Files
ppsspp/Core/MIPS/RiscV/RiscVAsm.cpp
T
Henrik RydgårdandClaude Opus 5.5 6d122f416e Keep JIT block entries and replacement hooks out of PSP memory
The JITs used to find a block by overwriting its first instruction with an "emuhack" holding
the offset into the code space, and replacement functions installed their own emuhack the same
way. Anything that read code (savestates, the debugger, memory dumps, cheats, the function
hasher, games reading their own code) had to translate them back.

Blocks now live in a block shadow: one u32 per guest instruction, indexed by the PC masked with
BLOCK_SHADOW_MASK (1GB on 64-bit, folding the kernel and uncached mirrors; 256MB on 32-bit, iOS
and Switch, where address space is short), with the low bits cleared so a misaligned PC can't
read across two entries. Only the ranges under memory views are committed, so a bad PC still
faults in the dispatcher, and the shadow is reserved before the memory map so it can't land in
a gap of the 4GB window. Entries hold full 32-bit offsets, lifting the 16MB limit. The
dispatchers on every backend, and the IR interpreter's loop, look blocks up there.

A hooked instruction without a compiled block gets the JIT's hook value in its entry: the offset
of the dispatcher's compile path (1 for the interpreters, the IR arena keeping that offset
empty), so dispatching there compiles a block, and the frontends substitute the hook. Compiling
replaces the entry with the block's, and destroying the block puts the hook value back. The hook
value is rewritten when the JIT changes or regenerates its dispatcher.

Hooks live in a map keyed by the masked address, and are dropped when the game overwrites the
hooked instruction, or when an icache invalidation finds the function's hash (immediates masked,
as when matching it) changed. Those checks run when queued invalidations are processed, since
cheats and the debugger queue them before writing. Installing and removing hooks invalidates
deferred, as it happens in HLE calls that can run inside a block. The cache instruction goes
through MIPSState, so it drops changed hooks too.

With clean memory, the save/clear/restore around savestates, memory reads and dumps goes away,
as do the source-range invalidations in the memcpy replacements, sceDmac and the cheats.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
2026-10-11 10:33:30 +02:00

259 lines
8.3 KiB
C++

// Copyright (c) 2023- PPSSPP Project.
// This program is free software: you can redistribute it and/or modify
// it under the terms of the GNU General Public License as published by
// the Free Software Foundation, version 2.0 or later versions.
// This program is distributed in the hope that it will be useful,
// but WITHOUT ANY WARRANTY; without even the implied warranty of
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
// GNU General Public License 2.0 for more details.
// A copy of the GPL 2.0 should have been included with the program.
// If not, see http://www.gnu.org/licenses/
// Official git repository and contact information can be found at
// https://github.com/hrydgard/ppsspp and http://www.ppsspp.org/.
#include "Common/Log.h"
#include "Core/CoreTiming.h"
#include "Core/MemMap.h"
#include "Core/MIPS/RiscV/RiscVJit.h"
#include "Core/MIPS/RiscV/RiscVRegCache.h"
#include "Core/MIPS/JitCommon/JitCommon.h"
#include "Core/MIPS/JitCommon/JitState.h"
#include "Core/Core.h"
namespace MIPSComp {
using namespace RiscVGen;
using namespace RiscVJitConstants;
static const bool enableDebug = false;
static const bool enableDisasm = false;
static void ShowPC(u32 downcount, void *membase, void *jitbase) {
static int count = 0;
if (currentMIPS) {
ERROR_LOG(Log::JIT, "[%08x] ShowPC Downcount : %08x %d %p %p", currentMIPS->pc, downcount, count, membase, jitbase);
} else {
ERROR_LOG(Log::JIT, "Universe corrupt?");
}
//if (count > 2000)
// exit(0);
count++;
}
void RiscVJitBackend::GenerateFixedCode(MIPSState *mipsState) {
// This will be used as a writable scratch area, always 32-bit accessible.
const u8 *start = AlignCodePage();
if (DebugProfilerEnabled()) {
ProtectMemoryPages(start, GetMemoryProtectPageSize(), MEM_PROT_READ | MEM_PROT_WRITE);
hooks_.profilerPC = (uint32_t *)GetWritableCodePtr();
*hooks_.profilerPC = 0;
hooks_.profilerStatus = (IRProfilerStatus *)GetWritableCodePtr() + 1;
*hooks_.profilerStatus = IRProfilerStatus::NOT_RUNNING;
SetCodePointer(GetCodePtr() + sizeof(uint32_t) * 2, GetWritableCodePtr() + sizeof(uint32_t) * 2);
}
const u8 *disasmStart = AlignCodePage();
BeginWrite(GetMemoryProtectPageSize());
if (jo.useStaticAlloc) {
saveStaticRegisters_ = AlignCode16();
SW(DOWNCOUNTREG, CTXREG, offsetof(MIPSState, downcount));
regs_.EmitSaveStaticRegisters();
RET();
loadStaticRegisters_ = AlignCode16();
regs_.EmitLoadStaticRegisters();
LW(DOWNCOUNTREG, CTXREG, offsetof(MIPSState, downcount));
RET();
} else {
saveStaticRegisters_ = nullptr;
loadStaticRegisters_ = nullptr;
}
applyRoundingMode_ = AlignCode16();
{
// Not sure if RISC-V has any flush to zero capability? Leaving it off for now...
LWU(SCRATCH2, CTXREG, offsetof(MIPSState, fcr31));
// FSRM only takes the low three bits, and fcr31 has plenty of other bits set (the flags
// at 2-6, for one) - without this we'd hand it a reserved rounding mode.
ANDI(SCRATCH2, SCRATCH2, 3);
// We can skip if the rounding mode is nearest (0) and flush is not set.
// (as restoreRoundingMode cleared it out anyway)
FixupBranch skip = BEQ(SCRATCH2, R_ZERO);
// MIPS Rounding Mode: RISC-V
// 0: Round nearest 0
// 1: Round to zero 1
// 2: Round up (ceil) 3
// 3: Round down (floor) 2
if (cpu_info.RiscV_Zbs) {
BEXTI(SCRATCH1, SCRATCH2, 1);
} else {
ANDI(SCRATCH1, SCRATCH2, 2);
SRLI(SCRATCH1, SCRATCH1, 1);
}
// Swap the lowest bit by the second bit.
XOR(SCRATCH2, SCRATCH2, SCRATCH1);
FSRM(SCRATCH2);
SetJumpTarget(skip);
RET();
}
hooks_.enterDispatcher = (IRNativeFuncNoArg)AlignCode16();
// Start by saving some regs on the stack. There are 12 GPs and 12 FPs we want.
// Note: we leave R_SP as, well, SP, so it doesn't need to be saved.
_assert_msg_(cpu_info.Mode64bit, "RiscVAsm currently assumes RV64, not RV32 or RV128");
static constexpr RiscVReg regs_to_save[]{ R_RA, X8, X9, X18, X19, X20, X21, X22, X23, X24, X25, X26, X27 };
// TODO: Maybe we shouldn't regalloc all of these? Is it worth it?
static constexpr RiscVReg regs_to_save_fp[]{ F8, F9, F18, F19, F20, F21, F22, F23, F24, F25, F26, F27 };
int saveSize = (XLEN / 8) * (int)(ARRAY_SIZE(regs_to_save) + ARRAY_SIZE(regs_to_save_fp));
if (saveSize & 0xF)
saveSize += 8;
_assert_msg_((saveSize & 0xF) == 0, "Stack must be kept aligned");
int saveOffset = 0;
ADDI(R_SP, R_SP, -saveSize);
for (RiscVReg r : regs_to_save) {
SD(r, R_SP, saveOffset);
saveOffset += XLEN / 8;
}
for (RiscVReg r : regs_to_save_fp) {
FS(64, r, R_SP, saveOffset);
saveOffset += XLEN / 8;
}
_assert_(saveOffset <= saveSize);
// Fixed registers, these are always kept when in Jit context.
LI(MEMBASEREG, Memory::base, SCRATCH1);
LI(CTXREG, mipsState, SCRATCH1);
LI(JITBASEREG, GetBasePtr(), SCRATCH1);
LoadStaticRegisters();
WriteDebugProfilerStatus(IRProfilerStatus::IN_JIT);
MovFromPC(SCRATCH1);
WriteDebugPC(SCRATCH1);
outerLoopPCInSCRATCH1_ = GetCodePtr();
MovToPC(SCRATCH1);
outerLoop_ = GetCodePtr();
// Advance can change the downcount (or thread), so must save/restore around it.
SaveStaticRegisters();
RestoreRoundingMode(true);
WriteDebugProfilerStatus(IRProfilerStatus::TIMER_ADVANCE);
QuickCallFunctionR(&CoreTiming::Advance, CTXREG, X7);
WriteDebugProfilerStatus(IRProfilerStatus::IN_JIT);
ApplyRoundingMode(true);
LoadStaticRegisters();
dispatcherCheckCoreState_ = GetCodePtr();
LI(SCRATCH1, &coreState, SCRATCH2);
LW(SCRATCH1, SCRATCH1, 0);
FixupBranch badCoreState = BNE(SCRATCH1, R_ZERO);
// We just checked coreState, so go to advance if downcount is negative.
BLT(DOWNCOUNTREG, R_ZERO, outerLoop_);
FixupBranch skipToRealDispatch = J();
dispatcherPCInSCRATCH1_ = GetCodePtr();
MovToPC(SCRATCH1);
hooks_.dispatcher = GetCodePtr();
FixupBranch bail = BLT(DOWNCOUNTREG, R_ZERO);
SetJumpTarget(skipToRealDispatch);
dispatcherNoCheck_ = GetCodePtr();
// Debug
if (enableDebug) {
MV(X10, DOWNCOUNTREG);
MV(X11, MEMBASEREG);
MV(X12, JITBASEREG);
QuickCallFunction(&ShowPC, X7);
}
LWU(SCRATCH1, CTXREG, offsetof(MIPSState, pc));
WriteDebugPC(SCRATCH1);
LI(SCRATCH2, (u32)Memory::BLOCK_SHADOW_ENTRY_MASK);
AND(SCRATCH1, SCRATCH1, SCRATCH2);
LI(SCRATCH2, Memory::blockShadow, X7);
ADD(SCRATCH1, SCRATCH1, SCRATCH2);
hooks_.dispatchFetch = GetCodePtr();
LWU(SCRATCH1, SCRATCH1, 0);
// The entry is the block's offset into the code space, or 0 for none.
FixupBranch needsCompile = BEQ(SCRATCH1, R_ZERO);
ADD(SCRATCH1, JITBASEREG, SCRATCH1);
JR(SCRATCH1);
SetJumpTarget(needsCompile);
// No block found, let's jit. We don't need to save static regs, they're all callee saved.
// A replacement hook's block shadow entry jumps here too (GetBlockShadowHookValue()). JitAt
// replaces it with the new block's entry, and destroying that block puts the hook value back.
hooks_.blockShadowHook = GetCodePtr();
RestoreRoundingMode(true);
WriteDebugProfilerStatus(IRProfilerStatus::COMPILING);
QuickCallFunctionR(&MIPSComp::JitAt, CTXREG, X7);
WriteDebugProfilerStatus(IRProfilerStatus::IN_JIT);
ApplyRoundingMode(true);
// Try again, the block index should be set now.
J(dispatcherNoCheck_);
SetJumpTarget(bail);
LI(SCRATCH1, &coreState, SCRATCH2);
LW(SCRATCH1, SCRATCH1, 0);
BEQ(SCRATCH1, R_ZERO, outerLoop_);
const uint8_t *quitLoop = GetCodePtr();
SetJumpTarget(badCoreState);
WriteDebugProfilerStatus(IRProfilerStatus::NOT_RUNNING);
SaveStaticRegisters();
RestoreRoundingMode(true);
_assert_msg_(cpu_info.Mode64bit, "RiscVAsm currently assumes RV64, not RV32 or RV128");
saveOffset = 0;
for (RiscVReg r : regs_to_save) {
LD(r, R_SP, saveOffset);
saveOffset += XLEN / 8;
}
for (RiscVReg r : regs_to_save_fp) {
FL(64, r, R_SP, saveOffset);
saveOffset += XLEN / 8;
}
ADDI(R_SP, R_SP, saveSize);
RET();
hooks_.crashHandler = GetCodePtr();
LI(SCRATCH1, &coreState, SCRATCH2);
LI(SCRATCH2, CORE_RUNTIME_ERROR);
SW(SCRATCH2, SCRATCH1, 0);
J(quitLoop);
// Leave this at the end, add more stuff above.
if (enableDisasm) {
#if PPSSPP_ARCH(RISCV64)
std::vector<std::string> lines = DisassembleRV64(start, GetCodePtr() - start);
for (auto s : lines) {
INFO_LOG(Log::JIT, "%s", s.c_str());
}
#endif
}
// Let's spare the pre-generated code from unprotect-reprotect.
AlignCodePage();
jitStartOffset_ = (int)(GetCodePtr() - start);
// Don't forget to zap the instruction cache! This must stay at the end of this function.
FlushIcache();
EndWrite();
}
} // namespace MIPSComp