From 8aa17f0480db67a514d3fc33e729f96f961ddee3 Mon Sep 17 00:00:00 2001 From: Zach Hilman Date: Mon, 29 Oct 2018 21:53:57 -0400 Subject: [PATCH 1/7] pl_u: Resize buffers in shared font data getter to what game requests Fixes unmapped spam in SMP and buffer size errors in some other games --- src/core/hle/service/ns/pl_u.cpp | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/src/core/hle/service/ns/pl_u.cpp b/src/core/hle/service/ns/pl_u.cpp index 44accecb7..1066bf505 100644 --- a/src/core/hle/service/ns/pl_u.cpp +++ b/src/core/hle/service/ns/pl_u.cpp @@ -351,6 +351,14 @@ void PL_U::GetSharedFontInOrderOfPriority(Kernel::HLERequestContext& ctx) { font_sizes.push_back(region.size); } + // Resize buffers if game requests smaller size output. + font_codes.resize( + std::min(font_codes.size(), ctx.GetWriteBufferSize(0) / sizeof(u32))); + font_offsets.resize( + std::min(font_offsets.size(), ctx.GetWriteBufferSize(1) / sizeof(u32))); + font_sizes.resize( + std::min(font_sizes.size(), ctx.GetWriteBufferSize(2) / sizeof(u32))); + ctx.WriteBuffer(font_codes, 0); ctx.WriteBuffer(font_offsets, 1); ctx.WriteBuffer(font_sizes, 2); From 0276761a1e8e9f1ac1e2678ac8fed0b6767f6732 Mon Sep 17 00:00:00 2001 From: Zach Hilman Date: Mon, 29 Oct 2018 21:55:06 -0400 Subject: [PATCH 2/7] process: Make MirrorMemory take state to map new memory as Credits to Subv --- src/core/hle/kernel/process.h | 3 ++- src/core/loader/nro.cpp | 7 +++++-- 2 files changed, 7 insertions(+), 3 deletions(-) diff --git a/src/core/hle/kernel/process.h b/src/core/hle/kernel/process.h index cf48787ce..230e395ff 100644 --- a/src/core/hle/kernel/process.h +++ b/src/core/hle/kernel/process.h @@ -259,7 +259,8 @@ public: ResultVal HeapAllocate(VAddr target, u64 size, VMAPermission perms); ResultCode HeapFree(VAddr target, u32 size); - ResultCode MirrorMemory(VAddr dst_addr, VAddr src_addr, u64 size); + ResultCode MirrorMemory(VAddr dst_addr, VAddr src_addr, u64 size, + MemoryState state = MemoryState::Mapped); ResultCode UnmapMemory(VAddr dst_addr, VAddr src_addr, u64 size); diff --git a/src/core/loader/nro.cpp b/src/core/loader/nro.cpp index c8e491fec..fbbd6b0de 100644 --- a/src/core/loader/nro.cpp +++ b/src/core/loader/nro.cpp @@ -170,17 +170,20 @@ static constexpr u32 PageAlignSize(u32 size) { arg_data.size()); } - // Read MOD header - ModHeader mod_header{}; // Default .bss to NRO header bss size if MOD0 section doesn't exist u32 bss_size{PageAlignSize(nro_header.bss_size)}; + + // Read MOD header + ModHeader mod_header{}; std::memcpy(&mod_header, program_image.data() + nro_header.module_header_offset, sizeof(ModHeader)); + const bool has_mod_header{mod_header.magic == Common::MakeMagic('M', 'O', 'D', '0')}; if (has_mod_header) { // Resize program image to include .bss section and page align each section bss_size = PageAlignSize(mod_header.bss_end_offset - mod_header.bss_start_offset); } + codeset.DataSegment().size += bss_size; program_image.resize(static_cast(program_image.size()) + bss_size); From 6cd504feb921b442ab079bd2be638180e3e61c04 Mon Sep 17 00:00:00 2001 From: Zach Hilman Date: Mon, 29 Oct 2018 21:58:11 -0400 Subject: [PATCH 3/7] ldr_ro: Fully implement LoadNrr (command 2) Includes parameter error checking, hash enforcement, initialization check, and max NRR load check. --- src/core/hle/service/ldr/ldr.cpp | 112 +++++++++++++++++++++++++++++++ 1 file changed, 112 insertions(+) diff --git a/src/core/hle/service/ldr/ldr.cpp b/src/core/hle/service/ldr/ldr.cpp index d607d985e..7804913fa 100644 --- a/src/core/hle/service/ldr/ldr.cpp +++ b/src/core/hle/service/ldr/ldr.cpp @@ -13,6 +13,36 @@ namespace Service::LDR { +namespace ErrCodes { +enum { + InvalidNRO = 52, + InvalidNRR = 53, + MissingNRRHash = 54, + MaximumNRO = 55, + MaximumNRR = 56, + AlreadyLoaded = 57, + InvalidAlignment = 81, + InvalidSize = 82, + InvalidNROAddress = 84, + InvalidNRRAddress = 85, + NotInitialized = 87, +}; +} + +constexpr ResultCode ERROR_INVALID_NRO(ErrorModule::Loader, ErrCodes::InvalidNRO); +constexpr ResultCode ERROR_INVALID_NRR(ErrorModule::Loader, ErrCodes::InvalidNRR); +constexpr ResultCode ERROR_MISSING_NRR_HASH(ErrorModule::Loader, ErrCodes::MissingNRRHash); +constexpr ResultCode ERROR_MAXIMUM_NRO(ErrorModule::Loader, ErrCodes::MaximumNRO); +constexpr ResultCode ERROR_MAXIMUM_NRR(ErrorModule::Loader, ErrCodes::MaximumNRR); +constexpr ResultCode ERROR_ALREADY_LOADED(ErrorModule::Loader, ErrCodes::AlreadyLoaded); +constexpr ResultCode ERROR_INVALID_ALIGNMENT(ErrorModule::Loader, ErrCodes::InvalidAlignment); +constexpr ResultCode ERROR_INVALID_SIZE(ErrorModule::Loader, ErrCodes::InvalidSize); +constexpr ResultCode ERROR_INVALID_NRO_ADDRESS(ErrorModule::Loader, ErrCodes::InvalidNROAddress); +constexpr ResultCode ERROR_INVALID_NRR_ADDRESS(ErrorModule::Loader, ErrCodes::InvalidNRRAddress); +constexpr ResultCode ERROR_NOT_INITIALIZED(ErrorModule::Loader, ErrCodes::NotInitialized); + +constexpr u64 MAXIMUM_LOADED_RO = 0x40; + class DebugMonitor final : public ServiceFramework { public: explicit DebugMonitor() : ServiceFramework{"ldr:dmnt"} { @@ -75,6 +105,88 @@ public: } void LoadNrr(Kernel::HLERequestContext& ctx) { + IPC::RequestParser rp{ctx}; + rp.Skip(2, false); + const VAddr nrr_addr{rp.Pop()}; + const u64 nrr_size{rp.Pop()}; + + if (!initialized) { + LOG_ERROR(Service_LDR, "LDR:RO not initialized before use!"); + IPC::ResponseBuilder rb{ctx, 2}; + rb.Push(ERROR_NOT_INITIALIZED); + return; + } + + if (nro.size() >= MAXIMUM_LOADED_RO) { + LOG_ERROR(Service_LDR, "Loading new NRR would exceed the maximum number of loaded NRRs " + "(0x40)! Failing..."); + IPC::ResponseBuilder rb{ctx, 2}; + rb.Push(ERROR_MAXIMUM_NRR); + return; + } + + // NRR Address does not fall on 0x1000 byte boundary + if ((nrr_addr & 0xFFF) != 0) { + LOG_ERROR(Service_LDR, "NRR Address has invalid alignment (actual {:016X})!", nrr_addr); + IPC::ResponseBuilder rb{ctx, 2}; + rb.Push(ERROR_INVALID_ALIGNMENT); + return; + } + + // NRR Size is zero or causes overflow + if (nrr_addr + nrr_size <= nrr_addr || nrr_size == 0 || (nrr_size & 0xFFF) != 0) { + LOG_ERROR(Service_LDR, "NRR Size is invalid! (nrr_address={:016X}, nrr_size={:016X})", + nrr_addr, nrr_size); + IPC::ResponseBuilder rb{ctx, 2}; + rb.Push(ERROR_INVALID_SIZE); + return; + } + // Read NRR data from memory + std::vector nrr_data(nrr_size); + Memory::ReadBlock(nrr_addr, nrr_data.data(), nrr_size); + NRRHeader header; + std::memcpy(&header, nrr_data.data(), sizeof(NRRHeader)); + + if (header.magic != Common::MakeMagic('N', 'R', 'R', '0')) { + LOG_ERROR(Service_LDR, "NRR did not have magic 'NRR0' (actual {:08X})!", header.magic); + IPC::ResponseBuilder rb{ctx, 2}; + rb.Push(ERROR_INVALID_NRR); + return; + } + + if (header.size != nrr_size) { + LOG_ERROR(Service_LDR, + "NRR header reported size did not match LoadNrr parameter size! " + "(header_size={:016X}, loadnrr_size={:016X})", + header.size, nrr_size); + IPC::ResponseBuilder rb{ctx, 2}; + rb.Push(ERROR_INVALID_SIZE); + return; + } + + if (Core::CurrentProcess()->GetTitleID() != header.title_id) { + LOG_ERROR(Service_LDR, + "Attempting to load NRR with title ID other than current process. (actual " + "{:016X})!", + header.title_id); + IPC::ResponseBuilder rb{ctx, 2}; + rb.Push(ERROR_INVALID_NRR); + return; + } + + std::vector hashes; + for (std::size_t i = header.hash_offset; + i < (header.hash_offset + (header.hash_count << 5)); i += 8) { + hashes.emplace_back(); + std::memcpy(hashes.back().data(), nrr_data.data() + i, sizeof(SHA256Hash)); + } + + nrr.insert_or_assign(nrr_addr, std::move(hashes)); + + IPC::ResponseBuilder rb{ctx, 2}; + rb.Push(RESULT_SUCCESS); + } + IPC::ResponseBuilder rb{ctx, 2}; rb.Push(RESULT_SUCCESS); LOG_WARNING(Service_LDR, "(STUBBED) called"); From 5e8e7b60196c5974716952de132a333b5fe81561 Mon Sep 17 00:00:00 2001 From: Zach Hilman Date: Mon, 29 Oct 2018 22:03:59 -0400 Subject: [PATCH 4/7] ldr_ro: Implement UnloadNrr (command 3) Includes initialization check, proper address check, alignment check, and actual unloading of a loaded NRR. --- src/core/hle/service/ldr/ldr.cpp | 86 +++++++++++++++++++++++++++++++- 1 file changed, 84 insertions(+), 2 deletions(-) diff --git a/src/core/hle/service/ldr/ldr.cpp b/src/core/hle/service/ldr/ldr.cpp index 7804913fa..252c66831 100644 --- a/src/core/hle/service/ldr/ldr.cpp +++ b/src/core/hle/service/ldr/ldr.cpp @@ -4,7 +4,9 @@ #include #include +#include +#include "common/hex_util.h" #include "core/hle/ipc_helpers.h" #include "core/hle/kernel/process.h" #include "core/hle/service/ldr/ldr.h" @@ -94,7 +96,7 @@ public: // clang-format off static const FunctionInfo functions[] = { {0, &RelocatableObject::LoadNro, "LoadNro"}, - {1, nullptr, "UnloadNro"}, + {1, &RelocatableObject::UnloadNro, "UnloadNro"}, {2, &RelocatableObject::LoadNrr, "LoadNrr"}, {3, nullptr, "UnloadNrr"}, {4, &RelocatableObject::Initialize, "Initialize"}, @@ -187,9 +189,38 @@ public: rb.Push(RESULT_SUCCESS); } + void UnloadNrr(Kernel::HLERequestContext& ctx) { + if (!initialized) { + LOG_ERROR(Service_LDR, "LDR:RO not initialized before use!"); + IPC::ResponseBuilder rb{ctx, 2}; + rb.Push(ERROR_NOT_INITIALIZED); + return; + } + + IPC::RequestParser rp{ctx}; + rp.Skip(2, false); + const auto nrr_addr{rp.Pop()}; + + if ((nrr_addr & 0xFFF) != 0) { + LOG_ERROR(Service_LDR, "NRR Address has invalid alignment (actual {:016X})!", nrr_addr); + IPC::ResponseBuilder rb{ctx, 2}; + rb.Push(ERROR_INVALID_ALIGNMENT); + return; + } + + const auto iter = nrr.find(nrr_addr); + if (iter == nrr.end()) { + LOG_ERROR(Service_LDR, + "Attempting to unload NRR which has not been loaded! (addr={:016X})", + nrr_addr); + IPC::ResponseBuilder rb{ctx, 2}; + rb.Push(ERROR_INVALID_NRR_ADDRESS); + return; + } + + nrr.erase(iter); IPC::ResponseBuilder rb{ctx, 2}; rb.Push(RESULT_SUCCESS); - LOG_WARNING(Service_LDR, "(STUBBED) called"); } void LoadNro(Kernel::HLERequestContext& ctx) { @@ -227,6 +258,57 @@ public: rb.Push(RESULT_SUCCESS); LOG_WARNING(Service_LDR, "(STUBBED) called"); } + +private: + using SHA256Hash = std::array; + + struct NROHeader { + u32_le entrypoint_insn; + u32_le mod_offset; + INSERT_PADDING_WORDS(2); + u32_le magic; + INSERT_PADDING_WORDS(1); + u32_le nro_size; + INSERT_PADDING_WORDS(1); + u32_le text_offset; + u32_le text_size; + u32_le ro_offset; + u32_le ro_size; + u32_le rw_offset; + u32_le rw_size; + u32_le bss_size; + INSERT_PADDING_WORDS(1); + std::array build_id; + INSERT_PADDING_BYTES(0x20); + }; + static_assert(sizeof(NROHeader) == 0x80, "NROHeader has invalid size."); + + struct NRRHeader { + u32_le magic; + INSERT_PADDING_BYTES(0x1C); + u64_le title_id_mask; + u64_le title_id_pattern; + std::array modulus; + std::array signature_1; + std::array signature_2; + u64_le title_id; + u32_le size; + INSERT_PADDING_BYTES(4); + u32_le hash_offset; + u32_le hash_count; + INSERT_PADDING_BYTES(8); + }; + static_assert(sizeof(NRRHeader) == 0x350, "NRRHeader has incorrect size."); + + struct NROInfo { + SHA256Hash hash; + u64 size; + }; + + bool initialized = false; + + std::map nro; + std::map> nrr; }; void InstallInterfaces(SM::ServiceManager& sm) { From 056fa43dcdf69d1f9379e888f0c137b264e63709 Mon Sep 17 00:00:00 2001 From: Zach Hilman Date: Mon, 29 Oct 2018 22:12:05 -0400 Subject: [PATCH 5/7] ldr_ro: Fully Implement LoadNro (command 0) Includes NRO and BSS error checking, maximum loaded NRO check, NRR hash check, and proper remapping of BSS data. --- src/core/hle/service/ldr/ldr.cpp | 123 ++++++++++++++++++++++++++++--- 1 file changed, 111 insertions(+), 12 deletions(-) diff --git a/src/core/hle/service/ldr/ldr.cpp b/src/core/hle/service/ldr/ldr.cpp index 252c66831..11b8a02e2 100644 --- a/src/core/hle/service/ldr/ldr.cpp +++ b/src/core/hle/service/ldr/ldr.cpp @@ -231,29 +231,128 @@ public: const VAddr bss_addr{rp.Pop()}; const u64 bss_size{rp.Pop()}; + if (!initialized) { + LOG_ERROR(Service_LDR, "LDR:RO not initialized before use!"); + IPC::ResponseBuilder rb{ctx, 2}; + rb.Push(ERROR_NOT_INITIALIZED); + return; + } + + if (nro.size() >= MAXIMUM_LOADED_RO) { + LOG_ERROR(Service_LDR, "Loading new NRO would exceed the maximum number of loaded NROs " + "(0x40)! Failing..."); + IPC::ResponseBuilder rb{ctx, 2}; + rb.Push(ERROR_MAXIMUM_NRO); + return; + } + + // NRO Address does not fall on 0x1000 byte boundary + if ((nro_addr & 0xFFF) != 0) { + LOG_ERROR(Service_LDR, "NRO Address has invalid alignment (actual {:016X})!", nro_addr); + IPC::ResponseBuilder rb{ctx, 2}; + rb.Push(ERROR_INVALID_ALIGNMENT); + return; + } + + // NRO Size or BSS Size is zero or causes overflow + if (nro_addr + nro_size <= nro_addr || nro_size == 0 || (nro_size & 0xFFF) != 0 || + (bss_size != 0 && bss_addr + bss_size <= bss_addr) || + (std::numeric_limits::max() - nro_size < bss_size)) { + LOG_ERROR(Service_LDR, + "NRO Size or BSS Size is invalid! (nro_address={:016X}, nro_size={:016X}, " + "bss_address={:016X}, bss_size={:016X})", + nro_addr, nro_size, bss_addr, bss_size); + IPC::ResponseBuilder rb{ctx, 2}; + rb.Push(ERROR_INVALID_SIZE); + return; + } + // Read NRO data from memory std::vector nro_data(nro_size); Memory::ReadBlock(nro_addr, nro_data.data(), nro_size); - // Load NRO as new executable module - const VAddr addr{*Core::CurrentProcess()->VMManager().FindFreeRegion(nro_size + bss_size)}; - Loader::AppLoader_NRO::LoadNro(nro_data, fmt::format("nro-{:08x}", addr), addr); + SHA256Hash hash{}; + mbedtls_sha256(nro_data.data(), nro_data.size(), hash.data(), 0); - // TODO(bunnei): This is an incomplete implementation. It was tested with Super Mario Party. - // It is currently missing: - // - Signature checks with LoadNRR - // - Checking if a module has already been loaded - // - Using/validating BSS, etc. params (these are used from NRO header instead) - // - Error checking - // - ...Probably other things + // NRO Hash is already loaded + if (std::find_if(nro.begin(), nro.end(), [&hash](const std::pair& info) { + return info.second.hash == hash; + }) != nro.end()) { + LOG_ERROR(Service_LDR, "NRO is already loaded!"); + IPC::ResponseBuilder rb{ctx, 2}; + rb.Push(ERROR_ALREADY_LOADED); + return; + } + + // NRO Hash is not in any loaded NRR + if (std::find_if(nrr.begin(), nrr.end(), + [&hash](const std::pair>& p) { + return std::find(p.second.begin(), p.second.end(), hash) != + p.second.end(); + }) == nrr.end()) { + LOG_ERROR(Service_LDR, + "NRO hash is not present in any currently loaded NRRs (hash={})!", + Common::HexArrayToString(hash)); + IPC::ResponseBuilder rb{ctx, 2}; + rb.Push(ERROR_MISSING_NRR_HASH); + return; + } + + NROHeader header; + std::memcpy(&header, nro_data.data(), sizeof(NROHeader)); + + if (header.magic != Common::MakeMagic('N', 'R', 'O', '0') || header.nro_size != nro_size || + header.bss_size != bss_size || + header.ro_offset != header.text_offset + header.text_size || + header.rw_offset != header.ro_offset + header.ro_size || + nro_size != header.rw_offset + header.rw_size || (header.text_size & 0xFFF) != 0 || + (header.ro_size & 0xFFF) != 0 || (header.rw_size & 0xFFF) != 0) { + LOG_ERROR(Service_LDR, "NRO was invalid!"); + IPC::ResponseBuilder rb{ctx, 2}; + rb.Push(ERROR_INVALID_NRO); + return; + } + + // Load NRO as new executable module + auto process = Core::CurrentProcess(); + auto& vm_manager = process->VMManager(); + auto map_address = vm_manager.FindFreeRegion(nro_size + bss_size); + + ASSERT(map_address.Succeeded()); + + ASSERT(process->MirrorMemory(*map_address, nro_addr, nro_size, + Kernel::MemoryState::ModuleCodeStatic) == RESULT_SUCCESS); + ASSERT(process->UnmapMemory(nro_addr, 0, nro_size) == RESULT_SUCCESS); + + if (bss_size > 0) { + ASSERT(process->MirrorMemory(*map_address + nro_size, bss_addr, bss_size, + Kernel::MemoryState::ModuleCodeStatic) == RESULT_SUCCESS); + ASSERT(process->UnmapMemory(bss_addr, 0, bss_size) == RESULT_SUCCESS); + } + + vm_manager.ReprotectRange(*map_address, header.text_size, + Kernel::VMAPermission::ReadExecute); + vm_manager.ReprotectRange(*map_address + header.ro_offset, header.ro_size, + Kernel::VMAPermission::Read); + vm_manager.ReprotectRange(*map_address + header.rw_offset, header.rw_size, + Kernel::VMAPermission::ReadWrite); + + Core::System::GetInstance().ArmInterface(0).ClearInstructionCache(); + Core::System::GetInstance().ArmInterface(1).ClearInstructionCache(); + Core::System::GetInstance().ArmInterface(2).ClearInstructionCache(); + Core::System::GetInstance().ArmInterface(3).ClearInstructionCache(); + + nro.insert_or_assign(*map_address, NROInfo{hash, nro_size + bss_size}); IPC::ResponseBuilder rb{ctx, 4}; rb.Push(RESULT_SUCCESS); - rb.Push(addr); - LOG_WARNING(Service_LDR, "(STUBBED) called"); + rb.Push(*map_address); + } } void Initialize(Kernel::HLERequestContext& ctx) { + initialized = true; + IPC::ResponseBuilder rb{ctx, 2}; rb.Push(RESULT_SUCCESS); LOG_WARNING(Service_LDR, "(STUBBED) called"); From c0a9abc3e10ce8873dc6d553c087862c121e1736 Mon Sep 17 00:00:00 2001 From: Zach Hilman Date: Tue, 30 Oct 2018 09:10:55 -0400 Subject: [PATCH 6/7] ldr_ro: Implement UnloadNro (command 1) Includes actual unmapping and address error checking. --- src/core/hle/service/ldr/ldr.cpp | 107 ++++++++++++++++++++++++------- 1 file changed, 85 insertions(+), 22 deletions(-) diff --git a/src/core/hle/service/ldr/ldr.cpp b/src/core/hle/service/ldr/ldr.cpp index 11b8a02e2..5f020cbe0 100644 --- a/src/core/hle/service/ldr/ldr.cpp +++ b/src/core/hle/service/ldr/ldr.cpp @@ -6,6 +6,7 @@ #include #include +#include "common/alignment.h" #include "common/hex_util.h" #include "core/hle/ipc_helpers.h" #include "core/hle/kernel/process.h" @@ -98,7 +99,7 @@ public: {0, &RelocatableObject::LoadNro, "LoadNro"}, {1, &RelocatableObject::UnloadNro, "UnloadNro"}, {2, &RelocatableObject::LoadNrr, "LoadNrr"}, - {3, nullptr, "UnloadNrr"}, + {3, &RelocatableObject::UnloadNrr, "UnloadNrr"}, {4, &RelocatableObject::Initialize, "Initialize"}, }; // clang-format on @@ -128,7 +129,7 @@ public: } // NRR Address does not fall on 0x1000 byte boundary - if ((nrr_addr & 0xFFF) != 0) { + if (!Common::Is4KBAligned(nrr_addr)) { LOG_ERROR(Service_LDR, "NRR Address has invalid alignment (actual {:016X})!", nrr_addr); IPC::ResponseBuilder rb{ctx, 2}; rb.Push(ERROR_INVALID_ALIGNMENT); @@ -136,7 +137,7 @@ public: } // NRR Size is zero or causes overflow - if (nrr_addr + nrr_size <= nrr_addr || nrr_size == 0 || (nrr_size & 0xFFF) != 0) { + if (nrr_addr + nrr_size <= nrr_addr || nrr_size == 0 || !Common::Is4KBAligned(nrr_size)) { LOG_ERROR(Service_LDR, "NRR Size is invalid! (nrr_address={:016X}, nrr_size={:016X})", nrr_addr, nrr_size); IPC::ResponseBuilder rb{ctx, 2}; @@ -201,7 +202,7 @@ public: rp.Skip(2, false); const auto nrr_addr{rp.Pop()}; - if ((nrr_addr & 0xFFF) != 0) { + if (!Common::Is4KBAligned(nrr_addr)) { LOG_ERROR(Service_LDR, "NRR Address has invalid alignment (actual {:016X})!", nrr_addr); IPC::ResponseBuilder rb{ctx, 2}; rb.Push(ERROR_INVALID_ALIGNMENT); @@ -247,7 +248,7 @@ public: } // NRO Address does not fall on 0x1000 byte boundary - if ((nro_addr & 0xFFF) != 0) { + if (!Common::Is4KBAligned(nro_addr)) { LOG_ERROR(Service_LDR, "NRO Address has invalid alignment (actual {:016X})!", nro_addr); IPC::ResponseBuilder rb{ctx, 2}; rb.Push(ERROR_INVALID_ALIGNMENT); @@ -255,9 +256,12 @@ public: } // NRO Size or BSS Size is zero or causes overflow - if (nro_addr + nro_size <= nro_addr || nro_size == 0 || (nro_size & 0xFFF) != 0 || - (bss_size != 0 && bss_addr + bss_size <= bss_addr) || - (std::numeric_limits::max() - nro_size < bss_size)) { + const auto nro_size_valid = + nro_size != 0 && nro_addr + nro_size > nro_addr && Common::Is4KBAligned(nro_size); + const auto bss_size_valid = std::numeric_limits::max() - nro_size >= bss_size && + (bss_size == 0 || bss_addr + bss_size > bss_addr); + + if (!nro_size_valid || !bss_size_valid) { LOG_ERROR(Service_LDR, "NRO Size or BSS Size is invalid! (nro_address={:016X}, nro_size={:016X}, " "bss_address={:016X}, bss_size={:016X})", @@ -275,9 +279,9 @@ public: mbedtls_sha256(nro_data.data(), nro_data.size(), hash.data(), 0); // NRO Hash is already loaded - if (std::find_if(nro.begin(), nro.end(), [&hash](const std::pair& info) { + if (std::any_of(nro.begin(), nro.end(), [&hash](const std::pair& info) { return info.second.hash == hash; - }) != nro.end()) { + })) { LOG_ERROR(Service_LDR, "NRO is already loaded!"); IPC::ResponseBuilder rb{ctx, 2}; rb.Push(ERROR_ALREADY_LOADED); @@ -285,11 +289,7 @@ public: } // NRO Hash is not in any loaded NRR - if (std::find_if(nrr.begin(), nrr.end(), - [&hash](const std::pair>& p) { - return std::find(p.second.begin(), p.second.end(), hash) != - p.second.end(); - }) == nrr.end()) { + if (!IsValidNROHash(hash)) { LOG_ERROR(Service_LDR, "NRO hash is not present in any currently loaded NRRs (hash={})!", Common::HexArrayToString(hash)); @@ -301,12 +301,7 @@ public: NROHeader header; std::memcpy(&header, nro_data.data(), sizeof(NROHeader)); - if (header.magic != Common::MakeMagic('N', 'R', 'O', '0') || header.nro_size != nro_size || - header.bss_size != bss_size || - header.ro_offset != header.text_offset + header.text_size || - header.rw_offset != header.ro_offset + header.ro_size || - nro_size != header.rw_offset + header.rw_size || (header.text_size & 0xFFF) != 0 || - (header.ro_size & 0xFFF) != 0 || (header.rw_size & 0xFFF) != 0) { + if (!IsValidNRO(header, nro_size, bss_size)) { LOG_ERROR(Service_LDR, "NRO was invalid!"); IPC::ResponseBuilder rb{ctx, 2}; rb.Push(ERROR_INVALID_NRO); @@ -314,7 +309,7 @@ public: } // Load NRO as new executable module - auto process = Core::CurrentProcess(); + auto* process = Core::CurrentProcess(); auto& vm_manager = process->VMManager(); auto map_address = vm_manager.FindFreeRegion(nro_size + bss_size); @@ -348,6 +343,57 @@ public: rb.Push(RESULT_SUCCESS); rb.Push(*map_address); } + + void UnloadNro(Kernel::HLERequestContext& ctx) { + IPC::RequestParser rp{ctx}; + rp.Skip(2, false); + const VAddr mapped_addr{rp.PopRaw()}; + const VAddr heap_addr{rp.PopRaw()}; + + if (!initialized) { + LOG_ERROR(Service_LDR, "LDR:RO not initialized before use!"); + IPC::ResponseBuilder rb{ctx, 2}; + rb.Push(ERROR_NOT_INITIALIZED); + return; + } + + if (!Common::Is4KBAligned(mapped_addr) || !Common::Is4KBAligned(heap_addr)) { + LOG_ERROR(Service_LDR, + "NRO/BSS Address has invalid alignment (actual nro_addr={:016X}, " + "bss_addr={:016X})!", + mapped_addr, heap_addr); + IPC::ResponseBuilder rb{ctx, 2}; + rb.Push(ERROR_INVALID_ALIGNMENT); + return; + } + + const auto iter = nro.find(mapped_addr); + if (iter == nro.end()) { + LOG_ERROR(Service_LDR, + "The NRO attempting to unmap was not mapped or has an invalid address " + "(actual {:016X})!", + mapped_addr); + IPC::ResponseBuilder rb{ctx, 2}; + rb.Push(ERROR_INVALID_NRO_ADDRESS); + return; + } + + auto* process = Core::CurrentProcess(); + auto& vm_manager = process->VMManager(); + const auto& nro_size = iter->second.size; + + ASSERT(process->MirrorMemory(heap_addr, mapped_addr, nro_size, + Kernel::MemoryState::ModuleCodeStatic) == RESULT_SUCCESS); + ASSERT(process->UnmapMemory(mapped_addr, 0, nro_size) == RESULT_SUCCESS); + + Core::System::GetInstance().ArmInterface(0).ClearInstructionCache(); + Core::System::GetInstance().ArmInterface(1).ClearInstructionCache(); + Core::System::GetInstance().ArmInterface(2).ClearInstructionCache(); + Core::System::GetInstance().ArmInterface(3).ClearInstructionCache(); + + nro.erase(iter); + IPC::ResponseBuilder rb{ctx, 2}; + rb.Push(RESULT_SUCCESS); } void Initialize(Kernel::HLERequestContext& ctx) { @@ -408,6 +454,23 @@ private: std::map nro; std::map> nrr; + + bool IsValidNROHash(const SHA256Hash& hash) { + return std::any_of( + nrr.begin(), nrr.end(), [&hash](const std::pair>& p) { + return std::find(p.second.begin(), p.second.end(), hash) != p.second.end(); + }); + } + + static bool IsValidNRO(const NROHeader& header, u64 nro_size, u64 bss_size) { + return header.magic == Common::MakeMagic('N', 'R', 'O', '0') && + header.nro_size == nro_size && header.bss_size == bss_size && + header.ro_offset == header.text_offset + header.text_size && + header.rw_offset == header.ro_offset + header.ro_size && + nro_size == header.rw_offset + header.rw_size && + Common::Is4KBAligned(header.text_size) && Common::Is4KBAligned(header.ro_size) && + Common::Is4KBAligned(header.rw_size); + } }; void InstallInterfaces(SM::ServiceManager& sm) { From 51af996854ce01da17750b0a1f8d2f3a95449cfc Mon Sep 17 00:00:00 2001 From: Zach Hilman Date: Sat, 17 Nov 2018 21:40:17 -0500 Subject: [PATCH 7/7] ldr_ro: Add error check for memory allocation failure --- src/core/hle/kernel/process.cpp | 4 ++-- src/core/hle/kernel/vm_manager.cpp | 6 +++--- src/core/hle/kernel/vm_manager.h | 3 ++- src/core/hle/service/ldr/ldr.cpp | 27 ++++++++++++++++++++------- 4 files changed, 27 insertions(+), 13 deletions(-) diff --git a/src/core/hle/kernel/process.cpp b/src/core/hle/kernel/process.cpp index f06b6bb55..a257c3726 100644 --- a/src/core/hle/kernel/process.cpp +++ b/src/core/hle/kernel/process.cpp @@ -252,8 +252,8 @@ ResultCode Process::HeapFree(VAddr target, u32 size) { return vm_manager.HeapFree(target, size); } -ResultCode Process::MirrorMemory(VAddr dst_addr, VAddr src_addr, u64 size) { - return vm_manager.MirrorMemory(dst_addr, src_addr, size); +ResultCode Process::MirrorMemory(VAddr dst_addr, VAddr src_addr, u64 size, MemoryState state) { + return vm_manager.MirrorMemory(dst_addr, src_addr, size, state); } ResultCode Process::UnmapMemory(VAddr dst_addr, VAddr /*src_addr*/, u64 size) { diff --git a/src/core/hle/kernel/vm_manager.cpp b/src/core/hle/kernel/vm_manager.cpp index ec7fd6150..100f8f6bf 100644 --- a/src/core/hle/kernel/vm_manager.cpp +++ b/src/core/hle/kernel/vm_manager.cpp @@ -298,7 +298,7 @@ ResultCode VMManager::HeapFree(VAddr target, u64 size) { return RESULT_SUCCESS; } -ResultCode VMManager::MirrorMemory(VAddr dst_addr, VAddr src_addr, u64 size) { +ResultCode VMManager::MirrorMemory(VAddr dst_addr, VAddr src_addr, u64 size, MemoryState state) { const auto vma = FindVMA(src_addr); ASSERT_MSG(vma != vma_map.end(), "Invalid memory address"); @@ -312,8 +312,8 @@ ResultCode VMManager::MirrorMemory(VAddr dst_addr, VAddr src_addr, u64 size) { const std::shared_ptr>& backing_block = vma->second.backing_block; const std::size_t backing_block_offset = vma->second.offset + vma_offset; - CASCADE_RESULT(auto new_vma, MapMemoryBlock(dst_addr, backing_block, backing_block_offset, size, - MemoryState::Mapped)); + CASCADE_RESULT(auto new_vma, + MapMemoryBlock(dst_addr, backing_block, backing_block_offset, size, state)); // Protect mirror with permissions from old region Reprotect(new_vma, vma->second.permissions); // Remove permissions from old region diff --git a/src/core/hle/kernel/vm_manager.h b/src/core/hle/kernel/vm_manager.h index 248cc46dc..d522404fe 100644 --- a/src/core/hle/kernel/vm_manager.h +++ b/src/core/hle/kernel/vm_manager.h @@ -189,7 +189,8 @@ public: ResultVal HeapAllocate(VAddr target, u64 size, VMAPermission perms); ResultCode HeapFree(VAddr target, u64 size); - ResultCode MirrorMemory(VAddr dst_addr, VAddr src_addr, u64 size); + ResultCode MirrorMemory(VAddr dst_addr, VAddr src_addr, u64 size, + MemoryState state = MemoryState::Mapped); /** * Scans all VMAs and updates the page table range of any that use the given vector as backing diff --git a/src/core/hle/service/ldr/ldr.cpp b/src/core/hle/service/ldr/ldr.cpp index 5f020cbe0..b43f1f054 100644 --- a/src/core/hle/service/ldr/ldr.cpp +++ b/src/core/hle/service/ldr/ldr.cpp @@ -18,6 +18,7 @@ namespace Service::LDR { namespace ErrCodes { enum { + InvalidMemoryState = 51, InvalidNRO = 52, InvalidNRR = 53, MissingNRRHash = 54, @@ -32,6 +33,7 @@ enum { }; } +constexpr ResultCode ERROR_INVALID_MEMORY_STATE(ErrorModule::Loader, ErrCodes::InvalidMemoryState); constexpr ResultCode ERROR_INVALID_NRO(ErrorModule::Loader, ErrCodes::InvalidNRO); constexpr ResultCode ERROR_INVALID_NRR(ErrorModule::Loader, ErrCodes::InvalidNRR); constexpr ResultCode ERROR_MISSING_NRR_HASH(ErrorModule::Loader, ErrCodes::MissingNRRHash); @@ -120,7 +122,7 @@ public: return; } - if (nro.size() >= MAXIMUM_LOADED_RO) { + if (nrr.size() >= MAXIMUM_LOADED_RO) { LOG_ERROR(Service_LDR, "Loading new NRR would exceed the maximum number of loaded NRRs " "(0x40)! Failing..."); IPC::ResponseBuilder rb{ctx, 2}; @@ -178,10 +180,13 @@ public: } std::vector hashes; + + // Copy all hashes in the NRR (specified by hash count/hash offset) into vector. for (std::size_t i = header.hash_offset; - i < (header.hash_offset + (header.hash_count << 5)); i += 8) { - hashes.emplace_back(); - std::memcpy(hashes.back().data(), nrr_data.data() + i, sizeof(SHA256Hash)); + i < (header.hash_offset + (header.hash_count * sizeof(SHA256Hash))); i += 8) { + SHA256Hash hash; + std::memcpy(hash.data(), nrr_data.data() + i, sizeof(SHA256Hash)); + hashes.emplace_back(hash); } nrr.insert_or_assign(nrr_addr, std::move(hashes)); @@ -258,8 +263,8 @@ public: // NRO Size or BSS Size is zero or causes overflow const auto nro_size_valid = nro_size != 0 && nro_addr + nro_size > nro_addr && Common::Is4KBAligned(nro_size); - const auto bss_size_valid = std::numeric_limits::max() - nro_size >= bss_size && - (bss_size == 0 || bss_addr + bss_size > bss_addr); + const auto bss_size_valid = + nro_size + bss_size >= nro_size && (bss_size == 0 || bss_addr + bss_size > bss_addr); if (!nro_size_valid || !bss_size_valid) { LOG_ERROR(Service_LDR, @@ -313,7 +318,15 @@ public: auto& vm_manager = process->VMManager(); auto map_address = vm_manager.FindFreeRegion(nro_size + bss_size); - ASSERT(map_address.Succeeded()); + if (!map_address.Succeeded() || + *map_address + nro_size + bss_size > vm_manager.GetAddressSpaceEndAddress()) { + + LOG_ERROR(Service_LDR, + "General error while allocation memory or no available memory to allocate!"); + IPC::ResponseBuilder rb{ctx, 2}; + rb.Push(ERROR_INVALID_MEMORY_STATE); + return; + } ASSERT(process->MirrorMemory(*map_address, nro_addr, nro_size, Kernel::MemoryState::ModuleCodeStatic) == RESULT_SUCCESS);