FEXL7105_BACI_Manual-01. Bluetooth Application Controller Interface (BACI) Command Manual

FEXL7105_BACI_Manual-01 Bluetooth Application Controller Interface (BACI) Command Manual Issue Date: May 31, 2013

NOTES No copying or reproduction of this document, in part or in whole, is permitted without the consent of LAPIS Semiconductor Co., Ltd. The content specified herein is subject to change for improvement without notice. The content specified herein is for the purpose of introducing LAPIS Semiconductor's products (hereinafter "Products"). If you wish to use any such Product, please be sure to refer to the specifications, which can be obtained from LAPIS Semiconductor upon request. Examples of application circuits, circuit constants and any other information contained herein illustrate the standard usage and operations of the Products. The peripheral conditions must be taken into account when designing circuits for mass production. Great care was taken in ensuring the accuracy of the information specified in this document. However, should you incur any damage arising from any inaccuracy or misprint of such information, LAPIS Semiconductor shall bear no responsibility for such damage. The technical information specified herein is intended only to show the typical functions of and examples of application circuits for the Products. LAPIS Semiconductor does not grant you, explicitly or implicitly, any license to use or exercise intellectual property or other rights held by LAPIS Semiconductor and other parties. LAPIS Semiconductor shall bear no responsibility whatsoever for any dispute arising from the use of such technical information. The Products specified in this document are intended to be used with general-use electronic equipment or devices (such as audio visual equipment, office-automation equipment, communication devices, electronic appliances and amusement devices). The Products specified in this document are not designed to be radiation tolerant. While LAPIS Semiconductor always makes efforts to enhance the quality and reliability of its Products, a Product may fail or malfunction for a variety of reasons. Please be sure to implement in your equipment using the Products safety measures to guard against the possibility of physical injury, fire or any other damage caused in the event of the failure of any Product, such as derating, redundancy, fire control and fail-safe designs. LAPIS Semiconductor shall bear no responsibility whatsoever for your use of any Product outside of the prescribed scope or not in accordance with the instruction manual. The Products are not designed or manufactured to be used with any equipment, device or system which requires an extremely high level of reliability the failure or malfunction of which may result in a direct threat to human life or create a risk of human injury (such as a medical instrument, transportation equipment, aerospace machinery, nuclear-reactor controller, fuel-controller or other safety device). LAPIS Semiconductor shall bear no responsibility in any way for use of any of the Products for the above special purposes. If a Product is intended to be used for any such special purpose, please contact a ROHM sales representative before purchasing. If you intend to export or ship overseas any Product or technology specified herein that may be controlled under the Foreign Exchange and the Foreign Trade Law, you will be required to obtain a license or permit under the Law. Copyright 2012-2013 LAPIS Semiconductor Co., Ltd. i

Preface This document is the Application Developer s Guide for ML7105 using BACI inteface. The following related manual is available and should be referenced as needed. ML7105 data sheet ML7105 users manual Application Developer s Guide for ML7105 ii

Notation Classification Notation Numeric value 0xnn 0bnnnn Represents a hexadecimal number. Represents a binary number. Address 0xnnnn_nnnn Represents a hexadecimal number. (indicates 0xnnnnnnnn) Unit word, W 1 word = 32 bits byte, B 1 byte = 8 bits Mega, M 10 6 Kilo, K (uppercase) 2 10 =1024 Kilo, k (lowercase) 10 3 =1000 Milli, m 10-3 Micro, μ 10-6 Nano, n 10-9 Second, s (lowercase) Second Terminology "H" level Signal level on the high voltage side; indicates the voltage level of V IH and V OH as defined in electrical characteristics. "L" level Signal level on the low voltage side; indicates the voltage level of V IL and V OL as defined in electrical characteristics. Register description Read/write attribute: R indicates read-enabled; W indicates write-enabled. MSB: Most significant bit in an 8-bit register (memory) LSB: Least significant bit in an 8-bit register (memory) iii

Table of Contents NOTES...i Preface...ii Notation...iii Table of Contents...iv Introduction...1 BLUETOOTH LOW ENERGY SINGLE MODE SPECIFICATION...1 DATA STORAGE AND MEMORY RETENTION...2 OVERVIEW OF BACI INTERFACE...3 BACI PACKET TYPE...3 BACI PACKET STRUCTURE...5 BYTE ORDER...5 STATE TRANSITIONS...6 BACI MESSAGES...7 BACI Command...9 RESET (0X01)...9 SHUTDOWN (0X02)...9 SLEEP (0X03)...9 WAKEUP (0X04)...10 ECHO (0X05)...10 TEST (0X06)...10 DTM (0X07)... 11 CONNECT (0X08)...12 DISCONNECT (0X09)...12 CONNECTION UPDATE (0X0A)...13 READ LOCAL DEVICE ADDRESS (0X0B)...13 READ LOCAL VERSION INFORMATION (0X0C)...13 READ RSSI (0X0D)...14 CONFIG TX POWER (0X0E)...15 CONFIGURE (0X0F)...16 READ EEPROM (0X10)...16 WRITE EEPROM (0X11)...17 READ BB REG (0X12)...18 WRITE BB REG (0X13)...18 READ RF REG (0X14)...19 WRITE RF REG (0X15)...19 RF SET TX HOP (0X16)...20 READ PLATFORM REG (0X17)...20 WRITE PLATFORM REG (0X18)...21 WRITE CONFIG COMPLETE (0X19)...22 READ CONFIG (0X1A)...22 WRITE CONFIG (0X1B)...22 ENABLE_I2C (0X1C)...23 GET EEPROM STATUS (0X1D)...24 WHITE_LIST (0X20)...24 SET_RANDOM_ADDRESS (0X21)...25 SET_ADV_SCAN (0X22)...26 SET_ADV_DATA (0X23)...26 CONNECT_CANCEL (0X24)...26 iv

ENCRYPT (0X25)...27 RAND (0X26)...27 BACI Data...29 BLE_ATT_DATA_EVENT (0X01)...29 BACI ATT Events List...30 BLE_ATT_DATA_COMMAND (0X02)...32 BACI ATT Commands List...33 BLE_SMP_DATA_EVENT (0X03)...36 BACI SMP Event List...37 BLE_SMP_DATA_COMMAND (0X04)...38 BACI SMP Command List...39 BLE_L2CAP_DATA_EVENT (0X05)...40 BACI L2CAP Event List...40 BLE_L2CAP_DATA_COMMAND (0X06)...41 BACI L2CAP Command List...41 BACI Events...42 START UP (0X01)...42 COMMAND STATUS (0X02)...42 COMMAND COMPLETE (0X03)...42 ECHO (0X04)...43 HARDWARE ERROR (0X05)...43 CONNECTION COMPLETE (0X06)...43 DISCONNECTION COMPLETE (0X07)...44 CONNECTION UPDATE COMPLETE (0X09)...45 DATA CREDIT (0X0A)...45 ADVERTISING REPORT EVENT (0X0D)...46 Flow Control...47 COMMAND...47 DATA...47 Glossary...47 Revision History...48 v

Introduction BACI stand for Bluetooth Application Controller Interface. BlueLitE Bluetooth Single Mode Low Energy (BLE) Protocol Stack, provides the BACI interface to allow BLE profiles and application to be implemented in a separate application processor and accessing the BLE stack functionality implemented in the BLE connectivity processor. This is a message based protocol, which can be interfaced over various transports like UART, SPI etc. BACI provides interfaces required to access the GAP, GATT and SM functionality for implementing BLE profiles and application scenario. It also provides interface for putting the device into Direct Test Mode (DTM) as defined by the BLE specification. The details of the BACI interface are captured in the rest of this document. Bluetooth Low Energy Single Mode Specification Bluetooth 4.0 specification defined Low Energy features in the following Volumes/Parts: Volume 2: Core System Package [BR/EDR Controller Volume] o Part D : Error Codes Volume 3: Core System Package [Host Volume] o o o o o Part A: Logical Link Control and Protocol Part C: Generic Access Profile (GAP) Part F: Attribute Protocol (ATT) Part G: Generic Attribute Profile (GATT) Part H: Security Manager (SM) Volume 6: Core System Package [Low Energy Controller Volume] 1

Generic Attribute Profile (GATT) Attribute Protocol (ATT) Security Manager (SM) Gener ic Access Profile (GAP) Logical Link Control and Adaption Protocol (L2CAP) Host Controller Interface (HCI) Link Layer (LL) Physical Layer (PHY) Figure 1. Bluetooth Low Energy components in connectivity processor Data storage and memory retention In the connectivity processor, the data can be stored in volatile and non-volatile memory. The dynamic data, which is created during runtime and required for the operation of application, is stored in the volatile memory. Some of that information can also be saved in the non-volatile memory, like bonding information, client characteristic configuration (CCC) etc. The static setup data can be written to non-volatile memory for long term storage during configuration. Those stored values will be used as default configuration on power-on. 2

Overview of BACI Interface The BACI Interface is shown in the figure below. Application Applicati on Process or Bluetooth Low Energy Profiles Bluetooth Application Controller Interface (BACI) Host BACI Interface Bluetooth Application Controller Interface (BACI) Controller Bluetoot h Connecti vity Process or Bluetooth Low Energy Host (GAP, GATT, SM etc.) Bluetooth Low Energy Controller (LL etc.) Figure 2. BACI Interface The interface that BACI provides for upper layer profiles and applications is known as the BACI Host interface. The other end of the interface which provides access to the Bluetooth Low Energy Host is known as the BACI Controller. BACI Packet Type BACI uses message format similar to the one used for UART transport of Bluetooth Host Controller Interface (HCI). For the UART transports following four types of HCI Packet Indicators are defined HCI Packet Type HCI Command Packet HCI ACL Data Packet HCI Synchronous Data Packet HCI Event Packet HCI Packet Indicator 0x01 0x02 0x03 0x04 For the BACI, following new packet types are defined BACI Packet Type BACI Command Packet BACI Data Packet BACI Event Packet BACI Packet Indicator 0x01 0x02 0x04 3

- BACI Command Control Packets sent from the application processor to connectivity processor. - BACI Event Control Packets sent from the connectivity processor to application processor. BACI events are generated based on locally initiated operation or request/response from peer device. - BACI Data This can be of two types Data Packets sent from the application processor to connectivity processor, to initiate a GATT or SMP transaction with peer device Data Packets sent from the connectivity processor to application processor, to inform application about the GATT or SMP message received from the peer device Application Processor Bluetooth Connectivity Processor BACI Command BACI Event BACI Event Bluetooth Peer Device supporting Low Energy BACI Data BACI Data BACI Data Legend Message (Command/ Event/Data) Exchange Optional Message (Command/Event/Data) Exchange Figure 3. BACI Packet Exchange 4

BACI Packet Structure All parameter values are sent and received in Little Endian format (i.e. for multi-octet parameters the Least Significant Octet is transmitted first). Figure 4. BACI Packet Structure Byte Order All multi-byte parameters are in little endian format (least significant byte first order), unless mentioned otherwise. 5

State Transitions Defined states are described below Init o Connectivity processor configuration (GAP, GATT, any other) o All dynamic data cleared Sleep o Power saving mode, all connection dropped o Configurations saved in memory Test o Direct Test Mode and related commands Idle o Configured and no LL/Radio activity initiated from application Connected o Connected with peer device configure Init Sleep Configuration Complete configure Enter Test Sleep Idle Test Wakeup Exit Test connected disconnected Connected Figure 5. State Transitions 6

BACI Messages Command Message Code Available Role Available State Reset 0x01 Master / Slave All Shutdown 0x02 Master / Slave All Sleep 0x03 Master / Slave Idle Wakeup 0x04 Master / Slave Sleep Echo 0x05 Master / Slave Idle / Connected Test 0x06 Master / Slave Idle / Test DTM 0x07 Master / Slave Test Connect 0x08 Master Idle Disconnect 0x09 Master / Slave Connected Connection Update 0x0A Slave Connected Read Local Device Address 0x0B Master / Slave Idle / Connected Read Local Version Information 0x0C Master / Slave Idle / Connected Read RSSI 0x0D Master Connected Config Tx Power 0x0E Master / Slave Idle / Connected Configure 0x0F Master / Slave Idle / Connected Read EEPROM 0x10 Master / Slave Idle / Connected Write EEPROM 0x11 Master / Slave Idle / Connected Read_BB_Reg 0x12 Master / Slave Idle / Connected Write_BB_Reg 0x13 Master / Slave Idle / Connected Read_RF_Reg 0x14 Master / Slave Idle / Connected Write_RF_Reg 0x15 Master / Slave Idle / Connected RF_Set_Tx_Hop 0x16 Master / Slave Test Read_Platform_Reg 0x17 Master / Slave Idle / Connected Write_Platform_Reg 0x18 Master / Slave Idle / Connected Write_config_complete 0x19 Master / Slave Idle / Connected Read_config 0x1A Master / Slave Idle / Connected Write_config 0x1B Master / Slave Idle / Connected Enable_i2c 0x1C Master / Slave Idle / Connected Get_eeprom_status 0x1D Master / Slave Idle / Connected White_list 0x20 Master / Slave Idle / Connected Set_random_address 0x21 Master / Slave Idle / Connected Set_adv_scan 0x22 Master / Slave Idle / Connected Set_adv_data 0x23 Slave Idle / Connected Connect_cancel 0x24 Master Idle Encrypt 0x25 Master / Slave All Rand 0x26 Master / Slave All Data ATT Data Event 0x01 Master / Slave Idle / Connected ATT Data Command 0x02 Master / Slave Idle / Connected SMP Data Event 0x03 Master / Slave Idle / Connected SMP Data Command 0x04 Master / Slave Idle / Connected BLE L2CAP Data Event 0x05 Master / Slave Idle / Connected BLE L2CAP Data Command 0x06 Master / Slave Idle / Connected 7

Message Code Available Role Available State Events Start Up 0x01 Master / Slave Idle Command Status 0x02 Master / Slave Idle / Connected Command Complete 0x03 Master / Slave Idle / Connected Echo 0x04 Master / Slave Idle / Connected Hardware Error 0x05 Master / Slave Idle / Connected Connection Complete 0x06 Master / Slave Idle / Connected Disconnection Complete 0x07 Master / Slave Connected Connection Update Complete 0x09 Master / Slave Connected Data Credit 0x0A N/A Idle / Connected Advertising Report 0x0D Master Idle / Connected 8

BACI Command Reset (0x01) This command is used to reset the BACI Controller. This also terminates any ongoing Link Layer activity and disconnects any active connection, enable/disable Test Mode. Events/Return Start Up Event is generated on controller reset. Shutdown (0x02) This command stops operation of connectivity processor completely. The return from Shutdown requires hardware reset. Events/Return No event is generated. Sleep (0x03) This command is used to enter Sleep mode, to save power. In this mode all connections will be disconnected. Connectivity processor will remain in Sleep Mode, till is receives Wakeup command from application processor. Events/Return Command Complete Event is generated before entering Sleep Mode. in Command Complete Event: Command Code: 1 octet Sleep (0x03) Command Parameter Length: 0x00 Command Parameter: Command Code Result. 0x00 represents success Any other represents Error Codes defined in Bluetooth Specification (Volume 2, Part D) Length of return parameters 9

Wakeup (0x04) This command is used to exit Sleep mode and to enter Idle state. Events/Return Command Complete Event and Start Up Event is generated. in Command Complete Event: Command Code: 1 octet Wakeup (0x04) Command Parameter Length: 0x00 Command Parameter: Command Code Result. 0x00 represents success Any other represents Error Codes defined in Bluetooth Specification (Volume 2, Part D) Length of return parameters Echo (0x05) This command is used to perform loopback test of the BACI Transport layer. Application processor sends data through this command and connectivity processor returns back the same data content in the corresponding Echo Event, to confirm the correct functioning of the transport layer. Data: Size 1-20 octet Any Any data can be sent Events/Return Echo Event is generated. Echo event uses fixed payload length of 20 bytes. Test (0x06) This command is used to enable/disable Test Mode. On entering and exiting Test Mode the connectivity processor is reset. Once the connectivity processor enters Test Mode, application processor can use DTM Commands to perform Radio Testing. Test_Enable: Size 1 octet 0x00 0x01 0x02-0xFF Disable Test Mode Enable Test Mode Reserved 10

Events/Return Command Complete Event is generated to report success or failure. On reset, Start Up Event will be generated. in Command Complete Event: Command Code: 1 octet Test (0x06) Command Parameter Length: 0x00 Command Parameter: Command Code Result. 0x00 represents success Any other represents Error Codes defined in Bluetooth Specification (Volume 2, Part D) Length of return parameters DTM (0x07) This command is used to encapsulate, following HCI Commands defined in Bluetooth Specification LE Receiver Test Command LE Transmitter Test Command LE Test End Command HCI DTM Command: Size Variable (as defined in Bluetooth HCI Specification) N/A Defined in the Bluetooth HCI Specification Events/Return Command Complete Event is generated to report success or failure. in Command Complete Event: Command Code: 1 octet DTM (0x07) Command Parameter Length: 0x00 or 0x02 Command Parameter: 0xXXXX Command Code Result. 0x00 represents success Any other represents Error Codes defined in Bluetooth Specification (Volume 2, Part D) Length of return parameters For following commands LE Receiver Test Command LE Transmitter Test Command For LE Test End Command, Number of packets received (2 octets) 11

BACI DTM Command Format 0x01 0x07 0x05 0x00-0x02 0x00-0x27 0x00-0x25 0x00-0x07 0x00-0x01 Command DTM Test Payload Payload start_stop Packet Type Length frequency Type Type Length Data Type flag - LE Receiver Test 0x01 0x07 0x05 0x01 0x00 0x00 0x00 0x01 Command DTM Test start_stop Packet Type Length frequency NA NA Type Type flag=start - LE Transmitter Test 0x01 0x07 0x05 0x02 0x00 0x00 0x00 0x01 Command DTM Test Payload Payload start_stop Packet Type Length frequency Type Type Length Data Type flag=start - LE Test End Command 0x01 0x07 0x05 0x00 0x00 0x00 0x00 0x00 Command start_stop Packet Type Length NA NA NA NA Type flag=stop NA Not applicable Connect (0x08) This command is used to establish connection with a peer Bluetooth device. are as defined for the LE_Create_Connection HCI Command. Events/Return Command Status Event is generated initially to inform the operation has started. On connection, Connection Complete Event is generated. Several other events will be generated, based the local and remote device role/configuration. Disconnect (0x09) This command is to terminate a connection with a connected Bluetooth device. Connection Context: 2 octets Connection Context (Connection Handle) is informed to the application on connection complete Events/Return Command Status Event is generated initially to inform the operation has started. On disconnection, Disconnection Complete Event is generated. 12

Connection Update (0x0A) This command is used to initiate LE Connection Update procedure with a connected Bluetooth device. This command shall be initiated from the BLE Master device. If the local device is BLE Slave, use BLE L2CAP Data Command. are as defined for the LE Connection Update HCI Command. Events/Return Command Status Event is generated initially to inform the operation has started. If the operation started successful, after that Connection Update Complete Event is generated. Read Local Device Address (0x0B) This command is used to get the local device addresses (both Public Address and Random Static Address). Flag: 1 octet 0x00 0x01 0x02 Read Public and Static Random Address. Generate Static Random Address. Do not change the existing Random Address set by Host. Read Public and generated Static Random Address. Generate Static Random Address. Set the Random Address with the newly generated value. Read Public and Static Random Address. Events/Return Command Complete Event is generated with local device addressed (public address followed by random address). in Command Complete Event: Command Code: 1 octet Read Local Device Address (0x0B) Command Parameter Length: 0x0C Command Parameter: 0xXXXXXXXXXXXX 0xXXXXXXXXXXXX Command Code Result. 0x00 represents success Any other represents Error Codes defined in Bluetooth Specification (Volume 2, Part D) Length of return parameters Public Address Random Address Read Local Version Information (0x0C) This command is used to read local version information of the BACI Controller. 13

Events/Return Command Complete Event is generated with local version information. in Command Complete Event: Command Code: 1 octet Read_Local_Version_Informat ion (0x0C) Command Parameter Length: 0x08 Command Parameter: HCI_Version HCI_Revision LMP/PAL_Version Manufacturer_Name LMP/PAL_Subversion Command Code Result. 0x00 represents success Any other represents Error Codes defined in Bluetooth Specification (Volume 2, Part D) Length of return parameters s defined in Bluetooth Assigned Number (1 octet) Revision of the Current HCI in the Controller (2 octets) Version of the Current LMP or PAL in the Controller (1 octet) Manufacturer Name of the BR/EDR Controller (2 octets) Subversion of the Current LMP or PAL in the Controller (2 octets) Read RSSI (0x0D) This command reads the Received Signal Strength Indication (RSSI) value from the BACI Controller. Connection Context: 2 octets Connection Context (Connection Handle) is informed to the application on connection complete Events/Return Command Complete Event is generated with RSSI value. in Command Complete Event: Command Code: 1 octet Read_RSSI (0x0D) Command Parameter Length: 0x03 Command Code Result. 0x00 represents success Any other represents Error Codes defined in Bluetooth Specification (Volume 2, Part D) Length of return parameters 14

Command Parameter: Handle RSSI Connection Handle (2 octets) RSSI (1 octet) Range: -127 to +20, +127 (signed integer) Units: dbm Config Tx Power (0x0E) This command used to set the transmit power level used for LE advertising/connection channel packets. TxPowerType: 1 octet Advertising Channel Tx Power(0x00) Connection Channel Tx Power(0x01) TxPower: 2 octets Tx Power (Register ) This value is set according to value of RF register (refer to example below). Events/Return Command Complete Event is generated. in Command Complete Event: ex.) TX Power value setting Read RF Reg Command (Address:0x003F): 01 14 02 3F 00 Command Complete Event (Read :0x00003DA6): 04 03 07 14 00 04 A6 3D 00 00 N (0x00003DA6 & 0x0000FF00) >> 8 TX Power 0 dbm: 0x003D ( N ) -6 dbm: 0x001E ( N / 2) -12 dbm: 0x000F ( N / 4) -18 dbm: 0x0007 ( N / 8) Note: The value of RF register is different by each sample of LSI. Command Code: 1 octet Config Tx Power (0x0E) Command Parameter Length: 0x00 Command Parameter: Command Code Result. 0x00 represents success Any other represents Error Codes defined in Bluetooth Specification (Volume 2, Part D) Length of return parameters 15

Configure (0x0F) This command is used to configure BACI Controller, for various setup required for GAP, GATT Service Configuration and other configurations. Role: 1 octet 0x00 0x01 Central. The scan parameters are used to start scanning. Peripheral. The adv parameters are used to start advertising. Advertising (Peripheral) : 15 octets 2 octets Advertising_Interval_Min 2 octets Advertising_Interval_Max 1 octet Advertising_Type 1 octet Own_Address_Type 1 octet Direct_Address_Type 6 octets Direct_Address 1 octet Advertising_Channel_Map 1 octet Advertising_Filter_Policy Scanning (Central): 7 octets 1 octet Scan_Type 2 octets Scan_Interval 2 octets Scan_window 1 octet Scan_own_address_type 1 octet Scan_filter_policy Connection parameters (Future Use): 25 octets 2 octets Connection_scan_interval 2 octets Connection_scan_window 1 octet Initiator_filter_policy 1 octet Peer_address_type 6 octets Peer_BD_address 1 octet Own_address_type 2 octets Connection_interval_min 2 octets Connection_interval_max 2 octets Connection_latency 2 octets Supervision_timeout 2 octets Maximum_ce_length 2 octets Minimum_ce_length Events/Return No event is generated for this command. Read EEPROM (0x10) This command is used to read the EEPROM data from Controller. The Enable_I2C command should be issued before using this command. StartAddress: 4 octets Start Address 16

Length: 1 octet The length of data to be read. Maximum of 24 octets. Events/Return Command Complete Event is generated with status, length of data read and data. in Command Complete Event: Command Code: 1 octet Read EEPROM (0x10) Command Parameter Length: 0xXX Command Parameter: 0xXX * <Length> Command Code Result. 0x00 represents success Any other represents Error Codes defined in Bluetooth Specification (Volume 2, Part D) <Length> is specified in the corresponding Read EEPROM command <Length> of data read from specified EEPROM address Write EEPROM (0x11) This command is used to write the EEPROM data to Controller. The Enable_I2C command should be issued before using this command. StartAddress: 4 octets Start Address Length: 1 octet The length of data to be written. Data: Variable Max 24 bytes The data to be written. Events/Return Command Complete Event is generated with status and length of data has been written successfully. in Command Complete Event: Command Code: 1 octet Write EEPROM (0x11) 0x00 0x01 0x02 Command Code Write EEPROM Command succeeded EEPROM NOT CONNECTED EEPROM CONNECTED NOT ENABLED Command Parameter Length: 17

0x00 Command Parameter: Length of return parameters Read BB Reg (0x12) This command is used to read the BB register. BBRegAddress: 2 octets BB Register Address Events/Return Command Complete Event is generated with status and BB read value. in Command Complete Event: Command Code: 1 octet Read_BB_Reg (0x12) Command Parameter Length: 0x02 Command Parameter: 0xXXXX Command Code Result. 0x00 represents success Any other represents Error Codes defined in Bluetooth Specification (Volume 2, Part D) Length of return parameters Register value read from Baseband register Write BB Reg (0x13) This command is used to write to the BB register. BBRegAddress: 2 octets BB Register Address : 2 octets BB Register value Events/Return Command Complete Event is generated with status. in Command Complete Event: Command Code: 1 octet Write_BB_Reg (0x13) Command Code 18

Command Parameter Length: 0x00 Command Parameter: Result. 0x00 represents success Any other represents Error Codes defined in Bluetooth Specification (Volume 2, Part D) Length of return parameters Read RF Reg (0x14) This command is used to read the RF register. RFRegAddress: 2 octets RF Register Address Events/Return Command Complete Event is generated with status and RF Reg value. in Command Complete Event: Command Code: 1 octet Read_RF_Reg (0x14) Command Parameter Length: 0x04 Command Parameter: 0xXXXXXXXX Command Code Result. 0x00 represents success Any other represents Error Codes defined in Bluetooth Specification (Volume 2, Part D) Length of return parameters Register value read from Radio register Write RF Reg (0x15) This command is used to write to the RF register. RFRegAddress: 1 octet RF Register Address : 4 octets RF Register value 19

Events/Return Command Complete Event is generated with status. in Command Complete Event: Command Code: 1 octet Write_RF_Reg (0x15) Command Parameter Length: 0x00 Command Parameter: Command Code Result. 0x00 represents success Any other represents Error Codes defined in Bluetooth Specification (Volume 2, Part D) Length of return parameters RF Set Tx HOP (0x16) This command enable/disable Hop for all channels during DTM Test. This command should be send before the start of DTM test. Hop: 1 octet Disable Hop for all channels(0x00) default Enable Hop for all channels(0x01) Events/Return Command Complete Event is generated with status. in Command Complete Event: Command Code: 1 octet RF_Set_Tx_Hop (0x16) Command Parameter Length: 0x00 Command Parameter: Command Code Result. 0x00 represents success Any other represents Error Codes defined in Bluetooth Specification (Volume 2, Part D) Length of return parameters Read Platform Reg (0x17) 20

This command is used to read the platform register. PFRegAddress: 4 octets Platform Register Address Events/Return Command Complete Event is generated with status and platform Reg value. in Command Complete Event: Bluetooth Application Controller Interface (BACI) Command Manual Command Code: 1 octet Read_Platform_Reg (0x17) Command Parameter Length: 0x04 Command Parameter: 0xXXXXXXXX Command Code Result. 0x00 represents success Any other represents Error Codes defined in Bluetooth Specification (Volume 2, Part D) Length of return parameters Register value read from Platform register Write Platform Reg (0x18) This command is used to write to the platform register. PFRegAddress: 4 octets Platform Register Address : 4 octets Platform Register value Events/Return Command Complete Event is generated with status. in Command Complete Event: Command Code: 1 octet Write_Platform_Reg (0x18) Command Parameter Length: 0x00 Command Code Result. 0x00 represents success Any other represents Error Codes defined in Bluetooth Specification (Volume 2, Part D) Length of return parameters 21

Command Parameter: Write Config Complete (0x19) This command is used to indicate the controller that the Config write has been completed. type: 1 octet 0x00 => Use CONFIG data Events/Return Startup Event is generated with status. Read Config (0x1A) This command is used to read the Config data from Controller. StartAddress: 4 octets offset Address Length: 1 octet The length of data to be read. (Maximum allowed length is 24 octets) Events/Return Command Complete Event is generated with status, length of data read and data. in Command Complete Event: Command Code: 1 octet Read_config (0x1A) Command Parameter Length: 0xXX Command Parameter: 0xXX * <Length> Command Code Result. 0x00 represents success Any other represents Error Codes defined in Bluetooth Specification (Volume 2, Part D) <Length> is specified in the corresponding Read Config command <Length> of data read from specified Config offset address Write Config (0x1B) This command is used to write the Config data to Controller. 22

StartAddress: 4 octets offset Address Length: 1 octet The length of configuration data to be written. Data: Variable Max 24 bytes The configuration data to be written. Events/Return Command Complete Event is generated with status and length of data has been written successfully. in Command Complete Event: Command Code: 1 octet Write_config (0x1B) Command Parameter Length: 0x00 Command Parameter: Command Code Result. 0x00 represents success Any other represents Error Codes defined in Bluetooth Specification (Volume 2, Part D) Length of return parameters Enable_I2C (0x1C) This command used to enable/disable I2C device support including the EEPROM PIN. Note : If EEPROM is not connected, this command can not be used because I2C_SDA and I2C_SCL may output low signal. enable: 1Octet Events/Return Command Complete Event is generated with status. in Command Complete Event: Disable I2C device support (0x00) default Enable I2C device support (0x01) Command Code: 1 octet Enable_I2C (0x1C) Command Code Result. 0x00 represents success Any other represents Error Codes defined in Bluetooth Specification (Volume 2, Part D) Command Parameter Length: 23

0x00 Command Parameter: Length of return parameters GET EEPROM Status (0x1D) This command used to get the EEPROM status. If the Get EEPROM Status returns 0x3 (EEPROM_PIN_NOT_ENABLED) then issue Enable_I2C command and Get EEPROM Status again to confirm the actual status (0x3 - EEPROM_NOT_CONNECTED). Events/Return Command Complete Event is generated with status. in Command Complete Event: Command Code: 1 octet Get_eeprom_status (0x1D) Command Parameter Length: 0x01 Command Parameter: 0x00 0x01 0x02 0x03 Command Code Result. 0x00 represents success Any other represents Error Codes defined in Bluetooth Specification (Volume 2, Part D) Length of return parameters EEPROM_ENABLED_VALID EEPROM_ENABLED_AND_NOT_VALID EEPROM_NOT_ENABLED EEPROM_ PIN_NOT_ENABLED/EEPROM_NOT_CONNECTED White_list (0x20) This command is used to encapsulate, Bluetooth Specification defined following HCI Commands related to white list LE Clear White List Command LE Add Device to White List Command LE Remove Device from White List Command Note: The number of additional device is basically one at BACI mode. Command Mode: 1 octet 0 LE Clear White List Command 1 LE Add Device to White List Command 2 LE Remove Device from White List Command address_type: 1 octet 24

0 Public Address 1 Random Address Bluetooth Application Controller Interface (BACI) Command Manual Address: 6 octets 0xXXXXXXXXXXXX Public or Random Address, as described by address_type Note: The address and address_type fields are used only for Add Device to White List and Remove Device from White List commands Events/Return Command Complete Event is generated to report success or failure. White List specific Event is returned as the event parameter, along with the status. in Command Complete Event: Command Code: 1 octet White_list(0x20) Command Parameter Length: 0x00 Command Parameter: Command Code Result. 0x00 represents success Any other represents Error Codes defined in Bluetooth Specification (Volume 2, Part D) Length of return parameters Set_random_address (0x21) This command is used to set random address of the local device Address: 6 octets 0xXXXXXXXXXXXX Random Address of the local device Events/Return Command Complete Event is generated to report success or failure. in Command Complete Event: Command Code: 1 octet Set_random_address (0x21) Command Parameter Length: Command Code Result. 0x00 represents success Any other represents Error Codes defined in Bluetooth Specification (Volume 2, Part D) 25

0x00 Command Parameter: Length of return parameters Set_adv_scan (0x22) This command is used to enable or disable Advertising or Scanning. CommandMode: 1 octet 0 Advertise 1 Scan Enable: 1 octet 0 Disable Advertising or scanning 1 Enable Advertising or scanning Filter_duplicates: 1 octet 0 Disable duplicate filtering 1 Enable duplicate filtering Note: Filter duplicates parameter is only applicable for Scanning. Events/Return No event is generated for this command. Set_adv_data (0x23) This command is used to set Advertising Data. Adv_data_type: 1 octet 0 or 1 0 : Adv Data 1 : Scan Rsp Data Adv_data_len: 1 octet 0-31 The number of significant octets in the Advertising Data Adv_data: 0-31 octets Advertising Data Events/Return No event is generated for this command. Connect_cancel (0x24) This command is used to cancel an already initiated Create Command. 26

Events/Return Connection Complete Event will be generated Encrypt (0x25) This command is used to request the Controller to encrypt the data in the command using the Key given in the command and returns the Encrypted data to the host. Key: 16 octets 0xXXXXXXXXXXXXXXXXXX XXXXXXXXXXXXXX Data: 16 octets 0xXXXXXXXXXXXXXXXXXX XXXXXXXXXXXXXX 128 bit key for the encryption of the data given in the command. 128 bit data block that is requested to be encrypted. Events/Return Command complete event shall be generated with status and Encrypted data. in Command Complete Event: Command Code: 1 octet Encrypt (0x25) 0xXX Command Parameter Length: 0x10 Encrypted_Data: 0xXXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXX Command Code 0x00 Encrypt command succeeded 0x01-0xFF Encrypt command failed Error Codes specified in Bluetooth Specification Volume-2 Part D Length of return parameters 128 bit encrypted data block Rand (0x26) This command is used to request the Controller to generate 8 octets of random data to be sent to the Host. Events/Return Command complete event is generated with status and random number. in Command Complete Event: Command Code: 1 octet Rand (0x26) Command Code 27

Command Parameter Length: 0x08 Random_Number: 0xXXXXXXXXXXXXXXXX 0x00 Rand command succeeded 0x01-0xFF Rand command failed Error Codes specified in Bluetooth Specification Volume-2 Part D Length of return parameters Random Number 28

BACI Data BLE_ATT_DATA_EVENT (0x01) This data is an ATT event used to notify an ATT protocol event resulting due to a local or peer ATT action. att_id: 1 octet device_id: 1 octet att_event: 1 octet Event ID/Code event_result: 2 octets Result Code datalen: 1 octet 0x00- BLE_MAX_ATT_PDU_EVT_ LEN (50) ATT Handle Index. Note: If ATT is configured to support maximum of one connection, att_id will have value 0x00. Application handling BLE_ATT_DATA_EVENT shall use the same att_id in the associated ATT messages sent using BLE_ATT_DATA_COMMAND. Device Handle of the peer Bluetooth device that is connected to the local device. The device handle for any Bluetooth device connection is notified as one of the data in the HCI Connection Complete Event ATT Event Code. Refer BACI ATT Event list API SUCCESS or any of the ATT Protocol or Internal Error Codes, as defined in BT_att_api.h and BT_error.h Number of bytes in the event_data parameter event_data: BLE_MAX_ATT_PDU_EVENT_LEN datalen bytes (Max Data bytes corresponding to the ATT Event Code. Refer BACI ATT BLE_MAX_ATT_PDU_ Command/Event list EVT_LEN= 50) 29

BACI ATT Events List ATT Event (Event Code) ATT_CONNECTION_IND (0x81) ATT_DISCONNECTION_IND (0x82) ATT_ERROR_RSP (0x01) ATT_XCNHG_MTU_REQ (0x02) ATT_XCHNG_MTU_RSP (0x03) ATT_FIND_INFO_REQ (0x04) ATT_FIND_INFO_RSP (0x05) ATT_FIND_BY_TYPE_VAL_REQ (0x06) ATT_FIND_BY_TYPE_VAL_RSP (0x07) ATT_READ_BY_TYPE_REQ (0x08) ATT_READ_BY_TYPE_RSP (0x09) ATT_READ_REQ (0x0A) ATT_READ_RSP (0x0B) ATT_READ_BLOB_REQ (0x0C) ATT_READ_BLOB_RSP (0x0D) ATT_READ_MULTIPLE_REQ (0x0E) ATT_READ_MULTIPLE_RSP (0x0F) Event Data On Connection Complete 6 octets BD_ADDR 1 octet Address type On Disconnection Complete 6 octets BD_ADDR 1 octet Address type ATT Error Response PDU 1 octet - Req_OpCode 2 octets Attribute Handle 1 octet Error Code ATT Exchange MTU Request PDU 2 octets Client Rx MTU ATT Exchange MTU Response PDU 2 octets Server Tx MTU ATT Find Information Request PDU 2 octets Start Handle 2 octets End Handle ATT Find Information Response PDU 1 octet UUID Format ( if 0x01 : 16 bit UUID; if 0x02 : 128 bit UUID) 4 to (ATT_MTU-2) octets - Handle UUID pair will consist of 2 octets Handle 2 octets(or 16 octets) 16bit UUID (or 128bit UUID) depending upon the UUID Format selected ATT Find By Type Request PDU 2 octets Start Handle 2 octets End Handle 2 octets - Attribute Type(UUID) 0 to (ATT_MTU-7) octets Attribute (of Length octets) ATT Find By Type Response PDU 4 to (ATT_MTU-1) octets Handle Information list, consists of 2 octets Start Handle 2 octets End Handle ATT Read By Type Request PDU 2 octets Start Handle 2 octets End Handle 2 octets (or 16 octets) 16-bit UUID (or 128-bit UUID) depending upon the UUID Format Selected ATT Read By Type Response PDU 1 octet Length 2 to (ATT_MTU-2) octets : Attribute data list, consists of 2 octets Attribute Handle (Length-2) octets Attribute ATT Read Request PDU 2 octets Attribute Handle ATT Read Response PDU 0 to (ATT_MTU -1) octets : Attribute ATT Read Blob Request PDU 2 octets Attribute Handle 2 octets Offset ATT Read Blob Response PDU 0 to (ATT_MTU-1) octets Part Attribute ATT Read Multiple Request PDU 4 to (ATT_MTU-1) octets Set Of Handles consists of 2 octets - each handle ATT Read Multiple Response PDU 0 to (ATT_MTU-1) octets Set of s 30

ATT Event (Event Code) ATT_READ_BY_GROUP_TYPE_REQ (0x10) ATT_READ_BY_GROUP_TYPE_RSP (0x11) ATT_WRITE_REQ (0x12) ATT_WRITE_RSP (0x13) ATT_WRITE_CMD (0x52) ATT_SIGNED_WRITE_CMD (0xD2) ATT_PREPARE_WRITE_REQ (0x16) ATT_PREPARE_WRITE_RSP (0x17) ATT_EXECUTE_WRITE_REQ (0x18) ATT_EXECUTE_WRITE_RSP (0x19) ATT_HANDLE_VALUE_NTF (0x1B) ATT_HANDLE_VALUE_IND (0x1D) ATT_HANDLE_VALUE_CNF (0x1E) ATT_UNKNOWN_PDU_IND (0xFF) Event Data ATT Read Group Type Request PDU 2 octets Start Handle 2 octets End Handle 2 octets(or 16 octets) 16-bit UUID( or 128-bit UUID) ATT Read Group Type Response PDU 1 octet Length 2 to (ATT_MTU-2) octets List of Attribute Data consists of 2 octets Start Handle 2 octets End Handle (Length 4) octets Attribute ATT Write Request PDU 2 octets Attribute Handle 0 to (ATT_MTU-3) octets Attribute ATT Write Response PDU ATT Write Command PDU 2 octets Attribute Handle 0 to (ATT_MTU-3) octets Attribute ATT Signed Write Command PDU 2 octets Attribute Handle 0 to (ATT_MTU -15) octets Attribute 12 octets Authentication Signature Note : This event is not supported. ATT Prepare Write Request PDU 2 octets Attribute Handle 2 octets Offset 0 to (ATT_MTU -5) octets Part Attribute ATT Prepare Write Response PDU 2 octets Attribute Handle 2 octets Offset 0 to (ATT_MTU -5) octets Part Attribute ATT Execute Write Request PDU 1 octet Flags ATT Execute Write Response PDU ATT Handle Notification PDU 2 octets Attribute Handle 0 to (ATT_MTU -3) octets Current of Attribute ATT Handle Indication PDU 2 octets Attribute Handle 0 to (ATT_MTU -3) octets Current of the Attribute ATT Handle Confirmation PDU Unknown or Unhandled PDU 31

BLE_ATT_DATA_COMMAND (0x02) This data is an ATT command used to initiate an ATT protocol action based on the ATT PDU type included in the data. att_id: 1 octet device_id: 1 octet pdu_id: 1 octet Command ID/Code datalen: 1 octet 0x00- BLE_MAX_ATT_PDU_CMD_ LEN (50) ATT Handle Index. Note: If ATT is configured to support maximum of one connection, att_id will have value 0x00. For a new connection, application receives att_id through ATT_CONNECTION_IND event as part of BLE_ATT_DATA_EVENT message Device Handle of the peer Bluetooth device that is connected to the local device. The device handle for any Bluetooth device connection is notified as one of the data in the HCI Connection Complete Event ATT Command PDU. Refer BACI ATT Command list Number of bytes in the event_data parameter event_data: BLE_MAX_ATT_PDU_COMMAND_LEN datalen bytes (Max Data bytes corresponding to the ATT Command Code. Refer BACI ATT BLE_MAX_ATT_PDU_ Command/Event list CMD_LEN = 50) 32

BACI ATT Commands List ATT Command (Command Code) ATT_ERROR_RSP (0x01) ATT_XCNHG_MTU_REQ (0x02) ATT_XCHNG_MTU_RSP (0x03) ATT_FIND_INFO_REQ (0x04) ATT_FIND_INFO_RSP (0x05) ATT_FIND_BY_TYPE_VAL_REQ (0x06) ATT_FIND_BY_TYPE_VAL_RSP (0x07) ATT_READ_BY_TYPE_REQ (0x08) ATT_READ_BY_TYPE_RSP (0x09) ATT_READ_REQ (0x0A) ATT_READ_RSP (0x0B) ATT_READ_BLOB_REQ (0x0C) ATT_READ_BLOB_RSP (0x0D) Event Data ATT Error Response PDU 2 octets Attribute Handle 1 octet - Req_OpCode 1 octet Error Code ATT Exchange MTU Request PDU 2 octets Client Rx MTU ATT Exchange MTU Response PDU 2 octets Server Rx MTU ATT Find Information Request PDU 2 octets Start Handle 2 octets End Handle ATT Find Information Response PDU 1 octets UUID Format ( if 0x01 : 16 bit UUID; if 0x02 : 128 bit UUID) 1 octet Don t care 2 octets Count (number of handle-uuid pair) 4 to (ATT_MTU-2) octets - Handle UUID pair will consist of 2 octets Handle 2 octets(or 16 octets) 16bit UUID (or 128bit UUID) depending upon the UUID Format selected ATT Find By Type Request PDU 2 octets - UUID 2 octets Start Handle 2 octets End Handle 2 octets Length of Attribute 0 to (ATT_MTU-7) octets Attribute (of Length octets) ATT Find By Type Response PDU 2 octets Count (Number of Handle pairs) 4 to (ATT_MTU-1) octets Handle Information list, consists of 2 octets Start Handle 2 octets End Handle ATT Read By Type Request PDU 2 octets Start Handle 2 octets End Handle 1 octet UUID Format 2 octets (or 16 octets) 16-bit UUID (or 128-bit UUID) depending upon the UUID Format selected ATT Read By Type Response PDU 2 octets - Actual count (Number actually packed. Not Used. Don t Care. ) 2 octets Count ( Number of pairs in the list) 2 to (ATT_MTU-2) octets : Attribute data list, consists of 2 octets Attribute Handle 2 octets Attribute Length (variable) octets-attribute value (of length octets) ATT Read Request PDU 2 octets Attribute Handle ATT Read Response PDU 2 octets Attribute Length 0 to (ATT_MTU -1) octets : Attribute (of length octets) ATT Read Blob Request PDU 2 octets Attribute Handle 2 octets Offset ATT Read Blob Response PDU 2 octets Attribute length 0 to (ATT_MTU-1) octets Part Attribute (of length octets) 33

ATT Command (Command Code) ATT_READ_MULTIPLE_REQ (0x0E) ATT_READ_MULTIPLE_RSP (0x0F) ATT_READ_BY_GROUP_TYPE_REQ (0x10) ATT_READ_BY_GROUP_TYPE_RSP (0x11) ATT_WRITE_REQ (0x12) ATT_WRITE_RSP (0x13) ATT_WRITE_CMD (0x52) ATT_SIGNED_WRITE_CMD (0xD2) Event Data ATT Read Multiple Request PDU 2 octets Count (number of Handles) 4 to (ATT_MTU-1) octets Handles info consists of 2 octets - each handle ATT Read Multiple Response PDU 2 octets Count (number of s) 0 to (ATT_MTU-1) octets Set of s consists of 2 octets Length (variable) octets ATT Read Group Type Request PDU 2 octets Start Handle 2 octets End Handle 1 octet UUID Format 2 octets(or 16 octets) 16-bit UUID( or 128-bit UUID) ATT Read Group Type Response PDU 2 octets Actual count. Not Used. Don t care. 2 octets Count 2 octets Each Attribute Length 6 to (ATT_MTU-2) octets List of Attribute Data consists of 2 octets Start Handle 2 octets End Handle Length octets Attribute ATT Write Request PDU 2 octets Attribute Handle 2 octets Length 0 to (ATT_MTU-3) octets Attribute (of Length octets) ATT Write Response PDU ATT Write Command PDU 2 octets Attribute Handle 2 octets Length 0 to (ATT_MTU-3) octets Attribute (of length octets) ATT Signed Write Command PDU 2 octets Attribute Handle 2 octets Length 0 to (ATT_MTU -15) octets Attribute 12 octets Authentication Signature Note : This command is not supported. ATT_PREPARE_WRITE_REQ (0x16) ATT_PREPARE_WRITE_RSP (0x17) ATT_EXECUTE_WRITE_REQ (0x18) ATT_EXECUTE_WRITE_RSP (0x19) ATT_HANDLE_VALUE_NTF ATT Prepare Write Request PDU 2 octets Offset 2 octets Attribute Handle 2 octets Length 0 to (ATT_MTU -5) octets Part Attribute (of length octets) ATT Prepare Write Response PDU 2 octets Offset 2 octets Attribute Handle 2 octets Length 0 to (ATT_MTU -5) octets Part Attribute (of length octets) ATT Execute Write Request PDU 1 octet Flags ATT Execute Write Response PDU ATT Handle Notification PDU 34

ATT Command (Command Code) (0x1B) ATT_HANDLE_VALUE_IND (0x1D) ATT_HANDLE_VALUE_CNF (0x1E) ATT_UNKNOWN_PDU_IND (0xFF) Event Data 2 octets Attribute Handle 2 octets Length 0 to (ATT_MTU -3) octets Current of Attribute (of length octets) ATT Handle Indication PDU 2 octets Attribute Handle 2 octets Length 0 to (ATT_MTU -3) octets Current of the Attribute (of length octets) ATT Handle Confirmation PDU Unknown or Unhandled PDU 35

BLE_SMP_DATA_EVENT (0x03) This data is an SMP event used to notify an SMP protocol event resulting due to a local or peer SMP action. device_id: 1 octet smp_event: 1 octet Event ID/Code event_result: 2 octets Result Code datalen: 1 octet 0x00- BLE_MAX_SMP_PDU_ EVT_LEN (66) Device Handle of the peer Bluetooth device that is connected to the local device. The device handle for any Bluetooth device connection is notified as one of the data in the Connection Complete Event SMP Event Code. Refer BACI SMP Event list API SUCCESS or any of the SMP Protocol or Internal Error Codes, as defined in BT_smp_api.h and BT_error.h Number of bytes in the event_data parameter event_data: BLE_MAX_SMP_PDU_EVENT_LEN datalen bytes (Max Data bytes corresponding to the SMP Event Code. Refer BACI SMP BLE_MAX_SMP_PDU_ Event list EVT_LEN = 66) 36

BACI SMP Event List SMP Event (SMP Event Code) SMP_AUTHENTICATION_COMPLETE (0x01) SMP_AUTHENTICATION_REQUEST (0x02) SMP_PASSKEY_ENTRY_REQUEST (0x03) SMP_PASSKEY_DISPLAY_REQUEST (0x04) SMP_LONG_TERM_KEY_REQUEST (0x05) SMP_KEY_EXCHANGE_INFO_REQUEST (0x06) SMP_KEY_EXCHANGE_INFO (0x07) SMP_RESOLVABLE_PVT_ADDR_CREATE_CNF (0x08) SMP_RESOLVABLE_PVT_ADDR_VERIFY_CNF (0x09) Event Data When received because of SMP_BACI_AUTHENTICATION_REQUEST SMP Command, 1 octet security level established (1-Without MITM/2-With MITM) 1 octet bonding information (0-No Bonding/1-Bonding) 1 octet Encryption Key Size negotiated When received because of SMP_BACI_ENCRYPTION_REQUEST SMP Command, event_data is not applicable and datalen is 0 1 octet security level established (1-Without MITM/2-With MITM) 1 octet bonding information (0-No Bonding/1-Bonding) 1 octet Encryption Key Size negotiated 4 octets of UINT32 passkey to be unpacked 8 octets of RAND 2 octets of UINT16 Encrypted Diversifier to be unpacked 1 octet of local key distribution information negotiated Bit 0: Local Encryption information Bit 1: Local Identity information Bit 2: Local Signature Key Bit 3-7: NA 1 octet of Encryption Key size negotiated 16 octets of Long Term Key 2 octets of UINT16 Encrypted Diversifier packed 8 octets of RAND 16 octets of Identity Resolving Key 7 octets of Identity Address information 1 octet Address Type (First Octet) 6 octets Bluetooth Device Address (Least Significant Octet First Order) 16 octets of Signature Resolving Key 1 octet of remote key distribution information negotiated Bit 0: Remote Encryption information Bit 1: Remote Identity information Bit 2: Remote Signature Key Bit 3-7: NA 1 octet of Encryption Key size negotiated 6 octets of resolvable private address created 6 octets of resolvable private address verified 37

BLE_SMP_DATA_COMMAND (0x04) This data is an SMP command used to initiate a SMP protocol action based on the SMP PDU type included in the data. device_id: 1 octet pdu_id: 1 octet Command ID/Code datalen: 1 octet 0x00- BLE_MAX_SMP_PDU_ CMD_LEN (66) Device Handle of the peer Bluetooth device that is connected to the local device. The device handle for any Bluetooth device connection is notified as one of the data in the Connection Complete Event SMP Command PDU. Refer BACI SMP Command list Number of bytes in the event_data parameter event_data: BLE_MAX_SMP_PDU_COMMAND_LEN datalen bytes (Max Data bytes corresponding to the SMP Command Code BLE_MAX_SMP_PDU_ CMD_LEN = 66) 38

BACI SMP Command List SMP Command (SMP Command Code) BACI_SMP_AUTHENTICATION_ REQUEST (0x00) BACI_SMP_AUTHENTICATION_ REQUEST_REPLY (0x01) BACI_SMP_PASSKEY_ENTRY_ REQUEST_REPLY (0x02) BACI_SMP_LONG_TERM_KEY_ REQUEST_REPLY (0x03) BACI_SMP_KEY_EXCHANGE_ INFO_REQUEST_REPLY (0x04) BACI_SMP_RESOLVABLE_ PVT_ADDR_CREATE (0x05) BACI_SMP_RESOLVABLE_ PVT_ADDR_VERIFY (0x06) BACI_SMP_ENCRYPTION_ REQUEST (0x07) Event Data 1 octet Security Level (1-Without MITM/2-With MITM) 1 octet Bonding (0-No Bonding/1-Bonding) 1 octet Minimum Encryption Key Size required 1 octet local IO Capability 1 octet local and remote key distribution specification Bit 0: Local Encryption information Bit 1: Local Identity information Bit 2: Local Signature Key Bit 3: Reserved Bit 4: Remote Encryption information Bit 5: Remote Identity information Bit 6: Remote Signature Key Bit 7: Reserved 1 octet maximum encryption key size supported 1 octet OOB data availability (0-No OOB data/1-oob data available) 16 octets of OOB data if above octet is 1 1 octet Security Level (1-Without MITM/2-With MITM) 1 octet Bonding (0-No Bonding/1-Bonding) 1 octet Minimum Encryption Key Size required 1 octet RejectCode (0-Accept Auth Req/Error Code-Reject) 1 octet local IO Capability 1 octet local and remote key distribution specification Bit 0: Local Encryption information Bit 1: Local Identity information Bit 2: Local Signature Key Bit 3: Reserved Bit 4: Remote Encryption information Bit 5: Remote Identity information Bit 6: Remote Signature Key Bit 7: Reserved 1 octet maximum encryption key size supported 1 octet OOB data availability (0-No OOB data/1-oob data available) 16 octets of OOB data if above octet is 1 1 octet status (1-Positive reply/0-negative Reply), if above octet is 1 4 octets of UINT32 decimal passkey packed 1 octet status (1-Positive reply/0-negative Reply) 16 octets of Long Term Key, if above octet is 1 16 octets of Long Term Key 2 octets of UINT16 Encryption Diversifier packed 8 octets of RAND 16 octets of Identity Resolving Key 7 octets of Identity Address information 1 octet Address Type (First Octet) 6 octets Bluetooth Device Address (Least Significant Octet First Order) 16 octets of Signature Resolving Key 16 octets of Identity Resolving Key 6 octets of BD Address to be verified 16 octets of Identity Resolving Key 8 octets of RAND 2 octets of UINT16 Encryption Diversifier packed 16 octets of Long Term Key 39