1 前言
本文只要对蓝牙协议栈做一个简单介绍，包含hci层、acl链路、
- 1
l2cap层，sdp服务及几个常见的profile，让初学蓝牙协议栈的人
对整个蓝牙协议栈有一个整体框架的了解。
2 HCI层
HCI（host communication interface）主机通讯端口，它主要为上层提供了一个统一的通讯端口，其主要用于传输命令和时间。大概关系图如下、
host（用户app）对蓝牙的控制都是发送通讯协议中定义的命令来控制蓝牙进入到响应的工作模式，蓝牙处理之后会以事件的方式返回通知主机。
协议数据格式
HCI传输的数据格式有4种类型，分别为命令，acl，sco和事件，在协议数据中对应的type分别为、
command(0x01) command pocket
acl（0x02） ACL Data pocket
sco（0x03） SCO Data Packet
event（0x04）event主要是be设备在有事件发生时通知主机
command pocket
command pocket的数据格式如下，大家也可以阅读蓝牙的协议栈文档去了解。
opcode为命令操作吗，由ocf与ogf组成。
opcode为命令操作吗，由ocf与ogf组成。
ACL Data pocket
acl主要用于主从设备之间数据的异步交换，比如音乐播放，我们的l2cap就是使用的是该模式。数据包的协议数据格式如下、
handle表示当前通信通道的句柄，PB Flag（packet boundary flag）表示包的可接收到的层。
SCO Data Packet
SCO主要用于ble与host之间同步数据的传输，数据包格式如下、
handle如上描述、PSF如下、
Event Packet
event主要是be设备在有事件发生时通知主机，格式如下。
2.1 Hci命令及应答的控制
由于不同的hci命令对结果有不同的处理，有的不需要结果，有些需要
- 1
等待结果后才能执行下一步动作，有些在一定状态下才有效，对这
样在hci层，都有一套机制，每发送一个命令，都会先检查当前是否
可以发送该命令（有时hci controller当前不能接收命令时，也不能
发送），若命令可以发送，检查该命令是否一定需要等待结果，并
且等待结果的超时时间是多少，然后启动一个定时器监测该命令的
返回结果，若超时还没有结果，就执行命令超时处理。
2.2 hci分组
《蓝牙协议及其源代码分析》 208页
《bluetooth_Core_v4.2.pdf》779页
《蓝牙协议及其源代码分析》该书可以购买或从网上下载，这里标
志的是网上下载的版本，非完整版本，若对不上号，自己找对应位
置。
《bluetooth_Core_v4.2.pdf》下载地址：
https://www.bluetooth.org/DocMan/handlers/DownloadDoc.ashx?doc_id=286439
2.3 HCI CONFIGURATION PARAMETERS
《bluetooth_Core_v4.2.pdf》787页
2.4 链路控制指令
《蓝牙协议及其源代码分析》 214页
《bluetooth_Core_v4.2.pdf》813页
2.5 链路策略命令
《蓝牙协议及其源代码分析》 216页
《bluetooth_Core_v4.2.pdf》926页
2.6 主机控制器和基带命令
《蓝牙协议及其源代码分析》 216页
《bluetooth_Core_v4.2.pdf》951页
2.7 信息参数命令
《蓝牙协议及其源代码分析》 218页
《bluetooth_Core_v4.2.pdf》1097页
2.8 状态参数命令
《蓝牙协议及其源代码分析》 218页
《bluetooth_Core_v4.2.pdf》1110页
2.9 测试命令
《蓝牙协议及其源代码分析》 218页
《bluetooth_Core_v4.2.pdf》1138页
2.10 事件
《蓝牙协议及其源代码分析》 219页
《bluetooth_Core_v4.2.pdf》1152页
2.11 BLE控制器命令
《bluetooth_Core_v4.2.pdf》1271页
3 ACL链路
L2CAP的通信是基于ACL链路的，两个蓝牙设备之间只有一条ACL链
- 1
路，由Connect Handle标识。在进行L2CAP的任何通信之前，都
需要先建立ACL链路，两个蓝牙设备的配对，先建立一条ACL通
码。ACL链路建立后，就会进行L2CAP的一些交互，获取信息，但
需要基于SDP profile获取信息时，L2CAP就会建立一条SDP逻辑链
路（由Channel ID标识），SDP的交互就在L2CAP建立的Channel
上进行，SDP交互完成后，会断开SDP的逻辑链路，若后面没有其
它再需要交互的，ACL链路也会断开，但由于已经配对过，上层会
保存ACL配对的信息。
4 L2CAP层
4.1 l2cap层位置
4.2 L2CAP包
《bluetooth_Core_v4.2.pdf》1737页
L2CAP包的类型有CID（Channel ID）确定：
0x0000 Null identifier（不使用）
0x0001 L2CAP Signaling channel（信令信道）
0x0002 Connectionless channel（无连接信道，用于广播）
0x0003 AMP Manager Protocol
0x0004 Attribute Protocol(BLE)
0x0005 Low Energy L2CAP Signaling channel(BLE信令信道)
0x0006 Security Manager Protocol（BLE）
0x0007 BR/EDR Security Manager
0x0008-0x001F Reserved
0x0020-0x003E Assigned Numbers
0x003F AMP Test Manager
0x0040-0xFFFF Dynamically allocated（建立连接后动态分配的信道，承载profile数据）
4.3 CONNECTION-ORIENTED CHANNELS IN BASIC
L2CAP面向连接的基本帧封包
4.4 CONNECTIONLESS DATA CHANNEL IN BASIC
L2CAP无连接的帧封包
4.5 CONNECTION-ORIENTED CHANNEL IN RETRANSMISSION/FLOW CONTROL/STREAMING
L2CAP面向连接的重传、流控帧封包
4.6 CONNECTION-ORIENTED CHANNELS IN LE CREDIT BASED FLOW CONTROL
L2CAP面向连接信道（BLE使用）
4.7 L2CAP信令封包
《bluetooth_Core_v4.2.pdf》1749页
L2CAP信令封包，其中infromation payload的内容格式如下：
Code值：
4.8 L2CAP层的状态
《bluetooth_Core_v4.2.pdf》1802页
• CLOSED – channel not connected.
• WAIT_CONNECT – a connection request has been received, but only a
connection response with indication “pending” can be sent.
• WAIT_CONNECT_RSP – a connection request has been sent, pending a
positive connect response.
• CONFIG – the different options are being negotiated for both sides; this
state comprises a number of substates, see Section 6.1.3 on page 114
• OPEN – user data transfer state.
• WAIT_DISCONNECT – a disconnect request has been sent, pending a
disconnect response.
• WAIT_CREATE – a channel creation request has been received, but only a
response with indication “pending” can be sent. This state is similar to
WAIT_CONNECT.
• WAIT_CREATE_RSP – a channel creation request has been sent, pending
a channel creation response. This state is similar to WAIT_CONNECT_RSP.
• WAIT_MOVE – a request to move the current channel to another Controller
has been received, but only a response with indication “pending” can be
sent.
• WAIT_MOVE_RSP – a request to move a channel to another Controller has
been sent, pending a move response
• WAIT_MOVE_CONFIRM – a response to the move channel request has
been sent, waiting for a confirmation of the move operation by the initiator
side
• WAIT_CONFIRM_RSP – a move channel confirm has been sent, waiting for
a move channel confirm response.
各种状态下收到不同事件的处理，L2CAP的重点。
- 1
5 Service Discovery Protocol（SDP）
5.1 SDP 协议数据单元( PDU )
《bluetooth_Core_v4.2.pdf》1926页
每一SDP 协议数据单元( PDU )都由PDU 头和PDU 指定参数组
成。报文头包含三个域:协议数据单元ID、事务ID 和参数长度
ParameterLength，参数包括一个后续状态参数。
5.2 SDP 连接建立过程
5.3 Service Record
Each service attribute describes a single characteristic of a service. Some
examples of service attributes are:
5.4 常见SDP获取的信息
PnP Information：有的蓝牙耳机没有实现这部分；
5.5 UUID定义
https://www.bluetooth.com/specifications/assigned-numbers/service-discovery
6 通用访问配置文件(Generic Access Profile, GAP)
GAP是所有其他配置文件的基础,它定义了在蓝牙设备间建立基带链
路的通用方法.除此之外,GAP还定义了下列内容:
必须在所有蓝牙设备中实施的功能
发现和链接设备的通用步骤
基本用户界面术语.
GAP处理未连接的两个设备间的发现和建立连接过程，GAP确保了
两个蓝牙设备可通过蓝牙技术交换信息。对于GAP的操作，直接由
HCI命令分组控制。
7 RFCOMM协议
7.1 RFCOMM数据封包格式
Frame Structure for Basic option
一个封包内的各部分内容
UIH frames with P/F-bit = 1 and credit based flow control used.
8 AUDIO/VIDEO CONTROL TRANSPORT PROTOCOL(AVCTP)
Audio/Video Control Transport Protocol (AVCTP), which is used to transport command and response
- 1
messages for controlling Audio Video features in conformant
devices. This protocol enables a device to support more than
one control profile at the same time; each supported profile
shall define its own message formatting and/or usage rules.
8.1 AVCTP所处的位置
AVCTP协议封包
9 AUDIO/VIDEO REMOTE CONTROL PROFILE(AVCRP)
This profile defines the requirements for Bluetooth® devices necessary for the support of the
- 1
Audio/Video Remote Control usage case. The requirements
are expressed in terms of end-user services, and by defining
the features and procedures that are required for
interoperability between Bluetooth devices in the
Audio/Video Remote Control usage case.
9.1 AVRC
10 Generic Audio/Video Distribution Profile (GAVDP)
This profile defines the requirements for
- 1
Bluetooth® devices necessary to set up streaming channels
used for support of audio/video distribution. The
requirements are expressed in terms of services provided to
applications, and by defining the features and procedures
that are required for interoperability between Bluetooth
devices in the Audio/Video Distribution usage model.
10.1 GAVDP协议位置
11 AUDIO/VIDEO DISTRIBUTION TRANSPORT PROTOCOL(AVDTP)
This protocol defines A/V stream negotiation,
- 1
establishment, and transmission procedures. Also specified
are the message formats that are exchanged between such
devices to transport their A/V streams in A/V distribution
applications.
11.1 AVDTP
11.2 AVDTP一些交互例子
12 ADVANCED AUDIO DISTRIBUTION PROFILE (A2DP)
12.1 A2DP协议位置
13 Hand s-Free Profile(HFP)
The Hands-Free Profile (HFP) 1.7.1 specification
- 1
defines a set of functions such that a Mobile Phone can be
used in conjunction with a Hands-Free device (e.g., installed
in the car or represented by a wearable device such as a
headset), with a Bluetooth Link providing a wireless means
for both remote control of the Mobile Phone by the Hands-
Free device and voice connections between the Mobile
Phone and the Hands-Free device.
13.1 HFP协议位置
14 HEADSET PROFILE(HSP)
This profile defines the requirements for
- 1
Bluetooth® devices necessary to support the Headset use
case. The requirements are expressed in terms of end-user
services, and by defining the features and procedures that are
required for interoperability between Bluetooth devices in the
Headset use case.
14.1 HSP协议位置
HSP（手机规格）– 提供手机（移动电话）与耳机之间通信所需的基
本功能。
HFP（免提规格）– 在 HSP 的基础上增加了某些扩展功能，原来只
用于从固定车载免提装置来控制移动电话。
A2DP（高级音频传送规格）– 允许传输立体声音频信号。 （相比用
于 HSP 和 HFP 的单声道加密，质量要好得多）。
AVRCP（音频/视频遥控规格）–用于从控制器（如立体声耳机）向
目标设备（如装有 Media Player 的电脑）发送命令（如前跳、暂停
和播放）。
15 Human Interface Device (HID) Profile
This profile defines how devices with Bluetooth
- 1
wireless communications can use the HID Specification
initially to discover the feature set of a Bluetooth HID device,
and then communicate with the Bluetooth HID device. This
profile further defines how a device with Bluetooth wireless
communications can support HID services over the Bluetooth
protocol stack using the Logical Link Control and Adaptation
Protocol (L2CAP) layer.
15.1 HID协议位置
15.2 HID head message
16 Serial Port Profile(SPP)
This profile defines the requirements for
- 1
Bluetooth® devices necessary for setting up emulated serial
cable connections using RFCOMM between two peer devices. The requirements are expressed in terms of services
provided to applications, and by defining the features and
procedures that are required for interoperability between
Bluetooth devices.
