Max number of Report ID for HID over GATT (Custom Generic HID over GATT)

RE: Max number of Report ID for HID over GATT (Custom Generic HID over GATT)

ovrebekk — Tue, 26 May 2020 08:17:36 GMT

Hi Jose

I am sorry for the slow response. I haven't been able to do much work in the devzone lately.

Are you still having issues with this?

If so I will set aside some time in the coming days to look into it.

Feel free to share anything you might have discovered over the last couple of weeks that could be helpful.

Best regards
Torbjørn

RE: Max number of Report ID for HID over GATT (Custom Generic HID over GATT)

Jose Pablo Castro Valverde — Tue, 12 May 2020 14:43:00 GMT

I checked but it does not indicate any error.
I am studying the keyboard example that used a buffer to avoid the stack to fill up.

Any suggestion of how to do it?

Thanks and best regards,

Jose Pablo

RE: Max number of Report ID for HID over GATT (Custom Generic HID over GATT)

ovrebekk — Tue, 12 May 2020 12:20:30 GMT

Hi Jose

Did you check the return value of the send function?

If the buffers in the stack fill up you will get a specific error code (NRF_ERROR_RESOURCES), and you need to wait for a TX complete event to occur before you can send more data.

Best regards
Torbjørn

RE: Max number of Report ID for HID over GATT (Custom Generic HID over GATT)

Jose Pablo Castro Valverde — Mon, 11 May 2020 03:34:05 GMT

Hi Ovrebekk.

I got another question.

I am trying to send a sequence of packets but I failed when I send more than 5 packets.

There is any event or flag I should wait until send the next packets?

Thanks and Best Regards,

Jose Pablo

RE: Max number of Report ID for HID over GATT (Custom Generic HID over GATT)

Jose Pablo Castro Valverde — Fri, 08 May 2020 14:27:01 GMT

Hi Ovrebekk.
This is what it says synaptic

I hope it will be useful.

Keep me posted if this is a know issue.

Meanwhile I keep debugging on the VM. I already make it works with an open source driver. My Open 3D Mouse make Blender and FreeCAD rotate when I push a buttons. It still needs more debugging, but I am moving forward.

Thanks and Best Regards,

Jose

RE: Max number of Report ID for HID over GATT (Custom Generic HID over GATT)

ovrebekk — Fri, 08 May 2020 13:29:56 GMT

Hi Jose

Thanks for sharing your results.

I will ask one of my more Linux proficient colleagues if this is a known issue.

Do you know which version of bluez you are running in Ubuntu 18.04?

Best regards
Torbjørn

RE: Max number of Report ID for HID over GATT (Custom Generic HID over GATT)

Jose Pablo Castro Valverde — Thu, 07 May 2020 02:04:47 GMT

Hi Overbekk

I tested with a VM using Ubuntu 20.04 and it work there.

It is definitely a problem on the O.S Kernel/driver side.

For the meantime I will debugging using the VM until the Ubuntu 18.04 be ready for migration to Ubuntu 20.04.

I never suspected that the problem were on the Kernel/driver side.

Thanks and Best Regards,

Jose

RE: Max number of Report ID for HID over GATT (Custom Generic HID over GATT)

Jose Pablo Castro Valverde — Wed, 06 May 2020 17:38:10 GMT

Hi Ovrebekk.

It's not a SoftDevice problem. It has to do with the O.S kernel and the driver.

I successfully sniff the packet in windows.

I got only one nRF52840-DK so I can't use it as sniffer.

This is what I did, so others could use this information.

Wireshark does not support bluetooth on windows as it does on Linux, but, it does support USB.

So I use a bluetooth dongle and capture the usb packets.

Steps:

Disabled the default bluetooth hardware on Device Manager (in case of a laptop that have that hardware integrated)
Connect a Bluetooth Dongle (USB).
Start Wireshark as administrator
Select capture USB
Start capturing USB packets
Pair the bluetooth device you are debugging
Filter in wireshark the packets letting only "btatt"
Gets the packets you are looking for.

I got another error on windows relate to the driver.

The first txt it's the Generic HID Device with only input reports

devzone.nordicsemi.com/.../DeviceManager_5F00_Open_5F00_3DMouse.txt

The second txt file is the Generic HID Device with input and output reports

devzone.nordicsemi.com/.../DeviceManager_5F00_Open_5F00_3DMouse_5F00_no_5F00_output_5F00_report.txt

Any help to make windows to understand the device and do no get this error?

Meanwhile I will continue developing in Linux and try on windows.

I am using Ubuntu 18.04 and maybe there's a problem with the kernel drivers because they are two year old.

I am going to try with a VM and Ubuntu 20.04 and other Distro to see if the problem persist.

Thanks and Best Regards,

Jose,

RE: Max number of Report ID for HID over GATT (Custom Generic HID over GATT)

ovrebekk — Wed, 06 May 2020 09:11:03 GMT

Hi Jose

Is the sd_ble_gatts_characteristic_add(..), or any other SoftDevice calls, returning an error code?

The SoftDevice is very mature at this point and I would say it is highly unlikely that it is not handling the handle values correctly, as this would cause issues for a large number of our customers.

I am not used to reading HCI captures in Wireshark, but the packets received during service discovery are a bit confusing. There seems to be limited data included in the read responses, it keeps receiving the HID Service UUID over and over on multiple handles.

Are you able to use a Nordic DK or dongle to get a trace of the Bluetooth communication directly?

As you might be aware we have a free sniffer solution that also uses Wireshark as the frontend.

Best regards
Torbjørn

RE: Max number of Report ID for HID over GATT (Custom Generic HID over GATT)

Jose Pablo Castro Valverde — Tue, 05 May 2020 07:52:07 GMT

Hi,
I resolved that problem. I just need more memory.
I change the NRF_SDH_BLE_GATTS_ATTR_TAB_SIZE on the sdk_config.h and update the Segger Embedded Studio project file so the memory map now is this:
linker_section_placement_macros="FLASH_PH_START=0x0;FLASH_PH_SIZE=0x100000;RAM_PH_START=0x20000000;RAM_PH_SIZE=0x40000;FLASH_START=0x27000;FLASH_SIZE=0xd9000;RAM_START=0x200032e0;RAM_SIZE=0x3cd20"

Now it allow more than 3 report id. But, I found a couple of more problem.
The first was the inp_rep_array[],m for some reason reset part of its value. Don't knwo why.

I solved it declaring inp_rep_array[] as a global static variable and initialized in a header file like this:
static ble_hids_inp_rep_init_t inp_rep_array[] =
{
{//Index 0
.max_len = INPUT_REP_MOUSE_LEN
, .rep_ref.report_id = HID_REP_MOUSE_ID
, .rep_ref.report_type= BLE_HIDS_REP_TYPE_INPUT
, .sec.cccd_wr = SEC_JUST_WORKS
, .sec.wr = SEC_JUST_WORKS
, .sec.rd = SEC_JUST_WORKS
}
,{//Index 1
.max_len = INPUT_REP_JOYSTICK_LEN
, .rep_ref.report_id = HID_REP_JOYSTICK_ID
, .rep_ref.report_type= BLE_HIDS_REP_TYPE_INPUT
, .sec.cccd_wr = SEC_JUST_WORKS
, .sec.wr = SEC_JUST_WORKS
, .sec.rd = SEC_JUST_WORKS
}
,{//Index 2
.max_len = INPUT_REP_MULTI_AXIS_LEN
, .rep_ref.report_id = HID_REP_MULTI_AXIS_ID
, .rep_ref.report_type= BLE_HIDS_REP_TYPE_INPUT
, .sec.cccd_wr = SEC_JUST_WORKS
, .sec.wr = SEC_JUST_WORKS
, .sec.rd = SEC_JUST_WORKS
}
,{//Index 3
.max_len = INPUT_REP_3D_DIGITIZER_LEN
, .rep_ref.report_id = HID_REP_3D_DIGITIZER_ID
, .rep_ref.report_type= BLE_HIDS_REP_TYPE_INPUT
, .sec.cccd_wr = SEC_JUST_WORKS
, .sec.wr = SEC_JUST_WORKS
, .sec.rd = SEC_JUST_WORKS
}
#ifdef USE_OUTPUT_REPORT
,{//Index 4
.max_len = INPUT_REP_CONTROL_LEN
, .rep_ref.report_id = HID_REP_CONTROL_ID
, .rep_ref.report_type= BLE_HIDS_REP_TYPE_INPUT
, .sec.cccd_wr = SEC_JUST_WORKS
, .sec.wr = SEC_JUST_WORKS
, .sec.rd = SEC_JUST_WORKS
}
#endif
};

Now I am trying to use the output report so I can send packets to the nRF52840 using the report id 5.

I am debugging with wireshark and the segger studio.

I found this. The m_hids.rep_map_handles.value is set as 0x002d but the wireshark indicates that the host (GNU/Linus Ubuntu 18.04) is asking for the report map on the handle 0x0026 and its getting zeros:

I kept looking with the segger debugger but I hit a wall in this function called :

SVCALL(SD_BLE_GATTS_CHARACTERISTIC_ADD, uint32_t, sd_ble_gatts_characteristic_add(uint16_t service_handle, ble_gatts_char_md_t const *p_char_md, ble_gatts_attr_t const *p_attr_char_value, ble_gatts_char_handles_t *p_handles));

I am assuming that call for the SoftDevice S140 v7.0.1, and that is a black box, so I can't continue debugging.

I also tried the ble_his_keyboard example using the hex file that comes with the SDK 16.0.0 without changing anything and the wireshark indicates exactly the same behavior.

My conclusion: The O.S (bluez driver probably), it's asking for the report map using the handle 0x0026 but the nRF52840 have that information on the handle 0x002d and for that reason the OS is getting zeros instead of the report map descriptor.

I recommend experiment with the ble_hids_keyboard example on GNU/Linux Ubuntu 18.04 with wireshark to reproduce the error and try to find the bug.

I have worked as Verification and Validation engineer for pre-silicon (Verilog, System Verilog, E), so, debugging and find bugs is like my second nature.

Let me know if there's anything I can change on the source code, even the SDK, so I can continue developing.

Have fun tracing that bug. (It also could be a bug on the OS/diver instead of the SoftDevice)

Thanks and Best Regards,

Jose Pablo,

P.S: I attached the wireshark packets captured and the kernel logging messages related to the Nordir Keyboard Example that failed to pass the report map.
I used the hex file that come with the SDK 16.0.0 ble_app_hids_keyboard_pca10056_s140.hex

devzone.nordicsemi.com/.../Nordic_5F00_Keyboard_5F00_Example_5F00_Kernel_5F00_log.txt devzone.nordicsemi.com/.../Nordic_5F00_Keyboard_5F00_Example.pcapng

RE: Max number of Report ID for HID over GATT (Custom Generic HID over GATT)

ovrebekk — Tue, 05 May 2020 07:27:03 GMT

Hi Jose

There shouldn't be a limit on the number of different reports, but when doing HID over GATT the size of the report descriptor is limited by the maximum size of a BLE attribute, which is 512 bytes.

Can you confirm whether or not your descriptor is larger or smaller than this?

Best regards
Torbjørn