While using hcitool to issue command to bluetooth controller, I found the response bytes are strange since they are not conform with spec.
for HCI command packet format:
As I tried to test if the hcitool works, I send LE Rand Command:
sudo hcitool -i hci0 cmd 0x08 0x0018
The response I got is:
< HCI Command: ogf 0x08, ocf 0x0018, plen 0> HCI Event: 0x0e plen 1201 18 20 00 5F CD 97 0D DB 36 C4 F5
Bluetooth Event format is:
There is not doubt that the event code is 0x0e, which means Command Complete. Per spec below
Command_OPcode: 0x18 0x20 <= strange here
The first byte (0x18) surely matches OCF of sending command which is LE Rand. However, the 0x20 is not the OGF(0x08) we send.
After digging deeper, I found OCF is actually 12 bits while OGF is only 6 bits. Thus, the OGF 0x08 'value' when sending in command turns out 0x20 of response of byte boundary: 0x08 == 0x20 >> 4