BIOS Syscalls and Breaks
Kernel services reached through the syscall and break instructions.
| Syscall number register | R4 |
|---|
Overview
Four kernel services are reached through the R3000 syscall instruction instead of a function vector. The caller puts the function number in R4 (A0) and executes syscall, whose 20-bit immediate field is unused and should be zero.1 The syscall raises a System call exception (code Sys), and the CPU therefore jumps to 0x80000080 like any other exception.21 The exception saves the registers in the current TCB and restores them on return. The kernel uses this to switch threads, by changing the current TCB inside the exception, and to change the interrupt bits of the status register.31
| R4 | Function | Explanation |
|---|---|---|
| 0x00 | NoFunction() | Returns without changing any register except K0 |
| 0x01 | EnterCriticalSection() | Disables interrupts4 |
| 0x02 | ExitCriticalSection() | Enables interrupts5 |
| 0x03 | ChangeThreadSubFunction(addr) | Switches to the TCB at R5 (used by ChangeTh) |
| 0x04 and up | none | Calls DeliverEvent(0xF0000010, 0x4000) and returns |
Critical Sections
A section of code in which interrupts are inhibited is called a critical section. Any function that modifies data in the kernel must be executed in a critical section.6 Interrupts are inhibited immediately after the PlayStation starts, after a call to EnterCriticalSection(), and at the start of an event handler.6
EnterCriticalSection() clears bits 2 and 10 of the status register (COP0 r12). Bit 2 is copied to bit 0 on the return from the syscall exception. The function returns 1 if both bits were set and 0 if interrupts were already disabled.14 ExitCriticalSection() sets the same two bits and returns no value.1 According to Sony, bit 0 of the status register is the interrupt permission bit, bit 2 is the main flow interrupt permission bit, and bit 10 is always 1.7
Both functions execute an internal system call and therefore destroy the interrupt context.45 SwEnterCriticalSection() and SwExitCriticalSection() suppress and enable interrupts without generating a system call, and Sony states that they can therefore be invoked in event handlers and callback functions.89
Exception Causes
GetCr() returns the cause register (COP0 r13). Bits 5 to 2 hold the exception code shown below.10
| Code | Cause |
|---|---|
| 0000 | External interrupt |
| 0100 | Address read error |
| 0101 | Address write error |
| 0110 | Command bus error |
| 0111 | Data bus error |
| 1000 | System call |
| 1001 | Break point |
| 1010 | Undefined command |
| 1011 | Co-processor not mounted |
| 1100 | Overflow |
The kernel handles interrupts and syscalls. Any other exception, including a break instruction, is unresolved: the kernel calls DeliverEvent(0xF0000010, 0x1000) and stops in SystemErrorUnresolvedException().11
Break Functions
The CPU raises no exception on an integer division by zero or overflow. The kernel and many games therefore test the divisor in software and execute a break instruction with a code in its immediate field.11
| Code | Meaning |
|---|---|
| 0x1C00 | Division by zero |
| 0x1800 | Division overflow (-0x80000000 / -1) |
| 0x0001 | Lockup (DTL-H2000) |
| 0x3C400 | User typed "break" in the debug console (DTL-H2000) |
The SN Systems PC file server uses break codes to reach files on the host PC through the "pcdrv:" device. The Caetla firmware for cheat cartridges also supports these calls.12 Unlike other BIOS functions, they take their arguments in A1, A2 and A3 and return two values: V0 is 0 on success or -1 on failure, and V1 holds the result or the error code.12
| Code | Function | Explanation |
|---|---|---|
| 0x101 | PCInit() | Initializes the file server |
| 0x102 | PCCreat(filename, fileattributes) | Creates a file on the PC (MS-DOS attribute bits) |
| 0x103 | PCOpen(filename, accessmode) | Opens a file on the PC and returns its handle |
| 0x104 | PCClose(filehandle) | Closes a file |
| 0x105 | PCRead(filehandle, length, dst) | Reads bytes (padded with zero past the end of file) |
| 0x106 | PCWrite(filehandle, length, src) | Writes bytes |
| 0x107 | PClSeek(filehandle, offset, seekmode) | Moves the file pointer from the start (0), current position (1) or end (2) |
In the DTL-H2000 BIOS these breaks serve the message window device "mwin:" and the CD-ROM simulator device "sim:".12 PCRead() does not stop at the end of the file. A program that does not know the file length can obtain it from PClSeek() with seek mode 2 and must then seek back to the start.12
References
-
^ a b c d e psx-spx. Kernel (BIOS), BIOS Function Summary, SYS-Functions, and BIOS Interrupt/Exception Handling. https://psx-spx.consoledev.net/kernelbios/
-
^ Sony Computer Entertainment Inc. PlayStation Hardware. August 1998. Page 2-7, Table 2-4.
-
^ psx-spx. Kernel (BIOS), BIOS Thread Functions, SYS(03h). https://psx-spx.consoledev.net/kernelbios/
-
^ a b c Sony Computer Entertainment Inc. Run-Time Library Reference. January 1999. Page 1-22, EnterCriticalSection.
-
^ a b Sony Computer Entertainment Inc. Run-Time Library Reference. January 1999. Page 1-26, ExitCriticalSection.
-
^ a b Sony Computer Entertainment Inc. Run-Time Library Overview. January 1999. Page 2-6.
-
^ Sony Computer Entertainment Inc. Run-Time Library Reference. January 1999. Page 1-37, GetSr, Table 1-2.
-
^ Sony Computer Entertainment Inc. Run-Time Library Reference. January 1999. Page 1-70, SwEnterCriticalSection.
-
^ Sony Computer Entertainment Inc. Run-Time Library Reference. January 1999. Page 1-71, SwExitCriticalSection.
-
^ Sony Computer Entertainment Inc. Run-Time Library Reference. January 1999. Page 1-33, GetCr, Table 1-1.
-
^ a b psx-spx. Kernel (BIOS), BIOS Function Summary, BREAK-Functions, and BIOS Misc Functions. https://psx-spx.consoledev.net/kernelbios/
-
^ a b c d psx-spx. Kernel (BIOS), BIOS PC File Server. https://psx-spx.consoledev.net/kernelbios/