Bluetooth GAIA protocol

While investigating the Bluetooth functionality of my Libratone Zipp wireless speaker I stumbled across a non-standard profile with UUID 00001107-d102-11e1-9b23-00025b00a5a5. It turned out to be a proprietary extension to Bluetooth called "GAIA protocol" and was made by Cambridge Silicon Radio CSR, which was bought by Qualcomm in 2015.

Profiles

Bluetooth is a communication standard that is split into a core specification that defines the basics, and "profiles" that specifiy the things that are wanted by humans: Accessing the phonebook for synchronization ("Phonebook Access Server"), transferring music from phone to bluetooth speaker ("Audio Sink"), controlling the volume of the speaker ("A/V Remote Control Target").

Each bluetooth device can provide several of those profiles. My Libratone Zipp speaker has the following:

$ bluetoothctl
Agent registered

[bluetooth]# scan le
Discovery started
[CHG] Controller 18:CF:5E:D7:23:42 Discovering: yes
[CHG] Device C4:67:B5:3F:23:42 RSSI: -50
[CHG] Device C4:67:B5:3F:23:42 TxPower: 0

[bluetooth]# info C4:67:B5:3F:23:42
Device C4:67:B5:3F:23:42 (public)
	Name: Libratone Zipp
	Alias: Libratone Zipp
	Class: 0x00240418
	Icon: audio-headphones
	Paired: yes
	Bonded: yes
	Trusted: no
	Blocked: no
	Connected: no
	LegacyPairing: no
	UUID: Vendor specific           (00001107-d102-11e1-9b23-00025b00a5a5)
	UUID: Headset                   (00001108-0000-1000-8000-00805f9b34fb)
	UUID: Audio Sink                (0000110b-0000-1000-8000-00805f9b34fb)
	UUID: A/V Remote Control Target (0000110c-0000-1000-8000-00805f9b34fb)
	UUID: A/V Remote Control        (0000110e-0000-1000-8000-00805f9b34fb)
	UUID: Handsfree                 (0000111e-0000-1000-8000-00805f9b34fb)
	UUID: PnP Information           (00001200-0000-1000-8000-00805f9b34fb)
	Modalias: bluetooth:v000Ap0001d0102
	RSSI: -50
	TxPower: 0

Each profile as a globally unique ID, the UUID. Profiles standardized by the Bluetooth Special Interests Group (SIG) have a 128bit-UUID in the form of 0000XXXX-0000-1000-8000-00805F9B34FB.

GAIA protocol

I wondered what the one vendor-specific profile was:

UUID: Vendor specific (00001107-d102-11e1-9b23-00025b00a5a5)

Since UUIDs are globally unique, searching for it yields very targeted results.

GAIA is the Generic Application Interface Architecture, which was originally thought up by Cambridge Silicon Radio and is now owned by Qualcomm.

There is no public specification available; you apparently have to sign a NDA to get it.

It seems to be a generic protocol to implement custom bluetooth commands. You press your data into a pre-defined structure, and the GAIA library takes care of the actual transmission, checksumming and packet combination.

It can be used to transfer firmware updates via bluetooth from PC/smartphone to your headphone or speaker (OTA-update), but also any other commands that the device chooses to implement:

Gaia has customized related commands, which can realize specific functions, such as querying battery power, version number, etc.; at the same time, it is also used for data transmission in OTA (but does not parse data)

YingbinLi 蓝牙: BC5-MM, CSR867x的DFU更新流程之八:Gaia的理解与使用

and

CSR GAIA (Generic Application Interface Architecture) implements an end-to-end, host-agnostic ecosystem supporting host application access to device functionality.

Guanghua Cheng: Bluetooth connection & GAIA protocol

So instead of properly defining and specifying an official profile, all Qualcomm licensees cook up their own commands. (But maybe the firmware update command is stadardized - I do not know)

Despite the NDA, the source code for some Android apps implementing GAIA is available:

Devices using GAIA

Note that this list is totally incomplete, because the profile UUIDs are only ever noted in bug reports by Linux users that know how to use the command line for getting information.

I suspect that there are hundreds if not thousands products implementing that protocol.

Written by Christian Weiske.

Comments? Please send an e-mail.