蓝牙协议栈

从软件开发者角度理解蓝牙协议栈，掌握各层职责、数据包结构和 API 调用。

📐 协议栈分层架构

📋 各层职责与开发接口

图表总览

各层详细说明

开发者关注点

🔧 Host 层详解（开发者关注）

GAP 层 - 设备发现与连接

// GAP 广播配置示例 (Nordic SDK)
ble_gap_adv_params_t adv_params = {
    .properties = {
        .type = BLE_GAP_ADV_TYPE_CONNECTABLE_SCANNABLE_UNDIRECTED
    },
    .p_peer_addr = NULL,
    .interval = {
        .min = BLE_GAP_ADV_INTERVAL_MIN,  // 160 * 0.625ms = 100ms
        .max = BLE_GAP_ADV_INTERVAL_MAX
    },
    .timeout = 0,
    .filter_policy = BLE_GAP_ADV_FP_ANY
};

// 设置广播数据
uint8_t adv_data[] = {
    0x02, 0x01, 0x06,  // Flags
    0x03, 0x03, 0xAA, 0xFE,  // Service UUID (0xFEAA)
    0x0B, 0x09, 'M', 'y', 'D', 'e', 'v', 'i', 'c', 'e'  // Device Name
};

sd_ble_gap_adv_start(&adv_params, 1);

GATT 层 - 服务与特征值

// GATT 服务定义示例
// 电池服务 UUID: 0x180F
// 电池电量特征值 UUID: 0x2A19

ble_gatts_char_md_t char_md = {
    .char_props.read = 1,
    .char_props.notify = 1,
    .p_char_user_desc = NULL,
    .p_char_pf = NULL,
    .p_user_desc_md = NULL,
};

ble_uuid_t uuid = {
    .uuid = BLE_UUID_BATTERY_LEVEL_CHAR,
    .type = BLE_UUID_TYPE_BLE
};

ble_attr_char_value_t char_val = {
    .def_val = 100,  // 初始电量 100%
    .max_len = 1,
};

// 添加特征值到服务
sd_ble_gatts_characteristic_add(service_handle, &char_md, &attr, &char_handle);

L2CAP 层 - 信道复用

📦 数据包结构详解

完整数据流向

HCI ACL 数据包格式

// HCI ACL Data Packet
// 用于 Host ↔ Controller 传输 GATT 数据

+----------------+----------------+----------------+
|  HCI Header    |  ACL Header    |  L2CAP PDU     |
|  (4 bytes)     |  (4 bytes)     |  (可变)        |
+----------------+----------------+----------------+

// HCI Header 结构
typedef struct {
    uint16_t handle;      // 连接句柄 (12 位) + 标志 (4 位)
    uint16_t dlen;        // 数据长度
} hci_acl_header_t;

// ACL Header 结构
typedef struct {
    uint16_t dlen;        // L2CAP 数据长度
    uint16_t cid;         // 信道 ID (ATT=0x0001, SMP=0x0002)
} l2cap_header_t;

// 示例：发送 GATT 通知
uint8_t packet[] = {
    // HCI ACL Header
    0x00, 0x40,           // Handle=0, PB=00, BC=00
    0x17, 0x00,           // Data Length=23
    
    // L2CAP Header
    0x13, 0x00,           // L2CAP Length=19
    0x01, 0x00,           // CID=0x0001 (ATT)
    
    // ATT Handle Value Notification
    0x1B,                 // Opcode: Handle Value Notification
    0x04, 0x00,           // Handle=0x0004
    0x64,                 // Value: 100%
};

ATT PDU 格式

// ATT PDU 通用格式
+--------+------------------+
| Opcode |  Parameters      |
| 1 byte |  可变长度        |
+--------+------------------+

// 常用 ATT Opcode
#define ATT_OP_ERROR              0x01
#define ATT_OP_EXCHANGE_MTU_REQ   0x02
#define ATT_OP_EXCHANGE_MTU_RSP   0x03
#define ATT_OP_FIND_INFO_REQ      0x04
#define ATT_OP_FIND_INFO_RSP      0x05
#define ATT_OP_FIND_BY_TYPE_REQ   0x06
#define ATT_OP_FIND_BY_TYPE_RSP   0x07
#define ATT_OP_READ_BY_TYPE_REQ   0x08
#define ATT_OP_READ_BY_TYPE_RSP   0x09
#define ATT_OP_READ_REQ           0x0A
#define ATT_OP_READ_RSP           0x0B
#define ATT_OP_READ_BLOB_REQ      0x0C
#define ATT_OP_READ_BLOB_RSP      0x0D
#define ATT_OP_READ_MULTI_REQ     0x0E
#define ATT_OP_READ_MULTI_RSP     0x0F
#define ATT_OP_READ_BY_GROUP_REQ  0x10
#define ATT_OP_READ_BY_GROUP_RSP  0x11
#define ATT_OP_WRITE_REQ          0x12
#define ATT_OP_WRITE_RSP          0x13
#define ATT_OP_WRITE_CMD          0x52
#define ATT_OP_PREP_WRITE_REQ     0x16
#define ATT_OP_PREP_WRITE_RSP     0x17
#define ATT_OP_EXEC_WRITE_REQ     0x18
#define ATT_OP_EXEC_WRITE_RSP     0x19
#define ATT_OP_HANDLE_VALUE_NOTIF 0x1B
#define ATT_OP_HANDLE_VALUE_IND   0x1D
#define ATT_OP_HANDLE_VALUE_CFM   0x1E

各层 MTU 对比

🔌 HCI 命令速查

常用 LE Controller 命令 (OGF=0x08)

HCI 命令格式示例

// HCI 命令包格式
// +----------------+----------------+----------------+
// | Opcode (2B)    | Parameter Len  | Parameters     |
// | OGF(10b)+OCF(6b)| (1B)          | (可变)         |
// +----------------+----------------+----------------+

// 示例：LE_Set_Advertising_Parameters
// OGF = 0x08, OCF = 0x000A
// Opcode = 0x200A

uint8_t hci_cmd[] = {
    0x0A, 0x20,           // Opcode: OGF=0x08, OCF=0x000A
    0x1F,                 // Parameter Length: 31 bytes
    
    // Advertising Parameters
    0xA0, 0x00,           // Interval Min: 160 * 0.625ms = 100ms
    0xA0, 0x00,           // Interval Max
    0x00,                 // Type: ADV_IND
    0x00, 0x00,           // Own Address Type
    0x00,                 // Peer Address Type
    0x00, 0x00, 0x00, 0x00, 0x00, 0x00,  // Peer Address
    0x07,                 // Channel Map: 37,38,39
    0x00,                 // Filter Policy
};

💻 跨平台 HCI 调用示例

#include 
#include 
#include 

int main() {
    int dev_id = hci_get_route(NULL);
    int dev_fd = hci_open_dev(dev_id);
    
    // LE_Set_Advertising_Parameters
    struct hci_request hci_req = {
        .ogf = OGF_LE_CTL,
        .ocf = OCF_LE_SET_ADV_PARAMETERS,
        .cparam = &adv_params,
        .clen = LE_SET_ADV_PARAMETERS_CP_SIZE,
        .rparam = &rp,
        .rlen = LE_SET_ADV_PARAMETERS_RP_SIZE,
    };
    
    hci_send_req(dev_fd, &hci_req, 1000);
    
    // LE_Set_Advertise_Enable
    uint8_t enable = 0x01;
    hci_send_cmd(dev_fd, OGF_LE_CTL, OCF_LE_SET_ADV_ENABLE, 1, &enable);
    
    return 0;
}

import bluetooth._bluetooth as bluez

# 打开 HCI 设备
dev_id = 0
sock = bluez.hci_open_dev(dev_id)

# 发送 HCI 命令
# LE_Set_Advertising_Parameters
cmd = bytes([
    0x0A, 0x20,  # Opcode
    0x1F,        # Length
    # ... 参数
])

sock.send(cmd)

# 读取事件
evt = sock.recv(255)
print(f"Event: {evt.hex()}")

#include "nrf_sdm.h"
#include "nrf_sdh.h"
#include "nrf_sdh_ble.h"

// 启用 SoftDevice
void softdevice_init(void) {
    nrf_clock_lf_cfg_t clock_cfg = NRF_CLOCK_LFCLK_RC;
    
    // 初始化 SoftDevice
    sd_softdevice_enable(&clock_cfg, NULL);
    
    // 启用 BLE
    nrf_sdh_ble_default_cfg_set(APP_BLE_CONN_CFG_TAG, &ble_cfg);
    nrf_sdh_ble_enable(&ram_start);
    
    // 配置广播参数
    ble_gap_adv_params_t adv_params = {
        .properties.type = BLE_GAP_ADV_TYPE_CONNECTABLE_SCANNABLE_UNDIRECTED,
        .interval.min = 160,  // 100ms
        .interval.max = 160,
    };
    
    sd_ble_gap_adv_start(&adv_params, APP_BLE_CONN_CFG_TAG);
}