[PATCH BlueZ v1 1/2] ranging: Issue CS Security Enable based on the ACL role

[PATCH BlueZ v1 1/2] ranging: Issue CS Security Enable based on the ACL role

[Luiz Augusto von Dentz]

From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>

CS Security Enable was only sent when the CS Config Complete reported the
local role as Initiator, and a CS Initiator that is the Peripheral of the
ACL moved to CS_STATE_HOLD, dropping all further CS events.

The CS Security Start procedure is tied to the ACL role instead
([Vol 6] Part B, 5.1.23: "The Link Layer of the Central initiates the CS
Security Start procedure", and [Vol 4] Part E, 7.8.133 disallows the
command when the Controller is the Peripheral), so send it whenever the
local device is the Central and wait for the event otherwise.

Fixes: 20cc88874d57 ("profiles: ranging: Add CS Initiator cmd and evt handling")
Assisted-by: OpenCode:claude-opus-5.5
---
 profiles/ranging/rap_hci.c | 13 +++----------
 1 file changed, 3 insertions(+), 10 deletions(-)

diff --git a/profiles/ranging/rap_hci.c b/profiles/ranging/rap_hci.c
index c472cedc9830..fee769e9b438 100644
--- a/profiles/ranging/rap_hci.c
+++ b/profiles/ranging/rap_hci.c
@@ -983,14 +983,8 @@ static void rap_cs_config_cmplt_evt(const void *data, uint8_t size,
 	cs_set_state(sm, CS_STATE_WAIT_SEC_CMPLT);
 
 	/* CS Security Enable may only be issued by the BLE Central */
-	if (rap_ev.role == 0x00) {
-		mapping = find_mapping_by_handle(sm, evt->handle);
-		if (!mapping || !mapping->is_central) {
-			error("CS Security Enable skipped: not BLE Central");
-			cs_set_state(sm, CS_STATE_HOLD);
-			return;
-		}
-
+	mapping = find_mapping_by_handle(sm, evt->handle);
+	if (mapping && mapping->is_central) {
 		if (bt_att_get_security(mapping->att, NULL) <
 						BT_ATT_SECURITY_MEDIUM) {
 			error("CS Security Enable skipped: not encrypted");
@@ -1001,8 +995,7 @@ static void rap_cs_config_cmplt_evt(const void *data, uint8_t size,
 		DBG("Central,encrypted: Sending CS Security Enable command");
 		rap_send_hci_cs_security_enable_command(sm, evt->handle);
 	} else {
-		/* Reflector role */
-		DBG("Reflector role: Waiting for security enable event...");
+		DBG("Peripheral: Waiting for security enable event...");
 	}
 
 	/* Send callback to RAP Profile */
-- 
2.56.0

[PATCH BlueZ v1 2/2] ranging: Fail CS Config Complete on role mismatch

[Luiz Augusto von Dentz]

From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>

When the role reported in CS Config Complete is not allowed by the
Role_Enable set with CS Set Default Settings, the state machine carried
on with the reported role. A Reflector-only Peripheral receiving a config
reporting Initiator ended up in CS_STATE_HOLD from the security path, so
every following Subevent Result was dropped with "Received Subevent when
CS Procedure is inactive!".

Move to CS_STATE_HOLD at Config Complete and report the mismatch instead.

Fixes: 20cc88874d57 ("profiles: ranging: Add CS Initiator cmd and evt handling")
Assisted-by: OpenCode:claude-opus-5.5
---
 profiles/ranging/rap_hci.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/profiles/ranging/rap_hci.c b/profiles/ranging/rap_hci.c
index fee769e9b438..62760b5c092e 100644
--- a/profiles/ranging/rap_hci.c
+++ b/profiles/ranging/rap_hci.c
@@ -964,6 +964,15 @@ static void rap_cs_config_cmplt_evt(const void *data, uint8_t size,
 	 * (CS_INITIATOR=0x00, CS_REFLECTOR=0x01)
 	 * which is different from the role_enable value sent in HCI command
 	 */
+	if ((is_initiator_role(sm) && rap_ev.role != CS_INITIATOR) ||
+	    (!is_initiator_role(sm) && !is_both_role(sm) &&
+	     rap_ev.role != CS_REFLECTOR)) {
+		error("CS Config role 0x%02X doesn't match role enable 0x%02X",
+			rap_ev.role, sm->role_enable);
+		cs_set_state(sm, CS_STATE_HOLD);
+		return;
+	}
+
 	sm->cs_opt.role = rap_ev.role;
 	sm->cs_opt.rtt_type = rap_ev.rtt_type;
 
-- 
2.56.0

RE: [BlueZ,v1,1/2] ranging: Issue CS Security Enable based on the ACL role

[bluez.test.bot]

[-- Attachment #1: Type: text/plain, Size: 858 bytes --]

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/series/1194674/

---Test result---

Test Summary:
CheckPatch                    PASS      1.11 seconds
GitLint                       PASS      0.69 seconds
BuildEll                      PASS      19.68 seconds
BluezMake                     PASS      304.29 seconds
CheckSmatch                   PASS      297.45 seconds
bluezmakeextell               PASS      95.34 seconds
TestFunctional                PASS      1130.04 seconds
IncrementalBuild              PASS      302.83 seconds
ScanBuild                     PASS      1160.14 seconds



https://github.com/bluez/bluez/pull/2721

---
Regards,
Linux Bluetooth

Re: [PATCH BlueZ v1 1/2] ranging: Issue CS Security Enable based on the ACL role

[patchwork-bot+bluetooth]

Hello:

This series was applied to bluetooth/bluez.git (master)
by Luiz Augusto von Dentz <luiz.von.dentz@intel.com>:

On Tue, 27 Oct 2026 10:09:52 -0400 you wrote:
> From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
> 
> CS Security Enable was only sent when the CS Config Complete reported the
> local role as Initiator, and a CS Initiator that is the Peripheral of the
> ACL moved to CS_STATE_HOLD, dropping all further CS events.
> 
> The CS Security Start procedure is tied to the ACL role instead
> ([Vol 6] Part B, 5.1.23: "The Link Layer of the Central initiates the CS
> Security Start procedure", and [Vol 4] Part E, 7.8.133 disallows the
> command when the Controller is the Peripheral), so send it whenever the
> local device is the Central and wait for the event otherwise.
> 
> [...]

Here is the summary with links:
  - [BlueZ,v1,1/2] ranging: Issue CS Security Enable based on the ACL role
    https://git.kernel.org/pub/scm/bluetooth/bluez.git/?id=7191f261b596
  - [BlueZ,v1,2/2] ranging: Fail CS Config Complete on role mismatch
    https://git.kernel.org/pub/scm/bluetooth/bluez.git/?id=9f14b93eb37f

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html