SceSysmem: Difference between revisions

Revision as of 22:05, 5 December 2017

SceSysmem is a kernel module that acts as the heart of the kernel. It exports multiple libraries for different functionalities (one of the few modules that do so). SceSysmem is the first module that is loaded in the kernel load sequence and its libraries are imported by almost all other modules. See Memory for more details on the memory subsystem.

Module

This module exists in both non-secure and secure world. The non-secure world SELF can be found in os0:kd/sysmem.skprx. It also can be found in the Boot Image.

Known NIDs

Version	Name	World	Privilege	NID
1.69	SceSysmem	Non-secure	Kernel	0xB93950C6
3.60	SceSysmem	?	Kernel	0x3380B323
3.61	SceSysmem	Non-secure	Kernel	0x3380B323
1.69	SceSysmem	Secure	Kernel	0x502BE0E5

Libraries

This module only exports kernel libraries.

Known NIDs

Version	Name	World	Visibility	NID
1.69	SceSysmemForKernel	Non-secure	Kernel	0x63A519E5
3.60	SceSysmemForKernel	?	Kernel	0x63A519E5
1.69	SceSysmemForDriver	Non-secure	Kernel	0x6F25E18A
3.60	SceSysmemForDriver	?	Kernel	0x6F25E18A
1.69	SceSysmem	Non-secure	User	0x37FE725A
3.60	SceSysmem	?	User	0x37FE725A
1.69	SceSysmemForDebugger	Non-secure	Kernel	0xC7309957
1.69	SceDipsw	Non-secure	User	0xB36D5922
3.60	SceDipsw	?	User	0xB36D5922
1.69	SceDipswForDriver	Non-secure	Kernel	0xC9E26388
3.60	SceDipswForDriver	?	Kernel	0xC9E26388
1.69	SceUartForKernel	Non-secure	Kernel	0xC03DBE40
3.60	SceUartForKernel	?	Kernel	0xC03DBE40
1.69	SceCpu	Non-secure	User	0x45265161
3.60	SceCpu	?	User	0x45265161
1.69	SceCpuForKernel	Non-secure	Kernel	0x54BF2BAB
3.60	SceCpuForKernel	?	Kernel	0x54BF2BAB
1.69	SceCpuForDriver	Non-secure	Kernel	0x40ECDB0E
3.60	SceCpuForDriver	?	Kernel	0x40ECDB0E
1.69	SceSysclibForKernel	Non-secure	Kernel	0x24878615
1.69	SceSysclibForDriver	Non-secure	Kernel	0x7EE45391
3.60	SceSysclibForDriver	?	Kernel	0x7EE45391
1.69	SceSysrootForKernel	Non-secure	Kernel	0x3691DA45
3.60	SceSysrootForKernel	?	Kernel	0x3691DA45
1.69	SceKernelUtilsForDriver	Non-secure	Kernel	0x496AD8B4
3.60	SceKernelUtilsForDriver	?	Kernel	0x496AD8B4
1.69	SceZlibForDriver	Non-secure	Kernel	0xE241534E
1.69	SceKernelSuspendForDriver	Non-secure	Kernel	0x7290B21C
3.60	SceKernelSuspendForDriver	?	Kernel	0x7290B21C
1.69	SceQafMgrForDriver	Non-secure	Kernel	0x4E29D3B6
3.60	SceQafMgrForDriver	?	Kernel	0x4E29D3B6
1.69	ScePmMgrForDriver	Non-secure	Kernel	0xF13F32F9
3.60	ScePmMgrForDriver	?	Kernel	0xF13F32F9
1.69	SceSblAIMgrForDriver	Non-secure	Kernel	0xFD00C69A
3.60	SceSblAIMgrForDriver	?	Kernel	0xFD00C69A
1.69	SceProcEventForDriver	Non-secure	Kernel	0x887F19D0
3.60	SceProcEventForDriver	?	Kernel	0x887F19D0
1.69	SceSysrootForDriver	Non-secure	Kernel	0x2ED7F97A
3.60	SceSysrootForDriver	?	Kernel	0x2ED7F97A
3.60	SceDebugLed	?	?	0xAE004C0A
3.60	SceDebugLedForDriver	?	Kernel	0x7BC05EAD
3.60	SceDebugForKernel	?	Kernel	0x88C17370
3.60	SceDebugForDriver	?	Kernel	0x88758561
1.69	SceSysmemForTZS	Secure	Kernel	0x8680060
1.69	SceDipswForTZS	Secure	Kernel	0x9DBF584C
1.69	SceCpuForTZS	Secure	Kernel	0xC516B23E
1.69	SceSysclibForTZS	Secure	Kernel	0xC839BB78
1.69	SceSysrootForTZS	Secure	Kernel	0xFEFF641D
1.69	SceQafMgrForTZS	Secure	Kernel	0x637069DD
1.69	ScePmMgrForTZS	Secure	Kernel	0x27F1AFD8
1.69	SceSblAIMgrForTZS	Secure	Kernel	0x60D19047

Memory Block Type

The type parameter indicates what kind of memory to allocate. Here is a mapping of type flags to ARM MMU flags. Higher bits are used for other options including where to allocate from. Not all flag values are valid, there is a table of valid types in the kernel. You cannot, for example, allocate RWX memory.

Mask	Value	Description
0x10000	0x10000	Global. `nG` bit NOT set
0xFF00	0x800	`B` bit set. Sharable device memory.
0xFF00	0x2000	`TEX[2]` and `TEX[0]` bit set. Outer cache Write-back, Write-Allocate. Inner cache non-cachable.
0xFF00	0x4000	`TEX[2]` and `B` bit set. Outer cache non-cachable. Inner cache Write-back, Write-Allocate
0xFF00	0x8000	`TEX[0]` bit set. `S` bit unset. Outer and inner non-cachable. Not sharable.
0xFF00	0xD000	`TEX[0]` bit set. `C,B` bits set. Outer and inner Write-back, Write-Allocate.
0xFF	0x4	`AP[2:0] = 5`, `XN=1`. Privileged RO, User NA.
0xFF	0x5	`AP[2:0] = 5`. Privileged RX, User NA.
0xFF	0x6	`AP[2:0] = 1`, `XN=1`. Privileged RW, User NA.
0xFF	0x7	`AP[2:0] = 1`. Privileged RWX, User NA. (Never used)
0xFF	0x50	`AP[2:0] = 7`. Privileged RX, User RX.
0xFF	0x60	`AP[2:0] = 3`, `XN=1`. Privileged RW, User RW.
0xFF	0x40	`AP[2:0] = 7`, `XN=1`. Privileged RO, User RO.

Mask	Value	Name
0x0F000000	0x09000000	SceKernelUserCdram
0x0F000000	0x0A000000	SceKernelUserShared
0x0F000000	0x0B000000	SceKernelUserIO
0x0F000000	0x0C000000	SceKernelUserMain
0x0F000000	0x0D000000	SceKernelUserUncache
0x0F000000	0x0E000000	SceKernelUserCDialog
0x0F000000	0x0F000000	SceKernelUserCDialogNC

SceSysmemForKernel

sceKernelAllocMemBlockForKernel

Version	World	NID
1.69	non-secure	0xC94850C9
1.69	secure	0x402EB970


typedef enum SceKernelAllocMemBlockAttr {
	SCE_KERNEL_ALLOC_MEMBLOCK_ATTR_HAS_PADDR          = 0x00000002U,
	SCE_KERNEL_ALLOC_MEMBLOCK_ATTR_HAS_ALIGNMENT      = 0x00000004U,
	SCE_KERNEL_ALLOC_MEMBLOCK_ATTR_HAS_MIRROR_BLOCKID = 0x00000040U,
	SCE_KERNEL_ALLOC_MEMBLOCK_ATTR_HAS_PID            = 0x00000080U,
	SCE_KERNEL_ALLOC_MEMBLOCK_ATTR_HAS_PADDR_LIST     = 0x00001000U
} SceKernelAllocMemBlockAttr;

struct SceKernelAllocMemKernelBlockOpt_old {
    uint32_t size; // 0x34
    uint32_t unk;
    uint32_t attr;
    uint32_t unk2;
    uint32_t paddr;
    uint32_t align;
    uint32_t unk3[3];
    uint32_t processid;
    uint32_t unk4[3];
};

// specific to 3.60
typedef struct SceKernelAllocMemBlockKernelOpt {
	SceSize size;                   //!< sizeof(SceKernelAllocMemBlockKernelOpt)
	SceUInt32 field_4;
	SceUInt32 attr;                 //!< OR of SceKernelAllocMemBlockAttr
	SceUInt32 field_C;
	SceUInt32 paddr;
	SceSize alignment;
	SceUInt32 field_18;
	SceUInt32 field_1C;
	SceUInt32 mirror_blockid;
	SceUID pid;
	SceKernelPaddrList *paddr_list;
	SceUInt32 field_2C;
	SceUInt32 field_30;
	SceUInt32 field_34;
	SceUInt32 field_38;
	SceUInt32 field_3C;
	SceUInt32 field_40;
	SceUInt32 field_44;
	SceUInt32 field_48;
	SceUInt32 field_4C;
	SceUInt32 field_50;
	SceUInt32 field_54;
} SceKernelAllocMemBlockKernelOpt;

int sceKernelAllocMemBlockForKernel(const char *name, int32_t type, uint32_t vsize, struct SceKernelAllocMemKernelBlockOpt *pOpt);

The interface is the same as the user version of this call, however more types can be specified and more options are in the pOpt argument.

To allocate a kernel RW block of memory, specify type = 0x6020D006.

To allocate a block of memory with a specific physical address, specify type = 0x20100206 or type = 0x20100806, pOpt->attr = 2, and pOpt->paddr = physical address.

To allocate a block of memory that is kernel executable, specify type = 0x1020D005.

To allocate a block of memory that is physically contiguous, specify type = 0x30808006, pOpt->attr = 0x200004 and an alignment to pOpt->alignment.

To allocate a block of memory inside the CDRAM, specify type = 0x40404006.

pOpt->attr bitmask

Bitmask	Uses
0x00000001	field_C
0x00000002	paddr
0x00000004	alignment
0x00000008	field_18
0x00000010	field_1C
0x00000020	??
0x00000040	mirror_blockid
0x00000080	pid
0x00001000	paddr_list
0x00002000	field_2C
0x00010000	field_30

Unrestricted Write for Process

Unrestricted memcpy to the virtual address space for process pid. Both dst and src must be in the address space of pid but src must also be accessible in the address space of the caller. This is normally used for resolving stubs in module loads.

Version	World	NID
1.69	non-secure	0x30931572

int unrestricted_memcpy_for_pid(int pid, void *dst, void *src, size_t len);

sceKernelFindClassByNameForKernel

Version	World	NID
3.60	Non-secure	0x62989905

int sceKernelFindClassByNameForKernel(const char name, SceClass **class);

SceSysmemForDriver

sceKernelMemcpyKernelToUser

Version	World	NID
1.69	non-secure	0x6D88EF8A

int sceKernelMemcpyKernelToUser(uint32_t uaddr, const void *kaddr, uint32_t len);

sceKernelMemcpyUserToKernel

Version	World	NID
1.69	non-secure	0xBC996A7A

int sceKernelMemcpyUserToKernel(void *kaddr, uint32_t uaddr, uint32_t len);

sceKernelMemcpyUserToKernelForPid

Version	World	NID
3.60	non-secure	0x605275F8

int sceKernelMemcpyUserToKernelForPid(int pid, void *kaddr, uint32_t uaddr, uint32_t len);

Same as above, but copies from the specified process.

strncpyKernelToUser

Version	World	NID
1.69	non-secure	0x80BD6FEB

int strncpyKernelToUser(uint32_t uaddr, const void *kaddr, uint32_t maxlen);

strncpyUserToKernel

Version	World	NID
1.69	non-secure	0xDB3EC244

int strncpyUserToKernel(void *kaddr, uint32_t uaddr, uint32_t maxlen);

strnlenUserSrc

Version	World	NID
1.69	non-secure	0xB429D419

int strnlenUserSrc(uint32_t uaddr, uint32_t maxlen);

get_paddr

Version	World	NID
1.69	non-secure	0x8D160E65
3.60	?	0x8D160E65
1.69	secure	0x1DEADF6C

int get_paddr(void *vaddr, void **result);

This will write the physical address for a virtual address vaddr to memory pointed to by result. Returns <0 on error, values >=0 indicate success.

sceKernelGetPaddrList

Version	World	NID
1.69	non-secure	0xE68BEEBD

typedef struct SceKernelAddrPair {
	uint32_t addr;
	uint32_t length;
} SceKernelAddrPair;

typedef struct SceKernelPaddrListReq {
	uint32_t size; // 0x14
	uint32_t output_buffer_size;
	uint32_t unk;
	uint32_t ret_count;
	SceKernelAddrPair *output_buffer;
} SceKernelPaddrListReq;

input.addr = vaddr;
input.length = length;
int sceKernelGetPaddrList(SceKernelAddrPair *input, SceKernelPaddrListReq *req);

This function takes in two parameters: an array of length 2 specifying the virtual address and the size of the block of memory and a request information. The function will write into output_buffer an array of addr_pair that encompasses the block of memory specified in the input. req->ret_count will contain the number of entries written. If output_buffer is null, it will just write the count.

sceKernelGetMemBlockBaseForDriver

Version	World	NID
1.69	non-secure	0xA841EDDA

int sceKernelGetMemBlockBaseForDriver(int blkid, void **base);

sceKernelFindMemBlockByAddrForDriver

Version	World	NID
1.69	non-secure	0x8A1742F6

int sceKernelFindMemBlockByAddrForDriver(void *base, int);

Remap Block

Version	World	NID
1.05	non-secure	0x8d332ae1
1.69	non-secure	0xDFE2C8CB

int sysmem_remap(int blkid, int type);

This is used to remap RW memory as RX. To do this, first allocate a memory block of type 0x1020D006. After you are done writing, call this with type set to 0x1020D005.

Create Heap Pool

Version	World	NID
1.69	non-secure	0x9328E0E8

typedef struct {
    int size; // 28
    int flags; // usually 0x1 
    int unk;
    int unk;
    int block_type;
    int unk;
    int unk;
} pool_arg_t;
int heap_pool_create(const char *name, int size, pool_arg_t *opt); // opt can be NULL

The heap pool is thread safe.

Destroy Heap Pool

Version	World	NID
1.69	non-secure	0xD6437637

int heap_pool_destroy(int pool_uid);

sceKernelAllocHeapMemoryForKernel

Version	World	NID
1.69	non-secure	0x7B4CB60A
3.60	?	0x7B4CB60A

void* sceKernelAllocHeapMemoryForKernel(SceUID uid, SceSize size);

sceKernelAllocHeapMemory2ForKernel

Version	World	NID
3.60	?	0xB415B5A8

same as sceKernelAllocHeapMemoryForKernel but does not set unk2 to 0

void* sceKernelAllocHeapMemory2ForKernel(SceUID uid, SceSize size, void* unk2);

sceKernelAllocHeapMemory3ForKernel

Version	World	NID
3.60	?	0x49D4DD9B

same as sceKernelAllocHeapMemoryForKernel but does not set unk2 to 0

void* sceKernelAllocHeapMemory3ForKernel(SceUID uid, SceSize size, void* unk2);

Free from Heap Pool

Version	World	NID
1.69	non-secure	0x3EBCE343

int heap_pool_free(int pool_uid, void *ptr);

Map User to Kernel

Version	World	NID
1.69	non-secure	0x7D4F8B5F
3.60	?	0x7D4F8B5F

Permission is either "1" for read only, no execute or "2"/"3" for read write, no execute. Type is either 0, 1, or 17 and affects the block type. 0 is default. This will allocate kernel memory starting at kernel_page. To get the same memory as the user pointer, add the kernel_offset. kernel_size is how much is allocated.


//this signature is for 1.69
int map_user_to_kernel(int permission, int type, void *user_buf, int size, void **kernel_page, int *kernel_size, int *kernel_offset);

//this signature is for 3.60 - now allows to give a name
int map_user_to_kernel(char *name, int permission, int type, void *user_buf, int size, void **kernel_page, int *kernel_size, int *kernel_offset);

Map User to Kernel Default

Version	World	NID
3.60	?	0x278BC201

assigns type 0

int map_user_to_kernel_default(char *name, int permission, void *user_buf, int size, void **kernel_page, int *kernel_size, int *kernel_offset);

Map User to Kernel Default 2

Version	World	NID
3.60	?	0x0091D74D

assigns type 0

int map_user_to_kernel_default_2(int unk0, char *name, int permission, void *user_buf, int size, void **kernel_page, int *kernel_size, int *kernel_offset);

Switch TTB to PID

Changes the TTBR to point to the tables for a given PID.

Version	World	NID
1.69	non-secure	0x6F2ACDAE
3.60	non-secure	N/A

int switch_ttb(int pid);

Write to RO for PID

Version	World	NID
1.69	non-secure	0x571D2739

int write_to_ro(int pid, void *dst, const void *src, int size);

Write to RX for PID

Same as write to RO but does a cache flush.

Version	World	NID
1.69	non-secure	0x30931572

int write_to_rx(int pid, void *dst, const void *src, int size);

Find Int for PID

Looks for an integer in user space.

Version	World	NID
1.69	non-secure	0x8334454F

int find_int(int pid, void *haystack, int needle, int size);

strnlen for PID

Version	World	NID
1.69	non-secure	0x9929EB07

int user_strnlen(int pid, char *ptr, int size);

strncpy for PID

Version	World	NID
1.69	non-secure	0x75AAF178

int user_strncpy(int pid, char *dst, const char *kern_src, int size);

memcpyk2u unchecked for PID

Version	World	NID
1.69	non-secure	0xFED82F2D

int user_memcpyk2u(int pid, void *dst, const void *kern_src, int size);

memcpyk2u checked for PID

This will not crash on invalid user pointers, but instead return error.

Version	World	NID
1.69	non-secure	0x6B825479

int user_safe_memcpyk2u(int pid, void *dst, const void *kern_src, int size);

memcpyu2u for PID

Version	World	NID
1.69	non-secure	0x8E086C33

int user_memcpyu2u(int pid, void *dst, const void *src, int size);

create_event

Version	NID
3.60	0x56A13E90

SceUID create_event(SceClass *cls, const char *name, SceObjectBase **obj);

Increase references to pages

Version	NID
3.60	0xBC0A1D60

int SceSysmemForDriver_BC0A1D605(int perm, const void *addr, unsigned int size);

Decrease references to pages

Version	NID
3.60	0x22CBE925

int SceSysmemForDriver_22CBE925(int perm, const void *addr, unsigned int size);

ksceKernelAllocMemBlockExt

Version	NID
3.60	0xD44F464D

int ksceKernelAllocMemBlockExt(const char *name, int type, unsigned int size, SceKernelAllocMemBlockKernelOpt *opt, SceKernelPaddrList *out_paddr_list);

sceKernelFindMemBlockForDriver

Version	NID
3.60	9C78064C

int sceKernelFindMemBlockForDriver(int flags, void *base, SceSize size);

SceSysmem

The SceSysmem library is responsible for both low-level and high-level memory management. There are functions for allocating raw blocks of memory (similar to Linux sbrk) as well as functions for maintaining a heap-like structure (similar to malloc) for kernel, however SceLibKernel implements a proper heap and that is used for user code.

sceKernelGetMemBlockInfoByRange

Version	NID
1.69	0x6F3DB4

sceKernelSyncVMDomain

Version	NID
1.69	0x19D2A81A

sceKernelRemapMemBlock

Version	NID
1.69	0x3B29E0F5

sceKernelGetMemBlockInfoByAddr

Version	NID
1.69	0x4010AD65

sceKernelMapMemBlock

Version	NID
1.69	0x7B763A21

sceKernelGetSubbudgetInfo

Version	NID
1.69	0x832B4A65

sceKernelGetFreeMemorySize

Version	NID
1.69	0x87CC580B

sceKernelOpenMemBlock

Version	NID
1.69	0x8EB8DFBB

sceKernelOpenVMDomain

Version	NID
1.69	0x9CA3EB2B

sceKernelFindMemBlockByAddr

Version	NID
1.69	0xA33B99D1

sceKernelFreeMemBlock

Version	NID
1.69	0xA91E15EE

sceKernelCloseMemBlock

Version	NID
1.69	0xB680E3A0

sceKernelGetMemBlockBase

Version	NID
1.69	0xB8EF5818

sceKernelAllocMemBlock

Version	NID
1.69	0xB9D5EBDE

sceKernelPartialMapMemBlock

Version	NID
1.69	0xC0A59868

sceKernelPartialUnmapMemBlock

Version	NID
1.69	0xCA99929B

sceKernelCloseVMDomain

Version	NID
1.69	0xD6CA56CA

sceKernelAllocMemBlockForVM

Version	NID
1.69	0xE2D7E137

sceKernelUnmapMemBlock

Version	NID
1.69	0xEE30D976

SceDipsw

SceCpu

This library provides wrapper for much ARM CP15 co-processor access as well as low level support of spinlocks and other synchronization primitives.

SceSysclib

The C standard library for use in the kernel only. (User code have SceLibKernel, which confusingly is user-only code). Include standard string functions (no insecure variants like strcpy).

strcmp

Version	NID
1.69 (non-secure)	0x0B33BC43

strncmp

Version	NID
1.69 (non-secure)	0x12cee649

strstr

Version	NID
1.69 (non-secure)	0x1304A69D

rshift

Version	NID
1.69 (non-secure)	0x1D89F6C0

memcpy

Version	NID
1.69 (non-secure)	0x40c88316

strchr

Version	NID
1.69 (non-secure)	0x38463759

memset2

Version	NID
1.69 (non-secure)	0x502B000D

memmove

On 1.69, this seems to be implemented incorrectly.

Version	NID
1.69 (non-secure)	0x6CC9C1A1

strrchr

Version	NID
1.69 (non-secure)	0x7F0E0835

strncat

Version	NID
1.69 (non-secure)	0xA1D1C32C

strtol

Version	NID
1.69 (non-secure)	0xAB77C5AA

snprintf

Version	NID
1.69 (non-secure)	0xAE7A8981

sceKernelStackCheckFail

Version	NID
1.69 (non-secure)	0xb997493d

strnlen

Version	NID
1.69 (non-secure)	0xCD4BD884

strlen

Version	NID
1.69 (non-secure)	0xCFC6A9AC

memcmp

Version	NID
1.69 (non-secure)	0xF939E83D

SceDipsw

sceKernelCheckDipsw

Version	NID
1.69	0x1C783FB2

sceKernelClearDipsw

Version	NID
1.69	0x800EDCC1

sceKernelSetDipsw

Version	NID
1.69	0x817053D4

SceDipswForDriver

ksceKernelCheckDipsw

Version	NID
3.60	0xA98FC2FD

ksceKernelClearDipsw

Version	NID
3.60	0xF1F3E9FE

ksceKernelSetDipsw

Version	NID
3.60	0x82E45FBF

SceUartForKernel

SceUartForKernel_41973874

Version	NID
3.60	0x41973874

int ksceUartWrite(int device, unsigned char data);

SceUartForKernel_38DB7629

Version	NID
3.60	0x38DB7629

Returns the number of words available to read from the read FIFO.

int ksceUartReadAvailable(int device);

SceUartForKernel_9BBF1255

Version	NID
3.60	0x9BBF1255

int ksceUartRead(int device);

SceUartForKernel_A9C74212

Version	NID
3.60	0xA9C74212

It initializes the clock generator registers for the device. The default baud rate is 115200 for devices 0-5 and 250000 for the device 6.

int ksceUartInit(int device);

SceCpu

sceKernelCpuId

Version	NID
1.69	0x2704CFEE

SceCpuForKernel

void SceCpuForKernel_1BB2BB8D(void); // BPIALLIS, Branch predictor invalidate all (IS)

void SceCpuForKernel_264DA250(void); // ICIALLUIS, Instruction cache invalidate all (PoU, IS)

void SceCpuForKernel_2F3BF020(void); //DCISW, Data cache invalidate by set/way (all the cache)

void SceCpuForKernel_470EAE1E(int mva); //DCIMVAC, Data cache invalidate by MVA (PoC)

void SceCpuForKernel_4C4C7D6B(void); //BPIALL, Branch predictor invalidate all

void SceCpuForKernel_583F30D1(void *addr, unsigned int size); //DCIMVAC, Data cache invalidate by MVA (PoC)

void SceCpuForKernel_6BA2E51C(void *addr, unsigned int size); // DCCIMVAC, Data cache clean and invalidate by MVA (PoC)

void SceCpuForKernel_73A30DB2(void); // DCCSW, Data cache clean by set/way (all the cache)

void SceCpuForKernel_76DAB4D0(void); // DCCISW, Data cache clean and invalidate by set/way (all the cache)

void SceCpuForKernel_AEE0B489(void); //ICIALLU, Instruction cache invalidate all (PoU)

void SceCpuForKernel_C5C1EE4E(void *addr, unsigned int size); // DCCMVAC, Data cache clean by MVA (PoC)

void SceCpuForKernel_C8E8C9E9(int mva); //DCCIMVAC, Data cache clean and invalidate by MVA (PoC)

void SceCpuForKernel_F4C7F578(void *addr, unsigned int size); // ICIMVAU, Instruction cache invalidate by MVA (PoU)

void SceCpuForKernel_F7159B55(int mva); // DCCMVAC, Data cache clean by MVA (PoC)

Unrestricted Write for Kernel

Unrestricted memcpy by first setting the DACR register to 0xFFFF0000 and then doing a memcpy.

Version	NID
1.69	0x8C683DEC

int unrestricted_memcpy_for_kernel(void *dst, void *src, size_t len);

get_paddr_2

Version	World	NID
3.60	?	0x67343a07

int get_paddr_2(int maskPAR, void *vaddr, void **result);

get_paddr_3

Version	World	NID
3.60	?	0x2a46e800

int get_paddr_3(void *vaddr, void **result);

SceCpuForKernel_D0D85FF8

Version	NID
3.60	0xD0D85FF8

int invalidate_unknown_coprocessor_cache(void);

SceCpuForDriver

SceCpuForDriver_BF82DEB2_lock

Version	NID
1.60	0xBF82DEB2

int SceCpuForDriver_BF82DEB2_lock(int *addr);

SceCpuForDriver_D6ED0C46_unlock

Version	NID
1.60	0xD6ED0C46

int SceCpuForDriver_D6ED0C46_unlock(int *addr);

These two functions implement a simple mutual exclusive access on a resource addr using LDREX/STREX.

SceCpuForDriver_D32ACE9E_lock_int

Version	NID
3.35	0xD32ACE9E

int SceCpuForDriver_D32ACE9E_lock_int(int *addr);

SceCpuForDriver_7BB9D5DF_unlock_int

Version	NID
3.35	0x7BB9D5DF

void SceCpuForDriver_7BB9D5DF_unlock_int(int *addr, int prev_state);

Same as the pair above, but while mutex is held, interrupts are disabled. Used like this:

int prev_state = SceCpuForDriver_D32ACE9E_lock_int(mutex);
// do work
SceCpuForDriver_7BB9D5DF_unlock_int(mutex, prev_state);

SceCpuForDriver_4C38CE4D_lock_int_2

Version	NID
3.35	0x4C38CE4D

SceCpuForDriver_9EC91017_unlock_int_2

Version	NID
3.35	0x9EC91017

Same as the pair above, but stores 0x80000000 as the addr value instead of LR.

SceCpuForDriver_821FC0EE_disable_irq

Version	NID
1.60	0x821FC0EE

int SceCpuForDriver_821FC0EE_disable_irq(void);

Disables irq (but not fiq) and returns previous interrupt bit status (so either 0 or 0x80).

SceCpuForDriver_F5BAD43B_restore_irq

Version	NID
1.60	0xF5BAD43B

void SceCpuForDriver_F5BAD43B_restore_irq(int previous_state);

Restores previous irq state, pass either 0 or 0x80.

SceCpuForDriver_5E4D5DE1_get_multproc_id_reg

Version	NID
1.50	0x5E4D5DE1

Return the CPU ID of the current core.

SceSysclibForKernel

SceSysclibForDriver

__aeabi_idiv

Version	NID
3.60	0x2518CD9E

__aeabi_uidiv

Version	NID
3.35	0xA9FF1205

__aeabi_uidivmod

Version	NID
3.35	0xA46CB7DE

__aeabi_ldivmod

Version	NID
3.60	0x7554ab04

memcpy

Version	NID
1.60	0x40C88316

memset

Version	NID
1.60	0x0AB9BF5C

strchr

Version	NID
3.35	0x38463759

strncmp

Version	NID
1.60	0x12CEE649

SceSysrootForKernel

sceSysrootGetSelfInfo

Version	NID
3.60	0xF10AB792

typedef struct self_info_pair
{
   uint32_t size; // 0x0C
   char* elf_data; 
   uint32_t elf_size;
} self_info_pair;

int sceSysrootGetSelfInfo(int index, self_info_pair* state);

Index	SELF
0	gcauthmgr_sm.self
1	rmauth_sm.self
2	encdec_w_portability_sm.self

SceSysrootForKernel_CC85905B

Version	NID
3.60	0xCC85905B

Returns the exception vectors base address. The address of the exception vectors for the CPU i is: SceSysrootForKernel_CC85905B() + 0x40 * i.

ksceKernelGetSysrootBuffer

Version	NID
3.60	0x9DB56D1F

returns pointer to Sysroot

ksceKernelGetSysbase

Version	NID
3.60	0x3E455842

sceSysrootGetNidName

Version	NID
3.60	0x0B79E220

int SceSysrootForKernel_0B79E220(unsigned int nid, const char **name);

SceSysrootForKernel_FF9F80FF

Version	NID
3.60	0xFF9F80FF

int SceSysrootForKernel_FF9F80FF(SceUID pid, const void *addr, unsigned int *info); // info[0] = 0x3C

Returns export info at address for pid (contains module, lib and NID and their names).

SceKernelUtilsForDriver

Crypto utilities

AES Init 1

This sets up the AES engine. ctx is a 960 byte buffer (int 1.69). blocksize and keysize is the security in bits. 128/196/256 are supported values.

Version	NID
1.69	0xF12B6451
3.60	0xF12B6451

last arg to subroutine is 0

int aes_init(void *ctx, int blocksize, int keysize, const char *key);

AES Init 2

Version	NID
3.60	0xEDA97D6D

last arg to subroutine is 1

int aes_init(void *ctx, int blocksize, int keysize, const char *key);

AES Init 3

Version	NID
3.60	0x72408E29

last arg to subroutine is 2

int aes_init(void *ctx, int blocksize, int keysize, const char *key);

AES Encrypt 1

Encrypt with AES. There are two functions that are the same on 1.69.

Version	NID
1.69	0xC2A61770
3.60	0xC2A61770

int aes_encrypt(void *ctx, const char *src, char *dst);

AES Encrypt 2

Encrypt with AES. There are two functions that are the same on 1.69.

Version	NID
1.69	0x302947B6
3.60	0x302947B6

int aes_encrypt(void *ctx, const char *src, char *dst);

AES Decrypt 1

Decrypt with AES.

Version	NID
1.69	0xD8678061
3.60	0xD8678061

int aes_decrypt(void *ctx, const char *src, char *dst);

AES Decrypt 2

Version	NID
3.60	0xE39CD272

int aes_decrypt(void *ctx, const char *src, char *dst);

global_Mt19937_init

Version	NID
3.60	0x4C9A5730

global_Mt19937_uninit

Version	NID
3.60	0x875B2A1C

sceHmacSha1DigestForDriver

Version	NID
3.60	0x29A28957

requires confirmation. either hmac or other function that calculates digest with key

int sceHmacSha1DigestForDriver(void* key, int key_len, void* data, int data_len, void* digest);

sceHmacSha224DigestForDriver

Version	NID
3.60	0x7F2A7B99

requires confirmation. either hmac or other function that calculates digest with key

int sceHmacSha224DigestForDriver(void* key, int key_len, void* data, int data_len, void* digest);

sceHmacSha256DigestForDriver

Version	NID
3.60	0x83EFA1CC

requires confirmation. either hmac or other function that calculates digest with key

int sceHmacSha256DigestForDriver(void* key, int key_len, void* data, int data_len, void* digest);

SceZlibForDriver

zlib compression library.

Firmware	zlib version
1.60	1.2.5

inflate

Version	NID
1.60	0xE4F34A68

deflate

Version	NID
1.60	0xE859D60F

deflateReset

Version	NID
1.60	0x68CFEA45

crc32

Version	NID
1.60	0xE0CE06C0

adler32

Version	NID
1.60	0x98619620

inflateSetDictionary

Version	NID
1.60	0x7B16DBD6

SceKernelSuspendForDriver

Libraries can register callbacks for handling suspend/resume related events.

Register Callback

Version	NID
1.69	0x04C05D10

typedef struct {
    uint32_t size; // 24
    uint32_t unk1;
    uint32_t unk2;
    uint32_t unk3;
    uint32_t unk4;
    uint32_t unk5;
} suspend_args_t;
typedef int (suspend_callback_t)(int resume, int eventid, suspend_args_t *args, void *opt);
int suspend_register_callback(const char *name, suspend_callback_t *callback_func, void *opt);

Registers a function for handling suspend/resume. resume is 0 if we are currently suspending and 1 if we are currently resuming. opt is passed from the registration. Registration adds an entry to a linked list and returns the block id for the new entry.

Unregister

Version	NID
1.69	0xDD61D621

int suspend_unregister(int id);

Call with the id returned from suspend_register_callback to remove the entry from the linked list and free the memory.

Make Callback

Version	NID
1.69	0xD4622EA8

int suspend_make_callback(int resume, int eventid, suspend_args_t *args, int stop_on_error);

This will go through the linked list and call each callback. If stop_on_error is set, then the first callback that returns a negative value will stop the call chain and return the block id of the callback that broke the chain. Otherwise, this function will invoke each callback and return zero.

Reset auto-suspend timer

Version	NID
3.60	0xE0489831

int reset_autosuspend_timer(int unk);

SceQafMgrForDriver

Provides many device permission checks including Vita model checks, running app privilege checks, and so on.

ScePmMgrForDriver

scePmGetBootTypeIndicatorBit2

Version	World	NID
3.60	non-secure	0x2ac815a2

gets data using ksceKernelGetSysrootBuffer

int scePmGetBootTypeIndicatorBit2(char* result);

SceSblAIMgrForDriver

SceProcEventForDriver

SceSysrootForDriver

SceSysrootForDriver_930B1342

Version	World	NID
3.60	non-secure	0x930B1342

int sceSysrootInitI2c?(void);

SceDebugLed

SceDebugLedForDriver

SceDebugForKernel

SceDebugForKernel_82D2EDCE

Version	NID
3.60	0x82D2EDCE

Print character.

int SceDebugForKernel_82D2EDCE(int character);

SceDebugForKernel_E783518C

Version	NID
3.60	0xE783518C

Returns pointer to current debug print char handler.

void *SceDebugForKernel_E783518C(void);

SceDebugForKernel_E6115A72

Version	NID
3.60	0xE6115A72

Set debug print char handler.

int SceDebugForKernel_E6115A72(int (*func)(void *arg, char c), void *args);

SceDebugForKernel_082B8D6A

Version	NID
3.60	0x082B8D6A

Print kernel exception information

//name can be:
//UNDEF - ?
//PABT - Prefetch Abort
//DABT - Data Abort
//NEST - ?
int SceDebugForKernel_082B8D6A(void *unk, void *ctx, int index, char *name);

SceDebugForDriver

SceSysmemForTZS

SceSysmemForTZS_0028E26C

Version	World	NID
1.69	Secure	0x0028E26C

int sceKernelAllocMemBlockForPidForTZS(int pid, const char *name, SceKernelMemBlockType type, int size, SceKernelAllocMemBlockKernelOpt *optp);

SceSysrootForTZS

SceSysrootForTZS_29C1049E

Version	World	NID
1.69	secure	0x29C1049E

Get sysroot buffer.

@@ Line 556: / Line 556: @@
 </source>
-=== Alloc from Heap Pool ===
+=== sceKernelAllocHeapMemoryForKernel ===
 {| class="wikitable"
 |-
@@ Line 567: / Line 567: @@
 <source lang="c">
 void* sceKernelAllocHeapMemoryForKernel(SceUID uid, SceSize size);
+</source>
+=== sceKernelAllocHeapMemory2ForKernel ===
+{| class="wikitable"
+|-
+! Version !! World !! NID
+|-
+| 3.60 || ? || 0xB415B5A8
+|}
+same as <code>sceKernelAllocHeapMemoryForKernel</code> but does not set unk2 to 0
+<source lang="c">
+void* sceKernelAllocHeapMemory2ForKernel(SceUID uid, SceSize size, void* unk2);
+</source>
+=== sceKernelAllocHeapMemory3ForKernel ===
+{| class="wikitable"
+|-
+! Version !! World !! NID
+|-
+| 3.60 || ? || 0x49D4DD9B
+|}
+same as <code>sceKernelAllocHeapMemoryForKernel</code> but does not set unk2 to 0
+<source lang="c">
+void* sceKernelAllocHeapMemory3ForKernel(SceUID uid, SceSize size, void* unk2);
 </source>