mgmt(7)

📦

version 5.87 · 11 versions

5.87 · arch rolling, nixpkgs unstable, ubuntu stonking (latest)
5.87+2.git8750129efca8 · centos-stream 9
5.87+2.git8750129efca8 · centos-stream 10
5.85 · alpine 3.23
5.86 · alpine 3.24
5.83 · ubuntu questing
5.87+1.git8750129efca8 · fedora 43
5.84 · fedora 43
5.87+1.git8750129efca8 · fedora 44
5.86 · fedora 44, nixos 26.05
5.85 · ubuntu resolute

, in arch rolling, nixpkgs unstable, ubuntu stonking

✨ NAME ✨

Okay so bestie, welcome to mgmt(7) from the Linux System Administration manual 💖 — this is the Bluetooth Management Protocol documentation, and it's literally the blueprint for how userspace talks to the kernel over Bluetooth management sockets. Slay.

🎀 SYNOPSIS 🎀

The way you get one of these Bluetooth management sockets is by setting the hci_channel member of struct sockaddr_hci to HCI_CHANNEL_CONTROL — see hci(7) for the full lore — when you're creating a raw HCI socket:

           int mgmt_create(void)
           {
               struct sockaddr_hci addr;
               int fd;

               fd = socket(PF_BLUETOOTH, SOCK_RAW | SOCK_CLOEXEC | SOCK_NONBLOCK,
                                                                       BTPROTO_HCI);
               if (fd < 0)
                   return -errno;

               memset(&addr, 0, sizeof(addr));
               addr.hci_family = AF_BLUETOOTH;
               addr.hci_dev = HCI_DEV_NONE;
               addr.hci_channel = HCI_CHANNEL_CONTROL;

               if (bind(fd, (struct sockaddr *) &addr, sizeof(addr)) < 0) {
                   int err = -errno;
                   close(fd);
                   return err;
               }

               return fd;
          }

💀 Heads up, bestie: the process creating the mgmt socket is required to have the CAP_NET_ADMIN capability — like, root would have this. No cap? No socket. Periodt.

👑 DESCRIPTION 👑

This document describes the format of data used for communicating with the kernel using a so-called Bluetooth Management sockets 🦋. These sockets are available starting with Linux kernel version 3.4 ✨.

So like, the Bluetooth Management API is not a set-in-stone thing — it grows every time the kernel levels up. Here's the whole glow-up timeline of which kernel version dropped which new commands, new events, or important fixes. The two columns you're reading are Version (the API version) and Kernel Version (the kernel that shipped it). Buckle up bestie, she's long but she's iconic 💅

API version 1.1 — kernel version 3.4
- command: Set Device ID
- events: (nothing new listed here)
API version 1.2 — kernel version 3.7
- commands: (nothing new listed here)
- event: Passkey Notify
API version 1.3 — kernel version 3.9
- commands: (nothing new listed here)
- events: (nothing new listed here)
API version 1.4 — kernel version 3.13 — this one showed up, four whole commands no cap
- command: Set Advertising
- command: Set BR/EDR
- command: Set Static Address
- command: Set Scan Parameters
- events: (nothing new listed here)
API version 1.5 — kernel version 3.15
- command: Set Secure Connections
- command: Set Debug Keys
- command: Set Privacy
- command: Load Identity Resolving Keys
- event: New Identity Resolving Key
- event: New Signature Resolving Key
API version 1.6 — kernel version 3.16
- command: Get Connection Information
- events: (nothing new listed here)
API version 1.7 — kernel version 3.17 — the big one, she ate and left no crumbs
- command: Get Clock Information
- events: (nothing new listed here)
- command: Add Device
- event: Device Added
- command: Remove Device
- event: Device Removed
- command: Load Connection Parameters
- event: New Connection Parameter
- command: Read Unconfigured Index List
- event: Unconfigured Index Added
- command: Read Controller Configuration Information
- event: Unconfigured Index Removed
- command: Set External Configuration
- event: New Configuration Options
- command: Set Public Address commands
- events: (nothing new listed here)
API version 1.8 — kernel version 3.19
- command: Start Service Discovery
- events: (nothing new listed here)
API version 1.9 — kernel version 4.1 — advertising arc era, we love to see it ✨
- command: Read Local Out Of Band Extended Data
- event: Extended Index Added
- command: Read Extended Controller Index List
- event: Extended Index Removed
- command: Read Advertising Features
- event: Local Out Of Band Extended Data Updated
- command: Add Advertising
- event: Advertising Added
- command: Remove Advertising
- event: Advertising Removed
API version 1.10 — kernel version 4.2
- commands: (nothing new listed here)
- events: (nothing new listed here)
API version 1.11 — kernel version 4.5
- command: Get Advertising Size Information
- events: (nothing new listed here)
- command: Start Limited Discovery
- events: (nothing new listed here)
API version 1.12 — kernel version 4.6
- commands: (nothing new listed here)
- events: (nothing new listed here)
API version 1.13 — kernel version 4.8
- commands: (nothing new listed here)
- events: (nothing new listed here)

That's the full timeline dump bestie 🫶 and the page keeps rolling from here —

🌈 1.14 · Bluetooth 4.9
- command Read Extended Controller Information → fires the event Extended Controller Information Changed
- command Set Appearance → this one has no event listed, it's giving silent icon energy
🦋 1.15 · Bluetooth 5.5
- command Get PHY Configuration → fires the event PHY Configuration Changed
- command Set PHY Configuration → no event in this row
- command Load Blocked Keys → no event in this row
🎀 1.16 · Bluetooth 5.6
- command Set Wideband Speech → no event listed, just vibes
⭐ 1.17 · Bluetooth 5.7
- command Read Controller Capabilities → fires the event Experimental Feature Changed
- command Read Experimental Features Information → no event in this row
- command Set Experimental Feature → no event in this row
💅 1.18 · Bluetooth 5.8 — okay this one is the main character of the table, look at all these rows:
- command Read Default System Configuration → fires the event Default System Configuration Changed
- command Set Default System Configuration → fires the event Default Runtime Configuration Changed
- command Read Default Runtime Configuration → fires the event Default Runtime Configuration Changed
- command Set Default Runtime Configuration → fires the event Device Flags Changed
- command Get Device Flags → fires the event Advertisement Monitor Added
- command Set Device Flags → fires the event Advertisement Monitor Removed
- command Read Advertisement Monitor Features → fires the event Controller Suspend
- command Add Advertisement Patterns Monitor → fires the event Controller Resume
- command Remove Advertisement Monitor → fires the event Advertisement Monitor Device Found
- no command in this row → fires the event Advertisement Monitor Device Lost
🔥 1.19 · Bluetooth 5.10
- command Add Extended Advertising Parameters → no event listed
- command Add Extended Advertising Data → no event listed
💜 1.20 · Bluetooth 5.11
- command Add Advertisement Patterns Monitor With RSSI Threshold → no event listed
👑 1.21 · Bluetooth 6.0
- command Set Mesh Receiver → fires the event Mesh Device Found
- command Read Mesh Features → fires the event Mesh Packet Transmit Complete
- command Transmit Mesh Packet → no event in this row
- command Cancel Transmit Mesh Packet → no event in this row

bestie pls note the pattern fr fr 💀 — the version on the left is the mgmt command version, the one next to it is the matching Bluetooth spec version, and then you get the command + whatever event it kicks off. Some rows are just a command with nothing in the event column, and that's not a typo, that's literally how it's written. Keep all of it. 🫶

📦 Packet Structures 📦

Okay bestie, before we get into the actual commands, we gotta talk about the ✨packet format✨ because it's giving structure and we love that for us.

Commands:

   0    4    8   12   16   22   24   28   31   35   39   43   47
   +-------------------+-------------------+-------------------+
   |  Command Code     |  Controller Index |  Parameter Length |
   +-------------------+-------------------+-------------------+
   |                                                           |

Events:

   0    4    8   12   16   22   24   28   31   35   39   43   47
   +-------------------+-------------------+-------------------+
   |  Event Code       |  Controller Index |  Parameter Length |
   +-------------------+-------------------+-------------------+
   |                                                           |

All fields are in little-endian byte order (least significant byte first). No cap, that's just how it is.

Controller Index can have a special value <non-controller> to indicate that command or event is not related to any controller. Possible values:

0x0000-0xFFFE — <controller id>
0xFFFF — <non-controller>

🚨 Error Codes 🚨

These values are defined for use with the Command Status and Command Complete events. Slay, here's the full list:

0x00 — Success
0x01 — Unknown Command
0x02 — Not Connected
0x03 — Failed
0x04 — Connect Failed
0x05 — Authentication Failed
0x06 — Not Paired
0x07 — No Resources
0x08 — Timeout
0x09 — Already Connected
0x0A — Busy
0x0B — Rejected
0x0C — Not Supported
0x0D — Invalid Parameters
0x0E — Disconnected
0x0F — Not Powered
0x10 — Cancelled
0x11 — Invalid Index
0x12 — RFKilled
0x13 — Already Paired
0x14 — Permission Denied

As a general rule all commands generate the events as specified below, however invalid lengths or unknown commands will always generate a Command Status response (with Unknown Command or Invalid Parameters status). Sending a command with an invalid Controller Index value will also always generate a Command Status event with the Invalid Index status code. So like, don't try to be cute with bad indexes, okay? 💅

🎮 Commands 🎮

📖 Read Management Version Information 📖

Command Code: 0x0001
Controller Index: <non-controller>
Command Parameters: (none)

Return Parameters:

Version (1 Octets)

...    Revision (2 Octets)

This command returns the Management version and revision. Besides being informational, the information can be used to determine whether certain behavior has changed or bugs fixed when interacting with the kernel. Lowkey useful for debugging vibes.

This command generates a Command Complete event on success or a Command Status event on failure.

📚 Read Management Supported Commands 📚

Command Code: 0x0002
Controller Index: <non-controller>
Command Parameters: (none)

Return Parameters:

Num_Of_Commands (2 Octets)

...    Num_Of_Events (2 Octets)

...    Command[] (2 Octets)

...    ...[]

...    Event[] (2 Octets)

...    ...[]

This command returns the list of supported Management commands and events.

The commands Read Management Version Information and Read management Supported Commands are not included in this list. Both commands are always supported and mandatory.

The events Command Status and Command Complete are not included in this list. Both are implicit and mandatory.

This command generates a Command Complete event on success or a Command Status event on failure.

🗂️ Read Controller Index List 🗂️

Command Code: 0x0003
Controller Index: <non-controller>
Command Parameters: (none)

Return Parameters:

Num_Controllers (2 Octets)

...    Controller_Index[] (2 Octets)

This command returns the list of currently known controllers. Controllers added or removed after calling this command can be monitored using the Index Added and Index Removed events. So like, keep an eye out for those events, bestie.

This command generates a Command Complete event on success or a Command Status event on failure.

🕵️ Read Controller Information 🕵️

Command Code: 0x0004
Controller Index: <controller id>
Command Parameters: (none)

Return Parameters:

Address (6 Octets)

...    Bluetooth_Version (1 Octet)

...    Manufacturer (2 Octets)

...    Supported_Settings (4 Octets)

...    Current_Settings (4 Octets)

...    Class_Of_Device (3 Octets)

...    Name (249 Octets)

...    Short_Name (11 Octets)

This command is used to retrieve the current state and basic information of a controller. It is typically used right after getting the response to the Read Controller Index List command or an Index Added event. Like, it's the natural next step, you know?

The Address parameter describes the controllers public address and it can be expected that it is set. However in case of single mode Low Energy only controllers it can be 00:00:00:00:00:00. To power on the controller in this case, it is required to configure a static address using Set Static Address command first.

If the public address is set, then it will be used as identity address for the controller. If no public address is available, then the configured static address will be used as identity address.

In the case of a dual-mode controller with public address that is configured as Low Energy only device (BR/EDR switched off), the static address is used when set and public address otherwise.

If no short name is set the Short_Name parameter will be empty (begin with a nul byte). So don't be surprised if it's giving empty strings, it's just how it is. 💖

okay so Current_Settings and Supported_Settings is a bitmask, and currently these are the available bits — no cap, bestie, every single one matters:

Bit 0 — Powered
Bit 1 — Connectable
Bit 2 — Fast Connectable
Bit 3 — Discoverable
Bit 4 — Bondable
Bit 5 — Link Level Security (Sec. mode 3)
Bit 6 — Secure Simple Pairing
Bit 7 — Basic Rate/Enhanced Data Rate
Bit 8 — High Speed
Bit 9 — Low Energy
Bit 10 — Advertising
Bit 11 — Secure Connections
Bit 12 — Debug Keys
Bit 13 — Privacy
Bit 14 — Controller Configuration
Bit 15 — Static Address
Bit 16 — PHY Configuration
Bit 17 — Wideband Speech
Bit 18 — Connected Isochronous Stream - Central
Bit 19 — Connected Isochronous Stream - Peripheral
Bit 20 — Isochronous Broadcaster
Bit 21 — Synchronized Receiver
Bit 22 — LL Privacy
Bit 23 — PAST Sender
Bit 24 — PAST Receiver

This command generates a Command Complete event on success or a Command Status event on failure. 💖

Possible errors:

Invalid Parameters
Invalid Index

🔌 Set Powered

Command Code — 0x0005

Controller Index — <controller id>

Command Parameters — Powered (1 Octet)

Return Parameters — Current_Settings (4 Octets)

This command is used to power on or off a controller. The allowed Powered command parameter values are 0x00 and 0x01. All other values will return Invalid Parameters.

If discoverable setting is activated with a timeout, then switching the controller off will expire this timeout and disable discoverable.

Settings programmed via Set Advertising and Add/Remove Advertising while the controller was powered off will be activated when powering the controller on.

Switching the controller off will permanently cancel and remove all advertising instances with a timeout set, i.e. time limited advertising instances are not being remembered across power cycles. Advertising Removed events will be issued accordingly.

This command generates a Command Complete event on success or a Command Status event on failure.

Possible errors:

Busy
Invalid Parameters
Invalid Index

✨ Set Discoverable

Command Code — 0x0006

Controller Index — <controller id>

Command Parameters — Discoverable (1 Octet), ... Timeout (2 Octets)

Return Parameters — Current_Settings (4 Octets)

This command is used to set the discoverable property of a controller. The allowed Discoverable command parameter values are:

0x00 — Not Discoverable
0x01 — General Discoverable
0x02 (since 1.4) — Limited Discoverable

Timeout is the time in seconds and is only meaningful when Discoverable is set to 0x01 or 0x02. Providing a timeout with 0x00 return Invalid Parameters. For 0x02, the timeout value is required.

This command is only available for BR/EDR capable controllers (e.g. not for single-mode LE ones). It will return Not Supported otherwise.

This command can be used when the controller is not powered and all settings will be programmed once powered.

However using a timeout when the controller is not powered will return Not Powered error.

When switching discoverable on and the connectable setting is off it will return Rejected error.

This command generates a Command Complete event on success or a Command Status event on failure.

Possible errors:

Busy
Rejected
Not Supported
Invalid Parameters
Not Powered
Invalid Index

🦋 Set Connectable

Command Code — 0x0007

Controller Index — <controller id>

Command Parameters — Connectable (1 Octet)

Return Parameters — Current_Settings (4 Octets)

This command is used to set the connectable property of a controller. The allowed Connectable command parameter values are 0x00 and 0x01. All other values will return Invalid Parameters.

This command is available for BR/EDR, LE-only and also dual mode controllers. For BR/EDR it changes the page scan setting and for LE controllers it changes the advertising type. For dual mode controllers it affects both settings.

For LE capable controllers the connectable setting takes effect when advertising is enabled (peripheral) or when directed advertising events are received (central).

This command can be used when the controller is not powered and all settings will be programmed once powered.

When switching connectable off, it will also switch off the discoverable setting. Switching connectable back on will not restore a previous discoverable. It will stay off and needs to be manually switched back on.

When switching connectable off, it will expire a discoverable setting with a timeout.

This setting does not affect known devices from Add Device command. These devices are always allowed to connect.

This command generates a Command Complete event on success or a Command Status event on failure.

Possible errors:

Busy
Not Supported
Invalid Parameters
Invalid Index

🎀 Set Fast Connectable

Command Code — 0x0008

Controller Index — <controller id>

Command Parameters — Enable (1 Octet)

Return Parameters — Current_Settings (4 Octets)

This command is used to set the controller into a connectable state where the page scan parameters have been set in a way to favor faster connect times with the expense of higher power consumption.

The allowed values of the Enable command parameter are 0x00 and 0x01. All other values will return Invalid Parameters.

This command is only available for BR/EDR capable controllers (e.g. not for single-mode LE ones). It will return Not Supported otherwise.

So yeah — this one's totally fine to run while the controller is not powered, and every setting gets programmed the moment it powers up. 💖

That setting is gonna be remembered through power down/up toggles. No cap. ✨

Fires off a Command Complete event when it works, or a Command Status event when it doesn't. 😭

Possible errors:

Failed
Busy
Not Supported
Invalid Parameters
Invalid Index

Set Bondable 💍

Command Code — 0x0009
Controller Index — <controller id>
Command Parameters — Bondable (1 Octet)
Return Parameters — Current_Settings (4 Octets)

Okay so this one sets the bondable property of a controller. Bestie, the only allowed values for the Bondable command parameter are 0x00 and 0x01 — literally anything else gets you an Invalid Parameters. 🙈

You can use this while the controller is not powered, and all the settings get programmed once it's powered. 🫶

Heads up: turning bondable on will not automatically switch the controller into connectable mode. You gotta do that separately, queen. 👑

The setting is remembered during power down/up toggles. ⭐

Generates a Command Complete event on success, or a Command Status event on failure.

Possible errors:

Invalid Parameters
Invalid Index

Set Link Security 🔐

Command Code — 0x000A
Controller Index — <controller id>
Command Parameters — Link_Security (1 Octet)
Return Parameters — Current_Settings (4 Octets)

This one either enables or disables link level security for a controller — you may know it as Security Mode 3. 💅 Allowed values for Link_Security are 0x00 and 0x01; everything else comes back Invalid Parameters. Periodt.

It's only available for BR/EDR capable controllers (so like, not for single-mode LE ones). Otherwise it returns Not Supported.

Runs fine while the controller is not powered, and all settings get programmed once powered. ✨

Generates a Command Complete event on success, or a Command Status event on failure.

Possible errors:

Busy
Not Supported
Invalid Parameters
Invalid Index

Set Secure Simple Pairing 🎀

Command Code — 0x000B
Controller Index — <controller id>
Command Parameters — Secure_Simple_Pairing (1 Octet)
Return Parameters — Current_Settings (4 Octets)

Enables/disables Secure Simple Pairing support for a controller. The allowed values for Secure_Simple_Pairing are 0x00 and 0x01, and all other values will return Invalid Parameters. 💀

Only available for BR/EDR capable controllers supporting the core specification version 2.1 or greater — so not for single-mode LE controllers, and not for pre-2.1 ones either.

Can be used when the controller is not powered; all settings get programmed once powered. 🌸

If the controller doesn't support Secure Simple Pairing, the command will fail regardless, with a Not Supported error. It's giving "no". 😭

Generates a Command Complete event on success, or a Command Status event on failure.

Possible errors:

Busy
Not Supported
Invalid Parameters
Invalid Index

Set High Speed 🚀

Command Code — 0x000C
Controller Index — <controller id>
Command Parameters — High_Speed (1 Octet)
Return Parameters — Current_Settings (4 Octets)

Enables/disables Bluetooth High Speed support for a controller. Allowed values for High_Speed are 0x00 and 0x01; anything else = Invalid Parameters. 🙅

BR/EDR capable controllers only (not single-mode LE ones, bestie).

Can be used when the controller is not powered — all settings get programmed once powered. ✨

Real talk: to enable High Speed support, you must have Secure Simple Pairing support enabled first. High Speed support is not possible for connections without Secure Simple Pairing. 🔥

And when you switch Secure Simple Pairing off, High Speed support gets switched off right along with it. Switching Secure Simple Pairing back on will not re-enable High Speed — you have to do that manually. Not me having to remind you. 💀

Generates a Command Complete event on success, or a Command Status event on failure.

Possible errors:

Not Supported
Invalid Parameters
Invalid Index

Set Low Energy 🦋

Command Code — 0x000D
Controller Index — <controller id>
Command Parameters — Low_Energy (1 Octet)
Return Parameters — Current_Settings (4 Octets)

Enables/disables Low Energy support for a controller. The allowed values of Low_Energy are 0x00 and 0x01; all other values return Invalid Parameters. 💅

Only available for LE capable controllers — otherwise you get a Not Supported error.

Can be used while the controller is not powered; all settings get programmed once powered. 🌈

If the kernel subsystem doesn't support Low Energy, or the controller doesn't either, the command will fail regardless. 😭

⚠️ Big one: disabling LE support will permanently disable and remove all advertising instances configured with the Add Advertising command. Advertising Removed events get issued accordingly. Like, gone gone. 🙈

Generates a Command Complete event on success, or a Command Status event on failure.

Possible errors:

Busy
Not Supported
Invalid Parameters
Invalid Index

Set Device Class 🏷️

Command Code — 0x000E
Controller Index — <controller id>
Command Parameters

Major_Class (1 Octet)
...    Minor_Class (1 Octet)

Return Parameters — Class_Of_Device (3 Octets)

Sets the major and minor device class for BR/EDR capable controllers. 👑

Also lowkey implicitly disables caching of pending CoD and EIR updates. ✨

BR/EDR capable controllers only — not for single-mode LE ones.

Works while the controller is not powered; all settings get programmed once powered. 🫶

If the controller is powered off, 0x000000 is returned for the class of device parameter. Then after power on, the new value gets announced via a class of device changed event. 🎀

Generates a Command Complete event on success, or a Command Status event on failure.

Possible errors:

Busy
Not Supported
Invalid Parameters
Invalid Index

Set Local Name ✨

Command Code — 0x000F
Controller Index — <controller id>
Command Parameters

Name (249 Octets)
...    Short_Name (11 Octets)

Return Parameters

Name (249 Octets)
...    Short_Name (11 Octets)

Sets the local name of a controller, bestie. The command parameters also include a short name, which gets used in case the full name doesn't fit within EIR/AD data. 🎀

Important: the name parameters need to always end with a null byte. If you fail to do that, the command will fail. Like, it's not optional. 💀

Can be used when the controller is not powered; all settings get programmed once powered. ⭐

The values of name and short name are remembered when you switch the controller off and back on again — so you only have to set the name and short name once when a new controller is found, and they'll stay until it's removed. Obsessed with the efficiency honestly. 💅

Generates a Command Complete event on success, or a Command Status event on failure.

Possible errors:

Invalid Parameters
Invalid Index

Add UUID 🧚

Command Code — 0x0010
Controller Index — <controller id>
Command Parameters

UUID (16 Octets)
...    SVC_Hint (1 Octet)

Return Parameters — Class_Of_Device (3 Octets)

Adds a UUID to be published in EIR data. 📇 The SVC_Hint parameter that comes with it tells the kernel whether the service class bits of the Class of Device value need modifying because of this UUID. iykyk. 💅

Can be used when the controller is not powered; all settings get programmed once powered. 🌸

If the controller is powered off, 0x000000 gets returned for the class of device parameter. And after power on, the new value is announced via a class of device changed event. 🔥

Generates a Command Complete event on success, or a Command Status event on failure.

Possible errors:

Busy
Invalid Parameters
Invalid Index

Remove UUID 🫥

Command Code — 0x0011
Controller Index — <controller id>
Command Parameters — UUID (16 Octets)
Return Parameters — Class_Of_Device (3 Octets)

Removes a UUID that was previously added using the Add UUID command. Bye bestie 👋

Cute trick: when the UUID parameter is an empty UUID (16 x 0x00), then all previously loaded UUIDs get removed. Nuclear option, honestly iconic. 💅

Can be used when the controller is not powered; all settings get programmed once powered. ✨

If the controller is powered off, 0x000000 is returned for the class of device parameter. After power on, the new value gets announced via a class of device changed event. ⭐

Generates a Command Complete event on success, or a Command Status event on failure.

Possible errors:

Busy
Invalid Parameters
Invalid Index

Load Link Keys 🔑

Command Code — 0x0012
Controller Index — <controller id>
Command Parameters

Debug_Keys (1 Octet)
...    Key_Count (2 Octets)
...    Address[] (6 Octets)
...    Address_Type[] (1 Octet)
...    Key_Type[] (1 Octet)
...    Value[] (16 Octets)
...    PIN_Length[] (1 Octet)
...    ...[]

Return Parameters — (none! it's giving minimalist 😌)

Feeds the kernel with all the link keys it currently knows about. 🫶 You do not need to call this one again when you receive New Link Key events, because the kernel updates its list automatically. Slay, honestly.

The Debug_Keys parameter tells the kernel whether to accept the usage of debug keys. Allowed values for it are 0x00 and 0x01 — all other values get you an Invalid Parameters response. 💀

Heads up: usage of the Debug_Keys parameter is deprecated and has been replaced with the Set Debug Keys command. Setting the Debug_Keys option via the Load Link Keys command has the same affect as setting it via Set Debug Keys, and applies to all keys in the system. 🎀

0 — BR/EDR
1 — Reserved (not in use)
2 — Reserved (not in use)

Public and random LE addresses are just not it, bestie — they're not valid and will get rejected. 🚫

So the Key_Type values that are currently defined, going off:

0x00 — Combination key
0x01 — Local Unit key
0x02 — Remote Unit key
0x03 — Debug Combination key
0x04 — Unauthenticated Combination key from P-192
0x05 — Authenticated Combination key from P-192
0x06 — Changed Combination key
0x07 — Unauthenticated Combination key from P-256
0x08 — Authenticated Combination key from P-256

This command can be used when the controller is not powered — yes, that's allowed, go off 💅

This command generates a Command Complete event on success, or a Command Status event on failure. That's the vibe.

Possible errors:

Invalid Parameters
Invalid Index

Load Long Term Keys 🔑

Command Code

0x0013

Controller Index

<controller id>

Command Parameters

Key_Count (2 Octets)
Address[] (6 Octets)
Address_Type[] (1 Octet)
Key_Type[] (1 Octet)
Central[] (1 Octet)
Encryption_Size[] (1 Octet)
Encryption_Diversifier[] (2 Octets)
Random_Number[] (8 Octets)
Value[] (16 Octets)
...[]

Return Parameters

(nothing here, it's giving minimalist ✨)

This command is literally just feeding the kernel all the (SMP) Long Term Keys it currently knows about. And here's the slay part: you don't need to call it again when New Long Term Key events come in, because the kernel updates its list automatically. Self-sufficient king behavior 👑 no cap.

Possible values for the Address_Type parameter:

0x00 — Reserved (not in use)
0x01 — LE Public
0x02 — LE Random

The Address and Address_Type you pass are the identity of a device — so either its public address or its static random address, iykyk. 🫶

Unresolvable random addresses and resolvable random addresses are not valid and will be rejected — don't try it 🙈

Currently defined Key_Type values:

0x00 — Unauthenticated key
0x01 — Authenticated key

This command can be used when the controller is not powered. Iconic.

This command generates a Command Complete event on success or a Command Status event on failure.

Possible errors:

Invalid Parameters
Invalid Index

Disconnect 💔

Command Code

0x0014

Controller Index

<controller id>

Command Parameters

Address (6 Octets)
Address_Type (1 Octet)

Return Parameters

Address (6 Octets)
Address_Type (1 Octet)

This command is how you force a currently connected device to, like, go away. Bye bestie 👋 the connection is OVER, it's not you it's the HCI layer.

Possible values for the Address_Type parameter:

0x00 — BR/EDR
0x01 — LE Public
0x02 — LE Random

Heads up: this command can only be used when the controller is powered. Not powered? Not today, sweetie.

This command generates a Command Complete event on success or failure.

Possible errors:

Not Connected
Busy
Invalid Parameters
Not Powered
Invalid Index

Get Connections 🔍

Command Code

0x0015

Controller Index

<controller id>

Command Parameters

(none, it doesn't need any input, queen of independence 💅)

Return Parameters

Connection_Count (2 Octets)
Address[] (6 Octets)
Address_Type[] (1 Octet)
...[]

This command is your little peek into who's currently connected — it retrieves a list of all the currently connected devices. Main character inventory energy 🌈

Possible values for the Address_Type parameter:

0x00 — BR/EDR
0x01 — LE Public
0x02 — LE Random

And for devices using resolvable random addresses with a known identity resolving key, the Address and Address_Type will contain the identity information. So you get the real them, not the disguise ✨

Reminder: this command can only be used when the controller is powered. Non-negotiable.

This command generates a Command Complete event on success or a Command Status event on failure.

Possible errors:

Invalid Parameters
Not Powered
Invalid Index

PIN Code Reply 🔢

Command Code

0x0016

Controller Index

<controller id>

Command Parameters

Address (6 Octets)
Address_Type (1 Octet)
PIN_Length (1 Octet)
PIN_Code (16 Octets)

Return Parameters

Address (6 Octets)
Address_Type (1 Octet)

This command is what you send back when someone hits you with a PIN Code request event — it's your reply, bestie 💌

Possible values for the Address_Type parameter:

0x00 — BR/EDR
0x01 — LE Public
0x02 — LE Random

Again: this command can only be used when the controller is powered. Powered only, fr fr.

This command generates a Command Complete event on success or failure.

Possible errors:

Not Connected
Invalid Parameters
Not Powered
Invalid Index

PIN Code Negative Reply 🙅‍♀️

Command Code

0x0017

Controller Index

<controller id>

Command Parameters

Address (6 Octets)
Address_Type (1 Octet)

Return Parameters

Address (6 Octets)
Address_Type (1 Octet)

This command is how you tell someone no — it returns a negative response to a PIN Code Request event. It's giving boundaries. Periodt. 🎀

Possible values for the Address_Type parameter:

0x00 — BR/EDR
0x01 — LE Public
0x02 — LE Random

This command can only be used when the controller is powered — like, it literally won't go otherwise.

It fires off a Command Complete event on success or failure. Either way you're getting a callback, bestie 💅

Possible errors:

Not Connected
Invalid Parameters
Not Powered
Invalid Index

🎀 Set IO Capability

Command Code

0x0018

Controller Index — <controller id>

Command Parameters — IO_Capability (1 Octet)

Return Parameters — none, it's giving minimalism 🦋

Okay so this command sets the IO Capability that gets used for pairing. And the cute part? It takes both SSP and SMP values, so no cap, it's bilingual ✨

Possible values for the IO_Capability parameter:

0x00 — DisplayOnly
0x01 — DisplayYesNo
0x02 — KeyboardOnly
0x03 — NoInputNoOutput
0x04 — KeyboardDisplay

Heads up: passing 0x04 (KeyboardDisplay) makes the kernel convert it to 0x01 (DisplayYesNo) when it's a BR/EDR connection — because KeyboardDisplay is specific to SMP, iykyk 🫶

This one is special: you can use it when the controller is not powered. Iconic behaviour honestly 👑

It generates a Command Complete event on success, or a Command Status event on failure.

Possible errors:

Invalid Parameters
Invalid Index

💖 Pair Device

Command Code

0x0019

Controller Index — <controller id>

Command Parameters

Address (6 Octets)
Address_Type (1 Octet)
IO_Capability (1 Octet)

Return Parameters

Address (6 Octets)
Address_Type (1 Octet)

This command triggers pairing with a remote device, periodt. The IO_Capability command parameter is a little temp override — it only applies for this pairing event, and it overrides the global IO Capability you set earlier with the Set IO Capability command 🔥

Possible values for the Address_Type parameter:

0x00 — BR/EDR
0x01 — LE Public
0x02 — LE Random

Possible values for the IO_Capability parameter:

0x00 — DisplayOnly
0x01 — DisplayYesNo
0x02 — KeyboardOnly
0x03 — NoInputNoOutput
0x04 — KeyboardDisplay

Again with the glow-up: 0x04 (KeyboardDisplay) gets converted by the kernel into 0x01 (DisplayYesNo) for BR/EDR connections, since KeyboardDisplay is SMP-specific 🌸

The Address and Address_Type in the return parameters give you the identity address if it's known. And if you handed in a resolvable random address and the remote provides an identity resolving key, the return params hold the resolved address. Slay 💅

So you can actually track which resolvable random address turned into which identity address — the New Identity Resolving Key event gets sent before you receive the Command Complete event for this command. Timeline matters, bestie ⭐

This command can only be used when the controller is powered.

It generates a Command Complete event on success or failure.

Two special statuses to know about:

Reject status is used when the requested transport is not enabled.
Not Supported status is used if the controller isn't capable with the requested transport.

Possible errors:

Rejected
Not Supported
Connect Failed
Busy
Invalid Parameters
Not Powered
Invalid Index
Already Paired

🦋 Cancel Pair Device

Command Code

0x001A

Controller Index — <controller id>

Command Parameters

Address (6 Octets)
Address_Type (1 Octet)

Return Parameters

Address (6 Octets)
Address_Type (1 Octet)

The Address and Address_Type you pass here should match exactly what you gave to a preceding Pair Device command — it's a callback in spirit, fr fr.

Possible values for the Address_Type parameter:

0x00 — BR/EDR
0x01 — LE Public
0x02 — LE Random

This command can only be used when the controller is powered.

It generates a Command Complete event on success or failure.

Possible errors:

Invalid Parameters
Not Powered
Invalid Index

💀 Unpair Device

Command Code

0x001B

Controller Index — <controller id>

Command Parameters

Address (6 Octets)
Address_Type (1 Octet)
Disconnect (1 Octet)

Return Parameters

Address (6 Octets)
Address_Type (1 Octet)

Removes all keys associated with the remote device. Full cleanse, no leftovers 🧹

Possible values for the Address_Type parameter:

0x00 — BR/EDR
0x01 — LE Public
0x02 — LE Random

The Disconnect parameter tells the kernel whether to forcefully disconnect any existing connections to the device. In practice it should basically always be 1 — the only exception is some special GAP qualification test-cases where you need key removal without disconnecting 👀

When you unpair a device, its link key, long term key, and — if provided — its identity resolving key all get purged. Gone. Deleted. 🗑️

For devices using resolvable random addresses where the identity resolving key was available: after this command they will no longer be resolved. The device essentially becomes private again. Main character went anonymous 😭

This command can only be used when the controller is powered.

It generates a Command Complete event on success or failure.

Possible errors:

Not Paired
Invalid Parameters
Not Powered
Invalid Index

✨ User Confirmation Reply

Command Code

0x001C

Controller Index — <controller id>

Command Parameters

Address (6 Octets)
Address_Type (1 Octet)

Return Parameters

Address (6 Octets)
Address_Type (1 Octet)

This command is your reply to a User Confirmation Request event — like hitting "yes" in the group chat 🫶

Possible values for the Address_Type parameter:

0x00 — BR/EDR
0x01 — LE Public
0x02 — LE Random

This command can only be used when the controller is powered.

It generates a Command Complete event on success or failure.

Possible errors:

Not Connected
Invalid Parameters
Not Powered
Invalid Index

💖 User Confirmation Negative Reply

Command Code

0x001D

Controller Index <controller id>

Command Parameters

Address (6 Octets)
...    Address_Type (1 Octet)

Return Parameters

Address (6 Octets)
...    Address_Type (1 Octet)

Okay so this one is literally you telling the controller "bestie, NO 💀" — it returns a negative response to a User Confirmation Request event. Like, the pairing thing popped up and the answer is no.

Possible values for the Address_Type parameter:

0x00 — BR/EDR
0x01 — LE Public
0x02 — LE Random

This command can only be used when the controller is powered. ⚡ Like, powered-powered. No power, no reply, periodt.

This command generates a Command Complete event on success or failure.

Possible errors:

Not Connected
Invalid Parameters
Not Powered
Invalid Index

🎀 User Passkey Reply

Command Code

0x001E

Controller Index <controller id>

Command Parameters

Address (6 Octets)
...    Address_Type (1 Octet)
...    Passkey (4 Octets)

Return Parameters

Address (6 Octets)
...    Address_Type (1 Octet)

This is the opposite vibe — you're responding to a User Confirmation Passkey Request event. You got a passkey, you're typing it in, you're being helpful 💅

Possible values for the Address_Type parameter:

0x00 — BR/EDR
0x01 — LE Public
0x02 — LE Random

This command can only be used when the controller is powered. Same energy as before: power it up first, bestie.

This command generates a Command Complete event on success or failure.

Possible errors:

Not Connected
Invalid Parameters
Not Powered
Invalid Index

🦋 User Passkey Negative Reply

Command Code

0x001F

Controller Index <controller id>

Command Parameters

Address (6 Octets)
...    Address_Type (1 Octet)

Return Parameters

Address (6 Octets)
...    Address_Type (1 Octet)

The passkey equivalent of "nope 🙈" — it returns a negative response to a User Passkey Request event.

Possible values for the Address_Type parameter:

0x00 — BR/EDR
0x01 — LE Public
0x02 — LE Random

This command can only be used when the controller is powered. (Are we sensing a theme? 👑)

This command generates a Command Complete event on success or failure.

Possible errors:

Not Connected
Invalid Parameters
Not Powered
Invalid Index

🌈 Read Local Out Of Band Data

Command Code

0x0020

Controller Index <controller id>

Command Parameters (none — this one's just a vibe check, no args 🫶)

Return Parameters

Hash_192 (16 Octets)
...    Randomizer_192 (16 Octets)
...    Hash_256 (16 Octets, Optional)
...    Randomizer_256 (16 Octets, Optional)

This command reads the local Out of Band data. OOB bestie, iconic security behavior 🔥

This command can only be used when the controller is powered.

If Secure Connections support is enabled, then this command will return P-192 versions of hash and randomizer as well as P-256 versions of both.

Super important caveat, do not skip this one: the values returned by this command become invalid when the controller is powered down. After each power-cycle it is required to call this command again to get updated values. So like, don't cache these and then go touch grass 😭 come back and re-read them.

This command generates a Command Complete event on success or a Command Status event on failure.

Possible errors:

Not Supported
Busy
Invalid Parameters
Not Powered
Invalid Index

💜 Add Remote Out Of Band Data

Command Code

0x0021

Controller Index <controller id>

Command Parameters

Address (6 Octets)
...    Address_Type (1 Octet)
...    Hash_192 (16 Octets)
...    Randomizer_192 (16 Octets)
...    Hash_256 (16 Octets, Optional)
...    Randomizer_256 (16 Octets, Optional)

Return Parameters

Address (6 Octets)
...    Address_Type (1 Octet)

This command provides Out of Band data for a remote device. Feeding the controller the tea on another device 🍓

Possible values for the Address_Type parameter:

0x00 — BR/EDR
0x01 — LE Public
0x02 — LE Random

Provided Out Of Band data is persistent over power down/up toggles. It survives 🙌 unlike some of us.

This command also accepts optional P-256 versions of hash and randomizer. If they are not provided, then they are set to zero value.

The P-256 versions of both can also be provided when the support for Secure Connections is not enabled. However in that case they will never be used. (So like, giving someone your number and never texting them. Valid but pointless 💀)

To only provide the P-256 versions of hash and randomizer, it is valid to leave both P-192 fields as zero values. If Secure Connections is disabled, then of course this is the same as not providing any data at all.

When providing data for remote LE devices, then the Hash_192 and Randomizer_192 fields are not used and shell be set to zero.

The Hash_256 and Randomizer_256 fields can be used for LE secure connections Out Of Band data. If only LE secure connections data is provided the Hash_P192 and Randomizer_P192 fields can be set to zero. Currently there is no support for providing the Security Manager TK Value for LE legacy pairing.

Heads up bestie: If Secure Connections Only mode has been enabled, then providing Hash_P192 and Randomizer_P192 is not allowed. They are required to be set to zero values. No exceptions, no cap. 🚫

This command can be used when the controller is not powered and all settings will be programmed once powered. (Yes, this one's chill about power state, unlike the last few.)

This command generates a Command Complete event on success or failure.

Possible errors:

Failed
Invalid Parameters
Not Powered
Invalid Index

⭐ Remove Remote Out Of Band Data

Command Code

0x0022

Controller Index <controller id>

Command Parameters

Address (6 Octets)
...    Address_Type (1 Octet)

Return Parameters

Address (6 Octets)
...    Address_Type (1 Octet)

This command removes data added using the Add Remote Out Of Band Data command. It's the undo button, we love an undo button 🎀

Possible values for the Address_Type parameter:

0x00 — BR/EDR
0x01 — LE Public
0x02 — LE Random

Iconic detail: when the Address parameter is 00:00:00:00:00:00, then all previously added data will be removed. Mass deletion. Full clean slate. ✨

This command can be used when the controller is not powered and all settings will be programmed once powered.

This command generates a Command Complete event on success or failure.

Possible errors:

Invalid Parameters
Not Powered
Invalid Index

🧚 Start Discovery

Command Code

0x0023

Controller Index <controller id>

Command Parameters

Address_Type (1 Octet)

Return Parameters

Address_Type (1 Octet)

This command starts the whole process of discovering remote devices. Main character energy: everyone shows up to say hi 👑

A Device Found event will be sent for each discovered device. Every single one, no skipping 💅

Possible values for the Address_Type parameter are a bit-wise or of the following bits:

Bit 0 — BR/EDR
Bit 1 — LE Public
Bit 2 — LE Random

By mixing and matching those flags you can end up with stuff like this:

0x01 — BR/EDR
0x06 — LE (public & random)
0x07 — BR/EDR/LE (interleaved discovery)

This command is powered-controller only, bestie — if the controller isn't powered, it's not happening.

It fires off a Command Complete event whether it slays or flops. 💅

Possible errors:

Busy
Not Supported
Invalid Parameters
Not Powered
Invalid Index

Stop Discovery 🛑

Command Code — 0x0024
Controller Index — <controller id>
Command Parameters — Address_Type (1 Octet)
Return Parameters — Address_Type (1 Octet)

This one hits the brakes on the discovery process you kicked off with the Start Discovery command. No more scanning, we're done here. ✋

Again: only usable when the controller is powered.

Generates a Command Complete event on success or failure — it's an equal-opportunity reporter.

Possible errors:

Rejected
Invalid Parameters
Invalid Index

Confirm Name 🌸

Command Code — 0x0025
Controller Index — <controller id>
Command Parameters — Address (6 Octets), Address_Type (1 Octet), Name_Known (1 Octet)
Return Parameters — Address (6 Octets), Address_Type (1 Octet)

So this command is only valid during device discovery, and it's expected for every single Device Found event that has the Confirm Name flag set. Like, the kernel is literally waiting on you, don't leave it hanging. 🙈

Possible values for the Address_Type parameter:

0x00 — BR/EDR
0x01 — LE Public
0x02 — LE Random

Now the Name_Known parameter: set it to 0x01 if user space already knows the name for the device, and 0x00 if it doesn't. And if you set it to 0x00, the kernel goes off and does a whole name resolving procedure for that device. Doing the most so you don't have to. 💖

Powered controller only, obviously.

Generates a Command Complete event on success or failure.

Possible errors:

Failed
Invalid Parameters
Invalid Index

Block Device 🚫

Command Code — 0x0026
Controller Index — <controller id>
Command Parameters — Address (6 Octets), Address_Type (1 Octet)
Return Parameters — Address (6 Octets), Address_Type (1 Octet)

This command adds a device to the list of devices that should be blocked from connecting to the local controller. Consider it the group-chat mute button but for Bluetooth. 💀

Possible values for the Address_Type parameter:

0x00 — BR/EDR
0x01 — LE Public
0x02 — LE Random

For Low Energy devices, blocking takes precedence over the auto-connection actions that come from Add Device. Blocked devices won't be auto-connected, and they won't even be reported when found during background scanning. And if the controller is connectable, directed advertising from blocked devices gets ignored too. They're on read, fr fr.

Connections created from advertising of the controller get dropped if the device is blocked.

Here's the cute part: this command can be used when the controller is not powered. Iconic.

Generates a Command Complete event on success or failure.

Possible errors:

Failed
Invalid Parameters
Invalid Index

Unblock Device 🕊️

Command Code — 0x0027
Controller Index — <controller id>
Command Parameters — Address (6 Octets), Address_Type (1 Octet)
Return Parameters — Address (6 Octets), Address_Type (1 Octet)

This one removes a device from that blocked list — the very same list you added it to with the Block Device command. Un-muting, basically. 🫶

Possible values for the Address_Type parameter:

0x00 — BR/EDR
0x01 — LE Public
0x02 — LE Random

When the Address parameter is 00:00:00:00:00:00, all previously blocked devices get unblocked. Mass forgiveness. ✨

This command can be used when the controller is not powered.

Generates a Command Complete event on success or failure.

Possible errors:

Invalid Parameters
Invalid Index

Set Device ID 🏷️

Command Code — 0x0028
Controller Index — <controller id>
Command Parameters — Source (2 Octets), Vendor (2 Octets), Product (2 Octets), Version (2 Octets)
Return Parameters — (none, she returns nothing but vibes)

This command can be used when the controller is not powered, and get this — all the settings get programmed once it is powered. Lazy-loading your identity. 💅

The Source parameter picks which organization assigned the Vendor parameter:

0x0000 — Disable Device ID
0x0001 — Bluetooth SIG
0x0002 — USB Implementer's Forum

The info gets put into the EIR data. And if the controller doesn't support EIR, or if SSP is disabled, this command still succeeds — the information is stored for later use and survives toggling SSP on and off. She's patient. 🌸

Generates a Command Complete event on success, or a Command Status event on failure. Different event for failure, notice that. 👀

Possible errors:

Invalid Parameters
Invalid Index

Set Advertising (since 1.4) 📣

Command Code — 0x0029
Controller Index — <controller id>
Command Parameters — Advertising (1 Octet)
Return Parameters — Current_Settings (4 Octets)

This command enables LE advertising on a controller that actually supports it. The allowed values for the Advertising command parameter are:

0x00 — Disable advertising
0x01 — Enables advertising
0x02 (since 1.9) — Enabled advertising in connectable mode

So using value 0x01 means: when connectable setting is disabled, the advertising happens with undirected non-connectable advertising packets and a non-resolvable random address is used. But if connectable setting is enabled, then it's undirected connectable advertising packets plus the identity address or resolvable private address. Different outfit depending on the occasion. 🎀

LE Devices configured via the Add Device command with Action 0x01 have no effect when you're using Advertising value 0x01, since only the connectable setting is taken into account.

Now — to get undirected connectable advertising without changing the connectable setting, use value 0x02. It makes the device connectable via LE without needing to be connectable on BR/EDR (and/or LE). No cap.

The value 0x02 should be the preferred mode of operation when implementing peripheral mode. Write that down. 📝

Heads up, bestie: using this command will temporarily deactivate any configuration made by the Add Advertising command. This command takes precedence. Once a Set Advertising command with value 0x00 is issued, any previously made configurations via Add/Remove Advertising — including such changes made while Set Advertising was active — will be re-enabled. So it's a pause, not a delete. 🦋

A pre-requisite is that LE is already enabled, otherwise this command will return a "rejected" response. 💅

This command generates a Command Complete event on success or a Command Status event on failure.

Possible errors:

Busy
Rejected
Not Supported
Invalid Parameters
Invalid Index

🔥 Set BR/EDR (since 1.4)

Command Code — 0x002A
Controller Index — <controller id>
Command Parameters — BR/EDR (1 Octet)
Return Parameters — Current_Settings (4 Octets)

This command is used to enable or disable BR/EDR support on a dual-mode controller. The allowed values for the Advertising command parameter are 0x00 and 0x01. All other values will return Invalid Parameters. ✨

A pre-requisite is that LE is already enabled, otherwise this command will return a "rejected" response. Enabling BR/EDR can be done both when powered on and powered off, however disabling it can only be done when powered off (otherwise the command will again return "rejected"). Disabling BR/EDR will automatically disable all other BR/EDR related settings. 😭

This command generates a Command Complete event on success or a Command Status event on failure.

Possible errors:

Busy
Rejected
Not Supported
Invalid Parameters
Invalid Index

🎀 Set Static Address (since 1.4)

Command Code — 0x002B
Controller Index — <controller id>
Command Parameters — Address (6 Octets)
Return Parameters — Current_Settings (4 Octets)

This command allows for setting the static random address. It is only supported on controllers with LE support. The static random address is suppose to be valid for the lifetime of the controller or at least until the next power cycle. To ensure such behavior, setting of the address is limited to when the controller is powered off. 🦋

The special BDADDR_ANY address (00:00:00:00:00:00) can be used to disable the static address.

When a controller has a public address (which is required for all dual-mode controllers), this address is not used. If a dual-mode controller is configured as Low Energy only devices (BR/EDR has been switched off), then the static address is used. Only when the controller information reports BDADDR_ANY (00:00:00:00:00:00), it is required to configure a static address first. 👑

If privacy mode is enabled and the controller is single mode LE only without a public address, the static random address is used as identity address.

The Static Address flag from the current settings can also be used to determine if the configured static address is in use or not.

This command generates a Command Complete event on success or a Command Status event on failure.

Possible errors:

Rejected
Not Supported
Invalid Parameters
Invalid Index

🌸 Set Scan Parameters (since 1.4)

Command Code — 0x002C
Controller Index — <controller id>
Command Parameters — Interval (2 Octets) Window (2 Octets)
Return Parameters — (nothing listed, bestie 💀)

This command allows for setting the Low Energy scan parameters used for connection establishment and passive scanning. It is only supported on controllers with LE support.

This command generates a Command Complete event on success or a Command Status event on failure.

Possible errors:

Rejected
Not Supported
Invalid Parameters
Invalid Index

💜 Set Secure Connections (since 1.5)

Command Code — 0x002D
Controller Index — <controller id>
Command Parameters — Secure_Connections (1 Octet)
Return Parameters — Current_Settings (4 Octets)

This command is used to enable/disable Secure Connections support for a controller. The allowed values for the Secure_Connections command parameter are 0x00, 0x01 and 0x02. All other values will return Invalid Parameters. ⭐

The value 0x00 disables Secure Connections, the value 0x01 enables Secure Connections and the value 0x02 enables Secure Connections Only mode.

This command is only available for LE capable controllers as well as controllers supporting the core specification version 4.1 or greater.

This command can be used when the controller is not powered and all settings will be programmed once powered. 🔥

In case the controller does not support Secure Connections the command will fail regardless with Not Supported error.

This command generates a Command Complete event on success or a Command Status event on failure.

Possible errors:

Busy
Not Supported
Invalid Parameters
Invalid Index

🧚 Set Debug Keys (since 1.5)

Command Code — 0x002E
Controller Index — <controller id>
Command Parameters — Debug_Keys (1 Octet)
Return Parameters — Current_Settings (4 Octets)

This command is used to tell the kernel whether to accept the usage of debug keys or not. The allowed values for this parameter are:

0x00 — Discard keys on disconnect
0x01 — Discard keys on reboot
0x02 (since 1.7) — Discard keys on reboot (SSP debug mode)

With a value of 0x00 any generated debug key will be discarded as soon as the connection terminates. 💀

With a value of 0x01 generated debug keys will be kept and can be used for future connections. However debug keys are always marked as non persistent and should not be stored. This means a reboot or changing the value back to 0x00 will delete them.

With a value of 0x02 generated debug keys will be kept and can be used for future connections. This has the same affect as with value 0x01. However in addition this value will also enter the controller mode to generate debug keys for each new pairing. Changing the value back to 0x01 or 0x00 will disable the controller mode for generating debug keys. 🫶

This command generates a Command Complete event on success or a Command Status event on failure.

Possible errors:

Busy
Not Supported
Invalid Parameters
Invalid Index

🌈 Set Privacy (since 1.5)

Command Code — 0x002F
Controller Index — <controller id>
Command Parameters — Privacy (1 Octet)
- ... Identity_Resolving_Key (16 Octets)
Return Parameters — Current_Settings (4 Octets)

This command is used to enable Low Energy Privacy feature using resolvable private addresses. 👑

The value 0x00 disables privacy mode, the values 0x01 and 0x02 enable privacy mode.

With value 0x01 the kernel will always use the privacy mode. This means resolvable private address is used when the controller is discoverable and also when pairing is initiated.

With value 0x02 the kernel will use a limited privacy mode with a resolvable private address except when the controller is bondable and discoverable, in which case the identity address is used.

Exposing the identity address when bondable and discoverable or during initiated pairing can be a privacy issue. For dual-mode controllers this can be neglected since its public address will be exposed over BR/EDR anyway. The benefit of exposing the identity address for pairing purposes is that it makes matching up devices with dual-mode topology during device discovery now possible. 😭

If the privacy value 0x02 is used, then also the GATT database should expose the Privacy Characteristic so that remote devices can determine if the privacy feature is in use or not.

When the controller has a public address (mandatory for dual-mode controllers) it is used as identity address. In case the controller is single mode LE only without a public address, it is required to configure a static random address first. The privacy mode can only be enabled when an identity address is available. ✨

The Identity_Resolving_Key is the local key assigned for the local resolvable private address.

Possible errors:

Busy
Not Supported
Invalid Parameters
Invalid Index

🍓 Load Identity Resolving Keys (since 1.5)

Command Code — 0x0030
Controller Index — <controller id>
Command Parameters — Key_Count (2 Octets)
- ... Address[] (6 Octets)
- ... Address_Type[] (1 Octet)
- ... Value[] (16 Octets)
- ... ...[]
Return Parameters — (nothing listed, bestie 💀)

This command is used to feed the kernel with currently known identity resolving keys. The command does not need to be called again upon the receipt of New Identity Resolving Key events since the kernel updates its list automatically. 🌟

Possible values for the Address_Type parameter:

0x00 — Reserved (not in use)
0x01 — LE Public
0x02 — LE Random

The provided Address and Address_Type are the identity of a device. So either its public address or static random address. 💅

Unresolvable random addresses and resolvable random addresses are not valid and will be rejected.

This command can be used when the controller is not powered.

This command generates a Command Complete event on success or a Command Status event on failure.

Possible errors:

Invalid Parameters
Invalid Index

🦋 Get Connection Information (since 1.6) 🦋

okay bestie, here's the tea on this one ☕

Command Code — 0x0031
Controller Index — <controller id>
Command Parameters
- Address (6 Octets)
- Address_Type (1 Octet)
Return Parameters
- Address (6 Octets)
- Address_Type (1 Octet)
- RSSI (1 Octet)
- TX_Power (1 Octet)
- Max_TX_Power (1 Octet)

This command is literally the "so… what's going on with this connection 👀" command — it pulls the connection info for you.

Possible values for the Address_Type parameter:

0x00 — Reserved (not in use)
0x01 — LE Public
0x02 — LE Random

Real talk: TX_Power and Max_TX_Power can be set to 127 if the values are invalid or unknown. And a value of 127 for RSSI means it's just not available. no cap 🙈

This command generates a Command Complete event on success and on failure. But heads up: in case of failure, only the Address and Address_Type fields are valid, and the values of the remaining parameters are considered invalid and shall be ignored. don't be out here trusting stale numbers 💀

Possible errors:

Not Connected
Not Powered
Invalid Parameters
Invalid Index

🎀 Get Clock Information (since 1.7) 🎀

Command Code — 0x0032
Controller Index — <controller id>
Command Parameters
- Address (6 Octets)
- Address_Type (1 Octet)
Return Parameters
- Address (6 Octets)
- Address_Type (1 Octet)
- Local_Clock (4 Octets)
- Piconet_Clock (4 Octets)
- Accuracy (2 Octets)

This command is used to get local and piconet clock information. clock lore ⏰✨

Possible values for the Address_Type parameter:

0x00 — BR/EDR
0x01 — Reserved (not in use)
0x02 — Reserved (not in use)

The Accuracy can be set to 0xffff, which means the value is unknown. (iykyk 🫶)

If the Address is set to 00:00:00:00:00:00, then only the Local_Clock field has a valid value. The Piconet_Clock and Accuracy fields are invalid and shall be ignored. don't come for them, they're just not invited to the party 🚫

This command generates a Command Complete event on success and on failure. In case of failure only Address and Address_Type fields are valid and values of remaining parameters are considered invalid and shall be ignored.

Possible errors:

Not Connected
Not Powered
Invalid Parameters
Invalid Index

💅 Add Device (since 1.7) 💅

Command Code — 0x0033
Controller Index — <controller id>
Command Parameters
- Address (6 Octets)
- Address_Type (1 Octet)
- Action (1 Octet)
Return Parameters
- Address (6 Octets)
- Address_Type (1 Octet)

This command is used to add a device to the action list. The action list allows scanning for devices and enables incoming connections from known devices. it's giving VIP guest list energy 🎟️✨

Possible values for the Address_Type parameter:

0x00 — BR/EDR
0x01 — LE Public
0x02 — LE Random

Possible values for the Action parameter:

0x00 — Background scan for device
0x01 — Allow incoming connection
0x02 — Auto-connect remote device

With the Action 0x00, when the device is found, a new Device Found event will be sent indicating this device is available. This action is only valid for LE Public and LE Random address types. 🔍

With the Action 0x01, the device is allowed to connect. For BR/EDR address type this means an incoming connection. For LE Public and LE Random address types, a connection will be established to devices using directed advertising. If successful a Device Connected event will be sent. 🫶

With the Action 2, when the device is found, it will be connected and if successful a Device Connected event will be sent. This action is only valid for LE Public and LE Random address types. (yes, it's written as 2 here — copy that exactly, bestie, do not "fix" it 😭)

When a device is blocked using Block Device command, then it is valid to add the device here, but all actions will be ignored until the device is unblocked. blocked bestie stays uninvited 💀

Devices added with Action 1 are allowed to connect even if the connectable setting is off. This acts as list of known trusted devices. main character whitelist energy 👑

This command can be used when the controller is not powered and all settings will be programmed once powered. 📴➡️📶

This command generates a Command Complete event on success or failure.

Possible errors:

Failed
Invalid Parameters
Invalid Index

🌸 Remove Device (since 1.7) 🌸

Command Code — 0x0034
Controller Index — <controller id>
Command Parameters
- Address (6 Octets)
- Address_Type (1 Octet)
Return Parameters
- Address (6 Octets)
- Address_Type (1 Octet)

This command is used to remove a device from the action list previously added by using the Add Device command. we're uninviting them, respectfully 🚪👋

Possible values for the Address_Type parameter:

0x00 — BR/EDR
0x01 — LE Public
0x02 — LE Random

When the Address parameter is 00:00:00:00:00:00, then all previously added devices will be removed. full group-chat purge, no survivors 💀🔥

This command can be used when the controller is not powered and all settings will be programmed once powered.

This command generates a Command Complete event on success or failure.

Possible errors:

Invalid Parameters
Invalid Index

⭐ Load Connection Parameters (since 1.7) ⭐

Command Code — 0x0035
Controller Index — <controller id>
Command Parameters
- Param_Count (2 Octets)
- Address[] (6 Octets)
- Address_Type[] (1 Octet)
- Min_Connection_Interval[] (2 Octets)
- Max_Connection_Interval[] (2 Octets)
- Connection_Latency[] (2 Octets)
- Supervision_Timeout[] (2 Octets)
- ...[]
Return Parameters — (none, bestie, it's a void 💫)

This command is used to load connection parameters from several devices into kernel. Currently this is only supported on controllers with Low Energy support.

Possible values for the Address_Type parameter:

0x00 — BR/EDR
0x01 — LE Public
0x02 — LE Random

The provided Address and Address_Type are the identity of a device. So either its public address or static random address. that's their whole identity, don't question it 💅

The Min_Connection_Interval, Max_Connection_Interval, Connection_Latency and Supervision_Timeout parameters should be configured as described in Core 4.1 spec, Vol 2, 7.8.12. 📖 go read the lore, it's all there.

This command can be used when the controller is not powered.

This command generates a Command Complete event on success or a Command Status event on failure. note the difference, bestie — different event on failure, don't mix them up 🫶

Possible errors:

Invalid Parameters
Invalid Index
Not Supported

🌈 Read Unconfigured Controller Index List (since 1.7) 🌈

Command Code — 0x0036
Controller Index — <non-controller>
Command Parameters — (nope, none, empty, void 🕳️✨)
Return Parameters
- Num_Controllers (2 Octets)
- Controller_Index[i] (2 Octets)

This one's the roll call — it hands you back the whole list of controller indexes that haven't been configured yet, plus how many of them there are. it's giving "who hasn't shown up to class" energy 📋👀

This command hands you back the list of controllers that are currently unconfigured. And bestie, if more unconfigured controllers show up after you call this? You can keep an eye on them with the Unconfigured Index Added event. Lowkey elegant.

An unconfigured controller has two glow-up paths:

It goes configured — you'll see an Unconfigured Index Removed event, then an Index Added event. The full makeover sequence 💅
It dips from the system entirely — signalled by the Unconfigured Index Removed event. Gone, not blocked.

Only controllers that actually need configuration get listed here. A controller that's fully configured won't show up even if it supports configuration changes — it's already that girl, no notes.

This command generates a Command Complete event on success or a Command Status event on failure.

✨ Read Controller Configuration Information (since 1.7) ✨

Command Code

0x0037

Controller Index

<controller id>

Command Parameters

(none — she takes nothing)

Return Parameters

Manufacturer (2 Octets)
Supported_Options (4 Octets)
Missing_Options (4 Octets)

Okay so this command is how you pull the supported configuration options of a controller and the missing configuration options. Two-for-one, we love.

The missing options are literally required to be configured before the controller counts as fully configured and ready for standard operation. Typical move: call this right after you get the response to Read Unconfigured Controller Index List, or right after an Unconfigured Index Added event. Timing queen 🎀

Supported_Options and Missing_Options are bitmasks, and currently these are the available bits:

Bit 0 — External configuration
Bit 1 — Bluetooth public address configuration

It is valid to call this command on controllers that don't require any configuration. And yes — a fully configured controller can still offer additional support for configuration. Flexible.

Example time, because this one's giving nuance: a controller may contain a valid Bluetooth public device address but also allow you to configure it from the host stack. In that case the general support for configurations is indicated by the Controller Configuration settings. For controllers where no configuration options are available, that setting option just won't be present. Simple as that.

When all configurations have been completed and the Missing_Options mask would therefore become empty, the now-ready controller gets announced via an Index Added event. The reveal ✨

This command generates a Command Complete event on success or a Command Status event on failure.

Possible errors:

Invalid Parameters
Invalid Index

✨ Set External Configuration (since 1.7) ✨

Command Code

0x0038

Controller Index

<controller id>

Command Parameters

Configuration (1 Octet)

Return Parameters

Missing_Options (4 Octets)

This command lets you flip the external configuration option to say a controller is now configured — or unconfigured, if we're going backwards.

The values, precisely:

0x00 sets unconfigured state
0x01 sets configured state

It is not mandatory that a controller provides this configuration option. But if it does, the configuration has to happen externally, via user channel operation or vendor specific methods. No shortcuts, bestie.

Set this option, and when Missing_Options comes back as zero? That means the controller switches to configured state, and you can expect it to be announced via an Index Added event. 🦋

Wrongly configured controllers might still throw an error when you try to power them via the Set Powered command. So like… get it right the first time, mmkay?

This command generates a Command Complete event on success or a Command Status event on failure.

Possible errors:

Rejected
Not Supported
Invalid Parameters
Invalid Index

✨ Set Public Address (since 1.7) ✨

Command Code

0x0039

Controller Index

<controller id>

Command Parameters

Address (6 Octets)

Return Parameters

Missing_Options (4 Octets)

This one configures the public address. Because a vendor specific procedure is required, this command might not be supported by all controllers — and honestly, most likely only a handful of embedded controllers will offer support for it. It's giving exclusive membership 🌸

When support for Bluetooth public address configuration is indicated in the supported options mask, then this command can be used to configure the public address.

And this part matters: it is only possible to configure the public address when the controller is powered off. Periodt.

Two scenarios, both important:

For an unconfigured controller, when Missing_Options returns an empty mask, that means an Index Added event for the now fully configured controller can be expected.
For a fully configured controller, the current controller index will become invalid, and an Unconfigured Index Removed event will be sent. Once the address has been successfully changed, an Index Added event will be sent. There is no guarantee that the controller index stays the same. Not gonna lie, that one's a jumpscare 😭

🚨 All previous configured parameters and settings are lost when this command succeeds. The controller has to be treated as a new one. Use this command for a fully configured controller only when you really know what you are doing. Like, fr fr. Genuinely. Not a drill.

This command generates a Command Complete event on success or a Command Status event on failure.

Possible errors:

Rejected
Not Supported
Invalid Parameters
Invalid Index

✨ Start Service Discovery (since 1.8) ✨

Command Code

0x003a

Controller Index

<controller id>

Command Parameters

Address_Type (1 Octet)
RSSI_Threshold (1 Octet)
UUID_Count (2 Octets)
UUID[i] (16 Octets)

Return Parameters

Address_Type (1 Octet)

This command kicks off the process of discovering remote devices with a specific UUID. A Device Found event will be sent for each discovered device. Cute, right? 🧚

Possible values for the Address_Type parameter are a bit-wise or of the following bits:

Bit 0 — BR/EDR
Bit 1 — LE Public
Bit 2 — LE Random

And by combining these, e.g. the following values are possible:

0x01 — BR/EDR
0x06 — LE (public & random)
0x07 — BR/EDR/LE (interleaved discovery)

The service discovery uses active scanning for Low Energy scanning and will search for UUID in both advertising data and scan response data. Thorough icon behavior 🔍

Found devices that have an RSSI value smaller than RSSI_Threshold are not reported via DeviceFound event. Setting a value of 127 will cause all devices to be reported. Yes, all of them. Everybody gets a turn.

The list of UUIDs identifies a logical OR. Only one of the UUIDs has to match to cause a DeviceFound event. And providing an empty list of UUIDs with Num_UUID set to 0 means DeviceFound events get sent out for all devices above the RSSI_Threshold. (Note the original says Num_UUID there — same field, we're just reading it off the page exactly as written 👀)

In case RSSI_Threshold is set to 127 and UUID_Count is 0, then this command behaves exactly the same as Start Discovery. Basically twins.

When the discovery procedure starts, the Discovery event will notify this, similar to Start Discovery.

This command can only be used when the controller is powered. Non-negotiable.

This command generates a Command Complete event on success or failure.

Possible errors:

Busy
Not Supported
Invalid Parameters
Not Powered
Invalid Index

✨ Read Local Out Of Band Extended Data (since 1.9) ✨

Command Code

0x003b

Controller Index

<controller id>

Command Parameters

Address_Type (1 Octet)

Return Parameters

Address_Type (1 Octet)
EIR_Data_Length (2 Octets)
EIR_Data (0-65535 Octets)

This command reads the local Out of Band data information and provides it encoded as extended inquiry response information or advertising data. Very demure, very encoded 💖

Possible values for the Address_Type parameter are a bit-wise or of the following bits:

Bit 0 — BR/EDR
Bit 1 — LE Public
Bit 2 — LE Random

(…and she continues, because there's so much more to cover — don't go anywhere bestie 🫶)

By combining these, bestie, you can get values like this:

0x01 — BR/EDR
0x06 — LE (public & random)
0x07 — Reserved (not in use)

For a BR/EDR controller (Address_Type 1), the info that comes back is:

Class of Device
Simple Pairing Hash C-192 (optional)
Simple Pairing Randomizer R-192 (optional)
Simple Pairing Hash C-256 (optional)
Simple Pairing Randomizer R-256 (optional)
Service Class UUID (optional)
Bluetooth Local Name (optional)

The Simple Pairing Hash C-256 and Simple Pairing Randomizer R-256 fields only show up when secure connections has been enabled.

The Device Address (BD_ADDR) is not included in the EIR_Data, so you gotta take it from controller information. No cap.

For an LE controller (Address_Type 6), the info that comes back is:

LE Bluetooth Device Address
LE Role
LE Secure Connections Confirmation Value (optional)
LE Secure Connections Random Value (optional)
Appearance (optional)
Local Name (optional)
Flags

The LE Secure Connections Confirmation Value and LE Secure Connections Random Value fields only show up when secure connections has been enabled.

The Security Manager TK Value from the Bluetooth specification cannot be provided by this command. The Out Of Band information here is for asymmetric exchanges based on Diffie-Hellman key exchange. The Security Manager TK Value is a symmetric random number that has to be acquired and agreed upon differently.

The info coming back from the BR/EDR controller type and the LE controller type is not related to each other. Once they've been used over an Out Of Band link, a new set of information shall be requested.

When Secure Connections Only mode has been enabled, the fields for Simple Pairing Hash C-192 and Simple Pairing Randomizer R-192 are not returned. Only the fields for the strong secure connections pairing are included.

This command can only be used when the controller is powered. ✨

Values returned by this command become invalid when the controller is powered down. After each power-cycle, you have to call this command again to get updated information. Periodt.

This command generates a Command Complete event on success or a Command Status event on failure.

Possible errors:

Not Supported
Busy
Invalid Parameters
Not Powered
Invalid Index

💅 Read Extended Controller Index List (since 1.9)

Command Code

0x003c

Controller Index

<non-controller>

Command Parameters

(nothing listed)

Return Parameters

Num_Controllers (2 Octets)
...    Controller_Index[i] (2 Octets)
...    Controller_Type[i] (1 Octet)
...    Controller_Bus[i] (1 Octet)

This command returns the list of currently known controllers, and it includes configured, unconfigured and alternate controllers. Slay.

Controllers added or removed after calling this command can be monitored using the Extended Index Added and Extended Index Removed events.

The existing Index Added, Index Removed, Unconfigured Index Added and Unconfigured Index Removed are no longer sent after this command has been used at least once.

Instead of calling Read Controller Index List and Read Unconfigured Controller Index List, this command combines all the information and can be used to retrieve the controller list.

The Controller_Type parameter has these values:

0x00 — Primary Controller (BR/EDR and/or LE)
0x01 — Unconfigured Controller (BR/EDR and/or LE)
0x02 — Alternate MAC/PHY Controller (AMP)

The 0x00 and 0x01 types indicate a primary BR/EDR and/or LE controller. The difference is just if they need extra configuration or if they are fully configured.

Controllers in configured state will be listed as 0x00, and controllers in unconfigured state will be listed as 0x01. A controller that is fully configured and supports configuration changes will be listed as 0x00.

Alternate MAC/PHY controllers will be listed as 0x02. They do not support the difference between configured and unconfigured state.

The Controller_Bus parameter has these values:

0x00 — Virtual
0x01 — USB
0x02 — PCMCIA
0x03 — UART
0x04 — RS232
0x05 — PCI
0x06 — SDIO
0x07 — SPI
0x08 — I2C
0x09 — SMD
0x0A — VIRTIO
0x0B — IPC

Controllers marked as RAW only operation are currently not listed by this command.

This command generates a Command Complete event on success or a Command Status event on failure.

🌈 Read Advertising Features (since 1.9)

Command Code

0x003d

Controller Index

<controller id>

Command Parameters

(nothing listed)

Return Parameters

Supported_Flags (4 Octets)
...    Max_Adv_Data_Len (1 Octet)
...    Max_Scan_Rsp_Len (1 Octet)
...    Max_Instances (1 Octet)
...    Num_Instances (1 Octet)
...    Instance[] (1 Octet)
...    ...[]

This command is used to read the advertising features supported by the controller and stack. 🦋

okay so the Supported_Flags field is literally the menu of possible values for the Flags field in the Add Advertising command, and here's the whole lineup, bestie:

Bit 0 — Switch into Connectable mode 💅
Bit 1 — Advertise as Discoverable
Bit 2 — Advertise as Limited Discoverable
Bit 3 — Add Flags field to Adv_Data
Bit 4 — Add TX Power field to Adv_Data
Bit 5 (since 1.14) — Add Appearance field to Scan_Rsp
Bit 6 (since 1.14) — Add Local Name in Scan_Rsp
Bit 7 (since 1.15) — Secondary Channel with LE 1M
Bit 8 (since 1.15) — Secondary Channel with LE 2M
Bit 9 (since 1.15) — Secondary Channel with LE Coded

The Flags bit 0 is the icon that says “support for connectable advertising” and also “support for switching to connectable advertising independent of the connectable global setting.” When this flag is not supported, then the global connectable setting decides whether undirected connectable, undirected scannable or undirected non-connectable advertising is used. It also decides the use of non-resolvable random address versus identity address or resolvable private address. no cap 🫶

The Flags bit 1 says “support for advertising with discoverable mode enabled.” Users of this flag will decrease the Max_Adv_Data_Len by 3 octets. In this case the advertising data flags are managed and added in front of the provided advertising data. ✨

The Flags bit 2 says “support for advertising with limited discoverable mode enabled.” Users of this flag will decrease the Max_Adv_Data_Len by 3 octets. In this case the advertising data flags are managed and added in front of the provided advertising data. 💖

The Flags bit 3 says “support for automatically keeping the Flags field of the advertising data updated.” Users of this flag will decrease the Max_Adv_Data_Len by 3 octets and need to keep that in mind. The Flags field will be added in front of the advertising data provided by the user. Note that with Flags bit 1 and Flags bit 2, this one will be implicitly used even if it is not marked as supported. 🎀

The Flags bit 4 says “support for automatically adding the TX Power value to the advertising data.” Users of this flag will decrease the Max_Adv_Data_Len by 3 octets. The TX Power field will be added at the end of the user provided advertising data. If the controller does not support TX Power information, then this bit will not be set. 🔥

The Flags bit 5 says “support for automatically adding the Appearance value to the scan response data.” Users of this flag will decrease the Max_Scan_Rsp_len by 4 octets. The Appearance field will be added in front of the scan response data provided by the user. If the appearance value is not supported, then this bit will not be set. 🌸

The Flags bit 6 says “support for automatically adding the Local Name value to the scan response data.” This flag indicates an opportunistic approach for the Local Name. If enough space in the scan response data is available, it will be added. If the space is limited, it's giving short version or no name information. The Local Name will be added at the end of the scan response data. 🦋

The Flags bit 7 says “support for advertising in secondary channel in LE 1M PHY.” 🧚

The Flags bit 8 says “support for advertising in secondary channel in LE 2M PHY.” Primary channel would be on 1M. 💜

The Flags bit 9 says “support for advertising in secondary channel in LE CODED PHY.” 🌈

The valid range for Instance identifiers is 1-254. The value 0 is reserved for internal use and the value 255 is reserved for future extensions. However the Max_Instances value for indicating the number of supported Instances can be also 0 if the controller does not support any advertising. 👑

The Max_Adv_Data_Len and Max_Scan_Rsp_Len provides extra information about the maximum length of the data fields. For now this will always return the value 31. Different flags however might decrease the actual available length in these data fields. ⭐

With Num_Instances and Instance array the currently occupied Instance identifiers can be retrieved. 💫

This command generates a Command Complete event on success or a Command Status event on failure. 😭

Possible errors:

Invalid Parameters
Invalid Index

🌸 Add Advertising (since 1.9) 🌸

Command Code — 0x003e
Controller Index — <controller id>

Command Parameters:

Instance (1 Octet)
... Flags (4 Octets)
... Duration (2 Octets)
... Timeout (2 Octets)
... Adv_Data_Len (1 Octet)
... Scan_Rsp_Len (1 Octet)
... Adv_Data (0-255 Octets)
... Scan_Rsp (0-255 Octets)

Return Parameters:

Instance (1 Octet)

This command is used to configure an advertising instance that can be used to switch a Bluetooth Low Energy controller into advertising mode. 💅

Added advertising information with this command will not be visible immediately if advertising is enabled via the Set Advertising command. The usage of the Set Advertising command takes precedence over this command. Instance information is stored and will be advertised once advertising via Set Advertising has been disabled. bestie, that's the whole vibe 🫶

The Instance identifier is a value between 1 and the number of supported instances. The value 0 is reserved. 🎀

With the Flags value the type of advertising is controlled and the following flags are defined:

Bit 0 — Switch into Connectable mode 💅
Bit 1 — Advertise as Discoverable
Bit 2 — Advertise as Limited Discoverable
Bit 3 — Add Flags field to Adv_Data
Bit 4 — Add TX Power field to Adv_Data
Bit 5 (since 1.14) — Add Appearance field to Scan_Rsp
Bit 6 (since 1.14) — Add Local Name in Scan_Rsp
Bit 7 (since 1.15) — Secondary Channel with LE 1M
Bit 8 (since 1.15) — Secondary Channel with LE 2M
Bit 9 (since 1.15) — Secondary Channel with LE Coded

When the connectable flag is set, the controller will use undirected connectable advertising. The value of the connectable setting can be overwritten this way. This is useful to switch a controller into connectable mode only for LE operation. This is similar to the mode 0x02 from the Set Advertising command.

When the connectable flag is not set, then the controller will use advertising based on the connectable setting. When using non-connectable or scannable advertising, the controller will be programmed with a non-resolvable random address. When the system is connectable, then the identity address or resolvable private address will be used.

Using the connectable flag is useful for peripheral mode support where BR/EDR (and/or LE) is controlled by Add Device. This allows making the peripheral connectable without having to interfere with the global connectable setting.

If Scan_Rsp_Len is zero and connectable flag is not set and the global connectable setting is off, then non-connectable advertising is used. If Scan_Rsp_Len is larger than zero and connectable flag is not set and the global advertising is off, then scannable advertising is used. This small difference is supported to provide less air traffic for devices implementing broadcaster role.

Secondary channel flags can be used to advertise in secondary channel with the corresponding PHYs. These flag bits are mutually exclusive and setting multiple will result in Invalid Parameter error. Choosing either LE 1M or LE 2M will result in using extended advertising on the primary channel with LE 1M and the respectively LE 1M or LE 2M on the secondary channel. Choosing LE Coded will result in using extended advertising on the primary and secondary channels with LE Coded. Choosing none of these flags will result in legacy advertising.

The Duration parameter configures the length of an Instance. The value is in seconds.

A value of 0 indicates a default value is chosen for the Duration. The default is 2 seconds.

If only one advertising Instance has been added, then the Duration value will be ignored. It only applies for the case where multiple Instances are configured. In that case every Instance will be available for the Duration time and after that it switches to the next one. This is a simple round-robin based approach.

The Timeout parameter configures the life-time of an Instance. In case the value 0 is used it indicates no expiration time. If a timeout value is provided, then the advertising Instance will be automatically removed when the timeout passes. The value for the timeout is in seconds. Powering down a controller will invalidate all advertising Instances and it is not possible to add a new Instance with a timeout when the controller is powered down.

When a Timeout is provided, then the Duration subtracts from the actual Timeout value of that Instance. For example an Instance with Timeout of 5 and Duration of 2 will be scheduled exactly 3 times, twice with 2 seconds and once with 1 second. Other Instances have no influence on the Timeout.

Re-adding an already existing instance (i.e. issuing the Add Advertising command with an Instance identifier of an existing instance) will update that instance's configuration.

An instance being added or changed while another instance is being advertised will not be visible immediately but only when the new/changed instance is being scheduled by the round robin advertising algorithm.

Changes to an instance that is currently being advertised will cancel that instance and switch to the next instance. The changes will be visible the next time the instance is scheduled for advertising. In case a single instance is active, this means that changes will be visible right away.

A pre-requisite is that LE is already enabled, otherwise this command will return a "rejected" response.

This command can be used when the controller is not powered and all settings will be programmed once powered.

This command generates a Command Complete event on success or a Command Status event on failure.

Possible errors:

Failed
Rejected
Not Supported
Invalid Parameters
Invalid Index

Remove Advertising (since 1.9)

Command Code 0x003f

Controller Index <controller id>

Command Parameters Instance (1 Octet)

Return Parameters Instance (1 Octet)

This command is used to remove an advertising instance that can be used to switch a Bluetooth Low Energy controller into advertising mode.

When the Instance parameter is zero, then all previously added advertising Instances will be removed.

Removing advertising information with this command will not be visible as long as advertising is enabled via the Set Advertising command. The usage of the Set Advertising command takes precedence over this command. Changes to Instance information are stored and will be advertised once advertising via Set Advertising has been disabled.

Removing an instance while it is being advertised will immediately cancel the instance, even when it has been advertised less then its configured Timeout or Duration.

This command can be used when the controller is not powered and all settings will be programmed once powered.

This command generates a Command Complete event on success or a Command Status event on failure.

Possible errors:

Invalid Parameters
Invalid Index

Get Advertising Size Information (since 1.11)

Command Code 0x0040

Controller Index <controller id>

Command Parameters Instance (1 Octet) ... Flags (4 Octets)

Return Parameters Instance (1 Octet) ... Flags (4 Octets) ... Max_Adv_Data_Len (1 Octet) ... Max_Scan_Rsp_Len (1 Octet)

The Read Advertising Features command returns the overall maximum size of advertising data and scan response data fields. That size is valid when no Flags are used. However when certain Flags are used, then the size might decrease. This command can be used to request detailed information about the maximum available size.

The following Flags values are defined:

0 — Switch into Connectable mode
1 — Advertise as Discoverable
2 — Advertise as Limited Discoverable
3 — Add Flags field to Adv_Data
4 — Add TX Power field to Adv_Data
5 — Add Appearance field to Scan_Rsp
6 — Add Local Name in Scan_Rsp

To get accurate information about the available size, the same Flags values should be used with the Add Advertising command.

The Max_Adv_Data_Len and Max_Scan_Rsp_Len fields provide information about the maximum length of the data fields for the given Flags values. When the Flags field is zero, then these fields would contain the same values as Read Advertising Features.

Possible errors:

Invalid Parameters
Invalid Index

Start Limited Discovery (since 1.11)

Command Code 0x0041

Controller Index <controller id>

Command Parameters Address_Type (1 Octet)

Return Parameters Address_Type (1 Octet)

This command is used to start the process of discovering remote devices using the limited discovery procedure. A Device Found event will be sent for each discovered device.

Possible values for the Address_Type parameter are a bit-wise or of the following bits:

Bit 0 — BR/EDR
Bit 1 — LE Public
Bit 2 — LE Random

By combining these e.g. the following values are possible:

0x01 — BR/EDR
0x06 — LE (public & random)
0x07 — BR/EDR/LE (interleaved discovery)

okay so the limited discovery vibe is lowkey doing active scanning for Low Energy scanning, and it’s searching for devices that have the limited discoverability flag configured. On BR/EDR it uses LIAC and filters on the limited discoverability flag of the class of device. iconic behavior, honestly. 🦋

when the discovery procedure starts, the Discovery event will notify you about it, similar to Start Discovery. bestie, it’s keeping you in the loop.

This command can only be used when the controller is powered — no powered controller, no command, periodt.

This command generates a Command Complete event on success or failure.

Possible errors:

Busy
Not Supported
Invalid Parameters
Not Powered
Invalid Index

👑 Read Extended Controller Information (since 1.14) 👑

Command Code: 0x0042
Controller Index: <controller id>
Command Parameters: none — it’s giving empty 💅
Return Parameters:
- Address (6 Octets)
- Bluetooth_Version (1 Octet)
- Manufacturer (2 Octets)
- Supported_Settings (4 Octets)
- Current_Settings (4 Octets)
- EIR_Data_Length (2 Octets)
- EIR_Data (0-65535 Octets)

This command is used to retrieve the current state and basic information of a controller. It is typically used right after getting the response to the Read Controller Index List command or an Index Added event (or its extended counterparts). very main character of it ✨

The Address parameter describes the controller’s public address, and you can expect that it is set. However, in the case of single mode Low Energy only controllers, it can be 00:00:00:00:00:00. To power on the controller in this case, it is required to configure a static address using Set Static Address command first. don’t skip that step, bestie 😭

If the public address is set, then it will be used as identity address for the controller. If no public address is available, then the configured static address will be used as identity address.

In the case of a dual-mode controller with public address that is configured as Low Energy only device (BR/EDR switched off), the static address is used when set and public address otherwise. the lore is lore-ing 🫶

Current_Settings and Supported_Settings is a bitmask with currently the following available bits:

Bit 0 — Powered
Bit 1 — Connectable
Bit 2 — Fast Connectable
Bit 3 — Discoverable
Bit 4 — Bondable
Bit 5 — Link Level Security (Sec. mode 3)
Bit 6 — Secure Simple Pairing
Bit 7 — Basic Rate/Enhanced Data Rate
Bit 8 — High Speed
Bit 9 — Low Energy
Bit 10 — Advertising
Bit 11 — Secure Connections
Bit 12 — Debug Keys
Bit 13 — Privacy
Bit 14 — Controller Configuration
Bit 15 — Static Address
Bit 16 — PHY Configuration
Bit 17 — Wideband Speech
Bit 18 — Connected Isochronous Stream - Central
Bit 19 — Connected Isochronous Stream - Peripheral

The EIR_Data field contains information about class of device, local name and other values. Not all of them might be present. For example a Low Energy only device does not contain class of device information. it’s giving “read the room” 🌸

When any of the values in the EIR_Data field changes, the event Extended Controller Information Changed will be used to inform clients about the updated information. slay, notify the people 💖

This command generates a Command Complete event on success or a Command Status event on failure.

Possible errors:

Invalid Parameters
Invalid Index

🎀 Set Appearance (since 1.14) 🎀

Command Code: 0x0043
Controller Index: <controller id>
Command Parameters:
- Appearance (2 Octets)
Return Parameters: none — it’s a one-way vibe, bestie

This command is used to set the appearance value of a controller.

This command can be used when the controller is not powered and all settings will be programmed once powered. very “get ready with me” of the controller ✨

The value of appearance will be remembered when switching the controller off and back on again. So the appearance only have to be set once when a new controller is found and will stay until removed. set it and forget it, no cap 💅

This command generates a Command Complete event on success or a Command Status event on failure.

This command is only available for LE capable controllers.

It will return Not Supported otherwise.

Possible errors:

Not Supported
Invalid Parameters
Invalid Index

🦋 Get PHY Configuration (since 1.15) 🦋

Command Code: 0x0044
Controller Index: <controller id>
Command Parameters: none — just vibes and a controller id
Return Parameters:
- Supported_PHYs (4 Octet)
- Configurable_PHYs (4 Octets)
- Selected_PHYs (4 Octet)

The PHYs parameters are a bitmask with currently the following available bits:

Bit 0 — BR 1M 1-Slot
Bit 1 — BR 1M 3-Slot
Bit 2 — BR 1M 5-Slot
Bit 3 — EDR 2M 1-Slot
Bit 4 — EDR 2M 3-Slot
Bit 5 — EDR 2M 5-Slot
Bit 6 — ERDR 3M 1-Slot
Bit 7 — EDR 3M 3-Slot
Bit 8 — EDR 3M 5-Slot
Bit 9 — LE 1M TX
Bit 10 — LE 1M RX
Bit 11 — LE 2M TX
Bit 12 — LE 2M RX
Bit 13 — LE Coded TX
Bit 14 — LE Coded RX

If BR/EDR is supported, then BR 1M 1-Slot is supported by default and can also not be deselected. If LE is supported, then LE 1M TX and LE 1M RX are supported by default. the defaults are defaulting 👑

Disabling BR/EDR completely or respectively LE has no impact on the PHY configuration. It is remembered over power cycles. it’s got memory, bestie 💜

This command generates a Command Complete event on success or a Command Status event on failure. ✨

Possible errors:

Invalid Parameters
Invalid Index

🦋 Set PHY Configuration (since 1.15)

Command Code

0x0045

Controller Index <controller id>

Command Parameters

Selected_PHYs (4 Octet)

Return Parameters

Okay so this one is literally how you set the default PHY for the controller 💅

It gets stored and then used for all the subsequent scanning and connection initiation. Like, every time, bestie. No cap.

You can grab the list of supported PHYs from the Get PHY Configuration command. Heads up though — if you select unsupported PHYs, or deselect default PHYs, you get an Invalid Parameter error. So yeah, don't do that 🙈

You can call this at literally any point to change the Selected PHYs, which is lowkey iconic.

For the PHYs parameter, go look at the Get PHY Configuration command — it's all there.

This command generates a Command Complete event on success or a Command Status event on failure.

Possible errors:

Invalid Parameters
Invalid Index

🔑 Load Blocked Keys (since 1.15)

Command Code

0x0046

Controller Index <controller id>

Command Parameters

Key_Count (2 Octets)
...    Key_Type[] (1 Octet)
...    Value[] (16 Octets)
...    ...[]

Return Parameters

This is the one where you feed the kernel a whole list of keys that are known to be vulnerable 💀

And the way this works is: if the pairing procedure ever produces any of these keys, they get silently dropped and any attempt to enable encryption is rejected. Periodt. No key for you.

Currently defined Key_Type values are:

0x00 — Link Key (BR/EDR)
0x01 — Long Term Key (LE)
0x02 — Identity Resolving Key (LE)

You can use this command when the controller is not powered — very chill of it tbh.

This command generates a Command Complete event on success or a Command Status event on failure.

Possible errors:

Invalid Parameters
Invalid Index

🎧 Set Wideband Speech (since 1.16)

Command Code

0x0047

Controller Index <controller id>

Command Parameters

Wideband_Speech (1 Octet)

Return Parameters

Current_Settings (4 Octets)

Enable/disable Wideband Speech support for a controller, bestie 🫶

The allowed values for the Wideband_Speech command parameter are 0x00 and 0x01. Any other value at all? Invalid Parameters. That's it, that's the vibe check.

0x00 disables Wideband Speech
0x01 enables Wideband Speech

This command is only available for BR/EDR capable controllers and requires controller specific support — so like, not everyone gets an invite to this party 😭

It can be used when the controller is not powered, and all settings will be programmed once powered. Slay.

And in case the controller doesn't support Wideband Speech, the command will fail regardless with a Not Supported error. Rude but fair.

This command generates a Command Complete event on success or a Command Status event on failure.

Possible errors:

Busy
Not Supported
Invalid Parameters
Invalid Index

👑 Read Controller Capabilities (since 1.17)

Command Code

0x0048

Controller Index <controller id>

Command Parameters

Return Parameters

Capabilities_Data_Length (2 Octets)
...    Capabilities_Data[] (0-65535 Octets)

Use this to retrieve the supported capabilities of the controller or the host stack. Obsessed with the flexibility ngl.

So Capabilities_Data_Length and Capabilities_Data together give you a list of security settings, features and information. It uses the same format as EIR_Data, but with the namespace defined right here 👇

0x01 — Flags
0x02 — Max Encryption Key Size (BR/EDR)
0x03 — Max Encryption Key Size (LE)
0x04 — Supported Tx Power (LE)

Flags (data type 0x01)

Bit 0 — Remote public key validation (BR/EDR)
Bit 1 — Remote public key validation (LE)
Bit 2 — Encryption key size enforcement (BR/EDR)
Bit 3 — Encryption key size enforcement (LE)

Max Encryption Key Size (data types 0x02 and 0x03)

When the field is present, then it provides a 1 Octet value indicating the max encryption key size. If the field is not present, then it is unknown what the max encryption key size of the controller or host is in use. Mysterious. We love a little mystery 💜

Supported LE Tx Power (data type 0x04)

When present, this 2-octet field provides the min and max LE Tx power supported by the controller, respectively, as reported by the LE Read Transmit Power HCI command. And if this field isn't available? That indicates the LE Read Transmit Power HCI command was not available. Fair enough honestly.

This command generates a Command Complete event on success or a Command Status event on failure.

Possible errors:

Invalid Parameters
Invalid Index

🧚 Read Experimental Features Information (since 1.17)

Command Code

0x0049

Controller Index <controller id> or <non-controller>

Command Parameters

Return Parameters

Feature_Count (2 Octets)
...    UUID[] (16 Octets)
...    Flags[] (4 Octets)
...    ...[]

This command retrieves the supported experimental features from the host stack 🍓

Okay so the UUID values are not defined here — they can change over time and are on purpose not stable. Features that mature will be removed at some point. And mapping a feature UUID to the actual functionality of that feature is out of scope here, so don't come for me asking 🌸

The following bits are defined for the Flags parameter:

Bit 0 — Feature active
Bit 1 — Causes change in supported settings

This command generates a Command Complete event on success or a Command Status event on failure.

Possible errors:

Invalid Parameters
Invalid Index

💫 Set Experimental Feature (since 1.17)

Command Code

0x004a

Controller Index <controller id> or <non-controller>

Command Parameters

UUID (16 Octets)
...    Action (1 Octet)

Return Parameters

UUID (16 Octets)
...    Flags (4 Octets)

This one changes the setting of an experimental feature of the host stack. Main character energy ✨

The UUID value must be a supported value returned from the Read Experimental Features Information command. No improvising, bestie.

The Action parameter is UUID specific, but in most cases it'll just be a simple on/off toggle with these values:

0x00 — Disable feature
0x01 — Enable feature

Whether you can use the command while the controller is powered up depends on the feature — check the Flags parameter of the Read Experimental Features Information command for details on whether the controller has to be powered down first. Read the fine print, it's literally there for you 🎀

okay so the Flags return parameter has these two bits, and they're literally the whole vibe check:

Bit 0 — Feature active
Bit 1 — Supported settings changed

when a feature causes the change of supported settings, then it's a good idea to re-read the controller information. like, actually do it bestie, it's giving responsible main character energy 💅

when the UUID parameter is an empty UUID (16 x 0x00), then all experimental features will be deactivated. poof. gone. deactivated. no cap.

this command generates a Command Complete event on success or a Command Status event on failure.

Possible errors:

Invalid Parameters
Not Powered
Invalid Index

🌸 Read Default System Configuration (since 1.18) 🌸

Command Code — 0x004b
Controller Index — <controller id>
Command Parameters — blank in the original, nothing listed here 🫶
Return Parameters — okay so it returns this little stack:

Parameter_Type[] (2 Octet)
...    Value_Length[] (1 Octet)
...    Value (0-255[] Octets)
...    ...[]

this command is used to read a list of default controller parameters. yes pls, give us the defaults.

currently defined Parameter_Type values are:

0x0000 — BR/EDR Page Scan Type
0x0001 — BR/EDR Page Scan Interval
0x0002 — BR/EDR Page Scan Window
0x0003 — BR/EDR Inquiry Scan Type
0x0004 — BR/EDR Inquiry Scan Interval
0x0005 — BR/EDR Inquiry Scan Window
0x0006 — BR/EDR Link Supervision Timeout
0x0007 — BR/EDR Page Timeout
0x0008 — BR/EDR Min Sniff Interval
0x0009 — BR/EDR Max Sniff Interval
0x000a — LE Advertisement Min Interval
0x000b — LE Advertisement Max Interval
0x000c — LE Multi Advertisement Rotation Interval
0x000d — LE Scanning Interval for auto connect
0x000e — LE Scanning Window for auto connect
0x000f — LE Scanning Interval for wake scenarios
0x0010 — LE Scanning Window for wake scenarios
0x0011 — LE Scanning Interval for discovery
0x0012 — LE Scanning Window for discovery
0x0013 — LE Scanning Interval for adv monitoring
0x0014 — LE Scanning Window for adv monitoring
0x0015 — LE Scanning Interval for connect
0x0016 — LE Scanning Window for connect
0x0017 — LE Min Connection Interval
0x0018 — LE Max Connection Interval
0x0019 — LE Connection Latency
0x001a — LE Connection Supervision Timeout
0x001b — LE Autoconnect Timeout
0x001d — LE Allow List Scanning Duration for adv monitoring
0x001e — LE No Filter Scanning Duration for adv monitoring
0x001f — LE Enable Interleave Scan for adv monitoring
0x0020 — BR/EDR Connection Idle Timeout

this command can be used at any time and will return a list of supported default parameters as well as their current value. so like, whenever, bestie. it's flexible.

this command generates a Command Complete event on success or a Command Status event on failure.

Possible errors:

Invalid Parameters
Invalid Index

🎀 Set Default System Configuration (since 1.18) 🎀

Command Code — 0x004c
Controller Index — <controller id>
Command Parameters — here's the stack:

Parameter_Type[] (2 Octet)
...    Value_Length[] (1 Octet)
...    Value[] (0-255 Octets)
...    ...[]

Return Parameters — blank, nothing listed 🙈

this command is used to set a list of default controller parameters. it's the "make it default" button, basically.

see Read Default System Configuration command for list of supported Parameter_Type values. iykyk, go look at the icon above ⭐

this command can be used when the controller is not powered and all supported parameters will be programmed once powered. so you can line it all up before the glow-up.

when providing unsupported values or invalid values, no parameter value will be changed and all values discarded. like, the whole batch gets yeeted. zero changes. be careful, fr fr.

this command generates a Command Complete event on success or a Command Status event on failure.

Possible errors:

Rejected
Not Supported
Invalid Parameters
Invalid Index

🦋 Read Default Runtime Configuration (since 1.18) 🦋

Command Code — 0x004d
Controller Index — <controller id>
Command Parameters — blank, nothing here bestie 💀
Return Parameters — this stack right here:

Parameter_Type[] (2 Octet)
...    Value_Length[] (1 Octet)
...    Value[] (0-255 Octets)

This command is used to read a list of default runtime parameters. ✨

Currently no Parameter_Type values are defined, so an empty list gets returned — yes bestie, it's giving "I asked for the menu and got a blank page" 😭 but that's literally the spec.

This command can be used at any time and will return a list of supported default parameters plus their current value. 🫶

It generates a Command Complete event on success, or a Command Status event on failure.

Possible errors:

Invalid Parameters
Invalid Index

Set Default Runtime Configuration (since 1.18) 🎀

Command Code

0x004e

Controller Index

<controller id>

Command Parameters

Parameter_Type[] (2 Octet)
...    Value_Length[] (1 Octet)
...    Value[] (0-255 Octets)
...    ...[]

Return Parameters

Nothing listed here — the return parameters section is empty in the original. Not me double-checking twice. 🙈

This command is used to set a list of default runtime parameters. 💅

Want the list of supported Parameter_Type values? Peep the Read Default Runtime Configuration command, bestie — that's where they live.

This command can be used at any time and will change the runtime default. BUT — key caveat, do not skip this — changes will not apply to existing connections or currently active operations. The way that's so important, fr fr. 🔥

When you provide unsupported values or invalid values, no parameter value will be changed and all values get discarded. It's an all-or-nothing vibe check, no partial slay. 💀

This command generates a Command Complete event on success or a Command Status event on failure.

Possible errors:

Rejected
Not Supported
Invalid Parameters
Invalid Index

Get Device Flags (since 1.18) 🦋

Command Code

0x004f

Controller Index

<controller id>

Command Parameters

Address (6 Octets)
...    Address_Type (1 Octet)

Return Parameters

Address (6 Octets)
...    Address_Type (1 Octet)
...    Supported_Flags (4 Octets)
...    Current_Flags (4 Octets)

This command is used to retrieve additional flags and settings for devices that are added via the Add Device command. 👑

Possible values for the Address_Type parameter:

0x00 — BR/EDR
0x01 — LE Public
0x02 — LE Random

The Flags parameters are a bitmask with currently the following available bits:

Bit 0 — Remote Wakeup enabled
Bit 1 — Device Privacy Mode enabled
Bit 2 — Address Resolution enabled
Bit 3 — PAST enabled

This command generates a Command Complete event on success or a Command Status event on failure.

Possible errors:

Invalid Parameters
Invalid Index

Set Device Flags (since 1.18) 🌸

Command Code

0x0050

Controller Index

<controller id>

Command Parameters

Address (6 Octets)
...    Address_Type (1 Octet)
...    Current_Flags (4 Octets)

Return Parameters

Address (6 Octets)
...    Address_Type (1 Octet)

This command is used to configure additional flags and settings for devices that are added via the Add Device command. ✨

Possible values for the Address_Type parameter:

0x00 — BR/EDR
0x01 — LE Public
0x02 — LE Random

The list of supported Flags can be retrieved via the Get Device Flags or Device Flags Changed command. Selecting unsupported flags will result in an Invalid Parameter error.

Refer to the Get Device Flags command for a detailed description of the Flags parameters. 👈 iykyk

The way this one's flexible: this command can be used when the controller is not powered, and all settings will be programmed once powered. Main character energy honestly. 🔥

This command generates a Command Complete event on success or a Command Status event on failure.

Possible errors:

Invalid Parameters
Invalid Index

Read Advertisement Monitor Features (since 1.18) 🧚

Command Code

0x0051

Controller Index

<controller id>

Command Parameters

Empty — literally nothing to pass in here. 🫶

Return Parameters

Supported_Features (4 Octets)
...    Enabled_Features (4 Octets)
...    Max_Num_Handles (2 Octets)
...    Max_Num_Patterns (1 Octet)
...    Num_Handles (2 Octets)
...    Handle[] (2 Octets)
...    ...[]

This command is used to read the advertisement monitor features supported by the controller and stack. Supported_Features lists everything related that the controller supports, while Enabled_Features lists the ones the kernel is currently actually using. 💅

Supported_Features and Enabled_Features are bitmasks with currently the following available bits:

Bit 0 — Advertisement content monitoring based on patterns with logic OR.

Max_Num_Handles indicates the maximum number of supported advertisement monitors. Heads up: the actual number of supported ones might be less, depending on the limitation of the controller. 🙈

Max_Num_Pattern indicates the maximum number of supported patterns in an advertisement patterns monitor. Same heads up: the actual number of supported ones might be less, depending on the limitation of the controller.

Num_Handles indicates the number of added advertisement monitors, and it is followed by a list of handles. 📋

This command can be used when the controller is not powered.

Add Advertisement Patterns Monitor (since 1.18) 🍓

Command Code

0x0052

Controller Index

<controller id>

Command Parameters

Pattern_Count (1 Octet)
...    AD_Type[] (1 Octet)
...    Offset[] (1 Octet)
...    Length[] (1 Octet)
...    Value[] (31 Octets)
...    ...[]

Return Parameters

Monitor_Handle (2 Octets)

This command is used to add an advertisement monitor whose filtering conditions are patterns. The kernel will trigger scanning if there is at least one monitor added. If the controller supports advertisement filtering, the kernel would offload the content filtering to the controller in order to reduce power consumption; otherwise the kernel ignores the content of the monitor. 👀

Real talk: if there are more than one patterns, OR logic would be applied among patterns during filtering. In other words, any advertisement matching at least one pattern in a given monitor would be considered as a match. Not all of them — just one. Slay. ⭐

A pattern contains the following fields:

AD_Data_Type — Advertising Data Type. The possible values are defined in Core Specification Supplement.
Offset — The start index where pattern matching shall be performed within the AD data.
Length — The length of the pattern value in bytes.
Value — The value of the pattern in bytes.

Here's an example of a pattern, bestie — look at it, it's iconic:

{
        0x16, // Service Data - 16-bit UUID
        0x02, // Skip the UUID part.
        0x04, // Length of the value
        {0x11, 0x22, 0x33, 0x44},
}

This command can be used when the controller is not powered and all settings will be programmed once powered. 💜

Possible errors:

Failed
Busy
No Resources
Invalid Parameters

Remove Advertisement Monitor (since 1.18) 🌈

Command Code

0x0053

Controller Index

<controller id>

Command Parameters

Monitor_Handle (2 Octets)

Return Parameters

Monitor_Handle (2 Octets)

This command is used to remove advertisement monitor(s). The kernel would remove the monitor(s) with Monitor_Handle and update the LE scanning. 🧹✨

Special case, don't miss it: when the Monitor_Handle is set to zero, then all previously added handles will be removed. Zero = yeet everything. 💀

Removing a monitor while it is being added will be ignored. 🙈

This command can be used when the controller is not powered and all settings will be programmed once powered.

Possible errors:

Failed
Busy

Add Extended Advertising Parameters (since 1.19) 👑

Command Code

0x0054

Controller Index

<controller id>

Command Parameters

Instance (1 Octet)
...    Flags (4 Octets)
...    Duration (2 Octets)
...    Timeout (2 Octets)
...    MinInterval (4 Octets)
...    MaxInterval (4 Octets)
...    TxPower (1 Octet)

Return Parameters

Instance (1 Octet)
...    TxPower (1 Octet)
...    MaxAdvDataLen (1 Octet)
...    MaxScanRspLen (1 Octet)

okay so this command is literally the setup era for a Bluetooth Low Energy advertising instance's parameters 💅. It's expected to be followed by an Add Extended Advertising Data command so the instance can be completed and enabled. No cap.

Anything you add with this command will not be visible immediately if advertising is enabled via the Set Advertising command. The usage of the Set Advertising command takes precedence over this command. The instance info is still stored, and it will be advertised once advertising via Set Advertising has been disabled. Iconic, honestly.

The Instance identifier is a value between 1 and the number of supported instances. The value 0 is reserved. 🚫

With the Flags value you control the type of advertising, and these are the defined flags, bestie:

Bit 0 — Switch into Connectable mode
Bit 1 — Advertise as Discoverable
Bit 2 — Advertise as Limited Discoverable
Bit 3 — Add Flags field to Adv_Data
Bit 4 — Add TX Power field to Adv_Data
Bit 5 — Add Appearance field to Scan_Rsp
Bit 6 — Add Local Name in Scan_Rsp
Bit 7 — Secondary Channel with LE 1M
Bit 8 — Secondary Channel with LE 2M
Bit 9 — Secondary Channel with LE Coded
Bit 10 — Indicate tx power can be specified
Bit 11 — Indicate HW supports the advertising offload
Bit 12 — The Duration parameter should be used
Bit 13 — The Timeout parameter should be used
Bit 14 — The Interval parameters should be used
Bit 15 — The Tx Power parameter should be used
Bit 16 — The advertisement will contain a scan response

When the connectable flag is set, then the controller will use undirected connectable advertising. The value of the connectable setting can be overwritten this way. This is useful to switch a controller into connectable mode only for LE operation. This is similar to the mode 0x02 from the Set Advertising command. 🎀

Using the connectable flag is useful for peripheral mode support where BR/EDR (and/or LE) is controlled by Add Device. This allows making the peripheral connectable without having to interfere with the global connectable setting. 🫶

Secondary channel flags can be used to advertise in secondary channel with the corresponding PHYs. These flag bits are mutually exclusive and setting multiple will result in Invalid Parameter error. Choosing either LE 1M or LE 2M will result in using extended advertising on the primary channel with LE 1M and the respectively LE 1M or LE 2M on the secondary channel. Choosing LE Coded will result in using extended advertising on the primary and secondary channels with LE Coded. Choosing none of these flags will result in legacy advertising.

To allow future parameters to be optionally extended in this structure, the flags member has been used to specify which of the structure fields were purposefully set by the caller. Unspecified parameters will be given sensible defaults by the kernel before the advertisement is registered. ✨

The Duration parameter configures the length of an Instance. The value is in seconds. The default is 2 seconds.

If only one advertising Instance has been added, then the Duration value will be ignored. It only applies for the case where multiple Instances are configured. In that case every Instance will be available for the Duration time and after that it switches to the next one. This is a simple round-robin based approach. 🔁

The Timeout parameter configures the life-time of an Instance. In case the value 0 is used it indicates no expiration time. If a timeout value is provided, then the advertising Instance will be automatically removed when the timeout passes. The value for the timeout is in seconds. Powering down a controller will invalidate all advertising Instances and it is not possible to add a new Instance with a timeout when the controller is powered down. 💀

When a Timeout is provided, then the Duration subtracts from the actual Timeout value of that Instance. For example an Instance with Timeout of 5 and Duration of 2 will be scheduled exactly 3 times, twice with 2 seconds and once with one second. Other Instances have no influence on the Timeout.

MinInterval and MaxInterval define the minimum and maximum advertising intervals, with units as number of .625ms advertising slots. The Max interval is expected to be greater than or equal to the Min interval, and both must have values in the range [0x000020, 0xFFFFFF]. If either condition is not met, the registration will fail. ⚠️

The provided Tx Power parameter will only be used if the controller supports it, which can be determined by the presence of the CanSetTxPower member of the Read Advertising Features command.

The acceptable range for requested Tx Power is defined in the spec (Version 5.2 | Vol 4, Part E, page 2585) to be [-127, +20] dBm, and the controller will select a power value up to the requested one. The transmission power selected by the controller is not guaranteed to match the requested one, so the reply will contain the power chosen by the controller. If the requested Tx Power is outside the valid range, the registration will fail. 🔥

When flag bit 16 is enabled, it indicates that the subsequent request to set advertising data will contain a scan response, and that the parameters should set a PDU type that is scannable.

Re-adding an already existing instance (i.e. issuing the Add Extended Advertising Parameters command with an Instance identifier of an existing instance) will update that instance's configuration. In this case where no new instance is added, no Advertising Added event will be generated. However, if the update of the instance fails, the instance will be removed, and an Advertising Removed event will be generated.

The MaxAdvDataLen return parameter indicates how large the data payload can be in the subsequent Add Extended Advertising Data Command, as it accounts for the data required for the selected flags. Similarly, the MaxScanRspLen return parameter indicates how large the scan response can be.

⚠️ LE must already be enabled, and the controller must be powered, otherwise a "rejected" status will be returned.

This command generates a Command Complete event on success or a Command Status event on failure.

Possible errors:

Failed
Rejected
Not Supported
Invalid Parameters
Busy

🌈 Add Extended Advertising Data (since 1.19)

Command Code: 0x0055

Controller Index: <controller id>

okay so the params for this one are giving ✨structured✨, let's go:

Command Parameters
- Instance (1 Octet)
- Advertising Data Length (1 Octet)
- Advertising Data (0-255 Octets)
- Scan Response Length (1 Octet)
- Scan Response (0-255 Octets)
Return Parameters
- Instance (1 Octet)

So the Add Extended Advertising Data command is literally just here to update the advertising data of an advertising instance the kernel already knows about 🫶. Bestie, it expects to be called after an Add Extended Advertising Parameters command — that's the whole registration process, no skipping steps 💅.

If extended advertising is available, this call kicks off HCI commands to set the instance's advertising data, set the scan response data, and then enable the instance. Iconic, efficient. But if extended advertising is not available, the advertising instance structure maintained in kernel just gets its advertising data and scan response updated, and the instance is either scheduled immediately or left chillin' in the queue for later advertisement as part of round-robin advertisement rotation in software. Same vibes, software mode 🌈.

Now the ✨conditional✨ part, pay attention bestie:

If Scan_Rsp_Len is zero and the flags defined in Add Extended Advertising Parameters command do not have the connectable flag set and the global connectable setting is off — then non-connectable advertising is used.
If Scan_Rsp_Len is larger than zero and the connectable flag is not set and the global advertising is off — then scannable advertising is used.

This small difference is supported to provide less air traffic for devices implementing the broadcaster role. Lowkey thoughtful of them ngl 🦋.

If the Instance you provided doesn't match a known instance, or if the provided advertising data or scan response are in an unrecognized format, an "Invalid Parameters" status will be returned 😭.

If a "Set LE" or Advertising command is still in progress, you get a "Busy" status back. Wait your turn, main character 💀.

If the controller is not powered, a "rejected" status will be returned. Plug it in bestie 🔌.

This command generates a Command Complete event on success, or a Command Status event on failure. Periodt.

Possible errors: Failed, Rejected, Invalid Parameters, Busy

🎀 Add Advertisement Patterns Monitor With RSSI Threshold (since 1.20) 🎀

Command Code — 0x0056
Controller Index — <controller id>
Command Parameters
- High_Threshold (1 Octet)
- High_Threshold_Timer (2 Octets)
- Low_Threshold (1 Octet)
- Low_Threshold_Timer (2 Octets)
- Sampling_Period (1 Octet)
- Pattern_Count (1 Octet)
- AD_Type[] (1 Octet)
- Offset[] (1 Octet)
- Length[] (1 Octet)
- Value[] (31 Octets)
- ...[]
Return Parameters
- Monitor_Handle (2 Octets)

This command is essentially the same as the Add Advertisement Patterns Monitor Command (0x0052), except it comes with extra RSSI parameters. It's the same fit, just with accessories 💅. So if the kernel supports advertisement filtering, the advertisement data gets filtered in accordance with the set RSSI parameters. Otherwise, it behaves exactly the same as the Add Advertisement Patterns Monitor Command. No notes.

Devices are considered "in-range" if the RSSI of the received adv packets are greater than High_Threshold dBm for High_Threshold_Timer seconds. Similarly, devices are considered lost if no received adv have RSSI greater than Low_Threshold dBm for Low_Threshold_Timer seconds. And only adv packets of an "in-range" device get propagated. Gatekeeping, but make it bluetooth 💀✨.

The meaning of Sampling_Period is as follows:

0x00 — All adv packets from "in-range" devices would be propagated. Everything, all of it, no filter 🔥
0xFF — Only the first adv data of "in-range" devices would be propagated. If the device becomes lost, then the first data when it is found again will also be propagated. Reunited and it feels so good 😭🫶
other — Advertisement data would be grouped into 100ms * N time period. Data in the same group will only be reported once, with the RSSI value being averaged out. Math girlies rise 🌸

Possible errors: Failed, Busy, No Resources, Invalid Parameters

🧚 Set Mesh Receiver (since 1.21) 🧚

Command Code — 0x0057
Controller Index — <controller id>
Command Parameters
- Enable (1 Octets)
- Window (2 Octets)
- Period (2 Octets)
- Num AD Types (1 Octets)
- AD Types[]

This command Enables or Disables Mesh Receiving. When enabled, passive scanning remains enabled for this controller. It's giving "on and stays on" 👑

The Window/Period values are used to set the Scan Parameters when no other scanning is being done. Considerate fr fr.

Num AD Types and AD Types parameters filter Advertising and Scan responses by AD type. Responses that don't contain at least one of the requested AD types will be ignored. Otherwise they'll be delivered with the Mesh Device Found event. If you're not on the list, you're not getting in 🎀.

Possible errors: Failed, No Resources, Invalid Parameters

⭐ Read Mesh Features (since 1.21) ⭐

Command Code — 0x0058
Controller Index — <controller id>
Command Parameters — (none, she takes nothing, she gives everything)
Return Parameters
- Index (2 Octets)
- Max Handles (1 Octets)
- Used Handles (1 Octets)
- Handle[]

This command is used to both verify that Outbound Mesh packet support is enabled, and to indicate the number of packets that can and are simultaneously queued. A vibe check for your mesh stack 💖.

Index identifies the HCI Controller that this information is valid for.
Max Handles indicates the maximum number of packets that may be queued.
Used Handles indicates the number of packets awaiting transmission.
Handle is an array of the currently outstanding packets.

Possible errors: Failed, No Resources, Invalid Parameters

💜 Transmit Mesh Packet (since 1.21) 💜

Command Code — 0x0059
Controller Index — <controller id>
Command Parameters
- Addr (6 octets)
- Addr Type (1 Octets)
- Instant (8 Octets)
- Delay (2 Octets)
- Count (1 Octets)
- Data Length (1 Octets)
- Data[] (variable)
Return Parameters
- Handle (1 Octets)

This command sends a Mesh Packet as a NONCONN LE Advertisement. Say it with me: NONCONN. No connection needed, she's independent 🦋.

The Addr + Addr Type parameters specify the address to use in the outbound advertising packet. If BD_ADDR_ANY and LE_RANDOM is set, the kernel will create a single use non-resolvable address. One-time address, very mysterious of her 🙈.

The Instant parameter is used in combination with the Delay parameter, to finely time the sending of the Advertising packet. It should be set to the Instant value tag of a received incoming Mesh Device Found Event. It's only useful in POLL-RESPONSE situations where a response must be sent within a negotiated time window. And heads up — the value of the Instant parameter should not be interpreted by the host, and only has meaning to the controller. Hands off, that one's not yours 💅.

The Delay parameter, if 0x0000, will cause the packet to be sent at the earliest opportunity. If non-Zero, and the controller supports delayed delivery, the Instant and Delay parameters will be used to delay the outbound packet. While the Instant is not defined, the Delay is specified in milliseconds. Timing is everything bestie ⏰.

The Count parameter must be sent to a non-Zero value indicating the number of times this packet will be sent before transmission completes. If the Delay parameter is non-Zero, then Count must be 1 only. Not negotiable, that's the rule 🎀.

The Data parameter is an octet array of the AD Type and Mesh Packet.

This command will return immediately, and if it succeeds, will generate a Mesh Packet Transmission Complete event when after the packet has been sent. Async queen 👑.

Possible errors: Failed, Busy, No Resources, Invalid Parameters

🌸 Cancel Transmit Mesh Packet (since 1.21) 🌸

Command Code — 0x005A
Controller Index — <controller id>
Command Parameters
- Handle (1 Octets)

This command may be used to cancel an outbound transmission request. The audacity, the power 💀.

The Handle parameter is the returned handle from a successful Transmit Mesh Packet request. If Zero is specified as the handle, all outstanding send requests are canceled. Zero means everybody out 🔥.

For each mesh packet canceled, the Mesh Packet Transmission Complete event will be generated, regardless of whether the packet was sent successfully. You'll hear about it either way, bestie 😭.

Possible errors: Failed, Invalid Parameters

🌈 Send HCI command and wait for event 🌈

Command Code — 0x005B
Controller Index — <controller id>
Command Parameters
- Opcode (2 Octets)
- Event (1 Octet)
- Timeout (1 Octet)
- Parameter Length (2 Octets)
- Parameter[] (variable)
Return Parameters
- Response (1-variable Octets)

This command may be used to send a HCI command and wait for an (optional) event. Errand girl energy, but make it useful 🫶.

The HCI command is specified by the Opcode, any arbitrary is supported including vendor commands, but contrary to the like of Raw/User channel it is run as an HCI command send by the kernel since it uses its command synchronization, thus it is possible to wait for a specific event as a response. That's the whole flex 💅.

Setting event to 0x00 will cause the command to wait for either HCI Command Status or HCI Command Complete.

Timeout is specified in seconds, setting it to 0 will cause the default timeout to be used. Zero = "you decide," slay.

Possible errors: Failed, Invalid Parameters

✨ Events ✨

Okay bestie, buckle up, here come the events 💖

🎀 Command Complete 🎀

Event Code — 0x0001
Controller Index — <controller id> or <non-controller>
Event Parameters
- Command_Opcode (2 Octets)
- Status (1 Octet)
- Return_Parameters[] (variable)

This event is an indication that a command has completed. The fixed set of parameters includes the opcode to identify the command that completed as well as a status value to indicate success or failure. The rest of the parameters are command specific and documented in the section for each command separately. Go read those, iykyk 📖✨

🦋 Command Status 🦋

Event Code — 0x0002
Controller Index — <controller id> or <non-controller>
Event Parameters
- Command_Opcode (2 Octets)
- Status (1 Octet)

The command status event is used to indicate an early status for a pending command. In the case that the status indicates failure (anything else except success status) this also means that the command has finished executing. Early tea, but make it accurate ☕

💀 Controller Error 💀

Event Code — 0x0003
Controller Index — <controller id>
Event Parameters
- Error_Code (1 Octet)

This event maps straight to the HCI Hardware Error event and is used to indicate something wrong with the controller hardware. Not the vibe. Not the vibe at all 😭

⭐ Index Added ⭐

Event Code — 0x0004
Controller Index — <controller id>
Event Parameters — (none)

This event indicates that a new controller has been added to the system. It's usually followed by a Read Controller Information command. New controller just dropped 👑✨

Once the Read Extended Controller Index List command has been used at least once, the Extended Index Added event gets sent instead of this one. 🫶

💔 Index Removed

Event Code: 0x0005

Controller Index: <controller id>

Event Parameters:

This event is the system saying a controller has been removed from the system. Bye bestie 👋

Once the Read Extended Controller Index List command has been used at least once, the Extended Index Removed event gets sent instead of this one.

⚙️ New Settings

Event Code: 0x0006

Controller Index: <controller id>

Event Parameters:

Current_Settings (4 Octets)

This event means one or more of the settings for a controller has changed. Settings said “new year new me” ✨

🎭 Class Of Device Changed

Event Code: 0x0007

Controller Index: <controller id>

Event Parameters:

Class_Of_Device (3 Octets)

This event indicates that the Class of Device value for the controller has changed. When the controller is powered off, the Class of Device value will always be reported as zero. Noted. 🫡

🏷️ Local Name Changed

Event Code: 0x0008

Controller Index: <controller id>

Event Parameters:

Name (249 Octets)
Short_Name (11 Octets)

This event indicates that the local name of the controller has changed. Name reveal era 💅

🔑 New Link Key

Event Code: 0x0009

Controller Index: <controller id>

Event Parameters:

Store_Hint (1 Octet)
Address (6 Octets)
Address_Type (1 Octet)
Key_Type (1 Octet)
Value (16 Octets)
PIN_Length (1 Octet)

This event indicates that a new link key has been generated for a remote device.

The Store_Hint parameter indicates whether the host is expected to store the key persistently or not (e.g. this would not be set if the authentication requirement was "No Bonding").

Possible values for the Address_Type parameter:

0 — BR/EDR
1 — Reserved (not in use)
2 — Reserved (not in use)

Public and random LE addresses are not valid and will be rejected.

Currently defined Key_Type values are:

0x00 — Combination key
0x01 — Local Unit key
0x02 — Remote Unit key
0x03 — Debug Combination key
0x04 — Unauthenticated Combination key from P-192
0x05 — Authenticated Combination key from P-192
0x06 — Changed Combination key
0x07 — Unauthenticated Combination key from P-256
0x08 — Authenticated Combination key from P-256

Receiving this event indicates that a pairing procedure has been completed. Slay, they’re paired 🎀

🗝️ New Long Term Key

Event Code: 0x000A

Controller Index: <controller id>

Event Parameters:

Store_Hint (1 Octet)
Address (6 Octets)
Address_Type (1 Octet)
Key_Type (1 Octet)
Central (1 Octet)
Encryption Size (1 Octet)
Enc. Diversifier (2 Octets)
Random Number (8 Octets)
Value (16 Octets)

This event indicates that a new long term key has been generated for a remote device.

The Store_Hint parameter indicates whether the host is expected to store the key persistently or not (e.g. this would not be set if the authentication requirement was "No Bonding").

Possible values for the Address_Type parameter:

0 — Reserved (not in use)
1 — LE Public
2 — LE Random

The provided Address and Address_Type are the identity of a device. So either its public address or static random address.

For unresolvable random addresses and resolvable random addresses without identity information and identity resolving key, the Store_Hint will be set to not store the long term key.

Currently defined Key_Type values are:

0x00 — Unauthenticated legacy key
0x01 — Authenticated legacy key
0x02 — Unauthenticated key from P-256
0x03 — Authenticated key from P-256
0x04 — Debug key from P-256

Receiving this event indicates that a pairing procedure has been completed. Another one, iconic 🔥

🔗 Device Connected

Event Code: 0x000B

Controller Index: <controller id>

Event Parameters:

Address (6 Octets)
Address_Type (1 Octet)
Flags (4 Octets)
EIR_Data_Length (2 Octets)
EIR_Data (0-65535 Octets)

This event indicates that a successful baseband connection has been created to the remote device. Connection secured, bestie 🦋

Possible values for the Address_Type parameter:

0 — BR/EDR
1 — LE Public
2 — LE Random

For devices using resolvable random addresses with a known identity resolving key, the Address and Address_Type will contain the identity information.

It is possible that devices get connected via its resolvable random address and after New Identity Resolving Key event start using its identity.

The following bits are defined for the Flags parameter — lowkey a whole little menu of what's going on with the connection:

0 — Reserved (not in use) 💤
1 — Legacy Pairing
2 — Reserved (not in use) 💤
3 — Initiated Connection
4 — Reserved (not in use) 💤

💔 Device Disconnected

Event Code

0x000C

Controller Index

<controller id>

Event Parameters

Address (6 Octets)
Address_Type (1 Octet)
Reason (1 Octet)

This event is basically the breakup text: it indicates that the baseband connection was lost to a remote device. 😭

Possible values for the Address_Type parameter:

0x00 — BR/EDR
0x01 — LE Public
0x02 — LE Random

For devices using resolvable random addresses with a known identity resolving key, the Address and Address_Type will contain the identity information.

Possible values for the Reason parameter:

0x00 — Unspecified
0x01 — Connection timeout
0x02 — Connection terminated by local host
0x03 — Connection terminated by remote host
0x04 — Connection terminated due to authentication failure
0x05 — Connection terminated by local host for suspend

Ok so real talk bestie: the local/remote distinction just determines which side terminated the low-level connection, regardless of the disconnection of the higher-level profiles. 🫶

This can sometimes be misleading and thus must be used with care. For example, some hardware combinations would report a locally initiated disconnection even if the user turned Bluetooth off in the remote side. 💀 So like… don't take it personally, the hardware is just dramatic.

🚫 Connect Failed

Event Code

0x000D

Controller Index

<controller id>

Event Parameters

Address (6 Octets)
Address_Type (1 Octet)
Status (1 Octet)

This event indicates that a connection attempt failed to a remote device. It's giving "left on read" energy ngl. 🙈

Possible values for the Address_Type parameter:

0x00 — BR/EDR
0x01 — LE Public
0x02 — LE Random

For devices using resolvable random addresses with a known identity resolving key, the Address and Address_Type will contain the identity information.

🔑 PIN Code Request

Event Code

0x000E

Controller Index

<controller id>

Event Parameters

Address (6 Octets)
Address_Type (1 Octet)
Secure (1 Octet)

This event is used to request a PIN Code reply from user space. The reply should either be returned using the PIN Code Reply or the PIN Code Negative Reply command. ✨

Possible values for the Address_Type parameter:

0x00 — BR/EDR
0x01 — LE Public
0x02 — LE Random

The Secure parameter:

0x01 — secure PIN code required
0x00 — secure PIN code not required

✅ User Confirmation Request

Event Code

0x000F

Controller Index

<controller id>

Event Parameters

Address (6 Octets)
Address_Type (1 Octet)
Confirm_Hint (1 Octet)
Value (4 Octets)

This event is used to request a user confirmation request from user space.

0x00 — BR/EDR
0x01 — LE Public
0x02 — LE Random

If the Confirm_Hint parameter value is 0x01 this means that a simple "Yes/No" confirmation should be presented to the user instead of a full numerical confirmation (in which case the parameter value will be 0x00). Bestie you gotta actually look at this one, don't just mash yes 👀

User space should respond to this command either using the User Confirmation Reply or the User Confirmation Negative Reply command.

🔢 User Passkey Request

Event Code

0x0010

Controller Index

<controller id>

Event Parameters

Address (6 Octets)
Address_Type (1 Octet)

This event is used to request a passkey from user space. The response to this event should either be the User Passkey Reply command or the User Passkey Negative Reply command. 💅

Possible values for the Address_Type parameter:

0x00 — BR/EDR
0x01 — LE Public
0x02 — LE Random

😬 Authentication Failed

Event Code

0x0011

Controller Index

<controller id>

Event Parameters

Address (6 Octets)
Address_Type (1 Octet)
Status (1 Octet)

This event indicates that there was an authentication failure with a remote device. Not the vibe. 🫠

Possible values for the Address_Type parameter:

0x00 — BR/EDR
0x01 — LE Public
0x02 — LE Random

🦋 Device Found

Event Code

0x0012

Controller Index

<controller id>

Event Parameters

Address (6 Octets)
Address_Type (1 Octet)
RSSI (1 Octet)
Flags (4 Octets)
EIR_Data_Length (2 Octets)
EIR_Data (0-65535 Octets)

This event indicates that a device was found during device discovery. Scavenger hunt era 🔥

Okay so the possible values for the Address_Type parameter are:

0x00 — BR/EDR
0x01 — LE Public
0x02 — LE Random

And these are the bits defined for the Flags parameter, bestie:

Bit 0 — Confirm name
Bit 1 — Legacy Pairing
Bit 2 — Not Connectable
Bit 3 — Reserved (not in use)
Bit 4 — Name Request Failed
Bit 5 — Scan Response

For the RSSI field, a value of 127 means the RSSI is not available. 😭 That can happen with Bluetooth 1.1 and earlier controllers, or with bad radio conditions.

The Confirm name flag means the kernel wants to know whether user space knows the name for this device or not. If this flag is set, user space should respond to it using the Confirm Name command. 💅

The Legacy Pairing flag means Legacy Pairing is likely to happen when pairing with this device. An application could use this info to optimize the pairing process by locally pre-generating a PIN code, which eliminates the risk of local input timeout when pairing. But heads up: there's a risk of false-positives for this flag, so user space should be able to handle getting something else as a PIN Request when pairing. 🫶

The Not Connectable flag means the device will not accept any connections. This can be indicated by Low Energy devices that are in broadcaster role. ✨

The Name Request Failed flag means the name resolving procedure has ended with failure for this device. User space should use this info to figure out when is a good time to retry the name resolving procedure.

Discovering 🔍

Event Code: 0x0013
Controller Index: <controller id>
Event Parameters:
- Address_Type (1 Octet)
- ... — Discovering (1 Octet)

This event means the controller has started discovering devices. This discovering state can come and go multiple times between Start Discovery and Stop Discovery commands. 👀

The Start Service Discovery command will also trigger this event.

The valid values for the Discovering parameter are 0x01 (enabled) and 0x00 (disabled).

Device Blocked 🚫

Event Code: 0x0014
Controller Index: <controller id>
Event Parameters:
- Address (6 Octets)
- ... — Address_Type (1 Octet)

This event means a device has been blocked using the Block Device command.

Possible values for the Address_Type parameter:

0x00 — BR/EDR
0x01 — LE Public
0x02 — LE Random

The event will only be sent to Management sockets other than the one through which the command was sent. No cap. 💀

Device Unblocked 🔓

Event Code: 0x0015
Controller Index: <controller id>
Event Parameters:
- Address (6 Octets)
- ... — Address_Type (1 Octet)

This event means a device has been unblocked using the Unblock Device command.

Possible values for the Address_Type parameter:

0x00 — BR/EDR
0x01 — LE Public
0x02 — LE Random

The event will only be sent to Management sockets other than the one through which the command was sent. 🫶

Device Unpaired 💔

Event Code: 0x0016
Controller Index: <controller id>
Event Parameters:
- Address (6 Octets)
- ... — Address_Type (1 Octet)

This event means a device has been unpaired — like, all its keys have been removed from the kernel — using the Unpair Device command.

Possible values for the Address_Type parameter:

0x00 — BR/EDR
0x01 — LE Public
0x02 — LE Random

For devices using resolvable random addresses with a known identity resolving key, the event parameters will contain the identity. After receiving this event, the device will become essentially private again. 🙈

The event will only be sent to Management sockets other than the one through which the Unpair Device command was sent.

Passkey Notify 🔑

Event Code: 0x0017
Controller Index: <controller id>
Event Parameters:
- Address (6 Octets)
- ... — Address_Type (1 Octet)
- ... — Passkey (4 Octets)
- ... — Entered (1 Octet)

This event is used to request passkey notification to the user. Unlike the other authentication events, it does not need responding to using any Management command. Iconic, honestly. ✨

Possible values for the Address_Type parameter:

0x00 — BR/EDR
0x01 — LE Public
0x02 — LE Random

The Passkey parameter indicates the passkey to be shown to the user, whereas the Entered parameter indicates how many characters the user has entered on the remote side. 💅

New Identity Resolving Key (since 1.5) 🎀

Event Code: 0x0018
Controller Index: <controller id>
Event Parameters:
- Store_Hint (1 Octet)
- ... — Random_Address (6 Octets)
- ... — Address (6 Octets)
- ... — Address_Type (1 Octet)
- ... — Value (16 Octets)

This event means a new identity resolving key has been generated for a remote device.

The Store_Hint parameter indicates whether the host is expected to store the key persistently or not.

The Random_Address provides the resolvable random address that was resolved into an identity. A value of 00:00:00:00:00:00 indicates that the identity resolving key was provided for a public address or static random address.

Once this event has been sent for a resolvable random address, all further events mapping this device will send out using the identity address information.

This event also indicates that now the identity address should be used for commands instead of the resolvable random address. 📌

It is possible that some devices allow discovering via its identity address, but after pairing using resolvable private address only. In such a case Store_Hint will be 0x00 and the Random_Address will indicate 00:00:00:00:00:00. For these devices, the Privacy Characteristic of the remote GATT database should be consulted to decide if the identity resolving key must be stored persistently or not. 🧚

Devices using Set Privacy command with the option 0x02 would be such type of device. 🫶

Possible values for the Address_Type parameter: bestie, here's the vibe check 💅

0 — Reserved (not in use)
1 — LE Public
2 — LE Random

The provided Address and Address_Type are the identity of a device. So either its public address or static random address. iykyk ✨

💖 New Signature Resolving Key (since 1.5) 💖

Event Code: 0x0019
Controller Index: <controller id>
Event Parameters:
- Store_Hint (1 Octet)
- ... Address (6 Octets)
- ... Address_Type (1 Octet)
- ... Type (1 Octet)
- ... Value (16 Octets)

This event indicates that a new signature resolving key has been generated for either the central or peripheral device. slay 🎀

The Store_Hint parameter indicates whether the host is expected to store the key persistently or not.

The Type parameter has the following possible values:

0x00 — Unauthenticated local CSRK
0x01 — Unauthenticated remote CSRK
0x02 — Authenticated local CSRK
0x03 — Authenticated remote CSRK

The local keys are used for signing data to be sent to the remote device, whereas the remote keys are used to verify signatures received from the remote device. that's the whole point, no cap 🦋

The local signature resolving key will be generated with each pairing request. Only after receiving this event with the Type indicating a local key is it possible to use ATT Signed Write procedures. big main character energy 👑

Possible values for the Address_Type parameter:

0x00 — Reserved (not in use)
0x01 — LE Public
0x02 — LE Random

The provided Address and Address_Type are the identity of a device. So either its public address or static random address. periodt 💜

🌸 Device Added (since 1.7) 🌸

Event Code: 0x001a
Controller Index: <controller id>
Event Parameters:
- Address (6 Octets)
- ... Address_Type (1 Octet)
- ... Action (1 Octet)

This event indicates that a device has been added using the Add Device command. okay so we love a fresh device 🫶

Possible values for the Address_Type parameter:

0x00 — BR/EDR
0x01 — LE Public
0x02 — LE Random

The event will only be sent to management sockets other than the one through which the command was sent. not me being nosy on the same socket 💀

🦋 Device Removed (since 1.7) 🦋

Event Code: 0x001b
Controller Index: <controller id>
Event Parameters:
- Address (6 Octets)
- ... Address_Type (1 Octet)

This event indicates that a device has been removed using the Remove Device command. bye bestie 😭

Possible values for the Address_Type parameter:

0x00 — BR/EDR
0x01 — LE Public
0x02 — LE Random

The event will only be sent to management sockets other than the one through which the command was sent. same socket rule, different event, we stay consistent ✨

⭐ New Connection Parameter (since 1.7) ⭐

Event Code: 0x001c
Controller Index: <controller id>
Event Parameters:
- Store_Hint (1 Octet)
- ... Address (6 Octets)
- ... Address_Type (1 Octet)
- ... Min_Connection_Interval (2 Octets)
- ... Max_Connection_Interval (2 Octets)
- ... Connection_Latency (2 Octets)
- ... Supervision_Timeout (2 Octets)

This event indicates a new set of connection parameters from a peripheral device. the peripheral said "new parameters, who dis" 💅

The Store_Hint parameter indicates whether the host is expected to store this information persistently or not.

Possible values for the Address_Type parameter:

0x00 — Reserved (not in use)
0x01 — LE Public
0x02 — LE Random

The Min_Connection_Interval, Max_Connection_Interval, Connection_Latency and Supervision_Timeout parameters are encoded as described in Core 4.1 spec, Vol 2, 7.7.65.3. go read the spec, bestie, it's giving required reading 📚

🎀 Unconfigured Index Added (since 1.7) 🎀

Event Code: 0x001d
Controller Index: <controller id>
Event Parameters:

This event indicates that a new unconfigured controller has been added to the system. It is usually followed by a Read Controller Configuration Information command. new controller just dropped 🔥

Only when a controller requires further configuration, it will be announced with this event. If it supports configuration, but does not require it, then an Index Added event will be used. lowkey a whole distinction 🌈

Once the Read Extended Controller Index List command has been used at least once, the Extended Index Added event will be send instead of this one. yes, "send", that's what it says 🙈

💜 Unconfigured Index Removed (since 1.7) 💜

Event Code: 0x001e
Controller Index: <controller id>
Event Parameters:

This event indicates that an unconfigured controller has been removed from the system. unconfigured controller said peace out 🦋

Once the Read Extended Controller Index List command has been used at least once, the Extended Index Removed event will be send instead of this one. same rule, different removal event 💅

✨ New Configuration Options (since 1.7) ✨

Event Code: 0x001f
Controller Index: <controller id>
Event Parameters:
- Missing_Options (4 Octets)

This event indicates that one or more of the options for the controller configuration has changed. configuration said "actually, new options" 🫶

👑 Extended Index Added (since 1.9) 👑

Event Code: 0x0020
Controller Index: <controller id>
Event Parameters:
- Controller_Type (1 Octet)
- ... Controller_Bus (1 Octet)

This event indicates that a new controller index has been added to the system. extended index, extra sparkle ⭐

This event will only be used after Read Extended Controller Index List has been used at least once. If it has not been used, then Index Added and Unconfigured Index Added are sent instead. read the list first, bestie, it's literally the rule 💀

🌈 Extended Index Removed (since 1.9) 🌈

Event Code: 0x0021
Controller Index: <controller id>
Event Parameters:
- Controller_Type (1 Octet)
- ... Controller_Bus (1 Octet)

This event indicates that an existing controller index has been removed from the system. existing controller index left the group chat 😭

This event will only be used after Read Extended Controller Index List has been used at least once. If it has not been used, then Index Removed and Unconfigured Index Removed are sent instead. same read-the-list prerequisite, no skips 💜

🦋 Local Out Of Band Extended Data Updated (since 1.9) 🦋

Event Code: 0x0022
Controller Index: <controller id>
Event Parameters:
- Address_Type (1 Octet)
- ... EIR_Data_Length (2 Octets)
- ... EIR_Data (0-65535 Octets)

This event is used when the Read Local Out Of Band Extended Data command has been used and some other user requested a new set of local out-of-band data. This allows for the original caller to adjust the data. teamwork makes the out-of-band dream work 🫶

Possible values for the Address_Type parameter are a bit-wise or of the following bits, bestie:

Bit 0 — BR/EDR
Bit 1 — LE Public
Bit 2 — LE Random

By combining these, e.g. the following values are possible:

0x01 — BR/EDR
0x06 — LE (public & random)
0x07 — Reserved (not in use)

The value for EIR_Data_Length and content for EIR_Data is the same as described in Read Local Out Of Band Extended Data command.

When LE Privacy is used and LE Secure Connections out-of-band data has been requested, then this event will be emitted every time the Resolvable Private Address (RPA) gets changed. The new RPA will be included in the EIR_Data.

The event will only be sent to management sockets other than the one through which the command was sent. It will additionally also only be sent to sockets that have used the command at least once.

🎀 Advertising Added (since 1.9)

Event Code — 0x0023
Controller Index — <controller id>
Event Parameters — Instance (1 Octet)

This event indicates that an advertising instance has been added using the Add Advertising command.

The event will only be sent to management sockets other than the one through which the command was sent.

🦋 Advertising Removed (since 1.9)

Event Code — 0x0024
Controller Index — <controller id>
Event Parameters — Instance (1 Octet)

This event indicates that an advertising instance has been removed using the Remove Advertising command.

The event will only be sent to management sockets other than the one through which the command was sent.

✨ Extended Controller Information Changed (since 1.14)

Event Code — 0x0025
Controller Index — <controller id>
Event Parameters:
- EIR_Data_Length (2 Octets)
- ...
- EIR_Data (0-65535 Octets)

This event indicates that controller information has been updated and new values are used. This includes the local name, class of device, device id and LE address information.

This event will only be used after Read Extended Controller Information command has been used at least once. If it has not been used the legacy events are used.

The event will only be sent to management sockets other than the one through which the change was triggered.

💜 PHY Configuration Changed (since 1.14)

Event Code — 0x0026
Controller Index — <controller id>
Event Parameters — Selected_PHYs (4 Octets)

This event indicates that default PHYs have been updated.

This event will only be used after Set PHY Configuration command has been used at least once.

The event will only be sent to management sockets other than the one through which the change was triggered.

Refer Get PHY Configuration command for PHYs parameter.

🌸 Experimental Feature Changed (since 1.17)

Event Code — 0x0027
Controller Index — <controller id>
Event Parameters:
- UUID (16 Octets)
- ...
- Flags (4 Octets)

This event indicates that the status of an experimental feature has been changed.

The event will only be sent to management sockets other than the one through which the change was triggered.

Refer to Set Experimental Feature command for the Flags parameter.

🍓 Default System Configuration Changed (since 1.18)

Event Code — 0x0028
Controller Index — <controller id>
Event Parameters:
- Parameter_Type[] (2 Octet)
- ...
- Value_Length[] (1 Octet)
- ...
- Value[] (0-255 Octets)

This event indicates the change of default system parameter values.

The event will only be sent to management sockets other than the one through which the change was triggered. In addition it will only be sent to sockets that have issued the Read Default System Configuration command.

Refer to Read Default System configuration command for the supported Parameter_Type values.

🌈 Default Runtime Configuration Changed (since 1.18)

Event Code — 0x0029
Controller Index — <controller id>
Event Parameters:
- Parameter_Type[] (2 Octet)
- ...
- Value_Length[] (1 Octet)
- ...
- Value[] (0-255 Octets)

This event indicates the change of default runtime parameter values.

Refer to Read Default Runtime configuration command for the supported Parameter_Type values.

👑 Device Flags Changed (since 1.18)

Event Code — 0x002a
Controller Index — <controller id>
Event Parameters:
- Address (6 Octets)
- ...
- Address_Type (1 Octet)
- ...
- Supported_Flags (4 Octets)
- ...
- Current_Flags (4 Octets)

This event indicates that the device flags have been changed via the Set Device Flags command or that a new device has been added via the Add Device command. In the latter case it is sent right after the Device Added event.

Possible values for the Address_Type parameter:

0x00 — BR/EDR
0x01 — LE Public
0x02 — LE Random

The event will only be sent to management sockets other than the one through which the command was sent.

In case this event is triggered by Add Device then it is sent to all management sockets.

🧚 Advertisement Monitor Added (since 1.18)

Event Code — 0x002b
Controller Index — <controller id>
Event Parameters — Monitor_Handle (2 Octets)

This event indicates that an advertisement monitor has been added using the Add Advertisement Patterns Monitor command.

The event will only be sent to management sockets other than the one through which the command was sent.

🫶 Advertisement Monitor Removed (since 1.18)

Event Code — 0x002c
Controller Index — <controller id>
Event Parameters — Monitor_Handle (2 Octets)

This event indicates that an advertisement monitor has been removed using the Remove Advertisement Monitor command.

The event will only be sent to management sockets other than the one through which the command was sent.

💅 Controller Suspend (since 1.18)

Event Code — 0x002d
Controller Index — <controller_id>
Event Parameters — Suspend_State (1 octet)

This event indicates that the controller is suspended for host suspend.

Possible values for the Suspend_State parameter:

0x00 — Running (not disconnected)
0x01 — Disconnected and not scanning
0x02 — Page scanning and/or passive scanning.

The value 0x00 is used for the running state and may be sent if the controller could not be configured to suspend properly.

This event will be sent to all management sockets.

💖 Controller Resume (since 1.18)

Event Code — 0x002e
Controller Index — <controller_id>
Event Parameters:
- Wake_Reason (1 octet)
- ...
- Address (6 octets)
- ...
- Address_Type (1 octet)

This event indicates that the controller has resumed from suspend.

Possible values for the Wake_Reason parameter:

0x00 — Resume from non-Bluetooth wake source
0x01 — Wake due to unexpected event
0x02 — Remote wake due to peer device connection

Okay so rn the expectation is literally just that peer reconnections should wake us out of the suspended state — that's it, that's the whole vibe. Any other event that happened while the system should have been suspended gets logged as wake due to unexpected event. 💀

If Wake_Reason is Remote wake due to connection, then the address of the peer device that caused the whole situation gets shared in Address and Address_Type. Otherwise? Both Address and Address_Type are zero. Simple as. ✨

This event will be sent to all management sockets.

🦋 Advertisement Monitor Device Found (since 1.18) 🦋

Event Code

0x002f

Controller Index

<controller_id>

Event Parameters

Monitor_Handle (2 Octets)
... Address (6 Octets)
... Address_Type (1 Octet)
... RSSI (1 Octet)
... Flags (4 Octets)
... AD_Data_Length (2 Octets)
... AD_Data (0-65535 Octets)

This event is basically the controller going "bestie I found one 👀" — it means the controller has started tracking a device matching an Advertisement Monitor with handle Monitor_Handle.

So Monitor_Handle 0 is the special case, and it means two possible things: either we're not active scanning and this is just a subsequent advertisement report for an already-matched Advertisement Monitor, or the controller offloading support isn't available at all, so we gotta report every single advertisement for software based filtering. Lowkey both at once, iykyk. 🙈

The address of the device being tracked gets shared in Address and Address_Type.

Possible values for the Address_Type parameter:

0x00 — BR/EDR
0x01 — LE Public
0x02 — LE Random

And for the RSSI field, a value of 127 means RSSI is not available — that can happen with Bluetooth 1.1 and earlier controllers, or when the radio conditions are just being messy. 😭

This event will be sent to all management sockets.

🌈 Advertisement Monitor Device Lost (since 1.18) 🌈

Event Code

0x0030

Controller Index

<controller_id>

Event Parameters

Monitor_Handle (2 Octets)
... Address (6 Octets)
... Address_Type (1 Octet)

This one is the sad one 😔 — it means the controller has stopped tracking a device that was being tracked by an Advertisement Monitor with the handle Monitor_Handle. It's giving "we lost them" energy.

The address of the device being tracked gets shared in Address and Address_Type.

Possible values for the Address_Type parameter:

0 — Reserved (not in use)
1 — LE Public
2 — LE Random

This event will be sent to all management sockets.

🧚 Mesh Device Found (since 1.21) 🧚

Event Code

0x0031

Controller Index

<controller_id>

Event Parameters

Address (6 Octets)
... Address_Type (1 Octet)
... RSSI (1 Octet)
... Instant (8 Octets)
... Flags (4 Octets)
... AD_Data_Length (2 Octets)
... AD_Data (0-65535 Octets)

This event means the controller received an Advertisement or Scan Result containing an AD Type that matches the Mesh scan set. Slay, filtering ate. 🔥

The address of the sending device is returned, and it must be a valid LE Address_Type.

Possible values for the Address_Type parameter:

0 — Reserved (not in use)
1 — LE Public
2 — LE Random

The RSSI field is a signed octet, and it's the RSSI reported by the receiving controller. Ngl, signed octets are so real.

The Instant field is a 64 bit value representing the instant in time the packet was received. Its value is not intended to be interpreted by the host — it's only useful if the host wants to make a timed response to the received packet (i.e. a Poll/Response). So don't go reading it like it means something, bestie, it's just a timestamp vibe. 💅

AD_Length and AD_Data contain the Info structure of Advertising and Scan results. To actually receive this event, AD filters must be requested with the Set Mesh Receiver command, specifying which AD Types to return. All AD structures will show up in this event if any of the filtered AD Types are present. Periodt.

This event will be sent to all management sockets.

⭐ Mesh Packet Transmit Complete (since 1.21) ⭐

Event Code

0x0032

Controller Index

<controller_id>

Event Parameters

Handle (1 Octets)

This event is your little "it's done!! 🎉" notification — it means a requested outbound Mesh packet has completed and no longer occupies a transmit slot. Main character energy, honestly.

This event will be sent to all management sockets.

📜 Copyright 📜

Free use of this software is granted under the terms of the GNU Lesser General Public Licenses (LGPL). Go off, LGPL, icon. 🫶

And that's the whole page, bestie — we literally made it to the end together 🎀✨ This one's brought to you by BlueZ, stamped April 2025, and filed under mgmt(7). Now go forth and manage some Bluetooth, you absolute legend. 💜🦋

📦 where this page comes from

arch rolling: bluez-utils 5.87-2 · GPL-2.0-only
nixpkgs unstable: bluez 5.87
ubuntu stonking: bluez 5.87-4 · GPL-2.0-or-later
💖 girlified by deepseek-ai/DeepSeek-V4.1-Flash-1017 on 2026-11-06: a language model's rewrite of the original, under its terms