Cannot get a RPi Zero to emulate _both_ a USB Keyboard _and_ Mouse - keyboard

Question

I am trying to get my RPi Zero W to emulate a keyboard and mouse. I can get it to emulate a keyboard or a mouse successfully, but not both at the same time.
I followed the instructions at iStickToIt and Key Mime Pi to successfully emulate a keyboard. Alternatively I followed the instructions here to successfully emulate a mouse. Both work fine on their own. However I don't know how to emulate both mouse and keyboard at once.
I thought that perhaps I just needed to combine the information and define 2 functions for the 1 USB gadget, creating /dev/hidg0 and /dev/hidg1, but only the 1st one works. Below is my combined code - you can see that the Report Length and Report Descriptor is different for keyboard and mouse. But only /dev/hidg0 works (keyboard).
Can you suggest where I am going wrong?
#!/usr/bin/env bash
# Adapted from https://github.com/girst/hardpass-sendHID/blob/master/README.md
# Exit on first error.
set -e
# Treat undefined environment variables as errors.
set -u
modprobe libcomposite
cd /sys/kernel/config/usb_gadget/
mkdir -p g1
cd g1
echo 0x1d6b > idVendor # Linux Foundation
echo 0x0104 > idProduct # Multifunction Composite Gadget
echo 0x0100 > bcdDevice # v1.0.0
echo 0x0200 > bcdUSB # USB2
STRINGS_DIR="strings/0x409"
mkdir -p "$STRINGS_DIR"
echo "82bc64754ca7384d7c90" > "${STRINGS_DIR}/serialnumber"
echo "Anykey" > "${STRINGS_DIR}/manufacturer"
echo "Generic USB Keyboard" > "${STRINGS_DIR}/product"
# -- Function 1: Keyboard -----------------------------------------------
FUNCTIONS_DIR="functions/hid.usb0"
mkdir -p "$FUNCTIONS_DIR"
echo 1 > "${FUNCTIONS_DIR}/protocol"
echo 0 > "${FUNCTIONS_DIR}/subclass" # No subclass
echo 8 > "${FUNCTIONS_DIR}/report_length"
# Write the report descriptor
# Source: https://www.kernel.org/doc/html/latest/usb/gadget_hid.html
echo -ne \\x05\\x01\\x09\\x06\\xa1\\x01\\x05\\x07\\x19\\xe0\\x29\\xe7\\x15\\x00\\x25\\x01\\x75\\x01\\x95\\x08\\x81\\x02\\x95\\x01\\x75\\x08\\x81\\x03\\x95\\x05\\x75\\x01\\x05\\x08\\x19\\x01\\x29\\x05\\x91\\x02\\x95\\x01\\x75\\x03\\x91\\x03\\x95\\x06\\x75\\x08\\x15\\x00\\x25\\x65\\x05\\x07\\x19\\x00\\x29\\x65\\x81\\x00\\xc0 > "${FUNCTIONS_DIR}/report_desc"
CONFIG_INDEX=1
CONFIGS_DIR="configs/c.${CONFIG_INDEX}"
mkdir -p "$CONFIGS_DIR"
echo 250 > "${CONFIGS_DIR}/MaxPower"
CONFIGS_STRINGS_DIR="${CONFIGS_DIR}/strings/0x409"
mkdir -p "$CONFIGS_STRINGS_DIR"
echo "Config ${CONFIG_INDEX}: ECM network" > "${CONFIGS_STRINGS_DIR}/configuration"
ln -s "$FUNCTIONS_DIR" "${CONFIGS_DIR}/"
# -- Function 2: Mouse --------------------------------------------------
FUNCTIONS_DIR="functions/hid.usb1"
mkdir -p "$FUNCTIONS_DIR"
echo 1 > "${FUNCTIONS_DIR}/protocol"
echo 0 > "${FUNCTIONS_DIR}/subclass" # No subclass
echo 3 > "${FUNCTIONS_DIR}/report_length"
# Write the report descriptor
# Source: https://www.kernel.org/doc/html/latest/usb/gadget_hid.html
echo -ne \\x05\\x01\\x09\\x02\\xa1\\x01\\x09\\x01\\xa1\\x00\\x05\\x09\\x19\\x01\\x29\\x03\\x15\\x00\\x25\\x01\\x95\\x03\\x75\\x01\\x81\\x02\\x95\\x01\\x75\\x05\\x81\\x03\\x05\\x01\\x09\\x30\\x09\\x31\\x15\\x81\\x25\\x7f\\x75\\x08\\x95\\x02\\x81\\x06\\xc0\\xc0 > "${FUNCTIONS_DIR}/report_desc"
CONFIG_INDEX=2
CONFIGS_DIR="configs/c.${CONFIG_INDEX}"
mkdir -p "$CONFIGS_DIR"
echo 250 > "${CONFIGS_DIR}/MaxPower"
CONFIGS_STRINGS_DIR="${CONFIGS_DIR}/strings/0x409"
mkdir -p "$CONFIGS_STRINGS_DIR"
echo "Config ${CONFIG_INDEX}: ECM network" > "${CONFIGS_STRINGS_DIR}/configuration"
ln -s "$FUNCTIONS_DIR" "${CONFIGS_DIR}/"
ls /sys/class/udc > UDC
chmod 777 /dev/hidg0
chmod 777 /dev/hidg1

Answer 1

I have found the answer to my own question. The mistake is in the 2 lines which say:
ln -s "$FUNCTIONS_DIR" "${CONFIGS_DIR}/"
Having set up 2 functions directories, they should both be linked into the same config directory and not 2 different config directories as I have done. So in my example one function directory was linked into "configs/c.1" and the other was linked into "configs/c.2", whereas they should both have been linked into "configs/c.1".
You can see a working report descriptor for both mouse and keyboard in the code for TinyPilot here. Note that this uses a slightly different mouse message format from my example above.
When you have set it up correctly use /dev/hidg0 for the keyboard and /dev/hidg1 for the mouse.
(With thanks to Michael Lynch, whose open-source RPi KVM project TinyPilot can be referred to here and here.)