bluez tutorial Version Exchange in ble

 

Feature Table, Version Exchange, Termination & Conn Params
Chapter 8 Sections 8.12.4–8.12.7 — Feature Bit Map Table, LL_VERSION_IND, LL_TERMINATE_IND & LL_CONNECTION_PARAM_REQ
Feature Bits
8 defined, 56 RFU
Version PDU
Company + LL + Sub
Termination
Either side, anytime
Param Req
4.1 — either side
Keywords:

BLE feature set Table 8.6 BLE LL_VERSION_IND company ID BLE version exchange procedure BLE termination LL_TERMINATE_IND BLE LL_CONNECTION_PARAM_REQ 4.1 BLE LE ping LL_PING_REQ BLE LL privacy LL privacy bit 6 BlueZ hcitool version exchange

Completing Section 8.12.4 — Feature Set Bit Table

The previous file explained the meaning of each feature bit in detail. This file presents the complete Table 8.6 from the textbook — the authoritative reference showing each bit’s position, name, the specification version it was introduced in, and which direction(s) it is valid for. It then covers the remaining LLCP procedures: Version Exchange, Termination, and the new 4.1/4.2 procedures.

Table 8.6 — Feature Set Bit Mapping (Complete Reference)
Bit Feature Introduced In Controller→Host Controller→Peer
0 LE Encryption 4.0 Y Y
1 Connection Parameters Request Procedure 4.1 Y Y
2 Extended Reject Indication 4.1 Y Y
3 Slave-Initiated Features Exchange 4.1 Y Y
4 LE Ping 4.1 Y N
5 LE Data Packet Length Extension 4.2 Y Y
6 LL Privacy 4.2 Y N
7 Extended Scanner Filter Policies 4.2 Y N
8–63 Reserved for Future Use (RFU)
Controller→Host: Y = feature reported to host, 0=not supported
Controller→Peer: Y = feature offered to peer, 1=allowed to use
N = not exchanged peer-to-peer (local controller info only)

8.12.5 — Version Exchange Procedure

Exchanging Device Identity Information

The Version Exchange procedure lets either the Master or the Slave share basic identification information about its Bluetooth implementation after entering the Connection state. This information is useful for diagnostics, logging, and compatibility checks between devices from different manufacturers.

The three pieces of information exchanged in a single LL_VERSION_IND PDU:

Company ID

A 16-bit identifier assigned by the Bluetooth SIG to each member company. This tells you who manufactured the Bluetooth chip in the remote device. For example, Cambridge Silicon Radio = 0x000A, Texas Instruments = 0x000D, Nordic Semiconductor = 0x0059.

Link Layer Version

The Bluetooth specification version the Link Layer implements. 6 = BLE 4.0, 7 = BLE 4.1, 8 = BLE 4.2, 9 = BLE 5.0, etc. This directly corresponds to which LLCP procedures and features the device supports.

Sub-Version Number

A 16-bit vendor-specific sub-version. Each manufacturer uses this to identify their specific firmware or silicon revision. Useful for diagnosing compatibility issues between specific hardware revisions.

Reciprocal rule: When a device receives LL_VERSION_IND from the peer, it responds with its own LL_VERSION_IND — but only if it has not already sent its own version information in this connection. This prevents endless loops and means version information is only exchanged once per connection.

Figure 8.28 — Version Exchange (Either Side May Initiate)
Master Slave
When Master initiates:
LL_VERSION_IND (CompanyID, LLVersion, SubVersion)
LL_VERSION_IND (Slave’s CompanyID, LLVersion, SubVersion)
OR
When Slave initiates:
LL_VERSION_IND (Slave’s version info)
LL_VERSION_IND (Master responds with own version)
/* Reading version info from a connected BLE device via BlueZ */
/* hcitool cmd 0x04 0x001D 0x40 0x00 */
/* OGF=0x04 (Link Policy), OCF=0x001D = Read Remote Version */
/* Parameter: connection handle (2 bytes, little-endian)      */

/* Response event (HCI Read Remote Version Complete):         */
/* - status   : 1 byte  (0x00 = success)                     */
/* - handle   : 2 bytes (connection handle)                   */
/* - version  : 1 byte  (6=BT4.0, 7=BT4.1, 8=BT4.2, 9=BT5) */
/* - manufacturer: 2 bytes (company ID from Bluetooth SIG)   */
/* - subversion  : 2 bytes (firmware/silicon sub-version)    */

/* Or use bluetoothctl and check device info:                 */
/* [AA:BB:CC:DD:EE:FF]# info                                  */
/* Device AA:BB:CC:DD:EE:FF                                   */
/*   ...                                                      */
/*   Connected: yes                                           */

8.12.6 — Termination Procedure

Closing the Connection Gracefully

The Termination procedure is how a BLE connection is closed cleanly. Either the Master or the Slave can send LL_TERMINATE_IND at any time — this is the one LLCP procedure that does not have to wait for any other procedure to complete first.

The PDU carries an error code that explains why the connection is being terminated. Common error codes include: remote user terminated (0x13), connection timeout (0x08), pairing not allowed (0x18), and so on. The receiving side acknowledges the termination at the Link Layer level (an ACK at the LL level, not a separate PDU), closes the connection, and notifies its host.

Figure 8.29 — Termination Procedure (Either Side)
Master Slave
Master-initiated termination:
LL_TERMINATE_IND (ErrorCode)
LL ack (link layer acknowledgment)
Connection closed
OR
Slave-initiated termination:
LL_TERMINATE_IND (ErrorCode)
LL ack
Connection closed
/* Disconnecting a BLE connection using BlueZ */

/* Command line: */
/* bluetoothctl disconnect AA:BB:CC:DD:EE:FF */

/* Via hcitool (sends HCI Disconnect command to controller): */
/* hcitool dc AA:BB:CC:DD:EE:FF */

/* Programmatic — HCI Disconnect command: */
/* OGF=0x01 (Link Control), OCF=0x0006    */
typedef struct {
    uint16_t handle; /* connection handle             */
    uint8_t  reason; /* 0x13 = remote user terminated */
} __attribute__((packed)) disconnect_cp;

/* The controller sends LL_TERMINATE_IND to the peer */
/* and reports Disconnection Complete event to host  */

8.12.7 — Connection Parameters Request Procedure (BLE 4.1)

Giving the Slave a Voice in Parameter Negotiation

In BLE 4.0, only the Master could change connection parameters (via the Connection Update procedure in Section 8.12.1). The Slave had no way to request a change — it had to accept whatever the Master decided. This was a problem in practice: a sensor device (Slave) running low on battery had no way to ask for a longer connection interval to save power.

BLE 4.1 added the Connection Parameters Request procedure to fix this. Now either the Master or the Slave can request a parameter update using LL_CONNECTION_PARAM_REQ. The remote device either accepts with LL_CONNECTION_PARAM_RSP or rejects with LL_REJECT_IND_EXT.

The parameters that can be requested:

connInterval min/max connSlaveLatency connSupervisionTimeout preferredPeriodicity referenceConnEventCount offsets (0–5)
Connection Parameters Request — Either Side Can Initiate (BLE 4.1+)
Master Slave
Slave requests a longer connection interval to save battery:
LL_CONNECTION_PARAM_REQ (min/max interval, latency, timeout)
Master accepts:
→ LL_CONNECTION_PARAM_RSP
Master rejects:
→ LL_REJECT_IND_EXT (reason)
Master may also then issue LL_CONNECTION_UPDATE_REQ to apply the new params

Why the Master still has the final word: Even with the 4.1 Connection Parameters Request, the Master ultimately controls when the parameters change. If the Master accepts the Slave’s request, it still schedules the change at a future connection event boundary (using LL_CONNECTION_UPDATE_REQ) rather than applying it immediately. This preserves the Master’s role as the timing authority for the connection.

/* Connection parameter update from Peripheral (Slave) in BlueZ */
/* Peripherals request updates via the L2CAP Connection Parameter */
/* Update Request (for older hosts) or via GATT on newer setups   */

/* Using bluetoothctl to update params as Central (Master):       */
/* hcitool lecup --handle 0x0040                                  */
/*              --min 0x0190 --max 0x0190                         */
/*              --latency 4 --timeout 0x01F4                       */
/* --min/max 0x0190 = 400 × 1.25ms = 500ms interval (power save) */
/* --latency 4      = Slave may skip 4 events                     */
/* --timeout 0x01F4 = 500 × 10ms = 5000ms supervision timeout    */

/* Checking connection params of a live connection:               */
/* hcitool lecc --list  (shows current connection parameters)     */

Section 8.12 LLCP — Complete Summary
4.0 Procedures

  • Connection Update (Master only)
  • Channel Map Update (Master only)
  • Encryption Start/Pause
  • Feature Exchange (Master only)
  • Version Exchange (either)
  • Termination (either, anytime)
  • Unknown RSP / Rejection
4.1 Additions

  • Connection Params Request (either)
  • LE Ping (either)
  • Slave Feature Request
  • Extended Rejection Indication
  • Feature bits 1–4 added
4.2 Additions

  • Data Length Update (either)
  • Feature bits 5–7 added
  • PDU payload up to 251 bytes
  • LL Privacy support
  • Extended scanner filters

This PDF Series — All Four Files
🔗

PDF 1012

Initiating State, Connection State, CONNECT_REQ payload
📋

PDF 1315

LLCP Overview, Conn Update, Channel Map, Encryption Start
🔐

PDF 1618

Encryption Pause, Feature Exchange, Feature Bits

PDF 1920 (Here)

Table 8.6, Version, Termination, Conn Params Req

Chapter 8 Link Layer Complete!

All four files cover Sections 8.11 and 8.12 completely — every link layer state, every CONNECT_REQ field, all LLCP procedures, and all feature bits through BLE 4.2. The next chapter moves to L2CAP.

Next Chapter: L2CAP → ← PDF 1618

Leave a Reply

Your email address will not be published. Required fields are marked *