Skip to content

sharedgpures: keep kernel handles alive and use NtDuplicateObject for cross-process handle transfer#312

Open
avafloww wants to merge 2542 commits intoValveSoftware:bleeding-edgefrom
avafloww:fix/sharedgpures-kernel-handles
Open

sharedgpures: keep kernel handles alive and use NtDuplicateObject for cross-process handle transfer#312
avafloww wants to merge 2542 commits intoValveSoftware:bleeding-edgefrom
avafloww:fix/sharedgpures-kernel-handles

Conversation

@avafloww
Copy link
Copy Markdown

@avafloww avafloww commented Feb 20, 2026

reference_client_handle() closes the duplicated kernel handle immediately after ObReferenceObjectByHandle(), destroying the kernel_object mapping in ntoskrnl's device manager RB tree. When open_client_handle() later calls ObOpenObjectByPointer() to look up the same object, the mapping is gone and the call fails.

Additionally, ntoskrnl has no constructor registered for "Section" type objects, so ObOpenObjectByPointer() cannot create handles for DMA-BUF shared memory sections even when the mapping is present.

Fix both issues by:

  • Keeping kernel handles alive in the shared_resource struct alongside each referenced object
  • Replacing ObOpenObjectByPointer() in open_client_handle() with a direct NtDuplicateObject() from the stored kernel handle
  • Closing stored kernel handles when the shared resource ref_count reaches 0

This is one of two PRs needed to make Wine/Proton & Spout2PW work with VNyan under Linux. The other PR is #313.

bylaws and others added 30 commits November 19, 2025 16:04
This was done for all other architectures but missed for arm64ec

(cherry picked from commit 9aa3003)
No WOA devices ship with SVE, so implementing this correctly by
preserving the SVE state in xstate isn't really viable for now so just
hardcode the FEX values.
Since these are unix pointers passed via the PE side.
I confirmed that ARM64EC BT thread creation callbacks aren't called through
some logging in FEX.
The native arch kernel32.dll isn't loaded in WOW64 mode, but threads can still
be created if the SKIP_LOADER_INIT flag is set, provide a default implementation
to support this.
Suspension in JITs cannot easily be handled on the unix side, so allow BT
modules to provide their own suspend helper.

Link: https://gitlab.winehq.org/wine/wine/-/merge_requests/6841
Works around broken variadic exit thunks.
If old_prot points to memory that is write-protected by the JIT, then writes to
it need to be performed on the PE-side to avoid a syscall fault that can't be
handled. Fixes Peggle Deluxe.
rbernon and others added 28 commits January 30, 2026 10:35
Otherwise build_import_name will access OOB when reading the dll name.

CW-Bug-Id: #24534
Fixes matching timezones Asia/Dili, Asia/Jayapura, Etc/GMT-9, Pacific/Palau.

CW-Bug-Id: #26597
Fixes Australia/Lord_Howe timezone match.

CW-Bug-Id: #26597
Prevents crashing in test_h264_decoder_concat_streams() when too many
samples are emitted.

(cherry picked from commit 5ae5529)
(cherry picked from commit 3a15667)
(cherry picked from commit a075e16)
(cherry picked from commit b81fd64)
(cherry picked from commit 9d3b180)
Performance issues can occur when a video output sample has a 2D buffer,
because winegstreamer currently outputs only to a linear buffer, which
must then be copied into the 2D buffer. Worse, a linear lock of the 2D
buffer requires the current contents to be copied to a linear buffer,
even when we intend to overwrite it, because MF linear buffers do not
support write-only locking.

(cherry picked from commit b55b239)

CW-Bug-Id: #25609 #25788 #25560
Support has been added from upstream for writing 2D buffers.

CW-Bug-Id: #25609 #25788 #25560
(cherry picked from commit 964cd76)

CW-Bug-Id: #26633
Followup of 964cd76.

(cherry picked from commit 0093652)

CW-Bug-Id: #26633
… cross-process handle transfer

reference_client_handle() closes the duplicated kernel handle immediately
after ObReferenceObjectByHandle(), destroying the kernel_object mapping
in ntoskrnl's device manager RB tree. When open_client_handle() later
calls ObOpenObjectByPointer() to look up the same object, the mapping is
gone and the call fails.

Additionally, ntoskrnl has no constructor registered for "Section" type
objects, so ObOpenObjectByPointer() cannot create handles for DMA-BUF
shared memory sections even when the mapping is present.

Fix both issues by:
- Keeping kernel handles alive in the shared_resource struct alongside
  each referenced object
- Replacing ObOpenObjectByPointer() in open_client_handle() with a
  direct NtDuplicateObject() from the stored kernel handle
- Closing stored kernel handles when the shared resource ref_count
  reaches 0
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.