macOS/HVF: anonymous guest RAM is counted twice in phys_footprint after host and guest access

// SPDX-License-Identifier: Apache-2.0
// Standalone Apple Silicon HVF accounting repro; no guest OS or VMM dependency.
#include <Hypervisor/Hypervisor.h>
#include <Hypervisor/hv_vm_allocate.h>
#include <inttypes.h>
#include <mach/mach.h>
#include <stdbool.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/mman.h>
#include <unistd.h>

#if !defined(__APPLE__) || !defined(__aarch64__)
#error "This repro requires macOS on Apple Silicon"
#endif

#define MIB (1024ULL * 1024ULL)
#define RAM_SIZE (256ULL * MIB)

static uint64_t baseline;

static void check(hv_return_t result, const char *operation) {
    if (result != HV_SUCCESS) {
        fprintf(stderr, "%s failed: 0x%x\n", operation, (unsigned)result);
        exit(1);
    }
}

static uint64_t sample(const char *phase) {
    task_vm_info_data_t info = {0};
    mach_msg_type_number_t count = TASK_VM_INFO_COUNT;
    kern_return_t result = task_info(mach_task_self(), TASK_VM_INFO,
                                    (task_info_t)&info, &count);
    if (result != KERN_SUCCESS) {
        fprintf(stderr, "task_info: %s\n", mach_error_string(result));
        exit(1);
    }
    if (phase != NULL) {
        printf("%-18s %14" PRIu64 " %12.2f %12.2f\n", phase,
               (uint64_t)info.phys_footprint,
               ((double)info.phys_footprint - (double)baseline) / MIB,
               (double)info.resident_size / MIB);
        fflush(stdout);
    }
    return info.phys_footprint;
}

static void run_guest(hv_vcpu_t cpu, hv_vcpu_exit_t *exit_info,
                      hv_ipa_t code_gpa, hv_ipa_t data_gpa, size_t page_size) {
    check(hv_vcpu_set_reg(cpu, HV_REG_PC, code_gpa), "set PC");
    check(hv_vcpu_set_reg(cpu, HV_REG_X0, data_gpa), "set X0");
    check(hv_vcpu_set_reg(cpu, HV_REG_X1, page_size), "set X1");
    check(hv_vcpu_set_reg(cpu, HV_REG_X2, RAM_SIZE / page_size), "set X2");
    check(hv_vcpu_run(cpu), "hv_vcpu_run");
    // HVC #0 from AArch64 has exception class 0x16.
    if (exit_info->reason != HV_EXIT_REASON_EXCEPTION ||
        (exit_info->exception.syndrome >> 26) != 0x16) {
        fprintf(stderr, "Unexpected guest exit: reason=%u syndrome=0x%" PRIx64 "\n",
                (unsigned)exit_info->reason,
                (uint64_t)exit_info->exception.syndrome);
        exit(1);
    }
}

int main(int argc, char **argv) {
    if (argc != 2 || (strcmp(argv[1], "mmap") && strcmp(argv[1], "hv"))) {
        fprintf(stderr, "Usage: %s mmap|hv\n", argv[0]);
        return 2;
    }
    alarm(60); // Bound the process lifetime even if guest execution misbehaves.
    const bool use_hv = strcmp(argv[1], "hv") == 0;
    const size_t page = (size_t)getpagesize();
    const size_t size = (size_t)RAM_SIZE + page; // One extra page holds guest code.
    const hv_ipa_t gpa = 0x40000000;
    void *allocation = NULL;

    printf("\nallocator=%s data_mib=256 code_bytes=%zu\n", argv[1], page);
    printf("%-18s %14s %12s %12s\n", "phase", "footprint_B", "delta_MiB", "resident_MiB");
    baseline = sample(NULL);
    sample("baseline");
    if (use_hv) {
        check(hv_vm_allocate(&allocation, size, HV_ALLOCATE_DEFAULT), "hv_vm_allocate");
    } else {
        allocation = mmap(NULL, size, PROT_READ | PROT_WRITE,
                          MAP_PRIVATE | MAP_ANON | MAP_NORESERVE, -1, 0);
        if (allocation == MAP_FAILED) {
            perror("mmap");
            return 1;
        }
    }

    const uint32_t code[] = {
        0xf9400003, // ldr x3, [x0]
        0x91000463, // add x3, x3, #1
        0xf9000003, // str x3, [x0]
        0x8b010000, // add x0, x0, x1
        0xf1000442, // subs x2, x2, #1
        0x54ffff61, // b.ne back to ldr
        0xd4000002, // hvc #0
    };
    memcpy(allocation, code, sizeof(code));
    uint8_t *data = (uint8_t *)allocation + page;
    for (size_t offset = 0; offset < RAM_SIZE; offset += page)
        *(volatile uint64_t *)(data + offset) = 41;
    sample("host-touched");

    check(hv_vm_create(NULL), "hv_vm_create");
    check(hv_vm_map(allocation, gpa, size,
                    HV_MEMORY_READ | HV_MEMORY_WRITE | HV_MEMORY_EXEC), "hv_vm_map");
    sample("mapped-only");
    hv_vcpu_t cpu;
    hv_vcpu_exit_t *exit_info;
    check(hv_vcpu_create(&cpu, &exit_info, NULL), "hv_vcpu_create");
    check(hv_vcpu_set_reg(cpu, HV_REG_CPSR, 0x3c5), "set CPSR");
    run_guest(cpu, exit_info, gpa, gpa + page, page);
    sample("guest-touched");

    // Confirm coherence, then repeat access to the same pages in both directions.
    for (size_t offset = 0; offset < RAM_SIZE; offset += page) {
        if (*(volatile uint64_t *)(data + offset) != 42) {
            fprintf(stderr, "Guest/host mismatch at byte %zu\n", offset);
            return 1;
        }
        *(volatile uint64_t *)(data + offset) = 43;
    }
    run_guest(cpu, exit_info, gpa, gpa + page, page);
    for (size_t offset = 0; offset < RAM_SIZE; offset += page) {
        if (*(volatile uint64_t *)(data + offset) != 44) {
            fprintf(stderr, "Second guest/host mismatch at byte %zu\n", offset);
            return 1;
        }
    }
    sample("guest-retouched");
    check(hv_vcpu_destroy(cpu), "hv_vcpu_destroy");
    check(hv_vm_unmap(gpa, size), "hv_vm_unmap");
    sample("guest-unmapped");
    check(hv_vm_destroy(), "hv_vm_destroy");
    if (use_hv) {
        check(hv_vm_deallocate(allocation, size), "hv_vm_deallocate");
    } else if (munmap(allocation, size) != 0) {
        perror("munmap");
        return 1;
    }
    sample("released");
    puts("Guest/host coherence and cleanup: PASS");
    return 0;
}

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>com.apple.security.hypervisor</key>
    <true/>
</dict>
</plist>