CC254x HID Project – Name changing feature added

After many weeks working on this particular feature, I have finally succeeded. Strangely enough, the solution is so simple, making all the other ways I have thought of seems dumb and unnecessary.

The name is stored in CC2540/1’s non-volatile (NV) memory. Along with the name, its CRC checksum and length are stored in separate NV memory slots as well. Upon start-up, the name and its CRC value is retrieved from the NV memory. A new CRC value is generated from the stored name and compared with the stored CRC value. If the two CRC values matches, the device will go on and set this stored name as the scan response data string and the device’s name. Otherwise, it will use the default names.

Before today, I have been trying the idea of dynamically allocating an array and filling it with appropriate elements to make up a new scan response. This approach has been fruitless. Then I realized, why not use the static scan response variable that is going to be available every time the device starts up and modify its elements instead. This new approach works flawlessly (after only a few tests).

The code should be pushed and available on Git (one of those repositories) soon enough. However, for future debugging, these are the relevant sections to this feature:

0. Local variables and constants

#define SNV_ID_DEVICE_NAME              0x80
#define SNV_ID_DEVICE_NAME_LENGTH       0x81
#define SNV_ID_DEVICE_NAME_CRC          0x82

uint8 *device_name_crc;
uint8 *device_name;
uint8 *device_name_length;
    
// GAP Profile - Name attribute for SCAN RSP data - Name shown up when scanned
static uint8 default_scanData[] =
{
  0x15,                             // length of this data => (name's size = 20 bytes) + 1
  GAP_ADTYPE_LOCAL_NAME_COMPLETE,   // AD Type = Complete local name
  'H',
  'I',
  'D',
  ' ',
  'K',
  'e',
  'y',
  'b',
  'o',
  'a',
  'r',
  'd',
  ' ',
  '&',
  ' ',
  'M',
  'o',
  'u',
  's',
  'e'
};

1. Local functions

//Pololu's CRC functions with minimal changes
uint8 CRCPoly = 0x89;  // the value of our CRC-7 polynomial
uint8 CRCTable[256];

void GenerateCRCTable()
{
    int i, j;
 
    // generate a table value for all 256 possible byte values
    for (i = 0; i < 256; i++)
    {
        CRCTable[i] = (i & 0x80) ? i ^ CRCPoly : i;
        for (j = 1; j < 8; j++)
        {
            CRCTable[i] <<= 1;
            if (CRCTable[i] & 0x80)
                CRCTable[i] ^= CRCPoly;
        }
    }
}
 
 
// adds a message byte to the current CRC-7 to get a the new CRC-7
uint8 CRCAdd(uint8 CRC, uint8 message_byte)
{
    return CRCTable[(CRC << 1) ^ message_byte];
}
 
 
// returns the CRC-7 for a message of "length" bytes
uint8 getCRC(uint8 message[], uint8 length)
{
    uint8 i;
    uint8 CRC = 0;
 
    for (i = 0; i < length; i++)
        CRC = CRCAdd(CRC, message[i]);
 
    return CRC;
}

3. Initialization in hidKbdMouse.c

void HidKbdMouse_Init( uint8 task_id )
{
  setupUART();
  GenerateCRCTable();
//......

4. Name checking during initlization

//about line 354 in source code
if(*device_name_crc != getCRC(device_name, *device_name_length)) {
      printf("Using default scan response name\r\n");
      GAPRole_SetParameter( GAPROLE_SCAN_RSP_DATA, sizeof ( default_scanData ), default_scanData );
    } else {      
      //make changes directly to the default_scanData. Since this variable is set at start-up, it should not matter
      uint8 len = *device_name_length;
      uint8 default_name_length = default_scanData[0];
      default_scanData[0] = len + 1;
      uint8 i;
      for(i = 0; i < len; i++) {
        default_scanData[i+2] = device_name[i];
      }      
      GAPRole_SetParameter( GAPROLE_SCAN_RSP_DATA, sizeof ( default_scanData ), default_scanData );
    }

//...
//about line 377 in source code
 if(*device_name_crc != getCRC(device_name, *device_name_length)) {
    GGS_SetParameter( GGS_DEVICE_NAME_ATT, GAP_DEVICE_NAME_LEN, (void *) attDeviceName );
  } else {
    GGS_SetParameter( GGS_DEVICE_NAME_ATT, *device_name_length + 1, (void *) device_name );
  }

5. UART name changing section

//...
else if((rxBuffer[1] == 'N') && (rxBuffer[2] == ',')) {
      uint8 i;
      uint8 deviceNewName[20];
      uint8 deviceNewNameLength;
      uint8 deviceNewNameCRC;
      
      deviceNewNameLength = rxBufferIndex-3;
      if(deviceNewNameLength > 20) {
        printf("Name exceeds permitted length\r\n");
      } else {
        for(i = 3; i < rxBufferIndex; i++) {
          deviceNewName[i-3] = rxBuffer[i];
        }   
        deviceNewName[deviceNewNameLength] = '\0';
        deviceNewNameCRC = getCRC(deviceNewName, deviceNewNameLength);

        osal_snv_write(SNV_ID_DEVICE_NAME, 20, deviceNewName);
        osal_snv_write(SNV_ID_DEVICE_NAME_LENGTH, 1, &deviceNewNameLength);
        osal_snv_write(SNV_ID_DEVICE_NAME_CRC, 1, &deviceNewNameCRC);
        printf("Name is being set, reset to set new name\r\n");
      }
  • To change the device’s scan response data and device’s name, first it must be put into CMD mode by sending 3’s @, ie. @@@
  • Then, the name can be set to be stored with SN,<value> where is the new name and it must be less than 20 characters long.
  • To see changes, the device needs to be restarted with S,R.

Ceasing development for CC254x BLE HID project

Windows 7 does not have any support for Bluetooth Low Energy stack. There are 3rd party commercial products, but who would want to install additional costly software just to use a keyboard/mouse combo. I do not have a Windows 8 machine and because of this particular reason, a few features of the HID stack cannot be developed and tested, such as LED reports, remote wake-up, etc. Although I have a touch-only tablet that supports BLE, using it for testing is not enjoyable and it cannot be tested for mouse feature.

The only do-able feature left to be implemented is the name change via serial. After this feature is implemented, the development of the project will be ceased.

Plans for ThinkClamp v0.7

ThinkClamp Pre-Ultimatum

In version 0.7, the ThinkClamp hardware and firmware will be completely re-designed.

It will use an inverter RC circuit to reset the TrackPoint using the clock line instead of a pin. This opens up the UART port which allows the MCU to talk to various Bluetooth modules. If this does not work well, the user will have the option to connect the RX line back to the TrackPoint’s reset line like before. Bluetooth communication should not be interfered as many of these Bluetooth modules mostly listens for commands instead of sending out any. Bluetooth modules that can be soldered onto the board includes HC-05, HC-06 and HM-10, in which HID firmware can be programmed.

The board will feature a single cell LiPo charging station with JST 2.0mm connector, which is the battery connector for many remote controlled airplanes and helicopter batteries. Just go to a model shop and try out the batteries until one fits. LEDs are included on-board to indicate whether if battery charging status. Charging will be done through connecting the board to a power source through the micro-USB connector. If a battery is not used, the header next to the BSL button may be connected to allow 5V from the USB to flow straight to the circuit.

The microcontroller is chosen to be compatible with a MSP430F5510 and MSP430F5508. With different firmwares, the board can function as a Bluetooth keyboard and mouse combo or a USB keyboard and mouse combo. The footprint will be TQFP with 0.5mm pitch, which is much easier to solder compared to QFN like the F5502 used in v0.6. The crystal used for USB functions has been replaced with a cheap resonator.

The rows and columns of the keyboard adapter will be connected to different pins on the MSP430, hoping to use its interrupts to save power when user is not typing.

There will be two ways to program the MSP430 as well as the Bluetooth on-board such as the HM-10 using a custom firmware. Debuggers can be connected to the 2.54mm headers or using a TagConnect cable.

HID firmware on HC-06 Bluetooth modules

371412603_147

TL;DR – HC-05/06 shares the same MCU used in the RN-42HID and RN-41HID. You can dump the firmware from these HID modules and transfer it onto the HC-05/06 modules. Doing so may infringe Roving Network’s intellectual property so it’s best if you don’t distribute their firmware. I post this because I found it interesting.

For educational purposes, I’ve been playing with these HC-05, HC-06 Bluetooth modules. They are cheap, widely available and their firmware can be changed. But the best thing about these modules is the microcontroller BC417 that is used to handle all their logic, the CSR Bluecore4-Ext, which shall be referred to from now as BC4-Ext.

CSR BC4 is available in different flavours, so far I’ve heard of BC4-Ext and BC4-ROM. The ‘Ext’ uses an external ROM to store some data, what, I can’t remember. These guys are the core of many Bluetooth modules, including the ones from Bluegiga and Roving Networks.

I have been learning to program these modules to handle UART communication to send HID key codes but it was difficult. The resources on this is quite limited and since Bluetooth 2.0 was so 2004, CSR Support website wasn’t of much help.

I wrote a custom firmware for the HM-10 CC2540/1 but it requires Bluetooth 4.0. For a keyboard and mouse, what good would Bluetooth 4.0 do. Bluetooth 2.0 is much more suitable as it is compatible with almost all Bluetooth devices that has been around for the last 10 years. In slight frustration, I gave in and bought a BlueSmirf RN-42-HID from Sparkfun. After reading the datasheet, however, it turns out they also use CSR BC4-Ext! This is great news.

The BlueSmirf arrived yesterday. After searching for the pinout of the RN-42, I soldered some jumper cables to its SPI pins and used a USB SPI programmer that is CSR-compatible and dump the firmware with BlueFlash. After flashing this firmware onto a HC-06 module, voilà, I now have an exact copy of a RN-42-HID in firmware.

There is still the issue of conflicting Bluetooth addresses, but may that be resolved by changing the PSR settings. Byron’s blogpost gives some steps on how this can be done. And of course, the firmware of the RN-42-HID will not be shared.

Saving a pin with an inverter buffer and a RC circuit

Up to now, I’ve been connecting the ThinkPad keyboard’s TrackPoint RESET line straight to the microcontroller. This takes up a pin and has been preventing me from adding features to the adapter, like Bluetooth or maybe some external serial communication.

Using an RC circuit to create a RESET is not new, but I just thought of it recently and finally got time to try it out. The test circuit below includes some insight into how the circuit works. The capacitor’s value of 20uF is the minimum, it can be higher, or the resistor value can be increased. Either way, increasing either will increase the time required to charge/discharge the RC circuit.

Inverter RC Circuit

Here’s the circuit in action. As you can see, during normal data transfer, RESET line remains LOW. There’s a small jitter after the TrackPoint is reset, but increasing the values of the resistor-capacitor circuit would fix this easily.

Logic Analyzer Test

During planning, I used various online calculators for charging and discharging time. Why bother doing manual calculations. The calculated time is ideal. It can be slightly higher or slightly lower. In this case, the charging and discharging time is slightly higher. Instead of 600us, the time taken to charge is measured to be 633us.

Bluetooth HID Firmware Tested on HM-10

Months ago, I wrote a firmware to convert any HM-10 to a Bluetooth Low Energy HID device. The HM-10 arrived and today I finally have some spare time to test it out. Flashing the HM-10 wasn’t straightforward as I thought it would be, due to the confusing VDD lines from the CC Debugger. So here’s how mine’s connected:

CC Debugger - HM-10

 

The LED on the CC Debugger should lit green, indicating it has found the CC2541 or CC2540 on the HM-10. After that, Texas Instruments SmartRF Flash Programmer was used to program the chip.

A MSP430 Launchpad was used with this test program:

#include <msp430.h>
#include <stdint.h>
#include "KBD_HUT.h"

void printf(char *format, ...);
void pressKey(uint8_t keyCode);
void releaseKey(uint8_t keyCode);
void sendKbdReport(void);
void sendMouseReport(void);
void buildMouseReport(void);

typedef struct {
 uint8_t buttons;
 uint8_t dX;
 uint8_t dY;
 uint8_t dZ;
} MOUSE_REPORT;

uint8_t index = 1;
MOUSE_REPORT mouseReport = { 0, 0, 0, 0 }; // HID report, to be sent to the PC.

const int8_t tableSinCosLookUp[16][2]; 

void main(void) {
 WDTCTL = WDTPW | WDTHOLD; // Stop watchdog timer

 BCSCTL1 = CALBC1_1MHZ;
 DCOCTL = CALDCO_1MHZ;

 //setup UART
 P1SEL = BIT1 + BIT2 ; // P1.1 = RXD, P1.2=TXD
 P1SEL2 = BIT1 + BIT2 ; // P1.1 = RXD, P1.2=TXD
 UCA0CTL1 |= UCSSEL_2; // SMCLK
 // 1000000 Hz 57600 bps
 UCA0BR0 = 0x11;
 UCA0BR1 = 0x00;
 UCA0MCTL = UCBRS_3 + UCBRF_0;
 UCA0CTL1 &= ~UCSWRST; // **Initialize USCI state machine**

 //setup LED
 P1OUT = 0;
 P1DIR |= BIT0;
 //setup button
 P1DIR &= ~BIT3;
 P1OUT |= BIT3; //pull-up, active low
 P1REN |= BIT3;

 while(1) {
 if((P1IN & BIT3) == BIT3) {
 releaseKey(hutSpacebar);
 P1OUT &= ~BIT0;
 } else {
 __delay_cycles(1000);
 if((P1IN & BIT3) != BIT3) {
 P1OUT |= BIT0;
 pressKey(hutSpacebar);

 buildMouseReport();
 sendMouseReport();
 }
 }
 sendKbdReport();
 }
}

void buildMouseReport(void) {
 mouseReport.dX =
 (tableSinCosLookUp[index][0] -
 tableSinCosLookUp[index - 1][0]) >> 1;
 mouseReport.dY =
 (tableSinCosLookUp[index][1] -
 tableSinCosLookUp[index - 1][1]) >> 1;

 if (index++ >= 90){
 index = 1;
 }
}

void pressKey(uint8_t keyCode) {
 printf("KD%c\r\n", keyCode); //send keycode as a character
}

void releaseKey(uint8_t keyCode) {
 printf("KU%c\r\n", keyCode); //send keycode as a character
}

void sendKbdReport(void) {
 printf("KUPDATE\r\n");
}

void sendMouseReport(void) {
 printf("M%c%c%c%c\r\n",mouseReport.buttons,mouseReport.dX,mouseReport.dY,mouseReport.dZ);
}

const int8_t tableSinCosLookUp[16][2] = {
 4,0,
 4,0,
 4,0,
 4,0,
 4,0,
 4,0,
 4,0,
 4,0,
 4,0,
 4,0,
 -4,0,
 -4,0,
 -4,0,
 -4,0,
 -4,0,
 -4,0,
 -4,0,
 -4,0
};

The test program demonstrates the Bluetooth HID firmware’s keyboard capability beautifully but there’s still a hiccup with the mouse movement, definitely because of that poor looking look-up table.

I shall have the TrackPoint setup and tested in a few days. Until then, thanks for reading and have fun!

ThinkClamp v0.6 Support: FAQ and Customizing Keyboard Matrix

This blog post answers a few frequently asked questions and describes the difference between the two firmwares provided as well as outlines the steps to obtain the matrix of a ThinkPad keyboard connected to the computer via a ThinkClamp PCB, for both version 0.6.2 and version 0.6.1 Rev 1.1.

Frequently Asked Questions

  1. Will the board design and source code be made open-source? No.
  2. What are the maximum dimensions of a populated board? 50x50x6.5mm.
  3. Will you be making a case? Yes, but in a very distant future.
  4. Will there be a Bluetooth version? Yes, the Bluetooth implementation is currently in progress.
  5. I am only interested in using the TrackPoint as a mouse, how do I use it with your board? If you are only interested in the TrackPoint, there’s no need to get my boards. Grab an Arduino Micro or Leonardo and load in Felix Klee’s TrackPoint example.
  6. Where can I get the components? Local electronic parts shop, element14, Digikey, RS, Mouser…
  7. How do I flash the firmware? The steps to flash the firmware is provided on the product page, but here are the steps anyway.
    • Download TI MSP430 USB Firmware Upgrade Example
    • Start the program, click Next, read and accept the terms
    • Unplug USB cable if it’s plugged in
    • Hold down BSL button while re-inserting the cable
    • Release the BSL button. The software should now detect the device
    • Choose ‘Select firmware’ and browse to the firmware downloaded. Difference outlined in Customizing firmware’s keyboard matrix section below.
    • Click ‘Upgrade firmware’ to flash the device
  8. A lot of keys are not showing up, what’s going on? Resolder the MSP430. Make sure all the pins are soldered.
  9. Some of the pin are not showing up and I’ve made sure all the pins are soldered? You may have a different keyboard matrix. Keep reading this blog post.

Customizing firmware’s keyboard matrix

In the firmware folder on Mediafire, you will find two text files: ThinkClamp_v0.6.txt and ThinkClamp_v0.6_datapipe.txt. These two firmware will send keyboard and mouse reports to the computer and allow the module to function as a normal keyboard. However, beside sending keyboard and mouse to the computer, ThinkClamp_v0.6_datapipe will also send a string consisting of the row and column of the pressed key to the computer via a generic 64-byte report (more information on report format can be found in Texas Instruments’ USB HID Datapipe documentation).

Using ThinkClamp_v0.6_datapipe, matrix of any ThinkPad keyboard can be found, providing the keyboard’s plug fit into the receptacle provided. The steps to get the matrix are as follow:

  1. Flash the firmware onto the chip via USB BSL or SBW
  2. Download TI’s Java_HID_Demo. If the link is broken, find the zip from MSP430 USB Developers Package page.
  3. Extract and run HidDemo.jar
  4. Click OK as we will be entering a different PIDoops
  5. Enter 0x0967 into the PID input box and click “Set VID PID”. The window will become:
  6. Click on the button above “Not Initialized”. The cross icon will become a green tick. The log window will print “Connected to device VID: 8263 PID 2407”.
  7. Now, as you type, printable and non-printable keys, the row and column pair will be printed (as row,col) in which both row and column starts at 0

You may want to wait a bit between each key presses as there seems to be a small delay between when a key is pressed and when its row and column is displayed. This latency only appears when in used matrix is being found.

To create a new firmware with this newly found matrix, the keys found need to be converted to its corresponding hex value in the USB HID Usage Table’s keyboard values on page 53. For example, this is my ThinkPad US T60 keyboard matrix:

NADA correspond to a 0x00. This means there is no key at this matrix position. After matching the keys to its corresponding key codes, it is then organized into a 8×16 matrix and written into the firmware text file after address F000 as follows. FN3QIJ5HW4OJQFA