Last active
September 18, 2025 02:54
-
-
Save johndrinkwater/7708901 to your computer and use it in GitHub Desktop.
I’m interested in writing (or helping to spec out the protocol so someone else can write) the linux kernel driver for Sony’s DualShock 4 (PS4’s lovely controller) Currently using the output of HID RAW from a USB connected dualshock 4…
For the gyro/touchpad discovery, I’ve just been using some terrible c code to throw numbers on the screen and it…
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| TADA, it’s `hexdump -v -e '64/1 "%02x" "\n"' < /dev/hidraw3` | |
| No idea what the first byte is… but I’m going to assume its for device ID for the many users that are connected, but it probably has to be set by the connected machine? | |
| 01ff777f7f0800aa0000435dfdf1ff14000200c5ff0721150300000000001b000001fc9133a32990880428008000000080000000008000000080000000008000 | |
| ↑↑↑↑ | |
| left stick, value, first field is horz (00 left), second field is vertical (00 top) | |
| 017f80ff61080064000059f2fdfffffbff0e00d107081e9bf600000000001b0000018e94b1b00690880428008000000080000000008000000080000000008000 | |
| ↑↑↑↑ | |
| right stick, value, first field is horz (00 left), second field is vertical (00 top) | |
| 017e7f7c8078000800009688fdfffffdfffbff8900c320d10700000000001b000001bc8e95201485413626008000000080000000008000000080000000008000 | |
| ↑ | |
| face buttons, bitmask, right side: 0 unpress, 1 for square, 2 for X, 4 for circle, 8 for triangle, combinations up to f | |
| 017e7f7c8078000800009688fdfffffdfffbff8900c320d10700000000001b000001bc8e95201485413626008000000080000000008000000080000000008000 | |
| ↑ | |
| face buttons, value, left side: 8 for no value, 0 for up, 1 for topright, 2 for right and it continues clockwise until 7 for topleft | |
| 01738b797f08401800008c7bfdffffffff02009500ab20890800000000001b000001518f0ed23a90880428008000000080000000008000000080000000008000 | |
| ↑ | |
| face buttons, bitmask, 0 unpressed, L3/R3 aka analog stick click ins, 1 for share, 2 for options, 4 for L3, 8 for R3, | |
| 0181827c7e0803540000b8ccfdb40021002a00f5004b1fdd0700000000001b00000185a4eab40d9fc2960f008000000080000000008000000080000000008000 | |
| ↑ | |
| triggers, bitmask, 0 unpressed, 1 for L1, 2 for R2, 4 for L2, 8 for R2 | |
| 017e827b7e08005800001861fe0000010002008d00a220d70700000000001b000001d5a3047431a2b8631b008000000080000000008000000080000000008000 | |
| 017e817b7e08005c00000764fe0000fbfffcff91009b20d10700000000001b000001d5a3047431a2b8631b008000000080000000008000000080000000008000 | |
| 017e827b7e0800600000f766fe03000500f7ff9900b720bd0700000000001b000001d5a3047431a2b8631b008000000080000000008000000080000000008000 | |
| ↑↑ | |
| event, 6 bits, incremented once each query, to track updates | |
| face button, bitmask, last 2 bits of this field, 1 for PS button, 2 for trackpad click // thanks to @evilhackerdude | |
| 0181837c7e080c4cffffff20fddcffdfff8d0031fdcf1c09f700000000001b00000185a4eab40d9fc2960f008000000080000000008000000080000000008000 | |
| ↑↑↑↑ | |
| triggers, value, first is L2 (00 unpressed), second is R2 (00 unpressed) | |
| 017d807f800800f00000985bfd070057009bfe8d0d1b1f6d0500000000001b0000012ba9b84116ab86e512008000000080000000008000000080000000008000 | |
| ↑↑↑↑ | |
| UNKNOWN time from gyro? ever incrementing, byteorder swapped. | |
| this data is bothering me atm… | |
| ### BATTERY | |
| 017d807f800800f00000985bfd070057009bfe8d0d1b1f6d0500000000001b0000012ba9b84116ab86e512008000000080000000008000000080000000008000 | |
| ↑↑ | |
| battery level, 00 to ff | |
| ### GYRO | |
| 017d807f800800f00000985bfd070057009bfe8d0d1b1f6d0500000000001b0000012ba9b84116ab86e512008000000080000000008000000080000000008000 | |
| ↑↑↑↑↑↑↑↑↑↑↑↑ | |
| Relative gyro motion, byteorderswapped, pitch, yaw, roll | |
| 017d807f800800f00000985bfd070057009bfe8d0d1b1f6d0500000000001b0000012ba9b84116ab86e512008000000080000000008000000080000000008000 | |
| ↑↑↑↑↑↑↑↑↑↑↑↑ | |
| Absolute gyro, byteorderswapped, roll, yaw, pitch. 0 for pitch is horizon | |
| Still debating the values and labelling here. Certainly absolute, might have naming muddled. | |
| 017d807f800800f00000985bfd070057009bfe8d0d1b1f6d0500000000001b0000012ba9b84116ab86e512008000000080000000008000000080000000008000 | |
| ↑↑↑↑↑↑↑↑↑↑ | |
| Unknown! We still have to find LED colour and active rumble output, so I expect these here. | |
| ### HEADSET/EXT | |
| 018080787e0800b000009cb3fa07000200ffff71007b203d0700000000007b000001af94b9b52180000000008000000080000000008000000080000000008000 | |
| ↑↑ | |
| Appears to be EXT info, bitmask, 00011011 is nothing attached. 01111011 is headset with mic. 00111011 is headphones. | |
| 018080787e0800b000009cb3fa07000200ffff71007b203d0700000000007b000001af94b9b52180000000008000000080000000008000000080000000008000 | |
| ↑↑↑↑↑ | |
| Unknown! I expect, but cannot confirm until Sony releases additional products, that the 5 nibbles next are bitmaps for control | |
| commands like volume, etc. | |
| ### TOUCHPAD | |
| Touches are: 1 bit of event active, 7 bits of event id, followed by 3 bytes of positional data. | |
| Supports 2 active touches, 2 previous touches. Remaining data is unset (for all I can see) | |
| 017e827b7f08002c0000e425fdffff0000feff95006720e90700000000001b00000148101ca22509b5b51b008000000080000000008000000080000000008000 | |
| ↑↑ | |
| Says how many packets to read, only seen 01 or 02 set | |
| A packet contains two touch events, touches can be ‘null’ by being 80000000 | |
| 017e81767e0800b800001060f8fdff00000500b5008720cd0700000000001b000000008000000080000000008000000080000000008000000080000000008000 | |
| 017e817f7e0800bc000017a1fdfdff010001008d00a320d10700000000001b0000023c0b5b941a87dec01b410b5e941a87dec01b008000000080000000008000 | |
| 017e827b7f08002c0000e425fdffff0000feff95006720e90700000000001b00000148101ca22509b5b51b008000000080000000008000000080000000008000 | |
| ↑↑ | |
| This appears to be another auto incrementing number to track last update, but need to do research… | |
| 017e827b7f08002c0000e425fdffff0000feff95006720e90700000000001b00000148101ca22509b5b51b008000000080000000008000000080000000008000 | |
| ↑↑ ↑↑ | |
| these values are tracking numbers, unique to each finger down, so for each lift and repress, it gets a newly incremented figure | |
| 017e827f7e08003000008996fc000000000300a900af20e90700000000001b0000012c728a4028731f040e008000000080000000008000000080000000008000 | |
| ↑↑↑↑↑↑ ↑↑↑↑↑↑ | |
| these values are for each fingers’ location, they stay static upon finger lifting, to maintain state. Not sure how it tracks if user is still holding, yet… | |
| To decode, each coord is using 12 bits… you need to mask/split and swap the middle byte | |
| 01401D → 0001 468 | |
| 604738 → 1888 900 | |
| Basically this, but written well :^) | |
| short finger1x = ((buf[37] & 0x0F) << 8) | buf[36]; | |
| short finger1y = buf[38] << 4 | (buf[37]>>4); | |
| 017e817f7e0800bc000017a1fdfdff010001008d00a320d10700000000001b0000023c0b5b941a87dec01b410b5e941a87dec01b008000000080000000008000 | |
| ↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑ | |
| as finger moves over the touchpad, a duplicate motion (likely previous position?) is sent, for both fingers, even if just one is moving | |
| Things I still haven’t discovered: LED status/colour, active rumble status, confirmation of gyro labelling | |
| Audio is dealt with using Bluetooth’s headset spec; haven’t been able to confirm if this is exposed at all over USB, or if it | |
| is meant to trigger automatic Bluetooth pairing and audio connection. |
ok small update after I hit home I see it starts auth. but its expecting some pipe to reply I guess?
USB LS and FS v1frame 0.019490312 0.000001334 wValue=0x0314
USB LS and FS v1frame 0.047488822 0.000001334 wValue=0x0314
USB LS and FS v1frame 0.12352164 0.000001332 wValue=0x0314
USB LS and FS v1frame 0.151493534 0.000001332 wValue=0x0314
USB LS and FS v1frame 0.225475312 0.000001332 wValue=0x0314
USB LS and FS v1frame 0.253489256 0.000001334 wValue=0x0314
it never sends any other get reports, just sets the nonce. Maybe its expecting something on one of the end pipes?
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Had a question about the ps4 controller and about the info I read.
Comment:
First off, see the correction, someone typed that in wrong, second this is not authentication. The Ps4 is just telling you the host mac.
It would be nice if someone would fix that.
Question:
I made my own device. I see this
wValue=0x0302
wValue=0x03a3
wValue=0x0312 if mac is 0,0,0,0,0,0 we replace it next
wValue=0x0313 get it in here
wValue=0x0314 reset or disconnect
then after a reset I do it again.
wValue=0x0302
wValue=0x03a3
wValue=0x0312 mac is right now
Ok so it works just like the OEM, but pressing Home does not work. I tried many tweaks changes to no avail. I have a 3rd party wired only that does not even do these reports and just works. The OEM pad in USB mode, does these packets and never sends the auth packets. 0xf0-0xf2 but clearly are in he report descriptor.
so it seems the auth is only for BT, but what does my device need to do, to be allow to work?