cachepc-linux

Fork of AMDESE/linux with modifications for CachePC side-channel attack
git clone https://git.sinitax.com/sinitax/cachepc-linux
Log | Files | Refs | README | LICENSE | sfeed.txt

hid-thrustmaster.c (10673B)


      1// SPDX-License-Identifier: GPL-2.0
      2/*
      3 * When connected to the machine, the Thrustmaster wheels appear as
      4 * a «generic» hid gamepad called "Thrustmaster FFB Wheel".
      5 *
      6 * When in this mode not every functionality of the wheel, like the force feedback,
      7 * are available. To enable all functionalities of a Thrustmaster wheel we have to send
      8 * to it a specific USB CONTROL request with a code different for each wheel.
      9 *
     10 * This driver tries to understand which model of Thrustmaster wheel the generic
     11 * "Thrustmaster FFB Wheel" really is and then sends the appropriate control code.
     12 *
     13 * Copyright (c) 2020-2021 Dario Pagani <dario.pagani.146+linuxk@gmail.com>
     14 * Copyright (c) 2020-2021 Kim Kuparinen <kimi.h.kuparinen@gmail.com>
     15 */
     16#include <linux/hid.h>
     17#include <linux/usb.h>
     18#include <linux/input.h>
     19#include <linux/slab.h>
     20#include <linux/module.h>
     21
     22/*
     23 * These interrupts are used to prevent a nasty crash when initializing the
     24 * T300RS. Used in thrustmaster_interrupts().
     25 */
     26static const u8 setup_0[] = { 0x42, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
     27static const u8 setup_1[] = { 0x0a, 0x04, 0x90, 0x03, 0x00, 0x00, 0x00, 0x00 };
     28static const u8 setup_2[] = { 0x0a, 0x04, 0x00, 0x0c, 0x00, 0x00, 0x00, 0x00 };
     29static const u8 setup_3[] = { 0x0a, 0x04, 0x12, 0x10, 0x00, 0x00, 0x00, 0x00 };
     30static const u8 setup_4[] = { 0x0a, 0x04, 0x00, 0x06, 0x00, 0x00, 0x00, 0x00 };
     31static const u8 *const setup_arr[] = { setup_0, setup_1, setup_2, setup_3, setup_4 };
     32static const unsigned int setup_arr_sizes[] = {
     33	ARRAY_SIZE(setup_0),
     34	ARRAY_SIZE(setup_1),
     35	ARRAY_SIZE(setup_2),
     36	ARRAY_SIZE(setup_3),
     37	ARRAY_SIZE(setup_4)
     38};
     39/*
     40 * This struct contains for each type of
     41 * Thrustmaster wheel
     42 *
     43 * Note: The values are stored in the CPU
     44 * endianness, the USB protocols always use
     45 * little endian; the macro cpu_to_le[BIT]()
     46 * must be used when preparing USB packets
     47 * and vice-versa
     48 */
     49struct tm_wheel_info {
     50	uint16_t wheel_type;
     51
     52	/*
     53	 * See when the USB control out packet is prepared...
     54	 * @TODO The TMX seems to require multiple control codes to switch.
     55	 */
     56	uint16_t switch_value;
     57
     58	char const *const wheel_name;
     59};
     60
     61/*
     62 * Known wheels.
     63 * Note: TMX does not work as it requires 2 control packets
     64 */
     65static const struct tm_wheel_info tm_wheels_infos[] = {
     66	{0x0306, 0x0006, "Thrustmaster T150RS"},
     67	{0x0200, 0x0005, "Thrustmaster T300RS (Missing Attachment)"},
     68	{0x0206, 0x0005, "Thrustmaster T300RS"},
     69	{0x0209, 0x0005, "Thrustmaster T300RS (Open Wheel Attachment)"},
     70	{0x0204, 0x0005, "Thrustmaster T300 Ferrari Alcantara Edition"},
     71	{0x0002, 0x0002, "Thrustmaster T500RS"}
     72	//{0x0407, 0x0001, "Thrustmaster TMX"}
     73};
     74
     75static const uint8_t tm_wheels_infos_length = 4;
     76
     77/*
     78 * This structs contains (in little endian) the response data
     79 * of the wheel to the request 73
     80 *
     81 * A sufficient research to understand what each field does is not
     82 * beign conducted yet. The position and meaning of fields are a
     83 * just a very optimistic guess based on instinct....
     84 */
     85struct __packed tm_wheel_response
     86{
     87	/*
     88	 * Seems to be the type of packet
     89	 * - 0x0049 if is data.a (15 bytes)
     90	 * - 0x0047 if is data.b (7 bytes)
     91	 */
     92	uint16_t type;
     93
     94	union {
     95		struct __packed {
     96			uint16_t field0;
     97			uint16_t field1;
     98			/*
     99			 * Seems to be the model code of the wheel
    100			 * Read table thrustmaster_wheels to values
    101			 */
    102			uint16_t model;
    103
    104			uint16_t field2;
    105			uint16_t field3;
    106			uint16_t field4;
    107			uint16_t field5;
    108		} a;
    109		struct __packed {
    110			uint16_t field0;
    111			uint16_t field1;
    112			uint16_t model;
    113		} b;
    114	} data;
    115};
    116
    117struct tm_wheel {
    118	struct usb_device *usb_dev;
    119	struct urb *urb;
    120
    121	struct usb_ctrlrequest *model_request;
    122	struct tm_wheel_response *response;
    123
    124	struct usb_ctrlrequest *change_request;
    125};
    126
    127/* The control packet to send to wheel */
    128static const struct usb_ctrlrequest model_request = {
    129	.bRequestType = 0xc1,
    130	.bRequest = 73,
    131	.wValue = 0,
    132	.wIndex = 0,
    133	.wLength = cpu_to_le16(0x0010)
    134};
    135
    136static const struct usb_ctrlrequest change_request = {
    137	.bRequestType = 0x41,
    138	.bRequest = 83,
    139	.wValue = 0, // Will be filled by the driver
    140	.wIndex = 0,
    141	.wLength = 0
    142};
    143
    144/*
    145 * On some setups initializing the T300RS crashes the kernel,
    146 * these interrupts fix that particular issue. So far they haven't caused any
    147 * adverse effects in other wheels.
    148 */
    149static void thrustmaster_interrupts(struct hid_device *hdev)
    150{
    151	int ret, trans, i, b_ep;
    152	u8 *send_buf = kmalloc(256, GFP_KERNEL);
    153	struct usb_host_endpoint *ep;
    154	struct device *dev = &hdev->dev;
    155	struct usb_interface *usbif = to_usb_interface(dev->parent);
    156	struct usb_device *usbdev = interface_to_usbdev(usbif);
    157
    158	if (!send_buf) {
    159		hid_err(hdev, "failed allocating send buffer\n");
    160		return;
    161	}
    162
    163	if (usbif->cur_altsetting->desc.bNumEndpoints < 2) {
    164		kfree(send_buf);
    165		hid_err(hdev, "Wrong number of endpoints?\n");
    166		return;
    167	}
    168
    169	ep = &usbif->cur_altsetting->endpoint[1];
    170	b_ep = ep->desc.bEndpointAddress;
    171
    172	for (i = 0; i < ARRAY_SIZE(setup_arr); ++i) {
    173		memcpy(send_buf, setup_arr[i], setup_arr_sizes[i]);
    174
    175		ret = usb_interrupt_msg(usbdev,
    176			usb_sndintpipe(usbdev, b_ep),
    177			send_buf,
    178			setup_arr_sizes[i],
    179			&trans,
    180			USB_CTRL_SET_TIMEOUT);
    181
    182		if (ret) {
    183			hid_err(hdev, "setup data couldn't be sent\n");
    184			kfree(send_buf);
    185			return;
    186		}
    187	}
    188
    189	kfree(send_buf);
    190}
    191
    192static void thrustmaster_change_handler(struct urb *urb)
    193{
    194	struct hid_device *hdev = urb->context;
    195
    196	// The wheel seems to kill himself before answering the host and therefore is violating the USB protocol...
    197	if (urb->status == 0 || urb->status == -EPROTO || urb->status == -EPIPE)
    198		hid_info(hdev, "Success?! The wheel should have been initialized!\n");
    199	else
    200		hid_warn(hdev, "URB to change wheel mode seems to have failed with error %d\n", urb->status);
    201}
    202
    203/*
    204 * Called by the USB subsystem when the wheel responses to our request
    205 * to get [what it seems to be] the wheel's model.
    206 *
    207 * If the model id is recognized then we send an opportune USB CONTROL REQUEST
    208 * to switch the wheel to its full capabilities
    209 */
    210static void thrustmaster_model_handler(struct urb *urb)
    211{
    212	struct hid_device *hdev = urb->context;
    213	struct tm_wheel *tm_wheel = hid_get_drvdata(hdev);
    214	uint16_t model = 0;
    215	int i, ret;
    216	const struct tm_wheel_info *twi = NULL;
    217
    218	if (urb->status) {
    219		hid_err(hdev, "URB to get model id failed with error %d\n", urb->status);
    220		return;
    221	}
    222
    223	if (tm_wheel->response->type == cpu_to_le16(0x49))
    224		model = le16_to_cpu(tm_wheel->response->data.a.model);
    225	else if (tm_wheel->response->type == cpu_to_le16(0x47))
    226		model = le16_to_cpu(tm_wheel->response->data.b.model);
    227	else {
    228		hid_err(hdev, "Unknown packet type 0x%x, unable to proceed further with wheel init\n", tm_wheel->response->type);
    229		return;
    230	}
    231
    232	for (i = 0; i < tm_wheels_infos_length && !twi; i++)
    233		if (tm_wheels_infos[i].wheel_type == model)
    234			twi = tm_wheels_infos + i;
    235
    236	if (twi)
    237		hid_info(hdev, "Wheel with model id 0x%x is a %s\n", model, twi->wheel_name);
    238	else {
    239		hid_err(hdev, "Unknown wheel's model id 0x%x, unable to proceed further with wheel init\n", model);
    240		return;
    241	}
    242
    243	tm_wheel->change_request->wValue = cpu_to_le16(twi->switch_value);
    244	usb_fill_control_urb(
    245		tm_wheel->urb,
    246		tm_wheel->usb_dev,
    247		usb_sndctrlpipe(tm_wheel->usb_dev, 0),
    248		(char *)tm_wheel->change_request,
    249		NULL, 0, // We do not expect any response from the wheel
    250		thrustmaster_change_handler,
    251		hdev
    252	);
    253
    254	ret = usb_submit_urb(tm_wheel->urb, GFP_ATOMIC);
    255	if (ret)
    256		hid_err(hdev, "Error %d while submitting the change URB. I am unable to initialize this wheel...\n", ret);
    257}
    258
    259static void thrustmaster_remove(struct hid_device *hdev)
    260{
    261	struct tm_wheel *tm_wheel = hid_get_drvdata(hdev);
    262
    263	usb_kill_urb(tm_wheel->urb);
    264
    265	kfree(tm_wheel->change_request);
    266	kfree(tm_wheel->response);
    267	kfree(tm_wheel->model_request);
    268	usb_free_urb(tm_wheel->urb);
    269	kfree(tm_wheel);
    270
    271	hid_hw_stop(hdev);
    272}
    273
    274/*
    275 * Function called by HID when a hid Thrustmaster FFB wheel is connected to the host.
    276 * This function starts the hid dev, tries to allocate the tm_wheel data structure and
    277 * finally send an USB CONTROL REQUEST to the wheel to get [what it seems to be] its
    278 * model type.
    279 */
    280static int thrustmaster_probe(struct hid_device *hdev, const struct hid_device_id *id)
    281{
    282	int ret = 0;
    283	struct tm_wheel *tm_wheel = NULL;
    284
    285	if (!hid_is_usb(hdev))
    286		return -EINVAL;
    287
    288	ret = hid_parse(hdev);
    289	if (ret) {
    290		hid_err(hdev, "parse failed with error %d\n", ret);
    291		goto error0;
    292	}
    293
    294	ret = hid_hw_start(hdev, HID_CONNECT_DEFAULT & ~HID_CONNECT_FF);
    295	if (ret) {
    296		hid_err(hdev, "hw start failed with error %d\n", ret);
    297		goto error0;
    298	}
    299
    300	// Now we allocate the tm_wheel
    301	tm_wheel = kzalloc(sizeof(struct tm_wheel), GFP_KERNEL);
    302	if (!tm_wheel) {
    303		ret = -ENOMEM;
    304		goto error1;
    305	}
    306
    307	tm_wheel->urb = usb_alloc_urb(0, GFP_ATOMIC);
    308	if (!tm_wheel->urb) {
    309		ret = -ENOMEM;
    310		goto error2;
    311	}
    312
    313	tm_wheel->model_request = kmemdup(&model_request,
    314					  sizeof(struct usb_ctrlrequest),
    315					  GFP_KERNEL);
    316	if (!tm_wheel->model_request) {
    317		ret = -ENOMEM;
    318		goto error3;
    319	}
    320
    321	tm_wheel->response = kzalloc(sizeof(struct tm_wheel_response), GFP_KERNEL);
    322	if (!tm_wheel->response) {
    323		ret = -ENOMEM;
    324		goto error4;
    325	}
    326
    327	tm_wheel->change_request = kmemdup(&change_request,
    328					   sizeof(struct usb_ctrlrequest),
    329					   GFP_KERNEL);
    330	if (!tm_wheel->change_request) {
    331		ret = -ENOMEM;
    332		goto error5;
    333	}
    334
    335	tm_wheel->usb_dev = interface_to_usbdev(to_usb_interface(hdev->dev.parent));
    336	hid_set_drvdata(hdev, tm_wheel);
    337
    338	thrustmaster_interrupts(hdev);
    339
    340	usb_fill_control_urb(
    341		tm_wheel->urb,
    342		tm_wheel->usb_dev,
    343		usb_rcvctrlpipe(tm_wheel->usb_dev, 0),
    344		(char *)tm_wheel->model_request,
    345		tm_wheel->response,
    346		sizeof(struct tm_wheel_response),
    347		thrustmaster_model_handler,
    348		hdev
    349	);
    350
    351	ret = usb_submit_urb(tm_wheel->urb, GFP_ATOMIC);
    352	if (ret) {
    353		hid_err(hdev, "Error %d while submitting the URB. I am unable to initialize this wheel...\n", ret);
    354		goto error6;
    355	}
    356
    357	return ret;
    358
    359error6: kfree(tm_wheel->change_request);
    360error5: kfree(tm_wheel->response);
    361error4: kfree(tm_wheel->model_request);
    362error3: usb_free_urb(tm_wheel->urb);
    363error2: kfree(tm_wheel);
    364error1: hid_hw_stop(hdev);
    365error0:
    366	return ret;
    367}
    368
    369static const struct hid_device_id thrustmaster_devices[] = {
    370	{ HID_USB_DEVICE(0x044f, 0xb65d)},
    371	{}
    372};
    373
    374MODULE_DEVICE_TABLE(hid, thrustmaster_devices);
    375
    376static struct hid_driver thrustmaster_driver = {
    377	.name = "hid-thrustmaster",
    378	.id_table = thrustmaster_devices,
    379	.probe = thrustmaster_probe,
    380	.remove = thrustmaster_remove,
    381};
    382
    383module_hid_driver(thrustmaster_driver);
    384
    385MODULE_AUTHOR("Dario Pagani <dario.pagani.146+linuxk@gmail.com>");
    386MODULE_LICENSE("GPL");
    387MODULE_DESCRIPTION("Driver to initialize some steering wheel joysticks from Thrustmaster");
    388