Friday, September 2, 2011

BT LE FindMe profile in Bluez

There is a post in Bluez mailing list "Current status on BLE development". It tells us current BT LE status in Bluez and also shows some git repositories with their development. I try to build their kernel and the latest bluez. I made some experiments and understood more about FindMe profile in Bluez.

* Unstable kernel with Interleaved Discovery, RSSI Threshold monitor,
LE scanning and remaining SM patches
[1] (branch

* BlueZ Userspace
[2] git:// proximity-devel

Experiment I: prepare one LE device only(Key Fob/Reporter/GATT Server) and one dual mode LE/BR/EDR device (Monitor/GATT Client) in Ubuntu machine. Key Fob runs immediate alert service. Bluez register the monitor service and it can write Alert Level to reporter. If Alert Level is mild or high, the Key Fob would ring. Then user can find where is the Key Fob. Reference to Immediate Alert Service (UUID: 0x1802) page and Alert Level(UUID:0x2a06) page.

Reference from site:
The Immediate Alert service is instantiated as a Primary Service. There is only one instance of the Immediate Alert service on a device. There is only one instance of the Alert Level characteristic in an Immediate Alert service. This alert continues until one of following conditions occurs:
• An implementation specific timeout
• User interaction on this device
• A new alert level is written
• The physical link is disconnected

If the written alert level is “No Alert”, no alerting is done on this device.
If the written alert level is “Mild Alert”, the device alerts.
If the written alert level is “High Alert”, the device alerts in the strongest possible way.

How to demo it:
1. set Key Fob to advertising mode
2. try LE scan from Ubuntu

erin@sundays:/project/upstream/bluez$ sudo hcitool -i hci0 lescan
LE Scan ...

3. create LE connection

erin@sundays:/project/upstream/bluez$ sudo hcitool -i hci0 lecc C0:FF:EE:C0:AA:06
Connection handle 32

4. use gatttool to browse the service of LE device

erin@sundays:/project/upstream/bluez$ sudo gatttool -i hci0 -b C0:FF:EE:C0:AA:06 -m 48 --interactive
[ ][C0:FF:EE:C0:AA:06][LE]> connect
[CON][C0:FF:EE:C0:AA:06][LE]> primary
attr handle: 0x0001, end grp handle: 0x000b uuid: 00001800-0000-1000-8000-00805f9b34fb
attr handle: 0x000c, end grp handle: 0x000e uuid: 00001801-0000-1000-8000-00805f9b34fb
attr handle: 0x000f, end grp handle: 0x0011 uuid: 00001803-0000-1000-8000-00805f9b34fb
attr handle: 0x0012, end grp handle: 0x0014 uuid: 00001802-0000-1000-8000-00805f9b34fb
attr handle: 0x0015, end grp handle: 0x0017 uuid: 00001804-0000-1000-8000-00805f9b34fb
attr handle: 0x0018, end grp handle: 0x001e uuid: 0000ffb0-0000-1000-8000-00805f9b34fb
attr handle: 0x001f, end grp handle: 0x0031 uuid: 0000ffa0-0000-1000-8000-00805f9b34fb
attr handle: 0x0032, end grp handle: 0x0036 uuid: 0000ffe0-0000-1000-8000-00805f9b34fb
[CON][C0:FF:EE:C0:AA:06][LE]> characteristics 0x0012 0x0014
handle: 0x0013, char properties: 0x08, char value handle: 0x0014, uuid: 00002a06-0000-1000-8000-00805f9b34fb
[CON][C0:FF:EE:C0:AA:06][LE]> char-desc 0x0012 0x00014
handle: 0x0012, uuid: 2800
handle: 0x0013, uuid: 2803
handle: 0x0014, uuid: 2a06
[CON][C0:FF:EE:C0:AA:06][LE]> char-read-uuid 2a06
handle: 0x0011 value: 00
[CON][C0:FF:EE:C0:AA:06][LE]> char-write-cmd 0x0011 02
[CON][C0:FF:EE:C0:AA:06][LE]> char-read-uuid 2a06
handle: 0x0011 value: 02
[CON][C0:FF:EE:C0:AA:06][LE]> disconnect

5. Key Fob would start to ring

Experiment II: prepare two BT BR/EDR devices. One is my Ubuntu laptop (daydreamer) and the other is my Ubuntu Desktop (Sundays). Daydreamer is a Key Fob (Client) and Sundays is a Monitor (Server).

1. Fake Immediate Alert profile and Link Loss profile in local data files.

erin@sundays:/project/vcgomes/linux-2.6$ cat /var/lib/bluetooth/00\:13\:EF\:F0\:C4\:46/profiles
78:DD:08:A3:A7:52 0000110a-0000-1000-8000-00805f9b34fb 0000110c-0000-1000-8000-00805f9b34fb 0000110e-0000-1000-8000-00805f9b34fb 00001112-0000-1000-8000-00805f9b34fb 0000111f-0000-1000-8000-00805f9b34fb 00001800-0000-1000-8000-00805f9b34fb 00001801-0000-1000-8000-00805f9b34fb 00001802-0000-1000-8000-00805f9b34fb 00001803-0000-1000-8000-00805f9b34fb
erin@sundays:/project/vcgomes/linux-2.6$ cat /var/lib/bluetooth/00\:13\:EF\:F0\:C4\:46/primary
78:DD:08:A3:A7:52 0011#0013#00001802-0000-1000-8000-00805f9b34fb 0009#000b#00001803-0000-1000-8000-00805f9b34fb

2. use dbus-send to change Alert Service value

erin@sundays:~$ dbus-send --system --type=method_call --print-reply --dest=org.bluez /org/bluez/2617/hci1/dev_78_DD_08_A3_A7_52 org.bluez.Proximity.GetProperties
method return sender=:1.62 -> dest=:1.91 reply_serial=2
array [
dict entry(
string "LinkLossAlertLevel"
variant string "none"
dict entry(
string "ImmediateAlertLevel"
variant string "none"

erin@sundays:~$ dbus-send --system --type=method_call --print-reply --dest=org.bluez /org/bluez/2617/hci1/dev_78_DD_08_A3_A7_52 org.bluez.Proximity.SetProperty string:ImmediateAlertLevel variant:string:high
method return sender=:1.62 -> dest=:1.92 reply_serial=2

erin@sundays:~$ dbus-send --system --type=method_call --print-reply --dest=org.bluez /org/bluez/2617/hci1/dev_78_DD_08_A3_A7_52 org.bluez.Proximity.GetProperties
method return sender=:1.62 -> dest=:1.93 reply_serial=2
array [
dict entry(
string "LinkLossAlertLevel"
variant string "none"
dict entry(
string "ImmediateAlertLevel"
variant string "high"

3. use gatttool to check the Alert Level value

erin@sundays:~$ dbus-send --system --type=method_call --print-reply --dest=org.bluez /org/bluez/2617/hci1/dev_78_DD_08_A3_A7_52 org.bluez.Proximity.SetProperty string:LinkLossAlertLevel variant:string:mild
method return sender=:1.62 -> dest=:1.96 reply_serial=2

erin@sundays:/project/upstream/bluez$ sudo gatttool -i hci0 -b 78:DD:08:A3:A7:52 -p 31 -m 48 --interactive
[ ][78:DD:08:A3:A7:52][BR]> connect
[CON][78:DD:08:A3:A7:52][BR]> char-read-uuid 2a06
handle: 0x000b value: 01
handle: 0x0013 value: 00

Tuesday, April 19, 2011

OBEX Message Access Profile introduction

Have you ever tried to push a SMS message from a laptop to an Android phone via Bluetooth? It's very similar to OPP (object push profile) and it is to use OBEX to exchange data too. I found some patches in Aurora about supporting MAP (message access profile) in Android two months ago. Finally, I got some time to play with it.

What is MAP? MAP defines a set of features and procedures to exchange messages between devices. It is especially tailored for the automotive Hands-Free use case where an onboard terminal device (typically a Car-Kit installed in the car) takes advantage of the messaging capability of a communication device (typically a mobile phone). This profile can however also be used for other use cases that require the exchange of messages between two devices.

I have no Car-Kit to verify this profile and I cannot find any platform to support it either. Therefore, I use python lightblue and write few lines to verify this function. I have one samsung smdkv210 platform and one ubuntu laptop. Below is the list about MAP profile from Aurora git repository. If you are using gingerbread, you could apply their patches easily. Also, it's just a simple list and we should review git log to retrieve more patches related to MAP profile.

native bluez
Bluetooth : Add MAP service records into SDP tool;a=commit;h=7f52e048879c74a35a212ed4a0ce2f14133e2806

android frameworks
frameworks/bluetooth: Changes for enabling Bluetooth MAP profile;a=commit;h=a7d9bf26766e420be997d2858fc7b73b42868860

Bluetooth UI application
Bluetooth: Adding MAP Profile implementation;a=commit;h=e900ed4897561fbb317a8c1488ac84c0fb051068

Email UI application
Email: Changes to trigger Email app to update its mailbox from Bluetooth MAP Profile;a=commit;h=e11f384228e44cb8b718247436fc0501bb81673a

MMS UI application
Mms: Enable MMS app to push a MMS added to outbox by Bluetooth MAP profile;a=commit;h=703e2c2ae82f973954c539cd8e55470e4d6c3873

Add MAS service from init.rc file and then we can see MAP record from sdptool.

#cat /root/init.rc
service map /system/bin/sdptool add --channel=16 MAS
user bluetooth
group bluetooth net_bt_admin

# sdptool browse local
Service Name: OBEX Message Access
Service RecHandle: 0x10008
Service Class ID List:
"" (0x1132)
Protocol Descriptor List:
"L2CAP" (0x0100)
"RFCOMM" (0x0003)
Channel: 16
"OBEX" (0x0008)
Profile Descriptor List:
"" (0x1134)
Version: 0x0100

I use ipython to write my scripts to demo MAP function. I create an OBEX Client from my Ubuntu machine and use it to connect with Android device. It send a 'get' request to retrieve the first slot of SMS.

import lightblue
client = lightblue.obex.OBEXClient(host,port)