Devices

Note for ioctls: * indicates name is assumed from RE and may not be accurate.

Device Listing

Note: only unique devices are listed. Benign devices like /dev/null are omitted for brevity's sake.

Path	Device Name	Notes
/dev/a53{io,mm,mmsys}	A53 Input/Output, Memory Management (sys)	See MP4 section
/dev/ajm{i}	Audio Job Manager	-
/dev/auditpipe	-	-
/dev/authmgr	-	-
/dev/az{1,ctl}	-	-
/dev/bar	-	-
/dev/bfs/ctl	-	-
/dev/bluetooth_hid	-	-
/dev/bt	-	-
/dev/camera	Camera	-
/dev/cloudsd	-	-
/dev/console	Console	Usermode logging
/dev/crepo	-	-
/dev/ctrlp{_sync}	-	-
/dev/dbggc{_control}	Debug GPU?	-
/dev/deci_coredump	Debug Com. Interface (DECI) coredump	-
/dev/deci_mp4_ioc	DECI I/O Control?	-
/dev/deci_mp4_mmc	-	-
/dev/deci_std{in,out,err}	DECI Input/Output/Error	-
/dev/deci_tty*	DECI Terminals	-
/dev/devctl	-	-
/dev/diag	-	-
/dev/dipsw	Dip Switch	-
/dev/dldbg	-	-
/dev/dmem{0,1,2}	-	-
/dev/dngl	-	-
/dev/duid	-	-
/dev/encdec	EncDec	-
/dev/envelope	-	-
/dev/evlg{0,1}	-	-
/dev/exthdd	External HDD	-
/dev/fcram	-	-
/dev/fsctrl	-	-
/dev/fttrm	-	-
/dev/gbase	-	-
/dev/gc	GPU command	-
/dev/geom.ctl	-	-
/dev/gic	-	-
/dev/gsched_bds.ctl	-	-
/dev/hdmi	HDMI	-
/dev/hid	-	-
/dev/hmd2_*	VR 2?	-
/dev/hmd_*	VR	-
/dev/iccnvs{0,1,2,4,6}	-	-
/dev/icc_configuration	ICC Config	-
/dev/icc_crash_report	ICC Crash Report	-
/dev/icc_device_power	ICC Device Power	-
/dev/icc_fan	ICC Fan	-
/dev/icc_floyd	ICC TPM?	-
/dev/icc_indicator	ICC LED	-
/dev/icc_nvs	ICC NVS	-
/dev/icc_power	ICC Power	-
/dev/icc_sc_config	ICC Syscon? Config	-
/dev/icc_thermal	ICC Thermal	-
/dev/klog	Kernel Log	Read syscall on this device can be used to get kernel log if privileged
/dev/kmbp	-	-
/dev/lvdctl	-	-
/dev/lvd{0,1}	-	-
/dev/m2.ctl	m.2 NVMe Control?	-
/dev/mbus	Event bus	-
/dev/mbus_av	Event bus (audio video?)	-
/dev/md0	-	-
/dev/md2	-	-
/dev/mdctl	-	-
/dev/metadbg	-	-
/dev/mp1	System Management Unit (SMU)	Power management, thermals, etc. (see mp1 section)
/dev/mp3	Trusted Execution Environment (TEE)	See mp3 section
/dev/mp4/dump{_for_decid}	A53 (mdbg?)	See mp4 section
/dev/notification{0-9}	Notification	-
/dev/npdrm	-	-
/dev/nsfsctl	-	-
/dev/nsid1.ctl	-	-
/dev/otpaccess	One-Time Programmable Access?	-
/dev/pfsctldev	-	-
/dev/pfsmgr	-	-
/dev/playgo_emu_param{1,2,3}	PlayGo emulator params	-
/dev/pltauth{0,1}	-	-
/dev/pup_update0	PUP Update	-
/dev/qafutkn	QA flag / utoken	-
/dev/rnps	React Native PS	PSN related
/dev/rootparam	-	-
/dev/s3da	3D Audio	-
/dev/sbl_secreg	-	-
/dev/sbl_srv	-	-
/dev/scanin	-	-
/dev/sce_zlib{_sys}	zlib	zlib (de)compression
/dev/sc_fw_update0	(syscon?) firmware update	-
/dev/sflash0	SPI flash	2MB. Has EMC firmware and (non-secure) NVS.
/dev/srtc	-	-
/dev/ssd0.*	Internal SSD partitions	-
/dev/sshot	Screenshot	-
/dev/transactionid.ctl	-	-
/dev/ufssuspend	-	-
/dev/usbctl	USB control	-
/dev/uvd_{dec/enc/bgt}	Unified Video Decoder?	-
/dev/wlanbt	-	-
/dev/xtp0	-	-

Platform Security Processor Core (PSP) (MP0)

• All the fun things are here
• Named SMU PSP as well
• Named ASP as well (AMD Secure Processor)

System Management Unit (SMU) (MP1)

MP1 (System Management Unit or "SMU") is an xtensa CPU responsible for power management, clock management, sampling sensor data, and other power/thermal-related tasks. The /dev/mp1 device can be used to issue commands to it. Below are known commands.

IOCTL #	Name	Notes
0x4068AE01	MP1_IOCTL_GET_CLK	Get clock frequency
0x8004AE17	MP1_IOCTL_SET_GFXCLK	Set graphics clock frequency
0xC004AE18	MP1_IOCTL_REQUEST_MODE_SWITCH	-
0x8008AE1D	MP1_IOCTL_SET_COREPSTATE	Set core power state?
0xC00CAE1E	MP1_IOCTL_GET_COREPSTATE	Get core power state?

Sensor Fusion Processor (SFP) (MP2)

• doesn't exist on ps5
• mainly for mobiles

Trusted Execution Environment (TEE) (MP3)

MP3 consists of the Trusted Execution Environment (TEE) running on the AMD Platform Security Processor (PSP/SP). Its primary function is Digital Rights Management (DRM) via PlayReady SL3000. In userspace, the libSceTEEClient library is used for interfacing with it, which internally uses /dev/mp3 to load secure binaries (sbins) and establish sessions. Below are known commands.

IOCTL #	Name	Notes
0xC010B403	TEE_IOC_INVOKE	Invoke commands
0xC010B408	TEE_IOC_DLM_GET_DEBUG_TOKEN	-
0xC028B409	TEE_IOC_DLM_START_TA_DEBUG	-
0xC110B40A	TEE_IOC_DLM_FETCH_DEBUG_STRING	-
0x8008B40B	TEE_IOC_DLM_STOP_TA_DEBUG	-
0x8008B40B	TEE_IOC_INIT_ASD	-
0xC038B40C	TEE_SHM_REGISTER	-
0xC004B40E	TEE_SHM_RELEASE	-
0xC004B40F	TEE_SET_TIMEOUT	-

A53MM/A53IO (MP4)

MP4, which consists of /dev/a53mm, /dev/a53mmsys, and /dev/a53io, is used for various tasks, and its overall purpose is not fully understood. Some of the things it includes are debugging (mdbg), video encode/decode, and other various memory-management related things. Below are known commands.

a53mm

IOCTL #	Name	Notes
0xC004AC01	-	-
0xC030AC02	A53MM_GIVE_DIRECT_MEM_TO_MAPPER	-
0xC030AC03	A53MM_CALL_INDIRECT_BUFFER	-
0xC050AC05	A53MM_MAPPER_VIRTUAL_QUERY	-
0xC038AC06	A53MM_GET_PARAM *	-
0xC018AC07	-	-
0xC004AC08	-	-
0xC018AC09	-	-
0xC010AC0A	-	-
0xC018AC0B	A53MM_MAPPER_QUERY_PA	-
0xC004AC0D	A53MM_WAIT_COMMAND_BUFFER_COMPLETION	-
0xC018AC0E	A53MM_INTERNAL_LOCK_UNLOCK_MAPPER_MEMORY	-
0xC018AC0F	-	-
0xC018AC10	A53MM_GET_USAGE_STATS_DATA	-
0xC004AC11	A53MM_SET_PAGE_TABLE_POOL_OCCUPANCY_THRESHOLD	-
0xC018AC12	A53MM_INTERNAL_TEST_PAGE_MIGRATION	-
0xC004AC13	-	-

a53mmsys

IOCTL #	Name	Notes
0xc020b501	A53MMSYS_INTERNAL_LOCK_UNLOCK_MAPPER_MEMORY	-
0xc028b502	-	-
0xc050b503	-	-
0xc010b504	-	-
0xc028b505	A53MMSYS_MAPPER_GET_INDIRECT_BUFFER_INFO	-
0xc020b506	-	-
0xc018b507	-	-
0xc018b508	A53MMSYS_DEBUG_MAPPER_QUERY_DMEM_OFFSET	-
0xc020b50a	-	-
0xc010b50b	A53MMSYS_DEBUG_GET_AMPR_COUNTER_INFO	-

a53io

IOCTL #	Name	Notes
0xC03861A1	BFS_A53IO_READ_BLOCK	-
0xC03861A2	BFS_A53IO_WRITE_BLOCK	-