HCI sits between the upper and lower layers of the BLE protocol stack. Everything from L2CAP upward runs in software on the host. Everything from the Link Layer downward runs in firmware on the controller. HCI is the bridge between them.

Rather than designing a completely new HCI for BLE, the specification reused the existing HCI from classic BR/EDR Bluetooth and extended it with LE-specific commands and events. This decision had three major benefits for developers and manufacturers:

Three types of packets travel across the HCI interface. Two are used exactly as in BR/EDR. One is slightly modified for LE. One BR/EDR packet type is absent entirely from LE.

Every HCI command has a 16-bit OpCode that identifies which command it is. The OpCode is split into two sub-fields: the upper 6 bits form the OGF (Opcode Group Field) and the lower 10 bits form the OCF (Opcode Command Field).

The OGF groups commands by category. For all BLE-specific commands, the OGF is always 0x08. This is how the controller knows whether an incoming command is a BR/EDR command or an LE command — it checks the OGF first.

/* Sending a raw HCI command with BlueZ hcitool */
/* Format: hcitool cmd OGF OCF [parameters...]  */

/* Example: LE Set Advertise Enable             */
/* OGF=0x08, OCF=0x000A, param: 0x01=enable     */
hcitool cmd 0x08 0x000a 01

/* Example: LE Set Scan Enable                  */
/* OGF=0x08, OCF=0x000C, params: enable, filter */
hcitool cmd 0x08 0x000c 01 00

/* Programmatic: building an HCI command in C   */
#include <bluetooth/hci.h>
#include <bluetooth/hci_lib.h>

/* Every LE command uses OGF_LE_CTL = 0x08      */
/* OCF values are defined in hci.h as            */
/* OCF_LE_SET_ADVERTISE_ENABLE  = 0x000A        */
/* OCF_LE_SET_SCAN_ENABLE       = 0x000C        */
/* OCF_LE_CREATE_CONN           = 0x000D        */
/* OCF_LE_SET_ADVERTISING_DATA  = 0x0008        */

In BR/EDR, each different event type has its own unique event code. If you wanted to catch a “Connection Complete” event you would look for event code 0x03. If you wanted “Inquiry Complete” it would be event code 0x01. Every event had its own code in a flat namespace.

For BLE, rather than consuming many new event codes in that same namespace, the specification reserved a single event code 0x3E — the LE Meta Event — and put all LE events inside it. Inside the LE Meta Event, a Subevent Code identifies exactly which LE event occurred. The remaining bytes after the subevent code are the event-specific parameters.

/* Catching LE Meta Events in BlueZ C code                    */
/* All LE events share event code HCI_LE_META_EVENT = 0x3E   */

#define HCI_LE_META_EVENT  0x3e

/* Subevent codes (defined in hci.h):                         */
#define EVT_LE_CONN_COMPLETE          0x01  /* Connection done  */
#define EVT_LE_ADVERTISING_REPORT     0x02  /* ADV packet seen  */
#define EVT_LE_CONN_UPDATE_COMPLETE   0x03  /* Params updated   */
#define EVT_LE_READ_REMOTE_USED_FEATURES_COMPLETE 0x04
#define EVT_LE_LTK_REQUEST            0x05  /* Key needed       */

/* Parsing an HCI event in a filter loop:                     */
hci_filter_set_event(HCI_LE_META_EVENT, &filter);
read(hci_sock, &buf, sizeof(buf));

evt_le_meta_event *meta = (void *)(buf + HCI_EVENT_HDR_SIZE + 1);
switch (meta->subevent) {
    case EVT_LE_CONN_COMPLETE:
        printf("LE connection established\n");
        break;
    case EVT_LE_ADVERTISING_REPORT:
        printf("LE advertising report received\n");
        break;
}

ACL (Asynchronous Connection-Less) data packets carry the actual application data between host and controller. The format for LE is identical to BR/EDR — the same field structure, the same connection handle field, and the same Packet Boundary (PB) and Broadcast (BC) flag bits.

All the data that flows between the L2CAP layer on the host and the link layer on the controller travels in these ACL packets. GATT notifications, ATT reads and writes, Security Manager pairing messages — all of it goes through HCI ACL packets.

Before looking at the table, here is the naming logic:

Commands and events introduced in specs 4.1 and 4.2 are shown in italics in the original textbook’s Table 9.1. In the table below they are highlighted in colour.

/* Quick reference — most commonly used LE HCI commands */

/* Start advertising: */
hci_send_cmd(sock, OGF_LE_CTL, OCF_LE_SET_ADVERTISING_DATA, ...);
hci_send_cmd(sock, OGF_LE_CTL, OCF_LE_SET_ADVERTISING_PARAMETERS, ...);
hci_send_cmd(sock, OGF_LE_CTL, OCF_LE_SET_ADVERTISE_ENABLE, 1_byte);

/* Start scanning: */
hci_send_cmd(sock, OGF_LE_CTL, OCF_LE_SET_SCAN_PARAMETERS, ...);
hci_send_cmd(sock, OGF_LE_CTL, OCF_LE_SET_SCAN_ENABLE, 2_bytes);

/* Create a connection: */
hci_send_cmd(sock, OGF_LE_CTL, OCF_LE_CREATE_CONN, ...);
/* Wait for LE_Connection_Complete meta event (subevent 0x01) */

/* Disconnect: */
hci_send_cmd(sock, OGF_LINK_CTL, OCF_DISCONNECT, 3_bytes);
/* Wait for Disconnect_Complete event */

/* Check controller capabilities: */
hci_send_cmd(sock, OGF_LE_CTL, OCF_LE_READ_LOCAL_SUPPORTED_FEATURES, 0);
hci_send_cmd(sock, OGF_LE_CTL, OCF_LE_READ_SUPPORTED_STATES, 0);