CS: Add the CS RAS GATTS module. by huangyulong3 · Pull Request #367 · open-vela/frameworks_bluetooth

huangyulong3 · 2026-01-13T11:38:52Z

bug: v/83693

rootcause: The GATTS module is essential for Channel Sounding during the ranging process, involving GATT service creation, GATT message transmission, and GATT management.

bug: v/83693 rootcause: The GATTS module is essential for Channel Sounding during the ranging process, involving GATT service creation, GATT message transmission, and GATT management. Signed-off-by: huangyulong3 <huangyulong3@xiaomi.com>

Copilot

Pull request overview

This PR adds a new GATTS (GATT Server) module for Channel Sounding Ranging Aggregation Service (CS RAS). The module manages GATT service creation, characteristic notifications/indications, and connection lifecycle for Bluetooth Channel Sounding ranging operations.

Changes:

Adds cs_ras_gatts.c implementing the RAS GATT server with service registration, attribute database, and callback handlers
Implements GATT characteristics for ranging features, real-time data, on-demand data, control point, data ready, and data overwrite
Provides API functions for initialization, cleanup, and sending notifications/indications

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-01-19T02:34:27Z

+    if (gatts_info->ras_gatts_handle != srv_handle) {
+        BT_LOGE("srv_handle(%p) not equal to gatts_handle(%p)", srv_handle, gatts_info->ras_gatts_handle);
+        return 0;
+    }


Null pointer dereference risk: gatts_info is accessed before checking if it's NULL. The null check should be performed before accessing gatts_info->ras_gatts_handle.

Copilot · 2026-01-19T02:34:27Z

+    if (gatts_info->ras_gatts_handle != srv_handle) {
+        BT_LOGE("srv_handle(%p) not equal to gatts_handle(%p)", srv_handle, gatts_info->ras_gatts_handle);
+        return 0;
+    }


Null pointer dereference risk: gatts_info is accessed before checking if it's NULL. The null check should be performed before accessing gatts_info->ras_gatts_handle.

Copilot · 2026-01-19T02:34:27Z

+    ras_gatts_register();
+}
+
+void ras_gatts_deinit(void)


Inconsistent function naming: This function is named 'ras_gatts_deinit' while the corresponding initialization function is named 'bt_cs_ras_gatts_init'. For consistency, this function should either be named 'bt_cs_ras_gatts_deinit' or the init function should be renamed to match this naming pattern.

Suggested change

void ras_gatts_deinit(void)

void bt_cs_ras_gatts_deinit(void)

Copilot · 2026-01-19T02:34:28Z

@@ -0,0 +1,411 @@
+/****************************************************************************
+ *
+ *   Copyright (C) 2025 Xiaomi InC. All rights reserved.


The company name contains a typo. "InC" should be "Inc" (with lowercase 'c').

Suggested change

* Copyright (C) 2025 Xiaomi InC. All rights reserved.

* Copyright (C) 2025 Xiaomi Inc. All rights reserved.

Copilot · 2026-01-19T02:34:28Z

+    if (gatts_info->ras_gatts_handle != srv_handle) {
+        BT_LOGE("srv_handle(%p) not equal to gatts_handle(%p)", srv_handle, gatts_info->ras_gatts_handle);
+        return 0;
+    }


Null pointer dereference risk: gatts_info is accessed before checking if it's NULL. The null check should be performed before accessing gatts_info->ras_gatts_handle.

Copilot · 2026-01-19T02:34:29Z

+    if (gatts_info->ras_gatts_handle != srv_handle) {
+        BT_LOGE("srv_handle(%p) not equal to gatts_handle(%p)", srv_handle, gatts_info->ras_gatts_handle);
+        return;
+    }


Null pointer dereference risk: gatts_info is accessed before checking if it's NULL. The null check should be performed before accessing gatts_info->ras_gatts_handle.

Copilot · 2026-01-19T02:34:30Z

+    switch (attr_handle) {
+    case RAS_RANGING_REAL_TIME_CCC_ID:
+        attr_ntf = RAS_REAL_TIME_CHAR_SEND;
+        break;
+    case RAS_RANGING_ON_DEMAND_CCC_ID:
+        attr_ntf = RAS_ON_DEMAND_CHAR_SEND;
+        break;
+    case RAS_RANGING_CONTROL_POINT_CCC_ID:
+        attr_ntf = RAS_CONTROL_POINT_CHAR_SEND;
+        break;
+    case RAS_RANGING_DATA_READY_CCC_ID:
+        attr_ntf = RAS_DATA_READY_CHAR_SEND;
+        break;
+    case RAS_RANGING_DATA_OVER_WRITE_CCC_ID:
+        attr_ntf = RAS_OVER_WRITE_CHAR_SEND;
+        break;
+    default:
+        BT_LOGE("Invalid attr_handle:%d", attr_handle);
+        return;
+    }


Incorrect attr_handle mapping: The switch cases use CCC descriptor IDs (e.g., RAS_RANGING_REAL_TIME_CCC_ID) but these should map to the characteristic attribute IDs that are being notified. The mapping appears correct conceptually, but the case values should match the characteristic IDs not the CCC IDs, since attr_handle in the notify complete callback refers to the characteristic that was notified.

Copilot · 2026-01-19T02:34:30Z

+    if (gatts_info->ras_gatts_handle != srv_handle) {
+        BT_LOGE("srv_handle(%p) not equal to gatts_handle(%p)", srv_handle, gatts_info->ras_gatts_handle);
+        return 0;
+    }


All CCC changed callbacks and the control point write callback check if gatts_info->ras_gatts_handle matches srv_handle before checking if gatts_info is NULL. If gatts_info is NULL, this will cause a null pointer dereference. The null check should be performed before accessing gatts_info->ras_gatts_handle.

Copilot · 2026-01-19T02:34:30Z

+    if (gatts_info->ras_gatts_handle != srv_handle) {
+        BT_LOGE("srv_handle(%p) not equal to gatts_handle(%p)", srv_handle, gatts_info->ras_gatts_handle);
+        return;
+    }


Null pointer dereference risk: gatts_info is accessed before checking if it's NULL. The null check should be performed before accessing gatts_info->ras_gatts_handle.

Copilot · 2026-01-19T02:34:30Z

+        return BT_STATUS_FAIL;
+    }
+
+    bt_status_t status = (is_notify ? (gatts_info->ras_gatts_interface->notify(gatts_info->ras_gatts_handle, addr, attr_handle, value, len)) : gatts_info->ras_gatts_interface->indicate(gatts_info->ras_gatts_handle, addr, attr_handle, value, len));


This line is excessively long (over 200 characters) and difficult to read. Consider breaking it into multiple lines for better maintainability and readability.

Suggested change

bt_status_t status = (is_notify ? (gatts_info->ras_gatts_interface->notify(gatts_info->ras_gatts_handle, addr, attr_handle, value, len)) : gatts_info->ras_gatts_interface->indicate(gatts_info->ras_gatts_handle, addr, attr_handle, value, len));

bt_status_t status;

if (is_notify) {

status = gatts_info->ras_gatts_interface->notify(

gatts_info->ras_gatts_handle, addr, attr_handle, value, len);

} else {

status = gatts_info->ras_gatts_interface->indicate(

gatts_info->ras_gatts_handle, addr, attr_handle, value, len);

}

github-actions · 2026-02-19T02:15:58Z

This PR is stale because it has been open 45 days with no activity. Remove stale label or comment or this will be closed in 10 days.

huangyulong3 requested review from chengkai15, gzh-terry, hyson710, zhangyuan376 and zhongzhijie1 as code owners January 13, 2026 11:38

CS: Add the CS RAS GATTS module.

caea1d6

bug: v/83693 rootcause: The GATTS module is essential for Channel Sounding during the ranging process, involving GATT service creation, GATT message transmission, and GATT management. Signed-off-by: huangyulong3 <huangyulong3@xiaomi.com>

huangyulong3 force-pushed the feature/bt_cs_add_ras_gatts_supported branch from 79af78c to caea1d6 Compare January 13, 2026 11:42

zhongzhijie1 requested a review from Copilot January 19, 2026 02:29

Copilot started reviewing on behalf of zhongzhijie1 January 19, 2026 02:29 View session

Copilot AI reviewed Jan 19, 2026

View reviewed changes

github-actions Bot added the Stale label Feb 19, 2026

github-actions Bot closed this Feb 27, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

CS: Add the CS RAS GATTS module.#367

CS: Add the CS RAS GATTS module.#367
huangyulong3 wants to merge 1 commit intoopen-vela:devfrom
huangyulong3:feature/bt_cs_add_ras_gatts_supported

huangyulong3 commented Jan 13, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Jan 19, 2026

Uh oh!

Copilot AI Jan 19, 2026

Uh oh!

Copilot AI Jan 19, 2026

Uh oh!

Copilot AI Jan 19, 2026

Uh oh!

Copilot AI Jan 19, 2026

Uh oh!

Copilot AI Jan 19, 2026

Uh oh!

Copilot AI Jan 19, 2026

Uh oh!

Copilot AI Jan 19, 2026

Uh oh!

Copilot AI Jan 19, 2026

Uh oh!

Copilot AI Jan 19, 2026

Uh oh!

github-actions Bot commented Feb 19, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

	void ras_gatts_deinit(void)
	void bt_cs_ras_gatts_deinit(void)

	* Copyright (C) 2025 Xiaomi InC. All rights reserved.
	* Copyright (C) 2025 Xiaomi Inc. All rights reserved.

-    bt_status_t status = (is_notify ? (gatts_info->ras_gatts_interface->notify(gatts_info->ras_gatts_handle, addr, attr_handle, value, len)) : gatts_info->ras_gatts_interface->indicate(gatts_info->ras_gatts_handle, addr, attr_handle, value, len));
+    bt_status_t status;
+    if (is_notify) {
+        status = gatts_info->ras_gatts_interface->notify(
+            gatts_info->ras_gatts_handle, addr, attr_handle, value, len);
+    } else {
+        status = gatts_info->ras_gatts_interface->indicate(
+            gatts_info->ras_gatts_handle, addr, attr_handle, value, len);
+    }

Conversation

huangyulong3 commented Jan 13, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI Jan 19, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 19, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 19, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 19, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 19, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 19, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 19, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 19, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 19, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 19, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions Bot commented Feb 19, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants