基于Android P版本分析
bluedroid
概述
一般情况下，我们在进行手机和车机的蓝牙配对过程中，会直接为手机和车机进行连接，一般情况下，会为设备赋予几项基本的蓝牙功能；
- 通话音频 - HFP；
- 媒体音频 - A2DP + AVRCP；
- 共享联系人 - PBAP；
A2DP
A2DP全称：Advenced Audio Distribution Profile，即蓝牙音频传输模型协定；
A2DP规定了使用蓝牙异步传输信道方式，传输高质量音乐文件数据的协议堆栈软件和使用方法，基于该协议就能通过以蓝牙方式传输高品质的音乐。例如使用蓝牙耳机或蓝牙音响设备来收听音乐了；
A2DP协议在frameworks层体现为两个：A2dpService和A2dpSinkService；
- A2dpService：作为音源输入端，提供音频流数据；
- A2dpSinkService：作为音源输出端，播放音源端提供的音频流数据；
A2DP协议分为了两个角色：Source和Sink；
- Source：发送音频端，录入/加载音频；
- Sink：接收音频端，播放音频；
AVRCP
AVRCP全称：Audio/Video Remote Control Profile，即音频/视频远程控制配置文件。
AVRCP设计用于提供控制TV，Hi-Fi设备等的标准接口，此配置文件用于许可单个远程控制设备（或其他设备）控制所有用于可以接入的A/V设备。AVRCP定义了如何控制流媒体的特征。包括暂停、停止、启动重放、音量控制及其他类型的远程控制操作（其实和DLNA的指令控制类似）；
AVRCP是一种在蓝牙协议栈A2DP/AVRCP上实现的控制技术；
avrcp是蓝牙应用层的协议，从这里可以看出，ARVCP的下面还有一个被称为AVRTP的协议，其实，它就是AVRCP的底层传输协议，可以理解成是AVRCP和a2dp之间的适配层。
AVRCP协议存在两个角色：CT和TG；
- CT（The Controller）：命令发起方，例如蓝牙耳机发送指令（上一首、下一首、音量调整）；
- TG（The target）：命令接收方，例如手机；
A2dpSink connect
根据协议栈，我们知道，A2dp协议是基于A2DTP协议实现的，实际上就是对A2DTP协议的连接建立；
A2DTP建立连接之后，需要进行一系列的配置，同时也需要针对Audio Stream的通道进行配置，以确保可以接收到音频数据；
在AVDTP协议建立连接的过程中，进行了Audio的config，同时也创建了对应的AudioTrack；
AVRCP connect
我们知道，针对AVRCP，分为了CT和TG，类似于HF和AG的角色划分，其中CT代表了指令发送方，一般情况下为耳机或者是车载蓝牙，TG作为指令接收方，一般为手机；
在连接还没有创建的情况下，CT应该会主动发起建立连接的请求，一旦连接成功之后，就可以发送AV/C指令；
A2dpSink协议建立连接成功之后，会将StateOpened状态之后，会通过SetActivePeer函数来触发SDP来搜索AVRCP协议服务；
SDP搜索成功之后，会在SDP的Complete的Response中开启AVRCP协议并连接；
协议数据包分析
A2DP Sink
Sent Connection Request
这个Command用来建立两个设备之间的L2CAP channel，我们不过多的展开描述，我们直接看该过程中对应的ServiceSearchAttributeRequest的结果：
yaml
Bluetooth L2CAP Protocol
Length: 24
CID: Dynamically Allocated Channel (0x0040)
[Connect in frame: 962]
[Disconnect in frame: 984]
[PSM: SDP (0x0001)]
Bluetooth SDP Protocol
PDU: Service Search Attribute Request (0x06)
Transaction Id: 0x0000
Parameter Length: 19
Service Search Pattern: Audio Source
Data Element: Sequence uint8 3 bytes
0011 0... = Data Element Type: Sequence (6)
.... .101 = Data Element Size: uint8 (5)
Data Element Var Size: 3
Data Value
Data Element: UUID 2 bytes
0001 1... = Data Element Type: UUID (3)
.... .001 = Data Element Size: 2 bytes (1)
Data Value
Value: UUID: Audio Source (0x110a)
Maximum Attribute Byte Count: 1008
Attribute ID List
Data Element: Sequence uint8 9 bytes
0011 0... = Data Element Type: Sequence (6)
.... .101 = Data Element Size: uint8 (5)
Data Element Var Size: 9
Data Value
Attribute ID: Service Class ID List
Data Element: Unsigned Integer 2 bytes
0000 1... = Data Element Type: Unsigned Integer (1)
.... .001 = Data Element Size: 2 bytes (1)
Data Value
Attribute ID: Service Class ID List (0x0001)
Attribute ID: Protocol Descriptor List
Data Element: Unsigned Integer 2 bytes
0000 1... = Data Element Type: Unsigned Integer (1)
.... .001 = Data Element Size: 2 bytes (1)
Data Value
Attribute ID: Protocol Descriptor List (0x0004)
Attribute ID: Bluetooth Profile Descriptor List
Data Element: Unsigned Integer 2 bytes
0000 1... = Data Element Type: Unsigned Integer (1)
.... .001 = Data Element Size: 2 bytes (1)
Data Value
Attribute ID: Bluetooth Profile Descriptor List (0x0009)
Continuation State: no (00)本次SDP服务搜索对应的Service（UUID）为Audio Source（0x110a），对应的Service为A2DP Sink；
yaml
Bluetooth L2CAP Protocol
Length: 55
CID: Dynamically Allocated Channel (0x0055)
[Connect in frame: 962]
[Disconnect in frame: 984]
[PSM: SDP (0x0001)]
Bluetooth SDP Protocol
PDU: Service Search Attribute Response (0x07)
Transaction Id: 0x0000
Parameter Length: 50
Attribute List Byte Count: 47
Attribute Lists [count = 1]
Data Element: Sequence uint8 45 bytes
0011 0... = Data Element Type: Sequence (6)
.... .101 = Data Element Size: uint8 (5)
Data Element Var Size: 45
Data Value
Attribute List [count = 3] (Audio Source)
Data Element: Sequence uint16 42 bytes
0011 0... = Data Element Type: Sequence (6)
.... .110 = Data Element Size: uint16 (6)
Data Element Var Size: 42
Data Value
Service Attribute: Service Class ID List (0x1), value = Audio Source
Attribute ID: Service Class ID List
Data Element: Unsigned Integer 2 bytes
0000 1... = Data Element Type: Unsigned Integer (1)
.... .001 = Data Element Size: 2 bytes (1)
Data Value
Attribute ID: Service Class ID List (0x0001)
Value
Data Element: Sequence uint8 3 bytes
0011 0... = Data Element Type: Sequence (6)
.... .101 = Data Element Size: uint8 (5)
Data Element Var Size: 3
Data Value
Data Element: UUID 2 bytes
0001 1... = Data Element Type: UUID (3)
.... .001 = Data Element Size: 2 bytes (1)
Data Value
Value: UUID: Audio Source (0x110a)
Service Attribute: Protocol Descriptor List (0x4), value = L2CAP:25 -> AVDTP (1.3)
Attribute ID: Protocol Descriptor List
Data Element: Unsigned Integer 2 bytes
0000 1... = Data Element Type: Unsigned Integer (1)
.... .001 = Data Element Size: 2 bytes (1)
Data Value
Attribute ID: Protocol Descriptor List (0x0004)
Value
Data Element: Sequence uint8 16 bytes
0011 0... = Data Element Type: Sequence (6)
.... .101 = Data Element Size: uint8 (5)
Data Element Var Size: 16
Data Value
Protocol #1: L2CAP, PSM: 25
Data Element: Sequence uint8 6 bytes
0011 0... = Data Element Type: Sequence (6)
.... .101 = Data Element Size: uint8 (5)
Data Element Var Size: 6
Data Value
Protocol Entry: L2CAP, PSM: 25
Data Element: UUID 2 bytes
0001 1... = Data Element Type: UUID (3)
.... .001 = Data Element Size: 2 bytes (1)
Data Value
Value: UUID: L2CAP (0x0100)
Data Element: Unsigned Integer 2 bytes
0000 1... = Data Element Type: Unsigned Integer (1)
.... .001 = Data Element Size: 2 bytes (1)
Data Value
L2CAP PSM: AVDTP (25)
Protocol #2: AVDTP, Version 1.3
Data Element: Sequence uint8 6 bytes
0011 0... = Data Element Type: Sequence (6)
.... .101 = Data Element Size: uint8 (5)
Data Element Var Size: 6
Data Value
Protocol Entry: AVDTP, Version 0x103
Data Element: UUID 2 bytes
0001 1... = Data Element Type: UUID (3)
.... .001 = Data Element Size: 2 bytes (1)
Data Value
Value: UUID: AVDTP (0x0019)
Data Element: Unsigned Integer 2 bytes
0000 1... = Data Element Type: Unsigned Integer (1)
.... .001 = Data Element Size: 2 bytes (1)
Data Value
Protocol Version: 0x0103
Service Attribute: Bluetooth Profile Descriptor List (0x9), value = Advanced Audio Distribution 1.3
Attribute ID: Bluetooth Profile Descriptor List
Data Element: Unsigned Integer 2 bytes
0000 1... = Data Element Type: Unsigned Integer (1)
.... .001 = Data Element Size: 2 bytes (1)
Data Value
Attribute ID: Bluetooth Profile Descriptor List (0x0009)
Value
Data Element: Sequence uint8 8 bytes
0011 0... = Data Element Type: Sequence (6)
.... .101 = Data Element Size: uint8 (5)
Data Element Var Size: 8
Data Value
Data Element: Sequence uint8 6 bytes
0011 0... = Data Element Type: Sequence (6)
.... .101 = Data Element Size: uint8 (5)
Data Element Var Size: 6
Data Value
Profile Descriptor List #1: Advanced Audio Distribution, Version 1.3
Data Element: UUID 2 bytes
0001 1... = Data Element Type: UUID (3)
.... .001 = Data Element Size: 2 bytes (1)
Data Value
Value: UUID: Advanced Audio Distribution (0x110d)
Data Element: Unsigned Integer 2 bytes
0000 1... = Data Element Type: Unsigned Integer (1)
.... .001 = Data Element Size: 2 bytes (1)
Data Value
Protocol Version: 0x0103
Continuation State: no (00)我们看到，在Protocol Descriptor List中表明了需要支持的协议，其中包括两个：L2CAP和AVDTP，而AVDTP协议是基于L2CAP协议实现的；
SDP协议执行完成之后，发送Sent Disconnection Request Command用于终止SDP服务搜索；
Sent Command - Discover
yaml
Bluetooth L2CAP Protocol
Length: 2
CID: Dynamically Allocated Channel (0x005f)
[Connect in frame: 995]
[Disconnect in frame: 1216]
[Service: Audio Source (0x110a)]
[PSM: AVDTP (0x0019)]
Bluetooth AVDTP Protocol
Signal: Discover (Command)
0000 .... = Transaction: 0x0
.... 00.. = Packet Type: Single (0x0)
.... ..00 = Message Type: Command (0x0)
00.. .... = RFA: 0x0
..00 0001 = Signal: Discover (0x01)该指令用于发现Remote Device有几个sep（stream end point），每个sep的媒体类型（audio、video、multi），例如本地的sep是个audio sink（音频播放设备，比如说音箱），远端的sep是个audio source（音源设备，比如说手机），那么这两个sep就可以连接了。
yaml
Bluetooth L2CAP Protocol
Length: 16
CID: Dynamically Allocated Channel (0x0057)
[Connect in frame: 995]
[Disconnect in frame: 1216]
[Service: Audio Source (0x110a)]
[PSM: AVDTP (0x0019)]
Bluetooth AVDTP Protocol
Signal: Discover (ResponseAccept)
0000 .... = Transaction: 0x0
.... 00.. = Packet Type: Single (0x0)
.... ..10 = Message Type: ResponseAccept (0x2)
00.. .... = RFA: 0x0
..00 0001 = Signal: Discover (0x01)
ACP SEP [1 - Audio Source] item 1/7
0000 01.. = SEID: 1
.... ..0. = In Use: False (0x0)
.... ...0 = RFA0: 0x0
0000 .... = Media Type: Audio (0x0)
.... 0... = Type: Source (0x0)
.... .000 = RFA1: 0x0
ACP SEP [2 - Audio Source] item 2/7
0000 10.. = SEID: 2
.... ..0. = In Use: False (0x0)
.... ...0 = RFA0: 0x0
0000 .... = Media Type: Audio (0x0)
.... 0... = Type: Source (0x0)
.... .000 = RFA1: 0x0
ACP SEP [3 - Audio Source] item 3/7
0000 11.. = SEID: 3
.... ..0. = In Use: False (0x0)
.... ...0 = RFA0: 0x0
0000 .... = Media Type: Audio (0x0)
.... 0... = Type: Source (0x0)
.... .000 = RFA1: 0x0
ACP SEP [4 - Audio Source] item 4/7
0001 00.. = SEID: 4
.... ..0. = In Use: False (0x0)
.... ...0 = RFA0: 0x0
0000 .... = Media Type: Audio (0x0)
.... 0... = Type: Source (0x0)
.... .000 = RFA1: 0x0
ACP SEP [5 - Audio Source] item 5/7
0001 01.. = SEID: 5
.... ..0. = In Use: False (0x0)
.... ...0 = RFA0: 0x0
0000 .... = Media Type: Audio (0x0)
.... 0... = Type: Source (0x0)
.... .000 = RFA1: 0x0
ACP SEP [6 - Audio Source] item 6/7
0001 10.. = SEID: 6
.... ..0. = In Use: False (0x0)
.... ...0 = RFA0: 0x0
0000 .... = Media Type: Audio (0x0)
.... 0... = Type: Source (0x0)
.... .000 = RFA1: 0x0
ACP SEP [7 - Audio Source] item 7/7
0001 11.. = SEID: 7
.... ..0. = In Use: False (0x0)
.... ...0 = RFA0: 0x0
0000 .... = Media Type: Audio (0x0)
.... 0... = Type: Source (0x0)
.... .000 = RFA1: 0x0远端回复共有7个sep，每个sep的类型都是Audio Source，对应的每个sep都分配了响应的seid；
- SEP：SEP，流端点，流端点是为了协商一个流而公开可用传输服务和A/V功能的应用程序
- SEID：SEP的ID
- In Use：表示这个SEP是否被使用，为0代表未被使用，1代表已被使用，目前状态都是未使用状态；
- Media Type：0代表audio、1代表video；
- TESP：表示Stream End Point类型，0代表SRC（Audio Source），1代表SNK（Audio Sink）；
Sent Command - GetAllCapabilities - ACP SEID [x - Audio Source]
接下来发送get capability和set configuration指令，该过程类似l2cap的配置过程，首先INT端（发起avdtp连接的一方叫INT）向ACP端（接受avdtp连接的一方）发送get capability command：
yaml
Bluetooth L2CAP Protocol
Length: 3
CID: Dynamically Allocated Channel (0x005f)
[Connect in frame: 995]
[Disconnect in frame: 1216]
[Service: Audio Source (0x110a)]
[PSM: AVDTP (0x0019)]
Bluetooth AVDTP Protocol
Signal: GetAllCapabilities (Command)
0001 .... = Transaction: 0x1
.... 00.. = Packet Type: Single (0x0)
.... ..00 = Message Type: Command (0x0)
00.. .... = RFA: 0x0
..00 1100 = Signal: GetAllCapabilities (0x0c)
ACP SEID [1 - Audio Source]
0000 01.. = ACP SEID: 1
.... ..00 = RFA: 0x0然后对方回复支持的codec信息，包括编码格式是sbc（蓝牙sink默认必须支持的一项选项了），采样率、压缩比等等，都是音频相关配置的东西；
yaml
Bluetooth L2CAP Protocol
Length: 12
CID: Dynamically Allocated Channel (0x0057)
[Connect in frame: 995]
[Disconnect in frame: 1216]
[Service: Audio Source (0x110a)]
[PSM: AVDTP (0x0019)]
Bluetooth AVDTP Protocol
Signal: GetAllCapabilities (ResponseAccept)
0001 .... = Transaction: 0x1
.... 00.. = Packet Type: Single (0x0)
.... ..10 = Message Type: ResponseAccept (0x2)
00.. .... = RFA: 0x0
..00 1100 = Signal: GetAllCapabilities (0x0c)
Capabilities
Service: Media Transport
Service Category: Media Transport (0x01)
Length of Service Category: 0x00
Service: Media Codec - Audio SBC (44100 | Mono JointStereo | block: 4 8 12 16 | subbands: 8 | allocation: Loudness | bitpool: 2..53)
Service Category: Media Codec (0x07)
Length of Service Category: 0x06
0000 .... = Media Type: Audio (0x0)
.... 0000 = RFA: 0x0
Media Codec Audio Type: SBC (0x00)
0... .... = Sampling Frequency 16000 Hz: False
.0.. .... = Sampling Frequency 32000 Hz: False
..1. .... = Sampling Frequency 44100 Hz: True
...0 .... = Sampling Frequency 48000 Hz: False
.... 1... = Channel Mode Mono: True
.... .0.. = Channel Mode Dual Channel: False
.... ..0. = Channel Mode Stereo: False
.... ...1 = Channel Mode Joint Stereo: True
1... .... = Block Length 4: True
.1.. .... = Block Length 8: True
..1. .... = Block Length 12: True
...1 .... = Block Length 16: True
.... 0... = Subbands 4: False
.... .1.. = Subbands 8: True
.... ..0. = Allocation Method SNR: False
.... ...1 = Allocation Method Loudness: True
Minimum Bitpool: 2
Maximum Bitpool: 53- Service Category：服务类型
上述的一组Request-Response是针对SEID = 1的配置请求，一共有7个sep，则会进行7组Request-Response配置；
yaml
Bluetooth AVDTP Protocol
Signal: GetAllCapabilities (Command)
0010 .... = Transaction: 0x2
.... 00.. = Packet Type: Single (0x0)
.... ..00 = Message Type: Command (0x0)
00.. .... = RFA: 0x0
..00 1100 = Signal: GetAllCapabilities (0x0c)
ACP SEID [2 - Audio Source]
0000 10.. = ACP SEID: 2
.... ..00 = RFA: 0x0
yaml
Bluetooth AVDTP Protocol
Signal: GetAllCapabilities (ResponseAccept)
0010 .... = Transaction: 0x2
.... 00.. = Packet Type: Single (0x0)
.... ..10 = Message Type: ResponseAccept (0x2)
00.. .... = RFA: 0x0
..00 1100 = Signal: GetAllCapabilities (0x0c)
Capabilities
Service: Media Transport
Service Category: Media Transport (0x01)
Length of Service Category: 0x00
Service: Media Codec - Audio MPEG-2,4 AAC
Service Category: Media Codec (0x07)
Length of Service Category: 0x08
0000 .... = Media Type: Audio (0x0)
.... 0000 = RFA: 0x0
Media Codec Audio Type: MPEG-2,4 AAC (0x02)
1... .... = MPEG2 AAC LC: True
.0.. .... = MPEG4 AAC LC: False
..0. .... = MPEG4 AAC LTP: False
...0 .... = MPEG4 AAC Scalable: False
.... 0000 = RFA: 0x0
0... .... = Sampling Frequency 8000 Hz: False
.0.. .... = Sampling Frequency 11025 Hz: False
..0. .... = Sampling Frequency 12000 Hz: False
...0 .... = Sampling Frequency 16000 Hz: False
.... 0... = Sampling Frequency 22050 Hz: False
.... .0.. = Sampling Frequency 24000 Hz: False
.... ..0. = Sampling Frequency 32000 Hz: False
.... ...1 = Sampling Frequency 44100 Hz: True
0... .... = Sampling Frequency 48000 Hz: False
.0.. .... = Sampling Frequency 64000 Hz: False
..0. .... = Sampling Frequency 88200 Hz: False
...0 .... = Sampling Frequency 96000 Hz: False
.... 0... = Channels 1: False
.... .1.. = Channels 2: True
.... ..00 = RFA: 0x0
0... .... .... .... .... .... = VBR Supported: False
.000 0010 1110 1110 0000 0000 = Bit Rate: 0x02ee00第三组的Response：
yaml
Bluetooth AVDTP Protocol
Signal: GetAllCapabilities (ResponseAccept)
0011 .... = Transaction: 0x3
.... 00.. = Packet Type: Single (0x0)
.... ..10 = Message Type: ResponseAccept (0x2)
00.. .... = RFA: 0x0
..00 1100 = Signal: GetAllCapabilities (0x0c)
Capabilities
Service: Media Transport
Service Category: Media Transport (0x01)
Length of Service Category: 0x00
Service: Media Codec - Audio non-A2DP (LDAC - 44100 48000 96000, DualChannel Stereo)
Service Category: Media Codec (0x07)
Length of Service Category: 0x0a
0000 .... = Media Type: Audio (0x0)
.... 0000 = RFA: 0x0
Media Codec Audio Type: non-A2DP (0xff)
Vendor ID: Sony Corporation (0x0000012d)
Codec: LDAC (0x00aa)
00.. .... = RFA1: 0x0
..1. .... = Sampling Frequency 44100 Hz: True
...1 .... = Sampling Frequency 48000 Hz: True
.... 0... = Sampling Frequency 88200 Hz: False
.... .1.. = Sampling Frequency 96000 Hz: True
.... ..0. = Sampling Frequency 176400 Hz: False
.... ...0 = Sampling Frequency 192000 Hz: False
0000 0... = RFA2: 0x00
.... .0.. = Channel Mode Mono: False
.... ..1. = Channel Mode Dual Channel: True
.... ...1 = Channel Mode Stereo: TrueSent Command - SetConfiguration -ACP SEID [2 - Audio Source] - INT SEID [2 - Audio Source]
yaml
Bluetooth AVDTP Protocol
Signal: SetConfiguration (Command)
1000 .... = Transaction: 0x8
.... 00.. = Packet Type: Single (0x0)
.... ..00 = Message Type: Command (0x0)
00.. .... = RFA: 0x0
..00 0011 = Signal: SetConfiguration (0x03)
ACP SEID [2 - Audio Source]
0000 10.. = ACP SEID: 2
.... ..00 = RFA: 0x0
INT SEID [2 - Audio Source]
0000 10.. = INT SEID: 2
.... ..00 = RFA: 0x0
Capabilities
Service: Media Transport
Service Category: Media Transport (0x01)
Length of Service Category: 0x00
Service: Media Codec - Audio MPEG-2,4 AAC
Service Category: Media Codec (0x07)
Length of Service Category: 0x08
0000 .... = Media Type: Audio (0x0)
.... 0000 = RFA: 0x0
Media Codec Audio Type: MPEG-2,4 AAC (0x02)
1... .... = MPEG2 AAC LC: True
.0.. .... = MPEG4 AAC LC: False
..0. .... = MPEG4 AAC LTP: False
...0 .... = MPEG4 AAC Scalable: False
.... 0000 = RFA: 0x0
0... .... = Sampling Frequency 8000 Hz: False
.0.. .... = Sampling Frequency 11025 Hz: False
..0. .... = Sampling Frequency 12000 Hz: False
...0 .... = Sampling Frequency 16000 Hz: False
.... 0... = Sampling Frequency 22050 Hz: False
.... .0.. = Sampling Frequency 24000 Hz: False
.... ..0. = Sampling Frequency 32000 Hz: False
.... ...1 = Sampling Frequency 44100 Hz: True
0... .... = Sampling Frequency 48000 Hz: False
.0.. .... = Sampling Frequency 64000 Hz: False
..0. .... = Sampling Frequency 88200 Hz: False
...0 .... = Sampling Frequency 96000 Hz: False
.... 0... = Channels 1: False
.... .1.. = Channels 2: True
.... ..00 = RFA: 0x0
0... .... .... .... .... .... = VBR Supported: False
.000 0010 1110 1110 0000 0000 = Bit Rate: 0x02ee00该命令用于在get Capabilities之后，选择特定的功能参数；
该指令选择的SEID = 2，即选用的Media Codec = Audio MPEG-2,4 AAC，采样率 = 44100Hz，通道 = 2代表了选用了第二通道；
yaml
Bluetooth AVDTP Protocol
Signal: SetConfiguration (ResponseAccept)
1000 .... = Transaction: 0x8
.... 00.. = Packet Type: Single (0x0)
.... ..10 = Message Type: ResponseAccept (0x2)
00.. .... = RFA: 0x0
..00 0011 = Signal: SetConfiguration (0x03)用于响应SetConfiguration Request；
Sent Command - Open - ACP SEID [2 - Audio Source]
yaml
Bluetooth AVDTP Protocol
Signal: Open (Command)
1001 .... = Transaction: 0x9
.... 00.. = Packet Type: Single (0x0)
.... ..00 = Message Type: Command (0x0)
00.. .... = RFA: 0x0
..00 0110 = Signal: Open (0x06)
ACP SEID [2 - Audio Source]
0000 10.. = ACP SEID: 2
.... ..00 = RFA: 0x0该指令用于在configuration成功之后，开启指定SEP的流；用于车机端告知手机端开启手机侧的AudioSource 流；
最后通过ResponseAccept的方式回复开启成功；
Rcvd Command - Discover
yaml
Bluetooth AVDTP Protocol
Signal: Discover (Command)
0000 .... = Transaction: 0x0
.... 00.. = Packet Type: Single (0x0)
.... ..00 = Message Type: Command (0x0)
00.. .... = RFA: 0x0
..00 0001 = Signal: Discover (0x01)这个是手机侧向车机侧发送搜索指令，用于搜索车机侧共有几个sep；
yaml
Bluetooth AVDTP Protocol
Signal: Discover (ResponseAccept)
0000 .... = Transaction: 0x0
.... 00.. = Packet Type: Single (0x0)
.... ..10 = Message Type: ResponseAccept (0x2)
00.. .... = RFA: 0x0
..00 0001 = Signal: Discover (0x01)
ACP SEP [1 - Audio Sink] item 1/2
0000 01.. = SEID: 1
.... ..0. = In Use: False (0x0)
.... ...0 = RFA0: 0x0
0000 .... = Media Type: Audio (0x0)
.... 1... = Type: Sink (0x1)
.... .000 = RFA1: 0x0
ACP SEP [2 - Audio Sink] item 2/2
0000 10.. = SEID: 2
.... ..1. = In Use: True (0x1)
.... ...0 = RFA0: 0x0
0000 .... = Media Type: Audio (0x0)
.... 1... = Type: Sink (0x1)
.... .000 = RFA1: 0x0车机侧共有两个sep，其中ACP SEP = 2的In Use = true表明了已被使用；
Rcvd Command - GetAllCapabilities - ACP SEID [x - Audio Sink]
第一组：
yaml
Bluetooth L2CAP Protocol
Length: 3
CID: Dynamically Allocated Channel (0x0057)
[Connect in frame: 995]
[Disconnect in frame: 1216]
[Service: Audio Source (0x110a)]
[PSM: AVDTP (0x0019)]
Bluetooth AVDTP Protocol
Signal: GetCapabilities (Command)
0001 .... = Transaction: 0x1
.... 00.. = Packet Type: Single (0x0)
.... ..00 = Message Type: Command (0x0)
00.. .... = RFA: 0x0
..00 0010 = Signal: GetCapabilities (0x02)
ACP SEID [1 - Audio Sink]
0000 01.. = ACP SEID: 1
.... ..00 = RFA: 0x0
yaml
Bluetooth AVDTP Protocol
Signal: GetCapabilities (ResponseAccept)
0001 .... = Transaction: 0x1
.... 00.. = Packet Type: Single (0x0)
.... ..10 = Message Type: ResponseAccept (0x2)
00.. .... = RFA: 0x0
..00 0010 = Signal: GetCapabilities (0x02)
Capabilities
Service: Media Transport
Service Category: Media Transport (0x01)
Length of Service Category: 0x00
Service: Media Codec - Audio SBC (44100 48000 | Mono DualChannel Stereo JointStereo | block: 4 8 12 16 | subbands: 4 8 | allocation: SNR Loudness | bitpool: 2..53)
Service Category: Media Codec (0x07)
Length of Service Category: 0x06
0000 .... = Media Type: Audio (0x0)
.... 0000 = RFA: 0x0
Media Codec Audio Type: SBC (0x00)
0... .... = Sampling Frequency 16000 Hz: False
.0.. .... = Sampling Frequency 32000 Hz: False
..1. .... = Sampling Frequency 44100 Hz: True
...1 .... = Sampling Frequency 48000 Hz: True
.... 1... = Channel Mode Mono: True
.... .1.. = Channel Mode Dual Channel: True
.... ..1. = Channel Mode Stereo: True
.... ...1 = Channel Mode Joint Stereo: True
1... .... = Block Length 4: True
.1.. .... = Block Length 8: True
..1. .... = Block Length 12: True
...1 .... = Block Length 16: True
.... 1... = Subbands 4: True
.... .1.. = Subbands 8: True
.... ..1. = Allocation Method SNR: True
.... ...1 = Allocation Method Loudness: True
Minimum Bitpool: 2
Maximum Bitpool: 53第二组：
yaml
Bluetooth AVDTP Protocol
Signal: GetCapabilities (Command)
0010 .... = Transaction: 0x2
.... 00.. = Packet Type: Single (0x0)
.... ..00 = Message Type: Command (0x0)
00.. .... = RFA: 0x0
..00 0010 = Signal: GetCapabilities (0x02)
ACP SEID [2 - Audio Sink]
0000 10.. = ACP SEID: 2
.... ..00 = RFA: 0x0
yaml
Bluetooth AVDTP Protocol
Signal: GetCapabilities (ResponseAccept)
0010 .... = Transaction: 0x2
.... 00.. = Packet Type: Single (0x0)
.... ..10 = Message Type: ResponseAccept (0x2)
00.. .... = RFA: 0x0
..00 0010 = Signal: GetCapabilities (0x02)
Capabilities
Service: Media Transport
Service Category: Media Transport (0x01)
Length of Service Category: 0x00
Service: Media Codec - Audio MPEG-2,4 AAC
Service Category: Media Codec (0x07)
Length of Service Category: 0x08
0000 .... = Media Type: Audio (0x0)
.... 0000 = RFA: 0x0
Media Codec Audio Type: MPEG-2,4 AAC (0x02)
1... .... = MPEG2 AAC LC: True
.0.. .... = MPEG4 AAC LC: False
..0. .... = MPEG4 AAC LTP: False
...0 .... = MPEG4 AAC Scalable: False
.... 0000 = RFA: 0x0
0... .... = Sampling Frequency 8000 Hz: False
.0.. .... = Sampling Frequency 11025 Hz: False
..0. .... = Sampling Frequency 12000 Hz: False
...0 .... = Sampling Frequency 16000 Hz: False
.... 0... = Sampling Frequency 22050 Hz: False
.... .0.. = Sampling Frequency 24000 Hz: False
.... ..0. = Sampling Frequency 32000 Hz: False
.... ...1 = Sampling Frequency 44100 Hz: True
1... .... = Sampling Frequency 48000 Hz: True
.0.. .... = Sampling Frequency 64000 Hz: False
..0. .... = Sampling Frequency 88200 Hz: False
...0 .... = Sampling Frequency 96000 Hz: False
.... 1... = Channels 1: True
.... .1.. = Channels 2: True
.... ..00 = RFA: 0x0
1... .... .... .... .... .... = VBR Supported: True
.000 0100 1110 0010 0000 0000 = Bit Rate: 0x04e200- Media Codec：Audio MPEG-2,4 AAC
- Sampling：44100Hz / 44800Hz
- Channels 1：true，第一个声道可用
- Channels 2：true，第二个声道可用
- VBR Supported = true：码率，VBR代表了动态码率；
Sent Command - Close - ACP SEID [2 - Audio Source]
yaml
Bluetooth AVDTP Protocol
Signal: Close (Command)
1010 .... = Transaction: 0xa
.... 00.. = Packet Type: Single (0x0)
.... ..00 = Message Type: Command (0x0)
00.. .... = RFA: 0x0
..00 1000 = Signal: Close (0x08)
ACP SEID [2 - Audio Source]
0000 10.. = ACP SEID: 2
.... ..00 = RFA: 0x0该指令用于关闭指定的SEID；这个命令在关闭或者是断开连接的时候会发送该指令；
对应通过ResponseAccept回复结果；
AVRCP _ Control
Sent Connection Request
这个Command用来建立两个设备之间的L2CAP channel，我们不过多的展开描述，我们直接看该过程中对应的ServiceSearchAttributeRequest的结果：
yaml
Bluetooth SDP Protocol
PDU: Service Search Attribute Request (0x06)
Transaction Id: 0x0000
Parameter Length: 25
Service Search Pattern: A/V Remote Control
Data Element: Sequence uint8 3 bytes
0011 0... = Data Element Type: Sequence (6)
.... .101 = Data Element Size: uint8 (5)
Data Element Var Size: 3
Data Value
Data Element: UUID 2 bytes
0001 1... = Data Element Type: UUID (3)
.... .001 = Data Element Size: 2 bytes (1)
Data Value
Value: UUID: A/V Remote Control (0x110e)
Maximum Attribute Byte Count: 1008
Attribute ID List
Data Element: Sequence uint8 15 bytes
0011 0... = Data Element Type: Sequence (6)
.... .101 = Data Element Size: uint8 (5)
Data Element Var Size: 15
Data Value
Attribute ID: Service Class ID List
Data Element: Unsigned Integer 2 bytes
0000 1... = Data Element Type: Unsigned Integer (1)
.... .001 = Data Element Size: 2 bytes (1)
Data Value
Attribute ID: Service Class ID List (0x0001)
Attribute ID: Protocol Descriptor List
Data Element: Unsigned Integer 2 bytes
0000 1... = Data Element Type: Unsigned Integer (1)
.... .001 = Data Element Size: 2 bytes (1)
Data Value
Attribute ID: Protocol Descriptor List (0x0004)
Attribute ID: Bluetooth Profile Descriptor List
Data Element: Unsigned Integer 2 bytes
0000 1... = Data Element Type: Unsigned Integer (1)
.... .001 = Data Element Size: 2 bytes (1)
Data Value
Attribute ID: Bluetooth Profile Descriptor List (0x0009)
Attribute ID: Additional Protocol Descriptor Lists
Data Element: Unsigned Integer 2 bytes
0000 1... = Data Element Type: Unsigned Integer (1)
.... .001 = Data Element Size: 2 bytes (1)
Data Value
Attribute ID: Additional Protocol Descriptor Lists (0x000d)
Attribute ID: Supported Features (AVRCP)
Data Element: Unsigned Integer 2 bytes
0000 1... = Data Element Type: Unsigned Integer (1)
.... .001 = Data Element Size: 2 bytes (1)
Data Value
Attribute ID: Supported Features (0x0311)
Continuation State: no (00)该请求中对应的UUID为A/V Remote Control；
yaml
Bluetooth SDP Protocol
PDU: Service Search Attribute Response (0x07)
Transaction Id: 0x0000
Parameter Length: 79
Attribute List Byte Count: 76
Attribute Lists [count = 1]
Data Element: Sequence uint8 74 bytes
0011 0... = Data Element Type: Sequence (6)
.... .101 = Data Element Size: uint8 (5)
Data Element Var Size: 74
Data Value
Attribute List [count = 5] (A/V Remote Control Target)
Data Element: Sequence uint16 71 bytes
0011 0... = Data Element Type: Sequence (6)
.... .110 = Data Element Size: uint16 (6)
Data Element Var Size: 71
Data Value
Service Attribute: Service Class ID List (0x1), value = A/V Remote Control Target
Attribute ID: Service Class ID List
Data Element: Unsigned Integer 2 bytes
0000 1... = Data Element Type: Unsigned Integer (1)
.... .001 = Data Element Size: 2 bytes (1)
Data Value
Attribute ID: Service Class ID List (0x0001)
Value
Data Element: Sequence uint8 3 bytes
0011 0... = Data Element Type: Sequence (6)
.... .101 = Data Element Size: uint8 (5)
Data Element Var Size: 3
Data Value
Data Element: UUID 2 bytes
0001 1... = Data Element Type: UUID (3)
.... .001 = Data Element Size: 2 bytes (1)
Data Value
Value: UUID: A/V Remote Control Target (0x110c)
Service Attribute: Protocol Descriptor List (0x4), value = L2CAP:23 -> AVCTP (1.3)
Attribute ID: Protocol Descriptor List
Data Element: Unsigned Integer 2 bytes
0000 1... = Data Element Type: Unsigned Integer (1)
.... .001 = Data Element Size: 2 bytes (1)
Data Value
Attribute ID: Protocol Descriptor List (0x0004)
Value
Data Element: Sequence uint8 16 bytes
0011 0... = Data Element Type: Sequence (6)
.... .101 = Data Element Size: uint8 (5)
Data Element Var Size: 16
Data Value
Protocol #1: L2CAP, PSM: 23
Data Element: Sequence uint8 6 bytes
0011 0... = Data Element Type: Sequence (6)
.... .101 = Data Element Size: uint8 (5)
Data Element Var Size: 6
Data Value
Protocol Entry: L2CAP, PSM: 23
Data Element: UUID 2 bytes
0001 1... = Data Element Type: UUID (3)
.... .001 = Data Element Size: 2 bytes (1)
Data Value
Value: UUID: L2CAP (0x0100)
Data Element: Unsigned Integer 2 bytes
0000 1... = Data Element Type: Unsigned Integer (1)
.... .001 = Data Element Size: 2 bytes (1)
Data Value
L2CAP PSM: AVCTP-Control (23)
Protocol #2: AVCTP, Version 1.3
Data Element: Sequence uint8 6 bytes
0011 0... = Data Element Type: Sequence (6)
.... .101 = Data Element Size: uint8 (5)
Data Element Var Size: 6
Data Value
Protocol Entry: AVCTP, Version 0x103
Data Element: UUID 2 bytes
0001 1... = Data Element Type: UUID (3)
.... .001 = Data Element Size: 2 bytes (1)
Data Value
Value: UUID: AVCTP (0x0017)
Data Element: Unsigned Integer 2 bytes
0000 1... = Data Element Type: Unsigned Integer (1)
.... .001 = Data Element Size: 2 bytes (1)
Data Value
Protocol Version: 0x0103
Service Attribute: Bluetooth Profile Descriptor List (0x9), value = A/V Remote Control 1.4
Attribute ID: Bluetooth Profile Descriptor List
Data Element: Unsigned Integer 2 bytes
0000 1... = Data Element Type: Unsigned Integer (1)
.... .001 = Data Element Size: 2 bytes (1)
Data Value
Attribute ID: Bluetooth Profile Descriptor List (0x0009)
Value
Data Element: Sequence uint8 8 bytes
0011 0... = Data Element Type: Sequence (6)
.... .101 = Data Element Size: uint8 (5)
Data Element Var Size: 8
Data Value
Data Element: Sequence uint8 6 bytes
0011 0... = Data Element Type: Sequence (6)
.... .101 = Data Element Size: uint8 (5)
Data Element Var Size: 6
Data Value
Profile Descriptor List #1: A/V Remote Control, Version 1.4
Data Element: UUID 2 bytes
0001 1... = Data Element Type: UUID (3)
.... .001 = Data Element Size: 2 bytes (1)
Data Value
Value: UUID: A/V Remote Control (0x110e)
Data Element: Unsigned Integer 2 bytes
0000 1... = Data Element Type: Unsigned Integer (1)
.... .001 = Data Element Size: 2 bytes (1)
Data Value
Protocol Version: 0x0104
Service Attribute: Additional Protocol Descriptor Lists (0xd), value = [L2CAP:27 -> AVCTP (1.3)]
Attribute ID: Additional Protocol Descriptor Lists
Data Element: Unsigned Integer 2 bytes
0000 1... = Data Element Type: Unsigned Integer (1)
.... .001 = Data Element Size: 2 bytes (1)
Data Value
Attribute ID: Additional Protocol Descriptor Lists (0x000d)
Value
Data Element: Sequence uint8 18 bytes
0011 0... = Data Element Type: Sequence (6)
.... .101 = Data Element Size: uint8 (5)
Data Element Var Size: 18
Data Value
Data Element: Sequence uint8 16 bytes
0011 0... = Data Element Type: Sequence (6)
.... .101 = Data Element Size: uint8 (5)
Data Element Var Size: 16
Data Value
Protocol Descriptor List #1
Protocol #1: L2CAP, PSM: 27
Data Element: Sequence uint8 6 bytes
0011 0... = Data Element Type: Sequence (6)
.... .101 = Data Element Size: uint8 (5)
Data Element Var Size: 6
Data Value
Protocol Entry: L2CAP, PSM: 27
Data Element: UUID 2 bytes
0001 1... = Data Element Type: UUID (3)
.... .001 = Data Element Size: 2 bytes (1)
Data Value
Value: UUID: L2CAP (0x0100)
Data Element: Unsigned Integer 2 bytes
0000 1... = Data Element Type: Unsigned Integer (1)
.... .001 = Data Element Size: 2 bytes (1)
Data Value
L2CAP PSM: AVCTP-Browsing (27)
Protocol #2: AVCTP, Version 1.3
Data Element: Sequence uint8 6 bytes
0011 0... = Data Element Type: Sequence (6)
.... .101 = Data Element Size: uint8 (5)
Data Element Var Size: 6
Data Value
Protocol Entry: AVCTP, Version 0x103
Data Element: UUID 2 bytes
0001 1... = Data Element Type: UUID (3)
.... .001 = Data Element Size: 2 bytes (1)
Data Value
Value: UUID: AVCTP (0x0017)
Data Element: Unsigned Integer 2 bytes
0000 1... = Data Element Type: Unsigned Integer (1)
.... .001 = Data Element Size: 2 bytes (1)
Data Value
Protocol Version: 0x0103
Service Attribute: (AVRCP) Supported Features (0x311), value = Category1(Player/Recorder) PlayerApplicationSettings Browsing MultiplePlayers
Attribute ID: Supported Features
Data Element: Unsigned Integer 2 bytes
0000 1... = Data Element Type: Unsigned Integer (1)
.... .001 = Data Element Size: 2 bytes (1)
Data Value
Attribute ID: Supported Features (0x0311)
Value
Data Element: Unsigned Integer 2 bytes
0000 1... = Data Element Type: Unsigned Integer (1)
.... .001 = Data Element Size: 2 bytes (1)
Data Value
0000 000. .... .... = Supported Features: Reserved: 0x00
.... ...0 .... .... = Supported Features: Cover Art: False
.... .... 1... .... = Supported Features: Multiple Player: True
.... .... .1.. .... = Supported Features: Browsing: True
.... .... ..0. .... = Supported Features: Group Navigation: False
.... .... ...1 .... = Supported Features: Settings: True
.... .... .... 0... = Supported Features: Category 4: Menu: False
.... .... .... .0.. = Supported Features: Category 3: Tuner: False
.... .... .... ..0. = Supported Features: Category 2: Monitor/Amplifier: False
.... .... .... ...1 = Supported Features: Category 1: Player/Recorder: True
Continuation State: no (00)AVRCP协议基于的Protocol为L2CAP和AVCTP；
然后SDP结束Connection；
Sent Connection Request (AVCTP-Control)
AVRCP的连接是基于L2CAP通道的，而AVRCP协议的底层协议为AVCTP，所以连接AVRCP协议请求是通过L2CAP发送AVCTP协议Connection Request实现的；
yaml
Bluetooth L2CAP Protocol
Length: 8
CID: L2CAP Signaling Channel (0x0001)
Command: Connection Request
Command Code: Connection Request (0x02)
Command Identifier: 0x17
Command Length: 4
PSM: AVCTP-Control (0x0017)
Source CID: Dynamically Allocated Channel (0x005a)
[Service: A/V Remote Control Target (0x110c)]
[Disconnect in frame: 1215]Sent Vendor dependent: Status - GetCapabilities (Company ID)
yaml
Bluetooth L2CAP Protocol
Length: 14
CID: Dynamically Allocated Channel (0x0051)
[Connect in frame: 1112]
[Disconnect in frame: 1215]
[Service: A/V Remote Control Target (0x110c)]
[PSM: AVCTP-Control (0x0017)]
Bluetooth AVCTP Protocol
0000 .... = Transaction: 0x0
.... 00.. = Packet Type: Single (0x0)
.... ..0. = C/R: Command (0x0)
.... ...0 = IPID: Profile OK (0x0)
Profile Identifier: A/V Remote Control (0x110e)
Bluetooth AVRCP Profile
0000 .... = Reserved: 0x0
.... 0001 = Ctype: Status (0x1)
0100 1... = Subunit Type: Panel (0x09)
.... .000 = Subunit ID: 0x0
Opcode: Vendor dependent (0x00)
Company ID: 00:19:58 (Bluetooth SIG, Inc.)
PDU ID: GetCapabilities (0x10)
0000 00.. = RFA: 0x00
.... ..00 = Packet Type: Single (0x0)
Parameter Length: 1
Capability: Company ID (0x02)
[Response Time: 9/1000ms]
[Response in frame: 1134]- Capability：需要获取的能力，这里指定了Company ID；
这个命令是CT发给TG的，用于获得TG支持哪些Company；
yaml
Bluetooth AVRCP Profile
0000 .... = Reserved: 0x0
.... 1100 = Ctype: Stable (0xc)
0100 1... = Subunit Type: Panel (0x09)
.... .000 = Subunit ID: 0x0
Opcode: Vendor dependent (0x00)
Company ID: 00:19:58 (Bluetooth SIG, Inc.)
PDU ID: GetCapabilities (0x10)
0000 00.. = RFA: 0x00
.... ..00 = Packet Type: Single (0x0)
Parameter Length: 8
Capability: Company ID (0x02)
Capability Count: 0x02
Company ID: 00:19:58 (Bluetooth SIG, Inc.)
Company ID: 00:23:45 (Sony Mobile Communica
[Response Time: 9/1000ms]
[Command in frame: 1122]TG回复支持的Company ID有两个：
-
Capability Count：支持的Company ID个数；
- Bluetooth SIG, Inc.
- Sony Mobile Communica
Sent Vendor dependent: Status - GetCapabilities (Events Supported)
yaml
Bluetooth L2CAP Protocol
Length: 14
CID: Dynamically Allocated Channel (0x0051)
[Connect in frame: 1112]
[Disconnect in frame: 1215]
[Service: A/V Remote Control Target (0x110c)]
[PSM: AVCTP-Control (0x0017)]
Bluetooth AVCTP Protocol
0001 .... = Transaction: 0x1
.... 00.. = Packet Type: Single (0x0)
.... ..0. = C/R: Command (0x0)
.... ...0 = IPID: Profile OK (0x0)
Profile Identifier: A/V Remote Control (0x110e)
Bluetooth AVRCP Profile
0000 .... = Reserved: 0x0
.... 0001 = Ctype: Status (0x1)
0100 1... = Subunit Type: Panel (0x09)
.... .000 = Subunit ID: 0x0
Opcode: Vendor dependent (0x00)
Company ID: 00:19:58 (Bluetooth SIG, Inc.)
PDU ID: GetCapabilities (0x10)
0000 00.. = RFA: 0x00
.... ..00 = Packet Type: Single (0x0)
Parameter Length: 1
Capability: Events Supported (0x03)
[Response Time: 6/1000ms]
[Response in frame: 1144]这个命令是CT发给TG的，用于获得TG支持哪些event；
yaml
Bluetooth AVRCP Profile
0000 .... = Reserved: 0x0
.... 1100 = Ctype: Stable (0xc)
0100 1... = Subunit Type: Panel (0x09)
.... .000 = Subunit ID: 0x0
Opcode: Vendor dependent (0x00)
Company ID: 00:19:58 (Bluetooth SIG, Inc.)
PDU ID: GetCapabilities (0x10)
0000 00.. = RFA: 0x00
.... ..00 = Packet Type: Single (0x0)
Parameter Length: 10
Capability: Events Supported (0x03)
Capability Count: 0x08
Event ID: PlaybackStatusChanged (0x01)
Event ID: TrackChanged (0x02)
Event ID: PlaybackPositionChanged (0x05)
Event ID: PlayerApplicationSettingChanged (0x08)
Event ID: NowPlayingContentChanged (0x09)
Event ID: AvailablePlayersChanged (0x0a)
Event ID: AddressedPlayerChanged (0x0b)
Event ID: UIDsChanged (0x0c)
[Response Time: 6/1000ms]
[Command in frame: 1135]-
Capability Count：能力个数，代表了支持的Events个数
- PlaybackStatusChanged：播放状态变化
- TrackChanged：Track信息变化
- PlaybackPositionChanged：播放偏移量变化
- PlayerApplicationSettingChanged：播放器应用设置变化
- NowPlayingContentChanged：当前播放内容变化
- AvailablePlayersChanged：播放器可用状态变化
- AddressedPlayerChanged：播放器地址信息变化
- UIDsChanged：UID信息变化
Sent Vendor dependent: Notify - RegisterNotification - XXXXXXX
yaml
Bluetooth L2CAP Protocol
Length: 18
CID: Dynamically Allocated Channel (0x0051)
[Connect in frame: 1112]
[Disconnect in frame: 1215]
[Service: A/V Remote Control Target (0x110c)]
[PSM: AVCTP-Control (0x0017)]
Bluetooth AVCTP Protocol
0000 .... = Transaction: 0x0
.... 00.. = Packet Type: Single (0x0)
.... ..0. = C/R: Command (0x0)
.... ...0 = IPID: Profile OK (0x0)
Profile Identifier: A/V Remote Control (0x110e)
Bluetooth AVRCP Profile
0000 .... = Reserved: 0x0
.... 0011 = Ctype: Notify (0x3)
0100 1... = Subunit Type: Panel (0x09)
.... .000 = Subunit ID: 0x0
Opcode: Vendor dependent (0x00)
Company ID: 00:19:58 (Bluetooth SIG, Inc.)
PDU ID: RegisterNotification (0x31)
0000 00.. = RFA: 0x00
.... ..00 = Packet Type: Single (0x0)
Parameter Length: 5
Event ID: PlaybackStatusChanged (0x01)
Interval: 0
[Response Time: 14/1000ms]
[Response in frame: 1150]该指令用于注册PlaybackStatusChanged事件监听通知；
PlaybackStatusChanged对应的就是我们上述获取到的支持的Event，所以支持的Events都会通过Notify的方式注册事件监听；
在收到Vendor dependent指令时，TG不会立马回复应答，而是通过一个临时的回复作为应答；
yaml
Bluetooth AVRCP Profile
0000 .... = Reserved: 0x0
.... 1111 = Ctype: Interim (0xf)
0100 1... = Subunit Type: Panel (0x09)
.... .000 = Subunit ID: 0x0
Opcode: Vendor dependent (0x00)
Company ID: 00:19:58 (Bluetooth SIG, Inc.)
PDU ID: RegisterNotification (0x31)
0000 00.. = RFA: 0x00
.... ..00 = Packet Type: Single (0x0)
Parameter Length: 2
Event ID: PlaybackStatusChanged (0x01)
Play Status: Paused (0x02)
[Response Time: 14/1000ms]
[Command in frame: 1146]- Ctype：Command type，interim，临时的
- Play Status：Paused
正式的TG应答：
yaml
Bluetooth AVRCP Profile
0000 .... = Reserved: 0x0
.... 1101 = Ctype: Changed (0xd)
0100 1... = Subunit Type: Panel (0x09)
.... .000 = Subunit ID: 0x0
Opcode: Vendor dependent (0x00)
Company ID: 00:19:58 (Bluetooth SIG, Inc.)
PDU ID: RegisterNotification (0x31)
0000 00.. = RFA: 0x00
.... ..00 = Packet Type: Single (0x0)
Parameter Length: 2
Event ID: PlaybackStatusChanged (0x01)
Play Status: Paused (0x02)
[Response Time: 14/1000ms]
[Command in frame: 1146]- Ctype：Changed，代表了注册监听成功后，状态变化信息的上报；在首次注册成功后，首先会上报一帧变化状态；
其他的Event也同样如此；
Sent Vendor dependent: Status - GetElementAttributes
yaml
Bluetooth AVRCP Profile
0000 .... = Reserved: 0x0
.... 0001 = Ctype: Status (0x1)
0100 1... = Subunit Type: Panel (0x09)
.... .000 = Subunit ID: 0x0
Opcode: Vendor dependent (0x00)
Company ID: 00:19:58 (Bluetooth SIG, Inc.)
PDU ID: GetElementAttributes (0x20)
0000 00.. = RFA: 0x00
.... ..00 = Packet Type: Single (0x0)
Parameter Length: 37
Identifier: 0x0000000000000000
Number of Attributes: 7
Attribute List
Attribute ID: Title (0x00000001)
Attribute ID: Artist (0x00000002)
Attribute ID: Album (0x00000003)
Attribute ID: Media Number (0x00000004)
Attribute ID: Total Number of Media (0x00000005)
Attribute ID: Genre (0x00000006)
Attribute ID: Playing Time (0x00000007)
[Response Time: 19/1000ms]
[Response in frame: 1166]该指令用于获取当前媒体条目的元数据属性；
yaml
Bluetooth AVRCP Profile
0000 .... = Reserved: 0x0
.... 1100 = Ctype: Stable (0xc)
0100 1... = Subunit Type: Panel (0x09)
.... .000 = Subunit ID: 0x0
Opcode: Vendor dependent (0x00)
Company ID: 00:19:58 (Bluetooth SIG, Inc.)
PDU ID: GetElementAttributes (0x20)
0000 00.. = RFA: 0x00
.... ..00 = Packet Type: Single (0x0)
Parameter Length: 144
Number of Attributes: 7
Attribute Entries
Attribute [ Title]: ������������������������������������������
Attribute ID: Title (0x00000001)
Character Set: UTF-8 (106)
Value Length: 42
Value: 一个真正关心农村农民的自己人
Attribute [ Artist]: ���������������
Attribute ID: Artist (0x00000002)
Character Set: UTF-8 (106)
Value Length: 15
Value: 深圳金耳朵
Attribute [ Album]: ���������������������
Attribute ID: Album (0x00000003)
Character Set: UTF-8 (106)
Value Length: 21
Value: 温铁军演讲全集
Attribute [ Media Number]: 1
Attribute ID: Media Number (0x00000004)
Character Set: UTF-8 (106)
Value Length: 1
Value: 1
Attribute [Total Number of Media]: 1
Attribute ID: Total Number of Media (0x00000005)
Character Set: UTF-8 (106)
Value Length: 1
Value: 1
Attribute [ Genre]:
Attribute ID: Genre (0x00000006)
Character Set: UTF-8 (106)
Value Length: 0
Value:
Attribute [ Playing Time]: 6174424
Attribute ID: Playing Time (0x00000007)
Character Set: UTF-8 (106)
Value Length: 7
Value: 6174424
[Response Time: 19/1000ms]
[Command in frame: 1160]- Title：标题
- Artist：艺术家
- Album：专辑
- Media Number：媒体数量
- Total Num of Media：媒体总数
- Genre：类型
- Playing Time：播放时长