GamePad
Gamepad
General information
The gamepads have 11 buttons, 2 triggers, 2 sticks and 1 D-Pad. The wired gamepad has a regular USB connector, the wireless uses the RF Module in the Xbox360. Both talk the same USB protocol.
The Play and Charge Kit for the wireless controller only provides power and a trickle charge. It does not change the wireless controller to a wired controller. The USB data lines are not active on the play and charge kit. It will not charge AA rechargeable batteries. The trickle charge is only available at the four prong jack at the bottom of the battery compartment. The play and charge can be plugged into any USB port, it does not have to be one on the 360.
The gamepad HID device
The gamepad is a regular USB HID device, but it has been crippled in a slight way:
The device uses the 0xff DeviceClass ('Vendor Specific') while normal HID devices use 0x03. Therefore normal HID drivers won't attach to it automatically. The device has no USB Report Descriptor, making the operating system unable to determine its device layout. Both problems are not hard to overcome; some operating systems (the BSDs for example) already override the USB Report Descriptors for some devices because they were shipped with broken ones.
A replacement report descriptor is available from the Free60 CVS repository. The layout of this descriptor is the same as the Windows driver, except that the big X button has been mapped to button 11. On Windows, it's unmapped.
Input report
Once in a while, a USB HID device sends back a so-called input report which contains all information about its current state. The length of the input report is the same as the original Xbox gamepad; 20 bytes.
Its button/trigger/pad/stick alignment is as listed below:
Offset Length (bits) Description Windows driver 0x00.0 8 Message type 0x01.0 8 Packet size (20 bytes = 0x14) 0x02.0 1 D-Pad up D-Pad up 0x02.1 1 D-Pad down D-Pad down 0x02.2 1 D-Pad left D-Pad left 0x02.3 1 D-pad right D-Pad right 0x02.4 1 Start button Button 8 0x02.5 1 Back button Button 7 0x02.6 1 Left stick press Button 9 0x02.7 1 Right stick press Button 10 0x03.0 1 Button LB Button 5 0x03.1 1 Button RB Button 6 0x03.2 1 Xbox logo button 0x03.3 1 Unused 0x03.4 1 Button A Button 1 0x03.5 1 Button B Button 2 0x03.6 1 Button X Button 3 0x03.7 1 Button Y Button 4 0x04.0 8 Left trigger Z-axis down 0x05.0 8 Right trigger Z-axis up 0x06.0 16 Left stick X-axis X-axis 0x08.0 16 Left stick Y-axis Y-axis 0x0a.0 16 Right stick X-axis X-turn 0x0c.0 16 Right stick Y-axis Y-turn 0x0e.0 48 Unused
All eight-bit values are unsigned. The 16-bit values are signed little-endian. The first byte (Message type) will be 0x01 for a LED status message and 0x00 for a normal input report message.
Output report
LED Control
Some control over the LEDs surrounding the XBox button is provided, corresponding to the markings 1, 2, 3 and 4. This is controlled using message type 0x01.
To select a new pattern for the LEDs, send a 3-byte packet of the following form:
0103XX
0x01 is the message type, 0x03 is the message length, and 0xXX is the desired pattern:
Pattern Description 0x00 All off 0x01 All blinking 0x02 1 flashes, then on 0x03 2 flashes, then on 0x04 3 flashes, then on 0x05 4 flashes, then on 0x06 1 on 0x07 2 on 0x08 3 on 0x09 4 on 0x0A Rotating (e.g. 1-2-4-3) 0x0B Blinking* 0x0C Slow blinking* 0x0D Alternating (e.g. 1+4-2+3), then back to previous*
The previous setting will be used for any itmes with * (all blinking, or 1, 2, 3 or 4 on).
Rumbler Control
Rumbling is also similar to on the original controller. Rumble commands take the following 8-byte form:
000800bbll000000
Where b is the speed to set the motor with the big weight, and l is the speed to set the small weight (0x00 to 0xFF in both cases).
The headset-port
Headset Port File:Headset port pinout.jpg Pinout for the headset port on the wired and wireless Xbox 360 controller Baud Rate: Unknown, Data 1: RX or TX, Data 2: RX or TX
A chatpad (mini-keyboard) for text entry can be plugged into this port.
The headset data protocol
FreeBSD ships with a driver called ugen(4) which is just a fallback driver for USB devices that do not have a matching driver. It allows you to read and write to the descriptors of the device. Descriptor 3 is used for the microphone. Descriptor 4 is the earpiece.
At this moment there isn't a lot of information available about the transfer protocol. The protocol for the microphone and the earpiece are the same, but the latter one uses half the sample rate of the first one. The following test shows this:
$ cat /dev/ugen0.3 > myvoice # tell a funny joke to the microphone and press ^C $ cat myvoice > /dev/ugen0.4 Playback will take twice as long.
The microphone emits 8000 bytes per second of 4 bits signed PCM, thus it's 16 KHz. The earpiece only consumes 4000 bytes, so it can only emit 8 KHz PCM (4 KHz sound at best).
lsusb output
Linux's lsusb utility tells us the following about the gamepad.
Bus 002 Device 003: ID 045e:028e Microsoft Corp.
Device Descriptor:
bLength 18
bDescriptorType 1
bcdUSB 2.00
bDeviceClass 255 Vendor Specific Class
bDeviceSubClass 255 Vendor Specific Subclass
bDeviceProtocol 255 Vendor Specific Protocol
bMaxPacketSize0 8
idVendor 0x045e Microsoft Corp.
idProduct 0x028e
bcdDevice 1.10
iManufacturer 1
iProduct 2
iSerial 3
bNumConfigurations 1
Configuration Descriptor:
bLength 9
bDescriptorType 2
wTotalLength 153
bNumInterfaces 4
bConfigurationValue 1
iConfiguration 0
bmAttributes 0xa0
(Bus Powered)
Remote Wakeup
MaxPower 500mA
Interface Descriptor:
bLength 9
bDescriptorType 4
bInterfaceNumber 0
bAlternateSetting 0
bNumEndpoints 2
bInterfaceClass 255 Vendor Specific Class
bInterfaceSubClass 93
bInterfaceProtocol 1
iInterface 0
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x81 EP 1 IN
bmAttributes 3
Transfer Type Interrupt
Synch Type None
Usage Type Data
wMaxPacketSize 0x0020 1x 32 bytes
bInterval 4
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x02 EP 2 OUT
bmAttributes 3
Transfer Type Interrupt
Synch Type None
Usage Type Data
wMaxPacketSize 0x0020 1x 32 bytes
bInterval 8
Interface Descriptor:
bLength 9
bDescriptorType 4
bInterfaceNumber 1
bAlternateSetting 0
bNumEndpoints 4
bInterfaceClass 255 Vendor Specific Class
bInterfaceSubClass 93
bInterfaceProtocol 3
iInterface 0
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x83 EP 3 IN
bmAttributes 3
Transfer Type Interrupt
Synch Type None
Usage Type Data
wMaxPacketSize 0x0020 1x 32 bytes
bInterval 2
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x04 EP 4 OUT
bmAttributes 3
Transfer Type Interrupt
Synch Type None
Usage Type Data
wMaxPacketSize 0x0020 1x 32 bytes
bInterval 4
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x85 EP 5 IN
bmAttributes 3
Transfer Type Interrupt
Synch Type None
Usage Type Data
wMaxPacketSize 0x0020 1x 32 bytes
bInterval 64
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x05 EP 5 OUT
bmAttributes 3
Transfer Type Interrupt
Synch Type None
Usage Type Data
wMaxPacketSize 0x0020 1x 32 bytes
bInterval 16
Interface Descriptor:
bLength 9
bDescriptorType 4
bInterfaceNumber 2
bAlternateSetting 0
bNumEndpoints 1
bInterfaceClass 255 Vendor Specific Class
bInterfaceSubClass 93
bInterfaceProtocol 2
iInterface 0
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x86 EP 6 IN
bmAttributes 3
Transfer Type Interrupt
Synch Type None
Usage Type Data
wMaxPacketSize 0x0020 1x 32 bytes
bInterval 16
Interface Descriptor:
bLength 9
bDescriptorType 4
bInterfaceNumber 3
bAlternateSetting 0
bNumEndpoints 0
bInterfaceClass 255 Vendor Specific Class
bInterfaceSubClass 253
bInterfaceProtocol 19
iInterface 4
UNRECOGNIZED: 06 41 00 01 01 03
Speculation
Rumors that both the wired gamepad and wireless dongle share the same interface, but probably won't have the same USB device IDs. The last six bytes of the input descriptor are for analog face buttons. The information on the web is contradictory. I know that the controller did have pressure sensitive face buttons originally. Some web sites now say that it does not, so they must have been scrapped. Others say that it still does have them. If it does not the bytes are just a relic, but if the controler does have the analog buttons then there must be some form of toggle mechanism.