BT_蓝牙电话数据包分析_拨打电话

dupz11192023-11-04 14:11

基于Android P版本分析

通话过程协议分析

上述过程中，描述的都是在非通话状态下的 AT+ 指令的状态信息，接下来我们对通话状态过程中涉及到的AT指令状态信息进行描述；

拨打电话 - AG

拨打电话大体分为拨号、响铃、通话这三个部分，状态变化后AG侧都会主动通知HF侧，HF侧再通过"AT+CLCC"获取详细的电话参数信息。

报告状态
+CIEV

用于报告事件状态；

yaml 复制代码 
Bluetooth HFP Profile
    [Role: AG - Audio Gate (1)]
    AT Stream: \r\n+CIEV: 2,2\r\n
    Command 0: +CIEV
        Command: +CIEV (Indicator Events Reporting)
        Type: Response (0x003a)
        Parameters
            Indicator Index: 2
            Indicator 2: 2

+CIEV: ,

  • ：Indicator，该值对应了AT+CIND指令的中index，例如

    • 1：call
    • 2：callsetup
    • 3：service
    • 4：signal
    • 5：roam
    • 6：battchg
    • 7：callheld

  • ：指定的就是Indicator指示对应的value值；

    • 例如，call = 1

      • 0： 没有电话在进行中
      • 1：至少有一个电话在进行中

Indicator参数常见的几种配置：

  • +CIEV:1,1：接听电话
  • +CIEV:2,0：当前没有等待的电话需要处理
  • +CIEV:2,2：拨打电话
  • +CIEV:2,3：已拨通

当前的状态为拨打电话状态；

选取编码方式
+BCS & AT+BCS
yaml 复制代码 
Bluetooth HFP Profile
    [Role: AG - Audio Gate (1)]
    AT Stream: \r\n+BCS: 2\r\n
    Command 0: +BCS
        Command: +BCS (Bluetooth Codec Selection)
        Type: Response (0x003a)
        Parameters
            Codec: mSBC (2)

当前选用的编解码器为mSBC，AT+BAC指令用于获取蓝牙可用编解码器，而对应的AT+BCS指令用于指定使用哪种编解码器；

yaml 复制代码 
Bluetooth HFP Profile
    [Role: HS - Headset (2)]
    AT Stream: AT+BCS=2\r
    Command 0: +BCS
        Command Line Prefix: AT
        Command: +BCS (Bluetooth Codec Selection)
        Type: Action Command (0x003d)
        Parameters
            Codec: mSBC (2)

然后返回对应的OK Response；

拨号
AT+CLCC & +CLCC
yaml 复制代码 
Bluetooth HFP Profile
    [Role: HS - Headset (2)]
    AT Stream: AT+CLCC\r
    Command 0: +CLCC
        Command Line Prefix: AT
        Command: +CLCC (Current Calls)
        Type: Action Command (0x000d)
        Parameters: No
yaml 复制代码 
Bluetooth HFP Profile
    [Role: AG - Audio Gate (1)]
    AT Stream: \r\n+CLCC: 1,0,2,0,0,"03511008611",129\r\n
    Command 0: +CLCC
        Command: +CLCC (Current Calls)
        Type: Response (0x003a)
        Parameters
            ID: 1
            Direction: Mobile Originated (0)
            State: Dialing (2)
            Mode: Voice (0)
            Mpty: Call is not one of multiparty (conference) call parties (0)
            Number: "03511008611"
            Type: The phone number format may be a national or international format, and may contain prefix and/or escape digits. No changes on the number presentation are required. (129)

拨号状态下，State = 2，Dialing；

对应上层回调信息：

ruby 复制代码 
01-01 00:03:27.361  1655  1758 D NativeInterface: onCallSetup: addr [B@5e15405 device30:AA:E4:42:C7:DD
01-01 00:03:27.361  1655  1758 D NativeInterface: onCallSetup: address [B@5e15405 event StackEvent {type:EVENT_TYPE_CALLSETUP, value1:2, value2:0, value3:0, value4:0, string: "null", device:30:AA:E4:42:C7:DD}

然后返回对应的OK Response；

同步连接请求
yaml 复制代码 
Frame 630: 67 bytes on wire (536 bits), 67 bytes captured (536 bits)
Bluetooth
    [Source: host]
    [Destination: controller]
Bluetooth HCI H4
    [Direction: Sent (0x00)]
    HCI Packet Type: HCI Command (0x01)
Bluetooth HCI Command - Enhanced Accept Synchronous Connection Request
    Command Opcode: Enhanced Accept Synchronous Connection Request (0x043e)
        0000 01.. .... .... = Opcode Group Field: Link Control Commands (0x01)
        .... ..00 0011 1110 = Opcode Command Field: Enhanced Accept Synchronous Connection Request (0x03e)
    Parameter Total Length: 63
    BD_ADDR: HuaweiDe_42:c7:dd (30:aa:e4:42:c7:dd)
    Tx Bandwidth (bytes/s): 8000
    Rx Bandwidth (bytes/s): 8000
    Transmit Coding Format
        Codec: mSBC (0x05)
        Company ID: Ericsson Technology Licensing (0x0000)
        Vendor Codec ID: 0x0000
    Receive Coding Format
        Codec: mSBC (0x05)
        Company ID: Ericsson Technology Licensing (0x0000)
        Vendor Codec ID: 0x0000
    Transmit Codec Frame Size: 60
    Receive Codec Frame Size: 60
    Input Bandwidth: 32000
    Output Bandwidth: 32000
    Input Coding Format
        Codec: Linear PCM (0x04)
        Company ID: Ericsson Technology Licensing (0x0000)
        Vendor Codec ID: 0x0000
    Output Coding Format
        Codec: Linear PCM (0x04)
        Company ID: Ericsson Technology Licensing (0x0000)
        Vendor Codec ID: 0x0000
    Input Coded Data Size: 16
    Output Coded Data Size: 16
    Input PCM Data Format: 2's complement (0x02)
    Output PCM Data Format: 2's complement (0x02)
    Input PCM Sample Payload MSB Position: 0
    Output PCM Sample Payload MSB Position: 0
    Input Data Path: Vendor Specific
    Output Data Path: Vendor Specific
    Input Transport Unit Size: 0
    Output Transport Unit Size: 0
    Max. Latency (ms): 13
    Packet Type: 0x0388, 3-EV5 may NOT be used, 2-EV5 may NOT be used, 3-EV3 may NOT be used, EV3 may be used
        0000 00.. .... .... = Reserved: 0x00
        .... ..1. .... .... = 3-EV5 may NOT be used: True
        .... ...1 .... .... = 2-EV5 may NOT be used: True
        .... .... 1... .... = 3-EV3 may NOT be used: True
        .... .... .0.. .... = 2-EV3 may NOT be used: False
        .... .... ..0. .... = EV5 may be used: False
        .... .... ...0 .... = EV4 may be used: False
        .... .... .... 1... = EV3 may be used: True
        .... .... .... .0.. = HV3 may be used: False
        .... .... .... ..0. = HV2 may be used: False
        .... .... .... ...0 = HV1 may be used: False
    Retransmission Effort: At least 1 retransmission, optimize for link quality (2)
    [Pending in frame: 631]
    [Command-Pending Delta: 3.244ms]
    [Response in frame: 632]
    [Command-Response Delta: 117.981ms]
  • Source：host，蓝牙协议层
  • Destination：蓝牙协议芯片
  • Direction：Sent（0x00）：类型 sent，对应的为Rcvd（0x01）
  • HCI Packet Type：HCI Command，这个类型是host和Controller通信使用的方式，对应的Controller向上回调给Host的方式为HCI Event；
  • BD_ADDR：AG侧蓝牙设备
  • Codec：mSBC（0x05），编解码器
  • Codec：Linear PCM (0x04)，音频格式
  • Command in frame: 630
  • Pending in frame：631
  • Response in frame：632
yaml 复制代码 
Frame 631: 7 bytes on wire (56 bits), 7 bytes captured (56 bits)
Bluetooth
    [Source: controller]
    [Destination: host]
Bluetooth HCI H4
    [Direction: Rcvd (0x01)]
    HCI Packet Type: HCI Event (0x04)
Bluetooth HCI Event - Command Status
    Event Code: Command Status (0x0f)
    Parameter Total Length: 4
    Status: Pending (0x00)
    Number of Allowed Command Packets: 1
    Command Opcode: Enhanced Accept Synchronous Connection Request (0x043e)
        0000 01.. .... .... = Opcode Group Field: Link Control Commands (0x01)
        .... ..00 0011 1110 = Opcode Command Field: Enhanced Accept Synchronous Connection Request (0x03e)
    [Command in frame: 630]
    [Response in frame: 632]
    [Command-Pending Delta: 3.244ms]
    [Pending-Response Delta: 114.737ms]
  • Direction：Rcvd (0x01)
  • Command in frame: 630
  • Response in frame：632
yaml 复制代码 
Frame 632: 20 bytes on wire (160 bits), 20 bytes captured (160 bits)
Bluetooth
    [Source: controller]
    [Destination: host]
Bluetooth HCI H4
    [Direction: Rcvd (0x01)]
    HCI Packet Type: HCI Event (0x04)
Bluetooth HCI Event - Synchronous Connection Complete
    Event Code: Synchronous Connection Complete (0x2c)
    Parameter Total Length: 17
    Status: Success (0x00)
    Connection Handle: 0x0003
    BD_ADDR: HuaweiDe_42:c7:dd (30:aa:e4:42:c7:dd)
    Link Type: eSCO connection (0x02)
    Transmit Interval: 12 slots (7.5 msec)
    Retransmit Window: 6 slots (3.75 msec)
    Rx Packet Length: 60
    Tx Packet Length: 60
    Air Mode: Unknown (5)
    [Command in frame: 630]
    [Pending in frame: 631]
    [Pending-Response Delta: 114.737ms]
    [Command-Response Delta: 117.981ms]
  • Link Type：eSCO connection (0x02)，eSCO通道已连接成功，因为我们选用的是mSBC编解码器，而mSBC编解码器只支持eSCO链路；

同步连接成功之后，底层会向上层回调onAudioStateChanged：

yaml 复制代码 
01-01 00:03:27.808  1655  1928 D bt_btif : bta_hf_client_sco_conn_cback: 0
01-01 00:03:27.808  1655  1928 I bt_btif : bta_sys_event: Event 0x1b0c
01-01 00:03:27.808  1655  1928 D bt_btif : bta_hf_client_hdl_event: BTA_HF_CLIENT_SCO_OPEN_EVT (0x1b0c)
01-01 00:03:27.808  1655  1928 I bt_btif : HF Client evt : State 2 (BTA_HF_CLIENT_OPEN_ST), Event 0x1b0c (BTA_HF_CLIENT_SCO_OPEN_EVT)
01-01 00:03:27.808  1655  1928 D bt_btif : bta_hf_client_sco_conn_open
01-01 00:03:27.808  1655  1928 D bt_btif : bta_hf_client_sco_event: before state: 2 event: 4
01-01 00:03:27.808  1655  1928 D bt_btif : bta_hf_client_sco_event: after state: 4
01-01 00:03:27.808  1655  1928 D bt_btif : bta_dm_pm_cback: st(4), id(27), app(1)
01-01 00:03:27.808  1655  1928 D bt_btif : bta_dm_pm_stop_timer: 
01-01 00:03:27.808  1655  1928 D bt_btif : bta_dm_pm_cback bta_dm_pm_stop_timer for current service, restart other service timers: count = 3
01-01 00:03:27.808  1655  1928 D bt_btm  : btm_bda_to_acl found
01-01 00:03:27.808  1655  1928 D bt_btm  : BTM_ReadRemoteFeatures
01-01 00:03:27.808  1655  1928 D bt_btif : bta_dm_pm_cback: SCO inactive, reset SSR to zero
01-01 00:03:27.808  1655  1928 D bt_btif : bta_dm_pm_set_mode: srvcsid: 18, state: 0, j: 5
01-01 00:03:27.808  1655  1928 D bt_btif : bta_dm_pm_set_mode: srvcsid: 27, state: 4, j: 21
01-01 00:03:27.808  1655  1928 D bt_btif : bta_dm_pm_set_mode: srvcsid: 26, state: 6, j: 16
01-01 00:03:27.808  1655  1928 D bt_btif : bta_dm_pm_set_mode dm_pm_timer:0, 7000 ms
01-01 00:03:27.808  1655  1928 D bt_btif : bta_dm_pm_set_mode dm_pm_timer:1, 7000 ms
01-01 00:03:27.808  1655  1928 D bt_btif : bta_dm_pm_set_mode dm_pm_timer:2, 7000 ms
01-01 00:03:27.808  1655  1928 D bt_btif : bta_dm_pm_set_mode dm_pm_timer:3, 7000 ms
01-01 00:03:27.808  1655  1928 D bt_btif : bta_dm_pm_set_mode dm_pm_timer:4, 7000 ms
01-01 00:03:27.808  1655  1928 D bt_btif : bta_dm_pm_set_mode dm_pm_timer:5, 7000 ms
01-01 00:03:27.808  1655  1928 D bt_btif : bta_dm_pm_set_mode dm_pm_timer:6, 7000 ms
01-01 00:03:27.808  1655  1928 D bt_btif : btif_transfer_context event 6, len 52
01-01 00:03:27.809  1655  1758 D bt_btif : btif task fetched event a001
01-01 00:03:27.809  1655  1758 D bt_btif : btif_context_switched
01-01 00:03:27.809  1655  1758 D bt_btif : btif_hf_client_upstreams_evt: event=BTA_HF_CLIENT_AUDIO_MSBC_OPEN_EVT (6)
01-01 00:03:27.809  1655  1758 I bt_btif : btif_hf_client_upstreams_evt: HAL bt_hf_client_callbacks->audio_state_cb
01-01 00:03:27.810  1655  1758 D NativeInterface: onAudioStateChanged: address [B@ed64403 event StackEvent {type:EVENT_TYPE_AUDIO_STATE_CHANGED, value1:3, value2:0, value3:0, value4:0, string: "null", device:30:AA:E4:42:C7:DD}

表明当前Audio Channel已开启，上层可以根据Audio State执行一些相应的逻辑；

响铃
+CIEV
yaml 复制代码 
Bluetooth HFP Profile
    [Role: AG - Audio Gate (1)]
    AT Stream: \r\n+CIEV: 2,3\r\n
    Command 0: +CIEV
        Command: +CIEV (Indicator Events Reporting)
        Type: Response (0x003a)
        Parameters
            Indicator Index: 2
            Indicator 2: 3

callsetup = 3，代表了呼叫的对方正在响铃，对应实际场景为：03511008611号码正在响铃中；

AT+CLCC & +CLCC
yaml 复制代码 
Bluetooth HFP Profile
    [Role: HS - Headset (2)]
    AT Stream: AT+CLCC\r
    Command 0: +CLCC
        Command Line Prefix: AT
        Command: +CLCC (Current Calls)
        Type: Action Command (0x000d)
        Parameters: No
yaml 复制代码 
Bluetooth HFP Profile
    [Role: AG - Audio Gate (1)]
    AT Stream: \r\n+CLCC: 1,0,3,0,0,"03511008611",129\r\n
    Command 0: +CLCC
        Command: +CLCC (Current Calls)
        Type: Response (0x003a)
        Parameters
            ID: 1
            Direction: Mobile Originated (0)
            State: Alerting (3)
            Mode: Voice (0)
            Mpty: Call is not one of multiparty (conference) call parties (0)
            Number: "03511008611"
            Type: The phone number format may be a national or international format, and may contain prefix and/or escape digits. No changes on the number presentation are required. (129)

拨号状态下，State = 3，Alerting；

然后返回对应的OK Response；

通话
+CIEV
yaml 复制代码 
Bluetooth HFP Profile
    [Role: AG - Audio Gate (1)]
    AT Stream: \r\n+CIEV: 1,1\r\n
    Command 0: +CIEV
        Command: +CIEV (Indicator Events Reporting)
        Type: Response (0x003a)
        Parameters
            Indicator Index: 1
            Indicator 1: 1

call = 1，代表了至少有一个正在通话中，对应实际场景为：03511008611号码已拨通；

+CIEV
yaml 复制代码 
Bluetooth HFP Profile
    [Role: AG - Audio Gate (1)]
    AT Stream: \r\n+CIEV: 2,0\r\n
    Command 0: +CIEV
        Command: +CIEV (Indicator Events Reporting)
        Type: Response (0x003a)
        Parameters
            Indicator Index: 2
            Indicator 2: 0

callsetup = 0，代表当前没在呼叫，对应实际场景为：03511008611号码已拨通，呼叫状态变为了已拨通状态；

AT+CLCC & +CLCC
yaml 复制代码 
Bluetooth HFP Profile
    [Role: HS - Headset (2)]
    AT Stream: AT+CLCC\r
    Command 0: +CLCC
        Command Line Prefix: AT
        Command: +CLCC (Current Calls)
        Type: Action Command (0x000d)
        Parameters: No
yaml 复制代码 
Bluetooth HFP Profile
    [Role: AG - Audio Gate (1)]
    AT Stream: \r\n+CLCC: 1,0,0,0,0,"03511008611",129\r\n
    Command 0: +CLCC
        Command: +CLCC (Current Calls)
        Type: Response (0x003a)
        Parameters
            ID: 1
            Direction: Mobile Originated (0)
            State: Active (0)
            Mode: Voice (0)
            Mpty: Call is not one of multiparty (conference) call parties (0)
            Number: "03511008611"
            Type: The phone number format may be a national or international format, and may contain prefix and/or escape digits. No changes on the number presentation are required. (129)

拨号状态下，State = 3，Alerting；

然后返回对应的OK Response；

拨打电话 - HF

HF侧的拨打电话和AG侧比较起来就多了一个步骤，通过AT命令"ATD"将需要拨打的电话信息发送到AG侧，然后通过手机的电话模块呼出电话；

推送号码

ATDddd..dd：标准AT命令，用于HF侧发送拨打电话号码至AG侧；

yaml 复制代码 
Bluetooth HFP Profile
    [Role: HS - Headset (2)]
    AT Stream: ATD03511008611;\r
    Command 0: D
        Command Line Prefix: AT
        Command: D (Dial)
        [Expert Info (Warning/Protocol): Non mandatory type or command in this role]
            [Non mandatory type or command in this role]
            [Severity level: Warning]
            [Group: Protocol]
        Parameters: No

对应的Response为OK；

相关推荐
axban2 小时前
QT M/V架构开发实战：QFileSystemModel介绍
开发语言·qt·架构
是罐装可乐2 小时前
深入理解 Vue3 Router：三种路由模式的工作原理与实战应用
架构·vue·路由·history·hash·ssr·router
爱睡觉的圈圈4 小时前
分布式IP代理集群架构与智能调度系统
分布式·tcp/ip·架构
sun0077006 小时前
android ndk编译valgrind
android
APItesterCris7 小时前
构建分布式京东商品数据采集系统：基于 API 的微服务实现方案
分布式·微服务·架构
AI视觉网奇7 小时前
android studio 断点无效
android·ide·android studio
jiaxi的天空7 小时前
android studio gradle 访问不了
android·ide·android studio
程序员在线炒粉8元1份顺丰包邮送可乐7 小时前
Docker 部署生产环境可用的 MySQL 主从架构
mysql·docker·架构
No Silver Bullet8 小时前
android组包时会把从maven私服获取的包下载到本地吗
android
catchadmin8 小时前
PHP serialize 序列化完全指南
android·开发语言·php
热门推荐
01UV安装并设置国内源02conda中设置镜像地址（附所有可换的地址）03GitHub 镜像站点04KGG转MP3工具|非KGM文件|解密音频05A股预测还能更准？开源大模型Kronos带你跑通预测+回测全流程06UV 工具安装与国内镜像源配置指南07突破百度网盘的下载限速，两种方法教会你【超详细】0846个Nano-banana 精选提示词，持续更新中09Spec-Kit 使用指南10保姆级教程：手把手教你用Dify实现完美多轮对话（附Chatflow和提示词）