View source for BIOS A Functions

You do not have permission to edit this page. Log in to edit.
---
title: BIOS A Functions
type: component
summary: Kernel functions called through address 0xA0 with the function number in R9.
category: System software
info: Vector = 0x000000A0
info: Number register = R9
info: Jump table = 0x00000200
---

## Overview

The A functions are called by loading the function number into R9 and jumping to address 0xA0. The four instructions at 0xA0 jump through the A function table at 0x00000200, which is 0x300 bytes long.[^spxfn][^spxmap] Arguments go in R4 to R7 and on the stack, and the return value is in R2. The [BIOS](/system/bios/) page describes the calling convention.[^spxfn]

Most A functions run from uncached ROM through an 8-bit bus. The memory and string functions also process data byte by byte. Consequently they are slow, and memcpy() takes about 160 cycles per byte while bzero() takes about 105.[^spxslow]

Several A functions duplicate B functions. A(00h) to A(09h) and A(3Bh) to A(3Eh) jump to the same code as B(32h) to B(3Fh); the boot code copies those addresses into the A table with AdjustA0Table().[^spxboot] Functions A(A0h) to A(B4h) do not exist in the DTL-H2000 BIOS, and A(AFh) to A(B4h) do not exist in the CEX-1000 kernel.[^spxfn]

## File Functions

These functions give low-level access to files and logical devices. They are described on the [file I/O](/system/bios/file-io/) page.[^spxfile][^lo215]

Table: A file functions

| Number | Function | Explanation |
| --- | --- | --- |
| A(00h) | open(filename, accessmode) | Opens a file and returns its descriptor, or -1[^lr153] |
| A(01h) | lseek(fd, offset, seektype) | Moves the file pointer from the start (0) or the current position (1)[^lr149] |
| A(02h) | read(fd, dst, length) | Reads length bytes and returns the number read, or -1[^lr156] |
| A(03h) | write(fd, src, length) | Writes length bytes and returns the number written, or -1[^lr177] |
| A(04h) | close(fd) | Closes the file and returns fd, or -1[^lr114] |
| A(05h) | ioctl(fd, cmd, arg) | Executes a device control command (used only for TTY)[^lr143] |
| A(06h) | exit(exitcode) | Terminates the program and returns to the BIOS |
| A(07h) | isatty(fd) | Returns bit 1 of the device flags (set only for the DUART TTY) |
| A(08h) | getc(fd) | Reads one byte (sign-extended) |
| A(09h) | putc(char, fd) | Writes one byte (fd is the second argument) |

## Conversion Functions

These functions convert between strings, characters and numbers.[^spxconv] All of them use signed 32-bit values for both int and long.

Table: A conversion functions

| Number | Function | Explanation |
| --- | --- | --- |
| A(0Ah) | todigit(char) | Returns 0 to 9 for "0" to "9" and 10 to 35 for letters |
| A(0Bh) | atof(src) | Does not work: uses the absent COP1 floating point unit |
| A(0Ch) | strtoul(src, src_end, base) | Converts an unsigned number |
| A(0Dh) | strtol(src, src_end, base) | Converts a signed number, with 0b, 0x and o prefixes |
| A(0Eh) | abs(val) | Returns the absolute value |
| A(0Fh) | labs(val) | Same as abs |
| A(10h) | atoi(src) | Converts a decimal number (a leading 0 selects octal) |
| A(11h) | atol(src) | Same as atoi |
| A(12h) | atob(src, num_dst) | Calls strtol with base 10 and exchanges the two results |
| A(25h) | toupper(char) | Converts a letter to uppercase |
| A(26h) | tolower(char) | Converts a letter to lowercase |
| A(32h) | strtod(src, src_end) | Does not work: uses the absent COP1 floating point unit |

atof() and strtod() were compiled for a MIPS processor with a COP1 floating point unit. The PlayStation has no such unit, and the BIOS does not emulate it. Calling either function therefore raises a coprocessor exception and stops the PlayStation in A(40h) SystemErrorUnresolvedException().[^spxconv]

## Non-local Jumps

Table: A non-local jump functions

| Number | Function | Explanation |
| --- | --- | --- |
| A(13h) | setjmp(buf) | Saves RA, SP, FP, R16 to R23 and GP in a 0x30-byte buffer and returns 0[^spxmisc] |
| A(14h) | longjmp(buf, param) | Restores the registers from buf and returns param at the saved RA |

The buffer layout is RA at 0x00, SP at 0x04, FP at 0x08, R16 to R23 at 0x0C and GP at 0x2C. setjmp() does not save the COP0 or GTE state, and longjmp() does not change a param of 0 into 1, so the caller must pass a nonzero value.[^spxmisc] The same buffer format is used by HookEntryInt().[^spxexc]

## String Functions

These functions follow the standard C library.[^spxstr] Most of them refuse a null pointer and return 0 in that case.

Table: A string functions

| Number | Function | Explanation |
| --- | --- | --- |
| A(15h) | strcat(dst, src) | Appends src to dst |
| A(16h) | strncat(dst, src, maxlen) | Appends at most maxlen characters |
| A(17h) | strcmp(str1, str2) | Compares two strings |
| A(18h) | strncmp(str1, str2, maxlen) | Compares at most maxlen characters |
| A(19h) | strcpy(dst, src) | Copies src to dst |
| A(1Ah) | strncpy(dst, src, maxlen) | Copies at most maxlen characters and pads with 0 |
| A(1Bh) | strlen(src) | Returns the string length |
| A(1Ch) | index(src, char) | Returns the address of the first occurrence of char |
| A(1Dh) | rindex(src, char) | Returns the address of the last occurrence of char |
| A(1Eh) | strchr(src, char) | Same as index |
| A(1Fh) | strrchr(src, char) | Same as rindex |
| A(20h) | strpbrk(src, list) | Finds the first character contained in list |
| A(21h) | strspn(src, list) | Returns the index of the first character of src in list |
| A(22h) | strcspn(src, list) | Returns the index of the first character of src not in list |
| A(23h) | strtok(src, list) | Splits a string at the separators in list; later calls pass 0 |
| A(24h) | strstr(str, substr) | Finds substr in str (misses some overlapping matches) |

strtok() copies the string into a 0x100-byte buffer in the kernel variables. A longer string than 255 characters therefore overwrites other kernel variables.[^spxstr]

## Memory Functions

Table: A memory functions

| Number | Function | Explanation |
| --- | --- | --- |
| A(27h) | bcopy(src, dst, len) | Copies len bytes (src first) |
| A(28h) | bzero(dst, len) | Fills len bytes with 0 |
| A(29h) | bcmp(ptr1, ptr2, len) | Compares len bytes (same faults as memcmp) |
| A(2Ah) | memcpy(dst, src, len) | Copies len bytes and returns dst |
| A(2Bh) | memset(dst, fillbyte, len) | Fills len bytes and returns dst |
| A(2Ch) | memmove(dst, src, len) | Copies overlapping areas (copies one byte too many backwards) |
| A(2Dh) | memcmp(src1, src2, len) | Compares len bytes (returns the difference of the following byte) |
| A(2Eh) | memchr(src, scanbyte, len) | Returns the address of the first scanbyte, or 0 |

These functions refuse a destination of 0x00000000 and a length above 0x7FFFFFFF.[^spxslow] memcmp() and bcmp() return the difference between the bytes after the first mismatch, so a return value of 0 does not prove that the blocks are equal.[^spxslow]

## Utility and Heap Functions

The heap functions manage the area given to InitHeap(). The kernel does not initialize the heap, so malloc() fails until InitHeap() has been called.[^spxheap][^os44]

Table: A utility and heap functions

| Number | Function | Explanation |
| --- | --- | --- |
| A(2Fh) | rand() | Returns a 15-bit random number |
| A(30h) | srand(seed) | Sets the 32-bit random seed |
| A(31h) | qsort(base, nel, width, callback) | Sorts an array (uses the heap) |
| A(33h) | malloc(size) | Allocates a block, 4-byte aligned |
| A(34h) | free(buf) | Releases a block (no error check) |
| A(35h) | lsearch(key, base, nel, width, callback) | Linear search of an array |
| A(36h) | bsearch(key, base, nel, width, callback) | Binary search of a sorted array |
| A(37h) | calloc(sizx, sizy) | Allocates and zero-fills sizx * sizy bytes |
| A(38h) | realloc(old_buf, new_size) | Changes the size of a block |
| A(39h) | InitHeap(addr, size) | Sets the heap address and size and releases all blocks[^lr139] |

rand() advances the seed as x = x * 0x41C64E6D + 0x3039 and returns (x / 0x10000) AND 0x7FFF.[^spxmisc] The ROM malloc() has a bug in which free() cannot release an area completely. Because the ROM cannot be corrected, Sony added malloc2() in RAM and the faster malloc3() in Library 4.0.[^lo221b]

## Console Functions

These functions use the TTY device (standard input fd 0 and standard output fd 1).[^spxtty]

Table: A console functions

| Number | Function | Explanation |
| --- | --- | --- |
| A(3Ah) | _exit(exitcode) | Stops the system |
| A(3Bh) | getchar() | Reads one character, masked to 7 bits |
| A(3Ch) | putchar(char) | Writes one character (TAB and LF expanded) |
| A(3Dh) | gets(dst) | Reads a line into a 128-byte buffer with echo |
| A(3Eh) | puts(src) | Writes a string |
| A(3Fh) | printf(txt, ...) | Writes a formatted string (%c %s %d %u %o %x %n) |

## Executable Functions

These functions load and start [PS-X EXE](/system/ps-x-exe/) files. They are described on the [boot](/system/bios/boot/) page.[^spxload]

Table: A executable functions

| Number | Function | Explanation |
| --- | --- | --- |
| A(40h) | SystemErrorUnresolvedException() | Stops the system after an unhandled exception |
| A(41h) | LoadTest(filename, headerbuf) | Reads the execution file information of a file[^lr148] |
| A(42h) | Load(filename, headerbuf) | Loads an execution file and flushes the I-cache[^lr146] |
| A(43h) | Exec(headerbuf, param1, param2) | Executes a loaded module[^lr125] |
| A(44h) | FlushCache() | Flushes the instruction cache[^lr128] |
| A(45h) | init_a0_b0_c0_vectors() | Copies the three function vectors to 0xA0 to 0xCF |
| A(51h) | LoadExec(filename, stackbase, stackoffset) | Loads and executes a file, then restarts the boot file[^lr147] |
| A(52h) | GetSysSp() | Returns the top of the system stack[^lr138] |
| A(9Ch) | SetConf(num_EvCB, num_TCB, stacktop) | Changes the kernel configuration[^lr162] |
| A(9Dh) | GetConf(num_EvCB_dst, num_TCB_dst, stacktop_dst) | Reads the kernel configuration[^lr132] |
| A(9Fh) | SetMem(megabytes) | Sets the valid memory size to 2 or 8 MB[^lr163] |
| A(A0h) | _boot() | Reboots the system from CD-ROM[^lr180] |
| A(A1h) | SystemError(type, errorcode) | Stops the system with an error type ("B" boot, "D" disk)[^lr172] |

Sony describes SystemError() as a function that displays a system error screen and calls exit() on the PlayStation.[^lr172] psx-spx finds that the retail BIOS function jumps to itself and hangs the PlayStation.[^spxna]

## GPU Functions

These functions write the GPU ports at 0x1F801810 (GP0) and 0x1F801814 (GP1) directly.[^spxgpu]

Table: A GPU functions

| Number | Function | Explanation |
| --- | --- | --- |
| A(46h) | GPU_dw(Xdst, Ydst, Xsiz, Ysiz, src) | Transfers an image to VRAM by software |
| A(47h) | gpu_send_dma(Xdst, Ydst, Xsiz, Ysiz, src) | Transfers an image to VRAM by DMA |
| A(48h) | SendGP1Command(gp1cmd) | Writes a GP1 command |
| A(49h) | GPU_cw(gp0cmd) | Waits for the GPU, then writes one GP0 word |
| A(4Ah) | GPU_cwp(src, num) | Waits for the GPU, then writes num GP0 words |
| A(4Bh) | send_gpu_linked_list(src) | Starts a linked-list DMA of an ordering table |
| A(4Ch) | gpu_abort_dma() | Stops GPU DMA and issues GP1(04h), GP1(02h) and GP1(01h) |
| A(4Dh) | GetGPUStatus() | Returns GPUSTAT |
| A(4Eh) | gpu_sync() | Waits until the GPU is ready for a command |

GPU_dw() transfers Xsiz * Ysiz / 2 words. When Xsiz * Ysiz is odd, the last halfword is not sent and the GPU waits for it. In the same way gpu_send_dma() sends Xsiz * Ysiz / 32 blocks of 16 words, and the remainder is lost.[^spxgpu]

## CD-ROM Functions

These functions control the CD-ROM drive below the file system. They are described on the [file I/O](/system/bios/file-io/) page.[^spxcd]

Table: A CD-ROM functions

| Number | Function | Explanation |
| --- | --- | --- |
| A(54h), A(71h) | _96_init() | Installs the ISO 9660 file system driver[^lr178] |
| A(56h), A(72h) | _96_remove() | Removes the ISO 9660 driver (does not work)[^lr179] |
| A(78h) | CdAsyncSeekL(src) | Issues Setloc and SeekL to an MM:SS:FF position |
| A(7Ch) | CdAsyncGetStatus(dst) | Issues GetStat |
| A(7Eh) | CdAsyncReadSector(count, dst, mode) | Issues SetMode and ReadN or ReadS |
| A(81h) | CdAsyncSetMode(mode) | Issues SetMode |
| A(90h) to A(93h) | CdromIoIrqFunc1() and others | Internal CD-ROM interrupt handlers |
| A(94h) | CdromGetInt5errCode(dst1, dst2) | Returns the status and error code of the last INT5 |
| A(95h) | CdInitSubFunc() | Subfunction of _96_init |
| A(96h) | AddCDROMDevice() | Installs the cdrom device |
| A(9Eh) | SetCdromIrqAutoAbort(type, flag) | Internal |
| A(A2h) | EnqueueCdIntr() | Installs the CD-ROM interrupt handlers with priority 0 |
| A(A3h) | DequeueCdIntr() | Removes them (does not work) |
| A(A4h) | CdGetLbn(filename) | Returns the first sector of a file |
| A(A5h) | CdReadSector(count, sector, buffer) | Reads 2048-byte sectors at double speed and waits |
| A(A6h) | CdGetStatus() | Returns the drive status byte |

_96_remove() and DequeueCdIntr() call SysDeqIntRP(), which can remove only the first element of a priority chain. They therefore fail to remove the CD-ROM handlers.[^spxcd][^spxexc]

## Memory Card Functions

These functions are the lower level of the Memory Card file system. They are described on the [file I/O](/system/bios/file-io/) page.[^spxcard]

Table: A Memory Card functions

| Number | Function | Explanation |
| --- | --- | --- |
| A(55h), A(70h) | _bu_init() | Initializes the Memory Card file system |
| A(97h) | AddMemCardDevice() | Installs the bu device |
| A(A7h) to A(AAh), A(AEh) | bufs_cb_0() to bufs_cb_4() | Internal completion callbacks |
| A(ABh) | _card_info(port) | Checks a card with a dummy read |
| A(ACh) | _card_load(port) | Reads the directory asynchronously |
| A(ADh) | _card_auto(flag) | Turns automatic formatting on (1) or off (0) |
| A(AFh) | card_write_test(port) | Clears the card change flag with a dummy write to sector 0x3F |

## Device Functions

The kernel drivers for its three standard devices are A functions. They are called through the device control blocks and not by applications.[^spxdev]

Table: A device driver functions

| Number | Function |
| --- | --- |
| A(5Bh) to A(5Eh) | dev_tty_init, dev_tty_open, dev_tty_in_out, dev_tty_ioctl |
| A(5Fh) to A(64h) | dev_cd_open, dev_cd_read, dev_cd_close, dev_cd_firstfile, dev_cd_nextfile, dev_cd_chdir |
| A(65h) to A(6Eh) | dev_card_open, dev_card_read, dev_card_write, dev_card_close, dev_card_firstfile, dev_card_nextfile, dev_card_erase, dev_card_undelete, dev_card_format, dev_card_rename |
| A(6Fh) | Clears the error field of a card FCB |
| A(98h) | AddDuartTtyDevice() |
| A(99h) | add_nullcon_driver() |

## Other Functions

Table: A other functions

| Number | Function | Explanation |
| --- | --- | --- |
| A(B2h) | _ioabort_raw(param) | Executes longjmp to the I/O abort buffer |
| A(B4h) | GetSystemInfo(index) | Returns the kernel date (0), flags (1), version string (2) or RAM size in KB (5) |

## Unused Numbers

Some numbers have no function. A(57h) to A(5Ah), A(73h) to A(77h), A(79h) to A(7Bh), A(7Dh), A(7Fh), A(80h), A(82h) to A(8Fh), A(B0h), A(B1h) and A(B3h) return 0. A(4Fh), A(50h), A(53h), A(9Ah) and A(9Bh) are SystemError functions that loop forever. A(B5h) to A(BFh) jump to address 0.[^spxna] psx-spx also lists A(52h) among these SystemError functions, although the function summary of psx-spx gives A(52h) the name GetSysSp.[^spxna][^spxfn]

## References

[^os44]: Sony Computer Entertainment Inc. PlayStation Operating System. August 1998. Page 4-4.
[^lo215]: Sony Computer Entertainment Inc. Run-Time Library Overview. January 1999. Page 2-15.
[^lo221b]: Sony Computer Entertainment Inc. Run-Time Library Overview. January 1999. Pages 2-21 and 2-22, Table 2-32.
[^lr114]: Sony Computer Entertainment Inc. Run-Time Library Reference. January 1999. Page 1-14, close.
[^lr125]: Sony Computer Entertainment Inc. Run-Time Library Reference. January 1999. Page 1-25, Exec.
[^lr128]: Sony Computer Entertainment Inc. Run-Time Library Reference. January 1999. Page 1-28, FlushCache.
[^lr132]: Sony Computer Entertainment Inc. Run-Time Library Reference. January 1999. Page 1-32, GetConf.
[^lr138]: Sony Computer Entertainment Inc. Run-Time Library Reference. January 1999. Page 1-38, GetSysSp.
[^lr139]: Sony Computer Entertainment Inc. Run-Time Library Reference. January 1999. Page 1-39, InitHeap.
[^lr143]: Sony Computer Entertainment Inc. Run-Time Library Reference. January 1999. Page 1-43, ioctl.
[^lr146]: Sony Computer Entertainment Inc. Run-Time Library Reference. January 1999. Page 1-46, Load.
[^lr147]: Sony Computer Entertainment Inc. Run-Time Library Reference. January 1999. Page 1-47, LoadExec.
[^lr148]: Sony Computer Entertainment Inc. Run-Time Library Reference. January 1999. Page 1-48, LoadTest.
[^lr149]: Sony Computer Entertainment Inc. Run-Time Library Reference. January 1999. Page 1-49, lseek.
[^lr153]: Sony Computer Entertainment Inc. Run-Time Library Reference. January 1999. Page 1-53, open.
[^lr156]: Sony Computer Entertainment Inc. Run-Time Library Reference. January 1999. Page 1-56, read.
[^lr162]: Sony Computer Entertainment Inc. Run-Time Library Reference. January 1999. Page 1-62, SetConf.
[^lr163]: Sony Computer Entertainment Inc. Run-Time Library Reference. January 1999. Page 1-63, SetMem.
[^lr172]: Sony Computer Entertainment Inc. Run-Time Library Reference. January 1999. Page 1-72, SystemError.
[^lr177]: Sony Computer Entertainment Inc. Run-Time Library Reference. January 1999. Page 1-77, write.
[^lr178]: Sony Computer Entertainment Inc. Run-Time Library Reference. January 1999. Page 1-78, _96_init.
[^lr179]: Sony Computer Entertainment Inc. Run-Time Library Reference. January 1999. Page 1-79, _96_remove.
[^lr180]: Sony Computer Entertainment Inc. Run-Time Library Reference. January 1999. Page 1-80, _boot.
[^spxfn]: psx-spx. Kernel (BIOS), BIOS Function Summary, A-Functions. https://psx-spx.consoledev.net/kernelbios/
[^spxmap]: psx-spx. Kernel (BIOS), BIOS RAM Map. https://psx-spx.consoledev.net/kernelbios/
[^spxboot]: psx-spx. Kernel (BIOS), BIOS Internal Boot Functions. https://psx-spx.consoledev.net/kernelbios/
[^spxfile]: psx-spx. Kernel (BIOS), BIOS File Functions. https://psx-spx.consoledev.net/kernelbios/
[^spxconv]: psx-spx. Kernel (BIOS), BIOS Number/String/Character Conversion. https://psx-spx.consoledev.net/kernelbios/
[^spxstr]: psx-spx. Kernel (BIOS), BIOS String Functions. https://psx-spx.consoledev.net/kernelbios/
[^spxslow]: psx-spx. Kernel (BIOS), BIOS Memory Fill/Copy/Compare (SLOW). https://psx-spx.consoledev.net/kernelbios/
[^spxheap]: psx-spx. Kernel (BIOS), BIOS Memory Allocation. https://psx-spx.consoledev.net/kernelbios/
[^spxmisc]: psx-spx. Kernel (BIOS), BIOS Misc Functions. https://psx-spx.consoledev.net/kernelbios/
[^spxexc]: psx-spx. Kernel (BIOS), BIOS Interrupt/Exception Handling. https://psx-spx.consoledev.net/kernelbios/
[^spxtty]: psx-spx. Kernel (BIOS), BIOS TTY Console (std_io). https://psx-spx.consoledev.net/kernelbios/
[^spxload]: psx-spx. Kernel (BIOS), BIOS File Execute and Flush Cache. https://psx-spx.consoledev.net/kernelbios/
[^spxgpu]: psx-spx. Kernel (BIOS), BIOS GPU Functions. https://psx-spx.consoledev.net/kernelbios/
[^spxcd]: psx-spx. Kernel (BIOS), BIOS CDROM Functions. https://psx-spx.consoledev.net/kernelbios/
[^spxcard]: psx-spx. Kernel (BIOS), BIOS Memory Card Functions. https://psx-spx.consoledev.net/kernelbios/
[^spxdev]: psx-spx. Kernel (BIOS), BIOS More Internal Functions. https://psx-spx.consoledev.net/kernelbios/
[^spxna]: psx-spx. Kernel (BIOS), BIOS Misc Functions, N/A functions. https://psx-spx.consoledev.net/kernelbios/