Devices
The PS5 has many kernel devices that can be accessed through IOCTL. Some of them have usermode module equivalents, some like "sbl" consist in Secure Modules and some like "camera" make use of a dedicated firmware stored in kernel memory.
See also PS4 devices.
Note for ioctls: * indicates name is assumed from RE and may not be accurate.
Device Listing[edit | edit source]
Unique devices are listed here without the "/dev/" prefix for readability. Benign devices like /dev/null are omitted for brevity's sake.
| Device Path | Device Long Name | Notes |
|---|---|---|
| a53{io,mm,mmsys} | A53 Input/Output, Memory Management (sys) | See MP4 section |
| ajm{i} | Audio Job Manager | - |
| auditpipe | Audit Pipe | - |
| authmgr | Authentication Manager | - |
| az{1,ctl} | - | Audio-related |
| bar | Backup And Restore | Used by shellcore for backup and recovery |
| bfs/ctl | - | - |
| bluetooth_hid | Bluetooth Human Interface Device | - |
| bt | Bluetooth | - |
| camera | Camera | - |
| cloudsd | Cloud SaveData | - |
| console | Console | Usermode logging |
| crepo | Crash Report | Used for crash reporting service (coredump, gpudump, shellcore) |
| ctrlp{_sync} | -CTRLP | Used by libScePad (controller). See PS4 and PS Vita ctrlp modules. |
| dbggc{_control} | Debug GPU? | - |
| deci_coredump | DECI5 coredump | - |
| deci_mp4_ioc | DECI5 MP4 ?I/O Control? | - |
| deci_mp4_mmc | DECI5 MP4 ?MM Control? | - |
| deci_std{in,out,err} | DECI5 Input/Output/Error | - |
| deci_tty* | DECI5 Terminals | - |
| devctl | Dev Control | - |
| diag | Diagnosis | - |
| dipsw | DIP Switches | - |
| dldbg | Dynamic Library Debug | - |
| dmem{0,1,2} | - | - |
| dngl | - | - |
| duid | Disc Unique ID | - |
| encdec | Encrypt Decrypt | Related to Portability Keys. |
| envelope | Envelope Files | Related to Envelope Files Keys. |
| evlg{0,1} | Event Log | Intended to be used with read syscall |
| exthdd | External HDD | - |
| fcram | - | - |
| fsctrl | FileSystem Control | - |
| fttrm | ?Film and Television Tracking? Rights Management | Used by bluray app |
| gbase | - | - |
| gc | GPU command | - |
| geom.ctl | - | - |
| gic | - | - |
| gsched_bds.ctl | - | - |
| hdmi | HDMI | - |
| hid | Human Interface Device | - |
| hmd2_* | Head-mounted Display | For PS VR 2. |
| hmd_* | Head-mounted Display | For PS VR first revision. |
| iccnvs{0,1,2,4,6} | ICC NVS | Specific access to Sectors 0, 1, 2, 4 and 6 of Serial Flash Non Volatile Storage |
| icc_configuration | ICC Configuration | - |
| icc_crash_report | ICC Crash Report | - |
| icc_device_power | ICC Device Power | - |
| icc_fan | ICC Fan | - |
| icc_floyd | ICC Floyd | SNVS Storage Device. ?TPM related? |
| icc_indicator | ICC Indicator | Control the LEDs. |
| icc_nvs | ICC NVS | ?Global access to Serial Flash Non Volatile Storage like on PS4? |
| icc_power | ICC Power | - |
| icc_sc_config | ICC ?Syscon? Configuration | - |
| icc_thermal | ICC Thermal | - |
| klog | Kernel Log | Read syscall on this device can be used to get kernel log if privileged |
| kmbp | - | - |
| lvdctl | Layered Vnode Device Control | - |
| lvd{0,1} | Layered Vnode Device | lv0 is a mountpoint for /mnt/rnps. lvd1 is a mountpoint for /mnt/sandbox/download/NPXS40140. See Filesystem. |
| cd0 | Compact Disc 0 | cd0 is a mountpoint for /mnt/disc. See Filesystem. |
| m2.ctl | M.2 SSD ?Control? | - |
| manuauth | Manufacturer Auth | - |
| mbus | ?Media/Memory/Management? Bus | Event bus |
| mbus_av | ?Media/Memory/Management? Bus (?audio video?) | Event bus maybe for audio/video. |
| md0 | ?Mount Directory? 0 | Main System modules/devices are located here for Kernel |
| md2 | ?Mount Directory? 2 | md2 is a mountpoint for /system_data/eap/rodata. See Filesystem. |
| mdctl | ?Mount Directory? Control | - |
| da1s1 | DA 1 Sector 1 | da1s1 is a mountpoint for /mnt/usb0. See Filesystem. |
| metadbg | Meta Debug | - |
| mp1 | System Management Unit (SMU) | Power management, thermals, etc. See MP1 section. |
| mp3 | Trusted Execution Environment (TEE) | See MP3 section. |
| mp4/dump{_for_decid} | A53 (mdbg?) | See MP4 section. |
| notification{0-9} | Notification | - |
| npdrm | Network Product Digital Rights Management interface | - |
| nsfsctl | Namespace Filesystem (NSFS) Control | - |
| nsid1.ctl | Namespace ID 1 Control | - |
| otpaccess | One-Time Programmable Access? | - |
| pfsctldev | PFS Control Device | - |
| pfsmgr | PFS Manager | Used for Trophy, Save Data, Keystone |
| playgo_emu_param{1,2,3} | PlayGo emulator params | - |
| pltauth{0,1} | Platform Authentication | For PSN connection. |
| pup_update0 | PUP Update | - |
| qafutkn | QA flag / Utoken | - |
| rnps | React Native PS | RNPS regroups many PSN services (friends, party, events, etc.) |
| rootparam | Root Param | Used by SceShellCore for verifying root param SFO/JSON |
| s3da | ?System/Software? 3D Acceleration | See Marcan's slides about PS4 GPU Linux driver. |
| sbl_secreg | SBL Secure Region/Registry | - |
| sbl_srv | SBL Service | Used exclusively by playready |
| scanin | - | - |
| sce_zlib{_sys} | zlib | zlib (de)compression |
| sc_fw_update0 | ?syscon? firmware update | - |
| sflash0 | Serial Flash | 2MB. Contains EMC firmware and (non-secure) NVS. |
| sflash0s0 | Serial Flash Sector 0 | |
| sflash0s0x0 | Serial Flash Sector 0 Block 0 | |
| sflash0s0x34 | Serial Flash Sector 0 Block 34 | Serial Flash Non Volatile Storage |
| sflash0s0x32 | Serial Flash Sector 0 Block 32 | To be confirmed. |
| sflash0s0x32b | Serial Flash Sector 0 Block 32 bis | |
| sflash0s0x41b | Serial Flash Sector 0 Block 41 | To be confirmed. |
| sflash0s0x41b | Serial Flash Sector 0 Block 41 bis | |
| sflash0s1 | Serial Flash Sector 1 | To be confirmed. |
| sflash0s1.crypt | Serial Flash Sector 1 encrypted | To be confirmed. |
| sflash0s1.cryptx40 | Serial Flash Sector 1 encrypted Block 40 | |
| srtc | Secure Real Time Clock | - |
| ssd0.* | Solid State Drive 0 | Mountpoints for many internal SSD partitions. See Filesystem. |
| sshot | Screenshot | - |
| transactionid.ctl | Transaction ID Control | - |
| ufssuspend | UFS Suspend | - |
| usbctl | USB Control | - |
| uvd_{dec/enc/bgt} | ?Unified Video Decoder? | Maybe related to gameplay recording. |
| wlanbt | Wireless LAN + Bluetooth | - |
| xpt0 | XPT Transport Interface | CAM Transport Layer |
Platform Security Processor Core (PSP) (MP0)[edit | edit source]
- See also the AMD Platform Security Processor wiki page.
- All the fun things related to PS5 security are here.
- Named AMD SMU PSP (AMD System Management Unit Platform Security Processor) and ASP (AMD Secure Processor) as well.
System Management Unit (SMU) (MP1)[edit | edit source]
MP1 (System Management Unit or "SMU") is an xtensa CPU responsible for power management, clock management, sampling sensor data, and other power/thermal-related tasks. The /dev/mp1 device can be used to issue commands to it. Below are known commands.
| IOCTL # | Name | Notes |
|---|---|---|
| 0x4068AE01 | MP1_IOCTL_GET_CLK | Get clock frequency |
| 0x8004AE17 | MP1_IOCTL_SET_GFXCLK | Set graphics clock frequency |
| 0xC004AE18 | MP1_IOCTL_REQUEST_MODE_SWITCH | - |
| 0x8008AE1D | MP1_IOCTL_SET_COREPSTATE | Set core power state? |
| 0xC00CAE1E | MP1_IOCTL_GET_COREPSTATE | Get core power state? |
Sensor Fusion Processor (SFP) (MP2)[edit | edit source]
- It does not exist on PS5 as it is mainly for mobiles.
Trusted Execution Environment (TEE) (MP3)[edit | edit source]
MP3 consists of the Trusted Execution Environment (TEE) running on the AMD Platform Security Processor. Its primary function is Digital Rights Management (DRM) via PlayReady SL3000. In usermode, the libSceTEEClient library is used for interfacing with it, which internally uses /dev/mp3 to load secure binaries (sbins) and establish sessions. Below are known commands.
| IOCTL # | Name | Notes |
|---|---|---|
| 0x400CB400 | TEE_IOC_VERSION | - |
| 0xC010B403 | TEE_IOC_INVOKE | Invoke commands |
| 0xC010B402 | TEE_IOC_OPEN_SESSION | - |
| 0xC008B404 | TEE_IOC_CANCEL | - |
| 0xC010B408 | TEE_IOC_DLM_GET_DEBUG_TOKEN | - |
| 0xC028B409 | TEE_IOC_DLM_START_TA_DEBUG | - |
| 0xC110B40A | TEE_IOC_DLM_FETCH_DEBUG_STRING | - |
| 0x8008B40B | TEE_IOC_DLM_STOP_TA_DEBUG | - |
| 0x8008B40B | TEE_IOC_INIT_ASD | - |
| 0xC038B40C | TEE_SHM_REGISTER | - |
| 0xC004B40E | TEE_SHM_RELEASE | - |
| 0xC004B40F | TEE_SET_TIMEOUT | - |
A53MM/A53IO (MP4)[edit | edit source]
MP4, which consists of /dev/a53mm, /dev/a53mmsys, and /dev/a53io, is used for various tasks, and its overall purpose is not fully understood. Some of the things it includes are debugging (mdbg), video encode/decode, and other various memory-management related things. Below are known commands.
a53mm
| IOCTL # | Name | Notes |
|---|---|---|
| 0xC004AC01 | - | - |
| 0xC030AC02 | A53MM_GIVE_DIRECT_MEM_TO_MAPPER | - |
| 0xC030AC03 | A53MM_CALL_INDIRECT_BUFFER | - |
| 0xC050AC05 | A53MM_MAPPER_VIRTUAL_QUERY | - |
| 0xC038AC06 | A53MM_GET_PARAM * | - |
| 0xC018AC07 | - | - |
| 0xC004AC08 | - | - |
| 0xC018AC09 | - | - |
| 0xC010AC0A | - | - |
| 0xC018AC0B | A53MM_MAPPER_QUERY_PA | - |
| 0xC004AC0D | A53MM_WAIT_COMMAND_BUFFER_COMPLETION | - |
| 0xC018AC0E | A53MM_INTERNAL_LOCK_UNLOCK_MAPPER_MEMORY | - |
| 0xC018AC0F | - | - |
| 0xC018AC10 | A53MM_GET_USAGE_STATS_DATA | - |
| 0xC004AC11 | A53MM_SET_PAGE_TABLE_POOL_OCCUPANCY_THRESHOLD | - |
| 0xC018AC12 | A53MM_INTERNAL_TEST_PAGE_MIGRATION | - |
| 0xC004AC13 | - | - |
a53mmsys
| IOCTL # | Name | Notes |
|---|---|---|
| 0xc020b501 | A53MMSYS_INTERNAL_LOCK_UNLOCK_MAPPER_MEMORY | - |
| 0xc028b502 | - | - |
| 0xc050b503 | - | - |
| 0xc010b504 | - | - |
| 0xc028b505 | A53MMSYS_MAPPER_GET_INDIRECT_BUFFER_INFO | - |
| 0xc020b506 | - | - |
| 0xc018b507 | - | - |
| 0xc018b508 | A53MMSYS_DEBUG_MAPPER_QUERY_DMEM_OFFSET | - |
| 0xc020b50a | - | - |
| 0xc010b50b | A53MMSYS_DEBUG_GET_AMPR_COUNTER_INFO | - |
a53io
| IOCTL # | Name | Notes |
|---|---|---|
| 0x80046101 | NAND_A53IO_OPEN | Exposes NAND groups for reading |
| 0x80046102 | NAND_A53IO_CLOSE | Closes off NAND groups |
| 0x80046103 | NAND_A53IO_SETUP_FLASH_DEVICE | - |
| 0x80046104 | NAND_A53IO_DISABLE_CONTROLLER | Disables A53 controller (warning: this will put the console in a bad state) |
| 0x80046105 | NAND_A53IO_FORMAT_NVM | Formats NVMe |
| 0x80186111 | BFS_A53IO_READ_DEVICE? | - |
| 0xC03861A1 | BFS_A53IO_READ_BLOCK | - |
| 0xC03861A2 | BFS_A53IO_WRITE_BLOCK | - |
| 0xC01061C1 | BFS_A53IO_CREATE_RESERVED_LBA | - |
| 0xC01061C2 | BFS_A53IO_DELETE_RESERVED_LBA | - |
| 0xC00C61C5 | ???? | Related to delete logical partitions |
| 0xC01061C8 | ???? | Related to delete logical partitions |
| 0xC02061CA | ???? | Related to delete logical partitions |
Backup and Restore[edit | edit source]
Backup and Restore (BAR) is used by SceShellCore via /dev/bar. Below are known commands.
| IOCTL # | Name | Notes |
|---|---|---|
| 0xC0684201 | BAR_CREATE_CONTEXT | - |
| 0xC0684202 | BAR_DESTROY_CONTEXT * | - |
| 0xC0684203 | BAR_INIT_CONTEXT | - |
| 0xC0684204 | BAR_UPDATE_AAD | - |
| 0xC0684205 | BAR_UPDATE_ENCRYPT | - |
| 0xC0684206 | BAR_UPDATE_DECRYPT | - |
| 0xC0684207 | BAR_FINISH_ENCRYPT | - |
| 0xC0684208 | BAR_FINISH_DECRYPT | - |
Disc UID[edit | edit source]
Disc UID (/dev/duid) has its own library (libSceDiscId). It's unknown what this is used for at present. It has two known IOCTLs.
| IOCTL # | Name | Notes |
|---|---|---|
| 0xC0104401 | DISC_ID_GET | - |
| 0xC0104402 | DISC_ID_GET2 | - |
Dynamic Library Debug[edit | edit source]
Dynamic Lib Debug (/dev/dldbg) is used by the library for debugging syscore. Given the name, it's likely used for debugging sprx libs. Below are known commands.
| IOCTL # | Name | Notes |
|---|---|---|
| 0x80084401 | DLDBG_STOP_ON_DL_LOAD | - |
| 0x80084402 | DLDBG_NO_STOP_ON_DL_LOAD | - |
| 0xC0084403 | DLDBG_GET_DL_LOAD_FLAG | - |
FTTRM[edit | edit source]
FTTRM's full purpose is unknown, but it is likely DRM-related. It is used by the Bluray application (BdmvPlayerCore, BdvdPlayerCore, UHDBdPlayerCore) via /dev/fttrm. There are only two known commands. RM stands for Rights Management and FT may stand for FilmTrack or Film and Television Tracking. See [1].
| IOCTL # | Name | Notes |
|---|---|---|
| 0xC0185301 | FTTRM_READ_SECTOR | - |
| 0xC0185302 | FTTRM_WRITE_SECTOR | - |
ICC Floyd (TPM)[edit | edit source]
The /dev/icc_floyd is for interacting with the floyd Trusted Platform Module (TPM) over ICC. It only has one known command.
| IOCTL # | Name | Notes |
|---|---|---|
| 0x400EB701 | ICC_FLOYD_GET_VERSION | - |
| 0xC010440E | FLOYD_UPDATE_FW | - |
Manufacturer Authorization[edit | edit source]
The /dev/manuauth device seems to be for manufacturer authorization or authentication. It is used in various updaters. Below are known commands.
| IOCTL # | Name | Notes |
|---|---|---|
| 0x40184D01 | MANUAUTH_LOAD_SM | Loads the secure module |
| 0x40184D02 | MANUAUTH_UNLOAD_SM | Unloads the secure module |
| 0xC0184D03 | MANUAUTH_SET_MANU_MODE | Sets manufacturer mode |
Namespace Filesystem Control[edit | edit source]
The Namespace Filesystem (NSFS) is used by Virtual Shell (Vsh) and SceShellCore. It is critical to processes running on the system. Below are known commands.
| IOCTL # | Name | Notes |
|---|---|---|
| 0xC0406E00 | NSFS_CREATE_REDIRECT | - |
| 0xC0406E01 | NSFS_DELETE_REDIRECT | - |
| 0xC0186E02 | NSFS_GET_REDIRECT_STATS | - |
| 0xC0206E03 | NSFS_ADD_OVERLAY_TO_NAMESPACE | - |
| 0xC0186E04 | NSFS_SET_GLOBAL_EXCLUDE | - |
PFS Control[edit | edit source]
Playstation FileSystem (PFS) Control and /dev/pfsctldev is used internally for VSH. Below are known commands.
| IOCTL # | Name | Notes |
|---|---|---|
| 0x8030B001 | DEVPFSCTL_FORMAT | - |
| 0xC0E0B006 | DEVPFSCTL_GETFSSTAT | - |
| 0xC040B008 | DEVPFSCTL_MOUNT | - |
| 0xC038B009 | DEVPFSCTL_UNMOUNT | - |
| 0xC028B00A | DEVPFSCTL_GETEVENT | - |
| 0xC030B00B | DEVPFSCTL_EVENTCOMP | - |
| 0xC020B00C | DEVPFSCTL_CANCELEVENT | - |
| 0xC020B00D | DEVPFSCTL_REGEVENT | - |
| 0xC020B00E | DEVPFSCTL_DEREGEVENT | - |
| 0x8004B00F | DEVPFSCTL_SYSPOWEREVENT | - |
| 0xC008B074 | DEVPFSCTL_FSCK | - |
PFS Manager[edit | edit source]
PFS Manager (/dev/pfsmgr) is used by SceShellCore. It handles trophy related tasks, savedata, and keystone verification. Below are known commands.
| IOCTL # | Name | Notes |
|---|---|---|
| 0xC1185001 | - | - |
| 0xC1185002 | - | - |
| 0xC1185003 | - | - |
| 0xC4085004 | - | - |
| 0x40845301 | - | - trophy related |
| 0xC0845302 | - | - savedata related |
| 0x40845303 | - | - savedata related |
| 0xC0845304 | - | - ??? |
| 0xC0845305 | - | - ??? |
| 0xC0A84B01 | - | - ??? |
| 0xC0A84B02 | PFSMGR_VERIFY_KEYSTONE | - |
PUP Updater[edit | edit source]
The /dev/pup_update0 device is used to perform firmware updates.
| IOCTL # | Name | Notes |
|---|---|---|
| 0xC0104401 | PUP_UPDATER_VERIFY_BLS_HEADER | - |
| 0xC0184402 | PUP_UPDATER_DECRYPT_HEADER | - |
| 0xC0184403 | PUP_UPDATER_VERIFY_ADDITIONAL_SIGN | - |
| 0xC0184404 | PUP_UPDATER_VERIFY_WATERMARK | - |
| 0xC0184405 | PUP_UPDATER_DECRYPT_SEGMENT | - |
| 0xC0284406 | PUP_UPDATER_DECRYPT_SEGMENT_BLOCK | - |
| 0x20004407 | PUP_UPDATER_UPDATE_SNVS | - |
| 0xC0104408 | PUP_UPDATER_GEN_CHALLENGE | - |
| 0xC018440A | PUP_UPDATER_READ_NAND_GROUP | - |
| 0xC018440B | PUP_UPDATER_WRITE_NAND_GROUP | - |
| 0xC010440C | PUP_UPDATER_IDENTIFY_NAND_CONTROLLER | - |
| 0xC004440D | PUP_UPDATER_IS_FW_OPERATIONAL | - |
| 0xC010440E | PUP_UPDATER_FLOYD_UPDATE_FW | - |
| 0xC001440F | PUP_UPDATER_GET_XTS_KEY_NUM | - |
| 0xC0104410 | PUP_UPDATER_VERIFY_RESPONSE | - |
Root Param[edit | edit source]
Root Param is used by SceShellCore to verify root PARAM.SFO files (for PS4) or JSON files (for PS5, aka PPR for ProsPeRo). Below are known commands.
| IOCTL # | Name | Notes |
|---|---|---|
| 0xC0305201 | ROOTPARAM_VERIFY_PS4_ROOT_PARAM | - |
| 0xC0305202 | ROOTPARAM_VERIFY_PPR_ROOT_PARAM | - |
| 0xC0305203 | ROOTPARAM_RESUME_FROM_STANDBY | - |
CAM Transport Layer[edit | edit source]
CAM (Common Access Method) storage subsystem provides a method for implementing drivers to control various known storage devices. Attaches any devices it finds to the appropriate drivers.
| IOCTL # | Name | Notes |
|---|---|---|
| 0xC4E01902 | - | related to cam_send_ccb |
| 0xC4E01903 | CAMGETPASSTHRU | related to cam_lookup_pass |
Wireless LAN and Bluetooth[edit | edit source]
WLAN and Bluetooth functionality is reachable via /dev/wlanbt. Below are known commands.
| IOCTL # | Name | Notes |
|---|---|---|
| 0x40047400 | WLANBT_GET_DEVICE_ID | - |