fx

Signed-off-by: lizzie <lizzie@eden-emu.dev>

src/common/CMakeLists.txt

@@ -63,6 +63,8 @@ add_library(
     fs/path_util.cpp
     fs/path_util.h
     hash.h
+    heap_tracker.cpp
+    heap_tracker.h
     hex_util.cpp
     hex_util.h
     host_memory.cpp

src/common/heap_tracker.cpp

@@ -0,0 +1,282 @@
+// SPDX-FileCopyrightText: Copyright 2026 Eden Emulator Project
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+// SPDX-FileCopyrightText: Copyright 2023 yuzu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+#include <fstream>
+#include "common/heap_tracker.h"
+#include "common/logging.h"
+#include "common/assert.h"
+
+namespace Common {
+
+namespace {
+
+s64 GetMaxPermissibleResidentMapCount() {
+    // Default value.
+    s64 value = 65530;
+
+    // Try to read how many mappings we can make.
+    std::ifstream s("/proc/sys/vm/max_map_count");
+    s >> value;
+
+    // Print, for debug.
+    LOG_INFO(HW_Memory, "Current maximum map count: {}", value);
+
+    // Allow 20000 maps for other code and to account for split inaccuracy.
+    return std::max<s64>(value - 20000, 0);
+}
+
+} // namespace
+
+HeapTracker::HeapTracker(Common::HostMemory& buffer)
+    : m_buffer(buffer), m_max_resident_map_count(GetMaxPermissibleResidentMapCount()) {}
+HeapTracker::~HeapTracker() = default;
+
+void HeapTracker::Map(size_t virtual_offset, size_t host_offset, size_t length,
+                      MemoryPermission perm, bool is_separate_heap) {
+    // When mapping other memory, map pages immediately.
+    if (!is_separate_heap) {
+        m_buffer.Map(virtual_offset, host_offset, length, perm, false);
+        return;
+    }
+
+    {
+        // We are mapping part of a separate heap.
+        std::scoped_lock lk{m_lock};
+
+        auto* const map = new SeparateHeapMap{
+            .vaddr = virtual_offset,
+            .paddr = host_offset,
+            .size = length,
+            .tick = m_tick++,
+            .perm = perm,
+            .is_resident = false,
+        };
+
+        // Insert into mappings.
+        m_map_count++;
+        m_mappings.insert(*map);
+    }
+
+    // Finally, map.
+    this->DeferredMapSeparateHeap(virtual_offset);
+}
+
+void HeapTracker::Unmap(size_t virtual_offset, size_t size, bool is_separate_heap) {
+    // If this is a separate heap...
+    if (is_separate_heap) {
+        std::scoped_lock lk{m_lock};
+
+        const SeparateHeapMap key{
+            .vaddr = virtual_offset,
+        };
+
+        // Split at the boundaries of the region we are removing.
+        this->SplitHeapMapLocked(virtual_offset);
+        this->SplitHeapMapLocked(virtual_offset + size);
+
+        // Erase all mappings in range.
+        auto it = m_mappings.find(key);
+        while (it != m_mappings.end() && it->vaddr < virtual_offset + size) {
+            // Get underlying item.
+            auto* const item = std::addressof(*it);
+
+            // If resident, erase from resident map.
+            if (item->is_resident) {
+                ASSERT(--m_resident_map_count >= 0);
+                m_resident_mappings.erase(m_resident_mappings.iterator_to(*item));
+            }
+
+            // Erase from map.
+            ASSERT(--m_map_count >= 0);
+            it = m_mappings.erase(it);
+
+            // Free the item.
+            delete item;
+        }
+    }
+
+    // Unmap pages.
+    m_buffer.Unmap(virtual_offset, size, false);
+}
+
+void HeapTracker::Protect(size_t virtual_offset, size_t size, MemoryPermission perm) {
+    // Ensure no rebuild occurs while reprotecting.
+    std::shared_lock lk{m_rebuild_lock};
+
+    // Split at the boundaries of the region we are reprotecting.
+    this->SplitHeapMap(virtual_offset, size);
+
+    // Declare tracking variables.
+    const VAddr end = virtual_offset + size;
+    VAddr cur = virtual_offset;
+
+    while (cur < end) {
+        VAddr next = cur;
+        bool should_protect = false;
+
+        {
+            std::scoped_lock lk2{m_lock};
+
+            const SeparateHeapMap key{
+                .vaddr = next,
+            };
+
+            // Try to get the next mapping corresponding to this address.
+            const auto it = m_mappings.nfind(key);
+
+            if (it == m_mappings.end()) {
+                // There are no separate heap mappings remaining.
+                next = end;
+                should_protect = true;
+            } else if (it->vaddr == cur) {
+                // We are in range.
+                // Update permission bits.
+                it->perm = perm;
+
+                // Determine next address and whether we should protect.
+                next = cur + it->size;
+                should_protect = it->is_resident;
+            } else /* if (it->vaddr > cur) */ {
+                // We weren't in range, but there is a block coming up that will be.
+                next = it->vaddr;
+                should_protect = true;
+            }
+        }
+
+        // Clamp to end.
+        next = (std::min)(next, end);
+        // Reprotect, if we need to.
+        if (should_protect) {
+            m_buffer.Protect(cur, next - cur, perm);
+        }
+
+        // Advance.
+        cur = next;
+    }
+}
+
+bool HeapTracker::DeferredMapSeparateHeap(u8* fault_address) {
+    if (m_buffer.IsInVirtualRange(fault_address)) {
+        return this->DeferredMapSeparateHeap(fault_address - m_buffer.VirtualBasePointer());
+    }
+
+    return false;
+}
+
+bool HeapTracker::DeferredMapSeparateHeap(size_t virtual_offset) {
+    bool rebuild_required = false;
+
+    {
+        std::scoped_lock lk{m_lock};
+
+        // Check to ensure this was a non-resident separate heap mapping.
+        const auto it = this->GetNearestHeapMapLocked(virtual_offset);
+        if (it == m_mappings.end() || it->is_resident) {
+            return false;
+        }
+
+        // Update tick before possible rebuild.
+        it->tick = m_tick++;
+
+        // Check if we need to rebuild.
+        if (m_resident_map_count > m_max_resident_map_count) {
+            rebuild_required = true;
+        }
+
+        // Map the area.
+        m_buffer.Map(it->vaddr, it->paddr, it->size, it->perm, false);
+
+        // This map is now resident.
+        it->is_resident = true;
+        m_resident_map_count++;
+        m_resident_mappings.insert(*it);
+    }
+
+    if (rebuild_required) {
+        // A rebuild was required, so perform it now.
+        this->RebuildSeparateHeapAddressSpace();
+    }
+
+    return true;
+}
+
+void HeapTracker::RebuildSeparateHeapAddressSpace() {
+    std::scoped_lock lk{m_rebuild_lock, m_lock};
+
+    ASSERT(!m_resident_mappings.empty());
+
+    // Dump half of the mappings.
+    //
+    // Despite being worse in theory, this has proven to be better in practice than more
+    // regularly dumping a smaller amount, because it significantly reduces average case
+    // lock contention.
+    std::size_t const desired_count = (std::min)(m_resident_map_count, m_max_resident_map_count) / 2;
+    std::size_t const evict_count = m_resident_map_count - desired_count;
+    auto it = m_resident_mappings.begin();
+
+    for (size_t i = 0; i < evict_count && it != m_resident_mappings.end(); i++) {
+        // Unmark and unmap.
+        it->is_resident = false;
+        m_buffer.Unmap(it->vaddr, it->size, false);
+
+        // Advance.
+        ASSERT(--m_resident_map_count >= 0);
+        it = m_resident_mappings.erase(it);
+    }
+}
+
+void HeapTracker::SplitHeapMap(VAddr offset, size_t size) {
+    std::scoped_lock lk{m_lock};
+
+    this->SplitHeapMapLocked(offset);
+    this->SplitHeapMapLocked(offset + size);
+}
+
+void HeapTracker::SplitHeapMapLocked(VAddr offset) {
+    const auto it = this->GetNearestHeapMapLocked(offset);
+    if (it == m_mappings.end() || it->vaddr == offset) {
+        // Not contained or no split required.
+        return;
+    }
+
+    // Cache the original values.
+    auto* const left = std::addressof(*it);
+    const size_t orig_size = left->size;
+
+    // Adjust the left map.
+    const size_t left_size = offset - left->vaddr;
+    left->size = left_size;
+
+    // Create the new right map.
+    auto* const right = new SeparateHeapMap{
+        .vaddr = left->vaddr + left_size,
+        .paddr = left->paddr + left_size,
+        .size = orig_size - left_size,
+        .tick = left->tick,
+        .perm = left->perm,
+        .is_resident = left->is_resident,
+    };
+
+    // Insert the new right map.
+    m_map_count++;
+    m_mappings.insert(*right);
+
+    // If resident, also insert into resident map.
+    if (right->is_resident) {
+        m_resident_map_count++;
+        m_resident_mappings.insert(*right);
+    }
+}
+
+HeapTracker::AddrTree::iterator HeapTracker::GetNearestHeapMapLocked(VAddr offset) {
+    const SeparateHeapMap key{
+        .vaddr = offset,
+    };
+
+    return m_mappings.find(key);
+}
+
+} // namespace Common

src/common/heap_tracker.h

@@ -0,0 +1,98 @@
+// SPDX-FileCopyrightText: Copyright 2023 yuzu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+#pragma once
+
+#include <atomic>
+#include <mutex>
+#include <set>
+#include <shared_mutex>
+
+#include "common/host_memory.h"
+#include "common/intrusive_red_black_tree.h"
+
+namespace Common {
+
+struct SeparateHeapMap {
+    Common::IntrusiveRedBlackTreeNode addr_node{};
+    Common::IntrusiveRedBlackTreeNode tick_node{};
+    VAddr vaddr{};
+    PAddr paddr{};
+    size_t size{};
+    size_t tick{};
+    MemoryPermission perm{};
+    bool is_resident{};
+};
+
+struct SeparateHeapMapAddrComparator {
+    static constexpr int Compare(const SeparateHeapMap& lhs, const SeparateHeapMap& rhs) {
+        if (lhs.vaddr < rhs.vaddr) {
+            return -1;
+        } else if (lhs.vaddr <= (rhs.vaddr + rhs.size - 1)) {
+            return 0;
+        } else {
+            return 1;
+        }
+    }
+};
+
+struct SeparateHeapMapTickComparator {
+    static constexpr int Compare(const SeparateHeapMap& lhs, const SeparateHeapMap& rhs) {
+        if (lhs.tick < rhs.tick) {
+            return -1;
+        } else if (lhs.tick > rhs.tick) {
+            return 1;
+        } else {
+            return SeparateHeapMapAddrComparator::Compare(lhs, rhs);
+        }
+    }
+};
+
+class HeapTracker {
+public:
+    explicit HeapTracker(Common::HostMemory& buffer);
+    ~HeapTracker();
+
+    void Map(size_t virtual_offset, size_t host_offset, size_t length, MemoryPermission perm,
+             bool is_separate_heap);
+    void Unmap(size_t virtual_offset, size_t size, bool is_separate_heap);
+    void Protect(size_t virtual_offset, size_t length, MemoryPermission perm);
+    u8* VirtualBasePointer() {
+        return m_buffer.VirtualBasePointer();
+    }
+
+    bool DeferredMapSeparateHeap(u8* fault_address);
+    bool DeferredMapSeparateHeap(size_t virtual_offset);
+
+private:
+    using AddrTreeTraits =
+        Common::IntrusiveRedBlackTreeMemberTraitsDeferredAssert<&SeparateHeapMap::addr_node>;
+    using AddrTree = AddrTreeTraits::TreeType<SeparateHeapMapAddrComparator>;
+
+    using TickTreeTraits =
+        Common::IntrusiveRedBlackTreeMemberTraitsDeferredAssert<&SeparateHeapMap::tick_node>;
+    using TickTree = TickTreeTraits::TreeType<SeparateHeapMapTickComparator>;
+
+    AddrTree m_mappings{};
+    TickTree m_resident_mappings{};
+
+private:
+    void SplitHeapMap(VAddr offset, size_t size);
+    void SplitHeapMapLocked(VAddr offset);
+
+    AddrTree::iterator GetNearestHeapMapLocked(VAddr offset);
+
+    void RebuildSeparateHeapAddressSpace();
+
+private:
+    Common::HostMemory& m_buffer;
+    const s64 m_max_resident_map_count;
+
+    std::shared_mutex m_rebuild_lock{};
+    std::mutex m_lock{};
+    s64 m_map_count{};
+    s64 m_resident_map_count{};
+    size_t m_tick{};
+};
+
+} // namespace Common

src/core/hle/service/nvdrv/core/nvmap.cpp

@@ -25,42 +25,33 @@ NvMap::Handle::Handle(u64 size_, Id id_)
     flags.raw = 0;
 }
 
-NvResult NvMap::Handle::Alloc(Flags pFlags, u32 pAlign, u8 pKind, u64 pAddress,
-                              NvCore::SessionId pSessionId) {
-    std::scoped_lock lock(mutex);
+NvResult NvMap::Handle::Alloc(Flags pFlags, u32 pAlign, u8 pKind, u64 pAddress, NvCore::SessionId pSessionId) {
     // Handles cannot be allocated twice
     if (allocated) {
         return NvResult::AccessDenied;
     }
-
     flags = pFlags;
     kind = pKind;
     align = pAlign < YUZU_PAGESIZE ? YUZU_PAGESIZE : pAlign;
     session_id = pSessionId;
-
     // This flag is only applicable for handles with an address passed
     if (pAddress) {
         flags.keep_uncached_after_free.Assign(0);
     } else {
-        LOG_CRITICAL(Service_NVDRV,
-                     "Mapping nvmap handles without a CPU side address is unimplemented!");
+        LOG_CRITICAL(Service_NVDRV, "Mapping nvmap handles without a CPU side address is unimplemented!");
     }
-
     size = Common::AlignUp(size, YUZU_PAGESIZE);
     aligned_size = Common::AlignUp(size, align);
     address = pAddress;
     allocated = true;
-
     return NvResult::Success;
 }
 
 NvResult NvMap::Handle::Duplicate(bool internal_session) {
-    std::scoped_lock lock(mutex);
     // Unallocated handles cannot be duplicated as duplication requires memory accounting (in HOS)
     if (!allocated) [[unlikely]] {
         return NvResult::BadValue;
     }
-
     // If we internally use FromId the duplication tracking of handles won't work accurately due to
     // us not implementing per-process handle refs.
     if (internal_session) {
@@ -68,16 +59,14 @@ NvResult NvMap::Handle::Duplicate(bool internal_session) {
     } else {
         dupes++;
     }
-
     return NvResult::Success;
 }
 
 NvMap::NvMap(Container& core_, Tegra::Host1x::Host1x& host1x_) : host1x{host1x_}, core{core_} {}
 
-void NvMap::AddHandle(std::shared_ptr<Handle> handle_description) {
-    std::scoped_lock lock(handles_lock);
-
-    handles.emplace(handle_description->id, std::move(handle_description));
+void NvMap::AddHandle(Handle&& handle_description) {
+    std::scoped_lock l(handles_lock);
+    handles.insert_or_assign(handle_description.id, std::move(handle_description));
 }
 
 void NvMap::UnmapHandle(Handle& handle_description) {
@@ -116,57 +105,48 @@ void NvMap::UnmapHandle(Handle& handle_description) {
 bool NvMap::TryRemoveHandle(const Handle& handle_description) {
     // No dupes left, we can remove from handle map
     if (handle_description.dupes == 0 && handle_description.internal_dupes == 0) {
-        std::scoped_lock lock(handles_lock);
-
-        auto it{handles.find(handle_description.id)};
+        std::scoped_lock l(handles_lock);
+        auto it = handles.find(handle_description.id);
         if (it != handles.end()) {
             handles.erase(it);
         }
-
         return true;
     } else {
         return false;
     }
 }
 
-NvResult NvMap::CreateHandle(u64 size, std::shared_ptr<NvMap::Handle>& result_out) {
-    if (!size) [[unlikely]] {
+NvResult NvMap::CreateHandle(u64 size, Handle::Id& out_handle) {
+    if (!Common::AlignUp(size, YUZU_PAGESIZE)) {
         return NvResult::BadValue;
     }
-
-    u32 id{next_handle_id.fetch_add(HandleIdIncrement, std::memory_order_relaxed)};
-    auto handle_description{std::make_shared<Handle>(size, id)};
-    AddHandle(handle_description);
-
-    result_out = handle_description;
+    u32 id = next_handle_id.fetch_add(HandleIdIncrement, std::memory_order_relaxed);
+    AddHandle(Handle(size, id));
+    out_handle = id;
     return NvResult::Success;
 }
 
-std::shared_ptr<NvMap::Handle> NvMap::GetHandle(Handle::Id handle) {
-    std::scoped_lock lock(handles_lock);
-    try {
-        return handles.at(handle);
-    } catch (std::out_of_range&) {
-        return nullptr;
-    }
+std::optional<std::reference_wrapper<NvMap::Handle>> NvMap::GetHandle(Handle::Id handle) {
+    if (auto const it = handles.find(handle); it != handles.end())
+        return {it->second};
+    return std::nullopt;
 }
 
 DAddr NvMap::GetHandleAddress(Handle::Id handle) {
-    std::scoped_lock lock(handles_lock);
-    try {
-        return handles.at(handle)->d_address;
-    } catch (std::out_of_range&) {
-        return 0;
-    }
+    if (auto const it = handles.find(handle); it != handles.end())
+        return it->second.d_address;
+    return 0;
 }
 
 DAddr NvMap::PinHandle(NvMap::Handle::Id handle, bool low_area_pin) {
-    auto handle_description{GetHandle(handle)};
-    if (!handle_description) [[unlikely]] {
+    std::scoped_lock lock(handles_lock);
+    auto o = GetHandle(handle);
+    if (!o) [[unlikely]] {
         return 0;
     }
 
-    std::scoped_lock lock(handle_description->mutex);
+    auto handle_description = &o->get();
+
     const auto map_low_area = [&] {
         if (handle_description->pin_virt_address == 0) {
             u32 address = host1x.Allocator().Allocate(u32(handle_description->aligned_size));
@@ -180,17 +160,15 @@ DAddr NvMap::PinHandle(NvMap::Handle::Id handle, bool low_area_pin) {
         {
             // Lock now to prevent our queue entry from being removed for allocation in-between the
             // following check and erase
-            std::scoped_lock queueLock(unmap_queue_lock);
+            std::scoped_lock ql(unmap_queue_lock);
             if (handle_description->unmap_queue_entry) {
                 unmap_queue.erase(*handle_description->unmap_queue_entry);
                 handle_description->unmap_queue_entry.reset();
-
                 if (low_area_pin) {
                     map_low_area();
                     handle_description->pins++;
-                    return static_cast<DAddr>(handle_description->pin_virt_address);
+                    return DAddr(handle_description->pin_virt_address);
                 }
-
                 handle_description->pins++;
                 return handle_description->d_address;
             }
@@ -211,12 +189,11 @@ DAddr NvMap::PinHandle(NvMap::Handle::Id handle, bool low_area_pin) {
             while ((address = smmu.Allocate(aligned_up)) == 0) {
                 // Free handles until the allocation succeeds
                 std::scoped_lock queueLock(unmap_queue_lock);
-                if (auto freeHandleDesc{unmap_queue.front()}) {
+                if (auto free_handle = handles.find(unmap_queue.front()); free_handle != handles.end()) {
                     // Handles in the unmap queue are guaranteed not to be pinned so don't bother
                     // checking if they are before unmapping
-                    std::scoped_lock freeLock(freeHandleDesc->mutex);
                     if (handle_description->d_address)
-                        UnmapHandle(*freeHandleDesc);
+                        UnmapHandle(free_handle->second);
                 } else {
                     LOG_CRITICAL(Service_NVDRV, "Ran out of SMMU address space!");
                 }
@@ -234,51 +211,44 @@ DAddr NvMap::PinHandle(NvMap::Handle::Id handle, bool low_area_pin) {
 
     handle_description->pins++;
     if (low_area_pin) {
-        return static_cast<DAddr>(handle_description->pin_virt_address);
+        return DAddr(handle_description->pin_virt_address);
     }
     return handle_description->d_address;
 }
 
 void NvMap::UnpinHandle(Handle::Id handle) {
-    auto handle_description{GetHandle(handle)};
-    if (!handle_description) {
-        return;
-    }
-
-    std::scoped_lock lock(handle_description->mutex);
-    if (--handle_description->pins < 0) {
-        LOG_WARNING(Service_NVDRV, "Pin count imbalance detected!");
-    } else if (!handle_description->pins) {
-        std::scoped_lock queueLock(unmap_queue_lock);
-
-        // Add to the unmap queue allowing this handle's memory to be freed if needed
-        unmap_queue.push_back(handle_description);
-        handle_description->unmap_queue_entry = std::prev(unmap_queue.end());
+    std::scoped_lock lock(handles_lock);
+    if (auto o = GetHandle(handle); o) {
+        auto handle_description = &o->get();
+        if (--handle_description->pins < 0) {
+            LOG_WARNING(Service_NVDRV, "Pin count imbalance detected!");
+        } else if (!handle_description->pins) {
+            std::scoped_lock ql(unmap_queue_lock);
+            // Add to the unmap queue allowing this handle's memory to be freed if needed
+            unmap_queue.push_back(handle);
+            handle_description->unmap_queue_entry = std::prev(unmap_queue.end());
+        }
     }
 }
 
 void NvMap::DuplicateHandle(Handle::Id handle, bool internal_session) {
-    auto handle_description{GetHandle(handle)};
-    if (!handle_description) {
+    std::scoped_lock lock(handles_lock);
+    auto o = GetHandle(handle);
+    if (!o) {
         LOG_CRITICAL(Service_NVDRV, "Unregistered handle!");
         return;
     }
-
-    auto result = handle_description->Duplicate(internal_session);
+    auto result = o->get().Duplicate(internal_session);
     if (result != NvResult::Success) {
         LOG_CRITICAL(Service_NVDRV, "Could not duplicate handle!");
     }
 }
 
 std::optional<NvMap::FreeInfo> NvMap::FreeHandle(Handle::Id handle, bool internal_session) {
-    std::weak_ptr<Handle> hWeak{GetHandle(handle)};
-    FreeInfo freeInfo;
-
-    // We use a weak ptr here so we can tell when the handle has been freed and report that back to
-    // guest
-    if (auto handle_description = hWeak.lock()) {
-        std::scoped_lock lock(handle_description->mutex);
-
+    // We use a weak ptr here so we can tell when the handle has been freed and report that back to guest
+    std::scoped_lock lock(handles_lock);
+    if (auto o = GetHandle(handle); o) {
+        auto handle_description = &o->get();
         if (internal_session) {
             if (--handle_description->internal_dupes < 0)
                 LOG_WARNING(Service_NVDRV, "Internal duplicate count imbalance detected!");
@@ -288,25 +258,25 @@ std::optional<NvMap::FreeInfo> NvMap::FreeHandle(Handle::Id handle, bool interna
             } else if (handle_description->dupes == 0) {
                 // Force unmap the handle
                 if (handle_description->d_address) {
-                    std::scoped_lock queueLock(unmap_queue_lock);
+                    std::scoped_lock ql(unmap_queue_lock);
                     UnmapHandle(*handle_description);
                 }
-
                 handle_description->pins = 0;
             }
         }
-
         // Try to remove the shared ptr to the handle from the map, if nothing else is using the
         // handle then it will now be freed when `handle_description` goes out of scope
         if (TryRemoveHandle(*handle_description)) {
             LOG_DEBUG(Service_NVDRV, "Removed nvmap handle: {}", handle);
         } else {
-            LOG_DEBUG(Service_NVDRV,
-                      "Tried to free nvmap handle: {} but didn't as it still has duplicates",
-                      handle);
+            LOG_DEBUG(Service_NVDRV, "Tried to free nvmap handle: {} but didn't as it still has duplicates", handle);
         }
-
-        freeInfo = {
+        // // If the handle hasn't been freed from memory, mark that
+        // if (!hWeak.expired()) {
+        //     LOG_DEBUG(Service_NVDRV, "nvmap handle: {} wasn't freed as it is still in use", handle);
+        //     freeInfo.can_unlock = false;
+        // }
+        return FreeInfo{
             .address = handle_description->address,
             .size = handle_description->size,
             .was_uncached = handle_description->flags.map_uncached.Value() != 0,
@@ -315,30 +285,15 @@ std::optional<NvMap::FreeInfo> NvMap::FreeHandle(Handle::Id handle, bool interna
     } else {
         return std::nullopt;
     }
-
-    // If the handle hasn't been freed from memory, mark that
-    if (!hWeak.expired()) {
-        LOG_DEBUG(Service_NVDRV, "nvmap handle: {} wasn't freed as it is still in use", handle);
-        freeInfo.can_unlock = false;
-    }
-
-    return freeInfo;
 }
 
 void NvMap::UnmapAllHandles(NvCore::SessionId session_id) {
-    auto handles_copy = [&] {
-        std::scoped_lock lk{handles_lock};
-        return handles;
-    }();
-
-    for (auto& [id, handle] : handles_copy) {
-        {
-            std::scoped_lock lk{handle->mutex};
-            if (handle->session_id.id != session_id.id || handle->dupes <= 0) {
-                continue;
-            }
+    std::scoped_lock lk{handles_lock};
+    for (auto it = handles.begin(); it != handles.end(); ++it) {
+        if (it->second.session_id.id != session_id.id || it->second.dupes <= 0) {
+            continue;
         }
-        FreeHandle(id, false);
+        FreeHandle(it->first, false);
     }
 }
 

src/core/hle/service/nvdrv/core/nvmap.h

@@ -12,6 +12,11 @@
 #include <memory>
 #include <mutex>
 #include <optional>
+#if BOOST_VERSION >= 109000
+#include <boost/unordered/unordered_node_map.hpp>
+#else
+#include <unordered_map>
+#endif
 #include <ankerl/unordered_dense.h>
 #include <assert.h>
 
@@ -31,54 +36,36 @@ class Host1x;
 namespace Service::Nvidia::NvCore {
 
 class Container;
-/**
- * @brief The nvmap core class holds the global state for nvmap and provides methods to manage
- * handles
- */
+/// @brief The nvmap core class holds the global state for nvmap and provides methods to manage handles
 class NvMap {
 public:
-    /**
-     * @brief A handle to a contiguous block of memory in an application's address space
-     */
+    /// @brief A handle to a contiguous block of memory in an application's address space
     struct Handle {
-        std::mutex mutex;
-
+        using Id = u32;
+        std::optional<typename std::list<Handle::Id>::iterator> unmap_queue_entry{};
         u64 align{};      //!< The alignment to use when pinning the handle onto the SMMU
         u64 size;         //!< Page-aligned size of the memory the handle refers to
         u64 aligned_size; //!< `align`-aligned size of the memory the handle refers to
         u64 orig_size;    //!< Original unaligned size of the memory this handle refers to
-
+        DAddr d_address{}; //!< The memory location in the device's AS that this handle corresponds to, this can also be in the nvdrv tmem
+        VAddr address{}; //!< The memory location in the guest's AS that this handle corresponds to, this can also be in the nvdrv tmem
+        s64 pins{};
         s32 dupes{1};          //!< How many guest references there are to this handle
         s32 internal_dupes{0}; //!< How many emulator-internal references there are to this handle
-
-        using Id = u32;
         Id id; //!< A globally unique identifier for this handle
-
-        s64 pins{};
         u32 pin_virt_address{};
-        std::optional<typename std::list<std::shared_ptr<Handle>>::iterator> unmap_queue_entry{};
-
         union Flags {
             u32 raw;
             BitField<0, 1, u32> map_uncached; //!< If the handle should be mapped as uncached
-            BitField<2, 1, u32> keep_uncached_after_free; //!< Only applicable when the handle was
-                                                          //!< allocated with a fixed address
-            BitField<4, 1, u32> _unk0_;                   //!< Passed to IOVMM for pins
+            BitField<2, 1, u32> keep_uncached_after_free; //!< Only applicable when the handle was allocated with a fixed address
+            BitField<4, 1, u32> _unk0_; //!< Passed to IOVMM for pins
         } flags{};
         static_assert(sizeof(Flags) == sizeof(u32));
-
-        VAddr address{}; //!< The memory location in the guest's AS that this handle corresponds to,
-                         //!< this can also be in the nvdrv tmem
-        bool is_shared_mem_mapped{}; //!< If this nvmap has been mapped with the MapSharedMem IPC
-                                     //!< call
-
-        u8 kind{};        //!< Used for memory compression
-        bool allocated{}; //!< If the handle has been allocated with `Alloc`
-        bool in_heap{};
         NvCore::SessionId session_id{};
-
-        DAddr d_address{}; //!< The memory location in the device's AS that this handle corresponds
-                           //!< to, this can also be in the nvdrv tmem
+        u8 kind{};        //!< Used for memory compression
+        bool allocated : 1 = false; //!< If the handle has been allocated with `Alloc`
+        bool in_heap : 1 = false;
+        bool is_shared_mem_mapped : 1 = false; //!< If this nvmap has been mapped with the MapSharedMem IPC < call
 
         Handle(u64 size, Id id);
 
@@ -123,9 +110,9 @@ public:
     /**
      * @brief Creates an unallocated handle of the given size
      */
-    [[nodiscard]] NvResult CreateHandle(u64 size, std::shared_ptr<NvMap::Handle>& result_out);
+    [[nodiscard]] NvResult CreateHandle(u64 size, Handle::Id& out_handle);
 
-    std::shared_ptr<Handle> GetHandle(Handle::Id handle);
+    std::optional<std::reference_wrapper<Handle>> GetHandle(Handle::Id handle);
 
     DAddr GetHandleAddress(Handle::Id handle);
 
@@ -157,20 +144,21 @@ public:
 
     void UnmapAllHandles(NvCore::SessionId session_id);
 
-private:
-    std::list<std::shared_ptr<Handle>> unmap_queue{};
+    std::list<Handle::Id> unmap_queue{};
+    /// Main owning map of handles
+#if BOOST_VERSION >= 109000
+    boost::unordered_node_map<Handle::Id, Handle> handles{};
+#else
+    std::unordered_map<Handle::Id, Handle> handles{};
+#endif
     std::mutex unmap_queue_lock{}; //!< Protects access to `unmap_queue`
-
-    ankerl::unordered_dense::map<Handle::Id, std::shared_ptr<Handle>>
-        handles{};           //!< Main owning map of handles
     std::mutex handles_lock; //!< Protects access to `handles`
-
-    static constexpr u32 HandleIdIncrement{
-        4}; //!< Each new handle ID is an increment of 4 from the previous
+    static constexpr u32 HandleIdIncrement{4}; //!< Each new handle ID is an increment of 4 from the previous
     std::atomic<u32> next_handle_id{HandleIdIncrement};
     Tegra::Host1x::Host1x& host1x;
+    Container& core;
 
-    void AddHandle(std::shared_ptr<Handle> handle);
+    void AddHandle(Handle&& handle);
 
     /**
      * @brief Unmaps and frees the SMMU memory region a handle is mapped to
@@ -184,7 +172,5 @@ private:
      * @return If the handle was removed from the map
      */
     bool TryRemoveHandle(const Handle& handle_description);
-
-    Container& core;
 };
 } // namespace Service::Nvidia::NvCore

src/core/hle/service/nvdrv/devices/nvhost_as_gpu.cpp

@@ -328,10 +328,11 @@ NvResult nvhost_as_gpu::MapBufferEx(IoctlMapBufferEx& params) {
         }
     }
 
-    auto handle{nvmap.GetHandle(params.handle)};
-    if (!handle) {
+    auto o = nvmap.GetHandle(params.handle);
+    if (!o) {
         return NvResult::BadValue;
     }
+    auto handle = &o->get();
 
     DAddr device_address = DAddr(nvmap.PinHandle(params.handle, false) + params.buffer_offset);
     u64 size{params.mapping_size ? params.mapping_size : handle->orig_size};

src/core/hle/service/nvdrv/devices/nvhost_nvdec_common.cpp

@@ -103,17 +103,13 @@ NvResult nvhost_nvdec_common::Submit(IoctlSubmit& params, std::span<u8> data, De
 
     for (std::size_t i = 0; i < syncpt_increments.size(); i++) {
         const SyncptIncr& syncpt_incr = syncpt_increments[i];
-        fence_thresholds[i] =
-            syncpoint_manager.IncrementSyncpointMaxExt(syncpt_incr.id, syncpt_incr.increments);
+        fence_thresholds[i] = syncpoint_manager.IncrementSyncpointMaxExt(syncpt_incr.id, syncpt_incr.increments);
     }
 
     for (const auto& cmd_buffer : command_buffers) {
         const auto object = nvmap.GetHandle(cmd_buffer.memory_id);
         ASSERT_OR_EXECUTE(object, return NvResult::InvalidState;);
-        Core::Memory::CpuGuestMemory<Tegra::ChCommandHeader,
-                                     Core::Memory::GuestMemoryFlags::SafeRead>
-            cmdlist(session->process->GetMemory(), object->address + cmd_buffer.offset,
-                    cmd_buffer.word_count);
+        Core::Memory::CpuGuestMemory<Tegra::ChCommandHeader, Core::Memory::GuestMemoryFlags::SafeRead> cmdlist(session->process->GetMemory(), object->get().address + cmd_buffer.offset, cmd_buffer.word_count);
         host1x.PushEntries(fd, std::move(cmdlist));
     }
 

src/core/hle/service/nvdrv/devices/nvmap.cpp

@@ -83,17 +83,14 @@ void nvmap::OnClose(DeviceFD fd) {
 NvResult nvmap::IocCreate(IocCreateParams& params) {
     LOG_DEBUG(Service_NVDRV, "called, size={:#08x}", params.size);
 
-    std::shared_ptr<NvCore::NvMap::Handle> handle_description{};
-    auto result =
-        file.CreateHandle(Common::AlignUp(params.size, YUZU_PAGESIZE), handle_description);
+    NvCore::NvMap::Handle handle_description(0, 0);
+    // Orig size is the unaligned size, set the handle to that
+    auto result = file.CreateHandle(params.size, params.handle);
     if (result != NvResult::Success) {
         LOG_CRITICAL(Service_NVDRV, "Failed to create Object");
         return result;
     }
-    handle_description->orig_size = params.size; // Orig size is the unaligned size
-    params.handle = handle_description->id;
-    LOG_DEBUG(Service_NVDRV, "handle: {}, size: {:#x}", handle_description->id, params.size);
-
+    LOG_DEBUG(Service_NVDRV, "handle: {}, size: {:#x}", params.handle, params.size);
     return NvResult::Success;
 }
 
@@ -115,30 +112,27 @@ NvResult nvmap::IocAlloc(IocAllocParams& params, DeviceFD fd) {
         params.align = YUZU_PAGESIZE;
     }
 
-    auto handle_description{file.GetHandle(params.handle)};
-    if (!handle_description) {
+    std::scoped_lock lock(file.handles_lock);
+    auto o = file.GetHandle(params.handle);
+    if (!o) {
         LOG_CRITICAL(Service_NVDRV, "Object does not exist, handle={:08X}", params.handle);
         return NvResult::BadValue;
     }
 
+    auto handle_description = &o->get();
     if (handle_description->allocated) {
         LOG_CRITICAL(Service_NVDRV, "Object is already allocated, handle={:08X}", params.handle);
         return NvResult::InsufficientMemory;
     }
 
-    const auto result = handle_description->Alloc(params.flags, params.align, params.kind,
-                                                  params.address, sessions[fd]);
+    const auto result = handle_description->Alloc(params.flags, params.align, params.kind, params.address, sessions[fd]);
     if (result != NvResult::Success) {
         LOG_CRITICAL(Service_NVDRV, "Object failed to allocate, handle={:08X}", params.handle);
         return result;
     }
     bool is_out_io{};
     auto process = container.GetSession(sessions[fd])->process;
-    ASSERT(process->GetPageTable()
-               .LockForMapDeviceAddressSpace(&is_out_io, handle_description->address,
-                                             handle_description->size,
-                                             Kernel::KMemoryPermission::None, true, false)
-               .IsSuccess());
+    ASSERT(process->GetPageTable().LockForMapDeviceAddressSpace(&is_out_io, handle_description->address, handle_description->size, Kernel::KMemoryPermission::None, true, false).IsSuccess());
     return result;
 }
 
@@ -151,13 +145,13 @@ NvResult nvmap::IocGetId(IocGetIdParams& params) {
         return NvResult::BadValue;
     }
 
-    auto handle_description{file.GetHandle(params.handle)};
-    if (!handle_description) {
+    std::scoped_lock lock(file.handles_lock);
+    auto o = file.GetHandle(params.handle);
+    if (!o) {
         LOG_CRITICAL(Service_NVDRV, "Error!");
-        return NvResult::AccessDenied; // This will always return EPERM irrespective of if the
-                                       // handle exists or not
+        return NvResult::AccessDenied; // This will always return EPERM irrespective of if the handle exists or not
     }
-
+    auto handle_description = &o->get();
     params.id = handle_description->id;
     return NvResult::Success;
 }
@@ -174,12 +168,14 @@ NvResult nvmap::IocFromId(IocFromIdParams& params) {
         return NvResult::BadValue;
     }
 
-    auto handle_description{file.GetHandle(params.id)};
-    if (!handle_description) {
+    std::scoped_lock lock(file.handles_lock);
+    auto o = file.GetHandle(params.id);
+    if (!o) {
         LOG_CRITICAL(Service_NVDRV, "Unregistered handle!");
         return NvResult::BadValue;
     }
 
+    auto handle_description = &o->get();
     auto result = handle_description->Duplicate(false);
     if (result != NvResult::Success) {
         LOG_CRITICAL(Service_NVDRV, "Could not duplicate handle!");
@@ -199,12 +195,14 @@ NvResult nvmap::IocParam(IocParamParams& params) {
         return NvResult::BadValue;
     }
 
-    auto handle_description{file.GetHandle(params.handle)};
-    if (!handle_description) {
+    std::scoped_lock lock(file.handles_lock);
+    auto o = file.GetHandle(params.handle);
+    if (!o) {
         LOG_CRITICAL(Service_NVDRV, "Not registered handle!");
         return NvResult::BadValue;
     }
 
+    auto handle_description = &o->get();
     switch (params.param) {
     case HandleParameterType::Size:
         params.result = static_cast<u32_le>(handle_description->orig_size);

src/core/memory.cpp

@@ -16,6 +16,7 @@
 #include "common/assert.h"
 #include "common/atomic_ops.h"
 #include "common/common_types.h"
+#include "common/heap_tracker.h"
 #include "common/logging.h"
 #include "common/page_table.h"
 #include "common/scope_exit.h"
@@ -54,24 +55,36 @@ struct Memory::Impl {
         } else {
             current_page_table->fastmem_arena = nullptr;
         }
+
+#ifdef __ANDROID__
+        heap_tracker.emplace(system.DeviceMemory().buffer);
+        host_buffer = std::addressof(*heap_tracker);
+#else
         host_buffer = std::addressof(system.DeviceMemory().buffer);
+#endif
     }
 
-    void MapMemoryRegion(Common::PageTable& page_table, Common::ProcessAddress base, u64 size, Common::PhysicalAddress target, Common::MemoryPermission perms, bool separate_heap) {
+    void MapMemoryRegion(Common::PageTable& page_table, Common::ProcessAddress base, u64 size,
+                         Common::PhysicalAddress target, Common::MemoryPermission perms,
+                         bool separate_heap) {
         ASSERT_MSG((size & YUZU_PAGEMASK) == 0, "non-page aligned size: {:016X}", size);
         ASSERT_MSG((base & YUZU_PAGEMASK) == 0, "non-page aligned base: {:016X}", GetInteger(base));
-        ASSERT_MSG(target >= DramMemoryMap::Base, "Out of bounds target: {:016X}", GetInteger(target));
-        MapPages(page_table, base / YUZU_PAGESIZE, size / YUZU_PAGESIZE, target, Common::PageType::Memory);
+        ASSERT_MSG(target >= DramMemoryMap::Base, "Out of bounds target: {:016X}",
+                   GetInteger(target));
+        MapPages(page_table, base / YUZU_PAGESIZE, size / YUZU_PAGESIZE, target,
+                 Common::PageType::Memory);
 
         if (current_page_table->fastmem_arena) {
             host_buffer->Map(GetInteger(base), GetInteger(target) - DramMemoryMap::Base, size, perms, separate_heap);
         }
     }
 
-    void UnmapRegion(Common::PageTable& page_table, Common::ProcessAddress base, u64 size, bool separate_heap) {
+    void UnmapRegion(Common::PageTable& page_table, Common::ProcessAddress base, u64 size,
+                     bool separate_heap) {
         ASSERT_MSG((size & YUZU_PAGEMASK) == 0, "non-page aligned size: {:016X}", size);
         ASSERT_MSG((base & YUZU_PAGEMASK) == 0, "non-page aligned base: {:016X}", GetInteger(base));
-        MapPages(page_table, base / YUZU_PAGESIZE, size / YUZU_PAGESIZE, 0, Common::PageType::Unmapped);
+        MapPages(page_table, base / YUZU_PAGESIZE, size / YUZU_PAGESIZE, 0,
+                 Common::PageType::Unmapped);
 
         if (current_page_table->fastmem_arena) {
             host_buffer->Unmap(GetInteger(base), size, separate_heap);
@@ -754,7 +767,12 @@ struct Memory::Impl {
     std::array<Common::ScratchBuffer<u32>, Core::Hardware::NUM_CPU_CORES> scratch_buffers{};
     std::span<Core::GPUDirtyMemoryManager> gpu_dirty_managers;
     std::mutex sys_core_guard;
+#ifdef __ANDROID__
+    std::optional<Common::HeapTracker> heap_tracker;
+    Common::HeapTracker* host_buffer{};
+#else
     Common::HostMemory* host_buffer{};
+#endif
 };
 
 Memory::Memory(Core::System& system_) : system{system_} {
@@ -947,14 +965,30 @@ bool Memory::InvalidateNCE(Common::ProcessAddress vaddr, size_t size) {
     u8* const ptr = impl->GetPointerImpl(
         GetInteger(vaddr),
         [&] {
-            LOG_ERROR(HW_Memory, "Unmapped InvalidateNCE for {} bytes @ {:#x}", size, GetInteger(vaddr));
+            LOG_ERROR(HW_Memory, "Unmapped InvalidateNCE for {} bytes @ {:#x}", size,
+                      GetInteger(vaddr));
             mapped = false;
         },
         [&] { rasterizer = true; });
     if (rasterizer) {
         impl->InvalidateGPUMemory(ptr, size);
     }
+
+#ifdef __ANDROID__
+    if (!rasterizer && mapped) {
+        impl->host_buffer->DeferredMapSeparateHeap(GetInteger(vaddr));
+    }
+#endif
+
     return mapped && ptr != nullptr;
 }
 
+bool Memory::InvalidateSeparateHeap(void* fault_address) {
+#ifdef __ANDROID__
+    return impl->host_buffer->DeferredMapSeparateHeap(static_cast<u8*>(fault_address));
+#else
+    return false;
+#endif
+}
+
 } // namespace Core::Memory

src/core/memory.h

@@ -1,4 +1,4 @@
-// SPDX-FileCopyrightText: Copyright 2026 Eden Emulator Project
+// SPDX-FileCopyrightText: Copyright 2025 Eden Emulator Project
 // SPDX-License-Identifier: GPL-3.0-or-later
 
 // SPDX-FileCopyrightText: 2014 Citra Emulator Project
@@ -490,8 +490,13 @@ public:
      *              marked as debug or non-debug.
      */
     void MarkRegionDebug(Common::ProcessAddress vaddr, u64 size, bool debug);
+
     void SetGPUDirtyManagers(std::span<Core::GPUDirtyMemoryManager> managers);
+
     bool InvalidateNCE(Common::ProcessAddress vaddr, size_t size);
+
+    bool InvalidateSeparateHeap(void* fault_address);
+
 private:
     Core::System& system;