HCI requirements

The Host Controller Interface (HCI) is used for interacting with a Bluetooth controller.

This document provides a list of Bluetooth (BT) and Bluetooth Low Energy (BLE) HCI requirements. The aim is for Host BT stack vendors and BT controller vendors to conform to these platform requirements in order to use the feature set described below.

This document refers to the Bluetooth Core 5.2 Specification as the "spec." The Bluetooth Core 5.2 Specification is available on the Bluetooth SIG website along with other adopted documents.

General design overview

Chip capabilities and configuration

As an open platform, Android has a matrix of software releases, OEMs, vendors, and platform and chip capabilities.

To manage the varying landscape and to manage migrations, a design philosophy of allowing BT controllers to expose their capabilities (beyond the standard Bluetooth Core 5.2 Specification) is described in this document. The host BT stack can then use these capabilities to determine which features to enable.

Support open standards

One goal of Android is to support open standards after ratification in a Bluetooth specification. If a feature described below becomes available in standard HCI methods in a future Bluetooth specification, we will lean towards making that approach the default.

Vendor-specific capabilities

Vendor-specific command: LE_Get_Vendor_Capabilities_Command

OpCode Command Field (OCF): 0x153

Command parameter Size Purpose
NA Empty Command parameter list

A Command Complete event will be generated for this command.

Return parameter Size Purpose
Status 1 octet Command Complete status
max_advt_instances
(Deprecated) 		1 octet Number of advertisement instances supported.

Reserved after v0.98.
This parameter is deprecated in the Google feature spec v0.98 and higher in favor of the LE Extended Advertising available in the BT spec version 5.0 and higher.
offloaded_resolution_of_private-address
(Deprecated) 		1 octet BT chip capability of RPA.
If supported by a chip, it needs enablement by the host.
0 = Not capable
1 = Capable

Reserved after v0.98.
This parameter is deprecated in the Google feature spec v0.98 and higher in favor of the Privacy feature available in the BT spec version 4.2 and higher.
total_scan_results_storage 2 octets Storage for scan results in bytes
max_irk_list_sz 1 octet Number of IRK entries supported in the firmware
filtering_support 1 octet Support for filtering in the controller
0 = Not supported
1 = Supported
max_filter 1 octet Number of filters supported
activity_energy_info_support 1 octet Supports reporting of activity and energy information
0 = Not capable
1 = Capable
version_supported 2 octets Specifies the version of the Google feature spec supported
byte[0] = Major number
byte[1] = Minor number

v1.04
byte[0] = 0x01
byte[1] = 0x04
total_num_of_advt_tracked 2 octets Total number of advertisers tracked for OnLost/OnFound purposes
extended_scan_support 1 octet Supports extended scan window and interval
debug_logging_supported 1 octet Supports logging of binary debug information from controller
LE_address_generation_offloading_support
(Deprecated) 		1 octet 0 = Not supported
1 = Supported

Reserved after v0.98.
This parameter is deprecated in the Google feature spec v0.98 and higher in favor of the Privacy feature available in the BT spec version 4.2 and higher.
A2DP_source_offload_capability_mask 4 Octets Bit masks for codec types supported
Bit 0 - SBC
Bit 1 - AAC
Bit 2 - APTX
Bit 3 - APTX HD
Bit 4 - LDAC
Bit 5-31 are reserved
bluetooth_quality_report_support 1 octet Supports reporting of Bluetooth Quality events
0 = Not capable
1 = Capable
dynamic_audio_buffer_support 4 octets Supports dynamic audio buffer in the Bluetooth controller
Bit masks for codec types supported
Bit 0 - SBC
Bit 1 - AAC
Bit 2 - APTX
Bit 3 - APTX HD
Bit 4 - LDAC
Bit 5-31 are reserved
a2dp_offload_v2_support 1 octet Supports A2DP offload v2 commands in the Bluetooth controller (see Start A2DP offload, Stop A2DP offload)
0 = Not supported
1 = Supported

Batch scan results

A design goal is to enhance how the Bluetooth LE Scan Response event notifications are delivered to the host, in order to save power in the host.

By reducing how often the controller notifies the host app processor to scan results, the host app processor can stay in idle/sleep longer. This reduces power consumption in the host. The return parameter total_scan_results_storage of LE_Get_Vendor_Capabilities_Command indicates the chip capability for storage of scan results.

This feature focuses on the management and configuration of the LE Scan Results storage facility in the Bluetooth controller. The storage is used to temporarily batch advertisement data and scan data and metadata that are received by the controller for later delivery to the host.

Firmware shall support two types of batching, which can be engaged simultaneously:

  • Truncated. Contains the following information elements: {MAC, TX Power, RSSI, Timestamp}
  • Full. Contains the following information elements: {MAC, TX Power, RSSI, Timestamp, Adv Data, Scan Response}

LE_Batch_Scan_Command

OCF: 0x156

Command parameter Size Purpose
Batch_Scan_opcode 1 octet 0x1 - Enable customer-specific feature
0x2 - Set Batch Scan Storage parameters
0x3 - Set Batch Scan parameters
0x4 - Read Batch Scan Result parameters

A Command Complete event will be generated for this command. Enabling the customer-specific feature does not start the scan.

Return parameter Size Purpose
Status 1 octet Command Complete status
Batch_Scan_opcode 1 octet 0x1 - Enable customer-specific feature
0x2 - Set Batch Scan Storage parameters
0x3 - Set Batch Scan parameters
0x4 - Read Batch Scan Result parameters

LE_Batch_Scan_Command: Enable customer-specific feature

Sub OCF: 0x01

Subcommand parameter Size Purpose
enable_customer_specific_feature_set 1 octet 0x01 - Enable Batch Scan feature
0x00 - Disable Batch Scan feature

A Command Complete event will be generated for this command.

Return parameter Size Purpose
Status 1 octet Command Complete status
Batch_Scan_opcode 1 octet 0x1 - Enable customer-specific feature
0x2 - Set Batch Scan Storage parameters
0x3 - Set Batch Scan parameters
0x4 - Read Batch Scan Result parameters

LE_Batch_Scan_Command: Set batch scan storage parameter subcommand

Sub OCF: 0x02

Subcommand parameter Size Purpose
Batch_Scan_Full_Max 1 octet Max storage space (in %) allocated to full style
[Range: 0-100]
Batch_Scan_Truncated_Max 1 octet Max storage space (in %) allocated to truncated style
[Range: 0-100]
Batch_Scan_Notify_Threshold 1 octet Setup notification level (in %) for individual storage pool
[Range: 0-100]
Setting to 0 will disable notification. Vendor-specific HCI event is generated (Storage threshold breach subevent)

A Command Complete event will be generated for this command.

Return parameter Size Purpose
Status 1 octet Command Complete status
Batch_scan_opcode 1 octet 0x02 [Set Batch Scan parameters]

LE_Batch_Scan_Command: Set batch scan parameter subcommand

Sub OCF: 0x03

Subcommand parameter Size Purpose
Batch_Scan_Mode 1 octet 0x00 – Batch scan is disabled
0x01 – Truncated mode is enabled
0x02 – Full mode is enabled
0x03 – Truncated and Full mode are enabled
Duty_cycle_scan_window 4 octets Batch Scan scan time (# of slot)
Duty_cyle_scan_interval 4 octets Batch Scan interval period (# of slot)
own_address_type 1 octet 0x00 - Public device address
0x01 - Random device address
Batch_scan_Discard_Rule 1 octet 0 - Discard oldest advertisement
1 - Discard advertisement with weakest RSSI

This subcommand will start batch scanning, if enabled. In Truncated scanning, results are stored in truncated form where the unique key for Truncated style = {BD_ADDR, scan_interval}. This means only one BD_ADDR will be recorded for each scan interval. The record to keep for Truncated mode is the following: {BD_ADDR, Tx Power, RSSI, Timestamp}

When Full mode is enabled, active scanning will be used and Scan Responses will be recorded. The Full style unique key = {MAC, Ad packet}, irrespective of scan interval. The record to keep for Full mode is {BD_ADDR, Tx Power, RSSI, Timestamp, Ad packet, Scan Response}. In Full style, the same AD packet, when seen multiple times across different scan intervals, is recorded only once. However, in Truncated mode, it is the visibility of BA_ADDR across different scan intervals that is of interest (once per scan interval). The RSSI is the averaged value of all duplicates of a unique advertisement within a scan interval.

A Command Complete event will be generated for this command.

Return parameter Size Purpose
Status 1 octet Command Complete status
Batch_scan_opcode 1 octet 0x03 [Set Batch Scan Parameters]

LE_Batch_Scan_Command: Read batch scan results subcommand

Sub OCF: 0x04

Subcommand parameter Size Purpose
Batch_Scan_Data_read 1 octet 0x01 - Truncated mode data
0x02 - Full mode data

A Command Complete event will be generated for this command. When the host issues this command, all the results in the controller may not fit in one Command Complete event. The host will iterate issuing this command until the corresponding results in the Command Complete event indicate 0 in the number of records, which indicates the controller has no more records to communicate to the host. Each Command Complete event could contain multiple records of only one type of data (Full or Truncated).

Controller and host time references are not synchronized. The unit of the timestamp is 50ms. The value of the timestamp is based off when the Read_Batch_Scan_Results_Sub_cmd is given by the host. If a command arrival time is T_c in the firmware, then the actual time the timestamp was taken in the firmware is T_fw. The reporting time will be: (T_c - T_fw). T_c and T_fw are in the firmware time domain. This lets the host compute how long ago the event happened.

Return parameter Size Purpose
Status 1 octet Command Complete status
Batch_scan_opcode 1 octet 0x03 [Set Batch Scan parameters]
Batch_Scan_data_read 1 octet Identifies the format (Truncated or Full)
num_of_records 1 octet Number of records of Batch_Scan_data_read
format_of_data Variable Truncated Mode:
Address[0]: 6 octets
Address_Type[0]: 1 octet
Tx_Pwr[0]: 1 octet
RSSI[0] : 1 octet
Timestamp[0]: 2 octets
[multiple records (num_of_records) with above format]

Full Mode:
Address[0]: 6 octets
Address_Type[0]: 1 octet
Tx_Pwr[0]: 1 octet
RSSI[0]: 1 octet
Timestamp[0]: 2 octets
Adv packet_len[0]: 1 octet
Adv_packet[0]: Adv_packet_len octets
Scan_data_resp_len[0]: 1 octet
Scan_data_resp[0]: Scan_data_resp octets
[multiple records with above format (num_of_records)]

Advertising Packet Content Filter

Use this to enable/disable/setup the Advertising Packet Content Filter (APCF) in the controller. APCF filters advertising reports in the controller but doesn't filter periodic advertising.

LE_APCF_Command

OCF: 0x157

Command parameter Size Purpose
APCF_opcode 1 octet 0x00 - APCF Enable
0x01 - APCF Set Filtering parameters
0x02 - APCF Broadcaster Address
0x03 - APCF Service UUID
0x04 - APCF Service Solicitation UUID
0x05 - APCF Local Name
0x06 - APCF Manufacturer Data
0x07 - APCF Service Data
0x08 - APCF Transport Discovery Service
0x09 - APCF AD Type Filter
0x10 ~ 0xAF - Reserved for future use
0xB0 ~ 0xDF - Reserved for vendor
0xE0 ~ 0xFE - Reserved for future use
0xFF - APCF Read extended Features

A Command Complete event will be generated for this command.

Return parameter Size Purpose
Status 1 octet Return status
APCF_opcode 1 octet 0x00 - APCF Enable
0x01 - APCF Set Filtering parameters
0x02 - APCF Broadcaster Address
0x03 - APCF Service UUID
0x04 - APCF Service Solicitation UUID
0x05 - APCF Local Name
0x06 - APCF Manufacturer Data
0x07 - APCF Service Data
0x08 - APCF Transport Discovery Service
0x09 - APCF AD Type Filter
0x10 ~ 0xAF - Reserved for future use
0xB0 ~ 0xDF - Reserved for vendor
0xE0 ~ 0xFE - Reserved for future use
0xFF - APCF Read extended Features

LE_APCF_Command: Enable_sub_cmd

Sub OCF: 0x00

Subcommand parameter Size Purpose
APCF_enable 1 octet 0x01 - Enable APCF feature
0x00 - Disable APCF feature

A Command Complete event will be generated for this command.

Return parameter Size Purpose
Status 1 octet Command Complete status
APCF_opcode 1 octet 0x0 - APCF Enable
APCF_Enable 1 octet Enable/disable is set via APCF_enable

LE_APCF_Command: set_filtering_parameters_sub_cmd

This subcommand is used to add or delete a filter specification or clear a filter list for on-chip filtering.

Sub OCF: 0x01

Subcommand parameter Size Purpose
APCF_Action 1 octet 0x00 - Add
0x01 - Delete
0x02 - Clear
Delete will clear the specific filter along with associated feature entries in other tables.
Clear will clear all the filters and associated entries in other tables.
APCF_Filter_Index 1 octet Filter index (0, max_filter-1)
APCF_Feature_Selection 2 octets Bit masks for the selected features:
Bit 0: Set to enable Broadcast Address filter
Bit 1: Set to enable Service Data Change filter
Bit 2: Set to enable Service UUID check
Bit 3: Set to enable Service Solicitation UUID check
Bit 4: Set to enable Local Name check
Bit 5: Set to enable Manufacturer Data Check
Bit 6: Set to enable Service Data Check
Bit 7: Set to enable Transport Discovery Service Check
Bit 8: Set to enable AD Type Check
APCF_List_Logic_Type 2 octets Logic operation for each feature selection (per-bit position) specified in APCF_Feature_Selection.
Valid only when a feature is enabled.
Bit position value:
0: OR
1: AND
If "AND" logic is selected, an ADV packet will pass the filter only if it contains ALL of the entries in the list.
If "OR" logic is selected, an ADV packet will pass the filter if it contains any of the entries in the list.
APCF_Filter_Logic_Type 1 octet 0x00: OR
0x01: AND
Note: The logic type is N/A for the first three fields of APCF_Feature_Selection, which is always "AND" logic. They are only applicable for (Bit 3 - ­Bit 6) four fields of APCF_Feature_Selection.
rssi_high_thresh 1 octet [in dBm]
The advertiser is considered seen only if the signal is higher than the RSSI high threshold. Otherwise, the firmware must behave as if it never saw it.
delivery_mode 1 octet 0x00 - immediate
0x01 - on_found
0x02 - batched
onfound_timeout 2 octets Valid only if delivery_mode is on_found.
[in milliseconds]
Time for firmware to linger and collect additional advertisements before reporting.
onfound_timeout_cnt 1 octet Valid only if delivery_mode is on_found.
[count]
If an advertisement in onFound lingers in firmware for the onfound_timeout duration, it will collect a few advertisements and the count is checked. If the count exceeds onfound_timeout_cnt, it's reported OnFound immediately thereafter.
rssi_low_thresh 1 octet Valid only if delivery_mode is on_found.
[in dBm]
The advertiser packet is considered as not seen if the RSSI of the received packet is not above the RSSI low threshold.
onlost_timeout 2 octets Valid only if delivery_mode is on_found.
[in milliseconds]
If an advertisement, after being found, is not seen contiguously for the lost_timeout period, it will immediately be reported lost.
num_of_tracking_entries 2 octets Valid only if delivery_mode is on_found.
[count]
Total number of advertisers to track per filter.

RSSI values must use 2's complement to represent negative values.

Host shall be able to configure multiple filters with APCF_Application_Address_type set to 0x02 (for all broadcaster addresses) to manage various filter combinations.

Filtering, batching and reporting are inter-related concepts. Every advertisement and related scan response will have to go through all the filters, one after the other. Thus, resulting actions (delivery_mode) are closely tied to filtering. The delivery modes are the following: report_immediately, batch, and onFound. The OnLost value is related to OnFound in the sense that it will come after OnFound when lost.

This processing flow depicts the conceptual model:

When an advertisement (or scan response) frame is received, it is applied to all the filters in serial order. It's possible that an advertisement can cause immediate reporting based on one filter and batching of the same due to a different filter action.

RSSI level thresholds (high and low) give the ability to control when the frame is visible for filter processing, even when a valid packet is received by the controller. In case of delivery mode being set to immediate or batched, the RSSI of a frame is considered for further controller processing. Different apps need different reporting and batching behavior. This allows multiple apps to have direct reporting and/or batching of results in firmware, concurrently. An example is a case when a batch scan is active from one app and later a regular LE scan is issued by another app. Before a batch scan is issued, the framework/app sets appropriate filters. Later, when the second app issues a regular scan, previous batching continues. However, due to the regular scan, it is akin to conceptually adding a null filter (along with all the existing filters) along with the LE scan command. The LE scan command parameters take precedence when active. When the regular LE scan is disabled, the controller will revert back to a previous batch scan, if it existed.

The OnFound delivery mode is based on configured filters. A combination that triggers a filter's action to succeed is considered the entity to track for onLost. The corresponding event is the LE Advt tracking subevent.

The OnFound/OnLost transition for a filter (if enabled) will look like the following:

A Command Complete event will be generated for this command.

Return parameter Size Purpose
Status 1 octet Command Complete status
APCF_opcode 1 octet 0x01 - APCF Set Filtering Parameters
APCF_Action 1 octet Echo back command's APCF_Action
APCF_AvailableSpaces 1 octet Number of available entries in the filters table

LE_APCF_Command: broadcast_address_sub_cmd

This subcommand is used to add or delete an advertiser address or to clear the advertiser address list for on-chip filtering.

Sub OCF: 0x02

Subcommand parameter Size Purpose
APCF_Action 1 octet 0x00 - Add
0x01 - Delete
0x02 - Clear
Delete will delete the specified broadcaster address in the specified filter.
Clear will clear all the broadcaster addresses in the specified filter.
APCF_Filter_Index 1 octet Filter index (0, max_filter-1)
APCF_Broadcaster_Address 6 octet 6-byte device address to add to or delete from the broadcaster address list
APCF_Application_Address_type 1 octet 0x00: Public
0x01: Random
0x02: NA (ignore the address type)
To filter advertising reports with identity address types (0x02, 0x03). To obtain advertising reports with address types 0x02 and 0x03, set this field to 0x02: NA (ignore the address type).

A Command Complete event will be generated for this command.

Return parameter Size Purpose
Status 1 octet Command Complete status
APCF_opcode 1 octet 0x02 - APCF Broadcaster Address
APCF_Action 1 octet Echo back command's APCF_Action
APCF_AvailableSpaces 1 octet Number of free entries still available in the Broadcast Address table

LE_APCF_Command: service_uuid_sub_cmd

This subcommand is used to add or delete a service UUID or to clear a service UUID list for on-chip filtering.

Sub OCF: 0x03

Subcommand parameter Size Purpose
APCF_Action 1 octet 0x00 - Add
0x01 - Delete
0x02 - Clear
Delete will delete the specified service UUID address in the specified filter.
Clear will clear all the service UUIDs in the specified filter.
APCF_Filter_Index 1 octet Filter index (0, max_filter-1)
APCF_UUID 2,4,16 octet The Service UUID (16-bit, 32-bit, or 128-bit) for adding to, or deleting from, the list.
APCF_UUID_MASK 2,4,16 octet The Service UUID Mask (16-bit, 32-bit, or 128-bit) to add to the list. It should have the same length as APCF_UUID.

A Command Complete event will be generated for this command.

Return parameter Size Purpose
Status 1 octet Command Complete status
APCF_opcode 1 octet 0x03 - APCF Service UUID
APCF_Action 1 octet Echo back command's APCF_Action
APCF_AvailableSpaces 1 octet Number of free entries still available in the Service UUID table

LE_APCF_Command: solicitation_uuid_sub_cmd

This subcommand is used to add or delete a solicitation UUID or to clear a solicitation UUID list for on-chip filtering.

Sub OCF: 0x04

Subcommand parameter Size Purpose
APCF_Action 1 octet 0x00 - Add
0x01 - Delete
0x02 - Clear
Delete will delete the solicitation UUID address in the specified filter.
Clear will clear all the solicitation UUIDs in the specified filter.
APCF_Filter_Index 1 octet Filter index (0, max_filter-1)
APCF_UUID 2,4,16 octet The Solicitation UUID (16-bit, 32-bit, or 128-bit) to add to or delete from the list.
APCF_UUID_MASK 2,4,16 octet The Solicitation UUID Mask (16-bit, 32-bit, or 128-bit) to add to the list. It should have the same length as the APCF_UUID.

A Command Complete event will be generated for this command.

Return parameter Size Purpose
Status 1 octet Command Complete status
APCF_opcode 1 octet 0x04 - APCF Solicitation UUID
APCF_Action 1 octet Echo back command's APCF_Action
APCF_AvailableSpaces 1 octet Number of free entries still available in the Solicitation UUID table

LE_APCF_Command: local_name_sub_cmd

This subcommand is used to add or delete a local name string or to clear the local name string list for on-chip filtering.

Sub OCF: 0x05

Subcommand parameter Size Purpose
APCF_Action 1 octet 0x00 - Add
0x01 - Delete
0x02 - Clear
Delete will delete the specified local name string in the specified filter.
Clear will clear all the local name strings in the specified filter.
APCF_Filter_Index 1 octet Filter index (0, max_filter-1)
APCF_LocName_Mandata_or_SerData Variable size A character string for local name.

Notes:
  • Currently the max number of characters in a local name string is 29
  • Not applicable when action is "Clear" (0x2)

A Command Complete event will be generated for this command.

Return parameter Size Purpose
Status 1 octet Command Complete status
APCF_opcode 1 octet 0x05 - APCF Local Name
APCF_Action 1 octet Echo back command's APCF_Action
APCF_AvailableSpaces 1 octet Number of free entries still available in the Local name table

LE_APCF_Command: manf_data_sub_cmd

This subcommand is used to add or delete a manufacturer data string or to clear the manufacturer data string list for on-chip filtering.

Sub OCF: 0x06

Subcommand parameter Size Purpose
APCF_Action 1 octet 0x00 - Add
0x01 - Delete
0x02 - Clear
Delete will delete the specified manufacturer data string in the specified filter.
Clear will clear all the manufacturer data strings in the specified filter.
APCF_Filter_Index 1 octet Filter Index (0, max_filter-1)
APCF_LocName_Mandata_or_SerData Variable size A character string for manufacturer data.

Notes:
  • Currently the max number of characters in a local name string is 29
  • Not applicable when action is "Clear" (0x2)
APCF_ManData_Mask Variable size The manufacture data mask to add to the list. It should have the same length as APCF_LocName_or_ManData_or_SerData.

A Command Complete event will be generated for this command.

Return parameter Size Purpose
Status 1 octet Command Complete status
APCF_opcode 1 octet 0x06 - APCF Manufacturer Data
APCF_Action 1 octet Echo back command's APCF_Action
APCF_AvailableSpaces 1 octet Number of free entries still available in the Manufacturer Data table

LE_APCF_Command: service_data_sub_cmd

This subcommand is used to add or delete a service data string or to clear the service data string list for on-chip filtering.

Sub OCF: 0x07

Subcommand parameter Size Purpose
APCF_Action 1 octet 0x00 - Add
0x01 - Delete
0x02 - Clear
Delete will delete the specified service data string in the specified filter.
Clear will clear all the service data strings in the specified filter.
APCF_Filter_Index 1 octet Filter Index (0, max_filter-1)
APCF_LocName_Mandata_or_SerData Variable size A character string for service data.

Notes:
  • Currently the max number of characters in a local name string is 29
  • Not applicable when action is "Clear" (0x2)
APCF_LocName_Mandata_or_SerData_Mask Variable size The service data mask to add to the list. It should have the same length as APCF_LocName_or_ManData_or_SerData.

A Command Complete event will be generated for this command.

Return parameter Size Purpose
Status 1 octet Command Complete status
APCF_opcode 1 octet 0x07 - APCF Service Data
APCF_Action 1 octet Echo back command's APCF_Action
APCF_AvailableSpaces 1 octet Number of free entries still available for Service Data table

LE_APCF_Command: ad_type_sub_cmd

This subcommand is used to add or delete an AD type or to clear an AD type list for on-chip filtering. Use read_extended_features_sub_cmd to check if this command is supported or not.
When APCF_AD_DATA_Length is 0, filter APCF_AD_TYPE without comparing AD Data and AD Data Mask. If the received ADV packet's data length exceeds AD_DATA_LENGTH, compare only the first AD_DATA_LENGTH bytes of AD Data and ignore the remaining data.

Sub OCF: 0x09

Subcommand parameter Size Purpose
APCF_Action 1 octet 0x00 - Add
0x01 - Delete
0x02 - Clear
Delete will delete the specified AD type in the specified filter.
Clear will clear all the AD types in the specified filter.
APCF_Filter_Index 1 octet Filter Index (0, max_filter-1)
APCF_AD_TYPE 1 octet The AD Type for adding to, or deleting from, the list. Ignore when APCF_Action is 0x02 (Clear)
APCF_AD_DATA_Length 1 octet 0x00 - means do not filter data content
Ignore when APCF_Action is 0x02 (Clear)
APCF_AD_DATA Variable size Variable-sized, based on APCF_AD_DATA_Length
Ignore when APCF_Action is 0x02 (Clear)
APCF_AD_DATA_MASK Variable size Variable-sized, based on APCF_AD_DATA_Length
Ignore when APCF_Action is 0x02 (Clear)
It should have the same length as APCF_AD_DATA.

A Command Complete event will be generated for this command.

Return parameter Size Purpose
Status 1 octet Command Complete status
APCF_opcode 1 octet 0x09 - APCF AD Type
APCF_Action 1 octet Echo back command's APCF_Action
APCF_AvailableSpaces 1 octet Number of free entries still available in the AD Type table

LE_APCF_Command: read_extended_features_sub_cmd

This subcommand is used to read extended APCF features.

Sub OCF: 0xFF

Subcommand parameter Size Purpose
Not applicable Empty command parameter.

A Command Complete event will be generated for this command.

Return parameter Size Purpose
Status 1 octet Command Complete status
APCF_opcode 1 octet 0xFF - APCF_Read_Extended_Features
APCF_extended_features 2 octet

Bit masks for extended features supported:

  • Bit 0: Support Transport Discovery Service filter
  • Bit 1: Support AD Type filter
  • Bit 2 ~15: Reserved for future use

Value of bit

  • 0 = Not supported
  • 1 = Supported

Controller activity and energy information command

The objective of this information is for higher host system functions to analyze the total activities of all components, including the BT controller and its macro state, in conjunction with what is happening in the apps and framework. To do this, the following information is required from the BT stack and the controller:

  • BT stack: Reporting the current macro-operational state of the controller
  • Firmware: Reporting aggregate activity and energy information

BT host stack macro states, as determined at the user level:

  • Idle: [page scan, LE advt, inquiry scan, LE scan]
  • Scan: [paging/inquiry/trying to connect]
  • Active: [ACL link on, SCO link ongoing, sniff mode]

The activities that the controller keeps track of over its life are Tx time, Rx time, idle time, and total energy consumed. They are cleared when read from the host.

LE_Get_Controller_Activity_Energy_Info

This is a vendor-specific command.

OCF: 0x159

Subcommand parameter Size Purpose
NA Empty command params

A Command Complete event will be generated for this command.

Return parameter Size Purpose
Status 1 octet Command Complete status
total_tx_time_ms 4 octets Total time performing Tx
total_rx_time_ms 4 octets Total time performing Rx
total_idle_time_ms 4 octets Total time in idle (non-sleep low power states)
total_energy_used 4 octets Total energy used [product of current (mA), voltage (V) and time (ms)]

LE extended set scan parameters command

This command can be used to enable a larger scan window and interval in the controller. Per the BT Core 5.2 Specification, a scan window and interval have an upper bound limit of 10.24 seconds, which hampers scan intervals beyond 10.24 seconds for apps.

Base reference: BT Core 5.2 Specification, page 2493 (LE Set Scan Parameters Command)

OCF: 0x15A

Command Parameter Size Purpose
LE_Ex_Scan_Type 1 octet 0x00 - Passive scanning. No SCAN_REQ packets shall be sent (default).
0x01 - Active scanning. SCAN_REQ packets may be sent.
LE_Ex_Scan_Interval 4 octets Defined as the time interval from when the Controller started its last LE scan until it began the subsequent LE scan.
Range: 0x0004 to 0x00FFFFFF
Default: 0x0010 (10 ms)
Time = N * 0.625 ms
Time range: 2.5 ms to 10442.25 seconds
LE_Ex_Scan_Window 4 octets The duration of the LE scan. LE_Scan_Window shall be less than or equal to LE_Scan_Interval.
Range: 0x0004 to 0xFFFF
Default: 0x0010 (10 ms)
Time = N * 0.625 ms
Time Range: 2.5 ms to 40.95 seconds
Own_Address_Type 1 octet 0x00 - Public Device Address (default)
0x01 - Random Device Address
LE_Ex_Scan_Filter_Policy 0x00 - Accept all advertisement packets (default). Directed advertising packets which are not addressed for this device shall be ignored.
0x01 - Ignore advertisement packets from devices not in the White List Only list. Directed advertising packets which are not addressed for this device shall be ignored.

A Command Complete event will be generated for this command.

Return parameter Size Purpose
Status 1 octet Command Complete status

Get controller debug info command

The objective of this information element is to acquire controller debug information by a host, in binary form, for post-processing and analysis. This helps debug on-field issues and provides engineers with a toolkit to log information for analysis. A Controller can provide the information when requested by a host via the event (Controller Debug Info subevent) or autonomously when desired by the controller. Example uses could be to report firmware state information, crash dump information, logging information, etc.

OCF: 0x15B

Command parameter Size Purpose
N/A Empty command parameter list

A Command Complete event will be generated for this command.

Return parameter Size Purpose
Status 1 octet Command Complete status

A2DP hardware offload support

The A2DP offload feature supports the offload of the A2DP audio encoding process to an audio processor attached to the BT Controller. The encoded audio data stream passes directly from the Audio processor to the BT Controller without the BT host's involvement. The BT Host is still responsible for the configuration and control of the A2DP session. Two versions of the commands are available. The legacy commands with Sub OCF 0x01-0x02 only support open-source codecs. The versions with Sub-OCF 0x03-0x04 are agnostic to the configured codec.

OCF: 0x15D

Start A2DP offload (legacy)

Sub OCF: 0x01

Use this command both to configure the A2DP offload process and to start the A2DP stream.

Command parameter Size Purpose
Codec 4 octets Specifies Codec type
0x01 - SBC
0x02 - AAC
0x04 - APTX
0x08 - APTX HD
0x10 - LDAC
Max_Latency 2 octets Max Latency Allowed (in ms). A value of zero disables flush.
SCMS-T_Enable 2 octets Octet 0: Flag that enables addition of SCMS-T header.
  • 0x00 - SCMS-T Header not included.
  • 0x01 - SCMS-T Header included.

Octet 1: Value for the SCMS-T header, when it’s enabled.
Sampling_Frequency 4 octets 0x01 - 44100 Hz
0x02 - 48000 Hz
0x04 - 88200 Hz
0x08 - 96000 Hz
Bits_Per_Sample 1 octet 0x01 - 16 bits per sample
0x02 - 24 bits per sample
0x04 - 32 bits per sample
Channel_Mode 1 octet 0x01 - Mono
0x02 - Stereo
Encoded_Audio_Bitrate 4 octets The encoded audio bitrate in bits per second second.
0x00000000 - The audio bitrate is not specified / unused.
0x00000001 - 0x00FFFFFF - Encoded audio bitrate in bits per second.
0x01000000 - 0xFFFFFFFF - Reserved.
Connection_Handle 2 octets Connection Handle of A2DP connection being configured
L2CAP_Channel_ID 2 octets L2CAP Channel ID to be used for this A2DP connection
L2CAP_MTU_Size 2 octets Maximum size of L2CAP MTU containing encoded audio packets
Codec_Information 32 octets Codec-specific Information.

SBC Codec:

Refer to SBC Codec specific information elements in A2DP v1.3.
Octet 0: Block length | Subbands | Allocation Method
Octet 1: Minimum Bitpool value
Octet 2: Maximum Bitpool value
Octet 3: Sampling Frequency | Channel Mode
Octet 4-31: reserved

AAC Codec:

Refer to AAC Codec specific information elements in A2DP v1.3
Octet 0: Object Type
Octet 1; b7: VBR
Octet 2-31: reserved

LDAC Codec:

Octet 0-3: Vendor ID
0x0000012D

Octet 4-5: Codec ID
0x00AA - LDAC
All other values are reserved

Octet 6: Bitrate Index:
0x00 - High
0x01 - Mid
0x02 - Low
0x03 - 0x7E - Reserved
0x7F - ABR (Adaptive Bit Rate)
0x80 - 0xFF - Reserved

Octet 7: LDAC Channel Mode
0x01 - Stereo
0x02 - Dual
0x04 - Mono
Others are reserved

Octet 8-31: reserved

All other codecs:

Octet 0-31: reserved

A Command Complete event will be generated for this command.

Return parameter Size Purpose
Status 1 octet Command Complete status
Sub_Opcode 1 octet 0x01 - Start A2DP offload

Start A2DP offload

Sub OCF: 0x03

Use this command both to configure the A2DP offload process and to start the A2DP stream.

Command parameter Size Purpose
Connection Handle 2 octets Handle of the active HCI connection
L2CAP_Channel_ID 2 octets Identifier of the L2CAP Channel opened for A2DP streaming
Data_Path_Direction 1 octet 0x00 - Output (AVDTP Source/Merge)
0x01 - Input (AVDTP Sink/Split)
Peer_MTU 2 octets Maximum size of L2CAP packets, negotiated with the peer.
CP_Enable_SCMS_T 1 octet 0x00 - Disable SCMS-T Content Protection Header
0x01 - Enable SCMS-T Content Protection Header
CP_Header_SCMS_T 1 octet When SCMS-T Content Protection Header is enabled (CP_SCMS_T_Enable set to 0x01), defines the header value that precedes the audio content (refer to A2DP, section 3.2.1-2) as defined by Bluetooth Assigned Numbers, section 6.3.2.
Ignored when SCMS-T Content protection isn't enabled.
Vendor_Specific_Parameters_Length 1 octet Length of Vendor Specific Parameters, in the range from 0 to 128.
The value 0 is used when no additional parameters are provided.
Vendor_Specific_Parameters 0-128 octets Vendor Specific Parameters provided by the Bluetooth Audio HAL, CodecParameters.vendorSpecificParameters[].

A Command Complete event will be generated for this command.

Return parameter Size Purpose
Status 1 octet Command Complete status
Sub_Opcode 1 octet 0x03 - Start A2DP offload

Stop A2DP offload (legacy)

Sub OCF: 0x02

This command is used to stop the A2DP offload stream.

Command parameter Size Purpose
N/A Empty command parameter list.

No parameters are defined for this command.

A Command Complete event will be generated for this command.

Return parameter Size Purpose
Status 1 octet Command Complete status
Sub_Opcode 1 octet 0x02 - Stop A2DP offload

Stop A2DP offload

Sub OCF: 0x04

This command is used to stop the A2DP offload stream.

Command parameter Size Purpose
Connection Handle 2 octets Handle of the active HCI connection
L2CAP_Channel_ID 2 octets Identifier of the L2CAP Channel opened for A2DP streaming
Data_Path_Direction 1 octet 0x00 - Output (AVDTP Source/Merge)
0x01 - Input (AVDTP Sink/Split)

A Command Complete event will be generated for this command.

Return parameter Size Purpose
Status 1 octet Command Complete status
Sub_Opcode 1 octet 0x04 - Stop A2DP offload

Bluetooth Quality Report command

The BT Quality Report command feature starts the mechanism in the Bluetooth controller to report Bluetooth Quality events to the host. You can enable four options:

  • Quality Monitoring Mode: The controller periodically sends a Link Quality related BQR subevent to the host.
  • Approaching LSTO: If no packets are received from the connected BT device for longer than half of the Link Supervision TimeOut (LSTO) value, the controller reports an Approaching LSTO event to the host.
  • A2DP Audio Choppy: When the controller detects factors that cause choppy audio, the controller reports an A2DP Audio Choppy event to the host.
  • (e)SCO Voice Choppy: When the controller detects factors that cause choppy voice, the controller reports an (e)SCO Voice Choppy event to the host.
  • Root Inflammation: This event is sent by the controller to the stack when the HAL or the controller encounters a fatal error and needs to restart Bluetooth.
  • LMP/LL message trace: The controller sends the LMP/LL message handshaking with the remote device to the host.
  • Bluetooth Multi-profile/Coex scheduling trace: The controller sends its scheduling information on handling multiple Bluetooth profiles and wireless coexistence in the 2.4 Ghz band to the host.
  • Controller Debug Information mechanism: When enabled, the controller can autonomously report debug logging information through the Controller debug info subevent to the host.
  • LE Audio Choppy: When the controller detects factors that cause choppy audio, the controller reports an LE Audio Choppy event to the host.
  • Advance RF Stats mode: The controller reports its RF stats related information to the host, supporting two report use cases:
    • Periodic reports
    • Event triggers (stream start/stop and link quality event trigger).
  • BQR_Report_Action of Bluetooth Quality Report Command: The host can use this HCI command to get a one time query for quality monitoring mode, energy monitor mode, or an advance RF stats mode.

OCF: 0x15E

Command parameter Size Purpose
BQR_Report_Action 1 octet Action to add / delete reporting of quality event(s) set in BQR_Quality_Event_Mask parameter, or clear all.

0x00 - Add
0x01 - Delete
0x02 - Clear
0x03 - One time query

Delete will clear specific quality event(s) reporting.
Clear will clear all quality events reporting (BQR_Quality_Event_Mask parameter can be ignored).

BQR_Quality_Event_Mask 4 octets Bit masks for the selected quality event reporting.

Bit 0: Set to enable quality monitoring mode.
Bit 1: Set to enable Approaching LSTO event (for ACL/(e)SCO/ISO).
Bit 2: Set to enable A2DP Audio Choppy event.
Bit 3: Set to enable (e)SCO Voice Choppy event.
Bit 4: Set to enable Root inflammation event.
Bit 5: Set to enable energy monitoring mode.
Bit 6: Set to enable LE audio choppy event.
Bit 7: Set to enable connect fail event.
Bit 8: Set to enable Advance RF Stats mode event trigger.
Bit 9: Set to enable Advance RF Stats periodic report.
Bit 10 ~ 14: Reserved.
Bit 15: Set to enable vendor-specific quality events.
Bit 16: Set to enable LMP/LL message trace.
Bit 17: Set to enable Bluetooth Multi-link/Coex scheduling trace.
Bit 18: Set to enable the Controller Debug Information mechanism.
Bit 19 ~ 30: Reserved.
Bit 31: Set to enable vendor-specific trace.

BQR_Minimum_Report_Interval 2 octets Define the minimum time interval of quality event reporting for the selected quality event(s). The controller Firmware should not report the next event within the defined time interval. The interval setting shall be respective and dedicated for the quality event(s) which are being added.

Unit: ms
Default: 0 (No limitation for the interval.)
Range: 0 ~ 65535 ms

BQR_Vendor_Specific_Quality_Event_Mask 4 octets Bit masks for the selected vendor-specific quality event reporting.
This parameter is valid only when bit 15 of BQR_Quality_Event_Mask is set.

Bit 0 ~ 31: Reserved.

BQR_Vendor_Specific_Trace_Mask 4 octets Bit masks for the selected vendor-specific trace reporting.
This parameter is valid only when bit 31 of BQR_Quality_Event_Mask is set.

Bit 0 ~ 31: Reserved.

Report_interval_multiple 4 octets The multiplier for BQR_Minimum_Report_Interval. When this value >= 1, the BQR Report Interval follows the format
BQR Report Interval = BQR_Minimum_Report_Interval x Report_interval_multiple.
The controller Firmware must not report the next event within the defined time interval. The interval setting is specifically dedicated for the added quality event(s).

Unit: ms
Default: 1
Range: 0 ~ 4294967295 (0: is equal set to 1)

Note: if the setting of BQR_Report_Interval is larger than the ability of the controller, the controller must return the maximum BQR_Report_Interval time on the completion of the command.

A Command Complete event will be generated for this command.

Return parameter Size Purpose
Status 1 octet Command Complete status
Current_Quality_Event_Mask 4 octets Indicates current bit mask setting.
Bit 0: Quality monitoring mode is enabled.
Bit 1: Approaching LSTO event reporting is enabled.
Bit 2: A2DP Audio Choppy event reporting is enabled.
Bit 3: (e)SCO Voice Choppy event reporting is enabled.
Bit 4: Root inflammation event reporting is enabled.
Bit 5: Energy monitoring mode is enabled.
Bit 6: LE audio choppy event reporting is enabled.
Bit 7: Connect fail event.
Bit 8: Set to enable Advance RF Stats mode event trigger.
Bit 9: Set to enable Advance RF Stats periodically report.
Bit 10 ~ 14: Reserved.
Bit 15: Vendor-specific quality event reporting is enabled.
Bit 16: LMP/LL message trace is enabled.
Bit 17: Bluetooth Multi-link/Coex scheduling trace is enabled.
Bit 18: Controller Debug Information mechanism is enabled.
Bit 19 ~ 30: Reserved.
Bit 31: Vendor-specific trace is enabled.
Current_Vendor_Specific_Quality_Event_Mask 4 octets Indicates current bit mask setting.
Current_Vendor_Specific_Trace_Mask 4 octets Indicates current bit mask setting.
BQR_Report_interval 4 octets Indicates current bit mask setting.
Current_Vendor_Specific_Trace_Mask 4 octets The setting of BQR_Report_interval. It must be the minimum value between BQR_Minimum_Report_Interval * Report_interval_multiple or the maximum support interval of the controller.

Dynamic audio buffer command

The dynamic audio buffer reduces audio glitching by changing the audio buffer size in the Bluetooth controller based on various scenarios.

OCF: 0x15F

Get audio buffer time capability

Sub OCF: 0x01

Use this command to get the audio buffer time capability from the Bluetooth controller.

Command parameter Size Purpose
N/A Empty Command parameter list

A Command Complete event will be generated for this command.

Return parameter Size Purpose
Status 1 octet Command Complete status
Dynamic_Audio_Buffer_opcode 1 octet 0x01 - Get audio buffer time
Audio_Codec_Type_Supported 4 octets Bit masks for the supported codec types
Bit 0 - SBC
Bit 1 - AAC
Bit 2 - APTX
Bit 3 - APTX HD
Bit 4 - LDAC
Bit 5-31 are reserved
Audio_Codec_Buffer_Default_Time_For_Bit_0 2 octets Default buffer time of the Bit 0 codec type specified in Audio_Codec_Type_Supported.
This value shall be 0 if the Bit 0 codec type is not supported.
Unit: ms
Audio_Codec_Buffer_Maximum_Time_For_Bit_0 2 octets Maximum buffer time of the Bit 0 codec type specified in Audio_Codec_Type_Supported.
This value shall be 0 if the Bit 0 codec type is not supported.
Unit: ms
Audio_Codec_Buffer_Minimum_Time_For_Bit_0 2 octets Minimum buffer time of the Bit 0 codec type specified in Audio_Codec_Type_Supported.
This value shall be 0 if the Bit 0 codec type is not supported.
Unit: ms
Audio_Codec_Buffer_Default_Time_For_Bit_1 2 octets Default buffer time of the Bit 1 codec type specified in Audio_Codec_Type_Supported.
This value shall be 0 if the Bit 1 codec type is not supported.
Unit: ms
Audio_Codec_Buffer_Maximum_Time_For_Bit_1 2 octets Maximum buffer time of the Bit 1 codec type specified in Audio_Codec_Type_Supported.
This value shall be 0 if the Bit 1 codec type is not supported.
Unit: ms
Audio_Codec_Buffer_Minimum_Time_For_Bit_1 2 octets Minimum buffer time of the Bit 1 codec type specified in Audio_Codec_Type_Supported.
This value shall be 0 if the Bit 1 codec type is not supported.
Unit: ms
...... ...... ......
Audio_Codec_Buffer_Default_Time_For_Bit_31 2 octets Default buffer time of the Bit 31 codec type specified in Audio_Codec_Type_Supported.
This value shall be 0 if the Bit 31 codec type is not supported.
Unit: ms
Audio_Codec_Buffer_Maximum_Time_For_Bit_31 2 octets Maximum buffer time of the Bit 31 codec type specified in Audio_Codec_Type_Supported.
This value shall be 0 if the Bit 31 codec type is not supported.
Unit: ms
Audio_Codec_Buffer_Minimum_Time_For_Bit_31 2 octets Minimum buffer time of the Bit 31 codec type specified in Audio_Codec_Type_Supported.
This value shall be 0 if the Bit 31 codec type is not supported.
Unit: ms

Set audio buffer time

Sub OCF: 0x02

Use this command to set the audio buffer time to the Bluetooth controller.

Command parameter Size Purpose
Audio_Codec_Buffer_Time 2 octets Requested audio buffer time for the current used codec.
Unit: ms

A Command Complete event will be generated for this command.

Return parameter Size Purpose
Status 1 octet Command Complete status
Dynamic_Audio_Buffer_opcode 1 octet 0x02 - Set audio buffer time
Audio_Codec_Buffer_Time 2 octets Current audio buffer time in the Bluetooth controller.
Unit: ms

HCI event (vendor-specific)

Vendor-specific HCI events are required in some cases. Refer to Figure 5.4 on page 1897 of the BT Core 5.2 Specification. Event parameter 0 will always contain the first subevent code, based on which the rest of the HCI event is decoded.

Event Parameter Size Purpose
HCI_vendor_specific_event_code 1 octet 0xFF
sub_event_code 1 octet A subevent code will be 1 octet in size, the byte immediately following Parameter Length in the HCI event packet.

Storage threshold breach subevent

This event indicates that the storage threshold has been breached.

Subevent code = 0x54

Subevent Parameter Size Purpose
None

LE multi-advertising state change subevent

This event indicates that an advertising instance has changed its state. At this time, this event is only used to indicate which advertising instance was stopped as a result of a connection.

Subevent code = 0x55

Subevent parameter Size Purpose
Advertising_instance 1 octet Identifies the specific advertising instance
Valid values are 0 through max_advt_instances-1
State_Change_Reason 1 octet 0x00: Connection received
Connection_handle 2 octets Identifies the connection that caused the advt instance to be disabled (0xFFFF if invalid)

LE advertisement tracking subevent

This event indicates when an advertiser is found or lost.

Sub event code = 0x56

Subevent Parameter Size Purpose
APCF_Filter_Index 1 octet Filter Index (0, max_filter-1)
Advertiser_State 1 octet 0x00: Advertiser found
0x01: Advertiser lost
Advt_Info_Present 1 octet 0x00: Advertiser information (Advt_Info) present
0x01: Advertiser information (Advt_Info) not present
Advertiser_Address 6 octets Public or random address
Advertiser_Address_Type 1 octet 0x00: Public address
0x01: Random address
Advt_Info Tx_Pwr[0]: 1 octet
RSSI[0]: 1 octet
Timestamp[0]: 2 octets
Adv packet_len[0]: 1 octet
Adv_packet[0]: Adv_packet_len octets
Scan_data_resp_len[0]: 1 octet
Scan_data_resp[0]: Scan_data_resp octets

Controller debug info subevent

This event is used by a Controller to provide binary debug information to a host.

Subevent code = 0x57

Subevent Parameter Size Purpose
debug_block_byte_offset_start 2 octets Debug block byte offset from the start
last_block 1 octet 0x00: More debug data present
0x01: Last binary block; no more debug data
cur_pay_load_sz 2 octets Binary block size in a current event
Debug_Data Variable Debug data of cur_payload_sz

Bluetooth Quality Report subevent

This event indicates one of the following: a Bluetooth quality event occurred, the controller uploaded the LMP/LL message trace and Bluetooth Multi-link/Coex scheduling trace, or the controller dumped debug information data.

Subevent Parameter Size Purpose
Quality_Report_Id 1 octet 0x01: Quality reporting on the monitoring mode.
0x02: Approaching LSTO.
0x03: A2DP Audio Choppy.
0x04: (e)SCO Voice Choppy.
0x05 ~ 0x06: Reserved.
0x07: LE audio choppy.
0x08: Connect fail.
0x09 ~ 0xFF: Reserved.
Packet_Types 1 octet 0x01: ID
0x02: NULL
0x03: POLL
0x04: FHS
0x05: HV1
0x06: HV2
0x07: HV3
0x08: DV
0x09: EV3
0x0A: EV4
0x0B: EV5
0x0C: 2-EV3
0x0D: 2-EV5
0x0E: 3-EV3
0x0F: 3-EV5
0x11: DH1
0x12: DM3
0x13: DH3
0x14: DM5
0x15: DH5
0x16: AUX1
0x17: 2-DH1
0x18: 2-DH3
0x19: 2-DH5
0x1A: 3-DH1
0x1B: 3-DH3
0x1C: 3-DH5
0x1D ~ 0x50: Reserved
0x51: ISO packet
0x52 ~ 0xFF: Reserved
Connection_Handle 2 octets ACL/(e)SCO/ISO connection handle.
Connection_Role 1 octet Performing Role for the connection.
0x00: Central
0x01: Peripheral
0x02 ~ 0xFF: Reserved.
TX_Power_Level 1 octet Current transmit power level for the specified Connection_Handle.

This value shall be the same as the controller's responding to the HCI_Read_Transmit_Power_Level HCI command.

RSSI 1 octet [in dBm]

Received Signal Strength Indication (RSSI) value for the specified Connection_Handle.
This value shall be an absolute receiver signal strength value.
Range: -127 to +20

SNR 1 octet [in dB]

Signal-to-Noise Ratio (SNR) value for the specified Connection_Handle.
The controller shall provide the average SNR of all the channels used by the link.

Unused_AFH_Channel_Count 1 octet Indicates the number of unused channels in AFH_channel_map.
0x4F ~ 0xFF: Reserved.
AFH_Select_Unideal_Channel_Count 1 octet Indicates the number of the channels which are interfered and have bad quality, but they are still selected for AFH.
The minimum number of channels allowed by the Bluetooth specification is 20, so even if all 79 channels are interfered and have bad quality, the controller still needs to choose at least 20 channels for AFH.
LSTO 2 octets Current Link Supervision Timeout Setting.
Time = N * 0.625 ms
Time Range: 0.625 ms to 40.9 s
Connection_Piconet_Clock 4 octets Piconet Clock for the specified Connection_Handle.
This value shall be the same as the controller's responding to HCI_Read_Clock HCI command with parameter "Which_Clock" of 0x01 (Piconet Clock).
Unit: N * 0.3125 ms (1 Bluetooth Clock)
Retransmission_Count 4 octets The number of retransmissions since the last event.
This count shall be reset after reporting to the host.
No_RX_Count 4 octets No RX count since the last event.
The count increases when no packet is received at the scheduled time slot or the received packet is corrupted.
This count shall be reset after reporting to the host.
NAK_Count 4 octets NAK (Negative Acknowledge) count since the last event.
This count shall be reset after reporting to the host.
Last_TX_ACK_Timestamp 4 octets Timestamp of last TX ACK. It is based on the Bluetooth Clock of the piconet central (CLK).
Unit: N * 0.3125 ms (1 Bluetooth Clock)
Flow_Off_Count 4 octets The number of times the controller receives Flow-off (STOP) since the last event.
This count shall be reset after reporting to the host.
Last_Flow_On_Timestamp 4 octets Timestamp of last Flow-on (GO). It is based on the Bluetooth Clock of the piconet central (CLK).
Unit: N * 0.3125 ms (1 Bluetooth Clock)
Buffer_Overflow_Bytes 4 octets [in Byte]

Buffer overflow count since the last event.
The controller counts how many bytes of data are dropped.
This count shall be reset after reporting to host.

Buffer_Underflow_Bytes 4 octets [in Byte]

Buffer underflow count since the last event.
This count shall be reset after reporting to host.

bdaddr 6 octets Remote device address
cal_failed_item_count 1 octet The count of calibration failed items
TX_Total_Packets 4 octets The number of packets that are sent out.
TX_UnAcked_Packets 4 octets The number of packets that don't receive an acknowledgment.
This count is reset after reporting to the host.
TX_Flushed_Packets 4 octets The number of packets that aren't sent out by its flush point.
This count is reset after reporting to the host.
TX_Last_Subevent_Packets 4 octets The number of packets that Link Layer transmits a CIS data PDU in the last subevent of a CIS event.
This count is reset after reporting to the host.
The value is zero if there's no valid value for the link.
CRC_Error_Packets 4 octets The number of received packages with CRC error since the last event.
This count is reset after reporting to the host.
RX_Duplicate_Packets 4 octets The number of duplicate (retransmission) packages received since the last event.
This count is reset after reporting to the host.
RX_Unreceived_Packets 4 octets The number of unreceived packets is the same as the parameter of the LE READ ISO Link Quality command (see Bluetooth core Specification Version 5.4). The associated streams are CIS and BIS.
When this value is incremented, the Link Layer doesn't receive a specific payload by its flush point (on a CIS) or at the end of the event it is associated with (on a BIS; see Bluetooth core Specification Version 5.4 Vol 6 Part B, Section 4.4.6.6).
Coex_Info_Mask 2 octets Bit 0 - CoexInvolvement: Set to indicate coex activities are suspected to be involved when this report is generated (for example, A2DP Chops and Approaching LSTO).
Bit 1 - WL 2G Radio Active: Set to indicate WLAN 2G Radio is active.
Bit 2 - WL 2G Connected: Set to indicate WLAN 2G Radio is active and connected.
Bit 3 - WL 5G/6G Radio Active: Set to indicate WLAN 5G/6G Radio is active.
Bit 4-15 - Reserved
Vendor Specific Parameter (parameter total length - TBD) * octets For the controller vendor to obtain more vendor specific parameters.

Subevent code = 0x58 [Quality_Report_Id = 0x05, Root Inflammation event]

This event indicates that Bluetooth HAL or the controller encountered a fatal error and needs Bluetooth stack to record this situation and restart. The controller must send a Root_Inflammation_Event to Bluetooth stack before sending the first fragment of the debug info events in any case.

The Error_Code parameter contains an error code reported from HAL/Controller, 0 if it is a chipset vendor specific error. The Vendor_Specific_Error_Code contains a chipset vendor specific error code from HAL/Controller. It should set as 0 if the parameter Error_Code is not 0. The parameters Error_Code and Vendor_Specific_Error_Code should not both be 0.

Subevent Parameter Size Purpose
Quality_Report_Id 1 octet 0x00 ~ 0x04: Reserved.
0x05: Root inflammation.
0x06 ~ 0xFF: Reserved.
Error_Code 1 octet 0x00: Chipset vendor specific error code is included.
0x01 ~ 0xFF: Controller failure occurred. See Bluetooth Spec [Vol 2] Part D, Error Codes for a list of error codes and descriptions.
Vendor_Specific_Error_Code 1 octet 0x00: No chipset vendor specific error code is included.
0x01 ~ 0xFF: Chipset vendor specific error code.
Vendor Specific Parameter (Parameter Total Length - 4) * octets For the controller vendor to obtain more vendor specific parameters.
Subevent Parameter Size Purpose
Quality_Report_Id 1 octet 0x00 ~ 0x10: Reserved.
0x11: LMP/LL message trace.
0x12: Bluetooth Multi-link/Coex scheduling trace.
0x13: Controller Debug Information data dump.
0x14 ~ 0xFF: Reserved.
Connection_Handle 2 octets Connection Handle.
Vendor Specific Parameter (Parameter Total Length - 4) * octets Vendor Specific format of LMP message trace, Bluetooth Multi-link/Coex scheduling trace and Controller Debug Information data dump.

Multi-advertiser support

The objectives of multi-advertiser support are the following:

  • Ability to support multiple advertisements (max_advt_instances)
  • Different transmit powers to allow for a varying range
  • Different advertising content
  • An individualized response for each advertiser
  • Privacy (non-trackable) for each advertiser
  • Connectable

To keep this specification close to existing standards, the following vendor-specific commands are provided. They are derived from the Bluetooth Core 4.1 Specification.

LE_Multi_Advt_Command

OCF: 0x154

Command parameter Size Purpose
Multi_advt_opcode 1 octet 0x01 - Set_Advt_Param_Multi_Sub_Cmd
0x02 - Set_Advt_Data_Multi_Sub_Cmd
0x03 - Set_Scan_Resp_Data_Multi_Sub_Cmd
0x04 - Set_Random_Addr_Multi_Sub_Cmd
0x05 - Set_Advt_Enable_Multi_Sub_Cmd

A Command Complete event will be generated for this command.

Return parameter Size Purpose
Status 1 octet Command Complete status
Multi_advt_opcode 1 octet 0x01 - Set_Advt_Param_Multi_Command
0x02 - Set_Advt_Data_Multi_Command
0x03 - Set_Scan_Resp_Data_Multi_Command
0x04 - Set_Random_Addr_Multi_Command
0x05 - Set_Advt_Enable_Multi_Command

LE_Multi_Advt_Command: Set_Advt_Param_Multi_Sub_Cmd

Base reference: Bluetooth Core 4.1 Specification, page 964 (LE Set Advertising Parameter Command)

Sub OCF: 0x01

Subcommand parameter Size Purpose
Advertising_Interval_Min Per spec Per spec
Advertising_Interval_Max Per spec Per spec
Advertising_Type Per spec Per spec
Own_Address_Type Per spec Per spec
Own_Address Per spec Per spec
Direct_Address_Type Per spec Per spec
Direct_Address Per spec Per spec
Advertising_Channel_Map Per spec Per spec
Adverstising_Filter_Policy Per spec Per spec
Advertising_Instance 1 octet Specifies the applicability of the above parameters to an instance
Tx_power 1 octet Transmit_Power
Unit - in dBm (signed integer)
Range (-70 to +20)

The Own_Address parameter could be a host-configured address at the time of setting up this multi-advertisement instance. This provides the ability to have a resolvable private address at the time of the transmit of the first beacon. Advertisement on an instance will continue irrespective of the connection. The host BT stack could issue a command to start advertisement on an instance, post connection.

A Command Complete event will be generated for this command as specified in the Bluetooth Core 4.1 Specification, per the above command. The controller will respond with a non-success (invalid parameter) code if the advertising instance or Tx_Power parameters are invalid.

Return parameter Size Purpose
Status 1 octet Command Complete status
Multi_advt_opcode 1 octet 0x01 [Set_Advt_Param_Multi_Sub_Cmd]

LE_Multi_Advt_Command: Set_Advt_Data_Multi_Sub_Cmd

Base reference: Bluetooth Core 4.1 Specification, page 969 (LE Set Advertising Data Command)

Sub OCF: 0x02

Subcommand parameter Size Purpose
Advertising_Data_Length Per spec Per spec
Advertising_Data Per spec Per spec
Advertising_Instance 1 octet Specifies the applicability of the above parameters to an instance

A Command Complete event will be generated for this command as specified in the Bluetooth Core 4.1 Specification, per the above command. The controller will respond with a non-success code if the advertising instance or Tx_Power parameters are invalid.

Return parameter Size Purpose
Status 1 octet Command Complete status
Multi_advt_opcode 1 octet 0x02 [Set_Advt_Data_Multi_Sub_Cmd]

LE_Multi_Advt_Command: Set_Scan_Resp_Data_Multi_Sub_Cmd

Base reference: Bluetooth Core 4.1 Specification, page 970 (LE Set Scan Response Data Command)

Sub OCF: 0x03

Subcommand parameter Size Purpose
Scan_Response_Data_Length Per spec Per spec
Scan_Response_Data Per spec Per spec
Advertising_Instance 1 octet Specifies the applicability of the above parameters to an instance

A Command Complete event will be generated for this command as specified in the Bluetooth Core 4.1 Specification, per the above command. The controller will respond with a non-success code (invalid parameter) if the advertising instance or Tx_Power parameters are invalid.

Return parameter Size Purpose
Status 1 octet Command Complete status
Multi_advt_opcode 1 octet 0x03 [Set_Scan_Resp_Data_Multi_Sub_Cmd]

LE_Multi_Advt_Command: Set_Random_Addr_Multi_Sub_Cmd

Base reference: Bluetooth Core 4.1 Specification, page 963 (LE Set Random Address Command)

Sub OCF: 0x04

Subcommand parameter Size Purpose
Random Address Per spec Per spec
Advertising_Instance 1 octet Specifies the applicability of the above parameters to an instance

A Command Complete event will be generated for this command.

Return parameter Size Purpose
Status 1 octet Command Complete status
Multi_advt_opcode 1 octet 0x04 [Set_Random_Addr_Multi_Sub_Cmd]

LE_Multi_Advt_Command: Set_Advt_Enable_Multi_Sub_Cmd

Base reference: Bluetooth Core 4.1 Specification, page 971 (LE Set Advertise Enable Command in that core specification)

OCF: 0x05

Subcommand parameter Size Purpose
Advertising_Enable 1 octet A value of 1 means enable. Any other value means disable.
Advertising_Instance 1 octet Specifies the applicability of the above parameters to an instance. Instance 0 means a standard HCI instance.

A Command Complete event will be generated for this command.

Return parameter Size Purpose
Status 1 octet Command Complete status
Multi_advt_opcode 1 octet 0x05 [Set_Advt_Enable_Multi_Sub_Cmd]

Offloaded resolution of private address

This feature resolves a private address in the controller firmware or hardware, which provides the following benefits:

  • Latency involved with the host in resolving a private address
  • Saving power by refraining from waking up the host

LE_Set_RPA_Timeout

OCF: 0x15C

Command parameter Size Purpose
LE_local_IRK 16 octet The local device IRK used to generate the random resolvable address(es).
tRPA_min 2 octets The minimum RPA generation timeout in seconds. The controller must generate new resolvable addresses for any advertising/scanning/connection events on or after this timeout.
Valid range: 300-1800
tRPA_max 2 octets The maximum RPA generation timeout in seconds. The controller must generate new resolvable addresses for any advertising/scanning/connection events on or before this timeout.
Valid range: tRPA_min-1800
Return parameter Size Purpose
Status 1 octet The status of the command.

Suggested HCI status values:
0x00 Success
0x01 Unknown command (if not supported)
0x12 Invalid command parameters (if any parameters are outside the given range)

LE_RPA_offload_Command

OCF: 0x155

Command parameter Size Purpose
RPA_offload_opcode 1 octet 0x1 - Enable customer specific feature
0x2 - Add IRK to the list
0x3 - Remove IRK from the list
0x4 - Clear IRK list
0x5 - Read IRK list entry

A Command Complete event will be generated for this command.

Return parameter Size Purpose
Status 1 octet Command Complete status
Event_RPA_offload_opcode 1 octet 0x1 - Enable customer specific feature
0x2 - Add IRK to the list
0x3 - Remove IRK from the list
0x4 - Clear IRK list
0x5 - Read IRK list entry

LE_RPA_offload: Enable_cust_specific_sub_Command

Sub OCF: 0x01

Subcommand parameter Size Purpose
enable_customer_specific_feature_set 1 octet 0x01 - Enable offloaded RPA feature
0x00 - Disable offloaded RPA feature

RPA offload is required to be enabled by the host, based on the chip capability. Refer to the LE_Get_Vendor_Capabilities_Command. Each chip can have a varying max_irk_list_sz in the firmware.

A Command Complete event will be generated for this command.

Return parameter Size Purpose
Status 1 octet Command Complete status
Event_cust_specific_feature_opcode 1 octet 0x01 [Enable customer-specific feature]

LE_RPA_offload: Add_IRK_to_list_sub_Command

Sub OCF: 0x02

Subcommand parameter Size Purpose
LE_IRK 16 octets LE IRK (1st byte LSB)
Address_Type 1 octet 0: Public address
1: Random address
LE_Device_Address 6 octets Public or random address associated to the IRK (1st byte LSB)

A Command Complete event will be generated for this command.

Return parameter Size Purpose
Status 1 octet Command Complete status
Event_cust_specific_feature_opcode 1 octet 0x02 [Add IRK to the list]
LE_IrkList_AvailableSpaces 1 octet Available IRL list entries after current operation

LE_RPA_offload: Remove_IRK_to_list_sub_Command

Sub OCF: 0x03

Subcommand parameter Size Purpose
Address_Type 1 octet 0: Public address
1: Random address
LE_Device_Address 6 octets Public or random address that associates to the IRK

A Command Complete event will be generated for this command.

Return parameter Size Purpose
Status 1 octet Command Complete status
Event_cust_specific_feature_opcode 1 octet 0x03 [Remove IRK from the list]
LE_IrkList_AvailableSpaces 1 octet Available IRL list entries after current operation

LE_RPA_offload: Clear_IRK_list_sub_Command

Sub OCF: 0x04

Subcommand parameter Size Purpose
None

A Command Complete event will be generated for this command.

Return parameter Size Purpose
Status 1 octet Command Complete status
Event_cust_specific_feature_opcode 1 octet 0x04 [Clear IRK List]
LE_IrkList_AvailableSpaces 1 octet Available IRL list entries after current operation [max_irk_list_sz]

LE_RPA_offload: Read_IRK_list_sub_Command

Sub OCF: 0x05

Subcommand parameter Size Purpose
LE_read_IRK_list_entry-index 1 octet Index of the IRK list [0, max_irk_list_sz-1]

A Command Complete event will be generated for this command.

Return parameter Size Purpose
Status 1 octet Command Complete status
Event_cust_specific_feature_opcode 1 octet 0x05 [Read IRK List Entry]
LE_Read_IRK_List_entry 1 octet Index of the IRK that the host wants to read back (maximum IRK list size is 32)
LE_IRK 16 octets IRK value
Address_Type 1 octet 0: Public address
1: Random address
LE_Device_Address 6 octets Public or random address associated to the IRK
LE_Resolved_Private_Address 6 octets Current resolved resolvable private address of this IRK