Bluetooth Driver services
btdrv
This is "nn::bluetooth::IBluetoothDriver".
The bluetooth driver implements the bluetooth protocol over h4/uart.
It interfaces with the uart service to actually talk with the bluetooth hardware.
The code seems to be derived from a broadcom stack. A good starting point for similar source code can be found in the MICO project: https://github.com/yinhongxing/mico/tree/ea67ff3659f12d730d4dc3b8d547b093bd2ee2ee/MICO/bluetooth_bte Note that the library files contain many (symbolized) functions which match btdrv.
Support for "nn::bluetooth::*" was added to sdknso with 6.x.
btdrv appears to be designed to only be used by the two sysmodules which use it, hid and btm. This service uses global state, nothing service-session-specific.
This has max_sessions 30. IPC handling is done by the main-thread.
As of 10.x these services only support using Hid and BLE devices, other devices such as audio are not usable.
Cmds 46-83 were added with [4.0.0+].
Various cmds were moved/etc starting with #InitializeBle with [5.0.0+].
InitializeBluetoothDriver
No input/output.
This is the first cmd used during service init.
This just returns 0.
InitializeBluetooth
No input, returns an output Event handle with EventClearMode=1.
This is used by btm, this should not be used by other processes.
EnableBluetooth
No input/output.
This is used by btm.
DisableBluetooth
No input/output.
This is used by btm.
FinalizeBluetooth
No input/output.
Not used by btm, other processes should not use this.
GetAdapterProperties
Takes a type-0x1A output buffer containing an #AdapterProperty.
This is used by btm.
GetAdapterProperty
Takes an input #BluetoothPropertyType and a type-0xA output buffer.
SetAdapterProperty
Takes an input #BluetoothPropertyType and a type-0x9 input buffer.
StartInquiry
No input/output.
This is used by btm.
StopInquiry
No input/output.
This is used by btm.
CreateBond
Takes an input #Address and a type-0x19 input buffer containing a #TransportType, no output.
[9.0.0+] Now only takes an #Address and a #TransportType without a buffer, no output.
The #TransportType is unused.
This is used by btm.
RemoveBond
Takes an input #Address, no output.
This is used by btm.
CancelBond
Takes an input #Address, no output.
This is used by btm.
RespondToPinRequest
Takes an input #Address, a bool, an u8, a #BluetoothPinCode, no output.
sdknso uses an user-specified s32 for the u8.
RespondToSspRequest
Takes an input #Address, a #BluetoothSspVariant, a bool, an u32, no output.
This is used by btm.
GetEventInfo
Takes a type-0xA output buffer and returns an output #EventType.
This copies 0x400-bytes from state to the output buffer, copies the #EventType from state to output, and signals an event.
This is used by btm.
InitializeHid
Takes an input u16, returns an output Event with EventClearMode=1.
Originally sdknso used an user-specified value for the u16, however with [9.0.0+] it uses hard-coded value 0x1 instead.
This is used by btm, this should not be used by other processes.
OpenHidConnection
Takes an input #Address, no output.
This just returns 0.
This is used by btm.
CloseHidConnection
Takes an input #Address, no output.
This is used by btm.
HidSendData
Takes an input #Address and a type-0x19 input buffer containing a #HidData, no output.
WriteHidData
Takes an input #Address and a type-0x19 input buffer containing a #HidReport, no output.
This is used by hid.
This sends a HID DATA transaction packet with report-type Output.
WriteHidData2
Takes an input #Address and a type-0x9 input buffer, no output.
This is internally the same as #WriteHidData, with the input buffer being directly passed to the funcptr instead of a tmp copy of the input #HidReport.
HidSetReport
Takes an input #Address, a #BluetoothHhReportType, a type-0x19 input buffer containing a #HidData, no output.
SetHidReport
Takes an input #Address, a #BluetoothHhReportType, a type-0x19 input buffer containing a #HidReport, no output.
This is used by hid.
This sends a HID SET_REPORT transaction packet.
GetHidReport
Takes an input #Address, an u8 report_id, a #BluetoothHhReportType, no output.
This is used by hid.
This sends a HID GET_REPORT transaction packet. The report_id is sent in the packet for the Report Id, when non-zero.
HidWakeController
Takes an input #Address, no output.
TriggerConnection
Takes an input #Address and an u16, no output.
This is used by btm.
AddPairedDeviceInfo
Takes a type-0x19 input buffer containing BluetoothDevicesSettings, no output.
This is used by btm.
GetPairedDeviceInfo
Takes an input #Address and a type-0x1A output buffer containing BluetoothDevicesSettings.
This is used by btm.
FinalizeHid
No input/output.
Not used by btm, other processes should not use this.
GetHidEventInfo
Takes a type-0xA output buffer, returns an output #HidEventType.
This copies 0x480-bytes from state to the output buffer. #HidEventType is set to: stateval!=0 ? 7 : 0. Once finished, this signals an event.
This is used by btm.
SetTsi
Takes an input #Address and an u8, no output.
This is used by btm.
EnableBurstMode
Takes an input #Address and a bool, no output.
This is used by btm.
SetZeroRetransmission
Takes an input #Address and a type-0x9 input buffer containing an array of u8s, no output.
The entry-count is clamped to a maximum of 5, the count can be 0.
This is used by btm.
EnableMcMode
Takes an input bool, no output.
This is used by btm.
EnableLlrScan
No input/output.
This is used by btm.
DisableLlrScan
No input/output.
This is used by btm.
EnableRadio
Takes an input bool, no output.
This is used by btm.
SetVisibility
Takes two input bools, no output.
This is used by btm.
EnableTbfcScan
Takes an input bool, no output.
This is used by btm.
RegisterHidReportEvent
No input, returns an output Event handle with EventClearMode=1.
This gets the Event handle for a previously created Event.
This is used by hid.
GetHidReportEventInfo
No input, takes a type-0xA output buffer and returns a #HidEventType.
[7.0.0+] No longer takes a buffer or returns output, now returns an output sharedmem handle. sdknso maps this with size=0x3000 and permissions=RW-.
Originally this was used in a dedicated sdknso func, with [7.0.0+] this is now used at the start of the sdknso impl for #RegisterHidReportEvent if the above sharedmem was not mapped yet.
The [7.0.0+] GetHidReportEventInfo sdknso func loads data using the above sharedmem.
This is used by hid.
GetLatestPlr
Takes a type-0x16 output buffer containing a #PlrList ([1.0.0-8.1.1] #PlrStatistics).
GetPendingConnections
No input/output.
This is used by btm.
GetChannelMap
Takes a type-0x16 output buffer containing a #ChannelMapList.
EnableTxPowerBoostSetting
Takes an input bool, no output.
sdknso ignores errors from this. sdknso exposes this under "nn::bluetooth::debug::".
IsTxPowerBoostSettingEnabled
No input, returns an output bool.
sdknso sets the tmpout_bool to 1, and uses that with the cmd. The sdknso func directly returns tmpout_bool, errors from the cmd are ignored.
sdknso exposes this under "nn::bluetooth::debug::".
EnableAfhSetting
Takes an input bool, no output.
sdknso ignores errors from this. sdknso exposes this under "nn::bluetooth::debug::".
IsAfhSettingEnabled
sdknso sets the tmpout_bool to 1, and uses that with the cmd. The sdknso func directly returns tmpout_bool, errors from the cmd are ignored.
sdknso exposes this under "nn::bluetooth::debug::".
InitializeBle
No input, returns an output Event handle with EventClearMode=1.
This is used by btm.
EnableBle
No input/output.
This is used by btm.
DisableBle
No input/output.
This is used by btm.
FinalizeBle
No input/output.
SetBleVisibility
Takes two input bools, no output.
SetLeConnectionParameter
Takes a #LeConnectionParams, no output.
SetBleConnectionParameter
Takes an input #Address, a bool, a #BleConnectionParameter, no output.
This is used by btm.
SetLeDefaultConnectionParameter
Takes a #LeConnectionParams, no output.
SetBleDefaultConnectionParameter
Takes a #BleConnectionParameter, no output.
This is used by btm.
SetBleAdvertiseData
Takes a type-0x19 input buffer containing a #BleAdvertisePacketData, no output.
SetBleAdvertiseParameter
Takes an input #Address, two u16s, no output.
StartBleScan
No input/output.
This is used by btm.
StopBleScan
No input/output.
This is used by btm.
AddBleScanFilterCondition
Takes a type-0x19 input buffer containing a #BleAdvertiseFilter, no output.
This is used by btm.
DeleteBleScanFilterCondition
Takes a type-0x19 input buffer containing a #BleAdvertiseFilter, no output.
This is used by btm.
DeleteBleScanFilter
Takes an input u8, no output.
Originally the sdknso func used an u8 for the user-specified param, with [9.0.0+] it's a s32.
ClearBleScanFilters
No input/output.
This is used by btm.
EnableBleScanFilter
Takes an input bool, no output.
This is used by btm.
RegisterGattClient
Takes an input #GattAttributeUuid, no output.
This is used by btm.
UnregisterGattClient
Takes an input u8, no output.
UnregisterAllGattClients
No input/output.
ConnectGattServer
Takes an input u8, an #Address, a bool, an AppletResourceUserId, no output.
This is used by btm.
CancelConnectGattServer
Takes an input u8, an #Address, a bool, no output.
This is used by btm.
DisconnectGattServer
Takes an input u32, no output.
This is used by btm.
GetGattAttribute
Takes an #Address and an u32, no output.
[9.0.0+] Now takes an input u32, no output.
GetGattService
Takes an input u32 and a #GattAttributeUuid, no output.
ConfigureAttMtu
Takes an input u16 and u32, no output.
This is used by btm.
RegisterGattServer
Takes an input #GattAttributeUuid, no output.
UnregisterGattServer
Takes an input u8, no output.
ConnectGattClient
Takes an input u8, an #Address, a bool, no output.
LeServerDisconnect
Takes an input u8, an #Address, no output.
DisconnectGattClient
Takes an input u8, no output.
AddGattService
Takes an input u8, an u8, a bool, a #GattAttributeUuid, no output.
Originally sdknso used an user-specified u8 for the second u8, with [9.0.0+] that func param is now a s32.
EnableGattService
Takes an input u8, a #GattAttributeUuid, no output.
AddGattCharacteristic
Takes an input u8, an u8, an u16, a #GattAttributeUuid, a #GattAttributeUuid, no output.
AddGattDescriptor
Takes an input u8, an u16, a #GattAttributeUuid, a #GattAttributeUuid, no output.
GetBleManagedEventInfo
Takes a type-0xA output buffer, returns an output #BleEventType.
This copies 0x400-bytes from state to the output buffer, and copies the #BleEventType from state to output.
This is used by btm.
GetGattFirstCharacteristic
Takes an input bool, an u32, a #GattId, a #GattAttributeUuid, returns an output u8 and #GattId.
GetGattNextCharacteristic
Takes an input bool, an u32, a #GattId, a #GattId, a #GattAttributeUuid, returns an output u8 and #GattId.
GetGattFirstDescriptor
Takes an input bool, an u32, a #GattId, a #GattId, a #GattAttributeUuid, returns an output #GattId.
GetGattNextDescriptor
Takes an input bool, an u32, a #GattId, a #GattId, a #GattId, a #GattAttributeUuid, returns an output #GattId.
RegisterGattManagedDataPath
Takes an input #GattAttributeUuid, no output.
This is used by btm.
UnregisterGattManagedDataPath
Takes an input #GattAttributeUuid, no output.
RegisterGattHidDataPath
Takes an input #GattAttributeUuid, no output.
This is used by btm.
UnregisterGattHidDataPath
Takes an input #GattAttributeUuid, no output.
This is used by btm.
RegisterGattDataPath
Takes an input #GattAttributeUuid, no output.
This is used by btm.
UnregisterGattDataPath
Takes an input #GattAttributeUuid, no output.
This is used by btm.
ReadGattCharacteristic
Takes an input bool, an u8, an u32, a #GattId, a #GattId, no output.
ReadGattDescriptor
Takes an input bool, an u8, an u32, a #GattId, a #GattId, a #GattId, no output.
This is used by hid.
WriteGattCharacteristic
Takes a type-0x9 input buffer, a bool, an u8, a bool, an u32, a #GattId, a #GattId, no output.
The buffer size must be <=0x258.
WriteGattDescriptor
Takes a type-0x9 input buffer, a bool, an u8, an u32, a #GattId, a #GattId, a #GattId, no output.
The buffer size must be <=0x258.
RegisterGattNotification
Takes an input bool, an u32, a #GattId, a #GattId, no output.
UnregisterGattNotification
Takes an input bool, an u32, a #GattId, a #GattId, no output.
This is used by hid.
GetLeHidEventInfo
Takes a type-0xA output buffer, returns an output #BleEventType.
This copies 0x400-bytes from state to the output buffer, and copies the #BleEventType from state to output. This also resets the state which was used for the outbuf-copy. Once finished, this signals an event.
This is used by hid.
See #LeEventInfo for the output buffer.
RegisterBleHidEvent
No input, returns an output Event handle with EventClearMode=1.
This is used by hid.
SetBleScanParameter
Takes two input u16s, no output.
This is used by btm.
MoveToSecondaryPiconet
Takes an input #Address, no output.
IsManufacturingMode
No input, returns an output bool.
sdknso will Abort if this fails, the bool is returned instead of a Result. sdknso exposes this under "nn::bluetooth::debug::".
This calls the same two funcs as various other cmds etc. This writes the bool returned by the second func to output, then returns 0. The second func loads the bool from system-setting "bluetooth_debug!skip_boot". The first func is the same as the second one, except it writes the bool into global state.
This is used by btm.
EmulateBluetoothCrash
Takes an input #FatalReason, no output.
sdknso masks the FatalReason with an u16-mask before passing it to the cmd. sdknso exposes this under "nn::bluetooth::debug::".
This writes data into a CircularBuffer (name "BLE CORE", seperate from sharedmem) with type=0x29, where the data is an u16 determined using the input #FatalReason. This is only done if a state field is value 0x3, after calling the func for this the field is set to value 0.
GetBleChannelMap
Takes a type-0x16 output buffer containing a #ChannelMapList.
bt
This is "nn::bluetooth::IBluetoothUser".
This has max_sessions 30. IPC handling is done by the main-thread.
LeClientReadCharacteristic
Takes a PID, a bool, an u8, an u32, a #GattId, a #GattId, an AppletResourceUserId, no output.
This is essentially the same as #ReadGattCharacteristic, the AppletResourceUserId is unused.
LeClientReadDescriptor
Takes a PID, a bool, an u8, an u32, a #GattId, a #GattId, a #GattId, an AppletResourceUserId, no output.
This is essentially the same as #ReadGattDescriptor, the AppletResourceUserId is unused.
LeClientWriteCharacteristic
Takes a PID, a type-0x9 input buffer, a bool, an u8, a bool, an u32, a #GattId, a #GattId, an AppletResourceUserId, no output.
This is essentially the same as #WriteGattCharacteristic, the AppletResourceUserId is unused.
LeClientWriteDescriptor
Takes a PID, a type-0x9 input buffer, a bool, an u8, an u32, a #GattId, a #GattId, a #GattId, an AppletResourceUserId, no output.
This is essentially the same as #WriteGattDescriptor, the AppletResourceUserId is unused.
LeClientRegisterNotification
Takes a PID, an input bool, an u32, a #GattId, a #GattId, an AppletResourceUserId, no output.
This is essentially the same as #RegisterGattNotification, the AppletResourceUserId is unused.
LeClientDeregisterNotification
Takes a PID, an input bool, an u32, a #GattId, a #GattId, an AppletResourceUserId, no output.
This is essentially the same as #UnregisterGattNotification, the AppletResourceUserId is unused.
SetLeResponse
Takes a PID, a type-0x9 input buffer, an u8, a #GattAttributeUuid, a #GattAttributeUuid, an AppletResourceUserId, no output.
The AppletResourceUserId is unused.
The buffer size must be <=0x258.
LeSendIndication
Takes a PID, a type-0x9 input buffer, an u8, a bool, a #GattAttributeUuid, a #GattAttributeUuid, an AppletResourceUserId, no output.
The AppletResourceUserId is unused.
The buffer size used internally is clamped to max size 0x258.
GetLeEventInfo
Takes a PID, a type-0xA output buffer, an AppletResourceUserId, returns an output #BleEventType.
This is identical to #GetLeHidEventInfo except different state is used. The AppletResourceUserId is unused. See #LeEventInfo for the output buffer.
RegisterBleEvent
Takes a PID, an AppletResourceUserId, returns an output Event handle with EventClearMode=1.
This is identical to #RegisterBleHidEvent except different Event state is used. The AppletResourceUserId is unused.
BluetoothPropertyType
This is u32 enum "nn::bluetooth::BluetoothPropertyType".
The sysmodule will Abort if the input type is unavailable / not recognized.
| Value | Description | Buffer contents |
|---|---|---|
| 1 | Name | String, max length 0xF8 excluding NUL-terminator. |
| 2 | Address | #Address |
| 3 | Only available with #SetAdapterProperty. 3-bytes | |
| 5 | 3-bytes | |
| 6 | 1-byte. The default is value 0x68. |
TransportType
This is u32 enum "nn::bluetooth::TransportType".
BluetoothSspVariant
This is u8 enum "nn::bluetooth::BluetoothSspVariant".
EventType
This is u32 enum "nn::bluetooth::EventType".
BluetoothHhReportType
This is u32 enum "nn::bluetooth::BluetoothHhReportType".
Bit0-1 directly control the HID bluetooth transaction report-type value. Bit2-3: these directly control the Parameter Reserved field for SetReport, for GetReport these control the Parameter Reserved and Size bits.
| Value | Description |
|---|---|
| 0 | Other |
| 1 | Input |
| 2 | Output |
| 3 | Feature |
HidEventType
This is u32 enum "nn::bluetooth::HidEventType".
BleEventType
This is u32 enum "nn::bluetooth::BleEventType".
FatalReason
This is u32 enum "nn::bluetooth::FatalReason".
This determines the u16 data to write into the CircularBuffer.
| Value | Description |
|---|---|
| 1 | u16 data = 0x850. |
| 2 | u16 data = 0x851. |
| Other values | u16 data = 0x852. |
AdapterProperty
This is "nn::bluetooth::AdapterProperty". This is a 0x103-byte struct.
| Offset | Size | Description |
|---|---|---|
| 0x0 | 0x6 | Same as the data for #BluetoothPropertyType type2. |
| 0x6 | 0x3 | Same as the data for #BluetoothPropertyType type5. |
| 0x9 | 0xF9 | Same as the data for #BluetoothPropertyType type1 (last byte is not initialized). |
| 0x102 | 0x1 | Set to hard-coded value 0x68 (same as the data for #BluetoothPropertyType type6). |
Address
This is "nn::bluetooth::Address". This is a 0x6-byte struct with 1-byte alignment.
BluetoothPinCode
This is "nn::bluetooth::BluetoothPinCode". This is a 0x10-byte struct with 1-byte alignment.
HidData
This is "nn::bluetooth::HidData". This is a 0x282-byte struct.
| Offset | Size | Description |
|---|---|---|
| 0x0 | 0x2 | Size of the following data. |
| 0x2 | 0x280 | Data |
HidReport
This is "nn::bluetooth::HidReport". This is a 0x2BE-byte struct.
| Offset | Size | Description |
|---|---|---|
| 0x0 | 0x2 | Size of the following data. |
| 0x2 | 0x2BC | Data |
PlrStatistics
This is "nn::bluetooth::PlrStatistics". This is a 0x84-byte struct.
PlrList
This is "nn::bluetooth::PlrList". This is a 0xA4-byte struct.
ChannelMapList
This is "nn::bluetooth::ChannelMapList". This is a 0x88-byte struct.
LeConnectionParams
This is "nn::bluetooth::LeConnectionParams". This is a 0x14-byte struct with 2-byte alignment.
BleConnectionParameter
This is "nn::bluetooth::BleConnectionParameter". This is a 0xC-byte struct with 2-byte alignment.
BleAdvertisePacketData
This is "nn::bluetooth::BleAdvertisePacketData" ([5.0.0-8.1.1] "nn::bluetooth::LeAdvertiseData"). This is a 0xCC-byte struct.
| Offset | Size | Description |
|---|---|---|
| 0x0 | 0x4 | |
| 0x4 | 0x1 | |
| 0x5 | 0x1 | Size of the data at +0x6. |
| 0x6 | 0x1F | |
| 0x25 | 0x3 | Padding |
| 0x28 | 0x1 | Total array entries for the below array, can be 0. |
| 0x29 | 0x7 | Padding |
| 0x30 | count*0x14 | Array entries, see below. |
| 0xA4 | 0x1 | Size of the data at +0xA8. |
| 0xA5 | 0x1 | |
| 0xA6 | 0x2 | Padding |
| 0xA8 | 0x1F | |
| 0xC7 | 0x1 | |
| 0xC8 | 0x1 | |
| 0xC9 | 0x3 | Padding |
Array entry:
| Offset | Size | Description |
|---|---|---|
| 0x0 | 0x2 | |
| 0x2 | 0x12 | Unused |
BleAdvertiseFilter
This is "nn::bluetooth::BleAdvertiseFilter". This is a 0x3E-byte struct.
BleAdvertisePacketParameter
This is "nn::bluetooth::BleAdvertisePacketParameter". This is a 8-byte struct with 1-byte alignment.
BleScanResult
This is "nn::bluetooth::BleScanResult". This is a 0x148-byte struct.
| Offset | Size | Description |
|---|---|---|
| 0x0 | 0x144 | |
| 0x144 | 0x4 | s32 |
BleConnectionInfo
This is "nn::bluetooth::BleConnectionInfo". This is a 0xC-byte struct.
| Offset | Size | Description |
|---|---|---|
| 0x0 | 0x4 | Id, 0xFFFFFFFF ([5.0.0-5.0.2] 0xFFFF) is invalid. |
| 0x4 | 0x6 | #Address |
| 0xA | 0x2 | Padding |
GattAttributeUuid
This is "nn::bluetooth::GattAttributeUuid". This is a 0x14-byte struct with 4-byte alignment.
| Offset | Size | Description |
|---|---|---|
| 0x0 | 0x4 | UUID size, must be 0x2, 0x4, or 0x10. |
| 0x4 | 0x10 | UUID with the above size. |
GattId
This is "nn::bluetooth::GattId". This is a 0x18-byte struct with 4-byte alignment.
| Offset | Size | Description |
|---|---|---|
| 0x0 | 0x1 | InstanceId |
| 0x1 | 0x3 | Padding |
| 0x4 | 0x14 | #GattAttributeUuid |
LeEventInfo
This is a 0x400-byte struct.
| Offset | Size | Description |
|---|---|---|
| 0x0 | 0x4 | |
| 0x4 | 0x4 | |
| 0x8 | 0x1 | |
| 0x9 | 0x3 | Padding |
| 0xC | 0x14 | #GattAttributeUuid |
| 0x20 | 0x14 | #GattAttributeUuid |
| 0x34 | 0x14 | #GattAttributeUuid |
| 0x48 | 0x2 | Size of the below data. |
| 0x4A | {above size} | Data. |
BleClientGattOperationInfo
This is "nn::bluetooth::BleClientGattOperationInfo". This is converted from #LeEventInfo.
| Offset | Size | Description |
|---|---|---|
| 0x0 | 0x1 | Converted from #LeEventInfo+0x0. |
| 0x1 | 0x3 | Padding |
| 0x4 | 0x4 | Same as #LeEventInfo+0x4. |
| 0x8 | 0x1 | Same as #LeEventInfo+0x8. |
| 0x9 | 0x3 | Padding |
| 0xC | 0x14 | Same as #LeEventInfo+0xC. |
| 0x20 | 0x14 | Same as #LeEventInfo+0x20. |
| 0x34 | 0x14 | Same as #LeEventInfo+0x34. |
| 0x48 | 0x8 | Same as #LeEventInfo+0x48. |
| 0x50 | {above size} | Same as #LeEventInfo+0x4A. |