[PATCH BlueZ v4 0/2] ranging: Reactive RAS UUID

[PATCH BlueZ v4 0/2] ranging: Reactive RAS UUID

[Naga Bhavani Akella]

This series replaces the probe with a reactive mechanism.
GATT_UUID is only added and the RAP profile only probed
/accepted once the remote peer actually discovers or accesses
a RAS GATT attribute (Features, Ondemand Data,
Control Point, Data Ready, Data Overwritten, or subscribes via the
Ranging Data CCC).

Patch 1 adds a generic RAS-access notification callback API to
shared/rap.

Patch 2 consumes that API in profiles/ranging/rap.c to bridge the
notification to btd_device_add_uuid()/service_accept(), and reverts
the probe in gatt_client_init()


Naga Bhavani Akella (2):
  rap: Add RAS attribute access notification API
  profiles: Register RAS UUID reactively instead of probing

 profiles/ranging/rap.c | 25 +++++++++++
 src/shared/rap.c       | 98 ++++++++++++++++++++++++++++++++++++++++++
 src/shared/rap.h       |  6 +++
 3 files changed, 129 insertions(+)

-- 

[PATCH BlueZ v4 1/2] rap: Add RAS attribute access notification API

[Naga Bhavani Akella]

Add a callback registration mechanism to notify bt_rap consumers
when a remote peer accesses or discovers a RAS GATT attribute.
Introduce register/unregister APIs and invoke callbacks asynchronously
from all relevant RAS characteristic read/write handlers,
following the existing bt_rap_register() pattern to avoid
reentrancy into device/profile/D-Bus logic.
---
 src/shared/rap.c | 98 ++++++++++++++++++++++++++++++++++++++++++++++++
 src/shared/rap.h |  6 +++
 2 files changed, 104 insertions(+)

diff --git a/src/shared/rap.c b/src/shared/rap.c
index dfb272d3a..567abdb75 100644
--- a/src/shared/rap.c
+++ b/src/shared/rap.c
@@ -306,6 +306,7 @@ struct bt_rap {
 
 static struct queue *rap_db;
 static struct queue *bt_rap_cbs;
+static struct queue *bt_rap_accessed_cbs;
 static struct queue *sessions;
 
 struct bt_rap_cb {
@@ -315,6 +316,12 @@ struct bt_rap_cb {
 	void *user_data;
 };
 
+struct bt_rap_accessed_cb {
+	unsigned int id;
+	bt_rap_accessed_func_t func;
+	void *user_data;
+};
+
 struct bt_rap_ready {
 	unsigned int id;
 	bt_rap_ready_func_t func;
@@ -724,6 +731,42 @@ static void cs_tracker_init(struct cstracker *t)
 	t->segment_data.iov_len = 0;
 }
 
+static bool notify_ras_accessed_idle(void *user_data)
+{
+	struct bt_att *att = user_data;
+	const struct queue_entry *entry;
+
+	for (entry = queue_get_entries(bt_rap_accessed_cbs); entry;
+	     entry = entry->next) {
+		struct bt_rap_accessed_cb *cb = entry->data;
+
+		cb->func(att, cb->user_data);
+	}
+
+	return false;
+}
+
+static void notify_ras_accessed_destroy(void *user_data)
+{
+	struct bt_att *att = user_data;
+
+	bt_att_unref(att);
+}
+
+/*
+ * Notify that the remote side has discovered/accessed a RAS attribute.
+ * Deferred to idle so it does not reenter device/profile logic from within
+ * the gatt-server's request-dispatch stack.
+ */
+static void notify_ras_accessed(struct bt_att *att)
+{
+	if (!att || !bt_rap_accessed_cbs || queue_isempty(bt_rap_accessed_cbs))
+		return;
+
+	timeout_add(0, notify_ras_accessed_idle, bt_att_ref(att),
+					notify_ras_accessed_destroy);
+}
+
 static void ras_features_read_cb(struct gatt_db_attribute *attrib,
 				 unsigned int id, uint16_t offset,
 				 uint8_t opcode, struct bt_att *att,
@@ -737,6 +780,8 @@ static void ras_features_read_cb(struct gatt_db_attribute *attrib,
 	 */
 	uint8_t value[4] = { 0x01, 0x00, 0x00, 0x00 };
 
+	notify_ras_accessed(att);
+
 	gatt_db_attribute_read_result(attrib, id, 0, value, sizeof(value));
 }
 
@@ -745,6 +790,8 @@ static void ras_ondemand_read_cb(struct gatt_db_attribute *attrib,
 				 uint8_t opcode, struct bt_att *att,
 				 void *user_data)
 {
+	notify_ras_accessed(att);
+
 	/* No static read data – on‑demand data is pushed via
 	 * notifications
 	 */
@@ -761,6 +808,8 @@ static void ras_control_point_write_cb(struct gatt_db_attribute *attrib,
 				       uint8_t opcode, struct bt_att *att,
 				       void *user_data)
 {
+	notify_ras_accessed(att);
+
 	/* Control point handler - implementation TBD */
 }
 
@@ -773,6 +822,8 @@ static void ras_data_ready_read_cb(struct gatt_db_attribute *attrib,
 	uint16_t counter = 0;
 	uint8_t value[2];
 
+	notify_ras_accessed(att);
+
 	put_le16(counter, value);
 	gatt_db_attribute_read_result(attrib, id, 0, value, sizeof(value));
 }
@@ -785,6 +836,8 @@ static void ras_data_overwritten_read_cb(struct gatt_db_attribute *attrib,
 {
 	uint8_t value[2] = { 0x00, 0x00 };
 
+	notify_ras_accessed(att);
+
 	gatt_db_attribute_read_result(attrib, id, 0, value, sizeof(value));
 }
 
@@ -800,6 +853,7 @@ static void ras_ranging_data_ccc_write_cb(struct gatt_db_attribute *attrib,
 	uint16_t *this_ccc;
 	uint16_t *other_ccc;
 
+	notify_ras_accessed(att);
 	if (!ras) {
 		gatt_db_attribute_write_result(attrib, id,
 					BT_ATT_ERROR_UNLIKELY);
@@ -1052,6 +1106,50 @@ bool bt_rap_unregister(unsigned int id)
 	return true;
 }
 
+unsigned int bt_rap_ras_accessed_register(bt_rap_accessed_func_t func,
+							void *user_data)
+{
+	struct bt_rap_accessed_cb *cb;
+	static unsigned int id;
+
+	if (!func)
+		return 0;
+
+	if (!bt_rap_accessed_cbs)
+		bt_rap_accessed_cbs = queue_new();
+
+	cb = new0(struct bt_rap_accessed_cb, 1);
+	cb->id = ++id ? id : ++id;
+	cb->func = func;
+	cb->user_data = user_data;
+
+	queue_push_tail(bt_rap_accessed_cbs, cb);
+
+	return cb->id;
+}
+
+static bool match_accessed_id(const void *data, const void *match_data)
+{
+	const struct bt_rap_accessed_cb *cb = data;
+	unsigned int id = PTR_TO_UINT(match_data);
+
+	return cb->id == id;
+}
+
+bool bt_rap_ras_accessed_unregister(unsigned int id)
+{
+	struct bt_rap_accessed_cb *cb;
+
+	cb = queue_remove_if(bt_rap_accessed_cbs, match_accessed_id,
+							UINT_TO_PTR(id));
+	if (!cb)
+		return false;
+
+	free(cb);
+
+	return true;
+}
+
 static inline size_t serialize_segmentation_header(
 				const struct segmentation_header *s,
 				uint8_t *out, size_t out_len)
diff --git a/src/shared/rap.h b/src/shared/rap.h
index 5582635e6..a78e9a5c6 100644
--- a/src/shared/rap.h
+++ b/src/shared/rap.h
@@ -15,6 +15,7 @@
 struct bt_rap;
 struct gatt_db;
 struct bt_gatt_client;
+struct bt_att;
 
 /* Channel Sounding Events */
 struct bt_rap_hci_cs_options {
@@ -161,6 +162,7 @@ typedef void (*bt_rap_debug_func_t)(const char *str, void *user_data);
 typedef void (*bt_rap_ready_func_t)(struct bt_rap *rap, void *user_data);
 typedef void (*bt_rap_destroy_func_t)(void *user_data);
 typedef void (*bt_rap_func_t)(struct bt_rap *rap, void *user_data);
+typedef void (*bt_rap_accessed_func_t)(struct bt_att *att, void *user_data);
 
 struct bt_rap *bt_rap_ref(struct bt_rap *rap);
 void bt_rap_unref(struct bt_rap *rap);
@@ -187,6 +189,10 @@ bool bt_rap_ready_unregister(struct bt_rap *rap, unsigned int id);
 
 bool bt_rap_unregister(unsigned int id);
 
+unsigned int bt_rap_ras_accessed_register(bt_rap_accessed_func_t func,
+							void *user_data);
+bool bt_rap_ras_accessed_unregister(unsigned int id);
+
 struct bt_rap *bt_rap_new(struct gatt_db *ldb, struct gatt_db *rdb);
 
 bool bt_rap_set_cs_config_params(void *hci_sm,
-- 

[PATCH BlueZ v4 2/2] profiles: Register RAS UUID reactively instead of probing

[Naga Bhavani Akella]

Replace the unconditional reflector-role GATT_UUID probe in
gatt_client_init() with a reactive registration driven by actual
remote RAS access, using the notification API added in shared/rap.
---
 profiles/ranging/rap.c | 25 +++++++++++++++++++++++++
 1 file changed, 25 insertions(+)

diff --git a/profiles/ranging/rap.c b/profiles/ranging/rap.c
index 3ffc0da76..4f6d7f2db 100644
--- a/profiles/ranging/rap.c
+++ b/profiles/ranging/rap.c
@@ -308,6 +308,27 @@ static void rap_attached(struct bt_rap *rap, void *user_data)
 	rap_data_add(data);
 }
 
+static void rap_ras_accessed(struct bt_att *att, void *user_data)
+{
+	struct btd_device *device;
+	struct btd_service *service;
+
+	device = btd_adapter_find_device_by_fd(bt_att_get_fd(att));
+	if (!device) {
+		error("unable to find device for RAS access");
+		return;
+	}
+
+	service = btd_device_get_service(device, GATT_UUID);
+	if (!service) {
+		btd_device_add_uuid(device, GATT_UUID);
+		service = btd_device_get_service(device, GATT_UUID);
+	}
+
+	if (service)
+		service_accept(service, btd_device_is_initiator(device));
+}
+
 enum cs_dict_target {
 	CS_TARGET_SETTINGS,
 	CS_TARGET_CFG,
@@ -830,6 +851,7 @@ static struct btd_profile rap_profile = {
 };
 
 static unsigned int rap_id;
+static unsigned int rap_ras_accessed_id;
 
 static int rap_init(void)
 {
@@ -840,6 +862,8 @@ static int rap_init(void)
 		return err;
 
 	rap_id = bt_rap_register(rap_attached, rap_detached, NULL);
+	rap_ras_accessed_id = bt_rap_ras_accessed_register(rap_ras_accessed,
+									NULL);
 
 	return 0;
 }
@@ -848,6 +872,7 @@ static void rap_exit(void)
 {
 	btd_profile_unregister(&rap_profile);
 	bt_rap_unregister(rap_id);
+	bt_rap_ras_accessed_unregister(rap_ras_accessed_id);
 }
 
 BLUETOOTH_PLUGIN_DEFINE(rap, VERSION, BLUETOOTH_PLUGIN_PRIORITY_DEFAULT,
-- 

RE: ranging: Reactive RAS UUID

[bluez.test.bot]

[-- Attachment #1: Type: text/plain, Size: 987 bytes --]

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=1129585

---Test result---

Test Summary:
CheckPatch                    PASS      0.75 seconds
GitLint                       PASS      0.48 seconds
BuildEll                      PASS      18.79 seconds
BluezMake                     PASS      586.07 seconds
MakeCheck                     PASS      0.92 seconds
MakeDistcheck                 PASS      145.94 seconds
CheckValgrind                 PASS      138.86 seconds
CheckSmatch                   PASS      249.89 seconds
bluezmakeextell               PASS      90.15 seconds
IncrementalBuild              PASS      675.63 seconds
ScanBuild                     PASS      812.25 seconds



https://github.com/bluez/bluez/pull/2328

---
Regards,
Linux Bluetooth

Re: [PATCH BlueZ v4 2/2] profiles: Register RAS UUID reactively instead of probing

[Luiz Augusto von Dentz]

Hi Naga,

On Fri, Jul 17, 2026 at 8:41 AM Naga Bhavani Akella
<naga.akella@oss.qualcomm.com> wrote:
>
> Replace the unconditional reflector-role GATT_UUID probe in
> gatt_client_init() with a reactive registration driven by actual
> remote RAS access, using the notification API added in shared/rap.

It seems you already have something like that in bt_rap_register
attached callback, it is just never used, which explains why
rap_attached is never called and you need the likes of probe in order
to create rap_data_new.

> ---
>  profiles/ranging/rap.c | 25 +++++++++++++++++++++++++
>  1 file changed, 25 insertions(+)
>
> diff --git a/profiles/ranging/rap.c b/profiles/ranging/rap.c
> index 3ffc0da76..4f6d7f2db 100644
> --- a/profiles/ranging/rap.c
> +++ b/profiles/ranging/rap.c
> @@ -308,6 +308,27 @@ static void rap_attached(struct bt_rap *rap, void *user_data)
>         rap_data_add(data);
>  }
>
> +static void rap_ras_accessed(struct bt_att *att, void *user_data)
> +{
> +       struct btd_device *device;
> +       struct btd_service *service;
> +
> +       device = btd_adapter_find_device_by_fd(bt_att_get_fd(att));
> +       if (!device) {
> +               error("unable to find device for RAS access");
> +               return;
> +       }
> +
> +       service = btd_device_get_service(device, GATT_UUID);
> +       if (!service) {
> +               btd_device_add_uuid(device, GATT_UUID);
> +               service = btd_device_get_service(device, GATT_UUID);
> +       }
> +
> +       if (service)
> +               service_accept(service, btd_device_is_initiator(device));
> +}
> +
>  enum cs_dict_target {
>         CS_TARGET_SETTINGS,
>         CS_TARGET_CFG,
> @@ -830,6 +851,7 @@ static struct btd_profile rap_profile = {
>  };
>
>  static unsigned int rap_id;
> +static unsigned int rap_ras_accessed_id;
>
>  static int rap_init(void)
>  {
> @@ -840,6 +862,8 @@ static int rap_init(void)
>                 return err;
>
>         rap_id = bt_rap_register(rap_attached, rap_detached, NULL);
> +       rap_ras_accessed_id = bt_rap_ras_accessed_register(rap_ras_accessed,
> +                                                                       NULL);
>
>         return 0;
>  }
> @@ -848,6 +872,7 @@ static void rap_exit(void)
>  {
>         btd_profile_unregister(&rap_profile);
>         bt_rap_unregister(rap_id);
> +       bt_rap_ras_accessed_unregister(rap_ras_accessed_id);
>  }
>
>  BLUETOOTH_PLUGIN_DEFINE(rap, VERSION, BLUETOOTH_PLUGIN_PRIORITY_DEFAULT,
> --
>


-- 
Luiz Augusto von Dentz

Re: [PATCH BlueZ v4 2/2] profiles: Register RAS UUID reactively instead of probing

[Luiz Augusto von Dentz]

Hi Naga,

On Fri, Jul 17, 2026 at 10:02 AM Luiz Augusto von Dentz
<luiz.dentz@gmail.com> wrote:
>
> Hi Naga,
>
> On Fri, Jul 17, 2026 at 8:41 AM Naga Bhavani Akella
> <naga.akella@oss.qualcomm.com> wrote:
> >
> > Replace the unconditional reflector-role GATT_UUID probe in
> > gatt_client_init() with a reactive registration driven by actual
> > remote RAS access, using the notification API added in shared/rap.
>
> It seems you already have something like that in bt_rap_register
> attached callback, it is just never used, which explains why
> rap_attached is never called and you need the likes of probe in order
> to create rap_data_new.

In case I wasn't clear, I meant shared/bap.c needs to call
rap->attached callback whenever a session is connected, just follow
what was done in the likes of shared/bap.c which does bt_bap_attach ->
bap->attached, so bt_rap_attach shall probably call rap->attached.

>
> > ---
> >  profiles/ranging/rap.c | 25 +++++++++++++++++++++++++
> >  1 file changed, 25 insertions(+)
> >
> > diff --git a/profiles/ranging/rap.c b/profiles/ranging/rap.c
> > index 3ffc0da76..4f6d7f2db 100644
> > --- a/profiles/ranging/rap.c
> > +++ b/profiles/ranging/rap.c
> > @@ -308,6 +308,27 @@ static void rap_attached(struct bt_rap *rap, void *user_data)
> >         rap_data_add(data);
> >  }
> >
> > +static void rap_ras_accessed(struct bt_att *att, void *user_data)
> > +{
> > +       struct btd_device *device;
> > +       struct btd_service *service;
> > +
> > +       device = btd_adapter_find_device_by_fd(bt_att_get_fd(att));
> > +       if (!device) {
> > +               error("unable to find device for RAS access");
> > +               return;
> > +       }
> > +
> > +       service = btd_device_get_service(device, GATT_UUID);
> > +       if (!service) {
> > +               btd_device_add_uuid(device, GATT_UUID);
> > +               service = btd_device_get_service(device, GATT_UUID);
> > +       }
> > +
> > +       if (service)
> > +               service_accept(service, btd_device_is_initiator(device));
> > +}
> > +
> >  enum cs_dict_target {
> >         CS_TARGET_SETTINGS,
> >         CS_TARGET_CFG,
> > @@ -830,6 +851,7 @@ static struct btd_profile rap_profile = {
> >  };
> >
> >  static unsigned int rap_id;
> > +static unsigned int rap_ras_accessed_id;
> >
> >  static int rap_init(void)
> >  {
> > @@ -840,6 +862,8 @@ static int rap_init(void)
> >                 return err;
> >
> >         rap_id = bt_rap_register(rap_attached, rap_detached, NULL);
> > +       rap_ras_accessed_id = bt_rap_ras_accessed_register(rap_ras_accessed,
> > +                                                                       NULL);
> >
> >         return 0;
> >  }
> > @@ -848,6 +872,7 @@ static void rap_exit(void)
> >  {
> >         btd_profile_unregister(&rap_profile);
> >         bt_rap_unregister(rap_id);
> > +       bt_rap_ras_accessed_unregister(rap_ras_accessed_id);
> >  }
> >
> >  BLUETOOTH_PLUGIN_DEFINE(rap, VERSION, BLUETOOTH_PLUGIN_PRIORITY_DEFAULT,
> > --
> >
>
>
> --
> Luiz Augusto von Dentz



-- 
Luiz Augusto von Dentz