diff --git a/src/connectivity/bluetooth/core/bt-host/BUILD.gn b/src/connectivity/bluetooth/core/bt-host/BUILD.gn
index d711050..3548b79 100644
--- a/src/connectivity/bluetooth/core/bt-host/BUILD.gn
+++ b/src/connectivity/bluetooth/core/bt-host/BUILD.gn
@@ -68,6 +68,7 @@
     "gap",
     "gatt",
     "hci",
+    "hci-spec",
     "l2cap",
     "sco",
     "sdp",
@@ -117,6 +118,7 @@
     "gap:bt-host-gap-tests",
     "gatt:bt-host-gatt-tests",
     "hci:bt-host-hci-tests",
+    "hci-spec:bt-host-hci-spec-tests",
     "l2cap:bt-host-l2cap-tests",
     "sco:bt-host-sco-tests",
     "sdp:bt-host-sdp-tests",
diff --git a/src/connectivity/bluetooth/core/bt-host/att/att.h b/src/connectivity/bluetooth/core/bt-host/att/att.h
index 7e94146..87379a8 100644
--- a/src/connectivity/bluetooth/core/bt-host/att/att.h
+++ b/src/connectivity/bluetooth/core/bt-host/att/att.h
@@ -15,7 +15,7 @@
 
 #include "lib/zx/time.h"
 #include "src/connectivity/bluetooth/core/bt-host/common/uint128.h"
-#include "src/connectivity/bluetooth/core/bt-host/hci/hci_constants.h"
+#include "src/connectivity/bluetooth/core/bt-host/hci-spec/constants.h"
 #include "src/connectivity/bluetooth/core/bt-host/l2cap/l2cap_defs.h"
 
 namespace bt::att {
diff --git a/src/connectivity/bluetooth/core/bt-host/fidl/low_energy_peripheral_server.cc b/src/connectivity/bluetooth/core/bt-host/fidl/low_energy_peripheral_server.cc
index 517b2c4..9597cee 100644
--- a/src/connectivity/bluetooth/core/bt-host/fidl/low_energy_peripheral_server.cc
+++ b/src/connectivity/bluetooth/core/bt-host/fidl/low_energy_peripheral_server.cc
@@ -15,8 +15,8 @@
 #include "src/connectivity/bluetooth/core/bt-host/gap/low_energy_advertising_manager.h"
 #include "src/connectivity/bluetooth/core/bt-host/gap/low_energy_connection_manager.h"
 #include "src/connectivity/bluetooth/core/bt-host/gap/peer.h"
-#include "src/connectivity/bluetooth/core/bt-host/hci/hci_constants.h"
-#include "src/connectivity/bluetooth/core/bt-host/hci/util.h"
+#include "src/connectivity/bluetooth/core/bt-host/hci-spec/constants.h"
+#include "src/connectivity/bluetooth/core/bt-host/hci-spec/util.h"
 #include "src/connectivity/bluetooth/core/bt-host/sm/types.h"
 #include "src/lib/fxl/strings/string_number_conversions.h"
 
diff --git a/src/connectivity/bluetooth/core/bt-host/fidl/profile_server.h b/src/connectivity/bluetooth/core/bt-host/fidl/profile_server.h
index 4a5edc1..4a0db48 100644
--- a/src/connectivity/bluetooth/core/bt-host/fidl/profile_server.h
+++ b/src/connectivity/bluetooth/core/bt-host/fidl/profile_server.h
@@ -12,7 +12,7 @@
 #include "lib/fidl/cpp/binding.h"
 #include "src/connectivity/bluetooth/core/bt-host/fidl/server_base.h"
 #include "src/connectivity/bluetooth/core/bt-host/gap/bredr_connection_manager.h"
-#include "src/connectivity/bluetooth/core/bt-host/hci/hci.h"
+#include "src/connectivity/bluetooth/core/bt-host/hci-spec/protocol.h"
 #include "src/connectivity/bluetooth/core/bt-host/sdp/server.h"
 #include "src/connectivity/bluetooth/core/bt-host/sdp/service_record.h"
 #include "src/connectivity/bluetooth/core/bt-host/socket/socket_factory.h"
diff --git a/src/connectivity/bluetooth/core/bt-host/gap/adapter.cc b/src/connectivity/bluetooth/core/bt-host/gap/adapter.cc
index 7ca27fd..adfa03f 100644
--- a/src/connectivity/bluetooth/core/bt-host/gap/adapter.cc
+++ b/src/connectivity/bluetooth/core/bt-host/gap/adapter.cc
@@ -17,13 +17,13 @@
 #include "src/connectivity/bluetooth/core/bt-host/common/log.h"
 #include "src/connectivity/bluetooth/core/bt-host/common/metrics.h"
 #include "src/connectivity/bluetooth/core/bt-host/common/random.h"
+#include "src/connectivity/bluetooth/core/bt-host/hci-spec/util.h"
 #include "src/connectivity/bluetooth/core/bt-host/hci/connection.h"
 #include "src/connectivity/bluetooth/core/bt-host/hci/legacy_low_energy_advertiser.h"
 #include "src/connectivity/bluetooth/core/bt-host/hci/legacy_low_energy_scanner.h"
 #include "src/connectivity/bluetooth/core/bt-host/hci/low_energy_connector.h"
 #include "src/connectivity/bluetooth/core/bt-host/hci/sequential_command_runner.h"
 #include "src/connectivity/bluetooth/core/bt-host/hci/transport.h"
-#include "src/connectivity/bluetooth/core/bt-host/hci/util.h"
 #include "src/connectivity/bluetooth/core/bt-host/l2cap/channel_manager.h"
 
 namespace bt::gap {
diff --git a/src/connectivity/bluetooth/core/bt-host/gap/adapter_state.h b/src/connectivity/bluetooth/core/bt-host/gap/adapter_state.h
index b0f2e2c..fe4f71f 100644
--- a/src/connectivity/bluetooth/core/bt-host/gap/adapter_state.h
+++ b/src/connectivity/bluetooth/core/bt-host/gap/adapter_state.h
@@ -13,9 +13,9 @@
 #include "src/connectivity/bluetooth/core/bt-host/common/device_address.h"
 #include "src/connectivity/bluetooth/core/bt-host/gap/gap.h"
 #include "src/connectivity/bluetooth/core/bt-host/gap/low_energy_state.h"
+#include "src/connectivity/bluetooth/core/bt-host/hci-spec/constants.h"
+#include "src/connectivity/bluetooth/core/bt-host/hci-spec/lmp_feature_set.h"
 #include "src/connectivity/bluetooth/core/bt-host/hci/acl_data_channel.h"
-#include "src/connectivity/bluetooth/core/bt-host/hci/hci_constants.h"
-#include "src/connectivity/bluetooth/core/bt-host/hci/lmp_feature_set.h"
 
 namespace bt::gap {
 
diff --git a/src/connectivity/bluetooth/core/bt-host/gap/adapter_unittest.cc b/src/connectivity/bluetooth/core/bt-host/gap/adapter_unittest.cc
index bbde3de..22f23e36 100644
--- a/src/connectivity/bluetooth/core/bt-host/gap/adapter_unittest.cc
+++ b/src/connectivity/bluetooth/core/bt-host/gap/adapter_unittest.cc
@@ -17,7 +17,7 @@
 #include "low_energy_advertising_manager.h"
 #include "low_energy_discovery_manager.h"
 #include "src/connectivity/bluetooth/core/bt-host/gatt/fake_layer.h"
-#include "src/connectivity/bluetooth/core/bt-host/hci/util.h"
+#include "src/connectivity/bluetooth/core/bt-host/hci-spec/util.h"
 #include "src/connectivity/bluetooth/core/bt-host/l2cap/fake_l2cap.h"
 #include "src/connectivity/bluetooth/core/bt-host/testing/controller_test.h"
 #include "src/connectivity/bluetooth/core/bt-host/testing/fake_controller.h"
diff --git a/src/connectivity/bluetooth/core/bt-host/gap/bredr_connection_manager.cc b/src/connectivity/bluetooth/core/bt-host/gap/bredr_connection_manager.cc
index 56f2d44..748f163 100644
--- a/src/connectivity/bluetooth/core/bt-host/gap/bredr_connection_manager.cc
+++ b/src/connectivity/bluetooth/core/bt-host/gap/bredr_connection_manager.cc
@@ -11,9 +11,9 @@
 #include "src/connectivity/bluetooth/core/bt-host/common/status.h"
 #include "src/connectivity/bluetooth/core/bt-host/gap/bredr_connection.h"
 #include "src/connectivity/bluetooth/core/bt-host/gap/peer_cache.h"
+#include "src/connectivity/bluetooth/core/bt-host/hci-spec/constants.h"
+#include "src/connectivity/bluetooth/core/bt-host/hci-spec/protocol.h"
 #include "src/connectivity/bluetooth/core/bt-host/hci/connection.h"
-#include "src/connectivity/bluetooth/core/bt-host/hci/hci.h"
-#include "src/connectivity/bluetooth/core/bt-host/hci/hci_constants.h"
 #include "src/connectivity/bluetooth/core/bt-host/hci/sequential_command_runner.h"
 #include "src/connectivity/bluetooth/core/bt-host/hci/status.h"
 #include "src/connectivity/bluetooth/core/bt-host/hci/transport.h"
diff --git a/src/connectivity/bluetooth/core/bt-host/gap/bredr_connection_manager.h b/src/connectivity/bluetooth/core/bt-host/gap/bredr_connection_manager.h
index 583fb99..1aefd4d 100644
--- a/src/connectivity/bluetooth/core/bt-host/gap/bredr_connection_manager.h
+++ b/src/connectivity/bluetooth/core/bt-host/gap/bredr_connection_manager.h
@@ -14,12 +14,12 @@
 #include "src/connectivity/bluetooth/core/bt-host/gap/bredr_interrogator.h"
 #include "src/connectivity/bluetooth/core/bt-host/gap/peer.h"
 #include "src/connectivity/bluetooth/core/bt-host/gap/types.h"
+#include "src/connectivity/bluetooth/core/bt-host/hci-spec/constants.h"
+#include "src/connectivity/bluetooth/core/bt-host/hci-spec/protocol.h"
 #include "src/connectivity/bluetooth/core/bt-host/hci/bredr_connection_request.h"
 #include "src/connectivity/bluetooth/core/bt-host/hci/command_channel.h"
 #include "src/connectivity/bluetooth/core/bt-host/hci/connection.h"
 #include "src/connectivity/bluetooth/core/bt-host/hci/control_packets.h"
-#include "src/connectivity/bluetooth/core/bt-host/hci/hci.h"
-#include "src/connectivity/bluetooth/core/bt-host/hci/hci_constants.h"
 #include "src/connectivity/bluetooth/core/bt-host/hci/status.h"
 #include "src/connectivity/bluetooth/core/bt-host/l2cap/l2cap.h"
 #include "src/connectivity/bluetooth/core/bt-host/l2cap/l2cap_defs.h"
diff --git a/src/connectivity/bluetooth/core/bt-host/gap/bredr_connection_manager_unittest.cc b/src/connectivity/bluetooth/core/bt-host/gap/bredr_connection_manager_unittest.cc
index 9bda098d..6ec15d3 100644
--- a/src/connectivity/bluetooth/core/bt-host/gap/bredr_connection_manager_unittest.cc
+++ b/src/connectivity/bluetooth/core/bt-host/gap/bredr_connection_manager_unittest.cc
@@ -13,9 +13,9 @@
 #include "src/connectivity/bluetooth/core/bt-host/common/test_helpers.h"
 #include "src/connectivity/bluetooth/core/bt-host/gap/fake_pairing_delegate.h"
 #include "src/connectivity/bluetooth/core/bt-host/gap/peer_cache.h"
-#include "src/connectivity/bluetooth/core/bt-host/hci/hci.h"
+#include "src/connectivity/bluetooth/core/bt-host/hci-spec/protocol.h"
+#include "src/connectivity/bluetooth/core/bt-host/hci-spec/util.h"
 #include "src/connectivity/bluetooth/core/bt-host/hci/status.h"
-#include "src/connectivity/bluetooth/core/bt-host/hci/util.h"
 #include "src/connectivity/bluetooth/core/bt-host/l2cap/fake_channel.h"
 #include "src/connectivity/bluetooth/core/bt-host/l2cap/fake_l2cap.h"
 #include "src/connectivity/bluetooth/core/bt-host/l2cap/l2cap_defs.h"
diff --git a/src/connectivity/bluetooth/core/bt-host/gap/bredr_connection_request.h b/src/connectivity/bluetooth/core/bt-host/gap/bredr_connection_request.h
index b94569f..6b87fbb 100644
--- a/src/connectivity/bluetooth/core/bt-host/gap/bredr_connection_request.h
+++ b/src/connectivity/bluetooth/core/bt-host/gap/bredr_connection_request.h
@@ -12,7 +12,8 @@
 #include "fbl/macros.h"
 #include "src/connectivity/bluetooth/core/bt-host/common/identifier.h"
 #include "src/connectivity/bluetooth/core/bt-host/common/inspectable.h"
-#include "src/connectivity/bluetooth/core/bt-host/hci/hci.h"
+#include "src/connectivity/bluetooth/core/bt-host/hci-spec/protocol.h"
+#include "src/connectivity/bluetooth/core/bt-host/hci/status.h"
 
 namespace bt::gap {
 
diff --git a/src/connectivity/bluetooth/core/bt-host/gap/bredr_discovery_manager.cc b/src/connectivity/bluetooth/core/bt-host/gap/bredr_discovery_manager.cc
index c334199..392011d 100644
--- a/src/connectivity/bluetooth/core/bt-host/gap/bredr_discovery_manager.cc
+++ b/src/connectivity/bluetooth/core/bt-host/gap/bredr_discovery_manager.cc
@@ -11,8 +11,8 @@
 #include "src/connectivity/bluetooth/core/bt-host/common/log.h"
 #include "src/connectivity/bluetooth/core/bt-host/common/supplement_data.h"
 #include "src/connectivity/bluetooth/core/bt-host/gap/peer_cache.h"
+#include "src/connectivity/bluetooth/core/bt-host/hci-spec/util.h"
 #include "src/connectivity/bluetooth/core/bt-host/hci/transport.h"
-#include "src/connectivity/bluetooth/core/bt-host/hci/util.h"
 
 namespace bt::gap {
 
diff --git a/src/connectivity/bluetooth/core/bt-host/gap/bredr_discovery_manager_unittest.cc b/src/connectivity/bluetooth/core/bt-host/gap/bredr_discovery_manager_unittest.cc
index 5587fd7..cef6dd0 100644
--- a/src/connectivity/bluetooth/core/bt-host/gap/bredr_discovery_manager_unittest.cc
+++ b/src/connectivity/bluetooth/core/bt-host/gap/bredr_discovery_manager_unittest.cc
@@ -6,7 +6,7 @@
 
 #include "src/connectivity/bluetooth/core/bt-host/common/test_helpers.h"
 #include "src/connectivity/bluetooth/core/bt-host/gap/peer_cache.h"
-#include "src/connectivity/bluetooth/core/bt-host/hci/hci.h"
+#include "src/connectivity/bluetooth/core/bt-host/hci-spec/protocol.h"
 #include "src/connectivity/bluetooth/core/bt-host/testing/controller_test.h"
 #include "src/connectivity/bluetooth/core/bt-host/testing/mock_controller.h"
 #include "src/connectivity/bluetooth/core/bt-host/testing/test_packets.h"
diff --git a/src/connectivity/bluetooth/core/bt-host/gap/bredr_interrogator.cc b/src/connectivity/bluetooth/core/bt-host/gap/bredr_interrogator.cc
index ce3ce4b..5767cb5 100644
--- a/src/connectivity/bluetooth/core/bt-host/gap/bredr_interrogator.cc
+++ b/src/connectivity/bluetooth/core/bt-host/gap/bredr_interrogator.cc
@@ -7,7 +7,7 @@
 #include <zircon/assert.h>
 
 #include "src/connectivity/bluetooth/core/bt-host/gap/peer.h"
-#include "src/connectivity/bluetooth/core/bt-host/hci/hci.h"
+#include "src/connectivity/bluetooth/core/bt-host/hci-spec/protocol.h"
 #include "src/connectivity/bluetooth/core/bt-host/hci/transport.h"
 
 namespace bt::gap {
diff --git a/src/connectivity/bluetooth/core/bt-host/gap/bredr_interrogator.h b/src/connectivity/bluetooth/core/bt-host/gap/bredr_interrogator.h
index 72f36d3..901d87b 100644
--- a/src/connectivity/bluetooth/core/bt-host/gap/bredr_interrogator.h
+++ b/src/connectivity/bluetooth/core/bt-host/gap/bredr_interrogator.h
@@ -17,11 +17,11 @@
 #include "src/connectivity/bluetooth/core/bt-host/common/device_address.h"
 #include "src/connectivity/bluetooth/core/bt-host/gap/interrogator.h"
 #include "src/connectivity/bluetooth/core/bt-host/gap/peer_cache.h"
+#include "src/connectivity/bluetooth/core/bt-host/hci-spec/constants.h"
+#include "src/connectivity/bluetooth/core/bt-host/hci-spec/protocol.h"
 #include "src/connectivity/bluetooth/core/bt-host/hci/command_channel.h"
 #include "src/connectivity/bluetooth/core/bt-host/hci/connection.h"
 #include "src/connectivity/bluetooth/core/bt-host/hci/control_packets.h"
-#include "src/connectivity/bluetooth/core/bt-host/hci/hci.h"
-#include "src/connectivity/bluetooth/core/bt-host/hci/hci_constants.h"
 #include "src/lib/fxl/functional/cancelable_callback.h"
 #include "src/lib/fxl/memory/ref_ptr.h"
 #include "src/lib/fxl/memory/weak_ptr.h"
diff --git a/src/connectivity/bluetooth/core/bt-host/gap/bredr_interrogator_unittest.cc b/src/connectivity/bluetooth/core/bt-host/gap/bredr_interrogator_unittest.cc
index 7c4cc7a..ef5e916 100644
--- a/src/connectivity/bluetooth/core/bt-host/gap/bredr_interrogator_unittest.cc
+++ b/src/connectivity/bluetooth/core/bt-host/gap/bredr_interrogator_unittest.cc
@@ -9,9 +9,9 @@
 #include "src/connectivity/bluetooth/core/bt-host/common/status.h"
 #include "src/connectivity/bluetooth/core/bt-host/common/test_helpers.h"
 #include "src/connectivity/bluetooth/core/bt-host/gap/peer_cache.h"
-#include "src/connectivity/bluetooth/core/bt-host/hci/hci.h"
+#include "src/connectivity/bluetooth/core/bt-host/hci-spec/protocol.h"
+#include "src/connectivity/bluetooth/core/bt-host/hci-spec/util.h"
 #include "src/connectivity/bluetooth/core/bt-host/hci/status.h"
-#include "src/connectivity/bluetooth/core/bt-host/hci/util.h"
 #include "src/connectivity/bluetooth/core/bt-host/l2cap/fake_l2cap.h"
 #include "src/connectivity/bluetooth/core/bt-host/l2cap/l2cap_defs.h"
 #include "src/connectivity/bluetooth/core/bt-host/testing/controller_test.h"
diff --git a/src/connectivity/bluetooth/core/bt-host/gap/discovery_filter.h b/src/connectivity/bluetooth/core/bt-host/gap/discovery_filter.h
index 5f8fdb1..073dfb3 100644
--- a/src/connectivity/bluetooth/core/bt-host/gap/discovery_filter.h
+++ b/src/connectivity/bluetooth/core/bt-host/gap/discovery_filter.h
@@ -9,7 +9,7 @@
 #include <vector>
 
 #include "src/connectivity/bluetooth/core/bt-host/common/uuid.h"
-#include "src/connectivity/bluetooth/core/bt-host/hci/hci_constants.h"
+#include "src/connectivity/bluetooth/core/bt-host/hci-spec/constants.h"
 
 namespace bt {
 
diff --git a/src/connectivity/bluetooth/core/bt-host/gap/interrogator.cc b/src/connectivity/bluetooth/core/bt-host/gap/interrogator.cc
index 07e7359..e66d11f 100644
--- a/src/connectivity/bluetooth/core/bt-host/gap/interrogator.cc
+++ b/src/connectivity/bluetooth/core/bt-host/gap/interrogator.cc
@@ -7,7 +7,7 @@
 #include <zircon/assert.h>
 
 #include "src/connectivity/bluetooth/core/bt-host/gap/peer.h"
-#include "src/connectivity/bluetooth/core/bt-host/hci/hci.h"
+#include "src/connectivity/bluetooth/core/bt-host/hci-spec/protocol.h"
 #include "src/connectivity/bluetooth/core/bt-host/hci/transport.h"
 
 namespace bt::gap {
diff --git a/src/connectivity/bluetooth/core/bt-host/gap/interrogator.h b/src/connectivity/bluetooth/core/bt-host/gap/interrogator.h
index ba61ba6..b957e1f 100644
--- a/src/connectivity/bluetooth/core/bt-host/gap/interrogator.h
+++ b/src/connectivity/bluetooth/core/bt-host/gap/interrogator.h
@@ -15,11 +15,11 @@
 
 #include "src/connectivity/bluetooth/core/bt-host/common/device_address.h"
 #include "src/connectivity/bluetooth/core/bt-host/gap/peer_cache.h"
+#include "src/connectivity/bluetooth/core/bt-host/hci-spec/constants.h"
+#include "src/connectivity/bluetooth/core/bt-host/hci-spec/protocol.h"
 #include "src/connectivity/bluetooth/core/bt-host/hci/command_channel.h"
 #include "src/connectivity/bluetooth/core/bt-host/hci/connection.h"
 #include "src/connectivity/bluetooth/core/bt-host/hci/control_packets.h"
-#include "src/connectivity/bluetooth/core/bt-host/hci/hci.h"
-#include "src/connectivity/bluetooth/core/bt-host/hci/hci_constants.h"
 #include "src/lib/fxl/memory/ref_ptr.h"
 #include "src/lib/fxl/memory/weak_ptr.h"
 
diff --git a/src/connectivity/bluetooth/core/bt-host/gap/interrogator_unittest.cc b/src/connectivity/bluetooth/core/bt-host/gap/interrogator_unittest.cc
index b81b4ce..2e0b55f 100644
--- a/src/connectivity/bluetooth/core/bt-host/gap/interrogator_unittest.cc
+++ b/src/connectivity/bluetooth/core/bt-host/gap/interrogator_unittest.cc
@@ -9,9 +9,9 @@
 #include "src/connectivity/bluetooth/core/bt-host/common/status.h"
 #include "src/connectivity/bluetooth/core/bt-host/common/test_helpers.h"
 #include "src/connectivity/bluetooth/core/bt-host/gap/peer_cache.h"
-#include "src/connectivity/bluetooth/core/bt-host/hci/hci.h"
+#include "src/connectivity/bluetooth/core/bt-host/hci-spec/protocol.h"
+#include "src/connectivity/bluetooth/core/bt-host/hci-spec/util.h"
 #include "src/connectivity/bluetooth/core/bt-host/hci/status.h"
-#include "src/connectivity/bluetooth/core/bt-host/hci/util.h"
 #include "src/connectivity/bluetooth/core/bt-host/l2cap/l2cap_defs.h"
 #include "src/connectivity/bluetooth/core/bt-host/testing/controller_test.h"
 #include "src/connectivity/bluetooth/core/bt-host/testing/fake_peer.h"
diff --git a/src/connectivity/bluetooth/core/bt-host/gap/low_energy_advertising_manager.cc b/src/connectivity/bluetooth/core/bt-host/gap/low_energy_advertising_manager.cc
index 542618e..6f9b01e 100644
--- a/src/connectivity/bluetooth/core/bt-host/gap/low_energy_advertising_manager.cc
+++ b/src/connectivity/bluetooth/core/bt-host/gap/low_energy_advertising_manager.cc
@@ -11,7 +11,7 @@
 #include "src/connectivity/bluetooth/core/bt-host/common/log.h"
 #include "src/connectivity/bluetooth/core/bt-host/common/random.h"
 #include "src/connectivity/bluetooth/core/bt-host/common/slab_allocator.h"
-#include "src/connectivity/bluetooth/core/bt-host/hci/util.h"
+#include "src/connectivity/bluetooth/core/bt-host/hci-spec/util.h"
 #include "src/lib/fxl/strings/string_printf.h"
 
 namespace bt::gap {
diff --git a/src/connectivity/bluetooth/core/bt-host/gap/low_energy_advertising_manager.h b/src/connectivity/bluetooth/core/bt-host/gap/low_energy_advertising_manager.h
index 25c8fbb..dda60be 100644
--- a/src/connectivity/bluetooth/core/bt-host/gap/low_energy_advertising_manager.h
+++ b/src/connectivity/bluetooth/core/bt-host/gap/low_energy_advertising_manager.h
@@ -10,7 +10,7 @@
 #include "src/connectivity/bluetooth/core/bt-host/common/advertising_data.h"
 #include "src/connectivity/bluetooth/core/bt-host/common/identifier.h"
 #include "src/connectivity/bluetooth/core/bt-host/gap/gap.h"
-#include "src/connectivity/bluetooth/core/bt-host/hci/hci_constants.h"
+#include "src/connectivity/bluetooth/core/bt-host/hci-spec/constants.h"
 #include "src/connectivity/bluetooth/core/bt-host/hci/low_energy_advertiser.h"
 #include "src/lib/fxl/memory/weak_ptr.h"
 
diff --git a/src/connectivity/bluetooth/core/bt-host/gap/low_energy_connection.h b/src/connectivity/bluetooth/core/bt-host/gap/low_energy_connection.h
index 5aa53994..a55c78e 100644
--- a/src/connectivity/bluetooth/core/bt-host/gap/low_energy_connection.h
+++ b/src/connectivity/bluetooth/core/bt-host/gap/low_energy_connection.h
@@ -15,7 +15,7 @@
 #include "src/connectivity/bluetooth/core/bt-host/common/inspectable.h"
 #include "src/connectivity/bluetooth/core/bt-host/gap/generic_access_client.h"
 #include "src/connectivity/bluetooth/core/bt-host/gatt/gatt.h"
-#include "src/connectivity/bluetooth/core/bt-host/hci/hci.h"
+#include "src/connectivity/bluetooth/core/bt-host/hci-spec/protocol.h"
 #include "src/connectivity/bluetooth/core/bt-host/l2cap/l2cap.h"
 #include "src/connectivity/bluetooth/core/bt-host/sm/security_manager.h"
 #include "src/connectivity/bluetooth/core/bt-host/sm/types.h"
diff --git a/src/connectivity/bluetooth/core/bt-host/gap/low_energy_connection_handle.h b/src/connectivity/bluetooth/core/bt-host/gap/low_energy_connection_handle.h
index 697afb7..5b9aa13 100644
--- a/src/connectivity/bluetooth/core/bt-host/gap/low_energy_connection_handle.h
+++ b/src/connectivity/bluetooth/core/bt-host/gap/low_energy_connection_handle.h
@@ -8,7 +8,7 @@
 #include <lib/fit/thread_checker.h>
 
 #include "src/connectivity/bluetooth/core/bt-host/common/identifier.h"
-#include "src/connectivity/bluetooth/core/bt-host/hci/hci.h"
+#include "src/connectivity/bluetooth/core/bt-host/hci-spec/protocol.h"
 #include "src/connectivity/bluetooth/core/bt-host/sm/types.h"
 #include "src/lib/fxl/memory/weak_ptr.h"
 
diff --git a/src/connectivity/bluetooth/core/bt-host/gap/low_energy_connection_manager.cc b/src/connectivity/bluetooth/core/bt-host/gap/low_energy_connection_manager.cc
index cc261ce..66f1ca3 100644
--- a/src/connectivity/bluetooth/core/bt-host/gap/low_energy_connection_manager.cc
+++ b/src/connectivity/bluetooth/core/bt-host/gap/low_energy_connection_manager.cc
@@ -22,13 +22,13 @@
 #include "src/connectivity/bluetooth/core/bt-host/gap/generic_access_client.h"
 #include "src/connectivity/bluetooth/core/bt-host/gap/peer.h"
 #include "src/connectivity/bluetooth/core/bt-host/gatt/local_service_manager.h"
+#include "src/connectivity/bluetooth/core/bt-host/hci-spec/constants.h"
+#include "src/connectivity/bluetooth/core/bt-host/hci-spec/defaults.h"
+#include "src/connectivity/bluetooth/core/bt-host/hci-spec/protocol.h"
+#include "src/connectivity/bluetooth/core/bt-host/hci-spec/util.h"
 #include "src/connectivity/bluetooth/core/bt-host/hci/connection.h"
-#include "src/connectivity/bluetooth/core/bt-host/hci/defaults.h"
-#include "src/connectivity/bluetooth/core/bt-host/hci/hci.h"
-#include "src/connectivity/bluetooth/core/bt-host/hci/hci_constants.h"
 #include "src/connectivity/bluetooth/core/bt-host/hci/local_address_delegate.h"
 #include "src/connectivity/bluetooth/core/bt-host/hci/transport.h"
-#include "src/connectivity/bluetooth/core/bt-host/hci/util.h"
 #include "src/connectivity/bluetooth/core/bt-host/l2cap/channel_manager.h"
 #include "src/connectivity/bluetooth/core/bt-host/sm/security_manager.h"
 #include "src/connectivity/bluetooth/core/bt-host/sm/smp.h"
diff --git a/src/connectivity/bluetooth/core/bt-host/gap/low_energy_connection_manager_unittest.cc b/src/connectivity/bluetooth/core/bt-host/gap/low_energy_connection_manager_unittest.cc
index d9319a9..2ee74cd 100644
--- a/src/connectivity/bluetooth/core/bt-host/gap/low_energy_connection_manager_unittest.cc
+++ b/src/connectivity/bluetooth/core/bt-host/gap/low_energy_connection_manager_unittest.cc
@@ -27,12 +27,12 @@
 #include "src/connectivity/bluetooth/core/bt-host/gap/peer.h"
 #include "src/connectivity/bluetooth/core/bt-host/gap/peer_cache.h"
 #include "src/connectivity/bluetooth/core/bt-host/gatt/fake_layer.h"
-#include "src/connectivity/bluetooth/core/bt-host/hci/defaults.h"
+#include "src/connectivity/bluetooth/core/bt-host/hci-spec/constants.h"
+#include "src/connectivity/bluetooth/core/bt-host/hci-spec/defaults.h"
+#include "src/connectivity/bluetooth/core/bt-host/hci-spec/util.h"
 #include "src/connectivity/bluetooth/core/bt-host/hci/fake_local_address_delegate.h"
-#include "src/connectivity/bluetooth/core/bt-host/hci/hci_constants.h"
 #include "src/connectivity/bluetooth/core/bt-host/hci/legacy_low_energy_scanner.h"
 #include "src/connectivity/bluetooth/core/bt-host/hci/low_energy_connector.h"
-#include "src/connectivity/bluetooth/core/bt-host/hci/util.h"
 #include "src/connectivity/bluetooth/core/bt-host/l2cap/fake_channel.h"
 #include "src/connectivity/bluetooth/core/bt-host/l2cap/fake_channel_test.h"
 #include "src/connectivity/bluetooth/core/bt-host/l2cap/fake_l2cap.h"
diff --git a/src/connectivity/bluetooth/core/bt-host/gap/low_energy_interrogator.cc b/src/connectivity/bluetooth/core/bt-host/gap/low_energy_interrogator.cc
index 43100a6..d6397a8 100644
--- a/src/connectivity/bluetooth/core/bt-host/gap/low_energy_interrogator.cc
+++ b/src/connectivity/bluetooth/core/bt-host/gap/low_energy_interrogator.cc
@@ -5,7 +5,7 @@
 #include "src/connectivity/bluetooth/core/bt-host/gap/low_energy_interrogator.h"
 
 #include "src/connectivity/bluetooth/core/bt-host/gap/peer.h"
-#include "src/connectivity/bluetooth/core/bt-host/hci/hci.h"
+#include "src/connectivity/bluetooth/core/bt-host/hci-spec/protocol.h"
 #include "src/connectivity/bluetooth/core/bt-host/hci/transport.h"
 
 namespace bt::gap {
diff --git a/src/connectivity/bluetooth/core/bt-host/gap/low_energy_interrogator_unittest.cc b/src/connectivity/bluetooth/core/bt-host/gap/low_energy_interrogator_unittest.cc
index 180308a..1901d01 100644
--- a/src/connectivity/bluetooth/core/bt-host/gap/low_energy_interrogator_unittest.cc
+++ b/src/connectivity/bluetooth/core/bt-host/gap/low_energy_interrogator_unittest.cc
@@ -8,7 +8,7 @@
 
 #include "src/connectivity/bluetooth/core/bt-host/common/test_helpers.h"
 #include "src/connectivity/bluetooth/core/bt-host/gap/peer_cache.h"
-#include "src/connectivity/bluetooth/core/bt-host/hci/hci.h"
+#include "src/connectivity/bluetooth/core/bt-host/hci-spec/protocol.h"
 #include "src/connectivity/bluetooth/core/bt-host/hci/status.h"
 #include "src/connectivity/bluetooth/core/bt-host/l2cap/fake_l2cap.h"
 #include "src/connectivity/bluetooth/core/bt-host/l2cap/l2cap_defs.h"
diff --git a/src/connectivity/bluetooth/core/bt-host/gap/low_energy_state.h b/src/connectivity/bluetooth/core/bt-host/gap/low_energy_state.h
index 153a0ba..1db140e 100644
--- a/src/connectivity/bluetooth/core/bt-host/gap/low_energy_state.h
+++ b/src/connectivity/bluetooth/core/bt-host/gap/low_energy_state.h
@@ -7,8 +7,8 @@
 
 #include <cstdint>
 
+#include "src/connectivity/bluetooth/core/bt-host/hci-spec/constants.h"
 #include "src/connectivity/bluetooth/core/bt-host/hci/acl_data_channel.h"
-#include "src/connectivity/bluetooth/core/bt-host/hci/hci_constants.h"
 
 namespace bt::gap {
 
diff --git a/src/connectivity/bluetooth/core/bt-host/gap/pairing_state.h b/src/connectivity/bluetooth/core/bt-host/gap/pairing_state.h
index 03acb07..1e10656 100644
--- a/src/connectivity/bluetooth/core/bt-host/gap/pairing_state.h
+++ b/src/connectivity/bluetooth/core/bt-host/gap/pairing_state.h
@@ -15,8 +15,8 @@
 #include "src/connectivity/bluetooth/core/bt-host/gap/pairing_delegate.h"
 #include "src/connectivity/bluetooth/core/bt-host/gap/peer_cache.h"
 #include "src/connectivity/bluetooth/core/bt-host/gap/types.h"
+#include "src/connectivity/bluetooth/core/bt-host/hci-spec/protocol.h"
 #include "src/connectivity/bluetooth/core/bt-host/hci/connection.h"
-#include "src/connectivity/bluetooth/core/bt-host/hci/hci.h"
 #include "src/connectivity/bluetooth/core/bt-host/sm/smp.h"
 #include "src/connectivity/bluetooth/core/bt-host/sm/types.h"
 
diff --git a/src/connectivity/bluetooth/core/bt-host/gap/peer.cc b/src/connectivity/bluetooth/core/bt-host/gap/peer.cc
index c80c487..823dc07 100644
--- a/src/connectivity/bluetooth/core/bt-host/gap/peer.cc
+++ b/src/connectivity/bluetooth/core/bt-host/gap/peer.cc
@@ -9,8 +9,8 @@
 #include "src/connectivity/bluetooth/core/bt-host/common/advertising_data.h"
 #include "src/connectivity/bluetooth/core/bt-host/common/manufacturer_names.h"
 #include "src/connectivity/bluetooth/core/bt-host/gap/gap.h"
+#include "src/connectivity/bluetooth/core/bt-host/hci-spec/util.h"
 #include "src/connectivity/bluetooth/core/bt-host/hci/low_energy_scanner.h"
-#include "src/connectivity/bluetooth/core/bt-host/hci/util.h"
 #include "src/lib/fxl/strings/string_printf.h"
 
 namespace bt::gap {
diff --git a/src/connectivity/bluetooth/core/bt-host/gap/peer.h b/src/connectivity/bluetooth/core/bt-host/gap/peer.h
index 5916bb4..f85cd47 100644
--- a/src/connectivity/bluetooth/core/bt-host/gap/peer.h
+++ b/src/connectivity/bluetooth/core/bt-host/gap/peer.h
@@ -22,9 +22,9 @@
 #include "src/connectivity/bluetooth/core/bt-host/gap/gap.h"
 #include "src/connectivity/bluetooth/core/bt-host/gap/peer_metrics.h"
 #include "src/connectivity/bluetooth/core/bt-host/gatt/persisted_data.h"
+#include "src/connectivity/bluetooth/core/bt-host/hci-spec/constants.h"
+#include "src/connectivity/bluetooth/core/bt-host/hci-spec/lmp_feature_set.h"
 #include "src/connectivity/bluetooth/core/bt-host/hci/connection.h"
-#include "src/connectivity/bluetooth/core/bt-host/hci/hci_constants.h"
-#include "src/connectivity/bluetooth/core/bt-host/hci/lmp_feature_set.h"
 #include "src/connectivity/bluetooth/core/bt-host/sm/security_manager.h"
 #include "src/connectivity/bluetooth/core/bt-host/sm/types.h"
 
diff --git a/src/connectivity/bluetooth/core/bt-host/gap/peer_cache_unittest.cc b/src/connectivity/bluetooth/core/bt-host/gap/peer_cache_unittest.cc
index eedd79e..f667286 100644
--- a/src/connectivity/bluetooth/core/bt-host/gap/peer_cache_unittest.cc
+++ b/src/connectivity/bluetooth/core/bt-host/gap/peer_cache_unittest.cc
@@ -18,7 +18,7 @@
 #include "src/connectivity/bluetooth/core/bt-host/common/uint128.h"
 #include "src/connectivity/bluetooth/core/bt-host/common/uuid.h"
 #include "src/connectivity/bluetooth/core/bt-host/gap/peer.h"
-#include "src/connectivity/bluetooth/core/bt-host/hci/link_key.h"
+#include "src/connectivity/bluetooth/core/bt-host/hci-spec/link_key.h"
 #include "src/connectivity/bluetooth/core/bt-host/hci/low_energy_scanner.h"
 #include "src/connectivity/bluetooth/core/bt-host/sm/smp.h"
 #include "src/connectivity/bluetooth/core/bt-host/sm/types.h"
diff --git a/src/connectivity/bluetooth/core/bt-host/gap/peer_unittest.cc b/src/connectivity/bluetooth/core/bt-host/gap/peer_unittest.cc
index 8b686d2..2d3b247 100644
--- a/src/connectivity/bluetooth/core/bt-host/gap/peer_unittest.cc
+++ b/src/connectivity/bluetooth/core/bt-host/gap/peer_unittest.cc
@@ -12,7 +12,7 @@
 
 #include "lib/gtest/test_loop_fixture.h"
 #include "src/connectivity/bluetooth/core/bt-host/common/manufacturer_names.h"
-#include "src/connectivity/bluetooth/core/bt-host/hci/util.h"
+#include "src/connectivity/bluetooth/core/bt-host/hci-spec/util.h"
 
 namespace bt::gap {
 namespace {
diff --git a/src/connectivity/bluetooth/core/bt-host/hci-spec/BUILD.gn b/src/connectivity/bluetooth/core/bt-host/hci-spec/BUILD.gn
new file mode 100644
index 0000000..d4fbdb0
--- /dev/null
+++ b/src/connectivity/bluetooth/core/bt-host/hci-spec/BUILD.gn
@@ -0,0 +1,38 @@
+# Copyright 2021 The Fuchsia Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+import("//src/connectivity/bluetooth/core/bt-host/build/bt_gtest_package.gni")
+
+# Static library containing the HCI specification definitions
+static_library("hci-spec") {
+  sources = [
+    "constants.h",
+    "defaults.h",
+    "le_connection_parameters.cc",
+    "le_connection_parameters.h",
+    "link_key.cc",
+    "link_key.h",
+    "lmp_feature_set.h",
+    "protocol.h",
+    "util.cc",
+    "util.h",
+  ]
+
+  public_deps = [ "//src/connectivity/bluetooth/core/bt-host/common" ]
+}
+
+source_set("tests") {
+  testonly = true
+
+  sources = [ "util_unittest.cc" ]
+
+  deps = [
+    ":hci-spec",
+    "//third_party/googletest:gtest",
+  ]
+}
+
+bt_gtest_package("bt-host-hci-spec-tests") {
+  deps = [ ":tests" ]
+}
diff --git a/src/connectivity/bluetooth/core/bt-host/hci-spec/README.md b/src/connectivity/bluetooth/core/bt-host/hci-spec/README.md
new file mode 100644
index 0000000..d9ca449e
--- /dev/null
+++ b/src/connectivity/bluetooth/core/bt-host/hci-spec/README.md
@@ -0,0 +1,25 @@
+# hci-spec
+
+The `hci-spec` library defines convenient and reliable C++ types, values and constants
+defining the HCI protocol as specified in the Bluetooth HCI Specification (Core Spec v5.2, Vol 4,
+Part E).
+
+In particular:
+
+ * `protocol.h` provides definitions of the opcodes and packet types that make up the HCI protocol,
+ such as HCI Command types and HCI event types, for both BR/EDR and Low Energy.
+ * `constants.h` provides definitions of the constant values defined in the HCI specification
+ * `defaults.h` provides typical default values listed in the HCI specification for certain commands
+
+## A Note on Dependencies
+
+This library is aimed to have minimal dependencies, especially on platform-specific code, such that
+it could feasible be widely used across multiple platforms in future. Dependencies should be kept
+to a minimum.
+
+## Future work
+
+The design of this library - as a direct representation of types and values from the specification -
+could enable machine generation of the library from a concise canonical representation of
+specification types in future. If this path were taken, this library - along with equivalents in
+other languages - could be automatically generated from a single core definition.
diff --git a/src/connectivity/bluetooth/core/bt-host/hci/hci_constants.h b/src/connectivity/bluetooth/core/bt-host/hci-spec/constants.h
similarity index 99%
rename from src/connectivity/bluetooth/core/bt-host/hci/hci_constants.h
rename to src/connectivity/bluetooth/core/bt-host/hci-spec/constants.h
index 5ea43ed..49dba1c 100644
--- a/src/connectivity/bluetooth/core/bt-host/hci/hci_constants.h
+++ b/src/connectivity/bluetooth/core/bt-host/hci-spec/constants.h
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef SRC_CONNECTIVITY_BLUETOOTH_CORE_BT_HOST_HCI_HCI_CONSTANTS_H_
-#define SRC_CONNECTIVITY_BLUETOOTH_CORE_BT_HOST_HCI_HCI_CONSTANTS_H_
+#ifndef SRC_CONNECTIVITY_BLUETOOTH_CORE_BT_HOST_HCI_SPEC_CONSTANTS_H_
+#define SRC_CONNECTIVITY_BLUETOOTH_CORE_BT_HOST_HCI_SPEC_CONSTANTS_H_
 
 // clang-format off
 
@@ -1510,4 +1510,4 @@
 
 }  // namespace bt
 
-#endif  // SRC_CONNECTIVITY_BLUETOOTH_CORE_BT_HOST_HCI_HCI_CONSTANTS_H_
+#endif  // SRC_CONNECTIVITY_BLUETOOTH_CORE_BT_HOST_HCI_SPEC_CONSTANTS_H_
diff --git a/src/connectivity/bluetooth/core/bt-host/hci/defaults.h b/src/connectivity/bluetooth/core/bt-host/hci-spec/defaults.h
similarity index 78%
rename from src/connectivity/bluetooth/core/bt-host/hci/defaults.h
rename to src/connectivity/bluetooth/core/bt-host/hci-spec/defaults.h
index 9c52336..1a74ae7 100644
--- a/src/connectivity/bluetooth/core/bt-host/hci/defaults.h
+++ b/src/connectivity/bluetooth/core/bt-host/hci-spec/defaults.h
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef SRC_CONNECTIVITY_BLUETOOTH_CORE_BT_HOST_HCI_DEFAULTS_H_
-#define SRC_CONNECTIVITY_BLUETOOTH_CORE_BT_HOST_HCI_DEFAULTS_H_
+#ifndef SRC_CONNECTIVITY_BLUETOOTH_CORE_BT_HOST_HCI_SPEC_DEFAULTS_H_
+#define SRC_CONNECTIVITY_BLUETOOTH_CORE_BT_HOST_HCI_SPEC_DEFAULTS_H_
 
 #include <cstdint>
 
@@ -30,4 +30,4 @@
 
 }  // namespace bt::hci::defaults
 
-#endif  // SRC_CONNECTIVITY_BLUETOOTH_CORE_BT_HOST_HCI_DEFAULTS_H_
+#endif  // SRC_CONNECTIVITY_BLUETOOTH_CORE_BT_HOST_HCI_SPEC_DEFAULTS_H_
diff --git a/src/connectivity/bluetooth/core/bt-host/hci/connection_parameters.cc b/src/connectivity/bluetooth/core/bt-host/hci-spec/le_connection_parameters.cc
similarity index 97%
rename from src/connectivity/bluetooth/core/bt-host/hci/connection_parameters.cc
rename to src/connectivity/bluetooth/core/bt-host/hci-spec/le_connection_parameters.cc
index b0fc2d6..1bf5864 100644
--- a/src/connectivity/bluetooth/core/bt-host/hci/connection_parameters.cc
+++ b/src/connectivity/bluetooth/core/bt-host/hci-spec/le_connection_parameters.cc
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include "connection_parameters.h"
+#include "le_connection_parameters.h"
 
 namespace bt::hci {
 
diff --git a/src/connectivity/bluetooth/core/bt-host/hci/connection_parameters.h b/src/connectivity/bluetooth/core/bt-host/hci-spec/le_connection_parameters.h
similarity index 93%
rename from src/connectivity/bluetooth/core/bt-host/hci/connection_parameters.h
rename to src/connectivity/bluetooth/core/bt-host/hci-spec/le_connection_parameters.h
index 0d71d57..3eaeac1 100644
--- a/src/connectivity/bluetooth/core/bt-host/hci/connection_parameters.h
+++ b/src/connectivity/bluetooth/core/bt-host/hci-spec/le_connection_parameters.h
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef SRC_CONNECTIVITY_BLUETOOTH_CORE_BT_HOST_HCI_CONNECTION_PARAMETERS_H_
-#define SRC_CONNECTIVITY_BLUETOOTH_CORE_BT_HOST_HCI_CONNECTION_PARAMETERS_H_
+#ifndef SRC_CONNECTIVITY_BLUETOOTH_CORE_BT_HOST_HCI_SPEC_LE_CONNECTION_PARAMETERS_H_
+#define SRC_CONNECTIVITY_BLUETOOTH_CORE_BT_HOST_HCI_SPEC_LE_CONNECTION_PARAMETERS_H_
 
 #include <cstdint>
 #include <string>
@@ -93,4 +93,4 @@
 
 }  // namespace bt::hci
 
-#endif  // SRC_CONNECTIVITY_BLUETOOTH_CORE_BT_HOST_HCI_CONNECTION_PARAMETERS_H_
+#endif  // SRC_CONNECTIVITY_BLUETOOTH_CORE_BT_HOST_HCI_SPEC_LE_CONNECTION_PARAMETERS_H_
diff --git a/src/connectivity/bluetooth/core/bt-host/hci/link_key.cc b/src/connectivity/bluetooth/core/bt-host/hci-spec/link_key.cc
similarity index 100%
rename from src/connectivity/bluetooth/core/bt-host/hci/link_key.cc
rename to src/connectivity/bluetooth/core/bt-host/hci-spec/link_key.cc
diff --git a/src/connectivity/bluetooth/core/bt-host/hci/link_key.h b/src/connectivity/bluetooth/core/bt-host/hci-spec/link_key.h
similarity index 83%
rename from src/connectivity/bluetooth/core/bt-host/hci/link_key.h
rename to src/connectivity/bluetooth/core/bt-host/hci-spec/link_key.h
index cac1d2b..f0f6aae 100644
--- a/src/connectivity/bluetooth/core/bt-host/hci/link_key.h
+++ b/src/connectivity/bluetooth/core/bt-host/hci-spec/link_key.h
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef SRC_CONNECTIVITY_BLUETOOTH_CORE_BT_HOST_HCI_LINK_KEY_H_
-#define SRC_CONNECTIVITY_BLUETOOTH_CORE_BT_HOST_HCI_LINK_KEY_H_
+#ifndef SRC_CONNECTIVITY_BLUETOOTH_CORE_BT_HOST_HCI_SPEC_LINK_KEY_H_
+#define SRC_CONNECTIVITY_BLUETOOTH_CORE_BT_HOST_HCI_SPEC_LINK_KEY_H_
 
 #include <cstdint>
 
@@ -38,4 +38,4 @@
 
 }  // namespace bt::hci
 
-#endif  // SRC_CONNECTIVITY_BLUETOOTH_CORE_BT_HOST_HCI_LINK_KEY_H_
+#endif  // SRC_CONNECTIVITY_BLUETOOTH_CORE_BT_HOST_HCI_SPEC_LINK_KEY_H_
diff --git a/src/connectivity/bluetooth/core/bt-host/hci/lmp_feature_set.h b/src/connectivity/bluetooth/core/bt-host/hci-spec/lmp_feature_set.h
similarity index 89%
rename from src/connectivity/bluetooth/core/bt-host/hci/lmp_feature_set.h
rename to src/connectivity/bluetooth/core/bt-host/hci-spec/lmp_feature_set.h
index 96b06ea..3ab08cc 100644
--- a/src/connectivity/bluetooth/core/bt-host/hci/lmp_feature_set.h
+++ b/src/connectivity/bluetooth/core/bt-host/hci-spec/lmp_feature_set.h
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef SRC_CONNECTIVITY_BLUETOOTH_CORE_BT_HOST_HCI_LMP_FEATURE_SET_H_
-#define SRC_CONNECTIVITY_BLUETOOTH_CORE_BT_HOST_HCI_LMP_FEATURE_SET_H_
+#ifndef SRC_CONNECTIVITY_BLUETOOTH_CORE_BT_HOST_HCI_SPEC_LMP_FEATURE_SET_H_
+#define SRC_CONNECTIVITY_BLUETOOTH_CORE_BT_HOST_HCI_SPEC_LMP_FEATURE_SET_H_
 
 #include <zircon/assert.h>
 
@@ -11,7 +11,7 @@
 #include <string>
 
 #include "src/connectivity/bluetooth/core/bt-host/common/log.h"
-#include "src/connectivity/bluetooth/core/bt-host/hci/hci_constants.h"
+#include "src/connectivity/bluetooth/core/bt-host/hci-spec/constants.h"
 #include "src/lib/fxl/strings/string_printf.h"
 
 namespace bt::hci {
@@ -79,4 +79,4 @@
 
 }  // namespace bt::hci
 
-#endif  // SRC_CONNECTIVITY_BLUETOOTH_CORE_BT_HOST_HCI_LMP_FEATURE_SET_H_
+#endif  // SRC_CONNECTIVITY_BLUETOOTH_CORE_BT_HOST_HCI_SPEC_LMP_FEATURE_SET_H_
diff --git a/src/connectivity/bluetooth/core/bt-host/hci/hci.h b/src/connectivity/bluetooth/core/bt-host/hci-spec/protocol.h
similarity index 99%
rename from src/connectivity/bluetooth/core/bt-host/hci/hci.h
rename to src/connectivity/bluetooth/core/bt-host/hci-spec/protocol.h
index 534293c..1a4cc64 100644
--- a/src/connectivity/bluetooth/core/bt-host/hci/hci.h
+++ b/src/connectivity/bluetooth/core/bt-host/hci-spec/protocol.h
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef SRC_CONNECTIVITY_BLUETOOTH_CORE_BT_HOST_HCI_HCI_H_
-#define SRC_CONNECTIVITY_BLUETOOTH_CORE_BT_HOST_HCI_HCI_H_
+#ifndef SRC_CONNECTIVITY_BLUETOOTH_CORE_BT_HOST_HCI_SPEC_PROTOCOL_H_
+#define SRC_CONNECTIVITY_BLUETOOTH_CORE_BT_HOST_HCI_SPEC_PROTOCOL_H_
 
 #include <zircon/compiler.h>
 
@@ -15,8 +15,7 @@
 #include "src/connectivity/bluetooth/core/bt-host/common/device_address.h"
 #include "src/connectivity/bluetooth/core/bt-host/common/device_class.h"
 #include "src/connectivity/bluetooth/core/bt-host/common/uint128.h"
-#include "src/connectivity/bluetooth/core/bt-host/hci/hci_constants.h"
-#include "src/connectivity/bluetooth/core/bt-host/hci/status.h"
+#include "src/connectivity/bluetooth/core/bt-host/hci-spec/constants.h"
 
 // This file contains general opcode/number and static packet definitions for
 // the Bluetooth Host-Controller Interface. Each packet payload structure
@@ -778,7 +777,6 @@
   uint16_t flush_timeout;
 } __PACKED;
 
-
 // ===============================================================
 // Read Transmit Transmit Power Level Command (v1.1) (BR/EDR & LE)
 constexpr OpCode kReadTransmitPowerLevel = ControllerAndBasebandOpCode(0x002D);
@@ -2813,7 +2811,7 @@
   ConnectionHandle connection_handle;
 
   // Reason that the connection parameter request was rejected.
-  Status reason;
+  StatusCode reason;
 } __PACKED;
 
 struct LERemoteConnectionParamReqNegativeReplyReturnParams {
@@ -3685,4 +3683,4 @@
 
 }  // namespace bt::hci
 
-#endif  // SRC_CONNECTIVITY_BLUETOOTH_CORE_BT_HOST_HCI_HCI_H_
+#endif  // SRC_CONNECTIVITY_BLUETOOTH_CORE_BT_HOST_HCI_SPEC_PROTOCOL_H_
diff --git a/src/connectivity/bluetooth/core/bt-host/hci/util.cc b/src/connectivity/bluetooth/core/bt-host/hci-spec/util.cc
similarity index 100%
rename from src/connectivity/bluetooth/core/bt-host/hci/util.cc
rename to src/connectivity/bluetooth/core/bt-host/hci-spec/util.cc
diff --git a/src/connectivity/bluetooth/core/bt-host/hci/util.h b/src/connectivity/bluetooth/core/bt-host/hci-spec/util.h
similarity index 82%
rename from src/connectivity/bluetooth/core/bt-host/hci/util.h
rename to src/connectivity/bluetooth/core/bt-host/hci-spec/util.h
index 7b7e14b..8475c93 100644
--- a/src/connectivity/bluetooth/core/bt-host/hci/util.h
+++ b/src/connectivity/bluetooth/core/bt-host/hci-spec/util.h
@@ -2,14 +2,13 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef SRC_CONNECTIVITY_BLUETOOTH_CORE_BT_HOST_HCI_UTIL_H_
-#define SRC_CONNECTIVITY_BLUETOOTH_CORE_BT_HOST_HCI_UTIL_H_
+#ifndef SRC_CONNECTIVITY_BLUETOOTH_CORE_BT_HOST_HCI_SPEC_UTIL_H_
+#define SRC_CONNECTIVITY_BLUETOOTH_CORE_BT_HOST_HCI_SPEC_UTIL_H_
 
 #include <string>
 
-#include "src/connectivity/bluetooth/core/bt-host/common/byte_buffer.h"
 #include "src/connectivity/bluetooth/core/bt-host/common/device_address.h"
-#include "src/connectivity/bluetooth/core/bt-host/hci/hci.h"
+#include "src/connectivity/bluetooth/core/bt-host/hci-spec/protocol.h"
 
 namespace bt::hci {
 
@@ -41,4 +40,4 @@
 
 }  // namespace bt::hci
 
-#endif  // SRC_CONNECTIVITY_BLUETOOTH_CORE_BT_HOST_HCI_UTIL_H_
+#endif  // SRC_CONNECTIVITY_BLUETOOTH_CORE_BT_HOST_HCI_SPEC_UTIL_H_
diff --git a/src/connectivity/bluetooth/core/bt-host/hci/util_unittest.cc b/src/connectivity/bluetooth/core/bt-host/hci-spec/util_unittest.cc
similarity index 100%
rename from src/connectivity/bluetooth/core/bt-host/hci/util_unittest.cc
rename to src/connectivity/bluetooth/core/bt-host/hci-spec/util_unittest.cc
diff --git a/src/connectivity/bluetooth/core/bt-host/hci/BUILD.gn b/src/connectivity/bluetooth/core/bt-host/hci/BUILD.gn
index fe11175..8539cb6 100644
--- a/src/connectivity/bluetooth/core/bt-host/hci/BUILD.gn
+++ b/src/connectivity/bluetooth/core/bt-host/hci/BUILD.gn
@@ -9,20 +9,15 @@
 # emulation.
 source_set("definitions") {
   sources = [
-    "connection_parameters.cc",
-    "connection_parameters.h",
-    "hci.h",
-    "hci_constants.h",
     "hci_defs.h",
-    "link_key.cc",
-    "link_key.h",
     "status.cc",
     "status.h",
-    "util.cc",
-    "util.h",
   ]
 
-  public_deps = [ "//src/connectivity/bluetooth/core/bt-host/common" ]
+  public_deps = [
+    "//src/connectivity/bluetooth/core/bt-host/common",
+    "//src/connectivity/bluetooth/core/bt-host/hci-spec",
+  ]
 }
 
 static_library("hci") {
@@ -42,7 +37,6 @@
     "connection.h",
     "control_packets.cc",
     "control_packets.h",
-    "defaults.h",
     "device_wrapper.cc",
     "device_wrapper.h",
     "legacy_low_energy_advertiser.cc",
@@ -117,7 +111,6 @@
     "slab_allocators_unittest.cc",
     "status_unittest.cc",
     "transport_unittest.cc",
-    "util_unittest.cc",
   ]
 
   deps = [
diff --git a/src/connectivity/bluetooth/core/bt-host/hci/acl_data_channel.h b/src/connectivity/bluetooth/core/bt-host/hci/acl_data_channel.h
index 09c3a59..3a6bd7b 100644
--- a/src/connectivity/bluetooth/core/bt-host/hci/acl_data_channel.h
+++ b/src/connectivity/bluetooth/core/bt-host/hci/acl_data_channel.h
@@ -17,11 +17,11 @@
 #include <unordered_map>
 
 #include "src/connectivity/bluetooth/core/bt-host/common/byte_buffer.h"
+#include "src/connectivity/bluetooth/core/bt-host/hci-spec/constants.h"
 #include "src/connectivity/bluetooth/core/bt-host/hci/acl_data_packet.h"
 #include "src/connectivity/bluetooth/core/bt-host/hci/command_channel.h"
 #include "src/connectivity/bluetooth/core/bt-host/hci/connection.h"
 #include "src/connectivity/bluetooth/core/bt-host/hci/control_packets.h"
-#include "src/connectivity/bluetooth/core/bt-host/hci/hci_constants.h"
 #include "src/connectivity/bluetooth/core/bt-host/hci/hci_defs.h"
 
 namespace bt::hci {
diff --git a/src/connectivity/bluetooth/core/bt-host/hci/acl_data_channel_unittest.cc b/src/connectivity/bluetooth/core/bt-host/hci/acl_data_channel_unittest.cc
index 3c58039..0fcf2a3 100644
--- a/src/connectivity/bluetooth/core/bt-host/hci/acl_data_channel_unittest.cc
+++ b/src/connectivity/bluetooth/core/bt-host/hci/acl_data_channel_unittest.cc
@@ -11,8 +11,8 @@
 
 #include "src/connectivity/bluetooth/core/bt-host/common/byte_buffer.h"
 #include "src/connectivity/bluetooth/core/bt-host/common/test_helpers.h"
+#include "src/connectivity/bluetooth/core/bt-host/hci-spec/defaults.h"
 #include "src/connectivity/bluetooth/core/bt-host/hci/connection.h"
-#include "src/connectivity/bluetooth/core/bt-host/hci/defaults.h"
 #include "src/connectivity/bluetooth/core/bt-host/hci/transport.h"
 #include "src/connectivity/bluetooth/core/bt-host/l2cap/l2cap_defs.h"
 #include "src/connectivity/bluetooth/core/bt-host/testing/controller_test.h"
diff --git a/src/connectivity/bluetooth/core/bt-host/hci/acl_data_packet.cc b/src/connectivity/bluetooth/core/bt-host/hci/acl_data_packet.cc
index 5d7db52..6602ea6 100644
--- a/src/connectivity/bluetooth/core/bt-host/hci/acl_data_packet.cc
+++ b/src/connectivity/bluetooth/core/bt-host/hci/acl_data_packet.cc
@@ -8,6 +8,7 @@
 #include <zircon/assert.h>
 
 #include "slab_allocators.h"
+#include "src/connectivity/bluetooth/core/bt-host/common/log.h"
 
 namespace bt::hci {
 namespace slab_allocators {
diff --git a/src/connectivity/bluetooth/core/bt-host/hci/acl_data_packet.h b/src/connectivity/bluetooth/core/bt-host/hci/acl_data_packet.h
index 7e9c05f..39c4c87 100644
--- a/src/connectivity/bluetooth/core/bt-host/hci/acl_data_packet.h
+++ b/src/connectivity/bluetooth/core/bt-host/hci/acl_data_packet.h
@@ -14,7 +14,7 @@
 
 #include "src/connectivity/bluetooth/core/bt-host/common/byte_buffer.h"
 #include "src/connectivity/bluetooth/core/bt-host/common/packet_view.h"
-#include "src/connectivity/bluetooth/core/bt-host/hci/hci.h"
+#include "src/connectivity/bluetooth/core/bt-host/hci-spec/protocol.h"
 #include "src/connectivity/bluetooth/core/bt-host/hci/packet.h"
 
 namespace bt::hci {
diff --git a/src/connectivity/bluetooth/core/bt-host/hci/advertising_report_parser.h b/src/connectivity/bluetooth/core/bt-host/hci/advertising_report_parser.h
index ec82d90..3caf2b7 100644
--- a/src/connectivity/bluetooth/core/bt-host/hci/advertising_report_parser.h
+++ b/src/connectivity/bluetooth/core/bt-host/hci/advertising_report_parser.h
@@ -7,8 +7,8 @@
 
 #include <fbl/macros.h>
 
+#include "src/connectivity/bluetooth/core/bt-host/hci-spec/protocol.h"
 #include "src/connectivity/bluetooth/core/bt-host/hci/control_packets.h"
-#include "src/connectivity/bluetooth/core/bt-host/hci/hci.h"
 
 namespace bt::hci {
 
diff --git a/src/connectivity/bluetooth/core/bt-host/hci/bredr_connection_request.cc b/src/connectivity/bluetooth/core/bt-host/hci/bredr_connection_request.cc
index a888d78..f369f5e 100644
--- a/src/connectivity/bluetooth/core/bt-host/hci/bredr_connection_request.cc
+++ b/src/connectivity/bluetooth/core/bt-host/hci/bredr_connection_request.cc
@@ -6,11 +6,11 @@
 
 #include "src/connectivity/bluetooth/core/bt-host/common/identifier.h"
 #include "src/connectivity/bluetooth/core/bt-host/common/log.h"
+#include "src/connectivity/bluetooth/core/bt-host/hci-spec/defaults.h"
+#include "src/connectivity/bluetooth/core/bt-host/hci-spec/protocol.h"
+#include "src/connectivity/bluetooth/core/bt-host/hci-spec/util.h"
 #include "src/connectivity/bluetooth/core/bt-host/hci/connection.h"
-#include "src/connectivity/bluetooth/core/bt-host/hci/defaults.h"
-#include "src/connectivity/bluetooth/core/bt-host/hci/hci.h"
 #include "src/connectivity/bluetooth/core/bt-host/hci/status.h"
-#include "src/connectivity/bluetooth/core/bt-host/hci/util.h"
 
 namespace bt::hci {
 
diff --git a/src/connectivity/bluetooth/core/bt-host/hci/bredr_connection_request.h b/src/connectivity/bluetooth/core/bt-host/hci/bredr_connection_request.h
index 2173562..ae610e9 100644
--- a/src/connectivity/bluetooth/core/bt-host/hci/bredr_connection_request.h
+++ b/src/connectivity/bluetooth/core/bt-host/hci/bredr_connection_request.h
@@ -10,12 +10,12 @@
 
 #include "src/connectivity/bluetooth/core/bt-host/common/identifier.h"
 #include "src/connectivity/bluetooth/core/bt-host/common/log.h"
+#include "src/connectivity/bluetooth/core/bt-host/hci-spec/defaults.h"
+#include "src/connectivity/bluetooth/core/bt-host/hci-spec/protocol.h"
+#include "src/connectivity/bluetooth/core/bt-host/hci-spec/util.h"
 #include "src/connectivity/bluetooth/core/bt-host/hci/command_channel.h"
 #include "src/connectivity/bluetooth/core/bt-host/hci/connection.h"
-#include "src/connectivity/bluetooth/core/bt-host/hci/defaults.h"
-#include "src/connectivity/bluetooth/core/bt-host/hci/hci.h"
 #include "src/connectivity/bluetooth/core/bt-host/hci/status.h"
-#include "src/connectivity/bluetooth/core/bt-host/hci/util.h"
 
 namespace bt::hci {
 
diff --git a/src/connectivity/bluetooth/core/bt-host/hci/command_channel.h b/src/connectivity/bluetooth/core/bt-host/hci/command_channel.h
index 96023ce..044dde8 100644
--- a/src/connectivity/bluetooth/core/bt-host/hci/command_channel.h
+++ b/src/connectivity/bluetooth/core/bt-host/hci/command_channel.h
@@ -24,9 +24,9 @@
 #include <fbl/macros.h>
 
 #include "src/connectivity/bluetooth/core/bt-host/common/byte_buffer.h"
+#include "src/connectivity/bluetooth/core/bt-host/hci-spec/constants.h"
+#include "src/connectivity/bluetooth/core/bt-host/hci-spec/protocol.h"
 #include "src/connectivity/bluetooth/core/bt-host/hci/control_packets.h"
-#include "src/connectivity/bluetooth/core/bt-host/hci/hci.h"
-#include "src/connectivity/bluetooth/core/bt-host/hci/hci_constants.h"
 #include "src/lib/fxl/functional/cancelable_callback.h"
 #include "src/lib/fxl/memory/ref_ptr.h"
 
diff --git a/src/connectivity/bluetooth/core/bt-host/hci/command_channel_unittest.cc b/src/connectivity/bluetooth/core/bt-host/hci/command_channel_unittest.cc
index 518cb84..85d683c 100644
--- a/src/connectivity/bluetooth/core/bt-host/hci/command_channel_unittest.cc
+++ b/src/connectivity/bluetooth/core/bt-host/hci/command_channel_unittest.cc
@@ -8,8 +8,8 @@
 
 #include "src/connectivity/bluetooth/core/bt-host/common/byte_buffer.h"
 #include "src/connectivity/bluetooth/core/bt-host/common/test_helpers.h"
+#include "src/connectivity/bluetooth/core/bt-host/hci-spec/protocol.h"
 #include "src/connectivity/bluetooth/core/bt-host/hci/control_packets.h"
-#include "src/connectivity/bluetooth/core/bt-host/hci/hci.h"
 #include "src/connectivity/bluetooth/core/bt-host/testing/controller_test.h"
 #include "src/connectivity/bluetooth/core/bt-host/testing/mock_controller.h"
 
diff --git a/src/connectivity/bluetooth/core/bt-host/hci/command_handler.h b/src/connectivity/bluetooth/core/bt-host/hci/command_handler.h
index 5cd8890..1d7aded 100644
--- a/src/connectivity/bluetooth/core/bt-host/hci/command_handler.h
+++ b/src/connectivity/bluetooth/core/bt-host/hci/command_handler.h
@@ -9,8 +9,8 @@
 #include <lib/fit/result.h>
 
 #include "src/connectivity/bluetooth/core/bt-host/common/log.h"
+#include "src/connectivity/bluetooth/core/bt-host/hci-spec/protocol.h"
 #include "src/connectivity/bluetooth/core/bt-host/hci/command_channel.h"
-#include "src/connectivity/bluetooth/core/bt-host/hci/hci.h"
 #include "src/lib/fxl/memory/weak_ptr.h"
 
 namespace bt::hci {
diff --git a/src/connectivity/bluetooth/core/bt-host/hci/connection.cc b/src/connectivity/bluetooth/core/bt-host/hci/connection.cc
index 6bbc4a4..4697521 100644
--- a/src/connectivity/bluetooth/core/bt-host/hci/connection.cc
+++ b/src/connectivity/bluetooth/core/bt-host/hci/connection.cc
@@ -7,10 +7,10 @@
 #include <endian.h>
 
 #include "command_channel.h"
-#include "defaults.h"
 #include "lib/async/default.h"
 #include "src/connectivity/bluetooth/core/bt-host/common/log.h"
-#include "src/connectivity/bluetooth/core/bt-host/hci/hci.h"
+#include "src/connectivity/bluetooth/core/bt-host/hci-spec/defaults.h"
+#include "src/connectivity/bluetooth/core/bt-host/hci-spec/protocol.h"
 #include "src/connectivity/bluetooth/core/bt-host/hci/status.h"
 #include "src/lib/fxl/strings/string_printf.h"
 #include "transport.h"
diff --git a/src/connectivity/bluetooth/core/bt-host/hci/connection.h b/src/connectivity/bluetooth/core/bt-host/hci/connection.h
index b3a36ea..fc4c058 100644
--- a/src/connectivity/bluetooth/core/bt-host/hci/connection.h
+++ b/src/connectivity/bluetooth/core/bt-host/hci/connection.h
@@ -12,10 +12,10 @@
 #include <fbl/macros.h>
 
 #include "src/connectivity/bluetooth/core/bt-host/common/device_address.h"
-#include "src/connectivity/bluetooth/core/bt-host/hci/connection_parameters.h"
+#include "src/connectivity/bluetooth/core/bt-host/hci-spec/le_connection_parameters.h"
+#include "src/connectivity/bluetooth/core/bt-host/hci-spec/link_key.h"
+#include "src/connectivity/bluetooth/core/bt-host/hci-spec/protocol.h"
 #include "src/connectivity/bluetooth/core/bt-host/hci/control_packets.h"
-#include "src/connectivity/bluetooth/core/bt-host/hci/hci.h"
-#include "src/connectivity/bluetooth/core/bt-host/hci/link_key.h"
 #include "src/lib/fxl/memory/ref_ptr.h"
 #include "src/lib/fxl/memory/weak_ptr.h"
 
diff --git a/src/connectivity/bluetooth/core/bt-host/hci/connection_unittest.cc b/src/connectivity/bluetooth/core/bt-host/hci/connection_unittest.cc
index 3d9a9fa..bb71bf0 100644
--- a/src/connectivity/bluetooth/core/bt-host/hci/connection_unittest.cc
+++ b/src/connectivity/bluetooth/core/bt-host/hci/connection_unittest.cc
@@ -5,7 +5,7 @@
 #include "src/connectivity/bluetooth/core/bt-host/hci/connection.h"
 
 #include "src/connectivity/bluetooth/core/bt-host/common/test_helpers.h"
-#include "src/connectivity/bluetooth/core/bt-host/hci/hci.h"
+#include "src/connectivity/bluetooth/core/bt-host/hci-spec/protocol.h"
 #include "src/connectivity/bluetooth/core/bt-host/l2cap/l2cap_defs.h"
 #include "src/connectivity/bluetooth/core/bt-host/testing/controller_test.h"
 #include "src/connectivity/bluetooth/core/bt-host/testing/mock_controller.h"
diff --git a/src/connectivity/bluetooth/core/bt-host/hci/control_packets.h b/src/connectivity/bluetooth/core/bt-host/hci/control_packets.h
index fc6f305..1038daf 100644
--- a/src/connectivity/bluetooth/core/bt-host/hci/control_packets.h
+++ b/src/connectivity/bluetooth/core/bt-host/hci/control_packets.h
@@ -12,7 +12,7 @@
 #include <fbl/macros.h>
 
 #include "src/connectivity/bluetooth/core/bt-host/common/byte_buffer.h"
-#include "src/connectivity/bluetooth/core/bt-host/hci/hci.h"
+#include "src/connectivity/bluetooth/core/bt-host/hci-spec/protocol.h"
 #include "src/connectivity/bluetooth/core/bt-host/hci/packet.h"
 #include "src/connectivity/bluetooth/core/bt-host/hci/status.h"
 
diff --git a/src/connectivity/bluetooth/core/bt-host/hci/legacy_low_energy_advertiser.cc b/src/connectivity/bluetooth/core/bt-host/hci/legacy_low_energy_advertiser.cc
index f1ed1e1..1fc7110 100644
--- a/src/connectivity/bluetooth/core/bt-host/hci/legacy_low_energy_advertiser.cc
+++ b/src/connectivity/bluetooth/core/bt-host/hci/legacy_low_energy_advertiser.cc
@@ -10,8 +10,8 @@
 
 #include "src/connectivity/bluetooth/core/bt-host/common/byte_buffer.h"
 #include "src/connectivity/bluetooth/core/bt-host/common/log.h"
+#include "src/connectivity/bluetooth/core/bt-host/hci-spec/util.h"
 #include "src/connectivity/bluetooth/core/bt-host/hci/transport.h"
-#include "src/connectivity/bluetooth/core/bt-host/hci/util.h"
 
 namespace bt::hci {
 
diff --git a/src/connectivity/bluetooth/core/bt-host/hci/legacy_low_energy_advertiser_unittest.cc b/src/connectivity/bluetooth/core/bt-host/hci/legacy_low_energy_advertiser_unittest.cc
index f3a9787..a6e58d8 100644
--- a/src/connectivity/bluetooth/core/bt-host/hci/legacy_low_energy_advertiser_unittest.cc
+++ b/src/connectivity/bluetooth/core/bt-host/hci/legacy_low_energy_advertiser_unittest.cc
@@ -10,7 +10,7 @@
 #include "src/connectivity/bluetooth/core/bt-host/common/device_address.h"
 #include "src/connectivity/bluetooth/core/bt-host/common/test_helpers.h"
 #include "src/connectivity/bluetooth/core/bt-host/common/uuid.h"
-#include "src/connectivity/bluetooth/core/bt-host/hci/defaults.h"
+#include "src/connectivity/bluetooth/core/bt-host/hci-spec/defaults.h"
 #include "src/connectivity/bluetooth/core/bt-host/hci/fake_connection.h"
 #include "src/connectivity/bluetooth/core/bt-host/testing/controller_test.h"
 #include "src/connectivity/bluetooth/core/bt-host/testing/fake_controller.h"
diff --git a/src/connectivity/bluetooth/core/bt-host/hci/legacy_low_energy_scanner.cc b/src/connectivity/bluetooth/core/bt-host/hci/legacy_low_energy_scanner.cc
index c8c247b..ec37ebd 100644
--- a/src/connectivity/bluetooth/core/bt-host/hci/legacy_low_energy_scanner.cc
+++ b/src/connectivity/bluetooth/core/bt-host/hci/legacy_low_energy_scanner.cc
@@ -9,12 +9,12 @@
 #include <zircon/assert.h>
 
 #include "src/connectivity/bluetooth/core/bt-host/common/log.h"
+#include "src/connectivity/bluetooth/core/bt-host/hci-spec/protocol.h"
+#include "src/connectivity/bluetooth/core/bt-host/hci-spec/util.h"
 #include "src/connectivity/bluetooth/core/bt-host/hci/advertising_report_parser.h"
-#include "src/connectivity/bluetooth/core/bt-host/hci/hci.h"
 #include "src/connectivity/bluetooth/core/bt-host/hci/local_address_delegate.h"
 #include "src/connectivity/bluetooth/core/bt-host/hci/sequential_command_runner.h"
 #include "src/connectivity/bluetooth/core/bt-host/hci/transport.h"
-#include "src/connectivity/bluetooth/core/bt-host/hci/util.h"
 
 namespace bt::hci {
 namespace {
diff --git a/src/connectivity/bluetooth/core/bt-host/hci/legacy_low_energy_scanner.h b/src/connectivity/bluetooth/core/bt-host/hci/legacy_low_energy_scanner.h
index 6d9c3ea..8630150 100644
--- a/src/connectivity/bluetooth/core/bt-host/hci/legacy_low_energy_scanner.h
+++ b/src/connectivity/bluetooth/core/bt-host/hci/legacy_low_energy_scanner.h
@@ -13,8 +13,8 @@
 #include <unordered_map>
 
 #include "src/connectivity/bluetooth/core/bt-host/common/byte_buffer.h"
+#include "src/connectivity/bluetooth/core/bt-host/hci-spec/protocol.h"
 #include "src/connectivity/bluetooth/core/bt-host/hci/command_channel.h"
-#include "src/connectivity/bluetooth/core/bt-host/hci/hci.h"
 #include "src/connectivity/bluetooth/core/bt-host/hci/low_energy_scanner.h"
 #include "src/lib/fxl/memory/ref_counted.h"
 
diff --git a/src/connectivity/bluetooth/core/bt-host/hci/low_energy_advertiser.h b/src/connectivity/bluetooth/core/bt-host/hci/low_energy_advertiser.h
index 99c08c6..4b73b11 100644
--- a/src/connectivity/bluetooth/core/bt-host/hci/low_energy_advertiser.h
+++ b/src/connectivity/bluetooth/core/bt-host/hci/low_energy_advertiser.h
@@ -12,8 +12,8 @@
 #include "src/connectivity/bluetooth/core/bt-host/common/advertising_data.h"
 #include "src/connectivity/bluetooth/core/bt-host/common/byte_buffer.h"
 #include "src/connectivity/bluetooth/core/bt-host/common/device_address.h"
+#include "src/connectivity/bluetooth/core/bt-host/hci-spec/constants.h"
 #include "src/connectivity/bluetooth/core/bt-host/hci/connection.h"
-#include "src/connectivity/bluetooth/core/bt-host/hci/hci_constants.h"
 #include "src/connectivity/bluetooth/core/bt-host/hci/local_address_delegate.h"
 
 namespace bt::hci {
@@ -81,8 +81,8 @@
   // when this advertisement is connected to and the advertisement has been
   // stopped.
   //
-  // |adv_options.interval| must be a value in "controller timeslices". See hci/hci_constants.h for
-  // the valid range.
+  // |adv_options.interval| must be a value in "controller timeslices". See
+  // hci-spec/hci_constants.h for the valid range.
   //
   // Provides results in |callback|. If advertising is setup, the final
   // interval of advertising is provided in |interval| and |status|
diff --git a/src/connectivity/bluetooth/core/bt-host/hci/low_energy_connector.cc b/src/connectivity/bluetooth/core/bt-host/hci/low_energy_connector.cc
index 39956cf..a437888 100644
--- a/src/connectivity/bluetooth/core/bt-host/hci/low_energy_connector.cc
+++ b/src/connectivity/bluetooth/core/bt-host/hci/low_energy_connector.cc
@@ -9,11 +9,11 @@
 #include <zircon/assert.h>
 
 #include "src/connectivity/bluetooth/core/bt-host/common/log.h"
-#include "src/connectivity/bluetooth/core/bt-host/hci/defaults.h"
-#include "src/connectivity/bluetooth/core/bt-host/hci/hci.h"
+#include "src/connectivity/bluetooth/core/bt-host/hci-spec/defaults.h"
+#include "src/connectivity/bluetooth/core/bt-host/hci-spec/protocol.h"
+#include "src/connectivity/bluetooth/core/bt-host/hci-spec/util.h"
 #include "src/connectivity/bluetooth/core/bt-host/hci/local_address_delegate.h"
 #include "src/connectivity/bluetooth/core/bt-host/hci/transport.h"
-#include "src/connectivity/bluetooth/core/bt-host/hci/util.h"
 
 namespace bt::hci {
 
diff --git a/src/connectivity/bluetooth/core/bt-host/hci/low_energy_connector.h b/src/connectivity/bluetooth/core/bt-host/hci/low_energy_connector.h
index 75668b63..dd2fa49 100644
--- a/src/connectivity/bluetooth/core/bt-host/hci/low_energy_connector.h
+++ b/src/connectivity/bluetooth/core/bt-host/hci/low_energy_connector.h
@@ -14,11 +14,11 @@
 #include <fbl/macros.h>
 
 #include "src/connectivity/bluetooth/core/bt-host/common/device_address.h"
+#include "src/connectivity/bluetooth/core/bt-host/hci-spec/constants.h"
+#include "src/connectivity/bluetooth/core/bt-host/hci-spec/le_connection_parameters.h"
 #include "src/connectivity/bluetooth/core/bt-host/hci/command_channel.h"
 #include "src/connectivity/bluetooth/core/bt-host/hci/connection.h"
-#include "src/connectivity/bluetooth/core/bt-host/hci/connection_parameters.h"
 #include "src/connectivity/bluetooth/core/bt-host/hci/control_packets.h"
-#include "src/connectivity/bluetooth/core/bt-host/hci/hci_constants.h"
 #include "src/connectivity/bluetooth/core/bt-host/hci/local_address_delegate.h"
 #include "src/lib/fxl/functional/cancelable_callback.h"
 #include "src/lib/fxl/memory/ref_ptr.h"
diff --git a/src/connectivity/bluetooth/core/bt-host/hci/low_energy_connector_unittest.cc b/src/connectivity/bluetooth/core/bt-host/hci/low_energy_connector_unittest.cc
index c365cc0..7e0cac1 100644
--- a/src/connectivity/bluetooth/core/bt-host/hci/low_energy_connector_unittest.cc
+++ b/src/connectivity/bluetooth/core/bt-host/hci/low_energy_connector_unittest.cc
@@ -10,7 +10,7 @@
 
 #include <fbl/macros.h>
 
-#include "src/connectivity/bluetooth/core/bt-host/hci/defaults.h"
+#include "src/connectivity/bluetooth/core/bt-host/hci-spec/defaults.h"
 #include "src/connectivity/bluetooth/core/bt-host/hci/fake_connection.h"
 #include "src/connectivity/bluetooth/core/bt-host/hci/fake_local_address_delegate.h"
 #include "src/connectivity/bluetooth/core/bt-host/testing/controller_test.h"
diff --git a/src/connectivity/bluetooth/core/bt-host/hci/low_energy_scanner.h b/src/connectivity/bluetooth/core/bt-host/hci/low_energy_scanner.h
index 58fff00..02f7c17 100644
--- a/src/connectivity/bluetooth/core/bt-host/hci/low_energy_scanner.h
+++ b/src/connectivity/bluetooth/core/bt-host/hci/low_energy_scanner.h
@@ -13,8 +13,8 @@
 
 #include "src/connectivity/bluetooth/core/bt-host/common/byte_buffer.h"
 #include "src/connectivity/bluetooth/core/bt-host/common/device_address.h"
-#include "src/connectivity/bluetooth/core/bt-host/hci/defaults.h"
-#include "src/connectivity/bluetooth/core/bt-host/hci/hci_constants.h"
+#include "src/connectivity/bluetooth/core/bt-host/hci-spec/constants.h"
+#include "src/connectivity/bluetooth/core/bt-host/hci-spec/defaults.h"
 #include "src/connectivity/bluetooth/core/bt-host/hci/local_address_delegate.h"
 #include "src/connectivity/bluetooth/core/bt-host/hci/sequential_command_runner.h"
 #include "src/lib/fxl/memory/ref_ptr.h"
diff --git a/src/connectivity/bluetooth/core/bt-host/hci/sequential_command_runner.cc b/src/connectivity/bluetooth/core/bt-host/hci/sequential_command_runner.cc
index 9e0e0c4..c4483a6 100644
--- a/src/connectivity/bluetooth/core/bt-host/hci/sequential_command_runner.cc
+++ b/src/connectivity/bluetooth/core/bt-host/hci/sequential_command_runner.cc
@@ -5,7 +5,7 @@
 #include "sequential_command_runner.h"
 
 #include "command_channel.h"
-#include "hci.h"
+#include "src/connectivity/bluetooth/core/bt-host/hci-spec/protocol.h"
 #include "transport.h"
 
 namespace bt::hci {
diff --git a/src/connectivity/bluetooth/core/bt-host/hci/sequential_command_runner_unittest.cc b/src/connectivity/bluetooth/core/bt-host/hci/sequential_command_runner_unittest.cc
index 91bd934..1591757 100644
--- a/src/connectivity/bluetooth/core/bt-host/hci/sequential_command_runner_unittest.cc
+++ b/src/connectivity/bluetooth/core/bt-host/hci/sequential_command_runner_unittest.cc
@@ -5,7 +5,7 @@
 #include "src/connectivity/bluetooth/core/bt-host/hci/sequential_command_runner.h"
 
 #include "src/connectivity/bluetooth/core/bt-host/common/log.h"
-#include "src/connectivity/bluetooth/core/bt-host/hci/hci.h"
+#include "src/connectivity/bluetooth/core/bt-host/hci-spec/protocol.h"
 #include "src/connectivity/bluetooth/core/bt-host/testing/controller_test.h"
 #include "src/connectivity/bluetooth/core/bt-host/testing/mock_controller.h"
 
diff --git a/src/connectivity/bluetooth/core/bt-host/hci/slab_allocators.h b/src/connectivity/bluetooth/core/bt-host/hci/slab_allocators.h
index acf0d10..ee6d514 100644
--- a/src/connectivity/bluetooth/core/bt-host/hci/slab_allocators.h
+++ b/src/connectivity/bluetooth/core/bt-host/hci/slab_allocators.h
@@ -11,8 +11,8 @@
 #include <fbl/slab_allocator.h>
 
 #include "src/connectivity/bluetooth/core/bt-host/common/slab_allocator_traits.h"
-#include "src/connectivity/bluetooth/core/bt-host/hci/hci.h"
-#include "src/connectivity/bluetooth/core/bt-host/hci/hci_constants.h"
+#include "src/connectivity/bluetooth/core/bt-host/hci-spec/constants.h"
+#include "src/connectivity/bluetooth/core/bt-host/hci-spec/protocol.h"
 #include "src/connectivity/bluetooth/core/bt-host/hci/packet.h"
 
 // This file defines a fbl::SlabAllocator trait template that can be used to
diff --git a/src/connectivity/bluetooth/core/bt-host/hci/status.cc b/src/connectivity/bluetooth/core/bt-host/hci/status.cc
index 14e507e..e4d9701 100644
--- a/src/connectivity/bluetooth/core/bt-host/hci/status.cc
+++ b/src/connectivity/bluetooth/core/bt-host/hci/status.cc
@@ -4,7 +4,7 @@
 
 #include "status.h"
 
-#include "util.h"
+#include "src/connectivity/bluetooth/core/bt-host/hci-spec/util.h"
 
 namespace bt {
 
diff --git a/src/connectivity/bluetooth/core/bt-host/hci/status.h b/src/connectivity/bluetooth/core/bt-host/hci/status.h
index 3e2fe03..abdb99a 100644
--- a/src/connectivity/bluetooth/core/bt-host/hci/status.h
+++ b/src/connectivity/bluetooth/core/bt-host/hci/status.h
@@ -8,7 +8,7 @@
 #include <lib/fit/function.h>
 
 #include "src/connectivity/bluetooth/core/bt-host/common/status.h"
-#include "src/connectivity/bluetooth/core/bt-host/hci/hci_constants.h"
+#include "src/connectivity/bluetooth/core/bt-host/hci-spec/constants.h"
 
 // This file provides a Status template specialization for hci::Status
 //
diff --git a/src/connectivity/bluetooth/core/bt-host/hci/transport_unittest.cc b/src/connectivity/bluetooth/core/bt-host/hci/transport_unittest.cc
index 6435cb1..e64214e 100644
--- a/src/connectivity/bluetooth/core/bt-host/hci/transport_unittest.cc
+++ b/src/connectivity/bluetooth/core/bt-host/hci/transport_unittest.cc
@@ -6,7 +6,7 @@
 
 #include "src/connectivity/bluetooth/core/bt-host/common/byte_buffer.h"
 #include "src/connectivity/bluetooth/core/bt-host/common/test_helpers.h"
-#include "src/connectivity/bluetooth/core/bt-host/hci/hci.h"
+#include "src/connectivity/bluetooth/core/bt-host/hci-spec/protocol.h"
 #include "src/connectivity/bluetooth/core/bt-host/testing/controller_test.h"
 #include "src/connectivity/bluetooth/core/bt-host/testing/mock_controller.h"
 
diff --git a/src/connectivity/bluetooth/core/bt-host/l2cap/basic_mode_rx_engine_fuzztest.cc b/src/connectivity/bluetooth/core/bt-host/l2cap/basic_mode_rx_engine_fuzztest.cc
index 73a4306..132922f 100644
--- a/src/connectivity/bluetooth/core/bt-host/l2cap/basic_mode_rx_engine_fuzztest.cc
+++ b/src/connectivity/bluetooth/core/bt-host/l2cap/basic_mode_rx_engine_fuzztest.cc
@@ -4,7 +4,7 @@
 
 #include "basic_mode_rx_engine.h"
 #include "src/connectivity/bluetooth/core/bt-host/common/byte_buffer.h"
-#include "src/connectivity/bluetooth/core/bt-host/hci/hci.h"
+#include "src/connectivity/bluetooth/core/bt-host/hci-spec/protocol.h"
 #include "src/connectivity/bluetooth/core/bt-host/l2cap/fragmenter.h"
 
 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
diff --git a/src/connectivity/bluetooth/core/bt-host/l2cap/basic_mode_rx_engine_unittest.cc b/src/connectivity/bluetooth/core/bt-host/l2cap/basic_mode_rx_engine_unittest.cc
index 7f12126..c473d7c 100644
--- a/src/connectivity/bluetooth/core/bt-host/l2cap/basic_mode_rx_engine_unittest.cc
+++ b/src/connectivity/bluetooth/core/bt-host/l2cap/basic_mode_rx_engine_unittest.cc
@@ -8,7 +8,7 @@
 
 #include "src/connectivity/bluetooth/core/bt-host/common/byte_buffer.h"
 #include "src/connectivity/bluetooth/core/bt-host/common/test_helpers.h"
-#include "src/connectivity/bluetooth/core/bt-host/hci/hci.h"
+#include "src/connectivity/bluetooth/core/bt-host/hci-spec/protocol.h"
 #include "src/connectivity/bluetooth/core/bt-host/l2cap/fragmenter.h"
 #include "src/connectivity/bluetooth/core/bt-host/l2cap/recombiner.h"
 
diff --git a/src/connectivity/bluetooth/core/bt-host/l2cap/bredr_dynamic_channel_registry_fuzztest.cc b/src/connectivity/bluetooth/core/bt-host/l2cap/bredr_dynamic_channel_registry_fuzztest.cc
index d2778c4..0e44612 100644
--- a/src/connectivity/bluetooth/core/bt-host/l2cap/bredr_dynamic_channel_registry_fuzztest.cc
+++ b/src/connectivity/bluetooth/core/bt-host/l2cap/bredr_dynamic_channel_registry_fuzztest.cc
@@ -7,7 +7,7 @@
 #include <fuzzer/FuzzedDataProvider.h>
 
 #include "src/connectivity/bluetooth/core/bt-host/common/byte_buffer.h"
-#include "src/connectivity/bluetooth/core/bt-host/hci/hci.h"
+#include "src/connectivity/bluetooth/core/bt-host/hci-spec/protocol.h"
 #include "src/connectivity/bluetooth/core/bt-host/l2cap/bredr_dynamic_channel.h"
 #include "src/connectivity/bluetooth/core/bt-host/l2cap/bredr_signaling_channel.h"
 #include "src/connectivity/bluetooth/core/bt-host/l2cap/fake_channel.h"
diff --git a/src/connectivity/bluetooth/core/bt-host/l2cap/bredr_dynamic_channel_unittest.cc b/src/connectivity/bluetooth/core/bt-host/l2cap/bredr_dynamic_channel_unittest.cc
index 9d473c2..b6c8141 100644
--- a/src/connectivity/bluetooth/core/bt-host/l2cap/bredr_dynamic_channel_unittest.cc
+++ b/src/connectivity/bluetooth/core/bt-host/l2cap/bredr_dynamic_channel_unittest.cc
@@ -13,7 +13,7 @@
 #include "lib/gtest/test_loop_fixture.h"
 #include "src/connectivity/bluetooth/core/bt-host/common/byte_buffer.h"
 #include "src/connectivity/bluetooth/core/bt-host/common/test_helpers.h"
-#include "src/connectivity/bluetooth/core/bt-host/hci/hci.h"
+#include "src/connectivity/bluetooth/core/bt-host/hci-spec/protocol.h"
 #include "src/connectivity/bluetooth/core/bt-host/l2cap/fake_signaling_channel.h"
 #include "src/connectivity/bluetooth/core/bt-host/l2cap/l2cap_defs.h"
 
diff --git a/src/connectivity/bluetooth/core/bt-host/l2cap/channel_manager.h b/src/connectivity/bluetooth/core/bt-host/l2cap/channel_manager.h
index 8142b9b..d7b6a14 100644
--- a/src/connectivity/bluetooth/core/bt-host/l2cap/channel_manager.h
+++ b/src/connectivity/bluetooth/core/bt-host/l2cap/channel_manager.h
@@ -18,10 +18,10 @@
 #include <fbl/macros.h>
 
 #include "lib/async/cpp/executor.h"
+#include "src/connectivity/bluetooth/core/bt-host/hci-spec/protocol.h"
 #include "src/connectivity/bluetooth/core/bt-host/hci/acl_data_channel.h"
 #include "src/connectivity/bluetooth/core/bt-host/hci/acl_data_packet.h"
 #include "src/connectivity/bluetooth/core/bt-host/hci/connection.h"
-#include "src/connectivity/bluetooth/core/bt-host/hci/hci.h"
 #include "src/connectivity/bluetooth/core/bt-host/l2cap/channel.h"
 #include "src/connectivity/bluetooth/core/bt-host/l2cap/l2cap_defs.h"
 #include "src/connectivity/bluetooth/core/bt-host/l2cap/le_signaling_channel.h"
diff --git a/src/connectivity/bluetooth/core/bt-host/l2cap/channel_manager_unittest.cc b/src/connectivity/bluetooth/core/bt-host/l2cap/channel_manager_unittest.cc
index 985442b..cf449fe 100644
--- a/src/connectivity/bluetooth/core/bt-host/l2cap/channel_manager_unittest.cc
+++ b/src/connectivity/bluetooth/core/bt-host/l2cap/channel_manager_unittest.cc
@@ -13,9 +13,9 @@
 
 #include "lib/gtest/test_loop_fixture.h"
 #include "src/connectivity/bluetooth/core/bt-host/common/test_helpers.h"
+#include "src/connectivity/bluetooth/core/bt-host/hci-spec/protocol.h"
 #include "src/connectivity/bluetooth/core/bt-host/hci/acl_data_packet.h"
 #include "src/connectivity/bluetooth/core/bt-host/hci/connection.h"
-#include "src/connectivity/bluetooth/core/bt-host/hci/hci.h"
 #include "src/connectivity/bluetooth/core/bt-host/hci/mock_acl_data_channel.h"
 #include "src/connectivity/bluetooth/core/bt-host/l2cap/l2cap_defs.h"
 #include "src/connectivity/bluetooth/core/bt-host/l2cap/test_packets.h"
diff --git a/src/connectivity/bluetooth/core/bt-host/l2cap/fake_channel.h b/src/connectivity/bluetooth/core/bt-host/l2cap/fake_channel.h
index eed0a12..8348b55 100644
--- a/src/connectivity/bluetooth/core/bt-host/l2cap/fake_channel.h
+++ b/src/connectivity/bluetooth/core/bt-host/l2cap/fake_channel.h
@@ -10,7 +10,7 @@
 #include <fbl/macros.h>
 
 #include "src/connectivity/bluetooth/core/bt-host/common/byte_buffer.h"
-#include "src/connectivity/bluetooth/core/bt-host/hci/hci.h"
+#include "src/connectivity/bluetooth/core/bt-host/hci-spec/protocol.h"
 #include "src/connectivity/bluetooth/core/bt-host/l2cap/channel.h"
 #include "src/connectivity/bluetooth/core/bt-host/l2cap/fragmenter.h"
 #include "src/connectivity/bluetooth/core/bt-host/l2cap/l2cap_defs.h"
diff --git a/src/connectivity/bluetooth/core/bt-host/l2cap/fake_channel_test.h b/src/connectivity/bluetooth/core/bt-host/l2cap/fake_channel_test.h
index 7be83b2..b3d64df 100644
--- a/src/connectivity/bluetooth/core/bt-host/l2cap/fake_channel_test.h
+++ b/src/connectivity/bluetooth/core/bt-host/l2cap/fake_channel_test.h
@@ -11,7 +11,7 @@
 
 #include <fbl/macros.h>
 
-#include "src/connectivity/bluetooth/core/bt-host/hci/hci.h"
+#include "src/connectivity/bluetooth/core/bt-host/hci-spec/protocol.h"
 #include "src/connectivity/bluetooth/core/bt-host/l2cap/fake_channel.h"
 #include "src/connectivity/bluetooth/core/bt-host/l2cap/l2cap_defs.h"
 
diff --git a/src/connectivity/bluetooth/core/bt-host/l2cap/fragmenter.h b/src/connectivity/bluetooth/core/bt-host/l2cap/fragmenter.h
index a0064db..be71f6f 100644
--- a/src/connectivity/bluetooth/core/bt-host/l2cap/fragmenter.h
+++ b/src/connectivity/bluetooth/core/bt-host/l2cap/fragmenter.h
@@ -8,7 +8,7 @@
 #include <fbl/macros.h>
 
 #include "src/connectivity/bluetooth/core/bt-host/common/byte_buffer.h"
-#include "src/connectivity/bluetooth/core/bt-host/hci/hci.h"
+#include "src/connectivity/bluetooth/core/bt-host/hci-spec/protocol.h"
 #include "src/connectivity/bluetooth/core/bt-host/l2cap/pdu.h"
 
 namespace bt::l2cap {
diff --git a/src/connectivity/bluetooth/core/bt-host/l2cap/fragmenter_unittest.cc b/src/connectivity/bluetooth/core/bt-host/l2cap/fragmenter_unittest.cc
index e4a95a3..3ab50cc 100644
--- a/src/connectivity/bluetooth/core/bt-host/l2cap/fragmenter_unittest.cc
+++ b/src/connectivity/bluetooth/core/bt-host/l2cap/fragmenter_unittest.cc
@@ -8,7 +8,7 @@
 
 #include "pdu.h"
 #include "src/connectivity/bluetooth/core/bt-host/common/test_helpers.h"
-#include "src/connectivity/bluetooth/core/bt-host/hci/hci.h"
+#include "src/connectivity/bluetooth/core/bt-host/hci-spec/protocol.h"
 
 namespace bt::l2cap {
 namespace {
diff --git a/src/connectivity/bluetooth/core/bt-host/l2cap/l2cap_unittest.cc b/src/connectivity/bluetooth/core/bt-host/l2cap/l2cap_unittest.cc
index a5e14ad..98bf542 100644
--- a/src/connectivity/bluetooth/core/bt-host/l2cap/l2cap_unittest.cc
+++ b/src/connectivity/bluetooth/core/bt-host/l2cap/l2cap_unittest.cc
@@ -11,7 +11,7 @@
 
 #include "src/connectivity/bluetooth/core/bt-host/common/byte_buffer.h"
 #include "src/connectivity/bluetooth/core/bt-host/common/test_helpers.h"
-#include "src/connectivity/bluetooth/core/bt-host/hci/hci.h"
+#include "src/connectivity/bluetooth/core/bt-host/hci-spec/protocol.h"
 #include "src/connectivity/bluetooth/core/bt-host/l2cap/channel.h"
 #include "src/connectivity/bluetooth/core/bt-host/l2cap/l2cap_defs.h"
 #include "src/connectivity/bluetooth/core/bt-host/l2cap/test_packets.h"
diff --git a/src/connectivity/bluetooth/core/bt-host/l2cap/le_signaling_channel.h b/src/connectivity/bluetooth/core/bt-host/l2cap/le_signaling_channel.h
index 4cf4e3d..f079143 100644
--- a/src/connectivity/bluetooth/core/bt-host/l2cap/le_signaling_channel.h
+++ b/src/connectivity/bluetooth/core/bt-host/l2cap/le_signaling_channel.h
@@ -9,7 +9,7 @@
 
 #include <fbl/macros.h>
 
-#include "src/connectivity/bluetooth/core/bt-host/hci/connection_parameters.h"
+#include "src/connectivity/bluetooth/core/bt-host/hci-spec/le_connection_parameters.h"
 #include "src/connectivity/bluetooth/core/bt-host/l2cap/signaling_channel.h"
 
 namespace bt::l2cap::internal {
diff --git a/src/connectivity/bluetooth/core/bt-host/l2cap/logical_link.h b/src/connectivity/bluetooth/core/bt-host/l2cap/logical_link.h
index 6799f67..c006c20 100644
--- a/src/connectivity/bluetooth/core/bt-host/l2cap/logical_link.h
+++ b/src/connectivity/bluetooth/core/bt-host/l2cap/logical_link.h
@@ -23,9 +23,9 @@
 
 #include "lib/fit/result.h"
 #include "src/connectivity/bluetooth/core/bt-host/common/inspectable.h"
+#include "src/connectivity/bluetooth/core/bt-host/hci-spec/protocol.h"
 #include "src/connectivity/bluetooth/core/bt-host/hci/acl_data_packet.h"
 #include "src/connectivity/bluetooth/core/bt-host/hci/connection.h"
-#include "src/connectivity/bluetooth/core/bt-host/hci/hci.h"
 #include "src/connectivity/bluetooth/core/bt-host/hci/hci_defs.h"
 #include "src/connectivity/bluetooth/core/bt-host/hci/transport.h"
 #include "src/connectivity/bluetooth/core/bt-host/l2cap/bredr_command_handler.h"
diff --git a/src/connectivity/bluetooth/core/bt-host/l2cap/logical_link_unittest.cc b/src/connectivity/bluetooth/core/bt-host/l2cap/logical_link_unittest.cc
index 1847edb..9d4e53a 100644
--- a/src/connectivity/bluetooth/core/bt-host/l2cap/logical_link_unittest.cc
+++ b/src/connectivity/bluetooth/core/bt-host/l2cap/logical_link_unittest.cc
@@ -8,8 +8,8 @@
 #include "lib/fit/single_threaded_executor.h"
 #include "lib/gtest/test_loop_fixture.h"
 #include "src/connectivity/bluetooth/core/bt-host/att/att.h"
+#include "src/connectivity/bluetooth/core/bt-host/hci-spec/protocol.h"
 #include "src/connectivity/bluetooth/core/bt-host/hci/connection.h"
-#include "src/connectivity/bluetooth/core/bt-host/hci/hci.h"
 #include "src/connectivity/bluetooth/core/bt-host/hci/mock_acl_data_channel.h"
 #include "src/connectivity/bluetooth/core/bt-host/l2cap/l2cap_defs.h"
 #include "src/connectivity/bluetooth/core/bt-host/sm/smp.h"
diff --git a/src/connectivity/bluetooth/core/bt-host/l2cap/pdu_unittest.cc b/src/connectivity/bluetooth/core/bt-host/l2cap/pdu_unittest.cc
index 917c722..bf02589 100644
--- a/src/connectivity/bluetooth/core/bt-host/l2cap/pdu_unittest.cc
+++ b/src/connectivity/bluetooth/core/bt-host/l2cap/pdu_unittest.cc
@@ -9,7 +9,7 @@
 #include "fragmenter.h"
 #include "recombiner.h"
 #include "src/connectivity/bluetooth/core/bt-host/common/test_helpers.h"
-#include "src/connectivity/bluetooth/core/bt-host/hci/hci.h"
+#include "src/connectivity/bluetooth/core/bt-host/hci-spec/protocol.h"
 #include "src/connectivity/bluetooth/core/bt-host/hci/packet.h"
 
 namespace bt::l2cap {
diff --git a/src/connectivity/bluetooth/core/bt-host/l2cap/recombiner.h b/src/connectivity/bluetooth/core/bt-host/l2cap/recombiner.h
index 32b6eb6..9c27de1 100644
--- a/src/connectivity/bluetooth/core/bt-host/l2cap/recombiner.h
+++ b/src/connectivity/bluetooth/core/bt-host/l2cap/recombiner.h
@@ -11,8 +11,8 @@
 
 #include <fbl/macros.h>
 
+#include "src/connectivity/bluetooth/core/bt-host/hci-spec/protocol.h"
 #include "src/connectivity/bluetooth/core/bt-host/hci/acl_data_packet.h"
-#include "src/connectivity/bluetooth/core/bt-host/hci/hci.h"
 #include "src/connectivity/bluetooth/core/bt-host/l2cap/l2cap_defs.h"
 #include "src/connectivity/bluetooth/core/bt-host/l2cap/pdu.h"
 
diff --git a/src/connectivity/bluetooth/core/bt-host/l2cap/recombiner_unittest.cc b/src/connectivity/bluetooth/core/bt-host/l2cap/recombiner_unittest.cc
index 0f2b170..32e97bd 100644
--- a/src/connectivity/bluetooth/core/bt-host/l2cap/recombiner_unittest.cc
+++ b/src/connectivity/bluetooth/core/bt-host/l2cap/recombiner_unittest.cc
@@ -7,7 +7,7 @@
 #include <gtest/gtest.h>
 
 #include "pdu.h"
-#include "src/connectivity/bluetooth/core/bt-host/hci/hci.h"
+#include "src/connectivity/bluetooth/core/bt-host/hci-spec/protocol.h"
 #include "src/connectivity/bluetooth/core/bt-host/hci/packet.h"
 
 namespace bt::l2cap {
diff --git a/src/connectivity/bluetooth/core/bt-host/l2cap/test_packets.cc b/src/connectivity/bluetooth/core/bt-host/l2cap/test_packets.cc
index 7b2545e..74ffed3 100644
--- a/src/connectivity/bluetooth/core/bt-host/l2cap/test_packets.cc
+++ b/src/connectivity/bluetooth/core/bt-host/l2cap/test_packets.cc
@@ -5,7 +5,7 @@
 #include "test_packets.h"
 
 #include "src/connectivity/bluetooth/core/bt-host/common/test_helpers.h"
-#include "src/connectivity/bluetooth/core/bt-host/hci/hci.h"
+#include "src/connectivity/bluetooth/core/bt-host/hci-spec/protocol.h"
 #include "src/connectivity/bluetooth/core/bt-host/l2cap/fcs.h"
 #include "src/connectivity/bluetooth/core/bt-host/l2cap/frame_headers.h"
 #include "src/connectivity/bluetooth/core/bt-host/l2cap/l2cap_defs.h"
diff --git a/src/connectivity/bluetooth/core/bt-host/l2cap/test_packets.h b/src/connectivity/bluetooth/core/bt-host/l2cap/test_packets.h
index 72d5df4..53ac78b 100644
--- a/src/connectivity/bluetooth/core/bt-host/l2cap/test_packets.h
+++ b/src/connectivity/bluetooth/core/bt-host/l2cap/test_packets.h
@@ -6,7 +6,7 @@
 #define SRC_CONNECTIVITY_BLUETOOTH_CORE_BT_HOST_L2CAP_TEST_PACKETS_H_
 
 #include "src/connectivity/bluetooth/core/bt-host/common/byte_buffer.h"
-#include "src/connectivity/bluetooth/core/bt-host/hci/hci.h"
+#include "src/connectivity/bluetooth/core/bt-host/hci-spec/protocol.h"
 #include "src/connectivity/bluetooth/core/bt-host/l2cap/frame_headers.h"
 #include "src/connectivity/bluetooth/core/bt-host/l2cap/l2cap_defs.h"
 #include "src/connectivity/bluetooth/core/bt-host/l2cap/types.h"
diff --git a/src/connectivity/bluetooth/core/bt-host/l2cap/types.h b/src/connectivity/bluetooth/core/bt-host/l2cap/types.h
index 06c54df..39e8476 100644
--- a/src/connectivity/bluetooth/core/bt-host/l2cap/types.h
+++ b/src/connectivity/bluetooth/core/bt-host/l2cap/types.h
@@ -12,8 +12,8 @@
 #include <fbl/macros.h>
 #include <fbl/ref_ptr.h>
 
-#include "src/connectivity/bluetooth/core/bt-host/hci/connection_parameters.h"
-#include "src/connectivity/bluetooth/core/bt-host/hci/hci.h"
+#include "src/connectivity/bluetooth/core/bt-host/hci-spec/le_connection_parameters.h"
+#include "src/connectivity/bluetooth/core/bt-host/hci-spec/protocol.h"
 #include "src/connectivity/bluetooth/core/bt-host/l2cap/l2cap_defs.h"
 #include "src/connectivity/bluetooth/core/bt-host/sm/status.h"
 #include "src/connectivity/bluetooth/core/bt-host/sm/types.h"
diff --git a/src/connectivity/bluetooth/core/bt-host/sco/sco.h b/src/connectivity/bluetooth/core/bt-host/sco/sco.h
index 8eb67ec..c2f4a17 100644
--- a/src/connectivity/bluetooth/core/bt-host/sco/sco.h
+++ b/src/connectivity/bluetooth/core/bt-host/sco/sco.h
@@ -7,7 +7,7 @@
 #ifndef SRC_CONNECTIVITY_BLUETOOTH_CORE_BT_HOST_SCO_SCO_H_
 #define SRC_CONNECTIVITY_BLUETOOTH_CORE_BT_HOST_SCO_SCO_H_
 
-#include "src/connectivity/bluetooth/core/bt-host/hci/hci_constants.h"
+#include "src/connectivity/bluetooth/core/bt-host/hci-spec/constants.h"
 
 namespace bt::sco {
 
diff --git a/src/connectivity/bluetooth/core/bt-host/sco/sco_connection_manager.h b/src/connectivity/bluetooth/core/bt-host/sco/sco_connection_manager.h
index fe36087..fbdd6ee6 100644
--- a/src/connectivity/bluetooth/core/bt-host/sco/sco_connection_manager.h
+++ b/src/connectivity/bluetooth/core/bt-host/sco/sco_connection_manager.h
@@ -6,7 +6,7 @@
 #define SRC_CONNECTIVITY_BLUETOOTH_CORE_BT_HOST_SCO_SCO_CONNECTION_MANAGER_H_
 
 #include "src/connectivity/bluetooth/core/bt-host/common/identifier.h"
-#include "src/connectivity/bluetooth/core/bt-host/hci/hci.h"
+#include "src/connectivity/bluetooth/core/bt-host/hci-spec/protocol.h"
 #include "src/connectivity/bluetooth/core/bt-host/hci/transport.h"
 #include "src/connectivity/bluetooth/core/bt-host/sco/sco_connection.h"
 #include "src/lib/fxl/memory/weak_ptr.h"
diff --git a/src/connectivity/bluetooth/core/bt-host/sm/pairing_channel_unittest.cc b/src/connectivity/bluetooth/core/bt-host/sm/pairing_channel_unittest.cc
index b644b17..dfc56a7 100644
--- a/src/connectivity/bluetooth/core/bt-host/sm/pairing_channel_unittest.cc
+++ b/src/connectivity/bluetooth/core/bt-host/sm/pairing_channel_unittest.cc
@@ -10,8 +10,8 @@
 #include "lib/fit/function.h"
 #include "src/connectivity/bluetooth/core/bt-host/common/byte_buffer.h"
 #include "src/connectivity/bluetooth/core/bt-host/common/test_helpers.h"
+#include "src/connectivity/bluetooth/core/bt-host/hci-spec/protocol.h"
 #include "src/connectivity/bluetooth/core/bt-host/hci/connection.h"
-#include "src/connectivity/bluetooth/core/bt-host/hci/hci.h"
 #include "src/connectivity/bluetooth/core/bt-host/l2cap/fake_channel_test.h"
 #include "src/connectivity/bluetooth/core/bt-host/sm/smp.h"
 #include "src/connectivity/bluetooth/core/bt-host/sm/util.h"
diff --git a/src/connectivity/bluetooth/core/bt-host/sm/phase_1.cc b/src/connectivity/bluetooth/core/bt-host/sm/phase_1.cc
index 1a24e2b..1794145 100644
--- a/src/connectivity/bluetooth/core/bt-host/sm/phase_1.cc
+++ b/src/connectivity/bluetooth/core/bt-host/sm/phase_1.cc
@@ -9,9 +9,9 @@
 #include "src/connectivity/bluetooth/core/bt-host/common/byte_buffer.h"
 #include "src/connectivity/bluetooth/core/bt-host/common/log.h"
 #include "src/connectivity/bluetooth/core/bt-host/common/status.h"
+#include "src/connectivity/bluetooth/core/bt-host/hci-spec/constants.h"
+#include "src/connectivity/bluetooth/core/bt-host/hci-spec/protocol.h"
 #include "src/connectivity/bluetooth/core/bt-host/hci/connection.h"
-#include "src/connectivity/bluetooth/core/bt-host/hci/hci.h"
-#include "src/connectivity/bluetooth/core/bt-host/hci/hci_constants.h"
 #include "src/connectivity/bluetooth/core/bt-host/l2cap/scoped_channel.h"
 #include "src/connectivity/bluetooth/core/bt-host/sm/packet.h"
 #include "src/connectivity/bluetooth/core/bt-host/sm/smp.h"
diff --git a/src/connectivity/bluetooth/core/bt-host/sm/phase_2_secure_connections_unittest.cc b/src/connectivity/bluetooth/core/bt-host/sm/phase_2_secure_connections_unittest.cc
index ed5c682..744f9e5 100644
--- a/src/connectivity/bluetooth/core/bt-host/sm/phase_2_secure_connections_unittest.cc
+++ b/src/connectivity/bluetooth/core/bt-host/sm/phase_2_secure_connections_unittest.cc
@@ -14,8 +14,8 @@
 #include "src/connectivity/bluetooth/core/bt-host/common/random.h"
 #include "src/connectivity/bluetooth/core/bt-host/common/test_helpers.h"
 #include "src/connectivity/bluetooth/core/bt-host/common/uint128.h"
+#include "src/connectivity/bluetooth/core/bt-host/hci-spec/constants.h"
 #include "src/connectivity/bluetooth/core/bt-host/hci/connection.h"
-#include "src/connectivity/bluetooth/core/bt-host/hci/hci_constants.h"
 #include "src/connectivity/bluetooth/core/bt-host/l2cap/fake_channel_test.h"
 #include "src/connectivity/bluetooth/core/bt-host/l2cap/l2cap_defs.h"
 #include "src/connectivity/bluetooth/core/bt-host/sm/ecdh_key.h"
diff --git a/src/connectivity/bluetooth/core/bt-host/sm/phase_3_unittest.cc b/src/connectivity/bluetooth/core/bt-host/sm/phase_3_unittest.cc
index f8a0f38..9de88ef 100644
--- a/src/connectivity/bluetooth/core/bt-host/sm/phase_3_unittest.cc
+++ b/src/connectivity/bluetooth/core/bt-host/sm/phase_3_unittest.cc
@@ -14,8 +14,8 @@
 #include "src/connectivity/bluetooth/core/bt-host/common/random.h"
 #include "src/connectivity/bluetooth/core/bt-host/common/test_helpers.h"
 #include "src/connectivity/bluetooth/core/bt-host/common/uint128.h"
+#include "src/connectivity/bluetooth/core/bt-host/hci-spec/link_key.h"
 #include "src/connectivity/bluetooth/core/bt-host/hci/connection.h"
-#include "src/connectivity/bluetooth/core/bt-host/hci/link_key.h"
 #include "src/connectivity/bluetooth/core/bt-host/l2cap/fake_channel_test.h"
 #include "src/connectivity/bluetooth/core/bt-host/sm/fake_phase_listener.h"
 #include "src/connectivity/bluetooth/core/bt-host/sm/packet.h"
diff --git a/src/connectivity/bluetooth/core/bt-host/sm/security_manager.cc b/src/connectivity/bluetooth/core/bt-host/sm/security_manager.cc
index 3db5f09..c5f9c33 100644
--- a/src/connectivity/bluetooth/core/bt-host/sm/security_manager.cc
+++ b/src/connectivity/bluetooth/core/bt-host/sm/security_manager.cc
@@ -21,8 +21,8 @@
 #include "src/connectivity/bluetooth/core/bt-host/common/random.h"
 #include "src/connectivity/bluetooth/core/bt-host/common/uint128.h"
 #include "src/connectivity/bluetooth/core/bt-host/gap/gap.h"
+#include "src/connectivity/bluetooth/core/bt-host/hci-spec/link_key.h"
 #include "src/connectivity/bluetooth/core/bt-host/hci/connection.h"
-#include "src/connectivity/bluetooth/core/bt-host/hci/link_key.h"
 #include "src/connectivity/bluetooth/core/bt-host/hci/status.h"
 #include "src/connectivity/bluetooth/core/bt-host/sm/packet.h"
 #include "src/connectivity/bluetooth/core/bt-host/sm/phase_2_secure_connections.h"
diff --git a/src/connectivity/bluetooth/core/bt-host/sm/security_manager.h b/src/connectivity/bluetooth/core/bt-host/sm/security_manager.h
index 2c0a97d6a1..78af05e 100644
--- a/src/connectivity/bluetooth/core/bt-host/sm/security_manager.h
+++ b/src/connectivity/bluetooth/core/bt-host/sm/security_manager.h
@@ -14,8 +14,8 @@
 #include "src/connectivity/bluetooth/core/bt-host/common/device_address.h"
 #include "src/connectivity/bluetooth/core/bt-host/common/uint128.h"
 #include "src/connectivity/bluetooth/core/bt-host/gap/gap.h"
+#include "src/connectivity/bluetooth/core/bt-host/hci-spec/link_key.h"
 #include "src/connectivity/bluetooth/core/bt-host/hci/connection.h"
-#include "src/connectivity/bluetooth/core/bt-host/hci/link_key.h"
 #include "src/connectivity/bluetooth/core/bt-host/l2cap/channel.h"
 #include "src/connectivity/bluetooth/core/bt-host/sm/delegate.h"
 #include "src/connectivity/bluetooth/core/bt-host/sm/pairing_phase.h"
diff --git a/src/connectivity/bluetooth/core/bt-host/sm/security_manager_unittest.cc b/src/connectivity/bluetooth/core/bt-host/sm/security_manager_unittest.cc
index a41c6a91..ba1c453 100644
--- a/src/connectivity/bluetooth/core/bt-host/sm/security_manager_unittest.cc
+++ b/src/connectivity/bluetooth/core/bt-host/sm/security_manager_unittest.cc
@@ -12,9 +12,9 @@
 #include "src/connectivity/bluetooth/core/bt-host/common/status.h"
 #include "src/connectivity/bluetooth/core/bt-host/common/test_helpers.h"
 #include "src/connectivity/bluetooth/core/bt-host/gap/gap.h"
+#include "src/connectivity/bluetooth/core/bt-host/hci-spec/link_key.h"
 #include "src/connectivity/bluetooth/core/bt-host/hci/connection.h"
 #include "src/connectivity/bluetooth/core/bt-host/hci/fake_connection.h"
-#include "src/connectivity/bluetooth/core/bt-host/hci/link_key.h"
 #include "src/connectivity/bluetooth/core/bt-host/hci/status.h"
 #include "src/connectivity/bluetooth/core/bt-host/l2cap/fake_channel_test.h"
 #include "src/connectivity/bluetooth/core/bt-host/sm/ecdh_key.h"
diff --git a/src/connectivity/bluetooth/core/bt-host/sm/test_security_manager.cc b/src/connectivity/bluetooth/core/bt-host/sm/test_security_manager.cc
index 598ebaa..4e69ad6 100644
--- a/src/connectivity/bluetooth/core/bt-host/sm/test_security_manager.cc
+++ b/src/connectivity/bluetooth/core/bt-host/sm/test_security_manager.cc
@@ -7,8 +7,8 @@
 
 #include <memory>
 
+#include "src/connectivity/bluetooth/core/bt-host/hci-spec/protocol.h"
 #include "src/connectivity/bluetooth/core/bt-host/hci/connection.h"
-#include "src/connectivity/bluetooth/core/bt-host/hci/hci.h"
 #include "src/connectivity/bluetooth/core/bt-host/sm/smp.h"
 #include "src/lib/fxl/memory/weak_ptr.h"
 
diff --git a/src/connectivity/bluetooth/core/bt-host/sm/test_security_manager.h b/src/connectivity/bluetooth/core/bt-host/sm/test_security_manager.h
index 8cc017ba..6fc45b2 100644
--- a/src/connectivity/bluetooth/core/bt-host/sm/test_security_manager.h
+++ b/src/connectivity/bluetooth/core/bt-host/sm/test_security_manager.h
@@ -12,8 +12,8 @@
 
 #include "src/connectivity/bluetooth/core/bt-host/common/uint128.h"
 #include "src/connectivity/bluetooth/core/bt-host/gap/gap.h"
+#include "src/connectivity/bluetooth/core/bt-host/hci-spec/link_key.h"
 #include "src/connectivity/bluetooth/core/bt-host/hci/connection.h"
-#include "src/connectivity/bluetooth/core/bt-host/hci/link_key.h"
 #include "src/connectivity/bluetooth/core/bt-host/l2cap/channel.h"
 #include "src/connectivity/bluetooth/core/bt-host/sm/delegate.h"
 #include "src/connectivity/bluetooth/core/bt-host/sm/security_manager.h"
diff --git a/src/connectivity/bluetooth/core/bt-host/sm/types.cc b/src/connectivity/bluetooth/core/bt-host/sm/types.cc
index f61b1b3..8533409 100644
--- a/src/connectivity/bluetooth/core/bt-host/sm/types.cc
+++ b/src/connectivity/bluetooth/core/bt-host/sm/types.cc
@@ -4,7 +4,7 @@
 
 #include "types.h"
 
-#include "src/connectivity/bluetooth/core/bt-host/hci/hci_constants.h"
+#include "src/connectivity/bluetooth/core/bt-host/hci-spec/constants.h"
 #include "src/connectivity/bluetooth/core/bt-host/sm/smp.h"
 #include "src/lib/fxl/strings/string_printf.h"
 
diff --git a/src/connectivity/bluetooth/core/bt-host/sm/types.h b/src/connectivity/bluetooth/core/bt-host/sm/types.h
index ae38a28..d258522 100644
--- a/src/connectivity/bluetooth/core/bt-host/sm/types.h
+++ b/src/connectivity/bluetooth/core/bt-host/sm/types.h
@@ -12,8 +12,8 @@
 #include <unordered_map>
 
 #include "src/connectivity/bluetooth/core/bt-host/common/uint128.h"
-#include "src/connectivity/bluetooth/core/bt-host/hci/hci_constants.h"
-#include "src/connectivity/bluetooth/core/bt-host/hci/link_key.h"
+#include "src/connectivity/bluetooth/core/bt-host/hci-spec/constants.h"
+#include "src/connectivity/bluetooth/core/bt-host/hci-spec/link_key.h"
 #include "src/connectivity/bluetooth/core/bt-host/sm/smp.h"
 
 namespace bt::sm {
diff --git a/src/connectivity/bluetooth/core/bt-host/sm/util.cc b/src/connectivity/bluetooth/core/bt-host/sm/util.cc
index 13afc7d..f853a6ef 100644
--- a/src/connectivity/bluetooth/core/bt-host/sm/util.cc
+++ b/src/connectivity/bluetooth/core/bt-host/sm/util.cc
@@ -18,7 +18,7 @@
 #include "src/connectivity/bluetooth/core/bt-host/common/status.h"
 #include "src/connectivity/bluetooth/core/bt-host/common/uint128.h"
 #include "src/connectivity/bluetooth/core/bt-host/common/uint256.h"
-#include "src/connectivity/bluetooth/core/bt-host/hci/util.h"
+#include "src/connectivity/bluetooth/core/bt-host/hci-spec/util.h"
 #include "src/connectivity/bluetooth/core/bt-host/sm/smp.h"
 #include "src/connectivity/bluetooth/core/bt-host/sm/status.h"
 #include "src/connectivity/bluetooth/core/bt-host/sm/types.h"
diff --git a/src/connectivity/bluetooth/core/bt-host/sm/util.h b/src/connectivity/bluetooth/core/bt-host/sm/util.h
index 0a9a7a6..ea1db07 100644
--- a/src/connectivity/bluetooth/core/bt-host/sm/util.h
+++ b/src/connectivity/bluetooth/core/bt-host/sm/util.h
@@ -9,7 +9,7 @@
 #include "src/connectivity/bluetooth/core/bt-host/common/device_address.h"
 #include "src/connectivity/bluetooth/core/bt-host/common/uint128.h"
 #include "src/connectivity/bluetooth/core/bt-host/common/uint256.h"
-#include "src/connectivity/bluetooth/core/bt-host/hci/hci_constants.h"
+#include "src/connectivity/bluetooth/core/bt-host/hci-spec/constants.h"
 #include "src/connectivity/bluetooth/core/bt-host/sm/delegate.h"
 #include "src/connectivity/bluetooth/core/bt-host/sm/smp.h"
 #include "src/connectivity/bluetooth/core/bt-host/sm/status.h"
diff --git a/src/connectivity/bluetooth/core/bt-host/sm/util_unittest.cc b/src/connectivity/bluetooth/core/bt-host/sm/util_unittest.cc
index ed0205d..278eb64 100644
--- a/src/connectivity/bluetooth/core/bt-host/sm/util_unittest.cc
+++ b/src/connectivity/bluetooth/core/bt-host/sm/util_unittest.cc
@@ -14,7 +14,7 @@
 #include "src/connectivity/bluetooth/core/bt-host/common/test_helpers.h"
 #include "src/connectivity/bluetooth/core/bt-host/common/uint128.h"
 #include "src/connectivity/bluetooth/core/bt-host/common/uint256.h"
-#include "src/connectivity/bluetooth/core/bt-host/hci/hci_constants.h"
+#include "src/connectivity/bluetooth/core/bt-host/hci-spec/constants.h"
 #include "src/connectivity/bluetooth/core/bt-host/sm/smp.h"
 #include "src/connectivity/bluetooth/core/bt-host/sm/status.h"
 
diff --git a/src/connectivity/bluetooth/core/bt-host/testing/controller_test_double_base.cc b/src/connectivity/bluetooth/core/bt-host/testing/controller_test_double_base.cc
index 3eb1a3e..d162cd33 100644
--- a/src/connectivity/bluetooth/core/bt-host/testing/controller_test_double_base.cc
+++ b/src/connectivity/bluetooth/core/bt-host/testing/controller_test_double_base.cc
@@ -9,8 +9,8 @@
 #include <zircon/status.h>
 
 #include "src/connectivity/bluetooth/core/bt-host/common/log.h"
+#include "src/connectivity/bluetooth/core/bt-host/hci-spec/constants.h"
 #include "src/connectivity/bluetooth/core/bt-host/hci/acl_data_packet.h"
-#include "src/connectivity/bluetooth/core/bt-host/hci/hci_constants.h"
 
 namespace bt::testing {
 
diff --git a/src/connectivity/bluetooth/core/bt-host/testing/controller_test_double_base.h b/src/connectivity/bluetooth/core/bt-host/testing/controller_test_double_base.h
index fd096f0..b1b2598 100644
--- a/src/connectivity/bluetooth/core/bt-host/testing/controller_test_double_base.h
+++ b/src/connectivity/bluetooth/core/bt-host/testing/controller_test_double_base.h
@@ -13,7 +13,7 @@
 
 #include "src/connectivity/bluetooth/core/bt-host/common/byte_buffer.h"
 #include "src/connectivity/bluetooth/core/bt-host/common/packet_view.h"
-#include "src/connectivity/bluetooth/core/bt-host/hci/hci.h"
+#include "src/connectivity/bluetooth/core/bt-host/hci-spec/protocol.h"
 
 namespace bt::testing {
 
diff --git a/src/connectivity/bluetooth/core/bt-host/testing/fake_controller.cc b/src/connectivity/bluetooth/core/bt-host/testing/fake_controller.cc
index c6e4eee..541d673 100644
--- a/src/connectivity/bluetooth/core/bt-host/testing/fake_controller.cc
+++ b/src/connectivity/bluetooth/core/bt-host/testing/fake_controller.cc
@@ -9,9 +9,9 @@
 
 #include "src/connectivity/bluetooth/core/bt-host/common/log.h"
 #include "src/connectivity/bluetooth/core/bt-host/common/packet_view.h"
-#include "src/connectivity/bluetooth/core/bt-host/hci/defaults.h"
-#include "src/connectivity/bluetooth/core/bt-host/hci/hci.h"
-#include "src/connectivity/bluetooth/core/bt-host/hci/util.h"
+#include "src/connectivity/bluetooth/core/bt-host/hci-spec/defaults.h"
+#include "src/connectivity/bluetooth/core/bt-host/hci-spec/protocol.h"
+#include "src/connectivity/bluetooth/core/bt-host/hci-spec/util.h"
 #include "src/connectivity/bluetooth/core/bt-host/testing/fake_peer.h"
 #include "src/lib/fxl/strings/string_printf.h"
 
diff --git a/src/connectivity/bluetooth/core/bt-host/testing/fake_controller.h b/src/connectivity/bluetooth/core/bt-host/testing/fake_controller.h
index c46f632..ca8d399 100644
--- a/src/connectivity/bluetooth/core/bt-host/testing/fake_controller.h
+++ b/src/connectivity/bluetooth/core/bt-host/testing/fake_controller.h
@@ -19,9 +19,9 @@
 
 #include "src/connectivity/bluetooth/core/bt-host/common/device_address.h"
 #include "src/connectivity/bluetooth/core/bt-host/common/device_class.h"
-#include "src/connectivity/bluetooth/core/bt-host/hci/connection_parameters.h"
-#include "src/connectivity/bluetooth/core/bt-host/hci/hci.h"
-#include "src/connectivity/bluetooth/core/bt-host/hci/hci_constants.h"
+#include "src/connectivity/bluetooth/core/bt-host/hci-spec/constants.h"
+#include "src/connectivity/bluetooth/core/bt-host/hci-spec/le_connection_parameters.h"
+#include "src/connectivity/bluetooth/core/bt-host/hci-spec/protocol.h"
 #include "src/connectivity/bluetooth/core/bt-host/l2cap/l2cap_defs.h"
 #include "src/connectivity/bluetooth/core/bt-host/testing/controller_test_double_base.h"
 #include "src/lib/fxl/functional/cancelable_callback.h"
diff --git a/src/connectivity/bluetooth/core/bt-host/testing/fake_dynamic_channel.h b/src/connectivity/bluetooth/core/bt-host/testing/fake_dynamic_channel.h
index 8dfb262..4704e94 100644
--- a/src/connectivity/bluetooth/core/bt-host/testing/fake_dynamic_channel.h
+++ b/src/connectivity/bluetooth/core/bt-host/testing/fake_dynamic_channel.h
@@ -10,7 +10,7 @@
 #include <memory>
 
 #include "src/connectivity/bluetooth/core/bt-host/common/byte_buffer.h"
-#include "src/connectivity/bluetooth/core/bt-host/hci/hci.h"
+#include "src/connectivity/bluetooth/core/bt-host/hci-spec/protocol.h"
 #include "src/connectivity/bluetooth/core/bt-host/l2cap/l2cap_defs.h"
 #include "src/lib/fxl/memory/ref_ptr.h"
 #include "src/lib/fxl/memory/weak_ptr.h"
diff --git a/src/connectivity/bluetooth/core/bt-host/testing/fake_dynamic_channel_unittest.cc b/src/connectivity/bluetooth/core/bt-host/testing/fake_dynamic_channel_unittest.cc
index d3db45a..0224281 100644
--- a/src/connectivity/bluetooth/core/bt-host/testing/fake_dynamic_channel_unittest.cc
+++ b/src/connectivity/bluetooth/core/bt-host/testing/fake_dynamic_channel_unittest.cc
@@ -8,7 +8,7 @@
 
 #include "src/connectivity/bluetooth/core/bt-host/common/byte_buffer.h"
 #include "src/connectivity/bluetooth/core/bt-host/common/test_helpers.h"
-#include "src/connectivity/bluetooth/core/bt-host/hci/hci.h"
+#include "src/connectivity/bluetooth/core/bt-host/hci-spec/protocol.h"
 #include "src/connectivity/bluetooth/core/bt-host/l2cap/l2cap_defs.h"
 #include "src/connectivity/bluetooth/core/bt-host/l2cap/test_packets.h"
 #include "src/connectivity/bluetooth/core/bt-host/testing/fake_l2cap.h"
diff --git a/src/connectivity/bluetooth/core/bt-host/testing/fake_gatt_server.h b/src/connectivity/bluetooth/core/bt-host/testing/fake_gatt_server.h
index 3fab29e..b1ac4c7 100644
--- a/src/connectivity/bluetooth/core/bt-host/testing/fake_gatt_server.h
+++ b/src/connectivity/bluetooth/core/bt-host/testing/fake_gatt_server.h
@@ -8,7 +8,7 @@
 #include "fake_l2cap.h"
 #include "src/connectivity/bluetooth/core/bt-host/att/att.h"
 #include "src/connectivity/bluetooth/core/bt-host/common/byte_buffer.h"
-#include "src/connectivity/bluetooth/core/bt-host/hci/hci.h"
+#include "src/connectivity/bluetooth/core/bt-host/hci-spec/protocol.h"
 
 namespace bt::testing {
 
diff --git a/src/connectivity/bluetooth/core/bt-host/testing/fake_l2cap.cc b/src/connectivity/bluetooth/core/bt-host/testing/fake_l2cap.cc
index 9485316..ac5b1bf 100644
--- a/src/connectivity/bluetooth/core/bt-host/testing/fake_l2cap.cc
+++ b/src/connectivity/bluetooth/core/bt-host/testing/fake_l2cap.cc
@@ -7,6 +7,8 @@
 #include <endian.h>
 #include <zircon/assert.h>
 
+#include "src/connectivity/bluetooth/core/bt-host/common/log.h"
+
 namespace bt::testing {
 
 FakeL2cap::FakeL2cap(SendFrameCallback send_frame_callback,
diff --git a/src/connectivity/bluetooth/core/bt-host/testing/fake_l2cap.h b/src/connectivity/bluetooth/core/bt-host/testing/fake_l2cap.h
index a31f476..4d2a73a 100644
--- a/src/connectivity/bluetooth/core/bt-host/testing/fake_l2cap.h
+++ b/src/connectivity/bluetooth/core/bt-host/testing/fake_l2cap.h
@@ -11,7 +11,7 @@
 
 #include "fake_dynamic_channel.h"
 #include "src/connectivity/bluetooth/core/bt-host/common/byte_buffer.h"
-#include "src/connectivity/bluetooth/core/bt-host/hci/hci.h"
+#include "src/connectivity/bluetooth/core/bt-host/hci-spec/protocol.h"
 #include "src/connectivity/bluetooth/core/bt-host/l2cap/l2cap_defs.h"
 
 namespace bt::testing {
diff --git a/src/connectivity/bluetooth/core/bt-host/testing/fake_peer.h b/src/connectivity/bluetooth/core/bt-host/testing/fake_peer.h
index 78bb919..9b13946 100644
--- a/src/connectivity/bluetooth/core/bt-host/testing/fake_peer.h
+++ b/src/connectivity/bluetooth/core/bt-host/testing/fake_peer.h
@@ -11,9 +11,9 @@
 
 #include "src/connectivity/bluetooth/core/bt-host/common/byte_buffer.h"
 #include "src/connectivity/bluetooth/core/bt-host/common/device_address.h"
+#include "src/connectivity/bluetooth/core/bt-host/hci-spec/le_connection_parameters.h"
+#include "src/connectivity/bluetooth/core/bt-host/hci-spec/protocol.h"
 #include "src/connectivity/bluetooth/core/bt-host/hci/connection.h"
-#include "src/connectivity/bluetooth/core/bt-host/hci/connection_parameters.h"
-#include "src/connectivity/bluetooth/core/bt-host/hci/hci.h"
 #include "src/connectivity/bluetooth/core/bt-host/testing/fake_gatt_server.h"
 #include "src/connectivity/bluetooth/core/bt-host/testing/fake_l2cap.h"
 #include "src/connectivity/bluetooth/core/bt-host/testing/fake_sdp_server.h"
diff --git a/src/connectivity/bluetooth/core/bt-host/testing/fake_sdp_server.h b/src/connectivity/bluetooth/core/bt-host/testing/fake_sdp_server.h
index d10353b..4aba9fe 100644
--- a/src/connectivity/bluetooth/core/bt-host/testing/fake_sdp_server.h
+++ b/src/connectivity/bluetooth/core/bt-host/testing/fake_sdp_server.h
@@ -9,7 +9,7 @@
 #include "fake_l2cap.h"
 #include "src/connectivity/bluetooth/core/bt-host/common/byte_buffer.h"
 #include "src/connectivity/bluetooth/core/bt-host/common/packet_view.h"
-#include "src/connectivity/bluetooth/core/bt-host/hci/hci.h"
+#include "src/connectivity/bluetooth/core/bt-host/hci-spec/protocol.h"
 #include "src/connectivity/bluetooth/core/bt-host/l2cap/fake_l2cap.h"
 #include "src/connectivity/bluetooth/core/bt-host/l2cap/l2cap_defs.h"
 #include "src/connectivity/bluetooth/core/bt-host/sdp/server.h"
diff --git a/src/connectivity/bluetooth/core/bt-host/testing/fake_sdp_server_unittest.cc b/src/connectivity/bluetooth/core/bt-host/testing/fake_sdp_server_unittest.cc
index a594eec..1acc013 100644
--- a/src/connectivity/bluetooth/core/bt-host/testing/fake_sdp_server_unittest.cc
+++ b/src/connectivity/bluetooth/core/bt-host/testing/fake_sdp_server_unittest.cc
@@ -8,7 +8,7 @@
 
 #include "src/connectivity/bluetooth/core/bt-host/common/byte_buffer.h"
 #include "src/connectivity/bluetooth/core/bt-host/common/test_helpers.h"
-#include "src/connectivity/bluetooth/core/bt-host/hci/hci.h"
+#include "src/connectivity/bluetooth/core/bt-host/hci-spec/protocol.h"
 #include "src/connectivity/bluetooth/core/bt-host/l2cap/l2cap_defs.h"
 #include "src/connectivity/bluetooth/core/bt-host/l2cap/test_packets.h"
 #include "src/connectivity/bluetooth/core/bt-host/testing/fake_dynamic_channel.h"
diff --git a/src/connectivity/bluetooth/core/bt-host/testing/fake_signaling_server.cc b/src/connectivity/bluetooth/core/bt-host/testing/fake_signaling_server.cc
index 66dd075..49612bf 100644
--- a/src/connectivity/bluetooth/core/bt-host/testing/fake_signaling_server.cc
+++ b/src/connectivity/bluetooth/core/bt-host/testing/fake_signaling_server.cc
@@ -7,6 +7,7 @@
 #include <endian.h>
 
 #include "fake_l2cap.h"
+#include "src/connectivity/bluetooth/core/bt-host/common/log.h"
 
 namespace bt::testing {
 
diff --git a/src/connectivity/bluetooth/core/bt-host/testing/fake_signaling_server.h b/src/connectivity/bluetooth/core/bt-host/testing/fake_signaling_server.h
index a6d6603..ac2ba42 100644
--- a/src/connectivity/bluetooth/core/bt-host/testing/fake_signaling_server.h
+++ b/src/connectivity/bluetooth/core/bt-host/testing/fake_signaling_server.h
@@ -9,7 +9,7 @@
 #include "fake_l2cap.h"
 #include "src/connectivity/bluetooth/core/bt-host/common/byte_buffer.h"
 #include "src/connectivity/bluetooth/core/bt-host/common/packet_view.h"
-#include "src/connectivity/bluetooth/core/bt-host/hci/hci.h"
+#include "src/connectivity/bluetooth/core/bt-host/hci-spec/protocol.h"
 #include "src/connectivity/bluetooth/core/bt-host/l2cap/l2cap_defs.h"
 
 namespace bt::testing {
diff --git a/src/connectivity/bluetooth/core/bt-host/testing/mock_controller.h b/src/connectivity/bluetooth/core/bt-host/testing/mock_controller.h
index 3b4151b..68cc34c 100644
--- a/src/connectivity/bluetooth/core/bt-host/testing/mock_controller.h
+++ b/src/connectivity/bluetooth/core/bt-host/testing/mock_controller.h
@@ -14,7 +14,7 @@
 #include <fbl/macros.h>
 
 #include "src/connectivity/bluetooth/core/bt-host/common/byte_buffer.h"
-#include "src/connectivity/bluetooth/core/bt-host/hci/hci.h"
+#include "src/connectivity/bluetooth/core/bt-host/hci-spec/protocol.h"
 #include "src/connectivity/bluetooth/core/bt-host/testing/controller_test_double_base.h"
 
 namespace bt::testing {
diff --git a/src/connectivity/bluetooth/core/bt-host/testing/test_packets.cc b/src/connectivity/bluetooth/core/bt-host/testing/test_packets.cc
index f6b85df..87705fc 100644
--- a/src/connectivity/bluetooth/core/bt-host/testing/test_packets.cc
+++ b/src/connectivity/bluetooth/core/bt-host/testing/test_packets.cc
@@ -6,9 +6,9 @@
 
 #include "src/connectivity/bluetooth/core/bt-host/common/byte_buffer.h"
 #include "src/connectivity/bluetooth/core/bt-host/common/test_helpers.h"
+#include "src/connectivity/bluetooth/core/bt-host/hci-spec/constants.h"
+#include "src/connectivity/bluetooth/core/bt-host/hci-spec/protocol.h"
 #include "src/connectivity/bluetooth/core/bt-host/hci/bredr_connection_request.h"
-#include "src/connectivity/bluetooth/core/bt-host/hci/hci.h"
-#include "src/connectivity/bluetooth/core/bt-host/hci/hci_constants.h"
 
 namespace bt::testing {
 
diff --git a/src/connectivity/bluetooth/core/bt-host/testing/test_packets.h b/src/connectivity/bluetooth/core/bt-host/testing/test_packets.h
index b775ef7..32df76d 100644
--- a/src/connectivity/bluetooth/core/bt-host/testing/test_packets.h
+++ b/src/connectivity/bluetooth/core/bt-host/testing/test_packets.h
@@ -7,7 +7,7 @@
 
 #include "src/connectivity/bluetooth/core/bt-host/common/byte_buffer.h"
 #include "src/connectivity/bluetooth/core/bt-host/common/device_address.h"
-#include "src/connectivity/bluetooth/core/bt-host/hci/hci.h"
+#include "src/connectivity/bluetooth/core/bt-host/hci-spec/protocol.h"
 #include "src/connectivity/bluetooth/core/bt-host/l2cap/l2cap_defs.h"
 #include "src/connectivity/bluetooth/core/bt-host/l2cap/types.h"
 
diff --git a/src/connectivity/bluetooth/hci/vendor/atheros/BUILD.gn b/src/connectivity/bluetooth/hci/vendor/atheros/BUILD.gn
index e1d9f54..7837ffa 100644
--- a/src/connectivity/bluetooth/hci/vendor/atheros/BUILD.gn
+++ b/src/connectivity/bluetooth/hci/vendor/atheros/BUILD.gn
@@ -33,8 +33,8 @@
     "//sdk/banjo/fuchsia.hardware.usb",
     "//sdk/fidl/fuchsia.hardware.bluetooth:fuchsia.hardware.bluetooth_c",
     "//sdk/lib/syslog/cpp:backend_legacy",
-    "//src/connectivity/bluetooth/core/bt-host/gap",
     "//src/connectivity/bluetooth/core/bt-host/hci",
+    "//src/connectivity/bluetooth/core/bt-host/hci-spec",
     "//src/devices/lib/driver",
     "//src/devices/usb/lib/usb",
     "//src/devices/usb/lib/usb",
diff --git a/src/connectivity/bluetooth/hci/vendor/atheros/device.h b/src/connectivity/bluetooth/hci/vendor/atheros/device.h
index ef9a46a..0aa7b83 100644
--- a/src/connectivity/bluetooth/hci/vendor/atheros/device.h
+++ b/src/connectivity/bluetooth/hci/vendor/atheros/device.h
@@ -16,8 +16,8 @@
 #include <fbl/mutex.h>
 
 #include "src/connectivity/bluetooth/core/bt-host/common/byte_buffer.h"
+#include "src/connectivity/bluetooth/core/bt-host/hci-spec/protocol.h"
 #include "src/connectivity/bluetooth/core/bt-host/hci/control_packets.h"
-#include "src/connectivity/bluetooth/core/bt-host/hci/hci.h"
 
 struct qca_version {
   uint32_t rom_version;
diff --git a/src/connectivity/bluetooth/hci/vendor/intel/BUILD.gn b/src/connectivity/bluetooth/hci/vendor/intel/BUILD.gn
index c7f3cc9..5565afd 100644
--- a/src/connectivity/bluetooth/hci/vendor/intel/BUILD.gn
+++ b/src/connectivity/bluetooth/hci/vendor/intel/BUILD.gn
@@ -42,8 +42,8 @@
     "//sdk/banjo/fuchsia.hardware.usb",
     "//sdk/fidl/fuchsia.hardware.bluetooth:fuchsia.hardware.bluetooth_c",
     "//sdk/lib/syslog/cpp:backend_legacy",
-    "//src/connectivity/bluetooth/core/bt-host/gap",
     "//src/connectivity/bluetooth/core/bt-host/hci",
+    "//src/connectivity/bluetooth/core/bt-host/hci-spec",
     "//src/devices/lib/driver",
     "//src/lib/ddk",
     "//src/lib/ddktl",
diff --git a/src/connectivity/bluetooth/hci/vendor/intel/vendor_hci.h b/src/connectivity/bluetooth/hci/vendor/intel/vendor_hci.h
index 5f34da4..6ef359a 100644
--- a/src/connectivity/bluetooth/hci/vendor/intel/vendor_hci.h
+++ b/src/connectivity/bluetooth/hci/vendor/intel/vendor_hci.h
@@ -11,8 +11,8 @@
 
 #include "src/connectivity/bluetooth/core/bt-host/common/byte_buffer.h"
 #include "src/connectivity/bluetooth/core/bt-host/common/device_address.h"
+#include "src/connectivity/bluetooth/core/bt-host/hci-spec/protocol.h"
 #include "src/connectivity/bluetooth/core/bt-host/hci/control_packets.h"
-#include "src/connectivity/bluetooth/core/bt-host/hci/hci.h"
 
 namespace btintel {
 
diff --git a/src/connectivity/bluetooth/tools/bt-hci-tool/BUILD.gn b/src/connectivity/bluetooth/tools/bt-hci-tool/BUILD.gn
index eb0bd9e..633c4cd 100644
--- a/src/connectivity/bluetooth/tools/bt-hci-tool/BUILD.gn
+++ b/src/connectivity/bluetooth/tools/bt-hci-tool/BUILD.gn
@@ -19,6 +19,7 @@
     "//src/connectivity/bluetooth/core/bt-host/common",
     "//src/connectivity/bluetooth/core/bt-host/gap",
     "//src/connectivity/bluetooth/core/bt-host/hci",
+    "//src/connectivity/bluetooth/core/bt-host/hci-spec",
     "//zircon/public/lib/fbl",
   ]
 }
diff --git a/src/connectivity/bluetooth/tools/bt-hci-tool/commands.cc b/src/connectivity/bluetooth/tools/bt-hci-tool/commands.cc
index d2a1ec8..590252d 100644
--- a/src/connectivity/bluetooth/tools/bt-hci-tool/commands.cc
+++ b/src/connectivity/bluetooth/tools/bt-hci-tool/commands.cc
@@ -13,9 +13,9 @@
 #include "src/connectivity/bluetooth/core/bt-host/common/advertising_data.h"
 #include "src/connectivity/bluetooth/core/bt-host/common/manufacturer_names.h"
 #include "src/connectivity/bluetooth/core/bt-host/gap/gap.h"
+#include "src/connectivity/bluetooth/core/bt-host/hci-spec/util.h"
 #include "src/connectivity/bluetooth/core/bt-host/hci/advertising_report_parser.h"
 #include "src/connectivity/bluetooth/core/bt-host/hci/control_packets.h"
-#include "src/connectivity/bluetooth/core/bt-host/hci/util.h"
 #include "src/lib/fxl/strings/join_strings.h"
 #include "src/lib/fxl/strings/string_number_conversions.h"
 #include "src/lib/fxl/strings/string_printf.h"
diff --git a/src/connectivity/bluetooth/tools/bt-hci-tool/main.cc b/src/connectivity/bluetooth/tools/bt-hci-tool/main.cc
index a8f5210..b72416c 100644
--- a/src/connectivity/bluetooth/tools/bt-hci-tool/main.cc
+++ b/src/connectivity/bluetooth/tools/bt-hci-tool/main.cc
@@ -19,8 +19,8 @@
 #include "lib/fit/defer.h"
 #include "src/connectivity/bluetooth/core/bt-host/common/byte_buffer.h"
 #include "src/connectivity/bluetooth/core/bt-host/common/log.h"
+#include "src/connectivity/bluetooth/core/bt-host/hci-spec/protocol.h"
 #include "src/connectivity/bluetooth/core/bt-host/hci/device_wrapper.h"
-#include "src/connectivity/bluetooth/core/bt-host/hci/hci.h"
 #include "src/connectivity/bluetooth/core/bt-host/hci/transport.h"
 #include "src/connectivity/bluetooth/tools/lib/command_dispatcher.h"
 #include "src/lib/fxl/command_line.h"
diff --git a/src/connectivity/bluetooth/tools/bt-intel-tool/BUILD.gn b/src/connectivity/bluetooth/tools/bt-intel-tool/BUILD.gn
index 5416ac2..0eb8df5 100644
--- a/src/connectivity/bluetooth/tools/bt-intel-tool/BUILD.gn
+++ b/src/connectivity/bluetooth/tools/bt-intel-tool/BUILD.gn
@@ -21,8 +21,8 @@
     "../lib",
     "//sdk/lib/fdio",
     "//src/connectivity/bluetooth/core/bt-host/common",
-    "//src/connectivity/bluetooth/core/bt-host/gap",
     "//src/connectivity/bluetooth/core/bt-host/hci",
+    "//src/connectivity/bluetooth/core/bt-host/hci-spec",
   ]
 
   public_deps = [
diff --git a/src/connectivity/bluetooth/tools/bt-intel-tool/bt_intel.h b/src/connectivity/bluetooth/tools/bt-intel-tool/bt_intel.h
index 4f870d4..9381cc0 100644
--- a/src/connectivity/bluetooth/tools/bt-intel-tool/bt_intel.h
+++ b/src/connectivity/bluetooth/tools/bt-intel-tool/bt_intel.h
@@ -6,7 +6,7 @@
 #define SRC_CONNECTIVITY_BLUETOOTH_TOOLS_BT_INTEL_TOOL_BT_INTEL_H_
 
 #include "src/connectivity/bluetooth/core/bt-host/common/device_address.h"
-#include "src/connectivity/bluetooth/core/bt-host/hci/hci.h"
+#include "src/connectivity/bluetooth/core/bt-host/hci-spec/protocol.h"
 
 namespace bt_intel {
 
diff --git a/src/connectivity/bluetooth/tools/bt-intel-tool/main.cc b/src/connectivity/bluetooth/tools/bt-intel-tool/main.cc
index bb5b3dc..1904449 100644
--- a/src/connectivity/bluetooth/tools/bt-intel-tool/main.cc
+++ b/src/connectivity/bluetooth/tools/bt-intel-tool/main.cc
@@ -15,8 +15,8 @@
 #include "commands.h"
 #include "src/connectivity/bluetooth/core/bt-host/common/byte_buffer.h"
 #include "src/connectivity/bluetooth/core/bt-host/common/log.h"
+#include "src/connectivity/bluetooth/core/bt-host/hci-spec/protocol.h"
 #include "src/connectivity/bluetooth/core/bt-host/hci/device_wrapper.h"
-#include "src/connectivity/bluetooth/core/bt-host/hci/hci.h"
 #include "src/connectivity/bluetooth/core/bt-host/hci/transport.h"
 #include "src/connectivity/bluetooth/tools/lib/command_dispatcher.h"
 #include "src/lib/fxl/command_line.h"