re: the heap ledger refutes my own leak hypothesis
Built the allocation ledger to test the leak I proposed this morning, and it
refutes it.
* No leak. The books balance: 379.5 MB live in 84 blocks plus 113.2 MB free
is 492.7 MB of the console's 512, with ~19 MB in allocation paths the filter
did not capture. Nothing is missing that a leak would explain.
* The 22 "leaked" releases are correct refusals. All 22 failing frees are
interior pointers into ONE allocation -- the 58.5 MB block at BC220000, at
offsets from 5 to 30 MB. The game sub-allocates out of a physical pool and
frees the sub-blocks. BaseHeap::Release frees whole regions, so honouring
an interior pointer would free 58.5 MB, twenty-two times over. The fix I
was moving toward would have been a catastrophe.
* Rounding is not it either: 480.67 MB requested against 484.50 MB granted is
3.83 MB (0.8%), versus a 14.84 MB shortfall.
What actually happens is a doubling grow that holds both buffers: allocate 32 MB,
free the previous, allocate 64 MB, free the 32, then ask for 128 MB while still
holding the 64. That needs 192 MB live for one buffer on top of ~315 MB held
elsewhere, and comes up 14.84 MB short.
No configuration fixes it. There is no guest memory-size cvar; the 512 MB is
baked into the address map rather than a constant (the aliases at 0xA0000000 and
0xC0000000 are spaced exactly 0x20000000 apart, so growing the heap runs one
window into the next); and this tree has no eh_dispatch cvar, so
RtlRaiseException routes the guest's OOM throw to HandleCppException, which logs
and returns without unwinding. That fall-through is the freeze.
Also worth recording: log_mask DISABLES categories (Kernel=1, Apu=2, Cpu=4,
Gpu=8), so the --log_mask=13 used throughout this corpus has been running with
the kernel log switched off.
The oracle is NOT fixed. Ledger committed as data/heap-ledger-stage01.txt.
This commit is contained in:
Sylpheed RE agent
354
docs/re/data/heap-ledger-stage01.txt
Normal file
354
docs/re/data/heap-ledger-stage01.txt
Normal file
@@ -0,0 +1,354 @@
|
||||
F 82000890 8284DD3C 0BD ( 189) MmFreePhysicalMemory
|
||||
F 82000894 8284DD2C 0BA ( 186) MmAllocatePhysicalMemoryEx
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 03A723D0, 20000004, 00000000, FFFFFFFF, 00000000)
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx = BC220000 Size: 03A80000
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 000778F0, 20000404, 00000000, FFFFFFFF, 00000000)
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx = BC1A0000 Size: 00080000
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 070D28B0, 20000404, 00000000, FFFFFFFF, 00000000)
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx = B50C0000 Size: 070E0000
|
||||
d> F800002C MmFreePhysicalMemory(00000000, BE078D80)
|
||||
!> F800002C BaseHeap::Release failed because address is not a region start
|
||||
!> F800002C PhysicalHeap::Release failed due to parent heap failure
|
||||
d> F8000044 MmFreePhysicalMemory(00000000, BDB18CC0)
|
||||
!> F8000044 BaseHeap::Release failed because address is not a region start
|
||||
!> F8000044 PhysicalHeap::Release failed due to parent heap failure
|
||||
d> F800002C MmFreePhysicalMemory(00000000, BCA44980)
|
||||
!> F800002C BaseHeap::Release failed because address is not a region start
|
||||
!> F800002C PhysicalHeap::Release failed due to parent heap failure
|
||||
d> F800002C MmFreePhysicalMemory(00000000, BCD24A00)
|
||||
!> F800002C BaseHeap::Release failed because address is not a region start
|
||||
!> F800002C PhysicalHeap::Release failed due to parent heap failure
|
||||
d> F800002C MmFreePhysicalMemory(00000000, BCE24A40)
|
||||
!> F800002C BaseHeap::Release failed because address is not a region start
|
||||
!> F800002C PhysicalHeap::Release failed due to parent heap failure
|
||||
d> F800002C MmFreePhysicalMemory(00000000, BD17CAC0)
|
||||
!> F800002C BaseHeap::Release failed because address is not a region start
|
||||
!> F800002C PhysicalHeap::Release failed due to parent heap failure
|
||||
d> F800002C MmFreePhysicalMemory(00000000, BD8E0C00)
|
||||
!> F800002C BaseHeap::Release failed because address is not a region start
|
||||
!> F800002C PhysicalHeap::Release failed due to parent heap failure
|
||||
d> F800002C MmFreePhysicalMemory(00000000, BDA60C40)
|
||||
!> F800002C BaseHeap::Release failed because address is not a region start
|
||||
!> F800002C PhysicalHeap::Release failed due to parent heap failure
|
||||
d> F8000008 MmFreePhysicalMemory(00000000, BC79C900)
|
||||
!> F8000008 BaseHeap::Release failed because address is not a region start
|
||||
!> F8000008 PhysicalHeap::Release failed due to parent heap failure
|
||||
d> F800002C MmFreePhysicalMemory(00000000, BDFB8D40)
|
||||
!> F800002C BaseHeap::Release failed because address is not a region start
|
||||
!> F800002C PhysicalHeap::Release failed due to parent heap failure
|
||||
d> F8000008 MmFreePhysicalMemory(00000000, BD07CA80)
|
||||
!> F8000008 BaseHeap::Release failed because address is not a region start
|
||||
!> F8000008 PhysicalHeap::Release failed due to parent heap failure
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 0000801F, 20000404, 00000000, FFFFFFFF, 00000000)
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx = B50B0000 Size: 00010000
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 00400000, 20000404, 00000000, FFFFFFFF, 00000080)
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx = B4CB0000 Size: 00400000
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 00000020, 00000204, 00000000, FFFFFFFF, 00000020)
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx = FFCA8000 Size: 00001000
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 00398FFF, 20000404, 00000000, FFFFFFFF, 00000000)
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx = B4910000 Size: 003A0000
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 00398FFF, 20000404, 00000000, FFFFFFFF, 00000000)
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx = B4570000 Size: 003A0000
|
||||
d> F8000008 MmFreePhysicalMemory(00000001, B4560000)
|
||||
d> F8000044 MmFreePhysicalMemory(00000000, BED2A080)
|
||||
!> F8000044 BaseHeap::Release failed because address is not a region start
|
||||
!> F8000044 PhysicalHeap::Release failed due to parent heap failure
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 000DF288, 20000004, 00000000, FFFFFFFF, 00000000)
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx = B4490000 Size: 000E0000
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 00F4F80F, 20000004, 00000000, FFFFFFFF, 00000000)
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx = B3540000 Size: 00F50000
|
||||
d> F8000044 MmFreePhysicalMemory(00000000, BF26A0C0)
|
||||
!> F8000044 BaseHeap::Release failed because address is not a region start
|
||||
!> F8000044 PhysicalHeap::Release failed due to parent heap failure
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 0088E80F, 20000004, 00000000, FFFFFFFF, 00000000)
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx = B2CB0000 Size: 00890000
|
||||
d> F8000044 MmFreePhysicalMemory(00000000, BE94CF80)
|
||||
!> F8000044 BaseHeap::Release failed because address is not a region start
|
||||
!> F8000044 PhysicalHeap::Release failed due to parent heap failure
|
||||
d> F8000044 MmFreePhysicalMemory(00000000, BF36A100)
|
||||
!> F8000044 BaseHeap::Release failed because address is not a region start
|
||||
!> F8000044 PhysicalHeap::Release failed due to parent heap failure
|
||||
d> F8000044 MmAllocatePhysicalMemoryEx(00000000, 00298810, 20000004, 00000000, FFFFFFFF, 00000000)
|
||||
d> F8000044 MmAllocatePhysicalMemoryEx = B2A10000 Size: 002A0000
|
||||
d> F8000044 MmAllocatePhysicalMemoryEx(00000000, 00298658, 20000004, 00000000, FFFFFFFF, 00000000)
|
||||
d> F8000044 MmAllocatePhysicalMemoryEx = B2770000 Size: 002A0000
|
||||
d> F8000044 MmFreePhysicalMemory(00000000, B2770000)
|
||||
d> F8000044 MmFreePhysicalMemory(00000000, BE88CF40)
|
||||
!> F8000044 BaseHeap::Release failed because address is not a region start
|
||||
!> F8000044 PhysicalHeap::Release failed due to parent heap failure
|
||||
d> F8000044 MmAllocatePhysicalMemoryEx(00000000, 00155810, 20000004, 00000000, FFFFFFFF, 00000000)
|
||||
d> F8000044 MmAllocatePhysicalMemoryEx = B28B0000 Size: 00160000
|
||||
d> F8000094 MmAllocatePhysicalMemoryEx(00000000, 001BF800, 20000004, 00000000, FFFFFFFF, 00000000)
|
||||
d> F8000094 MmAllocatePhysicalMemoryEx = B26F0000 Size: 001C0000
|
||||
d> F8000044 MmAllocatePhysicalMemoryEx(00000000, 00155531, 20000004, 00000000, FFFFFFFF, 00000000)
|
||||
d> F8000044 MmAllocatePhysicalMemoryEx = B2590000 Size: 00160000
|
||||
d> F8000044 MmFreePhysicalMemory(00000000, B2590000)
|
||||
d> F8000044 MmFreePhysicalMemory(00000000, BEA7A040)
|
||||
!> F8000044 BaseHeap::Release failed because address is not a region start
|
||||
!> F8000044 PhysicalHeap::Release failed due to parent heap failure
|
||||
d> F8000094 MmAllocatePhysicalMemoryEx(00000000, 00629000, 20000004, 00000000, FFFFFFFF, 00000000)
|
||||
d> F8000094 MmAllocatePhysicalMemoryEx = B20C0000 Size: 00630000
|
||||
d> F8000094 MmAllocatePhysicalMemoryEx(00000000, 0004CFFF, 20000404, 00000000, FFFFFFFF, 00000000)
|
||||
d> F8000094 MmAllocatePhysicalMemoryEx = B2070000 Size: 00050000
|
||||
d> F8000044 MmFreePhysicalMemory(00000000, BE4E8E40)
|
||||
!> F8000044 BaseHeap::Release failed because address is not a region start
|
||||
!> F8000044 PhysicalHeap::Release failed due to parent heap failure
|
||||
d> F8000044 MmFreePhysicalMemory(00000000, BE378DC0)
|
||||
!> F8000044 BaseHeap::Release failed because address is not a region start
|
||||
!> F8000044 PhysicalHeap::Release failed due to parent heap failure
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 000681F9, 20000004, 00000000, FFFFFFFF, 00000000)
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx = B2000000 Size: 00070000
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 003C0FFF, 20000404, 00000000, FFFFFFFF, 00000000)
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx = B1C30000 Size: 003D0000
|
||||
d> F8000008 MmFreePhysicalMemory(00000000, B2000000)
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 000F40EB, 20000004, 00000000, FFFFFFFF, 00000000)
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx = B1B30000 Size: 00100000
|
||||
d> F8000008 MmFreePhysicalMemory(00000000, B1B30000)
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 00100000, 20000004, 00000000, FFFFFFFF, 00000000)
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx = B1B30000 Size: 00100000
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 00100000, 20000004, 00000000, FFFFFFFF, 00000000)
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx = B1A30000 Size: 00100000
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 000A8C00, 20000004, 00000000, FFFFFFFF, 00000000)
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx = B1980000 Size: 000B0000
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 0002E820, 20000004, 00000000, FFFFFFFF, 00000000)
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx = B2040000 Size: 00030000
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 000E1FFF, 20000404, 00000000, FFFFFFFF, 00000000)
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx = B1890000 Size: 000F0000
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 000447FF, 20000404, 00000000, FFFFFFFF, 00000000)
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx = B1840000 Size: 00050000
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 000447FF, 20000404, 00000000, FFFFFFFF, 00000000)
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx = B17F0000 Size: 00050000
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 000E1FFF, 20000404, 00000000, FFFFFFFF, 00000000)
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx = B1700000 Size: 000F0000
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 000447FF, 20000404, 00000000, FFFFFFFF, 00000000)
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx = B16B0000 Size: 00050000
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 000447FF, 20000404, 00000000, FFFFFFFF, 00000000)
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx = B1660000 Size: 00050000
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 000E1FFF, 20000404, 00000000, FFFFFFFF, 00000000)
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx = B1570000 Size: 000F0000
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 000447FF, 20000404, 00000000, FFFFFFFF, 00000000)
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx = B1520000 Size: 00050000
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 000447FF, 20000404, 00000000, FFFFFFFF, 00000000)
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx = B14D0000 Size: 00050000
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 00697828, 20000004, 00000000, FFFFFFFF, 00000000)
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx = B0E30000 Size: 006A0000
|
||||
d> F8000154 MmAllocatePhysicalMemoryEx(00000000, 00080020, 20000004, 00000000, FFFFFFFF, 00000000)
|
||||
d> F8000154 MmAllocatePhysicalMemoryEx = B0DA0000 Size: 00090000
|
||||
d> F8000154 MmAllocatePhysicalMemoryEx(00000000, 00080020, 20000004, 00000000, FFFFFFFF, 00000000)
|
||||
d> F8000154 MmAllocatePhysicalMemoryEx = B0D10000 Size: 00090000
|
||||
d> F8000154 MmAllocatePhysicalMemoryEx(00000000, 00080020, 20000004, 00000000, FFFFFFFF, 00000000)
|
||||
d> F8000154 MmAllocatePhysicalMemoryEx = B0C80000 Size: 00090000
|
||||
d> F8000154 MmAllocatePhysicalMemoryEx(00000000, 00080020, 20000004, 00000000, FFFFFFFF, 00000000)
|
||||
d> F8000154 MmAllocatePhysicalMemoryEx = B0BF0000 Size: 00090000
|
||||
d> F8000154 MmAllocatePhysicalMemoryEx(00000000, 00080020, 20000004, 00000000, FFFFFFFF, 00000000)
|
||||
d> F8000154 MmAllocatePhysicalMemoryEx = B0B60000 Size: 00090000
|
||||
d> F8000154 MmAllocatePhysicalMemoryEx(00000000, 00080020, 20000004, 00000000, FFFFFFFF, 00000000)
|
||||
d> F8000154 MmAllocatePhysicalMemoryEx = B0AD0000 Size: 00090000
|
||||
d> F8000154 MmAllocatePhysicalMemoryEx(00000000, 00080020, 20000004, 00000000, FFFFFFFF, 00000000)
|
||||
d> F8000154 MmAllocatePhysicalMemoryEx = B0A40000 Size: 00090000
|
||||
d> F8000154 MmAllocatePhysicalMemoryEx(00000000, 00080020, 20000004, 00000000, FFFFFFFF, 00000000)
|
||||
d> F8000154 MmAllocatePhysicalMemoryEx = B09B0000 Size: 00090000
|
||||
d> F8000008 MmFreePhysicalMemory(00000000, B0E30000)
|
||||
d> F8000008 MmFreePhysicalMemory(00000000, B1B30000)
|
||||
d> F8000008 MmFreePhysicalMemory(00000000, B2040000)
|
||||
d> F8000008 MmFreePhysicalMemory(00000000, B1980000)
|
||||
d> F8000008 MmFreePhysicalMemory(00000000, B0C80000)
|
||||
d> F8000008 MmFreePhysicalMemory(00000000, B0D10000)
|
||||
d> F8000008 MmFreePhysicalMemory(00000000, B09B0000)
|
||||
d> F8000008 MmFreePhysicalMemory(00000000, B0AD0000)
|
||||
d> F8000008 MmFreePhysicalMemory(00000000, B0A40000)
|
||||
d> F8000008 MmFreePhysicalMemory(00000000, B0DA0000)
|
||||
d> F8000008 MmFreePhysicalMemory(00000000, B0B60000)
|
||||
d> F8000008 MmFreePhysicalMemory(00000000, B0BF0000)
|
||||
d> F8000008 MmFreePhysicalMemory(00000000, B1A30000)
|
||||
d> F8000008 MmFreePhysicalMemory(00000000, B1890000)
|
||||
d> F8000008 MmFreePhysicalMemory(00000000, B1840000)
|
||||
d> F8000008 MmFreePhysicalMemory(00000000, B17F0000)
|
||||
d> F8000008 MmFreePhysicalMemory(00000000, B1700000)
|
||||
d> F8000008 MmFreePhysicalMemory(00000000, B16B0000)
|
||||
d> F8000008 MmFreePhysicalMemory(00000000, B1660000)
|
||||
d> F8000008 MmFreePhysicalMemory(00000000, B1570000)
|
||||
d> F8000008 MmFreePhysicalMemory(00000000, B1520000)
|
||||
d> F8000008 MmFreePhysicalMemory(00000000, B14D0000)
|
||||
d> F8000008 MmFreePhysicalMemory(00000000, BE4B0E00)
|
||||
!> F8000008 BaseHeap::Release failed because address is not a region start
|
||||
!> F8000008 PhysicalHeap::Release failed due to parent heap failure
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 007D0FFF, 20000404, 00000000, FFFFFFFF, 00000000)
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx = B1450000 Size: 007E0000
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 003E8FFF, 20000404, 00000000, FFFFFFFF, 00000000)
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx = B1060000 Size: 003F0000
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 003E8FFF, 20000404, 00000000, FFFFFFFF, 00000000)
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx = B0C70000 Size: 003F0000
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 002F8008, 20000004, 00000000, FFFFFFFF, 00000000)
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx = B0970000 Size: 00300000
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 00100000, 20000004, 00000000, FFFFFFFF, 00000000)
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx = B0870000 Size: 00100000
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 00140000, 20000004, 00000000, FFFFFFFF, 00000000)
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx = B0730000 Size: 00140000
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 00108010, 20000004, 00000000, FFFFFFFF, 00000000)
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx = B0620000 Size: 00110000
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 00080010, 20000004, 00000000, FFFFFFFF, 00000000)
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx = B0590000 Size: 00090000
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 00108010, 20000004, 00000000, FFFFFFFF, 00000000)
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx = B0480000 Size: 00110000
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 00080010, 20000004, 00000000, FFFFFFFF, 00000000)
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx = B03F0000 Size: 00090000
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 00108010, 20000004, 00000000, FFFFFFFF, 00000000)
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx = B02E0000 Size: 00110000
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 00080010, 20000004, 00000000, FFFFFFFF, 00000000)
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx = B0250000 Size: 00090000
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 00108010, 20000004, 00000000, FFFFFFFF, 00000000)
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx = B0140000 Size: 00110000
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 00080010, 20000004, 00000000, FFFFFFFF, 00000000)
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx = B00B0000 Size: 00090000
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 002F8008, 20000004, 00000000, FFFFFFFF, 00000000)
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx = AFDB0000 Size: 00300000
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 00100000, 20000004, 00000000, FFFFFFFF, 00000000)
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx = AFCB0000 Size: 00100000
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 00140000, 20000004, 00000000, FFFFFFFF, 00000000)
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx = AFB70000 Size: 00140000
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 00108010, 20000004, 00000000, FFFFFFFF, 00000000)
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx = AFA60000 Size: 00110000
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 00080010, 20000004, 00000000, FFFFFFFF, 00000000)
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx = AF9D0000 Size: 00090000
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 00108010, 20000004, 00000000, FFFFFFFF, 00000000)
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx = AF8C0000 Size: 00110000
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 00080010, 20000004, 00000000, FFFFFFFF, 00000000)
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx = AF830000 Size: 00090000
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 00108010, 20000004, 00000000, FFFFFFFF, 00000000)
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx = AF720000 Size: 00110000
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 00080010, 20000004, 00000000, FFFFFFFF, 00000000)
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx = AF690000 Size: 00090000
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 00108010, 20000004, 00000000, FFFFFFFF, 00000000)
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx = AF580000 Size: 00110000
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 00080010, 20000004, 00000000, FFFFFFFF, 00000000)
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx = AF4F0000 Size: 00090000
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 002F8008, 20000004, 00000000, FFFFFFFF, 00000000)
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx = AF1F0000 Size: 00300000
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 00100000, 20000004, 00000000, FFFFFFFF, 00000000)
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx = AF0F0000 Size: 00100000
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 00140000, 20000004, 00000000, FFFFFFFF, 00000000)
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx = AEFB0000 Size: 00140000
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 00108010, 20000004, 00000000, FFFFFFFF, 00000000)
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx = AEEA0000 Size: 00110000
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 00080010, 20000004, 00000000, FFFFFFFF, 00000000)
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx = AEE10000 Size: 00090000
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 00108010, 20000004, 00000000, FFFFFFFF, 00000000)
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx = AED00000 Size: 00110000
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 00080010, 20000004, 00000000, FFFFFFFF, 00000000)
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx = AEC70000 Size: 00090000
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 00108010, 20000004, 00000000, FFFFFFFF, 00000000)
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx = AEB60000 Size: 00110000
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 00080010, 20000004, 00000000, FFFFFFFF, 00000000)
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx = AEAD0000 Size: 00090000
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 00108010, 20000004, 00000000, FFFFFFFF, 00000000)
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx = AE9C0000 Size: 00110000
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 00080010, 20000004, 00000000, FFFFFFFF, 00000000)
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx = AE930000 Size: 00090000
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 003E8FFF, 20000404, 00000000, FFFFFFFF, 00000000)
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx = AE540000 Size: 003F0000
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 00046FFF, 20000404, 00000000, FFFFFFFF, 00000000)
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx = B2020000 Size: 00050000
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 00730FFF, 20000404, 00000000, FFFFFFFF, 00000000)
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx = ADE00000 Size: 00740000
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 00078FFF, 20000404, 00000000, FFFFFFFF, 00000000)
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx = ADD80000 Size: 00080000
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 00730FFF, 20000404, 00000000, FFFFFFFF, 00000000)
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx = AD640000 Size: 00740000
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 00398FFF, 20000404, 00000000, FFFFFFFF, 00000000)
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx = AD2A0000 Size: 003A0000
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 00078FFF, 20000404, 00000000, FFFFFFFF, 00000000)
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx = AD220000 Size: 00080000
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 00004FFF, 20000404, 00000000, FFFFFFFF, 00000000)
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx = B2010000 Size: 00010000
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 00042FFF, 20000404, 00000000, FFFFFFFF, 00000000)
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx = AD1D0000 Size: 00050000
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 00042FFF, 20000404, 00000000, FFFFFFFF, 00000000)
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx = AD180000 Size: 00050000
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 00042FFF, 20000404, 00000000, FFFFFFFF, 00000000)
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx = AD130000 Size: 00050000
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 0000FFFF, 20000404, 00000000, FFFFFFFF, 00000000)
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx = B2000000 Size: 00010000
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 0000FFFF, 20000404, 00000000, FFFFFFFF, 00000000)
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx = AD120000 Size: 00010000
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 0003CFFF, 20000404, 00000000, FFFFFFFF, 00000000)
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx = AD0E0000 Size: 00040000
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 0003CFFF, 20000404, 00000000, FFFFFFFF, 00000000)
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx = AD0A0000 Size: 00040000
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 0003CFFF, 20000404, 00000000, FFFFFFFF, 00000000)
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx = AD060000 Size: 00040000
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 0003CFFF, 20000404, 00000000, FFFFFFFF, 00000000)
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx = AD020000 Size: 00040000
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 0003CFFF, 20000404, 00000000, FFFFFFFF, 00000000)
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx = ACFE0000 Size: 00040000
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 0003CFFF, 20000404, 00000000, FFFFFFFF, 00000000)
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx = ACFA0000 Size: 00040000
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 0003CFFF, 20000404, 00000000, FFFFFFFF, 00000000)
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx = ACF60000 Size: 00040000
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 0003CFFF, 20000404, 00000000, FFFFFFFF, 00000000)
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx = ACF20000 Size: 00040000
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 0003CFFF, 20000404, 00000000, FFFFFFFF, 00000000)
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx = ACEE0000 Size: 00040000
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 0003CFFF, 20000404, 00000000, FFFFFFFF, 00000000)
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx = ACEA0000 Size: 00040000
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 0003CFFF, 20000404, 00000000, FFFFFFFF, 00000000)
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx = ACE60000 Size: 00040000
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 0003CFFF, 20000404, 00000000, FFFFFFFF, 00000000)
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx = ACE20000 Size: 00040000
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 00100000, 20000004, 00000000, FFFFFFFF, 00000000)
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx = ACD20000 Size: 00100000
|
||||
d> F8000008 MmFreePhysicalMemory(00000000, ACD20000)
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 00100000, 20000004, 00000000, FFFFFFFF, 00000000)
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx = ACD20000 Size: 00100000
|
||||
d> F8000008 MmFreePhysicalMemory(00000000, ACD20000)
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 00040FFF, 20000404, 00000000, FFFFFFFF, 00000000)
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx = ACDD0000 Size: 00050000
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 0000CFFF, 20000404, 00000000, FFFFFFFF, 00000000)
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx = ACDC0000 Size: 00010000
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 00100000, 20000004, 00000000, FFFFFFFF, 00000000)
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx = ACCC0000 Size: 00100000
|
||||
d> F8000008 MmFreePhysicalMemory(00000000, ACCC0000)
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 00BB5B9A, 20000004, 00000000, FFFFFFFF, 00000000)
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx = AC200000 Size: 00BC0000
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 003C0FFF, 20000404, 00000000, FFFFFFFF, 00000000)
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx = ABE30000 Size: 003D0000
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 003C0FFF, 20000404, 00000000, FFFFFFFF, 00000000)
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx = ABA60000 Size: 003D0000
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 003C0FFF, 20000404, 00000000, FFFFFFFF, 00000000)
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx = AB690000 Size: 003D0000
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 003C0FFF, 20000404, 00000000, FFFFFFFF, 00000000)
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx = AB2C0000 Size: 003D0000
|
||||
d> F8000008 MmFreePhysicalMemory(00000000, AC200000)
|
||||
d> F8000008 MmFreePhysicalMemory(00000000, B2A10000)
|
||||
d> F8000008 MmFreePhysicalMemory(00000000, BE7A8F00)
|
||||
!> F8000008 BaseHeap::Release failed because address is not a region start
|
||||
!> F8000008 PhysicalHeap::Release failed due to parent heap failure
|
||||
d> F8000008 MmFreePhysicalMemory(00000000, BDA98C80)
|
||||
!> F8000008 BaseHeap::Release failed because address is not a region start
|
||||
!> F8000008 PhysicalHeap::Release failed due to parent heap failure
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 00080000, 20000004, 00000000, FFFFFFFF, 00000000)
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx = B2C30000 Size: 00080000
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 00100000, 20000004, 00000000, FFFFFFFF, 00000000)
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx = B2B30000 Size: 00100000
|
||||
d> F8000008 MmFreePhysicalMemory(00000000, B2C30000)
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 00200000, 20000004, 00000000, FFFFFFFF, 00000000)
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx = ACBC0000 Size: 00200000
|
||||
d> F8000008 MmFreePhysicalMemory(00000000, B2B30000)
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 00400000, 20000004, 00000000, FFFFFFFF, 00000000)
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx = AC7C0000 Size: 00400000
|
||||
d> F8000008 MmFreePhysicalMemory(00000000, ACBC0000)
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 00800000, 20000004, 00000000, FFFFFFFF, 00000000)
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx = AAAC0000 Size: 00800000
|
||||
d> F8000008 MmFreePhysicalMemory(00000000, AC7C0000)
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 01000000, 20000004, 00000000, FFFFFFFF, 00000000)
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx = A9AC0000 Size: 01000000
|
||||
d> F8000008 MmFreePhysicalMemory(00000000, AAAC0000)
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 02000000, 20000004, 00000000, FFFFFFFF, 00000000)
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx = A7AC0000 Size: 02000000
|
||||
d> F8000008 MmFreePhysicalMemory(00000000, A9AC0000)
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 04000000, 20000004, 00000000, FFFFFFFF, 00000000)
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx = A3AC0000 Size: 04000000
|
||||
d> F8000008 MmFreePhysicalMemory(00000000, A7AC0000)
|
||||
d> F8000008 MmAllocatePhysicalMemoryEx(00000000, 08000000, 20000004, 00000000, FFFFFFFF, 00000000)
|
||||
!> F8000008 PhysicalHeap::AllocRange unable to alloc physical memory in parent heap (requested 134217728 bytes, parent free 28969/131072 pages)
|
||||
w> F8000008 MmAllocatePhysicalMemoryEx: Allocation failed: 00000000 Size: 08000000
|
||||
@@ -218,3 +218,95 @@ failed releases.
|
||||
region start` says the guest is freeing something at an address Xenia's heap does
|
||||
not recognise as a region base, which is an **emulator-side** bug rather than a
|
||||
game one.
|
||||
|
||||
---
|
||||
|
||||
# The allocation ledger — and 🔴 my leak hypothesis is wrong
|
||||
|
||||
**2026-08-26, same day.** The section above proposed that failed releases leak
|
||||
guest pages and drain the console. I built the ledger to test it, and **it
|
||||
refutes that**.
|
||||
|
||||
`--log_level=3 --log_mask=0` makes `MmAllocatePhysicalMemoryEx` log its request,
|
||||
its granted base and its rounded size, and puts `MmFreePhysicalMemory` in the
|
||||
export trace, so allocations can be matched to frees. (`log_mask` **disables**
|
||||
categories — Kernel=1, Apu=2, Cpu=4, Gpu=8 — so the `--log_mask=13` used
|
||||
everywhere in this corpus had the kernel log switched **off**.) Raw ledger:
|
||||
[`data/heap-ledger-stage01.txt`](data/heap-ledger-stage01.txt).
|
||||
|
||||
## 🔴 There is no leak — the books balance
|
||||
|
||||
| | |
|
||||
|---|---|
|
||||
| live guest physical allocations at the failure | **379.5 MB** in 84 blocks |
|
||||
| free, per the failing allocator | **113.2 MB** |
|
||||
| sum | **492.7 MB** of the console's 512 MB |
|
||||
|
||||
The ~19 MB remainder is allocation paths this filter did not capture (image,
|
||||
stacks, kernel structures). Nothing is missing that a leak would explain.
|
||||
|
||||
## 🔴 And the 22 "leaked" releases are correct refusals
|
||||
|
||||
Every one of the 22 failing frees is an **interior pointer into the same
|
||||
allocation** — the 58.5 MB block at `BC220000`:
|
||||
|
||||
| freed at | region base | region size | offset into region |
|
||||
|---|---|---|---|
|
||||
| `BE078D80` | `BC220000` | 58.50 MB | 30.35 MB |
|
||||
| `BDB18CC0` | `BC220000` | 58.50 MB | 24.97 MB |
|
||||
| `BCA44980` | `BC220000` | 58.50 MB | 8.14 MB |
|
||||
| … | | | |
|
||||
|
||||
**22 of 22 fall inside a known allocation, all in that one block.** So the game
|
||||
sub-allocates out of one big physical pool and calls `MmFreePhysicalMemory` on
|
||||
the sub-blocks. Xenia is **right** to refuse them: `BaseHeap::Release` frees a
|
||||
whole region, so honouring an interior pointer would free 58.5 MB — and would do
|
||||
it twenty-two times. My proposed "fix" would have been a catastrophe.
|
||||
|
||||
## 🔴 Rounding is not it either
|
||||
|
||||
Requested `480.67 MB`, granted `484.50 MB` — **3.83 MB (0.80 %)** of 64 KB-page
|
||||
rounding, against a shortfall of **14.84 MB**. Not the cause.
|
||||
|
||||
## ✅ What actually happens: a doubling grow that holds both buffers
|
||||
|
||||
The last six ledger lines before the freeze:
|
||||
|
||||
= A7AC0000 Size: 02000000 allocate 32 MB
|
||||
MmFreePhysicalMemory(A9AC0000) free the previous buffer
|
||||
= A3AC0000 Size: 04000000 allocate 64 MB
|
||||
MmFreePhysicalMemory(A7AC0000) free the 32 MB
|
||||
MmAllocatePhysicalMemoryEx(08000000) ask for 128 MB -> FAILS
|
||||
|
||||
The game grows a buffer by doubling and allocates the **new** block before
|
||||
freeing the old, so the 128 MB step needs `64 + 128 = 192 MB` live at once for
|
||||
that buffer alone, on top of ~315 MB held elsewhere. It comes up **14.84 MB**
|
||||
short.
|
||||
|
||||
## 🔴 And there is no configuration that fixes it
|
||||
|
||||
* **No guest memory-size cvar.** `memory.cc` has only `protect_zero`,
|
||||
`protect_on_release`, `scribble_heap` and the MMIO ones.
|
||||
* **The 512 MB is baked into the address map, not a constant.** The parent heap
|
||||
is `Initialize(..., 0x00000000, 0x20000000, 4096)` and its aliases sit at
|
||||
`0xA0000000` and `0xC0000000` — spaced **exactly** `0x20000000` apart. Growing
|
||||
the heap would run the `0xA0000000` window straight into `0xC0000000`. It is
|
||||
not a one-line change.
|
||||
* **No `eh_dispatch` cvar in this tree.** `title-crash-stl-tree.md` mentions one;
|
||||
this build has none. `RtlRaiseException_entry` routes `0xE06D7363` to
|
||||
`HandleCppException`, which **logs and returns** — so the guest's
|
||||
out-of-memory throw does not unwind, execution falls through into code that
|
||||
assumed it would not run, and the guest spins. That is the freeze.
|
||||
|
||||
## ❔ So the oracle is still broken, and here is what is left
|
||||
|
||||
Not fixed. The remaining candidates, in the order I would try them:
|
||||
|
||||
1. **Find the ~19 MB the ledger does not see.** If some of it is emulator-side
|
||||
rather than guest-side, recovering 15 MB of it clears the shortfall exactly.
|
||||
Log `NtAllocateVirtualMemory` and the image load as well.
|
||||
2. **Make the throw unwind.** Implementing guest EH dispatch would let the game
|
||||
handle its own allocation failure — it evidently expects to, or it would not
|
||||
be probing sizes by doubling.
|
||||
3. **Reach flight another way.** The tutorial loads less; two attempts timed out
|
||||
before reaching it, and that is unfinished rather than refuted.
|
||||
|
||||
Reference in New Issue
Block a user