一个BLE HCI ACLpacket的实例分析

一个BLE HCI ACLpacket的实例分析，原始数据如下

02 02 20 0f 00 0b 00 04 00 1b 2f 00 00 00 4f 00 00 00 00 00

 

1. 第1字节表示HCI packet的类型

Vol 4: Host Controller Interface [Transport Layer] -- Part A -- 2 protocol

// bluedroid\hci\src\hci_h4.c
/* HCI H4 message type definitions */
#define H4_TYPE_COMMAND         1
#define H4_TYPE_ACL_DATA        2
#define H4_TYPE_SCO_DATA        3
#define H4_TYPE_EVENT           4

02 表示这是一个HCI ACL Data packet

 

2. HCI ACL Data packet的第2、3字节代表Handle + PB Flag + BC Flag

 

 

小端模式的“02 20”实际值为0x2002，对应上图可知

Handle = 0x2002 & 0x0FFF = 0x0002

PB Flag = (0x20 >> 4) & 0x03 = 0x02，表示这是一个起始包

 

3. HCI ACL Data packet的第4、5字节代表该HCI ACL Data packet的Data Total Length

小端模式的“0f 00”实际值为0x000f，Data部分的数据总长度是15。

 

4. 起始包的第6、7字节代表该PDU的长度，如果PDU的长度超过了Data Total Length，将要分包发送

“0b 00” = 0x000b， L2CAP PDU的长度为11

 

5. 起始包的第8、9字节代表该L2CAP PDU的Channel ID

// bluedroid\stack\include\l2cdefs.h
/* L2CAP Predefined CIDs  (0x0004-0x003E Reserved)
*/
#define L2CAP_SIGNALLING_CID            1
#define L2CAP_CONNECTIONLESS_CID        2
#define L2CAP_AMP_CID                   3
#define L2CAP_ATT_CID                   4
#define L2CAP_BLE_SIGNALLING_CID        5
#define L2CAP_SMP_CID                   6
#define L2CAP_AMP_TEST_CID              0x003F
#define L2CAP_BASE_APPL_CID             0x0040

“04 00” = 0x0004，表示Attribute protocol

 

6. 第10字节代表Attribute protocol PDU的操作码Opcode

// bluedroid\stack\include\gatt_api.h
#define  GATT_RSP_ERROR                      0x01
#define  GATT_REQ_MTU                        0x02
#define  GATT_RSP_MTU                        0x03
#define  GATT_REQ_FIND_INFO                  0x04
#define  GATT_RSP_FIND_INFO                  0x05
#define  GATT_REQ_FIND_TYPE_VALUE            0x06
#define  GATT_RSP_FIND_TYPE_VALUE            0x07
#define  GATT_REQ_READ_BY_TYPE               0x08
#define  GATT_RSP_READ_BY_TYPE               0x09
#define  GATT_REQ_READ                       0x0A
#define  GATT_RSP_READ                       0x0B
#define  GATT_REQ_READ_BLOB                  0x0C
#define  GATT_RSP_READ_BLOB                  0x0D
#define  GATT_REQ_READ_MULTI                 0x0E
#define  GATT_RSP_READ_MULTI                 0x0F
#define  GATT_REQ_READ_BY_GRP_TYPE           0x10
#define  GATT_RSP_READ_BY_GRP_TYPE           0x11
#define  GATT_REQ_WRITE                      0x12 /*                 0001-0010 (write)*/
#define  GATT_RSP_WRITE                      0x13
#define  GATT_CMD_WRITE                      0x52 /* changed in V4.0 01001-0010(write cmd)*/
#define  GATT_REQ_PREPARE_WRITE              0x16
#define  GATT_RSP_PREPARE_WRITE              0x17
#define  GATT_REQ_EXEC_WRITE                 0x18
#define  GATT_RSP_EXEC_WRITE                 0x19
#define  GATT_HANDLE_VALUE_NOTIF             0x1B
#define  GATT_HANDLE_VALUE_IND               0x1D
#define  GATT_HANDLE_VALUE_CONF              0x1E
#define  GATT_SIGN_CMD_WRITE                 0xD2 /* changed in V4.0 1101-0010 (signed write)  see write cmd above*/
#define  GATT_OP_CODE_MAX                    GATT_HANDLE_VALUE_CONF + 1 /* 0x1E = 30 + 1 = 31*/

”1b“ GATT_HANDLE_VALUE_NOTIF

“2f 00” = 0x002f -- the handle of the attribute

“00 00 4f 00 00 00 00 00” -- the current value of the attribute