Gamepad
General information
The gamepads have 11 buttons, 2 triggers, 2 sticks and 1 D-Pad. The wired gamepad has a regular USB connector, the wireless uses the RF Module in the Xbox360. Both talk the same USB protocol.
The Play and Charge Kit for the wireless controller only provides power and a trickle charge. It does not change the wireless controller to a wired controller. The USB data lines are not active on the play and charge kit. It will not charge AA rechargeable batteries. The trickle charge is only available at the four prong jack at the bottom of the battery compartment. The play and charge can be plugged into any USB port, it does not have to be one on the 360.
The gamepad HID device
The gamepad is a regular USB HID device, but it has been crippled in a slight way:
- The device uses the 0xff DeviceClass ('Vendor Specific') while normal HID devices use 0x03. Therefore normal HID drivers won't attach to it automatically.
- The device has no USB Report Descriptor, making the operating system unable to determine its device layout.
Both problems are not hard to overcome; some operating systems (the BSDs for example) already override the USB Report Descriptors for some devices because they were shipped with broken ones.
A replacement report descriptor is available from the Free60 CVS repository. The layout of this descriptor is the same as the Windows driver, except that the big X button has been mapped to button 11. On Windows, it's unmapped.
Input report
Once in a while, a USB HID device sends back a so-called input report which contains all information about its current state. The length of the input report is the same as the original Xbox gamepad; 20 bytes.
Its button/trigger/pad/stick alignment is as listed below:
| Offset | Length (bits) | Description | Windows driver |
|---|---|---|---|
| 0x00.0 | 8 | Message type | |
| 0x01.0 | 8 | Packet size (20 bytes = 0x14) | |
| 0x02.0 | 1 | D-Pad up | D-Pad up |
| 0x02.1 | 1 | D-Pad down | D-Pad down |
| 0x02.2 | 1 | D-Pad left | D-Pad left |
| 0x02.3 | 1 | D-pad right | D-Pad right |
| 0x02.4 | 1 | Start button | Button 8 |
| 0x02.5 | 1 | Back button | Button 7 |
| 0x02.6 | 1 | Left stick press | Button 9 |
| 0x02.7 | 1 | Right stick press | Button 10 |
| 0x03.0 | 1 | Button LB | Button 5 |
| 0x03.1 | 1 | Button RB | Button 6 |
| 0x03.2 | 1 | Xbox logo button | |
| 0x03.3 | 1 | Unused | |
| 0x03.4 | 1 | Button A | Button 1 |
| 0x03.5 | 1 | Button B | Button 2 |
| 0x03.6 | 1 | Button X | Button 3 |
| 0x03.7 | 1 | Button Y | Button 4 |
| 0x04.0 | 8 | Left trigger | Z-axis down |
| 0x05.0 | 8 | Right trigger | Z-axis up |
| 0x06.0 | 16 | Left stick X-axis | X-axis |
| 0x08.0 | 16 | Left stick Y-axis | Y-axis |
| 0x0a.0 | 16 | Right stick X-axis | X-turn |
| 0x0c.0 | 16 | Right stick Y-axis | Y-turn |
| 0x0e.0 | 48 | Unused |
All eight-bit values are unsigned. The 16-bit values are signed little-endian. The first byte (Message type) will be 0x01 for a LED status message and 0x00 for a normal input report message.
Output report
LED Control
Some control over the LEDs surrounding the XBox button is provided, corresponding to the markings 1, 2, 3 and 4. This is controlled using message type 0x01.
To select a new pattern for the LEDs, send a 3-byte packet of the following form:
0103XX
0x01 is the message type, 0x03 is the message length, and 0xXX is the desired pattern:
| Pattern | Description |
|---|---|
| 0x00 | All off |
| 0x01 | All blinking |
| 0x02 | 1 flashes, then on |
| 0x03 | 2 flashes, then on |
| 0x04 | 3 flashes, then on |
| 0x05 | 4 flashes, then on |
| 0x06 | 1 on |
| 0x07 | 2 on |
| 0x08 | 3 on |
| 0x09 | 4 on |
| 0x0A | Rotating (e.g. 1-2-4-3) |
| 0x0B | Blinking* |
| 0x0C | Slow blinking* |
| 0x0D | Alternating (e.g. 1 4-2 3), then back to previous* |
The previous setting will be used for any itmes with * (all blinking, or 1, 2, 3 or 4 on).
Rumbler Control
Rumbling is also similar to on the original controller. Rumble commands take the following 8-byte form:
000800bbll000000
Where b is the speed to set the motor with the big weight, and l is the speed to set the small weight (0x00 to 0xFF in both cases).
The headset-port
- Headset Port
Baud Rate: Unknown, Data 1: RX or TX, Data 2: RX or TX
A chatpad (mini-keyboard) for text entry can be plugged into this port.
The headset data protocol
FreeBSD ships with a driver called ugen(4) which is just a fallback driver for USB devices that do not have a matching driver. It allows you to read and write to the descriptors of the device. Descriptor 3 is used for the microphone. Descriptor 4 is the earpiece.
At this moment there isn't a lot of information available about the transfer protocol. The protocol for the microphone and the earpiece are the same, but the latter one uses half the sample rate of the first one. The following test shows this:
$ cat /dev/ugen0.3 > myvoice # tell a funny joke to the microphone and press ^C $ cat myvoice > /dev/ugen0.4
Playback will take twice as long.
The microphone emits 8000 bytes per second of 4 bits signed PCM, thus it's 16 KHz. The earpiece only consumes 4000 bytes, so it can only emit 8 KHz PCM (4 KHz sound at best).
lsusb output
Linux's lsusb utility tells us the following about the gamepad.
Bus 002 Device 003: ID 045e:028e Microsoft Corp.
Device Descriptor:
bLength 18
bDescriptorType 1
bcdUSB 2.00
bDeviceClass 255 Vendor Specific Class
bDeviceSubClass 255 Vendor Specific Subclass
bDeviceProtocol 255 Vendor Specific Protocol
bMaxPacketSize0 8
idVendor 0x045e Microsoft Corp.
idProduct 0x028e
bcdDevice 1.10
iManufacturer 1
iProduct 2
iSerial 3
bNumConfigurations 1
Configuration Descriptor:
bLength 9
bDescriptorType 2
wTotalLength 153
bNumInterfaces 4
bConfigurationValue 1
iConfiguration 0
bmAttributes 0xa0
(Bus Powered)
Remote Wakeup
MaxPower 500mA
Interface Descriptor:
bLength 9
bDescriptorType 4
bInterfaceNumber 0
bAlternateSetting 0
bNumEndpoints 2
bInterfaceClass 255 Vendor Specific Class
bInterfaceSubClass 93
bInterfaceProtocol 1
iInterface 0
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x81 EP 1 IN
bmAttributes 3
Transfer Type Interrupt
Synch Type None
Usage Type Data
wMaxPacketSize 0x0020 1x 32 bytes
bInterval 4
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x02 EP 2 OUT
bmAttributes 3
Transfer Type Interrupt
Synch Type None
Usage Type Data
wMaxPacketSize 0x0020 1x 32 bytes
bInterval 8
Interface Descriptor:
bLength 9
bDescriptorType 4
bInterfaceNumber 1
bAlternateSetting 0
bNumEndpoints 4
bInterfaceClass 255 Vendor Specific Class
bInterfaceSubClass 93
bInterfaceProtocol 3
iInterface 0
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x83 EP 3 IN
bmAttributes 3
Transfer Type Interrupt
Synch Type None
Usage Type Data
wMaxPacketSize 0x0020 1x 32 bytes
bInterval 2
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x04 EP 4 OUT
bmAttributes 3
Transfer Type Interrupt
Synch Type None
Usage Type Data
wMaxPacketSize 0x0020 1x 32 bytes
bInterval 4
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x85 EP 5 IN
bmAttributes 3
Transfer Type Interrupt
Synch Type None
Usage Type Data
wMaxPacketSize 0x0020 1x 32 bytes
bInterval 64
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x05 EP 5 OUT
bmAttributes 3
Transfer Type Interrupt
Synch Type None
Usage Type Data
wMaxPacketSize 0x0020 1x 32 bytes
bInterval 16
Interface Descriptor:
bLength 9
bDescriptorType 4
bInterfaceNumber 2
bAlternateSetting 0
bNumEndpoints 1
bInterfaceClass 255 Vendor Specific Class
bInterfaceSubClass 93
bInterfaceProtocol 2
iInterface 0
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x86 EP 6 IN
bmAttributes 3
Transfer Type Interrupt
Synch Type None
Usage Type Data
wMaxPacketSize 0x0020 1x 32 bytes
bInterval 16
Interface Descriptor:
bLength 9
bDescriptorType 4
bInterfaceNumber 3
bAlternateSetting 0
bNumEndpoints 0
bInterfaceClass 255 Vendor Specific Class
bInterfaceSubClass 253
bInterfaceProtocol 19
iInterface 4
UNRECOGNIZED: 06 41 00 01 01 03
Speculation
Rumors that both the wired gamepad and wireless dongle share the same interface, but probably won't have the same USB device IDs.- The last six bytes of the input descriptor are for analog face buttons. The information on the web is contradictory. I know that the controller did have pressure sensitive face buttons originally. Some web sites now say that it does not, so they must have been scrapped. Others say that it still does have them. If it does not the bytes are just a relic, but if the controler does have the analog buttons then there must be some form of toggle mechanism.