github.com/google/syzkaller@v0.0.0-20240517125934-c0f1611a36d6/sys/fuchsia/test/vmar (about)

     1  # TODO: This test assumes that the system page size is 4KiB (or a divisor of 4KiB), since
     2  # some arguments must be page-aligned, and some tests will fail if the page size is larger.
     3  
     4  r0 = syz_vmar_root_self()
     5  
     6  # Allocate a vmar with the ZX_VM_CAN_MAP_SPECIFIC permission.
     7  
     8  zx_vmar_allocate(r0, 0x40, 0x0, 0x2000, &AUTO=<r1=>0x0, &AUTO)
     9  
    10  # Create a vmo and map it into the vmar at a specific offset (of 0 bytes), then unmap the full subregion.
    11  
    12  zx_vmo_create(0x1000, 0x0, &AUTO=<r2=>0x0)
    13  zx_vmar_map(r1, 0x10, 0x0, r2, 0x0, 0x1000, &AUTO=<r3=>0x0)
    14  zx_vmar_unmap(r1, r3, 0x1000)
    15  
    16  # Attempting to map the same vmo should fail when the vmar offset + stated size is larger than the allocated vmar, or the vmar offset is not page-aligned.
    17  
    18  zx_vmar_map(r1, 0x10, 0x0, r2, 0x0, 0x3001, &AUTO=<r3=>0x0) # ZX_ERR_INVALID_ARGS
    19  zx_vmar_map(r1, 0x10, 0x2000, r2, 0x0, 0x1001, &AUTO=<r3=>0x0) # ZX_ERR_INVALID_ARGS
    20  zx_vmar_map(r1, 0x10, 0x100, r2, 0x0, 0x1000, &AUTO=<r3=>0x0) # ZX_ERR_INVALID_ARGS
    21  
    22  # Repeatedly map a vmo into the vmar with the ZX_VM_OFFSET_IS_UPPER_LIMIT option.
    23  # Mapping should succeed until the upper limit is reached.  
    24  
    25  zx_vmar_map(r1, 0x2000, 0x2000, r2, 0x0, 0x1000, &AUTO=<r5=>0x0)
    26  zx_vmar_map(r1, 0x2000, 0x2000, r2, 0x0, 0x1000, &AUTO=<r6=>0x0)
    27  zx_vmar_map(r1, 0x2000, 0x2000, r2, 0x0, 0x1000, &AUTO) # ZX_ERR_NO_RESOURCES
    28  
    29  # Destroy a vmar. Afterwards, uses of that vmar handle should fail.
    30  
    31  zx_vmar_destroy(r1)
    32  zx_vmar_unmap(r1, r5, 0x1000) # ZX_ERR_BAD_STATE
    33  zx_vmar_allocate(r1, 0x40, 0x0, 0x1000, &AUTO, &AUTO) # ZX_ERR_BAD_STATE
    34  
    35  # Allocate a vmar with the ZX_VM_CAN_MAP_READ and ZX_VM_CAN_MAP_WRITE permissions,
    36  # then map in a vmo with the ZX_VM_PERM_READ and ZX_VM_PERM_WRITE permissions.
    37  # Remove the write permission from the mapped region, leaving the read permission.
    38  # Restore the write permission to the mapped region.
    39  # Attempt to increase permissions to include ZX_VM_PERM_EXECUTE; this should fail.
    40  
    41  zx_vmar_allocate(r0, 0x180, 0x0, 0x3000, &AUTO=<r7=>0x0, &AUTO=<r8=>0x0)
    42  zx_vmar_map(r7, 0x3, 0x0, r2, 0x0, 0x1000, &AUTO=<r9=>0x0)
    43  zx_vmar_protect(r7, 0x1, r9, 0x1000)
    44  zx_vmar_protect(r7, 0x3, r9, 0x1000)
    45  zx_vmar_protect(r7, 0x7, r9, 0x1000) # ZX_ERR_ACCESS_DENIED
    46  zx_vmar_unmap(r7, r9, 0x1000)
    47  
    48  # Create a vmo and map it into a vmar, leaving part of the vmar unmapped.
    49  # Verify that a sequence of operations succeeds on the full mapped region and on a page-aligned subregion.
    50  # An operation on a range including an unmapped region should fail.
    51  
    52  zx_vmo_create(0x2000, 0x0, &AUTO=<r10=>0x0)
    53  zx_vmar_map(r7, 0x3, 0x0, r10, 0x0, 0x2000, &AUTO=<r11=>0x0)
    54  zx_vmar_op_range(r7, 0x1, r11, 0x2000, 0x0, 0x0)
    55  zx_vmar_op_range(r7, 0x2, r11, 0x1000, 0x0, 0x0)
    56  zx_vmar_op_range(r7, 0x3, r11, 0x2000, 0x0, 0x0)
    57  zx_vmar_op_range(r7, 0x3, r8, 0x3000, 0x0, 0x0) # ZX_ERR_BAD_STATE