All right a quick update.
The problem was that the gamepad isn't using the Service Discovery Protocol correctly. This causes the discovery to stop prematurely because it can't parse the response. To fix this we have to patch a file in the ESP-IDF named esp-idf/components/bt/host/bluedroid/stack/sdp/sdp_discovery.c.
In the function static *save_attr_seq add the following lines:
UINT32 seq_len, attr_len;
UINT16 attr_id;
UINT8 type, *p_seq_end;
tSDP_DISC_REC *p_rec;
type = *p++;
//start of patch
if ((type >> 3) == UINT_DESC_TYPE) {
//this could potentially read random data and crash your program
p-=4;
type = *p++;
}
//end of patch
if ((type >> 3) != DATA_ELE_SEQ_DESC_TYPE) {
SDP_TRACE_WARNING ("SDP - Wrong type, want data sequence: 0x%02x in attr_rsp\n", type);
return (NULL);
}
I don't know why but the SDP wants you to have 2 sequences at the beginning of the response and the gamepad only sends one. The first sequence is discarded anyway so we make it think the first sequence is the second one. The documentation on this is in the bluetooth spec which has 3000 pages and can be found if you look for the pdf on google.
With this fixed I was able to run the HID host demo from the idf:
I (8878) ESP_HIDH_DEMO: a0:5a:5c:14:fa:d5 OPEN:
BDA:a0:5a:5c:14:fa:d5, Status: OK, Connected: YES, Handle: 0, Usage: GAMEPAD
Name: , Manufacturer: , Serial Number:
PID: 0x2009, VID: 0x057e, VERSION: 0x0001
Report Map Length: 170
VENDOR OUTPUT REPORT, ID: 18, Length: 48
VENDOR OUTPUT REPORT, ID: 17, Length: 48
VENDOR OUTPUT REPORT, ID: 16, Length: 48
VENDOR OUTPUT REPORT, ID: 1, Length: 48
VENDOR INPUT REPORT, ID: 63, Length: 11
VENDOR INPUT REPORT, ID: 51, Length: 361
VENDOR INPUT REPORT, ID: 50, Length: 361
VENDOR INPUT REPORT, ID: 49, Length: 361
VENDOR INPUT REPORT, ID: 48, Length: 48
GAMEPAD INPUT REPORT, ID: 33, Length: 48