The Network Processor Interface(NPI) is what is used to communicate between the AP and NP. Check https://processors.wiki.ti.com/index.php/Unified_Network_Processor_Interface for up to date information.

The NPI Transport Layer can be driven by UART or SPI. The protocol used is the updated version of the current TI NPI framework.

The NPI framework uses this frame format (the same frame is use for UART or SPI):

SOF	Length	Cmd0	Cmd1	Data Payload	FCS
1 Byte (0xFE)	2 bytes	1 byte	1 Byte	0-4096 bytes	1 Byte

SOF: start of Frame (1 byte).
Length: length of the data payload field (2 bytes).
Cmd0: the opcode is split in 2 field:

Type (3 bits): synchronous req (0x1), asynchronous req (0x2), synchronous response (0x3) ( see NPI frame type for SNP (NPI cmd 0))
Subsystem (5 bits): the subsystem for which the command belongs to ( BLE SNP subsystem (0x15 or 21) ).
Cmd1: type of command, or command (8 bits)
Payload: the command itself (or extension of the command).
FCS: frame check sequence, calculated on all field except SOF.
Using this NPI frame and protocol makes it easier to reuse existing code from other technologies (or use combine technologies), like ZigBee-RF4CE.

The subsystem used is the BLE SNP subsystem (0x15 or 21).

The API field is composed of a header subfield and an opcodeId subfield. The header subfield is 2 bits long and is used to indicate the group of APIs the command belongs to:

Opcode Subgroup	Description
0	SNP Device
1	SNP GAP (adv. and connection)
2	SNP GATT Services management
3	reserved

SNP Frame description:

For a SNP Frame , the command opcode is the first byte of the param section.

SOF	Length	Cmd0	Cmd1	Data Payload	FCS
1 Byte (0xFE)	2 bytes	1 byte, bits 5-7: type, bits 0-4: subsystem (21 for BLE)	1 Byte	0-4096 bytes	1 Byte

Dealing with Parameters and Packed Structures

Most commands accept parameters. For convenience, parameters of each command are described through packed structures. Some parameter take variable parameter size. A variable field is described as a pointer in the corresponding structure. There is only one variable length field per command. This field is put at the end of the structure. The length of this field is generally not indicated, but can be retrieve easily by reading the length of the whole frame.

The obvious consequence is that the total parameters size is not necessary equal to the size of the structure, rather a variable length parameter (the pointer) is present in the structure. Since a pointer doesn't make sense to be send over a transport protocol (UART/SPI), it represents a place holder for the real data. It can be considered as the location in the frame where the information pointed too by the pointer starts being transmitted. Also, since the maximum of only one pointer per structure, the size of the data pointed to can be deduced from the global frame length with knowledge of the other parameters in the structure.

For Example: SNP_setAdvData needs to be sent to the SNP, with type SNP_SCANRSP_DATA and raw data "0x00 0x01 0x02" The structure snpSetAdvDataReq_t is used to represent the data over UART.

PACKED_TYPEDEF_STRUCT
{
  uint8_t type;         
  uint8_t *pData;       
} snpSetAdvDataReq_t;

the frame send over UART/SPI will be the following:

SOF	Length	Cmd0	Cmd1	Type	data	FCS
0xFE	0x04 0x00 bytes	SNP_NPI_ASYNC_CMD_TYPE	SNP_SET_ADV_DATA_REQ	SNP_SCANRSP_DATA	0x00 0x01 0x02	the Fcs

Note that all field needs to use the little endian format (except for variable length field where they are read in the order they arrive on the bus.).

dealing with UUID

UUID can be 2 bytes long or 16 bytes long. each services and each characteristics have its own UUID. UUID are send LSB first over UART.

in order to save memory when a lot of service are created, some predefined UUID are store in flash area of the SNP code. if one of those UUID is recognize in a service or characteristic, the version located in flash will be used.

Also, the SNP will do the following :

if the UUID send assign to a service/characteristic is a long (16 bytes) BT BASE UUID, and the SNP has a short version of this UUID, then SNP will replace the long version by a short version.
if the UUID send assign to a service/characteristic is a short (2 bytes) HAP BASE UUID , and the SNP recognize it, it will automatically replace it by the long version of the UUID.