HCI Commands list

HCI Commands

Link Control Commands (OGF = 0x01)
No	Command Name	OpCode	Description
1	Inquiry	0x0001	Command used to enter Inquiry mode where it discovers other Bluetooth devices.
2	Inquiry_Cancel	0x0002	Command to cancel the Inquiry mode in which the Bluetooth device is in.
3	Periodic_Inquiry_Mode	0x0003	Command to set the device to enter Inquiry modes periodically according to the time interval set.
4	Exit_Periodic_Inquiry_Mode	0x0004	Command to exit the periodic Inquiry mode
5	Create_Connection	0x0005	Command to create an ACL connection to the device specified by the BD_ADDR in the parameters.
6	Disconnect	0x0006	Command to terminate the existing connection to a device
7	Add_SCO_Connection	0x0007	Create an SCO connection defined by the connection handle parameters.
8	Accept_Connection_Request	0x0009	Command to accept a new connection request
9	Reject_Connection_Request	0x000A	Command to reject a new connection request
10	Link_Key_Request_Reply	0x000B	Reply command to a link key request event sent from controller to the host
11	Link_Key_Request_Negative_Reply	0x000C	Reply command to a link key request event from the controller to the host if there is no link key associated with the connection.
12	PIN_Code_Request_Reply	0x000D	Reply command to a PIN code request event sent from a controller to the host.
13	PIN_Code_Request_Negative_Reply	0x000E	Reply command to a PIN code request event sent from the controller to the host if there is no PIN associated with the connection.
14	Change_Connection_Packet_Type	0x000F	Command to change the type of packets to be sent for an existing connection.
15	Authentication_Requested	0x0011	Command to establish authentication between two devices specified by the connection handle.
16	Set_Connection_Encryption	0x0013	Command to enable or disable the link level encryption.
17	Change_Connection_Link_Key	0x0015	Command to force the change of a link key to a new one between two connected devices.
18	Master_Link_Key	0x0017	Command to force two devices to use the master’s link key temporarily.
19	Remote_Name_Request	0x0019	Command to determine the user friendly name of the connected device.
20	Read_Remote_Supported_Features	0x001B	Command to determine the features supported by the connected device.
21	Read_Remote_Version_Information	0x001D	Command to determine the version information of the connected device.
22	Read_Clock_Offset	0x001F	Command to read the clock offset of the remote device.
HCI Policy Command (OGF=0x02)
1	Hold_Mode	0x0001	Command to place the current or remote device into the Hold mode state.
2	Sniff_Mode	0x0003	Command to place the current or remote device into the Sniff mode state.
3	Exit_Sniff_Mode	0x0004	Command to exit the current or remote device from the Sniff mode state.
4	Park_Mode	0x0005	Command to place the current or remote device into the Park mode state.
5	Exit_Park_Mode	0x0006	Command to exit the current or remote device from the Park mode state.
6	QoS_Setup	0x0007	Command to setup the Quality of Service parameters of the device.
7	Role_Discovery	0x0009	Command to determine the role of the device for a particular connection.
8	Switch_Role	0x000B	Command to allow the device to switch roles for a particular connection.
9	Read_Link_Policy_Settings	0x000C	Command to determine the link policy that the LM can use to establish connections.
10	Write_Link_Policy_Settings	0x000D	Command to set the link policy that the LM can use for a particular connection.
Host Controller and Baseband Commands (OGF=0x03)
1	Set_Event_Mask	0x0001	Command to set which events are generated by the HCI for the host.
2	Reset	0x0003	Command to reset the host controller, link manager and the radio module.
3	Set_Event_Filter	0x0005	Command used by host to set the different types of event filters that the host needs to receive.
4	Flush	0x0008	Command used to flush all pending data packets for transmission for a particular connection handle.
5	Read_PIN_Type	0x0009	Command used by host to determine if the link manager assumes that the host requires a variable PIN type or fixed PIN code. PIN is used during pairing.
6	Write_PIN_Type	0x000A	Command used by host to write to the host controller on the PIN type supported by the host.
7	Create_New_Unit_Key	0x000B	Command used to create a new unit key.
8	Read_Stored_Link_Key	0x000D	Command to read the link key stored in the host controller.
9	Write_Stored_Link_Key	0x0011	Command to write the link key to the host controller.
10	Delete_Stored_Link_Key	0x0012	Command to delete a stored link key in the host controller.
11	Change_Local_Name	0x0013	Command to modify the user friendly name of the device.
12	Read_Local_Name	0x0014	Command to read the user friendly name of the device.
13	Read_Connection_Accept_Timeout	0x0015	Command to determine the timeout session before the host denies and rejects a new connection request.
14	Write_Connection_Accept_Timeout	0x0016	Command to set the timeout session before a device can deny or reject a connection request.
15	Read_Page_Timeout	0x0017	Command to read the timeout value where a device will wait for a connection acceptance before sending a connection failure is returned.
16	Write_Page_Timeout	0x0018	Command to write the timeout value where a device will wait for a connection acceptance before sending a connection failure is returned.
17	Read_Scan_Enable	0x0019	Command to read the status of the Scan_Enable configuration.
18	Write_Scan_Enable	0x001A	Command to set the status of the Scan_Enable configuration.
19	Read_Page_Scan_Activity	0x001B	Command to read the value of the Page_Scan_Interval and Page_Scan_Window configurations.
20	Write_Page_Scan_Activity	0x001C	Command to write the value of the Page_Scan_Interval and Page_Scan_Window configurations.
21	Read_Inquiry_Scan_Activity	0x001D	Command to read the value of the Inquiry_Scan_Interval and Inquiry_Scan_Window configurations.
22	Write_Inquiry_Scan_Activity	0x001E	Command to set the value of the Inquiry_Scan_Interval and Inquiry_Scan_Window configurations.
23	Read_Authentication_Enable	0x001F	Command to read the Authentication_Enable parameter.
24	Write_Authentication_Enable	0x0020	Command to set the Authentication_Enable parameter.
25	Read_Encryption_Mode	0x0021	Command to read the Encryption_Mode parameter.
26	Write_Encryption_Mode	0x0022	Command to write the Encryption_Mode parameter.
27	Read_Class_Of_Device	0x0023	Command to read the Class_Of_Device parameter.
28	Write_Class_Of_Device	0x0024	Command to set the Class_Of_Device parameter.
29	Read_Voice_Setting	0x0025	Command to read the Voice_Setting parameter. Used for voice connections.
30	Write_Voice_Setting	0x0026	Command to set the Voice_Setting parameter. Used for voice connections.
31	Read_Automatic_Flush_Timeout	0x0027	Command to read the Flush_Timeout parameter. Used for ACL connections only.
32	Write_Automatic_Flush_Timeout	0x0028	Command to set the Flush_Timeout parameter. Used for ACL connections only.
33	Read_Num_Broadcast_Retransmissions	0x0029	Command to read the number of time a broadcast message is retransmitted.
34	Write_Num_Broadcast_Retransmissions	0x002A	Command to set the number of time a broadcast message is retransmitted.
35	Read_Hold_Mode_Activity	0x002B	Command to set the Hold_Mode activity to instruct the device to perform an activity during hold mode.
36	Write_Hold_Mode_Activity	0x002C	Command to set the Hold_Mode_Activity parameter.
37	Read_Transmit_Power_Level	0x002D	Command to read the power level required for transmission for a connection handle.
38	Read_SCO_Flow_Control_Enable	0x002E	Command to check the current status of the flow control for the SCO connection.
39	Write_SCO_Flow_Control_Enable	0x002F	Command to set the status of the flow control for a connection handle.
40	Set_Host_Controller_To_Host_Flow_Control	0x0031	Command to set the flow control from the host controller to host in on or off state.
41	Host_Buffer_Size	0x0033	Command set by host to inform the host controller of the buffer size of the host for ACL and SCO connections.
42	Host_Number_Of_Completed_Packets	0x0035	Command set from host to host controller when it is ready to receive more data packets.
43	Read_Link_Supervision_Timeout	0x0036	Command to read the timeout for monitoring link losses.
44	Write_Link_Supervision_Timeout	0x0037	Command to set the timeout for monitoring link losses.
45	Read_Number_Of_Supported_IAC	0x0038	Command to read the number of IACs that the device can listen on during Inquiry access.
46	Read_Current_IAC_LAP	0x0039	Command to read the LAP for the current IAC.
47	Write_Current_IAC_LAP	0x003A	Command to set the LAP for the current IAC.
48	Read_Page_Scan_Period_Mode	0x003B	Command to read the timeout session of a page scan.
49	Write_Page_Scan_Period_Mode	0x003C	Command to set the timeout session of a page scan.
50	Read_Page_Scan_Mode	0x003D	Command to read the default Page scan mode.
51	Write_Page_Scan_Mode	0x003E	Command to set the default page scan mode.

HCI Events

No	Command Name	Event Code	Description
1	Inquiry_Complete_Event	0x01	Indicates the Inquiry has finished.
2	Inquiry_Result_Event	0x02	Indicates that Bluetooth device(s) have responded for the inquiry.
3	Connection_Complete_Event	0x03	Indicates to both hosts that the new connection has been formed.
4	Connection_Request_Event	0x04	Indicates that a new connection is trying to be established.
5	Disconnection_Complete_Event	0x05	Occurs when a connection has been disconnected.
6	Authentication_Complete_Event	0x06	Occurs when an authentication has been completed.
7	Remote_Name_Request_Complete_Event	0x07	Indicates that the request for the remote name has been completed.
8	Encryption_Change_Event	0x08	Indicates that a change in the encryption has been completed.
9	Change_Connection_Link_Key_Complete_Event	0x09	Indicates that the change in the link key has been completed.
10	Master_Link_Key_Complete_Event	0x0A	Indicates that the change in the temporary link key or semi permanent link key on the master device is complete.
11	Read_Remote_Supported_Features_Complete_Event	0x0B	Indicates that the reading of the supported features on the remote device is complete.
12	Read_Remote_Version_Complete_Event	0x0C	Indicates that the version number on the remote device has been read and completed.
13	Q0S_Setup_Complete_Event	0x0D	Indicates that the Quality of Service setup has been complete.
14	Command_Complete_Event	0x0E	Used by controller to send status and event parameters to the host for the particular command.
15	Command_Status_Event	0x0F	Indicates that the command has been received and is being processed in the host controller.
16	Hardware_Error_Event	0x10	Indicates a hardware failure of the Bluetooth device.
17	Flush_Occured_event	0x11	Indicates that the data has been flushed for a particular connection.
18	Role_Change_Event	0x12	Indicates that the current bluetooth role for a connection has been changed.
19	Number_Of_Completed_Packets_Event	0x13	Indicates to the host the number of data packets sent compared to the last time the same event was sent.
20	Mode_Change_Event	0x14	Indicates the change in mode from hold, sniff, park or active to another mode.
21	Return_Link_Keys_Event	0x15	Used to return stored link keys after a Read_Stored_Link_Key command was issued.
22	PIN_Code_Request_Event	0x16	Indicates the a PIN code is required for a new connection.
23	Link_Key_Request_Event	0x17	Indicates that a link key is required for the connection.
24	Link_Key_Notification_Event	0x18	Indicates to the host that a new link key has been created.
25	Loopback_Command_Event	0x19	Indicates that command sent from the host will be looped back.
26	Data_Buffer_Overflow_Event	0x1A	Indicates that the data buffers on the host has overflowed.
27	Max_Slots_Change_Event	0x1B	Informs the host when the LMP_Max_Slots parameter changes.
28	Read_Clock_Offset_Complete_Event	0x1C	Indicates the completion of reading the clock offset information.
29	Connection_Packet_Type_Changed_Event	0x1D	Indicate the completion of the packet type change for a connection.
30	QoS_Violation_Event	0x1E	Indicates that the link manager is unable to provide the required Quality of Service.
31	Page_Scan_Mode_Change_Event	0x1F	Indicates that the remote device has successfully changed the Page Scan mode.
32	Page_Scan_Repetition_Mode_Change_Event	0x20	Indicates that the remote device has successfully changed the Page Scan Repetition mode.

HCI Error Codes

No	Command Name	Error Code
1	Unknown HCI Command	0x01
2	No Connection	0x02
3	Hardware Failure	0x03
4	Page Timeout	0x04
5	Authentication Failure	0x05
6	Key Missing	0x06
7	Memory Full	0x07
8	Connection Timeout	0x08
9	Max Number Of Connections	0x09
10	Max Number Of SCO Connections To A Device	0x0A
11	ACL Connection Already Exists	0x0B
12	Command Disallowed	0x0C
13	Host Rejected Due To Limited Resources	0x0D
14	Host Rejected Due To Security Reasons	0x0E
15	Host Rejected Due To A Remote Device Only A Personal Device	0x0F
16	Host Timeout	0x1
17	Unsupported Feature Or Parameter Value	0x11
18	Invalid HCI Command Parameters	0x12
19	Other End Terminated Connection: User Ended Connection	0x13
20	Other End Terminated Connection: Low Resources	0x14
21	Other End Terminated Connection: About To Power Off	0x15
22	Connection Terminated By Local Host	0x16
23	Repeated Attempts	0x17
24	Pairing Not Allowed	0x18
25	Unknown LMP PDU	0x19
26	Unsupported Remote Feature	0x1A
27	SCO Offset Rejected	0x1B
28	SCO Interval Rejected	0x1C
29	SCO Air Mode Rejected	0x1D
30	Invalid LMP Parameters	0x1E
31	Unspecified Error	0x1F
32	Unsupported LMP Parameter	0x20
33	Role Change Not Allowed	0x21
34	LMP Response Timeout	0x22
35	LMP Error Transaction Collision	0x23
36	LMP PDU Not Allowed	0x24
37	Encryption Mode Not Acceptable	0x25
38	Unit Key Used	0x26
39	QoS Not Supported	0x27
40	Instant Passed	0x28
41	Pairing With Unit Key Not Supported	0x29
42	Reserved For Future Use	0x2A-0xFF

This article has 14 Comments

Pingback: PocketMagic » More on Android’s Bluetooth
Peter says:

November 28, 2010 at 9:04 pm

Hi!
Do you know any way to write an application on my SDK 1.6 phone which could measure the lq(link quality) level between my phone and a bluetooth transmitter?

By the way how could I implement these hci commands written here in my code? Is there a .jar or something I coul put into my build path?

Thanks in advice,
Peter
Radu Motisan says:

November 29, 2010 at 12:12 am

Hi Peter,

Yes, it is possible. You need to directly interface the bluetooth chip, via serial connection.

Then you need a parser , very much like the AT modem parser.

Hope this helps,
Radu
Peter says:

December 1, 2010 at 1:47 pm

Thank you for the answer, but it’s not all clear.
So you are saying, that there is not an API or something I could use, I should implement a brand new method based on the concept of linq quality, but I don’t understand, why do I need a serial connection to the BT chip. Isn’t it enough to be connected to the device, like when I want to get the RSSI value of a connection?
And do I need the parser to be aware of the results I get from the chip? (for example I send it 00110 and I recieve back 01110 then the parser would analyze the result and add the “1 difference” to the lq calculator I also need to implement)?
I’ve read on a forum about a method named getLinkQuality() included in the Bluez API, have you heard about this possibility?
The problem was that I couldn’t use the API like it was a folder(not a .jar or something like that) full of program files written in C language.
And one last question: how could I implement these hci commands written in this article in my code?

I’m really sorry for asking so much, I’m new at Android programming, and I have to finish my code until 8th of december, and the only thing missing is this LQ level I need to get.

Any hints would really be appreciated.

Peter
Peter says:

December 1, 2010 at 2:01 pm

And by the way this BT chip I want to communicate with is a mobile phone.
Radu Motisan says:

December 2, 2010 at 11:59 am

Hello Peter,

Actually I was referring to a lower programming level. I pointed to that direction because you’ve asked “how could I implement these hci commands written here in my code?”

To get an idea, first see this diagram:
http://www.ibm.com/developerworks/wireless/library/wi-boogie1/bt_protocol_stack_c.gif

As you can see, the HCI layer is at the bottom. It is used to directly interface the radio BT chip, inside the mobile phone. You no longer use high level APIs (like DiscoverBTDevices, L2CAPConnect, etc), instead you implement EVERYTHING by yourself, by sending these HCI commands over a serial link to the BT Radio Chip (which is nothing else but a micro-processor).
The advantage over this effort, is that you have complete control.

Should I have some time for this, I will write a sample code.
Peter says:

December 2, 2010 at 6:01 pm

Really thanks for the idea, but do you know about a way that I could reach these functions via high level API-s?
Android NDK for example is a new thing for me, but it can use native codes to build a project, and I saw codes written in C I could use. I think I’ll try that first.

Regards,

Peter
Radu Motisan says:

December 2, 2010 at 6:03 pm

Ok, than the way to go is to stick to BlueZ and try compiling a native code sample that gives you the RSSI. HAve a look here, for a start: http://www.pocketmagic.net/?p=1332
Peter says:

December 4, 2010 at 12:58 am

Well, I must say, you are a huge help for me…wonderful page you linked. I really, really thank you, now I can continue working on my project. I hope I will be able to finish it, but if not, I know where to find answers.
Thank you a lot again.

Peter
Radu Motisan says:

December 4, 2010 at 1:36 am

Glad this helped. For any questions, just drop a line here. Good luck!
Peter says:

December 4, 2010 at 3:21 pm

Hi!
I’m really sorry to write again, but could you tell me how to modificate/use this code (http://android.git.kernel.org/?p=platform/external/bluez.git;a=commitdiff;h=611c26d196ef15425ae92dec9f3cdf92bbbe489a) to give a variable in my java code the hci_read_link_quality value?
On this site they describe the Android.mk file and there is the code itself, but I can’t find out how to gain the value itself.
Regards,
Peter
Radu Motisan says:

December 5, 2010 at 11:22 pm

Hi Peter,

Well the modifications require some time, so instead of doing them myself, I will guide you to the right direction:
http://www.pocketmagic.net/?p=1398
See Bluetooth on Android using BlueZ and JNI for an example on how to use BlueZ with your code. There are step by step examples that should help you.

Once you get that working, it will be easier for you to integrate the RSSI code.

Do you have experience with C coding? You will need it.
Peter says:

December 6, 2010 at 7:30 pm

Well I have only experience with C++ coding, but that will do. Thanks again, this will probably take some time. I’ll let you know when I’m done;)
Radu Motisan says:

December 6, 2010 at 7:31 pm

Ok, good luck with that!

You must be logged in to post a comment.

PocketMagic

Where Technology meets magic

This article has 14 Comments

Leave a Reply