* [PATCH v5 00/12] Input: xbox_gip - Add new driver for Xbox GIP
@ 2026-09-02 1:02 Vicki Pfau
2026-09-02 1:02 ` [PATCH v5 01/12] " Vicki Pfau
` (11 more replies)
0 siblings, 12 replies; 22+ messages in thread
From: Vicki Pfau @ 2026-09-02 1:02 UTC (permalink / raw)
To: Dmitry Torokhov, linux-input; +Cc: Vicki Pfau
This is a new version of the previously submitted xbox-gip series.
This introduces a new driver for the Xbox One/Series controller protocol,
officially known as the Gaming Input Protocol, or GIP for short.
Microsoft released documentation on (some of) GIP in late 2024, upon which
this driver is based. Though the documentation was incomplete, it still
provided enough information to warrant a clean start over the previous,
incomplete implementation.
This driver is already at feature parity with the GIP support in xpad,
along with several more enhancements:
- Proper support for parsing message length and fragmented messages
- Metadata parsing, allowing for auto-detection on various parameters,
including the presence and location in the message of the share button,
as well as detection of specific device types
- Controllable LED support
- HID passthrough for the Chatpad
- Battery information support
- Arcade stick support
- Racing wheel support
- Support for the security flow, allowing use with wireless controllers
that include their own dongles. (This does not include support for the
first-party dongle yet.)
The framework set out in this driver also allows future expansion for
specialized device types and additional features more cleanly than xpad.
Future plans include:
- Adding support for more device types, such as flight sticks.
- Exposing a raw character device to enable sending vendor-specific
commands from userspace.
- Event logging to either sysfs or dmesg.
- Support for the headphone jack.
This version cleans up issues found by sashiko as well as some smaller
refactoring to clean up reused code.
Vicki Pfau (12):
Input: xbox_gip - Add new driver for Xbox GIP
Input: xpad - Remove Xbox One support
Input: xbox_gip - Add controllable LED support
Input: xbox_gip - Add HID relaying
Input: xbox_gip - Add battery support
Input: xbox_gip - Allow sending fragmented and ACME messages
Input: xbox_gip - Add security implementation from xone
Input: xbox_gip - Add arcade stick support
Input: xbox_gip - Add support for PDP guitar controllers
Input: Add ABS_CLUTCH, HANDBRAKE, and SHIFTER
HID: Map more automobile simulation inputs
Input: xbox_gip - Add wheel support
Documentation/input/devices/xpad.rst | 17 +-
MAINTAINERS | 6 +
drivers/hid/hid-debug.c | 16 +-
drivers/hid/hid-input.c | 2 +
drivers/input/joystick/Kconfig | 2 +
drivers/input/joystick/Makefile | 1 +
drivers/input/joystick/gip/Kconfig | 21 +
drivers/input/joystick/gip/Makefile | 8 +
drivers/input/joystick/gip/gip-arcade-stick.c | 173 +
drivers/input/joystick/gip/gip-core.c | 3234 +++++++++++++++++
drivers/input/joystick/gip/gip-drivers.c | 222 ++
drivers/input/joystick/gip/gip-pdp-jaguar.c | 129 +
drivers/input/joystick/gip/gip-security.c | 795 ++++
drivers/input/joystick/gip/gip-wheel.c | 349 ++
drivers/input/joystick/gip/gip.h | 431 +++
drivers/input/joystick/xpad.c | 684 +---
include/uapi/linux/input-event-codes.h | 3 +
include/uapi/linux/input.h | 1 +
18 files changed, 5397 insertions(+), 697 deletions(-)
create mode 100644 drivers/input/joystick/gip/Kconfig
create mode 100644 drivers/input/joystick/gip/Makefile
create mode 100644 drivers/input/joystick/gip/gip-arcade-stick.c
create mode 100644 drivers/input/joystick/gip/gip-core.c
create mode 100644 drivers/input/joystick/gip/gip-drivers.c
create mode 100644 drivers/input/joystick/gip/gip-pdp-jaguar.c
create mode 100644 drivers/input/joystick/gip/gip-security.c
create mode 100644 drivers/input/joystick/gip/gip-wheel.c
create mode 100644 drivers/input/joystick/gip/gip.h
--
2.54.0
^ permalink raw reply [flat|nested] 22+ messages in thread
* [PATCH v5 01/12] Input: xbox_gip - Add new driver for Xbox GIP
2026-09-02 1:02 [PATCH v5 00/12] Input: xbox_gip - Add new driver for Xbox GIP Vicki Pfau
@ 2026-09-02 1:02 ` Vicki Pfau
2026-09-02 1:28 ` sashiko-bot
2026-09-02 1:02 ` [PATCH v5 02/12] Input: xpad - Remove Xbox One support Vicki Pfau
` (10 subsequent siblings)
11 siblings, 1 reply; 22+ messages in thread
From: Vicki Pfau @ 2026-09-02 1:02 UTC (permalink / raw)
To: Dmitry Torokhov, linux-input; +Cc: Vicki Pfau
This introduces a new driver for the Xbox One/Series controller protocol,
officially known as the Gaming Input Protocol, or GIP for short.
Microsoft released documentation on (some of) GIP in late 2024, upon which
this driver is based. Though the documentation was incomplete, it still
provided enough information to warrant a clean start over the previous,
incomplete implementation.
This driver is already at feature parity with the GIP support in xpad,
along with several more enhancements:
- Proper support for parsing message length and fragmented messages
- Metadata parsing, allowing for auto-detection on various parameters,
including the presence and location in the message of the share button,
as well as detection of specific device types
The framework set out in this driver also allows future expansion for
specialized device types and additional features more cleanly than xpad.
Future plans include:
- Adding support for more device types, such as arcade sticks, racing
wheels and flight sticks.
- Support for the security handshake, which is required for devices that
use wireless dongles.
- Exposing a raw character device to enable sending vendor-specific
commands from userspace.
- Event logging to either sysfs or dmesg.
- Support for the headphone jack.
Signed-off-by: Vicki Pfau <vi@endrift.com>
---
MAINTAINERS | 6 +
drivers/input/joystick/Kconfig | 2 +
drivers/input/joystick/Makefile | 1 +
drivers/input/joystick/gip/Kconfig | 21 +
drivers/input/joystick/gip/Makefile | 4 +
drivers/input/joystick/gip/gip-core.c | 2591 ++++++++++++++++++++++
drivers/input/joystick/gip/gip-drivers.c | 204 ++
drivers/input/joystick/gip/gip.h | 344 +++
8 files changed, 3173 insertions(+)
create mode 100644 drivers/input/joystick/gip/Kconfig
create mode 100644 drivers/input/joystick/gip/Makefile
create mode 100644 drivers/input/joystick/gip/gip-core.c
create mode 100644 drivers/input/joystick/gip/gip-drivers.c
create mode 100644 drivers/input/joystick/gip/gip.h
diff --git a/MAINTAINERS b/MAINTAINERS
index 806bd2d80d15..7fdf1b989667 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -29347,6 +29347,12 @@ S: Maintained
F: drivers/media/rc/keymaps/rc-xbox-dvd.c
F: drivers/media/rc/xbox_remote.c
+XBOX GIP
+M: Vicki Pfau <vi@endrift.com>
+L: linux-input@vger.kernel.org
+S: Maintained
+F: drivers/input/joystick/gip/
+
XC2028/3028 TUNER DRIVER
M: Mauro Carvalho Chehab <mchehab@kernel.org>
L: linux-media@vger.kernel.org
diff --git a/drivers/input/joystick/Kconfig b/drivers/input/joystick/Kconfig
index 7755e5b454d2..d4665c80a371 100644
--- a/drivers/input/joystick/Kconfig
+++ b/drivers/input/joystick/Kconfig
@@ -291,6 +291,8 @@ config JOYSTICK_JOYDUMP
To compile this driver as a module, choose M here: the
module will be called joydump.
+source "drivers/input/joystick/gip/Kconfig"
+
config JOYSTICK_XPAD
tristate "Xbox gamepad support"
depends on USB_ARCH_HAS_HCD
diff --git a/drivers/input/joystick/Makefile b/drivers/input/joystick/Makefile
index 9976f596a920..323392921b7d 100644
--- a/drivers/input/joystick/Makefile
+++ b/drivers/input/joystick/Makefile
@@ -39,5 +39,6 @@ obj-$(CONFIG_JOYSTICK_TURBOGRAFX) += turbografx.o
obj-$(CONFIG_JOYSTICK_TWIDJOY) += twidjoy.o
obj-$(CONFIG_JOYSTICK_WARRIOR) += warrior.o
obj-$(CONFIG_JOYSTICK_WALKERA0701) += walkera0701.o
+obj-$(CONFIG_JOYSTICK_XBOX_GIP) += gip/
obj-$(CONFIG_JOYSTICK_XPAD) += xpad.o
obj-$(CONFIG_JOYSTICK_ZHENHUA) += zhenhua.o
diff --git a/drivers/input/joystick/gip/Kconfig b/drivers/input/joystick/gip/Kconfig
new file mode 100644
index 000000000000..2ce789d23178
--- /dev/null
+++ b/drivers/input/joystick/gip/Kconfig
@@ -0,0 +1,21 @@
+# SPDX-License-Identifier: GPL-2.0-or-later
+#
+# Gaming Input Protocol driver configuration
+#
+config JOYSTICK_XBOX_GIP
+ tristate "Xbox One/Series controller support"
+ depends on USB && USB_ARCH_HAS_HCD
+ help
+ Say Y here if you want to use Xbox One and Series controllers with your
+ computer. Make sure to say Y to "Joystick support" (CONFIG_INPUT_JOYDEV)
+ and/or "Event interface support" (CONFIG_INPUT_EVDEV) as well.
+
+ To compile this driver as a module, choose M here: the
+ module will be called xbox_gip.
+
+config JOYSTICK_XBOX_GIP_FF
+ bool "Xbox One/Series controller rumble support"
+ depends on JOYSTICK_XBOX_GIP && INPUT
+ select INPUT_FF_MEMLESS
+ help
+ Say Y here if you want to take advantage of Xbox One/Series rumble.
diff --git a/drivers/input/joystick/gip/Makefile b/drivers/input/joystick/gip/Makefile
new file mode 100644
index 000000000000..d39f946db1ae
--- /dev/null
+++ b/drivers/input/joystick/gip/Makefile
@@ -0,0 +1,4 @@
+# SPDX-License-Identifier: GPL-2.0-or-later
+obj-$(CONFIG_JOYSTICK_XBOX_GIP) += xbox-gip.o
+# Base driver
+xbox-gip-y := gip-core.o gip-drivers.o
diff --git a/drivers/input/joystick/gip/gip-core.c b/drivers/input/joystick/gip/gip-core.c
new file mode 100644
index 000000000000..11196afdce33
--- /dev/null
+++ b/drivers/input/joystick/gip/gip-core.c
@@ -0,0 +1,2591 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+/*
+ * Gaming Input Protocol driver for Xbox One/Series controllers
+ *
+ * Copyright (c) 2025 Valve Software
+ *
+ * TODO:
+ * - Audio device support
+ * - Security packet handshake
+ * - Event logging
+ * - Sending fragmented messages
+ * - Raw character device
+ * - Wheel support
+ * - Flight stick support
+ * - Arcade stick support
+ * - Split into driver-per-attachment GIP-as-a-bus approach drivers
+ *
+ * This driver is based on the Microsoft GIP spec at:
+ * https://aka.ms/gipdocs
+ * https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-gipusb/e7c90904-5e21-426e-b9ad-d82adeee0dbc
+ */
+
+#include <linux/module.h>
+#include <linux/unaligned.h>
+#include <linux/uuid.h>
+#include "gip.h"
+
+#define GIP_WIRED_INTF_DATA 0
+#define GIP_WIRED_INTF_AUDIO 1
+
+#define MAX_MESSAGE_LENGTH 0x4000
+
+#define MAX_AUDIO_MESSAGES 9
+
+#define GIP_DATA_CLASS_COMMAND (0u << 5)
+#define GIP_DATA_CLASS_LOW_LATENCY (1u << 5)
+#define GIP_DATA_CLASS_STANDARD_LATENCY (2u << 5)
+#define GIP_DATA_CLASS_AUDIO (3u << 5)
+
+#define GIP_DATA_CLASS_SHIFT 5
+#define GIP_DATA_CLASS_MASK (7u << 5)
+
+/* Undocumented Elite 2 vendor messages */
+#define GIP_CMD_RAW_REPORT 0x0c
+#define GIP_CMD_GUIDE_COLOR 0x0e
+#define GIP_SL_ELITE_CONFIG 0x4d
+
+#define GIP_BTN_OFFSET_XBE1 28
+#define GIP_BTN_OFFSET_XBE2 14
+
+#define GIP_AUDIO_FORMAT_NULL 0
+#define GIP_AUDIO_FORMAT_8000HZ_1CH 1
+#define GIP_AUDIO_FORMAT_8000HZ_2CH 2
+#define GIP_AUDIO_FORMAT_12000HZ_1CH 3
+#define GIP_AUDIO_FORMAT_12000HZ_2CH 4
+#define GIP_AUDIO_FORMAT_16000HZ_1CH 5
+#define GIP_AUDIO_FORMAT_16000HZ_2CH 6
+#define GIP_AUDIO_FORMAT_20000HZ_1CH 7
+#define GIP_AUDIO_FORMAT_20000HZ_2CH 8
+#define GIP_AUDIO_FORMAT_24000HZ_1CH 9
+#define GIP_AUDIO_FORMAT_24000HZ_2CH 10
+#define GIP_AUDIO_FORMAT_32000HZ_1CH 11
+#define GIP_AUDIO_FORMAT_32000HZ_2CH 12
+#define GIP_AUDIO_FORMAT_40000HZ_1CH 13
+#define GIP_AUDIO_FORMAT_40000HZ_2CH 14
+#define GIP_AUDIO_FORMAT_48000HZ_1CH 15
+#define GIP_AUDIO_FORMAT_48000HZ_2CH 16
+#define GIP_AUDIO_FORMAT_48000HZ_6CH 32
+#define GIP_AUDIO_FORMAT_48000HZ_8CH 33
+#define MAX_GIP_AUDIO_FORMAT GIP_AUDIO_FORMAT_48000HZ_8CH
+
+/* Protocol Control constants */
+#define GIP_CONTROL_CODE_ACK 0
+#define GIP_CONTROL_CODE_NACK 1 /* obsolete */
+#define GIP_CONTROL_CODE_UNK 2 /* obsolete */
+#define GIP_CONTROL_CODE_AB 3 /* obsolete */
+#define GIP_CONTROL_CODE_MPER 4 /* obsolete */
+#define GIP_CONTROL_CODE_STOP 5 /* obsolete */
+#define GIP_CONTROL_CODE_START 6 /* obsolete */
+#define GIP_CONTROL_CODE_ERR 7 /* obsolete */
+
+/* Status Device constants */
+#define GIP_POWER_LEVEL_OFF 0
+#define GIP_POWER_LEVEL_STANDBY 1 /* obsolete */
+#define GIP_POWER_LEVEL_FULL 2
+
+#define GIP_NOT_CHARGING 0
+#define GIP_CHARGING 1
+#define GIP_CHARGE_ERROR 2
+
+#define GIP_BATTERY_ABSENT 0
+#define GIP_BATTERY_STANDARD 1
+#define GIP_BATTERY_RECHARGEABLE 2
+
+#define GIP_BATTERY_CRITICAL 0
+#define GIP_BATTERY_LOW 1
+#define GIP_BATTERY_MEDIUM 2
+#define GIP_BATTERY_FULL 3
+
+#define GIP_EVENT_FAULT 0x0002
+
+#define GIP_FAULT_UNKNOWN 0
+#define GIP_FAULT_HARD 1
+#define GIP_FAULT_NMI 2
+#define GIP_FAULT_SVC 3
+#define GIP_FAULT_PEND_SV 4
+#define GIP_FAULT_SMART_PTR 5
+#define GIP_FAULT_MCU 6
+#define GIP_FAULT_BUS 7
+#define GIP_FAULT_USAGE 8
+#define GIP_FAULT_RADIO_HANG 9
+#define GIP_FAULT_WATCHDOG 10
+#define GIP_FAULT_LINK_STALL 11
+#define GIP_FAULT_ASSERTION 12
+
+/* Metadata constants */
+#define GIP_MESSAGE_FLAG_BIG_ENDIAN BIT(0)
+#define GIP_MESSAGE_FLAG_RELIABLE BIT(1)
+#define GIP_MESSAGE_FLAG_SEQUENCED BIT(2)
+#define GIP_MESSAGE_FLAG_DOWNSTREAM BIT(3)
+#define GIP_MESSAGE_FLAG_UPSTREAM BIT(4)
+#define GIP_MESSAGE_FLAG_DS_REQUEST_RESPONSE BIT(5)
+
+#define GIP_DATA_TYPE_CUSTOM 1
+#define GIP_DATA_TYPE_AUDIO 2
+#define GIP_DATA_TYPE_SECURITY 3
+#define GIP_DATA_TYPE_GIP 4
+
+/* Set Device State constants */
+#define GIP_STATE_START 0
+#define GIP_STATE_STOP 1
+#define GIP_STATE_STANDBY 2 /* obsolete */
+#define GIP_STATE_FULL_POWER 3
+#define GIP_STATE_OFF 4
+#define GIP_STATE_QUIESCE 5
+#define GIP_STATE_UNK6 6
+#define GIP_STATE_RESET 7
+
+/* Guide Button Status constants */
+#define GIP_LED_GUIDE 0
+#define GIP_LED_IR 1 /* deprecated, for Kinect */
+
+#define GIP_LED_GUIDE_OFF 0
+#define GIP_LED_GUIDE_ON 1
+#define GIP_LED_GUIDE_FAST_BLINK 2
+#define GIP_LED_GUIDE_SLOW_BLINK 3
+#define GIP_LED_GUIDE_CHARGING_BLINK 4
+#define GIP_LED_GUIDE_RAMP_TO_LEVEL 0xd
+
+#define GIP_LED_IR_OFF 0
+#define GIP_LED_IR_ON_100MS 1
+#define GIP_LED_IR_PATTERN 4
+
+/* Direct Motor Command constants */
+#define GIP_MOTOR_RIGHT_VIBRATION BIT(0)
+#define GIP_MOTOR_LEFT_VIBRATION BIT(1)
+#define GIP_MOTOR_RIGHT_IMPULSE BIT(2)
+#define GIP_MOTOR_LEFT_IMPULSE BIT(3)
+#define GIP_MOTOR_ALL 0xf
+
+/* Extended Command constants */
+#define GIP_EXTCMD_GET_CAPABILITIES 0x00
+#define GIP_EXTCMD_GET_TELEMETRY_DATA 0x01
+#define GIP_EXTCMD_GET_SERIAL_NUMBER 0x04
+
+#define GIP_EXTENDED_STATUS_OK 0
+#define GIP_EXTENDED_STATUS_NOT_SUPPORTED 1
+#define GIP_EXTENDED_STATUS_NOT_READY 2
+#define GIP_EXTENDED_STATUS_ACCESS_DENIED 3
+#define GIP_EXTENDED_STATUS_FAILED 4
+
+/* Internal constants, not part of protocol */
+#define GIP_DEFAULT_IN_SYSTEM_MESSAGES 0x5e
+#define GIP_DEFAULT_OUT_SYSTEM_MESSAGES 0x472
+
+#define GIP_LED_GUIDE_MAX_BRIGHTNESS 100 /* Spec says 47, but larger values work */
+#define GIP_LED_GUIDE_INIT_BRIGHTNESS 20
+
+#ifndef VK_LWIN
+#define VK_LWIN 0x5b
+#endif
+
+static const guid_t guid_console_function_map =
+ GUID_INIT(0xecddd2fe, 0xd387, 0x4294, 0xbd, 0x96, 0x1a, 0x71, 0x2e, 0x3d, 0xc7, 0x7d);
+static const guid_t guid_console_function_map_overflow =
+ GUID_INIT(0x137d4bd0, 0x9347, 0x4472, 0xaa, 0x26, 0x8c, 0x34, 0xa0, 0x8f, 0xf9, 0xbd);
+static const guid_t guid_controller =
+ GUID_INIT(0x9776ff56, 0x9bfd, 0x4581, 0xad, 0x45, 0xb6, 0x45, 0xbb, 0xa5, 0x26, 0xd6);
+static const guid_t guid_dev_auth_pc_opt_out =
+ GUID_INIT(0x7a34ce77, 0x7de2, 0x45c6, 0x8c, 0xa4, 0x00, 0x42, 0xc0, 0x8b, 0xd9, 0x4a);
+static const guid_t guid_dynamic_latency_input =
+ GUID_INIT(0x87f2e56b, 0xc3bb, 0x49b1, 0x82, 0x65, 0xff, 0xff, 0xf3, 0x77, 0x99, 0xee);
+static const guid_t guid_elite_buttons =
+ GUID_INIT(0x37d19ff7, 0xb5c6, 0x49d1, 0xa7, 0x5e, 0x03, 0xb2, 0x4b, 0xef, 0x8c, 0x89);
+static const guid_t guid_headset =
+ GUID_INIT(0xbc25d1a3, 0xc24e, 0x4992, 0x9d, 0xda, 0xef, 0x4f, 0x12, 0x3e, 0xf5, 0xdc);
+
+/*
+ * The following GUIDs are observed, but the exact meanings aren't known, so
+ * for now we document them but don't use them anywhere.
+ *
+ * GamepadEmu:
+ * GUID_INIT(0xe2e5f1bc, 0xa6e6, 0x41a2, 0x8f, 0x43, 0x33, 0xcf, 0xa2, 0x51, 0x09, 0x81)
+ * IAudioOnly:
+ * GUID_INIT(0x92844cd1, 0xf7c8, 0x49ef, 0x97, 0x77, 0x46, 0x7d, 0xa7, 0x08, 0xad, 0x10)
+ * IControllerProfileModeState:
+ * GUID_INIT(0xf758dc66, 0x022c, 0x48b8, 0xa4, 0xf6, 0x45, 0x7b, 0xa8, 0x0e, 0x2a, 0x5b)
+ * ICustomAudio:
+ * GUID_INIT(0x63fd9cc9, 0x94ee, 0x4b5d, 0x9c, 0x4d, 0x8b, 0x86, 0x4c, 0x14, 0x9c, 0xac)
+ * IExtendedDeviceFlags:
+ * GUID_INIT(0x34ad9b1e, 0x36ad, 0x4fb5, 0x8a, 0xc7, 0x17, 0x23, 0x4c, 0x9f, 0x54, 0x6f)
+ * IProgrammableGamepad:
+ * GUID_INIT(0x31c1034d, 0xb5b7, 0x4551, 0x98, 0x13, 0x87, 0x69, 0xd4, 0xa0, 0xe4, 0xf9)
+ * IVirtualDevice:
+ * GUID_INIT(0xdfd26825, 0x110a, 0x4e94, 0xb9, 0x37, 0xb2, 0x7c, 0xe4, 0x7b, 0x25, 0x40)
+ * OnlineDevAuth:
+ * GUID_INIT(0x632b1fd1, 0xa3e9, 0x44f9, 0x84, 0x20, 0x5c, 0xe3, 0x44, 0xa0, 0x64, 0x04)
+ *
+ * Seen on Elite Controller, Adaptive Controller: 9ebd00a3-b5e6-4c08-a33b-673126459ec4
+ * Seen on Adaptive Controller: ce1e58c5-221c-4bdb-9c24-bf3941601320
+ * Seen on Adaptive Joystick: db02f681-5038-4219-8668-c3459c5c3293
+ * Seen on Elite 2 Controller: f758dc66-022c-48b8-a4f6-457ba80e2a5b (IControllerProfileModeState)
+ * Seen on Elite 2 Controller: 31c1034d-b5b7-4551-9813-8769d4a0e4f9 (IProgrammableGamepad)
+ * Seen on Elite 2 Controller: 34ad9b1e-36ad-4fb5-8ac7-17234c9f546f (IExtendedDeviceFlags)
+ * Seen on Elite 2 Controller: 88e0b694-6bd9-4416-a560-e7fafdfa528f
+ * Seen on Elite 2 Controller: ea96c8c0-b216-448b-be80-7e5deb0698e2
+ */
+
+static const int gip_data_class_mtu[8] = { 64, 64, 64, 2048, 0, 0, 0, 0 };
+
+struct gip_audio_format {
+ uint16_t rate;
+ uint8_t channels;
+};
+
+static const struct gip_audio_format gip_audio_format_table[MAX_GIP_AUDIO_FORMAT + 1] = {
+ [GIP_AUDIO_FORMAT_8000HZ_1CH] = { .rate = 8000, .channels = 1 },
+ [GIP_AUDIO_FORMAT_8000HZ_2CH] = { .rate = 8000, .channels = 2 },
+ [GIP_AUDIO_FORMAT_12000HZ_1CH] = { .rate = 12000, .channels = 1 },
+ [GIP_AUDIO_FORMAT_12000HZ_2CH] = { .rate = 12000, .channels = 2 },
+ [GIP_AUDIO_FORMAT_16000HZ_1CH] = { .rate = 16000, .channels = 1 },
+ [GIP_AUDIO_FORMAT_16000HZ_2CH] = { .rate = 16000, .channels = 2 },
+ [GIP_AUDIO_FORMAT_20000HZ_1CH] = { .rate = 20000, .channels = 1 },
+ [GIP_AUDIO_FORMAT_20000HZ_2CH] = { .rate = 20000, .channels = 2 },
+ [GIP_AUDIO_FORMAT_24000HZ_1CH] = { .rate = 24000, .channels = 1 },
+ [GIP_AUDIO_FORMAT_24000HZ_2CH] = { .rate = 24000, .channels = 2 },
+ [GIP_AUDIO_FORMAT_32000HZ_1CH] = { .rate = 32000, .channels = 1 },
+ [GIP_AUDIO_FORMAT_32000HZ_2CH] = { .rate = 32000, .channels = 2 },
+ [GIP_AUDIO_FORMAT_40000HZ_1CH] = { .rate = 40000, .channels = 1 },
+ [GIP_AUDIO_FORMAT_40000HZ_2CH] = { .rate = 40000, .channels = 2 },
+ [GIP_AUDIO_FORMAT_48000HZ_1CH] = { .rate = 48000, .channels = 1 },
+ [GIP_AUDIO_FORMAT_48000HZ_2CH] = { .rate = 48000, .channels = 2 },
+ [GIP_AUDIO_FORMAT_48000HZ_6CH] = { .rate = 48000, .channels = 6 },
+ [GIP_AUDIO_FORMAT_48000HZ_8CH] = { .rate = 48000, .channels = 8 },
+};
+
+
+static const struct gip_quirks base_quirks[] = {
+ { GIP_VID_PDP, GIP_PID_PDP_ROCK_CANDY, 0, .quirks = GIP_QUIRK_NO_HELLO },
+
+ {0},
+};
+
+struct gip_audio_format_pair {
+ uint8_t inbound;
+ uint8_t outbound;
+};
+static_assert(sizeof(struct gip_audio_format_pair) == 2);
+
+struct gip_protocol_control_ack {
+ uint8_t control_code;
+ uint8_t message_type;
+ uint8_t flags;
+ __le32 fragment_offset;
+ __le16 remaining_buffer;
+} __packed;
+static_assert(sizeof(struct gip_protocol_control_ack) == 9);
+
+struct gip_hello_device {
+ __le64 device_id;
+ __le16 vendor_id;
+ __le16 product_id;
+ __le16 firmware_major_version;
+ __le16 firmware_minor_version;
+ __le16 firmware_build_version;
+ __le16 firmware_revision;
+ uint8_t hardware_major_version;
+ uint8_t hardware_minor_version;
+ uint8_t rf_proto_major_version;
+ uint8_t rf_proto_minor_version;
+ uint8_t security_major_version;
+ uint8_t security_minor_version;
+ uint8_t gip_major_version;
+ uint8_t gip_minor_version;
+} __packed;
+static_assert(sizeof(struct gip_hello_device) == 28);
+
+struct gip_device_metadata_header {
+ __le16 length;
+ uint8_t supports_device_firmware_versions_major;
+ uint8_t supports_device_firmware_versions_minor;
+ __le16 audio_offset;
+ __le16 supported_upstream_system_message_offset;
+ __le16 supported_downstream_system_message_offset;
+ __le16 preferred_types_offset;
+ __le16 supported_interfaces_offset;
+ __le16 hid_descriptor_offset;
+} __packed;
+
+struct gip_direct_motor {
+ uint8_t command;
+ uint8_t motor_bitmap;
+ uint8_t left_impulse_level;
+ uint8_t right_impulse_level;
+ uint8_t left_vibration_level;
+ uint8_t right_vibration_level;
+ uint8_t duration;
+ uint8_t delay;
+ uint8_t repeat;
+};
+
+static const struct gip_driver *base_drivers[] = {
+ &gip_driver_navigation,
+ &gip_driver_gamepad,
+ NULL /* Sentinel */
+};
+
+static int gip_decode_length(uint64_t *length, const uint8_t *bytes, int num_bytes)
+{
+ *length = 0;
+ int offset;
+
+ for (offset = 0; offset < num_bytes; offset++) {
+ uint8_t byte = bytes[offset];
+
+ *length |= (byte & 0x7full) << (offset * 7);
+ if (!(byte & 0x80)) {
+ offset++;
+ break;
+ }
+ }
+ return offset;
+}
+
+static int gip_encode_length(uint64_t length, uint8_t *bytes, int num_bytes)
+{
+ int offset;
+
+ for (offset = 0; offset < num_bytes; offset++) {
+ uint8_t byte = length & 0x7f;
+
+ length >>= 7;
+ if (length)
+ byte |= 0x80;
+ bytes[offset] = byte;
+ if (!length) {
+ offset++;
+ break;
+ }
+ }
+ return offset;
+}
+
+static bool gip_supports_system_message(struct gip_attachment *attachment,
+ uint8_t command, bool upstream)
+{
+ if (upstream)
+ return attachment->metadata.device
+ .in_system_messages[command >> 5] & BIT(command);
+ else
+ return attachment->metadata.device
+ .out_system_messages[command >> 5] & BIT(command);
+}
+
+bool gip_supports_vendor_message(struct gip_attachment *attachment,
+ uint8_t command, bool upstream)
+{
+ size_t i;
+
+ for (i = 0; i < attachment->metadata.num_messages; i++) {
+ struct gip_message_metadata *metadata =
+ &attachment->metadata.message_metadata[i];
+
+ if (metadata->type != command)
+ continue;
+ if (metadata->flags & GIP_MESSAGE_FLAG_DS_REQUEST_RESPONSE)
+ return true;
+
+ if (upstream)
+ return metadata->flags & GIP_MESSAGE_FLAG_UPSTREAM;
+ else
+ return metadata->flags & GIP_MESSAGE_FLAG_DOWNSTREAM;
+ }
+ return false;
+}
+
+static uint8_t gip_sequence_next(struct gip_attachment *attachment,
+ uint8_t command, bool system)
+{
+ uint8_t seq;
+
+ if (system) {
+ switch (command) {
+ case GIP_CMD_SECURITY:
+ seq = attachment->seq_security++;
+ if (!seq)
+ seq = attachment->seq_security++;
+ break;
+ case GIP_CMD_EXTENDED:
+ seq = attachment->seq_extended++;
+ if (!seq)
+ seq = attachment->seq_extended++;
+ break;
+ case GIP_AUDIO_DATA:
+ seq = attachment->seq_audio++;
+ if (!seq)
+ seq = attachment->seq_audio++;
+ break;
+ default:
+ seq = attachment->seq_system++;
+ if (!seq)
+ seq = attachment->seq_system++;
+ break;
+ }
+ } else {
+ seq = attachment->seq_vendor++;
+ if (!seq)
+ seq = attachment->seq_vendor++;
+ }
+ return seq;
+}
+
+static void gip_handle_quirks_array(struct gip_attachment *attachment,
+ const struct gip_quirks *quirks)
+{
+ size_t i, j;
+
+ for (i = 0; quirks[i].vendor_id; i++) {
+ if (quirks[i].vendor_id != attachment->vendor_id)
+ continue;
+ if (quirks[i].product_id != attachment->product_id)
+ continue;
+ if (quirks[i].attachment_index != attachment->attachment_index)
+ continue;
+
+ attachment->features |= quirks[i].added_features;
+ attachment->features &= ~quirks[i].filtered_features;
+ attachment->quirks |= quirks[i].quirks;
+
+ if (quirks[i].override_name)
+ attachment->name = quirks[i].override_name;
+
+ for (j = 0; j < 8; ++j) {
+ struct gip_device_metadata *metadata = &attachment->metadata.device;
+
+ metadata->in_system_messages[j] |= quirks[i].extra_in_system[j];
+ metadata->out_system_messages[j] |= quirks[i].extra_out_system[j];
+ }
+
+ attachment->extra_buttons = quirks[i].extra_buttons;
+ attachment->extra_axes = quirks[i].extra_axes;
+ break;
+ }
+
+}
+
+static void gip_handle_quirks(struct gip_attachment *attachment)
+{
+ gip_handle_quirks_array(attachment, base_quirks);
+
+ if (attachment->driver && attachment->driver->quirks)
+ gip_handle_quirks_array(attachment, attachment->driver->quirks);
+}
+
+static int gip_send_raw_message(struct gip_attachment *attachment,
+ uint8_t message_type, uint8_t flags, uint8_t seq, const uint8_t *bytes,
+ int num_bytes)
+{
+ struct gip_interface *intf;
+ int offset = 3;
+ struct gip_urb *urb = NULL;
+ int i;
+ int rc = 0;
+
+ if (num_bytes < 0) {
+ gip_warn(attachment, "Invalid message length %d\n", num_bytes);
+ return -EINVAL;
+ }
+
+ if (num_bytes + 6 > gip_data_class_mtu[message_type >> GIP_DATA_CLASS_SHIFT]) {
+ gip_err(attachment,
+ "Attempted to send a message that requires fragmenting, which is not yet supported.\n");
+ return -EOPNOTSUPP;
+ }
+
+ if ((message_type & GIP_DATA_CLASS_MASK) == GIP_DATA_CLASS_AUDIO)
+ intf = &attachment->device->audio;
+ else
+ intf = &attachment->device->data;
+
+ if (intf->isoc_messages) {
+ /* TODO: Needed for audio support */
+ gip_warn(intf, "Unimplemented isochronous message output\n");
+ return -EOPNOTSUPP;
+ }
+
+ guard(spinlock_irqsave)(&attachment->device->message_lock);
+ for (i = 0; i < MAX_OUT_MESSAGES && !urb; i++) {
+ if (!intf->out_queue[i].urb)
+ continue;
+ if (!intf->out_queue[i].urb->anchor)
+ urb = &intf->out_queue[i];
+ }
+ if (!urb) {
+ gip_err(attachment, "Output queue is full; dropping message\n");
+ return -ENOSPC;
+ }
+ urb->data[0] = message_type;
+ urb->data[1] = flags;
+ urb->data[2] = seq;
+ offset += gip_encode_length(num_bytes, &urb->data[offset],
+ sizeof(urb->data) - offset);
+
+ if (num_bytes > 0)
+ memcpy(&urb->data[offset], bytes, num_bytes);
+
+ num_bytes += offset;
+ urb->urb->transfer_buffer_length = num_bytes;
+
+ print_hex_dump_debug(KBUILD_MODNAME ": Sending message: ",
+ DUMP_PREFIX_OFFSET, 16, 1, urb->data, num_bytes, false);
+
+ usb_anchor_urb(urb->urb, &intf->out_anchor);
+ rc = usb_submit_urb(urb->urb, GFP_ATOMIC);
+ if (rc) {
+ dev_err(&intf->intf->dev,
+ "%s - usb_submit_urb failed with result %d\n",
+ __func__, rc);
+ usb_unanchor_urb(urb->urb);
+ rc = -EIO;
+ }
+
+ return rc;
+}
+
+int gip_send_system_message(struct gip_attachment *attachment,
+ uint8_t message_type, uint8_t flags, const void *bytes, int num_bytes)
+{
+ return gip_send_raw_message(attachment, message_type,
+ GIP_FLAG_SYSTEM | attachment->attachment_index | flags,
+ gip_sequence_next(attachment, message_type, true),
+ bytes, num_bytes);
+}
+
+int gip_send_vendor_message(struct gip_attachment *attachment,
+ uint8_t message_type, uint8_t flags, const void *bytes, int num_bytes)
+{
+ return gip_send_raw_message(attachment, message_type, flags,
+ gip_sequence_next(attachment, message_type, false),
+ bytes, num_bytes);
+}
+
+static void gip_metadata_free(struct device *dev, struct gip_metadata *metadata)
+{
+ devm_kfree(dev, metadata->device.audio_formats);
+
+ if (metadata->device.preferred_types) {
+ int i;
+
+ for (i = 0; i < metadata->device.num_preferred_types; i++)
+ devm_kfree(dev, metadata->device.preferred_types[i]);
+ devm_kfree(dev, metadata->device.preferred_types);
+ }
+ devm_kfree(dev, metadata->device.supported_interfaces);
+ devm_kfree(dev, metadata->device.hid_descriptor);
+ devm_kfree(dev, metadata->message_metadata);
+
+ memset(metadata, 0, sizeof(*metadata));
+}
+
+static int gip_parse_audio_format_metadata(struct device *dev,
+ struct gip_device_metadata *dev_metadata, const uint8_t *bytes,
+ int length, int buffer_offset)
+{
+ unsigned int i;
+
+ dev_metadata->num_audio_formats = bytes[buffer_offset];
+ if (buffer_offset + dev_metadata->num_audio_formats * 2 + 1 > length)
+ return -EINVAL;
+ dev_metadata->audio_formats = devm_kmalloc_array(dev,
+ dev_metadata->num_audio_formats, 2, GFP_KERNEL);
+ if (!dev_metadata->audio_formats)
+ return -ENOMEM;
+ memcpy(dev_metadata->audio_formats, &bytes[buffer_offset + 1],
+ dev_metadata->num_audio_formats * 2);
+
+ for (i = 0; i < dev_metadata->num_audio_formats; i++) {
+ const struct gip_audio_format_pair *pair = &dev_metadata->audio_formats[i];
+ const struct gip_audio_format *inbound = NULL;
+ const struct gip_audio_format *outbound = NULL;
+
+ if (pair->inbound <= MAX_GIP_AUDIO_FORMAT) {
+ inbound = &gip_audio_format_table[pair->inbound];
+ if (pair->inbound != GIP_AUDIO_FORMAT_NULL && inbound->rate == 0)
+ inbound = NULL;
+ }
+ if (!inbound)
+ dev_warn(dev, "Unknown audio format %u\n", pair->inbound);
+
+ if (pair->outbound <= MAX_GIP_AUDIO_FORMAT) {
+ outbound = &gip_audio_format_table[pair->outbound];
+ if (pair->outbound != GIP_AUDIO_FORMAT_NULL && outbound->rate == 0)
+ outbound = NULL;
+ }
+ if (!outbound)
+ dev_warn(dev, "Unknown audio format %u\n", pair->outbound);
+
+ if (inbound && outbound)
+ dev_dbg(dev,
+ "Supported audio format: %uHz %uch inbound, %uHz %uch outbound\n",
+ inbound->rate,
+ inbound->channels,
+ outbound->rate,
+ outbound->channels);
+ }
+ return 0;
+}
+
+static int gip_parse_preferred_types_metadata(struct device *dev,
+ struct gip_device_metadata *dev_metadata, const uint8_t *bytes,
+ int length, int buffer_offset)
+{
+ int i;
+ int count;
+
+ dev_metadata->num_preferred_types = bytes[buffer_offset];
+ dev_metadata->preferred_types = devm_kcalloc(dev,
+ dev_metadata->num_preferred_types, sizeof(char *), GFP_KERNEL);
+ if (!dev_metadata->preferred_types)
+ return -ENOMEM;
+
+ buffer_offset++;
+ for (i = 0; i < dev_metadata->num_preferred_types; i++) {
+ if (buffer_offset + 2 >= length)
+ return -EINVAL;
+
+ count = get_unaligned_le16(&bytes[buffer_offset]);
+ buffer_offset += 2;
+ if (buffer_offset + count > length)
+ return -EINVAL;
+
+ dev_metadata->preferred_types[i] = devm_kcalloc(dev, count + 1,
+ sizeof(char), GFP_KERNEL);
+ if (!dev_metadata->preferred_types[i])
+ return -ENOMEM;
+ memcpy(dev_metadata->preferred_types[i], &bytes[buffer_offset], count);
+ buffer_offset += count;
+ }
+
+ return 0;
+}
+
+static int gip_parse_supported_interfaces_metadata(struct device *dev,
+ struct gip_device_metadata *dev_metadata, const uint8_t *bytes,
+ int length, int buffer_offset)
+{
+ dev_metadata->num_supported_interfaces = bytes[buffer_offset];
+ if (buffer_offset + 1 +
+ (int32_t) (dev_metadata->num_supported_interfaces * sizeof(guid_t)) > length)
+ return -EINVAL;
+
+ dev_metadata->supported_interfaces = devm_kmalloc_array(dev,
+ dev_metadata->num_supported_interfaces, sizeof(guid_t), GFP_KERNEL);
+ if (!dev_metadata->supported_interfaces)
+ return -ENOMEM;
+
+ memcpy(dev_metadata->supported_interfaces, &bytes[buffer_offset + 1],
+ sizeof(guid_t) * dev_metadata->num_supported_interfaces);
+
+ return 0;
+}
+
+static int gip_parse_hid_descriptor_metadata(struct device *dev,
+ struct gip_device_metadata *dev_metadata, const uint8_t *bytes,
+ int length, int buffer_offset)
+{
+ dev_metadata->hid_descriptor_size = bytes[buffer_offset];
+ if (buffer_offset + 1 + dev_metadata->hid_descriptor_size > length)
+ return -EINVAL;
+
+ dev_metadata->hid_descriptor = devm_kmalloc(dev,
+ dev_metadata->hid_descriptor_size, GFP_KERNEL);
+ if (!dev_metadata->hid_descriptor)
+ return -ENOMEM;
+
+ memcpy(dev_metadata->hid_descriptor, &bytes[buffer_offset + 1],
+ dev_metadata->hid_descriptor_size);
+ print_hex_dump_debug(KBUILD_MODNAME ": Received HID descriptor: ",
+ DUMP_PREFIX_OFFSET, 16, 1, dev_metadata->hid_descriptor,
+ dev_metadata->hid_descriptor_size, false);
+
+ return 0;
+}
+
+static int gip_parse_device_metadata(struct device *dev,
+ struct gip_metadata *metadata, const uint8_t *bytes, int num_bytes,
+ int *offset)
+{
+ struct gip_device_metadata *dev_metadata = &metadata->device;
+ int buffer_offset;
+ int count;
+ int length;
+ int i;
+ int rc;
+ const struct gip_device_metadata_header *header;
+
+ bytes = &bytes[*offset];
+ num_bytes -= *offset;
+ if (num_bytes < sizeof(*header))
+ return -EINVAL;
+
+ header = (const struct gip_device_metadata_header *)bytes;
+ length = le16_to_cpu(header->length);
+ if (num_bytes < length)
+ return -EINVAL;
+
+ /* Skip supported firmware versions for now */
+
+ buffer_offset = le16_to_cpu(header->audio_offset);
+ if (buffer_offset >= length)
+ return -EINVAL;
+
+ if (buffer_offset > 0) {
+ rc = gip_parse_audio_format_metadata(dev, dev_metadata,
+ bytes, length, buffer_offset);
+ if (rc)
+ return rc;
+ }
+
+ buffer_offset = le16_to_cpu(header->supported_upstream_system_message_offset);
+ if (buffer_offset >= length)
+ return -EINVAL;
+
+ if (buffer_offset > 0) {
+ count = bytes[buffer_offset];
+ if (buffer_offset + count + 1 > length)
+ return -EINVAL;
+
+ for (i = 0; i < count; i++) {
+ uint8_t message = bytes[buffer_offset + 1 + i];
+
+ dev_dbg(dev,
+ "Supported upstream system message %02x\n",
+ message);
+ dev_metadata->in_system_messages[message >> 5] |=
+ BIT(message & 0x1F);
+ }
+ }
+
+ buffer_offset = le16_to_cpu(header->supported_downstream_system_message_offset);
+ if (buffer_offset >= length)
+ return -EINVAL;
+
+ if (buffer_offset > 0) {
+ count = bytes[buffer_offset];
+ if (buffer_offset + count + 1 > length)
+ return -EINVAL;
+
+ for (i = 0; i < count; i++) {
+ uint8_t message = bytes[buffer_offset + 1 + i];
+
+ dev_dbg(dev,
+ "Supported downstream system message %02x\n",
+ message);
+ dev_metadata->out_system_messages[message >> 5] |=
+ BIT(message & 0x1F);
+ }
+ }
+
+ buffer_offset = le16_to_cpu(header->preferred_types_offset);
+ if (buffer_offset >= length)
+ return -EINVAL;
+
+ if (buffer_offset > 0) {
+ rc = gip_parse_preferred_types_metadata(dev, dev_metadata,
+ bytes, length, buffer_offset);
+ if (rc)
+ return rc;
+ }
+
+ buffer_offset = le16_to_cpu(header->supported_interfaces_offset);
+ if (buffer_offset >= length)
+ return -EINVAL;
+
+ if (buffer_offset > 0) {
+ rc = gip_parse_supported_interfaces_metadata(dev,
+ dev_metadata, bytes, length, buffer_offset);
+ if (rc)
+ return rc;
+ }
+
+ if (metadata->version_major > 1 || metadata->version_minor >= 1) {
+ /* HID descriptor support added in metadata version 1.1 */
+ buffer_offset = le16_to_cpu(header->hid_descriptor_offset);
+ if (buffer_offset >= length)
+ return -EINVAL;
+
+ if (buffer_offset > 0) {
+ rc = gip_parse_hid_descriptor_metadata(dev,
+ dev_metadata, bytes, length, buffer_offset);
+ if (rc)
+ return rc;
+ }
+ }
+
+ *offset += length;
+ return 0;
+}
+
+static int gip_parse_message_metadata(struct device *dev,
+ struct gip_message_metadata *metadata, const uint8_t *bytes,
+ int num_bytes, int *offset)
+{
+ uint16_t length;
+
+ bytes = &bytes[*offset];
+ num_bytes -= *offset;
+
+ if (num_bytes < 2)
+ return -EINVAL;
+
+ length = get_unaligned_le16(&bytes[0]);
+ if (num_bytes < length)
+ return -EINVAL;
+
+ if (length < 15)
+ return -EINVAL;
+
+ metadata->type = bytes[2];
+ metadata->length = get_unaligned_le16(&bytes[3]);
+ metadata->data_type = get_unaligned_le16(&bytes[5]);
+ metadata->flags = get_unaligned_le32(&bytes[7]);
+ metadata->period = get_unaligned_le16(&bytes[11]);
+ metadata->persistence_timeout = get_unaligned_le16(&bytes[13]);
+
+ dev_dbg(dev,
+ "Supported vendor message type %02x of length %d, %s, %s, %s\n",
+ metadata->type, metadata->length,
+ metadata->flags & GIP_MESSAGE_FLAG_UPSTREAM ?
+ (metadata->flags & GIP_MESSAGE_FLAG_DOWNSTREAM ? "bidirectional" : "upstream") :
+ metadata->flags & GIP_MESSAGE_FLAG_DOWNSTREAM ? "downstream" :
+ metadata->flags & GIP_MESSAGE_FLAG_DS_REQUEST_RESPONSE ? "downstream request response" :
+ "unknown direction",
+ metadata->flags & GIP_MESSAGE_FLAG_SEQUENCED ? "sequenced" : "not sequenced",
+ metadata->flags & GIP_MESSAGE_FLAG_RELIABLE ? "reliable" : "unreliable");
+
+ *offset += length;
+ return 0;
+}
+
+static bool gip_parse_metadata(struct device *dev,
+ struct gip_metadata *metadata, const uint8_t *bytes, int num_bytes)
+{
+ int header_size;
+ int metadata_size;
+ int offset = 0;
+ int i;
+ int rc;
+
+ if (num_bytes < 16)
+ return -EINVAL;
+
+ print_hex_dump_debug(KBUILD_MODNAME ": Received metadata: ",
+ DUMP_PREFIX_OFFSET, 16, 1, bytes, num_bytes, false);
+
+ header_size = get_unaligned_le16(&bytes[0]);
+ if (num_bytes < header_size || header_size < 16)
+ return -EINVAL;
+
+ metadata->version_major = get_unaligned_le16(&bytes[2]);
+ metadata->version_minor = get_unaligned_le16(&bytes[4]);
+ /* Middle bytes are reserved */
+ metadata_size = get_unaligned_le16(&bytes[14]);
+
+ if (num_bytes < metadata_size || metadata_size < header_size)
+ return -EINVAL;
+
+ offset = header_size;
+
+ rc = gip_parse_device_metadata(dev, metadata, bytes, num_bytes, &offset);
+ if (rc)
+ goto parse_err;
+
+ if (offset >= num_bytes)
+ goto parse_err;
+
+ metadata->num_messages = bytes[offset];
+ offset++;
+ if (metadata->num_messages > 0) {
+ metadata->message_metadata = devm_kcalloc(dev,
+ metadata->num_messages,
+ sizeof(*metadata->message_metadata), GFP_KERNEL);
+ if (!metadata->message_metadata)
+ return -ENOMEM;
+
+ for (i = 0; i < metadata->num_messages; i++) {
+ rc = gip_parse_message_metadata(dev,
+ &metadata->message_metadata[i], bytes,
+ num_bytes, &offset);
+ if (rc)
+ goto parse_err;
+ }
+ }
+
+ return 0;
+
+parse_err:
+ gip_metadata_free(dev, metadata);
+ return rc;
+}
+
+static int gip_acknowledge(struct gip_attachment *attachment,
+ const struct gip_header *header, uint32_t fragment_offset,
+ uint16_t bytes_remaining)
+{
+ struct gip_protocol_control_ack message;
+
+ message.control_code = GIP_CONTROL_CODE_ACK;
+ message.message_type = header->message_type;
+ message.flags = header->flags & GIP_FLAG_SYSTEM;
+ message.fragment_offset = cpu_to_le32(fragment_offset);
+ message.remaining_buffer = cpu_to_le16(bytes_remaining);
+
+ return gip_send_raw_message(attachment, GIP_CMD_PROTO_CONTROL,
+ GIP_FLAG_SYSTEM | attachment->attachment_index,
+ header->sequence_id, (uint8_t *)&message, sizeof(message));
+}
+
+static int gip_fragment_failed(struct gip_attachment *attachment,
+ const struct gip_header *header)
+{
+ attachment->in_fragment_retries++;
+ if (attachment->in_fragment_retries > 8) {
+ devm_kfree(to_gip_device(attachment), attachment->in_fragment_data);
+ attachment->in_fragment_data = NULL;
+ attachment->in_fragment_message = -1;
+ return 0;
+ }
+ return gip_acknowledge(attachment, header,
+ attachment->in_fragment_offset,
+ attachment->in_total_length - attachment->in_fragment_offset);
+}
+
+static int gip_bind_driver(struct gip_attachment *attachment, const struct gip_driver *driver)
+{
+ if (driver->probe) {
+ int rc = driver->probe(attachment);
+
+ if (rc)
+ return rc;
+ }
+
+ attachment->driver = driver;
+ memcpy(attachment->vendor_handlers, driver->vendor_handlers,
+ sizeof(attachment->vendor_handlers));
+ return 0;
+}
+
+static int gip_enable_elite_buttons(struct gip_attachment *attachment)
+{
+ if (attachment->vendor_id == GIP_VID_MICROSOFT) {
+ if (attachment->product_id == GIP_PID_XBOX_ELITE) {
+ attachment->xbe_format = GIP_BTN_FMT_XBE1;
+ } else if (attachment->product_id == GIP_PID_XBOX_ELITE_2) {
+ if (attachment->firmware_major_version == 4) {
+ attachment->xbe_format = GIP_BTN_FMT_XBE2_4;
+ } else if (attachment->firmware_major_version == 5) {
+ /*
+ * The exact range for this being necessary is
+ * unknown, but it starts at 5.11 and at either
+ * 5.16 or 5.17. This approach still works on
+ * 5.21, even if it's not necessary, so having
+ * a loose upper limit is fine.
+ */
+ if (attachment->firmware_minor_version >= 11 &&
+ attachment->firmware_minor_version < 17)
+ attachment->xbe_format = GIP_BTN_FMT_XBE2_RAW;
+ else
+ attachment->xbe_format = GIP_BTN_FMT_XBE2_5;
+ }
+ }
+ }
+
+ if (attachment->xbe_format == GIP_BTN_FMT_XBE2_RAW) {
+ /*
+ * The meaning of this packet is unknown and not documented, but
+ * it's needed for the Elite 2 controller to send raw reports
+ */
+ static const uint8_t enable_raw_report[] = { 7, 0 };
+
+ return gip_send_vendor_message(attachment, GIP_SL_ELITE_CONFIG,
+ 0, enable_raw_report, sizeof(enable_raw_report));
+ }
+
+ return 0;
+}
+
+#ifdef CONFIG_JOYSTICK_XBOX_GIP_FF
+static int gip_play_effect(struct input_dev *dev, void *data, struct ff_effect *effect)
+{
+ struct gip_attachment *attachment = input_get_drvdata(dev);
+ struct gip_direct_motor control = {
+ .motor_bitmap = GIP_MOTOR_LEFT_VIBRATION | GIP_MOTOR_RIGHT_VIBRATION
+ };
+
+ if (effect->type != FF_RUMBLE)
+ return 0;
+
+ control.left_vibration_level = effect->u.rumble.strong_magnitude * 100 / 0xFFFF;
+ control.right_vibration_level = effect->u.rumble.weak_magnitude * 100 / 0xFFFF;
+ control.duration = 255;
+
+ return gip_send_vendor_message(attachment, GIP_CMD_DIRECT_MOTOR,
+ 0, &control, sizeof(control));
+}
+#endif
+
+static int gip_send_guide_button_led(struct gip_attachment *attachment,
+ uint8_t pattern, uint8_t intensity)
+{
+ uint8_t buffer[] = {
+ GIP_LED_GUIDE,
+ pattern,
+ intensity,
+ };
+
+ if (!gip_supports_system_message(attachment, GIP_CMD_LED, false))
+ return 0;
+
+ return gip_send_system_message(attachment, GIP_CMD_LED, 0, buffer, sizeof(buffer));
+}
+
+static bool gip_send_set_device_state(struct gip_attachment *attachment, uint8_t state)
+{
+ uint8_t buffer[] = { state };
+
+ return gip_send_system_message(attachment, GIP_CMD_SET_DEVICE_STATE,
+ attachment->attachment_index, buffer, sizeof(buffer));
+}
+
+static int gip_handle_command_raw_report(struct gip_attachment *attachment,
+ const struct gip_header *header, const uint8_t *bytes, int num_bytes)
+{
+ struct input_dev *input;
+
+ if (num_bytes < 17) {
+ gip_dbg(attachment, "Discarding too-short raw report\n");
+ return -EINVAL;
+ }
+ guard(rcu)();
+ input = rcu_dereference(attachment->input);
+ if (!input)
+ return -ENODEV;
+
+ if ((attachment->features & GIP_FEATURE_ELITE_BUTTONS)
+ && attachment->xbe_format == GIP_BTN_FMT_XBE2_RAW) {
+ input_report_abs(input, ABS_PROFILE, bytes[15] & 3);
+ if (bytes[15] & 3) {
+ input_report_key(input, BTN_GRIPL, 0);
+ input_report_key(input, BTN_GRIPR, 0);
+ input_report_key(input, BTN_GRIPL2, 0);
+ input_report_key(input, BTN_GRIPR2, 0);
+ } else {
+ input_report_key(input, BTN_GRIPL,
+ bytes[GIP_BTN_OFFSET_XBE2] & BIT(2));
+ input_report_key(input, BTN_GRIPR,
+ bytes[GIP_BTN_OFFSET_XBE2] & BIT(0));
+ input_report_key(input, BTN_GRIPL2,
+ bytes[GIP_BTN_OFFSET_XBE2] & BIT(3));
+ input_report_key(input, BTN_GRIPR2,
+ bytes[GIP_BTN_OFFSET_XBE2] & BIT(1));
+ }
+
+ input_sync(input);
+ }
+ return 0;
+}
+
+static int gip_setup_input_device(struct gip_attachment *attachment)
+{
+ struct input_dev *input;
+ int rc;
+
+ if (!attachment->driver || !attachment->driver->setup_input)
+ return -ENODEV;
+
+ rcu_read_lock();
+ input = rcu_dereference(attachment->input);
+ rcu_read_unlock();
+ if (input)
+ return 0;
+
+ input = devm_input_allocate_device(to_gip_device(attachment));
+ if (!input)
+ return -ENOMEM;
+ input->id.bustype = BUS_USB;
+ input->id.vendor = attachment->vendor_id;
+ input->id.product = attachment->product_id;
+ input->uniq = attachment->uniq;
+ if (attachment->name)
+ input->name = attachment->name;
+ else if (attachment->attachment_index == 0)
+ input->name = attachment->device->udev->product;
+ input->phys = attachment->phys;
+
+ input_set_capability(input, EV_KEY, BTN_MODE);
+
+ rc = attachment->driver->setup_input(attachment, input);
+ if (rc < 0)
+ goto err_free_device;
+
+ if (attachment->features &
+ (GIP_FEATURE_CONSOLE_FUNCTION_MAP | GIP_FEATURE_CONSOLE_FUNCTION_MAP_OVERFLOW))
+ input_set_capability(input, EV_KEY, KEY_RECORD);
+
+ if (attachment->features & GIP_FEATURE_ELITE_BUTTONS) {
+ input_set_capability(input, EV_KEY, BTN_GRIPL);
+ input_set_capability(input, EV_KEY, BTN_GRIPR);
+ input_set_capability(input, EV_KEY, BTN_GRIPL2);
+ input_set_capability(input, EV_KEY, BTN_GRIPR2);
+ if (attachment->xbe_format == GIP_BTN_FMT_XBE1)
+ input_set_abs_params(input, ABS_PROFILE, 0, 1, 0, 0);
+ else
+ input_set_abs_params(input, ABS_PROFILE, 0, 3, 0, 0);
+
+ attachment->vendor_handlers[GIP_CMD_RAW_REPORT] = gip_handle_command_raw_report;
+ }
+
+#ifdef CONFIG_JOYSTICK_XBOX_GIP_FF
+ if (attachment->features & GIP_FEATURE_MOTOR_CONTROL) {
+ input_set_capability(input, EV_FF, FF_RUMBLE);
+ input_ff_create_memless(input, NULL, gip_play_effect);
+ }
+#endif
+
+ input_set_drvdata(input, attachment);
+ rcu_assign_pointer(attachment->input, input);
+ synchronize_rcu();
+ rc = input_register_device(input);
+ if (rc)
+ goto err_free_device;
+
+ return 0;
+
+err_free_device:
+ rcu_assign_pointer(attachment->input, NULL);
+ synchronize_rcu();
+
+ input_free_device(input);
+ return rc;
+}
+
+static int gip_init_input_device(struct gip_attachment *attachment)
+{
+ struct input_dev *input;
+ int rc = 0;
+
+ rcu_read_lock();
+ input = rcu_dereference(attachment->input);
+ rcu_read_unlock();
+ if (input)
+ return 0;
+
+ if (attachment->driver && attachment->driver->init) {
+ rc = attachment->driver->init(attachment);
+ if (rc < 0)
+ return rc;
+ }
+
+ if (rc != GIP_INIT_NO_INPUT && (attachment->features & GIP_FEATURE_CONTROLLER)) {
+ rc = gip_setup_input_device(attachment);
+ if (rc == -ENODEV)
+ return 0;
+ if (rc)
+ return rc;
+ }
+
+ return rc;
+}
+
+static int gip_send_init_sequence(struct gip_attachment *attachment)
+{
+ int rc = 0;
+ size_t len;
+
+ if (attachment->features & GIP_FEATURE_EXTENDED_SET_DEVICE_STATE) {
+ /*
+ * The meaning of this packet is unknown and not documented, but it's
+ * needed for the Elite 2 controller to start up on older firmwares
+ */
+ static const uint8_t set_device_state[] = {
+ GIP_STATE_UNK6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0,
+ 0x55, 0x53, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0
+ };
+
+ rc = gip_send_system_message(attachment,
+ GIP_CMD_SET_DEVICE_STATE, 0, set_device_state,
+ sizeof(set_device_state));
+ if (rc)
+ return rc;
+ }
+ rc = gip_enable_elite_buttons(attachment);
+ if (rc)
+ return rc;
+ if (!gip_supports_system_message(attachment, GIP_CMD_AUDIO_CONTROL, false)) {
+ rc = gip_send_set_device_state(attachment, GIP_STATE_START);
+ if (rc)
+ return rc;
+ attachment->device_state = GIP_STATE_START;
+ } else {
+ rc = gip_send_set_device_state(attachment, GIP_STATE_STOP);
+ if (rc)
+ return rc;
+ attachment->device_state = GIP_STATE_STOP;
+ }
+
+ rc = gip_send_guide_button_led(attachment,
+ GIP_LED_GUIDE_ON,
+ GIP_LED_GUIDE_INIT_BRIGHTNESS);
+ if (rc)
+ return rc;
+
+ if (gip_supports_system_message(attachment, GIP_CMD_SECURITY, false)
+ && !(attachment->features & GIP_FEATURE_SECURITY_OPT_OUT)) {
+ /* TODO: Implement Security command property */
+ uint8_t buffer[] = { 0x1, 0x0 };
+
+ rc = gip_send_system_message(attachment, GIP_CMD_SECURITY, 0,
+ buffer, sizeof(buffer));
+ if (rc)
+ return rc;
+ }
+
+ usb_make_path(attachment->device->udev, attachment->phys,
+ sizeof(attachment->phys));
+ len = strlen(attachment->phys);
+ if (len < sizeof(attachment->phys) - 1)
+ snprintf(attachment->phys + len,
+ sizeof(attachment->phys) - len, "/input%d",
+ attachment->attachment_index);
+
+ rc = gip_init_input_device(attachment);
+ if (rc)
+ return rc;
+
+ return 0;
+}
+
+static void gip_fragment_timeout(struct work_struct *work)
+{
+ struct gip_attachment *attachment = container_of(to_delayed_work(work),
+ struct gip_attachment, in_fragment_timeout);
+
+ guard(mutex)(&attachment->lock);
+ if (!attachment->in_fragment_data)
+ return;
+
+ devm_kfree(to_gip_device(attachment), attachment->in_fragment_data);
+ attachment->in_fragment_data = NULL;
+ attachment->in_fragment_message = -1;
+}
+
+static void gip_free_devices(struct gip_attachment *attachment)
+{
+ struct input_dev *input;
+
+ if (attachment->driver && attachment->driver->remove)
+ attachment->driver->remove(attachment);
+
+ rcu_read_lock();
+ input = rcu_dereference(attachment->input);
+ rcu_read_unlock();
+
+ rcu_assign_pointer(attachment->input, NULL);
+ synchronize_rcu();
+
+ if (input)
+ input_unregister_device(input);
+}
+
+static void gip_reset_metadata(struct gip_attachment *attachment)
+{
+ if (attachment->got_metadata != GIP_METADATA_GOT)
+ return;
+
+ gip_metadata_free(to_gip_device(attachment), &attachment->metadata);
+ gip_free_devices(attachment);
+ attachment->got_metadata = GIP_METADATA_NONE;
+}
+
+static void gip_retry_metadata(struct work_struct *work)
+{
+ struct gip_attachment *attachment = container_of(to_delayed_work(work),
+ struct gip_attachment, metadata_next);
+
+ guard(mutex)(&attachment->lock);
+ if (attachment->got_metadata == GIP_METADATA_GOT)
+ return;
+
+ if (attachment->metadata_retries < 4) {
+ attachment->metadata_retries++;
+ schedule_delayed_work(&attachment->metadata_next, HZ / 2);
+ gip_send_system_message(attachment, GIP_CMD_METADATA, 0, NULL, 0);
+ } else {
+ gip_info(attachment,
+ "Unable to obtain metadata, attempting to reset device\n");
+ gip_send_set_device_state(attachment, GIP_STATE_RESET);
+ }
+}
+
+static int gip_ensure_metadata(struct gip_attachment *attachment)
+{
+ if (attachment->got_metadata != GIP_METADATA_NONE)
+ return 0;
+
+ attachment->got_metadata = GIP_METADATA_PENDING;
+ cancel_delayed_work(&attachment->metadata_next);
+ schedule_delayed_work(&attachment->metadata_next, HZ / 2);
+ attachment->metadata_retries = 0;
+ return gip_send_system_message(attachment, GIP_CMD_METADATA, 0, NULL, 0);
+}
+
+static void gip_reset_attachment(struct gip_attachment *attachment)
+{
+ cancel_delayed_work(&attachment->metadata_next);
+ cancel_delayed_work(&attachment->in_fragment_timeout);
+
+ if (attachment->in_fragment_data) {
+ devm_kfree(to_gip_device(attachment), attachment->in_fragment_data);
+ attachment->in_fragment_data = NULL;
+ attachment->in_fragment_message = -1;
+ }
+
+ gip_free_devices(attachment);
+}
+
+static int gip_handle_command_protocol_control(struct gip_attachment *attachment,
+ const struct gip_header *header, const uint8_t *bytes, int num_bytes)
+{
+ /* TODO */
+ gip_warn(attachment, "Unimplemented Protocol Control message\n");
+ return -EOPNOTSUPP;
+}
+
+static bool gip_handle_command_hello_device(struct gip_attachment *attachment,
+ const struct gip_header *header, const uint8_t *bytes, int num_bytes)
+{
+ const struct gip_hello_device *message;
+
+ if (num_bytes != sizeof(*message))
+ return -EINVAL;
+
+ message = (const struct gip_hello_device *)bytes;
+
+ gip_dbg(attachment, "Device hello from %llx (%04x:%04x)\n",
+ le64_to_cpu(message->device_id),
+ le16_to_cpu(message->vendor_id),
+ le16_to_cpu(message->product_id));
+ gip_dbg(attachment, "Firmware version %d.%d.%d rev %d\n",
+ le16_to_cpu(message->firmware_major_version),
+ le16_to_cpu(message->firmware_minor_version),
+ le16_to_cpu(message->firmware_build_version),
+ le16_to_cpu(message->firmware_revision));
+
+ /*
+ * The GIP spec specifies that the host should reject the device if any of these are wrong.
+ * I don't know if Windows or an Xbox do, however, so let's just log warnings instead.
+ */
+ if (message->rf_proto_major_version != 1 && message->rf_proto_minor_version != 0)
+ gip_warn(attachment, "Invalid RF protocol version %d.%d, expected 1.0\n",
+ message->rf_proto_major_version, message->rf_proto_minor_version);
+
+ if (message->security_major_version != 1 && message->security_minor_version != 0)
+ gip_warn(attachment, "Invalid security protocol version %d.%d, expected 1.0\n",
+ message->security_major_version, message->security_minor_version);
+
+ if (message->gip_major_version != 1 && message->gip_minor_version != 0)
+ gip_warn(attachment, "Invalid GIP version %d.%d, expected 1.0\n",
+ message->gip_major_version, message->gip_minor_version);
+
+ attachment->firmware_major_version = le16_to_cpu(message->firmware_major_version);
+ attachment->firmware_minor_version = le16_to_cpu(message->firmware_minor_version);
+ attachment->vendor_id = le16_to_cpu(message->vendor_id);
+ attachment->product_id = le16_to_cpu(message->product_id);
+ if (!attachment->uniq)
+ attachment->uniq = devm_kasprintf(to_gip_device(attachment),
+ GFP_KERNEL, "%llx", le64_to_cpu(message->device_id));
+
+ if (header->flags & GIP_FLAG_ATTACHMENT_MASK)
+ return gip_send_system_message(attachment, GIP_CMD_METADATA, 0, NULL, 0);
+ if (attachment->got_metadata == GIP_METADATA_FAKED)
+ attachment->got_metadata = GIP_METADATA_NONE;
+
+ gip_reset_attachment(attachment);
+ return gip_ensure_metadata(attachment);
+}
+
+static int gip_handle_command_status_device(struct gip_attachment *attachment,
+ const struct gip_header *header, const uint8_t *bytes, int num_bytes)
+{
+ int rc;
+ int i;
+
+ if (num_bytes < 1)
+ return -EINVAL;
+
+ attachment->status.base.battery_level = bytes[0] & 3;
+ attachment->status.base.battery_type = (bytes[0] >> 2) & 3;
+ attachment->status.base.charge = (bytes[0] >> 4) & 3;
+ attachment->status.base.power_level = (bytes[0] >> 6) & 3;
+
+ if (num_bytes >= 4) {
+ attachment->status.device_active = bytes[1] & 1;
+ if (bytes[1] & 2) {
+ /* Events present */
+ if (num_bytes < 5)
+ return -EINVAL;
+
+ attachment->status.num_events = bytes[4];
+ if (attachment->status.num_events > 5) {
+ gip_info(attachment,
+ "Device reported too many events, %d > 5\n",
+ attachment->status.num_events);
+ return -EINVAL;
+ }
+ if (5 + attachment->status.num_events * 10 > num_bytes)
+ return -EINVAL;
+
+ for (i = 0; i < attachment->status.num_events; i++) {
+ struct gip_status_event *event = &attachment->status.events[i];
+
+ event->event_type = get_unaligned_le16(&bytes[i * 10 + 5]);
+ event->fault_tag = get_unaligned_le32(&bytes[i * 10 + 7]);
+ event->fault_address = get_unaligned_le32(&bytes[i * 10 + 11]);
+
+ gip_info(attachment,
+ "Attachment %i event type %i, tag %i address %x\n",
+ attachment->attachment_index,
+ event->event_type,
+ event->fault_tag,
+ event->fault_address);
+ }
+ }
+ }
+
+ rc = gip_init_input_device(attachment);
+ if (rc)
+ return rc;
+
+ return gip_ensure_metadata(attachment);
+}
+
+static int gip_handle_command_metadata_respose(struct gip_attachment *attachment,
+ const struct gip_header *header, const uint8_t *bytes, int num_bytes)
+{
+ struct gip_metadata metadata = {0};
+ const guid_t *expected_guid = NULL;
+ bool found_expected_guid;
+ bool found_controller_guid = false;
+ int i, j, k;
+ int rc;
+
+ rc = gip_parse_metadata(to_gip_device(attachment), &metadata, bytes, num_bytes);
+ if (rc)
+ return rc;
+
+ gip_reset_metadata(attachment);
+
+ attachment->metadata = metadata;
+ attachment->got_metadata = GIP_METADATA_GOT;
+ attachment->features = 0;
+ cancel_delayed_work(&attachment->metadata_next);
+
+ for (i = 0; i < metadata.device.num_preferred_types; i++) {
+ const char *type = metadata.device.preferred_types[i];
+
+ gip_dbg(attachment, "Device preferred type: %s\n", type);
+ }
+ for (i = 0; i < metadata.device.num_preferred_types; i++) {
+ const char *type = metadata.device.preferred_types[i];
+
+ for (j = 0; base_drivers[j] && !expected_guid; j++) {
+ for (k = 0; base_drivers[j]->types[k] && !expected_guid; k++) {
+ if (strcmp(type, base_drivers[j]->types[k]) == 0) {
+ gip_dbg(attachment, "Matched type %s\n", type);
+ rc = gip_bind_driver(attachment, base_drivers[j]);
+ if (rc == 0)
+ expected_guid = &base_drivers[j]->guid;
+ else if (rc != -ENODEV)
+ return rc;
+ }
+ }
+ }
+ if (expected_guid)
+ break;
+
+ if (strcmp(type, "Windows.Xbox.Input.Chatpad") == 0)
+ break;
+
+ if (strcmp(type, "Windows.Xbox.Input.Headset") == 0) {
+ expected_guid = &guid_headset;
+ break;
+ }
+ }
+
+ found_expected_guid = !expected_guid;
+ for (i = 0; i < metadata.device.num_supported_interfaces; i++) {
+ const guid_t *guid = &metadata.device.supported_interfaces[i];
+
+ gip_dbg(attachment, "Supported interface: %pUl\n", guid);
+ if (expected_guid && guid_equal(expected_guid, guid))
+ found_expected_guid = true;
+
+ if (guid_equal(&guid_controller, guid)) {
+ found_controller_guid = true;
+ continue;
+ }
+ if (guid_equal(&gip_driver_navigation.guid, guid)) {
+ attachment->features |= GIP_FEATURE_CONTROLLER;
+ continue;
+ }
+ if (guid_equal(&guid_dev_auth_pc_opt_out, guid)) {
+ attachment->features |= GIP_FEATURE_SECURITY_OPT_OUT;
+ continue;
+ }
+ if (guid_equal(&guid_console_function_map, guid)) {
+ attachment->features |= GIP_FEATURE_CONSOLE_FUNCTION_MAP;
+ continue;
+ }
+ if (guid_equal(&guid_console_function_map_overflow, guid)) {
+ attachment->features |= GIP_FEATURE_CONSOLE_FUNCTION_MAP_OVERFLOW;
+ continue;
+ }
+ if (guid_equal(&guid_elite_buttons, guid)) {
+ attachment->features |= GIP_FEATURE_ELITE_BUTTONS;
+ continue;
+ }
+ if (guid_equal(&guid_dynamic_latency_input, guid)) {
+ attachment->features |= GIP_FEATURE_DYNAMIC_LATENCY_INPUT;
+ continue;
+ }
+ }
+
+ for (i = 0; i < metadata.num_messages; i++) {
+ struct gip_message_metadata *message = &metadata.message_metadata[i];
+
+ if (message->type == GIP_CMD_DIRECT_MOTOR && message->length >= 9
+ && (message->flags & GIP_MESSAGE_FLAG_DOWNSTREAM))
+ attachment->features |= GIP_FEATURE_MOTOR_CONTROL;
+ }
+
+ if (!found_expected_guid || !found_controller_guid)
+ gip_dbg(attachment, "Controller was missing expected GUID. "
+ "This controller probably won't work on an actual Xbox.\n");
+
+ gip_handle_quirks(attachment);
+
+ if ((attachment->features & GIP_FEATURE_GUIDE_COLOR)
+ && !gip_supports_vendor_message(attachment,
+ GIP_CMD_GUIDE_COLOR, false))
+ attachment->features &= ~GIP_FEATURE_GUIDE_COLOR;
+
+ gip_dbg(attachment, "Attachment %i has features: %02x\n",
+ attachment->attachment_index, attachment->features);
+
+ return gip_send_init_sequence(attachment);
+}
+
+static int gip_handle_command_security(struct gip_attachment *attachment,
+ const struct gip_header *header, const uint8_t *bytes, int num_bytes)
+{
+ /* TODO: Needed for controllers that connect via dongles */
+ gip_warn(attachment, "Unimplemented Security message\n");
+ return -EOPNOTSUPP;
+}
+
+static int gip_handle_command_guide_button_status(struct gip_attachment *attachment,
+ const struct gip_header *header, const uint8_t *bytes, int num_bytes)
+{
+ struct input_dev *input;
+
+ if (num_bytes < 2)
+ return -EINVAL;
+
+ guard(rcu)();
+ input = rcu_dereference(attachment->input);
+ if (!input)
+ return -ENODEV;
+
+ if (bytes[1] == VK_LWIN) {
+ input_report_key(input, BTN_MODE, bytes[0] & 3);
+ input_sync(input);
+ }
+
+ return 0;
+}
+
+static int gip_handle_command_audio_control(struct gip_attachment *attachment,
+ const struct gip_header *header, const uint8_t *bytes, int num_bytes)
+{
+ /* TODO: Needed for audio */
+ gip_warn(attachment, "Unimplemented Audio Control message\n");
+ return -EOPNOTSUPP;
+}
+
+static int gip_handle_command_firmware(struct gip_attachment *attachment,
+ const struct gip_header *header, const uint8_t *bytes, int num_bytes)
+{
+ if (num_bytes < 1)
+ return -EINVAL;
+
+ if (bytes[0] == 1) {
+ uint16_t major, minor, build, rev;
+
+ if (num_bytes < 14) {
+ gip_dbg(attachment, "Discarding too-short firmware message\n");
+
+ return -EINVAL;
+ }
+ major = get_unaligned_le16(&bytes[6]);
+ minor = get_unaligned_le16(&bytes[8]);
+ build = get_unaligned_le16(&bytes[10]);
+ rev = get_unaligned_le16(&bytes[12]);
+
+ gip_dbg(attachment,
+ "Firmware version: %d.%d.%d rev %d\n", major, minor, build, rev);
+
+ attachment->firmware_major_version = major;
+ attachment->firmware_minor_version = minor;
+
+ if (attachment->vendor_id == GIP_VID_MICROSOFT
+ && attachment->product_id == GIP_PID_XBOX_ELITE_2)
+ return gip_enable_elite_buttons(attachment);
+
+ return 0;
+ }
+
+ gip_warn(attachment, "Unimplemented Firmware message\n");
+
+ return -EOPNOTSUPP;
+}
+
+static int gip_handle_command_hid_report(struct gip_attachment *attachment,
+ const struct gip_header *header, uint8_t *bytes, int num_bytes)
+{
+ gip_warn(attachment, "Unimplemented HID report message\n");
+
+ return -EOPNOTSUPP;
+}
+
+static int gip_handle_command_extended(struct gip_attachment *attachment,
+ const struct gip_header *header, const uint8_t *bytes, int num_bytes)
+{
+ if (num_bytes < 2)
+ return -EINVAL;
+
+ if (bytes[1] != GIP_EXTENDED_STATUS_OK) {
+ gip_dbg(attachment,
+ "Extended message type %02x failed with status %i\n",
+ bytes[0], bytes[1]);
+ return -EPROTO;
+ }
+
+ switch (bytes[0]) {
+ case GIP_EXTCMD_GET_SERIAL_NUMBER:
+ memcpy(attachment->serial, &bytes[2],
+ min(sizeof(attachment->serial), (size_t)(num_bytes - 2)));
+ break;
+ default:
+ /* TODO */
+ gip_dbg(attachment, "Unimplemented extended message type %02x\n",
+ bytes[0]);
+ return -EOPNOTSUPP;
+ }
+
+ return 0;
+}
+
+static int gip_handle_elite_buttons(struct gip_attachment *attachment,
+ struct input_dev *input, const uint8_t *bytes, int num_bytes)
+{
+ bool grip[4] = { 0, 0, 0, 0 };
+ int profile = -1;
+
+ if (attachment->xbe_format == GIP_BTN_FMT_XBE1
+ && num_bytes > GIP_BTN_OFFSET_XBE1) {
+ profile = bytes[GIP_BTN_OFFSET_XBE1] >> 4;
+ if (profile) {
+ grip[0] = bytes[GIP_BTN_OFFSET_XBE1] & BIT(0);
+ grip[1] = bytes[GIP_BTN_OFFSET_XBE1] & BIT(1);
+ grip[2] = bytes[GIP_BTN_OFFSET_XBE1] & BIT(2);
+ grip[3] = bytes[GIP_BTN_OFFSET_XBE1] & BIT(3);
+ }
+ } else if ((attachment->xbe_format == GIP_BTN_FMT_XBE2_4
+ || attachment->xbe_format == GIP_BTN_FMT_XBE2_5)
+ && num_bytes > GIP_BTN_OFFSET_XBE2) {
+ int profile_offset;
+
+ if (attachment->xbe_format == GIP_BTN_FMT_XBE2_4)
+ profile_offset = 15;
+ else
+ profile_offset = 20;
+ profile = bytes[profile_offset] & 3;
+
+ if (!profile) {
+ grip[0] = bytes[GIP_BTN_OFFSET_XBE2] & BIT(2);
+ grip[1] = bytes[GIP_BTN_OFFSET_XBE2] & BIT(0);
+ grip[2] = bytes[GIP_BTN_OFFSET_XBE2] & BIT(3);
+ grip[3] = bytes[GIP_BTN_OFFSET_XBE2] & BIT(1);
+ }
+ }
+ if (profile >= 0) {
+ input_report_key(input, BTN_GRIPL, grip[0]);
+ input_report_key(input, BTN_GRIPR, grip[1]);
+ input_report_key(input, BTN_GRIPL2, grip[2]);
+ input_report_key(input, BTN_GRIPR2, grip[3]);
+ input_report_abs(input, ABS_PROFILE, profile);
+ }
+ return 0;
+}
+
+static int gip_handle_console_map(struct gip_attachment *attachment,
+ struct input_dev *input, const uint8_t *bytes, int num_bytes)
+{
+ int function_map_offset = -1;
+
+ if (attachment->features & GIP_FEATURE_DYNAMIC_LATENCY_INPUT) {
+ /* The dynamic latency input bytes are after the console function map */
+ if (num_bytes >= 26)
+ function_map_offset = num_bytes - 26;
+ } else {
+ function_map_offset = num_bytes - 18;
+ }
+ if (function_map_offset >= 0) {
+ input_report_key(input, KEY_RECORD,
+ bytes[function_map_offset] & BIT(0));
+ }
+ return 0;
+}
+
+static int gip_handle_ll_input_report(struct gip_attachment *attachment,
+ const struct gip_header *header, const uint8_t *bytes, int num_bytes)
+{
+ struct input_dev *input;
+ int rc = 0;
+
+ guard(rcu)();
+ input = rcu_dereference(attachment->input);
+ if (!input)
+ return -ENODEV;
+
+ if (attachment->device_state != GIP_STATE_START) {
+ gip_dbg(attachment, "Discarding early input report\n");
+ attachment->device_state = GIP_STATE_START;
+ return 0;
+ }
+
+ if (attachment->driver && attachment->driver->handle_input_report) {
+ rc = attachment->driver->handle_input_report(attachment, input, bytes, num_bytes);
+ if (rc < 0)
+ return rc;
+ }
+
+ if (attachment->features & GIP_FEATURE_ELITE_BUTTONS) {
+ rc = gip_handle_elite_buttons(attachment, input, bytes, num_bytes);
+ if (rc < 0)
+ goto exit;
+ }
+
+ if (num_bytes >= 32 && (attachment->features & GIP_FEATURE_CONSOLE_FUNCTION_MAP))
+ rc = gip_handle_console_map(attachment, input, bytes, num_bytes);
+
+exit:
+ input_sync(input);
+
+ return rc;
+}
+
+static int gip_handle_ll_overflow_input_report(struct gip_attachment *attachment,
+ const struct gip_header *header, const uint8_t *bytes, int num_bytes)
+{
+ struct input_dev *input;
+ int rc = 0;
+
+ guard(rcu)();
+ input = rcu_dereference(attachment->input);
+ if (!input)
+ return -ENODEV;
+
+ if (attachment->device_state != GIP_STATE_START) {
+ gip_dbg(attachment, "Discarding early input report\n");
+ attachment->device_state = GIP_STATE_START;
+ return 0;
+ }
+
+ if (attachment->driver && attachment->driver->handle_overflow_input_report) {
+ rc = attachment->driver->handle_overflow_input_report(attachment,
+ input, bytes, num_bytes);
+ if (rc < 0)
+ return rc;
+ }
+
+ if (attachment->features & GIP_FEATURE_CONSOLE_FUNCTION_MAP_OVERFLOW)
+ rc = gip_handle_console_map(attachment, input, bytes, num_bytes);
+
+ input_sync(input);
+
+ return rc;
+}
+
+static int gip_handle_audio_data(struct gip_attachment *attachment,
+ const struct gip_header *header, const uint8_t *bytes, int num_bytes)
+{
+ /* TODO: Needed for audio support */
+ gip_dbg(attachment, "Unimplemented Audio Data message\n");
+ return -EOPNOTSUPP;
+}
+
+static int gip_handle_system_message(struct gip_attachment *attachment,
+ const struct gip_header *header, uint8_t *bytes, int num_bytes)
+{
+ if (!gip_supports_system_message(attachment, header->message_type, true)) {
+ gip_warn(attachment,
+ "Received claimed-unsupported system message type %02x\n",
+ header->message_type);
+ return -EPROTO;
+ }
+ switch (header->message_type) {
+ case GIP_CMD_PROTO_CONTROL:
+ return gip_handle_command_protocol_control(attachment, header,
+ bytes, num_bytes);
+ case GIP_CMD_HELLO_DEVICE:
+ return gip_handle_command_hello_device(attachment, header,
+ bytes, num_bytes);
+ case GIP_CMD_STATUS_DEVICE:
+ return gip_handle_command_status_device(attachment, header,
+ bytes, num_bytes);
+ case GIP_CMD_METADATA:
+ return gip_handle_command_metadata_respose(attachment, header,
+ bytes, num_bytes);
+ case GIP_CMD_SECURITY:
+ return gip_handle_command_security(attachment, header, bytes,
+ num_bytes);
+ case GIP_CMD_GUIDE_BUTTON:
+ return gip_handle_command_guide_button_status(attachment,
+ header, bytes, num_bytes);
+ case GIP_CMD_AUDIO_CONTROL:
+ return gip_handle_command_audio_control(attachment, header,
+ bytes, num_bytes);
+ case GIP_CMD_FIRMWARE:
+ return gip_handle_command_firmware(attachment, header, bytes,
+ num_bytes);
+ case GIP_CMD_HID_REPORT:
+ return gip_handle_command_hid_report(attachment, header,
+ bytes, num_bytes);
+ case GIP_CMD_EXTENDED:
+ return gip_handle_command_extended(attachment, header, bytes,
+ num_bytes);
+ case GIP_AUDIO_DATA:
+ return gip_handle_audio_data(attachment, header, bytes,
+ num_bytes);
+ default:
+ gip_warn(attachment,
+ "Received unknown system message type %02x\n",
+ header->message_type);
+ return -EPROTO;
+ }
+}
+
+static struct gip_attachment *gip_ensure_attachment(struct gip_device *device,
+ uint8_t attachment_index)
+{
+ struct gip_attachment *attachment = device->attachments[attachment_index];
+
+ if (!attachment) {
+ attachment = devm_kzalloc(to_gip_device(device), sizeof(*attachment), GFP_KERNEL);
+ if (!attachment)
+ return ERR_PTR(-ENOMEM);
+
+ attachment->attachment_index = attachment_index;
+ attachment->device = device;
+ attachment->in_fragment_message = -1;
+
+ if (attachment_index == 0) {
+ attachment->vendor_id = device->udev->descriptor.idVendor;
+ attachment->product_id = device->udev->descriptor.idProduct;
+ }
+
+ device->attachments[attachment_index] = attachment;
+
+ mutex_init(&attachment->lock);
+ INIT_DELAYED_WORK(&attachment->in_fragment_timeout, gip_fragment_timeout);
+ INIT_DELAYED_WORK(&attachment->metadata_next, gip_retry_metadata);
+
+ attachment->metadata.device.in_system_messages[0] =
+ GIP_DEFAULT_IN_SYSTEM_MESSAGES;
+ attachment->metadata.device.out_system_messages[0] =
+ GIP_DEFAULT_OUT_SYSTEM_MESSAGES;
+ if (attachment->attachment_index == 0) {
+ /* Some decent default settings */
+ attachment->features |= GIP_FEATURE_CONTROLLER;
+ attachment->metadata.device.in_system_messages[0] |=
+ BIT(GIP_CMD_GUIDE_BUTTON);
+ }
+
+ gip_handle_quirks(attachment);
+ if (attachment->quirks & GIP_QUIRK_NO_HELLO)
+ gip_ensure_metadata(attachment);
+
+ attachment->got_metadata = GIP_METADATA_FAKED;
+ }
+ return attachment;
+}
+
+static int gip_handle_message(struct gip_attachment *attachment,
+ const struct gip_header *header, uint8_t *bytes, int num_bytes)
+{
+ if (header->flags & GIP_FLAG_SYSTEM)
+ return gip_handle_system_message(attachment, header, bytes,
+ num_bytes);
+
+ if (header->message_type < MAX_GIP_CMD && attachment->vendor_handlers[header->message_type])
+ return attachment->vendor_handlers[header->message_type](attachment,
+ header, bytes, num_bytes);
+
+ switch (header->message_type) {
+ case GIP_LL_INPUT_REPORT:
+ return gip_handle_ll_input_report(attachment, header, bytes,
+ num_bytes);
+ case GIP_LL_OVERFLOW_INPUT_REPORT:
+ return gip_handle_ll_overflow_input_report(attachment, header,
+ bytes, num_bytes);
+ }
+ gip_info(attachment,
+ "Received unknown vendor message type %02x\n",
+ header->message_type);
+ return -EOPNOTSUPP;
+}
+
+static int gip_receive_fragment(struct gip_attachment *attachment,
+ const struct gip_header *header, int offset,
+ uint64_t *fragment_offset, uint16_t *bytes_remaining, uint8_t *bytes,
+ int num_bytes)
+{
+ int rc = 0;
+
+ if (header->flags & GIP_FLAG_INIT_FRAG) {
+ uint64_t total_length;
+
+ guard(mutex)(&attachment->lock);
+ if (attachment->in_fragment_message >= 0) {
+ /*
+ * Reset fragment buffer if we get a new initial
+ * fragment before finishing the last message.
+ * TODO: Is this the correct behavior?
+ */
+ devm_kfree(to_gip_device(attachment), attachment->in_fragment_data);
+ attachment->in_fragment_data = NULL;
+ }
+ offset += gip_decode_length(&total_length, &bytes[offset],
+ num_bytes - offset);
+ if (total_length > MAX_MESSAGE_LENGTH)
+ return -EINVAL;
+
+ if (header->length > num_bytes - offset) {
+ gip_warn(attachment,
+ "Received fragment that claims to be %llu bytes, expected %i\n",
+ header->length, num_bytes - offset);
+ return -EPROTO;
+ }
+ if (header->length > total_length) {
+ gip_warn(attachment,
+ "Received too long fragment, %llu bytes, exceeds %lld\n",
+ header->length, total_length);
+ return -EINVAL;
+ }
+ attachment->in_fragment_data = devm_kmalloc(to_gip_device(attachment),
+ total_length, GFP_KERNEL);
+ if (!attachment->in_fragment_data)
+ return -ENOMEM;
+ attachment->in_total_length = total_length;
+ attachment->in_fragment_message = header->message_type;
+ memcpy(attachment->in_fragment_data, &bytes[offset],
+ header->length);
+ *fragment_offset = header->length;
+ attachment->in_fragment_offset = header->length;
+ *bytes_remaining = attachment->in_total_length - header->length;
+ if (header->flags & GIP_FLAG_ACME)
+ gip_acknowledge(attachment, header, *fragment_offset, *bytes_remaining);
+ } else {
+ guard(mutex)(&attachment->lock);
+ if (attachment->in_fragment_message < 0) {
+ gip_warn_ratelimited(attachment,
+ "Received unexpected fragment of message type %02x\n",
+ header->message_type);
+ return -EPROTO;
+ }
+ if (header->message_type != attachment->in_fragment_message) {
+ gip_warn_ratelimited(attachment,
+ "Received out of sequence message type %02x, expected %02x\n",
+ header->message_type, attachment->in_fragment_message);
+ gip_fragment_failed(attachment, header);
+ return -EPROTO;
+ }
+
+ offset += gip_decode_length(fragment_offset, &bytes[offset],
+ num_bytes - offset);
+
+ if (header->length > num_bytes - offset) {
+ gip_warn(attachment,
+ "Received fragment that claims to be %llu bytes, expected %i\n",
+ header->length, num_bytes - offset);
+ return -EPROTO;
+ }
+ if (*fragment_offset != attachment->in_fragment_offset) {
+ /*
+ * While this is theoretically always an issue, for
+ * whatever reason a bunch of controllers will send the
+ * wrong final fragment offset. Presumably, that means
+ * the official driver won't reject it, so I guess we
+ * shouldn't either. Feels bad.
+ */
+ if (header->length && *fragment_offset != attachment->in_total_length) {
+ gip_warn_ratelimited(attachment,
+ "Received out of sequence fragment: claimed %llu, expected %d\n",
+ *fragment_offset, attachment->in_fragment_offset);
+ gip_acknowledge(attachment, header,
+ attachment->in_fragment_offset,
+ attachment->in_total_length - attachment->in_fragment_offset);
+ return -EPROTO;
+ }
+ gip_dbg_ratelimited(attachment,
+ "Received erroneous final fragment offset, proceeding anyway\n");
+ *bytes_remaining = 0;
+ }
+ if (*fragment_offset + header->length > attachment->in_total_length) {
+ gip_warn(attachment,
+ "Received too long fragment, %llu exceeds %d\n",
+ *fragment_offset + header->length, attachment->in_total_length);
+ gip_fragment_failed(attachment, header);
+ return -EINVAL;
+ } else {
+ *bytes_remaining = attachment->in_total_length -
+ (*fragment_offset + header->length);
+ }
+ if (header->length != 0)
+ memcpy(&attachment->in_fragment_data[*fragment_offset],
+ &bytes[offset], header->length);
+ *fragment_offset += header->length;
+ attachment->in_fragment_offset = *fragment_offset;
+
+ if (header->flags & GIP_FLAG_ACME)
+ gip_acknowledge(attachment, header, *fragment_offset, *bytes_remaining);
+ if (header->length == 0 && !*bytes_remaining) {
+ rc = gip_handle_message(attachment, header,
+ attachment->in_fragment_data,
+ attachment->in_total_length);
+ devm_kfree(to_gip_device(attachment), attachment->in_fragment_data);
+ attachment->in_fragment_data = NULL;
+ attachment->in_fragment_message = -1;
+ }
+ }
+ cancel_delayed_work(&attachment->in_fragment_timeout);
+ schedule_delayed_work(&attachment->in_fragment_timeout, HZ);
+
+ return rc;
+}
+
+static int gip_receive_message(struct gip_device *device, uint8_t *bytes,
+ int num_bytes)
+{
+ struct gip_header header;
+ int offset = 3;
+ int rc = 0;
+ uint64_t fragment_offset = 0;
+ uint16_t bytes_remaining = 0;
+ bool is_fragment;
+ uint8_t attachment_index;
+ struct gip_attachment *attachment;
+
+ if (num_bytes < 5)
+ return -EINVAL;
+
+ header.message_type = bytes[0];
+ header.flags = bytes[1];
+ header.sequence_id = bytes[2];
+ offset += gip_decode_length(&header.length, &bytes[offset], num_bytes - offset);
+
+ is_fragment = header.flags & GIP_FLAG_FRAGMENT;
+ attachment_index = header.flags & GIP_FLAG_ATTACHMENT_MASK;
+ attachment = gip_ensure_attachment(device, attachment_index);
+ if (IS_ERR(attachment))
+ return PTR_ERR(attachment);
+
+ print_hex_dump_debug(KBUILD_MODNAME ": Received message: ",
+ DUMP_PREFIX_OFFSET, 16, 1, bytes, num_bytes, false);
+
+ /* Handle coalescing fragmented messages */
+ if (is_fragment) {
+ rc = gip_receive_fragment(attachment, &header, offset,
+ &fragment_offset, &bytes_remaining, bytes, num_bytes);
+ } else if (header.length + offset > num_bytes) {
+ gip_warn(device,
+ "Received message with erroneous length (claimed %llu, actual %d), discarding\n",
+ header.length + offset, num_bytes);
+ rc = -EPROTO;
+ } else {
+ guard(mutex)(&attachment->lock);
+ num_bytes -= offset;
+ bytes += offset;
+ fragment_offset = header.length;
+ if (header.flags & GIP_FLAG_ACME)
+ gip_acknowledge(attachment, &header, fragment_offset, bytes_remaining);
+ rc = gip_handle_message(attachment, &header, bytes, num_bytes);
+ }
+
+ return rc;
+}
+
+static void gip_receive_work(struct work_struct *work)
+{
+ struct gip_device *device = container_of(work, struct gip_device,
+ receive_message);
+ unsigned long flags;
+
+ spin_lock_irqsave(&device->message_lock, flags);
+ while (device->pending_in_messages) {
+ struct gip_raw_message *message = &device->in_queue[device->next_in_message];
+
+ spin_unlock_irqrestore(&device->message_lock, flags);
+
+ gip_receive_message(device, message->bytes, message->num_bytes);
+
+ spin_lock_irqsave(&device->message_lock, flags);
+ device->next_in_message = (device->next_in_message + 1) % MAX_IN_MESSAGES;
+ device->pending_in_messages--;
+ }
+ spin_unlock_irqrestore(&device->message_lock, flags);
+}
+
+static void gip_urb_in(struct urb *urb)
+{
+ struct gip_interface *intf = urb->context;
+ struct gip_device *gip = intf->device;
+ struct device *dev = &intf->intf->dev;
+ int status = urb->status;
+ int message_id;
+ struct gip_raw_message *message;
+ unsigned long flags;
+
+ switch (status) {
+ case 0:
+ /* success */
+ break;
+ case -ECONNRESET:
+ case -ENOENT:
+ case -ESHUTDOWN:
+ /* this urb is terminated, clean up */
+ dev_dbg(dev, "%s - urb shutting down with status: %d\n",
+ __func__, status);
+ return;
+ default:
+ dev_dbg(dev, "%s - urb has status of: %d\n",
+ __func__, status);
+ goto exit;
+ }
+ if (intf->isoc_messages) {
+ /* TODO: Needed for audio support */
+ gip_warn(gip, "Unimplemented isochronous message input\n");
+ goto exit;
+ }
+
+ spin_lock_irqsave(&gip->message_lock, flags);
+ if (gip->pending_in_messages >= MAX_IN_MESSAGES) {
+ gip_err(gip, "Input queue is full; dropping message\n");
+ } else {
+ message_id = (gip->next_in_message + gip->pending_in_messages) % MAX_IN_MESSAGES;
+ message = &gip->in_queue[message_id];
+ gip->pending_in_messages++;
+ memcpy(message->bytes, intf->in_data, urb->actual_length);
+ message->num_bytes = urb->actual_length;
+ }
+ spin_unlock_irqrestore(&gip->message_lock, flags);
+ schedule_work(&gip->receive_message);
+
+exit:
+ status = usb_submit_urb(urb, GFP_ATOMIC);
+ if (status)
+ dev_err(dev, "%s - usb_submit_urb failed with result %d\n",
+ __func__, status);
+}
+
+static void gip_urb_out(struct urb *urb)
+{
+ struct gip_interface *intf = urb->context;
+ struct device *dev = &intf->intf->dev;
+ int status = urb->status;
+
+ switch (status) {
+ case 0:
+ /* success */
+ break;
+
+ case -ECONNRESET:
+ case -ENOENT:
+ case -ESHUTDOWN:
+ /* this urb is terminated, clean up */
+ dev_dbg(dev, "%s - urb shutting down with status: %d\n",
+ __func__, status);
+ break;
+
+ default:
+ dev_dbg(dev, "%s - nonzero urb status received: %d\n",
+ __func__, status);
+ break;
+ }
+}
+
+static int gip_init_input(struct gip_interface *intf,
+ struct usb_endpoint_descriptor *ep_in)
+{
+ int error;
+ struct usb_device *udev = interface_to_usbdev(intf->intf);
+
+ intf->urb_in = usb_alloc_urb(intf->isoc_messages, GFP_KERNEL);
+ if (!intf->urb_in)
+ return -ENOMEM;
+
+ intf->in_data = usb_alloc_coherent(udev, intf->mtu, GFP_KERNEL,
+ &intf->urb_in->transfer_dma);
+
+ if (!intf->in_data) {
+ return -ENOMEM;
+ goto err_free_urb;
+ }
+
+ usb_fill_int_urb(intf->urb_in, udev,
+ usb_rcvintpipe(udev, ep_in->bEndpointAddress),
+ intf->in_data, intf->mtu, gip_urb_in, intf,
+ ep_in->bInterval);
+ intf->urb_in->transfer_flags |= URB_NO_TRANSFER_DMA_MAP;
+
+ if (intf->isoc_messages)
+ intf->urb_in->transfer_flags |= URB_ISO_ASAP;
+
+ return 0;
+
+err_free_urb:
+ usb_free_urb(intf->urb_in);
+ intf->urb_in = NULL;
+
+ return error;
+}
+
+static int gip_init_output(struct gip_interface *intf,
+ struct usb_endpoint_descriptor *ep_out)
+{
+ int error;
+ struct usb_device *udev = interface_to_usbdev(intf->intf);
+ int i;
+
+ if (usb_ifnum_to_if(udev, GIP_WIRED_INTF_AUDIO)) {
+ /*
+ * Explicitly disable the audio interface. This is needed
+ * for some controllers, such as the PowerA Enhanced Wired
+ * Controller for Series X|S (0x20d6:0x200e) to report the
+ * guide button.
+ */
+ error = usb_set_interface(udev, GIP_WIRED_INTF_AUDIO, 0);
+ if (error)
+ gip_warn(intf,
+ "unable to disable audio interface: %d\n",
+ error);
+ }
+
+ init_usb_anchor(&intf->out_anchor);
+
+ for (i = 0; i < MAX_OUT_MESSAGES; i++) {
+ intf->out_queue[i].urb = usb_alloc_urb(intf->isoc_messages, GFP_KERNEL);
+ if (!intf->out_queue[i].urb) {
+ error = -ENOMEM;
+ goto err_free_urbs;
+ }
+
+ intf->out_queue[i].data = usb_alloc_coherent(udev, intf->mtu, GFP_KERNEL,
+ &intf->out_queue[i].urb->transfer_dma);
+
+ if (!intf->out_queue[i].data) {
+ return -ENOMEM;
+ goto err_free_urbs;
+ }
+
+ usb_fill_int_urb(intf->out_queue[i].urb, udev,
+ usb_sndintpipe(udev, ep_out->bEndpointAddress),
+ intf->out_queue[i].data, intf->mtu, gip_urb_out, intf,
+ ep_out->bInterval);
+ intf->out_queue[i].urb->transfer_flags |= URB_NO_TRANSFER_DMA_MAP;
+
+ if (intf->isoc_messages)
+ intf->out_queue[i].urb->transfer_flags |= URB_ISO_ASAP;
+ }
+
+ return 0;
+
+err_free_urbs:
+ for (i = 0; i < MAX_OUT_MESSAGES; i++) {
+ if (intf->out_queue[i].data)
+ usb_free_coherent(udev, intf->mtu, intf->out_queue[i].data,
+ intf->out_queue[i].urb->transfer_dma);
+ usb_free_urb(intf->out_queue[i].urb);
+ intf->out_queue[i].urb = NULL;
+ }
+ return error;
+}
+
+static void gip_deinit_output(struct gip_interface *intf)
+{
+ int i;
+
+ for (i = 0; i < MAX_OUT_MESSAGES; i++) {
+ if (!intf->out_queue[i].urb)
+ continue;
+ usb_free_coherent(interface_to_usbdev(intf->intf), intf->mtu,
+ intf->out_queue[i].data, intf->out_queue[i].urb->transfer_dma);
+ usb_free_urb(intf->out_queue[i].urb);
+ intf->out_queue[i].data = NULL;
+ intf->out_queue[i].urb = NULL;
+ }
+}
+
+static void gip_deinit_input(struct gip_interface *intf)
+{
+ usb_free_coherent(interface_to_usbdev(intf->intf), intf->mtu,
+ intf->in_data, intf->urb_in->transfer_dma);
+ usb_free_urb(intf->urb_in);
+ intf->urb_in = NULL;
+}
+
+static int gip_interface_init(struct gip_interface *intf)
+{
+ struct usb_endpoint_descriptor *ep_in = NULL;
+ struct usb_endpoint_descriptor *ep_out = NULL;
+ int error = usb_find_common_endpoints(intf->intf->cur_altsetting,
+ NULL, NULL, &ep_in, &ep_out);
+
+ if (error)
+ return error;
+
+ if (!ep_in || !ep_out)
+ return -ENODEV;
+
+ error = gip_init_input(intf, ep_in);
+ if (error)
+ return error;
+
+ error = gip_init_output(intf, ep_out);
+ if (error)
+ goto err_free_input;
+
+ if (usb_submit_urb(intf->urb_in, GFP_KERNEL)) {
+ error = -EIO;
+ goto err_free_output;
+ }
+
+ return 0;
+
+err_free_output:
+ gip_deinit_output(intf);
+err_free_input:
+ gip_deinit_input(intf);
+ return error;
+}
+
+static int gip_probe(struct usb_interface *intf, const struct usb_device_id *id)
+{
+ struct usb_device *udev = interface_to_usbdev(intf);
+ struct gip_device *gip = NULL;
+ struct gip_attachment *attachment;
+ int rc;
+
+ if (intf->cur_altsetting->desc.bInterfaceNumber != GIP_WIRED_INTF_DATA) {
+ /*
+ * The Xbox One controller lists three interfaces all with the
+ * same interface class, subclass and protocol. Differentiate by
+ * interface number.
+ */
+ return 0;
+ }
+
+ gip = devm_kzalloc(&udev->dev, sizeof(*gip), GFP_KERNEL);
+ if (!gip)
+ return -ENOMEM;
+
+ gip->udev = udev;
+ gip->data.device = gip;
+ gip->data.intf = intf;
+ gip->data.mtu = BASE_GIP_MTU;
+ gip->audio.device = gip;
+ gip->audio.mtu = MAX_GIP_MTU;
+ gip->audio.isoc_messages = MAX_AUDIO_MESSAGES;
+
+ INIT_WORK(&gip->receive_message, gip_receive_work);
+ spin_lock_init(&gip->message_lock);
+
+ rc = gip_interface_init(&gip->data);
+ if (rc) {
+ devm_kfree(to_gip_device(gip), gip);
+ return rc;
+ }
+ /* Don't init audio interface -- we aren't using it yet */
+
+ usb_set_intfdata(intf, gip);
+
+ /* Pre-create the first attachment, as it should always exist */
+ attachment = gip_ensure_attachment(gip, 0);
+ if (IS_ERR(attachment)) {
+ usb_kill_urb(gip->data.urb_in);
+ usb_kill_anchored_urbs(&gip->data.out_anchor);
+ gip_deinit_input(&gip->data);
+ gip_deinit_output(&gip->data);
+ return PTR_ERR(attachment);
+ }
+
+ return 0;
+}
+
+static int gip_shutdown(struct gip_device *device)
+{
+ int i;
+
+ cancel_work_sync(&device->receive_message);
+
+ for (i = 0; i < MAX_ATTACHMENTS; i++) {
+ struct gip_attachment *attachment = device->attachments[i];
+
+ if (!attachment)
+ continue;
+
+ cancel_delayed_work_sync(&attachment->metadata_next);
+ cancel_delayed_work_sync(&attachment->in_fragment_timeout);
+
+ guard(mutex)(&attachment->lock);
+ gip_reset_attachment(attachment);
+ gip_reset_metadata(attachment);
+ }
+
+ return 0;
+}
+
+static void gip_disconnect(struct usb_interface *intf)
+{
+ struct gip_device *gip = usb_get_intfdata(intf);
+ int i;
+
+ if (!gip)
+ return;
+
+ gip_shutdown(gip);
+
+ usb_kill_urb(gip->data.urb_in);
+ usb_kill_anchored_urbs(&gip->data.out_anchor);
+ if (gip->audio.intf) {
+ usb_kill_urb(gip->audio.urb_in);
+ usb_kill_anchored_urbs(&gip->audio.out_anchor);
+ }
+
+ gip_deinit_input(&gip->data);
+ gip_deinit_output(&gip->data);
+ if (gip->audio.intf) {
+ gip_deinit_input(&gip->audio);
+ gip_deinit_output(&gip->audio);
+ }
+
+ usb_set_intfdata(intf, NULL);
+
+ for (i = 0; i < MAX_ATTACHMENTS; i++) {
+ struct gip_attachment *attachment = gip->attachments[i];
+
+ if (!attachment)
+ continue;
+
+ gip_reset_attachment(attachment);
+ gip_reset_metadata(attachment);
+
+ devm_kfree(to_gip_device(attachment), attachment->uniq);
+ devm_kfree(to_gip_device(attachment), attachment);
+ }
+
+ devm_kfree(to_gip_device(gip), gip);
+}
+
+static int gip_suspend(struct usb_interface *intf, pm_message_t message)
+{
+ struct gip_device *gip = usb_get_intfdata(intf);
+
+ if (!gip)
+ return 0;
+
+ usb_kill_urb(gip->data.urb_in);
+ usb_kill_anchored_urbs(&gip->data.out_anchor);
+ if (gip->audio.intf) {
+ usb_kill_urb(gip->audio.urb_in);
+ usb_kill_anchored_urbs(&gip->audio.out_anchor);
+ }
+
+ if (gip->attachments[0]) {
+ struct gip_attachment *attachment = gip->attachments[0];
+
+ guard(mutex)(&attachment->lock);
+ gip_send_set_device_state(attachment, GIP_STATE_OFF);
+ attachment->device_state = GIP_STATE_OFF;
+ }
+
+ return gip_shutdown(gip);
+}
+
+static int gip_resume(struct usb_interface *intf)
+{
+ struct gip_device *gip = usb_get_intfdata(intf);
+
+ if (!gip)
+ return 0;
+
+ if (usb_submit_urb(gip->data.urb_in, GFP_KERNEL))
+ return -EIO;
+
+ return 0;
+}
+
+/* The Xbox One controller uses subclass 71 and protocol 208. */
+#define GIP_VENDOR(vend) \
+ { \
+ .match_flags = USB_DEVICE_ID_MATCH_VENDOR | USB_DEVICE_ID_MATCH_INT_INFO, \
+ .idVendor = (vend), \
+ .bInterfaceClass = USB_CLASS_VENDOR_SPEC, \
+ .bInterfaceSubClass = 71, \
+ .bInterfaceProtocol = 208 \
+ }
+
+static const struct usb_device_id gip_table[] = {
+ /*
+ * Please keep this list sorted by vendor ID.
+ */
+ GIP_VENDOR(0x03f0), /* HP/HyperX */
+ GIP_VENDOR(0x044f), /* ThrustMaster */
+ GIP_VENDOR(0x045e), /* Microsoft */
+ GIP_VENDOR(0x046d), /* Logitech */
+ GIP_VENDOR(0x0738), /* Mad Catz */
+ GIP_VENDOR(0x0b05), /* ASUS */
+ GIP_VENDOR(0x0e6f), /* PDP */
+ GIP_VENDOR(0x0f0d), /* Hori */
+ GIP_VENDOR(0x10f5), /* Turtle Beach */
+ GIP_VENDOR(0x1532), /* Razer */
+ GIP_VENDOR(0x20d6), /* PowerA/BDA */
+ GIP_VENDOR(0x24c6), /* PowerA/BDA/ThrustMaster */
+ GIP_VENDOR(0x294b), /* Snakebyte */
+ GIP_VENDOR(0x2dc8), /* 8BitDo */
+ GIP_VENDOR(0x2e24), /* Hyperkin */
+ GIP_VENDOR(0x2e95), /* SCUF Gaming */
+ GIP_VENDOR(0x3285), /* Nacon */
+ GIP_VENDOR(0x3537), /* GameSir */
+ GIP_VENDOR(0x366c), /* ByoWave */
+ { }
+};
+
+MODULE_DEVICE_TABLE(usb, gip_table);
+
+static struct usb_driver gip_driver = {
+ .name = "xbox-gip",
+ .probe = gip_probe,
+ .disconnect = gip_disconnect,
+ .suspend = gip_suspend,
+ .resume = gip_resume,
+ .id_table = gip_table,
+};
+
+module_usb_driver(gip_driver);
+
+MODULE_AUTHOR("Vicki Pfau <vi@endrift.com>");
+MODULE_DESCRIPTION("Xbox Gaming Input Protocol driver");
+MODULE_LICENSE("GPL");
diff --git a/drivers/input/joystick/gip/gip-drivers.c b/drivers/input/joystick/gip/gip-drivers.c
new file mode 100644
index 000000000000..2c2297b1fed8
--- /dev/null
+++ b/drivers/input/joystick/gip/gip-drivers.c
@@ -0,0 +1,204 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+/*
+ * Base drivers for common GIP devices
+ *
+ * Copyright (c) 2025 Valve Software
+ *
+ * This driver is based on the Microsoft GIP spec at:
+ * https://aka.ms/gipdocs
+ * https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-gipusb/e7c90904-5e21-426e-b9ad-d82adeee0dbc
+ */
+
+#include <linux/unaligned.h>
+#include "gip.h"
+
+struct gip_device_capabilities_response {
+ uint8_t extra_button_count;
+ uint8_t extra_axis_count;
+ uint8_t led_count;
+ uint8_t max_global_led_gain;
+};
+
+static bool dpad_as_buttons;
+
+static int gip_setup_gamepad_input(struct gip_attachment *attachment, struct input_dev *input)
+{
+ int ret = gip_driver_navigation.setup_input(attachment, input);
+
+ if (ret < 0)
+ return ret;
+ input_set_capability(input, EV_KEY, BTN_THUMBR);
+ input_set_capability(input, EV_KEY, BTN_THUMBL);
+ input_set_abs_params(input, ABS_X, -32768, 32767, 16, 128);
+ input_set_abs_params(input, ABS_Y, -32768, 32767, 16, 128);
+ input_set_abs_params(input, ABS_RX, -32768, 32767, 16, 128);
+ input_set_abs_params(input, ABS_RY, -32768, 32767, 16, 128);
+ input_set_abs_params(input, ABS_Z, 0, 1023, 0, 0);
+ input_set_abs_params(input, ABS_RZ, 0, 1023, 0, 0);
+
+ /* Xbox Adaptive Controller */
+ if (attachment->vendor_id == 0x045e && attachment->product_id == 0x0b0a)
+ input_set_abs_params(input, ABS_PROFILE, 0, 3, 0, 0);
+ return 0;
+}
+
+static int gip_handle_gamepad_report(struct gip_attachment *attachment,
+ struct input_dev *input, const uint8_t *bytes, int num_bytes)
+{
+ int ret = gip_driver_navigation.handle_input_report(attachment, input, bytes, num_bytes);
+
+ if (ret < 0)
+ return ret;
+
+ if (num_bytes < 14) {
+ gip_dbg(attachment, "Discarding too-short input report\n");
+ return -EINVAL;
+ }
+
+ input_report_key(input, BTN_THUMBL, bytes[1] & BIT(6));
+ input_report_key(input, BTN_THUMBR, bytes[1] & BIT(7));
+
+ input_report_abs(input, ABS_Z, (int16_t)get_unaligned_le16(&bytes[2]));
+ input_report_abs(input, ABS_RZ, (int16_t)get_unaligned_le16(&bytes[4]));
+
+ input_report_abs(input, ABS_X, (int16_t)get_unaligned_le16(&bytes[6]));
+ input_report_abs(input, ABS_Y, ~(int16_t)get_unaligned_le16(&bytes[8]));
+
+ input_report_abs(input, ABS_RX, (int16_t)get_unaligned_le16(&bytes[10]));
+ input_report_abs(input, ABS_RY, ~(int16_t)get_unaligned_le16(&bytes[12]));
+
+ if (attachment->vendor_id == GIP_VID_MICROSOFT &&
+ attachment->product_id == GIP_PID_XBOX_ADAPTIVE_CONTROLLER &&
+ num_bytes >= 31)
+ input_report_abs(input, ABS_PROFILE, bytes[30] & 3);
+
+ return 0;
+}
+
+const struct gip_driver gip_driver_gamepad = {
+ .types = (const char* const[]) { "Windows.Xbox.Input.Gamepad", NULL },
+ .guid = GUID_INIT(0x082e402c, 0x07df, 0x45e1, 0xa5, 0xab,
+ 0xa3, 0x12, 0x7a, 0xf1, 0x97, 0xb5),
+
+ .quirks = (const struct gip_quirks[]) {
+ /* Xbox One Controller (model 1573) */
+ { GIP_VID_MICROSOFT, GIP_PID_XBOX_ONE_1573, 0,
+ .override_name = "Xbox One Controller" },
+
+ /* Xbox One Controller (model 1697) */
+ { GIP_VID_MICROSOFT, GIP_PID_XBOX_ONE_1697, 0,
+ .override_name = "Xbox One Controller" },
+
+ /* Xbox Elite */
+ { GIP_VID_MICROSOFT, GIP_PID_XBOX_ELITE, 0,
+ .override_name = "Xbox Elite Controller",
+ .added_features = GIP_FEATURE_ELITE_BUTTONS,
+ .filtered_features = GIP_FEATURE_CONSOLE_FUNCTION_MAP },
+
+ /* Xbox One Controller (model 1708) */
+ { GIP_VID_MICROSOFT, GIP_PID_XBOX_ONE_1708, 0,
+ .override_name = "Xbox One Controller" },
+
+ /* Xbox Elite 2 */
+ { GIP_VID_MICROSOFT, GIP_PID_XBOX_ELITE_2, 0,
+ .override_name = "Xbox Elite Series 2 Controller",
+ .added_features = GIP_FEATURE_GUIDE_COLOR |
+ GIP_FEATURE_EXTENDED_SET_DEVICE_STATE },
+
+ /* Xbox Adaptive Controller */
+ { GIP_VID_MICROSOFT, GIP_PID_XBOX_ADAPTIVE_CONTROLLER, 0,
+ .override_name = "Xbox Adaptive Controller" },
+
+ /* Xbox Wireless Controller */
+ { GIP_VID_MICROSOFT, GIP_PID_XBOX_WIRELESS, 0,
+ .override_name = "Xbox Wireless Controller" },
+
+ {0},
+ },
+
+ .probe = NULL,
+ .remove = NULL,
+ .init = NULL,
+ .setup_input = gip_setup_gamepad_input,
+ .handle_input_report = gip_handle_gamepad_report,
+};
+
+static int gip_setup_navigation_input(struct gip_attachment *attachment, struct input_dev *input)
+{
+ input_set_capability(input, EV_KEY, BTN_Y);
+ input_set_capability(input, EV_KEY, BTN_B);
+ input_set_capability(input, EV_KEY, BTN_X);
+ input_set_capability(input, EV_KEY, BTN_A);
+ input_set_capability(input, EV_KEY, BTN_SELECT);
+ input_set_capability(input, EV_KEY, BTN_START);
+ input_set_capability(input, EV_KEY, BTN_TR);
+ input_set_capability(input, EV_KEY, BTN_TL);
+
+ attachment->dpad_as_buttons = dpad_as_buttons;
+ if (attachment->dpad_as_buttons) {
+ input_set_capability(input, EV_KEY, BTN_DPAD_UP);
+ input_set_capability(input, EV_KEY, BTN_DPAD_RIGHT);
+ input_set_capability(input, EV_KEY, BTN_DPAD_LEFT);
+ input_set_capability(input, EV_KEY, BTN_DPAD_DOWN);
+ } else {
+ input_set_abs_params(input, ABS_HAT0X, -1, 1, 0, 0);
+ input_set_abs_params(input, ABS_HAT0Y, -1, 1, 0, 0);
+ }
+
+ return 0;
+}
+
+static int gip_handle_navigation_report(struct gip_attachment *attachment,
+ struct input_dev *input, const uint8_t *bytes, int num_bytes)
+{
+ if (num_bytes < 2) {
+ gip_dbg(attachment, "Discarding too-short input report\n");
+ return -EINVAL;
+ }
+
+ input_report_key(input, BTN_START, bytes[0] & BIT(2));
+ input_report_key(input, BTN_SELECT, bytes[0] & BIT(3));
+ input_report_key(input, BTN_A, bytes[0] & BIT(4));
+ input_report_key(input, BTN_B, bytes[0] & BIT(5));
+ input_report_key(input, BTN_X, bytes[0] & BIT(6));
+ input_report_key(input, BTN_Y, bytes[0] & BIT(7));
+
+ if (attachment->dpad_as_buttons) {
+ input_report_key(input, BTN_DPAD_UP, bytes[1] & BIT(0));
+ input_report_key(input, BTN_DPAD_DOWN, bytes[1] & BIT(1));
+ input_report_key(input, BTN_DPAD_LEFT, bytes[1] & BIT(2));
+ input_report_key(input, BTN_DPAD_RIGHT, bytes[1] & BIT(3));
+ } else {
+ input_report_abs(input, ABS_HAT0X,
+ !!(bytes[1] & BIT(3)) - !!(bytes[1] & BIT(2)));
+ input_report_abs(input, ABS_HAT0Y,
+ !!(bytes[1] & BIT(1)) - !!(bytes[1] & BIT(0)));
+ }
+
+ if (attachment->quirks & GIP_QUIRK_SWAP_LB_RB) {
+ /* Previous */
+ input_report_key(input, BTN_TR, bytes[1] & BIT(4));
+ /* Next */
+ input_report_key(input, BTN_TL, bytes[1] & BIT(5));
+ } else {
+ input_report_key(input, BTN_TL, bytes[1] & BIT(4));
+ input_report_key(input, BTN_TR, bytes[1] & BIT(5));
+ }
+
+ return 0;
+}
+
+const struct gip_driver gip_driver_navigation = {
+ .types = (const char* const[]) { "Windows.Xbox.Input.NavigationController", NULL },
+ .guid = GUID_INIT(0xb8f31fe7, 0x7386, 0x40e9, 0xa9, 0xf8,
+ 0x2f, 0x21, 0x26, 0x3a, 0xcf, 0xb7),
+
+ .probe = NULL,
+ .remove = NULL,
+ .init = NULL,
+ .setup_input = gip_setup_navigation_input,
+ .handle_input_report = gip_handle_navigation_report,
+};
+
+module_param(dpad_as_buttons, bool, 0444);
+MODULE_PARM_DESC(dpad_as_buttons, "Map the D-Pad as buttons instead of axes");
diff --git a/drivers/input/joystick/gip/gip.h b/drivers/input/joystick/gip/gip.h
new file mode 100644
index 000000000000..d48ab64ab2eb
--- /dev/null
+++ b/drivers/input/joystick/gip/gip.h
@@ -0,0 +1,344 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+/*
+ * Gaming Input Protocol driver for Xbox One/Series controllers
+ *
+ * Copyright (c) 2025 Valve Software
+ *
+ * This driver is based on the Microsoft GIP spec at:
+ * https://aka.ms/gipdocs
+ * https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-gipusb/e7c90904-5e21-426e-b9ad-d82adeee0dbc
+ */
+
+#ifndef _GIP_H
+#define _GIP_H
+
+#include <linux/rcupdate.h>
+#include <linux/usb/input.h>
+
+#define BASE_GIP_MTU 64
+#define MAX_GIP_MTU 2048
+
+#define MAX_ATTACHMENTS 8
+
+#define MAX_IN_MESSAGES 8
+#define MAX_OUT_MESSAGES 8
+
+#define GIP_VID_MICROSOFT 0x045e
+#define GIP_VID_PDP 0x0e6f
+
+#define GIP_PID_XBOX_ONE_1573 0x02d1
+#define GIP_PID_XBOX_ONE_1697 0x02dd
+#define GIP_PID_XBOX_ELITE 0x02e3
+#define GIP_PID_XBOX_ONE_1708 0x02ea
+#define GIP_PID_XBOX_ELITE_2 0x0b00
+#define GIP_PID_XBOX_ADAPTIVE_CONTROLLER 0x0b0a
+#define GIP_PID_XBOX_WIRELESS 0x0b12
+
+#define GIP_PID_PDP_ROCK_CANDY 0x0246
+
+#define GIP_QUIRK_NO_HELLO BIT(0)
+#define GIP_QUIRK_NO_IMPULSE_VIBRATION BIT(1)
+#define GIP_QUIRK_SWAP_LB_RB BIT(2)
+/*
+ * Driver-specific quirks should start from 31 and go downwards to avoid
+ * conflicts with newly-added core quirks
+ */
+
+#define GIP_FEATURE_CONTROLLER BIT(0)
+#define GIP_FEATURE_CONSOLE_FUNCTION_MAP BIT(1)
+#define GIP_FEATURE_CONSOLE_FUNCTION_MAP_OVERFLOW BIT(2)
+#define GIP_FEATURE_ELITE_BUTTONS BIT(3)
+#define GIP_FEATURE_DYNAMIC_LATENCY_INPUT BIT(4)
+#define GIP_FEATURE_SECURITY_OPT_OUT BIT(5)
+#define GIP_FEATURE_MOTOR_CONTROL BIT(6)
+#define GIP_FEATURE_GUIDE_COLOR BIT(7)
+#define GIP_FEATURE_EXTENDED_SET_DEVICE_STATE BIT(8)
+
+#define GIP_FLAG_FRAGMENT BIT(7)
+#define GIP_FLAG_INIT_FRAG BIT(6)
+#define GIP_FLAG_SYSTEM BIT(5)
+#define GIP_FLAG_ACME BIT(4)
+#define GIP_FLAG_ATTACHMENT_MASK 0x7
+
+/* System messages */
+#define GIP_CMD_PROTO_CONTROL 0x01
+#define GIP_CMD_HELLO_DEVICE 0x02
+#define GIP_CMD_STATUS_DEVICE 0x03
+#define GIP_CMD_METADATA 0x04
+#define GIP_CMD_SET_DEVICE_STATE 0x05
+#define GIP_CMD_SECURITY 0x06
+#define GIP_CMD_GUIDE_BUTTON 0x07
+#define GIP_CMD_AUDIO_CONTROL 0x08
+#define GIP_CMD_LED 0x0a
+#define GIP_CMD_HID_REPORT 0x0b
+#define GIP_CMD_FIRMWARE 0x0c
+#define GIP_CMD_EXTENDED 0x1e
+#define GIP_CMD_DEBUG 0x1f
+#define GIP_AUDIO_DATA 0x60
+
+/* Navigation vendor messages */
+#define GIP_CMD_DIRECT_MOTOR 0x09
+#define GIP_LL_INPUT_REPORT 0x20
+#define GIP_LL_OVERFLOW_INPUT_REPORT 0x26
+
+/* Wheel and ArcadeStick vendor messages */
+#define GIP_CMD_INITIAL_REPORTS_REQUEST 0x0a
+#define GIP_LL_STATIC_CONFIGURATION 0x21
+#define GIP_LL_BUTTON_INFO_REPORT 0x22
+
+#define MAX_GIP_CMD 0x80
+
+#define to_gip_device(p) \
+ _Generic((p), \
+ struct gip_attachment * : gip_attachment_dev, \
+ struct gip_interface * : gip_interface_dev, \
+ struct gip_device * : gip_device_dev)(p)
+
+#define gip_dbg(dev, ...) dev_dbg(to_gip_device(dev), __VA_ARGS__)
+#define gip_info(dev, ...) dev_info(to_gip_device(dev), __VA_ARGS__)
+#define gip_warn(dev, ...) dev_warn(to_gip_device(dev), __VA_ARGS__)
+#define gip_err(dev, ...) dev_err(to_gip_device(dev), __VA_ARGS__)
+
+#define gip_dbg_ratelimited(dev, ...) dev_dbg_ratelimited(to_gip_device(dev), __VA_ARGS__)
+#define gip_info_ratelimited(dev, ...) dev_info_ratelimited(to_gip_device(dev), __VA_ARGS__)
+#define gip_warn_ratelimited(dev, ...) dev_warn_ratelimited(to_gip_device(dev), __VA_ARGS__)
+#define gip_err_ratelimited(dev, ...) dev_err_ratelimited(to_gip_device(dev), __VA_ARGS__)
+
+enum gip_init_status {
+ GIP_INIT_OK = 0,
+ GIP_INIT_NO_INPUT = 1,
+};
+
+enum gip_metadata_status {
+ GIP_METADATA_NONE = 0,
+ GIP_METADATA_GOT = 1,
+ GIP_METADATA_FAKED = 2,
+ GIP_METADATA_PENDING = 3,
+};
+
+enum gip_elite_button_format {
+ GIP_BTN_FMT_UNKNOWN,
+ GIP_BTN_FMT_XBE1,
+ GIP_BTN_FMT_XBE2_RAW,
+ GIP_BTN_FMT_XBE2_4,
+ GIP_BTN_FMT_XBE2_5,
+};
+
+struct gip_header {
+ uint8_t message_type;
+ uint8_t flags;
+ uint8_t sequence_id;
+ uint64_t length;
+};
+
+struct gip_raw_message {
+ uint16_t num_bytes;
+ uint8_t bytes[BASE_GIP_MTU];
+};
+
+struct gip_device_metadata {
+ uint8_t num_audio_formats;
+ uint8_t num_preferred_types;
+ uint8_t num_supported_interfaces;
+ uint8_t hid_descriptor_size;
+
+ uint32_t in_system_messages[8];
+ uint32_t out_system_messages[8];
+
+ struct gip_audio_format_pair *audio_formats;
+ char **preferred_types;
+ guid_t *supported_interfaces;
+ uint8_t *hid_descriptor;
+};
+
+struct gip_message_metadata {
+ uint16_t length;
+ uint8_t type;
+ uint16_t data_type;
+ uint32_t flags;
+ uint16_t period;
+ uint16_t persistence_timeout;
+};
+
+struct gip_metadata {
+ uint16_t version_major;
+ uint16_t version_minor;
+
+ struct gip_device_metadata device;
+
+ uint8_t num_messages;
+ struct gip_message_metadata *message_metadata;
+};
+
+struct gip_status {
+ int power_level;
+ int charge;
+ int battery_type;
+ int battery_level;
+};
+
+struct gip_status_event {
+ uint16_t event_type;
+ uint32_t fault_tag;
+ uint32_t fault_address;
+};
+
+struct gip_extended_status {
+ struct gip_status base;
+ bool device_active;
+
+ int num_events;
+ struct gip_status_event events[5];
+};
+
+struct gip_attachment;
+typedef int (*gip_command_handler)(struct gip_attachment *a, const struct gip_header *header,
+ const uint8_t *bytes, int num_bytes);
+
+struct gip_device;
+struct gip_attachment {
+ const struct gip_driver *driver;
+ struct gip_device *device;
+ void *driver_data;
+ gip_command_handler vendor_handlers[MAX_GIP_CMD];
+
+ uint8_t attachment_index;
+ struct input_dev __rcu *input;
+ uint16_t vendor_id;
+ uint16_t product_id;
+ char *uniq;
+ const char *name;
+ char phys[32];
+ char serial[32];
+ struct mutex lock;
+
+ int16_t in_fragment_message;
+ uint16_t in_total_length;
+ uint8_t *in_fragment_data;
+ uint32_t in_fragment_offset;
+ struct delayed_work in_fragment_timeout;
+ int in_fragment_retries;
+
+ uint16_t firmware_major_version;
+ uint16_t firmware_minor_version;
+
+ enum gip_metadata_status got_metadata;
+ struct delayed_work metadata_next;
+ int metadata_retries;
+ struct gip_metadata metadata;
+
+ uint8_t seq_system;
+ uint8_t seq_security;
+ uint8_t seq_extended;
+ uint8_t seq_audio;
+ uint8_t seq_vendor;
+
+ uint8_t device_state;
+
+ struct gip_extended_status status;
+
+ enum gip_elite_button_format xbe_format;
+ uint32_t features;
+ uint32_t quirks;
+
+ int extra_buttons;
+ int extra_axes;
+
+ bool dpad_as_buttons;
+ struct hid_device __rcu *hdev;
+};
+
+struct gip_urb {
+ struct urb *urb;
+ uint8_t *data;
+ unsigned int offset;
+};
+
+struct gip_interface {
+ struct gip_device *device;
+ struct usb_interface *intf;
+ uint32_t mtu;
+ int isoc_messages;
+
+ struct urb *urb_in;
+ uint8_t *in_data;
+
+ struct usb_anchor out_anchor;
+ struct gip_urb out_queue[MAX_OUT_MESSAGES];
+};
+
+struct gip_device {
+ struct usb_device *udev;
+
+ struct gip_interface data;
+ struct gip_interface audio;
+
+ struct gip_raw_message in_queue[MAX_IN_MESSAGES];
+ int pending_in_messages;
+ int next_in_message;
+
+ struct work_struct receive_message;
+ spinlock_t message_lock;
+
+ struct gip_attachment *attachments[MAX_ATTACHMENTS];
+};
+
+struct gip_quirks {
+ uint16_t vendor_id;
+ uint16_t product_id;
+ uint8_t attachment_index;
+ const char *override_name;
+ uint32_t added_features;
+ uint32_t filtered_features;
+ uint32_t quirks;
+ uint32_t extra_in_system[8];
+ uint32_t extra_out_system[8];
+ uint8_t extra_buttons;
+ uint8_t extra_axes;
+};
+
+struct gip_driver {
+ const char *const *types;
+ guid_t guid;
+
+ const struct gip_quirks *quirks;
+
+ int (*probe)(struct gip_attachment *a);
+ void (*remove)(struct gip_attachment *a);
+ int (*init)(struct gip_attachment *a);
+ int (*setup_input)(struct gip_attachment *a, struct input_dev *input);
+ int (*handle_input_report)(struct gip_attachment *a,
+ struct input_dev *input, const uint8_t *bytes, int num_bytes);
+ int (*handle_overflow_input_report)(struct gip_attachment *a,
+ struct input_dev *input, const uint8_t *bytes, int num_bytes);
+ gip_command_handler vendor_handlers[MAX_GIP_CMD];
+};
+
+static inline struct device *gip_attachment_dev(struct gip_attachment *attachment)
+{
+ return &attachment->device->udev->dev;
+}
+
+static inline struct device *gip_interface_dev(struct gip_interface *intf)
+{
+ return &intf->device->udev->dev;
+}
+
+static inline struct device *gip_device_dev(struct gip_device *device)
+{
+ return &device->udev->dev;
+}
+
+bool gip_supports_vendor_message(struct gip_attachment *attachment, uint8_t command, bool upstream);
+
+int gip_send_system_message(struct gip_attachment *attachment,
+ uint8_t message_type, uint8_t flags, const void *bytes, int num_bytes);
+int gip_send_vendor_message(struct gip_attachment *attachment,
+ uint8_t message_type, uint8_t flags, const void *bytes, int num_bytes);
+
+extern const struct gip_driver gip_driver_navigation;
+extern const struct gip_driver gip_driver_gamepad;
+extern const struct gip_driver gip_driver_arcade_stick;
+extern const struct gip_driver gip_driver_wheel;
+extern const struct gip_driver gip_driver_flight_stick;
+#endif
--
2.54.0
^ permalink raw reply related [flat|nested] 22+ messages in thread
* [PATCH v5 02/12] Input: xpad - Remove Xbox One support
2026-09-02 1:02 [PATCH v5 00/12] Input: xbox_gip - Add new driver for Xbox GIP Vicki Pfau
2026-09-02 1:02 ` [PATCH v5 01/12] " Vicki Pfau
@ 2026-09-02 1:02 ` Vicki Pfau
2026-09-02 1:02 ` [PATCH v5 03/12] Input: xbox_gip - Add controllable LED support Vicki Pfau
` (9 subsequent siblings)
11 siblings, 0 replies; 22+ messages in thread
From: Vicki Pfau @ 2026-09-02 1:02 UTC (permalink / raw)
To: Dmitry Torokhov, linux-input; +Cc: Vicki Pfau
It has been superseded by xbox_gip. As the new driver is already at feature
parity, removing the fairly rough Xbox One support from xpad is safe and
will prevent any potential conflicts.
Signed-off-by: Vicki Pfau <vi@endrift.com>
---
Documentation/input/devices/xpad.rst | 17 +-
drivers/input/joystick/xpad.c | 684 +--------------------------
2 files changed, 11 insertions(+), 690 deletions(-)
diff --git a/Documentation/input/devices/xpad.rst b/Documentation/input/devices/xpad.rst
index a480bc781565..fd2afdd7b405 100644
--- a/Documentation/input/devices/xpad.rst
+++ b/Documentation/input/devices/xpad.rst
@@ -2,19 +2,19 @@
xpad - Linux USB driver for Xbox compatible controllers
=======================================================
-This driver exposes all first-party and third-party Xbox compatible
-controllers. It has a long history and has enjoyed considerable usage
-as Windows' xinput library caused most PC games to focus on Xbox
-controller compatibility.
+This driver exposes all first-party and third-party Xbox and Xbox 360
+compatible controllers. It has a long history and has enjoyed considerable
+usage as Windows' xinput library caused most PC games to focus on Xbox
+controller compatibility. Xbox One/Series controller support has been
+superseded by the xbox_gip driver, which specializes in the Gaming Input
+Protocl that is introduced on the Xbox One.
Due to backwards compatibility all buttons are reported as digital.
This only affects Original Xbox controllers. All later controller models
have only digital face buttons.
Rumble is supported on some models of Xbox 360 controllers but not of
-Original Xbox controllers nor on Xbox One controllers. As of writing
-the Xbox One's rumble protocol has not been reverse-engineered but in
-the future could be supported.
+Original Xbox controllers.
Notes
@@ -98,9 +98,6 @@ All generations of Xbox controllers speak USB over the wire.
- Wireless Xbox 360 controllers require a 'Xbox 360 Wireless Gaming Receiver
for Windows'
- Wired Xbox 360 controllers use standard USB connectors.
-- Xbox One controllers can be wireless but speak Wi-Fi Direct and are not
- yet supported.
-- Xbox One controllers can be wired and use standard Micro-USB connectors.
diff --git a/drivers/input/joystick/xpad.c b/drivers/input/joystick/xpad.c
index feb8f368f834..206007e0cafb 100644
--- a/drivers/input/joystick/xpad.c
+++ b/drivers/input/joystick/xpad.c
@@ -17,7 +17,6 @@
* - the iForce driver drivers/char/joystick/iforce.c
* - the skeleton-driver drivers/usb/usb-skeleton.c
* - Xbox 360 information http://www.free60.org/wiki/Gamepad
- * - Xbox One information https://github.com/quantus/xbox-one-controller-protocol
*
* Thanks to:
* - ITO Takayuki for providing essential xpad information on his website
@@ -46,10 +45,6 @@
#define MAP_DPAD_TO_BUTTONS BIT(0)
#define MAP_TRIGGERS_TO_BUTTONS BIT(1)
#define MAP_STICKS_TO_NULL BIT(2)
-#define MAP_SHARE_BUTTON BIT(3)
-#define MAP_PADDLES BIT(4)
-#define MAP_PROFILE_BUTTON BIT(5)
-#define MAP_SHARE_OFFSET BIT(6)
#define DANCEPAD_MAP_CONFIG (MAP_DPAD_TO_BUTTONS | \
MAP_TRIGGERS_TO_BUTTONS | MAP_STICKS_TO_NULL)
@@ -57,22 +52,13 @@
#define XTYPE_XBOX 0
#define XTYPE_XBOX360 1
#define XTYPE_XBOX360W 2
-#define XTYPE_XBOXONE 3
-#define XTYPE_UNKNOWN 4
+#define XTYPE_UNKNOWN 3
/* Send power-off packet to xpad360w after holding the mode button for this many
* seconds
*/
#define XPAD360W_POWEROFF_TIMEOUT 5
-#define PKT_XB 0
-#define PKT_XBE1 1
-#define PKT_XBE2_FW_OLD 2
-#define PKT_XBE2_FW_5_EARLY 3
-#define PKT_XBE2_FW_5_11 4
-
-#define FLAG_DELAY_INIT BIT(0)
-
static bool dpad_to_buttons;
module_param(dpad_to_buttons, bool, S_IRUGO);
MODULE_PARM_DESC(dpad_to_buttons, "Map D-PAD to buttons rather than axes for unknown pads");
@@ -105,16 +91,11 @@ static const struct xpad_device {
{ 0x03eb, 0xff02, "Wooting Two (Legacy)", 0, XTYPE_XBOX360 },
{ 0x03f0, 0x038D, "HyperX Clutch", 0, XTYPE_XBOX360 }, /* wired */
{ 0x03f0, 0x048D, "HyperX Clutch", 0, XTYPE_XBOX360 }, /* wireless */
- { 0x03f0, 0x0495, "HyperX Clutch Gladiate", 0, XTYPE_XBOXONE },
- { 0x03f0, 0x07A0, "HyperX Clutch Gladiate RGB", 0, XTYPE_XBOXONE },
- { 0x03f0, 0x08B6, "HyperX Clutch Gladiate", MAP_SHARE_BUTTON, XTYPE_XBOXONE }, /* v2 */
- { 0x03f0, 0x09B4, "HyperX Clutch Tanto", 0, XTYPE_XBOXONE },
{ 0x044f, 0x0f00, "Thrustmaster Wheel", 0, XTYPE_XBOX },
{ 0x044f, 0x0f03, "Thrustmaster Wheel", 0, XTYPE_XBOX },
{ 0x044f, 0x0f07, "Thrustmaster, Inc. Controller", 0, XTYPE_XBOX },
{ 0x044f, 0x0f10, "Thrustmaster Modena GT Wheel", 0, XTYPE_XBOX },
{ 0x044f, 0xb326, "Thrustmaster Gamepad GP XID", 0, XTYPE_XBOX360 },
- { 0x044f, 0xd01e, "ThrustMaster, Inc. ESWAP X 2 ELDEN RING EDITION", 0, XTYPE_XBOXONE },
{ 0x045e, 0x0202, "Microsoft X-Box pad v1 (US)", 0, XTYPE_XBOX },
{ 0x045e, 0x0285, "Microsoft X-Box pad (Japan)", 0, XTYPE_XBOX },
{ 0x045e, 0x0287, "Microsoft Xbox Controller S", 0, XTYPE_XBOX },
@@ -124,14 +105,7 @@ static const struct xpad_device {
{ 0x045e, 0x028f, "Microsoft X-Box 360 pad v2", 0, XTYPE_XBOX360 },
{ 0x045e, 0x0291, "Xbox 360 Wireless Receiver (XBOX)", MAP_DPAD_TO_BUTTONS, XTYPE_XBOX360W },
{ 0x045e, 0x02a9, "Xbox 360 Wireless Receiver (Unofficial)", MAP_DPAD_TO_BUTTONS, XTYPE_XBOX360W },
- { 0x045e, 0x02d1, "Microsoft X-Box One pad", 0, XTYPE_XBOXONE },
- { 0x045e, 0x02dd, "Microsoft X-Box One pad (Firmware 2015)", 0, XTYPE_XBOXONE },
- { 0x045e, 0x02e3, "Microsoft X-Box One Elite pad", MAP_PADDLES, XTYPE_XBOXONE },
- { 0x045e, 0x02ea, "Microsoft X-Box One S pad", 0, XTYPE_XBOXONE },
{ 0x045e, 0x0719, "Xbox 360 Wireless Receiver", MAP_DPAD_TO_BUTTONS, XTYPE_XBOX360W },
- { 0x045e, 0x0b00, "Microsoft X-Box One Elite 2 pad", MAP_PADDLES, XTYPE_XBOXONE },
- { 0x045e, 0x0b0a, "Microsoft X-Box Adaptive Controller", MAP_PROFILE_BUTTON, XTYPE_XBOXONE },
- { 0x045e, 0x0b12, "Microsoft Xbox Series S|X Controller", MAP_SHARE_BUTTON | MAP_SHARE_OFFSET, XTYPE_XBOXONE },
{ 0x046d, 0xc21d, "Logitech Gamepad F310", 0, XTYPE_XBOX360 },
{ 0x046d, 0xc21e, "Logitech Gamepad F510", 0, XTYPE_XBOX360 },
{ 0x046d, 0xc21f, "Logitech Gamepad F710", 0, XTYPE_XBOX360 },
@@ -151,7 +125,6 @@ static const struct xpad_device {
{ 0x06a3, 0x0200, "Saitek Racing Wheel", 0, XTYPE_XBOX },
{ 0x06a3, 0x0201, "Saitek Adrenalin", 0, XTYPE_XBOX },
{ 0x06a3, 0xf51a, "Saitek P3600", 0, XTYPE_XBOX360 },
- { 0x0738, 0x4503, "Mad Catz Racing Wheel", 0, XTYPE_XBOXONE },
{ 0x0738, 0x4506, "Mad Catz 4506 Wireless Controller", 0, XTYPE_XBOX },
{ 0x0738, 0x4516, "Mad Catz Control Pad", 0, XTYPE_XBOX },
{ 0x0738, 0x4520, "Mad Catz Control Pad Pro", 0, XTYPE_XBOX },
@@ -173,7 +146,6 @@ static const struct xpad_device {
{ 0x0738, 0x4740, "Mad Catz Beat Pad", 0, XTYPE_XBOX360 },
{ 0x0738, 0x4743, "Mad Catz Beat Pad Pro", MAP_DPAD_TO_BUTTONS, XTYPE_XBOX },
{ 0x0738, 0x4758, "Mad Catz Arcade Game Stick", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOX360 },
- { 0x0738, 0x4a01, "Mad Catz FightStick TE 2", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOXONE },
{ 0x0738, 0x6040, "Mad Catz Beat Pad Pro", MAP_DPAD_TO_BUTTONS, XTYPE_XBOX },
{ 0x0738, 0x9871, "Mad Catz Portable Drum", 0, XTYPE_XBOX360 },
{ 0x0738, 0xb726, "Mad Catz Xbox controller - MW2", 0, XTYPE_XBOX360 },
@@ -184,12 +156,8 @@ static const struct xpad_device {
{ 0x0738, 0xcb29, "Saitek Aviator Stick AV8R02", 0, XTYPE_XBOX360 },
{ 0x0738, 0xf738, "Super SFIV FightStick TE S", 0, XTYPE_XBOX360 },
{ 0x07ff, 0xffff, "Mad Catz GamePad", 0, XTYPE_XBOX360 },
- { 0x0b05, 0x1a38, "ASUS ROG RAIKIRI", MAP_SHARE_BUTTON, XTYPE_XBOXONE },
- { 0x0b05, 0x1abb, "ASUS ROG RAIKIRI PRO", 0, XTYPE_XBOXONE },
{ 0x0b05, 0x1c91, "ASUS ROG RAIKIRI II", 0, XTYPE_XBOX360 },
{ 0x0b05, 0x1c92, "ASUS ROG RAIKIRI II WIRELESS", 0, XTYPE_XBOX360 },
- { 0x0b05, 0x1c96, "ASUS ROG RAIKIRI II XBOX", MAP_SHARE_BUTTON, XTYPE_XBOXONE },
- { 0x0b05, 0x1d04, "ASUS ROG RAIKIRI II XBOX WIRELESS", MAP_SHARE_BUTTON, XTYPE_XBOXONE },
{ 0x0c12, 0x0005, "Intec wireless", 0, XTYPE_XBOX },
{ 0x0c12, 0x8801, "Nyko Xbox Controller", 0, XTYPE_XBOX },
{ 0x0c12, 0x8802, "Zeroplus Xbox Controller", 0, XTYPE_XBOX },
@@ -212,34 +180,10 @@ static const struct xpad_device {
{ 0x0e6f, 0x011f, "Rock Candy Gamepad Wired Controller", 0, XTYPE_XBOX360 },
{ 0x0e6f, 0x0131, "PDP EA Sports Controller", 0, XTYPE_XBOX360 },
{ 0x0e6f, 0x0133, "Xbox 360 Wired Controller", 0, XTYPE_XBOX360 },
- { 0x0e6f, 0x0139, "Afterglow Prismatic Wired Controller", 0, XTYPE_XBOXONE },
- { 0x0e6f, 0x013a, "PDP Xbox One Controller", 0, XTYPE_XBOXONE },
- { 0x0e6f, 0x0146, "Rock Candy Wired Controller for Xbox One", 0, XTYPE_XBOXONE },
- { 0x0e6f, 0x0147, "PDP Marvel Xbox One Controller", 0, XTYPE_XBOXONE },
- { 0x0e6f, 0x015c, "PDP Xbox One Arcade Stick", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOXONE },
- { 0x0e6f, 0x015d, "PDP Mirror's Edge Official Wired Controller for Xbox One", 0, XTYPE_XBOXONE },
- { 0x0e6f, 0x0161, "PDP Xbox One Controller", 0, XTYPE_XBOXONE },
- { 0x0e6f, 0x0162, "PDP Xbox One Controller", 0, XTYPE_XBOXONE },
- { 0x0e6f, 0x0163, "PDP Xbox One Controller", 0, XTYPE_XBOXONE },
- { 0x0e6f, 0x0164, "PDP Battlefield One", 0, XTYPE_XBOXONE },
- { 0x0e6f, 0x0165, "PDP Titanfall 2", 0, XTYPE_XBOXONE },
{ 0x0e6f, 0x0201, "Pelican PL-3601 'TSZ' Wired Xbox 360 Controller", 0, XTYPE_XBOX360 },
{ 0x0e6f, 0x0213, "Afterglow Gamepad for Xbox 360", 0, XTYPE_XBOX360 },
{ 0x0e6f, 0x021f, "Rock Candy Gamepad for Xbox 360", 0, XTYPE_XBOX360 },
- { 0x0e6f, 0x0246, "Rock Candy Gamepad for Xbox One 2015", 0, XTYPE_XBOXONE },
- { 0x0e6f, 0x02a0, "PDP Xbox One Controller", 0, XTYPE_XBOXONE },
- { 0x0e6f, 0x02a1, "PDP Xbox One Controller", 0, XTYPE_XBOXONE },
- { 0x0e6f, 0x02a2, "PDP Wired Controller for Xbox One - Crimson Red", 0, XTYPE_XBOXONE },
- { 0x0e6f, 0x02a4, "PDP Wired Controller for Xbox One - Stealth Series", 0, XTYPE_XBOXONE },
- { 0x0e6f, 0x02a6, "PDP Wired Controller for Xbox One - Camo Series", 0, XTYPE_XBOXONE },
- { 0x0e6f, 0x02a7, "PDP Xbox One Controller", 0, XTYPE_XBOXONE },
- { 0x0e6f, 0x02a8, "PDP Xbox One Controller", 0, XTYPE_XBOXONE },
- { 0x0e6f, 0x02ab, "PDP Controller for Xbox One", 0, XTYPE_XBOXONE },
- { 0x0e6f, 0x02ad, "PDP Wired Controller for Xbox One - Stealth Series", 0, XTYPE_XBOXONE },
- { 0x0e6f, 0x02b3, "Afterglow Prismatic Wired Controller", 0, XTYPE_XBOXONE },
- { 0x0e6f, 0x02b8, "Afterglow Prismatic Wired Controller", 0, XTYPE_XBOXONE },
{ 0x0e6f, 0x0301, "Logic3 Controller", 0, XTYPE_XBOX360 },
- { 0x0e6f, 0x0346, "Rock Candy Gamepad for Xbox One 2016", 0, XTYPE_XBOXONE },
{ 0x0e6f, 0x0401, "Logic3 Controller", 0, XTYPE_XBOX360 },
{ 0x0e6f, 0x0413, "Afterglow AX.1 Gamepad for Xbox 360", 0, XTYPE_XBOX360 },
{ 0x0e6f, 0x0501, "PDP Xbox 360 Controller", 0, XTYPE_XBOX360 },
@@ -251,23 +195,13 @@ static const struct xpad_device {
{ 0x0f0d, 0x000d, "Hori Fighting Stick EX2", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOX360 },
{ 0x0f0d, 0x0016, "Hori Real Arcade Pro.EX", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOX360 },
{ 0x0f0d, 0x001b, "Hori Real Arcade Pro VX", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOX360 },
- { 0x0f0d, 0x0063, "Hori Real Arcade Pro Hayabusa (USA) Xbox One", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOXONE },
- { 0x0f0d, 0x0067, "HORIPAD ONE", 0, XTYPE_XBOXONE },
- { 0x0f0d, 0x0078, "Hori Real Arcade Pro V Kai Xbox One", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOXONE },
- { 0x0f0d, 0x00c5, "Hori Fighting Commander ONE", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOXONE },
{ 0x0f0d, 0x00dc, "HORIPAD FPS for Nintendo Switch", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOX360 },
- { 0x0f0d, 0x0151, "Hori Racing Wheel Overdrive for Xbox Series X", 0, XTYPE_XBOXONE },
- { 0x0f0d, 0x0152, "Hori Racing Wheel Overdrive for Xbox Series X", 0, XTYPE_XBOXONE },
- { 0x0f0d, 0x01b2, "HORI Taiko No Tatsujin Drum Controller", MAP_SHARE_BUTTON, XTYPE_XBOXONE },
{ 0x0f30, 0x010b, "Philips Recoil", 0, XTYPE_XBOX },
{ 0x0f30, 0x0202, "Joytech Advanced Controller", 0, XTYPE_XBOX },
{ 0x0f30, 0x8888, "BigBen XBMiniPad Controller", 0, XTYPE_XBOX },
{ 0x102c, 0xff0c, "Joytech Wireless Advanced Controller", 0, XTYPE_XBOX },
{ 0x1038, 0x1430, "SteelSeries Stratus Duo", 0, XTYPE_XBOX360 },
{ 0x1038, 0x1431, "SteelSeries Stratus Duo", 0, XTYPE_XBOX360 },
- { 0x10f5, 0x7005, "Turtle Beach Recon Controller", 0, XTYPE_XBOXONE },
- { 0x10f5, 0x7008, "Turtle Beach Recon Controller", MAP_SHARE_BUTTON, XTYPE_XBOXONE },
- { 0x10f5, 0x7073, "Turtle Beach Stealth Ultra Controller", MAP_SHARE_BUTTON, XTYPE_XBOXONE },
{ 0x11c9, 0x55f0, "Nacon GC-100XF", 0, XTYPE_XBOX360 },
{ 0x11ff, 0x0511, "PXN V900", 0, XTYPE_XBOX360 },
{ 0x1209, 0x2882, "Ardwiino Controller", 0, XTYPE_XBOX360 },
@@ -280,9 +214,6 @@ static const struct xpad_device {
{ 0x1430, 0xf801, "RedOctane Controller", 0, XTYPE_XBOX360 },
{ 0x146b, 0x0601, "BigBen Interactive XBOX 360 Controller", 0, XTYPE_XBOX360 },
{ 0x146b, 0x0604, "Bigben Interactive DAIJA Arcade Stick", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOX360 },
- { 0x1532, 0x0a00, "Razer Atrox Arcade Stick", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOXONE },
- { 0x1532, 0x0a03, "Razer Wildcat", 0, XTYPE_XBOXONE },
- { 0x1532, 0x0a29, "Razer Wolverine V2", 0, XTYPE_XBOXONE },
{ 0x1532, 0x0a57, "Razer Wolverine V3 Pro (Wired)", 0, XTYPE_XBOX360 },
{ 0x1532, 0x0a59, "Razer Wolverine V3 Pro (2.4 GHz Dongle)", 0, XTYPE_XBOX360 },
{ 0x15e4, 0x3f00, "Power A Mini Pro Elite", 0, XTYPE_XBOX360 },
@@ -334,12 +265,7 @@ static const struct xpad_device {
{ 0x1ee9, 0x1590, "ZOTAC Gaming Zone", 0, XTYPE_XBOX360 },
{ 0x20bc, 0x5134, "BETOP BTP-KP50B Xinput Dongle", 0, XTYPE_XBOX360 },
{ 0x20bc, 0x514a, "BETOP BTP-KP50C Xinput Dongle", 0, XTYPE_XBOX360 },
- { 0x20d6, 0x2001, "BDA Xbox Series X Wired Controller", 0, XTYPE_XBOXONE },
- { 0x20d6, 0x2009, "PowerA Enhanced Wired Controller for Xbox Series X|S", 0, XTYPE_XBOXONE },
- { 0x20d6, 0x2064, "PowerA Wired Controller for Xbox", MAP_SHARE_BUTTON, XTYPE_XBOXONE },
{ 0x20d6, 0x281f, "PowerA Wired Controller For Xbox 360", 0, XTYPE_XBOX360 },
- { 0x20d6, 0x400b, "PowerA FUSION Pro 4 Wired Controller", MAP_SHARE_BUTTON, XTYPE_XBOXONE },
- { 0x20d6, 0x890b, "PowerA MOGA XP-Ultra Controller", MAP_SHARE_BUTTON, XTYPE_XBOXONE },
{ 0x2345, 0xe00b, "Machenike G5 Pro Controller", 0, XTYPE_XBOX360 },
{ 0x24c6, 0x5000, "Razer Atrox Arcade Stick", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOX360 },
{ 0x24c6, 0x5300, "PowerA MINI PROEX Controller", 0, XTYPE_XBOX360 },
@@ -347,9 +273,6 @@ static const struct xpad_device {
{ 0x24c6, 0x530a, "Xbox 360 Pro EX Controller", 0, XTYPE_XBOX360 },
{ 0x24c6, 0x531a, "PowerA Pro Ex", 0, XTYPE_XBOX360 },
{ 0x24c6, 0x5397, "FUS1ON Tournament Controller", 0, XTYPE_XBOX360 },
- { 0x24c6, 0x541a, "PowerA Xbox One Mini Wired Controller", 0, XTYPE_XBOXONE },
- { 0x24c6, 0x542a, "Xbox ONE spectra", 0, XTYPE_XBOXONE },
- { 0x24c6, 0x543a, "PowerA Xbox One wired controller", 0, XTYPE_XBOXONE },
{ 0x24c6, 0x5500, "Hori XBOX 360 EX 2 with Turbo", 0, XTYPE_XBOX360 },
{ 0x24c6, 0x5501, "Hori Real Arcade Pro VX-SA", 0, XTYPE_XBOX360 },
{ 0x24c6, 0x5502, "Hori Fighting Stick VX Alt", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOX360 },
@@ -358,29 +281,18 @@ static const struct xpad_device {
{ 0x24c6, 0x550d, "Hori GEM Xbox controller", 0, XTYPE_XBOX360 },
{ 0x24c6, 0x550e, "Hori Real Arcade Pro V Kai 360", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOX360 },
{ 0x24c6, 0x5510, "Hori Fighting Commander ONE (Xbox 360/PC Mode)", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOX360 },
- { 0x24c6, 0x551a, "PowerA FUSION Pro Controller", 0, XTYPE_XBOXONE },
- { 0x24c6, 0x561a, "PowerA FUSION Controller", 0, XTYPE_XBOXONE },
- { 0x24c6, 0x581a, "ThrustMaster XB1 Classic Controller", 0, XTYPE_XBOXONE },
{ 0x24c6, 0x5b00, "ThrustMaster Ferrari 458 Racing Wheel", 0, XTYPE_XBOX360 },
{ 0x24c6, 0x5b02, "Thrustmaster, Inc. GPX Controller", 0, XTYPE_XBOX360 },
{ 0x24c6, 0x5b03, "Thrustmaster Ferrari 458 Racing Wheel", 0, XTYPE_XBOX360 },
{ 0x24c6, 0x5d04, "Razer Sabertooth", 0, XTYPE_XBOX360 },
{ 0x24c6, 0xfafe, "Rock Candy Gamepad for Xbox 360", 0, XTYPE_XBOX360 },
{ 0x2563, 0x058d, "OneXPlayer Gamepad", 0, XTYPE_XBOX360 },
- { 0x294b, 0x3303, "Snakebyte GAMEPAD BASE X", 0, XTYPE_XBOXONE },
- { 0x294b, 0x3404, "Snakebyte GAMEPAD RGB X", 0, XTYPE_XBOXONE },
{ 0x2993, 0x2001, "TECNO Pocket Go", 0, XTYPE_XBOX360 },
- { 0x2dc8, 0x2000, "8BitDo Pro 2 Wired Controller fox Xbox", 0, XTYPE_XBOXONE },
- { 0x2dc8, 0x200f, "8BitDo Ultimate 3-mode Controller for Xbox", MAP_SHARE_BUTTON, XTYPE_XBOXONE },
{ 0x2dc8, 0x3106, "8BitDo Ultimate Wireless / Pro 2 Wired Controller", 0, XTYPE_XBOX360 },
{ 0x2dc8, 0x3109, "8BitDo Ultimate Wireless Bluetooth", 0, XTYPE_XBOX360 },
{ 0x2dc8, 0x310a, "8BitDo Ultimate 2C Wireless Controller", 0, XTYPE_XBOX360 },
{ 0x2dc8, 0x310b, "8BitDo Ultimate 2 Wireless Controller", 0, XTYPE_XBOX360 },
{ 0x2dc8, 0x6001, "8BitDo SN30 Pro", 0, XTYPE_XBOX360 },
- { 0x2e24, 0x0423, "Hyperkin DuchesS Xbox One pad", MAP_SHARE_BUTTON, XTYPE_XBOXONE },
- { 0x2e24, 0x0652, "Hyperkin Duke X-Box One pad", 0, XTYPE_XBOXONE },
- { 0x2e24, 0x1688, "Hyperkin X91 X-Box One pad", 0, XTYPE_XBOXONE },
- { 0x2e95, 0x0504, "SCUF Gaming Controller", MAP_SHARE_BUTTON, XTYPE_XBOXONE },
{ 0x31e3, 0x1100, "Wooting One", 0, XTYPE_XBOX360 },
{ 0x31e3, 0x1200, "Wooting Two", 0, XTYPE_XBOX360 },
{ 0x31e3, 0x1210, "Wooting Lekker", 0, XTYPE_XBOX360 },
@@ -388,17 +300,11 @@ static const struct xpad_device {
{ 0x31e3, 0x1230, "Wooting Two HE (ARM)", 0, XTYPE_XBOX360 },
{ 0x31e3, 0x1300, "Wooting 60HE (AVR)", 0, XTYPE_XBOX360 },
{ 0x31e3, 0x1310, "Wooting 60HE (ARM)", 0, XTYPE_XBOX360 },
- { 0x3285, 0x0603, "Nacon Pro Compact controller for Xbox", 0, XTYPE_XBOXONE },
{ 0x3285, 0x0607, "Nacon GC-100", 0, XTYPE_XBOX360 },
- { 0x3285, 0x0614, "Nacon Pro Compact", 0, XTYPE_XBOXONE },
- { 0x3285, 0x0646, "Nacon Pro Compact", 0, XTYPE_XBOXONE },
{ 0x3285, 0x0662, "Nacon Revolution5 Pro", 0, XTYPE_XBOX360 },
- { 0x3285, 0x0663, "Nacon Evol-X", 0, XTYPE_XBOXONE },
{ 0x3537, 0x1004, "GameSir T4 Kaleid", 0, XTYPE_XBOX360 },
{ 0x3537, 0x100f, "GameSir Nova 2 Lite", 0, XTYPE_XBOX360 },
- { 0x3537, 0x1010, "GameSir G7 SE", 0, XTYPE_XBOXONE },
{ 0x3651, 0x1000, "CRKD SG", 0, XTYPE_XBOX360 },
- { 0x366c, 0x0005, "ByoWave Proteus Controller", MAP_SHARE_BUTTON, XTYPE_XBOXONE, FLAG_DELAY_INIT },
{ 0x3767, 0x0101, "Fanatec Speedster 3 Forceshock Wheel", 0, XTYPE_XBOX },
{ 0x37d7, 0x2501, "Flydigi Apex 5", 0, XTYPE_XBOX360 },
{ 0x413d, 0x2104, "Black Shark Green Ghost Gamepad", 0, XTYPE_XBOX360 },
@@ -456,13 +362,6 @@ static const signed short xpad_abs_triggers[] = {
-1
};
-/* used when the controller has extra paddle buttons */
-static const signed short xpad_btn_paddles[] = {
- BTN_GRIPR, BTN_GRIPR2, /* paddle upper right, lower right */
- BTN_GRIPL, BTN_GRIPL2, /* paddle upper left, lower left */
- -1 /* terminating entry */
-};
-
/*
* Xbox 360 has a vendor-specific class, so we cannot match it with only
* USB_INTERFACE_INFO (also specifically refused by USB subsystem), so we
@@ -479,49 +378,30 @@ static const signed short xpad_btn_paddles[] = {
{ XPAD_XBOX360_VENDOR_PROTOCOL((vend), 1) }, \
{ XPAD_XBOX360_VENDOR_PROTOCOL((vend), 129) }
-/* The Xbox One controller uses subclass 71 and protocol 208. */
-#define XPAD_XBOXONE_VENDOR_PROTOCOL(vend, pr) \
- .match_flags = USB_DEVICE_ID_MATCH_VENDOR | USB_DEVICE_ID_MATCH_INT_INFO, \
- .idVendor = (vend), \
- .bInterfaceClass = USB_CLASS_VENDOR_SPEC, \
- .bInterfaceSubClass = 71, \
- .bInterfaceProtocol = (pr)
-#define XPAD_XBOXONE_VENDOR(vend) \
- { XPAD_XBOXONE_VENDOR_PROTOCOL((vend), 208) }
-
static const struct usb_device_id xpad_table[] = {
/*
- * Please keep this list sorted by vendor ID. Note that there are 2
- * macros - XPAD_XBOX360_VENDOR and XPAD_XBOXONE_VENDOR.
+ * Please keep this list sorted by vendor ID
*/
{ USB_INTERFACE_INFO('X', 'B', 0) }, /* Xbox USB-IF not-approved class */
XPAD_XBOX360_VENDOR(0x0079), /* GPD Win 2 controller */
XPAD_XBOX360_VENDOR(0x0351), /* CRKD Controllers */
XPAD_XBOX360_VENDOR(0x03eb), /* Wooting Keyboards (Legacy) */
XPAD_XBOX360_VENDOR(0x03f0), /* HP HyperX Xbox 360 controllers */
- XPAD_XBOXONE_VENDOR(0x03f0), /* HP HyperX Xbox One controllers */
XPAD_XBOX360_VENDOR(0x044f), /* Thrustmaster Xbox 360 controllers */
- XPAD_XBOXONE_VENDOR(0x044f), /* Thrustmaster Xbox One controllers */
XPAD_XBOX360_VENDOR(0x045e), /* Microsoft Xbox 360 controllers */
- XPAD_XBOXONE_VENDOR(0x045e), /* Microsoft Xbox One controllers */
XPAD_XBOX360_VENDOR(0x046d), /* Logitech Xbox 360-style controllers */
XPAD_XBOX360_VENDOR(0x0502), /* Acer Inc. Xbox 360 style controllers */
XPAD_XBOX360_VENDOR(0x056e), /* Elecom JC-U3613M */
XPAD_XBOX360_VENDOR(0x06a3), /* Saitek P3600 */
XPAD_XBOX360_VENDOR(0x0738), /* Mad Catz Xbox 360 controllers */
{ USB_DEVICE(0x0738, 0x4540) }, /* Mad Catz Beat Pad */
- XPAD_XBOXONE_VENDOR(0x0738), /* Mad Catz FightStick TE 2 */
XPAD_XBOX360_VENDOR(0x07ff), /* Mad Catz Gamepad */
XPAD_XBOX360_VENDOR(0x0b05), /* ASUS controllers */
- XPAD_XBOXONE_VENDOR(0x0b05), /* ASUS controllers */
XPAD_XBOX360_VENDOR(0x0c12), /* Zeroplus X-Box 360 controllers */
XPAD_XBOX360_VENDOR(0x0db0), /* Micro Star International X-Box 360 controllers */
XPAD_XBOX360_VENDOR(0x0e6f), /* 0x0e6f Xbox 360 controllers */
- XPAD_XBOXONE_VENDOR(0x0e6f), /* 0x0e6f Xbox One controllers */
XPAD_XBOX360_VENDOR(0x0f0d), /* Hori controllers */
- XPAD_XBOXONE_VENDOR(0x0f0d), /* Hori controllers */
XPAD_XBOX360_VENDOR(0x1038), /* SteelSeries controllers */
- XPAD_XBOXONE_VENDOR(0x10f5), /* Turtle Beach Controllers */
XPAD_XBOX360_VENDOR(0x11c9), /* Nacon GC100XF */
XPAD_XBOX360_VENDOR(0x11ff), /* PXN V900 */
XPAD_XBOX360_VENDOR(0x1209), /* Ardwiino Controllers */
@@ -529,7 +409,6 @@ static const struct usb_device_id xpad_table[] = {
XPAD_XBOX360_VENDOR(0x1430), /* RedOctane Xbox 360 controllers */
XPAD_XBOX360_VENDOR(0x146b), /* Bigben Interactive controllers */
XPAD_XBOX360_VENDOR(0x1532), /* Razer Sabertooth */
- XPAD_XBOXONE_VENDOR(0x1532), /* Razer Wildcat */
XPAD_XBOX360_VENDOR(0x15e4), /* Numark Xbox 360 controllers */
XPAD_XBOX360_VENDOR(0x162e), /* Joytech Xbox 360 controllers */
XPAD_XBOX360_VENDOR(0x1689), /* Razer Onza */
@@ -540,27 +419,18 @@ static const struct usb_device_id xpad_table[] = {
XPAD_XBOX360_VENDOR(0x1ee9), /* ZOTAC Technology Limited */
XPAD_XBOX360_VENDOR(0x20bc), /* BETOP wireless dongles */
XPAD_XBOX360_VENDOR(0x20d6), /* PowerA controllers */
- XPAD_XBOXONE_VENDOR(0x20d6), /* PowerA controllers */
XPAD_XBOX360_VENDOR(0x2345), /* Machenike Controllers */
XPAD_XBOX360_VENDOR(0x24c6), /* PowerA controllers */
- XPAD_XBOXONE_VENDOR(0x24c6), /* PowerA controllers */
XPAD_XBOX360_VENDOR(0x2563), /* OneXPlayer Gamepad */
XPAD_XBOX360_VENDOR(0x260d), /* Dareu H101 */
- XPAD_XBOXONE_VENDOR(0x294b), /* Snakebyte */
XPAD_XBOX360_VENDOR(0x2993), /* TECNO Mobile */
XPAD_XBOX360_VENDOR(0x2c22), /* Qanba Controllers */
XPAD_XBOX360_VENDOR(0x2dc8), /* 8BitDo Controllers */
- XPAD_XBOXONE_VENDOR(0x2dc8), /* 8BitDo Controllers */
- XPAD_XBOXONE_VENDOR(0x2e24), /* Hyperkin Controllers */
XPAD_XBOX360_VENDOR(0x2f24), /* GameSir Controllers */
- XPAD_XBOXONE_VENDOR(0x2e95), /* SCUF Gaming Controller */
XPAD_XBOX360_VENDOR(0x31e3), /* Wooting Keyboards */
XPAD_XBOX360_VENDOR(0x3285), /* Nacon GC-100 */
- XPAD_XBOXONE_VENDOR(0x3285), /* Nacon Evol-X */
XPAD_XBOX360_VENDOR(0x3537), /* GameSir Controllers */
- XPAD_XBOXONE_VENDOR(0x3537), /* GameSir Controllers */
XPAD_XBOX360_VENDOR(0x3651), /* CRKD Controllers */
- XPAD_XBOXONE_VENDOR(0x366c), /* ByoWave controllers */
XPAD_XBOX360_VENDOR(0x37d7), /* Flydigi Controllers */
XPAD_XBOX360_VENDOR(0x3958), /* RedOctane Games Controllers */
XPAD_XBOX360_VENDOR(0x413d), /* Black Shark Green Ghost Controller */
@@ -569,162 +439,6 @@ static const struct usb_device_id xpad_table[] = {
MODULE_DEVICE_TABLE(usb, xpad_table);
-struct xboxone_init_packet {
- u16 idVendor;
- u16 idProduct;
- const u8 *data;
- u8 len;
-};
-
-#define XBOXONE_INIT_PKT(_vid, _pid, _data) \
- { \
- .idVendor = (_vid), \
- .idProduct = (_pid), \
- .data = (_data), \
- .len = ARRAY_SIZE(_data), \
- }
-
-/*
- * starting with xbox one, the game input protocol is used
- * magic numbers are taken from
- * - https://github.com/xpadneo/gip-dissector/blob/main/src/gip-dissector.lua
- * - https://github.com/medusalix/xone/blob/master/bus/protocol.c
- */
-#define GIP_CMD_ACK 0x01
-#define GIP_CMD_ANNOUNCE 0x02
-#define GIP_CMD_IDENTIFY 0x04
-#define GIP_CMD_POWER 0x05
-#define GIP_CMD_AUTHENTICATE 0x06
-#define GIP_CMD_VIRTUAL_KEY 0x07
-#define GIP_CMD_RUMBLE 0x09
-#define GIP_CMD_LED 0x0a
-#define GIP_CMD_FIRMWARE 0x0c
-#define GIP_CMD_INPUT 0x20
-
-#define GIP_SEQ0 0x00
-
-#define GIP_OPT_ACK 0x10
-#define GIP_OPT_INTERNAL 0x20
-
-/*
- * length of the command payload encoded with
- * https://en.wikipedia.org/wiki/LEB128
- * which is a no-op for N < 128
- */
-#define GIP_PL_LEN(N) (N)
-
-/*
- * payload specific defines
- */
-#define GIP_PWR_ON 0x00
-#define GIP_LED_ON 0x01
-
-#define GIP_MOTOR_R BIT(0)
-#define GIP_MOTOR_L BIT(1)
-#define GIP_MOTOR_RT BIT(2)
-#define GIP_MOTOR_LT BIT(3)
-#define GIP_MOTOR_ALL (GIP_MOTOR_R | GIP_MOTOR_L | GIP_MOTOR_RT | GIP_MOTOR_LT)
-
-#define GIP_WIRED_INTF_DATA 0
-#define GIP_WIRED_INTF_AUDIO 1
-
-/*
- * This packet is required for all Xbox One pads with 2015
- * or later firmware installed (or present from the factory).
- */
-static const u8 xboxone_power_on[] = {
- GIP_CMD_POWER, GIP_OPT_INTERNAL, GIP_SEQ0, GIP_PL_LEN(1), GIP_PWR_ON
-};
-
-/*
- * This packet is required for Xbox One S (0x045e:0x02ea)
- * and Xbox One Elite Series 2 (0x045e:0x0b00) pads to
- * initialize the controller that was previously used in
- * Bluetooth mode.
- */
-static const u8 xboxone_s_init[] = {
- GIP_CMD_POWER, GIP_OPT_INTERNAL, GIP_SEQ0, 0x0f, 0x06
-};
-
-/*
- * This packet is required to get additional input data
- * from Xbox One Elite Series 2 (0x045e:0x0b00) pads.
- * We mostly do this right now to get paddle data
- */
-static const u8 extra_input_packet_init[] = {
- 0x4d, 0x10, 0x01, 0x02, 0x07, 0x00
-};
-
-/*
- * This packet is required for the Titanfall 2 Xbox One pads
- * (0x0e6f:0x0165) to finish initialization and for Hori pads
- * (0x0f0d:0x0067) to make the analog sticks work.
- */
-static const u8 xboxone_hori_ack_id[] = {
- GIP_CMD_ACK, GIP_OPT_INTERNAL, GIP_SEQ0, GIP_PL_LEN(9),
- 0x00, GIP_CMD_IDENTIFY, GIP_OPT_INTERNAL, 0x3a, 0x00, 0x00, 0x00, 0x80, 0x00
-};
-
-/*
- * This packet is sent by default on Windows, and is required for some pads to
- * start sending input reports, including most (all?) of the PDP. These pads
- * include: (0x0e6f:0x02ab), (0x0e6f:0x02a4), (0x0e6f:0x02a6).
- */
-static const u8 xboxone_led_on[] = { GIP_CMD_LED, GIP_OPT_INTERNAL, GIP_SEQ0,
-GIP_PL_LEN(3), 0x00, GIP_LED_ON, 0x14 };
-
-/*
- * This packet is required for most (all?) of the PDP pads to start
- * sending input reports. These pads include: (0x0e6f:0x02ab),
- * (0x0e6f:0x02a4), (0x0e6f:0x02a6).
- */
-static const u8 xboxone_auth_done[] = {
- GIP_CMD_AUTHENTICATE, GIP_OPT_INTERNAL, GIP_SEQ0, GIP_PL_LEN(2), 0x01, 0x00
-};
-
-/*
- * A specific rumble packet is required for some PowerA pads to start
- * sending input reports. One of those pads is (0x24c6:0x543a).
- */
-static const u8 xboxone_rumblebegin_init[] = {
- GIP_CMD_RUMBLE, 0x00, GIP_SEQ0, GIP_PL_LEN(9),
- 0x00, GIP_MOTOR_ALL, 0x00, 0x00, 0x1D, 0x1D, 0xFF, 0x00, 0x00
-};
-
-/*
- * A rumble packet with zero FF intensity will immediately
- * terminate the rumbling required to init PowerA pads.
- * This should happen fast enough that the motors don't
- * spin up to enough speed to actually vibrate the gamepad.
- */
-static const u8 xboxone_rumbleend_init[] = {
- GIP_CMD_RUMBLE, 0x00, GIP_SEQ0, GIP_PL_LEN(9),
- 0x00, GIP_MOTOR_ALL, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
-};
-
-/*
- * This specifies the selection of init packets that a gamepad
- * will be sent on init *and* the order in which they will be
- * sent. The correct sequence number will be added when the
- * packet is going to be sent.
- */
-static const struct xboxone_init_packet xboxone_init_packets[] = {
- XBOXONE_INIT_PKT(0x0e6f, 0x0165, xboxone_hori_ack_id),
- XBOXONE_INIT_PKT(0x0f0d, 0x0067, xboxone_hori_ack_id),
- XBOXONE_INIT_PKT(0x0000, 0x0000, xboxone_power_on),
- XBOXONE_INIT_PKT(0x045e, 0x02ea, xboxone_s_init),
- XBOXONE_INIT_PKT(0x045e, 0x0b00, xboxone_s_init),
- XBOXONE_INIT_PKT(0x045e, 0x0b00, extra_input_packet_init),
- XBOXONE_INIT_PKT(0x0000, 0x0000, xboxone_led_on),
- XBOXONE_INIT_PKT(0x0000, 0x0000, xboxone_auth_done),
- XBOXONE_INIT_PKT(0x24c6, 0x541a, xboxone_rumblebegin_init),
- XBOXONE_INIT_PKT(0x24c6, 0x542a, xboxone_rumblebegin_init),
- XBOXONE_INIT_PKT(0x24c6, 0x543a, xboxone_rumblebegin_init),
- XBOXONE_INIT_PKT(0x24c6, 0x541a, xboxone_rumbleend_init),
- XBOXONE_INIT_PKT(0x24c6, 0x542a, xboxone_rumbleend_init),
- XBOXONE_INIT_PKT(0x24c6, 0x543a, xboxone_rumbleend_init),
-};
-
struct xpad_output_packet {
u8 data[XPAD_PKT_LEN];
u8 len;
@@ -754,14 +468,12 @@ struct usb_xpad {
struct urb *irq_out; /* urb for interrupt out report */
struct usb_anchor irq_out_anchor;
bool irq_out_active; /* we must not use an active URB */
- u8 odata_serial; /* serial number for xbox one protocol */
unsigned char *odata; /* output data */
dma_addr_t odata_dma;
spinlock_t odata_lock;
struct xpad_output_packet out_packets[XPAD_NUM_OUT_PACKETS];
int last_out_packet;
- int init_seq;
#if defined(CONFIG_JOYSTICK_XPAD_LEDS)
struct xpad_led *led;
@@ -771,19 +483,14 @@ struct usb_xpad {
int mapping; /* map d-pad to buttons or to axes */
int xtype; /* type of xbox device */
- int packet_type; /* type of the extended packet */
int pad_nr; /* the order x360 pads were attached */
const char *name; /* name of the device */
struct work_struct work; /* init/remove device from callback */
time64_t mode_btn_down_ts;
- bool delay_init; /* init packets should be delayed */
- bool delayed_init_done;
};
static int xpad_init_input(struct usb_xpad *xpad);
static void xpad_deinit_input(struct usb_xpad *xpad);
-static int xpad_start_input(struct usb_xpad *xpad);
-static void xpadone_ack_mode_report(struct usb_xpad *xpad, u8 seq_num);
static void xpad360w_poweroff_controller(struct usb_xpad *xpad);
/*
@@ -1021,187 +728,6 @@ static void xpad360w_process_packet(struct usb_xpad *xpad, u16 cmd, unsigned cha
rcu_read_unlock();
}
-/*
- * xpadone_process_packet
- *
- * Completes a request by converting the data into events for the
- * input subsystem. This version is for the Xbox One controller.
- *
- * The report format was gleaned from
- * https://github.com/kylelemons/xbox/blob/master/xbox.go
- */
-static void xpadone_process_packet(struct usb_xpad *xpad, u16 cmd, unsigned char *data, u32 len)
-{
- struct input_dev *dev = xpad->dev;
- bool do_sync = false;
-
- /* the xbox button has its own special report */
- if (data[0] == GIP_CMD_VIRTUAL_KEY) {
- /*
- * The Xbox One S controller requires these reports to be
- * acked otherwise it continues sending them forever and
- * won't report further mode button events.
- */
- if (data[1] == (GIP_OPT_ACK | GIP_OPT_INTERNAL))
- xpadone_ack_mode_report(xpad, data[2]);
-
- input_report_key(dev, BTN_MODE, data[4] & GENMASK(1, 0));
- input_sync(dev);
-
- do_sync = true;
- } else if (data[0] == GIP_CMD_FIRMWARE) {
- /* Some packet formats force us to use this separate to poll paddle inputs */
- if (xpad->packet_type == PKT_XBE2_FW_5_11) {
- /* Mute paddles if controller is in a custom profile slot
- * Checked by looking at the active profile slot to
- * verify it's the default slot
- */
- if (data[19] != 0)
- data[18] = 0;
-
- /* Elite Series 2 split packet paddle bits */
- input_report_key(dev, BTN_GRIPR, data[18] & BIT(0));
- input_report_key(dev, BTN_GRIPR2, data[18] & BIT(1));
- input_report_key(dev, BTN_GRIPL, data[18] & BIT(2));
- input_report_key(dev, BTN_GRIPL2, data[18] & BIT(3));
-
- do_sync = true;
- }
- } else if (data[0] == GIP_CMD_ANNOUNCE) {
- int error;
-
- if (xpad->delay_init && !xpad->delayed_init_done) {
- xpad->delayed_init_done = true;
- error = xpad_start_input(xpad);
- if (error)
- dev_warn(&xpad->dev->dev,
- "unable to start delayed input: %d\n",
- error);
- }
- } else if (data[0] == GIP_CMD_INPUT) { /* The main valid packet type for inputs */
- /* menu/view buttons */
- input_report_key(dev, BTN_START, data[4] & BIT(2));
- input_report_key(dev, BTN_SELECT, data[4] & BIT(3));
- if (xpad->mapping & MAP_SHARE_BUTTON) {
- u32 offset = (xpad->mapping & MAP_SHARE_OFFSET) ? 26 : 18;
-
- if (len >= offset)
- input_report_key(dev, KEY_RECORD, data[len - offset] & BIT(0));
- }
-
- /* buttons A,B,X,Y */
- input_report_key(dev, BTN_A, data[4] & BIT(4));
- input_report_key(dev, BTN_B, data[4] & BIT(5));
- input_report_key(dev, BTN_X, data[4] & BIT(6));
- input_report_key(dev, BTN_Y, data[4] & BIT(7));
-
- /* digital pad */
- if (xpad->mapping & MAP_DPAD_TO_BUTTONS) {
- /* dpad as buttons (left, right, up, down) */
- input_report_key(dev, BTN_DPAD_LEFT, data[5] & BIT(2));
- input_report_key(dev, BTN_DPAD_RIGHT, data[5] & BIT(3));
- input_report_key(dev, BTN_DPAD_UP, data[5] & BIT(0));
- input_report_key(dev, BTN_DPAD_DOWN, data[5] & BIT(1));
- } else {
- input_report_abs(dev, ABS_HAT0X,
- !!(data[5] & 0x08) - !!(data[5] & 0x04));
- input_report_abs(dev, ABS_HAT0Y,
- !!(data[5] & 0x02) - !!(data[5] & 0x01));
- }
-
- /* TL/TR */
- input_report_key(dev, BTN_TL, data[5] & BIT(4));
- input_report_key(dev, BTN_TR, data[5] & BIT(5));
-
- /* stick press left/right */
- input_report_key(dev, BTN_THUMBL, data[5] & BIT(6));
- input_report_key(dev, BTN_THUMBR, data[5] & BIT(7));
-
- if (!(xpad->mapping & MAP_STICKS_TO_NULL)) {
- /* left stick */
- input_report_abs(dev, ABS_X,
- (__s16) le16_to_cpup((__le16 *)(data + 10)));
- input_report_abs(dev, ABS_Y,
- ~(__s16) le16_to_cpup((__le16 *)(data + 12)));
-
- /* right stick */
- input_report_abs(dev, ABS_RX,
- (__s16) le16_to_cpup((__le16 *)(data + 14)));
- input_report_abs(dev, ABS_RY,
- ~(__s16) le16_to_cpup((__le16 *)(data + 16)));
- }
-
- /* triggers left/right */
- if (xpad->mapping & MAP_TRIGGERS_TO_BUTTONS) {
- input_report_key(dev, BTN_TL2,
- (__u16) le16_to_cpup((__le16 *)(data + 6)));
- input_report_key(dev, BTN_TR2,
- (__u16) le16_to_cpup((__le16 *)(data + 8)));
- } else {
- input_report_abs(dev, ABS_Z,
- (__u16) le16_to_cpup((__le16 *)(data + 6)));
- input_report_abs(dev, ABS_RZ,
- (__u16) le16_to_cpup((__le16 *)(data + 8)));
- }
-
- /* Profile button has a value of 0-3, so it is reported as an axis */
- if (xpad->mapping & MAP_PROFILE_BUTTON)
- input_report_abs(dev, ABS_PROFILE, data[34]);
-
- /* paddle handling */
- /* based on SDL's SDL_hidapi_xboxone.c */
- if (xpad->mapping & MAP_PADDLES) {
- if (xpad->packet_type == PKT_XBE1) {
- /* Mute paddles if controller has a custom mapping applied.
- * Checked by comparing the current mapping
- * config against the factory mapping config
- */
- if (memcmp(&data[4], &data[18], 2) != 0)
- data[32] = 0;
-
- /* OG Elite Series Controller paddle bits */
- input_report_key(dev, BTN_GRIPR, data[32] & BIT(1));
- input_report_key(dev, BTN_GRIPR2, data[32] & BIT(3));
- input_report_key(dev, BTN_GRIPL, data[32] & BIT(0));
- input_report_key(dev, BTN_GRIPL2, data[32] & BIT(2));
- } else if (xpad->packet_type == PKT_XBE2_FW_OLD) {
- /* Mute paddles if controller has a custom mapping applied.
- * Checked by comparing the current mapping
- * config against the factory mapping config
- */
- if (data[19] != 0)
- data[18] = 0;
-
- /* Elite Series 2 4.x firmware paddle bits */
- input_report_key(dev, BTN_GRIPR, data[18] & BIT(0));
- input_report_key(dev, BTN_GRIPR2, data[18] & BIT(1));
- input_report_key(dev, BTN_GRIPL, data[18] & BIT(2));
- input_report_key(dev, BTN_GRIPL2, data[18] & BIT(3));
- } else if (xpad->packet_type == PKT_XBE2_FW_5_EARLY) {
- /* Mute paddles if controller has a custom mapping applied.
- * Checked by comparing the current mapping
- * config against the factory mapping config
- */
- if (data[23] != 0)
- data[22] = 0;
-
- /* Elite Series 2 5.x firmware paddle bits
- * (before the packet was split)
- */
- input_report_key(dev, BTN_GRIPR, data[22] & BIT(0));
- input_report_key(dev, BTN_GRIPR2, data[22] & BIT(1));
- input_report_key(dev, BTN_GRIPL, data[22] & BIT(2));
- input_report_key(dev, BTN_GRIPL2, data[22] & BIT(3));
- }
- }
-
- do_sync = true;
- }
-
- if (do_sync)
- input_sync(dev);
-}
-
static void xpad_irq_in(struct urb *urb)
{
struct usb_xpad *xpad = urb->context;
@@ -1234,9 +760,6 @@ static void xpad_irq_in(struct urb *urb)
case XTYPE_XBOX360W:
xpad360w_process_packet(xpad, 0, xpad->idata);
break;
- case XTYPE_XBOXONE:
- xpadone_process_packet(xpad, 0, xpad->idata, urb->actual_length);
- break;
default:
xpad_process_packet(xpad, 0, xpad->idata);
}
@@ -1248,56 +771,12 @@ static void xpad_irq_in(struct urb *urb)
__func__, retval);
}
-/* Callers must hold xpad->odata_lock spinlock */
-static bool xpad_prepare_next_init_packet(struct usb_xpad *xpad)
-{
- const struct xboxone_init_packet *init_packet;
-
- if (xpad->xtype != XTYPE_XBOXONE)
- return false;
-
- /*
- * Some dongles will discard init packets if they're sent before the
- * controller connects. In these cases, we need to wait until we get
- * an announce packet from them to send the init packet sequence.
- */
- if (xpad->delay_init && !xpad->delayed_init_done)
- return false;
-
- /* Perform initialization sequence for Xbox One pads that require it */
- while (xpad->init_seq < ARRAY_SIZE(xboxone_init_packets)) {
- init_packet = &xboxone_init_packets[xpad->init_seq++];
-
- if (init_packet->idVendor != 0 &&
- init_packet->idVendor != xpad->dev->id.vendor)
- continue;
-
- if (init_packet->idProduct != 0 &&
- init_packet->idProduct != xpad->dev->id.product)
- continue;
-
- /* This packet applies to our device, so prepare to send it */
- memcpy(xpad->odata, init_packet->data, init_packet->len);
- xpad->irq_out->transfer_buffer_length = init_packet->len;
-
- /* Update packet with current sequence number */
- xpad->odata[2] = xpad->odata_serial++;
- return true;
- }
-
- return false;
-}
-
/* Callers must hold xpad->odata_lock spinlock */
static bool xpad_prepare_next_out_packet(struct usb_xpad *xpad)
{
struct xpad_output_packet *pkt, *packet = NULL;
int i;
- /* We may have init packets to send before we can send user commands */
- if (xpad_prepare_next_init_packet(xpad))
- return true;
-
for (i = 0; i < XPAD_NUM_OUT_PACKETS; i++) {
if (++xpad->last_out_packet >= XPAD_NUM_OUT_PACKETS)
xpad->last_out_packet = 0;
@@ -1473,57 +952,6 @@ static int xpad_inquiry_pad_presence(struct usb_xpad *xpad)
return xpad_try_sending_next_out_packet(xpad);
}
-static int xpad_start_xbox_one(struct usb_xpad *xpad)
-{
- int error;
-
- if (usb_ifnum_to_if(xpad->udev, GIP_WIRED_INTF_AUDIO)) {
- /*
- * Explicitly disable the audio interface. This is needed
- * for some controllers, such as the PowerA Enhanced Wired
- * Controller for Series X|S (0x20d6:0x200e) to report the
- * guide button.
- */
- error = usb_set_interface(xpad->udev,
- GIP_WIRED_INTF_AUDIO, 0);
- if (error)
- dev_warn(&xpad->dev->dev,
- "unable to disable audio interface: %d\n",
- error);
- }
-
- guard(spinlock_irqsave)(&xpad->odata_lock);
-
- /*
- * Begin the init sequence by attempting to send a packet.
- * We will cycle through the init packet sequence before
- * sending any packets from the output ring.
- */
- xpad->init_seq = 0;
- return xpad_try_sending_next_out_packet(xpad);
-}
-
-static void xpadone_ack_mode_report(struct usb_xpad *xpad, u8 seq_num)
-{
- struct xpad_output_packet *packet =
- &xpad->out_packets[XPAD_OUT_CMD_IDX];
- static const u8 mode_report_ack[] = {
- GIP_CMD_ACK, GIP_OPT_INTERNAL, GIP_SEQ0, GIP_PL_LEN(9),
- 0x00, GIP_CMD_VIRTUAL_KEY, GIP_OPT_INTERNAL, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00
- };
-
- guard(spinlock_irqsave)(&xpad->odata_lock);
-
- packet->len = sizeof(mode_report_ack);
- memcpy(packet->data, mode_report_ack, packet->len);
- packet->data[2] = seq_num;
- packet->pending = true;
-
- /* Reset the sequence so we send out the ack now */
- xpad->last_out_packet = -1;
- xpad_try_sending_next_out_packet(xpad);
-}
-
#ifdef CONFIG_JOYSTICK_XPAD_FF
static int xpad_play_effect(struct input_dev *dev, void *data, struct ff_effect *effect)
{
@@ -1582,24 +1010,6 @@ static int xpad_play_effect(struct input_dev *dev, void *data, struct ff_effect
packet->pending = true;
break;
- case XTYPE_XBOXONE:
- packet->data[0] = GIP_CMD_RUMBLE; /* activate rumble */
- packet->data[1] = 0x00;
- packet->data[2] = xpad->odata_serial++;
- packet->data[3] = GIP_PL_LEN(9);
- packet->data[4] = 0x00;
- packet->data[5] = GIP_MOTOR_ALL;
- packet->data[6] = 0x00; /* left trigger */
- packet->data[7] = 0x00; /* right trigger */
- packet->data[8] = strong / 512; /* left actuator */
- packet->data[9] = weak / 512; /* right actuator */
- packet->data[10] = 0xFF; /* on period */
- packet->data[11] = 0x00; /* off period */
- packet->data[12] = 0xFF; /* repeat count */
- packet->len = 13;
- packet->pending = true;
- break;
-
default:
dev_dbg(&xpad->dev->dev,
"%s - rumble command sent to unsupported xpad type: %d\n",
@@ -1778,13 +1188,6 @@ static int xpad_start_input(struct usb_xpad *xpad)
if (usb_submit_urb(xpad->irq_in, GFP_KERNEL))
return -EIO;
- if (xpad->xtype == XTYPE_XBOXONE) {
- error = xpad_start_xbox_one(xpad);
- if (error) {
- usb_kill_urb(xpad->irq_in);
- return error;
- }
- }
if (xpad->xtype == XTYPE_XBOX360) {
/*
* Some third-party controllers Xbox 360-style controllers
@@ -1890,8 +1293,6 @@ static void xpad_close(struct input_dev *dev)
static void xpad_set_up_abs(struct input_dev *input_dev, signed short abs)
{
- struct usb_xpad *xpad = input_get_drvdata(input_dev);
-
switch (abs) {
case ABS_X:
case ABS_Y:
@@ -1901,18 +1302,12 @@ static void xpad_set_up_abs(struct input_dev *input_dev, signed short abs)
break;
case ABS_Z:
case ABS_RZ: /* the triggers (if mapped to axes) */
- if (xpad->xtype == XTYPE_XBOXONE)
- input_set_abs_params(input_dev, abs, 0, 1023, 0, 0);
- else
- input_set_abs_params(input_dev, abs, 0, 255, 0, 0);
+ input_set_abs_params(input_dev, abs, 0, 255, 0, 0);
break;
case ABS_HAT0X:
case ABS_HAT0Y: /* the d-pad (only if dpad is mapped to axes */
input_set_abs_params(input_dev, abs, -1, 1, 0, 0);
break;
- case ABS_PROFILE: /* 4 value profile button (such as on XAC) */
- input_set_abs_params(input_dev, abs, 0, 4, 0, 0);
- break;
default:
input_set_abs_params(input_dev, abs, 0, 0, 0, 0);
break;
@@ -1967,12 +1362,9 @@ static int xpad_init_input(struct usb_xpad *xpad)
input_set_capability(input_dev, EV_KEY, xpad_common_btn[i]);
/* set up model-specific ones */
- if (xpad->xtype == XTYPE_XBOX360 || xpad->xtype == XTYPE_XBOX360W ||
- xpad->xtype == XTYPE_XBOXONE) {
+ if (xpad->xtype == XTYPE_XBOX360 || xpad->xtype == XTYPE_XBOX360W) {
for (i = 0; xpad360_btn[i] >= 0; i++)
input_set_capability(input_dev, EV_KEY, xpad360_btn[i]);
- if (xpad->mapping & MAP_SHARE_BUTTON)
- input_set_capability(input_dev, EV_KEY, KEY_RECORD);
} else {
for (i = 0; xpad_btn[i] >= 0; i++)
input_set_capability(input_dev, EV_KEY, xpad_btn[i]);
@@ -1984,12 +1376,6 @@ static int xpad_init_input(struct usb_xpad *xpad)
xpad_btn_pad[i]);
}
- /* set up paddles if the controller has them */
- if (xpad->mapping & MAP_PADDLES) {
- for (i = 0; xpad_btn_paddles[i] >= 0; i++)
- input_set_capability(input_dev, EV_KEY, xpad_btn_paddles[i]);
- }
-
/*
* This should be a simple else block. However historically
* xbox360w has mapped DPAD to buttons while xbox360 did not. This
@@ -2011,10 +1397,6 @@ static int xpad_init_input(struct usb_xpad *xpad)
xpad_set_up_abs(input_dev, xpad_abs_triggers[i]);
}
- /* setup profile button as an axis with 4 possible values */
- if (xpad->mapping & MAP_PROFILE_BUTTON)
- xpad_set_up_abs(input_dev, ABS_PROFILE);
-
error = xpad_init_ff(xpad);
if (error)
goto err_free_input;
@@ -2080,18 +1462,13 @@ static int xpad_probe(struct usb_interface *intf, const struct usb_device_id *id
xpad->mapping = xpad_device[i].mapping;
xpad->xtype = xpad_device[i].xtype;
xpad->name = xpad_device[i].name;
- if (xpad_device[i].flags & FLAG_DELAY_INIT)
- xpad->delay_init = true;
- xpad->packet_type = PKT_XB;
INIT_WORK(&xpad->work, xpad_presence_work);
if (xpad->xtype == XTYPE_UNKNOWN) {
if (intf->cur_altsetting->desc.bInterfaceClass == USB_CLASS_VENDOR_SPEC) {
if (intf->cur_altsetting->desc.bInterfaceProtocol == 129)
xpad->xtype = XTYPE_XBOX360W;
- else if (intf->cur_altsetting->desc.bInterfaceProtocol == 208)
- xpad->xtype = XTYPE_XBOXONE;
else
xpad->xtype = XTYPE_XBOX360;
} else {
@@ -2106,17 +1483,6 @@ static int xpad_probe(struct usb_interface *intf, const struct usb_device_id *id
xpad->mapping |= MAP_STICKS_TO_NULL;
}
- if (xpad->xtype == XTYPE_XBOXONE &&
- intf->cur_altsetting->desc.bInterfaceNumber != GIP_WIRED_INTF_DATA) {
- /*
- * The Xbox One controller lists three interfaces all with the
- * same interface class, subclass and protocol. Differentiate by
- * interface number.
- */
- error = -ENODEV;
- goto err_free_in_urb;
- }
-
ep_irq_in = ep_irq_out = NULL;
for (i = 0; i < 2; i++) {
@@ -2149,38 +1515,6 @@ static int xpad_probe(struct usb_interface *intf, const struct usb_device_id *id
usb_set_intfdata(intf, xpad);
- /* Packet type detection */
- if (le16_to_cpu(udev->descriptor.idVendor) == 0x045e) { /* Microsoft controllers */
- if (le16_to_cpu(udev->descriptor.idProduct) == 0x02e3) {
- /* The original elite controller always uses the oldest
- * type of extended packet
- */
- xpad->packet_type = PKT_XBE1;
- } else if (le16_to_cpu(udev->descriptor.idProduct) == 0x0b00) {
- /* The elite 2 controller has seen multiple packet
- * revisions. These are tied to specific firmware
- * versions
- */
- if (le16_to_cpu(udev->descriptor.bcdDevice) < 0x0500) {
- /* This is the format that the Elite 2 used
- * prior to the BLE update
- */
- xpad->packet_type = PKT_XBE2_FW_OLD;
- } else if (le16_to_cpu(udev->descriptor.bcdDevice) <
- 0x050b) {
- /* This is the format that the Elite 2 used
- * prior to the update that split the packet
- */
- xpad->packet_type = PKT_XBE2_FW_5_EARLY;
- } else {
- /* The split packet format that was introduced
- * in firmware v5.11
- */
- xpad->packet_type = PKT_XBE2_FW_5_11;
- }
- }
- }
-
if (xpad->xtype == XTYPE_XBOX360W) {
/*
* Submit the int URB immediately rather than waiting for open
@@ -2282,7 +1616,6 @@ static int xpad_resume(struct usb_interface *intf)
struct usb_xpad *xpad = usb_get_intfdata(intf);
struct input_dev *input = xpad->dev;
- xpad->delayed_init_done = false;
if (xpad->xtype == XTYPE_XBOX360W)
return xpad360w_start_input(xpad);
@@ -2291,15 +1624,6 @@ static int xpad_resume(struct usb_interface *intf)
if (input_device_enabled(input))
return xpad_start_input(xpad);
- if (xpad->xtype == XTYPE_XBOXONE) {
- /*
- * Even if there are no users, we'll send Xbox One pads
- * the startup sequence so they don't sit there and
- * blink until somebody opens the input device again.
- */
- return xpad_start_xbox_one(xpad);
- }
-
return 0;
}
--
2.54.0
^ permalink raw reply related [flat|nested] 22+ messages in thread
* [PATCH v5 03/12] Input: xbox_gip - Add controllable LED support
2026-09-02 1:02 [PATCH v5 00/12] Input: xbox_gip - Add new driver for Xbox GIP Vicki Pfau
2026-09-02 1:02 ` [PATCH v5 01/12] " Vicki Pfau
2026-09-02 1:02 ` [PATCH v5 02/12] Input: xpad - Remove Xbox One support Vicki Pfau
@ 2026-09-02 1:02 ` Vicki Pfau
2026-09-02 1:20 ` sashiko-bot
2026-09-02 1:02 ` [PATCH v5 04/12] Input: xbox_gip - Add HID relaying Vicki Pfau
` (8 subsequent siblings)
11 siblings, 1 reply; 22+ messages in thread
From: Vicki Pfau @ 2026-09-02 1:02 UTC (permalink / raw)
To: Dmitry Torokhov, linux-input; +Cc: Vicki Pfau
Xbox One controllers have two different types of controllable LED support:
- Monochrome white, which most controllers have.
- RGBW addressible, which the Elite 2 controllers have.
This exposes both types as led cdevs.
Signed-off-by: Vicki Pfau <vi@endrift.com>
---
drivers/input/joystick/gip/Kconfig | 2 +-
drivers/input/joystick/gip/gip-core.c | 115 ++++++++++++++++++++++++++
drivers/input/joystick/gip/gip.h | 6 +-
3 files changed, 121 insertions(+), 2 deletions(-)
diff --git a/drivers/input/joystick/gip/Kconfig b/drivers/input/joystick/gip/Kconfig
index 2ce789d23178..3422bf84cb89 100644
--- a/drivers/input/joystick/gip/Kconfig
+++ b/drivers/input/joystick/gip/Kconfig
@@ -4,7 +4,7 @@
#
config JOYSTICK_XBOX_GIP
tristate "Xbox One/Series controller support"
- depends on USB && USB_ARCH_HAS_HCD
+ depends on USB && USB_ARCH_HAS_HCD && LEDS_CLASS_MULTICOLOR
help
Say Y here if you want to use Xbox One and Series controllers with your
computer. Make sure to say Y to "Joystick support" (CONFIG_INPUT_JOYDEV)
diff --git a/drivers/input/joystick/gip/gip-core.c b/drivers/input/joystick/gip/gip-core.c
index 11196afdce33..23ab0768580f 100644
--- a/drivers/input/joystick/gip/gip-core.c
+++ b/drivers/input/joystick/gip/gip-core.c
@@ -1037,9 +1037,120 @@ static int gip_send_guide_button_led(struct gip_attachment *attachment,
if (!gip_supports_system_message(attachment, GIP_CMD_LED, false))
return 0;
+ if (!(attachment->features & GIP_FEATURE_GUIDE_COLOR))
+ attachment->guide_led.standard.brightness = intensity;
+
return gip_send_system_message(attachment, GIP_CMD_LED, 0, buffer, sizeof(buffer));
}
+static int gip_send_guide_button_color_led(struct gip_attachment *attachment,
+ uint8_t r, uint8_t g, uint8_t b, uint8_t w)
+{
+ uint8_t buffer[] = { 0x00, w, r, g, b };
+
+ if (!(attachment->features & GIP_FEATURE_GUIDE_COLOR))
+ return -EINVAL;
+
+ attachment->guide_led.color.subled_info[0].brightness = r;
+ attachment->guide_led.color.subled_info[1].brightness = g;
+ attachment->guide_led.color.subled_info[2].brightness = b;
+ attachment->guide_led.color.subled_info[3].brightness = w;
+
+ return gip_send_vendor_message(attachment, GIP_CMD_GUIDE_COLOR, 0, buffer, sizeof(buffer));
+}
+
+static int gip_guide_led_set(struct led_classdev *led,
+ enum led_brightness value)
+{
+ struct gip_attachment *attachment = container_of(led,
+ struct gip_attachment, guide_led.standard);
+
+ guard(mutex)(&attachment->lock);
+ return gip_send_guide_button_led(attachment, GIP_LED_GUIDE_ON, value);
+}
+
+static int gip_guide_color_led_set(struct led_classdev *led,
+ enum led_brightness value)
+{
+ struct led_classdev_mc *mc_cdev = container_of(led,
+ struct led_classdev_mc, led_cdev);
+ struct gip_attachment *attachment = container_of(mc_cdev,
+ struct gip_attachment, guide_led.color);
+
+ guard(mutex)(&attachment->lock);
+ led_mc_calc_color_components(mc_cdev, value);
+ return gip_send_guide_button_color_led(attachment,
+ mc_cdev->subled_info[0].brightness,
+ mc_cdev->subled_info[1].brightness,
+ mc_cdev->subled_info[2].brightness,
+ mc_cdev->subled_info[3].brightness);
+}
+
+static int gip_guide_led_probe(struct gip_attachment *attachment, struct device *dev)
+{
+ int rc = 0;
+
+ if (!gip_supports_system_message(attachment, GIP_CMD_LED, false))
+ return 0;
+
+ if (attachment->features & GIP_FEATURE_GUIDE_COLOR) {
+ struct mc_subled *mc_led_info;
+ struct led_classdev_mc *mc_cdev = &attachment->guide_led.color;
+ struct led_classdev *cdev = &mc_cdev->led_cdev;
+
+ mc_led_info = devm_kcalloc(dev, 4,
+ sizeof(*mc_led_info), GFP_KERNEL);
+ if (!mc_led_info)
+ return -ENOMEM;
+
+ mc_led_info[0].color_index = LED_COLOR_ID_RED;
+ mc_led_info[0].intensity = 51;
+ mc_led_info[1].color_index = LED_COLOR_ID_GREEN;
+ mc_led_info[1].intensity = 51;
+ mc_led_info[2].color_index = LED_COLOR_ID_BLUE;
+ mc_led_info[2].intensity = 51;
+ mc_led_info[3].color_index = LED_COLOR_ID_WHITE;
+ mc_led_info[3].intensity = 51;
+
+ mc_cdev->subled_info = mc_led_info;
+ mc_cdev->num_colors = 4;
+
+ cdev->brightness = 51;
+ cdev->max_brightness = 255;
+ cdev->flags = LED_CORE_SUSPENDRESUME | LED_RETAIN_AT_SHUTDOWN;
+ cdev->brightness_set_blocking = gip_guide_color_led_set;
+ cdev->name = devm_kasprintf(dev, GFP_KERNEL,
+ "%s:rgb:power", dev_name(dev));
+ if (!cdev->name)
+ rc = -ENOMEM;
+
+ if (!rc)
+ rc = devm_led_classdev_multicolor_register(dev,
+ mc_cdev);
+
+ if (rc)
+ devm_kfree(dev, mc_led_info);
+ } else {
+ struct led_classdev *cdev = &attachment->guide_led.standard;
+
+ cdev->max_brightness = GIP_LED_GUIDE_MAX_BRIGHTNESS;
+ cdev->brightness = GIP_LED_GUIDE_INIT_BRIGHTNESS;
+ cdev->flags = LED_CORE_SUSPENDRESUME | LED_RETAIN_AT_SHUTDOWN;
+ cdev->brightness_set_blocking = gip_guide_led_set;
+ cdev->name = devm_kasprintf(dev, GFP_KERNEL,
+ "%s:white:power", dev_name(dev));
+ if (!cdev->name)
+ return -ENOMEM;
+
+ rc = devm_led_classdev_register(dev, cdev);
+
+ if (rc)
+ devm_kfree(dev, cdev->name);
+ }
+
+ return rc;
+}
+
static bool gip_send_set_device_state(struct gip_attachment *attachment, uint8_t state)
{
uint8_t buffer[] = { state };
@@ -1150,6 +1261,10 @@ static int gip_setup_input_device(struct gip_attachment *attachment)
if (rc)
goto err_free_device;
+ rc = gip_guide_led_probe(attachment, &input->dev);
+ if (rc)
+ gip_err(attachment, "Failed to register LEDs: %d\n", rc);
+
return 0;
err_free_device:
diff --git a/drivers/input/joystick/gip/gip.h b/drivers/input/joystick/gip/gip.h
index d48ab64ab2eb..2e78aad508c3 100644
--- a/drivers/input/joystick/gip/gip.h
+++ b/drivers/input/joystick/gip/gip.h
@@ -12,6 +12,7 @@
#ifndef _GIP_H
#define _GIP_H
+#include <linux/led-class-multicolor.h>
#include <linux/rcupdate.h>
#include <linux/usb/input.h>
@@ -234,6 +235,10 @@ struct gip_attachment {
uint8_t seq_vendor;
uint8_t device_state;
+ union {
+ struct led_classdev standard;
+ struct led_classdev_mc color;
+ } guide_led;
struct gip_extended_status status;
@@ -245,7 +250,6 @@ struct gip_attachment {
int extra_axes;
bool dpad_as_buttons;
- struct hid_device __rcu *hdev;
};
struct gip_urb {
--
2.54.0
^ permalink raw reply related [flat|nested] 22+ messages in thread
* [PATCH v5 04/12] Input: xbox_gip - Add HID relaying
2026-09-02 1:02 [PATCH v5 00/12] Input: xbox_gip - Add new driver for Xbox GIP Vicki Pfau
` (2 preceding siblings ...)
2026-09-02 1:02 ` [PATCH v5 03/12] Input: xbox_gip - Add controllable LED support Vicki Pfau
@ 2026-09-02 1:02 ` Vicki Pfau
2026-09-02 1:22 ` sashiko-bot
2026-09-02 1:02 ` [PATCH v5 05/12] Input: xbox_gip - Add battery support Vicki Pfau
` (7 subsequent siblings)
11 siblings, 1 reply; 22+ messages in thread
From: Vicki Pfau @ 2026-09-02 1:02 UTC (permalink / raw)
To: Dmitry Torokhov, linux-input; +Cc: Vicki Pfau
GIP allows tunneling of HID packets, with the HID descriptor embedded in
the GIP metadata exchanged during the initial handshake. This patch creates
a hid_device for this HID descriptor if found, as well as relaying the HID
packets.
Signed-off-by: Vicki Pfau <vi@endrift.com>
---
drivers/input/joystick/gip/gip-core.c | 114 +++++++++++++++++++++++++-
drivers/input/joystick/gip/gip.h | 2 +
include/uapi/linux/input.h | 1 +
3 files changed, 114 insertions(+), 3 deletions(-)
diff --git a/drivers/input/joystick/gip/gip-core.c b/drivers/input/joystick/gip/gip-core.c
index 23ab0768580f..3b033fe65dc4 100644
--- a/drivers/input/joystick/gip/gip-core.c
+++ b/drivers/input/joystick/gip/gip-core.c
@@ -560,6 +560,54 @@ int gip_send_vendor_message(struct gip_attachment *attachment,
bytes, num_bytes);
}
+static int gip_hid_ll_parse(struct hid_device *hdev)
+{
+ struct gip_attachment *attachment = hdev->driver_data;
+
+ return hid_parse_report(hdev,
+ attachment->metadata.device.hid_descriptor,
+ attachment->metadata.device.hid_descriptor_size);
+}
+
+static int gip_hid_ll_start(struct hid_device *hdev)
+{
+ return 0;
+}
+
+static void gip_hid_ll_stop(struct hid_device *hdev)
+{
+}
+
+static int gip_hid_ll_open(struct hid_device *hdev)
+{
+ return 0;
+}
+
+static void gip_hid_ll_close(struct hid_device *hdev)
+{
+}
+
+static int gip_hid_ll_raw_request(struct hid_device *hdev,
+ unsigned char reportnum, uint8_t *buf, size_t count,
+ unsigned char report_type, int reqtype)
+{
+ /*
+ * TODO: Based on the metadata, output reports appear to be possible,
+ * but the chatpad doesn't have the LEDs it claims to support, so
+ * it's not clear how to test we're sending them properly.
+ */
+ return 0;
+}
+
+static const struct hid_ll_driver gip_hid_ll_driver = {
+ .parse = gip_hid_ll_parse,
+ .start = gip_hid_ll_start,
+ .stop = gip_hid_ll_stop,
+ .open = gip_hid_ll_open,
+ .close = gip_hid_ll_close,
+ .raw_request = gip_hid_ll_raw_request,
+};
+
static void gip_metadata_free(struct device *dev, struct gip_metadata *metadata)
{
devm_kfree(dev, metadata->device.audio_formats);
@@ -1303,6 +1351,48 @@ static int gip_init_input_device(struct gip_attachment *attachment)
return rc;
}
+static int gip_create_hdev(struct gip_attachment *attachment)
+{
+ struct hid_device *hdev;
+ int rc;
+
+ if (!attachment->metadata.device.hid_descriptor)
+ return 0;
+
+ rcu_read_lock();
+ hdev = rcu_dereference(attachment->hdev);
+ rcu_read_unlock();
+ if (hdev)
+ return 0;
+
+ hdev = hid_allocate_device();
+
+ if (IS_ERR(hdev))
+ return PTR_ERR(hdev);
+
+ hdev->ll_driver = &gip_hid_ll_driver;
+ hdev->bus = BUS_GIP;
+ hdev->vendor = attachment->vendor_id;
+ hdev->product = attachment->product_id;
+ hdev->dev.parent = to_gip_device(attachment);
+ hdev->driver_data = attachment;
+ if (attachment->name)
+ strscpy(hdev->name, attachment->name);
+ else
+ strscpy(hdev->name, "Xbox Chatpad");
+ strscpy(hdev->phys, attachment->phys);
+ rc = hid_add_device(hdev);
+ if (rc) {
+ gip_err(attachment, "HID device add failed: %d\n", rc);
+ hid_destroy_device(hdev);
+ } else {
+ rcu_assign_pointer(attachment->hdev, hdev);
+ synchronize_rcu();
+ }
+
+ return rc;
+}
+
static int gip_send_init_sequence(struct gip_attachment *attachment)
{
int rc = 0;
@@ -1368,7 +1458,11 @@ static int gip_send_init_sequence(struct gip_attachment *attachment)
if (rc)
return rc;
- return 0;
+ rc = gip_create_hdev(attachment);
+ if (rc)
+ return rc;
+
+ return rc;
}
static void gip_fragment_timeout(struct work_struct *work)
@@ -1388,19 +1482,25 @@ static void gip_fragment_timeout(struct work_struct *work)
static void gip_free_devices(struct gip_attachment *attachment)
{
struct input_dev *input;
+ struct hid_device *hdev;
if (attachment->driver && attachment->driver->remove)
attachment->driver->remove(attachment);
rcu_read_lock();
input = rcu_dereference(attachment->input);
+ hdev = rcu_dereference(attachment->hdev);
rcu_read_unlock();
rcu_assign_pointer(attachment->input, NULL);
+ rcu_assign_pointer(attachment->hdev, NULL);
synchronize_rcu();
if (input)
input_unregister_device(input);
+
+ if (hdev)
+ hid_destroy_device(hdev);
}
static void gip_reset_metadata(struct gip_attachment *attachment)
@@ -1768,9 +1868,17 @@ static int gip_handle_command_firmware(struct gip_attachment *attachment,
static int gip_handle_command_hid_report(struct gip_attachment *attachment,
const struct gip_header *header, uint8_t *bytes, int num_bytes)
{
- gip_warn(attachment, "Unimplemented HID report message\n");
+ struct hid_device *hdev;
- return -EOPNOTSUPP;
+ guard(rcu)();
+ hdev = rcu_dereference(attachment->hdev);
+ if (hdev)
+ return hid_safe_input_report(hdev, HID_INPUT_REPORT, bytes,
+ num_bytes, umin(header->length, num_bytes), true);
+
+ gip_warn(attachment, "Got HID report with no HID descriptor\n");
+
+ return -EPROTO;
}
static int gip_handle_command_extended(struct gip_attachment *attachment,
diff --git a/drivers/input/joystick/gip/gip.h b/drivers/input/joystick/gip/gip.h
index 2e78aad508c3..fbcf66e18158 100644
--- a/drivers/input/joystick/gip/gip.h
+++ b/drivers/input/joystick/gip/gip.h
@@ -12,6 +12,7 @@
#ifndef _GIP_H
#define _GIP_H
+#include <linux/hid.h>
#include <linux/led-class-multicolor.h>
#include <linux/rcupdate.h>
#include <linux/usb/input.h>
@@ -250,6 +251,7 @@ struct gip_attachment {
int extra_axes;
bool dpad_as_buttons;
+ struct hid_device __rcu *hdev;
};
struct gip_urb {
diff --git a/include/uapi/linux/input.h b/include/uapi/linux/input.h
index 6aa703fcfcfb..d9c630ff8292 100644
--- a/include/uapi/linux/input.h
+++ b/include/uapi/linux/input.h
@@ -276,6 +276,7 @@ struct input_mask {
#define BUS_INTEL_ISHTP 0x1F
#define BUS_AMD_SFH 0x20
#define BUS_SDW 0x21
+#define BUS_GIP 0x22
/*
* MT_TOOL types
--
2.54.0
^ permalink raw reply related [flat|nested] 22+ messages in thread
* [PATCH v5 05/12] Input: xbox_gip - Add battery support
2026-09-02 1:02 [PATCH v5 00/12] Input: xbox_gip - Add new driver for Xbox GIP Vicki Pfau
` (3 preceding siblings ...)
2026-09-02 1:02 ` [PATCH v5 04/12] Input: xbox_gip - Add HID relaying Vicki Pfau
@ 2026-09-02 1:02 ` Vicki Pfau
2026-09-02 1:20 ` sashiko-bot
2026-09-02 1:02 ` [PATCH v5 06/12] Input: xbox_gip - Allow sending fragmented and ACME messages Vicki Pfau
` (6 subsequent siblings)
11 siblings, 1 reply; 22+ messages in thread
From: Vicki Pfau @ 2026-09-02 1:02 UTC (permalink / raw)
To: Dmitry Torokhov, linux-input; +Cc: Vicki Pfau
Controllers are required to give information about the battery in the
controller, if present. This patch exposes that information as a
power_supply device.
Signed-off-by: Vicki Pfau <vi@endrift.com>
---
drivers/input/joystick/gip/gip-core.c | 125 +++++++++++++++++++++++++-
drivers/input/joystick/gip/gip.h | 4 +
2 files changed, 125 insertions(+), 4 deletions(-)
diff --git a/drivers/input/joystick/gip/gip-core.c b/drivers/input/joystick/gip/gip-core.c
index 3b033fe65dc4..57d638408daf 100644
--- a/drivers/input/joystick/gip/gip-core.c
+++ b/drivers/input/joystick/gip/gip-core.c
@@ -255,6 +255,13 @@ static const struct gip_audio_format gip_audio_format_table[MAX_GIP_AUDIO_FORMAT
};
+static enum power_supply_property gip_battery_props[] = {
+ POWER_SUPPLY_PROP_PRESENT,
+ POWER_SUPPLY_PROP_CAPACITY_LEVEL,
+ POWER_SUPPLY_PROP_SCOPE,
+ POWER_SUPPLY_PROP_STATUS,
+};
+
static const struct gip_quirks base_quirks[] = {
{ GIP_VID_PDP, GIP_PID_PDP_ROCK_CANDY, 0, .quirks = GIP_QUIRK_NO_HELLO },
@@ -1199,6 +1206,106 @@ static int gip_guide_led_probe(struct gip_attachment *attachment, struct device
return rc;
}
+static int gip_battery_get_property(struct power_supply *psy,
+ enum power_supply_property psp, union power_supply_propval *val)
+{
+ struct gip_attachment *attachment = power_supply_get_drvdata(psy);
+
+ guard(spinlock_irqsave)(&attachment->battery_lock);
+ switch (psp) {
+ case POWER_SUPPLY_PROP_PRESENT:
+ val->intval = attachment->status.base.battery_type != GIP_BATTERY_ABSENT;
+ break;
+ case POWER_SUPPLY_PROP_SCOPE:
+ val->intval = POWER_SUPPLY_SCOPE_DEVICE;
+ break;
+ case POWER_SUPPLY_PROP_STATUS:
+ if (attachment->status.base.battery_type == GIP_BATTERY_ABSENT) {
+ val->intval = POWER_SUPPLY_STATUS_NOT_CHARGING;
+ } else {
+ switch (attachment->status.base.charge) {
+ case GIP_CHARGING:
+ if (attachment->status.base.battery_level == GIP_BATTERY_FULL)
+ val->intval = POWER_SUPPLY_STATUS_FULL;
+ else
+ val->intval = POWER_SUPPLY_STATUS_CHARGING;
+ break;
+ case GIP_NOT_CHARGING:
+ val->intval = POWER_SUPPLY_STATUS_DISCHARGING;
+ break;
+ case GIP_CHARGE_ERROR:
+ default:
+ val->intval = POWER_SUPPLY_STATUS_UNKNOWN;
+ break;
+ }
+ }
+ break;
+ case POWER_SUPPLY_PROP_CAPACITY_LEVEL:
+ if (attachment->status.base.battery_type == GIP_BATTERY_ABSENT) {
+ val->intval = POWER_SUPPLY_CAPACITY_LEVEL_FULL;
+ } else {
+ switch (attachment->status.base.battery_level) {
+ case GIP_BATTERY_CRITICAL:
+ val->intval = POWER_SUPPLY_CAPACITY_LEVEL_CRITICAL;
+ break;
+ case GIP_BATTERY_LOW:
+ val->intval = POWER_SUPPLY_CAPACITY_LEVEL_LOW;
+ break;
+ case GIP_BATTERY_MEDIUM:
+ val->intval = POWER_SUPPLY_CAPACITY_LEVEL_NORMAL;
+ break;
+ case GIP_BATTERY_FULL:
+ val->intval = POWER_SUPPLY_CAPACITY_LEVEL_FULL;
+ break;
+ default:
+ val->intval = POWER_SUPPLY_CAPACITY_LEVEL_UNKNOWN;
+ break;
+ }
+ break;
+ }
+ break;
+ default:
+ return -EINVAL;
+ }
+ return 0;
+}
+
+static int gip_battery_create(struct gip_attachment *attachment, struct device *dev)
+{
+ struct power_supply_config supply_config = { .drv_data = attachment, };
+ int rc;
+
+ attachment->battery_desc.properties = gip_battery_props;
+ attachment->battery_desc.num_properties = ARRAY_SIZE(gip_battery_props);
+ attachment->battery_desc.get_property = gip_battery_get_property;
+ attachment->battery_desc.type = POWER_SUPPLY_TYPE_BATTERY;
+ attachment->battery_desc.name = devm_kasprintf(dev, GFP_KERNEL,
+ "gip-battery-%s", dev_name(dev));
+
+ if (!attachment->battery_desc.name)
+ return -ENOMEM;
+
+ attachment->battery = devm_power_supply_register(dev,
+ &attachment->battery_desc, &supply_config);
+ if (IS_ERR(attachment->battery)) {
+ rc = PTR_ERR(attachment->battery);
+ goto err_out;
+ }
+
+ rc = power_supply_powers(attachment->battery, dev);
+ if (rc < 0) {
+ power_supply_unregister(attachment->battery);
+ goto err_out;
+ }
+
+ return 0;
+
+err_out:
+ attachment->battery = NULL;
+ devm_kfree(dev, attachment->battery_desc.name);
+ return rc;
+}
+
static bool gip_send_set_device_state(struct gip_attachment *attachment, uint8_t state)
{
uint8_t buffer[] = { state };
@@ -1312,6 +1419,9 @@ static int gip_setup_input_device(struct gip_attachment *attachment)
rc = gip_guide_led_probe(attachment, &input->dev);
if (rc)
gip_err(attachment, "Failed to register LEDs: %d\n", rc);
+ rc = gip_battery_create(attachment, &input->dev);
+ if (rc)
+ gip_err(attachment, "Failed to register battery: %d\n", rc);
return 0;
@@ -1494,6 +1604,8 @@ static void gip_free_devices(struct gip_attachment *attachment)
rcu_assign_pointer(attachment->input, NULL);
rcu_assign_pointer(attachment->hdev, NULL);
+ /* The following are freed by devres */
+ attachment->battery = NULL;
synchronize_rcu();
if (input)
@@ -1629,10 +1741,14 @@ static int gip_handle_command_status_device(struct gip_attachment *attachment,
if (num_bytes < 1)
return -EINVAL;
- attachment->status.base.battery_level = bytes[0] & 3;
- attachment->status.base.battery_type = (bytes[0] >> 2) & 3;
- attachment->status.base.charge = (bytes[0] >> 4) & 3;
- attachment->status.base.power_level = (bytes[0] >> 6) & 3;
+ scoped_guard(spinlock_irqsave, &attachment->battery_lock) {
+ attachment->status.base.battery_level = bytes[0] & 3;
+ attachment->status.base.battery_type = (bytes[0] >> 2) & 3;
+ attachment->status.base.charge = (bytes[0] >> 4) & 3;
+ attachment->status.base.power_level = (bytes[0] >> 6) & 3;
+ }
+ if (attachment->battery)
+ power_supply_changed(attachment->battery);
if (num_bytes >= 4) {
attachment->status.device_active = bytes[1] & 1;
@@ -2122,6 +2238,7 @@ static struct gip_attachment *gip_ensure_attachment(struct gip_device *device,
device->attachments[attachment_index] = attachment;
mutex_init(&attachment->lock);
+ spin_lock_init(&attachment->battery_lock);
INIT_DELAYED_WORK(&attachment->in_fragment_timeout, gip_fragment_timeout);
INIT_DELAYED_WORK(&attachment->metadata_next, gip_retry_metadata);
diff --git a/drivers/input/joystick/gip/gip.h b/drivers/input/joystick/gip/gip.h
index fbcf66e18158..13a182145577 100644
--- a/drivers/input/joystick/gip/gip.h
+++ b/drivers/input/joystick/gip/gip.h
@@ -14,6 +14,7 @@
#include <linux/hid.h>
#include <linux/led-class-multicolor.h>
+#include <linux/power_supply.h>
#include <linux/rcupdate.h>
#include <linux/usb/input.h>
@@ -241,6 +242,9 @@ struct gip_attachment {
struct led_classdev_mc color;
} guide_led;
+ spinlock_t battery_lock;
+ struct power_supply *battery;
+ struct power_supply_desc battery_desc;
struct gip_extended_status status;
enum gip_elite_button_format xbe_format;
--
2.54.0
^ permalink raw reply related [flat|nested] 22+ messages in thread
* [PATCH v5 06/12] Input: xbox_gip - Allow sending fragmented and ACME messages
2026-09-02 1:02 [PATCH v5 00/12] Input: xbox_gip - Add new driver for Xbox GIP Vicki Pfau
` (4 preceding siblings ...)
2026-09-02 1:02 ` [PATCH v5 05/12] Input: xbox_gip - Add battery support Vicki Pfau
@ 2026-09-02 1:02 ` Vicki Pfau
2026-09-02 1:19 ` sashiko-bot
2026-09-02 1:02 ` [PATCH v5 07/12] Input: xbox_gip - Add security implementation from xone Vicki Pfau
` (5 subsequent siblings)
11 siblings, 1 reply; 22+ messages in thread
From: Vicki Pfau @ 2026-09-02 1:02 UTC (permalink / raw)
To: Dmitry Torokhov, linux-input; +Cc: Vicki Pfau
GIP supports sending messages that exceed the length of the MTU using a
fragmented message flow. It sits on top of a reliable message transmission
flow, which uses the ACME flag to signal that a message must be ACKed if it
is received properly. We already supported receiving and coalescing these
messages, but the ability to send them wasn't yet present due to not
needing it for basic usage. This patch adds it for future use with the
security flow.
Signed-off-by: Vicki Pfau <vi@endrift.com>
---
drivers/input/joystick/gip/gip-core.c | 330 ++++++++++++++++++++++++--
drivers/input/joystick/gip/gip.h | 17 ++
2 files changed, 330 insertions(+), 17 deletions(-)
diff --git a/drivers/input/joystick/gip/gip-core.c b/drivers/input/joystick/gip/gip-core.c
index 57d638408daf..544becf8badd 100644
--- a/drivers/input/joystick/gip/gip-core.c
+++ b/drivers/input/joystick/gip/gip-core.c
@@ -8,7 +8,6 @@
* - Audio device support
* - Security packet handshake
* - Event logging
- * - Sending fragmented messages
* - Raw character device
* - Wheel support
* - Flight stick support
@@ -28,6 +27,7 @@
#define GIP_WIRED_INTF_DATA 0
#define GIP_WIRED_INTF_AUDIO 1
+#define GIP_DUAL_LENGTH 6
#define MAX_MESSAGE_LENGTH 0x4000
#define MAX_AUDIO_MESSAGES 9
@@ -437,6 +437,13 @@ static uint8_t gip_sequence_next(struct gip_attachment *attachment,
return seq;
}
+static unsigned int gip_fragment_id(const struct gip_attachment *attachment,
+ const struct gip_out_fragment *fragment)
+{
+ return BIT(attachment->attachment_index * MAX_OUT_FRAGMENTS +
+ (unsigned) (fragment - attachment->out_fragments));
+}
+
static void gip_handle_quirks_array(struct gip_attachment *attachment,
const struct gip_quirks *quirks)
{
@@ -479,6 +486,42 @@ static void gip_handle_quirks(struct gip_attachment *attachment)
gip_handle_quirks_array(attachment, attachment->driver->quirks);
}
+static struct gip_out_fragment *gip_find_fragment(struct gip_attachment *attachment,
+ uint8_t message_type, uint8_t flags, uint8_t seq, bool strict)
+{
+ int i;
+
+ for (i = 0; i < MAX_OUT_FRAGMENTS; i++) {
+ if (!attachment->out_fragments[i].active)
+ continue;
+ if (attachment->out_fragments[i].message != message_type)
+ continue;
+ if ((attachment->out_fragments[i].flags ^ flags) & GIP_FLAG_SYSTEM)
+ continue;
+ if (attachment->out_fragments[i].seq != seq) {
+ if (strict)
+ continue;
+
+ /*
+ * Found one with the wrong sequence number. For some
+ * reason the official driver allows this.
+ */
+ gip_warn(attachment,
+ "Found fragment with different sequence number %02x, wanted %02x\n",
+ attachment->out_fragments[i].seq, seq);
+ }
+
+ return &attachment->out_fragments[i];
+ }
+ return NULL;
+}
+
+static void gip_free_fragment(struct gip_out_fragment *fragment)
+{
+ kfree(fragment->data);
+ memset(fragment, 0, sizeof(*fragment));
+}
+
static int gip_send_raw_message(struct gip_attachment *attachment,
uint8_t message_type, uint8_t flags, uint8_t seq, const uint8_t *bytes,
int num_bytes)
@@ -486,20 +529,25 @@ static int gip_send_raw_message(struct gip_attachment *attachment,
struct gip_interface *intf;
int offset = 3;
struct gip_urb *urb = NULL;
+ struct gip_out_fragment *fragment = NULL;
int i;
int rc = 0;
+ int mtu = gip_data_class_mtu[message_type >> GIP_DATA_CLASS_SHIFT];
+ int reduced_mtu = mtu - GIP_DUAL_LENGTH;
+ /*
+ * This buffer size shouldn't need to be more than 6 (there should never
+ * be more than 3 length bytes), but add enough extra to fit fully
+ * extended bignums for 32 bit (5 bytes) + 16 bit (3 bytes) values to be
+ * safe and then WARN_ON if we go over. If this ever happens it would be
+ * due to driver bugs.
+ */
+ uint8_t header[11];
if (num_bytes < 0) {
gip_warn(attachment, "Invalid message length %d\n", num_bytes);
return -EINVAL;
}
- if (num_bytes + 6 > gip_data_class_mtu[message_type >> GIP_DATA_CLASS_SHIFT]) {
- gip_err(attachment,
- "Attempted to send a message that requires fragmenting, which is not yet supported.\n");
- return -EOPNOTSUPP;
- }
-
if ((message_type & GIP_DATA_CLASS_MASK) == GIP_DATA_CLASS_AUDIO)
intf = &attachment->device->audio;
else
@@ -511,6 +559,90 @@ static int gip_send_raw_message(struct gip_attachment *attachment,
return -EOPNOTSUPP;
}
+ header[0] = message_type;
+ header[2] = seq;
+
+ if (num_bytes > reduced_mtu ||
+ (flags & (GIP_FLAG_ACME | GIP_FLAG_FRAGMENT)) == GIP_FLAG_ACME) {
+ for (i = 0; i < MAX_OUT_FRAGMENTS; i++) {
+ if (attachment->out_fragments[i].active)
+ continue;
+
+ fragment = &attachment->out_fragments[i];
+ break;
+ }
+
+ if (!fragment) {
+ gip_err(attachment, "Fragmented message queue is full; dropping message\n");
+ return -EALREADY;
+ }
+
+ fragment->data = kmalloc(num_bytes, GFP_KERNEL);
+ if (!fragment->data)
+ return -ENOMEM;
+ fragment->active = true;
+ fragment->message = message_type;
+ fragment->flags = flags & GIP_FLAG_SYSTEM;
+ fragment->acked = false;
+ fragment->seq = seq;
+ fragment->total_length = num_bytes;
+ fragment->fragment_offset = 0;
+ memcpy(fragment->data, bytes, num_bytes);
+ bytes = fragment->data;
+
+ if (num_bytes > reduced_mtu) {
+ gip_dbg(attachment, "Starting new reliable message: %02x%02x%02x, total length %u\n",
+ message_type, flags, seq, num_bytes);
+ flags |= GIP_FLAG_INIT_FRAG | GIP_FLAG_FRAGMENT | GIP_FLAG_ACME;
+ fragment->flags |= GIP_FLAG_FRAGMENT;
+ /* The spec says to extend the value to fit in 3 bytes */
+ offset += gip_encode_length(reduced_mtu, &header[offset], sizeof(header));
+ if (offset == 4 && reduced_mtu < 0x80 && num_bytes < 0x80) {
+ header[3] |= 0x80;
+ header[4] = 0;
+ offset = 5;
+ }
+ offset += gip_encode_length(num_bytes, &header[offset],
+ sizeof(header) - offset);
+ WARN_ON(offset != GIP_DUAL_LENGTH);
+ num_bytes = mtu - offset;
+ } else {
+ offset += gip_encode_length(num_bytes, &header[offset],
+ sizeof(header) - offset);
+ }
+ } else if (flags & GIP_FLAG_FRAGMENT) {
+ fragment = gip_find_fragment(attachment, message_type, flags, seq, true);
+ if (!fragment) {
+ gip_err(attachment,
+ "Attempted to send message fragment with no associated message\n");
+ return -EINVAL;
+ }
+
+ num_bytes = min(reduced_mtu, fragment->total_length - fragment->fragment_offset);
+ offset += gip_encode_length(num_bytes, &header[offset],
+ sizeof(header) - offset);
+ if (offset == 4 && num_bytes < 0x80 && fragment->fragment_offset < 0x80) {
+ header[3] |= 0x80;
+ header[4] = 0;
+ offset = 5;
+ }
+ offset += gip_encode_length(fragment->fragment_offset, &header[offset],
+ sizeof(header) - offset);
+ WARN_ON(offset != GIP_DUAL_LENGTH);
+
+ if (num_bytes && fragment->fragment_offset + num_bytes == fragment->total_length) {
+ /* The final fragment in a fragmented message must be ACKed */
+ flags |= GIP_FLAG_ACME;
+ fragment->acked = false;
+ }
+ bytes = &fragment->data[fragment->fragment_offset];
+ } else if (num_bytes >= 0) {
+ offset += gip_encode_length(num_bytes, &header[offset],
+ sizeof(header) - offset);
+ }
+
+ header[1] = flags;
+
guard(spinlock_irqsave)(&attachment->device->message_lock);
for (i = 0; i < MAX_OUT_MESSAGES && !urb; i++) {
if (!intf->out_queue[i].urb)
@@ -520,17 +652,13 @@ static int gip_send_raw_message(struct gip_attachment *attachment,
}
if (!urb) {
gip_err(attachment, "Output queue is full; dropping message\n");
- return -ENOSPC;
+ rc = -ENOSPC;
+ goto err_free_fragment;
}
- urb->data[0] = message_type;
- urb->data[1] = flags;
- urb->data[2] = seq;
- offset += gip_encode_length(num_bytes, &urb->data[offset],
- sizeof(urb->data) - offset);
+ memcpy(urb->data, header, offset);
if (num_bytes > 0)
memcpy(&urb->data[offset], bytes, num_bytes);
-
num_bytes += offset;
urb->urb->transfer_buffer_length = num_bytes;
@@ -545,9 +673,96 @@ static int gip_send_raw_message(struct gip_attachment *attachment,
__func__, rc);
usb_unanchor_urb(urb->urb);
rc = -EIO;
+ goto err_free_fragment;
+ }
+
+ if (fragment) {
+ /*
+ * Sending further fragments is handled in gip_urb_out if this fragment doesn't need
+ * ACKing or in gip_handle_command_protocol_control if it does. The flag should also
+ * be cleared if we're done sending this packet.
+ */
+ if (fragment->total_length > reduced_mtu && !(flags & GIP_FLAG_ACME))
+ intf->has_pending_out |= gip_fragment_id(attachment, fragment);
+ else
+ intf->has_pending_out &= ~gip_fragment_id(attachment, fragment);
}
return rc;
+
+err_free_fragment:
+ gip_free_fragment(fragment);
+ return rc;
+}
+
+static int gip_send_next_fragment(struct gip_attachment *attachment,
+ struct gip_out_fragment *fragment)
+{
+ struct gip_interface *intf;
+ int next_bytes;
+ int flags = GIP_FLAG_FRAGMENT | fragment->flags | attachment->attachment_index;
+ int mtu;
+ int rc;
+
+ mtu = gip_data_class_mtu[fragment->message >> GIP_DATA_CLASS_SHIFT] - GIP_DUAL_LENGTH;
+ if (fragment->fragment_offset == fragment->total_length) {
+ if ((fragment->message & GIP_DATA_CLASS_MASK) == GIP_DATA_CLASS_AUDIO)
+ intf = &attachment->device->audio;
+ else
+ intf = &attachment->device->data;
+
+ next_bytes = 0;
+ intf->has_pending_out &= ~gip_fragment_id(attachment, fragment);
+ } else if (fragment->fragment_offset + mtu >= fragment->total_length) {
+ next_bytes = fragment->total_length - fragment->fragment_offset;
+ flags |= GIP_FLAG_ACME;
+ } else {
+ next_bytes = mtu;
+ }
+
+ rc = gip_send_raw_message(attachment, fragment->message, flags,
+ fragment->seq, &fragment->data[fragment->fragment_offset],
+ next_bytes);
+
+ if (rc < 0)
+ return rc;
+
+ if (fragment->acked)
+ fragment->fragment_offset += next_bytes;
+ if (next_bytes == 0 && !(fragment->flags & GIP_FLAG_ACME))
+ /* Finished sending the message */
+ gip_free_fragment(fragment);
+ return next_bytes;
+}
+
+static void gip_send_fragment_work(struct work_struct *work)
+{
+ struct gip_interface *intf = container_of(work, struct gip_interface, send_fragment);
+ struct gip_out_fragment *fragment;
+ unsigned int has_pending_out;
+ unsigned long flags;
+ int i, j;
+
+ spin_lock_irqsave(&intf->device->message_lock, flags);
+ has_pending_out = intf->has_pending_out;
+ spin_unlock_irqrestore(&intf->device->message_lock, flags);
+ for (i = 0; i < MAX_ATTACHMENTS; i++) {
+ struct gip_attachment *attachment = intf->device->attachments[i];
+
+ for (j = 0; j < MAX_OUT_FRAGMENTS; j++) {
+ /* Check for pending output fragments */
+ if (!(has_pending_out & BIT(i * MAX_OUT_FRAGMENTS + j)))
+ continue;
+
+ guard(mutex)(&attachment->lock);
+ fragment = &attachment->out_fragments[j];
+ if (!fragment->active)
+ continue;
+ if (!(fragment->flags & GIP_FLAG_FRAGMENT))
+ continue;
+ gip_send_next_fragment(attachment, fragment);
+ }
+ }
}
int gip_send_system_message(struct gip_attachment *attachment,
@@ -1659,6 +1874,8 @@ static int gip_ensure_metadata(struct gip_attachment *attachment)
static void gip_reset_attachment(struct gip_attachment *attachment)
{
+ int i;
+
cancel_delayed_work(&attachment->metadata_next);
cancel_delayed_work(&attachment->in_fragment_timeout);
@@ -1668,15 +1885,84 @@ static void gip_reset_attachment(struct gip_attachment *attachment)
attachment->in_fragment_message = -1;
}
+ for (i = 0; i < MAX_OUT_FRAGMENTS; i++) {
+ if (attachment->out_fragments[i].active)
+ gip_free_fragment(&attachment->out_fragments[i]);
+ }
+
gip_free_devices(attachment);
+
}
static int gip_handle_command_protocol_control(struct gip_attachment *attachment,
const struct gip_header *header, const uint8_t *bytes, int num_bytes)
{
- /* TODO */
- gip_warn(attachment, "Unimplemented Protocol Control message\n");
- return -EOPNOTSUPP;
+ const struct gip_protocol_control_ack *ack;
+ struct gip_out_fragment *fragment = NULL;
+ uint32_t fragment_offset;
+ uint16_t remaining_buffer;
+ bool ok = true;
+ int mtu;
+ int rc;
+
+ if (num_bytes < 1)
+ return -EINVAL;
+
+ if (bytes[0] != GIP_CONTROL_CODE_ACK) {
+ gip_warn(attachment, "Unimplemented Protocol Control code %i message\n", bytes[0]);
+ return -EOPNOTSUPP;
+ }
+
+ if (num_bytes < sizeof(*ack))
+ return -EINVAL;
+
+ ack = (const struct gip_protocol_control_ack *)bytes;
+
+ fragment = gip_find_fragment(attachment, ack->message_type, ack->flags,
+ header->sequence_id, false);
+ if (!fragment) {
+ gip_warn(attachment, "Received ACK for unknown message\n");
+ rc = -EINVAL;
+ goto resend;
+ }
+
+
+ fragment_offset = le32_to_cpu(ack->fragment_offset);
+ remaining_buffer = le16_to_cpu(ack->remaining_buffer);
+
+ if (fragment_offset > fragment->total_length)
+ ok = false;
+ mtu = gip_data_class_mtu[fragment->message >> GIP_DATA_CLASS_SHIFT] - GIP_DUAL_LENGTH;
+ if (!ok) {
+ gip_warn(attachment, "Received invalid buffer offset in ACK, "
+ "got offset=%u + remaining=%u, expected offset=%u + remaining=%u\n",
+ fragment_offset, remaining_buffer,
+ fragment->fragment_offset, fragment->total_length - fragment->fragment_offset);
+ rc = -EINVAL;
+ goto resend;
+ } else if ((fragment->flags & GIP_FLAG_FRAGMENT) &&
+ (fragment->fragment_offset > fragment_offset ||
+ fragment->fragment_offset + mtu < fragment_offset)) {
+ gip_warn(attachment, "Received unexpected buffer offset in ACK, "
+ "got offset=%u, expected offset=%u\n",
+ fragment_offset, fragment->fragment_offset + mtu);
+ }
+
+ fragment->acked = true;
+ if (fragment->flags & GIP_FLAG_FRAGMENT) {
+ fragment->fragment_offset = fragment_offset;
+ rc = gip_send_next_fragment(attachment, fragment);
+ if (rc < 0)
+ return rc;
+ } else {
+ gip_free_fragment(fragment);
+ }
+
+ return 0;
+
+resend:
+ // TODO
+ return rc;
}
static bool gip_handle_command_hello_device(struct gip_attachment *attachment,
@@ -2220,6 +2506,7 @@ static struct gip_attachment *gip_ensure_attachment(struct gip_device *device,
uint8_t attachment_index)
{
struct gip_attachment *attachment = device->attachments[attachment_index];
+ int i;
if (!attachment) {
attachment = devm_kzalloc(to_gip_device(device), sizeof(*attachment), GFP_KERNEL);
@@ -2235,6 +2522,9 @@ static struct gip_attachment *gip_ensure_attachment(struct gip_device *device,
attachment->product_id = device->udev->descriptor.idProduct;
}
+ for (i = 0; i < MAX_OUT_FRAGMENTS; i++)
+ attachment->out_fragments[i].message = -1;
+
device->attachments[attachment_index] = attachment;
mutex_init(&attachment->lock);
@@ -2549,6 +2839,7 @@ static void gip_urb_out(struct urb *urb)
switch (status) {
case 0:
/* success */
+ schedule_work(&intf->send_fragment);
break;
case -ECONNRESET:
@@ -2745,9 +3036,11 @@ static int gip_probe(struct usb_interface *intf, const struct usb_device_id *id)
gip->data.device = gip;
gip->data.intf = intf;
gip->data.mtu = BASE_GIP_MTU;
+ INIT_WORK(&gip->data.send_fragment, gip_send_fragment_work);
gip->audio.device = gip;
gip->audio.mtu = MAX_GIP_MTU;
gip->audio.isoc_messages = MAX_AUDIO_MESSAGES;
+ INIT_WORK(&gip->audio.send_fragment, gip_send_fragment_work);
INIT_WORK(&gip->receive_message, gip_receive_work);
spin_lock_init(&gip->message_lock);
@@ -2779,6 +3072,9 @@ static int gip_shutdown(struct gip_device *device)
int i;
cancel_work_sync(&device->receive_message);
+ cancel_work_sync(&device->data.send_fragment);
+ if (device->audio.intf)
+ cancel_work_sync(&device->audio.send_fragment);
for (i = 0; i < MAX_ATTACHMENTS; i++) {
struct gip_attachment *attachment = device->attachments[i];
diff --git a/drivers/input/joystick/gip/gip.h b/drivers/input/joystick/gip/gip.h
index 13a182145577..c7751f96e8ac 100644
--- a/drivers/input/joystick/gip/gip.h
+++ b/drivers/input/joystick/gip/gip.h
@@ -25,6 +25,7 @@
#define MAX_IN_MESSAGES 8
#define MAX_OUT_MESSAGES 8
+#define MAX_OUT_FRAGMENTS 2
#define GIP_VID_MICROSOFT 0x045e
#define GIP_VID_PDP 0x0e6f
@@ -194,6 +195,17 @@ struct gip_extended_status {
struct gip_status_event events[5];
};
+struct gip_out_fragment {
+ bool active;
+ bool acked;
+ uint8_t message;
+ uint8_t flags;
+ uint8_t seq;
+ uint16_t total_length;
+ uint32_t fragment_offset;
+ uint8_t *data;
+};
+
struct gip_attachment;
typedef int (*gip_command_handler)(struct gip_attachment *a, const struct gip_header *header,
const uint8_t *bytes, int num_bytes);
@@ -222,6 +234,8 @@ struct gip_attachment {
struct delayed_work in_fragment_timeout;
int in_fragment_retries;
+ struct gip_out_fragment out_fragments[MAX_OUT_FRAGMENTS];
+
uint16_t firmware_major_version;
uint16_t firmware_minor_version;
@@ -275,6 +289,9 @@ struct gip_interface {
struct usb_anchor out_anchor;
struct gip_urb out_queue[MAX_OUT_MESSAGES];
+
+ struct work_struct send_fragment;
+ unsigned int has_pending_out;
};
struct gip_device {
--
2.54.0
^ permalink raw reply related [flat|nested] 22+ messages in thread
* [PATCH v5 07/12] Input: xbox_gip - Add security implementation from xone
2026-09-02 1:02 [PATCH v5 00/12] Input: xbox_gip - Add new driver for Xbox GIP Vicki Pfau
` (5 preceding siblings ...)
2026-09-02 1:02 ` [PATCH v5 06/12] Input: xbox_gip - Allow sending fragmented and ACME messages Vicki Pfau
@ 2026-09-02 1:02 ` Vicki Pfau
2026-09-02 1:20 ` sashiko-bot
2026-09-02 1:02 ` [PATCH v5 08/12] Input: xbox_gip - Add arcade stick support Vicki Pfau
` (4 subsequent siblings)
11 siblings, 1 reply; 22+ messages in thread
From: Vicki Pfau @ 2026-09-02 1:02 UTC (permalink / raw)
To: Dmitry Torokhov, linux-input; +Cc: Vicki Pfau
This patch imports and adapts the security message implementation from the
out-of-tree xone driver, which is licensed under the GPL 2.0. This message
is necessary for most controllers that use wireless dongles. The
implementation is largely unchanged, with minor changes being made to adapt
it to the xbox_gip driver and renaming components as appropriate for the
official terminology from the released spec.
Signed-off-by: Vicki Pfau <vi@endrift.com>
---
drivers/input/joystick/gip/Kconfig | 2 +-
drivers/input/joystick/gip/Makefile | 2 +-
drivers/input/joystick/gip/gip-core.c | 48 +-
drivers/input/joystick/gip/gip-drivers.c | 8 +
drivers/input/joystick/gip/gip-security.c | 795 ++++++++++++++++++++++
drivers/input/joystick/gip/gip.h | 54 +-
6 files changed, 883 insertions(+), 26 deletions(-)
create mode 100644 drivers/input/joystick/gip/gip-security.c
diff --git a/drivers/input/joystick/gip/Kconfig b/drivers/input/joystick/gip/Kconfig
index 3422bf84cb89..b933583d325f 100644
--- a/drivers/input/joystick/gip/Kconfig
+++ b/drivers/input/joystick/gip/Kconfig
@@ -4,7 +4,7 @@
#
config JOYSTICK_XBOX_GIP
tristate "Xbox One/Series controller support"
- depends on USB && USB_ARCH_HAS_HCD && LEDS_CLASS_MULTICOLOR
+ depends on USB && USB_ARCH_HAS_HCD && LEDS_CLASS_MULTICOLOR && CRYPTO_ECDH
help
Say Y here if you want to use Xbox One and Series controllers with your
computer. Make sure to say Y to "Joystick support" (CONFIG_INPUT_JOYDEV)
diff --git a/drivers/input/joystick/gip/Makefile b/drivers/input/joystick/gip/Makefile
index d39f946db1ae..a5ad301a9063 100644
--- a/drivers/input/joystick/gip/Makefile
+++ b/drivers/input/joystick/gip/Makefile
@@ -1,4 +1,4 @@
# SPDX-License-Identifier: GPL-2.0-or-later
obj-$(CONFIG_JOYSTICK_XBOX_GIP) += xbox-gip.o
# Base driver
-xbox-gip-y := gip-core.o gip-drivers.o
+xbox-gip-y := gip-core.o gip-drivers.o gip-security.o
diff --git a/drivers/input/joystick/gip/gip-core.c b/drivers/input/joystick/gip/gip-core.c
index 544becf8badd..db4d2956e7d9 100644
--- a/drivers/input/joystick/gip/gip-core.c
+++ b/drivers/input/joystick/gip/gip-core.c
@@ -6,7 +6,6 @@
*
* TODO:
* - Audio device support
- * - Security packet handshake
* - Event logging
* - Raw character device
* - Wheel support
@@ -1760,17 +1759,6 @@ static int gip_send_init_sequence(struct gip_attachment *attachment)
if (rc)
return rc;
- if (gip_supports_system_message(attachment, GIP_CMD_SECURITY, false)
- && !(attachment->features & GIP_FEATURE_SECURITY_OPT_OUT)) {
- /* TODO: Implement Security command property */
- uint8_t buffer[] = { 0x1, 0x0 };
-
- rc = gip_send_system_message(attachment, GIP_CMD_SECURITY, 0,
- buffer, sizeof(buffer));
- if (rc)
- return rc;
- }
-
usb_make_path(attachment->device->udev, attachment->phys,
sizeof(attachment->phys));
len = strlen(attachment->phys);
@@ -1809,6 +1797,8 @@ static void gip_free_devices(struct gip_attachment *attachment)
struct input_dev *input;
struct hid_device *hdev;
+ gip_security_release(&attachment->security);
+
if (attachment->driver && attachment->driver->remove)
attachment->driver->remove(attachment);
@@ -1891,7 +1881,6 @@ static void gip_reset_attachment(struct gip_attachment *attachment)
}
gip_free_devices(attachment);
-
}
static int gip_handle_command_protocol_control(struct gip_attachment *attachment,
@@ -2070,6 +2059,24 @@ static int gip_handle_command_status_device(struct gip_attachment *attachment,
}
}
+ if (attachment->security.status == GIP_SECURITY_PENDING) {
+ if (attachment->quirks & GIP_QUIRK_SKIP_SECURITY)
+ /*
+ * Some BDA/PowerA Xbox One controllers have a security
+ * handshake implementation that is very sensitive to
+ * the precise message ordering. It's very hard to get
+ * this just right, so for now we just skip it. Most
+ * wired controllers don't need the security flow to
+ * work anyway.
+ */
+ rc = gip_security_skip_handshake(&attachment->security);
+ else
+ rc = gip_security_start_handshake(&attachment->security);
+
+ if (rc)
+ return rc;
+ }
+
rc = gip_init_input_device(attachment);
if (rc)
return rc;
@@ -2187,20 +2194,16 @@ static int gip_handle_command_metadata_respose(struct gip_attachment *attachment
GIP_CMD_GUIDE_COLOR, false))
attachment->features &= ~GIP_FEATURE_GUIDE_COLOR;
+ if (!gip_supports_system_message(attachment, GIP_CMD_SECURITY, false) ||
+ (attachment->features & GIP_FEATURE_SECURITY_OPT_OUT))
+ attachment->security.status = GIP_SECURITY_SKIPPED;
+
gip_dbg(attachment, "Attachment %i has features: %02x\n",
attachment->attachment_index, attachment->features);
return gip_send_init_sequence(attachment);
}
-static int gip_handle_command_security(struct gip_attachment *attachment,
- const struct gip_header *header, const uint8_t *bytes, int num_bytes)
-{
- /* TODO: Needed for controllers that connect via dongles */
- gip_warn(attachment, "Unimplemented Security message\n");
- return -EOPNOTSUPP;
-}
-
static int gip_handle_command_guide_button_status(struct gip_attachment *attachment,
const struct gip_header *header, const uint8_t *bytes, int num_bytes)
{
@@ -2474,8 +2477,7 @@ static int gip_handle_system_message(struct gip_attachment *attachment,
return gip_handle_command_metadata_respose(attachment, header,
bytes, num_bytes);
case GIP_CMD_SECURITY:
- return gip_handle_command_security(attachment, header, bytes,
- num_bytes);
+ return gip_security_handle_message(&attachment->security, bytes, num_bytes);
case GIP_CMD_GUIDE_BUTTON:
return gip_handle_command_guide_button_status(attachment,
header, bytes, num_bytes);
diff --git a/drivers/input/joystick/gip/gip-drivers.c b/drivers/input/joystick/gip/gip-drivers.c
index 2c2297b1fed8..74bc858e71cc 100644
--- a/drivers/input/joystick/gip/gip-drivers.c
+++ b/drivers/input/joystick/gip/gip-drivers.c
@@ -81,6 +81,14 @@ const struct gip_driver gip_driver_gamepad = {
0xa3, 0x12, 0x7a, 0xf1, 0x97, 0xb5),
.quirks = (const struct gip_quirks[]) {
+ /* PowerA Xbox One Classic Controller */
+ { GIP_VID_BDA, GIP_PID_BDA_XB1_CLASSIC, 0,
+ .quirks = GIP_QUIRK_SKIP_SECURITY },
+
+ /* PowerA Xbox One Fusion Pro */
+ { GIP_VID_BDA, GIP_PID_BDA_XB1_FUSION_PRO, 0,
+ .quirks = GIP_QUIRK_SKIP_SECURITY },
+
/* Xbox One Controller (model 1573) */
{ GIP_VID_MICROSOFT, GIP_PID_XBOX_ONE_1573, 0,
.override_name = "Xbox One Controller" },
diff --git a/drivers/input/joystick/gip/gip-security.c b/drivers/input/joystick/gip/gip-security.c
new file mode 100644
index 000000000000..58de547aa1dd
--- /dev/null
+++ b/drivers/input/joystick/gip/gip-security.c
@@ -0,0 +1,795 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+/*
+ * Gaming Input Protocol security message driver for Xbox One/Series controllers
+ *
+ * This file is based on files from the xone project
+ * - https://github.com/dlundqvist/xone/blob/master/auth/auth.c
+ * - https://github.com/dlundqvist/xone/blob/master/auth/crypto.c
+ *
+ * Copyright (C) 2023 Severin von Wnuck-Lipinski <severinvonw@outlook.de>
+ * Copyright (c) 2026 Valve Software
+ */
+
+#include <linux/scatterlist.h>
+#include <linux/version.h>
+#include <crypto/hash.h>
+#include <crypto/sha2.h>
+#include <crypto/akcipher.h>
+#include <crypto/kpp.h>
+#include <crypto/ecdh.h>
+
+#include "gip.h"
+
+/* trailer is required for v1 clients */
+#define GIP_SECURITY_TRAILER_LEN 8
+#define GIP_SECURITY_CERTIFICATE_MAX_LEN 1024
+#define GIP_SECURITY_ENCRYPTED_PMS_LEN 256
+#define GIP_SECURITY_TRANSCRIPT_LEN 32
+#define GIP_SECURITY_SESSION_KEY_LEN 16
+
+#define GIP_SECURITY_ECDH_SECRET_LEN 32
+
+enum gip_security_context {
+ GIP_SECURITY_CTX_HANDSHAKE = 0x00,
+ GIP_SECURITY_CTX_CONTROL = 0x01,
+};
+
+enum gip_security_command_handshake {
+ GIP_SECURITY_CMD_HOST_HELLO = 0x01,
+ GIP_SECURITY_CMD_CLIENT_HELLO = 0x02,
+ GIP_SECURITY_CMD_CLIENT_CERTIFICATE = 0x03,
+ GIP_SECURITY_CMD_HOST_SECRET = 0x05,
+ GIP_SECURITY_CMD_HOST_FINISH = 0x07,
+ GIP_SECURITY_CMD_CLIENT_FINISH = 0x08,
+
+ GIP_SECURITY2_CMD_HOST_HELLO = 0x21,
+ GIP_SECURITY2_CMD_CLIENT_HELLO = 0x22,
+ GIP_SECURITY2_CMD_CLIENT_CERTIFICATE = 0x23,
+ GIP_SECURITY2_CMD_CLIENT_PUBKEY = 0x24,
+ GIP_SECURITY2_CMD_HOST_PUBKEY = 0x25,
+ GIP_SECURITY2_CMD_HOST_FINISH = 0x26,
+ GIP_SECURITY2_CMD_CLIENT_FINISH = 0x27,
+};
+
+enum gip_security_command_control {
+ GIP_SECURITY_CTRL_COMPLETE = 0x00,
+ GIP_SECURITY_CTRL_RESET = 0x01,
+};
+
+enum gip_security_option {
+ GIP_SECURITY_OPT_ACKNOWLEDGE = BIT(0),
+ GIP_SECURITY_OPT_REQUEST = BIT(1),
+ GIP_SECURITY_OPT_FROM_HOST = BIT(6),
+ GIP_SECURITY_OPT_FROM_CLIENT = BIT(6) | BIT(7),
+};
+
+struct gip_security_header_handshake {
+ u8 context;
+ u8 options;
+ u8 error;
+ u8 command;
+ __be16 length;
+} __packed;
+
+struct gip_security_header_data {
+ u8 command;
+ u8 version;
+ __be16 length;
+} __packed;
+
+struct gip_security_header_full {
+ struct gip_security_header_handshake handshake;
+ struct gip_security_header_data data;
+} __packed;
+
+struct gip_security_header_control {
+ u8 context;
+ u8 control;
+} __packed;
+
+struct gip_security_request {
+ struct gip_security_header_handshake header;
+
+ u8 trailer[GIP_SECURITY_TRAILER_LEN];
+} __packed;
+
+struct gip_security_host_hello {
+ struct gip_security_header_full header;
+
+ u8 random[GIP_SECURITY_RANDOM_LEN];
+ u8 unknown1[4];
+ u8 unknown2[4];
+
+ u8 trailer[GIP_SECURITY_TRAILER_LEN];
+} __packed;
+
+struct gip_security_host_secret {
+ struct gip_security_header_full header;
+
+ u8 encrypted_pms[GIP_SECURITY_ENCRYPTED_PMS_LEN];
+
+ u8 trailer[GIP_SECURITY_TRAILER_LEN];
+} __packed;
+
+struct gip_security_host_finish {
+ struct gip_security_header_full header;
+
+ u8 transcript[GIP_SECURITY_TRANSCRIPT_LEN];
+
+ u8 trailer[GIP_SECURITY_TRAILER_LEN];
+} __packed;
+
+struct gip_security_client_hello {
+ u8 random[GIP_SECURITY_RANDOM_LEN];
+ u8 unknown[48];
+} __packed;
+
+struct gip_security_client_finish {
+ u8 transcript[GIP_SECURITY_TRANSCRIPT_LEN];
+ u8 unknown[32];
+} __packed;
+
+struct gip_security2_host_hello {
+ struct gip_security_header_full header;
+
+ u8 random[GIP_SECURITY_RANDOM_LEN];
+ u8 unknown[4];
+
+ u8 trailer[GIP_SECURITY_TRAILER_LEN];
+} __packed;
+
+struct gip_security2_host_pubkey {
+ struct gip_security_header_full header;
+
+ u8 pubkey[GIP_SECURITY2_PUBKEY_LEN];
+
+ u8 trailer[GIP_SECURITY_TRAILER_LEN];
+} __packed;
+
+struct gip_security2_host_finish {
+ struct gip_security_header_full header;
+
+ u8 transcript[GIP_SECURITY_TRANSCRIPT_LEN];
+
+ u8 trailer[GIP_SECURITY_TRAILER_LEN];
+} __packed;
+
+struct gip_security2_client_hello {
+ u8 random[GIP_SECURITY_RANDOM_LEN];
+ u8 unknown1[108];
+ u8 unknown2[32];
+} __packed;
+
+struct gip_security2_client_cert {
+ char header[4];
+ u8 unknown1[136];
+ char chip[32];
+ char revision[20];
+ u8 unknown2[576];
+} __packed;
+
+struct gip_security2_client_pubkey {
+ u8 pubkey[GIP_SECURITY2_PUBKEY_LEN];
+ u8 unknown[64];
+} __packed;
+
+struct gip_security2_client_finish {
+ u8 transcript[GIP_SECURITY_TRANSCRIPT_LEN];
+ u8 unknown[32];
+} __packed;
+
+static void gip_security_get_transcript(struct sha256_ctx *ctx, void *transcript)
+{
+ struct sha256_ctx state;
+
+ memcpy(&state, ctx, sizeof(state));
+ sha256_final(&state, transcript);
+ memzero_explicit(&state, sizeof(state));
+}
+
+static void gip_security_compute_prf(const char *label,
+ u8 *raw_key, int key_len, u8 *seed, int seed_len, u8 *out, int out_len)
+{
+ u8 hash[SHA256_DIGEST_SIZE], hash_out[SHA256_DIGEST_SIZE];
+ struct hmac_sha256_ctx ctx;
+ struct hmac_sha256_key key;
+
+ hmac_sha256_preparekey(&key, raw_key, key_len);
+
+ hmac_sha256_init(&ctx, &key);
+ hmac_sha256_update(&ctx, label, strlen(label));
+ hmac_sha256_update(&ctx, seed, seed_len);
+ hmac_sha256_final(&ctx, hash);
+
+ while (out_len > 0) {
+ hmac_sha256_init(&ctx, &key);
+ hmac_sha256_update(&ctx, hash, sizeof(hash));
+ hmac_sha256_update(&ctx, label, strlen(label));
+ hmac_sha256_update(&ctx, seed, seed_len);
+ hmac_sha256_final(&ctx, hash_out);
+
+ memcpy(out, hash_out, min_t(int, out_len, sizeof(hash)));
+ out += sizeof(hash);
+ out_len -= sizeof(hash);
+
+ hmac_sha256(&key, hash, sizeof(hash), hash);
+ }
+
+ memzero_explicit(&ctx, sizeof(ctx));
+ memzero_explicit(&key, sizeof(key));
+}
+
+static int gip_security_encrypt_rsa(u8 *key, int key_len, u8 *in, int in_len, u8 *out, int out_len)
+{
+ struct crypto_akcipher *tfm;
+ int err;
+
+ tfm = crypto_alloc_akcipher("pkcs1pad(rsa)", 0, 0);
+ if (IS_ERR(tfm))
+ return PTR_ERR(tfm);
+
+ err = crypto_akcipher_set_pub_key(tfm, key, key_len);
+ if (err)
+ goto err_free_tfm;
+
+ err = crypto_akcipher_sync_encrypt(tfm, in, in_len, out, out_len);
+
+err_free_tfm:
+ crypto_free_akcipher(tfm);
+
+ return err;
+}
+
+static int gip_security_ecdh_get_pubkey(struct crypto_kpp *tfm, u8 *out, int len)
+{
+ struct kpp_request *req;
+ struct scatterlist dest;
+ struct ecdh key = {};
+ DECLARE_CRYPTO_WAIT(wait);
+ void *privkey, *pubkey;
+ unsigned int privkey_len;
+ int err = 0;
+
+ privkey_len = crypto_ecdh_key_len(&key);
+ privkey = kzalloc(privkey_len, GFP_KERNEL);
+ if (!privkey)
+ return -ENOMEM;
+
+ pubkey = kzalloc(len, GFP_KERNEL);
+ if (!pubkey) {
+ err = -ENOMEM;
+ goto err_free_privkey;
+ }
+
+ /* generate private key */
+ err = crypto_ecdh_encode_key(privkey, privkey_len, &key);
+ if (err)
+ goto err_free_pubkey;
+
+ err = crypto_kpp_set_secret(tfm, privkey, privkey_len);
+ if (err)
+ goto err_free_pubkey;
+
+ req = kpp_request_alloc(tfm, GFP_KERNEL);
+ if (!req) {
+ err = -ENOMEM;
+ goto err_free_pubkey;
+ }
+
+ sg_init_one(&dest, pubkey, len);
+
+ kpp_request_set_input(req, NULL, 0);
+ kpp_request_set_output(req, &dest, len);
+ kpp_request_set_callback(req, CRYPTO_TFM_REQ_MAY_BACKLOG,
+ crypto_req_done, &wait);
+ err = crypto_wait_req(crypto_kpp_generate_public_key(req), &wait);
+ if (!err)
+ memcpy(out, pubkey, len);
+
+ kpp_request_free(req);
+
+err_free_pubkey:
+ kfree(pubkey);
+err_free_privkey:
+ memzero_explicit(privkey, privkey_len);
+ kfree(privkey);
+
+ return err;
+}
+
+static int gip_security_ecdh_get_secret(struct crypto_kpp *tfm, u8 *pubkey,
+ int pubkey_len, u8 *secret, int secret_len)
+{
+ struct kpp_request *req;
+ struct scatterlist src, dest;
+ DECLARE_CRYPTO_WAIT(wait);
+ int err;
+
+ req = kpp_request_alloc(tfm, GFP_KERNEL);
+ if (!req)
+ return -ENOMEM;
+
+ sg_init_one(&src, pubkey, pubkey_len);
+ sg_init_one(&dest, secret, secret_len);
+
+ kpp_request_set_input(req, &src, pubkey_len);
+ kpp_request_set_output(req, &dest, secret_len);
+ kpp_request_set_callback(req, CRYPTO_TFM_REQ_MAY_BACKLOG,
+ crypto_req_done, &wait);
+ err = crypto_wait_req(crypto_kpp_compute_shared_secret(req), &wait);
+
+ kpp_request_free(req);
+
+ return err;
+}
+
+static int gip_security_compute_ecdh(u8 *pubkey_in, u8 *pubkey_out, int pubkey_len, u8 *secret_hash)
+{
+ struct crypto_kpp *tfm_ecdh;
+ u8 secret[GIP_SECURITY_ECDH_SECRET_LEN] = {0};
+ int err;
+
+ tfm_ecdh = crypto_alloc_kpp("ecdh-nist-p256", 0, 0);
+ if (IS_ERR(tfm_ecdh)) {
+ err = PTR_ERR(tfm_ecdh);
+ goto err_free_secret;
+ }
+
+ err = gip_security_ecdh_get_pubkey(tfm_ecdh, pubkey_out, pubkey_len);
+ if (err)
+ goto err_free_ecdh;
+
+ err = gip_security_ecdh_get_secret(tfm_ecdh, pubkey_in, pubkey_len,
+ secret, sizeof(secret));
+ if (err)
+ goto err_free_ecdh;
+
+ sha256(secret, sizeof(secret), secret_hash);
+
+err_free_ecdh:
+ crypto_free_kpp(tfm_ecdh);
+err_free_secret:
+ memzero_explicit(&secret, sizeof(secret));
+
+ return err;
+}
+
+static int gip_security_send_message(struct gip_security *security,
+ enum gip_security_command_handshake cmd, void *message, u16 len)
+{
+ struct gip_attachment *attachment = container_of(security, struct gip_attachment, security);
+ struct gip_security_header_full *hdr = message;
+ u16 data_len = len - sizeof(hdr->handshake) - GIP_SECURITY_TRAILER_LEN;
+
+ hdr->handshake.context = GIP_SECURITY_CTX_HANDSHAKE;
+ hdr->handshake.options = GIP_SECURITY_OPT_ACKNOWLEDGE | GIP_SECURITY_OPT_FROM_HOST;
+ hdr->handshake.command = cmd;
+ hdr->handshake.length = cpu_to_be16(data_len);
+
+ hdr->data.command = cmd;
+ hdr->data.version = cmd >= GIP_SECURITY2_CMD_HOST_HELLO ? 0x02 : 0x01;
+ hdr->data.length = cpu_to_be16(data_len - sizeof(hdr->data));
+
+ security->last_sent_command = cmd;
+ sha256_update(&security->transcript, message + sizeof(hdr->handshake), data_len);
+
+ return gip_send_system_message(attachment, GIP_CMD_SECURITY, GIP_FLAG_ACME, message, len);
+}
+
+static int gip_security_send_request(struct gip_security *security,
+ enum gip_security_command_handshake cmd, u16 len)
+{
+ struct gip_attachment *attachment = container_of(security, struct gip_attachment, security);
+ struct gip_security_request req = {};
+ u16 data_len = len + sizeof(struct gip_security_header_data);
+
+ req.header.context = GIP_SECURITY_CTX_HANDSHAKE;
+ req.header.options = GIP_SECURITY_OPT_REQUEST | GIP_SECURITY_OPT_FROM_HOST;
+ req.header.command = cmd;
+ req.header.length = cpu_to_be16(data_len);
+
+ return gip_send_system_message(attachment, GIP_CMD_SECURITY,
+ GIP_FLAG_ACME, &req, sizeof(req));
+}
+
+static int gip_security2_send_hello(struct gip_security *security)
+{
+ struct gip_security2_host_hello message = {};
+
+ get_random_bytes(security->random_host, sizeof(security->random_host));
+ memcpy(message.random, security->random_host, sizeof(message.random));
+
+ return gip_security_send_message(security, GIP_SECURITY2_CMD_HOST_HELLO,
+ &message, sizeof(message));
+}
+
+static int gip_security2_handle_hello(struct gip_security *security, const void *data, u32 len)
+{
+ const struct gip_security2_client_hello *message = data;
+
+ if (len < sizeof(*message))
+ return -EINVAL;
+
+ memcpy(security->random_client, message->random, sizeof(security->random_client));
+
+ return gip_security_send_request(security,
+ GIP_SECURITY2_CMD_CLIENT_CERTIFICATE,
+ sizeof(struct gip_security2_client_cert));
+}
+
+static int gip_security2_handle_certificate(struct gip_security *security,
+ const void *data, u32 len)
+{
+ const struct gip_security2_client_cert *message = data;
+
+ if (len < sizeof(*message))
+ return -EINVAL;
+
+ gip_dbg(security,
+ "%s: header=%.*s, chip=%.*s, revision=%.*s\n", __func__,
+ (int)sizeof(message->header), message->header,
+ (int)sizeof(message->chip), message->chip,
+ (int)sizeof(message->revision), message->revision);
+
+ return gip_security_send_request(security,
+ GIP_SECURITY2_CMD_CLIENT_PUBKEY,
+ sizeof(struct gip_security2_client_pubkey));
+}
+
+static int gip_security2_handle_pubkey(struct gip_security *security,
+ const void *data, u32 len)
+{
+ const struct gip_security2_client_pubkey *message = data;
+
+ if (len < sizeof(*message))
+ return -EINVAL;
+
+ memcpy(security->pubkey_client2, message->pubkey, sizeof(message->pubkey));
+ schedule_work(&security->work_exchange_ecdh);
+
+ return 0;
+}
+
+static void gip_security2_exchange_ecdh(struct work_struct *work)
+{
+ struct gip_security *security = container_of(work, typeof(*security), work_exchange_ecdh);
+ struct gip_attachment *attachment = container_of(security, struct gip_attachment, security);
+ struct gip_security2_host_pubkey message = {};
+ u8 random[GIP_SECURITY_RANDOM_LEN * 2];
+ u8 secret[GIP_SECURITY2_SECRET_LEN];
+ int err;
+
+ guard(mutex)(&attachment->lock);
+ memcpy(random, security->random_host, sizeof(security->random_host));
+ memcpy(random + sizeof(security->random_host), security->random_client,
+ sizeof(security->random_client));
+
+ err = gip_security_compute_ecdh(security->pubkey_client2,
+ message.pubkey, sizeof(message.pubkey), secret);
+ if (err) {
+ gip_err(security, "%s: compute ECDH failed: %d\n", __func__, err);
+ return;
+ }
+
+ gip_security_compute_prf("Master Secret", secret, sizeof(secret),
+ random, sizeof(random), security->master_secret,
+ sizeof(security->master_secret));
+
+ err = gip_security_send_message(security, GIP_SECURITY2_CMD_HOST_PUBKEY,
+ &message, sizeof(message));
+ if (err)
+ gip_err(security, "%s: send message failed: %d\n", __func__, err);
+}
+
+static int gip_security_send_hello(struct gip_security *security)
+{
+ struct gip_security_host_hello message = {};
+
+ get_random_bytes(security->random_host, sizeof(security->random_host));
+ memcpy(message.random, security->random_host, sizeof(message.random));
+
+ return gip_security_send_message(security, GIP_SECURITY_CMD_HOST_HELLO,
+ &message, sizeof(message));
+}
+
+static int gip_security_send_finish(struct gip_security *security,
+ enum gip_security_command_handshake cmd)
+{
+ struct gip_security_host_finish message = {};
+ u8 transcript[GIP_SECURITY_TRANSCRIPT_LEN];
+
+ gip_security_get_transcript(&security->transcript, transcript);
+ gip_security_compute_prf("Host Finished", security->master_secret,
+ sizeof(security->master_secret), transcript, sizeof(transcript),
+ message.transcript, sizeof(message.transcript));
+
+ return gip_security_send_message(security, cmd, &message, sizeof(message));
+}
+
+static int gip_security_handle_acknowledge(struct gip_security *security)
+{
+ switch (security->last_sent_command) {
+ case GIP_SECURITY2_CMD_HOST_HELLO:
+ return gip_security_send_request(security,
+ GIP_SECURITY2_CMD_CLIENT_HELLO,
+ sizeof(struct gip_security2_client_hello));
+ case GIP_SECURITY2_CMD_HOST_PUBKEY:
+ return gip_security_send_finish(security, GIP_SECURITY2_CMD_HOST_FINISH);
+ case GIP_SECURITY2_CMD_HOST_FINISH:
+ return gip_security_send_request(security,
+ GIP_SECURITY2_CMD_CLIENT_FINISH,
+ sizeof(struct gip_security2_client_finish));
+ case GIP_SECURITY_CMD_HOST_HELLO:
+ return gip_security_send_request(security,
+ GIP_SECURITY_CMD_CLIENT_HELLO,
+ sizeof(struct gip_security_client_hello));
+ case GIP_SECURITY_CMD_HOST_SECRET:
+ return gip_security_send_finish(security, GIP_SECURITY_CMD_HOST_FINISH);
+ case GIP_SECURITY_CMD_HOST_FINISH:
+ return gip_security_send_request(security,
+ GIP_SECURITY_CMD_CLIENT_FINISH,
+ sizeof(struct gip_security_client_finish));
+ default:
+ return -EPROTO;
+ }
+}
+
+static int gip_security_handle_hello(struct gip_security *security, const void *data, u32 len)
+{
+ const struct gip_security_client_hello *message = data;
+
+ if (len < sizeof(*message))
+ return -EINVAL;
+
+ memcpy(security->random_client, message->random, sizeof(message->random));
+
+ return gip_security_send_request(security, GIP_SECURITY_CMD_CLIENT_CERTIFICATE,
+ GIP_SECURITY_CERTIFICATE_MAX_LEN);
+}
+
+static int gip_security_handle_certificate(struct gip_security *security, const void *data, u32 len)
+{
+ /* ASN.1 SEQUENCE (len = 0x04 + 0x010a) */
+ u8 asn1_seq[] = { 0x30, 0x82, 0x01, 0x0a };
+ int i;
+
+ if (len > GIP_SECURITY_CERTIFICATE_MAX_LEN)
+ return -EINVAL;
+
+ /*
+ * Poor way of extracting a pubkey from an X.509 certificate.
+ * The certificates issued by Microsoft do not comply with RFC 5280.
+ * They have an empty subject and no subjectAltName.
+ * This is explicitly forbidden by section 4.2.1.6 of the RFC.
+ * The kernel's ASN.1 parser will fail when using x509_cert_parse.
+ */
+ for (i = 0; i + sizeof(asn1_seq) <= len; i++) {
+ if (memcmp(data + i, asn1_seq, sizeof(asn1_seq)))
+ continue;
+
+ if (i + GIP_SECURITY_PUBKEY_LEN > len)
+ return -EINVAL;
+
+ memcpy(security->pubkey_client, data + i, GIP_SECURITY_PUBKEY_LEN);
+ schedule_work(&security->work_exchange_rsa);
+
+ return 0;
+ }
+
+ return -EPROTO;
+}
+
+static int gip_security_handle_finish(struct gip_security *security, const void *data, u32 len)
+{
+ const struct gip_security_client_finish *message = data;
+ u8 transcript[GIP_SECURITY_TRANSCRIPT_LEN];
+ u8 finished[GIP_SECURITY_TRANSCRIPT_LEN];
+
+ if (len < sizeof(*message))
+ return -EINVAL;
+
+ gip_security_get_transcript(&security->transcript, transcript);
+ gip_security_compute_prf("Device Finished",
+ security->master_secret, sizeof(security->master_secret),
+ transcript, sizeof(transcript), finished, sizeof(finished));
+
+ if (memcmp(message->transcript, finished, sizeof(finished))) {
+ gip_err(security, "%s: transcript mismatch\n", __func__);
+ return -EPROTO;
+ }
+
+ schedule_work(&security->work_complete);
+
+ return 0;
+}
+
+static void gip_security_exchange_rsa(struct work_struct *work)
+{
+ struct gip_security *security = container_of(work, typeof(*security), work_exchange_rsa);
+ struct gip_attachment *attachment = container_of(security, struct gip_attachment, security);
+ struct gip_security_host_secret message = {};
+ u8 random[GIP_SECURITY_RANDOM_LEN * 2];
+ int err;
+
+ guard(mutex)(&attachment->lock);
+ memcpy(random, security->random_host, sizeof(security->random_host));
+ memcpy(random + sizeof(security->random_host), security->random_client,
+ sizeof(security->random_client));
+
+ /* get random premaster secret */
+ get_random_bytes(security->pms, sizeof(security->pms));
+
+ err = gip_security_encrypt_rsa(security->pubkey_client,
+ sizeof(security->pubkey_client), security->pms,
+ sizeof(security->pms), message.encrypted_pms,
+ sizeof(message.encrypted_pms));
+ if (err) {
+ gip_err(security, "%s: encrypt RSA failed: %d\n", __func__, err);
+ return;
+ }
+
+ gip_security_compute_prf("Master Secret", security->pms,
+ sizeof(security->pms), random, sizeof(random),
+ security->master_secret, sizeof(security->master_secret));
+
+ err = gip_security_send_message(security, GIP_SECURITY_CMD_HOST_SECRET,
+ &message, sizeof(message));
+ if (err)
+ gip_err(security, "%s: send message failed: %d\n", __func__, err);
+}
+
+static void gip_security_complete_handshake(struct work_struct *work)
+{
+ struct gip_security *security = container_of(work, typeof(*security), work_complete);
+ struct gip_attachment *attachment = container_of(security, struct gip_attachment, security);
+ struct gip_security_header_control hdr = {
+ .context = GIP_SECURITY_CTX_CONTROL,
+ .control = GIP_SECURITY_CTRL_COMPLETE,
+ };
+ u8 random[GIP_SECURITY_RANDOM_LEN * 2];
+ u8 key[GIP_SECURITY_SESSION_KEY_LEN];
+ int err;
+
+ guard(mutex)(&attachment->lock);
+ memcpy(random, security->random_host, sizeof(security->random_host));
+ memcpy(random + sizeof(security->random_host), security->random_client,
+ sizeof(security->random_client));
+
+ gip_security_compute_prf(
+ "EXPORTER DAWN data channel session key for controller",
+ security->master_secret, sizeof(security->master_secret),
+ random, sizeof(random), key, sizeof(key));
+
+ gip_dbg(security, "%s: key=%*phD\n", __func__, (int)sizeof(key), key);
+
+ err = gip_send_system_message(attachment, GIP_CMD_SECURITY,
+ 0, &hdr, sizeof(hdr));
+ if (err) {
+ gip_err(security, "%s: send complete failed: %d\n", __func__, err);
+ return;
+ }
+
+ security->status = GIP_SECURITY_DONE;
+}
+
+static int gip_security_dispatch_message(struct gip_security *security,
+ enum gip_security_command_handshake cmd, const void *data, u32 len)
+{
+ switch (cmd) {
+ case GIP_SECURITY2_CMD_CLIENT_HELLO:
+ return gip_security2_handle_hello(security, data, len);
+ case GIP_SECURITY2_CMD_CLIENT_CERTIFICATE:
+ return gip_security2_handle_certificate(security, data, len);
+ case GIP_SECURITY2_CMD_CLIENT_PUBKEY:
+ return gip_security2_handle_pubkey(security, data, len);
+ case GIP_SECURITY2_CMD_CLIENT_FINISH:
+ return gip_security_handle_finish(security, data, len);
+ case GIP_SECURITY_CMD_CLIENT_HELLO:
+ return gip_security_handle_hello(security, data, len);
+ case GIP_SECURITY_CMD_CLIENT_CERTIFICATE:
+ return gip_security_handle_certificate(security, data, len);
+ case GIP_SECURITY_CMD_CLIENT_FINISH:
+ return gip_security_handle_finish(security, data, len);
+ default:
+ return -EPROTO;
+ }
+}
+
+int gip_security_handle_message(struct gip_security *security, const void *bytes, int num_bytes)
+{
+ const struct gip_security_header_handshake *handshake = bytes;
+ const struct gip_security_header_full *hdr;
+ int err;
+
+ if (security->status != GIP_SECURITY_SENT) {
+ gip_err(security, "%s: security message received when none expected: 0x%02x\n",
+ __func__, handshake->command);
+ return -EPROTO;
+ }
+
+ if (num_bytes < sizeof(*handshake))
+ return -EINVAL;
+
+ if (handshake->error)
+ return -EPROTO;
+
+ if (handshake->options & GIP_SECURITY_OPT_ACKNOWLEDGE) {
+ if (handshake->command == 0x01)
+ return gip_security_handle_acknowledge(security);
+
+ gip_err(security, "%s: handshake failed: 0x%02x\n",
+ __func__, handshake->command);
+ return -EPROTO;
+ }
+
+ if (num_bytes < sizeof(*hdr))
+ return -EINVAL;
+
+ hdr = bytes;
+ /* client uses v2 */
+ if (handshake->command != hdr->data.command) {
+ /* reset transcript hash and restart handshake */
+ gip_dbg(security, "%s: protocol upgrade\n", __func__);
+ sha256_init(&security->transcript);
+ return gip_security2_send_hello(security);
+ }
+
+ err = gip_security_dispatch_message(security, hdr->data.command,
+ bytes + sizeof(*hdr), num_bytes - sizeof(*hdr));
+ if (err)
+ return err;
+
+ sha256_update(&security->transcript, bytes + sizeof(hdr->handshake),
+ num_bytes - sizeof(hdr->handshake));
+
+ return 0;
+}
+
+void gip_security_release(struct gip_security *security)
+{
+ if (security->status < GIP_SECURITY_SENT)
+ return;
+
+ cancel_work_sync(&security->work_exchange_rsa);
+ cancel_work_sync(&security->work_exchange_ecdh);
+ cancel_work_sync(&security->work_complete);
+
+ memzero_explicit(&security->transcript, sizeof(security->transcript));
+
+ security->status = GIP_SECURITY_PENDING;
+}
+
+int gip_security_start_handshake(struct gip_security *security)
+{
+ int err;
+
+ sha256_init(&security->transcript);
+
+ INIT_WORK(&security->work_exchange_rsa, gip_security_exchange_rsa);
+ INIT_WORK(&security->work_exchange_ecdh, gip_security2_exchange_ecdh);
+ INIT_WORK(&security->work_complete, gip_security_complete_handshake);
+
+ err = gip_security_send_hello(security);
+ if (err < 0)
+ return err;
+
+ security->status = GIP_SECURITY_SENT;
+ return 0;
+}
+
+int gip_security_skip_handshake(struct gip_security *security)
+{
+ struct gip_attachment *attachment = container_of(security, struct gip_attachment, security);
+ struct gip_security_header_control hdr = {
+ .context = GIP_SECURITY_CTX_CONTROL,
+ .control = GIP_SECURITY_CTRL_COMPLETE,
+ };
+ int err;
+
+ err = gip_send_system_message(attachment, GIP_CMD_SECURITY, 0, &hdr, sizeof(hdr));
+ if (err < 0)
+ return err;
+
+ security->status = GIP_SECURITY_SKIPPED;
+ return 0;
+}
diff --git a/drivers/input/joystick/gip/gip.h b/drivers/input/joystick/gip/gip.h
index c7751f96e8ac..0abd44ada89f 100644
--- a/drivers/input/joystick/gip/gip.h
+++ b/drivers/input/joystick/gip/gip.h
@@ -12,6 +12,7 @@
#ifndef _GIP_H
#define _GIP_H
+#include <crypto/sha2.h>
#include <linux/hid.h>
#include <linux/led-class-multicolor.h>
#include <linux/power_supply.h>
@@ -29,6 +30,7 @@
#define GIP_VID_MICROSOFT 0x045e
#define GIP_VID_PDP 0x0e6f
+#define GIP_VID_BDA 0x24c6
#define GIP_PID_XBOX_ONE_1573 0x02d1
#define GIP_PID_XBOX_ONE_1697 0x02dd
@@ -40,9 +42,13 @@
#define GIP_PID_PDP_ROCK_CANDY 0x0246
+#define GIP_PID_BDA_XB1_CLASSIC 0x581a
+#define GIP_PID_BDA_XB1_FUSION_PRO 0x591a
+
#define GIP_QUIRK_NO_HELLO BIT(0)
#define GIP_QUIRK_NO_IMPULSE_VIBRATION BIT(1)
#define GIP_QUIRK_SWAP_LB_RB BIT(2)
+#define GIP_QUIRK_SKIP_SECURITY BIT(3)
/*
* Driver-specific quirks should start from 31 and go downwards to avoid
* conflicts with newly-added core quirks
@@ -90,13 +96,21 @@
#define GIP_LL_STATIC_CONFIGURATION 0x21
#define GIP_LL_BUTTON_INFO_REPORT 0x22
+#define GIP_SECURITY_RANDOM_LEN 32
+#define GIP_SECURITY_PUBKEY_LEN 270
+#define GIP_SECURITY_SECRET_LEN 48
+
+#define GIP_SECURITY2_PUBKEY_LEN 64
+#define GIP_SECURITY2_SECRET_LEN 32
+
#define MAX_GIP_CMD 0x80
#define to_gip_device(p) \
_Generic((p), \
struct gip_attachment * : gip_attachment_dev, \
struct gip_interface * : gip_interface_dev, \
- struct gip_device * : gip_device_dev)(p)
+ struct gip_device * : gip_device_dev, \
+ struct gip_security * : gip_security_dev)(p)
#define gip_dbg(dev, ...) dev_dbg(to_gip_device(dev), __VA_ARGS__)
#define gip_info(dev, ...) dev_info(to_gip_device(dev), __VA_ARGS__)
@@ -120,6 +134,13 @@ enum gip_metadata_status {
GIP_METADATA_PENDING = 3,
};
+enum gip_security_status {
+ GIP_SECURITY_PENDING = 0,
+ GIP_SECURITY_SKIPPED,
+ GIP_SECURITY_SENT,
+ GIP_SECURITY_DONE,
+};
+
enum gip_elite_button_format {
GIP_BTN_FMT_UNKNOWN,
GIP_BTN_FMT_XBE1,
@@ -206,6 +227,26 @@ struct gip_out_fragment {
uint8_t *data;
};
+struct gip_security {
+ struct sha256_ctx transcript;
+
+ struct work_struct work_exchange_rsa;
+ struct work_struct work_exchange_ecdh;
+ struct work_struct work_complete;
+
+ enum gip_security_status status;
+ uint8_t last_sent_command;
+
+ uint8_t random_host[GIP_SECURITY_RANDOM_LEN];
+ uint8_t random_client[GIP_SECURITY_RANDOM_LEN];
+
+ uint8_t pubkey_client[GIP_SECURITY_PUBKEY_LEN];
+ uint8_t pubkey_client2[GIP_SECURITY2_PUBKEY_LEN];
+
+ uint8_t pms[GIP_SECURITY_SECRET_LEN];
+ uint8_t master_secret[GIP_SECURITY_SECRET_LEN];
+};
+
struct gip_attachment;
typedef int (*gip_command_handler)(struct gip_attachment *a, const struct gip_header *header,
const uint8_t *bytes, int num_bytes);
@@ -243,6 +284,7 @@ struct gip_attachment {
struct delayed_work metadata_next;
int metadata_retries;
struct gip_metadata metadata;
+ struct gip_security security;
uint8_t seq_system;
uint8_t seq_security;
@@ -356,6 +398,11 @@ static inline struct device *gip_device_dev(struct gip_device *device)
return &device->udev->dev;
}
+static inline struct device *gip_security_dev(struct gip_security *security)
+{
+ return gip_attachment_dev(container_of(security, struct gip_attachment, security));
+}
+
bool gip_supports_vendor_message(struct gip_attachment *attachment, uint8_t command, bool upstream);
int gip_send_system_message(struct gip_attachment *attachment,
@@ -363,6 +410,11 @@ int gip_send_system_message(struct gip_attachment *attachment,
int gip_send_vendor_message(struct gip_attachment *attachment,
uint8_t message_type, uint8_t flags, const void *bytes, int num_bytes);
+int gip_security_handle_message(struct gip_security *security, const void *bytes, int num_bytes);
+int gip_security_start_handshake(struct gip_security *security);
+int gip_security_skip_handshake(struct gip_security *security);
+void gip_security_release(struct gip_security *security);
+
extern const struct gip_driver gip_driver_navigation;
extern const struct gip_driver gip_driver_gamepad;
extern const struct gip_driver gip_driver_arcade_stick;
--
2.54.0
^ permalink raw reply related [flat|nested] 22+ messages in thread
* [PATCH v5 08/12] Input: xbox_gip - Add arcade stick support
2026-09-02 1:02 [PATCH v5 00/12] Input: xbox_gip - Add new driver for Xbox GIP Vicki Pfau
` (6 preceding siblings ...)
2026-09-02 1:02 ` [PATCH v5 07/12] Input: xbox_gip - Add security implementation from xone Vicki Pfau
@ 2026-09-02 1:02 ` Vicki Pfau
2026-09-02 1:24 ` sashiko-bot
2026-09-02 1:02 ` [PATCH v5 09/12] Input: xbox_gip - Add support for PDP guitar controllers Vicki Pfau
` (3 subsequent siblings)
11 siblings, 1 reply; 22+ messages in thread
From: Vicki Pfau @ 2026-09-02 1:02 UTC (permalink / raw)
To: Dmitry Torokhov, linux-input; +Cc: Vicki Pfau
This adds support for the arcade stick device type. Currently I'm only
aware of one Xbox controller that uses this device type, the Razer Atrox,
so testing coverage is limited.
Signed-off-by: Vicki Pfau <vi@endrift.com>
---
drivers/input/joystick/gip/Makefile | 2 +
drivers/input/joystick/gip/gip-arcade-stick.c | 173 ++++++++++++++++++
drivers/input/joystick/gip/gip-core.c | 6 +-
drivers/input/joystick/gip/gip.h | 4 +-
4 files changed, 181 insertions(+), 4 deletions(-)
create mode 100644 drivers/input/joystick/gip/gip-arcade-stick.c
diff --git a/drivers/input/joystick/gip/Makefile b/drivers/input/joystick/gip/Makefile
index a5ad301a9063..9ed59caec4d9 100644
--- a/drivers/input/joystick/gip/Makefile
+++ b/drivers/input/joystick/gip/Makefile
@@ -2,3 +2,5 @@
obj-$(CONFIG_JOYSTICK_XBOX_GIP) += xbox-gip.o
# Base driver
xbox-gip-y := gip-core.o gip-drivers.o gip-security.o
+# Additional device support
+xbox-gip-y += gip-arcade-stick.o
diff --git a/drivers/input/joystick/gip/gip-arcade-stick.c b/drivers/input/joystick/gip/gip-arcade-stick.c
new file mode 100644
index 000000000000..11ededfab855
--- /dev/null
+++ b/drivers/input/joystick/gip/gip-arcade-stick.c
@@ -0,0 +1,173 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+/*
+ * Drivers for GIP arcade sticks
+ *
+ * Copyright (c) 2025 Valve Software
+ *
+ * This driver is based on the Microsoft GIP spec at:
+ * https://aka.ms/gipdocs
+ * https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-gipusb/e7c90904-5e21-426e-b9ad-d82adeee0dbc
+ */
+
+#include <linux/unaligned.h>
+#include "gip.h"
+
+enum gip_arcade_stick_vibration_motor_support {
+ GIP_VIBRATION_NO_MOTOR = 0,
+ GIP_VIBRATION_SINGLE_MOTOR = 1,
+ GIP_VIBRATION_DUAL_MOTOR = 2,
+};
+
+struct gip_arcade_stick_info {
+ uint8_t vibration_motor;
+ uint16_t actuator_bias;
+};
+
+struct gip_arcade_stick_static_coniguration {
+ uint8_t button_count;
+ uint8_t report_version;
+ uint8_t vibration_motor_support;
+ uint8_t actuator_bits;
+};
+
+static int gip_arcade_stick_probe(struct gip_attachment *attachment)
+{
+ struct gip_arcade_stick_info *info = kzalloc(sizeof(*info), GFP_KERNEL);
+
+ if (!info)
+ return -ENOMEM;
+
+ attachment->quirks |= GIP_QUIRK_SWAP_LB_RB;
+ attachment->driver_data = info;
+
+ return 0;
+}
+
+static void gip_arcade_stick_remove(struct gip_attachment *attachment)
+{
+ kfree(attachment->driver_data);
+ attachment->driver_data = NULL;
+}
+
+static int gip_init_arcade_stick(struct gip_attachment *attachment)
+{
+ if (gip_supports_vendor_message(attachment, GIP_CMD_INITIAL_REPORTS_REQUEST, false)) {
+ uint8_t request = GIP_LL_STATIC_CONFIGURATION;
+ int rc = gip_send_vendor_message(attachment, GIP_CMD_INITIAL_REPORTS_REQUEST, 0,
+ &request, sizeof(request));
+
+ if (rc < 0)
+ return rc;
+
+ return GIP_INIT_NO_INPUT;
+ }
+
+ return 0;
+}
+
+static int gip_setup_arcade_stick_input(struct gip_attachment *attachment, struct input_dev *input)
+{
+ struct gip_arcade_stick_info *info = attachment->driver_data;
+ int rc;
+
+ if (!info)
+ return -ENODEV;
+
+ rc = gip_driver_navigation.setup_input(attachment, input);
+ if (rc < 0)
+ return rc;
+
+ if (info->actuator_bias > 0) {
+ input_set_abs_params(input, ABS_X,
+ -info->actuator_bias, info->actuator_bias - 1, 0, 0);
+ input_set_abs_params(input, ABS_Y,
+ -info->actuator_bias, info->actuator_bias - 1, 0, 0);
+ }
+
+ if (attachment->extra_buttons >= 1)
+ input_set_capability(input, EV_KEY, BTN_TR2);
+
+ if (attachment->extra_buttons >= 2)
+ input_set_capability(input, EV_KEY, BTN_TL2);
+ return 0;
+}
+
+static int gip_handle_arcade_stick_report(struct gip_attachment *attachment,
+ struct input_dev *input, const uint8_t *bytes, int num_bytes)
+{
+ struct gip_arcade_stick_info *info = attachment->driver_data;
+ int rc;
+
+ if (!info)
+ return -ENODEV;
+
+ rc = gip_driver_navigation.handle_input_report(attachment, input, bytes, num_bytes);
+ if (rc < 0)
+ return rc;
+
+ if (num_bytes < 6) {
+ gip_dbg(attachment, "Discarding too-short input report\n");
+ return -EINVAL;
+ }
+
+ if (info->actuator_bias > 0) {
+ input_report_abs(input, ABS_X, get_unaligned_le16(&bytes[2]) - info->actuator_bias);
+ input_report_abs(input, ABS_Y, get_unaligned_le16(&bytes[4]) - info->actuator_bias);
+ }
+
+ if (num_bytes >= 19) {
+ /* Extra button 6 */
+ input_report_key(input, BTN_TR2, bytes[18] & BIT(6));
+ /* Extra button 7 */
+ input_report_key(input, BTN_TL2, bytes[18] & BIT(7));
+ }
+
+ return 0;
+}
+
+static int gip_handle_arcade_stick_ll_static_configuration(struct gip_attachment *attachment,
+ const struct gip_header *header, const uint8_t *bytes, int num_bytes)
+{
+ const struct gip_arcade_stick_static_coniguration *config =
+ (const struct gip_arcade_stick_static_coniguration *)bytes;
+ struct gip_arcade_stick_info *info = attachment->driver_data;
+
+ if (!info)
+ return -ENODEV;
+
+ if (num_bytes < 4)
+ return -EINVAL;
+
+ attachment->extra_buttons = clamp(config->button_count, 6, 38) - 6;
+ if (config->actuator_bits)
+ info->actuator_bias = BIT(min(config->actuator_bits, 16) - 1);
+ else
+ info->actuator_bias = 0;
+
+ if (config->vibration_motor_support == GIP_VIBRATION_NO_MOTOR)
+ attachment->features &= ~GIP_FEATURE_MOTOR_CONTROL;
+
+ gip_dbg(attachment, "Arcade stick with report version %u, %u buttons, %u actuator bits\n",
+ config->report_version, config->button_count, config->actuator_bits);
+
+ return gip_setup_input_device(attachment);
+}
+
+const struct gip_driver gip_driver_arcade_stick = {
+ .types = (const char* const[]) {
+ "Windows.Xbox.Input.ArcadeStick",
+ "Microsoft.Xbox.Input.ArcadeStick",
+ NULL
+ },
+ .guid = GUID_INIT(0x332054cc, 0xa34b, 0x41d5, 0xa3, 0x4a,
+ 0xa6, 0xa6, 0x71, 0x1e, 0xc4, 0xb3),
+
+ .probe = gip_arcade_stick_probe,
+ .remove = gip_arcade_stick_remove,
+ .init = gip_init_arcade_stick,
+ .setup_input = gip_setup_arcade_stick_input,
+ .handle_input_report = gip_handle_arcade_stick_report,
+ .vendor_handlers = {
+ [GIP_LL_STATIC_CONFIGURATION] = gip_handle_arcade_stick_ll_static_configuration,
+ },
+};
diff --git a/drivers/input/joystick/gip/gip-core.c b/drivers/input/joystick/gip/gip-core.c
index db4d2956e7d9..e8075a99306d 100644
--- a/drivers/input/joystick/gip/gip-core.c
+++ b/drivers/input/joystick/gip/gip-core.c
@@ -10,7 +10,8 @@
* - Raw character device
* - Wheel support
* - Flight stick support
- * - Arcade stick support
+ * - More arcade stick testing
+ * - Arcade stick extra buttons
* - Split into driver-per-attachment GIP-as-a-bus approach drivers
*
* This driver is based on the Microsoft GIP spec at:
@@ -328,6 +329,7 @@ struct gip_direct_motor {
static const struct gip_driver *base_drivers[] = {
&gip_driver_navigation,
&gip_driver_gamepad,
+ &gip_driver_arcade_stick,
NULL /* Sentinel */
};
@@ -1566,7 +1568,7 @@ static int gip_handle_command_raw_report(struct gip_attachment *attachment,
return 0;
}
-static int gip_setup_input_device(struct gip_attachment *attachment)
+int gip_setup_input_device(struct gip_attachment *attachment)
{
struct input_dev *input;
int rc;
diff --git a/drivers/input/joystick/gip/gip.h b/drivers/input/joystick/gip/gip.h
index 0abd44ada89f..f44a312ae0c9 100644
--- a/drivers/input/joystick/gip/gip.h
+++ b/drivers/input/joystick/gip/gip.h
@@ -403,6 +403,8 @@ static inline struct device *gip_security_dev(struct gip_security *security)
return gip_attachment_dev(container_of(security, struct gip_attachment, security));
}
+int gip_setup_input_device(struct gip_attachment *attachment);
+
bool gip_supports_vendor_message(struct gip_attachment *attachment, uint8_t command, bool upstream);
int gip_send_system_message(struct gip_attachment *attachment,
@@ -418,6 +420,4 @@ void gip_security_release(struct gip_security *security);
extern const struct gip_driver gip_driver_navigation;
extern const struct gip_driver gip_driver_gamepad;
extern const struct gip_driver gip_driver_arcade_stick;
-extern const struct gip_driver gip_driver_wheel;
-extern const struct gip_driver gip_driver_flight_stick;
#endif
--
2.54.0
^ permalink raw reply related [flat|nested] 22+ messages in thread
* [PATCH v5 09/12] Input: xbox_gip - Add support for PDP guitar controllers
2026-09-02 1:02 [PATCH v5 00/12] Input: xbox_gip - Add new driver for Xbox GIP Vicki Pfau
` (7 preceding siblings ...)
2026-09-02 1:02 ` [PATCH v5 08/12] Input: xbox_gip - Add arcade stick support Vicki Pfau
@ 2026-09-02 1:02 ` Vicki Pfau
2026-09-02 1:02 ` [PATCH v5 10/12] Input: Add ABS_CLUTCH, HANDBRAKE, and SHIFTER Vicki Pfau
` (2 subsequent siblings)
11 siblings, 0 replies; 22+ messages in thread
From: Vicki Pfau @ 2026-09-02 1:02 UTC (permalink / raw)
To: Dmitry Torokhov, linux-input; +Cc: Vicki Pfau
This patch adds support for the PDP guitar controllers, namely the Fender
Jaguar and RiffMaster models. These use mostly the same protocol, but the
RiffMaster appears t use a slightly newer variant.
Signed-off-by: Vicki Pfau <vi@endrift.com>
---
drivers/input/joystick/gip/Makefile | 1 +
drivers/input/joystick/gip/gip-core.c | 1 +
drivers/input/joystick/gip/gip-pdp-jaguar.c | 129 ++++++++++++++++++++
drivers/input/joystick/gip/gip.h | 2 +
4 files changed, 133 insertions(+)
create mode 100644 drivers/input/joystick/gip/gip-pdp-jaguar.c
diff --git a/drivers/input/joystick/gip/Makefile b/drivers/input/joystick/gip/Makefile
index 9ed59caec4d9..62c016d6c11e 100644
--- a/drivers/input/joystick/gip/Makefile
+++ b/drivers/input/joystick/gip/Makefile
@@ -4,3 +4,4 @@ obj-$(CONFIG_JOYSTICK_XBOX_GIP) += xbox-gip.o
xbox-gip-y := gip-core.o gip-drivers.o gip-security.o
# Additional device support
xbox-gip-y += gip-arcade-stick.o
+xbox-gip-y += gip-pdp-jaguar.o
diff --git a/drivers/input/joystick/gip/gip-core.c b/drivers/input/joystick/gip/gip-core.c
index e8075a99306d..166fc420ffb2 100644
--- a/drivers/input/joystick/gip/gip-core.c
+++ b/drivers/input/joystick/gip/gip-core.c
@@ -330,6 +330,7 @@ static const struct gip_driver *base_drivers[] = {
&gip_driver_navigation,
&gip_driver_gamepad,
&gip_driver_arcade_stick,
+ &gip_driver_pdp_jaguar,
NULL /* Sentinel */
};
diff --git a/drivers/input/joystick/gip/gip-pdp-jaguar.c b/drivers/input/joystick/gip/gip-pdp-jaguar.c
new file mode 100644
index 000000000000..ec0e9d811d12
--- /dev/null
+++ b/drivers/input/joystick/gip/gip-pdp-jaguar.c
@@ -0,0 +1,129 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+/*
+ * Drivers for GIP PDP Jaguar-style guitars
+ *
+ * Copyright (c) 2026 Valve Software
+ */
+
+#include <linux/unaligned.h>
+#include "gip.h"
+
+#define GIP_QUIRK_PDP_HAS_RIGHT_STICK BIT(31)
+
+static int gip_setup_pdp_jaguar_input(struct gip_attachment *attachment, struct input_dev *input)
+{
+ /*
+ * Despite having the navigation controller GUID, we don't want to use
+ * those mappings. Instead, we use the xone mappings for compatibility
+ * reasons.
+ */
+
+ /* Lower fret */
+ input_set_capability(input, EV_KEY, BTN_TRIGGER_HAPPY1);
+ input_set_capability(input, EV_KEY, BTN_TRIGGER_HAPPY2);
+ input_set_capability(input, EV_KEY, BTN_TRIGGER_HAPPY3);
+ input_set_capability(input, EV_KEY, BTN_TRIGGER_HAPPY4);
+ input_set_capability(input, EV_KEY, BTN_TRIGGER_HAPPY5);
+ /* Upper fret */
+ input_set_capability(input, EV_KEY, BTN_TRIGGER_HAPPY6);
+ input_set_capability(input, EV_KEY, BTN_TRIGGER_HAPPY7);
+ input_set_capability(input, EV_KEY, BTN_TRIGGER_HAPPY8);
+ input_set_capability(input, EV_KEY, BTN_TRIGGER_HAPPY9);
+ input_set_capability(input, EV_KEY, BTN_TRIGGER_HAPPY10);
+
+ input_set_capability(input, EV_KEY, BTN_START);
+ input_set_capability(input, EV_KEY, BTN_SELECT);
+
+ /* Whammy bar */
+ input_set_abs_params(input, ABS_Y, 0, 255, 0, 0);
+ /* Tilt */
+ input_set_abs_params(input, ABS_Z, 0, 255, 0, 0);
+
+ input_set_abs_params(input, ABS_HAT0X, -1, 1, 0, 0);
+ input_set_abs_params(input, ABS_HAT0Y, -1, 1, 0, 0);
+
+ if (attachment->quirks & GIP_QUIRK_PDP_HAS_RIGHT_STICK) {
+ input_set_capability(input, EV_KEY, BTN_THUMBR);
+ input_set_abs_params(input, ABS_RX, -32768, 32767, 16, 128);
+ input_set_abs_params(input, ABS_RY, -32768, 32767, 16, 128);
+ }
+
+ return 0;
+}
+
+static int gip_handle_pdp_jaguar_report(struct gip_attachment *attachment,
+ struct input_dev *input, const uint8_t *bytes, int num_bytes)
+{
+ bool lower;
+
+ if (num_bytes < 4) {
+ gip_dbg(attachment, "Discarding too-short input report\n");
+ return -EINVAL;
+ }
+
+ input_report_key(input, BTN_START, bytes[0] & BIT(2));
+ input_report_key(input, BTN_SELECT, bytes[0] & BIT(3));
+
+ if (num_bytes >= 7 && (bytes[5] || bytes[6])) {
+ /* Newer report version on the RiffMaster */
+ input_report_key(input, BTN_TRIGGER_HAPPY1, bytes[5] & BIT(0));
+ input_report_key(input, BTN_TRIGGER_HAPPY2, bytes[5] & BIT(1));
+ input_report_key(input, BTN_TRIGGER_HAPPY3, bytes[5] & BIT(2));
+ input_report_key(input, BTN_TRIGGER_HAPPY4, bytes[5] & BIT(3));
+ input_report_key(input, BTN_TRIGGER_HAPPY5, bytes[5] & BIT(4));
+
+ input_report_key(input, BTN_TRIGGER_HAPPY6, bytes[6] & BIT(0));
+ input_report_key(input, BTN_TRIGGER_HAPPY7, bytes[6] & BIT(1));
+ input_report_key(input, BTN_TRIGGER_HAPPY8, bytes[6] & BIT(2));
+ input_report_key(input, BTN_TRIGGER_HAPPY9, bytes[6] & BIT(3));
+ input_report_key(input, BTN_TRIGGER_HAPPY10, bytes[6] & BIT(4));
+ } else {
+ lower = bytes[1] & BIT(6);
+ input_report_key(input, BTN_TRIGGER_HAPPY1, !lower && (bytes[0] & BIT(4)));
+ input_report_key(input, BTN_TRIGGER_HAPPY2, !lower && (bytes[0] & BIT(5)));
+ input_report_key(input, BTN_TRIGGER_HAPPY3, !lower && (bytes[0] & BIT(7)));
+ input_report_key(input, BTN_TRIGGER_HAPPY4, !lower && (bytes[0] & BIT(6)));
+ input_report_key(input, BTN_TRIGGER_HAPPY5, !lower && (bytes[1] & BIT(4)));
+
+ input_report_key(input, BTN_TRIGGER_HAPPY6, lower && (bytes[0] & BIT(4)));
+ input_report_key(input, BTN_TRIGGER_HAPPY7, lower && (bytes[0] & BIT(5)));
+ input_report_key(input, BTN_TRIGGER_HAPPY8, lower && (bytes[0] & BIT(7)));
+ input_report_key(input, BTN_TRIGGER_HAPPY9, lower && (bytes[0] & BIT(6)));
+ input_report_key(input, BTN_TRIGGER_HAPPY10, lower && (bytes[1] & BIT(4)));
+ }
+
+ input_report_abs(input, ABS_Y, bytes[2]);
+ input_report_abs(input, ABS_Z, bytes[3]);
+
+ input_report_abs(input, ABS_HAT0X,
+ !!(bytes[1] & BIT(3)) - !!(bytes[1] & BIT(2)));
+ input_report_abs(input, ABS_HAT0Y,
+ !!(bytes[1] & BIT(1)) - !!(bytes[1] & BIT(0)));
+
+ if ((attachment->quirks & GIP_QUIRK_PDP_HAS_RIGHT_STICK) && num_bytes >= 14) {
+ input_report_key(input, BTN_THUMBR, bytes[1] & BIT(6));
+ input_report_abs(input, ABS_RX, (int16_t)get_unaligned_le16(&bytes[10]));
+ input_report_abs(input, ABS_RY, ~(int16_t)get_unaligned_le16(&bytes[12]));
+ }
+
+ return 0;
+}
+
+const struct gip_driver gip_driver_pdp_jaguar = {
+ .types = (const char *const[]) { "PDP.Xbox.Guitar.Jaguar", NULL },
+ .guid = GUID_INIT(0x1a266af6, 0x3a46, 0x45e3, 0xb9, 0xb6,
+ 0x0f, 0x2c, 0x0b, 0x2c, 0x1e, 0xbe),
+
+ .quirks = (const struct gip_quirks[]) {
+ /* PDP RiffMaster */
+ { GIP_VID_PDP, GIP_PID_PDP_RIFFMASTER, 0,
+ .quirks = GIP_QUIRK_PDP_HAS_RIGHT_STICK, },
+
+ {0},
+ },
+ .probe = NULL,
+ .remove = NULL,
+ .init = NULL,
+ .setup_input = gip_setup_pdp_jaguar_input,
+ .handle_input_report = gip_handle_pdp_jaguar_report,
+};
diff --git a/drivers/input/joystick/gip/gip.h b/drivers/input/joystick/gip/gip.h
index f44a312ae0c9..7d4628dea684 100644
--- a/drivers/input/joystick/gip/gip.h
+++ b/drivers/input/joystick/gip/gip.h
@@ -41,6 +41,7 @@
#define GIP_PID_XBOX_WIRELESS 0x0b12
#define GIP_PID_PDP_ROCK_CANDY 0x0246
+#define GIP_PID_PDP_RIFFMASTER 0x0248
#define GIP_PID_BDA_XB1_CLASSIC 0x581a
#define GIP_PID_BDA_XB1_FUSION_PRO 0x591a
@@ -420,4 +421,5 @@ void gip_security_release(struct gip_security *security);
extern const struct gip_driver gip_driver_navigation;
extern const struct gip_driver gip_driver_gamepad;
extern const struct gip_driver gip_driver_arcade_stick;
+extern const struct gip_driver gip_driver_pdp_jaguar;
#endif
--
2.54.0
^ permalink raw reply related [flat|nested] 22+ messages in thread
* [PATCH v5 10/12] Input: Add ABS_CLUTCH, HANDBRAKE, and SHIFTER
2026-09-02 1:02 [PATCH v5 00/12] Input: xbox_gip - Add new driver for Xbox GIP Vicki Pfau
` (8 preceding siblings ...)
2026-09-02 1:02 ` [PATCH v5 09/12] Input: xbox_gip - Add support for PDP guitar controllers Vicki Pfau
@ 2026-09-02 1:02 ` Vicki Pfau
2026-09-02 1:23 ` sashiko-bot
2026-09-02 1:02 ` [PATCH v5 11/12] HID: Map more automobile simulation inputs Vicki Pfau
2026-09-02 1:02 ` [PATCH v5 12/12] Input: xbox_gip - Add wheel support Vicki Pfau
11 siblings, 1 reply; 22+ messages in thread
From: Vicki Pfau @ 2026-09-02 1:02 UTC (permalink / raw)
To: Dmitry Torokhov, linux-input; +Cc: Vicki Pfau
Add new absolute axes for racing game controllers
Signed-off-by: Vicki Pfau <vi@endrift.com>
---
drivers/hid/hid-debug.c | 16 +++++++++-------
include/uapi/linux/input-event-codes.h | 3 +++
2 files changed, 12 insertions(+), 7 deletions(-)
diff --git a/drivers/hid/hid-debug.c b/drivers/hid/hid-debug.c
index f44e6e708404..7a1b56311e9b 100644
--- a/drivers/hid/hid-debug.c
+++ b/drivers/hid/hid-debug.c
@@ -3511,13 +3511,15 @@ static const char *absolutes[ABS_CNT] = {
[ABS_RY] = "Ry", [ABS_RZ] = "Rz",
[ABS_THROTTLE] = "Throttle", [ABS_RUDDER] = "Rudder",
[ABS_WHEEL] = "Wheel", [ABS_GAS] = "Gas",
- [ABS_BRAKE] = "Brake", [ABS_HAT0X] = "Hat0X",
- [ABS_HAT0Y] = "Hat0Y", [ABS_HAT1X] = "Hat1X",
- [ABS_HAT1Y] = "Hat1Y", [ABS_HAT2X] = "Hat2X",
- [ABS_HAT2Y] = "Hat2Y", [ABS_HAT3X] = "Hat3X",
- [ABS_HAT3Y] = "Hat 3Y", [ABS_PRESSURE] = "Pressure",
- [ABS_DISTANCE] = "Distance", [ABS_TILT_X] = "XTilt",
- [ABS_TILT_Y] = "YTilt", [ABS_TOOL_WIDTH] = "ToolWidth",
+ [ABS_BRAKE] = "Brake", [ABS_CLUTCH] = "Clutch",
+ [ABS_HANDBRAKE] = "Handbrake", [ABS_SHIFTER] = "Shifter",
+ [ABS_HAT0X] = "Hat0X", [ABS_HAT0Y] = "Hat0Y",
+ [ABS_HAT1X] = "Hat1X", [ABS_HAT1Y] = "Hat1Y",
+ [ABS_HAT2X] = "Hat2X", [ABS_HAT2Y] = "Hat2Y",
+ [ABS_HAT3X] = "Hat3X", [ABS_HAT3Y] = "Hat3Y",
+ [ABS_PRESSURE] = "Pressure", [ABS_DISTANCE] = "Distance",
+ [ABS_TILT_X] = "XTilt", [ABS_TILT_Y] = "YTilt",
+ [ABS_TOOL_WIDTH] = "ToolWidth",
[ABS_VOLUME] = "Volume", [ABS_PROFILE] = "Profile",
[ABS_SND_PROFILE] = "SoundProfile",
[ABS_MISC] = "Misc",
diff --git a/include/uapi/linux/input-event-codes.h b/include/uapi/linux/input-event-codes.h
index 3528168f7c6d..5c881ed44177 100644
--- a/include/uapi/linux/input-event-codes.h
+++ b/include/uapi/linux/input-event-codes.h
@@ -879,6 +879,9 @@
#define ABS_WHEEL 0x08
#define ABS_GAS 0x09
#define ABS_BRAKE 0x0a
+#define ABS_CLUTCH 0x0b
+#define ABS_HANDBRAKE 0x0c
+#define ABS_SHIFTER 0x0d
#define ABS_HAT0X 0x10
#define ABS_HAT0Y 0x11
#define ABS_HAT1X 0x12
--
2.54.0
^ permalink raw reply related [flat|nested] 22+ messages in thread
* [PATCH v5 11/12] HID: Map more automobile simulation inputs
2026-09-02 1:02 [PATCH v5 00/12] Input: xbox_gip - Add new driver for Xbox GIP Vicki Pfau
` (9 preceding siblings ...)
2026-09-02 1:02 ` [PATCH v5 10/12] Input: Add ABS_CLUTCH, HANDBRAKE, and SHIFTER Vicki Pfau
@ 2026-09-02 1:02 ` Vicki Pfau
2026-09-02 1:02 ` [PATCH v5 12/12] Input: xbox_gip - Add wheel support Vicki Pfau
11 siblings, 0 replies; 22+ messages in thread
From: Vicki Pfau @ 2026-09-02 1:02 UTC (permalink / raw)
To: Dmitry Torokhov, linux-input; +Cc: Vicki Pfau, Jiri Kosina
The HID usage tables section 5.3 specify clutch and shifter values that had
previously been ignored. As the ABS_CLUTCH and ABS_SHIFTER bits now exist,
we should use them appropriately.
Signed-off-by: Vicki Pfau <vi@endrift.com>
Acked-by: Jiri Kosina <jkosina@suse.com>
---
drivers/hid/hid-input.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c
index 3487600cadb4..6ade969412c6 100644
--- a/drivers/hid/hid-input.c
+++ b/drivers/hid/hid-input.c
@@ -828,6 +828,8 @@ static void hidinput_configure_usage(struct hid_input *hidinput, struct hid_fiel
case 0xbb: map_abs(ABS_THROTTLE); break;
case 0xc4: map_abs(ABS_GAS); break;
case 0xc5: map_abs(ABS_BRAKE); break;
+ case 0xc6: map_abs(ABS_CLUTCH); break;
+ case 0xc7: map_abs(ABS_SHIFTER); break;
case 0xc8: map_abs(ABS_WHEEL); break;
default: goto ignore;
}
--
2.54.0
^ permalink raw reply related [flat|nested] 22+ messages in thread
* [PATCH v5 12/12] Input: xbox_gip - Add wheel support
2026-09-02 1:02 [PATCH v5 00/12] Input: xbox_gip - Add new driver for Xbox GIP Vicki Pfau
` (10 preceding siblings ...)
2026-09-02 1:02 ` [PATCH v5 11/12] HID: Map more automobile simulation inputs Vicki Pfau
@ 2026-09-02 1:02 ` Vicki Pfau
2026-09-02 1:33 ` sashiko-bot
11 siblings, 1 reply; 22+ messages in thread
From: Vicki Pfau @ 2026-09-02 1:02 UTC (permalink / raw)
To: Dmitry Torokhov, linux-input; +Cc: Vicki Pfau
This adds preliminary support for racing wheel support in xbox_gip,
exposing them mapped to the newly added axes.
Signed-off-by: Vicki Pfau <vi@endrift.com>
---
drivers/input/joystick/gip/Makefile | 1 +
drivers/input/joystick/gip/gip-core.c | 4 +-
drivers/input/joystick/gip/gip-drivers.c | 10 +
drivers/input/joystick/gip/gip-wheel.c | 349 +++++++++++++++++++++++
drivers/input/joystick/gip/gip.h | 6 +
5 files changed, 369 insertions(+), 1 deletion(-)
create mode 100644 drivers/input/joystick/gip/gip-wheel.c
diff --git a/drivers/input/joystick/gip/Makefile b/drivers/input/joystick/gip/Makefile
index 62c016d6c11e..7d4209eb32c3 100644
--- a/drivers/input/joystick/gip/Makefile
+++ b/drivers/input/joystick/gip/Makefile
@@ -5,3 +5,4 @@ xbox-gip-y := gip-core.o gip-drivers.o gip-security.o
# Additional device support
xbox-gip-y += gip-arcade-stick.o
xbox-gip-y += gip-pdp-jaguar.o
+xbox-gip-y += gip-wheel.o
diff --git a/drivers/input/joystick/gip/gip-core.c b/drivers/input/joystick/gip/gip-core.c
index 166fc420ffb2..d285fc777be2 100644
--- a/drivers/input/joystick/gip/gip-core.c
+++ b/drivers/input/joystick/gip/gip-core.c
@@ -8,7 +8,7 @@
* - Audio device support
* - Event logging
* - Raw character device
- * - Wheel support
+ * - Wheel force feedback
* - Flight stick support
* - More arcade stick testing
* - Arcade stick extra buttons
@@ -331,6 +331,8 @@ static const struct gip_driver *base_drivers[] = {
&gip_driver_gamepad,
&gip_driver_arcade_stick,
&gip_driver_pdp_jaguar,
+ &gip_driver_trueforce_wheel,
+ &gip_driver_wheel,
NULL /* Sentinel */
};
diff --git a/drivers/input/joystick/gip/gip-drivers.c b/drivers/input/joystick/gip/gip-drivers.c
index 74bc858e71cc..7ba11b19c8ee 100644
--- a/drivers/input/joystick/gip/gip-drivers.c
+++ b/drivers/input/joystick/gip/gip-drivers.c
@@ -142,6 +142,11 @@ static int gip_setup_navigation_input(struct gip_attachment *attachment, struct
input_set_capability(input, EV_KEY, BTN_TR);
input_set_capability(input, EV_KEY, BTN_TL);
+ if (attachment->quirks & GIP_QUIRK_FORCE_GAMEPAD_SB) {
+ input_set_capability(input, EV_KEY, BTN_THUMBR);
+ input_set_capability(input, EV_KEY, BTN_THUMBL);
+ }
+
attachment->dpad_as_buttons = dpad_as_buttons;
if (attachment->dpad_as_buttons) {
input_set_capability(input, EV_KEY, BTN_DPAD_UP);
@@ -193,6 +198,11 @@ static int gip_handle_navigation_report(struct gip_attachment *attachment,
input_report_key(input, BTN_TR, bytes[1] & BIT(5));
}
+ if (attachment->quirks & GIP_QUIRK_FORCE_GAMEPAD_SB) {
+ input_report_key(input, BTN_THUMBL, bytes[1] & BIT(6));
+ input_report_key(input, BTN_THUMBR, bytes[1] & BIT(7));
+ }
+
return 0;
}
diff --git a/drivers/input/joystick/gip/gip-wheel.c b/drivers/input/joystick/gip/gip-wheel.c
new file mode 100644
index 000000000000..e6810f10c3eb
--- /dev/null
+++ b/drivers/input/joystick/gip/gip-wheel.c
@@ -0,0 +1,349 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+/*
+ * Drivers for GIP racing wheel devices
+ *
+ * Copyright (c) 2025 Valve Software
+ *
+ * This driver is based on the Microsoft GIP spec at:
+ * https://aka.ms/gipdocs
+ * https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-gipusb/e7c90904-5e21-426e-b9ad-d82adeee0dbc
+ */
+
+#include <linux/unaligned.h>
+#include "gip.h"
+
+#define GIP_QUIRK_WHEEL_FORCE_HANDBRAKE BIT(31)
+
+/* Wheel vendor messages */
+#define GIP_CMD_SET_APPLICATION_MEMORY 0x0b
+#define GIP_CMD_SET_EQUATIONS_STATES 0x0c
+#define GIP_CMD_SET_EQUATION 0x0d
+
+/* Wheel-specific flags */
+#define GIP_WHEEL_HAS_POWER BIT(3)
+#define GIP_WHEEL_HANDBRAKE_CONN BIT(4)
+#define GIP_WHEEL_CLUTCH_CONN BIT(5)
+#define GIP_WHEEL_BRAKE_CONN BIT(6)
+#define GIP_WHEEL_THROTTLE_CONN BIT(7)
+
+#define GIP_HSHIFTER_NONE 0
+#define GIP_HSHIFTER_2POS 1 /* 2 position, no neutral */
+#define GIP_HSHIFTER_2POS_N 2 /* 2 position, neutral */
+#define GIP_HSHIFTER_RTL_1TL 3 /* Reverse top left, first top left */
+#define GIP_HSHIFTER_RTL_1BL 4 /* Reverse top left, first bottom left */
+#define GIP_HSHIFTER_RBL 5 /* Reverse bottom left */
+#define GIP_HSHIFTER_RTR 6 /* Reverse top right */
+#define GIP_HSHIFTER_RBR 7 /* Reverse bottom right */
+
+struct gip_wheel_info {
+ uint8_t shifter_type: 3;
+ uint8_t max_gear: 5;
+ uint16_t angle_setting;
+ uint16_t max_angle;
+ uint16_t max_throttle;
+ uint16_t max_brake;
+ uint16_t max_clutch;
+ uint8_t max_handbrake;
+ int8_t value_retries;
+};
+
+struct gip_initial_reports_request {
+ uint8_t type;
+ uint8_t data[2];
+};
+
+static int gip_wheel_probe(struct gip_attachment *attachment)
+{
+ struct gip_wheel_info *info = kzalloc(sizeof(*info), GFP_KERNEL);
+
+ if (!info)
+ return -ENOMEM;
+ attachment->driver_data = info;
+
+ return 0;
+}
+
+static void gip_wheel_remove(struct gip_attachment *attachment)
+{
+ kfree(attachment->driver_data);
+ attachment->driver_data = NULL;
+}
+
+static int gip_wheel_init(struct gip_attachment *attachment)
+{
+ struct gip_initial_reports_request request = { 0 };
+ int rc = gip_send_vendor_message(attachment,
+ GIP_CMD_INITIAL_REPORTS_REQUEST, 0, &request,
+ sizeof(request));
+
+ if (rc < 0)
+ return rc;
+
+ return GIP_INIT_NO_INPUT;
+}
+
+static int gip_setup_wheel_input(struct gip_attachment *attachment, struct input_dev *input)
+{
+ int rc = gip_driver_navigation.setup_input(attachment, input);
+ struct gip_wheel_info *info = attachment->driver_data;
+
+ if (rc < 0)
+ return rc;
+
+ if (!info)
+ return -ENODEV;
+
+ input_set_abs_params(input, ABS_WHEEL, -info->max_angle - 1, info->max_angle, 0, 0);
+ input_abs_set_res(input, ABS_WHEEL, info->angle_setting);
+ if (info->max_throttle)
+ input_set_abs_params(input, ABS_GAS, 0, info->max_throttle, 0, 0);
+
+ if (info->max_brake)
+ input_set_abs_params(input, ABS_BRAKE, 0, info->max_brake, 0, 0);
+
+ if (info->max_clutch)
+ input_set_abs_params(input, ABS_CLUTCH, 0, info->max_clutch, 0, 0);
+
+ if (info->max_handbrake)
+ input_set_abs_params(input, ABS_HANDBRAKE, 0, info->max_handbrake, 0, 0);
+
+ if (info->shifter_type)
+ input_set_abs_params(input, ABS_SHIFTER, -1, info->max_gear, 0, 0);
+
+ return 0;
+}
+
+static int gip_handle_wheel_ll_input_report(struct gip_attachment *attachment,
+ const struct gip_header *header, const uint8_t *bytes, int num_bytes)
+{
+ int rc = 0;
+ struct gip_wheel_info *info = attachment->driver_data;
+
+ if (num_bytes < 17)
+ return -EINVAL;
+
+ if (!info)
+ return -ENODEV;
+
+ info->max_gear = bytes[11] & 0x1F;
+ info->shifter_type = bytes[11] >> 5;
+ info->angle_setting = get_unaligned_le16(&bytes[13]);
+
+ gip_dbg(attachment,
+ "Racing wheel with %u max gear, %u degree rotation\n",
+ info->max_gear, info->angle_setting);
+
+ if (info->angle_setting && info->max_angle) {
+ if (info->value_retries-- > 0)
+ return 0;
+
+ rc = gip_setup_input_device(attachment);
+ } else {
+ return 0;
+ }
+
+ if (rc < 0)
+ return rc;
+
+ /* Now that we're done configuring, fall back to default handler */
+ attachment->vendor_handlers[GIP_LL_INPUT_REPORT] = NULL;
+
+ return 0;
+}
+
+static int gip_handle_wheel_report(struct gip_attachment *attachment,
+ struct input_dev *input, const uint8_t *bytes, int num_bytes)
+{
+ uint8_t connections;
+ struct gip_wheel_info *info = attachment->driver_data;
+ int rc = gip_driver_navigation.handle_input_report(attachment, input, bytes, num_bytes);
+
+ if (rc < 0)
+ return rc;
+
+ if (!info)
+ return -ENODEV;
+
+ if (num_bytes < 17)
+ return -EINVAL;
+
+ input_report_abs(input, ABS_WHEEL, get_unaligned_le16(&bytes[2]) - info->max_angle - 1);
+
+ connections = bytes[16];
+
+ if (attachment->quirks & GIP_QUIRK_WHEEL_FORCE_HANDBRAKE)
+ connections |= GIP_WHEEL_HANDBRAKE_CONN;
+
+ if (connections & GIP_WHEEL_THROTTLE_CONN)
+ input_report_abs(input, ABS_GAS, get_unaligned_le16(&bytes[4]));
+ else
+ input_report_abs(input, ABS_GAS, 0);
+
+ if (connections & GIP_WHEEL_BRAKE_CONN)
+ input_report_abs(input, ABS_BRAKE, get_unaligned_le16(&bytes[6]));
+ else
+ input_report_abs(input, ABS_BRAKE, 0);
+
+ if (connections & GIP_WHEEL_CLUTCH_CONN)
+ input_report_abs(input, ABS_CLUTCH, get_unaligned_le16(&bytes[8]));
+ else
+ input_report_abs(input, ABS_CLUTCH, 0);
+
+ if (connections & GIP_WHEEL_HANDBRAKE_CONN)
+ input_report_abs(input, ABS_HANDBRAKE, bytes[10]);
+ else
+ input_report_abs(input, ABS_HANDBRAKE, 0);
+
+ if (info->shifter_type)
+ input_report_abs(input, ABS_SHIFTER, (int8_t)bytes[12]);
+
+ return 0;
+}
+
+static int gip_handle_wheel_ll_static_configuration(struct gip_attachment *attachment,
+ const struct gip_header *header, const uint8_t *bytes, int num_bytes)
+{
+ struct gip_wheel_info *info = attachment->driver_data;
+
+ if (!info)
+ return -ENODEV;
+
+ if (num_bytes < 11)
+ return -EINVAL;
+
+ info->max_angle = BIT(min(bytes[0], 16)) / 2 - 1;
+ info->max_throttle = BIT(min(bytes[1], 16)) - 1;
+ info->max_brake = BIT(min(bytes[2], 16)) - 1;
+ info->max_clutch = BIT(min(bytes[3], 16)) - 1;
+ info->max_handbrake = BIT(min(bytes[4], 8)) - 1;
+
+ gip_dbg(attachment,
+ "Racing wheel with precision: %u bits angle, %u bits throttle, %u bits brake,\n",
+ bytes[0], bytes[1], bytes[2]);
+ gip_dbg(attachment,
+ "%u bits clutch, %u bits handbrake\n", bytes[3], bytes[4]);
+
+ if (info->angle_setting && info->max_angle && info->value_retries <= 0)
+ return gip_setup_input_device(attachment);
+
+ return 0;
+}
+
+const struct gip_driver gip_driver_wheel = {
+ .types = (const char* const[]) {
+ "Windows.Xbox.Input.Wheel",
+ "Microsoft.Xbox.Input.Wheel",
+ NULL
+ },
+ .guid = GUID_INIT(0x646979cf, 0x6b71, 0x4e96, 0x8d, 0xf9,
+ 0x59, 0xe3, 0x98, 0xd7, 0x42, 0x0c),
+
+ .quirks = (const struct gip_quirks[]) {
+ /* Thrustmaster T128X GIP Racing Wheel */
+ { GIP_VID_THRUSTMASTER, GIP_PID_THRUSTMASTER_T128X, 0,
+ .quirks = GIP_QUIRK_FORCE_GAMEPAD_SB | GIP_QUIRK_WHEEL_FORCE_HANDBRAKE, },
+
+ {0},
+ },
+
+ .probe = gip_wheel_probe,
+ .remove = gip_wheel_remove,
+ .init = gip_wheel_init,
+ .setup_input = gip_setup_wheel_input,
+ .handle_input_report = gip_handle_wheel_report,
+ .vendor_handlers = {
+ [GIP_LL_INPUT_REPORT] = gip_handle_wheel_ll_input_report,
+ [GIP_LL_STATIC_CONFIGURATION] = gip_handle_wheel_ll_static_configuration,
+ },
+};
+
+struct gip_trueforce_wheel_state {
+ struct gip_wheel_info wheel_info; /* This field must be first for type punning */
+ int8_t dial;
+};
+
+static int gip_trueforce_wheel_probe(struct gip_attachment *attachment)
+{
+ struct gip_trueforce_wheel_state *state = kzalloc(sizeof(*state), GFP_KERNEL);
+
+ if (!state)
+ return -ENOMEM;
+ attachment->driver_data = state;
+ /* The shifter won't show in the first few input reports */
+ state->wheel_info.value_retries = 3;
+
+ return 0;
+}
+
+static void gip_trueforce_wheel_remove(struct gip_attachment *attachment)
+{
+ kfree(attachment->driver_data);
+ attachment->driver_data = NULL;
+}
+
+static int gip_setup_trueforce_wheel_input(struct gip_attachment *attachment,
+ struct input_dev *input)
+{
+ int rc = gip_driver_wheel.setup_input(attachment, input);
+
+ if (rc < 0)
+ return rc;
+
+ input_set_capability(input, EV_KEY, BTN_THUMBL);
+ input_set_capability(input, EV_KEY, BTN_THUMBR);
+ input_set_capability(input, EV_KEY, KEY_KPPLUS);
+ input_set_capability(input, EV_KEY, KEY_KPMINUS);
+ input_set_capability(input, EV_KEY, KEY_KPENTER);
+ input_set_capability(input, EV_REL, REL_DIAL);
+
+ return 0;
+}
+
+static int gip_handle_trueforce_wheel_report(struct gip_attachment *attachment,
+ struct input_dev *input, const uint8_t *bytes, int num_bytes)
+{
+ int rc = gip_driver_wheel.handle_input_report(attachment, input, bytes, num_bytes);
+ struct gip_trueforce_wheel_state *state = attachment->driver_data;
+ int dial;
+
+ if (rc < 0)
+ return rc;
+
+ if (num_bytes < 18)
+ return -EINVAL;
+
+ dial = bytes[17] >> 5;
+
+ input_report_key(input, BTN_THUMBL, bytes[17] & BIT(0));
+ input_report_key(input, BTN_THUMBR, bytes[17] & BIT(1));
+ input_report_key(input, KEY_KPPLUS, bytes[17] & BIT(2));
+ input_report_key(input, KEY_KPMINUS, bytes[17] & BIT(3));
+ input_report_key(input, KEY_KPENTER, bytes[17] & BIT(4));
+ if (dial == 0 && state->dial == 7)
+ input_report_rel(input, REL_DIAL, -1);
+ else if (dial == 7 && state->dial == 0)
+ input_report_rel(input, REL_DIAL, 1);
+ else
+ input_report_rel(input, REL_DIAL,
+ state->dial - dial);
+ state->dial = dial;
+
+ return 0;
+}
+
+const struct gip_driver gip_driver_trueforce_wheel = {
+ .types = (const char *const[]) { "Logi.Xbox.Input.TrueForceWheel", NULL },
+ .guid = GUID_INIT(0x6ca319e5, 0x0bc0, 0x41be, 0x83, 0x19,
+ 0x6b, 0xb7, 0x10, 0x81, 0xec, 0x55),
+
+ .probe = gip_trueforce_wheel_probe,
+ .remove = gip_trueforce_wheel_remove,
+ .init = gip_wheel_init,
+ .setup_input = gip_setup_trueforce_wheel_input,
+ .handle_input_report = gip_handle_trueforce_wheel_report,
+ .vendor_handlers = {
+ [GIP_LL_INPUT_REPORT] = gip_handle_wheel_ll_input_report,
+ [GIP_LL_STATIC_CONFIGURATION] = gip_handle_wheel_ll_static_configuration,
+ },
+};
+
diff --git a/drivers/input/joystick/gip/gip.h b/drivers/input/joystick/gip/gip.h
index 7d4628dea684..204a66629164 100644
--- a/drivers/input/joystick/gip/gip.h
+++ b/drivers/input/joystick/gip/gip.h
@@ -28,10 +28,13 @@
#define MAX_OUT_MESSAGES 8
#define MAX_OUT_FRAGMENTS 2
+#define GIP_VID_THRUSTMASTER 0x044f
#define GIP_VID_MICROSOFT 0x045e
#define GIP_VID_PDP 0x0e6f
#define GIP_VID_BDA 0x24c6
+#define GIP_PID_THRUSTMASTER_T128X 0xb69c
+
#define GIP_PID_XBOX_ONE_1573 0x02d1
#define GIP_PID_XBOX_ONE_1697 0x02dd
#define GIP_PID_XBOX_ELITE 0x02e3
@@ -50,6 +53,7 @@
#define GIP_QUIRK_NO_IMPULSE_VIBRATION BIT(1)
#define GIP_QUIRK_SWAP_LB_RB BIT(2)
#define GIP_QUIRK_SKIP_SECURITY BIT(3)
+#define GIP_QUIRK_FORCE_GAMEPAD_SB BIT(4)
/*
* Driver-specific quirks should start from 31 and go downwards to avoid
* conflicts with newly-added core quirks
@@ -422,4 +426,6 @@ extern const struct gip_driver gip_driver_navigation;
extern const struct gip_driver gip_driver_gamepad;
extern const struct gip_driver gip_driver_arcade_stick;
extern const struct gip_driver gip_driver_pdp_jaguar;
+extern const struct gip_driver gip_driver_wheel;
+extern const struct gip_driver gip_driver_trueforce_wheel;
#endif
--
2.54.0
^ permalink raw reply related [flat|nested] 22+ messages in thread
* Re: [PATCH v5 06/12] Input: xbox_gip - Allow sending fragmented and ACME messages
2026-09-02 1:02 ` [PATCH v5 06/12] Input: xbox_gip - Allow sending fragmented and ACME messages Vicki Pfau
@ 2026-09-02 1:19 ` sashiko-bot
0 siblings, 0 replies; 22+ messages in thread
From: sashiko-bot @ 2026-09-02 1:19 UTC (permalink / raw)
To: Vicki Pfau; +Cc: linux-input, dmitry.torokhov
Thank you for your contribution! Sashiko AI review found 4 potential issue(s) to consider:
- [Critical] Unconditional dereference of NULL fragment pointer on error path for non-fragmented messages.
- [High] Missing synchronization when allocating and initializing `out_fragments` slots.
- [High] Unsynchronized read-modify-write of the `intf->has_pending_out` bitmask.
- [High] Dropped ACKs permanently leak `out_fragments` slots.
--
commit 317888ee9cccdc0f09f7f1c8d616d2664382777a
Author: Vicki Pfau <vi@endrift.com>
Input: xbox_gip - Allow sending fragmented and ACME messages
This commit introduces support for sending fragmented messages that exceed the
MTU length and messages requiring ACKs using the ACME flag in the GIP protocol.
It adds queuing, processing, and acknowledgment handling logic to the xbox_gip
driver.
> diff --git a/drivers/input/joystick/gip/gip-core.c b/drivers/input/joystick/gip/gip-core.c
> index 57d638408daf4..544becf8badd6 100644
> --- a/drivers/input/joystick/gip/gip-core.c
> +++ b/drivers/input/joystick/gip/gip-core.c
[ ... ]
> +static void gip_free_fragment(struct gip_out_fragment *fragment)
> +{
> + kfree(fragment->data);
> + memset(fragment, 0, sizeof(*fragment));
> +}
[ ... ]
> static int gip_send_raw_message(struct gip_attachment *attachment,
> uint8_t message_type, uint8_t flags, uint8_t seq, const uint8_t *bytes,
> int num_bytes)
> @@ -486,20 +529,25 @@ static int gip_send_raw_message(struct gip_attachment *attachment,
> struct gip_interface *intf;
> int offset = 3;
> struct gip_urb *urb = NULL;
> + struct gip_out_fragment *fragment = NULL;
> int i;
> int rc = 0;
[ ... ]
> + if (num_bytes > reduced_mtu ||
> + (flags & (GIP_FLAG_ACME | GIP_FLAG_FRAGMENT)) == GIP_FLAG_ACME) {
> + for (i = 0; i < MAX_OUT_FRAGMENTS; i++) {
> + if (attachment->out_fragments[i].active)
> + continue;
> +
> + fragment = &attachment->out_fragments[i];
> + break;
> + }
[Severity: High]
Does this code have a missing synchronization issue?
The fragment slot is claimed and initialized locklessly here. If concurrent
callers (like force feedback workers, sysfs, or incoming message handlers)
pick the same inactive slot, could this lead to double-allocation (a memory
leak) and state corruption?
> +
> + if (!fragment) {
> + gip_err(attachment, "Fragmented message queue is full; dropping message\n");
> + return -EALREADY;
> + }
> +
> + fragment->data = kmalloc(num_bytes, GFP_KERNEL);
> + if (!fragment->data)
> + return -ENOMEM;
> + fragment->active = true;
[Severity: High]
Can these out_fragments slots permanently leak if ACKs are dropped?
When an outgoing message requires an ACK, the slot is marked active here and
relies entirely on a device-initiated ACK to be freed. Because there is no
timeout mechanism, if the device drops the message or fails to respond, could
the slot remain locked forever? Since MAX_OUT_FRAGMENTS is only 2, a couple
of dropped packets might permanently exhaust the queue.
[ ... ]
> guard(spinlock_irqsave)(&attachment->device->message_lock);
> for (i = 0; i < MAX_OUT_MESSAGES && !urb; i++) {
> if (!intf->out_queue[i].urb)
[ ... ]
> + if (fragment) {
> + /*
> + * Sending further fragments is handled in gip_urb_out if this fragment doesn't need
> + * ACKing or in gip_handle_command_protocol_control if it does. The flag should also
> + * be cleared if we're done sending this packet.
> + */
> + if (fragment->total_length > reduced_mtu && !(flags & GIP_FLAG_ACME))
> + intf->has_pending_out |= gip_fragment_id(attachment, fragment);
> + else
> + intf->has_pending_out &= ~gip_fragment_id(attachment, fragment);
> }
>
> return rc;
> +
> +err_free_fragment:
> + gip_free_fragment(fragment);
> + return rc;
> +}
[Severity: Critical]
Does this error path unconditionally dereference a NULL pointer?
If gip_send_raw_message() is called for a standard, non-fragmented message,
the fragment pointer remains NULL. If the output queue is full or
usb_submit_urb() fails, the function jumps to err_free_fragment and calls
gip_free_fragment().
Since gip_free_fragment() unconditionally accesses fragment->data and calls
memset(fragment, ...), won't this immediately crash the kernel when fragment
is NULL?
[ ... ]
> +static int gip_send_next_fragment(struct gip_attachment *attachment,
> + struct gip_out_fragment *fragment)
> +{
> + struct gip_interface *intf;
[ ... ]
> + if (fragment->fragment_offset == fragment->total_length) {
> + if ((fragment->message & GIP_DATA_CLASS_MASK) == GIP_DATA_CLASS_AUDIO)
> + intf = &attachment->device->audio;
> + else
> + intf = &attachment->device->data;
> +
> + next_bytes = 0;
> + intf->has_pending_out &= ~gip_fragment_id(attachment, fragment);
[Severity: High]
Is there an unsynchronized read-modify-write data race here?
Here in gip_send_next_fragment(), intf->has_pending_out is updated without
holding message_lock. However, as seen in gip_send_raw_message(), this shared
bitmask is also modified under message_lock.
Could concurrent updates to this shared variable cause lost updates,
permanently stalling fragment transmission for any attachments whose bits get
lost?
--
Sashiko AI review · https://sashiko.dev/#/patchset/20260902010237.865772-1-vi@endrift.com?part=6
^ permalink raw reply [flat|nested] 22+ messages in thread
* Re: [PATCH v5 07/12] Input: xbox_gip - Add security implementation from xone
2026-09-02 1:02 ` [PATCH v5 07/12] Input: xbox_gip - Add security implementation from xone Vicki Pfau
@ 2026-09-02 1:20 ` sashiko-bot
0 siblings, 0 replies; 22+ messages in thread
From: sashiko-bot @ 2026-09-02 1:20 UTC (permalink / raw)
To: Vicki Pfau; +Cc: linux-input, dmitry.torokhov
Thank you for your contribution! Sashiko AI review found 4 potential issue(s) to consider:
New issues:
- [High] Stack-allocated buffers are used for cryptographic scatterlists, violating DMA constraints and causing kernel panics on architectures with virtually mapped stacks.
- [High] An ABBA deadlock occurs between `attachment->lock` and `cancel_work_sync()` during device teardown or reset.
- [Medium] The driver utilizes CRYPTO_LIB_SHA256 and CRYPTO_RSA but lacks the required Kconfig declarations, which can lead to build and runtime failures.
Pre-existing issues:
- [High] This problem wasn't introduced by this patch, but incorrect teardown order in `gip_disconnect()` allows the URB completion handler to re-queue a work item after it was cancelled, leading to a Use-After-Free.
--
commit 0028f224002448741826a03077075da976d732d6
Author: Vicki Pfau <vi@endrift.com>
Subject: Input: xbox_gip - Add security implementation from xone
This patch imports and adapts the security message implementation from the
out-of-tree xone driver. This message is necessary for most controllers that
use wireless dongles. The implementation hooks into the xbox_gip driver to
handle security commands.
> diff --git a/drivers/input/joystick/gip/Kconfig b/drivers/input/joystick/gip/Kconfig
> index 3422bf84cb895..b933583d325f7 100644
> --- a/drivers/input/joystick/gip/Kconfig
> +++ b/drivers/input/joystick/gip/Kconfig
> @@ -4,7 +4,7 @@
> #
> config JOYSTICK_XBOX_GIP
> tristate "Xbox One/Series controller support"
> - depends on USB && USB_ARCH_HAS_HCD && LEDS_CLASS_MULTICOLOR
> + depends on USB && USB_ARCH_HAS_HCD && LEDS_CLASS_MULTICOLOR && CRYPTO_ECDH
[Severity: Medium]
This patch introduces a dependency on CRYPTO_LIB_SHA256 and CRYPTO_RSA (used
in gip-security.c), but these are missing from the Kconfig depends block.
Can this lead to build and runtime failures when compiling without these
crypto options, or when a device requiring the security handshake connects?
> help
> Say Y here if you want to use Xbox One and Series controllers with your
> computer. Make sure to say Y to "Joystick support" (CONFIG_INPUT_JOYDEV)
[ ... ]
> diff --git a/drivers/input/joystick/gip/gip-core.c b/drivers/input/joystick/gip/gip-core.c
> index 544becf8badd6..db4d2956e7d9b 100644
> --- a/drivers/input/joystick/gip/gip-core.c
> +++ b/drivers/input/joystick/gip/gip-core.c
[ ... ]
> @@ -1809,6 +1797,8 @@ static void gip_free_devices(struct gip_attachment *attachment)
> struct input_dev *input;
> struct hid_device *hdev;
>
> + gip_security_release(&attachment->security);
> +
[Severity: High]
This is a pre-existing issue, but the teardown order in the pre-existing
gip_disconnect() function appears to cancel work items before stopping the
USB URB.
gip_disconnect() calls gip_shutdown() (which eventually calls
gip_security_release() here), and only afterwards calls usb_kill_urb(). If
the incoming URB completes in this window, it can process messages and
re-queue the cancelled work items (e.g., work_exchange_rsa).
After the device is freed by devres, can the re-queued work item execute and
dereference freed pointers, leading to a Use-After-Free?
> if (attachment->driver && attachment->driver->remove)
> attachment->driver->remove(attachment);
[ ... ]
> diff --git a/drivers/input/joystick/gip/gip-security.c b/drivers/input/joystick/gip/gip-security.c
> new file mode 100644
> index 0000000000000..58de547aa1dd1
> --- /dev/null
> +++ b/drivers/input/joystick/gip/gip-security.c
[ ... ]
> +static int gip_security_ecdh_get_secret(struct crypto_kpp *tfm, u8 *pubkey,
> + int pubkey_len, u8 *secret, int secret_len)
> +{
> + struct kpp_request *req;
> + struct scatterlist src, dest;
> + DECLARE_CRYPTO_WAIT(wait);
> + int err;
> +
> + req = kpp_request_alloc(tfm, GFP_KERNEL);
> + if (!req)
> + return -ENOMEM;
> +
> + sg_init_one(&src, pubkey, pubkey_len);
> + sg_init_one(&dest, secret, secret_len);
[Severity: High]
Does this code use a stack-allocated buffer (secret) for a cryptographic
scatterlist? Passing stack memory to sg_init_one() violates DMA constraints
and can cause a kernel panic/Oops (due to BUG_ON(!virt_addr_valid(buf))) on
architectures with virtually mapped stacks.
> + kpp_request_set_input(req, &src, pubkey_len);
> + kpp_request_set_output(req, &dest, secret_len);
[ ... ]
> +static int gip_security_compute_ecdh(u8 *pubkey_in, u8 *pubkey_out, int pubkey_len, u8 *secret_hash)
> +{
> + struct crypto_kpp *tfm_ecdh;
> + u8 secret[GIP_SECURITY_ECDH_SECRET_LEN] = {0};
> + int err;
> +
> + tfm_ecdh = crypto_alloc_kpp("ecdh-nist-p256", 0, 0);
> + if (IS_ERR(tfm_ecdh)) {
> + err = PTR_ERR(tfm_ecdh);
> + goto err_free_secret;
> + }
> +
> + err = gip_security_ecdh_get_pubkey(tfm_ecdh, pubkey_out, pubkey_len);
> + if (err)
> + goto err_free_ecdh;
> +
> + err = gip_security_ecdh_get_secret(tfm_ecdh, pubkey_in, pubkey_len,
> + secret, sizeof(secret));
[ ... ]
> +static void gip_security_exchange_rsa(struct work_struct *work)
> +{
> + struct gip_security *security = container_of(work, typeof(*security), work_exchange_rsa);
> + struct gip_attachment *attachment = container_of(security, struct gip_attachment, security);
> + struct gip_security_host_secret message = {};
> + u8 random[GIP_SECURITY_RANDOM_LEN * 2];
> + int err;
> +
> + guard(mutex)(&attachment->lock);
[ ... ]
> +void gip_security_release(struct gip_security *security)
> +{
> + if (security->status < GIP_SECURITY_SENT)
> + return;
> +
> + cancel_work_sync(&security->work_exchange_rsa);
[Severity: High]
Can this cause an ABBA deadlock during device teardown?
During hot-unplug, gip_shutdown() in gip-core.c acquires attachment->lock
and then calls gip_security_release(), which synchronously waits for the
work item using cancel_work_sync().
Simultaneously, the running gip_security_exchange_rsa() work item blocks
trying to acquire the same attachment->lock mutex.
> + cancel_work_sync(&security->work_exchange_ecdh);
> + cancel_work_sync(&security->work_complete);
> +
> + memzero_explicit(&security->transcript, sizeof(security->transcript));
> +
> + security->status = GIP_SECURITY_PENDING;
> +}
--
Sashiko AI review · https://sashiko.dev/#/patchset/20260902010237.865772-1-vi@endrift.com?part=7
^ permalink raw reply [flat|nested] 22+ messages in thread
* Re: [PATCH v5 05/12] Input: xbox_gip - Add battery support
2026-09-02 1:02 ` [PATCH v5 05/12] Input: xbox_gip - Add battery support Vicki Pfau
@ 2026-09-02 1:20 ` sashiko-bot
0 siblings, 0 replies; 22+ messages in thread
From: sashiko-bot @ 2026-09-02 1:20 UTC (permalink / raw)
To: Vicki Pfau; +Cc: dmitry.torokhov, linux-input
Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:
- [High] Devres actions on `input->dev` are delayed until userspace drops all references, causing the power supply to outlive the `attachment` structure and resulting in a Use-After-Free.
- [High] Manually unregistering a devm-managed power supply and freeing its name on an error path leads to a double-unregister and UAF when devres cleanup executes.
--
commit 7a0e19630adf51b35545780bfe01529fdc2adba8
Author: Vicki Pfau <vi@endrift.com>
Input: xbox_gip - Add battery support
This commit adds battery support to the xbox_gip driver by exposing the
controller's battery information as a power_supply device.
> diff --git a/drivers/input/joystick/gip/gip-core.c b/drivers/input/joystick/gip/gip-core.c
> --- a/drivers/input/joystick/gip/gip-core.c
> +++ b/drivers/input/joystick/gip/gip-core.c
[ ... ]
> @@ -1199,6 +1206,106 @@ static int gip_guide_led_probe(struct gip_attachment *attachment, struct device
[ ... ]
> +static int gip_battery_create(struct gip_attachment *attachment, struct device *dev)
> +{
> + struct power_supply_config supply_config = { .drv_data = attachment, };
> + int rc;
[ ... ]
> + attachment->battery = devm_power_supply_register(dev,
> + &attachment->battery_desc, &supply_config);
> + if (IS_ERR(attachment->battery)) {
> + rc = PTR_ERR(attachment->battery);
> + goto err_out;
> + }
> +
> + rc = power_supply_powers(attachment->battery, dev);
> + if (rc < 0) {
> + power_supply_unregister(attachment->battery);
> + goto err_out;
> + }
[Severity: High]
Because attachment->battery was allocated using devm_power_supply_register(),
a devres action is already queued to unregister it. If power_supply_powers()
fails and we manually call power_supply_unregister() here, will devres
attempt to unregister it again later when the input device is cleaned up,
leading to a double-free?
[ ... ]
> @@ -1494,6 +1604,8 @@ static void gip_free_devices(struct gip_attachment *attachment)
>
> rcu_assign_pointer(attachment->input, NULL);
> rcu_assign_pointer(attachment->hdev, NULL);
> + /* The following are freed by devres */
> + attachment->battery = NULL;
> synchronize_rcu();
[Severity: High]
The battery was registered with devm using the input device (input->dev).
Since input device devres actions are delayed until userspace drops all
evdev file descriptor references, does setting attachment->battery to NULL
here leave the power supply active after the driver disconnects?
If a user reads the sysfs attributes for the power supply after the device
is unplugged, could gip_battery_get_property() attempt to access the freed
attachment structure?
--
Sashiko AI review · https://sashiko.dev/#/patchset/20260902010237.865772-1-vi@endrift.com?part=5
^ permalink raw reply [flat|nested] 22+ messages in thread
* Re: [PATCH v5 03/12] Input: xbox_gip - Add controllable LED support
2026-09-02 1:02 ` [PATCH v5 03/12] Input: xbox_gip - Add controllable LED support Vicki Pfau
@ 2026-09-02 1:20 ` sashiko-bot
0 siblings, 0 replies; 22+ messages in thread
From: sashiko-bot @ 2026-09-02 1:20 UTC (permalink / raw)
To: Vicki Pfau; +Cc: linux-input, dmitry.torokhov
Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] LED classdev remains registered after driver disconnect, leading to a Use-After-Free vulnerability.
--
commit c366b72f3332d21395d97672e39c1566b23f91d5
Author: Vicki Pfau <vi@endrift.com>
Input: xbox_gip - Add controllable LED support
This commit adds controllable LED support for Xbox One controllers. It supports
both monochrome white LEDs and RGBW addressable LEDs for Elite 2 controllers,
exposing them as LED class devices.
> diff --git a/drivers/input/joystick/gip/gip-core.c b/drivers/input/joystick/gip/gip-core.c
> index 11196afdce33f..23ab0768580f5 100644
> --- a/drivers/input/joystick/gip/gip-core.c
> +++ b/drivers/input/joystick/gip/gip-core.c
[ ... ]
> +static int gip_guide_led_probe(struct gip_attachment *attachment, struct device *dev)
> +{
> + int rc = 0;
> +
> + if (!gip_supports_system_message(attachment, GIP_CMD_LED, false))
> + return 0;
> +
> + if (attachment->features & GIP_FEATURE_GUIDE_COLOR) {
> + struct mc_subled *mc_led_info;
> + struct led_classdev_mc *mc_cdev = &attachment->guide_led.color;
> + struct led_classdev *cdev = &mc_cdev->led_cdev;
> +
> + mc_led_info = devm_kcalloc(dev, 4,
> + sizeof(*mc_led_info), GFP_KERNEL);
> + if (!mc_led_info)
> + return -ENOMEM;
> +
> + mc_led_info[0].color_index = LED_COLOR_ID_RED;
> + mc_led_info[0].intensity = 51;
> + mc_led_info[1].color_index = LED_COLOR_ID_GREEN;
> + mc_led_info[1].intensity = 51;
> + mc_led_info[2].color_index = LED_COLOR_ID_BLUE;
> + mc_led_info[2].intensity = 51;
> + mc_led_info[3].color_index = LED_COLOR_ID_WHITE;
> + mc_led_info[3].intensity = 51;
> +
> + mc_cdev->subled_info = mc_led_info;
> + mc_cdev->num_colors = 4;
> +
> + cdev->brightness = 51;
> + cdev->max_brightness = 255;
> + cdev->flags = LED_CORE_SUSPENDRESUME | LED_RETAIN_AT_SHUTDOWN;
> + cdev->brightness_set_blocking = gip_guide_color_led_set;
> + cdev->name = devm_kasprintf(dev, GFP_KERNEL,
> + "%s:rgb:power", dev_name(dev));
> + if (!cdev->name)
> + rc = -ENOMEM;
> +
> + if (!rc)
> + rc = devm_led_classdev_multicolor_register(dev,
> + mc_cdev);
[Severity: High]
Does binding this LED to the input device's lifecycle cause a use-after-free
if the controller is disconnected while an input event node is still open?
Since the devres action for unregistering the LED is bound to the input device
(&input->dev), the LED will remain registered as long as userspace holds an
evdev file descriptor open.
However, during driver unbind, gip_disconnect() calls:
devm_kfree(to_gip_device(attachment), attachment);
This immediately frees the attachment structure containing the registered
led_classdev and led_classdev_mc structures. Subsequent accesses to the LED's
sysfs attributes (such as changing brightness via gip_guide_color_led_set)
would then dereference this freed memory.
Should this register against the physical device instead, such as
to_gip_device(attachment), to ensure the LED is unregistered synchronously
during driver unbind?
[ ... ]
> + } else {
> + struct led_classdev *cdev = &attachment->guide_led.standard;
> +
> + cdev->max_brightness = GIP_LED_GUIDE_MAX_BRIGHTNESS;
> + cdev->brightness = GIP_LED_GUIDE_INIT_BRIGHTNESS;
> + cdev->flags = LED_CORE_SUSPENDRESUME | LED_RETAIN_AT_SHUTDOWN;
> + cdev->brightness_set_blocking = gip_guide_led_set;
> + cdev->name = devm_kasprintf(dev, GFP_KERNEL,
> + "%s:white:power", dev_name(dev));
> + if (!cdev->name)
> + return -ENOMEM;
> +
> + rc = devm_led_classdev_register(dev, cdev);
[Severity: High]
Can this similarly cause a use-after-free since the standard LED is also
registered using the input device as the devres parent?
[ ... ]
> @@ -1150,6 +1261,10 @@ static int gip_setup_input_device(struct gip_attachment *attachment)
> if (rc)
> goto err_free_device;
>
> + rc = gip_guide_led_probe(attachment, &input->dev);
[Severity: High]
By passing &input->dev instead of the physical device to gip_guide_led_probe(),
the LED lifecycle becomes tied to the input device.
Input devices only run their devres actions when the last userspace reference
is released. If the LED memory resides in attachment, shouldn't the LED be
tied to the attachment's device so that unregistration happens before the
attachment is freed?
> + if (rc)
> + gip_err(attachment, "Failed to register LEDs: %d\n", rc);
> +
> return 0;
>
> err_free_device:
--
Sashiko AI review · https://sashiko.dev/#/patchset/20260902010237.865772-1-vi@endrift.com?part=3
^ permalink raw reply [flat|nested] 22+ messages in thread
* Re: [PATCH v5 04/12] Input: xbox_gip - Add HID relaying
2026-09-02 1:02 ` [PATCH v5 04/12] Input: xbox_gip - Add HID relaying Vicki Pfau
@ 2026-09-02 1:22 ` sashiko-bot
0 siblings, 0 replies; 22+ messages in thread
From: sashiko-bot @ 2026-09-02 1:22 UTC (permalink / raw)
To: Vicki Pfau; +Cc: linux-input, dmitry.torokhov
Thank you for your contribution! Sashiko AI review found 5 potential issue(s) to consider:
New issues:
- [Critical] gip_reset_metadata() frees hid_descriptor before destroying the HID device, allowing a concurrent UAF during HID probe.
- [High] Fragmented HID reports are processed with a payload size of 0, causing the entire assembled report to be truncated and silently dropped.
- [Medium] Useless synchronize_rcu() call delays device initialization.
- [Medium] The hid_device fields `version`, `country`, and `uniq` are not initialized before calling `hid_add_device()`.
Pre-existing issues:
- [Critical] Use-after-free in receive worker due to incorrect shutdown ordering.
--
commit e6352eb8b59489fd2119b2f3d053cfef65ac2c92
Author: Vicki Pfau <vi@endrift.com>
Subject: Input: xbox_gip - Add HID relaying
This patch allows tunneling of HID packets by creating a hid_device for
the HID descriptor embedded in the GIP metadata, and relays the packets.
> diff --git a/drivers/input/joystick/gip/gip-core.c b/drivers/input/joystick/gip/gip-core.c
> index 23ab0768580f5..3b033fe65dc40 100644
> --- a/drivers/input/joystick/gip/gip-core.c
> +++ b/drivers/input/joystick/gip/gip-core.c
> @@ -560,6 +560,54 @@ int gip_send_vendor_message(struct gip_attachment *attachment,
> bytes, num_bytes);
> }
>
> +static int gip_hid_ll_parse(struct hid_device *hdev)
> +{
> + struct gip_attachment *attachment = hdev->driver_data;
> +
> + return hid_parse_report(hdev,
> + attachment->metadata.device.hid_descriptor,
> + attachment->metadata.device.hid_descriptor_size);
> +}
[Severity: Critical]
Can this lead to a use-after-free during a concurrent HID probe?
If a device reset or hotplug occurs, gip_reset_metadata() frees the
metadata before destroying the child devices:
gip_reset_metadata()
gip_metadata_free(to_gip_device(attachment), &attachment->metadata);
gip_free_devices(attachment);
Since gip_metadata_free() synchronously frees hid_descriptor, if the HID
core concurrently probes the device and calls gip_hid_ll_parse() before
gip_free_devices() unregisters the HID device, it would dereference the
freed descriptor memory.
[ ... ]
> @@ -1303,6 +1351,48 @@ static int gip_init_input_device(struct gip_attachment *attachment)
> return rc;
> }
>
> +static int gip_create_hdev(struct gip_attachment *attachment)
> +{
> + struct hid_device *hdev;
> + int rc;
> +
> + if (!attachment->metadata.device.hid_descriptor)
> + return 0;
> +
> + rcu_read_lock();
> + hdev = rcu_dereference(attachment->hdev);
> + rcu_read_unlock();
> + if (hdev)
> + return 0;
> +
> + hdev = hid_allocate_device();
> +
> + if (IS_ERR(hdev))
> + return PTR_ERR(hdev);
> +
> + hdev->ll_driver = &gip_hid_ll_driver;
> + hdev->bus = BUS_GIP;
> + hdev->vendor = attachment->vendor_id;
> + hdev->product = attachment->product_id;
> + hdev->dev.parent = to_gip_device(attachment);
> + hdev->driver_data = attachment;
> + if (attachment->name)
> + strscpy(hdev->name, attachment->name);
> + else
> + strscpy(hdev->name, "Xbox Chatpad");
> + strscpy(hdev->phys, attachment->phys);
> + rc = hid_add_device(hdev);
[Severity: Medium]
Are we missing the initialization of some standard hid_device fields here?
It appears that the version, country, and uniq fields are not populated
before calling hid_add_device(). This might break userspace expectations
that rely on these standard HID properties for device matching or
configuration.
> + if (rc) {
> + gip_err(attachment, "HID device add failed: %d\n", rc);
> + hid_destroy_device(hdev);
> + } else {
> + rcu_assign_pointer(attachment->hdev, hdev);
> + synchronize_rcu();
> + }
[Severity: Medium]
Is this synchronize_rcu() call necessary on the successful allocation path?
Since we are publishing a new pointer where the previous value was NULL,
there are no existing readers holding an old pointer that needs to be
reclaimed. This seems to delay device initialization by a full RCU grace
period unnecessarily.
[ ... ]
> @@ -1768,9 +1868,17 @@ static int gip_handle_command_firmware(struct gip_attachment *attachment,
> static int gip_handle_command_hid_report(struct gip_attachment *attachment,
> const struct gip_header *header, uint8_t *bytes, int num_bytes)
> {
> - gip_warn(attachment, "Unimplemented HID report message\n");
> + struct hid_device *hdev;
>
> - return -EOPNOTSUPP;
> + guard(rcu)();
> + hdev = rcu_dereference(attachment->hdev);
> + if (hdev)
> + return hid_safe_input_report(hdev, HID_INPUT_REPORT, bytes,
> + num_bytes, umin(header->length, num_bytes), true);
[Severity: High]
Could this cause large fragmented HID reports to be silently dropped?
When gip_receive_fragment() reassembles a fragmented message, it completes
upon receiving a terminator fragment where header->length is 0. It then
calls gip_handle_message() using this final header.
If umin(header->length, num_bytes) is evaluated with header->length == 0,
the payload size passed to hid_safe_input_report() will be 0, causing the
entire reassembled HID report to be truncated.
> +
> + gip_warn(attachment, "Got HID report with no HID descriptor\n");
> +
> + return -EPROTO;
> }
[ ... ]
[Severity: Critical]
This is a pre-existing issue, but is there a use-after-free risk in the
receive worker due to incorrect shutdown ordering in gip_disconnect()?
Looking at gip_disconnect():
gip_shutdown(gip);
...
usb_kill_urb(gip->data.urb_in);
The gip_shutdown() function synchronously cancels the receive worker.
However, this happens before usb_kill_urb() is called. If an incoming URB
completes right after cancel_work_sync() returns, gip_urb_in() could
re-queue the worker.
When gip_disconnect() then proceeds to free the gip structure, the
re-queued worker will execute gip_receive_work() and access the freed
memory. Should the URBs be killed before cancelling the workers?
--
Sashiko AI review · https://sashiko.dev/#/patchset/20260902010237.865772-1-vi@endrift.com?part=4
^ permalink raw reply [flat|nested] 22+ messages in thread
* Re: [PATCH v5 10/12] Input: Add ABS_CLUTCH, HANDBRAKE, and SHIFTER
2026-09-02 1:02 ` [PATCH v5 10/12] Input: Add ABS_CLUTCH, HANDBRAKE, and SHIFTER Vicki Pfau
@ 2026-09-02 1:23 ` sashiko-bot
0 siblings, 0 replies; 22+ messages in thread
From: sashiko-bot @ 2026-09-02 1:23 UTC (permalink / raw)
To: Vicki Pfau; +Cc: dmitry.torokhov, linux-input
Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] The hid-universal-pidff driver fails to adjust fuzz and deadzone for the newly added racing axes (ABS_CLUTCH, ABS_HANDBRAKE, ABS_SHIFTER).
--
commit 6be790038ce1202a4794a1e9066e937b7c0b308a
Author: Vicki Pfau <vi@endrift.com>
Input: Add ABS_CLUTCH, HANDBRAKE, and SHIFTER
This commit adds new absolute axes for racing game controllers.
[ ... ]
> diff --git a/include/uapi/linux/input-event-codes.h b/include/uapi/linux/input-event-codes.h
> index 3528168f7c6d7..5c881ed441771 100644
> --- a/include/uapi/linux/input-event-codes.h
> +++ b/include/uapi/linux/input-event-codes.h
> @@ -879,6 +879,9 @@
> #define ABS_WHEEL 0x08
> #define ABS_GAS 0x09
> #define ABS_BRAKE 0x0a
> +#define ABS_CLUTCH 0x0b
> +#define ABS_HANDBRAKE 0x0c
> +#define ABS_SHIFTER 0x0d
[Severity: Medium]
Will this cause an issue with fuzz and deadzone adjustment for the newly
added racing axes?
Looking at drivers/hid/hid-universal-pidff.c in
universal_pidff_input_configured(), there is a loop that controls the fuzz
and deadzone configuration for racing controllers:
/* Decrease fuzz and deadzone on available axes */
for (axis = ABS_X; axis <= ABS_BRAKE; axis++) {
if (!test_bit(axis, input->absbit))
continue;
This loop stops at ABS_BRAKE, skipping the newly appended ABS_CLUTCH,
ABS_HANDBRAKE, and ABS_SHIFTER axes.
High-resolution inputs for these newly added axes (like a clutch pedal or
analog handbrake) will retain the HID input core's default large fuzz or
deadzone values. This could lead to "steppy" input response and dropped
small movements.
Does the loop in universal_pidff_input_configured() need to be updated to
include these new axes?
--
Sashiko AI review · https://sashiko.dev/#/patchset/20260902010237.865772-1-vi@endrift.com?part=10
^ permalink raw reply [flat|nested] 22+ messages in thread
* Re: [PATCH v5 08/12] Input: xbox_gip - Add arcade stick support
2026-09-02 1:02 ` [PATCH v5 08/12] Input: xbox_gip - Add arcade stick support Vicki Pfau
@ 2026-09-02 1:24 ` sashiko-bot
0 siblings, 0 replies; 22+ messages in thread
From: sashiko-bot @ 2026-09-02 1:24 UTC (permalink / raw)
To: Vicki Pfau; +Cc: dmitry.torokhov, linux-input
Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] Missing `input_sync()` when discarding too-short reports, leaving events stuck in the input core buffers.
--
commit 11239c49a7f8de98682a983be88f926f7595b94d
Author: Vicki Pfau <vi@endrift.com>
Input: xbox_gip - Add arcade stick support
This adds support for the arcade stick device type to the xbox_gip driver.
Currently only the Razer Atrox controller is known to use this type.
> diff --git a/drivers/input/joystick/gip/gip-arcade-stick.c b/drivers/input/joystick/gip/gip-arcade-stick.c
> new file mode 100644
> index 0000000000000..11ededfab8555
> --- /dev/null
> +++ b/drivers/input/joystick/gip/gip-arcade-stick.c
[ ... ]
> +static int gip_handle_arcade_stick_report(struct gip_attachment *attachment,
> + struct input_dev *input, const uint8_t *bytes, int num_bytes)
> +{
> + struct gip_arcade_stick_info *info = attachment->driver_data;
> + int rc;
> +
> + if (!info)
> + return -ENODEV;
> +
> + rc = gip_driver_navigation.handle_input_report(attachment, input, bytes, num_bytes);
> + if (rc < 0)
> + return rc;
> +
> + if (num_bytes < 6) {
> + gip_dbg(attachment, "Discarding too-short input report\n");
> + return -EINVAL;
> + }
[Severity: Medium]
When an input report is received with a length between 2 and 5 bytes,
gip_driver_navigation.handle_input_report() successfully parses the first
two bytes and calls input_report_key() and input_report_abs() to update the
device state.
If num_bytes < 6, this error path in gip_handle_arcade_stick_report() returns
-EINVAL before the device state can be synchronized. This error code is
propagated back to the caller in drivers/input/joystick/gip/gip-core.c
(gip_handle_ll_input_report()), which then immediately returns without calling
input_sync(input).
Because of this early return, does the driver leave the reported key and axis
events buffered in the input core without flushing them to userspace? Could
this result in missed or delayed events if the hardware sends unexpectedly
short event packets?
> +
> + if (info->actuator_bias > 0) {
> + input_report_abs(input, ABS_X, get_unaligned_le16(&bytes[2]) - info->actuator_bias);
> + input_report_abs(input, ABS_Y, get_unaligned_le16(&bytes[4]) - info->actuator_bias);
> + }
--
Sashiko AI review · https://sashiko.dev/#/patchset/20260902010237.865772-1-vi@endrift.com?part=8
^ permalink raw reply [flat|nested] 22+ messages in thread
* Re: [PATCH v5 01/12] Input: xbox_gip - Add new driver for Xbox GIP
2026-09-02 1:02 ` [PATCH v5 01/12] " Vicki Pfau
@ 2026-09-02 1:28 ` sashiko-bot
0 siblings, 0 replies; 22+ messages in thread
From: sashiko-bot @ 2026-09-02 1:28 UTC (permalink / raw)
To: Vicki Pfau; +Cc: linux-input, dmitry.torokhov
Thank you for your contribution! Sashiko AI review found 17 potential issue(s) to consider:
- [Critical] Failed `INIT_FRAG` validation leaves state desynchronized, leading to NULL pointer dereference.
- [Critical] Kernel panic due to NULL pointer dereference in `gip_free_fragment` during error handling.
- [High] Devm allocations bound to `udev->dev` instead of `intf->dev` cause memory leaks.
- [High] System suspend unregisters input devices, breaking userspace file descriptors.
- [High] Improper workqueue teardown order relative to URB killing causes Use-After-Free.
- [High] Race condition between fragment reception and timeout can incorrectly free a valid fragment buffer.
- [High] Undefined behavior due to unbounded bitwise shift in `gip_decode_length`.
- [High] Unreachable `goto` cleanup code in interface initialization causes memory leaks on failure.
- [High] Intermediate message fragments fail to advance `fragment_offset`, causing an infinite transmission loop.
- [High] Manual `power_supply_unregister` on a `devm`-managed power supply causes a double free.
- [High] Missing bounds check in `gip_handle_elite_buttons` leads to an out-of-bounds array read.
- [High] Data race on attachment creation during probe leads to duplicate allocation and memory leaks.
- [High] Unprotected state modifications during message transmission cause data races.
- [High] Manual `devm_kfree` of attachment in `gip_disconnect` causes UAF when sysfs callbacks run concurrently.
- [Medium] Early return in `gip_parse_metadata` leaks devres-allocated fields.
- [Medium] Anti-pattern: Using devres (`devm_kmalloc`) for per-message data buffers in the hot path.
- [Medium] Buffer overflow in `gip_urb_in` when copying URB data into a fixed 64-byte message queue.
--
commit 6e5a9bf1d68de07f6142d692c36b2ce1b34a0cc6
Author: Vicki Pfau <vi@endrift.com>
Subject: Input: xbox_gip - Add new driver for Xbox GIP
This introduces a new driver for the Xbox One/Series controller protocol,
officially known as the Gaming Input Protocol, or GIP for short. It is
based on the Microsoft GIP spec and provides features like fragmented
message parsing and auto-detection via metadata.
> diff --git a/drivers/input/joystick/gip/gip.h b/drivers/input/joystick/gip/gip.h
> --- /dev/null
> +++ b/drivers/input/joystick/gip/gip.h
> @@ -0,0 +1,344 @@
> +/* SPDX-License-Identifier: GPL-2.0-or-later */
[ ... ]
> +static inline struct device *gip_attachment_dev(struct gip_attachment *attachment)
> +{
> + return &attachment->device->udev->dev;
> +}
[Severity: High]
Does this helper force all attachment devm allocations to be bound to the USB
device instead of the interface?
If devm_input_allocate_device() or devm_kzalloc() use this device pointer,
they will be bound to the parent udev->dev. When the driver is unbound from
the interface (e.g., via sysfs), the devres actions attached to the interface
will run, but those attached to the USB device will not, causing a persistent
memory leak of driver structures and input devices.
> +
> +static inline struct device *gip_interface_dev(struct gip_interface *intf)
[ ... ]
> diff --git a/drivers/input/joystick/gip/gip-core.c b/drivers/input/joystick/gip/gip-core.c
> --- /dev/null
> +++ b/drivers/input/joystick/gip/gip-core.c
> @@ -0,0 +1,2591 @@
[ ... ]
> +static int gip_decode_length(uint64_t *length, const uint8_t *bytes, int num_bytes)
> +{
> + *length = 0;
> + int offset;
> +
> + for (offset = 0; offset < num_bytes; offset++) {
> + uint8_t byte = bytes[offset];
> +
> + *length |= (byte & 0x7full) << (offset * 7);
[Severity: High]
Can this bitwise shift result in undefined behavior?
The while loop is bounded only by num_bytes. If a malicious USB device
sends a packet with 10 or more consecutive bytes having the 0x80 bit set,
offset * 7 will equal or exceed 64, shifting a 64-bit integer out of bounds
and leading to corrupted length parsing.
> + if (!(byte & 0x80)) {
> + offset++;
> + break;
> + }
> + }
> + return offset;
> +}
[ ... ]
> +static uint8_t gip_sequence_next(struct gip_attachment *attachment,
> + uint8_t command, bool system)
> +{
> + uint8_t seq;
> +
> + if (system) {
[ ... ]
> + } else {
> + seq = attachment->seq_vendor++;
> + if (!seq)
> + seq = attachment->seq_vendor++;
> + }
> + return seq;
> +}
[Severity: High]
Are these shared sequence numbers protected against concurrent modification?
Modifying shared state like seq_vendor without locks could cause data races.
Concurrent attempts to send messages (e.g., from force-feedback rumble
updates and background ACME acks) might race to increment sequence IDs and
cause sequence number duplication. This pattern of unprotected modification
also occurs in gip_send_raw_message when claiming out_fragments slots.
> +
> +static void gip_handle_quirks_array(struct gip_attachment *attachment,
[ ... ]
> +static int gip_send_raw_message(struct gip_attachment *attachment,
> + uint8_t message_type, uint8_t flags, uint8_t seq, const uint8_t *bytes,
> + int num_bytes)
> +{
[ ... ]
> + if (!urb) {
> + gip_err(attachment, "Output queue is full; dropping message\n");
> + rc = -ENOSPC;
> + goto err_free_fragment;
> + }
[Severity: Critical]
Is it possible for error paths in fragment sending to cause a NULL pointer
dereference?
If a fragment pointer is initialized to NULL, and the output queue is full or
usb_submit_urb() fails, jumping to an error path that unconditionally calls
memset(fragment, 0, ...) (like in a gip_free_fragment function) would
immediately panic the kernel.
> + urb->data[0] = message_type;
[ ... ]
> +static bool gip_parse_metadata(struct device *dev,
> + struct gip_metadata *metadata, const uint8_t *bytes, int num_bytes)
> +{
[ ... ]
> + metadata->num_messages = bytes[offset];
> + offset++;
> + if (metadata->num_messages > 0) {
> + metadata->message_metadata = devm_kcalloc(dev,
> + metadata->num_messages,
> + sizeof(*metadata->message_metadata), GFP_KERNEL);
> + if (!metadata->message_metadata)
> + return -ENOMEM;
[Severity: Medium]
Will this early return leak previously allocated devres fields?
If devm_kcalloc fails here, returning -ENOMEM directly bypasses the
parse_err cleanup label, which is responsible for freeing previously allocated
structures like audio formats and preferred types, causing a persistent memory
leak.
> +
> + for (i = 0; i < metadata->num_messages; i++) {
[ ... ]
> +static int gip_handle_elite_buttons(struct gip_attachment *attachment,
> + struct input_dev *input, const uint8_t *bytes, int num_bytes)
> +{
> + bool grip[4] = { 0, 0, 0, 0 };
> + int profile = -1;
> +
> + if (attachment->xbe_format == GIP_BTN_FMT_XBE1
> + && num_bytes > GIP_BTN_OFFSET_XBE1) {
[ ... ]
> + } else if ((attachment->xbe_format == GIP_BTN_FMT_XBE2_4
> + || attachment->xbe_format == GIP_BTN_FMT_XBE2_5)
> + && num_bytes > GIP_BTN_OFFSET_XBE2) {
> + int profile_offset;
> +
> + if (attachment->xbe_format == GIP_BTN_FMT_XBE2_4)
> + profile_offset = 15;
> + else
> + profile_offset = 20;
> + profile = bytes[profile_offset] & 3;
[Severity: High]
Is it possible to encounter an out-of-bounds read here due to insufficient
bounds checking?
For GIP_BTN_FMT_XBE2_5 layouts, profile_offset is set to 20. The preceding
bounds check only validates that num_bytes > 14 (GIP_BTN_OFFSET_XBE2). If a
malicious USB packet arrives with a length of 15 to 20 bytes, reading
bytes[profile_offset] causes an out-of-bounds array access.
> +
> + if (!profile) {
[ ... ]
> +static struct gip_attachment *gip_ensure_attachment(struct gip_device *device,
> + uint8_t attachment_index)
> +{
> + struct gip_attachment *attachment = device->attachments[attachment_index];
> +
> + if (!attachment) {
> + attachment = devm_kzalloc(to_gip_device(device), sizeof(*attachment), GFP_KERNEL);
[Severity: High]
Does this attachment creation suffer from a data race during probe?
This uses a check-and-allocate pattern for device->attachments[attachment_index]
without locking. If gip_probe starts URB reception before ensuring the
attachment exists, a racing USB packet could trigger the receive worker. Both
threads could concurrently execute gip_ensure_attachment, allocating multiple
instances, causing state corruption and memory leaks.
> + if (!attachment)
> + return ERR_PTR(-ENOMEM);
[ ... ]
> +static int gip_receive_fragment(struct gip_attachment *attachment,
> + const struct gip_header *header, int offset,
> + uint64_t *fragment_offset, uint16_t *bytes_remaining, uint8_t *bytes,
> + int num_bytes)
> +{
> + int rc = 0;
> +
> + if (header->flags & GIP_FLAG_INIT_FRAG) {
> + uint64_t total_length;
> +
> + guard(mutex)(&attachment->lock);
> + if (attachment->in_fragment_message >= 0) {
> + /*
> + * Reset fragment buffer if we get a new initial
> + * fragment before finishing the last message.
> + * TODO: Is this the correct behavior?
> + */
> + devm_kfree(to_gip_device(attachment), attachment->in_fragment_data);
> + attachment->in_fragment_data = NULL;
> + }
> + offset += gip_decode_length(&total_length, &bytes[offset],
> + num_bytes - offset);
> + if (total_length > MAX_MESSAGE_LENGTH)
> + return -EINVAL;
[Severity: Critical]
Could this early return leave the state desynchronized if length validation
fails?
If an INIT_FRAG arrives while in_fragment_message >= 0, in_fragment_data
is freed and set to NULL. If it then fails the total_length validation, the
function returns early without resetting in_fragment_message. A subsequent
fragment of the same type would skip initialization checks and call memcpy
into the NULL in_fragment_data pointer, causing an immediate kernel panic.
> +
> + if (header->length > num_bytes - offset) {
[ ... ]
> + if (header->length > total_length) {
[ ... ]
> + attachment->in_fragment_data = devm_kmalloc(to_gip_device(attachment),
> + total_length, GFP_KERNEL);
[Severity: Medium]
Should devres be used for per-message data buffers in the hot path?
Allocating and freeing dynamic buffers for every fragmented message using
devm_kmalloc and devm_kfree causes performance degradation and lock contention.
Devres is designed for device lifecycle management, not high-frequency data
path allocations.
> + if (!attachment->in_fragment_data)
[ ... ]
> + if (*fragment_offset + header->length > attachment->in_total_length) {
[ ... ]
> + if (header->length != 0)
> + memcpy(&attachment->in_fragment_data[*fragment_offset],
> + &bytes[offset], header->length);
> + *fragment_offset += header->length;
> + attachment->in_fragment_offset = *fragment_offset;
> +
> + if (header->flags & GIP_FLAG_ACME)
> + gip_acknowledge(attachment, header, *fragment_offset, *bytes_remaining);
> + if (header->length == 0 && !*bytes_remaining) {
> + rc = gip_handle_message(attachment, header,
> + attachment->in_fragment_data,
> + attachment->in_total_length);
> + devm_kfree(to_gip_device(attachment), attachment->in_fragment_data);
> + attachment->in_fragment_data = NULL;
> + attachment->in_fragment_message = -1;
> + }
> + }
> + cancel_delayed_work(&attachment->in_fragment_timeout);
[Severity: High]
Can this asynchronous cancellation race with the timeout handler?
Because cancel_delayed_work is called outside the attachment->lock, it
can race with gip_fragment_timeout. If the timeout fires and blocks on the
lock while gip_receive_fragment is running, it will acquire the lock right
after the new buffer is installed and wrongfully devm_kfree the actively
used buffer.
> + schedule_delayed_work(&attachment->in_fragment_timeout, HZ);
> +
> + return rc;
> +}
[ ... ]
> +static void gip_urb_in(struct urb *urb)
> +{
[ ... ]
> + spin_lock_irqsave(&gip->message_lock, flags);
> + if (gip->pending_in_messages >= MAX_IN_MESSAGES) {
> + gip_err(gip, "Input queue is full; dropping message\n");
> + } else {
> + message_id = (gip->next_in_message + gip->pending_in_messages) % MAX_IN_MESSAGES;
> + message = &gip->in_queue[message_id];
> + gip->pending_in_messages++;
> + memcpy(message->bytes, intf->in_data, urb->actual_length);
[Severity: Medium]
Might this copy overflow the fixed-size message queue buffer?
message->bytes is hardcoded to 64 bytes (BASE_GIP_MTU). The data is
copied using urb->actual_length without validation against the destination
size. If a quirky USB device returns more than 64 bytes (or if the audio
interface with an MTU of 2048 bytes is ever enabled), this will trigger an
out-of-bounds write and corrupt the in_queue ring buffer.
> + message->num_bytes = urb->actual_length;
> + }
> + spin_unlock_irqrestore(&gip->message_lock, flags);
> + schedule_work(&gip->receive_message);
> +
> +exit:
> + status = usb_submit_urb(urb, GFP_ATOMIC);
[ ... ]
> +static int gip_init_input(struct gip_interface *intf,
> + struct usb_endpoint_descriptor *ep_in)
> +{
[ ... ]
> + intf->in_data = usb_alloc_coherent(udev, intf->mtu, GFP_KERNEL,
> + &intf->urb_in->transfer_dma);
> +
> + if (!intf->in_data) {
> + return -ENOMEM;
> + goto err_free_urb;
> + }
[Severity: High]
Are these goto cleanup paths unreachable?
Returning -ENOMEM directly prevents the cleanup code from executing,
leaking the allocated URB on failure. The same unreachable pattern exists
in gip_init_output for err_free_urbs, where it leaks all previously allocated
URBs and DMA buffers in the output queue if memory allocation fails mid-loop.
> +
> + usb_fill_int_urb(intf->urb_in, udev,
[ ... ]
> +static int gip_probe(struct usb_interface *intf, const struct usb_device_id *id)
> +{
> + struct usb_device *udev = interface_to_usbdev(intf);
> + struct gip_device *gip = NULL;
> + struct gip_attachment *attachment;
> + int rc;
> +
> + if (intf->cur_altsetting->desc.bInterfaceNumber != GIP_WIRED_INTF_DATA) {
[ ... ]
> + }
> +
> + gip = devm_kzalloc(&udev->dev, sizeof(*gip), GFP_KERNEL);
[Severity: High]
Should this devm allocation be bound to the interface device (&intf->dev)
instead of the USB device (&udev->dev)?
By binding driver state to the USB device instead of the interface, the memory
is not freed when the driver unbinds from the interface (e.g., via sysfs).
This causes a persistent memory leak of driver structures and input devices
since devres actions attached to udev->dev will not fire on driver unbind.
> + if (!gip)
> + return -ENOMEM;
[ ... ]
> +static void gip_disconnect(struct usb_interface *intf)
> +{
> + struct gip_device *gip = usb_get_intfdata(intf);
> + int i;
> +
> + if (!gip)
> + return;
> +
> + gip_shutdown(gip);
> +
> + usb_kill_urb(gip->data.urb_in);
[Severity: High]
Does this workqueue teardown order introduce a Use-After-Free?
gip_shutdown(gip) synchronously cancels the receive workqueue, but the input
URBs are killed afterward. If an input URB completes in the window between
cancel_work_sync and usb_kill_urb, the completion handler gip_urb_in
will reschedule the work again. gip_disconnect will proceed to free the
structures, leading to a UAF when the rescheduled work executes.
> + usb_kill_anchored_urbs(&gip->data.out_anchor);
[ ... ]
> + for (i = 0; i < MAX_ATTACHMENTS; i++) {
> + struct gip_attachment *attachment = gip->attachments[i];
> +
> + if (!attachment)
> + continue;
> +
> + gip_reset_attachment(attachment);
> + gip_reset_metadata(attachment);
> +
> + devm_kfree(to_gip_device(attachment), attachment->uniq);
> + devm_kfree(to_gip_device(attachment), attachment);
> + }
[Severity: High]
Can manually freeing the attachment struct cause a UAF with concurrent sysfs access?
Since input_dev devres was bound to &udev->dev, sysfs nodes (such as battery
or LED properties) remain active even after unbind. Manually freeing the container
structure here creates a window where a concurrent sysfs read could access the freed
attachment structure (e.g., locking the freed battery_lock).
> +
> + devm_kfree(to_gip_device(gip), gip);
> +}
> +
> +static int gip_suspend(struct usb_interface *intf, pm_message_t message)
> +{
> + struct gip_device *gip = usb_get_intfdata(intf);
> +
> + if (!gip)
> + return 0;
> +
> + usb_kill_urb(gip->data.urb_in);
[ ... ]
> + if (gip->attachments[0]) {
> + struct gip_attachment *attachment = gip->attachments[0];
> +
> + guard(mutex)(&attachment->lock);
> + gip_send_set_device_state(attachment, GIP_STATE_OFF);
> + attachment->device_state = GIP_STATE_OFF;
> + }
> +
> + return gip_shutdown(gip);
> +}
[Severity: High]
Is it intended that system suspend destroys the userspace-visible nodes?
Calling gip_shutdown(gip) completely destroys the driver state and unconditionally
unregisters the input_dev and hid_device via gip_free_devices(). When the
system resumes, these devices are not recreated, permanently breaking any running
applications holding evdev or hidraw file descriptors.
[Severity: High]
Does intermediate message fragment transmission fail to advance fragment_offset?
If an intermediate fragment is sent, it will not have GIP_FLAG_ACME set, so
the device never sends an ACK, and the fragment might not be marked as acked.
If the offset is only advanced when fragment->acked is true, the driver will
repeatedly resend the identical chunk indefinitely, causing an infinite loop
that stalls transmission for any message exceeding the MTU limit.
[Severity: High]
Can a manual power_supply_unregister on a devm-managed resource cause a double free?
If the power supply is created with devm_power_supply_register() and later
manually unregistered in an error path (e.g., if power_supply_powers() fails),
the devres framework remains unaware and will attempt to unregister it again
during teardown, resulting in a double-free kernel panic.
--
Sashiko AI review · https://sashiko.dev/#/patchset/20260902010237.865772-1-vi@endrift.com?part=1
^ permalink raw reply [flat|nested] 22+ messages in thread
* Re: [PATCH v5 12/12] Input: xbox_gip - Add wheel support
2026-09-02 1:02 ` [PATCH v5 12/12] Input: xbox_gip - Add wheel support Vicki Pfau
@ 2026-09-02 1:33 ` sashiko-bot
0 siblings, 0 replies; 22+ messages in thread
From: sashiko-bot @ 2026-09-02 1:33 UTC (permalink / raw)
To: Vicki Pfau; +Cc: linux-input, dmitry.torokhov
Thank you for your contribution! Sashiko AI review found 3 potential issue(s) to consider:
New issues:
- [Medium] Improper wrap-around calculation for REL_DIAL in TrueForce wheel driver.
- [Medium] Packet length validation happens after partial event reporting, causing input event desync on short packets.
Pre-existing issues:
- [Critical] Workqueues are synchronously cancelled before killing URBs in gip_disconnect, causing a Use-After-Free.
--
commit f290772c9ca66efd1e7d5ec4dd73e7af098deefd
Author: Vicki Pfau <vi@endrift.com>
Input: xbox_gip - Add wheel support
This adds preliminary support for racing wheel support in xbox_gip,
exposing them mapped to the newly added axes.
> diff --git a/drivers/input/joystick/gip/gip-wheel.c b/drivers/input/joystick/gip/gip-wheel.c
> new file mode 100644
> --- /dev/null
> +++ b/drivers/input/joystick/gip/gip-wheel.c
[ ... ]
> +static int gip_handle_wheel_report(struct gip_attachment *attachment,
> + struct input_dev *input, const uint8_t *bytes, int num_bytes)
> +{
> + uint8_t connections;
> + struct gip_wheel_info *info = attachment->driver_data;
> + int rc = gip_driver_navigation.handle_input_report(attachment, input, bytes, num_bytes);
> +
> + if (rc < 0)
> + return rc;
> +
> + if (!info)
> + return -ENODEV;
> +
> + if (num_bytes < 17)
> + return -EINVAL;
[Severity: Medium]
Does this cause input events to be desynced on short packets?
If a short packet arrives (between 2 and 16 bytes), the base navigation handler
above successfully processes the first bytes and queues events. The length
check here then fails and returns -EINVAL, which causes an early exit before
the core can call input_sync().
This could leave the device in an inconsistent state with phantom inputs or
stuck keys until the next valid packet arrives.
[ ... ]
> +static int gip_handle_trueforce_wheel_report(struct gip_attachment *attachment,
> + struct input_dev *input, const uint8_t *bytes, int num_bytes)
> +{
> + int rc = gip_driver_wheel.handle_input_report(attachment, input, bytes, num_bytes);
> + struct gip_trueforce_wheel_state *state = attachment->driver_data;
> + int dial;
> +
> + if (rc < 0)
> + return rc;
> +
> + if (num_bytes < 18)
> + return -EINVAL;
[Severity: Medium]
Similarly, does this early return skip input synchronization for short packets?
Like the base wheel handler, events are queued by
gip_driver_wheel.handle_input_report() before this check fails.
[ ... ]
> + if (dial == 0 && state->dial == 7)
> + input_report_rel(input, REL_DIAL, -1);
> + else if (dial == 7 && state->dial == 0)
> + input_report_rel(input, REL_DIAL, 1);
> + else
> + input_report_rel(input, REL_DIAL,
> + state->dial - dial);
> + state->dial = dial;
> +
> + return 0;
> +}
[Severity: Medium]
Can this calculation magnify offsets if the dial is turned quickly?
If the wheel's dial is turned fast enough to jump multiple steps between USB
reports (e.g., from 6 to 0, crossing the boundary), this falls through the
1-step boundary checks.
The fallback calculation of state->dial - dial would then result in a
reported offset of 6 (6 - 0) instead of the actual -2 steps taken.
As a quick aside, I noticed a separate issue in the core code while reviewing:
[Severity: Critical]
This is a pre-existing issue, but does gip_disconnect() have a Use-After-Free
race window during device unbind?
drivers/input/joystick/gip/gip-core.c:gip_disconnect() {
...
gip_shutdown(gip);
usb_kill_urb(gip->data.urb_in);
...
}
Since workqueues are synchronously cancelled in gip_shutdown() before calling
usb_kill_urb(), if an URB completes in that window, its completion handler
can reschedule the work on memory that is actively being torn down.
--
Sashiko AI review · https://sashiko.dev/#/patchset/20260902010237.865772-1-vi@endrift.com?part=12
^ permalink raw reply [flat|nested] 22+ messages in thread
end of thread, other threads:[~2026-09-02 1:33 UTC | newest]
Thread overview: 22+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-09-02 1:02 [PATCH v5 00/12] Input: xbox_gip - Add new driver for Xbox GIP Vicki Pfau
2026-09-02 1:02 ` [PATCH v5 01/12] " Vicki Pfau
2026-09-02 1:28 ` sashiko-bot
2026-09-02 1:02 ` [PATCH v5 02/12] Input: xpad - Remove Xbox One support Vicki Pfau
2026-09-02 1:02 ` [PATCH v5 03/12] Input: xbox_gip - Add controllable LED support Vicki Pfau
2026-09-02 1:20 ` sashiko-bot
2026-09-02 1:02 ` [PATCH v5 04/12] Input: xbox_gip - Add HID relaying Vicki Pfau
2026-09-02 1:22 ` sashiko-bot
2026-09-02 1:02 ` [PATCH v5 05/12] Input: xbox_gip - Add battery support Vicki Pfau
2026-09-02 1:20 ` sashiko-bot
2026-09-02 1:02 ` [PATCH v5 06/12] Input: xbox_gip - Allow sending fragmented and ACME messages Vicki Pfau
2026-09-02 1:19 ` sashiko-bot
2026-09-02 1:02 ` [PATCH v5 07/12] Input: xbox_gip - Add security implementation from xone Vicki Pfau
2026-09-02 1:20 ` sashiko-bot
2026-09-02 1:02 ` [PATCH v5 08/12] Input: xbox_gip - Add arcade stick support Vicki Pfau
2026-09-02 1:24 ` sashiko-bot
2026-09-02 1:02 ` [PATCH v5 09/12] Input: xbox_gip - Add support for PDP guitar controllers Vicki Pfau
2026-09-02 1:02 ` [PATCH v5 10/12] Input: Add ABS_CLUTCH, HANDBRAKE, and SHIFTER Vicki Pfau
2026-09-02 1:23 ` sashiko-bot
2026-09-02 1:02 ` [PATCH v5 11/12] HID: Map more automobile simulation inputs Vicki Pfau
2026-09-02 1:02 ` [PATCH v5 12/12] Input: xbox_gip - Add wheel support Vicki Pfau
2026-09-02 1:33 ` sashiko-bot
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).