* [PATCH BlueZ v1 0/2] Initial Channel Sounding Support for
@ 2026-06-09 10:49 Naga Bhavani Akella
2026-06-09 10:49 ` [PATCH BlueZ v1 1/2] shared: rap: Add the is_central parameter to verify whether the local role is central before sending the HCI CS Security Enable command Naga Bhavani Akella
2026-06-09 10:49 ` [PATCH BlueZ v1 2/2] profiles: ranging: Add command flow and event support for CS Initiator Naga Bhavani Akella
0 siblings, 2 replies; 4+ messages in thread
From: Naga Bhavani Akella @ 2026-06-09 10:49 UTC (permalink / raw)
To: linux-bluetooth
Cc: luiz.dentz, quic_mohamull, quic_hbandi, quic_anubhavg,
Naga Bhavani Akella
This series adds initial LE Channel Sounding (CS) Initiator support by
introducing the required HCI command flow and event handling for CS
procedures.
The changes include
1. Adding an is_central parameter to validate that
current local role is central before issuing
HCI_LE_CS_Security_Enable command.
2. Introduction of initial LE Channel Sounding (CS)
Initiator support by adding required HCI command flow
and event handling for CS capability discovery,
configuration management, and ranging procedures.
The CS init pipeline is not yet wired to D-Bus APIs,
so bt_rap_read_local_supported_capabilities()
is currently marked __maybe_unused.
Naga Bhavani Akella (2):
shared: rap: Add the is_central parameter to verify whether the local
role is central before sending the HCI CS Security Enable command.
profiles: ranging: Add command flow and event support for CS
Initiator
profiles/ranging/rap.c | 3 +-
profiles/ranging/rap_hci.c | 876 +++++++++++++++++++++++++++++++++----
src/shared/rap.h | 3 +-
3 files changed, 785 insertions(+), 97 deletions(-)
--
^ permalink raw reply [flat|nested] 4+ messages in thread* [PATCH BlueZ v1 1/2] shared: rap: Add the is_central parameter to verify whether the local role is central before sending the HCI CS Security Enable command. 2026-06-09 10:49 [PATCH BlueZ v1 0/2] Initial Channel Sounding Support for Naga Bhavani Akella @ 2026-06-09 10:49 ` Naga Bhavani Akella 2026-06-09 12:29 ` Initial Channel Sounding Support for bluez.test.bot 2026-06-09 10:49 ` [PATCH BlueZ v1 2/2] profiles: ranging: Add command flow and event support for CS Initiator Naga Bhavani Akella 1 sibling, 1 reply; 4+ messages in thread From: Naga Bhavani Akella @ 2026-06-09 10:49 UTC (permalink / raw) To: linux-bluetooth Cc: luiz.dentz, quic_mohamull, quic_hbandi, quic_anubhavg, Naga Bhavani Akella --- src/shared/rap.h | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/shared/rap.h b/src/shared/rap.h index d3ced61b1..4d6a3d1c8 100644 --- a/src/shared/rap.h +++ b/src/shared/rap.h @@ -213,5 +213,6 @@ void bt_rap_detach_hci(struct bt_rap *rap, void *hci_sm); /* Connection handle mapping functions */ bool bt_rap_set_conn_handle(void *hci_sm, struct bt_rap *rap, uint16_t handle, - const uint8_t *bdaddr, uint8_t bdaddr_type); + const uint8_t *bdaddr, uint8_t bdaddr_type, + bool is_central); void bt_rap_clear_conn_handle(void *hci_sm, uint16_t handle); -- ^ permalink raw reply related [flat|nested] 4+ messages in thread
* RE: Initial Channel Sounding Support for 2026-06-09 10:49 ` [PATCH BlueZ v1 1/2] shared: rap: Add the is_central parameter to verify whether the local role is central before sending the HCI CS Security Enable command Naga Bhavani Akella @ 2026-06-09 12:29 ` bluez.test.bot 0 siblings, 0 replies; 4+ messages in thread From: bluez.test.bot @ 2026-06-09 12:29 UTC (permalink / raw) To: linux-bluetooth, naga.akella [-- Attachment #1: Type: text/plain, Size: 61923 bytes --] This is automated email and please do not reply to this email! Dear submitter, Thank you for submitting the patches to the linux bluetooth mailing list. This is a CI test results with your patch series: PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=1108507 ---Test result--- Test Summary: CheckPatch FAIL 1.11 seconds GitLint FAIL 0.42 seconds BuildEll PASS 20.12 seconds BluezMake FAIL 646.69 seconds CheckSmatch FAIL 344.91 seconds bluezmakeextell FAIL 176.73 seconds IncrementalBuild FAIL 637.18 seconds ScanBuild FAIL 493.70 seconds Details ############################## Test: CheckPatch - FAIL Desc: Run checkpatch.pl script Output: [BlueZ,v1,2/2] profiles: ranging: Add command flow and event support for CS Initiator WARNING:PREFER_DEFINED_ATTRIBUTE_MACRO: __always_unused or __maybe_unused is preferred over __attribute__((__unused__)) #216: FILE: profiles/ranging/rap_hci.c:30: +#define __maybe_unused __attribute__((unused)) WARNING:BLOCK_COMMENT_STYLE: Block comments use a trailing */ on a separate line #1089: FILE: profiles/ranging/rap_hci.c:1485: + * keeping it unused till DBUS API is added */ WARNING:BRACES: braces {} are not necessary for single statement blocks #1113: FILE: profiles/ranging/rap_hci.c:1509: + for (i = 2; i <= 22; i++) { + default_map[i / 8] |= (1 << (i % 8)); + } WARNING:BRACES: braces {} are not necessary for single statement blocks #1116: FILE: profiles/ranging/rap_hci.c:1512: + for (i = 26; i <= 76; i++) { + default_map[i / 8] |= (1 << (i % 8)); + } WARNING:BLOCK_COMMENT_STYLE: Block comments use a trailing */ on a separate line #1232: FILE: profiles/ranging/rap_hci.c:1628: + * keeping it unused till DBUS API is added */ /github/workspace/src/patch/14619214.patch total: 0 errors, 5 warnings, 1131 lines checked NOTE: For some of the reported defects, checkpatch may be able to mechanically convert to the typical style using --fix or --fix-inplace. /github/workspace/src/patch/14619214.patch has style problems, please review. NOTE: Ignored message types: COMMIT_MESSAGE COMPLEX_MACRO CONST_STRUCT FILE_PATH_CHANGES MISSING_SIGN_OFF PREFER_PACKED SPDX_LICENSE_TAG SPLIT_STRING SSCANF_TO_KSTRTO NOTE: If any of the errors are false positives, please report them to the maintainer, see CHECKPATCH in MAINTAINERS. ############################## Test: GitLint - FAIL Desc: Run gitlint Output: [BlueZ,v1,1/2] shared: rap: Add the is_central parameter to verify whether the local role is central before sending the HCI CS Security Enable command. 1: T1 Title exceeds max length (151>80): "[BlueZ,v1,1/2] shared: rap: Add the is_central parameter to verify whether the local role is central before sending the HCI CS Security Enable command." 1: T3 Title has trailing punctuation (.): "[BlueZ,v1,1/2] shared: rap: Add the is_central parameter to verify whether the local role is central before sending the HCI CS Security Enable command." [BlueZ,v1,2/2] profiles: ranging: Add command flow and event support for CS Initiator 1: T1 Title exceeds max length (85>80): "[BlueZ,v1,2/2] profiles: ranging: Add command flow and event support for CS Initiator" ############################## Test: BluezMake - FAIL Desc: Build BlueZ Output: tools/mgmt-tester.c: In function ‘main’: tools/mgmt-tester.c:12990:5: note: variable tracking size limit exceeded with ‘-fvar-tracking-assignments’, retrying without 12990 | int main(int argc, char *argv[]) | ^~~~ unit/test-avdtp.c: In function ‘main’: unit/test-avdtp.c:766:5: note: variable tracking size limit exceeded with ‘-fvar-tracking-assignments’, retrying without 766 | int main(int argc, char *argv[]) | ^~~~ unit/test-avrcp.c: In function ‘main’: unit/test-avrcp.c:989:5: note: variable tracking size limit exceeded with ‘-fvar-tracking-assignments’, retrying without 989 | int main(int argc, char *argv[]) | ^~~~ profiles/ranging/rap_hci.c:1486:21: error: no previous declaration for ‘bt_rap_set_channel_classification’ [-Werror=missing-declarations] 1486 | bool __maybe_unused bt_rap_set_channel_classification(void *hci_sm, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ cc1: all warnings being treated as errors make[1]: *** [Makefile:9007: profiles/ranging/bluetoothd-rap_hci.o] Error 1 make[1]: *** Waiting for unfinished jobs.... make: *** [Makefile:4172: all] Error 2 ############################## Test: CheckSmatch - FAIL Desc: Run smatch tool with source Output: src/shared/crypto.c:271:21: warning: Variable length array is used. src/shared/crypto.c:272:23: warning: Variable length array is used. src/shared/gatt-helpers.c:764:31: warning: Variable length array is used. src/shared/gatt-helpers.c:842:31: warning: Variable length array is used. src/shared/gatt-helpers.c:1335:31: warning: Variable length array is used. src/shared/gatt-helpers.c:1366:23: warning: Variable length array is used. src/shared/gatt-server.c:271:25: warning: Variable length array is used. src/shared/gatt-server.c:614:25: warning: Variable length array is used. src/shared/gatt-server.c:712:25: warning: Variable length array is used. src/shared/bap.c:312:25: warning: array of flexible structures src/shared/bap.c: note: in included file: ./src/shared/ascs.h:88:25: warning: array of flexible structures src/shared/shell.c: note: in included file (through /usr/include/readline/readline.h): /usr/include/readline/rltypedefs.h:35:23: warning: non-ANSI function declaration of function 'Function' /usr/include/readline/rltypedefs.h:36:25: warning: non-ANSI function declaration of function 'VFunction' /usr/include/readline/rltypedefs.h:37:27: warning: non-ANSI function declaration of function 'CPFunction' /usr/include/readline/rltypedefs.h:38:29: warning: non-ANSI function declaration of function 'CPPFunction' src/shared/crypto.c:271:21: warning: Variable length array is used. src/shared/crypto.c:272:23: warning: Variable length array is used. src/shared/gatt-helpers.c:764:31: warning: Variable length array is used. src/shared/gatt-helpers.c:842:31: warning: Variable length array is used. src/shared/gatt-helpers.c:1335:31: warning: Variable length array is used. src/shared/gatt-helpers.c:1366:23: warning: Variable length array is used. src/shared/gatt-server.c:271:25: warning: Variable length array is used. src/shared/gatt-server.c:614:25: warning: Variable length array is used. src/shared/gatt-server.c:712:25: warning: Variable length array is used. src/shared/bap.c:312:25: warning: array of flexible structures src/shared/bap.c: note: in included file: ./src/shared/ascs.h:88:25: warning: array of flexible structures src/shared/shell.c: note: in included file (through /usr/include/readline/readline.h): /usr/include/readline/rltypedefs.h:35:23: warning: non-ANSI function declaration of function 'Function' /usr/include/readline/rltypedefs.h:36:25: warning: non-ANSI function declaration of function 'VFunction' /usr/include/readline/rltypedefs.h:37:27: warning: non-ANSI function declaration of function 'CPFunction' /usr/include/readline/rltypedefs.h:38:29: warning: non-ANSI function declaration of function 'CPPFunction' tools/mesh-cfgtest.c:1453:17: warning: unknown escape sequence: '\%' tools/sco-tester.c: note: in included file: ./lib/bluetooth/bluetooth.h:232:15: warning: array of flexible structures ./lib/bluetooth/bluetooth.h:237:31: warning: array of flexible structures tools/bneptest.c:634:39: warning: unknown escape sequence: '\%' tools/seq2bseq.c:57:26: warning: Variable length array is used. tools/obex-client-tool.c: note: in included file (through /usr/include/readline/readline.h): /usr/include/readline/rltypedefs.h:35:23: warning: non-ANSI function declaration of function 'Function' /usr/include/readline/rltypedefs.h:36:25: warning: non-ANSI function declaration of function 'VFunction' /usr/include/readline/rltypedefs.h:37:27: warning: non-ANSI function declaration of function 'CPFunction' /usr/include/readline/rltypedefs.h:38:29: warning: non-ANSI function declaration of function 'CPPFunction' client/btpclient/gatt.c: note: in included file: ./src/shared/btp.h:335:41: warning: array of flexible structures ./src/shared/btp.h:340:55: warning: array of flexible structures ./src/shared/btp.h:363:47: warning: array of flexible structures ./src/shared/btp.h:392:42: warning: array of flexible structures src/advertising.c: note: in included file: ./src/shared/mgmt.h:95:25: error: redefinition of unsigned int enum mgmt_io_capability src/agent.c: note: in included file: src/shared/queue.h:19:20: error: redefinition of struct queue_entry src/adv_monitor.c: note: in included file: ./src/shared/mgmt.h:95:25: error: redefinition of unsigned int enum mgmt_io_capability unit/avctp.c:505:34: warning: Variable length array is used. unit/avctp.c:556:34: warning: Variable length array is used. unit/test-avrcp.c:373:26: warning: Variable length array is used. unit/test-avrcp.c:398:26: warning: Variable length array is used. unit/test-avrcp.c:414:24: warning: Variable length array is used. unit/avrcp-lib.c:1085:34: warning: Variable length array is used. unit/avrcp-lib.c:1583:34: warning: Variable length array is used. unit/avrcp-lib.c:1612:34: warning: Variable length array is used. unit/avrcp-lib.c:1638:34: warning: Variable length array is used. src/advertising.c: note: in included file: ./src/shared/mgmt.h:95:25: error: redefinition of unsigned int enum mgmt_io_capability src/agent.c: note: in included file: src/shared/queue.h:19:20: error: redefinition of struct queue_entry src/adv_monitor.c: note: in included file: ./src/shared/mgmt.h:95:25: error: redefinition of unsigned int enum mgmt_io_capability src/main.c: note: in included file (through src/device.h): ./src/shared/queue.h:19:20: error: redefinition of struct queue_entry mesh/mesh-io-mgmt.c:525:67: warning: Variable length array is used. client/display.c: note: in included file (through /usr/include/readline/readline.h): /usr/include/readline/rltypedefs.h:35:23: warning: non-ANSI function declaration of function 'Function' /usr/include/readline/rltypedefs.h:36:25: warning: non-ANSI function declaration of function 'VFunction' /usr/include/readline/rltypedefs.h:37:27: warning: non-ANSI function declaration of function 'CPFunction' /usr/include/readline/rltypedefs.h:38:29: warning: non-ANSI function declaration of function 'CPPFunction' src/shared/crypto.c:271:21: warning: Variable length array is used. src/shared/crypto.c:272:23: warning: Variable length array is used. src/shared/gatt-helpers.c:764:31: warning: Variable length array is used. src/shared/gatt-helpers.c:842:31: warning: Variable length array is used. src/shared/gatt-helpers.c:1335:31: warning: Variable length array is used. src/shared/gatt-helpers.c:1366:23: warning: Variable length array is used. src/shared/gatt-server.c:271:25: warning: Variable length array is used. src/shared/gatt-server.c:614:25: warning: Variable length array is used. src/shared/gatt-server.c:712:25: warning: Variable length array is used. src/shared/bap.c:312:25: warning: array of flexible structures src/shared/bap.c: note: in included file: ./src/shared/ascs.h:88:25: warning: array of flexible structures src/shared/shell.c: note: in included file (through /usr/include/readline/readline.h): /usr/include/readline/rltypedefs.h:35:23: warning: non-ANSI function declaration of function 'Function' /usr/include/readline/rltypedefs.h:36:25: warning: non-ANSI function declaration of function 'VFunction' /usr/include/readline/rltypedefs.h:37:27: warning: non-ANSI function declaration of function 'CPFunction' /usr/include/readline/rltypedefs.h:38:29: warning: non-ANSI function declaration of function 'CPPFunction' monitor/packet.c:2002:26: warning: Variable length array is used. monitor/packet.c: note: in included file: monitor/bt.h:3924:52: warning: array of flexible structures monitor/bt.h:3912:40: warning: array of flexible structures monitor/msft.c: note: in included file: monitor/msft.h:88:44: warning: array of flexible structures tools/rctest.c:631:33: warning: non-ANSI function declaration of function 'automated_send_recv' tools/hex2hcd.c:136:26: warning: Variable length array is used. tools/meshctl.c:324:33: warning: non-ANSI function declaration of function 'forget_mesh_devices' tools/mesh-gatt/node.c:456:39: warning: non-ANSI function declaration of function 'node_get_local_node' tools/mesh-gatt/net.c:1239:30: warning: non-ANSI function declaration of function 'get_next_seq' tools/mesh-gatt/net.c:2193:29: warning: non-ANSI function declaration of function 'net_get_default_ttl' tools/mesh-gatt/net.c:2207:26: warning: non-ANSI function declaration of function 'net_get_seq_num' tools/mesh-gatt/prov.c: note: in included file (through /usr/include/readline/readline.h): /usr/include/readline/rltypedefs.h:35:23: warning: non-ANSI function declaration of function 'Function' /usr/include/readline/rltypedefs.h:36:25: warning: non-ANSI function declaration of function 'VFunction' /usr/include/readline/rltypedefs.h:37:27: warning: non-ANSI function declaration of function 'CPFunction' /usr/include/readline/rltypedefs.h:38:29: warning: non-ANSI function declaration of function 'CPPFunction' tools/mesh-gatt/onoff-model.c: note: in included file (through /usr/include/readline/readline.h): /usr/include/readline/rltypedefs.h:35:23: warning: non-ANSI function declaration of function 'Function' /usr/include/readline/rltypedefs.h:36:25: warning: non-ANSI function declaration of function 'VFunction' /usr/include/readline/rltypedefs.h:37:27: warning: non-ANSI function declaration of function 'CPFunction' /usr/include/readline/rltypedefs.h:38:29: warning: non-ANSI function declaration of function 'CPPFunction' ell/log.c:431:65: warning: non-ANSI function declaration of function 'register_debug_section' ell/log.c:439:68: warning: non-ANSI function declaration of function 'free_debug_sections' ell/random.c:60:42: warning: non-ANSI function declaration of function 'l_getrandom_is_supported' ell/cipher.c:660:28: warning: non-ANSI function declaration of function 'init_supported' ell/checksum.c:382:28: warning: non-ANSI function declaration of function 'init_supported' ell/checksum.c:444:47: warning: non-ANSI function declaration of function 'l_checksum_cmac_aes_supported' ell/cipher.c:519:24: warning: Variable length array is used. ell/cert-crypto.c:36:33: warning: Variable length array is used. ell/cert-crypto.c:142:36: warning: Variable length array is used. ell/cert-crypto.c:198:36: warning: Variable length array is used. ell/cert-crypto.c:251:31: warning: Variable length array is used. ell/key.c:550:25: warning: Variable length array is used. ell/dbus-service.c:548:49: warning: non-ANSI function declaration of function '_dbus_object_tree_new' ell/dbus-filter.c:233:46: warning: Variable length array is used. ell/tls.c:45:25: warning: Variable length array is used. ell/tls.c:86:22: warning: Variable length array is used. ell/tls.c:86:46: warning: Variable length array is used. ell/tls-suites.c:1079:25: warning: Variable length array is used. ell/tls-suites.c:1081:34: warning: Variable length array is used. ell/tls-suites.c:1084:41: warning: Variable length array is used. ell/tls-suites.c:1133:41: warning: Variable length array is used. ell/tls.c:1819:26: warning: Variable length array is used. emulator/btdev.c:478:29: warning: Variable length array is used. emulator/bthost.c:703:28: warning: Variable length array is used. emulator/bthost.c:704:32: warning: Variable length array is used. emulator/bthost.c:944:28: warning: Variable length array is used. emulator/bthost.c:978:28: warning: Variable length array is used. emulator/bthost.c:979:32: warning: Variable length array is used. attrib/gatttool.c:236:23: warning: Variable length array is used. attrib/interactive.c: note: in included file (through /usr/include/readline/readline.h): /usr/include/readline/rltypedefs.h:35:23: warning: non-ANSI function declaration of function 'Function' /usr/include/readline/rltypedefs.h:36:25: warning: non-ANSI function declaration of function 'VFunction' /usr/include/readline/rltypedefs.h:37:27: warning: non-ANSI function declaration of function 'CPFunction' /usr/include/readline/rltypedefs.h:38:29: warning: non-ANSI function declaration of function 'CPPFunction' attrib/interactive.c:175:27: warning: non-ANSI function declaration of function 'disconnect_io' attrib/interactive.c:300:23: warning: Variable length array is used. profiles/ranging/rap_hci.c:1486:21: error: no previous declaration for ‘bt_rap_set_channel_classification’ [-Werror=missing-declarations] 1486 | bool __maybe_unused bt_rap_set_channel_classification(void *hci_sm, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ cc1: all warnings being treated as errors make[1]: *** [Makefile:9007: profiles/ranging/bluetoothd-rap_hci.o] Error 1 make[1]: *** Waiting for unfinished jobs.... make: *** [Makefile:4172: all] Error 2 ############################## Test: bluezmakeextell - FAIL Desc: Build Bluez with External ELL Output: profiles/ranging/rap_hci.c:1486:21: error: no previous declaration for ‘bt_rap_set_channel_classification’ [-Werror=missing-declarations] 1486 | bool __maybe_unused bt_rap_set_channel_classification(void *hci_sm, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ cc1: all warnings being treated as errors make[1]: *** [Makefile:9007: profiles/ranging/bluetoothd-rap_hci.o] Error 1 make[1]: *** Waiting for unfinished jobs.... make: *** [Makefile:4172: all] Error 2 ############################## Test: IncrementalBuild - FAIL Desc: Incremental build with the patches in the series Output: tools/mgmt-tester.c: In function ‘main’: tools/mgmt-tester.c:12990:5: note: variable tracking size limit exceeded with ‘-fvar-tracking-assignments’, retrying without 12990 | int main(int argc, char *argv[]) | ^~~~ unit/test-avdtp.c: In function ‘main’: unit/test-avdtp.c:766:5: note: variable tracking size limit exceeded with ‘-fvar-tracking-assignments’, retrying without 766 | int main(int argc, char *argv[]) | ^~~~ unit/test-avrcp.c: In function ‘main’: unit/test-avrcp.c:989:5: note: variable tracking size limit exceeded with ‘-fvar-tracking-assignments’, retrying without 989 | int main(int argc, char *argv[]) | ^~~~ profiles/ranging/rap.c: In function ‘rap_accept’: profiles/ranging/rap.c:421:4: error: too few arguments to function ‘bt_rap_set_conn_handle’ 421 | bt_rap_set_conn_handle(data->hci_sm, | ^~~~~~~~~~~~~~~~~~~~~~ In file included from profiles/ranging/rap.c:35: ./src/shared/rap.h:215:6: note: declared here 215 | bool bt_rap_set_conn_handle(void *hci_sm, struct bt_rap *rap, uint16_t handle, | ^~~~~~~~~~~~~~~~~~~~~~ make[1]: *** [Makefile:8993: profiles/ranging/bluetoothd-rap.o] Error 1 make[1]: *** Waiting for unfinished jobs.... profiles/ranging/rap_hci.c:1107:6: error: conflicting types for ‘bt_rap_set_conn_handle’ 1107 | bool bt_rap_set_conn_handle(void *hci_sm, struct bt_rap *rap, uint16_t handle, | ^~~~~~~~~~~~~~~~~~~~~~ In file included from profiles/ranging/rap_hci.c:23: ./src/shared/rap.h:215:6: note: previous declaration of ‘bt_rap_set_conn_handle’ was here 215 | bool bt_rap_set_conn_handle(void *hci_sm, struct bt_rap *rap, uint16_t handle, | ^~~~~~~~~~~~~~~~~~~~~~ make[1]: *** [Makefile:9007: profiles/ranging/bluetoothd-rap_hci.o] Error 1 make: *** [Makefile:4172: all] Error 2 [BlueZ,v1,1/2] shared: rap: Add the is_central parameter to verify whether the local role is central before sending the HCI CS Security Enable command. tools/mgmt-tester.c: In function ‘main’: tools/mgmt-tester.c:12990:5: note: variable tracking size limit exceeded with ‘-fvar-tracking-assignments’, retrying without 12990 | int main(int argc, char *argv[]) | ^~~~ unit/test-avdtp.c: In function ‘main’: unit/test-avdtp.c:766:5: note: variable tracking size limit exceeded with ‘-fvar-tracking-assignments’, retrying without 766 | int main(int argc, char *argv[]) | ^~~~ unit/test-avrcp.c: In function ‘main’: unit/test-avrcp.c:989:5: note: variable tracking size limit exceeded with ‘-fvar-tracking-assignments’, retrying without 989 | int main(int argc, char *argv[]) | ^~~~ profiles/ranging/rap.c: In function ‘rap_accept’: profiles/ranging/rap.c:421:4: error: too few arguments to function ‘bt_rap_set_conn_handle’ 421 | bt_rap_set_conn_handle(data->hci_sm, | ^~~~~~~~~~~~~~~~~~~~~~ In file included from profiles/ranging/rap.c:35: ./src/shared/rap.h:215:6: note: declared here 215 | bool bt_rap_set_conn_handle(void *hci_sm, struct bt_rap *rap, uint16_t handle, | ^~~~~~~~~~~~~~~~~~~~~~ make[1]: *** [Makefile:8993: profiles/ranging/bluetoothd-rap.o] Error 1 make[1]: *** Waiting for unfinished jobs.... profiles/ranging/rap_hci.c:1107:6: error: conflicting types for ‘bt_rap_set_conn_handle’ 1107 | bool bt_rap_set_conn_handle(void *hci_sm, struct bt_rap *rap, uint16_t handle, | ^~~~~~~~~~~~~~~~~~~~~~ In file included from profiles/ranging/rap_hci.c:23: ./src/shared/rap.h:215:6: note: previous declaration of ‘bt_rap_set_conn_handle’ was here 215 | bool bt_rap_set_conn_handle(void *hci_sm, struct bt_rap *rap, uint16_t handle, | ^~~~~~~~~~~~~~~~~~~~~~ make[1]: *** [Makefile:9007: profiles/ranging/bluetoothd-rap_hci.o] Error 1 make: *** [Makefile:4172: all] Error 2 ############################## Test: ScanBuild - FAIL Desc: Run Scan Build Output: src/shared/gatt-client.c:447:21: warning: Use of memory after it is freed gatt_db_unregister(op->client->db, op->db_id); ^~~~~~~~~~ src/shared/gatt-client.c:692:2: warning: Use of memory after it is freed discovery_op_complete(op, false, att_ecode); ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ src/shared/gatt-client.c:992:2: warning: Use of memory after it is freed discovery_op_complete(op, success, att_ecode); ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ src/shared/gatt-client.c:1098:2: warning: Use of memory after it is freed discovery_op_complete(op, success, att_ecode); ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ src/shared/gatt-client.c:1292:2: warning: Use of memory after it is freed discovery_op_complete(op, success, att_ecode); ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ src/shared/gatt-client.c:1357:2: warning: Use of memory after it is freed discovery_op_complete(op, success, att_ecode); ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ src/shared/gatt-client.c:1632:6: warning: Use of memory after it is freed if (read_db_hash(op)) { ^~~~~~~~~~~~~~~~ src/shared/gatt-client.c:1637:2: warning: Use of memory after it is freed discover_all(op); ^~~~~~~~~~~~~~~~ src/shared/gatt-client.c:1693:56: warning: Use of memory after it is freed notify_data->chrc->ccc_write_id = notify_data->att_id = att_id; ~~~~~~~~~~~~~~~~~~~ ^ src/shared/gatt-client.c:2146:6: warning: Use of memory after it is freed if (read_db_hash(op)) { ^~~~~~~~~~~~~~~~ src/shared/gatt-client.c:2154:8: warning: Use of memory after it is freed discovery_op_ref(op), ^~~~~~~~~~~~~~~~~~~~ src/shared/gatt-client.c:3332:2: warning: Use of memory after it is freed complete_write_long_op(req, success, 0, false); ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ src/shared/gatt-client.c:3354:2: warning: Use of memory after it is freed request_unref(req); ^~~~~~~~~~~~~~~~~~ 13 warnings generated. src/shared/bap.c:1529:8: warning: Use of memory after it is freed bap = bt_bap_ref_safe(bap); ^~~~~~~~~~~~~~~~~~~~ src/shared/bap.c:2340:20: warning: Use of memory after it is freed return queue_find(stream->bap->streams, NULL, stream); ^~~~~~~~~~~~~~~~~~~~ 2 warnings generated. src/shared/gatt-client.c:447:21: warning: Use of memory after it is freed gatt_db_unregister(op->client->db, op->db_id); ^~~~~~~~~~ src/shared/gatt-client.c:692:2: warning: Use of memory after it is freed discovery_op_complete(op, false, att_ecode); ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ src/shared/gatt-client.c:992:2: warning: Use of memory after it is freed discovery_op_complete(op, success, att_ecode); ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ src/shared/gatt-client.c:1098:2: warning: Use of memory after it is freed discovery_op_complete(op, success, att_ecode); ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ src/shared/gatt-client.c:1292:2: warning: Use of memory after it is freed discovery_op_complete(op, success, att_ecode); ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ src/shared/gatt-client.c:1357:2: warning: Use of memory after it is freed discovery_op_complete(op, success, att_ecode); ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ src/shared/gatt-client.c:1632:6: warning: Use of memory after it is freed if (read_db_hash(op)) { ^~~~~~~~~~~~~~~~ src/shared/gatt-client.c:1637:2: warning: Use of memory after it is freed discover_all(op); ^~~~~~~~~~~~~~~~ src/shared/gatt-client.c:1693:56: warning: Use of memory after it is freed notify_data->chrc->ccc_write_id = notify_data->att_id = att_id; ~~~~~~~~~~~~~~~~~~~ ^ src/shared/gatt-client.c:2146:6: warning: Use of memory after it is freed if (read_db_hash(op)) { ^~~~~~~~~~~~~~~~ src/shared/gatt-client.c:2154:8: warning: Use of memory after it is freed discovery_op_ref(op), ^~~~~~~~~~~~~~~~~~~~ src/shared/gatt-client.c:3332:2: warning: Use of memory after it is freed complete_write_long_op(req, success, 0, false); ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ src/shared/gatt-client.c:3354:2: warning: Use of memory after it is freed request_unref(req); ^~~~~~~~~~~~~~~~~~ 13 warnings generated. tools/hciattach.c:817:7: warning: Although the value stored to 'n' is used in the enclosing expression, the value is never actually read from 'n' if ((n = read_hci_event(fd, resp, 10)) < 0) { ^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~ tools/hciattach.c:865:7: warning: Although the value stored to 'n' is used in the enclosing expression, the value is never actually read from 'n' if ((n = read_hci_event(fd, resp, 4)) < 0) { ^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~ tools/hciattach.c:887:8: warning: Although the value stored to 'n' is used in the enclosing expression, the value is never actually read from 'n' if ((n = read_hci_event(fd, resp, 10)) < 0) { ^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~ tools/hciattach.c:909:7: warning: Although the value stored to 'n' is used in the enclosing expression, the value is never actually read from 'n' if ((n = read_hci_event(fd, resp, 4)) < 0) { ^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~ tools/hciattach.c:930:7: warning: Although the value stored to 'n' is used in the enclosing expression, the value is never actually read from 'n' if ((n = read_hci_event(fd, resp, 4)) < 0) { ^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~ tools/hciattach.c:974:7: warning: Although the value stored to 'n' is used in the enclosing expression, the value is never actually read from 'n' if ((n = read_hci_event(fd, resp, 6)) < 0) { ^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~ 6 warnings generated. src/shared/bap.c:1529:8: warning: Use of memory after it is freed bap = bt_bap_ref_safe(bap); ^~~~~~~~~~~~~~~~~~~~ src/shared/bap.c:2340:20: warning: Use of memory after it is freed return queue_find(stream->bap->streams, NULL, stream); ^~~~~~~~~~~~~~~~~~~~ 2 warnings generated. src/oui.c:50:2: warning: Value stored to 'hwdb' is never read hwdb = udev_hwdb_unref(hwdb); ^ ~~~~~~~~~~~~~~~~~~~~~ src/oui.c:53:2: warning: Value stored to 'udev' is never read udev = udev_unref(udev); ^ ~~~~~~~~~~~~~~~~ 2 warnings generated. tools/rfcomm.c:234:3: warning: Value stored to 'i' is never read i = execvp(cmdargv[0], cmdargv); ^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~ tools/rfcomm.c:234:7: warning: Null pointer passed to 1st parameter expecting 'nonnull' i = execvp(cmdargv[0], cmdargv); ^~~~~~~~~~~~~~~~~~~~~~~~~~~ tools/rfcomm.c:354:8: warning: Although the value stored to 'fd' is used in the enclosing expression, the value is never actually read from 'fd' if ((fd = open(devname, O_RDONLY | O_NOCTTY)) < 0) { ^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ tools/rfcomm.c:497:14: warning: Assigned value is garbage or undefined req.channel = raddr.rc_channel; ^ ~~~~~~~~~~~~~~~~ tools/rfcomm.c:515:8: warning: Although the value stored to 'fd' is used in the enclosing expression, the value is never actually read from 'fd' if ((fd = open(devname, O_RDONLY | O_NOCTTY)) < 0) { ^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 5 warnings generated. tools/ciptool.c:351:7: warning: 5th function call argument is an uninitialized value sk = do_connect(ctl, dev_id, &src, &dst, psm, (1 << CMTP_LOOPBACK)); ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 1 warning generated. src/sdp-xml.c:126:10: warning: Assigned value is garbage or undefined buf[1] = data[i + 1]; ^ ~~~~~~~~~~~ src/sdp-xml.c:306:11: warning: Assigned value is garbage or undefined buf[1] = data[i + 1]; ^ ~~~~~~~~~~~ src/sdp-xml.c:344:11: warning: Assigned value is garbage or undefined buf[1] = data[i + 1]; ^ ~~~~~~~~~~~ 3 warnings generated. tools/sdptool.c:941:26: warning: Result of 'malloc' is converted to a pointer of type 'uint32_t', which is incompatible with sizeof operand type 'int' uint32_t *value_int = malloc(sizeof(int)); ~~~~~~~~~~ ^~~~~~ ~~~~~~~~~~~ tools/sdptool.c:980:4: warning: 1st function call argument is an uninitialized value free(allocArray[i]); ^~~~~~~~~~~~~~~~~~~ tools/sdptool.c:3777:2: warning: Potential leak of memory pointed to by 'si.name' return add_service(0, &si); ^~~~~~~~~~~~~~~~~~~~~~~~~~ tools/sdptool.c:4112:4: warning: Potential leak of memory pointed to by 'context.svc' return -1; ^~~~~~~~~ 4 warnings generated. tools/avtest.c:243:5: warning: Value stored to 'len' is never read len = write(sk, buf, 3); ^ ~~~~~~~~~~~~~~~~~ tools/avtest.c:253:5: warning: Value stored to 'len' is never read len = write(sk, buf, 4); ^ ~~~~~~~~~~~~~~~~~ tools/avtest.c:262:5: warning: Value stored to 'len' is never read len = write(sk, buf, 3); ^ ~~~~~~~~~~~~~~~~~ tools/avtest.c:276:5: warning: Value stored to 'len' is never read len = write(sk, buf, ^ ~~~~~~~~~~~~~~ tools/avtest.c:283:5: warning: Value stored to 'len' is never read len = write(sk, buf, ^ ~~~~~~~~~~~~~~ tools/avtest.c:290:5: warning: Value stored to 'len' is never read len = write(sk, buf, ^ ~~~~~~~~~~~~~~ tools/avtest.c:297:5: warning: Value stored to 'len' is never read len = write(sk, buf, ^ ~~~~~~~~~~~~~~ tools/avtest.c:309:5: warning: Value stored to 'len' is never read len = write(sk, buf, 4); ^ ~~~~~~~~~~~~~~~~~ tools/avtest.c:313:5: warning: Value stored to 'len' is never read len = write(sk, buf, 2); ^ ~~~~~~~~~~~~~~~~~ tools/avtest.c:322:5: warning: Value stored to 'len' is never read len = write(sk, buf, 3); ^ ~~~~~~~~~~~~~~~~~ tools/avtest.c:326:5: warning: Value stored to 'len' is never read len = write(sk, buf, 2); ^ ~~~~~~~~~~~~~~~~~ tools/avtest.c:335:5: warning: Value stored to 'len' is never read len = write(sk, buf, 3); ^ ~~~~~~~~~~~~~~~~~ tools/avtest.c:342:5: warning: Value stored to 'len' is never read len = write(sk, buf, 2); ^ ~~~~~~~~~~~~~~~~~ tools/avtest.c:364:5: warning: Value stored to 'len' is never read len = write(sk, buf, 4); ^ ~~~~~~~~~~~~~~~~~ tools/avtest.c:368:5: warning: Value stored to 'len' is never read len = write(sk, buf, 2); ^ ~~~~~~~~~~~~~~~~~ tools/avtest.c:377:5: warning: Value stored to 'len' is never read len = write(sk, buf, 3); ^ ~~~~~~~~~~~~~~~~~ tools/avtest.c:381:5: warning: Value stored to 'len' is never read len = write(sk, buf, 2); ^ ~~~~~~~~~~~~~~~~~ tools/avtest.c:394:5: warning: Value stored to 'len' is never read len = write(sk, buf, 4); ^ ~~~~~~~~~~~~~~~~~ tools/avtest.c:398:5: warning: Value stored to 'len' is never read len = write(sk, buf, 2); ^ ~~~~~~~~~~~~~~~~~ tools/avtest.c:405:4: warning: Value stored to 'len' is never read len = write(sk, buf, 2); ^ ~~~~~~~~~~~~~~~~~ tools/avtest.c:415:4: warning: Value stored to 'len' is never read len = write(sk, buf, 2); ^ ~~~~~~~~~~~~~~~~~ tools/avtest.c:580:3: warning: Value stored to 'len' is never read len = write(sk, buf, 2); ^ ~~~~~~~~~~~~~~~~~ tools/avtest.c:588:3: warning: Value stored to 'len' is never read len = write(sk, buf, invalid ? 2 : 3); ^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ tools/avtest.c:602:3: warning: Value stored to 'len' is never read len = write(sk, buf, 4 + media_transport_size); ^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ tools/avtest.c:615:3: warning: Value stored to 'len' is never read len = write(sk, buf, 3); ^ ~~~~~~~~~~~~~~~~~ tools/avtest.c:625:3: warning: Value stored to 'len' is never read len = write(sk, buf, 3); ^ ~~~~~~~~~~~~~~~~~ tools/avtest.c:637:3: warning: Value stored to 'len' is never read len = write(sk, buf, 3); ^ ~~~~~~~~~~~~~~~~~ tools/avtest.c:652:3: warning: Value stored to 'len' is never read len = write(sk, buf, 3); ^ ~~~~~~~~~~~~~~~~~ tools/avtest.c:664:3: warning: Value stored to 'len' is never read len = write(sk, buf, 3); ^ ~~~~~~~~~~~~~~~~~ tools/avtest.c:673:3: warning: Value stored to 'len' is never read len = write(sk, buf, 3); ^ ~~~~~~~~~~~~~~~~~ tools/avtest.c:680:3: warning: Value stored to 'len' is never read len = write(sk, buf, 2); ^ ~~~~~~~~~~~~~~~~~ tools/avtest.c:716:2: warning: Value stored to 'len' is never read len = write(sk, buf, AVCTP_HEADER_LENGTH + sizeof(play_pressed)); ^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 32 warnings generated. tools/btproxy.c:836:15: warning: Null pointer passed to 1st parameter expecting 'nonnull' tcp_port = atoi(optarg); ^~~~~~~~~~~~ tools/btproxy.c:839:8: warning: Null pointer passed to 1st parameter expecting 'nonnull' if (strlen(optarg) > 3 && !strncmp(optarg, "hci", 3)) ^~~~~~~~~~~~~~ 2 warnings generated. tools/create-image.c:76:3: warning: Value stored to 'fd' is never read fd = -1; ^ ~~ tools/create-image.c:84:3: warning: Value stored to 'fd' is never read fd = -1; ^ ~~ tools/create-image.c:92:3: warning: Value stored to 'fd' is never read fd = -1; ^ ~~ tools/create-image.c:105:2: warning: Value stored to 'fd' is never read fd = -1; ^ ~~ 4 warnings generated. tools/check-selftest.c:42:3: warning: Value stored to 'ptr' is never read ptr = fgets(result, sizeof(result), fp); ^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 1 warning generated. tools/btgatt-client.c:1822:2: warning: Value stored to 'argv' is never read argv += optind; ^ ~~~~~~ 1 warning generated. tools/btgatt-server.c:1204:2: warning: Value stored to 'argv' is never read argv -= optind; ^ ~~~~~~ 1 warning generated. tools/gatt-service.c:294:2: warning: 2nd function call argument is an uninitialized value chr_write(chr, value, len); ^~~~~~~~~~~~~~~~~~~~~~~~~~ 1 warning generated. tools/obex-server-tool.c:133:13: warning: Null pointer passed to 1st parameter expecting 'nonnull' data->fd = open(name, O_WRONLY | O_CREAT | O_NOCTTY, 0600); ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ tools/obex-server-tool.c:192:13: warning: Null pointer passed to 1st parameter expecting 'nonnull' data->fd = open(name, O_RDONLY | O_NOCTTY, 0); ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2 warnings generated. tools/test-runner.c:1370:2: warning: Address of stack memory associated with local variable 'kernel_path' is still referred to by the global variable 'kernel_image' upon returning to the caller. This will be a dangling reference return EXIT_SUCCESS; ^~~~~~~~~~~~~~~~~~~ 1 warning generated. client/btpclient/btpclientctl.c:402:3: warning: Value stored to 'bit' is never read bit = 0; ^ ~ client/btpclient/btpclientctl.c:1655:2: warning: Null pointer passed to 2nd parameter expecting 'nonnull' memcpy(cp->data, ad_data, ad_len); ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2 warnings generated. src/sdp-client.c:353:14: warning: Access to field 'cb' results in a dereference of a null pointer (*ctxt)->cb = cb; ~~~~~~~~~~~~^~~~ 1 warning generated. src/sdpd-request.c:209:13: warning: Result of 'malloc' is converted to a pointer of type 'char', which is incompatible with sizeof operand type 'uint16_t' pElem = malloc(sizeof(uint16_t)); ^~~~~~ ~~~~~~~~~~~~~~~~ src/sdpd-request.c:237:13: warning: Result of 'malloc' is converted to a pointer of type 'char', which is incompatible with sizeof operand type 'uint32_t' pElem = malloc(sizeof(uint32_t)); ^~~~~~ ~~~~~~~~~~~~~~~~ 2 warnings generated. src/gatt-database.c:1171:10: warning: Value stored to 'bits' during its initialization is never read uint8_t bits[] = { BT_GATT_CHRC_CLI_FEAT_ROBUST_CACHING, ^~~~ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 1 warning generated. src/gatt-client.c:1569:2: warning: Use of memory after it is freed notify_client_unref(client); ^~~~~~~~~~~~~~~~~~~~~~~~~~~ 1 warning generated. unit/avrcp-lib.c:1968:3: warning: 1st function call argument is an uninitialized value g_free(text[i]); ^~~~~~~~~~~~~~~ 1 warning generated. unit/avdtp.c:756:25: warning: Use of memory after it is freed session->prio_queue = g_slist_remove(session->prio_queue, req); ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ unit/avdtp.c:763:24: warning: Use of memory after it is freed session->req_queue = g_slist_remove(session->req_queue, req); ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2 warnings generated. unit/test-util.c:33:8: warning: Potential leak of memory pointed to by 'p1' p2[0] = 1; ~~~~~~^~~ unit/test-util.c:36:3: warning: Potential leak of memory pointed to by 'p2' _cleanup_free_ uint8_t *data = NULL; ^~~~~~~~~~~~~~~~~~~~~~~~~~~~ ./src/shared/util.h:134:24: note: expanded from macro '_cleanup_free_' #define _cleanup_free_ _cleanup_(freep) ^ ./src/shared/util.h:132:22: note: expanded from macro '_cleanup_' #define _cleanup_(f) __attribute__((cleanup(f))) ^ unit/test-util.c:42:3: warning: Potential leak of memory pointed to by 'data' assert(is_null_too == NULL); ^~~~~~~~~~~~~~~~~~~~~~~~~~~ /usr/include/assert.h:108:11: note: expanded from macro 'assert' ((void) sizeof ((expr) ? 1 : 0), __extension__ ({ \ ^~~~~~~~~~~~~~~~~~~~~~~ unit/test-util.c:50:2: warning: Potential leak of memory pointed to by 'data' assert(is_null == NULL); ^~~~~~~~~~~~~~~~~~~~~~~ /usr/include/assert.h:108:11: note: expanded from macro 'assert' ((void) sizeof ((expr) ? 1 : 0), __extension__ ({ \ ^~~~~~~~~~~~~~~~~~~~~~~ 4 warnings generated. profiles/audio/avdtp.c:895:25: warning: Use of memory after it is freed session->prio_queue = g_slist_remove(session->prio_queue, req); ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ profiles/audio/avdtp.c:902:24: warning: Use of memory after it is freed session->req_queue = g_slist_remove(session->req_queue, req); ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2 warnings generated. profiles/audio/a2dp.c:442:8: warning: Use of memory after it is freed if (!cb->resume_cb) ^~~~~~~~~~~~~ profiles/audio/a2dp.c:3354:20: warning: Access to field 'starting' results in a dereference of a null pointer (loaded from variable 'stream') stream->starting = TRUE; ~~~~~~ ^ profiles/audio/a2dp.c:3357:8: warning: Access to field 'suspending' results in a dereference of a null pointer (loaded from variable 'stream') if (!stream->suspending && stream->suspend_timer) { ^~~~~~~~~~~~~~~~~~ profiles/audio/a2dp.c:3417:22: warning: Access to field 'suspending' results in a dereference of a null pointer (loaded from variable 'stream') stream->suspending = TRUE; ~~~~~~ ^ 4 warnings generated. profiles/audio/avrcp.c:1968:2: warning: Value stored to 'operands' is never read operands += sizeof(*pdu); ^ ~~~~~~~~~~~~ 1 warning generated. attrib/gatt.c:970:2: warning: Potential leak of memory pointed to by 'long_write' return prepare_write(long_write); ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 1 warning generated. src/sdpd-request.c:209:13: warning: Result of 'malloc' is converted to a pointer of type 'char', which is incompatible with sizeof operand type 'uint16_t' pElem = malloc(sizeof(uint16_t)); ^~~~~~ ~~~~~~~~~~~~~~~~ src/sdpd-request.c:237:13: warning: Result of 'malloc' is converted to a pointer of type 'char', which is incompatible with sizeof operand type 'uint32_t' pElem = malloc(sizeof(uint32_t)); ^~~~~~ ~~~~~~~~~~~~~~~~ 2 warnings generated. src/sdp-client.c:353:14: warning: Access to field 'cb' results in a dereference of a null pointer (*ctxt)->cb = cb; ~~~~~~~~~~~~^~~~ 1 warning generated. src/sdp-xml.c:126:10: warning: Assigned value is garbage or undefined buf[1] = data[i + 1]; ^ ~~~~~~~~~~~ src/sdp-xml.c:306:11: warning: Assigned value is garbage or undefined buf[1] = data[i + 1]; ^ ~~~~~~~~~~~ src/sdp-xml.c:344:11: warning: Assigned value is garbage or undefined buf[1] = data[i + 1]; ^ ~~~~~~~~~~~ 3 warnings generated. src/gatt-database.c:1171:10: warning: Value stored to 'bits' during its initialization is never read uint8_t bits[] = { BT_GATT_CHRC_CLI_FEAT_ROBUST_CACHING, ^~~~ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 1 warning generated. src/gatt-client.c:1569:2: warning: Use of memory after it is freed notify_client_unref(client); ^~~~~~~~~~~~~~~~~~~~~~~~~~~ 1 warning generated. gobex/gobex-header.c:95:2: warning: Null pointer passed to 2nd parameter expecting 'nonnull' memcpy(to, from, count); ^~~~~~~~~~~~~~~~~~~~~~~ 1 warning generated. gobex/gobex-transfer.c:423:7: warning: Use of memory after it is freed if (!g_slist_find(transfers, transfer)) ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 1 warning generated. mesh/main.c:162:3: warning: Value stored to 'optarg' is never read optarg += strlen("auto"); ^ ~~~~~~~~~~~~~~ 1 warning generated. lib/bluetooth/hci.c:93:4: warning: Value stored to 'ptr' is never read ptr += sprintf(ptr, "%s", m->str); ^ ~~~~~~~~~~~~~~~~~~~~~~~~~~ 1 warning generated. client/player.c:2363:8: warning: Null pointer passed to 2nd parameter expecting 'nonnull' if (!strcmp(ep->path, pattern)) ^~~~~~~~~~~~~~~~~~~~~~~~~ client/player.c:3640:16: warning: Null pointer passed to 1st parameter expecting 'nonnull' codec->name = strdup(name); ^~~~~~~~~~~~ 2 warnings generated. gdbus/watch.c:226:3: warning: Attempt to free released memory g_free(l->data); ^~~~~~~~~~~~~~~ 1 warning generated. lib/bluetooth/sdp.c:509:17: warning: Dereference of undefined pointer value uint8_t dtd = *(uint8_t *) dtds[i]; ^~~~~~~~~~~~~~~~~~~~ lib/bluetooth/sdp.c:539:17: warning: Dereference of undefined pointer value uint8_t dtd = *(uint8_t *) dtds[i]; ^~~~~~~~~~~~~~~~~~~~ lib/bluetooth/sdp.c:1891:26: warning: Potential leak of memory pointed to by 'ap' for (; pdlist; pdlist = pdlist->next) { ^~~~~~ lib/bluetooth/sdp.c:1905:6: warning: Potential leak of memory pointed to by 'pds' ap = sdp_list_append(ap, pds); ~~~^~~~~~~~~~~~~~~~~~~~~~~~~~ lib/bluetooth/sdp.c:1950:10: warning: Potential leak of memory pointed to by 'u' *seqp = sdp_list_append(*seqp, u); ~~~~~~^~~~~~~~~~~~~~~~~~~~~~~~~~~ lib/bluetooth/sdp.c:2055:4: warning: Potential leak of memory pointed to by 'lang' sdp_list_free(*langSeq, free); ^~~~~~~~~~~~~ lib/bluetooth/sdp.c:2144:9: warning: Potential leak of memory pointed to by 'profDesc' return 0; ^ lib/bluetooth/sdp.c:3276:8: warning: Potential leak of memory pointed to by 'pSvcRec' pSeq = sdp_list_append(pSeq, pSvcRec); ~~~~~^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ lib/bluetooth/sdp.c:3277:9: warning: Potential leak of memory pointed to by 'pSeq' pdata += sizeof(uint32_t); ~~~~~~^~~~~~~~~~~~~~~~~~~ lib/bluetooth/sdp.c:4613:13: warning: Potential leak of memory pointed to by 'rec_list' } while (scanned < attr_list_len && pdata_len > 0); ^~~~~~~ lib/bluetooth/sdp.c:4909:40: warning: Potential leak of memory pointed to by 'tseq' for (d = sdpdata->val.dataseq; d; d = d->next) { ^ lib/bluetooth/sdp.c:4945:8: warning: Potential leak of memory pointed to by 'subseq' tseq = sdp_list_append(tseq, subseq); ~~~~~^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 12 warnings generated. src/shared/gatt-client.c:447:21: warning: Use of memory after it is freed gatt_db_unregister(op->client->db, op->db_id); ^~~~~~~~~~ src/shared/gatt-client.c:692:2: warning: Use of memory after it is freed discovery_op_complete(op, false, att_ecode); ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ src/shared/gatt-client.c:992:2: warning: Use of memory after it is freed discovery_op_complete(op, success, att_ecode); ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ src/shared/gatt-client.c:1098:2: warning: Use of memory after it is freed discovery_op_complete(op, success, att_ecode); ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ src/shared/gatt-client.c:1292:2: warning: Use of memory after it is freed discovery_op_complete(op, success, att_ecode); ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ src/shared/gatt-client.c:1357:2: warning: Use of memory after it is freed discovery_op_complete(op, success, att_ecode); ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ src/shared/gatt-client.c:1632:6: warning: Use of memory after it is freed if (read_db_hash(op)) { ^~~~~~~~~~~~~~~~ src/shared/gatt-client.c:1637:2: warning: Use of memory after it is freed discover_all(op); ^~~~~~~~~~~~~~~~ src/shared/gatt-client.c:1693:56: warning: Use of memory after it is freed notify_data->chrc->ccc_write_id = notify_data->att_id = att_id; ~~~~~~~~~~~~~~~~~~~ ^ src/shared/gatt-client.c:2146:6: warning: Use of memory after it is freed if (read_db_hash(op)) { ^~~~~~~~~~~~~~~~ src/shared/gatt-client.c:2154:8: warning: Use of memory after it is freed discovery_op_ref(op), ^~~~~~~~~~~~~~~~~~~~ src/shared/gatt-client.c:3332:2: warning: Use of memory after it is freed complete_write_long_op(req, success, 0, false); ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ src/shared/gatt-client.c:3354:2: warning: Use of memory after it is freed request_unref(req); ^~~~~~~~~~~~~~~~~~ 13 warnings generated. src/shared/bap.c:1529:8: warning: Use of memory after it is freed bap = bt_bap_ref_safe(bap); ^~~~~~~~~~~~~~~~~~~~ src/shared/bap.c:2340:20: warning: Use of memory after it is freed return queue_find(stream->bap->streams, NULL, stream); ^~~~~~~~~~~~~~~~~~~~ 2 warnings generated. monitor/l2cap.c:1676:4: warning: Value stored to 'data' is never read data += len; ^ ~~~ monitor/l2cap.c:1677:4: warning: Value stored to 'size' is never read size -= len; ^ ~~~ 2 warnings generated. monitor/hwdb.c:59:2: warning: Value stored to 'hwdb' is never read hwdb = udev_hwdb_unref(hwdb); ^ ~~~~~~~~~~~~~~~~~~~~~ monitor/hwdb.c:64:2: warning: Value stored to 'udev' is never read udev = udev_unref(udev); ^ ~~~~~~~~~~~~~~~~ monitor/hwdb.c:106:2: warning: Value stored to 'hwdb' is never read hwdb = udev_hwdb_unref(hwdb); ^ ~~~~~~~~~~~~~~~~~~~~~ monitor/hwdb.c:111:2: warning: Value stored to 'udev' is never read udev = udev_unref(udev); ^ ~~~~~~~~~~~~~~~~ 4 warnings generated. tools/bluemoon.c:1102:8: warning: Null pointer passed to 1st parameter expecting 'nonnull' if (strlen(optarg) > 3 && !strncmp(optarg, "hci", 3)) ^~~~~~~~~~~~~~ 1 warning generated. tools/meshctl.c:326:19: warning: Access to field 'mesh_devices' results in a dereference of a null pointer (loaded from variable 'default_ctrl') g_list_free_full(default_ctrl->mesh_devices, g_free); ^~~~~~~~~~~~~~~~~~~~~~~~~~ tools/meshctl.c:762:2: warning: 2nd function call argument is an uninitialized value bt_shell_printf("Attempting to disconnect from %s\n", addr); ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ tools/meshctl.c:1957:2: warning: Value stored to 'len' is never read len = len + extra + strlen("local_node.json"); ^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 3 warnings generated. In file included from tools/mesh-gatt/crypto.c:32: ./src/shared/util.h:291:9: warning: 1st function call argument is an uninitialized value return be32_to_cpu(get_unaligned((const uint32_t *) ptr)); ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ./src/shared/util.h:41:26: note: expanded from macro 'be32_to_cpu' #define be32_to_cpu(val) bswap_32(val) ^~~~~~~~~~~~~ /usr/include/byteswap.h:34:21: note: expanded from macro 'bswap_32' #define bswap_32(x) __bswap_32 (x) ^~~~~~~~~~~~~~ In file included from tools/mesh-gatt/crypto.c:32: ./src/shared/util.h:301:9: warning: 1st function call argument is an uninitialized value return be64_to_cpu(get_unaligned((const uint64_t *) ptr)); ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ./src/shared/util.h:42:26: note: expanded from macro 'be64_to_cpu' #define be64_to_cpu(val) bswap_64(val) ^~~~~~~~~~~~~ /usr/include/byteswap.h:37:21: note: expanded from macro 'bswap_64' #define bswap_64(x) __bswap_64 (x) ^~~~~~~~~~~~~~ 2 warnings generated. ell/util.c:853:8: warning: The left operand of '>' is a garbage value if (x > UINT8_MAX) ~ ^ ell/util.c:871:8: warning: The left operand of '>' is a garbage value if (x > UINT16_MAX) ~ ^ 2 warnings generated. ell/pem.c:131:8: warning: Dereference of null pointer (loaded from variable 'eol') if (*eol == '\r' || *eol == '\n') ^~~~ ell/pem.c:166:18: warning: Dereference of null pointer (loaded from variable 'eol') if (buf_len && *eol == '\r' && *buf_ptr == '\n') { ^~~~ ell/pem.c:166:34: warning: Dereference of null pointer (loaded from variable 'buf_ptr') if (buf_len && *eol == '\r' && *buf_ptr == '\n') { ^~~~~~~~ ell/pem.c:304:11: warning: 1st function call argument is an uninitialized value result = pem_load_buffer(file.data, file.st.st_size, ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ell/pem.c:469:9: warning: 1st function call argument is an uninitialized value list = l_pem_load_certificate_list_from_data(file.data, ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 5 warnings generated. ell/cert.c:645:41: warning: Access to field 'asn1_len' results in a dereference of a null pointer (loaded from variable 'cert') key = l_key_new(L_KEY_RSA, cert->asn1, cert->asn1_len); ^~~~~~~~~~~~~~ 1 warning generated. ell/gvariant-util.c:143:18: warning: The left operand of '>' is a garbage value if (alignment > max_alignment) ~~~~~~~~~ ^ ell/gvariant-util.c:456:5: warning: Dereference of null pointer !children[0].fixed_size) { ^~~~~~~~~~~~~~~~~~~~~~ 2 warnings generated. emulator/serial.c:150:2: warning: Assigned value is garbage or undefined enum btdev_type uninitialized_var(type); ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ emulator/serial.c:150:36: warning: Value stored to 'type' during its initialization is never read enum btdev_type uninitialized_var(type); ^~~~ emulator/serial.c:36:30: note: expanded from macro 'uninitialized_var' #define uninitialized_var(x) x = x ^ ~ emulator/serial.c:213:2: warning: Assigned value is garbage or undefined enum btdev_type uninitialized_var(dev_type); ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ emulator/serial.c:213:36: warning: Value stored to 'dev_type' during its initialization is never read enum btdev_type uninitialized_var(dev_type); ^~~~~~~~ emulator/serial.c:36:30: note: expanded from macro 'uninitialized_var' #define uninitialized_var(x) x = x ^ ~ 4 warnings generated. ell/ecc-external.c:77:11: warning: Assigned value is garbage or undefined dest[i] = src[i]; ^ ~~~~~~ ell/ecc-external.c:160:18: warning: The right operand of '-' is a garbage value diff = left[i] - right[i] - borrow; ^ ~~~~~~~~ ell/ecc-external.c:227:14: warning: 2nd function call argument is an uninitialized value product = mul_64_64(left[i], right[k - i]); ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ell/ecc-external.c:408:9: warning: Assigned value is garbage or undefined tmp[1] = product[3]; ^ ~~~~~~~~~~ ell/ecc-external.c:435:22: warning: The left operand of '&' is a garbage value tmp[1] = product[3] & 0xffffffff00000000ull; ~~~~~~~~~~ ^ ell/ecc-external.c:483:22: warning: The left operand of '&' is a garbage value tmp[1] = product[5] & 0xffffffff00000000ull; ~~~~~~~~~~ ^ ell/ecc-external.c:688:28: warning: The left operand of '>>' is a garbage value tmp[i] = (product[8 + i] >> 9) | (product[9 + i] << 55); ~~~~~~~~~~~~~~ ^ 7 warnings generated. emulator/server.c:230:2: warning: Assigned value is garbage or undefined enum btdev_type uninitialized_var(type); ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ emulator/server.c:230:36: warning: Value stored to 'type' during its initialization is never read enum btdev_type uninitialized_var(type); ^~~~ emulator/server.c:36:30: note: expanded from macro 'uninitialized_var' #define uninitialized_var(x) x = x ^ ~ 2 warnings generated. emulator/b1ee.c:258:3: warning: Potential leak of memory pointed to by 'server_port' int opt; ^~~~~~~ emulator/b1ee.c:258:3: warning: Potential leak of memory pointed to by 'sniffer_port' int opt; ^~~~~~~ emulator/b1ee.c:289:2: warning: Value stored to 'argc' is never read argc = argc - optind; ^ ~~~~~~~~~~~~~ 3 warnings generated. gobex/gobex-header.c:95:2: warning: Null pointer passed to 2nd parameter expecting 'nonnull' memcpy(to, from, count); ^~~~~~~~~~~~~~~~~~~~~~~ 1 warning generated. gobex/gobex-transfer.c:423:7: warning: Use of memory after it is freed if (!g_slist_find(transfers, transfer)) ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 1 warning generated. attrib/gatt.c:970:2: warning: Potential leak of memory pointed to by 'long_write' return prepare_write(long_write); ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 1 warning generated. emulator/btdev.c:6662:20: warning: Access to field 'link' results in a dereference of a null pointer (loaded from variable 'acl') le_past_received(acl->link, pa); ^~~~~~~~~ emulator/btdev.c:6762:25: warning: Access to field 'link' results in a dereference of a null pointer (loaded from variable 'acl') le_past_info_received(acl->link, ea); ^~~~~~~~~ 2 warnings generated. profiles/ranging/rap.c: In function ‘rap_accept’: profiles/ranging/rap.c:421:4: error: too few arguments to function ‘bt_rap_set_conn_handle’ 421 | bt_rap_set_conn_handle(data->hci_sm, | ^~~~~~~~~~~~~~~~~~~~~~ In file included from profiles/ranging/rap.c:35: ./src/shared/rap.h:215:6: note: declared here 215 | bool bt_rap_set_conn_handle(void *hci_sm, struct bt_rap *rap, uint16_t handle, | ^~~~~~~~~~~~~~~~~~~~~~ make[1]: *** [Makefile:8993: profiles/ranging/bluetoothd-rap.o] Error 1 make[1]: *** Waiting for unfinished jobs.... profiles/audio/media.c:1112:7: warning: Use of memory after it is freed if (req->cb != pac_select_cb) { ^~~~~~~ 1 warning generated. make: *** [Makefile:4172: all] Error 2 https://github.com/bluez/bluez/pull/2200 --- Regards, Linux Bluetooth ^ permalink raw reply [flat|nested] 4+ messages in thread
* [PATCH BlueZ v1 2/2] profiles: ranging: Add command flow and event support for CS Initiator 2026-06-09 10:49 [PATCH BlueZ v1 0/2] Initial Channel Sounding Support for Naga Bhavani Akella 2026-06-09 10:49 ` [PATCH BlueZ v1 1/2] shared: rap: Add the is_central parameter to verify whether the local role is central before sending the HCI CS Security Enable command Naga Bhavani Akella @ 2026-06-09 10:49 ` Naga Bhavani Akella 1 sibling, 0 replies; 4+ messages in thread From: Naga Bhavani Akella @ 2026-06-09 10:49 UTC (permalink / raw) To: linux-bluetooth Cc: luiz.dentz, quic_mohamull, quic_hbandi, quic_anubhavg, Naga Bhavani Akella Introduce support for LE Channel Sounding (CS) ranging procedures in the Initiator role by enabling required HCI command sequencing and event handling. - Add transmission of core HCI LE CS commands: HCI_LE_CS_Read_Local_Supported_Capabilities, HCI_LE_CS_Read_Remote_Supported_Capabilities, HCI_LE_CS_Security_Enable, HCI_LE_CS_Create_Config, HCI_LE_CS_Remove_Config, HCI_LE_CS_Read_Remote_FAE_Table, HCI_LE_CS_Set_Channel_Classification, HCI_LE_CS_Set_Procedure_Parameters, HCI_LE_CS_Procedure_Enable - Add handling of event: HCI_LE_CS_Read_Remote_FAE_Table_Complete This enables cs capability discovery, cs configuration management and execution of CS ranging procedures in the Initiator role. - CS init pipeline not yet wired up pending D-Bus API. bt_rap_read_local_supported_capabilities() has no caller, mark __maybe_unused till DBus APIs are introduced. --- profiles/ranging/rap.c | 3 +- profiles/ranging/rap_hci.c | 876 +++++++++++++++++++++++++++++++++---- 2 files changed, 783 insertions(+), 96 deletions(-) diff --git a/profiles/ranging/rap.c b/profiles/ranging/rap.c index e0a46a87a..e3b50c145 100644 --- a/profiles/ranging/rap.c +++ b/profiles/ranging/rap.c @@ -421,7 +421,8 @@ static int rap_accept(struct btd_service *service) bt_rap_set_conn_handle(data->hci_sm, data->rap, handle, (const uint8_t *) bdaddr, - bdaddr_type); + bdaddr_type, + btd_device_is_initiator(device)); } else { error("Failed to find connection handle for device %s", addr); diff --git a/profiles/ranging/rap_hci.c b/profiles/ranging/rap_hci.c index febe23384..873bbe6cb 100644 --- a/profiles/ranging/rap_hci.c +++ b/profiles/ranging/rap_hci.c @@ -16,14 +16,20 @@ #include <unistd.h> #include <string.h> #include <endian.h> +#include <time.h> #include "lib/bluetooth/bluetooth.h" #include "src/shared/util.h" #include "src/shared/queue.h" #include "src/shared/rap.h" +#include "src/shared/att.h" #include "src/log.h" #include "monitor/bt.h" +#ifndef __maybe_unused +#define __maybe_unused __attribute__((unused)) +#endif + /* Macro to sign-extend an N-bit value to 16-bit signed integer */ #define SIGN_EXTEND_TO_16(val, bits) \ ((int16_t)(((val) ^ (1U << ((bits)-1))) - (1U << ((bits)-1)))) @@ -67,6 +73,7 @@ struct cs_state_machine { struct bt_rap_hci_cs_options cs_opt; /* Per-instance CS options */ uint8_t role_enable; /* Role value for HCI commands (1, 2, or 3) */ struct queue *conn_mappings; /* Per-instance connection mappings */ + struct timespec last_chan_class_time; /* For 1-second rate limit */ }; /* Connection Handle Mapping */ @@ -74,10 +81,18 @@ struct rap_conn_mapping { uint16_t handle; uint8_t bdaddr[6]; uint8_t bdaddr_type; + bool is_central; /* true if local device is BLE Central on this link */ struct bt_att *att; struct bt_rap *rap; }; +/* Function declarations */ +static bool bt_rap_read_remote_fae_table(void *hci_sm, uint16_t handle); +static void rap_send_hci_cs_create_config_command(struct cs_state_machine *sm, + uint16_t handle); +static bool bt_rap_read_remote_supported_capabilities(void *hci_sm, + uint16_t handle); + /* Connection Mapping Helper Functions */ static void mapping_free(void *data) { @@ -97,14 +112,6 @@ static bool match_mapping_handle(const void *a, const void *b) return mapping->handle == handle; } -static bool match_mapping_rap(const void *a, const void *b) -{ - const struct rap_conn_mapping *mapping = a; - const struct bt_rap *rap = b; - - return mapping->rap == rap; -} - static struct rap_conn_mapping *find_mapping_by_handle( struct cs_state_machine *sm, uint16_t handle) @@ -118,19 +125,14 @@ static struct rap_conn_mapping *find_mapping_by_handle( static bool add_conn_mapping(struct cs_state_machine *sm, uint16_t handle, const uint8_t *bdaddr, uint8_t bdaddr_type, - struct bt_att *att, struct bt_rap *rap) + bool is_central, struct bt_att *att, + struct bt_rap *rap) { struct rap_conn_mapping *mapping; if (!sm) return false; - if (!sm->conn_mappings) { - sm->conn_mappings = queue_new(); - if (!sm->conn_mappings) - return false; - } - /* Check if mapping already exists */ mapping = find_mapping_by_handle(sm, handle); if (mapping) { @@ -138,6 +140,7 @@ static bool add_conn_mapping(struct cs_state_machine *sm, uint16_t handle, if (bdaddr) memcpy(mapping->bdaddr, bdaddr, 6); mapping->bdaddr_type = bdaddr_type; + mapping->is_central = is_central; mapping->att = att; mapping->rap = rap; return true; @@ -152,6 +155,7 @@ static bool add_conn_mapping(struct cs_state_machine *sm, uint16_t handle, if (bdaddr) memcpy(mapping->bdaddr, bdaddr, 6); mapping->bdaddr_type = bdaddr_type; + mapping->is_central = is_central; mapping->att = att; mapping->rap = rap; @@ -171,13 +175,28 @@ static void remove_conn_mapping(struct cs_state_machine *sm, uint16_t handle) mapping_free(mapping); } -static void remove_rap_mappings(struct cs_state_machine *sm) +static struct bt_rap *resolve_handle_to_rap(struct cs_state_machine *sm, + uint16_t handle) { - if (!sm || !sm->conn_mappings) - return; + struct rap_conn_mapping *mapping; - queue_remove_all(sm->conn_mappings, match_mapping_rap, sm->rap, - mapping_free); + if (!sm) + return NULL; + + /* Try to find in mapping cache */ + mapping = find_mapping_by_handle(sm, handle); + if (mapping && mapping->rap) { + DBG("Found handle 0x%04X in mapping cache", handle); + return mapping->rap; + } + + /* Profile layer should have called bt_rap_set_conn_handle() during + * connection establishment. If we reach here, the mapping was not set. + */ + DBG("No mapping found for handle 0x%04X", handle); + DBG("Profile layer should call bt_rap_set_conn_handle() on connect"); + + return NULL; } /* State Machine Functions */ @@ -194,6 +213,7 @@ static void cs_state_machine_init(struct cs_state_machine *sm, sm->hci = hci; sm->initiator = false; sm->procedure_active = false; + sm->conn_mappings = queue_new(); /* Store role_enable for HCI commands (1, 2, or 3 from config) */ sm->role_enable = role; @@ -219,8 +239,8 @@ static void cs_set_state(struct cs_state_machine *sm, return; /* Validate state values before array access */ - if (sm->current_state > CS_STATE_UNSPECIFIED || - new_state > CS_STATE_UNSPECIFIED) { + if ((unsigned int)sm->current_state >= ARRAY_SIZE(state_names) || + (unsigned int)new_state >= ARRAY_SIZE(state_names)) { error("Invalid state transition attempted"); return; } @@ -238,11 +258,85 @@ static enum cs_state cs_get_current_state(struct cs_state_machine *sm) return sm ? sm->current_state : CS_STATE_UNSPECIFIED; } +static bool is_initiator_role(const struct cs_state_machine *sm) +{ + return sm->role_enable == 0x01 || sm->role_enable == 0x03; +} + +/* Helper function to send read remote capabilities for all connections */ +static void send_read_remote_cap_for_mapping(void *data, void *user_data) +{ + struct rap_conn_mapping *mapping = data; + struct cs_state_machine *sm = user_data; + + if (!mapping || !sm) + return; + + DBG("Sending read remote capabilities for handle 0x%04X", + mapping->handle); + bt_rap_read_remote_supported_capabilities(sm, mapping->handle); +} + /* HCI Event Callbacks */ +static void rap_rd_loc_supp_cap_done_cb(const void *data, uint8_t size, + void *user_data) +{ + const struct bt_hci_rsp_le_cs_rd_loc_supp_cap *rsp; + struct cs_state_machine *sm = (struct cs_state_machine *) user_data; + + if (!sm || !data || + size < sizeof(struct bt_hci_rsp_le_cs_rd_loc_supp_cap)) + return; + + DBG("size=0x%02X", size); + + rsp = (const struct bt_hci_rsp_le_cs_rd_loc_supp_cap *) data; + + if (rsp->status != 0) { + error("Read Local Supported Capabilities failed: 0x%02X", + rsp->status); + return; + } + + DBG("Local CS Capabilities:"); + DBG(" Num Config Supported: %u", rsp->num_config_supported); + DBG(" Max Consecutive Procedures: %u", + rsp->max_consecutive_procedures_supported); + DBG(" Num Antennas: %u", rsp->num_antennas_supported); + DBG(" Max Antenna Paths: %u", rsp->max_antenna_paths_supported); + DBG(" Roles Supported: 0x%02X", rsp->roles_supported); + DBG(" Modes Supported: 0x%02X", rsp->modes_supported); + DBG(" RTT Capability: 0x%02X", rsp->rtt_capability); + DBG(" RTT AA Only N: %u", rsp->rtt_aa_only_n); + DBG(" RTT Sounding N: %u", rsp->rtt_sounding_n); + DBG(" RTT Random Payload N: %u", rsp->rtt_random_payload_n); + DBG(" NADM Sounding Capability: 0x%04X", + rsp->nadm_sounding_capability); + DBG(" NADM Random Capability: 0x%04X", rsp->nadm_random_capability); + DBG(" CS Sync PHYs Supported: 0x%02X", rsp->cs_sync_phys_supported); + DBG(" Subfeatures Supported: 0x%04X", rsp->subfeatures_supported); + DBG(" T_IP1 Times Supported: 0x%04X", rsp->t_ip1_times_supported); + DBG(" T_IP2 Times Supported: 0x%04X", rsp->t_ip2_times_supported); + DBG(" T_FCS Times Supported: 0x%04X", rsp->t_fcs_times_supported); + DBG(" T_PM Times Supported: 0x%04X", rsp->t_pm_times_supported); + DBG(" T_SW Time Supported: %u", rsp->t_sw_time_supported); + DBG(" TX SNR Capability: 0x%02X", rsp->tx_snr_capability); + + /* Transition to INIT state before reading remote capabilities */ + cs_set_state(sm, CS_STATE_INIT); + + /* Send read remote capabilities for all connected devices */ + if (sm->conn_mappings) { + DBG("Sending read remote capabilities for all connections"); + queue_foreach(sm->conn_mappings, + send_read_remote_cap_for_mapping, sm); + } +} + static void rap_def_settings_done_cb(const void *data, uint8_t size, void *user_data) { - struct bt_hci_rsp_le_cs_set_def_settings *rp; + const struct bt_hci_rsp_le_cs_set_def_settings *rp; struct cs_state_machine *sm = user_data; if (!sm || !data || size < sizeof(*rp)) @@ -250,10 +344,11 @@ static void rap_def_settings_done_cb(const void *data, uint8_t size, DBG("size=0x%02X", size); - rp = (struct bt_hci_rsp_le_cs_set_def_settings *) data; + rp = (const struct bt_hci_rsp_le_cs_set_def_settings *) data; - if (cs_get_current_state(sm) != CS_STATE_INIT) { - DBG("Event received in Wrong State!! Expected : CS_STATE_INIT"); + if (cs_get_current_state(sm) == CS_STATE_STOPPED || + cs_get_current_state(sm) == CS_STATE_UNSPECIFIED) { + DBG("Def settings response in terminal state, ignoring"); return; } @@ -261,9 +356,13 @@ static void rap_def_settings_done_cb(const void *data, uint8_t size, /* Success - proceed to configuration */ cs_set_state(sm, CS_STATE_WAIT_CONFIG_CMPLT); - /* Reflector role */ - DBG("Waiting for CS Config Completed event..."); - /* TODO: Initiator role - Send CS Config complete cmd */ + /* If role is initiator, send CS Create Config command */ + if (is_initiator_role(sm)) { + rap_send_hci_cs_create_config_command(sm, rp->handle); + } else { + /* Reflector role */ + DBG("Reflector role: Waiting for CS Config Completed"); + } } else { /* Error - transition to stopped */ error("CS Set default setting failed with status 0x%02X", @@ -272,8 +371,196 @@ static void rap_def_settings_done_cb(const void *data, uint8_t size, } } -static void rap_send_hci_def_settings_command(struct cs_state_machine *sm, +static void rap_send_hci_cs_create_config_command(struct cs_state_machine *sm, + uint16_t handle) +{ + struct bt_hci_cmd_le_cs_create_config cmd; + unsigned int status; + + uint8_t channel_map[10] = { + 0xFC, 0xFF, 0x7F, 0xFC, 0xFF, + 0xFF, 0xFF, 0xFF, 0xFF, 0x1F + }; + + if (!sm || !sm->hci) { + error("CS Create Config: sm or hci is null"); + return; + } + + DBG("Sending CS Create Config command for handle 0x%04X", handle); + + memset(&cmd, 0, sizeof(cmd)); + cmd.handle = cpu_to_le16(handle); + cmd.create_context = 1; + /* Default values, will change to pick user given values later */ + cmd.config_id = 0x00; + cmd.main_mode_type = 0x01; + cmd.sub_mode_type = 0xFF; + cmd.min_main_mode_steps = 0x02; + cmd.max_main_mode_steps = 0x03; + cmd.main_mode_repetition = 0x01; + cmd.mode_0_steps = 0x02; + cmd.role = 0x00; + cmd.rtt_type = 0x00; + cmd.cs_sync_phy = 0x01; + memcpy(cmd.channel_map, channel_map, 10); + cmd.channel_map_repetition = 0x01; + cmd.channel_selection_type = 0x00; + cmd.ch3c_shape = 0x00; + cmd.ch3c_jump = 0x02; + cmd.reserved = 0x00; + + status = bt_hci_send(sm->hci, BT_HCI_CMD_LE_CS_CREATE_CONFIG, + &cmd, sizeof(cmd), NULL, sm, NULL); + + if (!status) { + error("Failed to send CS Create Config command"); + cs_set_state(sm, CS_STATE_STOPPED); + return; + } + + DBG("CS Create Config command sent successfully"); +} + +static void rap_send_hci_cs_remove_config_command(struct cs_state_machine *sm, uint16_t handle) +{ + struct bt_hci_cmd_le_cs_remove_config cmd; + unsigned int status; + + if (!sm || !sm->hci) { + error("CS Remove Config: sm or hci is null"); + return; + } + + DBG("Sending CS Remove Config command for handle 0x%04X", handle); + + memset(&cmd, 0, sizeof(cmd)); + cmd.handle = cpu_to_le16(handle); + cmd.config_id = 0x00; /* Default config ID */ + + status = bt_hci_send(sm->hci, BT_HCI_CMD_LE_CS_REMOVE_CONFIG, + &cmd, sizeof(cmd), NULL, sm, NULL); + + if (!status) { + error("Failed to send CS Remove Config command"); + cs_set_state(sm, CS_STATE_STOPPED); + return; + } + + DBG("CS Remove Config command sent successfully"); +} + +static void rap_send_hci_cs_security_enable_command( + struct cs_state_machine *sm, uint16_t handle) +{ + struct bt_hci_cmd_le_cs_sec_enable cmd; + unsigned int status; + + if (!sm || !sm->hci) { + error("CS Security Enable: sm or hci is null"); + return; + } + + DBG("Sending CS Security Enable command for handle 0x%04X", handle); + + memset(&cmd, 0, sizeof(cmd)); + cmd.handle = cpu_to_le16(handle); + + status = bt_hci_send(sm->hci, BT_HCI_CMD_LE_CS_SEC_ENABLE, + &cmd, sizeof(cmd), NULL, sm, NULL); + + if (!status) { + error("Failed to send CS Security Enable command"); + cs_set_state(sm, CS_STATE_STOPPED); + return; + } + + DBG("CS Security Enable command sent successfully"); +} + +static bool rap_send_hci_cs_set_procedure_parameters( + struct cs_state_machine *sm, uint16_t handle) +{ + struct bt_hci_cmd_le_cs_set_proc_params cmd; + unsigned int status; + uint8_t min_sub_event_len[3] = { + 0x00, 0x20, 0x00 + }; + + uint8_t max_sub_event_len[3] = { + 0x03, 0x20, 0x00 + }; + + if (!sm || !sm->hci) { + error("CS Set Procedure Parameters: sm or hci is null"); + return false; + } + + DBG("Sending CS Set Procedure Parameters for handle 0x%04X", handle); + + memset(&cmd, 0, sizeof(cmd)); + cmd.handle = cpu_to_le16(handle); + /* Default values, will change to pick user given values later */ + cmd.config_id = 0x00; + cmd.max_procedure_len = 0x0640; + cmd.min_procedure_interval = 0x1E; + cmd.max_procedure_interval = 0x96; + cmd.max_procedure_count = 0x00; + memcpy(cmd.min_subevent_len, min_sub_event_len, 3); + memcpy(cmd.max_subevent_len, max_sub_event_len, 3); + cmd.tone_antenna_config_selection = 0x07; + cmd.phy = 0x01; + cmd.tx_power_delta = 0x80; + cmd.preferred_peer_antenna = 0x03; + cmd.snr_control_initiator = 0xFF; + cmd.snr_control_reflector = 0xFF; + + status = bt_hci_send(sm->hci, BT_HCI_CMD_LE_CS_SET_PROC_PARAMS, + &cmd, sizeof(cmd), NULL, sm, NULL); + + if (!status) { + error("Failed to send CS Set Procedure Parameters command"); + return false; + } + + DBG("CS Set Procedure Parameters command sent successfully"); + return true; +} + +static bool rap_send_hci_cs_procedure_enable(struct cs_state_machine *sm, + uint16_t handle, + bool enable_proc) +{ + struct bt_hci_cmd_le_cs_proc_enable cmd; + unsigned int status; + + if (!sm || !sm->hci) { + error("CS Procedure Enable: sm or hci is null"); + return false; + } + + DBG("Sending CS Procedure Enable for handle 0x%04X", handle); + + memset(&cmd, 0, sizeof(cmd)); + cmd.handle = cpu_to_le16(handle); + cmd.config_id = 0x00; /* Default config Id */ + cmd.enable = enable_proc ? 0x01 : 0x00; + + status = bt_hci_send(sm->hci, BT_HCI_CMD_LE_CS_PROC_ENABLE, + &cmd, sizeof(cmd), NULL, sm, NULL); + + if (!status) { + error("Failed to send CS Procedure Enable command"); + return false; + } + + DBG("CS Procedure Enable command sent successfully"); + return true; +} + +static void rap_send_hci_def_settings_command(struct cs_state_machine *sm, + const struct bt_hci_evt_le_cs_rd_rem_supp_cap_complete *ev) { struct bt_hci_cmd_le_cs_set_def_settings cp; unsigned int status; @@ -285,8 +572,8 @@ static void rap_send_hci_def_settings_command(struct cs_state_machine *sm, memset(&cp, 0, sizeof(cp)); - if (handle) - cp.handle = handle; + if (ev->handle) + cp.handle = ev->handle; cp.role_enable = sm->role_enable; /* Use preserved HCI command value */ cp.cs_sync_antenna_selection = sm->cs_opt.cs_sync_ant_sel; @@ -302,12 +589,93 @@ static void rap_send_hci_def_settings_command(struct cs_state_machine *sm, error("Failed to send default settings cmd"); } +static void rap_rd_rem_fae_cmplt_evt(const void *data, uint8_t size, + void *user_data) +{ + struct cs_state_machine *sm = (struct cs_state_machine *) user_data; + const struct bt_hci_evt_le_cs_rd_rem_fae_complete *evt; + struct iovec iov; + int i; + + if (!sm || !data || + size < sizeof(struct bt_hci_evt_le_cs_rd_rem_fae_complete)) + return; + + /* Initialize iovec with the event data */ + iov.iov_base = (void *) data; + iov.iov_len = size; + + /* Pull the entire structure at once */ + evt = util_iov_pull_mem(&iov, sizeof(*evt)); + + if (!evt) { + error("Failed to pull remote FAE complete struct"); + return; + } + + DBG("status=0x%02X, handle=0x%04X", evt->status, evt->handle); + + /* Check status */ + if (evt->status != 0) { + /* Status 0x11 (Unsupported Feature or Parameter Value) means + * the remote has zero FAE, the procedure continues + * to the Default Settings step. + */ + if (evt->status == 0x11) { + DBG("Remote FAE=0 (No_FAE), proceed to Def Settings"); + if (is_initiator_role(sm)) { + struct bt_hci_evt_le_cs_rd_rem_supp_cap_complete + tmp_ev; + + memset(&tmp_ev, 0, sizeof(tmp_ev)); + tmp_ev.handle = evt->handle; + DBG("Initiator: send def settings (No_FAE)"); + rap_send_hci_def_settings_command(sm, &tmp_ev); + } else { + DBG("Reflector role: continuing after No_FAE"); + cs_set_state(sm, CS_STATE_INIT); + } + return; + } + error("Remote FAE Table read failed with status 0x%02X", + evt->status); + cs_set_state(sm, CS_STATE_STOPPED); + return; + } + + DBG("Remote FAE Table received:"); + for (i = 0; i < 72; i += 8) { + DBG(" [%02d-%02d]: %02X %02X %02X %02X %02X %02X %02X %02X", + i, i+7, + evt->remote_fae_table[i], evt->remote_fae_table[i+1], + evt->remote_fae_table[i+2], evt->remote_fae_table[i+3], + evt->remote_fae_table[i+4], evt->remote_fae_table[i+5], + evt->remote_fae_table[i+6], evt->remote_fae_table[i+7]); + } + + /* After receiving FAE Table, send default settings */ + /* Local capabilities already read before this event */ + if (is_initiator_role(sm)) { + struct bt_hci_evt_le_cs_rd_rem_supp_cap_complete tmp_ev; + + memset(&tmp_ev, 0, sizeof(tmp_ev)); + tmp_ev.handle = evt->handle; + DBG("Initiator role: send def settings after FAE table"); + rap_send_hci_def_settings_command(sm, &tmp_ev); + } else { + DBG("Reflector role: Proceeding after FAE Table"); + cs_set_state(sm, CS_STATE_INIT); + } +} + static void rap_rd_rmt_supp_cap_cmplt_evt(const void *data, uint8_t size, void *user_data) { struct cs_state_machine *sm = user_data; const struct bt_hci_evt_le_cs_rd_rem_supp_cap_complete *evt; + struct bt_rap *rap; struct iovec iov; + uint16_t subfeatures_supported; if (!sm || !data || size < sizeof(*evt)) return; @@ -334,6 +702,16 @@ static void rap_rd_rmt_supp_cap_cmplt_evt(const void *data, uint8_t size, return; } + /* Resolve handle to RAP instance */ + rap = resolve_handle_to_rap(sm, evt->handle); + + if (!rap) { + DBG("[WARN] Could not resolve handle 0x%04X to RAP instance", + evt->handle); + /* Continue with state machine RAP for now */ + rap = sm->rap; + } + DBG("num_config=%u, ", evt->num_config_supported); DBG("max_consecutive_proc=%u, num_antennas=%u, ", @@ -343,9 +721,26 @@ static void rap_rd_rmt_supp_cap_cmplt_evt(const void *data, uint8_t size, evt->max_antenna_paths_supported, evt->roles_supported, evt->modes_supported); + subfeatures_supported = le16_to_cpu(evt->subfeatures_supported); + DBG("subfeatures_supported=0x%04X", subfeatures_supported); - rap_send_hci_def_settings_command(sm, evt->handle); - cs_set_state(sm, CS_STATE_INIT); + /* Check Bit 1 of subfeatures_supported (0x0002) */ + if (!(subfeatures_supported & 0x0002)) { + DBG("Bit 1 not set, sending Read Remote FAE Table"); + bt_rap_read_remote_fae_table(sm, evt->handle); + return; + } + + /* Local capabilities already read before this event */ + if (is_initiator_role(sm)) { + DBG("Initiator role: send def settings cmd for handle 0x%04X", + evt->handle); + rap_send_hci_def_settings_command(sm, evt); + } else { + DBG("Reflector role: send def settings cmd"); + cs_set_state(sm, CS_STATE_INIT); + rap_send_hci_def_settings_command(sm, evt); + } } static void rap_cs_config_cmplt_evt(const void *data, uint8_t size, @@ -383,8 +778,15 @@ static void rap_cs_config_cmplt_evt(const void *data, uint8_t size, /* Check status */ if (evt->status != 0) { - error("Configuration failed with status 0x%02X", - evt->status); + if (evt->action != 0x00) { + /* Create/update failed — try to remove the config */ + error("Configuration failed with status 0x%02X", + evt->status); + rap_send_hci_cs_remove_config_command(sm, evt->handle); + } else { + error("CS Config Remove failed with status 0x%02X", + evt->status); + } cs_set_state(sm, CS_STATE_STOPPED); return; } @@ -428,12 +830,40 @@ static void rap_cs_config_cmplt_evt(const void *data, uint8_t size, rap_ev.main_mode_type, rap_ev.sub_mode_type, rap_ev.role, rap_ev.rtt_type); + if (rap_ev.action == 0x00) { + cs_set_state(sm, CS_STATE_UNSPECIFIED); + DBG("CS Config Removed !!!"); + bt_rap_hci_cs_config_complete_callback(size, &rap_ev, sm->rap); + return; + } /* Success - proceed to Security enable complete */ cs_set_state(sm, CS_STATE_WAIT_SEC_CMPLT); - /* Reflector role */ - DBG("Waiting for security enable event..."); - /* TODO: Initiator role - Send CS Security enable cmd */ + /* CS Security Enable may only be issued by the BLE Central */ + if (rap_ev.role == 0x00) { + /* Initiator role */ + struct rap_conn_mapping *mapping; + + mapping = find_mapping_by_handle(sm, evt->handle); + if (!mapping || !mapping->is_central) { + error("CS Security Enable skipped: not BLE Central"); + cs_set_state(sm, CS_STATE_STOPPED); + return; + } + + if (bt_att_get_security(mapping->att, NULL) < + BT_ATT_SECURITY_MEDIUM) { + error("CS Security Enable skipped: not encrypted"); + cs_set_state(sm, CS_STATE_STOPPED); + return; + } + + DBG("Central,encrypted: Sending CS Security Enable command"); + rap_send_hci_cs_security_enable_command(sm, evt->handle); + } else { + /* Reflector role */ + DBG("Reflector role: Waiting for security enable event..."); + } /* Send callback to RAP Profile */ bt_rap_hci_cs_config_complete_callback(size, &rap_ev, sm->rap); @@ -486,9 +916,27 @@ static void rap_cs_sec_enable_cmplt_evt(const void *data, uint8_t size, /* Success - proceed to configuration */ cs_set_state(sm, CS_STATE_WAIT_PROC_CMPLT); - /* Reflector role */ - DBG("Waiting for CS Proc complete event..."); - /* TODO: Initiator - Send CS Proc Set Parameter and enable */ + /* Check if role is initiator */ + if (sm->cs_opt.role == CS_INITIATOR) { + DBG("Initiator role: Sending CS Set Procedure Params"); + if (!rap_send_hci_cs_set_procedure_parameters( + sm, handle)) { + error("Failed to send CS Set Procedure Params"); + cs_set_state(sm, CS_STATE_STOPPED); + return; + } + + DBG("Initiator role: Sending CS Procedure Enable"); + if (!rap_send_hci_cs_procedure_enable(sm, handle, + true)) { + error("Failed to send CS Procedure Enable"); + cs_set_state(sm, CS_STATE_STOPPED); + return; + } + } else { + // Reflector role + DBG("Reflector role: Waiting for CS Proc compl event"); + } } else { /* Error - transition to stopped */ error("Security enable failed with status 0x%02X", @@ -565,8 +1013,13 @@ static void rap_cs_proc_enable_cmplt_evt(const void *data, uint8_t size, rap_ev.proc_intrvl); /* Success - procedure started */ - cs_set_state(sm, CS_STATE_STARTED); - sm->procedure_active = true; + if (rap_ev.state == 0x01) { + cs_set_state(sm, CS_STATE_STARTED); + sm->procedure_active = true; + } else if (rap_ev.state == 0x00) { + cs_set_state(sm, CS_STATE_STOPPED); + sm->procedure_active = false; + } /* Send callback to RAP Profile */ bt_rap_hci_cs_procedure_enable_complete_callback(size, @@ -800,6 +1253,54 @@ static void parse_cs_step(struct iovec *iov, struct cs_step_data *step, } } +/* + * Handle the common step-parsing tail shared by both subevent result variants. + * Fixes truncation (num_steps_reported > CS_MAX_STEPS) by zeroing the step + * count and trimming send_len to header_size, matching the abort-status path. + */ +static void cs_parse_steps(struct iovec *iov, + uint8_t num_steps_reported, + uint8_t proc_done_status, + uint8_t subevt_done_status, + uint8_t abort_reason, + uint8_t cs_role, uint8_t cs_rtt_type, + uint8_t max_paths, + struct cs_step_data *step_data, + uint8_t *num_steps_out, + size_t *send_len, + size_t header_size) +{ + uint8_t steps = MIN(num_steps_reported, CS_MAX_STEPS); + uint8_t i; + + if (num_steps_reported > CS_MAX_STEPS) { + DBG("Too many steps reported: %u (max %u)", + num_steps_reported, CS_MAX_STEPS); + *num_steps_out = 0; + *send_len = header_size; + return; + } + + if (subevt_done_status == 0xF || proc_done_status == 0xF) { + DBG("CS Procedure/Subevent aborted: "); + DBG("sub evt status = %d, proc status = %d, reason = %d", + subevt_done_status, proc_done_status, abort_reason); + /* + * Step bytes were never parsed; zero-initialised step_data[] + * entries would appear as spurious mode-0 quality=0 steps to + * the BCS algorithm. Clear the count so an aborted subevent + * carries no fake measurements. + */ + *num_steps_out = 0; + *send_len = header_size; + return; + } + + for (i = 0; i < steps; i++) + parse_cs_step(iov, &step_data[i], cs_role, cs_rtt_type, + max_paths); +} + static void rap_cs_subevt_result_evt(const void *data, uint8_t size, void *user_data) { @@ -822,7 +1323,6 @@ static void rap_cs_subevt_result_evt(const void *data, uint8_t size, uint8_t abort_reason; uint8_t num_ant_paths; uint8_t num_steps_reported; - uint8_t i; if (!sm || !data || size < sizeof(struct bt_hci_evt_le_cs_subevent_result)) @@ -883,28 +1383,13 @@ static void rap_cs_subevt_result_evt(const void *data, uint8_t size, rap_ev->num_ant_paths = num_ant_paths; rap_ev->num_steps_reported = steps; - if (num_steps_reported > CS_MAX_STEPS) { - DBG("Too many steps reported: %u (max %u)", - num_steps_reported, CS_MAX_STEPS); - goto send_event; - } - - /* Early exit for error conditions */ - if (rap_ev->subevt_done_status == 0xF || - rap_ev->proc_done_status == 0xF) { - DBG("CS Procedure/Subevent aborted: "); - DBG("sub evt status = %d, proc status = %d, reason = %d", - rap_ev->subevt_done_status, rap_ev->proc_done_status, - rap_ev->abort_reason); - goto send_event; - } + cs_parse_steps(&iov, num_steps_reported, + proc_done_status, subevt_done_status, abort_reason, + cs_role, cs_rtt_type, max_paths, + rap_ev->step_data, &rap_ev->num_steps_reported, + &send_len, + offsetof(struct rap_ev_cs_subevent_result, step_data)); - /* Parse interleaved step data from remaining iovec data */ - for (i = 0; i < steps; i++) - parse_cs_step(&iov, &rap_ev->step_data[i], cs_role, cs_rtt_type, - max_paths); - -send_event: DBG("CS subevent result processed: %zu bytes, ", send_len); bt_rap_hci_cs_subevent_result_callback(send_len, rap_ev, sm->rap); free(rap_ev); @@ -920,7 +1405,7 @@ static void rap_cs_subevt_result_cont_evt(const void *data, uint8_t size, uint8_t cs_rtt_type; uint8_t max_paths; uint8_t steps; - size_t send_len = 0; + size_t send_len; uint16_t handle; uint8_t config_id; uint8_t proc_done_status; @@ -928,7 +1413,6 @@ static void rap_cs_subevt_result_cont_evt(const void *data, uint8_t size, uint8_t abort_reason; uint8_t num_ant_paths; uint8_t num_steps_reported; - uint8_t i; if (!sm || !data || size < sizeof(struct bt_hci_evt_le_cs_subevent_result_continue)) @@ -981,28 +1465,14 @@ static void rap_cs_subevt_result_cont_evt(const void *data, uint8_t size, rap_ev->num_ant_paths = num_ant_paths; rap_ev->num_steps_reported = steps; - if (num_steps_reported > CS_MAX_STEPS) { - DBG("Too many steps reported: %u (max %u)", - num_steps_reported, CS_MAX_STEPS); - goto send_event; - } - - /* Early exit for error conditions */ - if (rap_ev->subevt_done_status == 0xF || - rap_ev->proc_done_status == 0xF) { - DBG("CS Procedure/Subevent aborted: "); - DBG("sub evt status = %d, proc status = %d, reason = %d", - rap_ev->subevt_done_status, rap_ev->proc_done_status, - rap_ev->abort_reason); - goto send_event; - } - - /* Parse interleaved step data from remaining iovec data */ - for (i = 0; i < steps; i++) - parse_cs_step(&iov, &rap_ev->step_data[i], cs_role, cs_rtt_type, - max_paths); + cs_parse_steps(&iov, num_steps_reported, + proc_done_status, subevt_done_status, abort_reason, + cs_role, cs_rtt_type, max_paths, + rap_ev->step_data, &rap_ev->num_steps_reported, + &send_len, + offsetof(struct rap_ev_cs_subevent_result_cont, + step_data)); -send_event: DBG("CS subevent result cont processed: %zu bytes, ", send_len); bt_rap_hci_cs_subevent_result_cont_callback(send_len, rap_ev, sm->rap); free(rap_ev); @@ -1010,6 +1480,208 @@ send_event: /* Subevent handler function type */ +/* This cmd is used by host to update channel classification + * function will be used when user sets channel classification + * keeping it unused till DBUS API is added */ +bool __maybe_unused bt_rap_set_channel_classification(void *hci_sm, + const uint8_t *channel_map) +{ + struct cs_state_machine *sm = hci_sm; + struct bt_hci_cmd_le_cs_set_chan_class cmd; + struct timespec now; + unsigned int status; + uint8_t default_map[10]; + int i, enabled_count = 0; + long diff_ms; + + if (!sm || !sm->hci) { + error("Invalid state machine or HCI"); + return false; + } + + /* If no channel map provided, create default map */ + if (!channel_map) { + memset(default_map, 0, sizeof(default_map)); + + /* Enable channels 2-22 and 26-76 (total 72 channels) + * Channels 0, 1, 23, 24, 25, 77, 78, 79 are reserved/disabled + */ + for (i = 2; i <= 22; i++) { + default_map[i / 8] |= (1 << (i % 8)); + } + for (i = 26; i <= 76; i++) { + default_map[i / 8] |= (1 << (i % 8)); + } + + channel_map = default_map; + } else { + /* Validate the provided channel map */ + /* Check reserved channels are disabled */ + if ((channel_map[0] & 0x03) != 0) { /* Channels 0, 1 */ + error("Channels 0 and 1 must be disabled (reserved)"); + return false; + } + if ((channel_map[2] & 0x80) != 0) { /* Channel 23 */ + error("Channel 23 must be disabled (reserved)"); + return false; + } + if ((channel_map[3] & 0x03) != 0) { /* Channels 24, 25 */ + error("Channels 24 and 25 must be disabled (reserved)"); + return false; + } + if ((channel_map[9] & 0xE0) != 0) { /* Ch 77, 78 and RFU bit */ + error("Channels 77, 78, 79 must be disabled (res)"); + return false; + } + + /* Count enabled channels using popcount; mask reserved bits: + * ch 0-1 (byte 0 bits 0-1), ch 23 (byte 2 bit 7), + * ch 24-25 (byte 3 bits 0-1), ch 77-79 (byte 9 bits 5-7). + */ + { + uint8_t masked[10]; + + memcpy(masked, channel_map, 10); + masked[0] &= 0xFC; + masked[2] &= 0x7F; + masked[3] &= 0xFC; + masked[9] &= 0x1F; + for (i = 0; i < 10; i++) + enabled_count += __builtin_popcount(masked[i]); + } + + if (enabled_count < 15) { + error("At least 15 channels must be enabled (found %d)", + enabled_count); + return false; + } + } + + /* Controller rejects with Command Disallowed (0x0C) + * if less than 1 second has elapsed since the + * last invocation. Enforce the limit here to avoid silent failures. + */ + clock_gettime(CLOCK_MONOTONIC, &now); + if (sm->last_chan_class_time.tv_sec != 0 || + sm->last_chan_class_time.tv_nsec != 0) { + diff_ms = (now.tv_sec - + sm->last_chan_class_time.tv_sec) * 1000 + + (now.tv_nsec - + sm->last_chan_class_time.tv_nsec) / 1000000; + + if (diff_ms < 1000) { + error("CS Set Channel Classification throttled: " + "only %ldms since last call (min 1000ms)", + diff_ms); + return false; + } + } + sm->last_chan_class_time = now; + + DBG("Sending CS Set Channel Classification command"); + + memset(&cmd, 0, sizeof(cmd)); + memcpy(cmd.channel_classification, channel_map, 10); + + status = bt_hci_send(sm->hci, BT_HCI_CMD_LE_CS_SET_CHAN_CLASS, + &cmd, sizeof(cmd), NULL, sm, NULL); + + if (!status) { + error("Failed to send CS Set Channel Classification command"); + return false; + } + + DBG("CS Set Channel Classification command sent successfully"); + return true; +} + +static bool bt_rap_read_remote_fae_table(void *hci_sm, uint16_t handle) +{ + struct cs_state_machine *sm = hci_sm; + struct bt_hci_cmd_le_cs_rd_rem_fae cmd; + unsigned int status; + + if (!sm || !sm->hci) { + error("Invalid state machine or HCI"); + return false; + } + + DBG("Sending Read Remote FAE Table for handle 0x%04X", handle); + + memset(&cmd, 0, sizeof(cmd)); + cmd.handle = cpu_to_le16(handle); + + status = bt_hci_send(sm->hci, BT_HCI_CMD_LE_CS_RD_REM_FAE, + &cmd, sizeof(cmd), NULL, sm, NULL); + + if (!status) { + error("Failed to send Read Remote FAE Table command"); + return false; + } + + DBG("Read Remote FAE Table command sent successfully"); + return true; +} + +/* This cmd is used by host to start cs distance measurement procedure + * function will be used when user start distance measurement + * keeping it unused till DBUS API is added */ +static bool __maybe_unused bt_rap_read_local_supported_capabilities( + void *hci_sm) +{ + struct cs_state_machine *sm = hci_sm; + unsigned int status; + + if (!sm || !sm->hci) { + error("Invalid state machine or HCI"); + return false; + } + + DBG("Sending Read Local Supported Capabilities command"); + + status = bt_hci_send(sm->hci, BT_HCI_CMD_LE_CS_RD_LOC_SUPP_CAP, + NULL, 0, rap_rd_loc_supp_cap_done_cb, + sm, NULL); + + if (!status) { + error("Failed to send Read Local Supported Capabilities"); + return false; + } + + DBG("Read Local Supported Capabilities command sent successfully"); + return true; +} + +static bool bt_rap_read_remote_supported_capabilities(void *hci_sm, + uint16_t handle) +{ + struct cs_state_machine *sm = hci_sm; + struct bt_hci_cmd_le_cs_rd_rem_supp_cap cmd; + unsigned int status; + + if (!sm || !sm->hci) { + error("Invalid state machine or HCI"); + return false; + } + + DBG("Sending Read Remote Supported Capabilities for handle 0x%04X", + handle); + + memset(&cmd, 0, sizeof(cmd)); + cmd.handle = cpu_to_le16(handle); + + status = bt_hci_send(sm->hci, BT_HCI_CMD_LE_CS_RD_REM_SUPP_CAP, + &cmd, sizeof(cmd), NULL, sm, NULL); + + if (!status) { + error("Failed to send Read Remote Capabilities command"); + return false; + } + + DBG("Read Remote Capabilities command sent successfully"); + return true; +} + static void unregister_event_id(void *data, void *user_data) { struct bt_hci *hci = user_data; @@ -1041,6 +1713,11 @@ void *bt_rap_attach_hci(struct bt_rap *rap, struct bt_hci *hci, max_tx_power); sm->event_ids = queue_new(); + if (!sm->event_ids) { + error("Failed to allocate event_ids queue"); + free(sm); + return NULL; + } /* Register each LE Meta subevent individually */ id = bt_hci_register_subevent(hci, @@ -1051,6 +1728,15 @@ void *bt_rap_attach_hci(struct bt_rap *rap, struct bt_hci *hci, queue_push_tail(sm->event_ids, UINT_TO_PTR(id)); + id = bt_hci_register_subevent(hci, + BT_HCI_EVT_LE_CS_RD_REM_FAE_COMPLETE, + rap_rd_rem_fae_cmplt_evt, sm, NULL); + + if (!id) + goto fail; + + queue_push_tail(sm->event_ids, UINT_TO_PTR(id)); + id = bt_hci_register_subevent(hci, BT_HCI_EVT_LE_CS_CONFIG_COMPLETE, rap_cs_config_cmplt_evt, sm, NULL); @@ -1100,12 +1786,14 @@ fail: error("Failed to register hci le meta subevents"); queue_foreach(sm->event_ids, unregister_event_id, hci); queue_destroy(sm->event_ids, NULL); + queue_destroy(sm->conn_mappings, mapping_free); free(sm); return NULL; } -bool bt_rap_set_conn_handle(void *hci_sm, struct bt_rap *rap, uint16_t handle, - const uint8_t *bdaddr, uint8_t bdaddr_type) +bool bt_rap_set_conn_handle(void *hci_sm, struct bt_rap *rap, + uint16_t handle, const uint8_t *bdaddr, uint8_t bdaddr_type, + bool is_central) { struct cs_state_machine *sm = hci_sm; struct bt_att *att; @@ -1124,7 +1812,8 @@ bool bt_rap_set_conn_handle(void *hci_sm, struct bt_rap *rap, uint16_t handle, bdaddr[2], bdaddr[1], bdaddr[0], bdaddr_type); } - return add_conn_mapping(sm, handle, bdaddr, bdaddr_type, att, rap); + return add_conn_mapping(sm, handle, bdaddr, bdaddr_type, is_central, + att, rap); } void bt_rap_clear_conn_handle(void *hci_sm, uint16_t handle) @@ -1157,9 +1846,6 @@ void bt_rap_detach_hci(struct bt_rap *rap, void *hci_sm) queue_destroy(sm->event_ids, NULL); /* Clean up per-instance connection mappings */ - remove_rap_mappings(sm); - - /* Destroy the connection mappings queue */ queue_destroy(sm->conn_mappings, mapping_free); /* Free the state machine */ -- ^ permalink raw reply related [flat|nested] 4+ messages in thread
end of thread, other threads:[~2026-06-09 12:29 UTC | newest] Thread overview: 4+ messages (download: mbox.gz follow: Atom feed -- links below jump to the message on this page -- 2026-06-09 10:49 [PATCH BlueZ v1 0/2] Initial Channel Sounding Support for Naga Bhavani Akella 2026-06-09 10:49 ` [PATCH BlueZ v1 1/2] shared: rap: Add the is_central parameter to verify whether the local role is central before sending the HCI CS Security Enable command Naga Bhavani Akella 2026-06-09 12:29 ` Initial Channel Sounding Support for bluez.test.bot 2026-06-09 10:49 ` [PATCH BlueZ v1 2/2] profiles: ranging: Add command flow and event support for CS Initiator Naga Bhavani Akella
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox