BT_蓝牙电话数据包分析_拨打电话

dupz11192023-11-04 14:11

基于Android P版本分析

通话过程协议分析

上述过程中，描述的都是在非通话状态下的 AT+ 指令的状态信息，接下来我们对通话状态过程中涉及到的AT指令状态信息进行描述；

拨打电话 - AG

拨打电话大体分为拨号、响铃、通话这三个部分，状态变化后AG侧都会主动通知HF侧，HF侧再通过"AT+CLCC"获取详细的电话参数信息。

报告状态
+CIEV

用于报告事件状态；

yaml 复制代码 
Bluetooth HFP Profile
    [Role: AG - Audio Gate (1)]
    AT Stream: \r\n+CIEV: 2,2\r\n
    Command 0: +CIEV
        Command: +CIEV (Indicator Events Reporting)
        Type: Response (0x003a)
        Parameters
            Indicator Index: 2
            Indicator 2: 2

+CIEV: ,

  • ：Indicator，该值对应了AT+CIND指令的中index，例如

    • 1：call
    • 2：callsetup
    • 3：service
    • 4：signal
    • 5：roam
    • 6：battchg
    • 7：callheld

  • ：指定的就是Indicator指示对应的value值；

    • 例如，call = 1

      • 0： 没有电话在进行中
      • 1：至少有一个电话在进行中

Indicator参数常见的几种配置：

  • +CIEV:1,1：接听电话
  • +CIEV:2,0：当前没有等待的电话需要处理
  • +CIEV:2,2：拨打电话
  • +CIEV:2,3：已拨通

当前的状态为拨打电话状态；

选取编码方式
+BCS & AT+BCS
yaml 复制代码 
Bluetooth HFP Profile
    [Role: AG - Audio Gate (1)]
    AT Stream: \r\n+BCS: 2\r\n
    Command 0: +BCS
        Command: +BCS (Bluetooth Codec Selection)
        Type: Response (0x003a)
        Parameters
            Codec: mSBC (2)

当前选用的编解码器为mSBC，AT+BAC指令用于获取蓝牙可用编解码器，而对应的AT+BCS指令用于指定使用哪种编解码器；

yaml 复制代码 
Bluetooth HFP Profile
    [Role: HS - Headset (2)]
    AT Stream: AT+BCS=2\r
    Command 0: +BCS
        Command Line Prefix: AT
        Command: +BCS (Bluetooth Codec Selection)
        Type: Action Command (0x003d)
        Parameters
            Codec: mSBC (2)

然后返回对应的OK Response；

拨号
AT+CLCC & +CLCC
yaml 复制代码 
Bluetooth HFP Profile
    [Role: HS - Headset (2)]
    AT Stream: AT+CLCC\r
    Command 0: +CLCC
        Command Line Prefix: AT
        Command: +CLCC (Current Calls)
        Type: Action Command (0x000d)
        Parameters: No
yaml 复制代码 
Bluetooth HFP Profile
    [Role: AG - Audio Gate (1)]
    AT Stream: \r\n+CLCC: 1,0,2,0,0,"03511008611",129\r\n
    Command 0: +CLCC
        Command: +CLCC (Current Calls)
        Type: Response (0x003a)
        Parameters
            ID: 1
            Direction: Mobile Originated (0)
            State: Dialing (2)
            Mode: Voice (0)
            Mpty: Call is not one of multiparty (conference) call parties (0)
            Number: "03511008611"
            Type: The phone number format may be a national or international format, and may contain prefix and/or escape digits. No changes on the number presentation are required. (129)

拨号状态下，State = 2，Dialing；

对应上层回调信息：

ruby 复制代码 
01-01 00:03:27.361  1655  1758 D NativeInterface: onCallSetup: addr [B@5e15405 device30:AA:E4:42:C7:DD
01-01 00:03:27.361  1655  1758 D NativeInterface: onCallSetup: address [B@5e15405 event StackEvent {type:EVENT_TYPE_CALLSETUP, value1:2, value2:0, value3:0, value4:0, string: "null", device:30:AA:E4:42:C7:DD}

然后返回对应的OK Response；

同步连接请求
yaml 复制代码 
Frame 630: 67 bytes on wire (536 bits), 67 bytes captured (536 bits)
Bluetooth
    [Source: host]
    [Destination: controller]
Bluetooth HCI H4
    [Direction: Sent (0x00)]
    HCI Packet Type: HCI Command (0x01)
Bluetooth HCI Command - Enhanced Accept Synchronous Connection Request
    Command Opcode: Enhanced Accept Synchronous Connection Request (0x043e)
        0000 01.. .... .... = Opcode Group Field: Link Control Commands (0x01)
        .... ..00 0011 1110 = Opcode Command Field: Enhanced Accept Synchronous Connection Request (0x03e)
    Parameter Total Length: 63
    BD_ADDR: HuaweiDe_42:c7:dd (30:aa:e4:42:c7:dd)
    Tx Bandwidth (bytes/s): 8000
    Rx Bandwidth (bytes/s): 8000
    Transmit Coding Format
        Codec: mSBC (0x05)
        Company ID: Ericsson Technology Licensing (0x0000)
        Vendor Codec ID: 0x0000
    Receive Coding Format
        Codec: mSBC (0x05)
        Company ID: Ericsson Technology Licensing (0x0000)
        Vendor Codec ID: 0x0000
    Transmit Codec Frame Size: 60
    Receive Codec Frame Size: 60
    Input Bandwidth: 32000
    Output Bandwidth: 32000
    Input Coding Format
        Codec: Linear PCM (0x04)
        Company ID: Ericsson Technology Licensing (0x0000)
        Vendor Codec ID: 0x0000
    Output Coding Format
        Codec: Linear PCM (0x04)
        Company ID: Ericsson Technology Licensing (0x0000)
        Vendor Codec ID: 0x0000
    Input Coded Data Size: 16
    Output Coded Data Size: 16
    Input PCM Data Format: 2's complement (0x02)
    Output PCM Data Format: 2's complement (0x02)
    Input PCM Sample Payload MSB Position: 0
    Output PCM Sample Payload MSB Position: 0
    Input Data Path: Vendor Specific
    Output Data Path: Vendor Specific
    Input Transport Unit Size: 0
    Output Transport Unit Size: 0
    Max. Latency (ms): 13
    Packet Type: 0x0388, 3-EV5 may NOT be used, 2-EV5 may NOT be used, 3-EV3 may NOT be used, EV3 may be used
        0000 00.. .... .... = Reserved: 0x00
        .... ..1. .... .... = 3-EV5 may NOT be used: True
        .... ...1 .... .... = 2-EV5 may NOT be used: True
        .... .... 1... .... = 3-EV3 may NOT be used: True
        .... .... .0.. .... = 2-EV3 may NOT be used: False
        .... .... ..0. .... = EV5 may be used: False
        .... .... ...0 .... = EV4 may be used: False
        .... .... .... 1... = EV3 may be used: True
        .... .... .... .0.. = HV3 may be used: False
        .... .... .... ..0. = HV2 may be used: False
        .... .... .... ...0 = HV1 may be used: False
    Retransmission Effort: At least 1 retransmission, optimize for link quality (2)
    [Pending in frame: 631]
    [Command-Pending Delta: 3.244ms]
    [Response in frame: 632]
    [Command-Response Delta: 117.981ms]
  • Source：host，蓝牙协议层
  • Destination：蓝牙协议芯片
  • Direction：Sent（0x00）：类型 sent，对应的为Rcvd（0x01）
  • HCI Packet Type：HCI Command，这个类型是host和Controller通信使用的方式，对应的Controller向上回调给Host的方式为HCI Event；
  • BD_ADDR：AG侧蓝牙设备
  • Codec：mSBC（0x05），编解码器
  • Codec：Linear PCM (0x04)，音频格式
  • Command in frame: 630
  • Pending in frame：631
  • Response in frame：632
yaml 复制代码 
Frame 631: 7 bytes on wire (56 bits), 7 bytes captured (56 bits)
Bluetooth
    [Source: controller]
    [Destination: host]
Bluetooth HCI H4
    [Direction: Rcvd (0x01)]
    HCI Packet Type: HCI Event (0x04)
Bluetooth HCI Event - Command Status
    Event Code: Command Status (0x0f)
    Parameter Total Length: 4
    Status: Pending (0x00)
    Number of Allowed Command Packets: 1
    Command Opcode: Enhanced Accept Synchronous Connection Request (0x043e)
        0000 01.. .... .... = Opcode Group Field: Link Control Commands (0x01)
        .... ..00 0011 1110 = Opcode Command Field: Enhanced Accept Synchronous Connection Request (0x03e)
    [Command in frame: 630]
    [Response in frame: 632]
    [Command-Pending Delta: 3.244ms]
    [Pending-Response Delta: 114.737ms]
  • Direction：Rcvd (0x01)
  • Command in frame: 630
  • Response in frame：632
yaml 复制代码 
Frame 632: 20 bytes on wire (160 bits), 20 bytes captured (160 bits)
Bluetooth
    [Source: controller]
    [Destination: host]
Bluetooth HCI H4
    [Direction: Rcvd (0x01)]
    HCI Packet Type: HCI Event (0x04)
Bluetooth HCI Event - Synchronous Connection Complete
    Event Code: Synchronous Connection Complete (0x2c)
    Parameter Total Length: 17
    Status: Success (0x00)
    Connection Handle: 0x0003
    BD_ADDR: HuaweiDe_42:c7:dd (30:aa:e4:42:c7:dd)
    Link Type: eSCO connection (0x02)
    Transmit Interval: 12 slots (7.5 msec)
    Retransmit Window: 6 slots (3.75 msec)
    Rx Packet Length: 60
    Tx Packet Length: 60
    Air Mode: Unknown (5)
    [Command in frame: 630]
    [Pending in frame: 631]
    [Pending-Response Delta: 114.737ms]
    [Command-Response Delta: 117.981ms]
  • Link Type：eSCO connection (0x02)，eSCO通道已连接成功，因为我们选用的是mSBC编解码器，而mSBC编解码器只支持eSCO链路；

同步连接成功之后，底层会向上层回调onAudioStateChanged：

yaml 复制代码 
01-01 00:03:27.808  1655  1928 D bt_btif : bta_hf_client_sco_conn_cback: 0
01-01 00:03:27.808  1655  1928 I bt_btif : bta_sys_event: Event 0x1b0c
01-01 00:03:27.808  1655  1928 D bt_btif : bta_hf_client_hdl_event: BTA_HF_CLIENT_SCO_OPEN_EVT (0x1b0c)
01-01 00:03:27.808  1655  1928 I bt_btif : HF Client evt : State 2 (BTA_HF_CLIENT_OPEN_ST), Event 0x1b0c (BTA_HF_CLIENT_SCO_OPEN_EVT)
01-01 00:03:27.808  1655  1928 D bt_btif : bta_hf_client_sco_conn_open
01-01 00:03:27.808  1655  1928 D bt_btif : bta_hf_client_sco_event: before state: 2 event: 4
01-01 00:03:27.808  1655  1928 D bt_btif : bta_hf_client_sco_event: after state: 4
01-01 00:03:27.808  1655  1928 D bt_btif : bta_dm_pm_cback: st(4), id(27), app(1)
01-01 00:03:27.808  1655  1928 D bt_btif : bta_dm_pm_stop_timer: 
01-01 00:03:27.808  1655  1928 D bt_btif : bta_dm_pm_cback bta_dm_pm_stop_timer for current service, restart other service timers: count = 3
01-01 00:03:27.808  1655  1928 D bt_btm  : btm_bda_to_acl found
01-01 00:03:27.808  1655  1928 D bt_btm  : BTM_ReadRemoteFeatures
01-01 00:03:27.808  1655  1928 D bt_btif : bta_dm_pm_cback: SCO inactive, reset SSR to zero
01-01 00:03:27.808  1655  1928 D bt_btif : bta_dm_pm_set_mode: srvcsid: 18, state: 0, j: 5
01-01 00:03:27.808  1655  1928 D bt_btif : bta_dm_pm_set_mode: srvcsid: 27, state: 4, j: 21
01-01 00:03:27.808  1655  1928 D bt_btif : bta_dm_pm_set_mode: srvcsid: 26, state: 6, j: 16
01-01 00:03:27.808  1655  1928 D bt_btif : bta_dm_pm_set_mode dm_pm_timer:0, 7000 ms
01-01 00:03:27.808  1655  1928 D bt_btif : bta_dm_pm_set_mode dm_pm_timer:1, 7000 ms
01-01 00:03:27.808  1655  1928 D bt_btif : bta_dm_pm_set_mode dm_pm_timer:2, 7000 ms
01-01 00:03:27.808  1655  1928 D bt_btif : bta_dm_pm_set_mode dm_pm_timer:3, 7000 ms
01-01 00:03:27.808  1655  1928 D bt_btif : bta_dm_pm_set_mode dm_pm_timer:4, 7000 ms
01-01 00:03:27.808  1655  1928 D bt_btif : bta_dm_pm_set_mode dm_pm_timer:5, 7000 ms
01-01 00:03:27.808  1655  1928 D bt_btif : bta_dm_pm_set_mode dm_pm_timer:6, 7000 ms
01-01 00:03:27.808  1655  1928 D bt_btif : btif_transfer_context event 6, len 52
01-01 00:03:27.809  1655  1758 D bt_btif : btif task fetched event a001
01-01 00:03:27.809  1655  1758 D bt_btif : btif_context_switched
01-01 00:03:27.809  1655  1758 D bt_btif : btif_hf_client_upstreams_evt: event=BTA_HF_CLIENT_AUDIO_MSBC_OPEN_EVT (6)
01-01 00:03:27.809  1655  1758 I bt_btif : btif_hf_client_upstreams_evt: HAL bt_hf_client_callbacks->audio_state_cb
01-01 00:03:27.810  1655  1758 D NativeInterface: onAudioStateChanged: address [B@ed64403 event StackEvent {type:EVENT_TYPE_AUDIO_STATE_CHANGED, value1:3, value2:0, value3:0, value4:0, string: "null", device:30:AA:E4:42:C7:DD}

表明当前Audio Channel已开启，上层可以根据Audio State执行一些相应的逻辑；

响铃
+CIEV
yaml 复制代码 
Bluetooth HFP Profile
    [Role: AG - Audio Gate (1)]
    AT Stream: \r\n+CIEV: 2,3\r\n
    Command 0: +CIEV
        Command: +CIEV (Indicator Events Reporting)
        Type: Response (0x003a)
        Parameters
            Indicator Index: 2
            Indicator 2: 3

callsetup = 3，代表了呼叫的对方正在响铃，对应实际场景为：03511008611号码正在响铃中；

AT+CLCC & +CLCC
yaml 复制代码 
Bluetooth HFP Profile
    [Role: HS - Headset (2)]
    AT Stream: AT+CLCC\r
    Command 0: +CLCC
        Command Line Prefix: AT
        Command: +CLCC (Current Calls)
        Type: Action Command (0x000d)
        Parameters: No
yaml 复制代码 
Bluetooth HFP Profile
    [Role: AG - Audio Gate (1)]
    AT Stream: \r\n+CLCC: 1,0,3,0,0,"03511008611",129\r\n
    Command 0: +CLCC
        Command: +CLCC (Current Calls)
        Type: Response (0x003a)
        Parameters
            ID: 1
            Direction: Mobile Originated (0)
            State: Alerting (3)
            Mode: Voice (0)
            Mpty: Call is not one of multiparty (conference) call parties (0)
            Number: "03511008611"
            Type: The phone number format may be a national or international format, and may contain prefix and/or escape digits. No changes on the number presentation are required. (129)

拨号状态下，State = 3，Alerting；

然后返回对应的OK Response；

通话
+CIEV
yaml 复制代码 
Bluetooth HFP Profile
    [Role: AG - Audio Gate (1)]
    AT Stream: \r\n+CIEV: 1,1\r\n
    Command 0: +CIEV
        Command: +CIEV (Indicator Events Reporting)
        Type: Response (0x003a)
        Parameters
            Indicator Index: 1
            Indicator 1: 1

call = 1，代表了至少有一个正在通话中，对应实际场景为：03511008611号码已拨通；

+CIEV
yaml 复制代码 
Bluetooth HFP Profile
    [Role: AG - Audio Gate (1)]
    AT Stream: \r\n+CIEV: 2,0\r\n
    Command 0: +CIEV
        Command: +CIEV (Indicator Events Reporting)
        Type: Response (0x003a)
        Parameters
            Indicator Index: 2
            Indicator 2: 0

callsetup = 0，代表当前没在呼叫，对应实际场景为：03511008611号码已拨通，呼叫状态变为了已拨通状态；

AT+CLCC & +CLCC
yaml 复制代码 
Bluetooth HFP Profile
    [Role: HS - Headset (2)]
    AT Stream: AT+CLCC\r
    Command 0: +CLCC
        Command Line Prefix: AT
        Command: +CLCC (Current Calls)
        Type: Action Command (0x000d)
        Parameters: No
yaml 复制代码 
Bluetooth HFP Profile
    [Role: AG - Audio Gate (1)]
    AT Stream: \r\n+CLCC: 1,0,0,0,0,"03511008611",129\r\n
    Command 0: +CLCC
        Command: +CLCC (Current Calls)
        Type: Response (0x003a)
        Parameters
            ID: 1
            Direction: Mobile Originated (0)
            State: Active (0)
            Mode: Voice (0)
            Mpty: Call is not one of multiparty (conference) call parties (0)
            Number: "03511008611"
            Type: The phone number format may be a national or international format, and may contain prefix and/or escape digits. No changes on the number presentation are required. (129)

拨号状态下，State = 3，Alerting；

然后返回对应的OK Response；

拨打电话 - HF

HF侧的拨打电话和AG侧比较起来就多了一个步骤，通过AT命令"ATD"将需要拨打的电话信息发送到AG侧，然后通过手机的电话模块呼出电话；

推送号码

ATDddd..dd：标准AT命令，用于HF侧发送拨打电话号码至AG侧；

yaml 复制代码 
Bluetooth HFP Profile
    [Role: HS - Headset (2)]
    AT Stream: ATD03511008611;\r
    Command 0: D
        Command Line Prefix: AT
        Command: D (Dial)
        [Expert Info (Warning/Protocol): Non mandatory type or command in this role]
            [Non mandatory type or command in this role]
            [Severity level: Warning]
            [Group: Protocol]
        Parameters: No

对应的Response为OK；

相关推荐
小马爱打代码4 小时前
微服务外联Feign调用：第三方API调用的负载均衡与容灾实战
微服务·架构·负载均衡
雨白8 小时前
Jetpack系列(二)：Lifecycle与LiveData结合，打造响应式UI
android·android jetpack
9527华安8 小时前
FPGA实现40G网卡NIC，基于PCIE4C+40G/50G Ethernet subsystem架构，提供工程源码和技术支持
fpga开发·架构·网卡·ethernet·nic·40g·pcie4c
kk爱闹10 小时前
【挑战14天学完python和pytorch】- day01
android·pytorch·python
每次的天空11 小时前
Android-自定义View的实战学习总结
android·学习·kotlin·音视频
恋猫de小郭12 小时前
Flutter Widget Preview 功能已合并到 master，提前在体验毛坯的预览支持
android·flutter·ios
断剑重铸之日13 小时前
Android自定义相机开发(类似OCR扫描相机）
android
随心最为安13 小时前
Android Library Maven 发布完整流程指南
android
guojl13 小时前
深度解决大文件上传难题
架构
岁月玲珑13 小时前
【使用Android Studio调试手机app时候手机老掉线问题】
android·ide·android studio
热门推荐
012024年 最新 iPhone手机 历代机型、屏幕尺寸、纵横比、分辨率 整理02Coze实战第13讲：飞书多维表格读取+豆包生图模型，轻松批量生成短剧封面03Coze扣子平台完整体验和实践（附国内和国际版对比）04Word粘贴时出现“运行时错误53,文件未找到：MathPage.WLL“的解决方案05手机电脑之间快速传输图片视频文件，不压缩画质、不限制大小的方法！06扣子（coze）实战|我用扣子搭建了一个自动分析小红薯笔记内容的AI应用|详细步骤拆解07MIUI显示/隐藏5G开关的方法，信号弱时开启手机Wifi通话方法08华为昇腾 910B 部署 DeepSeek-R1 蒸馏系列模型详细指南09DeepSeek各版本说明与优缺点分析10Coze平台 创建AI智能体的详细步骤指南