[PATCH BlueZ v5 0/4] doc: Add Channel Sounding API

[PATCH BlueZ v5 0/4] doc: Add Channel Sounding API

[Naga Bhavani Akella]

Improve Channel Sounding documentation by adding cross-references
between the D-Bus APIs and bluetoothctl commands, along with practical
usage examples.

The D-Bus API documents gain :Used by: references to the bluetoothctl
cs submenu and examples for methods and signals, while the
bluetoothctl documentation is updated with :Uses: references,
argument descriptions, and usage examples.

Changes in v5:
- Add Example scripts for cs reflector and initiator 
- Document CS params per-command

Changes in v4:
- Addressed review comments.
- Dropped the rest of the previously submitted series pending redesign

Changes in v3:
- Addressed review comments.
- Dropped the rest of the previously submitted series pending redesign

Changes in v2:
- Addressed review comments.
- Dropped the rest of the previously submitted series pending redesign

Naga Bhavani Akella (4):
  doc/org.bluez.ChannelSounding1:Add Used by reference and Examples
  doc/org.bluez.ChannelSoundingRanging1:Add references and examples
  doc/bluetoothctl-cs: Add :Uses: fields and document arguments
  client: Add scripts to start cs Initiator/reflector

 Makefile.am                               |   4 +
 Makefile.tools                            |   5 +-
 client/scripts/cs-initiator.bt            |   6 +
 client/scripts/cs-reflector.bt            |   5 +
 doc/bluetoothctl-cs.rst                   | 546 ++++++++++++++++++++++
 doc/org.bluez.ChannelSounding1.rst        | 534 +++++++++++++++++++++
 doc/org.bluez.ChannelSoundingRanging1.rst |  66 +++
 7 files changed, 1164 insertions(+), 2 deletions(-)
 create mode 100644 client/scripts/cs-initiator.bt
 create mode 100644 client/scripts/cs-reflector.bt
 create mode 100644 doc/bluetoothctl-cs.rst
 create mode 100644 doc/org.bluez.ChannelSounding1.rst
 create mode 100644 doc/org.bluez.ChannelSoundingRanging1.rst

-- 

[PATCH BlueZ v5 1/4] doc/org.bluez.ChannelSounding1:Add Used by reference and Examples

[Naga Bhavani Akella]

Add :Used by: field linking to bluetoothctl cs submenu and
Examples section showing corresponding bluetoothctl cs commands
for D-Bus methods
---
 doc/org.bluez.ChannelSounding1.rst | 534 +++++++++++++++++++++++++++++
 1 file changed, 534 insertions(+)
 create mode 100644 doc/org.bluez.ChannelSounding1.rst

diff --git a/doc/org.bluez.ChannelSounding1.rst b/doc/org.bluez.ChannelSounding1.rst
new file mode 100644
index 000000000..c06e1d728
--- /dev/null
+++ b/doc/org.bluez.ChannelSounding1.rst
@@ -0,0 +1,534 @@
+==========================
+org.bluez.ChannelSounding1
+==========================
+
+----------------------------------------------
+BlueZ D-Bus Channel Sounding API documentation
+----------------------------------------------
+
+:Version: BlueZ
+:Date: June 2026
+:Manual section: 5
+:Manual group: Linux System Administration
+
+Interface
+=========
+
+:Service:	org.bluez
+:Interface:	org.bluez.ChannelSounding1
+:Object path:	[variable prefix]/{hci0,hci1,...}/dev_XX_XX_XX_XX_XX_XX
+:Used by:	**bluetoothctl(1)**, **bluetoothctl-cs(1)**
+
+Methods
+-------
+
+void StartMeasurement(dict params)
+``````````````````````````````````
+
+Starts a Channel Sounding distance measurement procedure on the connected
+device. All configuration is supplied in a single ``a{sv}`` dictionary.
+Any key that is omitted retains its current value in the daemon.
+
+The device to measure is identified by the D-Bus object path on which
+this method is called
+(``[variable prefix]/{hci0,hci1,...}/dev_XX_XX_XX_XX_XX_XX``).
+Only one measurement per device object may be active at a time. Calling
+**StartMeasurement** while a session is already active returns
+``org.bluez.Error.InProgress``.
+
+When ``role`` is Reflector (``0x02``), this method does not start a CS
+distance measurement: a Reflector never initiates a procedure locally,
+so it cannot start one via this call. Instead, all given configuration
+is applied and stored so the controller is ready to respond once a
+remote Initiator begins a procedure, and the method returns success
+without arming a local measurement session. The ``Active`` property
+only transitions to ``true`` when a remote-initiated procedure
+actually starts, which may happen well after this method returns (or
+not at all, if the remote never initiates one). Clients that watch
+``PropertiesChanged`` for ``Active`` (as **bluetoothctl-cs(1)** does)
+are notified of both the remote-initiated start and its eventual stop.
+
+For Initiator role (or Both), ``duration_secs`` and the device object
+path are the parameters that matter to start a measurement; every
+other key below is optional configuration with a usable default. For
+Reflector role, only ``role``, ``sync_ant_sel`` and ``max_tx_power``
+are required or have any effect — the remaining keys are accepted but
+otherwise unused, since no local procedure is armed.
+
+Supported dictionary keys:
+
+:uint32 duration_secs (Default: 0):
+
+	Duration in seconds before the measurement is stopped
+	automatically. A value of 0 disables the automatic timeout.
+
+:byte role (Default: 0x03):
+
+	CS role to use for the measurement.
+
+	Possible values:
+
+	:0x01: Initiator
+	:0x02: Reflector
+	:0x03: Both (Initiator and Reflector)
+
+:byte sync_ant_sel (Default: 0xFF):
+
+	CS sync antenna selection. Values 0xFE and 0xFF are reserved
+	by the Bluetooth specification.
+
+:byte max_tx_power (Default: 0x14):
+
+	Maximum TX power in dBm, treated as a signed value. Valid
+	range is -127 to +20 dBm.
+
+:byte config_id:
+
+	CS configuration identifier.
+
+:byte main_mode_type:
+
+	Main CS mode used in the procedure.
+
+:byte sub_mode_type:
+
+	Sub-mode within the main mode. Set to 0xFF when unused.
+
+:byte main_mode_min_steps:
+
+	Minimum number of CS main mode steps per CS subevent.
+
+:byte main_mode_max_steps:
+
+	Maximum number of CS main mode steps per CS subevent.
+
+:byte main_mode_repetition:
+
+	Number of times the main mode steps are repeated in a
+	subevent.
+
+:byte mode0_steps:
+
+	Number of CS Mode 0 steps at the beginning of each subevent.
+
+:byte rtt_types:
+
+	Round Trip Time measurement types for the configuration.
+
+:byte sync_phy:
+
+	PHY used for CS sync packets.
+
+	Possible values:
+
+	:0x01: LE 1M PHY
+	:0x02: LE 2M PHY
+
+:array{byte} channel_map:
+
+	10-byte channel map bitmap. Must be exactly 10 bytes.
+
+:byte channel_map_repetition:
+
+	Number of consecutive repetitions of the channel map.
+
+:byte channel_selection_type:
+
+	Algorithm used for CS channel selection.
+
+:byte channel_shape:
+
+	Shape used in the channel selection algorithm.
+
+:byte channel_jump:
+
+	Channel jump size used in the channel selection algorithm.
+
+:byte companion_signal_enable:
+
+	Set to 1 to transmit a companion signal alongside the CS
+	tone, 0 to disable.
+
+:uint16 max_procedure_duration:
+
+	Maximum duration of a single CS measurement procedure.
+
+:uint16 min_period_between_procedures:
+
+	Minimum time between consecutive CS measurement procedures.
+
+:uint16 max_period_between_procedures:
+
+	Maximum time between consecutive CS measurement procedures.
+
+:uint16 max_procedure_count:
+
+	Maximum number of CS measurement procedures to run.
+	A value of 0 means no limit.
+
+:array{byte} min_sub_event_len:
+
+	Minimum CS subevent length as a 3-byte little-endian value.
+	Must be exactly 3 bytes.
+
+:array{byte} max_sub_event_len:
+
+	Maximum CS subevent length as a 3-byte little-endian value.
+	Must be exactly 3 bytes.
+
+:byte tone_antenna_config_selection:
+
+	Antenna configuration used for CS tone exchanges.
+
+:byte phy:
+
+	PHY used during CS procedures.
+
+	Possible values:
+
+	:0x01: LE 1M PHY
+	:0x02: LE 2M PHY
+
+:byte tx_power_delta:
+
+	Difference between remote and local TX power during CS
+	procedures. 0x80 indicates not applicable.
+
+:byte preferred_peer_antenna:
+
+	Preferred antenna to be used by the peer device.
+
+:byte snr_control_initiator:
+
+	SNR control setting for the initiator role.
+	0xFF indicates no preference.
+
+:byte snr_control_reflector:
+
+	SNR control setting for the reflector role.
+	0xFF indicates no preference.
+
+Possible errors:
+
+:org.bluez.Error.InProgress:
+:org.bluez.Error.InvalidArgs:
+:org.freedesktop.DBus.Error.Failed:
+
+Examples:
+
+:bluetoothctl set role then start:
+	| [cs] > role 0x01
+	| [cs] > main_mode_type 2
+	| [cs] > start AA:BB:CC:DD:EE:FF
+:bluetoothctl start with defaults:
+	| [cs] > start [dev_addr] [duration_secs]
+:bluetoothctl configure as Reflector (applies settings, does not start a measurement):
+	| [cs] > role 0x02
+	| [cs] > start
+
+void StopMeasurement(void)
+``````````````````````````
+
+Stops the active Channel Sounding distance measurement on this device.
+The device is identified by the D-Bus object path on which this method
+is called — no session identifier is required.
+
+Raises ``org.bluez.Error.NotConnected`` if no measurement is active.
+
+Possible errors:
+
+:org.bluez.Error.NotConnected:
+:org.freedesktop.DBus.Error.Failed:
+
+In **bluetoothctl(1)**, the device address argument may be omitted only
+when a single measurement is active; it is required when multiple
+measurements are active.
+
+Examples:
+
+:bluetoothctl stop the only active measurement:
+	| [cs] > stop
+:bluetoothctl stop a specific device when multiple are active:
+	| [cs] > stop AA:BB:CC:DD:EE:FF
+
+Signals
+-------
+
+void ProcedureData(dict data)
+``````````````````````````````
+
+Emitted when a Channel Sounding measurement procedure completes on this
+device, carrying the raw CS procedure results as reported by the
+controller. Consumers such as an external ranging estimation daemon
+subscribe to this signal to compute distance estimates.
+
+:dict data:
+
+	:int32 procedureCounter:
+
+		Procedure counter value from the controller.
+
+	:int32 procedureSequence:
+
+		Sequence number of this procedure.
+
+	:byte initiatorSelectedTxPower:
+
+		TX power selected by the Initiator, treated as a signed
+		value.
+
+	:byte reflectorSelectedTxPower:
+
+		TX power selected by the Reflector, treated as a signed
+		value.
+
+	:uint32 initiatorSubeventCount:
+
+		Number of subevent results reported by the Initiator.
+
+	:array{dict} initiatorSubeventResults:
+
+		Present only when ``initiatorSubeventCount`` is greater
+		than 0. One entry per Initiator subevent, each with the
+		fields described in `Subevent Result`_ below.
+
+	:byte initiatorProcedureAbortReason:
+
+		Reason the Initiator's procedure was aborted, 0 if not
+		aborted.
+
+	:uint32 reflectorSubeventCount:
+
+		Number of subevent results reported by the Reflector.
+
+	:array{dict} reflectorSubeventResults:
+
+		Present only when ``reflectorSubeventCount`` is greater
+		than 0. One entry per Reflector subevent, each with the
+		fields described in `Subevent Result`_ below.
+
+	:byte reflectorProcedureAbortReason:
+
+		Reason the Reflector's procedure was aborted, 0 if not
+		aborted.
+
+	:dict procedureEnableConfig:
+
+		:byte toneAntennaConfigSelection:
+
+			Antenna configuration used for CS tone exchanges.
+
+		:uint32 subeventLenUs:
+
+			Subevent length in microseconds.
+
+		:byte subeventsPerEvent:
+
+			Number of subevents per event.
+
+		:uint32 subeventInterval:
+
+			Interval between subevents.
+
+		:uint32 eventInterval:
+
+			Interval between events.
+
+		:uint32 procedureInterval:
+
+			Interval between procedures.
+
+		:uint32 procedureCount:
+
+			Number of procedures configured.
+
+		:uint32 maxProcedureLen:
+
+			Maximum procedure length.
+
+	:dict csConfigParam:
+
+		:byte modeType:
+
+			Main CS mode used in the procedure.
+
+		:byte subModeType:
+
+			Sub-mode within the main mode.
+
+		:byte rttType:
+
+			Round Trip Time measurement type.
+
+		:array{byte} channelMap:
+
+			10-byte channel map bitmap.
+
+		:byte minMainModeSteps:
+		:byte maxMainModeSteps:
+		:byte mainModeRepetition:
+		:byte mode0Steps:
+
+		:byte role:
+
+			CS role in effect for the procedure (Initiator,
+			Reflector, or Both).
+
+		:byte csSyncPhyType:
+
+			PHY used for CS sync packets.
+
+		:byte channelSelectionType:
+		:byte ch3cShapeType:
+		:byte ch3cJump:
+		:byte channelMapRepetition:
+		:byte tIp1TimeUs:
+		:byte tIp2TimeUs:
+		:byte tFcsTimeUs:
+		:byte tPmTimeUs:
+		:byte tSwTimeUsSupportedByLocal:
+		:byte tSwTimeUsSupportedByRemote:
+
+		:uint32 bleConnInterval:
+
+			BLE connection interval in effect during the
+			procedure.
+
+Subevent Result
+~~~~~~~~~~~~~~~~
+
+Each element of ``initiatorSubeventResults`` and
+``reflectorSubeventResults`` is a dict with the following fields:
+
+:int32 startAclConnEvtCounter:
+
+	ACL connection event counter at the start of the subevent.
+
+:int32 freqComp:
+
+	Frequency compensation value.
+
+:byte refPwrLvl:
+
+	Reference power level, treated as a signed value.
+
+:byte numAntPaths:
+
+	Number of antenna paths used.
+
+:byte subeventAbortReason:
+
+	Reason the subevent was aborted, 0 if not aborted.
+
+:uint64 timestampNanos:
+
+	Timestamp of the subevent result, in nanoseconds.
+
+:uint32 numSteps:
+
+	Number of steps reported in this subevent.
+
+:array{dict} stepData:
+
+	One entry per step. Each entry has:
+
+	:byte stepMode:
+
+		CS step mode (0-3).
+
+	:byte stepChannel:
+
+		Channel used for the step.
+
+	:dict modeZeroData:
+
+		Present when ``stepMode`` is 0.
+
+		:byte packetQuality:
+		:byte packetRssiDbm:
+		:byte packetAntenna:
+
+		:int32 initiatorMeasuredFreqOffset:
+
+			Frequency offset measured by the Initiator.
+
+	:dict modeOneData:
+
+		Present when ``stepMode`` is 1.
+
+		:byte packetQuality:
+		:byte packetNadm:
+		:byte packetRssiDbm:
+
+		:int32 toaTodInitiator:
+
+			Time of Arrival / Time of Departure at the
+			Initiator.
+
+		:int32 todToaReflector:
+
+			Time of Departure / Time of Arrival at the
+			Reflector.
+
+		:byte packetAntenna:
+
+		:array{int32} packetPct1:
+
+			In-phase/quadrature sample pair, as
+			``[i_sample, q_sample]``.
+
+		:array{int32} packetPct2:
+
+			In-phase/quadrature sample pair, as
+			``[i_sample, q_sample]``.
+
+	:dict modeTwoData:
+
+		Present when ``stepMode`` is 2.
+
+		:byte antennaPermutationIndex:
+
+		:array{int32} tonePctIQSamples:
+
+			Interleaved in-phase/quadrature tone samples, as
+			``[i_sample, q_sample, ...]`` — one pair per
+			antenna path.
+
+		:array{byte} toneQualityIndicators:
+
+			One quality indicator byte per antenna path.
+
+	:dict modeThreeData:
+
+		Present when ``stepMode`` is 3. Contains the combined
+		fields of both **modeOneData** and **modeTwoData**.
+
+Properties
+----------
+
+boolean Active [readonly]
+`````````````````````````
+
+Indicates whether a CS distance measurement procedure is currently
+active on this device.
+
+Set to ``true`` when a procedure starts — either because the local
+Initiator called **StartMeasurement** successfully, or because the
+remote Initiator enabled a CS procedure on the local Reflector.
+
+Set to ``false`` when the procedure stops for any reason: the local
+application called **StopMeasurement**, the measurement duration timer
+expired, or the ACL connection was dropped.
+
+This property emits ``PropertiesChanged`` on every transition so that
+clients can track measurement state without polling.
+
+RESOURCES
+=========
+
+http://www.bluez.org
+
+REPORTING BUGS
+==============
+
+linux-bluetooth@vger.kernel.org
-- 

RE: doc: Add Channel Sounding API

[bluez.test.bot]

[-- Attachment #1: Type: text/plain, Size: 10689 bytes --]

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=1127251

---Test result---

Test Summary:
CheckPatch                    PASS      1.34 seconds
GitLint                       PASS      0.97 seconds
BuildEll                      FAIL      11.48 seconds
BluezMake                     FAIL      423.10 seconds
MakeCheck                     FAIL      12.92 seconds
MakeDistcheck                 PASS      106.43 seconds
CheckValgrind                 FAIL      83.99 seconds
CheckSmatch                   PASS      174.95 seconds
bluezmakeextell               FAIL      4.35 seconds
IncrementalBuild              FAIL      481.68 seconds
ScanBuild                     PASS      551.19 seconds

Details
##############################
Test: BuildEll - FAIL
Desc: Build and Install ELL
Output:

writing RSA key
writing RSA key
writing RSA key
writing RSA key
writing RSA key
make[1]: *** [Makefile:3293: unit/ec-cert-server.pem] Error 1
make[1]: *** Waiting for unfinished jobs....
make: *** [Makefile:1309: all] Error 2
##############################
Test: BluezMake - FAIL
Desc: Build BlueZ
Output:

tools/mgmt-tester.c: In function ‘main’:
tools/mgmt-tester.c:12990:5: note: variable tracking size limit exceeded with ‘-fvar-tracking-assignments’, retrying without
12990 | int main(int argc, char *argv[])
      |     ^~~~
unit/test-avdtp.c: In function ‘main’:
unit/test-avdtp.c:766:5: note: variable tracking size limit exceeded with ‘-fvar-tracking-assignments’, retrying without
  766 | int main(int argc, char *argv[])
      |     ^~~~
unit/test-avrcp.c: In function ‘main’:
unit/test-avrcp.c:989:5: note: variable tracking size limit exceeded with ‘-fvar-tracking-assignments’, retrying without
  989 | int main(int argc, char *argv[])
      |     ^~~~
monitor/packet.c: In function ‘print_features_subpage’:
monitor/packet.c:2940:29: error: ‘%u’ directive writing between 1 and 10 bytes into a region of size between 5 and 7 [-Werror=format-overflow=]
 2940 |   sprintf(str, "Features[%u/%u]", page, i);
      |                             ^~
monitor/packet.c:2940:16: note: directive argument in the range [0, 2147483646]
 2940 |   sprintf(str, "Features[%u/%u]", page, i);
      |                ^~~~~~~~~~~~~~~~~
In file included from /usr/include/stdio.h:867,
                 from monitor/packet.c:18:
/usr/include/x86_64-linux-gnu/bits/stdio2.h:36:10: note: ‘__builtin___sprintf_chk’ output between 14 and 25 bytes into a destination of size 18
   36 |   return __builtin___sprintf_chk (__s, __USE_FORTIFY_LEVEL - 1,
      |          ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   37 |       __bos (__s), __fmt, __va_arg_pack ());
      |       ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
cc1: all warnings being treated as errors
make[1]: *** [Makefile:7063: monitor/packet.o] Error 1
make[1]: *** Waiting for unfinished jobs....
make: *** [Makefile:4177: all] Error 2
##############################
Test: MakeCheck - FAIL
Desc: Run Bluez Make Check
Output:

monitor/packet.c: In function ‘print_features_subpage’:
monitor/packet.c:2940:29: error: ‘%u’ directive writing between 1 and 10 bytes into a region of size between 5 and 7 [-Werror=format-overflow=]
 2940 |   sprintf(str, "Features[%u/%u]", page, i);
      |                             ^~
monitor/packet.c:2940:16: note: directive argument in the range [0, 2147483646]
 2940 |   sprintf(str, "Features[%u/%u]", page, i);
      |                ^~~~~~~~~~~~~~~~~
In file included from /usr/include/stdio.h:867,
                 from monitor/packet.c:18:
/usr/include/x86_64-linux-gnu/bits/stdio2.h:36:10: note: ‘__builtin___sprintf_chk’ output between 14 and 25 bytes into a destination of size 18
   36 |   return __builtin___sprintf_chk (__s, __USE_FORTIFY_LEVEL - 1,
      |          ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   37 |       __bos (__s), __fmt, __va_arg_pack ());
      |       ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
cc1: all warnings being treated as errors
make[1]: *** [Makefile:7063: monitor/packet.o] Error 1
make: *** [Makefile:10825: check] Error 2
##############################
Test: CheckValgrind - FAIL
Desc: Run Bluez Make Check with Valgrind
Output:

tools/mgmt-tester.c: In function ‘main’:
tools/mgmt-tester.c:12990:5: note: variable tracking size limit exceeded with ‘-fvar-tracking-assignments’, retrying without
12990 | int main(int argc, char *argv[])
      |     ^~~~
monitor/packet.c: In function ‘print_features_subpage’:
monitor/packet.c:2940:29: error: ‘%u’ directive writing between 1 and 10 bytes into a region of size between 5 and 7 [-Werror=format-overflow=]
 2940 |   sprintf(str, "Features[%u/%u]", page, i);
      |                             ^~
monitor/packet.c:2940:16: note: directive argument in the range [0, 2147483646]
 2940 |   sprintf(str, "Features[%u/%u]", page, i);
      |                ^~~~~~~~~~~~~~~~~
In file included from /usr/include/stdio.h:867,
                 from monitor/packet.c:18:
/usr/include/x86_64-linux-gnu/bits/stdio2.h:36:10: note: ‘__builtin___sprintf_chk’ output between 14 and 25 bytes into a destination of size 18
   36 |   return __builtin___sprintf_chk (__s, __USE_FORTIFY_LEVEL - 1,
      |          ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   37 |       __bos (__s), __fmt, __va_arg_pack ());
      |       ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
cc1: all warnings being treated as errors
make[1]: *** [Makefile:7063: monitor/packet.o] Error 1
make[1]: *** Waiting for unfinished jobs....
make: *** [Makefile:10825: check] Error 2
##############################
Test: bluezmakeextell - FAIL
Desc: Build Bluez with External ELL
Output:

configure.ac:21: installing './compile'
configure.ac:36: installing './config.guess'
configure.ac:36: installing './config.sub'
configure.ac:5: installing './install-sh'
configure.ac:5: installing './missing'
Makefile.am: installing './depcomp'
parallel-tests: installing './test-driver'
Package cups was not found in the pkg-config search path.
Perhaps you should add the directory containing `cups.pc'
to the PKG_CONFIG_PATH environment variable
No package 'cups' found
configure: error: Package requirements (ell >= 0.39) were not met:

No package 'ell' found

Consider adjusting the PKG_CONFIG_PATH environment variable if you
installed software in a non-standard prefix.

Alternatively, you may set the environment variables ELL_CFLAGS
and ELL_LIBS to avoid the need to call pkg-config.
See the pkg-config man page for more details.
##############################
Test: IncrementalBuild - FAIL
Desc: Incremental build with the patches in the series
Output:

tools/mgmt-tester.c: In function ‘main’:
tools/mgmt-tester.c:12990:5: note: variable tracking size limit exceeded with ‘-fvar-tracking-assignments’, retrying without
12990 | int main(int argc, char *argv[])
      |     ^~~~
unit/test-avdtp.c: In function ‘main’:
unit/test-avdtp.c:766:5: note: variable tracking size limit exceeded with ‘-fvar-tracking-assignments’, retrying without
  766 | int main(int argc, char *argv[])
      |     ^~~~
unit/test-avrcp.c: In function ‘main’:
unit/test-avrcp.c:989:5: note: variable tracking size limit exceeded with ‘-fvar-tracking-assignments’, retrying without
  989 | int main(int argc, char *argv[])
      |     ^~~~
monitor/packet.c: In function ‘print_features_subpage’:
monitor/packet.c:2940:29: error: ‘%u’ directive writing between 1 and 10 bytes into a region of size between 5 and 7 [-Werror=format-overflow=]
 2940 |   sprintf(str, "Features[%u/%u]", page, i);
      |                             ^~
monitor/packet.c:2940:16: note: directive argument in the range [0, 2147483646]
 2940 |   sprintf(str, "Features[%u/%u]", page, i);
      |                ^~~~~~~~~~~~~~~~~
In file included from /usr/include/stdio.h:867,
                 from monitor/packet.c:18:
/usr/include/x86_64-linux-gnu/bits/stdio2.h:36:10: note: ‘__builtin___sprintf_chk’ output between 14 and 25 bytes into a destination of size 18
   36 |   return __builtin___sprintf_chk (__s, __USE_FORTIFY_LEVEL - 1,
      |          ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   37 |       __bos (__s), __fmt, __va_arg_pack ());
      |       ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
cc1: all warnings being treated as errors
make[1]: *** [Makefile:7058: monitor/packet.o] Error 1
make[1]: *** Waiting for unfinished jobs....
make: *** [Makefile:4172: all] Error 2
[BlueZ,v5,1/4] doc/org.bluez.ChannelSounding1:Add Used by reference and Examples

tools/mgmt-tester.c: In function ‘main’:
tools/mgmt-tester.c:12990:5: note: variable tracking size limit exceeded with ‘-fvar-tracking-assignments’, retrying without
12990 | int main(int argc, char *argv[])
      |     ^~~~
unit/test-avdtp.c: In function ‘main’:
unit/test-avdtp.c:766:5: note: variable tracking size limit exceeded with ‘-fvar-tracking-assignments’, retrying without
  766 | int main(int argc, char *argv[])
      |     ^~~~
unit/test-avrcp.c: In function ‘main’:
unit/test-avrcp.c:989:5: note: variable tracking size limit exceeded with ‘-fvar-tracking-assignments’, retrying without
  989 | int main(int argc, char *argv[])
      |     ^~~~
monitor/packet.c: In function ‘print_features_subpage’:
monitor/packet.c:2940:29: error: ‘%u’ directive writing between 1 and 10 bytes into a region of size between 5 and 7 [-Werror=format-overflow=]
 2940 |   sprintf(str, "Features[%u/%u]", page, i);
      |                             ^~
monitor/packet.c:2940:16: note: directive argument in the range [0, 2147483646]
 2940 |   sprintf(str, "Features[%u/%u]", page, i);
      |                ^~~~~~~~~~~~~~~~~
In file included from /usr/include/stdio.h:867,
                 from monitor/packet.c:18:
/usr/include/x86_64-linux-gnu/bits/stdio2.h:36:10: note: ‘__builtin___sprintf_chk’ output between 14 and 25 bytes into a destination of size 18
   36 |   return __builtin___sprintf_chk (__s, __USE_FORTIFY_LEVEL - 1,
      |          ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   37 |       __bos (__s), __fmt, __va_arg_pack ());
      |       ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
cc1: all warnings being treated as errors
make[1]: *** [Makefile:7058: monitor/packet.o] Error 1
make[1]: *** Waiting for unfinished jobs....
make: *** [Makefile:4172: all] Error 2


https://github.com/bluez/bluez/pull/2307

---
Regards,
Linux Bluetooth

[PATCH BlueZ v5 2/4] doc/org.bluez.ChannelSoundingRanging1:Add references and examples

[Naga Bhavani Akella]

Add :Used by: field linking to bluetoothctl cs submenu and
Examples section showing the corresponding bluetoothctl output
for the RangeEstimate signal
---
 Makefile.am                               |  4 ++
 doc/org.bluez.ChannelSoundingRanging1.rst | 66 +++++++++++++++++++++++
 2 files changed, 70 insertions(+)
 create mode 100644 doc/org.bluez.ChannelSoundingRanging1.rst

diff --git a/Makefile.am b/Makefile.am
index 76c4ab5d4..84d0ff1c0 100644
--- a/Makefile.am
+++ b/Makefile.am
@@ -405,6 +405,8 @@ man_MANS += doc/org.bluez.Telephony.5 doc/org.bluez.Call.5
 man_MANS += doc/org.bluez.ThermometerManager.5 \
 		doc/org.bluez.Thermometer.5 \
 		doc/org.bluez.ThermometerWatcher.5
+man_MANS += doc/org.bluez.ChannelSounding1.5 \
+		doc/org.bluez.ChannelSoundingRanging1.5
 endif
 manual_pages += doc/bluetoothd.8
 manual_pages += doc/hci.7 doc/mgmt.7 doc/l2cap.7 doc/rfcomm.7 doc/sco.7 \
@@ -445,6 +447,8 @@ manual_pages += doc/org.bluez.Telephony.5 doc/org.bluez.Call.5
 manual_pages += doc/org.bluez.ThermometerManager.5 \
 		doc/org.bluez.Thermometer.5 \
 		doc/org.bluez.ThermometerWatcher.5
+manual_pages += doc/org.bluez.ChannelSounding1.5 \
+		doc/org.bluez.ChannelSoundingRanging1.5
 
 EXTRA_DIST += src/genbuiltin src/bluetooth.conf \
 			src/main.conf profiles/network/network.conf \
diff --git a/doc/org.bluez.ChannelSoundingRanging1.rst b/doc/org.bluez.ChannelSoundingRanging1.rst
new file mode 100644
index 000000000..0151ac503
--- /dev/null
+++ b/doc/org.bluez.ChannelSoundingRanging1.rst
@@ -0,0 +1,66 @@
+==================================
+org.bluez.ChannelSoundingRanging1
+==================================
+
+------------------------------------------------------
+BlueZ D-Bus Channel Sounding Ranging API documentation
+------------------------------------------------------
+
+:Version: BlueZ
+:Date: July 2026
+:Manual section: 5
+:Manual group: Linux System Administration
+
+Interface
+=========
+
+:Service:	org.bluez
+:Interface:	org.bluez.ChannelSoundingRanging1
+:Object path:	[variable prefix]/{hci0,hci1,...}/dev_XX_XX_XX_XX_XX_XX
+:Used by:	**bluetoothctl(1)**, **bluetoothctl-cs(1)**
+
+This interface reports distance estimates derived from Channel Sounding
+measurement data. It is emitted by an external ranging estimation daemon
+(**cs-range-daemon**) which subscribes to the ``ProcedureData`` signal on
+**org.bluez.ChannelSounding1** for every device object, feeds the parsed
+CS procedure data into a distance-estimation library, and re-publishes
+the resulting estimate as **RangeEstimate** on the same device object
+path. It carries no methods or properties of its own.
+
+Signals
+-------
+
+void RangeEstimate(double distance_m, byte confidence)
+````````````````````````````````````````````````````````
+
+Emitted whenever a new distance estimate has been computed for the
+device identified by the object path on which the signal is raised.
+
+:double distance_m:
+
+	Estimated distance to the remote device, in meters.
+
+:byte confidence:
+
+	Confidence level of the estimate, expressed as a percentage
+	(0-100).
+
+Clients that started a Channel Sounding measurement via
+**org.bluez.ChannelSounding1.StartMeasurement** and wish to receive
+range estimates should watch for this signal on the same device object
+path.
+
+Examples:
+
+:bluetoothctl distance output while a measurement is active:
+	| [CS] Distance: 1.234 m  Confidence: 87%
+
+RESOURCES
+=========
+
+http://www.bluez.org
+
+REPORTING BUGS
+==============
+
+linux-bluetooth@vger.kernel.org
-- 

[PATCH BlueZ v5 3/4] doc/bluetoothctl-cs: Add :Uses: fields and document arguments

[Naga Bhavani Akella]

Add :Uses: fields to link commands to their corresponding D-Bus API
methods, and document command arguments with usage examples.
---
 Makefile.tools          |   5 +-
 doc/bluetoothctl-cs.rst | 546 ++++++++++++++++++++++++++++++++++++++++
 2 files changed, 549 insertions(+), 2 deletions(-)
 create mode 100644 doc/bluetoothctl-cs.rst

diff --git a/Makefile.tools b/Makefile.tools
index 6188449f1..0646d52e1 100644
--- a/Makefile.tools
+++ b/Makefile.tools
@@ -359,7 +359,7 @@ man_MANS += doc/rctest.1 doc/l2ping.1 doc/btattach.1 doc/isotest.1 \
 		doc/bluetoothctl-gatt.1 doc/bluetoothctl-player.1 \
 		doc/bluetoothctl-scan.1 doc/bluetoothctl-transport.1 \
 		doc/bluetoothctl-assistant.1 doc/bluetoothctl-hci.1 \
-		doc/bluetoothctl-telephony.1
+		doc/bluetoothctl-telephony.1 doc/bluetoothctl-cs.1
 
 endif
 
@@ -465,7 +465,8 @@ manual_pages += doc/hciattach.1 doc/hciconfig.1 doc/hcitool.1 \
 			doc/bluetoothctl-transport.1 \
 			doc/bluetoothctl-assistant.1 \
 			doc/bluetoothctl-hci.1 \
-			doc/bluetoothctl-telephony.1
+			doc/bluetoothctl-telephony.1 \
+			doc/bluetoothctl-cs.1
 
 if HID2HCI
 udevdir = $(UDEV_DIR)
diff --git a/doc/bluetoothctl-cs.rst b/doc/bluetoothctl-cs.rst
new file mode 100644
index 000000000..bbc1d8565
--- /dev/null
+++ b/doc/bluetoothctl-cs.rst
@@ -0,0 +1,546 @@
+================
+bluetoothctl-cs
+================
+
+--------------------------
+Channel Sounding Submenu
+--------------------------
+
+:Version: BlueZ
+:Copyright: Free use of this software is granted under the terms of the GNU
+            Lesser General Public Licenses (LGPL).
+:Date: June 2026
+:Manual section: 1
+:Manual group: Linux System Administration
+
+SYNOPSIS
+========
+
+**bluetoothctl** [--options] [cs.commands]
+
+This submenu controls Bluetooth Channel Sounding (CS) distance measurement
+using the **org.bluez.ChannelSounding1(5)** D-Bus interface. It allows
+starting and stopping measurements and inspecting the current parameter
+state and active session identifier.
+
+Each CS parameter has its own **cs.<param>** set command (see the
+**CS Parameter Commands** section below). Overrides are applied to
+the local parameter state immediately, so **show** reflects them
+right away; **start** always uses whatever values are currently set.
+
+
+Channel Sounding Commands
+=========================
+
+start
+-----
+
+Starts a distance measurement on the connected device using the
+currently set CS parameters (see the **cs.<param>** commands below).
+All configuration is sent to the daemon in a single **StartMeasurement**
+call. On success the device path is printed to the console. Multiple
+simultaneous sessions across different devices are supported; each is
+tracked independently.
+
+Calling **start** on a device that already has an active measurement
+returns an error without starting a second session on the same device.
+
+For Initiator role (or Both), the mandatory parameters are the
+positional ``dev_addr`` and ``duration_secs``; every ``cs.<param>``
+command below is optional configuration with a usable default.
+
+If ``role`` is set to Reflector (``0x02``, via **cs.role**), **start**
+does not begin measuring distance: a Reflector never initiates a CS
+procedure. It only pushes the current parameters to the daemon and
+arms the device to respond once the remote Initiator starts one; the
+call still succeeds. When the remote side starts or stops a procedure,
+the console prints ``Measurement started``/``Measurement stopped`` for
+that device — use **show** or watch the ``Active`` property to see
+the same transition. In this role the only parameters that are
+required or have any effect are ``role``, ``sync_ant_sel`` and
+``max_tx_power``; every other **cs.<param>** command below is
+accepted but unused.
+
+Positional arguments are optional:
+
+- ``dev_addr`` — Bluetooth address of the target device; uses the only
+  available CS-capable device when omitted.
+- ``duration_secs`` — auto-stop timeout in seconds; ``0`` (default) means
+  no timeout.
+
+:Usage: **> start [dev_addr] [duration_secs]**
+:Uses: **org.bluez.ChannelSounding1(5)** method **StartMeasurement**
+:[dev_addr]: Bluetooth address of the target device (optional; uses the
+             only available CS-capable device when omitted)
+:[duration_secs]: Seconds before auto-stop (optional, default 0 = no timeout)
+
+:Example Start with all defaults, no timeout:
+	| **> start**
+:Example Start on a specific device:
+	| **> start AA:BB:CC:DD:EE:FF**
+:Example Start on a specific device with 10-second auto-stop:
+	| **> start AA:BB:CC:DD:EE:FF 10**
+:Example Start with 10-second auto-stop (single device, address omitted):
+	| **> start 0 10**
+:Example Start with 5-minute auto-stop:
+	| **> start AA:BB:CC:DD:EE:FF 300**
+
+stop
+----
+
+Stops an active CS distance measurement. When only one measurement is
+running the device address may be omitted. When multiple measurements
+are active the address is required to identify which one to stop.
+
+:Usage: **> stop [dev_addr]**
+:Uses: **org.bluez.ChannelSounding1(5)** method **StopMeasurement**
+:[dev_addr]: Bluetooth address of the device to stop (optional when
+             only one session is active; required otherwise)
+:Example Stop the only active measurement:
+	| **> stop**
+:Example Stop a specific device when multiple are active:
+	| **> stop AA:BB:CC:DD:EE:FF**
+:Example Stop a second device:
+	| **> stop 11:22:33:44:55:66**
+
+show
+----
+
+Displays all active measurements (device path for each) and the full
+set of CS parameter values that will be used on the next **start** call.
+When no measurements are active, ``none`` is shown.
+
+The parameter output is divided into three sections:
+
+- **Default Settings** — role, CS sync antenna selection, max TX power.
+- **CS Config Params** — per-procedure configuration fields including
+  mode type, step counts, PHY, and channel map.
+- **CS Frequency Params** — procedure scheduling fields including
+  duration, period, subevent lengths, and SNR control.
+
+:Usage: **> show**
+:Example Show active session and all CS parameters:
+	| **> show**
+
+CS Parameter Commands
+======================
+
+Each CS parameter is set with its own command, of the form
+``cs.<param> <value>``. Entering a param command with no value shows
+its current setting. Overrides apply to the local parameter state
+immediately, so **show** reflects them right away; **start** always
+uses whatever values are currently set. Array-valued parameters
+(``channel_map``, ``min_sub_event_len``, ``max_sub_event_len``) take
+colon-separated hex bytes with no ``0x`` prefix.
+
+:Usage: **> <param> [value]**
+
+role
+----
+
+Get/set the CS role.
+
+:Usage: **> role [0x01|0x02|0x03]**
+:[0x01|0x02|0x03]: ``0x01`` Initiator, ``0x02`` Reflector, ``0x03`` Both
+                   (optional, shows current if omitted; default ``0x03``)
+:Example Show current role:
+	| **> role**
+:Example Set role to Initiator only:
+	| **> role 0x01**
+:Example Set role to Reflector only (does not measure):
+	| **> role 0x02**
+:Example Set role to both Initiator and Reflector:
+	| **> role 0x03**
+
+sync_ant_sel
+------------
+
+Get/set the CS sync antenna selection.
+
+:Usage: **> sync_ant_sel [value]**
+:[value]: CS sync antenna selection; ``0xFE``/``0xFF`` reserved
+          (optional, shows current if omitted; default ``0xFF``)
+:Example Show current antenna selection:
+	| **> sync_ant_sel**
+:Example Select antenna 1:
+	| **> sync_ant_sel 0x01**
+
+max_tx_power
+------------
+
+Get/set the maximum TX power.
+
+:Usage: **> max_tx_power [dBm]**
+:[dBm]: Max TX power in dBm, signed (optional, shows current if
+        omitted; range −127 to +20; default ``20``)
+:Example Show current max TX power:
+	| **> max_tx_power**
+:Example Reduce max TX power to 10 dBm:
+	| **> max_tx_power 10**
+
+config_id
+---------
+
+Get/set the CS configuration identifier.
+
+:Usage: **> config_id [value]**
+:[value]: CS configuration identifier (optional, shows current if
+          omitted; default ``0``)
+:Example Show current config id:
+	| **> config_id**
+:Example Set config id to 1:
+	| **> config_id 1**
+
+main_mode_type
+--------------
+
+Get/set the CS main mode type.
+
+:Usage: **> main_mode_type [1|2|3]**
+:[1|2|3]: ``1`` Mode 1 (RTT), ``2`` Mode 2 (PBR), ``3`` Both (optional,
+          shows current if omitted; default ``1``)
+:Example Show current main mode type:
+	| **> main_mode_type**
+:Example Set main mode to Mode 2 (PBR):
+	| **> main_mode_type 2**
+:Example Set main mode to both RTT and PBR:
+	| **> main_mode_type 3**
+
+sub_mode_type
+-------------
+
+Get/set the CS sub-mode type within the main mode.
+
+:Usage: **> sub_mode_type [value]**
+:[value]: Sub-mode within main mode; ``0xFF`` = unused (optional,
+          shows current if omitted; default ``0xFF``)
+:Example Show current sub-mode type:
+	| **> sub_mode_type**
+:Example Set sub-mode type to 0x01:
+	| **> sub_mode_type 0x01**
+
+main_mode_min_steps
+--------------------
+
+Get/set the minimum CS main mode steps per subevent.
+
+:Usage: **> main_mode_min_steps [value]**
+:[value]: Min CS main mode steps per subevent (optional, shows
+          current if omitted; default ``2``)
+:Example Show current value:
+	| **> main_mode_min_steps**
+:Example Set minimum steps to 4:
+	| **> main_mode_min_steps 4**
+
+main_mode_max_steps
+--------------------
+
+Get/set the maximum CS main mode steps per subevent.
+
+:Usage: **> main_mode_max_steps [value]**
+:[value]: Max CS main mode steps per subevent (optional, shows
+          current if omitted; default ``3``)
+:Example Show current value:
+	| **> main_mode_max_steps**
+:Example Set maximum steps to 8:
+	| **> main_mode_max_steps 8**
+
+main_mode_repetition
+---------------------
+
+Get/set how many times main mode steps are repeated in a subevent.
+
+:Usage: **> main_mode_repetition [value]**
+:[value]: Repetition count (optional, shows current if omitted;
+          default ``1``)
+:Example Show current value:
+	| **> main_mode_repetition**
+:Example Repeat main mode steps twice:
+	| **> main_mode_repetition 2**
+
+mode0_steps
+-----------
+
+Get/set the number of CS Mode 0 steps at the beginning of each
+subevent.
+
+:Usage: **> mode0_steps [value]**
+:[value]: CS Mode 0 step count (optional, shows current if omitted;
+          default ``2``)
+:Example Show current value:
+	| **> mode0_steps**
+:Example Set Mode 0 steps to 3:
+	| **> mode0_steps 3**
+
+rtt_types
+---------
+
+Get/set the RTT measurement types bitmask.
+
+:Usage: **> rtt_types [value]**
+:[value]: RTT measurement types bitmask (optional, shows current if
+          omitted; default ``0``)
+:Example Show current value:
+	| **> rtt_types**
+:Example Set RTT types bitmask:
+	| **> rtt_types 0x01**
+
+sync_phy
+--------
+
+Get/set the PHY used for CS sync.
+
+:Usage: **> sync_phy [0x01|0x02]**
+:[0x01|0x02]: ``0x01`` LE 1M, ``0x02`` LE 2M (optional, shows current
+              if omitted; default ``0x01``)
+:Example Show current sync PHY:
+	| **> sync_phy**
+:Example Set CS sync PHY to LE 2M:
+	| **> sync_phy 0x02**
+
+channel_map
+-----------
+
+Get/set the 10-byte CS channel map bitmap.
+
+:Usage: **> channel_map [b0:b1:...:b9]**
+:[b0:b1:...:b9]: 10 colon-separated hex bytes (optional, shows current
+                 if omitted; default ``FC:FF:7F:FC:FF:FF:FF:FF:FF:1F``)
+:Example Show current channel map:
+	| **> channel_map**
+:Example Set a custom channel map (all enabled):
+	| **> channel_map FF:FF:FF:FF:FF:FF:FF:FF:FF:FF**
+
+channel_map_repetition
+-----------------------
+
+Get/set the number of consecutive repetitions of the channel map.
+
+:Usage: **> channel_map_repetition [value]**
+:[value]: Repetition count (optional, shows current if omitted;
+          default ``1``)
+:Example Show current value:
+	| **> channel_map_repetition**
+:Example Repeat the channel map 3 times:
+	| **> channel_map_repetition 3**
+
+channel_selection_type
+-----------------------
+
+Get/set the CS channel selection algorithm.
+
+:Usage: **> channel_selection_type [value]**
+:[value]: Channel selection algorithm (optional, shows current if
+          omitted; default ``0``)
+:Example Show current value:
+	| **> channel_selection_type**
+:Example Select algorithm 1:
+	| **> channel_selection_type 1**
+
+channel_shape
+-------------
+
+Get/set the shape used in the channel selection algorithm.
+
+:Usage: **> channel_shape [value]**
+:[value]: Channel shape (optional, shows current if omitted; default
+          ``0``)
+:Example Show current value:
+	| **> channel_shape**
+:Example Set channel shape to 1:
+	| **> channel_shape 1**
+
+channel_jump
+------------
+
+Get/set the channel jump size.
+
+:Usage: **> channel_jump [value]**
+:[value]: Channel jump size (optional, shows current if omitted;
+          default ``2``)
+:Example Show current value:
+	| **> channel_jump**
+:Example Set channel jump to 4:
+	| **> channel_jump 4**
+
+companion_signal_enable
+------------------------
+
+Get/set whether the companion signal is transmitted.
+
+:Usage: **> companion_signal_enable [0|1]**
+:[0|1]: ``1`` to transmit companion signal, ``0`` to disable (optional,
+        shows current if omitted; default ``0``)
+:Example Show current value:
+	| **> companion_signal_enable**
+:Example Enable the companion signal:
+	| **> companion_signal_enable 1**
+
+max_procedure_duration
+-----------------------
+
+Get/set the maximum duration of one CS measurement procedure.
+
+:Usage: **> max_procedure_duration [value]**
+:[value]: Maximum procedure duration (optional, shows current if
+          omitted; default ``1600``)
+:Example Show current value:
+	| **> max_procedure_duration**
+:Example Set max procedure duration to 800:
+	| **> max_procedure_duration 800**
+
+min_period_between_procedures
+-------------------------------
+
+Get/set the minimum time between consecutive procedures.
+
+:Usage: **> min_period_between_procedures [value]**
+:[value]: Minimum period (optional, shows current if omitted; default
+          ``30``)
+:Example Show current value:
+	| **> min_period_between_procedures**
+:Example Set minimum period to 50:
+	| **> min_period_between_procedures 50**
+
+max_period_between_procedures
+-------------------------------
+
+Get/set the maximum time between consecutive procedures.
+
+:Usage: **> max_period_between_procedures [value]**
+:[value]: Maximum period (optional, shows current if omitted; default
+          ``150``)
+:Example Show current value:
+	| **> max_period_between_procedures**
+:Example Set maximum period to 200:
+	| **> max_period_between_procedures 200**
+
+max_procedure_count
+--------------------
+
+Get/set the maximum number of procedures.
+
+:Usage: **> max_procedure_count [value]**
+:[value]: Max procedure count; ``0`` = no limit (optional, shows
+          current if omitted; default ``0``)
+:Example Show current value:
+	| **> max_procedure_count**
+:Example Limit the procedure count to 100:
+	| **> max_procedure_count 100**
+
+min_sub_event_len
+------------------
+
+Get/set the minimum CS subevent length.
+
+:Usage: **> min_sub_event_len [b0:b1:b2]**
+:[b0:b1:b2]: 3-byte LE value, colon-separated hex (optional, shows
+             current if omitted; default ``00:20:00``)
+:Example Show current value:
+	| **> min_sub_event_len**
+:Example Set minimum subevent length:
+	| **> min_sub_event_len 00:10:00**
+
+max_sub_event_len
+------------------
+
+Get/set the maximum CS subevent length.
+
+:Usage: **> max_sub_event_len [b0:b1:b2]**
+:[b0:b1:b2]: 3-byte LE value, colon-separated hex (optional, shows
+             current if omitted; default ``03:20:00``)
+:Example Show current value:
+	| **> max_sub_event_len**
+:Example Set maximum subevent length:
+	| **> max_sub_event_len 04:20:00**
+
+tone_antenna_config_selection
+-------------------------------
+
+Get/set the antenna configuration for CS tone exchanges.
+
+:Usage: **> tone_antenna_config_selection [value]**
+:[value]: Antenna config selection (optional, shows current if
+          omitted; default ``0x07``)
+:Example Show current value:
+	| **> tone_antenna_config_selection**
+:Example Set antenna config to 0x01:
+	| **> tone_antenna_config_selection 0x01**
+
+phy
+---
+
+Get/set the PHY used for CS procedures.
+
+:Usage: **> phy [0x01|0x02]**
+:[0x01|0x02]: ``0x01`` LE 1M, ``0x02`` LE 2M (optional, shows current
+              if omitted; default ``0x01``)
+:Example Show current procedure PHY:
+	| **> phy**
+:Example Set CS procedure PHY to LE 2M:
+	| **> phy 0x02**
+
+tx_power_delta
+--------------
+
+Get/set the remote vs local TX power delta.
+
+:Usage: **> tx_power_delta [value]**
+:[value]: TX power delta; ``0x80`` = not applicable (optional, shows
+          current if omitted; default ``0x80``)
+:Example Show current value:
+	| **> tx_power_delta**
+:Example Set TX power delta to 0x05:
+	| **> tx_power_delta 0x05**
+
+preferred_peer_antenna
+-----------------------
+
+Get/set the preferred antenna for the peer device.
+
+:Usage: **> preferred_peer_antenna [value]**
+:[value]: Preferred peer antenna (optional, shows current if omitted;
+          default ``0x03``)
+:Example Show current value:
+	| **> preferred_peer_antenna**
+:Example Prefer antenna 1 on the peer:
+	| **> preferred_peer_antenna 0x01**
+
+snr_control_initiator
+----------------------
+
+Get/set the SNR control for the initiator.
+
+:Usage: **> snr_control_initiator [value]**
+:[value]: SNR control; ``0xFF`` = no preference (optional, shows
+          current if omitted; default ``0xFF``)
+:Example Show current value:
+	| **> snr_control_initiator**
+:Example Prefer high SNR on the initiator:
+	| **> snr_control_initiator 0x01**
+
+snr_control_reflector
+----------------------
+
+Get/set the SNR control for the reflector.
+
+:Usage: **> snr_control_reflector [value]**
+:[value]: SNR control; ``0xFF`` = no preference (optional, shows
+          current if omitted; default ``0xFF``)
+:Example Show current value:
+	| **> snr_control_reflector**
+:Example Prefer high SNR on the reflector:
+	| **> snr_control_reflector 0x01**
+:Example Prefer high SNR on both roles:
+	| **> snr_control_initiator 0x01**
+	| **> snr_control_reflector 0x01**
+
+RESOURCES
+=========
+
+http://www.bluez.org
+
+REPORTING BUGS
+==============
+
+linux-bluetooth@vger.kernel.org
-- 

[PATCH BlueZ v5 4/4] client: Add scripts to start cs Initiator/reflector

[Naga Bhavani Akella]

This adds sample bluetoothctl scripts for cs initiator/
reflector.

cs-initiator.bt sets up and runs a CS measurement as an Initiator
cs-reflector.bt sets up the device to respond as a Reflector
---
 client/scripts/cs-initiator.bt | 6 ++++++
 client/scripts/cs-reflector.bt | 5 +++++
 2 files changed, 11 insertions(+)
 create mode 100644 client/scripts/cs-initiator.bt
 create mode 100644 client/scripts/cs-reflector.bt

diff --git a/client/scripts/cs-initiator.bt b/client/scripts/cs-initiator.bt
new file mode 100644
index 000000000..8e439a1eb
--- /dev/null
+++ b/client/scripts/cs-initiator.bt
@@ -0,0 +1,6 @@
+power on
+cs.role 0x01
+cs.main_mode_type 2
+cs.phy 0x02
+cs.sync_phy 0x02
+cs.start AA:BB:CC:DD:EE:FF 30
diff --git a/client/scripts/cs-reflector.bt b/client/scripts/cs-reflector.bt
new file mode 100644
index 000000000..7765804ed
--- /dev/null
+++ b/client/scripts/cs-reflector.bt
@@ -0,0 +1,5 @@
+power on
+cs.role 0x02
+cs.sync_ant_sel 0x01
+cs.max_tx_power 10
+cs.start
--