/* profiles/audio/cas.c */

#include <stdint.h>
#include <stdbool.h>
#include "lib/bluetooth.h"
#include "lib/uuid.h"
#include "src/shared/gatt-db.h"
#include "src/shared/gatt-server.h"
#include "profiles/audio/csis.h"

/* 16-bit UUID for Common Audio Service */
#define CAS_UUID16              0x1853

/* 16-bit UUID for Coordinated Set Identification Service */
#define CSIS_UUID16             0x1846

/* Per-adapter CAS data */
struct cas_data {
    struct btd_adapter          *adapter;
    struct gatt_db              *db;
    struct gatt_db_attribute    *service;   /* CAS primary service attr  */
    struct gatt_db_attribute    *csis_attr; /* Pointer to CSIS service   */
    bool                         is_set_member; /* Part of Coordinated Set? */
};

The gatt_db_add_service() call creates the Primary Service declaration attribute with the specified UUID. The third argument true marks it as a primary service. The fourth argument is the number of attribute handles to reserve.

static void cas_add_service(struct cas_data *data)
{
    struct gatt_db_attribute *service;
    bt_uuid_t uuid;

    /*
     * Create the CAS Primary Service declaration.
     * UUID: 0x1853
     * is_primary: true
     * num_handles: 4 — enough for:
     *   1 x Primary Service Declaration
     *   1 x Include Declaration (CSIS, conditional)
     *   2 x spare handles
     */
    bt_uuid16_create(&uuid, CAS_UUID16);
    service = gatt_db_add_service(data->db, &uuid, true, 4);

    if (!service) {
        error("CAS: Failed to create service in GATT database");
        return;
    }

    data->service = service;

    /*
     * CAS has no characteristics of its own.
     * If this device is part of a Coordinated Set,
     * we add an Include Declaration pointing to CSIS.
     */
    if (data->is_set_member && data->csis_attr) {
        cas_include_csis(data);
    }

    /* Activate the service so it is visible to remote clients */
    gatt_db_service_set_active(service, true);
}

The gatt_db_service_add_included() API adds an Include Declaration (UUID 0x2802) attribute to the parent service (CAS), storing the handle range of the child service (CSIS). This is the BlueZ mechanism for the GATT Include procedure.

static void cas_include_csis(struct cas_data *data)
{
    struct gatt_db_attribute *included;

    /*
     * Add an Include Declaration inside CAS pointing to CSIS.
     *
     * gatt_db_service_add_included() adds attribute type 0x2802
     * (Include Declaration) to data->service (CAS), with its value
     * containing the start handle, end handle, and UUID of
     * data->csis_attr (CSIS).
     *
     * The spec rule: CAS shall include no more than one CSIS instance.
     * We call this at most once, guarded by is_set_member check.
     */
    included = gatt_db_service_add_included(data->service,
                                             data->csis_attr);

    if (!included) {
        error("CAS: Failed to add CSIS as included service");
        return;
    }

    DBG("CAS: CSIS included (device is Coordinated Set member)");
}

The adapter_probe callback is called by BlueZ when the Bluetooth adapter is ready. This is where CAS initialises its data and calls cas_add_service().

static int cas_adapter_probe(struct btd_adapter *adapter)
{
    struct cas_data *data;
    struct gatt_db *db;

    db = btd_adapter_get_gatt_db(adapter);
    if (!db) {
        error("CAS: Cannot get GATT database from adapter");
        return -EINVAL;
    }

    data = g_new0(struct cas_data, 1);
    data->adapter = btd_adapter_ref(adapter);
    data->db = gatt_db_ref(db);

    /*
     * Determine if this device is configured as a Coordinated Set
     * member (e.g. via /etc/bluetooth/main.conf or a config file).
     * In practice, this is determined by whether CSIS has been
     * registered by the CSIS plugin before CAS initialises.
     */
    data->csis_attr = csis_get_service_attribute(adapter);
    data->is_set_member = (data->csis_attr != NULL);

    /* Register CAS in the GATT database */
    cas_add_service(data);

    btd_adapter_set_data(adapter, data);

    DBG("CAS: Registered on adapter %s (set_member=%d)",
        btd_adapter_get_path(adapter), data->is_set_member);

    return 0;
}

static void cas_adapter_remove(struct btd_adapter *adapter)
{
    struct cas_data *data = btd_adapter_get_data(adapter);

    if (!data)
        return;

    /* Remove CAS from the GATT database */
    if (data->service)
        gatt_db_remove_service(data->db, data->service);

    gatt_db_unref(data->db);
    btd_adapter_unref(data->adapter);
    g_free(data);
}

/* Profile registration: CAS runs as an adapter-level plugin */
static const struct btd_profile cas_profile = {
    .name            = "cas",
    .priority        = BTD_PROFILE_PRIORITY_MEDIUM,
    .adapter_probe   = cas_adapter_probe,
    .adapter_remove  = cas_adapter_remove,
};

/* BlueZ plugin descriptor — tells bluetoothd about this plugin */
static int cas_plugin_init(void)
{
    DBG("CAS plugin initialising");
    return btd_profile_register(&cas_profile);
}

static void cas_plugin_exit(void)
{
    DBG("CAS plugin exiting");
    btd_profile_unregister(&cas_profile);
}

/* Macro that registers this as a BlueZ plugin with the daemon */
BLUETOOTH_PLUGIN_DEFINE(cas, VERSION,
                        BLUETOOTH_PLUGIN_PRIORITY_DEFAULT,
                        cas_plugin_init,
                        cas_plugin_exit)

Once connected to a CAP Acceptor device, use the GATT menu in bluetoothctl to list all services and look for the CAS UUID.

# Start bluetoothd in experimental mode first:
sudo bluetoothd --experimental &

# Launch bluetoothctl
bluetoothctl

# Enable LE scanning and find a CAP Acceptor
[bluetooth]# scan le
[NEW] Device AA:BB:CC:DD:EE:FF TWS_Earbuds_L

# Connect
[bluetooth]# connect AA:BB:CC:DD:EE:FF
Connection successful

# Switch to GATT menu
[bluetooth]# menu gatt

# List all attributes (services + characteristics)
[bluetooth]# list-attributes AA:BB:CC:DD:EE:FF

# Expected output (look for these UUIDs):
#
# Primary Service (Handle 0x0020)
#   /org/bluez/hci0/dev_AA_BB_CC_DD_EE_FF/service0020
#   00001853-0000-1000-8000-00805f9b34fb  <-- CAS UUID !!
#
# Included Service (Handle 0x0021)  <-- if Coordinated Set member
#   00001846-0000-1000-8000-00805f9b34fb  <-- CSIS UUID !!
#
# Primary Service (Handle 0x0030)
#   00001846-0000-1000-8000-00805f9b34fb  <-- CSIS service
#
# Characteristic (Handle 0x0031)
#   00002b84-0000-1000-8000-00805f9b34fb  <-- SIRK
#
# Characteristic (Handle 0x0033)
#   00002b85-0000-1000-8000-00805f9b34fb  <-- Set Size
#
# Characteristic (Handle 0x0035)
#   00002b86-0000-1000-8000-00805f9b34fb  <-- Member Lock

# Still in bluetoothctl GATT menu:

# Read the Coordinated Set Size characteristic
[bluetooth]# read /org/bluez/hci0/dev_AA_BB_CC_DD_EE_FF/service0030/char0033
# Response: 0x02  (set has 2 members — a pair)

# Read the Member Rank
[bluetooth]# read /org/bluez/hci0/dev_AA_BB_CC_DD_EE_FF/service0030/char0037
# Response: 0x01  (this is member rank 1 = Left earbud)

# Reading SIRK requires an encrypted connection (bonded device)
[bluetooth]# read /org/bluez/hci0/dev_AA_BB_CC_DD_EE_FF/service0030/char0031
# Response: 01 AB CD EF ...  (1 byte type + 16 byte key)
#           ^^ type 0x01 = Encrypted SIRK

gatttool lets you inspect raw ATT PDUs. This is useful for understanding exactly what bytes are on the wire when CAS is discovered.

# Connect and list all primary services
gatttool -b AA:BB:CC:DD:EE:FF -I
> connect
> primary

# Output example:
# attr handle: 0x0001, end grp handle: 0x0009 uuid: 00001800-... (GAP)
# attr handle: 0x000a, end grp handle: 0x000d uuid: 00001801-... (GATT)
# attr handle: 0x0020, end grp handle: 0x0021 uuid: 00001853-... (CAS)  <--
# attr handle: 0x0030, end grp handle: 0x0038 uuid: 00001846-... (CSIS) <--
# attr handle: 0x0040, end grp handle: 0x0060 uuid: 00001850-... (PACS)
# attr handle: 0x0070, end grp handle: 0x0090 uuid: 0000184e-... (ASCS)

# Read the CAS service declaration attribute directly (handle 0x0020)
> char-read-hnd 0x0020
# Characteristic value/descriptor: 53 18
#                                   ^^ ^^ = 0x1853 in little-endian

# Find Include Declaration inside CAS (handle 0x0021)
> char-read-hnd 0x0021
# Characteristic value/descriptor: 30 00 38 00 46 18
#                                   ^^^^^ start handle of CSIS = 0x0030
#                                         ^^^^^ end handle of CSIS = 0x0038
#                                               ^^^^^ CSIS UUID = 0x1846

1. A device exposes CAS but has no Include Declaration inside it. What does this tell the CAP Initiator?
2. What is the SIRK, and why must the Initiator resolve it before it can connect to the second earbud?
3. If a device supports EATT, what additional entry must appear in the CAS SDP record?
4. In the BlueZ GATT API, what does passing true as the third argument to gatt_db_add_service() do?
5. How does the CAP Initiator know that it has connected to all members of a Coordinated Set?
6. What ATT PDU type does the Initiator use to discover Primary Services?