Editing Devices

The PS5 has many kernel devices that can be accessed through [[IOCTL]]. Some of them have usermode module equivalents, some like "sbl" consist in [[Secure Modules]] and some like "camera" make use of a dedicated firmware stored in kernel memory.

See also [https://psdevwiki.com/ps5/Devices PS4 devices].

Note for ioctls: * indicates name is assumed from RE and may not be accurate.

== Device Listing ==

Unique devices are listed here. Benign devices like /dev/null are omitted for brevity's sake.

{| class="wikitable sortable"
|-
! Path !! Device Name !! Notes
|-
| /dev/a53{io,mm,mmsys} || A53 Input/Output, Memory Management (sys) || See MP4 section
|-
| /dev/ajm{i} || Audio Job Manager || -
|-
| /dev/auditpipe || - || -
|-
| /dev/authmgr || Authentication Manager || -
|-
| /dev/az{1,ctl} || - || Audio-related
|-
| /dev/bar || Backup and Restore || Used by shellcore for backup and recovery
|-
| /dev/bfs/ctl || - || -
|-
| /dev/bluetooth_hid || - || -
|-
| /dev/bt || - || -
|-
| /dev/camera || Camera || -
|-
| /dev/cloudsd || Cloud SaveData || -
|-
| /dev/console || Console || Usermode logging
|-
| /dev/crepo || Crash Report || Used for crash reporting service (coredump, gpudump, shellcore)
|-
| /dev/ctrlp{_sync} || - || Used by libScePad (controller)
|-
| /dev/dbggc{_control} || Debug GPU? || -
|-
| /dev/deci_coredump || Debug Com. Interface (DECI) coredump || -
|-
| /dev/deci_mp4_ioc || DECI I/O Control? || -
|-
| /dev/deci_mp4_mmc || - || -
|-
| /dev/deci_std{in,out,err} || DECI Input/Output/Error || -
|-
| /dev/deci_tty* || DECI Terminals || -
|-
| /dev/devctl || - || -
|-
| /dev/diag || - || -
|-
| /dev/dipsw || Dip Switch || -
|-
| /dev/dldbg || Dynamic Library Debug || -
|-
| /dev/dmem{0,1,2} || - || -
|-
| /dev/dngl || - || -
|-
| /dev/duid || Disc Unique ID || -
|-
| /dev/encdec || EncDec || -
|-
| /dev/envelope || Envelope Format Crypto || -
|-
| /dev/evlg{0,1} || Event Log || Intended to be used with read syscall 
|-
| /dev/exthdd || External HDD || -
|-
| /dev/fcram || - || -
|-
| /dev/fsctrl || - || -
|-
| /dev/fttrm || - || Used by bluray app
|-
| /dev/gbase || - || -
|-
| /dev/gc || GPU command || -
|-
| /dev/geom.ctl || - || -
|-
| /dev/gic || - || -
|-
| /dev/gsched_bds.ctl || - || -
|-
| /dev/hdmi || HDMI || -
|-
| /dev/hid || - || -
|-
| /dev/hmd2_* || VR 2? || -
|-
| /dev/hmd_* || VR || -
|-
| /dev/iccnvs{0,1,2,4,6} || ICC_NVS (sectors) || Location of Sectors 0, 1, 2, 4 and 6 of sflash0 non volatile storage
|-
| /dev/icc_configuration || ICC Config || -
|-
| /dev/icc_crash_report || ICC Crash Report || -
|-
| /dev/icc_device_power || ICC Device Power || -
|-
| /dev/icc_fan || ICC Fan || -
|-
| /dev/icc_floyd || ICC TPM? || SNVS Storage Device
|-
| /dev/icc_indicator || ICC LED || -
|-
| /dev/icc_nvs || ICC NVS || -
|-
| /dev/icc_power || ICC Power || -
|-
| /dev/icc_sc_config || ICC Syscon? Config || -
|-
| /dev/icc_thermal || ICC Thermal || -
|-
| /dev/klog || Kernel Log || Read syscall on this device can be used to get kernel log if privileged
|-
| /dev/kmbp || - || -
|-
| /dev/lvdctl || Layered Vnode Device Control || -
|-
| /dev/lvd{0,1} || Layered Vnode Device || -
|-
| /dev/m2.ctl || m.2 NVMe Control? || -
|-
| /dev/manuauth || Manufacturer Auth|| -
|-
| /dev/mbus || Event bus || -
|-
| /dev/mbus_av || Event bus (audio video?) || -
|-
| /dev/md0 || Kernel Md0 || Main System modules are located here for Kernel (Not System Modules!)
|-
| /dev/md2 || - || -
|-
| /dev/mdctl || - || -
|-
| /dev/metadbg || - || -
|-
| /dev/mp1 || System Management Unit (SMU) || Power management, thermals, etc. (see mp1 section)
|-
| /dev/mp3 || Trusted Execution Environment (TEE) || See mp3 section
|-
| /dev/mp4/dump{_for_decid} || A53 (mdbg?) || See mp4 section
|-
| /dev/notification{0-9} || Notification || -
|-
| /dev/npdrm || Network Product Digital Rights Management interface || -
|-
| /dev/nsfsctl || Namespace Filesystem (NSFS) Control || -
|-
| /dev/nsid1.ctl || - || -
|-
| /dev/otpaccess || One-Time Programmable Access? || -
|-
| /dev/pfsctldev || Playstation Filesystem (PFS) Control || -
|-
| /dev/pfsmgr || PFS Manager || Used for trophies, savegames, keystone
|-
| /dev/playgo_emu_param{1,2,3} || PlayGo emulator params || -
|-
| /dev/pltauth{0,1} || Platform Authentication (PSN) || -
|-
| /dev/pup_update0 || PUP Update || -
|-
| /dev/qafutkn || QA flag / Utoken || -
|-
| /dev/rnps || React Native PS || PSN related
|-
| /dev/rootparam || Root Param || Used by shellcore for verifying root param sfo/json
|-
| /dev/s3da || 3D Audio || -
|-
| /dev/sbl_secreg || SBL Secure Region || -
|-
| /dev/sbl_srv || SBL Service || Used exclusively by playready
|-
| /dev/scanin || - || -
|-
| /dev/sce_zlib{_sys} || zlib || zlib (de)compression
|-
| /dev/sc_fw_update0 || (syscon?) firmware update || -
|-
| /dev/sflash0 || SPI flash || 2MB. Has EMC firmware and (non-secure) NVS.
|-
| /dev/srtc || Secure Real Time Clock || -
|-
| /dev/ssd0.* || Internal SSD partitions || -
|-
| /dev/sshot || Screenshot || -
|-
| /dev/transactionid.ctl || - || -
|-
| /dev/ufssuspend || - || -
|-
| /dev/usbctl || USB control || -
|-
| /dev/uvd_{dec/enc/bgt} || Unified Video Decoder? || -
|-
| /dev/wlanbt || Wireless LAN + Bluetooth || -
|-
| /dev/xpt0 || XPT Transport Interface || CAM Transport Layer
|}

== Platform Security Processor Core (PSP) (MP0) ==

* See also the [[AMD Platform Security Processor]] wiki page.
* All the fun things related to PS5 security are here.
* Named AMD SMU PSP (AMD System Management Unit Platform Security Processor) and ASP (AMD Secure Processor) as well.

== System Management Unit (SMU) (MP1) ==

MP1 (System Management Unit or "SMU") is an xtensa CPU responsible for power management, clock management, sampling sensor data, and other power/thermal-related tasks. The /dev/mp1 device can be used to issue commands to it. Below are known commands.

{| class="wikitable sortable"
|-
! IOCTL # !! Name !! Notes
|-
| 0x4068AE01 || MP1_IOCTL_GET_CLK || Get clock frequency
|-
| 0x8004AE17 || MP1_IOCTL_SET_GFXCLK || Set graphics clock frequency
|-
| 0xC004AE18 || MP1_IOCTL_REQUEST_MODE_SWITCH || -
|-
| 0x8008AE1D || MP1_IOCTL_SET_COREPSTATE || Set core power state?
|-
| 0xC00CAE1E || MP1_IOCTL_GET_COREPSTATE || Get core power state?
|}

== Sensor Fusion Processor (SFP) (MP2) ==

* It does not exist on PS5 as it is mainly for mobiles.

== Trusted Execution Environment (TEE) (MP3) ==

MP3 consists of the Trusted Execution Environment (TEE) running on the [[AMD Platform Security Processor]]. Its primary function is Digital Rights Management (DRM) via [https://www.microsoft.com/playready/features/EnhancedContentProtection.aspx PlayReady SL3000]. In usermode, the libSceTEEClient library is used for interfacing with it, which internally uses /dev/mp3 to load secure binaries (sbins) and establish sessions. Below are known commands.

{| class="wikitable sortable"
|-
! IOCTL # !! Name !! Notes
|-
|0x400CB400
|TEE_IOC_VERSION
| -
|-
| 0xC010B403 || TEE_IOC_INVOKE || Invoke commands
|-
|0xC010B402
|TEE_IOC_OPEN_SESSION
| -
|-
|0xC008B404
|TEE_IOC_CANCEL
| -
|-
| 0xC010B408 || TEE_IOC_DLM_GET_DEBUG_TOKEN || -
|-
| 0xC028B409 || TEE_IOC_DLM_START_TA_DEBUG || -
|-
| 0xC110B40A || TEE_IOC_DLM_FETCH_DEBUG_STRING || -
|-
| 0x8008B40B || TEE_IOC_DLM_STOP_TA_DEBUG || -
|-
| 0x8008B40B || TEE_IOC_INIT_ASD || -
|-
| 0xC038B40C || TEE_SHM_REGISTER || -
|-
| 0xC004B40E || TEE_SHM_RELEASE || -
|-
| 0xC004B40F || TEE_SET_TIMEOUT || -
|}

== A53MM/A53IO (MP4) ==

MP4, which consists of /dev/a53mm, /dev/a53mmsys, and /dev/a53io, is used for various tasks, and its overall purpose is not fully understood. Some of the things it includes are debugging (mdbg), video encode/decode, and other various memory-management related things. Below are known commands.

'''a53mm'''
{| class="wikitable sortable"
|-
! IOCTL # !! Name !! Notes
|-
| 0xC004AC01 || - || -
|-
| 0xC030AC02 || A53MM_GIVE_DIRECT_MEM_TO_MAPPER || -
|-
| 0xC030AC03 || A53MM_CALL_INDIRECT_BUFFER || -
|-
| 0xC050AC05 || A53MM_MAPPER_VIRTUAL_QUERY || -
|-
| 0xC038AC06 || A53MM_GET_PARAM * || -
|-
| 0xC018AC07 || - || -
|-
| 0xC004AC08 || - || -
|-
| 0xC018AC09 || - || -
|-
| 0xC010AC0A || - || -
|-
| 0xC018AC0B || A53MM_MAPPER_QUERY_PA || -
|-
| 0xC004AC0D || A53MM_WAIT_COMMAND_BUFFER_COMPLETION || -
|-
| 0xC018AC0E || A53MM_INTERNAL_LOCK_UNLOCK_MAPPER_MEMORY || -
|-
| 0xC018AC0F || - || -
|-
| 0xC018AC10 || A53MM_GET_USAGE_STATS_DATA || -
|-
| 0xC004AC11 || A53MM_SET_PAGE_TABLE_POOL_OCCUPANCY_THRESHOLD || -
|-
| 0xC018AC12 || A53MM_INTERNAL_TEST_PAGE_MIGRATION || -
|-
| 0xC004AC13 || - || -
|}

'''a53mmsys'''
{| class="wikitable sortable"
|-
! IOCTL # !! Name !! Notes
|-
| 0xc020b501 || A53MMSYS_INTERNAL_LOCK_UNLOCK_MAPPER_MEMORY || -
|-
| 0xc028b502 || - || -
|-
| 0xc050b503 || - || -
|-
| 0xc010b504 || - || -
|-
| 0xc028b505 || A53MMSYS_MAPPER_GET_INDIRECT_BUFFER_INFO || -
|-
| 0xc020b506 || - || -
|-
| 0xc018b507 || - || -
|-
| 0xc018b508 || A53MMSYS_DEBUG_MAPPER_QUERY_DMEM_OFFSET || -
|-
| 0xc020b50a || - || -
|-
| 0xc010b50b || A53MMSYS_DEBUG_GET_AMPR_COUNTER_INFO || -
|}

'''a53io'''
{| class="wikitable sortable"
|-
! IOCTL # !! Name !! Notes
|-
| 0x80046101 || NAND_A53IO_OPEN || Exposes NAND groups for reading
|-
| 0x80046102 || NAND_A53IO_CLOSE || Closes off NAND groups
|-
| 0x80046103 || NAND_A53IO_SETUP_FLASH_DEVICE || -
|-
| 0x80046104 || NAND_A53IO_DISABLE_CONTROLLER || Disables A53 controller (warning: this will put the console in a bad state)
|-
| 0x80046105 || NAND_A53IO_FORMAT_NVM || Formats NVMe
|-
| 0x80186111 || BFS_A53IO_READ_DEVICE? || -
|-
| 0xC03861A1 || BFS_A53IO_READ_BLOCK || -
|-
| 0xC03861A2 || BFS_A53IO_WRITE_BLOCK || -
|-
| 0xC01061C1 || BFS_A53IO_CREATE_RESERVED_LBA || -
|-
| 0xC01061C2 || BFS_A53IO_DELETE_RESERVED_LBA || -
|-
| 0xC00C61C5 || ???? || Related to delete logical partitions
|-
| 0xC01061C8 || ???? || Related to delete logical partitions
|-
| 0xC02061CA || ???? || Related to delete logical partitions
|}

== Backup and Restore ==

Backup and Restore (BAR) is used by [[SceShellCore]] via /dev/bar. Below are known commands.

{| class="wikitable sortable"
|-
! IOCTL # !! Name !! Notes
|-
| 0xC0684201 || BAR_CREATE_CONTEXT || -
|-
| 0xC0684202 || BAR_DESTROY_CONTEXT * || -
|-
| 0xC0684203 || BAR_INIT_CONTEXT || -
|-
| 0xC0684204 || BAR_UPDATE_AAD || -
|-
| 0xC0684205 || BAR_UPDATE_ENCRYPT || -
|-
| 0xC0684206 || BAR_UPDATE_DECRYPT || -
|-
| 0xC0684207 || BAR_FINISH_ENCRYPT || -
|-
| 0xC0684208 || BAR_FINISH_DECRYPT || -
|}

== Disc UID ==

Disc UID (/dev/duid) has its own library (libSceDiscId). It's unknown what this is used for at present. It has two known [[IOCTL]]s.

{| class="wikitable sortable"
|-
! IOCTL # !! Name !! Notes
|-
| 0xC0104401 || DISC_ID_GET || -
|-
| 0xC0104402 || DISC_ID_GET2 || -
|}

== Dynamic Library Debug ==

Dynamic Lib Debug (/dev/dldbg) is used by the library for debugging syscore. Given the name, it's likely used for debugging sprx libs. Below are known commands.

{| class="wikitable sortable"
|-
! IOCTL # !! Name !! Notes
|-
| 0x80084401 || DLDBG_STOP_ON_DL_LOAD || -
|-
| 0x80084402 || DLDBG_NO_STOP_ON_DL_LOAD || -
|-
| 0xC0084403 || DLDBG_GET_DL_LOAD_FLAG || -
|-
|}

== FTTRM ==

FTTRM's full purpose is unknown, but it is likely DRM-related. It is used by the Bluray application (BdmvPlayerCore, BdvdPlayerCore, UHDBdPlayerCore) via /dev/fttrm. There are only two known commands.

{| class="wikitable sortable"
|-
! IOCTL # !! Name !! Notes
|-
| 0xC0185301 || FTTRM_READ_SECTOR || -
|-
| 0xC0185302 || FTTRM_WRITE_SECTOR || -
|}

== ICC Floyd (TPM) ==

The /dev/icc_floyd is for interacting with the floyd Trusted Platform Module (TPM) over ICC. It only has one known command.

{| class="wikitable sortable"
|-
! IOCTL # !! Name !! Notes
|-
| 0x400EB701 || ICC_FLOYD_GET_VERSION || -
|-
| 0xC010440E || FLOYD_UPDATE_FW || -
|-
|}

== Manufacturer Authorization ==

The /dev/manuauth device seems to be for manufacturer authorization or authentication. It is used in various updaters. Below are known commands.

{| class="wikitable sortable"
|-
! IOCTL # !! Name !! Notes
|-
| 0x40184D01 || MANUAUTH_LOAD_SM || Loads the secure module
|-
| 0x40184D02 || MANUAUTH_UNLOAD_SM || Unloads the secure module
|-
| 0xC0184D03 || MANUAUTH_SET_MANU_MODE || Sets manufacturer mode
|-
|}

== Namespace Filesystem Control ==

The Namespace Filesystem (NSFS) is used by Virtual Shell (Vsh) and [[SceShellCore]]. It is critical to processes running on the system. Below are known commands.

{| class="wikitable sortable"
|-
! IOCTL # !! Name !! Notes
|-
| 0xC0406E00 || NSFS_CREATE_REDIRECT || -
|-
| 0xC0406E01 || NSFS_DELETE_REDIRECT || -
|-
| 0xC0186E02 || NSFS_GET_REDIRECT_STATS || -
|-
| 0xC0206E03 || NSFS_ADD_OVERLAY_TO_NAMESPACE || -
|-
| 0xC0186E04 || NSFS_SET_GLOBAL_EXCLUDE || -
|}

== PFS Control ==

Playstation FileSystem (PFS) Control and /dev/pfsctldev is used internally for VSH. Below are known commands.

{| class="wikitable sortable"
|-
! IOCTL # !! Name !! Notes
|-
| 0x8030B001 || DEVPFSCTL_FORMAT || -
|-
| 0xC0E0B006 || DEVPFSCTL_GETFSSTAT || -
|-
| 0xC040B008 || DEVPFSCTL_MOUNT || -
|-
| 0xC038B009 || DEVPFSCTL_UNMOUNT || -
|-
| 0xC028B00A || DEVPFSCTL_GETEVENT || -
|-
| 0xC030B00B || DEVPFSCTL_EVENTCOMP || -
|-
| 0xC020B00C || DEVPFSCTL_CANCELEVENT || -
|-
| 0xC020B00D || DEVPFSCTL_REGEVENT || -
|-
| 0xC020B00E || DEVPFSCTL_DEREGEVENT || -
|-
| 0x8004B00F || DEVPFSCTL_SYSPOWEREVENT || -
|-
| 0xC008B074 || DEVPFSCTL_FSCK || -
|}

== PFS Manager ==

PFS Manager (/dev/pfsmgr) is used by [[SceShellCore]]. It handles trophy related tasks, savedata, and keystone verification. Below are known commands.

{| class="wikitable sortable"
|-
! IOCTL # !! Name !! Notes
|-
| 0xC1185001 || - || -
|-
| 0xC1185002 || - || -
|-
| 0xC1185003 || - || -
|-
| 0xC4085004 || - || -
|-
| 0x40845301 || - || - trophy related
|-
| 0xC0845302 || - || - savedata related
|-
| 0x40845303 || - || - savedata related
|-
| 0xC0845304 || - || - ???
|-
| 0xC0845305 || - || - ???
|-
| 0xC0A84B01 || - || - ???
|-
| 0xC0A84B02 || PFSMGR_VERIFY_KEYSTONE || -
|}

== PUP Updater ==

The /dev/pup_update0 device is used to perform firmware updates.

{| class="wikitable sortable"
|-
! IOCTL # !! Name !! Notes
|-
| 0xC0104401 || PUP_UPDATER_VERIFY_BLS_HEADER || -
|-
| 0xC0184402 || PUP_UPDATER_DECRYPT_HEADER || -
|-
| 0xC0184403 || PUP_UPDATER_VERIFY_ADDITIONAL_SIGN || -
|-
| 0xC0184404 || PUP_UPDATER_VERIFY_WATERMARK || -
|-
| 0xC0184405 || PUP_UPDATER_DECRYPT_SEGMENT || -
|-
| 0xC0284406 || PUP_UPDATER_DECRYPT_SEGMENT_BLOCK || -
|-
| 0x20004407 || PUP_UPDATER_UPDATE_SNVS || -
|-
| 0xC0104408 || PUP_UPDATER_GEN_CHALLENGE || -
|-
| 0xC018440A || PUP_UPDATER_READ_NAND_GROUP || -
|-
| 0xC018440B || PUP_UPDATER_WRITE_NAND_GROUP || -
|-
| 0xC010440C || PUP_UPDATER_IDENTIFY_NAND_CONTROLLER || -
|-
| 0xC004440D || PUP_UPDATER_IS_FW_OPERATIONAL || -
|-
| 0xC010440E || PUP_UPDATER_FLOYD_UPDATE_FW || -
|-
| 0xC001440F || PUP_UPDATER_GET_XTS_KEY_NUM || -
|-
| 0xC0104410 || PUP_UPDATER_VERIFY_RESPONSE || -
|}

== Root Param ==

Root Param is used by [[SceShellCore]] to verify root PARAM.SFO files (for PS4) or JSON files (for PS5, aka PPR for ProsPeRo). Below are known commands.

{| class="wikitable sortable"
|-
! IOCTL # !! Name !! Notes
|-
| 0xC0305201 || ROOTPARAM_VERIFY_PS4_ROOT_PARAM || -
|-
| 0xC0305202 || ROOTPARAM_VERIFY_PPR_ROOT_PARAM || -
|-
| 0xC0305203 || ROOTPARAM_RESUME_FROM_STANDBY || -
|}

== CAM Transport Layer ==

CAM (Common Access Method) storage subsystem provides a method for implementing drivers to control various known storage devices.
Attaches any devices it finds to the appropriate drivers.

{| class="wikitable sortable"
|-
! IOCTL # !! Name !! Notes
|-
| 0xC4E01902 || - || related to cam_send_ccb
|-
| 0xC4E01903 || CAMGETPASSTHRU || related to cam_lookup_pass
|}

== Wireless LAN and Bluetooth ==

WLAN and Bluetooth functionality is reachable via /dev/wlanbt. Below are known commands.

{| class="wikitable sortable"
|-
! IOCTL # !! Name !! Notes
|-
| 0x40047400 || WLANBT_GET_DEVICE_ID || -
|}