1 // SPDX-License-Identifier: GPL-2.0
2 /*
3 * When connected to the machine, the Thrustmaster wheels appear as
4 * a «generic» hid gamepad called "Thrustmaster FFB Wheel".
5 *
6 * When in this mode not every functionality of the wheel, like the force feedback,
7 * are available. To enable all functionalities of a Thrustmaster wheel we have to send
8 * to it a specific USB CONTROL request with a code different for each wheel.
9 *
10 * This driver tries to understand which model of Thrustmaster wheel the generic
11 * "Thrustmaster FFB Wheel" really is and then sends the appropriate control code.
12 *
13 * Copyright (c) 2020-2021 Dario Pagani <dario.pagani.146+linuxk@gmail.com>
14 * Copyright (c) 2020-2021 Kim Kuparinen <kimi.h.kuparinen@gmail.com>
15 */
16 #include <linux/hid.h>
17 #include <linux/usb.h>
18 #include <linux/input.h>
19 #include <linux/slab.h>
20 #include <linux/module.h>
21
22 /*
23 * These interrupts are used to prevent a nasty crash when initializing the
24 * T300RS. Used in thrustmaster_interrupts().
25 */
26 static const u8 setup_0[] = { 0x42, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
27 static const u8 setup_1[] = { 0x0a, 0x04, 0x90, 0x03, 0x00, 0x00, 0x00, 0x00 };
28 static const u8 setup_2[] = { 0x0a, 0x04, 0x00, 0x0c, 0x00, 0x00, 0x00, 0x00 };
29 static const u8 setup_3[] = { 0x0a, 0x04, 0x12, 0x10, 0x00, 0x00, 0x00, 0x00 };
30 static const u8 setup_4[] = { 0x0a, 0x04, 0x00, 0x06, 0x00, 0x00, 0x00, 0x00 };
31 static const u8 *const setup_arr[] = { setup_0, setup_1, setup_2, setup_3, setup_4 };
32 static const unsigned int setup_arr_sizes[] = {
33 ARRAY_SIZE(setup_0),
34 ARRAY_SIZE(setup_1),
35 ARRAY_SIZE(setup_2),
36 ARRAY_SIZE(setup_3),
37 ARRAY_SIZE(setup_4)
38 };
39 /*
40 * This struct contains for each type of
41 * Thrustmaster wheel
42 *
43 * Note: The values are stored in the CPU
44 * endianness, the USB protocols always use
45 * little endian; the macro cpu_to_le[BIT]()
46 * must be used when preparing USB packets
47 * and vice-versa
48 */
49 struct tm_wheel_info {
50 uint16_t wheel_type;
51
52 /*
53 * See when the USB control out packet is prepared...
54 * @TODO The TMX seems to require multiple control codes to switch.
55 */
56 uint16_t switch_value;
57
58 char const *const wheel_name;
59 };
60
61 /*
62 * Known wheels.
63 * Note: TMX does not work as it requires 2 control packets
64 */
65 static const struct tm_wheel_info tm_wheels_infos[] = {
66 {0x0306, 0x0006, "Thrustmaster T150RS"},
67 {0x0200, 0x0005, "Thrustmaster T300RS (Missing Attachment)"},
68 {0x0206, 0x0005, "Thrustmaster T300RS"},
69 {0x0209, 0x0005, "Thrustmaster T300RS (Open Wheel Attachment)"},
70 {0x020a, 0x0005, "Thrustmaster T300RS (Sparco R383 Mod)"},
71 {0x0204, 0x0005, "Thrustmaster T300 Ferrari Alcantara Edition"},
72 {0x0002, 0x0002, "Thrustmaster T500RS"}
73 //{0x0407, 0x0001, "Thrustmaster TMX"}
74 };
75
76 static const uint8_t tm_wheels_infos_length = 7;
77
78 /*
79 * This structs contains (in little endian) the response data
80 * of the wheel to the request 73
81 *
82 * A sufficient research to understand what each field does is not
83 * beign conducted yet. The position and meaning of fields are a
84 * just a very optimistic guess based on instinct....
85 */
86 struct __packed tm_wheel_response
87 {
88 /*
89 * Seems to be the type of packet
90 * - 0x0049 if is data.a (15 bytes)
91 * - 0x0047 if is data.b (7 bytes)
92 */
93 uint16_t type;
94
95 union {
96 struct __packed {
97 uint16_t field0;
98 uint16_t field1;
99 /*
100 * Seems to be the model code of the wheel
101 * Read table thrustmaster_wheels to values
102 */
103 uint16_t model;
104
105 uint16_t field2;
106 uint16_t field3;
107 uint16_t field4;
108 uint16_t field5;
109 } a;
110 struct __packed {
111 uint16_t field0;
112 uint16_t field1;
113 uint16_t model;
114 } b;
115 } data;
116 };
117
118 struct tm_wheel {
119 struct usb_device *usb_dev;
120 struct urb *urb;
121
122 struct usb_ctrlrequest *model_request;
123 struct tm_wheel_response *response;
124
125 struct usb_ctrlrequest *change_request;
126 };
127
128 /* The control packet to send to wheel */
129 static const struct usb_ctrlrequest model_request = {
130 .bRequestType = 0xc1,
131 .bRequest = 73,
132 .wValue = 0,
133 .wIndex = 0,
134 .wLength = cpu_to_le16(0x0010)
135 };
136
137 static const struct usb_ctrlrequest change_request = {
138 .bRequestType = 0x41,
139 .bRequest = 83,
140 .wValue = 0, // Will be filled by the driver
141 .wIndex = 0,
142 .wLength = 0
143 };
144
145 /*
146 * On some setups initializing the T300RS crashes the kernel,
147 * these interrupts fix that particular issue. So far they haven't caused any
148 * adverse effects in other wheels.
149 */
thrustmaster_interrupts(struct hid_device * hdev)150 static void thrustmaster_interrupts(struct hid_device *hdev)
151 {
152 int ret, trans, i, b_ep;
153 u8 *send_buf = kmalloc(256, GFP_KERNEL);
154 struct usb_host_endpoint *ep;
155 struct device *dev = &hdev->dev;
156 struct usb_interface *usbif = to_usb_interface(dev->parent);
157 struct usb_device *usbdev = interface_to_usbdev(usbif);
158
159 if (!send_buf) {
160 hid_err(hdev, "failed allocating send buffer\n");
161 return;
162 }
163
164 if (usbif->cur_altsetting->desc.bNumEndpoints < 2) {
165 kfree(send_buf);
166 hid_err(hdev, "Wrong number of endpoints?\n");
167 return;
168 }
169
170 ep = &usbif->cur_altsetting->endpoint[1];
171 b_ep = ep->desc.bEndpointAddress;
172
173 /* Are the expected endpoints present? */
174 u8 ep_addr[2] = {b_ep, 0};
175
176 if (!usb_check_int_endpoints(usbif, ep_addr)) {
177 kfree(send_buf);
178 hid_err(hdev, "Unexpected non-int endpoint\n");
179 return;
180 }
181
182 for (i = 0; i < ARRAY_SIZE(setup_arr); ++i) {
183 memcpy(send_buf, setup_arr[i], setup_arr_sizes[i]);
184
185 ret = usb_interrupt_msg(usbdev,
186 usb_sndintpipe(usbdev, b_ep),
187 send_buf,
188 setup_arr_sizes[i],
189 &trans,
190 USB_CTRL_SET_TIMEOUT);
191
192 if (ret) {
193 hid_err(hdev, "setup data couldn't be sent\n");
194 kfree(send_buf);
195 return;
196 }
197 }
198
199 kfree(send_buf);
200 }
201
thrustmaster_change_handler(struct urb * urb)202 static void thrustmaster_change_handler(struct urb *urb)
203 {
204 struct hid_device *hdev = urb->context;
205
206 // The wheel seems to kill himself before answering the host and therefore is violating the USB protocol...
207 if (urb->status == 0 || urb->status == -EPROTO || urb->status == -EPIPE)
208 hid_info(hdev, "Success?! The wheel should have been initialized!\n");
209 else
210 hid_warn(hdev, "URB to change wheel mode seems to have failed with error %d\n", urb->status);
211 }
212
213 /*
214 * Called by the USB subsystem when the wheel responses to our request
215 * to get [what it seems to be] the wheel's model.
216 *
217 * If the model id is recognized then we send an opportune USB CONTROL REQUEST
218 * to switch the wheel to its full capabilities
219 */
thrustmaster_model_handler(struct urb * urb)220 static void thrustmaster_model_handler(struct urb *urb)
221 {
222 struct hid_device *hdev = urb->context;
223 struct tm_wheel *tm_wheel = hid_get_drvdata(hdev);
224 uint16_t model = 0;
225 int i, ret;
226 const struct tm_wheel_info *twi = NULL;
227
228 if (urb->status) {
229 hid_err(hdev, "URB to get model id failed with error %d\n", urb->status);
230 return;
231 }
232
233 if (tm_wheel->response->type == cpu_to_le16(0x49))
234 model = le16_to_cpu(tm_wheel->response->data.a.model);
235 else if (tm_wheel->response->type == cpu_to_le16(0x47))
236 model = le16_to_cpu(tm_wheel->response->data.b.model);
237 else {
238 hid_err(hdev, "Unknown packet type 0x%x, unable to proceed further with wheel init\n", tm_wheel->response->type);
239 return;
240 }
241
242 for (i = 0; i < tm_wheels_infos_length && !twi; i++)
243 if (tm_wheels_infos[i].wheel_type == model)
244 twi = tm_wheels_infos + i;
245
246 if (twi)
247 hid_info(hdev, "Wheel with model id 0x%x is a %s\n", model, twi->wheel_name);
248 else {
249 hid_err(hdev, "Unknown wheel's model id 0x%x, unable to proceed further with wheel init\n", model);
250 return;
251 }
252
253 tm_wheel->change_request->wValue = cpu_to_le16(twi->switch_value);
254 usb_fill_control_urb(
255 tm_wheel->urb,
256 tm_wheel->usb_dev,
257 usb_sndctrlpipe(tm_wheel->usb_dev, 0),
258 (char *)tm_wheel->change_request,
259 NULL, 0, // We do not expect any response from the wheel
260 thrustmaster_change_handler,
261 hdev
262 );
263
264 ret = usb_submit_urb(tm_wheel->urb, GFP_ATOMIC);
265 if (ret)
266 hid_err(hdev, "Error %d while submitting the change URB. I am unable to initialize this wheel...\n", ret);
267 }
268
thrustmaster_remove(struct hid_device * hdev)269 static void thrustmaster_remove(struct hid_device *hdev)
270 {
271 struct tm_wheel *tm_wheel = hid_get_drvdata(hdev);
272
273 usb_kill_urb(tm_wheel->urb);
274
275 kfree(tm_wheel->change_request);
276 kfree(tm_wheel->response);
277 kfree(tm_wheel->model_request);
278 usb_free_urb(tm_wheel->urb);
279 kfree(tm_wheel);
280
281 hid_hw_stop(hdev);
282 }
283
284 /*
285 * Function called by HID when a hid Thrustmaster FFB wheel is connected to the host.
286 * This function starts the hid dev, tries to allocate the tm_wheel data structure and
287 * finally send an USB CONTROL REQUEST to the wheel to get [what it seems to be] its
288 * model type.
289 */
thrustmaster_probe(struct hid_device * hdev,const struct hid_device_id * id)290 static int thrustmaster_probe(struct hid_device *hdev, const struct hid_device_id *id)
291 {
292 int ret = 0;
293 struct tm_wheel *tm_wheel = NULL;
294
295 if (!hid_is_usb(hdev))
296 return -EINVAL;
297
298 ret = hid_parse(hdev);
299 if (ret) {
300 hid_err(hdev, "parse failed with error %d\n", ret);
301 goto error0;
302 }
303
304 ret = hid_hw_start(hdev, HID_CONNECT_DEFAULT & ~HID_CONNECT_FF);
305 if (ret) {
306 hid_err(hdev, "hw start failed with error %d\n", ret);
307 goto error0;
308 }
309
310 // Now we allocate the tm_wheel
311 tm_wheel = kzalloc(sizeof(struct tm_wheel), GFP_KERNEL);
312 if (!tm_wheel) {
313 ret = -ENOMEM;
314 goto error1;
315 }
316
317 tm_wheel->urb = usb_alloc_urb(0, GFP_ATOMIC);
318 if (!tm_wheel->urb) {
319 ret = -ENOMEM;
320 goto error2;
321 }
322
323 tm_wheel->model_request = kmemdup(&model_request,
324 sizeof(struct usb_ctrlrequest),
325 GFP_KERNEL);
326 if (!tm_wheel->model_request) {
327 ret = -ENOMEM;
328 goto error3;
329 }
330
331 tm_wheel->response = kzalloc(sizeof(struct tm_wheel_response), GFP_KERNEL);
332 if (!tm_wheel->response) {
333 ret = -ENOMEM;
334 goto error4;
335 }
336
337 tm_wheel->change_request = kmemdup(&change_request,
338 sizeof(struct usb_ctrlrequest),
339 GFP_KERNEL);
340 if (!tm_wheel->change_request) {
341 ret = -ENOMEM;
342 goto error5;
343 }
344
345 tm_wheel->usb_dev = interface_to_usbdev(to_usb_interface(hdev->dev.parent));
346 hid_set_drvdata(hdev, tm_wheel);
347
348 thrustmaster_interrupts(hdev);
349
350 usb_fill_control_urb(
351 tm_wheel->urb,
352 tm_wheel->usb_dev,
353 usb_rcvctrlpipe(tm_wheel->usb_dev, 0),
354 (char *)tm_wheel->model_request,
355 tm_wheel->response,
356 sizeof(struct tm_wheel_response),
357 thrustmaster_model_handler,
358 hdev
359 );
360
361 ret = usb_submit_urb(tm_wheel->urb, GFP_ATOMIC);
362 if (ret) {
363 hid_err(hdev, "Error %d while submitting the URB. I am unable to initialize this wheel...\n", ret);
364 goto error6;
365 }
366
367 return ret;
368
369 error6: kfree(tm_wheel->change_request);
370 error5: kfree(tm_wheel->response);
371 error4: kfree(tm_wheel->model_request);
372 error3: usb_free_urb(tm_wheel->urb);
373 error2: kfree(tm_wheel);
374 error1: hid_hw_stop(hdev);
375 error0:
376 return ret;
377 }
378
379 static const struct hid_device_id thrustmaster_devices[] = {
380 { HID_USB_DEVICE(0x044f, 0xb65d)},
381 {}
382 };
383
384 MODULE_DEVICE_TABLE(hid, thrustmaster_devices);
385
386 static struct hid_driver thrustmaster_driver = {
387 .name = "hid-thrustmaster",
388 .id_table = thrustmaster_devices,
389 .probe = thrustmaster_probe,
390 .remove = thrustmaster_remove,
391 };
392
393 module_hid_driver(thrustmaster_driver);
394
395 MODULE_AUTHOR("Dario Pagani <dario.pagani.146+linuxk@gmail.com>");
396 MODULE_LICENSE("GPL");
397 MODULE_DESCRIPTION("Driver to initialize some steering wheel joysticks from Thrustmaster");
398
399