psx.wiki

BIOS B Functions: Difference between revisions

Revision as of 02:44, 23 October 2026
RemmyLee
(CPU and system bus at register depth: instruction set, COP0, I/O map, memory control, interrupts, DMA, timers)		Revision as of 02:45, 23 October 2026
RemmyLee
(BIOS and kernel: A, B, C functions, syscalls, events, threads, file I/O, boot, PS-X EXE)
Line 1:Line 1:
+---
+title: BIOS B Functions
+type: component
+summary: Kernel functions called through address 0xB0 with the function number in R9.
+category: System software
+info: Vector = 0x000000B0
+info: Number register = R9
+---
+
+## Overview
+
+The B functions are called by loading the function number into R9 and jumping to address 0xB0. They hold the kernel services for timers, events, threads, the controller, exceptions and the file system.[^spxfn] Sony's kernel library libapi provides the same groups of services to applications.[^lo203] GetB0Table() returns the address of the B function jump table, so a program can patch an entry. The BIOS often calls its own functions directly, however, and in that case a patched entry has no effect.[^spxmisc]
+
+Functions B(4Ah) to B(5Dh) do not exist in the DTL-H2000 BIOS. In the CEX-1000 kernel the table ends at B(F6h), and higher numbers jump into garbage.[^spxfn]
+
+## Kernel Memory and Timers
+
+Table: B kernel memory and timer functions
+
+| Number | Function | Explanation |
+| --- | --- | --- |
+| B(00h) | alloc_kernel_memory(size) | Allocates from the 8K-byte kernel area at 0xA000E000[^spxheap] |
+| B(01h) | free_kernel_memory(buf) | Releases a block of kernel memory |
+| B(02h) | init_timer(t, reload, flags) | Sets the mode and target of timer 0 to 2[^spxtmr] |
+| B(03h) | get_timer(t) | Returns the current value of timer 0 to 2 |
+| B(04h) | enable_timer_irq(t) | Enables the interrupt of timer 0 to 2 or of vertical blank (t = 3) |
+| B(05h) | disable_timer_irq(t) | Disables the same interrupt |
+| B(06h) | restart_timer(t) | Sets the current value of timer 0 to 2 to zero |
+
+The kernel memory area holds the ExCBs (4 x 8 bytes), the EvCBs (N x 0x1C bytes), the TCBs (N x 0xC0 bytes) and the process control block (4 bytes). Unlike the heap, the BIOS initializes it at boot and allocates the blocks from the TCB and EVENT values in SYSTEM.CNF.[^spxheap]
+
+The three hardware timers are not used by any BIOS function, so a game may use them freely.[^spxtmr] Sony's libapi reaches them as root counters through SetRCnt(), GetRCnt(), StartRCnt(), StopRCnt() and ResetRCnt(), which return 0 for RCntCNT3 because vertical synchronization cannot be set.[^lr164][^lr135][^lr160] init_timer() writes 0 to the mode register at 0x1F801104 + t * 16 and then the reload value to 0x1F801108 + t * 16. It builds the new mode from 0x0048 or 0x0049 by flags bit 4, adds 0x100 when flags bit 0 is clear and 0x10 when flags bit 12 is set.[^spxtmr]
+
+## Events
+
+These functions are described on the [events](/system/bios/events/) page.[^spxev][^lo209]
+
+Table: B event functions
+
+| Number | Function | Explanation |
+| --- | --- | --- |
+| B(07h) | DeliverEvent(class, spec) | Generates an event[^lr117] |
+| B(08h) | OpenEvent(class, spec, mode, func) | Opens an event and returns its descriptor[^lr154] |
+| B(09h) | CloseEvent(event) | Releases an EvCB[^lr115] |
+| B(0Ah) | WaitEvent(event) | Waits for an event to occur[^lr176] |
+| B(0Bh) | TestEvent(event) | Checks whether an event has occurred[^lr173] |
+| B(0Ch) | EnableEvent(event) | Enables occurrence of an event[^lr120] |
+| B(0Dh) | DisableEvent(event) | Inhibits occurrence of an event[^lr118] |
+| B(20h) | UnDeliverEvent(class, spec) | Cancels an event[^lr175] |
+
+## Threads
+
+These functions are described on the [threads](/system/bios/threads/) page.[^spxth][^lo212]
+
+Table: B thread functions
+
+| Number | Function | Explanation |
+| --- | --- | --- |
+| B(0Eh) | OpenTh(reg_PC, reg_SP_FP, reg_GP) | Secures a TCB and returns a thread descriptor[^lr155] |
+| B(0Fh) | CloseTh(handle) | Closes a thread and releases its TCB[^lr116] |
+| B(10h) | ChangeTh(handle) | Transfers execution to a thread[^lr113] |
+
+## Controller
+
+These functions read the controllers on each vertical blank interrupt.[^spxpad][^lo217]
+
+Table: B controller functions
+
+| Number | Function | Explanation |
+| --- | --- | --- |
+| B(12h) | InitPAD2(buf1, siz1, buf2, siz2) | Registers the two receive buffers |
+| B(13h) | StartPAD2() | Starts reading the controllers on vertical blank |
+| B(14h) | StopPAD2() | Stops reading the controllers (and the Memory Cards) |
+| B(15h) | PAD_init2(type, button_dest, unused, unused) | Initializes hidden buffers for PAD_dr() |
+| B(16h) | PAD_dr() | Returns the buttons of a digital pad from the hidden buffers |
+| B(5Bh) | ChangeClearPAD(int) | Selects whether the vertical blank handler ends interrupt processing[^lr112] |
+
+Each receive buffer should be 0x22 bytes. The first byte is the status (0x00 success, 0xFF timeout), the second is the controller ID, and the remaining 32 bytes hold up to 16 halfwords of data.[^spxpad] For the libapi function InitPAD(), Sony advises allocating 34 bytes for each buffer, because a longer reply from an unexpected controller would otherwise overrun it.[^lr142] InitPAD2() fills the buffers with zero, which reads as status 0x00 with every button pressed. A program should therefore set both status bytes to 0xFF after the call, or reject ID 0x00.[^spxpad]
+
+The BIOS has no function that sends data to a controller, so a program cannot control vibration motors through the BIOS.[^spxpad] PAD_dr() works only with controller IDs 0x41 and 0x23 and returns 0xFFFF for any other controller. This includes an analog controller in analog mode.[^spxpad]
+
+## Exceptions
+
+These functions are described on the [events](/system/bios/events/) page.[^spxexc]
+
+Table: B exception functions
+
+| Number | Function | Explanation |
+| --- | --- | --- |
+| B(17h) | ReturnFromException() | Restores the registers from the current TCB and returns[^lr161] |
+| B(18h) | ResetEntryInt() | Restores the default exit structure and returns its address |
+| B(19h) | HookEntryInt(addr) | Installs a hook run at the end of exception handling |
+
+## File System
+
+These functions are described on the [file I/O](/system/bios/file-io/) page.[^spxfile][^lo215]
+
+Table: B file functions
+
+| Number | Function | Explanation |
+| --- | --- | --- |
+| B(32h) | open(filename, accessmode) | Opens a file (same as A(00h))[^lr153] |
+| B(33h) | lseek(fd, offset, seektype) | Moves the file pointer (same as A(01h))[^lr149] |
+| B(34h) | read(fd, dst, length) | Reads from a file (same as A(02h))[^lr156] |
+| B(35h) | write(fd, src, length) | Writes to a file (same as A(03h))[^lr177] |
+| B(36h) | close(fd) | Closes a file (same as A(04h))[^lr114] |
+| B(37h) | ioctl(fd, cmd, arg) | Controls a device (same as A(05h))[^lr143] |
+| B(38h) | exit(exitcode) | Terminates the program (same as A(06h)) |
+| B(39h) | isatty(fd) | Same as A(07h) |
+| B(3Ah) | getc(fd) | Same as A(08h) |
+| B(3Bh) | putc(char, fd) | Same as A(09h) |
+| B(3Ch) | getchar() | Same as A(3Bh) |
+| B(3Dh) | putchar(char) | Same as A(3Ch) |
+| B(3Eh) | gets(dst) | Same as A(3Dh) |
+| B(3Fh) | puts(src) | Same as A(3Eh) |
+| B(40h) | cd(name) | Changes the default directory[^lr111] |
+| B(41h) | format(devicename) | Initializes a file system[^lr129] |
+| B(42h) | firstfile2(filename, direntry) | Finds the first file matching a name |
+| B(43h) | nextfile(direntry) | Finds the next matching file[^lr152] |
+| B(44h) | rename(old_filename, new_filename) | Changes a file name[^lr159] |
+| B(45h) | erase(filename) | Deletes a file[^lr123] |
+| B(46h) | undelete(filename) | Resurrects a deleted file[^lr174] |
+| B(54h) | _get_errno() | Returns the latest I/O error code[^lr181] |
+| B(55h) | _get_error(fd) | Returns the error code of one file[^lr182] |
+| B(59h) | testdevice(devicename) | Calls a device test function (does nothing for cdrom, bu and tty) |
+
+## Devices
+
+Table: B device functions
+
+| Number | Function | Explanation |
+| --- | --- | --- |
+| B(47h) | AddDrv(device_info) | Adds a device control block |
+| B(48h) | DelDrv(device_name) | Removes a device by its lowercase name |
+| B(49h) | PrintInstalledDevices() | Prints the names of the installed devices with printf |
+
+AddCDROMDevice(), AddMemCardDevice() and the TTY functions use these internal device functions.[^spxdev]
+
+## Memory Card
+
+These functions are described on the [file I/O](/system/bios/file-io/) page.[^spxcard]
+
+Table: B Memory Card functions
+
+| Number | Function | Explanation |
+| --- | --- | --- |
+| B(4Ah) | InitCARD2(pad_enable) | Initializes the card driver (destroys K0 and K1) |
+| B(4Bh) | StartCARD2() | Starts the card driver |
+| B(4Ch) | StopCARD2() | Stops the card driver |
+| B(4Dh) | _card_info_subfunc(port) | Subfunction of _card_info |
+| B(4Eh) | _card_write(port, sector, src) | Starts writing one 128-byte sector |
+| B(4Fh) | _card_read(port, sector, dst) | Starts reading one 128-byte sector |
+| B(50h) | _new_card() | Ignores the card change flag on the next access |
+| B(58h) | _card_chan() | Returns the slot of the last card callback |
+| B(5Ch) | _card_status(slot) | Returns the status of the last card command |
+| B(5Dh) | _card_wait(slot) | Waits until the last card command is not busy |
+
+## Other Functions
+
+Table: B other functions
+
+| Number | Function | Explanation |
+| --- | --- | --- |
+| B(51h) | Krom2RawAdd(shiftjis_code) | Returns the ROM address of a kanji font pattern[^lr144] |
+| B(53h) | Krom2Offset(shiftjis_code) | Subfunction of Krom2RawAdd |
+| B(56h) | GetC0Table() | Returns the address of the C function table |
+| B(57h) | GetB0Table() | Returns the address of the B function table |
+
+Many games call GetB0Table() or GetC0Table() and then patch kernel code. psx-spx lists the known patches, which mostly concern the exception handler and the controller and Memory Card interrupt handling.[^spxpatch]
+
+## Unused Numbers
+
+B(11h), B(24h) to B(29h), B(2Ch) to B(31h) and B(5Eh) to B(FFh) jump to address 0. B(1Ah) to B(1Fh), B(21h) to B(23h), B(2Ah), B(2Bh), B(52h) and B(5Ah) are SystemError functions that loop forever.[^spxna]
+
+## References
+
+[^lo203]: Sony Computer Entertainment Inc. Run-Time Library Overview. January 1999. Page 2-3.
+[^lo209]: Sony Computer Entertainment Inc. Run-Time Library Overview. January 1999. Page 2-9.
+[^lo212]: Sony Computer Entertainment Inc. Run-Time Library Overview. January 1999. Page 2-12.
+[^lo215]: Sony Computer Entertainment Inc. Run-Time Library Overview. January 1999. Page 2-15.
+[^lo217]: Sony Computer Entertainment Inc. Run-Time Library Overview. January 1999. Page 2-17.
+[^lr111]: Sony Computer Entertainment Inc. Run-Time Library Reference. January 1999. Page 1-11, cd.
+[^lr112]: Sony Computer Entertainment Inc. Run-Time Library Reference. January 1999. Page 1-12, ChangeClearPAD.
+[^lr113]: Sony Computer Entertainment Inc. Run-Time Library Reference. January 1999. Page 1-13, ChangeTh.
+[^lr114]: Sony Computer Entertainment Inc. Run-Time Library Reference. January 1999. Page 1-14, close.
+[^lr115]: Sony Computer Entertainment Inc. Run-Time Library Reference. January 1999. Page 1-15, CloseEvent.
+[^lr116]: Sony Computer Entertainment Inc. Run-Time Library Reference. January 1999. Page 1-16, CloseTh.
+[^lr117]: Sony Computer Entertainment Inc. Run-Time Library Reference. January 1999. Page 1-17, DeliverEvent.
+[^lr118]: Sony Computer Entertainment Inc. Run-Time Library Reference. January 1999. Page 1-18, DisableEvent.
+[^lr120]: Sony Computer Entertainment Inc. Run-Time Library Reference. January 1999. Page 1-20, EnableEvent.
+[^lr123]: Sony Computer Entertainment Inc. Run-Time Library Reference. January 1999. Page 1-23, erase.
+[^lr129]: Sony Computer Entertainment Inc. Run-Time Library Reference. January 1999. Page 1-29, format.
+[^lr135]: Sony Computer Entertainment Inc. Run-Time Library Reference. January 1999. Page 1-35, GetRCnt.
+[^lr142]: Sony Computer Entertainment Inc. Run-Time Library Reference. January 1999. Page 1-42, InitPAD.
+[^lr143]: Sony Computer Entertainment Inc. Run-Time Library Reference. January 1999. Page 1-43, ioctl.
+[^lr144]: Sony Computer Entertainment Inc. Run-Time Library Reference. January 1999. Page 1-44, Krom2RawAdd.
+[^lr149]: Sony Computer Entertainment Inc. Run-Time Library Reference. January 1999. Page 1-49, lseek.
+[^lr152]: Sony Computer Entertainment Inc. Run-Time Library Reference. January 1999. Page 1-52, nextfile.
+[^lr153]: Sony Computer Entertainment Inc. Run-Time Library Reference. January 1999. Page 1-53, open.
+[^lr154]: Sony Computer Entertainment Inc. Run-Time Library Reference. January 1999. Page 1-54, OpenEvent.
+[^lr155]: Sony Computer Entertainment Inc. Run-Time Library Reference. January 1999. Page 1-55, OpenTh.
+[^lr156]: Sony Computer Entertainment Inc. Run-Time Library Reference. January 1999. Page 1-56, read.
+[^lr159]: Sony Computer Entertainment Inc. Run-Time Library Reference. January 1999. Page 1-59, rename.
+[^lr160]: Sony Computer Entertainment Inc. Run-Time Library Reference. January 1999. Page 1-60, ResetRCnt.
+[^lr161]: Sony Computer Entertainment Inc. Run-Time Library Reference. January 1999. Page 1-61, ReturnFromException.
+[^lr164]: Sony Computer Entertainment Inc. Run-Time Library Reference. January 1999. Page 1-64, SetRCnt.
+[^lr173]: Sony Computer Entertainment Inc. Run-Time Library Reference. January 1999. Page 1-73, TestEvent.
+[^lr174]: Sony Computer Entertainment Inc. Run-Time Library Reference. January 1999. Page 1-74, undelete.
+[^lr175]: Sony Computer Entertainment Inc. Run-Time Library Reference. January 1999. Page 1-75, UnDeliverEvent.
+[^lr176]: Sony Computer Entertainment Inc. Run-Time Library Reference. January 1999. Page 1-76, WaitEvent.
+[^lr177]: Sony Computer Entertainment Inc. Run-Time Library Reference. January 1999. Page 1-77, write.
+[^lr181]: Sony Computer Entertainment Inc. Run-Time Library Reference. January 1999. Page 1-81, _get_errno.
+[^lr182]: Sony Computer Entertainment Inc. Run-Time Library Reference. January 1999. Page 1-82, _get_error.
+[^spxfn]: psx-spx. Kernel (BIOS), BIOS Function Summary, B-Functions. https://psx-spx.consoledev.net/kernelbios/
+[^spxmisc]: psx-spx. Kernel (BIOS), BIOS Misc Functions, GetC0Table and GetB0Table. https://psx-spx.consoledev.net/kernelbios/
+[^spxheap]: psx-spx. Kernel (BIOS), BIOS Memory Allocation. https://psx-spx.consoledev.net/kernelbios/
+[^spxtmr]: psx-spx. Kernel (BIOS), BIOS Timer Functions. https://psx-spx.consoledev.net/kernelbios/
+[^spxev]: psx-spx. Kernel (BIOS), BIOS Event Functions. https://psx-spx.consoledev.net/kernelbios/
+[^spxth]: psx-spx. Kernel (BIOS), BIOS Thread Functions. https://psx-spx.consoledev.net/kernelbios/
+[^spxpad]: psx-spx. Kernel (BIOS), BIOS Joypad Functions. https://psx-spx.consoledev.net/kernelbios/
+[^spxexc]: psx-spx. Kernel (BIOS), BIOS Interrupt/Exception Handling. https://psx-spx.consoledev.net/kernelbios/
+[^spxfile]: psx-spx. Kernel (BIOS), BIOS File Functions. https://psx-spx.consoledev.net/kernelbios/
+[^spxdev]: psx-spx. Kernel (BIOS), BIOS More Internal Functions. https://psx-spx.consoledev.net/kernelbios/
+[^spxcard]: psx-spx. Kernel (BIOS), BIOS Memory Card Functions. https://psx-spx.consoledev.net/kernelbios/
+[^spxpatch]: psx-spx. Kernel (BIOS), BIOS Patches. https://psx-spx.consoledev.net/kernelbios/
+[^spxna]: psx-spx. Kernel (BIOS), BIOS Misc Functions, N/A functions. https://psx-spx.consoledev.net/kernelbios/