fix(install): DPI daemon init + reliability — fixes the FW-10.40 helper crash (#152)#181
Merged
Merged
Conversation
…er crash (#152, #164, #81) Implements the elf-arsenal gap-analysis fixes for the install-crash and reliability reports, HARDWARE-VERIFIED on a real FW 9.60 PS5. The headline fix is the #152 root cause: the standalone DPI daemon called sceAppInstUtilInstallByPackage COLD (no sceAppInstUtilInitialize), which wedged Sony's IPMI state and let the watchdog kill the on-console helper ~4 s after a rejected patch install. Payload (payload/dpi/ezremote_dpi.c): - Boot-timing wait (25 s, 500 ms steps) so kstuff's kernel patches land before touching AppInstUtil. - Timed sceAppInstUtilInitialize on a detached thread (10 s timeout) + per-request init-retry. Never calls InstallByPackage cold. - Path safety (reject `..`, non-absolute) + /data/ -> /user/data/ rewrite so the sandboxed installer can see the staged pkg. - Tri-state ok / error:0x%08X / error:init:... / error:badpath / error:recv reply (backward-compatible with the old decimal form). Engine (pkg_install.rs): - parse_dpi_reply — parses the daemon's tri-state (8 unit tests, incl. the high-bit-u32 overflow case and legacy-decimal back-compat). - delete_staging_with_retry — bounded retry on the bare `fs_delete_failed` token (Sony briefly holds the staged pkg open post-install); pure is_retryable_delete_error predicate (5 unit tests). Applied at all three staging-cleanup sites. - /api/pkg/dpi-direct-install — streaming install (beta, #81): serve the pkg at /pkg-host/ and hand the daemon the HTTP URL, no staging upload. Client: - InstallPackage "Stream (beta)" affordance + pkgLibrary installStream / runDpiDirectInstall (routes through browserInvoke for the webui too). - AppShell transfer-port (:9113) liveness probe: logs the up->down transition of the "mgmt up but transfer dead" wedge (read-only diagnostic — does NOT auto-reconnect, so a real crash isn't papered over). connection.ts carries transferAlive. HARDWARE VERIFICATION (FW 9.60 Pro @192.168.86.100): - New DPI daemon loads + binds :9040 without hanging. - Path traversal -> `error:badpath`; well-formed nonexistent path -> `error:0x80020002` (it INITIALIZED, called InstallByPackage, got Sony's real reject — not the cold-call wedge). - CRUX: the main helper stayed ALIVE + ucred_elevated 6 s after the rejected install (the original #152 bundle showed helper death ~4 s after exactly this). Reviewed + gated by me on top of another model's implementation: fixed a `cy33bc`->`cy33hc` credit typo and 22 rustfmt violations in pkg_install.rs that would have failed CI. Full non-HW gate green: payload+DPI -Werror, engine fmt/clippy/78 tests, desktop 89 tests/clippy, client typecheck/lint/770 tests, i18n 18 langs. NOT in scope (documented follow-ups in docs/elf-arsenal-reference-fixes.md): the FW-11+ credential escalation (jb_escalate_pid) — the DPI daemon relies on elfldr's pristine ucred, which is install-capable only below FW 11 (bgft.c:505); fan-threshold persistence (P2-7) and NP/offline accounts (P2-8) feature requests. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This was referenced Jul 6, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Implements the elf-arsenal gap-analysis fixes for the install-crash + reliability reports (#152, #164, #81), hardware-verified on a real FW 9.60 PS5. Builds on another model's implementation — I reviewed, gated, fixed the CI-breakers, and verified on hardware.
The #152 root cause (fixed)
The standalone DPI daemon called
sceAppInstUtilInstallByPackagecold — nosceAppInstUtilInitializefirst — which wedged Sony's IPMI state and let the watchdog kill the on-console helper ~4 s after a rejected patch install. That's the "helper dies 4–7 s after the install is rejected" symptom.Changes
Payload (
ezremote_dpi.c): 25 s boot-timing wait (kstuff patches land first) → timedsceAppInstUtilInitialize(10 s timeout, detached thread) + per-request init-retry → never a coldInstallByPackage. Plus path-safety (..reject) +/data/→/user/data/rewrite for the sandboxed installer, and a tri-stateok/error:0x%08X/error:init:…/error:badpathreply (back-compat with the old decimal form).Engine (
pkg_install.rs):parse_dpi_reply(8 unit tests, incl. high-bit-u32 overflow + legacy-decimal),delete_staging_with_retryon thefs_delete_failedtoken (Sony briefly holds the pkg open post-install; pure predicate + 5 tests), and/api/pkg/dpi-direct-install(streaming install beta, #81 — no staging upload).Client: "Stream (beta)" install affordance +
installStream/runDpiDirectInstall, and an AppShell transfer-port (:9113) liveness probe that logs the "mgmt up but transfer dead" wedge transition — read-only diagnostic, does NOT auto-reconnect (a real crash isn't papered over).🔬 Hardware verification (FW 9.60 Pro)
:9040without hanging.error:badpath; well-formed nonexistent path →error:0x80020002(it initialized, called InstallByPackage, got Sony's real reject — not the cold-call wedge).ucred_elevated6 s after the rejected install — the original Pkg files can’t be updated #152 bundle showed helper death ~4 s after exactly this.What I fixed on top of the base work
A
cy33bc→cy33hccredit typo and 22 rustfmt violations inpkg_install.rsthat would have failed CI.Not in scope (documented in
docs/elf-arsenal-reference-fixes.md)FW-11+ credential escalation (
jb_escalate_pid) — the daemon relies on elfldr's pristine ucred, install-capable only below FW 11 (bgft.c:505); fan-threshold persistence + NP/offline accounts (feature requests).Testing
Payload + DPI
-Werror; engine fmt/clippy/78 tests; desktop 89 tests/clippy; client typecheck/lint/770 tests; i18n 18 langs. Plus the hardware verification above.Related: #152, #164, #81 (needs a FW 10.40/12.x reporter to confirm end-to-end on their console — the mechanism is verified on 9.60).
🤖 Generated with Claude Code