mirror of
https://github.com/boykopovar/AnyPS5.git
synced 2026-11-04 13:07:32 +00:00
fix(libSceRudp): check the context status arguments first and initialization before the id pointer
14 KiB
14 KiB
libSceRudp technical debt
Silent stubs
- sceRudpProcessEvents, sceRudpNetFlush and sceRudpNetReceived (libSceRudp) - there is no reliable-UDP stack on the host, and every
sceRudpWrite,sceRudpReadandsceRudpGetStatuscall here reports a reset or idle context without queueing data, so no context ever holds pending data to process, send or receive; the three calls return success aftersceRudpInitandRUDP_ERROR_NOT_INITIALIZEDbefore it, as shadPS4 returns OK from its stubs. What the console'ssceRudpNetReceivedreturns is unverified. PPSA03490 callssceRudpProcessEvents(0)followed bysceRudpNetFlush()from its P2P service thread and ignores the first result. - sceRudpEnableInternalIOThread2 (libSceRudp) takes
(uint32_t stack_size, uint32_t priority, uint64_t affinity), taken from the managedSceRudp.Rudp.EnableInternalIOThread(uint stackSize, uint priority, ulong affinity)in PPSA06888's Unity metadata; the first two matchsceRudpEnableInternalIOThread. It returns success aftersceRudpInitandRUDP_ERROR_NOT_INITIALIZEDbefore it, assceRudpEnableInternalIOThreaddoes, without starting any thread. Whether the console reports other errors, and whether it applies the affinity, is unverified. - sceRudpActivate takes a context ID, socket address and 32-bit address length. Initialization and initial argument checks match the native implementation; transport mode checks, address conversion and connection activation remain unimplemented and throw.
Unknown function info
- sceRudpGetStatus - PPSA01521 passes an output pointer and byte count
0xF8. Measured on a PS5 (firmware 13.60): the status is 0xF8 bytes; beforesceRudpInitevery call returnsRUDP_ERROR_NOT_INITIALIZED, and after it a null pointer or a byte count of 0 or above 0xF8 returnsRUDP_ERROR_INVALID_ARGUMENT. The layout matchesSceRudpStatusin Vita3K withcurrentContextsat 0x64 andallocs,frees,memCurrentandmemPeakat 0xC8 to 0xD4. OnlycurrentContextsis reported: the traffic counters stay 0 because nothing is sent, and the allocator counters stay 0 because the library does not allocate from the title's pool (the console reports 6 allocations and 0x1260 bytes right aftersceRudpInit, and 4 more allocations and 0x3F0 bytes per context). The console also writescurrentContextsand the allocator counters when the byte count is smaller than their offset; only the requested bytes are written here. - sceRudpGetMaxSegmentSize (libSceRudp) - measured on a PS5 (firmware 13.60) in #3073: before
sceRudpInitit returnsRUDP_ERROR_NOT_INITIALIZEDand leaves the value untouched, also for a null pointer; after it a null pointer returnsRUDP_ERROR_INVALID_ARGUMENTand a valid one gets 1410 with result 0. No source says whether a size stored bysceRudpSetMaxSegmentSizeis reported instead, so 1410 is always reported. - sceRudpGetContextStatus (libSceRudp) -
sceRudpGetContextStatus(int ctxId, void* status, size_t size)returns, after initialization,0x80770004for a negative id, a nullstatusor asizeoutside 1 to 0x30, before the id lookup (0x80770003), as @ntamas94 read in PS4 firmware 10.71; @BunnyFl's 13.42 run, under an emulator with imports stubbed and not on a console, agrees on size and null. It writes the firstsizebytes of a 0x30-byte block, zero except0xFFFFFFFFat bytes 4-7, as it read when idle. A second run like it comparessizeas 64 bits (10.71 hasuint32_t) and reads that block for a bound context and 6 in bytes 0-3 for a listening one, whichmaincan't produce. - sceRudpCreateContext (libSceRudp) - checks initialization before its null id pointer, as @BunnyFl's 13.42 run under an emulator with imports stubbed shows; not measured on a console.
- sceRudpSetMaxSegmentSize (libSceRudp) - unverified on a PS5.
(uint16_t mss)and the checks follow Vita3K, with the argument in RPCS3:RUDP_ERROR_NOT_INITIALIZEDbeforesceRudpInit,RUDP_ERROR_NOT_ACCEPTABLEwhile a context exists, otherwise stored without a range check and kept acrosssceRudpEnd, as Vita3K keeps it in its library state. Nothing reads the stored size: Vita3K leaves the getter unimplemented, sosceRudpGetMaxSegmentSizekeeps the measured 1410 - sceRudpGetOption, sceRudpSetOption (libSceRudp) - full PS5 option contracts are unverified; defaults and validation follow Vita3K. Options 12 and 13 have unknown meanings; last-error option 14 is not maintained. Their setters store all 32 bits per context and return 0 for valid four-byte buffers, preserving acceptance on
main; their getters throw. Static inspection of PPSA06888 v01.001.008's bundled Unity transport shows its context-set constructor configuring IDs 2, 3, 5 and 6; runtime usage and other paths remain unverified. The plugin wrappers pass four-byte values. No context can connect, so stored settings cannot affect traffic. Closes when: PS5 option contracts are verified and the remaining behavior is implemented. - sceRudpPollCreate, sceRudpPollControl, sceRudpPollWait, sceRudpPollDestroy - console hardware behavior and removal of the last entry during an existing wait remain unverified. A firmware 13.42 report executes the actual module under emulation with kernel/libc imports stubbed and condition waits scripted, not on console hardware: an empty poll waits for its remaining timeout, including after spurious wakes, and leaves event output untouched. This agrees with the retained wait behavior here and conflicts with the immediate empty return in Vita3K. The argument checks, control operations and 8-byte event layout retain their existing sources; the firmware report has not been independently reproduced here.
- sceRudpPollCancel (libSceRudp) - unmeasured: a wait that starts while a cancel is draining. Here the drain waits only for the waits registered when it started; a later wait is neither cancelled nor counted. The rest is measured on a retail PS5 (firmware 13.60) through the real
libSceRudp.sprx(@HabibUrRehmanBhattii), matching @BunnyFl's 13.42 library run:int sceRudpPollCancel(int pollId)returns0x80770001beforesceRudpInit,0x80770004for a negative id and0x8077001Ffor an unknown one. With no waiter, one cancellation is kept per poll and the nextsceRudpPollWait, even with a zero timeout, returns0x80770014at once. With waiters, all return0x80770014, the call returns 0 after they leave, and nothing stays pending. - sceRudpPollDestroy and sceRudpEnd - draining remains incomplete. The detailed firmware 13.42 report executes the module with emulated/stubbed imports. In the scripted two-waiter Destroy case both waiters return
0x80770014; Destroy drains them before returning, then destroys the condition variable. A later wait on that destroyed ID returns0x8077001F. End similarly drains its active waiter with0x80770014; subsequent Wait/Cancel calls return0x80770001. Here Destroy/End return without draining and wake existing waiters with0x8077001F/0x80770001. Real-kernel wake/timeout races, simultaneous control calls, End/re-init overlap and extreme timeout boundaries remain untested; the report is not a console hardware measurement or an independent reproduction here. - sceRudpGetLocalInfo - remains a throwing placeholder: on a bound context the console copies the socket's address from
sceNetGetsockname, which this library does not reach, per @BunnyFl's 13.42 run. Its name and NID are in the PS5 3.20 export inventory. - sceRudpBind (libSceRudp) - follows @BunnyFl's 13.42 runs (records) under an emulator with imports stubbed, not on a console.
(ctxId, socketId, vport, muxMode): after initialization, a negative id or socket (0x80770004), a mux mode not 1 or 2 (0x80770006), an unknown id (0x80770003), a listening context (0x80770011) and a second bind (0x8077001D), then a mux mode other than its contexts' (0x80770006), mux mode 1 with vport 0 (0x80770015) and a mux mode 2 vport in use (0x80770017). Only mux mode 2 tracks vports. Vport 0 takes the next free one above the last handed out, from 0x2711; the socket's record and counter go when its last context leaves. The disassembly gives 0x2710 after 0xFFFF and0x80770018when none is free; not run, so passing 0xFFFF throws. - sceRudpTerminate (libSceRudp) - per the same run, a bound context that isn't listening frees its vport, and its socket's record if it was the last context, before returning; a listening one is unknown at once but holds both until the next
sceRudpProcessEvents. Not modelled: the(2, socketId, 0, 0, 0, 0, arg)call of thesceRudpSetEventHandlerhandler from the nextsceRudpProcessEventsafter a record goes, since that export takes the four-argument context handler type here; the internal IO thread's steps when a socket's first context binds and when its record goes; and the release deferred for connected contexts, which can't occur here. - sceRudpSetEventHandler (libSceRudp) - returns
0x80770001before initialization and0x80770022for a null handler, andsceRudpEndclears the handler, as the 13.42 run under an emulator with imports stubbed shows; not measured on a console. - sceRudpListen (libSceRudp) - follows the same 13.42 run, under an emulator with imports stubbed, not on a console.
sceRudpListen(ctxId, backlog)checks, after initialization, a negative id or a backlog of 0 or less (0x80770004), no handler set throughsceRudpSetEventHandler(0x80770022), an unknown id (0x80770003), a context not bound with mux mode 2 (0x80770011) and a second listen (0x80770021), then listens, keeping a backlog of at most 0x80. - sceRudpAccept (libSceRudp) - the success path never ran, since no peer connects: of its arguments the same 13.42 run, under an emulator with imports stubbed and not on a console, ran only
ctxIdand a nullnewCtxId; the types and positions ofhandler,handlerArg,address,addressLengthandvportcome from disassembly. After initialization it checks a negative id or a nullnewCtxId(0x80770004), an unknown id (0x80770003) and a context that is not listening (0x80770011). It then returns0x80770016while option 7 is set, as by default, and otherwise waits untilsceRudpTerminateends the context and returns0x80770014, as the run did. WhatsceRudpEnddoes to a waiting accept was not run, so that throws. - sceRudpFlush, sceRudpGetRemoteInfo and sceRudpGetContextBufferStatus (libSceRudp) - follow @BunnyFl's firmware 13.42 run of the real exports under an emulator with imports stubbed, not a console:
(ctxId),(ctxId, addr, addrLen, vport)and(ctxId, void* out, size_t size). After the initialization check a negative id returnsINVALID_ARGUMENT, as do a null output or a size outside 1 to 16 for the buffer status, then an unknown or terminated idINVALID_CONTEXT_ID. No context here ever connects, so Flush and GetRemoteInfo then returnNOT_ACCEPTABLE(0x80770011), as the run gave for created, bound and listening contexts, and the buffer status writessizezero bytes and returns 0, as it did for every context state run. The connected states, where the run gave 0 for GetRemoteInfo in states 4 and 5 and for Flush in state 4, are not reachable