SceSysmem

SceSysmem is a kernel module that acts as the heart of the kernel. It exports multiple libraries for various features. SceSysmem is the first module that is loaded in the kernel load sequence and its libraries are imported by almost all other modules. See Memory for more details on the memory subsystem.

Module

This module exists in both non-secure and secure world. The non-secure world SELF can be found in os0:kd/sysmem.skprx. It also can be found in the Boot Image.

Known NIDs

Version	Name	World	Privilege	NID
1.69	SceSysmem	Non-secure	Kernel	0xB93950C6
3.60	SceSysmem	Non-secure	Kernel	0x3380B323
3.61	SceSysmem	Non-secure	Kernel	0x3380B323
1.69	SceSysmem	Secure	Kernel	0x502BE0E5

Libraries

Known NIDs

Version	Name	World	Visibility	NID
1.69	SceSysmemForKernel	Non-secure	Kernel	0x63A519E5
3.60	SceSysmemForKernel	Non-secure	Kernel	0x63A519E5
1.69	SceSysmemForDriver	Non-secure	Kernel	0x6F25E18A
3.60	SceSysmemForDriver	Non-secure	Kernel	0x6F25E18A
1.69	SceSysmem	Non-secure	User	0x37FE725A
3.60	SceSysmem	Non-secure	User	0x37FE725A
1.69	SceSysmemForDebugger	Non-secure	Kernel	0xC7309957
1.69	SceDipsw	Non-secure	User	0xB36D5922
3.60	SceDipsw	Non-secure	User	0xB36D5922
1.69	SceDipswForDriver	Non-secure	Kernel	0xC9E26388
3.60	SceDipswForDriver	Non-secure	Kernel	0xC9E26388
1.69	SceUartForKernel	Non-secure	Kernel	0xC03DBE40
3.60	SceUartForKernel	Non-secure	Kernel	0xC03DBE40
1.69	SceCpu	Non-secure	User	0x45265161
3.60	SceCpu	Non-secure	User	0x45265161
1.69	SceCpuForKernel	Non-secure	Kernel	0x54BF2BAB
3.60	SceCpuForKernel	Non-secure	Kernel	0x54BF2BAB
1.69	SceCpuForDriver	Non-secure	Kernel	0x40ECDB0E
3.60	SceCpuForDriver	Non-secure	Kernel	0x40ECDB0E
1.69	SceSysclibForKernel	Non-secure	Kernel	0x24878615
3.60	SceSysclibForKernel	Non-secure	Kernel	removed
1.69	SceSysclibForDriver	Non-secure	Kernel	0x7EE45391
3.60	SceSysclibForDriver	Non-secure	Kernel	0x7EE45391
1.69	SceSysrootForKernel	Non-secure	Kernel	0x3691DA45
3.60	SceSysrootForKernel	Non-secure	Kernel	0x3691DA45
1.69	SceSysrootForDriver	Non-secure	Kernel	0x2ED7F97A
3.60	SceSysrootForDriver	Non-secure	Kernel	0x2ED7F97A
1.69	SceKernelUtilsForDriver	Non-secure	Kernel	0x496AD8B4
3.60	SceKernelUtilsForDriver	Non-secure	Kernel	0x496AD8B4
1.69	SceZlibForDriver	Non-secure	Kernel	0xE241534E
1.69	SceKernelSuspendForDriver	Non-secure	Kernel	0x7290B21C
3.60	SceKernelSuspendForDriver	Non-secure	Kernel	0x7290B21C
1.69	SceQafMgrForDriver	Non-secure	Kernel	0x4E29D3B6
3.60	SceQafMgrForDriver	Non-secure	Kernel	0x4E29D3B6
1.69	ScePmMgrForDriver	Non-secure	Kernel	0xF13F32F9
3.60	ScePmMgrForDriver	Non-secure	Kernel	0xF13F32F9
1.69	SceSblAIMgrForDriver	Non-secure	Kernel	0xFD00C69A
3.60	SceSblAIMgrForDriver	Non-secure	Kernel	0xFD00C69A
1.69	SceProcEventForDriver	Non-secure	Kernel	0x887F19D0
3.60	SceProcEventForDriver	Non-secure	Kernel	0x887F19D0
3.60	SceDebugLed	Non-secure	User	0xAE004C0A
3.60	SceDebugLedForDriver	Non-secure	Kernel	0x7BC05EAD
3.60	SceDebugForKernel	Non-secure	Kernel	0x88C17370
3.60	SceDebugForDriver	Non-secure	Kernel	0x88758561
1.69	SceSysmemForTZS	Secure	Kernel	0x8680060
1.69	SceDipswForTZS	Secure	Kernel	0x9DBF584C
1.69	SceCpuForTZS	Secure	Kernel	0xC516B23E
1.69	SceSysclibForTZS	Secure	Kernel	0xC839BB78
1.69	SceSysrootForTZS	Secure	Kernel	0xFEFF641D
1.69	SceQafMgrForTZS	Secure	Kernel	0x637069DD
1.69	ScePmMgrForTZS	Secure	Kernel	0x27F1AFD8
1.69	SceSblAIMgrForTZS	Secure	Kernel	0x60D19047

Types

typedef int threadmgr_core_ctx;

struct tctx_holder
{
  int unk0;
  int unk4;
  int unk8;
  int unkC;
  int unk10;
  int unk14;
  int unk18;
  int unk1C;
  int unk20;
  int unk24;
  int unk28;
  int unk2C;
  int unk30;
  threadmgr_core_ctx *tctx_34;
};

struct callback_holder1
{
  int unk0;
  int (*unk4)(void);
  int (*unk8)(void);
  int (*unkC)(void);
  int unk10;
  int unk14;
  int unk18;
  int unk1C;
  int (*unk20)(void);
  int unk24;
  int unk28;
  int unk2C;
  int unk30;
  int unk34;
  int unk38;
  int (*unk3C)(void);
};

struct callback_holder2
{
  int size;
  int (__cdecl *unk4)(int result, int *a2);
  int (__cdecl *unk8)(SceUID *a1);
  int (__cdecl *unkC)(int, int *);
  int (__cdecl *sceKernelGetSelfInfoForKernel)(SceUID pid, SceSelfInfo *self_info);
  int (__cdecl *sceKernelGetProcessTitleIdForKernel)(SceUID pid, char *titleid, size_t len);
  int (__cdecl *unk18)(unsigned int a1);
  int (__cdecl *unk1c)(int a1);
};

struct callback_holder3
{
  int unk0;
  int (*unk4)(void);
  int (*unk8)(void);
  int (__fastcall *unkC)(int);
  int (__fastcall *unk10)(int);
  int (*unk14)(void);
};

struct sysbase_t
{
  tctx_holder *hldr[6];
  char unk[84];
  char *sysroot_buffer;
  int unk70;
  char unk74[616];
  char unk2dc[52];
  int unk310;
  int unk314;
  int unk318;
  int unk31C;
  int unk320;
  int unk324;
  int unk328;
  int unk32C;
  int unk330;
  int unk334;
  int unk338;
  int unk33C;
  int unk340;
  int (__cdecl *unk344)();
  int unk348;
  int (*unk34C_some_callback1)(void);
  callback_holder3 *unk350;
  int unk354;
  callback_holder1 *unk358;
  callback_holder2 *unk35C;
  int (*unk360)(void);
  int (*unk364)(void);
  int (__fastcall *unk368)(int, int, int);
  char unk36C[20];
  int (__cdecl *sceSblLicMgrGetLicenseStatusForDriver)();
  int (__cdecl *SceSblPostSsMgrForDriver_22599675)();
  int (__cdecl *SceSblPostSsMgrForDriver_9b49c249)();
  int (__cdecl *SceSblPostSsMgrForDriver_d8a2d465)(unsigned long long);
  int (__cdecl *SceSblPostSsMgrForDriver_abdd68cd)(void *);
  int (__cdecl *sceSblUtMgrHasNpTestFlagForDriver)();
  int (*SceSblUpdateMgr_smth)(void);
  int (*ScePower_smth)(void);
};

typedef int (*SceClassCallback)(void *item);

typedef struct SceClass {
	struct SceClass *next;
	struct SceClass *root;
	struct SceClass *prev;
	const char *name;
	struct SceClass *uidclass;
	unsigned int attributes;
	unsigned short itemsize;
	unsigned short unk1A;
	unsigned int object_type;
	SceClassCallback create_cb;
	SceClassCallback destroy_cb;
	unsigned int magic; /* 0xABCE9DA5 */
} SceClass; /* size = 0x2C */

Memory Block Type

The type parameter indicates what kind of memory to allocate. Here is a mapping of type flags to ARM MMU flags. Higher bits are used for other options including where to allocate from. Not all flag values are valid, there is a table of valid types in the kernel. You cannot, for example, allocate RWX memory.

Mask	Value	Description
0x10000	0x10000	Global. `nG` bit NOT set
0xFF00	0x800	`B` bit set. Sharable device memory.
0xFF00	0x2000	`TEX[2]` and `TEX[0]` bit set. Outer cache Write-back, Write-Allocate. Inner cache non-cachable.
0xFF00	0x4000	`TEX[2]` and `B` bit set. Outer cache non-cachable. Inner cache Write-back, Write-Allocate
0xFF00	0x8000	`TEX[0]` bit set. `S` bit unset. Outer and inner non-cachable. Not sharable.
0xFF00	0xD000	`TEX[0]` bit set. `C,B` bits set. Outer and inner Write-back, Write-Allocate.
0xFF	0x4	`AP[2:0] = 5`, `XN=1`. Privileged RO, User NA.
0xFF	0x5	`AP[2:0] = 5`. Privileged RX, User NA.
0xFF	0x6	`AP[2:0] = 1`, `XN=1`. Privileged RW, User NA.
0xFF	0x7	`AP[2:0] = 1`. Privileged RWX, User NA. (Never used)
0xFF	0x50	`AP[2:0] = 7`. Privileged RX, User RX.
0xFF	0x60	`AP[2:0] = 3`, `XN=1`. Privileged RW, User RW.
0xFF	0x40	`AP[2:0] = 7`, `XN=1`. Privileged RO, User RO.

Mask	Value	Name
0x0F000000	0x09000000	SceKernelUserCdram
0x0F000000	0x0A000000	SceKernelUserShared
0x0F000000	0x0B000000	SceKernelUserIO
0x0F000000	0x0C000000	SceKernelUserMain
0x0F000000	0x0D000000	SceKernelUserUncache
0x0F000000	0x0E000000	SceKernelUserCDialog
0x0F000000	0x0F000000	SceKernelUserCDialogNC

SceSysmemForKernel

sceKernelRxMemcpyKernelToUserForPidForKernel

Version	World	NID
1.69	non-secure	0x30931572
3.60	non-secure	0x30931572

Unrestricted memcpy to the virtual address space for process pid. Both dst and src must be in the address space of pid but src must also be accessible in the address space of the caller. This is normally used for resolving stubs in module loads. Same as write to RO but does a cache flush.

int sceKernelRxMemcpyKernelToUserForPidForKernel(SceUID pid, uintptr_t dst, const void *src, size_t len);

sceKernelFindClassByNameForKernel

Version	World	NID
3.60	Non-secure	0x62989905

int sceKernelFindClassByNameForKernel(const char *name, SceClass **class);

sceKernelGetMemBlockTypeForKernel

Version	World	NID
3.60	Non-secure	0x289BE3EC

/***
 * Gets the memory block type of a memory block
 *
 * @param[in] uid - SceUID of the memory block
 * @param[out] type - Type of the memory block identified by uid
 *
 * @return 0 on success, < 0 on error.
*/
int sceKernelGetMemBlockTypeForKernel(SceUID uid, unsigned int *type);

sceKernelCreateUidObjForKernel

Version	World	NID
3.60	Non-secure	0xDF0288D7

SceUID sceKernelCreateUidObjForKernel(SceClass *class, const char *name, SceCreateUidObjOpt *opt, SceObjectBase **obj);

SceSysmemForDriver

sceKernelMemcpyKernelToUserForDriver

Version	World	NID
1.69	non-secure	0x6D88EF8A
3.60	non-secure	0x6D88EF8A

int sceKernelMemcpyKernelToUserForDriver(uint32_t uaddr, const void *kaddr, uint32_t len);

sceKernelMemcpyUserToKernelForDriver

Version	World	NID
1.69	non-secure	0xBC996A7A
3.60	non-secure	0xBC996A7A

int sceKernelMemcpyUserToKernelForDriver(void *kaddr, uint32_t uaddr, uint32_t len);

sceKernelMemcpyUserToKernelForPidForDriver

Version	World	NID
3.60	non-secure	0x605275F8

int sceKernelMemcpyUserToKernelForPidForDriver(SceUID pid, void *kaddr, uint32_t uaddr, uint32_t len);

Same as above, but copies from the specified process.

sceKernelStrncpyKernelToUserForDriver

Version	World	NID
1.69	non-secure	0x80BD6FEB
3.60	non-secure	0x80BD6FEB

int sceKernelStrncpyKernelToUserForDriver(uint32_t uaddr, const void *kaddr, uint32_t maxlen);

sceKernelStrncpyUserToKernelForDriver

Version	World	NID
1.69	non-secure	0xDB3EC244
3.60	non-secure	0xDB3EC244

int sceKernelStrncpyUserToKernelForDriver(void *kaddr, uint32_t uaddr, uint32_t maxlen);

sceKernelStrnlenUserForDriver

Version	World	NID
1.69	non-secure	0xB429D419
3.60	non-secure	0xB429D419

int sceKernelStrnlenUserForDriver(uint32_t uaddr, uint32_t maxlen);

sceKernelGetPaddrForDriver

Version	World	NID
1.69	secure	0x1DEADF6C
1.69	non-secure	0x8D160E65
3.60	non-secure	0x8D160E65

if (result == 0)
    return 0x80020005; // SCE_KERNEL_ERROR_INVALID_FLAGS
return sceKernelCpuGetPaddrWithMaskForKernel(0x33, vaddr, result);

This will write the physical address for a virtual address vaddr to memory pointed to by result.

Returns <0 on error, values >=0 indicate success.

int sceKernelGetPaddrForDriver(void *vaddr, void **result);

sceKernelGetPaddrListForDriver

Version	World	NID
1.69	non-secure	0xE68BEEBD
3.60	non-secure	0xE68BEEBD

typedef struct SceKernelAddrPair {
	uint32_t addr;
	uint32_t length;
} SceKernelAddrPair;

typedef struct SceKernelPaddrListReq {
	uint32_t size; // 0x14
	uint32_t output_buffer_size;
	uint32_t unk;
	uint32_t ret_count;
	SceKernelAddrPair *output_buffer;
} SceKernelPaddrListReq;

input.addr = vaddr;
input.length = length;
int sceKernelGetPaddrListForDriver(SceKernelAddrPair *input, SceKernelPaddrListReq *req);

This function takes in two parameters: an array of length 2 specifying the virtual address and the size of the block of memory and a request information. The function will write into output_buffer an array of addr_pair that encompasses the block of memory specified in the input. req->ret_count will contain the number of entries written. If output_buffer is null, it will just write the count.

sceKernelAllocMemBlockForDriver

Version	World	NID
1.69	secure	0x402EB970
1.69	non-secure	0xC94850C9
3.60	non-secure	0xC94850C9

typedef enum SceKernelAllocMemBlockAttr {
	SCE_KERNEL_ALLOC_MEMBLOCK_ATTR_HAS_PADDR          = 0x00000002U,
	SCE_KERNEL_ALLOC_MEMBLOCK_ATTR_HAS_ALIGNMENT      = 0x00000004U,
	SCE_KERNEL_ALLOC_MEMBLOCK_ATTR_HAS_MIRROR_BLOCKID = 0x00000040U,
	SCE_KERNEL_ALLOC_MEMBLOCK_ATTR_HAS_PID            = 0x00000080U,
	SCE_KERNEL_ALLOC_MEMBLOCK_ATTR_HAS_PADDR_LIST     = 0x00001000U
} SceKernelAllocMemBlockAttr;

struct SceKernelAllocMemKernelBlockOpt_old {
    uint32_t size; // 0x34
    uint32_t unk;
    uint32_t attr;
    uint32_t unk2;
    uint32_t paddr;
    uint32_t align;
    uint32_t unk3[3];
    uint32_t processid;
    uint32_t unk4[3];
};

// specific to 3.60
typedef struct SceKernelAllocMemBlockKernelOpt {
	SceSize size;                   //!< sizeof(SceKernelAllocMemBlockKernelOpt)
	SceUInt32 field_4;
	SceUInt32 attr;                 //!< OR of SceKernelAllocMemBlockAttr
	SceUInt32 field_C;
	SceUInt32 paddr;
	SceSize alignment;
	SceUInt32 field_18;
	SceUInt32 field_1C;
	SceUInt32 mirror_blockid;
	SceUID pid;
	SceKernelPaddrList *paddr_list;
	SceUInt32 field_2C;
	SceUInt32 field_30;
	SceUInt32 field_34;
	SceUInt32 field_38;
	SceUInt32 field_3C;
	SceUInt32 field_40;
	SceUInt32 field_44;
	SceUInt32 field_48;
	SceUInt32 field_4C;
	SceUInt32 field_50;
	SceUInt32 field_54;
} SceKernelAllocMemBlockKernelOpt;

int sceKernelAllocMemBlockForDriver(const char *name, int32_t type, uint32_t vsize, struct SceKernelAllocMemKernelBlockOpt *pOpt);

The interface is the same as the user version of this call, however more types can be specified and more options are in the pOpt argument.

To allocate a kernel RW block of memory, specify type = 0x6020D006.

To allocate a block of memory with a specific physical address, specify type = 0x20100206 or type = 0x20100806, pOpt->attr = 2, and pOpt->paddr = physical address.

To allocate a block of memory that is kernel executable, specify type = 0x1020D005.

To allocate a block of memory that is physically contiguous, specify type = 0x30808006, pOpt->attr = 0x200004 and an alignment to pOpt->alignment.

To allocate a block of memory inside the CDRAM, specify type = 0x40404006.

pOpt->attr bitmask

Bitmask	Uses
0x00000001	field_C
0x00000002	paddr
0x00000004	alignment
0x00000008	field_18
0x00000010	field_1C
0x00000020	??
0x00000040	mirror_blockid
0x00000080	pid
0x00001000	paddr_list
0x00002000	field_2C
0x00010000	field_30

sceKernelGetMemBlockBaseForDriver

Version	World	NID
1.69	non-secure	0xA841EDDA
3.60	non-secure	0xA841EDDA

int sceKernelGetMemBlockBaseForDriver(int blkid, void **base);

sceKernelFindMemBlockByAddrForDriver

Version	World	NID
1.69	non-secure	0x8A1742F6
3.60	non-secure	0x8A1742F6

int sceKernelFindMemBlockByAddrForDriver(void *base, int);

sceKernelRemapBlockForDriver

Version	World	NID
1.05	non-secure	0x8D332AE1
1.69	non-secure	0xDFE2C8CB
3.60	non-secure	0xDFE2C8CB

int sceKernelRemapBlockForDriver(int blkid, int type);

This is used to remap RW memory as RX. To do this, first allocate a memory block of type 0x1020D006. After you are done writing, call this with type set to 0x1020D005.

sceKernelCreateHeapForDriver

Version	World	NID
1.69	non-secure	0x9328E0E8
3.60	non-secure	0x9328E0E8

typedef struct {
    int size; // 28
    int flags; // usually 0x1 
    int unk;
    int unk;
    int block_type;
    int unk;
    int unk;
} pool_arg_t;

int sceKernelCreateHeapForDriver(const char *name, int size, pool_arg_t *opt); // opt can be NULL

The heap pool is thread safe.

sceKernelDeleteHeapForDriver

Version	World	NID
1.69	non-secure	0xD6437637
3.60	non-secure	0xD6437637

int sceKernelDeleteHeapForDriver(int pool_uid);

sceKernelAllocHeapMemoryForDriver

Version	World	NID
1.69	non-secure	0x7B4CB60A
3.60	non-secure	0x7B4CB60A

void* sceKernelAllocHeapMemoryForDriver(SceUID uid, SceSize size);

sceKernelAllocHeapMemory2ForDriver

Version	World	NID
3.60	non-secure	0xB415B5A8

Same as sceKernelAllocHeapMemoryForDriver but does not set unk2 to 0.

void* sceKernelAllocHeapMemory2ForDriver(SceUID uid, SceSize size, ctx_49D4DD9B* unk2);

sceKernelAllocHeapMemory3ForDriver

Version	World	NID
3.60	non-secure	0x49D4DD9B

Same as sceKernelAllocHeapMemoryForDriver but does not set unk2 to 0.

typedef struct ctx_49D4DD9B
{
   int unk0;
   int unk4;
   int unk8;
   int unkC;
   int unk10;
};

void* sceKernelAllocHeapMemory3ForDriver(SceUID uid, SceSize size, ctx_49D4DD9B* unk2);

sceKernelAllocHeapMemory4ForDriver

Version	World	NID
3.60	non-secure	0xD351EBC8

Same as sceKernelAllocHeapMemory2ForDriver but does set uid to 0x1000B.

Checks that uid is 0x10013 or 0x10005

void* sceKernelAllocHeapMemory4ForDriver(SceUID uid, SceSize size, ctx_49D4DD9B *unk);

sceKernelAllocHeapMemoryFromGlobal1ForDriver

Version	World	NID
3.60	non-secure	0x7750CEA7

Same as sceKernelAllocHeapMemoryForDriver but uses global uid.

void* sceKernelAllocHeapMemoryFromGlobal1ForDriver(SceSize size);

sceKernelAllocHeapMemoryFromGlobal2ForDriver

Version	World	NID
3.60	non-secure	0x0B4ED16A

Same as sceKernelAllocHeapMemoryForDriver but does not set unk2 to 0 and uses global uid.

typedef struct ctx_0B4ED16A
{
  int unk0;
  uint64_t unk8;
  uint64_t unkC;
};

void* sceKernelAllocHeapMemoryFromGlobal2ForDriver(SceSize size, ctx_0B4ED16A* unk);

sceKernelFreeHeapMemoryForDriver

Version	World	NID
1.69	non-secure	0x3EBCE343
3.60	non-secure	0x3EBCE343

int sceKernelFreeHeapMemoryForDriver(int pool_uid, void *ptr);

sceKernelMapUserBlockForDriver

Version	World	NID
1.69	non-secure	0x7D4F8B5F
3.60	non-secure	0x7D4F8B5F

Permission is either "1" for read only, no execute or "2"/"3" for read write, no execute. Type is either 0, 1, or 17 and affects the block type. 0 is default. This will allocate kernel memory starting at kernel_page. To get the same memory as the user pointer, add the kernel_offset. kernel_size is how much is allocated.

//this signature is for 1.69
int sceKernelMapUserBlockForDriver(int permission, int type, void *user_buf, int size, void **kernel_page, int *kernel_size, int *kernel_offset);

//this signature is for 3.60 - now allows to give a name
int sceKernelMapUserBlockForDriver(char *name, int permission, int type, void *user_buf, int size, void **kernel_page, int *kernel_size, int *kernel_offset);

sceKernelMapUserBlockDefaultTypeForDriver

Version	World	NID
3.60	non-secure	0x278BC201

Assigns type 0.

int sceKernelMapUserBlockDefaultTypeForDriver(char *name, int permission, void *user_buf, int size, void **kernel_page, int *kernel_size, int *kernel_offset);

sceKernelMapUserBlockDefaultTypeForPidForDriver

Version	World	NID
3.60	non-secure	0x0091D74D

Assigns type 0.

int sceKernelMapUserBlockDefaultTypeForPidForDriver(int pid, const char *name, int permission, const void *user_buf, int size, void **kernel_page, int *kernel_size, int *kernel_offset);

Switch TTB For PID

Version	World	NID
1.69	non-secure	0x6F2ACDAE
3.60	non-secure	N/A

Changes the TTBR to point to the tables for a given PID.

int switch_ttb_for_pid(SceUID pid);

sceKernelRoMemcpyKernelToUserForPidForDriver

Version	World	NID
1.69	non-secure	0x571D2739
3.60	non-secure	0x571D2739

int sceKernelRoMemcpyKernelToUserForPidForDriver(SceUID pid, void *dst, const void *src, SceSize size);

sceKernelFirstDifferentIntUserForPidForDriver

Version	World	NID
1.69	non-secure	0x8334454F
3.60	non-secure	0x8334454F

Looks for an integer in userspace.

int sceKernelFirstDifferentIntUserForPidForDriver(SceUID pid, void *haystack, int needle, SceSize size);

sceKernelStrnlenUserForPidForDriver

Version	World	NID
1.69	non-secure	0x9929EB07
3.60	non-secure	0x9929EB07

int sceKernelStrnlenUserForPidForDriver(SceUID pid, char *ptr, SceSize size);

sceKernelStrncpyUserForPidForDriver

Version	World	NID
1.69	non-secure	0x75AAF178
3.60	non-secure	0x75AAF178

int sceKernelStrncpyUserForPidForDriver(SceUID pid, char *dst, const char *kern_src, SceSize size);

sceKernelMemcpyKernelToUserForPidUncheckedForDriver

Version	World	NID
1.69	non-secure	0xFED82F2D
3.60	non-secure	0xFED82F2D

int sceKernelMemcpyKernelToUserForPidUncheckedForDriver(SceUID pid, void *dst, const void *kern_src, SceSize size);

sceKernelMemcpyKernelToUserForPidForDriver

Version	World	NID
1.69	non-secure	0x6B825479
3.60	non-secure	0x6B825479

This will not crash on invalid user pointers, but instead return error.

int sceKernelMemcpyKernelToUserForPidForDriver(SceUID pid, void *dst, const void *kern_src, SceSize size);

sceKernelMemcpyUserToUserForPidForDriver

Version	World	NID
1.69	non-secure	0x8E086C33
3.60	non-secure	0x8E086C33

int sceKernelMemcpyUserToUserForPidForDriver(SceUID pid, void *dst, const void *src, SceSize size);

sceKernelCreateEventForDriver

Version	World	NID
3.60	non-secure	0x56A13E90

SceUID sceKernelCreateEventForDriver(SceClass *cls, const char *name, SceObjectBase **obj);

sceKernelMemRangeRetainWithPermForDriver

Version	World	NID
3.60	non-secure	0xBC0A1D60

Increase references to pages.

int sceKernelMemRangeRetainWithPermForDriver(int perm, const void *addr, unsigned int size);

sceKernelMemRangeReleaseWithPermForDriver

Version	World	NID
3.60	non-secure	0x22CBE925

Decrease references to pages.

int sceKernelMemRangeReleaseWithPermForDriver(int perm, const void *addr, unsigned int size);

sceKernelAllocMemBlockExtForDriver

Version	World	NID
3.60	non-secure	0xD44F464D

int sceKernelAllocMemBlockExtForDriver(const char *name, int type, unsigned int size, SceKernelAllocMemBlockKernelOpt *opt, SceKernelPaddrList *out_paddr_list);

sceKernelFindMemBlockForDriver

Version	World	NID
3.60	non-secure	0x9C78064C

int sceKernelFindMemBlockForDriver(int flags, void *base, SceSize size);

SceSysmemForDriver_98C15666

Version	World	NID
3.60	non-secure	0x98C15666

Returns the paddr and size (addrpair) of the memblock if it's physically continuous.

int SceSysmemForDriver_98C15666(SceUID uid, SceKernelAddrPair *addrpair)

SceSysmem

The SceSysmem library is responsible for both low-level and high-level memory management. There are functions for allocating raw blocks of memory (similar to Linux sbrk) as well as functions for maintaining a heap-like structure (similar to malloc) for kernel, however SceLibKernel implements a proper heap and that is used for user code.

sceKernelMapMemBlock

Version	NID
1.69	0x7B763A21
3.60	not present

sceKernelRemapMemBlock

Version	NID
1.69	0x3B29E0F5
3.60	not present

sceKernelPartialMapMemBlock

Version	NID
1.69	0xC0A59868
3.60	not present

sceKernelUnmapMemBlock

Version	NID
1.69	0xEE30D976
3.60	not present

sceKernelPartialUnmapMemBlock

Version	NID
1.69	0xCA99929B
3.60	not present

sceKernelGetMemBlockInfoByRange

Version	NID
1.69	0x006F3DB4
3.60	0x006F3DB4

sceKernelGetMemBlockInfoByAddr

Version	NID
1.69	0x4010AD65
3.60	0x4010AD65

sceKernelGetSubbudgetInfo

Version	NID
1.69	0x832B4A65
3.60	0x832B4A65

sceKernelGetFreeMemorySize

Version	NID
1.69	0x87CC580B
3.60	0x87CC580B

sceKernelOpenMemBlock

Version	NID
1.69	0x8EB8DFBB
3.60	0x8EB8DFBB

sceKernelFindMemBlockByAddr

Version	NID
1.69	0xA33B99D1
3.60	0xA33B99D1

sceKernelFreeMemBlock

Version	NID
1.69	0xA91E15EE
3.60	0xA91E15EE

sceKernelFreeMemBlockForVM

Version	NID
3.60	0x4EA13FEA

sceKernelCloseMemBlock

Version	NID
1.69	0xB680E3A0
3.60	0xB680E3A0

sceKernelGetMemBlockBase

Version	NID
1.69	0xB8EF5818
3.60	0xB8EF5818

sceKernelAllocMemBlock

Version	NID
1.69	0xB9D5EBDE
3.60	0xB9D5EBDE

sceKernelAllocUnmapMemBlock

Version	NID
3.60	0xEC636BCB

sceKernelOpenVMDomain

Version	NID
1.69	0x9CA3EB2B
3.60	0x9CA3EB2B

sceKernelSyncVMDomain

Version	NID
1.69	0x19D2A81A
3.60	0x19D2A81A

sceKernelCloseVMDomain

Version	NID
1.69	0xD6CA56CA
3.60	0xD6CA56CA

sceKernelAllocMemBlockForVM

Version	NID
1.69	0xE2D7E137
3.60	0xE2D7E137

sceKernelCheckModelCapability

Version	NID
3.60	0x0144FBD9

sceKernelGetModelForCDialog

Version	NID
3.60	0xA2CB322F

sceKernelGetModel

Version	NID
3.60	0xD0D4F729

sceKernelIsPSVitaTV

Version	NID
3.60	0x1453A5E5

SceDipsw

sceKernelCheckDipsw

Version	NID
1.69	0x1C783FB2
3.60	0x1C783FB2

sceKernelClearDipsw

Version	NID
1.69	0x800EDCC1
3.60	0x800EDCC1

sceKernelSetDipsw

Version	NID
1.69	0x817053D4
3.60	0x817053D4

SceDipswForDriver

sceKernelCheckDipswForDriver

Version	NID
3.60	0xA98FC2FD

sceKernelCheckDipswForDriver(int bit);

sceKernelGetDipswForDriver

Version	NID
3.60	0xB2AD48BE

return *(int *)(dipsw_addr + 4 * int_count);

sceKernelGetDipswForDriver(int int_count);

sceKernelClearDipswForDriver

Version	NID
3.60	0xF1F3E9FE

sceKernelClearDipswForDriver(int bit);

sceKernelSetDipswForDriver

Version	NID
3.60	0x82E45FBF

sceKernelSetDipswForDriver(int bit);

SceUartForKernel

sceUartWriteForKernel

Version	NID
3.60	0x41973874

int sceUartWriteForKernel(int device, unsigned char data);

sceUartReadAvailableForKernel

Version	NID
3.60	0x38DB7629

Returns the number of words available to read from the read FIFO.

int sceUartReadAvailableForKernel(int device);

sceUartReadForKernel

Version	NID
3.60	0x9BBF1255

int sceUartReadForKernel(int device);

sceUartInitForKernel

Version	NID
3.60	0xA9C74212

It initializes the clock generator registers for the device. The default baud rate is 115200 for devices 0-5 and 250000 for the device 6.

int sceUartInitForKernel(int device);

SceCpu

This library provides wrapper for much ARM CP15 co-processor access as well as low level support of spinlocks and other synchronization primitives.

sceKernelCpuGetCpuId

Version	World	NID
1.69	non-secure	0x2704CFEE
3.60	non-secure	0x2704CFEE

Return the CPU ID of the current core.

int sceKernelCpuGetCpuId(void);

SceCpuForKernel

sceKernelCpuGetCONTEXTIDRForKernel

Version	World	NID
3.60	non-secure	0x5B6B3274

The CONTEXTIDR, bits [31:0] contain the process ID number.

return (unsigned __int8)__mrc(15, 0, 13, 0, 1); // Read CONTEXTIDR (Context ID Register)

void sceKernelCpuGetCONTEXTIDRForKernel(void);

sceKernelCpuUpdateSCTLRForKernel

Version	World	NID
3.60	non-secure	0x04008CF7

int result;
  result = __mrc(15, 0, 1, 0, 0) | 0x1806; // Read SCTLR (System Control Register)
  __mcr(15, 0, result, 1, 0, 0); // Write SCTLR (System Control Register)
  return result;

void sceKernelCpuUpdateSCTLRForKernel(void); // SCTLR (System Control Register)

sceKernelCpuBranchPredictorInvalidateAllISForKernel

Version	World	NID
3.60	non-secure	0x1BB2BB8D

void sceKernelCpuBranchPredictorInvalidateAllISForKernel(void); // BPIALLIS, Branch predictor invalidate all (IS)

sceKernelCpuBranchPredictorInvalidateAllForKernel

Version	World	NID
3.60	non-secure	0x4C4C7D6B

void sceKernelCpuBranchPredictorInvalidateAllForKernel(void); // BPIALL, Branch predictor invalidate all

sceKernelCpuDcacheInvalidateMVACForKernel

Version	World	NID
3.60	non-secure	0x470EAE1E

void sceKernelCpuDcacheInvalidateMVACForKernel(int mva); // DCIMVAC, Data cache invalidate by MVA (PoC)

sceKernelCpuDcacheInvalidateMVACRangeForKernel

Version	World	NID
3.60	non-secure	0x583F30D1

void sceKernelCpuDcacheInvalidateMVACRangeForKernel(void *addr, unsigned int size); // DCIMVAC, Data cache invalidate by MVA (PoC)

sceKernelCpuDcacheCleanInvalidateMVACRangeForKernel

Version	World	NID
3.60	non-secure	0x6BA2E51C

void sceKernelCpuDcacheCleanInvalidateMVACRangeForKernel(void *addr, unsigned int size); // DCCIMVAC, Data cache clean and invalidate by MVA (PoC)

sceKernelCpuDcacheInvalidateSWForKernel

Version	World	NID
3.60	non-secure	0x2F3BF020

void sceKernelCpuDcacheInvalidateSWForKernel(void); // DCISW, Data cache invalidate by set/way (all the cache)

sceKernelCpuDcacheCleanSWForKernel

Version	World	NID
3.60	non-secure	0x73A30DB2

void sceKernelCpuDcacheCleanSWForKernel(void); // DCCSW, Data cache clean by set/way (all the cache)

sceKernelCpuDcacheCleanInvalidateSWForKernel

Version	World	NID
3.60	non-secure	0x76DAB4D0

void sceKernelCpuDcacheCleanInvalidateSWForKernel(void); // DCCISW, Data cache clean and invalidate by set/way (all the cache)

sceKernelCpuDcacheCleanMVACForKernel

Version	World	NID
3.60	non-secure	0xF7159B55

void sceKernelCpuDcacheCleanMVACForKernel(int mva); // DCCMVAC, Data cache clean by MVA (PoC)

sceKernelCpuDcacheCleanMVACRangeForKernel

Version	World	NID
3.60	non-secure	0xC5C1EE4E

void sceKernelCpuDcacheCleanMVACRangeForKernel(void *addr, unsigned int size); // DCCMVAC, Data cache clean by MVA (PoC)

sceKernelCpuDcacheCleanInvalidateMVACForKernel

Version	World	NID
3.60	non-secure	0xC8E8C9E9

void sceKernelCpuDcacheCleanInvalidateMVACForKernel(int mva); // DCCIMVAC, Data cache clean and invalidate by MVA (PoC)

sceKernelCpuIcacheInvalidateAllUISForKernel

Version	World	NID
3.60	non-secure	0x264DA250

void sceKernelCpuIcacheInvalidateAllUISForKernel(void); // ICIALLUIS, Instruction cache invalidate all (PoU, IS)

sceKernelCpuIcacheInvalidateAllUForKernel

Version	World	NID
3.60	non-secure	0xAEE0B489

void sceKernelCpuIcacheInvalidateAllUForKernel(void); // ICIALLU, Instruction cache invalidate all (PoU)

sceKernelCpuIcacheInvalidateMVAURangeForKernel

Version	World	NID
3.60	non-secure	0xF4C7F578

void sceKernelCpuIcacheInvalidateMVAURangeForKernel(void *addr, unsigned int size); // ICIMVAU, Instruction cache invalidate by MVA (PoU)

sceKernelCpuIcacheAndL2InvalidateMVAURangeForKernel

Version	World	NID
3.60	non-secure	0x19F17BD0

int sceKernelCpuIcacheAndL2InvalidateMVAURangeForKernel(void *addr, unsigned int size);

sceKernelCpuPreloadEngineKill

Version	World	NID
3.60	non-secure	0xD0D85FF8

NSACR (Non-Secure Access Control Register)
Test bit NS access to the Preload Engine resources
[>] PLEFF (Preload Engine FIFO flush operation)
[>] PLEKC (Preload Engine kill channel operation)
[<] PLEASR (Preload Engine Activity Status Register)

int sceKernelCpuPreloadEngineKill(void);

sceKernelCpuUnrestrictedMemcpyForKernel

Version	World	NID
1.69	non-secure	0x8C683DEC
3.60	non-secure	0x8C683DEC

Unrestricted memcpy by first setting the DACR register to 0xFFFF0000 and then doing a memcpy.

int sceKernelCpuUnrestrictedMemcpyForKernel(void *dst, const void *src, size_t len);

sceKernelCpuGetPaddrWithMaskForKernel

Version	World	NID
3.60	non-secure	0x67343A07

maskPAR is usually 0x33, sometimes 2.

int sceKernelCpuGetPaddrWithMaskForKernel(int maskPAR, void *vaddr, void **result);

sceKernelCpuGetPaddrForKernel

Version	World	NID
3.60	non-secure	0x2A46E800

Uses maskPAR 0x33.

int sceKernelCpuGetPaddrForKernel(void *vaddr, void **result);

sceKernelCpuForKernel_9B8173F4

Version	World	NID
3.60	non-secure	0x9B8173F4

Might be get_vaddr_memory_type.

Return value can be:

2
8
0x40
0x80
0xD0
0x80022007 (SCE_KERNEL_ERROR_VA2PA_FAULT)

int sceKernelCpuForKernel_9B8173F4(void *vaddr);

SceCpuForKernel_A5C9DBBA

Version	World	NID
3.60	non-secure	0xA5C9DBBA

Uses sceKernelCpuGetCpuIdForDriver, sceKernelCpuAtomicGetAndSub16ForDriver and sceKernelCpuUnlockStoreLRForDriver.

int SceCpuForKernel_A5C9DBBA(void *addr);

SceCpuForKernel_9D72DD1B

Version	World	NID
3.60	non-secure	0x9D72DD1B

Uses sceKernelCpuGetCpuIdForDriver and sceKernelCpuLockStoreLRForDriver.

int SceCpuForKernel_9D72DD1B(void *addr);

SceCpuForKernel_4CD4D921

Version	World	NID
3.60	non-secure	0x4CD4D921

*(uint32_t *)addr = 1;
*((uint16_t *)addr + 2) = 4;
*((uint16_t *)addr + 3) = 4;
return result;

aka write 01 00 00 00 04 00 04 00 at addr.

int SceCpuForKernel_4CD4D921(void *addr);