/dev/usb/btrm

/dev/usb/btrm is the IOSU device node for the internal Bluetooth module. It provides an interface to communicate with the Wii Remote, Wii Balance Board, and Wii U Pro controller, which is exposed to Cafe OS by padscore.rpl. Inside IOSU, it uses /dev/uhs/1 to talk to the Bluetooth module, which is connected via internal USB.

ioctlv() interface

0x00 - Execute function

This function is used to execute some sort of function call. It takes two buffers through the ioctlv interface: a function identifier buffer as input and a function result buffer as output.

Structures

Function identifier buffer

This structure identifies which function call to make. It is 0x1008 bytes long, with many unknown (unused?) fields set to 0. The main identifiers for a function call are two bytes, a library and a function.

/* Function identifier */
typedef struct
{
    char unknown0[0x1000-0x0];
    uint8_t lib, func;
    char unknown1002[0x1004-0x1002];
    uint32_t unknown1004;
} bt_funcid_t;

Function result buffer

This structure contains the output of a function executed by the Bluetooth resource manager.

/* Function result */
typedef struct
{
    char unknown0[0x1000-0x0];
    uint8_t some_id;
    char unknown1001[0x1004-0x1001];
    uint32_t unknown1004;
    uint32_t unknown1008;
} bt_funcres_t;