Difference between revisions of "SceExcpmgr"

From Vita Development Wiki
Jump to navigation Jump to search
Tags: Mobile edit Mobile web edit
Tags: Mobile edit Mobile web edit
Line 75: Line 75:
* Reset: 0
* Reset: 0
* Undefined Instruction: 1
* Undefined Instruction: 1
* Supervisor Call: 2
* Supervisor Call (SVC): 2
* Prefetch Abort: 3
* Prefetch Abort: 3
* Data Abort: 4
* Data Abort: 4
* Not used: 5
* Reserved: 5
* IRQ interrupt: 6
* Interrupt (IRQ): 6
* FIQ interrupt: 7
* Fast Interrupt (FIQ): 7
The syscall handler in FW 1.50 is SceExcpmgr_func_0x81000E40.
The syscall handler in FW 1.50 is SceExcpmgr_func_0x81000E40.

Revision as of 21:37, 19 August 2020

SceExcpmgr is a kernel module that sets up exception handling. A version exists in both worlds. In non-secure world, after the kernel is booted up, the exception handlers pointed to by VBAR all jump into code in this module.


This module exists in both non-secure and secure world. The non-secure world SELF can be found in os0:kd/excpmgr.skprx.

Known NIDs

Version Name World Privilege NID
1.69 SceExcpmgr Non-secure Kernel 0xBBCA9AB6
3.60 SceExcpmgr Non-secure Kernel 0xF3D9E37C
3.65 SceExcpmgr Non-secure Kernel 0xB5616C8A
1.69 SceExcpmgr Secure Kernel 0x93332B9A


This module only exports kernel libraries.

Known NIDs

Version Name World Visibility NID
1.69-3.60 SceExcpmgrForKernel Non-secure Kernel 0x4CA0FDD5
3.65 SceExcpmgrForKernel Non-secure Kernel 0x1496A5B5
1.69-1.80 SceExcpmgrForTZS Secure Kernel 0x8F526F35

To find


These 7 function names must be of the following NIDs:

         sceExcpmgrGetDataForKernel: 0x08CB30E6
         SceExcpmgrForKernel_3AE9AEE1: 0x3AE9AEE1
         SceExcpmgrForKernel_4FF90618: 0x4FF90618
         SceExcpmgrForKernel_7ADF11DB: 0x7ADF11DB
         SceExcpmgrForKernel_8D223205: 0x8D223205
         SceExcpmgrForKernel_A66DDFA3: 0xA66DDFA3
         SceExcpmgrForKernel_C45C0D3D: 0xC45C0D3D
         SceExcpmgrForKernel_D464A9A7: 0xD464A9A7



Version NID
0.990-3.60 0x03499636

Temp name was sceExcpmgrRegisterHandlerForKernel.

Installs an exception handler.

int sceKernelRegisterExceptionHandlerForKernel(int excpcode, int priority, void *function);

The function must be ARM and not thumb, and the allowed priority values are from 0 to 7 (including them).

Where excpcode can be:

  • Reset: 0
  • Undefined Instruction: 1
  • Supervisor Call (SVC): 2
  • Prefetch Abort: 3
  • Data Abort: 4
  • Reserved: 5
  • Interrupt (IRQ): 6
  • Fast Interrupt (FIQ): 7

The syscall handler in FW 1.50 is SceExcpmgr_func_0x81000E40.


Version NID
0.990-3.60 0xFFCCB5F9


Version NID
0.990-3.60 0xE04AE286


Version NID
0.990 0x917A6D2B


Version NID
0.990-3.60 0xB77DCBD6


Version NID
0.990-3.60 0x25C0C91B


Version NID
0.990-3.60 0xFFFA3353


Version NID
0.990-3.60 0xD17EEE40
void sceKernelRegisterExceptionHandlerForKernel(int a1);


Version NID
0.990-3.60 0xA90AC525


Version NID
0.990-3.60 0x4C603645


Version NID
3.60 0x08CB30E6



Version NID
0.931-1.80 0x07A5790B


Version NID
0.931-1.80 0x166C9362


Version NID
0.931-1.80 0x6282E52C


Version NID
0.931-1.80 0xA0434735


Version NID
0.931-3.60 0xAC297406
// some_id must be in the 0-7 range
int sceKernelRegisterMonitorEntryForTZS(int some_id, void *pParam);


Version NID
0.931-1.80 0xDD4C680D



SVC (Supervisor Call), more commonly called Syscalls (system calls), is what allows to interact with non-secure kernel from usermode.

The SVC interface is defined in non-secure kernel as:

Register Value
R0 First argument
R1 Second argument
R2 Third argument
R3 Fourth argument
R12 Syscall number

On return, R1-R3 and R12 are cleared to 0x0 or 0xDEADBEEF to prevent any data leaks. All user pointers passed to syscalls are accessed with ARM instructions LDRT and STRT for hardware forced permission checks. Syscalls 0x0 - 0xFF are likely a "fastcall" interface that do not mask interrupts or set the DACR, however currently are no such fastcalls defined. Syscalls 0x100 - 0xFFF are made with IRQ interrupts masked and DACR set to 0xFFFF0000 (to prevent access to certain memory domains). Any other syscall numbers are invalid.

System calls are handled in "system" mode defined in ARMv7 (mode 0b11111).

User exported functions loaded by SceKernelModulemgr are exported as syscalls. The number assigned to the syscall are randomized with respect to each library but not within a library. That means, for example, two functions exported by a library will always be some syscall number apart even though that number will change on each boot.

There is no SVC in secure world because all code in secure world is running as kernel.


SMC (Secure Monitor Call) is what allows to interact with ARM TrustZone from non-secure kernel.

The SMC interface for making a non-secure kernel call to secure kernel is:

Register Value
R0 First argument
R1 Second argument
R2 Third argument
R3 Fourth argument
R12 SMC number

The SMC interface is very similar to SVC interface. The SMC handler and MVBAR is set up in Secure World by SceExcpmgrForTZS.

0x0 - 0xFF are fast service calls. 0x100 - 0xFFF are normal service calls ran with IRQs masked.

Secure services are ran in ARM system processor mode (0b11111) in the Secure World.

SMC calls are registered by SceIntrmgrForTZS functions.

SMC calls

Number Arguments Notes
int smc_set_sce_shared_memory_block_s(unsigned int paddr, unsigned int size);
int smc_disable_virtual_ranges(void);
Disables the virtual ranges: 0x40000000-0x40100000, 0x50000000-0x51000000 and 0x51000000-0x52000000 to the context with PID 0x10007.
int smc_ple_flush_kill_and_l1_dcache_clean_invalidate_all(void);
Flushes (and kills if there is activity) the PLE (Preload Engine) and then cleans and invalidates all the L1 Dcache.
int smc_compat_set_state(int a1, int command);
With a1 set to 2, used to enable/disable some things used by the PSP Emulator. Maybe the CPU, or memory for example. Command: 0 (stop), 1 (start), 2 (LCD DMAC init).
int smc_bus_freq_op(int operation, unsigned int freq);
op = 0: Set bus frequency, op = 1: Get bus frequency, op = 2: Set GPU Xbar frequency, op = 3: Get GPU Xbar frequency
int smc_cdram_enable(void);
Seems to enable the CDRAM (by using the SceEmcTop registers).
0x118 CDRAM related Seems to enable something CDRAM related.
0x119 CDRAM related Seems to disable something CDRAM related.
int smc_reset_device(int type, int mode);
Reset device (check [1] for more info).
0x11C Used by SceLowio#SceGrabForDriver_188BBCC8.
int smc_compat_set_memory_bank_start_paddr(int bank, unsigned int paddr);
Valid banks 0-7, and paddrs: 0x20000000-0x2FFFFFFF and 0x42800000-0x7FFFFFFF.
int smc_compat_set_state_ex(int command, int ex);
Replacement for SMC 0x110. Used to enable/disable some things used by the PSP Emulator. Maybe the CPU, or memory for example. Command: 0 (stop), 1 (start), 2 (LCD DMAC init). Ex is only used for start (maybe for resume/suspend).
int smc_compat_get_memory_bank_start_paddr(int bank);
Valid banks 0-7.
int smc_intr_crash(int type, void *pTTBR0, void *pVBAR, void *pSysbase);
type: 0 (exception), 1 (panic_or_assertion_failed)
int smc_sm_sched_proxy_invoke(SceBool priority, void *sm_self_paddr, SceUInt32 num_pa_range, SceSblTzsBridgeArgArea area);
Used by sceSblSmSchedProxyInvokeForKernel.
int smc_sm_sched_proxy_wait(SceSmSchedRequestId req_id, SceSblTzsBridgeArgArea area);
Used by sceSblSmSchedProxyWaitForKernel.
int smc_sm_sched_proxy_get_status(SceSmSchedRequestId req_id, SceSblTzsBridgeArgArea area);
Used by sceSblSmSchedProxyGetStatusForKernel.
int smc_sm_sched_proxy_kill(SceSmSchedRequestId req_id);
Used by sceSblSmSchedProxyKillForKernel.
0x131 Reserved (on FWs 0.931-3.60).
0x132 Reserved (on FWs 0.931-3.60).
int smc_sm_sched_proxy_call_func(SceSmSchedRequestId req_id, int mailbox_id, SceUInt32 mailval);
Used by sceSblSmSchedProxyCallFuncForKernel. mailval is paddr(SceSblSmschedCallFuncCommand) | 1.
int smc_sm_sched_proxy_read_arm2cry(SceSmSchedRequestId req_id, int mailbox_id, SceUInt32 *pMailval);
Used by sceSblSmSchedProxyReadArm2CryForKernel.
int smc_sm_sched_proxy_write_arm2cry(SceSmSchedRequestId req_id, int mailbox_id, SceUInt32 mailval);
Used by sceSblSmSchedProxyWriteArm2CryForKernel.
int smc_sm_sched_proxy_write_cry2arm(SceSmSchedRequestId req_id, int mailbox_id, SceUInt32 mailval);
Used by sceSblSmSchedProxyWriteCry2ArmForKernel.
int smc_sm_sched_proxy_read_cry2arm(SceSmSchedRequestId req_id, int mailbox_id, SceUInt32 *pMailval);
Used by sceSblSmSchedProxyReadCry2ArmForKernel.
int smc_sm_sched_proxy_register_intr_handler(SceSmSchedRequestId req_id, int mailbox_id);
Used by sceSblSmSchedProxyRegisterIntrHandlerForKernel.
int smc_sm_sched_proxy_release_intr_handler(SceSmSchedRequestId req_id, int mailbox_id);
Used by sceSblSmSchedProxyReleaseIntrHandlerForKernel.
int smc_sm_sched_proxy_enable_all_cry2arm_interrupts(SceSmSchedRequestId req_id, int mailbox_id, SceSblTzsBridgeArgArea area);
Interrupt Cry2Arm set enable.
int smc_sm_sched_proxy_uninitialize(void);
Interrupt Cry2Arm clear enable. Used by sceSblSmSchedProxyUninitializeForKernel.
int smc_sm_sched_proxy_execute_sk_command(sk_cmd_index cmd_index);
Executes a Secure Kernel command. Used by sceSblSmSchedProxyExecuteSKCommandForKernel.
int smc_0x168_dmac(int index, int value);
SceDmacmgrDmac related. Writes value to SceDmacmgrDmacN + 0x100. Maybe key_id related.
int smc_0x169_dmac(int index, int value);
SceDmacmgrDmac related. Writes value to SceDmacmgrDmacN + 0x104. Maybe key_id related.
int smc_l2_write_control_register(int value);
Flushes and invalidates the entire L2 Cache (Clean and Invalidate by Way with way = 0xFFFF, offset 0x7FC), then performs an L2 Cache Sync (offset 0x730), and finally writes value to the L2 Control Register (offset 0x100).
int smc_l2_write_auxiliary_control_register(int value);
Writes value to the L2 Auxiliary Control Register (offset 0x104).


On development units, data and prefetch aborts can handle BKPT instruction for software breakpoints. SceDebug uses this to handle usermode breakpoints. There is no built-in support for BKPT in kernel code.

SceSysmem uses data aborts with the LDRT and STRT instructions to implement user pointer checking. When LDRT/STRT throws a MMU data exception because of an invalid access and the exception came from SceSysmem#sceKernelCopyFromUserForDriver or SceSysmem#sceKernelCopyToUserForDriver or related functions, the data abort handler will resume execution.


IRQs are only handled in non-secure world. An IRQ in secure world is fatal. See SceKernelIntrMgr.


FIQs are only handled in secure world because of the bit set in the SCR. Because of this, it is likely that secure devices such as the F00D Processor use FIQs to communicate with the Cortex A9 cores. See SceKernelIntrMgr.