BT_蓝牙电话数据包分析_拨打电话

dupz11192023-11-04 14:11

基于Android P版本分析

通话过程协议分析

上述过程中，描述的都是在非通话状态下的 AT+ 指令的状态信息，接下来我们对通话状态过程中涉及到的AT指令状态信息进行描述；

拨打电话 - AG

拨打电话大体分为拨号、响铃、通话这三个部分，状态变化后AG侧都会主动通知HF侧，HF侧再通过"AT+CLCC"获取详细的电话参数信息。

报告状态
+CIEV

用于报告事件状态；

yaml 复制代码 
Bluetooth HFP Profile
    [Role: AG - Audio Gate (1)]
    AT Stream: \r\n+CIEV: 2,2\r\n
    Command 0: +CIEV
        Command: +CIEV (Indicator Events Reporting)
        Type: Response (0x003a)
        Parameters
            Indicator Index: 2
            Indicator 2: 2

+CIEV: ,

  • ：Indicator，该值对应了AT+CIND指令的中index，例如

    • 1：call
    • 2：callsetup
    • 3：service
    • 4：signal
    • 5：roam
    • 6：battchg
    • 7：callheld

  • ：指定的就是Indicator指示对应的value值；

    • 例如，call = 1

      • 0： 没有电话在进行中
      • 1：至少有一个电话在进行中

Indicator参数常见的几种配置：

  • +CIEV:1,1：接听电话
  • +CIEV:2,0：当前没有等待的电话需要处理
  • +CIEV:2,2：拨打电话
  • +CIEV:2,3：已拨通

当前的状态为拨打电话状态；

选取编码方式
+BCS & AT+BCS
yaml 复制代码 
Bluetooth HFP Profile
    [Role: AG - Audio Gate (1)]
    AT Stream: \r\n+BCS: 2\r\n
    Command 0: +BCS
        Command: +BCS (Bluetooth Codec Selection)
        Type: Response (0x003a)
        Parameters
            Codec: mSBC (2)

当前选用的编解码器为mSBC，AT+BAC指令用于获取蓝牙可用编解码器，而对应的AT+BCS指令用于指定使用哪种编解码器；

yaml 复制代码 
Bluetooth HFP Profile
    [Role: HS - Headset (2)]
    AT Stream: AT+BCS=2\r
    Command 0: +BCS
        Command Line Prefix: AT
        Command: +BCS (Bluetooth Codec Selection)
        Type: Action Command (0x003d)
        Parameters
            Codec: mSBC (2)

然后返回对应的OK Response；

拨号
AT+CLCC & +CLCC
yaml 复制代码 
Bluetooth HFP Profile
    [Role: HS - Headset (2)]
    AT Stream: AT+CLCC\r
    Command 0: +CLCC
        Command Line Prefix: AT
        Command: +CLCC (Current Calls)
        Type: Action Command (0x000d)
        Parameters: No
yaml 复制代码 
Bluetooth HFP Profile
    [Role: AG - Audio Gate (1)]
    AT Stream: \r\n+CLCC: 1,0,2,0,0,"03511008611",129\r\n
    Command 0: +CLCC
        Command: +CLCC (Current Calls)
        Type: Response (0x003a)
        Parameters
            ID: 1
            Direction: Mobile Originated (0)
            State: Dialing (2)
            Mode: Voice (0)
            Mpty: Call is not one of multiparty (conference) call parties (0)
            Number: "03511008611"
            Type: The phone number format may be a national or international format, and may contain prefix and/or escape digits. No changes on the number presentation are required. (129)

拨号状态下，State = 2，Dialing；

对应上层回调信息：

ruby 复制代码 
01-01 00:03:27.361  1655  1758 D NativeInterface: onCallSetup: addr [B@5e15405 device30:AA:E4:42:C7:DD
01-01 00:03:27.361  1655  1758 D NativeInterface: onCallSetup: address [B@5e15405 event StackEvent {type:EVENT_TYPE_CALLSETUP, value1:2, value2:0, value3:0, value4:0, string: "null", device:30:AA:E4:42:C7:DD}

然后返回对应的OK Response；

同步连接请求
yaml 复制代码 
Frame 630: 67 bytes on wire (536 bits), 67 bytes captured (536 bits)
Bluetooth
    [Source: host]
    [Destination: controller]
Bluetooth HCI H4
    [Direction: Sent (0x00)]
    HCI Packet Type: HCI Command (0x01)
Bluetooth HCI Command - Enhanced Accept Synchronous Connection Request
    Command Opcode: Enhanced Accept Synchronous Connection Request (0x043e)
        0000 01.. .... .... = Opcode Group Field: Link Control Commands (0x01)
        .... ..00 0011 1110 = Opcode Command Field: Enhanced Accept Synchronous Connection Request (0x03e)
    Parameter Total Length: 63
    BD_ADDR: HuaweiDe_42:c7:dd (30:aa:e4:42:c7:dd)
    Tx Bandwidth (bytes/s): 8000
    Rx Bandwidth (bytes/s): 8000
    Transmit Coding Format
        Codec: mSBC (0x05)
        Company ID: Ericsson Technology Licensing (0x0000)
        Vendor Codec ID: 0x0000
    Receive Coding Format
        Codec: mSBC (0x05)
        Company ID: Ericsson Technology Licensing (0x0000)
        Vendor Codec ID: 0x0000
    Transmit Codec Frame Size: 60
    Receive Codec Frame Size: 60
    Input Bandwidth: 32000
    Output Bandwidth: 32000
    Input Coding Format
        Codec: Linear PCM (0x04)
        Company ID: Ericsson Technology Licensing (0x0000)
        Vendor Codec ID: 0x0000
    Output Coding Format
        Codec: Linear PCM (0x04)
        Company ID: Ericsson Technology Licensing (0x0000)
        Vendor Codec ID: 0x0000
    Input Coded Data Size: 16
    Output Coded Data Size: 16
    Input PCM Data Format: 2's complement (0x02)
    Output PCM Data Format: 2's complement (0x02)
    Input PCM Sample Payload MSB Position: 0
    Output PCM Sample Payload MSB Position: 0
    Input Data Path: Vendor Specific
    Output Data Path: Vendor Specific
    Input Transport Unit Size: 0
    Output Transport Unit Size: 0
    Max. Latency (ms): 13
    Packet Type: 0x0388, 3-EV5 may NOT be used, 2-EV5 may NOT be used, 3-EV3 may NOT be used, EV3 may be used
        0000 00.. .... .... = Reserved: 0x00
        .... ..1. .... .... = 3-EV5 may NOT be used: True
        .... ...1 .... .... = 2-EV5 may NOT be used: True
        .... .... 1... .... = 3-EV3 may NOT be used: True
        .... .... .0.. .... = 2-EV3 may NOT be used: False
        .... .... ..0. .... = EV5 may be used: False
        .... .... ...0 .... = EV4 may be used: False
        .... .... .... 1... = EV3 may be used: True
        .... .... .... .0.. = HV3 may be used: False
        .... .... .... ..0. = HV2 may be used: False
        .... .... .... ...0 = HV1 may be used: False
    Retransmission Effort: At least 1 retransmission, optimize for link quality (2)
    [Pending in frame: 631]
    [Command-Pending Delta: 3.244ms]
    [Response in frame: 632]
    [Command-Response Delta: 117.981ms]
  • Source：host，蓝牙协议层
  • Destination：蓝牙协议芯片
  • Direction：Sent（0x00）：类型 sent，对应的为Rcvd（0x01）
  • HCI Packet Type：HCI Command，这个类型是host和Controller通信使用的方式，对应的Controller向上回调给Host的方式为HCI Event；
  • BD_ADDR：AG侧蓝牙设备
  • Codec：mSBC（0x05），编解码器
  • Codec：Linear PCM (0x04)，音频格式
  • Command in frame: 630
  • Pending in frame：631
  • Response in frame：632
yaml 复制代码 
Frame 631: 7 bytes on wire (56 bits), 7 bytes captured (56 bits)
Bluetooth
    [Source: controller]
    [Destination: host]
Bluetooth HCI H4
    [Direction: Rcvd (0x01)]
    HCI Packet Type: HCI Event (0x04)
Bluetooth HCI Event - Command Status
    Event Code: Command Status (0x0f)
    Parameter Total Length: 4
    Status: Pending (0x00)
    Number of Allowed Command Packets: 1
    Command Opcode: Enhanced Accept Synchronous Connection Request (0x043e)
        0000 01.. .... .... = Opcode Group Field: Link Control Commands (0x01)
        .... ..00 0011 1110 = Opcode Command Field: Enhanced Accept Synchronous Connection Request (0x03e)
    [Command in frame: 630]
    [Response in frame: 632]
    [Command-Pending Delta: 3.244ms]
    [Pending-Response Delta: 114.737ms]
  • Direction：Rcvd (0x01)
  • Command in frame: 630
  • Response in frame：632
yaml 复制代码 
Frame 632: 20 bytes on wire (160 bits), 20 bytes captured (160 bits)
Bluetooth
    [Source: controller]
    [Destination: host]
Bluetooth HCI H4
    [Direction: Rcvd (0x01)]
    HCI Packet Type: HCI Event (0x04)
Bluetooth HCI Event - Synchronous Connection Complete
    Event Code: Synchronous Connection Complete (0x2c)
    Parameter Total Length: 17
    Status: Success (0x00)
    Connection Handle: 0x0003
    BD_ADDR: HuaweiDe_42:c7:dd (30:aa:e4:42:c7:dd)
    Link Type: eSCO connection (0x02)
    Transmit Interval: 12 slots (7.5 msec)
    Retransmit Window: 6 slots (3.75 msec)
    Rx Packet Length: 60
    Tx Packet Length: 60
    Air Mode: Unknown (5)
    [Command in frame: 630]
    [Pending in frame: 631]
    [Pending-Response Delta: 114.737ms]
    [Command-Response Delta: 117.981ms]
  • Link Type：eSCO connection (0x02)，eSCO通道已连接成功，因为我们选用的是mSBC编解码器，而mSBC编解码器只支持eSCO链路；

同步连接成功之后，底层会向上层回调onAudioStateChanged：

yaml 复制代码 
01-01 00:03:27.808  1655  1928 D bt_btif : bta_hf_client_sco_conn_cback: 0
01-01 00:03:27.808  1655  1928 I bt_btif : bta_sys_event: Event 0x1b0c
01-01 00:03:27.808  1655  1928 D bt_btif : bta_hf_client_hdl_event: BTA_HF_CLIENT_SCO_OPEN_EVT (0x1b0c)
01-01 00:03:27.808  1655  1928 I bt_btif : HF Client evt : State 2 (BTA_HF_CLIENT_OPEN_ST), Event 0x1b0c (BTA_HF_CLIENT_SCO_OPEN_EVT)
01-01 00:03:27.808  1655  1928 D bt_btif : bta_hf_client_sco_conn_open
01-01 00:03:27.808  1655  1928 D bt_btif : bta_hf_client_sco_event: before state: 2 event: 4
01-01 00:03:27.808  1655  1928 D bt_btif : bta_hf_client_sco_event: after state: 4
01-01 00:03:27.808  1655  1928 D bt_btif : bta_dm_pm_cback: st(4), id(27), app(1)
01-01 00:03:27.808  1655  1928 D bt_btif : bta_dm_pm_stop_timer: 
01-01 00:03:27.808  1655  1928 D bt_btif : bta_dm_pm_cback bta_dm_pm_stop_timer for current service, restart other service timers: count = 3
01-01 00:03:27.808  1655  1928 D bt_btm  : btm_bda_to_acl found
01-01 00:03:27.808  1655  1928 D bt_btm  : BTM_ReadRemoteFeatures
01-01 00:03:27.808  1655  1928 D bt_btif : bta_dm_pm_cback: SCO inactive, reset SSR to zero
01-01 00:03:27.808  1655  1928 D bt_btif : bta_dm_pm_set_mode: srvcsid: 18, state: 0, j: 5
01-01 00:03:27.808  1655  1928 D bt_btif : bta_dm_pm_set_mode: srvcsid: 27, state: 4, j: 21
01-01 00:03:27.808  1655  1928 D bt_btif : bta_dm_pm_set_mode: srvcsid: 26, state: 6, j: 16
01-01 00:03:27.808  1655  1928 D bt_btif : bta_dm_pm_set_mode dm_pm_timer:0, 7000 ms
01-01 00:03:27.808  1655  1928 D bt_btif : bta_dm_pm_set_mode dm_pm_timer:1, 7000 ms
01-01 00:03:27.808  1655  1928 D bt_btif : bta_dm_pm_set_mode dm_pm_timer:2, 7000 ms
01-01 00:03:27.808  1655  1928 D bt_btif : bta_dm_pm_set_mode dm_pm_timer:3, 7000 ms
01-01 00:03:27.808  1655  1928 D bt_btif : bta_dm_pm_set_mode dm_pm_timer:4, 7000 ms
01-01 00:03:27.808  1655  1928 D bt_btif : bta_dm_pm_set_mode dm_pm_timer:5, 7000 ms
01-01 00:03:27.808  1655  1928 D bt_btif : bta_dm_pm_set_mode dm_pm_timer:6, 7000 ms
01-01 00:03:27.808  1655  1928 D bt_btif : btif_transfer_context event 6, len 52
01-01 00:03:27.809  1655  1758 D bt_btif : btif task fetched event a001
01-01 00:03:27.809  1655  1758 D bt_btif : btif_context_switched
01-01 00:03:27.809  1655  1758 D bt_btif : btif_hf_client_upstreams_evt: event=BTA_HF_CLIENT_AUDIO_MSBC_OPEN_EVT (6)
01-01 00:03:27.809  1655  1758 I bt_btif : btif_hf_client_upstreams_evt: HAL bt_hf_client_callbacks->audio_state_cb
01-01 00:03:27.810  1655  1758 D NativeInterface: onAudioStateChanged: address [B@ed64403 event StackEvent {type:EVENT_TYPE_AUDIO_STATE_CHANGED, value1:3, value2:0, value3:0, value4:0, string: "null", device:30:AA:E4:42:C7:DD}

表明当前Audio Channel已开启，上层可以根据Audio State执行一些相应的逻辑；

响铃
+CIEV
yaml 复制代码 
Bluetooth HFP Profile
    [Role: AG - Audio Gate (1)]
    AT Stream: \r\n+CIEV: 2,3\r\n
    Command 0: +CIEV
        Command: +CIEV (Indicator Events Reporting)
        Type: Response (0x003a)
        Parameters
            Indicator Index: 2
            Indicator 2: 3

callsetup = 3，代表了呼叫的对方正在响铃，对应实际场景为：03511008611号码正在响铃中；

AT+CLCC & +CLCC
yaml 复制代码 
Bluetooth HFP Profile
    [Role: HS - Headset (2)]
    AT Stream: AT+CLCC\r
    Command 0: +CLCC
        Command Line Prefix: AT
        Command: +CLCC (Current Calls)
        Type: Action Command (0x000d)
        Parameters: No
yaml 复制代码 
Bluetooth HFP Profile
    [Role: AG - Audio Gate (1)]
    AT Stream: \r\n+CLCC: 1,0,3,0,0,"03511008611",129\r\n
    Command 0: +CLCC
        Command: +CLCC (Current Calls)
        Type: Response (0x003a)
        Parameters
            ID: 1
            Direction: Mobile Originated (0)
            State: Alerting (3)
            Mode: Voice (0)
            Mpty: Call is not one of multiparty (conference) call parties (0)
            Number: "03511008611"
            Type: The phone number format may be a national or international format, and may contain prefix and/or escape digits. No changes on the number presentation are required. (129)

拨号状态下，State = 3，Alerting；

然后返回对应的OK Response；

通话
+CIEV
yaml 复制代码 
Bluetooth HFP Profile
    [Role: AG - Audio Gate (1)]
    AT Stream: \r\n+CIEV: 1,1\r\n
    Command 0: +CIEV
        Command: +CIEV (Indicator Events Reporting)
        Type: Response (0x003a)
        Parameters
            Indicator Index: 1
            Indicator 1: 1

call = 1，代表了至少有一个正在通话中，对应实际场景为：03511008611号码已拨通；

+CIEV
yaml 复制代码 
Bluetooth HFP Profile
    [Role: AG - Audio Gate (1)]
    AT Stream: \r\n+CIEV: 2,0\r\n
    Command 0: +CIEV
        Command: +CIEV (Indicator Events Reporting)
        Type: Response (0x003a)
        Parameters
            Indicator Index: 2
            Indicator 2: 0

callsetup = 0，代表当前没在呼叫，对应实际场景为：03511008611号码已拨通，呼叫状态变为了已拨通状态；

AT+CLCC & +CLCC
yaml 复制代码 
Bluetooth HFP Profile
    [Role: HS - Headset (2)]
    AT Stream: AT+CLCC\r
    Command 0: +CLCC
        Command Line Prefix: AT
        Command: +CLCC (Current Calls)
        Type: Action Command (0x000d)
        Parameters: No
yaml 复制代码 
Bluetooth HFP Profile
    [Role: AG - Audio Gate (1)]
    AT Stream: \r\n+CLCC: 1,0,0,0,0,"03511008611",129\r\n
    Command 0: +CLCC
        Command: +CLCC (Current Calls)
        Type: Response (0x003a)
        Parameters
            ID: 1
            Direction: Mobile Originated (0)
            State: Active (0)
            Mode: Voice (0)
            Mpty: Call is not one of multiparty (conference) call parties (0)
            Number: "03511008611"
            Type: The phone number format may be a national or international format, and may contain prefix and/or escape digits. No changes on the number presentation are required. (129)

拨号状态下，State = 3，Alerting；

然后返回对应的OK Response；

拨打电话 - HF

HF侧的拨打电话和AG侧比较起来就多了一个步骤，通过AT命令"ATD"将需要拨打的电话信息发送到AG侧，然后通过手机的电话模块呼出电话；

推送号码

ATDddd..dd：标准AT命令，用于HF侧发送拨打电话号码至AG侧；

yaml 复制代码 
Bluetooth HFP Profile
    [Role: HS - Headset (2)]
    AT Stream: ATD03511008611;\r
    Command 0: D
        Command Line Prefix: AT
        Command: D (Dial)
        [Expert Info (Warning/Protocol): Non mandatory type or command in this role]
            [Non mandatory type or command in this role]
            [Severity level: Warning]
            [Group: Protocol]
        Parameters: No

对应的Response为OK；

相关推荐
刘立军42 分钟前
本地大模型编程实战(33)用SSE实现大模型的流式输出
架构·langchain·全栈
一直_在路上1 小时前
Go 语言微服务演进路径：从小型项目到企业级架构
架构·go
黄林晴3 小时前
如何判断手机是否是纯血鸿蒙系统
android
火柴就是我3 小时前
flutter 之真手势冲突处理
android·flutter
法的空间3 小时前
Flutter JsonToDart 支持 JsonSchema
android·flutter·ios
循环不息优化不止3 小时前
深入解析安卓 Handle 机制
android
恋猫de小郭4 小时前
Android 将强制应用使用主题图标，你怎么看？
android·前端·flutter
jctech4 小时前
这才是2025年的插件化！ComboLite 2.0：为Compose开发者带来极致“爽”感
android·开源
用户2018792831674 小时前
为何Handler的postDelayed不适合精准定时任务？
android
叽哥4 小时前
Kotlin学习第 8 课：Kotlin 进阶特性：简化代码与提升效率
android·java·kotlin
热门推荐
01GitHub 镜像站点02UV 工具安装与国内镜像源配置指南03UV安装并设置国内源0446个Nano-banana 精选提示词，持续更新中05A股预测还能更准？开源大模型Kronos带你跑通预测+回测全流程06Claude Code 平替：OpenAI发布 Codex CLI ，GPT-5 国内直接使用07KGG转MP3工具|非KGM文件|解密音频08解决 WSL Ubuntu 中 /etc/resolv.conf 自动重置问题09conda中设置镜像地址（附所有可换的地址）10保姆级教程：手把手教你用Dify实现完美多轮对话（附Chatflow和提示词）