Problem with some keys using nRF Desktop with iPad/Apple products

[Glen M]

Hi,

My customer tried using the keyboard we made based on nRF Desktop with NCS version 2.1.0 with an iPad and noticed that most of the keys work, but space bar does not, and caps lock does not.

I suspected something was up with the HID descriptor so I've been digging into that all day, and I've been troubleshooting it using an nRF52840-DK with the excellent Nordic-provided Bluetooth sniffer code on it with Wireshark.

I found that the keyboard is advertising that its report map is at characteristic handle 3a, but when the iPad tries to read the report map from that characteristic it fails. So the iPad not getting the HID report map might explain the strange behavior I'm seeing.

I turned on RTT debugging and I see the error happening there, too: "bt_l2cap: Ignoring data for unknown channel ID 0x003a"

I tried searching for that error text and I found a DevZone post about it where Nordic Support declared that it was no big deal and could be ignored, but it seems too much of a coincidence that this could explain the issues I'm having.  That support ticket is here:

 Bluetooth: Ignoring data for unknown channel ID 0x003a 

That characteristic is under the BT_UUID_HIDS_REPORT_MAP_VAL characteristic (0x2a4b) I found in \nRF_Connect\v2.1.0\zephyr\include\zephyr\bluetooth\uuid.h

but so far I haven't found the place in the Bluetooth code that associates the channel ID of 3a with the report map.

Help! Has this perhaps been solved in a later version of NCS? I've avoided upgrading because a lot of stuff has changed in NCS since I started this project and the last time I tried upgrading the error list I got make it seem like it was going to be a lot of work to upgrade.

I've attached a couple of screenshots from my Wireshark capture showing where the device is advertising its report map on 3A and then throwing an error when the host tries to read it.

Thanks,

Glen

[Glen M]

I just tried it using my second nRF52840-DK with the latest NCS 2.61 and a new instance of nRF Desktop. The ID has changed slightly, but the error still exists.

[Sigurd]

Hi!

Glen M said:

I just tried it using my second nRF52840-DK with the latest NCS 2.61 and a new instance of nRF Desktop.

This was with out-of-the-box nrf_desktop application?

ith an iPad and noticed that most of the keys work, but space bar does not, and caps lock does not.

Is it only on the iPad /iOS this is an issue? Does it work as expected on Windows and Android ?

BR,

Sigurd

[Glen M]

On further testing, I've found that they keyboard portion of this combined keyboard/trackpad product starts working fine when I remove the following configuration options that add in the mouse report - so it seems that the iPad doesn't like my combined keyboard/mouse report:

CONFIG_DESKTOP_HID_REPORT_MOUSE_SUPPORT=y

CONFIG_DESKTOP_HID_MOUSE=y

It seems that the iPad doesn't like something about the combined keyboard/mouse report. I will continue to try to debug, but any help you can provide would be greatly appreciated.

I've also been experimenting with these defines but increasing them beyond what I have here does not help:

CONFIG_BT_HIDS_INPUT_REP_MAX=6
CONFIG_BT_HIDS_OUTPUT_REP_MAX=2
CONFIG_BT_HIDS_FEATURE_REP_MAX=2
CONFIG_BT_HIDS_ATTR_MAX=50

Is there a way to break this up into two separate HID reports?

Thanks,

Glen

[Glen M]

I've been trying to understand the failure to read the report map characteristic. I found the place where the RTT log prints out the "Ignoring data for unknown channel ID x" error, which is in bt_l2cap_le_lookup_rx_cid(). I modified that function so that I can break in it and see the list of CIDs it checks through when it fails to find the requested one. I'm new to all of this HID stuff so I don't understand all of what I'm seeing, but I noticed something interesting that might help:
The ID that is requested is 0x3A. In the Wireshark capture from the Bluetooth sniffer I can see that the packet where the device reports its readable/writable characteristics to the host is labeled with as Bluetooth Attribute Protocol, "ATT". It lists 12 characteristics, with the Report Map as Characteristic Handle 0x3a, Attribute Data handle 0x39. See image below:

When I look at the request from the iPad that ultimately gets rejected, I see that it's asking for ATT protocol attribute 0x3a, on L2CAP CID 4, which is one of my L2CAP CIDs..

But when the bt_l2cap_le_lookup_rx_cid function runs, that seems to be searching through the L2CAP CID list... which I think is the wrong list for an ATT characteristic. The CIDs it searches through when trying to match the 0x3A are: 5, 6, and 4 (with mtu = 23).

It looks to me like the Nordic library code should see this request and say "Ah - they are asking for characteristic #0x3a on L2CAP CID 4. I see that I have a L2CAP CID #4, so let me kick this request up to the Bluteooth Attribute Protocol layer to retrieve that requested value. Whereas what it's doing now is saying "Nope... I don't have an L2CAP CID 0x3a. ERROR!".

Here's a snapshot of the request that fails:

Here's a snapshot of the failure:

[Glen M]

Any thoughts on this from Nordic? This issue is urgent.

[Sigurd]

Hi Glen!

The "bt_l2cap: unknown channel ID 0x003a" is a red herring, it's standard that iOS devices sends this.

What iPadOS version and iPad generation are you testing with?

Note that connecting a Bluetooth accessory to your iPad requires iPadOS 13.4 or later. 

I will try to get an iPad today, and see if I can recreate the issue here.

[Glen M]

Thanks Sigurd - I'm using a 10th gen iPad with iPadOS version 16.3.1