* [PATCH v6 00/12] Input: xbox_gip - Add new driver for Xbox GIP
@ 2026-09-08 3:21 Vicki Pfau
2026-09-08 3:21 ` [PATCH v6 01/12] " Vicki Pfau
` (11 more replies)
0 siblings, 12 replies; 23+ messages in thread
From: Vicki Pfau @ 2026-09-08 3:21 UTC (permalink / raw)
To: Dmitry Torokhov, linux-input; +Cc: Vicki Pfau
This is a new version of the previously submitted xbox-gip series.
This introduces a new driver for the Xbox One/Series controller protocol,
officially known as the Gaming Input Protocol, or GIP for short.
Microsoft released documentation on (some of) GIP in late 2024, upon which
this driver is based. Though the documentation was incomplete, it still
provided enough information to warrant a clean start over the previous,
incomplete implementation.
This driver is already at feature parity with the GIP support in xpad,
along with several more enhancements:
- Proper support for parsing message length and fragmented messages
- Metadata parsing, allowing for auto-detection on various parameters,
including the presence and location in the message of the share button,
as well as detection of specific device types
- Controllable LED support
- HID passthrough for the Chatpad
- Battery information support
- Arcade stick support
- Racing wheel support
- Support for the security flow, allowing use with wireless controllers
that include their own dongles. (This does not include support for the
first-party dongle yet.)
The framework set out in this driver also allows future expansion for
specialized device types and additional features more cleanly than xpad.
Future plans include:
- Adding support for more device types, such as flight sticks.
- Exposing a raw character device to enable sending vendor-specific
commands from userspace.
- Event logging to either sysfs or dmesg.
- Support for the headphone jack.
This version cleans up more issues found by sashiko as well as some smaller
refactoring to clean up reused code.
Vicki Pfau (12):
Input: xbox_gip - Add new driver for Xbox GIP
Input: xpad - Remove Xbox One support
Input: xbox_gip - Add controllable LED support
Input: xbox_gip - Add HID relaying
Input: xbox_gip - Add battery support
Input: xbox_gip - Allow sending fragmented and ACME messages
Input: xbox_gip - Add security implementation from xone
Input: xbox_gip - Add arcade stick support
Input: xbox_gip - Add support for PDP guitar controllers
Input: Add ABS_CLUTCH, HANDBRAKE, and SHIFTER
HID: Map more automobile simulation inputs
Input: xbox_gip - Add wheel support
Documentation/input/devices/xpad.rst | 17 +-
MAINTAINERS | 6 +
drivers/hid/hid-debug.c | 16 +-
drivers/hid/hid-input.c | 2 +
drivers/input/joystick/Kconfig | 2 +
drivers/input/joystick/Makefile | 1 +
drivers/input/joystick/gip/Kconfig | 22 +
drivers/input/joystick/gip/Makefile | 8 +
drivers/input/joystick/gip/gip-arcade-stick.c | 173 +
drivers/input/joystick/gip/gip-core.c | 3281 +++++++++++++++++
drivers/input/joystick/gip/gip-drivers.c | 222 ++
drivers/input/joystick/gip/gip-pdp-jaguar.c | 129 +
drivers/input/joystick/gip/gip-security.c | 807 ++++
drivers/input/joystick/gip/gip-wheel.c | 350 ++
drivers/input/joystick/gip/gip.h | 434 +++
drivers/input/joystick/xpad.c | 684 +---
include/uapi/linux/input-event-codes.h | 3 +
include/uapi/linux/input.h | 1 +
18 files changed, 5461 insertions(+), 697 deletions(-)
create mode 100644 drivers/input/joystick/gip/Kconfig
create mode 100644 drivers/input/joystick/gip/Makefile
create mode 100644 drivers/input/joystick/gip/gip-arcade-stick.c
create mode 100644 drivers/input/joystick/gip/gip-core.c
create mode 100644 drivers/input/joystick/gip/gip-drivers.c
create mode 100644 drivers/input/joystick/gip/gip-pdp-jaguar.c
create mode 100644 drivers/input/joystick/gip/gip-security.c
create mode 100644 drivers/input/joystick/gip/gip-wheel.c
create mode 100644 drivers/input/joystick/gip/gip.h
--
2.54.0
^ permalink raw reply [flat|nested] 23+ messages in thread
* [PATCH v6 01/12] Input: xbox_gip - Add new driver for Xbox GIP
2026-09-08 3:21 [PATCH v6 00/12] Input: xbox_gip - Add new driver for Xbox GIP Vicki Pfau
@ 2026-09-08 3:21 ` Vicki Pfau
2026-09-08 3:44 ` sashiko-bot
2026-09-08 3:21 ` [PATCH v6 02/12] Input: xpad - Remove Xbox One support Vicki Pfau
` (10 subsequent siblings)
11 siblings, 1 reply; 23+ messages in thread
From: Vicki Pfau @ 2026-09-08 3:21 UTC (permalink / raw)
To: Dmitry Torokhov, linux-input; +Cc: Vicki Pfau
This introduces a new driver for the Xbox One/Series controller protocol,
officially known as the Gaming Input Protocol, or GIP for short.
Microsoft released documentation on (some of) GIP in late 2024, upon which
this driver is based. Though the documentation was incomplete, it still
provided enough information to warrant a clean start over the previous,
incomplete implementation.
This driver is already at feature parity with the GIP support in xpad,
along with several more enhancements:
- Proper support for parsing message length and fragmented messages
- Metadata parsing, allowing for auto-detection on various parameters,
including the presence and location in the message of the share button,
as well as detection of specific device types
The framework set out in this driver also allows future expansion for
specialized device types and additional features more cleanly than xpad.
Future plans include:
- Adding support for more device types, such as arcade sticks, racing
wheels and flight sticks.
- Support for the security handshake, which is required for devices that
use wireless dongles.
- Exposing a raw character device to enable sending vendor-specific
commands from userspace.
- Event logging to either sysfs or dmesg.
- Support for the headphone jack.
Signed-off-by: Vicki Pfau <vi@endrift.com>
---
MAINTAINERS | 6 +
drivers/input/joystick/Kconfig | 2 +
drivers/input/joystick/Makefile | 1 +
drivers/input/joystick/gip/Kconfig | 21 +
drivers/input/joystick/gip/Makefile | 4 +
drivers/input/joystick/gip/gip-core.c | 2591 ++++++++++++++++++++++
drivers/input/joystick/gip/gip-drivers.c | 204 ++
drivers/input/joystick/gip/gip.h | 344 +++
8 files changed, 3173 insertions(+)
create mode 100644 drivers/input/joystick/gip/Kconfig
create mode 100644 drivers/input/joystick/gip/Makefile
create mode 100644 drivers/input/joystick/gip/gip-core.c
create mode 100644 drivers/input/joystick/gip/gip-drivers.c
create mode 100644 drivers/input/joystick/gip/gip.h
diff --git a/MAINTAINERS b/MAINTAINERS
index 806bd2d80d15..7fdf1b989667 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -29347,6 +29347,12 @@ S: Maintained
F: drivers/media/rc/keymaps/rc-xbox-dvd.c
F: drivers/media/rc/xbox_remote.c
+XBOX GIP
+M: Vicki Pfau <vi@endrift.com>
+L: linux-input@vger.kernel.org
+S: Maintained
+F: drivers/input/joystick/gip/
+
XC2028/3028 TUNER DRIVER
M: Mauro Carvalho Chehab <mchehab@kernel.org>
L: linux-media@vger.kernel.org
diff --git a/drivers/input/joystick/Kconfig b/drivers/input/joystick/Kconfig
index 7755e5b454d2..d4665c80a371 100644
--- a/drivers/input/joystick/Kconfig
+++ b/drivers/input/joystick/Kconfig
@@ -291,6 +291,8 @@ config JOYSTICK_JOYDUMP
To compile this driver as a module, choose M here: the
module will be called joydump.
+source "drivers/input/joystick/gip/Kconfig"
+
config JOYSTICK_XPAD
tristate "Xbox gamepad support"
depends on USB_ARCH_HAS_HCD
diff --git a/drivers/input/joystick/Makefile b/drivers/input/joystick/Makefile
index 9976f596a920..323392921b7d 100644
--- a/drivers/input/joystick/Makefile
+++ b/drivers/input/joystick/Makefile
@@ -39,5 +39,6 @@ obj-$(CONFIG_JOYSTICK_TURBOGRAFX) += turbografx.o
obj-$(CONFIG_JOYSTICK_TWIDJOY) += twidjoy.o
obj-$(CONFIG_JOYSTICK_WARRIOR) += warrior.o
obj-$(CONFIG_JOYSTICK_WALKERA0701) += walkera0701.o
+obj-$(CONFIG_JOYSTICK_XBOX_GIP) += gip/
obj-$(CONFIG_JOYSTICK_XPAD) += xpad.o
obj-$(CONFIG_JOYSTICK_ZHENHUA) += zhenhua.o
diff --git a/drivers/input/joystick/gip/Kconfig b/drivers/input/joystick/gip/Kconfig
new file mode 100644
index 000000000000..2ce789d23178
--- /dev/null
+++ b/drivers/input/joystick/gip/Kconfig
@@ -0,0 +1,21 @@
+# SPDX-License-Identifier: GPL-2.0-or-later
+#
+# Gaming Input Protocol driver configuration
+#
+config JOYSTICK_XBOX_GIP
+ tristate "Xbox One/Series controller support"
+ depends on USB && USB_ARCH_HAS_HCD
+ help
+ Say Y here if you want to use Xbox One and Series controllers with your
+ computer. Make sure to say Y to "Joystick support" (CONFIG_INPUT_JOYDEV)
+ and/or "Event interface support" (CONFIG_INPUT_EVDEV) as well.
+
+ To compile this driver as a module, choose M here: the
+ module will be called xbox_gip.
+
+config JOYSTICK_XBOX_GIP_FF
+ bool "Xbox One/Series controller rumble support"
+ depends on JOYSTICK_XBOX_GIP && INPUT
+ select INPUT_FF_MEMLESS
+ help
+ Say Y here if you want to take advantage of Xbox One/Series rumble.
diff --git a/drivers/input/joystick/gip/Makefile b/drivers/input/joystick/gip/Makefile
new file mode 100644
index 000000000000..d39f946db1ae
--- /dev/null
+++ b/drivers/input/joystick/gip/Makefile
@@ -0,0 +1,4 @@
+# SPDX-License-Identifier: GPL-2.0-or-later
+obj-$(CONFIG_JOYSTICK_XBOX_GIP) += xbox-gip.o
+# Base driver
+xbox-gip-y := gip-core.o gip-drivers.o
diff --git a/drivers/input/joystick/gip/gip-core.c b/drivers/input/joystick/gip/gip-core.c
new file mode 100644
index 000000000000..0e23811a6ecc
--- /dev/null
+++ b/drivers/input/joystick/gip/gip-core.c
@@ -0,0 +1,2591 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+/*
+ * Gaming Input Protocol driver for Xbox One/Series controllers
+ *
+ * Copyright (c) 2025 Valve Software
+ *
+ * TODO:
+ * - Audio device support
+ * - Security packet handshake
+ * - Event logging
+ * - Sending fragmented messages
+ * - Raw character device
+ * - Wheel support
+ * - Flight stick support
+ * - Arcade stick support
+ * - Split into driver-per-attachment GIP-as-a-bus approach drivers
+ *
+ * This driver is based on the Microsoft GIP spec at:
+ * https://aka.ms/gipdocs
+ * https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-gipusb/e7c90904-5e21-426e-b9ad-d82adeee0dbc
+ */
+
+#include <linux/module.h>
+#include <linux/unaligned.h>
+#include <linux/uuid.h>
+#include "gip.h"
+
+#define GIP_WIRED_INTF_DATA 0
+#define GIP_WIRED_INTF_AUDIO 1
+
+#define MAX_MESSAGE_LENGTH 0x4000
+
+#define MAX_AUDIO_MESSAGES 9
+
+#define GIP_DATA_CLASS_COMMAND (0u << 5)
+#define GIP_DATA_CLASS_LOW_LATENCY (1u << 5)
+#define GIP_DATA_CLASS_STANDARD_LATENCY (2u << 5)
+#define GIP_DATA_CLASS_AUDIO (3u << 5)
+
+#define GIP_DATA_CLASS_SHIFT 5
+#define GIP_DATA_CLASS_MASK (7u << 5)
+
+/* Undocumented Elite 2 vendor messages */
+#define GIP_CMD_RAW_REPORT 0x0c
+#define GIP_CMD_GUIDE_COLOR 0x0e
+#define GIP_SL_ELITE_CONFIG 0x4d
+
+#define GIP_BTN_OFFSET_XBE1 28
+#define GIP_BTN_OFFSET_XBE2 14
+
+#define GIP_AUDIO_FORMAT_NULL 0
+#define GIP_AUDIO_FORMAT_8000HZ_1CH 1
+#define GIP_AUDIO_FORMAT_8000HZ_2CH 2
+#define GIP_AUDIO_FORMAT_12000HZ_1CH 3
+#define GIP_AUDIO_FORMAT_12000HZ_2CH 4
+#define GIP_AUDIO_FORMAT_16000HZ_1CH 5
+#define GIP_AUDIO_FORMAT_16000HZ_2CH 6
+#define GIP_AUDIO_FORMAT_20000HZ_1CH 7
+#define GIP_AUDIO_FORMAT_20000HZ_2CH 8
+#define GIP_AUDIO_FORMAT_24000HZ_1CH 9
+#define GIP_AUDIO_FORMAT_24000HZ_2CH 10
+#define GIP_AUDIO_FORMAT_32000HZ_1CH 11
+#define GIP_AUDIO_FORMAT_32000HZ_2CH 12
+#define GIP_AUDIO_FORMAT_40000HZ_1CH 13
+#define GIP_AUDIO_FORMAT_40000HZ_2CH 14
+#define GIP_AUDIO_FORMAT_48000HZ_1CH 15
+#define GIP_AUDIO_FORMAT_48000HZ_2CH 16
+#define GIP_AUDIO_FORMAT_48000HZ_6CH 32
+#define GIP_AUDIO_FORMAT_48000HZ_8CH 33
+#define MAX_GIP_AUDIO_FORMAT GIP_AUDIO_FORMAT_48000HZ_8CH
+
+/* Protocol Control constants */
+#define GIP_CONTROL_CODE_ACK 0
+#define GIP_CONTROL_CODE_NACK 1 /* obsolete */
+#define GIP_CONTROL_CODE_UNK 2 /* obsolete */
+#define GIP_CONTROL_CODE_AB 3 /* obsolete */
+#define GIP_CONTROL_CODE_MPER 4 /* obsolete */
+#define GIP_CONTROL_CODE_STOP 5 /* obsolete */
+#define GIP_CONTROL_CODE_START 6 /* obsolete */
+#define GIP_CONTROL_CODE_ERR 7 /* obsolete */
+
+/* Status Device constants */
+#define GIP_POWER_LEVEL_OFF 0
+#define GIP_POWER_LEVEL_STANDBY 1 /* obsolete */
+#define GIP_POWER_LEVEL_FULL 2
+
+#define GIP_NOT_CHARGING 0
+#define GIP_CHARGING 1
+#define GIP_CHARGE_ERROR 2
+
+#define GIP_BATTERY_ABSENT 0
+#define GIP_BATTERY_STANDARD 1
+#define GIP_BATTERY_RECHARGEABLE 2
+
+#define GIP_BATTERY_CRITICAL 0
+#define GIP_BATTERY_LOW 1
+#define GIP_BATTERY_MEDIUM 2
+#define GIP_BATTERY_FULL 3
+
+#define GIP_EVENT_FAULT 0x0002
+
+#define GIP_FAULT_UNKNOWN 0
+#define GIP_FAULT_HARD 1
+#define GIP_FAULT_NMI 2
+#define GIP_FAULT_SVC 3
+#define GIP_FAULT_PEND_SV 4
+#define GIP_FAULT_SMART_PTR 5
+#define GIP_FAULT_MCU 6
+#define GIP_FAULT_BUS 7
+#define GIP_FAULT_USAGE 8
+#define GIP_FAULT_RADIO_HANG 9
+#define GIP_FAULT_WATCHDOG 10
+#define GIP_FAULT_LINK_STALL 11
+#define GIP_FAULT_ASSERTION 12
+
+/* Metadata constants */
+#define GIP_MESSAGE_FLAG_BIG_ENDIAN BIT(0)
+#define GIP_MESSAGE_FLAG_RELIABLE BIT(1)
+#define GIP_MESSAGE_FLAG_SEQUENCED BIT(2)
+#define GIP_MESSAGE_FLAG_DOWNSTREAM BIT(3)
+#define GIP_MESSAGE_FLAG_UPSTREAM BIT(4)
+#define GIP_MESSAGE_FLAG_DS_REQUEST_RESPONSE BIT(5)
+
+#define GIP_DATA_TYPE_CUSTOM 1
+#define GIP_DATA_TYPE_AUDIO 2
+#define GIP_DATA_TYPE_SECURITY 3
+#define GIP_DATA_TYPE_GIP 4
+
+/* Set Device State constants */
+#define GIP_STATE_START 0
+#define GIP_STATE_STOP 1
+#define GIP_STATE_STANDBY 2 /* obsolete */
+#define GIP_STATE_FULL_POWER 3
+#define GIP_STATE_OFF 4
+#define GIP_STATE_QUIESCE 5
+#define GIP_STATE_UNK6 6
+#define GIP_STATE_RESET 7
+
+/* Guide Button Status constants */
+#define GIP_LED_GUIDE 0
+#define GIP_LED_IR 1 /* deprecated, for Kinect */
+
+#define GIP_LED_GUIDE_OFF 0
+#define GIP_LED_GUIDE_ON 1
+#define GIP_LED_GUIDE_FAST_BLINK 2
+#define GIP_LED_GUIDE_SLOW_BLINK 3
+#define GIP_LED_GUIDE_CHARGING_BLINK 4
+#define GIP_LED_GUIDE_RAMP_TO_LEVEL 0xd
+
+#define GIP_LED_IR_OFF 0
+#define GIP_LED_IR_ON_100MS 1
+#define GIP_LED_IR_PATTERN 4
+
+/* Direct Motor Command constants */
+#define GIP_MOTOR_RIGHT_VIBRATION BIT(0)
+#define GIP_MOTOR_LEFT_VIBRATION BIT(1)
+#define GIP_MOTOR_RIGHT_IMPULSE BIT(2)
+#define GIP_MOTOR_LEFT_IMPULSE BIT(3)
+#define GIP_MOTOR_ALL 0xf
+
+/* Extended Command constants */
+#define GIP_EXTCMD_GET_CAPABILITIES 0x00
+#define GIP_EXTCMD_GET_TELEMETRY_DATA 0x01
+#define GIP_EXTCMD_GET_SERIAL_NUMBER 0x04
+
+#define GIP_EXTENDED_STATUS_OK 0
+#define GIP_EXTENDED_STATUS_NOT_SUPPORTED 1
+#define GIP_EXTENDED_STATUS_NOT_READY 2
+#define GIP_EXTENDED_STATUS_ACCESS_DENIED 3
+#define GIP_EXTENDED_STATUS_FAILED 4
+
+/* Internal constants, not part of protocol */
+#define GIP_DEFAULT_IN_SYSTEM_MESSAGES 0x5e
+#define GIP_DEFAULT_OUT_SYSTEM_MESSAGES 0x472
+
+#define GIP_LED_GUIDE_MAX_BRIGHTNESS 100 /* Spec says 47, but larger values work */
+#define GIP_LED_GUIDE_INIT_BRIGHTNESS 20
+
+#ifndef VK_LWIN
+#define VK_LWIN 0x5b
+#endif
+
+static const guid_t guid_console_function_map =
+ GUID_INIT(0xecddd2fe, 0xd387, 0x4294, 0xbd, 0x96, 0x1a, 0x71, 0x2e, 0x3d, 0xc7, 0x7d);
+static const guid_t guid_console_function_map_overflow =
+ GUID_INIT(0x137d4bd0, 0x9347, 0x4472, 0xaa, 0x26, 0x8c, 0x34, 0xa0, 0x8f, 0xf9, 0xbd);
+static const guid_t guid_controller =
+ GUID_INIT(0x9776ff56, 0x9bfd, 0x4581, 0xad, 0x45, 0xb6, 0x45, 0xbb, 0xa5, 0x26, 0xd6);
+static const guid_t guid_dev_auth_pc_opt_out =
+ GUID_INIT(0x7a34ce77, 0x7de2, 0x45c6, 0x8c, 0xa4, 0x00, 0x42, 0xc0, 0x8b, 0xd9, 0x4a);
+static const guid_t guid_dynamic_latency_input =
+ GUID_INIT(0x87f2e56b, 0xc3bb, 0x49b1, 0x82, 0x65, 0xff, 0xff, 0xf3, 0x77, 0x99, 0xee);
+static const guid_t guid_elite_buttons =
+ GUID_INIT(0x37d19ff7, 0xb5c6, 0x49d1, 0xa7, 0x5e, 0x03, 0xb2, 0x4b, 0xef, 0x8c, 0x89);
+static const guid_t guid_headset =
+ GUID_INIT(0xbc25d1a3, 0xc24e, 0x4992, 0x9d, 0xda, 0xef, 0x4f, 0x12, 0x3e, 0xf5, 0xdc);
+
+/*
+ * The following GUIDs are observed, but the exact meanings aren't known, so
+ * for now we document them but don't use them anywhere.
+ *
+ * GamepadEmu:
+ * GUID_INIT(0xe2e5f1bc, 0xa6e6, 0x41a2, 0x8f, 0x43, 0x33, 0xcf, 0xa2, 0x51, 0x09, 0x81)
+ * IAudioOnly:
+ * GUID_INIT(0x92844cd1, 0xf7c8, 0x49ef, 0x97, 0x77, 0x46, 0x7d, 0xa7, 0x08, 0xad, 0x10)
+ * IControllerProfileModeState:
+ * GUID_INIT(0xf758dc66, 0x022c, 0x48b8, 0xa4, 0xf6, 0x45, 0x7b, 0xa8, 0x0e, 0x2a, 0x5b)
+ * ICustomAudio:
+ * GUID_INIT(0x63fd9cc9, 0x94ee, 0x4b5d, 0x9c, 0x4d, 0x8b, 0x86, 0x4c, 0x14, 0x9c, 0xac)
+ * IExtendedDeviceFlags:
+ * GUID_INIT(0x34ad9b1e, 0x36ad, 0x4fb5, 0x8a, 0xc7, 0x17, 0x23, 0x4c, 0x9f, 0x54, 0x6f)
+ * IProgrammableGamepad:
+ * GUID_INIT(0x31c1034d, 0xb5b7, 0x4551, 0x98, 0x13, 0x87, 0x69, 0xd4, 0xa0, 0xe4, 0xf9)
+ * IVirtualDevice:
+ * GUID_INIT(0xdfd26825, 0x110a, 0x4e94, 0xb9, 0x37, 0xb2, 0x7c, 0xe4, 0x7b, 0x25, 0x40)
+ * OnlineDevAuth:
+ * GUID_INIT(0x632b1fd1, 0xa3e9, 0x44f9, 0x84, 0x20, 0x5c, 0xe3, 0x44, 0xa0, 0x64, 0x04)
+ *
+ * Seen on Elite Controller, Adaptive Controller: 9ebd00a3-b5e6-4c08-a33b-673126459ec4
+ * Seen on Adaptive Controller: ce1e58c5-221c-4bdb-9c24-bf3941601320
+ * Seen on Adaptive Joystick: db02f681-5038-4219-8668-c3459c5c3293
+ * Seen on Elite 2 Controller: f758dc66-022c-48b8-a4f6-457ba80e2a5b (IControllerProfileModeState)
+ * Seen on Elite 2 Controller: 31c1034d-b5b7-4551-9813-8769d4a0e4f9 (IProgrammableGamepad)
+ * Seen on Elite 2 Controller: 34ad9b1e-36ad-4fb5-8ac7-17234c9f546f (IExtendedDeviceFlags)
+ * Seen on Elite 2 Controller: 88e0b694-6bd9-4416-a560-e7fafdfa528f
+ * Seen on Elite 2 Controller: ea96c8c0-b216-448b-be80-7e5deb0698e2
+ */
+
+static const int gip_data_class_mtu[8] = { 64, 64, 64, 2048, 0, 0, 0, 0 };
+
+struct gip_audio_format {
+ uint16_t rate;
+ uint8_t channels;
+};
+
+static const struct gip_audio_format gip_audio_format_table[MAX_GIP_AUDIO_FORMAT + 1] = {
+ [GIP_AUDIO_FORMAT_8000HZ_1CH] = { .rate = 8000, .channels = 1 },
+ [GIP_AUDIO_FORMAT_8000HZ_2CH] = { .rate = 8000, .channels = 2 },
+ [GIP_AUDIO_FORMAT_12000HZ_1CH] = { .rate = 12000, .channels = 1 },
+ [GIP_AUDIO_FORMAT_12000HZ_2CH] = { .rate = 12000, .channels = 2 },
+ [GIP_AUDIO_FORMAT_16000HZ_1CH] = { .rate = 16000, .channels = 1 },
+ [GIP_AUDIO_FORMAT_16000HZ_2CH] = { .rate = 16000, .channels = 2 },
+ [GIP_AUDIO_FORMAT_20000HZ_1CH] = { .rate = 20000, .channels = 1 },
+ [GIP_AUDIO_FORMAT_20000HZ_2CH] = { .rate = 20000, .channels = 2 },
+ [GIP_AUDIO_FORMAT_24000HZ_1CH] = { .rate = 24000, .channels = 1 },
+ [GIP_AUDIO_FORMAT_24000HZ_2CH] = { .rate = 24000, .channels = 2 },
+ [GIP_AUDIO_FORMAT_32000HZ_1CH] = { .rate = 32000, .channels = 1 },
+ [GIP_AUDIO_FORMAT_32000HZ_2CH] = { .rate = 32000, .channels = 2 },
+ [GIP_AUDIO_FORMAT_40000HZ_1CH] = { .rate = 40000, .channels = 1 },
+ [GIP_AUDIO_FORMAT_40000HZ_2CH] = { .rate = 40000, .channels = 2 },
+ [GIP_AUDIO_FORMAT_48000HZ_1CH] = { .rate = 48000, .channels = 1 },
+ [GIP_AUDIO_FORMAT_48000HZ_2CH] = { .rate = 48000, .channels = 2 },
+ [GIP_AUDIO_FORMAT_48000HZ_6CH] = { .rate = 48000, .channels = 6 },
+ [GIP_AUDIO_FORMAT_48000HZ_8CH] = { .rate = 48000, .channels = 8 },
+};
+
+
+static const struct gip_quirks base_quirks[] = {
+ { GIP_VID_PDP, GIP_PID_PDP_ROCK_CANDY, 0, .quirks = GIP_QUIRK_NO_HELLO },
+
+ {0},
+};
+
+struct gip_audio_format_pair {
+ uint8_t inbound;
+ uint8_t outbound;
+};
+static_assert(sizeof(struct gip_audio_format_pair) == 2);
+
+struct gip_protocol_control_ack {
+ uint8_t control_code;
+ uint8_t message_type;
+ uint8_t flags;
+ __le32 fragment_offset;
+ __le16 remaining_buffer;
+} __packed;
+static_assert(sizeof(struct gip_protocol_control_ack) == 9);
+
+struct gip_hello_device {
+ __le64 device_id;
+ __le16 vendor_id;
+ __le16 product_id;
+ __le16 firmware_major_version;
+ __le16 firmware_minor_version;
+ __le16 firmware_build_version;
+ __le16 firmware_revision;
+ uint8_t hardware_major_version;
+ uint8_t hardware_minor_version;
+ uint8_t rf_proto_major_version;
+ uint8_t rf_proto_minor_version;
+ uint8_t security_major_version;
+ uint8_t security_minor_version;
+ uint8_t gip_major_version;
+ uint8_t gip_minor_version;
+} __packed;
+static_assert(sizeof(struct gip_hello_device) == 28);
+
+struct gip_device_metadata_header {
+ __le16 length;
+ uint8_t supports_device_firmware_versions_major;
+ uint8_t supports_device_firmware_versions_minor;
+ __le16 audio_offset;
+ __le16 supported_upstream_system_message_offset;
+ __le16 supported_downstream_system_message_offset;
+ __le16 preferred_types_offset;
+ __le16 supported_interfaces_offset;
+ __le16 hid_descriptor_offset;
+} __packed;
+
+struct gip_direct_motor {
+ uint8_t command;
+ uint8_t motor_bitmap;
+ uint8_t left_impulse_level;
+ uint8_t right_impulse_level;
+ uint8_t left_vibration_level;
+ uint8_t right_vibration_level;
+ uint8_t duration;
+ uint8_t delay;
+ uint8_t repeat;
+};
+
+static const struct gip_driver *base_drivers[] = {
+ &gip_driver_navigation,
+ &gip_driver_gamepad,
+ NULL /* Sentinel */
+};
+
+static int gip_decode_length(uint64_t *length, const uint8_t *bytes, int num_bytes)
+{
+ *length = 0;
+ int offset;
+
+ for (offset = 0; offset < num_bytes && offset < 9; offset++) {
+ uint8_t byte = bytes[offset];
+
+ *length |= (byte & 0x7full) << (offset * 7);
+ if (!(byte & 0x80)) {
+ offset++;
+ break;
+ }
+ }
+ return offset;
+}
+
+static int gip_encode_length(uint64_t length, uint8_t *bytes, int num_bytes)
+{
+ int offset;
+
+ for (offset = 0; offset < num_bytes; offset++) {
+ uint8_t byte = length & 0x7f;
+
+ length >>= 7;
+ if (length)
+ byte |= 0x80;
+ bytes[offset] = byte;
+ if (!length) {
+ offset++;
+ break;
+ }
+ }
+ return offset;
+}
+
+static bool gip_supports_system_message(struct gip_attachment *attachment,
+ uint8_t command, bool upstream)
+{
+ if (upstream)
+ return attachment->metadata.device
+ .in_system_messages[command >> 5] & BIT(command);
+ else
+ return attachment->metadata.device
+ .out_system_messages[command >> 5] & BIT(command);
+}
+
+bool gip_supports_vendor_message(struct gip_attachment *attachment,
+ uint8_t command, bool upstream)
+{
+ size_t i;
+
+ for (i = 0; i < attachment->metadata.num_messages; i++) {
+ struct gip_message_metadata *metadata =
+ &attachment->metadata.message_metadata[i];
+
+ if (metadata->type != command)
+ continue;
+ if (metadata->flags & GIP_MESSAGE_FLAG_DS_REQUEST_RESPONSE)
+ return true;
+
+ if (upstream)
+ return metadata->flags & GIP_MESSAGE_FLAG_UPSTREAM;
+ else
+ return metadata->flags & GIP_MESSAGE_FLAG_DOWNSTREAM;
+ }
+ return false;
+}
+
+static uint8_t gip_sequence_next(struct gip_attachment *attachment,
+ uint8_t command, bool system)
+{
+ uint8_t seq;
+
+ if (system) {
+ switch (command) {
+ case GIP_CMD_SECURITY:
+ seq = attachment->seq_security++;
+ if (!seq)
+ seq = attachment->seq_security++;
+ break;
+ case GIP_CMD_EXTENDED:
+ seq = attachment->seq_extended++;
+ if (!seq)
+ seq = attachment->seq_extended++;
+ break;
+ case GIP_AUDIO_DATA:
+ seq = attachment->seq_audio++;
+ if (!seq)
+ seq = attachment->seq_audio++;
+ break;
+ default:
+ seq = attachment->seq_system++;
+ if (!seq)
+ seq = attachment->seq_system++;
+ break;
+ }
+ } else {
+ seq = attachment->seq_vendor++;
+ if (!seq)
+ seq = attachment->seq_vendor++;
+ }
+ return seq;
+}
+
+static void gip_handle_quirks_array(struct gip_attachment *attachment,
+ const struct gip_quirks *quirks)
+{
+ size_t i, j;
+
+ for (i = 0; quirks[i].vendor_id; i++) {
+ if (quirks[i].vendor_id != attachment->vendor_id)
+ continue;
+ if (quirks[i].product_id != attachment->product_id)
+ continue;
+ if (quirks[i].attachment_index != attachment->attachment_index)
+ continue;
+
+ attachment->features |= quirks[i].added_features;
+ attachment->features &= ~quirks[i].filtered_features;
+ attachment->quirks |= quirks[i].quirks;
+
+ if (quirks[i].override_name)
+ attachment->name = quirks[i].override_name;
+
+ for (j = 0; j < 8; ++j) {
+ struct gip_device_metadata *metadata = &attachment->metadata.device;
+
+ metadata->in_system_messages[j] |= quirks[i].extra_in_system[j];
+ metadata->out_system_messages[j] |= quirks[i].extra_out_system[j];
+ }
+
+ attachment->extra_buttons = quirks[i].extra_buttons;
+ attachment->extra_axes = quirks[i].extra_axes;
+ break;
+ }
+
+}
+
+static void gip_handle_quirks(struct gip_attachment *attachment)
+{
+ gip_handle_quirks_array(attachment, base_quirks);
+
+ if (attachment->driver && attachment->driver->quirks)
+ gip_handle_quirks_array(attachment, attachment->driver->quirks);
+}
+
+static int gip_send_raw_message(struct gip_attachment *attachment,
+ uint8_t message_type, uint8_t flags, uint8_t seq, const uint8_t *bytes,
+ int num_bytes)
+{
+ struct gip_interface *intf;
+ int offset = 3;
+ struct gip_urb *urb = NULL;
+ int i;
+ int rc = 0;
+
+ if (num_bytes < 0) {
+ gip_warn(attachment, "Invalid message length %d\n", num_bytes);
+ return -EINVAL;
+ }
+
+ if (num_bytes + 6 > gip_data_class_mtu[message_type >> GIP_DATA_CLASS_SHIFT]) {
+ gip_err(attachment,
+ "Attempted to send a message that requires fragmenting, which is not yet supported.\n");
+ return -EOPNOTSUPP;
+ }
+
+ if ((message_type & GIP_DATA_CLASS_MASK) == GIP_DATA_CLASS_AUDIO)
+ intf = &attachment->device->audio;
+ else
+ intf = &attachment->device->data;
+
+ if (intf->isoc_messages) {
+ /* TODO: Needed for audio support */
+ gip_warn(intf, "Unimplemented isochronous message output\n");
+ return -EOPNOTSUPP;
+ }
+
+ guard(spinlock_irqsave)(&attachment->device->message_lock);
+ for (i = 0; i < MAX_OUT_MESSAGES && !urb; i++) {
+ if (!intf->out_queue[i].urb)
+ continue;
+ if (!intf->out_queue[i].urb->anchor)
+ urb = &intf->out_queue[i];
+ }
+ if (!urb) {
+ gip_err(attachment, "Output queue is full; dropping message\n");
+ return -ENOSPC;
+ }
+ urb->data[0] = message_type;
+ urb->data[1] = flags;
+ urb->data[2] = seq;
+ offset += gip_encode_length(num_bytes, &urb->data[offset],
+ sizeof(urb->data) - offset);
+
+ if (num_bytes > 0)
+ memcpy(&urb->data[offset], bytes, num_bytes);
+
+ num_bytes += offset;
+ urb->urb->transfer_buffer_length = num_bytes;
+
+ print_hex_dump_debug(KBUILD_MODNAME ": Sending message: ",
+ DUMP_PREFIX_OFFSET, 16, 1, urb->data, num_bytes, false);
+
+ usb_anchor_urb(urb->urb, &intf->out_anchor);
+ rc = usb_submit_urb(urb->urb, GFP_ATOMIC);
+ if (rc) {
+ dev_err(&intf->intf->dev,
+ "%s - usb_submit_urb failed with result %d\n",
+ __func__, rc);
+ usb_unanchor_urb(urb->urb);
+ rc = -EIO;
+ }
+
+ return rc;
+}
+
+int gip_send_system_message(struct gip_attachment *attachment,
+ uint8_t message_type, uint8_t flags, const void *bytes, int num_bytes)
+{
+ return gip_send_raw_message(attachment, message_type,
+ GIP_FLAG_SYSTEM | attachment->attachment_index | flags,
+ gip_sequence_next(attachment, message_type, true),
+ bytes, num_bytes);
+}
+
+int gip_send_vendor_message(struct gip_attachment *attachment,
+ uint8_t message_type, uint8_t flags, const void *bytes, int num_bytes)
+{
+ return gip_send_raw_message(attachment, message_type, flags,
+ gip_sequence_next(attachment, message_type, false),
+ bytes, num_bytes);
+}
+
+static void gip_metadata_free(struct device *dev, struct gip_metadata *metadata)
+{
+ devm_kfree(dev, metadata->device.audio_formats);
+
+ if (metadata->device.preferred_types) {
+ int i;
+
+ for (i = 0; i < metadata->device.num_preferred_types; i++)
+ devm_kfree(dev, metadata->device.preferred_types[i]);
+ devm_kfree(dev, metadata->device.preferred_types);
+ }
+ devm_kfree(dev, metadata->device.supported_interfaces);
+ devm_kfree(dev, metadata->device.hid_descriptor);
+ devm_kfree(dev, metadata->message_metadata);
+
+ memset(metadata, 0, sizeof(*metadata));
+}
+
+static int gip_parse_audio_format_metadata(struct device *dev,
+ struct gip_device_metadata *dev_metadata, const uint8_t *bytes,
+ int length, int buffer_offset)
+{
+ unsigned int i;
+
+ dev_metadata->num_audio_formats = bytes[buffer_offset];
+ if (buffer_offset + dev_metadata->num_audio_formats * 2 + 1 > length)
+ return -EINVAL;
+ dev_metadata->audio_formats = devm_kmalloc_array(dev,
+ dev_metadata->num_audio_formats, 2, GFP_KERNEL);
+ if (!dev_metadata->audio_formats)
+ return -ENOMEM;
+ memcpy(dev_metadata->audio_formats, &bytes[buffer_offset + 1],
+ dev_metadata->num_audio_formats * 2);
+
+ for (i = 0; i < dev_metadata->num_audio_formats; i++) {
+ const struct gip_audio_format_pair *pair = &dev_metadata->audio_formats[i];
+ const struct gip_audio_format *inbound = NULL;
+ const struct gip_audio_format *outbound = NULL;
+
+ if (pair->inbound <= MAX_GIP_AUDIO_FORMAT) {
+ inbound = &gip_audio_format_table[pair->inbound];
+ if (pair->inbound != GIP_AUDIO_FORMAT_NULL && inbound->rate == 0)
+ inbound = NULL;
+ }
+ if (!inbound)
+ dev_warn(dev, "Unknown audio format %u\n", pair->inbound);
+
+ if (pair->outbound <= MAX_GIP_AUDIO_FORMAT) {
+ outbound = &gip_audio_format_table[pair->outbound];
+ if (pair->outbound != GIP_AUDIO_FORMAT_NULL && outbound->rate == 0)
+ outbound = NULL;
+ }
+ if (!outbound)
+ dev_warn(dev, "Unknown audio format %u\n", pair->outbound);
+
+ if (inbound && outbound)
+ dev_dbg(dev,
+ "Supported audio format: %uHz %uch inbound, %uHz %uch outbound\n",
+ inbound->rate,
+ inbound->channels,
+ outbound->rate,
+ outbound->channels);
+ }
+ return 0;
+}
+
+static int gip_parse_preferred_types_metadata(struct device *dev,
+ struct gip_device_metadata *dev_metadata, const uint8_t *bytes,
+ int length, int buffer_offset)
+{
+ int i;
+ int count;
+
+ dev_metadata->num_preferred_types = bytes[buffer_offset];
+ dev_metadata->preferred_types = devm_kcalloc(dev,
+ dev_metadata->num_preferred_types, sizeof(char *), GFP_KERNEL);
+ if (!dev_metadata->preferred_types)
+ return -ENOMEM;
+
+ buffer_offset++;
+ for (i = 0; i < dev_metadata->num_preferred_types; i++) {
+ if (buffer_offset + 2 >= length)
+ return -EINVAL;
+
+ count = get_unaligned_le16(&bytes[buffer_offset]);
+ buffer_offset += 2;
+ if (buffer_offset + count > length)
+ return -EINVAL;
+
+ dev_metadata->preferred_types[i] = devm_kcalloc(dev, count + 1,
+ sizeof(char), GFP_KERNEL);
+ if (!dev_metadata->preferred_types[i])
+ return -ENOMEM;
+ memcpy(dev_metadata->preferred_types[i], &bytes[buffer_offset], count);
+ buffer_offset += count;
+ }
+
+ return 0;
+}
+
+static int gip_parse_supported_interfaces_metadata(struct device *dev,
+ struct gip_device_metadata *dev_metadata, const uint8_t *bytes,
+ int length, int buffer_offset)
+{
+ dev_metadata->num_supported_interfaces = bytes[buffer_offset];
+ if (buffer_offset + 1 +
+ (int32_t) (dev_metadata->num_supported_interfaces * sizeof(guid_t)) > length)
+ return -EINVAL;
+
+ dev_metadata->supported_interfaces = devm_kmalloc_array(dev,
+ dev_metadata->num_supported_interfaces, sizeof(guid_t), GFP_KERNEL);
+ if (!dev_metadata->supported_interfaces)
+ return -ENOMEM;
+
+ memcpy(dev_metadata->supported_interfaces, &bytes[buffer_offset + 1],
+ sizeof(guid_t) * dev_metadata->num_supported_interfaces);
+
+ return 0;
+}
+
+static int gip_parse_hid_descriptor_metadata(struct device *dev,
+ struct gip_device_metadata *dev_metadata, const uint8_t *bytes,
+ int length, int buffer_offset)
+{
+ dev_metadata->hid_descriptor_size = bytes[buffer_offset];
+ if (buffer_offset + 1 + dev_metadata->hid_descriptor_size > length)
+ return -EINVAL;
+
+ dev_metadata->hid_descriptor = devm_kmalloc(dev,
+ dev_metadata->hid_descriptor_size, GFP_KERNEL);
+ if (!dev_metadata->hid_descriptor)
+ return -ENOMEM;
+
+ memcpy(dev_metadata->hid_descriptor, &bytes[buffer_offset + 1],
+ dev_metadata->hid_descriptor_size);
+ print_hex_dump_debug(KBUILD_MODNAME ": Received HID descriptor: ",
+ DUMP_PREFIX_OFFSET, 16, 1, dev_metadata->hid_descriptor,
+ dev_metadata->hid_descriptor_size, false);
+
+ return 0;
+}
+
+static int gip_parse_device_metadata(struct device *dev,
+ struct gip_metadata *metadata, const uint8_t *bytes, int num_bytes,
+ int *offset)
+{
+ struct gip_device_metadata *dev_metadata = &metadata->device;
+ int buffer_offset;
+ int count;
+ int length;
+ int i;
+ int rc;
+ const struct gip_device_metadata_header *header;
+
+ bytes = &bytes[*offset];
+ num_bytes -= *offset;
+ if (num_bytes < sizeof(*header))
+ return -EINVAL;
+
+ header = (const struct gip_device_metadata_header *)bytes;
+ length = le16_to_cpu(header->length);
+ if (num_bytes < length)
+ return -EINVAL;
+
+ /* Skip supported firmware versions for now */
+
+ buffer_offset = le16_to_cpu(header->audio_offset);
+ if (buffer_offset >= length)
+ return -EINVAL;
+
+ if (buffer_offset > 0) {
+ rc = gip_parse_audio_format_metadata(dev, dev_metadata,
+ bytes, length, buffer_offset);
+ if (rc)
+ return rc;
+ }
+
+ buffer_offset = le16_to_cpu(header->supported_upstream_system_message_offset);
+ if (buffer_offset >= length)
+ return -EINVAL;
+
+ if (buffer_offset > 0) {
+ count = bytes[buffer_offset];
+ if (buffer_offset + count + 1 > length)
+ return -EINVAL;
+
+ for (i = 0; i < count; i++) {
+ uint8_t message = bytes[buffer_offset + 1 + i];
+
+ dev_dbg(dev,
+ "Supported upstream system message %02x\n",
+ message);
+ dev_metadata->in_system_messages[message >> 5] |=
+ BIT(message & 0x1F);
+ }
+ }
+
+ buffer_offset = le16_to_cpu(header->supported_downstream_system_message_offset);
+ if (buffer_offset >= length)
+ return -EINVAL;
+
+ if (buffer_offset > 0) {
+ count = bytes[buffer_offset];
+ if (buffer_offset + count + 1 > length)
+ return -EINVAL;
+
+ for (i = 0; i < count; i++) {
+ uint8_t message = bytes[buffer_offset + 1 + i];
+
+ dev_dbg(dev,
+ "Supported downstream system message %02x\n",
+ message);
+ dev_metadata->out_system_messages[message >> 5] |=
+ BIT(message & 0x1F);
+ }
+ }
+
+ buffer_offset = le16_to_cpu(header->preferred_types_offset);
+ if (buffer_offset >= length)
+ return -EINVAL;
+
+ if (buffer_offset > 0) {
+ rc = gip_parse_preferred_types_metadata(dev, dev_metadata,
+ bytes, length, buffer_offset);
+ if (rc)
+ return rc;
+ }
+
+ buffer_offset = le16_to_cpu(header->supported_interfaces_offset);
+ if (buffer_offset >= length)
+ return -EINVAL;
+
+ if (buffer_offset > 0) {
+ rc = gip_parse_supported_interfaces_metadata(dev,
+ dev_metadata, bytes, length, buffer_offset);
+ if (rc)
+ return rc;
+ }
+
+ if (metadata->version_major > 1 || metadata->version_minor >= 1) {
+ /* HID descriptor support added in metadata version 1.1 */
+ buffer_offset = le16_to_cpu(header->hid_descriptor_offset);
+ if (buffer_offset >= length)
+ return -EINVAL;
+
+ if (buffer_offset > 0) {
+ rc = gip_parse_hid_descriptor_metadata(dev,
+ dev_metadata, bytes, length, buffer_offset);
+ if (rc)
+ return rc;
+ }
+ }
+
+ *offset += length;
+ return 0;
+}
+
+static int gip_parse_message_metadata(struct device *dev,
+ struct gip_message_metadata *metadata, const uint8_t *bytes,
+ int num_bytes, int *offset)
+{
+ uint16_t length;
+
+ bytes = &bytes[*offset];
+ num_bytes -= *offset;
+
+ if (num_bytes < 2)
+ return -EINVAL;
+
+ length = get_unaligned_le16(&bytes[0]);
+ if (num_bytes < length)
+ return -EINVAL;
+
+ if (length < 15)
+ return -EINVAL;
+
+ metadata->type = bytes[2];
+ metadata->length = get_unaligned_le16(&bytes[3]);
+ metadata->data_type = get_unaligned_le16(&bytes[5]);
+ metadata->flags = get_unaligned_le32(&bytes[7]);
+ metadata->period = get_unaligned_le16(&bytes[11]);
+ metadata->persistence_timeout = get_unaligned_le16(&bytes[13]);
+
+ dev_dbg(dev,
+ "Supported vendor message type %02x of length %d, %s, %s, %s\n",
+ metadata->type, metadata->length,
+ metadata->flags & GIP_MESSAGE_FLAG_UPSTREAM ?
+ (metadata->flags & GIP_MESSAGE_FLAG_DOWNSTREAM ? "bidirectional" : "upstream") :
+ metadata->flags & GIP_MESSAGE_FLAG_DOWNSTREAM ? "downstream" :
+ metadata->flags & GIP_MESSAGE_FLAG_DS_REQUEST_RESPONSE ? "downstream request response" :
+ "unknown direction",
+ metadata->flags & GIP_MESSAGE_FLAG_SEQUENCED ? "sequenced" : "not sequenced",
+ metadata->flags & GIP_MESSAGE_FLAG_RELIABLE ? "reliable" : "unreliable");
+
+ *offset += length;
+ return 0;
+}
+
+static bool gip_parse_metadata(struct device *dev,
+ struct gip_metadata *metadata, const uint8_t *bytes, int num_bytes)
+{
+ int header_size;
+ int metadata_size;
+ int offset = 0;
+ int i;
+ int rc;
+
+ if (num_bytes < 16)
+ return -EINVAL;
+
+ print_hex_dump_debug(KBUILD_MODNAME ": Received metadata: ",
+ DUMP_PREFIX_OFFSET, 16, 1, bytes, num_bytes, false);
+
+ header_size = get_unaligned_le16(&bytes[0]);
+ if (num_bytes < header_size || header_size < 16)
+ return -EINVAL;
+
+ metadata->version_major = get_unaligned_le16(&bytes[2]);
+ metadata->version_minor = get_unaligned_le16(&bytes[4]);
+ /* Middle bytes are reserved */
+ metadata_size = get_unaligned_le16(&bytes[14]);
+
+ if (num_bytes < metadata_size || metadata_size < header_size)
+ return -EINVAL;
+
+ offset = header_size;
+
+ rc = gip_parse_device_metadata(dev, metadata, bytes, num_bytes, &offset);
+ if (rc)
+ goto parse_err;
+
+ if (offset >= num_bytes)
+ goto parse_err;
+
+ metadata->num_messages = bytes[offset];
+ offset++;
+ if (metadata->num_messages > 0) {
+ metadata->message_metadata = devm_kcalloc(dev,
+ metadata->num_messages,
+ sizeof(*metadata->message_metadata), GFP_KERNEL);
+ if (!metadata->message_metadata) {
+ rc = -ENOMEM;
+ goto parse_err;
+ }
+
+ for (i = 0; i < metadata->num_messages; i++) {
+ rc = gip_parse_message_metadata(dev,
+ &metadata->message_metadata[i], bytes,
+ num_bytes, &offset);
+ if (rc)
+ goto parse_err;
+ }
+ }
+
+ return 0;
+
+parse_err:
+ gip_metadata_free(dev, metadata);
+ return rc;
+}
+
+static int gip_acknowledge(struct gip_attachment *attachment,
+ const struct gip_header *header, uint32_t fragment_offset,
+ uint16_t bytes_remaining)
+{
+ struct gip_protocol_control_ack message;
+
+ message.control_code = GIP_CONTROL_CODE_ACK;
+ message.message_type = header->message_type;
+ message.flags = header->flags & GIP_FLAG_SYSTEM;
+ message.fragment_offset = cpu_to_le32(fragment_offset);
+ message.remaining_buffer = cpu_to_le16(bytes_remaining);
+
+ return gip_send_raw_message(attachment, GIP_CMD_PROTO_CONTROL,
+ GIP_FLAG_SYSTEM | attachment->attachment_index,
+ header->sequence_id, (uint8_t *)&message, sizeof(message));
+}
+
+static void gip_free_in_fragment(struct gip_attachment *attachment)
+{
+ kfree(attachment->in_fragment_data);
+ attachment->in_fragment_data = NULL;
+ attachment->in_fragment_message = -1;
+}
+
+static int gip_fragment_failed(struct gip_attachment *attachment,
+ const struct gip_header *header)
+{
+ attachment->in_fragment_retries++;
+ if (attachment->in_fragment_retries > 8) {
+ gip_free_in_fragment(attachment);
+ return 0;
+ }
+ return gip_acknowledge(attachment, header,
+ attachment->in_fragment_offset,
+ attachment->in_total_length - attachment->in_fragment_offset);
+}
+
+static int gip_bind_driver(struct gip_attachment *attachment, const struct gip_driver *driver)
+{
+ if (driver->probe) {
+ int rc = driver->probe(attachment);
+
+ if (rc)
+ return rc;
+ }
+
+ attachment->driver = driver;
+ memcpy(attachment->vendor_handlers, driver->vendor_handlers,
+ sizeof(attachment->vendor_handlers));
+ return 0;
+}
+
+static int gip_enable_elite_buttons(struct gip_attachment *attachment)
+{
+ if (attachment->vendor_id == GIP_VID_MICROSOFT) {
+ if (attachment->product_id == GIP_PID_XBOX_ELITE) {
+ attachment->xbe_format = GIP_BTN_FMT_XBE1;
+ } else if (attachment->product_id == GIP_PID_XBOX_ELITE_2) {
+ if (attachment->firmware_major_version == 4) {
+ attachment->xbe_format = GIP_BTN_FMT_XBE2_4;
+ } else if (attachment->firmware_major_version == 5) {
+ /*
+ * The exact range for this being necessary is
+ * unknown, but it starts at 5.11 and at either
+ * 5.16 or 5.17. This approach still works on
+ * 5.21, even if it's not necessary, so having
+ * a loose upper limit is fine.
+ */
+ if (attachment->firmware_minor_version >= 11 &&
+ attachment->firmware_minor_version < 17)
+ attachment->xbe_format = GIP_BTN_FMT_XBE2_RAW;
+ else
+ attachment->xbe_format = GIP_BTN_FMT_XBE2_5;
+ }
+ }
+ }
+
+ if (attachment->xbe_format == GIP_BTN_FMT_XBE2_RAW) {
+ /*
+ * The meaning of this packet is unknown and not documented, but
+ * it's needed for the Elite 2 controller to send raw reports
+ */
+ static const uint8_t enable_raw_report[] = { 7, 0 };
+
+ return gip_send_vendor_message(attachment, GIP_SL_ELITE_CONFIG,
+ 0, enable_raw_report, sizeof(enable_raw_report));
+ }
+
+ return 0;
+}
+
+#ifdef CONFIG_JOYSTICK_XBOX_GIP_FF
+static int gip_play_effect(struct input_dev *dev, void *data, struct ff_effect *effect)
+{
+ struct gip_attachment *attachment = input_get_drvdata(dev);
+ struct gip_direct_motor control = {
+ .motor_bitmap = GIP_MOTOR_LEFT_VIBRATION | GIP_MOTOR_RIGHT_VIBRATION
+ };
+
+ if (effect->type != FF_RUMBLE)
+ return 0;
+
+ control.left_vibration_level = effect->u.rumble.strong_magnitude * 100 / 0xFFFF;
+ control.right_vibration_level = effect->u.rumble.weak_magnitude * 100 / 0xFFFF;
+ control.duration = 255;
+
+ return gip_send_vendor_message(attachment, GIP_CMD_DIRECT_MOTOR,
+ 0, &control, sizeof(control));
+}
+#endif
+
+static int gip_send_guide_button_led(struct gip_attachment *attachment,
+ uint8_t pattern, uint8_t intensity)
+{
+ uint8_t buffer[] = {
+ GIP_LED_GUIDE,
+ pattern,
+ intensity,
+ };
+
+ if (!gip_supports_system_message(attachment, GIP_CMD_LED, false))
+ return 0;
+
+ return gip_send_system_message(attachment, GIP_CMD_LED, 0, buffer, sizeof(buffer));
+}
+
+static bool gip_send_set_device_state(struct gip_attachment *attachment, uint8_t state)
+{
+ uint8_t buffer[] = { state };
+
+ return gip_send_system_message(attachment, GIP_CMD_SET_DEVICE_STATE,
+ attachment->attachment_index, buffer, sizeof(buffer));
+}
+
+static int gip_handle_command_raw_report(struct gip_attachment *attachment,
+ const struct gip_header *header, const uint8_t *bytes, int num_bytes)
+{
+ struct input_dev *input;
+
+ if (num_bytes < 17) {
+ gip_dbg(attachment, "Discarding too-short raw report\n");
+ return -EINVAL;
+ }
+ guard(rcu)();
+ input = rcu_dereference(attachment->input);
+ if (!input)
+ return -ENODEV;
+
+ if ((attachment->features & GIP_FEATURE_ELITE_BUTTONS)
+ && attachment->xbe_format == GIP_BTN_FMT_XBE2_RAW) {
+ input_report_abs(input, ABS_PROFILE, bytes[15] & 3);
+ if (bytes[15] & 3) {
+ input_report_key(input, BTN_GRIPL, 0);
+ input_report_key(input, BTN_GRIPR, 0);
+ input_report_key(input, BTN_GRIPL2, 0);
+ input_report_key(input, BTN_GRIPR2, 0);
+ } else {
+ input_report_key(input, BTN_GRIPL,
+ bytes[GIP_BTN_OFFSET_XBE2] & BIT(2));
+ input_report_key(input, BTN_GRIPR,
+ bytes[GIP_BTN_OFFSET_XBE2] & BIT(0));
+ input_report_key(input, BTN_GRIPL2,
+ bytes[GIP_BTN_OFFSET_XBE2] & BIT(3));
+ input_report_key(input, BTN_GRIPR2,
+ bytes[GIP_BTN_OFFSET_XBE2] & BIT(1));
+ }
+
+ input_sync(input);
+ }
+ return 0;
+}
+
+static int gip_setup_input_device(struct gip_attachment *attachment)
+{
+ struct input_dev *input;
+ int rc;
+
+ if (!attachment->driver || !attachment->driver->setup_input)
+ return -ENODEV;
+
+ rcu_read_lock();
+ input = rcu_dereference(attachment->input);
+ rcu_read_unlock();
+ if (input)
+ return 0;
+
+ input = devm_input_allocate_device(to_gip_device(attachment));
+ if (!input)
+ return -ENOMEM;
+ input->id.bustype = BUS_USB;
+ input->id.vendor = attachment->vendor_id;
+ input->id.product = attachment->product_id;
+ input->uniq = attachment->uniq;
+ if (attachment->name)
+ input->name = attachment->name;
+ else if (attachment->attachment_index == 0)
+ input->name = attachment->device->udev->product;
+ input->phys = attachment->phys;
+
+ input_set_capability(input, EV_KEY, BTN_MODE);
+
+ rc = attachment->driver->setup_input(attachment, input);
+ if (rc < 0)
+ goto err_free_device;
+
+ if (attachment->features &
+ (GIP_FEATURE_CONSOLE_FUNCTION_MAP | GIP_FEATURE_CONSOLE_FUNCTION_MAP_OVERFLOW))
+ input_set_capability(input, EV_KEY, KEY_RECORD);
+
+ if (attachment->features & GIP_FEATURE_ELITE_BUTTONS) {
+ input_set_capability(input, EV_KEY, BTN_GRIPL);
+ input_set_capability(input, EV_KEY, BTN_GRIPR);
+ input_set_capability(input, EV_KEY, BTN_GRIPL2);
+ input_set_capability(input, EV_KEY, BTN_GRIPR2);
+ if (attachment->xbe_format == GIP_BTN_FMT_XBE1)
+ input_set_abs_params(input, ABS_PROFILE, 0, 1, 0, 0);
+ else
+ input_set_abs_params(input, ABS_PROFILE, 0, 3, 0, 0);
+
+ attachment->vendor_handlers[GIP_CMD_RAW_REPORT] = gip_handle_command_raw_report;
+ }
+
+#ifdef CONFIG_JOYSTICK_XBOX_GIP_FF
+ if (attachment->features & GIP_FEATURE_MOTOR_CONTROL) {
+ input_set_capability(input, EV_FF, FF_RUMBLE);
+ input_ff_create_memless(input, NULL, gip_play_effect);
+ }
+#endif
+
+ input_set_drvdata(input, attachment);
+ rcu_assign_pointer(attachment->input, input);
+ synchronize_rcu();
+ rc = input_register_device(input);
+ if (rc)
+ goto err_free_device;
+
+ return 0;
+
+err_free_device:
+ rcu_assign_pointer(attachment->input, NULL);
+ synchronize_rcu();
+
+ input_free_device(input);
+ return rc;
+}
+
+static int gip_init_input_device(struct gip_attachment *attachment)
+{
+ struct input_dev *input;
+ int rc = 0;
+
+ rcu_read_lock();
+ input = rcu_dereference(attachment->input);
+ rcu_read_unlock();
+ if (input)
+ return 0;
+
+ if (attachment->driver && attachment->driver->init) {
+ rc = attachment->driver->init(attachment);
+ if (rc < 0)
+ return rc;
+ }
+
+ if (rc != GIP_INIT_NO_INPUT && (attachment->features & GIP_FEATURE_CONTROLLER)) {
+ rc = gip_setup_input_device(attachment);
+ if (rc == -ENODEV)
+ return 0;
+ if (rc)
+ return rc;
+ }
+
+ return rc;
+}
+
+static int gip_send_init_sequence(struct gip_attachment *attachment)
+{
+ int rc = 0;
+ size_t len;
+
+ if (attachment->features & GIP_FEATURE_EXTENDED_SET_DEVICE_STATE) {
+ /*
+ * The meaning of this packet is unknown and not documented, but it's
+ * needed for the Elite 2 controller to start up on older firmwares
+ */
+ static const uint8_t set_device_state[] = {
+ GIP_STATE_UNK6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0,
+ 0x55, 0x53, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0
+ };
+
+ rc = gip_send_system_message(attachment,
+ GIP_CMD_SET_DEVICE_STATE, 0, set_device_state,
+ sizeof(set_device_state));
+ if (rc)
+ return rc;
+ }
+ rc = gip_enable_elite_buttons(attachment);
+ if (rc)
+ return rc;
+ if (!gip_supports_system_message(attachment, GIP_CMD_AUDIO_CONTROL, false)) {
+ rc = gip_send_set_device_state(attachment, GIP_STATE_START);
+ if (rc)
+ return rc;
+ attachment->device_state = GIP_STATE_START;
+ } else {
+ rc = gip_send_set_device_state(attachment, GIP_STATE_STOP);
+ if (rc)
+ return rc;
+ attachment->device_state = GIP_STATE_STOP;
+ }
+
+ rc = gip_send_guide_button_led(attachment,
+ GIP_LED_GUIDE_ON,
+ GIP_LED_GUIDE_INIT_BRIGHTNESS);
+ if (rc)
+ return rc;
+
+ if (gip_supports_system_message(attachment, GIP_CMD_SECURITY, false)
+ && !(attachment->features & GIP_FEATURE_SECURITY_OPT_OUT)) {
+ /* TODO: Implement Security command property */
+ uint8_t buffer[] = { 0x1, 0x0 };
+
+ rc = gip_send_system_message(attachment, GIP_CMD_SECURITY, 0,
+ buffer, sizeof(buffer));
+ if (rc)
+ return rc;
+ }
+
+ usb_make_path(attachment->device->udev, attachment->phys,
+ sizeof(attachment->phys));
+ len = strlen(attachment->phys);
+ if (len < sizeof(attachment->phys) - 1)
+ snprintf(attachment->phys + len,
+ sizeof(attachment->phys) - len, "/input%d",
+ attachment->attachment_index);
+
+ rc = gip_init_input_device(attachment);
+ if (rc)
+ return rc;
+
+ return 0;
+}
+
+static void gip_fragment_timeout(struct work_struct *work)
+{
+ struct gip_attachment *attachment = container_of(to_delayed_work(work),
+ struct gip_attachment, in_fragment_timeout);
+
+ guard(mutex)(&attachment->lock);
+ if (!attachment->in_fragment_data)
+ return;
+
+ gip_free_in_fragment(attachment);
+}
+
+static void gip_free_devices(struct gip_attachment *attachment)
+{
+ struct input_dev *input;
+
+ if (attachment->driver && attachment->driver->remove)
+ attachment->driver->remove(attachment);
+
+ rcu_read_lock();
+ input = rcu_dereference(attachment->input);
+ rcu_read_unlock();
+
+ rcu_assign_pointer(attachment->input, NULL);
+ synchronize_rcu();
+
+ if (input)
+ input_unregister_device(input);
+}
+
+static void gip_reset_metadata(struct gip_attachment *attachment)
+{
+ if (attachment->got_metadata != GIP_METADATA_GOT)
+ return;
+
+ gip_free_devices(attachment);
+ gip_metadata_free(to_gip_device(attachment), &attachment->metadata);
+ attachment->got_metadata = GIP_METADATA_NONE;
+}
+
+static void gip_retry_metadata(struct work_struct *work)
+{
+ struct gip_attachment *attachment = container_of(to_delayed_work(work),
+ struct gip_attachment, metadata_next);
+
+ guard(mutex)(&attachment->lock);
+ if (attachment->got_metadata == GIP_METADATA_GOT)
+ return;
+
+ if (attachment->metadata_retries < 4) {
+ attachment->metadata_retries++;
+ schedule_delayed_work(&attachment->metadata_next, HZ / 2);
+ gip_send_system_message(attachment, GIP_CMD_METADATA, 0, NULL, 0);
+ } else {
+ gip_info(attachment,
+ "Unable to obtain metadata, attempting to reset device\n");
+ gip_send_set_device_state(attachment, GIP_STATE_RESET);
+ }
+}
+
+static int gip_ensure_metadata(struct gip_attachment *attachment)
+{
+ if (attachment->got_metadata != GIP_METADATA_NONE)
+ return 0;
+
+ attachment->got_metadata = GIP_METADATA_PENDING;
+ cancel_delayed_work(&attachment->metadata_next);
+ schedule_delayed_work(&attachment->metadata_next, HZ / 2);
+ attachment->metadata_retries = 0;
+ return gip_send_system_message(attachment, GIP_CMD_METADATA, 0, NULL, 0);
+}
+
+static void gip_reset_attachment(struct gip_attachment *attachment)
+{
+ cancel_delayed_work(&attachment->metadata_next);
+ cancel_delayed_work(&attachment->in_fragment_timeout);
+
+ if (attachment->in_fragment_data)
+ gip_free_in_fragment(attachment);
+
+ gip_free_devices(attachment);
+}
+
+static int gip_handle_command_protocol_control(struct gip_attachment *attachment,
+ const struct gip_header *header, const uint8_t *bytes, int num_bytes)
+{
+ /* TODO */
+ gip_warn(attachment, "Unimplemented Protocol Control message\n");
+ return -EOPNOTSUPP;
+}
+
+static bool gip_handle_command_hello_device(struct gip_attachment *attachment,
+ const struct gip_header *header, const uint8_t *bytes, int num_bytes)
+{
+ const struct gip_hello_device *message;
+
+ if (num_bytes != sizeof(*message))
+ return -EINVAL;
+
+ message = (const struct gip_hello_device *)bytes;
+
+ gip_dbg(attachment, "Device hello from %llx (%04x:%04x)\n",
+ le64_to_cpu(message->device_id),
+ le16_to_cpu(message->vendor_id),
+ le16_to_cpu(message->product_id));
+ gip_dbg(attachment, "Firmware version %d.%d.%d rev %d\n",
+ le16_to_cpu(message->firmware_major_version),
+ le16_to_cpu(message->firmware_minor_version),
+ le16_to_cpu(message->firmware_build_version),
+ le16_to_cpu(message->firmware_revision));
+
+ /*
+ * The GIP spec specifies that the host should reject the device if any of these are wrong.
+ * I don't know if Windows or an Xbox do, however, so let's just log warnings instead.
+ */
+ if (message->rf_proto_major_version != 1 && message->rf_proto_minor_version != 0)
+ gip_warn(attachment, "Invalid RF protocol version %d.%d, expected 1.0\n",
+ message->rf_proto_major_version, message->rf_proto_minor_version);
+
+ if (message->security_major_version != 1 && message->security_minor_version != 0)
+ gip_warn(attachment, "Invalid security protocol version %d.%d, expected 1.0\n",
+ message->security_major_version, message->security_minor_version);
+
+ if (message->gip_major_version != 1 && message->gip_minor_version != 0)
+ gip_warn(attachment, "Invalid GIP version %d.%d, expected 1.0\n",
+ message->gip_major_version, message->gip_minor_version);
+
+ attachment->firmware_major_version = le16_to_cpu(message->firmware_major_version);
+ attachment->firmware_minor_version = le16_to_cpu(message->firmware_minor_version);
+ attachment->vendor_id = le16_to_cpu(message->vendor_id);
+ attachment->product_id = le16_to_cpu(message->product_id);
+ if (!attachment->uniq)
+ attachment->uniq = devm_kasprintf(to_gip_device(attachment),
+ GFP_KERNEL, "%llx", le64_to_cpu(message->device_id));
+
+ if (header->flags & GIP_FLAG_ATTACHMENT_MASK)
+ return gip_send_system_message(attachment, GIP_CMD_METADATA, 0, NULL, 0);
+ if (attachment->got_metadata == GIP_METADATA_FAKED)
+ attachment->got_metadata = GIP_METADATA_NONE;
+
+ gip_reset_attachment(attachment);
+ return gip_ensure_metadata(attachment);
+}
+
+static int gip_handle_command_status_device(struct gip_attachment *attachment,
+ const struct gip_header *header, const uint8_t *bytes, int num_bytes)
+{
+ int rc;
+ int i;
+
+ if (num_bytes < 1)
+ return -EINVAL;
+
+ attachment->status.base.battery_level = bytes[0] & 3;
+ attachment->status.base.battery_type = (bytes[0] >> 2) & 3;
+ attachment->status.base.charge = (bytes[0] >> 4) & 3;
+ attachment->status.base.power_level = (bytes[0] >> 6) & 3;
+
+ if (num_bytes >= 4) {
+ attachment->status.device_active = bytes[1] & 1;
+ if (bytes[1] & 2) {
+ /* Events present */
+ if (num_bytes < 5)
+ return -EINVAL;
+
+ attachment->status.num_events = bytes[4];
+ if (attachment->status.num_events > 5) {
+ gip_info(attachment,
+ "Device reported too many events, %d > 5\n",
+ attachment->status.num_events);
+ return -EINVAL;
+ }
+ if (5 + attachment->status.num_events * 10 > num_bytes)
+ return -EINVAL;
+
+ for (i = 0; i < attachment->status.num_events; i++) {
+ struct gip_status_event *event = &attachment->status.events[i];
+
+ event->event_type = get_unaligned_le16(&bytes[i * 10 + 5]);
+ event->fault_tag = get_unaligned_le32(&bytes[i * 10 + 7]);
+ event->fault_address = get_unaligned_le32(&bytes[i * 10 + 11]);
+
+ gip_info(attachment,
+ "Attachment %i event type %i, tag %i address %x\n",
+ attachment->attachment_index,
+ event->event_type,
+ event->fault_tag,
+ event->fault_address);
+ }
+ }
+ }
+
+ rc = gip_init_input_device(attachment);
+ if (rc)
+ return rc;
+
+ return gip_ensure_metadata(attachment);
+}
+
+static int gip_handle_command_metadata_respose(struct gip_attachment *attachment,
+ const struct gip_header *header, const uint8_t *bytes, int num_bytes)
+{
+ struct gip_metadata metadata = {0};
+ const guid_t *expected_guid = NULL;
+ bool found_expected_guid;
+ bool found_controller_guid = false;
+ int i, j, k;
+ int rc;
+
+ rc = gip_parse_metadata(to_gip_device(attachment), &metadata, bytes, num_bytes);
+ if (rc)
+ return rc;
+
+ gip_reset_metadata(attachment);
+
+ attachment->metadata = metadata;
+ attachment->got_metadata = GIP_METADATA_GOT;
+ attachment->features = 0;
+ cancel_delayed_work(&attachment->metadata_next);
+
+ for (i = 0; i < metadata.device.num_preferred_types; i++) {
+ const char *type = metadata.device.preferred_types[i];
+
+ gip_dbg(attachment, "Device preferred type: %s\n", type);
+ }
+ for (i = 0; i < metadata.device.num_preferred_types; i++) {
+ const char *type = metadata.device.preferred_types[i];
+
+ for (j = 0; base_drivers[j] && !expected_guid; j++) {
+ for (k = 0; base_drivers[j]->types[k] && !expected_guid; k++) {
+ if (strcmp(type, base_drivers[j]->types[k]) == 0) {
+ gip_dbg(attachment, "Matched type %s\n", type);
+ rc = gip_bind_driver(attachment, base_drivers[j]);
+ if (rc == 0)
+ expected_guid = &base_drivers[j]->guid;
+ else if (rc != -ENODEV)
+ return rc;
+ }
+ }
+ }
+ if (expected_guid)
+ break;
+
+ if (strcmp(type, "Windows.Xbox.Input.Chatpad") == 0)
+ break;
+
+ if (strcmp(type, "Windows.Xbox.Input.Headset") == 0) {
+ expected_guid = &guid_headset;
+ break;
+ }
+ }
+
+ found_expected_guid = !expected_guid;
+ for (i = 0; i < metadata.device.num_supported_interfaces; i++) {
+ const guid_t *guid = &metadata.device.supported_interfaces[i];
+
+ gip_dbg(attachment, "Supported interface: %pUl\n", guid);
+ if (expected_guid && guid_equal(expected_guid, guid))
+ found_expected_guid = true;
+
+ if (guid_equal(&guid_controller, guid)) {
+ found_controller_guid = true;
+ continue;
+ }
+ if (guid_equal(&gip_driver_navigation.guid, guid)) {
+ attachment->features |= GIP_FEATURE_CONTROLLER;
+ continue;
+ }
+ if (guid_equal(&guid_dev_auth_pc_opt_out, guid)) {
+ attachment->features |= GIP_FEATURE_SECURITY_OPT_OUT;
+ continue;
+ }
+ if (guid_equal(&guid_console_function_map, guid)) {
+ attachment->features |= GIP_FEATURE_CONSOLE_FUNCTION_MAP;
+ continue;
+ }
+ if (guid_equal(&guid_console_function_map_overflow, guid)) {
+ attachment->features |= GIP_FEATURE_CONSOLE_FUNCTION_MAP_OVERFLOW;
+ continue;
+ }
+ if (guid_equal(&guid_elite_buttons, guid)) {
+ attachment->features |= GIP_FEATURE_ELITE_BUTTONS;
+ continue;
+ }
+ if (guid_equal(&guid_dynamic_latency_input, guid)) {
+ attachment->features |= GIP_FEATURE_DYNAMIC_LATENCY_INPUT;
+ continue;
+ }
+ }
+
+ for (i = 0; i < metadata.num_messages; i++) {
+ struct gip_message_metadata *message = &metadata.message_metadata[i];
+
+ if (message->type == GIP_CMD_DIRECT_MOTOR && message->length >= 9
+ && (message->flags & GIP_MESSAGE_FLAG_DOWNSTREAM))
+ attachment->features |= GIP_FEATURE_MOTOR_CONTROL;
+ }
+
+ if (!found_expected_guid || !found_controller_guid)
+ gip_dbg(attachment, "Controller was missing expected GUID. "
+ "This controller probably won't work on an actual Xbox.\n");
+
+ gip_handle_quirks(attachment);
+
+ if ((attachment->features & GIP_FEATURE_GUIDE_COLOR)
+ && !gip_supports_vendor_message(attachment,
+ GIP_CMD_GUIDE_COLOR, false))
+ attachment->features &= ~GIP_FEATURE_GUIDE_COLOR;
+
+ gip_dbg(attachment, "Attachment %i has features: %02x\n",
+ attachment->attachment_index, attachment->features);
+
+ return gip_send_init_sequence(attachment);
+}
+
+static int gip_handle_command_security(struct gip_attachment *attachment,
+ const struct gip_header *header, const uint8_t *bytes, int num_bytes)
+{
+ /* TODO: Needed for controllers that connect via dongles */
+ gip_warn(attachment, "Unimplemented Security message\n");
+ return -EOPNOTSUPP;
+}
+
+static int gip_handle_command_guide_button_status(struct gip_attachment *attachment,
+ const struct gip_header *header, const uint8_t *bytes, int num_bytes)
+{
+ struct input_dev *input;
+
+ if (num_bytes < 2)
+ return -EINVAL;
+
+ guard(rcu)();
+ input = rcu_dereference(attachment->input);
+ if (!input)
+ return -ENODEV;
+
+ if (bytes[1] == VK_LWIN) {
+ input_report_key(input, BTN_MODE, bytes[0] & 3);
+ input_sync(input);
+ }
+
+ return 0;
+}
+
+static int gip_handle_command_audio_control(struct gip_attachment *attachment,
+ const struct gip_header *header, const uint8_t *bytes, int num_bytes)
+{
+ /* TODO: Needed for audio */
+ gip_warn(attachment, "Unimplemented Audio Control message\n");
+ return -EOPNOTSUPP;
+}
+
+static int gip_handle_command_firmware(struct gip_attachment *attachment,
+ const struct gip_header *header, const uint8_t *bytes, int num_bytes)
+{
+ if (num_bytes < 1)
+ return -EINVAL;
+
+ if (bytes[0] == 1) {
+ uint16_t major, minor, build, rev;
+
+ if (num_bytes < 14) {
+ gip_dbg(attachment, "Discarding too-short firmware message\n");
+
+ return -EINVAL;
+ }
+ major = get_unaligned_le16(&bytes[6]);
+ minor = get_unaligned_le16(&bytes[8]);
+ build = get_unaligned_le16(&bytes[10]);
+ rev = get_unaligned_le16(&bytes[12]);
+
+ gip_dbg(attachment,
+ "Firmware version: %d.%d.%d rev %d\n", major, minor, build, rev);
+
+ attachment->firmware_major_version = major;
+ attachment->firmware_minor_version = minor;
+
+ if (attachment->vendor_id == GIP_VID_MICROSOFT
+ && attachment->product_id == GIP_PID_XBOX_ELITE_2)
+ return gip_enable_elite_buttons(attachment);
+
+ return 0;
+ }
+
+ gip_warn(attachment, "Unimplemented Firmware message\n");
+
+ return -EOPNOTSUPP;
+}
+
+static int gip_handle_command_hid_report(struct gip_attachment *attachment,
+ const struct gip_header *header, uint8_t *bytes, int num_bytes)
+{
+ gip_warn(attachment, "Unimplemented HID report message\n");
+
+ return -EOPNOTSUPP;
+}
+
+static int gip_handle_command_extended(struct gip_attachment *attachment,
+ const struct gip_header *header, const uint8_t *bytes, int num_bytes)
+{
+ if (num_bytes < 2)
+ return -EINVAL;
+
+ if (bytes[1] != GIP_EXTENDED_STATUS_OK) {
+ gip_dbg(attachment,
+ "Extended message type %02x failed with status %i\n",
+ bytes[0], bytes[1]);
+ return -EPROTO;
+ }
+
+ switch (bytes[0]) {
+ case GIP_EXTCMD_GET_SERIAL_NUMBER:
+ memcpy(attachment->serial, &bytes[2],
+ min(sizeof(attachment->serial), (size_t)(num_bytes - 2)));
+ break;
+ default:
+ /* TODO */
+ gip_dbg(attachment, "Unimplemented extended message type %02x\n",
+ bytes[0]);
+ return -EOPNOTSUPP;
+ }
+
+ return 0;
+}
+
+static int gip_handle_elite_buttons(struct gip_attachment *attachment,
+ struct input_dev *input, const uint8_t *bytes, int num_bytes)
+{
+ bool grip[4] = { 0, 0, 0, 0 };
+ int profile = -1;
+
+ if (attachment->xbe_format == GIP_BTN_FMT_XBE1
+ && num_bytes > GIP_BTN_OFFSET_XBE1) {
+ profile = bytes[GIP_BTN_OFFSET_XBE1] >> 4;
+ if (profile) {
+ grip[0] = bytes[GIP_BTN_OFFSET_XBE1] & BIT(0);
+ grip[1] = bytes[GIP_BTN_OFFSET_XBE1] & BIT(1);
+ grip[2] = bytes[GIP_BTN_OFFSET_XBE1] & BIT(2);
+ grip[3] = bytes[GIP_BTN_OFFSET_XBE1] & BIT(3);
+ }
+ } else if ((attachment->xbe_format == GIP_BTN_FMT_XBE2_4
+ || attachment->xbe_format == GIP_BTN_FMT_XBE2_5)
+ && num_bytes > GIP_BTN_OFFSET_XBE2) {
+ int profile_offset;
+
+ if (attachment->xbe_format == GIP_BTN_FMT_XBE2_4)
+ profile_offset = 15;
+ else
+ profile_offset = 20;
+
+ if (num_bytes > profile_offset)
+ profile = bytes[profile_offset] & 3;
+ else
+ profile = 0;
+
+ if (!profile) {
+ grip[0] = bytes[GIP_BTN_OFFSET_XBE2] & BIT(2);
+ grip[1] = bytes[GIP_BTN_OFFSET_XBE2] & BIT(0);
+ grip[2] = bytes[GIP_BTN_OFFSET_XBE2] & BIT(3);
+ grip[3] = bytes[GIP_BTN_OFFSET_XBE2] & BIT(1);
+ }
+ }
+ if (profile >= 0) {
+ input_report_key(input, BTN_GRIPL, grip[0]);
+ input_report_key(input, BTN_GRIPR, grip[1]);
+ input_report_key(input, BTN_GRIPL2, grip[2]);
+ input_report_key(input, BTN_GRIPR2, grip[3]);
+ input_report_abs(input, ABS_PROFILE, profile);
+ }
+ return 0;
+}
+
+static int gip_handle_console_map(struct gip_attachment *attachment,
+ struct input_dev *input, const uint8_t *bytes, int num_bytes)
+{
+ int function_map_offset = -1;
+
+ if (attachment->features & GIP_FEATURE_DYNAMIC_LATENCY_INPUT) {
+ /* The dynamic latency input bytes are after the console function map */
+ if (num_bytes >= 26)
+ function_map_offset = num_bytes - 26;
+ } else {
+ function_map_offset = num_bytes - 18;
+ }
+ if (function_map_offset >= 0) {
+ input_report_key(input, KEY_RECORD,
+ bytes[function_map_offset] & BIT(0));
+ }
+ return 0;
+}
+
+static int gip_handle_ll_input_report(struct gip_attachment *attachment,
+ const struct gip_header *header, const uint8_t *bytes, int num_bytes)
+{
+ struct input_dev *input;
+ int rc = 0;
+
+ guard(rcu)();
+ input = rcu_dereference(attachment->input);
+ if (!input)
+ return -ENODEV;
+
+ if (attachment->device_state != GIP_STATE_START) {
+ gip_dbg(attachment, "Discarding early input report\n");
+ attachment->device_state = GIP_STATE_START;
+ return 0;
+ }
+
+ if (attachment->driver && attachment->driver->handle_input_report) {
+ rc = attachment->driver->handle_input_report(attachment, input, bytes, num_bytes);
+ if (rc < 0)
+ return rc;
+ }
+
+ if (attachment->features & GIP_FEATURE_ELITE_BUTTONS) {
+ rc = gip_handle_elite_buttons(attachment, input, bytes, num_bytes);
+ if (rc < 0)
+ goto exit;
+ }
+
+ if (num_bytes >= 32 && (attachment->features & GIP_FEATURE_CONSOLE_FUNCTION_MAP))
+ rc = gip_handle_console_map(attachment, input, bytes, num_bytes);
+
+exit:
+ input_sync(input);
+
+ return rc;
+}
+
+static int gip_handle_ll_overflow_input_report(struct gip_attachment *attachment,
+ const struct gip_header *header, const uint8_t *bytes, int num_bytes)
+{
+ struct input_dev *input;
+ int rc = 0;
+
+ guard(rcu)();
+ input = rcu_dereference(attachment->input);
+ if (!input)
+ return -ENODEV;
+
+ if (attachment->device_state != GIP_STATE_START) {
+ gip_dbg(attachment, "Discarding early input report\n");
+ attachment->device_state = GIP_STATE_START;
+ return 0;
+ }
+
+ if (attachment->driver && attachment->driver->handle_overflow_input_report) {
+ rc = attachment->driver->handle_overflow_input_report(attachment,
+ input, bytes, num_bytes);
+ if (rc < 0)
+ return rc;
+ }
+
+ if (attachment->features & GIP_FEATURE_CONSOLE_FUNCTION_MAP_OVERFLOW)
+ rc = gip_handle_console_map(attachment, input, bytes, num_bytes);
+
+ input_sync(input);
+
+ return rc;
+}
+
+static int gip_handle_audio_data(struct gip_attachment *attachment,
+ const struct gip_header *header, const uint8_t *bytes, int num_bytes)
+{
+ /* TODO: Needed for audio support */
+ gip_dbg(attachment, "Unimplemented Audio Data message\n");
+ return -EOPNOTSUPP;
+}
+
+static int gip_handle_system_message(struct gip_attachment *attachment,
+ const struct gip_header *header, uint8_t *bytes, int num_bytes)
+{
+ if (!gip_supports_system_message(attachment, header->message_type, true)) {
+ gip_warn(attachment,
+ "Received claimed-unsupported system message type %02x\n",
+ header->message_type);
+ return -EPROTO;
+ }
+ switch (header->message_type) {
+ case GIP_CMD_PROTO_CONTROL:
+ return gip_handle_command_protocol_control(attachment, header,
+ bytes, num_bytes);
+ case GIP_CMD_HELLO_DEVICE:
+ return gip_handle_command_hello_device(attachment, header,
+ bytes, num_bytes);
+ case GIP_CMD_STATUS_DEVICE:
+ return gip_handle_command_status_device(attachment, header,
+ bytes, num_bytes);
+ case GIP_CMD_METADATA:
+ return gip_handle_command_metadata_respose(attachment, header,
+ bytes, num_bytes);
+ case GIP_CMD_SECURITY:
+ return gip_handle_command_security(attachment, header, bytes,
+ num_bytes);
+ case GIP_CMD_GUIDE_BUTTON:
+ return gip_handle_command_guide_button_status(attachment,
+ header, bytes, num_bytes);
+ case GIP_CMD_AUDIO_CONTROL:
+ return gip_handle_command_audio_control(attachment, header,
+ bytes, num_bytes);
+ case GIP_CMD_FIRMWARE:
+ return gip_handle_command_firmware(attachment, header, bytes,
+ num_bytes);
+ case GIP_CMD_HID_REPORT:
+ return gip_handle_command_hid_report(attachment, header,
+ bytes, num_bytes);
+ case GIP_CMD_EXTENDED:
+ return gip_handle_command_extended(attachment, header, bytes,
+ num_bytes);
+ case GIP_AUDIO_DATA:
+ return gip_handle_audio_data(attachment, header, bytes,
+ num_bytes);
+ default:
+ gip_warn(attachment,
+ "Received unknown system message type %02x\n",
+ header->message_type);
+ return -EPROTO;
+ }
+}
+
+static struct gip_attachment *gip_ensure_attachment(struct gip_device *device,
+ uint8_t attachment_index)
+{
+ struct gip_attachment *attachment = device->attachments[attachment_index];
+
+ if (!attachment) {
+ attachment = devm_kzalloc(to_gip_device(device), sizeof(*attachment), GFP_KERNEL);
+ if (!attachment)
+ return ERR_PTR(-ENOMEM);
+
+ attachment->attachment_index = attachment_index;
+ attachment->device = device;
+ attachment->in_fragment_message = -1;
+
+ if (attachment_index == 0) {
+ attachment->vendor_id = device->udev->descriptor.idVendor;
+ attachment->product_id = device->udev->descriptor.idProduct;
+ }
+
+ device->attachments[attachment_index] = attachment;
+
+ mutex_init(&attachment->lock);
+ INIT_DELAYED_WORK(&attachment->in_fragment_timeout, gip_fragment_timeout);
+ INIT_DELAYED_WORK(&attachment->metadata_next, gip_retry_metadata);
+
+ attachment->metadata.device.in_system_messages[0] =
+ GIP_DEFAULT_IN_SYSTEM_MESSAGES;
+ attachment->metadata.device.out_system_messages[0] =
+ GIP_DEFAULT_OUT_SYSTEM_MESSAGES;
+ if (attachment->attachment_index == 0) {
+ /* Some decent default settings */
+ attachment->features |= GIP_FEATURE_CONTROLLER;
+ attachment->metadata.device.in_system_messages[0] |=
+ BIT(GIP_CMD_GUIDE_BUTTON);
+ }
+
+ gip_handle_quirks(attachment);
+ if (attachment->quirks & GIP_QUIRK_NO_HELLO)
+ gip_ensure_metadata(attachment);
+
+ attachment->got_metadata = GIP_METADATA_FAKED;
+ }
+ return attachment;
+}
+
+static int gip_handle_message(struct gip_attachment *attachment,
+ const struct gip_header *header, uint8_t *bytes, int num_bytes)
+{
+ if (header->flags & GIP_FLAG_SYSTEM)
+ return gip_handle_system_message(attachment, header, bytes,
+ num_bytes);
+
+ if (header->message_type < MAX_GIP_CMD && attachment->vendor_handlers[header->message_type])
+ return attachment->vendor_handlers[header->message_type](attachment,
+ header, bytes, num_bytes);
+
+ switch (header->message_type) {
+ case GIP_LL_INPUT_REPORT:
+ return gip_handle_ll_input_report(attachment, header, bytes,
+ num_bytes);
+ case GIP_LL_OVERFLOW_INPUT_REPORT:
+ return gip_handle_ll_overflow_input_report(attachment, header,
+ bytes, num_bytes);
+ }
+ gip_info(attachment,
+ "Received unknown vendor message type %02x\n",
+ header->message_type);
+ return -EOPNOTSUPP;
+}
+
+static int gip_receive_fragment(struct gip_attachment *attachment,
+ const struct gip_header *header, int offset,
+ uint64_t *fragment_offset, uint16_t *bytes_remaining, uint8_t *bytes,
+ int num_bytes)
+{
+ int rc = 0;
+
+ cancel_delayed_work_sync(&attachment->in_fragment_timeout);
+ if (header->flags & GIP_FLAG_INIT_FRAG) {
+ uint64_t total_length;
+
+ guard(mutex)(&attachment->lock);
+ if (attachment->in_fragment_message >= 0)
+ /*
+ * Reset fragment buffer if we get a new initial
+ * fragment before finishing the last message.
+ * TODO: Is this the correct behavior?
+ */
+ gip_free_in_fragment(attachment);
+ offset += gip_decode_length(&total_length, &bytes[offset],
+ num_bytes - offset);
+ if (total_length > MAX_MESSAGE_LENGTH)
+ return -EINVAL;
+
+ if (header->length > num_bytes - offset) {
+ gip_warn(attachment,
+ "Received fragment that claims to be %llu bytes, expected %i\n",
+ header->length, num_bytes - offset);
+ return -EPROTO;
+ }
+ if (header->length > total_length) {
+ gip_warn(attachment,
+ "Received too long fragment, %llu bytes, exceeds %lld\n",
+ header->length, total_length);
+ return -EINVAL;
+ }
+ attachment->in_fragment_data = kzalloc(total_length, GFP_KERNEL);
+ if (!attachment->in_fragment_data)
+ return -ENOMEM;
+ attachment->in_total_length = total_length;
+ attachment->in_fragment_message = header->message_type;
+ memcpy(attachment->in_fragment_data, &bytes[offset],
+ header->length);
+ *fragment_offset = header->length;
+ attachment->in_fragment_offset = header->length;
+ *bytes_remaining = attachment->in_total_length - header->length;
+ if (header->flags & GIP_FLAG_ACME)
+ gip_acknowledge(attachment, header, *fragment_offset, *bytes_remaining);
+ } else {
+ guard(mutex)(&attachment->lock);
+ if (attachment->in_fragment_message < 0) {
+ gip_warn_ratelimited(attachment,
+ "Received unexpected fragment of message type %02x\n",
+ header->message_type);
+ return -EPROTO;
+ }
+ if (header->message_type != attachment->in_fragment_message) {
+ gip_warn_ratelimited(attachment,
+ "Received out of sequence message type %02x, expected %02x\n",
+ header->message_type, attachment->in_fragment_message);
+ gip_fragment_failed(attachment, header);
+ return -EPROTO;
+ }
+
+ offset += gip_decode_length(fragment_offset, &bytes[offset],
+ num_bytes - offset);
+
+ if (header->length > num_bytes - offset) {
+ gip_warn(attachment,
+ "Received fragment that claims to be %llu bytes, expected %i\n",
+ header->length, num_bytes - offset);
+ return -EPROTO;
+ }
+ if (*fragment_offset != attachment->in_fragment_offset) {
+ /*
+ * While this is theoretically always an issue, for
+ * whatever reason a bunch of controllers will send the
+ * wrong final fragment offset. Presumably, that means
+ * the official driver won't reject it, so I guess we
+ * shouldn't either. Feels bad.
+ */
+ if (header->length && *fragment_offset != attachment->in_total_length) {
+ gip_warn_ratelimited(attachment,
+ "Received out of sequence fragment: claimed %llu, expected %d\n",
+ *fragment_offset, attachment->in_fragment_offset);
+ gip_acknowledge(attachment, header,
+ attachment->in_fragment_offset,
+ attachment->in_total_length - attachment->in_fragment_offset);
+ return -EPROTO;
+ }
+ gip_dbg_ratelimited(attachment,
+ "Received erroneous final fragment offset, proceeding anyway\n");
+ *bytes_remaining = 0;
+ }
+ if (*fragment_offset + header->length > attachment->in_total_length) {
+ gip_warn(attachment,
+ "Received too long fragment, %llu exceeds %d\n",
+ *fragment_offset + header->length, attachment->in_total_length);
+ gip_fragment_failed(attachment, header);
+ return -EINVAL;
+ } else {
+ *bytes_remaining = attachment->in_total_length -
+ (*fragment_offset + header->length);
+ }
+ if (header->length != 0)
+ memcpy(&attachment->in_fragment_data[*fragment_offset],
+ &bytes[offset], header->length);
+ *fragment_offset += header->length;
+ attachment->in_fragment_offset = *fragment_offset;
+
+ if (header->flags & GIP_FLAG_ACME)
+ gip_acknowledge(attachment, header, *fragment_offset, *bytes_remaining);
+ if (header->length == 0 && !*bytes_remaining) {
+ rc = gip_handle_message(attachment, header,
+ attachment->in_fragment_data,
+ attachment->in_total_length);
+ gip_free_in_fragment(attachment);
+ }
+ }
+ schedule_delayed_work(&attachment->in_fragment_timeout, HZ);
+
+ return rc;
+}
+
+static int gip_receive_message(struct gip_device *device, uint8_t *bytes,
+ int num_bytes)
+{
+ struct gip_header header;
+ int offset = 3;
+ int rc = 0;
+ uint64_t fragment_offset = 0;
+ uint16_t bytes_remaining = 0;
+ bool is_fragment;
+ uint8_t attachment_index;
+ struct gip_attachment *attachment;
+
+ if (num_bytes < 5)
+ return -EINVAL;
+
+ header.message_type = bytes[0];
+ header.flags = bytes[1];
+ header.sequence_id = bytes[2];
+ offset += gip_decode_length(&header.length, &bytes[offset], num_bytes - offset);
+
+ is_fragment = header.flags & GIP_FLAG_FRAGMENT;
+ attachment_index = header.flags & GIP_FLAG_ATTACHMENT_MASK;
+ attachment = gip_ensure_attachment(device, attachment_index);
+ if (IS_ERR(attachment))
+ return PTR_ERR(attachment);
+
+ print_hex_dump_debug(KBUILD_MODNAME ": Received message: ",
+ DUMP_PREFIX_OFFSET, 16, 1, bytes, num_bytes, false);
+
+ /* Handle coalescing fragmented messages */
+ if (is_fragment) {
+ rc = gip_receive_fragment(attachment, &header, offset,
+ &fragment_offset, &bytes_remaining, bytes, num_bytes);
+ } else if (header.length + offset > num_bytes) {
+ gip_warn(device,
+ "Received message with erroneous length (claimed %llu, actual %d), discarding\n",
+ header.length + offset, num_bytes);
+ rc = -EPROTO;
+ } else {
+ guard(mutex)(&attachment->lock);
+ num_bytes -= offset;
+ bytes += offset;
+ fragment_offset = header.length;
+ if (header.flags & GIP_FLAG_ACME)
+ gip_acknowledge(attachment, &header, fragment_offset, bytes_remaining);
+ rc = gip_handle_message(attachment, &header, bytes, num_bytes);
+ }
+
+ return rc;
+}
+
+static void gip_receive_work(struct work_struct *work)
+{
+ struct gip_device *device = container_of(work, struct gip_device,
+ receive_message);
+ unsigned long flags;
+
+ spin_lock_irqsave(&device->message_lock, flags);
+ while (device->pending_in_messages) {
+ struct gip_raw_message *message = &device->in_queue[device->next_in_message];
+
+ spin_unlock_irqrestore(&device->message_lock, flags);
+
+ gip_receive_message(device, message->bytes, message->num_bytes);
+
+ spin_lock_irqsave(&device->message_lock, flags);
+ device->next_in_message = (device->next_in_message + 1) % MAX_IN_MESSAGES;
+ device->pending_in_messages--;
+ }
+ spin_unlock_irqrestore(&device->message_lock, flags);
+}
+
+static void gip_urb_in(struct urb *urb)
+{
+ struct gip_interface *intf = urb->context;
+ struct gip_device *gip = intf->device;
+ struct device *dev = &intf->intf->dev;
+ int status = urb->status;
+ int message_id;
+ struct gip_raw_message *message;
+ unsigned long flags;
+
+ switch (status) {
+ case 0:
+ /* success */
+ break;
+ case -ECONNRESET:
+ case -ENOENT:
+ case -ESHUTDOWN:
+ /* this urb is terminated, clean up */
+ dev_dbg(dev, "%s - urb shutting down with status: %d\n",
+ __func__, status);
+ return;
+ default:
+ dev_dbg(dev, "%s - urb has status of: %d\n",
+ __func__, status);
+ goto exit;
+ }
+ if (intf->isoc_messages) {
+ /* TODO: Needed for audio support */
+ gip_warn(gip, "Unimplemented isochronous message input\n");
+ goto exit;
+ }
+
+ spin_lock_irqsave(&gip->message_lock, flags);
+ if (gip->pending_in_messages >= MAX_IN_MESSAGES) {
+ gip_err(gip, "Input queue is full; dropping message\n");
+ } else {
+ message_id = (gip->next_in_message + gip->pending_in_messages) % MAX_IN_MESSAGES;
+ message = &gip->in_queue[message_id];
+ gip->pending_in_messages++;
+ message->num_bytes = umin(urb->actual_length, sizeof(message->bytes));
+ memcpy(message->bytes, intf->in_data, message->num_bytes);
+ }
+ spin_unlock_irqrestore(&gip->message_lock, flags);
+ schedule_work(&gip->receive_message);
+
+exit:
+ status = usb_submit_urb(urb, GFP_ATOMIC);
+ if (status)
+ dev_err(dev, "%s - usb_submit_urb failed with result %d\n",
+ __func__, status);
+}
+
+static void gip_urb_out(struct urb *urb)
+{
+ struct gip_interface *intf = urb->context;
+ struct device *dev = &intf->intf->dev;
+ int status = urb->status;
+
+ switch (status) {
+ case 0:
+ /* success */
+ break;
+
+ case -ECONNRESET:
+ case -ENOENT:
+ case -ESHUTDOWN:
+ /* this urb is terminated, clean up */
+ dev_dbg(dev, "%s - urb shutting down with status: %d\n",
+ __func__, status);
+ break;
+
+ default:
+ dev_dbg(dev, "%s - nonzero urb status received: %d\n",
+ __func__, status);
+ break;
+ }
+}
+
+static int gip_init_input(struct gip_interface *intf,
+ struct usb_endpoint_descriptor *ep_in)
+{
+ int error;
+ struct usb_device *udev = interface_to_usbdev(intf->intf);
+
+ intf->urb_in = usb_alloc_urb(intf->isoc_messages, GFP_KERNEL);
+ if (!intf->urb_in)
+ return -ENOMEM;
+
+ intf->in_data = usb_alloc_coherent(udev, intf->mtu, GFP_KERNEL,
+ &intf->urb_in->transfer_dma);
+
+ if (!intf->in_data) {
+ error = -ENOMEM;
+ goto err_free_urb;
+ }
+
+ usb_fill_int_urb(intf->urb_in, udev,
+ usb_rcvintpipe(udev, ep_in->bEndpointAddress),
+ intf->in_data, intf->mtu, gip_urb_in, intf,
+ ep_in->bInterval);
+ intf->urb_in->transfer_flags |= URB_NO_TRANSFER_DMA_MAP;
+
+ if (intf->isoc_messages)
+ intf->urb_in->transfer_flags |= URB_ISO_ASAP;
+
+ return 0;
+
+err_free_urb:
+ usb_free_urb(intf->urb_in);
+ intf->urb_in = NULL;
+
+ return error;
+}
+
+static int gip_init_output(struct gip_interface *intf,
+ struct usb_endpoint_descriptor *ep_out)
+{
+ int error;
+ struct usb_device *udev = interface_to_usbdev(intf->intf);
+ int i;
+
+ if (usb_ifnum_to_if(udev, GIP_WIRED_INTF_AUDIO)) {
+ /*
+ * Explicitly disable the audio interface. This is needed
+ * for some controllers, such as the PowerA Enhanced Wired
+ * Controller for Series X|S (0x20d6:0x200e) to report the
+ * guide button.
+ */
+ error = usb_set_interface(udev, GIP_WIRED_INTF_AUDIO, 0);
+ if (error)
+ gip_warn(intf,
+ "unable to disable audio interface: %d\n",
+ error);
+ }
+
+ init_usb_anchor(&intf->out_anchor);
+
+ for (i = 0; i < MAX_OUT_MESSAGES; i++) {
+ intf->out_queue[i].urb = usb_alloc_urb(intf->isoc_messages, GFP_KERNEL);
+ if (!intf->out_queue[i].urb) {
+ error = -ENOMEM;
+ goto err_free_urbs;
+ }
+
+ intf->out_queue[i].data = usb_alloc_coherent(udev, intf->mtu, GFP_KERNEL,
+ &intf->out_queue[i].urb->transfer_dma);
+
+ if (!intf->out_queue[i].data) {
+ return -ENOMEM;
+ goto err_free_urbs;
+ }
+
+ usb_fill_int_urb(intf->out_queue[i].urb, udev,
+ usb_sndintpipe(udev, ep_out->bEndpointAddress),
+ intf->out_queue[i].data, intf->mtu, gip_urb_out, intf,
+ ep_out->bInterval);
+ intf->out_queue[i].urb->transfer_flags |= URB_NO_TRANSFER_DMA_MAP;
+
+ if (intf->isoc_messages)
+ intf->out_queue[i].urb->transfer_flags |= URB_ISO_ASAP;
+ }
+
+ return 0;
+
+err_free_urbs:
+ for (i = 0; i < MAX_OUT_MESSAGES; i++) {
+ if (intf->out_queue[i].data)
+ usb_free_coherent(udev, intf->mtu, intf->out_queue[i].data,
+ intf->out_queue[i].urb->transfer_dma);
+ usb_free_urb(intf->out_queue[i].urb);
+ intf->out_queue[i].urb = NULL;
+ }
+ return error;
+}
+
+static void gip_deinit_output(struct gip_interface *intf)
+{
+ int i;
+
+ for (i = 0; i < MAX_OUT_MESSAGES; i++) {
+ if (!intf->out_queue[i].urb)
+ continue;
+ usb_free_coherent(interface_to_usbdev(intf->intf), intf->mtu,
+ intf->out_queue[i].data, intf->out_queue[i].urb->transfer_dma);
+ usb_free_urb(intf->out_queue[i].urb);
+ intf->out_queue[i].data = NULL;
+ intf->out_queue[i].urb = NULL;
+ }
+}
+
+static void gip_deinit_input(struct gip_interface *intf)
+{
+ usb_free_coherent(interface_to_usbdev(intf->intf), intf->mtu,
+ intf->in_data, intf->urb_in->transfer_dma);
+ usb_free_urb(intf->urb_in);
+ intf->urb_in = NULL;
+}
+
+static int gip_interface_init(struct gip_interface *intf)
+{
+ struct usb_endpoint_descriptor *ep_in = NULL;
+ struct usb_endpoint_descriptor *ep_out = NULL;
+ int error = usb_find_common_endpoints(intf->intf->cur_altsetting,
+ NULL, NULL, &ep_in, &ep_out);
+
+ if (error)
+ return error;
+
+ if (!ep_in || !ep_out)
+ return -ENODEV;
+
+ error = gip_init_input(intf, ep_in);
+ if (error)
+ return error;
+
+ error = gip_init_output(intf, ep_out);
+ if (error)
+ goto err_free_input;
+
+ if (usb_submit_urb(intf->urb_in, GFP_KERNEL)) {
+ error = -EIO;
+ goto err_free_output;
+ }
+
+ return 0;
+
+err_free_output:
+ gip_deinit_output(intf);
+err_free_input:
+ gip_deinit_input(intf);
+ return error;
+}
+
+static int gip_probe(struct usb_interface *intf, const struct usb_device_id *id)
+{
+ struct usb_device *udev = interface_to_usbdev(intf);
+ struct gip_device *gip = NULL;
+ struct gip_attachment *attachment;
+ int rc;
+
+ if (intf->cur_altsetting->desc.bInterfaceNumber != GIP_WIRED_INTF_DATA) {
+ /*
+ * The Xbox One controller lists three interfaces all with the
+ * same interface class, subclass and protocol. Differentiate by
+ * interface number.
+ */
+ return 0;
+ }
+
+ gip = devm_kzalloc(&intf->dev, sizeof(*gip), GFP_KERNEL);
+ if (!gip)
+ return -ENOMEM;
+
+ gip->udev = udev;
+ gip->data.device = gip;
+ gip->data.intf = intf;
+ gip->data.mtu = BASE_GIP_MTU;
+ gip->audio.device = gip;
+ gip->audio.mtu = MAX_GIP_MTU;
+ gip->audio.isoc_messages = MAX_AUDIO_MESSAGES;
+
+ INIT_WORK(&gip->receive_message, gip_receive_work);
+ spin_lock_init(&gip->message_lock);
+
+ /* Pre-create the first attachment, as it should always exist */
+ attachment = gip_ensure_attachment(gip, 0);
+ if (IS_ERR(attachment)) {
+ devm_kfree(to_gip_device(gip), gip);
+ return PTR_ERR(attachment);
+ }
+
+
+ rc = gip_interface_init(&gip->data);
+ if (rc) {
+ gip_reset_attachment(attachment);
+ gip_reset_metadata(attachment);
+
+ devm_kfree(to_gip_device(attachment), attachment->uniq);
+ devm_kfree(to_gip_device(attachment), attachment);
+ devm_kfree(to_gip_device(gip), gip);
+ return rc;
+ }
+ /* Don't init audio interface -- we aren't using it yet */
+
+ usb_set_intfdata(intf, gip);
+ return 0;
+}
+
+static void gip_shutdown(struct gip_device *device)
+{
+ int i;
+
+ cancel_work_sync(&device->receive_message);
+
+ for (i = 0; i < MAX_ATTACHMENTS; i++) {
+ struct gip_attachment *attachment = device->attachments[i];
+
+ if (!attachment)
+ continue;
+
+ cancel_delayed_work_sync(&attachment->metadata_next);
+ cancel_delayed_work_sync(&attachment->in_fragment_timeout);
+
+ guard(mutex)(&attachment->lock);
+ gip_reset_attachment(attachment);
+ gip_reset_metadata(attachment);
+ }
+}
+
+static void gip_disconnect(struct usb_interface *intf)
+{
+ struct gip_device *gip = usb_get_intfdata(intf);
+ int i;
+
+ if (!gip)
+ return;
+
+ gip_shutdown(gip);
+
+ usb_kill_urb(gip->data.urb_in);
+ usb_kill_anchored_urbs(&gip->data.out_anchor);
+ if (gip->audio.intf) {
+ usb_kill_urb(gip->audio.urb_in);
+ usb_kill_anchored_urbs(&gip->audio.out_anchor);
+ }
+
+ gip_deinit_input(&gip->data);
+ gip_deinit_output(&gip->data);
+ if (gip->audio.intf) {
+ gip_deinit_input(&gip->audio);
+ gip_deinit_output(&gip->audio);
+ }
+
+ usb_set_intfdata(intf, NULL);
+
+ for (i = 0; i < MAX_ATTACHMENTS; i++) {
+ struct gip_attachment *attachment = gip->attachments[i];
+
+ if (!attachment)
+ continue;
+
+ devm_kfree(to_gip_device(attachment), attachment->uniq);
+ devm_kfree(to_gip_device(attachment), attachment);
+ }
+
+ devm_kfree(to_gip_device(gip), gip);
+}
+
+static int gip_suspend(struct usb_interface *intf, pm_message_t message)
+{
+ struct gip_device *gip = usb_get_intfdata(intf);
+
+ if (!gip)
+ return 0;
+
+ usb_kill_urb(gip->data.urb_in);
+ usb_kill_anchored_urbs(&gip->data.out_anchor);
+ if (gip->audio.intf) {
+ usb_kill_urb(gip->audio.urb_in);
+ usb_kill_anchored_urbs(&gip->audio.out_anchor);
+ }
+
+ if (gip->attachments[0]) {
+ struct gip_attachment *attachment = gip->attachments[0];
+
+ guard(mutex)(&attachment->lock);
+ gip_send_set_device_state(attachment, GIP_STATE_OFF);
+ attachment->device_state = GIP_STATE_OFF;
+ }
+
+ gip_shutdown(gip);
+
+ return 0;
+}
+
+static int gip_resume(struct usb_interface *intf)
+{
+ struct gip_device *gip = usb_get_intfdata(intf);
+
+ if (!gip)
+ return 0;
+
+ if (usb_submit_urb(gip->data.urb_in, GFP_KERNEL))
+ return -EIO;
+
+ return 0;
+}
+
+/* The Xbox One controller uses subclass 71 and protocol 208. */
+#define GIP_VENDOR(vend) \
+ { \
+ .match_flags = USB_DEVICE_ID_MATCH_VENDOR | USB_DEVICE_ID_MATCH_INT_INFO, \
+ .idVendor = (vend), \
+ .bInterfaceClass = USB_CLASS_VENDOR_SPEC, \
+ .bInterfaceSubClass = 71, \
+ .bInterfaceProtocol = 208 \
+ }
+
+static const struct usb_device_id gip_table[] = {
+ /*
+ * Please keep this list sorted by vendor ID.
+ */
+ GIP_VENDOR(0x03f0), /* HP/HyperX */
+ GIP_VENDOR(0x044f), /* ThrustMaster */
+ GIP_VENDOR(0x045e), /* Microsoft */
+ GIP_VENDOR(0x046d), /* Logitech */
+ GIP_VENDOR(0x0738), /* Mad Catz */
+ GIP_VENDOR(0x0b05), /* ASUS */
+ GIP_VENDOR(0x0e6f), /* PDP */
+ GIP_VENDOR(0x0f0d), /* Hori */
+ GIP_VENDOR(0x10f5), /* Turtle Beach */
+ GIP_VENDOR(0x1532), /* Razer */
+ GIP_VENDOR(0x20d6), /* PowerA/BDA */
+ GIP_VENDOR(0x24c6), /* PowerA/BDA/ThrustMaster */
+ GIP_VENDOR(0x294b), /* Snakebyte */
+ GIP_VENDOR(0x2dc8), /* 8BitDo */
+ GIP_VENDOR(0x2e24), /* Hyperkin */
+ GIP_VENDOR(0x2e95), /* SCUF Gaming */
+ GIP_VENDOR(0x3285), /* Nacon */
+ GIP_VENDOR(0x3537), /* GameSir */
+ GIP_VENDOR(0x366c), /* ByoWave */
+ { }
+};
+
+MODULE_DEVICE_TABLE(usb, gip_table);
+
+static struct usb_driver gip_driver = {
+ .name = "xbox-gip",
+ .probe = gip_probe,
+ .disconnect = gip_disconnect,
+ .suspend = gip_suspend,
+ .resume = gip_resume,
+ .id_table = gip_table,
+};
+
+module_usb_driver(gip_driver);
+
+MODULE_AUTHOR("Vicki Pfau <vi@endrift.com>");
+MODULE_DESCRIPTION("Xbox Gaming Input Protocol driver");
+MODULE_LICENSE("GPL");
diff --git a/drivers/input/joystick/gip/gip-drivers.c b/drivers/input/joystick/gip/gip-drivers.c
new file mode 100644
index 000000000000..2c2297b1fed8
--- /dev/null
+++ b/drivers/input/joystick/gip/gip-drivers.c
@@ -0,0 +1,204 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+/*
+ * Base drivers for common GIP devices
+ *
+ * Copyright (c) 2025 Valve Software
+ *
+ * This driver is based on the Microsoft GIP spec at:
+ * https://aka.ms/gipdocs
+ * https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-gipusb/e7c90904-5e21-426e-b9ad-d82adeee0dbc
+ */
+
+#include <linux/unaligned.h>
+#include "gip.h"
+
+struct gip_device_capabilities_response {
+ uint8_t extra_button_count;
+ uint8_t extra_axis_count;
+ uint8_t led_count;
+ uint8_t max_global_led_gain;
+};
+
+static bool dpad_as_buttons;
+
+static int gip_setup_gamepad_input(struct gip_attachment *attachment, struct input_dev *input)
+{
+ int ret = gip_driver_navigation.setup_input(attachment, input);
+
+ if (ret < 0)
+ return ret;
+ input_set_capability(input, EV_KEY, BTN_THUMBR);
+ input_set_capability(input, EV_KEY, BTN_THUMBL);
+ input_set_abs_params(input, ABS_X, -32768, 32767, 16, 128);
+ input_set_abs_params(input, ABS_Y, -32768, 32767, 16, 128);
+ input_set_abs_params(input, ABS_RX, -32768, 32767, 16, 128);
+ input_set_abs_params(input, ABS_RY, -32768, 32767, 16, 128);
+ input_set_abs_params(input, ABS_Z, 0, 1023, 0, 0);
+ input_set_abs_params(input, ABS_RZ, 0, 1023, 0, 0);
+
+ /* Xbox Adaptive Controller */
+ if (attachment->vendor_id == 0x045e && attachment->product_id == 0x0b0a)
+ input_set_abs_params(input, ABS_PROFILE, 0, 3, 0, 0);
+ return 0;
+}
+
+static int gip_handle_gamepad_report(struct gip_attachment *attachment,
+ struct input_dev *input, const uint8_t *bytes, int num_bytes)
+{
+ int ret = gip_driver_navigation.handle_input_report(attachment, input, bytes, num_bytes);
+
+ if (ret < 0)
+ return ret;
+
+ if (num_bytes < 14) {
+ gip_dbg(attachment, "Discarding too-short input report\n");
+ return -EINVAL;
+ }
+
+ input_report_key(input, BTN_THUMBL, bytes[1] & BIT(6));
+ input_report_key(input, BTN_THUMBR, bytes[1] & BIT(7));
+
+ input_report_abs(input, ABS_Z, (int16_t)get_unaligned_le16(&bytes[2]));
+ input_report_abs(input, ABS_RZ, (int16_t)get_unaligned_le16(&bytes[4]));
+
+ input_report_abs(input, ABS_X, (int16_t)get_unaligned_le16(&bytes[6]));
+ input_report_abs(input, ABS_Y, ~(int16_t)get_unaligned_le16(&bytes[8]));
+
+ input_report_abs(input, ABS_RX, (int16_t)get_unaligned_le16(&bytes[10]));
+ input_report_abs(input, ABS_RY, ~(int16_t)get_unaligned_le16(&bytes[12]));
+
+ if (attachment->vendor_id == GIP_VID_MICROSOFT &&
+ attachment->product_id == GIP_PID_XBOX_ADAPTIVE_CONTROLLER &&
+ num_bytes >= 31)
+ input_report_abs(input, ABS_PROFILE, bytes[30] & 3);
+
+ return 0;
+}
+
+const struct gip_driver gip_driver_gamepad = {
+ .types = (const char* const[]) { "Windows.Xbox.Input.Gamepad", NULL },
+ .guid = GUID_INIT(0x082e402c, 0x07df, 0x45e1, 0xa5, 0xab,
+ 0xa3, 0x12, 0x7a, 0xf1, 0x97, 0xb5),
+
+ .quirks = (const struct gip_quirks[]) {
+ /* Xbox One Controller (model 1573) */
+ { GIP_VID_MICROSOFT, GIP_PID_XBOX_ONE_1573, 0,
+ .override_name = "Xbox One Controller" },
+
+ /* Xbox One Controller (model 1697) */
+ { GIP_VID_MICROSOFT, GIP_PID_XBOX_ONE_1697, 0,
+ .override_name = "Xbox One Controller" },
+
+ /* Xbox Elite */
+ { GIP_VID_MICROSOFT, GIP_PID_XBOX_ELITE, 0,
+ .override_name = "Xbox Elite Controller",
+ .added_features = GIP_FEATURE_ELITE_BUTTONS,
+ .filtered_features = GIP_FEATURE_CONSOLE_FUNCTION_MAP },
+
+ /* Xbox One Controller (model 1708) */
+ { GIP_VID_MICROSOFT, GIP_PID_XBOX_ONE_1708, 0,
+ .override_name = "Xbox One Controller" },
+
+ /* Xbox Elite 2 */
+ { GIP_VID_MICROSOFT, GIP_PID_XBOX_ELITE_2, 0,
+ .override_name = "Xbox Elite Series 2 Controller",
+ .added_features = GIP_FEATURE_GUIDE_COLOR |
+ GIP_FEATURE_EXTENDED_SET_DEVICE_STATE },
+
+ /* Xbox Adaptive Controller */
+ { GIP_VID_MICROSOFT, GIP_PID_XBOX_ADAPTIVE_CONTROLLER, 0,
+ .override_name = "Xbox Adaptive Controller" },
+
+ /* Xbox Wireless Controller */
+ { GIP_VID_MICROSOFT, GIP_PID_XBOX_WIRELESS, 0,
+ .override_name = "Xbox Wireless Controller" },
+
+ {0},
+ },
+
+ .probe = NULL,
+ .remove = NULL,
+ .init = NULL,
+ .setup_input = gip_setup_gamepad_input,
+ .handle_input_report = gip_handle_gamepad_report,
+};
+
+static int gip_setup_navigation_input(struct gip_attachment *attachment, struct input_dev *input)
+{
+ input_set_capability(input, EV_KEY, BTN_Y);
+ input_set_capability(input, EV_KEY, BTN_B);
+ input_set_capability(input, EV_KEY, BTN_X);
+ input_set_capability(input, EV_KEY, BTN_A);
+ input_set_capability(input, EV_KEY, BTN_SELECT);
+ input_set_capability(input, EV_KEY, BTN_START);
+ input_set_capability(input, EV_KEY, BTN_TR);
+ input_set_capability(input, EV_KEY, BTN_TL);
+
+ attachment->dpad_as_buttons = dpad_as_buttons;
+ if (attachment->dpad_as_buttons) {
+ input_set_capability(input, EV_KEY, BTN_DPAD_UP);
+ input_set_capability(input, EV_KEY, BTN_DPAD_RIGHT);
+ input_set_capability(input, EV_KEY, BTN_DPAD_LEFT);
+ input_set_capability(input, EV_KEY, BTN_DPAD_DOWN);
+ } else {
+ input_set_abs_params(input, ABS_HAT0X, -1, 1, 0, 0);
+ input_set_abs_params(input, ABS_HAT0Y, -1, 1, 0, 0);
+ }
+
+ return 0;
+}
+
+static int gip_handle_navigation_report(struct gip_attachment *attachment,
+ struct input_dev *input, const uint8_t *bytes, int num_bytes)
+{
+ if (num_bytes < 2) {
+ gip_dbg(attachment, "Discarding too-short input report\n");
+ return -EINVAL;
+ }
+
+ input_report_key(input, BTN_START, bytes[0] & BIT(2));
+ input_report_key(input, BTN_SELECT, bytes[0] & BIT(3));
+ input_report_key(input, BTN_A, bytes[0] & BIT(4));
+ input_report_key(input, BTN_B, bytes[0] & BIT(5));
+ input_report_key(input, BTN_X, bytes[0] & BIT(6));
+ input_report_key(input, BTN_Y, bytes[0] & BIT(7));
+
+ if (attachment->dpad_as_buttons) {
+ input_report_key(input, BTN_DPAD_UP, bytes[1] & BIT(0));
+ input_report_key(input, BTN_DPAD_DOWN, bytes[1] & BIT(1));
+ input_report_key(input, BTN_DPAD_LEFT, bytes[1] & BIT(2));
+ input_report_key(input, BTN_DPAD_RIGHT, bytes[1] & BIT(3));
+ } else {
+ input_report_abs(input, ABS_HAT0X,
+ !!(bytes[1] & BIT(3)) - !!(bytes[1] & BIT(2)));
+ input_report_abs(input, ABS_HAT0Y,
+ !!(bytes[1] & BIT(1)) - !!(bytes[1] & BIT(0)));
+ }
+
+ if (attachment->quirks & GIP_QUIRK_SWAP_LB_RB) {
+ /* Previous */
+ input_report_key(input, BTN_TR, bytes[1] & BIT(4));
+ /* Next */
+ input_report_key(input, BTN_TL, bytes[1] & BIT(5));
+ } else {
+ input_report_key(input, BTN_TL, bytes[1] & BIT(4));
+ input_report_key(input, BTN_TR, bytes[1] & BIT(5));
+ }
+
+ return 0;
+}
+
+const struct gip_driver gip_driver_navigation = {
+ .types = (const char* const[]) { "Windows.Xbox.Input.NavigationController", NULL },
+ .guid = GUID_INIT(0xb8f31fe7, 0x7386, 0x40e9, 0xa9, 0xf8,
+ 0x2f, 0x21, 0x26, 0x3a, 0xcf, 0xb7),
+
+ .probe = NULL,
+ .remove = NULL,
+ .init = NULL,
+ .setup_input = gip_setup_navigation_input,
+ .handle_input_report = gip_handle_navigation_report,
+};
+
+module_param(dpad_as_buttons, bool, 0444);
+MODULE_PARM_DESC(dpad_as_buttons, "Map the D-Pad as buttons instead of axes");
diff --git a/drivers/input/joystick/gip/gip.h b/drivers/input/joystick/gip/gip.h
new file mode 100644
index 000000000000..605149834269
--- /dev/null
+++ b/drivers/input/joystick/gip/gip.h
@@ -0,0 +1,344 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+/*
+ * Gaming Input Protocol driver for Xbox One/Series controllers
+ *
+ * Copyright (c) 2025 Valve Software
+ *
+ * This driver is based on the Microsoft GIP spec at:
+ * https://aka.ms/gipdocs
+ * https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-gipusb/e7c90904-5e21-426e-b9ad-d82adeee0dbc
+ */
+
+#ifndef _GIP_H
+#define _GIP_H
+
+#include <linux/rcupdate.h>
+#include <linux/usb/input.h>
+
+#define BASE_GIP_MTU 64
+#define MAX_GIP_MTU 2048
+
+#define MAX_ATTACHMENTS 8
+
+#define MAX_IN_MESSAGES 8
+#define MAX_OUT_MESSAGES 8
+
+#define GIP_VID_MICROSOFT 0x045e
+#define GIP_VID_PDP 0x0e6f
+
+#define GIP_PID_XBOX_ONE_1573 0x02d1
+#define GIP_PID_XBOX_ONE_1697 0x02dd
+#define GIP_PID_XBOX_ELITE 0x02e3
+#define GIP_PID_XBOX_ONE_1708 0x02ea
+#define GIP_PID_XBOX_ELITE_2 0x0b00
+#define GIP_PID_XBOX_ADAPTIVE_CONTROLLER 0x0b0a
+#define GIP_PID_XBOX_WIRELESS 0x0b12
+
+#define GIP_PID_PDP_ROCK_CANDY 0x0246
+
+#define GIP_QUIRK_NO_HELLO BIT(0)
+#define GIP_QUIRK_NO_IMPULSE_VIBRATION BIT(1)
+#define GIP_QUIRK_SWAP_LB_RB BIT(2)
+/*
+ * Driver-specific quirks should start from 31 and go downwards to avoid
+ * conflicts with newly-added core quirks
+ */
+
+#define GIP_FEATURE_CONTROLLER BIT(0)
+#define GIP_FEATURE_CONSOLE_FUNCTION_MAP BIT(1)
+#define GIP_FEATURE_CONSOLE_FUNCTION_MAP_OVERFLOW BIT(2)
+#define GIP_FEATURE_ELITE_BUTTONS BIT(3)
+#define GIP_FEATURE_DYNAMIC_LATENCY_INPUT BIT(4)
+#define GIP_FEATURE_SECURITY_OPT_OUT BIT(5)
+#define GIP_FEATURE_MOTOR_CONTROL BIT(6)
+#define GIP_FEATURE_GUIDE_COLOR BIT(7)
+#define GIP_FEATURE_EXTENDED_SET_DEVICE_STATE BIT(8)
+
+#define GIP_FLAG_FRAGMENT BIT(7)
+#define GIP_FLAG_INIT_FRAG BIT(6)
+#define GIP_FLAG_SYSTEM BIT(5)
+#define GIP_FLAG_ACME BIT(4)
+#define GIP_FLAG_ATTACHMENT_MASK 0x7
+
+/* System messages */
+#define GIP_CMD_PROTO_CONTROL 0x01
+#define GIP_CMD_HELLO_DEVICE 0x02
+#define GIP_CMD_STATUS_DEVICE 0x03
+#define GIP_CMD_METADATA 0x04
+#define GIP_CMD_SET_DEVICE_STATE 0x05
+#define GIP_CMD_SECURITY 0x06
+#define GIP_CMD_GUIDE_BUTTON 0x07
+#define GIP_CMD_AUDIO_CONTROL 0x08
+#define GIP_CMD_LED 0x0a
+#define GIP_CMD_HID_REPORT 0x0b
+#define GIP_CMD_FIRMWARE 0x0c
+#define GIP_CMD_EXTENDED 0x1e
+#define GIP_CMD_DEBUG 0x1f
+#define GIP_AUDIO_DATA 0x60
+
+/* Navigation vendor messages */
+#define GIP_CMD_DIRECT_MOTOR 0x09
+#define GIP_LL_INPUT_REPORT 0x20
+#define GIP_LL_OVERFLOW_INPUT_REPORT 0x26
+
+/* Wheel and ArcadeStick vendor messages */
+#define GIP_CMD_INITIAL_REPORTS_REQUEST 0x0a
+#define GIP_LL_STATIC_CONFIGURATION 0x21
+#define GIP_LL_BUTTON_INFO_REPORT 0x22
+
+#define MAX_GIP_CMD 0x80
+
+#define to_gip_device(p) \
+ _Generic((p), \
+ struct gip_attachment * : gip_attachment_dev, \
+ struct gip_interface * : gip_interface_dev, \
+ struct gip_device * : gip_device_dev)(p)
+
+#define gip_dbg(dev, ...) dev_dbg(to_gip_device(dev), __VA_ARGS__)
+#define gip_info(dev, ...) dev_info(to_gip_device(dev), __VA_ARGS__)
+#define gip_warn(dev, ...) dev_warn(to_gip_device(dev), __VA_ARGS__)
+#define gip_err(dev, ...) dev_err(to_gip_device(dev), __VA_ARGS__)
+
+#define gip_dbg_ratelimited(dev, ...) dev_dbg_ratelimited(to_gip_device(dev), __VA_ARGS__)
+#define gip_info_ratelimited(dev, ...) dev_info_ratelimited(to_gip_device(dev), __VA_ARGS__)
+#define gip_warn_ratelimited(dev, ...) dev_warn_ratelimited(to_gip_device(dev), __VA_ARGS__)
+#define gip_err_ratelimited(dev, ...) dev_err_ratelimited(to_gip_device(dev), __VA_ARGS__)
+
+enum gip_init_status {
+ GIP_INIT_OK = 0,
+ GIP_INIT_NO_INPUT = 1,
+};
+
+enum gip_metadata_status {
+ GIP_METADATA_NONE = 0,
+ GIP_METADATA_GOT = 1,
+ GIP_METADATA_FAKED = 2,
+ GIP_METADATA_PENDING = 3,
+};
+
+enum gip_elite_button_format {
+ GIP_BTN_FMT_UNKNOWN,
+ GIP_BTN_FMT_XBE1,
+ GIP_BTN_FMT_XBE2_RAW,
+ GIP_BTN_FMT_XBE2_4,
+ GIP_BTN_FMT_XBE2_5,
+};
+
+struct gip_header {
+ uint8_t message_type;
+ uint8_t flags;
+ uint8_t sequence_id;
+ uint64_t length;
+};
+
+struct gip_raw_message {
+ uint16_t num_bytes;
+ uint8_t bytes[BASE_GIP_MTU];
+};
+
+struct gip_device_metadata {
+ uint8_t num_audio_formats;
+ uint8_t num_preferred_types;
+ uint8_t num_supported_interfaces;
+ uint8_t hid_descriptor_size;
+
+ uint32_t in_system_messages[8];
+ uint32_t out_system_messages[8];
+
+ struct gip_audio_format_pair *audio_formats;
+ char **preferred_types;
+ guid_t *supported_interfaces;
+ uint8_t *hid_descriptor;
+};
+
+struct gip_message_metadata {
+ uint16_t length;
+ uint8_t type;
+ uint16_t data_type;
+ uint32_t flags;
+ uint16_t period;
+ uint16_t persistence_timeout;
+};
+
+struct gip_metadata {
+ uint16_t version_major;
+ uint16_t version_minor;
+
+ struct gip_device_metadata device;
+
+ uint8_t num_messages;
+ struct gip_message_metadata *message_metadata;
+};
+
+struct gip_status {
+ int power_level;
+ int charge;
+ int battery_type;
+ int battery_level;
+};
+
+struct gip_status_event {
+ uint16_t event_type;
+ uint32_t fault_tag;
+ uint32_t fault_address;
+};
+
+struct gip_extended_status {
+ struct gip_status base;
+ bool device_active;
+
+ int num_events;
+ struct gip_status_event events[5];
+};
+
+struct gip_attachment;
+typedef int (*gip_command_handler)(struct gip_attachment *a, const struct gip_header *header,
+ const uint8_t *bytes, int num_bytes);
+
+struct gip_device;
+struct gip_attachment {
+ const struct gip_driver *driver;
+ struct gip_device *device;
+ void *driver_data;
+ gip_command_handler vendor_handlers[MAX_GIP_CMD];
+
+ uint8_t attachment_index;
+ struct input_dev __rcu *input;
+ uint16_t vendor_id;
+ uint16_t product_id;
+ char *uniq;
+ const char *name;
+ char phys[32];
+ char serial[32];
+ struct mutex lock;
+
+ int16_t in_fragment_message;
+ uint16_t in_total_length;
+ uint8_t *in_fragment_data;
+ uint32_t in_fragment_offset;
+ struct delayed_work in_fragment_timeout;
+ int in_fragment_retries;
+
+ uint16_t firmware_major_version;
+ uint16_t firmware_minor_version;
+
+ enum gip_metadata_status got_metadata;
+ struct delayed_work metadata_next;
+ int metadata_retries;
+ struct gip_metadata metadata;
+
+ uint8_t seq_system;
+ uint8_t seq_security;
+ uint8_t seq_extended;
+ uint8_t seq_audio;
+ uint8_t seq_vendor;
+
+ uint8_t device_state;
+
+ struct gip_extended_status status;
+
+ enum gip_elite_button_format xbe_format;
+ uint32_t features;
+ uint32_t quirks;
+
+ int extra_buttons;
+ int extra_axes;
+
+ bool dpad_as_buttons;
+ struct hid_device __rcu *hdev;
+};
+
+struct gip_urb {
+ struct urb *urb;
+ uint8_t *data;
+ unsigned int offset;
+};
+
+struct gip_interface {
+ struct gip_device *device;
+ struct usb_interface *intf;
+ uint32_t mtu;
+ int isoc_messages;
+
+ struct urb *urb_in;
+ uint8_t *in_data;
+
+ struct usb_anchor out_anchor;
+ struct gip_urb out_queue[MAX_OUT_MESSAGES];
+};
+
+struct gip_device {
+ struct usb_device *udev;
+
+ struct gip_interface data;
+ struct gip_interface audio;
+
+ struct gip_raw_message in_queue[MAX_IN_MESSAGES];
+ int pending_in_messages;
+ int next_in_message;
+
+ struct work_struct receive_message;
+ spinlock_t message_lock;
+
+ struct gip_attachment *attachments[MAX_ATTACHMENTS];
+};
+
+struct gip_quirks {
+ uint16_t vendor_id;
+ uint16_t product_id;
+ uint8_t attachment_index;
+ const char *override_name;
+ uint32_t added_features;
+ uint32_t filtered_features;
+ uint32_t quirks;
+ uint32_t extra_in_system[8];
+ uint32_t extra_out_system[8];
+ uint8_t extra_buttons;
+ uint8_t extra_axes;
+};
+
+struct gip_driver {
+ const char *const *types;
+ guid_t guid;
+
+ const struct gip_quirks *quirks;
+
+ int (*probe)(struct gip_attachment *a);
+ void (*remove)(struct gip_attachment *a);
+ int (*init)(struct gip_attachment *a);
+ int (*setup_input)(struct gip_attachment *a, struct input_dev *input);
+ int (*handle_input_report)(struct gip_attachment *a,
+ struct input_dev *input, const uint8_t *bytes, int num_bytes);
+ int (*handle_overflow_input_report)(struct gip_attachment *a,
+ struct input_dev *input, const uint8_t *bytes, int num_bytes);
+ gip_command_handler vendor_handlers[MAX_GIP_CMD];
+};
+
+static inline struct device *gip_attachment_dev(struct gip_attachment *attachment)
+{
+ return &attachment->device->data.intf->dev;
+}
+
+static inline struct device *gip_interface_dev(struct gip_interface *intf)
+{
+ return &intf->intf->dev;
+}
+
+static inline struct device *gip_device_dev(struct gip_device *device)
+{
+ return &device->data.intf->dev;
+}
+
+bool gip_supports_vendor_message(struct gip_attachment *attachment, uint8_t command, bool upstream);
+
+int gip_send_system_message(struct gip_attachment *attachment,
+ uint8_t message_type, uint8_t flags, const void *bytes, int num_bytes);
+int gip_send_vendor_message(struct gip_attachment *attachment,
+ uint8_t message_type, uint8_t flags, const void *bytes, int num_bytes);
+
+extern const struct gip_driver gip_driver_navigation;
+extern const struct gip_driver gip_driver_gamepad;
+extern const struct gip_driver gip_driver_arcade_stick;
+extern const struct gip_driver gip_driver_wheel;
+extern const struct gip_driver gip_driver_flight_stick;
+#endif
--
2.54.0
^ permalink raw reply related [flat|nested] 23+ messages in thread
* [PATCH v6 02/12] Input: xpad - Remove Xbox One support
2026-09-08 3:21 [PATCH v6 00/12] Input: xbox_gip - Add new driver for Xbox GIP Vicki Pfau
2026-09-08 3:21 ` [PATCH v6 01/12] " Vicki Pfau
@ 2026-09-08 3:21 ` Vicki Pfau
2026-09-08 3:34 ` sashiko-bot
2026-09-08 3:21 ` [PATCH v6 03/12] Input: xbox_gip - Add controllable LED support Vicki Pfau
` (9 subsequent siblings)
11 siblings, 1 reply; 23+ messages in thread
From: Vicki Pfau @ 2026-09-08 3:21 UTC (permalink / raw)
To: Dmitry Torokhov, linux-input; +Cc: Vicki Pfau
It has been superseded by xbox_gip. As the new driver is already at feature
parity, removing the fairly rough Xbox One support from xpad is safe and
will prevent any potential conflicts.
Signed-off-by: Vicki Pfau <vi@endrift.com>
---
Documentation/input/devices/xpad.rst | 17 +-
drivers/input/joystick/xpad.c | 684 +--------------------------
2 files changed, 11 insertions(+), 690 deletions(-)
diff --git a/Documentation/input/devices/xpad.rst b/Documentation/input/devices/xpad.rst
index a480bc781565..fd2afdd7b405 100644
--- a/Documentation/input/devices/xpad.rst
+++ b/Documentation/input/devices/xpad.rst
@@ -2,19 +2,19 @@
xpad - Linux USB driver for Xbox compatible controllers
=======================================================
-This driver exposes all first-party and third-party Xbox compatible
-controllers. It has a long history and has enjoyed considerable usage
-as Windows' xinput library caused most PC games to focus on Xbox
-controller compatibility.
+This driver exposes all first-party and third-party Xbox and Xbox 360
+compatible controllers. It has a long history and has enjoyed considerable
+usage as Windows' xinput library caused most PC games to focus on Xbox
+controller compatibility. Xbox One/Series controller support has been
+superseded by the xbox_gip driver, which specializes in the Gaming Input
+Protocl that is introduced on the Xbox One.
Due to backwards compatibility all buttons are reported as digital.
This only affects Original Xbox controllers. All later controller models
have only digital face buttons.
Rumble is supported on some models of Xbox 360 controllers but not of
-Original Xbox controllers nor on Xbox One controllers. As of writing
-the Xbox One's rumble protocol has not been reverse-engineered but in
-the future could be supported.
+Original Xbox controllers.
Notes
@@ -98,9 +98,6 @@ All generations of Xbox controllers speak USB over the wire.
- Wireless Xbox 360 controllers require a 'Xbox 360 Wireless Gaming Receiver
for Windows'
- Wired Xbox 360 controllers use standard USB connectors.
-- Xbox One controllers can be wireless but speak Wi-Fi Direct and are not
- yet supported.
-- Xbox One controllers can be wired and use standard Micro-USB connectors.
diff --git a/drivers/input/joystick/xpad.c b/drivers/input/joystick/xpad.c
index feb8f368f834..206007e0cafb 100644
--- a/drivers/input/joystick/xpad.c
+++ b/drivers/input/joystick/xpad.c
@@ -17,7 +17,6 @@
* - the iForce driver drivers/char/joystick/iforce.c
* - the skeleton-driver drivers/usb/usb-skeleton.c
* - Xbox 360 information http://www.free60.org/wiki/Gamepad
- * - Xbox One information https://github.com/quantus/xbox-one-controller-protocol
*
* Thanks to:
* - ITO Takayuki for providing essential xpad information on his website
@@ -46,10 +45,6 @@
#define MAP_DPAD_TO_BUTTONS BIT(0)
#define MAP_TRIGGERS_TO_BUTTONS BIT(1)
#define MAP_STICKS_TO_NULL BIT(2)
-#define MAP_SHARE_BUTTON BIT(3)
-#define MAP_PADDLES BIT(4)
-#define MAP_PROFILE_BUTTON BIT(5)
-#define MAP_SHARE_OFFSET BIT(6)
#define DANCEPAD_MAP_CONFIG (MAP_DPAD_TO_BUTTONS | \
MAP_TRIGGERS_TO_BUTTONS | MAP_STICKS_TO_NULL)
@@ -57,22 +52,13 @@
#define XTYPE_XBOX 0
#define XTYPE_XBOX360 1
#define XTYPE_XBOX360W 2
-#define XTYPE_XBOXONE 3
-#define XTYPE_UNKNOWN 4
+#define XTYPE_UNKNOWN 3
/* Send power-off packet to xpad360w after holding the mode button for this many
* seconds
*/
#define XPAD360W_POWEROFF_TIMEOUT 5
-#define PKT_XB 0
-#define PKT_XBE1 1
-#define PKT_XBE2_FW_OLD 2
-#define PKT_XBE2_FW_5_EARLY 3
-#define PKT_XBE2_FW_5_11 4
-
-#define FLAG_DELAY_INIT BIT(0)
-
static bool dpad_to_buttons;
module_param(dpad_to_buttons, bool, S_IRUGO);
MODULE_PARM_DESC(dpad_to_buttons, "Map D-PAD to buttons rather than axes for unknown pads");
@@ -105,16 +91,11 @@ static const struct xpad_device {
{ 0x03eb, 0xff02, "Wooting Two (Legacy)", 0, XTYPE_XBOX360 },
{ 0x03f0, 0x038D, "HyperX Clutch", 0, XTYPE_XBOX360 }, /* wired */
{ 0x03f0, 0x048D, "HyperX Clutch", 0, XTYPE_XBOX360 }, /* wireless */
- { 0x03f0, 0x0495, "HyperX Clutch Gladiate", 0, XTYPE_XBOXONE },
- { 0x03f0, 0x07A0, "HyperX Clutch Gladiate RGB", 0, XTYPE_XBOXONE },
- { 0x03f0, 0x08B6, "HyperX Clutch Gladiate", MAP_SHARE_BUTTON, XTYPE_XBOXONE }, /* v2 */
- { 0x03f0, 0x09B4, "HyperX Clutch Tanto", 0, XTYPE_XBOXONE },
{ 0x044f, 0x0f00, "Thrustmaster Wheel", 0, XTYPE_XBOX },
{ 0x044f, 0x0f03, "Thrustmaster Wheel", 0, XTYPE_XBOX },
{ 0x044f, 0x0f07, "Thrustmaster, Inc. Controller", 0, XTYPE_XBOX },
{ 0x044f, 0x0f10, "Thrustmaster Modena GT Wheel", 0, XTYPE_XBOX },
{ 0x044f, 0xb326, "Thrustmaster Gamepad GP XID", 0, XTYPE_XBOX360 },
- { 0x044f, 0xd01e, "ThrustMaster, Inc. ESWAP X 2 ELDEN RING EDITION", 0, XTYPE_XBOXONE },
{ 0x045e, 0x0202, "Microsoft X-Box pad v1 (US)", 0, XTYPE_XBOX },
{ 0x045e, 0x0285, "Microsoft X-Box pad (Japan)", 0, XTYPE_XBOX },
{ 0x045e, 0x0287, "Microsoft Xbox Controller S", 0, XTYPE_XBOX },
@@ -124,14 +105,7 @@ static const struct xpad_device {
{ 0x045e, 0x028f, "Microsoft X-Box 360 pad v2", 0, XTYPE_XBOX360 },
{ 0x045e, 0x0291, "Xbox 360 Wireless Receiver (XBOX)", MAP_DPAD_TO_BUTTONS, XTYPE_XBOX360W },
{ 0x045e, 0x02a9, "Xbox 360 Wireless Receiver (Unofficial)", MAP_DPAD_TO_BUTTONS, XTYPE_XBOX360W },
- { 0x045e, 0x02d1, "Microsoft X-Box One pad", 0, XTYPE_XBOXONE },
- { 0x045e, 0x02dd, "Microsoft X-Box One pad (Firmware 2015)", 0, XTYPE_XBOXONE },
- { 0x045e, 0x02e3, "Microsoft X-Box One Elite pad", MAP_PADDLES, XTYPE_XBOXONE },
- { 0x045e, 0x02ea, "Microsoft X-Box One S pad", 0, XTYPE_XBOXONE },
{ 0x045e, 0x0719, "Xbox 360 Wireless Receiver", MAP_DPAD_TO_BUTTONS, XTYPE_XBOX360W },
- { 0x045e, 0x0b00, "Microsoft X-Box One Elite 2 pad", MAP_PADDLES, XTYPE_XBOXONE },
- { 0x045e, 0x0b0a, "Microsoft X-Box Adaptive Controller", MAP_PROFILE_BUTTON, XTYPE_XBOXONE },
- { 0x045e, 0x0b12, "Microsoft Xbox Series S|X Controller", MAP_SHARE_BUTTON | MAP_SHARE_OFFSET, XTYPE_XBOXONE },
{ 0x046d, 0xc21d, "Logitech Gamepad F310", 0, XTYPE_XBOX360 },
{ 0x046d, 0xc21e, "Logitech Gamepad F510", 0, XTYPE_XBOX360 },
{ 0x046d, 0xc21f, "Logitech Gamepad F710", 0, XTYPE_XBOX360 },
@@ -151,7 +125,6 @@ static const struct xpad_device {
{ 0x06a3, 0x0200, "Saitek Racing Wheel", 0, XTYPE_XBOX },
{ 0x06a3, 0x0201, "Saitek Adrenalin", 0, XTYPE_XBOX },
{ 0x06a3, 0xf51a, "Saitek P3600", 0, XTYPE_XBOX360 },
- { 0x0738, 0x4503, "Mad Catz Racing Wheel", 0, XTYPE_XBOXONE },
{ 0x0738, 0x4506, "Mad Catz 4506 Wireless Controller", 0, XTYPE_XBOX },
{ 0x0738, 0x4516, "Mad Catz Control Pad", 0, XTYPE_XBOX },
{ 0x0738, 0x4520, "Mad Catz Control Pad Pro", 0, XTYPE_XBOX },
@@ -173,7 +146,6 @@ static const struct xpad_device {
{ 0x0738, 0x4740, "Mad Catz Beat Pad", 0, XTYPE_XBOX360 },
{ 0x0738, 0x4743, "Mad Catz Beat Pad Pro", MAP_DPAD_TO_BUTTONS, XTYPE_XBOX },
{ 0x0738, 0x4758, "Mad Catz Arcade Game Stick", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOX360 },
- { 0x0738, 0x4a01, "Mad Catz FightStick TE 2", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOXONE },
{ 0x0738, 0x6040, "Mad Catz Beat Pad Pro", MAP_DPAD_TO_BUTTONS, XTYPE_XBOX },
{ 0x0738, 0x9871, "Mad Catz Portable Drum", 0, XTYPE_XBOX360 },
{ 0x0738, 0xb726, "Mad Catz Xbox controller - MW2", 0, XTYPE_XBOX360 },
@@ -184,12 +156,8 @@ static const struct xpad_device {
{ 0x0738, 0xcb29, "Saitek Aviator Stick AV8R02", 0, XTYPE_XBOX360 },
{ 0x0738, 0xf738, "Super SFIV FightStick TE S", 0, XTYPE_XBOX360 },
{ 0x07ff, 0xffff, "Mad Catz GamePad", 0, XTYPE_XBOX360 },
- { 0x0b05, 0x1a38, "ASUS ROG RAIKIRI", MAP_SHARE_BUTTON, XTYPE_XBOXONE },
- { 0x0b05, 0x1abb, "ASUS ROG RAIKIRI PRO", 0, XTYPE_XBOXONE },
{ 0x0b05, 0x1c91, "ASUS ROG RAIKIRI II", 0, XTYPE_XBOX360 },
{ 0x0b05, 0x1c92, "ASUS ROG RAIKIRI II WIRELESS", 0, XTYPE_XBOX360 },
- { 0x0b05, 0x1c96, "ASUS ROG RAIKIRI II XBOX", MAP_SHARE_BUTTON, XTYPE_XBOXONE },
- { 0x0b05, 0x1d04, "ASUS ROG RAIKIRI II XBOX WIRELESS", MAP_SHARE_BUTTON, XTYPE_XBOXONE },
{ 0x0c12, 0x0005, "Intec wireless", 0, XTYPE_XBOX },
{ 0x0c12, 0x8801, "Nyko Xbox Controller", 0, XTYPE_XBOX },
{ 0x0c12, 0x8802, "Zeroplus Xbox Controller", 0, XTYPE_XBOX },
@@ -212,34 +180,10 @@ static const struct xpad_device {
{ 0x0e6f, 0x011f, "Rock Candy Gamepad Wired Controller", 0, XTYPE_XBOX360 },
{ 0x0e6f, 0x0131, "PDP EA Sports Controller", 0, XTYPE_XBOX360 },
{ 0x0e6f, 0x0133, "Xbox 360 Wired Controller", 0, XTYPE_XBOX360 },
- { 0x0e6f, 0x0139, "Afterglow Prismatic Wired Controller", 0, XTYPE_XBOXONE },
- { 0x0e6f, 0x013a, "PDP Xbox One Controller", 0, XTYPE_XBOXONE },
- { 0x0e6f, 0x0146, "Rock Candy Wired Controller for Xbox One", 0, XTYPE_XBOXONE },
- { 0x0e6f, 0x0147, "PDP Marvel Xbox One Controller", 0, XTYPE_XBOXONE },
- { 0x0e6f, 0x015c, "PDP Xbox One Arcade Stick", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOXONE },
- { 0x0e6f, 0x015d, "PDP Mirror's Edge Official Wired Controller for Xbox One", 0, XTYPE_XBOXONE },
- { 0x0e6f, 0x0161, "PDP Xbox One Controller", 0, XTYPE_XBOXONE },
- { 0x0e6f, 0x0162, "PDP Xbox One Controller", 0, XTYPE_XBOXONE },
- { 0x0e6f, 0x0163, "PDP Xbox One Controller", 0, XTYPE_XBOXONE },
- { 0x0e6f, 0x0164, "PDP Battlefield One", 0, XTYPE_XBOXONE },
- { 0x0e6f, 0x0165, "PDP Titanfall 2", 0, XTYPE_XBOXONE },
{ 0x0e6f, 0x0201, "Pelican PL-3601 'TSZ' Wired Xbox 360 Controller", 0, XTYPE_XBOX360 },
{ 0x0e6f, 0x0213, "Afterglow Gamepad for Xbox 360", 0, XTYPE_XBOX360 },
{ 0x0e6f, 0x021f, "Rock Candy Gamepad for Xbox 360", 0, XTYPE_XBOX360 },
- { 0x0e6f, 0x0246, "Rock Candy Gamepad for Xbox One 2015", 0, XTYPE_XBOXONE },
- { 0x0e6f, 0x02a0, "PDP Xbox One Controller", 0, XTYPE_XBOXONE },
- { 0x0e6f, 0x02a1, "PDP Xbox One Controller", 0, XTYPE_XBOXONE },
- { 0x0e6f, 0x02a2, "PDP Wired Controller for Xbox One - Crimson Red", 0, XTYPE_XBOXONE },
- { 0x0e6f, 0x02a4, "PDP Wired Controller for Xbox One - Stealth Series", 0, XTYPE_XBOXONE },
- { 0x0e6f, 0x02a6, "PDP Wired Controller for Xbox One - Camo Series", 0, XTYPE_XBOXONE },
- { 0x0e6f, 0x02a7, "PDP Xbox One Controller", 0, XTYPE_XBOXONE },
- { 0x0e6f, 0x02a8, "PDP Xbox One Controller", 0, XTYPE_XBOXONE },
- { 0x0e6f, 0x02ab, "PDP Controller for Xbox One", 0, XTYPE_XBOXONE },
- { 0x0e6f, 0x02ad, "PDP Wired Controller for Xbox One - Stealth Series", 0, XTYPE_XBOXONE },
- { 0x0e6f, 0x02b3, "Afterglow Prismatic Wired Controller", 0, XTYPE_XBOXONE },
- { 0x0e6f, 0x02b8, "Afterglow Prismatic Wired Controller", 0, XTYPE_XBOXONE },
{ 0x0e6f, 0x0301, "Logic3 Controller", 0, XTYPE_XBOX360 },
- { 0x0e6f, 0x0346, "Rock Candy Gamepad for Xbox One 2016", 0, XTYPE_XBOXONE },
{ 0x0e6f, 0x0401, "Logic3 Controller", 0, XTYPE_XBOX360 },
{ 0x0e6f, 0x0413, "Afterglow AX.1 Gamepad for Xbox 360", 0, XTYPE_XBOX360 },
{ 0x0e6f, 0x0501, "PDP Xbox 360 Controller", 0, XTYPE_XBOX360 },
@@ -251,23 +195,13 @@ static const struct xpad_device {
{ 0x0f0d, 0x000d, "Hori Fighting Stick EX2", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOX360 },
{ 0x0f0d, 0x0016, "Hori Real Arcade Pro.EX", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOX360 },
{ 0x0f0d, 0x001b, "Hori Real Arcade Pro VX", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOX360 },
- { 0x0f0d, 0x0063, "Hori Real Arcade Pro Hayabusa (USA) Xbox One", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOXONE },
- { 0x0f0d, 0x0067, "HORIPAD ONE", 0, XTYPE_XBOXONE },
- { 0x0f0d, 0x0078, "Hori Real Arcade Pro V Kai Xbox One", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOXONE },
- { 0x0f0d, 0x00c5, "Hori Fighting Commander ONE", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOXONE },
{ 0x0f0d, 0x00dc, "HORIPAD FPS for Nintendo Switch", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOX360 },
- { 0x0f0d, 0x0151, "Hori Racing Wheel Overdrive for Xbox Series X", 0, XTYPE_XBOXONE },
- { 0x0f0d, 0x0152, "Hori Racing Wheel Overdrive for Xbox Series X", 0, XTYPE_XBOXONE },
- { 0x0f0d, 0x01b2, "HORI Taiko No Tatsujin Drum Controller", MAP_SHARE_BUTTON, XTYPE_XBOXONE },
{ 0x0f30, 0x010b, "Philips Recoil", 0, XTYPE_XBOX },
{ 0x0f30, 0x0202, "Joytech Advanced Controller", 0, XTYPE_XBOX },
{ 0x0f30, 0x8888, "BigBen XBMiniPad Controller", 0, XTYPE_XBOX },
{ 0x102c, 0xff0c, "Joytech Wireless Advanced Controller", 0, XTYPE_XBOX },
{ 0x1038, 0x1430, "SteelSeries Stratus Duo", 0, XTYPE_XBOX360 },
{ 0x1038, 0x1431, "SteelSeries Stratus Duo", 0, XTYPE_XBOX360 },
- { 0x10f5, 0x7005, "Turtle Beach Recon Controller", 0, XTYPE_XBOXONE },
- { 0x10f5, 0x7008, "Turtle Beach Recon Controller", MAP_SHARE_BUTTON, XTYPE_XBOXONE },
- { 0x10f5, 0x7073, "Turtle Beach Stealth Ultra Controller", MAP_SHARE_BUTTON, XTYPE_XBOXONE },
{ 0x11c9, 0x55f0, "Nacon GC-100XF", 0, XTYPE_XBOX360 },
{ 0x11ff, 0x0511, "PXN V900", 0, XTYPE_XBOX360 },
{ 0x1209, 0x2882, "Ardwiino Controller", 0, XTYPE_XBOX360 },
@@ -280,9 +214,6 @@ static const struct xpad_device {
{ 0x1430, 0xf801, "RedOctane Controller", 0, XTYPE_XBOX360 },
{ 0x146b, 0x0601, "BigBen Interactive XBOX 360 Controller", 0, XTYPE_XBOX360 },
{ 0x146b, 0x0604, "Bigben Interactive DAIJA Arcade Stick", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOX360 },
- { 0x1532, 0x0a00, "Razer Atrox Arcade Stick", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOXONE },
- { 0x1532, 0x0a03, "Razer Wildcat", 0, XTYPE_XBOXONE },
- { 0x1532, 0x0a29, "Razer Wolverine V2", 0, XTYPE_XBOXONE },
{ 0x1532, 0x0a57, "Razer Wolverine V3 Pro (Wired)", 0, XTYPE_XBOX360 },
{ 0x1532, 0x0a59, "Razer Wolverine V3 Pro (2.4 GHz Dongle)", 0, XTYPE_XBOX360 },
{ 0x15e4, 0x3f00, "Power A Mini Pro Elite", 0, XTYPE_XBOX360 },
@@ -334,12 +265,7 @@ static const struct xpad_device {
{ 0x1ee9, 0x1590, "ZOTAC Gaming Zone", 0, XTYPE_XBOX360 },
{ 0x20bc, 0x5134, "BETOP BTP-KP50B Xinput Dongle", 0, XTYPE_XBOX360 },
{ 0x20bc, 0x514a, "BETOP BTP-KP50C Xinput Dongle", 0, XTYPE_XBOX360 },
- { 0x20d6, 0x2001, "BDA Xbox Series X Wired Controller", 0, XTYPE_XBOXONE },
- { 0x20d6, 0x2009, "PowerA Enhanced Wired Controller for Xbox Series X|S", 0, XTYPE_XBOXONE },
- { 0x20d6, 0x2064, "PowerA Wired Controller for Xbox", MAP_SHARE_BUTTON, XTYPE_XBOXONE },
{ 0x20d6, 0x281f, "PowerA Wired Controller For Xbox 360", 0, XTYPE_XBOX360 },
- { 0x20d6, 0x400b, "PowerA FUSION Pro 4 Wired Controller", MAP_SHARE_BUTTON, XTYPE_XBOXONE },
- { 0x20d6, 0x890b, "PowerA MOGA XP-Ultra Controller", MAP_SHARE_BUTTON, XTYPE_XBOXONE },
{ 0x2345, 0xe00b, "Machenike G5 Pro Controller", 0, XTYPE_XBOX360 },
{ 0x24c6, 0x5000, "Razer Atrox Arcade Stick", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOX360 },
{ 0x24c6, 0x5300, "PowerA MINI PROEX Controller", 0, XTYPE_XBOX360 },
@@ -347,9 +273,6 @@ static const struct xpad_device {
{ 0x24c6, 0x530a, "Xbox 360 Pro EX Controller", 0, XTYPE_XBOX360 },
{ 0x24c6, 0x531a, "PowerA Pro Ex", 0, XTYPE_XBOX360 },
{ 0x24c6, 0x5397, "FUS1ON Tournament Controller", 0, XTYPE_XBOX360 },
- { 0x24c6, 0x541a, "PowerA Xbox One Mini Wired Controller", 0, XTYPE_XBOXONE },
- { 0x24c6, 0x542a, "Xbox ONE spectra", 0, XTYPE_XBOXONE },
- { 0x24c6, 0x543a, "PowerA Xbox One wired controller", 0, XTYPE_XBOXONE },
{ 0x24c6, 0x5500, "Hori XBOX 360 EX 2 with Turbo", 0, XTYPE_XBOX360 },
{ 0x24c6, 0x5501, "Hori Real Arcade Pro VX-SA", 0, XTYPE_XBOX360 },
{ 0x24c6, 0x5502, "Hori Fighting Stick VX Alt", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOX360 },
@@ -358,29 +281,18 @@ static const struct xpad_device {
{ 0x24c6, 0x550d, "Hori GEM Xbox controller", 0, XTYPE_XBOX360 },
{ 0x24c6, 0x550e, "Hori Real Arcade Pro V Kai 360", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOX360 },
{ 0x24c6, 0x5510, "Hori Fighting Commander ONE (Xbox 360/PC Mode)", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOX360 },
- { 0x24c6, 0x551a, "PowerA FUSION Pro Controller", 0, XTYPE_XBOXONE },
- { 0x24c6, 0x561a, "PowerA FUSION Controller", 0, XTYPE_XBOXONE },
- { 0x24c6, 0x581a, "ThrustMaster XB1 Classic Controller", 0, XTYPE_XBOXONE },
{ 0x24c6, 0x5b00, "ThrustMaster Ferrari 458 Racing Wheel", 0, XTYPE_XBOX360 },
{ 0x24c6, 0x5b02, "Thrustmaster, Inc. GPX Controller", 0, XTYPE_XBOX360 },
{ 0x24c6, 0x5b03, "Thrustmaster Ferrari 458 Racing Wheel", 0, XTYPE_XBOX360 },
{ 0x24c6, 0x5d04, "Razer Sabertooth", 0, XTYPE_XBOX360 },
{ 0x24c6, 0xfafe, "Rock Candy Gamepad for Xbox 360", 0, XTYPE_XBOX360 },
{ 0x2563, 0x058d, "OneXPlayer Gamepad", 0, XTYPE_XBOX360 },
- { 0x294b, 0x3303, "Snakebyte GAMEPAD BASE X", 0, XTYPE_XBOXONE },
- { 0x294b, 0x3404, "Snakebyte GAMEPAD RGB X", 0, XTYPE_XBOXONE },
{ 0x2993, 0x2001, "TECNO Pocket Go", 0, XTYPE_XBOX360 },
- { 0x2dc8, 0x2000, "8BitDo Pro 2 Wired Controller fox Xbox", 0, XTYPE_XBOXONE },
- { 0x2dc8, 0x200f, "8BitDo Ultimate 3-mode Controller for Xbox", MAP_SHARE_BUTTON, XTYPE_XBOXONE },
{ 0x2dc8, 0x3106, "8BitDo Ultimate Wireless / Pro 2 Wired Controller", 0, XTYPE_XBOX360 },
{ 0x2dc8, 0x3109, "8BitDo Ultimate Wireless Bluetooth", 0, XTYPE_XBOX360 },
{ 0x2dc8, 0x310a, "8BitDo Ultimate 2C Wireless Controller", 0, XTYPE_XBOX360 },
{ 0x2dc8, 0x310b, "8BitDo Ultimate 2 Wireless Controller", 0, XTYPE_XBOX360 },
{ 0x2dc8, 0x6001, "8BitDo SN30 Pro", 0, XTYPE_XBOX360 },
- { 0x2e24, 0x0423, "Hyperkin DuchesS Xbox One pad", MAP_SHARE_BUTTON, XTYPE_XBOXONE },
- { 0x2e24, 0x0652, "Hyperkin Duke X-Box One pad", 0, XTYPE_XBOXONE },
- { 0x2e24, 0x1688, "Hyperkin X91 X-Box One pad", 0, XTYPE_XBOXONE },
- { 0x2e95, 0x0504, "SCUF Gaming Controller", MAP_SHARE_BUTTON, XTYPE_XBOXONE },
{ 0x31e3, 0x1100, "Wooting One", 0, XTYPE_XBOX360 },
{ 0x31e3, 0x1200, "Wooting Two", 0, XTYPE_XBOX360 },
{ 0x31e3, 0x1210, "Wooting Lekker", 0, XTYPE_XBOX360 },
@@ -388,17 +300,11 @@ static const struct xpad_device {
{ 0x31e3, 0x1230, "Wooting Two HE (ARM)", 0, XTYPE_XBOX360 },
{ 0x31e3, 0x1300, "Wooting 60HE (AVR)", 0, XTYPE_XBOX360 },
{ 0x31e3, 0x1310, "Wooting 60HE (ARM)", 0, XTYPE_XBOX360 },
- { 0x3285, 0x0603, "Nacon Pro Compact controller for Xbox", 0, XTYPE_XBOXONE },
{ 0x3285, 0x0607, "Nacon GC-100", 0, XTYPE_XBOX360 },
- { 0x3285, 0x0614, "Nacon Pro Compact", 0, XTYPE_XBOXONE },
- { 0x3285, 0x0646, "Nacon Pro Compact", 0, XTYPE_XBOXONE },
{ 0x3285, 0x0662, "Nacon Revolution5 Pro", 0, XTYPE_XBOX360 },
- { 0x3285, 0x0663, "Nacon Evol-X", 0, XTYPE_XBOXONE },
{ 0x3537, 0x1004, "GameSir T4 Kaleid", 0, XTYPE_XBOX360 },
{ 0x3537, 0x100f, "GameSir Nova 2 Lite", 0, XTYPE_XBOX360 },
- { 0x3537, 0x1010, "GameSir G7 SE", 0, XTYPE_XBOXONE },
{ 0x3651, 0x1000, "CRKD SG", 0, XTYPE_XBOX360 },
- { 0x366c, 0x0005, "ByoWave Proteus Controller", MAP_SHARE_BUTTON, XTYPE_XBOXONE, FLAG_DELAY_INIT },
{ 0x3767, 0x0101, "Fanatec Speedster 3 Forceshock Wheel", 0, XTYPE_XBOX },
{ 0x37d7, 0x2501, "Flydigi Apex 5", 0, XTYPE_XBOX360 },
{ 0x413d, 0x2104, "Black Shark Green Ghost Gamepad", 0, XTYPE_XBOX360 },
@@ -456,13 +362,6 @@ static const signed short xpad_abs_triggers[] = {
-1
};
-/* used when the controller has extra paddle buttons */
-static const signed short xpad_btn_paddles[] = {
- BTN_GRIPR, BTN_GRIPR2, /* paddle upper right, lower right */
- BTN_GRIPL, BTN_GRIPL2, /* paddle upper left, lower left */
- -1 /* terminating entry */
-};
-
/*
* Xbox 360 has a vendor-specific class, so we cannot match it with only
* USB_INTERFACE_INFO (also specifically refused by USB subsystem), so we
@@ -479,49 +378,30 @@ static const signed short xpad_btn_paddles[] = {
{ XPAD_XBOX360_VENDOR_PROTOCOL((vend), 1) }, \
{ XPAD_XBOX360_VENDOR_PROTOCOL((vend), 129) }
-/* The Xbox One controller uses subclass 71 and protocol 208. */
-#define XPAD_XBOXONE_VENDOR_PROTOCOL(vend, pr) \
- .match_flags = USB_DEVICE_ID_MATCH_VENDOR | USB_DEVICE_ID_MATCH_INT_INFO, \
- .idVendor = (vend), \
- .bInterfaceClass = USB_CLASS_VENDOR_SPEC, \
- .bInterfaceSubClass = 71, \
- .bInterfaceProtocol = (pr)
-#define XPAD_XBOXONE_VENDOR(vend) \
- { XPAD_XBOXONE_VENDOR_PROTOCOL((vend), 208) }
-
static const struct usb_device_id xpad_table[] = {
/*
- * Please keep this list sorted by vendor ID. Note that there are 2
- * macros - XPAD_XBOX360_VENDOR and XPAD_XBOXONE_VENDOR.
+ * Please keep this list sorted by vendor ID
*/
{ USB_INTERFACE_INFO('X', 'B', 0) }, /* Xbox USB-IF not-approved class */
XPAD_XBOX360_VENDOR(0x0079), /* GPD Win 2 controller */
XPAD_XBOX360_VENDOR(0x0351), /* CRKD Controllers */
XPAD_XBOX360_VENDOR(0x03eb), /* Wooting Keyboards (Legacy) */
XPAD_XBOX360_VENDOR(0x03f0), /* HP HyperX Xbox 360 controllers */
- XPAD_XBOXONE_VENDOR(0x03f0), /* HP HyperX Xbox One controllers */
XPAD_XBOX360_VENDOR(0x044f), /* Thrustmaster Xbox 360 controllers */
- XPAD_XBOXONE_VENDOR(0x044f), /* Thrustmaster Xbox One controllers */
XPAD_XBOX360_VENDOR(0x045e), /* Microsoft Xbox 360 controllers */
- XPAD_XBOXONE_VENDOR(0x045e), /* Microsoft Xbox One controllers */
XPAD_XBOX360_VENDOR(0x046d), /* Logitech Xbox 360-style controllers */
XPAD_XBOX360_VENDOR(0x0502), /* Acer Inc. Xbox 360 style controllers */
XPAD_XBOX360_VENDOR(0x056e), /* Elecom JC-U3613M */
XPAD_XBOX360_VENDOR(0x06a3), /* Saitek P3600 */
XPAD_XBOX360_VENDOR(0x0738), /* Mad Catz Xbox 360 controllers */
{ USB_DEVICE(0x0738, 0x4540) }, /* Mad Catz Beat Pad */
- XPAD_XBOXONE_VENDOR(0x0738), /* Mad Catz FightStick TE 2 */
XPAD_XBOX360_VENDOR(0x07ff), /* Mad Catz Gamepad */
XPAD_XBOX360_VENDOR(0x0b05), /* ASUS controllers */
- XPAD_XBOXONE_VENDOR(0x0b05), /* ASUS controllers */
XPAD_XBOX360_VENDOR(0x0c12), /* Zeroplus X-Box 360 controllers */
XPAD_XBOX360_VENDOR(0x0db0), /* Micro Star International X-Box 360 controllers */
XPAD_XBOX360_VENDOR(0x0e6f), /* 0x0e6f Xbox 360 controllers */
- XPAD_XBOXONE_VENDOR(0x0e6f), /* 0x0e6f Xbox One controllers */
XPAD_XBOX360_VENDOR(0x0f0d), /* Hori controllers */
- XPAD_XBOXONE_VENDOR(0x0f0d), /* Hori controllers */
XPAD_XBOX360_VENDOR(0x1038), /* SteelSeries controllers */
- XPAD_XBOXONE_VENDOR(0x10f5), /* Turtle Beach Controllers */
XPAD_XBOX360_VENDOR(0x11c9), /* Nacon GC100XF */
XPAD_XBOX360_VENDOR(0x11ff), /* PXN V900 */
XPAD_XBOX360_VENDOR(0x1209), /* Ardwiino Controllers */
@@ -529,7 +409,6 @@ static const struct usb_device_id xpad_table[] = {
XPAD_XBOX360_VENDOR(0x1430), /* RedOctane Xbox 360 controllers */
XPAD_XBOX360_VENDOR(0x146b), /* Bigben Interactive controllers */
XPAD_XBOX360_VENDOR(0x1532), /* Razer Sabertooth */
- XPAD_XBOXONE_VENDOR(0x1532), /* Razer Wildcat */
XPAD_XBOX360_VENDOR(0x15e4), /* Numark Xbox 360 controllers */
XPAD_XBOX360_VENDOR(0x162e), /* Joytech Xbox 360 controllers */
XPAD_XBOX360_VENDOR(0x1689), /* Razer Onza */
@@ -540,27 +419,18 @@ static const struct usb_device_id xpad_table[] = {
XPAD_XBOX360_VENDOR(0x1ee9), /* ZOTAC Technology Limited */
XPAD_XBOX360_VENDOR(0x20bc), /* BETOP wireless dongles */
XPAD_XBOX360_VENDOR(0x20d6), /* PowerA controllers */
- XPAD_XBOXONE_VENDOR(0x20d6), /* PowerA controllers */
XPAD_XBOX360_VENDOR(0x2345), /* Machenike Controllers */
XPAD_XBOX360_VENDOR(0x24c6), /* PowerA controllers */
- XPAD_XBOXONE_VENDOR(0x24c6), /* PowerA controllers */
XPAD_XBOX360_VENDOR(0x2563), /* OneXPlayer Gamepad */
XPAD_XBOX360_VENDOR(0x260d), /* Dareu H101 */
- XPAD_XBOXONE_VENDOR(0x294b), /* Snakebyte */
XPAD_XBOX360_VENDOR(0x2993), /* TECNO Mobile */
XPAD_XBOX360_VENDOR(0x2c22), /* Qanba Controllers */
XPAD_XBOX360_VENDOR(0x2dc8), /* 8BitDo Controllers */
- XPAD_XBOXONE_VENDOR(0x2dc8), /* 8BitDo Controllers */
- XPAD_XBOXONE_VENDOR(0x2e24), /* Hyperkin Controllers */
XPAD_XBOX360_VENDOR(0x2f24), /* GameSir Controllers */
- XPAD_XBOXONE_VENDOR(0x2e95), /* SCUF Gaming Controller */
XPAD_XBOX360_VENDOR(0x31e3), /* Wooting Keyboards */
XPAD_XBOX360_VENDOR(0x3285), /* Nacon GC-100 */
- XPAD_XBOXONE_VENDOR(0x3285), /* Nacon Evol-X */
XPAD_XBOX360_VENDOR(0x3537), /* GameSir Controllers */
- XPAD_XBOXONE_VENDOR(0x3537), /* GameSir Controllers */
XPAD_XBOX360_VENDOR(0x3651), /* CRKD Controllers */
- XPAD_XBOXONE_VENDOR(0x366c), /* ByoWave controllers */
XPAD_XBOX360_VENDOR(0x37d7), /* Flydigi Controllers */
XPAD_XBOX360_VENDOR(0x3958), /* RedOctane Games Controllers */
XPAD_XBOX360_VENDOR(0x413d), /* Black Shark Green Ghost Controller */
@@ -569,162 +439,6 @@ static const struct usb_device_id xpad_table[] = {
MODULE_DEVICE_TABLE(usb, xpad_table);
-struct xboxone_init_packet {
- u16 idVendor;
- u16 idProduct;
- const u8 *data;
- u8 len;
-};
-
-#define XBOXONE_INIT_PKT(_vid, _pid, _data) \
- { \
- .idVendor = (_vid), \
- .idProduct = (_pid), \
- .data = (_data), \
- .len = ARRAY_SIZE(_data), \
- }
-
-/*
- * starting with xbox one, the game input protocol is used
- * magic numbers are taken from
- * - https://github.com/xpadneo/gip-dissector/blob/main/src/gip-dissector.lua
- * - https://github.com/medusalix/xone/blob/master/bus/protocol.c
- */
-#define GIP_CMD_ACK 0x01
-#define GIP_CMD_ANNOUNCE 0x02
-#define GIP_CMD_IDENTIFY 0x04
-#define GIP_CMD_POWER 0x05
-#define GIP_CMD_AUTHENTICATE 0x06
-#define GIP_CMD_VIRTUAL_KEY 0x07
-#define GIP_CMD_RUMBLE 0x09
-#define GIP_CMD_LED 0x0a
-#define GIP_CMD_FIRMWARE 0x0c
-#define GIP_CMD_INPUT 0x20
-
-#define GIP_SEQ0 0x00
-
-#define GIP_OPT_ACK 0x10
-#define GIP_OPT_INTERNAL 0x20
-
-/*
- * length of the command payload encoded with
- * https://en.wikipedia.org/wiki/LEB128
- * which is a no-op for N < 128
- */
-#define GIP_PL_LEN(N) (N)
-
-/*
- * payload specific defines
- */
-#define GIP_PWR_ON 0x00
-#define GIP_LED_ON 0x01
-
-#define GIP_MOTOR_R BIT(0)
-#define GIP_MOTOR_L BIT(1)
-#define GIP_MOTOR_RT BIT(2)
-#define GIP_MOTOR_LT BIT(3)
-#define GIP_MOTOR_ALL (GIP_MOTOR_R | GIP_MOTOR_L | GIP_MOTOR_RT | GIP_MOTOR_LT)
-
-#define GIP_WIRED_INTF_DATA 0
-#define GIP_WIRED_INTF_AUDIO 1
-
-/*
- * This packet is required for all Xbox One pads with 2015
- * or later firmware installed (or present from the factory).
- */
-static const u8 xboxone_power_on[] = {
- GIP_CMD_POWER, GIP_OPT_INTERNAL, GIP_SEQ0, GIP_PL_LEN(1), GIP_PWR_ON
-};
-
-/*
- * This packet is required for Xbox One S (0x045e:0x02ea)
- * and Xbox One Elite Series 2 (0x045e:0x0b00) pads to
- * initialize the controller that was previously used in
- * Bluetooth mode.
- */
-static const u8 xboxone_s_init[] = {
- GIP_CMD_POWER, GIP_OPT_INTERNAL, GIP_SEQ0, 0x0f, 0x06
-};
-
-/*
- * This packet is required to get additional input data
- * from Xbox One Elite Series 2 (0x045e:0x0b00) pads.
- * We mostly do this right now to get paddle data
- */
-static const u8 extra_input_packet_init[] = {
- 0x4d, 0x10, 0x01, 0x02, 0x07, 0x00
-};
-
-/*
- * This packet is required for the Titanfall 2 Xbox One pads
- * (0x0e6f:0x0165) to finish initialization and for Hori pads
- * (0x0f0d:0x0067) to make the analog sticks work.
- */
-static const u8 xboxone_hori_ack_id[] = {
- GIP_CMD_ACK, GIP_OPT_INTERNAL, GIP_SEQ0, GIP_PL_LEN(9),
- 0x00, GIP_CMD_IDENTIFY, GIP_OPT_INTERNAL, 0x3a, 0x00, 0x00, 0x00, 0x80, 0x00
-};
-
-/*
- * This packet is sent by default on Windows, and is required for some pads to
- * start sending input reports, including most (all?) of the PDP. These pads
- * include: (0x0e6f:0x02ab), (0x0e6f:0x02a4), (0x0e6f:0x02a6).
- */
-static const u8 xboxone_led_on[] = { GIP_CMD_LED, GIP_OPT_INTERNAL, GIP_SEQ0,
-GIP_PL_LEN(3), 0x00, GIP_LED_ON, 0x14 };
-
-/*
- * This packet is required for most (all?) of the PDP pads to start
- * sending input reports. These pads include: (0x0e6f:0x02ab),
- * (0x0e6f:0x02a4), (0x0e6f:0x02a6).
- */
-static const u8 xboxone_auth_done[] = {
- GIP_CMD_AUTHENTICATE, GIP_OPT_INTERNAL, GIP_SEQ0, GIP_PL_LEN(2), 0x01, 0x00
-};
-
-/*
- * A specific rumble packet is required for some PowerA pads to start
- * sending input reports. One of those pads is (0x24c6:0x543a).
- */
-static const u8 xboxone_rumblebegin_init[] = {
- GIP_CMD_RUMBLE, 0x00, GIP_SEQ0, GIP_PL_LEN(9),
- 0x00, GIP_MOTOR_ALL, 0x00, 0x00, 0x1D, 0x1D, 0xFF, 0x00, 0x00
-};
-
-/*
- * A rumble packet with zero FF intensity will immediately
- * terminate the rumbling required to init PowerA pads.
- * This should happen fast enough that the motors don't
- * spin up to enough speed to actually vibrate the gamepad.
- */
-static const u8 xboxone_rumbleend_init[] = {
- GIP_CMD_RUMBLE, 0x00, GIP_SEQ0, GIP_PL_LEN(9),
- 0x00, GIP_MOTOR_ALL, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
-};
-
-/*
- * This specifies the selection of init packets that a gamepad
- * will be sent on init *and* the order in which they will be
- * sent. The correct sequence number will be added when the
- * packet is going to be sent.
- */
-static const struct xboxone_init_packet xboxone_init_packets[] = {
- XBOXONE_INIT_PKT(0x0e6f, 0x0165, xboxone_hori_ack_id),
- XBOXONE_INIT_PKT(0x0f0d, 0x0067, xboxone_hori_ack_id),
- XBOXONE_INIT_PKT(0x0000, 0x0000, xboxone_power_on),
- XBOXONE_INIT_PKT(0x045e, 0x02ea, xboxone_s_init),
- XBOXONE_INIT_PKT(0x045e, 0x0b00, xboxone_s_init),
- XBOXONE_INIT_PKT(0x045e, 0x0b00, extra_input_packet_init),
- XBOXONE_INIT_PKT(0x0000, 0x0000, xboxone_led_on),
- XBOXONE_INIT_PKT(0x0000, 0x0000, xboxone_auth_done),
- XBOXONE_INIT_PKT(0x24c6, 0x541a, xboxone_rumblebegin_init),
- XBOXONE_INIT_PKT(0x24c6, 0x542a, xboxone_rumblebegin_init),
- XBOXONE_INIT_PKT(0x24c6, 0x543a, xboxone_rumblebegin_init),
- XBOXONE_INIT_PKT(0x24c6, 0x541a, xboxone_rumbleend_init),
- XBOXONE_INIT_PKT(0x24c6, 0x542a, xboxone_rumbleend_init),
- XBOXONE_INIT_PKT(0x24c6, 0x543a, xboxone_rumbleend_init),
-};
-
struct xpad_output_packet {
u8 data[XPAD_PKT_LEN];
u8 len;
@@ -754,14 +468,12 @@ struct usb_xpad {
struct urb *irq_out; /* urb for interrupt out report */
struct usb_anchor irq_out_anchor;
bool irq_out_active; /* we must not use an active URB */
- u8 odata_serial; /* serial number for xbox one protocol */
unsigned char *odata; /* output data */
dma_addr_t odata_dma;
spinlock_t odata_lock;
struct xpad_output_packet out_packets[XPAD_NUM_OUT_PACKETS];
int last_out_packet;
- int init_seq;
#if defined(CONFIG_JOYSTICK_XPAD_LEDS)
struct xpad_led *led;
@@ -771,19 +483,14 @@ struct usb_xpad {
int mapping; /* map d-pad to buttons or to axes */
int xtype; /* type of xbox device */
- int packet_type; /* type of the extended packet */
int pad_nr; /* the order x360 pads were attached */
const char *name; /* name of the device */
struct work_struct work; /* init/remove device from callback */
time64_t mode_btn_down_ts;
- bool delay_init; /* init packets should be delayed */
- bool delayed_init_done;
};
static int xpad_init_input(struct usb_xpad *xpad);
static void xpad_deinit_input(struct usb_xpad *xpad);
-static int xpad_start_input(struct usb_xpad *xpad);
-static void xpadone_ack_mode_report(struct usb_xpad *xpad, u8 seq_num);
static void xpad360w_poweroff_controller(struct usb_xpad *xpad);
/*
@@ -1021,187 +728,6 @@ static void xpad360w_process_packet(struct usb_xpad *xpad, u16 cmd, unsigned cha
rcu_read_unlock();
}
-/*
- * xpadone_process_packet
- *
- * Completes a request by converting the data into events for the
- * input subsystem. This version is for the Xbox One controller.
- *
- * The report format was gleaned from
- * https://github.com/kylelemons/xbox/blob/master/xbox.go
- */
-static void xpadone_process_packet(struct usb_xpad *xpad, u16 cmd, unsigned char *data, u32 len)
-{
- struct input_dev *dev = xpad->dev;
- bool do_sync = false;
-
- /* the xbox button has its own special report */
- if (data[0] == GIP_CMD_VIRTUAL_KEY) {
- /*
- * The Xbox One S controller requires these reports to be
- * acked otherwise it continues sending them forever and
- * won't report further mode button events.
- */
- if (data[1] == (GIP_OPT_ACK | GIP_OPT_INTERNAL))
- xpadone_ack_mode_report(xpad, data[2]);
-
- input_report_key(dev, BTN_MODE, data[4] & GENMASK(1, 0));
- input_sync(dev);
-
- do_sync = true;
- } else if (data[0] == GIP_CMD_FIRMWARE) {
- /* Some packet formats force us to use this separate to poll paddle inputs */
- if (xpad->packet_type == PKT_XBE2_FW_5_11) {
- /* Mute paddles if controller is in a custom profile slot
- * Checked by looking at the active profile slot to
- * verify it's the default slot
- */
- if (data[19] != 0)
- data[18] = 0;
-
- /* Elite Series 2 split packet paddle bits */
- input_report_key(dev, BTN_GRIPR, data[18] & BIT(0));
- input_report_key(dev, BTN_GRIPR2, data[18] & BIT(1));
- input_report_key(dev, BTN_GRIPL, data[18] & BIT(2));
- input_report_key(dev, BTN_GRIPL2, data[18] & BIT(3));
-
- do_sync = true;
- }
- } else if (data[0] == GIP_CMD_ANNOUNCE) {
- int error;
-
- if (xpad->delay_init && !xpad->delayed_init_done) {
- xpad->delayed_init_done = true;
- error = xpad_start_input(xpad);
- if (error)
- dev_warn(&xpad->dev->dev,
- "unable to start delayed input: %d\n",
- error);
- }
- } else if (data[0] == GIP_CMD_INPUT) { /* The main valid packet type for inputs */
- /* menu/view buttons */
- input_report_key(dev, BTN_START, data[4] & BIT(2));
- input_report_key(dev, BTN_SELECT, data[4] & BIT(3));
- if (xpad->mapping & MAP_SHARE_BUTTON) {
- u32 offset = (xpad->mapping & MAP_SHARE_OFFSET) ? 26 : 18;
-
- if (len >= offset)
- input_report_key(dev, KEY_RECORD, data[len - offset] & BIT(0));
- }
-
- /* buttons A,B,X,Y */
- input_report_key(dev, BTN_A, data[4] & BIT(4));
- input_report_key(dev, BTN_B, data[4] & BIT(5));
- input_report_key(dev, BTN_X, data[4] & BIT(6));
- input_report_key(dev, BTN_Y, data[4] & BIT(7));
-
- /* digital pad */
- if (xpad->mapping & MAP_DPAD_TO_BUTTONS) {
- /* dpad as buttons (left, right, up, down) */
- input_report_key(dev, BTN_DPAD_LEFT, data[5] & BIT(2));
- input_report_key(dev, BTN_DPAD_RIGHT, data[5] & BIT(3));
- input_report_key(dev, BTN_DPAD_UP, data[5] & BIT(0));
- input_report_key(dev, BTN_DPAD_DOWN, data[5] & BIT(1));
- } else {
- input_report_abs(dev, ABS_HAT0X,
- !!(data[5] & 0x08) - !!(data[5] & 0x04));
- input_report_abs(dev, ABS_HAT0Y,
- !!(data[5] & 0x02) - !!(data[5] & 0x01));
- }
-
- /* TL/TR */
- input_report_key(dev, BTN_TL, data[5] & BIT(4));
- input_report_key(dev, BTN_TR, data[5] & BIT(5));
-
- /* stick press left/right */
- input_report_key(dev, BTN_THUMBL, data[5] & BIT(6));
- input_report_key(dev, BTN_THUMBR, data[5] & BIT(7));
-
- if (!(xpad->mapping & MAP_STICKS_TO_NULL)) {
- /* left stick */
- input_report_abs(dev, ABS_X,
- (__s16) le16_to_cpup((__le16 *)(data + 10)));
- input_report_abs(dev, ABS_Y,
- ~(__s16) le16_to_cpup((__le16 *)(data + 12)));
-
- /* right stick */
- input_report_abs(dev, ABS_RX,
- (__s16) le16_to_cpup((__le16 *)(data + 14)));
- input_report_abs(dev, ABS_RY,
- ~(__s16) le16_to_cpup((__le16 *)(data + 16)));
- }
-
- /* triggers left/right */
- if (xpad->mapping & MAP_TRIGGERS_TO_BUTTONS) {
- input_report_key(dev, BTN_TL2,
- (__u16) le16_to_cpup((__le16 *)(data + 6)));
- input_report_key(dev, BTN_TR2,
- (__u16) le16_to_cpup((__le16 *)(data + 8)));
- } else {
- input_report_abs(dev, ABS_Z,
- (__u16) le16_to_cpup((__le16 *)(data + 6)));
- input_report_abs(dev, ABS_RZ,
- (__u16) le16_to_cpup((__le16 *)(data + 8)));
- }
-
- /* Profile button has a value of 0-3, so it is reported as an axis */
- if (xpad->mapping & MAP_PROFILE_BUTTON)
- input_report_abs(dev, ABS_PROFILE, data[34]);
-
- /* paddle handling */
- /* based on SDL's SDL_hidapi_xboxone.c */
- if (xpad->mapping & MAP_PADDLES) {
- if (xpad->packet_type == PKT_XBE1) {
- /* Mute paddles if controller has a custom mapping applied.
- * Checked by comparing the current mapping
- * config against the factory mapping config
- */
- if (memcmp(&data[4], &data[18], 2) != 0)
- data[32] = 0;
-
- /* OG Elite Series Controller paddle bits */
- input_report_key(dev, BTN_GRIPR, data[32] & BIT(1));
- input_report_key(dev, BTN_GRIPR2, data[32] & BIT(3));
- input_report_key(dev, BTN_GRIPL, data[32] & BIT(0));
- input_report_key(dev, BTN_GRIPL2, data[32] & BIT(2));
- } else if (xpad->packet_type == PKT_XBE2_FW_OLD) {
- /* Mute paddles if controller has a custom mapping applied.
- * Checked by comparing the current mapping
- * config against the factory mapping config
- */
- if (data[19] != 0)
- data[18] = 0;
-
- /* Elite Series 2 4.x firmware paddle bits */
- input_report_key(dev, BTN_GRIPR, data[18] & BIT(0));
- input_report_key(dev, BTN_GRIPR2, data[18] & BIT(1));
- input_report_key(dev, BTN_GRIPL, data[18] & BIT(2));
- input_report_key(dev, BTN_GRIPL2, data[18] & BIT(3));
- } else if (xpad->packet_type == PKT_XBE2_FW_5_EARLY) {
- /* Mute paddles if controller has a custom mapping applied.
- * Checked by comparing the current mapping
- * config against the factory mapping config
- */
- if (data[23] != 0)
- data[22] = 0;
-
- /* Elite Series 2 5.x firmware paddle bits
- * (before the packet was split)
- */
- input_report_key(dev, BTN_GRIPR, data[22] & BIT(0));
- input_report_key(dev, BTN_GRIPR2, data[22] & BIT(1));
- input_report_key(dev, BTN_GRIPL, data[22] & BIT(2));
- input_report_key(dev, BTN_GRIPL2, data[22] & BIT(3));
- }
- }
-
- do_sync = true;
- }
-
- if (do_sync)
- input_sync(dev);
-}
-
static void xpad_irq_in(struct urb *urb)
{
struct usb_xpad *xpad = urb->context;
@@ -1234,9 +760,6 @@ static void xpad_irq_in(struct urb *urb)
case XTYPE_XBOX360W:
xpad360w_process_packet(xpad, 0, xpad->idata);
break;
- case XTYPE_XBOXONE:
- xpadone_process_packet(xpad, 0, xpad->idata, urb->actual_length);
- break;
default:
xpad_process_packet(xpad, 0, xpad->idata);
}
@@ -1248,56 +771,12 @@ static void xpad_irq_in(struct urb *urb)
__func__, retval);
}
-/* Callers must hold xpad->odata_lock spinlock */
-static bool xpad_prepare_next_init_packet(struct usb_xpad *xpad)
-{
- const struct xboxone_init_packet *init_packet;
-
- if (xpad->xtype != XTYPE_XBOXONE)
- return false;
-
- /*
- * Some dongles will discard init packets if they're sent before the
- * controller connects. In these cases, we need to wait until we get
- * an announce packet from them to send the init packet sequence.
- */
- if (xpad->delay_init && !xpad->delayed_init_done)
- return false;
-
- /* Perform initialization sequence for Xbox One pads that require it */
- while (xpad->init_seq < ARRAY_SIZE(xboxone_init_packets)) {
- init_packet = &xboxone_init_packets[xpad->init_seq++];
-
- if (init_packet->idVendor != 0 &&
- init_packet->idVendor != xpad->dev->id.vendor)
- continue;
-
- if (init_packet->idProduct != 0 &&
- init_packet->idProduct != xpad->dev->id.product)
- continue;
-
- /* This packet applies to our device, so prepare to send it */
- memcpy(xpad->odata, init_packet->data, init_packet->len);
- xpad->irq_out->transfer_buffer_length = init_packet->len;
-
- /* Update packet with current sequence number */
- xpad->odata[2] = xpad->odata_serial++;
- return true;
- }
-
- return false;
-}
-
/* Callers must hold xpad->odata_lock spinlock */
static bool xpad_prepare_next_out_packet(struct usb_xpad *xpad)
{
struct xpad_output_packet *pkt, *packet = NULL;
int i;
- /* We may have init packets to send before we can send user commands */
- if (xpad_prepare_next_init_packet(xpad))
- return true;
-
for (i = 0; i < XPAD_NUM_OUT_PACKETS; i++) {
if (++xpad->last_out_packet >= XPAD_NUM_OUT_PACKETS)
xpad->last_out_packet = 0;
@@ -1473,57 +952,6 @@ static int xpad_inquiry_pad_presence(struct usb_xpad *xpad)
return xpad_try_sending_next_out_packet(xpad);
}
-static int xpad_start_xbox_one(struct usb_xpad *xpad)
-{
- int error;
-
- if (usb_ifnum_to_if(xpad->udev, GIP_WIRED_INTF_AUDIO)) {
- /*
- * Explicitly disable the audio interface. This is needed
- * for some controllers, such as the PowerA Enhanced Wired
- * Controller for Series X|S (0x20d6:0x200e) to report the
- * guide button.
- */
- error = usb_set_interface(xpad->udev,
- GIP_WIRED_INTF_AUDIO, 0);
- if (error)
- dev_warn(&xpad->dev->dev,
- "unable to disable audio interface: %d\n",
- error);
- }
-
- guard(spinlock_irqsave)(&xpad->odata_lock);
-
- /*
- * Begin the init sequence by attempting to send a packet.
- * We will cycle through the init packet sequence before
- * sending any packets from the output ring.
- */
- xpad->init_seq = 0;
- return xpad_try_sending_next_out_packet(xpad);
-}
-
-static void xpadone_ack_mode_report(struct usb_xpad *xpad, u8 seq_num)
-{
- struct xpad_output_packet *packet =
- &xpad->out_packets[XPAD_OUT_CMD_IDX];
- static const u8 mode_report_ack[] = {
- GIP_CMD_ACK, GIP_OPT_INTERNAL, GIP_SEQ0, GIP_PL_LEN(9),
- 0x00, GIP_CMD_VIRTUAL_KEY, GIP_OPT_INTERNAL, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00
- };
-
- guard(spinlock_irqsave)(&xpad->odata_lock);
-
- packet->len = sizeof(mode_report_ack);
- memcpy(packet->data, mode_report_ack, packet->len);
- packet->data[2] = seq_num;
- packet->pending = true;
-
- /* Reset the sequence so we send out the ack now */
- xpad->last_out_packet = -1;
- xpad_try_sending_next_out_packet(xpad);
-}
-
#ifdef CONFIG_JOYSTICK_XPAD_FF
static int xpad_play_effect(struct input_dev *dev, void *data, struct ff_effect *effect)
{
@@ -1582,24 +1010,6 @@ static int xpad_play_effect(struct input_dev *dev, void *data, struct ff_effect
packet->pending = true;
break;
- case XTYPE_XBOXONE:
- packet->data[0] = GIP_CMD_RUMBLE; /* activate rumble */
- packet->data[1] = 0x00;
- packet->data[2] = xpad->odata_serial++;
- packet->data[3] = GIP_PL_LEN(9);
- packet->data[4] = 0x00;
- packet->data[5] = GIP_MOTOR_ALL;
- packet->data[6] = 0x00; /* left trigger */
- packet->data[7] = 0x00; /* right trigger */
- packet->data[8] = strong / 512; /* left actuator */
- packet->data[9] = weak / 512; /* right actuator */
- packet->data[10] = 0xFF; /* on period */
- packet->data[11] = 0x00; /* off period */
- packet->data[12] = 0xFF; /* repeat count */
- packet->len = 13;
- packet->pending = true;
- break;
-
default:
dev_dbg(&xpad->dev->dev,
"%s - rumble command sent to unsupported xpad type: %d\n",
@@ -1778,13 +1188,6 @@ static int xpad_start_input(struct usb_xpad *xpad)
if (usb_submit_urb(xpad->irq_in, GFP_KERNEL))
return -EIO;
- if (xpad->xtype == XTYPE_XBOXONE) {
- error = xpad_start_xbox_one(xpad);
- if (error) {
- usb_kill_urb(xpad->irq_in);
- return error;
- }
- }
if (xpad->xtype == XTYPE_XBOX360) {
/*
* Some third-party controllers Xbox 360-style controllers
@@ -1890,8 +1293,6 @@ static void xpad_close(struct input_dev *dev)
static void xpad_set_up_abs(struct input_dev *input_dev, signed short abs)
{
- struct usb_xpad *xpad = input_get_drvdata(input_dev);
-
switch (abs) {
case ABS_X:
case ABS_Y:
@@ -1901,18 +1302,12 @@ static void xpad_set_up_abs(struct input_dev *input_dev, signed short abs)
break;
case ABS_Z:
case ABS_RZ: /* the triggers (if mapped to axes) */
- if (xpad->xtype == XTYPE_XBOXONE)
- input_set_abs_params(input_dev, abs, 0, 1023, 0, 0);
- else
- input_set_abs_params(input_dev, abs, 0, 255, 0, 0);
+ input_set_abs_params(input_dev, abs, 0, 255, 0, 0);
break;
case ABS_HAT0X:
case ABS_HAT0Y: /* the d-pad (only if dpad is mapped to axes */
input_set_abs_params(input_dev, abs, -1, 1, 0, 0);
break;
- case ABS_PROFILE: /* 4 value profile button (such as on XAC) */
- input_set_abs_params(input_dev, abs, 0, 4, 0, 0);
- break;
default:
input_set_abs_params(input_dev, abs, 0, 0, 0, 0);
break;
@@ -1967,12 +1362,9 @@ static int xpad_init_input(struct usb_xpad *xpad)
input_set_capability(input_dev, EV_KEY, xpad_common_btn[i]);
/* set up model-specific ones */
- if (xpad->xtype == XTYPE_XBOX360 || xpad->xtype == XTYPE_XBOX360W ||
- xpad->xtype == XTYPE_XBOXONE) {
+ if (xpad->xtype == XTYPE_XBOX360 || xpad->xtype == XTYPE_XBOX360W) {
for (i = 0; xpad360_btn[i] >= 0; i++)
input_set_capability(input_dev, EV_KEY, xpad360_btn[i]);
- if (xpad->mapping & MAP_SHARE_BUTTON)
- input_set_capability(input_dev, EV_KEY, KEY_RECORD);
} else {
for (i = 0; xpad_btn[i] >= 0; i++)
input_set_capability(input_dev, EV_KEY, xpad_btn[i]);
@@ -1984,12 +1376,6 @@ static int xpad_init_input(struct usb_xpad *xpad)
xpad_btn_pad[i]);
}
- /* set up paddles if the controller has them */
- if (xpad->mapping & MAP_PADDLES) {
- for (i = 0; xpad_btn_paddles[i] >= 0; i++)
- input_set_capability(input_dev, EV_KEY, xpad_btn_paddles[i]);
- }
-
/*
* This should be a simple else block. However historically
* xbox360w has mapped DPAD to buttons while xbox360 did not. This
@@ -2011,10 +1397,6 @@ static int xpad_init_input(struct usb_xpad *xpad)
xpad_set_up_abs(input_dev, xpad_abs_triggers[i]);
}
- /* setup profile button as an axis with 4 possible values */
- if (xpad->mapping & MAP_PROFILE_BUTTON)
- xpad_set_up_abs(input_dev, ABS_PROFILE);
-
error = xpad_init_ff(xpad);
if (error)
goto err_free_input;
@@ -2080,18 +1462,13 @@ static int xpad_probe(struct usb_interface *intf, const struct usb_device_id *id
xpad->mapping = xpad_device[i].mapping;
xpad->xtype = xpad_device[i].xtype;
xpad->name = xpad_device[i].name;
- if (xpad_device[i].flags & FLAG_DELAY_INIT)
- xpad->delay_init = true;
- xpad->packet_type = PKT_XB;
INIT_WORK(&xpad->work, xpad_presence_work);
if (xpad->xtype == XTYPE_UNKNOWN) {
if (intf->cur_altsetting->desc.bInterfaceClass == USB_CLASS_VENDOR_SPEC) {
if (intf->cur_altsetting->desc.bInterfaceProtocol == 129)
xpad->xtype = XTYPE_XBOX360W;
- else if (intf->cur_altsetting->desc.bInterfaceProtocol == 208)
- xpad->xtype = XTYPE_XBOXONE;
else
xpad->xtype = XTYPE_XBOX360;
} else {
@@ -2106,17 +1483,6 @@ static int xpad_probe(struct usb_interface *intf, const struct usb_device_id *id
xpad->mapping |= MAP_STICKS_TO_NULL;
}
- if (xpad->xtype == XTYPE_XBOXONE &&
- intf->cur_altsetting->desc.bInterfaceNumber != GIP_WIRED_INTF_DATA) {
- /*
- * The Xbox One controller lists three interfaces all with the
- * same interface class, subclass and protocol. Differentiate by
- * interface number.
- */
- error = -ENODEV;
- goto err_free_in_urb;
- }
-
ep_irq_in = ep_irq_out = NULL;
for (i = 0; i < 2; i++) {
@@ -2149,38 +1515,6 @@ static int xpad_probe(struct usb_interface *intf, const struct usb_device_id *id
usb_set_intfdata(intf, xpad);
- /* Packet type detection */
- if (le16_to_cpu(udev->descriptor.idVendor) == 0x045e) { /* Microsoft controllers */
- if (le16_to_cpu(udev->descriptor.idProduct) == 0x02e3) {
- /* The original elite controller always uses the oldest
- * type of extended packet
- */
- xpad->packet_type = PKT_XBE1;
- } else if (le16_to_cpu(udev->descriptor.idProduct) == 0x0b00) {
- /* The elite 2 controller has seen multiple packet
- * revisions. These are tied to specific firmware
- * versions
- */
- if (le16_to_cpu(udev->descriptor.bcdDevice) < 0x0500) {
- /* This is the format that the Elite 2 used
- * prior to the BLE update
- */
- xpad->packet_type = PKT_XBE2_FW_OLD;
- } else if (le16_to_cpu(udev->descriptor.bcdDevice) <
- 0x050b) {
- /* This is the format that the Elite 2 used
- * prior to the update that split the packet
- */
- xpad->packet_type = PKT_XBE2_FW_5_EARLY;
- } else {
- /* The split packet format that was introduced
- * in firmware v5.11
- */
- xpad->packet_type = PKT_XBE2_FW_5_11;
- }
- }
- }
-
if (xpad->xtype == XTYPE_XBOX360W) {
/*
* Submit the int URB immediately rather than waiting for open
@@ -2282,7 +1616,6 @@ static int xpad_resume(struct usb_interface *intf)
struct usb_xpad *xpad = usb_get_intfdata(intf);
struct input_dev *input = xpad->dev;
- xpad->delayed_init_done = false;
if (xpad->xtype == XTYPE_XBOX360W)
return xpad360w_start_input(xpad);
@@ -2291,15 +1624,6 @@ static int xpad_resume(struct usb_interface *intf)
if (input_device_enabled(input))
return xpad_start_input(xpad);
- if (xpad->xtype == XTYPE_XBOXONE) {
- /*
- * Even if there are no users, we'll send Xbox One pads
- * the startup sequence so they don't sit there and
- * blink until somebody opens the input device again.
- */
- return xpad_start_xbox_one(xpad);
- }
-
return 0;
}
--
2.54.0
^ permalink raw reply related [flat|nested] 23+ messages in thread
* [PATCH v6 03/12] Input: xbox_gip - Add controllable LED support
2026-09-08 3:21 [PATCH v6 00/12] Input: xbox_gip - Add new driver for Xbox GIP Vicki Pfau
2026-09-08 3:21 ` [PATCH v6 01/12] " Vicki Pfau
2026-09-08 3:21 ` [PATCH v6 02/12] Input: xpad - Remove Xbox One support Vicki Pfau
@ 2026-09-08 3:21 ` Vicki Pfau
2026-09-08 3:39 ` sashiko-bot
2026-09-08 3:21 ` [PATCH v6 04/12] Input: xbox_gip - Add HID relaying Vicki Pfau
` (8 subsequent siblings)
11 siblings, 1 reply; 23+ messages in thread
From: Vicki Pfau @ 2026-09-08 3:21 UTC (permalink / raw)
To: Dmitry Torokhov, linux-input; +Cc: Vicki Pfau
Xbox One controllers have two different types of controllable LED support:
- Monochrome white, which most controllers have.
- RGBW addressible, which the Elite 2 controllers have.
This exposes both types as led cdevs.
Signed-off-by: Vicki Pfau <vi@endrift.com>
---
drivers/input/joystick/gip/Kconfig | 2 +-
drivers/input/joystick/gip/gip-core.c | 115 ++++++++++++++++++++++++++
drivers/input/joystick/gip/gip.h | 6 +-
3 files changed, 121 insertions(+), 2 deletions(-)
diff --git a/drivers/input/joystick/gip/Kconfig b/drivers/input/joystick/gip/Kconfig
index 2ce789d23178..3422bf84cb89 100644
--- a/drivers/input/joystick/gip/Kconfig
+++ b/drivers/input/joystick/gip/Kconfig
@@ -4,7 +4,7 @@
#
config JOYSTICK_XBOX_GIP
tristate "Xbox One/Series controller support"
- depends on USB && USB_ARCH_HAS_HCD
+ depends on USB && USB_ARCH_HAS_HCD && LEDS_CLASS_MULTICOLOR
help
Say Y here if you want to use Xbox One and Series controllers with your
computer. Make sure to say Y to "Joystick support" (CONFIG_INPUT_JOYDEV)
diff --git a/drivers/input/joystick/gip/gip-core.c b/drivers/input/joystick/gip/gip-core.c
index 0e23811a6ecc..a5ed5f3bf3fe 100644
--- a/drivers/input/joystick/gip/gip-core.c
+++ b/drivers/input/joystick/gip/gip-core.c
@@ -1044,9 +1044,120 @@ static int gip_send_guide_button_led(struct gip_attachment *attachment,
if (!gip_supports_system_message(attachment, GIP_CMD_LED, false))
return 0;
+ if (!(attachment->features & GIP_FEATURE_GUIDE_COLOR))
+ attachment->guide_led.standard.brightness = intensity;
+
return gip_send_system_message(attachment, GIP_CMD_LED, 0, buffer, sizeof(buffer));
}
+static int gip_send_guide_button_color_led(struct gip_attachment *attachment,
+ uint8_t r, uint8_t g, uint8_t b, uint8_t w)
+{
+ uint8_t buffer[] = { 0x00, w, r, g, b };
+
+ if (!(attachment->features & GIP_FEATURE_GUIDE_COLOR))
+ return -EINVAL;
+
+ attachment->guide_led.color.subled_info[0].brightness = r;
+ attachment->guide_led.color.subled_info[1].brightness = g;
+ attachment->guide_led.color.subled_info[2].brightness = b;
+ attachment->guide_led.color.subled_info[3].brightness = w;
+
+ return gip_send_vendor_message(attachment, GIP_CMD_GUIDE_COLOR, 0, buffer, sizeof(buffer));
+}
+
+static int gip_guide_led_set(struct led_classdev *led,
+ enum led_brightness value)
+{
+ struct gip_attachment *attachment = container_of(led,
+ struct gip_attachment, guide_led.standard);
+
+ guard(mutex)(&attachment->lock);
+ return gip_send_guide_button_led(attachment, GIP_LED_GUIDE_ON, value);
+}
+
+static int gip_guide_color_led_set(struct led_classdev *led,
+ enum led_brightness value)
+{
+ struct led_classdev_mc *mc_cdev = container_of(led,
+ struct led_classdev_mc, led_cdev);
+ struct gip_attachment *attachment = container_of(mc_cdev,
+ struct gip_attachment, guide_led.color);
+
+ guard(mutex)(&attachment->lock);
+ led_mc_calc_color_components(mc_cdev, value);
+ return gip_send_guide_button_color_led(attachment,
+ mc_cdev->subled_info[0].brightness,
+ mc_cdev->subled_info[1].brightness,
+ mc_cdev->subled_info[2].brightness,
+ mc_cdev->subled_info[3].brightness);
+}
+
+static int gip_guide_led_probe(struct gip_attachment *attachment, struct device *dev)
+{
+ int rc = 0;
+
+ if (!gip_supports_system_message(attachment, GIP_CMD_LED, false))
+ return 0;
+
+ if (attachment->features & GIP_FEATURE_GUIDE_COLOR) {
+ struct mc_subled *mc_led_info;
+ struct led_classdev_mc *mc_cdev = &attachment->guide_led.color;
+ struct led_classdev *cdev = &mc_cdev->led_cdev;
+
+ mc_led_info = devm_kcalloc(dev, 4,
+ sizeof(*mc_led_info), GFP_KERNEL);
+ if (!mc_led_info)
+ return -ENOMEM;
+
+ mc_led_info[0].color_index = LED_COLOR_ID_RED;
+ mc_led_info[0].intensity = 51;
+ mc_led_info[1].color_index = LED_COLOR_ID_GREEN;
+ mc_led_info[1].intensity = 51;
+ mc_led_info[2].color_index = LED_COLOR_ID_BLUE;
+ mc_led_info[2].intensity = 51;
+ mc_led_info[3].color_index = LED_COLOR_ID_WHITE;
+ mc_led_info[3].intensity = 51;
+
+ mc_cdev->subled_info = mc_led_info;
+ mc_cdev->num_colors = 4;
+
+ cdev->brightness = 51;
+ cdev->max_brightness = 255;
+ cdev->flags = LED_CORE_SUSPENDRESUME | LED_RETAIN_AT_SHUTDOWN;
+ cdev->brightness_set_blocking = gip_guide_color_led_set;
+ cdev->name = devm_kasprintf(dev, GFP_KERNEL,
+ "%s:rgb:power", dev_name(dev));
+ if (!cdev->name)
+ rc = -ENOMEM;
+
+ if (!rc)
+ rc = devm_led_classdev_multicolor_register(dev,
+ mc_cdev);
+
+ if (rc)
+ devm_kfree(dev, mc_led_info);
+ } else {
+ struct led_classdev *cdev = &attachment->guide_led.standard;
+
+ cdev->max_brightness = GIP_LED_GUIDE_MAX_BRIGHTNESS;
+ cdev->brightness = GIP_LED_GUIDE_INIT_BRIGHTNESS;
+ cdev->flags = LED_CORE_SUSPENDRESUME | LED_RETAIN_AT_SHUTDOWN;
+ cdev->brightness_set_blocking = gip_guide_led_set;
+ cdev->name = devm_kasprintf(dev, GFP_KERNEL,
+ "%s:white:power", dev_name(dev));
+ if (!cdev->name)
+ return -ENOMEM;
+
+ rc = devm_led_classdev_register(dev, cdev);
+
+ if (rc)
+ devm_kfree(dev, cdev->name);
+ }
+
+ return rc;
+}
+
static bool gip_send_set_device_state(struct gip_attachment *attachment, uint8_t state)
{
uint8_t buffer[] = { state };
@@ -1157,6 +1268,10 @@ static int gip_setup_input_device(struct gip_attachment *attachment)
if (rc)
goto err_free_device;
+ rc = gip_guide_led_probe(attachment, &input->dev);
+ if (rc)
+ gip_err(attachment, "Failed to register LEDs: %d\n", rc);
+
return 0;
err_free_device:
diff --git a/drivers/input/joystick/gip/gip.h b/drivers/input/joystick/gip/gip.h
index 605149834269..69eef001d91f 100644
--- a/drivers/input/joystick/gip/gip.h
+++ b/drivers/input/joystick/gip/gip.h
@@ -12,6 +12,7 @@
#ifndef _GIP_H
#define _GIP_H
+#include <linux/led-class-multicolor.h>
#include <linux/rcupdate.h>
#include <linux/usb/input.h>
@@ -234,6 +235,10 @@ struct gip_attachment {
uint8_t seq_vendor;
uint8_t device_state;
+ union {
+ struct led_classdev standard;
+ struct led_classdev_mc color;
+ } guide_led;
struct gip_extended_status status;
@@ -245,7 +250,6 @@ struct gip_attachment {
int extra_axes;
bool dpad_as_buttons;
- struct hid_device __rcu *hdev;
};
struct gip_urb {
--
2.54.0
^ permalink raw reply related [flat|nested] 23+ messages in thread
* [PATCH v6 04/12] Input: xbox_gip - Add HID relaying
2026-09-08 3:21 [PATCH v6 00/12] Input: xbox_gip - Add new driver for Xbox GIP Vicki Pfau
` (2 preceding siblings ...)
2026-09-08 3:21 ` [PATCH v6 03/12] Input: xbox_gip - Add controllable LED support Vicki Pfau
@ 2026-09-08 3:21 ` Vicki Pfau
2026-09-08 3:45 ` sashiko-bot
2026-09-08 3:21 ` [PATCH v6 05/12] Input: xbox_gip - Add battery support Vicki Pfau
` (7 subsequent siblings)
11 siblings, 1 reply; 23+ messages in thread
From: Vicki Pfau @ 2026-09-08 3:21 UTC (permalink / raw)
To: Dmitry Torokhov, linux-input; +Cc: Vicki Pfau
GIP allows tunneling of HID packets, with the HID descriptor embedded in
the GIP metadata exchanged during the initial handshake. This patch creates
a hid_device for this HID descriptor if found, as well as relaying the HID
packets.
Signed-off-by: Vicki Pfau <vi@endrift.com>
---
drivers/input/joystick/gip/gip-core.c | 115 +++++++++++++++++++++++++-
drivers/input/joystick/gip/gip.h | 2 +
include/uapi/linux/input.h | 1 +
3 files changed, 115 insertions(+), 3 deletions(-)
diff --git a/drivers/input/joystick/gip/gip-core.c b/drivers/input/joystick/gip/gip-core.c
index a5ed5f3bf3fe..dc174560ee49 100644
--- a/drivers/input/joystick/gip/gip-core.c
+++ b/drivers/input/joystick/gip/gip-core.c
@@ -560,6 +560,54 @@ int gip_send_vendor_message(struct gip_attachment *attachment,
bytes, num_bytes);
}
+static int gip_hid_ll_parse(struct hid_device *hdev)
+{
+ struct gip_attachment *attachment = hdev->driver_data;
+
+ return hid_parse_report(hdev,
+ attachment->metadata.device.hid_descriptor,
+ attachment->metadata.device.hid_descriptor_size);
+}
+
+static int gip_hid_ll_start(struct hid_device *hdev)
+{
+ return 0;
+}
+
+static void gip_hid_ll_stop(struct hid_device *hdev)
+{
+}
+
+static int gip_hid_ll_open(struct hid_device *hdev)
+{
+ return 0;
+}
+
+static void gip_hid_ll_close(struct hid_device *hdev)
+{
+}
+
+static int gip_hid_ll_raw_request(struct hid_device *hdev,
+ unsigned char reportnum, uint8_t *buf, size_t count,
+ unsigned char report_type, int reqtype)
+{
+ /*
+ * TODO: Based on the metadata, output reports appear to be possible,
+ * but the chatpad doesn't have the LEDs it claims to support, so
+ * it's not clear how to test we're sending them properly.
+ */
+ return 0;
+}
+
+static const struct hid_ll_driver gip_hid_ll_driver = {
+ .parse = gip_hid_ll_parse,
+ .start = gip_hid_ll_start,
+ .stop = gip_hid_ll_stop,
+ .open = gip_hid_ll_open,
+ .close = gip_hid_ll_close,
+ .raw_request = gip_hid_ll_raw_request,
+};
+
static void gip_metadata_free(struct device *dev, struct gip_metadata *metadata)
{
devm_kfree(dev, metadata->device.audio_formats);
@@ -1310,6 +1358,50 @@ static int gip_init_input_device(struct gip_attachment *attachment)
return rc;
}
+static int gip_create_hdev(struct gip_attachment *attachment)
+{
+ struct hid_device *hdev;
+ int rc;
+
+ if (!attachment->metadata.device.hid_descriptor)
+ return 0;
+
+ rcu_read_lock();
+ hdev = rcu_dereference(attachment->hdev);
+ rcu_read_unlock();
+ if (hdev)
+ return 0;
+
+ hdev = hid_allocate_device();
+
+ if (IS_ERR(hdev))
+ return PTR_ERR(hdev);
+
+ hdev->ll_driver = &gip_hid_ll_driver;
+ hdev->bus = BUS_GIP;
+ hdev->vendor = attachment->vendor_id;
+ hdev->product = attachment->product_id;
+ hdev->version = 0x0100;
+ hdev->country = 0;
+ hdev->dev.parent = to_gip_device(attachment);
+ hdev->driver_data = attachment;
+ if (attachment->name)
+ strscpy(hdev->name, attachment->name);
+ else
+ strscpy(hdev->name, "Xbox Chatpad");
+ strscpy(hdev->phys, attachment->phys);
+ rc = hid_add_device(hdev);
+ if (rc) {
+ gip_err(attachment, "HID device add failed: %d\n", rc);
+ hid_destroy_device(hdev);
+ } else {
+ rcu_assign_pointer(attachment->hdev, hdev);
+ synchronize_rcu();
+ }
+
+ return rc;
+}
+
static int gip_send_init_sequence(struct gip_attachment *attachment)
{
int rc = 0;
@@ -1375,7 +1467,11 @@ static int gip_send_init_sequence(struct gip_attachment *attachment)
if (rc)
return rc;
- return 0;
+ rc = gip_create_hdev(attachment);
+ if (rc)
+ return rc;
+
+ return rc;
}
static void gip_fragment_timeout(struct work_struct *work)
@@ -1393,19 +1489,25 @@ static void gip_fragment_timeout(struct work_struct *work)
static void gip_free_devices(struct gip_attachment *attachment)
{
struct input_dev *input;
+ struct hid_device *hdev;
if (attachment->driver && attachment->driver->remove)
attachment->driver->remove(attachment);
rcu_read_lock();
input = rcu_dereference(attachment->input);
+ hdev = rcu_dereference(attachment->hdev);
rcu_read_unlock();
rcu_assign_pointer(attachment->input, NULL);
+ rcu_assign_pointer(attachment->hdev, NULL);
synchronize_rcu();
if (input)
input_unregister_device(input);
+
+ if (hdev)
+ hid_destroy_device(hdev);
}
static void gip_reset_metadata(struct gip_attachment *attachment)
@@ -1770,9 +1872,16 @@ static int gip_handle_command_firmware(struct gip_attachment *attachment,
static int gip_handle_command_hid_report(struct gip_attachment *attachment,
const struct gip_header *header, uint8_t *bytes, int num_bytes)
{
- gip_warn(attachment, "Unimplemented HID report message\n");
+ struct hid_device *hdev;
- return -EOPNOTSUPP;
+ guard(rcu)();
+ hdev = rcu_dereference(attachment->hdev);
+ if (hdev)
+ return hid_input_report(hdev, HID_INPUT_REPORT, bytes, num_bytes, true);
+
+ gip_warn(attachment, "Got HID report with no HID descriptor\n");
+
+ return -EPROTO;
}
static int gip_handle_command_extended(struct gip_attachment *attachment,
diff --git a/drivers/input/joystick/gip/gip.h b/drivers/input/joystick/gip/gip.h
index 69eef001d91f..e2571fb43aea 100644
--- a/drivers/input/joystick/gip/gip.h
+++ b/drivers/input/joystick/gip/gip.h
@@ -12,6 +12,7 @@
#ifndef _GIP_H
#define _GIP_H
+#include <linux/hid.h>
#include <linux/led-class-multicolor.h>
#include <linux/rcupdate.h>
#include <linux/usb/input.h>
@@ -250,6 +251,7 @@ struct gip_attachment {
int extra_axes;
bool dpad_as_buttons;
+ struct hid_device __rcu *hdev;
};
struct gip_urb {
diff --git a/include/uapi/linux/input.h b/include/uapi/linux/input.h
index 6aa703fcfcfb..d9c630ff8292 100644
--- a/include/uapi/linux/input.h
+++ b/include/uapi/linux/input.h
@@ -276,6 +276,7 @@ struct input_mask {
#define BUS_INTEL_ISHTP 0x1F
#define BUS_AMD_SFH 0x20
#define BUS_SDW 0x21
+#define BUS_GIP 0x22
/*
* MT_TOOL types
--
2.54.0
^ permalink raw reply related [flat|nested] 23+ messages in thread
* [PATCH v6 05/12] Input: xbox_gip - Add battery support
2026-09-08 3:21 [PATCH v6 00/12] Input: xbox_gip - Add new driver for Xbox GIP Vicki Pfau
` (3 preceding siblings ...)
2026-09-08 3:21 ` [PATCH v6 04/12] Input: xbox_gip - Add HID relaying Vicki Pfau
@ 2026-09-08 3:21 ` Vicki Pfau
2026-09-08 3:38 ` sashiko-bot
2026-09-08 3:21 ` [PATCH v6 06/12] Input: xbox_gip - Allow sending fragmented and ACME messages Vicki Pfau
` (6 subsequent siblings)
11 siblings, 1 reply; 23+ messages in thread
From: Vicki Pfau @ 2026-09-08 3:21 UTC (permalink / raw)
To: Dmitry Torokhov, linux-input; +Cc: Vicki Pfau
Controllers are required to give information about the battery in the
controller, if present. This patch exposes that information as a
power_supply device.
Signed-off-by: Vicki Pfau <vi@endrift.com>
---
drivers/input/joystick/gip/gip-core.c | 116 +++++++++++++++++++++++++-
drivers/input/joystick/gip/gip.h | 4 +
2 files changed, 116 insertions(+), 4 deletions(-)
diff --git a/drivers/input/joystick/gip/gip-core.c b/drivers/input/joystick/gip/gip-core.c
index dc174560ee49..568877a4ce4b 100644
--- a/drivers/input/joystick/gip/gip-core.c
+++ b/drivers/input/joystick/gip/gip-core.c
@@ -255,6 +255,13 @@ static const struct gip_audio_format gip_audio_format_table[MAX_GIP_AUDIO_FORMAT
};
+static enum power_supply_property gip_battery_props[] = {
+ POWER_SUPPLY_PROP_PRESENT,
+ POWER_SUPPLY_PROP_CAPACITY_LEVEL,
+ POWER_SUPPLY_PROP_SCOPE,
+ POWER_SUPPLY_PROP_STATUS,
+};
+
static const struct gip_quirks base_quirks[] = {
{ GIP_VID_PDP, GIP_PID_PDP_ROCK_CANDY, 0, .quirks = GIP_QUIRK_NO_HELLO },
@@ -1206,6 +1213,97 @@ static int gip_guide_led_probe(struct gip_attachment *attachment, struct device
return rc;
}
+static int gip_battery_get_property(struct power_supply *psy,
+ enum power_supply_property psp, union power_supply_propval *val)
+{
+ struct gip_attachment *attachment = power_supply_get_drvdata(psy);
+
+ guard(spinlock_irqsave)(&attachment->battery_lock);
+ switch (psp) {
+ case POWER_SUPPLY_PROP_PRESENT:
+ val->intval = attachment->status.base.battery_type != GIP_BATTERY_ABSENT;
+ break;
+ case POWER_SUPPLY_PROP_SCOPE:
+ val->intval = POWER_SUPPLY_SCOPE_DEVICE;
+ break;
+ case POWER_SUPPLY_PROP_STATUS:
+ if (attachment->status.base.battery_type == GIP_BATTERY_ABSENT) {
+ val->intval = POWER_SUPPLY_STATUS_NOT_CHARGING;
+ } else {
+ switch (attachment->status.base.charge) {
+ case GIP_CHARGING:
+ if (attachment->status.base.battery_level == GIP_BATTERY_FULL)
+ val->intval = POWER_SUPPLY_STATUS_FULL;
+ else
+ val->intval = POWER_SUPPLY_STATUS_CHARGING;
+ break;
+ case GIP_NOT_CHARGING:
+ val->intval = POWER_SUPPLY_STATUS_DISCHARGING;
+ break;
+ case GIP_CHARGE_ERROR:
+ default:
+ val->intval = POWER_SUPPLY_STATUS_UNKNOWN;
+ break;
+ }
+ }
+ break;
+ case POWER_SUPPLY_PROP_CAPACITY_LEVEL:
+ if (attachment->status.base.battery_type == GIP_BATTERY_ABSENT) {
+ val->intval = POWER_SUPPLY_CAPACITY_LEVEL_FULL;
+ } else {
+ switch (attachment->status.base.battery_level) {
+ case GIP_BATTERY_CRITICAL:
+ val->intval = POWER_SUPPLY_CAPACITY_LEVEL_CRITICAL;
+ break;
+ case GIP_BATTERY_LOW:
+ val->intval = POWER_SUPPLY_CAPACITY_LEVEL_LOW;
+ break;
+ case GIP_BATTERY_MEDIUM:
+ val->intval = POWER_SUPPLY_CAPACITY_LEVEL_NORMAL;
+ break;
+ case GIP_BATTERY_FULL:
+ val->intval = POWER_SUPPLY_CAPACITY_LEVEL_FULL;
+ break;
+ default:
+ val->intval = POWER_SUPPLY_CAPACITY_LEVEL_UNKNOWN;
+ break;
+ }
+ break;
+ }
+ break;
+ default:
+ return -EINVAL;
+ }
+ return 0;
+}
+
+static int gip_battery_create(struct gip_attachment *attachment, struct device *dev)
+{
+ struct power_supply_config supply_config = { .drv_data = attachment, };
+ int rc;
+
+ attachment->battery_desc.properties = gip_battery_props;
+ attachment->battery_desc.num_properties = ARRAY_SIZE(gip_battery_props);
+ attachment->battery_desc.get_property = gip_battery_get_property;
+ attachment->battery_desc.type = POWER_SUPPLY_TYPE_BATTERY;
+ attachment->battery_desc.name = devm_kasprintf(dev, GFP_KERNEL, "gip-%s", dev_name(dev));
+
+ if (!attachment->battery_desc.name)
+ return -ENOMEM;
+
+ attachment->battery = devm_power_supply_register(dev,
+ &attachment->battery_desc, &supply_config);
+ if (IS_ERR(attachment->battery)) {
+ rc = PTR_ERR(attachment->battery);
+ attachment->battery = NULL;
+ devm_kfree(dev, attachment->battery_desc.name);
+ return rc;
+ }
+
+ power_supply_powers(attachment->battery, dev);
+ return 0;
+}
+
static bool gip_send_set_device_state(struct gip_attachment *attachment, uint8_t state)
{
uint8_t buffer[] = { state };
@@ -1319,6 +1417,9 @@ static int gip_setup_input_device(struct gip_attachment *attachment)
rc = gip_guide_led_probe(attachment, &input->dev);
if (rc)
gip_err(attachment, "Failed to register LEDs: %d\n", rc);
+ rc = gip_battery_create(attachment, &input->dev);
+ if (rc)
+ gip_err(attachment, "Failed to register battery: %d\n", rc);
return 0;
@@ -1501,6 +1602,8 @@ static void gip_free_devices(struct gip_attachment *attachment)
rcu_assign_pointer(attachment->input, NULL);
rcu_assign_pointer(attachment->hdev, NULL);
+ /* The following are freed by devres */
+ attachment->battery = NULL;
synchronize_rcu();
if (input)
@@ -1633,10 +1736,14 @@ static int gip_handle_command_status_device(struct gip_attachment *attachment,
if (num_bytes < 1)
return -EINVAL;
- attachment->status.base.battery_level = bytes[0] & 3;
- attachment->status.base.battery_type = (bytes[0] >> 2) & 3;
- attachment->status.base.charge = (bytes[0] >> 4) & 3;
- attachment->status.base.power_level = (bytes[0] >> 6) & 3;
+ scoped_guard(spinlock_irqsave, &attachment->battery_lock) {
+ attachment->status.base.battery_level = bytes[0] & 3;
+ attachment->status.base.battery_type = (bytes[0] >> 2) & 3;
+ attachment->status.base.charge = (bytes[0] >> 4) & 3;
+ attachment->status.base.power_level = (bytes[0] >> 6) & 3;
+ }
+ if (attachment->battery)
+ power_supply_changed(attachment->battery);
if (num_bytes >= 4) {
attachment->status.device_active = bytes[1] & 1;
@@ -2129,6 +2236,7 @@ static struct gip_attachment *gip_ensure_attachment(struct gip_device *device,
device->attachments[attachment_index] = attachment;
mutex_init(&attachment->lock);
+ spin_lock_init(&attachment->battery_lock);
INIT_DELAYED_WORK(&attachment->in_fragment_timeout, gip_fragment_timeout);
INIT_DELAYED_WORK(&attachment->metadata_next, gip_retry_metadata);
diff --git a/drivers/input/joystick/gip/gip.h b/drivers/input/joystick/gip/gip.h
index e2571fb43aea..1c6854540f08 100644
--- a/drivers/input/joystick/gip/gip.h
+++ b/drivers/input/joystick/gip/gip.h
@@ -14,6 +14,7 @@
#include <linux/hid.h>
#include <linux/led-class-multicolor.h>
+#include <linux/power_supply.h>
#include <linux/rcupdate.h>
#include <linux/usb/input.h>
@@ -241,6 +242,9 @@ struct gip_attachment {
struct led_classdev_mc color;
} guide_led;
+ spinlock_t battery_lock;
+ struct power_supply *battery;
+ struct power_supply_desc battery_desc;
struct gip_extended_status status;
enum gip_elite_button_format xbe_format;
--
2.54.0
^ permalink raw reply related [flat|nested] 23+ messages in thread
* [PATCH v6 06/12] Input: xbox_gip - Allow sending fragmented and ACME messages
2026-09-08 3:21 [PATCH v6 00/12] Input: xbox_gip - Add new driver for Xbox GIP Vicki Pfau
` (4 preceding siblings ...)
2026-09-08 3:21 ` [PATCH v6 05/12] Input: xbox_gip - Add battery support Vicki Pfau
@ 2026-09-08 3:21 ` Vicki Pfau
2026-09-08 3:39 ` sashiko-bot
2026-09-08 3:21 ` [PATCH v6 07/12] Input: xbox_gip - Add security implementation from xone Vicki Pfau
` (5 subsequent siblings)
11 siblings, 1 reply; 23+ messages in thread
From: Vicki Pfau @ 2026-09-08 3:21 UTC (permalink / raw)
To: Dmitry Torokhov, linux-input; +Cc: Vicki Pfau
GIP supports sending messages that exceed the length of the MTU using a
fragmented message flow. It sits on top of a reliable message transmission
flow, which uses the ACME flag to signal that a message must be ACKed if it
is received properly. We already supported receiving and coalescing these
messages, but the ability to send them wasn't yet present due to not
needing it for basic usage. This patch adds it for future use with the
security flow.
Signed-off-by: Vicki Pfau <vi@endrift.com>
---
drivers/input/joystick/gip/gip-core.c | 385 ++++++++++++++++++++++++--
drivers/input/joystick/gip/gip.h | 20 ++
2 files changed, 388 insertions(+), 17 deletions(-)
diff --git a/drivers/input/joystick/gip/gip-core.c b/drivers/input/joystick/gip/gip-core.c
index 568877a4ce4b..f61b5f18b819 100644
--- a/drivers/input/joystick/gip/gip-core.c
+++ b/drivers/input/joystick/gip/gip-core.c
@@ -8,7 +8,6 @@
* - Audio device support
* - Security packet handshake
* - Event logging
- * - Sending fragmented messages
* - Raw character device
* - Wheel support
* - Flight stick support
@@ -28,6 +27,7 @@
#define GIP_WIRED_INTF_DATA 0
#define GIP_WIRED_INTF_AUDIO 1
+#define GIP_DUAL_LENGTH 6
#define MAX_MESSAGE_LENGTH 0x4000
#define MAX_AUDIO_MESSAGES 9
@@ -40,6 +40,9 @@
#define GIP_DATA_CLASS_SHIFT 5
#define GIP_DATA_CLASS_MASK (7u << 5)
+#define GIP_ACME_RETRY_TIME (HZ / 10)
+#define GIP_ACME_MAX_RETRIES 8
+
/* Undocumented Elite 2 vendor messages */
#define GIP_CMD_RAW_REPORT 0x0c
#define GIP_CMD_GUIDE_COLOR 0x0e
@@ -437,6 +440,13 @@ static uint8_t gip_sequence_next(struct gip_attachment *attachment,
return seq;
}
+static unsigned int gip_fragment_id(const struct gip_attachment *attachment,
+ const struct gip_out_fragment *fragment)
+{
+ return BIT(attachment->attachment_index * MAX_OUT_FRAGMENTS +
+ (unsigned int) (fragment - attachment->out_fragments));
+}
+
static void gip_handle_quirks_array(struct gip_attachment *attachment,
const struct gip_quirks *quirks)
{
@@ -479,6 +489,50 @@ static void gip_handle_quirks(struct gip_attachment *attachment)
gip_handle_quirks_array(attachment, attachment->driver->quirks);
}
+static struct gip_out_fragment *gip_find_fragment(struct gip_attachment *attachment,
+ uint8_t message_type, uint8_t flags, uint8_t seq, bool strict)
+{
+ int i;
+
+ for (i = 0; i < MAX_OUT_FRAGMENTS; i++) {
+ if (!attachment->out_fragments[i].active)
+ continue;
+ if (attachment->out_fragments[i].message != message_type)
+ continue;
+ if ((attachment->out_fragments[i].flags ^ flags) & GIP_FLAG_SYSTEM)
+ continue;
+ if (attachment->out_fragments[i].seq != seq) {
+ if (strict)
+ continue;
+
+ /*
+ * Found one with the wrong sequence number. For some
+ * reason the official driver allows this.
+ */
+ gip_warn(attachment,
+ "Found fragment with different sequence number %02x, wanted %02x\n",
+ attachment->out_fragments[i].seq, seq);
+ }
+
+ return &attachment->out_fragments[i];
+ }
+ return NULL;
+}
+
+static void gip_free_fragment(struct gip_out_fragment *fragment)
+{
+ cancel_delayed_work(&fragment->timeout);
+ kfree(fragment->data);
+ fragment->data = NULL;
+ fragment->active = false;
+ fragment->message = 0;
+ fragment->flags = 0;
+ fragment->seq = 0;
+ fragment->retries = 0;
+ fragment->total_length = 0;
+ fragment->fragment_offset = 0;
+}
+
static int gip_send_raw_message(struct gip_attachment *attachment,
uint8_t message_type, uint8_t flags, uint8_t seq, const uint8_t *bytes,
int num_bytes)
@@ -486,20 +540,25 @@ static int gip_send_raw_message(struct gip_attachment *attachment,
struct gip_interface *intf;
int offset = 3;
struct gip_urb *urb = NULL;
+ struct gip_out_fragment *fragment = NULL;
int i;
int rc = 0;
+ int mtu = gip_data_class_mtu[message_type >> GIP_DATA_CLASS_SHIFT];
+ int reduced_mtu = mtu - GIP_DUAL_LENGTH;
+ /*
+ * This buffer size shouldn't need to be more than 6 (there should never
+ * be more than 3 length bytes), but add enough extra to fit fully
+ * extended bignums for 32 bit (5 bytes) + 16 bit (3 bytes) values to be
+ * safe and then WARN_ON if we go over. If this ever happens it would be
+ * due to driver bugs.
+ */
+ uint8_t header[11];
if (num_bytes < 0) {
gip_warn(attachment, "Invalid message length %d\n", num_bytes);
return -EINVAL;
}
- if (num_bytes + 6 > gip_data_class_mtu[message_type >> GIP_DATA_CLASS_SHIFT]) {
- gip_err(attachment,
- "Attempted to send a message that requires fragmenting, which is not yet supported.\n");
- return -EOPNOTSUPP;
- }
-
if ((message_type & GIP_DATA_CLASS_MASK) == GIP_DATA_CLASS_AUDIO)
intf = &attachment->device->audio;
else
@@ -511,6 +570,89 @@ static int gip_send_raw_message(struct gip_attachment *attachment,
return -EOPNOTSUPP;
}
+ header[0] = message_type;
+ header[2] = seq;
+
+ if (num_bytes > reduced_mtu ||
+ (flags & (GIP_FLAG_ACME | GIP_FLAG_FRAGMENT)) == GIP_FLAG_ACME) {
+ for (i = 0; i < MAX_OUT_FRAGMENTS; i++) {
+ if (attachment->out_fragments[i].active)
+ continue;
+
+ fragment = &attachment->out_fragments[i];
+ break;
+ }
+
+ if (!fragment) {
+ gip_err(attachment, "Fragmented message queue is full; dropping message\n");
+ return -EALREADY;
+ }
+
+ fragment->data = kmalloc(num_bytes, GFP_KERNEL);
+ if (!fragment->data)
+ return -ENOMEM;
+ fragment->active = true;
+ fragment->message = message_type;
+ fragment->flags = flags & GIP_FLAG_SYSTEM;
+ fragment->seq = seq;
+ fragment->total_length = num_bytes;
+ fragment->fragment_offset = 0;
+ memcpy(fragment->data, bytes, num_bytes);
+ bytes = fragment->data;
+
+ if (num_bytes > reduced_mtu) {
+ gip_dbg(attachment, "Starting new reliable message: %02x%02x%02x, total length %u\n",
+ message_type, flags, seq, num_bytes);
+ flags |= GIP_FLAG_INIT_FRAG | GIP_FLAG_FRAGMENT | GIP_FLAG_ACME;
+ fragment->flags |= GIP_FLAG_FRAGMENT;
+ /* The spec says to extend the value to fit in 3 bytes */
+ offset += gip_encode_length(reduced_mtu, &header[offset], sizeof(header));
+ if (offset == 4 && reduced_mtu < 0x80 && num_bytes < 0x80) {
+ header[3] |= 0x80;
+ header[4] = 0;
+ offset = 5;
+ }
+ offset += gip_encode_length(num_bytes, &header[offset],
+ sizeof(header) - offset);
+ WARN_ON(offset != GIP_DUAL_LENGTH);
+ num_bytes = mtu - offset;
+ } else {
+ offset += gip_encode_length(num_bytes, &header[offset],
+ sizeof(header) - offset);
+ }
+ } else if (flags & GIP_FLAG_FRAGMENT) {
+ fragment = gip_find_fragment(attachment, message_type, flags, seq, true);
+ if (!fragment) {
+ gip_err(attachment,
+ "Attempted to send message fragment with no associated message\n");
+ return -EINVAL;
+ }
+
+ num_bytes = min(reduced_mtu, fragment->total_length - fragment->fragment_offset);
+ offset += gip_encode_length(num_bytes, &header[offset],
+ sizeof(header) - offset);
+ if (offset == 4 && num_bytes < 0x80 && fragment->fragment_offset < 0x80) {
+ header[3] |= 0x80;
+ header[4] = 0;
+ offset = 5;
+ }
+ offset += gip_encode_length(fragment->fragment_offset, &header[offset],
+ sizeof(header) - offset);
+ WARN_ON(offset != GIP_DUAL_LENGTH);
+
+ if (num_bytes && fragment->fragment_offset + num_bytes == fragment->total_length) {
+ /* The final fragment in a fragmented message must be ACKed */
+ flags |= GIP_FLAG_ACME;
+ fragment->acked = false;
+ }
+ bytes = &fragment->data[fragment->fragment_offset];
+ } else if (num_bytes >= 0) {
+ offset += gip_encode_length(num_bytes, &header[offset],
+ sizeof(header) - offset);
+ }
+
+ header[1] = flags;
+
guard(spinlock_irqsave)(&attachment->device->message_lock);
for (i = 0; i < MAX_OUT_MESSAGES && !urb; i++) {
if (!intf->out_queue[i].urb)
@@ -520,17 +662,13 @@ static int gip_send_raw_message(struct gip_attachment *attachment,
}
if (!urb) {
gip_err(attachment, "Output queue is full; dropping message\n");
- return -ENOSPC;
+ rc = -ENOSPC;
+ goto err_free_fragment;
}
- urb->data[0] = message_type;
- urb->data[1] = flags;
- urb->data[2] = seq;
- offset += gip_encode_length(num_bytes, &urb->data[offset],
- sizeof(urb->data) - offset);
+ memcpy(urb->data, header, offset);
if (num_bytes > 0)
memcpy(&urb->data[offset], bytes, num_bytes);
-
num_bytes += offset;
urb->urb->transfer_buffer_length = num_bytes;
@@ -545,11 +683,106 @@ static int gip_send_raw_message(struct gip_attachment *attachment,
__func__, rc);
usb_unanchor_urb(urb->urb);
rc = -EIO;
+ goto err_free_fragment;
}
+ if (fragment) {
+ /*
+ * Sending further fragments is handled in gip_urb_out if this fragment doesn't need
+ * ACKing or in gip_handle_command_protocol_control if it does. The flag should also
+ * be cleared if we're done sending this packet.
+ */
+ if (fragment->total_length > reduced_mtu && !(flags & GIP_FLAG_ACME))
+ intf->has_pending_out |= gip_fragment_id(attachment, fragment);
+ else
+ intf->has_pending_out &= ~gip_fragment_id(attachment, fragment);
+ if (flags & GIP_FLAG_ACME)
+ schedule_delayed_work(&fragment->timeout, GIP_ACME_RETRY_TIME);
+ }
+
+ return rc;
+
+err_free_fragment:
+ if (fragment)
+ gip_free_fragment(fragment);
return rc;
}
+static int gip_send_next_fragment(struct gip_attachment *attachment,
+ struct gip_out_fragment *fragment)
+{
+ struct gip_interface *intf;
+ int next_bytes;
+ int flags = GIP_FLAG_FRAGMENT | fragment->flags | attachment->attachment_index;
+ int mtu;
+ int rc;
+
+ mtu = gip_data_class_mtu[fragment->message >> GIP_DATA_CLASS_SHIFT] - GIP_DUAL_LENGTH;
+ if (fragment->fragment_offset == fragment->total_length) {
+ if ((fragment->message & GIP_DATA_CLASS_MASK) == GIP_DATA_CLASS_AUDIO)
+ intf = &attachment->device->audio;
+ else
+ intf = &attachment->device->data;
+
+ next_bytes = 0;
+ guard(spinlock_irqsave)(&intf->device->message_lock);
+ intf->has_pending_out &= ~gip_fragment_id(attachment, fragment);
+ } else if (fragment->fragment_offset + mtu >= fragment->total_length) {
+ next_bytes = fragment->total_length - fragment->fragment_offset;
+ flags |= GIP_FLAG_ACME;
+ } else {
+ next_bytes = mtu;
+ }
+
+ rc = gip_send_raw_message(attachment, fragment->message, flags,
+ fragment->seq, &fragment->data[fragment->fragment_offset],
+ next_bytes);
+
+ if (rc < 0)
+ return rc;
+
+ if (fragment->acked)
+ fragment->fragment_offset += next_bytes;
+ if (next_bytes == 0 && !(fragment->flags & GIP_FLAG_ACME)) {
+ /* Finished sending the message */
+ gip_free_fragment(fragment);
+ } else if (flags & GIP_FLAG_ACME) {
+ fragment->acked = false;
+ schedule_delayed_work(&fragment->timeout, GIP_ACME_RETRY_TIME);
+ }
+ return next_bytes;
+}
+
+static void gip_send_fragment_work(struct work_struct *work)
+{
+ struct gip_interface *intf = container_of(work, struct gip_interface, send_fragment);
+ struct gip_out_fragment *fragment;
+ unsigned int has_pending_out;
+ unsigned long flags;
+ int i, j;
+
+ spin_lock_irqsave(&intf->device->message_lock, flags);
+ has_pending_out = intf->has_pending_out;
+ spin_unlock_irqrestore(&intf->device->message_lock, flags);
+ for (i = 0; i < MAX_ATTACHMENTS; i++) {
+ struct gip_attachment *attachment = intf->device->attachments[i];
+
+ for (j = 0; j < MAX_OUT_FRAGMENTS; j++) {
+ /* Check for pending output fragments */
+ if (!(has_pending_out & BIT(i * MAX_OUT_FRAGMENTS + j)))
+ continue;
+
+ guard(mutex)(&attachment->lock);
+ fragment = &attachment->out_fragments[j];
+ if (!fragment->active)
+ continue;
+ if (!(fragment->flags & GIP_FLAG_FRAGMENT))
+ continue;
+ gip_send_next_fragment(attachment, fragment);
+ }
+ }
+}
+
int gip_send_system_message(struct gip_attachment *attachment,
uint8_t message_type, uint8_t flags, const void *bytes, int num_bytes)
{
@@ -1587,6 +1820,25 @@ static void gip_fragment_timeout(struct work_struct *work)
gip_free_in_fragment(attachment);
}
+static void gip_out_fragment_timeout(struct work_struct *work)
+{
+ struct gip_out_fragment *fragment = container_of(to_delayed_work(work),
+ struct gip_out_fragment, timeout);
+ struct gip_attachment *attachment = fragment->attachment;
+
+ guard(mutex)(&attachment->lock);
+ if (!fragment->active || !fragment->data || fragment->acked)
+ return;
+
+ fragment->retries++;
+ if (fragment->retries >= GIP_ACME_MAX_RETRIES) {
+ gip_free_fragment(fragment);
+ gip_warn(attachment, "Reliable message transmission failed\n");
+ return;
+ }
+ gip_send_next_fragment(attachment, fragment);
+}
+
static void gip_free_devices(struct gip_attachment *attachment)
{
struct input_dev *input;
@@ -1657,21 +1909,102 @@ static int gip_ensure_metadata(struct gip_attachment *attachment)
static void gip_reset_attachment(struct gip_attachment *attachment)
{
+ int i;
+ int pending_out_bits =
+ BIT((attachment->attachment_index + 1) * MAX_OUT_FRAGMENTS) -
+ BIT(attachment->attachment_index * MAX_OUT_FRAGMENTS);
+ unsigned long flags;
+
cancel_delayed_work(&attachment->metadata_next);
cancel_delayed_work(&attachment->in_fragment_timeout);
if (attachment->in_fragment_data)
gip_free_in_fragment(attachment);
+ spin_lock_irqsave(&attachment->device->message_lock, flags);
+ attachment->device->data.has_pending_out &= ~pending_out_bits;
+ attachment->device->audio.has_pending_out &= ~pending_out_bits;
+ spin_unlock_irqrestore(&attachment->device->message_lock, flags);
+
+ for (i = 0; i < MAX_OUT_FRAGMENTS; i++) {
+ if (attachment->out_fragments[i].active)
+ gip_free_fragment(&attachment->out_fragments[i]);
+ }
+
gip_free_devices(attachment);
+
}
static int gip_handle_command_protocol_control(struct gip_attachment *attachment,
const struct gip_header *header, const uint8_t *bytes, int num_bytes)
{
- /* TODO */
- gip_warn(attachment, "Unimplemented Protocol Control message\n");
- return -EOPNOTSUPP;
+ const struct gip_protocol_control_ack *ack;
+ struct gip_out_fragment *fragment = NULL;
+ uint32_t fragment_offset;
+ uint16_t remaining_buffer;
+ bool ok = true;
+ int mtu;
+ int rc;
+
+ if (num_bytes < 1)
+ return -EINVAL;
+
+ if (bytes[0] != GIP_CONTROL_CODE_ACK) {
+ gip_warn(attachment, "Unimplemented Protocol Control code %i message\n", bytes[0]);
+ return -EOPNOTSUPP;
+ }
+
+ if (num_bytes < sizeof(*ack))
+ return -EINVAL;
+
+ ack = (const struct gip_protocol_control_ack *)bytes;
+
+ fragment = gip_find_fragment(attachment, ack->message_type, ack->flags,
+ header->sequence_id, false);
+ if (!fragment) {
+ gip_warn(attachment, "Received ACK for unknown message\n");
+ return -EINVAL;
+ }
+
+
+ fragment_offset = le32_to_cpu(ack->fragment_offset);
+ remaining_buffer = le16_to_cpu(ack->remaining_buffer);
+
+ if (fragment_offset > fragment->total_length)
+ ok = false;
+ mtu = gip_data_class_mtu[fragment->message >> GIP_DATA_CLASS_SHIFT] - GIP_DUAL_LENGTH;
+ if (!ok) {
+ gip_warn(attachment, "Received invalid buffer offset in ACK, "
+ "got offset=%u + remaining=%u, expected offset=%u + remaining=%u\n",
+ fragment_offset, remaining_buffer,
+ fragment->fragment_offset, fragment->total_length - fragment->fragment_offset);
+ rc = -EINVAL;
+ goto resend;
+ } else if ((fragment->flags & GIP_FLAG_FRAGMENT) &&
+ (fragment->fragment_offset > fragment_offset ||
+ fragment->fragment_offset + mtu < fragment_offset)) {
+ gip_warn(attachment, "Received unexpected buffer offset in ACK, "
+ "got offset=%u, expected offset=%u\n",
+ fragment_offset, fragment->fragment_offset + mtu);
+ }
+
+ fragment->acked = true;
+ fragment->retries = 0;
+ cancel_delayed_work(&fragment->timeout);
+ if (fragment->flags & GIP_FLAG_FRAGMENT) {
+ fragment->fragment_offset = fragment_offset;
+ rc = gip_send_next_fragment(attachment, fragment);
+ if (rc < 0)
+ return rc;
+ } else {
+ gip_free_fragment(fragment);
+ }
+
+ return 0;
+
+resend:
+ gip_send_next_fragment(attachment, fragment);
+ return rc;
}
static bool gip_handle_command_hello_device(struct gip_attachment *attachment,
@@ -2218,6 +2551,7 @@ static struct gip_attachment *gip_ensure_attachment(struct gip_device *device,
uint8_t attachment_index)
{
struct gip_attachment *attachment = device->attachments[attachment_index];
+ int i;
if (!attachment) {
attachment = devm_kzalloc(to_gip_device(device), sizeof(*attachment), GFP_KERNEL);
@@ -2233,6 +2567,11 @@ static struct gip_attachment *gip_ensure_attachment(struct gip_device *device,
attachment->product_id = device->udev->descriptor.idProduct;
}
+ for (i = 0; i < MAX_OUT_FRAGMENTS; i++) {
+ attachment->out_fragments[i].attachment = attachment;
+ INIT_DELAYED_WORK(&attachment->out_fragments[i].timeout, gip_out_fragment_timeout);
+ }
+
device->attachments[attachment_index] = attachment;
mutex_init(&attachment->lock);
@@ -2542,6 +2881,7 @@ static void gip_urb_out(struct urb *urb)
switch (status) {
case 0:
/* success */
+ schedule_work(&intf->send_fragment);
break;
case -ECONNRESET:
@@ -2738,9 +3078,11 @@ static int gip_probe(struct usb_interface *intf, const struct usb_device_id *id)
gip->data.device = gip;
gip->data.intf = intf;
gip->data.mtu = BASE_GIP_MTU;
+ INIT_WORK(&gip->data.send_fragment, gip_send_fragment_work);
gip->audio.device = gip;
gip->audio.mtu = MAX_GIP_MTU;
gip->audio.isoc_messages = MAX_AUDIO_MESSAGES;
+ INIT_WORK(&gip->audio.send_fragment, gip_send_fragment_work);
INIT_WORK(&gip->receive_message, gip_receive_work);
spin_lock_init(&gip->message_lock);
@@ -2772,8 +3114,17 @@ static int gip_probe(struct usb_interface *intf, const struct usb_device_id *id)
static void gip_shutdown(struct gip_device *device)
{
int i;
+ unsigned long flags;
+
+ spin_lock_irqsave(&device->message_lock, flags);
+ device->data.has_pending_out = 0;
+ device->audio.has_pending_out = 0;
+ spin_unlock_irqrestore(&device->message_lock, flags);
cancel_work_sync(&device->receive_message);
+ cancel_work_sync(&device->data.send_fragment);
+ if (device->audio.intf)
+ cancel_work_sync(&device->audio.send_fragment);
for (i = 0; i < MAX_ATTACHMENTS; i++) {
struct gip_attachment *attachment = device->attachments[i];
diff --git a/drivers/input/joystick/gip/gip.h b/drivers/input/joystick/gip/gip.h
index 1c6854540f08..007edbb628b2 100644
--- a/drivers/input/joystick/gip/gip.h
+++ b/drivers/input/joystick/gip/gip.h
@@ -25,6 +25,7 @@
#define MAX_IN_MESSAGES 8
#define MAX_OUT_MESSAGES 8
+#define MAX_OUT_FRAGMENTS 2
#define GIP_VID_MICROSOFT 0x045e
#define GIP_VID_PDP 0x0e6f
@@ -194,6 +195,20 @@ struct gip_extended_status {
struct gip_status_event events[5];
};
+struct gip_out_fragment {
+ struct gip_attachment *attachment;
+ bool active;
+ bool acked;
+ uint8_t message;
+ uint8_t flags;
+ uint8_t seq;
+ uint8_t retries;
+ uint16_t total_length;
+ uint32_t fragment_offset;
+ uint8_t *data;
+ struct delayed_work timeout;
+};
+
struct gip_attachment;
typedef int (*gip_command_handler)(struct gip_attachment *a, const struct gip_header *header,
const uint8_t *bytes, int num_bytes);
@@ -222,6 +237,8 @@ struct gip_attachment {
struct delayed_work in_fragment_timeout;
int in_fragment_retries;
+ struct gip_out_fragment out_fragments[MAX_OUT_FRAGMENTS];
+
uint16_t firmware_major_version;
uint16_t firmware_minor_version;
@@ -275,6 +292,9 @@ struct gip_interface {
struct usb_anchor out_anchor;
struct gip_urb out_queue[MAX_OUT_MESSAGES];
+
+ struct work_struct send_fragment;
+ unsigned int has_pending_out;
};
struct gip_device {
--
2.54.0
^ permalink raw reply related [flat|nested] 23+ messages in thread
* [PATCH v6 07/12] Input: xbox_gip - Add security implementation from xone
2026-09-08 3:21 [PATCH v6 00/12] Input: xbox_gip - Add new driver for Xbox GIP Vicki Pfau
` (5 preceding siblings ...)
2026-09-08 3:21 ` [PATCH v6 06/12] Input: xbox_gip - Allow sending fragmented and ACME messages Vicki Pfau
@ 2026-09-08 3:21 ` Vicki Pfau
2026-09-08 3:38 ` sashiko-bot
2026-09-08 3:21 ` [PATCH v6 08/12] Input: xbox_gip - Add arcade stick support Vicki Pfau
` (4 subsequent siblings)
11 siblings, 1 reply; 23+ messages in thread
From: Vicki Pfau @ 2026-09-08 3:21 UTC (permalink / raw)
To: Dmitry Torokhov, linux-input; +Cc: Vicki Pfau
This patch imports and adapts the security message implementation from the
out-of-tree xone driver, which is licensed under the GPL 2.0. This message
is necessary for most controllers that use wireless dongles. The
implementation is largely unchanged, with minor changes being made to adapt
it to the xbox_gip driver and renaming components as appropriate for the
official terminology from the released spec.
Signed-off-by: Vicki Pfau <vi@endrift.com>
---
drivers/input/joystick/gip/Kconfig | 1 +
drivers/input/joystick/gip/Makefile | 2 +-
drivers/input/joystick/gip/gip-core.c | 48 +-
drivers/input/joystick/gip/gip-drivers.c | 8 +
drivers/input/joystick/gip/gip-security.c | 807 ++++++++++++++++++++++
drivers/input/joystick/gip/gip.h | 54 +-
6 files changed, 895 insertions(+), 25 deletions(-)
create mode 100644 drivers/input/joystick/gip/gip-security.c
diff --git a/drivers/input/joystick/gip/Kconfig b/drivers/input/joystick/gip/Kconfig
index 3422bf84cb89..1b9b844779e6 100644
--- a/drivers/input/joystick/gip/Kconfig
+++ b/drivers/input/joystick/gip/Kconfig
@@ -5,6 +5,7 @@
config JOYSTICK_XBOX_GIP
tristate "Xbox One/Series controller support"
depends on USB && USB_ARCH_HAS_HCD && LEDS_CLASS_MULTICOLOR
+ depends on CRYPTO_ECDH && CRYPTO_LIB_SHA256 && CRYPTO_RSA
help
Say Y here if you want to use Xbox One and Series controllers with your
computer. Make sure to say Y to "Joystick support" (CONFIG_INPUT_JOYDEV)
diff --git a/drivers/input/joystick/gip/Makefile b/drivers/input/joystick/gip/Makefile
index d39f946db1ae..a5ad301a9063 100644
--- a/drivers/input/joystick/gip/Makefile
+++ b/drivers/input/joystick/gip/Makefile
@@ -1,4 +1,4 @@
# SPDX-License-Identifier: GPL-2.0-or-later
obj-$(CONFIG_JOYSTICK_XBOX_GIP) += xbox-gip.o
# Base driver
-xbox-gip-y := gip-core.o gip-drivers.o
+xbox-gip-y := gip-core.o gip-drivers.o gip-security.o
diff --git a/drivers/input/joystick/gip/gip-core.c b/drivers/input/joystick/gip/gip-core.c
index f61b5f18b819..157a22c80abd 100644
--- a/drivers/input/joystick/gip/gip-core.c
+++ b/drivers/input/joystick/gip/gip-core.c
@@ -6,7 +6,6 @@
*
* TODO:
* - Audio device support
- * - Security packet handshake
* - Event logging
* - Raw character device
* - Wheel support
@@ -1778,17 +1777,6 @@ static int gip_send_init_sequence(struct gip_attachment *attachment)
if (rc)
return rc;
- if (gip_supports_system_message(attachment, GIP_CMD_SECURITY, false)
- && !(attachment->features & GIP_FEATURE_SECURITY_OPT_OUT)) {
- /* TODO: Implement Security command property */
- uint8_t buffer[] = { 0x1, 0x0 };
-
- rc = gip_send_system_message(attachment, GIP_CMD_SECURITY, 0,
- buffer, sizeof(buffer));
- if (rc)
- return rc;
- }
-
usb_make_path(attachment->device->udev, attachment->phys,
sizeof(attachment->phys));
len = strlen(attachment->phys);
@@ -1844,6 +1832,8 @@ static void gip_free_devices(struct gip_attachment *attachment)
struct input_dev *input;
struct hid_device *hdev;
+ gip_security_release(&attachment->security);
+
if (attachment->driver && attachment->driver->remove)
attachment->driver->remove(attachment);
@@ -1932,7 +1922,6 @@ static void gip_reset_attachment(struct gip_attachment *attachment)
}
gip_free_devices(attachment);
-
}
static int gip_handle_command_protocol_control(struct gip_attachment *attachment,
@@ -2112,6 +2101,24 @@ static int gip_handle_command_status_device(struct gip_attachment *attachment,
}
}
+ if (attachment->security.status == GIP_SECURITY_PENDING) {
+ if (attachment->quirks & GIP_QUIRK_SKIP_SECURITY)
+ /*
+ * Some BDA/PowerA Xbox One controllers have a security
+ * handshake implementation that is very sensitive to
+ * the precise message ordering. It's very hard to get
+ * this just right, so for now we just skip it. Most
+ * wired controllers don't need the security flow to
+ * work anyway.
+ */
+ rc = gip_security_skip_handshake(&attachment->security);
+ else
+ rc = gip_security_start_handshake(&attachment->security);
+
+ if (rc)
+ return rc;
+ }
+
rc = gip_init_input_device(attachment);
if (rc)
return rc;
@@ -2229,20 +2236,16 @@ static int gip_handle_command_metadata_respose(struct gip_attachment *attachment
GIP_CMD_GUIDE_COLOR, false))
attachment->features &= ~GIP_FEATURE_GUIDE_COLOR;
+ if (!gip_supports_system_message(attachment, GIP_CMD_SECURITY, false) ||
+ (attachment->features & GIP_FEATURE_SECURITY_OPT_OUT))
+ attachment->security.status = GIP_SECURITY_SKIPPED;
+
gip_dbg(attachment, "Attachment %i has features: %02x\n",
attachment->attachment_index, attachment->features);
return gip_send_init_sequence(attachment);
}
-static int gip_handle_command_security(struct gip_attachment *attachment,
- const struct gip_header *header, const uint8_t *bytes, int num_bytes)
-{
- /* TODO: Needed for controllers that connect via dongles */
- gip_warn(attachment, "Unimplemented Security message\n");
- return -EOPNOTSUPP;
-}
-
static int gip_handle_command_guide_button_status(struct gip_attachment *attachment,
const struct gip_header *header, const uint8_t *bytes, int num_bytes)
{
@@ -2519,8 +2522,7 @@ static int gip_handle_system_message(struct gip_attachment *attachment,
return gip_handle_command_metadata_respose(attachment, header,
bytes, num_bytes);
case GIP_CMD_SECURITY:
- return gip_handle_command_security(attachment, header, bytes,
- num_bytes);
+ return gip_security_handle_message(&attachment->security, bytes, num_bytes);
case GIP_CMD_GUIDE_BUTTON:
return gip_handle_command_guide_button_status(attachment,
header, bytes, num_bytes);
diff --git a/drivers/input/joystick/gip/gip-drivers.c b/drivers/input/joystick/gip/gip-drivers.c
index 2c2297b1fed8..74bc858e71cc 100644
--- a/drivers/input/joystick/gip/gip-drivers.c
+++ b/drivers/input/joystick/gip/gip-drivers.c
@@ -81,6 +81,14 @@ const struct gip_driver gip_driver_gamepad = {
0xa3, 0x12, 0x7a, 0xf1, 0x97, 0xb5),
.quirks = (const struct gip_quirks[]) {
+ /* PowerA Xbox One Classic Controller */
+ { GIP_VID_BDA, GIP_PID_BDA_XB1_CLASSIC, 0,
+ .quirks = GIP_QUIRK_SKIP_SECURITY },
+
+ /* PowerA Xbox One Fusion Pro */
+ { GIP_VID_BDA, GIP_PID_BDA_XB1_FUSION_PRO, 0,
+ .quirks = GIP_QUIRK_SKIP_SECURITY },
+
/* Xbox One Controller (model 1573) */
{ GIP_VID_MICROSOFT, GIP_PID_XBOX_ONE_1573, 0,
.override_name = "Xbox One Controller" },
diff --git a/drivers/input/joystick/gip/gip-security.c b/drivers/input/joystick/gip/gip-security.c
new file mode 100644
index 000000000000..99b3ddab63e2
--- /dev/null
+++ b/drivers/input/joystick/gip/gip-security.c
@@ -0,0 +1,807 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+/*
+ * Gaming Input Protocol security message driver for Xbox One/Series controllers
+ *
+ * This file is based on files from the xone project
+ * - https://github.com/dlundqvist/xone/blob/master/auth/auth.c
+ * - https://github.com/dlundqvist/xone/blob/master/auth/crypto.c
+ *
+ * Copyright (C) 2023 Severin von Wnuck-Lipinski <severinvonw@outlook.de>
+ * Copyright (c) 2026 Valve Software
+ */
+
+#include <linux/scatterlist.h>
+#include <linux/version.h>
+#include <crypto/hash.h>
+#include <crypto/sha2.h>
+#include <crypto/akcipher.h>
+#include <crypto/kpp.h>
+#include <crypto/ecdh.h>
+
+#include "gip.h"
+
+/* trailer is required for v1 clients */
+#define GIP_SECURITY_TRAILER_LEN 8
+#define GIP_SECURITY_CERTIFICATE_MAX_LEN 1024
+#define GIP_SECURITY_ENCRYPTED_PMS_LEN 256
+#define GIP_SECURITY_TRANSCRIPT_LEN 32
+#define GIP_SECURITY_SESSION_KEY_LEN 16
+
+#define GIP_SECURITY_ECDH_SECRET_LEN 32
+
+enum gip_security_context {
+ GIP_SECURITY_CTX_HANDSHAKE = 0x00,
+ GIP_SECURITY_CTX_CONTROL = 0x01,
+};
+
+enum gip_security_command_handshake {
+ GIP_SECURITY_CMD_HOST_HELLO = 0x01,
+ GIP_SECURITY_CMD_CLIENT_HELLO = 0x02,
+ GIP_SECURITY_CMD_CLIENT_CERTIFICATE = 0x03,
+ GIP_SECURITY_CMD_HOST_SECRET = 0x05,
+ GIP_SECURITY_CMD_HOST_FINISH = 0x07,
+ GIP_SECURITY_CMD_CLIENT_FINISH = 0x08,
+
+ GIP_SECURITY2_CMD_HOST_HELLO = 0x21,
+ GIP_SECURITY2_CMD_CLIENT_HELLO = 0x22,
+ GIP_SECURITY2_CMD_CLIENT_CERTIFICATE = 0x23,
+ GIP_SECURITY2_CMD_CLIENT_PUBKEY = 0x24,
+ GIP_SECURITY2_CMD_HOST_PUBKEY = 0x25,
+ GIP_SECURITY2_CMD_HOST_FINISH = 0x26,
+ GIP_SECURITY2_CMD_CLIENT_FINISH = 0x27,
+};
+
+enum gip_security_command_control {
+ GIP_SECURITY_CTRL_COMPLETE = 0x00,
+ GIP_SECURITY_CTRL_RESET = 0x01,
+};
+
+enum gip_security_option {
+ GIP_SECURITY_OPT_ACKNOWLEDGE = BIT(0),
+ GIP_SECURITY_OPT_REQUEST = BIT(1),
+ GIP_SECURITY_OPT_FROM_HOST = BIT(6),
+ GIP_SECURITY_OPT_FROM_CLIENT = BIT(6) | BIT(7),
+};
+
+struct gip_security_header_handshake {
+ u8 context;
+ u8 options;
+ u8 error;
+ u8 command;
+ __be16 length;
+} __packed;
+
+struct gip_security_header_data {
+ u8 command;
+ u8 version;
+ __be16 length;
+} __packed;
+
+struct gip_security_header_full {
+ struct gip_security_header_handshake handshake;
+ struct gip_security_header_data data;
+} __packed;
+
+struct gip_security_header_control {
+ u8 context;
+ u8 control;
+} __packed;
+
+struct gip_security_request {
+ struct gip_security_header_handshake header;
+
+ u8 trailer[GIP_SECURITY_TRAILER_LEN];
+} __packed;
+
+struct gip_security_host_hello {
+ struct gip_security_header_full header;
+
+ u8 random[GIP_SECURITY_RANDOM_LEN];
+ u8 unknown1[4];
+ u8 unknown2[4];
+
+ u8 trailer[GIP_SECURITY_TRAILER_LEN];
+} __packed;
+
+struct gip_security_host_secret {
+ struct gip_security_header_full header;
+
+ u8 encrypted_pms[GIP_SECURITY_ENCRYPTED_PMS_LEN];
+
+ u8 trailer[GIP_SECURITY_TRAILER_LEN];
+} __packed;
+
+struct gip_security_host_finish {
+ struct gip_security_header_full header;
+
+ u8 transcript[GIP_SECURITY_TRANSCRIPT_LEN];
+
+ u8 trailer[GIP_SECURITY_TRAILER_LEN];
+} __packed;
+
+struct gip_security_client_hello {
+ u8 random[GIP_SECURITY_RANDOM_LEN];
+ u8 unknown[48];
+} __packed;
+
+struct gip_security_client_finish {
+ u8 transcript[GIP_SECURITY_TRANSCRIPT_LEN];
+ u8 unknown[32];
+} __packed;
+
+struct gip_security2_host_hello {
+ struct gip_security_header_full header;
+
+ u8 random[GIP_SECURITY_RANDOM_LEN];
+ u8 unknown[4];
+
+ u8 trailer[GIP_SECURITY_TRAILER_LEN];
+} __packed;
+
+struct gip_security2_host_pubkey {
+ struct gip_security_header_full header;
+
+ u8 pubkey[GIP_SECURITY2_PUBKEY_LEN];
+
+ u8 trailer[GIP_SECURITY_TRAILER_LEN];
+} __packed;
+
+struct gip_security2_host_finish {
+ struct gip_security_header_full header;
+
+ u8 transcript[GIP_SECURITY_TRANSCRIPT_LEN];
+
+ u8 trailer[GIP_SECURITY_TRAILER_LEN];
+} __packed;
+
+struct gip_security2_client_hello {
+ u8 random[GIP_SECURITY_RANDOM_LEN];
+ u8 unknown1[108];
+ u8 unknown2[32];
+} __packed;
+
+struct gip_security2_client_cert {
+ char header[4];
+ u8 unknown1[136];
+ char chip[32];
+ char revision[20];
+ u8 unknown2[576];
+} __packed;
+
+struct gip_security2_client_pubkey {
+ u8 pubkey[GIP_SECURITY2_PUBKEY_LEN];
+ u8 unknown[64];
+} __packed;
+
+struct gip_security2_client_finish {
+ u8 transcript[GIP_SECURITY_TRANSCRIPT_LEN];
+ u8 unknown[32];
+} __packed;
+
+static void gip_security_get_transcript(struct sha256_ctx *ctx, void *transcript)
+{
+ struct sha256_ctx state;
+
+ memcpy(&state, ctx, sizeof(state));
+ sha256_final(&state, transcript);
+}
+
+static void gip_security_compute_prf(const char *label,
+ u8 *raw_key, int key_len, u8 *seed, int seed_len, u8 *out, int out_len)
+{
+ u8 hash[SHA256_DIGEST_SIZE], hash_out[SHA256_DIGEST_SIZE];
+ struct hmac_sha256_ctx ctx;
+ struct hmac_sha256_key key;
+
+ hmac_sha256_preparekey(&key, raw_key, key_len);
+
+ hmac_sha256_init(&ctx, &key);
+ hmac_sha256_update(&ctx, label, strlen(label));
+ hmac_sha256_update(&ctx, seed, seed_len);
+ hmac_sha256_final(&ctx, hash);
+
+ while (out_len > 0) {
+ hmac_sha256_init(&ctx, &key);
+ hmac_sha256_update(&ctx, hash, sizeof(hash));
+ hmac_sha256_update(&ctx, label, strlen(label));
+ hmac_sha256_update(&ctx, seed, seed_len);
+ hmac_sha256_final(&ctx, hash_out);
+
+ memcpy(out, hash_out, min_t(int, out_len, sizeof(hash)));
+ out += sizeof(hash);
+ out_len -= sizeof(hash);
+
+ hmac_sha256(&key, hash, sizeof(hash), hash);
+ }
+
+ memzero_explicit(&ctx, sizeof(ctx));
+ memzero_explicit(&key, sizeof(key));
+}
+
+static int gip_security_encrypt_rsa(u8 *key, int key_len, u8 *in, int in_len, u8 *out, int out_len)
+{
+ struct crypto_akcipher *tfm;
+ int err;
+
+ tfm = crypto_alloc_akcipher("pkcs1pad(rsa)", 0, 0);
+ if (IS_ERR(tfm))
+ return PTR_ERR(tfm);
+
+ err = crypto_akcipher_set_pub_key(tfm, key, key_len);
+ if (err)
+ goto err_free_tfm;
+
+ err = crypto_akcipher_sync_encrypt(tfm, in, in_len, out, out_len);
+
+err_free_tfm:
+ crypto_free_akcipher(tfm);
+
+ return err;
+}
+
+static int gip_security_ecdh_get_pubkey(struct crypto_kpp *tfm, u8 *out, int len)
+{
+ struct kpp_request *req;
+ struct scatterlist dest;
+ struct ecdh key = {};
+ DECLARE_CRYPTO_WAIT(wait);
+ void *privkey, *pubkey;
+ unsigned int privkey_len;
+ int err = 0;
+
+ privkey_len = crypto_ecdh_key_len(&key);
+ privkey = kzalloc(privkey_len, GFP_KERNEL);
+ if (!privkey)
+ return -ENOMEM;
+
+ pubkey = kzalloc(len, GFP_KERNEL);
+ if (!pubkey) {
+ err = -ENOMEM;
+ goto err_free_privkey;
+ }
+
+ /* generate private key */
+ err = crypto_ecdh_encode_key(privkey, privkey_len, &key);
+ if (err)
+ goto err_free_pubkey;
+
+ err = crypto_kpp_set_secret(tfm, privkey, privkey_len);
+ if (err)
+ goto err_free_pubkey;
+
+ req = kpp_request_alloc(tfm, GFP_KERNEL);
+ if (!req) {
+ err = -ENOMEM;
+ goto err_free_pubkey;
+ }
+
+ sg_init_one(&dest, pubkey, len);
+
+ kpp_request_set_input(req, NULL, 0);
+ kpp_request_set_output(req, &dest, len);
+ kpp_request_set_callback(req, CRYPTO_TFM_REQ_MAY_BACKLOG,
+ crypto_req_done, &wait);
+ err = crypto_wait_req(crypto_kpp_generate_public_key(req), &wait);
+ if (!err)
+ memcpy(out, pubkey, len);
+
+ kpp_request_free(req);
+
+err_free_pubkey:
+ kfree(pubkey);
+err_free_privkey:
+ memzero_explicit(privkey, privkey_len);
+ kfree(privkey);
+
+ return err;
+}
+
+static int gip_security_ecdh_get_secret(struct crypto_kpp *tfm, u8 *pubkey,
+ int pubkey_len, u8 *secret, int secret_len)
+{
+ struct kpp_request *req;
+ struct scatterlist src, dest;
+ DECLARE_CRYPTO_WAIT(wait);
+ int err;
+
+ req = kpp_request_alloc(tfm, GFP_KERNEL);
+ if (!req)
+ return -ENOMEM;
+
+ sg_init_one(&src, pubkey, pubkey_len);
+ sg_init_one(&dest, secret, secret_len);
+
+ kpp_request_set_input(req, &src, pubkey_len);
+ kpp_request_set_output(req, &dest, secret_len);
+ kpp_request_set_callback(req, CRYPTO_TFM_REQ_MAY_BACKLOG,
+ crypto_req_done, &wait);
+ err = crypto_wait_req(crypto_kpp_compute_shared_secret(req), &wait);
+
+ kpp_request_free(req);
+
+ return err;
+}
+
+static int gip_security_compute_ecdh(u8 *pubkey_in, u8 *pubkey_out, int pubkey_len, u8 *secret_hash)
+{
+ struct crypto_kpp *tfm_ecdh;
+ u8 *secret;
+ int err;
+
+ secret = kzalloc(GIP_SECURITY_ECDH_SECRET_LEN, GFP_KERNEL);
+ if (!secret)
+ return -ENOMEM;
+
+ tfm_ecdh = crypto_alloc_kpp("ecdh-nist-p256", 0, 0);
+ if (IS_ERR(tfm_ecdh)) {
+ err = PTR_ERR(tfm_ecdh);
+ goto err_free_secret;
+ }
+
+ err = gip_security_ecdh_get_pubkey(tfm_ecdh, pubkey_out, pubkey_len);
+ if (err)
+ goto err_free_ecdh;
+
+ err = gip_security_ecdh_get_secret(tfm_ecdh, pubkey_in, pubkey_len,
+ secret, GIP_SECURITY_ECDH_SECRET_LEN);
+ if (err)
+ goto err_free_ecdh;
+
+ sha256(secret, GIP_SECURITY_ECDH_SECRET_LEN, secret_hash);
+
+err_free_ecdh:
+ crypto_free_kpp(tfm_ecdh);
+err_free_secret:
+ kfree_sensitive(secret);
+
+ return err;
+}
+
+static int gip_security_send_message(struct gip_security *security,
+ enum gip_security_command_handshake cmd, void *message, u16 len)
+{
+ struct gip_attachment *attachment = container_of(security, struct gip_attachment, security);
+ struct gip_security_header_full *hdr = message;
+ u16 data_len = len - sizeof(hdr->handshake) - GIP_SECURITY_TRAILER_LEN;
+
+ hdr->handshake.context = GIP_SECURITY_CTX_HANDSHAKE;
+ hdr->handshake.options = GIP_SECURITY_OPT_ACKNOWLEDGE | GIP_SECURITY_OPT_FROM_HOST;
+ hdr->handshake.command = cmd;
+ hdr->handshake.length = cpu_to_be16(data_len);
+
+ hdr->data.command = cmd;
+ hdr->data.version = cmd >= GIP_SECURITY2_CMD_HOST_HELLO ? 0x02 : 0x01;
+ hdr->data.length = cpu_to_be16(data_len - sizeof(hdr->data));
+
+ security->last_sent_command = cmd;
+ sha256_update(&security->transcript, message + sizeof(hdr->handshake), data_len);
+
+ return gip_send_system_message(attachment, GIP_CMD_SECURITY, GIP_FLAG_ACME, message, len);
+}
+
+static int gip_security_send_request(struct gip_security *security,
+ enum gip_security_command_handshake cmd, u16 len)
+{
+ struct gip_attachment *attachment = container_of(security, struct gip_attachment, security);
+ struct gip_security_request req = {};
+ u16 data_len = len + sizeof(struct gip_security_header_data);
+
+ req.header.context = GIP_SECURITY_CTX_HANDSHAKE;
+ req.header.options = GIP_SECURITY_OPT_REQUEST | GIP_SECURITY_OPT_FROM_HOST;
+ req.header.command = cmd;
+ req.header.length = cpu_to_be16(data_len);
+
+ return gip_send_system_message(attachment, GIP_CMD_SECURITY,
+ GIP_FLAG_ACME, &req, sizeof(req));
+}
+
+static int gip_security2_send_hello(struct gip_security *security)
+{
+ struct gip_security2_host_hello message = {};
+
+ get_random_bytes(security->random_host, sizeof(security->random_host));
+ memcpy(message.random, security->random_host, sizeof(message.random));
+
+ return gip_security_send_message(security, GIP_SECURITY2_CMD_HOST_HELLO,
+ &message, sizeof(message));
+}
+
+static int gip_security2_handle_hello(struct gip_security *security, const void *data, u32 len)
+{
+ const struct gip_security2_client_hello *message = data;
+
+ if (len < sizeof(*message))
+ return -EINVAL;
+
+ memcpy(security->random_client, message->random, sizeof(security->random_client));
+
+ return gip_security_send_request(security,
+ GIP_SECURITY2_CMD_CLIENT_CERTIFICATE,
+ sizeof(struct gip_security2_client_cert));
+}
+
+static int gip_security2_handle_certificate(struct gip_security *security,
+ const void *data, u32 len)
+{
+ const struct gip_security2_client_cert *message = data;
+
+ if (len < sizeof(*message))
+ return -EINVAL;
+
+ gip_dbg(security,
+ "%s: header=%.*s, chip=%.*s, revision=%.*s\n", __func__,
+ (int)sizeof(message->header), message->header,
+ (int)sizeof(message->chip), message->chip,
+ (int)sizeof(message->revision), message->revision);
+
+ return gip_security_send_request(security,
+ GIP_SECURITY2_CMD_CLIENT_PUBKEY,
+ sizeof(struct gip_security2_client_pubkey));
+}
+
+static int gip_security2_handle_pubkey(struct gip_security *security,
+ const void *data, u32 len)
+{
+ const struct gip_security2_client_pubkey *message = data;
+
+ if (len < sizeof(*message))
+ return -EINVAL;
+
+ memcpy(security->pubkey_client2, message->pubkey, sizeof(message->pubkey));
+ schedule_work(&security->work_exchange_ecdh);
+
+ return 0;
+}
+
+static void gip_security2_exchange_ecdh(struct work_struct *work)
+{
+ struct gip_security *security = container_of(work, typeof(*security), work_exchange_ecdh);
+ struct gip_attachment *attachment = container_of(security, struct gip_attachment, security);
+ struct gip_security2_host_pubkey message = {};
+ u8 random[GIP_SECURITY_RANDOM_LEN * 2];
+ u8 secret[GIP_SECURITY2_SECRET_LEN];
+ int err;
+
+ guard(mutex)(&attachment->lock);
+ if (security->status != GIP_SECURITY_SENT)
+ return;
+
+ memcpy(random, security->random_host, sizeof(security->random_host));
+ memcpy(random + sizeof(security->random_host), security->random_client,
+ sizeof(security->random_client));
+
+ err = gip_security_compute_ecdh(security->pubkey_client2,
+ message.pubkey, sizeof(message.pubkey), secret);
+ if (err) {
+ gip_err(security, "%s: compute ECDH failed: %d\n", __func__, err);
+ return;
+ }
+
+ gip_security_compute_prf("Master Secret", secret, sizeof(secret),
+ random, sizeof(random), security->master_secret,
+ sizeof(security->master_secret));
+
+ err = gip_security_send_message(security, GIP_SECURITY2_CMD_HOST_PUBKEY,
+ &message, sizeof(message));
+ if (err)
+ gip_err(security, "%s: send message failed: %d\n", __func__, err);
+}
+
+static int gip_security_send_hello(struct gip_security *security)
+{
+ struct gip_security_host_hello message = {};
+
+ get_random_bytes(security->random_host, sizeof(security->random_host));
+ memcpy(message.random, security->random_host, sizeof(message.random));
+
+ return gip_security_send_message(security, GIP_SECURITY_CMD_HOST_HELLO,
+ &message, sizeof(message));
+}
+
+static int gip_security_send_finish(struct gip_security *security,
+ enum gip_security_command_handshake cmd)
+{
+ struct gip_security_host_finish message = {};
+ u8 transcript[GIP_SECURITY_TRANSCRIPT_LEN];
+
+ gip_security_get_transcript(&security->transcript, transcript);
+ gip_security_compute_prf("Host Finished", security->master_secret,
+ sizeof(security->master_secret), transcript, sizeof(transcript),
+ message.transcript, sizeof(message.transcript));
+
+ return gip_security_send_message(security, cmd, &message, sizeof(message));
+}
+
+static int gip_security_handle_acknowledge(struct gip_security *security)
+{
+ switch (security->last_sent_command) {
+ case GIP_SECURITY2_CMD_HOST_HELLO:
+ return gip_security_send_request(security,
+ GIP_SECURITY2_CMD_CLIENT_HELLO,
+ sizeof(struct gip_security2_client_hello));
+ case GIP_SECURITY2_CMD_HOST_PUBKEY:
+ return gip_security_send_finish(security, GIP_SECURITY2_CMD_HOST_FINISH);
+ case GIP_SECURITY2_CMD_HOST_FINISH:
+ return gip_security_send_request(security,
+ GIP_SECURITY2_CMD_CLIENT_FINISH,
+ sizeof(struct gip_security2_client_finish));
+ case GIP_SECURITY_CMD_HOST_HELLO:
+ return gip_security_send_request(security,
+ GIP_SECURITY_CMD_CLIENT_HELLO,
+ sizeof(struct gip_security_client_hello));
+ case GIP_SECURITY_CMD_HOST_SECRET:
+ return gip_security_send_finish(security, GIP_SECURITY_CMD_HOST_FINISH);
+ case GIP_SECURITY_CMD_HOST_FINISH:
+ return gip_security_send_request(security,
+ GIP_SECURITY_CMD_CLIENT_FINISH,
+ sizeof(struct gip_security_client_finish));
+ default:
+ return -EPROTO;
+ }
+}
+
+static int gip_security_handle_hello(struct gip_security *security, const void *data, u32 len)
+{
+ const struct gip_security_client_hello *message = data;
+
+ if (len < sizeof(*message))
+ return -EINVAL;
+
+ memcpy(security->random_client, message->random, sizeof(message->random));
+
+ return gip_security_send_request(security, GIP_SECURITY_CMD_CLIENT_CERTIFICATE,
+ GIP_SECURITY_CERTIFICATE_MAX_LEN);
+}
+
+static int gip_security_handle_certificate(struct gip_security *security, const void *data, u32 len)
+{
+ /* ASN.1 SEQUENCE (len = 0x04 + 0x010a) */
+ u8 asn1_seq[] = { 0x30, 0x82, 0x01, 0x0a };
+ int i;
+
+ if (len > GIP_SECURITY_CERTIFICATE_MAX_LEN)
+ return -EINVAL;
+
+ /*
+ * Poor way of extracting a pubkey from an X.509 certificate.
+ * The certificates issued by Microsoft do not comply with RFC 5280.
+ * They have an empty subject and no subjectAltName.
+ * This is explicitly forbidden by section 4.2.1.6 of the RFC.
+ * The kernel's ASN.1 parser will fail when using x509_cert_parse.
+ */
+ for (i = 0; i + sizeof(asn1_seq) <= len; i++) {
+ if (memcmp(data + i, asn1_seq, sizeof(asn1_seq)))
+ continue;
+
+ if (i + GIP_SECURITY_PUBKEY_LEN > len)
+ return -EINVAL;
+
+ memcpy(security->pubkey_client, data + i, GIP_SECURITY_PUBKEY_LEN);
+ schedule_work(&security->work_exchange_rsa);
+
+ return 0;
+ }
+
+ return -EPROTO;
+}
+
+static int gip_security_handle_finish(struct gip_security *security, const void *data, u32 len)
+{
+ const struct gip_security_client_finish *message = data;
+ u8 transcript[GIP_SECURITY_TRANSCRIPT_LEN];
+ u8 finished[GIP_SECURITY_TRANSCRIPT_LEN];
+
+ if (len < sizeof(*message))
+ return -EINVAL;
+
+ gip_security_get_transcript(&security->transcript, transcript);
+ gip_security_compute_prf("Device Finished",
+ security->master_secret, sizeof(security->master_secret),
+ transcript, sizeof(transcript), finished, sizeof(finished));
+
+ if (memcmp(message->transcript, finished, sizeof(finished))) {
+ gip_err(security, "%s: transcript mismatch\n", __func__);
+ return -EPROTO;
+ }
+
+ schedule_work(&security->work_complete);
+
+ return 0;
+}
+
+static void gip_security_exchange_rsa(struct work_struct *work)
+{
+ struct gip_security *security = container_of(work, typeof(*security), work_exchange_rsa);
+ struct gip_attachment *attachment = container_of(security, struct gip_attachment, security);
+ struct gip_security_host_secret message = {};
+ u8 random[GIP_SECURITY_RANDOM_LEN * 2];
+ int err;
+
+ guard(mutex)(&attachment->lock);
+ if (security->status != GIP_SECURITY_SENT)
+ return;
+
+ memcpy(random, security->random_host, sizeof(security->random_host));
+ memcpy(random + sizeof(security->random_host), security->random_client,
+ sizeof(security->random_client));
+
+ /* get random premaster secret */
+ get_random_bytes(security->pms, sizeof(security->pms));
+
+ err = gip_security_encrypt_rsa(security->pubkey_client,
+ sizeof(security->pubkey_client), security->pms,
+ sizeof(security->pms), message.encrypted_pms,
+ sizeof(message.encrypted_pms));
+ if (err) {
+ gip_err(security, "%s: encrypt RSA failed: %d\n", __func__, err);
+ return;
+ }
+
+ gip_security_compute_prf("Master Secret", security->pms,
+ sizeof(security->pms), random, sizeof(random),
+ security->master_secret, sizeof(security->master_secret));
+
+ err = gip_security_send_message(security, GIP_SECURITY_CMD_HOST_SECRET,
+ &message, sizeof(message));
+ if (err)
+ gip_err(security, "%s: send message failed: %d\n", __func__, err);
+}
+
+static void gip_security_complete_handshake(struct work_struct *work)
+{
+ struct gip_security *security = container_of(work, typeof(*security), work_complete);
+ struct gip_attachment *attachment = container_of(security, struct gip_attachment, security);
+ struct gip_security_header_control hdr = {
+ .context = GIP_SECURITY_CTX_CONTROL,
+ .control = GIP_SECURITY_CTRL_COMPLETE,
+ };
+ u8 random[GIP_SECURITY_RANDOM_LEN * 2];
+ u8 key[GIP_SECURITY_SESSION_KEY_LEN];
+ int err;
+
+ guard(mutex)(&attachment->lock);
+ if (security->status != GIP_SECURITY_SENT)
+ return;
+
+ memcpy(random, security->random_host, sizeof(security->random_host));
+ memcpy(random + sizeof(security->random_host), security->random_client,
+ sizeof(security->random_client));
+
+ gip_security_compute_prf(
+ "EXPORTER DAWN data channel session key for controller",
+ security->master_secret, sizeof(security->master_secret),
+ random, sizeof(random), key, sizeof(key));
+
+ gip_dbg(security, "%s: key=%*phD\n", __func__, (int)sizeof(key), key);
+
+ err = gip_send_system_message(attachment, GIP_CMD_SECURITY,
+ 0, &hdr, sizeof(hdr));
+ if (err) {
+ gip_err(security, "%s: send complete failed: %d\n", __func__, err);
+ return;
+ }
+
+ security->status = GIP_SECURITY_DONE;
+}
+
+static int gip_security_dispatch_message(struct gip_security *security,
+ enum gip_security_command_handshake cmd, const void *data, u32 len)
+{
+ switch (cmd) {
+ case GIP_SECURITY2_CMD_CLIENT_HELLO:
+ return gip_security2_handle_hello(security, data, len);
+ case GIP_SECURITY2_CMD_CLIENT_CERTIFICATE:
+ return gip_security2_handle_certificate(security, data, len);
+ case GIP_SECURITY2_CMD_CLIENT_PUBKEY:
+ return gip_security2_handle_pubkey(security, data, len);
+ case GIP_SECURITY2_CMD_CLIENT_FINISH:
+ return gip_security_handle_finish(security, data, len);
+ case GIP_SECURITY_CMD_CLIENT_HELLO:
+ return gip_security_handle_hello(security, data, len);
+ case GIP_SECURITY_CMD_CLIENT_CERTIFICATE:
+ return gip_security_handle_certificate(security, data, len);
+ case GIP_SECURITY_CMD_CLIENT_FINISH:
+ return gip_security_handle_finish(security, data, len);
+ default:
+ return -EPROTO;
+ }
+}
+
+int gip_security_handle_message(struct gip_security *security, const void *bytes, int num_bytes)
+{
+ const struct gip_security_header_handshake *handshake = bytes;
+ const struct gip_security_header_full *hdr;
+ int err;
+
+ if (security->status != GIP_SECURITY_SENT) {
+ gip_err(security, "%s: security message received when none expected: 0x%02x\n",
+ __func__, handshake->command);
+ return -EPROTO;
+ }
+
+ if (num_bytes < sizeof(*handshake))
+ return -EINVAL;
+
+ if (handshake->error)
+ return -EPROTO;
+
+ if (handshake->options & GIP_SECURITY_OPT_ACKNOWLEDGE) {
+ if (handshake->command == 0x01)
+ return gip_security_handle_acknowledge(security);
+
+ gip_err(security, "%s: handshake failed: 0x%02x\n",
+ __func__, handshake->command);
+ return -EPROTO;
+ }
+
+ if (num_bytes < sizeof(*hdr))
+ return -EINVAL;
+
+ hdr = bytes;
+ /* client uses v2 */
+ if (handshake->command != hdr->data.command) {
+ /* reset transcript hash and restart handshake */
+ gip_dbg(security, "%s: protocol upgrade\n", __func__);
+ sha256_init(&security->transcript);
+ return gip_security2_send_hello(security);
+ }
+
+ err = gip_security_dispatch_message(security, hdr->data.command,
+ bytes + sizeof(*hdr), num_bytes - sizeof(*hdr));
+ if (err)
+ return err;
+
+ sha256_update(&security->transcript, bytes + sizeof(hdr->handshake),
+ num_bytes - sizeof(hdr->handshake));
+
+ return 0;
+}
+
+void gip_security_release(struct gip_security *security)
+{
+ if (security->status < GIP_SECURITY_SENT)
+ return;
+
+ cancel_work(&security->work_exchange_rsa);
+ cancel_work(&security->work_exchange_ecdh);
+ cancel_work(&security->work_complete);
+
+ memzero_explicit(&security->transcript, sizeof(security->transcript));
+
+ security->status = GIP_SECURITY_PENDING;
+}
+
+int gip_security_start_handshake(struct gip_security *security)
+{
+ int err;
+
+ sha256_init(&security->transcript);
+
+ INIT_WORK(&security->work_exchange_rsa, gip_security_exchange_rsa);
+ INIT_WORK(&security->work_exchange_ecdh, gip_security2_exchange_ecdh);
+ INIT_WORK(&security->work_complete, gip_security_complete_handshake);
+
+ err = gip_security_send_hello(security);
+ if (err < 0)
+ return err;
+
+ security->status = GIP_SECURITY_SENT;
+ return 0;
+}
+
+int gip_security_skip_handshake(struct gip_security *security)
+{
+ struct gip_attachment *attachment = container_of(security, struct gip_attachment, security);
+ struct gip_security_header_control hdr = {
+ .context = GIP_SECURITY_CTX_CONTROL,
+ .control = GIP_SECURITY_CTRL_COMPLETE,
+ };
+ int err;
+
+ err = gip_send_system_message(attachment, GIP_CMD_SECURITY, 0, &hdr, sizeof(hdr));
+ if (err < 0)
+ return err;
+
+ security->status = GIP_SECURITY_SKIPPED;
+ return 0;
+}
diff --git a/drivers/input/joystick/gip/gip.h b/drivers/input/joystick/gip/gip.h
index 007edbb628b2..d2ad10f77bc2 100644
--- a/drivers/input/joystick/gip/gip.h
+++ b/drivers/input/joystick/gip/gip.h
@@ -12,6 +12,7 @@
#ifndef _GIP_H
#define _GIP_H
+#include <crypto/sha2.h>
#include <linux/hid.h>
#include <linux/led-class-multicolor.h>
#include <linux/power_supply.h>
@@ -29,6 +30,7 @@
#define GIP_VID_MICROSOFT 0x045e
#define GIP_VID_PDP 0x0e6f
+#define GIP_VID_BDA 0x24c6
#define GIP_PID_XBOX_ONE_1573 0x02d1
#define GIP_PID_XBOX_ONE_1697 0x02dd
@@ -40,9 +42,13 @@
#define GIP_PID_PDP_ROCK_CANDY 0x0246
+#define GIP_PID_BDA_XB1_CLASSIC 0x581a
+#define GIP_PID_BDA_XB1_FUSION_PRO 0x591a
+
#define GIP_QUIRK_NO_HELLO BIT(0)
#define GIP_QUIRK_NO_IMPULSE_VIBRATION BIT(1)
#define GIP_QUIRK_SWAP_LB_RB BIT(2)
+#define GIP_QUIRK_SKIP_SECURITY BIT(3)
/*
* Driver-specific quirks should start from 31 and go downwards to avoid
* conflicts with newly-added core quirks
@@ -90,13 +96,21 @@
#define GIP_LL_STATIC_CONFIGURATION 0x21
#define GIP_LL_BUTTON_INFO_REPORT 0x22
+#define GIP_SECURITY_RANDOM_LEN 32
+#define GIP_SECURITY_PUBKEY_LEN 270
+#define GIP_SECURITY_SECRET_LEN 48
+
+#define GIP_SECURITY2_PUBKEY_LEN 64
+#define GIP_SECURITY2_SECRET_LEN 32
+
#define MAX_GIP_CMD 0x80
#define to_gip_device(p) \
_Generic((p), \
struct gip_attachment * : gip_attachment_dev, \
struct gip_interface * : gip_interface_dev, \
- struct gip_device * : gip_device_dev)(p)
+ struct gip_device * : gip_device_dev, \
+ struct gip_security * : gip_security_dev)(p)
#define gip_dbg(dev, ...) dev_dbg(to_gip_device(dev), __VA_ARGS__)
#define gip_info(dev, ...) dev_info(to_gip_device(dev), __VA_ARGS__)
@@ -120,6 +134,13 @@ enum gip_metadata_status {
GIP_METADATA_PENDING = 3,
};
+enum gip_security_status {
+ GIP_SECURITY_PENDING = 0,
+ GIP_SECURITY_SKIPPED,
+ GIP_SECURITY_SENT,
+ GIP_SECURITY_DONE,
+};
+
enum gip_elite_button_format {
GIP_BTN_FMT_UNKNOWN,
GIP_BTN_FMT_XBE1,
@@ -209,6 +230,26 @@ struct gip_out_fragment {
struct delayed_work timeout;
};
+struct gip_security {
+ struct sha256_ctx transcript;
+
+ struct work_struct work_exchange_rsa;
+ struct work_struct work_exchange_ecdh;
+ struct work_struct work_complete;
+
+ enum gip_security_status status;
+ uint8_t last_sent_command;
+
+ uint8_t random_host[GIP_SECURITY_RANDOM_LEN];
+ uint8_t random_client[GIP_SECURITY_RANDOM_LEN];
+
+ uint8_t pubkey_client[GIP_SECURITY_PUBKEY_LEN];
+ uint8_t pubkey_client2[GIP_SECURITY2_PUBKEY_LEN];
+
+ uint8_t pms[GIP_SECURITY_SECRET_LEN];
+ uint8_t master_secret[GIP_SECURITY_SECRET_LEN];
+};
+
struct gip_attachment;
typedef int (*gip_command_handler)(struct gip_attachment *a, const struct gip_header *header,
const uint8_t *bytes, int num_bytes);
@@ -246,6 +287,7 @@ struct gip_attachment {
struct delayed_work metadata_next;
int metadata_retries;
struct gip_metadata metadata;
+ struct gip_security security;
uint8_t seq_system;
uint8_t seq_security;
@@ -359,6 +401,11 @@ static inline struct device *gip_device_dev(struct gip_device *device)
return &device->data.intf->dev;
}
+static inline struct device *gip_security_dev(struct gip_security *security)
+{
+ return gip_attachment_dev(container_of(security, struct gip_attachment, security));
+}
+
bool gip_supports_vendor_message(struct gip_attachment *attachment, uint8_t command, bool upstream);
int gip_send_system_message(struct gip_attachment *attachment,
@@ -366,6 +413,11 @@ int gip_send_system_message(struct gip_attachment *attachment,
int gip_send_vendor_message(struct gip_attachment *attachment,
uint8_t message_type, uint8_t flags, const void *bytes, int num_bytes);
+int gip_security_handle_message(struct gip_security *security, const void *bytes, int num_bytes);
+int gip_security_start_handshake(struct gip_security *security);
+int gip_security_skip_handshake(struct gip_security *security);
+void gip_security_release(struct gip_security *security);
+
extern const struct gip_driver gip_driver_navigation;
extern const struct gip_driver gip_driver_gamepad;
extern const struct gip_driver gip_driver_arcade_stick;
--
2.54.0
^ permalink raw reply related [flat|nested] 23+ messages in thread
* [PATCH v6 08/12] Input: xbox_gip - Add arcade stick support
2026-09-08 3:21 [PATCH v6 00/12] Input: xbox_gip - Add new driver for Xbox GIP Vicki Pfau
` (6 preceding siblings ...)
2026-09-08 3:21 ` [PATCH v6 07/12] Input: xbox_gip - Add security implementation from xone Vicki Pfau
@ 2026-09-08 3:21 ` Vicki Pfau
2026-09-08 3:35 ` sashiko-bot
2026-09-08 3:21 ` [PATCH v6 09/12] Input: xbox_gip - Add support for PDP guitar controllers Vicki Pfau
` (3 subsequent siblings)
11 siblings, 1 reply; 23+ messages in thread
From: Vicki Pfau @ 2026-09-08 3:21 UTC (permalink / raw)
To: Dmitry Torokhov, linux-input; +Cc: Vicki Pfau
This adds support for the arcade stick device type. Currently I'm only
aware of one Xbox controller that uses this device type, the Razer Atrox,
so testing coverage is limited.
Signed-off-by: Vicki Pfau <vi@endrift.com>
---
drivers/input/joystick/gip/Makefile | 2 +
drivers/input/joystick/gip/gip-arcade-stick.c | 173 ++++++++++++++++++
drivers/input/joystick/gip/gip-core.c | 6 +-
drivers/input/joystick/gip/gip.h | 4 +-
4 files changed, 181 insertions(+), 4 deletions(-)
create mode 100644 drivers/input/joystick/gip/gip-arcade-stick.c
diff --git a/drivers/input/joystick/gip/Makefile b/drivers/input/joystick/gip/Makefile
index a5ad301a9063..9ed59caec4d9 100644
--- a/drivers/input/joystick/gip/Makefile
+++ b/drivers/input/joystick/gip/Makefile
@@ -2,3 +2,5 @@
obj-$(CONFIG_JOYSTICK_XBOX_GIP) += xbox-gip.o
# Base driver
xbox-gip-y := gip-core.o gip-drivers.o gip-security.o
+# Additional device support
+xbox-gip-y += gip-arcade-stick.o
diff --git a/drivers/input/joystick/gip/gip-arcade-stick.c b/drivers/input/joystick/gip/gip-arcade-stick.c
new file mode 100644
index 000000000000..11ededfab855
--- /dev/null
+++ b/drivers/input/joystick/gip/gip-arcade-stick.c
@@ -0,0 +1,173 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+/*
+ * Drivers for GIP arcade sticks
+ *
+ * Copyright (c) 2025 Valve Software
+ *
+ * This driver is based on the Microsoft GIP spec at:
+ * https://aka.ms/gipdocs
+ * https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-gipusb/e7c90904-5e21-426e-b9ad-d82adeee0dbc
+ */
+
+#include <linux/unaligned.h>
+#include "gip.h"
+
+enum gip_arcade_stick_vibration_motor_support {
+ GIP_VIBRATION_NO_MOTOR = 0,
+ GIP_VIBRATION_SINGLE_MOTOR = 1,
+ GIP_VIBRATION_DUAL_MOTOR = 2,
+};
+
+struct gip_arcade_stick_info {
+ uint8_t vibration_motor;
+ uint16_t actuator_bias;
+};
+
+struct gip_arcade_stick_static_coniguration {
+ uint8_t button_count;
+ uint8_t report_version;
+ uint8_t vibration_motor_support;
+ uint8_t actuator_bits;
+};
+
+static int gip_arcade_stick_probe(struct gip_attachment *attachment)
+{
+ struct gip_arcade_stick_info *info = kzalloc(sizeof(*info), GFP_KERNEL);
+
+ if (!info)
+ return -ENOMEM;
+
+ attachment->quirks |= GIP_QUIRK_SWAP_LB_RB;
+ attachment->driver_data = info;
+
+ return 0;
+}
+
+static void gip_arcade_stick_remove(struct gip_attachment *attachment)
+{
+ kfree(attachment->driver_data);
+ attachment->driver_data = NULL;
+}
+
+static int gip_init_arcade_stick(struct gip_attachment *attachment)
+{
+ if (gip_supports_vendor_message(attachment, GIP_CMD_INITIAL_REPORTS_REQUEST, false)) {
+ uint8_t request = GIP_LL_STATIC_CONFIGURATION;
+ int rc = gip_send_vendor_message(attachment, GIP_CMD_INITIAL_REPORTS_REQUEST, 0,
+ &request, sizeof(request));
+
+ if (rc < 0)
+ return rc;
+
+ return GIP_INIT_NO_INPUT;
+ }
+
+ return 0;
+}
+
+static int gip_setup_arcade_stick_input(struct gip_attachment *attachment, struct input_dev *input)
+{
+ struct gip_arcade_stick_info *info = attachment->driver_data;
+ int rc;
+
+ if (!info)
+ return -ENODEV;
+
+ rc = gip_driver_navigation.setup_input(attachment, input);
+ if (rc < 0)
+ return rc;
+
+ if (info->actuator_bias > 0) {
+ input_set_abs_params(input, ABS_X,
+ -info->actuator_bias, info->actuator_bias - 1, 0, 0);
+ input_set_abs_params(input, ABS_Y,
+ -info->actuator_bias, info->actuator_bias - 1, 0, 0);
+ }
+
+ if (attachment->extra_buttons >= 1)
+ input_set_capability(input, EV_KEY, BTN_TR2);
+
+ if (attachment->extra_buttons >= 2)
+ input_set_capability(input, EV_KEY, BTN_TL2);
+ return 0;
+}
+
+static int gip_handle_arcade_stick_report(struct gip_attachment *attachment,
+ struct input_dev *input, const uint8_t *bytes, int num_bytes)
+{
+ struct gip_arcade_stick_info *info = attachment->driver_data;
+ int rc;
+
+ if (!info)
+ return -ENODEV;
+
+ rc = gip_driver_navigation.handle_input_report(attachment, input, bytes, num_bytes);
+ if (rc < 0)
+ return rc;
+
+ if (num_bytes < 6) {
+ gip_dbg(attachment, "Discarding too-short input report\n");
+ return -EINVAL;
+ }
+
+ if (info->actuator_bias > 0) {
+ input_report_abs(input, ABS_X, get_unaligned_le16(&bytes[2]) - info->actuator_bias);
+ input_report_abs(input, ABS_Y, get_unaligned_le16(&bytes[4]) - info->actuator_bias);
+ }
+
+ if (num_bytes >= 19) {
+ /* Extra button 6 */
+ input_report_key(input, BTN_TR2, bytes[18] & BIT(6));
+ /* Extra button 7 */
+ input_report_key(input, BTN_TL2, bytes[18] & BIT(7));
+ }
+
+ return 0;
+}
+
+static int gip_handle_arcade_stick_ll_static_configuration(struct gip_attachment *attachment,
+ const struct gip_header *header, const uint8_t *bytes, int num_bytes)
+{
+ const struct gip_arcade_stick_static_coniguration *config =
+ (const struct gip_arcade_stick_static_coniguration *)bytes;
+ struct gip_arcade_stick_info *info = attachment->driver_data;
+
+ if (!info)
+ return -ENODEV;
+
+ if (num_bytes < 4)
+ return -EINVAL;
+
+ attachment->extra_buttons = clamp(config->button_count, 6, 38) - 6;
+ if (config->actuator_bits)
+ info->actuator_bias = BIT(min(config->actuator_bits, 16) - 1);
+ else
+ info->actuator_bias = 0;
+
+ if (config->vibration_motor_support == GIP_VIBRATION_NO_MOTOR)
+ attachment->features &= ~GIP_FEATURE_MOTOR_CONTROL;
+
+ gip_dbg(attachment, "Arcade stick with report version %u, %u buttons, %u actuator bits\n",
+ config->report_version, config->button_count, config->actuator_bits);
+
+ return gip_setup_input_device(attachment);
+}
+
+const struct gip_driver gip_driver_arcade_stick = {
+ .types = (const char* const[]) {
+ "Windows.Xbox.Input.ArcadeStick",
+ "Microsoft.Xbox.Input.ArcadeStick",
+ NULL
+ },
+ .guid = GUID_INIT(0x332054cc, 0xa34b, 0x41d5, 0xa3, 0x4a,
+ 0xa6, 0xa6, 0x71, 0x1e, 0xc4, 0xb3),
+
+ .probe = gip_arcade_stick_probe,
+ .remove = gip_arcade_stick_remove,
+ .init = gip_init_arcade_stick,
+ .setup_input = gip_setup_arcade_stick_input,
+ .handle_input_report = gip_handle_arcade_stick_report,
+ .vendor_handlers = {
+ [GIP_LL_STATIC_CONFIGURATION] = gip_handle_arcade_stick_ll_static_configuration,
+ },
+};
diff --git a/drivers/input/joystick/gip/gip-core.c b/drivers/input/joystick/gip/gip-core.c
index 157a22c80abd..9e43d9cba453 100644
--- a/drivers/input/joystick/gip/gip-core.c
+++ b/drivers/input/joystick/gip/gip-core.c
@@ -10,7 +10,8 @@
* - Raw character device
* - Wheel support
* - Flight stick support
- * - Arcade stick support
+ * - More arcade stick testing
+ * - Arcade stick extra buttons
* - Split into driver-per-attachment GIP-as-a-bus approach drivers
*
* This driver is based on the Microsoft GIP spec at:
@@ -331,6 +332,7 @@ struct gip_direct_motor {
static const struct gip_driver *base_drivers[] = {
&gip_driver_navigation,
&gip_driver_gamepad,
+ &gip_driver_arcade_stick,
NULL /* Sentinel */
};
@@ -1582,7 +1584,7 @@ static int gip_handle_command_raw_report(struct gip_attachment *attachment,
return 0;
}
-static int gip_setup_input_device(struct gip_attachment *attachment)
+int gip_setup_input_device(struct gip_attachment *attachment)
{
struct input_dev *input;
int rc;
diff --git a/drivers/input/joystick/gip/gip.h b/drivers/input/joystick/gip/gip.h
index d2ad10f77bc2..98add856ae21 100644
--- a/drivers/input/joystick/gip/gip.h
+++ b/drivers/input/joystick/gip/gip.h
@@ -406,6 +406,8 @@ static inline struct device *gip_security_dev(struct gip_security *security)
return gip_attachment_dev(container_of(security, struct gip_attachment, security));
}
+int gip_setup_input_device(struct gip_attachment *attachment);
+
bool gip_supports_vendor_message(struct gip_attachment *attachment, uint8_t command, bool upstream);
int gip_send_system_message(struct gip_attachment *attachment,
@@ -421,6 +423,4 @@ void gip_security_release(struct gip_security *security);
extern const struct gip_driver gip_driver_navigation;
extern const struct gip_driver gip_driver_gamepad;
extern const struct gip_driver gip_driver_arcade_stick;
-extern const struct gip_driver gip_driver_wheel;
-extern const struct gip_driver gip_driver_flight_stick;
#endif
--
2.54.0
^ permalink raw reply related [flat|nested] 23+ messages in thread
* [PATCH v6 09/12] Input: xbox_gip - Add support for PDP guitar controllers
2026-09-08 3:21 [PATCH v6 00/12] Input: xbox_gip - Add new driver for Xbox GIP Vicki Pfau
` (7 preceding siblings ...)
2026-09-08 3:21 ` [PATCH v6 08/12] Input: xbox_gip - Add arcade stick support Vicki Pfau
@ 2026-09-08 3:21 ` Vicki Pfau
2026-09-08 3:21 ` [PATCH v6 10/12] Input: Add ABS_CLUTCH, HANDBRAKE, and SHIFTER Vicki Pfau
` (2 subsequent siblings)
11 siblings, 0 replies; 23+ messages in thread
From: Vicki Pfau @ 2026-09-08 3:21 UTC (permalink / raw)
To: Dmitry Torokhov, linux-input; +Cc: Vicki Pfau
This patch adds support for the PDP guitar controllers, namely the Fender
Jaguar and RiffMaster models. These use mostly the same protocol, but the
RiffMaster appears t use a slightly newer variant.
Signed-off-by: Vicki Pfau <vi@endrift.com>
---
drivers/input/joystick/gip/Makefile | 1 +
drivers/input/joystick/gip/gip-core.c | 1 +
drivers/input/joystick/gip/gip-pdp-jaguar.c | 129 ++++++++++++++++++++
drivers/input/joystick/gip/gip.h | 2 +
4 files changed, 133 insertions(+)
create mode 100644 drivers/input/joystick/gip/gip-pdp-jaguar.c
diff --git a/drivers/input/joystick/gip/Makefile b/drivers/input/joystick/gip/Makefile
index 9ed59caec4d9..62c016d6c11e 100644
--- a/drivers/input/joystick/gip/Makefile
+++ b/drivers/input/joystick/gip/Makefile
@@ -4,3 +4,4 @@ obj-$(CONFIG_JOYSTICK_XBOX_GIP) += xbox-gip.o
xbox-gip-y := gip-core.o gip-drivers.o gip-security.o
# Additional device support
xbox-gip-y += gip-arcade-stick.o
+xbox-gip-y += gip-pdp-jaguar.o
diff --git a/drivers/input/joystick/gip/gip-core.c b/drivers/input/joystick/gip/gip-core.c
index 9e43d9cba453..5e581adb0788 100644
--- a/drivers/input/joystick/gip/gip-core.c
+++ b/drivers/input/joystick/gip/gip-core.c
@@ -333,6 +333,7 @@ static const struct gip_driver *base_drivers[] = {
&gip_driver_navigation,
&gip_driver_gamepad,
&gip_driver_arcade_stick,
+ &gip_driver_pdp_jaguar,
NULL /* Sentinel */
};
diff --git a/drivers/input/joystick/gip/gip-pdp-jaguar.c b/drivers/input/joystick/gip/gip-pdp-jaguar.c
new file mode 100644
index 000000000000..ec0e9d811d12
--- /dev/null
+++ b/drivers/input/joystick/gip/gip-pdp-jaguar.c
@@ -0,0 +1,129 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+/*
+ * Drivers for GIP PDP Jaguar-style guitars
+ *
+ * Copyright (c) 2026 Valve Software
+ */
+
+#include <linux/unaligned.h>
+#include "gip.h"
+
+#define GIP_QUIRK_PDP_HAS_RIGHT_STICK BIT(31)
+
+static int gip_setup_pdp_jaguar_input(struct gip_attachment *attachment, struct input_dev *input)
+{
+ /*
+ * Despite having the navigation controller GUID, we don't want to use
+ * those mappings. Instead, we use the xone mappings for compatibility
+ * reasons.
+ */
+
+ /* Lower fret */
+ input_set_capability(input, EV_KEY, BTN_TRIGGER_HAPPY1);
+ input_set_capability(input, EV_KEY, BTN_TRIGGER_HAPPY2);
+ input_set_capability(input, EV_KEY, BTN_TRIGGER_HAPPY3);
+ input_set_capability(input, EV_KEY, BTN_TRIGGER_HAPPY4);
+ input_set_capability(input, EV_KEY, BTN_TRIGGER_HAPPY5);
+ /* Upper fret */
+ input_set_capability(input, EV_KEY, BTN_TRIGGER_HAPPY6);
+ input_set_capability(input, EV_KEY, BTN_TRIGGER_HAPPY7);
+ input_set_capability(input, EV_KEY, BTN_TRIGGER_HAPPY8);
+ input_set_capability(input, EV_KEY, BTN_TRIGGER_HAPPY9);
+ input_set_capability(input, EV_KEY, BTN_TRIGGER_HAPPY10);
+
+ input_set_capability(input, EV_KEY, BTN_START);
+ input_set_capability(input, EV_KEY, BTN_SELECT);
+
+ /* Whammy bar */
+ input_set_abs_params(input, ABS_Y, 0, 255, 0, 0);
+ /* Tilt */
+ input_set_abs_params(input, ABS_Z, 0, 255, 0, 0);
+
+ input_set_abs_params(input, ABS_HAT0X, -1, 1, 0, 0);
+ input_set_abs_params(input, ABS_HAT0Y, -1, 1, 0, 0);
+
+ if (attachment->quirks & GIP_QUIRK_PDP_HAS_RIGHT_STICK) {
+ input_set_capability(input, EV_KEY, BTN_THUMBR);
+ input_set_abs_params(input, ABS_RX, -32768, 32767, 16, 128);
+ input_set_abs_params(input, ABS_RY, -32768, 32767, 16, 128);
+ }
+
+ return 0;
+}
+
+static int gip_handle_pdp_jaguar_report(struct gip_attachment *attachment,
+ struct input_dev *input, const uint8_t *bytes, int num_bytes)
+{
+ bool lower;
+
+ if (num_bytes < 4) {
+ gip_dbg(attachment, "Discarding too-short input report\n");
+ return -EINVAL;
+ }
+
+ input_report_key(input, BTN_START, bytes[0] & BIT(2));
+ input_report_key(input, BTN_SELECT, bytes[0] & BIT(3));
+
+ if (num_bytes >= 7 && (bytes[5] || bytes[6])) {
+ /* Newer report version on the RiffMaster */
+ input_report_key(input, BTN_TRIGGER_HAPPY1, bytes[5] & BIT(0));
+ input_report_key(input, BTN_TRIGGER_HAPPY2, bytes[5] & BIT(1));
+ input_report_key(input, BTN_TRIGGER_HAPPY3, bytes[5] & BIT(2));
+ input_report_key(input, BTN_TRIGGER_HAPPY4, bytes[5] & BIT(3));
+ input_report_key(input, BTN_TRIGGER_HAPPY5, bytes[5] & BIT(4));
+
+ input_report_key(input, BTN_TRIGGER_HAPPY6, bytes[6] & BIT(0));
+ input_report_key(input, BTN_TRIGGER_HAPPY7, bytes[6] & BIT(1));
+ input_report_key(input, BTN_TRIGGER_HAPPY8, bytes[6] & BIT(2));
+ input_report_key(input, BTN_TRIGGER_HAPPY9, bytes[6] & BIT(3));
+ input_report_key(input, BTN_TRIGGER_HAPPY10, bytes[6] & BIT(4));
+ } else {
+ lower = bytes[1] & BIT(6);
+ input_report_key(input, BTN_TRIGGER_HAPPY1, !lower && (bytes[0] & BIT(4)));
+ input_report_key(input, BTN_TRIGGER_HAPPY2, !lower && (bytes[0] & BIT(5)));
+ input_report_key(input, BTN_TRIGGER_HAPPY3, !lower && (bytes[0] & BIT(7)));
+ input_report_key(input, BTN_TRIGGER_HAPPY4, !lower && (bytes[0] & BIT(6)));
+ input_report_key(input, BTN_TRIGGER_HAPPY5, !lower && (bytes[1] & BIT(4)));
+
+ input_report_key(input, BTN_TRIGGER_HAPPY6, lower && (bytes[0] & BIT(4)));
+ input_report_key(input, BTN_TRIGGER_HAPPY7, lower && (bytes[0] & BIT(5)));
+ input_report_key(input, BTN_TRIGGER_HAPPY8, lower && (bytes[0] & BIT(7)));
+ input_report_key(input, BTN_TRIGGER_HAPPY9, lower && (bytes[0] & BIT(6)));
+ input_report_key(input, BTN_TRIGGER_HAPPY10, lower && (bytes[1] & BIT(4)));
+ }
+
+ input_report_abs(input, ABS_Y, bytes[2]);
+ input_report_abs(input, ABS_Z, bytes[3]);
+
+ input_report_abs(input, ABS_HAT0X,
+ !!(bytes[1] & BIT(3)) - !!(bytes[1] & BIT(2)));
+ input_report_abs(input, ABS_HAT0Y,
+ !!(bytes[1] & BIT(1)) - !!(bytes[1] & BIT(0)));
+
+ if ((attachment->quirks & GIP_QUIRK_PDP_HAS_RIGHT_STICK) && num_bytes >= 14) {
+ input_report_key(input, BTN_THUMBR, bytes[1] & BIT(6));
+ input_report_abs(input, ABS_RX, (int16_t)get_unaligned_le16(&bytes[10]));
+ input_report_abs(input, ABS_RY, ~(int16_t)get_unaligned_le16(&bytes[12]));
+ }
+
+ return 0;
+}
+
+const struct gip_driver gip_driver_pdp_jaguar = {
+ .types = (const char *const[]) { "PDP.Xbox.Guitar.Jaguar", NULL },
+ .guid = GUID_INIT(0x1a266af6, 0x3a46, 0x45e3, 0xb9, 0xb6,
+ 0x0f, 0x2c, 0x0b, 0x2c, 0x1e, 0xbe),
+
+ .quirks = (const struct gip_quirks[]) {
+ /* PDP RiffMaster */
+ { GIP_VID_PDP, GIP_PID_PDP_RIFFMASTER, 0,
+ .quirks = GIP_QUIRK_PDP_HAS_RIGHT_STICK, },
+
+ {0},
+ },
+ .probe = NULL,
+ .remove = NULL,
+ .init = NULL,
+ .setup_input = gip_setup_pdp_jaguar_input,
+ .handle_input_report = gip_handle_pdp_jaguar_report,
+};
diff --git a/drivers/input/joystick/gip/gip.h b/drivers/input/joystick/gip/gip.h
index 98add856ae21..3a35bcc43927 100644
--- a/drivers/input/joystick/gip/gip.h
+++ b/drivers/input/joystick/gip/gip.h
@@ -41,6 +41,7 @@
#define GIP_PID_XBOX_WIRELESS 0x0b12
#define GIP_PID_PDP_ROCK_CANDY 0x0246
+#define GIP_PID_PDP_RIFFMASTER 0x0248
#define GIP_PID_BDA_XB1_CLASSIC 0x581a
#define GIP_PID_BDA_XB1_FUSION_PRO 0x591a
@@ -423,4 +424,5 @@ void gip_security_release(struct gip_security *security);
extern const struct gip_driver gip_driver_navigation;
extern const struct gip_driver gip_driver_gamepad;
extern const struct gip_driver gip_driver_arcade_stick;
+extern const struct gip_driver gip_driver_pdp_jaguar;
#endif
--
2.54.0
^ permalink raw reply related [flat|nested] 23+ messages in thread
* [PATCH v6 10/12] Input: Add ABS_CLUTCH, HANDBRAKE, and SHIFTER
2026-09-08 3:21 [PATCH v6 00/12] Input: xbox_gip - Add new driver for Xbox GIP Vicki Pfau
` (8 preceding siblings ...)
2026-09-08 3:21 ` [PATCH v6 09/12] Input: xbox_gip - Add support for PDP guitar controllers Vicki Pfau
@ 2026-09-08 3:21 ` Vicki Pfau
2026-09-08 3:44 ` sashiko-bot
2026-09-08 3:21 ` [PATCH v6 11/12] HID: Map more automobile simulation inputs Vicki Pfau
2026-09-08 3:21 ` [PATCH v6 12/12] Input: xbox_gip - Add wheel support Vicki Pfau
11 siblings, 1 reply; 23+ messages in thread
From: Vicki Pfau @ 2026-09-08 3:21 UTC (permalink / raw)
To: Dmitry Torokhov, linux-input; +Cc: Vicki Pfau
Add new absolute axes for racing game controllers
Signed-off-by: Vicki Pfau <vi@endrift.com>
---
drivers/hid/hid-debug.c | 16 +++++++++-------
include/uapi/linux/input-event-codes.h | 3 +++
2 files changed, 12 insertions(+), 7 deletions(-)
diff --git a/drivers/hid/hid-debug.c b/drivers/hid/hid-debug.c
index f44e6e708404..7a1b56311e9b 100644
--- a/drivers/hid/hid-debug.c
+++ b/drivers/hid/hid-debug.c
@@ -3511,13 +3511,15 @@ static const char *absolutes[ABS_CNT] = {
[ABS_RY] = "Ry", [ABS_RZ] = "Rz",
[ABS_THROTTLE] = "Throttle", [ABS_RUDDER] = "Rudder",
[ABS_WHEEL] = "Wheel", [ABS_GAS] = "Gas",
- [ABS_BRAKE] = "Brake", [ABS_HAT0X] = "Hat0X",
- [ABS_HAT0Y] = "Hat0Y", [ABS_HAT1X] = "Hat1X",
- [ABS_HAT1Y] = "Hat1Y", [ABS_HAT2X] = "Hat2X",
- [ABS_HAT2Y] = "Hat2Y", [ABS_HAT3X] = "Hat3X",
- [ABS_HAT3Y] = "Hat 3Y", [ABS_PRESSURE] = "Pressure",
- [ABS_DISTANCE] = "Distance", [ABS_TILT_X] = "XTilt",
- [ABS_TILT_Y] = "YTilt", [ABS_TOOL_WIDTH] = "ToolWidth",
+ [ABS_BRAKE] = "Brake", [ABS_CLUTCH] = "Clutch",
+ [ABS_HANDBRAKE] = "Handbrake", [ABS_SHIFTER] = "Shifter",
+ [ABS_HAT0X] = "Hat0X", [ABS_HAT0Y] = "Hat0Y",
+ [ABS_HAT1X] = "Hat1X", [ABS_HAT1Y] = "Hat1Y",
+ [ABS_HAT2X] = "Hat2X", [ABS_HAT2Y] = "Hat2Y",
+ [ABS_HAT3X] = "Hat3X", [ABS_HAT3Y] = "Hat3Y",
+ [ABS_PRESSURE] = "Pressure", [ABS_DISTANCE] = "Distance",
+ [ABS_TILT_X] = "XTilt", [ABS_TILT_Y] = "YTilt",
+ [ABS_TOOL_WIDTH] = "ToolWidth",
[ABS_VOLUME] = "Volume", [ABS_PROFILE] = "Profile",
[ABS_SND_PROFILE] = "SoundProfile",
[ABS_MISC] = "Misc",
diff --git a/include/uapi/linux/input-event-codes.h b/include/uapi/linux/input-event-codes.h
index 3528168f7c6d..5c881ed44177 100644
--- a/include/uapi/linux/input-event-codes.h
+++ b/include/uapi/linux/input-event-codes.h
@@ -879,6 +879,9 @@
#define ABS_WHEEL 0x08
#define ABS_GAS 0x09
#define ABS_BRAKE 0x0a
+#define ABS_CLUTCH 0x0b
+#define ABS_HANDBRAKE 0x0c
+#define ABS_SHIFTER 0x0d
#define ABS_HAT0X 0x10
#define ABS_HAT0Y 0x11
#define ABS_HAT1X 0x12
--
2.54.0
^ permalink raw reply related [flat|nested] 23+ messages in thread
* [PATCH v6 11/12] HID: Map more automobile simulation inputs
2026-09-08 3:21 [PATCH v6 00/12] Input: xbox_gip - Add new driver for Xbox GIP Vicki Pfau
` (9 preceding siblings ...)
2026-09-08 3:21 ` [PATCH v6 10/12] Input: Add ABS_CLUTCH, HANDBRAKE, and SHIFTER Vicki Pfau
@ 2026-09-08 3:21 ` Vicki Pfau
2026-09-08 3:21 ` [PATCH v6 12/12] Input: xbox_gip - Add wheel support Vicki Pfau
11 siblings, 0 replies; 23+ messages in thread
From: Vicki Pfau @ 2026-09-08 3:21 UTC (permalink / raw)
To: Dmitry Torokhov, linux-input; +Cc: Vicki Pfau, Jiri Kosina
The HID usage tables section 5.3 specify clutch and shifter values that had
previously been ignored. As the ABS_CLUTCH and ABS_SHIFTER bits now exist,
we should use them appropriately.
Signed-off-by: Vicki Pfau <vi@endrift.com>
Acked-by: Jiri Kosina <jkosina@suse.com>
---
drivers/hid/hid-input.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c
index 3487600cadb4..6ade969412c6 100644
--- a/drivers/hid/hid-input.c
+++ b/drivers/hid/hid-input.c
@@ -828,6 +828,8 @@ static void hidinput_configure_usage(struct hid_input *hidinput, struct hid_fiel
case 0xbb: map_abs(ABS_THROTTLE); break;
case 0xc4: map_abs(ABS_GAS); break;
case 0xc5: map_abs(ABS_BRAKE); break;
+ case 0xc6: map_abs(ABS_CLUTCH); break;
+ case 0xc7: map_abs(ABS_SHIFTER); break;
case 0xc8: map_abs(ABS_WHEEL); break;
default: goto ignore;
}
--
2.54.0
^ permalink raw reply related [flat|nested] 23+ messages in thread
* [PATCH v6 12/12] Input: xbox_gip - Add wheel support
2026-09-08 3:21 [PATCH v6 00/12] Input: xbox_gip - Add new driver for Xbox GIP Vicki Pfau
` (10 preceding siblings ...)
2026-09-08 3:21 ` [PATCH v6 11/12] HID: Map more automobile simulation inputs Vicki Pfau
@ 2026-09-08 3:21 ` Vicki Pfau
2026-09-08 3:55 ` sashiko-bot
11 siblings, 1 reply; 23+ messages in thread
From: Vicki Pfau @ 2026-09-08 3:21 UTC (permalink / raw)
To: Dmitry Torokhov, linux-input; +Cc: Vicki Pfau
This adds preliminary support for racing wheel support in xbox_gip,
exposing them mapped to the newly added axes.
Signed-off-by: Vicki Pfau <vi@endrift.com>
---
drivers/input/joystick/gip/Makefile | 1 +
drivers/input/joystick/gip/gip-core.c | 4 +-
drivers/input/joystick/gip/gip-drivers.c | 10 +
drivers/input/joystick/gip/gip-wheel.c | 350 +++++++++++++++++++++++
drivers/input/joystick/gip/gip.h | 6 +
5 files changed, 370 insertions(+), 1 deletion(-)
create mode 100644 drivers/input/joystick/gip/gip-wheel.c
diff --git a/drivers/input/joystick/gip/Makefile b/drivers/input/joystick/gip/Makefile
index 62c016d6c11e..7d4209eb32c3 100644
--- a/drivers/input/joystick/gip/Makefile
+++ b/drivers/input/joystick/gip/Makefile
@@ -5,3 +5,4 @@ xbox-gip-y := gip-core.o gip-drivers.o gip-security.o
# Additional device support
xbox-gip-y += gip-arcade-stick.o
xbox-gip-y += gip-pdp-jaguar.o
+xbox-gip-y += gip-wheel.o
diff --git a/drivers/input/joystick/gip/gip-core.c b/drivers/input/joystick/gip/gip-core.c
index 5e581adb0788..b4c0693f24ef 100644
--- a/drivers/input/joystick/gip/gip-core.c
+++ b/drivers/input/joystick/gip/gip-core.c
@@ -8,7 +8,7 @@
* - Audio device support
* - Event logging
* - Raw character device
- * - Wheel support
+ * - Wheel force feedback
* - Flight stick support
* - More arcade stick testing
* - Arcade stick extra buttons
@@ -334,6 +334,8 @@ static const struct gip_driver *base_drivers[] = {
&gip_driver_gamepad,
&gip_driver_arcade_stick,
&gip_driver_pdp_jaguar,
+ &gip_driver_trueforce_wheel,
+ &gip_driver_wheel,
NULL /* Sentinel */
};
diff --git a/drivers/input/joystick/gip/gip-drivers.c b/drivers/input/joystick/gip/gip-drivers.c
index 74bc858e71cc..7ba11b19c8ee 100644
--- a/drivers/input/joystick/gip/gip-drivers.c
+++ b/drivers/input/joystick/gip/gip-drivers.c
@@ -142,6 +142,11 @@ static int gip_setup_navigation_input(struct gip_attachment *attachment, struct
input_set_capability(input, EV_KEY, BTN_TR);
input_set_capability(input, EV_KEY, BTN_TL);
+ if (attachment->quirks & GIP_QUIRK_FORCE_GAMEPAD_SB) {
+ input_set_capability(input, EV_KEY, BTN_THUMBR);
+ input_set_capability(input, EV_KEY, BTN_THUMBL);
+ }
+
attachment->dpad_as_buttons = dpad_as_buttons;
if (attachment->dpad_as_buttons) {
input_set_capability(input, EV_KEY, BTN_DPAD_UP);
@@ -193,6 +198,11 @@ static int gip_handle_navigation_report(struct gip_attachment *attachment,
input_report_key(input, BTN_TR, bytes[1] & BIT(5));
}
+ if (attachment->quirks & GIP_QUIRK_FORCE_GAMEPAD_SB) {
+ input_report_key(input, BTN_THUMBL, bytes[1] & BIT(6));
+ input_report_key(input, BTN_THUMBR, bytes[1] & BIT(7));
+ }
+
return 0;
}
diff --git a/drivers/input/joystick/gip/gip-wheel.c b/drivers/input/joystick/gip/gip-wheel.c
new file mode 100644
index 000000000000..5de455edff3c
--- /dev/null
+++ b/drivers/input/joystick/gip/gip-wheel.c
@@ -0,0 +1,350 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+/*
+ * Drivers for GIP racing wheel devices
+ *
+ * Copyright (c) 2025 Valve Software
+ *
+ * This driver is based on the Microsoft GIP spec at:
+ * https://aka.ms/gipdocs
+ * https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-gipusb/e7c90904-5e21-426e-b9ad-d82adeee0dbc
+ */
+
+#include <linux/unaligned.h>
+#include "gip.h"
+
+#define GIP_QUIRK_WHEEL_FORCE_HANDBRAKE BIT(31)
+
+/* Wheel vendor messages */
+#define GIP_CMD_SET_APPLICATION_MEMORY 0x0b
+#define GIP_CMD_SET_EQUATIONS_STATES 0x0c
+#define GIP_CMD_SET_EQUATION 0x0d
+
+/* Wheel-specific flags */
+#define GIP_WHEEL_HAS_POWER BIT(3)
+#define GIP_WHEEL_HANDBRAKE_CONN BIT(4)
+#define GIP_WHEEL_CLUTCH_CONN BIT(5)
+#define GIP_WHEEL_BRAKE_CONN BIT(6)
+#define GIP_WHEEL_THROTTLE_CONN BIT(7)
+
+#define GIP_HSHIFTER_NONE 0
+#define GIP_HSHIFTER_2POS 1 /* 2 position, no neutral */
+#define GIP_HSHIFTER_2POS_N 2 /* 2 position, neutral */
+#define GIP_HSHIFTER_RTL_1TL 3 /* Reverse top left, first top left */
+#define GIP_HSHIFTER_RTL_1BL 4 /* Reverse top left, first bottom left */
+#define GIP_HSHIFTER_RBL 5 /* Reverse bottom left */
+#define GIP_HSHIFTER_RTR 6 /* Reverse top right */
+#define GIP_HSHIFTER_RBR 7 /* Reverse bottom right */
+
+struct gip_wheel_info {
+ uint8_t shifter_type: 3;
+ uint8_t max_gear: 5;
+ uint16_t angle_setting;
+ uint16_t max_angle;
+ uint16_t max_throttle;
+ uint16_t max_brake;
+ uint16_t max_clutch;
+ uint8_t max_handbrake;
+ int8_t value_retries;
+};
+
+struct gip_initial_reports_request {
+ uint8_t type;
+ uint8_t data[2];
+};
+
+static int gip_wheel_probe(struct gip_attachment *attachment)
+{
+ struct gip_wheel_info *info = kzalloc(sizeof(*info), GFP_KERNEL);
+
+ if (!info)
+ return -ENOMEM;
+ attachment->driver_data = info;
+
+ return 0;
+}
+
+static void gip_wheel_remove(struct gip_attachment *attachment)
+{
+ kfree(attachment->driver_data);
+ attachment->driver_data = NULL;
+}
+
+static int gip_wheel_init(struct gip_attachment *attachment)
+{
+ struct gip_initial_reports_request request = { 0 };
+ int rc = gip_send_vendor_message(attachment,
+ GIP_CMD_INITIAL_REPORTS_REQUEST, 0, &request,
+ sizeof(request));
+
+ if (rc < 0)
+ return rc;
+
+ return GIP_INIT_NO_INPUT;
+}
+
+static int gip_setup_wheel_input(struct gip_attachment *attachment, struct input_dev *input)
+{
+ int rc = gip_driver_navigation.setup_input(attachment, input);
+ struct gip_wheel_info *info = attachment->driver_data;
+
+ if (rc < 0)
+ return rc;
+
+ if (!info)
+ return -ENODEV;
+
+ input_set_abs_params(input, ABS_WHEEL, -info->max_angle - 1, info->max_angle, 0, 0);
+ input_abs_set_res(input, ABS_WHEEL, info->angle_setting);
+ if (info->max_throttle)
+ input_set_abs_params(input, ABS_GAS, 0, info->max_throttle, 0, 0);
+
+ if (info->max_brake)
+ input_set_abs_params(input, ABS_BRAKE, 0, info->max_brake, 0, 0);
+
+ if (info->max_clutch)
+ input_set_abs_params(input, ABS_CLUTCH, 0, info->max_clutch, 0, 0);
+
+ if (info->max_handbrake)
+ input_set_abs_params(input, ABS_HANDBRAKE, 0, info->max_handbrake, 0, 0);
+
+ if (info->shifter_type)
+ input_set_abs_params(input, ABS_SHIFTER, -1, info->max_gear, 0, 0);
+
+ return 0;
+}
+
+static int gip_handle_wheel_ll_input_report(struct gip_attachment *attachment,
+ const struct gip_header *header, const uint8_t *bytes, int num_bytes)
+{
+ int rc = 0;
+ struct gip_wheel_info *info = attachment->driver_data;
+
+ if (num_bytes < 17)
+ return -EINVAL;
+
+ if (!info)
+ return -ENODEV;
+
+ info->max_gear = bytes[11] & 0x1F;
+ info->shifter_type = bytes[11] >> 5;
+ info->angle_setting = get_unaligned_le16(&bytes[13]);
+
+ gip_dbg(attachment,
+ "Racing wheel with %u max gear, %u degree rotation\n",
+ info->max_gear, info->angle_setting);
+
+ if (info->angle_setting && info->max_angle) {
+ if (info->value_retries-- > 0)
+ return 0;
+
+ rc = gip_setup_input_device(attachment);
+ } else {
+ return 0;
+ }
+
+ if (rc < 0)
+ return rc;
+
+ /* Now that we're done configuring, fall back to default handler */
+ attachment->vendor_handlers[GIP_LL_INPUT_REPORT] = NULL;
+
+ return 0;
+}
+
+static int gip_handle_wheel_report(struct gip_attachment *attachment,
+ struct input_dev *input, const uint8_t *bytes, int num_bytes)
+{
+ uint8_t connections;
+ struct gip_wheel_info *info = attachment->driver_data;
+ int rc = gip_driver_navigation.handle_input_report(attachment, input, bytes, num_bytes);
+
+ if (rc < 0)
+ return rc;
+
+ if (!info)
+ return -ENODEV;
+
+ if (num_bytes < 17)
+ return -EINVAL;
+
+ input_report_abs(input, ABS_WHEEL, get_unaligned_le16(&bytes[2]) - info->max_angle - 1);
+
+ connections = bytes[16];
+
+ if (attachment->quirks & GIP_QUIRK_WHEEL_FORCE_HANDBRAKE)
+ connections |= GIP_WHEEL_HANDBRAKE_CONN;
+
+ if (connections & GIP_WHEEL_THROTTLE_CONN)
+ input_report_abs(input, ABS_GAS, get_unaligned_le16(&bytes[4]));
+ else
+ input_report_abs(input, ABS_GAS, 0);
+
+ if (connections & GIP_WHEEL_BRAKE_CONN)
+ input_report_abs(input, ABS_BRAKE, get_unaligned_le16(&bytes[6]));
+ else
+ input_report_abs(input, ABS_BRAKE, 0);
+
+ if (connections & GIP_WHEEL_CLUTCH_CONN)
+ input_report_abs(input, ABS_CLUTCH, get_unaligned_le16(&bytes[8]));
+ else
+ input_report_abs(input, ABS_CLUTCH, 0);
+
+ if (connections & GIP_WHEEL_HANDBRAKE_CONN)
+ input_report_abs(input, ABS_HANDBRAKE, bytes[10]);
+ else
+ input_report_abs(input, ABS_HANDBRAKE, 0);
+
+ if (info->shifter_type)
+ input_report_abs(input, ABS_SHIFTER, (int8_t)bytes[12]);
+
+ return 0;
+}
+
+static int gip_handle_wheel_ll_static_configuration(struct gip_attachment *attachment,
+ const struct gip_header *header, const uint8_t *bytes, int num_bytes)
+{
+ struct gip_wheel_info *info = attachment->driver_data;
+
+ if (!info)
+ return -ENODEV;
+
+ if (num_bytes < 11)
+ return -EINVAL;
+
+ info->max_angle = BIT(min(bytes[0], 16)) / 2 - 1;
+ info->max_throttle = BIT(min(bytes[1], 16)) - 1;
+ info->max_brake = BIT(min(bytes[2], 16)) - 1;
+ info->max_clutch = BIT(min(bytes[3], 16)) - 1;
+ info->max_handbrake = BIT(min(bytes[4], 8)) - 1;
+
+ gip_dbg(attachment,
+ "Racing wheel with precision: %u bits angle, %u bits throttle, %u bits brake,\n",
+ bytes[0], bytes[1], bytes[2]);
+ gip_dbg(attachment,
+ "%u bits clutch, %u bits handbrake\n", bytes[3], bytes[4]);
+
+ if (info->angle_setting && info->max_angle && info->value_retries <= 0)
+ return gip_setup_input_device(attachment);
+
+ return 0;
+}
+
+const struct gip_driver gip_driver_wheel = {
+ .types = (const char* const[]) {
+ "Windows.Xbox.Input.Wheel",
+ "Microsoft.Xbox.Input.Wheel",
+ NULL
+ },
+ .guid = GUID_INIT(0x646979cf, 0x6b71, 0x4e96, 0x8d, 0xf9,
+ 0x59, 0xe3, 0x98, 0xd7, 0x42, 0x0c),
+
+ .quirks = (const struct gip_quirks[]) {
+ /* Thrustmaster T128X GIP Racing Wheel */
+ { GIP_VID_THRUSTMASTER, GIP_PID_THRUSTMASTER_T128X, 0,
+ .quirks = GIP_QUIRK_FORCE_GAMEPAD_SB | GIP_QUIRK_WHEEL_FORCE_HANDBRAKE, },
+
+ {0},
+ },
+
+ .probe = gip_wheel_probe,
+ .remove = gip_wheel_remove,
+ .init = gip_wheel_init,
+ .setup_input = gip_setup_wheel_input,
+ .handle_input_report = gip_handle_wheel_report,
+ .vendor_handlers = {
+ [GIP_LL_INPUT_REPORT] = gip_handle_wheel_ll_input_report,
+ [GIP_LL_STATIC_CONFIGURATION] = gip_handle_wheel_ll_static_configuration,
+ },
+};
+
+struct gip_trueforce_wheel_state {
+ struct gip_wheel_info wheel_info; /* This field must be first for type punning */
+ int8_t dial;
+};
+
+static int gip_trueforce_wheel_probe(struct gip_attachment *attachment)
+{
+ struct gip_trueforce_wheel_state *state = kzalloc(sizeof(*state), GFP_KERNEL);
+
+ if (!state)
+ return -ENOMEM;
+ attachment->driver_data = state;
+ /* The shifter won't show in the first few input reports */
+ state->wheel_info.value_retries = 3;
+
+ return 0;
+}
+
+static void gip_trueforce_wheel_remove(struct gip_attachment *attachment)
+{
+ kfree(attachment->driver_data);
+ attachment->driver_data = NULL;
+}
+
+static int gip_setup_trueforce_wheel_input(struct gip_attachment *attachment,
+ struct input_dev *input)
+{
+ int rc = gip_driver_wheel.setup_input(attachment, input);
+
+ if (rc < 0)
+ return rc;
+
+ input_set_capability(input, EV_KEY, BTN_THUMBL);
+ input_set_capability(input, EV_KEY, BTN_THUMBR);
+ input_set_capability(input, EV_KEY, KEY_KPPLUS);
+ input_set_capability(input, EV_KEY, KEY_KPMINUS);
+ input_set_capability(input, EV_KEY, KEY_KPENTER);
+ input_set_capability(input, EV_REL, REL_DIAL);
+
+ return 0;
+}
+
+static int gip_handle_trueforce_wheel_report(struct gip_attachment *attachment,
+ struct input_dev *input, const uint8_t *bytes, int num_bytes)
+{
+ int rc = gip_driver_wheel.handle_input_report(attachment, input, bytes, num_bytes);
+ struct gip_trueforce_wheel_state *state = attachment->driver_data;
+ int dial;
+
+ if (rc < 0)
+ return rc;
+
+ if (num_bytes < 18)
+ return -EINVAL;
+
+ dial = bytes[17] >> 5;
+
+ input_report_key(input, BTN_THUMBL, bytes[17] & BIT(0));
+ input_report_key(input, BTN_THUMBR, bytes[17] & BIT(1));
+ input_report_key(input, KEY_KPPLUS, bytes[17] & BIT(2));
+ input_report_key(input, KEY_KPMINUS, bytes[17] & BIT(3));
+ input_report_key(input, KEY_KPENTER, bytes[17] & BIT(4));
+ /* Dial states only change one at a time, so we can easily check for wraparound */
+ if (dial == 0 && state->dial == 7)
+ input_report_rel(input, REL_DIAL, -1);
+ else if (dial == 7 && state->dial == 0)
+ input_report_rel(input, REL_DIAL, 1);
+ else
+ input_report_rel(input, REL_DIAL,
+ state->dial - dial);
+ state->dial = dial;
+
+ return 0;
+}
+
+const struct gip_driver gip_driver_trueforce_wheel = {
+ .types = (const char *const[]) { "Logi.Xbox.Input.TrueForceWheel", NULL },
+ .guid = GUID_INIT(0x6ca319e5, 0x0bc0, 0x41be, 0x83, 0x19,
+ 0x6b, 0xb7, 0x10, 0x81, 0xec, 0x55),
+
+ .probe = gip_trueforce_wheel_probe,
+ .remove = gip_trueforce_wheel_remove,
+ .init = gip_wheel_init,
+ .setup_input = gip_setup_trueforce_wheel_input,
+ .handle_input_report = gip_handle_trueforce_wheel_report,
+ .vendor_handlers = {
+ [GIP_LL_INPUT_REPORT] = gip_handle_wheel_ll_input_report,
+ [GIP_LL_STATIC_CONFIGURATION] = gip_handle_wheel_ll_static_configuration,
+ },
+};
+
diff --git a/drivers/input/joystick/gip/gip.h b/drivers/input/joystick/gip/gip.h
index 3a35bcc43927..d488fad5463f 100644
--- a/drivers/input/joystick/gip/gip.h
+++ b/drivers/input/joystick/gip/gip.h
@@ -28,10 +28,13 @@
#define MAX_OUT_MESSAGES 8
#define MAX_OUT_FRAGMENTS 2
+#define GIP_VID_THRUSTMASTER 0x044f
#define GIP_VID_MICROSOFT 0x045e
#define GIP_VID_PDP 0x0e6f
#define GIP_VID_BDA 0x24c6
+#define GIP_PID_THRUSTMASTER_T128X 0xb69c
+
#define GIP_PID_XBOX_ONE_1573 0x02d1
#define GIP_PID_XBOX_ONE_1697 0x02dd
#define GIP_PID_XBOX_ELITE 0x02e3
@@ -50,6 +53,7 @@
#define GIP_QUIRK_NO_IMPULSE_VIBRATION BIT(1)
#define GIP_QUIRK_SWAP_LB_RB BIT(2)
#define GIP_QUIRK_SKIP_SECURITY BIT(3)
+#define GIP_QUIRK_FORCE_GAMEPAD_SB BIT(4)
/*
* Driver-specific quirks should start from 31 and go downwards to avoid
* conflicts with newly-added core quirks
@@ -425,4 +429,6 @@ extern const struct gip_driver gip_driver_navigation;
extern const struct gip_driver gip_driver_gamepad;
extern const struct gip_driver gip_driver_arcade_stick;
extern const struct gip_driver gip_driver_pdp_jaguar;
+extern const struct gip_driver gip_driver_wheel;
+extern const struct gip_driver gip_driver_trueforce_wheel;
#endif
--
2.54.0
^ permalink raw reply related [flat|nested] 23+ messages in thread
* Re: [PATCH v6 02/12] Input: xpad - Remove Xbox One support
2026-09-08 3:21 ` [PATCH v6 02/12] Input: xpad - Remove Xbox One support Vicki Pfau
@ 2026-09-08 3:34 ` sashiko-bot
0 siblings, 0 replies; 23+ messages in thread
From: sashiko-bot @ 2026-09-08 3:34 UTC (permalink / raw)
To: Vicki Pfau; +Cc: linux-input, dmitry.torokhov
Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:
- [Low] The `flags` field in `struct xpad_device` is now unused and should be removed.
- [Low] Documentation Typo: 'Protocl' instead of 'Protocol'.
--
commit 30879d88695dc1f5b4aa4e33ed67c80e554e4b56
Author: Vicki Pfau <vi@endrift.com>
Input: xpad - Remove Xbox One support
This commit removes Xbox One controller support from the xpad driver.
It notes that this functionality is fully superseded by the xbox_gip driver,
which specializes in the Xbox One Gaming Input Protocol.
> diff --git a/Documentation/input/devices/xpad.rst b/Documentation/input/devices/xpad.rst
> index a480bc781565e..fd2afdd7b4059 100644
> --- a/Documentation/input/devices/xpad.rst
> +++ b/Documentation/input/devices/xpad.rst
> @@ -2,19 +2,19 @@
> xpad - Linux USB driver for Xbox compatible controllers
> =======================================================
>
> -This driver exposes all first-party and third-party Xbox compatible
> -controllers. It has a long history and has enjoyed considerable usage
> -as Windows' xinput library caused most PC games to focus on Xbox
> -controller compatibility.
> +This driver exposes all first-party and third-party Xbox and Xbox 360
> +compatible controllers. It has a long history and has enjoyed considerable
> +usage as Windows' xinput library caused most PC games to focus on Xbox
> +controller compatibility. Xbox One/Series controller support has been
> +superseded by the xbox_gip driver, which specializes in the Gaming Input
> +Protocl that is introduced on the Xbox One.
[Severity: Low]
This isn't a bug, but there's a typo in the documentation: Protocl instead of
Protocol.
> diff --git a/drivers/input/joystick/xpad.c b/drivers/input/joystick/xpad.c
> index feb8f368f834e..206007e0cafb6 100644
> --- a/drivers/input/joystick/xpad.c
> +++ b/drivers/input/joystick/xpad.c
[ ... ]
> @@ -2080,18 +1462,13 @@ static int xpad_probe(struct usb_interface *intf, const struct usb_device_id *id
> xpad->mapping = xpad_device[i].mapping;
> xpad->xtype = xpad_device[i].xtype;
> xpad->name = xpad_device[i].name;
> - if (xpad_device[i].flags & FLAG_DELAY_INIT)
> - xpad->delay_init = true;
>
> - xpad->packet_type = PKT_XB;
> INIT_WORK(&xpad->work, xpad_presence_work);
[Severity: Low]
Since the only flag (FLAG_DELAY_INIT) and its usage here in xpad_probe() have
been removed, is it intended to leave the flags field inside the definition
of struct xpad_device?
--
Sashiko AI review · https://sashiko.dev/#/patchset/20260908032145.2118234-1-vi@endrift.com?part=2
^ permalink raw reply [flat|nested] 23+ messages in thread
* Re: [PATCH v6 08/12] Input: xbox_gip - Add arcade stick support
2026-09-08 3:21 ` [PATCH v6 08/12] Input: xbox_gip - Add arcade stick support Vicki Pfau
@ 2026-09-08 3:35 ` sashiko-bot
0 siblings, 0 replies; 23+ messages in thread
From: sashiko-bot @ 2026-09-08 3:35 UTC (permalink / raw)
To: Vicki Pfau; +Cc: dmitry.torokhov, linux-input
Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] The `gip_handle_arcade_stick_report` function returns `-EINVAL` on short packets after successfully reporting key events, bypassing `input_sync()`.
--
commit 52729645cd0e478b1045c3e2e7b193ab5b91d1c7
Author: Vicki Pfau <vi@endrift.com>
Input: xbox_gip - Add arcade stick support
This adds support for the arcade stick device type. Currently I'm only
aware of one Xbox controller that uses this device type, the Razer Atrox,
so testing coverage is limited.
> diff --git a/drivers/input/joystick/gip/gip-arcade-stick.c b/drivers/input/joystick/gip/gip-arcade-stick.c
> new file mode 100644
> index 0000000000000..11ededfab8555
> --- /dev/null
> +++ b/drivers/input/joystick/gip/gip-arcade-stick.c
[ ... ]
> +static int gip_handle_arcade_stick_report(struct gip_attachment *attachment,
> + struct input_dev *input, const uint8_t *bytes, int num_bytes)
> +{
> + struct gip_arcade_stick_info *info = attachment->driver_data;
> + int rc;
> +
> + if (!info)
> + return -ENODEV;
> +
> + rc = gip_driver_navigation.handle_input_report(attachment, input, bytes, num_bytes);
> + if (rc < 0)
> + return rc;
> +
> + if (num_bytes < 6) {
> + gip_dbg(attachment, "Discarding too-short input report\n");
> + return -EINVAL;
> + }
[Severity: Medium]
If the input report packet is between 2 and 5 bytes long, does this sequence
skip the required input_sync() call?
gip_driver_navigation.handle_input_report() will successfully process the
first few bytes and queue key events. Returning -EINVAL here propagates the
error to the caller, which then aborts and skips the input_sync() call for
the already queued events.
Should the size check for num_bytes < 6 be performed before delegating to
the navigation driver to prevent leaving unsynchronized events in the input
core?
--
Sashiko AI review · https://sashiko.dev/#/patchset/20260908032145.2118234-1-vi@endrift.com?part=8
^ permalink raw reply [flat|nested] 23+ messages in thread
* Re: [PATCH v6 05/12] Input: xbox_gip - Add battery support
2026-09-08 3:21 ` [PATCH v6 05/12] Input: xbox_gip - Add battery support Vicki Pfau
@ 2026-09-08 3:38 ` sashiko-bot
0 siblings, 0 replies; 23+ messages in thread
From: sashiko-bot @ 2026-09-08 3:38 UTC (permalink / raw)
To: Vicki Pfau; +Cc: linux-input, dmitry.torokhov
Thank you for your contribution! Sashiko AI review found 3 potential issue(s) to consider:
New issues:
- [High] Attaching power_supply devres to the input_dev creates a Use-After-Free due to lifecycle mismatch.
Pre-existing issues:
- [High] Preexisting Use-After-Free in LED registration due to lifecycle mismatch with input_dev.
- [High] Improper cleanup ordering in gip_disconnect allows receive_message work to run after structures are freed.
--
commit fc70d38900f23e7e70d19f7c2913e3ee24cac40d
Author: Vicki Pfau <vi@endrift.com>
Input: xbox_gip - Add battery support
Controllers are required to give information about the battery in the
controller, if present. This patch exposes that information as a
power_supply device.
> diff --git a/drivers/input/joystick/gip/gip-core.c b/drivers/input/joystick/gip/gip-core.c
> index dc174560ee49f..568877a4ce4b4 100644
> --- a/drivers/input/joystick/gip/gip-core.c
> +++ b/drivers/input/joystick/gip/gip-core.c
[ ... ]
> @@ -1206,6 +1213,97 @@ static int gip_guide_led_probe(struct gip_attachment *attachment, struct device
> return rc;
> }
>
> +static int gip_battery_create(struct gip_attachment *attachment, struct device *dev)
> +{
> + struct power_supply_config supply_config = { .drv_data = attachment, };
> + int rc;
> +
> + attachment->battery_desc.properties = gip_battery_props;
> + attachment->battery_desc.num_properties = ARRAY_SIZE(gip_battery_props);
> + attachment->battery_desc.get_property = gip_battery_get_property;
> + attachment->battery_desc.type = POWER_SUPPLY_TYPE_BATTERY;
> + attachment->battery_desc.name = devm_kasprintf(dev, GFP_KERNEL, "gip-%s", dev_name(dev));
> +
> + if (!attachment->battery_desc.name)
> + return -ENOMEM;
> +
> + attachment->battery = devm_power_supply_register(dev,
> + &attachment->battery_desc, &supply_config);
[Severity: High]
Does registering the power supply against the refcounted input_dev create a
use-after-free risk?
Because input_dev is refcounted (e.g. via evdev), its destruction can be
delayed by a user holding an open file descriptor. However, the attachment
structure (passed as driver data) is freed synchronously upon device
disconnect.
If the device is unplugged, attachment is freed, but the power supply remains
registered until input_dev is closed. Reading the battery sysfs files during
this window will dereference the freed attachment.
> + if (IS_ERR(attachment->battery)) {
> + rc = PTR_ERR(attachment->battery);
> + attachment->battery = NULL;
> + devm_kfree(dev, attachment->battery_desc.name);
> + return rc;
> + }
> +
> + power_supply_powers(attachment->battery, dev);
> + return 0;
> +}
[ ... ]
> @@ -1319,6 +1417,9 @@ static int gip_setup_input_device(struct gip_attachment *attachment)
> rc = gip_guide_led_probe(attachment, &input->dev);
[Severity: High]
This is a pre-existing issue, but does registering the LED devices against
input->dev create a similar use-after-free risk?
In gip_guide_led_probe() in drivers/input/joystick/gip/gip-core.c,
devm_led_classdev_register() (and the multicolor variant) use input->dev as
the devres parent. Like the battery, the LED class devices will remain
registered as long as the input_dev exists.
Since the underlying attachment structure is freed upon unplug, this results
in a use-after-free when sysfs LED attributes are read or written after
disconnection.
> if (rc)
> gip_err(attachment, "Failed to register LEDs: %d\n", rc);
> + rc = gip_battery_create(attachment, &input->dev);
> + if (rc)
> + gip_err(attachment, "Failed to register battery: %d\n", rc);
>
> return 0;
[Severity: High]
This isn't a bug introduced by this patch, but could the cleanup ordering in
gip_disconnect() allow the receive_message work to run after the gip structure
is freed?
gip_disconnect() in drivers/input/joystick/gip/gip-core.c calls gip_shutdown()
(which does cancel_work_sync(&device->receive_message)) before it calls
usb_kill_urb(gip->data.urb_in):
drivers/input/joystick/gip/gip-core.c:gip_disconnect() {
...
gip_shutdown(gip);
...
usb_kill_urb(gip->data.urb_in);
...
}
If a USB completion interrupt arrives between cancel_work_sync() and
usb_kill_urb(), gip_urb_in() will execute with a success status and put the
work back on the queue:
drivers/input/joystick/gip/gip-core.c:gip_urb_in() {
...
schedule_work(&gip->receive_message);
...
}
gip_disconnect() then frees the gip structure. When the workqueue runs, it
will dereference the freed gip pointer. Can we reverse the order to cancel the
work after killing the URBs?
--
Sashiko AI review · https://sashiko.dev/#/patchset/20260908032145.2118234-1-vi@endrift.com?part=5
^ permalink raw reply [flat|nested] 23+ messages in thread
* Re: [PATCH v6 07/12] Input: xbox_gip - Add security implementation from xone
2026-09-08 3:21 ` [PATCH v6 07/12] Input: xbox_gip - Add security implementation from xone Vicki Pfau
@ 2026-09-08 3:38 ` sashiko-bot
0 siblings, 0 replies; 23+ messages in thread
From: sashiko-bot @ 2026-09-08 3:38 UTC (permalink / raw)
To: Vicki Pfau; +Cc: linux-input, dmitry.torokhov
Thank you for your contribution! Sashiko AI review found 6 potential issue(s) to consider:
New issues:
- [High] Asynchronous cancellation of security workers leads to Use-After-Free on disconnect. A naive synchronous fix would cause a deadlock.
- [High] The security transcript incorrectly hashes USB transport padding for unfragmented messages, causing handshake failures.
- [Medium] Unselectable Kconfig dependency on hidden symbol CRYPTO_LIB_SHA256.
- [Medium] Out-of-bounds read when processing unexpectedly short security messages.
- [Medium] Sensitive cryptographic secrets are not cleared from stack and heap memory.
Pre-existing issues:
- [High] Preexisting Use-After-Free in out_fragment timeout handlers due to missing synchronous cancellation.
--
commit e5c6e1be1aac0ee61bba5f91bea05c7f0f89796f
Author: Vicki Pfau <vi@endrift.com>
Input: xbox_gip - Add security implementation from xone
This patch imports and adapts the security message implementation from the
out-of-tree xone driver. This message is necessary for most controllers that
use wireless dongles.
> diff --git a/drivers/input/joystick/gip/Kconfig b/drivers/input/joystick/gip/Kconfig
> --- a/drivers/input/joystick/gip/Kconfig
> +++ b/drivers/input/joystick/gip/Kconfig
> @@ -5,6 +5,7 @@
> config JOYSTICK_XBOX_GIP
> tristate "Xbox One/Series controller support"
> depends on USB && USB_ARCH_HAS_HCD && LEDS_CLASS_MULTICOLOR
> + depends on CRYPTO_ECDH && CRYPTO_LIB_SHA256 && CRYPTO_RSA
[Severity: Medium]
Is depends on CRYPTO_LIB_SHA256 intentional here?
CRYPTO_LIB_SHA256 is a hidden tristate symbol without a prompt, meaning users
won't be able to select JOYSTICK_XBOX_GIP via menuconfig unless another
driver accidentally selects CRYPTO_LIB_SHA256 first.
Should this use select CRYPTO_LIB_SHA256 instead?
[ ... ]
> diff --git a/drivers/input/joystick/gip/gip-core.c b/drivers/input/joystick/gip/gip-core.c
> --- a/drivers/input/joystick/gip/gip-core.c
> +++ b/drivers/input/joystick/gip/gip-core.c
[ ... ]
> @@ -1932,7 +1922,6 @@ static void gip_reset_attachment(struct gip_attachment *attachment)
> }
>
> gip_free_devices(attachment);
> -
> }
[Severity: High]
This is a pre-existing issue, but I noticed a potential use-after-free
involving out_fragments during shutdown.
When the controller is unplugged, the teardown path calls
gip_reset_attachment(), which loops through out_fragments and calls
gip_free_fragment(). However, gip_free_fragment() uses the non-blocking
cancel_delayed_work().
If the out_fragment timeout worker is running, it will block on
guard(mutex)(&attachment->lock). After the disconnect path finishes and
frees the attachment, the worker could unblock and access the freed memory.
[ ... ]
> diff --git a/drivers/input/joystick/gip/gip-security.c b/drivers/input/joystick/gip/gip-security.c
> --- /dev/null
> +++ b/drivers/input/joystick/gip/gip-security.c
[ ... ]
> +static void gip_security2_exchange_ecdh(struct work_struct *work)
> +{
> + struct gip_security *security = container_of(work, typeof(*security), work_exchange_ecdh);
> + struct gip_attachment *attachment = container_of(security, struct gip_attachment, security);
> + struct gip_security2_host_pubkey message = {};
> + u8 random[GIP_SECURITY_RANDOM_LEN * 2];
> + u8 secret[GIP_SECURITY2_SECRET_LEN];
[Severity: Medium]
Does this leave the derived hashed ECDH shared secret on the stack?
The 32-byte secret is allocated here but never explicitly cleared with
memzero_explicit() before the function returns.
> + int err;
> +
> + guard(mutex)(&attachment->lock);
[Severity: High]
Can this lock acquisition cause a use-after-free if the controller is
disconnected during a handshake?
When gip_disconnect() triggers shutdown, it acquires attachment->lock and
calls gip_security_release(), which uses the non-blocking cancel_work() on
these security workers.
If this worker is running, it blocks here. After the teardown path completes
and frees the attachment via devm_kfree(), this worker would unblock and
access the freed memory. (Note that simply switching to cancel_work_sync() in
gip_security_release() while holding the mutex might deadlock).
[ ... ]
> +int gip_security_handle_message(struct gip_security *security, const void *bytes, int num_bytes)
> +{
> + const struct gip_security_header_handshake *handshake = bytes;
> + const struct gip_security_header_full *hdr;
> + int err;
> +
> + if (security->status != GIP_SECURITY_SENT) {
> + gip_err(security, "%s: security message received when none expected: 0x%02x\n",
> + __func__, handshake->command);
[Severity: Medium]
Could this dereference handshake->command out-of-bounds?
We haven't verified that the payload length num_bytes is at least
sizeof(*handshake) before trying to read the command field for this error
message.
A malformed USB message might cause an out-of-bounds read and information
disclosure in the kernel log.
> + return -EPROTO;
> + }
> +
> + if (num_bytes < sizeof(*handshake))
> + return -EINVAL;
> +
[ ... ]
> + err = gip_security_dispatch_message(security, hdr->data.command,
> + bytes + sizeof(*hdr), num_bytes - sizeof(*hdr));
> + if (err)
> + return err;
> +
> + sha256_update(&security->transcript, bytes + sizeof(hdr->handshake),
> + num_bytes - sizeof(hdr->handshake));
[Severity: High]
Does the transcript hash include trailing padding bytes?
The core receive path in gip_receive_message() passes num_bytes (the full
USB packet length minus header offset) to gip_handle_message() without
truncating it to header.length.
If the USB host controller pads the interrupt transfer packet, these trailing
padding bytes will be included in the sha256_update() call here, causing the
handshake to fail.
[ ... ]
> +void gip_security_release(struct gip_security *security)
> +{
> + if (security->status < GIP_SECURITY_SENT)
> + return;
> +
> + cancel_work(&security->work_exchange_rsa);
> + cancel_work(&security->work_exchange_ecdh);
> + cancel_work(&security->work_complete);
> +
> + memzero_explicit(&security->transcript, sizeof(security->transcript));
[Severity: Medium]
While the transcript is explicitly cleared here, should we also zero out the
long-term session keys (security->pms and security->master_secret)?
Leaving these on the heap could lead to a leak of cryptographic secrets if
combined with an out-of-bounds read vulnerability.
> +
> + security->status = GIP_SECURITY_PENDING;
> +}
--
Sashiko AI review · https://sashiko.dev/#/patchset/20260908032145.2118234-1-vi@endrift.com?part=7
^ permalink raw reply [flat|nested] 23+ messages in thread
* Re: [PATCH v6 03/12] Input: xbox_gip - Add controllable LED support
2026-09-08 3:21 ` [PATCH v6 03/12] Input: xbox_gip - Add controllable LED support Vicki Pfau
@ 2026-09-08 3:39 ` sashiko-bot
0 siblings, 0 replies; 23+ messages in thread
From: sashiko-bot @ 2026-09-08 3:39 UTC (permalink / raw)
To: Vicki Pfau; +Cc: linux-input, dmitry.torokhov
Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:
New issues:
- [High] Registering a managed LED classdev against an input device creates a circular dependency, leading to memory leaks, list corruption, and kernel crashes on device reconnect.
Pre-existing issues:
- [High] Repeatedly calling `devm_input_allocate_device()` against the USB interface without unbinding leaks `input_dev` structures on every device reconnect.
--
commit 170b2e9725cebf9b1d26ed7fb1bf1a2b52d452c6
Author: Vicki Pfau <vi@endrift.com>
Input: xbox_gip - Add controllable LED support
This commit adds controllable LED support for Xbox One controllers. It exposes
both monochrome white and RGBW addressable LEDs as led class devices depending
on the controller capabilities.
> diff --git a/drivers/input/joystick/gip/gip.h b/drivers/input/joystick/gip/gip.h
> index 605149834269f..69eef001d91ff 100644
> --- a/drivers/input/joystick/gip/gip.h
> +++ b/drivers/input/joystick/gip/gip.h
> @@ -234,6 +235,10 @@ struct gip_attachment {
> uint8_t seq_vendor;
>
> uint8_t device_state;
> + union {
> + struct led_classdev standard;
> + struct led_classdev_mc color;
> + } guide_led;
[Severity: High]
Does embedding the led_classdev directly inside the long-lived
gip_attachment structure risk list corruption?
If the input device is reset and re-probed (for example, via a reset
message), the driver recreates the device and could call
devm_led_classdev_register() again on the exact same already-registered
led_classdev struct. This would corrupt the global leds_list and cause a
kernel crash.
> diff --git a/drivers/input/joystick/gip/gip-core.c b/drivers/input/joystick/gip/gip-core.c
> index 0e23811a6ecc1..a5ed5f3bf3fed 100644
> --- a/drivers/input/joystick/gip/gip-core.c
> +++ b/drivers/input/joystick/gip/gip-core.c
[ ... ]
> +static int gip_guide_led_probe(struct gip_attachment *attachment, struct device *dev)
> +{
[ ... ]
> + if (!rc)
> + rc = devm_led_classdev_multicolor_register(dev,
> + mc_cdev);
[Severity: High]
Can this create a circular dependency?
By using devm_led_classdev_multicolor_register() in gip_guide_led_probe()
with the input_dev as the parent device, the LED child device takes a
reference to the input_dev. Since input_dev devres actions only execute when
its reference count drops to zero, the LED device is never automatically
unregistered, creating a circular reference and leaking memory.
[ ... ]
> + } else {
> + struct led_classdev *cdev = &attachment->guide_led.standard;
[ ... ]
> + rc = devm_led_classdev_register(dev, cdev);
[Severity: High]
Similarly, does registering the standard LED classdev against the input device
here create the same circular dependency preventing automatic unregistration?
[ ... ]
> @@ -1157,6 +1268,10 @@ static int gip_setup_input_device(struct gip_attachment *attachment)
> if (rc)
> goto err_free_device;
>
> + rc = gip_guide_led_probe(attachment, &input->dev);
> + if (rc)
> + gip_err(attachment, "Failed to register LEDs: %d\n", rc);
> +
> return 0;
[Severity: High]
This isn't a bug introduced by this patch, but does the allocation of the
input device earlier in gip_setup_input_device() leak input_dev structures on
every reconnect?
The code uses devm_input_allocate_device() with the long-lived USB interface
as the parent. When the controller resets (by sending a reset packet),
the driver correctly calls input_unregister_device(), but the devm free action
remains attached to the USB interface's devres list. A new input_dev is then
allocated for the re-initialization, leaking an entire input_dev structure
each time until the USB dongle is physically unplugged.
[Severity: High]
Also, if a controller reset causes gip_setup_input_device() to run again, does
calling gip_guide_led_probe() register the LEDs a second time without
ensuring the previous LED instances were unregistered?
Combined with embedding the led_classdev inside the attachment, this seems
like it would trigger list corruption.
--
Sashiko AI review · https://sashiko.dev/#/patchset/20260908032145.2118234-1-vi@endrift.com?part=3
^ permalink raw reply [flat|nested] 23+ messages in thread
* Re: [PATCH v6 06/12] Input: xbox_gip - Allow sending fragmented and ACME messages
2026-09-08 3:21 ` [PATCH v6 06/12] Input: xbox_gip - Allow sending fragmented and ACME messages Vicki Pfau
@ 2026-09-08 3:39 ` sashiko-bot
0 siblings, 0 replies; 23+ messages in thread
From: sashiko-bot @ 2026-09-08 3:39 UTC (permalink / raw)
To: Vicki Pfau; +Cc: linux-input, dmitry.torokhov
Thank you for your contribution! Sashiko AI review found 6 potential issue(s) to consider:
- [High] Missing synchronous cancellation of `out_fragments[i].timeout` during device shutdown leads to use-after-free.
- [High] Unprotected lockless access to `out_fragments` state causes data races, corruption, and potential Use-After-Free.
- [High] Infinite USB transmission loop if the first fragment of a message times out.
- [High] The `acked` field of `gip_out_fragment` is not cleared on slot reuse, breaking reliable retries.
- [Medium] Stale `has_pending_out` bit in error path causes concurrent chunk transmissions.
- [Low] Mixing `goto` error handling with `guard()` cleanup violates subsystem guidelines.
--
commit a080933dee9387ce07bf54626ee39a087371ba35
Author: Vicki Pfau <vi@endrift.com>
Subject: Input: xbox_gip - Allow sending fragmented and ACME messages
This patch implements support for sending fragmented messages and handling the
reliable transmission flow (ACME messages). It adds dynamic message allocation
slots and uses background delayed work to manage ACKs and retry timeouts.
Link: https://lkml.kernel.org/r/target-patch-link
> diff --git a/drivers/input/joystick/gip/gip-core.c b/drivers/input/joystick/gip/gip-core.c
> index 568877a4ce4b4..f61b5f18b819a 100644
> --- a/drivers/input/joystick/gip/gip-core.c
> +++ b/drivers/input/joystick/gip/gip-core.c
[ ... ]
> +static void gip_free_fragment(struct gip_out_fragment *fragment)
> +{
> + cancel_delayed_work(&fragment->timeout);
> + kfree(fragment->data);
> + fragment->data = NULL;
> + fragment->active = false;
> + fragment->message = 0;
> + fragment->flags = 0;
> + fragment->seq = 0;
> + fragment->retries = 0;
> + fragment->total_length = 0;
> + fragment->fragment_offset = 0;
> +}
[Severity: High]
Does this code leak the acked state to future messages?
When fragment slots are released, fragment->acked is not cleared here. If a
slot is later reused, it could inherit a stale true value, causing the
timeout retry logic to immediately skip resending lost packets.
[ ... ]
> + for (i = 0; i < MAX_OUT_FRAGMENTS; i++) {
> + if (attachment->out_fragments[i].active)
> + continue;
> +
> + fragment = &attachment->out_fragments[i];
> + break;
> + }
[Severity: High]
Is it safe to access out_fragments locklessly here?
gip_handle_command_protocol_control() also modifies these fields locklessly.
Scanning and claiming slots concurrently without acquiring attachment->lock
can lead to data races and duplicate slot allocations.
> +
> + if (!fragment) {
> + gip_err(attachment, "Fragmented message queue is full; dropping message\n");
> + return -EALREADY;
> + }
> +
> + fragment->data = kmalloc(num_bytes, GFP_KERNEL);
> + if (!fragment->data)
> + return -ENOMEM;
> + fragment->active = true;
> + fragment->message = message_type;
> + fragment->flags = flags & GIP_FLAG_SYSTEM;
> + fragment->seq = seq;
> + fragment->total_length = num_bytes;
> + fragment->fragment_offset = 0;
[Severity: High]
Should fragment->acked be explicitly set to false here?
Since gip_free_fragment() does not clear the acked flag, explicitly setting
it to false here would ensure the new message does not skip retry handling
if the previous message finished successfully.
[ ... ]
> guard(spinlock_irqsave)(&attachment->device->message_lock);
> for (i = 0; i < MAX_OUT_MESSAGES && !urb; i++) {
> if (!intf->out_queue[i].urb)
> continue;
> if (!intf->out_queue[i].urb->anchor)
> urb = &intf->out_queue[i];
> }
> if (!urb) {
> gip_err(attachment, "Output queue is full; dropping message\n");
> - return -ENOSPC;
> + rc = -ENOSPC;
> + goto err_free_fragment;
> }
[Severity: Low]
Is it permitted to mix goto error handling with guard() in this function?
The cleanup subsystem guidelines strictly mandate that functions must not mix
goto-based cleanup labels with guard() declarations, as it causes confusing
ownership semantics and resource leaks.
[ ... ]
> +err_free_fragment:
> + if (fragment)
> + gip_free_fragment(fragment);
> return rc;
> }
[Severity: Medium]
If usb_submit_urb() fails and we jump to err_free_fragment, does this leave a
stale bit in intf->has_pending_out?
If the has_pending_out bit was previously set from an intermediate chunk
submission, failing to clear it here leaves it active. When a new message
claims this slot, gip_send_fragment_work() could see the stale bit and
prematurely send the new message's second chunk.
[ ... ]
> +static int gip_send_next_fragment(struct gip_attachment *attachment,
> + struct gip_out_fragment *fragment)
> +{
[ ... ]
> + } else if (fragment->fragment_offset + mtu >= fragment->total_length) {
> + next_bytes = fragment->total_length - fragment->fragment_offset;
> + flags |= GIP_FLAG_ACME;
> + } else {
> + next_bytes = mtu;
> + }
[Severity: High]
How does this sequence handle retries for the first chunk?
If the first chunk of a fragmented message times out and this function
retries it, GIP_FLAG_ACME is not appended because it is not the final
fragment. This bypasses the reliable ACME timeout logic, which causes
the worker thread to immediately and repeatedly resend offset 0 without
waiting for ACKs, resulting in an infinite USB transmission loop.
[ ... ]
> static void gip_reset_attachment(struct gip_attachment *attachment)
> {
> + int i;
> + int pending_out_bits =
> + BIT((attachment->attachment_index + 1) * MAX_OUT_FRAGMENTS) -
> + BIT(attachment->attachment_index * MAX_OUT_FRAGMENTS);
> + unsigned long flags;
> +
> cancel_delayed_work(&attachment->metadata_next);
> cancel_delayed_work(&attachment->in_fragment_timeout);
>
> if (attachment->in_fragment_data)
> gip_free_in_fragment(attachment);
>
> + spin_lock_irqsave(&attachment->device->message_lock, flags);
> + attachment->device->data.has_pending_out &= ~pending_out_bits;
> + attachment->device->audio.has_pending_out &= ~pending_out_bits;
> + spin_unlock_irqrestore(&attachment->device->message_lock, flags);
> +
> + for (i = 0; i < MAX_OUT_FRAGMENTS; i++) {
> + if (attachment->out_fragments[i].active)
> + gip_free_fragment(&attachment->out_fragments[i]);
> + }
> +
> gip_free_devices(attachment);
> +
> }
[Severity: High]
Could the loop in gip_reset_attachment() introduce a use-after-free during
teardown?
During gip_shutdown(), the device teardown path correctly uses
cancel_delayed_work_sync() for other background workers, but relies on this
loop which uses the non-synchronous cancel_delayed_work() via
gip_free_fragment().
If gip_out_fragment_timeout() is executing and waiting on attachment->lock
during shutdown, it could resume after devres frees the attachment
structure, resulting in a use-after-free.
[ ... ]
> static int gip_handle_command_protocol_control(struct gip_attachment *attachment,
> const struct gip_header *header, const uint8_t *bytes, int num_bytes)
> {
[ ... ]
> + fragment->acked = true;
> + fragment->retries = 0;
> + cancel_delayed_work(&fragment->timeout);
> + if (fragment->flags & GIP_FLAG_FRAGMENT) {
> + fragment->fragment_offset = fragment_offset;
> + rc = gip_send_next_fragment(attachment, fragment);
> + if (rc < 0)
> + return rc;
> + } else {
> + gip_free_fragment(fragment);
> + }
> +
> + return 0;
[Severity: High]
Are modifications to the fragment state thread-safe here without
attachment->lock?
This path modifies fragment->acked and fragment->fragment_offset, and calls
gip_free_fragment() entirely locklessly. Doing so can race concurrently
with gip_out_fragment_timeout() and gip_send_raw_message(), leading to
corrupted fragment offsets or duplicated USB submissions.
--
Sashiko AI review · https://sashiko.dev/#/patchset/20260908032145.2118234-1-vi@endrift.com?part=6
^ permalink raw reply [flat|nested] 23+ messages in thread
* Re: [PATCH v6 10/12] Input: Add ABS_CLUTCH, HANDBRAKE, and SHIFTER
2026-09-08 3:21 ` [PATCH v6 10/12] Input: Add ABS_CLUTCH, HANDBRAKE, and SHIFTER Vicki Pfau
@ 2026-09-08 3:44 ` sashiko-bot
0 siblings, 0 replies; 23+ messages in thread
From: sashiko-bot @ 2026-09-08 3:44 UTC (permalink / raw)
To: Vicki Pfau; +Cc: linux-input, dmitry.torokhov
Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] The deadzone and fuzz reduction loop in the universal force-feedback driver hardcodes its upper bound to ABS_BRAKE, failing to include the newly added racing axes.
--
commit 87216a5e9d2ce889923252443994d20643f1c840
Author: Vicki Pfau <vi@endrift.com>
Input: Add ABS_CLUTCH, HANDBRAKE, and SHIFTER
This commit adds new absolute axes for racing game controllers.
> diff --git a/include/uapi/linux/input-event-codes.h b/include/uapi/linux/input-event-codes.h
> index 3528168f7c6d7..5c881ed441771 100644
> --- a/include/uapi/linux/input-event-codes.h
> +++ b/include/uapi/linux/input-event-codes.h
> @@ -879,6 +879,9 @@
> #define ABS_WHEEL 0x08
> #define ABS_GAS 0x09
> #define ABS_BRAKE 0x0a
> +#define ABS_CLUTCH 0x0b
> +#define ABS_HANDBRAKE 0x0c
> +#define ABS_SHIFTER 0x0d
[Severity: Medium]
Will these newly added racing axes be excluded from the deadzone and fuzz
adjustments in the generic PID force-feedback driver?
Looking at universal_pidff_input_configured() in
drivers/hid/hid-universal-pidff.c:
/* Decrease fuzz and deadzone on available axes */
for (axis = ABS_X; axis <= ABS_BRAKE; axis++) {
if (!test_bit(axis, input->absbit))
continue;
input_set_abs_params(input, axis, input->absinfo[axis].minimum,
input->absinfo[axis].maximum,
axis == ABS_X ? 0 : 8, 0);
}
Since this loop hardcodes its upper bound to ABS_BRAKE, it appears ABS_CLUTCH,
ABS_HANDBRAKE, and ABS_SHIFTER will be skipped.
Consequently, these inputs would fall back to default HID core deadzone
calculations, which might result in inconsistent behavior and unwanted
deadzones compared to the gas and brake pedals which explicitly receive
a deadzone of 0.
Should this loop's upper bound be updated to include the new axes?
--
Sashiko AI review · https://sashiko.dev/#/patchset/20260908032145.2118234-1-vi@endrift.com?part=10
^ permalink raw reply [flat|nested] 23+ messages in thread
* Re: [PATCH v6 01/12] Input: xbox_gip - Add new driver for Xbox GIP
2026-09-08 3:21 ` [PATCH v6 01/12] " Vicki Pfau
@ 2026-09-08 3:44 ` sashiko-bot
0 siblings, 0 replies; 23+ messages in thread
From: sashiko-bot @ 2026-09-08 3:44 UTC (permalink / raw)
To: Vicki Pfau; +Cc: linux-input, dmitry.torokhov
Thank you for your contribution! Sashiko AI review found 11 potential issue(s) to consider:
- [High] Incorrect teardown ordering in `gip_disconnect()` leaves pending `receive_message` work, causing a UAF.
- [High] Missing synchronous cancellation of `out_fragments` and `security` works during driver teardown.
- [High] Input devices are forcefully destroyed and recreated across system suspend/resume.
- [High] Use-After-Free in LED and Power Supply sysfs handlers due to devres lifetime mismatch.
- [High] URB input processing does not loop over packed messages and passes incorrect payload lengths.
- [High] Missing `cancel_delayed_work_sync` in `gip_probe` error path leads to use-after-free of attachment memory.
- [High] Functions returning negative error codes are declared with a `bool` return type, causing silent failures.
- [Medium] Unreachable cleanup code in `gip_init_output` error path leaks URBs and DMA buffers.
- [Medium] Devm-managed `input_dev` is leaked on dynamic device reset.
- [Medium] Concurrent modification of `attachment->seq_vendor` without holding `attachment->lock`.
- [Low] Mixing `guard()` scope-based cleanup with `goto`-based error handling in `gip_send_raw_message`.
--
commit 28d6048d8c164794e1dada5c80d56b8de14979e0
Author: Vicki Pfau <vi@endrift.com>
Input: xbox_gip - Add new driver for Xbox GIP
This patch introduces a new driver for the Xbox One/Series controller protocol,
known as the Gaming Input Protocol. It implements proper support for message
length parsing, fragmented messages, and metadata auto-detection. The driver
is designed to allow for future expansion to specialized device types and
additional features.
> diff --git a/drivers/input/joystick/gip/gip-core.c b/drivers/input/joystick/gip/gip-core.c
> index 0e23811a6ecc1..0000000000000 100644
> --- a/drivers/input/joystick/gip/gip-core.c
> +++ b/drivers/input/joystick/gip/gip-core.c
[ ... ]
> @@ -391,5 +391,5 @@ static uint8_t gip_sequence_next(struct gip_attachment *attachment,
> }
> } else {
> seq = attachment->seq_vendor++;
[Severity: Medium]
Can this modification to the shared sequence state race with other callers?
Calling gip_send_vendor_message() from softirq context, like in gip_play_effect(),
increments attachment->seq_vendor without holding attachment->lock. This might
race with other message senders executing in process context and cause corrupted
sequence numbers.
[ ... ]
> @@ -533,5 +533,5 @@ static void gip_free_fragment(struct gip_out_fragment *fragment)
> {
> cancel_delayed_work(&fragment->timeout);
[ ... ]
> @@ -3142,5 +3142,5 @@ static void gip_shutdown(struct gip_device *device)
>
> guard(mutex)(&attachment->lock);
> gip_reset_attachment(attachment);
[Severity: High]
Does this non-synchronous cancellation allow the fragment timeout work to survive
driver teardown?
Because gip_reset_attachment() invokes gip_free_fragment() while holding
attachment->lock, a concurrently executing gip_out_fragment_timeout() will block
trying to acquire the same lock.
Since cancel_delayed_work() does not wait for the blocked work to finish, the
work item could resume after gip_disconnect() frees the attachment structure,
leading to a use-after-free.
[ ... ]
> @@ -677,5 +677,5 @@ static int gip_send_raw_message(struct gip_attachment *attachment,
>
> guard(spinlock_irqsave)(&attachment->device->message_lock);
[ ... ]
> return rc;
>
> err_free_fragment:
> if (fragment)
> gip_free_fragment(fragment);
> return rc;
> }
[Severity: Low]
Does this mix guard scope-based cleanup with goto error handling?
The cleanup subsystem guidelines recommend avoiding goto-based cleanup labels
in the same function that uses guard declarations, as it creates confusing
ownership and resource lifecycle semantics.
[ ... ]
> @@ -1151,5 +1151,5 @@ static int gip_parse_message_metadata(struct device *dev,
>
> static bool gip_parse_metadata(struct device *dev,
> struct gip_metadata *metadata, const uint8_t *bytes, int num_bytes)
> {
[ ... ]
> if (offset >= num_bytes)
> goto parse_err;
[ ... ]
> parse_err:
> gip_metadata_free(dev, metadata);
> return rc;
> }
[Severity: High]
Can this function return a false success on error conditions?
The function is declared with a bool return type but uses and returns negative
error codes like -EINVAL and -ENOMEM. If the offset bounds check is hit, rc is
exactly 0, causing the function to return false (0).
Upstream callers like gip_handle_command_hello_device will implicitly cast this
to success, proceeding to use the freed metadata structure and risking
out-of-bounds accesses.
[ ... ]
> @@ -1388,5 +1388,5 @@ static int gip_guide_led_probe(struct gip_attachment *attachment, struct device
> if (!rc)
> rc = devm_led_classdev_multicolor_register(dev,
> mc_cdev);
[ ... ]
> @@ -1473,5 +1473,5 @@ static int gip_battery_create(struct gip_attachment *attachment, struct device *
>
> attachment->battery = devm_power_supply_register(dev,
> &attachment->battery_desc, &supply_config);
[ ... ]
> @@ -3183,5 +3183,5 @@ static void gip_disconnect(struct usb_interface *intf)
>
> devm_kfree(to_gip_device(attachment), attachment->uniq);
> devm_kfree(to_gip_device(attachment), attachment);
> }
[Severity: High]
Is there a lifetime mismatch between the devres-managed sysfs interfaces and
the attachment structure?
The battery and LED class devices are registered using the input device
dev pointer as the devres owner. However, the attachment structure, which
is used as the driver data for these callbacks, is explicitly freed via
devm_kfree() in gip_disconnect().
If a userspace process holds an open file descriptor on the input event node,
the input device memory and devres cleanup callbacks are deferred, leaving
dangling pointers that can be dereferenced by userspace sysfs reads or writes.
[ ... ]
> @@ -1602,5 +1602,5 @@ int gip_setup_input_device(struct gip_attachment *attachment)
> return 0;
>
> input = devm_input_allocate_device(to_gip_device(attachment));
> if (!input)
[ ... ]
> @@ -1861,5 +1861,5 @@ static void gip_free_devices(struct gip_attachment *attachment)
>
> if (input)
> input_unregister_device(input);
[Severity: Medium]
Will this leak the devm-managed input device during a dynamic reset?
The input device is allocated with devm_input_allocate_device(), tying its
memory to the USB interface. When the device is reset dynamically, such as upon
receiving a new hello message, gip_reset_attachment() calls gip_free_devices()
and unregisters the device.
Because the memory is devm-managed, it is not freed until the parent USB device
unbinds, resulting in a memory leak on every internal reset.
[Severity: High]
Also, does this forcefully destroy and recreate input devices across system
suspend?
When the system suspends, gip_suspend() calls gip_shutdown(), which invokes
gip_reset_attachment() and gip_free_devices(). This unregisters the input device,
completely destroying the node.
Applications will receive an EPOLLHUP and lose the controller permanently until
restarted. Standard input drivers typically persist the input device across
suspend and only pause I/O.
[ ... ]
> @@ -1902,5 +1902,5 @@ static void gip_reset_attachment(struct gip_attachment *attachment)
> cancel_delayed_work(&attachment->metadata_next);
> cancel_delayed_work(&attachment->in_fragment_timeout);
[ ... ]
> @@ -3108,5 +3108,5 @@ static int gip_probe(struct usb_interface *intf, const struct usb_device_id *id)
> if (rc) {
> gip_reset_attachment(attachment);
> gip_reset_metadata(attachment);
>
> devm_kfree(to_gip_device(attachment), attachment->uniq);
> devm_kfree(to_gip_device(attachment), attachment);
[Severity: High]
Does this non-synchronous cancellation in the probe error path allow the
metadata work item to access freed memory?
If gip_interface_init() fails, gip_reset_attachment() uses cancel_delayed_work()
for metadata_next, and then the attachment memory is immediately freed by
devm_kfree().
If the delayed work was scheduled, such as for devices with the GIP_QUIRK_NO_HELLO
quirk, it could execute concurrently and access the freed attachment structure.
[ ... ]
> @@ -2801,5 +2801,5 @@ static int gip_receive_message(struct gip_device *device, uint8_t *bytes,
> guard(mutex)(&attachment->lock);
> num_bytes -= offset;
> bytes += offset;
> fragment_offset = header.length;
> if (header.flags & GIP_FLAG_ACME)
> gip_acknowledge(attachment, &header, fragment_offset, bytes_remaining);
> rc = gip_handle_message(attachment, &header, bytes, num_bytes);
[Severity: High]
Does this code fail to handle multiple packed messages and pass incorrect
payload lengths?
For non-fragmented messages, the function passes the entire remaining buffer size
(num_bytes) to gip_handle_message() instead of the actual payload size defined by
header.length. It also lacks a loop to process subsequent messages in the transfer.
Because Xbox controllers often pack multiple messages or include trailing padding,
strict length validation checks in downstream handlers will fail, causing valid
messages to be dropped.
[ ... ]
> @@ -2977,6 +2977,5 @@ static int gip_init_output(struct gip_interface *intf,
> intf->out_queue[i].data = usb_alloc_coherent(udev, intf->mtu, GFP_KERNEL,
> &intf->out_queue[i].urb->transfer_dma);
>
> if (!intf->out_queue[i].data) {
> return -ENOMEM;
> goto err_free_urbs;
> }
[Severity: Medium]
Will this unreachable cleanup code leak URBs and DMA buffers on failure?
The return statement is placed immediately before the goto err_free_urbs label,
making the cleanup path completely unreachable if the coherent allocation fails.
[ ... ]
> @@ -3157,5 +3157,5 @@ static void gip_disconnect(struct usb_interface *intf)
> return;
>
> gip_shutdown(gip);
>
> usb_kill_urb(gip->data.urb_in);
[Severity: High]
Does the teardown ordering here leave a window for a use-after-free?
Calling gip_shutdown() invokes cancel_work_sync(&device->receive_message).
However, usb_kill_urb() is not called until after gip_shutdown() returns.
In that window, the hardware can complete a pending URB, triggering gip_urb_in(),
which will successfully reschedule the receive_message work item. After
gip_disconnect() completes and frees the gip_device structure, the pending
work will execute and dereference the freed memory.
--
Sashiko AI review · https://sashiko.dev/#/patchset/20260908032145.2118234-1-vi@endrift.com?part=1
^ permalink raw reply [flat|nested] 23+ messages in thread
* Re: [PATCH v6 04/12] Input: xbox_gip - Add HID relaying
2026-09-08 3:21 ` [PATCH v6 04/12] Input: xbox_gip - Add HID relaying Vicki Pfau
@ 2026-09-08 3:45 ` sashiko-bot
0 siblings, 0 replies; 23+ messages in thread
From: sashiko-bot @ 2026-09-08 3:45 UTC (permalink / raw)
To: Vicki Pfau; +Cc: linux-input, dmitry.torokhov
Thank you for your contribution! Sashiko AI review found 7 potential issue(s) to consider:
New issues:
- [High] gip_handle_command_hid_report() uses hid_input_report() instead of hid_safe_input_report(), bypassing buffer size checks.
- [Medium] gip_create_hdev() contains a redundant synchronize_rcu() call after publishing the newly allocated hdev pointer.
- [Medium] The hid_device's uniq field is not initialized before hid_add_device() is called.
- [Low] gip_free_devices() leaks the RCU-protected hdev pointer outside the read-side critical section, violating the RCU API contract.
Pre-existing issues:
- [Critical] gip_disconnect() cancels the receive workqueue before killing the active URB, introducing a race condition that causes Use-After-Free of the gip_device.
- [Critical] The LED classdev is embedded in the attachment but registered using the devres of the ephemeral input_dev, leading to list corruption upon device reset.
- [High] Resetting the attachment leaks input_dev structures because devm_input_allocate_device() is used but the memory is never explicitly freed before reallocation.
--
commit 4a45548f46c49c18ea22bd85490b3cf588327135
Author: Vicki Pfau <vi@endrift.com>
Input: xbox_gip - Add HID relaying
GIP allows tunneling of HID packets, with the HID descriptor embedded in
the GIP metadata exchanged during the initial handshake. This patch creates
a hid_device for this HID descriptor if found, as well as relaying the HID
packets.
> diff --git a/drivers/input/joystick/gip/gip-core.c b/drivers/input/joystick/gip/gip-core.c
> index a5ed5f3bf3fed..dc174560ee49f 100644
> --- a/drivers/input/joystick/gip/gip-core.c
> +++ b/drivers/input/joystick/gip/gip-core.c
[ ... ]
> @@ -1310,6 +1358,50 @@ static int gip_init_input_device(struct gip_attachment *attachment)
> return rc;
> }
>
> +static int gip_create_hdev(struct gip_attachment *attachment)
> +{
> + struct hid_device *hdev;
> + int rc;
> +
[ ... ]
> + hdev->dev.parent = to_gip_device(attachment);
> + hdev->driver_data = attachment;
> + if (attachment->name)
> + strscpy(hdev->name, attachment->name);
> + else
> + strscpy(hdev->name, "Xbox Chatpad");
> + strscpy(hdev->phys, attachment->phys);
[Severity: Medium]
Does this code forget to initialize hdev->uniq?
The HID subsystem documentation explicitly mandates that transport drivers
fully initialize fields including uniq before calling hid_add_device().
While the input_dev correctly populates this, it appears to be omitted here,
which leaves the device missing standard sysfs attributes.
> + rc = hid_add_device(hdev);
> + if (rc) {
> + gip_err(attachment, "HID device add failed: %d\n", rc);
> + hid_destroy_device(hdev);
> + } else {
> + rcu_assign_pointer(attachment->hdev, hdev);
> + synchronize_rcu();
[Severity: Medium]
Is it necessary to block the thread for an RCU grace period here?
Since rcu_assign_pointer() publishes the newly allocated hdev pointer
(replacing NULL or a synchronized teardown state), and no memory is being
reclaimed at this point, this synchronize_rcu() call appears completely
redundant and needlessly delays device initialization.
> + }
> +
> + return rc;
> +}
[ ... ]
> @@ -1393,19 +1489,25 @@ static void gip_fragment_timeout(struct work_struct *work)
> static void gip_free_devices(struct gip_attachment *attachment)
> {
> struct input_dev *input;
> + struct hid_device *hdev;
>
> if (attachment->driver && attachment->driver->remove)
> attachment->driver->remove(attachment);
>
> rcu_read_lock();
> input = rcu_dereference(attachment->input);
> + hdev = rcu_dereference(attachment->hdev);
> rcu_read_unlock();
>
> rcu_assign_pointer(attachment->input, NULL);
> + rcu_assign_pointer(attachment->hdev, NULL);
> synchronize_rcu();
>
> if (input)
> input_unregister_device(input);
> +
> + if (hdev)
> + hid_destroy_device(hdev);
[Severity: Low]
Can this leak the RCU-protected hdev pointer outside the read-side
critical section?
The hdev pointer is extracted using rcu_dereference() under rcu_read_lock(),
but it is utilized outside the critical section to destroy it. While this
might be functionally safe here because the thread is the exclusive updater
and synchronizes before destruction, it violates RCU API rules. Should this
use rcu_access_pointer() or rcu_dereference_protected() instead?
> }
>
> static void gip_reset_metadata(struct gip_attachment *attachment)
[ ... ]
> @@ -1770,9 +1872,16 @@ static int gip_handle_command_firmware(struct gip_attachment *attachment,
> static int gip_handle_command_hid_report(struct gip_attachment *attachment,
> const struct gip_header *header, uint8_t *bytes, int num_bytes)
> {
> - gip_warn(attachment, "Unimplemented HID report message\n");
> + struct hid_device *hdev;
>
> - return -EOPNOTSUPP;
> + guard(rcu)();
> + hdev = rcu_dereference(attachment->hdev);
> + if (hdev)
> + return hid_input_report(hdev, HID_INPUT_REPORT, bytes, num_bytes, true);
[Severity: High]
Could this cause an out-of-bounds read in the HID core?
The raw byte array from untrusted hardware input is passed directly to
hid_input_report() without providing the allocated buffer size. The HID
subsystem explicitly directs transport drivers to use hid_safe_input_report()
with the allocated buffer size to ensure proper boundary checks are performed
against the report descriptor.
> +
> + gip_warn(attachment, "Got HID report with no HID descriptor\n");
> +
> + return -EPROTO;
> }
While reviewing this file, I also noticed a few pre-existing regressions
elsewhere in the codebase:
> static void gip_disconnect(struct usb_interface *intf)
> {
> struct gip_device *gip = usb_get_intfdata(intf);
> int i;
>
> if (!gip)
> return;
>
> gip_shutdown(gip);
>
> usb_kill_urb(gip->data.urb_in);
[Severity: Critical]
This is a pre-existing issue, but does this destruction order cause a
use-after-free of the gip_device?
The cleanup function gip_shutdown() cancels the receive_message workqueue
before usb_kill_urb() is called. If the urb_in completes concurrently after
the workqueue is canceled but before the URB is killed, it will reschedule
the receive_message work. This work then executes concurrently with the rest
of gip_disconnect(), which frees the gip_device.
> static int gip_setup_input_device(struct gip_attachment *attachment)
> {
> struct input_dev *input;
> int rc;
>
> if (!attachment->driver || !attachment->driver->setup_input)
> return -ENODEV;
>
> rcu_read_lock();
> input = rcu_dereference(attachment->input);
> rcu_read_unlock();
> if (input)
> return 0;
>
> input = devm_input_allocate_device(to_gip_device(attachment));
[Severity: High]
This isn't a bug introduced by this patch, but are input_dev structures
leaked when the attachment is reset?
The input_dev is allocated using devm_input_allocate_device(). During a
protocol reset, input_unregister_device() is explicitly called, but this
does not free the devres-managed memory until the parent USB interface
unbinds. Re-allocating the device on subsequent resets appears to accumulate
leaked structures in memory.
> static int gip_guide_led_probe(struct gip_attachment *attachment, struct device *dev)
> {
> int rc = 0;
>
> if (!gip_supports_system_message(attachment, GIP_CMD_LED, false))
> return 0;
>
> if (attachment->features & GIP_FEATURE_GUIDE_COLOR) {
> struct mc_subled *mc_led_info;
> struct led_classdev_mc *mc_cdev = &attachment->guide_led.color;
> struct led_classdev *cdev = &mc_cdev->led_cdev;
>
> mc_led_info = devm_kcalloc(dev, 4,
[ ... ]
> if (!rc)
> rc = devm_led_classdev_multicolor_register(dev,
> mc_cdev);
[Severity: Critical]
This is a pre-existing issue, but does tying the embedded LED classdev
registration to the ephemeral input_dev lead to list corruption?
The led_classdev is embedded in the attachment structure, but it is
registered using devm_led_classdev_register() tied to the input_dev's
lifecycle. On reset, the input_dev is unregistered, but its devres cleanup
is deferred until the last userspace reference is closed. If the driver
reallocates the input_dev and re-registers the exact same embedded
led_classdev structure before cleanup completes, it corrupts the LED
subsystem's linked lists.
--
Sashiko AI review · https://sashiko.dev/#/patchset/20260908032145.2118234-1-vi@endrift.com?part=4
^ permalink raw reply [flat|nested] 23+ messages in thread
* Re: [PATCH v6 12/12] Input: xbox_gip - Add wheel support
2026-09-08 3:21 ` [PATCH v6 12/12] Input: xbox_gip - Add wheel support Vicki Pfau
@ 2026-09-08 3:55 ` sashiko-bot
0 siblings, 0 replies; 23+ messages in thread
From: sashiko-bot @ 2026-09-08 3:55 UTC (permalink / raw)
To: Vicki Pfau; +Cc: linux-input, dmitry.torokhov
Thank you for your contribution! Sashiko AI review found 4 potential issue(s) to consider:
New issues:
- [Medium] Late packet length validation causes input state desynchronization.
- [Medium] Incorrect wraparound delta calculation for the REL_DIAL axis when multiple steps occur.
- [Medium] Phantom REL_DIAL scroll event upon device initialization.
Pre-existing issues:
- [High] Out-of-order teardown in `gip_disconnect` allows URB completion handler to trigger use-after-free of gip_device.
--
commit 4a4f1a60a6109caec93af3211950c865f6e16e58
Author: Vicki Pfau <vi@endrift.com>
Input: xbox_gip - Add wheel support
This adds preliminary support for racing wheel support in xbox_gip,
exposing them mapped to the newly added axes.
> diff --git a/drivers/input/joystick/gip/gip-wheel.c b/drivers/input/joystick/gip/gip-wheel.c
> new file mode 100644
> index 0000000000000..5de455edff3c1
> --- /dev/null
> +++ b/drivers/input/joystick/gip/gip-wheel.c
[ ... ]
> +static int gip_handle_wheel_report(struct gip_attachment *attachment,
> + struct input_dev *input, const uint8_t *bytes, int num_bytes)
> +{
> + uint8_t connections;
> + struct gip_wheel_info *info = attachment->driver_data;
> + int rc = gip_driver_navigation.handle_input_report(attachment, input, bytes, num_bytes);
> +
> + if (rc < 0)
> + return rc;
> +
> + if (!info)
> + return -ENODEV;
> +
> + if (num_bytes < 17)
> + return -EINVAL;
[Severity: Medium]
Will returning -EINVAL here trap events that were already queued?
If a device sends a fragmented or short report (e.g. 16 bytes),
gip_driver_navigation.handle_input_report() will process the first bytes and
queue events.
By returning -EINVAL after this, the error propagates and bypasses the
input_sync() call in the core loop, leaving the queued events
unsynchronized in the input subsystem buffer and potentially causing
stuck keys.
[ ... ]
> +static int gip_handle_trueforce_wheel_report(struct gip_attachment *attachment,
> + struct input_dev *input, const uint8_t *bytes, int num_bytes)
> +{
> + int rc = gip_driver_wheel.handle_input_report(attachment, input, bytes, num_bytes);
> + struct gip_trueforce_wheel_state *state = attachment->driver_data;
> + int dial;
> +
> + if (rc < 0)
> + return rc;
> +
> + if (num_bytes < 18)
> + return -EINVAL;
[Severity: Medium]
Can this similarly trap events reported by the base wheel handler?
Events are reported by gip_driver_wheel.handle_input_report() before the
TrueForce-specific size validation rejects the packet. This will also bypass
input_sync().
[ ... ]
> + input_report_key(input, KEY_KPENTER, bytes[17] & BIT(4));
> + /* Dial states only change one at a time, so we can easily check for wraparound */
> + if (dial == 0 && state->dial == 7)
> + input_report_rel(input, REL_DIAL, -1);
> + else if (dial == 7 && state->dial == 0)
> + input_report_rel(input, REL_DIAL, 1);
> + else
> + input_report_rel(input, REL_DIAL,
> + state->dial - dial);
[Severity: Medium]
Is it possible for this calculation to compute an incorrect wraparound delta
if multiple steps occur between reports?
If a user quickly scrolls the TrueForce dial, the step might jump by 2 or more
across the 0/7 boundary (e.g. from 7 to 1).
The explicit edge case checks would fail, and the fallback logic would compute
state->dial - dial (7 - 1 = 6), incorrectly reporting a delta of +6 instead of
the correct logical step of -2.
[Severity: Medium]
Could this logic emit a phantom REL_DIAL scroll event when the device is
initialized?
When the driver first allocates gip_trueforce_wheel_state, kzalloc zeroes
state->dial.
If the physical wheel dial is at a non-zero position (e.g. 4) when normal
reporting begins, the handler computes 0 - 4 = -4 and immediately emits a
scroll event before the user even touches the wheel.
[ ... ]
This is a pre-existing issue, but I noticed a potential problem in
gip_disconnect() within drivers/input/joystick/gip/gip-core.c:
[Severity: High]
Does cancelling the work before killing the URB allow the URB completion
handler to schedule new work that outlives the device?
drivers/input/joystick/gip/gip-core.c:gip_disconnect() {
...
gip_shutdown(gip);
usb_kill_urb(gip->data.urb_in);
...
}
If the URB is still active and a packet arrives just after gip_shutdown()
cancels the device->receive_message work struct, the URB completion handler
can call schedule_work() again.
When gip_disconnect() completes and frees the gip structure, the system
workqueue could execute the corrupted workqueue item and trigger a
use-after-free kernel panic.
--
Sashiko AI review · https://sashiko.dev/#/patchset/20260908032145.2118234-1-vi@endrift.com?part=12
^ permalink raw reply [flat|nested] 23+ messages in thread
end of thread, other threads:[~2026-09-08 3:55 UTC | newest]
Thread overview: 23+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-09-08 3:21 [PATCH v6 00/12] Input: xbox_gip - Add new driver for Xbox GIP Vicki Pfau
2026-09-08 3:21 ` [PATCH v6 01/12] " Vicki Pfau
2026-09-08 3:44 ` sashiko-bot
2026-09-08 3:21 ` [PATCH v6 02/12] Input: xpad - Remove Xbox One support Vicki Pfau
2026-09-08 3:34 ` sashiko-bot
2026-09-08 3:21 ` [PATCH v6 03/12] Input: xbox_gip - Add controllable LED support Vicki Pfau
2026-09-08 3:39 ` sashiko-bot
2026-09-08 3:21 ` [PATCH v6 04/12] Input: xbox_gip - Add HID relaying Vicki Pfau
2026-09-08 3:45 ` sashiko-bot
2026-09-08 3:21 ` [PATCH v6 05/12] Input: xbox_gip - Add battery support Vicki Pfau
2026-09-08 3:38 ` sashiko-bot
2026-09-08 3:21 ` [PATCH v6 06/12] Input: xbox_gip - Allow sending fragmented and ACME messages Vicki Pfau
2026-09-08 3:39 ` sashiko-bot
2026-09-08 3:21 ` [PATCH v6 07/12] Input: xbox_gip - Add security implementation from xone Vicki Pfau
2026-09-08 3:38 ` sashiko-bot
2026-09-08 3:21 ` [PATCH v6 08/12] Input: xbox_gip - Add arcade stick support Vicki Pfau
2026-09-08 3:35 ` sashiko-bot
2026-09-08 3:21 ` [PATCH v6 09/12] Input: xbox_gip - Add support for PDP guitar controllers Vicki Pfau
2026-09-08 3:21 ` [PATCH v6 10/12] Input: Add ABS_CLUTCH, HANDBRAKE, and SHIFTER Vicki Pfau
2026-09-08 3:44 ` sashiko-bot
2026-09-08 3:21 ` [PATCH v6 11/12] HID: Map more automobile simulation inputs Vicki Pfau
2026-09-08 3:21 ` [PATCH v6 12/12] Input: xbox_gip - Add wheel support Vicki Pfau
2026-09-08 3:55 ` sashiko-bot
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox