Some more understanding of the task scheduler. I'm now confident that on 200d, e021cc4c is irq_handler(), it runs whenever an irq is triggered, due to VBAR setup in early code, see the table of handlers at e021cb60, associated with VBAR setup at e0040002:
coprocessor_moveto(0xf,0,0,&LAB_e021cb60,in_cr12,in_cr0);
See ARM manual, B4.1.156 for that mcr usage. Also see FUN_e01caa88(&LAB_e021cb60,"Exception vector") for finding VBAR address.
As part of irq_handler(), we have:
if (bVar5) {
handle_interrupt();
DAT_0000100c = DAT_0000100c + -1;
return *puVar6;
}
handle_interrupt();
thunk_FUN_df003028();
change_running_task_maybe(&PTR_0000101c,&PTR_00001020);
This means that in most cases, handling an IRQ triggers assessing whether the task should change. Which means the irq_handler is in essence the scheduler. I assume there's a timer that triggers a periodic irq so it can't stall if the rest of the system is idle