1// SPDX-License-Identifier: GPL-2.0+
   2/*
   3 * HID driver for Valve Steam Controller
   4 *
   5 * Copyright (c) 2018 Rodrigo Rivas Costa <rodrigorivascosta@gmail.com>
   6 *
   7 * Supports both the wired and wireless interfaces.
   8 *
   9 * This controller has a builtin emulation of mouse and keyboard: the right pad
  10 * can be used as a mouse, the shoulder buttons are mouse buttons, A and B
  11 * buttons are ENTER and ESCAPE, and so on. This is implemented as additional
  12 * HID interfaces.
  13 *
  14 * This is known as the "lizard mode", because apparently lizards like to use
  15 * the computer from the coach, without a proper mouse and keyboard.
  16 *
  17 * This driver will disable the lizard mode when the input device is opened
  18 * and re-enable it when the input device is closed, so as not to break user
  19 * mode behaviour. The lizard_mode parameter can be used to change that.
  20 *
  21 * There are a few user space applications (notably Steam Client) that use
  22 * the hidraw interface directly to create input devices (XTest, uinput...).
  23 * In order to avoid breaking them this driver creates a layered hidraw device,
  24 * so it can detect when the client is running and then:
  25 *  - it will not send any command to the controller.
  26 *  - this input device will be removed, to avoid double input of the same
  27 *    user action.
  28 * When the client is closed, this input device will be created again.
  29 *
  30 * For additional functions, such as changing the right-pad margin or switching
  31 * the led, you can use the user-space tool at:
  32 *
  33 *   https://github.com/rodrigorc/steamctrl
  34 */
  35
  36#include <linux/device.h>
  37#include <linux/input.h>
  38#include <linux/hid.h>
  39#include <linux/module.h>
  40#include <linux/workqueue.h>
  41#include <linux/mutex.h>
  42#include <linux/rcupdate.h>
  43#include <linux/delay.h>
  44#include <linux/power_supply.h>
  45#include "hid-ids.h"
  46
  47MODULE_LICENSE("GPL");
  48MODULE_AUTHOR("Rodrigo Rivas Costa <rodrigorivascosta@gmail.com>");
  49
  50static bool lizard_mode = true;
  51
  52static DEFINE_MUTEX(steam_devices_lock);
  53static LIST_HEAD(steam_devices);
  54
  55#define STEAM_QUIRK_WIRELESS		BIT(0)
  56
  57/* Touch pads are 40 mm in diameter and 65535 units */
  58#define STEAM_PAD_RESOLUTION 1638
  59/* Trigger runs are about 5 mm and 256 units */
  60#define STEAM_TRIGGER_RESOLUTION 51
  61/* Joystick runs are about 5 mm and 256 units */
  62#define STEAM_JOYSTICK_RESOLUTION 51
  63
  64#define STEAM_PAD_FUZZ 256
  65
  66/*
  67 * Commands that can be sent in a feature report.
  68 * Thanks to Valve for some valuable hints.
  69 */
  70#define STEAM_CMD_SET_MAPPINGS		0x80
  71#define STEAM_CMD_CLEAR_MAPPINGS	0x81
  72#define STEAM_CMD_GET_MAPPINGS		0x82
  73#define STEAM_CMD_GET_ATTRIB		0x83
  74#define STEAM_CMD_GET_ATTRIB_LABEL	0x84
  75#define STEAM_CMD_DEFAULT_MAPPINGS	0x85
  76#define STEAM_CMD_FACTORY_RESET		0x86
  77#define STEAM_CMD_WRITE_REGISTER	0x87
  78#define STEAM_CMD_CLEAR_REGISTER	0x88
  79#define STEAM_CMD_READ_REGISTER		0x89
  80#define STEAM_CMD_GET_REGISTER_LABEL	0x8a
  81#define STEAM_CMD_GET_REGISTER_MAX	0x8b
  82#define STEAM_CMD_GET_REGISTER_DEFAULT	0x8c
  83#define STEAM_CMD_SET_MODE		0x8d
  84#define STEAM_CMD_DEFAULT_MOUSE		0x8e
  85#define STEAM_CMD_FORCEFEEDBAK		0x8f
  86#define STEAM_CMD_REQUEST_COMM_STATUS	0xb4
  87#define STEAM_CMD_GET_SERIAL		0xae
  88
  89/* Some useful register ids */
  90#define STEAM_REG_LPAD_MODE		0x07
  91#define STEAM_REG_RPAD_MODE		0x08
  92#define STEAM_REG_RPAD_MARGIN		0x18
  93#define STEAM_REG_LED			0x2d
  94#define STEAM_REG_GYRO_MODE		0x30
  95
  96/* Raw event identifiers */
  97#define STEAM_EV_INPUT_DATA		0x01
  98#define STEAM_EV_CONNECT		0x03
  99#define STEAM_EV_BATTERY		0x04
 100
 101/* Values for GYRO_MODE (bitmask) */
 102#define STEAM_GYRO_MODE_OFF		0x0000
 103#define STEAM_GYRO_MODE_STEERING	0x0001
 104#define STEAM_GYRO_MODE_TILT		0x0002
 105#define STEAM_GYRO_MODE_SEND_ORIENTATION	0x0004
 106#define STEAM_GYRO_MODE_SEND_RAW_ACCEL		0x0008
 107#define STEAM_GYRO_MODE_SEND_RAW_GYRO		0x0010
 108
 109/* Other random constants */
 110#define STEAM_SERIAL_LEN 10
 111
 112struct steam_device {
 113	struct list_head list;
 114	spinlock_t lock;
 115	struct hid_device *hdev, *client_hdev;
 116	struct mutex mutex;
 117	bool client_opened;
 118	struct input_dev __rcu *input;
 119	unsigned long quirks;
 120	struct work_struct work_connect;
 121	bool connected;
 122	char serial_no[STEAM_SERIAL_LEN + 1];
 123	struct power_supply_desc battery_desc;
 124	struct power_supply __rcu *battery;
 125	u8 battery_charge;
 126	u16 voltage;
 127};
 128
 129static int steam_recv_report(struct steam_device *steam,
 130		u8 *data, int size)
 131{
 132	struct hid_report *r;
 133	u8 *buf;
 134	int ret;
 135
 136	r = steam->hdev->report_enum[HID_FEATURE_REPORT].report_id_hash[0];
 137	if (hid_report_len(r) < 64)
 138		return -EINVAL;
 139
 140	buf = hid_alloc_report_buf(r, GFP_KERNEL);
 141	if (!buf)
 142		return -ENOMEM;
 143
 144	/*
 145	 * The report ID is always 0, so strip the first byte from the output.
 146	 * hid_report_len() is not counting the report ID, so +1 to the length
 147	 * or else we get a EOVERFLOW. We are safe from a buffer overflow
 148	 * because hid_alloc_report_buf() allocates +7 bytes.
 149	 */
 150	ret = hid_hw_raw_request(steam->hdev, 0x00,
 151			buf, hid_report_len(r) + 1,
 152			HID_FEATURE_REPORT, HID_REQ_GET_REPORT);
 153	if (ret > 0)
 154		memcpy(data, buf + 1, min(size, ret - 1));
 155	kfree(buf);
 156	return ret;
 157}
 158
 159static int steam_send_report(struct steam_device *steam,
 160		u8 *cmd, int size)
 161{
 162	struct hid_report *r;
 163	u8 *buf;
 164	unsigned int retries = 50;
 165	int ret;
 166
 167	r = steam->hdev->report_enum[HID_FEATURE_REPORT].report_id_hash[0];
 168	if (hid_report_len(r) < 64)
 169		return -EINVAL;
 170
 171	buf = hid_alloc_report_buf(r, GFP_KERNEL);
 172	if (!buf)
 173		return -ENOMEM;
 174
 175	/* The report ID is always 0 */
 176	memcpy(buf + 1, cmd, size);
 177
 178	/*
 179	 * Sometimes the wireless controller fails with EPIPE
 180	 * when sending a feature report.
 181	 * Doing a HID_REQ_GET_REPORT and waiting for a while
 182	 * seems to fix that.
 183	 */
 184	do {
 185		ret = hid_hw_raw_request(steam->hdev, 0,
 186				buf, size + 1,
 187				HID_FEATURE_REPORT, HID_REQ_SET_REPORT);
 188		if (ret != -EPIPE)
 189			break;
 190		msleep(20);
 191	} while (--retries);
 192
 193	kfree(buf);
 194	if (ret < 0)
 195		hid_err(steam->hdev, "%s: error %d (%*ph)\n", __func__,
 196				ret, size, cmd);
 197	return ret;
 198}
 199
 200static inline int steam_send_report_byte(struct steam_device *steam, u8 cmd)
 201{
 202	return steam_send_report(steam, &cmd, 1);
 203}
 204
 205static int steam_write_registers(struct steam_device *steam,
 206		/* u8 reg, u16 val */...)
 207{
 208	/* Send: 0x87 len (reg valLo valHi)* */
 209	u8 reg;
 210	u16 val;
 211	u8 cmd[64] = {STEAM_CMD_WRITE_REGISTER, 0x00};
 212	va_list args;
 213
 214	va_start(args, steam);
 215	for (;;) {
 216		reg = va_arg(args, int);
 217		if (reg == 0)
 218			break;
 219		val = va_arg(args, int);
 220		cmd[cmd[1] + 2] = reg;
 221		cmd[cmd[1] + 3] = val & 0xff;
 222		cmd[cmd[1] + 4] = val >> 8;
 223		cmd[1] += 3;
 224	}
 225	va_end(args);
 226
 227	return steam_send_report(steam, cmd, 2 + cmd[1]);
 228}
 229
 230static int steam_get_serial(struct steam_device *steam)
 231{
 232	/*
 233	 * Send: 0xae 0x15 0x01
 234	 * Recv: 0xae 0x15 0x01 serialnumber (10 chars)
 235	 */
 236	int ret;
 237	u8 cmd[] = {STEAM_CMD_GET_SERIAL, 0x15, 0x01};
 238	u8 reply[3 + STEAM_SERIAL_LEN + 1];
 239
 240	ret = steam_send_report(steam, cmd, sizeof(cmd));
 241	if (ret < 0)
 242		return ret;
 243	ret = steam_recv_report(steam, reply, sizeof(reply));
 244	if (ret < 0)
 245		return ret;
 246	if (reply[0] != 0xae || reply[1] != 0x15 || reply[2] != 0x01)
 247		return -EIO;
 248	reply[3 + STEAM_SERIAL_LEN] = 0;
 249	strlcpy(steam->serial_no, reply + 3, sizeof(steam->serial_no));
 250	return 0;
 251}
 252
 253/*
 254 * This command requests the wireless adaptor to post an event
 255 * with the connection status. Useful if this driver is loaded when
 256 * the controller is already connected.
 257 */
 258static inline int steam_request_conn_status(struct steam_device *steam)
 259{
 260	return steam_send_report_byte(steam, STEAM_CMD_REQUEST_COMM_STATUS);
 261}
 262
 263static void steam_set_lizard_mode(struct steam_device *steam, bool enable)
 264{
 265	if (enable) {
 266		/* enable esc, enter, cursors */
 267		steam_send_report_byte(steam, STEAM_CMD_DEFAULT_MAPPINGS);
 268		/* enable mouse */
 269		steam_send_report_byte(steam, STEAM_CMD_DEFAULT_MOUSE);
 270		steam_write_registers(steam,
 271			STEAM_REG_RPAD_MARGIN, 0x01, /* enable margin */
 272			0);
 273	} else {
 274		/* disable esc, enter, cursor */
 275		steam_send_report_byte(steam, STEAM_CMD_CLEAR_MAPPINGS);
 276		steam_write_registers(steam,
 277			STEAM_REG_RPAD_MODE, 0x07, /* disable mouse */
 278			STEAM_REG_RPAD_MARGIN, 0x00, /* disable margin */
 279			0);
 280	}
 281}
 282
 283static int steam_input_open(struct input_dev *dev)
 284{
 285	struct steam_device *steam = input_get_drvdata(dev);
 286
 287	mutex_lock(&steam->mutex);
 288	if (!steam->client_opened && lizard_mode)
 289		steam_set_lizard_mode(steam, false);
 290	mutex_unlock(&steam->mutex);
 291	return 0;
 292}
 293
 294static void steam_input_close(struct input_dev *dev)
 295{
 296	struct steam_device *steam = input_get_drvdata(dev);
 297
 298	mutex_lock(&steam->mutex);
 299	if (!steam->client_opened && lizard_mode)
 300		steam_set_lizard_mode(steam, true);
 301	mutex_unlock(&steam->mutex);
 302}
 303
 304static enum power_supply_property steam_battery_props[] = {
 305	POWER_SUPPLY_PROP_PRESENT,
 306	POWER_SUPPLY_PROP_SCOPE,
 307	POWER_SUPPLY_PROP_VOLTAGE_NOW,
 308	POWER_SUPPLY_PROP_CAPACITY,
 309};
 310
 311static int steam_battery_get_property(struct power_supply *psy,
 312				enum power_supply_property psp,
 313				union power_supply_propval *val)
 314{
 315	struct steam_device *steam = power_supply_get_drvdata(psy);
 316	unsigned long flags;
 317	s16 volts;
 318	u8 batt;
 319	int ret = 0;
 320
 321	spin_lock_irqsave(&steam->lock, flags);
 322	volts = steam->voltage;
 323	batt = steam->battery_charge;
 324	spin_unlock_irqrestore(&steam->lock, flags);
 325
 326	switch (psp) {
 327	case POWER_SUPPLY_PROP_PRESENT:
 328		val->intval = 1;
 329		break;
 330	case POWER_SUPPLY_PROP_SCOPE:
 331		val->intval = POWER_SUPPLY_SCOPE_DEVICE;
 332		break;
 333	case POWER_SUPPLY_PROP_VOLTAGE_NOW:
 334		val->intval = volts * 1000; /* mV -> uV */
 335		break;
 336	case POWER_SUPPLY_PROP_CAPACITY:
 337		val->intval = batt;
 338		break;
 339	default:
 340		ret = -EINVAL;
 341		break;
 342	}
 343	return ret;
 344}
 345
 346static int steam_battery_register(struct steam_device *steam)
 347{
 348	struct power_supply *battery;
 349	struct power_supply_config battery_cfg = { .drv_data = steam, };
 350	unsigned long flags;
 351	int ret;
 352
 353	steam->battery_desc.type = POWER_SUPPLY_TYPE_BATTERY;
 354	steam->battery_desc.properties = steam_battery_props;
 355	steam->battery_desc.num_properties = ARRAY_SIZE(steam_battery_props);
 356	steam->battery_desc.get_property = steam_battery_get_property;
 357	steam->battery_desc.name = devm_kasprintf(&steam->hdev->dev,
 358			GFP_KERNEL, "steam-controller-%s-battery",
 359			steam->serial_no);
 360	if (!steam->battery_desc.name)
 361		return -ENOMEM;
 362
 363	/* avoid the warning of 0% battery while waiting for the first info */
 364	spin_lock_irqsave(&steam->lock, flags);
 365	steam->voltage = 3000;
 366	steam->battery_charge = 100;
 367	spin_unlock_irqrestore(&steam->lock, flags);
 368
 369	battery = power_supply_register(&steam->hdev->dev,
 370			&steam->battery_desc, &battery_cfg);
 371	if (IS_ERR(battery)) {
 372		ret = PTR_ERR(battery);
 373		hid_err(steam->hdev,
 374				"%s:power_supply_register failed with error %d\n",
 375				__func__, ret);
 376		return ret;
 377	}
 378	rcu_assign_pointer(steam->battery, battery);
 379	power_supply_powers(battery, &steam->hdev->dev);
 380	return 0;
 381}
 382
 383static int steam_input_register(struct steam_device *steam)
 384{
 385	struct hid_device *hdev = steam->hdev;
 386	struct input_dev *input;
 387	int ret;
 388
 389	rcu_read_lock();
 390	input = rcu_dereference(steam->input);
 391	rcu_read_unlock();
 392	if (input) {
 393		dbg_hid("%s: already connected\n", __func__);
 394		return 0;
 395	}
 396
 397	input = input_allocate_device();
 398	if (!input)
 399		return -ENOMEM;
 400
 401	input_set_drvdata(input, steam);
 402	input->dev.parent = &hdev->dev;
 403	input->open = steam_input_open;
 404	input->close = steam_input_close;
 405
 406	input->name = (steam->quirks & STEAM_QUIRK_WIRELESS) ?
 407		"Wireless Steam Controller" :
 408		"Steam Controller";
 409	input->phys = hdev->phys;
 410	input->uniq = steam->serial_no;
 411	input->id.bustype = hdev->bus;
 412	input->id.vendor = hdev->vendor;
 413	input->id.product = hdev->product;
 414	input->id.version = hdev->version;
 415
 416	input_set_capability(input, EV_KEY, BTN_TR2);
 417	input_set_capability(input, EV_KEY, BTN_TL2);
 418	input_set_capability(input, EV_KEY, BTN_TR);
 419	input_set_capability(input, EV_KEY, BTN_TL);
 420	input_set_capability(input, EV_KEY, BTN_Y);
 421	input_set_capability(input, EV_KEY, BTN_B);
 422	input_set_capability(input, EV_KEY, BTN_X);
 423	input_set_capability(input, EV_KEY, BTN_A);
 424	input_set_capability(input, EV_KEY, BTN_DPAD_UP);
 425	input_set_capability(input, EV_KEY, BTN_DPAD_RIGHT);
 426	input_set_capability(input, EV_KEY, BTN_DPAD_LEFT);
 427	input_set_capability(input, EV_KEY, BTN_DPAD_DOWN);
 428	input_set_capability(input, EV_KEY, BTN_SELECT);
 429	input_set_capability(input, EV_KEY, BTN_MODE);
 430	input_set_capability(input, EV_KEY, BTN_START);
 431	input_set_capability(input, EV_KEY, BTN_GEAR_DOWN);
 432	input_set_capability(input, EV_KEY, BTN_GEAR_UP);
 433	input_set_capability(input, EV_KEY, BTN_THUMBR);
 434	input_set_capability(input, EV_KEY, BTN_THUMBL);
 435	input_set_capability(input, EV_KEY, BTN_THUMB);
 436	input_set_capability(input, EV_KEY, BTN_THUMB2);
 437
 438	input_set_abs_params(input, ABS_HAT2Y, 0, 255, 0, 0);
 439	input_set_abs_params(input, ABS_HAT2X, 0, 255, 0, 0);
 440	input_set_abs_params(input, ABS_X, -32767, 32767, 0, 0);
 441	input_set_abs_params(input, ABS_Y, -32767, 32767, 0, 0);
 442	input_set_abs_params(input, ABS_RX, -32767, 32767,
 443			STEAM_PAD_FUZZ, 0);
 444	input_set_abs_params(input, ABS_RY, -32767, 32767,
 445			STEAM_PAD_FUZZ, 0);
 446	input_set_abs_params(input, ABS_HAT0X, -32767, 32767,
 447			STEAM_PAD_FUZZ, 0);
 448	input_set_abs_params(input, ABS_HAT0Y, -32767, 32767,
 449			STEAM_PAD_FUZZ, 0);
 450	input_abs_set_res(input, ABS_X, STEAM_JOYSTICK_RESOLUTION);
 451	input_abs_set_res(input, ABS_Y, STEAM_JOYSTICK_RESOLUTION);
 452	input_abs_set_res(input, ABS_RX, STEAM_PAD_RESOLUTION);
 453	input_abs_set_res(input, ABS_RY, STEAM_PAD_RESOLUTION);
 454	input_abs_set_res(input, ABS_HAT0X, STEAM_PAD_RESOLUTION);
 455	input_abs_set_res(input, ABS_HAT0Y, STEAM_PAD_RESOLUTION);
 456	input_abs_set_res(input, ABS_HAT2Y, STEAM_TRIGGER_RESOLUTION);
 457	input_abs_set_res(input, ABS_HAT2X, STEAM_TRIGGER_RESOLUTION);
 458
 459	ret = input_register_device(input);
 460	if (ret)
 461		goto input_register_fail;
 462
 463	rcu_assign_pointer(steam->input, input);
 464	return 0;
 465
 466input_register_fail:
 467	input_free_device(input);
 468	return ret;
 469}
 470
 471static void steam_input_unregister(struct steam_device *steam)
 472{
 473	struct input_dev *input;
 474	rcu_read_lock();
 475	input = rcu_dereference(steam->input);
 476	rcu_read_unlock();
 477	if (!input)
 478		return;
 479	RCU_INIT_POINTER(steam->input, NULL);
 480	synchronize_rcu();
 481	input_unregister_device(input);
 482}
 483
 484static void steam_battery_unregister(struct steam_device *steam)
 485{
 486	struct power_supply *battery;
 487
 488	rcu_read_lock();
 489	battery = rcu_dereference(steam->battery);
 490	rcu_read_unlock();
 491
 492	if (!battery)
 493		return;
 494	RCU_INIT_POINTER(steam->battery, NULL);
 495	synchronize_rcu();
 496	power_supply_unregister(battery);
 497}
 498
 499static int steam_register(struct steam_device *steam)
 500{
 501	int ret;
 502	bool client_opened;
 503
 504	/*
 505	 * This function can be called several times in a row with the
 506	 * wireless adaptor, without steam_unregister() between them, because
 507	 * another client send a get_connection_status command, for example.
 508	 * The battery and serial number are set just once per device.
 509	 */
 510	if (!steam->serial_no[0]) {
 511		/*
 512		 * Unlikely, but getting the serial could fail, and it is not so
 513		 * important, so make up a serial number and go on.
 514		 */
 515		mutex_lock(&steam->mutex);
 516		if (steam_get_serial(steam) < 0)
 517			strlcpy(steam->serial_no, "XXXXXXXXXX",
 518					sizeof(steam->serial_no));
 519		mutex_unlock(&steam->mutex);
 520
 521		hid_info(steam->hdev, "Steam Controller '%s' connected",
 522				steam->serial_no);
 523
 524		/* ignore battery errors, we can live without it */
 525		if (steam->quirks & STEAM_QUIRK_WIRELESS)
 526			steam_battery_register(steam);
 527
 528		mutex_lock(&steam_devices_lock);
 529		if (list_empty(&steam->list))
 530			list_add(&steam->list, &steam_devices);
 531		mutex_unlock(&steam_devices_lock);
 532	}
 533
 534	mutex_lock(&steam->mutex);
 535	client_opened = steam->client_opened;
 536	if (!client_opened)
 537		steam_set_lizard_mode(steam, lizard_mode);
 538	mutex_unlock(&steam->mutex);
 539
 540	if (!client_opened)
 541		ret = steam_input_register(steam);
 542	else
 543		ret = 0;
 544
 545	return ret;
 546}
 547
 548static void steam_unregister(struct steam_device *steam)
 549{
 550	steam_battery_unregister(steam);
 551	steam_input_unregister(steam);
 552	if (steam->serial_no[0]) {
 553		hid_info(steam->hdev, "Steam Controller '%s' disconnected",
 554				steam->serial_no);
 555		mutex_lock(&steam_devices_lock);
 556		list_del_init(&steam->list);
 557		mutex_unlock(&steam_devices_lock);
 558		steam->serial_no[0] = 0;
 559	}
 560}
 561
 562static void steam_work_connect_cb(struct work_struct *work)
 563{
 564	struct steam_device *steam = container_of(work, struct steam_device,
 565							work_connect);
 566	unsigned long flags;
 567	bool connected;
 568	int ret;
 569
 570	spin_lock_irqsave(&steam->lock, flags);
 571	connected = steam->connected;
 572	spin_unlock_irqrestore(&steam->lock, flags);
 573
 574	if (connected) {
 575		ret = steam_register(steam);
 576		if (ret) {
 577			hid_err(steam->hdev,
 578				"%s:steam_register failed with error %d\n",
 579				__func__, ret);
 580		}
 581	} else {
 582		steam_unregister(steam);
 583	}
 584}
 585
 586static bool steam_is_valve_interface(struct hid_device *hdev)
 587{
 588	struct hid_report_enum *rep_enum;
 589
 590	/*
 591	 * The wired device creates 3 interfaces:
 592	 *  0: emulated mouse.
 593	 *  1: emulated keyboard.
 594	 *  2: the real game pad.
 595	 * The wireless device creates 5 interfaces:
 596	 *  0: emulated keyboard.
 597	 *  1-4: slots where up to 4 real game pads will be connected to.
 598	 * We know which one is the real gamepad interface because they are the
 599	 * only ones with a feature report.
 600	 */
 601	rep_enum = &hdev->report_enum[HID_FEATURE_REPORT];
 602	return !list_empty(&rep_enum->report_list);
 603}
 604
 605static int steam_client_ll_parse(struct hid_device *hdev)
 606{
 607	struct steam_device *steam = hdev->driver_data;
 608
 609	return hid_parse_report(hdev, steam->hdev->dev_rdesc,
 610			steam->hdev->dev_rsize);
 611}
 612
 613static int steam_client_ll_start(struct hid_device *hdev)
 614{
 615	return 0;
 616}
 617
 618static void steam_client_ll_stop(struct hid_device *hdev)
 619{
 620}
 621
 622static int steam_client_ll_open(struct hid_device *hdev)
 623{
 624	struct steam_device *steam = hdev->driver_data;
 625
 626	mutex_lock(&steam->mutex);
 627	steam->client_opened = true;
 628	mutex_unlock(&steam->mutex);
 629
 630	steam_input_unregister(steam);
 631
 632	return 0;
 633}
 634
 635static void steam_client_ll_close(struct hid_device *hdev)
 636{
 637	struct steam_device *steam = hdev->driver_data;
 638
 639	unsigned long flags;
 640	bool connected;
 641
 642	spin_lock_irqsave(&steam->lock, flags);
 643	connected = steam->connected;
 644	spin_unlock_irqrestore(&steam->lock, flags);
 645
 646	mutex_lock(&steam->mutex);
 647	steam->client_opened = false;
 648	if (connected)
 649		steam_set_lizard_mode(steam, lizard_mode);
 650	mutex_unlock(&steam->mutex);
 651
 652	if (connected)
 653		steam_input_register(steam);
 654}
 655
 656static int steam_client_ll_raw_request(struct hid_device *hdev,
 657				unsigned char reportnum, u8 *buf,
 658				size_t count, unsigned char report_type,
 659				int reqtype)
 660{
 661	struct steam_device *steam = hdev->driver_data;
 662
 663	return hid_hw_raw_request(steam->hdev, reportnum, buf, count,
 664			report_type, reqtype);
 665}
 666
 667static struct hid_ll_driver steam_client_ll_driver = {
 668	.parse = steam_client_ll_parse,
 669	.start = steam_client_ll_start,
 670	.stop = steam_client_ll_stop,
 671	.open = steam_client_ll_open,
 672	.close = steam_client_ll_close,
 673	.raw_request = steam_client_ll_raw_request,
 674};
 675
 676static struct hid_device *steam_create_client_hid(struct hid_device *hdev)
 677{
 678	struct hid_device *client_hdev;
 679
 680	client_hdev = hid_allocate_device();
 681	if (IS_ERR(client_hdev))
 682		return client_hdev;
 683
 684	client_hdev->ll_driver = &steam_client_ll_driver;
 685	client_hdev->dev.parent = hdev->dev.parent;
 686	client_hdev->bus = hdev->bus;
 687	client_hdev->vendor = hdev->vendor;
 688	client_hdev->product = hdev->product;
 689	client_hdev->version = hdev->version;
 690	client_hdev->type = hdev->type;
 691	client_hdev->country = hdev->country;
 692	strlcpy(client_hdev->name, hdev->name,
 693			sizeof(client_hdev->name));
 694	strlcpy(client_hdev->phys, hdev->phys,
 695			sizeof(client_hdev->phys));
 696	/*
 697	 * Since we use the same device info than the real interface to
 698	 * trick userspace, we will be calling steam_probe recursively.
 699	 * We need to recognize the client interface somehow.
 700	 */
 701	client_hdev->group = HID_GROUP_STEAM;
 702	return client_hdev;
 703}
 704
 705static int steam_probe(struct hid_device *hdev,
 706				const struct hid_device_id *id)
 707{
 708	struct steam_device *steam;
 709	int ret;
 710
 711	ret = hid_parse(hdev);
 712	if (ret) {
 713		hid_err(hdev,
 714			"%s:parse of hid interface failed\n", __func__);
 715		return ret;
 716	}
 717
 718	/*
 719	 * The virtual client_dev is only used for hidraw.
 720	 * Also avoid the recursive probe.
 721	 */
 722	if (hdev->group == HID_GROUP_STEAM)
 723		return hid_hw_start(hdev, HID_CONNECT_HIDRAW);
 724	/*
 725	 * The non-valve interfaces (mouse and keyboard emulation) are
 726	 * connected without changes.
 727	 */
 728	if (!steam_is_valve_interface(hdev))
 729		return hid_hw_start(hdev, HID_CONNECT_DEFAULT);
 730
 731	steam = devm_kzalloc(&hdev->dev, sizeof(*steam), GFP_KERNEL);
 732	if (!steam) {
 733		ret = -ENOMEM;
 734		goto steam_alloc_fail;
 735	}
 736	steam->hdev = hdev;
 737	hid_set_drvdata(hdev, steam);
 738	spin_lock_init(&steam->lock);
 739	mutex_init(&steam->mutex);
 740	steam->quirks = id->driver_data;
 741	INIT_WORK(&steam->work_connect, steam_work_connect_cb);
 742	INIT_LIST_HEAD(&steam->list);
 743
 744	steam->client_hdev = steam_create_client_hid(hdev);
 745	if (IS_ERR(steam->client_hdev)) {
 746		ret = PTR_ERR(steam->client_hdev);
 747		goto client_hdev_fail;
 748	}
 749	steam->client_hdev->driver_data = steam;
 750
 751	/*
 752	 * With the real steam controller interface, do not connect hidraw.
 753	 * Instead, create the client_hid and connect that.
 754	 */
 755	ret = hid_hw_start(hdev, HID_CONNECT_DEFAULT & ~HID_CONNECT_HIDRAW);
 756	if (ret)
 757		goto hid_hw_start_fail;
 758
 759	ret = hid_add_device(steam->client_hdev);
 760	if (ret)
 761		goto client_hdev_add_fail;
 762
 763	ret = hid_hw_open(hdev);
 764	if (ret) {
 765		hid_err(hdev,
 766			"%s:hid_hw_open\n",
 767			__func__);
 768		goto hid_hw_open_fail;
 769	}
 770
 771	if (steam->quirks & STEAM_QUIRK_WIRELESS) {
 772		hid_info(hdev, "Steam wireless receiver connected");
 773		/* If using a wireless adaptor ask for connection status */
 774		steam->connected = false;
 775		steam_request_conn_status(steam);
 776	} else {
 777		/* A wired connection is always present */
 778		steam->connected = true;
 779		ret = steam_register(steam);
 780		if (ret) {
 781			hid_err(hdev,
 782				"%s:steam_register failed with error %d\n",
 783				__func__, ret);
 784			goto input_register_fail;
 785		}
 786	}
 787
 788	return 0;
 789
 790input_register_fail:
 791hid_hw_open_fail:
 792client_hdev_add_fail:
 793	hid_hw_stop(hdev);
 794hid_hw_start_fail:
 795	hid_destroy_device(steam->client_hdev);
 796client_hdev_fail:
 797	cancel_work_sync(&steam->work_connect);
 798steam_alloc_fail:
 799	hid_err(hdev, "%s: failed with error %d\n",
 800			__func__, ret);
 801	return ret;
 802}
 803
 804static void steam_remove(struct hid_device *hdev)
 805{
 806	struct steam_device *steam = hid_get_drvdata(hdev);
 807
 808	if (!steam || hdev->group == HID_GROUP_STEAM) {
 809		hid_hw_stop(hdev);
 810		return;
 811	}
 812
 813	hid_destroy_device(steam->client_hdev);
 814	steam->client_opened = false;
 815	cancel_work_sync(&steam->work_connect);
 816	if (steam->quirks & STEAM_QUIRK_WIRELESS) {
 817		hid_info(hdev, "Steam wireless receiver disconnected");
 818	}
 819	hid_hw_close(hdev);
 820	hid_hw_stop(hdev);
 821	steam_unregister(steam);
 822}
 823
 824static void steam_do_connect_event(struct steam_device *steam, bool connected)
 825{
 826	unsigned long flags;
 827	bool changed;
 828
 829	spin_lock_irqsave(&steam->lock, flags);
 830	changed = steam->connected != connected;
 831	steam->connected = connected;
 832	spin_unlock_irqrestore(&steam->lock, flags);
 833
 834	if (changed && schedule_work(&steam->work_connect) == 0)
 835		dbg_hid("%s: connected=%d event already queued\n",
 836				__func__, connected);
 837}
 838
 839/*
 840 * Some input data in the protocol has the opposite sign.
 841 * Clamp the values to 32767..-32767 so that the range is
 842 * symmetrical and can be negated safely.
 843 */
 844static inline s16 steam_le16(u8 *data)
 845{
 846	s16 x = (s16) le16_to_cpup((__le16 *)data);
 847
 848	return x == -32768 ? -32767 : x;
 849}
 850
 851/*
 852 * The size for this message payload is 60.
 853 * The known values are:
 854 *  (* values are not sent through wireless)
 855 *  (* accelerator/gyro is disabled by default)
 856 *  Offset| Type  | Mapped to |Meaning
 857 * -------+-------+-----------+--------------------------
 858 *  4-7   | u32   | --        | sequence number
 859 *  8-10  | 24bit | see below | buttons
 860 *  11    | u8    | ABS_HAT2Y | left trigger
 861 *  12    | u8    | ABS_HAT2X | right trigger
 862 *  13-15 | --    | --        | always 0
 863 *  16-17 | s16   | ABS_X/ABS_HAT0X     | X value
 864 *  18-19 | s16   | ABS_Y/ABS_HAT0Y     | Y value
 865 *  20-21 | s16   | ABS_RX    | right-pad X value
 866 *  22-23 | s16   | ABS_RY    | right-pad Y value
 867 *  24-25 | s16   | --        | * left trigger
 868 *  26-27 | s16   | --        | * right trigger
 869 *  28-29 | s16   | --        | * accelerometer X value
 870 *  30-31 | s16   | --        | * accelerometer Y value
 871 *  32-33 | s16   | --        | * accelerometer Z value
 872 *  34-35 | s16   | --        | gyro X value
 873 *  36-36 | s16   | --        | gyro Y value
 874 *  38-39 | s16   | --        | gyro Z value
 875 *  40-41 | s16   | --        | quaternion W value
 876 *  42-43 | s16   | --        | quaternion X value
 877 *  44-45 | s16   | --        | quaternion Y value
 878 *  46-47 | s16   | --        | quaternion Z value
 879 *  48-49 | --    | --        | always 0
 880 *  50-51 | s16   | --        | * left trigger (uncalibrated)
 881 *  52-53 | s16   | --        | * right trigger (uncalibrated)
 882 *  54-55 | s16   | --        | * joystick X value (uncalibrated)
 883 *  56-57 | s16   | --        | * joystick Y value (uncalibrated)
 884 *  58-59 | s16   | --        | * left-pad X value
 885 *  60-61 | s16   | --        | * left-pad Y value
 886 *  62-63 | u16   | --        | * battery voltage
 887 *
 888 * The buttons are:
 889 *  Bit  | Mapped to  | Description
 890 * ------+------------+--------------------------------
 891 *  8.0  | BTN_TR2    | right trigger fully pressed
 892 *  8.1  | BTN_TL2    | left trigger fully pressed
 893 *  8.2  | BTN_TR     | right shoulder
 894 *  8.3  | BTN_TL     | left shoulder
 895 *  8.4  | BTN_Y      | button Y
 896 *  8.5  | BTN_B      | button B
 897 *  8.6  | BTN_X      | button X
 898 *  8.7  | BTN_A      | button A
 899 *  9.0  | BTN_DPAD_UP    | lef-pad up
 900 *  9.1  | BTN_DPAD_RIGHT | lef-pad right
 901 *  9.2  | BTN_DPAD_LEFT  | lef-pad left
 902 *  9.3  | BTN_DPAD_DOWN  | lef-pad down
 903 *  9.4  | BTN_SELECT | menu left
 904 *  9.5  | BTN_MODE   | steam logo
 905 *  9.6  | BTN_START  | menu right
 906 *  9.7  | BTN_GEAR_DOWN | left back lever
 907 * 10.0  | BTN_GEAR_UP   | right back lever
 908 * 10.1  | --         | left-pad clicked
 909 * 10.2  | BTN_THUMBR | right-pad clicked
 910 * 10.3  | BTN_THUMB  | left-pad touched (but see explanation below)
 911 * 10.4  | BTN_THUMB2 | right-pad touched
 912 * 10.5  | --         | unknown
 913 * 10.6  | BTN_THUMBL | joystick clicked
 914 * 10.7  | --         | lpad_and_joy
 915 */
 916
 917static void steam_do_input_event(struct steam_device *steam,
 918		struct input_dev *input, u8 *data)
 919{
 920	/* 24 bits of buttons */
 921	u8 b8, b9, b10;
 922	s16 x, y;
 923	bool lpad_touched, lpad_and_joy;
 924
 925	b8 = data[8];
 926	b9 = data[9];
 927	b10 = data[10];
 928
 929	input_report_abs(input, ABS_HAT2Y, data[11]);
 930	input_report_abs(input, ABS_HAT2X, data[12]);
 931
 932	/*
 933	 * These two bits tells how to interpret the values X and Y.
 934	 * lpad_and_joy tells that the joystick and the lpad are used at the
 935	 * same time.
 936	 * lpad_touched tells whether X/Y are to be read as lpad coord or
 937	 * joystick values.
 938	 * (lpad_touched || lpad_and_joy) tells if the lpad is really touched.
 939	 */
 940	lpad_touched = b10 & BIT(3);
 941	lpad_and_joy = b10 & BIT(7);
 942	x = steam_le16(data + 16);
 943	y = -steam_le16(data + 18);
 944
 945	input_report_abs(input, lpad_touched ? ABS_HAT0X : ABS_X, x);
 946	input_report_abs(input, lpad_touched ? ABS_HAT0Y : ABS_Y, y);
 947	/* Check if joystick is centered */
 948	if (lpad_touched && !lpad_and_joy) {
 949		input_report_abs(input, ABS_X, 0);
 950		input_report_abs(input, ABS_Y, 0);
 951	}
 952	/* Check if lpad is untouched */
 953	if (!(lpad_touched || lpad_and_joy)) {
 954		input_report_abs(input, ABS_HAT0X, 0);
 955		input_report_abs(input, ABS_HAT0Y, 0);
 956	}
 957
 958	input_report_abs(input, ABS_RX, steam_le16(data + 20));
 959	input_report_abs(input, ABS_RY, -steam_le16(data + 22));
 960
 961	input_event(input, EV_KEY, BTN_TR2, !!(b8 & BIT(0)));
 962	input_event(input, EV_KEY, BTN_TL2, !!(b8 & BIT(1)));
 963	input_event(input, EV_KEY, BTN_TR, !!(b8 & BIT(2)));
 964	input_event(input, EV_KEY, BTN_TL, !!(b8 & BIT(3)));
 965	input_event(input, EV_KEY, BTN_Y, !!(b8 & BIT(4)));
 966	input_event(input, EV_KEY, BTN_B, !!(b8 & BIT(5)));
 967	input_event(input, EV_KEY, BTN_X, !!(b8 & BIT(6)));
 968	input_event(input, EV_KEY, BTN_A, !!(b8 & BIT(7)));
 969	input_event(input, EV_KEY, BTN_SELECT, !!(b9 & BIT(4)));
 970	input_event(input, EV_KEY, BTN_MODE, !!(b9 & BIT(5)));
 971	input_event(input, EV_KEY, BTN_START, !!(b9 & BIT(6)));
 972	input_event(input, EV_KEY, BTN_GEAR_DOWN, !!(b9 & BIT(7)));
 973	input_event(input, EV_KEY, BTN_GEAR_UP, !!(b10 & BIT(0)));
 974	input_event(input, EV_KEY, BTN_THUMBR, !!(b10 & BIT(2)));
 975	input_event(input, EV_KEY, BTN_THUMBL, !!(b10 & BIT(6)));
 976	input_event(input, EV_KEY, BTN_THUMB, lpad_touched || lpad_and_joy);
 977	input_event(input, EV_KEY, BTN_THUMB2, !!(b10 & BIT(4)));
 978	input_event(input, EV_KEY, BTN_DPAD_UP, !!(b9 & BIT(0)));
 979	input_event(input, EV_KEY, BTN_DPAD_RIGHT, !!(b9 & BIT(1)));
 980	input_event(input, EV_KEY, BTN_DPAD_LEFT, !!(b9 & BIT(2)));
 981	input_event(input, EV_KEY, BTN_DPAD_DOWN, !!(b9 & BIT(3)));
 982
 983	input_sync(input);
 984}
 985
 986/*
 987 * The size for this message payload is 11.
 988 * The known values are:
 989 *  Offset| Type  | Meaning
 990 * -------+-------+---------------------------
 991 *  4-7   | u32   | sequence number
 992 *  8-11  | --    | always 0
 993 *  12-13 | u16   | voltage (mV)
 994 *  14    | u8    | battery percent
 995 */
 996static void steam_do_battery_event(struct steam_device *steam,
 997		struct power_supply *battery, u8 *data)
 998{
 999	unsigned long flags;
1000
1001	s16 volts = steam_le16(data + 12);
1002	u8 batt = data[14];
1003
1004	/* Creating the battery may have failed */
1005	rcu_read_lock();
1006	battery = rcu_dereference(steam->battery);
1007	if (likely(battery)) {
1008		spin_lock_irqsave(&steam->lock, flags);
1009		steam->voltage = volts;
1010		steam->battery_charge = batt;
1011		spin_unlock_irqrestore(&steam->lock, flags);
1012		power_supply_changed(battery);
1013	}
1014	rcu_read_unlock();
1015}
1016
1017static int steam_raw_event(struct hid_device *hdev,
1018			struct hid_report *report, u8 *data,
1019			int size)
1020{
1021	struct steam_device *steam = hid_get_drvdata(hdev);
1022	struct input_dev *input;
1023	struct power_supply *battery;
1024
1025	if (!steam)
1026		return 0;
1027
1028	if (steam->client_opened)
1029		hid_input_report(steam->client_hdev, HID_FEATURE_REPORT,
1030				data, size, 0);
1031	/*
1032	 * All messages are size=64, all values little-endian.
1033	 * The format is:
1034	 *  Offset| Meaning
1035	 * -------+--------------------------------------------
1036	 *  0-1   | always 0x01, 0x00, maybe protocol version?
1037	 *  2     | type of message
1038	 *  3     | length of the real payload (not checked)
1039	 *  4-n   | payload data, depends on the type
1040	 *
1041	 * There are these known types of message:
1042	 *  0x01: input data (60 bytes)
1043	 *  0x03: wireless connect/disconnect (1 byte)
1044	 *  0x04: battery status (11 bytes)
1045	 */
1046
1047	if (size != 64 || data[0] != 1 || data[1] != 0)
1048		return 0;
1049
1050	switch (data[2]) {
1051	case STEAM_EV_INPUT_DATA:
1052		if (steam->client_opened)
1053			return 0;
1054		rcu_read_lock();
1055		input = rcu_dereference(steam->input);
1056		if (likely(input))
1057			steam_do_input_event(steam, input, data);
1058		rcu_read_unlock();
1059		break;
1060	case STEAM_EV_CONNECT:
1061		/*
1062		 * The payload of this event is a single byte:
1063		 *  0x01: disconnected.
1064		 *  0x02: connected.
1065		 */
1066		switch (data[4]) {
1067		case 0x01:
1068			steam_do_connect_event(steam, false);
1069			break;
1070		case 0x02:
1071			steam_do_connect_event(steam, true);
1072			break;
1073		}
1074		break;
1075	case STEAM_EV_BATTERY:
1076		if (steam->quirks & STEAM_QUIRK_WIRELESS) {
1077			rcu_read_lock();
1078			battery = rcu_dereference(steam->battery);
1079			if (likely(battery)) {
1080				steam_do_battery_event(steam, battery, data);
1081			} else {
1082				dbg_hid(
1083					"%s: battery data without connect event\n",
1084					__func__);
1085				steam_do_connect_event(steam, true);
1086			}
1087			rcu_read_unlock();
1088		}
1089		break;
1090	}
1091	return 0;
1092}
1093
1094static int steam_param_set_lizard_mode(const char *val,
1095					const struct kernel_param *kp)
1096{
1097	struct steam_device *steam;
1098	int ret;
1099
1100	ret = param_set_bool(val, kp);
1101	if (ret)
1102		return ret;
1103
1104	mutex_lock(&steam_devices_lock);
1105	list_for_each_entry(steam, &steam_devices, list) {
1106		mutex_lock(&steam->mutex);
1107		if (!steam->client_opened)
1108			steam_set_lizard_mode(steam, lizard_mode);
1109		mutex_unlock(&steam->mutex);
1110	}
1111	mutex_unlock(&steam_devices_lock);
1112	return 0;
1113}
1114
1115static const struct kernel_param_ops steam_lizard_mode_ops = {
1116	.set	= steam_param_set_lizard_mode,
1117	.get	= param_get_bool,
1118};
1119
1120module_param_cb(lizard_mode, &steam_lizard_mode_ops, &lizard_mode, 0644);
1121MODULE_PARM_DESC(lizard_mode,
1122	"Enable mouse and keyboard emulation (lizard mode) when the gamepad is not in use");
1123
1124static const struct hid_device_id steam_controllers[] = {
1125	{ /* Wired Steam Controller */
1126	  HID_USB_DEVICE(USB_VENDOR_ID_VALVE,
1127		USB_DEVICE_ID_STEAM_CONTROLLER)
1128	},
1129	{ /* Wireless Steam Controller */
1130	  HID_USB_DEVICE(USB_VENDOR_ID_VALVE,
1131		USB_DEVICE_ID_STEAM_CONTROLLER_WIRELESS),
1132	  .driver_data = STEAM_QUIRK_WIRELESS
1133	},
1134	{}
1135};
1136
1137MODULE_DEVICE_TABLE(hid, steam_controllers);
1138
1139static struct hid_driver steam_controller_driver = {
1140	.name = "hid-steam",
1141	.id_table = steam_controllers,
1142	.probe = steam_probe,
1143	.remove = steam_remove,
1144	.raw_event = steam_raw_event,
1145};
1146
1147module_hid_driver(steam_controller_driver);