SceSyscon

From Vita Development Wiki

System controller

Module

Version World Privilege
1.69-3.60 Non-secure Kernel

Libraries

Known NIDs

Version Name World Visibility NID
1.69-3.60 SceSysconForDriver Non-secure Kernel 0x60A35F64

Types

#define SCE_KERNEL_ERROR_SYSCON_ERROR     0x80250000
#define SCE_SYSCON_ERROR_INVALID_SIZE     0x80250001
#define SCE_SYSCON_ERROR_INVALID_ARGUMENT 0x80250002
#define SCE_SYSCON_ERROR_INVALID_POINTER  0x80250003
#define SCE_SYSCON_ERROR_INVALID_STATUS   0x80250004
#define SCE_SYSCON_ERROR_NOT_INTR_ALLOWED 0x80250005
#define SCE_SYSCON_ERROR_TX_SIZE_TOO_LONG 0x80250006

#define SCE_SYSCON_ERROR_ILLEGAL_SIZE     0x80250100
#define SCE_SYSCON_ERROR_ILLEGAL_STATUS   0x80250101
#define SCE_SYSCON_ERROR_NOEXEC           0x80250102
#define SCE_SYSCON_ERROR_INVALID_FLAGS    0x80250105

// Syscon error codes are got with 0x80250200 | rx[3], where rx is the data returned by Syscon

typedef struct SceSysconPacket { // size is 0x80
	struct SceSysconPacket *next;	// 0x00
	SceUInt32 status;		// Lower 16 bits contain flags
	SceUID semaId;			// 0x08
	SceUInt32 index;		// Out: returns to which packet list the packet was inserted into
	SceUInt8 tx[32]; // tx[0..1] = cmd, tx[2] = size
	SceUInt8 rx[32]; // rx[0..1] = cmd?, rx[2] = size?
	void *tx_extra;
	void *rx_extra;
	SceSize rx_extra_size;
	SceUInt32 rx_offset;
	int (*callback)(SceSysconPacket *packet, void *argp);
	void *argp;
	SceUInt32 time;
	SceUInt32 unk[5];
} SceSysconPacket;

typedef enum SceSysconControl {
	SCE_SYSCON_CTRL_UP        = 0x1,
	SCE_SYSCON_CTRL_RIGHT     = 0x2,
	SCE_SYSCON_CTRL_DOWN      = 0x4,
	SCE_SYSCON_CTRL_LEFT      = 0x8,
	SCE_SYSCON_CTRL_TRIANGLE  = 0x10,
	SCE_SYSCON_CTRL_CIRCLE    = 0x20,
	SCE_SYSCON_CTRL_CROSS     = 0x40,
	SCE_SYSCON_CTRL_SQUARE    = 0x80,
	SCE_SYSCON_CTRL_SELECT    = 0x100,
	SCE_SYSCON_CTRL_LTRIGGER  = 0x200,
	SCE_SYSCON_CTRL_RTRIGGER  = 0x400,
	SCE_SYSCON_CTRL_START     = 0x800,
	SCE_SYSCON_CTRL_PSBUTTON  = 0x1000,
	SCE_SYSCON_CTRL_POWER     = 0x4000,
	SCE_SYSCON_CTRL_VOLUP     = 0x10000,
	SCE_SYSCON_CTRL_VOLDOWN   = 0x20000,
	SCE_SYSCON_CTRL_HEADPHONE = 0x8000000
} SceSysconControl;

Flags (passed to sceSysconCmdExecForDriver, etc), also lower bits of status:

Flags Meaning
0x1 Some kind of priority that helps to select to which packet list the packet is inserted into.
0x100 Do not insert packet checksum (at tx_buf[2 + len]), where len = tx_buf[2]. And don't memset the rest of the buffer to -1 (memset(tx_buf + len + 3, -1, 29 - len)) if len < 29.
0x400 When set, use rx_extra to receive the data. rx_extra_size must be greater than 32.
0x800 When set: use tx_extra instead of tx for sending data. The size is contained in tx_extra[2] and must be smaller or equal to 253. When cleared: use tx and the size is contained in tx[2], which has to be smaller or equal 29.

SceSysconForDriver

sceSysconErnieShutdownForDriver

Version NID
0.931-3.60 0x94AB13CC
#define ERNIE_SHUTDOWN_SHUTDOWN 0
#define ERNIE_SHUTDOWN_REBOOT 1

int sceSysconErnieShutdownForDriver(int mode);

sceSysconPowerCtrlKermitResetForDriver

Version NID
0.931-3.60 0x14B99945

Executes SMC 0x11A: return sceSysconSetPowerMode(2, 0);

int sceSysconPowerCtrlKermitResetForDriver(void);

sceSysconBatteryExecBLCommandForDriver

Version NID
0.990-3.60 0x74B2AB55
int sceSysconBatteryExecBLCommandForDriver(int ctx);

sceSysconBatteryReadBLCommandForDriver

Version NID
0.990-3.60 0x448DAFF1
int sceSysconBatteryReadBLCommandForDriver(int ctx, int unk1, int unk2, void *buf, SceSize size);

sceSysconBatterySetBLCommandForDriver

Version NID
0.990-3.60 0xE4F29744
int sceSysconBatterySetBLCommandForDriver(int ctx, int unk, void *src, SceSize size);

sceSysconBatteryStartBLModeForDriver

Version NID
0.990-3.60 0x2CEF078E
int sceSysconBatteryStartBLModeForDriver(void);

sceSysconBatteryStopBLModeForDriver

Version NID
0.990-3.60 0xE4AE7852
int sceSysconBatteryStopBLModeForDriver(void);

sceSysconBatterySWResetForDriver

Version NID
0.990-3.60 0x87DA378D
int sceSysconBatterySWResetForDriver(void);

SceSysconForDriver_ACEE1C70

Version NID
3.60 0xACEE1C70

related to battery, called by ScePowerForDriver_0D56C601.

SceSysconForDriver_4A184B7C

Version NID
3.60 0x4A184B7C

related to battery, called by ScePowerForDriver_627A89C6.

sceSysconIsLowBatteryInhibitUpdateRebootForDriver

Version NID
3.60 0x1A0C140F

used by scePowerIsLowBatteryInhibitUpdateReboot

int sceSysconIsLowBatteryInhibitUpdateRebootForDriver(unk);

sceSysconIsLowBatteryInhibitUpdateDownloadForDriver

Version NID
3.60 0x1E3130EE

used by scePowerIsLowBatteryInhibitUpdateDownload

int sceSysconIsLowBatteryInhibitUpdateDownloadForDriver(unk);

sceSysconGetManualChargeModeForDriver

Version NID
0.931-0.940 not present
3.60 0x4FEC564C
int sceSysconGetManualChargeModeForDriver(int *piMode);

sceSysconCtrlManualChargeModeForDriver

Version NID
0.931-0.940 not present
3.60 0xC6A2C9EF
int sceSysconCtrlManualChargeModeForDriver(int mode);

sceSysconGetLogInfoForDriver

Version NID
0.931-0.940 not present
3.60 0x701535FC
typedef struct SceSysconLogInfo { // size is 8 on FW 3.60
   uint8_t unk_0[8];
} SceSysconLogInfo;

int sceSysconGetLogInfoForDriver(SceSysconLogInfo *pInfo);

sceSysconLogStartForDriver

Version NID
0.931-0.940 not present
3.60 0x4E55CF5E
int sceSysconLogStartForDriver(void);

sceSysconLogStartWaitingForDriver

Version NID
0.931-0.940 not present
3.60 0x9C0B1E61
int sceSysconLogStartWaitingForDriver(void);

sceSysconLogReadDataForDriver

Version NID
0.931-0.940 not present
3.60 0x487D97F3
int sceSysconLogReadDataForDriver(SceUInt32 offset, void *buffer, SceSize size);

sceSysconGetTemperatureLogForDriver

Version NID
0.931-0.940 not present
3.60 0x3B354824

sceSysconClearTemperatureLogForDriver

Version NID
0.931-0.940 not present
3.60 0x3843D657

sceSysconGetUsbDetStatusForDriver

Version NID
0.931-0.940 not present
3.60 0xEF810687

sceSysconGetBaryonTimestampForDriver

Version NID
3.60 0x4D588A0A

A temp name was sceSysconGetTimeStampForDriver, derived from PSP.

Returns the timestamp of latest installed Syscon FW patch, formatted as YYYYMMDDhhmm. This comes from a string stored in Syscon FW under another format: $Date:: YYYY-MM-DD hh:mm:ss +0900#$

Example: $Date:: 2013-12-13 15:52:05 +0900#$ in Syscon FW becomes 201312131552 in Syscon command 2.

// pTimestamp will point to a buffer of size 0x10 bytes, containing a string of size 13 (12: length + 1: terminal character)
int sceSysconGetBaryonTimestampForDriver(char *pTimestamp);

sceSysconGetWakeupFactorForDriver

Version NID
3.60 0xCF5B2F2F

Result is 2 bytes wakeup factor coming from Syscon command 0x10.

int sceSysconGetWakeupFactorForDriver(SceUInt32 *pWakeupFactor);

sceSysconCtrlHdmiCecPowerForDriver

Version NID
0.931-3.60 0x62155962

Sets the pin CDC Hot Plug Detect (HPD) state of the HDMI bridge (AD80244 / ADV7533).

int sceSysconCtrlHdmiCecPowerForDriver(SceBool enable_HDMI_CDC_HPD_pin);

SceSysconForDriver_3FDD29D6

Version NID
0.931-3.60 0x3FDD29D6
int SceSysconForDriver_3FDD29D6(int a1, SceBool use_flag);

sceSysconCtrlRMRPowerForDriver

Version NID
3.60 0x710A7CF0

Temp name was sceSysconCtrlMsPowerForDriver.

int sceSysconCtrlRMRPowerForDriver(int enable_power);

SceSysconForDriver_7F198FA2

Version NID
0.931-3.60 0x7F198FA2

Used by ScePower when setting a device clock frequency.

/* device:
0: 
1: SetSysClockFrequency, SetDmac5ClockFrequency, SetBusClockFrequency, SetCameraBusClockFrequency
2: SetArmClockFrequency
3: SetGpuClockFrequency, SetVipClockFrequency
4: SetGpuClockFrequencyInternal, SetGpuXbarClockFrequency, SetCompatClockFrequency

unk: 0x8A - (something got from ScePervasiveForDriver)
*/

int SceSysconForDriver_7F198FA2(SceUInt32 device, SceUInt32 unk);

sceSysconSetPowerModeForDriver

Version NID
0.940-3.60 0x8A95D35C

Temp name was sceSysconResetDeviceForDriver.

int sceSysconSetPowerModeForDriver(int type, int mode);

It issues SMC #0 with r12 = 0x11A.

The mode argument is usually set to 0x2 or sometimes 0x8002 (which seems to correspond to some request by the UDC and BT drivers).

The type argument determines what to do.

Real define names are like: "SCE_SYSCON_POWERMODE_MODE_STANDBY".

Type Description Syscon command
0 Power off {0xC0, 0, 5, type, (~mode) & 0xFF, (~mode >> 8) & 0xFF, (mode >> 16) & 0xFF}
1 Suspend (low-power state) {0xC0, 0, 5, type, (~mode) & 0xFF, (~mode >> 8) & 0xFF, (mode >> 16) & 0xFF}
2 Cold reset {0x01, 8, 1, 0}
3 ?Reset to update mode? {0xC1, 0, 2, 0}
4 ?Reset to update mode? {0xC1, 0, 2, 1}
5 Hibernate {0xC2, 0, 2, 0x5A}
16 ?? {0xC0, 0, 5, type, (~mode) & 0xFF, (~mode >> 8) & 0xFF, (mode >> 16) & 0xFF}
17 Soft reset (suspend and immediately resume) {0xC0, 0, 5, type, (~mode) & 0xFF, (~mode >> 8) & 0xFF, (mode >> 16) & 0xFF}

sceSysconEnableHibernateIOForDriver

Version NID
0.931-0.940 not present
0.990-3.60 0x4946538A
int sceSysconEnableHibernateIOForDriver(int a1);

sceSysconWaitReadyForDriver

Version NID
0.931-0.940 not present
3.60 0x55DF1C9B

Temp name was sceSysconWaitInitializedForDriver.

int sceSysconWaitReadyForDriver(void);

sceSysconCmdSyncForDriver

Version NID
0.931-3.60 0x6E517D22
int sceSysconCmdSyncForDriver(SceSysconPacket *packet, int noWait);

sceSysconCmdExecForDriver

Version NID
0.931-3.60 0x9ADDCA4A
int sceSysconCmdExecForDriver(SceSysconPacket *packet, unsigned int flags);

sceSysconCmdExecAsyncForDriver

Version NID
0.931-3.60 0xC2224E82
int sceSysconCmdExecAsyncForDriver(SceSysconPacket *packet, u32 flags, int (*callback)(SceSysconPacket *, void *), void *argp);

sceSysconCtrlSdPowerForDriver

Version NID
3.60 0xBE1ADE4F

Enables/disables GameCard reader.

Used by SceSdstor.

int sceSysconCtrlSdPowerForDriver(int enable_power);

sceSysconCtrlWirelessPowerForDriver

Version NID
0.990 0x4FBDA504
3.60 not present

sceSysconCtrlWirelessPower2ForDriver

Version NID
0.940 not present
3.60 0xA2E85DB9

sceSysconCtrlWirelessPowerDownForDriver

Version NID
0.990 0xDF8C6D2D
3.60 not present

SceSysconForDriver_C0F215B7

Version NID
0.940 not present
3.60 0xC0F215B7

Gets something (a byte).

int SceSysconForDriver_C0F215B7(void);

sceSysconVerifyConfigstorageScriptForDriver

Version NID
3.60 0xCC6F90A8

This function is not used by the OS and anyway it would always return error because it calls a command that is not implemented in Syscon FW.

int sceSysconVerifyConfigstorageScriptForDriver(int a1, void *pScript, SceSize size);

sceSysconLoadConfigstorageScriptForDriver

Version NID
3.60 0x89C5CFD6

The OS uses this function to change between modes: IDU mode, Show Mode, no mode. This works by spoofing or rewriting KBL Param#Hardware Info. This is reboot persistent.

int sceSysconLoadConfigstorageScriptForDriver(int a1, void *pScript, SceSize size);

sceSysconBeginConfigstorageTransactionForDriver

Version NID
0.990-3.60 0xA4968B8C
int sceSysconBeginConfigstorageTransactionForDriver(void);

sceSysconCommitConfigstorageTransactionForDriver

Version NID
0.990-3.60 0x7B9B3617
int sceSysconCommitConfigstorageTransactionForDriver(void);

sceSysconEndConfigstorageTransactionForDriver

Version NID
0.990-3.60 0xFCC3E8EE
int sceSysconEndConfigstorageTransactionForDriver(void);

sceSysconSetDebugHandlersForDriver

Version NID
0.990-3.60 0xF245CD6F
/** A set of debug handlers for syscon, that you can set in sceSysconSetDebugHandlersForDriver(). */
typedef struct SceSysconDebugHandlers {
    /** Structure size (probably, unused). */
    s32 size;
    /** Callback ran right before running a packet, with a pointer to it passed as the first argument. */
    void (*start)(SceSysconPacket *packet);
    /** Callback ran right after finishing running a packet, with a pointer to it passed as the first argument. */
    void (*end)(SceSysconPacket *packet);
} SceSysconDebugHandlers;

int sceSysconSetDebugHandlersForDriver(SceSysconDebugHandlers *debug_handlers);

sceSysconGetBatteryCalibDataForDriver

Version NID
0.931-0.940 not present
3.60 0x9ADC9936
int sceSysconGetBatteryCalibDataForDriver(int *piData1, int *piData2, int *piData3, int *piData4);

sceSysconGetTouchpanelDeviceInfoForDriver

Version NID
0.990-3.60 0xF492E69E
typedef struct SceKernelTouchpanelDeviceInfo {
  uint16_t FrontVendorID;
  uint16_t FrontFwVersion;
  uint16_t BackVendorID;
  uint16_t BackFwVersion;
} SceKernelTouchpanelDeviceInfo;

int sceSysconGetTouchpanelDeviceInfoForDriver(SceKernelTouchpanelDeviceInfo *pInfo);

sceSysconGetTouchpanelDeviceInfo2ForDriver

Version NID
0.940 not present
0.990-3.60 0x030D447F

This is a guessed name.

Returns extended panel info.

typedef struct SceKernelTouchpanelDeviceInfo2 {
	uint16_t FrontVendorID;
	uint16_t FrontFwVersion;
	uint16_t FrontUnk1;
	uint8_t FrontUnk2;
	uint8_t FrontUnk3;
	uint16_t unused1;
	uint16_t BackVendorID;
	uint16_t BackFwVersion;
	uint16_t BackUnk1;
	uint8_t BackUnk2;
	uint8_t BackUnk3;
	uint16_t unused2;
} SceKernelTouchpanelDeviceInfo2;

int sceSysconGetTouchpanelDeviceInfo2ForDriver(SceKernelTouchpanelDeviceInfo2 *pInfo);

sceSysconGetHardwareInfoForDriver

Version NID
0.931-3.60 0xCBD6D8BC

Returns Ernie HW info. See KBL Param#Hardware Info.

int sceSysconGetHardwareInfoForDriver(void);

sceSysconGetHardwareInfo2ForDriver

Version NID
3.60 0x965C68C3
//"hwinfo = 0x%08x, id = 0x%llx, hwtype = 0x%08x"
typedef struct SceKernelHardwareInfo2 {
  int hwinfo;
  uint64_t id; // unsure
  int hwtype; // unsure
} SceKernelHardwareInfo2;

int sceSysconGetHardwareInfo2ForDriver(SceKernelHardwareInfo2 *pInfo);

sceSysconGetBaryonVersionForDriver

Version NID
0.931-3.60 0xFF86F4C5

On PSVita it is Ernie Version not Baryon Version.

int sceSysconGetBaryonVersionForDriver(void);

SceSysconForDriver_0D0B6D25

Version NID
3.60 0x0D0B6D25

Maybe exits Syscon DownLoader mode.

int SceSysconForDriver_0D0B6D25(void);

SceSysconForDriver_4BC63A40

Version NID
3.60 0x4BC63A40

SceSysconForDriver_EBE3262C

Version NID
1.03-3.60 0xEBE3262C

In SceSblPostSsMgr, used just after #sceSysconGetBaryonVersionForDriver.

Return 8 bits of some Syscon Mode information. Bit 6 (from right) is Syscon DownLoader Mode flag. Bit 3 (from right) is Power Online flag.

SceUInt8 SceSysconForDriver_EBE3262C(void);

sceSysconIsPowerOnlineForDriver

Version NID
0.931-3.60 0x9DA2A5AB

Returns true iff Syscon information bit 3 (from right) is set. See also #SceSysconForDriver_EBE3262C.

Used by many ScePower functions for example before setting display brightness.

SceBoolean sceSysconIsPowerOnlineForDriver(void);

sceSysconGetErnieDLVersionForDriver

Version NID
0.931-3.60 0xD2F456DC

Runs Syscon command 0x1100.

void sceSysconGetErnieDLVersionForDriver(int *pVersion);

sceSysconGetBatteryVersionForDriver

Version NID
0.931-3.60 0x68E0031E

Battery IC name: if HWinfo > 7 "Abby" else "Bert".

int sceSysconGetBatteryVersionForDriver(int *HWinfo, int *FWinfo, int *DFinfo);

sceSysconGetManufacturesStatusForDriver

Version NID
0.931-0.940 not present
3.60 0x3E09A1F4

In theory, this function should only be called when Product Mode is already set.

int sceSysconGetManufacturesStatusForDriver(int *piStatus);

sceSysconReadScratchPadForDriver

Version NID
0.931-3.60 0x299B1CE7

Temp name was sceSysconReadCommandForDriver, sceSysconVsReadDataForDriver.

Calls syscon command 0x90.

Used by SceRtc.

// size: On FW 3.60, must be between 0 and 0x18. On FW 0.931, must be 2, 4 or 8.
// offset: Must be between 0 and 0xFF.
// offset + size must not exceed 0x100
int sceSysconReadScratchPadForDriver(SceUInt32 offset, void *buffer, SceSize size);

sceSysconWriteScratchPadForDriver

Version NID
0.931-3.60 0xE26488B9

Temp name was sceSysconSendCommandForDriver, sceSysconVsWriteDataForDriver.

Calls syscon command 0x91.

Used by SceRtc and ScePower.

// size: On FW 3.60, must be between 0 and 0x18. On FW 0.931, must be 2, 4 or 8.
// offset: Must be between 0 and 0xFF.
// offset + size must not exceed 0x100
int sceSysconWriteScratchPadForDriver(SceUInt32 offset, void *buffer, SceSize size);

sceSysconNvsSetRunModeForDriver

Version NID
0.931-3.60 0x81A6060D

Used by sceSblNvsReadDataForKernel and sceSblNvsWriteDataForKernel.

// mode: 0 before read/write
int sceSysconNvsSetRunModeForDriver(int mode);

sceSysconNvsSetUnkModeForDriver

Version NID
0.931-3.60 0x2EC6D55D
// mode: unk
int sceSysconNvsSetUnkModeForDriver(int mode);

sceSysconNvsReadDataForDriver

Version NID
0.931-3.60 0xACAFA2B8

Used by sceSblNvsReadDataForKernel and sceSblSsGetNvsDataForDriver.

int sceSysconNvsReadDataForDriver(SceUInt32 offset, void *buffer, SceSize size);

sceSysconNvsWriteDataForDriver

Version NID
0.931-3.60 0x10C9657A

Used by sceSblNvsWriteDataForKernel and sceSblSsSetNvsDataForDriver.

int sceSysconNvsWriteDataForDriver(SceUInt32 offset, void *buffer, SceSize size);

sceSysconGetMultiCnInfoForDriver

Version NID
3.60 0x1503D6A0

sceSysconSetMultiCnPortForDriver

Version NID
0.940-3.60 0x8AAB6308
// port: 0: for JIG mode, 0x10000: for normal mode
int sceSysconSetMultiCnPortForDriver(int port);

SceSysconForDriver_E7893732

Version NID
3.60 0xE7893732

Calls Syscon command 0x1B0. Related to UART, JIG or MultiCn.

// value holds 3 useful bytes and 1 byte not sent to syscon
int SceSysconForDriver_E7893732(int value);

SceSysconForDriver_9CA6EB70

Version NID
1.03-3.60 0x9CA6EB70

Sends value using Syscon command 0x89E. Does nothing on prototype models with motherboards IRT-001 and older.

Related to LED.

int SceSysconForDriver_9CA6EB70(SceBool state);

sceSysconCtrlLEDForDriver

Version NID
0.931-3.60 0x04EC7579
#define STATE_ON 1
#define STATE_OFF 0

#define DEVICE_UNK 0x40 // maybe PS button or CP power LED or maybe color (blue)

int sceSysconCtrlLEDForDriver(int device, SceBool state);

sceSysconCtrlDolceLEDForDriver

Version NID
0.931 not present
3.60 0x727F985A

This is a guessed name.

#define STATE_ON 0
#define STATE_BLINK_SLOW 1
#define STATE_BLINK_FAST 2

int sceSysconCtrlDolceLEDForDriver(SceUInt32 state);

sceSysconConfigLEDForDriver

Version NID
3.60 0x6F586D1A

This is a guessed name.

#define DEVICE_UNK 0x40 // maybe PS button or CP power LED or maybe color (blue)

// unk: SceLedConfig.unk_4

int sceSysconConfigLEDForDriver(int device, SceUInt32 unk);

sceSysconCtrlAccPowerForDriver

Version NID
0.940-3.60 0x8D1D97E8
int sceSysconCtrlAccPowerForDriver(SceBool enable);

sceSysconCtrlDeviceResetForDriver

Version NID
0.990-3.60 0x40FF3898

sceSysconJigOpenPortForDriver

Version NID
0.940-3.60 0x44A173F5
int sceSysconJigOpenPortForDriver(void);

sceSysconJigClosePortForDriver

Version NID
0.940-3.60 0x483FAE05
int sceSysconJigClosePortForDriver(void);

sceSysconJigSetConfigForDriver

Version NID
0.940-3.60 0xD24BF916
int sceSysconJigSetConfigForDriver(char a1, char a2);

sceSysconCtrlHostOutputViaDongleForDriver

Version NID
0.990-3.60 0xDECCB2B4

Connect / disconnect PSVita SLIM Jig Host.

int sceSysconCtrlHostOutputViaDongleForDriver(SceBool enable);

receive_pm_sm_jig_msg_from_syscon

Version NID
0.940-3.60 0x3C80B529
int receive_pm_sm_jig_msg_from_syscon(SceUInt32 offset, SceSize size, void *buf);

send_pm_sm_jig_msg_to_syscon

Version NID
0.940-3.60 0x7BFBA09E

send_pm_sm_stop_to_syscon

Version NID
0.990-3.60 0x933D813F

Used just after send_pm_sm_jig_msg_to_syscon or when it fails before.

int send_pm_sm_stop_to_syscon(int a1, int a2, int a3);

sceSysconIduModeSetForDriver

Version NID
3.60 0x956D07CB

sceSysconIduModeClearForDriver

Version NID
3.60 0x34574496

sceSysconShowModeSetForDriver

Version NID
3.60 0x6D65B70F

sceSysconShowModeClearForDriver

Version NID
3.60 0x8D7724C0

sceSysconIsDownLoaderModeForDriver

Version NID
3.60 0x9ADD60D2

sceSysconIsDealDownLoaderModeForDriver

Version NID
0.990-3.60 0xB7BCC638

sceSysconSetAlarmCallbackForDriver

Version NID
3.60 0x32418370

sceSysconSetWlanCallbackForDriver

Version NID
0.990 0x4DEB8712
3.60 not present

This is a guessed name.

Looks like sceSysconSetAlarmCallbackForDriver.

sceSysconSetLowBatteryCallbackForDriver

Version NID
3.60 0x3F0DB7C0

sceSysconSetThermalAlertCallbackForDriver

Version NID
3.60 0x773B8126

sceSysconUpdaterSetSegmentForDriver

Version NID
0.931-3.60 0x9B00BC7F
// segment_no: a 8bit value
int sceSysconUpdaterSetSegmentForDriver(SceUInt32 segment_no);

sceSysconUpdaterLoadSegmentForDriver

Version NID
0.931-3.60 0x356B9696
// pSegment: the encrypted segment to load
// unk: maybe segment_no
// size: usually 0x400
int sceSysconUpdaterLoadSegmentForDriver(void *segment, int unk, SceSize size);

sceSysconUpdaterLoadSegment2ForDriver

Version NID
0.931-3.60 0x734544E4
// pSegment: the encrypted segment to load
// unk: maybe segment_no
// size: usually 0x400
int sceSysconUpdaterLoadSegment2ForDriver(void *segment, int unk, SceSize size);

sceSysconUpdaterCalcChecksumForDriver

Version NID
0.931-3.60 0xD27C3D80

Computes checksum to use with sceSysconUpdaterExecProgrammingForDriver. It does not call any Syscon command.

int sceSysconUpdaterCalcChecksumForDriver(void *data, SceSize size, int *checksum);

sceSysconUpdaterExecProgrammingForDriver

Version NID
0.931-3.60 0x69AD76E4

Executes programming, i.e writes segments on Syscon EEPROM.

// checksum: value got from sceSysconUpdaterCalcChecksumForDriver
int sceSysconUpdaterExecProgrammingForDriver(int checksum);

sceSysconUpdaterSetRunModeForDriver

Version NID
0.931-3.60 0xB487C2FB
// mode: 0x72BA (0.931-3.60), 0x9A54 (0.931-0.3.60), 0x152E (3.60), 0x3665 (3.60), 0xC5E7 (3.60), 
int sceSysconUpdaterSetRunModeForDriver(int mode);

sceSysconUpdaterExecFinalizeForDriver

Version NID
0.931-3.60 0xC7747A63
// digest: sha1 of decrypted concatenated segments, comes from Syscon Update package packet type 0x20
// size: usually 0x14 (sha1 size)
int sceSysconUpdaterExecFinalizeForDriver(void *digest, SceSize size);

SceSysconForDriver_CBA836FF

Version NID
0.931-0.940 not present
3.60 0xCBA836FF

Sends a 0x18-byte buffer to Syscon command 0x1185. This Syscon command 0x1185 seems to be unimplemented in recent Syscon FWs: it does not do anything.

// size: must be 0x18
int SceSysconForDriver_CBA836FF(void *pBuf, SceSize size);

snvs_read

Version NID
1.03-3.60 0xEBDF88B9

Used in SceSblPostSsMgr to read data from SNVS with pm_sm command 8. Also used in SceSblUpdateMgr with update_service_sm commands 0xB0002 and 0xC0002.

// in_size: 0x10
// out_size: 0x30
int snvs_read(void *in_buf, SceSize in_size, void *out_buf, SceSize out_size);

snvs_write

Version NID
1.03-3.60 0x63683B9B

Used in SceSblPostSsMgr to write data to SNVS with pm_sm command 8. Also used in SceSblUpdateMgr with update_service_sm commands 0xB0002 and 0xC0002.

// in_size: 0x30
// out_size: 0x10
int snvs_write(void *in_buf, SceSize in_size, void *out_buf, SceSize out_size);

syscon_update_command_0xD00002

Version NID
0.931-0.940 not present
3.60 0x4D03754A

Calls Syscon command 0xD0.

Used in SceSblUpdateMgr with update_service_sm command 0xD0002.

// in_buf: buffer that embeds input data, usually 0xD0002 command request + 8
// in_size: usually 0x28
// out_buf: buffer to receive result, usually 0xD0002 command request + 0x30
// out_size: usually 0x28
int syscon_update_command_0xD00002(void *in_buf, SceSize in_size, void *out_buf, SceSize out_size);

SceSysconForDriver_D7F5A797

Version NID
0.931-3.60 0xD7F5A797

Used only by ScePower.

int SceSysconForDriver_D7F5A797(void);

SceSysconForDriver_B9EA2FA8

Version NID
0.931-0.940 not present
3.60 0xB9EA2FA8

Used only by SceUsbServ.

int SceSysconForDriver_B9EA2FA8(void);

SceSysconForDriver_C562AF3A

Version NID
0.931-3.60 0xC562AF3A

Only used by ScePower.

If Ernie version is greater than 0x70503 it calls syscon command 0x900 else syscon command 0x802.

pOut value comes from Syscon. Only 4 bytes are copied to pOut.

int SceSysconForDriver_C562AF3A(SceUInt32 *pOut);

SceSysconForDriver_901D6CD4

Version NID
0.931-3.60 0x901D6CD4

Sets a flag used internally by SceSyscon.

Used by SceCtrl, ScePower.

int SceSysconForDriver_901D6CD4(int enable);

sceSysconGetControlsInfoForDriver

Version NID
0.931-3.60 0x145F59A4

This is a guessed name.

See Boot Controls Info.

Runs syscon command 0x100.

int sceSysconGetControlsInfoForDriver(SceUInt32 *pCtrl);

SceSysconForDriver_76272CB9

Version NID
0.931-0.940 not present
3.60 0x76272CB9

Gets a 4 byte value.

Runs syscon command 0x120.

int SceSysconForDriver_76272CB9(SceUInt32 *unk);

SceSysconForDriver_86BAAF7D

Version NID
0.940-3.60 0x86BAAF7D

Returns a 8-bit value casted to 32-bit for convenience.

Used by SceRtc.

int SceSysconForDriver_86BAAF7D(void);

SceSysconForDriver_D7BEFF8B

Version NID
0.931-3.60 0xD7BEFF8B

Gets Syscon power on time in ticks of 0.5 second. Each second the counter automatically increases by 2.

Calls Syscon command 0x11.

Used to calculate the current time and date.

int SceSysconForDriver_D7BEFF8B(SceUInt32 *puiTime);

SceSysconForDriver_3168F3AF

Version NID
0.931-3.60 0x3168F3AF

Calls Syscon command 0x12.

It is an alarm timer. It must be initialized using Syscon command 0x82 via #SceSysconForDriver_51164951.

// FW 0.931
int SceSysconForDriver_3168F3AF(SceUInt32 *pResult);

// FW 3.60
int SceSysconForDriver_3168F3AF(SceUInt32 *pResult, SceUInt32 *pResult2);

SceSysconForDriver_BA09F171

Version NID
0.931-0.940 not present
3.60 0xBA09F171

Calls Syscon command 0x13.

It might be related to alarm/timer.

int SceSysconForDriver_BA09F171(SceUInt32 *pResult, SceUInt32 *pResult2);

SceSysconForDriver_9B6A6F64

Version NID
0.931-3.60 0x9B6A6F64

Calls Syscon command 0x81.

Sets current Syscon power on time in ticks of 0.5 second. The set value can be get with #SceSysconForDriver_D7BEFF8B.

Used by SceRtc. Set to 0 just before setting Current Tick, to reset syscon power on time.

int SceSysconForDriver_9B6A6F64(SceUInt32 time);

SceSysconForDriver_51164951

Version NID
0.931-3.60 0x51164951

Calls Syscon command 0x82. On Syscon version < 0x90907, 4 bytes are sent to Syscon, whilst on Syscon version >= 0x90907, 5 bytes are sent to Syscon.

Used by SceRtc#sceRtcSetAlarmTickForDriver.

The set value can be get with #SceSysconForDriver_3168F3AF.

// a1: seen value: 0xffffffff during Syscon Init
// a2: some 8-bit flag, seen value: 0 during Syscon Init

// FW 0.931
int SceSysconForDriver_51164951(int a1);

// FW 3.60
int SceSysconForDriver_51164951(int a1, int a2);

SceSysconForDriver_373ECF8A

Version NID
0.931-0.940 not present
0.931-3.60 0x373ECF8A

Calls Syscon command 0x83.

Sends 2 bytes of data to Syscon.

int SceSysconForDriver_373ECF8A(SceUInt32 unk);

SceSysconForDriver_253CC522

Version NID
3.60 0x253CC522

Calls Syscon command 0x807.

If calling on devkit, can get 0x8025023F. maybe limited by model.

// dst size is 2 byte.
int SceSysconForDriver_253CC522(SceUInt8 *dst);

SceSysconForDriver_175CE5A1

Version NID
3.60 0x175CE5A1
// dst size is 8 byte.
int SceSysconForDriver_175CE5A1(SceUInt32 *dst);

SceSysconForDriver_596B17B7

Version NID
0.931-3.60 0x596B17B7

Used by ScePower.

int SceSysconForDriver_596B17B7(SceBoolean enable);

SceSysconForDriver_00A65FC1

Version NID
0.931 0x00A65FC1
0.990-3.60 not present

If Syscon version <= 0x70503, it calls Syscon command 0x8A1, else Syscon command 0x982.

Used by ScePower.

int SceSysconForDriver_00A65FC1(int *pInfo);

SceSysconForDriver_FDB3AE9D

Version NID
3.60 0xFDB3AE9D

Commands

It seems like the command format is as follows: (direction << 8) | cmd_id, where direction = 1 means write to syscon, and direction = 0 means read from syscon.

Command Output size Functions NIDs Description
0x0 0x0 0x0D0B6D25
0x1 0x4 module_start sceSysconGetBaryonVersionForDriver. Used during SysconInit.
0x2 0xC module_start sceSysconGetBaryonTimestampForDriver. Returns 12-byte string followed by at least 2-byte memory leak. Used during SysconInit.
0x3 0x4 module_start sceSysconGetSleepFactor. Used during SysconInit.
0x4 0x4
0x5 0x4 0xCBD6D8BC sceSysconGetHardwareInfoForDriver
0x6 0x10 Get "Hardware flags". See KBL Param#Hardware flags.
0x10 0x2 0xCF5B2F2F sceSysconGetWakeupFactorForDriver
0x11 0x4 0xD7BEFF8B ??
0x12 0x5 or 0x6 0x3168F3AF ??
0x13 0x2 0xBA09F171 ??
0x14 0x1 0x93075DD1 ??
0x15 0x4 0x3E09A1F4 sceSysconGetManufacturesStatusForDriver
0x80 0x0 module_start ?? used at SysconInit
0x81 ? 0x9B6A6F64
0x82 ? 0x51164951
0x83 ? 0x373ECF8A
0x84 ? 0x2659535C
0x85 ? 0x4295D497
0x86 ? 0x701535FC sceSysconGetLogInfoForDriver
0x87 ? 0x4E55CF5E sceSysconLogStartForDriver
0x88 ? 0x487D97F3 sceSysconLogReadDataForDriver
0x89 ? 0x9C0B1E61 sceSysconLogStartWaitingForDriver
0x90 ?0x3B? 0x299B1CE7 sceSysconReadScratchPadForDriver
0x91 ?0x3B? 0xE26488B9 sceSysconWriteScratchPadForDriver
0xA0 ?0x10 or 0x28? second_loader See Ernie Secure.
0xB0 ? 0x058941D7 ??
0xB1 ? 0xDF8C6D2D sceSysconCtrlWirelessPowerDownForDriver
0xB2 ?0x3B or 2? 0xDECCB2B4 sceSysconCtrlHostOutputViaDongleForDriver
0xB3 ? 0x33B5CDB3 ??
0xB4 ? 0xF6D4DDC4 ??
0xB5 ? 0x00AE3AEB
0xB6 ? 0x0D300158
0xB7 ? 0x91EF4EC3 ??
0xC0 ?0x3E?
0xC1 ?0x3C? 0x94AB13CC sceSysconErnieShutdownForDriver
0xD0 ?0x2A or 0x28?
0xD1 ?0x2?
0xD2 ?0x30? second_loader, SNVS functions See Ernie Secure. SNVS RW.
0xD3 ?0x12?
0x100 0x4 0x145F59A4 sceSysconGetControlsInfoForDriver
0x101 ?0x8? Uses ErnieVersion and ErnieDLVersion
0x102 0xC
0x103 0x4 0x1503D6A0 sceSysconGetMultiCnInfoForDriver
0x104 0xC
0x105 ? Uses string "PS" then "TUV".
0x106 ?
0x107 ?
0x108 ?
0x109 ?
0x110 ?
0x120 ? 0x76272CB9 ??
0x121 ?
0x130 0x4 module_start ?? used during SysconInit
0x131 ?0x1? 0xF99BC858 ?? Added on a FW higher than 2.50.
0x140 ?
0x141 ?
0x142 ?
0x143 ?
0x144 ?
0x145 ?
0x146 ?
0x147 ?
0x148 ?
0x150 ?
0x151 ?
0x152 ?
0x153 ?
0x154 ?
0x155 ?
0x156 ?
0x157 ?
0x160 ?
0x161 ?
0x162 ?
0x163 ?
0x168 ?
0x170 ?
0x171 ?
0x172 ?
0x180 ?
0x181 ? 0xCFCEE733
0x182 ?
0x183 ? 0xFDB3AE9D
0x184 ?
0x185 ?
0x186 ?
0x187 ?
0x188 ?
0x189 ?
0x18A ?
0x18B ?
0x18C ?
0x18D ?
0x18E ?
0x18F ?
0x190 ? 0x8AAB6308 sceSysconSetMultiCnPortForDriver
0x191 ?
0x192 ?
0x1A0 ?
0x1A1 ?
0x1B0 ? 0xE7893732
0x1B2 ?
0x1C0 ?
0x1C1 ?
0x1C2 ?
0x1C3 ?
0x1C4 ?
0x1D0 ?
0x1D1 ?
0x1D2 ?
0x1D3 ?
0x1D4 ?
0x1D5 ?
0x1E0 ?
0x1E1 ?
0x1E2 ?
0x1E3 ?
0x300 ?
0x301 ?
0x303 ?
0x380 ? 0xF492E69E sceSysconGetTouchpanelDeviceInfoForDriver
0x38A ? 0xA1F1B973 ??
0x390 ? 0x030D447F sceSysconGetTouchpanelDeviceInfo2ForDriver
0x392 ? 0x48ED8981, 060E55C1
0x393 ? 0x9A28BEEF, 0x8874EF45 used in SceSblUpdateMgr
0x3A9 ? 0x010F95D9
0x3AB ? 0x357CC9D9
0x3AC ? 0x3664E2C0 ??
0x3AF ? 0xB8F4F4E3
0x3B9 ? 0x42E599AC
0x3BB ? 0xCCA56A16
0x3BC ? 0x2E6D97CD ??
0x3BF ? 0x240A604E
0x3C2 ? 0x5946B29B, 0x10327C64 used in SceSblUpdateMgr
0x480 ? 0xD01E64FC ??
0x481 ? 0x9A7858B6 ??
0x800 0x4 0xA2FE9BF9 ?? related to Ernie#CMD_0x0800 Get USB Info
0x801 0x0 ??
0x802 ? 0xC562AF3A ??
0x803 ? 0x03F11220 ??
0x804 ? ??
0x805 ?0x0? 0xEF810687 sceSysconGetUsbDetStatusForDriver
0x806 ?0x1? 0xE7F5D3DC Reboots Vita?
0x807 ?0x0? 0x253CC522 ??
0x820 0x0 0x727F985A sceSysconCtrlDolceLEDForDriver. PSTV LED on
0x821 0x0 0x727F985A sceSysconCtrlDolceLEDForDriver. PSTV LED blink slow
0x822 0x0 0x727F985A sceSysconCtrlDolceLEDForDriver. PSTV LED blink fast
0x840 ?0x1? 0x4FEC564C sceSysconGetManualChargeModeForDriver
0x841 ?0x1? 0x3C3B949C ??
0x842 ?0x1? 0x1C29C00E ??
0x843 ?0x1? 0x730E4725 ??
0x880 ? 0xA039B563 ??
0x881 ? 0x9BF78047 ??
0x884 ? 0x3FDD29D6 ??
0x885 ? 0x79E6DD8B ??
0x886 ?0x2? 0x62155962 sceSysconCtrlHdmiCecPowerForDriver
0x887 ? 0x063425AE maybe sceSysconCtrlMotionSensorPowerForDriver
0x888 ?0x2? 0xBE1ADE4F sceSysconCtrlSdPowerForDriver
0x889 ?0x2? 0x8D1D97E8 sceSysconCtrlAccPowerForDriver
0x88A ? 0x4FBDA504, 0xA2E85DB9 sceSysconCtrlWirelessPowerForDriver, sceSysconCtrlWirelessPower2ForDriver
0x88B ? 0x5A614349 ??
0x88C ? 0xB872E904 ??
0x88D ? 0xDD16ABD9 ??
0x88E ?0x2? 0x7F198FA2 maybe related to clock frequency. see Ernie#CMD_0x088E
0x88F ?0x2? 0x40FF3898 sceSysconCtrlDeviceResetForDriver ?UsbEtherSmsc and WlanBt related?
0x890 ? 0x285594F8 ??
0x891 ?0x2? 0x04EC7579 sceSysconCtrlLEDForDriver
0x892 ? 0x596B17B7 ScePower related
0x893 ? 0x2A4B0437 ScePower related
0x899 ? 0x5CDDA14D SceHpremote related
0x89A ? 0x59DC5938 SceUdcd and ScePower related
0x89B ?0x2? 0x710A7CF0 sceSysconCtrlRMRPowerForDriver
0x89C ?0x2? 0xB1F88B11 SceUsbServ related
0x89D ? 0x6F586D1A sceSysconConfigLEDForDriver
0x89E ? 0x9CA6EB70 ScePower related
0x89F ? 0xCB41B531 ??
0x8A0 ? 0x9070F139 ScePower related
0x8A1 ? 0x00A65FC1 ScePower related
0x8A2 ? 0x0826BA07 ??
0x8A3 ? 0xB841C141 ??
0x8A4 ? 91D3B7A3 ??
0x8B0 ? 0x4946538A sceSysconEnableHibernateIOForDriver
0x8C0 ? 0xC6A2C9EF sceSysconCtrlManualChargeModeForDriver
0x8C5 ?0x2? 0x3274A925 SceUsbServ and SceUsbEtherSmsc related
0x8C6 ? 0xDFB024C4 SceSblUpdateMgr related
0x8C7 ? 0x87FF8041 ??
0x8C8 ? 0x7BFA95DA ??
0x8C9 ? 0x451C1662 ??
0x8CA ? 0x79074DE4 ??
0x8CB ? 0x7D25F6D2 ??
0x8CC ? 0xD2ADABCA ??
0x8CE ? 0x3B354824 sceSysconGetTemperatureLog
0x8CF ? 0x3843D657 sceSysconClearTemperatureLog
0x8D0 ? 0xF87679EE ??
0x900 ? 0xC562AF3A ??
0x901 ? 0x03F11220 ??
0x902 ? 0xAD0A8275 ??
0x903 ? 0x26F9D729 ?? Added on a FW higher than 2.50.
0x904 ? 0x9ADC9936 sceSysconGetBatteryCalibDataForDriver
0x910 ?
0x911 ?
0x912 ?
0x913 ?
0x914 ?
0x915 ?
0x916 ?
0x917 ?
0x932 ?
0x944 ?
0x945 ?
0x952 ? Uses string "PC" then "TUV".
0x953 ?
0x954 ?
0x961 ?
0x962 ?
0x963 ?
0x964 ?
0x965 ?
0x966 ?
0x967 ?
0x968 ?
0x969 ?
0x980 ? 0x68E0031E sceSysconGetBatteryVersionForDriver
0x981 ? 0x9070F139 ScePower related
0x982 ?0x3B? 0x00A65FC1 ScePower related
0x983 ? 0x0826BA07 ??
0x984 ? 0xB841C141 ??
0x985 ? 0x91D3B7A3 ??
0x989 ? 0x87DA378D sceSysconBatterySWResetForDriver
0x98A ?0x3B? 0xF93CF833 ??
0x98B ? 0xE1885F68 ??
0x98C ? 0xCD73079D ??
0x9B0 ? 0x2CEF078E sceSysconBatteryStartBLModeForDriver
0x9B1 ? 0xE4AE7852 sceSysconBatteryStopBLModeForDriver
0x9B2 ? 0xE4F29744 sceSysconBatterySetBLCommandForDriver
0x9B3 ? 0x74B2AB55 sceSysconBatteryExecBLCommandForDriver
0x9B4 ? 0x448DAFF1 sceSysconBatteryReadBLCommandForDriver
0xA00 0x0 ??
0xA82 ? 0x7BAFE083 ??
0x1080 ?0x0 or 0x2? 0x81A6060D sceSysconNvsSetRunModeForDriver
0x1081 ?0x0 or 0x2? 0x2EC6D55D sceSysconNvsSetUnkModeForDriver
0x1082 ? 0xACAFA2B8 sceSysconNvsReadDataForDriver
0x1083 ?0x2? 0x10C9657A sceSysconNvsWriteDataForDriver
0x1100 0x4 0xD2F456DC sceSysconGetErnieDLVersionForDriver
0x1101 0x4
0x1180 ? 0x9B00BC7F sceSysconUpdaterSetSegmentForDriver
0x1181 ? 0x356B9696, 0x734544E4 sceSysconUpdaterLoadSegmentForDriver, sceSysconUpdaterLoadSegment2ForDriver
0x1182 ? 0x69AD76E4 sceSysconUpdaterExecProgrammingForDriver
0x1183 ? 0xB487C2FB sceSysconUpdaterSetRunModeForDriver
0x1184 ? 0xC7747A63 sceSysconUpdaterExecFinalizeForDriver
0x1185 ? 0xCBA836FF SceSysconForDriver_CBA836FF
0x1300 0x8 ??
0x1310 0x1 0x351946B0 ??
0x1382 ? 0xA4968B8C sceSysconBeginConfigstorageTransactionForDriver
0x1383 ? 0xFCC3E8EE sceSysconEndConfigstorageTransactionForDriver
0x1384 ? 0x7B9B3617 sceSysconCommitConfigstorageTransactionForDriver
0x1385 ? 0x89C5CFD6 sceSysconLoadConfigstorageScriptForDriver
0x1386 (not implemented in Syscon FW) ? 0xCC6F90A8 sceSysconVerifyConfigstorageScriptForDriver
0x1392 ? 0xFD65FFCB ??
0x1393 ? 0x02350352 ??
0x1394 ? 0x7DE84CE3 ??
0x2080 ? 0x44A173F5 sceSysconJigOpenPortForDriver
0x2081 ? 0x483FAE05 sceSysconJigClosePortForDriver
0x2082 ? 0xD24BF916 sceSysconJigSetConfigForDriver
0x2083 ?
0x2084 ?
0x2085 ?

Callbacks

All the following exports have this function prototype: int sceSysconSet*Callback(void (*func)(int enable, void *argp), void *argp);.

Maybe we will find more same as on PSP: SilverSpring's PSP Syscon callbacks enum.

NID Function Description
0x129EA022 ?? ??
0x14730196 ?? ??
0x2D471528 ?? ??. Set by ScePower. Very similar to SYSCON_CB_LOW_BATTERY.
0x32418370 sceSysconSetAlarmCallbackForDriver SYSCON_CB_ALARM. Set by ScePower.
0x3F0DB7C0 sceSysconSetLowBatteryCallbackForDriver SYSCON_CB_LOW_BATTERY. Set by ScePower.
0x773B8126 sceSysconSetThermalAlertCallbackForDriver SYSCON_CB_THERMAL_ALERT. Set by ScePower.
0x80D6E061 ?? ??. Set by ScePower.
0x9F8340FF ?? ??