fabi/Xenia-Canary
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[Audit] round 24: signal-path probes (XEvent::Set + IO + NtDuplicateObject)

Browse Source 
Adds AUDIT-HLC probes for every path that signals an XEvent or duplicates
its handle, so the round-23 puzzle (waits completing without visible
NtSetEvent/KeSetEvent) can be cross-referenced by underlying X_KEVENT VA
and by primary handle.

  * NtCreateEvent_inner: always log kevent_va for handle/VA cross-ref
  * XEvent::Set: universal hook prints primary handle + kevent_va + LR;
    catches all paths into the event regardless of shim used
  * NtSetEvent: extended with PPC back-chain walk for caller's guest_lr
    (same idiom as the wait probe), so the signaler function is
    immediately identifiable
  * NtReadFile / NtReadFileScatter / NtWriteFile: log when signal_event
    path fires ev->Set() inline at IO completion (bypasses both
    NtSetEvent and KeSetEvent shims)
  * CompleteOverlappedEx (kernel_state.cc): log when overlapped event
    is signaled at completion
  * NtDuplicateObject: log src/dst handle pair (round-24 confirmed silph
    event is dup'd before signaling, explaining the handle-mismatch
    puzzle between NtSetEvent's `handle=` argument and XEvent::Set's
    primary handle())

Result: silph wait at sub_821CB030+0x1B0 on handle F80000A0 is signaled
via NtSetEvent on handle F80000A8 (the duplicate created by sub_8245D9D8
at lr=0x82450DF4 inside the worker chain sub_82450A28 ← 0xA68 ← 0xB68).
Verdict A confirmed: signaler exists and is reachable, but round-17.β
missed it because the search keyed on the wrong handle. No bypass path;
the worker chain is identical between canary and ours-impl, but ours
signals different handles (work-item queue divergence at sub_82452DC0).

Audit-only diagnostic. No semantic changes. Net delta +86 LOC across 7
files. All probes gated on the existing audit_handle_lifecycle cvar
(default off). Tested via Sylpheed boot (35 s, 4 MB log). Audit-handle-
lifecycle-probes branch, local-only.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This commit is contained in:
MechaCat02
2026-06-08 21:09:40 +02:00
parent 4670afbeb5
commit 07f09f8fe0
7 changed files with 91 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

40
src/xenia/kernel/xboxkrnl/xboxkrnl_threading.cc
View File

@@ -712,11 +712,26 @@ dword_result_t NtCreateEvent_entry(
}
if (cvars::audit_handle_lifecycle) {
uint32_t lr = static_cast<uint32_t>(cpu::ThreadState::Get()->context()->lr);
uint32_t out_handle = handle_ptr ? uint32_t(*handle_ptr) : 0u;
XELOGKERNEL(
"AUDIT-HLC NtCreateEvent handle={:08X} type={} initial_state={} "
"lr={:08X}",
handle_ptr ? uint32_t(*handle_ptr) : 0u, uint32_t(event_type),
uint32_t(initial_state), lr);
out_handle, uint32_t(event_type), uint32_t(initial_state), lr);
// Round-24: also log the underlying X_KEVENT guest VA for every
// NtCreateEvent so KeSetEvent probes can be cross-referenced by ptr.
XELOGKERNEL(
"AUDIT-HLC NtCreateEvent_inner handle={:08X} kevent_va={:08X} "
"lr={:08X}",
out_handle, ev->guest_object(), lr);
// When caller pinned a target handle, additionally emit the legacy
// _target line so older round-24 grep recipes still match.
if (cvars::audit_track_event_handle != 0 &&
out_handle == cvars::audit_track_event_handle) {
XELOGKERNEL(
"AUDIT-HLC NtCreateEvent_target handle={:08X} object_va={:08X} "
"lr={:08X}",
out_handle, ev->guest_object(), lr);
}
}
return X_STATUS_SUCCESS;
}
@@ -744,9 +759,24 @@ uint32_t xeNtSetEvent(uint32_t handle, xe::be<uint32_t>* previous_state_ptr) {
dword_result_t NtSetEvent_entry(dword_t handle, lpdword_t previous_state_ptr) {
if (cvars::audit_handle_lifecycle) {
uint32_t lr = static_cast<uint32_t>(cpu::ThreadState::Get()->context()->lr);
XELOGKERNEL("AUDIT-HLC NtSetEvent handle={:08X} lr={:08X}",
uint32_t(handle), lr);
auto* ctx = cpu::ThreadState::Get()->context();
uint32_t lr = static_cast<uint32_t>(ctx->lr);
// Round-24: walk PPC back-chain for caller's guest LR (same idiom as
// NtWaitForSingleObjectEx probe).
uint32_t guest_lr = 0;
uint32_t sp = static_cast<uint32_t>(ctx->r[1]);
uint32_t back1 = xe::load_and_swap<uint32_t>(ctx->TranslateVirtual(sp));
if (back1) {
uint32_t back2 =
xe::load_and_swap<uint32_t>(ctx->TranslateVirtual(back1));
if (back2) {
guest_lr = xe::load_and_swap<uint32_t>(
ctx->TranslateVirtual(back2 - 8));
}
}
XELOGKERNEL(
"AUDIT-HLC NtSetEvent handle={:08X} lr={:08X} guest_lr={:08X}",
uint32_t(handle), lr, guest_lr);
}
return xeNtSetEvent(handle, previous_state_ptr);
}