Editing Devices

Jump to navigation Jump to search
Warning: You are not logged in. Your IP address will be publicly visible if you make any edits. If you log in or create an account, your edits will be attributed to your username, along with other benefits.

The edit can be undone. Please check the comparison below to verify that this is what you want to do, and then publish the changes below to finish undoing the edit.

Latest revision Your text
Line 1: Line 1:
The PS5 has many kernel devices that can be accessed through [[IOCTL]]. Some of them have usermode module equivalents, some like "sbl" consist in [[Secure Modules]] and some like "camera" make use of a dedicated firmware stored in kernel memory.
See also [https://psdevwiki.com/ps4/Devices PS4 devices].
Note for ioctls: * indicates name is assumed from RE and may not be accurate.
Note for ioctls: * indicates name is assumed from RE and may not be accurate.


== Device Listing ==
== Device Listing ==
 
Note: only unique devices are listed. Benign devices like /dev/null are omitted for brevity's sake.
Unique devices are listed here. Benign devices like /dev/null are omitted for brevity's sake.


{| class="wikitable sortable"
{| class="wikitable sortable"
Line 19: Line 14:
| /dev/auditpipe || - || -
| /dev/auditpipe || - || -
|-
|-
| /dev/authmgr || Authentication Manager || -
| /dev/authmgr || - || -
|-
|-
| /dev/az{1,ctl} || - || Audio-related
| /dev/az{1,ctl} || - || -
|-
|-
| /dev/bar || Backup and Restore || Used by shellcore for backup and recovery
| /dev/bar || - || -
|-
|-
| /dev/bfs/ctl || - || -
| /dev/bfs/ctl || - || -
Line 33: Line 28:
| /dev/camera || Camera || -
| /dev/camera || Camera || -
|-
|-
| /dev/cloudsd || Cloud SaveData || -
| /dev/cloudsd || - || -
|-
|-
| /dev/console || Console || Usermode logging
| /dev/console || Console || Usermode logging
|-
|-
| /dev/crepo || Crash Report || Used for crash reporting service (coredump, gpudump, shellcore)
| /dev/crepo || - || -
|-
|-
| /dev/ctrlp{_sync} || - || Used by libScePad (controller)
| /dev/ctrlp{_sync} || - || -
|-
|-
| /dev/dbggc{_control} || Debug GPU? || -
| /dev/dbggc{_control} || Debug GPU? || -
Line 59: Line 54:
| /dev/dipsw || Dip Switch || -
| /dev/dipsw || Dip Switch || -
|-
|-
| /dev/dldbg || Dynamic Library Debug || -
| /dev/dldbg || - || -
|-
|-
| /dev/dmem{0,1,2} || - || -
| /dev/dmem{0,1,2} || - || -
Line 65: Line 60:
| /dev/dngl || - || -
| /dev/dngl || - || -
|-
|-
| /dev/duid || Disc Unique ID || -
| /dev/duid || - || -
|-
|-
| /dev/encdec || EncDec || -
| /dev/encdec || EncDec || -
|-
|-
| /dev/envelope || Envelope Format Crypto || -
| /dev/envelope || - || -
|-
|-
| /dev/evlg{0,1} || Event Log || Intended to be used with read syscall
| /dev/evlg{0,1} || - || -
|-
|-
| /dev/exthdd || External HDD || -
| /dev/exthdd || External HDD || -
Line 79: Line 74:
| /dev/fsctrl || - || -
| /dev/fsctrl || - || -
|-
|-
| /dev/fttrm || - || Used by bluray app
| /dev/fttrm || - || -
|-
|-
| /dev/gbase || - || -
| /dev/gbase || - || -
Line 99: Line 94:
| /dev/hmd_* || VR || -
| /dev/hmd_* || VR || -
|-
|-
| /dev/iccnvs{0,1,2,4,6} || ICC_NVS (sectors) || Location of Sectors 0, 1, 2, 4 and 6 of sflash0 non volatile storage
| /dev/iccnvs{0,1,2,4,6} || - || -
|-
|-
| /dev/icc_configuration || ICC Config || -
| /dev/icc_configuration || ICC Config || -
Line 109: Line 104:
| /dev/icc_fan || ICC Fan || -
| /dev/icc_fan || ICC Fan || -
|-
|-
| /dev/icc_floyd || ICC TPM? || SNVS Storage Device
| /dev/icc_floyd || ICC TPM? || -
|-
|-
| /dev/icc_indicator || ICC LED || -
| /dev/icc_indicator || ICC LED || -
Line 125: Line 120:
| /dev/kmbp || - || -
| /dev/kmbp || - || -
|-
|-
| /dev/lvdctl || Layered Vnode Device Control || -
| /dev/lvdctl || - || -
|-
|-
| /dev/lvd{0,1} || Layered Vnode Device || -
| /dev/lvd{0,1} || - || -
|-
|-
| /dev/m2.ctl || m.2 NVMe Control? || -
| /dev/m2.ctl || m.2 NVMe Control? || -
|-
| /dev/manuauth || Manufacturer Auth|| -
|-
|-
| /dev/mbus || Event bus || -
| /dev/mbus || Event bus || -
Line 137: Line 130:
| /dev/mbus_av || Event bus (audio video?) || -
| /dev/mbus_av || Event bus (audio video?) || -
|-
|-
| /dev/md0 || Kernel Md0 || Main System modules are located here for Kernel (Not System Modules!)
| /dev/md0 || - || -
|-
|-
| /dev/md2 || - || -
| /dev/md2 || - || -
Line 153: Line 146:
| /dev/notification{0-9} || Notification || -
| /dev/notification{0-9} || Notification || -
|-
|-
| /dev/npdrm || Network Product Digital Rights Management interface || -
| /dev/npdrm || - || -
|-
|-
| /dev/nsfsctl || Namespace Filesystem (NSFS) Control || -
| /dev/nsfsctl || - || -
|-
|-
| /dev/nsid1.ctl || - || -
| /dev/nsid1.ctl || - || -
Line 161: Line 154:
| /dev/otpaccess || One-Time Programmable Access? || -
| /dev/otpaccess || One-Time Programmable Access? || -
|-
|-
| /dev/pfsctldev || Playstation Filesystem (PFS) Control || -
| /dev/pfsctldev || - || -
|-
|-
| /dev/pfsmgr || PFS Manager || Used for trophies, savegames, keystone
| /dev/pfsmgr || - || -
|-
|-
| /dev/playgo_emu_param{1,2,3} || PlayGo emulator params || -
| /dev/playgo_emu_param{1,2,3} || PlayGo emulator params || -
|-
|-
| /dev/pltauth{0,1} || Platform Authentication (PSN) || -
| /dev/pltauth{0,1} || - || -
|-
|-
| /dev/pup_update0 || PUP Update || -
| /dev/pup_update0 || PUP Update || -
|-
|-
| /dev/qafutkn || QA flag / Utoken || -
| /dev/qafutkn || QA flag / utoken || -
|-
|-
| /dev/rnps || React Native PS || PSN related
| /dev/rnps || React Native PS || PSN related
|-
|-
| /dev/rootparam || Root Param || Used by shellcore for verifying root param sfo/json
| /dev/rootparam || - || -
|-
|-
| /dev/s3da || 3D Audio || -
| /dev/s3da || 3D Audio || -
|-
|-
| /dev/sbl_secreg || SBL Secure Region || -
| /dev/sbl_secreg || - || -
|-
|-
| /dev/sbl_srv || SBL Service || Used exclusively by playready
| /dev/sbl_srv || - || -
|-
|-
| /dev/scanin || - || -
| /dev/scanin || - || -
Line 191: Line 184:
| /dev/sflash0 || SPI flash || 2MB. Has EMC firmware and (non-secure) NVS.
| /dev/sflash0 || SPI flash || 2MB. Has EMC firmware and (non-secure) NVS.
|-
|-
| /dev/srtc || Secure Real Time Clock || -
| /dev/srtc || - || -
|-
|-
| /dev/ssd0.* || Internal SSD partitions || -
| /dev/ssd0.* || Internal SSD partitions || -
Line 205: Line 198:
| /dev/uvd_{dec/enc/bgt} || Unified Video Decoder? || -
| /dev/uvd_{dec/enc/bgt} || Unified Video Decoder? || -
|-
|-
| /dev/wlanbt || Wireless LAN + Bluetooth || -
| /dev/wlanbt || - || -
|-
|-
| /dev/xpt0 || XPT Transport Interface || CAM Transport Layer
| /dev/xtp0 || - || -
|}
|}


== Platform Security Processor Core (PSP) (MP0) ==
== Platform Security Processor Core (PSP) (MP0) ==


* See also the [[AMD Platform Security Processor]] wiki page.
* All the fun things are here
* All the fun things related to PS5 security are here.
* Named SMU PSP as well
* Named AMD SMU PSP (AMD System Management Unit Platform Security Processor) and ASP (AMD Secure Processor) as well.
* Named ASP as well


== System Management Unit (SMU) (MP1) ==
== System Management Unit (SMU) (MP1) ==
MP1 (System Management Unit or "SMU") is an xtensa CPU responsible for power management, clock management, sampling sensor data, and other power/thermal-related tasks. The /dev/mp1 device can be used to issue commands to it. Below are known commands.
MP1 (System Management Unit or "SMU") is an xtensa CPU responsible for power management, clock management, sampling sensor data, and other power/thermal-related tasks. The /dev/mp1 device can be used to issue commands to it. Below are known commands.


Line 237: Line 229:
== Sensor Fusion Processor (SFP) (MP2) ==
== Sensor Fusion Processor (SFP) (MP2) ==


* It does not exist on PS5 as it is mainly for mobiles.
* doesn't exist on ps5
* mainly for mobiles


== Trusted Execution Environment (TEE) (MP3) ==
== Trusted Execution Environment (TEE) (MP3) ==
 
MP3 consists of the Trusted Execution Environment (TEE) running on the AMD Platform Security Processor (PSP/SP). Its primary function is Digital Rights Management (DRM) via [https://www.microsoft.com/playready/features/EnhancedContentProtection.aspx PlayReady SL3000]. In userspace, the libSceTEEClient library is used for interfacing with it, which internally uses /dev/mp3 to load secure binaries (sbins) and establish sessions. Below are known commands.
MP3 consists of the Trusted Execution Environment (TEE) running on the [[AMD Platform Security Processor]]. Its primary function is Digital Rights Management (DRM) via [https://www.microsoft.com/playready/features/EnhancedContentProtection.aspx PlayReady SL3000]. In usermode, the libSceTEEClient library is used for interfacing with it, which internally uses /dev/mp3 to load secure binaries (sbins) and establish sessions. Below are known commands.


{| class="wikitable sortable"
{| class="wikitable sortable"
|-
|-
! IOCTL # !! Name !! Notes
! IOCTL # !! Name !! Notes
|-
|0x400CB400
|TEE_IOC_VERSION
| -
|-
|-
| 0xC010B403 || TEE_IOC_INVOKE || Invoke commands
| 0xC010B403 || TEE_IOC_INVOKE || Invoke commands
|-
|0xC010B402
|TEE_IOC_OPEN_SESSION
| -
|-
|0xC008B404
|TEE_IOC_CANCEL
| -
|-
|-
| 0xC010B408 || TEE_IOC_DLM_GET_DEBUG_TOKEN || -
| 0xC010B408 || TEE_IOC_DLM_GET_DEBUG_TOKEN || -
Line 279: Line 259:


== A53MM/A53IO (MP4) ==
== A53MM/A53IO (MP4) ==
MP4, which consists of /dev/a53mm, /dev/a53mmsys, and /dev/a53io, is used for various tasks, and its overall purpose is not fully understood. Some of the things it includes are debugging (mdbg), video encode/decode, and other various memory-management related things. Below are known commands.
MP4, which consists of /dev/a53mm, /dev/a53mmsys, and /dev/a53io, is used for various tasks, and its overall purpose is not fully understood. Some of the things it includes are debugging (mdbg), video encode/decode, and other various memory-management related things. Below are known commands.


Line 309: Line 288:
| 0xC004AC0D || A53MM_WAIT_COMMAND_BUFFER_COMPLETION || -
| 0xC004AC0D || A53MM_WAIT_COMMAND_BUFFER_COMPLETION || -
|-
|-
| 0xC018AC0E || A53MM_INTERNAL_LOCK_UNLOCK_MAPPER_MEMORY || -
| 0xC018AC0E || - || -
|-
|-
| 0xC018AC0F || - || -
| 0xC018AC0F || - || -
|-
|-
| 0xC018AC10 || A53MM_GET_USAGE_STATS_DATA || -
| 0xC018AC10 || A53MM_VA_TO_IOMA * || -
|-
|-
| 0xC004AC11 || A53MM_SET_PAGE_TABLE_POOL_OCCUPANCY_THRESHOLD || -
| 0xC004AC11 || A53MM_PAGE_TABLE_POOL_OCCUPANCY_THRESHOLD || -
|-
|-
| 0xC018AC12 || A53MM_INTERNAL_TEST_PAGE_MIGRATION || -
| 0xC018AC12 || - || -
|-
|-
| 0xC004AC13 || - || -
| 0xC004AC13 || - || -
Line 327: Line 306:
! IOCTL # !! Name !! Notes
! IOCTL # !! Name !! Notes
|-
|-
| 0xc020b501 || A53MMSYS_INTERNAL_LOCK_UNLOCK_MAPPER_MEMORY || -
| 0xc020b501 || - || -
|-
|-
| 0xc028b502 || - || -
| 0xc028b502 || - || -
Line 352: Line 331:
|-
|-
! IOCTL # !! Name !! Notes
! IOCTL # !! Name !! Notes
|-
| 0x80046101 || NAND_A53IO_OPEN || Exposes NAND groups for reading
|-
| 0x80046102 || NAND_A53IO_CLOSE || Closes off NAND groups
|-
| 0x80046103 || NAND_A53IO_SETUP_FLASH_DEVICE || -
|-
| 0x80046104 || NAND_A53IO_DISABLE_CONTROLLER || Disables A53 controller (warning: this will put the console in a bad state)
|-
| 0x80046105 || NAND_A53IO_FORMAT_NVM || Formats NVMe
|-
| 0x80186111 || BFS_A53IO_READ_DEVICE? || -
|-
|-
| 0xC03861A1 || BFS_A53IO_READ_BLOCK || -
| 0xC03861A1 || BFS_A53IO_READ_BLOCK || -
|-
|-
| 0xC03861A2 || BFS_A53IO_WRITE_BLOCK || -
| 0xC03861A2 || BFS_A53IO_WRITE_BLOCK || -
|-
| 0xC01061C1 || BFS_A53IO_CREATE_RESERVED_LBA || -
|-
| 0xC01061C2 || BFS_A53IO_DELETE_RESERVED_LBA || -
|-
| 0xC00C61C5 || ???? || Related to delete logical partitions
|-
| 0xC01061C8 || ???? || Related to delete logical partitions
|-
| 0xC02061CA || ???? || Related to delete logical partitions
|}
== Backup and Restore ==
Backup and Restore (BAR) is used by [[SceShellCore]] via /dev/bar. Below are known commands.
{| class="wikitable sortable"
|-
! IOCTL # !! Name !! Notes
|-
| 0xC0684201 || BAR_CREATE_CONTEXT || -
|-
| 0xC0684202 || BAR_DESTROY_CONTEXT * || -
|-
| 0xC0684203 || BAR_INIT_CONTEXT || -
|-
| 0xC0684204 || BAR_UPDATE_AAD || -
|-
| 0xC0684205 || BAR_UPDATE_ENCRYPT || -
|-
| 0xC0684206 || BAR_UPDATE_DECRYPT || -
|-
| 0xC0684207 || BAR_FINISH_ENCRYPT || -
|-
| 0xC0684208 || BAR_FINISH_DECRYPT || -
|}
== Disc UID ==
Disc UID (/dev/duid) has its own library (libSceDiscId). It's unknown what this is used for at present. It has two known [[IOCTL]]s.
{| class="wikitable sortable"
|-
! IOCTL # !! Name !! Notes
|-
| 0xC0104401 || DISC_ID_GET || -
|-
| 0xC0104402 || DISC_ID_GET2 || -
|}
== Dynamic Library Debug ==
Dynamic Lib Debug (/dev/dldbg) is used by the library for debugging syscore. Given the name, it's likely used for debugging sprx libs. Below are known commands.
{| class="wikitable sortable"
|-
! IOCTL # !! Name !! Notes
|-
| 0x80084401 || DLDBG_STOP_ON_DL_LOAD || -
|-
| 0x80084402 || DLDBG_NO_STOP_ON_DL_LOAD || -
|-
| 0xC0084403 || DLDBG_GET_DL_LOAD_FLAG || -
|-
|}
== FTTRM ==
FTTRM's full purpose is unknown, but it is likely DRM-related. It is used by the Bluray application (BdmvPlayerCore, BdvdPlayerCore, UHDBdPlayerCore) via /dev/fttrm. There are only two known commands.
{| class="wikitable sortable"
|-
! IOCTL # !! Name !! Notes
|-
| 0xC0185301 || FTTRM_READ_SECTOR || -
|-
| 0xC0185302 || FTTRM_WRITE_SECTOR || -
|}
== ICC Floyd (TPM) ==
The /dev/icc_floyd is for interacting with the floyd Trusted Platform Module (TPM) over ICC. It only has one known command.
{| class="wikitable sortable"
|-
! IOCTL # !! Name !! Notes
|-
| 0x400EB701 || ICC_FLOYD_GET_VERSION || -
|-
| 0xC010440E || FLOYD_UPDATE_FW || -
|-
|}
== Manufacturer Authorization ==
The /dev/manuauth device seems to be for manufacturer authorization or authentication. It is used in various updaters. Below are known commands.
{| class="wikitable sortable"
|-
! IOCTL # !! Name !! Notes
|-
| 0x40184D01 || MANUAUTH_LOAD_SM || Loads the secure module
|-
| 0x40184D02 || MANUAUTH_UNLOAD_SM || Unloads the secure module
|-
| 0xC0184D03 || MANUAUTH_SET_MANU_MODE || Sets manufacturer mode
|-
|}
== Namespace Filesystem Control ==
The Namespace Filesystem (NSFS) is used by Virtual Shell (Vsh) and [[SceShellCore]]. It is critical to processes running on the system. Below are known commands.
{| class="wikitable sortable"
|-
! IOCTL # !! Name !! Notes
|-
| 0xC0406E00 || NSFS_CREATE_REDIRECT || -
|-
| 0xC0406E01 || NSFS_DELETE_REDIRECT || -
|-
| 0xC0186E02 || NSFS_GET_REDIRECT_STATS || -
|-
| 0xC0206E03 || NSFS_ADD_OVERLAY_TO_NAMESPACE || -
|-
| 0xC0186E04 || NSFS_SET_GLOBAL_EXCLUDE || -
|}
== PFS Control ==
Playstation FileSystem (PFS) Control and /dev/pfsctldev is used internally for VSH. Below are known commands.
{| class="wikitable sortable"
|-
! IOCTL # !! Name !! Notes
|-
| 0x8030B001 || DEVPFSCTL_FORMAT || -
|-
| 0xC0E0B006 || DEVPFSCTL_GETFSSTAT || -
|-
| 0xC040B008 || DEVPFSCTL_MOUNT || -
|-
| 0xC038B009 || DEVPFSCTL_UNMOUNT || -
|-
| 0xC028B00A || DEVPFSCTL_GETEVENT || -
|-
| 0xC030B00B || DEVPFSCTL_EVENTCOMP || -
|-
| 0xC020B00C || DEVPFSCTL_CANCELEVENT || -
|-
| 0xC020B00D || DEVPFSCTL_REGEVENT || -
|-
| 0xC020B00E || DEVPFSCTL_DEREGEVENT || -
|-
| 0x8004B00F || DEVPFSCTL_SYSPOWEREVENT || -
|-
| 0xC008B074 || DEVPFSCTL_FSCK || -
|}
== PFS Manager ==
PFS Manager (/dev/pfsmgr) is used by [[SceShellCore]]. It handles trophy related tasks, savedata, and keystone verification. Below are known commands.
{| class="wikitable sortable"
|-
! IOCTL # !! Name !! Notes
|-
| 0xC1185001 || - || -
|-
| 0xC1185002 || - || -
|-
| 0xC1185003 || - || -
|-
| 0xC4085004 || - || -
|-
| 0x40845301 || - || - trophy related
|-
| 0xC0845302 || - || - savedata related
|-
| 0x40845303 || - || - savedata related
|-
| 0xC0845304 || - || - ???
|-
| 0xC0845305 || - || - ???
|-
| 0xC0A84B01 || - || - ???
|-
| 0xC0A84B02 || PFSMGR_VERIFY_KEYSTONE || -
|}
== PUP Updater ==
The /dev/pup_update0 device is used to perform firmware updates.
{| class="wikitable sortable"
|-
! IOCTL # !! Name !! Notes
|-
| 0xC0104401 || PUP_UPDATER_VERIFY_BLS_HEADER || -
|-
| 0xC0184402 || PUP_UPDATER_DECRYPT_HEADER || -
|-
| 0xC0184403 || PUP_UPDATER_VERIFY_ADDITIONAL_SIGN || -
|-
| 0xC0184404 || PUP_UPDATER_VERIFY_WATERMARK || -
|-
| 0xC0184405 || PUP_UPDATER_DECRYPT_SEGMENT || -
|-
| 0xC0284406 || PUP_UPDATER_DECRYPT_SEGMENT_BLOCK || -
|-
| 0x20004407 || PUP_UPDATER_UPDATE_SNVS || -
|-
| 0xC0104408 || PUP_UPDATER_GEN_CHALLENGE || -
|-
| 0xC018440A || PUP_UPDATER_READ_NAND_GROUP || -
|-
| 0xC018440B || PUP_UPDATER_WRITE_NAND_GROUP || -
|-
| 0xC010440C || PUP_UPDATER_IDENTIFY_NAND_CONTROLLER || -
|-
| 0xC004440D || PUP_UPDATER_IS_FW_OPERATIONAL || -
|-
| 0xC010440E || PUP_UPDATER_FLOYD_UPDATE_FW || -
|-
| 0xC001440F || PUP_UPDATER_GET_XTS_KEY_NUM || -
|-
| 0xC0104410 || PUP_UPDATER_VERIFY_RESPONSE || -
|}
== Root Param ==
Root Param is used by [[SceShellCore]] to verify root PARAM.SFO files (for PS4) or JSON files (for PS5, aka PPR for ProsPeRo). Below are known commands.
{| class="wikitable sortable"
|-
! IOCTL # !! Name !! Notes
|-
| 0xC0305201 || ROOTPARAM_VERIFY_PS4_ROOT_PARAM || -
|-
| 0xC0305202 || ROOTPARAM_VERIFY_PPR_ROOT_PARAM || -
|-
| 0xC0305203 || ROOTPARAM_RESUME_FROM_STANDBY || -
|}
== CAM Transport Layer ==
CAM (Common Access Method) storage subsystem provides a method for implementing drivers to control various known storage devices.
Attaches any devices it finds to the appropriate drivers.
{| class="wikitable sortable"
|-
! IOCTL # !! Name !! Notes
|-
| 0xC4E01902 || - || related to cam_send_ccb
|-
| 0xC4E01903 || CAMGETPASSTHRU || related to cam_lookup_pass
|}
== Wireless LAN and Bluetooth ==
WLAN and Bluetooth functionality is reachable via /dev/wlanbt. Below are known commands.
{| class="wikitable sortable"
|-
! IOCTL # !! Name !! Notes
|-
| 0x40047400 || WLANBT_GET_DEVICE_ID || -
|}
|}
Please note that all contributions to PS5 Developer wiki are considered to be released under the GNU Free Documentation License 1.2 (see PS5 Developer wiki:Copyrights for details). If you do not want your writing to be edited mercilessly and redistributed at will, then do not submit it here.
You are also promising us that you wrote this yourself, or copied it from a public domain or similar free resource. Do not submit copyrighted work without permission!

To protect the wiki against automated edit spam, we kindly ask you to solve the following hCaptcha:

Cancel Editing help (opens in new window)
Retrieved from "http://www.psdevwiki.com/ps5/Devices"