From Vita Development Wiki
Revision as of 12:37, 3 September 2022 by CreepNT (talk | contribs) (→‎RPC calls: Fix id marked as int instead of unsigned)
Jump to navigation Jump to search

The VENEZIA binary image module.


This module doesn't contain any ARM code; instead, it holds the image for execution on the VENEZIA coprocessor.

The module doesn't import from any library, and doesn't export any library.

Module layout description
Segment Description
.text Module metadata (SceModuleInfo, etc)
.data VENEZIA image

The VENEZIA image is an executable binary for the MeP architecture. The binary is copied to physical address 0x40800000 by SceSblFwLoader (mapped at vaddr 0x28200000).

On the VENEZIA MeP cores, the image is visible at address 0x800000 (i.e. the binary's base address is 0x800000).


General information

The image contains MeP code for SceNgs, SceAudioDec, JPEG encoder, decoder and CSC.

The MP3 decoder used is SoCrates MP3 Decoder FIXED-1-16.

The AAC decoder used is Toshiba Enhanced MPEG-4 ADTS & RAW AACPLUS LC Decoder (Fixed Point) 0-04.

All offsets in the following sections are relative to the start of the image, for vnzimg.skprx from firmware ???.

More information is available in the VVNZRunner GitHub repository.

RPC calls

MeP code parses RPC calls from ARM (issued with sceVeneziaRpcCallGenericThunk() in a function at 0x11482. It maps RPC call ID to a function with the following code:

void* get_function_by_id(unsigned int id) {
    if (id >= 0x200)
        return NULL;
    return FUNCTABLE[id];

FUNCTABLE is located at 0xEADD0 and cointains pointers to other functions. An example of such a function is <code>vnsJpegEncoderEncode</code> located at 0x1F988.

VENEZIA memory model

Venezia works with memory by using physical addresses directly However since Venezia supports threading it includes memory mapping model to prevent race conditions This model is described in detail in the US20120324167A1 patent.


In this state, only a task that has changed a memory region to this state is permitted to perform a read/write access by the L1C/L2C. This access is achieved by accessing a virtual address that is mapped in a physical memory by the L1 CFL2C.


In this state, one or more tasks that belong to the same process and that have requested a transition to this state are permitted to perform a read access by the L1C/L2C. A task is not permitted to perform a write access to a memory region in this state.

PUBLIC state

In this state, tasks of which mapping set by the ATU is the same, that is, tasks that belong to the same process, share data. However, a task cannot directly access a memory region in this state. Only tasks that belong to the same process are permitted to access, after changing a memory in this state to the PRIVATE state or the PROTECTED state


This state is a state that is not managed by the kernel. That is, this is a portion excluding the kernel management region out of memory regions that the memory has. Because the kernel does not manage consistency of caches in a memory region in this state, a task must hold consistency of the caches by taking responsibility, when a task uses this memory region.

Any memory must be switched to at least PUBLIC state to ensure cache coherence.


The VENEZIA image includes the following functions:

Toshiba functions

Those functions are described in the US20120324167A1 patent.

Offset Function
0x11A30 enter_memory_access_protocol
0x11ADC leave_memory_access_protocol
0x11E02 open_private_memory
0x11D34 open_protected_memory
0x11C4E open_public_memory
0x11E76 close_private_memory
0x11DA8 close_protected_memory
0x11CBC close_public_memory

Sony functions

These functions are wrappers for the Toshiba functions, written by SCE.

See vnz/memory.h.

VENEZIA threads

VENEZIA can run up to 7 threads in parallel (one on each core). Threads are assigned to cores automatically and have a priority system.

See vnz/vthread.h.

Generic functions

Offset Function
C stdlib
0x124F28 memset
0x124F3C abs
0x124F48 memcpy
0x124F60 memmove
softfp functions
0x124F90 __mulsf3
0x125268 __divsf3
0x125324 __eqsf2
0x125686 __fixsfsi
0x1256DC __floatsisf
0x1253F0 __gesf2
0x12536A __gtsf2
0x1254FC __lesf2
0x125476 __ltsf2
0x1252DE __nesf2