Devices: Difference between revisions

From PS5 Developer wiki
Jump to navigation Jump to search
(Add a few various ioctls)
No edit summary
 
(16 intermediate revisions by 4 users not shown)
Line 1: Line 1:
The PS5 has many kernel devices that can be accessed through [[IOCTL]]. Some of them have usermode module equivalents, some like "sbl" consist in [[Secure Modules]] and some like "camera" make use of a dedicated firmware stored in kernel memory.
See also [https://psdevwiki.com/ps4/Devices PS4 devices].
Note for ioctls: * indicates name is assumed from RE and may not be accurate.
Note for ioctls: * indicates name is assumed from RE and may not be accurate.


== Device Listing ==
== Device Listing ==
Note: only unique devices are listed. Benign devices like /dev/null are omitted for brevity's sake.
 
Unique devices are listed here without the "/dev/" prefix for readability. Benign devices like /dev/null are omitted for brevity's sake.


{| class="wikitable sortable"
{| class="wikitable sortable"
|-
|-
! Path !! Device Name !! Notes
! Device Path !! Device Long Name !! Notes
|-
|-
| /dev/a53{io,mm,mmsys} || A53 Input/Output, Memory Management (sys) || See MP4 section
| a53{io,mm,mmsys} || A53 Input/Output, Memory Management (sys) || See MP4 section
|-
|-
| /dev/ajm{i} || Audio Job Manager || -
| ajm{i} || Audio Job Manager || -
|-
|-
| /dev/auditpipe || - || -
| auditpipe || Audit Pipe || -
|-
|-
| /dev/authmgr || Authentication Manager || -
| authmgr || Authentication Manager || -
|-
|-
| /dev/az{1,ctl} || - || Audio-related
| az{1,ctl} || - || Audio-related
|-
|-
| /dev/bar || Backup and Restore || Used by shellcore for backup and recovery
| bar || [[Backup And Restore]] || Used by shellcore for backup and recovery
|-
|-
| /dev/bfs/ctl || - || -
| bfs/ctl || - || -
|-
|-
| /dev/bluetooth_hid || - || -
| bluetooth_hid || Bluetooth Human Interface Device || -
|-
|-
| /dev/bt || - || -
| bt || Bluetooth || -
|-
|-
| /dev/camera || Camera || -
| camera || Camera || -
|-
|-
| /dev/cloudsd || Cloud SaveData || -
| cloudsd || Cloud SaveData || -
|-
|-
| /dev/console || Console || Usermode logging
| console || Console || Usermode logging
|-
|-
| /dev/crepo || Crash Report || Used for crash reporting service (coredump, gpudump, shellcore)
| crepo || Crash Report || Used for crash reporting service (coredump, gpudump, shellcore)
|-
|-
| /dev/ctrlp{_sync} || - || Used by libScePad (controller)
| ctrlp{_sync} || -CTRLP || Used by libScePad (controller). See PS4 and PS Vita ctrlp modules.
|-
|-
| /dev/dbggc{_control} || Debug GPU? || -
| dbggc{_control} || Debug GPU? || -
|-
|-
| /dev/deci_coredump || Debug Com. Interface (DECI) coredump || -
| deci_coredump || [[DECI5]] coredump || -
|-
|-
| /dev/deci_mp4_ioc || DECI I/O Control? || -
| deci_mp4_ioc || [[DECI5]] MP4 ?I/O Control? || -
|-
|-
| /dev/deci_mp4_mmc || - || -
| deci_mp4_mmc || [[DECI5]] MP4 ?MM Control? || -
|-
|-
| /dev/deci_std{in,out,err} || DECI Input/Output/Error || -
| deci_std{in,out,err} || [[DECI5]] Input/Output/Error || -
|-
|-
| /dev/deci_tty* || DECI Terminals || -
| deci_tty* || [[DECI5]] Terminals || -
|-
|-
| /dev/devctl || - || -
| devctl || Dev Control || -
|-
|-
| /dev/diag || - || -
| diag || Diagnosis || -
|-
|-
| /dev/dipsw || Dip Switch || -
| dipsw || [[DIP Switches]] || -
|-
|-
| /dev/dldbg || Dynamic Library Debug || -
| dldbg || Dynamic Library Debug || -
|-
|-
| /dev/dmem{0,1,2} || - || -
| dmem{0,1,2} || - || -
|-
|-
| /dev/dngl || - || -
| dngl || - || -
|-
|-
| /dev/duid || Disc Unique ID || -
| duid || Disc Unique ID || -
|-
|-
| /dev/encdec || EncDec || -
| encdec || Encrypt Decrypt || Related to Portability Keys.
|-
|-
| /dev/envelope || Envelope Format Crypto || -
| envelope || [[Envelope Files]] || Related to Envelope Files Keys.
|-
|-
| /dev/evlg{0,1} || Event Log || Intended to be used with read syscall  
| evlg{0,1} || Event Log || Intended to be used with read syscall  
|-
|-
| /dev/exthdd || External HDD || -
| exthdd || External HDD || -
|-
|-
| /dev/fcram || - || -
| fcram || - || -
|-
|-
| /dev/fsctrl || - || -
| fsctrl || FileSystem Control || -
|-
|-
| /dev/fttrm || - || Used by bluray app
| fttrm || ?Film and Television Tracking? Rights Management || Used by bluray app
|-
|-
| /dev/gbase || - || -
| gbase || - || -
|-
|-
| /dev/gc || GPU command || -
| gc || GPU command || -
|-
|-
| /dev/geom.ctl || - || -
| geom.ctl || - || -
|-
|-
| /dev/gic || - || -
| gic || - || -
|-
|-
| /dev/gsched_bds.ctl || - || -
| gsched_bds.ctl || - || -
|-
|-
| /dev/hdmi || HDMI || -
| hdmi || HDMI || -
|-
|-
| /dev/hid || - || -
| hid || Human Interface Device || -
|-
|-
| /dev/hmd2_* || VR 2? || -
| hmd2_* || Head-mounted Display || For PS VR 2.
|-
|-
| /dev/hmd_* || VR || -
| hmd_* || Head-mounted Display || For PS VR first revision.
|-
|-
| /dev/iccnvs{0,1,2,4,6} || ICC_NVS (sectors) || Location of Sectors 0, 1, 2, 4 and 6 of sflash0 non volatile storage
| iccnvs{0,1,2,4,6} || ICC NVS || Specific access to Sectors 0, 1, 2, 4 and 6 of [[Serial Flash]] [[Non Volatile Storage]]
|-
|-
| /dev/icc_configuration || ICC Config || -
| icc_configuration || ICC Configuration || -
|-
|-
| /dev/icc_crash_report || ICC Crash Report || -
| icc_crash_report || ICC Crash Report || -
|-
|-
| /dev/icc_device_power || ICC Device Power || -
| icc_device_power || ICC Device Power || -
|-
|-
| /dev/icc_fan || ICC Fan || -
| icc_fan || ICC Fan || -
|-
|-
| /dev/icc_floyd || ICC TPM? || SNVS Storage Device
| icc_floyd || ICC Floyd || SNVS Storage Device. ?TPM related?
|-
|-
| /dev/icc_indicator || ICC LED || -
| icc_indicator || ICC Indicator || Control the LEDs.
|-
|-
| /dev/icc_nvs || ICC NVS || -
| icc_nvs || ICC NVS || ?Global access to [[Serial Flash]] [[Non Volatile Storage]] like on PS4?
|-
|-
| /dev/icc_power || ICC Power || -
| icc_power || ICC Power || -
|-
|-
| /dev/icc_sc_config || ICC Syscon? Config || -
| icc_sc_config || ICC ?Syscon? Configuration || -
|-
|-
| /dev/icc_thermal || ICC Thermal || -
| icc_thermal || ICC Thermal || -
|-
|-
| /dev/klog || Kernel Log || Read syscall on this device can be used to get kernel log if privileged
| klog || Kernel Log || Read syscall on this device can be used to get kernel log if privileged
|-
|-
| /dev/kmbp || - || -
| kmbp || - || -
|-
|-
| /dev/lvdctl || Layered Vnode Device Control || -
| lvdctl || Layered Vnode Device Control || -
|-
|-
| /dev/lvd{0,1} || Layered Vnode Device || -
| lvd{0,1} || Layered Vnode Device || lv0 is a mountpoint for /mnt/rnps. lvd1 is a mountpoint for /mnt/sandbox/download/NPXS40140. See [[Filesystem]].
|-
|-
| /dev/m2.ctl || m.2 NVMe Control? || -
| cd0 || Compact Disc 0 || cd0 is a mountpoint for /mnt/disc. See [[Filesystem]].
|-
|-
| /dev/manuauth || Manufacturer Auth|| -
| m2.ctl || [[M.2 SSD]] ?Control? || -
|-
|-
| /dev/mbus || Event bus || -
| manuauth || Manufacturer Auth || -
|-
|-
| /dev/mbus_av || Event bus (audio video?) || -
| mbus || ?Media/Memory/Management? Bus || Event bus
|-
|-
| /dev/md0 || Kernel Md0 || Main System modules are located here for Kernel (Not System Modules!)
| mbus_av || ?Media/Memory/Management? Bus (?audio video?) || Event bus maybe for audio/video.
|-
|-
| /dev/md2 || - || -
| md0 || ?Mount Directory? 0 || Main System modules/devices are located here for Kernel
|-
|-
| /dev/mdctl || - || -
| md2 || ?Mount Directory? 2 || md2 is a mountpoint for /system_data/eap/rodata. See [[Filesystem]].
|-
|-
| /dev/metadbg || - || -
| mdctl || ?Mount Directory? Control || -
|-
|-
| /dev/mp1 || System Management Unit (SMU) || Power management, thermals, etc. (see mp1 section)
| da1s1 || DA 1 Sector 1 || da1s1 is a mountpoint for /mnt/usb0. See [[Filesystem]].
|-
|-
| /dev/mp3 || Trusted Execution Environment (TEE) || See mp3 section
| metadbg || Meta Debug || -
|-
|-
| /dev/mp4/dump{_for_decid} || A53 (mdbg?) || See mp4 section
| mp1 || System Management Unit (SMU) || Power management, thermals, etc. See MP1 section.
|-
|-
| /dev/notification{0-9} || Notification || -
| mp3 || Trusted Execution Environment (TEE) || See MP3 section.
|-
|-
| /dev/npdrm || Network Product Digital Rights Management interface || -
| mp4/dump{_for_decid} || A53 (mdbg?) || See MP4 section.
|-
|-
| /dev/nsfsctl || Namespace Filesystem (NSFS) Control || -
| notification{0-9} || Notification || -
|-
|-
| /dev/nsid1.ctl || - || -
| npdrm || Network Product Digital Rights Management interface || -
|-
|-
| /dev/otpaccess || One-Time Programmable Access? || -
| nsfsctl || Namespace Filesystem (NSFS) Control || -
|-
|-
| /dev/pfsctldev || Playstation Filesystem (PFS) Control || -
| nsid1.ctl || Namespace ID 1 Control || -
|-
|-
| /dev/pfsmgr || PFS Manager || Used for trophies, savegames, keystone
| otpaccess || One-Time Programmable Access? || -
|-
|-
| /dev/playgo_emu_param{1,2,3} || PlayGo emulator params || -
| pfsctldev || PFS Control Device || -
|-
|-
| /dev/pltauth{0,1} || Platform Authentication (PSN) || -
| pfsmgr || PFS Manager || Used for [[Trophy]], [[Save Data]], [[Keystone]]
|-
|-
| /dev/pup_update0 || PUP Update || -
| playgo_emu_param{1,2,3} || [[PlayGo]] emulator params || -
|-
|-
| /dev/qafutkn || QA flag / Utoken || -
| pltauth{0,1} || Platform Authentication || For PSN connection.
|-
|-
| /dev/rnps || React Native PS || PSN related
| pup_update0 || PUP Update || -
|-
|-
| /dev/rootparam || Root Param || Used by shellcore for verifying root param sfo/json
| qafutkn || QA flag / Utoken || -
|-
|-
| /dev/s3da || 3D Audio || -
| rnps || React Native PS || [[RNPS]] regroups many PSN services (friends, party, events, etc.)
|-
|-
| /dev/sbl_secreg || SBL Secure Region || -
| rootparam || Root Param || Used by [[SceShellCore]] for verifying root param SFO/JSON
|-
|-
| /dev/sbl_srv || SBL Service || Used exclusively by playready
| s3da || ?System/Software? 3D Acceleration || See Marcan's slides about PS4 GPU Linux driver.
|-
|-
| /dev/scanin || - || -
| sbl_secreg || SBL Secure Region/Registry || -
|-
|-
| /dev/sce_zlib{_sys} || zlib || zlib (de)compression
| sbl_srv || SBL Service || Used exclusively by playready
|-
|-
| /dev/sc_fw_update0 || (syscon?) firmware update || -
| scanin || - || -
|-
|-
| /dev/sflash0 || SPI flash || 2MB. Has EMC firmware and (non-secure) NVS.
| sce_zlib{_sys} || zlib || zlib (de)compression
|-
|-
| /dev/srtc || Secure Real Time Clock || -
| sc_fw_update0 || ?syscon? firmware update || -
|-
|-
| /dev/ssd0.* || Internal SSD partitions || -
| sflash0 || [[Serial Flash]] || 2MB. Contains [[EMC]] firmware and (non-secure) NVS.
|-
|-
| /dev/sshot || Screenshot || -
| sflash0s0 || [[Serial Flash]] Sector 0 ||  
|-
|-
| /dev/transactionid.ctl || - || -
| sflash0s0x0 || [[Serial Flash]] Sector 0 Block 0 ||  
|-
|-
| /dev/ufssuspend || - || -
| sflash0s0x34 || [[Serial Flash]] Sector 0 Block 34 || Serial Flash [[Non Volatile Storage]]
|-
|-
| /dev/usbctl || USB control || -
| sflash0s0x32 || [[Serial Flash]] Sector 0 Block 32 || To be confirmed.
|-
|-
| /dev/uvd_{dec/enc/bgt} || Unified Video Decoder? || -
| sflash0s0x32b || [[Serial Flash]] Sector 0 Block 32 bis ||  
|-
|-
| /dev/wlanbt || Wireless LAN + Bluetooth || -
| sflash0s0x41b || [[Serial Flash]] Sector 0 Block 41 || To be confirmed.
|-
|-
| /dev/xpt0 || XPT Transport Interface || CAM Transport Layer
| sflash0s0x41b || [[Serial Flash]] Sector 0 Block 41 bis ||
|-
| sflash0s1 || [[Serial Flash]] Sector 1 || To be confirmed.
|-
| sflash0s1.crypt || [[Serial Flash]] Sector 1 encrypted || To be confirmed.
|-
| sflash0s1.cryptx40 || [[Serial Flash]] Sector 1 encrypted Block 40 ||
|-
| srtc || Secure Real Time Clock || -
|-
| ssd0.* || Solid State Drive 0 || Mountpoints for many internal SSD partitions. See [[Filesystem]].
|-
| sshot || Screenshot || -
|-
| transactionid.ctl || Transaction ID Control || -
|-
| ufssuspend || UFS Suspend || -
|-
| usbctl || USB Control || -
|-
| uvd_{dec/enc/bgt} || ?Unified Video Decoder? || Maybe related to gameplay recording.
|-
| wlanbt || Wireless LAN + Bluetooth || -
|-
| xpt0 || XPT Transport Interface || CAM Transport Layer
|}
|}


== Platform Security Processor Core (PSP) (MP0) ==
== Platform Security Processor Core (PSP) (MP0) ==


* All the fun things are here
* See also the [[AMD Platform Security Processor]] wiki page.
* Named SMU PSP as well
* All the fun things related to PS5 security are here.
* Named ASP as well (AMD Secure Processor)
* Named AMD SMU PSP (AMD System Management Unit Platform Security Processor) and ASP (AMD Secure Processor) as well.


== System Management Unit (SMU) (MP1) ==
== System Management Unit (SMU) (MP1) ==
MP1 (System Management Unit or "SMU") is an xtensa CPU responsible for power management, clock management, sampling sensor data, and other power/thermal-related tasks. The /dev/mp1 device can be used to issue commands to it. Below are known commands.
MP1 (System Management Unit or "SMU") is an xtensa CPU responsible for power management, clock management, sampling sensor data, and other power/thermal-related tasks. The /dev/mp1 device can be used to issue commands to it. Below are known commands.


Line 231: Line 261:
== Sensor Fusion Processor (SFP) (MP2) ==
== Sensor Fusion Processor (SFP) (MP2) ==


* doesn't exist on ps5
* It does not exist on PS5 as it is mainly for mobiles.
* mainly for mobiles


== Trusted Execution Environment (TEE) (MP3) ==
== Trusted Execution Environment (TEE) (MP3) ==
MP3 consists of the Trusted Execution Environment (TEE) running on the AMD Platform Security Processor (PSP/SP). Its primary function is Digital Rights Management (DRM) via [https://www.microsoft.com/playready/features/EnhancedContentProtection.aspx PlayReady SL3000]. In userspace, the libSceTEEClient library is used for interfacing with it, which internally uses /dev/mp3 to load secure binaries (sbins) and establish sessions. Below are known commands.
 
MP3 consists of the Trusted Execution Environment (TEE) running on the [[AMD Platform Security Processor]]. Its primary function is Digital Rights Management (DRM) via [https://www.microsoft.com/playready/features/EnhancedContentProtection.aspx PlayReady SL3000]. In usermode, the libSceTEEClient library is used for interfacing with it, which internally uses /dev/mp3 to load secure binaries (sbins) and establish sessions. Below are known commands.


{| class="wikitable sortable"
{| class="wikitable sortable"
|-
|-
! IOCTL # !! Name !! Notes
! IOCTL # !! Name !! Notes
|-
|0x400CB400
|TEE_IOC_VERSION
| -
|-
|-
| 0xC010B403 || TEE_IOC_INVOKE || Invoke commands
| 0xC010B403 || TEE_IOC_INVOKE || Invoke commands
|-
|0xC010B402
|TEE_IOC_OPEN_SESSION
| -
|-
|0xC008B404
|TEE_IOC_CANCEL
| -
|-
|-
| 0xC010B408 || TEE_IOC_DLM_GET_DEBUG_TOKEN || -
| 0xC010B408 || TEE_IOC_DLM_GET_DEBUG_TOKEN || -
Line 261: Line 303:


== A53MM/A53IO (MP4) ==
== A53MM/A53IO (MP4) ==
MP4, which consists of /dev/a53mm, /dev/a53mmsys, and /dev/a53io, is used for various tasks, and its overall purpose is not fully understood. Some of the things it includes are debugging (mdbg), video encode/decode, and other various memory-management related things. Below are known commands.
MP4, which consists of /dev/a53mm, /dev/a53mmsys, and /dev/a53io, is used for various tasks, and its overall purpose is not fully understood. Some of the things it includes are debugging (mdbg), video encode/decode, and other various memory-management related things. Below are known commands.


Line 334: Line 377:
! IOCTL # !! Name !! Notes
! IOCTL # !! Name !! Notes
|-
|-
| 0x80046101 || ???? || Used for opening NAND and SCF FW formatting
| 0x80046101 || NAND_A53IO_OPEN || Exposes NAND groups for reading
|-
| 0x80046102 || NAND_A53IO_CLOSE || Closes off NAND groups
|-
| 0x80046103 || NAND_A53IO_SETUP_FLASH_DEVICE || -
|-
| 0x80046104 || NAND_A53IO_DISABLE_CONTROLLER || Disables A53 controller (warning: this will put the console in a bad state)
|-
|-
| 0x80046105 || ???? || Maybe used for M.2 formatting
| 0x80046105 || NAND_A53IO_FORMAT_NVM || Formats NVMe
|-
|-
| 0x80186111 || BFS_A53IO_READ_DEVICE? || -
| 0x80186111 || BFS_A53IO_READ_DEVICE? || -
|-
|-
| 0x80404702 || ???? || -
| 0xC03861A1 || BFS_A53IO_READ_BLOCK || -
|-
| 0xC03861A2 || BFS_A53IO_WRITE_BLOCK || -
|-
| 0xC01061C1 || BFS_A53IO_CREATE_RESERVED_LBA || -
|-
| 0xC01061C2 || BFS_A53IO_DELETE_RESERVED_LBA || -
|-
| 0xC00C61C5 || ???? || Related to delete logical partitions
|-
|-
| 0xC03861A1 || BFS_A53IO_READ_BLOCK || -
| 0xC01061C8 || ???? || Related to delete logical partitions
|-
|-
| 0xC03861A2 || ???? || Seems multifunctional
| 0xC02061CA || ???? || Related to delete logical partitions
|}
|}


== Backup and Restore ==
== Backup and Restore ==
Backup and Restore (BAR) is used by shellcore via /dev/bar. Below are known commands.
 
Backup and Restore (BAR) is used by [[SceShellCore]] via /dev/bar. Below are known commands.


{| class="wikitable sortable"
{| class="wikitable sortable"
Line 372: Line 430:


== Disc UID ==
== Disc UID ==
Disc UID (/dev/duid) has its own library (libSceDiscId). It's unknown what this is used for at present. It has 2 known ioctls.
 
Disc UID (/dev/duid) has its own library (libSceDiscId). It's unknown what this is used for at present. It has two known [[IOCTL]]s.


{| class="wikitable sortable"
{| class="wikitable sortable"
Line 384: Line 443:


== Dynamic Library Debug ==
== Dynamic Library Debug ==
Dynamic Lib Debug (/dev/dldbg) is used by the library for debugging syscore. Given the name, it's likely used for debugging sprx libs. Below are known commands.
Dynamic Lib Debug (/dev/dldbg) is used by the library for debugging syscore. Given the name, it's likely used for debugging sprx libs. Below are known commands.


Line 399: Line 459:


== FTTRM ==
== FTTRM ==
FTTRM's full purpose is unknown, but it's likely DRM-related. It's used by the Bluray app (BdmvPlayerCore, BdvdPlayerCore, UHDBdPlayerCore) via /dev/fttrm. There are only 2 known commands.
 
FTTRM's full purpose is unknown, but it is likely DRM-related. It is used by the Bluray application (BdmvPlayerCore, BdvdPlayerCore, UHDBdPlayerCore) via /dev/fttrm. There are only two known commands. RM stands for Rights Management and FT may stand for FilmTrack or Film and Television Tracking. See [https://info.filmtrack.com/the-critical-role-of-security-in-entertainment-rights-management].


{| class="wikitable sortable"
{| class="wikitable sortable"
Line 411: Line 472:


== ICC Floyd (TPM) ==
== ICC Floyd (TPM) ==
The /dev/icc_floyd is for interacting with the floyd Trusted Platform Module (TPM) over ICC. It only has one known command.
The /dev/icc_floyd is for interacting with the floyd Trusted Platform Module (TPM) over ICC. It only has one known command.


Line 420: Line 482:
|-
|-
| 0xC010440E || FLOYD_UPDATE_FW || -
| 0xC010440E || FLOYD_UPDATE_FW || -
|
|-
|}
|}


== Manufacturer Authorization ==
== Manufacturer Authorization ==
The /dev/manuauth device seems to be for manufacturer authorization or authentication. It's used in various updaters. Below are known commands.
 
The /dev/manuauth device seems to be for manufacturer authorization or authentication. It is used in various updaters. Below are known commands.


{| class="wikitable sortable"
{| class="wikitable sortable"
Line 435: Line 498:
|-
|-
| 0xC0184D03 || MANUAUTH_SET_MANU_MODE || Sets manufacturer mode
| 0xC0184D03 || MANUAUTH_SET_MANU_MODE || Sets manufacturer mode
|
|-
|}
|}


== Namespace Filesystem Control ==
== Namespace Filesystem Control ==
The Namespace Filesystem (NSFS) is used by Virtual Shell (Vsh) and shellcore. It's critical to processes running on the system. Below are known commands.
 
The Namespace Filesystem (NSFS) is used by Virtual Shell (Vsh) and [[SceShellCore]]. It is critical to processes running on the system. Below are known commands.


{| class="wikitable sortable"
{| class="wikitable sortable"
Line 457: Line 521:


== PFS Control ==
== PFS Control ==
Playstation Filesystem (PFS) Control and /dev/pfsctldev is used internally for VSH. Below are known commands.
 
Playstation FileSystem (PFS) Control and /dev/pfsctldev is used internally for VSH. Below are known commands.


{| class="wikitable sortable"
{| class="wikitable sortable"
Line 487: Line 552:


== PFS Manager ==
== PFS Manager ==
PFS Manager (/dev/pfsmgr) is used by shellcore. It handles trophy related tasks, savedata, and keystone verification. Below are known commands.
 
PFS Manager (/dev/pfsmgr) is used by [[SceShellCore]]. It handles trophy related tasks, savedata, and keystone verification. Below are known commands.


{| class="wikitable sortable"
{| class="wikitable sortable"
Line 514: Line 580:
|-
|-
| 0xC0A84B02 || PFSMGR_VERIFY_KEYSTONE || -
| 0xC0A84B02 || PFSMGR_VERIFY_KEYSTONE || -
|}
== PUP Updater ==
The /dev/pup_update0 device is used to perform firmware updates.
{| class="wikitable sortable"
|-
! IOCTL # !! Name !! Notes
|-
| 0xC0104401 || PUP_UPDATER_VERIFY_BLS_HEADER || -
|-
| 0xC0184402 || PUP_UPDATER_DECRYPT_HEADER || -
|-
| 0xC0184403 || PUP_UPDATER_VERIFY_ADDITIONAL_SIGN || -
|-
| 0xC0184404 || PUP_UPDATER_VERIFY_WATERMARK || -
|-
| 0xC0184405 || PUP_UPDATER_DECRYPT_SEGMENT || -
|-
| 0xC0284406 || PUP_UPDATER_DECRYPT_SEGMENT_BLOCK || -
|-
| 0x20004407 || PUP_UPDATER_UPDATE_SNVS || -
|-
| 0xC0104408 || PUP_UPDATER_GEN_CHALLENGE || -
|-
| 0xC018440A || PUP_UPDATER_READ_NAND_GROUP || -
|-
| 0xC018440B || PUP_UPDATER_WRITE_NAND_GROUP || -
|-
| 0xC010440C || PUP_UPDATER_IDENTIFY_NAND_CONTROLLER || -
|-
| 0xC004440D || PUP_UPDATER_IS_FW_OPERATIONAL || -
|-
| 0xC010440E || PUP_UPDATER_FLOYD_UPDATE_FW || -
|-
| 0xC001440F || PUP_UPDATER_GET_XTS_KEY_NUM || -
|-
| 0xC0104410 || PUP_UPDATER_VERIFY_RESPONSE || -
|}
|}


== Root Param ==
== Root Param ==
Root Param is used by shellcore to verify root param sfos (for PS4) or jsons (for PS5, aka PPR for ProsPeRo). Below are known commands.
 
Root Param is used by [[SceShellCore]] to verify root PARAM.SFO files (for PS4) or JSON files (for PS5, aka PPR for ProsPeRo). Below are known commands.


{| class="wikitable sortable"
{| class="wikitable sortable"
Line 531: Line 637:


== CAM Transport Layer ==
== CAM Transport Layer ==
CAM (Common Access Method) storage subsystem provides a method for implementing drivers to control various known storage devices.
CAM (Common Access Method) storage subsystem provides a method for implementing drivers to control various known storage devices.
Attaches any devices it finds to the appropriate drivers.
Attaches any devices it finds to the appropriate drivers.
Line 543: Line 650:
|}
|}


== Wireless LAN + Bluetooth ==
== Wireless LAN and Bluetooth ==
 
WLAN and Bluetooth functionality is reachable via /dev/wlanbt. Below are known commands.
WLAN and Bluetooth functionality is reachable via /dev/wlanbt. Below are known commands.


Latest revision as of 00:47, 30 December 2024

The PS5 has many kernel devices that can be accessed through IOCTL. Some of them have usermode module equivalents, some like "sbl" consist in Secure Modules and some like "camera" make use of a dedicated firmware stored in kernel memory.

See also PS4 devices.

Note for ioctls: * indicates name is assumed from RE and may not be accurate.

Device Listing[edit | edit source]

Unique devices are listed here without the "/dev/" prefix for readability. Benign devices like /dev/null are omitted for brevity's sake.

Device Path Device Long Name Notes
a53{io,mm,mmsys} A53 Input/Output, Memory Management (sys) See MP4 section
ajm{i} Audio Job Manager -
auditpipe Audit Pipe -
authmgr Authentication Manager -
az{1,ctl} - Audio-related
bar Backup And Restore Used by shellcore for backup and recovery
bfs/ctl - -
bluetooth_hid Bluetooth Human Interface Device -
bt Bluetooth -
camera Camera -
cloudsd Cloud SaveData -
console Console Usermode logging
crepo Crash Report Used for crash reporting service (coredump, gpudump, shellcore)
ctrlp{_sync} -CTRLP Used by libScePad (controller). See PS4 and PS Vita ctrlp modules.
dbggc{_control} Debug GPU? -
deci_coredump DECI5 coredump -
deci_mp4_ioc DECI5 MP4 ?I/O Control? -
deci_mp4_mmc DECI5 MP4 ?MM Control? -
deci_std{in,out,err} DECI5 Input/Output/Error -
deci_tty* DECI5 Terminals -
devctl Dev Control -
diag Diagnosis -
dipsw DIP Switches -
dldbg Dynamic Library Debug -
dmem{0,1,2} - -
dngl - -
duid Disc Unique ID -
encdec Encrypt Decrypt Related to Portability Keys.
envelope Envelope Files Related to Envelope Files Keys.
evlg{0,1} Event Log Intended to be used with read syscall
exthdd External HDD -
fcram - -
fsctrl FileSystem Control -
fttrm ?Film and Television Tracking? Rights Management Used by bluray app
gbase - -
gc GPU command -
geom.ctl - -
gic - -
gsched_bds.ctl - -
hdmi HDMI -
hid Human Interface Device -
hmd2_* Head-mounted Display For PS VR 2.
hmd_* Head-mounted Display For PS VR first revision.
iccnvs{0,1,2,4,6} ICC NVS Specific access to Sectors 0, 1, 2, 4 and 6 of Serial Flash Non Volatile Storage
icc_configuration ICC Configuration -
icc_crash_report ICC Crash Report -
icc_device_power ICC Device Power -
icc_fan ICC Fan -
icc_floyd ICC Floyd SNVS Storage Device. ?TPM related?
icc_indicator ICC Indicator Control the LEDs.
icc_nvs ICC NVS ?Global access to Serial Flash Non Volatile Storage like on PS4?
icc_power ICC Power -
icc_sc_config ICC ?Syscon? Configuration -
icc_thermal ICC Thermal -
klog Kernel Log Read syscall on this device can be used to get kernel log if privileged
kmbp - -
lvdctl Layered Vnode Device Control -
lvd{0,1} Layered Vnode Device lv0 is a mountpoint for /mnt/rnps. lvd1 is a mountpoint for /mnt/sandbox/download/NPXS40140. See Filesystem.
cd0 Compact Disc 0 cd0 is a mountpoint for /mnt/disc. See Filesystem.
m2.ctl M.2 SSD ?Control? -
manuauth Manufacturer Auth -
mbus ?Media/Memory/Management? Bus Event bus
mbus_av ?Media/Memory/Management? Bus (?audio video?) Event bus maybe for audio/video.
md0 ?Mount Directory? 0 Main System modules/devices are located here for Kernel
md2 ?Mount Directory? 2 md2 is a mountpoint for /system_data/eap/rodata. See Filesystem.
mdctl ?Mount Directory? Control -
da1s1 DA 1 Sector 1 da1s1 is a mountpoint for /mnt/usb0. See Filesystem.
metadbg Meta Debug -
mp1 System Management Unit (SMU) Power management, thermals, etc. See MP1 section.
mp3 Trusted Execution Environment (TEE) See MP3 section.
mp4/dump{_for_decid} A53 (mdbg?) See MP4 section.
notification{0-9} Notification -
npdrm Network Product Digital Rights Management interface -
nsfsctl Namespace Filesystem (NSFS) Control -
nsid1.ctl Namespace ID 1 Control -
otpaccess One-Time Programmable Access? -
pfsctldev PFS Control Device -
pfsmgr PFS Manager Used for Trophy, Save Data, Keystone
playgo_emu_param{1,2,3} PlayGo emulator params -
pltauth{0,1} Platform Authentication For PSN connection.
pup_update0 PUP Update -
qafutkn QA flag / Utoken -
rnps React Native PS RNPS regroups many PSN services (friends, party, events, etc.)
rootparam Root Param Used by SceShellCore for verifying root param SFO/JSON
s3da ?System/Software? 3D Acceleration See Marcan's slides about PS4 GPU Linux driver.
sbl_secreg SBL Secure Region/Registry -
sbl_srv SBL Service Used exclusively by playready
scanin - -
sce_zlib{_sys} zlib zlib (de)compression
sc_fw_update0 ?syscon? firmware update -
sflash0 Serial Flash 2MB. Contains EMC firmware and (non-secure) NVS.
sflash0s0 Serial Flash Sector 0
sflash0s0x0 Serial Flash Sector 0 Block 0
sflash0s0x34 Serial Flash Sector 0 Block 34 Serial Flash Non Volatile Storage
sflash0s0x32 Serial Flash Sector 0 Block 32 To be confirmed.
sflash0s0x32b Serial Flash Sector 0 Block 32 bis
sflash0s0x41b Serial Flash Sector 0 Block 41 To be confirmed.
sflash0s0x41b Serial Flash Sector 0 Block 41 bis
sflash0s1 Serial Flash Sector 1 To be confirmed.
sflash0s1.crypt Serial Flash Sector 1 encrypted To be confirmed.
sflash0s1.cryptx40 Serial Flash Sector 1 encrypted Block 40
srtc Secure Real Time Clock -
ssd0.* Solid State Drive 0 Mountpoints for many internal SSD partitions. See Filesystem.
sshot Screenshot -
transactionid.ctl Transaction ID Control -
ufssuspend UFS Suspend -
usbctl USB Control -
uvd_{dec/enc/bgt} ?Unified Video Decoder? Maybe related to gameplay recording.
wlanbt Wireless LAN + Bluetooth -
xpt0 XPT Transport Interface CAM Transport Layer

Platform Security Processor Core (PSP) (MP0)[edit | edit source]

  • See also the AMD Platform Security Processor wiki page.
  • All the fun things related to PS5 security are here.
  • Named AMD SMU PSP (AMD System Management Unit Platform Security Processor) and ASP (AMD Secure Processor) as well.

System Management Unit (SMU) (MP1)[edit | edit source]

MP1 (System Management Unit or "SMU") is an xtensa CPU responsible for power management, clock management, sampling sensor data, and other power/thermal-related tasks. The /dev/mp1 device can be used to issue commands to it. Below are known commands.

IOCTL # Name Notes
0x4068AE01 MP1_IOCTL_GET_CLK Get clock frequency
0x8004AE17 MP1_IOCTL_SET_GFXCLK Set graphics clock frequency
0xC004AE18 MP1_IOCTL_REQUEST_MODE_SWITCH -
0x8008AE1D MP1_IOCTL_SET_COREPSTATE Set core power state?
0xC00CAE1E MP1_IOCTL_GET_COREPSTATE Get core power state?

Sensor Fusion Processor (SFP) (MP2)[edit | edit source]

  • It does not exist on PS5 as it is mainly for mobiles.

Trusted Execution Environment (TEE) (MP3)[edit | edit source]

MP3 consists of the Trusted Execution Environment (TEE) running on the AMD Platform Security Processor. Its primary function is Digital Rights Management (DRM) via PlayReady SL3000. In usermode, the libSceTEEClient library is used for interfacing with it, which internally uses /dev/mp3 to load secure binaries (sbins) and establish sessions. Below are known commands.

IOCTL # Name Notes
0x400CB400 TEE_IOC_VERSION -
0xC010B403 TEE_IOC_INVOKE Invoke commands
0xC010B402 TEE_IOC_OPEN_SESSION -
0xC008B404 TEE_IOC_CANCEL -
0xC010B408 TEE_IOC_DLM_GET_DEBUG_TOKEN -
0xC028B409 TEE_IOC_DLM_START_TA_DEBUG -
0xC110B40A TEE_IOC_DLM_FETCH_DEBUG_STRING -
0x8008B40B TEE_IOC_DLM_STOP_TA_DEBUG -
0x8008B40B TEE_IOC_INIT_ASD -
0xC038B40C TEE_SHM_REGISTER -
0xC004B40E TEE_SHM_RELEASE -
0xC004B40F TEE_SET_TIMEOUT -

A53MM/A53IO (MP4)[edit | edit source]

MP4, which consists of /dev/a53mm, /dev/a53mmsys, and /dev/a53io, is used for various tasks, and its overall purpose is not fully understood. Some of the things it includes are debugging (mdbg), video encode/decode, and other various memory-management related things. Below are known commands.

a53mm

IOCTL # Name Notes
0xC004AC01 - -
0xC030AC02 A53MM_GIVE_DIRECT_MEM_TO_MAPPER -
0xC030AC03 A53MM_CALL_INDIRECT_BUFFER -
0xC050AC05 A53MM_MAPPER_VIRTUAL_QUERY -
0xC038AC06 A53MM_GET_PARAM * -
0xC018AC07 - -
0xC004AC08 - -
0xC018AC09 - -
0xC010AC0A - -
0xC018AC0B A53MM_MAPPER_QUERY_PA -
0xC004AC0D A53MM_WAIT_COMMAND_BUFFER_COMPLETION -
0xC018AC0E A53MM_INTERNAL_LOCK_UNLOCK_MAPPER_MEMORY -
0xC018AC0F - -
0xC018AC10 A53MM_GET_USAGE_STATS_DATA -
0xC004AC11 A53MM_SET_PAGE_TABLE_POOL_OCCUPANCY_THRESHOLD -
0xC018AC12 A53MM_INTERNAL_TEST_PAGE_MIGRATION -
0xC004AC13 - -

a53mmsys

IOCTL # Name Notes
0xc020b501 A53MMSYS_INTERNAL_LOCK_UNLOCK_MAPPER_MEMORY -
0xc028b502 - -
0xc050b503 - -
0xc010b504 - -
0xc028b505 A53MMSYS_MAPPER_GET_INDIRECT_BUFFER_INFO -
0xc020b506 - -
0xc018b507 - -
0xc018b508 A53MMSYS_DEBUG_MAPPER_QUERY_DMEM_OFFSET -
0xc020b50a - -
0xc010b50b A53MMSYS_DEBUG_GET_AMPR_COUNTER_INFO -

a53io

IOCTL # Name Notes
0x80046101 NAND_A53IO_OPEN Exposes NAND groups for reading
0x80046102 NAND_A53IO_CLOSE Closes off NAND groups
0x80046103 NAND_A53IO_SETUP_FLASH_DEVICE -
0x80046104 NAND_A53IO_DISABLE_CONTROLLER Disables A53 controller (warning: this will put the console in a bad state)
0x80046105 NAND_A53IO_FORMAT_NVM Formats NVMe
0x80186111 BFS_A53IO_READ_DEVICE? -
0xC03861A1 BFS_A53IO_READ_BLOCK -
0xC03861A2 BFS_A53IO_WRITE_BLOCK -
0xC01061C1 BFS_A53IO_CREATE_RESERVED_LBA -
0xC01061C2 BFS_A53IO_DELETE_RESERVED_LBA -
0xC00C61C5 ???? Related to delete logical partitions
0xC01061C8 ???? Related to delete logical partitions
0xC02061CA ???? Related to delete logical partitions

Backup and Restore[edit | edit source]

Backup and Restore (BAR) is used by SceShellCore via /dev/bar. Below are known commands.

IOCTL # Name Notes
0xC0684201 BAR_CREATE_CONTEXT -
0xC0684202 BAR_DESTROY_CONTEXT * -
0xC0684203 BAR_INIT_CONTEXT -
0xC0684204 BAR_UPDATE_AAD -
0xC0684205 BAR_UPDATE_ENCRYPT -
0xC0684206 BAR_UPDATE_DECRYPT -
0xC0684207 BAR_FINISH_ENCRYPT -
0xC0684208 BAR_FINISH_DECRYPT -

Disc UID[edit | edit source]

Disc UID (/dev/duid) has its own library (libSceDiscId). It's unknown what this is used for at present. It has two known IOCTLs.

IOCTL # Name Notes
0xC0104401 DISC_ID_GET -
0xC0104402 DISC_ID_GET2 -

Dynamic Library Debug[edit | edit source]

Dynamic Lib Debug (/dev/dldbg) is used by the library for debugging syscore. Given the name, it's likely used for debugging sprx libs. Below are known commands.

IOCTL # Name Notes
0x80084401 DLDBG_STOP_ON_DL_LOAD -
0x80084402 DLDBG_NO_STOP_ON_DL_LOAD -
0xC0084403 DLDBG_GET_DL_LOAD_FLAG -

FTTRM[edit | edit source]

FTTRM's full purpose is unknown, but it is likely DRM-related. It is used by the Bluray application (BdmvPlayerCore, BdvdPlayerCore, UHDBdPlayerCore) via /dev/fttrm. There are only two known commands. RM stands for Rights Management and FT may stand for FilmTrack or Film and Television Tracking. See [1].

IOCTL # Name Notes
0xC0185301 FTTRM_READ_SECTOR -
0xC0185302 FTTRM_WRITE_SECTOR -

ICC Floyd (TPM)[edit | edit source]

The /dev/icc_floyd is for interacting with the floyd Trusted Platform Module (TPM) over ICC. It only has one known command.

IOCTL # Name Notes
0x400EB701 ICC_FLOYD_GET_VERSION -
0xC010440E FLOYD_UPDATE_FW -

Manufacturer Authorization[edit | edit source]

The /dev/manuauth device seems to be for manufacturer authorization or authentication. It is used in various updaters. Below are known commands.

IOCTL # Name Notes
0x40184D01 MANUAUTH_LOAD_SM Loads the secure module
0x40184D02 MANUAUTH_UNLOAD_SM Unloads the secure module
0xC0184D03 MANUAUTH_SET_MANU_MODE Sets manufacturer mode

Namespace Filesystem Control[edit | edit source]

The Namespace Filesystem (NSFS) is used by Virtual Shell (Vsh) and SceShellCore. It is critical to processes running on the system. Below are known commands.

IOCTL # Name Notes
0xC0406E00 NSFS_CREATE_REDIRECT -
0xC0406E01 NSFS_DELETE_REDIRECT -
0xC0186E02 NSFS_GET_REDIRECT_STATS -
0xC0206E03 NSFS_ADD_OVERLAY_TO_NAMESPACE -
0xC0186E04 NSFS_SET_GLOBAL_EXCLUDE -

PFS Control[edit | edit source]

Playstation FileSystem (PFS) Control and /dev/pfsctldev is used internally for VSH. Below are known commands.

IOCTL # Name Notes
0x8030B001 DEVPFSCTL_FORMAT -
0xC0E0B006 DEVPFSCTL_GETFSSTAT -
0xC040B008 DEVPFSCTL_MOUNT -
0xC038B009 DEVPFSCTL_UNMOUNT -
0xC028B00A DEVPFSCTL_GETEVENT -
0xC030B00B DEVPFSCTL_EVENTCOMP -
0xC020B00C DEVPFSCTL_CANCELEVENT -
0xC020B00D DEVPFSCTL_REGEVENT -
0xC020B00E DEVPFSCTL_DEREGEVENT -
0x8004B00F DEVPFSCTL_SYSPOWEREVENT -
0xC008B074 DEVPFSCTL_FSCK -

PFS Manager[edit | edit source]

PFS Manager (/dev/pfsmgr) is used by SceShellCore. It handles trophy related tasks, savedata, and keystone verification. Below are known commands.

IOCTL # Name Notes
0xC1185001 - -
0xC1185002 - -
0xC1185003 - -
0xC4085004 - -
0x40845301 - - trophy related
0xC0845302 - - savedata related
0x40845303 - - savedata related
0xC0845304 - - ???
0xC0845305 - - ???
0xC0A84B01 - - ???
0xC0A84B02 PFSMGR_VERIFY_KEYSTONE -

PUP Updater[edit | edit source]

The /dev/pup_update0 device is used to perform firmware updates.

IOCTL # Name Notes
0xC0104401 PUP_UPDATER_VERIFY_BLS_HEADER -
0xC0184402 PUP_UPDATER_DECRYPT_HEADER -
0xC0184403 PUP_UPDATER_VERIFY_ADDITIONAL_SIGN -
0xC0184404 PUP_UPDATER_VERIFY_WATERMARK -
0xC0184405 PUP_UPDATER_DECRYPT_SEGMENT -
0xC0284406 PUP_UPDATER_DECRYPT_SEGMENT_BLOCK -
0x20004407 PUP_UPDATER_UPDATE_SNVS -
0xC0104408 PUP_UPDATER_GEN_CHALLENGE -
0xC018440A PUP_UPDATER_READ_NAND_GROUP -
0xC018440B PUP_UPDATER_WRITE_NAND_GROUP -
0xC010440C PUP_UPDATER_IDENTIFY_NAND_CONTROLLER -
0xC004440D PUP_UPDATER_IS_FW_OPERATIONAL -
0xC010440E PUP_UPDATER_FLOYD_UPDATE_FW -
0xC001440F PUP_UPDATER_GET_XTS_KEY_NUM -
0xC0104410 PUP_UPDATER_VERIFY_RESPONSE -

Root Param[edit | edit source]

Root Param is used by SceShellCore to verify root PARAM.SFO files (for PS4) or JSON files (for PS5, aka PPR for ProsPeRo). Below are known commands.

IOCTL # Name Notes
0xC0305201 ROOTPARAM_VERIFY_PS4_ROOT_PARAM -
0xC0305202 ROOTPARAM_VERIFY_PPR_ROOT_PARAM -
0xC0305203 ROOTPARAM_RESUME_FROM_STANDBY -

CAM Transport Layer[edit | edit source]

CAM (Common Access Method) storage subsystem provides a method for implementing drivers to control various known storage devices. Attaches any devices it finds to the appropriate drivers.

IOCTL # Name Notes
0xC4E01902 - related to cam_send_ccb
0xC4E01903 CAMGETPASSTHRU related to cam_lookup_pass

Wireless LAN and Bluetooth[edit | edit source]

WLAN and Bluetooth functionality is reachable via /dev/wlanbt. Below are known commands.

IOCTL # Name Notes
0x40047400 WLANBT_GET_DEVICE_ID -
Retrieved from "http://www.psdevwiki.com/ps5/index.php?title=Devices&oldid=3257"