Skip to content

Fix synthetic SIF RPC server memory aliasing - #217

Open
GTTeancum wants to merge 1 commit into
ran-j:mainfrom
GTTeancum:fix/synthetic-rpc-server
Open

Fix synthetic SIF RPC server memory aliasing#217
GTTeancum wants to merge 1 commit into
ran-j:mainfrom
GTTeancum:fix/synthetic-rpc-server

Conversation

@GTTeancum

Copy link
Copy Markdown

Summary

  • mark placeholder SIF RPC servers as synthetic in host state
  • avoid reading mutable guest-memory fields from synthetic descriptors during bind/call
  • preserve normal guest server descriptor behavior for registered RPC servers
  • add a regression test that overwrites a placeholder descriptor and verifies it cannot redirect a payload copy into unrelated EE memory

Why

Placeholder servers are allocated inside EE RDRAM so guest bind loops receive a nonzero server pointer. A game can later reuse that address. SifCallRpc previously trusted the overwritten descriptor's buf field and copied request data to that stale destination, corrupting unrelated live game objects.

Testing

  • MINITEST_FILTER=synthetic RPC server ignores: 1/1 passed
  • MINITEST_FILTER=PS2SifRpc: 18/18 passed
  • integration boot probe: 578 calls to the affected synthetic controller RPC with zero writes to the previously corrupted object

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant