Effective in 2026, to align with our trunk stable development model and ensure platform stability for the ecosystem, we will publish source code to AOSP in Q2 and Q4. For building and contributing to AOSP, we recommend utilizing android-latest-release instead of aosp-main. The android-latest-release manifest branch will always reference the most recent release pushed to AOSP. For more information, see Changes to AOSP.

HCI requirements

The Host Controller Interface (HCI) is used for interacting with a Bluetooth controller.

This document provides a list of Bluetooth (BT) and Bluetooth Low Energy (BLE) HCI requirements. The aim is for Host BT stack vendors and BT controller vendors to conform to these platform requirements in order to use the feature set described below.

This document refers to the Bluetooth Core 5.2 Specification as the "spec." The Bluetooth Core 5.2 Specification is available on the Bluetooth SIG website along with other adopted documents.

General design overview

Chip capabilities and configuration

As an open platform, Android has a matrix of software releases, OEMs, vendors, and platform and chip capabilities.

To manage the varying landscape and to manage migrations, a design philosophy of allowing BT controllers to expose their capabilities (beyond the standard Bluetooth Core 5.2 Specification) is described in this document. The host BT stack can then use these capabilities to determine which features to enable.

Support open standards

One goal of Android is to support open standards after ratification in a Bluetooth specification. If a feature described below becomes available in standard HCI methods in a future Bluetooth specification, we will lean towards making that approach the default.

Vendor-specific capabilities

Vendor-specific command: LE_Get_Vendor_Capabilities_Command

OpCode Command Field (OCF): 0x153

Command parameter	Size	Purpose
	NA	Empty Command parameter list

A Command Complete event will be generated for this command.

Return parameter	Size	Purpose
`Status`	1 octet	Command Complete status
`max_advt_instances` (Deprecated)	1 octet	Number of advertisement instances supported. Reserved after v0.98. *This parameter is deprecated in the Google feature spec v0.98 and higher in favor of the LE Extended Advertising* available in the BT spec version 5.0 and higher.**
`offloaded_resolution_of_private-address` (Deprecated)	1 octet	BT chip capability of RPA. If supported by a chip, it needs enablement by the host. 0 = Not capable 1 = Capable Reserved after v0.98. *This parameter is deprecated in the Google feature spec v0.98 and higher in favor of the Privacy feature* available in the BT spec version 4.2 and higher.**
`total_scan_results_storage`	2 octets	Storage for scan results in bytes
`max_irk_list_sz`	1 octet	Number of IRK entries supported in the firmware
`filtering_support`	1 octet	Support for filtering in the controller 0 = Not supported 1 = Supported
`max_filter`	1 octet	Number of filters supported
`activity_energy_info_support`	1 octet	Supports reporting of activity and energy information 0 = Not capable 1 = Capable
`version_supported`	2 octets	Specifies the version of the Google feature spec supported byte[0] = Major number byte[1] = Minor number v1.05 byte[0] = 0x01 byte[1] = 0x05 Feature additions in the following versions: v1.05: iso_link_feedback_support BQRv7 sniff_offload_support V1.04: BQRv6
`total_num_of_advt_tracked`	2 octets	Total number of advertisers tracked for `OnLost`/`OnFound` purposes
`extended_scan_support`	1 octet	Supports extended scan window and interval
`debug_logging_supported`	1 octet	Supports logging of binary debug information from controller
`LE_address_generation_offloading_support` (Deprecated)	1 octet	0 = Not supported 1 = Supported Reserved after v0.98. *This parameter is deprecated in the Google feature spec v0.98 and higher in favor of the Privacy feature* available in the BT spec version 4.2 and higher.**
`A2DP_source_offload_capability_mask`	4 Octets	Bit masks for codec types supported Bit 0 - SBC Bit 1 - AAC Bit 2 - APTX Bit 3 - APTX HD Bit 4 - LDAC Bit 5-31 are reserved
`bluetooth_quality_report_support`	1 octet	Supports reporting of Bluetooth Quality events 0 = Not capable 1 = Capable
`dynamic_audio_buffer_support`	4 octets	Supports dynamic audio buffer in the Bluetooth controller Bit masks for codec types supported Bit 0 - SBC Bit 1 - AAC Bit 2 - APTX Bit 3 - APTX HD Bit 4 - LDAC Bit 5-31 are reserved
`a2dp_offload_v2_support`	1 octet	Supports A2DP offload v2 commands in the Bluetooth controller (see Start A2DP offload, Stop A2DP offload) 0 = Not supported 1 = Supported
`iso_link_feedback_support`	1 octet	Supports the ISO Link Feedback event 0 = Not supported 1 = Supported
`sniff_offload_support`	1 octet	Supports Sniff Offload commands in a Bluetooth controller 0 = Not supported 1 = Supported

Batch scan results

A design goal is to enhance how the Bluetooth LE Scan Response event notifications are delivered to the host, in order to save power in the host.

By reducing how often the controller notifies the host app processor to scan results, the host app processor can stay in idle/sleep longer. This reduces power consumption in the host. The return parameter total_scan_results_storage of LE_Get_Vendor_Capabilities_Command indicates the chip capability for storage of scan results.

This feature focuses on the management and configuration of the LE Scan Results storage facility in the Bluetooth controller. The storage is used to temporarily batch advertisement data and scan data and metadata that are received by the controller for later delivery to the host.

Firmware shall support two types of batching, which can be engaged simultaneously:

Truncated. Contains the following information elements: {MAC, TX Power, RSSI, Timestamp}
Full. Contains the following information elements: {MAC, TX Power, RSSI, Timestamp, Adv Data, Scan Response}

LE_Batch_Scan_Command

OCF: 0x156

Command parameter	Size	Purpose
`Batch_Scan_opcode`	1 octet	0x1 - Enable customer-specific feature 0x2 - Set Batch Scan Storage parameters 0x3 - Set Batch Scan parameters 0x4 - Read Batch Scan Result parameters

A Command Complete event will be generated for this command. Enabling the customer-specific feature does not start the scan.

Return parameter	Size	Purpose
`Status`	1 octet	Command Complete status
`Batch_Scan_opcode`	1 octet	0x1 - Enable customer-specific feature 0x2 - Set Batch Scan Storage parameters 0x3 - Set Batch Scan parameters 0x4 - Read Batch Scan Result parameters

LE_Batch_Scan_Command: Enable customer-specific feature

Sub OCF: 0x01

Subcommand parameter	Size	Purpose
`enable_customer_specific_feature_set`	1 octet	0x01 - Enable Batch Scan feature 0x00 - Disable Batch Scan feature

A Command Complete event will be generated for this command.

Return parameter	Size	Purpose
`Status`	1 octet	Command Complete status
`Batch_Scan_opcode`	1 octet	0x1 - Enable customer-specific feature 0x2 - Set Batch Scan Storage parameters 0x3 - Set Batch Scan parameters 0x4 - Read Batch Scan Result parameters

LE_Batch_Scan_Command: Set batch scan storage parameter subcommand

Sub OCF: 0x02

Subcommand parameter	Size	Purpose
`Batch_Scan_Full_Max`	1 octet	Max storage space (in %) allocated to full style [Range: 0-100]
`Batch_Scan_Truncated_Max`	1 octet	Max storage space (in %) allocated to truncated style [Range: 0-100]
`Batch_Scan_Notify_Threshold`	1 octet	Setup notification level (in %) for individual storage pool [Range: 0-100] Setting to 0 will disable notification. Vendor-specific HCI event is generated (Storage threshold breach subevent)

A Command Complete event will be generated for this command.

Return parameter	Size	Purpose
`Status`	1 octet	Command Complete status
`Batch_scan_opcode`	1 octet	0x02 [Set Batch Scan parameters]

LE_Batch_Scan_Command: Set batch scan parameter subcommand

Sub OCF: 0x03

Subcommand parameter	Size	Purpose
`Batch_Scan_Mode`	1 octet	0x00 – Batch scan is disabled 0x01 – Truncated mode is enabled 0x02 – Full mode is enabled 0x03 – Truncated and Full mode are enabled
`Duty_cycle_scan_window`	4 octets	Batch Scan scan time (# of slot)
`Duty_cyle_scan_interval`	4 octets	Batch Scan interval period (# of slot)
`own_address_type`	1 octet	0x00 - Public device address 0x01 - Random device address
`Batch_scan_Discard_Rule`	1 octet	0 - Discard oldest advertisement 1 - Discard advertisement with weakest RSSI

This subcommand will start batch scanning, if enabled. In Truncated scanning, results are stored in truncated form where the unique key for Truncated style = {BD_ADDR, scan_interval}. This means only one BD_ADDR will be recorded for each scan interval. The record to keep for Truncated mode is the following: {BD_ADDR, Tx Power, RSSI, Timestamp}

When Full mode is enabled, active scanning will be used and Scan Responses will be recorded. The Full style unique key = {MAC, Ad packet}, irrespective of scan interval. The record to keep for Full mode is {BD_ADDR, Tx Power, RSSI, Timestamp, Ad packet, Scan Response}. In Full style, the same AD packet, when seen multiple times across different scan intervals, is recorded only once. However, in Truncated mode, it is the visibility of BA_ADDR across different scan intervals that is of interest (once per scan interval). The RSSI is the averaged value of all duplicates of a unique advertisement within a scan interval.

A Command Complete event will be generated for this command.

Return parameter	Size	Purpose
`Status`	1 octet	Command Complete status
`Batch_scan_opcode`	1 octet	0x03 [Set Batch Scan Parameters]

LE_Batch_Scan_Command: Read batch scan results subcommand

Sub OCF: 0x04

Subcommand parameter	Size	Purpose
`Batch_Scan_Data_read`	1 octet	0x01 - Truncated mode data 0x02 - Full mode data

A Command Complete event will be generated for this command. When the host issues this command, all the results in the controller may not fit in one Command Complete event. The host will iterate issuing this command until the corresponding results in the Command Complete event indicate 0 in the number of records, which indicates the controller has no more records to communicate to the host. Each Command Complete event could contain multiple records of only one type of data (Full or Truncated).

Controller and host time references are not synchronized. The unit of the timestamp is 50ms. The value of the timestamp is based off when the Read_Batch_Scan_Results_Sub_cmd is given by the host. If a command arrival time is T_c in the firmware, then the actual time the timestamp was taken in the firmware is T_fw. The reporting time will be: (T_c - T_fw). T_c and T_fw are in the firmware time domain. This lets the host compute how long ago the event happened.

Return parameter	Size	Purpose
`Status`	1 octet	Command Complete status
`Batch_scan_opcode`	1 octet	0x03 [Set Batch Scan parameters]
`Batch_Scan_data_read`	1 octet	Identifies the format (Truncated or Full)
`num_of_records`	1 octet	Number of records of `Batch_Scan_data_read`
`format_of_data`	Variable	Truncated Mode: Address[0]: 6 octets Address_Type[0]: 1 octet Tx_Pwr[0]: 1 octet RSSI[0] : 1 octet Timestamp[0]: 2 octets [multiple records (`num_of_records`) with above format] Full Mode: Address[0]: 6 octets Address_Type[0]: 1 octet Tx_Pwr[0]: 1 octet RSSI[0]: 1 octet Timestamp[0]: 2 octets Adv packet_len[0]: 1 octet Adv_packet[0]: Adv_packet_len octets Scan_data_resp_len[0]: 1 octet Scan_data_resp[0]: `Scan_data_resp` octets [multiple records with above format (`num_of_records`)]

Advertising Packet Content Filter

Use this to enable/disable/setup the Advertising Packet Content Filter (APCF) in the controller. APCF filters advertising reports in the controller but doesn't filter periodic advertising.

LE_APCF_Command

OCF: 0x157

Command parameter	Size	Purpose
`APCF_opcode`	1 octet	0x00 - APCF Enable 0x01 - APCF Set Filtering parameters 0x02 - APCF Broadcaster Address 0x03 - APCF Service UUID 0x04 - APCF Service Solicitation UUID 0x05 - APCF Local Name 0x06 - APCF Manufacturer Data 0x07 - APCF Service Data 0x08 - APCF Transport Discovery Service 0x09 - APCF AD Type Filter 0x10 ~ 0xAF - Reserved for future use 0xB0 ~ 0xDF - Reserved for vendor 0xE0 ~ 0xFE - Reserved for future use 0xFF - APCF Read extended Features

A Command Complete event will be generated for this command.

Return parameter	Size	Purpose
`Status`	1 octet	Return status
`APCF_opcode`	1 octet	0x00 - APCF Enable 0x01 - APCF Set Filtering parameters 0x02 - APCF Broadcaster Address 0x03 - APCF Service UUID 0x04 - APCF Service Solicitation UUID 0x05 - APCF Local Name 0x06 - APCF Manufacturer Data 0x07 - APCF Service Data 0x08 - APCF Transport Discovery Service 0x09 - APCF AD Type Filter 0x10 ~ 0xAF - Reserved for future use 0xB0 ~ 0xDF - Reserved for vendor 0xE0 ~ 0xFE - Reserved for future use 0xFF - APCF Read extended Features

LE_APCF_Command: Enable_sub_cmd

Sub OCF: 0x00

Subcommand parameter	Size	Purpose
`APCF_enable`	1 octet	0x01 - Enable APCF feature 0x00 - Disable APCF feature

A Command Complete event will be generated for this command.

Return parameter	Size	Purpose
`Status`	1 octet	Command Complete status
`APCF_opcode`	1 octet	0x0 - APCF Enable
`APCF_Enable`	1 octet	Enable/disable is set via `APCF_enable`

LE_APCF_Command: set_filtering_parameters_sub_cmd

This subcommand is used to add or delete a filter specification or clear a filter list for on-chip filtering.

Sub OCF: 0x01

Subcommand parameter	Size	Purpose
`APCF_Action`	1 octet	0x00 - Add 0x01 - Delete 0x02 - Clear Delete will clear the specific filter along with associated feature entries in other tables. Clear will clear all the filters and associated entries in other tables.
`APCF_Filter_Index`	1 octet	Filter index (0, `max_filter-1`)
`APCF_Feature_Selection`	2 octets	Bit masks for the selected features: Bit 0: Set to enable Broadcast Address filter Bit 1: Set to enable Service Data Change filter Bit 2: Set to enable Service UUID check Bit 3: Set to enable Service Solicitation UUID check Bit 4: Set to enable Local Name check Bit 5: Set to enable Manufacturer Data Check Bit 6: Set to enable Service Data Check Bit 7: Set to enable Transport Discovery Service Check Bit 8: Set to enable AD Type Check
`APCF_List_Logic_Type`	2 octets	Logic operation for each feature selection (per-bit position) specified in `APCF_Feature_Selection`. Valid only when a feature is enabled. Bit position value: 0: OR 1: AND If "AND" logic is selected, an ADV packet will pass the filter only if it contains ALL of the entries in the list. If "OR" logic is selected, an ADV packet will pass the filter if it contains any of the entries in the list.
`APCF_Filter_Logic_Type`	1 octet	0x00: OR 0x01: AND Note: The logic type is N/A for the first three fields of `APCF_Feature_Selection`, which is always "AND" logic. They are only applicable for (Bit 3 - Bit 6) four fields of `APCF_Feature_Selection`.
`rssi_high_thresh`	1 octet	[in dBm] The advertiser is considered seen only if the signal is higher than the RSSI high threshold. Otherwise, the firmware must behave as if it never saw it.
`delivery_mode`	1 octet	0x00 - `immediate` 0x01 - `on_found` 0x02 - `batched`
`onfound_timeout`	2 octets	Valid only if `delivery_mode` is `on_found`. [in milliseconds] Time for firmware to linger and collect additional advertisements before reporting.
`onfound_timeout_cnt`	1 octet	Valid only if `delivery_mode` is `on_found`. [count] If an advertisement in `onFound` lingers in firmware for the `onfound_timeout` duration, it will collect a few advertisements and the count is checked. If the count exceeds `onfound_timeout_cnt`, it's reported `OnFound` immediately thereafter.
`rssi_low_thresh`	1 octet	Valid only if `delivery_mode` is `on_found`. [in dBm] The advertiser packet is considered as not seen if the RSSI of the received packet is not above the RSSI low threshold.
`onlost_timeout`	2 octets	Valid only if `delivery_mode` is `on_found`. [in milliseconds] If an advertisement, after being found, is not seen contiguously for the `lost_timeout` period, it will immediately be reported lost.
`num_of_tracking_entries`	2 octets	Valid only if `delivery_mode` is `on_found`. [count] Total number of advertisers to track per filter.

RSSI values must use 2's complement to represent negative values.

Host shall be able to configure multiple filters with APCF_Application_Address_type set to 0x02 (for all broadcaster addresses) to manage various filter combinations.

Filtering, batching and reporting are inter-related concepts. Every advertisement and related scan response will have to go through all the filters, one after the other. Thus, resulting actions (delivery_mode) are closely tied to filtering. The delivery modes are the following: report_immediately, batch, and onFound. The OnLost value is related to OnFound in the sense that it will come after OnFound when lost.

This processing flow depicts the conceptual model:

When an advertisement (or scan response) frame is received, it is applied to all the filters in serial order. It's possible that an advertisement can cause immediate reporting based on one filter and batching of the same due to a different filter action.

RSSI level thresholds (high and low) give the ability to control when the frame is visible for filter processing, even when a valid packet is received by the controller. In case of delivery mode being set to immediate or batched, the RSSI of a frame is considered for further controller processing. Different apps need different reporting and batching behavior. This allows multiple apps to have direct reporting and/or batching of results in firmware, concurrently. An example is a case when a batch scan is active from one app and later a regular LE scan is issued by another app. Before a batch scan is issued, the framework/app sets appropriate filters. Later, when the second app issues a regular scan, previous batching continues. However, due to the regular scan, it is akin to conceptually adding a null filter (along with all the existing filters) along with the LE scan command. The LE scan command parameters take precedence when active. When the regular LE scan is disabled, the controller will revert back to a previous batch scan, if it existed.

The OnFound delivery mode is based on configured filters. A combination that triggers a filter's action to succeed is considered the entity to track for onLost. The corresponding event is the LE Advt tracking subevent.

The OnFound/OnLost transition for a filter (if enabled) will look like the following:

A Command Complete event will be generated for this command.

Return parameter	Size	Purpose
`Status`	1 octet	Command Complete status
`APCF_opcode`	1 octet	0x01 - APCF Set Filtering Parameters
`APCF_Action`	1 octet	Echo back command's `APCF_Action`
`APCF_AvailableSpaces`	1 octet	Number of available entries in the filters table

LE_APCF_Command: broadcast_address_sub_cmd

This subcommand is used to add or delete an advertiser address or to clear the advertiser address list for on-chip filtering.

Sub OCF: 0x02

Subcommand parameter	Size	Purpose
`APCF_Action`	1 octet	0x00 - Add 0x01 - Delete 0x02 - Clear Delete will delete the specified broadcaster address in the specified filter. Clear will clear all the broadcaster addresses in the specified filter.
`APCF_Filter_Index`	1 octet	Filter index (0, `max_filter-1`)
`APCF_Broadcaster_Address`	6 octet	6-byte device address to add to or delete from the broadcaster address list
`APCF_Application_Address_type`	1 octet	0x00: Public 0x01: Random 0x02: NA (ignore the address type) To filter advertising reports with identity address types (0x02, 0x03). To obtain advertising reports with address types 0x02 and 0x03, set this field to 0x02: NA (ignore the address type).

A Command Complete event will be generated for this command.

Return parameter	Size	Purpose
`Status`	1 octet	Command Complete status
`APCF_opcode`	1 octet	0x02 - APCF Broadcaster Address
`APCF_Action`	1 octet	Echo back command's `APCF_Action`
`APCF_AvailableSpaces`	1 octet	Number of free entries still available in the Broadcast Address table

LE_APCF_Command: service_uuid_sub_cmd

This subcommand is used to add or delete a service UUID or to clear a service UUID list for on-chip filtering.

Sub OCF: 0x03

Subcommand parameter	Size	Purpose
`APCF_Action`	1 octet	0x00 - Add 0x01 - Delete 0x02 - Clear Delete will delete the specified service UUID address in the specified filter. Clear will clear all the service UUIDs in the specified filter.
`APCF_Filter_Index`	1 octet	Filter index (0, `max_filter`-1)
`APCF_UUID`	2,4,16 octet	The Service UUID (16-bit, 32-bit, or 128-bit) for adding to, or deleting from, the list.
`APCF_UUID_MASK`	2,4,16 octet	The Service UUID Mask (16-bit, 32-bit, or 128-bit) to add to the list. It should have the same length as `APCF_UUID.`

A Command Complete event will be generated for this command.

Return parameter	Size	Purpose
`Status`	1 octet	Command Complete status
`APCF_opcode`	1 octet	0x03 - APCF Service UUID
`APCF_Action`	1 octet	Echo back command's `APCF_Action`
`APCF_AvailableSpaces`	1 octet	Number of free entries still available in the Service UUID table

LE_APCF_Command: solicitation_uuid_sub_cmd

This subcommand is used to add or delete a solicitation UUID or to clear a solicitation UUID list for on-chip filtering.

Sub OCF: 0x04

Subcommand parameter	Size	Purpose
`APCF_Action`	1 octet	0x00 - Add 0x01 - Delete 0x02 - Clear Delete will delete the solicitation UUID address in the specified filter. Clear will clear all the solicitation UUIDs in the specified filter.
`APCF_Filter_Index`	1 octet	Filter index (0, `max_filter`-1)
`APCF_UUID`	2,4,16 octet	The Solicitation UUID (16-bit, 32-bit, or 128-bit) to add to or delete from the list.
`APCF_UUID_MASK`	2,4,16 octet	The Solicitation UUID Mask (16-bit, 32-bit, or 128-bit) to add to the list. It should have the same length as the `APCF_UUID`.

A Command Complete event will be generated for this command.

Return parameter	Size	Purpose
`Status`	1 octet	Command Complete status
`APCF_opcode`	1 octet	0x04 - APCF Solicitation UUID
`APCF_Action`	1 octet	Echo back command's `APCF_Action`
`APCF_AvailableSpaces`	1 octet	Number of free entries still available in the Solicitation UUID table

LE_APCF_Command: local_name_sub_cmd

This subcommand is used to add or delete a local name string or to clear the local name string list for on-chip filtering.

Sub OCF: 0x05

Subcommand parameter	Size	Purpose
`APCF_Action`	1 octet	0x00 - Add 0x01 - Delete 0x02 - Clear Delete will delete the specified local name string in the specified filter. Clear will clear all the local name strings in the specified filter.
`APCF_Filter_Index`	1 octet	Filter index (0, `max_filter`-1)
`APCF_LocName_Mandata_or_SerData`	Variable size	A character string for local name. Notes: Currently the max number of characters in a local name string is 29 Not applicable when action is "Clear" (0x2)

A Command Complete event will be generated for this command.

Return parameter	Size	Purpose
`Status`	1 octet	Command Complete status
`APCF_opcode`	1 octet	0x05 - APCF Local Name
`APCF_Action`	1 octet	Echo back command's `APCF_Action`
`APCF_AvailableSpaces`	1 octet	Number of free entries still available in the Local name table

LE_APCF_Command: manf_data_sub_cmd

This subcommand is used to add or delete a manufacturer data string or to clear the manufacturer data string list for on-chip filtering.

Sub OCF: 0x06

Subcommand parameter	Size	Purpose
`APCF_Action`	1 octet	0x00 - Add 0x01 - Delete 0x02 - Clear Delete will delete the specified manufacturer data string in the specified filter. Clear will clear all the manufacturer data strings in the specified filter.
`APCF_Filter_Index`	1 octet	Filter Index (0, `max_filter`-1)
`APCF_LocName_Mandata_or_SerData`	Variable size	A character string for manufacturer data. Notes: Currently the max number of characters in a local name string is 29 Not applicable when action is "Clear" (0x2)
`APCF_ManData_Mask`	Variable size	The manufacture data mask to add to the list. It should have the same length as `APCF_LocName_or_ManData_or_SerData`.

A Command Complete event will be generated for this command.

Return parameter	Size	Purpose
`Status`	1 octet	Command Complete status
`APCF_opcode`	1 octet	0x06 - APCF Manufacturer Data
`APCF_Action`	1 octet	Echo back command's `APCF_Action`
`APCF_AvailableSpaces`	1 octet	Number of free entries still available in the Manufacturer Data table

LE_APCF_Command: service_data_sub_cmd

This subcommand is used to add or delete a service data string or to clear the service data string list for on-chip filtering.

Sub OCF: 0x07

Subcommand parameter	Size	Purpose
`APCF_Action`	1 octet	0x00 - Add 0x01 - Delete 0x02 - Clear Delete will delete the specified service data string in the specified filter. Clear will clear all the service data strings in the specified filter.
`APCF_Filter_Index`	1 octet	Filter Index (0, `max_filter`-1)
`APCF_LocName_Mandata_or_SerData`	Variable size	A character string for service data. Notes: Currently the max number of characters in a local name string is 29 Not applicable when action is "Clear" (0x2)
`APCF_LocName_Mandata_or_SerData_Mask`	Variable size	The service data mask to add to the list. It should have the same length as `APCF_LocName_or_ManData_or_SerData.`

A Command Complete event will be generated for this command.

Return parameter	Size	Purpose
`Status`	1 octet	Command Complete status
`APCF_opcode`	1 octet	0x07 - APCF Service Data
`APCF_Action`	1 octet	Echo back command's `APCF_Action`
`APCF_AvailableSpaces`	1 octet	Number of free entries still available for Service Data table

LE_APCF_Command: ad_type_sub_cmd

This subcommand is used to add or delete an AD type or to clear an AD type list for on-chip filtering. Use read_extended_features_sub_cmd to check if this command is supported or not.
When APCF_AD_DATA_Length is 0, filter APCF_AD_TYPE without comparing AD Data and AD Data Mask. If the received ADV packet's data length exceeds AD_DATA_LENGTH, compare only the first AD_DATA_LENGTH bytes of AD Data and ignore the remaining data.

Sub OCF: 0x09

Subcommand parameter	Size	Purpose
`APCF_Action`	1 octet	0x00 - Add 0x01 - Delete 0x02 - Clear Delete will delete the specified AD type in the specified filter. Clear will clear all the AD types in the specified filter.
`APCF_Filter_Index`	1 octet	Filter Index (0, `max_filter`-1)
`APCF_AD_TYPE`	1 octet	The AD Type for adding to, or deleting from, the list. Ignore when APCF_Action is 0x02 (Clear)
`APCF_AD_DATA_Length`	1 octet	0x00 - means do not filter data content Ignore when `APCF_Action` is 0x02 (Clear)
`APCF_AD_DATA`	Variable size	Variable-sized, based on `APCF_AD_DATA_Length` Ignore when `APCF_Action` is 0x02 (Clear)
`APCF_AD_DATA_MASK`	Variable size	Variable-sized, based on `APCF_AD_DATA_Length` Ignore when `APCF_Action` is 0x02 (Clear) It should have the same length as `APCF_AD_DATA`.

A Command Complete event will be generated for this command.

Return parameter	Size	Purpose
`Status`	1 octet	Command Complete status
`APCF_opcode`	1 octet	0x09 - APCF AD Type
`APCF_Action`	1 octet	Echo back command's `APCF_Action`
`APCF_AvailableSpaces`	1 octet	Number of free entries still available in the AD Type table

LE_APCF_Command: read_extended_features_sub_cmd

This subcommand is used to read extended APCF features.

Sub OCF: 0xFF

Subcommand parameter	Size	Purpose
	Not applicable	Empty command parameter.

A Command Complete event will be generated for this command.

Return parameter Size Purpose

Status 1 octet Command Complete status

APCF_opcode 1 octet 0xFF - APCF_Read_Extended_Features

APCF_extended_features

2 octet

Bit masks for extended features supported:

Bit 0: Support Transport Discovery Service filter
Bit 1: Support AD Type filter
Bit 2 ~15: Reserved for future use

Value of bit

0 = Not supported
1 = Supported

Controller activity and energy information command

The objective of this information is for higher host system functions to analyze the total activities of all components, including the BT controller and its macro state, in conjunction with what is happening in the apps and framework. To do this, the following information is required from the BT stack and the controller:

BT stack: Reporting the current macro-operational state of the controller
Firmware: Reporting aggregate activity and energy information

BT host stack macro states, as determined at the user level:

Idle: [page scan, LE advt, inquiry scan, LE scan]
Scan: [paging/inquiry/trying to connect]
Active: [ACL link on, SCO link ongoing, sniff mode]

The activities that the controller keeps track of over its life are Tx time, Rx time, idle time, and total energy consumed. They are cleared when read from the host.

LE_Get_Controller_Activity_Energy_Info

This is a vendor-specific command.

OCF: 0x159

Subcommand parameter	Size	Purpose
	NA	Empty command params

A Command Complete event will be generated for this command.

Return parameter	Size	Purpose
`Status`	1 octet	Command Complete status
`total_tx_time_ms`	4 octets	Total time performing Tx
`total_rx_time_ms`	4 octets	Total time performing Rx
`total_idle_time_ms`	4 octets	Total time in idle (non-sleep low power states)
`total_energy_used`	4 octets	Total energy used [product of current (mA), voltage (V) and time (ms)]

LE extended set scan parameters command

This command can be used to enable a larger scan window and interval in the controller. Per the BT Core 5.2 Specification, a scan window and interval have an upper bound limit of 10.24 seconds, which hampers scan intervals beyond 10.24 seconds for apps.

Base reference: BT Core 5.2 Specification, page 2493 (LE Set Scan Parameters Command)

OCF: 0x15A

Command Parameter	Size	Purpose
`LE_Ex_Scan_Type`	1 octet	0x00 - Passive scanning. No `SCAN_REQ` packets shall be sent (default). 0x01 - Active scanning. `SCAN_REQ` packets may be sent.
`LE_Ex_Scan_Interval`	4 octets	Defined as the time interval from when the Controller started its last LE scan until it began the subsequent LE scan. Range: 0x0004 to 0x00FFFFFF Default: 0x0010 (10 ms) Time = N * 0.625 ms Time range: 2.5 ms to 10442.25 seconds
`LE_Ex_Scan_Window`	4 octets	The duration of the LE scan. `LE_Scan_Window` shall be less than or equal to `LE_Scan_Interval`. Range: 0x0004 to 0xFFFF Default: 0x0010 (10 ms) Time = N * 0.625 ms Time Range: 2.5 ms to 40.95 seconds
`Own_Address_Type`	1 octet	0x00 - Public Device Address (default) 0x01 - Random Device Address
`LE_Ex_Scan_Filter_Policy`		0x00 - Accept all advertisement packets (default). Directed advertising packets which are not addressed for this device shall be ignored. 0x01 - Ignore advertisement packets from devices not in the White List Only list. Directed advertising packets which are not addressed for this device shall be ignored.

A Command Complete event will be generated for this command.

Return parameter	Size	Purpose
`Status`	1 octet	Command Complete status

Get controller debug info command

The objective of this information element is to acquire controller debug information by a host, in binary form, for post-processing and analysis. This helps debug on-field issues and provides engineers with a toolkit to log information for analysis. A Controller can provide the information when requested by a host via the event (Controller Debug Info subevent) or autonomously when desired by the controller. Example uses could be to report firmware state information, crash dump information, logging information, etc.

OCF: 0x15B

Command parameter	Size	Purpose
	N/A	Empty command parameter list

A Command Complete event will be generated for this command.

Return parameter	Size	Purpose
`Status`	1 octet	Command Complete status

A2DP hardware offload support

The A2DP offload feature supports the offload of the A2DP audio encoding process to an audio processor attached to the BT Controller. The encoded audio data stream passes directly from the Audio processor to the BT Controller without the BT host's involvement. The BT Host is still responsible for the configuration and control of the A2DP session. Two versions of the commands are available. The legacy commands with Sub OCF 0x01-0x02 only support open-source codecs. The versions with Sub-OCF 0x03-0x04 are agnostic to the configured codec.

OCF: 0x15D

Start A2DP offload (legacy)

Sub OCF: 0x01

Use this command both to configure the A2DP offload process and to start the A2DP stream.

Command parameter	Size	Purpose
`Codec`	4 octets	Specifies Codec type 0x01 - SBC 0x02 - AAC 0x04 - APTX 0x08 - APTX HD 0x10 - LDAC
`Max_Latency`	2 octets	Max Latency Allowed (in ms). A value of zero disables flush.
`SCMS-T_Enable`	2 octets	Octet 0: Flag that enables addition of SCMS-T header. 0x00 - SCMS-T Header not included. 0x01 - SCMS-T Header included. Octet 1: Value for the SCMS-T header, when it’s enabled.
`Sampling_Frequency`	4 octets	0x01 - 44100 Hz 0x02 - 48000 Hz 0x04 - 88200 Hz 0x08 - 96000 Hz
`Bits_Per_Sample`	1 octet	0x01 - 16 bits per sample 0x02 - 24 bits per sample 0x04 - 32 bits per sample
`Channel_Mode`	1 octet	0x01 - Mono 0x02 - Stereo
`Encoded_Audio_Bitrate`	4 octets	The encoded audio bitrate in bits per second second. 0x00000000 - The audio bitrate is not specified / unused. 0x00000001 - 0x00FFFFFF - Encoded audio bitrate in bits per second. 0x01000000 - 0xFFFFFFFF - Reserved.
`Connection_Handle`	2 octets	Connection Handle of A2DP connection being configured
`L2CAP_Channel_ID`	2 octets	L2CAP Channel ID to be used for this A2DP connection
`L2CAP_MTU_Size`	2 octets	Maximum size of L2CAP MTU containing encoded audio packets
`Codec_Information`	32 octets	Codec-specific Information. SBC Codec: Refer to SBC Codec specific information elements in A2DP v1.3. Octet 0: Block length \| Subbands \| Allocation Method Octet 1: Minimum Bitpool value Octet 2: Maximum Bitpool value Octet 3: Sampling Frequency \| Channel Mode Octet 4-31: reserved AAC Codec: Refer to AAC Codec specific information elements in A2DP v1.3 Octet 0: Object Type Octet 1; b7: VBR Octet 2-31: reserved LDAC Codec: Octet 0-3: Vendor ID 0x0000012D Octet 4-5: Codec ID 0x00AA - LDAC All other values are reserved Octet 6: Bitrate Index: 0x00 - High 0x01 - Mid 0x02 - Low 0x03 - 0x7E - Reserved 0x7F - ABR (Adaptive Bit Rate) 0x80 - 0xFF - Reserved Octet 7: LDAC Channel Mode 0x01 - Stereo 0x02 - Dual 0x04 - Mono Others are reserved Octet 8-31: reserved All other codecs: Octet 0-31: reserved

A Command Complete event will be generated for this command.

Return parameter	Size	Purpose
`Status`	1 octet	Command Complete status
`Sub_Opcode`	1 octet	0x01 - Start A2DP offload

Start A2DP offload

Sub OCF: 0x03

Use this command both to configure the A2DP offload process and to start the A2DP stream.

Command parameter	Size	Purpose
`Connection Handle`	2 octets	Handle of the active HCI connection
`L2CAP_Channel_ID`	2 octets	Identifier of the L2CAP Channel opened for A2DP streaming
`Data_Path_Direction`	1 octet	0x00 - Output (AVDTP Source/Merge) 0x01 - Input (AVDTP Sink/Split)
`Peer_MTU`	2 octets	Maximum size of L2CAP packets, negotiated with the peer.
`CP_Enable_SCMS_T`	1 octet	0x00 - Disable SCMS-T Content Protection Header 0x01 - Enable SCMS-T Content Protection Header
`CP_Header_SCMS_T`	1 octet	When SCMS-T Content Protection Header is enabled (`CP_SCMS_T_Enable` set to 0x01), defines the header value that precedes the audio content (refer to A2DP, section 3.2.1-2) as defined by Bluetooth Assigned Numbers, section 6.3.2. Ignored when SCMS-T Content protection isn't enabled.
`Vendor_Specific_Parameters_Length`	1 octet	Length of Vendor Specific Parameters, in the range from 0 to 128. The value 0 is used when no additional parameters are provided.
`Vendor_Specific_Parameters`	0-128 octets	Vendor Specific Parameters provided by the Bluetooth Audio HAL, `CodecParameters.vendorSpecificParameters[]`.

A Command Complete event will be generated for this command.

Return parameter	Size	Purpose
`Status`	1 octet	Command Complete status
`Sub_Opcode`	1 octet	0x03 - Start A2DP offload

Stop A2DP offload (legacy)

Sub OCF: 0x02

This command is used to stop the A2DP offload stream.

Command parameter	Size	Purpose
	N/A	Empty command parameter list.

No parameters are defined for this command.

A Command Complete event will be generated for this command.

Return parameter	Size	Purpose
`Status`	1 octet	Command Complete status
`Sub_Opcode`	1 octet	0x02 - Stop A2DP offload

Stop A2DP offload

Sub OCF: 0x04

This command is used to stop the A2DP offload stream.

Command parameter	Size	Purpose
`Connection Handle`	2 octets	Handle of the active HCI connection
`L2CAP_Channel_ID`	2 octets	Identifier of the L2CAP Channel opened for A2DP streaming
`Data_Path_Direction`	1 octet	0x00 - Output (AVDTP Source/Merge) 0x01 - Input (AVDTP Sink/Split)

A Command Complete event will be generated for this command.

Return parameter	Size	Purpose
`Status`	1 octet	Command Complete status
`Sub_Opcode`	1 octet	0x04 - Stop A2DP offload

Bluetooth Quality Report command

The BT Quality Report command feature starts the mechanism in the Bluetooth controller to report Bluetooth Quality events to the host. You can enable four options:

Quality Monitoring Mode: The controller periodically sends a Link Quality related BQR subevent to the host.
Approaching LSTO: If no packets are received from the connected BT device for longer than half of the Link Supervision TimeOut (LSTO) value, the controller reports an Approaching LSTO event to the host.
A2DP Audio Choppy: When the controller detects factors that cause choppy audio, the controller reports an A2DP Audio Choppy event to the host.
(e)SCO Voice Choppy: When the controller detects factors that cause choppy voice, the controller reports an (e)SCO Voice Choppy event to the host.
Root Inflammation: This event is sent by the controller to the stack when the HAL or the controller encounters a fatal error and needs to restart Bluetooth.
LMP/LL message trace: The controller sends the LMP/LL message handshaking with the remote device to the host.
Bluetooth Multi-profile/Coex scheduling trace: The controller sends its scheduling information on handling multiple Bluetooth profiles and wireless coexistence in the 2.4 Ghz band to the host.
Controller Debug Information mechanism: When enabled, the controller can autonomously report debug logging information through the Controller debug info subevent to the host.
LE Audio Choppy: When the controller detects factors that cause choppy audio, the controller reports an LE Audio Choppy event to the host.
Advance RF Stats mode: The controller reports its RF stats related information to the host, supporting two report use cases:
- Periodic reports
- Event triggers (stream start/stop and link quality event trigger).
The controller health monitoring mechanism provides the host with health-related information through two types of events: periodic reports and event-triggered reports.
BQR_Report_Action of Bluetooth Quality Report Command: The host can use this HCI command to get a one time query for quality monitoring mode, energy monitor mode, or an advance RF stats mode.

OCF: 0x15E

Command parameter	Size	Purpose
`BQR_Report_Action`	1 octet	Action to add / delete reporting of quality event(s) set in BQR_Quality_Event_Mask parameter, or clear all. 0x00 - Add 0x01 - Delete 0x02 - Clear 0x03 - One time query Delete will clear specific quality event(s) reporting. Clear will clear all quality events reporting (BQR_Quality_Event_Mask parameter can be ignored).
`BQR_Quality_Event_Mask`	4 octets	Bit masks for the selected quality event reporting. Bit 0: Set to enable quality monitoring mode. Bit 1: Set to enable Approaching LSTO event (for ACL/(e)SCO/ISO). Bit 2: Set to enable A2DP Audio Choppy event. Bit 3: Set to enable (e)SCO Voice Choppy event. Bit 4: Set to enable Root inflammation event. Bit 5: Set to enable energy monitoring mode. Bit 6: Set to enable LE audio choppy event. Bit 7: Set to enable connect fail event. Bit 8: Set to enable Advance RF Stats mode event trigger. Bit 9: Set to enable Advance RF Stats periodic report. Bit 10: Set to enable controller health monitoring mechanism event trigger. (added in BQRv7) Bit 11: Set to enable controller health monitoring mechanism periodically report. (added in BQRv7) Bit 12 ~ 14: Reserved. Bit 15: Set to enable vendor-specific quality events. Bit 16: Set to enable LMP/LL message trace. Bit 17: Set to enable Bluetooth Multi-link/Coex scheduling trace. Bit 18: Set to enable the Controller Debug Information mechanism. Bit 19: Reserved for offload debug information. Bit 20: UART History Dump Event trigger. (added in BQRv7) Bit 21 ~ 30: Reserved. Bit 31: Set to enable vendor-specific trace.
`BQR_Minimum_Report_Interval`	2 octets	Define the minimum time interval of quality event reporting for the selected quality event(s). The controller Firmware should not report the next event within the defined time interval. The interval setting shall be respective and dedicated for the quality event(s) which are being added. Unit: ms Default: 0 (No limitation for the interval.) Range: 0 ~ 65535 ms
`BQR_Vendor_Specific_Quality_Event_Mask`	4 octets	Bit masks for the selected vendor-specific quality event reporting. This parameter is valid only when bit 15 of `BQR_Quality_Event_Mask` is set. Bit 0 ~ 31: Reserved.
`BQR_Vendor_Specific_Trace_Mask`	4 octets	Bit masks for the selected vendor-specific trace reporting. This parameter is valid only when bit 31 of `BQR_Quality_Event_Mask` is set. Bit 0 ~ 31: Reserved.
`Report_interval_multiple`	4 octets	The multiplier for `BQR_Minimum_Report_Interval`. When this value >= 1, the BQR Report Interval follows the format BQR Report Interval = BQR_Minimum_Report_Interval x Report_interval_multiple. The controller Firmware must not report the next event within the defined time interval. The interval setting is specifically dedicated for the added quality event(s). Unit: ms Default: 1 Range: 0 ~ 4294967295 (0: is equal set to 1) Note: if the setting of `BQR_Report_Interval` is larger than the ability of the controller, the controller must return the maximum `BQR_Report_Interval` time on the completion of the command.

A Command Complete event will be generated for this command.

Return parameter	Size	Purpose
`Status`	1 octet	Command Complete status
`Current_Quality_Event_Mask`	4 octets	Indicates current bit mask setting. Bit 0: Quality monitoring mode is enabled. Bit 1: Approaching LSTO event reporting is enabled. Bit 2: A2DP Audio Choppy event reporting is enabled. Bit 3: (e)SCO Voice Choppy event reporting is enabled. Bit 4: Root inflammation event reporting is enabled. Bit 5: Energy monitoring mode is enabled. Bit 6: LE audio choppy event reporting is enabled. Bit 7: Connect fail event. Bit 8: Set to enable Advance RF Stats mode event trigger. Bit 9: Set to enable Advance RF Stats periodically report. Bit 10: Set to enabled controller health monitoring mechanism event trigger. Bit 11: Set to enabled controller health monitoring mechanism periodically report. Bit 12 ~ 14: Reserved. Bit 15: Vendor-specific quality event reporting is enabled. Bit 16: LMP/LL message trace is enabled. Bit 17: Bluetooth Multi-link/Coex scheduling trace is enabled. Bit 18: Controller Debug Information mechanism is enabled. Bit 19: Reserved for offload debug information Bit 20: UART History Dump Event trigger Bit 21 ~ 30: Reserved. Bit 31: Vendor-specific trace is enabled.
`Current_Vendor_Specific_Quality_Event_Mask`	4 octets	Indicates current bit mask setting.
`Current_Vendor_Specific_Trace_Mask`	4 octets	Indicates current bit mask setting.
`BQR_Report_interval`	4 octets	Indicates current bit mask setting.
`Current_Vendor_Specific_Trace_Mask`	4 octets	The setting of `BQR_Report_interval`. It must be the minimum value between BQR_Minimum_Report_Interval * Report_interval_multiple or the maximum support interval of the controller.

Dynamic audio buffer command

The dynamic audio buffer reduces audio glitching by changing the audio buffer size in the Bluetooth controller based on various scenarios.

OCF: 0x15F

Get audio buffer time capability

Sub OCF: 0x01

Use this command to get the audio buffer time capability from the Bluetooth controller.

Command parameter	Size	Purpose
	N/A	Empty Command parameter list

A Command Complete event will be generated for this command.

Return parameter	Size	Purpose
`Status`	1 octet	Command Complete status
`Dynamic_Audio_Buffer_opcode`	1 octet	0x01 - Get audio buffer time
`Audio_Codec_Type_Supported`	4 octets	Bit masks for the supported codec types Bit 0 - SBC Bit 1 - AAC Bit 2 - APTX Bit 3 - APTX HD Bit 4 - LDAC Bit 5-31 are reserved
`Audio_Codec_Buffer_Default_Time_For_Bit_0`	2 octets	Default buffer time of the Bit 0 codec type specified in Audio_Codec_Type_Supported. This value shall be 0 if the Bit 0 codec type is not supported. Unit: ms
`Audio_Codec_Buffer_Maximum_Time_For_Bit_0`	2 octets	Maximum buffer time of the Bit 0 codec type specified in Audio_Codec_Type_Supported. This value shall be 0 if the Bit 0 codec type is not supported. Unit: ms
`Audio_Codec_Buffer_Minimum_Time_For_Bit_0`	2 octets	Minimum buffer time of the Bit 0 codec type specified in Audio_Codec_Type_Supported. This value shall be 0 if the Bit 0 codec type is not supported. Unit: ms
`Audio_Codec_Buffer_Default_Time_For_Bit_1`	2 octets	Default buffer time of the Bit 1 codec type specified in Audio_Codec_Type_Supported. This value shall be 0 if the Bit 1 codec type is not supported. Unit: ms
`Audio_Codec_Buffer_Maximum_Time_For_Bit_1`	2 octets	Maximum buffer time of the Bit 1 codec type specified in Audio_Codec_Type_Supported. This value shall be 0 if the Bit 1 codec type is not supported. Unit: ms
`Audio_Codec_Buffer_Minimum_Time_For_Bit_1`	2 octets	Minimum buffer time of the Bit 1 codec type specified in Audio_Codec_Type_Supported. This value shall be 0 if the Bit 1 codec type is not supported. Unit: ms
......	......	......
`Audio_Codec_Buffer_Default_Time_For_Bit_31`	2 octets	Default buffer time of the Bit 31 codec type specified in Audio_Codec_Type_Supported. This value shall be 0 if the Bit 31 codec type is not supported. Unit: ms
`Audio_Codec_Buffer_Maximum_Time_For_Bit_31`	2 octets	Maximum buffer time of the Bit 31 codec type specified in Audio_Codec_Type_Supported. This value shall be 0 if the Bit 31 codec type is not supported. Unit: ms
`Audio_Codec_Buffer_Minimum_Time_For_Bit_31`	2 octets	Minimum buffer time of the Bit 31 codec type specified in Audio_Codec_Type_Supported. This value shall be 0 if the Bit 31 codec type is not supported. Unit: ms

Set audio buffer time

Sub OCF: 0x02

Use this command to set the audio buffer time to the Bluetooth controller.

Command parameter	Size	Purpose
`Audio_Codec_Buffer_Time`	2 octets	Requested audio buffer time for the current used codec. Unit: ms

A Command Complete event will be generated for this command.

Return parameter	Size	Purpose
`Status`	1 octet	Command Complete status
`Dynamic_Audio_Buffer_opcode`	1 octet	0x02 - Set audio buffer time
`Audio_Codec_Buffer_Time`	2 octets	Current audio buffer time in the Bluetooth controller. Unit: ms

HCI event (vendor-specific)

Vendor-specific HCI events are required in some cases. Refer to Figure 5.4 on page 1897 of the BT Core 5.2 Specification. Event parameter 0 will always contain the first subevent code, based on which the rest of the HCI event is decoded.

Event Parameter	Size	Purpose
`HCI_vendor_specific_event_code`	1 octet	0xFF
`sub_event_code`	1 octet	A subevent code will be 1 octet in size, the byte immediately following Parameter Length in the HCI event packet.

Storage threshold breach subevent

This event indicates that the storage threshold has been breached.

Subevent code = 0x54

Subevent Parameter	Size	Purpose
None

LE multi-advertising state change subevent

This event indicates that an advertising instance has changed its state. At this time, this event is only used to indicate which advertising instance was stopped as a result of a connection.

Subevent code = 0x55

Subevent parameter	Size	Purpose
`Advertising_instance`	1 octet	Identifies the specific advertising instance Valid values are 0 through `max_advt_instances`-1
`State_Change_Reason`	1 octet	0x00: Connection received
`Connection_handle`	2 octets	Identifies the connection that caused the `advt` instance to be disabled (0xFFFF if invalid)

LE advertisement tracking subevent

This event indicates when an advertiser is found or lost.

Sub event code = 0x56

Subevent Parameter	Size	Purpose
`APCF_Filter_Index`	1 octet	Filter Index (0, `max_filter`-1)
`Advertiser_State`	1 octet	0x00: Advertiser found 0x01: Advertiser lost
`Advt_Info_Present`	1 octet	0x00: Advertiser information (`Advt_Info`) present 0x01: Advertiser information (`Advt_Info`) not present
`Advertiser_Address`	6 octets	Public or random address
`Advertiser_Address_Type`	1 octet	0x00: Public address 0x01: Random address
`Advt_Info`		`Tx_Pwr[0]`: 1 octet `RSSI[0]`: 1 octet `Timestamp[0]`: 2 octets `Adv packet_len[0]`: 1 octet `Adv_packet[0]`: `Adv_packet_len` octets `Scan_data_resp_len[0]`: 1 octet `Scan_data_resp[0]`: `Scan_data_resp` octets

Controller debug info subevent

This event is used by a Controller to provide binary debug information to a host.

Subevent code = 0x57

Subevent Parameter	Size	Purpose
`debug_block_byte_offset_start`	2 octets	Debug block byte offset from the start
`last_block`	1 octet	0x00: More debug data present 0x01: Last binary block; no more debug data
`cur_pay_load_sz`	2 octets	Binary block size in a current event
`Debug_Data`	Variable	Debug data of `cur_payload_sz`

Bluetooth Quality Report subevent

This event indicates one of the following: a Bluetooth quality event occurred, the controller uploaded the LMP/LL message trace and Bluetooth Multi-link/Coex scheduling trace, or the controller dumped debug information data.

Subevent Parameter	Size	Purpose
`Quality_Report_Id`	1 octet	0x01: Quality reporting on the monitoring mode. 0x02: Approaching LSTO. 0x03: A2DP Audio Choppy. 0x04: (e)SCO Voice Choppy. 0x05 ~ 0x06: Reserved. 0x07: LE audio choppy. 0x08: Connect fail. 0x09 ~ 0xFF: Reserved.
`Packet_Types`	1 octet	0x01: ID 0x02: NULL 0x03: POLL 0x04: FHS 0x05: HV1 0x06: HV2 0x07: HV3 0x08: DV 0x09: EV3 0x0A: EV4 0x0B: EV5 0x0C: 2-EV3 0x0D: 2-EV5 0x0E: 3-EV3 0x0F: 3-EV5 0x10: DM1 0x11: DH1 0x12: DM3 0x13: DH3 0x14: DM5 0x15: DH5 0x16: AUX1 0x17: 2-DH1 0x18: 2-DH3 0x19: 2-DH5 0x1A: 3-DH1 0x1B: 3-DH3 0x1C: 3-DH5 0x1D ~ 0x50: Reserved 0x51: ISO packet 0x52: 1M PHY 0x53: 2M PHY 0x54: Codec PHY S=2 0x55: Codec PHY S=8 0x56 ~ 0xFF: Reserved
`Connection_Handle`	2 octets	ACL/(e)SCO/ISO connection handle.
`Connection_Role`	1 octet	Performing Role for the connection. 0x00: Central 0x01: Peripheral 0x02 ~ 0xFF: Reserved.
`TX_Power_Level`	1 octet	Current transmit power level for the specified Connection_Handle. This value shall be the same as the controller's responding to the HCI_Read_Transmit_Power_Level HCI command.
`RSSI`	1 octet	[in dBm] Received Signal Strength Indication (RSSI) value for the specified Connection_Handle. This value shall be an absolute receiver signal strength value. Range: -127 to +20
`SNR`	1 octet	[in dB] Signal-to-Noise Ratio (SNR) value for the specified Connection_Handle. The controller shall provide the average SNR of all the channels used by the link.
`Unused_AFH_Channel_Count`	1 octet	Indicates the number of unused channels in AFH_channel_map. 0x4F ~ 0xFF: Reserved.
`AFH_Select_Unideal_Channel_Count`	1 octet	Indicates the number of the channels which are interfered and have bad quality, but they are still selected for AFH. The minimum number of channels allowed by the Bluetooth specification is 20, so even if all 79 channels are interfered and have bad quality, the controller still needs to choose at least 20 channels for AFH.
`LSTO`	2 octets	Current Link Supervision Timeout Setting. Time = N * 0.625 ms Time Range: 0.625 ms to 40.9 s
`Connection_Piconet_Clock`	4 octets	Piconet Clock for the specified Connection_Handle. This value shall be the same as the controller's responding to HCI_Read_Clock HCI command with parameter "Which_Clock" of 0x01 (Piconet Clock). Unit: N * 0.3125 ms (1 Bluetooth Clock)
`Retransmission_Count`	4 octets	The number of retransmissions since the last event. This count shall be reset after reporting to the host.
`No_RX_Count`	4 octets	No RX count since the last event. The count increases when no packet is received at the scheduled time slot or the received packet is corrupted. This count shall be reset after reporting to the host.
`NAK_Count`	4 octets	NAK (Negative Acknowledge) count since the last event. This count shall be reset after reporting to the host.
`Last_TX_ACK_Timestamp`	4 octets	Timestamp of last TX ACK. It is based on the Bluetooth Clock of the piconet central (CLK). Unit: N * 0.3125 ms (1 Bluetooth Clock)
`Flow_Off_Count`	4 octets	The number of times the controller receives Flow-off (STOP) since the last event. This count shall be reset after reporting to the host.
`Last_Flow_On_Timestamp`	4 octets	Timestamp of last Flow-on (GO). It is based on the Bluetooth Clock of the piconet central (CLK). Unit: N * 0.3125 ms (1 Bluetooth Clock)
`Buffer_Overflow_Bytes`	4 octets	[in Byte] Buffer overflow count since the last event. The controller counts how many bytes of data are dropped. This count shall be reset after reporting to host.
`Buffer_Underflow_Bytes`	4 octets	[in Byte] Buffer underflow count since the last event. This count shall be reset after reporting to host.
`bdaddr`	6 octets	Remote device address
`cal_failed_item_count`	1 octet	The count of calibration failed items
`TX_Total_Packets`	4 octets	The number of packets that are sent out.
`TX_UnAcked_Packets`	4 octets	The number of packets that don't receive an acknowledgment. This count is reset after reporting to the host.
`TX_Flushed_Packets`	4 octets	The number of packets that aren't sent out by its flush point. This count is reset after reporting to the host.
`TX_Last_Subevent_Packets`	4 octets	The number of packets that Link Layer transmits a CIS data PDU in the last subevent of a CIS event. This count is reset after reporting to the host. The value is zero if there's no valid value for the link.
`CRC_Error_Packets`	4 octets	The number of received packages with CRC error since the last event. This count is reset after reporting to the host.
`RX_Duplicate_Packets`	4 octets	The number of duplicate (retransmission) packages received since the last event. This count is reset after reporting to the host.
`RX_Unreceived_Packets`	4 octets	The number of unreceived packets is the same as the parameter of the LE READ ISO Link Quality command (see Bluetooth core Specification Version 5.4). The associated streams are CIS and BIS. When this value is incremented, the Link Layer doesn't receive a specific payload by its flush point (on a CIS) or at the end of the event it is associated with (on a BIS; see Bluetooth core Specification Version 5.4 Vol 6 Part B, Section 4.4.6.6).
`Coex_Info_Mask`	2 octets	Bit 0 - CoexInvolvement: Set to indicate coex activities are suspected to be involved when this report is generated (for example, A2DP Chops and Approaching LSTO). Bit 1 - WL 2G Radio Active: Set to indicate WLAN 2G Radio is active. Bit 2 - WL 2G Connected: Set to indicate WLAN 2G Radio is active and connected. Bit 3 - WL 5G/6G Radio Active: Set to indicate WLAN 5G/6G Radio is active. Bit 4-15 - Reserved
Vendor Specific Parameter	(parameter total length - TBD) * octets	For the controller vendor to obtain more vendor specific parameters.

Subevent code = 0x58 [Quality_Report_Id = 0x05, Root Inflammation event]

This event indicates that Bluetooth HAL or the controller encountered a fatal error and needs Bluetooth stack to record this situation and restart. The controller must send a Root_Inflammation_Event to Bluetooth stack before sending the first fragment of the debug info events in any case.

The Error_Code parameter contains an error code reported from HAL/Controller, 0 if it is a chipset vendor specific error. The Vendor_Specific_Error_Code contains a chipset vendor specific error code from HAL/Controller. It should set as 0 if the parameter Error_Code is not 0. The parameters Error_Code and Vendor_Specific_Error_Code should not both be 0.

Subevent Parameter	Size	Purpose
`Quality_Report_Id`	1 octet	0x00 ~ 0x04: Reserved. 0x05: Root inflammation. 0x06 ~ 0xFF: Reserved.
`Error_Code`	1 octet	0x00: Chipset vendor specific error code is included. 0x01 ~ 0xFF: Controller failure occurred. See Bluetooth Spec [Vol 2] Part D, Error Codes for a list of error codes and descriptions.
`Vendor_Specific_Error_Code`	1 octet	0x00: No chipset vendor specific error code is included. 0x01 ~ 0xFF: Chipset vendor specific error code.
Vendor Specific Parameter	(Parameter Total Length - 4) * octets	For the controller vendor to obtain more vendor specific parameters.

Subevent code = 0x58 [Quality_Report_Id = 0x06, Energy monitor event]

This event provides a snapshot of the Bluetooth controller's power consumption and operational states over a specific time period. This event helps developers and engineers analyze how the controller manages power, identify which activities consume the most energy, and troubleshoot power-related issues.

The parameters in the report track key metrics, including:

Average current consumption: The overall current used by the controller.
Time spent in different states: The total time (in milliseconds) the controller spends in an idle (sleep/low power) state versus an active state (connecting, transmitting, or receiving data).
State transition counts: The number of times the controller switches between idle and active states.
Time spent in specific radio states: Separate metrics for time spent transmitting (Tx) and receiving (Rx) for both BR/EDR (Bluetooth Classic) and LE (Bluetooth Low Energy) links.
Average transmit power levels: The average power (in dBm) used for transmissions on BR/EDR and LE links.
Detailed chain activity: Reports on time spent with active transmit or receive chains, distinguishing between one-chain and two-chain operations, and between internal (iPA) and external (ePA) power amplifiers.
Scan activity time: The time the controller spends actively scanning for BR/EDR and LE devices.

By examining these parameters, engineers can gain insight into the controller's power efficiency and optimize its performance.

Subevent Parameter	Size	Purpose
`Quality_Report_Id`	1 octet	0x06: Energy Monitoring
`Average_Current_Consumption`	2 octets	[in mA] Average current consumption of all activities consumed by the controller
`Idle_Total_Time` (sleep)	4 octets	[in ms] Total time in the idle (low power states, sleep) state.
`Idle_Sate_Enter_Count`	4 octets	Indicates how many times the controller enters the idle state.
`Active_Total_Time`	4 octets	[in ms] Total time in the active (inquiring, paging, ACL/SCO/eSCO/BIS/CIS traffic, processing any task) state.
`Active_State_Enter_Count`	4 octets	Indicates how many times the controller enters the active states.
`BR_RDR_Tx_Total_Time`	4 octets	[in ms] Total time in the BR/EDR specific Tx(Transmitting for ACL/SCO/eSCO traffic)state.
`BR_RDR_Tx_State_Enter_Count`	4 octets	Indicates how many times the controller enters the BR/EDR specific Tx state.
`BR_RDR_Tx_Average_Power_Level`	1 octets	[in dBm] Average Tx power level of all the BR/EDR link(s)
`BR_RDR_Rx_Total_Time`	4 octets	[in ms] Total time in the BR/EDR specific Rx (Receiving from ACL/SCO/eSCO traffic) state.
`BR_RDR_Rx_State_Enter_Count`	4 octets	[in ms] Indicates how many times the controller enters the BR/EDR specific Rx state.
`LE_Tx_Total_Time`	4 octets	[in ms] Total time in the LE specific Tx (Transmitting for either ACL/BIS/CIS or LE advertising traffic) state.
`LE_Tx_State_Enter_Count`	4 octets	Indicates how many times the controller enters the BR/EDR specific Rx state.
`LE_Tx_Average_Power_Level`	1 octets	[in dBm] Average Tx power level of all the LE link(s).
`LE_Rx_Total_Time`	4 octets	[in ms] Total time in the LE specific Rx (Receiving from either ACL/BIS/CIS or LE scanning traffic) state.
`LE_Rx_State_Enter_Count`	4 octets	[in ms] Indicates how many times the controller enters the LE specific Rx state
`Report_Time_Duration` (Total time)	4 octets	[in ms] The total time duration to collect power related information.
`RX_Active_One_Chain_Time`	4 octets	[in ms] The time duration of RX active in one chain
`RX_Active_Two_Chain_Time`	4 octets	[in ms] The time duration of RX active in two chain
`TX_iPA_Active_One_Chain_Time`	4 octets	[in ms] The time duration of internal TX active in one chain
`TX_iPA_Active_Two_Chain_Time`	4 octets	[in ms] The time duration of internal TX active in two chain
`TX_ePA_Active_One_Chain_Time`	4 octets	[in ms] The time duration of external TX active in one chain
`TX_ePA_Active_Two_Chain_Time`	4 octets	[in ms] The time duration of external TX active in two chain
`BREDR_RX_Active_Scan_total_Time`	4 octets	[in ms] Time period (ms) on BR/EDR scan RX active time
`LE_RX_Active_Scan_total_Time`	4 octets	[in ms] Time period (ms) on LE scan RX active time

Subevent code = 0x58 [Quality_Report_Id = 0x09~0x0A, Advanced RF stats event]

The Bluetooth Advanced RF (Radio Frequency) Stats event provides detailed performance metrics about the Bluetooth controller's radio behavior. The event can be triggered in two ways:

By Trigger (0x09): A one-time report is sent in response to a specific command.
By Monitor (0x0A): The controller periodically sends reports at a specified interval.

The event's parameters are essentially packet counters that track various radio behaviors over a specified time period.

Key metrics and their purpose

Transmit power statistics: These counters track packets sent using different power configurations, distinguishing between internal (iPA) and external (ePA) power amplifiers and various antenna diversity (Div) or beamforming (BF) modes. This helps determine which power and antenna settings are being used most frequently.
Received signal strength indicator (RSSI) bins: These parameters categorize received packets based on their signal strength. By providing a count of packets within specific RSSI ranges (e.g., less than -90 dBm, -70 to -75 dBm), the report gives a clear picture of the link quality. A high count in the "weak" signal bins (for example, < -90 dBm) indicates a poor connection.
RSSI delta: This metric measures the difference in signal strength between the two receive antennas (if applicable). Counters track how many packets have an RSSI delta within different ranges. A large delta (e.g., >11 dBm) can suggest interference or a physical obstruction, as one antenna is receiving a much stronger signal than the other.
Antenna switching and re-transmissions: The report counts how often the controller switches between antennas and tracks re-transmitted (ReTX) packets. A high number of re-transmissions often points to a weak or unreliable connection, requiring packets to be resent.
Channel quality: These parameters provide a high-level summary of the health of different communication channels, categorizing them as "Good," "OK," "Bad," or "Very Bad" based on their RSSI. This gives an immediate overview of the RF environment.
TX buffer queue: This section monitors the number of packets waiting in the controller's transmit buffer for different link types, such as ACL (Asynchronous Connection-oriented Logical link), LECONN (LE Connection), and LEISOC (LE Isochronous). High buffer counts can indicate a bottleneck or a problem with data flowing from the host to the controller.

Subevent parameter	Size	Purpose
`Quality_Report_Id`	1 octet	0x09: Advance RF Stats By Trigger 0x0A: Advance RF Stats By Monitor
`Extension_info`	1 octet	BQR version information. 0x01 for BQRv6 0x02 for BQRv7
`Report_Time_Period`	4 octets	The time period to collect performance information. Unit: ms
`TX_Power_iPA_BF`	4 octets	Packet counter of iPA BF
`TX_Power_ePA_BF`	4 octets	Packet counter of ePA BF
`TX_Power_iPA_Div`	4 octets	Packet counter of ePA Div
`TX_Power_ePA_Div`	4 octets	Packet counter of ePA Div
`RSSI_chain_50`	4 octets	Packet counter of RSSI chain > -50 dBm
`RSSI_chain_50_55`	4 octets	Packet counter of RSSI chain between -50 dBm ~ >-55 dBm
`RSSI_chain_55_60`	4 octets	Packet counter of RSSI chain between -55 dBm ~ >-60 dBm
`RSSI_chain_60_65`	4 octets	Packet counter of RSSI chain between -60 dBm ~ >-65 dBm
`RSSI_chain_65_70`	4 octets	Packet counter of RSSI chain between -65 dBm ~ >-70 dBm
`RSSI_chain_70_75`	4 octets	Packet counter of RSSI chain between -70 dBm ~ >-75 dBm
`RSSI_chain_75_80`	4 octets	Packet counter of RSSI chain between -75 dBm ~ >-80 dBm
`RSSI_chain_80_85`	4 octets	Packet counter of RSSI chain between -80 dBm ~ >-85 dBm
`RSSI_chain_85_90`	4 octets	Packet counter of RSSI chain between -85 dBm ~ >-90 dBm
`RSSI_chain_90`	4 octets	Packet counter of RSSI chain < -90 dBm
`RSSI_delta_2`	4 octets	Packet counter of RSSI delta < 2 dBm
`RSSI_delta_2_5`	4 octets	Packet counter of RSSI delta between 2 dBm ~ 5 dBm
`RSSI_delta_5_8`	4 octets	Packet counter of RSSI delta between 5 dBm ~ 8 dBm
`RSSI_delta_8_11`	4 octets	Packet counter of RSSI delta between 8 dBm ~ 11 dBm
`RSSI_delta_11`	4 octets	Packet counter of RSSI delta > 11 dBm
`Antenna_Switch_Count`	4 octets	Packet counter of antenna switching event
`ReTX_iPA_BF`	4 octets	Packet counter of ReTX_iPA_BF in the latest time period
`ReTX_ePA_BF`	4 octets	Packet counter of ReTX_ePA_BF in the latest time period
`ReTX_iPA_Div`	4 octets	Packet counter of ReTX_iPA_Div in the latest time period
`ReTX_ePA_Div`	4 octets	Packet counter of ReTX_ePA_Div in the latest time period
`Channel_count_Good`	1 octets	Number of channels whose RSSI falls within Bin-1 (<-90)
`Channel_count_OK`	1 octets	Number of channels whose RSSI falls within Bin-2 (-90~-76)
`Channel_count_Bad`	1 octets	Number of channels whose RSSI falls within Bin-3 (-76~-50)
`Channel_count_VeryBad`	1 octets	Number of channels whose RSSI falls within Bin-4 (>-50)
`TX_buffer_Queue_Count`	4 octets	Counter of buffer queue status-controller TX buffer in the latest time period [0:3] ACL_1 [4:7] ACL_2 [8:11] LECONN_1 [12:15] LECONN_2 [16:19] LEISOC_1 [20:23] LEISOC_2 [24:27] LEBroadcast [28:31] rsvd

Subevent code = 0x58 [Quality_Report_Id = 0x0B~0x0C, Controller Health Monitoring event]

The Bluetooth Controller Health Monitoring event provides a summary of the controller's operational status. The event can be triggered in two ways:

By Trigger (0x09): A one-time report is sent in response to a specific command.
By Monitor (0x0A): The controller periodically sends reports at a specified interval.

The Bluetooth Controller Health Monitoring event is a diagnostic tool that provides a summary of the controller's operational status. This event is part of the Bluetooth Quality Report (BQR) framework and is used for debugging connectivity, power management, and timing issues. It can be sent as a one-time report or periodically to provide continuous monitoring.

Key metrics and their purpose

HCI Packet Counters: The event tracks the total number of packets sent from the Host to the Controller and vice versa. These counters are essential for debugging issues with the Host Controller Interface (HCI) transport, which is the communication channel between the software stack and the Bluetooth controller chip.
Packet Lengths: The event reports the length of the last HCI packet sent and received. This helps verify that data is being transmitted correctly and that there are no unexpected size issues.
Wake-up Signal Counts: The report includes the total number of times the BT_Wake and HOST_Wake pins have been asserted. These physical signals are critical for power management, as they are used to wake the respective entities from low-power states. Monitoring these counts helps debug power-related problems, such as unexpected wake-ups or failures to enter sleep mode.
Timestamps: The event provides several timestamps, including the time of the last wake-up signal and the last HCI reset. These timestamps help troubleshoot timing-related issues and provide a reference point for when certain events occurred.
Watchdog Timer: A specific flag indicates if the event was generated as an early warning that the controller's watchdog timer is about to expire. This is a critical alert for potential controller freezes or malfunctions.
Link Status: The report summarizes the current state of active connections, including the total count of BR/EDR, LE, and CIS (Connected Isochronous Stream) links. It also indicates if any SCO (Synchronous Connection-Oriented) links are active. This information provides a snapshot of the controller's current connection load.

Subevent parameter	Size	Purpose
`Quality_Report_Id`	1 Octet	0xB~0xC 0x0B: one-time or event-triggered reports 0x0C: periodic reports.
`Packet_Count_Host_to_Controller`	4 Octets	Total count of packets sent from Host to Controller over HCI transport. This field is employed for the purpose of debugging HCI (for example, UART) issues. Behavior: the counters reset when the controller received HCI reset.
`Packet_Count_Controller_to_Host`	4 Octets	Total count of HCI Event packets sent to Host. This field is employed for the purpose of debugging HCI (e.g., UART) issues. Behavior: the counters reset when the controller received HCI reset.
`Last_Packet_Length_Host_to_Controller`	2 Octets	Length of the last HCI packet sent to Host UART. Note: HCI Packet Length max 2 octet (Include HCI, ACL, SCO, ISO)
`Last_Packet_Length_Controller_To_host`	2 Octets	Length of the last HCI packet received from Host UART. Note: HCI Packet Length max 2 octet (Include HCI, ACL, SCO, ISO)
`Total_BT_Wake_Count`	4 Octets	The aggregate tally of BT_Wake pin assertions by the Host entity. This field serves as a diagnostic tool for debugging power-related issues. Behavior: the counters reset when the controller received HCI reset.
`Total_HOST_Wake_Count`	4 Octets	Aggregate calculation of Host_Wake pin assertions initiated by the Controller. This field serves as a diagnostic tool for debugging power-related issues. Behavior: the counters reset when the controller received HCI reset.
`Last_BT_Wake_TimeStamp`	4 Octets	Last Timestamp when Host Asserted BT_Wake Pin.This field is implemented for the purpose of debugging Power issues.
`Last_HOST_Wake_TimeStamp`	4 Octets	The most recent timestamp when the controller asserted the Host_Wake pin. This field is used for debugging power issues.
`Reset_Timestamp`	4 Octets	Timestamp indicating the completion of the most recent HCI Reset. This field is utilized for the express purpose of facilitating the resolution of timing-related issues. It should serve as the initial recording point against which all other items are referenced.
`Current_Timestamp`	4 Octets	The present time when this event is generated. This field is utilized for the purpose of troubleshooting timing discrepancies. It should serve as the trigger recording point that all other elements reference.
`Is_WatchDog_Timer_About_To_Expire`	4 Octets	Flag to denote that this health status event is generated by the controller as an early warning of watch dog expiration. The current timestamp serves to indicate the time of occurrence.
`Coex_Status_Mask`	2 Octets	Bit 0 - Reserved
`Total_Links_BR_EDR_LE_Active`	1 Octet	Total link count of BR/EDR/LE in Active state.
`Total_Links_BR_EDR_Sniff`	1 Octet	Total link count of BR/EDR in Sniff/Idle state.
`Total_Links_CIS`	1 Octet	Total link count of ISO.
`Is_SCO_Active`	1 Octet	Indicator to check if the SCO link is currently activated.

Subevent Parameter	Size	Purpose
`Quality_Report_Id`	1 octet	0x00 ~ 0x10: Reserved. 0x11: LMP/LL message trace. 0x12: Bluetooth Multi-link/Coex scheduling trace. 0x13: Controller Debug Information data dump. 0x14 ~ 0xFF: Reserved.
`Connection_Handle`	2 octets	Connection Handle.
Vendor Specific Parameter	(Parameter Total Length - 4) * octets	Vendor Specific format of LMP message trace, Bluetooth Multi-link/Coex scheduling trace and Controller Debug Information data dump.

ISO Link Feedback subevent

Sub event code = 0x5C

When activated, this event must be generated during each ISO interval.

Activation

The activation is performed by selecting the vendor Data_Path_ID code 0x19 in the HCI_LE_Setup_ISO_Data_Path standard command. The HCI_Configure_Data_Path command with the Data_Path_ID set to 0x19 and Vendor_Specific_Config_Length set to 0, must be accepted, even if no action is expected from the controller upon reception of this command.

Dispatching time point

The event is emitted from the start of an ISO interval (CIG or BIG anchor point), to the following ISO interval. The controller indicates the delay with the effective start of the ISO interval using Anchor_Point_Delay.

Controller synchronization

At the start of an ISO interval, the controller computes Stream_SN by incrementing the current value by the configured ISO_Interval ÷ SDU_Interval; on the first interval, it's initialized to 0.
Then, for each packet in the ISO FIFO, the following applies:

The controller calculates the wrapping difference SN_diff between the two sequence numbers:
SN_diff = (SDU_SN - Stream_SN + 0x10000) mod 0x10000
When (SN_diff + (FT-1) × ISO_Interval ÷ SDU_Interval) mod 0x10000 <= (FT-1) × ISO_Interval ÷ SDU_Interval:
The packet is in the re-transmission window. It should have been scheduled for transmission at previous intervals and is now available for re-transmission. If this isn't the case (it hasn't been scheduled for transmission), it has been late received. This must be signaled to the host using the In_Status. Such packets can be discarded or scheduled for transmission; the choice is implementation-defined.
Or when SN_diff < ISO_Interval ÷ SDU_Interval:
The packet is scheduled for transmission from this event until the flush timeout occurs.
Or when SN_diff >= ISO_Interval ÷ SDU_Interval and SN_diff <= Max_Forward_Buffers:
The packet is in the future; it will be transmitted with a subsequent event. As the packets are sent in order, this condition ends the search for packets for this interval.
The buffers used by the host isn't communicated to the controller, but is limited to Max_Forward_Buffers = 16.
Or when none of the above conditions are met:
The packet is discarded, the flush timeout limit is reached, or a malformed packet has been received.

Subevent parameter	Size	Purpose
`Connection_Handle`	2 octets	Connection handle of the CIS or BIS Range: 0x0000 to 0x0EFF
`Sequence_Number`	2 octets	Sequence number of the stream, managed by the controller. Initialized to 0 when the CIS or BIS is created, and incremented by the number of SDUs by ISO Isochronous interval, defined as `ISO_interval ÷ SDU_Interval`, at each ISO interval.
`Anchor_Point_Delay`	2 octets	Delay in microseconds between the generation of the event and the effective BIG or CIG anchor point or start of the ISO interval. The effective anchor point timestamp is defined by: `Event generation time - Anchor_Point_Delay` Range: 0 to ISO interval in microseconds
`In_Status`	2 octets	Controller ISO buffer status At the start of an ISO interval, each bit b_i is set when the SDU `(Sequence_Number + i) mod 0x10000` is available. When not available, the SDU is identified as `Not received from the host`. The value i ranges from 0 to `ISO_Interval ÷ SDU_Interval - 1`. For other values of i, the bits are set to 0.
`Tx_Status`	2 octets	Transmission status, relative to the SDUs with sequence numbers: `(Sequence_Number - Flush_Timeout × ISO_Interval ÷ SDU_Interval + i + 0x10000) mod 0x10000` Each bit b_i is set when all the PDUs of the identified SDU, by its sequence number, have been successfully transmitted, and acknowledged. The value i ranges from 0 to `ISO_Interval ÷ SDU_Interval - 1`. For other values of i, the bits are set to 0. On a broadcast group, the transmission is always supposed to be acknowledged.

Multi-advertiser support

The objectives of multi-advertiser support are the following:

Ability to support multiple advertisements (max_advt_instances)
Different transmit powers to allow for a varying range
Different advertising content
An individualized response for each advertiser
Privacy (non-trackable) for each advertiser
Connectable

To keep this specification close to existing standards, the following vendor-specific commands are provided. They are derived from the Bluetooth Core 4.1 Specification.

LE_Multi_Advt_Command

OCF: 0x154

Command parameter	Size	Purpose
`Multi_advt_opcode`	1 octet	0x01 - `Set_Advt_Param_Multi_Sub_Cmd` 0x02 - `Set_Advt_Data_Multi_Sub_Cmd` 0x03 - `Set_Scan_Resp_Data_Multi_Sub_Cmd` 0x04 - `Set_Random_Addr_Multi_Sub_Cmd` 0x05 - `Set_Advt_Enable_Multi_Sub_Cmd`

A Command Complete event will be generated for this command.

Return parameter	Size	Purpose
`Status`	1 octet	Command Complete status
`Multi_advt_opcode`	1 octet	0x01 - `Set_Advt_Param_Multi_Command` 0x02 - `Set_Advt_Data_Multi_Command` 0x03 - `Set_Scan_Resp_Data_Multi_Command` 0x04 - `Set_Random_Addr_Multi_Command` 0x05 - `Set_Advt_Enable_Multi_Command`

LE_Multi_Advt_Command: Set_Advt_Param_Multi_Sub_Cmd

Base reference: Bluetooth Core 4.1 Specification, page 964 (LE Set Advertising Parameter Command)

Sub OCF: 0x01

Subcommand parameter	Size	Purpose
`Advertising_Interval_Min`	Per spec	Per spec
`Advertising_Interval_Max`	Per spec	Per spec
`Advertising_Type`	Per spec	Per spec
`Own_Address_Type`	Per spec	Per spec
`Own_Address`	Per spec	Per spec
`Direct_Address_Type`	Per spec	Per spec
`Direct_Address`	Per spec	Per spec
`Advertising_Channel_Map`	Per spec	Per spec
`Adverstising_Filter_Policy`	Per spec	Per spec
`Advertising_Instance`	1 octet	Specifies the applicability of the above parameters to an instance
`Tx_power`	1 octet	Transmit_Power Unit - in dBm (signed integer) Range (-70 to +20)

The Own_Address parameter could be a host-configured address at the time of setting up this multi-advertisement instance. This provides the ability to have a resolvable private address at the time of the transmit of the first beacon. Advertisement on an instance will continue irrespective of the connection. The host BT stack could issue a command to start advertisement on an instance, post connection.

A Command Complete event will be generated for this command as specified in the Bluetooth Core 4.1 Specification, per the above command. The controller will respond with a non-success (invalid parameter) code if the advertising instance or Tx_Power parameters are invalid.

Return parameter	Size	Purpose
`Status`	1 octet	Command Complete status
`Multi_advt_opcode`	1 octet	0x01 [`Set_Advt_Param_Multi_Sub_Cmd]`

LE_Multi_Advt_Command: Set_Advt_Data_Multi_Sub_Cmd

Base reference: Bluetooth Core 4.1 Specification, page 969 (LE Set Advertising Data Command)

Sub OCF: 0x02

Subcommand parameter	Size	Purpose
`Advertising_Data_Length`	Per spec	Per spec
`Advertising_Data`	Per spec	Per spec
`Advertising_Instance`	1 octet	Specifies the applicability of the above parameters to an instance

A Command Complete event will be generated for this command as specified in the Bluetooth Core 4.1 Specification, per the above command. The controller will respond with a non-success code if the advertising instance or Tx_Power parameters are invalid.

Return parameter	Size	Purpose
`Status`	1 octet	Command Complete status
`Multi_advt_opcode`	1 octet	0x02 [`Set_Advt_Data_Multi_Sub_Cmd]`

LE_Multi_Advt_Command: Set_Scan_Resp_Data_Multi_Sub_Cmd

Base reference: Bluetooth Core 4.1 Specification, page 970 (LE Set Scan Response Data Command)

Sub OCF: 0x03

Subcommand parameter	Size	Purpose
`Scan_Response_Data_Length`	Per spec	Per spec
`Scan_Response_Data`	Per spec	Per spec
`Advertising_Instance`	1 octet	Specifies the applicability of the above parameters to an instance

A Command Complete event will be generated for this command as specified in the Bluetooth Core 4.1 Specification, per the above command. The controller will respond with a non-success code (invalid parameter) if the advertising instance or Tx_Power parameters are invalid.

Return parameter	Size	Purpose
`Status`	1 octet	Command Complete status
`Multi_advt_opcode`	1 octet	0x03 [`Set_Scan_Resp_Data_Multi_Sub_Cmd]`

LE_Multi_Advt_Command: Set_Random_Addr_Multi_Sub_Cmd

Base reference: Bluetooth Core 4.1 Specification, page 963 (LE Set Random Address Command)

Sub OCF: 0x04

Subcommand parameter	Size	Purpose
Random Address	Per spec	Per spec
`Advertising_Instance`	1 octet	Specifies the applicability of the above parameters to an instance

A Command Complete event will be generated for this command.

Return parameter	Size	Purpose
`Status`	1 octet	Command Complete status
`Multi_advt_opcode`	1 octet	0x04 [`Set_Random_Addr_Multi_Sub_Cmd]`

LE_Multi_Advt_Command: Set_Advt_Enable_Multi_Sub_Cmd

Base reference: Bluetooth Core 4.1 Specification, page 971 (LE Set Advertise Enable Command in that core specification)

OCF: 0x05

Subcommand parameter	Size	Purpose
`Advertising_Enable`	1 octet	A value of 1 means enable. Any other value means disable.
`Advertising_Instance`	1 octet	Specifies the applicability of the above parameters to an instance. Instance 0 means a standard HCI instance.

A Command Complete event will be generated for this command.

Return parameter	Size	Purpose
`Status`	1 octet	Command Complete status
`Multi_advt_opcode`	1 octet	0x05 [`Set_Advt_Enable_Multi_Sub_Cmd]`

Offloaded resolution of private address

This feature resolves a private address in the controller firmware or hardware, which provides the following benefits:

Latency involved with the host in resolving a private address
Saving power by refraining from waking up the host

LE_Set_RPA_Timeout

OCF: 0x15C

Command parameter	Size	Purpose
`LE_local_IRK`	16 octet	The local device IRK used to generate the random resolvable address(es).
`tRPA_min`	2 octets	The minimum RPA generation timeout in seconds. The controller must generate new resolvable addresses for any advertising/scanning/connection events on or after this timeout. Valid range: 300-1800
`tRPA_max`	2 octets	The maximum RPA generation timeout in seconds. The controller must generate new resolvable addresses for any advertising/scanning/connection events on or before this timeout. Valid range: `tRPA_min`-1800

Return parameter	Size	Purpose
`Status`	1 octet	The status of the command. Suggested HCI status values: 0x00 Success 0x01 Unknown command (if not supported) 0x12 Invalid command parameters (if any parameters are outside the given range)

LE_RPA_offload_Command

OCF: 0x155

Command parameter	Size	Purpose
`RPA_offload_opcode`	1 octet	0x1 - Enable customer specific feature 0x2 - Add IRK to the list 0x3 - Remove IRK from the list 0x4 - Clear IRK list 0x5 - Read IRK list entry

A Command Complete event will be generated for this command.

Return parameter	Size	Purpose
`Status`	1 octet	Command Complete status
`Event_RPA_offload_opcode`	1 octet	0x1 - Enable customer specific feature 0x2 - Add IRK to the list 0x3 - Remove IRK from the list 0x4 - Clear IRK list 0x5 - Read IRK list entry

LE_RPA_offload: Enable_cust_specific_sub_Command

Sub OCF: 0x01

Subcommand parameter	Size	Purpose
`enable_customer_specific_feature_set`	1 octet	0x01 - Enable offloaded RPA feature 0x00 - Disable offloaded RPA feature

RPA offload is required to be enabled by the host, based on the chip capability. Refer to the LE_Get_Vendor_Capabilities_Command. Each chip can have a varying max_irk_list_sz in the firmware.

A Command Complete event will be generated for this command.

Return parameter	Size	Purpose
`Status`	1 octet	Command Complete status
`Event_cust_specific_feature_opcode`	1 octet	0x01 [Enable customer-specific feature]

LE_RPA_offload: Add_IRK_to_list_sub_Command

Sub OCF: 0x02

Subcommand parameter	Size	Purpose
`LE_IRK`	16 octets	LE IRK (1st byte LSB)
`Address_Type`	1 octet	0: Public address 1: Random address
`LE_Device_Address`	6 octets	Public or random address associated to the IRK (1st byte LSB)

A Command Complete event will be generated for this command.

Return parameter	Size	Purpose
`Status`	1 octet	Command Complete status
`Event_cust_specific_feature_opcode`	1 octet	0x02 [Add IRK to the list]
`LE_IrkList_AvailableSpaces`	1 octet	Available IRL list entries after current operation

LE_RPA_offload: Remove_IRK_to_list_sub_Command

Sub OCF: 0x03

Subcommand parameter	Size	Purpose
`Address_Type`	1 octet	0: Public address 1: Random address
`LE_Device_Address`	6 octets	Public or random address that associates to the IRK

A Command Complete event will be generated for this command.

Return parameter	Size	Purpose
`Status`	1 octet	Command Complete status
`Event_cust_specific_feature_opcode`	1 octet	0x03 [Remove IRK from the list]
`LE_IrkList_AvailableSpaces`	1 octet	Available IRL list entries after current operation

LE_RPA_offload: Clear_IRK_list_sub_Command

Sub OCF: 0x04

Subcommand parameter	Size	Purpose
None

A Command Complete event will be generated for this command.

Return parameter	Size	Purpose
`Status`	1 octet	Command Complete status
`Event_cust_specific_feature_opcode`	1 octet	0x04 [Clear IRK List]
`LE_IrkList_AvailableSpaces`	1 octet	Available IRL list entries after current operation [`max_irk_list_sz]`

LE_RPA_offload: Read_IRK_list_sub_Command

Sub OCF: 0x05

Subcommand parameter	Size	Purpose
`LE_read_IRK_list_entry-index`	1 octet	Index of the IRK list [0, `max_irk_list_sz-1]`

A Command Complete event will be generated for this command.

Return parameter	Size	Purpose
`Status`	1 octet	Command Complete status
`Event_cust_specific_feature_opcode`	1 octet	0x05 [Read IRK List Entry]
`LE_Read_IRK_List_entry`	1 octet	Index of the IRK that the host wants to read back (maximum IRK list size is 32)
`LE_IRK`	16 octets	IRK value
`Address_Type`	1 octet	0: Public address 1: Random address
`LE_Device_Address`	6 octets	Public or random address associated to the IRK
`LE_Resolved_Private_Address`	6 octets	Current resolved resolvable private address of this IRK

Sniff Offload

The Sniff Offload feature offloads Sniff mode management from the Bluetooth host stack to the Bluetooth controller. This allows the controller to manage the timing of entering/exiting Sniff mode and applying configurable Sniff and Sniff sub-rating parameters, while the host retains control over parameter selection based on Bluetooth profile activity changes.

Sniff Offload States

This section defines the states within a Bluetooth controller with respect to the Sniff Offload function. Two global states have been defined to identify a Bluetooth controller’s status with respect to Sniff Offload enablement. Two connection specific states have been defined to identify a BR/EDR connection’s status when the Bluetooth controller is in Sniff Offload Enabled state.

Global States

Two global states have been defined to identify a Bluetooth controller’s status with respect to Sniff Offload enablement.

Sniff Offload Disabled State

A Bluetooth controller is considered to be in a ‘Sniff Offload Disabled’ state by default. It is expected that the Bluetooth controller shall handle the HCI_Sniff_Mode, HCI_Exit_Sniff_Mode and HCI_Sniff_Subrating commands issued from a Bluetooth host. The Bluetooth controller shall also forward the HCI_Mode_Change and HCI_Sniff_Subrating events to a Bluetooth host as per the event mask set by the Bluetooth host.

Sniff Offload Enabled State

A Bluetooth controller is considered to be in a ‘Sniff Offload Enabled’ state after it has successfully handled a ‘WriteSniffOffloadEnable’ to enable Sniff Offload. In this state the Bluetooth controller is expected to forward the HCI_Mode_Change and HCI_Sniff_Subrating events to a Bluetooth host as decided by a logical-AND function of the event mask set by the Bluetooth host and the Event Suppression Flags.

Connection Specific States

When a Bluetooth controller is in a ‘Sniff Offload Enabled’ state, each active ACL can be in one of the two described below states.

Pending-Parameter State

An ACL is considered to be in a ‘Pending-Parameters’ state when the Bluetooth controller is in ‘Sniff Offload Enabled’ state, but a ‘WriteSniffOffloadParameters’ vendor specific command has not been issued at least once by the Bluetooth host for the present ACL.

Control-Started State

An ACL is considered to be in a ‘Control-Started’’ state when the Bluetooth controller is in ‘Sniff Offload Enabled’ state, and a ‘WriteSniffOffloadParameters’ vendor specific command has been issued at least once by the Bluetooth host for the present ACL.

WriteSniffOffloadEnable

OCF: 0x310

Command parameter	Size	Purpose
`Enable_Sniff_Offload`	1 octet	0x00 : Disable 0x01 : Enable
`Subrating_Max_Latency`	2 octets	The Maximum Latency parameter shall be used to calculate the maximum sniff subrate that the remote device may use. Default: Tsniff Latency = N × 0.625 ms (1 Baseband slot) Range: 0x0002 to 0xFFFE Time Range: 1.25 ms to 40.9 s
`Subrating_Min_Remote_Timeout`	2 octets	Minimum sniff mode timeout (Tsniff_mode_timeout) that the remote device may use Default: 0x0000 Timeout = N × 0.625 ms (1 Baseband slot) Range: 0x0000 to 0xFFFE Time Range: 0 s to 40.9 s
`Subrating_Min_Local_Timeout`	2 octets	Minimum sniff mode timeout (Tsniff_mode_timeout) that the local device may use. Default: 0x0000 Timeout = N × 0.625 ms (1 Baseband slot) Range: 0x0000 to 0xFFFE Time Range: 0 s to 40.9 s
`Suppress_Mode_Change_Event`	1 octet	0x00 : The Bluetooth controller shall report the HCI Mode_Change event to the host subject to the configuration set in HCI_Set_Event_Mask command. 0x01 : The Bluetooth controller shall not report the HCI Mode_Change event to the host.
`Suppress_Sniff_Subrating_Event`	1 octet	0x00 : The Bluetooth controller shall report the HCI Sniff_Subrating event to the host subject to the configuration set in HCI_Set_Event_Mask command. 0x01 : The Bluetooth controller shall not report the HCI Sniff_Subrating event to the host.

WriteSniffOffloadParameters

OCF: 0x311

Command parameter	Size	Purpose
`Connection_Handle`	2 octets	16-bit BR/EDR ACL connection handle. Range: 0x0000 to 0x0EFF
`Sniff_Max_Interval`	2 octets	–Bluetooth SIG Defined range, ordinarily used for entry to Sniff mode. Range: 0x0002 to 0xFFFE; only even values are valid Mandatory Range: 0x0006 to 0x0540 Time = N × 0.625 ms Time Range: 1.25 ms to 40.9 s –Special Cases 0x0000 : Used to select “Push-Active” Sniff-Offload Mode. 0x0001 : Used to select “Prefer-Active” Sniff-Offload Mode.
`Sniff_Min_Interval`	2 octets	Range: 0x0002 to 0xFFFE; only even values are valid Mandatory Range: 0x0006 to 0x0540 Time = N × 0.625 ms Time Range: 1.25 ms to 40.9 s
`Sniff_Attempts`	2 octets	Number of Baseband receive slots for sniff attempt. Length = N × 1.25 ms Range: 0x0001 to 0x7FFF Time Range: 1.25 ms to 40.9 s Mandatory Range for Controller: 1 to Tsniff ÷ 2
`Sniff_Timeout`	2 octets	Number of Baseband receive slots for sniff timeout. Length = N × 1.25 ms Range: 0x0000 to 0x7FFF Time Range: 0 ms to 40.9 s Mandatory Range for Controller: 0 to 0x0028
`Link_Inactivity_Timeout`	2 octets	Timeout value in milliseconds. Link_Inactivity Timer started/reset at every HCI-ACL transaction. At the expiry of this timer, the controller shall initiate entry to Sniff mode.
`Subrating_Max_Latency`	2 octets	The Maximum Latency parameter shall be used to calculate the maximum sniff subrate that the remote device may use. Default: Tsniff Latency = N × 0.625 ms (1 Baseband slot) Range: 0x0002 to 0xFFFE Time Range: 1.25 ms to 40.9 s
`Subrating_Min_Remote_Timeout`	2 octets	Minimum sniff mode timeout (Tsniff_mode_timeout) that the remote device may use Default: 0x0000 Timeout = N × 0.625 ms (1 Baseband slot) Range: 0x0000 to 0xFFFE Time Range: 0 s to 40.9 s
`Subrating_Min_Local_Timeout`	2 octets	Minimum sniff mode timeout (Tsniff_mode_timeout) that the local device may use. Default: 0x0000 Timeout = N × 0.625 ms (1 Baseband slot) Range: 0x0000 to 0xFFFE Time Range: 0 s to 40.9 s
`Allow_Exit_Sniff_On_Rx`	1 octet	Flag to control exit of Sniff mode on receive-direction HCI-ACL transaction. 0x00 : Do not exit sniff on Rx. 0x01 : Exit Sniff on Rx Receive-direction HCI-ACL is defined as ACL packet transmission from controller to host over HCI.
`Allow_Exit_Sniff_On_Tx`	1 octet	Flag to control exit of Sniff mode on transmit-direction HCI-ACL transaction. 0x00 : Do not exit sniff on Tx. 0x01 : Exit Sniff on Tx Transmit-direction HCI-ACL is defined as ACL packet transmission from host to controller over HCI.

HCI requirements Stay organized with collections Save and categorize content based on your preferences.

General design overview

Chip capabilities and configuration

Support open standards

Vendor-specific capabilities

Batch scan results

LE_Batch_Scan_Command

LE_Batch_Scan_Command: Enable customer-specific feature

LE_Batch_Scan_Command: Set batch scan storage parameter subcommand

LE_Batch_Scan_Command: Set batch scan parameter subcommand

LE_Batch_Scan_Command: Read batch scan results subcommand

Advertising Packet Content Filter

LE_APCF_Command

LE_APCF_Command: Enable_sub_cmd

LE_APCF_Command: set_filtering_parameters_sub_cmd

LE_APCF_Command: broadcast_address_sub_cmd

LE_APCF_Command: service_uuid_sub_cmd

LE_APCF_Command: solicitation_uuid_sub_cmd

LE_APCF_Command: local_name_sub_cmd

LE_APCF_Command: manf_data_sub_cmd

LE_APCF_Command: service_data_sub_cmd

LE_APCF_Command: ad_type_sub_cmd

LE_APCF_Command: read_extended_features_sub_cmd

Controller activity and energy information command

LE_Get_Controller_Activity_Energy_Info

LE extended set scan parameters command

Get controller debug info command

A2DP hardware offload support

Start A2DP offload (legacy)

Start A2DP offload

Stop A2DP offload (legacy)

Stop A2DP offload

Bluetooth Quality Report command

Dynamic audio buffer command

Get audio buffer time capability

Set audio buffer time

HCI event (vendor-specific)

Storage threshold breach subevent

LE multi-advertising state change subevent

LE advertisement tracking subevent

Controller debug info subevent

Bluetooth Quality Report subevent

Subevent code = 0x58 [Quality_Report_Id = 0x01 ~ 0x04, Link Quality related event]

Subevent code = 0x58 [Quality_Report_Id = 0x05, Root Inflammation event]

Subevent code = 0x58 [Quality_Report_Id = 0x06, Energy monitor event]

Subevent code = 0x58 [Quality_Report_Id = 0x09~0x0A, Advanced RF stats event]

Key metrics and their purpose

Subevent code = 0x58 [Quality_Report_Id = 0x0B~0x0C, Controller Health Monitoring event]

Key metrics and their purpose

Subevent code = 0x58 [Quality_Report_Id = 0x11 ~ 0x13, Log Dump related event]

ISO Link Feedback subevent

Activation

Dispatching time point

Controller synchronization

Multi-advertiser support

LE_Multi_Advt_Command

LE_Multi_Advt_Command: Set_Advt_Param_Multi_Sub_Cmd

LE_Multi_Advt_Command: Set_Advt_Data_Multi_Sub_Cmd

LE_Multi_Advt_Command: Set_Scan_Resp_Data_Multi_Sub_Cmd

LE_Multi_Advt_Command: Set_Random_Addr_Multi_Sub_Cmd

LE_Multi_Advt_Command: Set_Advt_Enable_Multi_Sub_Cmd

Offloaded resolution of private address

LE_Set_RPA_Timeout

LE_RPA_offload_Command

LE_RPA_offload: Enable_cust_specific_sub_Command

LE_RPA_offload: Add_IRK_to_list_sub_Command

LE_RPA_offload: Remove_IRK_to_list_sub_Command

LE_RPA_offload: Clear_IRK_list_sub_Command

LE_RPA_offload: Read_IRK_list_sub_Command

Sniff Offload

Sniff Offload States

Global States

Sniff Offload Disabled State

Sniff Offload Enabled State

Connection Specific States

Pending-Parameter State

Control-Started State

WriteSniffOffloadEnable

WriteSniffOffloadParameters

HCI requirements