SceSysmem

SceSysmem is a kernel module that acts as the heart of the kernel. It exports multiple libraries for various features. SceSysmem is the first module that is loaded in the kernel load sequence and its libraries are imported by almost all other modules. See Memory for more details on the memory subsystem.

Module
This module exists in both non-secure and secure world. The non-secure world SELF can be found in. It also can be found in the Boot Image.

Memory Block Type
The  parameter indicates what kind of memory to allocate. Here is a mapping of  flags to ARM MMU flags. Higher bits are used for other options including where to allocate from. Not all flag values are valid, there is a table of valid types in the kernel. You cannot, for example, allocate RWX memory.

sceKernelRxMemcpyKernelToUserForPidForKernel
Unrestricted memcpy to the virtual address space for process. Both  and   must be in the address space of   but   must also be accessible in the address space of the caller. This is normally used for resolving stubs in module loads. Same as write to RO but does a cache flush.

sceKernelMemcpyUserToKernelForPidForDriver
Same as above, but copies from the specified process.

sceKernelGetPaddrForDriver
This will write the physical address for a virtual address  to memory pointed to by.

Returns <0 on error, values >=0 indicate success.

sceKernelGetPaddrListForDriver
This function takes in two parameters: an array of length 2 specifying the virtual address and the size of the block of memory and a request information. The function will write into  an array of   that encompasses the block of memory specified in the input. will contain the number of entries written. If  is null, it will just write the count.

sceKernelAllocMemBlockForDriver
The interface is the same as the user version of this call, however more types can be specified and more options are in the pOpt argument.

To allocate a kernel RW block of memory, specify.

To allocate a block of memory with a specific physical address, specify  or ,  , and.

To allocate a block of memory that is kernel executable, specify.

To allocate a block of memory that is physically contiguous, specify,   and an alignment to.

To allocate a block of memory inside the CDRAM, specify.

sceKernelRemapBlockForDriver
This is used to remap RW memory as RX. To do this, first allocate a memory block of type. After you are done writing, call this with  set to.

sceKernelCreateHeapForDriver
The heap pool is thread safe.

sceKernelAllocHeapMemory2ForDriver
Same as  but does not set   to 0.

sceKernelAllocHeapMemory3ForDriver
Same as  but does not set   to 0.

sceKernelAllocHeapMemory4ForDriver
Same as  but does set   to 0x1000B.

Checks that uid is 0x10013 or 0x10005

sceKernelAllocHeapMemoryFromGlobal1ForDriver
Same as  but uses global.

sceKernelAllocHeapMemoryFromGlobal2ForDriver
Same as  but does not set   to 0 and uses global.

sceKernelMapUserBlockForDriver
Permission is either "1" for read only, no execute or "2"/"3" for read write, no execute. Type is either 0, 1, or 17 and affects the block type. 0 is default. This will allocate kernel memory starting at kernel_page. To get the same memory as the user pointer, add the kernel_offset. kernel_size is how much is allocated.

sceKernelMapUserBlockDefaultTypeForDriver
Assigns type 0.

sceKernelMapUserBlockDefaultTypeForPidForDriver
Assigns type 0.

Switch TTB For PID
Changes the TTBR to point to the tables for a given PID.

sceKernelFirstDifferentIntUserForPidForDriver
Looks for an integer in userspace.

sceKernelMemcpyKernelToUserForPidForDriver
This will not crash on invalid user pointers, but instead return error.

sceKernelMemRangeRetainWithPermForDriver
Increase references to pages.

sceKernelMemRangeReleaseWithPermForDriver
Decrease references to pages.

SceSysmemForDriver_98C15666
Returns the paddr and size (addrpair) of the memblock if it's physically continuous.

SceSysmem
The SceSysmem library is responsible for both low-level and high-level memory management. There are functions for allocating raw blocks of memory (similar to Linux ) as well as functions for maintaining a heap-like structure (similar to  ) for kernel, however SceLibKernel implements a proper heap and that is used for user code.

sceKernelGetDipswForDriver
return *(int *)(dipsw_addr + 4 * int_count);

sceUartReadAvailableForKernel
Returns the number of words available to read from the read FIFO.

sceUartInitForKernel
It initializes the clock generator registers for the. The default baud rate is 115200 for devices 0-5 and 250000 for the device 6.

SceCpu
This library provides wrapper for much ARM CP15 co-processor access as well as low level support of spinlocks and other synchronization primitives.

sceKernelCpuGetCpuId
Return the CPU ID of the current core.

sceKernelCpuUnrestrictedMemcpyForKernel
Unrestricted memcpy by first setting the  register to   and then doing a memcpy.

SceCpuForDriver_D6ED0C46_unlock
These two functions implement a simple mutual exclusive access on a resource addr using LDREX/STREX.

sceKernelCpuResumeIntrForDriver
Same as the pair above, but while mutex is held, interrupts are disabled. Used like this:

SceCpuForDriver_9EC91017_unlock_int_2
Same as the pair above (sceKernelCpuSuspendIntrForDriver and sceKernelCpuResumeIntrForDriver), but stores 0x80000000 as the addr value instead of LR.

sceKernelCpuDisableIntrForDriver
Disable irq (but not fiq) and returns previous interrupt bit status (so either 0 or 0x80).

sceKernelCpuEnableIntrForDriver
Restore previous irq state, pass either 0 or 0x80.

sceKernelCpuGetCpuIdForDriver
Return the CPU ID of the current core.

SceSysclibForDriver
The C standard library for use in kernel only. (Userland have SceLibKernel, which confusingly is userland only).

Include standard string functions (no insecure variants like ).

memcmp
timing constant memcmp

memmove
On 1.69, this seems to be implemented incorrectly.

SceSysrootForKernel_CC85905B
Returns the exception vectors base address. The address of the exception vectors for the CPU  is:.

SceSysrootForKernel_377895EB
Returns 0 on success, 0xFFFFFFFF on error. a1 usually takes value 1 after this function is called. Called by sceSblAuthMgrAuthHeaderForKernel before F00D request.

sceSysrootGetSysrootBufferForKernel
Returns pointer to Sysroot buffer.

sceSysrootUseExternalStorageForKernel
Returns true when Manufacturing Mode flag is set:

return (*(int *)(*(int *)sysroot_buffer + 0x6C) >> 2) & 1;

sceSysrootUseInternalStorageForKernel
Returns true when internal storage is present (PSTV and SLIM - not FAT) and flag is set:

return *(char *)(sysroot_buffer + 0x35) & 1 ^ 1;

sceSysrootGetModuleInfoForPidForKernel
Returns export info at address for pid (contains module, lib and NID and their names).

SceSysrootForKernel_71DB83A2
Write value at 0x375F8 + 0x380.

sceSysrootSetSystemSwVersionForDriver
Set System Software version as int in SceSysmem memory. For exemple: 0x3650000 on 3.65.

sceSysrootGetSystemSwVersionForDriver
Returns System Software version as int from SceSysmem memory. For exemple: 0x3650000 on 3.65.

sceAesDecrypt1ForDriver
Decrypt with AES.

sceAesEncrypt1ForDriver
Encrypt with AES. There are two functions that are the same on 1.69.

sceAesEncrypt2ForDriver
Encrypt with AES. There are two functions that are the same on 1.69.

sceAesInit1ForDriver
This sets up the AES engine. is a 960 byte buffer (int 1.69). and  is the security in bits. 128/196/256 are supported values.

last arg to subroutine is 0

sceAesInit2ForDriver
last arg to subroutine is 1

sceAesInit3ForDriver
last arg to subroutine is 2

SceZlibForDriver
zlib compression library.

SceKernelSuspendForDriver
Used to register callbacks for handling suspend/resume related events.

sceKernelRegisterSysEventHandlerForDriver
Registers a function for handling suspend/resume. is 0 if we are currently suspending and 1 if we are currently resuming. is passed from the registration. Registration adds an entry to a linked list and returns the block id for the new entry.

Returns the suspend_callback_id.

sceKernelUnregisterSysEventHandlerForDriver
Call with the id returned from  to remove the entry from the linked list and free the memory.

sceKernelSysEventDispatchForDriver
This will go through the linked list and call each callback. If  is set, then the first callback that returns a negative value will stop the call chain and return the block id of the callback that broke the chain. Otherwise, this function will invoke each callback and return zero.

sceKernelPowerTickForDriver
Cancel specified idle timers to prevent entering in power save processing.

Returns 0 on success.

SceQafMgrForDriver
Provides many device permission checks including PSVita model checks, running app privilege checks, debugging enabled checks, and so on.

SceQafMgrForDriver_7B14DC45
Used by SceAppMgr.

return ((unsigned int)*(char *)(SceSysrootGetSysrootBufferForKernel + 0x2D) >> 1) & 1; // = 0x2D + BIT number 30

scePmGetBootTypeIndicatorBit2ForDriver
gets data using ksceKernelGetSysrootBuffer

scePmGetBootTypeIndicatorBit2_2ForDriver
gets data using ksceKernelGetSysrootBuffer

sceSblAIMgrGetSMIForDriver
might be get shipped fw version

sceSblAIMgrIsTestForDriver
TEST = Internal Test Unit

Returns true if PsCode TargetId <= 0x100.

sceSblAIMgrIsToolOrTestForDriver
TOOL = DevKit

Returns true if PsCode TargetId <= 0x101.

sceSblAIMgrIsNonCEXForDriver
Returns true if PsCode TargetId <= 0x102.

sceSblAIMgrIsCEXForDriver
Returns sceSblAIMgrIsJapaneseFatForDriver if PsCode TargetId <= 0x111 else returns 0.

sceSblAIMgrIsVITAForDriver
Returns sceSblAIMgrIsGenuineVITAForDriver.

sceSblAIMgrIsDolceForDriver
Returns sceSblAIMgrIsGenuineDolceForDriver if returns true else returns sceKernelCheckDipswForDriver(0x98).

sceSblAIMgrIsGenuineVITAForDriver
Returns true if:
 * PsCode TargetId <= 0x111 AND sceSblAIMgrIsGenuineDolceForDriver returns false
 * sceSblAIMgrIsJapaneseFatForDriver returns true AND HardwareInfo != 0x700000 != 0x720000 != 0x510000

?sceSblAIMgrGetBoardRevisionForDriver?
Returns board revision if PsCode TargetId == 0x101.

sceDebugPutcharForKernel
Print character.

sceDebugGetPutcharHandlerForKernel
Returns pointer to current debug print char handler.

sceDebugRegisterPutcharHandlerForKernel
Set debug print char handler.

SceDebugForKernel_082B8D6A
Print kernel exception information.

invoke_some_callback
Maybe invoke debug handler.

sceSysrootGetSysrootBufferForTZS
Returns pointer to Sysroot buffer.