一.概述
在前面的文章中介绍了inquiry和ACL connection的建立过程。这个连接建立后,L2CAP signaling channel(CID = 0x0001)就已经存在,可以进行L2CAP连接
至此,本地L2CAP发送的Connection request已经被远端response,下面将会进行configure的过程,在下一篇中继续介绍。L2CAP connection的建立过程繁琐,涉及的HCI交互的command、event以及ACL Data很多,一些细节容易遗忘。这里还是需要把L2CAP连接的建立过程弄清楚,在整体的框架上进一步深化了解细节,这样对于蓝牙的相关协议会深刻些吧,以上。
二.基本概念
HCI ACL Data Format:
L2CAP的C-Frame,在signaling channel上使用,结构如下:
L2CAP是request-response的通信形式,signaling channel上发送一些控制信息,它的information payload是comamnd的形式,格式如下:
总结下来,就是一些控制信息在signaling channel上发送,采用的C-Frame,information域是上图request packet的形式。定义的commnand code可以查询Spec:page1415-1416。
三.一些步骤的分析
Frame29:L2CAP发出Information request,HCI收到ACL Data
HCI层看到的Data如下:
00001001 00100000 00001010 00000000 00000110 00000000 00000001 00000000 00001010 00011111 00000010 00000000 00000010 00000000
Connection Handle: 00001001 = 0x09 = 9 //占据12个bit
PB:0x10(First automatically flushable packet)
BC:0x00(No broadcast, point-to-point)
Total Length: 00001010 00000000 = 0x000A = 10
绿色部分是L2CAP的Data,前面是HCI层所做的包装.
PDU Length: 00000110 00000000 = 0x0006 = 6
Channel ID:00000001 00000000 = 0x0001(signaling channel)
Information payload:00001010 00011111 00000010 00000000 00000010 00000000
其中command code:00001010 = 0x0a = 10 (Information request)
Identifier:00011111 = 0x1f = 31(response与request保持相同,ps:貌似与opcode类似的样子!!)
Length:00000010 00000000 = 0x02 = 2
Data:00000010 00000000 = 0x02 (Extended features supported)
Frame30:相应的,HCI层发出HCI_Read_Remote_Extended_Features
该command的参数为
Connection_Handle
Page Number
00011100 00000100 00000011 00001001 00000000 00000001
opCode:00011100 = 0x041C
TotalLength = 00000011 =3
Connection handle:00001001 = 9
page Number = 00000000 00000001 = 0x0100(0x0000代表normal LMP features,其余根据page Number确定对应的feature)
Frame31:HCI收到ACL Data,是对方发来的发来的Information request。
这其实是一个互相交换information的过程。
Frame32:收到Max Slots Change event
该Event有两个参数:
Connection_Handle,
LMP_Max_Slots
00011011 00000011 00001001 00000000 00000101
EventCode:0x1b
Total Length: 3
Connection Handle: 9
LMP Max Slots: 5
这个应该是返回的extended feature吧
Frame33: Read_Remote_Extended_Supported_Features----Command Status
00001111 00000100 00000000 00000010 00011100 00000100
OpCode:0x0f
Total Length: 4
Status: Success 0x00
Number HCI Command Packets: 2
Opcode: 0x041c
Frame34:Read_Remote_Extended_Features_Complete event
该Event参数如下:
Status, Connection_Handle,
Page_Number,
Maximum page number,
Extended_LMP_Features
00100011 00001101 00000000 00001001 00000000 00000001 00000001 00000001 00000000 00000000 00000000 00000000 00000000 00000000 00000000
EventCode:0x23
Total Length: 00001101 = 13
Status: Request for remote extended features succeeded
Connection Handle: 0x00001001 = 9
Page Number = 00000000 00000001 = 0x01
Maximum Page Number: 0x01
Extended_LMP_Features: 0x0000000000000001 //根据FEATURE MASK来表示,支持就置为1,这里表示支持3 slot packets
以上完成了一个L2CAp的information request的过程,这个request要求的是Extended features supported,相应的HCI发送HCI_Read_Remote_Extended_Features,page Number为0x00000001,左后返回的
Read_Remote_Extended_Features_Complete event返回了需要读取的Feature,和相同的Page Number0x0000001。
Frame35-37发出Read_RSSI的Command,返回Number Of Completed Packets和command complete event。这个是在L2CAP发出Connection request之前必须的吗??
Frame38:L2CAP发出Connection request,HCI收到相应的ACL Data
00001001 00000000 00001100 00000000 00001000 00000000 00000001 00000000 00000010 00000100 00000100 00000000 00000001 00000000 01000000 00000000
Connection Handle: 00001001 000000 = 9
Broadcast Flag: No broadcast, point-to-point
Packet Boundary Flag: First non-automatically-flushable L2CAP packet
Total Length: 00001100 00000000 = 0x0c = 12
L2CAP部分:
PDU Length: 00001000 00000000 = 8
CID:00000001 000000000 = 0x0001(signaling Channel)
Command Code: 00000010 = 0x02(Connection request)
ID:00000100 = 4
length = 00000000 000000100 = 4
PSM: 00000001 00000000 = 0x0001 (SDP)
Source CID:01000000 00000000 = 0x0040 //定义了request发出和接收的CID
这个request发出,开始建立L2CAP的连接
Frame39:发出Write_Link_Policy_Settings command
Frame40:L2CAP对对方的information request进行response,ID是2
Frame41:对本地发送的information request的response,ID是31。
Frame42:本地L2CAP再次发送information request,ID为32,
Frame43:收到Write_Link_Policy_Settings command的command complete event
Frame44-47是Role discovery command和对应的event
Frame48:HCI收到ACL Data,远端L2CAP发出的对本地的connection request的response
00001001 00100000 00010000 00000000 00001100 00000000 00000001 00000000 00000011 00000100 00001000 00000000 01000100 00000000 01000000 00000000 00000001 00000000 00000000 00000000
Connection Handle: 9
Broadcast Flag: No broadcast, point-to-point
Packet Boundary Flag: First automatically-flushable L2CAP packet
Total Length: 16
L2CAP部分:
PDU Length: 12
Channel ID: 0x0001
Command Code: 00000000 00000011 =0x03 Connection response
Identifier: 4
Command Length: 8
Destination Channel ID: 01000100 00000000 = 0x0044 //发送这个response的CID
Source Channel ID:01000000 00000000 0x0040 //这个CID在request中确定下来
Result: 00000001 00000000 (Connection pending)
Status: No further information available
四.总结
1.概述
前面一篇博文已经介绍到远端设备对本地的Connection request进行了response,目前L2CAP的连接处于pending状态。这篇将继续抓取下面的一些packets,来看L2CAP Connection的建立过程。
Data:8个字节表示支持的fixed channel,p1427和p1430
这里表示支持L2CAP Signaling channel和AMP Manager Protocol Channel这两个fixed Channel
这次返回的是上面中介绍的Frame42:本地发送的ID为32的information request
InfoType: 0x03 Fixed Channels Supported //也是询问的支持的fixed channel
Result: Success
Data:8个字节表示支持的fixed channel,p1427和p1430
这里表示支持只支持L2CAP Signaling channel
在Frame48中本地已经收到远端的connection response,只是状态为pending,这里再次接受到connection response,也许表示成功了。如下:
00001001 00100000 00010000 00000000 00001100 00000000 00000001 00000000 00000011 00000100 00001000 00000000 01000100 00000000 01000000 00000000 00000000 00000000 00000000 00000000
Result: Connection successful
2.一些Frame
Frame50:HCI收到ACL Data,传到L2CAP层,是远端的information request
00001001 00100000 00001010 00000000 00000110 00000000 00000001 00000000 00001010 00000011 00000010 00000000 00000011 00000000
Connection Handle: 9
Broadcast Flag: No broadcast, point-to-point
Packet Boundary Flag: First automatically-flushable L2CAP packet
Total Length: 10
PDU Length: 6
Channel ID: 0x0001
Code: 00001010 = 0xa Information request
Identifier: 3
Command Length: 2
InfoType: 00000011 00000000 = 0x0003 Fixed Channels supported
注:这里远端设备显然查询本地设备支持的fixed Channel类型
Frame51:返回information response,HCI收到L2CAP层的ACL Data
00001001 00100000 00010100 00000000 00010000 00000000 00000001 00000000 00001011 00000011 00001100 00000000 00000011 00000000 00000000 00000000 00001010 00000000 00000000 00000000 00000000 00000000 00000000 00000000
这里只看重点部分:
Channel ID: 0x0001
Code: 00001011 = 0x0b Information response
InfoType: 00000011 00000000 = 0x03 Fixed Channels Supported
Result: Success
注:这里本地设备返回response,表明自己支持两个fixed channel,分别是L2CAP Signaling channel和AMP Manager Protocol Channel这两个fixed Channel。
Frame54:远端设备再次返回information response
00001001 00100000 00010100 00000000 00010000 00000000 00000001 00000000 00001011 00100000 00001100 00000000 00000011 00000000 00000000 00000000 00000010 00000000 00000000 00000000 00000000 00000000 00000000 00000000
Code: 0x0b Information response
Identifier: 0x20 = 32 //对应上次的information request
注:远端返回的information response表明其只支持L2CAP Signaling channel
Frame55-Frame61:HCI进行了一些command,Read_Clock_offset,Get_Link_Quality等。
Frame62:L2CAP收到远端的Connection response
00001001 00100000 00010000 00000000 00001100 00000000 00000001 00000000 00000011 00000100 00001000 00000000 01000100 00000000 01000000 00000000 00000000 00000000 00000000 00000000
Code: 0x03 Connection response
Destination Channel ID: 0x0044
Source Channel ID: 0x0040 //本地的CID,这个CID在本地发送connection request中确定
Status: Connection successful
注:到这里,本地发送的connection request已经被远端response,并且状态为成功。
//从这里开始,进入Configure 的过程
Frame63:本地发送Configure request
在这部分,本地部分主要是发送information requset和远端设备交换设备信息,发送connection requset建立L2CAP的连接,以及发送configure request进行参数配置。在这个过程里,远端的slave也会发送information requset和configure requset,双方进行信息交换和参数配置。至此,本地的configure部分结束,下面进行验证部分。
00001001 00000000 00010000 00000000 00001100 00000000 00000001 00000000 00000100 00000101 00001000 00000000 01000100 00000000 00000000 00000000 00000001 00000010 00000000 00000100
Identifier: 0x05 = 5
Destination Channel ID: 0x0044 //发送的目标设备的CID
我们看看configure 部分的结构:
Channel ID: 0x0001
Code: 0x04 Configure request
C Flag: Last Configuration Request
length:0x02 = 2
config data:0x0400 = 1024
注:本地发送的configure request是关于设置MTU的,这里配置的是1024。
Frame66:收到slave发送的configure request
00001001 00100000 00010000 00000000 00001100 00000000 00000001 00000000 00000100 00000100 00001000 00000000 01000000 00000000 00000000 00000000 00000001 00000010 00000000 00000001
Code: 0x03 Configure request
ID:0x04 =4
configure Type:0x01 关于MTU
length:0x02
Data:0x0100 = 256
注:也就是slave建议的MTU为256个字节。
Frame67:本地发送configure response
00001001 00000000 00001110 00000000 00001010 00000000 00000001 00000000 00000101 00000100 00000110 00000000 01000100 00000000 00000000 00000000 00000000 00000000
Code:0x05 Configure response
Identifier: 4 //对应Frame66slave的configure request
Results: Success
//这里奇怪的是应该还有两个字节的Config部分,这里怎么木有了。。。result后就结束了
注:这是本地设备对远端设备的configure request的resposne,结果是成功,应该是接受了远端设备256MTU的配置。
Frame73:远端返回configure resposne
00001001 00100000 00001110 00000000 00001010 00000000 00000001 00000000 00000101 00000101 00000110 00000000 01000000 00000000 00000000 00000000 00000000 00000000
Code: 0x05 Configure response
Identifier: 5
Source Channel ID: 0x0040
Results: Success
注:这里也没有config部分,到result域就结束了。。。不过成功表示接受了1024的MTU配置吧。
3.总结