PSVR Control: USB Command Response Format

Control the PSVR is performed over the USB port, through the HID interface 5.

    INTERFACE 5: Human Interface Device ====================
     bLength            :    0x9 (9 bytes)
     bDescriptorType    :    0x4 Interface
     bInterfaceNumber   :    0x5
     bAlternateSetting  :    0x0
     bNumEndpoints      :    0x2
     bInterfaceClass    :    0x3 Human Interface Device
     bInterfaceSubClass :    0x0
     bInterfaceProtocol :    0x0
     iInterface         :    0x8 PS VR Control
      ENDPOINT 0x84: Interrupt IN ==========================
       bLength          :    0x7 (7 bytes)
       bDescriptorType  :    0x5 Endpoint
       bEndpointAddress :   0x84 IN
       bmAttributes     :    0x3 Interrupt
       wMaxPacketSize   :   0x40 (64 bytes)
       bInterval        :    0x4
      ENDPOINT 0x4: Interrupt OUT ==========================
       bLength          :    0x7 (7 bytes)
       bDescriptorType  :    0x5 Endpoint
       bEndpointAddress :    0x4 OUT
       bmAttributes     :    0x3 Interrupt
       wMaxPacketSize   :   0x40 (64 bytes)
       bInterval        :    0x4

In addition to the inherent USB protocol, Sony has an additional layer. Wrapping the data to write or read with a header as follows. This header is the first 4 bytes of the USB packet, and is followed by the data.

Byte offset	Length (in bytes)	Description
0x00	1	Command/Register
0x01	1	Sub-Register?
0x02	1	Magic Byte - always '0xAA'
0x03	1	Length, the number of bytes in following data (4, 8, or 16).

Commands are sent from controlling PC/PS4, the response is return within a report of the same format. Some reports are autonomously sent to the PC/PS4 from the PSVR.

We discovered that the PSVR will (usefully) advise some error messages when the commands sent to it don't match what it is expecting. So far we have seen 3 types of error.

'Bad R-ID' when a request is sent to command register that does not exist.

'Bad Length' when a request contains the wrong number of data bytes.

'Bad sidetone value' when a request contains an 'out of range' value. This has only been seen with report 0x21, so far...