* [PATCH] Bluetooth: btintel_pcie: Remove unused ret in btintel_pcie_submit_rx_work()
From: Robertus Diawan Chris @ 2026-04-30 4:05 UTC (permalink / raw)
To: marcel, luiz.dentz
Cc: linux-bluetooth, linux-kernel, linux-kernel-mentees, skhan, me
The variable ret assigned to -EINVAL, however, this value is never read
and re-assigned a new value when the code jumps to label resubmit.
The assignment is redundant and can be removed.
This is reported by Coverity Scan with CID 1598882 as UNUSED_VALUE.
Signed-off-by: Robertus Diawan Chris <robertusdchris@gmail.com>
---
drivers/bluetooth/btintel_pcie.c | 4 +---
1 file changed, 1 insertion(+), 3 deletions(-)
diff --git a/drivers/bluetooth/btintel_pcie.c b/drivers/bluetooth/btintel_pcie.c
index 2f59c0d6f9ec..ac4f5b45a6af 100644
--- a/drivers/bluetooth/btintel_pcie.c
+++ b/drivers/bluetooth/btintel_pcie.c
@@ -1376,10 +1376,8 @@ static int btintel_pcie_submit_rx_work(struct btintel_pcie_data *data, u8 status
rfh_hdr = buf;
len = rfh_hdr->packet_len;
- if (len <= 0) {
- ret = -EINVAL;
+ if (len <= 0)
goto resubmit;
- }
/* Remove RFH header */
buf += sizeof(*rfh_hdr);
base-commit: 254f49634ee16a731174d2ae34bc50bd5f45e731
--
2.54.0
^ permalink raw reply related
* [RFC PATCH] Bluetooth: fix Set Public Address on controller in HCI_AUTO_OFF grace period
From: Dan Klishch @ 2026-04-30 4:55 UTC (permalink / raw)
To: Marcel Holtmann, Luiz Augusto von Dentz; +Cc: linux-bluetooth, linux-kernel
When mgmt's Set Public Address command (and Set External Configuration)
stages a configuration change, set_public_address() sets HCI_CONFIG and
HCI_AUTO_OFF on the device and queues hci_power_on. The intent is for
the queued power_on to run hci_dev_init_sync() -- which detects
HCI_CONFIG and calls hdev->set_bdaddr() to program the new address into
the firmware -- and then re-emit Index Added with the controller back in
the boot-init grace period (HCI_UP=1, HCI_AUTO_OFF=1) so userspace can
re-push pending config commands and drive a fresh Set Powered 1 cycle.
The bug bites when the command is issued while the controller is in
that same grace period itself -- the normal post-boot state, before
bluetoothd has claimed the controller via Set Powered 1. In that state
HCI_UP=1 and HCI_AUTO_OFF=1, so hdev_is_powered() is false (the command
is accepted) but hci_power_on()'s "already up" early-return condition
HCI_UP && HCI_MGMT && HCI_AUTO_OFF is true. The early-return path runs
hci_powered_update_sync() -- which is the wrong thing for this case:
neither hci_dev_init_sync() nor mgmt_index_added() runs. The result:
- hdev->public_addr is recorded but never reaches the firmware via
hdev->set_bdaddr(),
- userspace sees Index Removed (from set_public_address) but no
Index Added, leaving the controller invisible to mgmt clients;
it is not in the configured, unconfigured or extended index list
yet remains registered in the kernel.
The other two starting states are fine: HCI_UP=0 falls through to the
full hci_dev_do_open() path (correct); HCI_UP=1 with HCI_AUTO_OFF=0
makes hdev_is_powered() true, so set_public_address() rejects with
MGMT_STATUS_REJECTED before queueing power_on at all.
Fix: at the top of hci_power_on(), if HCI_CONFIG is pending and we are
in the affected grace-period state (HCI_UP, HCI_MGMT, !HCI_RFKILLED),
close the device first. The early-return condition then fails and we
fall through to hci_dev_do_open() -> hci_dev_init_sync(), which honors
HCI_CONFIG by invoking hdev->set_bdaddr(); the post-open block then
re-emits Index Added via the existing HCI_CONFIG branch.
hci_dev_close_sync() clears HCI_AUTO_OFF as a side effect of going
through the regular power-down path, but set_public_address() had set
it deliberately so the post-reopen state matches the boot-init grace
period that mgmt clients expect ("treat as new one" per the protocol
contract). Several mgmt commands -- Set Privacy, Set Wideband Speech,
Set LE, Set BR/EDR, etc. -- gate on !hdev_is_powered(), and bluetoothd
expects to push them during this window before issuing Set Powered 1
itself. Restore HCI_AUTO_OFF after the close so hdev_is_powered() ==
false again.
This matches the documented behavior for Set Public Address on a
fully-configured controller ("Once the address has been successfully
changed an Index Added event will be sent.")
Assisted-by: Claude:claude-opus-4-7
Signed-off-by: Dan Klishch <danilklishch@gmail.com>
---
net/bluetooth/hci_core.c | 8 ++++++++
1 file changed, 8 insertions(+)
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -948,6 +948,14 @@ static void hci_power_on(struct work_struct *work)
BT_DBG("%s", hdev->name);
+ if (hci_dev_test_flag(hdev, HCI_CONFIG) &&
+ hci_dev_test_flag(hdev, HCI_MGMT) &&
+ !hci_dev_test_flag(hdev, HCI_RFKILLED) &&
+ test_bit(HCI_UP, &hdev->flags)) {
+ hci_dev_do_close(hdev);
+ hci_dev_set_flag(hdev, HCI_AUTO_OFF);
+ }
+
if (test_bit(HCI_UP, &hdev->flags) &&
hci_dev_test_flag(hdev, HCI_MGMT) &&
hci_dev_test_and_clear_flag(hdev, HCI_AUTO_OFF)) {
---
Claude was able to fully convince me that the patch and the explanation
are correct. Moreover, this indeed fixed a problem I had with a custom
patched bluetoothd that happened to override public-addr in the 2
second post-boot window. However, both the patch and commit description
are fully AI-generated.
^ permalink raw reply
* [PATCH BlueZ v7 0/3] Add RAS Packet format and Notification support
From: Prathibha Madugonde @ 2026-04-30 7:41 UTC (permalink / raw)
To: linux-bluetooth; +Cc: luiz.dentz, quic_mohamull, quic_hbandi, quic_anubhavg
From: Prathibha Madugonde <prathibha.madugonde@oss.qualcomm.com>
Changes in v7:
src/shared:
Replace pointer operations to util_iov operations
Club ranging counter and config id into one field
Add helper functions for ranging counter and config id
Changes in v6:
src/shared:
Removed 5 separate CCC write callbacks
Added unified ras_ranging_data_ccc_write_cb for Real-time and On-demand
Removed unused macros
refactored CS mode processing into separate functions
Improved iov_prepend_bytes - use realloc/memmove instead of malloc/memcpy
unit/test-rap:
Added RAS/SR/SPE/BI-11-C test case for mutual exclusivity validation
Changes in v5:
Fixed Max length err in title
Changes in v4:
Fixed declaration after statement in src/shared/rap.c
Changes in v3:
Fix for cs_mode_one_data struct members rearrage as per spec
Reading of cs_mode_one_data in rap_hci.c
Address cs_mode data struct padding in src/shared/rap.c
Changes in v2:
Fixed missing declaration in src/shared/rap.c
Patch overview:
1/3 src/shared: Add RAS packet format and sending notifications to client
2/3 uint/test-rap : Add PTS tests for CS reflector
3/3 profiles/ranging: Read cs_mode_one_data members as per spec
profiles/ranging/rap_hci.c | 25 +-
src/shared/rap.c | 1258 +++++++++++++++++++++++++++++++++++-
src/shared/rap.h | 4 +-
unit/test-rap.c | 325 +++++++++-
4 files changed, 1584 insertions(+), 28 deletions(-)
--
2.34.1
^ permalink raw reply
* [PATCH BlueZ v7 1/3] src/shared: Add RAS packet format and notification support
From: Prathibha Madugonde @ 2026-04-30 7:41 UTC (permalink / raw)
To: linux-bluetooth; +Cc: luiz.dentz, quic_mohamull, quic_hbandi, quic_anubhavg
In-Reply-To: <20260430074142.3599484-1-prathm@qti.qualcomm.com>
From: Prathibha Madugonde <prathibha.madugonde@oss.qualcomm.com>
Implement complete RAS data pipeline:
- Handle HCI CS subevent result/continuation events
- Serialize ranging/subevent headers per spec
- GATT notifications for real-time ranging data
---
src/shared/rap.c | 1258 +++++++++++++++++++++++++++++++++++++++++++++-
src/shared/rap.h | 4 +-
2 files changed, 1248 insertions(+), 14 deletions(-)
diff --git a/src/shared/rap.c b/src/shared/rap.c
index ac6de04e0..b554726b0 100644
--- a/src/shared/rap.c
+++ b/src/shared/rap.c
@@ -14,6 +14,7 @@
#include <errno.h>
#include "bluetooth/bluetooth.h"
+#include "bluetooth/hci.h"
#include "bluetooth/uuid.h"
#include "src/shared/queue.h"
@@ -33,6 +34,180 @@
/* Total number of attribute handles reserved for the RAS service */
#define RAS_TOTAL_NUM_HANDLES 18
+/* 2(rc+cfg) + 1(tx_pwr) + 1(4 bits antenna_mask, 2 bits reserved,
+ * 2 bits pct_format)
+ */
+#define RAS_RANGING_HEADER_SIZE 4
+#define TOTAL_RAS_RANGING_HEADER_SIZE 5
+#define ATT_OVERHEAD 3 /* 1(opcode) + 2(char handle) */
+#define RAS_STEP_ABORTED_BIT 0x80/* set step aborted */
+#define RAS_SUBEVENT_HEADER_SIZE 8
+
+enum pct_format {
+ IQ = 0,
+ PHASE = 1,
+};
+
+enum ranging_done_status {
+ RANGING_DONE_ALL_RESULTS_COMPLETE = 0x0,
+ RANGING_DONE_PARTIAL_RESULTS = 0x1,
+ RANGING_DONE_ABORTED = 0xF,
+};
+
+enum subevent_done_status {
+ SUBEVENT_DONE_ALL_RESULTS_COMPLETE = 0x0,
+ SUBEVENT_DONE_PARTIAL_RESULTS = 0x1,
+ SUBEVENT_DONE_ABORTED = 0xF,
+};
+
+enum ranging_abort_reason {
+ RANGING_ABORT_NO_ABORT = 0x0,
+ RANGING_ABORT_LOCAL_HOST_OR_REMOTE = 0x1,
+ RANGING_ABORT_INSUFFICIENT_FILTERED_CHANNELS = 0x2,
+ RANGING_ABORT_INSTANT_HAS_PASSED = 0x3,
+ RANGING_ABORT_UNSPECIFIED = 0xF,
+};
+
+enum subevent_abort_reason {
+ SUBEVENT_ABORT_NO_ABORT = 0x0,
+ SUBEVENT_ABORT_LOCAL_HOST_OR_REMOTE = 0x1,
+ SUBEVENT_ABORT_NO_CS_SYNC_RECEIVED = 0x2,
+ SUBEVENT_ABORT_SCHEDULING_CONFLICTS_OR_LIMITED_RESOURCES = 0x3,
+ SUBEVENT_ABORT_UNSPECIFIED = 0xF,
+};
+
+/* Segmentation header: 1 byte
+ * bit 0: first_segment
+ * bit 1: last_segment
+ * bits 2-7: rolling_segment_counter (6 bits)
+ */
+struct segmentation_header {
+ uint8_t first_segment;
+ uint8_t last_segment;
+ uint8_t rolling_segment_counter;
+};
+
+/* Macros to pack/unpack segmentation header */
+#define SEG_HDR_PACK(first, last, counter) \
+ ((uint8_t)(((first) ? 0x01 : 0x00) | \
+ ((last) ? 0x02 : 0x00) | \
+ (((counter) & 0x3F) << 2)))
+
+struct ranging_header {
+ /* Byte 0-1: 12-bit counter + 4-bit config_id */
+ uint8_t counter_config[2];
+ int8_t selected_tx_power; /* Byte 2: selected TX power */
+ /* Byte 3: 4-bit antenna_mask + 2-bit reserved + 2-bit pct_format */
+ uint8_t antenna_pct;
+} __packed;
+
+static inline void ranging_header_set_counter(struct ranging_header *hdr,
+ uint16_t counter)
+{
+ /* Counter is 12 bits, stored in lower 12 bits of first 2 bytes */
+ hdr->counter_config[0] = counter & 0xFF;
+ hdr->counter_config[1] = (hdr->counter_config[1] & 0xF0) |
+ ((counter >> 8) & 0x0F);
+}
+
+static inline void ranging_header_set_config_id(struct ranging_header *hdr,
+ uint8_t config_id)
+{
+ /* Config ID is 4 bits, stored in upper 4 bits of byte 1 */
+ hdr->counter_config[1] = (hdr->counter_config[1] & 0x0F) |
+ ((config_id & 0x0F) << 4);
+}
+
+static inline void ranging_header_set_antenna_mask(
+ struct ranging_header *hdr,
+ uint8_t mask)
+{
+ /* Antenna mask is 4 bits, stored in lower 4 bits of byte 3 */
+ hdr->antenna_pct = (hdr->antenna_pct & 0xF0) | (mask & 0x0F);
+}
+
+static inline void ranging_header_set_pct_format(struct ranging_header *hdr,
+ uint8_t format)
+{
+ /* PCT format is 2 bits, stored in bits 6-7 of byte 3 */
+ hdr->antenna_pct = (hdr->antenna_pct & 0x3F) |
+ ((format & 0x03) << 6);
+}
+
+struct ras_subevent_header {
+ uint16_t start_acl_conn_event;
+ uint16_t frequency_compensation;
+ uint8_t ranging_done_status;
+ uint8_t subevent_done_status;
+ uint8_t ranging_abort_reason;
+ uint8_t subevent_abort_reason;
+ int8_t reference_power_level;
+ uint8_t num_steps_reported;
+};
+
+/* Macros to pack/unpack RAS subevent header status fields */
+#define RAS_DONE_STATUS_PACK(ranging, subevent) \
+ ((uint8_t)(((ranging) & 0x0F) | (((subevent) & 0x0F) << 4)))
+
+#define RAS_ABORT_REASON_PACK(ranging, subevent) \
+ ((uint8_t)(((ranging) & 0x0F) | (((subevent) & 0x0F) << 4)))
+
+struct ras_subevent {
+ struct ras_subevent_header subevent_header;
+ uint8_t subevent_data[];
+};
+
+/* Role maps to Core CS roles (initiator/reflector) */
+enum cs_role {
+ CS_ROLE_INITIATOR = 0x00,
+ CS_ROLE_REFLECTOR = 0x01,
+};
+
+#define CS_INVALID_CONFIG_ID 0xFF
+/* Minimal enums (align to controller values if needed) */
+enum cs_procedure_done_status {
+ CS_PROC_ALL_RESULTS_COMPLETE = 0x00,
+ CS_PROC_PARTIAL_RESULTS = 0x01,
+ CS_PROC_ABORTED = 0x02
+};
+
+/* Main cs_procedure_data */
+struct cs_procedure_data {
+ /* Identity and counters */
+ uint16_t counter;
+ uint8_t num_antenna_paths;
+ /* Flags and status */
+ enum cs_procedure_done_status local_status;
+ enum cs_procedure_done_status remote_status;
+ bool contains_complete_subevent_;
+ /* RAS aggregation */
+ struct segmentation_header segmentation_header_;
+ struct ranging_header ranging_header_;
+ struct iovec ras_raw_data_; /* raw concatenated */
+ uint16_t ras_raw_data_index_;
+ struct ras_subevent_header ras_subevent_header_;
+ struct iovec ras_subevent_data_; /* buffer per subevent */
+ uint8_t ras_subevent_counter_;
+ /* Reference power levels */
+ int8_t initiator_reference_power_level;
+ int8_t reflector_reference_power_level;
+ bool ranging_header_prepended_;
+ bool ras_subevent_header_emitted;
+};
+
+struct cstracker {
+ enum cs_role role; /* INITIATOR/REFLECTOR */
+ uint8_t config_id; /* CS_INVALID_CONFIG_ID */
+ int8_t selected_tx_power; /* PROC_ENABLE_COMPLETE */
+ uint8_t rtt_type; /* RTT type */
+ struct cs_procedure_data *current_proc;
+ /* Cached header values for CONT events (per-connection state) */
+ uint16_t last_proc_counter;
+ uint16_t last_start_acl_conn_evt_counter;
+ uint16_t last_freq_comp;
+ int8_t last_ref_pwr_lvl;
+};
+
/* Ranging Service context */
struct ras {
struct bt_rap_db *rapdb;
@@ -43,9 +218,17 @@ struct ras {
struct gatt_db_attribute *realtime_chrc;
struct gatt_db_attribute *realtime_chrc_ccc;
struct gatt_db_attribute *ondemand_chrc;
+ struct gatt_db_attribute *ondemand_ccc;
struct gatt_db_attribute *cp_chrc;
+ struct gatt_db_attribute *cp_ccc;
struct gatt_db_attribute *ready_chrc;
+ struct gatt_db_attribute *ready_ccc;
struct gatt_db_attribute *overwritten_chrc;
+ struct gatt_db_attribute *overwritten_ccc;
+
+ /* CCC state tracking for mutual exclusivity */
+ uint16_t realtime_ccc_value;
+ uint16_t ondemand_ccc_value;
};
struct bt_rap_db {
@@ -70,6 +253,7 @@ struct bt_rap {
bt_rap_destroy_func_t debug_destroy;
void *debug_data;
void *user_data;
+ struct cstracker *resptracker;
};
static struct queue *rap_db;
@@ -90,6 +274,204 @@ struct bt_rap_ready {
void *data;
};
+uint16_t default_ras_mtu = 247; /*Section 3.1.2 of RAP 1.0*/
+uint8_t ras_segment_header_size = 1;
+
+static struct cs_procedure_data *cs_procedure_data_create(
+ uint16_t procedure_counter,
+ uint8_t num_antenna_paths,
+ uint8_t configuration_id,
+ int8_t selected_tx_power)
+{
+ struct cs_procedure_data *d;
+ uint8_t i;
+ uint8_t antenna_mask = 0;
+
+ d = calloc(1, sizeof(struct cs_procedure_data));
+
+ if (!d)
+ return NULL;
+
+ d->counter = procedure_counter;
+ d->num_antenna_paths = num_antenna_paths;
+ d->local_status = CS_PROC_PARTIAL_RESULTS;
+ d->remote_status = CS_PROC_PARTIAL_RESULTS;
+ d->contains_complete_subevent_ = false;
+ d->segmentation_header_.first_segment = 1;
+ d->segmentation_header_.last_segment = 0;
+ d->segmentation_header_.rolling_segment_counter = 0;
+
+ /* Initialize ranging header using helper functions */
+ memset(&d->ranging_header_, 0, sizeof(d->ranging_header_));
+ ranging_header_set_counter(&d->ranging_header_, procedure_counter);
+ ranging_header_set_config_id(&d->ranging_header_, configuration_id);
+ d->ranging_header_.selected_tx_power = selected_tx_power;
+
+ /* Build antenna mask */
+ for (i = 0; i < num_antenna_paths; i++)
+ antenna_mask |= (1u << i);
+ ranging_header_set_antenna_mask(&d->ranging_header_, antenna_mask);
+
+ ranging_header_set_pct_format(&d->ranging_header_, IQ);
+ memset(&d->ras_raw_data_, 0, sizeof(d->ras_raw_data_));
+ d->ras_raw_data_index_ = 0;
+ memset(&d->ras_subevent_data_, 0, sizeof(d->ras_subevent_data_));
+ d->ras_subevent_counter_ = 0;
+ d->initiator_reference_power_level = 0;
+ d->reflector_reference_power_level = 0;
+ d->ranging_header_prepended_ = false;
+ d->ras_subevent_header_emitted = false;
+
+ return d;
+}
+
+static void cs_procedure_data_destroy(struct cs_procedure_data *d)
+{
+ if (!d)
+ return;
+
+ free(d->ras_raw_data_.iov_base);
+ free(d->ras_subevent_data_.iov_base);
+ free(d);
+}
+
+static void cs_pd_set_local_status(struct cs_procedure_data *d,
+ enum cs_procedure_done_status s)
+{
+ if (d)
+ d->local_status = s;
+}
+
+static void cs_pd_set_remote_status(struct cs_procedure_data *d,
+ enum cs_procedure_done_status s)
+{
+ if (d)
+ d->remote_status = s;
+}
+
+static void cs_pd_set_reference_power_levels(struct cs_procedure_data *d,
+ int8_t init_lvl, int8_t ref_lvl)
+{
+ if (!d)
+ return;
+
+ d->initiator_reference_power_level = init_lvl;
+ d->reflector_reference_power_level = ref_lvl;
+}
+
+static void cs_pd_ras_begin_subevent(struct cs_procedure_data *d,
+ uint16_t start_acl_conn_event,
+ uint16_t frequency_compensation,
+ int8_t reference_power_level)
+{
+ if (!d)
+ return;
+
+ d->ras_subevent_counter_++;
+ d->ras_subevent_header_.start_acl_conn_event = start_acl_conn_event;
+ d->ras_subevent_header_.frequency_compensation =
+ frequency_compensation;
+ d->ras_subevent_header_.reference_power_level = reference_power_level;
+ d->ras_subevent_header_.num_steps_reported = 0;
+ d->ras_subevent_header_emitted = false;
+ d->ras_subevent_data_.iov_len = 0;
+}
+
+static bool cs_pd_ras_append_subevent_bytes(struct cs_procedure_data *d,
+ const uint8_t *bytes, size_t len)
+{
+ if (!d || !bytes || len == 0)
+ return false;
+
+ return util_iov_append(&d->ras_subevent_data_, bytes, len) != NULL;
+}
+
+static inline size_t serialize_ras_subevent_header(
+ const struct ras_subevent_header *h,
+ uint8_t *out, size_t out_len)
+{
+
+ if (!h || !out || out_len < RAS_SUBEVENT_HEADER_SIZE)
+ return 0;
+
+ put_le16(h->start_acl_conn_event, out + 0);
+ put_le16(h->frequency_compensation, out + 2);
+ out[4] = RAS_DONE_STATUS_PACK(h->ranging_done_status,
+ h->subevent_done_status);
+ out[5] = RAS_ABORT_REASON_PACK(h->ranging_abort_reason,
+ h->subevent_abort_reason);
+ out[6] = h->reference_power_level;
+ out[7] = h->num_steps_reported;
+
+ return RAS_SUBEVENT_HEADER_SIZE;
+}
+
+static bool cs_pd_ras_commit_subevent(struct cs_procedure_data *d,
+ uint8_t num_steps_reported,
+ uint8_t ranging_done_status,
+ uint8_t subevent_done_status,
+ uint8_t ranging_abort_reason,
+ uint8_t subevent_abort_reason)
+{
+ size_t hdr_sz;
+ size_t payload_sz;
+ size_t total;
+ uint8_t *buf;
+ size_t w;
+ bool ok;
+
+ if (!d)
+ return false;
+
+ d->ras_subevent_header_.num_steps_reported =
+ (uint8_t)(d->ras_subevent_header_.num_steps_reported +
+ num_steps_reported);
+ d->ras_subevent_header_.ranging_done_status = ranging_done_status;
+ d->ras_subevent_header_.subevent_done_status = subevent_done_status;
+ d->ras_subevent_header_.ranging_abort_reason = ranging_abort_reason;
+ d->ras_subevent_header_.subevent_abort_reason = subevent_abort_reason;
+
+ if (subevent_done_status == SUBEVENT_DONE_ALL_RESULTS_COMPLETE)
+ d->contains_complete_subevent_ = true;
+
+ if (subevent_done_status == SUBEVENT_DONE_PARTIAL_RESULTS)
+ return true;
+
+ if (!d->ras_subevent_header_emitted) {
+ hdr_sz = RAS_SUBEVENT_HEADER_SIZE;
+ payload_sz = d->ras_subevent_data_.iov_len;
+ total = hdr_sz + payload_sz;
+ buf = (uint8_t *)malloc(total);
+
+ if (!buf)
+ return false;
+
+ w = serialize_ras_subevent_header(&d->ras_subevent_header_,
+ buf, total);
+
+ if (w != hdr_sz) {
+ free(buf);
+ return false;
+ }
+
+ if (payload_sz > 0)
+ memcpy(buf + hdr_sz,
+ (const uint8_t *)d->ras_subevent_data_.iov_base,
+ payload_sz);
+
+ ok = util_iov_append(&d->ras_raw_data_, buf, total) != NULL;
+ free(buf);
+
+ if (!ok)
+ return false;
+
+ d->ras_subevent_data_.iov_len = 0;
+ d->ras_subevent_header_emitted = true;
+ }
+
+ return true;
+}
+
static struct ras *rap_get_ras(struct bt_rap *rap)
{
if (!rap)
@@ -155,6 +537,11 @@ static void rap_free(void *data)
rap_db_free(rap->rrapdb);
+ if (rap->resptracker) {
+ free(rap->resptracker);
+ rap->resptracker = NULL;
+ }
+
queue_destroy(rap->notify, free);
queue_destroy(rap->pending, NULL);
queue_destroy(rap->ready_cbs, rap_ready_free);
@@ -240,6 +627,22 @@ bool bt_rap_set_debug(struct bt_rap *rap, bt_rap_debug_func_t func,
return true;
}
+static void cs_tracker_init(struct cstracker *t)
+{
+ if (!t)
+ return;
+
+ memset(t, 0, sizeof(*t));
+ t->role = CS_ROLE_REFLECTOR;
+ t->config_id = CS_INVALID_CONFIG_ID;
+ t->rtt_type = 0;
+ t->selected_tx_power = 0;
+ t->last_proc_counter = 0;
+ t->last_start_acl_conn_evt_counter = 0;
+ t->last_freq_comp = 0;
+ t->last_ref_pwr_lvl = 0;
+}
+
static void ras_features_read_cb(struct gatt_db_attribute *attrib,
unsigned int id, uint16_t offset,
uint8_t opcode, struct bt_att *att,
@@ -304,6 +707,70 @@ static void ras_data_overwritten_read_cb(struct gatt_db_attribute *attrib,
gatt_db_attribute_read_result(attrib, id, 0, value, sizeof(value));
}
+static void ras_ranging_data_ccc_write_cb(struct gatt_db_attribute *attrib,
+ unsigned int id, uint16_t offset,
+ const uint8_t *value, size_t len,
+ uint8_t opcode, struct bt_att *att,
+ void *user_data)
+{
+ struct ras *ras = user_data;
+ uint16_t ccc_value;
+ bool is_realtime;
+ uint16_t *this_ccc;
+ uint16_t *other_ccc;
+
+ if (!ras) {
+ gatt_db_attribute_write_result(attrib, id,
+ BT_ATT_ERROR_UNLIKELY);
+ return;
+ }
+
+ if (offset) {
+ gatt_db_attribute_write_result(attrib, id,
+ BT_ATT_ERROR_INVALID_OFFSET);
+ return;
+ }
+
+ if (len != 2) {
+ gatt_db_attribute_write_result(attrib, id,
+ BT_ATT_ERROR_INVALID_ATTRIBUTE_VALUE_LEN);
+ return;
+ }
+
+ ccc_value = get_le16(value);
+
+ if (ccc_value != 0x0000 && ccc_value != 0x0001 &&
+ ccc_value != 0x0002 && ccc_value != 0x0003) {
+ gatt_db_attribute_write_result(attrib, id,
+ BT_ERROR_WRITE_REQUEST_REJECTED);
+ return;
+ }
+
+ /* Determine which CCC this is */
+ is_realtime = (attrib == ras->realtime_chrc_ccc);
+ this_ccc = is_realtime ? &ras->realtime_ccc_value :
+ &ras->ondemand_ccc_value;
+ other_ccc = is_realtime ? &ras->ondemand_ccc_value :
+ &ras->realtime_ccc_value;
+
+ /* Check mutual exclusivity: reject if trying to enable realtime
+ * while ondemand is already enabled.
+ * Test case: RAS/SR/SPE/BI-11-C [Client enables both Real-time
+ * Ranging Data and On-demand Ranging Data notifications or
+ * indications]
+ */
+ if (ccc_value != 0x0000 && *other_ccc != 0x0000) {
+ gatt_db_attribute_write_result(attrib, id,
+ BT_ERROR_CCC_IMPROPERLY_CONFIGURED);
+ return;
+ }
+
+ /* Update state */
+ *this_ccc = ccc_value;
+
+ gatt_db_attribute_write_result(attrib, id, 0);
+}
+
/* Service registration – store attribute pointers */
static struct ras *register_ras_service(struct gatt_db *db)
{
@@ -349,9 +816,9 @@ static struct ras *register_ras_service(struct gatt_db *db)
NULL, NULL, ras);
ras->realtime_chrc_ccc =
- gatt_db_service_add_ccc(ras->svc,
- BT_ATT_PERM_READ |
- BT_ATT_PERM_WRITE);
+ gatt_db_service_add_ccc_custom(ras->svc,
+ BT_ATT_PERM_READ | BT_ATT_PERM_WRITE,
+ ras_ranging_data_ccc_write_cb, ras);
/* On-demand Ranging Data */
bt_uuid16_create(&uuid, RAS_ONDEMAND_DATA_UUID);
@@ -364,8 +831,9 @@ static struct ras *register_ras_service(struct gatt_db *db)
ras_ondemand_read_cb, NULL,
ras);
- gatt_db_service_add_ccc(ras->svc,
- BT_ATT_PERM_READ | BT_ATT_PERM_WRITE);
+ ras->ondemand_ccc = gatt_db_service_add_ccc_custom(ras->svc,
+ BT_ATT_PERM_READ | BT_ATT_PERM_WRITE,
+ ras_ranging_data_ccc_write_cb, ras);
/* RAS Control Point */
bt_uuid16_create(&uuid, RAS_CONTROL_POINT_UUID);
@@ -379,8 +847,8 @@ static struct ras *register_ras_service(struct gatt_db *db)
ras_control_point_write_cb,
ras);
- gatt_db_service_add_ccc(ras->svc,
- BT_ATT_PERM_READ | BT_ATT_PERM_WRITE);
+ ras->cp_ccc = gatt_db_service_add_ccc(ras->svc,
+ BT_ATT_PERM_READ | BT_ATT_PERM_WRITE);
/* RAS Data Ready */
bt_uuid16_create(&uuid, RAS_DATA_READY_UUID);
@@ -394,8 +862,8 @@ static struct ras *register_ras_service(struct gatt_db *db)
ras_data_ready_read_cb, NULL,
ras);
- gatt_db_service_add_ccc(ras->svc,
- BT_ATT_PERM_READ | BT_ATT_PERM_WRITE);
+ ras->ready_ccc = gatt_db_service_add_ccc(ras->svc,
+ BT_ATT_PERM_READ | BT_ATT_PERM_WRITE);
/* RAS Data Overwritten */
bt_uuid16_create(&uuid, RAS_DATA_OVERWRITTEN_UUID);
@@ -409,8 +877,8 @@ static struct ras *register_ras_service(struct gatt_db *db)
ras_data_overwritten_read_cb,
NULL, ras);
- gatt_db_service_add_ccc(ras->svc,
- BT_ATT_PERM_READ | BT_ATT_PERM_WRITE);
+ ras->overwritten_ccc = gatt_db_service_add_ccc(ras->svc,
+ BT_ATT_PERM_READ | BT_ATT_PERM_WRITE);
/* Activate the service */
gatt_db_service_set_active(ras->svc, true);
@@ -503,32 +971,780 @@ bool bt_rap_unregister(unsigned int id)
return true;
}
+static inline size_t serialize_segmentation_header(
+ const struct segmentation_header *s,
+ uint8_t *out, size_t out_len)
+{
+ if (!s || !out || out_len < 1)
+ return 0;
+
+ out[0] = SEG_HDR_PACK(s->first_segment, s->last_segment,
+ s->rolling_segment_counter);
+
+ return 1;
+}
+
+static inline bool serialize_ranging_header_iov(const struct ranging_header *r,
+ struct iovec *iov)
+{
+ if (!r || !iov)
+ return false;
+
+ /* Serialize the per-byte packed fields using util_iov_push functions */
+ if (!util_iov_push_le16(iov, get_le16(r->counter_config)))
+ return false;
+
+ if (!util_iov_push_u8(iov, r->selected_tx_power))
+ return false;
+
+ if (!util_iov_push_u8(iov, r->antenna_pct))
+ return false;
+
+ return true;
+}
+
+static inline uint16_t ras_att_value_payload_max(struct bt_rap *rap)
+{
+ struct bt_att *att = bt_rap_get_att(rap);
+ uint16_t mtu = att ? bt_att_get_mtu(att) : default_ras_mtu;
+
+ return (uint16_t)(mtu > ATT_OVERHEAD ?
+ (mtu - ATT_OVERHEAD - TOTAL_RAS_RANGING_HEADER_SIZE -
+ ras_segment_header_size) : 0);
+}
+
+/* Prepend data to an iovec - optimized to avoid unnecessary malloc/copy
+ * by using realloc and memmove instead of malloc/memcpy/free pattern.
+ * This reduces memory allocations and is more cache-friendly.
+ */
+static bool iov_prepend_bytes(struct iovec *iov, const uint8_t *bytes,
+ size_t len)
+{
+ size_t new_len;
+ void *new_base;
+
+ if (!iov || !bytes || len == 0)
+ return false;
+
+ new_len = iov->iov_len + len;
+
+ /* Use realloc to potentially expand in-place */
+ new_base = realloc(iov->iov_base, new_len);
+
+ if (!new_base)
+ return false;
+
+ /* Move existing data forward to make room at the beginning */
+ if (iov->iov_len > 0)
+ memmove((uint8_t *)new_base + len, new_base, iov->iov_len);
+
+ /* Copy new data to the beginning */
+ memcpy(new_base, bytes, len);
+
+ iov->iov_base = new_base;
+ iov->iov_len = new_len;
+
+ return true;
+}
+
+/* Append the 4-byte RangingHeader to ras_raw_data_ on first segment */
+static bool ras_maybe_prepend_ranging_header(struct cs_procedure_data *d)
+{
+ struct iovec temp_iov = { 0 };
+ bool ok;
+
+ if (!d)
+ return false;
+
+ if (d->ranging_header_prepended_)
+ return false;
+
+ if (!d->segmentation_header_.first_segment)
+ return false;
+
+ if (d->ras_raw_data_index_ != 0)
+ return false;
+
+ temp_iov.iov_base = malloc(4);
+ if (!temp_iov.iov_base)
+ return false;
+ temp_iov.iov_len = 0;
+
+ /* Serialize ranging header into temporary iovec */
+ if (!serialize_ranging_header_iov(&d->ranging_header_, &temp_iov)) {
+ free(temp_iov.iov_base);
+ return false;
+ }
+
+ /* Prepend the serialized header to ras_raw_data_ */
+ ok = iov_prepend_bytes(&d->ras_raw_data_, temp_iov.iov_base,
+ temp_iov.iov_len);
+
+ /* Free temporary iovec buffer */
+ free(temp_iov.iov_base);
+
+ if (ok)
+ d->ranging_header_prepended_ = true;
+
+ return ok;
+}
+
+static void send_ras_segment_data(struct bt_rap *rap,
+ struct cs_procedure_data *proc)
+{
+ struct ras *ras;
+ uint16_t value_max;
+ const uint16_t header_len = ras_segment_header_size;
+ uint16_t raw_payload_size;
+ bool ok;
+
+ if (!rap || !proc)
+ return;
+
+ if (!rap->lrapdb || !rap->lrapdb->ras)
+ return;
+
+ ras = rap->lrapdb->ras;
+ value_max = ras_att_value_payload_max(rap);
+
+ if (value_max == 0) {
+ DBG(rap, "value_max=0 (MTU not available?)");
+ return;
+ }
+
+ if (value_max <= header_len) {
+ DBG(rap, "value_max(%u) too small for header", value_max);
+ return;
+ }
+
+ raw_payload_size = (uint16_t)(value_max - header_len);
+
+ /* Convert tail recursion to loop */
+ while (true) {
+ size_t total_len = proc->ras_raw_data_.iov_len;
+ size_t index = proc->ras_raw_data_index_;
+ size_t unsent_data_size;
+ uint16_t copy_size;
+ uint16_t seg_len;
+ uint8_t *seg;
+ uint16_t wr = 0;
+
+ if (index > total_len)
+ index = total_len;
+
+ unsent_data_size = total_len - index;
+
+ if (unsent_data_size == 0)
+ return;
+
+ /* Set last_segment if procedure complete or fits in segment */
+ if ((proc->local_status != CS_PROC_PARTIAL_RESULTS &&
+ unsent_data_size <= raw_payload_size) ||
+ (proc->contains_complete_subevent_ &&
+ unsent_data_size <= raw_payload_size)) {
+ proc->segmentation_header_.last_segment = 1;
+ } else {
+ proc->segmentation_header_.last_segment = 0;
+ }
+
+ /* Wait for more data if needed and not last segment */
+ if (unsent_data_size < raw_payload_size &&
+ proc->segmentation_header_.last_segment == 0) {
+ DBG(rap, "waiting for more data (unsent=%zu < "
+ "payload=%u)", unsent_data_size,
+ raw_payload_size);
+ return;
+ }
+
+ copy_size = (uint16_t)((unsent_data_size < raw_payload_size) ?
+ unsent_data_size : raw_payload_size);
+ seg_len = (uint16_t)(header_len + copy_size);
+ seg = (uint8_t *)malloc(seg_len);
+
+ if (!seg) {
+ DBG(rap, "OOM (%u)", seg_len);
+ return;
+ }
+
+ wr += (uint16_t)serialize_segmentation_header(
+ &proc->segmentation_header_, seg + wr,
+ seg_len - wr);
+ memcpy(seg + wr,
+ (const uint8_t *)proc->ras_raw_data_.iov_base + index,
+ copy_size);
+ wr += copy_size;
+
+ /* Try sending to real-time characteristic */
+ if (ras->realtime_chrc)
+ ok = gatt_db_attribute_notify(ras->realtime_chrc, seg,
+ wr, bt_rap_get_att(rap));
+
+ /* Try sending to on-demand characteristic */
+ if (ras->ondemand_chrc)
+ ok = gatt_db_attribute_notify(ras->ondemand_chrc, seg,
+ wr, bt_rap_get_att(rap));
+
+ free(seg);
+
+ if (!ok) {
+ DBG(rap, "Failed to send RAS notification");
+ return;
+ }
+
+ /* Advance read cursor and update segmentation state */
+ proc->ras_raw_data_index_ += copy_size;
+ proc->segmentation_header_.first_segment = 0;
+ proc->segmentation_header_.rolling_segment_counter =
+ (uint8_t)((proc->segmentation_header_
+ .rolling_segment_counter + 1) & 0x3F);
+
+ if (proc->segmentation_header_.last_segment ||
+ proc->ras_raw_data_index_ >=
+ proc->ras_raw_data_.iov_len) {
+ DBG(rap, "RAS clear ras buffers");
+ proc->ras_raw_data_.iov_len = 0;
+ proc->ras_raw_data_index_ = 0;
+ proc->ranging_header_prepended_ = false;
+ return;
+ }
+ }
+}
+
+static inline void resptracker_reset_current_proc(struct cstracker *t)
+{
+ if (!t)
+ return;
+
+ if (t->current_proc) {
+ cs_procedure_data_destroy(t->current_proc);
+ t->current_proc = NULL;
+ }
+}
+
+static void process_cs_mode_zero(struct bt_rap *rap,
+ struct cs_procedure_data *proc,
+ const struct cs_step_data *step,
+ uint8_t idx, uint8_t mode_byte)
+{
+ const uint8_t *payload;
+ uint8_t plen;
+
+ /* Mode 0: use raw structure bytes */
+ payload = (const uint8_t *)&step->step_mode_data;
+ plen = step->step_data_length;
+ cs_pd_ras_append_subevent_bytes(proc, payload, plen);
+ DBG(rap, "step[%u]: mode=0x%02x Mode0 payload_len=%u sent",
+ idx, mode_byte, (unsigned int)plen);
+}
+
+static void process_cs_mode_one(struct bt_rap *rap,
+ struct cs_procedure_data *proc,
+ const struct cs_step_data *step,
+ uint8_t idx, uint8_t mode_byte)
+{
+ const struct cs_mode_one_data *m1 =
+ &step->step_mode_data.mode_one_data;
+ struct cstracker *resptracker = rap->resptracker;
+ struct iovec temp_iov = { 0 };
+ uint16_t time_val;
+ uint32_t pct1;
+ uint32_t pct2;
+ enum cs_role cs_role = resptracker->role;
+ uint8_t cs_rtt_type = resptracker->rtt_type;
+ bool include_pct;
+
+ temp_iov.iov_base = malloc(64);
+ if (!temp_iov.iov_base) {
+ DBG(rap, "Mode1 ERROR: malloc failed!");
+ return;
+ }
+ temp_iov.iov_len = 0;
+
+ include_pct = (cs_rtt_type == 0x01 || cs_rtt_type == 0x02);
+
+ if (!util_iov_push_u8(&temp_iov, m1->packet_quality) ||
+ !util_iov_push_u8(&temp_iov, m1->packet_nadm) ||
+ !util_iov_push_u8(&temp_iov, m1->packet_rssi_dbm))
+ goto done;
+
+ /* Time value (2 bytes LE) - use the appropriate field based on role */
+ if (cs_role == CS_ROLE_REFLECTOR)
+ time_val = m1->tod_toa_refl;
+ else
+ time_val = m1->toa_tod_init;
+
+ if (!util_iov_push_le16(&temp_iov, time_val) ||
+ !util_iov_push_u8(&temp_iov, m1->packet_ant))
+ goto done;
+
+ if (include_pct) {
+ /* PCT1 (3 bytes LE) - 12-bit I + 12-bit Q */
+ pct1 = ((uint32_t)(m1->packet_pct1.i_sample & 0x0FFF)) |
+ (((uint32_t)(m1->packet_pct1.q_sample & 0x0FFF)) <<
+ 12);
+ if (!util_iov_push_le24(&temp_iov, pct1))
+ goto done;
+
+ /* PCT2 (3 bytes LE) */
+ pct2 = ((uint32_t)(m1->packet_pct2.i_sample & 0x0FFF)) |
+ (((uint32_t)(m1->packet_pct2.q_sample & 0x0FFF)) <<
+ 12);
+ if (!util_iov_push_le24(&temp_iov, pct2))
+ goto done;
+ }
+
+ cs_pd_ras_append_subevent_bytes(proc, temp_iov.iov_base,
+ temp_iov.iov_len);
+
+done:
+ free(temp_iov.iov_base);
+
+ DBG(rap, "step[%u]: mode=0x%02x Mode1 serialized payload_len=%zu "
+ "role=%s rtt_type=0x%02x pct=%s",
+ idx, mode_byte, temp_iov.iov_len,
+ cs_role == CS_ROLE_INITIATOR ? "INIT" : "REFL", cs_rtt_type,
+ include_pct ? "YES" : "NO");
+}
+
+static void process_cs_mode_two(struct bt_rap *rap,
+ struct cs_procedure_data *proc,
+ const struct cs_step_data *step,
+ uint8_t num_ant_paths,
+ uint8_t idx, uint8_t mode_byte)
+{
+ const struct cs_mode_two_data *m2 =
+ &step->step_mode_data.mode_two_data;
+ struct iovec temp_iov = { 0 };
+ uint8_t k;
+ uint8_t num_paths = (num_ant_paths + 1) < 5 ?
+ (num_ant_paths + 1) : 5;
+
+ temp_iov.iov_base = malloc(128);
+ if (!temp_iov.iov_base) {
+ DBG(rap, "Mode2 ERROR: malloc failed!");
+ return;
+ }
+ temp_iov.iov_len = 0;
+
+ if (!util_iov_push_u8(&temp_iov, m2->ant_perm_index))
+ goto done;
+
+ /* Serialize each path: PCT (3 bytes LE) + quality (1 byte) */
+ for (k = 0; k < num_paths; k++) {
+ /* Convert 4-byte structure PCT to 3-byte wire format */
+ uint32_t pct = ((uint32_t)(m2->tone_pct[k].i_sample &
+ 0x0FFF)) |
+ (((uint32_t)(m2->tone_pct[k].q_sample &
+ 0x0FFF)) << 12);
+ if (!util_iov_push_le24(&temp_iov, pct) ||
+ !util_iov_push_u8(&temp_iov,
+ m2->tone_quality_indicator[k]))
+ goto done;
+ }
+
+ cs_pd_ras_append_subevent_bytes(proc, temp_iov.iov_base,
+ temp_iov.iov_len);
+
+done:
+ free(temp_iov.iov_base);
+
+ DBG(rap, "step[%u]: mode=0x%02x Mode2 serialized payload_len=%zu "
+ "paths=%u",
+ idx, mode_byte, temp_iov.iov_len, num_paths);
+}
+
+static void process_cs_mode_three(struct bt_rap *rap,
+ struct cs_procedure_data *proc,
+ const struct cs_step_data *step,
+ uint8_t num_ant_paths,
+ uint8_t idx, uint8_t mode_byte)
+{
+ const struct cs_mode_three_data *m3 =
+ &step->step_mode_data.mode_three_data;
+ const struct cs_mode_one_data *m1 = &m3->mode_one_data;
+ const struct cs_mode_two_data *m2 = &m3->mode_two_data;
+ struct cstracker *resptracker = rap->resptracker;
+ struct iovec temp_iov = { 0 };
+ uint16_t time_val;
+ uint32_t pct1;
+ uint32_t pct2;
+ enum cs_role cs_role = resptracker->role;
+ uint8_t cs_rtt_type = resptracker->rtt_type;
+ uint8_t k;
+ uint8_t num_paths = (num_ant_paths + 1) < 5 ?
+ (num_ant_paths + 1) : 5;
+ bool include_pct;
+
+ temp_iov.iov_base = malloc(128);
+ if (!temp_iov.iov_base) {
+ DBG(rap, "Mode3 ERROR: malloc failed!");
+ return;
+ }
+ temp_iov.iov_len = 0;
+
+ /* Determine if PCT samples should be included */
+ include_pct = (cs_rtt_type == 0x01 || cs_rtt_type == 0x02);
+
+ if (!util_iov_push_u8(&temp_iov, m1->packet_quality) ||
+ !util_iov_push_u8(&temp_iov, m1->packet_nadm) ||
+ !util_iov_push_u8(&temp_iov, m1->packet_rssi_dbm))
+ goto done;
+
+ /* Time value (2 bytes LE) - use the appropriate field based on role */
+ if (cs_role == CS_ROLE_REFLECTOR)
+ time_val = m1->tod_toa_refl;
+ else
+ time_val = m1->toa_tod_init;
+
+ if (!util_iov_push_le16(&temp_iov, time_val) ||
+ !util_iov_push_u8(&temp_iov, m1->packet_ant))
+ goto done;
+
+ /* PCT samples if RTT type contains sounding sequence */
+ if (include_pct) {
+ /* PCT1 (3 bytes LE) - 12-bit I + 12-bit Q */
+ pct1 = ((uint32_t)(m1->packet_pct1.i_sample & 0x0FFF)) |
+ (((uint32_t)(m1->packet_pct1.q_sample & 0x0FFF)) <<
+ 12);
+
+ if (!util_iov_push_le24(&temp_iov, pct1))
+ goto done;
+
+ /* PCT2 (3 bytes LE) */
+ pct2 = ((uint32_t)(m1->packet_pct2.i_sample & 0x0FFF)) |
+ (((uint32_t)(m1->packet_pct2.q_sample & 0x0FFF)) <<
+ 12);
+
+ if (!util_iov_push_le24(&temp_iov, pct2))
+ goto done;
+ }
+
+ if (!util_iov_push_u8(&temp_iov, m2->ant_perm_index))
+ goto done;
+
+ for (k = 0; k < num_paths; k++) {
+ /* Convert 4-byte structure PCT to 3-byte wire format */
+ uint32_t pct = ((uint32_t)(m2->tone_pct[k].i_sample &
+ 0x0FFF)) |
+ (((uint32_t)(m2->tone_pct[k].q_sample &
+ 0x0FFF)) << 12);
+ if (!util_iov_push_le24(&temp_iov, pct) ||
+ !util_iov_push_u8(&temp_iov,
+ m2->tone_quality_indicator[k]))
+ goto done;
+ }
+
+ cs_pd_ras_append_subevent_bytes(proc, temp_iov.iov_base,
+ temp_iov.iov_len);
+
+done:
+ free(temp_iov.iov_base);
+
+ DBG(rap, "=== Mode3 END: step[%u] payload_len=%zu paths=%u role=%s "
+ "rtt_type=0x%02x pct=%s ===",
+ idx, temp_iov.iov_len, num_paths,
+ cs_role == CS_ROLE_INITIATOR ? "INIT" : "REFL",
+ cs_rtt_type, include_pct ? "YES" : "NO");
+}
+
+static void process_cs_mode_step(struct bt_rap *rap,
+ struct cs_procedure_data *proc,
+ const struct cs_step_data *step,
+ uint8_t num_ant_paths,
+ uint8_t idx)
+{
+ const uint8_t mode = step->step_mode;
+ const uint8_t payload_len = step->step_data_length;
+ uint8_t mode_byte;
+ uint8_t mode_type;
+ const uint8_t *payload;
+ uint8_t plen;
+ bool step_aborted;
+
+ /* Check if step is aborted: bit 7 of step_mode or 0 payload len */
+ step_aborted = (mode & RAS_STEP_ABORTED_BIT) || (payload_len == 0);
+
+ DBG(rap, "step[%u]: mode=0x%02x channel=%u payload_len=%u "
+ "aborted=%s", idx, mode, step->step_chnl, payload_len,
+ step_aborted ? "YES" : "NO");
+
+ mode_byte = step->step_mode;
+
+ if (step_aborted) {
+ /* Ensure abort bit is set */
+ mode_byte |= RAS_STEP_ABORTED_BIT;
+ cs_pd_ras_append_subevent_bytes(proc, &mode_byte, 1);
+ /* No payload when aborted - per RAS spec Table 3.8 */
+ DBG(rap, "step[%u]: mode=0x%02x aborted, no payload sent",
+ idx, mode_byte);
+ return;
+ }
+
+ mode_type = mode & 0x03;
+
+ /* Mode byte first (without abort bit) */
+ cs_pd_ras_append_subevent_bytes(proc, &mode_byte, 1);
+
+ switch (mode_type) {
+ case CS_MODE_ZERO:
+ process_cs_mode_zero(rap, proc, step, idx, mode_byte);
+ break;
+ case CS_MODE_ONE:
+ process_cs_mode_one(rap, proc, step, idx, mode_byte);
+ break;
+ case CS_MODE_TWO:
+ process_cs_mode_two(rap, proc, step, num_ant_paths, idx,
+ mode_byte);
+ break;
+ case CS_MODE_THREE:
+ process_cs_mode_three(rap, proc, step, num_ant_paths, idx,
+ mode_byte);
+ break;
+ default:
+ /* Unknown mode: use raw structure bytes */
+ payload = (const uint8_t *)&step->step_mode_data;
+ plen = step->step_data_length;
+ cs_pd_ras_append_subevent_bytes(proc, payload, plen);
+ DBG(rap, "step[%u]: mode=0x%02x unknown mode, "
+ "payload_len=%u sent",
+ idx, mode_byte, (unsigned int)plen);
+ break;
+ }
+}
+
+/* Unified local subevent handler */
+static void handle_local_subevent_result(struct bt_rap *rap,
+ bool has_header_fields,
+ uint8_t config_id,
+ uint8_t num_ant_paths,
+ uint16_t proc_counter,
+ uint16_t start_acl_conn_evt_counter,
+ uint16_t freq_comp,
+ int8_t ref_pwr_lvl,
+ uint8_t proc_done_status,
+ uint8_t subevt_done_status,
+ uint8_t abort_reason,
+ uint8_t num_steps_reported,
+ const void *step_bytes)
+{
+ struct cstracker *resptracker;
+ struct cs_procedure_data *proc;
+ const struct cs_step_data *steps;
+ uint8_t idx;
+
+ if (!rap || !rap->resptracker || !step_bytes)
+ return;
+
+ resptracker = rap->resptracker;
+
+ if (resptracker->current_proc) {
+ struct cs_procedure_data *cur = resptracker->current_proc;
+
+ if (has_header_fields && cur->counter != proc_counter) {
+ /* Safety: a new procedure; destroy the previous one */
+ resptracker_reset_current_proc(resptracker);
+ }
+ }
+
+ proc = resptracker->current_proc;
+ /* Cache header info from a RESULT event for later CONT usage */
+ if (has_header_fields) {
+ resptracker->last_proc_counter = proc_counter;
+ resptracker->last_start_acl_conn_evt_counter =
+ start_acl_conn_evt_counter;
+ resptracker->last_freq_comp = freq_comp;
+ resptracker->last_ref_pwr_lvl = ref_pwr_lvl;
+ }
+
+ /* Create the procedure on first use */
+ if (!proc) {
+ uint16_t create_counter = has_header_fields ? proc_counter :
+ resptracker->last_proc_counter;
+
+ proc = cs_procedure_data_create(create_counter,
+ num_ant_paths,
+ config_id,
+ resptracker->selected_tx_power);
+ if (!proc)
+ return;
+
+ resptracker->current_proc = proc;
+
+ /* Reference power levels and status defaults */
+ cs_pd_set_reference_power_levels(proc,
+ has_header_fields ? ref_pwr_lvl :
+ resptracker->last_ref_pwr_lvl,
+ has_header_fields ? ref_pwr_lvl :
+ resptracker->last_ref_pwr_lvl);
+ cs_pd_set_local_status(proc,
+ (enum cs_procedure_done_status)proc_done_status);
+ cs_pd_set_remote_status(proc,
+ (enum cs_procedure_done_status)subevt_done_status);
+ }
+
+ /* Begin a new RAS subevent only when we have header fields */
+ if (has_header_fields) {
+ cs_pd_ras_begin_subevent(proc,
+ start_acl_conn_evt_counter,
+ freq_comp,
+ ref_pwr_lvl);
+ }
+
+ /* step_bytes points to an array of struct cs_step_data */
+ steps = (const struct cs_step_data *)step_bytes;
+
+ /* Process each step using helper function */
+ for (idx = 0; idx < num_steps_reported; idx++)
+ process_cs_mode_step(rap, proc, &steps[idx], num_ant_paths,
+ idx);
+
+ /* Update status for this chunk */
+ cs_pd_set_local_status(proc,
+ (enum cs_procedure_done_status)proc_done_status);
+ cs_pd_set_remote_status(proc,
+ (enum cs_procedure_done_status)subevt_done_status);
+
+ /* Commit subevent chunk (RESULT or CONT) */
+ cs_pd_ras_commit_subevent(proc,
+ num_steps_reported,
+ proc_done_status,
+ subevt_done_status,
+ abort_reason & 0x0F,
+ (abort_reason >> 4) & 0x0F);
+
+ /* Ensure first segment body starts with the 4-byte RangingHeader */
+ ras_maybe_prepend_ranging_header(proc);
+
+ if (subevt_done_status != SUBEVENT_DONE_PARTIAL_RESULTS)
+ /* Send RAS raw segment data */
+ send_ras_segment_data(rap, proc);
+
+ /* Procedure complete? Clean up */
+ if (proc_done_status == CS_PROC_ALL_RESULTS_COMPLETE) {
+ DBG(rap, "Destroying CsProcedureData counter=%u and "
+ "clearing current_proc", proc->counter);
+ resptracker_reset_current_proc(resptracker);
+ /* Reset cached header values for next procedure */
+ resptracker->last_proc_counter = 0;
+ resptracker->last_start_acl_conn_evt_counter = 0;
+ resptracker->last_freq_comp = 0;
+ resptracker->last_ref_pwr_lvl = 0;
+ }
+}
+
+static void form_ras_data_with_cs_subevent_result(struct bt_rap *rap,
+ const struct rap_ev_cs_subevent_result *data,
+ uint16_t length)
+{
+ size_t base_len = offsetof(struct rap_ev_cs_subevent_result,
+ step_data);
+
+ if (!rap || !rap->resptracker || !data)
+ return;
+
+ /* Defensive check: base header must be present */
+ if (length < base_len)
+ return;
+
+ DBG(rap, "Received CS subevent result subevent: len=%d", length);
+
+ handle_local_subevent_result(rap,
+ true, /* has header fields */
+ data->config_id,
+ data->num_ant_paths,
+ data->proc_counter,
+ data->start_acl_conn_evt_counter,
+ data->freq_comp,
+ data->ref_pwr_lvl,
+ data->proc_done_status,
+ data->subevt_done_status,
+ data->abort_reason,
+ data->num_steps_reported,
+ data->step_data); /* start of steps */
+}
+
+static void form_ras_data_with_cs_subevent_result_cont(struct bt_rap *rap,
+ const struct rap_ev_cs_subevent_result_cont *cont,
+ uint16_t length)
+{
+ size_t base_len = offsetof(struct rap_ev_cs_subevent_result_cont,
+ step_data);
+ struct cstracker *resptracker;
+
+ if (!rap || !rap->resptracker || !cont)
+ return;
+
+ if (length < base_len)
+ return;
+
+ DBG(rap, "Received CS subevent result continue subevent: len=%d",
+ length);
+
+ resptracker = rap->resptracker;
+
+ /* Use cached header values captured from the last RESULT event */
+ handle_local_subevent_result(rap,
+ false, /* CONT has no header fields */
+ cont->config_id,
+ cont->num_ant_paths,
+ resptracker->last_proc_counter,
+ resptracker->last_start_acl_conn_evt_counter,
+ resptracker->last_freq_comp,
+ resptracker->last_ref_pwr_lvl,
+ cont->proc_done_status,
+ cont->subevt_done_status,
+ cont->abort_reason,
+ cont->num_steps_reported,
+ cont->step_data);
+}
+
void bt_rap_hci_cs_subevent_result_cont_callback(uint16_t length,
const void *param,
void *user_data)
{
+ const struct rap_ev_cs_subevent_result_cont *cont = param;
struct bt_rap *rap = user_data;
DBG(rap, "Received CS subevent CONT: len=%d", length);
+
+ form_ras_data_with_cs_subevent_result_cont(rap, cont, length);
}
void bt_rap_hci_cs_subevent_result_callback(uint16_t length,
const void *param,
void *user_data)
{
+ const struct rap_ev_cs_subevent_result *data = param;
struct bt_rap *rap = user_data;
DBG(rap, "Received CS subevent: len=%d", length);
+
+ /* Populate CsProcedureData and send RAS payload */
+ form_ras_data_with_cs_subevent_result(rap, data, length);
}
void bt_rap_hci_cs_procedure_enable_complete_callback(uint16_t length,
const void *param,
void *user_data)
{
+ const struct rap_ev_cs_proc_enable_cmplt *data = param;
struct bt_rap *rap = user_data;
+ struct cstracker *resptracker;
DBG(rap, "Received CS procedure enable complete subevent: len=%d",
length);
+
+ if (!rap->resptracker) {
+ resptracker = new0(struct cstracker, 1);
+ cs_tracker_init(resptracker);
+ rap->resptracker = resptracker;
+ }
+
+ resptracker = rap->resptracker;
+
+ /* Populate responder tracker */
+ resptracker->config_id = data->config_id;
+ resptracker->selected_tx_power = data->sel_tx_pwr;
}
void bt_rap_hci_cs_sec_enable_complete_callback(uint16_t length,
@@ -544,9 +1760,27 @@ void bt_rap_hci_cs_config_complete_callback(uint16_t length,
const void *param,
void *user_data)
{
+ const struct rap_ev_cs_config_cmplt *data = param;
struct bt_rap *rap = user_data;
+ struct cstracker *resptracker;
+
+ if (!rap)
+ return;
DBG(rap, "Received CS config complete subevent: len=%d", length);
+
+ if (!rap->resptracker) {
+ resptracker = new0(struct cstracker, 1);
+ cs_tracker_init(resptracker);
+ rap->resptracker = resptracker;
+ }
+
+ resptracker = rap->resptracker;
+
+ /* Basic fields */
+ resptracker->config_id = data->config_id;
+ resptracker->role = data->role;
+ resptracker->rtt_type = data->rtt_type;
}
struct bt_rap *bt_rap_new(struct gatt_db *ldb, struct gatt_db *rdb)
@@ -786,7 +2020,7 @@ bool bt_rap_attach(struct bt_rap *rap, struct bt_gatt_client *client)
bt_uuid16_create(&uuid, RAS_UUID16);
- gatt_db_foreach_service(rap->lrapdb->db, &uuid,
+ gatt_db_foreach_service(rap->rrapdb->db, &uuid,
foreach_rap_service, rap);
return true;
diff --git a/src/shared/rap.h b/src/shared/rap.h
index 15ddea295..c9431aecd 100644
--- a/src/shared/rap.h
+++ b/src/shared/rap.h
@@ -97,11 +97,11 @@ struct cs_mode_zero_data {
struct cs_mode_one_data {
uint8_t packet_quality;
- uint8_t packet_rssi_dbm;
- uint8_t packet_ant;
uint8_t packet_nadm;
+ uint8_t packet_rssi_dbm;
int16_t toa_tod_init;
int16_t tod_toa_refl;
+ uint8_t packet_ant;
struct pct_iq_sample packet_pct1;
struct pct_iq_sample packet_pct2;
};
--
2.34.1
^ permalink raw reply related
* [PATCH BlueZ v7 2/3] unit/test-rap: Add PTS tests for CS reflector
From: Prathibha Madugonde @ 2026-04-30 7:41 UTC (permalink / raw)
To: linux-bluetooth; +Cc: luiz.dentz, quic_mohamull, quic_hbandi, quic_anubhavg
In-Reply-To: <20260430074142.3599484-1-prathm@qti.qualcomm.com>
[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #1: Type: text/plain; charset=UTF-8, Size: 13700 bytes --]
From: Prathibha Madugonde <prathibha.madugonde@oss.qualcomm.com>
Added below RAS - Real time Ranging PTS testcases:
RAS/SR/RCO/BV-01-C [Characteristic Read - RAS Features]
RAS/SR/RRD/BV-01-C [Real-time Ranging Data]
RAS/SR/RRD/BV-03-C [Real-time Ranging Data notifications and indications]
RAS/SR/RRD/BV-05-C [Real-Time Ranging Data disconnection]
RAS/SR/SPE/BI-11-C [Client enables both Real-time and On-demand]
---
unit/test-rap.c | 325 +++++++++++++++++++++++++++++++++++++++++++++++-
1 file changed, 322 insertions(+), 3 deletions(-)
diff --git a/unit/test-rap.c b/unit/test-rap.c
index 884cb1c96..4ca4a715e 100644
--- a/unit/test-rap.c
+++ b/unit/test-rap.c
@@ -37,6 +37,7 @@ struct test_data_ras {
size_t iovcnt;
struct iovec *iov;
unsigned int ras_id;
+ struct bt_rap *rap; /* Store rap instance for CS injection */
};
struct test_data_rap {
@@ -68,8 +69,8 @@ struct notify {
do { \
const struct iovec iov[] = { args }; \
static struct test_data_ras data; \
- data.iovcnt = ARRAY_SIZE(iov_data(args)); \
- data.iov = util_iov_dup(iov, ARRAY_SIZE(iov_data(args))); \
+ data.iovcnt = ARRAY_SIZE(iov); \
+ data.iov = util_iov_dup(iov, ARRAY_SIZE(iov)); \
tester_add(name, &data, NULL, function, \
test_teardown_ras); \
} while (0)
@@ -155,6 +156,94 @@ static void gatt_notify_cb(struct gatt_db_attribute *attrib,
printf("%s: Failed to send notification\n", __func__);
}
+static void gatt_ccc_write_cb(struct gatt_db_attribute *attrib,
+ unsigned int id, uint16_t offset,
+ const uint8_t *value, size_t len,
+ uint8_t opcode, struct bt_att *att,
+ void *user_data)
+{
+ struct test_data_ras *data = user_data;
+ struct ccc_state *ccc;
+ uint16_t handle;
+ uint16_t ccc_value;
+ uint8_t ecode = 0;
+
+ handle = gatt_db_attribute_get_handle(attrib);
+
+ if (offset) {
+ ecode = BT_ATT_ERROR_INVALID_OFFSET;
+ goto done;
+ }
+
+ if (len != 2) {
+ ecode = BT_ATT_ERROR_INVALID_ATTRIBUTE_VALUE_LEN;
+ goto done;
+ }
+
+ ccc_value = get_le16(value);
+
+ ccc = get_ccc_state(data, handle);
+ if (!ccc) {
+ ecode = BT_ATT_ERROR_UNLIKELY;
+ goto done;
+ }
+
+ ccc->value = ccc_value;
+
+ /* Send write response first */
+ gatt_db_attribute_write_result(attrib, id, 0);
+
+ /* If notifications/indications enabled on Real-time Ranging Data CCCD,
+ * inject fake HCI CS subevent data to trigger notifications
+ */
+ if (handle == 0x0006 && ccc_value != 0x0000 && data->rap) {
+ size_t event_size = sizeof(struct rap_ev_cs_subevent_result) +
+ sizeof(struct cs_step_data);
+ struct rap_ev_cs_subevent_result *fake_event;
+ struct cs_mode_zero_data *mode_zero;
+
+ if (tester_use_debug())
+ tester_debug("Injecting fake CS data...");
+
+ fake_event = g_malloc0(event_size);
+ if (!fake_event)
+ return; /* Already sent write response */
+
+ /* Fill in the header fields */
+ fake_event->conn_hdl = 0x0001;
+ fake_event->config_id = 0x01;
+ fake_event->start_acl_conn_evt_counter = 0x0000;
+ fake_event->proc_counter = 0x0001;
+ fake_event->freq_comp = 0x0000;
+ fake_event->ref_pwr_lvl = 0x00;
+ fake_event->proc_done_status = 0x00;
+ fake_event->subevt_done_status = 0x00;
+ fake_event->abort_reason = 0x00;
+ fake_event->num_ant_paths = 0x01;
+ fake_event->num_steps_reported = 0x01;
+
+ fake_event->step_data[0].step_mode = CS_MODE_ZERO;
+ fake_event->step_data[0].step_chnl = 0x00;
+ /* Mode 0: 1+1+1+4 bytes */
+ fake_event->step_data[0].step_data_length = 4;
+mode_zero = &fake_event->step_data[0].step_mode_data.mode_zero_data;
+ mode_zero->packet_quality = 0x01;
+ mode_zero->packet_rssi_dbm = 0x02;
+ mode_zero->packet_ant = 0x03;
+ mode_zero->init_measured_freq_offset = 0x04;
+
+ /* Inject the fake event to trigger notification */
+ bt_rap_hci_cs_subevent_result_callback(event_size, fake_event,
+ data->rap);
+
+ g_free(fake_event);
+ }
+ return;
+
+done:
+ gatt_db_attribute_write_result(attrib, id, ecode);
+}
+
static void gatt_ccc_read_cb(struct gatt_db_attribute *attrib,
unsigned int id, uint16_t offset,
uint8_t opcode, struct bt_att *att,
@@ -184,10 +273,21 @@ done:
static void ras_attached(struct bt_rap *rap, void *user_data)
{
+ struct test_data_ras *data = user_data;
+
+ if (data) {
+ data->rap = rap;
+ bt_rap_ref(rap); /* Keep a reference */
+ }
}
static void ras_detached(struct bt_rap *rap, void *user_data)
{
+ struct test_data_ras *data = user_data;
+
+ if (data && data->rap == rap)
+ data->rap = NULL;
+
bt_rap_unref(rap);
}
@@ -205,12 +305,13 @@ static void test_server(const void *user_data)
att = bt_att_new(io_get_fd(io), false);
g_assert(att);
+ bt_att_set_security(att, BT_ATT_SECURITY_MEDIUM);
bt_att_set_debug(att, BT_ATT_DEBUG, print_debug, "bt_att:", NULL);
data->db = gatt_db_new();
g_assert(data->db);
- gatt_db_ccc_register(data->db, gatt_ccc_read_cb, NULL,
+ gatt_db_ccc_register(data->db, gatt_ccc_read_cb, gatt_ccc_write_cb,
gatt_notify_cb, data);
bt_rap_add_db(data->db);
@@ -426,6 +527,210 @@ static void test_server(const void *user_data)
DISC_RAS_CHAR_AFTER_TYPE, \
RAS_FIND_INFO
+/*
+ * RAS/SR/RCO/BV-01-C – Characteristic Read: RAS Features
+ *
+ * ATT: Read Request (0x0a) len 2
+ * Handle: 0x0003 (RAS Features value handle)
+ *
+ * ATT: Read Response (0x0b) len 5
+ * Value: 0x01 0x00 0x00 0x00
+ * Feature bits:
+ * Bit 0: Real-time ranging (1 = supported)
+ * Bit 1: Retrieve stored results (0 = not supported)
+ * Bit 2: Abort operation (0 = not supported)
+ *
+ * Note: The RAS Features characteristic is registered with
+ * BT_ATT_PERM_READ | BT_ATT_PERM_READ_ENCRYPT. Since the test sets
+ * BT_ATT_SECURITY_MEDIUM, the encryption requirement is satisfied
+ * and the server returns the feature value showing real-time ranging
+ * support.
+ */
+
+#define ATT_READ_RAS_FEATURES \
+ IOV_DATA(0x0a, 0x03, 0x00), \
+ IOV_DATA(0x0b, 0x01, 0x00, 0x00, 0x00)
+
+#define RAS_SR_RCO_BV_01_C \
+ ATT_EXCHANGE_MTU, \
+ DISCOVER_PRIM_SERV_NOTIF, \
+ RAS_FIND_BY_TYPE_VALUE, \
+ DISC_RAS_CHAR_AFTER_TYPE, \
+ RAS_FIND_INFO, \
+ ATT_READ_RAS_FEATURES
+
+/*
+ * RAS Real-time Ranging Data CCCD Configuration
+ * Round 1: Enable/Disable notifications (CCCD = 0x0001)
+ * Round 2: Enable/Disable indications (CCCD = 0x0002)
+ */
+#define RAS_REALTIME_CCCD_CONFIG \
+ /* Round 1: Enable notifications on Real-time Ranging Data CCCD */ \
+ /* (handle 0x0006) */ \
+ IOV_DATA(0x12, 0x06, 0x00, 0x01, 0x00), \
+ IOV_DATA(0x13), \
+ /* Disable notifications */ \
+ IOV_DATA(0x12, 0x06, 0x00, 0x00, 0x00), \
+ IOV_DATA(0x13), \
+ /* Round 2: Enable indications on Real-time Ranging Data CCCD */ \
+ IOV_DATA(0x12, 0x06, 0x00, 0x02, 0x00), \
+ IOV_DATA(0x13), \
+ /* Disable indications */ \
+ IOV_DATA(0x12, 0x06, 0x00, 0x00, 0x00), \
+ IOV_DATA(0x13)
+
+/*
+ * Enable both notifications and indications (CCCD = 0x0003)
+ * Expect notification (0x1b) to be sent, not indication (0x1d)
+ * Then disable CCCD
+ *
+ * Note: This test is currently disabled because the GATT server rejects
+ * CCCD value 0x0003 (both notifications and indications enabled) before
+ * reaching the custom callback. The test infrastructure needs to be updated
+ * to support this scenario.
+ */
+#define RAS_REALTIME_CCCD_BOTH_ENABLE_DISABLE \
+ /* Enable notifications only (CCCD = 0x0001) */ \
+ IOV_DATA(0x12, 0x06, 0x00, 0x01, 0x00), \
+ IOV_DATA(0x13), \
+ /* Disable CCCD */ \
+ IOV_DATA(0x12, 0x06, 0x00, 0x00, 0x00), \
+ IOV_DATA(0x13)
+
+/*
+ * Disconnection/Reconnection simulation for Real-time Ranging Data
+ * Enable notifications, disable (disconnect), re-enable (reconnect), disable
+ */
+#define RAS_REALTIME_CCCD_DISCONNECT_RECONNECT \
+ /* Step 1: Enable notifications */ \
+ IOV_DATA(0x12, 0x06, 0x00, 0x01, 0x00), \
+ IOV_DATA(0x13), \
+ /* Step 3: Disable CCCD (simulates disconnection) */ \
+ IOV_DATA(0x12, 0x06, 0x00, 0x00, 0x00), \
+ IOV_DATA(0x13), \
+ /* Step 4: Re-enable notifications (simulates reconnection) */ \
+ IOV_DATA(0x12, 0x06, 0x00, 0x01, 0x00), \
+ IOV_DATA(0x13), \
+ /* Disable CCCD to clean up */ \
+ IOV_DATA(0x12, 0x06, 0x00, 0x00, 0x00), \
+ IOV_DATA(0x13)
+
+/*
+ * RAS/SR/RRD/BV-01-C [Real-time Ranging Data]
+ * Verify that the IUT can configure CCCD for notifications/indications
+ * of the Real-time Ranging Data characteristic.
+ */
+#define RAS_SR_RRD_BV_01_C \
+ ATT_EXCHANGE_MTU, \
+ DISCOVER_PRIM_SERV_NOTIF, \
+ RAS_FIND_BY_TYPE_VALUE, \
+ DISC_RAS_CHAR_AFTER_TYPE, \
+ RAS_FIND_INFO, \
+ RAS_REALTIME_CCCD_CONFIG
+
+/*
+ * RAS/SR/RRD/BV-03-C [Real-time Ranging Data notifications and indications]
+ * Verify that the IUT only sends Real-time Ranging Data notifications when
+ * configured for both notifications and indications (CCCD = 0x0003).
+ *
+ * Test Procedure:
+ * 1. Write 0x0003 to Real-time Ranging Data CCCD (enable both
+ * notifications and indications)
+ * 2. Trigger CS Subevent Data (via fake HCI event injection)
+ * 3. Verify IUT sends only notifications (0x1b), not indications (0x1d)
+ */
+#define RAS_SR_RRD_BV_03_C \
+ ATT_EXCHANGE_MTU, \
+ DISCOVER_PRIM_SERV_NOTIF, \
+ RAS_FIND_BY_TYPE_VALUE, \
+ DISC_RAS_CHAR_AFTER_TYPE, \
+ RAS_FIND_INFO, \
+ RAS_REALTIME_CCCD_BOTH_ENABLE_DISABLE
+
+/*
+ * RAS/SR/RRD/BV-05-C [Real-Time Ranging Data disconnection]
+ * Verify that the IUT does not resume sending Real-time Ranging Data
+ * notifications or indications after a disconnection occurs.
+ *
+ * Test Procedure:
+ * 1. Enable Real-time Ranging Data notifications
+ * 2. Trigger CS Subevent Data (IUT sends notifications)
+ * 3. Disable CCCD (simulates disconnection - CCCD resets to 0x0000)
+ * 4. Re-enable notifications (simulates reconnection and reconfiguration)
+ * 5. Verify IUT does not send old ranging data
+ *
+ * Note: In a unit test, we simulate disconnection by disabling and re-enabling
+ * the CCCD. The RAP implementation should clear any pending data when CCCD is
+ * disabled, ensuring no old data is sent after re-enabling.
+ */
+#define RAS_SR_RRD_BV_05_C \
+ ATT_EXCHANGE_MTU, \
+ DISCOVER_PRIM_SERV_NOTIF, \
+ RAS_FIND_BY_TYPE_VALUE, \
+ DISC_RAS_CHAR_AFTER_TYPE, \
+ RAS_FIND_INFO, \
+ RAS_REALTIME_CCCD_DISCONNECT_RECONNECT
+
+/*
+ * RAS/SR/SPE/BI-11-C [Client enables both Real-time Ranging Data and
+ * On-demand Ranging Data notifications or indications]
+ *
+ * Test Purpose:
+ * Verify that the IUT responds with the Client Characteristic Configuration
+ * Descriptor Improperly Configured error when both Real-time Ranging Data
+ * and On-demand Ranging Data notifications or indications are enabled.
+ *
+ * Test Procedure:
+ * 1. Write 0x0001 to Real-time Ranging Data CCCD (enable notifications)
+ * 2. Write 0x0001 to On-demand Ranging Data CCCD (should fail with 0xFD)
+ * 3. Read both CCCDs to verify Real-time is 0x0001, On-demand is 0x0000
+ * 4. Write 0x0000 to Real-time Ranging Data CCCD (disable)
+ * 5. Write 0x0001 to On-demand Ranging Data CCCD (enable notifications)
+ * 6. Write 0x0001 to Real-time Ranging Data CCCD (should fail with 0xFD)
+ * 7. Read both CCCDs to verify Real-time is 0x0000, On-demand is 0x0001
+ *
+ * Expected Outcome:
+ * - Steps 2 and 6: IUT rejects with error code 0xFD
+ * - Step 3: Real-time CCCD = 0x0001, On-demand CCCD = 0x0000
+ * - Step 7: Real-time CCCD = 0x0000, On-demand CCCD = 0x0001
+ */
+#define RAS_SR_SPE_BI_11_C \
+ ATT_EXCHANGE_MTU, \
+ DISCOVER_PRIM_SERV_NOTIF, \
+ RAS_FIND_BY_TYPE_VALUE, \
+ DISC_RAS_CHAR_AFTER_TYPE, \
+ RAS_FIND_INFO, \
+ /* Step 1: Enable notifications on Real-time Ranging Data CCCD */ \
+ /* (handle 0x0006) */ \
+ IOV_DATA(0x12, 0x06, 0x00, 0x01, 0x00), \
+ IOV_DATA(0x13), \
+ /* Step 2: Try to enable notifications on On-demand Ranging Data */ \
+ /* CCCD (handle 0x0009) - should fail with 0xFD */ \
+ IOV_DATA(0x12, 0x09, 0x00, 0x01, 0x00), \
+ IOV_DATA(0x01, 0x12, 0x09, 0x00, 0xFD), \
+ /* Step 4: Read Real-time Ranging Data CCCD (should be 0x0001) */ \
+ IOV_DATA(0x0a, 0x06, 0x00), \
+ IOV_DATA(0x0b, 0x01, 0x00), \
+ /* Step 4: Read On-demand Ranging Data CCCD (should be 0x0000) */ \
+ IOV_DATA(0x0a, 0x09, 0x00), \
+ IOV_DATA(0x0b, 0x00, 0x00), \
+ /* Step 5: Disable Real-time Ranging Data CCCD */ \
+ IOV_DATA(0x12, 0x06, 0x00, 0x00, 0x00), \
+ IOV_DATA(0x13), \
+ /* Step 6: Enable notifications on On-demand Ranging Data CCCD */ \
+ IOV_DATA(0x12, 0x09, 0x00, 0x01, 0x00), \
+ IOV_DATA(0x13), \
+ /* Step 7: Try to enable notifications on Real-time Ranging Data */ \
+ /* CCCD - should fail with 0xFD */ \
+ IOV_DATA(0x12, 0x06, 0x00, 0x01, 0x00), \
+ IOV_DATA(0x01, 0x12, 0x06, 0x00, 0xFD), \
+ /* Step 9: Read Real-time Ranging Data CCCD (should be 0x0000) */ \
+ IOV_DATA(0x0a, 0x06, 0x00), \
+ IOV_DATA(0x0b, 0x00, 0x00), \
+ /* Step 9: Read On-demand Ranging Data CCCD (should be 0x0001) */ \
+ IOV_DATA(0x0a, 0x09, 0x00), \
+ IOV_DATA(0x0b, 0x01, 0x00)
+
int main(int argc, char *argv[])
{
tester_init(&argc, &argv);
@@ -441,6 +746,20 @@ int main(int argc, char *argv[])
RAS_SR_SGGIT_CHA_BV_03_C);
define_test_ras("RAS/SR/SGGIT/CHA/BV-04-C", test_server,
RAS_SR_SGGIT_CHA_BV_04_C);
+ /* RAS Read Characteristic Operations */
+ define_test_ras("RAS/SR/RCO/BV-01-C", test_server,
+ RAS_SR_RCO_BV_01_C);
+ /* RAS Real-time Ranging Data */
+ define_test_ras("RAS/SR/RRD/BV-01-C", test_server,
+ RAS_SR_RRD_BV_01_C);
+ /* RAS Real-time Ranging Data with CS injection */
+ define_test_ras("RAS/SR/RRD/BV-03-C", test_server,
+ RAS_SR_RRD_BV_03_C);
+ define_test_ras("RAS/SR/RRD/BV-05-C", test_server,
+ RAS_SR_RRD_BV_05_C);
+ /* RAS Special Procedures - Mutual Exclusivity */
+ define_test_ras("RAS/SR/SPE/BI-11-C", test_server,
+ RAS_SR_SPE_BI_11_C);
return tester_run();
}
--
2.34.1
^ permalink raw reply related
* [PATCH BlueZ v7 3/3] profiles/ranging: Read cs_mode_one_data members
From: Prathibha Madugonde @ 2026-04-30 7:41 UTC (permalink / raw)
To: linux-bluetooth; +Cc: luiz.dentz, quic_mohamull, quic_hbandi, quic_anubhavg
In-Reply-To: <20260430074142.3599484-1-prathm@qti.qualcomm.com>
From: Prathibha Madugonde <prathibha.madugonde@oss.qualcomm.com>
Rearrage reading of cs_mode_one_data struct members as per spec.
---
profiles/ranging/rap_hci.c | 25 ++++++++++++++-----------
1 file changed, 14 insertions(+), 11 deletions(-)
diff --git a/profiles/ranging/rap_hci.c b/profiles/ranging/rap_hci.c
index a3d2df608..08ddc077c 100644
--- a/profiles/ranging/rap_hci.c
+++ b/profiles/ranging/rap_hci.c
@@ -632,19 +632,22 @@ static void parse_mode_one_data(struct iovec *iov,
}
DBG("CS Step mode 1");
- util_iov_pull_u8(iov, &mode_data->packet_quality);
- util_iov_pull_u8(iov, &mode_data->packet_rssi_dbm);
- util_iov_pull_u8(iov, &mode_data->packet_ant);
- util_iov_pull_u8(iov, &mode_data->packet_nadm);
-
- if (iov->iov_len >= 2) {
- util_iov_pull_le16(iov, &time_val);
- if (cs_role == CS_REFLECTOR)
- mode_data->tod_toa_refl = time_val;
- else
- mode_data->toa_tod_init = time_val;
+ /* Parse fixed fields in specification order */
+ if (!util_iov_pull_u8(iov, &mode_data->packet_quality) ||
+ !util_iov_pull_u8(iov, &mode_data->packet_nadm) ||
+ !util_iov_pull_u8(iov, &mode_data->packet_rssi_dbm) ||
+ !util_iov_pull_le16(iov, &time_val) ||
+ !util_iov_pull_u8(iov, &mode_data->packet_ant)) {
+ DBG("Mode 1: failed to parse basic fields");
+ memset(mode_data, 0, sizeof(*mode_data));
+ return;
}
+ if (cs_role == CS_REFLECTOR)
+ mode_data->tod_toa_refl = time_val;
+ else
+ mode_data->toa_tod_init = time_val;
+
if ((cs_rtt_type == 0x01 || cs_rtt_type == 0x02) &&
iov->iov_len >= 6) {
int16_t i_val, q_val;
--
2.34.1
^ permalink raw reply related
* RE: [RFC] Bluetooth: fix Set Public Address on controller in HCI_AUTO_OFF grace period
From: bluez.test.bot @ 2026-04-30 7:49 UTC (permalink / raw)
To: linux-bluetooth, danilklishch
In-Reply-To: <20260430045522.7881-1-danilklishch@gmail.com>
[-- Attachment #1: Type: text/plain, Size: 5075 bytes --]
This is automated email and please do not reply to this email!
Dear submitter,
Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=1087873
---Test result---
Test Summary:
CheckPatch FAIL 0.63 seconds
GitLint FAIL 0.26 seconds
SubjectPrefix PASS 0.09 seconds
BuildKernel PASS 25.03 seconds
CheckAllWarning PASS 27.56 seconds
CheckSparse PASS 26.39 seconds
BuildKernel32 PASS 24.04 seconds
TestRunnerSetup PASS 523.74 seconds
TestRunner_l2cap-tester PASS 27.31 seconds
TestRunner_iso-tester PASS 34.75 seconds
TestRunner_bnep-tester PASS 6.36 seconds
TestRunner_mgmt-tester FAIL 109.68 seconds
TestRunner_rfcomm-tester PASS 9.47 seconds
TestRunner_sco-tester PASS 14.20 seconds
TestRunner_ioctl-tester PASS 9.96 seconds
TestRunner_mesh-tester FAIL 11.22 seconds
TestRunner_smp-tester PASS 8.64 seconds
TestRunner_userchan-tester PASS 6.74 seconds
TestRunner_6lowpan-tester FAIL 8.59 seconds
IncrementalBuild PASS 23.68 seconds
Details
##############################
Test: CheckPatch - FAIL
Desc: Run checkpatch.pl script
Output:
[RFC] Bluetooth: fix Set Public Address on controller in HCI_AUTO_OFF grace period
WARNING: Non-standard signature: Assisted-by:
#148:
Assisted-by: Claude:claude-opus-4-7
ERROR: Unrecognized email address: 'Claude:claude-opus-4-7'
#148:
Assisted-by: Claude:claude-opus-4-7
total: 1 errors, 1 warnings, 0 checks, 14 lines checked
NOTE: For some of the reported defects, checkpatch may be able to
mechanically convert to the typical style using --fix or --fix-inplace.
/github/workspace/src/patch/14548392.patch has style problems, please review.
NOTE: Ignored message types: UNKNOWN_COMMIT_ID
NOTE: If any of the errors are false positives, please report
them to the maintainer, see CHECKPATCH in MAINTAINERS.
##############################
Test: GitLint - FAIL
Desc: Run gitlint
Output:
[RFC] Bluetooth: fix Set Public Address on controller in HCI_AUTO_OFF grace period
WARNING: I3 - ignore-body-lines: gitlint will be switching from using Python regex 'match' (match beginning) to 'search' (match anywhere) semantics. Please review your ignore-body-lines.regex option accordingly. To remove this warning, set general.regex-style-search=True. More details: https://jorisroovers.github.io/gitlint/configuration/#regex-style-search
1: T1 Title exceeds max length (82>80): "[RFC] Bluetooth: fix Set Public Address on controller in HCI_AUTO_OFF grace period"
##############################
Test: TestRunner_mgmt-tester - FAIL
Desc: Run mgmt-tester with test-runner
Output:
Total: 494, Passed: 489 (99.0%), Failed: 1, Not Run: 4
Failed Test Cases
Read Exp Feature - Success Failed 0.096 seconds
##############################
Test: TestRunner_mesh-tester - FAIL
Desc: Run mesh-tester with test-runner
Output:
Total: 10, Passed: 8 (80.0%), Failed: 2, Not Run: 0
Failed Test Cases
Mesh - Send cancel - 1 Timed out 1.834 seconds
Mesh - Send cancel - 2 Timed out 1.995 seconds
##############################
Test: TestRunner_6lowpan-tester - FAIL
Desc: Run 6lowpan-tester with test-runner
Output:
WARNING: possible circular locking dependency detected
7.0.0-rc7-gb8928b8010b2 #1 Not tainted
------------------------------------------------------
kworker/0:1/11 is trying to acquire lock:
ffff888002735940 ((wq_completion)hci0#2){+.+.}-{0:0}, at: touch_wq_lockdep_map+0x75/0x180
but task is already holding lock:
ffffffff9c44faa0 (rtnl_mutex){+.+.}-{4:4}, at: lowpan_unregister_netdev+0xd/0x30
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #4 (rtnl_mutex){+.+.}-{4:4}:
lock_acquire+0xf7/0x2c0
__mutex_lock+0x16b/0x1fc0
lowpan_register_netdev+0x11/0x30
chan_ready_cb+0x836/0xd00
l2cap_recv_frame+0x61bb/0x88e0
l2cap_recv_acldata+0x790/0xdf0
hci_rx_work+0x500/0xd00
process_scheduled_works+0xba7/0x1a90
worker_thread+0x514/0xbb0
kthread+0x368/0x490
ret_from_fork+0x498/0x7e0
ret_from_fork_asm+0x19/0x30
-> #3 (&chan->lock#3/1){+.+.}-{4:4}:
lock_acquire+0xf7/0x2c0
__mutex_lock+0x16b/0x1fc0
l2cap_chan_connect+0x74e/0x1980
lowpan_control_write+0x523/0x660
full_proxy_write+0x10b/0x190
vfs_write+0x1c0/0xf60
ksys_write+0xf1/0x1d0
do_syscall_64+0xa0/0x570
entry_SYSCALL_64_after_hwframe+0x74/0x7c
-> #2 (&conn->lock){+.+.}-{4:4}:
...
Total: 8, Passed: 8 (100.0%), Failed: 0, Not Run: 0
https://github.com/bluez/bluetooth-next/pull/135
---
Regards,
Linux Bluetooth
^ permalink raw reply
* Re: [PATCH v3 0/5] Bluetooth: btusb: fix wakeup irq devres lifetime
From: Johan Hovold @ 2026-04-30 8:22 UTC (permalink / raw)
To: Luiz Augusto von Dentz, Marcel Holtmann; +Cc: linux-bluetooth, linux-kernel
In-Reply-To: <20260402154810.2467291-1-johan@kernel.org>
On Thu, Apr 02, 2026 at 05:48:05PM +0200, Johan Hovold wrote:
> This series fixes a couple of use-after-free issues and a wakeup source
> leak on probe failure and a (currently benign) OOB wakeup interrupt
> devres lifetime issue.
>
> Included is also a related cleanup.
>
> Note that these are intended for 7.1 (e.g. as the fixes are not
> critical) and apply on top of linux-next which has commit 2db5a8b68e31
> ("Bluetooth: btusb: refactor endpoint lookup").
Can these be picked up now (for 7.1 or 7.2)?
Johan
^ permalink raw reply
* [bluez/bluez] 7e38e0: src/shared: Add RAS packet format and notification...
From: prathibhamadugonde @ 2026-04-30 9:25 UTC (permalink / raw)
To: linux-bluetooth
Branch: refs/heads/1087948
Home: https://github.com/bluez/bluez
Commit: 7e38e07ffd061e1b3756bdce628e3b3360f1d551
https://github.com/bluez/bluez/commit/7e38e07ffd061e1b3756bdce628e3b3360f1d551
Author: Prathibha Madugonde <prathibha.madugonde@oss.qualcomm.com>
Date: 2026-04-30 (Thu, 30 Apr 2026)
Changed paths:
M src/shared/rap.c
M src/shared/rap.h
Log Message:
-----------
src/shared: Add RAS packet format and notification support
Implement complete RAS data pipeline:
- Handle HCI CS subevent result/continuation events
- Serialize ranging/subevent headers per spec
- GATT notifications for real-time ranging data
Commit: 293b360d5847a08fe8386972d5e60e9a3e44265d
https://github.com/bluez/bluez/commit/293b360d5847a08fe8386972d5e60e9a3e44265d
Author: Prathibha Madugonde <prathibha.madugonde@oss.qualcomm.com>
Date: 2026-04-30 (Thu, 30 Apr 2026)
Changed paths:
M profiles/ranging/rap_hci.c
Log Message:
-----------
profiles/ranging: Read cs_mode_one_data members
Rearrage reading of cs_mode_one_data struct members as per spec.
Compare: https://github.com/bluez/bluez/compare/7e38e07ffd06%5E...293b360d5847
To unsubscribe from these emails, change your notification settings at https://github.com/bluez/bluez/settings/notifications
^ permalink raw reply
* Re: [PATCH 2/9] arm64: dts: qcom: arduino-imola: Describe boot1 NVMEM layout
From: Krzysztof Kozlowski @ 2026-04-30 9:43 UTC (permalink / raw)
To: Loic Poulain
Cc: Ulf Hansson, Rob Herring, Krzysztof Kozlowski, Conor Dooley,
Bjorn Andersson, Konrad Dybcio, Jens Axboe, Johannes Berg,
Jeff Johnson, Bartosz Golaszewski, Marcel Holtmann,
Luiz Augusto von Dentz, Balakrishna Godavarthi, Rocky Liao,
David S. Miller, Eric Dumazet, Jakub Kicinski, Paolo Abeni,
Simon Horman, linux-mmc, devicetree, linux-kernel, linux-arm-msm,
linux-block, linux-wireless, ath10k, linux-bluetooth, netdev,
daniel
In-Reply-To: <20260428-block-as-nvmem-v1-2-6ad23e75190a@oss.qualcomm.com>
On Tue, Apr 28, 2026 at 04:23:07PM +0200, Loic Poulain wrote:
> On Arduino Uno-Q, the eMMC boot1 partition is factory provisioned
> with device-specific information such as the WiFi MAC address
> and the Bluetooth BD address. This partition can serve as an
> alternative to additional non-volatile memory, such as a
> dedicated EEPROM.
>
> The eMMC boot partitions are typically good candidates, as they
> are realively small, read-only by default (and can be enforced
> as hardware read-only), and are not affected by board reflashing
> procedures, which generally target the eMMC user or GP partitions.
>
> Describe the corresponding nvmem-layout for the WiFi and
> Bluetooth addresses.
>
> Signed-off-by: Loic Poulain <loic.poulain@oss.qualcomm.com>
> ---
> arch/arm64/boot/dts/qcom/qrb2210-arduino-imola.dts | 24 ++++++++++++++++++++++
> 1 file changed, 24 insertions(+)
>
> diff --git a/arch/arm64/boot/dts/qcom/qrb2210-arduino-imola.dts b/arch/arm64/boot/dts/qcom/qrb2210-arduino-imola.dts
> index bf088fa9807f040f0c8f405f9111b01790b09377..dc85cf94f71cac8666cab30ccf37cc2d2f8fd941 100644
> --- a/arch/arm64/boot/dts/qcom/qrb2210-arduino-imola.dts
> +++ b/arch/arm64/boot/dts/qcom/qrb2210-arduino-imola.dts
> @@ -409,7 +409,31 @@ &sdhc_1 {
> no-sdio;
> no-sd;
>
> + #address-cells = <1>;
> + #size-cells = <0>;
> +
> status = "okay";
> +
> + card@0 {
> + compatible = "mmc-card";
> + reg = <0>;
> +
> + partitions-boot1 {
> + nvmem-layout {
This should not be a separate patch. You add the layout AND you use it.
> + compatible = "fixed-layout";
> + #address-cells = <1>;
> + #size-cells = <1>;
> +
> + wifi_mac_addr: mac-addr@4400 {
> + reg = <0x4400 0x6>;
> + };
> +
> + bd_addr: bd-addr@5400 {
> + reg = <0x5400 0x6>;
> + };
> + };
> + };
> + };
> };
>
> &spi5 {
>
> --
> 2.34.1
>
^ permalink raw reply
* Re: [PATCH 1/9] dt-bindings: mmc: Document support for nvmem-layout
From: Krzysztof Kozlowski @ 2026-04-30 9:59 UTC (permalink / raw)
To: Loic Poulain
Cc: Ulf Hansson, Rob Herring, Krzysztof Kozlowski, Conor Dooley,
Bjorn Andersson, Konrad Dybcio, Jens Axboe, Johannes Berg,
Jeff Johnson, Bartosz Golaszewski, Marcel Holtmann,
Luiz Augusto von Dentz, Balakrishna Godavarthi, Rocky Liao,
David S. Miller, Eric Dumazet, Jakub Kicinski, Paolo Abeni,
Simon Horman, linux-mmc, devicetree, linux-kernel, linux-arm-msm,
linux-block, linux-wireless, ath10k, linux-bluetooth, netdev,
daniel
In-Reply-To: <20260428-block-as-nvmem-v1-1-6ad23e75190a@oss.qualcomm.com>
On Tue, Apr 28, 2026 at 04:23:06PM +0200, Loic Poulain wrote:
> + compatible = "fixed-layout";
> +
> + #address-cells = <1>;
> + #size-cells = <1>;
> +
> + mac-addr@4400 {
> + reg = <0x4400 0x6>;
This looks incomplete. Why isn't this mac-base type of entry? And how do
you address it from NVMEM consumer?
> + };
> +
> + bd-addr@5400 {
> + reg = <0x5400 0x6>;
> + };
> + };
> + };
> };
> };
>
>
> --
> 2.34.1
>
^ permalink raw reply
* RE: Add RAS Packet format and Notification support
From: bluez.test.bot @ 2026-04-30 10:21 UTC (permalink / raw)
To: linux-bluetooth, prathibha.madugonde
In-Reply-To: <20260430074142.3599484-2-prathm@qti.qualcomm.com>
[-- Attachment #1: Type: text/plain, Size: 989 bytes --]
This is automated email and please do not reply to this email!
Dear submitter,
Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=1087948
---Test result---
Test Summary:
CheckPatch PASS 1.79 seconds
GitLint PASS 3.43 seconds
BuildEll PASS 20.20 seconds
BluezMake PASS 637.12 seconds
MakeCheck PASS 1.01 seconds
MakeDistcheck PASS 243.36 seconds
CheckValgrind PASS 218.54 seconds
CheckSmatch PASS 346.96 seconds
bluezmakeextell PASS 180.68 seconds
IncrementalBuild PASS 636.66 seconds
ScanBuild PASS 1018.19 seconds
https://github.com/bluez/bluez/pull/2086
---
Regards,
Linux Bluetooth
^ permalink raw reply
* Re: [PATCH 1/9] dt-bindings: mmc: Document support for nvmem-layout
From: Loic Poulain @ 2026-04-30 13:13 UTC (permalink / raw)
To: Krzysztof Kozlowski
Cc: Ulf Hansson, Rob Herring, Krzysztof Kozlowski, Conor Dooley,
Bjorn Andersson, Konrad Dybcio, Jens Axboe, Johannes Berg,
Jeff Johnson, Bartosz Golaszewski, Marcel Holtmann,
Luiz Augusto von Dentz, Balakrishna Godavarthi, Rocky Liao,
David S. Miller, Eric Dumazet, Jakub Kicinski, Paolo Abeni,
Simon Horman, linux-mmc, devicetree, linux-kernel, linux-arm-msm,
linux-block, linux-wireless, ath10k, linux-bluetooth, netdev,
daniel
In-Reply-To: <20260430-bird-of-sheer-ampleness-744e7f@quoll>
Hi Krzysztof,
On Thu, Apr 30, 2026 at 11:59 AM Krzysztof Kozlowski <krzk@kernel.org> wrote:
>
> On Tue, Apr 28, 2026 at 04:23:06PM +0200, Loic Poulain wrote:
>
> > + compatible = "fixed-layout";
> > +
> > + #address-cells = <1>;
> > + #size-cells = <1>;
> > +
> > + mac-addr@4400 {
> > + reg = <0x4400 0x6>;
>
> This looks incomplete. Why isn't this mac-base type of entry? And how do
> you address it from NVMEM consumer?
This indeed falls under the fixed-cell/mac-base type, thanks for
pointing that out.
NVMEM consumers reference these entries using the nvmem-cells
property, via the corresponding label/phandle.
>
> > + };
> > +
> > + bd-addr@5400 {
> > + reg = <0x5400 0x6>;
> > + };
> > + };
> > + };
> > };
> > };
> >
> >
> > --
> > 2.34.1
> >
^ permalink raw reply
* Re: [PATCH BlueZ v2 0/3] Add ability to desynchronized transports for PTS tests
From: patchwork-bot+bluetooth @ 2026-04-30 13:50 UTC (permalink / raw)
To: =?utf-8?b?RnLDqWTDqXJpYyBEYW5pcyA8ZnJlZGVyaWMuZGFuaXNAY29sbGFib3JhLmNvbT4=?=
Cc: linux-bluetooth
In-Reply-To: <20260428080314.180777-1-frederic.danis@collabora.com>
Hello:
This series was applied to bluetooth/bluez.git (master)
by Luiz Augusto von Dentz <luiz.von.dentz@intel.com>:
On Tue, 28 Apr 2026 10:03:11 +0200 you wrote:
> If bluetoothd is started in testing mode a new Desynchronized property
> is added to org.bluez.MediaTransport1, allowing to prevent automatic
> acquire of linked transport objects.
>
> When desynchronized, each transports needs to be acquired separately.
>
> This allows to pass PTS tests BAP/UCL/STR/BV-543-C and BV-546-C which
> requires to connect the ISO streams with one ASE in "Enable" state
> while the other is in "Config QoS" state.
>
> [...]
Here is the summary with links:
- [BlueZ,v2,1/3] audio: Add ability to desynchronized linked transport
(no matching commit)
- [BlueZ,v2,2/3] doc: Add documentation for CIS transport Desynchronized property
https://git.kernel.org/pub/scm/bluetooth/bluez.git/?id=f8a2e6124b36
- [BlueZ,v2,3/3] client/player: Add support to desynchronize linked transports
https://git.kernel.org/pub/scm/bluetooth/bluez.git/?id=304bc5b78a3c
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply
* [bluez/bluez] 1db065: audio: Add ability to desynchronized linked transport
From: fdanis-oss @ 2026-04-30 14:27 UTC (permalink / raw)
To: linux-bluetooth
Branch: refs/heads/master
Home: https://github.com/bluez/bluez
Commit: 1db06505df5a4c8f6626de76f1ca7ba33207df59
https://github.com/bluez/bluez/commit/1db06505df5a4c8f6626de76f1ca7ba33207df59
Author: Frédéric Danis <frederic.danis@collabora.com>
Date: 2026-04-29 (Wed, 29 Apr 2026)
Changed paths:
M profiles/audio/transport.c
Log Message:
-----------
audio: Add ability to desynchronized linked transport
If bluetoothd is started in testing mode a new Desynchronized property
is added, allowing to prevent automatic acquire of linked transport
objects.
When desynchronized, each transports needs to be acquired separately.
This allows to pass PTS tests BAP/UCL/STR/BV-543-C and BV-546-C.
Commit: f8a2e6124b3635e52073c16bb4a8238ac2610e53
https://github.com/bluez/bluez/commit/f8a2e6124b3635e52073c16bb4a8238ac2610e53
Author: Frédéric Danis <frederic.danis@collabora.com>
Date: 2026-04-29 (Wed, 29 Apr 2026)
Changed paths:
M doc/org.bluez.MediaTransport.rst
Log Message:
-----------
doc: Add documentation for CIS transport Desynchronized property
This is only supported when bluetoothd is started in testing mode.
Assisted-by: GPT:GPT-5.3-Codex
Commit: 304bc5b78a3c94af32577abfcf1e5489c5360062
https://github.com/bluez/bluez/commit/304bc5b78a3c94af32577abfcf1e5489c5360062
Author: Frédéric Danis <frederic.danis@collabora.com>
Date: 2026-04-29 (Wed, 29 Apr 2026)
Changed paths:
M client/player.c
Log Message:
-----------
client/player: Add support to desynchronize linked transports
After linked transports has been desynchronized, they should be acquired
separately and read handler should only be started for source local
endpoint.
This is used to pass PTS tests BAP/UCL/STR/BV-543-C and BV-546-C.
Compare: https://github.com/bluez/bluez/compare/278f3439c45f...304bc5b78a3c
To unsubscribe from these emails, change your notification settings at https://github.com/bluez/bluez/settings/notifications
^ permalink raw reply
* Re: [PATCH BlueZ v7 0/3] Add RAS Packet format and Notification support
From: patchwork-bot+bluetooth @ 2026-04-30 14:40 UTC (permalink / raw)
To: Prathibha Madugonde
Cc: linux-bluetooth, luiz.dentz, quic_mohamull, quic_hbandi,
quic_anubhavg
In-Reply-To: <20260430074142.3599484-1-prathm@qti.qualcomm.com>
Hello:
This series was applied to bluetooth/bluez.git (master)
by Luiz Augusto von Dentz <luiz.von.dentz@intel.com>:
On Thu, 30 Apr 2026 13:11:39 +0530 you wrote:
> From: Prathibha Madugonde <prathibha.madugonde@oss.qualcomm.com>
>
> Changes in v7:
> src/shared:
> Replace pointer operations to util_iov operations
> Club ranging counter and config id into one field
> Add helper functions for ranging counter and config id
>
> [...]
Here is the summary with links:
- [BlueZ,v7,1/3] src/shared: Add RAS packet format and notification support
https://git.kernel.org/pub/scm/bluetooth/bluez.git/?id=a9b39d71597d
- [BlueZ,v7,3/3] profiles/ranging: Read cs_mode_one_data members
https://git.kernel.org/pub/scm/bluetooth/bluez.git/?id=5d4792dc2a20
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply
* Re: [PATCH BlueZ v3 0/3] Add RAS Packet format and Notification support
From: patchwork-bot+bluetooth @ 2026-04-30 14:40 UTC (permalink / raw)
To: Prathibha Madugonde
Cc: linux-bluetooth, luiz.dentz, quic_mohamull, quic_hbandi,
quic_anubhavg
In-Reply-To: <20260427113544.1063560-1-prathm@qti.qualcomm.com>
Hello:
This series was applied to bluetooth/bluez.git (master)
by Luiz Augusto von Dentz <luiz.von.dentz@intel.com>:
On Mon, 27 Apr 2026 17:05:41 +0530 you wrote:
> From: Prathibha Madugonde <prathibha.madugonde@oss.qualcomm.com>
>
> Changes in v3:
> Fix for cs_mode_one_data struct members rearrage as per spec
> Reading of cs_mode_one_data in rap_hci.c
> Address cs_mode data struct padding in src/shared/rap.c
>
> [...]
Here is the summary with links:
- [BlueZ,v3,1/3] Add RAS packet formatting and notification support for CS reflector
(no matching commit)
- [BlueZ,v3,3/3] profiles/ranging: Read cs_mode_one_data members as per spec
https://git.kernel.org/pub/scm/bluetooth/bluez.git/?id=5d4792dc2a20
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply
* Re: [PATCH BlueZ v4 0/3] Add RAS Packet format and Notification support
From: patchwork-bot+bluetooth @ 2026-04-30 14:40 UTC (permalink / raw)
To: Prathibha Madugonde
Cc: linux-bluetooth, luiz.dentz, quic_mohamull, quic_hbandi,
quic_anubhavg
In-Reply-To: <20260427170007.1282289-1-prathm@qti.qualcomm.com>
Hello:
This series was applied to bluetooth/bluez.git (master)
by Luiz Augusto von Dentz <luiz.von.dentz@intel.com>:
On Mon, 27 Apr 2026 22:30:04 +0530 you wrote:
> From: Prathibha Madugonde <prathibha.madugonde@oss.qualcomm.com>
>
> Changes in v4:
> Fixed declaration after statement in src/shared/rap.c
>
> Changes in v3:
> Fix for cs_mode_one_data struct members rearrage as per spec
> Reading of cs_mode_one_data in rap_hci.c
> Address cs_mode data struct padding in src/shared/rap.c
>
> [...]
Here is the summary with links:
- [BlueZ,v4,1/3] src/shared: Add RAS packet formatting and notification support for CS reflector
(no matching commit)
- [BlueZ,v4,3/3] profiles/ranging: Read cs_mode_one_data members as per spec
https://git.kernel.org/pub/scm/bluetooth/bluez.git/?id=5d4792dc2a20
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply
* Re: [PATCH BlueZ v5 0/3] Add RAS Packet format and Notification support
From: patchwork-bot+bluetooth @ 2026-04-30 14:40 UTC (permalink / raw)
To: Prathibha Madugonde
Cc: linux-bluetooth, luiz.dentz, quic_mohamull, quic_hbandi,
quic_anubhavg
In-Reply-To: <20260428023111.1640377-1-prathm@qti.qualcomm.com>
Hello:
This series was applied to bluetooth/bluez.git (master)
by Luiz Augusto von Dentz <luiz.von.dentz@intel.com>:
On Tue, 28 Apr 2026 08:01:08 +0530 you wrote:
> From: Prathibha Madugonde <prathibha.madugonde@oss.qualcomm.com>
>
> Changes in v5:
> Fixed Max length err in title
>
> Changes in v4:
> Fixed declaration after statement in src/shared/rap.c
>
> [...]
Here is the summary with links:
- [BlueZ,v5,1/3] src/shared: Add RAS packet format and notification support
(no matching commit)
- [BlueZ,v5,3/3] profiles/ranging: Read cs_mode_one_data members
https://git.kernel.org/pub/scm/bluetooth/bluez.git/?id=5d4792dc2a20
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply
* Re: [PATCH BlueZ v6 0/3] Add RAS Packet format and Notification support
From: patchwork-bot+bluetooth @ 2026-04-30 14:40 UTC (permalink / raw)
To: Prathibha Madugonde
Cc: linux-bluetooth, luiz.dentz, quic_mohamull, quic_hbandi,
quic_anubhavg
In-Reply-To: <20260429152942.2940978-1-prathm@qti.qualcomm.com>
Hello:
This series was applied to bluetooth/bluez.git (master)
by Luiz Augusto von Dentz <luiz.von.dentz@intel.com>:
On Wed, 29 Apr 2026 20:59:39 +0530 you wrote:
> From: Prathibha Madugonde <prathibha.madugonde@oss.qualcomm.com>
>
> Changes in v6:
> src/shared:
> Removed 5 separate CCC write callbacks
> Added unified ras_ranging_data_ccc_write_cb for Real-time and On-demand
> Removed unused macros
> refactored CS mode processing into separate functions
> Improved iov_prepend_bytes - use realloc/memmove instead of malloc/memcpy
> unit/test-rap:
> Added RAS/SR/SPE/BI-11-C test case for mutual exclusivity validation
>
> [...]
Here is the summary with links:
- [BlueZ,v6,1/3] src/shared: Add RAS packet format and notification support
(no matching commit)
- [BlueZ,v6,3/3] profiles/ranging: Read cs_mode_one_data members
https://git.kernel.org/pub/scm/bluetooth/bluez.git/?id=5d4792dc2a20
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply
* [syzbot] [bluetooth?] KASAN: slab-use-after-free Read in skb_pull (2)
From: syzbot @ 2026-04-30 15:25 UTC (permalink / raw)
To: linux-bluetooth, linux-kernel, luiz.dentz, marcel, syzkaller-bugs
Hello,
syzbot found the following issue on:
HEAD commit: 0787c45ea08a Add linux-next specific files for 20260429
git tree: linux-next
console output: https://syzkaller.appspot.com/x/log.txt?x=12e219ba580000
kernel config: https://syzkaller.appspot.com/x/.config?x=dc6dd31c8eef55aa
dashboard link: https://syzkaller.appspot.com/bug?extid=da2717d5c64bf7975268
compiler: Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/2eccbc923d17/disk-0787c45e.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/68b90b45c92d/vmlinux-0787c45e.xz
kernel image: https://storage.googleapis.com/syzbot-assets/a5b9de0f776c/bzImage-0787c45e.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+da2717d5c64bf7975268@syzkaller.appspotmail.com
==================================================================
BUG: KASAN: slab-use-after-free in skb_pull_inline include/linux/skbuff.h:2853 [inline]
BUG: KASAN: slab-use-after-free in skb_pull+0x133/0x1d0 net/core/skbuff.c:2664
Read of size 4 at addr ffff888040ca5e30 by task kworker/0:8/5871
CPU: 0 UID: 0 PID: 5871 Comm: kworker/0:8 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)}
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Comput[ 699.645251][ T5871] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026
Workqueue: events hci_uart_write_work
Call Trace:
<TASK>
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
print_address_description+0x55/0x1e0 mm/kasan/report.c:378
print_report+0x58/0x70 mm/kasan/report.c:482
kasan_report+0x117/0x150 mm/kasan/report.c:595
skb_pull_inline include/linux/skbuff.h:2853 [inline]
skb_pull+0x133/0x1d0 net/core/skbuff.c:2664
hci_uart_write_work+0x44d/0x720 drivers/bluetooth/hci_ldisc.c:168
process_one_work+0x9a3/0x1710 kernel/workqueue.c:3312
process_scheduled_works kernel/workqueue.c:3403 [inline]
worker_thread+0xba8/0x11e0 kernel/workqueue.c:3489
kthread+0x388/0x470 kernel/kthread.c:436
ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
</TASK>
Allocated by task 9:
kasan_save_stack mm/kasan/common.c:57 [inline]
kasan_save_track+0x3e/0x80 mm/kasan/common.c:78
unpoison_slab_object mm/kasan/common.c:340 [inline]
__kasan_slab_alloc+0x6c/0x80 mm/kasan/common.c:366
kasan_slab_alloc include/linux/kasan.h:253 [inline]
slab_post_alloc_hook mm/slub.c:4577 [inline]
slab_alloc_node mm/slub.c:4906 [inline]
kmem_cache_alloc_node_noprof+0x22a/0x6e0 mm/slub.c:4958
__alloc_skb+0x1d0/0x7d0 net/core/skbuff.c:702
alloc_skb include/linux/skbuff.h:1383 [inline]
h5_prepare_pkt+0x1b3/0xc40 drivers/bluetooth/hci_h5.c:728
h5_dequeue+0x1ba/0x840 drivers/bluetooth/hci_h5.c:797
hci_uart_dequeue drivers/bluetooth/hci_ldisc.c:107 [inline]
hci_uart_write_work+0x29b/0x720 drivers/bluetooth/hci_ldisc.c:161
process_one_work+0x9a3/0x1710 kernel/workqueue.c:3312
process_scheduled_works kernel/workqueue.c:3403 [inline]
worker_thread+0xba8/0x11e0 kernel/workqueue.c:3489
kthread+0x388/0x470 kernel/kthread.c:436
ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
Freed by task 15008:
kasan_save_stack mm/kasan/common.c:57 [inline]
kasan_save_track+0x3e/0x80 mm/kasan/common.c:78
kasan_save_free_info+0x46/0x50 mm/kasan/generic.c:584
poison_slab_object mm/kasan/common.c:253 [inline]
__kasan_slab_free+0x5c/0x80 mm/kasan/common.c:285
kasan_slab_free include/linux/kasan.h:235 [inline]
slab_free_hook mm/slub.c:2700 [inline]
slab_free mm/slub.c:6258 [inline]
kmem_cache_free+0x187/0x6c0 mm/slub.c:6385
kfree_skb_reason include/linux/skbuff.h:1322 [inline]
kfree_skb include/linux/skbuff.h:1331 [inline]
hci_uart_flush+0x9d/0x360 drivers/bluetooth/hci_ldisc.c:235
hci_uart_close drivers/bluetooth/hci_ldisc.c:268 [inline]
hci_uart_tty_close+0x99/0x2d0 drivers/bluetooth/hci_ldisc.c:545
tty_ldisc_kill drivers/tty/tty_ldisc.c:613 [inline]
tty_ldisc_hangup+0x444/0x630 drivers/tty/tty_ldisc.c:729
__tty_hangup+0x3eb/0x660 drivers/tty/tty_io.c:621
tty_vhangup drivers/tty/tty_io.c:691 [inline]
tty_ioctl+0x75d/0xde0 drivers/tty/tty_io.c:2732
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:597 [inline]
__se_sys_ioctl+0xff/0x170 fs/ioctl.c:583
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x15f/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
The buggy address belongs to the object at ffff888040ca5dc0
which belongs to the cache skbuff_head_cache of size 240
The buggy address is located 112 bytes inside of
freed 240-byte region [ffff888040ca5dc0, ffff888040ca5eb0)
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x40ca5
memcg:ffff888040e64101
flags: 0x80000000000000(node=0|zone=1)
page_type: f5(slab)
raw: 0080000000000000 ffff88801dac5a00 dead000000000100 dead000000000122
raw: 0000000000000000 00000008000c000c 00000000f5000000 ffff888040e64101
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1182, tgid 1182 (kworker/u8:10), ts 217707286874, free_ts 217702375992
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x1f9/0x250 mm/page_alloc.c:1853
prep_new_page mm/page_alloc.c:1861 [inline]
get_page_from_freelist+0x27d6/0x2850 mm/page_alloc.c:3941
__alloc_frozen_pages_noprof+0x18d/0x380 mm/page_alloc.c:5249
alloc_slab_page mm/slub.c:3289 [inline]
allocate_slab+0x74/0x5e0 mm/slub.c:3404
new_slab mm/slub.c:3447 [inline]
refill_objects+0x33c/0x3d0 mm/slub.c:7263
refill_sheaf mm/slub.c:2827 [inline]
__pcs_replace_empty_main+0x373/0x720 mm/slub.c:4659
alloc_from_pcs mm/slub.c:4757 [inline]
slab_alloc_node mm/slub.c:4891 [inline]
kmem_cache_alloc_node_noprof+0x4f4/0x6e0 mm/slub.c:4958
__alloc_skb+0x1d0/0x7d0 net/core/skbuff.c:702
alloc_skb include/linux/skbuff.h:1383 [inline]
nsim_dev_trap_skb_build drivers/net/netdevsim/dev.c:819 [inline]
nsim_dev_trap_report drivers/net/netdevsim/dev.c:876 [inline]
nsim_dev_trap_report_work+0x29f/0xbd0 drivers/net/netdevsim/dev.c:922
process_one_work+0x9a3/0x1710 kernel/workqueue.c:3312
process_scheduled_works kernel/workqueue.c:3403 [inline]
worker_thread+0xba8/0x11e0 kernel/workqueue.c:3489
kthread+0x388/0x470 kernel/kthread.c:436
ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
page last free pid 29 tgid 29 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
__free_pages_prepare mm/page_alloc.c:1397 [inline]
__free_frozen_pages+0x1075/0x11b0 mm/page_alloc.c:2938
rcu_do_batch kernel/rcu/tree.c:2617 [inline]
rcu_core kernel/rcu/tree.c:2869 [inline]
rcu_cpu_kthread+0x99e/0x1470 kernel/rcu/tree.c:2957
smpboot_thread_fn+0x541/0xa50 kernel/smpboot.c:160
kthread+0x388/0x470 kernel/kthread.c:436
ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
Memory state around the buggy address:
ffff888040ca5d00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc
ffff888040ca5d80: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb
>ffff888040ca5e00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff888040ca5e80: fb fb fb fb fb fb fc fc fc fc fc fc fc fc fc fc
ffff888040ca5f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
^ permalink raw reply
* [bluez/bluez] a9b39d: src/shared: Add RAS packet format and notification...
From: prathibhamadugonde @ 2026-04-30 15:28 UTC (permalink / raw)
To: linux-bluetooth
Branch: refs/heads/master
Home: https://github.com/bluez/bluez
Commit: a9b39d71597dd28f9339bee4548b537c6749d384
https://github.com/bluez/bluez/commit/a9b39d71597dd28f9339bee4548b537c6749d384
Author: Prathibha Madugonde <prathibha.madugonde@oss.qualcomm.com>
Date: 2026-04-30 (Thu, 30 Apr 2026)
Changed paths:
M src/shared/rap.c
M src/shared/rap.h
Log Message:
-----------
src/shared: Add RAS packet format and notification support
Implement complete RAS data pipeline:
- Handle HCI CS subevent result/continuation events
- Serialize ranging/subevent headers per spec
- GATT notifications for real-time ranging data
Commit: 5d4792dc2a2088e7355e19b5fa763159f2a8231d
https://github.com/bluez/bluez/commit/5d4792dc2a2088e7355e19b5fa763159f2a8231d
Author: Prathibha Madugonde <prathibha.madugonde@oss.qualcomm.com>
Date: 2026-04-30 (Thu, 30 Apr 2026)
Changed paths:
M profiles/ranging/rap_hci.c
Log Message:
-----------
profiles/ranging: Read cs_mode_one_data members
Rearrage reading of cs_mode_one_data struct members as per spec.
Commit: 303ea3c539b80778eaea68900c9ea9bb421a97c0
https://github.com/bluez/bluez/commit/303ea3c539b80778eaea68900c9ea9bb421a97c0
Author: Prathibha Madugonde <prathibha.madugonde@oss.qualcomm.com>
Date: 2026-04-30 (Thu, 30 Apr 2026)
Changed paths:
M unit/test-rap.c
Log Message:
-----------
unit/test-rap: Add PTS tests for CS reflector
Added below RAS - Real time Ranging PTS testcases:
RAS/SR/RCO/BV-01-C [Characteristic Read - RAS Features]
RAS/SR/RRD/BV-01-C [Real-time Ranging Data]
RAS/SR/RRD/BV-03-C [Real-time Ranging Data notifications and indications]
RAS/SR/RRD/BV-05-C [Real-Time Ranging Data disconnection]
RAS/SR/SPE/BI-11-C [Client enables both Real-time and On-demand]
Compare: https://github.com/bluez/bluez/compare/304bc5b78a3c...303ea3c539b8
To unsubscribe from these emails, change your notification settings at https://github.com/bluez/bluez/settings/notifications
^ permalink raw reply
* [RFC PATCH BlueZ 1/3] shared/hci: Add BPF filter for registered events
From: Luiz Augusto von Dentz @ 2026-04-30 15:50 UTC (permalink / raw)
To: linux-bluetooth
From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Implement a BPF socket filter in bt_hci_register/bt_hci_unregister that
uses setsockopt(SO_ATTACH_FILTER) to only accept HCI events that have
been registered, plus BT_HCI_EVT_CMD_COMPLETE and BT_HCI_EVT_CMD_STATUS
which are always needed for command response processing.
The filter is rebuilt each time an event is registered or unregistered,
and only applies to non-stream (raw socket) connections.
Assisted-by: Claude:claude-opus-4.6
---
src/shared/hci.c | 84 ++++++++++++++++++++++++++++++++++++++++++++++++
1 file changed, 84 insertions(+)
diff --git a/src/shared/hci.c b/src/shared/hci.c
index 0faa6dea555d..5105b0b2f320 100644
--- a/src/shared/hci.c
+++ b/src/shared/hci.c
@@ -23,6 +23,7 @@
#include <sys/ioctl.h>
#include <fcntl.h>
#include <errno.h>
+#include <linux/filter.h>
#include "bluetooth/hci.h"
#include "monitor/bt.h"
@@ -565,6 +566,85 @@ bool bt_hci_flush(struct bt_hci *hci)
return true;
}
+static void update_evt_filter(struct bt_hci *hci)
+{
+ const struct queue_entry *entry;
+ struct sock_filter *filters;
+ struct sock_fprog fprog;
+ unsigned int count, i;
+ int fd;
+
+ fd = io_get_fd(hci->io);
+ if (fd < 0)
+ return;
+
+ /* If stream-based (not a raw socket), no BPF filtering needed */
+ if (hci->is_stream)
+ return;
+
+ count = queue_length(hci->evt_list);
+
+ /* Build filter: load event code, check defaults + registered events.
+ * Packet layout for HCI_CHANNEL_RAW: [H4 type (1 byte)][evt code (1)]
+ * So event code is at offset 1.
+ *
+ * Filter structure:
+ * [0] Load byte at offset 1 (event code)
+ * [1] JEQ BT_HCI_EVT_CMD_COMPLETE -> accept
+ * [2] JEQ BT_HCI_EVT_CMD_STATUS -> accept
+ * [3..3+count-1] JEQ registered_event -> accept
+ * [3+count] reject
+ * [4+count] accept
+ */
+ filters = malloc(sizeof(*filters) * (count + 5));
+ if (!filters)
+ return;
+
+ i = 0;
+
+ /* Load event code byte */
+ filters[i++] = (struct sock_filter)
+ BPF_STMT(BPF_LD + BPF_B + BPF_ABS, 1);
+
+ /* Check BT_HCI_EVT_CMD_COMPLETE (0x0e) */
+ filters[i++] = (struct sock_filter)
+ BPF_JUMP(BPF_JMP + BPF_JEQ + BPF_K, BT_HCI_EVT_CMD_COMPLETE,
+ count + 2, 0);
+
+ /* Check BT_HCI_EVT_CMD_STATUS (0x0f) */
+ filters[i++] = (struct sock_filter)
+ BPF_JUMP(BPF_JMP + BPF_JEQ + BPF_K, BT_HCI_EVT_CMD_STATUS,
+ count + 1, 0);
+
+ /* Check each registered event */
+ entry = queue_get_entries(hci->evt_list);
+ while (entry) {
+ const struct evt *evt = entry->data;
+ unsigned int jump = count - (i - 3);
+
+ filters[i] = (struct sock_filter)
+ BPF_JUMP(BPF_JMP + BPF_JEQ + BPF_K, evt->event,
+ jump, 0);
+ i++;
+ entry = entry->next;
+ }
+
+ /* Reject */
+ filters[i++] = (struct sock_filter)
+ BPF_STMT(BPF_RET | BPF_K, 0);
+
+ /* Accept */
+ filters[i++] = (struct sock_filter)
+ BPF_STMT(BPF_RET | BPF_K, 0x0fffffff);
+
+ fprog.len = i;
+ fprog.filter = filters;
+
+ setsockopt(fd, SOL_SOCKET, SO_ATTACH_FILTER, &fprog, sizeof(fprog));
+
+ free(filters);
+}
+
unsigned int bt_hci_register(struct bt_hci *hci, uint8_t event,
bt_hci_callback_func_t callback,
void *user_data, bt_hci_destroy_func_t destroy)
@@ -591,6 +671,8 @@ unsigned int bt_hci_register(struct bt_hci *hci, uint8_t event,
return 0;
}
+ update_evt_filter(hci);
+
return evt->id;
}
@@ -657,6 +739,8 @@ bool bt_hci_unregister(struct bt_hci *hci, unsigned int id)
evt_free(evt);
+ update_evt_filter(hci);
+
return true;
}
--
2.53.0
^ permalink raw reply related
* [RFC PATCH BlueZ 2/3] shared/hci: Add bt_hci_register_subevent for LE Meta events
From: Luiz Augusto von Dentz @ 2026-04-30 15:50 UTC (permalink / raw)
To: linux-bluetooth
In-Reply-To: <20260430155038.426968-1-luiz.dentz@gmail.com>
From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Add bt_hci_register_subevent/bt_hci_unregister_subevent API that allows
registering for specific LE Meta Event subevents. The BPF filter is
extended to accept BT_HCI_EVT_LE_META_EVENT packets and then check the
subevent byte (offset 4) against registered subevents.
Since bt_hci_register_subevent is only used with BT_HCI_EVT_LE_META_EVENT,
the event parameter is omitted. The subevent list reuses struct evt where
evt->event stores the subevent code.
Assisted-by: Claude:claude-opus-4.6
---
src/shared/hci.c | 239 ++++++++++++++++++++++++++++++++++++++++-------
src/shared/hci.h | 6 ++
2 files changed, 211 insertions(+), 34 deletions(-)
diff --git a/src/shared/hci.c b/src/shared/hci.c
index 5105b0b2f320..24b2c813e888 100644
--- a/src/shared/hci.c
+++ b/src/shared/hci.c
@@ -45,6 +45,7 @@ struct bt_hci {
struct queue *cmd_queue;
struct queue *rsp_queue;
struct queue *evt_list;
+ struct queue *subevt_list;
struct queue *data_queue;
};
@@ -239,6 +240,21 @@ static void process_notify(void *data, void *user_data)
hdr->plen, evt->user_data);
}
+struct subevt_data {
+ uint8_t subevent;
+ const void *data;
+ uint8_t size;
+};
+
+static void process_subevt_notify(void *data, void *user_data)
+{
+ struct subevt_data *sd = user_data;
+ struct evt *evt = data;
+
+ if (evt->event == sd->subevent)
+ evt->callback(sd->data, sd->size, evt->user_data);
+}
+
static void process_event(struct bt_hci *hci, const void *data, size_t size)
{
const struct bt_hci_evt_hdr *hdr = data;
@@ -275,6 +291,16 @@ static void process_event(struct bt_hci *hci, const void *data, size_t size)
default:
queue_foreach(hci->evt_list, process_notify, (void *) hdr);
+ if (hdr->evt == BT_HCI_EVT_LE_META_EVENT && size > 0) {
+ const uint8_t *params = data;
+ struct subevt_data sd;
+
+ sd.subevent = params[0];
+ sd.data = data + 1;
+ sd.size = size - 1;
+ queue_foreach(hci->subevt_list,
+ process_subevt_notify, &sd);
+ }
break;
}
}
@@ -332,10 +358,12 @@ static struct bt_hci *create_hci(int fd)
hci->cmd_queue = queue_new();
hci->rsp_queue = queue_new();
hci->evt_list = queue_new();
+ hci->subevt_list = queue_new();
hci->data_queue = queue_new();
if (!io_set_read_handler(hci->io, io_read_callback, hci, NULL)) {
queue_destroy(hci->evt_list, NULL);
+ queue_destroy(hci->subevt_list, NULL);
queue_destroy(hci->rsp_queue, NULL);
queue_destroy(hci->cmd_queue, NULL);
queue_destroy(hci->data_queue, NULL);
@@ -458,6 +486,7 @@ void bt_hci_unref(struct bt_hci *hci)
return;
queue_destroy(hci->evt_list, evt_free);
+ queue_destroy(hci->subevt_list, evt_free);
queue_destroy(hci->cmd_queue, cmd_free);
queue_destroy(hci->rsp_queue, cmd_free);
queue_destroy(hci->data_queue, data_free);
@@ -571,7 +600,7 @@ static void update_evt_filter(struct bt_hci *hci)
const struct queue_entry *entry;
struct sock_filter *filters;
struct sock_fprog fprog;
- unsigned int count, i;
+ unsigned int evt_count, subevt_count, count, i;
int fd;
fd = io_get_fd(hci->io);
@@ -582,21 +611,37 @@ static void update_evt_filter(struct bt_hci *hci)
if (hci->is_stream)
return;
- count = queue_length(hci->evt_list);
+ evt_count = queue_length(hci->evt_list);
+ subevt_count = queue_length(hci->subevt_list);
- /* Build filter: load event code, check defaults + registered events.
- * Packet layout for HCI_CHANNEL_RAW: [H4 type (1 byte)][evt code (1)]
- * So event code is at offset 1.
+ /* Filter structure:
+ * Packet layout: [H4 type(1)][evt code(1)][plen(1)][params...]
+ * For LE Meta: params[0] is the subevent code (offset 4 from start)
*
- * Filter structure:
* [0] Load byte at offset 1 (event code)
- * [1] JEQ BT_HCI_EVT_CMD_COMPLETE -> accept
- * [2] JEQ BT_HCI_EVT_CMD_STATUS -> accept
- * [3..3+count-1] JEQ registered_event -> accept
- * [3+count] reject
- * [4+count] accept
+ * [1] JEQ CMD_COMPLETE -> accept
+ * [2] JEQ CMD_STATUS -> accept
+ * [3] JEQ LE_META -> subevent_check (if subevts registered)
+ * [4..4+evt_count-1] JEQ registered_event -> accept
+ * [4+evt_count] reject
+ * -- subevent section (if subevt_count > 0) --
+ * [5+evt_count] Load byte at offset 4 (subevent code)
+ * [6+evt_count..6+evt_count+subevt_count-1] JEQ subevent -> accept
+ * [6+evt_count+subevt_count] reject
+ * -- shared accept --
+ * [last] accept
*/
- filters = malloc(sizeof(*filters) * (count + 5));
+
+ /* Without subevents: 3 (defaults) + evt_count + reject + accept = evt_count + 5
+ * With subevents: 4 (defaults+LE_META) + evt_count + reject +
+ * 1 (load subevent) + subevt_count + reject + accept
+ */
+ if (subevt_count)
+ count = 4 + evt_count + 1 + 1 + subevt_count + 1 + 1;
+ else
+ count = 3 + evt_count + 1 + 1;
+
+ filters = malloc(sizeof(*filters) * count);
if (!filters)
return;
@@ -606,32 +651,106 @@ static void update_evt_filter(struct bt_hci *hci)
filters[i++] = (struct sock_filter)
BPF_STMT(BPF_LD + BPF_B + BPF_ABS, 1);
- /* Check BT_HCI_EVT_CMD_COMPLETE (0x0e) */
- filters[i++] = (struct sock_filter)
- BPF_JUMP(BPF_JMP + BPF_JEQ + BPF_K, BT_HCI_EVT_CMD_COMPLETE,
- count + 2, 0);
-
- /* Check BT_HCI_EVT_CMD_STATUS (0x0f) */
- filters[i++] = (struct sock_filter)
- BPF_JUMP(BPF_JMP + BPF_JEQ + BPF_K, BT_HCI_EVT_CMD_STATUS,
- count + 1, 0);
-
- /* Check each registered event */
- entry = queue_get_entries(hci->evt_list);
- while (entry) {
- const struct evt *evt = entry->data;
- unsigned int jump = count - (i - 3);
+ if (subevt_count) {
+ /* accept is at index: count - 1
+ * From instruction at index i, jump_true = (count-1) - (i+1)
+ */
+ /* Check BT_HCI_EVT_CMD_COMPLETE -> accept */
filters[i] = (struct sock_filter)
- BPF_JUMP(BPF_JMP + BPF_JEQ + BPF_K, evt->event,
- jump, 0);
+ BPF_JUMP(BPF_JMP + BPF_JEQ + BPF_K,
+ BT_HCI_EVT_CMD_COMPLETE,
+ count - 1 - (i + 1), 0);
i++;
- entry = entry->next;
- }
- /* Reject */
- filters[i++] = (struct sock_filter)
- BPF_STMT(BPF_RET | BPF_K, 0);
+ /* Check BT_HCI_EVT_CMD_STATUS -> accept */
+ filters[i] = (struct sock_filter)
+ BPF_JUMP(BPF_JMP + BPF_JEQ + BPF_K,
+ BT_HCI_EVT_CMD_STATUS,
+ count - 1 - (i + 1), 0);
+ i++;
+
+ /* Check LE_META -> subevent section
+ * subevent section starts at: 4 + evt_count + 1
+ * (after the evt reject instruction)
+ */
+ filters[i] = (struct sock_filter)
+ BPF_JUMP(BPF_JMP + BPF_JEQ + BPF_K,
+ BT_HCI_EVT_LE_META_EVENT,
+ 4 + evt_count + 1 - (i + 1), 0);
+ i++;
+
+ /* Check each registered event -> accept */
+ entry = queue_get_entries(hci->evt_list);
+ while (entry) {
+ const struct evt *evt = entry->data;
+
+ filters[i] = (struct sock_filter)
+ BPF_JUMP(BPF_JMP + BPF_JEQ + BPF_K,
+ evt->event,
+ count - 1 - (i + 1), 0);
+ i++;
+ entry = entry->next;
+ }
+
+ /* Reject (for non-matching events) */
+ filters[i++] = (struct sock_filter)
+ BPF_STMT(BPF_RET | BPF_K, 0);
+
+ /* Subevent section: load subevent byte at offset 4 */
+ filters[i++] = (struct sock_filter)
+ BPF_STMT(BPF_LD + BPF_B + BPF_ABS, 4);
+
+ /* Check each registered subevent -> accept */
+ entry = queue_get_entries(hci->subevt_list);
+ while (entry) {
+ const struct evt *evt = entry->data;
+
+ filters[i] = (struct sock_filter)
+ BPF_JUMP(BPF_JMP + BPF_JEQ + BPF_K,
+ evt->event,
+ count - 1 - (i + 1), 0);
+ i++;
+ entry = entry->next;
+ }
+
+ /* Reject (for non-matching subevents) */
+ filters[i++] = (struct sock_filter)
+ BPF_STMT(BPF_RET | BPF_K, 0);
+ } else {
+ /* No subevents - simple filter */
+
+ /* Check BT_HCI_EVT_CMD_COMPLETE -> accept */
+ filters[i] = (struct sock_filter)
+ BPF_JUMP(BPF_JMP + BPF_JEQ + BPF_K,
+ BT_HCI_EVT_CMD_COMPLETE,
+ count - 1 - (i + 1), 0);
+ i++;
+
+ /* Check BT_HCI_EVT_CMD_STATUS -> accept */
+ filters[i] = (struct sock_filter)
+ BPF_JUMP(BPF_JMP + BPF_JEQ + BPF_K,
+ BT_HCI_EVT_CMD_STATUS,
+ count - 1 - (i + 1), 0);
+ i++;
+
+ /* Check each registered event -> accept */
+ entry = queue_get_entries(hci->evt_list);
+ while (entry) {
+ const struct evt *evt = entry->data;
+
+ filters[i] = (struct sock_filter)
+ BPF_JUMP(BPF_JMP + BPF_JEQ + BPF_K,
+ evt->event,
+ count - 1 - (i + 1), 0);
+ i++;
+ entry = entry->next;
+ }
+
+ /* Reject */
+ filters[i++] = (struct sock_filter)
+ BPF_STMT(BPF_RET | BPF_K, 0);
+ }
/* Accept */
filters[i++] = (struct sock_filter)
@@ -744,6 +863,58 @@ bool bt_hci_unregister(struct bt_hci *hci, unsigned int id)
return true;
}
+
+unsigned int bt_hci_register_subevent(struct bt_hci *hci,
+ uint8_t subevent,
+ bt_hci_callback_func_t callback,
+ void *user_data, bt_hci_destroy_func_t destroy)
+{
+ struct evt *evt;
+
+ if (!hci)
+ return 0;
+
+ evt = new0(struct evt, 1);
+ evt->event = subevent;
+
+ if (hci->next_evt_id < 1)
+ hci->next_evt_id = 1;
+
+ evt->id = hci->next_evt_id++;
+
+ evt->callback = callback;
+ evt->destroy = destroy;
+ evt->user_data = user_data;
+
+ if (!queue_push_tail(hci->subevt_list, evt)) {
+ free(evt);
+ return 0;
+ }
+
+ update_evt_filter(hci);
+
+ return evt->id;
+}
+
+bool bt_hci_unregister_subevent(struct bt_hci *hci, unsigned int id)
+{
+ struct evt *evt;
+
+ if (!hci || !id)
+ return false;
+
+ evt = queue_remove_if(hci->subevt_list, match_evt_id,
+ UINT_TO_PTR(id));
+ if (!evt)
+ return false;
+
+ evt_free(evt);
+
+ update_evt_filter(hci);
+
+ return true;
+}
+
bool bt_hci_get_conn_handle(struct bt_hci *hci, const uint8_t *bdaddr,
uint16_t *handle)
{
diff --git a/src/shared/hci.h b/src/shared/hci.h
index 800dc4946b97..5be48577f9db 100644
--- a/src/shared/hci.h
+++ b/src/shared/hci.h
@@ -42,5 +42,11 @@ unsigned int bt_hci_register(struct bt_hci *hci, uint8_t event,
void *user_data, bt_hci_destroy_func_t destroy);
bool bt_hci_unregister(struct bt_hci *hci, unsigned int id);
+unsigned int bt_hci_register_subevent(struct bt_hci *hci,
+ uint8_t subevent,
+ bt_hci_callback_func_t callback,
+ void *user_data, bt_hci_destroy_func_t destroy);
+bool bt_hci_unregister_subevent(struct bt_hci *hci, unsigned int id);
+
bool bt_hci_get_conn_handle(struct bt_hci *hci, const uint8_t *bdaddr,
uint16_t *handle);
--
2.53.0
^ permalink raw reply related
* [RFC PATCH BlueZ 3/3] ranging/rap_hci: Use bt_hci_register_subevent for LE CS events
From: Luiz Augusto von Dentz @ 2026-04-30 15:50 UTC (permalink / raw)
To: linux-bluetooth
In-Reply-To: <20260430155038.426968-1-luiz.dentz@gmail.com>
From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Replace the single BT_HCI_EVT_LE_META_EVENT registration and subevent
dispatch table with individual bt_hci_register_subevent calls for each
CS subevent. This enables BPF filtering at the socket level for each
specific subevent and removes the manual subevent dispatch logic.
Event IDs are stored in a struct queue for flexible management.
Assisted-by: Claude:claude-opus-4.6
---
profiles/ranging/rap_hci.c | 193 ++++++++++++++-----------------------
1 file changed, 71 insertions(+), 122 deletions(-)
diff --git a/profiles/ranging/rap_hci.c b/profiles/ranging/rap_hci.c
index 08ddc077ce94..8e65e5ef87bd 100644
--- a/profiles/ranging/rap_hci.c
+++ b/profiles/ranging/rap_hci.c
@@ -61,7 +61,7 @@ struct cs_state_machine {
enum cs_state old_state;
struct bt_hci *hci;
struct bt_rap *rap;
- unsigned int event_id;
+ struct queue *event_ids;
bool initiator;
bool procedure_active;
struct bt_rap_hci_cs_options cs_opt; /* Per-instance CS options */
@@ -302,7 +302,7 @@ static void rap_send_hci_def_settings_command(struct cs_state_machine *sm,
error("Failed to send default settings cmd");
}
-static void rap_rd_rmt_supp_cap_cmplt_evt(const uint8_t *data, uint8_t size,
+static void rap_rd_rmt_supp_cap_cmplt_evt(const void *data, uint8_t size,
void *user_data)
{
struct cs_state_machine *sm = user_data;
@@ -348,7 +348,7 @@ static void rap_rd_rmt_supp_cap_cmplt_evt(const uint8_t *data, uint8_t size,
cs_set_state(sm, CS_STATE_INIT);
}
-static void rap_cs_config_cmplt_evt(const uint8_t *data, uint8_t size,
+static void rap_cs_config_cmplt_evt(const void *data, uint8_t size,
void *user_data)
{
struct cs_state_machine *sm = user_data;
@@ -439,7 +439,7 @@ static void rap_cs_config_cmplt_evt(const uint8_t *data, uint8_t size,
bt_rap_hci_cs_config_complete_callback(size, &rap_ev, sm->rap);
}
-static void rap_cs_sec_enable_cmplt_evt(const uint8_t *data, uint8_t size,
+static void rap_cs_sec_enable_cmplt_evt(const void *data, uint8_t size,
void *user_data)
{
struct cs_state_machine *sm = user_data;
@@ -500,7 +500,7 @@ static void rap_cs_sec_enable_cmplt_evt(const uint8_t *data, uint8_t size,
bt_rap_hci_cs_sec_enable_complete_callback(size, &rap_ev, sm->rap);
}
-static void rap_cs_proc_enable_cmplt_evt(const uint8_t *data, uint8_t size,
+static void rap_cs_proc_enable_cmplt_evt(const void *data, uint8_t size,
void *user_data)
{
struct cs_state_machine *sm = user_data;
@@ -800,7 +800,7 @@ static void parse_cs_step(struct iovec *iov, struct cs_step_data *step,
}
}
-static void rap_cs_subevt_result_evt(const uint8_t *data, uint8_t size,
+static void rap_cs_subevt_result_evt(const void *data, uint8_t size,
void *user_data)
{
struct cs_state_machine *sm = (struct cs_state_machine *) user_data;
@@ -910,7 +910,7 @@ send_event:
free(rap_ev);
}
-static void rap_cs_subevt_result_cont_evt(const uint8_t *data, uint8_t size,
+static void rap_cs_subevt_result_cont_evt(const void *data, uint8_t size,
void *user_data)
{
struct cs_state_machine *sm = (struct cs_state_machine *) user_data;
@@ -1009,113 +1009,12 @@ send_event:
}
/* Subevent handler function type */
-typedef void (*subevent_handler_t)(const uint8_t *data, uint8_t size,
- void *user_data);
-/* Subevent table entry */
-struct subevent_entry {
- uint8_t opcode;
- uint8_t min_len;
- uint8_t max_len;
- subevent_handler_t handler;
- const char *name;
-};
-
-/* Macro to define HCI event entries
- * Note: min_len excludes the subevent byte since it's stripped before dispatch
- */
-#define HCI_EVT(_opcode, _struct, _handler, _name) \
- { \
- .opcode = _opcode, \
- .min_len = sizeof(_struct), \
- .max_len = 0xFF, \
- .handler = _handler, \
- .name = _name \
- }
-
-/* Subevent dispatch table */
-static const struct subevent_entry subevent_table[] = {
- HCI_EVT(BT_HCI_EVT_LE_CS_RD_REM_SUPP_CAP_COMPLETE,
- struct bt_hci_evt_le_cs_rd_rem_supp_cap_complete,
- rap_rd_rmt_supp_cap_cmplt_evt,
- "CS Read Remote Supported Capabilities Complete"),
- HCI_EVT(BT_HCI_EVT_LE_CS_CONFIG_COMPLETE,
- struct bt_hci_evt_le_cs_config_complete,
- rap_cs_config_cmplt_evt,
- "CS Config Complete"),
- HCI_EVT(BT_HCI_EVT_LE_CS_SEC_ENABLE_COMPLETE,
- struct bt_hci_evt_le_cs_sec_enable_complete,
- rap_cs_sec_enable_cmplt_evt,
- "CS Security Enable Complete"),
- HCI_EVT(BT_HCI_EVT_LE_CS_PROC_ENABLE_COMPLETE,
- struct bt_hci_evt_le_cs_proc_enable_complete,
- rap_cs_proc_enable_cmplt_evt,
- "CS Procedure Enable Complete"),
- HCI_EVT(BT_HCI_EVT_LE_CS_SUBEVENT_RESULT,
- struct bt_hci_evt_le_cs_subevent_result,
- rap_cs_subevt_result_evt,
- "CS Subevent Result"),
- HCI_EVT(BT_HCI_EVT_LE_CS_SUBEVENT_RESULT_CONTINUE,
- struct bt_hci_evt_le_cs_subevent_result_continue,
- rap_cs_subevt_result_cont_evt,
- "CS Subevent Result Continue")
-};
-
-#undef HCI_EVT
-
-#define SUBEVENT_TABLE_SIZE ARRAY_SIZE(subevent_table)
-
-/* HCI Event Registration */
-static void rap_handle_hci_events(const void *data, uint8_t size,
- void *user_data)
+static void unregister_event_id(void *data, void *user_data)
{
- struct iovec iov;
- uint8_t subevent;
- const struct subevent_entry *entry = NULL;
- size_t i;
+ struct bt_hci *hci = user_data;
- /* Initialize iovec with the event data */
- iov.iov_base = (void *) data;
- iov.iov_len = size;
-
- /* Pull the subevent code */
- if (!util_iov_pull_u8(&iov, &subevent)) {
- DBG("Failed to parse subevent code");
- return;
- }
-
- /* Find the subevent in the table */
- for (i = 0; i < SUBEVENT_TABLE_SIZE; i++) {
- if (subevent_table[i].opcode == subevent) {
- entry = &subevent_table[i];
- break;
- }
- }
-
- /* Check if subevent is supported */
- if (!entry) {
- DBG("Unknown subevent: 0x%02X", subevent);
- return;
- }
-
- /* Validate payload length */
- if (iov.iov_len < entry->min_len) {
- DBG("%s: payload too short (%zu < %u)",
- entry->name, iov.iov_len, entry->min_len);
- return;
- }
-
- if (entry->max_len != 0xFF && iov.iov_len > entry->max_len) {
- DBG("%s: payload too long (%zu > %u)",
- entry->name, iov.iov_len, entry->max_len);
- return;
- }
-
- /* Call the handler */
- DBG("Handling %s (opcode=0x%02X, len=%zu)",
- entry->name, subevent, iov.iov_len);
-
- entry->handler(iov.iov_base, iov.iov_len, user_data);
+ bt_hci_unregister_subevent(hci, PTR_TO_UINT(data));
}
void *bt_rap_attach_hci(struct bt_rap *rap, struct bt_hci *hci,
@@ -1123,6 +1022,7 @@ void *bt_rap_attach_hci(struct bt_rap *rap, struct bt_hci *hci,
int8_t max_tx_power)
{
struct cs_state_machine *sm;
+ unsigned int id;
if (!rap || !hci) {
error("rap or hci null");
@@ -1140,22 +1040,68 @@ void *bt_rap_attach_hci(struct bt_rap *rap, struct bt_hci *hci,
cs_state_machine_init(sm, rap, hci, role, cs_sync_ant_sel,
max_tx_power);
- sm->event_id = bt_hci_register(hci, BT_HCI_EVT_LE_META_EVENT,
- rap_handle_hci_events, sm, NULL);
+ sm->event_ids = queue_new();
- DBG("bt_hci_register done, event_id : %d", sm->event_id);
+ /* Register each LE Meta subevent individually */
+ id = bt_hci_register_subevent(hci,
+ BT_HCI_EVT_LE_CS_RD_REM_SUPP_CAP_COMPLETE,
+ rap_rd_rmt_supp_cap_cmplt_evt, sm, NULL);
+ if (!id)
+ goto fail;
- if (!sm->event_id) {
- error("Failed to register hci le meta events");
- error("event_id=0x%02X", sm->event_id);
- free(sm);
- return NULL;
- }
+ queue_push_tail(sm->event_ids, UINT_TO_PTR(id));
+
+ id = bt_hci_register_subevent(hci,
+ BT_HCI_EVT_LE_CS_CONFIG_COMPLETE,
+ rap_cs_config_cmplt_evt, sm, NULL);
+ if (!id)
+ goto fail;
+
+ queue_push_tail(sm->event_ids, UINT_TO_PTR(id));
+
+ id = bt_hci_register_subevent(hci,
+ BT_HCI_EVT_LE_CS_SEC_ENABLE_COMPLETE,
+ rap_cs_sec_enable_cmplt_evt, sm, NULL);
+ if (!id)
+ goto fail;
+
+ queue_push_tail(sm->event_ids, UINT_TO_PTR(id));
+
+ id = bt_hci_register_subevent(hci,
+ BT_HCI_EVT_LE_CS_PROC_ENABLE_COMPLETE,
+ rap_cs_proc_enable_cmplt_evt, sm, NULL);
+ if (!id)
+ goto fail;
+
+ queue_push_tail(sm->event_ids, UINT_TO_PTR(id));
+
+ id = bt_hci_register_subevent(hci,
+ BT_HCI_EVT_LE_CS_SUBEVENT_RESULT,
+ rap_cs_subevt_result_evt, sm, NULL);
+ if (!id)
+ goto fail;
+
+ queue_push_tail(sm->event_ids, UINT_TO_PTR(id));
+
+ id = bt_hci_register_subevent(hci,
+ BT_HCI_EVT_LE_CS_SUBEVENT_RESULT_CONTINUE,
+ rap_cs_subevt_result_cont_evt, sm, NULL);
+ if (!id)
+ goto fail;
+
+ queue_push_tail(sm->event_ids, UINT_TO_PTR(id));
DBG("CS options: role=%u, cs_sync_ant_sel=%u, max_tx_power=%d",
role, cs_sync_ant_sel, max_tx_power);
return sm;
+
+fail:
+ error("Failed to register hci le meta subevents");
+ queue_foreach(sm->event_ids, unregister_event_id, hci);
+ queue_destroy(sm->event_ids, NULL);
+ free(sm);
+ return NULL;
}
bool bt_rap_set_conn_handle(void *hci_sm, struct bt_rap *rap, uint16_t handle,
@@ -1204,8 +1150,11 @@ void bt_rap_detach_hci(struct bt_rap *rap, void *hci_sm)
/* Cleanup the per-instance state machine */
if (sm) {
/* Unregister HCI events */
- if (sm->event_id && sm->hci)
- bt_hci_unregister(sm->hci, sm->event_id);
+ if (sm->hci)
+ queue_foreach(sm->event_ids, unregister_event_id,
+ sm->hci);
+
+ queue_destroy(sm->event_ids, NULL);
/* Clean up per-instance connection mappings */
remove_rap_mappings(sm);
--
2.53.0
^ permalink raw reply related
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox