Files
AnyPS5/docs/dev/debt/libSceRudp.md
T
Adrià 5e936063e3 Merge pull request #13871 from zaryabzip/fix/rudp-context-status-checks
fix(libSceRudp): check the context status arguments first and initialization before the id pointer
2026-11-01 06:06:40 +01:00

14 KiB

libSceRudp technical debt

Silent stubs

  • sceRudpProcessEvents, sceRudpNetFlush and sceRudpNetReceived (libSceRudp) - there is no reliable-UDP stack on the host, and every sceRudpWrite, sceRudpRead and sceRudpGetStatus call here reports a reset or idle context without queueing data, so no context ever holds pending data to process, send or receive; the three calls return success after sceRudpInit and RUDP_ERROR_NOT_INITIALIZED before it, as shadPS4 returns OK from its stubs. What the console's sceRudpNetReceived returns is unverified. PPSA03490 calls sceRudpProcessEvents(0) followed by sceRudpNetFlush() from its P2P service thread and ignores the first result.
  • sceRudpEnableInternalIOThread2 (libSceRudp) takes (uint32_t stack_size, uint32_t priority, uint64_t affinity), taken from the managed SceRudp.Rudp.EnableInternalIOThread(uint stackSize, uint priority, ulong affinity) in PPSA06888's Unity metadata; the first two match sceRudpEnableInternalIOThread. It returns success after sceRudpInit and RUDP_ERROR_NOT_INITIALIZED before it, as sceRudpEnableInternalIOThread does, without starting any thread. Whether the console reports other errors, and whether it applies the affinity, is unverified.
  • sceRudpActivate takes a context ID, socket address and 32-bit address length. Initialization and initial argument checks match the native implementation; transport mode checks, address conversion and connection activation remain unimplemented and throw.

Unknown function info

  • sceRudpGetStatus - PPSA01521 passes an output pointer and byte count 0xF8. Measured on a PS5 (firmware 13.60): the status is 0xF8 bytes; before sceRudpInit every call returns RUDP_ERROR_NOT_INITIALIZED, and after it a null pointer or a byte count of 0 or above 0xF8 returns RUDP_ERROR_INVALID_ARGUMENT. The layout matches SceRudpStatus in Vita3K with currentContexts at 0x64 and allocs, frees, memCurrent and memPeak at 0xC8 to 0xD4. Only currentContexts is reported: the traffic counters stay 0 because nothing is sent, and the allocator counters stay 0 because the library does not allocate from the title's pool (the console reports 6 allocations and 0x1260 bytes right after sceRudpInit, and 4 more allocations and 0x3F0 bytes per context). The console also writes currentContexts and the allocator counters when the byte count is smaller than their offset; only the requested bytes are written here.
  • sceRudpGetMaxSegmentSize (libSceRudp) - measured on a PS5 (firmware 13.60) in #3073: before sceRudpInit it returns RUDP_ERROR_NOT_INITIALIZED and leaves the value untouched, also for a null pointer; after it a null pointer returns RUDP_ERROR_INVALID_ARGUMENT and a valid one gets 1410 with result 0. No source says whether a size stored by sceRudpSetMaxSegmentSize is reported instead, so 1410 is always reported.
  • sceRudpGetContextStatus (libSceRudp) - sceRudpGetContextStatus(int ctxId, void* status, size_t size) returns, after initialization, 0x80770004 for a negative id, a null status or a size outside 1 to 0x30, before the id lookup (0x80770003), as @ntamas94 read in PS4 firmware 10.71; @BunnyFl's 13.42 run, under an emulator with imports stubbed and not on a console, agrees on size and null. It writes the first size bytes of a 0x30-byte block, zero except 0xFFFFFFFF at bytes 4-7, as it read when idle. A second run like it compares size as 64 bits (10.71 has uint32_t) and reads that block for a bound context and 6 in bytes 0-3 for a listening one, which main can't produce.
  • sceRudpCreateContext (libSceRudp) - checks initialization before its null id pointer, as @BunnyFl's 13.42 run under an emulator with imports stubbed shows; not measured on a console.
  • sceRudpSetMaxSegmentSize (libSceRudp) - unverified on a PS5. (uint16_t mss) and the checks follow Vita3K, with the argument in RPCS3: RUDP_ERROR_NOT_INITIALIZED before sceRudpInit, RUDP_ERROR_NOT_ACCEPTABLE while a context exists, otherwise stored without a range check and kept across sceRudpEnd, as Vita3K keeps it in its library state. Nothing reads the stored size: Vita3K leaves the getter unimplemented, so sceRudpGetMaxSegmentSize keeps the measured 1410
  • sceRudpGetOption, sceRudpSetOption (libSceRudp) - full PS5 option contracts are unverified; defaults and validation follow Vita3K. Options 12 and 13 have unknown meanings; last-error option 14 is not maintained. Their setters store all 32 bits per context and return 0 for valid four-byte buffers, preserving acceptance on main; their getters throw. Static inspection of PPSA06888 v01.001.008's bundled Unity transport shows its context-set constructor configuring IDs 2, 3, 5 and 6; runtime usage and other paths remain unverified. The plugin wrappers pass four-byte values. No context can connect, so stored settings cannot affect traffic. Closes when: PS5 option contracts are verified and the remaining behavior is implemented.
  • sceRudpPollCreate, sceRudpPollControl, sceRudpPollWait, sceRudpPollDestroy - console hardware behavior and removal of the last entry during an existing wait remain unverified. A firmware 13.42 report executes the actual module under emulation with kernel/libc imports stubbed and condition waits scripted, not on console hardware: an empty poll waits for its remaining timeout, including after spurious wakes, and leaves event output untouched. This agrees with the retained wait behavior here and conflicts with the immediate empty return in Vita3K. The argument checks, control operations and 8-byte event layout retain their existing sources; the firmware report has not been independently reproduced here.
  • sceRudpPollCancel (libSceRudp) - unmeasured: a wait that starts while a cancel is draining. Here the drain waits only for the waits registered when it started; a later wait is neither cancelled nor counted. The rest is measured on a retail PS5 (firmware 13.60) through the real libSceRudp.sprx (@HabibUrRehmanBhattii), matching @BunnyFl's 13.42 library run: int sceRudpPollCancel(int pollId) returns 0x80770001 before sceRudpInit, 0x80770004 for a negative id and 0x8077001F for an unknown one. With no waiter, one cancellation is kept per poll and the next sceRudpPollWait, even with a zero timeout, returns 0x80770014 at once. With waiters, all return 0x80770014, the call returns 0 after they leave, and nothing stays pending.
  • sceRudpPollDestroy and sceRudpEnd - draining remains incomplete. The detailed firmware 13.42 report executes the module with emulated/stubbed imports. In the scripted two-waiter Destroy case both waiters return 0x80770014; Destroy drains them before returning, then destroys the condition variable. A later wait on that destroyed ID returns 0x8077001F. End similarly drains its active waiter with 0x80770014; subsequent Wait/Cancel calls return 0x80770001. Here Destroy/End return without draining and wake existing waiters with 0x8077001F/0x80770001. Real-kernel wake/timeout races, simultaneous control calls, End/re-init overlap and extreme timeout boundaries remain untested; the report is not a console hardware measurement or an independent reproduction here.
  • sceRudpGetLocalInfo - remains a throwing placeholder: on a bound context the console copies the socket's address from sceNetGetsockname, which this library does not reach, per @BunnyFl's 13.42 run. Its name and NID are in the PS5 3.20 export inventory.
  • sceRudpBind (libSceRudp) - follows @BunnyFl's 13.42 runs (records) under an emulator with imports stubbed, not on a console. (ctxId, socketId, vport, muxMode): after initialization, a negative id or socket (0x80770004), a mux mode not 1 or 2 (0x80770006), an unknown id (0x80770003), a listening context (0x80770011) and a second bind (0x8077001D), then a mux mode other than its contexts' (0x80770006), mux mode 1 with vport 0 (0x80770015) and a mux mode 2 vport in use (0x80770017). Only mux mode 2 tracks vports. Vport 0 takes the next free one above the last handed out, from 0x2711; the socket's record and counter go when its last context leaves. The disassembly gives 0x2710 after 0xFFFF and 0x80770018 when none is free; not run, so passing 0xFFFF throws.
  • sceRudpTerminate (libSceRudp) - per the same run, a bound context that isn't listening frees its vport, and its socket's record if it was the last context, before returning; a listening one is unknown at once but holds both until the next sceRudpProcessEvents. Not modelled: the (2, socketId, 0, 0, 0, 0, arg) call of the sceRudpSetEventHandler handler from the next sceRudpProcessEvents after a record goes, since that export takes the four-argument context handler type here; the internal IO thread's steps when a socket's first context binds and when its record goes; and the release deferred for connected contexts, which can't occur here.
  • sceRudpSetEventHandler (libSceRudp) - returns 0x80770001 before initialization and 0x80770022 for a null handler, and sceRudpEnd clears the handler, as the 13.42 run under an emulator with imports stubbed shows; not measured on a console.
  • sceRudpListen (libSceRudp) - follows the same 13.42 run, under an emulator with imports stubbed, not on a console. sceRudpListen(ctxId, backlog) checks, after initialization, a negative id or a backlog of 0 or less (0x80770004), no handler set through sceRudpSetEventHandler (0x80770022), an unknown id (0x80770003), a context not bound with mux mode 2 (0x80770011) and a second listen (0x80770021), then listens, keeping a backlog of at most 0x80.
  • sceRudpAccept (libSceRudp) - the success path never ran, since no peer connects: of its arguments the same 13.42 run, under an emulator with imports stubbed and not on a console, ran only ctxId and a null newCtxId; the types and positions of handler, handlerArg, address, addressLength and vport come from disassembly. After initialization it checks a negative id or a null newCtxId (0x80770004), an unknown id (0x80770003) and a context that is not listening (0x80770011). It then returns 0x80770016 while option 7 is set, as by default, and otherwise waits until sceRudpTerminate ends the context and returns 0x80770014, as the run did. What sceRudpEnd does to a waiting accept was not run, so that throws.
  • sceRudpFlush, sceRudpGetRemoteInfo and sceRudpGetContextBufferStatus (libSceRudp) - follow @BunnyFl's firmware 13.42 run of the real exports under an emulator with imports stubbed, not a console: (ctxId), (ctxId, addr, addrLen, vport) and (ctxId, void* out, size_t size). After the initialization check a negative id returns INVALID_ARGUMENT, as do a null output or a size outside 1 to 16 for the buffer status, then an unknown or terminated id INVALID_CONTEXT_ID. No context here ever connects, so Flush and GetRemoteInfo then return NOT_ACCEPTABLE (0x80770011), as the run gave for created, bound and listening contexts, and the buffer status writes size zero bytes and returns 0, as it did for every context state run. The connected states, where the run gave 0 for GetRemoteInfo in states 4 and 5 and for Flush in state 4, are not reachable