Thrustmaster T248R Support

[renfordt]

I'm currently struggeling to set up my T248R.

OS: CachyOS

I have installed hid-tmff2 and also oversteer via AUR both seem to work in general but instead of a T248R a T300RS is selected in the compatibility mode, with no other selections in that dropdown possible. I have the T3PM pedals.

The steering wheel seems to work in general, but the buttons don't work at all.

Clutch, brakes and accelerator are swapped in oversteer and also don't react properly (only 0, 0,5 or 1; not really floating)
Accelerator is clutch, breaks are accelerator and clutch is break.

If you give me some hints how to get the correct values, I can also create a pull request and make it working (hopefully).

[Kimplul]

Hello, thanks for the report. I hadn't heard of the T248R before, I just have the 'regular' T248 so this is potentially new territory. Could you post the output of sudo dmesg -w when connecting the wheel?

[renfordt]

Of course here it is:

[19473.029585] usb 1-2.4: new full-speed USB device number 21 using xhci_hcd
[19473.257847] usb 1-2.4: New USB device found, idVendor=044f, idProduct=b66d, bcdDevice= 2.49
[19473.257855] usb 1-2.4: New USB device strings: Mfr=1, Product=2, SerialNumber=0
[19473.257857] usb 1-2.4: Product: Thrustmaster Racing Wheel FFB
[19473.257859] usb 1-2.4: Manufacturer: Thrustmaster
[19473.305958] input: Thrustmaster Thrustmaster Racing Wheel FFB as /devices/pci0000:00/0000:00:02.1/0000:03:00.0/0000:04:0c.0/0000:0b:00.0/usb1/1-2/1-2.4/1-2.4:1.0/0003:044F:B66D.0018/input/input40
[19473.306070] tmff2 0003:044F:B66D.0018: input,hiddev96,hidraw1: USB HID v1.11 Gamepad [Thrustmaster Thrustmaster Racing Wheel FFB] on usb-0000:0b:00.0-2.4/input0
[19473.311810] tmff2 0003:044F:B66D.0018: firmware version 1 might be too old, consider updating
[19473.311811] tmff2 0003:044F:B66D.0018: note: this has to be done through Windows.
[19473.317811] tmff2 0003:044F:B66D.0018: force feedback for T300RS

[Kimplul]

[...]044F:B66D[...]

044F is the manufacturer ID for Thrustmaster, and B66D is the ID they previously used for the T300. Looks like Thrustmaster decided to re-use the same ID for another wheel, and since this driver currently only looks at the product ID to check which wheel is being connected, the driver gets confused and thinks its talking to a T300.

There's been some previous discussion about this, for instance B689 has been used for a couple different wheels, including the T818. We tried to figure out some way to ask the wheel directly what device it actually is, but that didn't really go anywhere last time around: #143 (comment)

To help figure out a possible solution to this, I think the best approach would be to do some packet captures on Windows of connecting the wheel. I would assume that if there is a way to check the 'actual' wheel model, the Windows driver does that during initialization and we can compare the USB responses that your T248R and my T300 get. There's a section in the wiki about this: https://github.com/Kimplul/hid-tmff2/wiki#how-to-add-in-support-for-a-new-t-series-wheel

Feel free to ask for clarification or advice if you decide to help out. It's perfectly fine to not want to as well, getting the captures going and analyzing them etc. can take some effort, be warned.

[renfordt]

So I finally had the time to set up everything and got everything running in the virtual machine. But now I got a bit stuck with getting all the related data.

For example I have this packet during startup of Windows VM, do I need it? If yes, what exactly am I looking for?

[Kimplul]

For example I have this packet during startup of Windows VM, do I need it?

Perhaps :)

If yes, what exactly am I looking for?

I don't know what the packet format is, so I don't really know which bits/packets we might be interested in. I had a theory that turned out to not hold in the comment linked above, so for now I guess any initialization-related packet might be worth studying in some detail. I'll do some fresh captures with my T300 and share them here, please do the same with your wheel so we can both try to compare captures and hopefully identify some fields that could potentially be something like a model ID. I'll probably do some captures with my T248 as a third point of comparison, and maybe eventually try to get some other users involved with other wheels.

I'll try to get my captures done soon^TM, but in the meantime I have some older captures of my T300 over in https://github.com/Kimplul/hid-tmff2/tree/pcaps, feel free to have a look if you like. Not sure how useful they are since they represent a way older driver, but at least they're available immediately.

[renfordt]

Interesting thing I have noticed during playing around with the VM:
When setting up the VM I added the USB device 044f:b66d. After I have started the VM and shut it down even before logging in to Windows, I get the error that the USB device is not found anymore on next start of the VM. Instead there is a new Wheel with the id 044f:b696. Maybe this help further.

Edit: On each startup of windows VM it changes to 044f:b696

[renfordt]

t248r_.zip
Here are the first captures. If you need anything else let me know.

• t248r_windows_boot → capture while booting Windows VM
• t248r_open_TM_Panel_and_turning → Opening TM Panel and manually turning the wheel
• t248r_noise → 30 seconds of random noise without doing anything
• t248r_FEdit_sine_stop → Run a sine wave in FEdit, but somehow it abruptly stopped after turning to the left
• t248r_FEdit_sine → Run a sine wave in FEdit, this time it worked

[Kimplul]

When setting up the VM I added the USB device 044f:b66d.

That's expected, Thrustmaster has a kind of weird two-step initialization where the wheel first shows up as a 'Thrustmaster Generic FFB Device' with the above ID, which then requires that the wheel be told what model it actually is. When it receives this information, it restarts itself and connects as the wheel proper. The first stage is handled by a separate driver, https://github.com/Kimplul/hid-tminit and the second stage is where this driver steps in to handle FFB etc.

Here are the first captures. If you need anything else let me know.

Thanks, I'll have a look and upload my captures as soon as I'm able.

[Kimplul]

Hi, sorry about the unfortunate delay. Accepted a PhD position, kept me pretty busy lately :)

Here's captures of my t300rs and t248, they should be of the same 'thing' as your t248r_windows_boot.pcapng. I didn't think to mention but capturing the outgoing packets is useful as well, since Wireshark can use the type of the outgoing packet to annotate incoming ones as well, so my captures will look a bit different from yours.

I'll have to look over the captures in some more detail, but so far it seems like at least what I've previously dubbed the 'firmware packet', packet number 59 in t248r_windows_boot.pcapng seems to keep the same prefix of 56 as my T300 (see packet 54 in t300rs-second-stage.png and 42 in t248-init.pcapng) and the other three bytes encode the firmware version (major, minor, revision). Not maybe super useful, but it's reassuring to see that there are at least comparable packets across the different wheels.

One packet that's maybe useful for us is (40 in t248-init.pcapng, 58 in t248r_windows_boot.pcapng and 40 in t300rs-second-stage.pcapng) which has an identical control response data ending between your T248 and mine, but is otherwise different compared to my T300 (I also added the T-GT for comparison, found the capture here):

Wheel	Response
T300	49 00 03 01 01 00 06 02 13 00 00 00 05 05 00 00
T248	49 00 03 08 01 00 00 0a 00 04 00 00 0b 0b 00 00
T248R	49 00 03 0f 01 00 00 10 00 04 00 00 0b 0b 00 00
T-GT	49 00 03 02 01 00 08 05 b1 00 00 00 08 01 00 00

There's also packet numbers 56 in t248-init.pcapng, 49 in t248r_windows_boot.pcapng and 38 in t300rs-second-stage.pcapng which seem to be identical between the T248 and T248R, while the T300RS is slightly different.

I would assume that the T248R, being a separate revision from the 'plain' T248, would indicate it somehow, which maybe points towards the 49 00 03 ... packet maybe containing the model and revision ID, encoded some way or other.

Not entirely sure how to proceed, gathering more data from different wheels could be useful. I'm particularly curious how wheels with attachments might show up, could indicate which fields are the 'base' of the wheel, which at least for now we're mainly interested in. To start with, we could potentially just compare the whole packet, although I suspect that breaks down fairly quickly. I might look through old issues if anyone with interesting hardware has already provided captures, but there's probably slim pickings. I might ping some people as well.

[Kimplul]

There's also packet numbers 56 in t248-init.pcapng, 49 in t248r_windows_boot.pcapng and 38 in t300rs-second-stage.pcapng which seem to be identical between the T248 and T248R, while the T300RS is slightly different.

I just realized those packets are apparently HID packets and transfer the rdesc, I just didn't have HID decoding enabled in Wireshark. That arguably makes them less interesting, as I would imagine that HID data would not include the type of information that we're after here.

[renfordt]

t248r_ v02.zip
So here is now again the capture, this time with in and outgoing connection. Similar procedure as before.
What I noticed, after the boot of windows the usb address changes from 1.18 to 1.19. Therefore I have added one more capture: after_boot is the same capture like win_boot but I changed the filter from 1.18 to 1.19.
Also I added one for the pedals.

If you need anything just let me know.

[Kimplul]

A PR was opened up about adding (or at least improving?) support for the T598, where the submitter detects the T598 based on the bcdDevice field. I had a look at it seems like it might be a fairly reliable way to detect other variants of the T248, your wheel reports itself as 0x249 whereas my T248 uses 0x248 and my T300 0X1000. Not sure about wheels like the T818 yet.

[Kimplul]

PR in question: #205

[InforesightConsulting]

@Kimplul Really appreciate your efforts here! Any news on the T248R support, particularly with regards to force feedback?

[Kimplul]

@InforesightConsulting thanks for the ping, I set up a new branch t248r where I added a check for the bcdDevice thing reported above, which should initialize the T248R as a 'regular' T248. Please try it out and report back, I'm really not sure what to expect.