psx.wiki

BIOS Syscalls and Breaks

Kernel services reached through the syscall and break instructions.

BIOS Syscalls and Breaks
Syscall number registerR4

This is an old revision of this page, as edited by RemmyLee at 02:45, 23 October 2026. Edit this revision | Latest revision

Overview

Four kernel services are reached through the R3000 syscall instruction instead of a function vector. The caller puts the function number in R4 (A0) and executes syscall, whose 20-bit immediate field is unused and should be zero.1 The syscall raises a System call exception (code Sys), and the CPU therefore jumps to 0x80000080 like any other exception.21 The exception saves the registers in the current TCB and restores them on return. The kernel uses this to switch threads, by changing the current TCB inside the exception, and to change the interrupt bits of the status register.31

Table 1: Syscall functions
R4 Function Explanation
0x00 NoFunction() Returns without changing any register except K0
0x01 EnterCriticalSection() Disables interrupts4
0x02 ExitCriticalSection() Enables interrupts5
0x03 ChangeThreadSubFunction(addr) Switches to the TCB at R5 (used by ChangeTh)
0x04 and up none Calls DeliverEvent(0xF0000010, 0x4000) and returns

Critical Sections

A section of code in which interrupts are inhibited is called a critical section. Any function that modifies data in the kernel must be executed in a critical section.6 Interrupts are inhibited immediately after the PlayStation starts, after a call to EnterCriticalSection(), and at the start of an event handler.6

EnterCriticalSection() clears bits 2 and 10 of the status register (COP0 r12). Bit 2 is copied to bit 0 on the return from the syscall exception. The function returns 1 if both bits were set and 0 if interrupts were already disabled.14 ExitCriticalSection() sets the same two bits and returns no value.1 According to Sony, bit 0 of the status register is the interrupt permission bit, bit 2 is the main flow interrupt permission bit, and bit 10 is always 1.7

Both functions execute an internal system call and therefore destroy the interrupt context.45 SwEnterCriticalSection() and SwExitCriticalSection() suppress and enable interrupts without generating a system call, and Sony states that they can therefore be invoked in event handlers and callback functions.89

Exception Causes

GetCr() returns the cause register (COP0 r13). Bits 5 to 2 hold the exception code shown below.10

Table 2: Exception codes
Code Cause
0000 External interrupt
0100 Address read error
0101 Address write error
0110 Command bus error
0111 Data bus error
1000 System call
1001 Break point
1010 Undefined command
1011 Co-processor not mounted
1100 Overflow

The kernel handles interrupts and syscalls. Any other exception, including a break instruction, is unresolved: the kernel calls DeliverEvent(0xF0000010, 0x1000) and stops in SystemErrorUnresolvedException().11

Break Functions

The CPU raises no exception on an integer division by zero or overflow. The kernel and many games therefore test the divisor in software and execute a break instruction with a code in its immediate field.11

Table 3: Break codes
Code Meaning
0x1C00 Division by zero
0x1800 Division overflow (-0x80000000 / -1)
0x0001 Lockup (DTL-H2000)
0x3C400 User typed "break" in the debug console (DTL-H2000)

The SN Systems PC file server uses break codes to reach files on the host PC through the "pcdrv:" device. The Caetla firmware for cheat cartridges also supports these calls.12 Unlike other BIOS functions, they take their arguments in A1, A2 and A3 and return two values: V0 is 0 on success or -1 on failure, and V1 holds the result or the error code.12

Table 4: PC file server break functions
Code Function Explanation
0x101 PCInit() Initializes the file server
0x102 PCCreat(filename, fileattributes) Creates a file on the PC (MS-DOS attribute bits)
0x103 PCOpen(filename, accessmode) Opens a file on the PC and returns its handle
0x104 PCClose(filehandle) Closes a file
0x105 PCRead(filehandle, length, dst) Reads bytes (padded with zero past the end of file)
0x106 PCWrite(filehandle, length, src) Writes bytes
0x107 PClSeek(filehandle, offset, seekmode) Moves the file pointer from the start (0), current position (1) or end (2)

In the DTL-H2000 BIOS these breaks serve the message window device "mwin:" and the CD-ROM simulator device "sim:".12 PCRead() does not stop at the end of the file. A program that does not know the file length can obtain it from PClSeek() with seek mode 2 and must then seek back to the start.12

References

  1. ^ a b c d e psx-spx. Kernel (BIOS), BIOS Function Summary, SYS-Functions, and BIOS Interrupt/Exception Handling. https://psx-spx.consoledev.net/kernelbios/

  2. ^ Sony Computer Entertainment Inc. PlayStation Hardware. August 1998. Page 2-7, Table 2-4.

  3. ^ psx-spx. Kernel (BIOS), BIOS Thread Functions, SYS(03h). https://psx-spx.consoledev.net/kernelbios/

  4. ^ a b c Sony Computer Entertainment Inc. Run-Time Library Reference. January 1999. Page 1-22, EnterCriticalSection.

  5. ^ a b Sony Computer Entertainment Inc. Run-Time Library Reference. January 1999. Page 1-26, ExitCriticalSection.

  6. ^ a b Sony Computer Entertainment Inc. Run-Time Library Overview. January 1999. Page 2-6.

  7. ^ Sony Computer Entertainment Inc. Run-Time Library Reference. January 1999. Page 1-37, GetSr, Table 1-2.

  8. ^ Sony Computer Entertainment Inc. Run-Time Library Reference. January 1999. Page 1-70, SwEnterCriticalSection.

  9. ^ Sony Computer Entertainment Inc. Run-Time Library Reference. January 1999. Page 1-71, SwExitCriticalSection.

  10. ^ Sony Computer Entertainment Inc. Run-Time Library Reference. January 1999. Page 1-33, GetCr, Table 1-1.

  11. ^ a b psx-spx. Kernel (BIOS), BIOS Function Summary, BREAK-Functions, and BIOS Misc Functions. https://psx-spx.consoledev.net/kernelbios/

  12. ^ a b c d psx-spx. Kernel (BIOS), BIOS PC File Server. https://psx-spx.consoledev.net/kernelbios/

Categories: System software