Tester protocol for Bluetooth stack *********************************** Copyright (C) 2015 Intel Corporation Overview ======== This document describes the format of data used for communicating between tester and implementation under test (IUT). The protocol is SOCK_STREAM based and follows a strict PDU specification with a generic header and initial registration exchange. The communication is driven from tester with commands/response exchange. The protocol is single PDU exchanged based, meaning every command requires a response. IUT will use events to signal notifications. Commands and events use single socket. All services are multi-plexed over same socket. .-- IUT --. .--Tester--. | | | | | | Command | | | | <-------------------------- | | | | | | | | Response | | | | --------------------------> | | | | | | | | Event | | | | --------------------------> | | | | | | '-----------' '----------' Packet Structures ================= Every packet will follow the basic header to support simple multi-plexing over the same socket. It will also support a basic control channel with service id 0. Due to use of single socket for command/response and events it is possible that event(s) will be received before response to command. 0 8 16 24 40 +------------+--------+------------------+-------------+ | Service ID | Opcode | Controller Index | Data Length | +------------+--------+------------------+-------------+ | | The unique service ID is assigned by this specification for each service supported by tester. As general rule of thumb, the opcode for command matches the opcode for a response. Or the opcode 0x00 for an error is returned. Events opcodes start from 0x80. All fields are in little-endian byte order (least significant byte first). Controller Index can have a special value to indicate that command or event is not related to any controller. Possible values: 0x00 to 0xFE 0xFF Error response is common for all services and has fixed structure: Opcode 0x00 - Error response Response parameters: Status (1 octet) Valid status values: 0x01 = Fail 0x02 = Unknown Command 0x03 = Not ready 0x04 = Invalid Index Core Service (ID 0) =================== Commands and responses: Opcode 0x00 - Error response Opcode 0x01 - Read Supported Commands command/response Controller Index: Command parameters: Response parameters: (variable) Each bit in response is a flag indicating if command with opcode matching bit number is supported. Bit set to 1 means that command is supported. Bit 0 is reserved and shall always be set to 0. If specific bit is not present in response (less than required bytes received) it shall be assumed that command is not supported. In case of an error, the error response will be returned. Opcode 0x02 - Read Supported Services command/response Controller Index: Command parameters: Response parameters: (variable) Each bit in response is a flag indicating if service with ID matching bit number is supported. Bit set to 1 means that service is supported. If specific bit is not present in response (less than required bytes received) it shall be assumed that service is not supported. In case of an error, the error response will be returned. Opcode 0x03 - Register Service command/response Controller Index: Command parameters: Service ID (1 octet) Response parameters: In case a command is sent for an undeclared service ID, it will be rejected. Also there will be no events for undeclared service ID. In case of an error, the error response will be returned. Opcode 0x04 - Unregister Service command/response Controller Index: Command parameters: Service ID (1 octet) Response parameters: In case of an error, the error response will be returned. Events: Opcode 0x80 - IUT ready event Controller Index: Event parameters: This event indicates that IUT has been initialized and is ready to receive BTP commands. Tester shall wait for this event before sending any command to the IUT. GAP Service (ID 1) ================== Commands and responses: Opcode 0x00 - Error response Opcode 0x01 - Read Supported Commands command/response Controller Index: Command parameters: Response parameters: (variable) Each bit in response is a flag indicating if command with opcode matching bit number is supported. Bit set to 1 means that command is supported. Bit 0 is reserved and shall always be set to 0. If specific bit is not present in response (less than required bytes received) it shall be assumed that command is not supported. In case of an error, the error response will be returned. Opcode 0x02 - Read Controller Index List command/response Controller Index: Command parameters: Response parameters: Number of Controllers (1 octet) Controller Index[i] (1 octet) This command returns the list of controllers. In case of an error, the error response will be returned. Opcode 0x03 - Read Controller Information command/response Controller Index: Command parameters: Response parameters: Address (6 Octets) Supported_Settings (4 Octets) Current_Settings (4 Octets) Class_Of_Device (3 Octets) Name (249 Octets) Short_Name (11 Octets) This command is used to retrieve the current state and basic information of a controller. It is typically used right after getting the response to the Read Controller Index List command Current_Settings and Supported_Settings is a bitmask with currently the following available bits: 0 Powered 1 Connectable 2 Fast Connectable 3 Discoverable 4 Bondable 5 Link Level Security (Sec. mode 3) 6 Secure Simple Pairing 7 Basic Rate/Enhanced Data Rate 8 High Speed 9 Low Energy 10 Advertising 11 Secure Connections 12 Debug Keys 13 Privacy 14 Controller Configuration 15 Static Address In case of an error, the error response will be returned. Opcode 0x04 - Reset command/response Controller Index: Command parameters: Response parameters: Current_Settings (4 Octets) This allows to clean up any state data (eg. keys) and restore controller to its default system state. In case of an error, the error response will be returned. Opcode 0x05 - Set Powered command/response Controller Index: Command parameters: Powered (1 octet) Response parameters: Current_Settings (4 Octets) Valid Powered values: 0x00 = Off 0x01 = On This command is used to power on or off a controller. In case of an error, the error response will be returned. Opcode 0x06 - Set Connectable command/response Controller Index: Command parameters: Connectable (1 octet) Response parameters: Current_Settings (4 Octets) Valid Connectable values: 0x00 = Off 0x01 = On This command is used to set controller connectable. In case of an error, the error response will be returned. Opcode 0x07 - Set Fast Connectable command/response Controller Index: Command parameters: Fast Connectable (1 octet) Response parameters: Current_Settings (4 Octets) Valid Fast Connectable values: 0x00 = Off 0x01 = On This command is used to set controller fast connectable. This command is only available for BR/EDR capable controllers. In case of an error, the error response will be returned. Opcode 0x08 - Set Discoverable command/response Controller Index: Command parameters: Discoverable (1 octet) Response parameters: Current_Settings (4 Octets) Valid Discoverable values: 0x00 = Off 0x01 = General Discoverable 0x02 = Limited Discoverable This command is used to set controller discoverable. In case of an error, the error response will be returned. Opcode 0x09 - Set Bondable command/response Controller Index: Command parameters: Bondable (1 octet) Response parameters: Current_Settings (4 Octets) Valid Bondable values: 0x00 = Off 0x01 = On This command is used to set controller bondable. In case of an error, the error response will be returned. Opcode 0x0a - Start Advertising command/response Controller Index: Command parameters: Adv_Data_Len (1 octet) Scan_Rsp_len (1 octet) Adv_Data (0-255 octets) Scan_Rsp (0-255 octets) Return Parameters: Current_Settings (4 Octets) This command is used to start advertising. In case of an error, the error response will be returned. Opcode 0x0b - Stop Advertising command/response Controller Index: Command parameters: Return Parameters: Current_Settings (4 Octets) This command is used to stop advertising. In case of an error, the error response will be returned. Opcode 0x0c - Start Discovery command/response Controller Index: Command parameters: Flags (1 octet) Return Parameters: Possible values for the Flags parameter are a bit-wise or of the following bits: 0 = LE scan 1 = BR/EDR scan 2 = Use limited discovery procedure 3 = Use active scan type 4 = Use observation procedure This command is used to start discovery. Observation Procedure allows to receive advertisements (and scan responses) from broadcasters (that are not visible during General or Limited discovery, because those are not discoverable). This procedure can use either passive or active scan type. If "Use observation procedure" (bit 4) is set, "Use limited discovery procedure" (bit 2) is excluded. In case of an error, the error response will be returned. Opcode 0x0d - Stop Discovery command/response Controller Index: Command parameters: Return Parameters: This command is used to stop discovery. In case of an error, the error response will be returned. Opcode 0x0e - Connect command/response Controller Index: Command parameters: Address_Type (1 octet) Address (6 octets) Return Parameters: Valid Address_Type parameter values: 0x00 = Public 0x01 = Random This command is used to create a Link Layer connection with remote device. In case of an error, the error response will be returned. Opcode 0x0f - Disconnect command/response Controller Index: Command parameters: Address_Type (1 octet) Address (6 octets) Return Parameters: Valid Address_Type parameter values: 0x00 = Public 0x01 = Random This command is used to terminate an existing connection or to cancel pending connection attempt. In case of an error, the error response will be returned. Opcode 0x10 - Set IO Capability command/response Controller Index: Command parameters: IO_Capability (1 octet) Return Parameters: Valid IO_Capabilities parameter values: 0x00 = Display Only 0x01 = Display Yes/No 0x02 = Keyboard Only 0x03 = No Input, No Output 0x04 = Keyboard Display This command is used to set IO capability. In case of an error, the error response will be returned. Opcode 0x11 - Pair command/response Controller Index: Command parameters: Address_Type (1 octet) Address (6 octets) Return Parameters: This command is used to initiate pairing with remote. In case of an error, the error response will be returned. Opcode 0x12 - Unpair command/response Controller Index: Command parameters: Address_Type (1 octet) Address (6 octets) Return Parameters: This command is used to unpair with remote. In case of an error, the error response will be returned. Opcode 0x13 - Passkey Entry Response command/response Controller Index: Command parameters: Address_Type (1 octet) Address (6 octets) Passkey (4 octets) Return Parameters: This command is used to response with passkey for pairing request. In case of an error, the error response will be returned. Opcode 0x14 - Passkey Confirmation Response command/response Controller Index: Command parameters: Address_Type (1 octet) Address (6 octets) Match (1 octet) Return Parameters: This command is used to response for pairing request with confirmation in accordance with initiator and responder passkey. In case of an error, the error response will be returned. Events: Opcode 0x80 - New Settings event Controller Index: Event parameters: Current_Settings (4 octets) This event indicates that one or more of the settings for a controller has changed. Opcode 0x81 - Device Found event Controller Index: Event parameters: Address (6 octets) Address_Type (1 octet) RSSI (1 octet) Flags (1 octet) EIR_Data_Length (2 Octets) EIR_Data (0-65535 Octets) Possible values for the Flags parameter are a bit-wise or of the following bits: 0 = RSSI valid 1 = Adv_Data included 2 = Scan_Rsp included This event indicates that a device was found during device discovery. Opcode 0x82 - Device Connected event Controller Index: Event parameters: Address_Type (1 octet) Address (6 octets) This event indicates that a device was connected. Opcode 0x83 - Device Disconnected event Controller Index: Event parameters: Address_Type (1 octet) Address (6 octets) This event indicates that a device was disconnected. Opcode 0x84 - Passkey Display event Controller Index: Event parameters: Address_Type (1 octet) Address (6 octets) Passkey (4 octets) This event indicates that passkey was received and it needs to be confirmed on remote side. Opcode 0x85 - Passkey Enter Request event Controller Index: Event parameters: Address_Type (1 octet) Address (6 octets) This event indicates that remote requests for passkey enter. Opcode 0x86 - Passkey Confirm Request event Controller Index: Event parameters: Address_Type (1 octet) Address (6 octets) Passkey (4 octets) This event indicates that passkey needs to be confirmed. Opcode 0x87 - Identity Resolved event Controller Index: Event parameters: Address_Type (1 octet) Address (6 octets) Identity_Address_Type (1 octet) Identity_Address (6 octets) This event indicates that the remote Identity Address has been resolved. GATT Service (ID 2) =================== Commands and responses: Opcode 0x00 - Error response Opcode 0x01 - Read Supported Commands command/response Controller Index: Command parameters: Response parameters: (variable) Each bit in response is a flag indicating if command with opcode matching bit number is supported. Bit set to 1 means that command is supported. Bit 0 is reserved and shall always be set to 0. If specific bit is not present in response (less than required bytes received) it shall be assumed that command is not supported. In case of an error, the error response will be returned. Opcode 0x02 - Add Service Controller Index: Command parameters: Type (1 octet) UUID_Length (1 octet) UUID (2 or 16 octets) Response parameters: Service_ID (2 octets) Valid Type parameter values: 0x00 = Primary 0x01 = Secondary Valid UUID_Length parameter values: 0x02 = UUID16 0x10 = UUID128 This command is used to add new service to GATT Server. Service ID of service declaration is returned in the response. Attribute database shall be initiated sequentially. After this issuing this command tester shall add characteristics or included services this service contains. In case of an error, the error response will be returned. Opcode 0x03 - Add Characteristic Controller Index: Command parameters: Service_ID (2 octets) Properties (1 octet) Permissions (1 octet) UUID_Length (1 octet) UUID (2 or 16 octets) Response parameters: Characteristic_ID (2 octets) Possible values for Service_ID: 0x0000 = Add in sequence 0x0001-0xffff = Add to service Possible response parameters: 0x0000 = Relative ID, will be set after start_server 0x0001-0xffff = ID in db Possible values for the Properties parameter are a bit-wise of the following bits: 0 Broadcast 1 Read 2 Write Without Response 3 Write 4 Notify 5 Indicate 6 Authenticated Signed Writes 7 Extended Properties Possible values for the Permissions parameter are a bit-wise of the following bits: 0 Read 1 Write 2 Read with Encryption 3 Write with Encryption 4 Read with Authentication 5 Write with Authentication 6 Read with Authorization 7 Write with Authorization This command is used to add new characteristic to GATT Server. Characteristic ID of characteristic declaration is returned in the response. Attribute's database shall be initiated sequentially. After issuing this command tester can add descriptors to this characteristic. In case of an error, the error response will be returned. Opcode 0x04 - Add Descriptor Controller Index: Command parameters: Characteristic_ID (2 octets) Permissions (1 octet) UUID_Length (1 octet) UUID (2 or 16 octets) Response parameters: Descriptor_ID (2 octets) Possible values for Characteristic_ID: 0x0000 = Add in sequence 0x0001-0xffff = Add to characteristic Possible response parameters: 0x0000 = Relative ID, will be set after start_server 0x0001-0xffff = ID in db This command is used to add new characteristic descriptor to GATT Server. The command shall be used right after Add Characteristic or previous Add Descriptor command. In case of an error, the error response will be returned. Opcode 0x05 - Add Included Service Controller Index: Command parameters: Service_ID (2 octets) Response parameters: Included_Service_ID (2 octets) This command is used to add new included service declaration to GATT Server. Service that is going to be included has to be already added to the server. Attribute_ID of include declaration is returned in the response. In case of an error, the error response will be returned. Opcode 0x06 - Set Characteristic/Descriptor Value Controller Index: Command parameters: Attribute_ID (2 octets) Value_Length (2 octet) Value (1-512 octets) Response parameters: Possible values for Characteristic_ID: 0x0000 = Set last attribute in db value 0x0001-0xffff = Set value of attribute under ID This command is used to set the value of characteristic or descriptor. In case of an error, the error response will be returned. Opcode 0x07 - Start Server Controller Index: Command parameters: Response parameters: Database_Attribute_Offset (2 octets) Database_Attribute_Count (1 octet) This command is used to start server with previously prepared attributes database. Device database may contain predefined attributes. Predefined attributes should be registered before attempt to register sequential database. Subsequent calls of this command shall return an error. In case of an error, the error response will be returned. Opcode 0x08 - Reset Server Controller Index: Command parameters: Response parameters: This command is used to clear the server from attributes. In case of an error, the error response will be returned. Opcode 0x09 - Set Required Encryption Key Size Controller Index: Command parameters: Attribute_ID (2 octets) Encryption_Key_Size (1 octet) Response parameters: Possible values for Attribute_ID: 0x0000 = Set encryption key of last added attribute 0x0001-0xffff = Set enctryption of attribute under ID This command is used to set required Encryption Key Size of an attribute. It shall be used only if encryption or authentication is needed to have access to this attribute. Otherwise an error shall be returned. Possible values for Encryption_Key_Size parameter are: <0x07, 0x0f> In case of an error, the error response will be returned. Opcode 0x0a - Exchange MTU Controller Index: Command parameters: Address_Type (1 octet) Address (6 octets) Response parameters: This command is used by GATT Client to configure ATT protocol. IUT is expected to send Exchange MTU Request to negotiate MTU size. In case of an error, the error response will be returned. Opcode 0x0b - Discover All Primary Services Controller Index: Command parameters: Address_Type (1 octet) Address (6 octets) Response parameters: Services_Count (1 octet) [array] Service (variable) Object Service is defined as: Start_Handle (2 octets) End_Group_Handle (2 octets) UUID_Length (1 octet) UUID (2 or 16 octets) Valid UUID_Length parameter values: 0x02 = UUID16 0x10 = UUID128 This procedure is used by a client to discover all primary services on a server. Services found during discovery are returned in the response. In case of an error, the error response will be returned. Opcode 0x0c - Discover Primary Service by UUID Controller Index: Command parameters: Address_Type (1 octet) Address (6 octets) UUID_Length (1 octet) UUID (2 or 16 octets) Response parameters: Services_Count (1 octet) [array] Service (variable) Object Service is defined as: Start_Handle (2 octets) End_Group_Handle (2 octets) UUID_Length (1 octet) UUID (2 or 16 octets) Valid UUID_Length parameter values: 0x02 = UUID16 0x10 = UUID128 This procedure is used by a client to discover primary services with specific UUID on a server. Services found during discovery are returned in the response. In case of an error, the error response will be returned. Opcode 0x0d - Find Included Services Controller Index: Command parameters: Address_Type (1 octet) Address (6 octets) Service_Start_Handle (2 octets) Service_End_Handle (2 octets) Response parameters: Services_Count (1 octet) [array] Included_Service (variable) Object Included_Service is defined as: Included_Handle (2 octets) Type (1 octet) Service (7 or 21 octets) Valid Type parameter values: 0x00 = Primary 0x01 = Secondary Object Service is defined as: Start_Handle (2 octets) End_Group_Handle (2 octets) UUID_Length (1 octet) UUID (2 or 16 octets) Valid UUID_Length parameter values: 0x02 = UUID16 0x10 = UUID128 This procedure is used by a client to discover service relationships to other services. Services found during discovery are returned in the response. Opcode 0x0e - Discover All Characteristics of a Service Controller Index: Command parameters: Address_Type (1 octet) Address (6 octets) Service_Start_Handle (2 octets) Service_End_Handle (2 octets) Response parameters: Characteristics_Count (1 octet) [array] Characteristic (variable) Object Characteristic is defined as: Characteristic_Handle (2 octets) Value_Handle (2 octets) Properties (1 octet) UUID_Length (1 octet) UUID (2 or 16 octets) Valid UUID_Length parameter values: 0x02 = UUID16 0x10 = UUID128 This procedure is used by a client to discover all characteristics within specified service range. Characteristics found during discovery are returned in the response. In case of an error, the error response will be returned. Opcode 0x0f - Discover Characteristics by UUID Controller Index: Command parameters: Address_Type (1 octet) Address (6 octets) Start_Handle (2 octets) End_Handle (2 octets) UUID_Length (1 octet) UUID (2 or 16 octets) Response parameters: Characteristics_Count (1 octet) [array] Characteristic (variable) Object Characteristic is defined as: Characteristic_Handle (2 octets) Value_Handle (2 octets) Properties (1 octet) UUID_Length (1 octet) UUID (2 or 16 octets) Valid UUID_Length parameter values: 0x02 = UUID16 0x10 = UUID128 This procedure is used by a client to discover characteristic declarations with given UUID on a server. Characteristics found during discovery are returned in the response. In case of an error, the error response will be returned. Opcode 0x10 - Discover All Characteristic Descriptors Controller Index: Command parameters: Address_Type (1 octet) Address (6 octets) Start_Handle (2 octets) End_Handle (2 octets) Response parameters: Descriptors_Count (1 octet) [array] Descriptor (variable) Object Descriptor is defined as: Descriptor_Handle (2 octets) UUID_Length (1 octet) UUID (2 or 16 octets) Valid UUID_Length parameter values: 0x02 = UUID16 0x10 = UUID128 This procedure is used by a client to discover all the characteristic descriptors contained within characteristic. Descriptors found during discovery are returned in the response. In case of an error, the error response will be returned. Opcode 0x11 - Read Characteristic Value/Descriptor Controller Index: Command parameters: Address_Type (1 octet) Address (6 octets) Handle (2 octets) Response parameters: ATT_Response (1 octet) Data_Length (2 octets) Data (variable) This procedure is used to read a Characteristic Value or Characteristic Descriptor from a server. Read results are returned in the response to this command. ATT_Response shall be set to 0x00, if Read has been completed successfully. Otherwise it shall be set to ATT error code received. In case of an error, the error response will be returned. Opcode 0x12 - Read Using Characteristic UUID Controller Index: Command parameters: Address_Type (1 octet) Address (6 octets) Start_Handle (2 octets) End_Handle (2 octets) UUID_Length (1 octet) UUID (2 or 16 octets) Response parameters: ATT_Response (1 octet)s Data_Length (2 octets) Data (variable) Valid UUID_Length parameter values: 0x02 = UUID16 0x10 = UUID128 This procedure is used to read a Characteristic Value from a server when characteristic UUID is known. Read results are returned in the response to this command. ATT_Response shall be set to 0x00, if Read has been completed successfully. Otherwise it shall be set to ATT error code received. In case of an error, the error response will be returned. Opcode 0x13 - Read Long Characteristic Value/Descriptor Controller Index: Command parameters: Address_Type (1 octet) Address (6 octets) Handle (2 octets) Offset (2 octets) Response parameters: ATT_Response (1 octet) Data_Length (2 octets) Data (variable) This procedure is used to read Long Characteristic Value or Long Characteristic Descriptor from a server. Read results are returned in the response to this command. ATT_Response shall be set to 0x00, if Read has been completed successfully. Otherwise it shall be set to ATT error code received. In case of an error, the error response will be returned. Opcode 0x14 - Read Multiple Characteristic Values Controller Index: Command parameters: Address_Type (1 octet) Address (6 octets) Handles_Count (1 octet) Handles (variable) Response parameters: ATT_Response (1 octet) Data_Length (2 octets) Data (variable) This procedure is used to read multiple Characteristic Values from a server. Read results are returned in the response to this command. ATT_Response shall be set to 0x00, if Read has been completed successfully. Otherwise it shall be set to ATT error code received. In case of an error, the error response will be returned. Opcode 0x15 - Write Without Response Controller Index: Command parameters: Address_Type (1 octet) Address (6 octets) Handle (2 octets) Data_Length (2 octets) Data (variable) Response parameters: This procedure is used to write a Characteristic Value to a server. There is no acknowledgment that the write was successfully performed. In case of an error, the error response will be returned. Opcode 0x16 - Signed Write Without Response Controller Index: Command parameters: Address_Type (1 octet) Address (6 octets) Handle (2 octets) Data_Length (2 octets) Data (variable) Response parameters: This procedure is used to write a Characteristic Value to a server. There is no acknowledgment that the write was successfully performed. This procedure is intended to be used if client and server are bonded, and connected using non-encrypted link. In case of an error, the error response will be returned. Opcode 0x17 - Write Characteristic Value/Descriptor Controller Index: Command parameters: Address_Type (1 octet) Address (6 octets) Handle (2 octets) Data_Length (2 octets) Data (variable) Response parameters: ATT_Response (1 octet) This procedure is used to write a Characteristic Value or Characteristic Descriptor to a server. ATT_Response shall be set to 0x00, if Write has been completed successfully. Otherwise it shall be set to ATT error code received. In case of an error, the error response will be returned. Opcode 0x18 - Write Long Characteristic Value/Descriptor Controller Index: Command parameters: Address_Type (1 octet) Address (6 octets) Handle (2 octets) Offset (2 octets) Data_Length (2 octets) Data (variable) Response parameters: ATT_Response (1 octet) This procedure is used to write a Long Characteristic Value or Long Characteristic Descriptor to a server. ATT_Response shall be set to 0x00, if Write has been completed successfully. Otherwise it shall be set to ATT error code received. In case of an error, the error response will be returned. Opcode 0x19 - Reliable Write Controller Index: Command parameters: Address_Type (1 octet) Address (6 octets) Handle (2 octets) Offset (2 octets) Data_Length (2 octets) Data (variable) Response parameters: ATT_Response (1 octet) This procedure is used to write a Characteristic Value to a server and assurance is required that the correct Characteristic Value is going to be written. ATT_Response shall be set to 0x00, if Write has been completed successfully. Otherwise it shall be set to ATT error code received. In case of an error, the error response will be returned. Opcode 0x1a - Configure Notifications Controller Index: Command parameters: Address_Type (1 octet) Address (6 octets) Enable (1 octet) CCC_Handle (2 octets) Response parameters: This procedure is used to configure server to notify characteristic value to a client. In case of an error, the error response will be returned. Opcode 0x1b - Configure Indications Controller Index: Command parameters: Address_Type (1 octet) Address (6 octets) Enable (1 octet) CCC_Handle (2 octets) Response parameters: This procedure is used to configure server to indicate characteristic value to a client. In case of an error, the error response will be returned. Opcode 0x1c - Get Attributes Controller Index: Command parameters: Start Handle (2 octets) End Handle (2 octets) Type_Length (1 octet) Type (2 or 16 octets) Response parameters: Attributes_Count (1 octet) [array] Attribute (variable) Object Attribute is defined as: Handle (2 octets) Permission (1 octet) Type_Length (1 octet) Type (2 or 16 octets) Valid Type_Length parameter values: 0x02 = UUID16 0x10 = UUID128 This procedure is used to query GATT Server for attributes based on given search pattern. Attributes can be searched using Attribute Handle range and Attribute Type. In case of an error, the error response will be returned. Opcode 0x1d - Get Attribute Value Controller Index: Command parameters: Handle (2 octets) Response parameters: ATT_Response (1 octet) Value_Length (2 octet) Value (variable) This procedure is used to query GATT Server for attribute value. In case of long attribute value, multiple responses will be sent. BTP_STATUS_SUCCESS response indicates the procedure is finished. In case of an error, the error response will be returned. Events: Opcode 0x80 - Notification/Indication Received Controller Index: Event parameters: Address_Type (1 octet) Address (6 octets) Type (1 octet) Handle (2 octets) Data_Length (2 octets) Data (variable) Valid Type parameter values: 0x01 = Notification 0x02 = Indication This event indicates that IUT has received notification or notification. Opcode 0x81 - Attribute Value Changed Controller Index: Event parameters: Attribute_ID (2 octets) Data_Length (2 octet) Data (1-512 octets) This event command is used to indicate attribute (characteristic or descriptor) value changed. Event is triggered when ATT Write operation to Tester GATT Server has been performed successfully. L2CAP Service (ID 3) ================== Commands and responses: Opcode 0x00 - Error response Opcode 0x01 - Read Supported Commands command/response Controller Index: Command parameters: Response parameters: (variable) Each bit in response is a flag indicating if command with opcode matching bit number is supported. Bit set to 1 means that command is supported. Bit 0 is reserved and shall always be set to 0. If specific bit is not present in response (less than required bytes received) it shall be assumed that command is not supported. In case of an error, the error response will be returned. Opcode 0x02 - Connect command/response Controller Index: Command parameters: Address_Type (1 octet) Address (6 octets) PSM (2 octets) Response parameters: Chan_ID (1 octet) This command is used to create an L2CAP channel. Chan_ID is returned in the response to this command to allow cancellation of this connection request using Disconnect command. Connected Event (or Disconnected Event in case of an error) shall be expected after issuing this command. In case of an error, the error response will be returned. Opcode 0x03 - Disconnect command Controller Index: Command parameters: Chan_ID (1 octet) Response parameters: This command is used to close an L2CAP channel. Chan_ID is the internal application number that identifies L2CAP channel. Disconnected Event shall be expected after issuing this command. In case of an error, the error response will be returned. Opcode 0x04 - Send Data command Controller Index: Command parameters: Chan_ID (1 octet) Data_Length (2 octets) Data (Data_Length octets) Response parameters: This command is used to send data over L2CAP channel. Chan_ID is the internal application number that identifies L2CAP channel. In case of an error, the error response will be returned. Opcode 0x05 - Listen command Controller Index: Command parameters: PSM (2 octets) Transport (1 octet) Response parameters: Valid Transport parameter values: 0x00 = BR/EDR 0x01 = LE This command is used to register L2CAP PSM and listen for incoming data. In case of an error, the error response will be returned. Opcode 0x06 - Accept Connection Request Controller Index: Command parameters: Chan_ID (1 octet) Result (2 octets) Return Parameters: This command is used to accept/reject incoming connection request. Connection can be rejected with non-zero Result value (refer to the L2CAP Connection Result values). Connected Event shall be expected after issuing this command. In case of an error, the error response will be returned. Events: Opcode 0x80 - Connection Request Event Controller Index: Event parameters: Chan_ID (1 octet) PSM (2 octets) Address_Type (1 octet) Address (6 octets) This event indicates incoming request for L2CAP connection. Connection Request needs to be accepted/rejected with result code using Accept Connection Request command. Opcode 0x81 - Connected Event Controller Index: Event parameters: Chan_ID (1 octet) PSM (2 octets) Address_Type (1 octet) Address (6 octets) This event indicates new L2CAP connection. Chan_ID is the internal application number that identifies L2CAP channel. Opcode 0x82 - Disconnected Event Controller Index: Event parameters: Result (2 octets) Chan_ID (1 octet) PSM (2 octets) Address_Type (1 octet) Address (6 octets) This event indicates L2CAP disconnection. Result value is returned in the response, if remote rejected connection request only. Otherwise it shall be set to zero. Please refer to the Core Specification for possible L2CAP Connection Result values. Chan_ID is the internal application number that identifies L2CAP channel. Opcode 0x83 - Data Received Event Controller Index: Event parameters: Chan_ID (1 octet) Data_Length (2 octets) Data (Data_Length octets) This event forwards data received over L2CAP channel. Chan_ID is the internal application number that identifies L2CAP channel. Mesh Node Service (ID 4) ================== Commands and responses: Opcode 0x00 - Error response Opcode 0x01 - Read Supported Commands command/response Controller Index: Command parameters: Response parameters: (variable) Each bit in response is a flag indicating if command with opcode matching bit number is supported. Bit set to 1 means that command is supported. Bit 0 is reserved and shall always be set to 0. If specific bit is not present in response (less than required bytes received) it shall be assumed that command is not supported. In case of an error, the error response will be returned. Opcode 0x02 - Configure Provisioning command/response Controller Index: Command parameters: UUID (16 octets) Static Auth (16 octets) Output Size (1 octet) Output Actions (2 octets) Input Size (1 octet) Input Actions (2 octets) This command is used to configure provisioning options. Output actions is a bitmask with following available bits: 0 Blink 1 Beep 2 Vibrate 3 Display number 4 Display string Input actions is a bitmask with following available bits: 0 Push 1 Twist 2 Enter number 3 Enter string In case of an error, the error response will be returned. Opcode 0x03 - Provision Node command/response Controller Index: Command parameters: Network Key (16 octets) Network Key Index (2 octets) Provisioning Flags (1 octet) IV Index (4 octets) Sequence Number (4 octets) Primary Element Address (2 octets) Device Key (16 octets) This command is used to provide provisioning information. It can be used whenever unprovisioned beacon is advertising or not. In case of an error, the error response will be returned. Opcode 0x04 - Init command/response Controller Index: Command parameters: This command is used to start advertising either as unprovisioned beacon or network node. Action depends on previous configuration. In case of an error, the error response will be returned. Opcode 0x05 - Reset command/response Controller Index: Command parameters: This command is used to reset state of a provisioned node making it to start sending unprovisioned beacons. In case of an error, the error response will be returned. Opcode 0x06 - Input number command/response Controller Index: Command parameters: Number (4 octets) This command is used to reply with input number as a response to Input action event. In case of an error, the error response will be returned. Opcode 0x07 - Input string command/response Controller Index: Command parameters: String Length (1 octet) String (variable) This command is used to reply with input string as a response to Input action event. In case of an error, the error response will be returned. Opcode 0x08 - IV Update Test Mode Controller Index: Command parameters: Toggle (1 octet) Valid Toggle values: 0x00 = Disable 0x01 = Enable This command is used to toggle the IV Update test mode. In case of an error, the error response will be returned. Opcode 0x09 - IV Update toggle state Controller Index: Command parameters: This command is used to make a IV Update state transition while in IV Update test mode, ignoring the 96 hour limit. In case of an error, the error response will be returned. Opcode 0x0a - Network Send Controller Index: Command parameters: TTL (1 octet) SRC (2 octets) DST (2 octets) Payload_Len (1 octet) Payload (variable) This command is used to send network layer packet. In case of an error, the error response will be returned. Opcode 0x0b - Health Generate Faults Controller Index: Command parameters: Response parameters: Test_ID (1 octet) Current_Faults_Count (1 octet) Registered_Faults_Count (1 octet) Current_Faults (variable) Registered_Faults (variable) This command is used to generate health faults on IUT. In case of an error, the error response will be returned. Opcode 0x0c - Health Clear Faults Controller Index: Command parameters: This command is used to clear fault arrays on IUT. In case of an error, the error response will be returned. Opcode 0x0d - Low Power Node Controller Index: Command parameters: Toggle (1 octet) Valid Toggle values: 0x00 = Disable 0x01 = Enable This command is used to toggle the Low Power feature of the local device. In case of an error, the error response will be returned. Opcode 0x0e - Low Power Node Poll Controller Index: Command parameters: This command is used to send out a Friend Poll message. In case of an error, the error response will be returned. Opcode 0x0f - Model Send Controller Index: Command parameters: SRC (2 octets) DST (2 octets) Payload_Len (1 octet) Payload (variable) This command is used to send Mesh model message. In case of an error, the error response will be returned. Events: Opcode 0x80 - Output number action Event Controller Index: Event parameters: Action (2 octets) Number (4 octets) Opcode 0x81 - Output string action Event Controller Index: Event parameters: String Length (1 octet) String (variable) Opcode 0x82 - Input action Event Controller Index: Event parameters: Action (2 octets) Size (1 octet) This event indicates that input action is required. Depending on action it may require reply with 'Input number' or 'Input string' commands. Depending on action either number or string fields are valid. Opcode 0x83 - Provisioned Event Controller Index: Event parameters: This event indicate that node was provisioned. Opcode 0x84 - Link open Event Controller Index: Event parameters: Bearer (1 octet) Valid Bearer parameter values: 0x00 = PB-ADV 0x01 = PB-GATT This event indicates that provisioning link has been opened on given bearer. Opcode 0x85 - Link closed Event Controller Index: Event parameters: Bearer (1 octet) Valid Bearer parameter values: 0x00 = PB-ADV 0x01 = PB-GATT This event indicates that provisioning link has been closed on given bearer. Opcode 0x86 - Network receive Event Controller Index: Event parameters: TTL (1 octet) CTL (1 octet) SRC (2 octets) DST (2 octets) Payload_Len (1 octet) Payload (variable) This event indicates reception of network packet.