Devices

Device Listing

Note: only unique devices are listed. Benign devices like /dev/null are omitted for brevity's sake.

Path	Device Name	Notes
/dev/a53{io,mm,mmsys}	A53 Input/Output, Memory Management (sys)	See MP4 section
/dev/ajm{i}	Audio Job Manager	-
/dev/auditpipe	-	-
/dev/authmgr	-	-
/dev/az{1,ctl}	-	-
/dev/bar	-	-
/dev/bfs/ctl	-	-
/dev/bluetooth_hid	-	-
/dev/bt	-	-
/dev/camera	Camera	-
/dev/cloudsd	-	-
/dev/console	Console	Usermode logging
/dev/crepo	-	-
/dev/ctrlp{_sync}	-	-
/dev/dbggc{_control}	Debug GPU?	-
/dev/deci_coredump	Debug Com. Interface (DECI) coredump	-
/dev/deci_mp4_ioc	DECI I/O Control?	-
/dev/deci_mp4_mmc	-	-
/dev/deci_std{in,out,err}	DECI Input/Output/Error	-
/dev/deci_tty*	DECI Terminals	-
/dev/devctl	-	-
/dev/diag	-	-
/dev/dipsw	Dip Switch	-
/dev/dldbg	-	-
/dev/dmem{0,1,2}	-	-
/dev/dngl	-	-
/dev/duid	-	-
/dev/encdec	EncDec	-
/dev/envelope	-	-
/dev/evlg{0,1}	-	-
/dev/exthdd	External HDD	-
/dev/fcram	-	-
/dev/fsctrl	-	-
/dev/fttrm	-	-
/dev/gbase	-	-
/dev/gc	GPU command	-
/dev/geom.ctl	-	-
/dev/gic	-	-
/dev/gsched_bds.ctl	-	-
/dev/hdmi	HDMI	-
/dev/hid	-	-
/dev/hmd2_*	VR 2?	-
/dev/hmd_*	VR	-
/dev/iccnvs{0,1,2,4,6}	-	-
/dev/icc_configuration	ICC Config	-
/dev/icc_crash_report	ICC Crash Report	-
/dev/icc_device_power	ICC Device Power	-
/dev/icc_fan	ICC Fan	-
/dev/icc_floyd	ICC TPM?	-
/dev/icc_indicator	ICC LED	-
/dev/icc_nvs	ICC NVS	-
/dev/icc_power	ICC Power	-
/dev/icc_sc_config	ICC Syscon? Config	-
/dev/icc_thermal	ICC Thermal	-
/dev/klog	Kernel Log	Read syscall on this device can be used to get kernel log if privileged
/dev/kmbp	-	-
/dev/lvdctl	-	-
/dev/lvd{0,1}	-	-
/dev/m2.ctl	m.2 NVMe Control?	-
/dev/mbus	Event bus	-
/dev/mbus_av	Event bus (audio video?)	-
/dev/md0	-	-
/dev/md2	-	-
/dev/mdctl	-	-
/dev/metadbg	-	-
/dev/mp1	System Management Unit (SMU)	Power management, thermals, etc. (see mp1 section)
/dev/mp3	Trusted Execution Environment (TEE)	See mp3 section
/dev/mp4/dump{_for_decid}	A53 (mdbg?)	See mp4 section
/dev/notification{0-9}	Notification	-
/dev/npdrm	-	-
/dev/nsfsctl	-	-
/dev/nsid1.ctl	-	-
/dev/otpaccess	One-Time Programmable Access?	-
/dev/pfsctldev	-	-
/dev/pfsmgr	-	-
/dev/playgo_emu_param{1,2,3}	PlayGo emulator params	-
/dev/pltauth{0,1}	-	-
/dev/pup_update0	PUP Update	-
/dev/qafutkn	QA flag / utoken	-
/dev/rnps	React Native PS	PSN related
/dev/rootparam	-	-
/dev/s3da	3D Audio	-
/dev/sbl_secreg	-	-
/dev/sbl_srv	-	-
/dev/scanin	-	-
/dev/sce_zlib{_sys}	zlib	zlib (de)compression
/dev/sc_fw_update0	(syscon?) firmware update	-
/dev/sflash0	SPI flash	2MB. Has EMC firmware and (non-secure) NVS.
/dev/srtc	-	-
/dev/ssd0.*	Internal SSD partitions	-
/dev/sshot	Screenshot	-
/dev/transactionid.ctl	-	-
/dev/ufssuspend	-	-
/dev/usbctl	USB control	-
/dev/uvd_{dec/enc/bgt}	Unified Video Decoder?	-
/dev/wlanbt	-	-
/dev/xtp0	-	-

System Management Unit (SMU) (MP1)

MP1 (System Management Unit or "SMU") is an xtensa CPU responsible for power management, clock management, sampling sensor data, and other power/thermal-related tasks. The /dev/mp1 device can be used to issue commands to it. Below are known commands.

IOCTL #	Name	Notes
0x4068AE01	MP1_IOCTL_GET_CLK	Get clock frequency
0x8004AE17	MP1_IOCTL_SET_GFXCLK	Set graphics clock frequency
0xC004AE18	MP1_IOCTL_REQUEST_MODE_SWITCH	-
0x8008AE1D	MP1_IOCTL_SET_COREPSTATE	Set core power state?
0xC00CAE1E	MP1_IOCTL_GET_COREPSTATE	Get core power state?

Trusted Execution Environment (TEE) (MP3)

MP3 consists of the Trusted Execution Environment (TEE) running on the AMD Platform Security Processor (PSP/SP). Its primary function is Digital Rights Management (DRM) via PlayReady SL3000. In userspace, the libSceTEEClient library is used for interfacing with it, which internally uses /dev/mp3 to load secure binaries (sbins) and establish sessions. Below are known commands.

IOCTL #	Name	Notes
0xC010B403	TEE_IOC_INVOKE	Invoke commands
0xC010B408	TEE_IOC_DLM_GET_DEBUG_TOKEN	-
0xC028B409	TEE_IOC_DLM_START_TA_DEBUG	-
0xC110B40A	TEE_IOC_DLM_FETCH_DEBUG_STRING	-
0x8008B40B	TEE_IOC_DLM_STOP_TA_DEBUG	-
0x8008B40B	TEE_IOC_INIT_ASD	-
0xC038B40C	TEE_SHM_REGISTER	-
0xC004B40E	TEE_SHM_RELEASE	-
0xC004B40F	TEE_SET_TIMEOUT	-

A53MM/A53IO (MP4)

MP4, which consists of /dev/a53mm, /dev/a53mmsys, and /dev/a53io, is used for various tasks, and its overall purpose is not fully understood. Some of the things it includes are debugging (mdbg), video encode/decode, and other various memory-management related things. Below are known commands.

IOCTL #	Name	Notes
0xC03861A1	BFS_A53IO_READ_BLOCK	-
0xC03861A2	BFS_A53IO_WRITE_BLOCK	-
0xC038AC06	IOC_A53MM_GET_PARAM	-