Devices
Note for ioctls: * indicates name is assumed from RE and may not be accurate.
Device Listing
Note: only unique devices are listed. Benign devices like /dev/null are omitted for brevity's sake.
| Path | Device Name | Notes |
|---|---|---|
| /dev/a53{io,mm,mmsys} | A53 Input/Output, Memory Management (sys) | See MP4 section |
| /dev/ajm{i} | Audio Job Manager | - |
| /dev/auditpipe | - | - |
| /dev/authmgr | - | - |
| /dev/az{1,ctl} | - | - |
| /dev/bar | - | - |
| /dev/bfs/ctl | - | - |
| /dev/bluetooth_hid | - | - |
| /dev/bt | - | - |
| /dev/camera | Camera | - |
| /dev/cloudsd | - | - |
| /dev/console | Console | Usermode logging |
| /dev/crepo | - | - |
| /dev/ctrlp{_sync} | - | - |
| /dev/dbggc{_control} | Debug GPU? | - |
| /dev/deci_coredump | Debug Com. Interface (DECI) coredump | - |
| /dev/deci_mp4_ioc | DECI I/O Control? | - |
| /dev/deci_mp4_mmc | - | - |
| /dev/deci_std{in,out,err} | DECI Input/Output/Error | - |
| /dev/deci_tty* | DECI Terminals | - |
| /dev/devctl | - | - |
| /dev/diag | - | - |
| /dev/dipsw | Dip Switch | - |
| /dev/dldbg | - | - |
| /dev/dmem{0,1,2} | - | - |
| /dev/dngl | - | - |
| /dev/duid | - | - |
| /dev/encdec | EncDec | - |
| /dev/envelope | - | - |
| /dev/evlg{0,1} | - | - |
| /dev/exthdd | External HDD | - |
| /dev/fcram | - | - |
| /dev/fsctrl | - | - |
| /dev/fttrm | - | - |
| /dev/gbase | - | - |
| /dev/gc | GPU command | - |
| /dev/geom.ctl | - | - |
| /dev/gic | - | - |
| /dev/gsched_bds.ctl | - | - |
| /dev/hdmi | HDMI | - |
| /dev/hid | - | - |
| /dev/hmd2_* | VR 2? | - |
| /dev/hmd_* | VR | - |
| /dev/iccnvs{0,1,2,4,6} | - | - |
| /dev/icc_configuration | ICC Config | - |
| /dev/icc_crash_report | ICC Crash Report | - |
| /dev/icc_device_power | ICC Device Power | - |
| /dev/icc_fan | ICC Fan | - |
| /dev/icc_floyd | ICC TPM? | - |
| /dev/icc_indicator | ICC LED | - |
| /dev/icc_nvs | ICC NVS | - |
| /dev/icc_power | ICC Power | - |
| /dev/icc_sc_config | ICC Syscon? Config | - |
| /dev/icc_thermal | ICC Thermal | - |
| /dev/klog | Kernel Log | Read syscall on this device can be used to get kernel log if privileged |
| /dev/kmbp | - | - |
| /dev/lvdctl | - | - |
| /dev/lvd{0,1} | - | - |
| /dev/m2.ctl | m.2 NVMe Control? | - |
| /dev/mbus | Event bus | - |
| /dev/mbus_av | Event bus (audio video?) | - |
| /dev/md0 | - | - |
| /dev/md2 | - | - |
| /dev/mdctl | - | - |
| /dev/metadbg | - | - |
| /dev/mp1 | System Management Unit (SMU) | Power management, thermals, etc. (see mp1 section) |
| /dev/mp3 | Trusted Execution Environment (TEE) | See mp3 section |
| /dev/mp4/dump{_for_decid} | A53 (mdbg?) | See mp4 section |
| /dev/notification{0-9} | Notification | - |
| /dev/npdrm | - | - |
| /dev/nsfsctl | - | - |
| /dev/nsid1.ctl | - | - |
| /dev/otpaccess | One-Time Programmable Access? | - |
| /dev/pfsctldev | - | - |
| /dev/pfsmgr | - | - |
| /dev/playgo_emu_param{1,2,3} | PlayGo emulator params | - |
| /dev/pltauth{0,1} | - | - |
| /dev/pup_update0 | PUP Update | - |
| /dev/qafutkn | QA flag / utoken | - |
| /dev/rnps | React Native PS | PSN related |
| /dev/rootparam | - | - |
| /dev/s3da | 3D Audio | - |
| /dev/sbl_secreg | - | - |
| /dev/sbl_srv | - | - |
| /dev/scanin | - | - |
| /dev/sce_zlib{_sys} | zlib | zlib (de)compression |
| /dev/sc_fw_update0 | (syscon?) firmware update | - |
| /dev/sflash0 | SPI flash | 2MB. Has EMC firmware and (non-secure) NVS. |
| /dev/srtc | - | - |
| /dev/ssd0.* | Internal SSD partitions | - |
| /dev/sshot | Screenshot | - |
| /dev/transactionid.ctl | - | - |
| /dev/ufssuspend | - | - |
| /dev/usbctl | USB control | - |
| /dev/uvd_{dec/enc/bgt} | Unified Video Decoder? | - |
| /dev/wlanbt | - | - |
| /dev/xtp0 | - | - |
System Management Unit (SMU) (MP1)
MP1 (System Management Unit or "SMU") is an xtensa CPU responsible for power management, clock management, sampling sensor data, and other power/thermal-related tasks. The /dev/mp1 device can be used to issue commands to it. Below are known commands.
| IOCTL # | Name | Notes |
|---|---|---|
| 0x4068AE01 | MP1_IOCTL_GET_CLK | Get clock frequency |
| 0x8004AE17 | MP1_IOCTL_SET_GFXCLK | Set graphics clock frequency |
| 0xC004AE18 | MP1_IOCTL_REQUEST_MODE_SWITCH | - |
| 0x8008AE1D | MP1_IOCTL_SET_COREPSTATE | Set core power state? |
| 0xC00CAE1E | MP1_IOCTL_GET_COREPSTATE | Get core power state? |
Trusted Execution Environment (TEE) (MP3)
MP3 consists of the Trusted Execution Environment (TEE) running on the AMD Platform Security Processor (PSP/SP). Its primary function is Digital Rights Management (DRM) via PlayReady SL3000. In userspace, the libSceTEEClient library is used for interfacing with it, which internally uses /dev/mp3 to load secure binaries (sbins) and establish sessions. Below are known commands.
| IOCTL # | Name | Notes |
|---|---|---|
| 0xC010B403 | TEE_IOC_INVOKE | Invoke commands |
| 0xC010B408 | TEE_IOC_DLM_GET_DEBUG_TOKEN | - |
| 0xC028B409 | TEE_IOC_DLM_START_TA_DEBUG | - |
| 0xC110B40A | TEE_IOC_DLM_FETCH_DEBUG_STRING | - |
| 0x8008B40B | TEE_IOC_DLM_STOP_TA_DEBUG | - |
| 0x8008B40B | TEE_IOC_INIT_ASD | - |
| 0xC038B40C | TEE_SHM_REGISTER | - |
| 0xC004B40E | TEE_SHM_RELEASE | - |
| 0xC004B40F | TEE_SET_TIMEOUT | - |
A53MM/A53IO (MP4)
MP4, which consists of /dev/a53mm, /dev/a53mmsys, and /dev/a53io, is used for various tasks, and its overall purpose is not fully understood. Some of the things it includes are debugging (mdbg), video encode/decode, and other various memory-management related things. Below are known commands.
a53mm
| IOCTL # | Name | Notes |
|---|---|---|
| 0xC004AC01 | - | - |
| 0xC030AC02 | A53MM_GIVE_DIRECT_MEM_TO_MAPPER | - |
| 0xC030AC03 | A53MM_CALL_INDIRECT_BUFFER | - |
| 0xC050AC05 | A53MM_MAPPER_VIRTUAL_QUERY | - |
| 0xC038AC06 | A53MM_GET_PARAM * | - |
| 0xC018AC07 | - | - |
| 0xC004AC08 | - | - |
| 0xC018AC09 | - | - |
| 0xC010AC0A | - | - |
| 0xC018AC0B | A53MM_MAPPER_QUERY_PA | - |
| 0xC004AC0D | A53MM_WAIT_COMMAND_BUFFER_COMPLETION | - |
| 0xC018AC0E | - | - |
| 0xC018AC0F | - | - |
| 0xC018AC10 | A53MM_VA_TO_IOMA * | - |
| 0xC004AC11 | A53MM_PAGE_TABLE_POOL_OCCUPANCY_THRESHOLD | - |
| 0xC018AC12 | - | - |
| 0xC004AC13 | - | - |
a53mmsys
| IOCTL # | Name | Notes |
|---|---|---|
| 0xc020b501 | - | - |
| 0xc028b502 | - | - |
| 0xc050b503 | - | - |
| 0xc010b504 | - | - |
| 0xc028b505 | A53MMSYS_MAPPER_GET_INDIRECT_BUFFER_INFO | - |
| 0xc020b506 | - | - |
| 0xc018b507 | - | - |
| 0xc018b508 | A53MMSYS_DEBUG_MAPPER_QUERY_DMEM_OFFSET | - |
| 0xc020b50a | - | - |
| 0xc010b50b | A53MMSYS_DEBUG_GET_AMPR_COUNTER_INFO | - |
a53io
| IOCTL # | Name | Notes |
|---|---|---|
| 0xC03861A1 | BFS_A53IO_READ_BLOCK | - |
| 0xC03861A2 | BFS_A53IO_WRITE_BLOCK | - |