* [PATCH v2 01/14] shared/gatt-client: Allow registering notify with explicit CCC value
2026-10-09 9:25 [PATCH v2 00/14] Ranging Profile and Ranging Service PTS fixes Cheng Jiang
@ 2026-10-09 9:25 ` Cheng Jiang
2026-10-09 15:42 ` Ranging Profile and Ranging Service PTS fixes bluez.test.bot
2026-10-09 9:25 ` [PATCH v2 02/14] shared/gatt-db: Pass the ATT opcode to the notify callback Cheng Jiang
` (13 subsequent siblings)
14 siblings, 1 reply; 18+ messages in thread
From: Cheng Jiang @ 2026-10-09 9:25 UTC (permalink / raw)
To: linux-bluetooth
Cc: jinwang.li, wei.deng, xiuzhuo.shang, shuai.zhang, Cheng Jiang
bt_gatt_client_register_notify() picks the CCC value to write based on
the characteristic properties, preferring notifications over indications
when both are supported. A client that specifically needs one of the two
- for example the Ranging Service, which distinguishes notification and
indication transports - has no way to request it.
Add bt_gatt_client_register_notify_with_ccc() which takes the desired
CCC value (0x0001 for notifications, 0x0002 for indications) and writes
it verbatim. register_notify() gains a ccc_value argument and rejects a
value the characteristic does not support. The existing entry point
keeps its behaviour by passing 0, which restores the property-based
selection.
Assisted-by: Claude:claude-opus-4.8
---
src/shared/gatt-client.c | 43 +++++++++++++++++++++++++++++++++++-----
src/shared/gatt-client.h | 7 +++++++
2 files changed, 45 insertions(+), 5 deletions(-)
diff --git a/src/shared/gatt-client.c b/src/shared/gatt-client.c
index 95f83fa3e..5c29587bb 100644
--- a/src/shared/gatt-client.c
+++ b/src/shared/gatt-client.c
@@ -242,6 +242,7 @@ struct notify_data {
uint8_t att_ecode;
int ref_count;
struct notify_chrc *chrc;
+ uint16_t ccc_value;
bt_gatt_client_register_callback_t callback;
bt_gatt_client_notify_callback_t notify;
void *user_data;
@@ -1680,10 +1681,9 @@ static bool notify_data_write_ccc(struct notify_data *notify_data, bool enable,
assert(notify_data->chrc->ccc_handle);
if (enable) {
- /* Try to enable notifications or indications based on
- * whatever the characteristic supports.
- */
- if (properties & BT_GATT_CHRC_PROP_NOTIFY)
+ if (notify_data->ccc_value)
+ value = cpu_to_le16(notify_data->ccc_value);
+ else if (properties & BT_GATT_CHRC_PROP_NOTIFY)
value = cpu_to_le16(0x0001);
else if (properties & BT_GATT_CHRC_PROP_INDICATE)
value = cpu_to_le16(0x0002);
@@ -1759,6 +1759,7 @@ static bool match_notify_chrc_value_handle(const void *a, const void *b)
static unsigned int register_notify(struct bt_gatt_client *client,
uint16_t handle,
+ uint16_t ccc_value,
bt_gatt_client_register_callback_t callback,
bt_gatt_client_notify_callback_t notify,
void *user_data,
@@ -1788,10 +1789,22 @@ static unsigned int register_notify(struct bt_gatt_client *client,
if (chrc->notify_count == INT_MAX)
return 0;
+ if (ccc_value == 0x0001 &&
+ !(chrc->properties & BT_GATT_CHRC_PROP_NOTIFY))
+ return 0;
+
+ if (ccc_value == 0x0002 &&
+ !(chrc->properties & BT_GATT_CHRC_PROP_INDICATE))
+ return 0;
+
+ if (ccc_value != 0 && ccc_value != 0x0001 && ccc_value != 0x0002)
+ return 0;
+
notify_data = new0(struct notify_data, 1);
notify_data->client = client;
notify_data->ref_count = 1;
notify_data->chrc = chrc;
+ notify_data->ccc_value = ccc_value;
notify_data->callback = callback;
notify_data->notify = notify;
notify_data->user_data = user_data;
@@ -1881,6 +1894,7 @@ static bool register_service_changed(struct bt_gatt_client *client)
*/
client->svc_chngd_ind_id = register_notify(client,
gatt_db_attribute_get_handle(attr),
+ 0x0002,
service_changed_register_cb,
service_changed_cb,
client, NULL);
@@ -3852,10 +3866,29 @@ unsigned int bt_gatt_client_register_notify(struct bt_gatt_client *client,
if (client->in_svc_chngd)
return 0;
- return register_notify(client, chrc_value_handle, callback, notify,
+ return register_notify(client, chrc_value_handle, 0, callback, notify,
user_data, destroy);
}
+unsigned int bt_gatt_client_register_notify_with_ccc(
+ struct bt_gatt_client *client,
+ uint16_t chrc_value_handle, uint16_t ccc_value,
+ bt_gatt_client_register_callback_t callback,
+ bt_gatt_client_notify_callback_t notify,
+ void *user_data,
+ bt_gatt_client_destroy_func_t destroy)
+{
+ if (!client || !client->db || !chrc_value_handle ||
+ (!callback && !notify) || !ccc_value)
+ return 0;
+
+ if (client->in_svc_chngd)
+ return 0;
+
+ return register_notify(client, chrc_value_handle, ccc_value, callback,
+ notify, user_data, destroy);
+}
+
bool bt_gatt_client_unregister_notify(struct bt_gatt_client *client,
unsigned int id)
{
diff --git a/src/shared/gatt-client.h b/src/shared/gatt-client.h
index ff90fd8ea..0c5d118c7 100644
--- a/src/shared/gatt-client.h
+++ b/src/shared/gatt-client.h
@@ -123,6 +123,13 @@ unsigned int bt_gatt_client_register_notify(struct bt_gatt_client *client,
bt_gatt_client_notify_callback_t notify,
void *user_data,
bt_gatt_client_destroy_func_t destroy);
+unsigned int bt_gatt_client_register_notify_with_ccc(
+ struct bt_gatt_client *client,
+ uint16_t chrc_value_handle, uint16_t ccc_value,
+ bt_gatt_client_register_callback_t callback,
+ bt_gatt_client_notify_callback_t notify,
+ void *user_data,
+ bt_gatt_client_destroy_func_t destroy);
bool bt_gatt_client_unregister_notify(struct bt_gatt_client *client,
unsigned int id);
--
2.43.0
^ permalink raw reply related [flat|nested] 18+ messages in thread* RE: Ranging Profile and Ranging Service PTS fixes
2026-10-09 9:25 ` [PATCH v2 01/14] shared/gatt-client: Allow registering notify with explicit CCC value Cheng Jiang
@ 2026-10-09 15:42 ` bluez.test.bot
0 siblings, 0 replies; 18+ messages in thread
From: bluez.test.bot @ 2026-10-09 15:42 UTC (permalink / raw)
To: linux-bluetooth, cheng.jiang
[-- Attachment #1: Type: text/plain, Size: 38699 bytes --]
This is automated email and please do not reply to this email!
Dear submitter,
Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/series/1182244/
---Test result---
Test Summary:
CheckPatch PASS 7.60 seconds
GitLint PASS 4.63 seconds
BuildEll PASS 19.78 seconds
BluezMake PASS 390.34 seconds
MakeCheck PASS 14.21 seconds
MakeDistcheck PASS 142.22 seconds
CheckValgrind PASS 233.89 seconds
CheckSmatch PASS 298.47 seconds
bluezmakeextell PASS 95.50 seconds
TestFunctional PASS 1182.10 seconds
IncrementalBuild FAIL 431.77 seconds
ScanBuild FAIL 197.30 seconds
Details
##############################
Test: IncrementalBuild - FAIL
Desc: Incremental build with the patches in the series
Output:
unit/test-bap.c: In function ‘test_setup_server’:
unit/test-bap.c:756:58: error: passing argument 4 of ‘gatt_db_ccc_register’ from incompatible pointer type [-Wincompatible-pointer-types]
756 | gatt_db_ccc_register(db, gatt_ccc_read_cb, NULL, gatt_notify_cb, data);
| ^~~~~~~~~~~~~~
| |
| void (*)(struct gatt_db_attribute *, struct gatt_db_attribute *, const uint8_t *, size_t, struct bt_att *, void *) {aka void (*)(struct gatt_db_attribute *, struct gatt_db_attribute *, const unsigned char *, long unsigned int, struct bt_att *, void *)}
In file included from unit/test-bap.c:38:
./src/shared/gatt-db.h:213:58: note: expected ‘gatt_db_notify_t’ {aka ‘void (*)(struct gatt_db_attribute *, struct gatt_db_attribute *, const unsigned char *, long unsigned int, unsigned char, struct bt_att *, void *)’} but argument is of type ‘void (*)(struct gatt_db_attribute *, struct gatt_db_attribute *, const uint8_t *, size_t, struct bt_att *, void *)’ {aka ‘void (*)(struct gatt_db_attribute *, struct gatt_db_attribute *, const unsigned char *, long unsigned int, struct bt_att *, void *)’}
213 | gatt_db_notify_t notify_func,
| ~~~~~~~~~~~~~~~~~^~~~~~~~~~~
unit/test-bap.c:637:13: note: ‘gatt_notify_cb’ declared here
637 | static void gatt_notify_cb(struct gatt_db_attribute *attrib,
| ^~~~~~~~~~~~~~
./src/shared/gatt-db.h:51:16: note: ‘gatt_db_notify_t’ declared here
51 | typedef void (*gatt_db_notify_t) (struct gatt_db_attribute *attrib,
| ^~~~~~~~~~~~~~~~
unit/test-micp.c: In function ‘test_server’:
unit/test-micp.c:301:41: error: passing argument 4 of ‘gatt_db_ccc_register’ from incompatible pointer type [-Wincompatible-pointer-types]
301 | gatt_notify_cb, data);
| ^~~~~~~~~~~~~~
| |
| void (*)(struct gatt_db_attribute *, struct gatt_db_attribute *, const uint8_t *, size_t, struct bt_att *, void *) {aka void (*)(struct gatt_db_attribute *, struct gatt_db_attribute *, const unsigned char *, long unsigned int, struct bt_att *, void *)}
In file included from unit/test-micp.c:29:
./src/shared/gatt-db.h:213:58: note: expected ‘gatt_db_notify_t’ {aka ‘void (*)(struct gatt_db_attribute *, struct gatt_db_attribute *, const unsigned char *, long unsigned int, unsigned char, struct bt_att *, void *)’} but argument is of type ‘void (*)(struct gatt_db_attribute *, struct gatt_db_attribute *, const uint8_t *, size_t, struct bt_att *, void *)’ {aka ‘void (*)(struct gatt_db_attribute *, struct gatt_db_attribute *, const unsigned char *, long unsigned int, struct bt_att *, void *)’}
213 | gatt_db_notify_t notify_func,
| ~~~~~~~~~~~~~~~~~^~~~~~~~~~~
unit/test-micp.c:222:13: note: ‘gatt_notify_cb’ declared here
222 | static void gatt_notify_cb(struct gatt_db_attribute *attrib,
| ^~~~~~~~~~~~~~
./src/shared/gatt-db.h:51:16: note: ‘gatt_db_notify_t’ declared here
51 | typedef void (*gatt_db_notify_t) (struct gatt_db_attribute *attrib,
| ^~~~~~~~~~~~~~~~
make[1]: *** [Makefile:7130: unit/test-micp.o] Error 1
make[1]: *** Waiting for unfinished jobs....
make[1]: *** [Makefile:7130: unit/test-bap.o] Error 1
make: *** [Makefile:4246: all] Error 2
[v2,02/14] shared/gatt-db: Pass the ATT opcode to the notify callback
unit/test-bap.c: In function ‘test_setup_server’:
unit/test-bap.c:756:58: error: passing argument 4 of ‘gatt_db_ccc_register’ from incompatible pointer type [-Wincompatible-pointer-types]
756 | gatt_db_ccc_register(db, gatt_ccc_read_cb, NULL, gatt_notify_cb, data);
| ^~~~~~~~~~~~~~
| |
| void (*)(struct gatt_db_attribute *, struct gatt_db_attribute *, const uint8_t *, size_t, struct bt_att *, void *) {aka void (*)(struct gatt_db_attribute *, struct gatt_db_attribute *, const unsigned char *, long unsigned int, struct bt_att *, void *)}
In file included from unit/test-bap.c:38:
./src/shared/gatt-db.h:213:58: note: expected ‘gatt_db_notify_t’ {aka ‘void (*)(struct gatt_db_attribute *, struct gatt_db_attribute *, const unsigned char *, long unsigned int, unsigned char, struct bt_att *, void *)’} but argument is of type ‘void (*)(struct gatt_db_attribute *, struct gatt_db_attribute *, const uint8_t *, size_t, struct bt_att *, void *)’ {aka ‘void (*)(struct gatt_db_attribute *, struct gatt_db_attribute *, const unsigned char *, long unsigned int, struct bt_att *, void *)’}
213 | gatt_db_notify_t notify_func,
| ~~~~~~~~~~~~~~~~~^~~~~~~~~~~
unit/test-bap.c:637:13: note: ‘gatt_notify_cb’ declared here
637 | static void gatt_notify_cb(struct gatt_db_attribute *attrib,
| ^~~~~~~~~~~~~~
./src/shared/gatt-db.h:51:16: note: ‘gatt_db_notify_t’ declared here
51 | typedef void (*gatt_db_notify_t) (struct gatt_db_attribute *attrib,
| ^~~~~~~~~~~~~~~~
unit/test-micp.c: In function ‘test_server’:
unit/test-micp.c:301:41: error: passing argument 4 of ‘gatt_db_ccc_register’ from incompatible pointer type [-Wincompatible-pointer-types]
301 | gatt_notify_cb, data);
| ^~~~~~~~~~~~~~
| |
| void (*)(struct gatt_db_attribute *, struct gatt_db_attribute *, const uint8_t *, size_t, struct bt_att *, void *) {aka void (*)(struct gatt_db_attribute *, struct gatt_db_attribute *, const unsigned char *, long unsigned int, struct bt_att *, void *)}
In file included from unit/test-micp.c:29:
./src/shared/gatt-db.h:213:58: note: expected ‘gatt_db_notify_t’ {aka ‘void (*)(struct gatt_db_attribute *, struct gatt_db_attribute *, const unsigned char *, long unsigned int, unsigned char, struct bt_att *, void *)’} but argument is of type ‘void (*)(struct gatt_db_attribute *, struct gatt_db_attribute *, const uint8_t *, size_t, struct bt_att *, void *)’ {aka ‘void (*)(struct gatt_db_attribute *, struct gatt_db_attribute *, const unsigned char *, long unsigned int, struct bt_att *, void *)’}
213 | gatt_db_notify_t notify_func,
| ~~~~~~~~~~~~~~~~~^~~~~~~~~~~
unit/test-micp.c:222:13: note: ‘gatt_notify_cb’ declared here
222 | static void gatt_notify_cb(struct gatt_db_attribute *attrib,
| ^~~~~~~~~~~~~~
./src/shared/gatt-db.h:51:16: note: ‘gatt_db_notify_t’ declared here
51 | typedef void (*gatt_db_notify_t) (struct gatt_db_attribute *attrib,
| ^~~~~~~~~~~~~~~~
make[1]: *** [Makefile:7130: unit/test-micp.o] Error 1
make[1]: *** Waiting for unfinished jobs....
make[1]: *** [Makefile:7130: unit/test-bap.o] Error 1
make: *** [Makefile:4246: all] Error 2
##############################
Test: ScanBuild - FAIL
Desc: Run Scan Build
Output:
src/shared/gatt-client.c:458:21: warning: Use of memory after it is freed [unix.Malloc]
458 | gatt_db_unregister(op->client->db, op->db_id);
| ^~~~~~~~~~
src/shared/gatt-client.c:703:2: warning: Use of memory after it is freed [unix.Malloc]
703 | discovery_op_complete(op, false, att_ecode);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
src/shared/gatt-client.c:1109:2: warning: Use of memory after it is freed [unix.Malloc]
1109 | discovery_op_complete(op, success, att_ecode);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
src/shared/gatt-client.c:1303:2: warning: Use of memory after it is freed [unix.Malloc]
1303 | discovery_op_complete(op, success, att_ecode);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
src/shared/gatt-client.c:1368:2: warning: Use of memory after it is freed [unix.Malloc]
1368 | discovery_op_complete(op, success, att_ecode);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
src/shared/gatt-client.c:1643:6: warning: Use of memory after it is freed [unix.Malloc]
1643 | if (read_db_hash(op)) {
| ^~~~~~~~~~~~~~~~
src/shared/gatt-client.c:1648:2: warning: Use of memory after it is freed [unix.Malloc]
1648 | discover_all(op);
| ^~~~~~~~~~~~~~~~
src/shared/gatt-client.c:1703:56: warning: Use of memory after it is freed [unix.Malloc]
1703 | notify_data->chrc->ccc_write_id = notify_data->att_id = att_id;
| ~~~~~~~~~~~~~~~~~~~ ^
src/shared/gatt-client.c:2170:6: warning: Use of memory after it is freed [unix.Malloc]
2170 | if (read_db_hash(op)) {
| ^~~~~~~~~~~~~~~~
src/shared/gatt-client.c:2178:8: warning: Use of memory after it is freed [unix.Malloc]
2178 | discovery_op_ref(op),
| ^~~~~~~~~~~~~~~~~~~~
src/shared/gatt-client.c:3364:2: warning: Use of memory after it is freed [unix.Malloc]
3364 | complete_write_long_op(req, success, 0, false);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
src/shared/gatt-client.c:3386:2: warning: Use of memory after it is freed [unix.Malloc]
3386 | request_unref(req);
| ^~~~~~~~~~~~~~~~~~
12 warnings generated.
src/shared/rap.c:3344:30: warning: Assigned value is uninitialized [core.uninitialized.Assign]
3344 | out->tone_pct[k].i_sample = tone_pct_i[k];
| ^ ~~~~~~~~~~~~~
src/shared/rap.c:4291:13: warning: Use of memory after it is freed [unix.Malloc]
4291 | attached = queue_find(sessions, NULL, rap);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
2 warnings generated.
src/shared/bap.c:1543:8: warning: Use of memory after it is freed [unix.Malloc]
1543 | bap = bt_bap_ref_safe(bap);
| ^~~~~~~~~~~~~~~~~~~~
src/shared/bap.c:2359:20: warning: Use of memory after it is freed [unix.Malloc]
2359 | return queue_find(stream->bap->streams, NULL, stream);
| ^~~~~~~~~~~~~~~~~~~~
2 warnings generated.
src/shared/gatt-client.c:458:21: warning: Use of memory after it is freed [unix.Malloc]
458 | gatt_db_unregister(op->client->db, op->db_id);
| ^~~~~~~~~~
src/shared/gatt-client.c:703:2: warning: Use of memory after it is freed [unix.Malloc]
703 | discovery_op_complete(op, false, att_ecode);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
src/shared/gatt-client.c:1109:2: warning: Use of memory after it is freed [unix.Malloc]
1109 | discovery_op_complete(op, success, att_ecode);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
src/shared/gatt-client.c:1303:2: warning: Use of memory after it is freed [unix.Malloc]
1303 | discovery_op_complete(op, success, att_ecode);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
src/shared/gatt-client.c:1368:2: warning: Use of memory after it is freed [unix.Malloc]
1368 | discovery_op_complete(op, success, att_ecode);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
src/shared/gatt-client.c:1643:6: warning: Use of memory after it is freed [unix.Malloc]
1643 | if (read_db_hash(op)) {
| ^~~~~~~~~~~~~~~~
src/shared/gatt-client.c:1648:2: warning: Use of memory after it is freed [unix.Malloc]
1648 | discover_all(op);
| ^~~~~~~~~~~~~~~~
src/shared/gatt-client.c:1703:56: warning: Use of memory after it is freed [unix.Malloc]
1703 | notify_data->chrc->ccc_write_id = notify_data->att_id = att_id;
| ~~~~~~~~~~~~~~~~~~~ ^
src/shared/gatt-client.c:2170:6: warning: Use of memory after it is freed [unix.Malloc]
2170 | if (read_db_hash(op)) {
| ^~~~~~~~~~~~~~~~
src/shared/gatt-client.c:2178:8: warning: Use of memory after it is freed [unix.Malloc]
2178 | discovery_op_ref(op),
| ^~~~~~~~~~~~~~~~~~~~
src/shared/gatt-client.c:3364:2: warning: Use of memory after it is freed [unix.Malloc]
3364 | complete_write_long_op(req, success, 0, false);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
src/shared/gatt-client.c:3386:2: warning: Use of memory after it is freed [unix.Malloc]
3386 | request_unref(req);
| ^~~~~~~~~~~~~~~~~~
12 warnings generated.
src/shared/rap.c:3344:30: warning: Assigned value is uninitialized [core.uninitialized.Assign]
3344 | out->tone_pct[k].i_sample = tone_pct_i[k];
| ^ ~~~~~~~~~~~~~
src/shared/rap.c:4291:13: warning: Use of memory after it is freed [unix.Malloc]
4291 | attached = queue_find(sessions, NULL, rap);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
2 warnings generated.
tools/hciattach_ath3k.c:530:9: warning: File position of the stream might be 'indeterminate' after a failed operation. Can cause undefined behavior [unix.Stream]
530 | if (!fgets(byte, 3, stream))
| ^~~~~~~~~~~~~~~~~~~~~~
tools/hciattach_ath3k.c:530:9: warning: Read function called when stream is in EOF state. Function has no effect [unix.Stream]
530 | if (!fgets(byte, 3, stream))
| ^~~~~~~~~~~~~~~~~~~~~~
2 warnings generated.
tools/hciattach.c:817:7: warning: Although the value stored to 'n' is used in the enclosing expression, the value is never actually read from 'n' [deadcode.DeadStores]
817 | if ((n = read_hci_event(fd, resp, 10)) < 0) {
| ^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~
tools/hciattach.c:865:7: warning: Although the value stored to 'n' is used in the enclosing expression, the value is never actually read from 'n' [deadcode.DeadStores]
865 | if ((n = read_hci_event(fd, resp, 4)) < 0) {
| ^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~
tools/hciattach.c:887:8: warning: Although the value stored to 'n' is used in the enclosing expression, the value is never actually read from 'n' [deadcode.DeadStores]
887 | if ((n = read_hci_event(fd, resp, 10)) < 0) {
| ^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~
tools/hciattach.c:909:7: warning: Although the value stored to 'n' is used in the enclosing expression, the value is never actually read from 'n' [deadcode.DeadStores]
909 | if ((n = read_hci_event(fd, resp, 4)) < 0) {
| ^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~
tools/hciattach.c:930:7: warning: Although the value stored to 'n' is used in the enclosing expression, the value is never actually read from 'n' [deadcode.DeadStores]
930 | if ((n = read_hci_event(fd, resp, 4)) < 0) {
| ^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~
tools/hciattach.c:974:7: warning: Although the value stored to 'n' is used in the enclosing expression, the value is never actually read from 'n' [deadcode.DeadStores]
974 | if ((n = read_hci_event(fd, resp, 6)) < 0) {
| ^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~
6 warnings generated.
src/shared/bap.c:1543:8: warning: Use of memory after it is freed [unix.Malloc]
1543 | bap = bt_bap_ref_safe(bap);
| ^~~~~~~~~~~~~~~~~~~~
src/shared/bap.c:2359:20: warning: Use of memory after it is freed [unix.Malloc]
2359 | return queue_find(stream->bap->streams, NULL, stream);
| ^~~~~~~~~~~~~~~~~~~~
2 warnings generated.
src/oui.c:50:2: warning: Value stored to 'hwdb' is never read [deadcode.DeadStores]
50 | hwdb = udev_hwdb_unref(hwdb);
| ^ ~~~~~~~~~~~~~~~~~~~~~
src/oui.c:53:2: warning: Value stored to 'udev' is never read [deadcode.DeadStores]
53 | udev = udev_unref(udev);
| ^ ~~~~~~~~~~~~~~~~
2 warnings generated.
tools/rfcomm.c:234:3: warning: Value stored to 'i' is never read [deadcode.DeadStores]
234 | i = execvp(cmdargv[0], cmdargv);
| ^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~
tools/rfcomm.c:234:7: warning: Null pointer passed to 1st parameter expecting 'nonnull' [core.NonNullParamChecker]
234 | i = execvp(cmdargv[0], cmdargv);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~
tools/rfcomm.c:354:8: warning: Although the value stored to 'fd' is used in the enclosing expression, the value is never actually read from 'fd' [deadcode.DeadStores]
354 | if ((fd = open(devname, O_RDONLY | O_NOCTTY)) < 0) {
| ^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
tools/rfcomm.c:473:6: warning: The 1st argument to 'getsockname' is -1 but should be >= 0 [unix.StdCLibraryFunctions]
473 | if (getsockname(nsk, (struct sockaddr *)&laddr, &alen) < 0) {
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
tools/rfcomm.c:497:14: warning: Assigned value is uninitialized [core.uninitialized.Assign]
497 | req.channel = raddr.rc_channel;
| ^ ~~~~~~~~~~~~~~~~
tools/rfcomm.c:515:8: warning: Although the value stored to 'fd' is used in the enclosing expression, the value is never actually read from 'fd' [deadcode.DeadStores]
515 | if ((fd = open(devname, O_RDONLY | O_NOCTTY)) < 0) {
| ^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
6 warnings generated.
tools/ciptool.c:351:7: warning: 5th function call argument is an uninitialized value [core.CallAndMessage]
351 | sk = do_connect(ctl, dev_id, &src, &dst, psm, (1 << CMTP_LOOPBACK));
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
1 warning generated.
tools/sdptool.c:941:26: warning: Result of 'malloc' is converted to a pointer of type 'uint32_t', which is incompatible with sizeof operand type 'int' [unix.MallocSizeof]
941 | uint32_t *value_int = malloc(sizeof(int));
| ~~~~~~~~~~ ^~~~~~ ~~~~~~~~~~~
tools/sdptool.c:980:4: warning: 1st function call argument is an uninitialized value [core.CallAndMessage]
980 | free(allocArray[i]);
| ^~~~~~~~~~~~~~~~~~~
tools/sdptool.c:3777:2: warning: Potential leak of memory pointed to by 'si.name' [unix.Malloc]
3777 | return add_service(0, &si);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~
tools/sdptool.c:4112:4: warning: Potential leak of memory pointed to by 'context.svc' [unix.Malloc]
4112 | return -1;
| ^~~~~~~~~
4 warnings generated.
src/sdp-xml.c:129:10: warning: Assigned value is uninitialized [core.uninitialized.Assign]
129 | buf[1] = data[i + 1];
| ^ ~~~~~~~~~~~
src/sdp-xml.c:309:11: warning: Assigned value is uninitialized [core.uninitialized.Assign]
309 | buf[1] = data[i + 1];
| ^ ~~~~~~~~~~~
src/sdp-xml.c:347:11: warning: Assigned value is uninitialized [core.uninitialized.Assign]
347 | buf[1] = data[i + 1];
| ^ ~~~~~~~~~~~
3 warnings generated.
tools/rfcomm-tester.c:410:6: warning: The 1st argument to 'bind' is -1 but should be >= 0 [unix.StdCLibraryFunctions]
410 | if (bind(sk, (struct sockaddr *) &addr, sizeof(addr)) < 0) {
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
tools/rfcomm-tester.c:428:8: warning: The 1st argument to 'connect' is -1 but should be >= 0 [unix.StdCLibraryFunctions]
428 | err = connect(sk, (struct sockaddr *) &addr, sizeof(addr));
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
2 warnings generated.
tools/avtest.c:243:5: warning: Value stored to 'len' is never read [deadcode.DeadStores]
243 | len = write(sk, buf, 3);
| ^ ~~~~~~~~~~~~~~~~~
tools/avtest.c:253:5: warning: Value stored to 'len' is never read [deadcode.DeadStores]
253 | len = write(sk, buf, 4);
| ^ ~~~~~~~~~~~~~~~~~
tools/avtest.c:262:5: warning: Value stored to 'len' is never read [deadcode.DeadStores]
262 | len = write(sk, buf, 3);
| ^ ~~~~~~~~~~~~~~~~~
tools/avtest.c:276:5: warning: Value stored to 'len' is never read [deadcode.DeadStores]
276 | len = write(sk, buf,
| ^ ~~~~~~~~~~~~~~
277 | 3 + sizeof(media_transport));
| ~~~~~~~~~~~~~~~~~~~~~~~~~~~~
tools/avtest.c:283:5: warning: Value stored to 'len' is never read [deadcode.DeadStores]
283 | len = write(sk, buf,
| ^ ~~~~~~~~~~~~~~
284 | 1 + media_transport_size);
| ~~~~~~~~~~~~~~~~~~~~~~~~~
tools/avtest.c:290:5: warning: Value stored to 'len' is never read [deadcode.DeadStores]
290 | len = write(sk, buf,
| ^ ~~~~~~~~~~~~~~
291 | 1 + media_transport_size);
| ~~~~~~~~~~~~~~~~~~~~~~~~~
tools/avtest.c:297:5: warning: Value stored to 'len' is never read [deadcode.DeadStores]
297 | len = write(sk, buf,
| ^ ~~~~~~~~~~~~~~
298 | 2 + media_transport_size);
| ~~~~~~~~~~~~~~~~~~~~~~~~~
tools/avtest.c:309:5: warning: Value stored to 'len' is never read [deadcode.DeadStores]
309 | len = write(sk, buf, 4);
| ^ ~~~~~~~~~~~~~~~~~
tools/avtest.c:313:5: warning: Value stored to 'len' is never read [deadcode.DeadStores]
313 | len = write(sk, buf, 2);
| ^ ~~~~~~~~~~~~~~~~~
tools/avtest.c:322:5: warning: Value stored to 'len' is never read [deadcode.DeadStores]
322 | len = write(sk, buf, 3);
| ^ ~~~~~~~~~~~~~~~~~
tools/avtest.c:326:5: warning: Value stored to 'len' is never read [deadcode.DeadStores]
326 | len = write(sk, buf, 2);
| ^ ~~~~~~~~~~~~~~~~~
tools/avtest.c:335:5: warning: Value stored to 'len' is never read [deadcode.DeadStores]
335 | len = write(sk, buf, 3);
| ^ ~~~~~~~~~~~~~~~~~
tools/avtest.c:342:5: warning: Value stored to 'len' is never read [deadcode.DeadStores]
342 | len = write(sk, buf, 2);
| ^ ~~~~~~~~~~~~~~~~~
tools/avtest.c:364:5: warning: Value stored to 'len' is never read [deadcode.DeadStores]
364 | len = write(sk, buf, 4);
| ^ ~~~~~~~~~~~~~~~~~
tools/avtest.c:368:5: warning: Value stored to 'len' is never read [deadcode.DeadStores]
368 | len = write(sk, buf, 2);
| ^ ~~~~~~~~~~~~~~~~~
tools/avtest.c:377:5: warning: Value stored to 'len' is never read [deadcode.DeadStores]
377 | len = write(sk, buf, 3);
| ^ ~~~~~~~~~~~~~~~~~
tools/avtest.c:381:5: warning: Value stored to 'len' is never read [deadcode.DeadStores]
381 | len = write(sk, buf, 2);
| ^ ~~~~~~~~~~~~~~~~~
tools/avtest.c:394:5: warning: Value stored to 'len' is never read [deadcode.DeadStores]
394 | len = write(sk, buf, 4);
| ^ ~~~~~~~~~~~~~~~~~
tools/avtest.c:398:5: warning: Value stored to 'len' is never read [deadcode.DeadStores]
398 | len = write(sk, buf, 2);
| ^ ~~~~~~~~~~~~~~~~~
tools/avtest.c:405:4: warning: Value stored to 'len' is never read [deadcode.DeadStores]
405 | len = write(sk, buf, 2);
| ^ ~~~~~~~~~~~~~~~~~
tools/avtest.c:415:4: warning: Value stored to 'len' is never read [deadcode.DeadStores]
415 | len = write(sk, buf, 2);
| ^ ~~~~~~~~~~~~~~~~~
tools/avtest.c:580:3: warning: Value stored to 'len' is never read [deadcode.DeadStores]
580 | len = write(sk, buf, 2);
| ^ ~~~~~~~~~~~~~~~~~
tools/avtest.c:588:3: warning: Value stored to 'len' is never read [deadcode.DeadStores]
588 | len = write(sk, buf, invalid ? 2 : 3);
| ^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
tools/avtest.c:602:3: warning: Value stored to 'len' is never read [deadcode.DeadStores]
602 | len = write(sk, buf, 4 + media_transport_size);
| ^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
tools/avtest.c:615:3: warning: Value stored to 'len' is never read [deadcode.DeadStores]
615 | len = write(sk, buf, 3);
| ^ ~~~~~~~~~~~~~~~~~
tools/avtest.c:625:3: warning: Value stored to 'len' is never read [deadcode.DeadStores]
625 | len = write(sk, buf, 3);
| ^ ~~~~~~~~~~~~~~~~~
tools/avtest.c:637:3: warning: Value stored to 'len' is never read [deadcode.DeadStores]
637 | len = write(sk, buf, 3);
| ^ ~~~~~~~~~~~~~~~~~
tools/avtest.c:652:3: warning: Value stored to 'len' is never read [deadcode.DeadStores]
652 | len = write(sk, buf, 3);
| ^ ~~~~~~~~~~~~~~~~~
tools/avtest.c:664:3: warning: Value stored to 'len' is never read [deadcode.DeadStores]
664 | len = write(sk, buf, 3);
| ^ ~~~~~~~~~~~~~~~~~
tools/avtest.c:673:3: warning: Value stored to 'len' is never read [deadcode.DeadStores]
673 | len = write(sk, buf, 3);
| ^ ~~~~~~~~~~~~~~~~~
tools/avtest.c:680:3: warning: Value stored to 'len' is never read [deadcode.DeadStores]
680 | len = write(sk, buf, 2);
| ^ ~~~~~~~~~~~~~~~~~
tools/avtest.c:716:2: warning: Value stored to 'len' is never read [deadcode.DeadStores]
716 | len = write(sk, buf, AVCTP_HEADER_LENGTH + sizeof(play_pressed));
| ^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
32 warnings generated.
tools/create-image.c:76:3: warning: Value stored to 'fd' is never read [deadcode.DeadStores]
76 | fd = -1;
| ^ ~~
tools/create-image.c:84:3: warning: Value stored to 'fd' is never read [deadcode.DeadStores]
84 | fd = -1;
| ^ ~~
tools/create-image.c:92:3: warning: Value stored to 'fd' is never read [deadcode.DeadStores]
92 | fd = -1;
| ^ ~~
tools/create-image.c:105:2: warning: Value stored to 'fd' is never read [deadcode.DeadStores]
105 | fd = -1;
| ^ ~~
tools/create-image.c:108:2: warning: Null pointer passed to 1st parameter expecting 'nonnull' [core.NonNullParamChecker]
108 | fprintf(fp, HDR_FMT, HDR_MAGIC, ino, mode, 0, 0, 1, 0,
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
109 | (uintmax_t) st.st_size, 0, 0, 0, 0, namelen + 1, 0, name);
| ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
tools/create-image.c:188:2: warning: Null pointer passed to 1st parameter expecting 'nonnull' [core.NonNullParamChecker]
188 | fclose(fp);
| ^~~~~~~~~~
6 warnings generated.
tools/btgatt-client.c:1822:2: warning: Value stored to 'argv' is never read [deadcode.DeadStores]
1822 | argv += optind;
| ^ ~~~~~~
1 warning generated.
tools/check-selftest.c:42:3: warning: Value stored to 'ptr' is never read [deadcode.DeadStores]
42 | ptr = fgets(result, sizeof(result), fp);
| ^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
1 warning generated.
tools/btgatt-server.c:1204:2: warning: Value stored to 'argv' is never read [deadcode.DeadStores]
1204 | argv -= optind;
| ^ ~~~~~~
1 warning generated.
tools/gatt-service.c:294:2: warning: 2nd function call argument is an uninitialized value [core.CallAndMessage]
294 | chr_write(chr, value, len);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~
1 warning generated.
In file included from tools/obex-server-tool.c:17:
In file included from /usr/include/fcntl.h:342:
/usr/include/x86_64-linux-gnu/bits/fcntl2.h:76:10: warning: Null pointer passed to 1st parameter expecting 'nonnull' [core.NonNullParamChecker]
76 | return __open_alias (__path, __oflag, __mode);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
1 warning generated.
client/btpclient/btpclientctl.c:402:3: warning: Value stored to 'bit' is never read [deadcode.DeadStores]
402 | bit = 0;
| ^ ~
client/btpclient/btpclientctl.c:1655:2: warning: Null pointer passed to 2nd parameter expecting 'nonnull' [core.NonNullParamChecker]
1655 | memcpy(cp->data, ad_data, ad_len);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
2 warnings generated.
src/sdp-client.c:353:14: warning: Access to field 'cb' results in a dereference of a null pointer [core.NullDereference]
353 | (*ctxt)->cb = cb;
| ~~~~~~~~~~~~^~~~
1 warning generated.
src/sdpd-request.c:209:13: warning: Result of 'malloc' is converted to a pointer of type 'char', which is incompatible with sizeof operand type 'uint16_t' [unix.MallocSizeof]
209 | pElem = malloc(sizeof(uint16_t));
| ^~~~~~ ~~~~~~~~~~~~~~~~
src/sdpd-request.c:237:13: warning: Result of 'malloc' is converted to a pointer of type 'char', which is incompatible with sizeof operand type 'uint32_t' [unix.MallocSizeof]
237 | pElem = malloc(sizeof(uint32_t));
| ^~~~~~ ~~~~~~~~~~~~~~~~
2 warnings generated.
src/gatt-client.c:1572:2: warning: Use of memory after it is freed [unix.Malloc]
1572 | notify_client_unref(client);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~
1 warning generated.
src/sdp-xml.c:129:10: warning: Assigned value is uninitialized [core.uninitialized.Assign]
129 | buf[1] = data[i + 1];
| ^ ~~~~~~~~~~~
src/sdp-xml.c:309:11: warning: Assigned value is uninitialized [core.uninitialized.Assign]
309 | buf[1] = data[i + 1];
| ^ ~~~~~~~~~~~
src/sdp-xml.c:347:11: warning: Assigned value is uninitialized [core.uninitialized.Assign]
347 | buf[1] = data[i + 1];
| ^ ~~~~~~~~~~~
3 warnings generated.
unit/avrcp-lib.c:1968:3: warning: 1st function call argument is an uninitialized value [core.CallAndMessage]
1968 | g_free(text[i]);
| ^~~~~~~~~~~~~~~
unit/avrcp-lib.c:3510:4: warning: Address of stack memory associated with local variable 'val' is still referred to by the caller variable 'iov' upon returning to the caller. This will be a dangling reference [core.StackAddressEscape]
3503 | struct media_item val[AVRCP_MEDIA_ATTRIBUTE_LAST];
| ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
3504 |
3505 | for (i = 0; i < number; i++) {
3506 | uint16_t len = 0;
3507 |
3508 | if (attrs[i] > AVRCP_MEDIA_ATTRIBUTE_LAST ||
3509 | attrs[i] == AVRCP_MEDIA_ATTRIBUTE_ILLEGAL)
3510 | return false;
| ^~~~~~~~~~~~
unit/avrcp-lib.c:3526:2: warning: Address of stack memory associated with local variable 'val' is still referred to by the caller variable 'iov' upon returning to the caller. This will be a dangling reference [core.StackAddressEscape]
3503 | return true;
| ^~~~~~~~~~~
3 warnings generated.
unit/avdtp.c:756:25: warning: Use of memory after it is freed [unix.Malloc]
756 | session->prio_queue = g_slist_remove(session->prio_queue, req);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
unit/avdtp.c:763:24: warning: Use of memory after it is freed [unix.Malloc]
763 | session->req_queue = g_slist_remove(session->req_queue, req);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
2 warnings generated.
unit/test-util.c:33:8: warning: Potential leak of memory pointed to by 'p1' [unix.Malloc]
33 | p2[0] = 1;
| ~~~~~~^~~
unit/test-util.c:36:3: warning: Potential leak of memory pointed to by 'p2' [unix.Malloc]
36 | _cleanup_free_ uint8_t *data = NULL;
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~
./src/shared/util.h:134:24: note: expanded from macro '_cleanup_free_'
134 | #define _cleanup_free_ _cleanup_(freep)
| ^
./src/shared/util.h:132:22: note: expanded from macro '_cleanup_'
132 | #define _cleanup_(f) __attribute__((cleanup(f)))
| ^
unit/test-util.c:42:3: warning: Potential leak of memory pointed to by 'data' [unix.Malloc]
42 | assert(is_null_too == NULL);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~
/usr/include/assert.h:170:11: note: expanded from macro 'assert'
170 | ((void) sizeof ((expr) ? 1 : 0), __extension__ ({ \
| ^~~~~~~~~~~~~~~~~~~~~~~
3 warnings generated.
unit/test-bap.c: In function ‘test_setup_server’:
unit/test-bap.c:756:58: error: passing argument 4 of ‘gatt_db_ccc_register’ from incompatible pointer type [-Wincompatible-pointer-types]
756 | gatt_db_ccc_register(db, gatt_ccc_read_cb, NULL, gatt_notify_cb, data);
| ^~~~~~~~~~~~~~
| |
| void (*)(struct gatt_db_attribute *, struct gatt_db_attribute *, const uint8_t *, size_t, struct bt_att *, void *) {aka void (*)(struct gatt_db_attribute *, struct gatt_db_attribute *, const unsigned char *, long unsigned int, struct bt_att *, void *)}
In file included from unit/test-bap.c:38:
./src/shared/gatt-db.h:213:58: note: expected ‘gatt_db_notify_t’ {aka ‘void (*)(struct gatt_db_attribute *, struct gatt_db_attribute *, const unsigned char *, long unsigned int, unsigned char, struct bt_att *, void *)’} but argument is of type ‘void (*)(struct gatt_db_attribute *, struct gatt_db_attribute *, const uint8_t *, size_t, struct bt_att *, void *)’ {aka ‘void (*)(struct gatt_db_attribute *, struct gatt_db_attribute *, const unsigned char *, long unsigned int, struct bt_att *, void *)’}
213 | gatt_db_notify_t notify_func,
| ~~~~~~~~~~~~~~~~~^~~~~~~~~~~
unit/test-bap.c:637:13: note: ‘gatt_notify_cb’ declared here
637 | static void gatt_notify_cb(struct gatt_db_attribute *attrib,
| ^~~~~~~~~~~~~~
./src/shared/gatt-db.h:51:16: note: ‘gatt_db_notify_t’ declared here
51 | typedef void (*gatt_db_notify_t) (struct gatt_db_attribute *attrib,
| ^~~~~~~~~~~~~~~~
make[1]: *** [Makefile:7130: unit/test-bap.o] Error 1
make[1]: *** Waiting for unfinished jobs....
make: *** [Makefile:4246: all] Error 2
https://github.com/bluez/bluez/pull/2643
---
Regards,
Linux Bluetooth
^ permalink raw reply [flat|nested] 18+ messages in thread
* [PATCH v2 02/14] shared/gatt-db: Pass the ATT opcode to the notify callback
2026-10-09 9:25 [PATCH v2 00/14] Ranging Profile and Ranging Service PTS fixes Cheng Jiang
2026-10-09 9:25 ` [PATCH v2 01/14] shared/gatt-client: Allow registering notify with explicit CCC value Cheng Jiang
@ 2026-10-09 9:25 ` Cheng Jiang
2026-10-09 9:25 ` [PATCH v2 03/14] unit: Take the ATT opcode in the notify callbacks Cheng Jiang
` (12 subsequent siblings)
14 siblings, 0 replies; 18+ messages in thread
From: Cheng Jiang @ 2026-10-09 9:25 UTC (permalink / raw)
To: linux-bluetooth
Cc: jinwang.li, wei.deng, xiuzhuo.shang, shuai.zhang, Cheng Jiang
gatt_db_read_t and gatt_db_write_t both tell the callback which ATT
operation it is serving through an opcode argument. gatt_db_notify_t does
not, so a notify callback can only assume a notification.
Pass the opcode the same way, set to BT_ATT_OP_HANDLE_NFY, which is what
gatt_db_attribute_notify() has always meant. No caller behaviour changes
yet; it gives the callback somewhere to read the transport from once there
is more than one.
Assisted-by: Claude:claude-opus-4.8
---
src/gatt-database.c | 3 ++-
src/shared/gatt-db.c | 3 ++-
src/shared/gatt-db.h | 3 ++-
3 files changed, 6 insertions(+), 3 deletions(-)
diff --git a/src/gatt-database.c b/src/gatt-database.c
index 18b7aa667..b8bcc0a04 100644
--- a/src/gatt-database.c
+++ b/src/gatt-database.c
@@ -1474,7 +1474,8 @@ remove:
static void gatt_notify_cb(struct gatt_db_attribute *attrib,
struct gatt_db_attribute *ccc,
const uint8_t *value, size_t len,
- struct bt_att *att, void *user_data)
+ uint8_t opcode, struct bt_att *att,
+ void *user_data)
{
struct btd_gatt_database *database = user_data;
struct notify notify;
diff --git a/src/shared/gatt-db.c b/src/shared/gatt-db.c
index 751d4c3da..d168e355b 100644
--- a/src/shared/gatt-db.c
+++ b/src/shared/gatt-db.c
@@ -2468,7 +2468,8 @@ bool gatt_db_attribute_notify(struct gatt_db_attribute *attrib,
else
notify_user_data = ccc->user_data;
- attrib->notify_func(attrib, ccc, value, len, att, notify_user_data);
+ attrib->notify_func(attrib, ccc, value, len, BT_ATT_OP_HANDLE_NFY, att,
+ notify_user_data);
return true;
}
diff --git a/src/shared/gatt-db.h b/src/shared/gatt-db.h
index da0600c01..587a281b3 100644
--- a/src/shared/gatt-db.h
+++ b/src/shared/gatt-db.h
@@ -51,7 +51,8 @@ typedef void (*gatt_db_write_t) (struct gatt_db_attribute *attrib,
typedef void (*gatt_db_notify_t) (struct gatt_db_attribute *attrib,
struct gatt_db_attribute *ccc,
const uint8_t *value, size_t len,
- struct bt_att *att, void *user_data);
+ uint8_t opcode, struct bt_att *att,
+ void *user_data);
struct gatt_db_attribute *
gatt_db_service_add_characteristic(struct gatt_db_attribute *attrib,
--
2.43.0
^ permalink raw reply related [flat|nested] 18+ messages in thread* [PATCH v2 03/14] unit: Take the ATT opcode in the notify callbacks
2026-10-09 9:25 [PATCH v2 00/14] Ranging Profile and Ranging Service PTS fixes Cheng Jiang
2026-10-09 9:25 ` [PATCH v2 01/14] shared/gatt-client: Allow registering notify with explicit CCC value Cheng Jiang
2026-10-09 9:25 ` [PATCH v2 02/14] shared/gatt-db: Pass the ATT opcode to the notify callback Cheng Jiang
@ 2026-10-09 9:25 ` Cheng Jiang
2026-10-09 9:25 ` [PATCH v2 04/14] shared/gatt-db: Add gatt_db_attribute_indicate() Cheng Jiang
` (11 subsequent siblings)
14 siblings, 0 replies; 18+ messages in thread
From: Cheng Jiang @ 2026-10-09 9:25 UTC (permalink / raw)
To: linux-bluetooth
Cc: jinwang.li, wei.deng, xiuzhuo.shang, shuai.zhang, Cheng Jiang
gatt_db_notify_t now passes the opcode of the operation it is serving.
Update the test callbacks to match; none of them needs to look at it.
Assisted-by: Claude:claude-opus-4.8
---
unit/test-bap.c | 3 ++-
unit/test-bass.c | 3 ++-
unit/test-mcp.c | 3 ++-
unit/test-micp.c | 3 ++-
unit/test-rap.c | 3 ++-
unit/test-vcp.c | 3 ++-
6 files changed, 12 insertions(+), 6 deletions(-)
diff --git a/unit/test-bap.c b/unit/test-bap.c
index 4e89ba6af..d16fbd96c 100644
--- a/unit/test-bap.c
+++ b/unit/test-bap.c
@@ -637,7 +637,8 @@ static struct ccc_state *get_ccc_state(struct test_data *data,
static void gatt_notify_cb(struct gatt_db_attribute *attrib,
struct gatt_db_attribute *ccc,
const uint8_t *value, size_t len,
- struct bt_att *att, void *user_data)
+ uint8_t opcode, struct bt_att *att,
+ void *user_data)
{
struct test_data *data = user_data;
uint16_t handle = gatt_db_attribute_get_handle(attrib);
diff --git a/unit/test-bass.c b/unit/test-bass.c
index 0cdee043e..302501249 100644
--- a/unit/test-bass.c
+++ b/unit/test-bass.c
@@ -625,7 +625,8 @@ done:
static void gatt_notify_cb(struct gatt_db_attribute *attrib,
struct gatt_db_attribute *ccc,
const uint8_t *value, size_t len,
- struct bt_att *att, void *user_data)
+ uint8_t opcode, struct bt_att *att,
+ void *user_data)
{
struct test_data *data = user_data;
struct ccc_state *ccc_state;
diff --git a/unit/test-mcp.c b/unit/test-mcp.c
index 21997915d..7ecb0d353 100644
--- a/unit/test-mcp.c
+++ b/unit/test-mcp.c
@@ -371,7 +371,8 @@ static struct ccc_state *get_ccc_state(struct test_data *data,
static void gatt_notify_cb(struct gatt_db_attribute *attrib,
struct gatt_db_attribute *ccc,
const uint8_t *value, size_t len,
- struct bt_att *att, void *user_data)
+ uint8_t opcode, struct bt_att *att,
+ void *user_data)
{
struct test_data *data = user_data;
uint16_t handle = gatt_db_attribute_get_handle(attrib);
diff --git a/unit/test-micp.c b/unit/test-micp.c
index ff17300d5..1723ffa66 100644
--- a/unit/test-micp.c
+++ b/unit/test-micp.c
@@ -222,7 +222,8 @@ static struct ccc_state *get_ccc_state(struct test_data_mics *data,
static void gatt_notify_cb(struct gatt_db_attribute *attrib,
struct gatt_db_attribute *ccc,
const uint8_t *value, size_t len,
- struct bt_att *att, void *user_data)
+ uint8_t opcode, struct bt_att *att,
+ void *user_data)
{
struct test_data_mics *data = user_data;
struct notify notify;
diff --git a/unit/test-rap.c b/unit/test-rap.c
index d7da2ff45..8e2759654 100644
--- a/unit/test-rap.c
+++ b/unit/test-rap.c
@@ -153,7 +153,8 @@ static struct ccc_state *get_ccc_state(struct test_data_ras *data,
static void gatt_notify_cb(struct gatt_db_attribute *attrib,
struct gatt_db_attribute *ccc,
const uint8_t *value, size_t len,
- struct bt_att *att, void *user_data)
+ uint8_t opcode, struct bt_att *att,
+ void *user_data)
{
struct test_data_ras *data = user_data;
struct notify notify;
diff --git a/unit/test-vcp.c b/unit/test-vcp.c
index 4a60842e5..4ec4da428 100644
--- a/unit/test-vcp.c
+++ b/unit/test-vcp.c
@@ -127,7 +127,8 @@ static struct ccc_state *get_ccc_state(struct test_data *data,
static void gatt_notify_cb(struct gatt_db_attribute *attrib,
struct gatt_db_attribute *ccc,
const uint8_t *value, size_t len,
- struct bt_att *att, void *user_data)
+ uint8_t opcode, struct bt_att *att,
+ void *user_data)
{
struct test_data *data = user_data;
uint16_t handle = gatt_db_attribute_get_handle(attrib);
--
2.43.0
^ permalink raw reply related [flat|nested] 18+ messages in thread* [PATCH v2 04/14] shared/gatt-db: Add gatt_db_attribute_indicate()
2026-10-09 9:25 [PATCH v2 00/14] Ranging Profile and Ranging Service PTS fixes Cheng Jiang
` (2 preceding siblings ...)
2026-10-09 9:25 ` [PATCH v2 03/14] unit: Take the ATT opcode in the notify callbacks Cheng Jiang
@ 2026-10-09 9:25 ` Cheng Jiang
2026-10-09 9:25 ` [PATCH v2 05/14] shared/rap: Honor CCCD transport for RAS on-demand ranging data Cheng Jiang
` (10 subsequent siblings)
14 siblings, 0 replies; 18+ messages in thread
From: Cheng Jiang @ 2026-10-09 9:25 UTC (permalink / raw)
To: linux-bluetooth
Cc: jinwang.li, wei.deng, xiuzhuo.shang, shuai.zhang, Cheng Jiang
gatt_db_attribute_notify() leaves the choice between a notification and an
indication to the CCC value the client wrote, preferring notifications
whenever the client enabled them. A server cannot therefore honour a
characteristic that has to be indicated: the Ranging Service requires
Ranging Data Ready and Ranging Data Overwritten to be indicated even when
the client subscribed to both transports (RAS 3.4.2, 3.5.2).
Add gatt_db_attribute_indicate() next to it. The two share a helper and
differ only in the opcode handed to the notify callback, so the CCC lookup
stays in one place, and a callback that does not care keeps working
unchanged.
gatt-database honours the request by skipping the notification branch and
sending an indication instead, provided the client enabled indications.
Assisted-by: Claude:claude-opus-4.8
---
src/gatt-database.c | 7 ++++++-
src/shared/gatt-db.c | 20 +++++++++++++++++---
src/shared/gatt-db.h | 12 ++++++++++++
3 files changed, 35 insertions(+), 4 deletions(-)
diff --git a/src/gatt-database.c b/src/gatt-database.c
index b8bcc0a04..b511e13e3 100644
--- a/src/gatt-database.c
+++ b/src/gatt-database.c
@@ -168,6 +168,7 @@ struct notify {
uint16_t len;
bt_gatt_server_conf_func_t conf;
void *user_data;
+ bool indicate;
};
#define CLI_FEAT_SIZE 1
@@ -1446,7 +1447,7 @@ static void send_notification_to_device(void *data, void *user_data)
* TODO: If the device is not connected but bonded, send the
* notification/indication when it becomes connected.
*/
- if (ccc->value & 0x0001) {
+ if (!notify->indicate && (ccc->value & 0x0001)) {
DBG("GATT server sending notification");
bt_gatt_server_send_notification(server,
notify->handle, notify->value,
@@ -1455,6 +1456,9 @@ static void send_notification_to_device(void *data, void *user_data)
return;
}
+ if (!(ccc->value & 0x0002))
+ return;
+
DBG("GATT server sending indication");
bt_gatt_server_send_indication(server, notify->handle, notify->value,
notify->len, notify->conf,
@@ -1487,6 +1491,7 @@ static void gatt_notify_cb(struct gatt_db_attribute *attrib,
notify.ccc_handle = gatt_db_attribute_get_handle(ccc);
notify.value = (void *) value;
notify.len = len;
+ notify.indicate = (opcode == BT_ATT_OP_HANDLE_IND);
if (attrib == database->svc_chngd)
notify.conf = service_changed_conf;
diff --git a/src/shared/gatt-db.c b/src/shared/gatt-db.c
index d168e355b..af26ca5c1 100644
--- a/src/shared/gatt-db.c
+++ b/src/shared/gatt-db.c
@@ -2440,9 +2440,9 @@ gatt_db_attribute_get_ccc(struct gatt_db_attribute *attrib)
return ccc;
}
-bool gatt_db_attribute_notify(struct gatt_db_attribute *attrib,
+static bool attribute_notify(struct gatt_db_attribute *attrib,
const uint8_t *value, size_t len,
- struct bt_att *att)
+ uint8_t opcode, struct bt_att *att)
{
struct gatt_db_attribute *ccc;
struct gatt_db *db;
@@ -2468,12 +2468,26 @@ bool gatt_db_attribute_notify(struct gatt_db_attribute *attrib,
else
notify_user_data = ccc->user_data;
- attrib->notify_func(attrib, ccc, value, len, BT_ATT_OP_HANDLE_NFY, att,
+ attrib->notify_func(attrib, ccc, value, len, opcode, att,
notify_user_data);
return true;
}
+bool gatt_db_attribute_notify(struct gatt_db_attribute *attrib,
+ const uint8_t *value, size_t len,
+ struct bt_att *att)
+{
+ return attribute_notify(attrib, value, len, BT_ATT_OP_HANDLE_NFY, att);
+}
+
+bool gatt_db_attribute_indicate(struct gatt_db_attribute *attrib,
+ const uint8_t *value, size_t len,
+ struct bt_att *att)
+{
+ return attribute_notify(attrib, value, len, BT_ATT_OP_HANDLE_IND, att);
+}
+
bool gatt_db_attribute_reset(struct gatt_db_attribute *attrib)
{
if (!attrib)
diff --git a/src/shared/gatt-db.h b/src/shared/gatt-db.h
index 587a281b3..5e7e7203f 100644
--- a/src/shared/gatt-db.h
+++ b/src/shared/gatt-db.h
@@ -301,6 +301,18 @@ bool gatt_db_attribute_notify(struct gatt_db_attribute *attrib,
const uint8_t *value, size_t len,
struct bt_att *att);
+/* Same as gatt_db_attribute_notify() but asks for an indication, so the
+ * notify callback is given BT_ATT_OP_HANDLE_IND instead of
+ * BT_ATT_OP_HANDLE_NFY. Some profiles mandate the indication transport for
+ * specific characteristics, for example the Ranging Service Ranging Data
+ * Ready and Ranging Data Overwritten ones, which gatt_db_attribute_notify()
+ * cannot express since it prefers notifications whenever the client enabled
+ * them.
+ */
+bool gatt_db_attribute_indicate(struct gatt_db_attribute *attrib,
+ const uint8_t *value, size_t len,
+ struct bt_att *att);
+
bool gatt_db_attribute_reset(struct gatt_db_attribute *attrib);
void *gatt_db_attribute_get_user_data(struct gatt_db_attribute *attrib);
--
2.43.0
^ permalink raw reply related [flat|nested] 18+ messages in thread* [PATCH v2 05/14] shared/rap: Honor CCCD transport for RAS on-demand ranging data
2026-10-09 9:25 [PATCH v2 00/14] Ranging Profile and Ranging Service PTS fixes Cheng Jiang
` (3 preceding siblings ...)
2026-10-09 9:25 ` [PATCH v2 04/14] shared/gatt-db: Add gatt_db_attribute_indicate() Cheng Jiang
@ 2026-10-09 9:25 ` Cheng Jiang
2026-10-09 9:25 ` [PATCH v2 06/14] shared/rap: Add RAS Control Point Abort Operation Cheng Jiang
` (9 subsequent siblings)
14 siblings, 0 replies; 18+ messages in thread
From: Cheng Jiang @ 2026-10-09 9:25 UTC (permalink / raw)
To: linux-bluetooth
Cc: jinwang.li, wei.deng, xiuzhuo.shang, shuai.zhang, Cheng Jiang
Complete the RAS responder handling of On-demand Ranging Data so the
transport used for each notified characteristic follows the peer's CCCD
subscription. The On-demand Ranging Data, RAS Control Point, Ranging
Data Ready and Ranging Data Overwritten characteristics are delivered
as notifications or indications according to how the client configured
their CCCDs. Ready and Overwritten gain a CCC write callback so their
subscribed transport is tracked, and a Ranging Counter each so a read
returns the value last notified.
When a client enables both transports (0x0003) the spec does not pick the
same one everywhere, so the two rules are kept in separate helpers:
Ranging Data Ready and Ranging Data Overwritten are indicated per RAS
3.4.2 and 3.5.2, while On-demand and Real-time Ranging Data are notified
per RAS 3.2.2 and 3.2.3.1. The RAS Control Point is indicate-only.
Ranging data is segmented across ATT PDUs, and it was queued a whole
transfer at a time. Notifications land on the att write queue, which
pick_next_send_op() drains ahead of the request queue and with no flow
control of its own, so doing that starves incoming ATT operations until the
last segment has been written: a Control Point write arriving mid-transfer
is only answered once the transfer ends.
Send one segment at a time instead. Indications go out with bt_att_send()
and the next segment is queued from the confirmation callback;
notifications have no confirmation to gate on, so the next one is queued
from a short timeout. Either way a single segment is outstanding, so an
Abort Operation stops the transfer rather than letting a queued one drain
out.
The notification delay cannot be zero: a zero timeout yields the event loop
without waiting, so a Control Point write is only seen once it has already
arrived, and a short transfer can finish before an Abort crosses the air
interface. Against RAS/SR/SPE/BI-05-C, which writes an invalid Abort
Operation mid-transfer, 0 ms fails and 5 ms passes, so use that.
Assisted-by: Claude:claude-opus-4.8
---
src/shared/rap.c | 392 +++++++++++++++++++++++++++++++++++++++++------
1 file changed, 342 insertions(+), 50 deletions(-)
diff --git a/src/shared/rap.c b/src/shared/rap.c
index 0a7a01ca8..e0129773e 100644
--- a/src/shared/rap.c
+++ b/src/shared/rap.c
@@ -33,6 +33,11 @@
* ras_ondemand_client permanently stuck waiting.
*/
#define RAS_CP_RESPONSE_TIMEOUT (10 * 1000)
+#define RAS_SEGMENT_TIMEOUT (1 * 1000)
+/* Delay between On-demand ranging-data notification segments, see
+ * send_ondemand_segment_data_cb().
+ */
+#define RAS_SEGMENT_NFY_PACE_MS 5
#define DBG(_rap, fmt, ...) \
rap_debug(_rap, "%s:%s() " fmt, __FILE__, __func__, ##__VA_ARGS__)
@@ -337,10 +342,12 @@ enum ras_cp_response_code {
*/
struct ras_ondemand_cache {
bool valid;
+ bool sending;
uint16_t counter;
struct iovec data;
uint16_t send_index;
struct segmentation_header seg_hdr;
+ unsigned int send_id;
};
/* Initiator role: which RAS Control Point request the client is
@@ -378,10 +385,17 @@ struct ras {
struct gatt_db_attribute *ready_ccc;
struct gatt_db_attribute *overwritten_chrc;
struct gatt_db_attribute *overwritten_ccc;
+ uint16_t ready_counter;
+ uint16_t overwritten_counter;
/* CCC state tracking for mutual exclusivity */
uint16_t realtime_ccc_value;
uint16_t ondemand_ccc_value;
+ /* CCC state for Ready/Overwritten so notifications are sent with
+ * the transport (notification or indication) the client enabled.
+ */
+ uint16_t ready_ccc_value;
+ uint16_t overwritten_ccc_value;
/* Initiator role: pending RAS Control Point request state */
struct ras_ondemand_client client;
@@ -396,6 +410,9 @@ static inline bool ras_is_ondemand_mode(const struct ras *ras)
* defined alongside the other RAS Control Point client helpers.
*/
static void ras_ondemand_client_reset(struct ras *ras);
+static void ras_ondemand_cache_clear(struct bt_rap *rap);
+static bool ras_cp_write_op(struct bt_rap *rap, struct ras *ras,
+ uint8_t opcode, uint16_t counter);
struct bt_rap_db {
struct gatt_db *db;
@@ -942,8 +959,7 @@ void bt_rap_detach(struct bt_rap *rap)
* connection so a reconnect (by this or another central) cannot
* be served stale ranging data via Get_Ranging_Data.
*/
- free(rap->cache.data.iov_base);
- memset(&rap->cache, 0, sizeof(rap->cache));
+ ras_ondemand_cache_clear(rap);
if (rap->rrapdb && rap->rrapdb->ras) {
struct ras *ras = rap->rrapdb->ras;
@@ -1180,12 +1196,7 @@ static void ras_features_read_cb(struct gatt_db_attribute *attrib,
void *user_data)
{
struct ras *ras = user_data;
- /*
- * Feature mask: bits 0-2 set:
- * - Real-time ranging
- * - Retrieve stored results
- * - Abort operation
- */
+ /* Real-time ranging and Abort Operation are supported. */
uint8_t value[4] = { 0x01, 0x00, 0x00, 0x00 };
if (ras)
@@ -1199,13 +1210,10 @@ static void ras_cp_send_response_code(struct bt_rap *rap, struct ras *ras,
static void ras_cp_send_complete_ranging_data(struct bt_rap *rap,
struct ras *ras, uint16_t counter);
static void send_ondemand_segment_data(struct bt_rap *rap, struct ras *ras);
-static void ras_ondemand_cache_clear(struct bt_rap *rap);
/*
* RAS Control Point handler, dispatches Get_Ranging_Data and
- * ACK_Ranging_Data. The remaining, optional
- * op codes (Retrieve_Lost_Ranging_Data_Segments, Abort_Operation,
- * Set_Filter) are not implemented.
+ * ACK_Ranging_Data. The remaining optional op codes are not implemented.
*/
static void ras_control_point_write_cb(struct gatt_db_attribute *attrib,
unsigned int id, uint16_t offset,
@@ -1236,6 +1244,14 @@ static void ras_control_point_write_cb(struct gatt_db_attribute *attrib,
return;
}
+ if (rap->cache.sending) {
+ ras_cp_send_response_code(rap, ras,
+ RAS_CP_RSP_CODE_SERVER_BUSY);
+ goto done;
+ }
+
+ DBG(rap, "CP write: opcode=0x%02x len=%zu", value[0], len);
+
switch (value[0]) {
case RAS_CP_OP_GET_RANGING_DATA:
if (len != 3) {
@@ -1279,6 +1295,7 @@ static void ras_control_point_write_cb(struct gatt_db_attribute *attrib,
break;
}
+done:
gatt_db_attribute_write_result(attrib, id, 0);
}
@@ -1289,13 +1306,12 @@ static void ras_data_ready_read_cb(struct gatt_db_attribute *attrib,
void *user_data)
{
struct ras *ras = user_data;
- uint16_t counter = 0;
uint8_t value[2];
if (ras)
bt_rap_get_session(att, ras->rapdb->db);
- put_le16(counter, value);
+ put_le16(ras ? ras->ready_counter : 0, value);
gatt_db_attribute_read_result(attrib, id, 0, value, sizeof(value));
}
@@ -1306,11 +1322,12 @@ static void ras_data_overwritten_read_cb(struct gatt_db_attribute *attrib,
void *user_data)
{
struct ras *ras = user_data;
- uint8_t value[2] = { 0x00, 0x00 };
+ uint8_t value[2];
if (ras)
bt_rap_get_session(att, ras->rapdb->db);
+ put_le16(ras ? ras->overwritten_counter : 0, value);
gatt_db_attribute_read_result(attrib, id, 0, value, sizeof(value));
}
@@ -1380,6 +1397,76 @@ static void ras_ranging_data_ccc_write_cb(struct gatt_db_attribute *attrib,
gatt_db_attribute_write_result(attrib, id, 0);
}
+/* Track the Ready / Overwritten CCC value so their notifications are sent with
+ * the transport the client subscribed to (notification vs indication). Both
+ * characteristics support NOTIFY and INDICATE; a headless RAS server must honor
+ * whichever the client enabled (e.g. RCO/BV-05-C uses Indication, BV-06-C
+ * uses Notification).
+ */
+static void ras_ready_overwritten_ccc_write_cb(struct gatt_db_attribute *attrib,
+ unsigned int id, uint16_t offset,
+ const uint8_t *value, size_t len,
+ uint8_t opcode, struct bt_att *att,
+ void *user_data)
+{
+ struct ras *ras = user_data;
+ uint16_t ccc_value;
+
+ if (!ras) {
+ gatt_db_attribute_write_result(attrib, id,
+ BT_ATT_ERROR_UNLIKELY);
+ return;
+ }
+
+ if (offset) {
+ gatt_db_attribute_write_result(attrib, id,
+ BT_ATT_ERROR_INVALID_OFFSET);
+ return;
+ }
+
+ if (len != 2) {
+ gatt_db_attribute_write_result(attrib, id,
+ BT_ATT_ERROR_INVALID_ATTRIBUTE_VALUE_LEN);
+ return;
+ }
+
+ ccc_value = get_le16(value);
+
+ if (ccc_value != 0x0000 && ccc_value != 0x0001 &&
+ ccc_value != 0x0002 && ccc_value != 0x0003) {
+ gatt_db_attribute_write_result(attrib, id,
+ BT_ERROR_WRITE_REQUEST_REJECTED);
+ return;
+ }
+
+ if (attrib == ras->ready_ccc)
+ ras->ready_ccc_value = ccc_value;
+ else if (attrib == ras->overwritten_ccc)
+ ras->overwritten_ccc_value = ccc_value;
+
+ gatt_db_attribute_write_result(attrib, id, 0);
+}
+
+/* Pick the notify transport for Ranging Data Ready / Ranging Data Overwritten
+ * from a tracked CCC value. RAS 3.4.2 and 3.5.2 require indications when both
+ * transports are enabled (0x0003), so notification is used only when it is the
+ * sole enabled transport. The On-demand and Real-time Ranging Data
+ * characteristics take the opposite rule and must not use this helper.
+ */
+static bool ras_ccc_use_indication(uint16_t ccc_value)
+{
+ return !(ccc_value & 0x0001) || (ccc_value & 0x0002);
+}
+
+/* Pick the notify transport for On-demand / Real-time Ranging Data. RAS 3.2.2
+ * and 3.2.3.1 require notifications when both transports are enabled (0x0003),
+ * so indication is used only when it is the sole enabled transport.
+ */
+static bool ras_data_ccc_use_indication(uint16_t ccc_value)
+{
+ return !(ccc_value & 0x0001);
+}
+
/* Service registration - store attribute pointers */
static struct ras *register_ras_service(struct gatt_db *db)
{
@@ -1470,8 +1557,10 @@ static struct ras *register_ras_service(struct gatt_db *db)
ras_data_ready_read_cb, NULL,
ras);
- ras->ready_ccc = gatt_db_service_add_ccc(ras->svc,
- BT_ATT_PERM_READ | BT_ATT_PERM_WRITE);
+ ras->ready_ccc = gatt_db_service_add_ccc_custom(ras->svc,
+ BT_ATT_PERM_READ | BT_ATT_PERM_WRITE,
+ ras_ready_overwritten_ccc_write_cb,
+ ras);
/* RAS Data Overwritten */
bt_uuid16_create(&uuid, RAS_DATA_OVERWRITTEN_UUID);
@@ -1485,8 +1574,10 @@ static struct ras *register_ras_service(struct gatt_db *db)
ras_data_overwritten_read_cb,
NULL, ras);
- ras->overwritten_ccc = gatt_db_service_add_ccc(ras->svc,
- BT_ATT_PERM_READ | BT_ATT_PERM_WRITE);
+ ras->overwritten_ccc = gatt_db_service_add_ccc_custom(ras->svc,
+ BT_ATT_PERM_READ | BT_ATT_PERM_WRITE,
+ ras_ready_overwritten_ccc_write_cb,
+ ras);
/* Activate the service */
gatt_db_service_set_active(ras->svc, true);
@@ -1702,12 +1793,17 @@ static void ras_ondemand_cache_clear(struct bt_rap *rap)
if (!rap)
return;
+ if (rap->cache.send_id)
+ timeout_remove(rap->cache.send_id);
+
free(rap->cache.data.iov_base);
rap->cache.data.iov_base = NULL;
rap->cache.data.iov_len = 0;
rap->cache.valid = false;
rap->cache.counter = 0;
rap->cache.send_index = 0;
+ rap->cache.send_id = 0;
+ rap->cache.sending = false;
}
static void ras_ondemand_cache_store(struct bt_rap *rap,
@@ -1735,9 +1831,14 @@ static void ras_send_ranging_data_ready(struct bt_rap *rap, struct ras *ras,
if (!rap || !ras || !ras->ready_chrc)
return;
+ ras->ready_counter = counter;
put_le16(counter, value);
- gatt_db_attribute_notify(ras->ready_chrc, value, sizeof(value),
- bt_rap_get_att(rap));
+ if (ras_ccc_use_indication(ras->ready_ccc_value))
+ gatt_db_attribute_indicate(ras->ready_chrc, value,
+ sizeof(value), bt_rap_get_att(rap));
+ else
+ gatt_db_attribute_notify(ras->ready_chrc, value,
+ sizeof(value), bt_rap_get_att(rap));
}
static void ras_send_ranging_data_overwritten(struct bt_rap *rap,
@@ -1748,9 +1849,14 @@ static void ras_send_ranging_data_overwritten(struct bt_rap *rap,
if (!rap || !ras || !ras->overwritten_chrc)
return;
+ ras->overwritten_counter = counter;
put_le16(counter, value);
- gatt_db_attribute_notify(ras->overwritten_chrc, value, sizeof(value),
- bt_rap_get_att(rap));
+ if (ras_ccc_use_indication(ras->overwritten_ccc_value))
+ gatt_db_attribute_indicate(ras->overwritten_chrc, value,
+ sizeof(value), bt_rap_get_att(rap));
+ else
+ gatt_db_attribute_notify(ras->overwritten_chrc, value,
+ sizeof(value), bt_rap_get_att(rap));
}
static void ras_cp_send_response_code(struct bt_rap *rap, struct ras *ras,
@@ -1761,8 +1867,9 @@ static void ras_cp_send_response_code(struct bt_rap *rap, struct ras *ras,
if (!rap || !ras || !ras->cp_chrc)
return;
- gatt_db_attribute_notify(ras->cp_chrc, value, sizeof(value),
- bt_rap_get_att(rap));
+ DBG(rap, "CP send Response Code: rsp=0x%02x", response_code);
+ gatt_db_attribute_indicate(ras->cp_chrc, value, sizeof(value),
+ bt_rap_get_att(rap));
}
static void ras_cp_send_complete_ranging_data(struct bt_rap *rap,
@@ -1776,18 +1883,51 @@ static void ras_cp_send_complete_ranging_data(struct bt_rap *rap,
value[0] = RAS_CP_RSP_COMPLETE_RANGING_DATA;
put_le16(counter, value + 1);
- gatt_db_attribute_notify(ras->cp_chrc, value, sizeof(value),
- bt_rap_get_att(rap));
+ gatt_db_attribute_indicate(ras->cp_chrc, value, sizeof(value),
+ bt_rap_get_att(rap));
}
-static void send_ondemand_segment_data(struct bt_rap *rap, struct ras *ras)
+static bool send_ondemand_segment_data_cb(void *user_data);
+
+/*
+ * Confirmation callback for an on-demand ranging-data Indication segment.
+ * Invoked (opcode == BT_ATT_OP_HANDLE_CONF) when the client confirms the
+ * segment. Only then do we send the next segment (confirm-driven flow control),
+ * so at most one indication is in-flight and an Abort (which clears
+ * cache.sending) stops the transfer immediately.
+ */
+static void ondemand_ind_conf_cb(uint8_t opcode, const void *pdu,
+ uint16_t length, void *user_data)
+{
+ struct bt_rap *rap = user_data;
+ struct ras *ras = rap && rap->lrapdb ? rap->lrapdb->ras : NULL;
+
+ if (!rap || !ras || !rap->cache.valid || !rap->cache.sending)
+ return;
+
+ /* All data sent and confirmed: finish with Complete Ranging Data. */
+ if (rap->cache.send_index >= rap->cache.data.iov_len) {
+ rap->cache.sending = false;
+ ras_cp_send_complete_ranging_data(rap, ras, rap->cache.counter);
+ return;
+ }
+
+ /* Otherwise send the next segment. */
+ send_ondemand_segment_data_cb(rap);
+}
+
+static bool send_ondemand_segment_data_cb(void *user_data)
{
+ struct bt_rap *rap = user_data;
+ struct ras *ras = rap && rap->lrapdb ? rap->lrapdb->ras : NULL;
uint16_t value_max;
const uint16_t header_len = ras_segment_header_size;
uint16_t raw_payload_size;
- if (!rap || !ras || !rap->cache.valid)
- return;
+ if (!rap || !ras || !rap->cache.valid || !rap->cache.sending)
+ return false;
+
+ rap->cache.send_id = 0;
value_max = ras_att_value_payload_max(rap);
@@ -1801,17 +1941,13 @@ static void send_ondemand_segment_data(struct bt_rap *rap, struct ras *ras)
*/
ras_cp_send_response_code(rap, ras,
RAS_CP_RSP_CODE_SERVER_BUSY);
- return;
+ rap->cache.sending = false;
+ return false;
}
raw_payload_size = (uint16_t)(value_max - header_len);
- rap->cache.send_index = 0;
- rap->cache.seg_hdr.first_segment = 1;
- rap->cache.seg_hdr.last_segment = 0;
- rap->cache.seg_hdr.rolling_segment_counter = 0;
-
- while (true) {
+ {
size_t total_len = rap->cache.data.iov_len;
size_t index = rap->cache.send_index;
size_t unsent_data_size = total_len - index;
@@ -1833,7 +1969,8 @@ static void send_ondemand_segment_data(struct bt_rap *rap, struct ras *ras)
DBG(rap, "OOM (%u)", seg_len);
ras_cp_send_response_code(rap, ras,
RAS_CP_RSP_CODE_SERVER_BUSY);
- return;
+ rap->cache.sending = false;
+ return false;
}
wr += (uint16_t)
@@ -1844,6 +1981,88 @@ static void send_ondemand_segment_data(struct bt_rap *rap, struct ras *ras)
copy_size);
wr += copy_size;
+ /*
+ * On-demand transfer flow control by transport:
+ *
+ * - Indication: send one segment as an ATT Handle Value
+ * Indication via bt_att_send() and advance/schedule the NEXT
+ * segment only from its confirmation callback
+ * (ondemand_ind_conf_cb). This keeps at most one segment
+ * in-flight, so an Abort Operation that clears cache.sending
+ * actually stops the transfer instead of a large backlog
+ * draining out of the att indication queue.
+ * - Notification: fire-and-forget, so there is no confirmation
+ * to gate on. Notifications go to the att write queue, which
+ * pick_next_send_op() drains ahead of the request queue and
+ * without flow control of its own, so queueing the whole
+ * transfer at once would starve incoming ATT operations until
+ * the last segment is written. Queue the next segment from
+ * the next event loop iteration instead, which keeps one
+ * segment outstanding.
+ *
+ * The delay has to be non-zero for a client to be able to
+ * abort a transfer it no longer wants. A zero timeout yields
+ * the event loop but does not wait, since poll() returns at
+ * once when nothing is pending on the socket, so a Control
+ * Point write is only seen here once it has already arrived,
+ * and the transfer can be over by then.
+ *
+ * What the peer gets is the transfer time, segments times this
+ * delay, and it has to cover a connection event for an Abort
+ * Operation to reach us at all. A short transfer is therefore
+ * the constraining case, not a long one, and the rate at which
+ * the controller reports ranging data does not help: the
+ * segments of one subevent still go out back to back.
+ * RAS/SR/SPE/BI-05-C, which writes an invalid Abort Operation
+ * mid-transfer and expects Invalid Parameter rather than
+ * Complete Ranging Data, fails at 0 ms and passes at 5 ms.
+ *
+ * The delay also bounds a transfer, so keep it short: at a
+ * 247 byte MTU a 13 KB procedure is 57 segments.
+ */
+ if (ras_data_ccc_use_indication(ras->ondemand_ccc_value)) {
+ uint16_t vhandle =
+ gatt_db_attribute_get_handle(
+ gatt_db_attribute_get_value(
+ ras->ondemand_chrc));
+ uint8_t *pdu = malloc(2 + wr);
+ unsigned int id = 0;
+
+ if (pdu) {
+ put_le16(vhandle, pdu);
+ memcpy(pdu + 2, seg, wr);
+ id = bt_att_send(bt_rap_get_att(rap),
+ BT_ATT_OP_HANDLE_IND,
+ pdu, 2 + wr,
+ ondemand_ind_conf_cb,
+ rap, NULL);
+ free(pdu);
+ }
+
+ free(seg);
+
+ if (!id) {
+ DBG(rap, "Failed to send on-demand indication");
+ ras_cp_send_response_code(rap, ras,
+ RAS_CP_RSP_CODE_SERVER_BUSY);
+ rap->cache.sending = false;
+ return false;
+ }
+
+ /* Advance now; last-segment completion and scheduling
+ * of the next segment happen in the confirmation cb.
+ */
+ rap->cache.send_index += copy_size;
+ rap->cache.seg_hdr.first_segment = 0;
+ rap->cache.seg_hdr.rolling_segment_counter =
+ (uint8_t)((rap->cache.seg_hdr
+ .rolling_segment_counter + 1) & 0x3F);
+ return false;
+ }
+
+ /* Reached whenever the client enabled notifications, so
+ * gatt_db_attribute_notify() picks the notification transport.
+ */
ok = gatt_db_attribute_notify(ras->ondemand_chrc, seg, wr,
bt_rap_get_att(rap));
@@ -1853,7 +2072,8 @@ static void send_ondemand_segment_data(struct bt_rap *rap, struct ras *ras)
DBG(rap, "Failed to send on-demand RAS notification");
ras_cp_send_response_code(rap, ras,
RAS_CP_RSP_CODE_SERVER_BUSY);
- return;
+ rap->cache.sending = false;
+ return false;
}
rap->cache.send_index += copy_size;
@@ -1863,11 +2083,37 @@ static void send_ondemand_segment_data(struct bt_rap *rap, struct ras *ras)
.rolling_segment_counter + 1) & 0x3F);
if (rap->cache.seg_hdr.last_segment) {
+ rap->cache.sending = false;
ras_cp_send_complete_ranging_data(rap, ras,
rap->cache.counter);
- return;
+ return false;
}
}
+
+ rap->cache.send_id = timeout_add(RAS_SEGMENT_NFY_PACE_MS,
+ send_ondemand_segment_data_cb,
+ rap, NULL);
+ if (!rap->cache.send_id) {
+ ras_cp_send_response_code(rap, ras,
+ RAS_CP_RSP_CODE_SERVER_BUSY);
+ rap->cache.sending = false;
+ }
+
+ return false;
+}
+
+static void send_ondemand_segment_data(struct bt_rap *rap, struct ras *ras)
+{
+ if (!rap || !ras || !rap->cache.valid || rap->cache.sending)
+ return;
+
+ rap->cache.sending = true;
+ rap->cache.send_index = 0;
+ rap->cache.seg_hdr.first_segment = 1;
+ rap->cache.seg_hdr.last_segment = 0;
+ rap->cache.seg_hdr.rolling_segment_counter = 0;
+
+ send_ondemand_segment_data_cb(rap);
}
static void send_ras_segment_data(struct bt_rap *rap,
@@ -1956,14 +2202,30 @@ static void send_ras_segment_data(struct bt_rap *rap,
wr += copy_size;
/* Try sending to real-time characteristic */
- if (ras->realtime_chrc)
- ok = gatt_db_attribute_notify(ras->realtime_chrc, seg,
- wr, bt_rap_get_att(rap));
+ if (ras->realtime_chrc) {
+ if (ras_data_ccc_use_indication(
+ ras->realtime_ccc_value))
+ ok = gatt_db_attribute_indicate(
+ ras->realtime_chrc, seg, wr,
+ bt_rap_get_att(rap));
+ else
+ ok = gatt_db_attribute_notify(
+ ras->realtime_chrc, seg, wr,
+ bt_rap_get_att(rap));
+ }
/* Try sending to on-demand characteristic */
- if (ras->ondemand_chrc && ok)
- ok = gatt_db_attribute_notify(ras->ondemand_chrc, seg,
- wr, bt_rap_get_att(rap));
+ if (ras->ondemand_chrc && ok) {
+ if (ras_data_ccc_use_indication(
+ ras->ondemand_ccc_value))
+ ok = gatt_db_attribute_indicate(
+ ras->ondemand_chrc, seg, wr,
+ bt_rap_get_att(rap));
+ else
+ ok = gatt_db_attribute_notify(
+ ras->ondemand_chrc, seg, wr,
+ bt_rap_get_att(rap));
+ }
free(seg);
@@ -3109,7 +3371,7 @@ static bool ras_cp_timeout_cb(void *user_data)
if (ras) {
DBG(rap, "RAS CP response timed out (pending_op=%d "
- "counter=%u) - resetting", ras->client.pending_op,
+ "counter=%u)", ras->client.pending_op,
ras->client.pending_counter);
/* The glib source is about to be destroyed on return; avoid
@@ -3135,11 +3397,24 @@ static void ras_cp_arm_timeout(struct bt_rap *rap, struct ras *ras)
ras_cp_timeout_cb, rap, NULL);
}
+static void ras_cp_arm_segment_timeout(struct bt_rap *rap, struct ras *ras)
+{
+ if (!ras)
+ return;
+
+ if (ras->client.cp_timeout_id)
+ timeout_remove(ras->client.cp_timeout_id);
+
+ ras->client.cp_timeout_id = timeout_add(RAS_SEGMENT_TIMEOUT,
+ ras_cp_timeout_cb, rap, NULL);
+}
+
static bool ras_cp_write_op(struct bt_rap *rap, struct ras *ras,
uint8_t opcode, uint16_t counter)
{
uint8_t value[3];
uint16_t value_handle;
+ uint16_t length = 1;
if (!rap || !ras || !ras->cp_chrc || !rap->client)
return false;
@@ -3150,10 +3425,11 @@ static bool ras_cp_write_op(struct bt_rap *rap, struct ras *ras,
value[0] = opcode;
put_le16(counter, value + 1);
+ length = sizeof(value);
return bt_gatt_client_write_without_response(rap->client,
value_handle, false,
- value, sizeof(value));
+ value, length);
}
static bool ras_cp_send_get_ranging_data(struct bt_rap *rap, struct ras *ras,
@@ -3798,11 +4074,15 @@ static void ras_segment_notify_cb(struct bt_rap *rap, uint16_t value_handle,
void *user_data)
{
const char *label = user_data ? user_data : "real-time";
+ struct ras *ras = rap_get_ras(rap);
DBG(rap, "Received %s notification: handle=0x%04x len=%u",
label, value_handle, length);
ras_reassemble_segment_notify(rap, value, length);
+
+ if (ras && ras->client.pending_op == RAS_CP_PENDING_GET)
+ ras_cp_arm_segment_timeout(rap, ras);
}
/* Initiator role: reacts to a Ranging Data Ready notification/indication
@@ -3918,11 +4198,23 @@ static void ras_cp_response_notify_cb(struct bt_rap *rap,
DBG(rap, "RAS CP response code=0x%02x (pending_op=%d "
"counter=%u)", code, ras->client.pending_op,
ras->client.pending_counter);
- ras_ondemand_client_reset(ras);
+ switch (code) {
+ case RAS_CP_RSP_CODE_SUCCESS:
+ case RAS_CP_RSP_CODE_OPCODE_NOT_SUPPORTED:
+ case RAS_CP_RSP_CODE_INVALID_PARAMETER:
+ case RAS_CP_RSP_CODE_PROCEDURE_NOT_COMPLETED:
+ case RAS_CP_RSP_CODE_SERVER_BUSY:
+ case RAS_CP_RSP_CODE_NO_RECORDS_FOUND:
+ ras_ondemand_client_reset(ras);
+ break;
+ default:
+ DBG(rap, "Ignoring RFU RAS CP response code 0x%02x",
+ code);
+ break;
+ }
break;
default:
DBG(rap, "Unknown RAS CP response opcode 0x%02x", value[0]);
- ras_ondemand_client_reset(ras);
break;
}
}
--
2.43.0
^ permalink raw reply related [flat|nested] 18+ messages in thread* [PATCH v2 06/14] shared/rap: Add RAS Control Point Abort Operation
2026-10-09 9:25 [PATCH v2 00/14] Ranging Profile and Ranging Service PTS fixes Cheng Jiang
` (4 preceding siblings ...)
2026-10-09 9:25 ` [PATCH v2 05/14] shared/rap: Honor CCCD transport for RAS on-demand ranging data Cheng Jiang
@ 2026-10-09 9:25 ` Cheng Jiang
2026-10-09 9:25 ` [PATCH v2 07/14] unit/test-rap: Expect Abort Operation in RAS Features Cheng Jiang
` (8 subsequent siblings)
14 siblings, 0 replies; 18+ messages in thread
From: Cheng Jiang @ 2026-10-09 9:25 UTC (permalink / raw)
To: linux-bluetooth
Cc: jinwang.li, wei.deng, xiuzhuo.shang, shuai.zhang, Cheng Jiang
Implement the Abort_Operation procedure (Op Code 0x03) so a client can
cancel an On-demand Ranging Data transfer that is already in progress,
and advertise it through bit 2 of the RAS Features characteristic.
Abort clears the sending state and removes the pending segment timer.
Since the transfer keeps at most one segment outstanding, dropping that
timer stops the transfer instead of letting a queued backlog drain out.
The Control Point busy check lets Abort through while every other Op Code
is answered with Server Busy, so an abort is accepted mid-transfer.
On the requester side, an Abort is written when a Get_Ranging_Data
request times out and the peer advertises Abort support, so the responder
does not keep sending data for a request the requester gave up on.
Assisted-by: Claude:claude-opus-4.8
---
src/shared/rap.c | 35 ++++++++++++++++++++++++++++++-----
1 file changed, 30 insertions(+), 5 deletions(-)
diff --git a/src/shared/rap.c b/src/shared/rap.c
index e0129773e..eddf9f0bf 100644
--- a/src/shared/rap.c
+++ b/src/shared/rap.c
@@ -312,8 +312,8 @@ struct cstracker {
enum ras_cp_opcode {
RAS_CP_OP_GET_RANGING_DATA = 0x00,
RAS_CP_OP_ACK_RANGING_DATA = 0x01,
+ RAS_CP_OP_ABORT_OPERATION = 0x03,
/* 0x02 Retrieve_Lost_Ranging_Data_Segments,
- * 0x03 Abort_Operation,
* 0x04 Set_Filter - optional, not implemented
*/
};
@@ -366,6 +366,7 @@ struct ras_ondemand_client {
* peer never sends a Control Point response.
*/
unsigned int cp_timeout_id;
+ bool abort_operation;
};
/* Ranging Service context */
@@ -1197,7 +1198,7 @@ static void ras_features_read_cb(struct gatt_db_attribute *attrib,
{
struct ras *ras = user_data;
/* Real-time ranging and Abort Operation are supported. */
- uint8_t value[4] = { 0x01, 0x00, 0x00, 0x00 };
+ uint8_t value[4] = { 0x05, 0x00, 0x00, 0x00 };
if (ras)
bt_rap_get_session(att, ras->rapdb->db);
@@ -1244,7 +1245,7 @@ static void ras_control_point_write_cb(struct gatt_db_attribute *attrib,
return;
}
- if (rap->cache.sending) {
+ if (rap->cache.sending && value[0] != RAS_CP_OP_ABORT_OPERATION) {
ras_cp_send_response_code(rap, ras,
RAS_CP_RSP_CODE_SERVER_BUSY);
goto done;
@@ -1270,6 +1271,22 @@ static void ras_control_point_write_cb(struct gatt_db_attribute *attrib,
send_ondemand_segment_data(rap, ras);
break;
+ case RAS_CP_OP_ABORT_OPERATION:
+ if (len != 1) {
+ ras_cp_send_response_code(rap, ras,
+ RAS_CP_RSP_CODE_INVALID_PARAMETER);
+ break;
+ }
+
+ if (rap->cache.sending) {
+ if (rap->cache.send_id)
+ timeout_remove(rap->cache.send_id);
+ rap->cache.send_id = 0;
+ rap->cache.sending = false;
+ }
+
+ ras_cp_send_response_code(rap, ras, RAS_CP_RSP_CODE_SUCCESS);
+ break;
case RAS_CP_OP_ACK_RANGING_DATA:
if (len != 3) {
ras_cp_send_response_code(rap, ras,
@@ -3379,6 +3396,10 @@ static bool ras_cp_timeout_cb(void *user_data)
* on it.
*/
ras->client.cp_timeout_id = 0;
+ if (ras->client.pending_op == RAS_CP_PENDING_GET &&
+ ras->client.abort_operation)
+ ras_cp_write_op(rap, ras, RAS_CP_OP_ABORT_OPERATION,
+ ras->client.pending_counter);
ras_ondemand_client_reset(ras);
}
@@ -3424,8 +3445,10 @@ static bool ras_cp_write_op(struct bt_rap *rap, struct ras *ras,
return false;
value[0] = opcode;
- put_le16(counter, value + 1);
- length = sizeof(value);
+ if (opcode != RAS_CP_OP_ABORT_OPERATION) {
+ put_le16(counter, value + 1);
+ length = sizeof(value);
+ }
return bt_gatt_client_write_without_response(rap->client,
value_handle, false,
@@ -4293,6 +4316,8 @@ static void read_ras_features(struct bt_rap *rap, bool success,
supports_realtime = (features & 0x01) != 0;
retrieve_lost = (features & 0x02) != 0;
abort_operation = (features & 0x04) != 0;
+ if (ras)
+ ras->client.abort_operation = abort_operation;
DBG(rap, "RAS Features - Real-time: %s, Retrieve Lost: %s, Abort: %s",
supports_realtime ? "Yes" : "No",
--
2.43.0
^ permalink raw reply related [flat|nested] 18+ messages in thread* [PATCH v2 07/14] unit/test-rap: Expect Abort Operation in RAS Features
2026-10-09 9:25 [PATCH v2 00/14] Ranging Profile and Ranging Service PTS fixes Cheng Jiang
` (5 preceding siblings ...)
2026-10-09 9:25 ` [PATCH v2 06/14] shared/rap: Add RAS Control Point Abort Operation Cheng Jiang
@ 2026-10-09 9:25 ` Cheng Jiang
2026-10-09 9:25 ` [PATCH v2 08/14] shared/rap: Shorten the requester Control Point response timeout Cheng Jiang
` (7 subsequent siblings)
14 siblings, 0 replies; 18+ messages in thread
From: Cheng Jiang @ 2026-10-09 9:25 UTC (permalink / raw)
To: linux-bluetooth
Cc: jinwang.li, wei.deng, xiuzhuo.shang, shuai.zhang, Cheng Jiang
The RAS Features characteristic now advertises Abort Operation, so the
value the Features read returns is 0x05 rather than 0x01.
Assisted-by: Claude:claude-opus-4.8
---
unit/test-rap.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/unit/test-rap.c b/unit/test-rap.c
index 8e2759654..b05edf203 100644
--- a/unit/test-rap.c
+++ b/unit/test-rap.c
@@ -798,11 +798,11 @@ const struct test_config_rap cfg_cggit_discovery = {
* Handle: 0x0003 (RAS Features value handle)
*
* ATT: Read Response (0x0b) len 5
- * Value: 0x01 0x00 0x00 0x00
+ * Value: 0x05 0x00 0x00 0x00
* Feature bits:
* Bit 0: Real-time ranging (1 = supported)
* Bit 1: Retrieve stored results (0 = not supported)
- * Bit 2: Abort operation (0 = not supported)
+ * Bit 2: Abort operation (1 = supported)
*
* Note: The RAS Features characteristic is registered with
* BT_ATT_PERM_READ | BT_ATT_PERM_READ_ENCRYPT. Since the test sets
@@ -813,7 +813,7 @@ const struct test_config_rap cfg_cggit_discovery = {
#define ATT_READ_RAS_FEATURES \
IOV_DATA(0x0a, 0x03, 0x00), \
- IOV_DATA(0x0b, 0x01, 0x00, 0x00, 0x00)
+ IOV_DATA(0x0b, 0x05, 0x00, 0x00, 0x00)
#define RAS_SR_RCO_BV_01_C \
ATT_EXCHANGE_MTU, \
--
2.43.0
^ permalink raw reply related [flat|nested] 18+ messages in thread* [PATCH v2 08/14] shared/rap: Shorten the requester Control Point response timeout
2026-10-09 9:25 [PATCH v2 00/14] Ranging Profile and Ranging Service PTS fixes Cheng Jiang
` (6 preceding siblings ...)
2026-10-09 9:25 ` [PATCH v2 07/14] unit/test-rap: Expect Abort Operation in RAS Features Cheng Jiang
@ 2026-10-09 9:25 ` Cheng Jiang
2026-10-09 9:25 ` [PATCH v2 09/14] shared/rap: Add real-time ranging data delivery on the responder Cheng Jiang
` (6 subsequent siblings)
14 siblings, 0 replies; 18+ messages in thread
From: Cheng Jiang @ 2026-10-09 9:25 UTC (permalink / raw)
To: linux-bluetooth
Cc: jinwang.li, wei.deng, xiuzhuo.shang, shuai.zhang, Cheng Jiang
RAP 4.5.4.1 gives the Requester two deadlines once it has written Get
Ranging Data, both enforced by sending Abort Operation: no On-demand
Ranging Data at all within 5 seconds of the command
(RAP/REQ/ORD/BI-01-C), and no following segment within 1 second of the
previous one (RAP/REQ/ORD/BI-02-C).
The watchdog the requester arms while waiting for a Control Point
response covered the first of those, but ran for 10 seconds, so it
would abort well after the specified deadline. Arm it for 5 seconds
instead. The per-segment deadline is handled separately by
ras_cp_arm_segment_timeout(), which uses RAS_SEGMENT_TIMEOUT.
Assisted-by: Claude:claude-opus-4.8
---
src/shared/rap.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/src/shared/rap.c b/src/shared/rap.c
index eddf9f0bf..7d4fa266c 100644
--- a/src/shared/rap.c
+++ b/src/shared/rap.c
@@ -32,7 +32,7 @@
* response for. Guards against a lost/dropped notification leaving
* ras_ondemand_client permanently stuck waiting.
*/
-#define RAS_CP_RESPONSE_TIMEOUT (10 * 1000)
+#define RAS_CP_RESPONSE_TIMEOUT (5 * 1000)
#define RAS_SEGMENT_TIMEOUT (1 * 1000)
/* Delay between On-demand ranging-data notification segments, see
* send_ondemand_segment_data_cb().
--
2.43.0
^ permalink raw reply related [flat|nested] 18+ messages in thread* [PATCH v2 09/14] shared/rap: Add real-time ranging data delivery on the responder
2026-10-09 9:25 [PATCH v2 00/14] Ranging Profile and Ranging Service PTS fixes Cheng Jiang
` (7 preceding siblings ...)
2026-10-09 9:25 ` [PATCH v2 08/14] shared/rap: Shorten the requester Control Point response timeout Cheng Jiang
@ 2026-10-09 9:25 ` Cheng Jiang
2026-10-09 9:25 ` [PATCH v2 10/14] shared/rap: Add requester ranging data subscription API Cheng Jiang
` (5 subsequent siblings)
14 siblings, 0 replies; 18+ messages in thread
From: Cheng Jiang @ 2026-10-09 9:25 UTC (permalink / raw)
To: linux-bluetooth
Cc: jinwang.li, wei.deng, xiuzhuo.shang, shuai.zhang, Cheng Jiang
Implement the RAS responder side of Real-time Ranging Data. Completed
ranging-data segments are queued in a per-connection FIFO and delivered
on the Real-time Ranging Data characteristic, honoring the transport
selected by the client's CCCD: notifications are paced with a fixed
inter-segment interval, while indications are driven by ATT confirmations
so the next segment is only sent once the previous one is acknowledged.
The pending real-time segment queue is cleared when a new CS procedure
starts, so stale segments from an aborted or superseded procedure are
never delivered to the peer.
Assisted-by: Claude:claude-opus-4.8
---
src/shared/rap.c | 186 +++++++++++++++++++++++++++++++++++------------
1 file changed, 139 insertions(+), 47 deletions(-)
diff --git a/src/shared/rap.c b/src/shared/rap.c
index 7d4fa266c..6c2196f73 100644
--- a/src/shared/rap.c
+++ b/src/shared/rap.c
@@ -420,6 +420,22 @@ struct bt_rap_db {
struct ras *ras;
};
+struct ras_realtime_segment {
+ uint8_t *value;
+ uint16_t len;
+};
+
+static void ras_realtime_segment_free(void *data)
+{
+ struct ras_realtime_segment *segment = data;
+
+ if (!segment)
+ return;
+
+ free(segment->value);
+ free(segment);
+}
+
struct bt_rap {
int ref_count;
struct bt_rap_db *lrapdb;
@@ -461,6 +477,11 @@ struct bt_rap {
* centrals cannot evict or receive each other's cached data.
*/
struct ras_ondemand_cache cache;
+
+ /* Serialized real-time segments await transport-paced delivery. */
+ struct queue *realtime_segments;
+ unsigned int realtime_send_id;
+ bool realtime_indicating;
};
static struct queue *rap_db;
@@ -1020,6 +1041,9 @@ static void rap_free(void *data)
rap_db_free(rap->rrapdb);
free(rap->cache.data.iov_base);
+ if (rap->realtime_send_id)
+ timeout_remove(rap->realtime_send_id);
+ queue_destroy(rap->realtime_segments, ras_realtime_segment_free);
if (rap->resptracker) {
free(rap->resptracker->segment_data.iov_base);
@@ -2133,10 +2157,96 @@ static void send_ondemand_segment_data(struct bt_rap *rap, struct ras *ras)
send_ondemand_segment_data_cb(rap);
}
+static bool send_realtime_segment_cb(void *user_data);
+
+static void ras_realtime_segments_clear(struct bt_rap *rap)
+{
+ if (!rap)
+ return;
+
+ if (rap->realtime_send_id) {
+ timeout_remove(rap->realtime_send_id);
+ rap->realtime_send_id = 0;
+ }
+
+ queue_destroy(rap->realtime_segments, ras_realtime_segment_free);
+ rap->realtime_segments = queue_new();
+}
+
+static void realtime_ind_conf_cb(uint8_t opcode, const void *pdu,
+ uint16_t length, void *user_data)
+{
+ struct bt_rap *rap = user_data;
+
+ if (!rap)
+ return;
+
+ rap->realtime_indicating = false;
+ send_realtime_segment_cb(rap);
+}
+
+static bool send_realtime_segment_cb(void *user_data)
+{
+ struct bt_rap *rap = user_data;
+ struct ras *ras = rap && rap->lrapdb ? rap->lrapdb->ras : NULL;
+ struct ras_realtime_segment *segment;
+
+ if (!rap || !ras || !rap->realtime_segments)
+ return false;
+
+ rap->realtime_send_id = 0;
+ if (rap->realtime_indicating || queue_isempty(rap->realtime_segments))
+ return false;
+
+ segment = queue_pop_head(rap->realtime_segments);
+ if (!segment)
+ return false;
+
+ if (ras_data_ccc_use_indication(ras->realtime_ccc_value)) {
+ uint16_t vhandle = gatt_db_attribute_get_handle(
+ gatt_db_attribute_get_value(
+ ras->realtime_chrc));
+ uint8_t *pdu = malloc(2 + segment->len);
+ unsigned int id = 0;
+
+ if (pdu) {
+ put_le16(vhandle, pdu);
+ memcpy(pdu + 2, segment->value, segment->len);
+ id = bt_att_send(bt_rap_get_att(rap),
+ BT_ATT_OP_HANDLE_IND, pdu,
+ 2 + segment->len,
+ realtime_ind_conf_cb, rap, NULL);
+ free(pdu);
+ }
+
+ ras_realtime_segment_free(segment);
+ if (!id) {
+ DBG(rap, "Failed to send real-time indication");
+ return false;
+ }
+
+ rap->realtime_indicating = true;
+ return false;
+ }
+
+ /* Reached whenever the client enabled notifications, so
+ * gatt_db_attribute_notify() picks the notification transport.
+ */
+ if (!gatt_db_attribute_notify(ras->realtime_chrc, segment->value,
+ segment->len, bt_rap_get_att(rap)))
+ DBG(rap, "Failed to send real-time notification");
+ ras_realtime_segment_free(segment);
+
+ if (!queue_isempty(rap->realtime_segments))
+ rap->realtime_send_id = timeout_add(RAS_SEGMENT_NFY_PACE_MS,
+ send_realtime_segment_cb, rap, NULL);
+
+ return false;
+}
+
static void send_ras_segment_data(struct bt_rap *rap,
struct cs_procedure_data *proc)
{
- struct ras *ras;
uint16_t value_max;
const uint16_t header_len = ras_segment_header_size;
uint16_t raw_payload_size;
@@ -2147,7 +2257,6 @@ static void send_ras_segment_data(struct bt_rap *rap,
if (!rap->lrapdb || !rap->lrapdb->ras)
return;
- ras = rap->lrapdb->ras;
value_max = ras_att_value_payload_max(rap);
if (value_max == 0) {
@@ -2171,7 +2280,6 @@ static void send_ras_segment_data(struct bt_rap *rap,
uint16_t seg_len;
uint8_t *seg;
uint16_t wr = 0;
- bool ok = true;
if (index > total_len)
index = total_len;
@@ -2181,25 +2289,16 @@ static void send_ras_segment_data(struct bt_rap *rap,
if (unsent_data_size == 0)
return;
- /* Set last_segment if procedure complete or fits in segment */
- if ((proc->local_status != CS_PROC_PARTIAL_RESULTS &&
- unsent_data_size <= raw_payload_size) ||
- (proc->contains_complete_subevent_ &&
- unsent_data_size <= raw_payload_size)) {
+ /* Only the final completed procedure segment terminates
+ * the stream.
+ */
+ if (proc->local_status != CS_PROC_PARTIAL_RESULTS &&
+ unsent_data_size <= raw_payload_size) {
proc->segmentation_header_.last_segment = 1;
} else {
proc->segmentation_header_.last_segment = 0;
}
- /* Wait for more data if needed and not last segment */
- if (unsent_data_size < raw_payload_size &&
- proc->segmentation_header_.last_segment == 0) {
- DBG(rap, "waiting for more data (unsent=%zu < "
- "payload=%u)", unsent_data_size,
- raw_payload_size);
- return;
- }
-
copy_size = (uint16_t)((unsent_data_size < raw_payload_size) ?
unsent_data_size : raw_payload_size);
seg_len = (uint16_t)(header_len + copy_size);
@@ -2218,39 +2317,26 @@ static void send_ras_segment_data(struct bt_rap *rap,
copy_size);
wr += copy_size;
- /* Try sending to real-time characteristic */
- if (ras->realtime_chrc) {
- if (ras_data_ccc_use_indication(
- ras->realtime_ccc_value))
- ok = gatt_db_attribute_indicate(
- ras->realtime_chrc, seg, wr,
- bt_rap_get_att(rap));
- else
- ok = gatt_db_attribute_notify(
- ras->realtime_chrc, seg, wr,
- bt_rap_get_att(rap));
- }
-
- /* Try sending to on-demand characteristic */
- if (ras->ondemand_chrc && ok) {
- if (ras_data_ccc_use_indication(
- ras->ondemand_ccc_value))
- ok = gatt_db_attribute_indicate(
- ras->ondemand_chrc, seg, wr,
- bt_rap_get_att(rap));
- else
- ok = gatt_db_attribute_notify(
- ras->ondemand_chrc, seg, wr,
- bt_rap_get_att(rap));
- }
+ {
+ struct ras_realtime_segment *segment = new0(
+ struct ras_realtime_segment, 1);
- free(seg);
+ if (!segment || !queue_push_tail(rap->realtime_segments,
+ segment)) {
+ free(segment);
+ free(seg);
+ DBG(rap, "Failed to queue real-time "
+ "RAS segment");
+ return;
+ }
- if (!ok) {
- DBG(rap, "Failed to send RAS notification");
- return;
+ segment->value = seg;
+ segment->len = wr;
}
+ if (!rap->realtime_send_id && !rap->realtime_indicating)
+ send_realtime_segment_cb(rap);
+
/* Advance read cursor and update segmentation state */
proc->ras_raw_data_index_ += copy_size;
proc->segmentation_header_.first_segment = 0;
@@ -2638,7 +2724,12 @@ static void handle_local_subevent_result(struct bt_rap *rap,
struct cs_procedure_data *cur = resptracker->current_proc;
if (has_header_fields && cur->counter != proc_counter) {
- /* Safety: a new procedure; destroy the previous one */
+ /* A new real-time procedure supersedes queued
+ * old ranging data.
+ */
+ if (!ras_is_ondemand_mode(rap->lrapdb->ras))
+ ras_realtime_segments_clear(rap);
+
resptracker_reset_current_proc(resptracker);
}
}
@@ -3247,6 +3338,7 @@ struct bt_rap *bt_rap_new(struct gatt_db *ldb, struct gatt_db *rdb)
rap->pending = queue_new();
rap->ready_cbs = queue_new();
rap->notify = queue_new();
+ rap->realtime_segments = queue_new();
if (!rdb)
goto done;
--
2.43.0
^ permalink raw reply related [flat|nested] 18+ messages in thread* [PATCH v2 10/14] shared/rap: Add requester ranging data subscription API
2026-10-09 9:25 [PATCH v2 00/14] Ranging Profile and Ranging Service PTS fixes Cheng Jiang
` (8 preceding siblings ...)
2026-10-09 9:25 ` [PATCH v2 09/14] shared/rap: Add real-time ranging data delivery on the responder Cheng Jiang
@ 2026-10-09 9:25 ` Cheng Jiang
2026-10-09 9:25 ` [PATCH v2 11/14] profiles/ranging: Expose requester ranging data mode over D-Bus Cheng Jiang
` (4 subsequent siblings)
14 siblings, 0 replies; 18+ messages in thread
From: Cheng Jiang @ 2026-10-09 9:25 UTC (permalink / raw)
To: linux-bluetooth
Cc: jinwang.li, wei.deng, xiuzhuo.shang, shuai.zhang, Cheng Jiang
Give the RAS requester control over how Ranging Data is received from the
peer. bt_rap_set_ranging_data_mode() picks Real-time, On-demand or neither,
together with the CCC value to write on the peer, and
bt_rap_disable_realtime_ranging() drops a Real-time subscription again.
bt_rap_set_ondemand_ranging() selects the mode to use before GATT discovery
has completed.
Setting a mode first unsubscribes whatever is currently subscribed, so the
modes do not stack, and fails when the RAS Features read has not completed
or the peer does not advertise the mode being asked for.
The requested transport applies to the RAS Control Point, Ranging Data
Ready and Ranging Data Overwritten characteristics. On-demand Ranging Data
itself stays on notifications whatever is asked for: it carries the
segmented transfer, and gating each segment on a confirmation would slow a
large one down for no benefit on the receiving side. On-demand mode also
reads Ranging Data Ready once subscribed, to pick up a counter published
before the subscription existed.
Real-time reception is guarded by the deadlines RAP 4.4.1.1 sets for the
Requester: the CCCD is disabled again if no first segment arrives within
5 seconds, or if more than 1 second passes between continuation segments,
so a peer that stops sending does not leave the subscription open.
Assisted-by: Claude:claude-opus-4.8
---
src/shared/rap.c | 275 +++++++++++++++++++++++++++++++++++++++--------
src/shared/rap.h | 23 ++++
2 files changed, 253 insertions(+), 45 deletions(-)
diff --git a/src/shared/rap.c b/src/shared/rap.c
index 6c2196f73..35a7b0980 100644
--- a/src/shared/rap.c
+++ b/src/shared/rap.c
@@ -34,6 +34,7 @@
*/
#define RAS_CP_RESPONSE_TIMEOUT (5 * 1000)
#define RAS_SEGMENT_TIMEOUT (1 * 1000)
+#define RAS_REALTIME_FIRST_SEGMENT_TIMEOUT (5 * 1000)
/* Delay between On-demand ranging-data notification segments, see
* send_ondemand_segment_data_cb().
*/
@@ -471,6 +472,15 @@ struct bt_rap {
* bt_rap_attach() to take effect.
*/
bool ondemand_mode;
+ uint16_t realtime_ccc_value;
+ uint16_t ondemand_ccc_value;
+ unsigned int realtime_notify_id;
+ unsigned int realtime_timeout_id;
+ unsigned int ondemand_notify_id;
+ unsigned int cp_notify_id;
+ unsigned int ready_notify_id;
+ unsigned int overwritten_notify_id;
+ uint32_t ras_features;
/* Responder role: this connection's on-demand ranging data cache.
* Per-connection (not on the shared struct ras) so that concurrent
@@ -958,6 +968,15 @@ void bt_rap_detach(struct bt_rap *rap)
bt_gatt_client_idle_unregister(rap->client, rap->idle_id);
bt_gatt_client_unref(rap->client);
rap->client = NULL;
+ if (rap->realtime_timeout_id) {
+ timeout_remove(rap->realtime_timeout_id);
+ rap->realtime_timeout_id = 0;
+ }
+ rap->realtime_notify_id = 0;
+ rap->ondemand_notify_id = 0;
+ rap->cp_notify_id = 0;
+ rap->ready_notify_id = 0;
+ rap->overwritten_notify_id = 0;
bt_att_unregister_disconnect(rap->att, rap->disconn_id);
rap->att = NULL;
@@ -3427,6 +3446,7 @@ static void rap_notify_destroy(void *data)
static unsigned int bt_rap_register_notify(struct bt_rap *rap,
uint16_t value_handle,
+ uint16_t ccc_value,
rap_notify_t func,
void *user_data)
{
@@ -3439,7 +3459,13 @@ static unsigned int bt_rap_register_notify(struct bt_rap *rap,
DBG(rap, "register for notifications");
- notify->id = bt_gatt_client_register_notify(rap->client,
+ if (ccc_value)
+ notify->id = bt_gatt_client_register_notify_with_ccc(
+ rap->client, value_handle, ccc_value,
+ ras_register, rap_notify, notify,
+ rap_notify_destroy);
+ else
+ notify->id = bt_gatt_client_register_notify(rap->client,
value_handle, ras_register,
rap_notify, notify,
rap_notify_destroy);
@@ -3454,6 +3480,85 @@ static unsigned int bt_rap_register_notify(struct bt_rap *rap,
return notify->id;
}
+bool bt_rap_disable_realtime_ranging(struct bt_rap *rap)
+{
+ unsigned int notify_id;
+
+ if (!rap || !rap->client)
+ return false;
+
+ if (rap->realtime_timeout_id) {
+ timeout_remove(rap->realtime_timeout_id);
+ rap->realtime_timeout_id = 0;
+ }
+
+ if (!rap->realtime_notify_id)
+ return true;
+
+ notify_id = rap->realtime_notify_id;
+ rap->realtime_notify_id = 0;
+
+ return bt_gatt_client_unregister_notify(rap->client, notify_id);
+}
+
+static bool ras_realtime_timeout_cb(void *user_data)
+{
+ struct bt_rap *rap = user_data;
+
+ rap->realtime_timeout_id = 0;
+ DBG(rap, "Real-time Ranging Data segment timeout; disabling CCCD");
+ bt_rap_disable_realtime_ranging(rap);
+
+ return false;
+}
+
+static void ras_realtime_arm_timeout(struct bt_rap *rap, unsigned int timeout)
+{
+ if (rap->realtime_timeout_id)
+ timeout_remove(rap->realtime_timeout_id);
+
+ rap->realtime_timeout_id = timeout_add(timeout, ras_realtime_timeout_cb,
+ rap, NULL);
+}
+
+static void ras_realtime_cancel_timeout(struct bt_rap *rap)
+{
+ if (!rap->realtime_timeout_id)
+ return;
+
+ timeout_remove(rap->realtime_timeout_id);
+ rap->realtime_timeout_id = 0;
+}
+
+static bool bt_rap_unregister_notify(struct bt_rap *rap, unsigned int *id)
+{
+ unsigned int notify_id;
+
+ if (!*id)
+ return true;
+
+ notify_id = *id;
+ *id = 0;
+ return bt_gatt_client_unregister_notify(rap->client, notify_id);
+}
+
+static bool bt_rap_disable_ranging_data(struct bt_rap *rap)
+{
+ bool success = true;
+
+ if (!rap || !rap->client)
+ return false;
+
+ ras_realtime_cancel_timeout(rap);
+
+ success &= bt_rap_unregister_notify(rap, &rap->realtime_notify_id);
+ success &= bt_rap_unregister_notify(rap, &rap->ondemand_notify_id);
+ success &= bt_rap_unregister_notify(rap, &rap->cp_notify_id);
+ success &= bt_rap_unregister_notify(rap, &rap->ready_notify_id);
+ success &= bt_rap_unregister_notify(rap, &rap->overwritten_notify_id);
+ return success;
+}
+
static void ras_ondemand_client_reset(struct ras *ras)
{
if (!ras)
@@ -4190,12 +4295,22 @@ static void ras_segment_notify_cb(struct bt_rap *rap, uint16_t value_handle,
{
const char *label = user_data ? user_data : "real-time";
struct ras *ras = rap_get_ras(rap);
+ struct iovec iov = { .iov_base = (void *)value, .iov_len = length };
+ struct segmentation_header seg_hdr;
+ bool realtime = !strcmp(label, "real-time");
DBG(rap, "Received %s notification: handle=0x%04x len=%u",
label, value_handle, length);
ras_reassemble_segment_notify(rap, value, length);
+ if (realtime && parse_segmentation_header(&iov, &seg_hdr)) {
+ if (seg_hdr.last_segment)
+ ras_realtime_cancel_timeout(rap);
+ else
+ ras_realtime_arm_timeout(rap, RAS_SEGMENT_TIMEOUT);
+ }
+
if (ras && ras->client.pending_op == RAS_CP_PENDING_GET)
ras_cp_arm_segment_timeout(rap, ras);
}
@@ -4340,7 +4455,9 @@ static void ras_cp_response_notify_cb(struct bt_rap *rap,
*/
static void rap_subscribe_ondemand_chrc(struct bt_rap *rap,
struct gatt_db_attribute *chrc,
- rap_notify_t func, const char *name)
+ uint16_t ccc_value, rap_notify_t func,
+ const char *name,
+ unsigned int *notify_id_out)
{
uint16_t value_handle;
unsigned int notify_id;
@@ -4356,13 +4473,118 @@ static void rap_subscribe_ondemand_chrc(struct bt_rap *rap,
return;
}
- notify_id = bt_rap_register_notify(rap, value_handle, func,
+ notify_id = bt_rap_register_notify(rap, value_handle, ccc_value, func,
(void *)name);
if (!notify_id)
DBG(rap, "Failed to register for %s notifications", name);
else
DBG(rap, "Registered for %s notifications: id=%u", name,
notify_id);
+
+ if (notify_id_out)
+ *notify_id_out = notify_id;
+}
+
+static void ras_data_ready_read_complete(struct bt_rap *rap, bool success,
+ uint8_t att_ecode, const uint8_t *value,
+ uint16_t length, void *user_data)
+{
+ if (!success) {
+ DBG(rap, "Unable to read Ranging Data Ready: error 0x%02x",
+ att_ecode);
+ return;
+ }
+
+ /* This read only synchronizes the characteristic as required by RAS.
+ * A Ready notification, not its current value, starts a retrieval.
+ */
+ DBG(rap, "Read Ranging Data Ready (%u bytes)", length);
+}
+
+static bool rap_subscribe_ranging_data(struct bt_rap *rap,
+ enum bt_rap_ranging_data_mode mode)
+{
+ struct ras *ras = rap_get_ras(rap);
+
+ if (!ras || !rap->client)
+ return false;
+
+ if (mode == BT_RAP_RANGING_DATA_REALTIME) {
+ uint16_t value_handle;
+
+ if (!(rap->ras_features & 0x01) || !ras->realtime_chrc ||
+ !gatt_db_attribute_get_char_data(ras->realtime_chrc,
+ NULL, &value_handle,
+ NULL, NULL, NULL))
+ return false;
+
+ rap->realtime_notify_id = bt_rap_register_notify(rap,
+ value_handle, rap->realtime_ccc_value,
+ ras_segment_notify_cb, "real-time");
+ if (rap->realtime_notify_id)
+ ras_realtime_arm_timeout(rap,
+ RAS_REALTIME_FIRST_SEGMENT_TIMEOUT);
+ return rap->realtime_notify_id != 0;
+ }
+
+ if (mode == BT_RAP_RANGING_DATA_ONDEMAND) {
+ uint16_t value_handle;
+
+ /* Data is segmented and can be large, so keep it on
+ * notifications. The control and status characteristics use
+ * the requested transport.
+ */
+ rap_subscribe_ondemand_chrc(rap, ras->ondemand_chrc,
+ BT_RAP_RANGING_NOTIFY, ras_segment_notify_cb,
+ "on-demand", &rap->ondemand_notify_id);
+ rap_subscribe_ondemand_chrc(rap, ras->cp_chrc,
+ rap->ondemand_ccc_value, ras_cp_response_notify_cb,
+ "RAS Control Point", &rap->cp_notify_id);
+ rap_subscribe_ondemand_chrc(rap, ras->ready_chrc,
+ rap->ondemand_ccc_value, ras_data_ready_notify_cb,
+ "Ranging Data Ready", &rap->ready_notify_id);
+ rap_subscribe_ondemand_chrc(rap, ras->overwritten_chrc,
+ rap->ondemand_ccc_value,
+ ras_data_overwritten_notify_cb,
+ "Ranging Data Overwritten",
+ &rap->overwritten_notify_id);
+ if (ras->ready_chrc &&
+ gatt_db_attribute_get_char_data(ras->ready_chrc, NULL,
+ &value_handle, NULL, NULL,
+ NULL))
+ rap_read_value(rap, value_handle,
+ ras_data_ready_read_complete, NULL);
+ return rap->ondemand_notify_id || rap->cp_notify_id ||
+ rap->ready_notify_id || rap->overwritten_notify_id;
+ }
+
+ return true;
+}
+
+bool bt_rap_set_ranging_data_mode(struct bt_rap *rap,
+ enum bt_rap_ranging_data_mode mode,
+ enum bt_rap_ranging_transport transport)
+{
+ if (!rap || !rap->client || !rap->ras_features)
+ return false;
+
+ if (mode == BT_RAP_RANGING_DATA_REALTIME &&
+ transport != BT_RAP_RANGING_NOTIFY &&
+ transport != BT_RAP_RANGING_INDICATE)
+ return false;
+
+ if (mode == BT_RAP_RANGING_DATA_ONDEMAND &&
+ transport != BT_RAP_RANGING_NOTIFY &&
+ transport != BT_RAP_RANGING_INDICATE)
+ return false;
+
+ if (!bt_rap_disable_ranging_data(rap))
+ return false;
+
+ rap->realtime_ccc_value = transport;
+ rap->ondemand_ccc_value = transport;
+
+ return rap_subscribe_ranging_data(rap, mode);
}
static void read_ras_features(struct bt_rap *rap, bool success,
@@ -4410,6 +4632,7 @@ static void read_ras_features(struct bt_rap *rap, bool success,
abort_operation = (features & 0x04) != 0;
if (ras)
ras->client.abort_operation = abort_operation;
+ rap->ras_features = features;
DBG(rap, "RAS Features - Real-time: %s, Retrieve Lost: %s, Abort: %s",
supports_realtime ? "Yes" : "No",
@@ -4423,48 +4646,10 @@ static void read_ras_features(struct bt_rap *rap, bool success,
return;
}
- if (!rap->ondemand_mode) {
- /* Register for real-time characteristic notifications */
- if (supports_realtime && ras->realtime_chrc) {
- uint16_t value_handle;
-
- if (gatt_db_attribute_get_char_data(ras->realtime_chrc,
- NULL, &value_handle,
- NULL, NULL, NULL)) {
- unsigned int notify_id;
-
- notify_id = bt_rap_register_notify(rap,
- value_handle,
- ras_segment_notify_cb,
- "real-time");
- if (!notify_id)
- DBG(rap, "Failed to register for "
- "real-time notifications");
- else
- DBG(rap, "Registered for real-time "
- "features: id=%u", notify_id);
- }
- }
-
- return;
- }
-
- /* On-demand mode: subscribe to each on-demand characteristic
- * independently so a partially-capable peer doesn't block the
- * others.
- */
- rap_subscribe_ondemand_chrc(rap, ras->ondemand_chrc,
- ras_segment_notify_cb,
- "on-demand");
- rap_subscribe_ondemand_chrc(rap, ras->cp_chrc,
- ras_cp_response_notify_cb,
- "RAS Control Point");
- rap_subscribe_ondemand_chrc(rap, ras->ready_chrc,
- ras_data_ready_notify_cb,
- "Ranging Data Ready");
- rap_subscribe_ondemand_chrc(rap, ras->overwritten_chrc,
- ras_data_overwritten_notify_cb,
- "Ranging Data Overwritten");
+ if (!rap_subscribe_ranging_data(rap, rap->ondemand_mode ?
+ BT_RAP_RANGING_DATA_ONDEMAND :
+ BT_RAP_RANGING_DATA_REALTIME))
+ DBG(rap, "Failed to subscribe to requested Ranging Data mode");
}
static void foreach_rap_char(struct gatt_db_attribute *attr, void *user_data)
diff --git a/src/shared/rap.h b/src/shared/rap.h
index 9ab577710..af4fab057 100644
--- a/src/shared/rap.h
+++ b/src/shared/rap.h
@@ -303,3 +303,26 @@ void bt_rap_set_conn_interval(struct bt_rap *rap, uint16_t conn_interval);
* GATT discovery to completion to take effect.
*/
bool bt_rap_set_ondemand_ranging(struct bt_rap *rap, bool enable);
+
+enum bt_rap_ranging_data_mode {
+ BT_RAP_RANGING_DATA_DISABLED,
+ BT_RAP_RANGING_DATA_REALTIME,
+ BT_RAP_RANGING_DATA_ONDEMAND,
+};
+
+enum bt_rap_ranging_transport {
+ BT_RAP_RANGING_NOTIFY = 0x0001,
+ BT_RAP_RANGING_INDICATE = 0x0002,
+};
+
+/* Select the Requester's received Ranging Data subscription. This can only
+ * be called after remote RAS discovery and Features read complete.
+ */
+bool bt_rap_set_ranging_data_mode(struct bt_rap *rap,
+ enum bt_rap_ranging_data_mode mode,
+ enum bt_rap_ranging_transport transport);
+
+/* Initiator role: stop receiving Real-time Ranging Data. The GATT client
+ * disables the characteristic CCCD when this is its final subscription.
+ */
+bool bt_rap_disable_realtime_ranging(struct bt_rap *rap);
--
2.43.0
^ permalink raw reply related [flat|nested] 18+ messages in thread* [PATCH v2 11/14] profiles/ranging: Expose requester ranging data mode over D-Bus
2026-10-09 9:25 [PATCH v2 00/14] Ranging Profile and Ranging Service PTS fixes Cheng Jiang
` (9 preceding siblings ...)
2026-10-09 9:25 ` [PATCH v2 10/14] shared/rap: Add requester ranging data subscription API Cheng Jiang
@ 2026-10-09 9:25 ` Cheng Jiang
2026-10-09 9:25 ` [PATCH v2 12/14] client: Add Channel Sounding ranging data mode control Cheng Jiang
` (3 subsequent siblings)
14 siblings, 0 replies; 18+ messages in thread
From: Cheng Jiang @ 2026-10-09 9:25 UTC (permalink / raw)
To: linux-bluetooth
Cc: jinwang.li, wei.deng, xiuzhuo.shang, shuai.zhang, Cheng Jiang
Add a SetRangingDataMode method to the Channel Sounding interface so a
client can select how Ranging Data is received from the peer (Real-time
or On-demand) and the CCCD transport to use, wiring through to
bt_rap_set_ranging_data_mode().
When a measurement stops, disable the Real-time Ranging Data
subscription so the peer receives the CCCD disable that the requester
owns.
Assisted-by: Claude:claude-opus-4.8
---
profiles/ranging/rap.c | 36 ++++++++++++++++++++++++++++++++++++
1 file changed, 36 insertions(+)
diff --git a/profiles/ranging/rap.c b/profiles/ranging/rap.c
index 0fffd3e03..6152da910 100644
--- a/profiles/ranging/rap.c
+++ b/profiles/ranging/rap.c
@@ -876,6 +876,14 @@ static DBusMessage *stop_measurement(DBusConnection *conn,
bt_rap_hci_set_procedure_data_cb(data->hci_sm, NULL, NULL, NULL);
+ /* The Requester owns the Real-time CCCD subscription. Unregister it
+ * when the procedure ends so the peer receives the required CCCD
+ * disable.
+ */
+ if (!bt_rap_disable_realtime_ranging(data->rap))
+ return g_dbus_create_error(msg, DBUS_ERROR_FAILED,
+ "Disable Real-time Ranging Data failed");
+
memset(&data->active_session, 0, sizeof(data->active_session));
g_dbus_emit_property_changed(btd_get_dbus_connection(),
@@ -885,6 +893,30 @@ static DBusMessage *stop_measurement(DBusConnection *conn,
return dbus_message_new_method_return(msg);
}
+static DBusMessage *set_ranging_data_mode(DBusConnection *conn,
+ DBusMessage *msg, void *user_data)
+{
+ struct rap_data *data = user_data;
+ uint8_t mode;
+ uint8_t transport;
+
+ if (!dbus_message_get_args(msg, NULL, DBUS_TYPE_BYTE, &mode,
+ DBUS_TYPE_BYTE, &transport,
+ DBUS_TYPE_INVALID))
+ return g_dbus_create_error(msg, DBUS_ERROR_INVALID_ARGS,
+ "Expected Ranging Data mode byte");
+
+ if (mode > BT_RAP_RANGING_DATA_ONDEMAND)
+ return g_dbus_create_error(msg, DBUS_ERROR_INVALID_ARGS,
+ "Invalid Ranging Data mode");
+
+ if (!bt_rap_set_ranging_data_mode(data->rap, mode, transport))
+ return g_dbus_create_error(msg, DBUS_ERROR_FAILED,
+ "Set Ranging Data mode failed");
+
+ return dbus_message_new_method_return(msg);
+}
+
static const GDBusMethodTable cs_dbus_methods[] = {
{ GDBUS_METHOD("StartMeasurement",
GDBUS_ARGS({ "params", "a{sv}" }),
@@ -894,6 +926,10 @@ static const GDBusMethodTable cs_dbus_methods[] = {
NULL,
NULL,
stop_measurement) },
+ { GDBUS_METHOD("SetRangingDataMode",
+ GDBUS_ARGS({ "mode", "y" }, { "transport", "y" }),
+ NULL,
+ set_ranging_data_mode) },
{ }
};
--
2.43.0
^ permalink raw reply related [flat|nested] 18+ messages in thread* [PATCH v2 12/14] client: Add Channel Sounding ranging data mode control
2026-10-09 9:25 [PATCH v2 00/14] Ranging Profile and Ranging Service PTS fixes Cheng Jiang
` (10 preceding siblings ...)
2026-10-09 9:25 ` [PATCH v2 11/14] profiles/ranging: Expose requester ranging data mode over D-Bus Cheng Jiang
@ 2026-10-09 9:25 ` Cheng Jiang
2026-10-09 9:25 ` [PATCH v2 13/14] doc: Document " Cheng Jiang
` (2 subsequent siblings)
14 siblings, 0 replies; 18+ messages in thread
From: Cheng Jiang @ 2026-10-09 9:25 UTC (permalink / raw)
To: linux-bluetooth
Cc: jinwang.li, wei.deng, xiuzhuo.shang, shuai.zhang, Cheng Jiang
Add a "ranging-data-mode" command to the Channel Sounding submenu that
selects how Ranging Data is received from a peer (disabled, real-time or
on-demand) and the CCCD transport (notify or indicate), invoking the
ChannelSounding1.SetRangingDataMode method on the device.
Add an advertising helper so the Responder can advertise the Ranging
Service UUID for discovery, together with a getter for the default
LEAdvertisingManager proxy it needs.
Assisted-by: Claude:claude-opus-4.8
---
client/cs.c | 87 +++++++++++++++++++++++++++++++++++++++++++++++++++++
1 file changed, 87 insertions(+)
diff --git a/client/cs.c b/client/cs.c
index 7533d053b..4c181e743 100644
--- a/client/cs.c
+++ b/client/cs.c
@@ -1429,6 +1429,89 @@ static void cmd_cs_stop(int argc, char *argv[])
bt_shell_printf("Failed to send StopMeasurement\n");
}
+/* ---- ranging-data-mode ---- */
+
+static void ranging_data_mode_setup(DBusMessageIter *iter, void *user_data)
+{
+ uint16_t values = PTR_TO_UINT(user_data);
+ uint8_t mode = values & 0xff;
+ uint8_t transport = values >> 8;
+
+ dbus_message_iter_append_basic(iter, DBUS_TYPE_BYTE, &mode);
+ dbus_message_iter_append_basic(iter, DBUS_TYPE_BYTE, &transport);
+}
+
+static void ranging_data_mode_reply(DBusMessage *message, void *user_data)
+{
+ DBusError error;
+
+ dbus_error_init(&error);
+ if (dbus_set_error_from_message(&error, message)) {
+ bt_shell_printf("SetRangingDataMode failed: %s\n",
+ error.message);
+ dbus_error_free(&error);
+ return;
+ }
+
+ bt_shell_printf("Ranging Data mode updated\n");
+}
+
+static void cmd_cs_ranging_data_mode(int argc, char *argv[])
+{
+ const char *dev_path;
+ GDBusProxy *proxy;
+ uint8_t mode;
+ uint8_t transport = 0x01;
+
+ if (argc < 3 || argc > 4) {
+ bt_shell_printf("Usage: ranging-data-mode <dev_addr>"
+ " <disabled/realtime/ondemand> [notify/indicate]\n");
+ return;
+ }
+
+ if (!strcmp(argv[2], "disabled"))
+ mode = 0x00;
+ else if (!strcmp(argv[2], "realtime"))
+ mode = 0x01;
+ else if (!strcmp(argv[2], "ondemand"))
+ mode = 0x02;
+ else {
+ bt_shell_printf("Invalid Ranging Data mode: %s\n", argv[2]);
+ return;
+ }
+
+ if (argc == 4) {
+ if (!strcmp(argv[3], "notify"))
+ transport = 0x01;
+ else if (!strcmp(argv[3], "indicate"))
+ transport = 0x02;
+ else {
+ bt_shell_printf("Invalid Ranging Data transport: "
+ "%s\n", argv[3]);
+ return;
+ }
+ }
+
+ dev_path = cs_resolve_address(argv[1]);
+ if (!dev_path) {
+ bt_shell_printf("Device %s not found\n", argv[1]);
+ return;
+ }
+
+ proxy = cs_find_proxy(dev_path);
+ if (!proxy) {
+ bt_shell_printf("No ChannelSounding1 interface for that "
+ "device\n");
+ return;
+ }
+
+ if (!g_dbus_proxy_method_call(proxy, "SetRangingDataMode",
+ ranging_data_mode_setup,
+ ranging_data_mode_reply,
+ UINT_TO_PTR(mode | (transport << 8)), NULL))
+ bt_shell_printf("Failed to send SetRangingDataMode\n");
+}
+
/* ---- show ---- */
static void cmd_cs_show(int argc, char *argv[])
@@ -1545,6 +1628,10 @@ static const struct bt_shell_menu cs_menu = {
cmd_cs_stop,
"Stop the active distance measurement;"
" address required when multiple are active" },
+ { "ranging-data-mode",
+ "<dev_addr> <disabled/realtime/ondemand> [notify/indicate]",
+ cmd_cs_ranging_data_mode,
+ "Set RAP Requester Ranging Data subscription mode" },
{ "show", NULL,
cmd_cs_show,
"Show active session id and current"
--
2.43.0
^ permalink raw reply related [flat|nested] 18+ messages in thread* [PATCH v2 13/14] doc: Document Channel Sounding ranging data mode control
2026-10-09 9:25 [PATCH v2 00/14] Ranging Profile and Ranging Service PTS fixes Cheng Jiang
` (11 preceding siblings ...)
2026-10-09 9:25 ` [PATCH v2 12/14] client: Add Channel Sounding ranging data mode control Cheng Jiang
@ 2026-10-09 9:25 ` Cheng Jiang
2026-10-09 9:25 ` [PATCH v2 14/14] doc/qualification: Add RAP/RAS PTS qualification results Cheng Jiang
2026-10-09 17:20 ` [PATCH v2 00/14] Ranging Profile and Ranging Service PTS fixes patchwork-bot+bluetooth
14 siblings, 0 replies; 18+ messages in thread
From: Cheng Jiang @ 2026-10-09 9:25 UTC (permalink / raw)
To: linux-bluetooth
Cc: jinwang.li, wei.deng, xiuzhuo.shang, shuai.zhang, Cheng Jiang
Document the ChannelSounding1.SetRangingDataMode method and the
bluetoothctl "ranging-data-mode" and "advertise-rangeservice" commands
added for RAP Requester and Responder control.
Assisted-by: Claude:claude-opus-4.8
---
doc/bluetoothctl-cs.rst | 24 ++++++++++++++++++++++
doc/org.bluez.ChannelSounding1.rst | 32 ++++++++++++++++++++++++++++++
2 files changed, 56 insertions(+)
diff --git a/doc/bluetoothctl-cs.rst b/doc/bluetoothctl-cs.rst
index c3d67fd2d..eecf4bfe4 100644
--- a/doc/bluetoothctl-cs.rst
+++ b/doc/bluetoothctl-cs.rst
@@ -103,6 +103,30 @@ are active the address is required to identify which one to stop.
:Example Stop a second device:
| **> stop 11:22:33:44:55:66**
+ranging-data-mode
+-----------------
+
+Controls the RAP Requester's received Ranging Data subscriptions independently
+of the local CS measurement lifecycle. Changing the mode disables the current
+RAS data CCCDs before enabling the requested mode.
+
+:Usage: **> ranging-data-mode <dev_addr> <disabled/realtime/ondemand> [notify/indicate]**
+:Uses: **org.bluez.ChannelSounding1(5)** method **SetRangingDataMode**
+:disabled: Disables all Ranging Data subscriptions.
+:realtime: Enables Real-time Ranging Data; transport defaults to ``notify``.
+:ondemand: Enables On-demand Data, Control Point, Ready, and Overwritten;
+ transport defaults to ``notify``. On-demand Data remains notification-based
+ so segmented transfers are not limited by indication confirmation pacing.
+:notify: Uses CCCD ``0x0001`` for the selected Ranging Data mode.
+:indicate: Uses CCCD ``0x0002`` for the selected Ranging Data mode.
+
+:Example Disable Ranging Data reception:
+ | **> ranging-data-mode AA:BB:CC:DD:EE:FF disabled**
+:Example Enable Real-time indications:
+ | **> ranging-data-mode AA:BB:CC:DD:EE:FF realtime indicate**
+:Example Enable On-demand indications:
+ | **> ranging-data-mode AA:BB:CC:DD:EE:FF ondemand indicate**
+
show
----
diff --git a/doc/org.bluez.ChannelSounding1.rst b/doc/org.bluez.ChannelSounding1.rst
index 95d6bc7b2..32c83e36f 100644
--- a/doc/org.bluez.ChannelSounding1.rst
+++ b/doc/org.bluez.ChannelSounding1.rst
@@ -258,6 +258,38 @@ Examples:
:bluetoothctl stop a specific device when multiple are active:
| [cs] > stop AA:BB:CC:DD:EE:FF
+void SetRangingDataMode(byte mode, byte transport)
+``````````````````````````````````````````````````
+
+Selects the RAP Requester's received Ranging Data subscription after remote
+RAS discovery has completed. This is independent of the local Channel Sounding
+measurement lifecycle. Changing mode first disables all current Ranging Data
+CCCD subscriptions, then enables the selected mode.
+
+``mode`` values:
+
+:0x00: Disabled. Stop receiving Ranging Data and disable all RAS data CCCDs.
+:0x01: Real-time. Enable the Real-time Ranging Data CCCD.
+:0x02: On-demand. Enable On-demand Data, Control Point, Ready, and Overwritten
+ CCCDs.
+
+``transport`` selects the CCCD value for Real-time or On-demand mode. It is
+ignored for Disabled mode. Use ``0x01`` for notifications or ``0x02`` for
+indications. For On-demand mode, this applies to Control Point, Ready, and
+Overwritten; segmented On-demand Data always uses notifications.
+
+Raises ``org.bluez.Error.Failed`` when remote RAS discovery and Features read
+have not completed, or the selected mode is unsupported by the peer.
+
+Example:
+
+:bluetoothctl disable Real-time Ranging Data:
+ | [cs] > ranging-data-mode AA:BB:CC:DD:EE:FF disabled
+:bluetoothctl enable Real-time indications:
+ | [cs] > ranging-data-mode AA:BB:CC:DD:EE:FF realtime indicate
+:bluetoothctl enable On-demand indications:
+ | [cs] > ranging-data-mode AA:BB:CC:DD:EE:FF ondemand indicate
+
Signals
-------
--
2.43.0
^ permalink raw reply related [flat|nested] 18+ messages in thread* [PATCH v2 14/14] doc/qualification: Add RAP/RAS PTS qualification results
2026-10-09 9:25 [PATCH v2 00/14] Ranging Profile and Ranging Service PTS fixes Cheng Jiang
` (12 preceding siblings ...)
2026-10-09 9:25 ` [PATCH v2 13/14] doc: Document " Cheng Jiang
@ 2026-10-09 9:25 ` Cheng Jiang
2026-10-09 17:20 ` [PATCH v2 00/14] Ranging Profile and Ranging Service PTS fixes patchwork-bot+bluetooth
14 siblings, 0 replies; 18+ messages in thread
From: Cheng Jiang @ 2026-10-09 9:25 UTC (permalink / raw)
To: linux-bluetooth
Cc: jinwang.li, wei.deng, xiuzhuo.shang, shuai.zhang, Cheng Jiang
Record the PTS results for the Ranging Profile and the Ranging Service.
Both are split per case prefix, as the other qualification documents are:
rap-pts.rst keeps the 19 RAP Requester and Responder cases, and the new
ras-pts.rst carries the 31 RAS Server cases.
Every case is listed on its own row rather than collapsed into a range, so
the file states which cases were actually run. RAS/SR/SPE/BI-02-C is
listed as not applicable: RAS.TS Table 5.1 selects it only when Abort
Operation is unsupported (NOT RAS 3/4), and the IUT supports it, so
RAS/SR/RCP/BV-03-C and RAS/SR/SPE/BI-05-C cover that path instead.
ras-pts.rst also records which transport the server must pick when a
client enables both notifications and indications, since the rule differs
per characteristic and each variant has its own case.
Assisted-by: Claude:claude-opus-4.8
---
doc/qualification/rap-pts.rst | 180 ++++++++++++++++++++++++++++++++++
doc/qualification/ras-pts.rst | 135 +++++++++++++++++++++++++
2 files changed, 315 insertions(+)
create mode 100644 doc/qualification/rap-pts.rst
create mode 100644 doc/qualification/ras-pts.rst
diff --git a/doc/qualification/rap-pts.rst b/doc/qualification/rap-pts.rst
new file mode 100644
index 000000000..a2647f701
--- /dev/null
+++ b/doc/qualification/rap-pts.rst
@@ -0,0 +1,180 @@
+.. SPDX-License-Identifier: GPL-2.0-or-later
+.. Copyright © 2026 Qualcomm Technologies, Inc.
+
+================
+RAP test results
+================
+
+:PTS version: 8.14.0.4
+:BlueZ: 5.87 with Channel Sounding support
+
+RAS Server test results are in ``ras-pts.rst``.
+
+Setup
+=====
+
+- Enable ``Experimental = true`` in ``/etc/bluetooth/main.conf``.
+- Use a ``NoInputNoOutput`` bluetoothctl agent and make it the default agent.
+- Before cases that establish a new encrypted link, delete the DUT bond and the
+ corresponding PTS LTK/bond. Removing only one side causes authentication
+ failure.
+- Do not use the bluetoothctl ``gatt`` menu to write RAS CCCDs. Use the
+ ``cs ranging-data-mode`` command so RAP owns subscription lifetime.
+
+Requester results
+=================
+
++----------------------------+----------+--------------------------------------------------------------------------+
+| Test name | Result | Notes |
++============================+==========+==========================================================================+
+| RAP/REQ/RRD/BV-01-C | PASS | Configure the requested Real-time notification or indication transport. |
++----------------------------+----------+--------------------------------------------------------------------------+
+| RAP/REQ/RRD/BI-01-C | PASS | The Requester disables the Real-time CCCD after 5 seconds without a |
+| | | first segment. |
++----------------------------+----------+--------------------------------------------------------------------------+
+| RAP/REQ/RRD/BI-02-C | PASS | The Requester disables the Real-time CCCD after 1 second without a |
+| | | continuation segment. |
++----------------------------+----------+--------------------------------------------------------------------------+
+| RAP/REQ/CGGIT/SER/BV-01-C | PASS | Discover the remote primary Ranging Service. |
++----------------------------+----------+--------------------------------------------------------------------------+
+| RAP/REQ/CGGIT/CHA/BV-01-C | PASS | Discover the RAS Features characteristic. |
++----------------------------+----------+--------------------------------------------------------------------------+
+| RAP/REQ/CGGIT/CHA/BV-02-C | PASS | Discover the Real-time Ranging Data characteristic. |
++----------------------------+----------+--------------------------------------------------------------------------+
+| RAP/REQ/CGGIT/CHA/BV-03-C | PASS | Discover the On-demand Ranging Data characteristic. |
++----------------------------+----------+--------------------------------------------------------------------------+
+| RAP/REQ/CGGIT/CHA/BV-04-C | PASS | Discover the RAS Control Point characteristic. |
++----------------------------+----------+--------------------------------------------------------------------------+
+| RAP/REQ/CGGIT/CHA/BV-05-C | PASS | Discover the Ranging Data Ready characteristic. |
++----------------------------+----------+--------------------------------------------------------------------------+
+| RAP/REQ/CGGIT/CHA/BV-06-C | PASS | Discover the Ranging Data Overwritten characteristic. |
++----------------------------+----------+--------------------------------------------------------------------------+
+| RAP/REQ/ORD/BV-01-C | PASS | See the On-demand ranging data procedures below. |
++----------------------------+----------+--------------------------------------------------------------------------+
+| RAP/REQ/ORD/BI-01-C | PASS | The Requester sends Abort Operation after 5 seconds without the first |
+| | | On-demand segment. |
++----------------------------+----------+--------------------------------------------------------------------------+
+| RAP/REQ/ORD/BI-02-C | PASS | The Requester sends Abort Operation when a continuation segment is |
+| | | missing for more than one second. |
++----------------------------+----------+--------------------------------------------------------------------------+
+| RAP/REQ/ORD/BI-03-C | PASS | Ignore Complete Lost and RFU Control Point responses; receive normal |
+| | | data and ACK the subsequent Complete response. |
++----------------------------+----------+--------------------------------------------------------------------------+
+| RAP/REQ/ORD/BV-05-C | PASS | Configure On-demand notification transport; PTS validates Ranging Data |
+| | | Ready notification handling. |
++----------------------------+----------+--------------------------------------------------------------------------+
+| RAP/REQ/ORD/BV-06-C | PASS | On the PTS MMI, promptly read Ranging Data Ready after PTS suppresses |
+| | | its notification. |
++----------------------------+----------+--------------------------------------------------------------------------+
+| RAP/REQ/ORD/BV-07-C | PASS | Configure On-demand indication transport; PTS validates Ranging Data |
+| | | Overwritten indication reception. |
++----------------------------+----------+--------------------------------------------------------------------------+
+| RAP/REQ/ORD/BV-08-C | PASS | Configure On-demand notification transport; PTS validates Ranging Data |
+| | | Overwritten notification reception. |
++----------------------------+----------+--------------------------------------------------------------------------+
+
+Responder results
+=================
+
++----------------------------+----------+--------------------------------------------------------------------------+
+| Test name | Result | Notes |
++============================+==========+==========================================================================+
+| RAP/RES/RSPF/BV-01-C | PASS | Discoverable advertising includes the Ranging Service UUID (0x185B). |
++----------------------------+----------+--------------------------------------------------------------------------+
+
+
+Before ``RAP/RES/RSPF/BV-01-C``, advertise the Ranging Service UUID so PTS can
+discover the Responder::
+
+ menu advertise
+ uuids 0000185b-0000-1000-8000-00805f9b34fb
+ back
+ advertise peripheral
+
+Stop it after the case with ``advertise off``.
+
+On-demand ranging data procedures
+=================================
+
+Some RAS Requester cases are exercised against PTS's SIG pre-generated ranging
+data (``TSPX_test_method``) when the PTS controller does not support Channel
+Sounding. The procedures below use the ``ranging-data-mode`` command to select
+the transport PTS expects for each case.
+
+For ``RAP/REQ/ORD/BV-01-C``, set ``TSPX_test_method`` to ``pre-generated
+ranging data`` and select the ``2_procedures`` input.
+
+After connection, pairing, and encryption complete, run the following in the
+same bluetoothctl session::
+
+ menu cs
+ ranging-data-mode <pts_addr> ondemand indicate
+
+This configures indications for Ranging Data Ready, RAS Control Point, and
+Ranging Data Overwritten. Segmented On-demand Ranging Data remains configured
+for notifications so large pre-generated streams are not stalled by
+per-indication confirmation pacing.
+
+The Requester reads the Ranging Data Ready characteristic, waits for the PTS
+Ready indication, writes ``Get Ranging Data``, reassembles the data, and writes
+``ACK Ranging Data`` after the PTS Complete response.
+
+For ``RAP/REQ/ORD/BI-01-C``, use the same setup but configure PTS not to send
+the first On-demand segment after ``Get Ranging Data``. The Requester writes
+``Abort Operation`` after five seconds. For ``RAP/REQ/ORD/BI-02-C``, have PTS
+send only First Segment; the Requester's one-second continuation watchdog
+sends Abort within the PTS assertion window.
+
+For ``RAP/REQ/ORD/BI-03-C``, use the same setup and allow PTS to inject
+Complete Lost Ranging Data Segments and RFU Control Point responses during the
+transfer. No additional DUT action is required: the Requester ignores them,
+then ACKs the normal Complete Ranging Data response.
+
+For ``RAP/REQ/ORD/BV-05-C``, select notification transport after security is
+complete::
+
+ menu cs
+ ranging-data-mode <pts_addr> ondemand notify
+
+This configures the Ranging Data Ready path for the PTS notification round.
+
+For ``RAP/REQ/ORD/BV-07-C``, select indication transport to receive the
+Ranging Data Overwritten indication::
+
+ menu cs
+ ranging-data-mode <pts_addr> ondemand indicate
+
+PTS can log failed attempts to send an indication during this case even though
+its final verdict is PASS; record the final PTS verdict rather than treating
+that server-side diagnostic alone as a DUT failure.
+
+For ``RAP/REQ/ORD/BV-08-C``, select notification transport to receive the
+Ranging Data Overwritten notification::
+
+ menu cs
+ ranging-data-mode <pts_addr> ondemand notify
+
+For ``RAP/REQ/ORD/BV-06-C``, after connection and security complete, first use
+indication transport to enter the PTS On-demand flow, then switch to the
+notification transport used by the lost-Ready round::
+
+ menu cs
+ ranging-data-mode <pts_addr> ondemand indicate
+ ranging-data-mode <pts_addr> ondemand notify
+
+Wait for ``Ranging Data mode updated`` after each command. PTS does not advance
+to the lost-Ready MMI until both transitions have been completed. It then
+suppresses the Ranging Data Ready notification and presents an MMI asking for a
+read of the Ranging Data Ready characteristic. Complete the MMI promptly, before
+its short timeout, from the bluetoothctl GATT menu::
+
+ back
+ menu gatt
+ select-attribute 00002c18-0000-1000-8000-00805f9b34fb
+ read
+
+Selecting the characteristic by UUID avoids depending on the handles PTS
+happens to assign; ``select-attribute`` matches characteristics before
+descriptors, so this selects the value attribute and not its CCCD. Use
+``list-attributes`` if the remote database needs to be inspected first. Return
+to PTS and continue the MMI after the read request is sent.
diff --git a/doc/qualification/ras-pts.rst b/doc/qualification/ras-pts.rst
new file mode 100644
index 000000000..3b9bfd0d0
--- /dev/null
+++ b/doc/qualification/ras-pts.rst
@@ -0,0 +1,135 @@
+.. SPDX-License-Identifier: GPL-2.0-or-later
+.. Copyright © 2026 Qualcomm Technologies, Inc.
+
+================
+RAS test results
+================
+
+:PTS version: 8.14.0.4
+:BlueZ: 5.87 with Channel Sounding support
+
+RAP Requester and Responder test results are in ``rap-pts.rst``.
+
+Setup
+=====
+
+- Enable ``Experimental = true`` in ``/etc/bluetooth/main.conf``.
+- Use a ``NoInputNoOutput`` bluetoothctl agent and make it the default agent.
+- Before cases that establish a new encrypted link, delete the DUT bond and the
+ corresponding PTS LTK/bond. Removing only one side causes authentication
+ failure.
+- The DUT acts as the CS Reflector. Set the role from the bluetoothctl Channel
+ Sounding menu before the first case::
+
+ menu cs
+ role 0x02
+
+Tests
+=====
+
++------------------------------+----------+----------------------------------------------------------------+
+| Test name | Result | Notes |
++==============================+==========+================================================================+
+| IOPT/RAS/SR/GATTDB/BV-01-I | PASS | RAS database validation. |
++------------------------------+----------+----------------------------------------------------------------+
+| RAS/SR/SGGIT/SER/BV-01-C | PASS | Primary, unique Ranging Service discovery. |
++------------------------------+----------+----------------------------------------------------------------+
+| RAS/SR/SGGIT/CHA/BV-01-C | PASS | RAS Features characteristic declaration. |
++------------------------------+----------+----------------------------------------------------------------+
+| RAS/SR/SGGIT/CHA/BV-02-C | PASS | Real-time Ranging Data characteristic declaration. |
++------------------------------+----------+----------------------------------------------------------------+
+| RAS/SR/SGGIT/CHA/BV-03-C | PASS | On-demand Ranging Data characteristic declaration. |
++------------------------------+----------+----------------------------------------------------------------+
+| RAS/SR/SGGIT/CHA/BV-04-C | PASS | RAS Control Point characteristic declaration. |
++------------------------------+----------+----------------------------------------------------------------+
+| RAS/SR/SGGIT/CHA/BV-08-C | PASS | Ranging Data Ready characteristic declaration. |
++------------------------------+----------+----------------------------------------------------------------+
+| RAS/SR/SGGIT/CHA/BV-12-C | PASS | Ranging Data Overwritten characteristic declaration. |
++------------------------------+----------+----------------------------------------------------------------+
+| RAS/SR/RCO/BV-01-C | PASS | RAS Features read. |
++------------------------------+----------+----------------------------------------------------------------+
+| RAS/SR/RCO/BV-02-C | PASS | Ranging Data Ready notification or indication. |
++------------------------------+----------+----------------------------------------------------------------+
+| RAS/SR/RCO/BV-03-C | PASS | Ranging Data Ready read. |
++------------------------------+----------+----------------------------------------------------------------+
+| RAS/SR/RCO/BV-04-C | PASS | Ranging Data Overwritten read. |
++------------------------------+----------+----------------------------------------------------------------+
+| RAS/SR/RCO/BV-05-C | PASS | Ranging Data Ready, Indication transport. |
++------------------------------+----------+----------------------------------------------------------------+
+| RAS/SR/RCO/BV-06-C | PASS | Ranging Data Ready, Notification transport. |
++------------------------------+----------+----------------------------------------------------------------+
+| RAS/SR/RCO/BV-07-C | PASS | Ranging Data Ready, Indication and Read. |
++------------------------------+----------+----------------------------------------------------------------+
+| RAS/SR/RCO/BV-08-C | PASS | Ranging Data Overwritten is indicated when the client enabled |
+| | | both transports. |
++------------------------------+----------+----------------------------------------------------------------+
+| RAS/SR/RCO/BV-09-C | PASS | Ranging Data Ready is indicated when the client enabled both |
+| | | transports. |
++------------------------------+----------+----------------------------------------------------------------+
+| RAS/SR/RRD/BV-01-C | PASS | Real-time Ranging Data delivery. |
++------------------------------+----------+----------------------------------------------------------------+
+| RAS/SR/RRD/BV-03-C | PASS | Real-time Ranging Data is notified when the client enabled |
+| | | both transports. |
++------------------------------+----------+----------------------------------------------------------------+
+| RAS/SR/RRD/BV-04-C | PASS | Overwritten Real-time data restarts on the new Ranging |
+| | | Counter. |
++------------------------------+----------+----------------------------------------------------------------+
+| RAS/SR/RRD/BV-05-C | PASS | Real-time subscription is dropped on disconnection. |
++------------------------------+----------+----------------------------------------------------------------+
+| RAS/SR/RCP/BV-01-C | PASS | Get Ranging Data, segmented transfer and ACK. |
++------------------------------+----------+----------------------------------------------------------------+
+| RAS/SR/RCP/BV-03-C | PASS | Abort Operation stops an in-progress transfer. |
++------------------------------+----------+----------------------------------------------------------------+
+| RAS/SR/RCP/BV-05-C | PASS | Control Point state is reset on disconnection. |
++------------------------------+----------+----------------------------------------------------------------+
+| RAS/SR/SPE/BI-01-C | PASS | Op Code Not Supported, Retrieve Lost Ranging Data Segments. |
++------------------------------+----------+----------------------------------------------------------------+
+| RAS/SR/SPE/BI-03-C | PASS | Op Code Not Supported, Set Filter. |
++------------------------------+----------+----------------------------------------------------------------+
+| RAS/SR/SPE/BI-04-C | PASS | Op Code Not Supported, RFU. |
++------------------------------+----------+----------------------------------------------------------------+
+| RAS/SR/SPE/BI-05-C | PASS | Invalid Parameter, Abort Operation. |
++------------------------------+----------+----------------------------------------------------------------+
+| RAS/SR/SPE/BI-06-C | PASS | Get Ranging Data and ACK Ranging Data errors. |
++------------------------------+----------+----------------------------------------------------------------+
+| RAS/SR/SPE/BI-07-C | PASS | Server Busy. |
++------------------------------+----------+----------------------------------------------------------------+
+| RAS/SR/SPE/BI-11-C | PASS | Real-time and On-demand CCCDs are mutually exclusive. |
++------------------------------+----------+----------------------------------------------------------------+
+
+Not applicable
+==============
+
++------------------------------+-----------------------------------------------+
+| Test name | Reason |
++==============================+===============================================+
+| RAS/SR/SPE/BI-02-C | Applies when Abort Operation is not supported |
+| | (NOT RAS 3/4 in RAS.TS Table 5.1). The IUT |
+| | supports it, so RAS/SR/RCP/BV-03-C and |
+| | RAS/SR/SPE/BI-05-C are run instead. |
++------------------------------+-----------------------------------------------+
+
+Pre-generated ranging data
+==========================
+
+With ``TSPX_test_method`` set to pre-generated CS data, the whole ranging data
+arrives in one go rather than one CS subevent at a time, so the On-demand
+notification path sends its segments back to back with no air time between
+them. ``RAS/SR/SPE/BI-05-C`` writes an invalid Abort Operation mid-transfer
+and needs the transfer to still be running when it does, so the per-segment
+delay has to leave the peer a window: it fails at 0 ms and passes at the 5 ms
+``RAS_SEGMENT_NFY_PACE_MS`` uses. Feeding the test data one subevent at a
+time rather than in one go does not change that, since the segments of a
+subevent still go out back to back. Raise the delay if PTS reports Complete
+Ranging Data where it expected Invalid Parameter.
+
+Transport selection
+===================
+
+When a client enables both notifications and indications on a characteristic,
+the transport the server must use differs per characteristic:
+
+- Ranging Data Ready and Ranging Data Overwritten are indicated (RAS 3.4.2 and
+ 3.5.2), covered by ``RAS/SR/RCO/BV-08-C`` and ``RAS/SR/RCO/BV-09-C``.
+- On-demand and Real-time Ranging Data are notified (RAS 3.2.2 and 3.2.3.1),
+ covered by ``RAS/SR/RCO/BV-05..07-C`` and ``RAS/SR/RRD/BV-03-C``.
--
2.43.0
^ permalink raw reply related [flat|nested] 18+ messages in thread* Re: [PATCH v2 00/14] Ranging Profile and Ranging Service PTS fixes
2026-10-09 9:25 [PATCH v2 00/14] Ranging Profile and Ranging Service PTS fixes Cheng Jiang
` (13 preceding siblings ...)
2026-10-09 9:25 ` [PATCH v2 14/14] doc/qualification: Add RAP/RAS PTS qualification results Cheng Jiang
@ 2026-10-09 17:20 ` patchwork-bot+bluetooth
14 siblings, 0 replies; 18+ messages in thread
From: patchwork-bot+bluetooth @ 2026-10-09 17:20 UTC (permalink / raw)
To: Cheng Jiang
Cc: linux-bluetooth, jinwang.li, wei.deng, xiuzhuo.shang, shuai.zhang
Hello:
This series was applied to bluetooth/bluez.git (master)
by Luiz Augusto von Dentz <luiz.von.dentz@intel.com>:
On Fri, 9 Oct 2026 17:25:16 +0800 you wrote:
> Changes since v1, from review:
>
> - src/ and unit/ are in separate patches throughout. Two of those splits
> leave the unit tests broken in between: patch 2 changes gatt_db_notify_t
> and patch 3 updates the test callbacks, so on patch 2 alone they do not
> compile; patch 6 advertises Abort Operation in RAS Features and patch 7
> updates the value test-rap expects. src/bluetoothd builds on every patch,
> and the tests pass once each pair is applied. Squashing the pairs would
> avoid it, if you would rather have that.
>
> [...]
Here is the summary with links:
- [v2,01/14] shared/gatt-client: Allow registering notify with explicit CCC value
https://git.kernel.org/pub/scm/bluetooth/bluez.git/?id=52fdca35b8e7
- [v2,02/14] shared/gatt-db: Pass the ATT opcode to the notify callback
(no matching commit)
- [v2,03/14] unit: Take the ATT opcode in the notify callbacks
(no matching commit)
- [v2,04/14] shared/gatt-db: Add gatt_db_attribute_indicate()
https://git.kernel.org/pub/scm/bluetooth/bluez.git/?id=8199d710021e
- [v2,05/14] shared/rap: Honor CCCD transport for RAS on-demand ranging data
(no matching commit)
- [v2,06/14] shared/rap: Add RAS Control Point Abort Operation
(no matching commit)
- [v2,07/14] unit/test-rap: Expect Abort Operation in RAS Features
(no matching commit)
- [v2,08/14] shared/rap: Shorten the requester Control Point response timeout
https://git.kernel.org/pub/scm/bluetooth/bluez.git/?id=bf0ce0541f28
- [v2,09/14] shared/rap: Add real-time ranging data delivery on the responder
(no matching commit)
- [v2,10/14] shared/rap: Add requester ranging data subscription API
https://git.kernel.org/pub/scm/bluetooth/bluez.git/?id=14ad98fba11c
- [v2,11/14] profiles/ranging: Expose requester ranging data mode over D-Bus
(no matching commit)
- [v2,12/14] client: Add Channel Sounding ranging data mode control
https://git.kernel.org/pub/scm/bluetooth/bluez.git/?id=68ac6ad752f2
- [v2,13/14] doc: Document Channel Sounding ranging data mode control
https://git.kernel.org/pub/scm/bluetooth/bluez.git/?id=2cd5045f1ec4
- [v2,14/14] doc/qualification: Add RAP/RAS PTS qualification results
https://git.kernel.org/pub/scm/bluetooth/bluez.git/?id=b111351fd617
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply [flat|nested] 18+ messages in thread