fabi/Xenia-Canary
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Proper misalignment for AllocatePool, add guest object table

Browse Source
This commit is contained in:
disjtqz
2023-10-14 09:08:02 -04:00
committed by Radosław Gliński
parent ee424ae14a
commit 6a08208dc8
11 changed files with 513 additions and 45 deletions
Download Patch File Download Diff File Expand all files Collapse all files

262
src/xenia/kernel/util/guest_object_table.cc Normal file
View File

@@ -0,0 +1,262 @@
/**
******************************************************************************
* Xenia : Xbox 360 Emulator Research Project *
******************************************************************************
* Copyright 2023 Xenia Canary. All rights reserved. *
* Released under the BSD license - see LICENSE in the root for more details. *
******************************************************************************
*/
#include "xenia/kernel/util/guest_object_table.h"
#include "xenia/base/atomic.h"
#include "xenia/cpu/processor.h"
#include "xenia/kernel/xboxkrnl/xboxkrnl_memory.h"
#include "xenia/kernel/xboxkrnl/xboxkrnl_threading.h"
namespace xe {
namespace kernel {
namespace util {
static constexpr uint32_t NUM_HANDLES_PER_BUCKET = 64;
static constexpr uint32_t SIZE_PER_HANDLE_BUCKET =
sizeof(guest_handle_t) * NUM_HANDLES_PER_BUCKET;
// every time we need to reallocate the list of buckets, we allocate an
// additional BUCKET_SLOT_GROWTH slots
static constexpr uint32_t BUCKET_SLOT_GROWTH = 8;
// if set, the element is a reference to the next free slot, not an object
static constexpr uint32_t ELEMENT_IS_FREE_FLAG = 1;
static constexpr uint32_t HANDLE_MAX = 0xFFFFFF;
static constexpr uint32_t HandleToBucketOffset(guest_handle_t handle) {
// yes, this does not divide by SIZE_PER_HANDLE_BUCKET, but the mask has the
// low 2 bits clear and we shr by 6 so its really handle >> 8
return (((handle & 0xFFFFFC) >> 6) & 0x3FFFFFC);
}
static constexpr uint32_t HandleToBucketElementOffset(guest_handle_t handle) {
return handle & 0xFC;
}
void InitializeNewHandleRange(X_HANDLE_TABLE* table, PPCContext* context,
uint32_t bucket_base_handle,
uint32_t new_bucket) {
uint32_t bucket_slot_addr =
HandleToBucketOffset(bucket_base_handle) + table->table_dynamic_buckets;
// insert the new bucket into its slot
*context->TranslateVirtualBE<uint32_t>(bucket_slot_addr) = new_bucket;
table->free_offset = bucket_base_handle;
table->highest_allocated_offset = bucket_base_handle + SIZE_PER_HANDLE_BUCKET;
auto bucket = context->TranslateVirtualBE<guest_handle_t>(new_bucket);
/*
initialize each bucket slot with a handle to the next free slot
(bucket_handle_index+1) this is so we can read back the slot, update free
ptr to that, and then store an object in NewObjectHandle
*/
for (uint32_t bucket_handle_index = 0;
bucket_handle_index < NUM_HANDLES_PER_BUCKET; ++bucket_handle_index) {
bucket[bucket_handle_index] = (bucket_base_handle | ELEMENT_IS_FREE_FLAG) +
((bucket_handle_index + 1) * 4);
}
}
bool GrowHandleTable(uint32_t table_ptr, PPCContext* context) {
X_HANDLE_TABLE* table = context->TranslateVirtual<X_HANDLE_TABLE*>(table_ptr);
guest_handle_t new_bucket_handle_base = table->highest_allocated_offset;
if (new_bucket_handle_base >= HANDLE_MAX) {
return false;
}
uint32_t new_bucket = xboxkrnl::xeAllocatePoolTypeWithTag(
context, SIZE_PER_HANDLE_BUCKET, 'tHbO', table->unk_pool_arg_34);
if (!new_bucket) {
return false;
}
// this is exactly equal to (SIZE_PER_HANDLE_BUCKET*
// countof(table_static_buckets)) - 1
if ((new_bucket_handle_base & 0x7FF) != 0) {
InitializeNewHandleRange(table, context, new_bucket_handle_base,
new_bucket);
return true;
}
if (new_bucket_handle_base) {
// bucket list realloc logic starts here
uint32_t new_dynamic_buckets = xboxkrnl::xeAllocatePoolTypeWithTag(
context,
sizeof(uint32_t) * ((new_bucket_handle_base / SIZE_PER_HANDLE_BUCKET) +
BUCKET_SLOT_GROWTH),
'rHbO', table->unk_pool_arg_34);
if (new_dynamic_buckets) {
/*
copy old bucket list contents to new, larger bucket list
*/
memcpy(context->TranslateVirtual(new_dynamic_buckets),
context->TranslateVirtual(table->table_dynamic_buckets),
sizeof(uint32_t) * (new_bucket_handle_base / SIZE_PER_HANDLE_BUCKET));
if (context->TranslateVirtualBE<uint32_t>(table->table_dynamic_buckets) !=
&table->table_static_buckets[0]) {
xboxkrnl::xeFreePool(context, table->table_dynamic_buckets);
}
table->table_dynamic_buckets = new_dynamic_buckets;
InitializeNewHandleRange(table, context, new_bucket_handle_base,
new_bucket);
return true;
}
xboxkrnl::xeFreePool(context, new_bucket);
return false;
}
table->table_dynamic_buckets =
table_ptr + offsetof(X_HANDLE_TABLE, table_static_buckets);
InitializeNewHandleRange(table, context, new_bucket_handle_base, new_bucket);
return true;
}
uint32_t NewObjectHandle(uint32_t table_guest, uint32_t object_guest,
PPCContext* context) {
X_HANDLE_TABLE* table =
context->TranslateVirtual<X_HANDLE_TABLE*>(table_guest);
X_OBJECT_HEADER* object = context->TranslateVirtual<X_OBJECT_HEADER*>(
object_guest - sizeof(X_OBJECT_HEADER));
guest_handle_t new_handle;
xboxkrnl::xeKeKfAcquireSpinLock(context, &table->table_lock, false);
{
if (table->unk_36 ||
table->free_offset == table->highest_allocated_offset &&
!GrowHandleTable(table_guest, context)) {
new_handle = 0;
} else {
guest_handle_t new_handle_offset = table->free_offset;
uint32_t bucket = *context->TranslateVirtualBE<uint32_t>(
HandleToBucketOffset(new_handle_offset) +
table->table_dynamic_buckets);
auto object_ptr_dest = context->TranslateVirtualBE<uint32_t>(
bucket + HandleToBucketElementOffset(new_handle_offset));
// see end of InitializeNewHandleRange, each slot contains the offset of
// the next free slot
uint32_t next_free_slot = *object_ptr_dest;
table->free_offset = next_free_slot & ~ELEMENT_IS_FREE_FLAG;
table->num_handles++;
// this object header field is not atomic, because we're already under the
// table lock whenever we make changes to it
++object->handle_count;
*object_ptr_dest = object_guest;
new_handle = (static_cast<uint32_t>(table->handle_high_byte) << 24) |
new_handle_offset;
}
}
xboxkrnl::xeKeKfReleaseSpinLock(context, &table->table_lock, 0, false);
return new_handle;
}
uint32_t DestroyObjectHandle(uint32_t table_guest, uint32_t handle,
PPCContext* context) {
X_HANDLE_TABLE* table =
context->TranslateVirtual<X_HANDLE_TABLE*>(table_guest);
xboxkrnl::xeKeKfAcquireSpinLock(context, &table->table_lock, false);
unsigned int result = 0;
{
if ((handle >> 24) != table->handle_high_byte) {
xenia_assert(false);
} else {
uint32_t handle_sans_flags_and_high = handle & 0xFFFFFC;
if (handle_sans_flags_and_high < table->highest_allocated_offset) {
uint32_t bucket_for_handle = *context->TranslateVirtualBE<uint32_t>(
HandleToBucketOffset(handle_sans_flags_and_high) +
table->table_dynamic_buckets);
uint32_t bucket_element_guest_ptr =
bucket_for_handle + HandleToBucketElementOffset(handle);
if (bucket_element_guest_ptr) {
auto bucket_element_ptr =
context->TranslateVirtualBE<uint32_t>(bucket_element_guest_ptr);
uint32_t bucket_element = *bucket_element_ptr;
if ((bucket_element & ELEMENT_IS_FREE_FLAG) == 0) {
result = bucket_element & ~2;
*bucket_element_ptr = table->free_offset | ELEMENT_IS_FREE_FLAG;
table->free_offset = handle_sans_flags_and_high;
table->num_handles--;
}
}
} else {
xenia_assert(false);
}
}
}
xboxkrnl::xeKeKfReleaseSpinLock(context, &table->table_lock, 0, false);
return result;
}
uint32_t LookupHandleUnlocked(X_HANDLE_TABLE* table, guest_handle_t handle,
bool reference_object, PPCContext* context) {
uint32_t result_object = 0;
if ((handle >> 24) != table->handle_high_byte) {
return 0U;
}
if ((handle & 0xFFFFFC) >= table->highest_allocated_offset) {
return 0U;
}
uint32_t bucket_element_guest_ptr =
*context->TranslateVirtualBE<uint32_t>(HandleToBucketOffset(handle) +
table->table_dynamic_buckets) +
HandleToBucketElementOffset(handle);
if (bucket_element_guest_ptr != 0) {
uint32_t bucket_element =
*context->TranslateVirtualBE<uint32_t>(bucket_element_guest_ptr);
result_object = bucket_element & ~2U;
if ((bucket_element & ELEMENT_IS_FREE_FLAG) == 0) {
if (reference_object) {
X_OBJECT_HEADER* header = context->TranslateVirtual<X_OBJECT_HEADER*>(
result_object - sizeof(X_OBJECT_HEADER));
context->processor->GuestAtomicIncrement32(
context, context->HostToGuestVirtual(&header->pointer_count));
}
} else {
result_object = 0;
}
} else {
result_object = 0;
}
return result_object;
}
uint32_t LookupHandle(uint32_t table, uint32_t handle,
uint32_t reference_object, PPCContext* context) {
X_HANDLE_TABLE* table_ptr = context->TranslateVirtual<X_HANDLE_TABLE*>(table);
uint32_t old_irql =
xboxkrnl::xeKeKfAcquireSpinLock(context, &table_ptr->table_lock);
uint32_t result =
LookupHandleUnlocked(table_ptr, handle, reference_object, context);
xboxkrnl::xeKeKfReleaseSpinLock(context, &table_ptr->table_lock, old_irql);
return result;
}
} // namespace util
} // namespace kernel
} // namespace xe

52
src/xenia/kernel/util/guest_object_table.h Normal file
View File

@@ -0,0 +1,52 @@
/**
******************************************************************************
* Xenia : Xbox 360 Emulator Research Project *
******************************************************************************
* Copyright 2023 Xenia Canary. All rights reserved. *
* Released under the BSD license - see LICENSE in the root for more details. *
******************************************************************************
*/
#ifndef XENIA_KERNEL_UTIL_GUEST_OBJECT_TABLE_H_
#define XENIA_KERNEL_UTIL_GUEST_OBJECT_TABLE_H_
#include "xenia/kernel/kernel_state.h"
#include "xenia/xbox.h"
namespace xe {
namespace kernel {
namespace util {
// use this to make it clearer in the code whether a uint32_t is a handle or not
using guest_handle_t = uint32_t;
// not normally api visible, but used so we can accurately recreate how the 360
// os allocated handles
struct X_HANDLE_TABLE {
xe::be<uint32_t> num_handles;
xe::be<guest_handle_t> free_offset;
xe::be<uint32_t> highest_allocated_offset;
xe::be<uint32_t> table_dynamic_buckets;
xe::be<uint32_t> table_static_buckets[8];
X_KSPINLOCK table_lock;
//used as unknown arg 3 to pool allocations
uint8_t unk_pool_arg_34;
uint8_t handle_high_byte;
uint8_t unk_36;
uint8_t unk_38;
};
static_assert_size(X_HANDLE_TABLE, 0x38);
bool GrowHandleTable(uint32_t table_ptr, cpu::ppc::PPCContext* context);
uint32_t NewObjectHandle(uint32_t table_guest, uint32_t object_guest,
cpu::ppc::PPCContext* context);
uint32_t DestroyObjectHandle(uint32_t table_guest, guest_handle_t handle,
cpu::ppc::PPCContext* context);
uint32_t LookupHandleUnlocked(X_HANDLE_TABLE* table, guest_handle_t handle,
bool reference_object,
cpu::ppc::PPCContext* context);
uint32_t LookupHandle(uint32_t table, guest_handle_t handle,
uint32_t reference_object, cpu::ppc::PPCContext* context);
} // namespace util
} // namespace kernel
} // namespace xe
#endif // XENIA_KERNEL_UTIL_GUEST_OBJECT_TABLE_H_

82
src/xenia/kernel/xboxkrnl/xboxkrnl_memory.cc
View File

@@ -14,9 +14,9 @@
#include "xenia/base/math.h"
#include "xenia/kernel/kernel_state.h"
#include "xenia/kernel/util/shim_utils.h"
#include "xenia/kernel/xboxkrnl/xboxkrnl_memory.h"
#include "xenia/kernel/xboxkrnl/xboxkrnl_private.h"
#include "xenia/xbox.h"
#include "xenia/kernel/xboxkrnl/xboxkrnl_memory.h"
DEFINE_bool(
ignore_offset_for_ranged_allocations, false,
"Allows to ignore 4k offset for physical allocations with provided range. "
@@ -380,10 +380,10 @@ dword_result_t NtAllocateEncryptedMemory_entry(dword_t unk, dword_t region_size,
DECLARE_XBOXKRNL_EXPORT1(NtAllocateEncryptedMemory, kMemory, kImplemented);
uint32_t xeMmAllocatePhysicalMemoryEx(uint32_t flags, uint32_t region_size,
uint32_t protect_bits,
uint32_t min_addr_range,
uint32_t max_addr_range,
uint32_t alignment) {
uint32_t protect_bits,
uint32_t min_addr_range,
uint32_t max_addr_range,
uint32_t alignment) {
// Type will usually be 0 (user request?), where 1 and 2 are sometimes made
// by D3D/etc.
@@ -463,7 +463,7 @@ dword_result_t MmAllocatePhysicalMemory_entry(dword_t flags,
dword_t region_size,
dword_t protect_bits) {
return xeMmAllocatePhysicalMemoryEx(flags, region_size, protect_bits, 0,
0xFFFFFFFFu, 0);
0xFFFFFFFFu, 0);
}
DECLARE_XBOXKRNL_EXPORT1(MmAllocatePhysicalMemory, kMemory, kImplemented);
@@ -642,35 +642,64 @@ dword_result_t MmMapIoSpace_entry(dword_t unk0, lpvoid_t src_address,
}
DECLARE_XBOXKRNL_EXPORT1(MmMapIoSpace, kMemory, kImplemented);
dword_result_t ExAllocatePoolTypeWithTag_entry(dword_t size, dword_t tag,
dword_t zero) {
uint32_t alignment = 8;
uint32_t adjusted_size = size;
if (adjusted_size < 4 * 1024) {
adjusted_size = xe::round_up(adjusted_size, 4 * 1024);
struct X_POOL_ALLOC_HEADER {
uint8_t unk_0;
uint8_t unk_1;
uint8_t unk_2; // set this to 170
uint8_t unk_3;
xe::be<uint32_t> tag;
};
uint32_t xeAllocatePoolTypeWithTag(PPCContext* context, uint32_t size,
uint32_t tag, uint32_t zero) {
if (size <= 0xFD8) {
uint32_t adjusted_size = size + sizeof(X_POOL_ALLOC_HEADER);
uint32_t addr =
kernel_state()->memory()->SystemHeapAlloc(adjusted_size, 64);
auto result_ptr = context->TranslateVirtual<X_POOL_ALLOC_HEADER*>(addr);
result_ptr->unk_2 = 170;
result_ptr->tag = tag;
return addr + sizeof(X_POOL_ALLOC_HEADER);
} else {
alignment = 4 * 1024;
return kernel_state()->memory()->SystemHeapAlloc(size, 4096);
}
}
uint32_t addr =
kernel_state()->memory()->SystemHeapAlloc(adjusted_size, alignment);
return addr;
dword_result_t ExAllocatePoolTypeWithTag_entry(dword_t size, dword_t tag,
dword_t zero,
const ppc_context_t& context) {
return xeAllocatePoolTypeWithTag(context, size, tag, zero);
}
DECLARE_XBOXKRNL_EXPORT1(ExAllocatePoolTypeWithTag, kMemory, kImplemented);
dword_result_t ExAllocatePoolWithTag_entry(dword_t numbytes, dword_t tag) {
return ExAllocatePoolTypeWithTag_entry(numbytes, tag, 0);
dword_result_t ExAllocatePoolWithTag_entry(dword_t numbytes, dword_t tag,
const ppc_context_t& context) {
return xeAllocatePoolTypeWithTag(context, numbytes, tag, 0);
}
DECLARE_XBOXKRNL_EXPORT1(ExAllocatePoolWithTag, kMemory, kImplemented);
dword_result_t ExAllocatePool_entry(dword_t size) {
dword_result_t ExAllocatePool_entry(dword_t size,
const ppc_context_t& context) {
const uint32_t none = 0x656E6F4E; // 'None'
return ExAllocatePoolTypeWithTag_entry(size, none, 0);
return xeAllocatePoolTypeWithTag(context, size, none, 0);
}
DECLARE_XBOXKRNL_EXPORT1(ExAllocatePool, kMemory, kImplemented);
void ExFreePool_entry(lpvoid_t base_address) {
kernel_state()->memory()->SystemHeapFree(base_address);
void xeFreePool(PPCContext* context, uint32_t base_address) {
auto memory = context->kernel_state->memory();
//if 4kb aligned, there is no pool header!
if ((base_address & (4096 - 1)) == 0) {
memory->SystemHeapFree(base_address);
} else {
memory->SystemHeapFree(base_address - sizeof(X_POOL_ALLOC_HEADER));
}
}
void ExFreePool_entry(lpvoid_t base_address, const ppc_context_t& context) {
xeFreePool(context, base_address.guest_address());
}
DECLARE_XBOXKRNL_EXPORT1(ExFreePool, kMemory, kImplemented);
@@ -710,9 +739,7 @@ DECLARE_XBOXKRNL_EXPORT1(KeLockL2, kMemory, kStub);
void KeUnlockL2_entry() {}
DECLARE_XBOXKRNL_EXPORT1(KeUnlockL2, kMemory, kStub);
dword_result_t MmCreateKernelStack_entry(dword_t stack_size, dword_t r4) {
assert_zero(r4); // Unknown argument.
uint32_t xeMmCreateKernelStack(uint32_t stack_size, uint32_t r4) {
auto stack_size_aligned = (stack_size + 0xFFF) & 0xFFFFF000;
uint32_t stack_alignment = (stack_size & 0xF000) ? 0x1000 : 0x10000;
@@ -725,6 +752,9 @@ dword_result_t MmCreateKernelStack_entry(dword_t stack_size, dword_t r4) {
&stack_address);
return stack_address + stack_size;
}
dword_result_t MmCreateKernelStack_entry(dword_t stack_size, dword_t r4) {
return xeMmCreateKernelStack(stack_size, r4);
}
DECLARE_XBOXKRNL_EXPORT1(MmCreateKernelStack, kMemory, kImplemented);
dword_result_t MmDeleteKernelStack_entry(lpvoid_t stack_base,

5
src/xenia/kernel/xboxkrnl/xboxkrnl_memory.h
View File

@@ -24,7 +24,12 @@ uint32_t xeMmAllocatePhysicalMemoryEx(uint32_t flags, uint32_t region_size,
uint32_t min_addr_range,
uint32_t max_addr_range,
uint32_t alignment);
uint32_t xeAllocatePoolTypeWithTag(PPCContext* context, uint32_t size,
uint32_t tag, uint32_t zero);
void xeFreePool(PPCContext* context, uint32_t base_address);
uint32_t xeMmCreateKernelStack(uint32_t size, uint32_t r4);
} // namespace xboxkrnl
} // namespace kernel
} // namespace xe

13
src/xenia/kernel/xboxkrnl/xboxkrnl_threading.cc
View File

@@ -1132,8 +1132,8 @@ dword_result_t KfAcquireSpinLock_entry(pointer_t<X_KSPINLOCK> lock_ptr,
DECLARE_XBOXKRNL_EXPORT3(KfAcquireSpinLock, kThreading, kImplemented, kBlocking,
kHighFrequency);
void xeKeKfReleaseSpinLock(PPCContext* ctx, X_KSPINLOCK* lock, uint32_t old_irql,
bool change_irql) {
void xeKeKfReleaseSpinLock(PPCContext* ctx, X_KSPINLOCK* lock,
uint32_t old_irql, bool change_irql) {
assert_true(lock->prcb_of_owner == static_cast<uint32_t>(ctx->r[13]));
// Unlock.
lock->prcb_of_owner.value = 0;
@@ -1170,8 +1170,9 @@ dword_result_t KeTryToAcquireSpinLockAtRaisedIrql_entry(
auto lock = reinterpret_cast<uint32_t*>(lock_ptr.host_address());
assert_true(lock_ptr->prcb_of_owner != static_cast<uint32_t>(ppc_ctx->r[13]));
PrefetchForCAS(lock);
if (!xe::atomic_cas(0, xe::byte_swap(static_cast<uint32_t>(ppc_ctx->r[13])),
lock)) {
if (!ppc_ctx->processor->GuestAtomicCAS32(
ppc_ctx, 0, static_cast<uint32_t>(ppc_ctx->r[13]),
lock_ptr.guest_address())) {
return 0;
}
return 1;
@@ -1361,8 +1362,8 @@ X_STATUS xeProcessUserApcs(PPCContext* ctx) {
return alert_status;
}
static void YankApcList(PPCContext* ctx, X_KTHREAD* current_thread, unsigned apc_mode,
bool rundown) {
static void YankApcList(PPCContext* ctx, X_KTHREAD* current_thread,
unsigned apc_mode, bool rundown) {
uint32_t unlocked_irql =
xeKeKfAcquireSpinLock(ctx, &current_thread->apc_lock);