Difference between revisions of "G27 PS3"

From GIMX
Jump to: navigation, search
(→‎Report descriptor)
(→‎Interrupt IN report)
 

(18 intermediate revisions by the same user not shown)

Line 2: Line 2:
 
This is a reverse engineering of the USB interface of the G27 when connected to a PS3.
 
This is a reverse engineering of the USB interface of the G27 when connected to a PS3.
  
−
=Enumeration=
+
=Compatibility mode=
  
−
==Device descriptor==
+
When plugged the G27 starts in compatibility mode and behaves as a Driving Force (product id 0xc294).
 +
 
 +
==Enumeration==
 +
 
 +
===Device descriptor===
  
 
{| class="wikitable"
 
{| class="wikitable"
Line 51: Line 55:
 
|}
 
|}
  
−
==Configuration descriptor==
+
===Configuration descriptor===
  
−
===Configuration Descriptor===
+
====Configuration Descriptor====
  
 
{| class="wikitable"
 
{| class="wikitable"
Line 88: Line 92:
 
|}
 
|}
  
−
===Interface Descriptor===
+
====Interface Descriptor====
  
 
{| class="wikitable"
 
{| class="wikitable"
Line 120: Line 124:
 
|}
 
|}
  
−
===HID Descriptor===
+
====HID Descriptor====
  
 
{| class="wikitable"
 
{| class="wikitable"
Line 145: Line 149:
 
|}
 
|}
  
−
===Endpoint Descriptor===
+
====Endpoint Descriptor====
  
 
{| class="wikitable"
 
{| class="wikitable"
Line 171: Line 175:
 
|}
 
|}
  
−
===Endpoint Descriptor===
+
====Endpoint Descriptor====
  
 
{| class="wikitable"
 
{| class="wikitable"
Line 197: Line 201:
 
|}
 
|}
  
−
==Report descriptor==
+
===Report descriptor===
  
  
Line 511: Line 515:
 
|}
 
|}
  
−
==Product string==
+
===Product string===
  
 
{| class="wikitable"
 
{| class="wikitable"
Line 525: Line 529:
 
|}
 
|}
  
−
=Get Reports (control endpoint)=
+
==Get Reports (control endpoint)==
  
−
==FFB reports==
+
===FFB reports===
  
−
=Set Reports (control endpoint)=
+
TODO
  
−
=Interrupt IN report=
+
==Set Reports (control endpoint)==
 +
 
 +
TODO
 +
 
 +
==Interrupt IN report==
  
 
{| class="wikitable"
 
{| class="wikitable"
Line 580: Line 588:
 
|-
 
|-
 
|[3]
 
|[3]
−
|colspan="8"|pedals (signed, center = 0x7f)
+
|colspan="8"|unknown (0x7f)
 
|-
 
|-
 
|[4]
 
|[4]
Line 589: Line 597:
 
|colspan="4"|hat switch (D-Pad, Released=8, N=0, NE=1, E=2, SE=3, S=4, SW=5, W=6, NW=7)
 
|colspan="4"|hat switch (D-Pad, Released=8, N=0, NE=1, E=2, SE=3, S=4, SW=5, W=6, NW=7)
 
|-
 
|-
−
|[5-6]
+
|[5]
−
|colspan="8"|0xffff
+
|colspan="8"|gas pedal (released = 0xFF)
 +
|-
 +
|[6]
 +
|colspan="8"|brake pedal (released = 0xFF)
 
|}
 
|}
  
−
=Interrupt OUT reports=
+
==Interrupt OUT reports==
  
 
TODO
 
TODO
 +
 +
=Native mode=
 +
 +
Once the native mode is enabled the G27 enumerates as a G27. Only the differences will be detailed.
 +
 +
==Enumeration==
 +
 +
===Device descriptor===
 +
 +
{| class="wikitable"
 +
|-
 +
|idProduct
 +
|0xc29b
 +
|}
 +
 +
===Configuration descriptor===
 +
 +
====Configuration Descriptor====
 +
 +
No difference.
 +
 +
====Interface Descriptor====
 +
 +
{| class="wikitable"
 +
|-
 +
|iInterface
 +
|Not Requested (254)
 +
|}
 +
 +
====HID Descriptor====
 +
 +
{| class="wikitable"
 +
|-
 +
|bcdHID
 +
|1.11 (0x0111)
 +
|-
 +
|wDescriptorLength
 +
|133
 +
|}
 +
 +
====Endpoint Descriptor====
 +
 +
{| class="wikitable"
 +
|-
 +
|wMaxPacketSize.PacketSize
 +
|16
 +
|-
 +
|bInterval
 +
|2
 +
|}
 +
 +
====Endpoint Descriptor====
 +
 +
{| class="wikitable"
 +
|-
 +
|wMaxPacketSize.PacketSize
 +
|16
 +
|-
 +
|bInterval
 +
|2
 +
|}
 +
 +
====Report descriptor====
 +
 +
The PS3 does not request it. It contains 3 more null bytes before the last two C0 bytes.
 +
 +
{| class="wikitable"
 +
|-
 +
|00 00 00
 +
|}
 +
 +
==Interrupt IN report==
 +
 +
{| class="wikitable"
 +
|-
 +
|width="100"|byte index
 +
|width="60"|bit 7
 +
|width="60"|bit 6
 +
|width="60"|bit 5
 +
|width="60"|bit 4
 +
|width="60"|bit 3
 +
|width="60"|bit 2
 +
|width="60"|bit 1
 +
|width="60"|bit 0
 +
|-
 +
|[0]
 +
|triangle
 +
|circle
 +
|square
 +
|cross
 +
|colspan="4"|hat switch (D-Pad, Released=8, N=0, NE=1, E=2, SE=3, S=4, SW=5, W=6, NW=7)
 +
|-
 +
|[1]
 +
|xooo
 +
l3
 +
|ooox
 +
r3
 +
|ooxo
 +
start
 +
|oxoo
 +
select
 +
|l2
 +
(wheel button left up)
 +
|r2
 +
(wheel button right up)
 +
|l1
 +
(left shifter)
 +
|r1
 +
(right shifter)
 +
|-
 +
|[2]
 +
|r5
 +
(wheel button right down)
 +
|r4
 +
(wheel button right middle)
 +
|gear 6
 +
|gear 5
 +
|gear 4
 +
|gear 3
 +
|gear 2
 +
|gear 1
 +
|-
 +
|[3]
 +
|colspan="6"|wheel (LSB)
 +
|l5
 +
(wheel button left down)
 +
|l4
 +
(wheel button left middle)
 +
|-
 +
|[4]
 +
|colspan="8"|wheel (MSB) (14-bit unsigned, min = 0, center = 0x2000, max = 0x3FFF)
 +
|-
 +
|[5]
 +
|colspan="8"|gas pedal (released = 0xFF)
 +
|-
 +
|[6]
 +
|colspan="8"|brake pedal (released = 0xFF)
 +
|-
 +
|[7]
 +
|colspan="8"|clutch pedal (released = 0xFF)
 +
|-
 +
|[8]
 +
|colspan="8"|shifter x axis (center = 0x80, left ~ 0x55, right ~ 0xab)
 +
|-
 +
|[9]
 +
|colspan="8"|shifter y axis (center = 0x80, down ~ 0x00, up ~ 0xff)
 +
|-
 +
|[10]
 +
|1
 +
|reverse engaged
 +
|0
 +
|1
 +
|1
 +
|1
 +
|0
 +
|stick down
 +
|}

Latest revision as of 23:08, 26 March 2016

This is a reverse engineering of the USB interface of the G27 when connected to a PS3.

Compatibility mode

When plugged the G27 starts in compatibility mode and behaves as a Driving Force (product id 0xc294).

Enumeration

Device descriptor

bLength 18
bDescriptorType DEVICE (0x01)
bcdUSB 2.00 (0x0200)
bDeviceClass Defined in Interface (0x00)
bDeviceSubClass Defined in Interface (0x00)
bDeviceProtocol Defined in Interface (0x00)
bMaxPacketSize0 16
idVendor 0x046d
idProduct 0xc294
bcdDevice 12.38 (0x1238)
iManufacturer None (0)
iProduct Not Requested (2)
iSerialNumber None (0)
bNumConfigurations 1

Configuration descriptor

Configuration Descriptor

bLength 9
bDescriptorType CONFIGURATION (0x02)
wTotalLength 41
bNumInterfaces 1
bConfigurationValue 1
iConfiguration None (0)
bmAttributes.Reserved 0
bmAttributes.RemoteWakeup RemoteWakeup Not Supported (0b0)
bmAttributes.SelfPowered Bus Powered (0b0)
bMaxPower 98mA (0x31)

Interface Descriptor

bLength 9
bDescriptorType INTERFACE (0x04)
bInterfaceNumber 0
bAlternateSetting 0
bNumEndpoints 2
bInterfaceClass Human Interface Device (0x03)
bInterfaceSubClass None (0x00)
bInterfaceProtocol None (0x00)
iInterface None (0)

HID Descriptor

bLength 9
bDescriptorType HID(33)
bcdHID 1.00 (0x0100)
bCountryCode 0x21
bNumDescriptors 1
bDescriptorType REPORT (34)
wDescriptorLength 130

Endpoint Descriptor

bLength 7
bDescriptorType ENDPOINT (0x05)
bEndpointAddress 1 IN (0b10000001)
bmAttributes.TransferType Interrupt (0b11)
wMaxPacketSize.PacketSize 8
wMaxPacketSize.Transactions One transaction per microframe if HS (0b00)
bInterval 10

Endpoint Descriptor

bLength 7
bDescriptorType ENDPOINT (0x05)
bEndpointAddress 1 OUT (0b00000001)
bmAttributes.TransferType Interrupt (0b11)
wMaxPacketSize.PacketSize 8
wMaxPacketSize.Transactions One transaction per microframe if HS (0b00)
bInterval 10

Report descriptor

05 01
09 04
A1 01
A1 02
95 01
75 0A
15 00
26 FF 03
35 00
46 FF 03
09 30
81 02
95 0C
75 01
25 01
45 01
05 09
19 01
29 0C
81 02
95 02
06 00 FF
09 01
81 02
05 01
09 31
26 FF 00
46 FF 00
95 01
75 08
81 02
25 07
46 3B 01
75 04
65 14
09 39
81 42
75 01
95 04
65 00
06 00 FF
09 01
25 01
45 01
81 02
95 02
75 08
26 FF 00
46 FF 00
09 02
81 02
C0
A1 02
26 FF 00
46 FF 00
95 07
75 08
09 03
91 02
C0
C0
Usage Page Generic Desktop Controls (0x01)
Usage Joystick (0x04)
Collection Application (0x01)
Collection Logical (0x02)
Report Count 1
Report Size 10
Logical Minimum 0
Logical Maximum 1023
Physical Minimum 0
Physical Maximum 1023
Usage X (0x30)
Input Data (0x02)
Report Count 12
Report Size 1
Logical Maximum 1
Physical Maximum 1
Usage Page Button (0x09)
Usage Minimum Button 1 (primary/trigger) (0x01)
Usage Maximum Button 12 (0x0c)
Input Data (0x02)
Report Count 2
Usage Page Vendor-defined (0xff00)
Usage Undefined (0x01)
Input Data (0x02)
Usage Page Generic Desktop Controls (0x01)
Usage Y (0x31)
Logical Maximum 255
Physical Maximum 255
Report Count 1
Report Size 8
Input Data (0x02)
Logical Maximum 7
Physical Maximum 315
Report Size 4
Unit 20
Usage Hat switch (0x39)
Input Data (0x42)
Report Size 1
Report Count 4
Unit 0
Usage Page Vendor-defined (0xff00)
Usage Undefined (0x01)
Logical Maximum 1
Physical Maximum 1
Input Data (0x02)
Report Count 2
Report Size 8
Logical Maximum 255
Physical Maximum 255
Usage Undefined (0x02)
Input Data (0x02)
End Collection
Collection Logical (0x02)
Logical Maximum 255
Physical Maximum 255
Report Count 7
Report Size 8
Usage Undefined (0x03)
Output Data (0x02)
End Collection
End Collection

Product string

bLength 34
bDescriptorType STRING (0x03)
bString G27 Racing Wheel

Get Reports (control endpoint)

FFB reports

TODO

Set Reports (control endpoint)

TODO

Interrupt IN report

byte index bit 7 bit 6 bit 5 bit 4 bit 3 bit 2 bit 1 bit 0
[0] Wheel axis LSB (unsigned, min = 0, max = 0x03ff, center = 0x0200)
[1] l1

(left shift)

r1

(right shift)

triangle

(up)

circle

(right)

square

(down)

cross

(left)

Wheel axis MSB
[2] 1 0 r2

(top-mid-bottom right)

l2

(top-mid-bottom left)

oxoo

select

ooxo

start

ooox

r3

xooo

l3

[3] unknown (0x7f)
[4] 1 0 0 0 hat switch (D-Pad, Released=8, N=0, NE=1, E=2, SE=3, S=4, SW=5, W=6, NW=7)
[5] gas pedal (released = 0xFF)
[6] brake pedal (released = 0xFF)

Interrupt OUT reports

TODO

Native mode

Once the native mode is enabled the G27 enumerates as a G27. Only the differences will be detailed.

Enumeration

Device descriptor

idProduct 0xc29b

Configuration descriptor

Configuration Descriptor

No difference.

Interface Descriptor

iInterface Not Requested (254)

HID Descriptor

bcdHID 1.11 (0x0111)
wDescriptorLength 133

Endpoint Descriptor

wMaxPacketSize.PacketSize 16
bInterval 2

Endpoint Descriptor

wMaxPacketSize.PacketSize 16
bInterval 2

Report descriptor

The PS3 does not request it. It contains 3 more null bytes before the last two C0 bytes.

00 00 00

Interrupt IN report

byte index bit 7 bit 6 bit 5 bit 4 bit 3 bit 2 bit 1 bit 0
[0] triangle circle square cross hat switch (D-Pad, Released=8, N=0, NE=1, E=2, SE=3, S=4, SW=5, W=6, NW=7)
[1] xooo

l3

ooox

r3

ooxo

start

oxoo

select

l2

(wheel button left up)

r2

(wheel button right up)

l1

(left shifter)

r1

(right shifter)

[2] r5

(wheel button right down)

r4

(wheel button right middle)

gear 6 gear 5 gear 4 gear 3 gear 2 gear 1
[3] wheel (LSB) l5

(wheel button left down)

l4

(wheel button left middle)

[4] wheel (MSB) (14-bit unsigned, min = 0, center = 0x2000, max = 0x3FFF)
[5] gas pedal (released = 0xFF)
[6] brake pedal (released = 0xFF)
[7] clutch pedal (released = 0xFF)
[8] shifter x axis (center = 0x80, left ~ 0x55, right ~ 0xab)
[9] shifter y axis (center = 0x80, down ~ 0x00, up ~ 0xff)
[10] 1 reverse engaged 0 1 1 1 0 stick down

Retrieved from "https://gimx.fr/wiki/index.php?title=G27_PS3&oldid=4931"