mach_vm_address_t saved_start,int flags,MAP_T map)1527 check_vm_map_enter_mem_object_control_outparam_changes(kern_return_t * kr, mach_vm_address_t addr,
1528 mach_vm_address_t saved_start, int flags, MAP_T map)
1529 {
1530 if (*kr == KERN_SUCCESS) {
1531 if (is_fixed(flags)) {
1532 if (addr != truncate_vm_map_addr_with_flags(map, saved_start, flags)) {
1533 *kr = OUT_PARAM_BAD;
1534 }
1535 }
1536 } else {
1537 if (saved_start != addr) {
1538 *kr = OUT_PARAM_BAD;
1539 }
1540 }
1541 }
1542
1543 kern_return_t
vm_map_enter_mem_object_control_wrapped(vm_map_t target_map,mach_vm_address_t * address,mach_vm_size_t size,vm_map_offset_t mask,int flags,mem_entry_name_port_t object __unused,memory_object_offset_t offset,boolean_t copy,vm_prot_t cur_protection,vm_prot_t max_protection,vm_inherit_t inheritance)1544 vm_map_enter_mem_object_control_wrapped(
1545 vm_map_t target_map,
1546 mach_vm_address_t *address,
1547 mach_vm_size_t size,
1548 vm_map_offset_t mask,
1549 int flags,
1550 mem_entry_name_port_t object __unused,
1551 memory_object_offset_t offset,
1552 boolean_t copy,
1553 vm_prot_t cur_protection,
1554 vm_prot_t max_protection,
1555 vm_inherit_t inheritance)
1556 {
1557 if (dealloc_would_time_out(*address, size, target_map)) {
1558 return ACCEPTABLE;
1559 }
1560
1561 vm_map_offset_t vmmaddr = (vm_map_offset_t) *address;
1562 vm_map_kernel_flags_t vmk_flags = VM_MAP_KERNEL_FLAGS_NONE;
1563
1564 vm_map_kernel_flags_set_vmflags(&vmk_flags, flags);
1565 struct file_control_return control_info = get_control_from_fd(file_descriptor);
1566 kern_return_t kr = vm_map_enter_mem_object_control(target_map, &vmmaddr, size, mask, vmk_flags, (memory_object_control_t) control_info.control, offset, copy, cur_protection, max_protection, inheritance);
1567 check_vm_map_enter_mem_object_control_outparam_changes(&kr, vmmaddr, *address, flags, target_map);
1568
1569 *address = vmmaddr;
1570
1571 cleanup_control_related_data(control_info);
1572
1573 return kr;
1574 }
1575
1576 kern_return_t
vm_map_wrapped(vm_map_t target_task,mach_vm_address_t * address,mach_vm_size_t size,mach_vm_offset_t mask,int flags,mem_entry_name_port_t object,memory_object_offset_t offset,boolean_t copy,vm_prot_t cur_protection,vm_prot_t max_protection,vm_inherit_t inheritance)1577 vm_map_wrapped(vm_map_t target_task,
1578 mach_vm_address_t *address,
1579 mach_vm_size_t size,
1580 mach_vm_offset_t mask,
1581 int flags,
1582 mem_entry_name_port_t object,
1583 memory_object_offset_t offset,
1584 boolean_t copy,
1585 vm_prot_t cur_protection,
1586 vm_prot_t max_protection,
1587 vm_inherit_t inheritance)
1588 {
1589 if (dealloc_would_time_out(*address, size, target_task)) {
1590 return ACCEPTABLE;
1591 }
1592
1593 vm_address_t addr = (vm_address_t)*address;
1594 kern_return_t kr = vm_map(target_task, &addr, size, mask, flags, object, offset, copy, cur_protection, max_protection, inheritance);
1595 check_mach_vm_map_outparam_changes(&kr, addr, (vm_address_t)*address, flags, target_task);
1596 *address = addr;
1597 return kr;
1598 }
1599
1600 kern_return_t
1601 vm_map_external(
1602 vm_map_t target_map,
1603 vm_offset_t *address,
1604 vm_size_t size,
1605 vm_offset_t mask,
1606 int flags,
1607 ipc_port_t port,
1608 vm_offset_t offset,
1609 boolean_t copy,
1610 vm_prot_t cur_protection,
1611 vm_prot_t max_protection,
1612 vm_inherit_t inheritance);
1613 kern_return_t
vm_map_external_wrapped(vm_map_t target_task,mach_vm_address_t * address,mach_vm_size_t size,mach_vm_offset_t mask,int flags,mem_entry_name_port_t object,memory_object_offset_t offset,boolean_t copy,vm_prot_t cur_protection,vm_prot_t max_protection,vm_inherit_t inheritance)1614 vm_map_external_wrapped(vm_map_t target_task,
1615 mach_vm_address_t *address,
1616 mach_vm_size_t size,
1617 mach_vm_offset_t mask,
1618 int flags,
1619 mem_entry_name_port_t object,
1620 memory_object_offset_t offset,
1621 boolean_t copy,
1622 vm_prot_t cur_protection,
1623 vm_prot_t max_protection,
1624 vm_inherit_t inheritance)
1625 {
1626 if (dealloc_would_time_out(*address, size, target_task)) {
1627 return ACCEPTABLE;
1628 }
1629
1630 vm_address_t addr = (vm_address_t)*address;
1631 kern_return_t kr = vm_map_external(target_task, &addr, size, mask, flags, object, offset, copy, cur_protection, max_protection, inheritance);
1632 check_mach_vm_map_outparam_changes(&kr, addr, (vm_address_t)*address, flags, target_task);
1633 *address = addr;
1634 return kr;
1635 }
1636
1637 // implementations
1638
1639 #define IMPL_MAP_FN_START_SIZE(map_fn, instance) \
1640 static kern_return_t \
1641 call_ ## map_fn ## __ ## instance (MAP_T map, mach_vm_address_t start, mach_vm_size_t size) \
1642 { \
1643 return call_map_fn__ ## instance(map_fn, map, start, size); \
1644 }
1645
1646 #define IMPL_MAP_FN_HINT_SIZE(map_fn, instance) \
1647 static kern_return_t \
1648 call_ ## map_fn ## __ ## instance (MAP_T map, mach_vm_address_t start_hint, mach_vm_size_t size) \
1649 { \
1650 return call_map_fn__ ## instance(map_fn, map, start_hint, size); \
1651 }
1652
1653 #define IMPL_MAP_FN_START_SIZE_OFFSET_OBJECT(map_fn, instance) \
1654 static kern_return_t \
1655 call_ ## map_fn ## __ ## instance ## __start_size_offset_object(MAP_T map, mach_vm_address_t start, mach_vm_size_t size, vm_object_offset_t offset, mach_vm_size_t obj_size) \
1656 { \
1657 return call_map_fn__ ## instance ## __start_size_offset_object(map_fn, map, start, size, offset, obj_size); \
1658 }
1659
1660 #define IMPL_MAP_FN_START_SIZE_INHERIT(map_fn, instance) \
1661 static kern_return_t \
1662 call_ ## map_fn ## __ ## instance ## __inherit(MAP_T map, mach_vm_address_t start, mach_vm_size_t size, vm_inherit_t inherit) \
1663 { \
1664 return call_map_fn__ ## instance ## __inherit(map_fn, map, start, size, inherit); \
1665 }
1666
1667 #define IMPL_MAP_FN_START_SIZE_FLAGS(map_fn, instance) \
1668 static kern_return_t \
1669 call_ ## map_fn ## __ ## instance ## __flags(MAP_T map, mach_vm_address_t * start, mach_vm_size_t size, int flags) \
1670 { \
1671 return call_map_fn__ ## instance ## __flags(map_fn, map, start, size, flags); \
1672 }
1673
1674 #define IMPL_MAP_FN_PROT_PAIRS(map_fn, instance) \
1675 static kern_return_t \
1676 call_ ## map_fn ## __ ## instance ## __prot_pairs(MAP_T map, vm_prot_t cur, vm_prot_t max) \
1677 { \
1678 return call_map_fn__ ## instance ## __prot_pairs(map_fn, map, cur, max); \
1679 }
1680
1681 #define IMPL(map_fn) \
1682 IMPL_MAP_FN_START_SIZE(map_fn, allocate_fixed) \
1683 IMPL_MAP_FN_START_SIZE(map_fn, allocate_fixed_copy) \
1684 IMPL_MAP_FN_START_SIZE(map_fn, memobject_fixed) \
1685 IMPL_MAP_FN_START_SIZE(map_fn, memobject_fixed_copy) \
1686 IMPL_MAP_FN_HINT_SIZE(map_fn, allocate_anywhere) \
1687 IMPL_MAP_FN_HINT_SIZE(map_fn, memobject_anywhere) \
1688 IMPL_MAP_FN_START_SIZE_OFFSET_OBJECT(map_fn, memobject_fixed) \
1689 IMPL_MAP_FN_START_SIZE_OFFSET_OBJECT(map_fn, memobject_fixed_copy) \
1690 IMPL_MAP_FN_START_SIZE_OFFSET_OBJECT(map_fn, memobject_anywhere) \
1691 IMPL_MAP_FN_START_SIZE_INHERIT(map_fn, allocate_fixed) \
1692 IMPL_MAP_FN_START_SIZE_INHERIT(map_fn, allocate_fixed_copy) \
1693 IMPL_MAP_FN_START_SIZE_INHERIT(map_fn, allocate_anywhere) \
1694 IMPL_MAP_FN_START_SIZE_INHERIT(map_fn, memobject_fixed) \
1695 IMPL_MAP_FN_START_SIZE_INHERIT(map_fn, memobject_fixed_copy) \
1696 IMPL_MAP_FN_START_SIZE_INHERIT(map_fn, memobject_anywhere) \
1697 IMPL_MAP_FN_START_SIZE_FLAGS(map_fn, allocate) \
1698 IMPL_MAP_FN_START_SIZE_FLAGS(map_fn, allocate_copy) \
1699 IMPL_MAP_FN_START_SIZE_FLAGS(map_fn, memobject) \
1700 IMPL_MAP_FN_START_SIZE_FLAGS(map_fn, memobject_copy) \
1701 IMPL_MAP_FN_PROT_PAIRS(map_fn, allocate_fixed) \
1702 IMPL_MAP_FN_PROT_PAIRS(map_fn, allocate_fixed_copy) \
1703 IMPL_MAP_FN_PROT_PAIRS(map_fn, allocate_anywhere) \
1704 IMPL_MAP_FN_PROT_PAIRS(map_fn, memobject_fixed) \
1705 IMPL_MAP_FN_PROT_PAIRS(map_fn, memobject_fixed_copy) \
1706 IMPL_MAP_FN_PROT_PAIRS(map_fn, memobject_anywhere) \
1707
1708 IMPL(mach_vm_map_wrapped)
IMPL(mach_vm_map_external_wrapped)1709 IMPL(mach_vm_map_external_wrapped)
1710 IMPL(mach_vm_map_kernel_wrapped)
1711 IMPL(vm_map_wrapped)
1712 IMPL(vm_map_external_wrapped)
1713 IMPL(vm_map_enter_mem_object_control_wrapped)
1714
1715 #undef IMPL
1716
1717 static int
1718 vm_parameter_validation_kern_test(int64_t in_value, int64_t *out_value)
1719 {
1720 // in_value has the userspace address of the fixed-size output buffer and a file descriptor.
1721 // The address is KB16 aligned, so the bottom bits are used for the fd.
1722 // fd bit 15 also indicates if we want to generate golden results.
1723 // in_value is KB16 aligned
1724 uint64_t fd_mask = KB16 - 1;
1725 file_descriptor = (int)(((uint64_t) in_value) & fd_mask);
1726 uint64_t buffer_address = in_value - file_descriptor;
1727 SYSCTL_OUTPUT_BUF = buffer_address;
1728 SYSCTL_OUTPUT_END = SYSCTL_OUTPUT_BUF + SYSCTL_OUTPUT_BUFFER_SIZE;
1729
1730 // check if running to generate golden result list via boot-arg
1731 kernel_generate_golden = (file_descriptor & (KB16 >> 1)) > 0;
1732 if (kernel_generate_golden) {
1733 file_descriptor &= ~(KB16 >> 1);
1734 }
1735
1736 // Test options:
1737 // - avoid panics for untagged wired memory (set to true during some tests)
1738 // - clamp vm addresses before passing to pmap to avoid pmap panics
1739 thread_test_context_t ctx CLEANUP_THREAD_TEST_CONTEXT = {
1740 .test_option_vm_prevent_wire_tag_panic = false,
1741 .test_option_vm_map_clamp_pmap_remove = true,
1742 };
1743 thread_set_test_context(&ctx);
1744
1745 #if !CONFIG_SPTM && (__ARM_42BIT_PA_SPACE__ || ARM_LARGE_MEMORY)
1746 if (kernel_generate_golden) {
1747 // Some devices skip some trials to avoid timeouts.
1748 // Golden files cannot be generated on these devices.
1749 testprintf("Can't generate golden files on this device "
1750 "(PPL && (__ARM_42BIT_PA_SPACE__ || ARM_LARGE_MEMORY)). "
1751 "Try again on a different device.\n");
1752 *out_value = 0; // failure
1753 goto done;
1754 }
1755 #else
1756 #pragma clang diagnostic ignored "-Wunused-label"
1757 #endif
1758
1759 /*
1760 * -- memory entry functions --
1761 * The memory entry test functions use macros to generate each flavor of memory entry function.
1762 * For more context on why, see the matching comment in vm_parameter_validation.c
1763 */
1764
1765 #define RUN_START_SIZE(fn, variant, name) dealloc_results(process_results(test_mach_with_allocated_start_size(call_ ## fn ## __start_size__ ## variant, name " (start/size)")))
1766 #define RUN_PROT(fn, name) dealloc_results(process_results(test_mach_with_allocated_vm_prot_t(call_ ## fn ## __vm_prot , name " (vm_prot_t)")))
1767
1768 #define RUN_ALL(fn, name) \
1769 RUN_START_SIZE(fn, copy, #name " (copy)"); \
1770 RUN_START_SIZE(fn, memonly, #name " (memonly)"); \
1771 RUN_START_SIZE(fn, namedcreate, #name " (namedcreate)"); \
1772 RUN_START_SIZE(fn, share, #name " (share)"); \
1773 RUN_START_SIZE(fn, namedreuse, #name " (namedreuse)"); \
1774 RUN_PROT(fn, #name " (vm_prot_t)"); \
1775
1776 RUN_ALL(mach_make_memory_entry_64, mach_make_memory_entry_64);
1777 RUN_ALL(mach_make_memory_entry, mach_make_memory_entry);
1778 RUN_ALL(mach_make_memory_entry_internal_retyped, mach_make_memory_entry_internal);
1779 #undef RUN_ALL
1780 #undef RUN_START_SIZE
1781 #undef RUN_PROT
1782
1783 #define RUN(fn, name) dealloc_results(process_results(test_mach_with_ledger_tag(fn, name " (ledger tag)")))
1784 RUN(call_mach_memory_entry_ownership__ledger_tag, "mach_memory_entry_ownership");
1785 #undef RUN
1786
1787 #define RUN(fn, name) dealloc_results(process_results(test_mach_with_ledger_flag(fn, name " (ledger flag)")))
1788 RUN(call_mach_memory_entry_ownership__ledger_flag, "mach_memory_entry_ownership");
1789 #undef RUN
1790
1791 #define RUN(fn, name) dealloc_results(process_results(test_mach_with_allocated_start_size(fn, name " (start/size)")))
1792 RUN(call_mach_memory_entry_map_size__start_size, "mach_memory_entry_map_size");
1793 #undef RUN
1794
1795 /*
1796 * -- allocate/deallocate functions --
1797 */
1798
1799 #define RUN(fn, name) dealloc_results(process_results(test_mach_allocation_func_with_start_size(fn, name)))
1800 RUN(call_mach_vm_allocate__start_size_fixed, "mach_vm_allocate_external (fixed) (realigned start/size)");
1801 RUN(call_mach_vm_allocate__start_size_anywhere, "mach_vm_allocate_external (anywhere) (hint/size)");
1802 RUN(call_mach_vm_allocate_kernel__start_size_fixed, "mach_vm_allocate (fixed) (realigned start/size)");
1803 RUN(call_mach_vm_allocate_kernel__start_size_anywhere, "mach_vm_allocate (anywhere) (hint/size)");
1804 #undef RUN
1805
1806 #define RUN(fn, name) dealloc_results(process_results(test_mach_allocation_func_with_vm_map_kernel_flags_t(fn, name " (vm_map_kernel_flags_t)")))
1807 RUN(call_mach_vm_allocate__flags, "mach_vm_allocate_external");
1808 RUN(call_mach_vm_allocate_kernel__flags, "mach_vm_allocate_kernel");
1809 #undef RUN
1810
1811 #define RUN(fn, name) dealloc_results(process_results(test_mach_allocation_func_with_start_size(fn, name)))
1812 RUN(call_vm_allocate__start_size_fixed, "vm_allocate (fixed) (realigned start/size)");
1813 RUN(call_vm_allocate__start_size_anywhere, "vm_allocate (anywhere) (hint/size)");
1814 #undef RUN
1815
1816 #define RUN(fn, name) dealloc_results(process_results(test_mach_allocation_func_with_vm_map_kernel_flags_t(fn, name " (vm_map_kernel_flags_t)")))
1817 RUN(call_vm_allocate__flags, "vm_allocate");
1818 #undef RUN
1819 dealloc_results(process_results(test_deallocator(call_mach_vm_deallocate, "mach_vm_deallocate (start/size)")));
1820 dealloc_results(process_results(test_deallocator(call_vm_deallocate, "vm_deallocate (start/size)")));
1821
1822 /*
1823 * -- map/remap functions --
1824 * These functions rely heavily on macros.
1825 * For more context on why, see the matching comment in vm_parameter_validation.c
1826 */
1827
1828 // map tests
1829
1830 #define RUN_START_SIZE(fn, name) dealloc_results(process_results(test_mach_with_allocated_start_size(fn, name " (realigned start/size)")))
1831 #define RUN_HINT_SIZE(fn, name) dealloc_results(process_results(test_mach_with_allocated_start_size(fn, name " (hint/size)")))
1832 #define RUN_PROT_PAIR(fn, name) dealloc_results(process_results(test_mach_vm_prot_pair(fn, name " (vm_prot_t pair)")))
1833 #define RUN_INHERIT(fn, name) dealloc_results(process_results(test_mach_with_allocated_vm_inherit_t(fn, name " (vm_inherit_t)")))
1834 #define RUN_FLAGS(fn, name) dealloc_results(process_results(test_mach_allocation_func_with_vm_map_kernel_flags_t(fn, name " (vm_map_kernel_flags_t)")))
1835 #define RUN_SSOO(fn, name) dealloc_results(process_results(test_mach_with_allocated_start_size_offset_object(fn, name " (start/size/offset/object)")))
1836
1837 #define RUN_ALL(fn, name) \
1838 RUN_START_SIZE(call_ ## fn ## __allocate_fixed, #name " (allocate fixed overwrite)"); \
1839 RUN_START_SIZE(call_ ## fn ## __allocate_fixed_copy, #name " (allocate fixed overwrite copy)"); \
1840 RUN_START_SIZE(call_ ## fn ## __memobject_fixed, #name " (memobject fixed overwrite)"); \
1841 RUN_START_SIZE(call_ ## fn ## __memobject_fixed_copy, #name " (memobject fixed overwrite copy)"); \
1842 RUN_HINT_SIZE(call_ ## fn ## __allocate_anywhere, #name " (allocate anywhere)"); \
1843 RUN_HINT_SIZE(call_ ## fn ## __memobject_anywhere, #name " (memobject anywhere)"); \
1844 RUN_PROT_PAIR(call_ ## fn ## __allocate_fixed__prot_pairs, #name " (allocate fixed overwrite)"); \
1845 RUN_PROT_PAIR(call_ ## fn ## __allocate_fixed_copy__prot_pairs, #name " (allocate fixed overwrite copy)"); \
1846 RUN_PROT_PAIR(call_ ## fn ## __allocate_anywhere__prot_pairs, #name " (allocate anywhere)"); \
1847 RUN_PROT_PAIR(call_ ## fn ## __memobject_fixed__prot_pairs, #name " (memobject fixed overwrite)"); \
1848 RUN_PROT_PAIR(call_ ## fn ## __memobject_fixed_copy__prot_pairs, #name " (memobject fixed overwrite copy)"); \
1849 RUN_PROT_PAIR(call_ ## fn ## __memobject_anywhere__prot_pairs, #name " (memobject anywhere)"); \
1850 RUN_INHERIT(call_ ## fn ## __allocate_fixed__inherit, #name " (allocate fixed overwrite)"); \
1851 RUN_INHERIT(call_ ## fn ## __allocate_fixed_copy__inherit, #name " (allocate fixed overwrite copy)"); \
1852 RUN_INHERIT(call_ ## fn ## __allocate_anywhere__inherit, #name " (allocate anywhere)"); \
1853 RUN_INHERIT(call_ ## fn ## __memobject_fixed__inherit, #name " (memobject fixed overwrite)"); \
1854 RUN_INHERIT(call_ ## fn ## __memobject_fixed_copy__inherit, #name " (memobject fixed overwrite copy)"); \
1855 RUN_INHERIT(call_ ## fn ## __memobject_anywhere__inherit, #name " (memobject anywhere)"); \
1856 RUN_FLAGS(call_ ## fn ## __allocate__flags, #name " (allocate)"); \
1857 RUN_FLAGS(call_ ## fn ## __allocate_copy__flags, #name " (allocate copy)"); \
1858 RUN_FLAGS(call_ ## fn ## __memobject__flags, #name " (memobject)"); \
1859 RUN_FLAGS(call_ ## fn ## __memobject_copy__flags, #name " (memobject copy)"); \
1860 RUN_SSOO(call_ ## fn ## __memobject_fixed__start_size_offset_object, #name " (memobject fixed overwrite)"); \
1861 RUN_SSOO(call_ ## fn ## __memobject_fixed_copy__start_size_offset_object, #name " (memobject fixed overwrite copy)"); \
1862 RUN_SSOO(call_ ## fn ## __memobject_anywhere__start_size_offset_object, #name " (memobject anywhere)"); \
1863
1864 RUN_ALL(mach_vm_map_wrapped, mach_vm_map);
1865 RUN_ALL(mach_vm_map_external_wrapped, mach_vm_map_external);
1866 RUN_ALL(mach_vm_map_kernel_wrapped, mach_vm_map_kernel);
1867 RUN_ALL(vm_map_wrapped, vm_map);
1868 RUN_ALL(vm_map_external_wrapped, vm_map_external);
1869
1870 #define RUN_SSO(fn, name) dealloc_results(process_results(test_mach_with_allocated_start_size_offset(fn, name " (start/size/offset)")))
1871
1872 #define RUN_ALL_CTL(fn, name) \
1873 RUN_START_SIZE(call_ ## fn ## __allocate_fixed, #name " (allocate fixed overwrite)"); \
1874 RUN_START_SIZE(call_ ## fn ## __allocate_fixed_copy, #name " (allocate fixed overwrite copy)"); \
1875 RUN_START_SIZE(call_ ## fn ## __memobject_fixed, #name " (memobject fixed overwrite)"); \
1876 RUN_START_SIZE(call_ ## fn ## __memobject_fixed_copy, #name " (memobject fixed overwrite copy)"); \
1877 RUN_HINT_SIZE(call_ ## fn ## __allocate_anywhere, #name " (allocate anywhere)"); \
1878 RUN_HINT_SIZE(call_ ## fn ## __memobject_anywhere, #name " (memobject anywhere)"); \
1879 RUN_PROT_PAIR(call_ ## fn ## __allocate_fixed__prot_pairs, #name " (allocate fixed overwrite)"); \
1880 RUN_PROT_PAIR(call_ ## fn ## __allocate_fixed_copy__prot_pairs, #name " (allocate fixed overwrite copy)"); \
1881 RUN_PROT_PAIR(call_ ## fn ## __allocate_anywhere__prot_pairs, #name " (allocate anywhere)"); \
1882 RUN_PROT_PAIR(call_ ## fn ## __memobject_fixed__prot_pairs, #name " (memobject fixed overwrite)"); \
1883 RUN_PROT_PAIR(call_ ## fn ## __memobject_fixed_copy__prot_pairs, #name " (memobject fixed overwrite copy)"); \
1884 RUN_PROT_PAIR(call_ ## fn ## __memobject_anywhere__prot_pairs, #name " (memobject anywhere)"); \
1885 RUN_INHERIT(call_ ## fn ## __allocate_fixed__inherit, #name " (allocate fixed overwrite)"); \
1886 RUN_INHERIT(call_ ## fn ## __allocate_fixed_copy__inherit, #name " (allocate fixed overwrite copy)"); \
1887 RUN_INHERIT(call_ ## fn ## __allocate_anywhere__inherit, #name " (allocate anywhere)"); \
1888 RUN_INHERIT(call_ ## fn ## __memobject_fixed__inherit, #name " (memobject fixed overwrite)"); \
1889 RUN_INHERIT(call_ ## fn ## __memobject_fixed_copy__inherit, #name " (memobject fixed overwrite copy)"); \
1890 RUN_INHERIT(call_ ## fn ## __memobject_anywhere__inherit, #name " (memobject anywhere)"); \
1891 RUN_FLAGS(call_ ## fn ## __allocate__flags, #name " (allocate)"); \
1892 RUN_FLAGS(call_ ## fn ## __allocate_copy__flags, #name " (allocate copy)"); \
1893 RUN_FLAGS(call_ ## fn ## __memobject__flags, #name " (memobject)"); \
1894 RUN_FLAGS(call_ ## fn ## __memobject_copy__flags, #name " (memobject copy)"); \
1895 RUN_SSO(call_ ## fn ## __memobject_fixed__start_size_offset_object, #name " (memobject fixed overwrite)"); \
1896 RUN_SSO(call_ ## fn ## __memobject_fixed_copy__start_size_offset_object, #name " (memobject fixed overwrite copy)"); \
1897 RUN_SSO(call_ ## fn ## __memobject_anywhere__start_size_offset_object, #name " (memobject anywhere)"); \
1898
1899 RUN_ALL_CTL(vm_map_enter_mem_object_control_wrapped, vm_map_enter_mem_object_control);
1900
1901 #undef RUN_ALL
1902 #undef RUN_START_SIZE
1903 #undef RUN_HINT_SIZE
1904 #undef RUN_PROT_PAIR
1905 #undef RUN_INHERIT
1906 #undef RUN_FLAGS
1907 #undef RUN_SSOO
1908 #undef RUN_ALL_CTL
1909 #undef RUN_SSO
1910
1911 // remap tests
1912
1913 #define FN_NAME(fn, variant, type) call_ ## fn ## __ ## variant ## __ ## type
1914 #define RUN_HELPER(harness, fn, variant, type, type_name, name) dealloc_results(process_results(harness(FN_NAME(fn, variant, type), #name " (" #variant ") (" type_name ")")))
1915 #define RUN_SRC_SIZE(fn, variant, type_name, name) RUN_HELPER(test_mach_with_allocated_start_size, fn, variant, src_size, type_name, name)
1916 #define RUN_DST_SIZE(fn, variant, type_name, name) RUN_HELPER(test_mach_with_allocated_start_size, fn, variant, dst_size, type_name, name)
1917 #define RUN_PROT_PAIRS(fn, variant, name) RUN_HELPER(test_mach_with_allocated_vm_prot_pair, fn, variant, prot_pairs, "prot_pairs", name)
1918 #define RUN_INHERIT(fn, variant, name) RUN_HELPER(test_mach_with_allocated_vm_inherit_t, fn, variant, inherit, "inherit", name)
1919 #define RUN_FLAGS(fn, variant, name) RUN_HELPER(test_mach_with_allocated_vm_map_kernel_flags_t, fn, variant, flags, "flags", name)
1920 #define RUN_SRC_DST_SIZE(fn, variant, type_name, name) RUN_HELPER(test_allocated_src_unallocated_dst_size, fn, variant, src_dst_size, type_name, name)
1921
1922 #define RUN_ALL(fn, realigned, name) \
1923 RUN_SRC_SIZE(fn, copy, realigned "src/size", name); \
1924 RUN_SRC_SIZE(fn, nocopy, realigned "src/size", name); \
1925 RUN_DST_SIZE(fn, fixed, "realigned dst/size", name); \
1926 RUN_DST_SIZE(fn, fixed_copy, "realigned dst/size", name); \
1927 RUN_DST_SIZE(fn, anywhere, "hint/size", name); \
1928 RUN_INHERIT(fn, fixed, name); \
1929 RUN_INHERIT(fn, fixed_copy, name); \
1930 RUN_INHERIT(fn, anywhere, name); \
1931 RUN_FLAGS(fn, nocopy, name); \
1932 RUN_FLAGS(fn, copy, name); \
1933 RUN_PROT_PAIRS(fn, fixed, name); \
1934 RUN_PROT_PAIRS(fn, fixed_copy, name); \
1935 RUN_PROT_PAIRS(fn, anywhere, name); \
1936 RUN_SRC_DST_SIZE(fn, fixed, "src/dst/size", name); \
1937 RUN_SRC_DST_SIZE(fn, fixed_copy, "src/dst/size", name); \
1938 RUN_SRC_DST_SIZE(fn, anywhere, "src/dst/size", name); \
1939
1940 RUN_ALL(mach_vm_remap_wrapped_kern, "realigned ", mach_vm_remap);
1941 RUN_ALL(mach_vm_remap_new_kernel_wrapped, , mach_vm_remap_new_kernel);
1942
1943 #undef RUN_ALL
1944 #undef RUN_HELPER
1945 #undef RUN_SRC_SIZE
1946 #undef RUN_DST_SIZE
1947 #undef RUN_PROT_PAIRS
1948 #undef RUN_INHERIT
1949 #undef RUN_FLAGS
1950 #undef RUN_SRC_DST_SIZE
1951
1952 /*
1953 * -- wire/unwire functions --
1954 * Some wire functions (vm_map_wire_and_extract, vm_map_wire_external, vm_map_wire_kernel)
1955 * are implemented with macros to avoid code duplication that would happen otherwise from the multiple
1956 * entrypoints, multiple params under test, and user/non user wired paths
1957 */
1958
1959 #define RUN(fn, name) dealloc_results(process_results(test_kext_unix_with_allocated_start_size(fn, name " (start/size)")))
1960 RUN(call_vslock, "vslock");
1961 RUN(call_vsunlock_undirtied, "vsunlock (undirtied)");
1962 RUN(call_vsunlock_dirtied, "vsunlock (dirtied)");
1963 #undef RUN
1964
1965 #define RUN_PROT(fn, wired, name) dealloc_results(process_results(test_mach_with_allocated_vm_prot_t(call_ ## fn ## __prot__user_wired_ ## wired ## _, name " (vm_prot_t)")))
1966 #define RUN_START(fn, wired, name) dealloc_results(process_results(test_kext_tagged_with_allocated_addr(call_ ## fn ## __start__user_wired_ ## wired ## _, name " (addr)")))
1967 #define RUN_START_END(fn, wired, name) dealloc_results(process_results(test_mach_with_allocated_start_end(call_ ## fn ## __start_end__user_wired_ ## wired ## _, name " (start/end)")))
1968 #define RUN_TAG(fn, wired, name) dealloc_results(process_results(test_mach_with_allocated_tag(call_ ## fn ## __tag__user_wired_ ## wired ## _, name " (tag)")))
1969
1970 #if XNU_PLATFORM_MacOSX
1971 // vm_map_wire_and_extract is implemented on macOS only
1972
1973 #define RUN_ALL_WIRE_AND_EXTRACT(fn, name) \
1974 RUN_PROT(fn, true, #name " (user wired)"); \
1975 RUN_PROT(fn, false, #name " (non user wired)"); \
1976 RUN_START(fn, true, #name " (user wired)"); \
1977 RUN_START(fn, false, #name " (non user wired)");
1978
1979 RUN_ALL_WIRE_AND_EXTRACT(vm_map_wire_and_extract_retyped, vm_map_wire_and_extract);
1980 #undef RUN_ALL_WIRE_AND_EXTRACT
1981 #endif // XNU_PLATFORM_MacOSX
1982
1983 #define RUN_ALL_WIRE_EXTERNAL(fn, name) \
1984 RUN_PROT(fn, true, #name " (user wired)"); \
1985 RUN_PROT(fn, false, #name " (non user wired))"); \
1986 RUN_START_END(fn, true, #name " (user wired)"); \
1987 RUN_START_END(fn, false, #name " (non user wired)");
1988
1989 RUN_ALL_WIRE_EXTERNAL(vm_map_wire_external_retyped, vm_map_wire_external);
1990 #undef RUN_ALL_WIRE_EXTERNAL
1991
1992 #define RUN_ALL_WIRE_KERNEL(fn, name) \
1993 RUN_PROT(fn, false, #name " (non user wired))"); \
1994 RUN_PROT(fn, true, #name " (user wired)"); \
1995 RUN_START_END(fn, true, #name " (user wired)"); \
1996 RUN_START_END(fn, false, #name " (non user wired)"); \
1997 RUN_TAG(fn, true, #name " (user wired)"); \
1998 RUN_TAG(fn, false, #name " (non user wired)");
1999
2000 RUN_ALL_WIRE_KERNEL(vm_map_wire_kernel, vm_map_wire_kernel);
2001 #undef RUN_ALL_WIRE_KERNEL
2002
2003 #undef RUN_PROT
2004 #undef RUN_START
2005 #undef RUN_START_END
2006 #undef RUN_TAG
2007
2008 #define RUN(fn, name) dealloc_results(process_results(test_mach_with_allocated_start_end(fn, name " (start/end)")))
2009 RUN(call_vm_map_unwire_user_wired, "vm_map_unwire (user_wired)");
2010 RUN(call_vm_map_unwire_non_user_wired, "vm_map_unwire (non user_wired)");
2011 #undef RUN
2012
2013 #define RUN(fn, name) dealloc_results(process_results(test_with_int64(fn, name " (int64)")))
2014 RUN(call_mach_vm_wire_level_monitor, "mach_vm_wire_level_monitor");
2015 #undef RUN
2016
2017 /*
2018 * -- copyin/copyout functions --
2019 */
2020
2021 #define RUN(fn, name) dealloc_results(process_results(test_mach_with_allocated_start_size(fn, name " (start/size)")))
2022 RUN(call_vm_map_copyin, "vm_map_copyin");
2023 RUN(call_mach_vm_read, "mach_vm_read");
2024 // vm_map_copyin_common is covered well by the vm_map_copyin test
2025 // RUN(call_vm_map_copyin_common, "vm_map_copyin_common");
2026 #undef RUN
2027
2028 #define RUN(fn, name) dealloc_results(process_results(test_mach_with_allocated_addr_of_size_n(fn, sizeof(uint32_t), name " (start)")))
2029 RUN(call_copyoutmap_atomic32, "copyoutmap_atomic32");
2030 #undef RUN
2031
2032 #define RUN(fn, name) dealloc_results(process_results(test_src_kerneldst_size(fn, name " (src/dst/size)")))
2033 RUN(call_copyinmap, "copyinmap");
2034 RUN(call_vm_map_read_user, "vm_map_read_user");
2035 #undef RUN
2036
2037 #define RUN(fn, name) dealloc_results(process_results(test_kernelsrc_dst_size(fn, name " (src/dst/size)")))
2038 RUN(call_vm_map_write_user, "vm_map_write_user");
2039 RUN(call_copyoutmap, "copyoutmap");
2040 #undef RUN
2041
2042 dealloc_results(process_results(test_vm_map_copy_overwrite(call_vm_map_copy_overwrite_interruptible, "vm_map_copy_overwrite (start/size)")));
2043
2044 /*
2045 * -- protection functions --
2046 */
2047
2048 #define RUN(fn, name) dealloc_results(process_results(test_mach_with_allocated_start_size(fn, name " (start/size)")))
2049 RUN(call_mach_vm_protect__start_size, "mach_vm_protect");
2050 RUN(call_vm_protect__start_size, "vm_protect");
2051 RUN(call_vm_map_protect__start_size__no_max, "vm_map_protect (no max)");
2052 RUN(call_vm_map_protect__start_size__set_max, "vm_map_protect (set max)");
2053 #undef RUN
2054
2055 #define RUN(fn, name) dealloc_results(process_results(test_mach_with_allocated_vm_prot_t(fn, name " (vm_prot_t)")))
2056 RUN(call_mach_vm_protect__vm_prot, "mach_vm_protect");
2057 RUN(call_vm_protect__vm_prot, "vm_protect");
2058 RUN(call_vm_map_protect__vm_prot__no_max, "vm_map_protect (no max)");
2059 RUN(call_vm_map_protect__vm_prot__set_max, "vm_map_protect (set max)");
2060 #undef RUN
2061
2062 #define RUN(fn, name) dealloc_results(process_results(test_unix_with_allocated_start_size(fn, name " (start/size)")))
2063 RUN(call_useracc__start_size, "useracc");
2064 #undef RUN
2065 #define RUN(fn, name) dealloc_results(process_results(test_unix_with_allocated_vm_prot_t(fn, name " (vm_prot_t)")))
2066 RUN(call_useracc__vm_prot, "useracc");
2067 #undef RUN
2068
2069 /*
2070 * -- madvise/behavior functions --
2071 */
2072
2073 #define RUN(fn, name) dealloc_results(process_results(test_mach_with_allocated_start_size(fn, name " (start/size)")))
2074 RUN(call_mach_vm_behavior_set__start_size__default, "mach_vm_behavior_set (VM_BEHAVIOR_DEFAULT)");
2075 RUN(call_mach_vm_behavior_set__start_size__can_reuse, "mach_vm_behavior_set (VM_BEHAVIOR_CAN_REUSE)");
2076 #undef RUN
2077 #define RUN(fn, name) dealloc_results(process_results(test_mach_with_allocated_vm_behavior_t(fn, name " (vm_behavior_t)")))
2078 RUN(call_mach_vm_behavior_set__vm_behavior, "mach_vm_behavior_set");
2079 #undef RUN
2080
2081 /*
2082 * -- purgability/purgeability functions --
2083 */
2084
2085 #define RUN(fn, name) dealloc_results(process_results(test_mach_with_allocated_purgeable_addr(fn, name " (addr)")))
2086 RUN(call_vm_map_purgable_control__address__get, "vm_map_purgable_control (get)");
2087 RUN(call_vm_map_purgable_control__address__purge_all, "vm_map_purgable_control (purge all)");
2088 #undef RUN
2089
2090 #define RUN(fn, name) dealloc_results(process_results(test_mach_with_allocated_purgeable_and_state(fn, name " (purgeable and state)")))
2091 RUN(call_vm_map_purgable_control__purgeable_state, "vm_map_purgable_control");
2092 #undef RUN
2093
2094 /*
2095 * -- region info functions --
2096 */
2097
2098 #define RUN(fn, name) dealloc_results(process_results(test_mach_with_allocated_addr(fn, name " (addr)")))
2099 RUN(call_mach_vm_region, "mach_vm_region");
2100 RUN(call_vm_region, "vm_region");
2101 #undef RUN
2102 #if XNU_PLATFORM_MacOSX
2103 #define RUN(fn, name) dealloc_results(process_results(test_mach_with_size(fn, name " (size)")))
2104 RUN(call_vm_region_object_create, "vm_region_object_create");
2105 #undef RUN
2106 #endif
2107
2108 /*
2109 * -- page info functions --
2110 */
2111
2112 #define RUN(fn, name) dealloc_results(process_results(test_mach_with_allocated_addr(fn, name " (addr)")))
2113 RUN(call_vm_map_page_info, "vm_map_page_info");
2114 #undef RUN
2115
2116 /*
2117 * -- miscellaneous functions --
2118 */
2119
2120 #if CONFIG_MAP_RANGES
2121 dealloc_results(process_results(test_mach_vm_range_create(call_mach_vm_range_create, "mach_vm_range_create (start/size/start2/size2)")));
2122 #endif
2123
2124 dealloc_results(process_results(test_kext_unix_with_allocated_vnode_addr(call_task_find_region_details, "task_find_region_details (addr)")));
2125
2126 dealloc_results(process_results(test_mach_with_allocated_start_size(test_mach_vm_deferred_reclamation_buffer_init, "mach_vm_deferred_reclamation_buffer_init (start/size)")));
2127
2128 *out_value = 1; // success
2129 done:
2130 SYSCTL_OUTPUT_BUF = 0;
2131 SYSCTL_OUTPUT_END = 0;
2132 return 0;
2133 }
2134
2135 SYSCTL_TEST_REGISTER(vm_parameter_validation_kern, vm_parameter_validation_kern_test);
2136