CC2340R5: CC2340R5 Custom BLE PHY: How to transmit raw/custom BLE advertising PDUs without BLE stack using prop_rf/rfPacketTx?

Qingtian Yang

Part Number: CC2340R5
Other Parts Discussed in Thread: SYSCONFIG

Hi,

I am trying to use the CC2340R5 with the LP_EM_CC2340R5/prop_rf/rfPacketTx example as a starting point.

My goal is:

Use the Custom RF stack configuration with BLE PHY selected (Generic 1 Mbps / 2 Mbps / Coded)
Transmit a fixed custom BLE advertising PDU
Do not use the full BLE stack (GAP/GATT/LL)
Later switch dynamically between BLE PHY and other PHYs for a multi-protocol application

Currently I can run with the prop_rf example, but I cannot make a valid BLE advertising packet that can be detected by a phone or nRF Connect.

I would like to understand:

When using Custom -> BLE PHY in SysConfig, does the radio automatically handle:
- BLE Access Address (0x8E89BED6)
- CRC24
- Data whitening
- BLE bit ordering
Is it sufficient to provide only the BLE advertising PDU payload:
- Header
- AdvA
- AdvData

or do I need to manually construct the full BLE over-the-air packet?

Does the rfPacketTx example use a proprietary packet formatter that prepends packet length or uses a non-BLE packet structure?
Is there an official example for transmitting raw/custom BLE advertising packets without using the BLE stack?

My current intention is to transmit only on advertising channel 37 (2402 MHz) first.

Thank you.

8 天前

0 Lydia 8 天前

TI__Mastermind 45785 points

Hello, we have received your case and the investigation will take some time. Thank you for your patience.

0 Qingtian Yang 8 天前

Prodigy 60 points

static void ble_build_adv_pdu(void)
{
  // --- PDU Header ---
  ble_pdu_raw[0] = 0x42;  // ADV_NONCONN_IND (0x02) | TxAdd=1 (0x40)
  ble_pdu_raw[1] = 15;    // Length: 6 (AdvA) + 3 (Flags) + 6 (Name) = 15

  // --- AdvA: Random Static Address CC:66:55:44:33:22 (LSByte first) ---
  ble_pdu_raw[2] = 0x22;
  ble_pdu_raw[3] = 0x33;
  ble_pdu_raw[4] = 0x44;
  ble_pdu_raw[5] = 0x55;
  ble_pdu_raw[6] = 0x66;
  ble_pdu_raw[7] =
    0xCC;  // MSByte: bits 7:6 = '11' (Random Static).You can edit any byte of address except this bits 7:6!

  // --- AD Structure 1: Flags ---
  ble_pdu_raw[8]  = 0x02;  // AD Length
  ble_pdu_raw[9]  = 0x01;  // AD Type: Flags
  ble_pdu_raw[10] = 0x06;  // LE General Discoverable | BR/EDR Not Supported

  // --- AD Structure 2: Complete Local Name "FG22" ---
  ble_pdu_raw[11] = 0x05;  // AD Length
  ble_pdu_raw[12] = 0x09;  // AD Type: Complete Local Name


  ble_pdu_raw[13] = '2';
  ble_pdu_raw[14] = '3';
  ble_pdu_raw[15] = '4';
  ble_pdu_raw[16] = '0';

  memcpy(ble_pdu_send+1,ble_pdu_raw,17);
  
  ble_pdu_send[0]=17;

}

/***** Callback Functions *****/
void defaultCallback(RCL_Command *cmd, LRF_Events lrfEvents, RCL_Events rclEvents)
{
    if (rclEvents.lastCmdDone)
    {
        gCmdDone += 1;

        GPIO_toggle(CONFIG_GPIO_GLED);
    }
}

/***** Function definitions *****/

void *mainThread(void *arg0)
{
    /* Initialize and open RCL */
    RCL_init();

    RCL_Handle rclHandle = RCL_open(&rclClient, &LRF_config);

    /* Set RF frequency */
    rclPacketTxCmdGenericTx.rfFrequency = FREQUENCY;

    /* Start command as soon as possible */
    rclPacketTxCmdGenericTx.common.scheduling = RCL_Schedule_Now;
    rclPacketTxCmdGenericTx.common.status = RCL_CommandStatus_Idle;

    rclPacketTxCmdGenericTx.config.fsOff = FS_OFF; // Turn off FS

    /* Callback triggers on last command done */
    rclPacketTxCmdGenericTx.common.runtime.callback = defaultCallback;
    rclPacketTxCmdGenericTx.common.runtime.rclCallbackMask.value = RCL_EventLastCmdDone.value;

    /* Set RCL TX buffer packet to be packet buffer */
    RCL_Buffer_TxBuffer *txPacket = (RCL_Buffer_TxBuffer *)&packet;

    GPIO_setConfig(CONFIG_GPIO_GLED, GPIO_CFG_OUT_STD | GPIO_CFG_OUT_LOW);
    GPIO_write(CONFIG_GPIO_GLED, CONFIG_GPIO_LED_OFF);

    ble_build_adv_pdu();

    while(1)
    {
        /* Create packet with random payload */
        uint8_t *txData;
        txData = RCL_TxBuffer_init(txPacket, NUM_PAD_BYTES, HDR_LEN, MAX_LENGTH);

        /* Zero out data in header before the length field */
        // for (int s = 0; s < LEN_INDEX; s++)
        // {
        //     txData[s] = 0U;
        // }

        /* Set the packet length */
        // txData[LEN_INDEX] = ble_pdu_send[0];

        memcpy(txData, ble_pdu_send, 17+1);

        /* Generate a random payload */
        // for (int i = HDR_LEN; i < MAX_LENGTH; i++)
        // {
        //     txData[i] = rand();
        // }

        /* Set packet to transmit */
        RCL_TxBuffer_put(&rclPacketTxCmdGenericTx.txBuffers, txPacket);

        rclPacketTxCmdGenericTx.common.status = RCL_CommandStatus_Idle;

        /* Submit command */
        RCL_Command_submit(rclHandle, &rclPacketTxCmdGenericTx);

        /* Pend on command completion */
        RCL_Command_pend(&rclPacketTxCmdGenericTx);

        usleep(PACKET_INTERVAL);
    }
}

This is part of my test code, based on the original rfPacketTx example. I only made some simple packet construction changes and modified:

#define FREQUENCY (2402000000U) // set to BLE channel 37

I hope this helps clarify the issue I am trying to understand.

0 Ryan Brown1 7 天前

TI__Prodigy 40 points

你好，

您应该查阅RCL API 指南中的BLE 命令处理程序（例如广播命令处理程序）和BLE5 文件参考。请注意，这需要使用自定义的 ti_radio_config.c/h 文件，因为 SysConfig 目前不支持自定义使用这些 RCL 命令。本质上，rfPacketTx 使用 BLE PHY，但并未公开所有 RCL 命令。您需要进一步研究文档，并尝试调整项目配置及其广播数据包结构，才能获得预期的输出。

问候，
瑞安

0 Qingtian Yang 2 天前回复 Ryan Brown1

Prodigy 60 points

您好：

我已经能够成功发出了ble的广播包了，但是我的sniffer提示我：crc错误，但payload完整无误。但是我找不到在sysconfig当中设置他的地方，这些配置都被隐藏了吗。另外我使用的simplelink-lowpower-f3-sdk 8.10，我使用类似的代码在SDK 9.20上面是正确的，我找不到调试的方向，能否提供关于sysconfig配置Generic BLE的更多信息

0 Tarek D 22 小时前

Prodigy 10 points

你好，

您如何验证有效载荷是否完整？

此致，

塔雷克·D

其他无线技术

其他无线技术论坛

CC2340R5: CC2340R5 Custom BLE PHY: How to transmit raw/custom BLE advertising PDUs without BLE stack using prop_rf/rfPacketTx?