BT_蓝牙电话数据包分析_拨打电话

dupz11192023-11-04 14:11

基于Android P版本分析

通话过程协议分析

上述过程中，描述的都是在非通话状态下的 AT+ 指令的状态信息，接下来我们对通话状态过程中涉及到的AT指令状态信息进行描述；

拨打电话 - AG

拨打电话大体分为拨号、响铃、通话这三个部分，状态变化后AG侧都会主动通知HF侧，HF侧再通过"AT+CLCC"获取详细的电话参数信息。

报告状态
+CIEV

用于报告事件状态；

yaml 复制代码 
Bluetooth HFP Profile
    [Role: AG - Audio Gate (1)]
    AT Stream: \r\n+CIEV: 2,2\r\n
    Command 0: +CIEV
        Command: +CIEV (Indicator Events Reporting)
        Type: Response (0x003a)
        Parameters
            Indicator Index: 2
            Indicator 2: 2

+CIEV: ,

  • ：Indicator，该值对应了AT+CIND指令的中index，例如

    • 1：call
    • 2：callsetup
    • 3：service
    • 4：signal
    • 5：roam
    • 6：battchg
    • 7：callheld

  • ：指定的就是Indicator指示对应的value值；

    • 例如，call = 1

      • 0： 没有电话在进行中
      • 1：至少有一个电话在进行中

Indicator参数常见的几种配置：

  • +CIEV:1,1：接听电话
  • +CIEV:2,0：当前没有等待的电话需要处理
  • +CIEV:2,2：拨打电话
  • +CIEV:2,3：已拨通

当前的状态为拨打电话状态；

选取编码方式
+BCS & AT+BCS
yaml 复制代码 
Bluetooth HFP Profile
    [Role: AG - Audio Gate (1)]
    AT Stream: \r\n+BCS: 2\r\n
    Command 0: +BCS
        Command: +BCS (Bluetooth Codec Selection)
        Type: Response (0x003a)
        Parameters
            Codec: mSBC (2)

当前选用的编解码器为mSBC，AT+BAC指令用于获取蓝牙可用编解码器，而对应的AT+BCS指令用于指定使用哪种编解码器；

yaml 复制代码 
Bluetooth HFP Profile
    [Role: HS - Headset (2)]
    AT Stream: AT+BCS=2\r
    Command 0: +BCS
        Command Line Prefix: AT
        Command: +BCS (Bluetooth Codec Selection)
        Type: Action Command (0x003d)
        Parameters
            Codec: mSBC (2)

然后返回对应的OK Response；

拨号
AT+CLCC & +CLCC
yaml 复制代码 
Bluetooth HFP Profile
    [Role: HS - Headset (2)]
    AT Stream: AT+CLCC\r
    Command 0: +CLCC
        Command Line Prefix: AT
        Command: +CLCC (Current Calls)
        Type: Action Command (0x000d)
        Parameters: No
yaml 复制代码 
Bluetooth HFP Profile
    [Role: AG - Audio Gate (1)]
    AT Stream: \r\n+CLCC: 1,0,2,0,0,"03511008611",129\r\n
    Command 0: +CLCC
        Command: +CLCC (Current Calls)
        Type: Response (0x003a)
        Parameters
            ID: 1
            Direction: Mobile Originated (0)
            State: Dialing (2)
            Mode: Voice (0)
            Mpty: Call is not one of multiparty (conference) call parties (0)
            Number: "03511008611"
            Type: The phone number format may be a national or international format, and may contain prefix and/or escape digits. No changes on the number presentation are required. (129)

拨号状态下，State = 2，Dialing；

对应上层回调信息：

ruby 复制代码 
01-01 00:03:27.361  1655  1758 D NativeInterface: onCallSetup: addr [B@5e15405 device30:AA:E4:42:C7:DD
01-01 00:03:27.361  1655  1758 D NativeInterface: onCallSetup: address [B@5e15405 event StackEvent {type:EVENT_TYPE_CALLSETUP, value1:2, value2:0, value3:0, value4:0, string: "null", device:30:AA:E4:42:C7:DD}

然后返回对应的OK Response；

同步连接请求
yaml 复制代码 
Frame 630: 67 bytes on wire (536 bits), 67 bytes captured (536 bits)
Bluetooth
    [Source: host]
    [Destination: controller]
Bluetooth HCI H4
    [Direction: Sent (0x00)]
    HCI Packet Type: HCI Command (0x01)
Bluetooth HCI Command - Enhanced Accept Synchronous Connection Request
    Command Opcode: Enhanced Accept Synchronous Connection Request (0x043e)
        0000 01.. .... .... = Opcode Group Field: Link Control Commands (0x01)
        .... ..00 0011 1110 = Opcode Command Field: Enhanced Accept Synchronous Connection Request (0x03e)
    Parameter Total Length: 63
    BD_ADDR: HuaweiDe_42:c7:dd (30:aa:e4:42:c7:dd)
    Tx Bandwidth (bytes/s): 8000
    Rx Bandwidth (bytes/s): 8000
    Transmit Coding Format
        Codec: mSBC (0x05)
        Company ID: Ericsson Technology Licensing (0x0000)
        Vendor Codec ID: 0x0000
    Receive Coding Format
        Codec: mSBC (0x05)
        Company ID: Ericsson Technology Licensing (0x0000)
        Vendor Codec ID: 0x0000
    Transmit Codec Frame Size: 60
    Receive Codec Frame Size: 60
    Input Bandwidth: 32000
    Output Bandwidth: 32000
    Input Coding Format
        Codec: Linear PCM (0x04)
        Company ID: Ericsson Technology Licensing (0x0000)
        Vendor Codec ID: 0x0000
    Output Coding Format
        Codec: Linear PCM (0x04)
        Company ID: Ericsson Technology Licensing (0x0000)
        Vendor Codec ID: 0x0000
    Input Coded Data Size: 16
    Output Coded Data Size: 16
    Input PCM Data Format: 2's complement (0x02)
    Output PCM Data Format: 2's complement (0x02)
    Input PCM Sample Payload MSB Position: 0
    Output PCM Sample Payload MSB Position: 0
    Input Data Path: Vendor Specific
    Output Data Path: Vendor Specific
    Input Transport Unit Size: 0
    Output Transport Unit Size: 0
    Max. Latency (ms): 13
    Packet Type: 0x0388, 3-EV5 may NOT be used, 2-EV5 may NOT be used, 3-EV3 may NOT be used, EV3 may be used
        0000 00.. .... .... = Reserved: 0x00
        .... ..1. .... .... = 3-EV5 may NOT be used: True
        .... ...1 .... .... = 2-EV5 may NOT be used: True
        .... .... 1... .... = 3-EV3 may NOT be used: True
        .... .... .0.. .... = 2-EV3 may NOT be used: False
        .... .... ..0. .... = EV5 may be used: False
        .... .... ...0 .... = EV4 may be used: False
        .... .... .... 1... = EV3 may be used: True
        .... .... .... .0.. = HV3 may be used: False
        .... .... .... ..0. = HV2 may be used: False
        .... .... .... ...0 = HV1 may be used: False
    Retransmission Effort: At least 1 retransmission, optimize for link quality (2)
    [Pending in frame: 631]
    [Command-Pending Delta: 3.244ms]
    [Response in frame: 632]
    [Command-Response Delta: 117.981ms]
  • Source：host，蓝牙协议层
  • Destination：蓝牙协议芯片
  • Direction：Sent（0x00）：类型 sent，对应的为Rcvd（0x01）
  • HCI Packet Type：HCI Command，这个类型是host和Controller通信使用的方式，对应的Controller向上回调给Host的方式为HCI Event；
  • BD_ADDR：AG侧蓝牙设备
  • Codec：mSBC（0x05），编解码器
  • Codec：Linear PCM (0x04)，音频格式
  • Command in frame: 630
  • Pending in frame：631
  • Response in frame：632
yaml 复制代码 
Frame 631: 7 bytes on wire (56 bits), 7 bytes captured (56 bits)
Bluetooth
    [Source: controller]
    [Destination: host]
Bluetooth HCI H4
    [Direction: Rcvd (0x01)]
    HCI Packet Type: HCI Event (0x04)
Bluetooth HCI Event - Command Status
    Event Code: Command Status (0x0f)
    Parameter Total Length: 4
    Status: Pending (0x00)
    Number of Allowed Command Packets: 1
    Command Opcode: Enhanced Accept Synchronous Connection Request (0x043e)
        0000 01.. .... .... = Opcode Group Field: Link Control Commands (0x01)
        .... ..00 0011 1110 = Opcode Command Field: Enhanced Accept Synchronous Connection Request (0x03e)
    [Command in frame: 630]
    [Response in frame: 632]
    [Command-Pending Delta: 3.244ms]
    [Pending-Response Delta: 114.737ms]
  • Direction：Rcvd (0x01)
  • Command in frame: 630
  • Response in frame：632
yaml 复制代码 
Frame 632: 20 bytes on wire (160 bits), 20 bytes captured (160 bits)
Bluetooth
    [Source: controller]
    [Destination: host]
Bluetooth HCI H4
    [Direction: Rcvd (0x01)]
    HCI Packet Type: HCI Event (0x04)
Bluetooth HCI Event - Synchronous Connection Complete
    Event Code: Synchronous Connection Complete (0x2c)
    Parameter Total Length: 17
    Status: Success (0x00)
    Connection Handle: 0x0003
    BD_ADDR: HuaweiDe_42:c7:dd (30:aa:e4:42:c7:dd)
    Link Type: eSCO connection (0x02)
    Transmit Interval: 12 slots (7.5 msec)
    Retransmit Window: 6 slots (3.75 msec)
    Rx Packet Length: 60
    Tx Packet Length: 60
    Air Mode: Unknown (5)
    [Command in frame: 630]
    [Pending in frame: 631]
    [Pending-Response Delta: 114.737ms]
    [Command-Response Delta: 117.981ms]
  • Link Type：eSCO connection (0x02)，eSCO通道已连接成功，因为我们选用的是mSBC编解码器，而mSBC编解码器只支持eSCO链路；

同步连接成功之后，底层会向上层回调onAudioStateChanged：

yaml 复制代码 
01-01 00:03:27.808  1655  1928 D bt_btif : bta_hf_client_sco_conn_cback: 0
01-01 00:03:27.808  1655  1928 I bt_btif : bta_sys_event: Event 0x1b0c
01-01 00:03:27.808  1655  1928 D bt_btif : bta_hf_client_hdl_event: BTA_HF_CLIENT_SCO_OPEN_EVT (0x1b0c)
01-01 00:03:27.808  1655  1928 I bt_btif : HF Client evt : State 2 (BTA_HF_CLIENT_OPEN_ST), Event 0x1b0c (BTA_HF_CLIENT_SCO_OPEN_EVT)
01-01 00:03:27.808  1655  1928 D bt_btif : bta_hf_client_sco_conn_open
01-01 00:03:27.808  1655  1928 D bt_btif : bta_hf_client_sco_event: before state: 2 event: 4
01-01 00:03:27.808  1655  1928 D bt_btif : bta_hf_client_sco_event: after state: 4
01-01 00:03:27.808  1655  1928 D bt_btif : bta_dm_pm_cback: st(4), id(27), app(1)
01-01 00:03:27.808  1655  1928 D bt_btif : bta_dm_pm_stop_timer: 
01-01 00:03:27.808  1655  1928 D bt_btif : bta_dm_pm_cback bta_dm_pm_stop_timer for current service, restart other service timers: count = 3
01-01 00:03:27.808  1655  1928 D bt_btm  : btm_bda_to_acl found
01-01 00:03:27.808  1655  1928 D bt_btm  : BTM_ReadRemoteFeatures
01-01 00:03:27.808  1655  1928 D bt_btif : bta_dm_pm_cback: SCO inactive, reset SSR to zero
01-01 00:03:27.808  1655  1928 D bt_btif : bta_dm_pm_set_mode: srvcsid: 18, state: 0, j: 5
01-01 00:03:27.808  1655  1928 D bt_btif : bta_dm_pm_set_mode: srvcsid: 27, state: 4, j: 21
01-01 00:03:27.808  1655  1928 D bt_btif : bta_dm_pm_set_mode: srvcsid: 26, state: 6, j: 16
01-01 00:03:27.808  1655  1928 D bt_btif : bta_dm_pm_set_mode dm_pm_timer:0, 7000 ms
01-01 00:03:27.808  1655  1928 D bt_btif : bta_dm_pm_set_mode dm_pm_timer:1, 7000 ms
01-01 00:03:27.808  1655  1928 D bt_btif : bta_dm_pm_set_mode dm_pm_timer:2, 7000 ms
01-01 00:03:27.808  1655  1928 D bt_btif : bta_dm_pm_set_mode dm_pm_timer:3, 7000 ms
01-01 00:03:27.808  1655  1928 D bt_btif : bta_dm_pm_set_mode dm_pm_timer:4, 7000 ms
01-01 00:03:27.808  1655  1928 D bt_btif : bta_dm_pm_set_mode dm_pm_timer:5, 7000 ms
01-01 00:03:27.808  1655  1928 D bt_btif : bta_dm_pm_set_mode dm_pm_timer:6, 7000 ms
01-01 00:03:27.808  1655  1928 D bt_btif : btif_transfer_context event 6, len 52
01-01 00:03:27.809  1655  1758 D bt_btif : btif task fetched event a001
01-01 00:03:27.809  1655  1758 D bt_btif : btif_context_switched
01-01 00:03:27.809  1655  1758 D bt_btif : btif_hf_client_upstreams_evt: event=BTA_HF_CLIENT_AUDIO_MSBC_OPEN_EVT (6)
01-01 00:03:27.809  1655  1758 I bt_btif : btif_hf_client_upstreams_evt: HAL bt_hf_client_callbacks->audio_state_cb
01-01 00:03:27.810  1655  1758 D NativeInterface: onAudioStateChanged: address [B@ed64403 event StackEvent {type:EVENT_TYPE_AUDIO_STATE_CHANGED, value1:3, value2:0, value3:0, value4:0, string: "null", device:30:AA:E4:42:C7:DD}

表明当前Audio Channel已开启，上层可以根据Audio State执行一些相应的逻辑；

响铃
+CIEV
yaml 复制代码 
Bluetooth HFP Profile
    [Role: AG - Audio Gate (1)]
    AT Stream: \r\n+CIEV: 2,3\r\n
    Command 0: +CIEV
        Command: +CIEV (Indicator Events Reporting)
        Type: Response (0x003a)
        Parameters
            Indicator Index: 2
            Indicator 2: 3

callsetup = 3，代表了呼叫的对方正在响铃，对应实际场景为：03511008611号码正在响铃中；

AT+CLCC & +CLCC
yaml 复制代码 
Bluetooth HFP Profile
    [Role: HS - Headset (2)]
    AT Stream: AT+CLCC\r
    Command 0: +CLCC
        Command Line Prefix: AT
        Command: +CLCC (Current Calls)
        Type: Action Command (0x000d)
        Parameters: No
yaml 复制代码 
Bluetooth HFP Profile
    [Role: AG - Audio Gate (1)]
    AT Stream: \r\n+CLCC: 1,0,3,0,0,"03511008611",129\r\n
    Command 0: +CLCC
        Command: +CLCC (Current Calls)
        Type: Response (0x003a)
        Parameters
            ID: 1
            Direction: Mobile Originated (0)
            State: Alerting (3)
            Mode: Voice (0)
            Mpty: Call is not one of multiparty (conference) call parties (0)
            Number: "03511008611"
            Type: The phone number format may be a national or international format, and may contain prefix and/or escape digits. No changes on the number presentation are required. (129)

拨号状态下，State = 3，Alerting；

然后返回对应的OK Response；

通话
+CIEV
yaml 复制代码 
Bluetooth HFP Profile
    [Role: AG - Audio Gate (1)]
    AT Stream: \r\n+CIEV: 1,1\r\n
    Command 0: +CIEV
        Command: +CIEV (Indicator Events Reporting)
        Type: Response (0x003a)
        Parameters
            Indicator Index: 1
            Indicator 1: 1

call = 1，代表了至少有一个正在通话中，对应实际场景为：03511008611号码已拨通；

+CIEV
yaml 复制代码 
Bluetooth HFP Profile
    [Role: AG - Audio Gate (1)]
    AT Stream: \r\n+CIEV: 2,0\r\n
    Command 0: +CIEV
        Command: +CIEV (Indicator Events Reporting)
        Type: Response (0x003a)
        Parameters
            Indicator Index: 2
            Indicator 2: 0

callsetup = 0，代表当前没在呼叫，对应实际场景为：03511008611号码已拨通，呼叫状态变为了已拨通状态；

AT+CLCC & +CLCC
yaml 复制代码 
Bluetooth HFP Profile
    [Role: HS - Headset (2)]
    AT Stream: AT+CLCC\r
    Command 0: +CLCC
        Command Line Prefix: AT
        Command: +CLCC (Current Calls)
        Type: Action Command (0x000d)
        Parameters: No
yaml 复制代码 
Bluetooth HFP Profile
    [Role: AG - Audio Gate (1)]
    AT Stream: \r\n+CLCC: 1,0,0,0,0,"03511008611",129\r\n
    Command 0: +CLCC
        Command: +CLCC (Current Calls)
        Type: Response (0x003a)
        Parameters
            ID: 1
            Direction: Mobile Originated (0)
            State: Active (0)
            Mode: Voice (0)
            Mpty: Call is not one of multiparty (conference) call parties (0)
            Number: "03511008611"
            Type: The phone number format may be a national or international format, and may contain prefix and/or escape digits. No changes on the number presentation are required. (129)

拨号状态下，State = 3，Alerting；

然后返回对应的OK Response；

拨打电话 - HF

HF侧的拨打电话和AG侧比较起来就多了一个步骤，通过AT命令"ATD"将需要拨打的电话信息发送到AG侧，然后通过手机的电话模块呼出电话；

推送号码

ATDddd..dd：标准AT命令，用于HF侧发送拨打电话号码至AG侧；

yaml 复制代码 
Bluetooth HFP Profile
    [Role: HS - Headset (2)]
    AT Stream: ATD03511008611;\r
    Command 0: D
        Command Line Prefix: AT
        Command: D (Dial)
        [Expert Info (Warning/Protocol): Non mandatory type or command in this role]
            [Non mandatory type or command in this role]
            [Severity level: Warning]
            [Group: Protocol]
        Parameters: No

对应的Response为OK；

相关推荐
厦门德仔30 分钟前
【WPF】WPF(样式)
android·java·wpf
aqi001 小时前
FFmpeg开发笔记（七十二）Linux给FFmpeg集成MPEG-5视频编解码器EVC
android·ffmpeg·音视频·流媒体
Devil枫3 小时前
Kotlin高级特性深度解析
android·开发语言·kotlin
ChinaDragonDreamer3 小时前
Kotlin：2.1.20 的新特性
android·开发语言·kotlin
文火冰糖的硅基工坊4 小时前
[创业之路-458]：企业经营层 - 蓝海战略 - 重构价值曲线、整合产业要素、创造新需求
科技·重构·架构·创业·业务
小张是铁粉5 小时前
oracle的内存架构学习
数据库·学习·oracle·架构
小马爱打代码10 小时前
微服务外联Feign调用：第三方API调用的负载均衡与容灾实战
微服务·架构·负载均衡
雨白14 小时前
Jetpack系列(二)：Lifecycle与LiveData结合，打造响应式UI
android·android jetpack
9527华安14 小时前
FPGA实现40G网卡NIC，基于PCIE4C+40G/50G Ethernet subsystem架构，提供工程源码和技术支持
fpga开发·架构·网卡·ethernet·nic·40g·pcie4c
kk爱闹15 小时前
【挑战14天学完python和pytorch】- day01
android·pytorch·python
热门推荐
012024年 最新 iPhone手机 历代机型、屏幕尺寸、纵横比、分辨率 整理02Coze实战第13讲：飞书多维表格读取+豆包生图模型，轻松批量生成短剧封面03Coze扣子平台完整体验和实践（附国内和国际版对比）04Word粘贴时出现“运行时错误53,文件未找到：MathPage.WLL“的解决方案05手机电脑之间快速传输图片视频文件，不压缩画质、不限制大小的方法！06扣子（coze）实战|我用扣子搭建了一个自动分析小红薯笔记内容的AI应用|详细步骤拆解07MIUI显示/隐藏5G开关的方法，信号弱时开启手机Wifi通话方法08华为昇腾 910B 部署 DeepSeek-R1 蒸馏系列模型详细指南09DeepSeek各版本说明与优缺点分析10django中用 InforSuite RDS 替代memcache