1 // SPDX-License-Identifier: GPL-2.0
2 /*
3  * When connected to the machine, the Thrustmaster wheels appear as
4  * a «generic» hid gamepad called "Thrustmaster FFB Wheel".
5  *
6  * When in this mode not every functionality of the wheel, like the force feedback,
7  * are available. To enable all functionalities of a Thrustmaster wheel we have to send
8  * to it a specific USB CONTROL request with a code different for each wheel.
9  *
10  * This driver tries to understand which model of Thrustmaster wheel the generic
11  * "Thrustmaster FFB Wheel" really is and then sends the appropriate control code.
12  *
13  * Copyright (c) 2020-2021 Dario Pagani <dario.pagani.146+linuxk@gmail.com>
14  * Copyright (c) 2020-2021 Kim Kuparinen <kimi.h.kuparinen@gmail.com>
15  */
16 #include <linux/hid.h>
17 #include <linux/usb.h>
18 #include <linux/input.h>
19 #include <linux/slab.h>
20 #include <linux/module.h>
21 
22 /*
23  * These interrupts are used to prevent a nasty crash when initializing the
24  * T300RS. Used in thrustmaster_interrupts().
25  */
26 static const u8 setup_0[] = { 0x42, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
27 static const u8 setup_1[] = { 0x0a, 0x04, 0x90, 0x03, 0x00, 0x00, 0x00, 0x00 };
28 static const u8 setup_2[] = { 0x0a, 0x04, 0x00, 0x0c, 0x00, 0x00, 0x00, 0x00 };
29 static const u8 setup_3[] = { 0x0a, 0x04, 0x12, 0x10, 0x00, 0x00, 0x00, 0x00 };
30 static const u8 setup_4[] = { 0x0a, 0x04, 0x00, 0x06, 0x00, 0x00, 0x00, 0x00 };
31 static const u8 *const setup_arr[] = { setup_0, setup_1, setup_2, setup_3, setup_4 };
32 static const unsigned int setup_arr_sizes[] = {
33 	ARRAY_SIZE(setup_0),
34 	ARRAY_SIZE(setup_1),
35 	ARRAY_SIZE(setup_2),
36 	ARRAY_SIZE(setup_3),
37 	ARRAY_SIZE(setup_4)
38 };
39 /*
40  * This struct contains for each type of
41  * Thrustmaster wheel
42  *
43  * Note: The values are stored in the CPU
44  * endianness, the USB protocols always use
45  * little endian; the macro cpu_to_le[BIT]()
46  * must be used when preparing USB packets
47  * and vice-versa
48  */
49 struct tm_wheel_info {
50 	uint16_t wheel_type;
51 
52 	/*
53 	 * See when the USB control out packet is prepared...
54 	 * @TODO The TMX seems to require multiple control codes to switch.
55 	 */
56 	uint16_t switch_value;
57 
58 	char const *const wheel_name;
59 };
60 
61 /*
62  * Known wheels.
63  * Note: TMX does not work as it requires 2 control packets
64  */
65 static const struct tm_wheel_info tm_wheels_infos[] = {
66 	{0x0306, 0x0006, "Thrustmaster T150RS"},
67 	{0x0200, 0x0005, "Thrustmaster T300RS (Missing Attachment)"},
68 	{0x0206, 0x0005, "Thrustmaster T300RS"},
69 	{0x0209, 0x0005, "Thrustmaster T300RS (Open Wheel Attachment)"},
70 	{0x020a, 0x0005, "Thrustmaster T300RS (Sparco R383 Mod)"},
71 	{0x0204, 0x0005, "Thrustmaster T300 Ferrari Alcantara Edition"},
72 	{0x0002, 0x0002, "Thrustmaster T500RS"}
73 	//{0x0407, 0x0001, "Thrustmaster TMX"}
74 };
75 
76 static const uint8_t tm_wheels_infos_length = 7;
77 
78 /*
79  * This structs contains (in little endian) the response data
80  * of the wheel to the request 73
81  *
82  * A sufficient research to understand what each field does is not
83  * beign conducted yet. The position and meaning of fields are a
84  * just a very optimistic guess based on instinct....
85  */
86 struct __packed tm_wheel_response
87 {
88 	/*
89 	 * Seems to be the type of packet
90 	 * - 0x0049 if is data.a (15 bytes)
91 	 * - 0x0047 if is data.b (7 bytes)
92 	 */
93 	uint16_t type;
94 
95 	union {
96 		struct __packed {
97 			uint16_t field0;
98 			uint16_t field1;
99 			/*
100 			 * Seems to be the model code of the wheel
101 			 * Read table thrustmaster_wheels to values
102 			 */
103 			uint16_t model;
104 
105 			uint16_t field2;
106 			uint16_t field3;
107 			uint16_t field4;
108 			uint16_t field5;
109 		} a;
110 		struct __packed {
111 			uint16_t field0;
112 			uint16_t field1;
113 			uint16_t model;
114 		} b;
115 	} data;
116 };
117 
118 struct tm_wheel {
119 	struct usb_device *usb_dev;
120 	struct urb *urb;
121 
122 	struct usb_ctrlrequest *model_request;
123 	struct tm_wheel_response *response;
124 
125 	struct usb_ctrlrequest *change_request;
126 };
127 
128 /* The control packet to send to wheel */
129 static const struct usb_ctrlrequest model_request = {
130 	.bRequestType = 0xc1,
131 	.bRequest = 73,
132 	.wValue = 0,
133 	.wIndex = 0,
134 	.wLength = cpu_to_le16(0x0010)
135 };
136 
137 static const struct usb_ctrlrequest change_request = {
138 	.bRequestType = 0x41,
139 	.bRequest = 83,
140 	.wValue = 0, // Will be filled by the driver
141 	.wIndex = 0,
142 	.wLength = 0
143 };
144 
145 /*
146  * On some setups initializing the T300RS crashes the kernel,
147  * these interrupts fix that particular issue. So far they haven't caused any
148  * adverse effects in other wheels.
149  */
thrustmaster_interrupts(struct hid_device * hdev)150 static void thrustmaster_interrupts(struct hid_device *hdev)
151 {
152 	int ret, trans, i, b_ep;
153 	u8 *send_buf = kmalloc(256, GFP_KERNEL);
154 	struct usb_host_endpoint *ep;
155 	struct device *dev = &hdev->dev;
156 	struct usb_interface *usbif = to_usb_interface(dev->parent);
157 	struct usb_device *usbdev = interface_to_usbdev(usbif);
158 
159 	if (!send_buf) {
160 		hid_err(hdev, "failed allocating send buffer\n");
161 		return;
162 	}
163 
164 	if (usbif->cur_altsetting->desc.bNumEndpoints < 2) {
165 		kfree(send_buf);
166 		hid_err(hdev, "Wrong number of endpoints?\n");
167 		return;
168 	}
169 
170 	ep = &usbif->cur_altsetting->endpoint[1];
171 	b_ep = ep->desc.bEndpointAddress;
172 
173 	for (i = 0; i < ARRAY_SIZE(setup_arr); ++i) {
174 		memcpy(send_buf, setup_arr[i], setup_arr_sizes[i]);
175 
176 		ret = usb_interrupt_msg(usbdev,
177 			usb_sndintpipe(usbdev, b_ep),
178 			send_buf,
179 			setup_arr_sizes[i],
180 			&trans,
181 			USB_CTRL_SET_TIMEOUT);
182 
183 		if (ret) {
184 			hid_err(hdev, "setup data couldn't be sent\n");
185 			kfree(send_buf);
186 			return;
187 		}
188 	}
189 
190 	kfree(send_buf);
191 }
192 
thrustmaster_change_handler(struct urb * urb)193 static void thrustmaster_change_handler(struct urb *urb)
194 {
195 	struct hid_device *hdev = urb->context;
196 
197 	// The wheel seems to kill himself before answering the host and therefore is violating the USB protocol...
198 	if (urb->status == 0 || urb->status == -EPROTO || urb->status == -EPIPE)
199 		hid_info(hdev, "Success?! The wheel should have been initialized!\n");
200 	else
201 		hid_warn(hdev, "URB to change wheel mode seems to have failed with error %d\n", urb->status);
202 }
203 
204 /*
205  * Called by the USB subsystem when the wheel responses to our request
206  * to get [what it seems to be] the wheel's model.
207  *
208  * If the model id is recognized then we send an opportune USB CONTROL REQUEST
209  * to switch the wheel to its full capabilities
210  */
thrustmaster_model_handler(struct urb * urb)211 static void thrustmaster_model_handler(struct urb *urb)
212 {
213 	struct hid_device *hdev = urb->context;
214 	struct tm_wheel *tm_wheel = hid_get_drvdata(hdev);
215 	uint16_t model = 0;
216 	int i, ret;
217 	const struct tm_wheel_info *twi = NULL;
218 
219 	if (urb->status) {
220 		hid_err(hdev, "URB to get model id failed with error %d\n", urb->status);
221 		return;
222 	}
223 
224 	if (tm_wheel->response->type == cpu_to_le16(0x49))
225 		model = le16_to_cpu(tm_wheel->response->data.a.model);
226 	else if (tm_wheel->response->type == cpu_to_le16(0x47))
227 		model = le16_to_cpu(tm_wheel->response->data.b.model);
228 	else {
229 		hid_err(hdev, "Unknown packet type 0x%x, unable to proceed further with wheel init\n", tm_wheel->response->type);
230 		return;
231 	}
232 
233 	for (i = 0; i < tm_wheels_infos_length && !twi; i++)
234 		if (tm_wheels_infos[i].wheel_type == model)
235 			twi = tm_wheels_infos + i;
236 
237 	if (twi)
238 		hid_info(hdev, "Wheel with model id 0x%x is a %s\n", model, twi->wheel_name);
239 	else {
240 		hid_err(hdev, "Unknown wheel's model id 0x%x, unable to proceed further with wheel init\n", model);
241 		return;
242 	}
243 
244 	tm_wheel->change_request->wValue = cpu_to_le16(twi->switch_value);
245 	usb_fill_control_urb(
246 		tm_wheel->urb,
247 		tm_wheel->usb_dev,
248 		usb_sndctrlpipe(tm_wheel->usb_dev, 0),
249 		(char *)tm_wheel->change_request,
250 		NULL, 0, // We do not expect any response from the wheel
251 		thrustmaster_change_handler,
252 		hdev
253 	);
254 
255 	ret = usb_submit_urb(tm_wheel->urb, GFP_ATOMIC);
256 	if (ret)
257 		hid_err(hdev, "Error %d while submitting the change URB. I am unable to initialize this wheel...\n", ret);
258 }
259 
thrustmaster_remove(struct hid_device * hdev)260 static void thrustmaster_remove(struct hid_device *hdev)
261 {
262 	struct tm_wheel *tm_wheel = hid_get_drvdata(hdev);
263 
264 	usb_kill_urb(tm_wheel->urb);
265 
266 	kfree(tm_wheel->change_request);
267 	kfree(tm_wheel->response);
268 	kfree(tm_wheel->model_request);
269 	usb_free_urb(tm_wheel->urb);
270 	kfree(tm_wheel);
271 
272 	hid_hw_stop(hdev);
273 }
274 
275 /*
276  * Function called by HID when a hid Thrustmaster FFB wheel is connected to the host.
277  * This function starts the hid dev, tries to allocate the tm_wheel data structure and
278  * finally send an USB CONTROL REQUEST to the wheel to get [what it seems to be] its
279  * model type.
280  */
thrustmaster_probe(struct hid_device * hdev,const struct hid_device_id * id)281 static int thrustmaster_probe(struct hid_device *hdev, const struct hid_device_id *id)
282 {
283 	int ret = 0;
284 	struct tm_wheel *tm_wheel = NULL;
285 
286 	if (!hid_is_usb(hdev))
287 		return -EINVAL;
288 
289 	ret = hid_parse(hdev);
290 	if (ret) {
291 		hid_err(hdev, "parse failed with error %d\n", ret);
292 		goto error0;
293 	}
294 
295 	ret = hid_hw_start(hdev, HID_CONNECT_DEFAULT & ~HID_CONNECT_FF);
296 	if (ret) {
297 		hid_err(hdev, "hw start failed with error %d\n", ret);
298 		goto error0;
299 	}
300 
301 	// Now we allocate the tm_wheel
302 	tm_wheel = kzalloc(sizeof(struct tm_wheel), GFP_KERNEL);
303 	if (!tm_wheel) {
304 		ret = -ENOMEM;
305 		goto error1;
306 	}
307 
308 	tm_wheel->urb = usb_alloc_urb(0, GFP_ATOMIC);
309 	if (!tm_wheel->urb) {
310 		ret = -ENOMEM;
311 		goto error2;
312 	}
313 
314 	tm_wheel->model_request = kmemdup(&model_request,
315 					  sizeof(struct usb_ctrlrequest),
316 					  GFP_KERNEL);
317 	if (!tm_wheel->model_request) {
318 		ret = -ENOMEM;
319 		goto error3;
320 	}
321 
322 	tm_wheel->response = kzalloc(sizeof(struct tm_wheel_response), GFP_KERNEL);
323 	if (!tm_wheel->response) {
324 		ret = -ENOMEM;
325 		goto error4;
326 	}
327 
328 	tm_wheel->change_request = kmemdup(&change_request,
329 					   sizeof(struct usb_ctrlrequest),
330 					   GFP_KERNEL);
331 	if (!tm_wheel->change_request) {
332 		ret = -ENOMEM;
333 		goto error5;
334 	}
335 
336 	tm_wheel->usb_dev = interface_to_usbdev(to_usb_interface(hdev->dev.parent));
337 	hid_set_drvdata(hdev, tm_wheel);
338 
339 	thrustmaster_interrupts(hdev);
340 
341 	usb_fill_control_urb(
342 		tm_wheel->urb,
343 		tm_wheel->usb_dev,
344 		usb_rcvctrlpipe(tm_wheel->usb_dev, 0),
345 		(char *)tm_wheel->model_request,
346 		tm_wheel->response,
347 		sizeof(struct tm_wheel_response),
348 		thrustmaster_model_handler,
349 		hdev
350 	);
351 
352 	ret = usb_submit_urb(tm_wheel->urb, GFP_ATOMIC);
353 	if (ret) {
354 		hid_err(hdev, "Error %d while submitting the URB. I am unable to initialize this wheel...\n", ret);
355 		goto error6;
356 	}
357 
358 	return ret;
359 
360 error6: kfree(tm_wheel->change_request);
361 error5: kfree(tm_wheel->response);
362 error4: kfree(tm_wheel->model_request);
363 error3: usb_free_urb(tm_wheel->urb);
364 error2: kfree(tm_wheel);
365 error1: hid_hw_stop(hdev);
366 error0:
367 	return ret;
368 }
369 
370 static const struct hid_device_id thrustmaster_devices[] = {
371 	{ HID_USB_DEVICE(0x044f, 0xb65d)},
372 	{}
373 };
374 
375 MODULE_DEVICE_TABLE(hid, thrustmaster_devices);
376 
377 static struct hid_driver thrustmaster_driver = {
378 	.name = "hid-thrustmaster",
379 	.id_table = thrustmaster_devices,
380 	.probe = thrustmaster_probe,
381 	.remove = thrustmaster_remove,
382 };
383 
384 module_hid_driver(thrustmaster_driver);
385 
386 MODULE_AUTHOR("Dario Pagani <dario.pagani.146+linuxk@gmail.com>");
387 MODULE_LICENSE("GPL");
388 MODULE_DESCRIPTION("Driver to initialize some steering wheel joysticks from Thrustmaster");
389 
390