Editing Devices

The PS5 has many kernel devices that can be accessed through [[IOCTL]]. Some of them have usermode module equivalents, some like "sbl" consist in [[Secure Modules]] and some like "camera" make use of a dedicated firmware stored in kernel memory.

See also [https://psdevwiki.com/ps4/Devices PS4 devices].

Note for ioctls: * indicates name is assumed from RE and may not be accurate.

== Device Listing ==

Unique devices are listed here without the "/dev/" prefix for readability. Benign devices like /dev/null are omitted for brevity's sake.

{| class="wikitable sortable"
|-
! Device Path !! Device Long Name !! Notes
|-
| a53{io,mm,mmsys} || A53 Input/Output, Memory Management (sys) || See MP4 section
|-
| ajm{i} || Audio Job Manager || -
|-
| auditpipe || Audit Pipe || -
|-
| authmgr || Authentication Manager || -
|-
| az{1,ctl} || - || Audio-related
|-
| bar || [[Backup And Restore]] || Used by shellcore for backup and recovery
|-
| bfs/ctl || - || -
|-
| bluetooth_hid || Bluetooth Human Interface Device || -
|-
| bt || Bluetooth || -
|-
| camera || Camera || -
|-
| cloudsd || Cloud SaveData || -
|-
| console || Console || Usermode logging
|-
| crepo || Crash Report || Used for crash reporting service (coredump, gpudump, shellcore)
|-
| ctrlp{_sync} || -CTRLP || Used by libScePad (controller). See PS4 and PS Vita ctrlp modules.
|-
| dbggc{_control} || Debug GPU? || -
|-
| deci_coredump || [[DECI5]] coredump || -
|-
| deci_mp4_ioc || [[DECI5]] MP4 ?I/O Control? || -
|-
| deci_mp4_mmc || [[DECI5]] MP4 ?MM Control? || -
|-
| deci_std{in,out,err} || [[DECI5]] Input/Output/Error || -
|-
| deci_tty* || [[DECI5]] Terminals || -
|-
| devctl || Dev Control || -
|-
| diag || Diagnosis || -
|-
| dipsw || [[DIP Switches]] || -
|-
| dldbg || Dynamic Library Debug || -
|-
| dmem{0,1,2} || - || -
|-
| dngl || - || -
|-
| duid || Disc Unique ID || -
|-
| encdec || Encrypt Decrypt || Related to Portability Keys.
|-
| envelope || [[Envelope Files]] || Related to Envelope Files Keys.
|-
| evlg{0,1} || Event Log || Intended to be used with read syscall 
|-
| exthdd || External HDD || -
|-
| fcram || - || -
|-
| fsctrl || FileSystem Control || -
|-
| fttrm || ?Film and Television Tracking? Rights Management || Used by bluray app
|-
| gbase || - || -
|-
| gc || GPU command || -
|-
| geom.ctl || - || -
|-
| gic || - || -
|-
| gsched_bds.ctl || - || -
|-
| hdmi || HDMI || -
|-
| hid || Human Interface Device || -
|-
| hmd2_* || Head-mounted Display || For PS VR 2.
|-
| hmd_* || Head-mounted Display || For PS VR first revision.
|-
| iccnvs{0,1,2,4,6} || ICC NVS || Specific access to Sectors 0, 1, 2, 4 and 6 of [[Serial Flash]] [[Non Volatile Storage]]
|-
| icc_configuration || ICC Configuration || -
|-
| icc_crash_report || ICC Crash Report || -
|-
| icc_device_power || ICC Device Power || -
|-
| icc_fan || ICC Fan || -
|-
| icc_floyd || ICC Floyd || SNVS Storage Device. ?TPM related?
|-
| icc_indicator || ICC Indicator || Control the LEDs.
|-
| icc_nvs || ICC NVS || ?Global access to [[Serial Flash]] [[Non Volatile Storage]] like on PS4?
|-
| icc_power || ICC Power || -
|-
| icc_sc_config || ICC ?Syscon? Configuration || -
|-
| icc_thermal || ICC Thermal || -
|-
| klog || Kernel Log || Read syscall on this device can be used to get kernel log if privileged
|-
| kmbp || - || -
|-
| lvdctl || Layered Vnode Device Control || -
|-
| lvd{0,1} || Layered Vnode Device || lv0 is a mountpoint for /mnt/rnps. lvd1 is a mountpoint for /mnt/sandbox/download/NPXS40140. See [[Filesystem]].
|-
| cd0 || Compact Disc 0 || cd0 is a mountpoint for /mnt/disc. See [[Filesystem]].
|-
| m2.ctl || [[M.2 SSD]] ?Control? || -
|-
| manuauth || Manufacturer Auth || -
|-
| mbus || ?Media/Memory/Management? Bus || Event bus
|-
| mbus_av || ?Media/Memory/Management? Bus (?audio video?) || Event bus maybe for audio/video.
|-
| md0 || ?Mount Directory? 0 || Main System modules/devices are located here for Kernel
|-
| md2 || ?Mount Directory? 2 || md2 is a mountpoint for /system_data/eap/rodata. See [[Filesystem]].
|-
| mdctl || ?Mount Directory? Control || -
|-
| da1s1 || DA 1 Sector 1 || da1s1 is a mountpoint for /mnt/usb0. See [[Filesystem]].
|-
| metadbg || Meta Debug || -
|-
| mp1 || System Management Unit (SMU) || Power management, thermals, etc. See MP1 section.
|-
| mp3 || Trusted Execution Environment (TEE) || See MP3 section.
|-
| mp4/dump{_for_decid} || A53 (mdbg?) || See MP4 section.
|-
| notification{0-9} || Notification || -
|-
| npdrm || Network Product Digital Rights Management interface || -
|-
| nsfsctl || Namespace Filesystem (NSFS) Control || -
|-
| nsid1.ctl || Namespace ID 1 Control || -
|-
| otpaccess || One-Time Programmable Access? || -
|-
| pfsctldev || PFS Control Device || -
|-
| pfsmgr || PFS Manager || Used for [[Trophy]], [[Save Data]], [[Keystone]]
|-
| playgo_emu_param{1,2,3} || [[PlayGo]] emulator params || -
|-
| pltauth{0,1} || Platform Authentication || For PSN connection.
|-
| pup_update0 || PUP Update || -
|-
| qafutkn || QA flag / Utoken || -
|-
| rnps || React Native PS || [[RNPS]] regroups many PSN services (friends, party, events, etc.)
|-
| rootparam || Root Param || Used by [[SceShellCore]] for verifying root param SFO/JSON
|-
| s3da || ?System/Software? 3D Acceleration || See Marcan's slides about PS4 GPU Linux driver.
|-
| sbl_secreg || SBL Secure Region/Registry || -
|-
| sbl_srv || SBL Service || Used exclusively by playready
|-
| scanin || - || -
|-
| sce_zlib{_sys} || zlib || zlib (de)compression
|-
| sc_fw_update0 || ?syscon? firmware update || -
|-
| sflash0 || [[Serial Flash]] || 2MB. Contains [[EMC]] firmware and (non-secure) NVS.
|-
| sflash0s0 || [[Serial Flash]] Sector 0 || 
|-
| sflash0s0x0 || [[Serial Flash]] Sector 0 Block 0 || 
|-
| sflash0s0x34 || [[Serial Flash]] Sector 0 Block 34 || Serial Flash [[Non Volatile Storage]]
|-
| sflash0s0x32 || [[Serial Flash]] Sector 0 Block 32 || To be confirmed.
|-
| sflash0s0x32b || [[Serial Flash]] Sector 0 Block 32 bis || 
|-
| sflash0s0x41b || [[Serial Flash]] Sector 0 Block 41 || To be confirmed.
|-
| sflash0s0x41b || [[Serial Flash]] Sector 0 Block 41 bis || 
|-
| sflash0s1 || [[Serial Flash]] Sector 1 || To be confirmed.
|-
| sflash0s1.crypt || [[Serial Flash]] Sector 1 encrypted || To be confirmed.
|-
| sflash0s1.cryptx40 || [[Serial Flash]] Sector 1 encrypted Block 40 || 
|-
| srtc || Secure Real Time Clock || -
|-
| ssd0.* || Solid State Drive 0 || Mountpoints for many internal SSD partitions. See [[Filesystem]].
|-
| sshot || Screenshot || -
|-
| transactionid.ctl || Transaction ID Control || -
|-
| ufssuspend || UFS Suspend || -
|-
| usbctl || USB Control || -
|-
| uvd_{dec/enc/bgt} || ?Unified Video Decoder? || Maybe related to gameplay recording.
|-
| wlanbt || Wireless LAN + Bluetooth || -
|-
| xpt0 || XPT Transport Interface || CAM Transport Layer
|}

== Platform Security Processor Core (PSP) (MP0) ==

* See also the [[AMD Platform Security Processor]] wiki page.
* All the fun things related to PS5 security are here.
* Named AMD SMU PSP (AMD System Management Unit Platform Security Processor) and ASP (AMD Secure Processor) as well.

== System Management Unit (SMU) (MP1) ==

MP1 (System Management Unit or "SMU") is an xtensa CPU responsible for power management, clock management, sampling sensor data, and other power/thermal-related tasks. The /dev/mp1 device can be used to issue commands to it. Below are known commands.

{| class="wikitable sortable"
|-
! IOCTL # !! Name !! Notes
|-
| 0x4068AE01 || MP1_IOCTL_GET_CLK || Get clock frequency
|-
| 0x8004AE17 || MP1_IOCTL_SET_GFXCLK || Set graphics clock frequency
|-
| 0xC004AE18 || MP1_IOCTL_REQUEST_MODE_SWITCH || -
|-
| 0x8008AE1D || MP1_IOCTL_SET_COREPSTATE || Set core power state?
|-
| 0xC00CAE1E || MP1_IOCTL_GET_COREPSTATE || Get core power state?
|}

== Sensor Fusion Processor (SFP) (MP2) ==

* It does not exist on PS5 as it is mainly for mobiles.

== Trusted Execution Environment (TEE) (MP3) ==

MP3 consists of the Trusted Execution Environment (TEE) running on the [[AMD Platform Security Processor]]. Its primary function is Digital Rights Management (DRM) via [https://www.microsoft.com/playready/features/EnhancedContentProtection.aspx PlayReady SL3000]. In usermode, the libSceTEEClient library is used for interfacing with it, which internally uses /dev/mp3 to load secure binaries (sbins) and establish sessions. Below are known commands.

{| class="wikitable sortable"
|-
! IOCTL # !! Name !! Notes
|-
|0x400CB400
|TEE_IOC_VERSION
| -
|-
| 0xC010B403 || TEE_IOC_INVOKE || Invoke commands
|-
|0xC010B402
|TEE_IOC_OPEN_SESSION
| -
|-
|0xC008B404
|TEE_IOC_CANCEL
| -
|-
| 0xC010B408 || TEE_IOC_DLM_GET_DEBUG_TOKEN || -
|-
| 0xC028B409 || TEE_IOC_DLM_START_TA_DEBUG || -
|-
| 0xC110B40A || TEE_IOC_DLM_FETCH_DEBUG_STRING || -
|-
| 0x8008B40B || TEE_IOC_DLM_STOP_TA_DEBUG || -
|-
| 0x8008B40B || TEE_IOC_INIT_ASD || -
|-
| 0xC038B40C || TEE_SHM_REGISTER || -
|-
| 0xC004B40E || TEE_SHM_RELEASE || -
|-
| 0xC004B40F || TEE_SET_TIMEOUT || -
|}

== A53MM/A53IO (MP4) ==

MP4, which consists of /dev/a53mm, /dev/a53mmsys, and /dev/a53io, is used for various tasks, and its overall purpose is not fully understood. Some of the things it includes are debugging (mdbg), video encode/decode, and other various memory-management related things. Below are known commands.

'''a53mm'''
{| class="wikitable sortable"
|-
! IOCTL # !! Name !! Notes
|-
| 0xC004AC01 || - || -
|-
| 0xC030AC02 || A53MM_GIVE_DIRECT_MEM_TO_MAPPER || -
|-
| 0xC030AC03 || A53MM_CALL_INDIRECT_BUFFER || -
|-
| 0xC050AC05 || A53MM_MAPPER_VIRTUAL_QUERY || -
|-
| 0xC038AC06 || A53MM_GET_PARAM * || -
|-
| 0xC018AC07 || - || -
|-
| 0xC004AC08 || - || -
|-
| 0xC018AC09 || - || -
|-
| 0xC010AC0A || - || -
|-
| 0xC018AC0B || A53MM_MAPPER_QUERY_PA || -
|-
| 0xC004AC0D || A53MM_WAIT_COMMAND_BUFFER_COMPLETION || -
|-
| 0xC018AC0E || A53MM_INTERNAL_LOCK_UNLOCK_MAPPER_MEMORY || -
|-
| 0xC018AC0F || - || -
|-
| 0xC018AC10 || A53MM_GET_USAGE_STATS_DATA || -
|-
| 0xC004AC11 || A53MM_SET_PAGE_TABLE_POOL_OCCUPANCY_THRESHOLD || -
|-
| 0xC018AC12 || A53MM_INTERNAL_TEST_PAGE_MIGRATION || -
|-
| 0xC004AC13 || - || -
|}

'''a53mmsys'''
{| class="wikitable sortable"
|-
! IOCTL # !! Name !! Notes
|-
| 0xc020b501 || A53MMSYS_INTERNAL_LOCK_UNLOCK_MAPPER_MEMORY || -
|-
| 0xc028b502 || - || -
|-
| 0xc050b503 || - || -
|-
| 0xc010b504 || - || -
|-
| 0xc028b505 || A53MMSYS_MAPPER_GET_INDIRECT_BUFFER_INFO || -
|-
| 0xc020b506 || - || -
|-
| 0xc018b507 || - || -
|-
| 0xc018b508 || A53MMSYS_DEBUG_MAPPER_QUERY_DMEM_OFFSET || -
|-
| 0xc020b50a || - || -
|-
| 0xc010b50b || A53MMSYS_DEBUG_GET_AMPR_COUNTER_INFO || -
|}

'''a53io'''
{| class="wikitable sortable"
|-
! IOCTL # !! Name !! Notes
|-
| 0x80046101 || NAND_A53IO_OPEN || Exposes NAND groups for reading
|-
| 0x80046102 || NAND_A53IO_CLOSE || Closes off NAND groups
|-
| 0x80046103 || NAND_A53IO_SETUP_FLASH_DEVICE || -
|-
| 0x80046104 || NAND_A53IO_DISABLE_CONTROLLER || Disables A53 controller (warning: this will put the console in a bad state)
|-
| 0x80046105 || NAND_A53IO_FORMAT_NVM || Formats NVMe
|-
| 0x80186111 || BFS_A53IO_READ_DEVICE? || -
|-
| 0xC03861A1 || BFS_A53IO_READ_BLOCK || -
|-
| 0xC03861A2 || BFS_A53IO_WRITE_BLOCK || -
|-
| 0xC01061C1 || BFS_A53IO_CREATE_RESERVED_LBA || -
|-
| 0xC01061C2 || BFS_A53IO_DELETE_RESERVED_LBA || -
|-
| 0xC00C61C5 || ???? || Related to delete logical partitions
|-
| 0xC01061C8 || ???? || Related to delete logical partitions
|-
| 0xC02061CA || ???? || Related to delete logical partitions
|}

== Backup and Restore ==

Backup and Restore (BAR) is used by [[SceShellCore]] via /dev/bar. Below are known commands.

{| class="wikitable sortable"
|-
! IOCTL # !! Name !! Notes
|-
| 0xC0684201 || BAR_CREATE_CONTEXT || -
|-
| 0xC0684202 || BAR_DESTROY_CONTEXT * || -
|-
| 0xC0684203 || BAR_INIT_CONTEXT || -
|-
| 0xC0684204 || BAR_UPDATE_AAD || -
|-
| 0xC0684205 || BAR_UPDATE_ENCRYPT || -
|-
| 0xC0684206 || BAR_UPDATE_DECRYPT || -
|-
| 0xC0684207 || BAR_FINISH_ENCRYPT || -
|-
| 0xC0684208 || BAR_FINISH_DECRYPT || -
|}

== Disc UID ==

Disc UID (/dev/duid) has its own library (libSceDiscId). It's unknown what this is used for at present. It has two known [[IOCTL]]s.

{| class="wikitable sortable"
|-
! IOCTL # !! Name !! Notes
|-
| 0xC0104401 || DISC_ID_GET || -
|-
| 0xC0104402 || DISC_ID_GET2 || -
|}

== Dynamic Library Debug ==

Dynamic Lib Debug (/dev/dldbg) is used by the library for debugging syscore. Given the name, it's likely used for debugging sprx libs. Below are known commands.

{| class="wikitable sortable"
|-
! IOCTL # !! Name !! Notes
|-
| 0x80084401 || DLDBG_STOP_ON_DL_LOAD || -
|-
| 0x80084402 || DLDBG_NO_STOP_ON_DL_LOAD || -
|-
| 0xC0084403 || DLDBG_GET_DL_LOAD_FLAG || -
|-
|}

== FTTRM ==

FTTRM's full purpose is unknown, but it is likely DRM-related. It is used by the Bluray application (BdmvPlayerCore, BdvdPlayerCore, UHDBdPlayerCore) via /dev/fttrm. There are only two known commands. RM stands for Rights Management and FT may stand for FilmTrack. See [https://info.filmtrack.com/the-critical-role-of-security-in-entertainment-rights-management].

{| class="wikitable sortable"
|-
! IOCTL # !! Name !! Notes
|-
| 0xC0185301 || FTTRM_READ_SECTOR || -
|-
| 0xC0185302 || FTTRM_WRITE_SECTOR || -
|}

== ICC Floyd (TPM) ==

The /dev/icc_floyd is for interacting with the floyd Trusted Platform Module (TPM) over ICC. It only has one known command.

{| class="wikitable sortable"
|-
! IOCTL # !! Name !! Notes
|-
| 0x400EB701 || ICC_FLOYD_GET_VERSION || -
|-
| 0xC010440E || FLOYD_UPDATE_FW || -
|-
|}

== Manufacturer Authorization ==

The /dev/manuauth device seems to be for manufacturer authorization or authentication. It is used in various updaters. Below are known commands.

{| class="wikitable sortable"
|-
! IOCTL # !! Name !! Notes
|-
| 0x40184D01 || MANUAUTH_LOAD_SM || Loads the secure module
|-
| 0x40184D02 || MANUAUTH_UNLOAD_SM || Unloads the secure module
|-
| 0xC0184D03 || MANUAUTH_SET_MANU_MODE || Sets manufacturer mode
|-
|}

== Namespace Filesystem Control ==

The Namespace Filesystem (NSFS) is used by Virtual Shell (Vsh) and [[SceShellCore]]. It is critical to processes running on the system. Below are known commands.

{| class="wikitable sortable"
|-
! IOCTL # !! Name !! Notes
|-
| 0xC0406E00 || NSFS_CREATE_REDIRECT || -
|-
| 0xC0406E01 || NSFS_DELETE_REDIRECT || -
|-
| 0xC0186E02 || NSFS_GET_REDIRECT_STATS || -
|-
| 0xC0206E03 || NSFS_ADD_OVERLAY_TO_NAMESPACE || -
|-
| 0xC0186E04 || NSFS_SET_GLOBAL_EXCLUDE || -
|}

== PFS Control ==

Playstation FileSystem (PFS) Control and /dev/pfsctldev is used internally for VSH. Below are known commands.

{| class="wikitable sortable"
|-
! IOCTL # !! Name !! Notes
|-
| 0x8030B001 || DEVPFSCTL_FORMAT || -
|-
| 0xC0E0B006 || DEVPFSCTL_GETFSSTAT || -
|-
| 0xC040B008 || DEVPFSCTL_MOUNT || -
|-
| 0xC038B009 || DEVPFSCTL_UNMOUNT || -
|-
| 0xC028B00A || DEVPFSCTL_GETEVENT || -
|-
| 0xC030B00B || DEVPFSCTL_EVENTCOMP || -
|-
| 0xC020B00C || DEVPFSCTL_CANCELEVENT || -
|-
| 0xC020B00D || DEVPFSCTL_REGEVENT || -
|-
| 0xC020B00E || DEVPFSCTL_DEREGEVENT || -
|-
| 0x8004B00F || DEVPFSCTL_SYSPOWEREVENT || -
|-
| 0xC008B074 || DEVPFSCTL_FSCK || -
|}

== PFS Manager ==

PFS Manager (/dev/pfsmgr) is used by [[SceShellCore]]. It handles trophy related tasks, savedata, and keystone verification. Below are known commands.

{| class="wikitable sortable"
|-
! IOCTL # !! Name !! Notes
|-
| 0xC1185001 || - || -
|-
| 0xC1185002 || - || -
|-
| 0xC1185003 || - || -
|-
| 0xC4085004 || - || -
|-
| 0x40845301 || - || - trophy related
|-
| 0xC0845302 || - || - savedata related
|-
| 0x40845303 || - || - savedata related
|-
| 0xC0845304 || - || - ???
|-
| 0xC0845305 || - || - ???
|-
| 0xC0A84B01 || - || - ???
|-
| 0xC0A84B02 || PFSMGR_VERIFY_KEYSTONE || -
|}

== PUP Updater ==

The /dev/pup_update0 device is used to perform firmware updates.

{| class="wikitable sortable"
|-
! IOCTL # !! Name !! Notes
|-
| 0xC0104401 || PUP_UPDATER_VERIFY_BLS_HEADER || -
|-
| 0xC0184402 || PUP_UPDATER_DECRYPT_HEADER || -
|-
| 0xC0184403 || PUP_UPDATER_VERIFY_ADDITIONAL_SIGN || -
|-
| 0xC0184404 || PUP_UPDATER_VERIFY_WATERMARK || -
|-
| 0xC0184405 || PUP_UPDATER_DECRYPT_SEGMENT || -
|-
| 0xC0284406 || PUP_UPDATER_DECRYPT_SEGMENT_BLOCK || -
|-
| 0x20004407 || PUP_UPDATER_UPDATE_SNVS || -
|-
| 0xC0104408 || PUP_UPDATER_GEN_CHALLENGE || -
|-
| 0xC018440A || PUP_UPDATER_READ_NAND_GROUP || -
|-
| 0xC018440B || PUP_UPDATER_WRITE_NAND_GROUP || -
|-
| 0xC010440C || PUP_UPDATER_IDENTIFY_NAND_CONTROLLER || -
|-
| 0xC004440D || PUP_UPDATER_IS_FW_OPERATIONAL || -
|-
| 0xC010440E || PUP_UPDATER_FLOYD_UPDATE_FW || -
|-
| 0xC001440F || PUP_UPDATER_GET_XTS_KEY_NUM || -
|-
| 0xC0104410 || PUP_UPDATER_VERIFY_RESPONSE || -
|}

== Root Param ==

Root Param is used by [[SceShellCore]] to verify root PARAM.SFO files (for PS4) or JSON files (for PS5, aka PPR for ProsPeRo). Below are known commands.

{| class="wikitable sortable"
|-
! IOCTL # !! Name !! Notes
|-
| 0xC0305201 || ROOTPARAM_VERIFY_PS4_ROOT_PARAM || -
|-
| 0xC0305202 || ROOTPARAM_VERIFY_PPR_ROOT_PARAM || -
|-
| 0xC0305203 || ROOTPARAM_RESUME_FROM_STANDBY || -
|}

== CAM Transport Layer ==

CAM (Common Access Method) storage subsystem provides a method for implementing drivers to control various known storage devices.
Attaches any devices it finds to the appropriate drivers.

{| class="wikitable sortable"
|-
! IOCTL # !! Name !! Notes
|-
| 0xC4E01902 || - || related to cam_send_ccb
|-
| 0xC4E01903 || CAMGETPASSTHRU || related to cam_lookup_pass
|}

== Wireless LAN and Bluetooth ==

WLAN and Bluetooth functionality is reachable via /dev/wlanbt. Below are known commands.

{| class="wikitable sortable"
|-
! IOCTL # !! Name !! Notes
|-
| 0x40047400 || WLANBT_GET_DEVICE_ID || -
|}