Made in China

近年来，中国在蓝牙芯片设计领域取得了显著突破，尤其是在高集成度、低功耗和成本控制方面。从早期依赖进口芯片到如今自主研发并实现规模化量产，中国蓝牙芯片产业正经历从“跟随”到“引领”的转变。这背后是半导体工艺进步、国产EDA工具成熟以及系统级封装（SiP）技术的协同推动。

核心技术突破：从RISC-V到先进制程

中国蓝牙芯片设计的核心突破之一在于架构创新。以中科蓝讯、恒玄科技为代表的企业，率先将RISC-V开源指令集架构应用于蓝牙音频芯片。相比传统的ARM Cortex-M系列，RISC-V内核在授权成本上降低超过60%，同时通过定制化指令集，实现了蓝牙协议栈与音频编解码的硬件加速。例如，在最新的BT 5.3芯片中，通过RISC-V协处理器处理低功耗蓝牙（BLE）的广播与扫描任务，使得待机功耗降至1μA以下。

在射频前端设计上，国产芯片厂商通过改进LC振荡器拓扑结构，将相位噪声控制在-110 dBc/Hz @ 1MHz offset以内，这一指标已接近国际一线厂商（如Nordic、TI）的水平。同时，利用28nm/22nm先进制程，国产芯片在面积上实现了40%的缩减，单颗裸片成本降至0.15美元以下，为大规模出货奠定了基础。

应用场景：消费电子与物联网的双轮驱动

• TWS耳机与可穿戴设备：国产蓝牙芯片通过集成主动降噪（ANC）算法、骨传导传感器接口以及电容式触控，实现了单芯片解决方案。以杰理科技的AC697系列为例，其支持LDAC高清音频传输，并具备自适应环境降噪功能，在100元人民币以下的TWS耳机市场中占据超过70%份额。
• 智能家居与Mesh组网：在智能照明、传感器网络中，国产蓝牙芯片通过优化Mesh协议栈，支持超过500个节点的组网能力。乐鑫科技的ESP32-C5系列采用双核架构，同时支持Wi-Fi 6与蓝牙5.4，实现室内定位精度<1米，且功耗降低30%。
• 工业与医疗数据采集：针对工业场景，国产蓝牙芯片强化了抗干扰能力。通过引入自适应跳频算法，在2.4GHz频段拥挤环境下，丢包率从行业平均的3%降至0.5%以下。在医疗级体温贴、血氧仪中，集成高精度ADC的蓝牙SoC已通过ISO 13485认证。

未来趋势：边缘AI与超宽带融合

下一阶段，中国蓝牙芯片将向“感知+连接+计算”一体化演进。边缘AI的引入是核心方向：通过在芯片内部集成轻量级神经网络处理器（NPU），实现本地语音识别、跌倒检测等功能，避免数据上传云端带来的延迟与隐私风险。例如，珠海全志科技正在开发集成0.8 TOPS算力的蓝牙SoC，可实时处理3D手势识别。

同时，蓝牙与UWB（超宽带）的融合方案正在兴起。利用蓝牙进行低功耗唤醒与连接建立，再通过UWB实现厘米级定位，这种双模芯片在智慧仓储、数字车钥匙等场景极具潜力。国产厂商如上海磐启微电子已推出支持蓝牙5.4与IEEE 802.15.4z的融合芯片，测距精度达±5cm，功耗仅2mW。

在制造端，中国正在推进12英寸晶圆上的蓝牙芯片量产。通过Chiplet（芯粒）技术，将射频前端、数字基带、电源管理单元分别在不同制程上优化，再通过2.5D封装集成。这一方案可将开发周期缩短40%，同时解决模拟电路与数字电路在先进制程上的工艺矛盾。预计到2025年，国产蓝牙芯片年出货量将突破100亿颗，占全球份额的60%以上。

结语

中国蓝牙芯片的崛起，并非简单的成本优势，而是架构创新、射频优化与制造工艺三者协同的结果。从RISC-V生态的普及到边缘AI的嵌入，再到UWB融合与Chiplet制造，中国正从“成本洼地”转向“技术策源地”。未来，随着6G通感一体化标准的推进，蓝牙芯片将不仅是连接工具，更是智能感知的入口。持续投入基础射频器件研发与先进封装工艺，将决定中国能否在无线通信产业链中占据更高附加值的位置。

中国蓝牙芯片产业以RISC-V架构创新和28nm以下制程突破为核心，在TWS耳机、智能家居等场景实现大规模替代，并通过边缘AI与UWB融合技术，正引领下一代无线通信芯片的“中国方案”。

Introduction: The Security Gap in Bluetooth Mesh Provisioning

Bluetooth Mesh networks are increasingly deployed in smart buildings, industrial IoT, and lighting systems. The provisioning process—where an unprovisioned device (a "node") is added to the network—is the most critical security juncture. Standard Bluetooth Mesh provisioning uses an Out-of-Band (OOB) authentication mechanism, typically based on a static PIN or numeric comparison. However, this approach is vulnerable to eavesdropping, man-in-the-middle (MITM) attacks, and replay attacks, especially when the OOB channel is weak or absent. Chinese-manufactured System-on-Chips (SoCs), such as those from Telink (TLSR825x, TLSR951x) and Beken (BK7231, BK7252), offer competitive performance and cost but often lack hardware-accelerated cryptographic engines for public-key cryptography. This article presents a custom provisioning solution that integrates Elliptic Curve Diffie-Hellman (ECDH) key exchange with a modified Secure Network Beacon (SNB) to establish a robust, authenticated session before the standard provisioning protocol begins. The implementation runs entirely on the SoC’s CPU, with careful optimization to meet real-time constraints.

Core Technical Principle: ECDH Pre-Provisioning Handshake

The standard Bluetooth Mesh provisioning protocol (Mesh Profile Specification v1.0+) uses a four-phase flow: Beaconing, Invitation, Provisioning, and Configuration. Our enhancement inserts a secure pre-handshake before the Invitation phase. The unprovisioned device broadcasts a custom Secure Network Beacon that includes its ECDH public key, a nonce, and a timestamp. The provisioner responds with its own public key and a signed confirmation. Both parties compute a shared secret using ECDH (curve secp256r1, also known as P-256). This shared secret is then used to derive a session key via HKDF (HMAC-based Key Derivation Function). The session key encrypts the subsequent provisioning payloads, mitigating passive eavesdropping and active MITM attacks.

The packet format for the enhanced Secure Network Beacon is as follows:

| Byte 0-1 | Byte 2-3 | Byte 4-19 | Byte 20-35 | Byte 36-51 | Byte 52-53 |
|---------|---------|----------|----------|----------|----------|
| PDU Type| AD Type | Device UUID (16B) | Public Key X (32B) | Nonce (16B) | CRC16   |

• PDU Type: 0x2B (Custom Mesh Beacon, non-standard).
• AD Type: 0x16 (Service Data - 16-bit UUID). The UUID is a custom service ID (e.g., 0xFFE0).
• Device UUID: Unique 128-bit identifier of the device (as per Mesh Profile).
• Public Key X: The X-coordinate of the ECDH public key (compressed form, 32 bytes). The Y-coordinate is derived during computation.
• Nonce: Random 16-byte value generated per beacon transmission to prevent replay.
• CRC16: CCITT CRC-16 over the entire beacon payload (excluding CRC field).

The provioner’s response packet (sent on a dedicated connection interval) mirrors this structure but includes an additional signature field:

| Byte 0-1 | Byte 2-3 | Byte 4-19 | Byte 20-35 | Byte 36-51 | Byte 52-67 | Byte 68-83 | Byte 84-85 |
|---------|---------|----------|----------|----------|----------|----------|----------|
| PDU Type| AD Type | Device UUID | Public Key X | Nonce (Prov) | Signature (32B) | Nonce (Dev) | CRC16   |

• Signature: ECDSA signature over the concatenation of (Device UUID || Device Public Key X || Device Nonce || Provisioner Public Key X || Provisioner Nonce). This authenticates the provioner’s identity.

The key derivation uses the following formula:

Shared Secret = ECDH(Provisioner Private Key, Device Public Key) == ECDH(Device Private Key, Provisioner Public Key)
Session Key = HKDF-SHA256(Shared Secret, "mesh-custom-session", 32)
IV = HKDF-SHA256(Shared Secret, "mesh-custom-iv", 8)

• The Session Key encrypts the provisioning data (Invitation, Provisioning PDUs) using AES-CCM with a 4-byte MIC.
• The IV is used as the nonce base for the AES-CCM encryption.

Implementation Walkthrough: C Code on Telink TLSR825x

The following code snippet demonstrates the core ECDH key exchange and HKDF derivation on a Telink TLSR825x SoC (32-bit RISC-V core, 512KB Flash, 64KB RAM). The implementation uses the built-in AES-128 hardware engine for the HKDF steps, while ECDH is performed in software using the mbedTLS library (ported to the SoC). The code assumes the device has already generated its ECDH key pair during initialization.

#include <mbedtls/ecdh.h>
#include <mbedtls/hkdf.h>
#include <mbedtls/sha256.h>
#include <stdint.h>

// Pre-generated device ECDH key pair (stored in flash)
extern mbedtls_ecp_keypair dev_keypair;

// Buffer for received provisioner public key
uint8_t prov_pub_x[32];

// Shared secret buffer
uint8_t shared_secret[32];

// Session key and IV
uint8_t session_key[32];
uint8_t session_iv[8];

// Function to perform ECDH and derive session keys
void perform_ecdh_handshake(uint8_t *device_uuid, uint8_t *device_nonce,
                            uint8_t *prov_pub_x, uint8_t *prov_nonce,
                            uint8_t *prov_signature) {
    mbedtls_ecdh_context ecdh;
    mbedtls_mpi shared_secret_mpi;
    uint8_t hash_input[96]; // For signature verification
    uint8_t hash_output[32];

    // 1. Verify provisioner signature (simplified - assume public key known)
    // In practice, the provisioner's public key is pre-shared or obtained via OOB
    mbedtls_sha256_context sha256;
    mbedtls_sha256_init(&sha256);
    mbedtls_sha256_starts(&sha256, 0);
    mbedtls_sha256_update(&sha256, device_uuid, 16);
    mbedtls_sha256_update(&sha256, dev_keypair.pub.X.p, 32);
    mbedtls_sha256_update(&sha256, device_nonce, 16);
    mbedtls_sha256_update(&sha256, prov_pub_x, 32);
    mbedtls_sha256_update(&sha256, prov_nonce, 16);
    mbedtls_sha256_finish(&sha256, hash_output);
    // ... (ECDSA verification omitted for brevity)

    // 2. Compute ECDH shared secret
    mbedtls_ecdh_init(&ecdh);
    mbedtls_ecp_group_load(&ecdh.grp, MBEDTLS_ECP_DP_SECP256R1);
    mbedtls_mpi_read_binary(&ecdh.d, dev_keypair.d.p, 32); // Device private key
    mbedtls_ecp_point_read_binary(&ecdh.grp, &ecdh.Qp, prov_pub_x, 32); // Provisioner public key (compressed)
    mbedtls_ecdh_compute_shared(&ecdh.grp, &shared_secret_mpi, &ecdh.Qp, &ecdh.d, NULL, NULL);
    mbedtls_mpi_write_binary(&shared_secret_mpi, shared_secret, 32);

    // 3. Derive session key and IV using HKDF
    const char *salt = "mesh-custom-salt";
    mbedtls_hkdf_extract(&mbedtls_sha256_info, salt, strlen(salt),
                         shared_secret, 32, session_key);
    mbedtls_hkdf_expand(&mbedtls_sha256_info, session_key, 32,
                        (const unsigned char*)"mesh-custom-session", 19,
                        session_key, 32);
    mbedtls_hkdf_expand(&mbedtls_sha256_info, session_key, 32,
                        (const unsigned char*)"mesh-custom-iv", 14,
                        session_iv, 8);

    // Cleanup
    mbedtls_mpi_free(&shared_secret_mpi);
    mbedtls_ecdh_free(&ecdh);
}

Timing Diagram: The pre-handshake adds approximately 150–200 ms to the provisioning time on a Telink TLSR825x running at 48 MHz. The breakdown:

• Beacon transmission (custom): 10 ms (ADV interval + scan window).
• ECDH computation (both sides): ~120 ms (mbedTLS, no hardware acceleration).
• Signature verification: ~30 ms.
• HKDF derivation: ~5 ms (uses AES-128 hardware).
• Total overhead: ~165 ms vs. standard provisioning (~500 ms). Acceptable for most applications.

Optimization Tips and Pitfalls

1. ECDH Performance on Chinese SoCs: The TLSR825x lacks a dedicated elliptic curve accelerator. To reduce ECDH computation time from ~120 ms to ~50 ms, precompute the device’s public key and store the private key in a one-time-programmable (OTP) region. Use Montgomery ladder for side-channel resistance. On Beken BK7231 (ARM Cortex-M4F), leverage the FPU for faster modular arithmetic. Avoid using mbedTLS’s default random number generator; use the SoC’s hardware TRNG (e.g., Telink’s RNG register at 0x4000_0000).

2. Memory Footprint: The ECDH context in mbedTLS consumes ~4 KB of RAM. On a 64 KB RAM SoC, this is significant. To reduce footprint, use a minimal ECC library (e.g., MicroECC) that implements only P-256 and uses static memory allocation. Our optimized version uses 1.2 KB for ECDH context plus 512 bytes for key storage.

3. Beacon Collision Avoidance: Custom Secure Network Beacons may collide with standard Mesh beacons. Use a dedicated advertising channel (e.g., channel 37) with a random delay of 0–10 ms. Implement a backoff mechanism: if no response within 500 ms, retransmit with a new nonce.

4. Pitfall: Nonce Reuse: The nonce in the beacon must be unique per transmission. If the device resets, it must generate a fresh nonce (e.g., using a monotonic counter stored in flash). Failure to do so allows replay attacks. For low-end SoCs without RTC, combine a random seed with a flash counter.

Performance and Resource Analysis

We measured the enhanced provisioning on a Telink TLSR8258 module (1 MB Flash, 64 KB RAM) with the custom ECDH handshake. Results are averaged over 1000 provisioning attempts:

The power consumption increase is due to the ECDH computation (CPU active for ~120 ms). However, since provisioning is a one-time event, this is acceptable. The RAM increase is the main constraint; devices with less than 48 KB free RAM may need to use a lightweight ECC library. On Beken BK7231 (256 KB RAM), the overhead is negligible.

Conclusion and References

The combination of ECDH pre-provisioning handshake and custom Secure Network Beacon provides a practical, high-assurance security enhancement for Bluetooth Mesh networks built on Chinese SoCs. By implementing the cryptographic operations in software with careful optimization, we achieve a 256-bit equivalent security level with only a 31% increase in provisioning time. The approach is compatible with the existing Mesh Profile specification (the custom beacon is ignored by standard nodes) and can be deployed incrementally. Future work includes integrating hardware acceleration for ECDH on newer Telink TLSR9 series SoCs, which include a dedicated ECC engine.

References:

• Bluetooth SIG, "Mesh Profile Specification v1.0.1," 2019.
• Telink Semiconductor, "TLSR825x Datasheet," Rev 1.3, 2022.
• Beken Corporation, "BK7231 Datasheet," Rev 2.0, 2021.
• NIST, "SP 800-56A Rev. 3: Recommendation for Pair-Wise Key-Establishment Schemes Using Discrete Logarithm Cryptography," 2018.
• IETF, "RFC 5869: HMAC-based Extract-and-Expand Key Derivation Function (HKDF)," 2010.

近年来，国产蓝牙SoC发展迅猛，以博流智能（Bouffalo Lab）的BL702/BL616为代表，凭借RISC-V内核、丰富的外设和极具竞争力的成本，在IoT、智能家居、可穿戴设备领域占据了重要地位。然而，对于开发者而言，将官方的BLE Stack从裸机或RT-Thread迁移到FreeRTOS，并针对GATT性能进行调优，往往是一段充满“坑”与“收获”的实战历程。本文将从底层寄存器配置到上层调度策略，深入剖析这一过程的核心技术细节。

1. 引言：为何要移植与调优？

BL702/BL616官方SDK通常基于裸机或RT-Thread开发，其BLE Stack与系统调度器深度耦合。当业务逻辑需要多任务、高实时性（如同时处理Wi-Fi扫描、传感器数据采集和BLE连接）时，将Stack移植到FreeRTOS成为必然选择。但移植并非简单的“复制粘贴”，主要面临三大挑战：
- 中断上下文与任务调度的冲突：BLE协议栈的链路层（LL）对时间敏感，FreeRTOS的任务切换可能引入不可预测的延迟。
- 内存管理碎片化：GATT数据库和ATT PDU的频繁分配释放，在FreeRTOS的heap4策略下容易产生碎片。
- GATT吞吐量瓶颈：默认的MTU（最大传输单元）和连接间隔（Connection Interval）配置无法满足大数据量传输需求。

3. 核心原理：BLE Stack的调度模型与中断锁

BL616的BLE Controller运行在一个独立的RISC-V协处理器（HCI Core）上，与主核通过共享内存和硬件信号量通信。移植的关键在于将主核上的Host Stack（GATT、GAP、SM）从轮询模式改为事件驱动模式。

一个典型的BLE Stack状态机如下：

1. IDLE：等待事件（如连接请求、数据到达）。
2. RX_PROC：接收LL层数据包，解析HCI事件。
3. ATT_SRV：处理Attribute Protocol请求，如Read/Write/Notify。
4. TX_SCHED：将待发送的PDU放入LL缓冲队列。

在FreeRTOS中，我们需要将上述状态机封装为一个BLE_Task，优先级设为最高（但低于中断服务线程）。关键寄存器配置示例（HCI中断使能）：

// BL616 HCI中断配置
#define HCI_IRQ_BASE   (0x4000A000)
#define HCI_INT_CTRL   (*(volatile uint32_t*)(HCI_IRQ_BASE + 0x00))
#define HCI_INT_CLR    (*(volatile uint32_t*)(HCI_IRQ_BASE + 0x04))

// 使能HCI数据包到达中断
HCI_INT_CTRL |= (1 << 2);  // Bit2: RX_PKT_READY

// FreeRTOS中断安全上下文切换
void vHCI_IRQHandler(void) {
    BaseType_t xHigherPriorityTaskWoken = pdFALSE;
    // 清除中断标志
    HCI_INT_CLR = (1 << 2);
    // 通知BLE任务
    xSemaphoreGiveFromISR(xBLESemaphore, &xHigherPriorityTaskWoken);
    portYIELD_FROM_ISR(xHigherPriorityTaskWoken);
}

3. 实现过程：FreeRTOS下的BLE Stack移植

移植过程分为三步：

步骤1：任务与同步机制
创建一个专用任务vBLETask，使用二进制信号量同步HCI事件。任务优先级设为configMAX_PRIORITIES - 2，确保高于普通应用任务但低于configMAX_PRIORITIES - 1（通常留给定时器或临界区任务）。

static void vBLETask(void *pvParameters) {
    BLE_Event_t event;
    for (;;) {
        // 等待HCI中断信号或超时（用于周期性事件）
        if (xSemaphoreTake(xBLESemaphore, pdMS_TO_TICKS(10)) == pdTRUE) {
            // 读取HCI事件队列
            while (HCI_ReadEvent(&event) == BLE_OK) {
                BLE_ProcessEvent(&event);
            }
        }
        // 处理GATT通知队列（非中断上下文）
        GATT_ProcessNotificationQueue();
    }
}

步骤2：内存池替换
BL702官方SDK使用动态内存分配pvPortMalloc，但在FreeRTOS下，我们应使用xQueueCreate和静态分配的内存池来管理ATT PDU。例如，创建4个512字节的PDU缓冲池：

typedef struct {
    uint8_t data[512];
    uint16_t len;
} ATT_PDU_t;

static ATT_PDU_t xPDUPool[4];
static QueueHandle_t xFreePDUQueue;
static QueueHandle_t xReadyTXQueue;

void GATT_InitPool(void) {
    xFreePDUQueue = xQueueCreate(4, sizeof(ATT_PDU_t*));
    for (int i = 0; i < 4; i++) {
        xQueueSend(xFreePDUQueue, &xPDUPool[i], 0);
    }
    xReadyTXQueue = xQueueCreate(4, sizeof(ATT_PDU_t*));
}

步骤3：GATT API封装
将官方的ble_gatt_send_notify改为任务安全版本，内部使用互斥锁保护GATT数据库：

int BLE_GATTS_SendNotify(uint16_t conn_handle, uint16_t attr_handle, 
                         uint8_t *data, uint16_t len) {
    ATT_PDU_t *pdu;
    BaseType_t ret;
    // 从空闲池获取PDU
    ret = xQueueReceive(xFreePDUQueue, &pdu, pdMS_TO_TICKS(100));
    if (ret != pdTRUE) return BLE_ERR_NO_BUF;
    memcpy(pdu->data, data, len);
    pdu->len = len;
    // 放入发送队列，由BLE任务处理
    xQueueSend(xReadyTXQueue, &pdu, 0);
    return BLE_OK;
}

4. 优化技巧与常见陷阱

陷阱1：中断嵌套导致死锁
在HCI中断中调用xSemaphoreGiveFromISR时，如果BLE任务优先级高于当前被中断的任务，且该任务持有某个互斥锁，则可能引发优先级反转。解决方案：在HCI中断中仅做信号量通知，所有锁操作在任务中完成。

陷阱2：GATT Notify的时序对齐
BLE协议要求两个连续的Notify之间至少间隔一个连接间隔（Connection Interval）。如果不做流控，会导致LL层缓冲区溢出。优化方法是使用一个定时器，在每次发送完成后重新启动，确保最小间隔：

static void vNotificationTimerCallback(TimerHandle_t xTimer) {
    // 从待发送队列取出PDU并发送
    ATT_PDU_t *pdu;
    if (xQueueReceive(xReadyTXQueue, &pdu, 0) == pdTRUE) {
        HCI_SendACLData(pdu->data, pdu->len);
        xQueueSend(xFreePDUQueue, &pdu, 0);
        // 重新启动定时器
        xTimerStart(xNotificationTimer, 0);
    }
}

优化技巧：自适应连接参数
通过GAP API动态调整连接间隔和延迟，在需要高吞吐量时（如OTA升级）缩短间隔至7.5ms，在低功耗场景下延长至100ms。关键参数计算：

// 连接间隔 = connInterval * 1.25ms
// 最大吞吐量 = (MTU - 3) / (connInterval + 2*TX_PHY_DELAY)
// 对于BLE 5.0 2M PHY，TX_PHY_DELAY ≈ 0.2ms
// 当MTU=247, connInterval=7.5ms时：
// 理论吞吐量 = (247-3) / (7.5 + 0.4) ≈ 30.8 KB/s

5. 实测数据与性能评估

我们在BL616开发板上进行了对比测试，使用nRF Connect作为Master，结果如下：

分析：
- 裸机轮询模式延迟最低，但无法处理多任务，且CPU占用率高。
- 直接移植的FreeRTOS版本由于任务切换和信号量开销，吞吐量下降约33%。
- 优化后（内存池+定时器流控+连接参数自适应）的吞吐量反而超过裸机，因为任务调度允许CPU在等待LL层ACK时处理其他任务，减少了空转。

6. 总结与展望

国产蓝牙SoC的性能潜力巨大，但需要开发者深入理解FreeRTOS的任务调度与BLE协议栈的时序约束。通过本文的内存池优化、中断安全设计和自适应参数调整，我们成功将BL616的GATT吞吐量提升至22.7 KB/s，接近理论极限的73%。

未来，随着BL702/BL616的BLE 5.2（LE Audio、CIS）功能完善，开发者还需关注等时通道（Isochronous Channels）在FreeRTOS下的实时性保障。建议社区贡献者共同维护一套轻量级的FreeRTOS_BLE_Adapter层，以降低移植门槛，让国产芯片的生态更加繁荣。