HOGP Report Descriptor >255 bytes

[Kenji Kozai]

Hello,

I am working on a Raspberry Pi Pico W and trying to get an HID device working over BLE that has a HID Report Descriptor that is 313 bytes long. The descriptor gets set using

hids_device_init_with_storage(0, desc_hid_report, desc_hid_report_len, NUM_REPORT_IDS, dev_report_storage);

where desc_hid_report contains my descriptor and desc_hid_report_len is a uint16_t. However, when I go to connect the Pico W to my host device, it reads the descriptor as the first 313-256=57 bytes of desc_hid_report. So this clearly seems to be an overflow of a uint8_t.

When I use a report descriptor that is <255 bytes long, everything works fine and the full report descriptor is picked up by the host upon connection. I've tried to trace this through the btstack code as much as possible, but everything I'm seeing uses uint16_t for lengths, so I am at a loss as to where my uint16_t desc_hid_report_len is being interpreted as a uint8_t.

I also tried searching around to see if it's a configuration issue in btstack_config.h or in the .gatt file, but didn't see anything obvious there either. I've tried increasing MAX_ATT_DB_SIZE, but that doesn't seem to resolve the apparent 255 byte limit on the length of the report map characteristic. Is an individual characteristic of 512 bytes (which I think is supported by BLE specs) not supported by btstack, or is there some config option that I'm missing?

Thanks for the help,

Kenji

[Matthias Ringwald]

Hi Kenji

The size field in hids_device_report_t is only 8-bit currently. Could you try to change that to uint16_t and let me know if this helps?

Cheers, Matthias

Sent from my iPhone

On 11 Aug 2025, at 08:18, Kenji Kozai <kko...@gmail.com> wrote:



--
You received this message because you are subscribed to the Google Groups "btstack-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email to btstack-dev...@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/btstack-dev/402efbe5-aa7a-4a40-8ca6-18d9f4128bf1n%40googlegroups.com.

[Kenji Kozai]

Hi Matthias,

I just gave that a shot. I changed the size field in hids_device_report_t within src/ble/gatt-service/hids_device.h from uint8_t to uint16_t. The HID report descriptor as found from /sys/kernel/debug/hid/.../rdesc is still cut off after the first 57 bytes.

If I am not mistaken, isn't the hids_device_report_t for handling the individual report IDs and not the HID report descriptor? The HID report descriptor seems to be stored in a hids_device_t in the hid_descriptor field, where the hid_descriptor_size is declared as uint16_t. From what I can tell, whenever it gets passed around, e.g. in att_read_callback (att_handle == instance->hid_report_map_handle), the calls are all with length parameters that are uint16_t, so I'm having trouble figuring out where it's getting miscast as uint8_t and causing the HID report descriptor/map to get truncated.

Kenji

You received this message because you are subscribed to a topic in the Google Groups "btstack-dev" group.
To unsubscribe from this topic, visit https://groups.google.com/d/topic/btstack-dev/wZWUd7fjDTo/unsubscribe.
To unsubscribe from this group and all its topics, send an email to btstack-dev...@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/btstack-dev/406773E6-968D-45F5-916F-6E1D8F1FA3E5%40gmail.com.

[Matthias Ringwald]

Hi Kenji

Could you either:
- provide test code for both sides using BTstack (e.g. hid_keyboard_demo + hid_host_demo) that allow to reproduce this
- provide HCI log files to see what ATT Requests are exchange, which might give a hint to what's going on.

Cheers
Matthias

> To view this discussion visit https://groups.google.com/d/msgid/btstack-dev/3e613e6c-96b0-4df2-a2a3-e8f91984cd1b%40gmail.com.

[Kenji Kozai]

HI Matthias,

Thanks for the quick responses. While trying to put together a minimal example, I found (perhaps unsurprisingly) that there was one place in my own code where the length variable was declared as uint8_t instead of uint16_t that I had not caught. Once I fixed that, everything was working as expected - 313 byte HID report descriptor was successfully set using BTstack.

Apologies for the mistake, and thank you for your time nonetheless.

Sincerely,

Kenji