Merge "Handle AVRCP fragment due to unique event 0xFFF"
diff --git a/PREUPLOAD.cfg b/PREUPLOAD.cfg
index 7fb1636..380216c 100644
--- a/PREUPLOAD.cfg
+++ b/PREUPLOAD.cfg
@@ -4,3 +4,6 @@
 [Builtin Hooks]
 clang_format = true
 
+[Hook Scripts]
+aosp_first = ${REPO_ROOT}/frameworks/base/tools/aosp/aosp_sha.sh ${PREUPLOAD_COMMIT} ".*$"
+
diff --git a/audio_bluetooth_hw/Android.bp b/audio_bluetooth_hw/Android.bp
index 9cdd64a..de1effd 100644
--- a/audio_bluetooth_hw/Android.bp
+++ b/audio_bluetooth_hw/Android.bp
@@ -19,7 +19,6 @@
         "libcutils",
         "libfmq",
         "libhidlbase",
-        "libhidltransport",
         "liblog",
         "libutils",
     ],
diff --git a/audio_bluetooth_hw/stream_apis.cc b/audio_bluetooth_hw/stream_apis.cc
index 74b6f2a..9b4c5cf 100644
--- a/audio_bluetooth_hw/stream_apis.cc
+++ b/audio_bluetooth_hw/stream_apis.cc
@@ -36,13 +36,95 @@
 
 namespace {
 
-constexpr unsigned int kMinimumDelayMs = 100;
+constexpr unsigned int kMinimumDelayMs = 50;
 constexpr unsigned int kMaximumDelayMs = 1000;
 constexpr int kExtraAudioSyncMs = 200;
 
 std::ostream& operator<<(std::ostream& os, const audio_config& config) {
   return os << "audio_config[sample_rate=" << config.sample_rate
-            << ", channels=" << StringPrintf("%#x", config.channel_mask) << ", format=" << config.format << "]";
+            << ", channels=" << StringPrintf("%#x", config.channel_mask)
+            << ", format=" << config.format << "]";
+}
+
+void out_calculate_feeding_delay_ms(const BluetoothStreamOut* out,
+                                    uint32_t* latency_ms,
+                                    uint64_t* frames = nullptr,
+                                    struct timespec* timestamp = nullptr) {
+  if (latency_ms == nullptr && frames == nullptr && timestamp == nullptr) {
+    return;
+  }
+
+  // delay_report is the audio delay from the remote headset receiving data to
+  // the headset playing sound in units of nanoseconds
+  uint64_t delay_report_ns = 0;
+  uint64_t delay_report_ms = 0;
+  // absorbed_bytes is the total number of bytes sent by the Bluetooth stack to
+  // a remote headset
+  uint64_t absorbed_bytes = 0;
+  // absorbed_timestamp is the ...
+  struct timespec absorbed_timestamp = {};
+  bool timestamp_fetched = false;
+
+  std::unique_lock<std::mutex> lock(out->mutex_);
+  if (out->bluetooth_output_.GetPresentationPosition(
+          &delay_report_ns, &absorbed_bytes, &absorbed_timestamp)) {
+    delay_report_ms = delay_report_ns / 1000000;
+    // assume kMinimumDelayMs (50ms) < delay_report_ns < kMaximumDelayMs
+    // (1000ms), or it is invalid / ignored and use old delay calculated
+    // by ourselves.
+    if (delay_report_ms > kMinimumDelayMs &&
+        delay_report_ms < kMaximumDelayMs) {
+      timestamp_fetched = true;
+    } else if (delay_report_ms >= kMaximumDelayMs) {
+      LOG(INFO) << __func__ << ": state=" << out->bluetooth_output_.GetState()
+                << ", delay_report=" << delay_report_ns << "ns abnormal";
+    }
+  }
+  if (!timestamp_fetched) {
+    // default to old delay if any failure is found when fetching from ports
+    // audio_a2dp_hw:
+    //   frames_count = buffer_size / frame_size
+    //   latency (sec.) = frames_count / samples_per_second (sample_rate)
+    // Sync from audio_a2dp_hw to add extra delay kExtraAudioSyncMs(+200ms)
+    delay_report_ms =
+        out->frames_count_ * 1000 / out->sample_rate_ + kExtraAudioSyncMs;
+    if (timestamp != nullptr) {
+      clock_gettime(CLOCK_MONOTONIC, &absorbed_timestamp);
+    }
+    LOG(VERBOSE) << __func__ << ": state=" << out->bluetooth_output_.GetState()
+                 << " uses the legacy delay " << delay_report_ms << " ms";
+  }
+  LOG(VERBOSE) << __func__ << ": state=" << out->bluetooth_output_.GetState()
+               << ", delay=" << delay_report_ms << "ms, data=" << absorbed_bytes
+               << " bytes, timestamp=" << absorbed_timestamp.tv_sec << "."
+               << StringPrintf("%09ld", absorbed_timestamp.tv_nsec) << "s";
+
+  if (latency_ms != nullptr) {
+    *latency_ms = delay_report_ms;
+  }
+  if (frames != nullptr) {
+    const uint64_t latency_frames = delay_report_ms * out->sample_rate_ / 1000;
+    *frames = absorbed_bytes / audio_stream_out_frame_size(&out->stream_out_);
+    if (out->frames_presented_ < *frames) {
+      // Are we (the audio HAL) reset?! The stack counter is obsoleted.
+      *frames = out->frames_presented_;
+    } else if ((out->frames_presented_ - *frames) > latency_frames) {
+      // Is the Bluetooth output reset / restarted by AVDTP reconfig?! Its
+      // counter was reset but could not be used.
+      *frames = out->frames_presented_;
+    }
+    // suppose frames would be queued in the headset buffer for delay_report
+    // period, so those frames in buffers should not be included in the number
+    // of presented frames at the timestamp.
+    if (*frames > latency_frames) {
+      *frames -= latency_frames;
+    } else {
+      *frames = 0;
+    }
+  }
+  if (timestamp != nullptr) {
+    *timestamp = absorbed_timestamp;
+  }
 }
 
 }  // namespace
@@ -340,17 +422,11 @@
 
 static uint32_t out_get_latency_ms(const struct audio_stream_out* stream) {
   const auto* out = reinterpret_cast<const BluetoothStreamOut*>(stream);
-  std::unique_lock<std::mutex> lock(out->mutex_);
-  /***
-   * audio_a2dp_hw:
-   *   frames_count = buffer_size / frame_size
-   *   latency (sec.) = frames_count / sample_rate
-   */
-  uint32_t latency_ms = out->frames_count_ * 1000 / out->sample_rate_;
+  uint32_t latency_ms = 0;
+  out_calculate_feeding_delay_ms(out, &latency_ms);
   LOG(VERBOSE) << __func__ << ": state=" << out->bluetooth_output_.GetState()
-               << ", latency_ms=" << latency_ms;
-  // Sync from audio_a2dp_hw to add extra +200ms
-  return latency_ms + kExtraAudioSyncMs;
+               << ", latency=" << latency_ms << "ms";
+  return latency_ms;
 }
 
 static int out_set_volume(struct audio_stream_out* stream, float left,
@@ -419,13 +495,11 @@
 
 static int out_get_render_position(const struct audio_stream_out* stream,
                                    uint32_t* dsp_frames) {
-  const auto* out = reinterpret_cast<const BluetoothStreamOut*>(stream);
-  std::unique_lock<std::mutex> lock(out->mutex_);
-
   if (dsp_frames == nullptr) return -EINVAL;
 
-  /* frames = (latency (ms) / 1000) * sample_per_seconds */
-  uint64_t latency_frames =
+  const auto* out = reinterpret_cast<const BluetoothStreamOut*>(stream);
+  // frames = (latency (ms) / 1000) * samples_per_second (sample_rate)
+  const uint64_t latency_frames =
       (uint64_t)out_get_latency_ms(stream) * out->sample_rate_ / 1000;
   if (out->frames_rendered_ >= latency_frames) {
     *dsp_frames = (uint32_t)(out->frames_rendered_ - latency_frames);
@@ -527,52 +601,12 @@
     return -EINVAL;
   }
 
-  // bytes is the total number of bytes sent by the Bluetooth stack to a
-  // remote headset
-  uint64_t bytes = 0;
-  // delay_report is the audio delay from the remote headset receiving data to
-  // the headset playing sound in units of nanoseconds
-  uint64_t delay_report_ns = 0;
   const auto* out = reinterpret_cast<const BluetoothStreamOut*>(stream);
-  std::unique_lock<std::mutex> lock(out->mutex_);
-
-  if (out->bluetooth_output_.GetPresentationPosition(&delay_report_ns, &bytes,
-                                                     timestamp)) {
-    // assume kMinimumDelayMs (100ms) < delay_report_ns < kMaximumDelayMs
-    // (1000ms), or it is invalid / ignored and use old delay calculated
-    // by ourselves.
-    if (delay_report_ns > kMinimumDelayMs * 1000000 &&
-        delay_report_ns < kMaximumDelayMs * 1000000) {
-      *frames = bytes / audio_stream_out_frame_size(stream);
-      timestamp->tv_nsec += delay_report_ns;
-      if (timestamp->tv_nsec > 1000000000) {
-        timestamp->tv_sec += static_cast<int>(timestamp->tv_nsec / 1000000000);
-        timestamp->tv_nsec %= 1000000000;
-      }
-      LOG(VERBOSE) << __func__ << ": state=" << out->bluetooth_output_.GetState() << ", frames=" << *frames << " ("
-                   << bytes << " bytes), timestamp=" << timestamp->tv_sec << "."
-                   << StringPrintf("%09ld", timestamp->tv_nsec) << "s";
-      return 0;
-    } else if (delay_report_ns >= kMaximumDelayMs * 1000000) {
-      LOG(WARNING) << __func__
-                   << ": state=" << out->bluetooth_output_.GetState()
-                   << ", delay_report=" << delay_report_ns << "ns abnormal";
-    }
-  }
-
-  // default to old delay if any failure is found when fetching from ports
-  if (out->frames_presented_ >= out->frames_count_) {
-    clock_gettime(CLOCK_MONOTONIC, timestamp);
-    *frames = out->frames_presented_ - out->frames_count_;
-    LOG(VERBOSE) << __func__ << ": state=" << out->bluetooth_output_.GetState() << ", frames=" << *frames << " ("
-                 << bytes << " bytes), timestamp=" << timestamp->tv_sec << "."
-                 << StringPrintf("%09ld", timestamp->tv_nsec) << "s";
-    return 0;
-  }
-
-  *frames = 0;
-  *timestamp = {};
-  return -EWOULDBLOCK;
+  out_calculate_feeding_delay_ms(out, nullptr, frames, timestamp);
+  LOG(VERBOSE) << __func__ << ": state=" << out->bluetooth_output_.GetState()
+               << ", frames=" << *frames << ", timestamp=" << timestamp->tv_sec
+               << "." << StringPrintf("%09ld", timestamp->tv_nsec) << "s";
+  return 0;
 }
 
 static void out_update_source_metadata(
diff --git a/audio_hal_interface/Android.bp b/audio_hal_interface/Android.bp
index 4b10435..94a77ff 100644
--- a/audio_hal_interface/Android.bp
+++ b/audio_hal_interface/Android.bp
@@ -19,7 +19,6 @@
         "android.hardware.bluetooth.audio@2.0",
         "libfmq",
         "libhidlbase",
-        "libhidltransport",
     ],
     static_libs: [
         "libosi",
@@ -46,7 +45,6 @@
         "libcutils",
         "libfmq",
         "libhidlbase",
-        "libhidltransport",
         "liblog",
         "libutils",
     ],
diff --git a/audio_hal_interface/client_interface.h b/audio_hal_interface/client_interface.h
index 11984aa..8ee2bb1 100644
--- a/audio_hal_interface/client_interface.h
+++ b/audio_hal_interface/client_interface.h
@@ -158,8 +158,9 @@
 
   static constexpr PcmParameters kInvalidPcmConfiguration = {
       .sampleRate = SampleRate::RATE_UNKNOWN,
+      .channelMode = ChannelMode::UNKNOWN,
       .bitsPerSample = BitsPerSample::BITS_UNKNOWN,
-      .channelMode = ChannelMode::UNKNOWN};
+  };
 
  private:
   // Helper function to connect to an IBluetoothAudioProvider
diff --git a/binder/Android.bp b/binder/Android.bp
index 9e1695c..e4beadb 100644
--- a/binder/Android.bp
+++ b/binder/Android.bp
@@ -54,7 +54,6 @@
         ],
     },
     include_dirs: [
-        "libnativehelper/include/nativehelper",
         "system/bt/types",
     ],
     shared_libs: [
@@ -76,6 +75,9 @@
         "-Wextra",
         "-Wno-unused-parameter",
     ],
+    sanitize: {
+        scs: true,
+    },
 }
 
 // AIDL interface between libbluetooth-binder and framework.jar
diff --git a/binder/android/bluetooth/IBluetooth.aidl b/binder/android/bluetooth/IBluetooth.aidl
index 6bda14b..fa2b063 100644
--- a/binder/android/bluetooth/IBluetooth.aidl
+++ b/binder/android/bluetooth/IBluetooth.aidl
@@ -35,12 +35,14 @@
  */
 interface IBluetooth
 {
+    @UnsupportedAppUsage
     boolean isEnabled();
     int getState();
     boolean enable();
     boolean enableNoAutoConnect();
     boolean disable();
 
+    @UnsupportedAppUsage
     String getAddress();
     ParcelUuid[] getUuids();
     boolean setName(in String name);
@@ -79,10 +81,12 @@
 
     String getRemoteName(in BluetoothDevice device);
     int getRemoteType(in BluetoothDevice device);
+    @UnsupportedAppUsage
     String getRemoteAlias(in BluetoothDevice device);
     boolean setRemoteAlias(in BluetoothDevice device, in String name);
     int getRemoteClass(in BluetoothDevice device);
     ParcelUuid[] getRemoteUuids(in BluetoothDevice device);
+    @UnsupportedAppUsage
     boolean fetchRemoteUuids(in BluetoothDevice device);
     boolean sdpSearch(in BluetoothDevice device, in ParcelUuid uuid);
     int getBatteryLevel(in BluetoothDevice device);
@@ -102,6 +106,7 @@
     int getSimAccessPermission(in BluetoothDevice device);
     boolean setSimAccessPermission(in BluetoothDevice device, int value);
 
+    @UnsupportedAppUsage
     void sendConnectionStateChange(in BluetoothDevice device, int profile, int state, int prevState);
 
     void registerCallback(in IBluetoothCallback callback);
diff --git a/binder/android/bluetooth/IBluetoothA2dp.aidl b/binder/android/bluetooth/IBluetoothA2dp.aidl
index 6606a1b..9cbd9ca 100644
--- a/binder/android/bluetooth/IBluetoothA2dp.aidl
+++ b/binder/android/bluetooth/IBluetoothA2dp.aidl
@@ -27,14 +27,20 @@
  */
 interface IBluetoothA2dp {
     // Public API
+    @UnsupportedAppUsage
     boolean connect(in BluetoothDevice device);
+    @UnsupportedAppUsage
     boolean disconnect(in BluetoothDevice device);
+    @UnsupportedAppUsage
     List<BluetoothDevice> getConnectedDevices();
+    @UnsupportedAppUsage
     List<BluetoothDevice> getDevicesMatchingConnectionStates(in int[] states);
+    @UnsupportedAppUsage
     int getConnectionState(in BluetoothDevice device);
     boolean setActiveDevice(in BluetoothDevice device);
     BluetoothDevice getActiveDevice();
     boolean setPriority(in BluetoothDevice device, int priority);
+    @UnsupportedAppUsage
     int getPriority(in BluetoothDevice device);
     boolean isAvrcpAbsoluteVolumeSupported();
     oneway void setAvrcpAbsoluteVolume(int volume);
diff --git a/binder/android/bluetooth/IBluetoothGatt.aidl b/binder/android/bluetooth/IBluetoothGatt.aidl
index c9e1c4b..016eeff 100644
--- a/binder/android/bluetooth/IBluetoothGatt.aidl
+++ b/binder/android/bluetooth/IBluetoothGatt.aidl
@@ -71,8 +71,10 @@
     void registerSync(in ScanResult scanResult, in int skip, in int timeout, in IPeriodicAdvertisingCallback callback);
     void unregisterSync(in IPeriodicAdvertisingCallback callback);
 
+    @UnsupportedAppUsage
     void registerClient(in ParcelUuid appId, in IBluetoothGattCallback callback);
 
+    @UnsupportedAppUsage
     void unregisterClient(in int clientIf);
     void clientConnect(in int clientIf, in String address, in boolean isDirect, in int transport, in boolean opportunistic, in int phy);
     void clientDisconnect(in int clientIf, in String address);
diff --git a/binder/android/bluetooth/IBluetoothHeadset.aidl b/binder/android/bluetooth/IBluetoothHeadset.aidl
index 0f6954c..c59cab1 100644
--- a/binder/android/bluetooth/IBluetoothHeadset.aidl
+++ b/binder/android/bluetooth/IBluetoothHeadset.aidl
@@ -29,8 +29,10 @@
  */
 interface IBluetoothHeadset {
     // Public API
+    @UnsupportedAppUsage
     List<BluetoothDevice> getConnectedDevices();
     List<BluetoothDevice> getDevicesMatchingConnectionStates(in int[] states);
+    @UnsupportedAppUsage
     int getConnectionState(in BluetoothDevice device);
     boolean startVoiceRecognition(in BluetoothDevice device);
     boolean stopVoiceRecognition(in BluetoothDevice device);
@@ -40,9 +42,13 @@
                                          in String arg);
 
     // Hidden API
+    @UnsupportedAppUsage
     boolean connect(in BluetoothDevice device);
+    @UnsupportedAppUsage
     boolean disconnect(in BluetoothDevice device);
+    @UnsupportedAppUsage
     boolean setPriority(in BluetoothDevice device, int priority);
+    @UnsupportedAppUsage
     int getPriority(in BluetoothDevice device);
     int getAudioState(in BluetoothDevice device);
     boolean isAudioOn();
diff --git a/binder/android/bluetooth/IBluetoothHeadsetClient.aidl b/binder/android/bluetooth/IBluetoothHeadsetClient.aidl
index 13495ae..6341af4 100644
--- a/binder/android/bluetooth/IBluetoothHeadsetClient.aidl
+++ b/binder/android/bluetooth/IBluetoothHeadsetClient.aidl
@@ -59,6 +59,7 @@
     boolean disconnectAudio(in BluetoothDevice device);
     void setAudioRouteAllowed(in BluetoothDevice device, boolean allowed);
     boolean getAudioRouteAllowed(in BluetoothDevice device);
+    boolean sendVendorAtCommand(in BluetoothDevice device, int vendorId, String atCommand);
 
     Bundle getCurrentAgFeatures(in BluetoothDevice device);
 }
diff --git a/binder/android/bluetooth/IBluetoothManager.aidl b/binder/android/bluetooth/IBluetoothManager.aidl
index 2e12700..faf78d8 100644
--- a/binder/android/bluetooth/IBluetoothManager.aidl
+++ b/binder/android/bluetooth/IBluetoothManager.aidl
@@ -31,13 +31,16 @@
 {
     IBluetooth registerAdapter(in IBluetoothManagerCallback callback);
     void unregisterAdapter(in IBluetoothManagerCallback callback);
+    @UnsupportedAppUsage
     void registerStateChangeCallback(in IBluetoothStateChangeCallback callback);
+    @UnsupportedAppUsage
     void unregisterStateChangeCallback(in IBluetoothStateChangeCallback callback);
     boolean isEnabled();
     boolean enable(String packageName);
     boolean enableNoAutoConnect(String packageName);
     boolean disable(String packageName, boolean persist);
     int getState();
+    @UnsupportedAppUsage
     IBluetoothGatt getBluetoothGatt();
 
     boolean bindBluetoothProfileService(int profile, IBluetoothProfileServiceConnection proxy);
diff --git a/binder/android/bluetooth/IBluetoothPan.aidl b/binder/android/bluetooth/IBluetoothPan.aidl
index 16b6ddf..4052aa4 100644
--- a/binder/android/bluetooth/IBluetoothPan.aidl
+++ b/binder/android/bluetooth/IBluetoothPan.aidl
@@ -26,7 +26,7 @@
 interface IBluetoothPan {
     // Public API
     boolean isTetheringOn();
-    void setBluetoothTethering(boolean value);
+    void setBluetoothTethering(boolean value, String pkgName);
     boolean connect(in BluetoothDevice device);
     boolean disconnect(in BluetoothDevice device);
     List<BluetoothDevice> getConnectedDevices();
diff --git a/bta/Android.bp b/bta/Android.bp
index 0e7bfe8..824076e 100644
--- a/bta/Android.bp
+++ b/bta/Android.bp
@@ -34,7 +34,6 @@
 cc_library_static {
     name: "libbt-bta",
     defaults: ["fluoride_bta_defaults"],
-    cflags: ["-Wno-implicit-fallthrough"],
     srcs: [
         "ag/bta_ag_act.cc",
         "ag/bta_ag_api.cc",
diff --git a/bta/ag/bta_ag_cmd.cc b/bta/ag/bta_ag_cmd.cc
index bec5497..87b2a82 100644
--- a/bta/ag/bta_ag_cmd.cc
+++ b/bta/ag/bta_ag_cmd.cc
@@ -782,9 +782,11 @@
  ******************************************************************************/
 static bool bta_ag_parse_biev_response(tBTA_AG_SCB* p_scb, tBTA_AG_VAL* val) {
   char* p_token = strtok(val->str, ",");
+  if (p_token == nullptr) return false;
   uint16_t rcv_ind_id = atoi(p_token);
 
   p_token = strtok(nullptr, ",");
+  if (p_token == nullptr) return false;
   uint16_t rcv_ind_val = atoi(p_token);
 
   APPL_TRACE_DEBUG("%s BIEV indicator id %d, value %d", __func__, rcv_ind_id,
diff --git a/bta/ag/bta_ag_main.cc b/bta/ag/bta_ag_main.cc
index f70027f..f7bb8be 100644
--- a/bta/ag/bta_ag_main.cc
+++ b/bta/ag/bta_ag_main.cc
@@ -564,8 +564,8 @@
   if (p_scb->state == BTA_AG_INIT_ST) {
     LOG(INFO) << __func__ << ": Resume connection to " << p_scb->peer_addr
               << ", handle" << bta_ag_scb_to_idx(p_scb);
-    tBTA_AG_DATA open_data = {.api_open.bd_addr = p_scb->peer_addr,
-                              .api_open.sec_mask = p_scb->cli_sec_mask};
+    tBTA_AG_DATA open_data = {.api_open = {.bd_addr = p_scb->peer_addr,
+                                           .sec_mask = p_scb->cli_sec_mask}};
     bta_ag_sm_execute(p_scb, BTA_AG_API_OPEN_EVT, open_data);
   } else {
     VLOG(1) << __func__ << ": device " << p_scb->peer_addr
diff --git a/bta/ag/bta_ag_sdp.cc b/bta/ag/bta_ag_sdp.cc
index ba955d3..88b3bdb 100644
--- a/bta/ag/bta_ag_sdp.cc
+++ b/bta/ag/bta_ag_sdp.cc
@@ -87,7 +87,7 @@
     } else {
       event = BTA_AG_DISC_INT_RES_EVT;
     }
-    tBTA_AG_DATA disc_result = {.disc_result.status = status};
+    tBTA_AG_DATA disc_result = {.disc_result = {.status = status}};
     do_in_main_thread(FROM_HERE, base::Bind(&bta_ag_sm_execute_by_handle, idx,
                                             event, disc_result));
   }
diff --git a/bta/av/bta_av_aact.cc b/bta/av/bta_av_aact.cc
index 108af36..aaf3dc5 100644
--- a/bta/av/bta_av_aact.cc
+++ b/bta/av/bta_av_aact.cc
@@ -965,7 +965,7 @@
  *
  ******************************************************************************/
 void bta_av_config_ind(tBTA_AV_SCB* p_scb, tBTA_AV_DATA* p_data) {
-  tBTA_AV_CI_SETCONFIG setconfig;
+  tBTA_AV_CI_SETCONFIG setconfig{};
   tAVDT_SEP_INFO* p_info;
   const AvdtpSepConfig* p_evt_cfg = &p_data->str_msg.cfg;
   uint8_t psc_mask = (p_evt_cfg->psc_mask | p_scb->cfg.psc_mask);
@@ -1167,6 +1167,7 @@
     } else {
       /* we do not know the peer device and it is using non-SBC codec
        * we need to know all the SEPs on SNK */
+      if (p_scb->uuid_int == 0) p_scb->uuid_int = p_scb->open_api.uuid;
       bta_av_discover_req(p_scb, NULL);
       return;
     }
@@ -3106,7 +3107,7 @@
   ARRAY_TO_STREAM(p_param, offload_start->codec_info,
                   (int8_t)sizeof(offload_start->codec_info));
   p_scb->offload_started = true;
-  BTM_VendorSpecificCommand(HCI_CONTROLLER_A2DP_OPCODE_OCF, p_param - param,
+  BTM_VendorSpecificCommand(HCI_CONTROLLER_A2DP, p_param - param,
                             param, offload_vendor_callback);
 }
 
@@ -3114,7 +3115,7 @@
   uint8_t param[sizeof(tBT_A2DP_OFFLOAD)];
   APPL_TRACE_DEBUG("%s", __func__);
   param[0] = VS_HCI_A2DP_OFFLOAD_STOP;
-  BTM_VendorSpecificCommand(HCI_CONTROLLER_A2DP_OPCODE_OCF, 1, param,
+  BTM_VendorSpecificCommand(HCI_CONTROLLER_A2DP, 1, param,
                             offload_vendor_callback);
 }
 /*******************************************************************************
diff --git a/bta/av/bta_av_main.cc b/bta/av/bta_av_main.cc
index 34516fc..e33635e 100644
--- a/bta/av/bta_av_main.cc
+++ b/bta/av/bta_av_main.cc
@@ -243,9 +243,7 @@
   enable.features = bta_av_cb.features;
 
   /* Register for SCO change event */
-  if (!(bta_av_cb.features & BTA_AV_FEAT_NO_SCO_SSPD)) {
-    bta_sys_sco_register(bta_av_sco_chg_cback);
-  }
+  bta_sys_sco_register(bta_av_sco_chg_cback);
 
   /* call callback with enable event */
   tBTA_AV bta_av_data;
@@ -986,16 +984,20 @@
   int i;
   tBTA_AV_API_STOP stop;
 
-  APPL_TRACE_DEBUG("%s: id:%d status:%d", __func__, id, status);
+  LOG(INFO) << __func__ << ": status=" << +status << ", num_links=" << +id;
   if (id) {
     bta_av_cb.sco_occupied = true;
 
+    if (bta_av_cb.features & BTA_AV_FEAT_NO_SCO_SSPD) {
+      return;
+    }
+
     /* either BTA_SYS_SCO_OPEN or BTA_SYS_SCO_CLOSE with remaining active SCO */
     for (i = 0; i < BTA_AV_NUM_STRS; i++) {
       p_scb = bta_av_cb.p_scb[i];
 
       if (p_scb && p_scb->co_started && (!p_scb->sco_suspend)) {
-        APPL_TRACE_DEBUG("%s: suspending scb:%d", __func__, i);
+        VLOG(1) << __func__ << ": suspending scb:" << i;
         /* scb is used and started, not suspended automatically */
         p_scb->sco_suspend = true;
         stop.flush = false;
@@ -1007,12 +1009,16 @@
   } else {
     bta_av_cb.sco_occupied = false;
 
+    if (bta_av_cb.features & BTA_AV_FEAT_NO_SCO_SSPD) {
+      return;
+    }
+
     for (i = 0; i < BTA_AV_NUM_STRS; i++) {
       p_scb = bta_av_cb.p_scb[i];
 
       if (p_scb && p_scb->sco_suspend) /* scb is used and suspended for SCO */
       {
-        APPL_TRACE_DEBUG("%s: starting scb:%d", __func__, i);
+        VLOG(1) << __func__ << ": starting scb:" << i;
         bta_av_ssm_execute(p_scb, BTA_AV_AP_START_EVT, NULL);
       }
     }
@@ -1108,8 +1114,10 @@
                   "%s: peer %s BTM_SwitchRole(BTM_ROLE_MASTER) error: %d",
                   __func__, p_scb->PeerAddress().ToString().c_str(), status);
       }
-      is_ok = false;
-      p_scb->wait |= BTA_AV_WAIT_ROLE_SW_RES_START;
+      if (status != BTM_MODE_UNSUPPORTED && status != BTM_DEV_BLACKLISTED) {
+        is_ok = false;
+        p_scb->wait |= BTA_AV_WAIT_ROLE_SW_RES_START;
+      }
     }
   }
 
diff --git a/bta/dm/bta_dm_act.cc b/bta/dm/bta_dm_act.cc
index 7ba3c74..43befc2 100644
--- a/bta/dm/bta_dm_act.cc
+++ b/bta/dm/bta_dm_act.cc
@@ -50,6 +50,7 @@
 #include "stack/gatt/connection_manager.h"
 #include "stack/include/gatt_api.h"
 #include "utl.h"
+#include "device/include/interop.h"
 
 #if (GAP_INCLUDED == TRUE)
 #include "gap_api.h"
@@ -1945,10 +1946,12 @@
     APPL_TRACE_DEBUG("%s appl_knows_rem_name %d", __func__,
                      bta_dm_search_cb.p_btm_inq_info->appl_knows_rem_name);
   }
-  if ((bta_dm_search_cb.p_btm_inq_info) &&
-      (bta_dm_search_cb.p_btm_inq_info->results.device_type ==
-       BT_DEVICE_TYPE_BLE) &&
-      (bta_dm_search_cb.state == BTA_DM_SEARCH_ACTIVE)) {
+  if (((bta_dm_search_cb.p_btm_inq_info) &&
+       (bta_dm_search_cb.p_btm_inq_info->results.device_type ==
+        BT_DEVICE_TYPE_BLE) &&
+       (bta_dm_search_cb.state == BTA_DM_SEARCH_ACTIVE)) ||
+      (transport == BT_TRANSPORT_LE &&
+       interop_match_addr(INTEROP_DISABLE_NAME_REQUEST, &bta_dm_search_cb.peer_bdaddr))) {
     /* Do not perform RNR for LE devices at inquiry complete*/
     bta_dm_search_cb.name_discover_done = true;
   }
@@ -2504,7 +2507,7 @@
       sec_event.cfm_req.loc_io_caps = p_data->cfm_req.loc_io_caps;
       sec_event.cfm_req.rmt_io_caps = p_data->cfm_req.rmt_io_caps;
 
-    /* continue to next case */
+      [[fallthrough]];
     /* Passkey entry mode, mobile device with output capability is very
         unlikely to receive key request, so skip this event */
     /*case BTM_SP_KEY_REQ_EVT: */
@@ -2767,6 +2770,9 @@
                 bta_dm_cb.device_list.peer_device[i].peer_bdaddr))
           issue_unpair_cb = true;
 
+        /* remove all cached GATT information */
+        BTA_GATTC_Refresh(bd_addr);
+
         APPL_TRACE_DEBUG("%s: Unpairing: issue unpair CB = %d ", __func__,
                          issue_unpair_cb);
       }
diff --git a/bta/dm/bta_dm_cfg.cc b/bta/dm/bta_dm_cfg.cc
index 438f329..e1e2cad 100644
--- a/bta/dm/bta_dm_cfg.cc
+++ b/bta/dm/bta_dm_cfg.cc
@@ -130,9 +130,9 @@
         {BTA_ID_CG, BTA_ALL_APP_ID, 1},     /* cg resue ct spec table */
         {BTA_ID_DG, BTA_ALL_APP_ID, 2},     /* dg spec table */
         {BTA_ID_AV, BTA_ALL_APP_ID, 4},     /* av spec table */
-        {BTA_ID_AVK, BTA_ALL_APP_ID, 12},   /* avk spec table */
-        {BTA_ID_FTC, BTA_ALL_APP_ID, 6},    /* ftc spec table */
-        {BTA_ID_FTS, BTA_ALL_APP_ID, 7},    /* fts spec table */
+        {BTA_ID_AVK, BTA_ALL_APP_ID, 13},   /* avk spec table */
+        {BTA_ID_FTC, BTA_ALL_APP_ID, 7},    /* ftc spec table */
+        {BTA_ID_FTS, BTA_ALL_APP_ID, 8},    /* fts spec table */
         {BTA_ID_HD, BTA_ALL_APP_ID, 3},     /* hd spec table */
         {BTA_ID_HH, BTA_HH_APP_ID_JOY, 5},  /* app BTA_HH_APP_ID_JOY,
                                                similar to hh spec table */
@@ -140,19 +140,19 @@
                                                similar to hh spec table */
         {BTA_ID_HH, BTA_ALL_APP_ID, 6},     /* hh spec table */
         {BTA_ID_PBC, BTA_ALL_APP_ID, 2},    /* reuse dg spec table */
-        {BTA_ID_PBS, BTA_ALL_APP_ID, 7},    /* reuse fts spec table */
-        {BTA_ID_OPC, BTA_ALL_APP_ID, 6},    /* reuse ftc spec table */
-        {BTA_ID_OPS, BTA_ALL_APP_ID, 7},    /* reuse fts spec table */
-        {BTA_ID_MSE, BTA_ALL_APP_ID, 7},    /* reuse fts spec table */
+        {BTA_ID_PBS, BTA_ALL_APP_ID, 8},    /* reuse fts spec table */
+        {BTA_ID_OPC, BTA_ALL_APP_ID, 7},    /* reuse ftc spec table */
+        {BTA_ID_OPS, BTA_ALL_APP_ID, 8},    /* reuse fts spec table */
+        {BTA_ID_MSE, BTA_ALL_APP_ID, 8},    /* reuse fts spec table */
         {BTA_ID_JV, BTA_JV_PM_ID_1,
-         6}, /* app BTA_JV_PM_ID_1, reuse ftc spec table */
-        {BTA_ID_JV, BTA_ALL_APP_ID, 7},     /* reuse fts spec table */
-        {BTA_ID_HL, BTA_ALL_APP_ID, 8},     /* reuse fts spec table */
-        {BTA_ID_PAN, BTUI_PAN_ID_PANU, 9},  /* PANU spec table */
-        {BTA_ID_PAN, BTUI_PAN_ID_NAP, 10},  /* NAP spec table */
-        {BTA_ID_HS, BTA_ALL_APP_ID, 11},    /* HS spec table */
-        {BTA_ID_GATTC, BTA_ALL_APP_ID, 13}, /* gattc spec table */
-        {BTA_ID_GATTS, BTA_ALL_APP_ID, 14}  /* gatts spec table */
+         7}, /* app BTA_JV_PM_ID_1, reuse ftc spec table */
+        {BTA_ID_JV, BTA_ALL_APP_ID, 8},     /* reuse fts spec table */
+        {BTA_ID_HL, BTA_ALL_APP_ID, 9},     /* reuse fts spec table */
+        {BTA_ID_PAN, BTUI_PAN_ID_PANU, 10}, /* PANU spec table */
+        {BTA_ID_PAN, BTUI_PAN_ID_NAP, 11},  /* NAP spec table */
+        {BTA_ID_HS, BTA_ALL_APP_ID, 12},    /* HS spec table */
+        {BTA_ID_GATTC, BTA_ALL_APP_ID, 14}, /* gattc spec table */
+        {BTA_ID_GATTS, BTA_ALL_APP_ID, 15}  /* gatts spec table */
 };
 
 tBTA_DM_PM_TYPE_QUALIFIER tBTA_DM_PM_SPEC bta_dm_pm_spec[BTA_DM_NUM_PM_SPEC] = {
diff --git a/bta/gatt/bta_gattc_act.cc b/bta/gatt/bta_gattc_act.cc
index 90978f6..3ff55b1 100644
--- a/bta/gatt/bta_gattc_act.cc
+++ b/bta/gatt/bta_gattc_act.cc
@@ -213,7 +213,7 @@
   }
 
   /* remove bg connection associated with this rcb */
-  for (uint8_t i = 0; i < BTA_GATTC_KNOWN_SR_MAX; i++) {
+  for (uint8_t i = 0; i < BTM_GetWhiteListSize(); i++) {
     if (!bta_gattc_cb.bg_track[i].in_use) continue;
 
     if (bta_gattc_cb.bg_track[i].cif_mask & (1 << (p_clreg->client_if - 1))) {
@@ -478,7 +478,7 @@
       p_clcb->p_srcb->state != BTA_GATTC_SERV_IDLE) {
     if (p_clcb->p_srcb->state == BTA_GATTC_SERV_IDLE) {
       p_clcb->p_srcb->state = BTA_GATTC_SERV_LOAD;
-      if (bta_gattc_cache_load(p_clcb)) {
+      if (bta_gattc_cache_load(p_clcb->p_srcb)) {
         p_clcb->p_srcb->state = BTA_GATTC_SERV_IDLE;
         bta_gattc_reset_discover_st(p_clcb->p_srcb, GATT_SUCCESS);
       } else {
@@ -1127,6 +1127,10 @@
   Uuid gattp_uuid = Uuid::From16Bit(UUID_SERVCLASS_GATT_SERVER);
   Uuid srvc_chg_uuid = Uuid::From16Bit(GATT_UUID_GATT_SRV_CHGD);
 
+  if (p_srcb->gatt_database.IsEmpty() && p_srcb->state == BTA_GATTC_SERV_IDLE) {
+    bta_gattc_cache_load(p_srcb);
+  }
+
   const gatt::Characteristic* p_char =
       bta_gattc_get_characteristic_srcb(p_srcb, p_notify->handle);
   if (!p_char) return false;
@@ -1240,20 +1244,6 @@
   }
 
   tBTA_GATTC_CLCB* p_clcb = bta_gattc_find_clcb_by_conn_id(conn_id);
-  /* connection not open yet */
-  if (p_clcb == NULL) {
-    p_clcb = bta_gattc_clcb_alloc(gatt_if, remote_bda, transport);
-
-    if (p_clcb == NULL) {
-      LOG(ERROR) << __func__ << ": No resources";
-      return;
-    }
-
-    p_clcb->bta_conn_id = conn_id;
-    p_clcb->transport = transport;
-
-    bta_gattc_sm_execute(p_clcb, BTA_GATTC_INT_CONN_EVT, NULL);
-  }
 
   notify.handle = handle;
 
@@ -1264,6 +1254,21 @@
 
   /* if app registered for the notification */
   if (bta_gattc_check_notif_registry(p_clrcb, p_srcb, &notify)) {
+    /* connection not open yet */
+    if (p_clcb == NULL) {
+      p_clcb = bta_gattc_clcb_alloc(gatt_if, remote_bda, transport);
+
+      if (p_clcb == NULL) {
+        LOG(ERROR) << "No resources";
+        return;
+      }
+
+      p_clcb->bta_conn_id = conn_id;
+      p_clcb->transport = transport;
+
+      bta_gattc_sm_execute(p_clcb, BTA_GATTC_INT_CONN_EVT, NULL);
+    }
+
     if (p_clcb != NULL)
       bta_gattc_proc_other_indication(p_clcb, op, p_data, &notify);
   }
diff --git a/bta/gatt/bta_gattc_api.cc b/bta/gatt/bta_gattc_api.cc
index 9b0bd9e..829084c 100644
--- a/bta/gatt/bta_gattc_api.cc
+++ b/bta/gatt/bta_gattc_api.cc
@@ -269,7 +269,7 @@
  * Returns          returns list of gatt::Service or NULL.
  *
  ******************************************************************************/
-const std::vector<gatt::Service>* BTA_GATTC_GetServices(uint16_t conn_id) {
+const std::list<gatt::Service>* BTA_GATTC_GetServices(uint16_t conn_id) {
   return bta_gattc_get_services(conn_id);
 }
 
diff --git a/bta/gatt/bta_gattc_cache.cc b/bta/gatt/bta_gattc_cache.cc
index 6c793f1..eed1d67 100644
--- a/bta/gatt/bta_gattc_cache.cc
+++ b/bta/gatt/bta_gattc_cache.cc
@@ -120,7 +120,7 @@
 }
 
 const Service* bta_gattc_find_matching_service(
-    const std::vector<Service>& services, uint16_t handle) {
+    const std::list<Service>& services, uint16_t handle) {
   for (const Service& service : services) {
     if (handle >= service.handle && handle <= service.end_handle)
       return &service;
@@ -419,14 +419,13 @@
   }
 }
 
-const std::vector<Service>* bta_gattc_get_services_srcb(
-    tBTA_GATTC_SERV* p_srcb) {
+const std::list<Service>* bta_gattc_get_services_srcb(tBTA_GATTC_SERV* p_srcb) {
   if (!p_srcb || p_srcb->gatt_database.IsEmpty()) return NULL;
 
   return &p_srcb->gatt_database.Services();
 }
 
-const std::vector<Service>* bta_gattc_get_services(uint16_t conn_id) {
+const std::list<Service>* bta_gattc_get_services(uint16_t conn_id) {
   tBTA_GATTC_CLCB* p_clcb = bta_gattc_find_clcb_by_conn_id(conn_id);
 
   if (p_clcb == NULL) return NULL;
@@ -438,14 +437,14 @@
 
 const Service* bta_gattc_get_service_for_handle_srcb(tBTA_GATTC_SERV* p_srcb,
                                                      uint16_t handle) {
-  const std::vector<Service>* services = bta_gattc_get_services_srcb(p_srcb);
+  const std::list<Service>* services = bta_gattc_get_services_srcb(p_srcb);
   if (services == NULL) return NULL;
   return bta_gattc_find_matching_service(*services, handle);
 }
 
 const Service* bta_gattc_get_service_for_handle(uint16_t conn_id,
                                                 uint16_t handle) {
-  const std::vector<Service>* services = bta_gattc_get_services(conn_id);
+  const std::list<Service>* services = bta_gattc_get_services(conn_id);
   if (services == NULL) return NULL;
 
   return bta_gattc_find_matching_service(*services, handle);
@@ -556,7 +555,7 @@
 /*******************************************************************************
  * Returns          number of elements inside db from start_handle to end_handle
  ******************************************************************************/
-static size_t bta_gattc_get_db_size(const std::vector<Service>& services,
+static size_t bta_gattc_get_db_size(const std::list<Service>& services,
                                     uint16_t start_handle,
                                     uint16_t end_handle) {
   if (services.empty()) return 0;
@@ -704,15 +703,14 @@
  *
  * Description      Load GATT cache from storage for server.
  *
- * Parameter        p_clcb: pointer to server clcb, that will
+ * Parameter        p_srcb: pointer to server cache, that will
  *                          be filled from storage
  * Returns          true on success, false otherwise
  *
  ******************************************************************************/
-bool bta_gattc_cache_load(tBTA_GATTC_CLCB* p_clcb) {
+bool bta_gattc_cache_load(tBTA_GATTC_SERV* p_srcb) {
   char fname[255] = {0};
-  bta_gattc_generate_cache_file_name(fname, sizeof(fname),
-                                     p_clcb->p_srcb->server_bda);
+  bta_gattc_generate_cache_file_name(fname, sizeof(fname), p_srcb->server_bda);
 
   FILE* fd = fopen(fname, "rb");
   if (!fd) {
@@ -749,7 +747,7 @@
       goto done;
     }
 
-    p_clcb->p_srcb->gatt_database = gatt::Database::Deserialize(attr, &success);
+    p_srcb->gatt_database = gatt::Database::Deserialize(attr, &success);
   }
 
 done:
diff --git a/bta/gatt/bta_gattc_int.h b/bta/gatt/bta_gattc_int.h
index 2b60ac7..45a54c3 100644
--- a/bta/gatt/bta_gattc_int.h
+++ b/bta/gatt/bta_gattc_int.h
@@ -71,9 +71,9 @@
 #define BTA_GATTC_CL_MAX 32
 #endif
 
-/* max known devices GATTC can support */
+/* max known devices GATTC can support in Bluetooth spec */
 #ifndef BTA_GATTC_KNOWN_SR_MAX
-#define BTA_GATTC_KNOWN_SR_MAX 10
+#define BTA_GATTC_KNOWN_SR_MAX 255
 #endif
 
 #define BTA_GATTC_CONN_MAX GATT_MAX_PHY_CHANNEL
@@ -426,8 +426,7 @@
                                                    uint8_t disc_type);
 extern void bta_gattc_search_service(tBTA_GATTC_CLCB* p_clcb,
                                      bluetooth::Uuid* p_uuid);
-extern const std::vector<gatt::Service>* bta_gattc_get_services(
-    uint16_t conn_id);
+extern const std::list<gatt::Service>* bta_gattc_get_services(uint16_t conn_id);
 extern const gatt::Service* bta_gattc_get_service_for_handle(uint16_t conn_id,
                                                              uint16_t handle);
 const gatt::Characteristic* bta_gattc_get_characteristic_srcb(
@@ -452,7 +451,7 @@
 extern tBTA_GATTC_CONN* bta_gattc_conn_find_alloc(const RawAddress& remote_bda);
 extern bool bta_gattc_conn_dealloc(const RawAddress& remote_bda);
 
-extern bool bta_gattc_cache_load(tBTA_GATTC_CLCB* p_clcb);
+extern bool bta_gattc_cache_load(tBTA_GATTC_SERV* p_srcb);
 extern void bta_gattc_cache_reset(const RawAddress& server_bda);
 
 #endif /* BTA_GATTC_INT_H */
diff --git a/bta/gatt/bta_gattc_queue.cc b/bta/gatt/bta_gattc_queue.cc
index 6d9fff3..6d8f57c 100644
--- a/bta/gatt/bta_gattc_queue.cc
+++ b/bta/gatt/bta_gattc_queue.cc
@@ -171,9 +171,9 @@
                                        GATT_WRITE_OP_CB cb, void* cb_data) {
   gatt_op_queue[conn_id].push_back({.type = GATT_WRITE_CHAR,
                                     .handle = handle,
-                                    .write_type = write_type,
                                     .write_cb = cb,
                                     .write_cb_data = cb_data,
+                                    .write_type = write_type,
                                     .value = std::move(value)});
   gatt_execute_next_op(conn_id);
 }
@@ -184,9 +184,9 @@
                                    GATT_WRITE_OP_CB cb, void* cb_data) {
   gatt_op_queue[conn_id].push_back({.type = GATT_WRITE_DESC,
                                     .handle = handle,
-                                    .write_type = write_type,
                                     .write_cb = cb,
                                     .write_cb_data = cb_data,
+                                    .write_type = write_type,
                                     .value = std::move(value)});
   gatt_execute_next_op(conn_id);
 }
diff --git a/bta/gatt/bta_gattc_utils.cc b/bta/gatt/bta_gattc_utils.cc
index 2c8e5fd..d0b45c1 100644
--- a/bta/gatt/bta_gattc_utils.cc
+++ b/bta/gatt/bta_gattc_utils.cc
@@ -224,7 +224,7 @@
   tBTA_GATTC_SERV* p_srcb = &bta_gattc_cb.known_server[0];
   uint8_t i;
 
-  for (i = 0; i < BTA_GATTC_KNOWN_SR_MAX; i++, p_srcb++) {
+  for (i = 0; i < BTM_GetWhiteListSize(); i++, p_srcb++) {
     if (p_srcb->in_use && p_srcb->server_bda == bda) return p_srcb;
   }
   return NULL;
@@ -243,7 +243,7 @@
   tBTA_GATTC_SERV* p_srcb = &bta_gattc_cb.known_server[0];
   uint8_t i;
 
-  for (i = 0; i < BTA_GATTC_KNOWN_SR_MAX; i++, p_srcb++) {
+  for (i = 0; i < BTM_GetWhiteListSize(); i++, p_srcb++) {
     if (p_srcb->server_bda == bda) return p_srcb;
   }
   return NULL;
@@ -279,7 +279,7 @@
   bool found = false;
   uint8_t i;
 
-  for (i = 0; i < BTA_GATTC_KNOWN_SR_MAX; i++, p_tcb++) {
+  for (i = 0; i < BTM_GetWhiteListSize(); i++, p_tcb++) {
     if (!p_tcb->in_use) {
       found = true;
       break;
@@ -409,7 +409,7 @@
   uint8_t i = 0;
   tBTA_GATTC_CIF_MASK* p_cif_mask;
 
-  for (i = 0; i < BTA_GATTC_KNOWN_SR_MAX; i++, p_bg_tck++) {
+  for (i = 0; i < BTM_GetWhiteListSize(); i++, p_bg_tck++) {
     if (p_bg_tck->in_use && ((p_bg_tck->remote_bda == remote_bda_ptr) ||
                              (p_bg_tck->remote_bda.IsEmpty()))) {
       p_cif_mask = &p_bg_tck->cif_mask;
@@ -437,7 +437,7 @@
   } else /* adding a new device mask */
   {
     for (i = 0, p_bg_tck = &bta_gattc_cb.bg_track[0];
-         i < BTA_GATTC_KNOWN_SR_MAX; i++, p_bg_tck++) {
+         i < BTM_GetWhiteListSize(); i++, p_bg_tck++) {
       if (!p_bg_tck->in_use) {
         p_bg_tck->in_use = true;
         p_bg_tck->remote_bda = remote_bda_ptr;
@@ -468,7 +468,7 @@
   uint8_t i = 0;
   bool is_bg_conn = false;
 
-  for (i = 0; i < BTA_GATTC_KNOWN_SR_MAX && !is_bg_conn; i++, p_bg_tck++) {
+  for (i = 0; i < BTM_GetWhiteListSize() && !is_bg_conn; i++, p_bg_tck++) {
     if (p_bg_tck->in_use && (p_bg_tck->remote_bda == remote_bda ||
                              p_bg_tck->remote_bda.IsEmpty())) {
       if (((p_bg_tck->cif_mask & (1 << (client_if - 1))) != 0) &&
diff --git a/bta/gatt/database.cc b/bta/gatt/database.cc
index 5f99d55..58f7056 100644
--- a/bta/gatt/database.cc
+++ b/bta/gatt/database.cc
@@ -21,6 +21,7 @@
 #include "stack/include/gattdefs.h"
 
 #include <base/logging.h>
+#include <list>
 #include <memory>
 #include <sstream>
 
@@ -39,7 +40,7 @@
 }
 }  // namespace
 
-Service* FindService(std::vector<Service>& services, uint16_t handle) {
+Service* FindService(std::list<Service>& services, uint16_t handle) {
   for (Service& service : services) {
     if (handle >= service.handle && handle <= service.end_handle)
       return &service;
@@ -126,11 +127,12 @@
   for (; it != nv_attr.cend(); ++it) {
     const auto& attr = *it;
     if (attr.type != PRIMARY_SERVICE && attr.type != SECONDARY_SERVICE) break;
-    result.services.emplace_back(
-        Service{.handle = attr.handle,
-                .end_handle = attr.value.service.end_handle,
-                .is_primary = (attr.type == PRIMARY_SERVICE),
-                .uuid = attr.value.service.uuid});
+    result.services.emplace_back(Service{
+        .handle = attr.handle,
+        .uuid = attr.value.service.uuid,
+        .is_primary = (attr.type == PRIMARY_SERVICE),
+        .end_handle = attr.value.service.end_handle,
+    });
   }
 
   auto current_service_it = result.services.begin();
@@ -167,11 +169,12 @@
           .end_handle = attr.value.included_service.end_handle,
       });
     } else if (attr.type == CHARACTERISTIC) {
-      current_service_it->characteristics.emplace_back(
-          Characteristic{.declaration_handle = attr.handle,
-                         .value_handle = attr.value.characteristic.value_handle,
-                         .properties = attr.value.characteristic.properties,
-                         .uuid = attr.value.characteristic.uuid});
+      current_service_it->characteristics.emplace_back(Characteristic{
+          .declaration_handle = attr.handle,
+          .uuid = attr.value.characteristic.uuid,
+          .value_handle = attr.value.characteristic.value_handle,
+          .properties = attr.value.characteristic.properties,
+      });
 
     } else {
       current_service_it->characteristics.back().descriptors.emplace_back(
@@ -182,4 +185,4 @@
   return result;
 }
 
-}  // namespace gatt
\ No newline at end of file
+}  // namespace gatt
diff --git a/bta/gatt/database.h b/bta/gatt/database.h
index 1e74809..d1ba836 100644
--- a/bta/gatt/database.h
+++ b/bta/gatt/database.h
@@ -18,6 +18,7 @@
 
 #pragma once
 
+#include <list>
 #include <set>
 #include <string>
 #include <utility>
@@ -101,10 +102,10 @@
 
   /* Clear the GATT database. This method forces relocation to ensure no extra
    * space is used unnecesarly */
-  void Clear() { std::vector<Service>().swap(services); }
+  void Clear() { std::list<Service>().swap(services); }
 
   /* Return list of services available in this database */
-  const std::vector<Service>& Services() const { return services; }
+  const std::list<Service>& Services() const { return services; }
 
   std::string ToString() const;
 
@@ -116,11 +117,11 @@
   friend class DatabaseBuilder;
 
  private:
-  std::vector<Service> services;
+  std::list<Service> services;
 };
 
 /* Find a service that should contain handle. Helper method for internal use
  * inside gatt namespace.*/
-Service* FindService(std::vector<Service>& services, uint16_t handle);
+Service* FindService(std::list<Service>& services, uint16_t handle);
 
 }  // namespace gatt
diff --git a/bta/gatt/database_builder.cc b/bta/gatt/database_builder.cc
index ed065ab..98c0a27 100644
--- a/bta/gatt/database_builder.cc
+++ b/bta/gatt/database_builder.cc
@@ -32,10 +32,12 @@
   // general case optimization - we add services in order
   if (database.services.empty() ||
       database.services.back().end_handle < handle) {
-    database.services.emplace_back(Service{.handle = handle,
-                                           .end_handle = end_handle,
-                                           .is_primary = is_primary,
-                                           .uuid = uuid});
+    database.services.emplace_back(Service{
+        .handle = handle,
+        .uuid = uuid,
+        .is_primary = is_primary,
+        .end_handle = end_handle,
+    });
   } else {
     auto& vec = database.services;
 
@@ -45,10 +47,12 @@
         [](Service s, uint16_t handle) { return s.end_handle < handle; });
 
     // Insert new service just before it
-    vec.emplace(it, Service{.handle = handle,
-                            .end_handle = end_handle,
-                            .is_primary = is_primary,
-                            .uuid = uuid});
+    vec.emplace(it, Service{
+                        .handle = handle,
+                        .uuid = uuid,
+                        .is_primary = is_primary,
+                        .end_handle = end_handle,
+                    });
   }
 
   services_to_discover.insert({handle, end_handle});
@@ -90,11 +94,12 @@
                  << loghex(value_handle) << " is after service end_handle="
                  << loghex(service->end_handle);
 
-  service->characteristics.emplace_back(
-      Characteristic{.declaration_handle = handle,
-                     .value_handle = value_handle,
-                     .properties = properties,
-                     .uuid = uuid});
+  service->characteristics.emplace_back(Characteristic{
+      .declaration_handle = handle,
+      .uuid = uuid,
+      .value_handle = value_handle,
+      .properties = properties,
+  });
   return;
 }
 
diff --git a/bta/gatt/database_builder.h b/bta/gatt/database_builder.h
index 0913100..d2cc720 100644
--- a/bta/gatt/database_builder.h
+++ b/bta/gatt/database_builder.h
@@ -21,7 +21,6 @@
 #include "gatt/database.h"
 
 #include <utility>
-#include <vector>
 
 namespace gatt {
 
diff --git a/bta/hd/bta_hd_act.cc b/bta/hd/bta_hd_act.cc
index 0d677ee..a37a051 100644
--- a/bta/hd/bta_hd_act.cc
+++ b/bta/hd/bta_hd_act.cc
@@ -62,7 +62,7 @@
 
       case 0x85:  // Report ID
         *has_report_id = TRUE;
-
+        [[fallthrough]];
       default:
         ptr += (item & 0x03);
         break;
diff --git a/bta/hearing_aid/hearing_aid.cc b/bta/hearing_aid/hearing_aid.cc
index 01bb0c7..75116f4 100644
--- a/bta/hearing_aid/hearing_aid.cc
+++ b/bta/hearing_aid/hearing_aid.cc
@@ -390,6 +390,13 @@
       hearingDevice->connection_update_status = AWAITING;
     }
 
+    tACL_CONN* p_acl = btm_bda_to_acl(address, BT_TRANSPORT_LE);
+    if (p_acl != nullptr && controller_get_interface()->supports_ble_2m_phy() &&
+        HCI_LE_2M_PHY_SUPPORTED(p_acl->peer_le_features)) {
+      LOG(INFO) << address << " set preferred PHY to 2M";
+      BTM_BleSetPhy(address, PHY_LE_2M, PHY_LE_2M, 0);
+    }
+
     // Set data length
     // TODO(jpawlowski: for 16khz only 87 is required, optimize
     BTM_SetBleDataLength(address, 167);
@@ -616,7 +623,7 @@
       return;
     }
 
-    const std::vector<gatt::Service>* services = BTA_GATTC_GetServices(conn_id);
+    const std::list<gatt::Service>* services = BTA_GATTC_GetServices(conn_id);
 
     const gatt::Service* service = nullptr;
     for (const gatt::Service& tmp : *services) {
@@ -1005,13 +1012,16 @@
     }
   }
 
-  void OnAudioSuspend() {
+  void OnAudioSuspend(const std::function<void()>& stop_audio_ticks) {
+    CHECK(stop_audio_ticks) << "stop_audio_ticks is empty";
+
     if (!audio_running) {
       LOG(WARNING) << __func__ << ": Unexpected audio suspend";
     } else {
       LOG(INFO) << __func__ << ": audio_running=" << audio_running;
     }
     audio_running = false;
+    stop_audio_ticks();
 
     std::vector<uint8_t> stop({CONTROL_POINT_OP_STOP});
     for (auto& device : hearingDevices.devices) {
@@ -1032,23 +1042,33 @@
     }
   }
 
-  void OnAudioResume() {
+  void OnAudioResume(const std::function<void()>& start_audio_ticks) {
+    CHECK(start_audio_ticks) << "start_audio_ticks is empty";
+
     if (audio_running) {
       LOG(ERROR) << __func__ << ": Unexpected Audio Resume";
     } else {
       LOG(INFO) << __func__ << ": audio_running=" << audio_running;
     }
-    audio_running = true;
+
+    for (auto& device : hearingDevices.devices) {
+      if (!device.accepting_audio) continue;
+      audio_running = true;
+      SendStart(&device);
+    }
+
+    if (!audio_running) {
+      LOG(INFO) << __func__ << ": No device (0/" << GetDeviceCount()
+                << ") ready to start";
+      return;
+    }
 
     // TODO: shall we also reset the encoder ?
     encoder_state_release();
     encoder_state_init();
     seq_counter = 0;
 
-    for (auto& device : hearingDevices.devices) {
-      if (!device.accepting_audio) continue;
-      SendStart(&device);
-    }
+    start_audio_ticks();
   }
 
   uint8_t GetOtherSideStreamStatus(HearingDevice* this_side_device) {
@@ -1140,9 +1160,9 @@
     }
 
     if (left == nullptr && right == nullptr) {
-      HearingAidAudioSource::Stop();
-      encoder_state_release();
-      current_volume = VOLUME_UNKNOWN;
+      LOG(WARNING) << __func__ << ": No more (0/" << GetDeviceCount()
+                   << ") devices ready";
+      DoDisconnectAudioStop();
       return;
     }
 
@@ -1455,8 +1475,17 @@
 
     hearingDevices.Remove(address);
 
-    if (connected)
-      callbacks->OnConnectionState(ConnectionState::DISCONNECTED, address);
+    if (!connected) {
+      return;
+    }
+
+    callbacks->OnConnectionState(ConnectionState::DISCONNECTED, address);
+    for (const auto& device : hearingDevices.devices) {
+      if (device.accepting_audio) return;
+    }
+    LOG(INFO) << __func__ << ": No more (0/" << GetDeviceCount()
+              << ") devices ready";
+    DoDisconnectAudioStop();
   }
 
   void OnGattDisconnected(tGATT_STATUS status, uint16_t conn_id,
@@ -1478,7 +1507,16 @@
 
     DoDisconnectCleanUp(hearingDevice);
 
+    // Keep this hearing aid in the list, and allow to reconnect back.
+
     callbacks->OnConnectionState(ConnectionState::DISCONNECTED, remote_bda);
+
+    for (const auto& device : hearingDevices.devices) {
+      if (device.accepting_audio) return;
+    }
+    LOG(INFO) << __func__ << ": No more (0/" << GetDeviceCount()
+              << ") devices ready";
+    DoDisconnectAudioStop();
   }
 
   void DoDisconnectCleanUp(HearingDevice* hearingDevice) {
@@ -1511,6 +1549,13 @@
     hearingDevice->command_acked = false;
   }
 
+  void DoDisconnectAudioStop() {
+    HearingAidAudioSource::Stop();
+    audio_running = false;
+    encoder_state_release();
+    current_volume = VOLUME_UNKNOWN;
+  }
+
   void SetVolume(int8_t volume) override {
     VLOG(2) << __func__ << ": " << +volume;
     current_volume = volume;
@@ -1722,14 +1767,11 @@
   void OnAudioDataReady(const std::vector<uint8_t>& data) override {
     if (instance) instance->OnAudioDataReady(data);
   }
-  void OnAudioSuspend(std::promise<void> do_suspend_promise) override {
-    if (instance) instance->OnAudioSuspend();
-    do_suspend_promise.set_value();
+  void OnAudioSuspend(const std::function<void()>& stop_audio_ticks) override {
+    if (instance) instance->OnAudioSuspend(stop_audio_ticks);
   }
-
-  void OnAudioResume(std::promise<void> do_resume_promise) override {
-    if (instance) instance->OnAudioResume();
-    do_resume_promise.set_value();
+  void OnAudioResume(const std::function<void()>& start_audio_ticks) override {
+    if (instance) instance->OnAudioResume(start_audio_ticks);
   }
 };
 
diff --git a/bta/hearing_aid/hearing_aid_audio_source.cc b/bta/hearing_aid/hearing_aid_audio_source.cc
index 3b92d41..0896e2b 100644
--- a/bta/hearing_aid/hearing_aid_audio_source.cc
+++ b/bta/hearing_aid/hearing_aid_audio_source.cc
@@ -97,12 +97,20 @@
 }
 
 void start_audio_ticks() {
+  if (data_interval_ms != HA_INTERVAL_10_MS &&
+      data_interval_ms != HA_INTERVAL_20_MS) {
+    LOG(FATAL) << " Unsupported data interval: " << data_interval_ms;
+  }
+
   wakelock_acquire();
-  audio_timer.SchedulePeriodic(get_main_thread()->GetWeakPtr(), FROM_HERE, base::Bind(&send_audio_data),
-                               base::TimeDelta::FromMilliseconds(data_interval_ms));
+  audio_timer.SchedulePeriodic(
+      get_main_thread()->GetWeakPtr(), FROM_HERE, base::Bind(&send_audio_data),
+      base::TimeDelta::FromMilliseconds(data_interval_ms));
+  LOG(INFO) << __func__ << ": running with data interval: " << data_interval_ms;
 }
 
 void stop_audio_ticks() {
+  LOG(INFO) << __func__ << ": stopped";
   audio_timer.CancelAndWait();
   wakelock_release();
 }
@@ -121,17 +129,12 @@
       UIPC_Ioctl(*uipc_hearing_aid, UIPC_CH_ID_AV_AUDIO, UIPC_SET_READ_POLL_TMO,
                  reinterpret_cast<void*>(0));
 
-      if (data_interval_ms != HA_INTERVAL_10_MS &&
-          data_interval_ms != HA_INTERVAL_20_MS) {
-        LOG(FATAL) << " Unsupported data interval: " << data_interval_ms;
-      }
-
-      start_audio_ticks();
+      do_in_main_thread(FROM_HERE, base::BindOnce(start_audio_ticks));
       break;
     case UIPC_CLOSE_EVT:
       LOG(INFO) << __func__ << ": UIPC_CLOSE_EVT";
       hearing_aid_send_ack(HEARING_AID_CTRL_ACK_SUCCESS);
-      stop_audio_ticks();
+      do_in_main_thread(FROM_HERE, base::BindOnce(stop_audio_ticks));
       break;
     default:
       LOG(ERROR) << "Hearing Aid audio data event not recognized:" << event;
@@ -306,65 +309,52 @@
 }
 
 bool hearing_aid_on_resume_req(bool start_media_task) {
-  // hearing_aid_recv_ctrl_data(HEARING_AID_CTRL_CMD_START)
-  if (localAudioReceiver != nullptr) {
-    // Call OnAudioResume and block till it returns.
-    std::promise<void> do_resume_promise;
-    std::future<void> do_resume_future = do_resume_promise.get_future();
-    bt_status_t status = do_in_main_thread(
-        FROM_HERE, base::BindOnce(&HearingAidAudioReceiver::OnAudioResume,
-                                  base::Unretained(localAudioReceiver),
-                                  std::move(do_resume_promise)));
-    if (status == BT_STATUS_SUCCESS) {
-      do_resume_future.wait();
-    } else {
-      LOG(ERROR) << __func__
-                 << ": HEARING_AID_CTRL_CMD_START: do_in_main_thread err="
-                 << status;
-      return false;
-    }
-  } else {
+  if (localAudioReceiver == nullptr) {
     LOG(ERROR) << __func__
                << ": HEARING_AID_CTRL_CMD_START: audio receiver not started";
     return false;
   }
-
-  // hearing_aid_data_cb(UIPC_OPEN_EVT): start_media_task
+  bt_status_t status;
   if (start_media_task) {
-    if (data_interval_ms != HA_INTERVAL_10_MS &&
-        data_interval_ms != HA_INTERVAL_20_MS) {
-      LOG(FATAL) << " Unsupported data interval: " << data_interval_ms;
-      data_interval_ms = HA_INTERVAL_10_MS;
-    }
-    start_audio_ticks();
+    status = do_in_main_thread(
+        FROM_HERE, base::BindOnce(&HearingAidAudioReceiver::OnAudioResume,
+                                  base::Unretained(localAudioReceiver),
+                                  start_audio_ticks));
+  } else {
+    auto start_dummy_ticks = []() {
+      LOG(INFO) << "start_audio_ticks: waiting for data path opened";
+    };
+    status = do_in_main_thread(
+        FROM_HERE, base::BindOnce(&HearingAidAudioReceiver::OnAudioResume,
+                                  base::Unretained(localAudioReceiver),
+                                  start_dummy_ticks));
+  }
+  if (status != BT_STATUS_SUCCESS) {
+    LOG(ERROR) << __func__
+               << ": HEARING_AID_CTRL_CMD_START: do_in_main_thread err="
+               << status;
+    return false;
   }
   return true;
 }
 
 bool hearing_aid_on_suspend_req() {
-  // hearing_aid_recv_ctrl_data(HEARING_AID_CTRL_CMD_SUSPEND): stop_media_task
-  stop_audio_ticks();
-  if (localAudioReceiver != nullptr) {
-    // Call OnAudioSuspend and block till it returns.
-    std::promise<void> do_suspend_promise;
-    std::future<void> do_suspend_future = do_suspend_promise.get_future();
-    bt_status_t status = do_in_main_thread(
-        FROM_HERE, base::BindOnce(&HearingAidAudioReceiver::OnAudioSuspend,
-                                  base::Unretained(localAudioReceiver),
-                                  std::move(do_suspend_promise)));
-    if (status == BT_STATUS_SUCCESS) {
-      do_suspend_future.wait();
-      return true;
-    } else {
-      LOG(ERROR) << __func__
-                 << ": HEARING_AID_CTRL_CMD_SUSPEND: do_in_main_thread err="
-                 << status;
-    }
-  } else {
+  if (localAudioReceiver == nullptr) {
     LOG(ERROR) << __func__
                << ": HEARING_AID_CTRL_CMD_SUSPEND: audio receiver not started";
+    return false;
   }
-  return false;
+  bt_status_t status = do_in_main_thread(
+      FROM_HERE,
+      base::BindOnce(&HearingAidAudioReceiver::OnAudioSuspend,
+                     base::Unretained(localAudioReceiver), stop_audio_ticks));
+  if (status != BT_STATUS_SUCCESS) {
+    LOG(ERROR) << __func__
+               << ": HEARING_AID_CTRL_CMD_SUSPEND: do_in_main_thread err="
+               << status;
+    return false;
+  }
+  return true;
 }
 }  // namespace
 
diff --git a/bta/hf_client/bta_hf_client_at.cc b/bta/hf_client/bta_hf_client_at.cc
index 5bcc68e..6e4fe26 100644
--- a/bta/hf_client/bta_hf_client_at.cc
+++ b/bta/hf_client/bta_hf_client_at.cc
@@ -724,9 +724,7 @@
  ******************************************************************************/
 void bta_hf_client_cnum(tBTA_HF_CLIENT_CB* client_cb, char* number,
                         uint16_t service) {
-  tBTA_HF_CLIENT evt;
-
-  memset(&evt, 0, sizeof(evt));
+  tBTA_HF_CLIENT evt = {};
 
   evt.cnum.service = service;
   strlcpy(evt.cnum.number, number, BTA_HF_CLIENT_NUMBER_LEN + 1);
@@ -736,6 +734,18 @@
   bta_hf_client_app_callback(BTA_HF_CLIENT_CNUM_EVT, &evt);
 }
 
+void bta_hf_client_unknown_response(tBTA_HF_CLIENT_CB* client_cb,
+                                    const char* evt_buffer) {
+  tBTA_HF_CLIENT evt = {};
+
+  strlcpy(evt.unknown.event_string, evt_buffer,
+          BTA_HF_CLIENT_UNKOWN_EVENT_LEN + 1);
+  evt.unknown.event_string[BTA_HF_CLIENT_UNKOWN_EVENT_LEN] = '\0';
+
+  evt.unknown.bd_addr = client_cb->peer_addr;
+  bta_hf_client_app_callback(BTA_HF_CLIENT_UNKNOWN_EVT, &evt);
+}
+
 /*******************************************************************************
  *
  * Function         bta_hf_client_binp
@@ -1436,6 +1446,36 @@
   return buffer;
 }
 
+static char* bta_hf_client_process_unknown(tBTA_HF_CLIENT_CB* client_cb,
+                                           char* buffer) {
+  char* start = strstr(buffer, "\r\n");
+  if (start == NULL) {
+    return NULL;
+  }
+  start += sizeof("\r\n") - 1;
+
+  char* end = strstr(start, "\r\n");
+  if (end == NULL) {
+    return NULL;
+  }
+
+  int evt_size = end - start + 1;
+
+  char tmp_buf[BTA_HF_CLIENT_UNKOWN_EVENT_LEN];
+  if (evt_size < BTA_HF_CLIENT_UNKOWN_EVENT_LEN) {
+    strlcpy(tmp_buf, start, evt_size);
+    bta_hf_client_unknown_response(client_cb, tmp_buf);
+    AT_CHECK_RN(end);
+  } else {
+    APPL_TRACE_ERROR("%s: exceed event buffer size. (%d, %d)", __func__,
+                     evt_size, BTA_HF_CLIENT_UNKOWN_EVENT_LEN);
+  }
+
+  APPL_TRACE_DEBUG("%s: %s", __func__, buffer);
+
+  return end;
+}
+
 /******************************************************************************
  *       SUPPORTED EVENT MESSAGES
  ******************************************************************************/
@@ -1461,7 +1501,7 @@
     bta_hf_client_parse_cnum,        bta_hf_client_parse_btrh,
     bta_hf_client_parse_busy,        bta_hf_client_parse_delayed,
     bta_hf_client_parse_no_carrier,  bta_hf_client_parse_no_answer,
-    bta_hf_client_parse_blacklisted, bta_hf_client_skip_unknown};
+    bta_hf_client_parse_blacklisted, bta_hf_client_process_unknown};
 
 /* calculate supported event list length */
 static const uint16_t bta_hf_client_parser_cb_count =
@@ -1996,6 +2036,25 @@
   bta_hf_client_send_at(client_cb, BTA_HF_CLIENT_AT_BIA, buf, at_len);
 }
 
+void bta_hf_client_send_at_vendor_specific_cmd(tBTA_HF_CLIENT_CB* client_cb,
+                                               const char* str) {
+  char buf[BTA_HF_CLIENT_AT_MAX_LEN];
+
+  APPL_TRACE_DEBUG("%s", __func__);
+
+  int at_len = snprintf(buf, sizeof(buf), "AT%s", str);
+
+  if (at_len < 1) {
+    APPL_TRACE_ERROR("%s: AT command Framing error", __func__);
+    return;
+  }
+
+  buf[at_len - 1] = '\r';
+
+  bta_hf_client_send_at(client_cb, BTA_HF_CLIENT_AT_VENDOR_SPECIFIC, buf,
+                        at_len);
+}
+
 void bta_hf_client_at_init(tBTA_HF_CLIENT_CB* client_cb) {
   alarm_free(client_cb->at_cb.resp_timer);
   alarm_free(client_cb->at_cb.hold_timer);
@@ -2087,6 +2146,9 @@
     case BTA_HF_CLIENT_AT_CMD_NREC:
       bta_hf_client_send_at_nrec(client_cb);
       break;
+    case BTA_HF_CLIENT_AT_CMD_VENDOR_SPECIFIC_CMD:
+      bta_hf_client_send_at_vendor_specific_cmd(client_cb, p_val->str);
+      break;
     default:
       APPL_TRACE_ERROR("Default case");
       snprintf(buf, BTA_HF_CLIENT_AT_MAX_LEN,
diff --git a/bta/hf_client/bta_hf_client_int.h b/bta/hf_client/bta_hf_client_int.h
index 15ceec2..99967f7 100644
--- a/bta/hf_client/bta_hf_client_int.h
+++ b/bta/hf_client/bta_hf_client_int.h
@@ -97,6 +97,7 @@
   BTA_HF_CLIENT_AT_CNUM,
   BTA_HF_CLIENT_AT_NREC,
   BTA_HF_CLIENT_AT_BINP,
+  BTA_HF_CLIENT_AT_VENDOR_SPECIFIC,
 };
 
 /*****************************************************************************
diff --git a/bta/hf_client/bta_hf_client_sco.cc b/bta/hf_client/bta_hf_client_sco.cc
index 50820bd..faf970d 100644
--- a/bta/hf_client/bta_hf_client_sco.cc
+++ b/bta/hf_client/bta_hf_client_sco.cc
@@ -305,6 +305,8 @@
         case BTA_HF_CLIENT_SCO_LISTEN_E:
           /* create SCO listen connection */
           bta_hf_client_sco_create(client_cb, false);
+          /* TODO(b/143901894): Is this correct? */
+          [[fallthrough]];
 
         case BTA_HF_CLIENT_SCO_OPEN_E:
           /* remove listening connection */
diff --git a/bta/hh/bta_hh_le.cc b/bta/hh/bta_hh_le.cc
index eb87cdf..510e3a4 100644
--- a/bta/hh/bta_hh_le.cc
+++ b/bta/hh/bta_hh_le.cc
@@ -1490,7 +1490,7 @@
     return;
   }
 
-  const std::vector<gatt::Service>* services =
+  const std::list<gatt::Service>* services =
       BTA_GATTC_GetServices(p_data->conn_id);
 
   bool have_hid = false;
diff --git a/bta/hh/bta_hh_utils.cc b/bta/hh/bta_hh_utils.cc
index c4c6061..f3cb1b3 100644
--- a/bta/hh/bta_hh_utils.cc
+++ b/bta/hh/bta_hh_utils.cc
@@ -21,6 +21,8 @@
 #if (BTA_HH_INCLUDED == TRUE)
 
 #include "bta_hh_int.h"
+#include "btif/include/btif_storage.h"
+#include "device/include/interop.h"
 #include "osi/include/osi.h"
 
 /* if SSR max latency is not defined by remote device, set the default value
@@ -393,6 +395,16 @@
         if (ssr_max_latency > BTA_HH_SSR_MAX_LATENCY_DEF)
           ssr_max_latency = BTA_HH_SSR_MAX_LATENCY_DEF;
 
+        char remote_name[BTM_MAX_REM_BD_NAME_LEN] = "";
+        if (btif_storage_get_stored_remote_name(bd_addr, remote_name)) {
+          if (interop_match_name(INTEROP_HID_HOST_LIMIT_SNIFF_INTERVAL,
+                                 remote_name)) {
+            if (ssr_max_latency > 18 /* slots * 0.625ms */) {
+              ssr_max_latency = 18;
+            }
+          }
+        }
+
         *p_max_ssr_lat = ssr_max_latency;
       } else
         *p_max_ssr_lat = p_cb->kdev[i].dscp_info.ssr_max_latency;
diff --git a/bta/include/bta_gatt_api.h b/bta/include/bta_gatt_api.h
index 9176501..41151f8 100644
--- a/bta/include/bta_gatt_api.h
+++ b/bta/include/bta_gatt_api.h
@@ -491,8 +491,7 @@
  * Returns          returns list of gatt::Service or NULL.
  *
  ******************************************************************************/
-extern const std::vector<gatt::Service>* BTA_GATTC_GetServices(
-    uint16_t conn_id);
+extern const std::list<gatt::Service>* BTA_GATTC_GetServices(uint16_t conn_id);
 
 /*******************************************************************************
  *
diff --git a/bta/include/bta_hearing_aid_api.h b/bta/include/bta_hearing_aid_api.h
index 9026262..6c4954b 100644
--- a/bta/include/bta_hearing_aid_api.h
+++ b/bta/include/bta_hearing_aid_api.h
@@ -21,7 +21,6 @@
 #include <base/callback_forward.h>
 #include <hardware/bt_hearing_aid.h>
 #include <deque>
-#include <future>
 #include <vector>
 
 constexpr uint16_t HEARINGAID_MAX_NUM_UUIDS = 1;
@@ -39,8 +38,22 @@
  public:
   virtual ~HearingAidAudioReceiver() = default;
   virtual void OnAudioDataReady(const std::vector<uint8_t>& data) = 0;
-  virtual void OnAudioSuspend(std::promise<void> do_suspend_promise) = 0;
-  virtual void OnAudioResume(std::promise<void> do_resume_promise) = 0;
+
+  // API to stop our feeding timer, and notify hearing aid devices that the
+  // streaming would stop, too.
+  //
+  // @param stop_audio_ticks a callable function calls out to stop the media
+  // timer for reading data.
+  virtual void OnAudioSuspend(
+      const std::function<void()>& stop_audio_ticks) = 0;
+
+  // To notify hearing aid devices to be ready for streaming, and start the
+  // media timer to feed the audio data.
+  //
+  // @param start_audio_ticks a callable function calls out to start a periodic
+  // timer for feeding data from the audio HAL.
+  virtual void OnAudioResume(
+      const std::function<void()>& start_audio_ticks) = 0;
 };
 
 // Number of rssi reads to attempt when requested
diff --git a/bta/include/bta_hf_client_api.h b/bta/include/bta_hf_client_api.h
index 69dc109..897555d 100644
--- a/bta/include/bta_hf_client_api.h
+++ b/bta/include/bta_hf_client_api.h
@@ -119,6 +119,9 @@
                                      */
 #define BTA_HF_CLIENT_BINP_EVT 20 /* binp number event */
 #define BTA_HF_CLIENT_RING_INDICATION 21 /* HF Client ring indication */
+
+#define BTA_HF_CLIENT_UNKNOWN_EVT 22 /* Unknown or vendor specific Event */
+
 #define BTA_HF_CLIENT_DISABLE_EVT 30     /* HF Client disabled */
 
 typedef uint8_t tBTA_HF_CLIENT_EVT;
@@ -159,6 +162,7 @@
 #define BTA_HF_CLIENT_AT_CMD_BINP 13
 #define BTA_HF_CLIENT_AT_CMD_BLDN 14
 #define BTA_HF_CLIENT_AT_CMD_NREC 15
+#define BTA_HF_CLIENT_AT_CMD_VENDOR_SPECIFIC_CMD 16
 
 typedef uint8_t tBTA_HF_CLIENT_AT_CMD_TYPE;
 
@@ -234,6 +238,13 @@
   uint16_t value;
 } tBTA_HF_CLIENT_VAL;
 
+/* data associated with BTA_HF_CLIENT_UNKNOWN_EVT event */
+#define BTA_HF_CLIENT_UNKOWN_EVENT_LEN 32
+typedef struct {
+  RawAddress bd_addr;
+  char event_string[BTA_HF_CLIENT_UNKOWN_EVENT_LEN + 1];
+} tBTA_HF_CLIENT_UNKNOWN;
+
 /* union of data associated with AG callback */
 typedef union {
   // Common BD ADDR field for all tyepdefs
@@ -248,6 +259,7 @@
   tBTA_HF_CLIENT_AT_RESULT result;
   tBTA_HF_CLIENT_CLCC clcc;
   tBTA_HF_CLIENT_CNUM cnum;
+  tBTA_HF_CLIENT_UNKNOWN unknown;
 } tBTA_HF_CLIENT;
 
 typedef uint32_t tBTA_HF_CLIENT_FEAT;
diff --git a/bta/jv/bta_jv_act.cc b/bta/jv/bta_jv_act.cc
index 462ee9d..5cd8041 100644
--- a/bta/jv/bta_jv_act.cc
+++ b/bta/jv/bta_jv_act.cc
@@ -1885,16 +1885,16 @@
   static tL2CAP_FIXED_CHNL_REG fcr = {
       .pL2CA_FixedConn_Cb = fcchan_conn_chng_cbk,
       .pL2CA_FixedData_Cb = fcchan_data_cbk,
-      .default_idle_tout = 0xffff,
       .fixed_chnl_opts =
           {
               .mode = L2CAP_FCR_BASIC_MODE,
+              .tx_win_sz = 1,
               .max_transmit = 0xFF,
               .rtrans_tout = 2000,
               .mon_tout = 12000,
               .mps = 670,
-              .tx_win_sz = 1,
           },
+      .default_idle_tout = 0xffff,
   };
 
   while (t && t->chan != chan) t = t->next;
diff --git a/bta/test/gatt/database_builder_sample_device_test.cc b/bta/test/gatt/database_builder_sample_device_test.cc
index bd4dabc..2bfaa04 100644
--- a/bta/test/gatt/database_builder_sample_device_test.cc
+++ b/bta/test/gatt/database_builder_sample_device_test.cc
@@ -19,6 +19,7 @@
 #include <gtest/gtest.h>
 
 #include <base/logging.h>
+#include <iterator>
 #include <utility>
 
 #include "gatt/database_builder.h"
@@ -223,64 +224,51 @@
   EXPECT_FALSE(builder.InProgress());
 
   // verify that the returned database matches what was discovered
-  EXPECT_EQ(result.Services()[0].handle, 0x0001);
-  EXPECT_EQ(result.Services()[0].uuid, SERVICE_1_UUID);
-  EXPECT_EQ(result.Services()[1].uuid, SERVICE_2_UUID);
-  EXPECT_EQ(result.Services()[2].uuid, SERVICE_3_UUID);
-  EXPECT_EQ(result.Services()[3].uuid, SERVICE_4_UUID);
-  EXPECT_EQ(result.Services()[4].uuid, SERVICE_5_UUID);
-  EXPECT_EQ(result.Services()[5].uuid, SERVICE_6_UUID);
+  auto service = result.Services().begin();
+  EXPECT_EQ(service->handle, 0x0001);
+  EXPECT_EQ(service->uuid, SERVICE_1_UUID);
 
-  EXPECT_EQ(result.Services()[0].characteristics[0].uuid,
-            SERVICE_1_CHAR_1_UUID);
-  EXPECT_EQ(result.Services()[0].characteristics[1].uuid,
-            SERVICE_1_CHAR_2_UUID);
-  EXPECT_EQ(result.Services()[0].characteristics[2].uuid,
-            SERVICE_1_CHAR_3_UUID);
+  EXPECT_EQ(service->characteristics[0].uuid, SERVICE_1_CHAR_1_UUID);
+  EXPECT_EQ(service->characteristics[1].uuid, SERVICE_1_CHAR_2_UUID);
+  EXPECT_EQ(service->characteristics[2].uuid, SERVICE_1_CHAR_3_UUID);
 
-  EXPECT_EQ(result.Services()[2].characteristics[0].uuid,
-            SERVICE_3_CHAR_1_UUID);
-  EXPECT_EQ(result.Services()[2].characteristics[0].descriptors[0].uuid,
+  service++;
+  EXPECT_EQ(service->uuid, SERVICE_2_UUID);
+
+  service++;
+  EXPECT_EQ(service->uuid, SERVICE_3_UUID);
+  EXPECT_EQ(service->characteristics[0].uuid, SERVICE_3_CHAR_1_UUID);
+  EXPECT_EQ(service->characteristics[0].descriptors[0].uuid,
             SERVICE_3_CHAR_1_DESC_1_UUID);
 
-  EXPECT_EQ(result.Services()[3].characteristics[0].uuid,
-            SERVICE_4_CHAR_1_UUID);
-  EXPECT_EQ(result.Services()[3].characteristics[1].uuid,
-            SERVICE_4_CHAR_2_UUID);
-  EXPECT_EQ(result.Services()[3].characteristics[2].uuid,
-            SERVICE_4_CHAR_3_UUID);
-  EXPECT_EQ(result.Services()[3].characteristics[3].uuid,
-            SERVICE_4_CHAR_4_UUID);
-  EXPECT_EQ(result.Services()[3].characteristics[4].uuid,
-            SERVICE_4_CHAR_5_UUID);
-  EXPECT_EQ(result.Services()[3].characteristics[5].uuid,
-            SERVICE_4_CHAR_6_UUID);
-  EXPECT_EQ(result.Services()[3].characteristics[5].descriptors[0].uuid,
+  service++;
+  EXPECT_EQ(service->uuid, SERVICE_4_UUID);
+  EXPECT_EQ(service->characteristics[0].uuid, SERVICE_4_CHAR_1_UUID);
+  EXPECT_EQ(service->characteristics[1].uuid, SERVICE_4_CHAR_2_UUID);
+  EXPECT_EQ(service->characteristics[2].uuid, SERVICE_4_CHAR_3_UUID);
+  EXPECT_EQ(service->characteristics[3].uuid, SERVICE_4_CHAR_4_UUID);
+  EXPECT_EQ(service->characteristics[4].uuid, SERVICE_4_CHAR_5_UUID);
+  EXPECT_EQ(service->characteristics[5].uuid, SERVICE_4_CHAR_6_UUID);
+  EXPECT_EQ(service->characteristics[5].descriptors[0].uuid,
             SERVICE_4_CHAR_6_DESC_1_UUID);
 
-  EXPECT_EQ(result.Services()[4].characteristics[0].uuid,
-            SERVICE_5_CHAR_1_UUID);
-  EXPECT_EQ(result.Services()[4].characteristics[1].uuid,
-            SERVICE_5_CHAR_2_UUID);
-  EXPECT_EQ(result.Services()[4].characteristics[2].uuid,
-            SERVICE_5_CHAR_3_UUID);
-  EXPECT_EQ(result.Services()[4].characteristics[3].uuid,
-            SERVICE_5_CHAR_4_UUID);
-  EXPECT_EQ(result.Services()[4].characteristics[4].uuid,
-            SERVICE_5_CHAR_5_UUID);
-  EXPECT_EQ(result.Services()[4].characteristics[5].uuid,
-            SERVICE_5_CHAR_6_UUID);
-  EXPECT_EQ(result.Services()[4].characteristics[6].uuid,
-            SERVICE_5_CHAR_7_UUID);
+  service++;
+  EXPECT_EQ(service->uuid, SERVICE_5_UUID);
+  EXPECT_EQ(service->characteristics[0].uuid, SERVICE_5_CHAR_1_UUID);
+  EXPECT_EQ(service->characteristics[1].uuid, SERVICE_5_CHAR_2_UUID);
+  EXPECT_EQ(service->characteristics[2].uuid, SERVICE_5_CHAR_3_UUID);
+  EXPECT_EQ(service->characteristics[3].uuid, SERVICE_5_CHAR_4_UUID);
+  EXPECT_EQ(service->characteristics[4].uuid, SERVICE_5_CHAR_5_UUID);
+  EXPECT_EQ(service->characteristics[5].uuid, SERVICE_5_CHAR_6_UUID);
+  EXPECT_EQ(service->characteristics[6].uuid, SERVICE_5_CHAR_7_UUID);
 
-  EXPECT_EQ(result.Services()[5].characteristics[0].uuid,
-            SERVICE_6_CHAR_1_UUID);
-  EXPECT_EQ(result.Services()[5].characteristics[0].descriptors[0].uuid,
+  service++;
+  EXPECT_EQ(service->uuid, SERVICE_6_UUID);
+  EXPECT_EQ(service->characteristics[0].uuid, SERVICE_6_CHAR_1_UUID);
+  EXPECT_EQ(service->characteristics[0].descriptors[0].uuid,
             SERVICE_6_CHAR_1_DESC_1_UUID);
-  EXPECT_EQ(result.Services()[5].characteristics[1].uuid,
-            SERVICE_6_CHAR_2_UUID);
-  EXPECT_EQ(result.Services()[5].characteristics[2].uuid,
-            SERVICE_6_CHAR_3_UUID);
+  EXPECT_EQ(service->characteristics[1].uuid, SERVICE_6_CHAR_2_UUID);
+  EXPECT_EQ(service->characteristics[2].uuid, SERVICE_6_CHAR_3_UUID);
 }
 
 }  // namespace gatt
\ No newline at end of file
diff --git a/bta/test/gatt/database_builder_test.cc b/bta/test/gatt/database_builder_test.cc
index fcafb49..0a7e928 100644
--- a/bta/test/gatt/database_builder_test.cc
+++ b/bta/test/gatt/database_builder_test.cc
@@ -19,6 +19,7 @@
 #include <gtest/gtest.h>
 
 #include <base/logging.h>
+#include <iterator>
 #include <utility>
 
 #include "gatt/database_builder.h"
@@ -59,10 +60,11 @@
   Database result = builder.Build();
 
   // verify that the returned database matches what was discovered
-  EXPECT_EQ(result.Services()[0].handle, 0x0001);
-  EXPECT_EQ(result.Services()[0].end_handle, 0x0001);
-  EXPECT_EQ(result.Services()[0].is_primary, true);
-  EXPECT_EQ(result.Services()[0].uuid, SERVICE_1_UUID);
+  auto service = result.Services().begin();
+  EXPECT_EQ(service->handle, 0x0001);
+  EXPECT_EQ(service->end_handle, 0x0001);
+  EXPECT_EQ(service->is_primary, true);
+  EXPECT_EQ(service->uuid, SERVICE_1_UUID);
 }
 
 /* Verify adding service, characteristic and descriptor work */
@@ -79,21 +81,20 @@
   Database result = builder.Build();
 
   // verify that the returned database matches what was discovered
-  EXPECT_EQ(result.Services()[0].handle, 0x0001);
-  EXPECT_EQ(result.Services()[0].end_handle, 0x000f);
-  EXPECT_EQ(result.Services()[0].is_primary, true);
-  EXPECT_EQ(result.Services()[0].uuid, SERVICE_1_UUID);
+  auto service = result.Services().begin();
+  EXPECT_EQ(service->handle, 0x0001);
+  EXPECT_EQ(service->end_handle, 0x000f);
+  EXPECT_EQ(service->is_primary, true);
+  EXPECT_EQ(service->uuid, SERVICE_1_UUID);
 
-  EXPECT_EQ(result.Services()[0].characteristics[0].uuid,
-            SERVICE_1_CHAR_1_UUID);
-  EXPECT_EQ(result.Services()[0].characteristics[0].declaration_handle, 0x0002);
-  EXPECT_EQ(result.Services()[0].characteristics[0].value_handle, 0x0003);
-  EXPECT_EQ(result.Services()[0].characteristics[0].properties, 0x02);
+  EXPECT_EQ(service->characteristics[0].uuid, SERVICE_1_CHAR_1_UUID);
+  EXPECT_EQ(service->characteristics[0].declaration_handle, 0x0002);
+  EXPECT_EQ(service->characteristics[0].value_handle, 0x0003);
+  EXPECT_EQ(service->characteristics[0].properties, 0x02);
 
-  EXPECT_EQ(result.Services()[0].characteristics[0].descriptors[0].uuid,
+  EXPECT_EQ(service->characteristics[0].descriptors[0].uuid,
             SERVICE_1_CHAR_1_DESC_1_UUID);
-  EXPECT_EQ(result.Services()[0].characteristics[0].descriptors[0].handle,
-            0x0004);
+  EXPECT_EQ(service->characteristics[0].descriptors[0].handle, 0x0004);
 }
 
 /* This test verifies that DatabaseBuilder properly handle discovery of
@@ -139,27 +140,35 @@
   Database result = builder.Build();
 
   // verify that the returned database matches what was discovered
-  EXPECT_EQ(result.Services()[0].handle, 0x0001);
-  EXPECT_EQ(result.Services()[0].is_primary, true);
-  EXPECT_EQ(result.Services()[0].uuid, SERVICE_1_UUID);
+  auto service = result.Services().begin();
+  EXPECT_EQ(service->handle, 0x0001);
+  EXPECT_EQ(service->is_primary, true);
+  EXPECT_EQ(service->uuid, SERVICE_1_UUID);
 
-  EXPECT_EQ(result.Services()[1].handle, 0x0020);
-  EXPECT_EQ(result.Services()[1].end_handle, 0x002f);
-  EXPECT_EQ(result.Services()[1].uuid, SERVICE_2_UUID);
-  EXPECT_EQ(result.Services()[1].is_primary, false);
+  service++;
+  EXPECT_EQ(service->handle, 0x0020);
+  EXPECT_EQ(service->end_handle, 0x002f);
+  EXPECT_EQ(service->uuid, SERVICE_2_UUID);
+  EXPECT_EQ(service->is_primary, false);
 
-  EXPECT_EQ(result.Services()[2].handle, 0x0030);
-  EXPECT_EQ(result.Services()[2].end_handle, 0x003f);
-  EXPECT_EQ(result.Services()[2].uuid, SERVICE_3_UUID);
-  EXPECT_EQ(result.Services()[2].is_primary, true);
+  service++;
+  EXPECT_EQ(service->handle, 0x0030);
+  EXPECT_EQ(service->end_handle, 0x003f);
+  EXPECT_EQ(service->uuid, SERVICE_3_UUID);
+  EXPECT_EQ(service->is_primary, true);
 
-  EXPECT_EQ(result.Services()[3].handle, 0x0040);
-  EXPECT_EQ(result.Services()[3].uuid, SERVICE_4_UUID);
-  EXPECT_EQ(result.Services()[3].is_primary, false);
+  service++;
+  EXPECT_EQ(service->handle, 0x0040);
+  EXPECT_EQ(service->uuid, SERVICE_4_UUID);
+  EXPECT_EQ(service->is_primary, false);
 
-  EXPECT_EQ(result.Services()[4].handle, 0x0050);
-  EXPECT_EQ(result.Services()[4].uuid, SERVICE_5_UUID);
-  EXPECT_EQ(result.Services()[4].is_primary, true);
+  service++;
+  EXPECT_EQ(service->handle, 0x0050);
+  EXPECT_EQ(service->uuid, SERVICE_5_UUID);
+  EXPECT_EQ(service->is_primary, true);
+
+  service++;
+  ASSERT_EQ(service, result.Services().end());
 }
 
 }  // namespace gatt
\ No newline at end of file
diff --git a/btif/Android.bp b/btif/Android.bp
index 1f781c9..6be1d81 100644
--- a/btif/Android.bp
+++ b/btif/Android.bp
@@ -24,6 +24,8 @@
     "system/bt/utils/include",
     "system/bt/include",
     "system/libhwbinder/include",
+    "system/security/keystore/include",
+    "hardware/interfaces/keymaster/4.0/support/include",
 ]
 
 // libbtif static library for target
@@ -71,6 +73,7 @@
         "src/btif_hf_client.cc",
         "src/btif_hh.cc",
         "src/btif_hd.cc",
+        "src/btif_keystore.cc",
         "src/btif_mce.cc",
         "src/btif_pan.cc",
         "src/btif_profile_queue.cc",
@@ -89,6 +92,9 @@
         "src/btif_util.cc",
         "src/stack_manager.cc",
     ],
+    header_libs: [
+        "libmedia_headers",
+    ],
     shared_libs: [
         "libaudioclient",
         "libcutils",
@@ -99,10 +105,14 @@
         "android.hardware.bluetooth.a2dp@1.0",
         "android.hardware.bluetooth.audio@2.0",
         "libhidlbase",
-        "libhidltransport",
-        "libhwbinder",
         "libutils",
         "libcrypto",
+        "android.hardware.keymaster@4.0",
+        "android.hardware.keymaster@3.0",
+        "libkeymaster4support",
+        "libkeystore_aidl",
+        "libkeystore_binder",
+        "libkeystore_parcelables",
     ],
     whole_static_libs: [
         "avrcp-target-service",
@@ -112,7 +122,6 @@
     ],
     cflags: [
         "-DBUILDCFG",
-        "-Wno-implicit-fallthrough",
     ],
 
 }
@@ -124,7 +133,10 @@
     defaults: ["fluoride_defaults"],
     test_suites: ["device-tests"],
     include_dirs: btifCommonIncludes,
-    srcs: ["test/btif_storage_test.cc"],
+    srcs: [
+        "test/btif_storage_test.cc",
+        "test/btif_keystore_test.cc"
+    ],
     header_libs: ["libbluetooth_headers"],
     shared_libs: [
         "libaudioclient",
@@ -132,13 +144,19 @@
         "android.hardware.bluetooth.audio@2.0",
         "libfmq",
         "libhidlbase",
-        "libhidltransport",
         "liblog",
         "libprotobuf-cpp-lite",
         "libcutils",
         "libprocessgroup",
         "libutils",
         "libcrypto",
+        "android.hardware.keymaster@4.0",
+        "android.hardware.keymaster@3.0",
+        "libkeymaster4support",
+        "libkeystore_aidl",
+        "libkeystore_binder",
+        "libkeystore_parcelables",
+        "libbinder",
     ],
     static_libs: [
         "libbt-bta",
@@ -162,6 +180,9 @@
         "libbluetooth-for-tests",
     ],
     cflags: ["-DBUILDCFG"],
+    sanitize: {
+        integer_overflow: true,
+    },
 }
 
 // btif profile queue unit tests for target
diff --git a/btif/co/bta_av_co.cc b/btif/co/bta_av_co.cc
index 9f17d4a..0621bc8 100644
--- a/btif/co/bta_av_co.cc
+++ b/btif/co/bta_av_co.cc
@@ -1385,7 +1385,20 @@
         __func__, bta_av_handle, peer_address.ToString().c_str());
     return;
   }
+
+  if (p_peer->mtu == mtu) return;
+
   p_peer->mtu = mtu;
+  if (active_peer_ == p_peer) {
+    LOG(INFO) << __func__ << ": update the codec encoder with peer "
+              << peer_address << " bta_av_handle: " << loghex(bta_av_handle)
+              << ", new MTU: " << mtu;
+    // Send a request with NONE config values to update only the MTU.
+    SetCodecAudioConfig(
+        {.sample_rate = BTAV_A2DP_CODEC_SAMPLE_RATE_NONE,
+         .bits_per_sample = BTAV_A2DP_CODEC_BITS_PER_SAMPLE_NONE,
+         .channel_mode = BTAV_A2DP_CODEC_CHANNEL_MODE_NONE});
+  }
 }
 
 bool BtaAvCo::SetActivePeer(const RawAddress& peer_address) {
@@ -1463,14 +1476,22 @@
   bool config_updated = false;
   bool success = true;
 
-  APPL_TRACE_DEBUG("%s: peer_address=%s codec_user_config=%s", __func__,
-                   peer_address.ToString().c_str(),
-                   codec_user_config.ToString().c_str());
+  VLOG(1) << __func__ << ": peer_address=" << peer_address.ToString()
+          << " codec_user_config=" << codec_user_config.ToString();
 
   BtaAvCoPeer* p_peer = FindPeer(peer_address);
   if (p_peer == nullptr) {
-    APPL_TRACE_ERROR("%s: cannot find peer %s to configure", __func__,
-                     peer_address.ToString().c_str());
+    LOG(ERROR) << __func__ << ": cannot find peer " << peer_address.ToString()
+               << " to configure";
+    success = false;
+    goto done;
+  }
+
+  // Don't call BTA_AvReconfig() prior to retrieving all peer's capabilities
+  if ((p_peer->num_rx_sinks != p_peer->num_sinks) &&
+      (p_peer->num_sup_sinks != BTA_AV_CO_NUM_ELEMENTS(p_peer->sinks))) {
+    LOG(WARNING) << __func__ << ": peer " << p_peer->addr.ToString()
+                 << " : not all peer's capabilities have been retrieved";
     success = false;
     goto done;
   }
@@ -1483,10 +1504,9 @@
     p_sink = p_peer->p_sink;
   }
   if (p_sink == nullptr) {
-    APPL_TRACE_ERROR(
-        "%s: peer %s : cannot find peer SEP to configure for codec type %d",
-        __func__, p_peer->addr.ToString().c_str(),
-        codec_user_config.codec_type);
+    LOG(ERROR) << __func__ << ": peer " << p_peer->addr.ToString()
+               << " : cannot find peer SEP to configure for codec type "
+               << codec_user_config.codec_type;
     success = false;
     goto done;
   }
@@ -1509,24 +1529,15 @@
 
     p_sink = SelectSourceCodec(p_peer);
     if (p_sink == nullptr) {
-      APPL_TRACE_ERROR("%s: peer %s : cannot set up codec for the peer SINK",
-                       __func__, p_peer->addr.ToString().c_str());
-      success = false;
-      goto done;
-    }
-    // Don't call BTA_AvReconfig() prior to retrieving all peer's capabilities
-    if ((p_peer->num_rx_sinks != p_peer->num_sinks) &&
-        (p_peer->num_sup_sinks != BTA_AV_CO_NUM_ELEMENTS(p_peer->sinks))) {
-      APPL_TRACE_WARNING(
-          "%s: peer %s : not all peer's capabilities have been retrieved",
-          __func__, p_peer->addr.ToString().c_str());
+      LOG(ERROR) << __func__ << ": peer " << p_peer->addr.ToString()
+                 << " : cannot set up codec for the peer SINK";
       success = false;
       goto done;
     }
 
     p_peer->acceptor = false;
-    APPL_TRACE_DEBUG("%s: call BTA_AvReconfig(0x%x)", __func__,
-                     p_peer->BtaAvHandle());
+    VLOG(1) << __func__ << ": call BTA_AvReconfig("
+            << loghex(p_peer->BtaAvHandle()) << ")";
     BTA_AvReconfig(p_peer->BtaAvHandle(), true, p_sink->sep_info_idx,
                    p_peer->codec_config, num_protect, bta_av_co_cp_scmst);
   }
@@ -1550,21 +1561,29 @@
   bool restart_output = false;
   bool config_updated = false;
 
-  APPL_TRACE_DEBUG("%s: codec_audio_config: %s", __func__,
-                   codec_audio_config.ToString().c_str());
+  VLOG(1) << __func__
+          << ": codec_audio_config: " << codec_audio_config.ToString();
 
   // Find the peer that is currently open
   BtaAvCoPeer* p_peer = active_peer_;
   if (p_peer == nullptr) {
-    APPL_TRACE_ERROR("%s: no active peer to configure", __func__);
+    LOG(ERROR) << __func__ << ": no active peer to configure";
+    return false;
+  }
+
+  // Don't call BTA_AvReconfig() prior to retrieving all peer's capabilities
+  if ((p_peer->num_rx_sinks != p_peer->num_sinks) &&
+      (p_peer->num_sup_sinks != BTA_AV_CO_NUM_ELEMENTS(p_peer->sinks))) {
+    LOG(WARNING) << __func__ << ": peer " << p_peer->addr.ToString()
+                 << " : not all peer's capabilities have been retrieved";
     return false;
   }
 
   // Use the current sink codec
   const BtaAvCoSep* p_sink = p_peer->p_sink;
   if (p_sink == nullptr) {
-    APPL_TRACE_ERROR("%s: peer %s : cannot find peer SEP to configure",
-                     __func__, p_peer->addr.ToString().c_str());
+    LOG(ERROR) << __func__ << ": peer " << p_peer->addr.ToString()
+               << " : cannot find peer SEP to configure";
     return false;
   }
 
@@ -1585,19 +1604,11 @@
     SaveNewCodecConfig(p_peer, result_codec_config, p_sink->num_protect,
                        p_sink->protect_info);
 
-    // Don't call BTA_AvReconfig() prior to retrieving all peer's capabilities
-    if ((p_peer->num_rx_sinks != p_peer->num_sinks) &&
-        (p_peer->num_sup_sinks != BTA_AV_CO_NUM_ELEMENTS(p_peer->sinks))) {
-      APPL_TRACE_WARNING(
-          "%s: peer %s : not all peer's capabilities have been retrieved",
-          __func__, p_peer->addr.ToString().c_str());
-    } else {
-      p_peer->acceptor = false;
-      APPL_TRACE_DEBUG("%s: call BTA_AvReconfig(0x%x)", __func__,
-                       p_peer->BtaAvHandle());
-      BTA_AvReconfig(p_peer->BtaAvHandle(), true, p_sink->sep_info_idx,
-                     p_peer->codec_config, num_protect, bta_av_co_cp_scmst);
-    }
+    p_peer->acceptor = false;
+    VLOG(1) << __func__ << ": call BTA_AvReconfig("
+            << loghex(p_peer->BtaAvHandle()) << ")";
+    BTA_AvReconfig(p_peer->BtaAvHandle(), true, p_sink->sep_info_idx,
+                   p_peer->codec_config, num_protect, bta_av_co_cp_scmst);
   }
 
   if (config_updated) {
diff --git a/btif/co/bta_hh_co.cc b/btif/co/bta_hh_co.cc
index 267b8ba..cec3f69 100644
--- a/btif/co/bta_hh_co.cc
+++ b/btif/co/bta_hh_co.cc
@@ -43,6 +43,8 @@
 static tBTA_HH_RPT_CACHE_ENTRY sReportCache[BTA_HH_NV_LOAD_MAX];
 #endif
 #define GET_RPT_RSP_OFFSET 9
+#define THREAD_NORMAL_PRIORITY 0
+#define BT_HH_THREAD "bt_hh_thread"
 
 void uhid_set_non_blocking(int fd) {
   int opts = fcntl(fd, F_GETFL);
@@ -161,7 +163,29 @@
         APPL_TRACE_ERROR("%s: UHID_FEATURE: Invalid report type = %d", __func__,
                          ev.u.feature.rtype);
       break;
+    case UHID_SET_REPORT:
+      if (ret < (ssize_t)(sizeof(ev.type) + sizeof(ev.u.set_report))) {
+          APPL_TRACE_ERROR("%s: Invalid size read from uhid-dev: %zd < %zu",
+                           __func__, ret, sizeof(ev.type) + sizeof(ev.u.set_report));
+            return -EFAULT;
+        }
 
+        APPL_TRACE_DEBUG("UHID_SET_REPORT: Report type = %d, report_size = %d"
+                          , ev.u.set_report.rtype, ev.u.set_report.size);
+
+        if (ev.u.set_report.rtype == UHID_FEATURE_REPORT)
+            btif_hh_setreport(p_dev, BTHH_FEATURE_REPORT,
+                              ev.u.set_report.size, ev.u.set_report.data);
+        else if (ev.u.set_report.rtype == UHID_OUTPUT_REPORT)
+            btif_hh_setreport(p_dev, BTHH_OUTPUT_REPORT,
+                              ev.u.set_report.size, ev.u.set_report.data);
+        else if(ev.u.set_report.rtype == UHID_INPUT_REPORT)
+            btif_hh_setreport(p_dev, BTHH_INPUT_REPORT,
+                              ev.u.set_report.size, ev.u.set_report.data);
+        else
+            APPL_TRACE_ERROR("%s:UHID_SET_REPORT: Invalid Report type = %d"
+                          , __func__, ev.u.set_report.rtype);
+        break;
     default:
       APPL_TRACE_DEBUG("Invalid event from uhid-dev: %u\n", ev.type);
   }
@@ -208,6 +232,17 @@
   APPL_TRACE_DEBUG("%s: Thread created fd = %d", __func__, p_dev->fd);
   struct pollfd pfds[1];
 
+  // This thread is created by bt_main_thread with RT priority. Lower the thread
+  // priority here since the tasks in this thread is not timing critical.
+  struct sched_param sched_params;
+  sched_params.sched_priority = THREAD_NORMAL_PRIORITY;
+  if (sched_setscheduler(gettid(), SCHED_OTHER, &sched_params)) {
+    APPL_TRACE_ERROR("%s: Failed to set thread priority to normal", __func__);
+    p_dev->hh_poll_thread_id = -1;
+    return 0;
+  }
+  pthread_setname_np(pthread_self(), BT_HH_THREAD);
+
   pfds[0].fd = p_dev->fd;
   pfds[0].events = POLLIN;
 
@@ -558,7 +593,7 @@
   }
 
   // Send the HID report to the kernel.
-  if (p_dev->fd >= 0 && p_dev->get_rpt_snt--) {
+  if (p_dev->fd >= 0 && p_dev->get_rpt_snt > 0 && p_dev->get_rpt_snt--) {
     uint32_t* get_rpt_id =
         (uint32_t*)fixed_queue_dequeue(p_dev->get_rpt_id_queue);
     memset(&ev, 0, sizeof(ev));
diff --git a/btif/include/btif_api.h b/btif/include/btif_api.h
index 519fc9c..cef1aad 100644
--- a/btif/include/btif_api.h
+++ b/btif/include/btif_api.h
@@ -105,6 +105,19 @@
 
 /*******************************************************************************
  *
+ * Function         is_single_user_mode_
+ *
+ * Description      Checks if BT was enabled in single user mode. In this
+ *                  mode, use of keystore for key attestation of LTK is limitee
+ *                  to this mode defined by UserManager.
+ *
+ * Returns          bool
+ *
+ ******************************************************************************/
+bool is_single_user_mode(void);
+
+/*******************************************************************************
+ *
  * Function         btif_get_adapter_properties
  *
  * Description      Fetches all local adapter properties
diff --git a/btif/include/btif_dm.h b/btif/include/btif_dm.h
index a9cb228..a9d4cb6 100644
--- a/btif/include/btif_dm.h
+++ b/btif/include/btif_dm.h
@@ -100,7 +100,7 @@
 void btif_dm_get_ble_local_keys(tBTA_DM_BLE_LOCAL_KEY_MASK* p_key_mask,
                                 Octet16* p_er,
                                 tBTA_BLE_LOCAL_ID_KEYS* p_id_keys);
-void btif_dm_save_ble_bonding_keys(void);
+void btif_dm_save_ble_bonding_keys(RawAddress& bd_addr);
 void btif_dm_remove_ble_bonding_keys(void);
 void btif_dm_ble_sec_req_evt(tBTA_DM_BLE_SEC_REQ* p_ble_req);
 
diff --git a/btif/include/btif_keystore.h b/btif/include/btif_keystore.h
new file mode 100644
index 0000000..cc06a98
--- /dev/null
+++ b/btif/include/btif_keystore.h
@@ -0,0 +1,78 @@
+/******************************************************************************
+ *
+ *  Copyright 2019 Google, Inc.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at:
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ ******************************************************************************/
+
+#include <base/logging.h>
+#include <keystore/keystore_client_impl.h>
+#include <mutex>
+
+#include "osi/include/alarm.h"
+#include "osi/include/allocator.h"
+#include "osi/include/compat.h"
+#include "osi/include/config.h"
+#include "osi/include/log.h"
+#include "osi/include/osi.h"
+#include "osi/include/properties.h"
+
+namespace bluetooth {
+/**
+ * Client wrapper to access AndroidKeystore.
+ *
+ * <p>Use to encrypt/decrypt data and store to disk.
+ */
+class BtifKeystore {
+ public:
+  /**
+   * @param keystore_client injected pre-created client object for keystore
+   */
+  BtifKeystore(keystore::KeystoreClient* keystore_client);
+
+  /**
+   * Encrypts given data
+   *
+   * <p>Returns a string representation of the encrypted data
+   *
+   * @param data to be encrypted
+   * @param flags for keystore
+   */
+  std::string Encrypt(const std::string& data, int32_t flags);
+
+  /**
+   * Returns a decrypted string representation of the encrypted data or empty
+   * string on error.
+   *
+   * @param input encrypted data
+   */
+  std::string Decrypt(const std::string& input_filename);
+
+  /**
+   * Check for existence of keystore key.
+   *
+   * This key can be cleared if a user manually wipes bluetooth storage data
+   * b/133214365
+   */
+  bool DoesKeyExist();
+
+ private:
+  std::unique_ptr<keystore::KeystoreClient> keystore_client_;
+  std::mutex api_mutex_;
+  keystore::KeyStoreNativeReturnCode GenerateKey(const std::string& name,
+                                                 int32_t flags,
+                                                 bool auth_bound);
+};
+
+}  // namespace bluetooth
diff --git a/btif/src/bluetooth.cc b/btif/src/bluetooth.cc
index 1faca2d..ae13843 100644
--- a/btif/src/bluetooth.cc
+++ b/btif/src/bluetooth.cc
@@ -65,6 +65,7 @@
 #include "common/address_obfuscator.h"
 #include "common/metrics.h"
 #include "device/include/interop.h"
+#include "main/shim/shim.h"
 #include "osi/include/alarm.h"
 #include "osi/include/allocation_tracker.h"
 #include "osi/include/log.h"
@@ -81,6 +82,7 @@
 
 bt_callbacks_t* bt_hal_cbacks = NULL;
 bool restricted_mode = false;
+bool single_user_mode = false;
 
 /*******************************************************************************
  *  Externs
@@ -132,8 +134,16 @@
  *
  ****************************************************************************/
 
-static int init(bt_callbacks_t* callbacks) {
-  LOG_INFO(LOG_TAG, "%s", __func__);
+static int init(bt_callbacks_t* callbacks, bool start_restricted,
+                bool is_single_user_mode) {
+  LOG_INFO(LOG_TAG, "%s: start restricted = %d ; single user = %d", __func__,
+           start_restricted, is_single_user_mode);
+
+  if (bluetooth::shim::is_gd_shim_enabled()) {
+    LOG_INFO(LOG_TAG, "%s Enable Gd bluetooth functionality", __func__);
+  } else {
+    LOG_INFO(LOG_TAG, "%s Preserving legacy bluetooth functionality", __func__);
+  }
 
   if (interface_ready()) return BT_STATUS_DONE;
 
@@ -142,16 +152,14 @@
 #endif
 
   bt_hal_cbacks = callbacks;
+  restricted_mode = start_restricted;
+  single_user_mode = is_single_user_mode;
   stack_manager_get_interface()->init_stack();
   btif_debug_init();
   return BT_STATUS_SUCCESS;
 }
 
-static int enable(bool start_restricted) {
-  LOG_INFO(LOG_TAG, "%s: start restricted = %d", __func__, start_restricted);
-
-  restricted_mode = start_restricted;
-
+static int enable() {
   if (!interface_ready()) return BT_STATUS_NOT_READY;
 
   stack_manager_get_interface()->start_up_stack_async();
@@ -168,6 +176,7 @@
 static void cleanup(void) { stack_manager_get_interface()->clean_up_stack(); }
 
 bool is_restricted_mode() { return restricted_mode; }
+bool is_single_user_mode() { return single_user_mode; }
 
 static int get_adapter_properties(void) {
   /* sanity check */
diff --git a/btif/src/btif_bqr.cc b/btif/src/btif_bqr.cc
index 17253c5..3f53e74 100644
--- a/btif/src/btif_bqr.cc
+++ b/btif/src/btif_bqr.cc
@@ -294,7 +294,7 @@
   UINT32_TO_STREAM(p_param, bqr_config.quality_event_mask);
   UINT16_TO_STREAM(p_param, bqr_config.minimum_report_interval_ms);
 
-  BTM_VendorSpecificCommand(HCI_CONTROLLER_BQR_OPCODE_OCF, p_param - param,
+  BTM_VendorSpecificCommand(HCI_CONTROLLER_BQR, p_param - param,
                             param, BqrVscCompleteCallback);
 }
 
diff --git a/btif/src/btif_config.cc b/btif/src/btif_config.cc
index c017c0f..ed24d7d 100644
--- a/btif/src/btif_config.cc
+++ b/btif/src/btif_config.cc
@@ -23,19 +23,22 @@
 #include <base/logging.h>
 #include <ctype.h>
 #include <openssl/rand.h>
+#include <openssl/sha.h>
+#include <private/android_filesystem_config.h>
 #include <stdio.h>
 #include <string.h>
 #include <time.h>
 #include <unistd.h>
-#include <string>
-
 #include <mutex>
+#include <sstream>
+#include <string>
 
 #include "bt_types.h"
 #include "btcore/include/module.h"
 #include "btif_api.h"
 #include "btif_common.h"
 #include "btif_config_transcode.h"
+#include "btif_keystore.h"
 #include "btif_util.h"
 #include "common/address_obfuscator.h"
 #include "osi/include/alarm.h"
@@ -52,10 +55,18 @@
 #define FILE_TIMESTAMP "TimeCreated"
 #define FILE_SOURCE "FileSource"
 #define TIME_STRING_LENGTH sizeof("YYYY-MM-DD HH:MM:SS")
+#define DISABLED "disabled"
 static const char* TIME_STRING_FORMAT = "%Y-%m-%d %H:%M:%S";
 
+constexpr int kBufferSize = 400 * 10;  // initial file is ~400B
+
+static bool use_key_attestation() {
+  return getuid() == AID_BLUETOOTH && is_single_user_mode();
+}
+
 #define BT_CONFIG_METRICS_SECTION "Metrics"
 #define BT_CONFIG_METRICS_SALT_256BIT "Salt256Bit"
+using bluetooth::BtifKeystore;
 using bluetooth::common::AddressObfuscator;
 
 // TODO(armansito): Find a better way than searching by a hardcoded path.
@@ -66,6 +77,8 @@
 #else   // !defined(OS_GENERIC)
 static const char* CONFIG_FILE_PATH = "/data/misc/bluedroid/bt_config.conf";
 static const char* CONFIG_BACKUP_PATH = "/data/misc/bluedroid/bt_config.bak";
+static const char* CONFIG_FILE_CHECKSUM_PATH = "/data/misc/bluedroid/bt_config.conf.encrypted-checksum";
+static const char* CONFIG_BACKUP_CHECKSUM_PATH = "/data/misc/bluedroid/bt_config.bak.encrypted-checksum";
 static const char* CONFIG_LEGACY_FILE_PATH =
     "/data/misc/bluedroid/bt_config.xml";
 #endif  // defined(OS_GENERIC)
@@ -77,7 +90,12 @@
 static void delete_config_files(void);
 static void btif_config_remove_unpaired(config_t* config);
 static void btif_config_remove_restricted(config_t* config);
-static std::unique_ptr<config_t> btif_config_open(const char* filename);
+static std::unique_ptr<config_t> btif_config_open(const char* filename, const char* checksum_filename);
+
+// Key attestation
+static std::string hash_file(const char* filename);
+static std::string read_checksum_file(const char* filename);
+static void write_checksum_file(const char* filename, const std::string& hash);
 
 static enum ConfigSource {
   NOT_LOADED,
@@ -158,21 +176,26 @@
 static std::unique_ptr<config_t> config;
 static alarm_t* config_timer;
 
+static BtifKeystore btif_keystore(new keystore::KeystoreClientImpl);
+
 // Module lifecycle functions
 
 static future_t* init(void) {
   std::unique_lock<std::recursive_mutex> lock(config_lock);
 
-  if (is_factory_reset()) delete_config_files();
+  if (is_factory_reset() ||
+      (use_key_attestation() && !btif_keystore.DoesKeyExist()))
+    delete_config_files();
 
   std::string file_source;
 
-  config = btif_config_open(CONFIG_FILE_PATH);
+  config = btif_config_open(CONFIG_FILE_PATH, CONFIG_FILE_CHECKSUM_PATH);
   btif_config_source = ORIGINAL;
   if (!config) {
     LOG_WARN(LOG_TAG, "%s unable to load config file: %s; using backup.",
              __func__, CONFIG_FILE_PATH);
-    config = btif_config_open(CONFIG_BACKUP_PATH);
+    remove(CONFIG_FILE_CHECKSUM_PATH);
+    config = btif_config_open(CONFIG_BACKUP_PATH, CONFIG_BACKUP_CHECKSUM_PATH);
     btif_config_source = BACKUP;
     file_source = "Backup";
   }
@@ -180,6 +203,7 @@
     LOG_WARN(LOG_TAG,
              "%s unable to load backup; attempting to transcode legacy file.",
              __func__);
+    remove(CONFIG_BACKUP_CHECKSUM_PATH);
     config = btif_config_transcode(CONFIG_LEGACY_FILE_PATH);
     btif_config_source = LEGACY;
     file_source = "Legacy";
@@ -239,7 +263,25 @@
   return future_new_immediate(FUTURE_FAIL);
 }
 
-static std::unique_ptr<config_t> btif_config_open(const char* filename) {
+static std::unique_ptr<config_t> btif_config_open(const char* filename, const char* checksum_filename) {
+  // START KEY ATTESTATION
+  // Get hash of current file
+  std::string current_hash = hash_file(filename);
+  // Get stored hash
+  std::string stored_hash = read_checksum_file(checksum_filename);
+  if (stored_hash.empty()) {
+    LOG(ERROR) << __func__ << ": stored_hash=<empty>";
+    if (!current_hash.empty()) {
+      write_checksum_file(checksum_filename, current_hash);
+      stored_hash = read_checksum_file(checksum_filename);
+    }
+  }
+  // Compare hashes
+  if (current_hash != stored_hash) {
+    return nullptr;
+  }
+  // END KEY ATTESTATION
+
   std::unique_ptr<config_t> config = config_new(filename);
   if (!config) return nullptr;
 
@@ -413,6 +455,12 @@
 
   if (length > 0) CHECK(value != NULL);
 
+  size_t max_value = ((size_t)-1);
+  if (((max_value - 1) / 2) < length) {
+    LOG(ERROR) << __func__ << ": length too long";
+    return false;
+  }
+
   char* str = (char*)osi_calloc(length * 2 + 1);
 
   for (size_t i = 0; i < length; ++i) {
@@ -465,6 +513,13 @@
 
   bool ret = config_save(*config, CONFIG_FILE_PATH);
   btif_config_source = RESET;
+
+  // Save encrypted hash
+  std::string current_hash = hash_file(CONFIG_FILE_PATH);
+  if (!current_hash.empty()) {
+    write_checksum_file(CONFIG_FILE_CHECKSUM_PATH, current_hash);
+  }
+
   return ret;
 }
 
@@ -482,9 +537,15 @@
 
   std::unique_lock<std::recursive_mutex> lock(config_lock);
   rename(CONFIG_FILE_PATH, CONFIG_BACKUP_PATH);
+  rename(CONFIG_FILE_CHECKSUM_PATH, CONFIG_BACKUP_CHECKSUM_PATH);
   std::unique_ptr<config_t> config_paired = config_new_clone(*config);
   btif_config_remove_unpaired(config_paired.get());
   config_save(*config_paired, CONFIG_FILE_PATH);
+  // Save hash
+  std::string current_hash = hash_file(CONFIG_FILE_PATH);
+  if (!current_hash.empty()) {
+    write_checksum_file(CONFIG_FILE_CHECKSUM_PATH, current_hash);
+  }
 }
 
 static void btif_config_remove_unpaired(config_t* conf) {
@@ -576,5 +637,65 @@
 static void delete_config_files(void) {
   remove(CONFIG_FILE_PATH);
   remove(CONFIG_BACKUP_PATH);
+  remove(CONFIG_FILE_CHECKSUM_PATH);
+  remove(CONFIG_BACKUP_CHECKSUM_PATH);
   osi_property_set("persist.bluetooth.factoryreset", "false");
 }
+
+static std::string hash_file(const char* filename) {
+  if (!use_key_attestation()) {
+    LOG(INFO) << __func__ << ": Disabled for multi-user";
+    return DISABLED;
+  }
+  FILE* fp = fopen(filename, "rb");
+  if (!fp) {
+    LOG(ERROR) << __func__ << ": unable to open config file: '" << filename
+               << "': " << strerror(errno);
+    return "";
+  }
+  uint8_t hash[SHA256_DIGEST_LENGTH];
+  SHA256_CTX sha256;
+  SHA256_Init(&sha256);
+  std::array<std::byte, kBufferSize> buffer;
+  int bytes_read = 0;
+  while ((bytes_read = fread(buffer.data(), 1, buffer.size(), fp))) {
+    SHA256_Update(&sha256, buffer.data(), bytes_read);
+  }
+  SHA256_Final(hash, &sha256);
+  std::stringstream ss;
+  for (int i = 0; i < SHA256_DIGEST_LENGTH; i++) {
+    ss << std::hex << std::setw(2) << std::setfill('0') << (int)hash[i];
+  }
+  fclose(fp);
+  return ss.str();
+}
+
+static std::string read_checksum_file(const char* checksum_filename) {
+  if (!use_key_attestation()) {
+    LOG(INFO) << __func__ << ": Disabled for multi-user";
+    return DISABLED;
+  }
+  std::string encrypted_hash = checksum_read(checksum_filename);
+  if (encrypted_hash.empty()) {
+    LOG(INFO) << __func__ << ": read empty hash.";
+    return "";
+  }
+  return btif_keystore.Decrypt(encrypted_hash);
+}
+
+static void write_checksum_file(const char* checksum_filename,
+                                const std::string& hash) {
+  if (!use_key_attestation()) {
+    LOG(INFO) << __func__
+              << ": Disabled for multi-user, since config changed removing "
+                 "checksums.";
+    remove(CONFIG_FILE_CHECKSUM_PATH);
+    remove(CONFIG_BACKUP_CHECKSUM_PATH);
+    return;
+  }
+  std::string encrypted_checksum = btif_keystore.Encrypt(hash, 0);
+  CHECK(!encrypted_checksum.empty())
+      << __func__ << ": Failed encrypting checksum";
+  CHECK(checksum_save(encrypted_checksum, checksum_filename))
+      << __func__ << ": Failed to save checksum!";
+}
diff --git a/btif/src/btif_dm.cc b/btif/src/btif_dm.cc
index 3b56bf8..c6a8a63 100644
--- a/btif/src/btif_dm.cc
+++ b/btif/src/btif_dm.cc
@@ -1146,7 +1146,14 @@
         /* Trigger SDP on the device */
         pairing_cb.sdp_attempts = 1;
 
-        // Report bonded to Java before start SDP
+        if (is_crosskey) {
+          // If bonding occurred due to cross-key pairing, send bonding callback
+          // for static address now
+          LOG_INFO(LOG_TAG,
+                   "%s: send bonding state update for static address %s",
+                   __func__, bd_addr.ToString().c_str());
+          bond_state_changed(BT_STATUS_SUCCESS, bd_addr, BT_BOND_STATE_BONDING);
+        }
         bond_state_changed(BT_STATUS_SUCCESS, bd_addr, BT_BOND_STATE_BONDED);
 
         btif_dm_get_remote_services(bd_addr);
@@ -1181,6 +1188,7 @@
       case HCI_ERR_AUTH_FAILURE:
       case HCI_ERR_KEY_MISSING:
         btif_storage_remove_bonded_device(&bd_addr);
+        [[fallthrough]];
       case HCI_ERR_HOST_REJECT_SECURITY:
       case HCI_ERR_ENCRY_MODE_NOT_ACCEPTABLE:
       case HCI_ERR_UNIT_KEY_USED:
@@ -1438,35 +1446,32 @@
       if (pairing_cb.state == BT_BOND_STATE_BONDED && pairing_cb.sdp_attempts &&
           (p_data->disc_res.bd_addr == pairing_cb.bd_addr ||
            p_data->disc_res.bd_addr == pairing_cb.static_bdaddr)) {
-        LOG_INFO(LOG_TAG, "%s Remote Service SDP done.", __func__);
+        LOG_INFO(LOG_TAG, "%s: SDP search done for %s", __func__,
+                 bd_addr.ToString().c_str());
         pairing_cb.sdp_attempts = 0;
 
-        // If bond occured due to cross-key pairing, send bond state callback
-        // for static address now
-        if (p_data->disc_res.bd_addr == pairing_cb.static_bdaddr) {
-          bond_state_changed(BT_STATUS_SUCCESS, bd_addr, BT_BOND_STATE_BONDING);
-          bond_state_changed(BT_STATUS_SUCCESS, bd_addr, BT_BOND_STATE_BONDED);
-        }
-        if (pairing_cb.state == BT_BOND_STATE_BONDED) {
-          if (p_data->disc_res.result == BTA_SUCCESS) {
-            // Device is bonded and SDP completed. Clear the pairing control
-            // block.
-            pairing_cb = {};
-          } else {
-            // Report empty UUID to Java if SDP report negative result while
-            // pairing.
-            bt_property_t prop;
-            Uuid uuid;
+        // Both SDP and bonding are done, clear pairing control block in case
+        // it is not already cleared
+        pairing_cb = {};
 
-            prop.type = BT_PROPERTY_UUIDS;
-            prop.val = &uuid;
-            prop.len = Uuid::kNumBytes128;
+        // Send one empty UUID to Java to unblock pairing intent when SDP failed
+        // or no UUID is discovered
+        if (p_data->disc_res.result != BTA_SUCCESS ||
+            p_data->disc_res.num_uuids == 0) {
+          LOG_INFO(LOG_TAG,
+                   "%s: SDP failed, send empty UUID to unblock bonding %s",
+                   __func__, bd_addr.ToString().c_str());
+          bt_property_t prop;
+          Uuid uuid = {};
 
-            /* Send the event to the BTIF */
-            HAL_CBACK(bt_hal_cbacks, remote_device_properties_cb,
-                      BT_STATUS_SUCCESS, &bd_addr, 1, &prop);
-            break;
-          }
+          prop.type = BT_PROPERTY_UUIDS;
+          prop.val = &uuid;
+          prop.len = Uuid::kNumBytes128;
+
+          /* Send the event to the BTIF */
+          HAL_CBACK(bt_hal_cbacks, remote_device_properties_cb,
+                    BT_STATUS_SUCCESS, &bd_addr, 1, &prop);
+          break;
         }
       }
 
@@ -2879,7 +2884,7 @@
       btif_storage_remove_bonded_device(&bdaddr);
       state = BT_BOND_STATE_NONE;
     } else {
-      btif_dm_save_ble_bonding_keys();
+      btif_dm_save_ble_bonding_keys(bdaddr);
       btif_dm_get_remote_services_by_transport(&bd_addr, GATT_TRANSPORT_LE);
     }
   } else {
@@ -2914,6 +2919,10 @@
         break;
     }
   }
+  if (state == BT_BOND_STATE_BONDED && bd_addr != pairing_cb.static_bdaddr) {
+    // Report RPA bonding state to Java in crosskey paring
+    bond_state_changed(status, bd_addr, BT_BOND_STATE_BONDING);
+  }
   bond_state_changed(status, bd_addr, state);
 }
 
@@ -2956,11 +2965,9 @@
   BTIF_TRACE_DEBUG("%s  *p_key_mask=0x%02x", __func__, *p_key_mask);
 }
 
-void btif_dm_save_ble_bonding_keys(void) {
+void btif_dm_save_ble_bonding_keys(RawAddress& bd_addr) {
   BTIF_TRACE_DEBUG("%s", __func__);
 
-  RawAddress bd_addr = pairing_cb.bd_addr;
-
   if (pairing_cb.ble.is_penc_key_rcvd) {
     btif_storage_add_ble_bonding_key(
         &bd_addr, (uint8_t*)&pairing_cb.ble.penc_key, BTIF_DM_LE_KEY_PENC,
diff --git a/btif/src/btif_hf.cc b/btif/src/btif_hf.cc
index e0e9515..04ad011 100644
--- a/btif/src/btif_hf.cc
+++ b/btif/src/btif_hf.cc
@@ -412,7 +412,7 @@
     case BTA_AG_AT_BLDN_EVT:
     case BTA_AG_AT_D_EVT:
       bt_hf_callbacks->DialCallCallback(
-          (event == BTA_AG_AT_D_EVT) ? p_data->val.str : nullptr,
+          (event == BTA_AG_AT_D_EVT) ? p_data->val.str : (char*)"",
           &btif_hf_cb[idx].connected_bda);
       break;
 
diff --git a/btif/src/btif_hf_client.cc b/btif/src/btif_hf_client.cc
index 7c65bf7..e7181e9 100644
--- a/btif/src/btif_hf_client.cc
+++ b/btif/src/btif_hf_client.cc
@@ -747,7 +747,7 @@
 }
 
 static const bthf_client_interface_t bthfClientInterface = {
-    sizeof(bthf_client_interface_t),
+    .size = sizeof(bthf_client_interface_t),
     .init = init,
     .connect = connect,
     .disconnect = disconnect,
@@ -949,7 +949,7 @@
                 (bthf_client_call_state_t)p_data->clcc.status,
                 p_data->clcc.mpty ? BTHF_CLIENT_CALL_MPTY_TYPE_MULTI
                                   : BTHF_CLIENT_CALL_MPTY_TYPE_SINGLE,
-                p_data->clcc.number_present ? p_data->clcc.number : NULL);
+                p_data->clcc.number_present ? p_data->clcc.number : "");
       break;
 
     case BTA_HF_CLIENT_CNUM_EVT:
@@ -999,6 +999,10 @@
     case BTA_HF_CLIENT_RING_INDICATION:
       HAL_CBACK(bt_hf_client_callbacks, ring_indication_cb, &cb->peer_bda);
       break;
+    case BTA_HF_CLIENT_UNKNOWN_EVT:
+      HAL_CBACK(bt_hf_client_callbacks, unknown_event_cb, &cb->peer_bda,
+                p_data->unknown.event_string);
+      break;
     default:
       BTIF_TRACE_WARNING("%s: Unhandled event: %d", __func__, event);
       break;
diff --git a/btif/src/btif_keystore.cc b/btif/src/btif_keystore.cc
new file mode 100644
index 0000000..0af03e1
--- /dev/null
+++ b/btif/src/btif_keystore.cc
@@ -0,0 +1,105 @@
+/******************************************************************************
+ *
+ *  Copyright 2019 Google, Inc.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at:
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ ******************************************************************************/
+
+#include "btif_keystore.h"
+
+#include <base/files/file_util.h>
+#include <base/logging.h>
+#include <base/strings/string_number_conversions.h>
+#include <base/strings/string_split.h>
+#include <base/strings/string_util.h>
+#include <base/strings/utf_string_conversions.h>
+#include <sys/stat.h>
+
+using namespace keystore;
+using namespace bluetooth;
+
+constexpr char kKeyStore[] = "AndroidKeystore";
+
+namespace bluetooth {
+
+BtifKeystore::BtifKeystore(keystore::KeystoreClient* keystore_client)
+    : keystore_client_(keystore_client) {}
+
+std::string BtifKeystore::Encrypt(const std::string& data, int32_t flags) {
+  std::lock_guard<std::mutex> lock(api_mutex_);
+  std::string output;
+  if (data.empty()) {
+    LOG(ERROR) << __func__ << ": empty data";
+    return output;
+  }
+  if (!keystore_client_->doesKeyExist(kKeyStore)) {
+    auto gen_result = GenerateKey(kKeyStore, 0, false);
+    if (!gen_result.isOk()) {
+      LOG(FATAL) << "EncryptWithAuthentication Failed: generateKey response="
+                 << gen_result;
+      return output;
+    }
+  }
+  if (!keystore_client_->encryptWithAuthentication(kKeyStore, data, flags,
+                                                   &output)) {
+    LOG(FATAL) << "EncryptWithAuthentication failed.";
+    return output;
+  }
+  return output;
+}
+
+std::string BtifKeystore::Decrypt(const std::string& input) {
+  std::lock_guard<std::mutex> lock(api_mutex_);
+  if (input.empty()) {
+    LOG(ERROR) << __func__ << ": empty input data";
+    return "";
+  }
+  std::string output;
+  if (!keystore_client_->decryptWithAuthentication(kKeyStore, input, &output)) {
+    LOG(FATAL) << "DecryptWithAuthentication failed.\n";
+  }
+  return output;
+}
+
+// Note: auth_bound keys created with this tool will not be usable.
+KeyStoreNativeReturnCode BtifKeystore::GenerateKey(const std::string& name,
+                                                   int32_t flags,
+                                                   bool auth_bound) {
+  AuthorizationSetBuilder params;
+  params.RsaSigningKey(2048, 65537)
+      .Digest(Digest::SHA_2_224)
+      .Digest(Digest::SHA_2_256)
+      .Digest(Digest::SHA_2_384)
+      .Digest(Digest::SHA_2_512)
+      .Padding(PaddingMode::RSA_PKCS1_1_5_SIGN)
+      .Padding(PaddingMode::RSA_PSS);
+  if (auth_bound) {
+    // Gatekeeper normally generates the secure user id.
+    // Using zero allows the key to be created, but it will not be usuable.
+    params.Authorization(TAG_USER_SECURE_ID, 0);
+  } else {
+    params.Authorization(TAG_NO_AUTH_REQUIRED);
+  }
+  AuthorizationSet hardware_enforced_characteristics;
+  AuthorizationSet software_enforced_characteristics;
+  return keystore_client_->generateKey(name, params, flags,
+                                       &hardware_enforced_characteristics,
+                                       &software_enforced_characteristics);
+}
+
+bool BtifKeystore::DoesKeyExist() {
+  return keystore_client_->doesKeyExist(kKeyStore);
+}
+
+}  // namespace bluetooth
diff --git a/btif/src/btif_profile_queue.cc b/btif/src/btif_profile_queue.cc
index 41275f1..900a6af 100644
--- a/btif/src/btif_profile_queue.cc
+++ b/btif/src/btif_profile_queue.cc
@@ -195,7 +195,14 @@
 
   LOG_INFO(LOG_TAG, "%s: executing connection request: %s", __func__,
            head.ToString().c_str());
-  return head.connect();
+  bt_status_t b_status = head.connect();
+  if (b_status != BT_STATUS_SUCCESS) {
+    LOG_INFO(LOG_TAG,
+             "%s: connect %s failed, advance to next scheduled connection.",
+             __func__, head.ToString().c_str());
+    btif_queue_advance();
+  }
+  return b_status;
 }
 
 /*******************************************************************************
diff --git a/btif/src/btif_rc.cc b/btif/src/btif_rc.cc
index 9919a7b..3db2ee9 100644
--- a/btif/src/btif_rc.cc
+++ b/btif/src/btif_rc.cc
@@ -2535,9 +2535,9 @@
     BTIF_TRACE_DEBUG("%s: Peer supports absolute volume. newVolume: %d",
                      __func__, volume);
 
-    tAVRC_COMMAND avrc_cmd = {.volume = {.opcode = AVRC_OP_VENDOR,
-                                         .pdu = AVRC_PDU_SET_ABSOLUTE_VOLUME,
+    tAVRC_COMMAND avrc_cmd = {.volume = {.pdu = AVRC_PDU_SET_ABSOLUTE_VOLUME,
                                          .status = AVRC_STS_NO_ERROR,
+                                         .opcode = AVRC_OP_VENDOR,
                                          .volume = volume}};
 
     BT_HDR* p_msg = NULL;
@@ -3336,6 +3336,8 @@
     rc_ctrl_procedure_complete(p_dev);
     return;
   }
+  p_dev->rc_app_settings.num_attrs = 0;
+  p_dev->rc_app_settings.num_ext_attrs = 0;
 
   for (xx = 0; xx < p_rsp->num_attr; xx++) {
     uint8_t st_index;
@@ -3809,6 +3811,10 @@
   if (p_rsp->status == AVRC_STS_NO_ERROR) {
     do_in_jni_thread(
         FROM_HERE,
+        base::Bind(bt_rc_ctrl_callbacks->play_status_changed_cb, p_dev->rc_addr,
+                   (btrc_play_status_t)p_rsp->play_status));
+    do_in_jni_thread(
+        FROM_HERE,
         base::Bind(bt_rc_ctrl_callbacks->play_position_changed_cb,
                    p_dev->rc_addr, p_rsp->song_len, p_rsp->song_pos));
   } else {
@@ -3907,6 +3913,12 @@
                    /* We want to make the ownership explicit in native */
                    btrc_items, item_count));
 
+    if (item_count > 0) {
+      if (btrc_items[0].item_type == AVRC_ITEM_PLAYER &&
+          (p_dev->rc_features & BTA_AV_FEAT_APP_SETTING)) {
+        list_player_app_setting_attrib_cmd(p_dev);
+      }
+    }
     /* Release the memory block for items and attributes allocated here.
      * Since the executor for do_in_jni_thread is a Single Thread Task Runner it
      * is okay to queue up the cleanup of btrc_items */
diff --git a/btif/src/btif_sock.cc b/btif/src/btif_sock.cc
index 0c4f6f6..8c4c9c3 100644
--- a/btif/src/btif_sock.cc
+++ b/btif/src/btif_sock.cc
@@ -28,6 +28,7 @@
 
 #include "bta_api.h"
 #include "btif_common.h"
+#include "btif_config.h"
 #include "btif_sock_l2cap.h"
 #include "btif_sock_rfc.h"
 #include "btif_sock_sco.h"
@@ -215,12 +216,24 @@
       status = btsock_l2cap_connect(bd_addr, channel, sock_fd, flags, app_uid);
       break;
 
-    case BTSOCK_L2CAP_LE:
+    case BTSOCK_L2CAP_LE: {
       flags |= BTSOCK_FLAG_LE_COC;
+
+      // Ensure device is in inquiry database
+      int addr_type = 0;
+      int device_type = 0;
+
+      if (btif_get_address_type(*bd_addr, &addr_type) &&
+          btif_get_device_type(*bd_addr, &device_type) &&
+          device_type != BT_DEVICE_TYPE_BREDR) {
+        BTA_DmAddBleDevice(*bd_addr, addr_type, device_type);
+      }
+
       LOG_DEBUG(LOG_TAG, "%s: type=BTSOCK_L2CAP_LE, channel=0x%x, flags=0x%x",
                 __func__, channel, flags);
       status = btsock_l2cap_connect(bd_addr, channel, sock_fd, flags, app_uid);
       break;
+    }
 
     case BTSOCK_SCO:
       status = btsock_sco_connect(bd_addr, sock_fd, flags);
diff --git a/btif/src/btif_storage.cc b/btif/src/btif_storage.cc
index ceaa895..e203d2f 100644
--- a/btif/src/btif_storage.cc
+++ b/btif/src/btif_storage.cc
@@ -35,6 +35,7 @@
 #include <alloca.h>
 #include <base/logging.h>
 #include <ctype.h>
+#include <log/log.h>
 #include <stdlib.h>
 #include <string.h>
 #include <time.h>
@@ -867,6 +868,43 @@
   return ret ? BT_STATUS_SUCCESS : BT_STATUS_FAIL;
 }
 
+/* Some devices hardcode sample LTK value from spec, instead of generating one.
+ * Treat such devices as insecure, and remove such bonds when bluetooth
+ * restarts. Removing them after disconnection is handled separately.
+ *
+ * We still allow such devices to bond in order to give the user a chance to
+ * update firmware.
+ */
+static void remove_devices_with_sample_ltk() {
+  std::vector<RawAddress> bad_ltk;
+  for (const section_t& section : btif_config_sections()) {
+    const std::string& name = section.name;
+    if (!RawAddress::IsValidAddress(name)) {
+      continue;
+    }
+
+    RawAddress bd_addr;
+    RawAddress::FromString(name, bd_addr);
+
+    tBTA_LE_KEY_VALUE key;
+    memset(&key, 0, sizeof(key));
+
+    if (btif_storage_get_ble_bonding_key(&bd_addr, BTIF_DM_LE_KEY_PENC, (uint8_t*)&key, sizeof(tBTM_LE_PENC_KEYS)) ==
+        BT_STATUS_SUCCESS) {
+      if (is_sample_ltk(key.penc_key.ltk)) {
+        bad_ltk.push_back(bd_addr);
+      }
+    }
+  }
+
+  for (RawAddress address : bad_ltk) {
+    android_errorWriteLog(0x534e4554, "128437297");
+    LOG(ERROR) << __func__ << ": removing bond to device using test TLK: " << address;
+
+    btif_storage_remove_bonded_device(&address);
+  }
+}
+
 /*******************************************************************************
  *
  * Function         btif_storage_load_bonded_devices
@@ -894,6 +932,8 @@
   Uuid remote_uuids[BT_MAX_NUM_UUIDS];
   bt_status_t status;
 
+  remove_devices_with_sample_ltk();
+
   btif_in_fetch_bonded_devices(&bonded_devices, 1);
 
   /* Now send the adapter_properties_cb with all adapter_properties */
@@ -1079,6 +1119,7 @@
       break;
     case BTIF_DM_LE_KEY_LID:
       name = "LE_KEY_LID";
+      break;
     default:
       return BT_STATUS_FAIL;
   }
diff --git a/btif/test/btif_keystore_test.cc b/btif/test/btif_keystore_test.cc
new file mode 100644
index 0000000..4cabbad
--- /dev/null
+++ b/btif/test/btif_keystore_test.cc
@@ -0,0 +1,64 @@
+/******************************************************************************
+ *
+ *  Copyright 2019 Google, Inc.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at:
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ ******************************************************************************/
+
+#include <base/logging.h>
+#include <binder/ProcessState.h>
+#include <gtest/gtest.h>
+#include <fstream>
+
+#include "btif/include/btif_keystore.h"
+
+using namespace bluetooth;
+
+class BtifKeystoreTest : public ::testing::Test {
+ protected:
+  std::unique_ptr<BtifKeystore> btif_keystore_;
+  void SetUp() override {
+    android::ProcessState::self()->startThreadPool();
+    btif_keystore_ =
+        std::make_unique<BtifKeystore>(static_cast<keystore::KeystoreClient*>(
+            new keystore::KeystoreClientImpl));
+  };
+  void TearDown() override { btif_keystore_ = nullptr; };
+};
+
+TEST_F(BtifKeystoreTest, test_encrypt_decrypt) {
+  std::string hash = "test";
+
+  std::string encrypted_hash = btif_keystore_->Encrypt(hash, 0);
+  std::string decrypted_hash = btif_keystore_->Decrypt(encrypted_hash);
+
+  EXPECT_FALSE(encrypted_hash.empty());
+  EXPECT_EQ(hash, decrypted_hash);
+}
+
+TEST_F(BtifKeystoreTest, test_encrypt_empty_hash) {
+  std::string hash = "";
+
+  std::string encrypted_hash = btif_keystore_->Encrypt(hash, 0);
+
+  EXPECT_TRUE(encrypted_hash.empty());
+}
+
+TEST_F(BtifKeystoreTest, test_decrypt_empty_hash) {
+  std::string hash = "";
+
+  std::string decrypted_hash = btif_keystore_->Decrypt(hash);
+
+  EXPECT_TRUE(decrypted_hash.empty());
+}
diff --git a/btif/test/btif_profile_queue_test.cc b/btif/test/btif_profile_queue_test.cc
index 486959b..af0255b 100644
--- a/btif/test/btif_profile_queue_test.cc
+++ b/btif/test/btif_profile_queue_test.cc
@@ -97,6 +97,49 @@
   EXPECT_EQ(sResult, UUID1_ADDR1);
 }
 
+static bt_status_t test_connect_cb_fail(RawAddress* bda, uint16_t uuid) {
+  sResult = UNKNOWN;
+  if (*bda == BtifProfileQueueTest::kTestAddr1) {
+    if (uuid == BtifProfileQueueTest::kTestUuid1) {
+      sResult = UUID1_ADDR1;
+    } else if (uuid == BtifProfileQueueTest::kTestUuid2) {
+      sResult = UUID2_ADDR1;
+    }
+  } else if (*bda == BtifProfileQueueTest::kTestAddr2) {
+    if (uuid == BtifProfileQueueTest::kTestUuid1) {
+      sResult = UUID1_ADDR2;
+    } else if (uuid == BtifProfileQueueTest::kTestUuid2) {
+      sResult = UUID2_ADDR2;
+    }
+  }
+  return BT_STATUS_BUSY;
+}
+
+TEST_F(BtifProfileQueueTest, test_connect_fail_still_can_advance_the_queue) {
+  sResult = NOT_SET;
+  // First connect-message for UUID1-ADDR1 is executed, but does not be removed
+  // from connect-queue yet.
+  btif_queue_connect(kTestUuid1, &kTestAddr1, test_connect_cb);
+  EXPECT_EQ(sResult, UUID1_ADDR1);
+  sResult = NOT_SET;
+  // Second connect-message for UUID2-ADDR1 be pushed into connect-queue, but is
+  // not executed
+  btif_queue_connect(kTestUuid2, &kTestAddr1, test_connect_cb_fail);
+  EXPECT_EQ(sResult, NOT_SET);
+  // Third connect-message for UUID1-ADDR2 be pushed into connect-queue, but is
+  // not executed
+  btif_queue_connect(kTestUuid1, &kTestAddr2, test_connect_cb_fail);
+  EXPECT_EQ(sResult, NOT_SET);
+  // Fourth connect-message for UUID2-ADDR2 be pushed into connect-queue, but is
+  // not executed
+  btif_queue_connect(kTestUuid2, &kTestAddr2, test_connect_cb_fail);
+  EXPECT_EQ(sResult, NOT_SET);
+  // removed First connect-message from connect-queue, check it can advance to
+  // subsequent connect-message.
+  btif_queue_advance();
+  EXPECT_EQ(sResult, UUID2_ADDR2);
+}
+
 TEST_F(BtifProfileQueueTest, test_connect_same_uuid_do_not_repeat) {
   sResult = NOT_SET;
   btif_queue_connect(kTestUuid1, &kTestAddr1, test_connect_cb);
diff --git a/build/Android.bp b/build/Android.bp
index 768d6ec..32c0f31 100644
--- a/build/Android.bp
+++ b/build/Android.bp
@@ -29,9 +29,10 @@
     },
 }
 
+// Fuzzable defaults are the subset of defaults that are used in fuzzing, which
+// requires no shared libraries, and no explicit sanitization.
 fluoride_defaults {
-    name: "fluoride_types_defaults",
-    defaults: ["libchrome_support_defaults"],
+    name: "fluoride_types_defaults_fuzzable",
     cflags: [
         "-DEXPORT_SYMBOL=__attribute__((visibility(\"default\")))",
         "-fvisibility=hidden",
@@ -54,15 +55,22 @@
 }
 
 fluoride_defaults {
-    name: "fluoride_defaults",
+    name: "fluoride_types_defaults",
+    defaults: [
+        "fluoride_types_defaults_fuzzable",
+        "libchrome_support_defaults"
+    ],
+}
+
+fluoride_defaults {
+    name: "fluoride_defaults_fuzzable",
     target: {
         android: {
             test_config_template: ":BluetoothTestConfigTemplate",
         },
     },
-    defaults: ["fluoride_types_defaults"],
+    defaults: ["fluoride_types_defaults_fuzzable"],
     header_libs: ["libbluetooth_headers"],
-    shared_libs: ["libstatslog"],
     static_libs: [
         "libbluetooth-types",
         "libbt-platform-protos-lite",
@@ -73,6 +81,15 @@
     },
 }
 
+fluoride_defaults {
+    name: "fluoride_defaults",
+    defaults: ["fluoride_defaults_fuzzable", "fluoride_types_defaults"],
+    shared_libs: ["libstatslog"],
+    sanitize: {
+        misc_undefined: ["bounds"],
+    },
+}
+
 // Enables code coverage for a set of source files. Must be combined with
 // "clang_coverage_bin" in order to work. See //test/gen_coverage.py for more information
 // on generating code coverage.
@@ -83,10 +100,6 @@
             clang_cflags: [
                 "-fprofile-instr-generate",
                 "-fcoverage-mapping",
-
-                // New pass manager does not work with -fprofile-instr-generate yet.
-                // http://b/131132095
-                "-fno-experimental-new-pass-manager",
             ],
         },
     },
@@ -105,10 +118,6 @@
             ldflags: [
                 "-fprofile-instr-generate",
                 "-fcoverage-mapping",
-
-                // New pass manager does not work with -fprofile-instr-generate yet.
-                // http://b/131132095
-                "-fno-experimental-new-pass-manager",
             ],
         },
     },
diff --git a/common/scoped_scs_exit.h b/common/scoped_scs_exit.h
deleted file mode 100644
index ad4a8d6..0000000
--- a/common/scoped_scs_exit.h
+++ /dev/null
@@ -1,39 +0,0 @@
-/*
- * Copyright 2018 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-#pragma once
-
-// Prevent x18 (shadow call stack address) from being clobbered by functions
-// called by a function that declares a variable of this type by temporarily
-// storing the value on the stack. This is used only when calling out to certain
-// vendor libraries.
-struct ScopedSCSExit {
-#ifdef __aarch64__
-    void* scs;
-
-    __attribute__((always_inline, no_sanitize("shadow-call-stack"))) ScopedSCSExit() {
-        __asm__ __volatile__("str x18, [%0]" ::"r"(&scs));
-    }
-
-    __attribute__((always_inline, no_sanitize("shadow-call-stack"))) ~ScopedSCSExit() {
-        __asm__ __volatile__("ldr x18, [%0]; str xzr, [%0]" ::"r"(&scs));
-    }
-#else
-    // Silence unused variable warnings in non-SCS builds.
-    __attribute__((no_sanitize("shadow-call-stack"))) ScopedSCSExit() {}
-    __attribute__((no_sanitize("shadow-call-stack"))) ~ScopedSCSExit() {}
-#endif
-};
diff --git a/device/include/controller.h b/device/include/controller.h
index c1fe337..a15f57b 100644
--- a/device/include/controller.h
+++ b/device/include/controller.h
@@ -89,6 +89,12 @@
 
 } controller_t;
 
+namespace bluetooth {
+namespace legacy {
+const controller_t* controller_get_interface();
+}  // namespace legacy
+}  // namespace bluetooth
+
 const controller_t* controller_get_interface();
 
 const controller_t* controller_get_test_interface(
diff --git a/device/include/interop.h b/device/include/interop.h
index b31efc3..d7ca917 100644
--- a/device/include/interop.h
+++ b/device/include/interop.h
@@ -89,7 +89,17 @@
   // Disable role switch for headsets/car-kits.
   // Some car kits allow role switch but when the Phone initiates role switch,
   // the Remote device will go into bad state that will lead to LMP time out.
-  INTEROP_DISABLE_ROLE_SWITCH
+  INTEROP_DISABLE_ROLE_SWITCH,
+
+  // Set a very low initial sniff subrating for HID devices that do not
+  // set their own sniff interval.
+  INTEROP_HID_HOST_LIMIT_SNIFF_INTERVAL,
+
+  // Disable remote name requst for some devices.
+  // The public address of these devices are same as the Random address in ADV.
+  // Then will get name by LE_Create_connection, actually fails,
+  // but will block pairing.
+  INTEROP_DISABLE_NAME_REQUEST
 } interop_feature_t;
 
 // Check if a given |addr| matches a known interoperability workaround as
diff --git a/device/include/interop_database.h b/device/include/interop_database.h
index 1fa2a4d..b4b1b07 100644
--- a/device/include/interop_database.h
+++ b/device/include/interop_database.h
@@ -143,6 +143,13 @@
 
     // AirPods 2 - unacceptably loud volume
     {{{0x94, 0x16, 0x25, 0, 0, 0}}, 3, INTEROP_DISABLE_ABSOLUTE_VOLUME},
+
+    // AirPods 2 - unacceptably loud volume
+    {{{0x9c, 0x64, 0x8b, 0, 0, 0}}, 3, INTEROP_DISABLE_ABSOLUTE_VOLUME},
+
+    // for skip name request,
+    // because BR/EDR address and ADV random address are the same
+    {{{0xd4, 0x7a, 0xe2, 0, 0, 0}}, 3, INTEROP_DISABLE_NAME_REQUEST},
 };
 
 typedef struct {
@@ -169,4 +176,9 @@
 
     // Kenwood KMM-BT518HD - no audio when A2DP codec sample rate is changed
     {"KMM-BT51*HD", 11, INTEROP_DISABLE_AVDTP_RECONFIGURE},
+
+    // Nintendo Switch Pro Controller and Joy Con - do not set sniff interval
+    // dynamically. They require custom HID report command to change mode.
+    {"Pro Controller", 14, INTEROP_HID_HOST_LIMIT_SNIFF_INTERVAL},
+    {"Joy-Con", 7, INTEROP_HID_HOST_LIMIT_SNIFF_INTERVAL},
 };
diff --git a/device/src/controller.cc b/device/src/controller.cc
index 20daa1c..537216b 100644
--- a/device/src/controller.cc
+++ b/device/src/controller.cc
@@ -27,6 +27,8 @@
 #include "btcore/include/module.h"
 #include "btcore/include/version.h"
 #include "hcimsgs.h"
+#include "main/shim/controller.h"
+#include "main/shim/shim.h"
 #include "osi/include/future.h"
 #include "stack/include/btm_ble_api.h"
 
@@ -271,6 +273,10 @@
         response, &number_of_local_supported_codecs, local_supported_codecs);
   }
 
+  if (!HCI_READ_ENCR_KEY_SIZE_SUPPORTED(supported_commands)) {
+    LOG(FATAL) << " Controller must support Read Encryption Key Size command";
+  }
+
   readable = true;
   return future_new_immediate(FUTURE_SUCCESS);
 }
@@ -578,7 +584,7 @@
     get_local_supported_codecs,
     get_le_all_initiating_phys};
 
-const controller_t* controller_get_interface() {
+const controller_t* bluetooth::legacy::controller_get_interface() {
   static bool loaded = false;
   if (!loaded) {
     loaded = true;
@@ -591,6 +597,14 @@
   return &interface;
 }
 
+const controller_t* controller_get_interface() {
+  if (bluetooth::shim::is_gd_shim_enabled()) {
+    return bluetooth::shim::controller_get_interface();
+  } else {
+    return bluetooth::legacy::controller_get_interface();
+  }
+}
+
 const controller_t* controller_get_test_interface(
     const hci_t* hci_interface,
     const hci_packet_factory_t* packet_factory_interface,
diff --git a/device/src/interop.cc b/device/src/interop.cc
index c2ed2a8..9a701b1 100644
--- a/device/src/interop.cc
+++ b/device/src/interop.cc
@@ -50,7 +50,7 @@
 
   if (interop_match_fixed_(feature, addr) ||
       interop_match_dynamic_(feature, addr)) {
-    LOG_WARN(LOG_TAG, "%s() Device %s is a match for interop workaround %s.",
+    LOG_INFO(LOG_TAG, "%s() Device %s is a match for interop workaround %s.",
              __func__, addr->ToString().c_str(),
              interop_feature_string_(feature));
     return true;
@@ -69,6 +69,8 @@
         strlen(name) >= interop_name_database[i].length &&
         strncmp(name, interop_name_database[i].name,
                 interop_name_database[i].length) == 0) {
+      LOG_INFO(LOG_TAG, "%s() Device %s is a match for interop workaround %s.",
+             __func__, name, interop_feature_string_(feature));
       return true;
     }
   }
@@ -128,6 +130,8 @@
     CASE_RETURN_STR(INTEROP_DISABLE_AVDTP_RECONFIGURE)
     CASE_RETURN_STR(INTEROP_DYNAMIC_ROLE_SWITCH)
     CASE_RETURN_STR(INTEROP_DISABLE_ROLE_SWITCH)
+    CASE_RETURN_STR(INTEROP_HID_HOST_LIMIT_SNIFF_INTERVAL)
+    CASE_RETURN_STR(INTEROP_DISABLE_NAME_REQUEST)
   }
 
   return "UNKNOWN";
diff --git a/embdrv/sbc/decoder/srce/decoder-sbc.c b/embdrv/sbc/decoder/srce/decoder-sbc.c
index 20c5b67..50168b5 100644
--- a/embdrv/sbc/decoder/srce/decoder-sbc.c
+++ b/embdrv/sbc/decoder/srce/decoder-sbc.c
@@ -33,6 +33,12 @@
 
 #define SPECIALIZE_READ_SAMPLES_JOINT
 
+#if __has_attribute(fallthrough)
+#define __fallthrough __attribute__((__fallthrough__))
+#else
+#define __fallthrough
+#endif
+
 /**
  * Scans through a buffer looking for a codec syncword. If the decoder has been
  * set for enhanced operation using OI_CODEC_SBC_DecoderReset(), it will search
@@ -413,7 +419,7 @@
 
       case SBC_DUAL_CHANNEL:
         frameLen *= 2;
-      /* fall through */
+        __fallthrough;
 
       default:
         if (mode == SBC_MONO) {
diff --git a/gd/Android.bp b/gd/Android.bp
index 64c9291..fc6461b 100644
--- a/gd/Android.bp
+++ b/gd/Android.bp
@@ -28,7 +28,6 @@
         "-DLOG_NDEBUG=1",
         "-DGOOGLE_PROTOBUF_NO_RTTI",
         "-Wno-unused-parameter",
-        "-Wno-implicit-fallthrough",
         "-Wno-unused-result",
     ],
     conlyflags: [
@@ -49,10 +48,6 @@
             clang_cflags: [
                 "-fprofile-instr-generate",
                 "-fcoverage-mapping",
-
-                // New pass manager does not work with -fprofile-instr-generate yet.
-                // http://b/131132095
-                "-fno-experimental-new-pass-manager",
             ],
         },
     },
@@ -71,10 +66,6 @@
             ldflags: [
                 "-fprofile-instr-generate",
                 "-fcoverage-mapping",
-
-                // New pass manager does not work with -fprofile-instr-generate yet.
-                // http://b/131132095
-                "-fno-experimental-new-pass-manager",
             ],
         },
     },
@@ -104,9 +95,7 @@
             ],
             shared_libs: [
                 "android.hardware.bluetooth@1.0",
-                "libhwbinder",
                 "libhidlbase",
-                "libhidltransport",
                 "libutils",
             ],
         },
@@ -118,16 +107,22 @@
         ":BluetoothCryptoToolboxSources",
         ":BluetoothHalSources",
         ":BluetoothHciSources",
+        ":BluetoothL2capSources",
+        ":BluetoothNeighborSources",
         ":BluetoothPacketSources",
-        ":BluetoothSmpSources",
+        ":BluetoothShimSources",
+        ":BluetoothSecuritySources",
     ],
     generated_headers: [
         "BluetoothGeneratedPackets_h",
     ],
+    shared_libs: [
+        "libchrome",
+    ],
 }
 
 cc_binary {
-    name: "stack_with_facade",
+    name: "bluetooth_stack_with_facade",
     defaults: [
         "gd_defaults",
     ],
@@ -135,8 +130,11 @@
     srcs: [
         "facade/facade_main.cc",
         "facade/grpc_root_server.cc",
+        "facade/read_only_property_server.cc",
         "grpc/grpc_module.cc",
         ":BluetoothFacade_hci_hal",
+        ":BluetoothFacade_hci_layer",
+        ":BluetoothFacade_l2cap_layer",
     ],
     generated_headers: [
         "BluetoothGeneratedPackets_h",
@@ -149,6 +147,7 @@
         "libbluetooth_gd",
     ],
     shared_libs: [
+        "libchrome",
         "libgrpc++_unsecure",
         "libprotobuf-cpp-full",
     ],
@@ -156,9 +155,7 @@
         android: {
             shared_libs: [
                 "android.hardware.bluetooth@1.0",
-                "libhwbinder",
                 "libhidlbase",
-                "libhidltransport",
                 "libutils",
             ],
         },
@@ -177,8 +174,11 @@
     srcs: [
         "cert/cert_main.cc",
         "cert/grpc_root_server.cc",
+        "cert/read_only_property_server.cc",
         "grpc/grpc_module.cc",
         ":BluetoothCertSource_hci_hal",
+        ":BluetoothCertSource_hci_layer",
+        ":BluetoothCertSource_l2cap_layer",
     ],
     generated_headers: [
         "BluetoothGeneratedPackets_h",
@@ -191,6 +191,7 @@
         "libbluetooth_gd",
     ],
     shared_libs: [
+        "libchrome",
         "libgrpc++_unsecure",
         "libprotobuf-cpp-full",
     ],
@@ -198,9 +199,7 @@
         android: {
             shared_libs: [
                 "android.hardware.bluetooth@1.0",
-                "libhwbinder",
                 "libhidlbase",
-                "libhidltransport",
                 "libutils",
             ],
         },
@@ -235,27 +234,32 @@
             ],
             shared_libs: [
                 "android.hardware.bluetooth@1.0",
-                "libhwbinder",
                 "libhidlbase",
-                "libhidltransport",
                 "libutils",
             ],
         },
     },
     srcs: [
         "module_unittest.cc",
+        "stack_manager_unittest.cc",
         ":BluetoothCommonTestSources",
         ":BluetoothCryptoToolboxTestSources",
         ":BluetoothHciTestSources",
         ":BluetoothL2capTestSources",
+        ":BluetoothNeighborTestSources",
         ":BluetoothPacketTestSources",
-        ":BluetoothSmpTestSources",
+        ":BluetoothSecurityTestSources",
+        ":BluetoothShimTestSources",
     ],
     generated_headers: [
         "BluetoothGeneratedPackets_h",
     ],
     static_libs: [
         "libbluetooth_gd",
+        "libgmock",
+    ],
+    shared_libs: [
+        "libchrome",
     ],
     sanitize: {
         address: true,
@@ -283,6 +287,35 @@
     },
 }
 
+cc_fuzz {
+  name: "bluetooth_gd_fuzz_test",
+  defaults: ["gd_defaults"],
+  srcs: [
+    "fuzz_test.cc",
+    ":BluetoothHciFuzzTestSources",
+    ":BluetoothL2capFuzzTestSources",
+  ],
+  static_libs: [
+    "libbluetooth_gd",
+    "libchrome",
+    "libgmock",
+    "libgtest",
+  ],
+  host_supported: true,
+  generated_headers: [
+    "BluetoothGeneratedPackets_h",
+  ],
+  target: {
+    android: {
+        shared_libs: [
+            "android.hardware.bluetooth@1.0",
+            "libhidlbase",
+            "libutils",
+        ],
+    },
+  },
+}
+
 cc_benchmark {
     name: "bluetooth_benchmark_gd",
     defaults: ["gd_defaults"],
@@ -294,6 +327,9 @@
     static_libs: [
         "libbluetooth_gd",
     ],
+    shared_libs: [
+        "libchrome",
+    ],
 }
 
 genrule {
@@ -305,10 +341,12 @@
     srcs: [
         "hci/hci_packets.pdl",
         "l2cap/l2cap_packets.pdl",
+        "security/smp_packets.pdl",
     ],
     out: [
         "hci/hci_packets.h",
         "l2cap/l2cap_packets.h",
+        "security/smp_packets.h",
     ],
 }
 
@@ -318,6 +356,8 @@
         "facade/common.proto",
         "facade/rootservice.proto",
         "hal/facade.proto",
+        "hci/facade.proto",
+        "l2cap/classic/facade.proto",
     ],
 }
 
@@ -338,6 +378,10 @@
         "facade/rootservice.pb.h",
         "hal/facade.grpc.pb.h",
         "hal/facade.pb.h",
+        "hci/facade.grpc.pb.h",
+        "hci/facade.pb.h",
+        "l2cap/classic/facade.grpc.pb.h",
+        "l2cap/classic/facade.pb.h",
     ],
 }
 
@@ -358,6 +402,10 @@
         "facade/rootservice.pb.cc",
         "hal/facade.grpc.pb.cc",
         "hal/facade.pb.cc",
+        "hci/facade.grpc.pb.cc",
+        "hci/facade.pb.cc",
+        "l2cap/classic/facade.grpc.pb.cc",
+        "l2cap/classic/facade.pb.cc",
     ],
 }
 
@@ -370,7 +418,11 @@
     cmd: "$(location aprotoc) -Isystem/bt/gd -Iexternal/protobuf/src --plugin=protoc-gen-grpc=$(location protoc-gen-grpc-python-plugin) $(in) --grpc_out=$(genDir) --python_out=$(genDir); " +
         "touch $(genDir)/facade/__init__.py; " +
         "touch $(genDir)/hal/__init__.py; " +
-        "touch $(genDir)/hal/cert/__init__.py; ",
+        "touch $(genDir)/hal/cert/__init__.py; " +
+        "touch $(genDir)/hci/__init__.py; " +
+        "touch $(genDir)/hci/cert/__init__.py; " +
+        "touch $(genDir)/l2cap/classic/__init__.py; " +
+        "touch $(genDir)/l2cap/classic/cert/__init__.py; ",
     srcs: [
         ":BluetoothFacadeProto",
         ":BluetoothCertStackProto",
@@ -386,9 +438,21 @@
         "hal/__init__.py",
         "hal/facade_pb2_grpc.py",
         "hal/facade_pb2.py",
+        "hci/__init__.py",
+        "hci/facade_pb2_grpc.py",
+        "hci/facade_pb2.py",
+        "l2cap/classic/__init__.py",
+        "l2cap/classic/facade_pb2_grpc.py",
+        "l2cap/classic/facade_pb2.py",
         "hal/cert/__init__.py",
         "hal/cert/api_pb2_grpc.py",
         "hal/cert/api_pb2.py",
+        "hci/cert/__init__.py",
+        "hci/cert/api_pb2_grpc.py",
+        "hci/cert/api_pb2.py",
+        "l2cap/classic/cert/__init__.py",
+        "l2cap/classic/cert/api_pb2_grpc.py",
+        "l2cap/classic/cert/api_pb2.py",
     ],
 }
 
@@ -397,6 +461,8 @@
     srcs: [
         "cert/rootservice.proto",
         "hal/cert/api.proto",
+        "hci/cert/api.proto",
+        "l2cap/classic/cert/api.proto",
     ],
 }
 
@@ -418,6 +484,10 @@
         "facade/common.pb.h",
         "hal/cert/api.grpc.pb.h",
         "hal/cert/api.pb.h",
+        "hci/cert/api.grpc.pb.h",
+        "hci/cert/api.pb.h",
+        "l2cap/classic/cert/api.grpc.pb.h",
+        "l2cap/classic/cert/api.pb.h",
     ],
 }
 
@@ -439,5 +509,9 @@
         "facade/common.pb.cc",
         "hal/cert/api.grpc.pb.cc",
         "hal/cert/api.pb.cc",
+        "hci/cert/api.grpc.pb.cc",
+        "hci/cert/api.pb.cc",
+        "l2cap/classic/cert/api.grpc.pb.cc",
+        "l2cap/classic/cert/api.pb.cc",
     ],
 }
diff --git a/gd/cert/android_devices_config.json b/gd/cert/android_devices_config.json
new file mode 100644
index 0000000..2bcbf9d
--- /dev/null
+++ b/gd/cert/android_devices_config.json
@@ -0,0 +1,54 @@
+{   "_description": "Bluetooth cert testing",
+    "testbed":
+    [
+        {
+            "_description": "Two Android devices cert testbed",
+            "name": "AndroidDeviceCert",
+            "GdDevice":
+            [
+                {
+                    "grpc_port": "8899",
+                    "grpc_root_server_port": "8897",
+                    "signal_port": "8895",
+                    "label": "stack_under_test",
+                    "serial_number": "DUT",
+                    "cmd":
+                    [
+                        "adb",
+                        "-s",
+                        "$(serial_number)",
+                        "shell",
+                        "/system/bin/bluetooth_stack_with_facade",
+                        "--grpc-port=$(grpc_port)",
+                        "--root-server-port=$(grpc_root_server_port)",
+                        "--btsnoop=data/misc/bluetooth/logs/btsnoop_hci.log",
+                        "--signal-port=$(signal_port)"
+                    ]
+                }
+            ],
+            "GdCertDevice":
+            [
+                {
+                    "grpc_port": "8898",
+                    "grpc_root_server_port": "8896",
+                    "signal_port": "8894",
+                    "label": "cert_stack",
+                    "serial_number": "CERT",
+                    "cmd":
+                    [
+                        "adb",
+                        "-s",
+                        "$(serial_number)",
+                        "shell",
+                        "/system/bin/bluetooth_cert_stack",
+                        "--grpc-port=$(grpc_port)",
+                        "--root-server-port=$(grpc_root_server_port)",
+                        "--btsnoop=data/misc/bluetooth/logs/btsnoop_hci.log",
+                        "--signal-port=$(signal_port)"
+                    ]
+                }
+            ]
+        }
+    ],
+    "logpath": "/tmp/logs"
+}
diff --git a/gd/cert/cert_main.cc b/gd/cert/cert_main.cc
index 623a45c..3111b70 100644
--- a/gd/cert/cert_main.cc
+++ b/gd/cert/cert_main.cc
@@ -16,9 +16,9 @@
 
 #include "stack_manager.h"
 
+#include <netinet/in.h>
 #include <sys/socket.h>
 #include <sys/types.h>
-#include <sys/un.h>
 #include <unistd.h>
 #include <csignal>
 #include <cstring>
@@ -47,16 +47,16 @@
 }  // namespace
 
 int main(int argc, const char** argv) {
-  int root_server_port = 8897;
-  int grpc_port = 8899;
+  int root_server_port = 8896;
+  int grpc_port = 8898;
+  int signal_port = 8894;
 
   const std::string arg_grpc_root_server_port = "--root-server-port=";
   const std::string arg_grpc_server_port = "--grpc-port=";
   const std::string arg_rootcanal_port = "--rootcanal-port=";
+  const std::string arg_signal_port = "--signal-port=";
   const std::string arg_btsnoop_path = "--btsnoop=";
   std::string btsnoop_path;
-  const std::string arg_tester_signal_socket = "--tester-signal-socket=";
-  std::string tester_signal_path;
   for (int i = 1; i < argc; i++) {
     std::string arg = argv[i];
     if (arg.find(arg_grpc_root_server_port) == 0) {
@@ -75,18 +75,20 @@
       btsnoop_path = arg.substr(arg_btsnoop_path.size());
       ::bluetooth::hal::SnoopLogger::SetFilePath(btsnoop_path);
     }
-    if (arg.find(arg_tester_signal_socket) == 0) {
-      tester_signal_path = arg.substr(arg_tester_signal_socket.size());
+    if (arg.find(arg_signal_port) == 0) {
+      auto port_number = arg.substr(arg_signal_port.size());
+      signal_port = std::stoi(port_number);
     }
   }
 
   signal(SIGINT, interrupt_handler);
   grpc_root_server.StartServer("0.0.0.0", root_server_port, grpc_port);
-  int tester_signal_socket = socket(AF_UNIX, SOCK_STREAM, 0);
-  struct sockaddr_un addr;
+  int tester_signal_socket = socket(AF_INET, SOCK_STREAM, 0);
+  struct sockaddr_in addr;
   memset(&addr, 0, sizeof(addr));
-  addr.sun_family = AF_UNIX;
-  strncpy(addr.sun_path, tester_signal_path.c_str(), tester_signal_path.size() + 1);
+  addr.sin_family = AF_INET;
+  addr.sin_port = htons(signal_port);
+  addr.sin_addr.s_addr = htonl(INADDR_ANY);
   connect(tester_signal_socket, (sockaddr*)&addr, sizeof(addr));
   close(tester_signal_socket);
   auto wait_thread = std::thread([] { grpc_root_server.RunGrpcLoop(); });
diff --git a/gd/cert/cert_testcases b/gd/cert/cert_testcases
index 777be8e..2d59aa7 100644
--- a/gd/cert/cert_testcases
+++ b/gd/cert/cert_testcases
@@ -1 +1,3 @@
 SimpleHalTest
+SimpleHciTest
+SimpleL2capTest
\ No newline at end of file
diff --git a/gd/cert/event_stream.py b/gd/cert/event_stream.py
index 0342131..543438e 100644
--- a/gd/cert/event_stream.py
+++ b/gd/cert/event_stream.py
@@ -24,37 +24,44 @@
 
 class EventStream(object):
 
-  event_buffer = []
-
   def __init__(self, stream_stub_fn):
     self.stream_stub_fn = stream_stub_fn
+    self.event_buffer = []
+
+    self.subscribe_request = common_pb2.EventStreamRequest(
+        subscription_mode=common_pb2.SUBSCRIBE,
+        fetch_mode=common_pb2.NONE
+    )
+
+    self.unsubscribe_request = common_pb2.EventStreamRequest(
+        subscription_mode=common_pb2.UNSUBSCRIBE,
+        fetch_mode=common_pb2.NONE
+    )
+
+    self.fetch_all_current_request = common_pb2.EventStreamRequest(
+        subscription_mode=common_pb2.UNCHANGED,
+        fetch_mode=common_pb2.ALL_CURRENT
+    )
+
+    self.fetch_at_least_one_request = lambda expiration_time : common_pb2.EventStreamRequest(
+        subscription_mode=common_pb2.UNCHANGED,
+        fetch_mode=common_pb2.AT_LEAST_ONE,
+        timeout_ms = int((expiration_time - datetime.now()).total_seconds() * 1000)
+    )
 
   def clear_event_buffer(self):
     self.event_buffer.clear()
 
   def subscribe(self):
-    return self.stream_stub_fn(
-        common_pb2.EventStreamRequest(
-          subscription_mode=common_pb2.SUBSCRIBE,
-          fetch_mode=common_pb2.NONE
-        )
-    )
+    rpc = self.stream_stub_fn(self.subscribe_request)
+    return rpc.result()
 
   def unsubscribe(self):
-    return self.stream_stub_fn(
-        common_pb2.EventStreamRequest(
-            subscription_mode=common_pb2.UNSUBSCRIBE,
-            fetch_mode=common_pb2.NONE
-        )
-    )
+    rpc = self.stream_stub_fn(self.unsubscribe_request)
+    return rpc.result()
 
   def assert_none(self):
-    response = self.stream_stub_fn(
-        common_pb2.EventStreamRequest(
-            subscription_mode=common_pb2.NONE,
-            fetch_mode=common_pb2.ALL_CURRENT
-        )
-    )
+    response = self.stream_stub_fn(self.fetch_all_current_request)
 
     try:
       for event in response:
@@ -66,12 +73,7 @@
       asserts.fail("event_buffer is not empty \n%s" % self.event_buffer)
 
   def assert_none_matching(self, match_fn):
-    response = self.stream_stub_fn(
-        common_pb2.EventStreamRequest(
-            subscription_mode=common_pb2.NONE,
-            fetch_mode=common_pb2.ALL_CURRENT
-        )
-    )
+    response = self.stream_stub_fn(self.fetch_all_current_request)
 
     try:
       for event in response:
@@ -95,13 +97,7 @@
       if datetime.now() > expiration_time:
         asserts.fail("timeout of %s exceeded" % str(timeout))
 
-      response = self.stream_stub_fn(
-          common_pb2.EventStreamRequest(
-              subscription_mode=common_pb2.NONE,
-              fetch_mode=common_pb2.AT_LEAST_ONE,
-              timeout_ms = int((expiration_time - datetime.now()).total_seconds() * 1000)
-          )
-      )
+      response = self.stream_stub_fn(self.fetch_at_least_one_request(expiration_time))
 
       try:
         for event in response:
diff --git a/gd/cert/gd_base_test.py b/gd/cert/gd_base_test.py
index af4becb..45c2077 100644
--- a/gd/cert/gd_base_test.py
+++ b/gd/cert/gd_base_test.py
@@ -37,28 +37,30 @@
         log_path_base = configs.get('log_path', '/tmp/logs')
         rootcanal_logpath = os.path.join(log_path_base, 'rootcanal_logs.txt')
         self.rootcanal_logs = open(rootcanal_logpath, 'w')
-
-        rootcanal_config = configs["testbed_configs"]['rootcanal']
-        rootcanal_hci_port = str(rootcanal_config.get("hci_port", "6402"))
-        self.rootcanal_process = subprocess.Popen(
-            [
-                ROOTCANAL,
-                str(rootcanal_config.get("test_port", "6401")),
-                rootcanal_hci_port,
-                str(rootcanal_config.get("link_layer_port", "6403"))
-            ],
-            cwd=ANDROID_BUILD_TOP,
-            env=os.environ.copy(),
-            stdout=self.rootcanal_logs,
-            stderr=self.rootcanal_logs
-        )
-
         gd_devices = self.testbed_configs.get("GdDevice")
-        for gd_device in gd_devices:
-            gd_device["rootcanal_port"] = rootcanal_hci_port
         gd_cert_devices = self.testbed_configs.get("GdCertDevice")
-        for gd_cert_device in gd_cert_devices:
-            gd_cert_device["rootcanal_port"] = rootcanal_hci_port
+
+        self.rootcanal_running = False
+        if 'rootcanal' in configs["testbed_configs"]:
+            self.rootcanal_running = True
+            rootcanal_config = configs["testbed_configs"]['rootcanal']
+            rootcanal_hci_port = str(rootcanal_config.get("hci_port", "6402"))
+            self.rootcanal_process = subprocess.Popen(
+                [
+                    ROOTCANAL,
+                    str(rootcanal_config.get("test_port", "6401")),
+                    rootcanal_hci_port,
+                    str(rootcanal_config.get("link_layer_port", "6403"))
+                ],
+                cwd=ANDROID_BUILD_TOP,
+                env=os.environ.copy(),
+                stdout=self.rootcanal_logs,
+                stderr=self.rootcanal_logs
+            )
+            for gd_device in gd_devices:
+                gd_device["rootcanal_port"] = rootcanal_hci_port
+            for gd_cert_device in gd_cert_devices:
+                gd_cert_device["rootcanal_port"] = rootcanal_hci_port
 
         self.register_controller(
             importlib.import_module('cert.gd_device'),
@@ -68,11 +70,12 @@
             builtin=True)
 
     def teardown_class(self):
-        self.unregister_controllers()
-        self.rootcanal_process.send_signal(signal.SIGINT)
-        rootcanal_return_code = self.rootcanal_process.wait()
-        self.rootcanal_logs.close()
-        if rootcanal_return_code != 0 and rootcanal_return_code != -signal.SIGINT:
-            logging.error("rootcanal stopped with code: %d" %
-                          rootcanal_return_code)
-            return False
+        if self.rootcanal_running:
+            self.rootcanal_process.send_signal(signal.SIGINT)
+            rootcanal_return_code = self.rootcanal_process.wait()
+            self.rootcanal_logs.close()
+            if rootcanal_return_code != 0 and\
+                rootcanal_return_code != -signal.SIGINT:
+                logging.error("rootcanal stopped with code: %d" %
+                              rootcanal_return_code)
+                return False
diff --git a/gd/cert/gd_cert_device.py b/gd/cert/gd_cert_device.py
index 7a35bd4..1cdd57d 100644
--- a/gd/cert/gd_cert_device.py
+++ b/gd/cert/gd_cert_device.py
@@ -17,8 +17,11 @@
 from gd_device_base import GdDeviceBase
 from gd_device_base import replace_vars
 
+from cert.event_stream import EventStream
 from cert import rootservice_pb2_grpc as cert_rootservice_pb2_grpc
 from hal.cert import api_pb2_grpc as hal_cert_pb2_grpc
+from hci.cert import api_pb2_grpc as hci_cert_pb2_grpc
+from l2cap.classic.cert import api_pb2_grpc as l2cap_cert_pb2_grpc
 
 ACTS_CONTROLLER_CONFIG_NAME = "GdCertDevice"
 ACTS_CONTROLLER_REFERENCE_NAME = "gd_cert_devices"
@@ -50,12 +53,31 @@
         resolved_cmd = []
         for entry in config["cmd"]:
             resolved_cmd.append(replace_vars(entry, config))
-        devices.append(GdCertDevice(config["grpc_port"], config["grpc_root_server_port"], resolved_cmd, config["label"]))
+        devices.append(GdCertDevice(config["grpc_port"],
+                                    config["grpc_root_server_port"],
+                                    config["signal_port"],
+                                    resolved_cmd, config["label"]))
     return devices
 
 class GdCertDevice(GdDeviceBase):
-    def __init__(self, grpc_port, grpc_root_server_port, cmd, label):
-        super().__init__(grpc_port, grpc_root_server_port, cmd, label, ACTS_CONTROLLER_CONFIG_NAME)
+    def __init__(self, grpc_port, grpc_root_server_port, signal_port, cmd, label):
+        super().__init__(grpc_port, grpc_root_server_port, signal_port, cmd,
+                         label, ACTS_CONTROLLER_CONFIG_NAME)
+
+        # Cert stubs
         self.rootservice = cert_rootservice_pb2_grpc.RootCertStub(self.grpc_root_server_channel)
         self.hal = hal_cert_pb2_grpc.HciHalCertStub(self.grpc_channel)
+        self.controller_read_only_property = cert_rootservice_pb2_grpc.ReadOnlyPropertyStub(self.grpc_channel)
+        self.hci = hci_cert_pb2_grpc.AclManagerCertStub(self.grpc_channel)
+        self.l2cap = l2cap_cert_pb2_grpc.L2capModuleCertStub(self.grpc_channel)
 
+        # Event streams
+        self.hal.hci_event_stream = EventStream(self.hal.FetchHciEvent)
+        self.hal.hci_acl_stream = EventStream(self.hal.FetchHciAcl)
+        self.hal.hci_sco_stream = EventStream(self.hal.FetchHciSco)
+        self.hci.connection_complete_stream = EventStream(self.hci.FetchConnectionComplete)
+        self.hci.disconnection_stream = EventStream(self.hci.FetchDisconnection)
+        self.hci.connection_failed_stream = EventStream(self.hci.FetchConnectionFailed)
+        self.hci.acl_stream = EventStream(self.hci.FetchAclData)
+        self.l2cap.packet_stream = EventStream(self.l2cap.FetchL2capData)
+        self.l2cap.connection_complete_stream = EventStream(self.l2cap.FetchConnectionComplete)
diff --git a/gd/cert/gd_device.py b/gd/cert/gd_device.py
index a306d20..2cd49b7 100644
--- a/gd/cert/gd_device.py
+++ b/gd/cert/gd_device.py
@@ -20,6 +20,8 @@
 from cert.event_stream import EventStream
 from facade import rootservice_pb2_grpc as facade_rootservice_pb2_grpc
 from hal import facade_pb2_grpc as hal_facade_pb2_grpc
+from hci import facade_pb2_grpc as hci_facade_pb2_grpc
+from l2cap.classic import facade_pb2_grpc as l2cap_facade_pb2_grpc
 
 ACTS_CONTROLLER_CONFIG_NAME = "GdDevice"
 ACTS_CONTROLLER_REFERENCE_NAME = "gd_devices"
@@ -51,14 +53,33 @@
         resolved_cmd = []
         for entry in config["cmd"]:
             resolved_cmd.append(replace_vars(entry, config))
-        devices.append(GdDevice(config["grpc_port"], config["grpc_root_server_port"], resolved_cmd, config["label"]))
+        devices.append(GdDevice(config["grpc_port"],
+                                config["grpc_root_server_port"],
+                                config["signal_port"],
+                                resolved_cmd, config["label"]))
     return devices
 
 class GdDevice(GdDeviceBase):
-    def __init__(self, grpc_port, grpc_root_server_port, cmd, label):
-        super().__init__(grpc_port, grpc_root_server_port, cmd, label, ACTS_CONTROLLER_CONFIG_NAME)
+    def __init__(self, grpc_port, grpc_root_server_port, signal_port, cmd, label):
+        super().__init__(grpc_port, grpc_root_server_port, signal_port, cmd,
+                         label, ACTS_CONTROLLER_CONFIG_NAME)
+
+        # Facade stubs
         self.rootservice = facade_rootservice_pb2_grpc.RootFacadeStub(self.grpc_root_server_channel)
         self.hal = hal_facade_pb2_grpc.HciHalFacadeStub(self.grpc_channel)
+        self.controller_read_only_property = facade_rootservice_pb2_grpc.ReadOnlyPropertyStub(self.grpc_channel)
+        self.hci = hci_facade_pb2_grpc.AclManagerFacadeStub(self.grpc_channel)
+        self.hci_classic_security = hci_facade_pb2_grpc.ClassicSecurityManagerFacadeStub(self.grpc_channel)
+        self.l2cap = l2cap_facade_pb2_grpc.L2capModuleFacadeStub(self.grpc_channel)
+
+        # Event streams
         self.hal.hci_event_stream = EventStream(self.hal.FetchHciEvent)
         self.hal.hci_acl_stream = EventStream(self.hal.FetchHciAcl)
         self.hal.hci_sco_stream = EventStream(self.hal.FetchHciSco)
+        self.hci.connection_complete_stream = EventStream(self.hci.FetchConnectionComplete)
+        self.hci.disconnection_stream = EventStream(self.hci.FetchDisconnection)
+        self.hci.connection_failed_stream = EventStream(self.hci.FetchConnectionFailed)
+        self.hci.acl_stream = EventStream(self.hci.FetchAclData)
+        self.hci_classic_security.command_complete_stream = EventStream(self.hci_classic_security.FetchCommandCompleteEvent)
+        self.l2cap.packet_stream = EventStream(self.l2cap.FetchL2capData)
+        self.l2cap.connection_complete_stream = EventStream(self.l2cap.FetchConnectionComplete)
diff --git a/gd/cert/gd_device_base.py b/gd/cert/gd_device_base.py
index 938db1a..df5f9f2 100644
--- a/gd/cert/gd_device_base.py
+++ b/gd/cert/gd_device_base.py
@@ -17,6 +17,7 @@
 import logging
 import os
 from builtins import open
+import json
 import signal
 import socket
 import subprocess
@@ -29,15 +30,25 @@
 
 ANDROID_BUILD_TOP = os.environ.get('ANDROID_BUILD_TOP')
 ANDROID_HOST_OUT = os.environ.get('ANDROID_HOST_OUT')
+WAIT_CHANNEL_READY_TIMEOUT = 10
 
 def replace_vars(string, config):
+    serial_number = config.get("serial_number")
+    if serial_number is None:
+        serial_number = ""
+    rootcanal_port = config.get("rootcanal_port")
+    if rootcanal_port is None:
+        rootcanal_port = ""
     return string.replace("$ANDROID_HOST_OUT", ANDROID_HOST_OUT) \
                  .replace("$(grpc_port)", config.get("grpc_port")) \
                  .replace("$(grpc_root_server_port)", config.get("grpc_root_server_port")) \
-                 .replace("$(rootcanal_port)", config.get("rootcanal_port"))
+                 .replace("$(rootcanal_port)", rootcanal_port) \
+                 .replace("$(signal_port)", config.get("signal_port")) \
+                 .replace("$(serial_number)", serial_number)
 
 class GdDeviceBase:
-    def __init__(self, grpc_port, grpc_root_server_port, cmd, label, type_identifier):
+    def __init__(self, grpc_port, grpc_root_server_port, signal_port, cmd,
+                 label, type_identifier):
         self.label = label if label is not None else grpc_port
         # logging.log_path only exists when this is used in an ACTS test run.
         log_path_base = getattr(logging, 'log_path', '/tmp/logs')
@@ -51,17 +62,18 @@
             log_path_base, '%s_%s_backing_logs.txt' % (type_identifier, label))
         self.backing_process_logs = open(backing_process_logpath, 'w')
 
-        btsnoop_path = os.path.join(log_path_base, '%s_btsnoop_hci.log' % label)
-        cmd.append("--btsnoop=" + btsnoop_path)
+        cmd_str = json.dumps(cmd)
+        if "--btsnoop=" not in cmd_str:
+            btsnoop_path = os.path.join(log_path_base, '%s_btsnoop_hci.log' % label)
+            cmd.append("--btsnoop=" + btsnoop_path)
 
-        tester_signal_socket = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)
-        socket_address = os.path.join(
-            log_path_base, '%s_socket' % type_identifier)
+        tester_signal_socket = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+        tester_signal_socket.setsockopt(
+            socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
+        socket_address = ('localhost', int(signal_port))
         tester_signal_socket.bind(socket_address)
         tester_signal_socket.listen(1)
 
-        cmd.append("--tester-signal-socket=" + socket_address)
-
         self.backing_process = subprocess.Popen(
             cmd,
             cwd=ANDROID_BUILD_TOP,
@@ -82,10 +94,18 @@
         backing_process_return_code = self.backing_process.wait()
         self.backing_process_logs.close()
         if backing_process_return_code != 0:
-            logging.error("backing process stopped with code: %d" %
-                          backing_process_return_code)
+            logging.error("backing process %s stopped with code: %d" %
+                          (self.label, backing_process_return_code))
             return False
 
+    def wait_channel_ready(self):
+        future = grpc.channel_ready_future(self.grpc_channel)
+        try:
+          future.result(timeout = WAIT_CHANNEL_READY_TIMEOUT)
+        except grpc.FutureTimeoutError:
+          logging.error("wait channel ready timeout")
+
+
 
 class GdDeviceBaseLoggerAdapter(logging.LoggerAdapter):
     def process(self, msg, kwargs):
diff --git a/gd/cert/grpc_root_server.cc b/gd/cert/grpc_root_server.cc
index fdbf85a..7281867 100644
--- a/gd/cert/grpc_root_server.cc
+++ b/gd/cert/grpc_root_server.cc
@@ -18,9 +18,12 @@
 
 #include <string>
 
+#include "cert/read_only_property_server.h"
 #include "cert/rootservice.grpc.pb.h"
 #include "grpc/grpc_module.h"
 #include "hal/cert/cert.h"
+#include "hci/cert/cert.h"
+#include "l2cap/classic/cert/cert.h"
 #include "os/log.h"
 #include "os/thread.h"
 #include "stack_manager.h"
@@ -50,6 +53,14 @@
       case BluetoothModule::HAL:
         modules.add<::bluetooth::hal::cert::HalCertModule>();
         break;
+      case BluetoothModule::HCI:
+        modules.add<::bluetooth::cert::ReadOnlyPropertyServerModule>();
+        modules.add<::bluetooth::hci::cert::AclManagerCertModule>();
+        break;
+      case BluetoothModule::L2CAP:
+        modules.add<::bluetooth::cert::ReadOnlyPropertyServerModule>();
+        modules.add<::bluetooth::l2cap::classic::cert::L2capModuleCertModule>();
+        break;
       default:
         return ::grpc::Status(::grpc::StatusCode::INVALID_ARGUMENT, "invalid module under test");
     }
@@ -74,6 +85,7 @@
 
     stack_manager_.GetInstance<GrpcModule>()->StopServer();
     grpc_loop_thread_->join();
+    delete grpc_loop_thread_;
 
     stack_manager_.ShutDown();
     delete stack_thread_;
diff --git a/gd/cert/host_only_config.json b/gd/cert/host_only_config.json
index 052685a..75e459c 100644
--- a/gd/cert/host_only_config.json
+++ b/gd/cert/host_only_config.json
@@ -15,13 +15,15 @@
                 {
                     "grpc_port": "8899",
                     "grpc_root_server_port": "8897",
+                    "signal_port": "8895",
                     "label": "stack_under_test",
                     "cmd":
                     [
-                        "$ANDROID_HOST_OUT/bin/stack_with_facade",
+                        "$ANDROID_HOST_OUT/bin/bluetooth_stack_with_facade",
                         "--grpc-port=$(grpc_port)",
                         "--root-server-port=$(grpc_root_server_port)",
-                        "--rootcanal-port=$(rootcanal_port)"
+                        "--rootcanal-port=$(rootcanal_port)",
+                        "--signal-port=$(signal_port)"
                     ]
                 }
             ],
@@ -30,13 +32,15 @@
                 {
                     "grpc_port": "8898",
                     "grpc_root_server_port": "8896",
+                    "signal_port": "8894",
                     "label": "cert_stack",
                     "cmd":
                     [
                         "$ANDROID_HOST_OUT/bin/bluetooth_cert_stack",
                         "--grpc-port=$(grpc_port)",
                         "--root-server-port=$(grpc_root_server_port)",
-                        "--rootcanal-port=$(rootcanal_port)"
+                        "--rootcanal-port=$(rootcanal_port)",
+                        "--signal-port=$(signal_port)"
                     ]
                 }
             ]
diff --git a/gd/cert/read_only_property_server.cc b/gd/cert/read_only_property_server.cc
new file mode 100644
index 0000000..d67c33e
--- /dev/null
+++ b/gd/cert/read_only_property_server.cc
@@ -0,0 +1,57 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "cert/read_only_property_server.h"
+#include "hci/controller.h"
+
+namespace bluetooth {
+namespace cert {
+
+class ReadOnlyPropertyService : public ReadOnlyProperty::Service {
+ public:
+  ReadOnlyPropertyService(hci::Controller* controller) : controller_(controller) {}
+  ::grpc::Status ReadLocalAddress(::grpc::ServerContext* context, const ::google::protobuf::Empty* request,
+                                  ::bluetooth::facade::BluetoothAddress* response) override {
+    auto address = controller_->GetControllerMacAddress().ToString();
+    response->set_address(address);
+    return ::grpc::Status::OK;
+  }
+
+ private:
+  hci::Controller* controller_;
+};
+
+void ReadOnlyPropertyServerModule::ListDependencies(ModuleList* list) {
+  GrpcFacadeModule::ListDependencies(list);
+  list->add<hci::Controller>();
+}
+void ReadOnlyPropertyServerModule::Start() {
+  GrpcFacadeModule::Start();
+  service_ = std::make_unique<ReadOnlyPropertyService>(GetDependency<hci::Controller>());
+}
+void ReadOnlyPropertyServerModule::Stop() {
+  service_.reset();
+  GrpcFacadeModule::Stop();
+}
+::grpc::Service* ReadOnlyPropertyServerModule::GetService() const {
+  return service_.get();
+}
+
+const ModuleFactory ReadOnlyPropertyServerModule::Factory =
+    ::bluetooth::ModuleFactory([]() { return new ReadOnlyPropertyServerModule(); });
+
+}  // namespace cert
+}  // namespace bluetooth
diff --git a/gd/cert/read_only_property_server.h b/gd/cert/read_only_property_server.h
new file mode 100644
index 0000000..e367537
--- /dev/null
+++ b/gd/cert/read_only_property_server.h
@@ -0,0 +1,45 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#pragma once
+
+#include <memory>
+
+#include <grpc++/grpc++.h>
+
+#include "cert/rootservice.grpc.pb.h"
+#include "grpc/grpc_module.h"
+
+namespace bluetooth {
+namespace cert {
+
+class ReadOnlyPropertyService;
+
+class ReadOnlyPropertyServerModule : public ::bluetooth::grpc::GrpcFacadeModule {
+ public:
+  static const ModuleFactory Factory;
+
+  void ListDependencies(ModuleList* list) override;
+  void Start() override;
+  void Stop() override;
+  ::grpc::Service* GetService() const override;
+
+ private:
+  std::unique_ptr<ReadOnlyPropertyService> service_;
+};
+
+}  // namespace cert
+}  // namespace bluetooth
diff --git a/gd/cert/rootservice.proto b/gd/cert/rootservice.proto
index 02bd078..4472bfe 100644
--- a/gd/cert/rootservice.proto
+++ b/gd/cert/rootservice.proto
@@ -2,6 +2,9 @@
 
 package bluetooth.cert;
 
+import "google/protobuf/empty.proto";
+import "facade/common.proto";
+
 service RootCert {
   rpc StartStack(StartStackRequest) returns (StartStackResponse) {}
   rpc StopStack(StopStackRequest) returns (StopStackResponse) {}
@@ -23,3 +26,7 @@
 message StopStackRequest {}
 
 message StopStackResponse {}
+
+service ReadOnlyProperty {
+  rpc ReadLocalAddress(google.protobuf.Empty) returns (facade.BluetoothAddress) {}
+}
diff --git a/gd/cert/run_device_cert.sh b/gd/cert/run_device_cert.sh
new file mode 100755
index 0000000..44e5a89
--- /dev/null
+++ b/gd/cert/run_device_cert.sh
@@ -0,0 +1,3 @@
+#! /bin/bash
+
+act.py -c $ANDROID_BUILD_TOP/system/bt/gd/cert/android_devices_config.json -tf $ANDROID_BUILD_TOP/system/bt/gd/cert/cert_testcases -tp $ANDROID_BUILD_TOP/system/bt/gd
diff --git a/gd/cert/set_up_acts.sh b/gd/cert/set_up_acts.sh
index 2d3ad3a..c8fa38b 100755
--- a/gd/cert/set_up_acts.sh
+++ b/gd/cert/set_up_acts.sh
@@ -1,6 +1,79 @@
 #! /bin/bash
-
+#
+# Script to setup environment to execute bluetooth certification stack
+#
 # for more info, see go/acts
 
+## Android build main build setup script relative to top level android source root
+BUILD_SETUP=./build/envsetup.sh
+
+function UsageAndroidTree {
+    cat<<EOF
+Ensure invoked from within the android source tree
+EOF
+}
+
+function UsageSourcedNotExecuted {
+    cat<<EOF
+Ensure script is SOURCED and not executed to persist the build setup
+e.g.
+source $0
+EOF
+}
+
+function UpFind {
+    while [[ $PWD != / ]] ; do
+        rc=$(find "$PWD" -maxdepth 1 "$@")
+        if [ -n "$rc" ]; then
+            echo $(dirname "$rc")
+            return
+        fi
+        cd ..
+    done
+}
+
+function SetUpAndroidBuild {
+    pushd .
+    android_root=$(UpFind -name out -type d)
+    if [[ -z $android_root ]] ; then
+        UsageAndroidTree
+        return
+    fi
+    echo "Found android root $android_root"
+    cd $android_root && . $BUILD_SETUP
+    echo "Sourced build setup rules"
+    cd $android_root && lunch
+    popd
+}
+
+function SetupPython3 {
+    echo "Setting up python3"
+    sudo apt-get install python3-dev
+}
+
+if [[ "${BASH_SOURCE[0]}" == "${0}" ]] ; then
+    UsageSourcedNotExecuted
+    exit 1
+fi
+
+if [[ -z "$ANDROID_BUILD_TOP" ]] ; then
+    SetUpAndroidBuild
+fi
+
+## Check python3 is installed properly
+dpkg -l python3-dev > /dev/null 2>&1
+if [[ $? -ne 0 ]] ; then
+    SetupPython3
+fi
+
+## All is good now so go ahead with the acts setup
+pushd .
 cd $ANDROID_BUILD_TOP/tools/test/connectivity/acts/framework/
 sudo python3 setup.py develop
+if [[ $? -eq 0 ]] ; then
+    echo "cert setup complete"
+else
+    echo "cert setup failed"
+fi
+popd
+
diff --git a/gd/common/Android.bp b/gd/common/Android.bp
index e9e0b25..c923427 100644
--- a/gd/common/Android.bp
+++ b/gd/common/Android.bp
@@ -1,17 +1,16 @@
 filegroup {
     name: "BluetoothCommonSources",
     srcs: [
-        "address.cc",
-        "class_of_device.cc",
+        "link_key.cc",
     ],
 }
 
 filegroup {
     name: "BluetoothCommonTestSources",
     srcs: [
-        "address_unittest.cc",
         "blocking_queue_unittest.cc",
-        "class_of_device_unittest.cc",
         "bidi_queue_unittest.cc",
+        "observer_registry_test.cc",
+        "link_key_unittest.cc",
     ],
 }
diff --git a/gd/common/bidi_queue.h b/gd/common/bidi_queue.h
index 17baa60..c108588 100644
--- a/gd/common/bidi_queue.h
+++ b/gd/common/bidi_queue.h
@@ -18,6 +18,7 @@
 
 #pragma once
 
+#include "common/callback.h"
 #include "os/queue.h"
 
 namespace bluetooth {
@@ -28,8 +29,8 @@
     : public ::bluetooth::os::IQueueEnqueue<TENQUEUE>,
       public ::bluetooth::os::IQueueDequeue<TDEQUEUE> {
  public:
-  using EnqueueCallback = std::function<std::unique_ptr<TENQUEUE>()>;
-  using DequeueCallback = std::function<void()>;
+  using EnqueueCallback = Callback<std::unique_ptr<TENQUEUE>()>;
+  using DequeueCallback = Callback<void()>;
 
   BidiQueueEnd(::bluetooth::os::IQueueEnqueue<TENQUEUE>* tx, ::bluetooth::os::IQueueDequeue<TDEQUEUE>* rx)
       : tx_(tx), rx_(rx) {
diff --git a/gd/common/bidi_queue_unittest.cc b/gd/common/bidi_queue_unittest.cc
index 0bad92d..7a5503c 100644
--- a/gd/common/bidi_queue_unittest.cc
+++ b/gd/common/bidi_queue_unittest.cc
@@ -18,9 +18,10 @@
 
 #include <future>
 
+#include "common/bind.h"
 #include "gtest/gtest.h"
-#include "os/thread.h"
 #include "os/handler.h"
+#include "os/thread.h"
 
 using ::bluetooth::os::Thread;
 using ::bluetooth::os::Handler;
@@ -64,33 +65,45 @@
       : handler_(handler), end_(end) {}
 
   ~TestBidiQueueEnd() {
+    handler_->Clear();
   }
 
   std::promise<void>* Send(TA* value) {
     std::promise<void>* promise = new std::promise<void>();
-    handler_->Post([this, value, promise] {
-      end_->RegisterEnqueue(handler_, [this, value, promise]() -> std::unique_ptr<TA> {
-        end_->UnregisterEnqueue();
-        promise->set_value();
-        return std::unique_ptr<TA>(value);
-      });
-    });
-
+    handler_->Post(BindOnce(&TestBidiQueueEnd<TA, TB>::handle_send, common::Unretained(this), common::Unretained(value),
+                            common::Unretained(promise)));
     return promise;
   }
 
   std::promise<TB*>* Receive() {
     std::promise<TB*>* promise = new std::promise<TB*>();
-    handler_->Post([this, promise] {
-      end_->RegisterDequeue(handler_, [this, promise] {
-        end_->UnregisterDequeue();
-        promise->set_value(end_->TryDequeue().get());
-      });
-    });
+    handler_->Post(
+        BindOnce(&TestBidiQueueEnd<TA, TB>::handle_receive, common::Unretained(this), common::Unretained(promise)));
 
     return promise;
   }
 
+  void handle_send(TA* value, std::promise<void>* promise) {
+    end_->RegisterEnqueue(handler_, Bind(&TestBidiQueueEnd<TA, TB>::handle_register_enqueue, common::Unretained(this),
+                                         common::Unretained(value), common::Unretained(promise)));
+  }
+
+  std::unique_ptr<TA> handle_register_enqueue(TA* value, std::promise<void>* promise) {
+    end_->UnregisterEnqueue();
+    promise->set_value();
+    return std::unique_ptr<TA>(value);
+  }
+
+  void handle_receive(std::promise<TB*>* promise) {
+    end_->RegisterDequeue(handler_, Bind(&TestBidiQueueEnd<TA, TB>::handle_register_dequeue, common::Unretained(this),
+                                         common::Unretained(promise)));
+  }
+
+  void handle_register_dequeue(std::promise<TB*>* promise) {
+    end_->UnregisterDequeue();
+    promise->set_value(end_->TryDequeue().get());
+  }
+
  private:
   Handler* handler_;
   BidiQueueEnd<TA, TB>* end_;
diff --git a/gd/common/bind.h b/gd/common/bind.h
new file mode 100644
index 0000000..1adf16c
--- /dev/null
+++ b/gd/common/bind.h
@@ -0,0 +1,34 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#pragma once
+
+#include "base/bind.h"
+
+namespace bluetooth {
+namespace common {
+
+using base::Bind;
+using base::BindOnce;
+using base::ConstRef;
+using base::IgnoreResult;
+using base::Owned;
+using base::Passed;
+using base::RetainedRef;
+using base::Unretained;
+
+}  // namespace common
+}  // namespace bluetooth
diff --git a/gd/common/blocking_queue.h b/gd/common/blocking_queue.h
index 8d006d5..622ca08 100644
--- a/gd/common/blocking_queue.h
+++ b/gd/common/blocking_queue.h
@@ -45,16 +45,14 @@
     return data;
   };
 
-  bool take_for(std::chrono::milliseconds time, T& data) {
+  // Returns true if take() will not block within a time period
+  bool wait_to_take(std::chrono::milliseconds time) {
     std::unique_lock<std::mutex> lock(mutex_);
     while (queue_.empty()) {
       if (not_empty_.wait_for(lock, time) == std::cv_status::timeout) {
         return false;
       }
     }
-    data = queue_.front();
-    queue_.pop();
-
     return true;
   }
 
diff --git a/gd/common/blocking_queue_unittest.cc b/gd/common/blocking_queue_unittest.cc
index da1d9c6..57a6245 100644
--- a/gd/common/blocking_queue_unittest.cc
+++ b/gd/common/blocking_queue_unittest.cc
@@ -86,6 +86,25 @@
   EXPECT_TRUE(queue_.empty());
 }
 
+TEST_F(BlockingQueueTest, wait_to_take_fail) {
+  EXPECT_FALSE(queue_.wait_to_take(std::chrono::milliseconds(3)));
+}
+
+TEST_F(BlockingQueueTest, wait_to_take_after_non_empty) {
+  int data = 1;
+  queue_.push(data);
+  EXPECT_TRUE(queue_.wait_to_take(std::chrono::milliseconds(3)));
+  queue_.clear();
+}
+
+TEST_F(BlockingQueueTest, wait_to_take_before_non_empty) {
+  int data = 1;
+  std::thread waiter_thread([this] { EXPECT_TRUE(queue_.wait_to_take(std::chrono::milliseconds(3))); });
+  queue_.push(data);
+  waiter_thread.join();
+  queue_.clear();
+}
+
 TEST_F(BlockingQueueTest, wait_for_non_empty_batch) {
   std::thread waiter_thread([this] {
     for (int data = 0; data < 10; data++) {
diff --git a/gd/common/callback.h b/gd/common/callback.h
new file mode 100644
index 0000000..b8be642
--- /dev/null
+++ b/gd/common/callback.h
@@ -0,0 +1,30 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#pragma once
+
+#include "base/callback.h"
+
+namespace bluetooth {
+namespace common {
+
+using base::Callback;
+using base::Closure;
+using base::OnceCallback;
+using base::OnceClosure;
+
+}  // namespace common
+}  // namespace bluetooth
diff --git a/gd/common/callback_list.h b/gd/common/callback_list.h
new file mode 100644
index 0000000..857b0c7
--- /dev/null
+++ b/gd/common/callback_list.h
@@ -0,0 +1,84 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#pragma once
+
+#include <utility>
+#include "base/callback_list.h"
+#include "os/handler.h"
+
+/* This file contains CallbackList implementation that will execute callback on provided Handler thread
+
+Example usage inside your class:
+
+private:
+  common::CallbackList<void(int)> callbacks_list_;
+public:
+  std::unique_ptr<common::CallbackList<void(int)>::Subscription> RegisterCallback(
+      const base::RepeatingCallback<void(int)>& cb, os::Handler* handler) {
+    return callbacks_list_.Add({cb, handler});
+  }
+
+  void NotifyAllCallbacks(int value) {
+    callbacks_list_.Notify(value);
+  }
+*/
+
+namespace bluetooth {
+namespace common {
+
+namespace {
+template <typename CallbackType>
+struct CallbackWithHandler {
+  CallbackWithHandler(base::RepeatingCallback<CallbackType> callback, os::Handler* handler)
+      : callback(callback), handler(handler) {}
+
+  bool is_null() const {
+    return callback.is_null();
+  }
+
+  void Reset() {
+    callback.Reset();
+  }
+
+  base::RepeatingCallback<CallbackType> callback;
+  os::Handler* handler;
+};
+
+}  // namespace
+
+template <typename Sig>
+class CallbackList;
+template <typename... Args>
+class CallbackList<void(Args...)> : public base::internal::CallbackListBase<CallbackWithHandler<void(Args...)>> {
+ public:
+  using CallbackType = CallbackWithHandler<void(Args...)>;
+  CallbackList() = default;
+  template <typename... RunArgs>
+  void Notify(RunArgs&&... args) {
+    auto it = this->GetIterator();
+    CallbackType* cb;
+    while ((cb = it.GetNext()) != nullptr) {
+      cb->handler->Post(base::Bind(cb->callback, args...));
+    }
+  }
+
+ private:
+  DISALLOW_COPY_AND_ASSIGN(CallbackList);
+};
+
+}  // namespace common
+}  // namespace bluetooth
diff --git a/gd/common/link_key.cc b/gd/common/link_key.cc
new file mode 100644
index 0000000..12b60cd
--- /dev/null
+++ b/gd/common/link_key.cc
@@ -0,0 +1,57 @@
+/******************************************************************************
+ *
+ *  Copyright 2019 The Android Open Source Project
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at:
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ ******************************************************************************/
+
+#include "link_key.h"
+
+namespace bluetooth {
+namespace common {
+
+const LinkKey LinkKey::kExample{
+    {0x4C, 0x68, 0x38, 0x41, 0x39, 0xf5, 0x74, 0xd8, 0x36, 0xbc, 0xf3, 0x4e, 0x9d, 0xfb, 0x01, 0xbf}};
+
+LinkKey::LinkKey(const uint8_t (&data)[16]) {
+  std::copy(data, data + kLength, link_key);
+}
+
+std::string LinkKey::ToString() const {
+  char buffer[33] = "";
+  for (int i = 0; i < 16; i++) {
+    std::snprintf(&buffer[i * 2], 3, "%02x", link_key[i]);
+  }
+  std::string str(buffer);
+  return str;
+}
+
+bool LinkKey::FromString(const std::string& from, bluetooth::common::LinkKey& to) {
+  LinkKey new_link_key;
+
+  if (from.length() != 32) {
+    return false;
+  }
+
+  char* temp = nullptr;
+  for (int i = 0; i < 16; i++) {
+    new_link_key.link_key[i] = strtol(from.substr(i * 2, 2).c_str(), &temp, 16);
+  }
+
+  to = new_link_key;
+  return true;
+}
+
+}  // namespace common
+}  // namespace bluetooth
diff --git a/gd/common/link_key.h b/gd/common/link_key.h
new file mode 100644
index 0000000..b2bf394
--- /dev/null
+++ b/gd/common/link_key.h
@@ -0,0 +1,41 @@
+/******************************************************************************
+ *
+ *  Copyright 2019 The Android Open Source Project
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at:
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ ******************************************************************************/
+
+#pragma once
+
+#include <string>
+
+namespace bluetooth {
+namespace common {
+
+class LinkKey final {
+ public:
+  LinkKey() = default;
+  LinkKey(const uint8_t (&data)[16]);
+
+  static constexpr unsigned int kLength = 16;
+  uint8_t link_key[kLength];
+
+  std::string ToString() const;
+  static bool FromString(const std::string& from, LinkKey& to);
+
+  static const LinkKey kExample;
+};
+
+}  // namespace common
+}  // namespace bluetooth
\ No newline at end of file
diff --git a/gd/common/link_key_unittest.cc b/gd/common/link_key_unittest.cc
new file mode 100644
index 0000000..6529564
--- /dev/null
+++ b/gd/common/link_key_unittest.cc
@@ -0,0 +1,50 @@
+/******************************************************************************
+ *
+ *  Copyright 2019 The Android Open Source Project
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at:
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ ******************************************************************************/
+
+#include "common/link_key.h"
+#include <gtest/gtest.h>
+#include "os/log.h"
+
+using bluetooth::common::LinkKey;
+
+static const char* test_link_key = "4c68384139f574d836bcf34e9dfb01bf\0";
+
+TEST(LinkKeyUnittest, test_constructor_array) {
+  uint8_t data[LinkKey::kLength] = {0x4c, 0x87, 0x49, 0xe1, 0x2e, 0x55, 0x0f, 0x7f,
+                                    0x60, 0x8b, 0x4f, 0x96, 0xd7, 0xc5, 0xbc, 0x2a};
+
+  LinkKey link_key(data);
+
+  for (int i = 0; i < LinkKey::kLength; i++) {
+    ASSERT_EQ(data[i], link_key.link_key[i]);
+  }
+}
+
+TEST(LinkKeyUnittest, test_from_str) {
+  LinkKey link_key;
+  LinkKey::FromString(test_link_key, link_key);
+
+  for (int i = 0; i < LinkKey::kLength; i++) {
+    ASSERT_EQ(LinkKey::kExample.link_key[i], link_key.link_key[i]);
+  }
+}
+
+TEST(LinkKeyUnittest, test_to_str) {
+  std::string str = LinkKey::kExample.ToString();
+  ASSERT_STREQ(str.c_str(), test_link_key);
+}
\ No newline at end of file
diff --git a/gd/common/observer_registry.h b/gd/common/observer_registry.h
new file mode 100644
index 0000000..99de57f
--- /dev/null
+++ b/gd/common/observer_registry.h
@@ -0,0 +1,75 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#pragma once
+
+#include <array>
+
+#include "common/bind.h"
+#include "common/callback.h"
+#include "os/log.h"
+
+namespace bluetooth {
+namespace common {
+
+// Tracks an observer registration on client (observer) code. Register() returns a wrapped callback object which can
+// be passed to server's register API. Unregister() invalidates the wrapped callback so all callbacks that are posted
+// to the client handler after the client called Unregister() call and before the server processed the Unregister()
+// call on its handler, are dropped.
+// Note: Register() invalidates the previous registration.
+class SingleObserverRegistry {
+ public:
+  template <typename R, typename... T>
+  decltype(auto) Register(Callback<R(T...)> callback) {
+    session_++;
+    return Bind(&SingleObserverRegistry::callback_wrapper<R, T...>, Unretained(this), session_, callback);
+  }
+
+  void Unregister() {
+    session_++;
+  }
+
+ private:
+  template <typename R, typename... T>
+  void callback_wrapper(int session, Callback<R(T...)> callback, T... t) {
+    if (session == session_) {
+      callback.Run(std::forward<T>(t)...);
+    }
+  }
+
+  uint8_t session_ = 0;
+};
+
+// Tracks observer registration for multiple event type. Each event type is represented as an integer in [0, Capacity).
+template <int Capacity = 10>
+class MultipleObserverRegistry {
+ public:
+  template <typename R, typename... T>
+  decltype(auto) Register(int event_type, Callback<R(T...)> callback) {
+    ASSERT(event_type < Capacity);
+    return registry_[event_type].Register(callback);
+  }
+
+  void Unregister(int event_type) {
+    ASSERT(event_type < Capacity);
+    registry_[event_type].Unregister();
+  }
+
+  std::array<SingleObserverRegistry, Capacity> registry_;
+};
+
+}  // namespace common
+}  // namespace bluetooth
diff --git a/gd/common/observer_registry_test.cc b/gd/common/observer_registry_test.cc
new file mode 100644
index 0000000..f1233a8
--- /dev/null
+++ b/gd/common/observer_registry_test.cc
@@ -0,0 +1,120 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "common/observer_registry.h"
+
+#include "common/bind.h"
+#include "gtest/gtest.h"
+
+namespace bluetooth {
+namespace common {
+
+class SingleObserverRegistryTest : public ::testing::Test {
+ protected:
+  void SetUp() override {
+    registry_ = new SingleObserverRegistry;
+  }
+
+  void TearDown() override {
+    delete registry_;
+  }
+
+  SingleObserverRegistry* registry_;
+};
+
+void Increment(int* count) {
+  (*count)++;
+}
+
+void IncrementBy(int* count, int n) {
+  (*count) += n;
+}
+
+TEST_F(SingleObserverRegistryTest, wrapped_callback) {
+  int count = 0;
+  auto wrapped_callback = registry_->Register(Bind(&Increment, Unretained(&count)));
+  wrapped_callback.Run();
+  EXPECT_EQ(count, 1);
+  wrapped_callback.Run();
+  EXPECT_EQ(count, 2);
+  wrapped_callback.Run();
+  EXPECT_EQ(count, 3);
+  registry_->Unregister();
+}
+
+TEST_F(SingleObserverRegistryTest, unregister) {
+  int count = 0;
+  auto wrapped_callback = registry_->Register(Bind(&Increment, Unretained(&count)));
+  registry_->Unregister();
+  wrapped_callback.Run();
+  EXPECT_EQ(count, 0);
+}
+
+TEST_F(SingleObserverRegistryTest, second_register) {
+  int count = 0;
+  auto wrapped_callback = registry_->Register(Bind(&Increment, Unretained(&count)));
+  registry_->Unregister();
+  auto wrapped_callback2 = registry_->Register(Bind(&Increment, Unretained(&count)));
+  wrapped_callback.Run();
+  EXPECT_EQ(count, 0);
+  wrapped_callback2.Run();
+  EXPECT_EQ(count, 1);
+}
+
+class MultipleObserverRegistryTest : public ::testing::Test {
+ protected:
+  void SetUp() override {
+    registry_ = new MultipleObserverRegistry<2>;
+  }
+
+  void TearDown() override {
+    delete registry_;
+  }
+
+  MultipleObserverRegistry<2>* registry_;
+};
+
+TEST_F(MultipleObserverRegistryTest, single_wrapped_callback) {
+  int count = 0;
+  auto wrapped_callback = registry_->Register(0, Bind(&Increment, Unretained(&count)));
+  wrapped_callback.Run();
+  EXPECT_EQ(count, 1);
+  wrapped_callback.Run();
+  EXPECT_EQ(count, 2);
+  wrapped_callback.Run();
+  EXPECT_EQ(count, 3);
+  registry_->Unregister(0);
+}
+
+TEST_F(MultipleObserverRegistryTest, multiple_wrapped_callback) {
+  int count = 0;
+  auto wrapped_callback0 = registry_->Register(0, Bind(&Increment, Unretained(&count)));
+  auto wrapped_callback1 = registry_->Register(1, Bind(&IncrementBy, Unretained(&count), 10));
+  wrapped_callback0.Run();
+  EXPECT_EQ(count, 1);
+  wrapped_callback1.Run();
+  EXPECT_EQ(count, 11);
+  registry_->Unregister(0);
+  wrapped_callback0.Run();
+  EXPECT_EQ(count, 11);
+  wrapped_callback1.Run();
+  EXPECT_EQ(count, 21);
+  registry_->Unregister(1);
+  EXPECT_EQ(count, 21);
+}
+
+}  // namespace common
+}  // namespace bluetooth
diff --git a/gd/common/testing/bind_test_util.h b/gd/common/testing/bind_test_util.h
new file mode 100644
index 0000000..7db9204
--- /dev/null
+++ b/gd/common/testing/bind_test_util.h
@@ -0,0 +1,29 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#pragma once
+
+#include "base/test/bind_test_util.h"
+
+namespace bluetooth {
+namespace common {
+namespace testing {
+
+using base::BindLambdaForTesting;
+
+}  // namespace testing
+}  // namespace common
+}  // namespace bluetooth
diff --git a/gd/common/testing/wired_pair_of_bidi_queues.h b/gd/common/testing/wired_pair_of_bidi_queues.h
new file mode 100644
index 0000000..92c6a1f
--- /dev/null
+++ b/gd/common/testing/wired_pair_of_bidi_queues.h
@@ -0,0 +1,97 @@
+/******************************************************************************
+ *
+ *  Copyright 2019 The Android Open Source Project
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at:
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ ******************************************************************************/
+
+#pragma once
+
+#include <memory>
+
+#include "common/bidi_queue.h"
+#include "os/handler.h"
+#include "packet/base_packet_builder.h"
+#include "packet/bit_inserter.h"
+#include "packet/packet_view.h"
+
+namespace bluetooth {
+namespace common {
+namespace testing {
+
+/* This class is a pair of BiDiQueues, that have down ends "wired" together. It can be used i.e. to mock L2cap
+ * interface, and provide two queues, where each sends packets of type A, and receives packets of type B */
+template <class A, class B, std::unique_ptr<B> (*A_TO_B)(std::unique_ptr<A>)>
+class WiredPairOfBiDiQueues {
+  void dequeue_callback_a() {
+    auto down_thing = queue_a_.GetDownEnd()->TryDequeue();
+    if (!down_thing) LOG_ERROR("Received dequeue, but no data ready...");
+
+    down_buffer_b_.Enqueue(A_TO_B(std::move(down_thing)), handler_);
+  }
+
+  void dequeue_callback_b() {
+    auto down_thing = queue_b_.GetDownEnd()->TryDequeue();
+    if (!down_thing) LOG_ERROR("Received dequeue, but no data ready...");
+
+    down_buffer_a_.Enqueue(A_TO_B(std::move(down_thing)), handler_);
+  }
+
+  os::Handler* handler_;
+  common::BidiQueue<B, A> queue_a_{10};
+  common::BidiQueue<B, A> queue_b_{10};
+  os::EnqueueBuffer<B> down_buffer_a_{queue_a_.GetDownEnd()};
+  os::EnqueueBuffer<B> down_buffer_b_{queue_b_.GetDownEnd()};
+
+ public:
+  WiredPairOfBiDiQueues(os::Handler* handler) : handler_(handler) {
+    queue_a_.GetDownEnd()->RegisterDequeue(
+        handler_, common::Bind(&WiredPairOfBiDiQueues::dequeue_callback_a, common::Unretained(this)));
+    queue_b_.GetDownEnd()->RegisterDequeue(
+        handler_, common::Bind(&WiredPairOfBiDiQueues::dequeue_callback_b, common::Unretained(this)));
+  }
+
+  ~WiredPairOfBiDiQueues() {
+    queue_a_.GetDownEnd()->UnregisterDequeue();
+    queue_b_.GetDownEnd()->UnregisterDequeue();
+  }
+
+  /* This methd returns the UpEnd of queue A */
+  common::BidiQueueEnd<A, B>* GetQueueAUpEnd() {
+    return queue_a_.GetUpEnd();
+  }
+
+  /* This methd returns the UpEnd of queue B */
+  common::BidiQueueEnd<A, B>* GetQueueBUpEnd() {
+    return queue_b_.GetUpEnd();
+  }
+};
+
+namespace {
+std::unique_ptr<packet::PacketView<packet::kLittleEndian>> BuilderToView(
+    std::unique_ptr<packet::BasePacketBuilder> up_thing) {
+  auto bytes = std::make_shared<std::vector<uint8_t>>();
+  bluetooth::packet::BitInserter i(*bytes);
+  bytes->reserve(up_thing->size());
+  up_thing->Serialize(i);
+  return std::make_unique<packet::PacketView<packet::kLittleEndian>>(bytes);
+}
+}  // namespace
+
+using WiredPairOfL2capQueues =
+    WiredPairOfBiDiQueues<packet::BasePacketBuilder, packet::PacketView<packet::kLittleEndian>, BuilderToView>;
+
+}  // namespace testing
+}  // namespace common
+}  // namespace bluetooth
diff --git a/gd/crypto_toolbox/crypto_toolbox.cc b/gd/crypto_toolbox/crypto_toolbox.cc
index 1b2c06d..6582633 100644
--- a/gd/crypto_toolbox/crypto_toolbox.cc
+++ b/gd/crypto_toolbox/crypto_toolbox.cc
@@ -161,5 +161,43 @@
   return h6(iltk, keyID_brle);
 }
 
+Octet16 c1(const Octet16& k, const Octet16& r, const uint8_t* pres, const uint8_t* preq, const uint8_t iat,
+           const uint8_t* ia, const uint8_t rat, const uint8_t* ra) {
+  Octet16 p1;
+  auto it = p1.begin();
+  it = std::copy(pres, pres + 7, it);
+  it = std::copy(preq, preq + 7, it);
+  it = std::copy(&rat, &rat + 1, it);
+  it = std::copy(&iat, &iat + 1, it);
+
+  for (uint8_t i = 0; i < OCTET16_LEN; i++) {
+    p1[i] = r[i] ^ p1[i];
+  }
+
+  Octet16 p1bis = aes_128(k, p1);
+
+  std::array<uint8_t, 4> padding{0};
+  Octet16 p2;
+  it = p2.begin();
+  it = std::copy(padding.begin(), padding.end(), it);
+  it = std::copy(ia, ia + 6, it);
+  it = std::copy(ra, ra + 6, it);
+
+  for (uint8_t i = 0; i < OCTET16_LEN; i++) {
+    p2[i] = p1bis[i] ^ p2[i];
+  }
+
+  return aes_128(k, p2);
+}
+
+Octet16 s1(const Octet16& k, const Octet16& r1, const Octet16& r2) {
+  Octet16 text{0};
+  constexpr uint8_t BT_OCTET8_LEN = 8;
+  memcpy(text.data(), r1.data(), BT_OCTET8_LEN);
+  memcpy(text.data() + BT_OCTET8_LEN, r2.data(), BT_OCTET8_LEN);
+
+  return aes_128(k, text);
+}
+
 }  // namespace crypto_toolbox
 }  // namespace bluetooth
\ No newline at end of file
diff --git a/gd/crypto_toolbox/crypto_toolbox.h b/gd/crypto_toolbox/crypto_toolbox.h
index 899c958..25f7f69 100644
--- a/gd/crypto_toolbox/crypto_toolbox.h
+++ b/gd/crypto_toolbox/crypto_toolbox.h
@@ -24,6 +24,10 @@
 constexpr int OCTET16_LEN = 16;
 using Octet16 = std::array<uint8_t, OCTET16_LEN>;
 
+Octet16 c1(const Octet16& k, const Octet16& r, const uint8_t* pres, const uint8_t* preq, const uint8_t iat,
+           const uint8_t* ia, const uint8_t rat, const uint8_t* ra);
+Octet16 s1(const Octet16& k, const Octet16& r1, const Octet16& r2);
+
 extern Octet16 aes_128(const Octet16& key, const Octet16& message);
 extern Octet16 aes_cmac(const Octet16& key, const uint8_t* message, uint16_t length);
 extern Octet16 f4(uint8_t* u, uint8_t* v, const Octet16& x, uint8_t z);
diff --git a/gd/facade/common.proto b/gd/facade/common.proto
index 1c4a764..bf35409 100644
--- a/gd/facade/common.proto
+++ b/gd/facade/common.proto
@@ -19,3 +19,7 @@
   EventFetchMode fetch_mode = 2;
   uint32 timeout_ms = 3;
 }
+
+message BluetoothAddress {
+  bytes address = 1;
+}
diff --git a/gd/facade/facade_main.cc b/gd/facade/facade_main.cc
index 4236923..8ff1e72 100644
--- a/gd/facade/facade_main.cc
+++ b/gd/facade/facade_main.cc
@@ -16,9 +16,9 @@
 
 #include "stack_manager.h"
 
+#include <netinet/in.h>
 #include <sys/socket.h>
 #include <sys/types.h>
-#include <sys/un.h>
 #include <unistd.h>
 #include <csignal>
 #include <cstring>
@@ -49,14 +49,14 @@
 int main(int argc, const char** argv) {
   int root_server_port = 8897;
   int grpc_port = 8899;
+  int signal_port = 8895;
 
   const std::string arg_grpc_root_server_port = "--root-server-port=";
   const std::string arg_grpc_server_port = "--grpc-port=";
   const std::string arg_rootcanal_port = "--rootcanal-port=";
+  const std::string arg_signal_port = "--signal-port=";
   const std::string arg_btsnoop_path = "--btsnoop=";
   std::string btsnoop_path;
-  const std::string arg_tester_signal_socket = "--tester-signal-socket=";
-  std::string tester_signal_path;
   for (int i = 1; i < argc; i++) {
     std::string arg = argv[i];
     if (arg.find(arg_grpc_root_server_port) == 0) {
@@ -75,18 +75,20 @@
       btsnoop_path = arg.substr(arg_btsnoop_path.size());
       ::bluetooth::hal::SnoopLogger::SetFilePath(btsnoop_path);
     }
-    if (arg.find(arg_tester_signal_socket) == 0) {
-      tester_signal_path = arg.substr(arg_tester_signal_socket.size());
+    if (arg.find(arg_signal_port) == 0) {
+      auto port_number = arg.substr(arg_signal_port.size());
+      signal_port = std::stoi(port_number);
     }
   }
 
   signal(SIGINT, interrupt_handler);
   grpc_root_server.StartServer("0.0.0.0", root_server_port, grpc_port);
-  int tester_signal_socket = socket(AF_UNIX, SOCK_STREAM, 0);
-  struct sockaddr_un addr;
+  int tester_signal_socket = socket(AF_INET, SOCK_STREAM, 0);
+  struct sockaddr_in addr;
   memset(&addr, 0, sizeof(addr));
-  addr.sun_family = AF_UNIX;
-  strncpy(addr.sun_path, tester_signal_path.c_str(), tester_signal_path.size() + 1);
+  addr.sin_family = AF_INET;
+  addr.sin_port = htons(signal_port);
+  addr.sin_addr.s_addr = htonl(INADDR_ANY);
   connect(tester_signal_socket, (sockaddr*)&addr, sizeof(addr));
   close(tester_signal_socket);
   auto wait_thread = std::thread([] { grpc_root_server.RunGrpcLoop(); });
diff --git a/gd/facade/grpc_root_server.cc b/gd/facade/grpc_root_server.cc
index e03cded..29ccc59 100644
--- a/gd/facade/grpc_root_server.cc
+++ b/gd/facade/grpc_root_server.cc
@@ -18,9 +18,12 @@
 
 #include <string>
 
+#include "facade/read_only_property_server.h"
 #include "facade/rootservice.grpc.pb.h"
 #include "grpc/grpc_module.h"
 #include "hal/facade.h"
+#include "hci/facade.h"
+#include "l2cap/classic/facade.h"
 #include "os/log.h"
 #include "os/thread.h"
 #include "stack_manager.h"
@@ -50,6 +53,15 @@
       case BluetoothModule::HAL:
         modules.add<::bluetooth::hal::HciHalFacadeModule>();
         break;
+      case BluetoothModule::HCI:
+        modules.add<::bluetooth::facade::ReadOnlyPropertyServerModule>();
+        modules.add<::bluetooth::hci::AclManagerFacadeModule>();
+        modules.add<::bluetooth::hci::ClassicSecurityManagerFacadeModule>();
+        break;
+      case BluetoothModule::L2CAP:
+        modules.add<::bluetooth::facade::ReadOnlyPropertyServerModule>();
+        modules.add<::bluetooth::l2cap::classic::L2capModuleFacadeModule>();
+        break;
       default:
         return ::grpc::Status(::grpc::StatusCode::INVALID_ARGUMENT, "invalid module under test");
     }
@@ -74,6 +86,7 @@
 
     stack_manager_.GetInstance<GrpcModule>()->StopServer();
     grpc_loop_thread_->join();
+    delete grpc_loop_thread_;
 
     stack_manager_.ShutDown();
     delete stack_thread_;
diff --git a/gd/facade/read_only_property_server.cc b/gd/facade/read_only_property_server.cc
new file mode 100644
index 0000000..3c57b87
--- /dev/null
+++ b/gd/facade/read_only_property_server.cc
@@ -0,0 +1,57 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "facade/read_only_property_server.h"
+#include "hci/controller.h"
+
+namespace bluetooth {
+namespace facade {
+
+class ReadOnlyPropertyService : public ReadOnlyProperty::Service {
+ public:
+  ReadOnlyPropertyService(hci::Controller* controller) : controller_(controller) {}
+  ::grpc::Status ReadLocalAddress(::grpc::ServerContext* context, const ::google::protobuf::Empty* request,
+                                  ::bluetooth::facade::BluetoothAddress* response) override {
+    auto address = controller_->GetControllerMacAddress().ToString();
+    response->set_address(address);
+    return ::grpc::Status::OK;
+  }
+
+ private:
+  hci::Controller* controller_;
+};
+
+void ReadOnlyPropertyServerModule::ListDependencies(ModuleList* list) {
+  GrpcFacadeModule::ListDependencies(list);
+  list->add<hci::Controller>();
+}
+void ReadOnlyPropertyServerModule::Start() {
+  GrpcFacadeModule::Start();
+  service_ = std::make_unique<ReadOnlyPropertyService>(GetDependency<hci::Controller>());
+}
+void ReadOnlyPropertyServerModule::Stop() {
+  service_.reset();
+  GrpcFacadeModule::Stop();
+}
+::grpc::Service* ReadOnlyPropertyServerModule::GetService() const {
+  return service_.get();
+}
+
+const ModuleFactory ReadOnlyPropertyServerModule::Factory =
+    ::bluetooth::ModuleFactory([]() { return new ReadOnlyPropertyServerModule(); });
+
+}  // namespace facade
+}  // namespace bluetooth
diff --git a/gd/facade/read_only_property_server.h b/gd/facade/read_only_property_server.h
new file mode 100644
index 0000000..dfac424
--- /dev/null
+++ b/gd/facade/read_only_property_server.h
@@ -0,0 +1,45 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#pragma once
+
+#include <memory>
+
+#include <grpc++/grpc++.h>
+
+#include "facade/rootservice.grpc.pb.h"
+#include "grpc/grpc_module.h"
+
+namespace bluetooth {
+namespace facade {
+
+class ReadOnlyPropertyService;
+
+class ReadOnlyPropertyServerModule : public ::bluetooth::grpc::GrpcFacadeModule {
+ public:
+  static const ModuleFactory Factory;
+
+  void ListDependencies(ModuleList* list) override;
+  void Start() override;
+  void Stop() override;
+  ::grpc::Service* GetService() const override;
+
+ private:
+  std::unique_ptr<ReadOnlyPropertyService> service_;
+};
+
+}  // namespace facade
+}  // namespace bluetooth
diff --git a/gd/facade/rootservice.proto b/gd/facade/rootservice.proto
index 7bf45ca..eec30ad 100644
--- a/gd/facade/rootservice.proto
+++ b/gd/facade/rootservice.proto
@@ -2,6 +2,9 @@
 
 package bluetooth.facade;
 
+import "google/protobuf/empty.proto";
+import "facade/common.proto";
+
 service RootFacade {
   rpc StartStack(StartStackRequest) returns (StartStackResponse) {}
   rpc StopStack(StopStackRequest) returns (StopStackResponse) {}
@@ -23,3 +26,7 @@
 message StopStackRequest {}
 
 message StopStackResponse {}
+
+service ReadOnlyProperty {
+  rpc ReadLocalAddress(google.protobuf.Empty) returns (facade.BluetoothAddress) {}
+}
diff --git a/gd/fuzz_test.cc b/gd/fuzz_test.cc
new file mode 100644
index 0000000..ef358b5
--- /dev/null
+++ b/gd/fuzz_test.cc
@@ -0,0 +1,29 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <stddef.h>
+#include <stdint.h>
+
+extern void RunL2capClassicDynamicChannelAllocatorFuzzTest(const uint8_t* data, size_t size);
+extern void RunL2capPacketFuzzTest(const uint8_t* data, size_t size);
+extern void RunHciPacketFuzzTest(const uint8_t* data, size_t size);
+
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
+  RunL2capClassicDynamicChannelAllocatorFuzzTest(data, size);
+  RunL2capPacketFuzzTest(data, size);
+  RunHciPacketFuzzTest(data, size);
+  return 0;
+}
\ No newline at end of file
diff --git a/gd/grpc/grpc_event_stream.h b/gd/grpc/grpc_event_stream.h
index 3b313f3..3ed4bee 100644
--- a/gd/grpc/grpc_event_stream.h
+++ b/gd/grpc/grpc_event_stream.h
@@ -64,10 +64,10 @@
 
     if (fetch_mode == ::bluetooth::facade::AT_LEAST_ONE) {
       RES response;
-      EVENT event;
-      if (!event_queue_.take_for(std::chrono::milliseconds(timeout_ms), event)) {
+      if (!event_queue_.wait_to_take(std::chrono::milliseconds(timeout_ms))) {
         return ::grpc::Status(::grpc::StatusCode::DEADLINE_EXCEEDED, "timeout exceeded");
       }
+      EVENT event = event_queue_.take();
       callback_->OnWriteResponse(&response, event);
       writer->Write(response);
     }
diff --git a/gd/hal/cert/cert.cc b/gd/hal/cert/cert.cc
index d637f13..12240d3 100644
--- a/gd/hal/cert/cert.cc
+++ b/gd/hal/cert/cert.cc
@@ -24,6 +24,7 @@
 #include "grpc/grpc_event_stream.h"
 #include "hal/cert/api.grpc.pb.h"
 #include "hal/hci_hal.h"
+#include "hal/serialize_packet.h"
 #include "hci/hci_packets.h"
 
 namespace bluetooth {
@@ -38,15 +39,15 @@
     hal->registerIncomingPacketCallback(this);
   }
 
+  ~HciHalCertService() {
+    hal_->unregisterIncomingPacketCallback();
+  }
+
   ::grpc::Status SendHciResetCommand(::grpc::ServerContext* context, const ::google::protobuf::Empty* request,
                                      ::google::protobuf::Empty* response) override {
     std::unique_lock<std::mutex> lock(mutex_);
     can_send_hci_command_ = false;
-    auto packet = hci::ResetBuilder::Create();
-    std::shared_ptr<std::vector<uint8_t>> packet_bytes = std::make_shared<std::vector<uint8_t>>();
-    hci::BitInserter it(*packet_bytes);
-    packet->Serialize(it);
-    hal_->sendHciCommand(*packet_bytes);
+    hal_->sendHciCommand(SerializePacket(hci::ResetBuilder::Create()));
     std::this_thread::sleep_for(std::chrono::milliseconds(300));
     while (!can_send_hci_command_) {
       cv_.wait(lock);
@@ -75,12 +76,7 @@
         break;
     }
 
-    auto packet = hci::WriteScanEnableBuilder::Create(scan_enable);
-    std::shared_ptr<std::vector<uint8_t>> packet_bytes = std::make_shared<std::vector<uint8_t>>();
-    hci::BitInserter it(*packet_bytes);
-    packet->Serialize(it);
-    hal_->sendHciCommand(*packet_bytes);
-
+    hal_->sendHciCommand(SerializePacket(hci::WriteScanEnableBuilder::Create(scan_enable)));
     while (!can_send_hci_command_) {
       cv_.wait(lock);
     }
diff --git a/gd/hal/cert/simple_hal_test.py b/gd/hal/cert/simple_hal_test.py
index e7b7bab..d8e54d0 100644
--- a/gd/hal/cert/simple_hal_test.py
+++ b/gd/hal/cert/simple_hal_test.py
@@ -46,9 +46,17 @@
             )
         )
 
+        self.device_under_test.wait_channel_ready()
+        self.cert_device.wait_channel_ready()
+
         self.device_under_test.hal.SendHciResetCommand(empty_pb2.Empty())
         self.cert_device.hal.SendHciResetCommand(empty_pb2.Empty())
 
+        self.hci_event_stream = self.device_under_test.hal.hci_event_stream
+        self.cert_hci_event_stream = self.cert_device.hal.hci_event_stream
+        self.hci_acl_stream = self.device_under_test.hal.hci_acl_stream
+        self.cert_hci_acl_stream = self.cert_device.hal.hci_acl_stream
+
     def teardown_test(self):
         self.device_under_test.rootservice.StopStack(
             facade_rootservice_pb2.StopStackRequest()
@@ -56,13 +64,15 @@
         self.cert_device.rootservice.StopStack(
             cert_rootservice_pb2.StopStackRequest()
         )
+        self.hci_event_stream.clear_event_buffer()
+        self.cert_hci_event_stream.clear_event_buffer()
 
     def test_none_event(self):
-        self.device_under_test.hal.hci_event_stream.clear_event_buffer()
+        self.hci_event_stream.clear_event_buffer()
 
-        self.device_under_test.hal.hci_event_stream.subscribe()
-        self.device_under_test.hal.hci_event_stream.assert_none()
-        self.device_under_test.hal.hci_event_stream.unsubscribe()
+        self.hci_event_stream.subscribe()
+        self.hci_event_stream.assert_none()
+        self.hci_event_stream.unsubscribe()
 
     def test_example(self):
         response = self.device_under_test.hal.SetLoopbackMode(
@@ -74,7 +84,7 @@
             hal_facade_pb2.LoopbackModeSettings(enable=True)
         )
 
-        self.device_under_test.hal.hci_event_stream.subscribe()
+        self.hci_event_stream.subscribe()
 
         self.device_under_test.hal.SendHciCommand(
             hal_facade_pb2.HciCommandPacket(
@@ -82,13 +92,13 @@
             )
         )
 
-        self.device_under_test.hal.hci_event_stream.assert_event_occurs(
+        self.hci_event_stream.assert_event_occurs(
             lambda packet: packet.payload == b'\x19\x08\x01\x04\x053\x8b\x9e0\x01'
         )
-        self.device_under_test.hal.hci_event_stream.unsubscribe()
+        self.hci_event_stream.unsubscribe()
 
     def test_inquiry_from_dut(self):
-        self.device_under_test.hal.hci_event_stream.subscribe()
+        self.hci_event_stream.subscribe()
 
         self.cert_device.hal.SetScanMode(
             hal_cert_pb2.ScanModeSettings(mode=3)
@@ -96,8 +106,207 @@
         self.device_under_test.hal.SetInquiry(
             hal_facade_pb2.InquirySettings(length=0x30, num_responses=0xff)
         )
-        self.device_under_test.hal.hci_event_stream.assert_event_occurs(
+        self.hci_event_stream.assert_event_occurs(
             lambda packet: b'\x02\x0f' in packet.payload
             # Expecting an HCI Event (code 0x02, length 0x0f)
         )
-        self.device_under_test.hal.hci_event_stream.unsubscribe()
+        self.hci_event_stream.unsubscribe()
+
+    def test_le_ad_scan_cert_advertises(self):
+        self.hci_event_stream.subscribe()
+
+        # Set the LE Address to 0D:05:04:03:02:01
+        self.device_under_test.hal.SendHciCommand(
+            hal_facade_pb2.HciCommandPacket(
+                payload=b'\x05\x20\x06\x01\x02\x03\x04\x05\x0D'
+            )
+        )
+        # Set the LE Scan parameters (active, 40ms, 20ms, Random, 
+        self.device_under_test.hal.SendHciCommand(
+            hal_facade_pb2.HciCommandPacket(
+                payload=b'\x0B\x20\x07\x01\x40\x00\x20\x00\x01\x00'
+            )
+        )
+        # Enable Scanning (Disable duplicate filtering)
+        self.device_under_test.hal.SendHciCommand(
+            hal_facade_pb2.HciCommandPacket(
+               payload=b'\x0C\x20\x02\x01\x00'
+            )
+        )
+
+        # Set the LE Address to 0C:05:04:03:02:01
+        self.cert_device.hal.SendHciCommand(
+            hal_facade_pb2.HciCommandPacket(
+                payload=b'\x05\x20\x06\x01\x02\x03\x04\x05\x0C'
+            )
+        )
+        # Set LE Advertising parameters
+        self.cert_device.hal.SendHciCommand(
+            hal_facade_pb2.HciCommandPacket(
+               payload=b'\x06\x20\x0F\x00\x02\x00\x03\x00\x01\x00\xA1\xA2\xA3\xA4\xA5\xA6\x07\x00'
+            )
+        )
+        # Set LE Advertising data
+        self.cert_device.hal.SendHciCommand(
+            hal_facade_pb2.HciCommandPacket(
+               payload=b'\x08\x20\x20\x0C\x0A\x09Im_A_Cert\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
+            )
+        )
+        # Enable Advertising
+        self.cert_device.hal.SendHciCommand(
+            hal_facade_pb2.HciCommandPacket(
+               payload=b'\x0A\x20\x01\x01'
+            )
+        )
+        self.hci_event_stream.assert_event_occurs(
+            lambda packet: b'Im_A_Cert' in packet.payload
+            # Expecting an HCI Event (code 0x3e, length 0x13, subevent 0x01 )
+        )
+        # Disable Advertising
+        self.cert_device.hal.SendHciCommand(
+            hal_facade_pb2.HciCommandPacket(
+               payload=b'\x0A\x20\x01\x00'
+            )
+        )
+        # Disable Scanning
+        self.device_under_test.hal.SendHciCommand(
+            hal_facade_pb2.HciCommandPacket(
+               payload=b'\x0C\x20\x02\x00\x00'
+            )
+        )
+        self.hci_event_stream.unsubscribe()
+
+    def test_le_connection_dut_advertises(self):
+        self.hci_event_stream.subscribe()
+        self.cert_hci_event_stream.subscribe()
+        self.hci_acl_stream.subscribe()
+        self.cert_hci_acl_stream.subscribe()
+
+        # Set the CERT LE Address to 0C:05:04:03:02:01
+        self.cert_device.hal.SendHciCommand(
+            hal_cert_pb2.HciCommandPacket(
+                payload=b'\x05\x20\x06\x01\x02\x03\x04\x05\x0C'
+            )
+        )
+
+        # Direct connect to 0D:05:04:03:02:01
+        self.cert_device.hal.SendHciCommand(
+            hal_cert_pb2.HciCommandPacket(
+               payload=b'\x0D\x20\x19\x11\x01\x22\x02\x00\x01\x01\x02\x03\x04\x05\x0D\x01\x06\x00\x70\x0C\x40\x00\x03\x07\x01\x00\x02\x00'
+            )
+        )
+
+        # Set the LE Address to 0D:05:04:03:02:01
+        self.device_under_test.hal.SendHciCommand(
+            hal_facade_pb2.HciCommandPacket(
+                payload=b'\x05\x20\x06\x01\x02\x03\x04\x05\x0D'
+            )
+        )
+        # Set LE Advertising parameters
+        self.device_under_test.hal.SendHciCommand(
+            hal_facade_pb2.HciCommandPacket(
+               payload=b'\x06\x20\x0F\x80\x00\x00\x04\x00\x01\x00\xA1\xA2\xA3\xA4\xA5\xA6\x07\x00'
+            )
+        )
+        # Set LE Advertising data
+        self.device_under_test.hal.SendHciCommand(
+            hal_facade_pb2.HciCommandPacket(
+               payload=b'\x08\x20\x20\x0C\x0B\x09Im_The_DUT\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
+            )
+        )
+        # Enable Advertising
+        self.device_under_test.hal.SendHciCommand(
+            hal_facade_pb2.HciCommandPacket(
+               payload=b'\x0A\x20\x01\x01'
+            )
+        )
+        # LeConnectionComplete TODO: Extract the handle
+        self.cert_hci_event_stream.assert_event_occurs(
+            lambda packet: b'\x3e\x13\x01\x00' in packet.payload
+        )
+        # LeConnectionComplete TODO: Extract the handle
+        self.hci_event_stream.assert_event_occurs(
+            lambda packet: b'\x3e\x13\x01\x00' in packet.payload
+        )
+        # Send ACL Data
+        self.device_under_test.hal.SendHciAcl(
+            hal_facade_pb2.HciAclPacket(
+               payload=b'\xfe\x0e\x0b\x00SomeAclData'
+            )
+        )
+        # Send ACL Data
+        self.cert_device.hal.SendHciAcl(
+            hal_facade_pb2.HciAclPacket(
+               payload=b'\xfe\x0e\x0f\x00SomeMoreAclData'
+            )
+        )
+        self.cert_hci_acl_stream.assert_event_occurs(
+            lambda packet: b'\xfe\x0e\x0b\x00SomeAclData' in packet.payload
+        )
+        self.hci_acl_stream.assert_event_occurs(
+            lambda packet: b'\xfe\x0e\x0f\x00SomeMoreAclData' in packet.payload
+        )
+
+        self.hci_event_stream.unsubscribe()
+        self.cert_hci_event_stream.unsubscribe()
+        self.hci_acl_stream.unsubscribe()
+        self.cert_hci_acl_stream.unsubscribe()
+
+    def test_le_white_list_connection_cert_advertises(self):
+        self.hci_event_stream.subscribe()
+        self.cert_hci_event_stream.subscribe()
+
+        # Set the LE Address to 0D:05:04:03:02:01
+        self.device_under_test.hal.SendHciCommand(
+            hal_facade_pb2.HciCommandPacket(
+                payload=b'\x05\x20\x06\x01\x02\x03\x04\x05\x0D'
+            )
+        )
+        # Add the cert device to the white list (Random 0C:05:04:03:02:01)
+        self.device_under_test.hal.SendHciCommand(
+            hal_facade_pb2.HciCommandPacket(
+                payload=b'\x11\x20\x07\x01\x01\x02\x03\x04\x05\x0C'
+            )
+        )
+        # Connect using the white list
+        self.device_under_test.hal.SendHciCommand(
+            hal_facade_pb2.HciCommandPacket(
+               payload=b'\x0D\x20\x19\x11\x01\x22\x02\x01\x00\xA1\xA2\xA3\xA4\xA5\xA6\x01\x06\x00\x70\x0C\x40\x00\x03\x07\x01\x00\x02\x00'
+            )
+        )
+
+        # Set the LE Address to 0C:05:04:03:02:01
+        self.cert_device.hal.SendHciCommand(
+            hal_facade_pb2.HciCommandPacket(
+                payload=b'\x05\x20\x06\x01\x02\x03\x04\x05\x0C'
+            )
+        )
+        # Set LE Advertising parameters
+        self.cert_device.hal.SendHciCommand(
+            hal_facade_pb2.HciCommandPacket(
+               payload=b'\x06\x20\x0F\x00\x02\x00\x03\x00\x01\x00\xA1\xA2\xA3\xA4\xA5\xA6\x07\x00'
+            )
+        )
+        # Set LE Advertising data
+        self.cert_device.hal.SendHciCommand(
+            hal_facade_pb2.HciCommandPacket(
+               payload=b'\x08\x20\x20\x0C\x0A\x09Im_A_Cert\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
+            )
+        )
+        # Enable Advertising
+        self.cert_device.hal.SendHciCommand(
+            hal_facade_pb2.HciCommandPacket(
+               payload=b'\x0A\x20\x01\x01'
+            )
+        )
+        # LeConnectionComplete
+        self.cert_hci_event_stream.assert_event_occurs(
+            lambda packet: b'\x3e\x13\x01\x00' in packet.payload
+        )
+        # LeConnectionComplete
+        self.hci_event_stream.assert_event_occurs(
+            lambda packet: b'\x3e\x13\x01\x00' in packet.payload
+        )
+
+        self.hci_event_stream.unsubscribe()
+        self.cert_hci_event_stream.unsubscribe()
diff --git a/gd/hal/facade.cc b/gd/hal/facade.cc
index 1072d59..ce25103 100644
--- a/gd/hal/facade.cc
+++ b/gd/hal/facade.cc
@@ -24,6 +24,7 @@
 #include "grpc/grpc_event_stream.h"
 #include "hal/facade.grpc.pb.h"
 #include "hal/hci_hal.h"
+#include "hal/serialize_packet.h"
 #include "hci/hci_packets.h"
 
 using ::grpc::ServerAsyncResponseWriter;
@@ -45,15 +46,15 @@
     hal->registerIncomingPacketCallback(this);
   }
 
+  ~HciHalFacadeService() {
+    hal_->unregisterIncomingPacketCallback();
+  }
+
   ::grpc::Status SendHciResetCommand(::grpc::ServerContext* context, const ::google::protobuf::Empty* request,
                                      ::google::protobuf::Empty* response) override {
     std::unique_lock<std::mutex> lock(mutex_);
     can_send_hci_command_ = false;
-    auto packet = hci::ResetBuilder::Create();
-    std::shared_ptr<std::vector<uint8_t>> packet_bytes = std::make_shared<std::vector<uint8_t>>();
-    hci::BitInserter it(*packet_bytes);
-    packet->Serialize(it);
-    hal_->sendHciCommand(*packet_bytes);
+    hal_->sendHciCommand(SerializePacket(hci::ResetBuilder::Create()));
     while (!can_send_hci_command_) {
       cv_.wait(lock);
     }
@@ -66,12 +67,8 @@
     std::unique_lock<std::mutex> lock(mutex_);
     can_send_hci_command_ = false;
     bool enable = request->enable();
-    auto packet = hci::WriteLoopbackModeBuilder::Create(enable ? hci::LoopbackMode::ENABLE_LOCAL
-                                                               : hci::LoopbackMode::NO_LOOPBACK);
-    std::shared_ptr<std::vector<uint8_t>> packet_bytes = std::make_shared<std::vector<uint8_t>>();
-    hci::BitInserter it(*packet_bytes);
-    packet->Serialize(it);
-    hal_->sendHciCommand(*packet_bytes);
+    hal_->sendHciCommand(SerializePacket(hci::WriteLoopbackModeBuilder::Create(
+        enable ? hci::LoopbackMode::ENABLE_LOCAL : hci::LoopbackMode::NO_LOOPBACK)));
     while (!can_send_hci_command_) {
       cv_.wait(lock);
     }
@@ -82,12 +79,11 @@
                             ::google::protobuf::Empty* response) override {
     std::unique_lock<std::mutex> lock(mutex_);
     can_send_hci_command_ = false;
-    auto packet = hci::InquiryBuilder::Create(0x33 /* LAP=0x9e8b33 */, static_cast<uint8_t>(request->length()),
-                                              static_cast<uint8_t>(request->num_responses()));
-    std::shared_ptr<std::vector<uint8_t>> packet_bytes = std::make_shared<std::vector<uint8_t>>();
-    hci::BitInserter it(*packet_bytes);
-    packet->Serialize(it);
-    hal_->sendHciCommand(*packet_bytes);
+    hci::Lap lap;
+    lap.lap_ = 0x33;
+
+    hal_->sendHciCommand(SerializePacket(hci::InquiryBuilder::Create(lap, static_cast<uint8_t>(request->length()),
+                                                                     static_cast<uint8_t>(request->num_responses()))));
     while (!can_send_hci_command_) {
       cv_.wait(lock);
     }
diff --git a/gd/hal/hci_hal.h b/gd/hal/hci_hal.h
index 88c0d9e..f95a4f9 100644
--- a/gd/hal/hci_hal.h
+++ b/gd/hal/hci_hal.h
@@ -63,16 +63,16 @@
   virtual ~HciHal() = default;
 
   // Register the callback for incoming packets. All incoming packets are dropped before
-  // this callback is registered. Callback can only be registered once, but will be reset
-  // after close().
-  //
-  // Call this function before initialize() to guarantee all incoming packets are received.
+  // this callback is registered. Callback can only be registered once.
   //
   // @param callback implements BluetoothHciHalCallbacks which will
   //    receive callbacks when incoming HCI packets are received
   //    from the controller to be sent to the host.
   virtual void registerIncomingPacketCallback(HciHalCallbacks* callback) = 0;
 
+  // Unregister the callback for incoming packets. Drop all further incoming packets.
+  virtual void unregisterIncomingPacketCallback() = 0;
+
   // Send an HCI command (as specified in the Bluetooth Specification
   // V4.2, Vol 2, Part 5, Section 5.4.1) to the Bluetooth controller.
   // Commands must be executed in order.
diff --git a/gd/hal/hci_hal_android_hidl.cc b/gd/hal/hci_hal_android_hidl.cc
index 8935837..7e45d89 100644
--- a/gd/hal/hci_hal_android_hidl.cc
+++ b/gd/hal/hci_hal_android_hidl.cc
@@ -113,6 +113,7 @@
 }  // namespace
 
 const std::string SnoopLogger::DefaultFilePath = "/data/misc/bluetooth/logs/btsnoop_hci.log";
+const bool SnoopLogger::AlwaysFlush = false;
 
 class HciHalHidl : public HciHal {
  public:
@@ -120,6 +121,10 @@
     callbacks_->SetCallback(callback);
   }
 
+  void unregisterIncomingPacketCallback() override {
+    callbacks_->ResetCallback();
+  }
+
   void sendHciCommand(HciPacket command) override {
     btsnoop_logger_->capture(command, SnoopLogger::Direction::OUTGOING, SnoopLogger::PacketType::CMD);
     bt_hci_->sendHciCommand(command);
diff --git a/gd/hal/hci_hal_host_rootcanal.cc b/gd/hal/hci_hal_host_rootcanal.cc
index 3279bd5..11809ba 100644
--- a/gd/hal/hci_hal_host_rootcanal.cc
+++ b/gd/hal/hci_hal_host_rootcanal.cc
@@ -87,6 +87,7 @@
 namespace hal {
 
 const std::string SnoopLogger::DefaultFilePath = "/tmp/btsnoop_hci.log";
+const bool SnoopLogger::AlwaysFlush = true;
 
 class HciHalHostRootcanal : public HciHal {
  public:
@@ -96,6 +97,11 @@
     incoming_packet_callback_ = callback;
   }
 
+  void unregisterIncomingPacketCallback() override {
+    std::lock_guard<std::mutex> lock(mutex_);
+    incoming_packet_callback_ = nullptr;
+  }
+
   void sendHciCommand(HciPacket command) override {
     std::lock_guard<std::mutex> lock(mutex_);
     ASSERT(sock_fd_ != INVALID_FD);
@@ -133,8 +139,9 @@
     ASSERT(sock_fd_ == INVALID_FD);
     sock_fd_ = ConnectToRootCanal(config_->GetServerAddress(), config_->GetPort());
     ASSERT(sock_fd_ != INVALID_FD);
-    reactable_ =
-        hci_incoming_thread_.GetReactor()->Register(sock_fd_, [this]() { this->incoming_packet_received(); }, nullptr);
+    reactable_ = hci_incoming_thread_.GetReactor()->Register(
+        sock_fd_, common::Bind(&HciHalHostRootcanal::incoming_packet_received, common::Unretained(this)),
+        common::Closure());
     btsnoop_logger_ = GetDependency<SnoopLogger>();
     LOG_INFO("Rootcanal HAL opened successfully");
   }
@@ -168,25 +175,31 @@
     hci_outgoing_queue_.emplace(packet);
     if (hci_outgoing_queue_.size() == 1) {
       hci_incoming_thread_.GetReactor()->ModifyRegistration(
-          reactable_, [this] { this->incoming_packet_received(); },
-          [this] {
-            std::lock_guard<std::mutex> lock(this->mutex_);
-            auto packet_to_send = this->hci_outgoing_queue_.front();
-            auto bytes_written = write(this->sock_fd_, (void*)packet_to_send.data(), packet_to_send.size());
-            this->hci_outgoing_queue_.pop();
-            if (bytes_written == -1) {
-              abort();
-            }
-            if (hci_outgoing_queue_.empty()) {
-              this->hci_incoming_thread_.GetReactor()->ModifyRegistration(
-                  this->reactable_, [this] { this->incoming_packet_received(); }, nullptr);
-            }
-          });
+          reactable_, common::Bind(&HciHalHostRootcanal::incoming_packet_received, common::Unretained(this)),
+          common::Bind(&HciHalHostRootcanal::send_packet_ready, common::Unretained(this)));
+    }
+  }
+
+  void send_packet_ready() {
+    std::lock_guard<std::mutex> lock(this->mutex_);
+    auto packet_to_send = this->hci_outgoing_queue_.front();
+    auto bytes_written = write(this->sock_fd_, (void*)packet_to_send.data(), packet_to_send.size());
+    this->hci_outgoing_queue_.pop();
+    if (bytes_written == -1) {
+      abort();
+    }
+    if (hci_outgoing_queue_.empty()) {
+      this->hci_incoming_thread_.GetReactor()->ModifyRegistration(
+          this->reactable_, common::Bind(&HciHalHostRootcanal::incoming_packet_received, common::Unretained(this)),
+          common::Closure());
     }
   }
 
   void incoming_packet_received() {
-    ASSERT(incoming_packet_callback_ != nullptr);
+    if (incoming_packet_callback_ == nullptr) {
+      LOG_INFO("Dropping a packet");
+      return;
+    }
 
     uint8_t buf[kBufSize] = {};
 
diff --git a/gd/hal/hci_hal_host_rootcanal_test.cc b/gd/hal/hci_hal_host_rootcanal_test.cc
index ae98737..9783e84 100644
--- a/gd/hal/hci_hal_host_rootcanal_test.cc
+++ b/gd/hal/hci_hal_host_rootcanal_test.cc
@@ -16,6 +16,7 @@
 
 #include "hal/hci_hal_host_rootcanal.h"
 #include "hal/hci_hal.h"
+#include "hal/serialize_packet.h"
 
 #include <fcntl.h>
 #include <netdb.h>
@@ -35,6 +36,7 @@
 #include "os/log.h"
 #include "os/thread.h"
 #include "os/utils.h"
+#include "packet/raw_builder.h"
 
 using ::bluetooth::os::Thread;
 
@@ -147,6 +149,7 @@
   }
 
   void TearDown() override {
+    hal_->unregisterIncomingPacketCallback();
     fake_registry_.StopAll();
     close(fake_server_socket_);
     delete fake_server_;
@@ -376,6 +379,11 @@
   }
 }
 
+TEST(HciHalHidlTest, serialize) {
+  std::vector<uint8_t> bytes = {1, 2, 3, 4, 5, 6, 7, 8, 9};
+  auto packet_bytes = hal::SerializePacket(std::unique_ptr<packet::BasePacketBuilder>(new packet::RawBuilder(bytes)));
+  EXPECT_EQ(bytes, packet_bytes);
+}
 }  // namespace
 }  // namespace hal
 }  // namespace bluetooth
diff --git a/gd/hal/serialize_packet.h b/gd/hal/serialize_packet.h
new file mode 100644
index 0000000..621dcec
--- /dev/null
+++ b/gd/hal/serialize_packet.h
@@ -0,0 +1,35 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#pragma once
+
+#include <memory>
+
+#include "packet/base_packet_builder.h"
+
+namespace bluetooth {
+namespace hal {
+
+inline std::vector<uint8_t> SerializePacket(std::unique_ptr<packet::BasePacketBuilder> packet) {
+  std::vector<uint8_t> packet_bytes;
+  packet_bytes.reserve(packet->size());
+  packet::BitInserter it(packet_bytes);
+  packet->Serialize(it);
+  return packet_bytes;
+}
+
+}  // namespace hal
+}  // namespace bluetooth
diff --git a/gd/hal/snoop_logger.cc b/gd/hal/snoop_logger.cc
index 874fb31..3574b17 100644
--- a/gd/hal/snoop_logger.cc
+++ b/gd/hal/snoop_logger.cc
@@ -119,6 +119,7 @@
                                     .type = static_cast<uint8_t>(type)};
   btsnoop_ostream_.write(reinterpret_cast<const char*>(&header), sizeof(btsnoop_packet_header_t));
   btsnoop_ostream_.write(reinterpret_cast<const char*>(packet.data()), packet.size());
+  if (AlwaysFlush) btsnoop_ostream_.flush();
 }
 
 void SnoopLogger::ListDependencies(ModuleList* list) {
diff --git a/gd/hal/snoop_logger.h b/gd/hal/snoop_logger.h
index 4e0b90d..8021c2b 100644
--- a/gd/hal/snoop_logger.h
+++ b/gd/hal/snoop_logger.h
@@ -35,6 +35,8 @@
   static const std::string DefaultFilePath;
   // Set File Path before module is started to ensure all packets are written to the right file
   static void SetFilePath(const std::string& filename);
+  // Flag to allow flush into persistent memory on every packet captured. This is enabled on host for debugging.
+  static const bool AlwaysFlush;
 
   enum class PacketType {
     CMD = 1,
diff --git a/gd/hci/Android.bp b/gd/hci/Android.bp
index 69589ca..8784a49 100644
--- a/gd/hci/Android.bp
+++ b/gd/hci/Android.bp
@@ -1,7 +1,17 @@
 filegroup {
     name: "BluetoothHciSources",
     srcs: [
+        "acl_manager.cc",
+        "acl_fragmenter.cc",
+        "address.cc",
+        "classic_security_manager.cc",
+        "class_of_device.cc",
+        "controller.cc",
+        "device.cc",
+        "device_database.cc",
         "hci_layer.cc",
+        "le_advertising_manager.cc",
+        "le_scanning_manager.cc",
     ],
 }
 
@@ -9,6 +19,39 @@
     name: "BluetoothHciTestSources",
     srcs: [
         "acl_builder_test.cc",
+        "acl_manager_test.cc",
+        "address_unittest.cc",
+        "address_with_type_test.cc",
+        "class_of_device_unittest.cc",
+        "classic_security_manager_test.cc",
+        "controller_test.cc",
+        "device_test.cc",
+        "device_database_test.cc",
+        "dual_device_test.cc",
         "hci_layer_test.cc",
+        "hci_packets_test.cc",
+        "le_advertising_manager_test.cc",
+        "le_scanning_manager_test.cc",
+    ],
+}
+
+filegroup {
+    name: "BluetoothFacade_hci_layer",
+    srcs: [
+        "facade.cc",
+    ],
+}
+
+filegroup {
+    name: "BluetoothCertSource_hci_layer",
+    srcs: [
+        "cert/cert.cc",
+    ],
+}
+
+filegroup {
+    name: "BluetoothHciFuzzTestSources",
+    srcs: [
+        "hci_packets_fuzz_test.cc",
     ],
 }
diff --git a/gd/hci/acl_fragmenter.cc b/gd/hci/acl_fragmenter.cc
new file mode 100644
index 0000000..189e52d
--- /dev/null
+++ b/gd/hci/acl_fragmenter.cc
@@ -0,0 +1,36 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "hci/acl_fragmenter.h"
+
+#include "os/log.h"
+#include "packet/fragmenting_inserter.h"
+
+namespace bluetooth {
+namespace hci {
+
+AclFragmenter::AclFragmenter(size_t mtu, std::unique_ptr<packet::BasePacketBuilder> packet)
+    : mtu_(mtu), packet_(std::move(packet)) {}
+
+std::vector<std::unique_ptr<packet::RawBuilder>> AclFragmenter::GetFragments() {
+  std::vector<std::unique_ptr<packet::RawBuilder>> to_return;
+  packet::FragmentingInserter fragmenting_inserter(mtu_, std::back_insert_iterator(to_return));
+  packet_->Serialize(fragmenting_inserter);
+  return to_return;
+}
+
+}  // namespace hci
+}  // namespace bluetooth
diff --git a/gd/hci/acl_fragmenter.h b/gd/hci/acl_fragmenter.h
new file mode 100644
index 0000000..4bc3d06
--- /dev/null
+++ b/gd/hci/acl_fragmenter.h
@@ -0,0 +1,44 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#pragma once
+
+#include <cstdint>
+#include <forward_list>
+#include <iterator>
+#include <memory>
+#include <vector>
+
+#include "packet/base_packet_builder.h"
+#include "packet/raw_builder.h"
+
+namespace bluetooth {
+namespace hci {
+
+class AclFragmenter {
+ public:
+  AclFragmenter(size_t mtu, std::unique_ptr<packet::BasePacketBuilder> input);
+  virtual ~AclFragmenter() = default;
+
+  std::vector<std::unique_ptr<packet::RawBuilder>> GetFragments();
+
+ private:
+  size_t mtu_;
+  std::unique_ptr<packet::BasePacketBuilder> packet_;
+};
+
+}  // namespace hci
+}  // namespace bluetooth
diff --git a/gd/hci/acl_manager.cc b/gd/hci/acl_manager.cc
new file mode 100644
index 0000000..c60cf05
--- /dev/null
+++ b/gd/hci/acl_manager.cc
@@ -0,0 +1,1807 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "hci/acl_manager.h"
+
+#include <future>
+#include <queue>
+#include <set>
+#include <utility>
+
+#include "acl_fragmenter.h"
+#include "acl_manager.h"
+#include "common/bidi_queue.h"
+#include "hci/controller.h"
+#include "hci/hci_layer.h"
+
+namespace bluetooth {
+namespace hci {
+
+constexpr uint16_t kQualcommDebugHandle = 0xedc;
+
+using common::Bind;
+using common::BindOnce;
+
+struct AclManager::acl_connection {
+  acl_connection(AddressWithType address_with_type) : address_with_type_(address_with_type) {}
+  friend AclConnection;
+  AddressWithType address_with_type_;
+  std::unique_ptr<AclConnection::Queue> queue_ = std::make_unique<AclConnection::Queue>(10);
+  bool is_disconnected_ = false;
+  ErrorCode disconnect_reason_;
+  os::Handler* command_complete_handler_ = nullptr;
+  os::Handler* disconnect_handler_ = nullptr;
+  ConnectionManagementCallbacks* command_complete_callbacks_;
+  common::OnceCallback<void(ErrorCode)> on_disconnect_callback_;
+  // Round-robin: Track if dequeue is registered for this connection
+  bool is_registered_ = false;
+  // Credits: Track the number of packets which have been sent to the controller
+  uint16_t number_of_sent_packets_ = 0;
+  void call_disconnect_callback() {
+    disconnect_handler_->Post(BindOnce(std::move(on_disconnect_callback_), disconnect_reason_));
+  }
+};
+
+struct AclManager::impl {
+  impl(AclManager& acl_manager) : acl_manager_(acl_manager) {}
+
+  void Start() {
+    hci_layer_ = acl_manager_.GetDependency<HciLayer>();
+    handler_ = acl_manager_.GetHandler();
+    controller_ = acl_manager_.GetDependency<Controller>();
+    max_acl_packet_credits_ = controller_->GetControllerNumAclPacketBuffers();
+    acl_packet_credits_ = max_acl_packet_credits_;
+    acl_buffer_length_ = controller_->GetControllerAclPacketLength();
+    controller_->RegisterCompletedAclPacketsCallback(
+        common::Bind(&impl::incoming_acl_credits, common::Unretained(this)), handler_);
+
+    // TODO: determine when we should reject connection
+    should_accept_connection_ = common::Bind([](Address, ClassOfDevice) { return true; });
+    hci_queue_end_ = hci_layer_->GetAclQueueEnd();
+    hci_queue_end_->RegisterDequeue(
+        handler_, common::Bind(&impl::dequeue_and_route_acl_packet_to_connection, common::Unretained(this)));
+    hci_layer_->RegisterEventHandler(EventCode::CONNECTION_COMPLETE,
+                                     Bind(&impl::on_connection_complete, common::Unretained(this)), handler_);
+    hci_layer_->RegisterEventHandler(EventCode::DISCONNECTION_COMPLETE,
+                                     Bind(&impl::on_disconnection_complete, common::Unretained(this)), handler_);
+    hci_layer_->RegisterEventHandler(EventCode::CONNECTION_REQUEST,
+                                     Bind(&impl::on_incoming_connection, common::Unretained(this)), handler_);
+    hci_layer_->RegisterLeEventHandler(SubeventCode::CONNECTION_COMPLETE,
+                                       Bind(&impl::on_le_connection_complete, common::Unretained(this)), handler_);
+    hci_layer_->RegisterLeEventHandler(SubeventCode::ENHANCED_CONNECTION_COMPLETE,
+                                       Bind(&impl::on_le_enhanced_connection_complete, common::Unretained(this)),
+                                       handler_);
+    hci_layer_->RegisterEventHandler(EventCode::CONNECTION_PACKET_TYPE_CHANGED,
+                                     Bind(&impl::on_connection_packet_type_changed, common::Unretained(this)),
+                                     handler_);
+    hci_layer_->RegisterEventHandler(EventCode::AUTHENTICATION_COMPLETE,
+                                     Bind(&impl::on_authentication_complete, common::Unretained(this)), handler_);
+    hci_layer_->RegisterEventHandler(EventCode::READ_CLOCK_OFFSET_COMPLETE,
+                                     Bind(&impl::on_read_clock_offset_complete, common::Unretained(this)), handler_);
+    hci_layer_->RegisterEventHandler(EventCode::MODE_CHANGE, Bind(&impl::on_mode_change, common::Unretained(this)),
+                                     handler_);
+    hci_layer_->RegisterEventHandler(EventCode::QOS_SETUP_COMPLETE,
+                                     Bind(&impl::on_qos_setup_complete, common::Unretained(this)), handler_);
+    hci_layer_->RegisterEventHandler(EventCode::ROLE_CHANGE, Bind(&impl::on_role_change, common::Unretained(this)),
+                                     handler_);
+    hci_layer_->RegisterEventHandler(EventCode::FLOW_SPECIFICATION_COMPLETE,
+                                     Bind(&impl::on_flow_specification_complete, common::Unretained(this)), handler_);
+    hci_layer_->RegisterEventHandler(EventCode::FLUSH_OCCURRED,
+                                     Bind(&impl::on_flush_occurred, common::Unretained(this)), handler_);
+    hci_mtu_ = controller_->GetControllerAclPacketLength();
+  }
+
+  void Stop() {
+    hci_layer_->UnregisterEventHandler(EventCode::DISCONNECTION_COMPLETE);
+    hci_layer_->UnregisterEventHandler(EventCode::CONNECTION_COMPLETE);
+    hci_layer_->UnregisterEventHandler(EventCode::CONNECTION_REQUEST);
+    hci_layer_->UnregisterEventHandler(EventCode::AUTHENTICATION_COMPLETE);
+    hci_queue_end_->UnregisterDequeue();
+    unregister_all_connections();
+    acl_connections_.clear();
+    hci_queue_end_ = nullptr;
+    handler_ = nullptr;
+    hci_layer_ = nullptr;
+  }
+
+  void incoming_acl_credits(uint16_t handle, uint16_t credits) {
+    auto connection_pair = acl_connections_.find(handle);
+    if (connection_pair == acl_connections_.end()) {
+      LOG_INFO("Dropping %hx received credits to unknown connection 0x%0hx", credits, handle);
+      return;
+    }
+    if (connection_pair->second.is_disconnected_) {
+      LOG_INFO("Dropping %hx received credits to disconnected connection 0x%0hx", credits, handle);
+      return;
+    }
+    connection_pair->second.number_of_sent_packets_ -= credits;
+    acl_packet_credits_ += credits;
+    ASSERT(acl_packet_credits_ <= max_acl_packet_credits_);
+    start_round_robin();
+  }
+
+  // Round-robin scheduler
+  void start_round_robin() {
+    if (acl_packet_credits_ == 0) {
+      return;
+    }
+    if (!fragments_to_send_.empty()) {
+      send_next_fragment();
+      return;
+    }
+    for (auto connection_pair = acl_connections_.begin(); connection_pair != acl_connections_.end();
+         connection_pair = std::next(connection_pair)) {
+      if (connection_pair->second.is_registered_) {
+        continue;
+      }
+      connection_pair->second.is_registered_ = true;
+      connection_pair->second.queue_->GetDownEnd()->RegisterDequeue(
+          handler_, common::Bind(&impl::handle_dequeue_from_upper, common::Unretained(this), connection_pair));
+    }
+  }
+
+  void handle_dequeue_from_upper(std::map<uint16_t, acl_connection>::iterator connection_pair) {
+    current_connection_pair_ = connection_pair;
+    buffer_packet();
+  }
+
+  void unregister_all_connections() {
+    for (auto connection_pair = acl_connections_.begin(); connection_pair != acl_connections_.end();
+         connection_pair = std::next(connection_pair)) {
+      if (connection_pair->second.is_registered_) {
+        connection_pair->second.is_registered_ = false;
+        connection_pair->second.queue_->GetDownEnd()->UnregisterDequeue();
+      }
+    }
+  }
+
+  void buffer_packet() {
+    unregister_all_connections();
+    BroadcastFlag broadcast_flag = BroadcastFlag::POINT_TO_POINT;
+    //   Wrap packet and enqueue it
+    uint16_t handle = current_connection_pair_->first;
+
+    auto packet = current_connection_pair_->second.queue_->GetDownEnd()->TryDequeue();
+    ASSERT(packet != nullptr);
+
+    if (packet->size() <= hci_mtu_) {
+      fragments_to_send_.push_front(AclPacketBuilder::Create(handle, PacketBoundaryFlag::FIRST_AUTOMATICALLY_FLUSHABLE,
+                                                             broadcast_flag, std::move(packet)));
+    } else {
+      auto fragments = AclFragmenter(hci_mtu_, std::move(packet)).GetFragments();
+      PacketBoundaryFlag packet_boundary_flag = PacketBoundaryFlag::FIRST_AUTOMATICALLY_FLUSHABLE;
+      for (size_t i = 0; i < fragments.size(); i++) {
+        fragments_to_send_.push_back(
+            AclPacketBuilder::Create(handle, packet_boundary_flag, broadcast_flag, std::move(fragments[i])));
+        packet_boundary_flag = PacketBoundaryFlag::CONTINUING_FRAGMENT;
+      }
+    }
+    ASSERT(fragments_to_send_.size() > 0);
+
+    current_connection_pair_->second.number_of_sent_packets_ += fragments_to_send_.size();
+    send_next_fragment();
+  }
+
+  void send_next_fragment() {
+    hci_queue_end_->RegisterEnqueue(handler_,
+                                    common::Bind(&impl::handle_enqueue_next_fragment, common::Unretained(this)));
+  }
+
+  std::unique_ptr<AclPacketBuilder> handle_enqueue_next_fragment() {
+    ASSERT(acl_packet_credits_ > 0);
+    if (acl_packet_credits_ == 1 || fragments_to_send_.size() == 1) {
+      hci_queue_end_->UnregisterEnqueue();
+      if (fragments_to_send_.size() == 1) {
+        handler_->Post(common::BindOnce(&impl::start_round_robin, common::Unretained(this)));
+      }
+    }
+    ASSERT(fragments_to_send_.size() > 0);
+    auto raw_pointer = fragments_to_send_.front().release();
+    acl_packet_credits_ -= 1;
+    fragments_to_send_.pop_front();
+    return std::unique_ptr<AclPacketBuilder>(raw_pointer);
+  }
+
+  void dequeue_and_route_acl_packet_to_connection() {
+    auto packet = hci_queue_end_->TryDequeue();
+    ASSERT(packet != nullptr);
+    if (!packet->IsValid()) {
+      LOG_INFO("Dropping invalid packet of size %zu", packet->size());
+      return;
+    }
+    uint16_t handle = packet->GetHandle();
+    if (handle == kQualcommDebugHandle) {
+      return;
+    }
+    auto connection_pair = acl_connections_.find(handle);
+    if (connection_pair == acl_connections_.end()) {
+      LOG_INFO("Dropping packet of size %zu to unknown connection 0x%0hx", packet->size(), handle);
+      return;
+    }
+    // TODO: What happens if the connection is stalled and fills up?
+    // TODO hsz: define enqueue callback
+    auto queue_end = connection_pair->second.queue_->GetDownEnd();
+    PacketView<kLittleEndian> payload = packet->GetPayload();
+    queue_end->RegisterEnqueue(handler_, common::Bind(
+                                             [](decltype(queue_end) queue_end, PacketView<kLittleEndian> payload) {
+                                               queue_end->UnregisterEnqueue();
+                                               return std::make_unique<PacketView<kLittleEndian>>(payload);
+                                             },
+                                             queue_end, std::move(payload)));
+  }
+
+  void on_incoming_connection(EventPacketView packet) {
+    ConnectionRequestView request = ConnectionRequestView::Create(packet);
+    ASSERT(request.IsValid());
+    Address address = request.GetBdAddr();
+    if (client_callbacks_ == nullptr) {
+      LOG_ERROR("No callbacks to call");
+      auto reason = RejectConnectionReason::LIMITED_RESOURCES;
+      this->reject_connection(RejectConnectionRequestBuilder::Create(address, reason));
+      return;
+    }
+    connecting_.insert(address);
+    if (is_classic_link_already_connected(address)) {
+      auto reason = RejectConnectionReason::UNACCEPTABLE_BD_ADDR;
+      this->reject_connection(RejectConnectionRequestBuilder::Create(address, reason));
+    } else if (should_accept_connection_.Run(address, request.GetClassOfDevice())) {
+      this->accept_connection(address);
+    } else {
+      auto reason = RejectConnectionReason::LIMITED_RESOURCES;  // TODO: determine reason
+      this->reject_connection(RejectConnectionRequestBuilder::Create(address, reason));
+    }
+  }
+
+  void on_classic_connection_complete(Address address) {
+    auto connecting_addr = connecting_.find(address);
+    if (connecting_addr == connecting_.end()) {
+      LOG_WARN("No prior connection request for %s", address.ToString().c_str());
+    } else {
+      connecting_.erase(connecting_addr);
+    }
+  }
+
+  void on_common_le_connection_complete(AddressWithType address_with_type) {
+    auto connecting_addr_with_type = connecting_le_.find(address_with_type);
+    if (connecting_addr_with_type == connecting_le_.end()) {
+      LOG_WARN("No prior connection request for %s", address_with_type.ToString().c_str());
+    } else {
+      connecting_le_.erase(connecting_addr_with_type);
+    }
+  }
+
+  void on_le_connection_complete(LeMetaEventView packet) {
+    LeConnectionCompleteView connection_complete = LeConnectionCompleteView::Create(packet);
+    ASSERT(connection_complete.IsValid());
+    auto status = connection_complete.GetStatus();
+    auto address = connection_complete.GetPeerAddress();
+    auto peer_address_type = connection_complete.GetPeerAddressType();
+    // TODO: find out which address and type was used to initiate the connection
+    AddressWithType address_with_type(address, peer_address_type);
+    on_common_le_connection_complete(address_with_type);
+    if (status != ErrorCode::SUCCESS) {
+      le_client_handler_->Post(common::BindOnce(&LeConnectionCallbacks::OnLeConnectFail,
+                                                common::Unretained(le_client_callbacks_), address_with_type, status));
+      return;
+    }
+    // TODO: Check and save other connection parameters
+    uint16_t handle = connection_complete.GetConnectionHandle();
+    ASSERT(acl_connections_.count(handle) == 0);
+    acl_connections_.emplace(handle, address_with_type);
+    if (acl_connections_.size() == 1 && fragments_to_send_.size() == 0) {
+      start_round_robin();
+    }
+    auto role = connection_complete.GetRole();
+    std::unique_ptr<AclConnection> connection_proxy(
+        new AclConnection(&acl_manager_, handle, address, peer_address_type, role));
+    le_client_handler_->Post(common::BindOnce(&LeConnectionCallbacks::OnLeConnectSuccess,
+                                              common::Unretained(le_client_callbacks_), address_with_type,
+                                              std::move(connection_proxy)));
+  }
+
+  void on_le_enhanced_connection_complete(LeMetaEventView packet) {
+    LeEnhancedConnectionCompleteView connection_complete = LeEnhancedConnectionCompleteView::Create(packet);
+    ASSERT(connection_complete.IsValid());
+    auto status = connection_complete.GetStatus();
+    auto address = connection_complete.GetPeerAddress();
+    auto peer_address_type = connection_complete.GetPeerAddressType();
+    auto peer_resolvable_address = connection_complete.GetPeerResolvablePrivateAddress();
+    AddressWithType reporting_address_with_type(address, peer_address_type);
+    if (!peer_resolvable_address.IsEmpty()) {
+      reporting_address_with_type = AddressWithType(peer_resolvable_address, AddressType::RANDOM_DEVICE_ADDRESS);
+    }
+    on_common_le_connection_complete(reporting_address_with_type);
+    if (status != ErrorCode::SUCCESS) {
+      le_client_handler_->Post(common::BindOnce(&LeConnectionCallbacks::OnLeConnectFail,
+                                                common::Unretained(le_client_callbacks_), reporting_address_with_type,
+                                                status));
+      return;
+    }
+    // TODO: Check and save other connection parameters
+    uint16_t handle = connection_complete.GetConnectionHandle();
+    ASSERT(acl_connections_.count(handle) == 0);
+    acl_connections_.emplace(handle, reporting_address_with_type);
+    if (acl_connections_.size() == 1 && fragments_to_send_.size() == 0) {
+      start_round_robin();
+    }
+    auto role = connection_complete.GetRole();
+    std::unique_ptr<AclConnection> connection_proxy(
+        new AclConnection(&acl_manager_, handle, address, peer_address_type, role));
+    le_client_handler_->Post(common::BindOnce(&LeConnectionCallbacks::OnLeConnectSuccess,
+                                              common::Unretained(le_client_callbacks_), reporting_address_with_type,
+                                              std::move(connection_proxy)));
+  }
+
+  void on_connection_complete(EventPacketView packet) {
+    ConnectionCompleteView connection_complete = ConnectionCompleteView::Create(packet);
+    ASSERT(connection_complete.IsValid());
+    auto status = connection_complete.GetStatus();
+    auto address = connection_complete.GetBdAddr();
+    on_classic_connection_complete(address);
+    if (status != ErrorCode::SUCCESS) {
+      client_handler_->Post(common::BindOnce(&ConnectionCallbacks::OnConnectFail, common::Unretained(client_callbacks_),
+                                             address, status));
+      return;
+    }
+    uint16_t handle = connection_complete.GetConnectionHandle();
+    ASSERT(acl_connections_.count(handle) == 0);
+    acl_connections_.emplace(handle, AddressWithType{address, AddressType::PUBLIC_DEVICE_ADDRESS});
+    if (acl_connections_.size() == 1 && fragments_to_send_.size() == 0) {
+      start_round_robin();
+    }
+    std::unique_ptr<AclConnection> connection_proxy(new AclConnection(&acl_manager_, handle, address));
+    client_handler_->Post(common::BindOnce(&ConnectionCallbacks::OnConnectSuccess,
+                                           common::Unretained(client_callbacks_), std::move(connection_proxy)));
+    while (!pending_outgoing_connections_.empty()) {
+      auto create_connection_packet_and_address = std::move(pending_outgoing_connections_.front());
+      pending_outgoing_connections_.pop();
+      if (!is_classic_link_already_connected(create_connection_packet_and_address.first)) {
+        connecting_.insert(create_connection_packet_and_address.first);
+        hci_layer_->EnqueueCommand(std::move(create_connection_packet_and_address.second),
+                                   common::BindOnce([](CommandStatusView status) {
+                                     ASSERT(status.IsValid());
+                                     ASSERT(status.GetCommandOpCode() == OpCode::CREATE_CONNECTION);
+                                   }),
+                                   handler_);
+        break;
+      }
+    }
+  }
+
+  void on_disconnection_complete(EventPacketView packet) {
+    DisconnectionCompleteView disconnection_complete = DisconnectionCompleteView::Create(packet);
+    ASSERT(disconnection_complete.IsValid());
+    uint16_t handle = disconnection_complete.GetConnectionHandle();
+    auto status = disconnection_complete.GetStatus();
+    if (status == ErrorCode::SUCCESS) {
+      ASSERT(acl_connections_.count(handle) == 1);
+      auto& acl_connection = acl_connections_.find(handle)->second;
+      acl_connection.is_disconnected_ = true;
+      acl_connection.disconnect_reason_ = disconnection_complete.GetReason();
+      acl_connection.call_disconnect_callback();
+      // Reclaim outstanding packets
+      acl_packet_credits_ += acl_connection.number_of_sent_packets_;
+      acl_connection.number_of_sent_packets_ = 0;
+    } else {
+      std::string error_code = ErrorCodeText(status);
+      LOG_ERROR("Received disconnection complete with error code %s, handle 0x%02hx", error_code.c_str(), handle);
+    }
+  }
+
+  void on_connection_packet_type_changed(EventPacketView packet) {
+    ConnectionPacketTypeChangedView packet_type_changed = ConnectionPacketTypeChangedView::Create(packet);
+    if (!packet_type_changed.IsValid()) {
+      LOG_ERROR("Received on_connection_packet_type_changed with invalid packet");
+      return;
+    } else if (packet_type_changed.GetStatus() != ErrorCode::SUCCESS) {
+      auto status = packet_type_changed.GetStatus();
+      std::string error_code = ErrorCodeText(status);
+      LOG_ERROR("Received on_connection_packet_type_changed with error code %s", error_code.c_str());
+      return;
+    }
+    uint16_t handle = packet_type_changed.GetConnectionHandle();
+    auto& acl_connection = acl_connections_.find(handle)->second;
+    if (acl_connection.command_complete_handler_ != nullptr) {
+      uint16_t packet_type = packet_type_changed.GetPacketType();
+      acl_connection.command_complete_handler_->Post(
+          common::BindOnce(&ConnectionManagementCallbacks::OnConnectionPacketTypeChanged,
+                           common::Unretained(acl_connection.command_complete_callbacks_), packet_type));
+    }
+  }
+
+  void on_master_link_key_complete(EventPacketView packet) {
+    MasterLinkKeyCompleteView complete_view = MasterLinkKeyCompleteView::Create(packet);
+    if (!complete_view.IsValid()) {
+      LOG_ERROR("Received on_master_link_key_complete with invalid packet");
+      return;
+    } else if (complete_view.GetStatus() != ErrorCode::SUCCESS) {
+      auto status = complete_view.GetStatus();
+      std::string error_code = ErrorCodeText(status);
+      LOG_ERROR("Received on_master_link_key_complete with error code %s", error_code.c_str());
+      return;
+    }
+    if (acl_manager_client_callbacks_ != nullptr) {
+      uint16_t connection_handle = complete_view.GetConnectionHandle();
+      KeyFlag key_flag = complete_view.GetKeyFlag();
+      acl_manager_client_handler_->Post(common::BindOnce(&AclManagerCallbacks::OnMasterLinkKeyComplete,
+                                                         common::Unretained(acl_manager_client_callbacks_),
+                                                         connection_handle, key_flag));
+    }
+  }
+
+  void on_authentication_complete(EventPacketView packet) {
+    AuthenticationCompleteView authentication_complete = AuthenticationCompleteView::Create(packet);
+    if (!authentication_complete.IsValid()) {
+      LOG_ERROR("Received on_authentication_complete with invalid packet");
+      return;
+    } else if (authentication_complete.GetStatus() != ErrorCode::SUCCESS) {
+      auto status = authentication_complete.GetStatus();
+      std::string error_code = ErrorCodeText(status);
+      LOG_ERROR("Received on_authentication_complete with error code %s", error_code.c_str());
+      return;
+    }
+    uint16_t handle = authentication_complete.GetConnectionHandle();
+    auto& acl_connection = acl_connections_.find(handle)->second;
+    if (acl_connection.command_complete_handler_ != nullptr) {
+      acl_connection.command_complete_handler_->Post(
+          common::BindOnce(&ConnectionManagementCallbacks::OnAuthenticationComplete,
+                           common::Unretained(acl_connection.command_complete_callbacks_)));
+    }
+  }
+
+  void on_encryption_change(EventPacketView packet) {
+    EncryptionChangeView encryption_change_view = EncryptionChangeView::Create(packet);
+    if (!encryption_change_view.IsValid()) {
+      LOG_ERROR("Received on_encryption_change with invalid packet");
+      return;
+    } else if (encryption_change_view.GetStatus() != ErrorCode::SUCCESS) {
+      auto status = encryption_change_view.GetStatus();
+      std::string error_code = ErrorCodeText(status);
+      LOG_ERROR("Received on_change_connection_link_key_complete with error code %s", error_code.c_str());
+      return;
+    }
+    uint16_t handle = encryption_change_view.GetConnectionHandle();
+    auto& acl_connection = acl_connections_.find(handle)->second;
+    if (acl_connection.command_complete_handler_ != nullptr) {
+      EncryptionEnabled enabled = encryption_change_view.GetEncryptionEnabled();
+      acl_connection.command_complete_handler_->Post(
+          common::BindOnce(&ConnectionManagementCallbacks::OnEncryptionChange,
+                           common::Unretained(acl_connection.command_complete_callbacks_), enabled));
+    }
+  }
+
+  void on_change_connection_link_key_complete(EventPacketView packet) {
+    ChangeConnectionLinkKeyCompleteView complete_view = ChangeConnectionLinkKeyCompleteView::Create(packet);
+    if (!complete_view.IsValid()) {
+      LOG_ERROR("Received on_change_connection_link_key_complete with invalid packet");
+      return;
+    } else if (complete_view.GetStatus() != ErrorCode::SUCCESS) {
+      auto status = complete_view.GetStatus();
+      std::string error_code = ErrorCodeText(status);
+      LOG_ERROR("Received on_change_connection_link_key_complete with error code %s", error_code.c_str());
+      return;
+    }
+    uint16_t handle = complete_view.GetConnectionHandle();
+    auto& acl_connection = acl_connections_.find(handle)->second;
+    if (acl_connection.command_complete_handler_ != nullptr) {
+      acl_connection.command_complete_handler_->Post(
+          common::BindOnce(&ConnectionManagementCallbacks::OnChangeConnectionLinkKeyComplete,
+                           common::Unretained(acl_connection.command_complete_callbacks_)));
+    }
+  }
+
+  void on_read_clock_offset_complete(EventPacketView packet) {
+    ReadClockOffsetCompleteView complete_view = ReadClockOffsetCompleteView::Create(packet);
+    if (!complete_view.IsValid()) {
+      LOG_ERROR("Received on_read_clock_offset_complete with invalid packet");
+      return;
+    } else if (complete_view.GetStatus() != ErrorCode::SUCCESS) {
+      auto status = complete_view.GetStatus();
+      std::string error_code = ErrorCodeText(status);
+      LOG_ERROR("Received on_read_clock_offset_complete with error code %s", error_code.c_str());
+      return;
+    }
+    uint16_t handle = complete_view.GetConnectionHandle();
+    auto& acl_connection = acl_connections_.find(handle)->second;
+    if (acl_connection.command_complete_handler_ != nullptr) {
+      uint16_t clock_offset = complete_view.GetClockOffset();
+      acl_connection.command_complete_handler_->Post(
+          common::BindOnce(&ConnectionManagementCallbacks::OnReadClockOffsetComplete,
+                           common::Unretained(acl_connection.command_complete_callbacks_), clock_offset));
+    }
+  }
+
+  void on_mode_change(EventPacketView packet) {
+    ModeChangeView mode_change_view = ModeChangeView::Create(packet);
+    if (!mode_change_view.IsValid()) {
+      LOG_ERROR("Received on_mode_change with invalid packet");
+      return;
+    } else if (mode_change_view.GetStatus() != ErrorCode::SUCCESS) {
+      auto status = mode_change_view.GetStatus();
+      std::string error_code = ErrorCodeText(status);
+      LOG_ERROR("Received on_mode_change with error code %s", error_code.c_str());
+      return;
+    }
+    uint16_t handle = mode_change_view.GetConnectionHandle();
+    auto& acl_connection = acl_connections_.find(handle)->second;
+    if (acl_connection.command_complete_handler_ != nullptr) {
+      Mode current_mode = mode_change_view.GetCurrentMode();
+      uint16_t interval = mode_change_view.GetInterval();
+      acl_connection.command_complete_handler_->Post(
+          common::BindOnce(&ConnectionManagementCallbacks::OnModeChange,
+                           common::Unretained(acl_connection.command_complete_callbacks_), current_mode, interval));
+    }
+  }
+
+  void on_qos_setup_complete(EventPacketView packet) {
+    QosSetupCompleteView complete_view = QosSetupCompleteView::Create(packet);
+    if (!complete_view.IsValid()) {
+      LOG_ERROR("Received on_qos_setup_complete with invalid packet");
+      return;
+    } else if (complete_view.GetStatus() != ErrorCode::SUCCESS) {
+      auto status = complete_view.GetStatus();
+      std::string error_code = ErrorCodeText(status);
+      LOG_ERROR("Received on_qos_setup_complete with error code %s", error_code.c_str());
+      return;
+    }
+    uint16_t handle = complete_view.GetConnectionHandle();
+    auto& acl_connection = acl_connections_.find(handle)->second;
+    if (acl_connection.command_complete_handler_ != nullptr) {
+      ServiceType service_type = complete_view.GetServiceType();
+      uint32_t token_rate = complete_view.GetTokenRate();
+      uint32_t peak_bandwidth = complete_view.GetPeakBandwidth();
+      uint32_t latency = complete_view.GetLatency();
+      uint32_t delay_variation = complete_view.GetDelayVariation();
+      acl_connection.command_complete_handler_->Post(
+          common::BindOnce(&ConnectionManagementCallbacks::OnQosSetupComplete,
+                           common::Unretained(acl_connection.command_complete_callbacks_), service_type, token_rate,
+                           peak_bandwidth, latency, delay_variation));
+    }
+  }
+
+  void on_role_change(EventPacketView packet) {
+    RoleChangeView role_change_view = RoleChangeView::Create(packet);
+    if (!role_change_view.IsValid()) {
+      LOG_ERROR("Received on_role_change with invalid packet");
+      return;
+    } else if (role_change_view.GetStatus() != ErrorCode::SUCCESS) {
+      auto status = role_change_view.GetStatus();
+      std::string error_code = ErrorCodeText(status);
+      LOG_ERROR("Received on_role_change with error code %s", error_code.c_str());
+      return;
+    }
+    if (acl_manager_client_callbacks_ != nullptr) {
+      Address bd_addr = role_change_view.GetBdAddr();
+      Role new_role = role_change_view.GetNewRole();
+      acl_manager_client_handler_->Post(common::BindOnce(
+          &AclManagerCallbacks::OnRoleChange, common::Unretained(acl_manager_client_callbacks_), bd_addr, new_role));
+    }
+  }
+
+  void on_flow_specification_complete(EventPacketView packet) {
+    FlowSpecificationCompleteView complete_view = FlowSpecificationCompleteView::Create(packet);
+    if (!complete_view.IsValid()) {
+      LOG_ERROR("Received on_flow_specification_complete with invalid packet");
+      return;
+    } else if (complete_view.GetStatus() != ErrorCode::SUCCESS) {
+      auto status = complete_view.GetStatus();
+      std::string error_code = ErrorCodeText(status);
+      LOG_ERROR("Received on_flow_specification_complete with error code %s", error_code.c_str());
+      return;
+    }
+    uint16_t handle = complete_view.GetConnectionHandle();
+    auto& acl_connection = acl_connections_.find(handle)->second;
+    if (acl_connection.command_complete_handler_ != nullptr) {
+      FlowDirection flow_direction = complete_view.GetFlowDirection();
+      ServiceType service_type = complete_view.GetServiceType();
+      uint32_t token_rate = complete_view.GetTokenRate();
+      uint32_t token_bucket_size = complete_view.GetTokenBucketSize();
+      uint32_t peak_bandwidth = complete_view.GetPeakBandwidth();
+      uint32_t access_latency = complete_view.GetAccessLatency();
+      acl_connection.command_complete_handler_->Post(
+          common::BindOnce(&ConnectionManagementCallbacks::OnFlowSpecificationComplete,
+                           common::Unretained(acl_connection.command_complete_callbacks_), flow_direction, service_type,
+                           token_rate, token_bucket_size, peak_bandwidth, access_latency));
+    }
+  }
+
+  void on_flush_occurred(EventPacketView packet) {
+    FlushOccurredView flush_occurred_view = FlushOccurredView::Create(packet);
+    if (!flush_occurred_view.IsValid()) {
+      LOG_ERROR("Received on_flush_occurred with invalid packet");
+      return;
+    }
+    uint16_t handle = flush_occurred_view.GetConnectionHandle();
+    auto& acl_connection = acl_connections_.find(handle)->second;
+    if (acl_connection.command_complete_handler_ != nullptr) {
+      acl_connection.command_complete_handler_->Post(
+          common::BindOnce(&ConnectionManagementCallbacks::OnFlushOccurred,
+                           common::Unretained(acl_connection.command_complete_callbacks_)));
+    }
+  }
+
+  void on_role_discovery_complete(CommandCompleteView view) {
+    auto complete_view = RoleDiscoveryCompleteView::Create(view);
+    if (!complete_view.IsValid()) {
+      LOG_ERROR("Received on_role_discovery_complete with invalid packet");
+      return;
+    } else if (complete_view.GetStatus() != ErrorCode::SUCCESS) {
+      auto status = complete_view.GetStatus();
+      std::string error_code = ErrorCodeText(status);
+      LOG_ERROR("Received on_role_discovery_complete with error code %s", error_code.c_str());
+      return;
+    }
+    uint16_t handle = complete_view.GetConnectionHandle();
+    auto& acl_connection = acl_connections_.find(handle)->second;
+    if (acl_connection.command_complete_handler_ != nullptr) {
+      Role role = complete_view.GetCurrentRole();
+      acl_connection.command_complete_handler_->Post(
+          common::BindOnce(&ConnectionManagementCallbacks::OnRoleDiscoveryComplete,
+                           common::Unretained(acl_connection.command_complete_callbacks_), role));
+    }
+  }
+
+  void on_read_link_policy_settings_complete(CommandCompleteView view) {
+    auto complete_view = ReadLinkPolicySettingsCompleteView::Create(view);
+    if (!complete_view.IsValid()) {
+      LOG_ERROR("Received on_read_link_policy_settings_complete with invalid packet");
+      return;
+    } else if (complete_view.GetStatus() != ErrorCode::SUCCESS) {
+      auto status = complete_view.GetStatus();
+      std::string error_code = ErrorCodeText(status);
+      LOG_ERROR("Received on_read_link_policy_settings_complete with error code %s", error_code.c_str());
+      return;
+    }
+    uint16_t handle = complete_view.GetConnectionHandle();
+    auto& acl_connection = acl_connections_.find(handle)->second;
+    if (acl_connection.command_complete_handler_ != nullptr) {
+      uint16_t link_policy_settings = complete_view.GetLinkPolicySettings();
+      acl_connection.command_complete_handler_->Post(
+          common::BindOnce(&ConnectionManagementCallbacks::OnReadLinkPolicySettingsComplete,
+                           common::Unretained(acl_connection.command_complete_callbacks_), link_policy_settings));
+    }
+  }
+
+  void on_read_default_link_policy_settings_complete(CommandCompleteView view) {
+    auto complete_view = ReadDefaultLinkPolicySettingsCompleteView::Create(view);
+    if (!complete_view.IsValid()) {
+      LOG_ERROR("Received on_read_link_policy_settings_complete with invalid packet");
+      return;
+    } else if (complete_view.GetStatus() != ErrorCode::SUCCESS) {
+      auto status = complete_view.GetStatus();
+      std::string error_code = ErrorCodeText(status);
+      LOG_ERROR("Received on_read_link_policy_settings_complete with error code %s", error_code.c_str());
+      return;
+    }
+    if (acl_manager_client_callbacks_ != nullptr) {
+      uint16_t default_link_policy_settings = complete_view.GetDefaultLinkPolicySettings();
+      acl_manager_client_handler_->Post(common::BindOnce(&AclManagerCallbacks::OnReadDefaultLinkPolicySettingsComplete,
+                                                         common::Unretained(acl_manager_client_callbacks_),
+                                                         default_link_policy_settings));
+    }
+  }
+
+  void on_read_automatic_flush_timeout_complete(CommandCompleteView view) {
+    auto complete_view = ReadAutomaticFlushTimeoutCompleteView::Create(view);
+    if (!complete_view.IsValid()) {
+      LOG_ERROR("Received on_read_automatic_flush_timeout_complete with invalid packet");
+      return;
+    } else if (complete_view.GetStatus() != ErrorCode::SUCCESS) {
+      auto status = complete_view.GetStatus();
+      std::string error_code = ErrorCodeText(status);
+      LOG_ERROR("Received on_read_automatic_flush_timeout_complete with error code %s", error_code.c_str());
+      return;
+    }
+    uint16_t handle = complete_view.GetConnectionHandle();
+    auto& acl_connection = acl_connections_.find(handle)->second;
+    if (acl_connection.command_complete_handler_ != nullptr) {
+      uint16_t flush_timeout = complete_view.GetFlushTimeout();
+      acl_connection.command_complete_handler_->Post(
+          common::BindOnce(&ConnectionManagementCallbacks::OnReadAutomaticFlushTimeoutComplete,
+                           common::Unretained(acl_connection.command_complete_callbacks_), flush_timeout));
+    }
+  }
+
+  void on_read_transmit_power_level_complete(CommandCompleteView view) {
+    auto complete_view = ReadTransmitPowerLevelCompleteView::Create(view);
+    if (!complete_view.IsValid()) {
+      LOG_ERROR("Received on_read_transmit_power_level_complete with invalid packet");
+      return;
+    } else if (complete_view.GetStatus() != ErrorCode::SUCCESS) {
+      auto status = complete_view.GetStatus();
+      std::string error_code = ErrorCodeText(status);
+      LOG_ERROR("Received on_read_transmit_power_level_complete with error code %s", error_code.c_str());
+      return;
+    }
+    uint16_t handle = complete_view.GetConnectionHandle();
+    auto& acl_connection = acl_connections_.find(handle)->second;
+    if (acl_connection.command_complete_handler_ != nullptr) {
+      uint8_t transmit_power_level = complete_view.GetTransmitPowerLevel();
+      acl_connection.command_complete_handler_->Post(
+          common::BindOnce(&ConnectionManagementCallbacks::OnReadTransmitPowerLevelComplete,
+                           common::Unretained(acl_connection.command_complete_callbacks_), transmit_power_level));
+    }
+  }
+
+  void on_read_link_supervision_timeout_complete(CommandCompleteView view) {
+    auto complete_view = ReadLinkSupervisionTimeoutCompleteView::Create(view);
+    if (!complete_view.IsValid()) {
+      LOG_ERROR("Received on_read_link_supervision_timeout_complete with invalid packet");
+      return;
+    } else if (complete_view.GetStatus() != ErrorCode::SUCCESS) {
+      auto status = complete_view.GetStatus();
+      std::string error_code = ErrorCodeText(status);
+      LOG_ERROR("Received on_read_link_supervision_timeout_complete with error code %s", error_code.c_str());
+      return;
+    }
+    uint16_t handle = complete_view.GetConnectionHandle();
+    auto& acl_connection = acl_connections_.find(handle)->second;
+    if (acl_connection.command_complete_handler_ != nullptr) {
+      uint16_t link_supervision_timeout = complete_view.GetLinkSupervisionTimeout();
+      acl_connection.command_complete_handler_->Post(
+          common::BindOnce(&ConnectionManagementCallbacks::OnReadLinkSupervisionTimeoutComplete,
+                           common::Unretained(acl_connection.command_complete_callbacks_), link_supervision_timeout));
+    }
+  }
+
+  void on_read_failed_contact_counter_complete(CommandCompleteView view) {
+    auto complete_view = ReadFailedContactCounterCompleteView::Create(view);
+    if (!complete_view.IsValid()) {
+      LOG_ERROR("Received on_read_failed_contact_counter_complete with invalid packet");
+      return;
+    } else if (complete_view.GetStatus() != ErrorCode::SUCCESS) {
+      auto status = complete_view.GetStatus();
+      std::string error_code = ErrorCodeText(status);
+      LOG_ERROR("Received on_read_failed_contact_counter_complete with error code %s", error_code.c_str());
+      return;
+    }
+    uint16_t handle = complete_view.GetConnectionHandle();
+    auto& acl_connection = acl_connections_.find(handle)->second;
+    if (acl_connection.command_complete_handler_ != nullptr) {
+      uint16_t failed_contact_counter = complete_view.GetFailedContactCounter();
+      acl_connection.command_complete_handler_->Post(
+          common::BindOnce(&ConnectionManagementCallbacks::OnReadFailedContactCounterComplete,
+                           common::Unretained(acl_connection.command_complete_callbacks_), failed_contact_counter));
+    }
+  }
+
+  void on_read_link_quality_complete(CommandCompleteView view) {
+    auto complete_view = ReadLinkQualityCompleteView::Create(view);
+    if (!complete_view.IsValid()) {
+      LOG_ERROR("Received on_read_link_quality_complete with invalid packet");
+      return;
+    } else if (complete_view.GetStatus() != ErrorCode::SUCCESS) {
+      auto status = complete_view.GetStatus();
+      std::string error_code = ErrorCodeText(status);
+      LOG_ERROR("Received on_read_link_quality_complete with error code %s", error_code.c_str());
+      return;
+    }
+    uint16_t handle = complete_view.GetConnectionHandle();
+    auto& acl_connection = acl_connections_.find(handle)->second;
+    if (acl_connection.command_complete_handler_ != nullptr) {
+      uint8_t link_quality = complete_view.GetLinkQuality();
+      acl_connection.command_complete_handler_->Post(
+          common::BindOnce(&ConnectionManagementCallbacks::OnReadLinkQualityComplete,
+                           common::Unretained(acl_connection.command_complete_callbacks_), link_quality));
+    }
+  }
+
+  void on_read_afh_channel_map_complete(CommandCompleteView view) {
+    auto complete_view = ReadAfhChannelMapCompleteView::Create(view);
+    if (!complete_view.IsValid()) {
+      LOG_ERROR("Received on_read_afh_channel_map_complete with invalid packet");
+      return;
+    } else if (complete_view.GetStatus() != ErrorCode::SUCCESS) {
+      auto status = complete_view.GetStatus();
+      std::string error_code = ErrorCodeText(status);
+      LOG_ERROR("Received on_read_afh_channel_map_complete with error code %s", error_code.c_str());
+      return;
+    }
+    uint16_t handle = complete_view.GetConnectionHandle();
+    auto& acl_connection = acl_connections_.find(handle)->second;
+    if (acl_connection.command_complete_handler_ != nullptr) {
+      AfhMode afh_mode = complete_view.GetAfhMode();
+      std::array<uint8_t, 10> afh_channel_map = complete_view.GetAfhChannelMap();
+      acl_connection.command_complete_handler_->Post(
+          common::BindOnce(&ConnectionManagementCallbacks::OnReadAfhChannelMapComplete,
+                           common::Unretained(acl_connection.command_complete_callbacks_), afh_mode, afh_channel_map));
+    }
+  }
+
+  void on_read_rssi_complete(CommandCompleteView view) {
+    auto complete_view = ReadRssiCompleteView::Create(view);
+    if (!complete_view.IsValid()) {
+      LOG_ERROR("Received on_read_rssi_complete with invalid packet");
+      return;
+    } else if (complete_view.GetStatus() != ErrorCode::SUCCESS) {
+      auto status = complete_view.GetStatus();
+      std::string error_code = ErrorCodeText(status);
+      LOG_ERROR("Received on_read_rssi_complete with error code %s", error_code.c_str());
+      return;
+    }
+    uint16_t handle = complete_view.GetConnectionHandle();
+    auto& acl_connection = acl_connections_.find(handle)->second;
+    if (acl_connection.command_complete_handler_ != nullptr) {
+      uint8_t rssi = complete_view.GetRssi();
+      acl_connection.command_complete_handler_->Post(
+          common::BindOnce(&ConnectionManagementCallbacks::OnReadRssiComplete,
+                           common::Unretained(acl_connection.command_complete_callbacks_), rssi));
+    }
+  }
+
+  void on_read_clock_complete(CommandCompleteView view) {
+    auto complete_view = ReadClockCompleteView::Create(view);
+    if (!complete_view.IsValid()) {
+      LOG_ERROR("Received on_read_clock_complete with invalid packet");
+      return;
+    } else if (complete_view.GetStatus() != ErrorCode::SUCCESS) {
+      auto status = complete_view.GetStatus();
+      std::string error_code = ErrorCodeText(status);
+      LOG_ERROR("Received on_read_clock_complete with error code %s", error_code.c_str());
+      return;
+    }
+    uint16_t handle = complete_view.GetConnectionHandle();
+    auto& acl_connection = acl_connections_.find(handle)->second;
+    if (acl_connection.command_complete_handler_ != nullptr) {
+      uint32_t clock = complete_view.GetClock();
+      uint16_t accuracy = complete_view.GetAccuracy();
+      acl_connection.command_complete_handler_->Post(
+          common::BindOnce(&ConnectionManagementCallbacks::OnReadClockComplete,
+                           common::Unretained(acl_connection.command_complete_callbacks_), clock, accuracy));
+    }
+  }
+
+  bool is_classic_link_already_connected(Address address) {
+    for (const auto& connection : acl_connections_) {
+      if (connection.second.address_with_type_.GetAddress() == address) {
+        return true;
+      }
+    }
+    return false;
+  }
+
+  void create_connection(Address address) {
+    // TODO: Configure default connection parameters?
+    uint16_t packet_type = 0x4408 /* DM 1,3,5 */ | 0x8810 /*DH 1,3,5 */;
+    PageScanRepetitionMode page_scan_repetition_mode = PageScanRepetitionMode::R1;
+    uint16_t clock_offset = 0;
+    ClockOffsetValid clock_offset_valid = ClockOffsetValid::INVALID;
+    CreateConnectionRoleSwitch allow_role_switch = CreateConnectionRoleSwitch::ALLOW_ROLE_SWITCH;
+    ASSERT(client_callbacks_ != nullptr);
+    std::unique_ptr<CreateConnectionBuilder> packet = CreateConnectionBuilder::Create(
+        address, packet_type, page_scan_repetition_mode, clock_offset, clock_offset_valid, allow_role_switch);
+
+    if (connecting_.empty()) {
+      if (is_classic_link_already_connected(address)) {
+        LOG_WARN("already connected: %s", address.ToString().c_str());
+        return;
+      }
+      connecting_.insert(address);
+      hci_layer_->EnqueueCommand(std::move(packet), common::BindOnce([](CommandStatusView status) {
+                                   ASSERT(status.IsValid());
+                                   ASSERT(status.GetCommandOpCode() == OpCode::CREATE_CONNECTION);
+                                 }),
+                                 handler_);
+    } else {
+      pending_outgoing_connections_.emplace(address, std::move(packet));
+    }
+  }
+
+  void create_le_connection(AddressWithType address_with_type) {
+    // TODO: Add white list handling.
+    // TODO: Configure default LE connection parameters?
+    uint16_t le_scan_interval = 0x0020;
+    uint16_t le_scan_window = 0x0010;
+    InitiatorFilterPolicy initiator_filter_policy = InitiatorFilterPolicy::USE_PEER_ADDRESS;
+    OwnAddressType own_address_type = OwnAddressType::RANDOM_DEVICE_ADDRESS;
+    uint16_t conn_interval_min = 0x0006;
+    uint16_t conn_interval_max = 0x0C00;
+    uint16_t conn_latency = 0x0C0;
+    uint16_t supervision_timeout = 0x0C00;
+    uint16_t minimum_ce_length = 0x0002;
+    uint16_t maximum_ce_length = 0x0C00;
+    ASSERT(le_client_callbacks_ != nullptr);
+
+    connecting_le_.insert(address_with_type);
+
+    hci_layer_->EnqueueCommand(
+        LeCreateConnectionBuilder::Create(le_scan_interval, le_scan_window, initiator_filter_policy,
+                                          address_with_type.GetAddressType(), address_with_type.GetAddress(),
+                                          own_address_type, conn_interval_min, conn_interval_max, conn_latency,
+                                          supervision_timeout, minimum_ce_length, maximum_ce_length),
+        common::BindOnce([](CommandStatusView status) {
+          ASSERT(status.IsValid());
+          ASSERT(status.GetCommandOpCode() == OpCode::CREATE_CONNECTION);
+        }),
+        handler_);
+  }
+
+  void cancel_connect(Address address) {
+    auto connecting_addr = connecting_.find(address);
+    if (connecting_addr == connecting_.end()) {
+      LOG_INFO("Cannot cancel non-existent connection to %s", address.ToString().c_str());
+      return;
+    }
+    std::unique_ptr<CreateConnectionCancelBuilder> packet = CreateConnectionCancelBuilder::Create(address);
+    hci_layer_->EnqueueCommand(std::move(packet), common::BindOnce([](CommandCompleteView complete) { /* TODO */ }),
+                               handler_);
+  }
+
+  void master_link_key(KeyFlag key_flag) {
+    std::unique_ptr<MasterLinkKeyBuilder> packet = MasterLinkKeyBuilder::Create(key_flag);
+    hci_layer_->EnqueueCommand(
+        std::move(packet),
+        common::BindOnce(&impl::check_command_status<MasterLinkKeyStatusView>, common::Unretained(this)), handler_);
+  }
+
+  void switch_role(Address address, Role role) {
+    std::unique_ptr<SwitchRoleBuilder> packet = SwitchRoleBuilder::Create(address, role);
+    hci_layer_->EnqueueCommand(
+        std::move(packet),
+        common::BindOnce(&impl::check_command_status<SwitchRoleStatusView>, common::Unretained(this)), handler_);
+  }
+
+  void read_default_link_policy_settings() {
+    std::unique_ptr<ReadDefaultLinkPolicySettingsBuilder> packet = ReadDefaultLinkPolicySettingsBuilder::Create();
+    hci_layer_->EnqueueCommand(
+        std::move(packet),
+        common::BindOnce(&impl::on_read_default_link_policy_settings_complete, common::Unretained(this)), handler_);
+  }
+
+  void write_default_link_policy_settings(uint16_t default_link_policy_settings) {
+    std::unique_ptr<WriteDefaultLinkPolicySettingsBuilder> packet =
+        WriteDefaultLinkPolicySettingsBuilder::Create(default_link_policy_settings);
+    hci_layer_->EnqueueCommand(
+        std::move(packet),
+        BindOnce(&AclManager::impl::check_command_complete<WriteDefaultLinkPolicySettingsCompleteView>,
+                 common::Unretained(this)),
+        handler_);
+  }
+
+  void accept_connection(Address address) {
+    auto role = AcceptConnectionRequestRole::BECOME_MASTER;  // We prefer to be master
+    hci_layer_->EnqueueCommand(AcceptConnectionRequestBuilder::Create(address, role),
+                               common::BindOnce(&impl::on_accept_connection_status, common::Unretained(this), address),
+                               handler_);
+  }
+
+  void handle_disconnect(uint16_t handle, DisconnectReason reason) {
+    ASSERT(acl_connections_.count(handle) == 1);
+    std::unique_ptr<DisconnectBuilder> packet = DisconnectBuilder::Create(handle, reason);
+    hci_layer_->EnqueueCommand(std::move(packet), BindOnce([](CommandStatusView status) { /* TODO: check? */ }),
+                               handler_);
+  }
+
+  void handle_change_connection_packet_type(uint16_t handle, uint16_t packet_type) {
+    ASSERT(acl_connections_.count(handle) == 1);
+    std::unique_ptr<ChangeConnectionPacketTypeBuilder> packet =
+        ChangeConnectionPacketTypeBuilder::Create(handle, packet_type);
+    hci_layer_->EnqueueCommand(std::move(packet),
+                               BindOnce(&AclManager::impl::check_command_status<ChangeConnectionPacketTypeStatusView>,
+                                        common::Unretained(this)),
+                               handler_);
+  }
+
+  void handle_authentication_requested(uint16_t handle) {
+    std::unique_ptr<AuthenticationRequestedBuilder> packet = AuthenticationRequestedBuilder::Create(handle);
+    hci_layer_->EnqueueCommand(
+        std::move(packet),
+        BindOnce(&AclManager::impl::check_command_status<AuthenticationRequestedStatusView>, common::Unretained(this)),
+        handler_);
+  }
+
+  void handle_set_connection_encryption(uint16_t handle, Enable enable) {
+    std::unique_ptr<SetConnectionEncryptionBuilder> packet = SetConnectionEncryptionBuilder::Create(handle, enable);
+    hci_layer_->EnqueueCommand(
+        std::move(packet),
+        BindOnce(&AclManager::impl::check_command_status<SetConnectionEncryptionStatusView>, common::Unretained(this)),
+        handler_);
+  }
+
+  void handle_change_connection_link_key(uint16_t handle) {
+    std::unique_ptr<ChangeConnectionLinkKeyBuilder> packet = ChangeConnectionLinkKeyBuilder::Create(handle);
+    hci_layer_->EnqueueCommand(
+        std::move(packet),
+        BindOnce(&AclManager::impl::check_command_status<ChangeConnectionLinkKeyStatusView>, common::Unretained(this)),
+        handler_);
+  }
+
+  void handle_read_clock_offset(uint16_t handle) {
+    std::unique_ptr<ReadClockOffsetBuilder> packet = ReadClockOffsetBuilder::Create(handle);
+    hci_layer_->EnqueueCommand(
+        std::move(packet),
+        BindOnce(&AclManager::impl::check_command_status<ReadClockOffsetStatusView>, common::Unretained(this)),
+        handler_);
+  }
+
+  void handle_hold_mode(uint16_t handle, uint16_t max_interval, uint16_t min_interval) {
+    std::unique_ptr<HoldModeBuilder> packet = HoldModeBuilder::Create(handle, max_interval, min_interval);
+    hci_layer_->EnqueueCommand(
+        std::move(packet),
+        BindOnce(&AclManager::impl::check_command_status<HoldModeStatusView>, common::Unretained(this)), handler_);
+  }
+
+  void handle_sniff_mode(uint16_t handle, uint16_t max_interval, uint16_t min_interval, int16_t attempt,
+                         uint16_t timeout) {
+    std::unique_ptr<SniffModeBuilder> packet =
+        SniffModeBuilder::Create(handle, max_interval, min_interval, attempt, timeout);
+    hci_layer_->EnqueueCommand(
+        std::move(packet),
+        BindOnce(&AclManager::impl::check_command_status<SniffModeStatusView>, common::Unretained(this)), handler_);
+  }
+
+  void handle_exit_sniff_mode(uint16_t handle) {
+    std::unique_ptr<ExitSniffModeBuilder> packet = ExitSniffModeBuilder::Create(handle);
+    hci_layer_->EnqueueCommand(
+        std::move(packet),
+        BindOnce(&AclManager::impl::check_command_status<ExitSniffModeStatusView>, common::Unretained(this)), handler_);
+  }
+
+  void handle_qos_setup_mode(uint16_t handle, ServiceType service_type, uint32_t token_rate, uint32_t peak_bandwidth,
+                             uint32_t latency, uint32_t delay_variation) {
+    std::unique_ptr<QosSetupBuilder> packet =
+        QosSetupBuilder::Create(handle, service_type, token_rate, peak_bandwidth, latency, delay_variation);
+    hci_layer_->EnqueueCommand(
+        std::move(packet),
+        BindOnce(&AclManager::impl::check_command_status<QosSetupStatusView>, common::Unretained(this)), handler_);
+  }
+
+  void handle_role_discovery(uint16_t handle) {
+    std::unique_ptr<RoleDiscoveryBuilder> packet = RoleDiscoveryBuilder::Create(handle);
+    hci_layer_->EnqueueCommand(std::move(packet),
+                               common::BindOnce(&impl::on_role_discovery_complete, common::Unretained(this)), handler_);
+  }
+
+  void handle_read_link_policy_settings(uint16_t handle) {
+    std::unique_ptr<ReadLinkPolicySettingsBuilder> packet = ReadLinkPolicySettingsBuilder::Create(handle);
+    hci_layer_->EnqueueCommand(std::move(packet),
+                               common::BindOnce(&impl::on_read_link_policy_settings_complete, common::Unretained(this)),
+                               handler_);
+  }
+
+  void handle_write_link_policy_settings(uint16_t handle, uint16_t link_policy_settings) {
+    std::unique_ptr<WriteLinkPolicySettingsBuilder> packet =
+        WriteLinkPolicySettingsBuilder::Create(handle, link_policy_settings);
+    hci_layer_->EnqueueCommand(std::move(packet),
+                               BindOnce(&AclManager::impl::check_command_complete<WriteLinkPolicySettingsCompleteView>,
+                                        common::Unretained(this)),
+                               handler_);
+  }
+
+  void handle_flow_specification(uint16_t handle, FlowDirection flow_direction, ServiceType service_type,
+                                 uint32_t token_rate, uint32_t token_bucket_size, uint32_t peak_bandwidth,
+                                 uint32_t access_latency) {
+    std::unique_ptr<FlowSpecificationBuilder> packet = FlowSpecificationBuilder::Create(
+        handle, flow_direction, service_type, token_rate, token_bucket_size, peak_bandwidth, access_latency);
+    hci_layer_->EnqueueCommand(
+        std::move(packet),
+        BindOnce(&AclManager::impl::check_command_status<FlowSpecificationStatusView>, common::Unretained(this)),
+        handler_);
+  }
+
+  void handle_sniff_subrating(uint16_t handle, uint16_t maximum_latency, uint16_t minimum_remote_timeout,
+                              uint16_t minimum_local_timeout) {
+    std::unique_ptr<SniffSubratingBuilder> packet =
+        SniffSubratingBuilder::Create(handle, maximum_latency, minimum_remote_timeout, minimum_local_timeout);
+    hci_layer_->EnqueueCommand(
+        std::move(packet),
+        BindOnce(&AclManager::impl::check_command_complete<SniffSubratingCompleteView>, common::Unretained(this)),
+        handler_);
+  }
+
+  void handle_flush(uint16_t handle) {
+    std::unique_ptr<FlushBuilder> packet = FlushBuilder::Create(handle);
+    hci_layer_->EnqueueCommand(
+        std::move(packet),
+        BindOnce(&AclManager::impl::check_command_complete<FlushCompleteView>, common::Unretained(this)), handler_);
+  }
+
+  void handle_read_automatic_flush_timeout(uint16_t handle) {
+    std::unique_ptr<ReadAutomaticFlushTimeoutBuilder> packet = ReadAutomaticFlushTimeoutBuilder::Create(handle);
+    hci_layer_->EnqueueCommand(
+        std::move(packet), common::BindOnce(&impl::on_read_automatic_flush_timeout_complete, common::Unretained(this)),
+        handler_);
+  }
+
+  void handle_write_automatic_flush_timeout(uint16_t handle, uint16_t flush_timeout) {
+    std::unique_ptr<WriteAutomaticFlushTimeoutBuilder> packet =
+        WriteAutomaticFlushTimeoutBuilder::Create(handle, flush_timeout);
+    hci_layer_->EnqueueCommand(
+        std::move(packet),
+        BindOnce(&AclManager::impl::check_command_complete<WriteAutomaticFlushTimeoutCompleteView>,
+                 common::Unretained(this)),
+        handler_);
+  }
+
+  void handle_read_transmit_power_level(uint16_t handle, TransmitPowerLevelType type) {
+    std::unique_ptr<ReadTransmitPowerLevelBuilder> packet = ReadTransmitPowerLevelBuilder::Create(handle, type);
+    hci_layer_->EnqueueCommand(std::move(packet),
+                               common::BindOnce(&impl::on_read_transmit_power_level_complete, common::Unretained(this)),
+                               handler_);
+  }
+
+  void handle_read_link_supervision_timeout(uint16_t handle) {
+    std::unique_ptr<ReadLinkSupervisionTimeoutBuilder> packet = ReadLinkSupervisionTimeoutBuilder::Create(handle);
+    hci_layer_->EnqueueCommand(
+        std::move(packet), common::BindOnce(&impl::on_read_link_supervision_timeout_complete, common::Unretained(this)),
+        handler_);
+  }
+
+  void handle_write_link_supervision_timeout(uint16_t handle, uint16_t link_supervision_timeout) {
+    std::unique_ptr<WriteLinkSupervisionTimeoutBuilder> packet =
+        WriteLinkSupervisionTimeoutBuilder::Create(handle, link_supervision_timeout);
+    hci_layer_->EnqueueCommand(
+        std::move(packet),
+        BindOnce(&AclManager::impl::check_command_complete<WriteLinkSupervisionTimeoutCompleteView>,
+                 common::Unretained(this)),
+        handler_);
+  }
+
+  void handle_read_failed_contact_counter(uint16_t handle) {
+    std::unique_ptr<ReadFailedContactCounterBuilder> packet = ReadFailedContactCounterBuilder::Create(handle);
+    hci_layer_->EnqueueCommand(
+        std::move(packet), common::BindOnce(&impl::on_read_failed_contact_counter_complete, common::Unretained(this)),
+        handler_);
+  }
+
+  void handle_reset_failed_contact_counter(uint16_t handle) {
+    std::unique_ptr<ResetFailedContactCounterBuilder> packet = ResetFailedContactCounterBuilder::Create(handle);
+    hci_layer_->EnqueueCommand(std::move(packet), BindOnce([](CommandCompleteView view) { /* TODO: check? */ }),
+                               handler_);
+  }
+
+  void handle_read_link_quality(uint16_t handle) {
+    std::unique_ptr<ReadLinkQualityBuilder> packet = ReadLinkQualityBuilder::Create(handle);
+    hci_layer_->EnqueueCommand(
+        std::move(packet), common::BindOnce(&impl::on_read_link_quality_complete, common::Unretained(this)), handler_);
+  }
+
+  void handle_afh_channel_map(uint16_t handle) {
+    std::unique_ptr<ReadAfhChannelMapBuilder> packet = ReadAfhChannelMapBuilder::Create(handle);
+    hci_layer_->EnqueueCommand(std::move(packet),
+                               common::BindOnce(&impl::on_read_afh_channel_map_complete, common::Unretained(this)),
+                               handler_);
+  }
+
+  void handle_read_rssi(uint16_t handle) {
+    std::unique_ptr<ReadRssiBuilder> packet = ReadRssiBuilder::Create(handle);
+    hci_layer_->EnqueueCommand(std::move(packet),
+                               common::BindOnce(&impl::on_read_rssi_complete, common::Unretained(this)), handler_);
+  }
+
+  void handle_read_clock(uint16_t handle, WhichClock which_clock) {
+    std::unique_ptr<ReadClockBuilder> packet = ReadClockBuilder::Create(handle, which_clock);
+    hci_layer_->EnqueueCommand(std::move(packet),
+                               common::BindOnce(&impl::on_read_clock_complete, common::Unretained(this)), handler_);
+  }
+
+  template <class T>
+  void check_command_complete(CommandCompleteView view) {
+    ASSERT(view.IsValid());
+    auto status_view = T::Create(view);
+    if (!status_view.IsValid()) {
+      LOG_ERROR("Received command complete with invalid packet, opcode 0x%02hx", view.GetCommandOpCode());
+      return;
+    }
+    ErrorCode status = status_view.GetStatus();
+    OpCode op_code = status_view.GetCommandOpCode();
+    if (status != ErrorCode::SUCCESS) {
+      std::string error_code = ErrorCodeText(status);
+      LOG_ERROR("Received command complete with error code %s, opcode 0x%02hx", error_code.c_str(), op_code);
+      return;
+    }
+  }
+
+  template <class T>
+  void check_command_status(CommandStatusView view) {
+    ASSERT(view.IsValid());
+    auto status_view = T::Create(view);
+    if (!status_view.IsValid()) {
+      LOG_ERROR("Received command status with invalid packet, opcode 0x%02hx", view.GetCommandOpCode());
+      return;
+    }
+    ErrorCode status = status_view.GetStatus();
+    OpCode op_code = status_view.GetCommandOpCode();
+    if (status != ErrorCode::SUCCESS) {
+      std::string error_code = ErrorCodeText(status);
+      LOG_ERROR("Received command status with error code %s, opcode 0x%02hx", error_code.c_str(), op_code);
+      return;
+    }
+  }
+
+  void cleanup(uint16_t handle) {
+    ASSERT(acl_connections_.count(handle) == 1);
+    auto& acl_connection = acl_connections_.find(handle)->second;
+    if (acl_connection.is_registered_) {
+      acl_connection.is_registered_ = false;
+      acl_connection.queue_->GetDownEnd()->UnregisterDequeue();
+    }
+    acl_connections_.erase(handle);
+  }
+
+  void on_accept_connection_status(Address address, CommandStatusView status) {
+    auto accept_status = AcceptConnectionRequestStatusView::Create(status);
+    ASSERT(accept_status.IsValid());
+    if (status.GetStatus() != ErrorCode::SUCCESS) {
+      cancel_connect(address);
+    }
+  }
+
+  void reject_connection(std::unique_ptr<RejectConnectionRequestBuilder> builder) {
+    hci_layer_->EnqueueCommand(std::move(builder), BindOnce([](CommandStatusView status) { /* TODO: check? */ }),
+                               handler_);
+  }
+
+  void handle_register_callbacks(ConnectionCallbacks* callbacks, os::Handler* handler) {
+    ASSERT(client_callbacks_ == nullptr);
+    ASSERT(client_handler_ == nullptr);
+    client_callbacks_ = callbacks;
+    client_handler_ = handler;
+  }
+
+  void handle_register_le_callbacks(LeConnectionCallbacks* callbacks, os::Handler* handler) {
+    ASSERT(le_client_callbacks_ == nullptr);
+    ASSERT(le_client_handler_ == nullptr);
+    le_client_callbacks_ = callbacks;
+    le_client_handler_ = handler;
+  }
+
+  void handle_register_acl_manager_callbacks(AclManagerCallbacks* callbacks, os::Handler* handler) {
+    ASSERT(acl_manager_client_callbacks_ == nullptr);
+    ASSERT(acl_manager_client_handler_ == nullptr);
+    acl_manager_client_callbacks_ = callbacks;
+    acl_manager_client_handler_ = handler;
+  }
+
+  acl_connection& check_and_get_connection(uint16_t handle) {
+    auto connection = acl_connections_.find(handle);
+    ASSERT(connection != acl_connections_.end());
+    return connection->second;
+  }
+
+  AclConnection::QueueUpEnd* get_acl_queue_end(uint16_t handle) {
+    auto& connection = check_and_get_connection(handle);
+    return connection.queue_->GetUpEnd();
+  }
+
+  void RegisterCallbacks(uint16_t handle, ConnectionManagementCallbacks* callbacks, os::Handler* handler) {
+    auto& connection = check_and_get_connection(handle);
+    connection.command_complete_callbacks_ = callbacks;
+    connection.command_complete_handler_ = handler;
+  }
+
+  void RegisterDisconnectCallback(uint16_t handle, common::OnceCallback<void(ErrorCode)> on_disconnect,
+                                  os::Handler* handler) {
+    auto& connection = check_and_get_connection(handle);
+    connection.on_disconnect_callback_ = std::move(on_disconnect);
+    connection.disconnect_handler_ = handler;
+    if (connection.is_disconnected_) {
+      connection.call_disconnect_callback();
+    }
+  }
+
+  bool Disconnect(uint16_t handle, DisconnectReason reason) {
+    auto& connection = check_and_get_connection(handle);
+    if (connection.is_disconnected_) {
+      LOG_INFO("Already disconnected");
+      return false;
+    }
+    handler_->Post(BindOnce(&impl::handle_disconnect, common::Unretained(this), handle, reason));
+    return true;
+  }
+
+  bool ChangeConnectionPacketType(uint16_t handle, uint16_t packet_type) {
+    auto& connection = check_and_get_connection(handle);
+    if (connection.is_disconnected_) {
+      LOG_INFO("Already disconnected");
+      return false;
+    }
+    handler_->Post(
+        BindOnce(&impl::handle_change_connection_packet_type, common::Unretained(this), handle, packet_type));
+    return true;
+  }
+
+  bool AuthenticationRequested(uint16_t handle) {
+    auto& connection = check_and_get_connection(handle);
+    if (connection.is_disconnected_) {
+      LOG_INFO("Already disconnected");
+      return false;
+    }
+    handler_->Post(BindOnce(&impl::handle_authentication_requested, common::Unretained(this), handle));
+    return true;
+  }
+
+  bool SetConnectionEncryption(uint16_t handle, Enable enable) {
+    auto& connection = check_and_get_connection(handle);
+    if (connection.is_disconnected_) {
+      LOG_INFO("Already disconnected");
+      return false;
+    }
+    handler_->Post(BindOnce(&impl::handle_set_connection_encryption, common::Unretained(this), handle, enable));
+    return true;
+  }
+
+  bool ChangeConnectionLinkKey(uint16_t handle) {
+    auto& connection = check_and_get_connection(handle);
+    if (connection.is_disconnected_) {
+      LOG_INFO("Already disconnected");
+      return false;
+    }
+    handler_->Post(BindOnce(&impl::handle_change_connection_link_key, common::Unretained(this), handle));
+    return true;
+  }
+
+  bool ReadClockOffset(uint16_t handle) {
+    auto& connection = check_and_get_connection(handle);
+    if (connection.is_disconnected_) {
+      LOG_INFO("Already disconnected");
+      return false;
+    }
+    handler_->Post(BindOnce(&impl::handle_read_clock_offset, common::Unretained(this), handle));
+    return true;
+  }
+
+  bool HoldMode(uint16_t handle, uint16_t max_interval, uint16_t min_interval) {
+    auto& connection = check_and_get_connection(handle);
+    if (connection.is_disconnected_) {
+      LOG_INFO("Already disconnected");
+      return false;
+    }
+    handler_->Post(BindOnce(&impl::handle_hold_mode, common::Unretained(this), handle, max_interval, min_interval));
+    return true;
+  }
+
+  bool SniffMode(uint16_t handle, uint16_t max_interval, uint16_t min_interval, int16_t attempt, uint16_t timeout) {
+    auto& connection = check_and_get_connection(handle);
+    if (connection.is_disconnected_) {
+      LOG_INFO("Already disconnected");
+      return false;
+    }
+    handler_->Post(BindOnce(&impl::handle_sniff_mode, common::Unretained(this), handle, max_interval, min_interval,
+                            attempt, timeout));
+    return true;
+  }
+
+  bool ExitSniffMode(uint16_t handle) {
+    auto& connection = check_and_get_connection(handle);
+    if (connection.is_disconnected_) {
+      LOG_INFO("Already disconnected");
+      return false;
+    }
+    handler_->Post(BindOnce(&impl::handle_exit_sniff_mode, common::Unretained(this), handle));
+    return true;
+  }
+
+  bool QosSetup(uint16_t handle, ServiceType service_type, uint32_t token_rate, uint32_t peak_bandwidth,
+                uint32_t latency, uint32_t delay_variation) {
+    auto& connection = check_and_get_connection(handle);
+    if (connection.is_disconnected_) {
+      LOG_INFO("Already disconnected");
+      return false;
+    }
+    handler_->Post(BindOnce(&impl::handle_qos_setup_mode, common::Unretained(this), handle, service_type, token_rate,
+                            peak_bandwidth, latency, delay_variation));
+    return true;
+  }
+
+  bool RoleDiscovery(uint16_t handle) {
+    auto& connection = check_and_get_connection(handle);
+    if (connection.is_disconnected_) {
+      LOG_INFO("Already disconnected");
+      return false;
+    }
+    handler_->Post(BindOnce(&impl::handle_role_discovery, common::Unretained(this), handle));
+    return true;
+  }
+
+  bool ReadLinkPolicySettings(uint16_t handle) {
+    auto& connection = check_and_get_connection(handle);
+    if (connection.is_disconnected_) {
+      LOG_INFO("Already disconnected");
+      return false;
+    }
+    handler_->Post(BindOnce(&impl::handle_read_link_policy_settings, common::Unretained(this), handle));
+    return true;
+  }
+
+  bool WriteLinkPolicySettings(uint16_t handle, uint16_t link_policy_settings) {
+    auto& connection = check_and_get_connection(handle);
+    if (connection.is_disconnected_) {
+      LOG_INFO("Already disconnected");
+      return false;
+    }
+    handler_->Post(
+        BindOnce(&impl::handle_write_link_policy_settings, common::Unretained(this), handle, link_policy_settings));
+    return true;
+  }
+
+  bool FlowSpecification(uint16_t handle, FlowDirection flow_direction, ServiceType service_type, uint32_t token_rate,
+                         uint32_t token_bucket_size, uint32_t peak_bandwidth, uint32_t access_latency) {
+    auto& connection = check_and_get_connection(handle);
+    if (connection.is_disconnected_) {
+      LOG_INFO("Already disconnected");
+      return false;
+    }
+    handler_->Post(BindOnce(&impl::handle_flow_specification, common::Unretained(this), handle, flow_direction,
+                            service_type, token_rate, token_bucket_size, peak_bandwidth, access_latency));
+    return true;
+  }
+
+  bool SniffSubrating(uint16_t handle, uint16_t maximum_latency, uint16_t minimum_remote_timeout,
+                      uint16_t minimum_local_timeout) {
+    auto& connection = check_and_get_connection(handle);
+    if (connection.is_disconnected_) {
+      LOG_INFO("Already disconnected");
+      return false;
+    }
+    handler_->Post(BindOnce(&impl::handle_sniff_subrating, common::Unretained(this), handle, maximum_latency,
+                            minimum_remote_timeout, minimum_local_timeout));
+    return true;
+  }
+
+  bool Flush(uint16_t handle) {
+    auto& connection = check_and_get_connection(handle);
+    if (connection.is_disconnected_) {
+      LOG_INFO("Already disconnected");
+      return false;
+    }
+    handler_->Post(BindOnce(&impl::handle_flush, common::Unretained(this), handle));
+    return true;
+  }
+
+  bool ReadAutomaticFlushTimeout(uint16_t handle) {
+    auto& connection = check_and_get_connection(handle);
+    if (connection.is_disconnected_) {
+      LOG_INFO("Already disconnected");
+      return false;
+    }
+    handler_->Post(BindOnce(&impl::handle_read_automatic_flush_timeout, common::Unretained(this), handle));
+    return true;
+  }
+
+  bool WriteAutomaticFlushTimeout(uint16_t handle, uint16_t flush_timeout) {
+    auto& connection = check_and_get_connection(handle);
+    if (connection.is_disconnected_) {
+      LOG_INFO("Already disconnected");
+      return false;
+    }
+    handler_->Post(
+        BindOnce(&impl::handle_write_automatic_flush_timeout, common::Unretained(this), handle, flush_timeout));
+    return true;
+  }
+
+  bool ReadTransmitPowerLevel(uint16_t handle, TransmitPowerLevelType type) {
+    auto& connection = check_and_get_connection(handle);
+    if (connection.is_disconnected_) {
+      LOG_INFO("Already disconnected");
+      return false;
+    }
+    handler_->Post(BindOnce(&impl::handle_read_transmit_power_level, common::Unretained(this), handle, type));
+    return true;
+  }
+
+  bool ReadLinkSupervisionTimeout(uint16_t handle) {
+    auto& connection = check_and_get_connection(handle);
+    if (connection.is_disconnected_) {
+      LOG_INFO("Already disconnected");
+      return false;
+    }
+    handler_->Post(BindOnce(&impl::handle_read_link_supervision_timeout, common::Unretained(this), handle));
+    return true;
+  }
+
+  bool WriteLinkSupervisionTimeout(uint16_t handle, uint16_t link_supervision_timeout) {
+    auto& connection = check_and_get_connection(handle);
+    if (connection.is_disconnected_) {
+      LOG_INFO("Already disconnected");
+      return false;
+    }
+    handler_->Post(BindOnce(&impl::handle_write_link_supervision_timeout, common::Unretained(this), handle,
+                            link_supervision_timeout));
+    return true;
+  }
+
+  bool ReadFailedContactCounter(uint16_t handle) {
+    auto& connection = check_and_get_connection(handle);
+    if (connection.is_disconnected_) {
+      LOG_INFO("Already disconnected");
+      return false;
+    }
+    handler_->Post(BindOnce(&impl::handle_read_failed_contact_counter, common::Unretained(this), handle));
+    return true;
+  }
+
+  bool ResetFailedContactCounter(uint16_t handle) {
+    auto& connection = check_and_get_connection(handle);
+    if (connection.is_disconnected_) {
+      LOG_INFO("Already disconnected");
+      return false;
+    }
+    handler_->Post(BindOnce(&impl::handle_reset_failed_contact_counter, common::Unretained(this), handle));
+    return true;
+  }
+
+  bool ReadLinkQuality(uint16_t handle) {
+    auto& connection = check_and_get_connection(handle);
+    if (connection.is_disconnected_) {
+      LOG_INFO("Already disconnected");
+      return false;
+    }
+    handler_->Post(BindOnce(&impl::handle_read_link_quality, common::Unretained(this), handle));
+    return true;
+  }
+
+  bool ReadAfhChannelMap(uint16_t handle) {
+    auto& connection = check_and_get_connection(handle);
+    if (connection.is_disconnected_) {
+      LOG_INFO("Already disconnected");
+      return false;
+    }
+    handler_->Post(BindOnce(&impl::handle_afh_channel_map, common::Unretained(this), handle));
+    return true;
+  }
+
+  bool ReadRssi(uint16_t handle) {
+    auto& connection = check_and_get_connection(handle);
+    if (connection.is_disconnected_) {
+      LOG_INFO("Already disconnected");
+      return false;
+    }
+    handler_->Post(BindOnce(&impl::handle_read_rssi, common::Unretained(this), handle));
+    return true;
+  }
+
+  bool ReadClock(uint16_t handle, WhichClock which_clock) {
+    auto& connection = check_and_get_connection(handle);
+    if (connection.is_disconnected_) {
+      LOG_INFO("Already disconnected");
+      return false;
+    }
+    handler_->Post(BindOnce(&impl::handle_read_clock, common::Unretained(this), handle, which_clock));
+    return true;
+  }
+
+  void Finish(uint16_t handle) {
+    auto& connection = check_and_get_connection(handle);
+    ASSERT_LOG(connection.is_disconnected_, "Finish must be invoked after disconnection (handle 0x%04hx)", handle);
+    handler_->Post(BindOnce(&impl::cleanup, common::Unretained(this), handle));
+  }
+
+  AclManager& acl_manager_;
+
+  Controller* controller_ = nullptr;
+  uint16_t max_acl_packet_credits_ = 0;
+  uint16_t acl_packet_credits_ = 0;
+  uint16_t acl_buffer_length_ = 0;
+
+  std::list<std::unique_ptr<AclPacketBuilder>> fragments_to_send_;
+  std::map<uint16_t, acl_connection>::iterator current_connection_pair_;
+
+  HciLayer* hci_layer_ = nullptr;
+  os::Handler* handler_ = nullptr;
+  ConnectionCallbacks* client_callbacks_ = nullptr;
+  os::Handler* client_handler_ = nullptr;
+  LeConnectionCallbacks* le_client_callbacks_ = nullptr;
+  os::Handler* le_client_handler_ = nullptr;
+  AclManagerCallbacks* acl_manager_client_callbacks_ = nullptr;
+  os::Handler* acl_manager_client_handler_ = nullptr;
+  common::BidiQueueEnd<AclPacketBuilder, AclPacketView>* hci_queue_end_ = nullptr;
+  std::map<uint16_t, AclManager::acl_connection> acl_connections_;
+  std::set<Address> connecting_;
+  std::set<AddressWithType> connecting_le_;
+  common::Callback<bool(Address, ClassOfDevice)> should_accept_connection_;
+  std::queue<std::pair<Address, std::unique_ptr<CreateConnectionBuilder>>> pending_outgoing_connections_;
+  size_t hci_mtu_{0};
+};
+
+AclConnection::QueueUpEnd* AclConnection::GetAclQueueEnd() const {
+  return manager_->pimpl_->get_acl_queue_end(handle_);
+}
+
+void AclConnection::RegisterCallbacks(ConnectionManagementCallbacks* callbacks, os::Handler* handler) {
+  return manager_->pimpl_->RegisterCallbacks(handle_, callbacks, handler);
+}
+
+void AclConnection::RegisterDisconnectCallback(common::OnceCallback<void(ErrorCode)> on_disconnect,
+                                               os::Handler* handler) {
+  return manager_->pimpl_->RegisterDisconnectCallback(handle_, std::move(on_disconnect), handler);
+}
+
+bool AclConnection::Disconnect(DisconnectReason reason) {
+  return manager_->pimpl_->Disconnect(handle_, reason);
+}
+
+bool AclConnection::ChangeConnectionPacketType(uint16_t packet_type) {
+  return manager_->pimpl_->ChangeConnectionPacketType(handle_, packet_type);
+}
+
+bool AclConnection::AuthenticationRequested() {
+  return manager_->pimpl_->AuthenticationRequested(handle_);
+}
+
+bool AclConnection::SetConnectionEncryption(Enable enable) {
+  return manager_->pimpl_->SetConnectionEncryption(handle_, enable);
+}
+
+bool AclConnection::ChangeConnectionLinkKey() {
+  return manager_->pimpl_->ChangeConnectionLinkKey(handle_);
+}
+
+bool AclConnection::ReadClockOffset() {
+  return manager_->pimpl_->ReadClockOffset(handle_);
+}
+
+bool AclConnection::HoldMode(uint16_t max_interval, uint16_t min_interval) {
+  return manager_->pimpl_->HoldMode(handle_, max_interval, min_interval);
+}
+
+bool AclConnection::SniffMode(uint16_t max_interval, uint16_t min_interval, uint16_t attempt, uint16_t timeout) {
+  return manager_->pimpl_->SniffMode(handle_, max_interval, min_interval, attempt, timeout);
+}
+
+bool AclConnection::ExitSniffMode() {
+  return manager_->pimpl_->ExitSniffMode(handle_);
+}
+
+bool AclConnection::QosSetup(ServiceType service_type, uint32_t token_rate, uint32_t peak_bandwidth, uint32_t latency,
+                             uint32_t delay_variation) {
+  return manager_->pimpl_->QosSetup(handle_, service_type, token_rate, peak_bandwidth, latency, delay_variation);
+}
+
+bool AclConnection::RoleDiscovery() {
+  return manager_->pimpl_->RoleDiscovery(handle_);
+}
+
+bool AclConnection::ReadLinkPolicySettings() {
+  return manager_->pimpl_->ReadLinkPolicySettings(handle_);
+}
+
+bool AclConnection::WriteLinkPolicySettings(uint16_t link_policy_settings) {
+  return manager_->pimpl_->WriteLinkPolicySettings(handle_, link_policy_settings);
+}
+
+bool AclConnection::FlowSpecification(FlowDirection flow_direction, ServiceType service_type, uint32_t token_rate,
+                                      uint32_t token_bucket_size, uint32_t peak_bandwidth, uint32_t access_latency) {
+  return manager_->pimpl_->FlowSpecification(handle_, flow_direction, service_type, token_rate, token_bucket_size,
+                                             peak_bandwidth, access_latency);
+}
+
+bool AclConnection::SniffSubrating(uint16_t maximum_latency, uint16_t minimum_remote_timeout,
+                                   uint16_t minimum_local_timeout) {
+  return manager_->pimpl_->SniffSubrating(handle_, maximum_latency, minimum_remote_timeout, minimum_local_timeout);
+}
+
+bool AclConnection::Flush() {
+  return manager_->pimpl_->Flush(handle_);
+}
+
+bool AclConnection::ReadAutomaticFlushTimeout() {
+  return manager_->pimpl_->ReadAutomaticFlushTimeout(handle_);
+}
+
+bool AclConnection::WriteAutomaticFlushTimeout(uint16_t flush_timeout) {
+  return manager_->pimpl_->WriteAutomaticFlushTimeout(handle_, flush_timeout);
+}
+
+bool AclConnection::ReadTransmitPowerLevel(TransmitPowerLevelType type) {
+  return manager_->pimpl_->ReadTransmitPowerLevel(handle_, type);
+}
+
+bool AclConnection::ReadLinkSupervisionTimeout() {
+  return manager_->pimpl_->ReadLinkSupervisionTimeout(handle_);
+}
+
+bool AclConnection::WriteLinkSupervisionTimeout(uint16_t link_supervision_timeout) {
+  return manager_->pimpl_->WriteLinkSupervisionTimeout(handle_, link_supervision_timeout);
+}
+
+bool AclConnection::ReadFailedContactCounter() {
+  return manager_->pimpl_->ReadFailedContactCounter(handle_);
+}
+
+bool AclConnection::ResetFailedContactCounter() {
+  return manager_->pimpl_->ResetFailedContactCounter(handle_);
+}
+
+bool AclConnection::ReadLinkQuality() {
+  return manager_->pimpl_->ReadLinkQuality(handle_);
+}
+
+bool AclConnection::ReadAfhChannelMap() {
+  return manager_->pimpl_->ReadAfhChannelMap(handle_);
+}
+
+bool AclConnection::ReadRssi() {
+  return manager_->pimpl_->ReadRssi(handle_);
+}
+
+bool AclConnection::ReadClock(WhichClock which_clock) {
+  return manager_->pimpl_->ReadClock(handle_, which_clock);
+}
+
+void AclConnection::Finish() {
+  return manager_->pimpl_->Finish(handle_);
+}
+
+AclManager::AclManager() : pimpl_(std::make_unique<impl>(*this)) {}
+
+void AclManager::RegisterCallbacks(ConnectionCallbacks* callbacks, os::Handler* handler) {
+  ASSERT(callbacks != nullptr && handler != nullptr);
+  GetHandler()->Post(common::BindOnce(&impl::handle_register_callbacks, common::Unretained(pimpl_.get()),
+                                      common::Unretained(callbacks), common::Unretained(handler)));
+}
+
+void AclManager::RegisterLeCallbacks(LeConnectionCallbacks* callbacks, os::Handler* handler) {
+  ASSERT(callbacks != nullptr && handler != nullptr);
+  GetHandler()->Post(common::BindOnce(&impl::handle_register_le_callbacks, common::Unretained(pimpl_.get()),
+                                      common::Unretained(callbacks), common::Unretained(handler)));
+}
+
+void AclManager::RegisterAclManagerCallbacks(AclManagerCallbacks* callbacks, os::Handler* handler) {
+  ASSERT(callbacks != nullptr && handler != nullptr);
+  GetHandler()->Post(common::BindOnce(&impl::handle_register_acl_manager_callbacks, common::Unretained(pimpl_.get()),
+                                      common::Unretained(callbacks), common::Unretained(handler)));
+}
+
+void AclManager::CreateConnection(Address address) {
+  GetHandler()->Post(common::BindOnce(&impl::create_connection, common::Unretained(pimpl_.get()), address));
+}
+
+void AclManager::CreateLeConnection(AddressWithType address_with_type) {
+  GetHandler()->Post(
+      common::BindOnce(&impl::create_le_connection, common::Unretained(pimpl_.get()), address_with_type));
+}
+
+void AclManager::CancelConnect(Address address) {
+  GetHandler()->Post(BindOnce(&impl::cancel_connect, common::Unretained(pimpl_.get()), address));
+}
+
+void AclManager::MasterLinkKey(KeyFlag key_flag) {
+  GetHandler()->Post(BindOnce(&impl::master_link_key, common::Unretained(pimpl_.get()), key_flag));
+}
+
+void AclManager::SwitchRole(Address address, Role role) {
+  GetHandler()->Post(BindOnce(&impl::switch_role, common::Unretained(pimpl_.get()), address, role));
+}
+
+void AclManager::ReadDefaultLinkPolicySettings() {
+  GetHandler()->Post(BindOnce(&impl::read_default_link_policy_settings, common::Unretained(pimpl_.get())));
+}
+
+void AclManager::WriteDefaultLinkPolicySettings(uint16_t default_link_policy_settings) {
+  GetHandler()->Post(BindOnce(&impl::write_default_link_policy_settings, common::Unretained(pimpl_.get()),
+                              default_link_policy_settings));
+}
+
+void AclManager::ListDependencies(ModuleList* list) {
+  list->add<HciLayer>();
+  list->add<Controller>();
+}
+
+void AclManager::Start() {
+  pimpl_->Start();
+}
+
+void AclManager::Stop() {
+  pimpl_->Stop();
+}
+
+const ModuleFactory AclManager::Factory = ModuleFactory([]() { return new AclManager(); });
+
+AclManager::~AclManager() = default;
+
+}  // namespace hci
+}  // namespace bluetooth
diff --git a/gd/hci/acl_manager.h b/gd/hci/acl_manager.h
new file mode 100644
index 0000000..ca86485
--- /dev/null
+++ b/gd/hci/acl_manager.h
@@ -0,0 +1,250 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#pragma once
+
+#include <memory>
+
+#include "common/bidi_queue.h"
+#include "common/callback.h"
+#include "hci/address.h"
+#include "hci/address_with_type.h"
+#include "hci/hci_layer.h"
+#include "hci/hci_packets.h"
+#include "module.h"
+#include "os/handler.h"
+
+namespace bluetooth {
+namespace hci {
+
+class AclManager;
+
+class ConnectionManagementCallbacks {
+ public:
+  virtual ~ConnectionManagementCallbacks() = default;
+  // Invoked when controller sends Connection Packet Type Changed event with Success error code
+  virtual void OnConnectionPacketTypeChanged(uint16_t packet_type) = 0;
+  // Invoked when controller sends Authentication Complete event with Success error code
+  virtual void OnAuthenticationComplete() = 0;
+  // Invoked when controller sends Encryption Change event with Success error code
+  virtual void OnEncryptionChange(EncryptionEnabled enabled) = 0;
+  // Invoked when controller sends Change Connection Link Key Complete event with Success error code
+  virtual void OnChangeConnectionLinkKeyComplete() = 0;
+  // Invoked when controller sends Read Clock Offset Complete event with Success error code
+  virtual void OnReadClockOffsetComplete(uint16_t clock_offset) = 0;
+  // Invoked when controller sends Mode Change event with Success error code
+  virtual void OnModeChange(Mode current_mode, uint16_t interval) = 0;
+  // Invoked when controller sends QoS Setup Complete event with Success error code
+  virtual void OnQosSetupComplete(ServiceType service_type, uint32_t token_rate, uint32_t peak_bandwidth,
+                                  uint32_t latency, uint32_t delay_variation) = 0;
+  // Invoked when controller sends Flow Specification Complete event with Success error code
+  virtual void OnFlowSpecificationComplete(FlowDirection flow_direction, ServiceType service_type, uint32_t token_rate,
+                                           uint32_t token_bucket_size, uint32_t peak_bandwidth,
+                                           uint32_t access_latency) = 0;
+  // Invoked when controller sends Flush Occurred event
+  virtual void OnFlushOccurred() = 0;
+  // Invoked when controller sends Command Complete event for Role Discovery command with Success error code
+  virtual void OnRoleDiscoveryComplete(Role current_role) = 0;
+  // Invoked when controller sends Command Complete event for Read Link Policy Settings command with Success error code
+  virtual void OnReadLinkPolicySettingsComplete(uint16_t link_policy_settings) = 0;
+  // Invoked when controller sends Command Complete event for Read Automatic Flush Timeout command with Success error
+  // code
+  virtual void OnReadAutomaticFlushTimeoutComplete(uint16_t flush_timeout) = 0;
+  // Invoked when controller sends Command Complete event for Read Transmit Power Level command with Success error code
+  virtual void OnReadTransmitPowerLevelComplete(uint8_t transmit_power_level) = 0;
+  // Invoked when controller sends Command Complete event for Read Link Supervision Time out command with Success error
+  // code
+  virtual void OnReadLinkSupervisionTimeoutComplete(uint16_t link_supervision_timeout) = 0;
+  // Invoked when controller sends Command Complete event for Read Failed Contact Counter command with Success error
+  // code
+  virtual void OnReadFailedContactCounterComplete(uint16_t failed_contact_counter) = 0;
+  // Invoked when controller sends Command Complete event for Read Link Quality command with Success error code
+  virtual void OnReadLinkQualityComplete(uint8_t link_quality) = 0;
+  // Invoked when controller sends Command Complete event for Read AFH Channel Map command with Success error code
+  virtual void OnReadAfhChannelMapComplete(AfhMode afh_mode, std::array<uint8_t, 10> afh_channel_map) = 0;
+  // Invoked when controller sends Command Complete event for Read RSSI command with Success error code
+  virtual void OnReadRssiComplete(uint8_t rssi) = 0;
+  // Invoked when controller sends Command Complete event for Read Clock command with Success error code
+  virtual void OnReadClockComplete(uint32_t clock, uint16_t accuracy) = 0;
+};
+
+class AclConnection {
+ public:
+  AclConnection()
+      : manager_(nullptr), handle_(0), address_(Address::kEmpty), address_type_(AddressType::PUBLIC_DEVICE_ADDRESS){};
+  virtual ~AclConnection() = default;
+
+  virtual Address GetAddress() const {
+    return address_;
+  }
+
+  virtual AddressType GetAddressType() const {
+    return address_type_;
+  }
+
+  uint16_t GetHandle() const {
+    return handle_;
+  }
+
+  /* This return role for LE devices only, for Classic, please see |RoleDiscovery| method.
+   * TODO: split AclConnection for LE and Classic
+   */
+  Role GetRole() const {
+    return role_;
+  }
+
+  using Queue = common::BidiQueue<PacketView<kLittleEndian>, BasePacketBuilder>;
+  using QueueUpEnd = common::BidiQueueEnd<BasePacketBuilder, PacketView<kLittleEndian>>;
+  using QueueDownEnd = common::BidiQueueEnd<PacketView<kLittleEndian>, BasePacketBuilder>;
+  virtual QueueUpEnd* GetAclQueueEnd() const;
+  virtual void RegisterCallbacks(ConnectionManagementCallbacks* callbacks, os::Handler* handler);
+  virtual void RegisterDisconnectCallback(common::OnceCallback<void(ErrorCode)> on_disconnect, os::Handler* handler);
+  virtual bool Disconnect(DisconnectReason reason);
+  virtual bool ChangeConnectionPacketType(uint16_t packet_type);
+  virtual bool AuthenticationRequested();
+  virtual bool SetConnectionEncryption(Enable enable);
+  virtual bool ChangeConnectionLinkKey();
+  virtual bool ReadClockOffset();
+  virtual bool HoldMode(uint16_t max_interval, uint16_t min_interval);
+  virtual bool SniffMode(uint16_t max_interval, uint16_t min_interval, uint16_t attempt, uint16_t timeout);
+  virtual bool ExitSniffMode();
+  virtual bool QosSetup(ServiceType service_type, uint32_t token_rate, uint32_t peak_bandwidth, uint32_t latency,
+                        uint32_t delay_variation);
+  virtual bool RoleDiscovery();
+  virtual bool ReadLinkPolicySettings();
+  virtual bool WriteLinkPolicySettings(uint16_t link_policy_settings);
+  virtual bool FlowSpecification(FlowDirection flow_direction, ServiceType service_type, uint32_t token_rate,
+                                 uint32_t token_bucket_size, uint32_t peak_bandwidth, uint32_t access_latency);
+  virtual bool SniffSubrating(uint16_t maximum_latency, uint16_t minimum_remote_timeout,
+                              uint16_t minimum_local_timeout);
+  virtual bool Flush();
+  virtual bool ReadAutomaticFlushTimeout();
+  virtual bool WriteAutomaticFlushTimeout(uint16_t flush_timeout);
+  virtual bool ReadTransmitPowerLevel(TransmitPowerLevelType type);
+  virtual bool ReadLinkSupervisionTimeout();
+  virtual bool WriteLinkSupervisionTimeout(uint16_t link_supervision_timeout);
+  virtual bool ReadFailedContactCounter();
+  virtual bool ResetFailedContactCounter();
+  virtual bool ReadLinkQuality();
+  virtual bool ReadAfhChannelMap();
+  virtual bool ReadRssi();
+  virtual bool ReadClock(WhichClock which_clock);
+
+  // Ask AclManager to clean me up. Must invoke after on_disconnect is called
+  virtual void Finish();
+
+  // TODO: API to change link settings ... ?
+
+ private:
+  friend AclManager;
+  AclConnection(AclManager* manager, uint16_t handle, Address address)
+      : manager_(manager), handle_(handle), address_(address) {}
+  AclConnection(AclManager* manager, uint16_t handle, Address address, AddressType address_type, Role role)
+      : manager_(manager), handle_(handle), address_(address), address_type_(address_type), role_(role) {}
+  AclManager* manager_;
+  uint16_t handle_;
+  Address address_;
+  AddressType address_type_;
+  Role role_;
+  DISALLOW_COPY_AND_ASSIGN(AclConnection);
+};
+
+class ConnectionCallbacks {
+ public:
+  virtual ~ConnectionCallbacks() = default;
+  // Invoked when controller sends Connection Complete event with Success error code
+  virtual void OnConnectSuccess(std::unique_ptr<AclConnection> /* , initiated_by_local ? */) = 0;
+  // Invoked when controller sends Connection Complete event with non-Success error code
+  virtual void OnConnectFail(Address, ErrorCode reason) = 0;
+};
+
+class LeConnectionCallbacks {
+ public:
+  virtual ~LeConnectionCallbacks() = default;
+  // Invoked when controller sends Connection Complete event with Success error code
+  // AddressWithType is always equal to the object used in AclManager#CreateLeConnection
+  virtual void OnLeConnectSuccess(AddressWithType, std::unique_ptr<AclConnection> /* , initiated_by_local ? */) = 0;
+  // Invoked when controller sends Connection Complete event with non-Success error code
+  virtual void OnLeConnectFail(AddressWithType, ErrorCode reason) = 0;
+};
+
+class AclManagerCallbacks {
+ public:
+  virtual ~AclManagerCallbacks() = default;
+  // Invoked when controller sends Master Link Key Complete event with Success error code
+  virtual void OnMasterLinkKeyComplete(uint16_t connection_handle, KeyFlag key_flag) = 0;
+  // Invoked when controller sends Role Change event with Success error code
+  virtual void OnRoleChange(Address bd_addr, Role new_role) = 0;
+  // Invoked when controller sends Command Complete event for Read Default Link Policy Settings command with Success
+  // error code
+  virtual void OnReadDefaultLinkPolicySettingsComplete(uint16_t default_link_policy_settings) = 0;
+};
+
+class AclManager : public Module {
+ public:
+  AclManager();
+  // NOTE: It is necessary to forward declare a default destructor that overrides the base class one, because
+  // "struct impl" is forwarded declared in .cc and compiler needs a concrete definition of "struct impl" when
+  // compiling AclManager's destructor. Hence we need to forward declare the destructor for AclManager to delay
+  // compiling AclManager's destructor until it starts linking the .cc file.
+  ~AclManager() override;
+
+  // Should register only once when user module starts.
+  // Generates OnConnectSuccess when an incoming connection is established.
+  virtual void RegisterCallbacks(ConnectionCallbacks* callbacks, os::Handler* handler);
+
+  // Should register only once when user module starts.
+  virtual void RegisterLeCallbacks(LeConnectionCallbacks* callbacks, os::Handler* handler);
+
+  // Should register only once when user module starts.
+  virtual void RegisterAclManagerCallbacks(AclManagerCallbacks* callbacks, os::Handler* handler);
+
+  // Generates OnConnectSuccess if connected, or OnConnectFail otherwise
+  virtual void CreateConnection(Address address);
+
+  // Generates OnLeConnectSuccess if connected, or OnLeConnectFail otherwise
+  virtual void CreateLeConnection(AddressWithType address_with_type);
+
+  // Generates OnConnectFail with error code "terminated by local host 0x16" if cancelled, or OnConnectSuccess if not
+  // successfully cancelled and already connected
+  virtual void CancelConnect(Address address);
+
+  virtual void MasterLinkKey(KeyFlag key_flag);
+  virtual void SwitchRole(Address address, Role role);
+  virtual void ReadDefaultLinkPolicySettings();
+  virtual void WriteDefaultLinkPolicySettings(uint16_t default_link_policy_settings);
+
+  static const ModuleFactory Factory;
+
+ protected:
+  void ListDependencies(ModuleList* list) override;
+
+  void Start() override;
+
+  void Stop() override;
+
+ private:
+  friend AclConnection;
+
+  struct impl;
+  std::unique_ptr<impl> pimpl_;
+
+  struct acl_connection;
+  DISALLOW_COPY_AND_ASSIGN(AclManager);
+};
+
+}  // namespace hci
+}  // namespace bluetooth
diff --git a/gd/hci/acl_manager_mock.h b/gd/hci/acl_manager_mock.h
new file mode 100644
index 0000000..544e621
--- /dev/null
+++ b/gd/hci/acl_manager_mock.h
@@ -0,0 +1,49 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+#pragma once
+
+#include "hci/acl_manager.h"
+
+#include <gmock/gmock.h>
+
+// Unit test interfaces
+namespace bluetooth {
+namespace hci {
+namespace testing {
+
+class MockAclConnection : public AclConnection {
+ public:
+  MOCK_METHOD(Address, GetAddress, (), (const, override));
+  MOCK_METHOD(AddressType, GetAddressType, (), (const, override));
+  MOCK_METHOD(void, RegisterDisconnectCallback,
+              (common::OnceCallback<void(ErrorCode)> on_disconnect, os::Handler* handler), (override));
+  MOCK_METHOD(bool, Disconnect, (DisconnectReason reason), (override));
+  MOCK_METHOD(void, Finish, (), (override));
+  MOCK_METHOD(QueueUpEnd*, GetAclQueueEnd, (), (const, override));
+};
+
+class MockAclManager : public AclManager {
+ public:
+  MOCK_METHOD(void, RegisterCallbacks, (ConnectionCallbacks * callbacks, os::Handler* handler), (override));
+  MOCK_METHOD(void, RegisterLeCallbacks, (LeConnectionCallbacks * callbacks, os::Handler* handler), (override));
+  MOCK_METHOD(void, CreateConnection, (Address address), (override));
+  MOCK_METHOD(void, CreateLeConnection, (AddressWithType address_with_type), (override));
+  MOCK_METHOD(void, CancelConnect, (Address address), (override));
+};
+
+}  // namespace testing
+}  // namespace hci
+}  // namespace bluetooth
\ No newline at end of file
diff --git a/gd/hci/acl_manager_test.cc b/gd/hci/acl_manager_test.cc
new file mode 100644
index 0000000..8b2cb32
--- /dev/null
+++ b/gd/hci/acl_manager_test.cc
@@ -0,0 +1,1015 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "hci/acl_manager.h"
+
+#include <algorithm>
+#include <chrono>
+#include <future>
+#include <map>
+
+#include <gmock/gmock.h>
+#include <gtest/gtest.h>
+
+#include "common/bind.h"
+#include "hci/address.h"
+#include "hci/controller.h"
+#include "hci/hci_layer.h"
+#include "os/thread.h"
+#include "packet/raw_builder.h"
+
+namespace bluetooth {
+namespace hci {
+namespace {
+
+using common::BidiQueue;
+using common::BidiQueueEnd;
+using packet::kLittleEndian;
+using packet::PacketView;
+using packet::RawBuilder;
+
+constexpr std::chrono::seconds kTimeout = std::chrono::seconds(2);
+
+PacketView<kLittleEndian> GetPacketView(std::unique_ptr<packet::BasePacketBuilder> packet) {
+  auto bytes = std::make_shared<std::vector<uint8_t>>();
+  BitInserter i(*bytes);
+  bytes->reserve(packet->size());
+  packet->Serialize(i);
+  return packet::PacketView<packet::kLittleEndian>(bytes);
+}
+
+std::unique_ptr<BasePacketBuilder> NextPayload(uint16_t handle) {
+  static uint32_t packet_number = 1;
+  auto payload = std::make_unique<RawBuilder>();
+  payload->AddOctets2(handle);
+  payload->AddOctets4(packet_number++);
+  return std::move(payload);
+}
+
+std::unique_ptr<AclPacketBuilder> NextAclPacket(uint16_t handle) {
+  PacketBoundaryFlag packet_boundary_flag = PacketBoundaryFlag::FIRST_AUTOMATICALLY_FLUSHABLE;
+  BroadcastFlag broadcast_flag = BroadcastFlag::ACTIVE_SLAVE_BROADCAST;
+  return AclPacketBuilder::Create(handle, packet_boundary_flag, broadcast_flag, NextPayload(handle));
+}
+
+class TestController : public Controller {
+ public:
+  void RegisterCompletedAclPacketsCallback(common::Callback<void(uint16_t /* handle */, uint16_t /* packets */)> cb,
+                                           os::Handler* handler) override {
+    acl_cb_ = cb;
+    acl_cb_handler_ = handler;
+  }
+
+  uint16_t GetControllerAclPacketLength() const override {
+    return acl_buffer_length_;
+  }
+
+  uint16_t GetControllerNumAclPacketBuffers() const override {
+    return total_acl_buffers_;
+  }
+
+  void CompletePackets(uint16_t handle, uint16_t packets) {
+    acl_cb_handler_->Post(common::BindOnce(acl_cb_, handle, packets));
+  }
+
+  uint16_t acl_buffer_length_ = 1024;
+  uint16_t total_acl_buffers_ = 2;
+  common::Callback<void(uint16_t /* handle */, uint16_t /* packets */)> acl_cb_;
+  os::Handler* acl_cb_handler_ = nullptr;
+
+ protected:
+  void Start() override {}
+  void Stop() override {}
+  void ListDependencies(ModuleList* list) override {}
+};
+
+class TestHciLayer : public HciLayer {
+ public:
+  void EnqueueCommand(std::unique_ptr<CommandPacketBuilder> command,
+                      common::OnceCallback<void(CommandStatusView)> on_status, os::Handler* handler) override {
+    command_queue_.push(std::move(command));
+    not_empty_.notify_all();
+  }
+
+  void EnqueueCommand(std::unique_ptr<CommandPacketBuilder> command,
+                      common::OnceCallback<void(CommandCompleteView)> on_complete, os::Handler* handler) override {
+    command_queue_.push(std::move(command));
+    command_complete_callbacks.push_front(std::move(on_complete));
+    not_empty_.notify_all();
+  }
+
+  std::unique_ptr<CommandPacketBuilder> GetLastCommand() {
+    if (command_queue_.size() == 0) {
+      return nullptr;
+    }
+    auto last = std::move(command_queue_.front());
+    command_queue_.pop();
+    return last;
+  }
+
+  ConnectionManagementCommandView GetCommandPacket(OpCode op_code) {
+    std::unique_lock<std::mutex> lock(mutex_);
+    std::chrono::milliseconds time = std::chrono::milliseconds(3000);
+
+    ASSERT(not_empty_.wait_for(lock, time) != std::cv_status::timeout);
+    auto packet_view = GetPacketView(GetLastCommand());
+    CommandPacketView command_packet_view = CommandPacketView::Create(packet_view);
+    ConnectionManagementCommandView command = ConnectionManagementCommandView::Create(command_packet_view);
+    ASSERT(command.IsValid());
+    EXPECT_EQ(command.GetOpCode(), op_code);
+
+    return command;
+  }
+
+  void RegisterEventHandler(EventCode event_code, common::Callback<void(EventPacketView)> event_handler,
+                            os::Handler* handler) override {
+    registered_events_[event_code] = event_handler;
+  }
+
+  void UnregisterEventHandler(EventCode event_code) override {
+    registered_events_.erase(event_code);
+  }
+
+  void RegisterLeEventHandler(SubeventCode subevent_code, common::Callback<void(LeMetaEventView)> event_handler,
+                              os::Handler* handler) override {
+    registered_le_events_[subevent_code] = event_handler;
+  }
+
+  void UnregisterLeEventHandler(SubeventCode subevent_code) {
+    registered_le_events_.erase(subevent_code);
+  }
+
+  void IncomingEvent(std::unique_ptr<EventPacketBuilder> event_builder) {
+    auto packet = GetPacketView(std::move(event_builder));
+    EventPacketView event = EventPacketView::Create(packet);
+    EXPECT_TRUE(event.IsValid());
+    EventCode event_code = event.GetEventCode();
+    EXPECT_TRUE(registered_events_.find(event_code) != registered_events_.end());
+    registered_events_[event_code].Run(event);
+  }
+
+  void IncomingLeMetaEvent(std::unique_ptr<LeMetaEventBuilder> event_builder) {
+    auto packet = GetPacketView(std::move(event_builder));
+    EventPacketView event = EventPacketView::Create(packet);
+    LeMetaEventView meta_event_view = LeMetaEventView::Create(event);
+    EXPECT_TRUE(meta_event_view.IsValid());
+    SubeventCode subevent_code = meta_event_view.GetSubeventCode();
+    EXPECT_TRUE(registered_le_events_.find(subevent_code) != registered_le_events_.end());
+    registered_le_events_[subevent_code].Run(meta_event_view);
+  }
+
+  void IncomingAclData(uint16_t handle) {
+    os::Handler* hci_handler = GetHandler();
+    auto* queue_end = acl_queue_.GetDownEnd();
+    std::promise<void> promise;
+    auto future = promise.get_future();
+    queue_end->RegisterEnqueue(hci_handler,
+                               common::Bind(
+                                   [](decltype(queue_end) queue_end, uint16_t handle, std::promise<void> promise) {
+                                     auto packet = GetPacketView(NextAclPacket(handle));
+                                     AclPacketView acl2 = AclPacketView::Create(packet);
+                                     queue_end->UnregisterEnqueue();
+                                     promise.set_value();
+                                     return std::make_unique<AclPacketView>(acl2);
+                                   },
+                                   queue_end, handle, common::Passed(std::move(promise))));
+    auto status = future.wait_for(kTimeout);
+    ASSERT_EQ(status, std::future_status::ready);
+  }
+
+  void AssertNoOutgoingAclData() {
+    auto queue_end = acl_queue_.GetDownEnd();
+    EXPECT_EQ(queue_end->TryDequeue(), nullptr);
+  }
+
+  void CommandCompleteCallback(EventPacketView event) {
+    CommandCompleteView complete_view = CommandCompleteView::Create(event);
+    ASSERT(complete_view.IsValid());
+    std::move(command_complete_callbacks.front()).Run(complete_view);
+    command_complete_callbacks.pop_front();
+  }
+
+  PacketView<kLittleEndian> OutgoingAclData() {
+    auto queue_end = acl_queue_.GetDownEnd();
+    std::unique_ptr<AclPacketBuilder> received;
+    do {
+      received = queue_end->TryDequeue();
+    } while (received == nullptr);
+
+    return GetPacketView(std::move(received));
+  }
+
+  BidiQueueEnd<AclPacketBuilder, AclPacketView>* GetAclQueueEnd() override {
+    return acl_queue_.GetUpEnd();
+  }
+
+  void ListDependencies(ModuleList* list) override {}
+  void Start() override {}
+  void Stop() override {}
+
+ private:
+  std::map<EventCode, common::Callback<void(EventPacketView)>> registered_events_;
+  std::map<SubeventCode, common::Callback<void(LeMetaEventView)>> registered_le_events_;
+  std::list<base::OnceCallback<void(CommandCompleteView)>> command_complete_callbacks;
+  BidiQueue<AclPacketView, AclPacketBuilder> acl_queue_{3 /* TODO: Set queue depth */};
+
+  std::queue<std::unique_ptr<CommandPacketBuilder>> command_queue_;
+  mutable std::mutex mutex_;
+  std::condition_variable not_empty_;
+};
+
+class AclManagerNoCallbacksTest : public ::testing::Test {
+ protected:
+  void SetUp() override {
+    test_hci_layer_ = new TestHciLayer;  // Ownership is transferred to registry
+    test_controller_ = new TestController;
+    fake_registry_.InjectTestModule(&HciLayer::Factory, test_hci_layer_);
+    fake_registry_.InjectTestModule(&Controller::Factory, test_controller_);
+    client_handler_ = fake_registry_.GetTestModuleHandler(&HciLayer::Factory);
+    EXPECT_NE(client_handler_, nullptr);
+    fake_registry_.Start<AclManager>(&thread_);
+    acl_manager_ = static_cast<AclManager*>(fake_registry_.GetModuleUnderTest(&AclManager::Factory));
+    Address::FromString("A1:A2:A3:A4:A5:A6", remote);
+  }
+
+  void TearDown() override {
+    fake_registry_.SynchronizeModuleHandler(&AclManager::Factory, std::chrono::milliseconds(20));
+    fake_registry_.StopAll();
+  }
+
+  TestModuleRegistry fake_registry_;
+  TestHciLayer* test_hci_layer_ = nullptr;
+  TestController* test_controller_ = nullptr;
+  os::Thread& thread_ = fake_registry_.GetTestThread();
+  AclManager* acl_manager_ = nullptr;
+  os::Handler* client_handler_ = nullptr;
+  Address remote;
+
+  std::future<void> GetConnectionFuture() {
+    ASSERT_LOG(mock_connection_callback_.connection_promise_ == nullptr, "Promises promises ... Only one at a time");
+    mock_connection_callback_.connection_promise_ = std::make_unique<std::promise<void>>();
+    return mock_connection_callback_.connection_promise_->get_future();
+  }
+
+  std::future<void> GetLeConnectionFuture() {
+    ASSERT_LOG(mock_le_connection_callbacks_.le_connection_promise_ == nullptr,
+               "Promises promises ... Only one at a time");
+    mock_le_connection_callbacks_.le_connection_promise_ = std::make_unique<std::promise<void>>();
+    return mock_le_connection_callbacks_.le_connection_promise_->get_future();
+  }
+
+  std::shared_ptr<AclConnection> GetLastConnection() {
+    return mock_connection_callback_.connections_.back();
+  }
+
+  std::shared_ptr<AclConnection> GetLastLeConnection() {
+    return mock_le_connection_callbacks_.le_connections_.back();
+  }
+
+  void SendAclData(uint16_t handle, std::shared_ptr<AclConnection> connection) {
+    auto queue_end = connection->GetAclQueueEnd();
+    std::promise<void> promise;
+    auto future = promise.get_future();
+    queue_end->RegisterEnqueue(client_handler_,
+                               common::Bind(
+                                   [](decltype(queue_end) queue_end, uint16_t handle, std::promise<void> promise) {
+                                     queue_end->UnregisterEnqueue();
+                                     promise.set_value();
+                                     return NextPayload(handle);
+                                   },
+                                   queue_end, handle, common::Passed(std::move(promise))));
+    auto status = future.wait_for(kTimeout);
+    ASSERT_EQ(status, std::future_status::ready);
+  }
+
+  class MockConnectionCallback : public ConnectionCallbacks {
+   public:
+    void OnConnectSuccess(std::unique_ptr<AclConnection> connection) override {
+      // Convert to std::shared_ptr during push_back()
+      connections_.push_back(std::move(connection));
+      if (connection_promise_ != nullptr) {
+        connection_promise_->set_value();
+        connection_promise_.reset();
+      }
+    }
+    MOCK_METHOD(void, OnConnectFail, (Address, ErrorCode reason), (override));
+
+    std::list<std::shared_ptr<AclConnection>> connections_;
+    std::unique_ptr<std::promise<void>> connection_promise_;
+  } mock_connection_callback_;
+
+  class MockLeConnectionCallbacks : public LeConnectionCallbacks {
+   public:
+    void OnLeConnectSuccess(AddressWithType address_with_type, std::unique_ptr<AclConnection> connection) override {
+      le_connections_.push_back(std::move(connection));
+      if (le_connection_promise_ != nullptr) {
+        le_connection_promise_->set_value();
+        le_connection_promise_.reset();
+      }
+    }
+    MOCK_METHOD(void, OnLeConnectFail, (AddressWithType, ErrorCode reason), (override));
+
+    std::list<std::shared_ptr<AclConnection>> le_connections_;
+    std::unique_ptr<std::promise<void>> le_connection_promise_;
+  } mock_le_connection_callbacks_;
+
+  class MockAclManagerCallbacks : public AclManagerCallbacks {
+   public:
+    MOCK_METHOD(void, OnMasterLinkKeyComplete, (uint16_t connection_handle, KeyFlag key_flag), (override));
+    MOCK_METHOD(void, OnRoleChange, (Address bd_addr, Role new_role), (override));
+    MOCK_METHOD(void, OnReadDefaultLinkPolicySettingsComplete, (uint16_t default_link_policy_settings), (override));
+  } mock_acl_manager_callbacks_;
+};
+
+class AclManagerTest : public AclManagerNoCallbacksTest {
+ protected:
+  void SetUp() override {
+    AclManagerNoCallbacksTest::SetUp();
+    acl_manager_->RegisterCallbacks(&mock_connection_callback_, client_handler_);
+    acl_manager_->RegisterLeCallbacks(&mock_le_connection_callbacks_, client_handler_);
+    acl_manager_->RegisterAclManagerCallbacks(&mock_acl_manager_callbacks_, client_handler_);
+  }
+};
+
+class AclManagerWithConnectionTest : public AclManagerTest {
+ protected:
+  void SetUp() override {
+    AclManagerTest::SetUp();
+    test_hci_layer_->RegisterEventHandler(
+        EventCode::COMMAND_COMPLETE,
+        base::Bind(&TestHciLayer::CommandCompleteCallback, common::Unretained(test_hci_layer_)), nullptr);
+
+    handle_ = 0x123;
+    acl_manager_->CreateConnection(remote);
+
+    // Wait for the connection request
+    std::unique_ptr<CommandPacketBuilder> last_command;
+    do {
+      last_command = test_hci_layer_->GetLastCommand();
+    } while (last_command == nullptr);
+
+    auto first_connection = GetConnectionFuture();
+    test_hci_layer_->IncomingEvent(
+        ConnectionCompleteBuilder::Create(ErrorCode::SUCCESS, handle_, remote, LinkType::ACL, Enable::DISABLED));
+
+    auto first_connection_status = first_connection.wait_for(kTimeout);
+    ASSERT_EQ(first_connection_status, std::future_status::ready);
+
+    connection_ = GetLastConnection();
+    connection_->RegisterCallbacks(&mock_connection_management_callbacks_, client_handler_);
+  }
+
+  uint16_t handle_;
+  std::shared_ptr<AclConnection> connection_;
+
+  class MockConnectionManagementCallbacks : public ConnectionManagementCallbacks {
+   public:
+    MOCK_METHOD1(OnConnectionPacketTypeChanged, void(uint16_t packet_type));
+    MOCK_METHOD0(OnAuthenticationComplete, void());
+    MOCK_METHOD1(OnEncryptionChange, void(EncryptionEnabled enabled));
+    MOCK_METHOD0(OnChangeConnectionLinkKeyComplete, void());
+    MOCK_METHOD1(OnReadClockOffsetComplete, void(uint16_t clock_offse));
+    MOCK_METHOD2(OnModeChange, void(Mode current_mode, uint16_t interval));
+    MOCK_METHOD5(OnQosSetupComplete, void(ServiceType service_type, uint32_t token_rate, uint32_t peak_bandwidth,
+                                          uint32_t latency, uint32_t delay_variation));
+    MOCK_METHOD6(OnFlowSpecificationComplete,
+                 void(FlowDirection flow_direction, ServiceType service_type, uint32_t token_rate,
+                      uint32_t token_bucket_size, uint32_t peak_bandwidth, uint32_t access_latency));
+    MOCK_METHOD0(OnFlushOccurred, void());
+    MOCK_METHOD1(OnRoleDiscoveryComplete, void(Role current_role));
+    MOCK_METHOD1(OnReadLinkPolicySettingsComplete, void(uint16_t link_policy_settings));
+    MOCK_METHOD1(OnReadAutomaticFlushTimeoutComplete, void(uint16_t flush_timeout));
+    MOCK_METHOD1(OnReadTransmitPowerLevelComplete, void(uint8_t transmit_power_level));
+    MOCK_METHOD1(OnReadLinkSupervisionTimeoutComplete, void(uint16_t link_supervision_timeout));
+    MOCK_METHOD1(OnReadFailedContactCounterComplete, void(uint16_t failed_contact_counter));
+    MOCK_METHOD1(OnReadLinkQualityComplete, void(uint8_t link_quality));
+    MOCK_METHOD2(OnReadAfhChannelMapComplete, void(AfhMode afh_mode, std::array<uint8_t, 10> afh_channel_map));
+    MOCK_METHOD1(OnReadRssiComplete, void(uint8_t rssi));
+    MOCK_METHOD2(OnReadClockComplete, void(uint32_t clock, uint16_t accuracy));
+  } mock_connection_management_callbacks_;
+};
+
+TEST_F(AclManagerTest, startup_teardown) {}
+
+TEST_F(AclManagerNoCallbacksTest, acl_connection_before_registered_callbacks) {
+  ClassOfDevice class_of_device;
+
+  test_hci_layer_->IncomingEvent(
+      ConnectionRequestBuilder::Create(remote, class_of_device, ConnectionRequestLinkType::ACL));
+  fake_registry_.SynchronizeModuleHandler(&HciLayer::Factory, std::chrono::milliseconds(20));
+  fake_registry_.SynchronizeModuleHandler(&AclManager::Factory, std::chrono::milliseconds(20));
+  fake_registry_.SynchronizeModuleHandler(&HciLayer::Factory, std::chrono::milliseconds(20));
+  auto last_command = test_hci_layer_->GetLastCommand();
+  auto packet = GetPacketView(std::move(last_command));
+  CommandPacketView command = CommandPacketView::Create(packet);
+  EXPECT_TRUE(command.IsValid());
+  OpCode op_code = command.GetOpCode();
+  EXPECT_EQ(op_code, OpCode::REJECT_CONNECTION_REQUEST);
+}
+
+TEST_F(AclManagerTest, invoke_registered_callback_connection_complete_success) {
+  uint16_t handle = 1;
+
+  acl_manager_->CreateConnection(remote);
+
+  // Wait for the connection request
+  std::unique_ptr<CommandPacketBuilder> last_command;
+  do {
+    last_command = test_hci_layer_->GetLastCommand();
+  } while (last_command == nullptr);
+
+  auto first_connection = GetConnectionFuture();
+
+  test_hci_layer_->IncomingEvent(
+      ConnectionCompleteBuilder::Create(ErrorCode::SUCCESS, handle, remote, LinkType::ACL, Enable::DISABLED));
+
+  auto first_connection_status = first_connection.wait_for(kTimeout);
+  ASSERT_EQ(first_connection_status, std::future_status::ready);
+
+  std::shared_ptr<AclConnection> connection = GetLastConnection();
+  ASSERT_EQ(connection->GetAddress(), remote);
+}
+
+TEST_F(AclManagerTest, invoke_registered_callback_connection_complete_fail) {
+  uint16_t handle = 0x123;
+
+  acl_manager_->CreateConnection(remote);
+
+  // Wait for the connection request
+  std::unique_ptr<CommandPacketBuilder> last_command;
+  do {
+    last_command = test_hci_layer_->GetLastCommand();
+  } while (last_command == nullptr);
+
+  EXPECT_CALL(mock_connection_callback_, OnConnectFail(remote, ErrorCode::PAGE_TIMEOUT));
+  test_hci_layer_->IncomingEvent(
+      ConnectionCompleteBuilder::Create(ErrorCode::PAGE_TIMEOUT, handle, remote, LinkType::ACL, Enable::DISABLED));
+  fake_registry_.SynchronizeModuleHandler(&HciLayer::Factory, std::chrono::milliseconds(20));
+  fake_registry_.SynchronizeModuleHandler(&AclManager::Factory, std::chrono::milliseconds(20));
+  fake_registry_.SynchronizeModuleHandler(&HciLayer::Factory, std::chrono::milliseconds(20));
+}
+
+TEST_F(AclManagerTest, invoke_registered_callback_le_connection_complete_success) {
+  AddressWithType remote_with_type(remote, AddressType::PUBLIC_DEVICE_ADDRESS);
+  acl_manager_->CreateLeConnection(remote_with_type);
+
+  auto packet = test_hci_layer_->GetCommandPacket(OpCode::LE_CREATE_CONNECTION);
+  auto le_connection_management_command_view = LeConnectionManagementCommandView::Create(packet);
+  auto command_view = LeCreateConnectionView::Create(le_connection_management_command_view);
+  ASSERT(command_view.IsValid());
+  EXPECT_EQ(command_view.GetPeerAddress(), remote);
+  EXPECT_EQ(command_view.GetPeerAddressType(), AddressType::PUBLIC_DEVICE_ADDRESS);
+
+  auto first_connection = GetLeConnectionFuture();
+
+  test_hci_layer_->IncomingLeMetaEvent(
+      LeConnectionCompleteBuilder::Create(ErrorCode::SUCCESS, 0x123, Role::SLAVE, AddressType::PUBLIC_DEVICE_ADDRESS,
+                                          remote, 0x0100, 0x0010, 0x0011, MasterClockAccuracy::PPM_30));
+
+  auto first_connection_status = first_connection.wait_for(kTimeout);
+  ASSERT_EQ(first_connection_status, std::future_status::ready);
+
+  std::shared_ptr<AclConnection> connection = GetLastLeConnection();
+  ASSERT_EQ(connection->GetAddress(), remote);
+}
+
+TEST_F(AclManagerTest, invoke_registered_callback_le_connection_complete_fail) {
+  AddressWithType remote_with_type(remote, AddressType::PUBLIC_DEVICE_ADDRESS);
+  acl_manager_->CreateLeConnection(remote_with_type);
+
+  auto packet = test_hci_layer_->GetCommandPacket(OpCode::LE_CREATE_CONNECTION);
+  auto le_connection_management_command_view = LeConnectionManagementCommandView::Create(packet);
+  auto command_view = LeCreateConnectionView::Create(le_connection_management_command_view);
+  ASSERT(command_view.IsValid());
+  EXPECT_EQ(command_view.GetPeerAddress(), remote);
+  EXPECT_EQ(command_view.GetPeerAddressType(), AddressType::PUBLIC_DEVICE_ADDRESS);
+
+  EXPECT_CALL(mock_le_connection_callbacks_,
+              OnLeConnectFail(remote_with_type, ErrorCode::CONNECTION_REJECTED_LIMITED_RESOURCES));
+  test_hci_layer_->IncomingLeMetaEvent(LeConnectionCompleteBuilder::Create(
+      ErrorCode::CONNECTION_REJECTED_LIMITED_RESOURCES, 0x123, Role::SLAVE, AddressType::PUBLIC_DEVICE_ADDRESS, remote,
+      0x0100, 0x0010, 0x0011, MasterClockAccuracy::PPM_30));
+}
+
+TEST_F(AclManagerTest, invoke_registered_callback_disconnection_complete) {
+  uint16_t handle = 0x123;
+
+  acl_manager_->CreateConnection(remote);
+
+  // Wait for the connection request
+  std::unique_ptr<CommandPacketBuilder> last_command;
+  do {
+    last_command = test_hci_layer_->GetLastCommand();
+  } while (last_command == nullptr);
+
+  auto first_connection = GetConnectionFuture();
+
+  test_hci_layer_->IncomingEvent(
+      ConnectionCompleteBuilder::Create(ErrorCode::SUCCESS, handle, remote, LinkType::ACL, Enable::DISABLED));
+
+  auto first_connection_status = first_connection.wait_for(kTimeout);
+  ASSERT_EQ(first_connection_status, std::future_status::ready);
+
+  std::shared_ptr<AclConnection> connection = GetLastConnection();
+
+  // Register the disconnect handler
+  std::promise<ErrorCode> promise;
+  auto future = promise.get_future();
+  connection->RegisterDisconnectCallback(
+      common::BindOnce([](std::promise<ErrorCode> promise, ErrorCode reason) { promise.set_value(reason); },
+                       std::move(promise)),
+      client_handler_);
+
+  test_hci_layer_->IncomingEvent(
+      DisconnectionCompleteBuilder::Create(ErrorCode::SUCCESS, handle, ErrorCode::REMOTE_USER_TERMINATED_CONNECTION));
+
+  auto disconnection_status = future.wait_for(kTimeout);
+  ASSERT_EQ(disconnection_status, std::future_status::ready);
+  ASSERT_EQ(ErrorCode::REMOTE_USER_TERMINATED_CONNECTION, future.get());
+
+  fake_registry_.SynchronizeModuleHandler(&HciLayer::Factory, std::chrono::milliseconds(20));
+}
+
+TEST_F(AclManagerTest, acl_connection_finish_after_disconnected) {
+  uint16_t handle = 0x123;
+
+  acl_manager_->CreateConnection(remote);
+
+  // Wait for the connection request
+  std::unique_ptr<CommandPacketBuilder> last_command;
+  do {
+    last_command = test_hci_layer_->GetLastCommand();
+  } while (last_command == nullptr);
+
+  auto first_connection = GetConnectionFuture();
+
+  test_hci_layer_->IncomingEvent(
+      ConnectionCompleteBuilder::Create(ErrorCode::SUCCESS, handle, remote, LinkType::ACL, Enable::DISABLED));
+
+  auto first_connection_status = first_connection.wait_for(kTimeout);
+  ASSERT_EQ(first_connection_status, std::future_status::ready);
+
+  std::shared_ptr<AclConnection> connection = GetLastConnection();
+
+  // Register the disconnect handler
+  std::promise<ErrorCode> promise;
+  auto future = promise.get_future();
+  connection->RegisterDisconnectCallback(
+      common::BindOnce([](std::promise<ErrorCode> promise, ErrorCode reason) { promise.set_value(reason); },
+                       std::move(promise)),
+      client_handler_);
+
+  test_hci_layer_->IncomingEvent(DisconnectionCompleteBuilder::Create(
+      ErrorCode::SUCCESS, handle, ErrorCode::REMOTE_DEVICE_TERMINATED_CONNECTION_POWER_OFF));
+
+  auto disconnection_status = future.wait_for(kTimeout);
+  ASSERT_EQ(disconnection_status, std::future_status::ready);
+  ASSERT_EQ(ErrorCode::REMOTE_DEVICE_TERMINATED_CONNECTION_POWER_OFF, future.get());
+
+  connection->Finish();
+}
+
+TEST_F(AclManagerTest, acl_send_data_one_connection) {
+  uint16_t handle = 0x123;
+
+  acl_manager_->CreateConnection(remote);
+
+  // Wait for the connection request
+  std::unique_ptr<CommandPacketBuilder> last_command;
+  do {
+    last_command = test_hci_layer_->GetLastCommand();
+  } while (last_command == nullptr);
+
+  auto first_connection = GetConnectionFuture();
+
+  test_hci_layer_->IncomingEvent(
+      ConnectionCompleteBuilder::Create(ErrorCode::SUCCESS, handle, remote, LinkType::ACL, Enable::DISABLED));
+
+  auto first_connection_status = first_connection.wait_for(kTimeout);
+  ASSERT_EQ(first_connection_status, std::future_status::ready);
+
+  std::shared_ptr<AclConnection> connection = GetLastConnection();
+
+  // Register the disconnect handler
+  connection->RegisterDisconnectCallback(
+      common::Bind([](std::shared_ptr<AclConnection> conn, ErrorCode) { conn->Finish(); }, connection),
+      client_handler_);
+
+  // Send a packet from HCI
+  test_hci_layer_->IncomingAclData(handle);
+  auto queue_end = connection->GetAclQueueEnd();
+
+  std::unique_ptr<PacketView<kLittleEndian>> received;
+  do {
+    received = queue_end->TryDequeue();
+  } while (received == nullptr);
+
+  PacketView<kLittleEndian> received_packet = *received;
+
+  // Send a packet from the connection
+  SendAclData(handle, connection);
+
+  auto sent_packet = test_hci_layer_->OutgoingAclData();
+
+  // Send another packet from the connection
+  SendAclData(handle, connection);
+
+  sent_packet = test_hci_layer_->OutgoingAclData();
+  connection->Disconnect(DisconnectReason::AUTHENTICATION_FAILURE);
+}
+
+TEST_F(AclManagerTest, acl_send_data_credits) {
+  uint16_t handle = 0x123;
+
+  acl_manager_->CreateConnection(remote);
+
+  // Wait for the connection request
+  std::unique_ptr<CommandPacketBuilder> last_command;
+  do {
+    last_command = test_hci_layer_->GetLastCommand();
+  } while (last_command == nullptr);
+
+  auto first_connection = GetConnectionFuture();
+  test_hci_layer_->IncomingEvent(
+      ConnectionCompleteBuilder::Create(ErrorCode::SUCCESS, handle, remote, LinkType::ACL, Enable::DISABLED));
+
+  auto first_connection_status = first_connection.wait_for(kTimeout);
+  ASSERT_EQ(first_connection_status, std::future_status::ready);
+
+  std::shared_ptr<AclConnection> connection = GetLastConnection();
+
+  // Register the disconnect handler
+  connection->RegisterDisconnectCallback(
+      common::BindOnce([](std::shared_ptr<AclConnection> conn, ErrorCode) { conn->Finish(); }, connection),
+      client_handler_);
+
+  // Use all the credits
+  for (uint16_t credits = 0; credits < test_controller_->total_acl_buffers_; credits++) {
+    // Send a packet from the connection
+    SendAclData(handle, connection);
+
+    auto sent_packet = test_hci_layer_->OutgoingAclData();
+  }
+
+  // Send another packet from the connection
+  SendAclData(handle, connection);
+
+  test_hci_layer_->AssertNoOutgoingAclData();
+
+  test_controller_->CompletePackets(handle, 1);
+
+  auto after_credits_sent_packet = test_hci_layer_->OutgoingAclData();
+
+  connection->Disconnect(DisconnectReason::AUTHENTICATION_FAILURE);
+}
+
+TEST_F(AclManagerWithConnectionTest, send_switch_role) {
+  acl_manager_->SwitchRole(connection_->GetAddress(), Role::SLAVE);
+  auto packet = test_hci_layer_->GetCommandPacket(OpCode::SWITCH_ROLE);
+  auto command_view = SwitchRoleView::Create(packet);
+  ASSERT(command_view.IsValid());
+  EXPECT_EQ(command_view.GetBdAddr(), connection_->GetAddress());
+  EXPECT_EQ(command_view.GetRole(), Role::SLAVE);
+
+  EXPECT_CALL(mock_acl_manager_callbacks_, OnRoleChange(connection_->GetAddress(), Role::SLAVE));
+  test_hci_layer_->IncomingEvent(RoleChangeBuilder::Create(ErrorCode::SUCCESS, connection_->GetAddress(), Role::SLAVE));
+}
+
+TEST_F(AclManagerWithConnectionTest, send_read_default_link_policy_settings) {
+  acl_manager_->ReadDefaultLinkPolicySettings();
+  auto packet = test_hci_layer_->GetCommandPacket(OpCode::READ_DEFAULT_LINK_POLICY_SETTINGS);
+  auto command_view = ReadDefaultLinkPolicySettingsView::Create(packet);
+  ASSERT(command_view.IsValid());
+
+  EXPECT_CALL(mock_acl_manager_callbacks_, OnReadDefaultLinkPolicySettingsComplete(0x07));
+  uint8_t num_packets = 1;
+  test_hci_layer_->IncomingEvent(
+      ReadDefaultLinkPolicySettingsCompleteBuilder::Create(num_packets, ErrorCode::SUCCESS, 0x07));
+}
+
+TEST_F(AclManagerWithConnectionTest, send_write_default_link_policy_settings) {
+  acl_manager_->WriteDefaultLinkPolicySettings(0x05);
+  auto packet = test_hci_layer_->GetCommandPacket(OpCode::WRITE_DEFAULT_LINK_POLICY_SETTINGS);
+  auto command_view = WriteDefaultLinkPolicySettingsView::Create(packet);
+  ASSERT(command_view.IsValid());
+  EXPECT_EQ(command_view.GetDefaultLinkPolicySettings(), 0x05);
+
+  uint8_t num_packets = 1;
+  test_hci_layer_->IncomingEvent(
+      WriteDefaultLinkPolicySettingsCompleteBuilder::Create(num_packets, ErrorCode::SUCCESS));
+}
+
+TEST_F(AclManagerWithConnectionTest, send_change_connection_packet_type) {
+  connection_->ChangeConnectionPacketType(0xEE1C);
+  auto packet = test_hci_layer_->GetCommandPacket(OpCode::CHANGE_CONNECTION_PACKET_TYPE);
+  auto command_view = ChangeConnectionPacketTypeView::Create(packet);
+  ASSERT(command_view.IsValid());
+  EXPECT_EQ(command_view.GetPacketType(), 0xEE1C);
+
+  EXPECT_CALL(mock_connection_management_callbacks_, OnConnectionPacketTypeChanged(0xEE1C));
+  test_hci_layer_->IncomingEvent(ConnectionPacketTypeChangedBuilder::Create(ErrorCode::SUCCESS, handle_, 0xEE1C));
+}
+
+TEST_F(AclManagerWithConnectionTest, send_authentication_requested) {
+  connection_->AuthenticationRequested();
+  auto packet = test_hci_layer_->GetCommandPacket(OpCode::AUTHENTICATION_REQUESTED);
+  auto command_view = AuthenticationRequestedView::Create(packet);
+  ASSERT(command_view.IsValid());
+
+  EXPECT_CALL(mock_connection_management_callbacks_, OnAuthenticationComplete);
+  test_hci_layer_->IncomingEvent(AuthenticationCompleteBuilder::Create(ErrorCode::SUCCESS, handle_));
+}
+
+TEST_F(AclManagerWithConnectionTest, send_read_clock_offset) {
+  connection_->ReadClockOffset();
+  auto packet = test_hci_layer_->GetCommandPacket(OpCode::READ_CLOCK_OFFSET);
+  auto command_view = ReadClockOffsetView::Create(packet);
+  ASSERT(command_view.IsValid());
+
+  EXPECT_CALL(mock_connection_management_callbacks_, OnReadClockOffsetComplete(0x0123));
+  test_hci_layer_->IncomingEvent(ReadClockOffsetCompleteBuilder::Create(ErrorCode::SUCCESS, handle_, 0x0123));
+}
+
+TEST_F(AclManagerWithConnectionTest, send_hold_mode) {
+  connection_->HoldMode(0x0500, 0x0020);
+  auto packet = test_hci_layer_->GetCommandPacket(OpCode::HOLD_MODE);
+  auto command_view = HoldModeView::Create(packet);
+  ASSERT(command_view.IsValid());
+  EXPECT_EQ(command_view.GetHoldModeMaxInterval(), 0x0500);
+  EXPECT_EQ(command_view.GetHoldModeMinInterval(), 0x0020);
+
+  EXPECT_CALL(mock_connection_management_callbacks_, OnModeChange(Mode::HOLD, 0x0020));
+  test_hci_layer_->IncomingEvent(ModeChangeBuilder::Create(ErrorCode::SUCCESS, handle_, Mode::HOLD, 0x0020));
+}
+
+TEST_F(AclManagerWithConnectionTest, send_sniff_mode) {
+  connection_->SniffMode(0x0500, 0x0020, 0x0040, 0x0014);
+  auto packet = test_hci_layer_->GetCommandPacket(OpCode::SNIFF_MODE);
+  auto command_view = SniffModeView::Create(packet);
+  ASSERT(command_view.IsValid());
+  EXPECT_EQ(command_view.GetSniffMaxInterval(), 0x0500);
+  EXPECT_EQ(command_view.GetSniffMinInterval(), 0x0020);
+  EXPECT_EQ(command_view.GetSniffAttempt(), 0x0040);
+  EXPECT_EQ(command_view.GetSniffTimeout(), 0x0014);
+
+  EXPECT_CALL(mock_connection_management_callbacks_, OnModeChange(Mode::SNIFF, 0x0028));
+  test_hci_layer_->IncomingEvent(ModeChangeBuilder::Create(ErrorCode::SUCCESS, handle_, Mode::SNIFF, 0x0028));
+}
+
+TEST_F(AclManagerWithConnectionTest, send_exit_sniff_mode) {
+  connection_->ExitSniffMode();
+  auto packet = test_hci_layer_->GetCommandPacket(OpCode::EXIT_SNIFF_MODE);
+  auto command_view = ExitSniffModeView::Create(packet);
+  ASSERT(command_view.IsValid());
+
+  EXPECT_CALL(mock_connection_management_callbacks_, OnModeChange(Mode::ACTIVE, 0x00));
+  test_hci_layer_->IncomingEvent(ModeChangeBuilder::Create(ErrorCode::SUCCESS, handle_, Mode::ACTIVE, 0x00));
+}
+
+TEST_F(AclManagerWithConnectionTest, send_qos_setup) {
+  connection_->QosSetup(ServiceType::BEST_EFFORT, 0x1234, 0x1233, 0x1232, 0x1231);
+  auto packet = test_hci_layer_->GetCommandPacket(OpCode::QOS_SETUP);
+  auto command_view = QosSetupView::Create(packet);
+  ASSERT(command_view.IsValid());
+  EXPECT_EQ(command_view.GetServiceType(), ServiceType::BEST_EFFORT);
+  EXPECT_EQ(command_view.GetTokenRate(), 0x1234);
+  EXPECT_EQ(command_view.GetPeakBandwidth(), 0x1233);
+  EXPECT_EQ(command_view.GetLatency(), 0x1232);
+  EXPECT_EQ(command_view.GetDelayVariation(), 0x1231);
+
+  EXPECT_CALL(mock_connection_management_callbacks_,
+              OnQosSetupComplete(ServiceType::BEST_EFFORT, 0x1234, 0x1233, 0x1232, 0x1231));
+  test_hci_layer_->IncomingEvent(QosSetupCompleteBuilder::Create(ErrorCode::SUCCESS, handle_, ServiceType::BEST_EFFORT,
+                                                                 0x1234, 0x1233, 0x1232, 0x1231));
+}
+
+TEST_F(AclManagerWithConnectionTest, send_flow_specification) {
+  connection_->FlowSpecification(FlowDirection::OUTGOING_FLOW, ServiceType::BEST_EFFORT, 0x1234, 0x1233, 0x1232,
+                                 0x1231);
+  auto packet = test_hci_layer_->GetCommandPacket(OpCode::FLOW_SPECIFICATION);
+  auto command_view = FlowSpecificationView::Create(packet);
+  ASSERT(command_view.IsValid());
+  EXPECT_EQ(command_view.GetFlowDirection(), FlowDirection::OUTGOING_FLOW);
+  EXPECT_EQ(command_view.GetServiceType(), ServiceType::BEST_EFFORT);
+  EXPECT_EQ(command_view.GetTokenRate(), 0x1234);
+  EXPECT_EQ(command_view.GetTokenBucketSize(), 0x1233);
+  EXPECT_EQ(command_view.GetPeakBandwidth(), 0x1232);
+  EXPECT_EQ(command_view.GetAccessLatency(), 0x1231);
+
+  EXPECT_CALL(mock_connection_management_callbacks_,
+              OnFlowSpecificationComplete(FlowDirection::OUTGOING_FLOW, ServiceType::BEST_EFFORT, 0x1234, 0x1233,
+                                          0x1232, 0x1231));
+  test_hci_layer_->IncomingEvent(
+      FlowSpecificationCompleteBuilder::Create(ErrorCode::SUCCESS, handle_, FlowDirection::OUTGOING_FLOW,
+                                               ServiceType::BEST_EFFORT, 0x1234, 0x1233, 0x1232, 0x1231));
+}
+
+TEST_F(AclManagerWithConnectionTest, send_flush) {
+  connection_->Flush();
+  auto packet = test_hci_layer_->GetCommandPacket(OpCode::FLUSH);
+  auto command_view = FlushView::Create(packet);
+  ASSERT(command_view.IsValid());
+
+  EXPECT_CALL(mock_connection_management_callbacks_, OnFlushOccurred());
+  test_hci_layer_->IncomingEvent(FlushOccurredBuilder::Create(handle_));
+}
+
+TEST_F(AclManagerWithConnectionTest, send_role_discovery) {
+  connection_->RoleDiscovery();
+  auto packet = test_hci_layer_->GetCommandPacket(OpCode::ROLE_DISCOVERY);
+  auto command_view = RoleDiscoveryView::Create(packet);
+  ASSERT(command_view.IsValid());
+
+  EXPECT_CALL(mock_connection_management_callbacks_, OnRoleDiscoveryComplete(Role::MASTER));
+  uint8_t num_packets = 1;
+  test_hci_layer_->IncomingEvent(
+      RoleDiscoveryCompleteBuilder::Create(num_packets, ErrorCode::SUCCESS, handle_, Role::MASTER));
+}
+
+TEST_F(AclManagerWithConnectionTest, send_read_link_policy_settings) {
+  connection_->ReadLinkPolicySettings();
+  auto packet = test_hci_layer_->GetCommandPacket(OpCode::READ_LINK_POLICY_SETTINGS);
+  auto command_view = ReadLinkPolicySettingsView::Create(packet);
+  ASSERT(command_view.IsValid());
+
+  EXPECT_CALL(mock_connection_management_callbacks_, OnReadLinkPolicySettingsComplete(0x07));
+  uint8_t num_packets = 1;
+  test_hci_layer_->IncomingEvent(
+      ReadLinkPolicySettingsCompleteBuilder::Create(num_packets, ErrorCode::SUCCESS, handle_, 0x07));
+}
+
+TEST_F(AclManagerWithConnectionTest, send_write_link_policy_settings) {
+  connection_->WriteLinkPolicySettings(0x05);
+  auto packet = test_hci_layer_->GetCommandPacket(OpCode::WRITE_LINK_POLICY_SETTINGS);
+  auto command_view = WriteLinkPolicySettingsView::Create(packet);
+  ASSERT(command_view.IsValid());
+  EXPECT_EQ(command_view.GetLinkPolicySettings(), 0x05);
+
+  uint8_t num_packets = 1;
+  test_hci_layer_->IncomingEvent(
+      WriteLinkPolicySettingsCompleteBuilder::Create(num_packets, ErrorCode::SUCCESS, handle_));
+}
+
+TEST_F(AclManagerWithConnectionTest, send_sniff_subrating) {
+  connection_->SniffSubrating(0x1234, 0x1235, 0x1236);
+  auto packet = test_hci_layer_->GetCommandPacket(OpCode::SNIFF_SUBRATING);
+  auto command_view = SniffSubratingView::Create(packet);
+  ASSERT(command_view.IsValid());
+  EXPECT_EQ(command_view.GetMaximumLatency(), 0x1234);
+  EXPECT_EQ(command_view.GetMinimumRemoteTimeout(), 0x1235);
+  EXPECT_EQ(command_view.GetMinimumLocalTimeout(), 0x1236);
+
+  uint8_t num_packets = 1;
+  test_hci_layer_->IncomingEvent(SniffSubratingCompleteBuilder::Create(num_packets, ErrorCode::SUCCESS, handle_));
+}
+
+TEST_F(AclManagerWithConnectionTest, send_read_automatic_flush_timeout) {
+  connection_->ReadAutomaticFlushTimeout();
+  auto packet = test_hci_layer_->GetCommandPacket(OpCode::READ_AUTOMATIC_FLUSH_TIMEOUT);
+  auto command_view = ReadAutomaticFlushTimeoutView::Create(packet);
+  ASSERT(command_view.IsValid());
+
+  EXPECT_CALL(mock_connection_management_callbacks_, OnReadAutomaticFlushTimeoutComplete(0x07ff));
+  uint8_t num_packets = 1;
+  test_hci_layer_->IncomingEvent(
+      ReadAutomaticFlushTimeoutCompleteBuilder::Create(num_packets, ErrorCode::SUCCESS, handle_, 0x07ff));
+}
+
+TEST_F(AclManagerWithConnectionTest, send_write_automatic_flush_timeout) {
+  connection_->WriteAutomaticFlushTimeout(0x07FF);
+  auto packet = test_hci_layer_->GetCommandPacket(OpCode::WRITE_AUTOMATIC_FLUSH_TIMEOUT);
+  auto command_view = WriteAutomaticFlushTimeoutView::Create(packet);
+  ASSERT(command_view.IsValid());
+  EXPECT_EQ(command_view.GetFlushTimeout(), 0x07FF);
+
+  uint8_t num_packets = 1;
+  test_hci_layer_->IncomingEvent(
+      WriteAutomaticFlushTimeoutCompleteBuilder::Create(num_packets, ErrorCode::SUCCESS, handle_));
+}
+
+TEST_F(AclManagerWithConnectionTest, send_read_transmit_power_level) {
+  connection_->ReadTransmitPowerLevel(TransmitPowerLevelType::CURRENT);
+  auto packet = test_hci_layer_->GetCommandPacket(OpCode::READ_TRANSMIT_POWER_LEVEL);
+  auto command_view = ReadTransmitPowerLevelView::Create(packet);
+  ASSERT(command_view.IsValid());
+  EXPECT_EQ(command_view.GetType(), TransmitPowerLevelType::CURRENT);
+
+  EXPECT_CALL(mock_connection_management_callbacks_, OnReadTransmitPowerLevelComplete(0x07));
+  uint8_t num_packets = 1;
+  test_hci_layer_->IncomingEvent(
+      ReadTransmitPowerLevelCompleteBuilder::Create(num_packets, ErrorCode::SUCCESS, handle_, 0x07));
+}
+
+TEST_F(AclManagerWithConnectionTest, send_read_link_supervision_timeout) {
+  connection_->ReadLinkSupervisionTimeout();
+  auto packet = test_hci_layer_->GetCommandPacket(OpCode::READ_LINK_SUPERVISION_TIMEOUT);
+  auto command_view = ReadLinkSupervisionTimeoutView::Create(packet);
+  ASSERT(command_view.IsValid());
+
+  EXPECT_CALL(mock_connection_management_callbacks_, OnReadLinkSupervisionTimeoutComplete(0x5677));
+  uint8_t num_packets = 1;
+  test_hci_layer_->IncomingEvent(
+      ReadLinkSupervisionTimeoutCompleteBuilder::Create(num_packets, ErrorCode::SUCCESS, handle_, 0x5677));
+}
+
+TEST_F(AclManagerWithConnectionTest, send_write_link_supervision_timeout) {
+  connection_->WriteLinkSupervisionTimeout(0x5678);
+  auto packet = test_hci_layer_->GetCommandPacket(OpCode::WRITE_LINK_SUPERVISION_TIMEOUT);
+  auto command_view = WriteLinkSupervisionTimeoutView::Create(packet);
+  ASSERT(command_view.IsValid());
+  EXPECT_EQ(command_view.GetLinkSupervisionTimeout(), 0x5678);
+
+  uint8_t num_packets = 1;
+  test_hci_layer_->IncomingEvent(
+      WriteLinkSupervisionTimeoutCompleteBuilder::Create(num_packets, ErrorCode::SUCCESS, handle_));
+}
+
+TEST_F(AclManagerWithConnectionTest, send_read_failed_contact_counter) {
+  connection_->ReadFailedContactCounter();
+  auto packet = test_hci_layer_->GetCommandPacket(OpCode::READ_FAILED_CONTACT_COUNTER);
+  auto command_view = ReadFailedContactCounterView::Create(packet);
+  ASSERT(command_view.IsValid());
+
+  EXPECT_CALL(mock_connection_management_callbacks_, OnReadFailedContactCounterComplete(0x00));
+  uint8_t num_packets = 1;
+  test_hci_layer_->IncomingEvent(
+      ReadFailedContactCounterCompleteBuilder::Create(num_packets, ErrorCode::SUCCESS, handle_, 0x00));
+}
+
+TEST_F(AclManagerWithConnectionTest, send_reset_failed_contact_counter) {
+  connection_->ResetFailedContactCounter();
+  auto packet = test_hci_layer_->GetCommandPacket(OpCode::RESET_FAILED_CONTACT_COUNTER);
+  auto command_view = ResetFailedContactCounterView::Create(packet);
+  ASSERT(command_view.IsValid());
+
+  uint8_t num_packets = 1;
+  test_hci_layer_->IncomingEvent(
+      ResetFailedContactCounterCompleteBuilder::Create(num_packets, ErrorCode::SUCCESS, handle_));
+}
+
+TEST_F(AclManagerWithConnectionTest, send_read_link_quality) {
+  connection_->ReadLinkQuality();
+  auto packet = test_hci_layer_->GetCommandPacket(OpCode::READ_LINK_QUALITY);
+  auto command_view = ReadLinkQualityView::Create(packet);
+  ASSERT(command_view.IsValid());
+
+  EXPECT_CALL(mock_connection_management_callbacks_, OnReadLinkQualityComplete(0xa9));
+  uint8_t num_packets = 1;
+  test_hci_layer_->IncomingEvent(
+      ReadLinkQualityCompleteBuilder::Create(num_packets, ErrorCode::SUCCESS, handle_, 0xa9));
+}
+
+TEST_F(AclManagerWithConnectionTest, send_read_afh_channel_map) {
+  connection_->ReadAfhChannelMap();
+  auto packet = test_hci_layer_->GetCommandPacket(OpCode::READ_AFH_CHANNEL_MAP);
+  auto command_view = ReadAfhChannelMapView::Create(packet);
+  ASSERT(command_view.IsValid());
+  std::array<uint8_t, 10> afh_channel_map = {0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09};
+
+  EXPECT_CALL(mock_connection_management_callbacks_,
+              OnReadAfhChannelMapComplete(AfhMode::AFH_ENABLED, afh_channel_map));
+  uint8_t num_packets = 1;
+  test_hci_layer_->IncomingEvent(ReadAfhChannelMapCompleteBuilder::Create(num_packets, ErrorCode::SUCCESS, handle_,
+                                                                          AfhMode::AFH_ENABLED, afh_channel_map));
+}
+
+TEST_F(AclManagerWithConnectionTest, send_read_rssi) {
+  connection_->ReadRssi();
+  auto packet = test_hci_layer_->GetCommandPacket(OpCode::READ_RSSI);
+  auto command_view = ReadRssiView::Create(packet);
+  ASSERT(command_view.IsValid());
+
+  EXPECT_CALL(mock_connection_management_callbacks_, OnReadRssiComplete(0x00));
+  uint8_t num_packets = 1;
+  test_hci_layer_->IncomingEvent(ReadRssiCompleteBuilder::Create(num_packets, ErrorCode::SUCCESS, handle_, 0x00));
+}
+
+TEST_F(AclManagerWithConnectionTest, send_read_clock) {
+  connection_->ReadClock(WhichClock::LOCAL);
+  auto packet = test_hci_layer_->GetCommandPacket(OpCode::READ_CLOCK);
+  auto command_view = ReadClockView::Create(packet);
+  ASSERT(command_view.IsValid());
+  EXPECT_EQ(command_view.GetWhichClock(), WhichClock::LOCAL);
+
+  EXPECT_CALL(mock_connection_management_callbacks_, OnReadClockComplete(0x00002e6a, 0x0000));
+  uint8_t num_packets = 1;
+  test_hci_layer_->IncomingEvent(
+      ReadClockCompleteBuilder::Create(num_packets, ErrorCode::SUCCESS, handle_, 0x00002e6a, 0x0000));
+}
+
+}  // namespace
+}  // namespace hci
+}  // namespace bluetooth
diff --git a/gd/common/address.cc b/gd/hci/address.cc
similarity index 90%
rename from gd/common/address.cc
rename to gd/hci/address.cc
index cd8101a..db0695d 100644
--- a/gd/common/address.cc
+++ b/gd/hci/address.cc
@@ -16,7 +16,7 @@
  *
  ******************************************************************************/
 
-#include "address.h"
+#include "hci/address.h"
 
 #include <stdint.h>
 #include <algorithm>
@@ -24,7 +24,7 @@
 #include <vector>
 
 namespace bluetooth {
-namespace common {
+namespace hci {
 
 static_assert(sizeof(Address) == 6, "Address must be 6 bytes long!");
 
@@ -37,8 +37,8 @@
 
 std::string Address::ToString() const {
   char buffer[] = "00:00:00:00:00:00";
-  std::snprintf(&buffer[0], sizeof(buffer),
-      "%02x:%02x:%02x:%02x:%02x:%02x", address[5], address[4], address[3], address[2], address[1], address[0]);
+  std::snprintf(&buffer[0], sizeof(buffer), "%02x:%02x:%02x:%02x:%02x:%02x", address[5], address[4], address[3],
+                address[2], address[1], address[0]);
   std::string str(buffer);
   return str;
 }
@@ -88,5 +88,5 @@
   return Address::FromString(address, tmp);
 }
 
-}  // namespace common
+}  // namespace hci
 }  // namespace bluetooth
diff --git a/gd/common/address.h b/gd/hci/address.h
similarity index 84%
rename from gd/common/address.h
rename to gd/hci/address.h
index 0036a59..a8f515c 100644
--- a/gd/common/address.h
+++ b/gd/hci/address.h
@@ -21,7 +21,7 @@
 #include <string>
 
 namespace bluetooth {
-namespace common {
+namespace hci {
 
 class Address final {
  public:
@@ -77,5 +77,17 @@
   return os;
 }
 
-}  // namespace common
+}  // namespace hci
 }  // namespace bluetooth
+
+namespace std {
+template <>
+struct hash<bluetooth::hci::Address> {
+  std::size_t operator()(const bluetooth::hci::Address& val) const {
+    static_assert(sizeof(uint64_t) >= bluetooth::hci::Address::kLength);
+    uint64_t int_addr = 0;
+    memcpy(reinterpret_cast<uint8_t*>(&int_addr), val.address, bluetooth::hci::Address::kLength);
+    return std::hash<uint64_t>{}(int_addr);
+  }
+};
+}  // namespace std
\ No newline at end of file
diff --git a/gd/common/address_unittest.cc b/gd/hci/address_unittest.cc
similarity index 82%
rename from gd/common/address_unittest.cc
rename to gd/hci/address_unittest.cc
index cdecce3..17ecd3a 100644
--- a/gd/common/address_unittest.cc
+++ b/gd/hci/address_unittest.cc
@@ -16,11 +16,13 @@
  *
  ******************************************************************************/
 
+#include <unordered_map>
+
 #include <gtest/gtest.h>
 
-#include "common/address.h"
+#include "hci/address.h"
 
-using bluetooth::common::Address;
+using bluetooth::hci::Address;
 
 static const char* test_addr = "bc:9a:78:56:34:12";
 static const char* test_addr2 = "21:43:65:87:a9:cb";
@@ -197,3 +199,34 @@
   EXPECT_TRUE(Address::FromString(address, addr));
   EXPECT_EQ(addr.ToString(), address);
 }
+
+TEST(AddressTest, BdAddrSameValueSameOrder) {
+  Address addr1{{0x01, 0x02, 0x03, 0x04, 0x05, 0x06}};
+  Address addr2{{0x01, 0x02, 0x03, 0x04, 0x05, 0x06}};
+  // Test if two addresses with same byte value have the same hash
+  struct std::hash<bluetooth::hci::Address> hasher;
+  EXPECT_EQ(hasher(addr1), hasher(addr2));
+  // Test if two addresses with the same hash and the same value, they will
+  // still map to the same value
+  std::unordered_map<Address, int> data = {};
+  data[addr1] = 5;
+  data[addr2] = 8;
+  EXPECT_EQ(data[addr1], data[addr2]);
+}
+
+TEST(AddressTest, BdAddrHashDifferentForDifferentAddressesZeroAddr) {
+  Address addr1{{0x01, 0x02, 0x03, 0x04, 0x05, 0x06}};
+  struct std::hash<Address> hasher;
+  EXPECT_NE(hasher(addr1), hasher(Address::kEmpty));
+}
+
+TEST(AddressTest, BdAddrHashDifferentForDifferentAddressesFullAddr) {
+  Address addr1{{0x01, 0x02, 0x03, 0x04, 0x05, 0x06}};
+  struct std::hash<Address> hasher;
+  EXPECT_NE(hasher(addr1), hasher(Address::kAny));
+}
+
+TEST(AddressTest, BdAddrHashDifferentForDifferentAddressesZeroAndFullAddr) {
+  struct std::hash<Address> hasher;
+  EXPECT_NE(hasher(Address::kEmpty), hasher(Address::kAny));
+}
diff --git a/gd/hci/address_with_type.h b/gd/hci/address_with_type.h
new file mode 100644
index 0000000..bed2cf2
--- /dev/null
+++ b/gd/hci/address_with_type.h
@@ -0,0 +1,96 @@
+/******************************************************************************
+ *
+ *  Copyright 2019 The Android Open Source Project
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at:
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ ******************************************************************************/
+
+#pragma once
+
+#include <sstream>
+#include <string>
+#include <utility>
+
+#include "hci/address.h"
+#include "hci/hci_packets.h"
+
+namespace bluetooth {
+namespace hci {
+
+class AddressWithType final {
+ public:
+  AddressWithType(Address address, AddressType address_type) : address_(address), address_type_(address_type) {}
+
+  explicit AddressWithType() : address_(Address::kEmpty), address_type_(AddressType::PUBLIC_DEVICE_ADDRESS) {}
+
+  inline Address GetAddress() const {
+    return address_;
+  }
+
+  inline AddressType GetAddressType() const {
+    return address_type_;
+  }
+
+  bool operator<(const AddressWithType& rhs) const {
+    return address_ < rhs.address_ && address_type_ < rhs.address_type_;
+  }
+  bool operator==(const AddressWithType& rhs) const {
+    return address_ == rhs.address_ && address_type_ == rhs.address_type_;
+  }
+  bool operator>(const AddressWithType& rhs) const {
+    return (rhs < *this);
+  }
+  bool operator<=(const AddressWithType& rhs) const {
+    return !(*this > rhs);
+  }
+  bool operator>=(const AddressWithType& rhs) const {
+    return !(*this < rhs);
+  }
+  bool operator!=(const AddressWithType& rhs) const {
+    return !(*this == rhs);
+  }
+
+  std::string ToString() const {
+    std::stringstream ss;
+    ss << address_ << "[" << AddressTypeText(address_type_) << "]";
+    return ss.str();
+  }
+
+ private:
+  Address address_;
+  AddressType address_type_;
+};
+
+inline std::ostream& operator<<(std::ostream& os, const AddressWithType& a) {
+  os << a.ToString();
+  return os;
+}
+
+}  // namespace hci
+}  // namespace bluetooth
+
+namespace std {
+template <>
+struct hash<bluetooth::hci::AddressWithType> {
+  std::size_t operator()(const bluetooth::hci::AddressWithType& val) const {
+    static_assert(sizeof(uint64_t) >= (sizeof(bluetooth::hci::Address) + sizeof(bluetooth::hci::AddressType)));
+    uint64_t int_addr = 0;
+    memcpy(reinterpret_cast<uint8_t*>(&int_addr), val.GetAddress().address, sizeof(bluetooth::hci::Address));
+    bluetooth::hci::AddressType address_type = val.GetAddressType();
+    memcpy(reinterpret_cast<uint8_t*>(&int_addr) + sizeof(bluetooth::hci::Address), &address_type,
+           sizeof(address_type));
+    return std::hash<uint64_t>{}(int_addr);
+  }
+};
+}  // namespace std
\ No newline at end of file
diff --git a/gd/hci/address_with_type_test.cc b/gd/hci/address_with_type_test.cc
new file mode 100644
index 0000000..f1e5a60
--- /dev/null
+++ b/gd/hci/address_with_type_test.cc
@@ -0,0 +1,68 @@
+/******************************************************************************
+ *
+ *  Copyright 2019 The Android Open Source Project
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at:
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ ******************************************************************************/
+
+#include <unordered_map>
+
+#include <gtest/gtest.h>
+
+#include "hci/address.h"
+#include "hci/address_with_type.h"
+#include "hci/hci_packets.h"
+
+namespace bluetooth {
+namespace hci {
+
+TEST(AddressWithTypeTest, AddressWithTypeSameValueSameOrder) {
+  Address addr1{{0x01, 0x02, 0x03, 0x04, 0x05, 0x06}};
+  AddressType type1 = AddressType::PUBLIC_DEVICE_ADDRESS;
+  AddressWithType address_with_type_1(addr1, type1);
+  Address addr2{{0x01, 0x02, 0x03, 0x04, 0x05, 0x06}};
+  AddressType type2 = AddressType::PUBLIC_DEVICE_ADDRESS;
+  AddressWithType address_with_type_2(addr2, type2);
+  // Test if two address with type with same byte value have the same hash
+  struct std::hash<bluetooth::hci::AddressWithType> hasher;
+  EXPECT_EQ(hasher(address_with_type_1), hasher(address_with_type_2));
+  // Test if two address with type with the same hash and the same value, they will
+  // still map to the same value
+  std::unordered_map<AddressWithType, int> data = {};
+  data[address_with_type_1] = 5;
+  data[address_with_type_2] = 8;
+  EXPECT_EQ(data[address_with_type_1], data[address_with_type_2]);
+}
+
+TEST(AddressWithTypeTest, HashDifferentDiffAddrSameType) {
+  Address addr{{0x01, 0x02, 0x03, 0x04, 0x05, 0x06}};
+  AddressType type = AddressType::PUBLIC_IDENTITY_ADDRESS;
+  AddressWithType address_with_type(addr, type);
+  struct std::hash<AddressWithType> hasher;
+  EXPECT_NE(hasher(address_with_type), hasher(AddressWithType(Address::kEmpty, AddressType::PUBLIC_IDENTITY_ADDRESS)));
+}
+
+TEST(AddressWithTypeTest, HashDifferentSameAddressDiffType) {
+  Address addr1{{0x01, 0x02, 0x03, 0x04, 0x05, 0x06}};
+  AddressType type1 = AddressType::PUBLIC_DEVICE_ADDRESS;
+  AddressWithType address_with_type_1(addr1, type1);
+  Address addr2{{0x01, 0x02, 0x03, 0x04, 0x05, 0x06}};
+  AddressType type2 = AddressType::PUBLIC_IDENTITY_ADDRESS;
+  AddressWithType address_with_type_2(addr2, type2);
+  struct std::hash<bluetooth::hci::AddressWithType> hasher;
+  EXPECT_NE(hasher(address_with_type_1), hasher(address_with_type_2));
+}
+
+}  // namespace hci
+}  // namespace bluetooth
\ No newline at end of file
diff --git a/gd/hci/cert/api.proto b/gd/hci/cert/api.proto
new file mode 100644
index 0000000..cf47743
--- /dev/null
+++ b/gd/hci/cert/api.proto
@@ -0,0 +1,46 @@
+syntax = "proto3";
+
+package bluetooth.hci.cert;
+
+import "google/protobuf/empty.proto";
+import "facade/common.proto";
+
+service AclManagerCert {
+  rpc SetPageScanMode(PageScanMode) returns (google.protobuf.Empty) {}
+  rpc SetIncomingConnectionPolicy(IncomingConnectionPolicy) returns (google.protobuf.Empty) {}
+  rpc Connect(facade.BluetoothAddress) returns (google.protobuf.Empty) {}
+  rpc Disconnect(facade.BluetoothAddress) returns (google.protobuf.Empty) {}
+  rpc FetchConnectionComplete(facade.EventStreamRequest) returns (stream ConnectionEvent) {}
+  rpc FetchDisconnection(facade.EventStreamRequest) returns (stream DisconnectionEvent) {}
+  rpc FetchConnectionFailed(facade.EventStreamRequest) returns (stream ConnectionFailedEvent) {}
+  rpc SendAclData(AclData) returns (google.protobuf.Empty) {}
+  rpc FetchAclData(facade.EventStreamRequest) returns (stream AclData) {}
+}
+
+message PageScanMode {
+  bool enabled = 1;
+}
+
+message IncomingConnectionPolicy {
+  facade.BluetoothAddress remote = 1;
+  bool accepted = 2;
+}
+
+message ConnectionEvent {
+  facade.BluetoothAddress remote = 1;
+}
+
+message DisconnectionEvent {
+  facade.BluetoothAddress remote = 1;
+  uint32 reason = 2;
+}
+
+message ConnectionFailedEvent {
+  facade.BluetoothAddress remote = 1;
+  uint32 reason = 2;
+}
+
+message AclData {
+  facade.BluetoothAddress remote = 1;
+  bytes payload = 2;
+}
diff --git a/gd/hci/cert/cert.cc b/gd/hci/cert/cert.cc
new file mode 100644
index 0000000..3ca100f
--- /dev/null
+++ b/gd/hci/cert/cert.cc
@@ -0,0 +1,358 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "hci/cert/cert.h"
+
+#include <condition_variable>
+#include <memory>
+#include <mutex>
+#include <set>
+
+#include "common/blocking_queue.h"
+#include "grpc/grpc_event_stream.h"
+#include "hci/cert/api.grpc.pb.h"
+#include "hci/classic_security_manager.h"
+#include "hci/controller.h"
+#include "hci/hci_layer.h"
+#include "hci/hci_packets.h"
+#include "os/queue.h"
+#include "packet/raw_builder.h"
+
+using ::grpc::ServerAsyncResponseWriter;
+using ::grpc::ServerAsyncWriter;
+using ::grpc::ServerContext;
+
+using ::bluetooth::common::Bind;
+using ::bluetooth::common::BindOnce;
+using ::bluetooth::facade::EventStreamRequest;
+using ::bluetooth::packet::RawBuilder;
+
+namespace bluetooth {
+namespace hci {
+namespace cert {
+
+class AclManagerCertService : public AclManagerCert::Service {
+ public:
+  AclManagerCertService(Controller* controller, HciLayer* hci_layer, ::bluetooth::os::Handler* facade_handler)
+      : controller_(controller), hci_layer_(hci_layer), handler_(facade_handler),
+        acl_queue_end_(hci_layer_->GetAclQueueEnd()) {
+    hci_layer_->RegisterEventHandler(EventCode::CONNECTION_COMPLETE,
+                                     Bind(&AclManagerCertService::on_connection_complete, common::Unretained(this)),
+                                     handler_);
+    hci_layer_->RegisterEventHandler(EventCode::DISCONNECTION_COMPLETE,
+                                     Bind(&AclManagerCertService::on_disconnection_complete, common::Unretained(this)),
+                                     handler_);
+    hci_layer_->RegisterEventHandler(EventCode::CONNECTION_REQUEST,
+                                     Bind(&AclManagerCertService::on_incoming_connection, common::Unretained(this)),
+                                     handler_);
+    hci_layer_->RegisterEventHandler(
+        EventCode::CONNECTION_PACKET_TYPE_CHANGED,
+        Bind(&AclManagerCertService::on_connection_packet_type_changed, common::Unretained(this)), handler_);
+    hci_layer_->RegisterEventHandler(EventCode::QOS_SETUP_COMPLETE,
+                                     Bind(&AclManagerCertService::on_qos_setup_complete, common::Unretained(this)),
+                                     handler_);
+    hci_layer_->RegisterEventHandler(EventCode::ROLE_CHANGE,
+                                     Bind(&AclManagerCertService::on_role_change, common::Unretained(this)), handler_);
+
+    controller_->RegisterCompletedAclPacketsCallback(common::Bind([](uint16_t, uint16_t) { /* TODO check */ }),
+                                                     handler_);
+    acl_queue_end_->RegisterDequeue(handler_,
+                                    Bind(&AclManagerCertService::on_incoming_packet, common::Unretained(this)));
+  }
+
+  void on_incoming_packet() {
+    auto packet = acl_queue_end_->TryDequeue();
+    ASSERT(packet->IsValid());
+    AclData acl_data;
+    if (connected_devices_.find(packet->GetHandle()) == connected_devices_.end()) {
+      LOG_ERROR("Can't find remote device");
+      return;
+    }
+    auto address = connected_devices_[packet->GetHandle()];
+    acl_data.mutable_remote()->set_address(address.ToString());
+    std::string data = std::string(packet->begin(), packet->end());
+    acl_data.set_payload(data);
+    acl_stream_.OnIncomingEvent(acl_data);
+  }
+
+  ~AclManagerCertService() {
+    acl_queue_end_->UnregisterDequeue();
+    hci_layer_->UnregisterEventHandler(EventCode::CONNECTION_REQUEST);
+    hci_layer_->UnregisterEventHandler(EventCode::DISCONNECTION_COMPLETE);
+    hci_layer_->UnregisterEventHandler(EventCode::CONNECTION_COMPLETE);
+  }
+
+  void on_connection_complete(EventPacketView packet) {
+    ConnectionCompleteView connection_complete = ConnectionCompleteView::Create(std::move(packet));
+    ASSERT(connection_complete.IsValid());
+    auto status = connection_complete.GetStatus();
+    auto address = connection_complete.GetBdAddr();
+    auto handle = connection_complete.GetConnectionHandle();
+    if (status == ErrorCode::SUCCESS) {
+      connected_devices_.emplace(handle, address);
+      ConnectionEvent event;
+      event.mutable_remote()->set_address(address.ToString());
+      connection_complete_stream_.OnIncomingEvent(event);
+    } else {
+      ConnectionFailedEvent event;
+      event.mutable_remote()->set_address(address.ToString());
+      event.set_reason(static_cast<uint32_t>(connection_complete.GetStatus()));
+      connection_failed_stream_.OnIncomingEvent(event);
+    }
+  }
+
+  void on_disconnection_complete(EventPacketView packet) {
+    DisconnectionCompleteView disconnection_complete = DisconnectionCompleteView::Create(std::move(packet));
+    ASSERT(disconnection_complete.IsValid());
+    auto status = disconnection_complete.GetStatus();
+    auto handle = disconnection_complete.GetConnectionHandle();
+    auto device = connected_devices_.find(handle);
+
+    ASSERT(device != connected_devices_.end());
+    auto address = device->second;
+    if (status == ErrorCode::SUCCESS) {
+      connected_devices_.erase(handle);
+      DisconnectionEvent event;
+      event.mutable_remote()->set_address(address.ToString());
+      event.set_reason(static_cast<uint32_t>(disconnection_complete.GetReason()));
+      disconnection_stream_.OnIncomingEvent(event);
+    }
+  }
+
+  void on_incoming_connection(EventPacketView packet) {
+    ConnectionRequestView request = ConnectionRequestView::Create(packet);
+    ASSERT(request.IsValid());
+    Address address = request.GetBdAddr();
+    if (accepted_devices_.find(address) != accepted_devices_.end()) {
+      auto role = AcceptConnectionRequestRole::BECOME_MASTER;  // We prefer to be master
+      hci_layer_->EnqueueCommand(AcceptConnectionRequestBuilder::Create(address, role),
+                                 common::BindOnce([](CommandStatusView status) { /* TODO: check? */ }), handler_);
+    } else {
+      auto reason = RejectConnectionReason::LIMITED_RESOURCES;
+      auto builder = RejectConnectionRequestBuilder::Create(address, reason);
+      hci_layer_->EnqueueCommand(std::move(builder), BindOnce([](CommandStatusView status) { /* TODO: check? */ }),
+                                 handler_);
+    }
+  }
+
+  void on_connection_packet_type_changed(EventPacketView packet) { /*TODO*/
+  }
+
+  void on_qos_setup_complete(EventPacketView packet) { /*TODO*/
+  }
+
+  void on_role_change(EventPacketView packet) { /*TODO*/
+  }
+
+  using EventStream = ::bluetooth::grpc::GrpcEventStream<AclData, AclPacketView>;
+
+  ::grpc::Status SetPageScanMode(::grpc::ServerContext* context, const ::bluetooth::hci::cert::PageScanMode* request,
+                                 ::google::protobuf::Empty* response) override {
+    ScanEnable scan_enable = request->enabled() ? ScanEnable::PAGE_SCAN_ONLY : ScanEnable::NO_SCANS;
+    std::promise<void> promise;
+    auto future = promise.get_future();
+    hci_layer_->EnqueueCommand(
+        WriteScanEnableBuilder::Create(scan_enable),
+        common::BindOnce([](std::promise<void> promise, CommandCompleteView) { promise.set_value(); },
+                         std::move(promise)),
+        handler_);
+    future.wait();
+    return ::grpc::Status::OK;
+  }
+
+  ::grpc::Status SetIncomingConnectionPolicy(::grpc::ServerContext* context,
+                                             const ::bluetooth::hci::cert::IncomingConnectionPolicy* request,
+                                             ::google::protobuf::Empty* response) override {
+    std::unique_lock<std::mutex> lock(mutex_);
+    Address peer;
+    ASSERT(Address::FromString(request->remote().address(), peer));
+    if (request->accepted()) {
+      accepted_devices_.insert(peer);
+    } else {
+      accepted_devices_.erase(peer);
+    }
+    return ::grpc::Status::OK;
+  }
+
+  ::grpc::Status Connect(::grpc::ServerContext* context, const facade::BluetoothAddress* remote,
+                         ::google::protobuf::Empty* response) override {
+    std::unique_lock<std::mutex> lock(mutex_);
+
+    uint16_t packet_type = 0x4408 /* DM 1,3,5 */ | 0x8810 /*DH 1,3,5 */;
+    PageScanRepetitionMode page_scan_repetition_mode = PageScanRepetitionMode::R1;
+    uint16_t clock_offset = 0;
+    ClockOffsetValid clock_offset_valid = ClockOffsetValid::INVALID;
+    CreateConnectionRoleSwitch allow_role_switch = CreateConnectionRoleSwitch::ALLOW_ROLE_SWITCH;
+
+    Address peer;
+    ASSERT(Address::FromString(remote->address(), peer));
+    std::unique_ptr<CreateConnectionBuilder> packet = CreateConnectionBuilder::Create(
+        peer, packet_type, page_scan_repetition_mode, clock_offset, clock_offset_valid, allow_role_switch);
+
+    hci_layer_->EnqueueCommand(std::move(packet), common::BindOnce([](CommandStatusView status) {
+                                 ASSERT(status.IsValid());
+                                 ASSERT(status.GetCommandOpCode() == OpCode::CREATE_CONNECTION);
+                               }),
+                               handler_);
+
+    return ::grpc::Status::OK;
+  }
+
+  ::grpc::Status Disconnect(::grpc::ServerContext* context, const facade::BluetoothAddress* request,
+                            ::google::protobuf::Empty* response) override {
+    std::unique_lock<std::mutex> lock(mutex_);
+    Address peer;
+    Address::FromString(request->address(), peer);
+    uint16_t handle = find_connected_device_handle_by_address(peer);
+    if (handle == kInvalidHandle) {
+      return ::grpc::Status(::grpc::StatusCode::INVALID_ARGUMENT, "Invalid address");
+    }
+
+    DisconnectReason reason = DisconnectReason::REMOTE_USER_TERMINATED_CONNECTION;
+    std::unique_ptr<DisconnectBuilder> packet = DisconnectBuilder::Create(handle, reason);
+    hci_layer_->EnqueueCommand(std::move(packet), BindOnce([](CommandStatusView status) { /* TODO: check? */ }),
+                               handler_);
+    return ::grpc::Status::OK;
+  }
+
+  ::grpc::Status SendAclData(::grpc::ServerContext* context, const AclData* request,
+                             ::google::protobuf::Empty* response) override {
+    Address peer;
+    Address::FromString(request->remote().address(), peer);
+    auto handle = find_connected_device_handle_by_address(peer);
+    if (handle == kInvalidHandle) {
+      return ::grpc::Status(::grpc::StatusCode::INVALID_ARGUMENT, "Invalid address");
+    }
+
+    constexpr PacketBoundaryFlag packet_boundary_flag = PacketBoundaryFlag::FIRST_AUTOMATICALLY_FLUSHABLE;
+    constexpr BroadcastFlag broadcast_flag = BroadcastFlag::POINT_TO_POINT;
+    std::unique_ptr<RawBuilder> packet = std::make_unique<RawBuilder>();
+    auto req_string = request->payload();
+    packet->AddOctets(std::vector<uint8_t>(req_string.begin(), req_string.end()));
+    auto acl_packet = AclPacketBuilder::Create(handle, packet_boundary_flag, broadcast_flag, std::move(packet));
+    acl_enqueue_buffer_.Enqueue(std::move(acl_packet), handler_);
+    return ::grpc::Status::OK;
+  }
+
+  ::grpc::Status FetchAclData(::grpc::ServerContext* context, const facade::EventStreamRequest* request,
+                              ::grpc::ServerWriter<AclData>* writer) override {
+    return acl_stream_.HandleRequest(context, request, writer);
+  }
+
+  ::grpc::Status FetchConnectionComplete(::grpc::ServerContext* context, const EventStreamRequest* request,
+                                         ::grpc::ServerWriter<ConnectionEvent>* writer) override {
+    return connection_complete_stream_.HandleRequest(context, request, writer);
+  };
+
+  ::grpc::Status FetchConnectionFailed(::grpc::ServerContext* context, const EventStreamRequest* request,
+                                       ::grpc::ServerWriter<ConnectionFailedEvent>* writer) override {
+    return connection_failed_stream_.HandleRequest(context, request, writer);
+  };
+
+  ::grpc::Status FetchDisconnection(::grpc::ServerContext* context,
+                                    const ::bluetooth::facade::EventStreamRequest* request,
+                                    ::grpc::ServerWriter<DisconnectionEvent>* writer) override {
+    return disconnection_stream_.HandleRequest(context, request, writer);
+  }
+
+ private:
+  Controller* controller_;
+  HciLayer* hci_layer_;
+  ::bluetooth::os::Handler* handler_;
+  common::BidiQueueEnd<AclPacketBuilder, AclPacketView>* acl_queue_end_;
+  os::EnqueueBuffer<AclPacketBuilder> acl_enqueue_buffer_{acl_queue_end_};
+  mutable std::mutex mutex_;
+  std::set<Address> accepted_devices_;
+  std::map<uint16_t /* handle */, Address> connected_devices_;
+
+  constexpr static uint16_t kInvalidHandle = 0xffff;
+
+  uint16_t find_connected_device_handle_by_address(Address address) {
+    for (auto device : connected_devices_) {
+      if (device.second == address) {
+        return device.first;
+      }
+    }
+    return kInvalidHandle;  // Can't find
+  }
+
+  class ConnectionCompleteStreamCallback
+      : public ::bluetooth::grpc::GrpcEventStreamCallback<ConnectionEvent, ConnectionEvent> {
+   public:
+    void OnWriteResponse(ConnectionEvent* response, const ConnectionEvent& connection) override {
+      response->CopyFrom(connection);
+    }
+  } connection_complete_stream_callback_;
+  ::bluetooth::grpc::GrpcEventStream<ConnectionEvent, ConnectionEvent> connection_complete_stream_{
+      &connection_complete_stream_callback_};
+
+  class ConnectionFailedStreamCallback
+      : public ::bluetooth::grpc::GrpcEventStreamCallback<ConnectionFailedEvent, ConnectionFailedEvent> {
+   public:
+    void OnWriteResponse(ConnectionFailedEvent* response, const ConnectionFailedEvent& event) override {
+      response->CopyFrom(event);
+    }
+  } connection_failed_stream_callback_;
+  ::bluetooth::grpc::GrpcEventStream<ConnectionFailedEvent, ConnectionFailedEvent> connection_failed_stream_{
+      &connection_failed_stream_callback_};
+
+  class DisconnectionStreamCallback
+      : public ::bluetooth::grpc::GrpcEventStreamCallback<DisconnectionEvent, DisconnectionEvent> {
+   public:
+    void OnWriteResponse(DisconnectionEvent* response, const DisconnectionEvent& event) override {
+      response->CopyFrom(event);
+    }
+  } disconnection_stream_callback_;
+  ::bluetooth::grpc::GrpcEventStream<DisconnectionEvent, DisconnectionEvent> disconnection_stream_{
+      &disconnection_stream_callback_};
+
+  class AclStreamCallback : public ::bluetooth::grpc::GrpcEventStreamCallback<AclData, AclData> {
+   public:
+    void OnWriteResponse(AclData* response, const AclData& event) override {
+      response->CopyFrom(event);
+    }
+
+  } acl_stream_callback_;
+  ::bluetooth::grpc::GrpcEventStream<AclData, AclData> acl_stream_{&acl_stream_callback_};
+};
+
+void AclManagerCertModule::ListDependencies(ModuleList* list) {
+  ::bluetooth::grpc::GrpcFacadeModule::ListDependencies(list);
+  list->add<Controller>();
+  list->add<HciLayer>();
+  list->add<ClassicSecurityManager>();
+}
+
+void AclManagerCertModule::Start() {
+  ::bluetooth::grpc::GrpcFacadeModule::Start();
+  service_ = new AclManagerCertService(GetDependency<Controller>(), GetDependency<HciLayer>(), GetHandler());
+}
+
+void AclManagerCertModule::Stop() {
+  delete service_;
+  ::bluetooth::grpc::GrpcFacadeModule::Stop();
+}
+
+::grpc::Service* AclManagerCertModule::GetService() const {
+  return service_;
+}
+
+const ModuleFactory AclManagerCertModule::Factory =
+    ::bluetooth::ModuleFactory([]() { return new AclManagerCertModule(); });
+
+}  // namespace cert
+}  // namespace hci
+}  // namespace bluetooth
diff --git a/gd/hci/cert/cert.h b/gd/hci/cert/cert.h
new file mode 100644
index 0000000..e3ecf46
--- /dev/null
+++ b/gd/hci/cert/cert.h
@@ -0,0 +1,45 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#pragma once
+
+#include <grpc++/grpc++.h>
+
+#include "grpc/grpc_module.h"
+#include "hci/acl_manager.h"
+
+namespace bluetooth {
+namespace hci {
+namespace cert {
+
+class AclManagerCertService;
+
+class AclManagerCertModule : public ::bluetooth::grpc::GrpcFacadeModule {
+ public:
+  static const ModuleFactory Factory;
+
+  void ListDependencies(ModuleList* list) override;
+  void Start() override;
+  void Stop() override;
+  ::grpc::Service* GetService() const override;
+
+ private:
+  AclManagerCertService* service_;
+};
+
+}  // namespace cert
+}  // namespace hci
+}  // namespace bluetooth
diff --git a/gd/hci/cert/simple_hci_test.py b/gd/hci/cert/simple_hci_test.py
new file mode 100644
index 0000000..5cfd0ee
--- /dev/null
+++ b/gd/hci/cert/simple_hci_test.py
@@ -0,0 +1,346 @@
+#!/usr/bin/env python3
+#
+#   Copyright 2019 - The Android Open Source Project
+#
+#   Licensed under the Apache License, Version 2.0 (the "License");
+#   you may not use this file except in compliance with the License.
+#   You may obtain a copy of the License at
+#
+#       http://www.apache.org/licenses/LICENSE-2.0
+#
+#   Unless required by applicable law or agreed to in writing, software
+#   distributed under the License is distributed on an "AS IS" BASIS,
+#   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+#   See the License for the specific language governing permissions and
+#   limitations under the License.
+
+from __future__ import print_function
+
+import os
+import sys
+sys.path.append(os.environ['ANDROID_BUILD_TOP'] + '/system/bt/gd')
+
+from cert.gd_base_test import GdBaseTestClass
+from cert.event_stream import EventStream
+from cert import rootservice_pb2 as cert_rootservice_pb2
+from facade import common_pb2
+from facade import rootservice_pb2 as facade_rootservice_pb2
+from google.protobuf import empty_pb2
+from hci import facade_pb2 as hci_facade_pb2
+from hci.cert import api_pb2 as hci_cert_pb2
+from hci.cert import api_pb2_grpc as hci_cert_pb2_grpc
+
+class SimpleHciTest(GdBaseTestClass):
+
+    def setup_test(self):
+        self.device_under_test = self.gd_devices[0]
+        self.cert_device = self.gd_cert_devices[0]
+
+        self.device_under_test.rootservice.StartStack(
+            facade_rootservice_pb2.StartStackRequest(
+                module_under_test=facade_rootservice_pb2.BluetoothModule.Value('HCI'),
+            )
+        )
+        self.cert_device.rootservice.StartStack(
+            cert_rootservice_pb2.StartStackRequest(
+                module_to_test=cert_rootservice_pb2.BluetoothModule.Value('HCI'),
+            )
+        )
+
+        self.device_under_test.wait_channel_ready()
+        self.cert_device.wait_channel_ready()
+
+        self.device_under_test.hci.SetPageScanMode(
+            hci_facade_pb2.PageScanMode(enabled=True)
+        )
+        self.cert_device.hci.SetPageScanMode(
+            hci_cert_pb2.PageScanMode(enabled=True)
+        )
+
+        dut_address = self.device_under_test.controller_read_only_property.ReadLocalAddress(empty_pb2.Empty()).address
+        self.device_under_test.address = dut_address
+        cert_address = self.cert_device.controller_read_only_property.ReadLocalAddress(empty_pb2.Empty()).address
+        self.cert_device.address = cert_address
+
+        self.dut_connection_complete_stream = self.device_under_test.hci.connection_complete_stream
+        self.dut_disconnection_stream = self.device_under_test.hci.disconnection_stream
+        self.dut_connection_failed_stream = self.device_under_test.hci.connection_failed_stream
+        self.dut_command_complete_stream = self.device_under_test.hci_classic_security.command_complete_stream
+
+        self.dut_address = common_pb2.BluetoothAddress(
+            address=self.device_under_test.address)
+        self.cert_address = common_pb2.BluetoothAddress(
+            address=self.cert_device.address)
+
+    def teardown_test(self):
+        self.device_under_test.rootservice.StopStack(
+            facade_rootservice_pb2.StopStackRequest()
+        )
+        self.cert_device.rootservice.StopStack(
+            cert_rootservice_pb2.StopStackRequest()
+        )
+
+    def test_none_event(self):
+        self.dut_connection_complete_stream.clear_event_buffer()
+        self.dut_connection_complete_stream.subscribe()
+        self.dut_connection_complete_stream.assert_none()
+        self.dut_connection_complete_stream.unsubscribe()
+
+    def _connect_from_dut(self):
+        policy = hci_cert_pb2.IncomingConnectionPolicy(
+            remote=self.dut_address,
+            accepted=True
+        )
+        self.cert_device.hci.SetIncomingConnectionPolicy(policy)
+
+        self.dut_connection_complete_stream.subscribe()
+        self.device_under_test.hci.Connect(self.cert_address)
+        self.dut_connection_complete_stream.assert_event_occurs(
+            lambda event: self._get_handle(event)
+        )
+        self.dut_connection_complete_stream.unsubscribe()
+
+    def _disconnect_from_dut(self):
+        self.dut_disconnection_stream.subscribe()
+        self.device_under_test.hci.Disconnect(self.cert_address)
+        self.dut_disconnection_stream.assert_event_occurs(
+            lambda event: event.remote.address == self.cert_device.address
+        )
+
+    def _get_handle(self, event):
+        if event.remote.address == self.cert_device.address:
+            self.connection_handle = event.connection_handle
+            return True
+        return False
+
+    def test_connect_disconnect_send_acl(self):
+        self._connect_from_dut()
+
+        cert_acl_stream = self.cert_device.hci.acl_stream
+        cert_acl_stream.subscribe()
+        acl_data = hci_facade_pb2.AclData(remote=self.cert_address, payload=b'123')
+        self.device_under_test.hci.SendAclData(acl_data)
+        self.device_under_test.hci.SendAclData(acl_data)
+        self.device_under_test.hci.SendAclData(acl_data)
+        cert_acl_stream.assert_event_occurs(
+            lambda packet : b'123' in packet.payload
+            and packet.remote == self.dut_address
+        )
+        cert_acl_stream.unsubscribe()
+
+        self._disconnect_from_dut()
+
+    def test_connect_disconnect_receive_acl(self):
+        self._connect_from_dut()
+
+        self.device_under_test.hci.acl_stream.subscribe()
+        acl_data = hci_cert_pb2.AclData(remote=self.dut_address, payload=b'123')
+        self.cert_device.hci.SendAclData(acl_data)
+        self.cert_device.hci.SendAclData(acl_data)
+        self.cert_device.hci.SendAclData(acl_data)
+        self.device_under_test.hci.acl_stream.assert_event_occurs(
+            lambda packet : b'123' in packet.payload
+            and packet.remote == self.cert_address
+        )
+        self.device_under_test.hci.acl_stream.unsubscribe()
+
+        self._disconnect_from_dut()
+
+    def test_reject_connection_request(self):
+        self.dut_connection_failed_stream.subscribe()
+        self.device_under_test.hci.Connect(self.cert_address)
+        self.dut_connection_failed_stream.assert_event_occurs(
+            lambda event : event.remote == self.cert_address
+        )
+        self.dut_connection_failed_stream.unsubscribe()
+
+    def test_send_classic_security_command(self):
+        self._connect_from_dut()
+        self.dut_command_complete_stream.subscribe()
+
+        self.device_under_test.hci.AuthenticationRequested(self.cert_address)
+
+        # Link request
+        self.device_under_test.hci_classic_security.LinkKeyRequestNegativeReply(self.cert_address)
+        self.dut_command_complete_stream.assert_event_occurs(
+            lambda event: event.command_opcode == 0x040c
+        )
+
+        # Pin code request
+        message = hci_facade_pb2.PinCodeRequestReplyMessage(
+            remote=self.cert_address,
+            len=4,
+            pin_code=bytes("1234", encoding = "ASCII")
+        )
+        self.device_under_test.hci_classic_security.PinCodeRequestReply(message)
+        self.dut_command_complete_stream.assert_event_occurs(
+            lambda event: event.command_opcode == 0x040d
+        )
+        self.device_under_test.hci_classic_security.PinCodeRequestNegativeReply(self.cert_address)
+        self.dut_command_complete_stream.assert_event_occurs(
+            lambda event: event.command_opcode == 0x040e
+        )
+
+        # IO capability request
+        message = hci_facade_pb2.IoCapabilityRequestReplyMessage(
+            remote=self.cert_address,
+            io_capability=0,
+            oob_present=0,
+            authentication_requirements=0
+        )
+        self.device_under_test.hci_classic_security.IoCapabilityRequestReply(message)
+        self.dut_command_complete_stream.assert_event_occurs(
+            lambda event: event.command_opcode == 0x042b
+        )
+
+        # message = hci_facade_pb2.IoCapabilityRequestNegativeReplyMessage(
+        #     remote=self.cert_address,
+        #     reason=1
+        # )
+        # # link_layer_controller.cc(447)] Check failed: security_manager_.GetAuthenticationAddress() == peer
+        # self.device_under_test.hci_classic_security.IoCapabilityRequestNegativeReply(message)
+
+        # User confirm request
+        self.device_under_test.hci_classic_security.UserConfirmationRequestReply(self.cert_address)
+        self.dut_command_complete_stream.assert_event_occurs(
+            lambda event: event.command_opcode == 0x042c
+        )
+
+        message = hci_facade_pb2.LinkKeyRequestReplyMessage(
+            remote=self.cert_address,
+            link_key=bytes("4C68384139F574D836BCF34E9DFB01BF", encoding = "ASCII")
+        )
+        self.device_under_test.hci_classic_security.LinkKeyRequestReply(message)
+        self.dut_command_complete_stream.assert_event_occurs(
+            lambda event: event.command_opcode == 0x040b
+        )
+
+        self.device_under_test.hci_classic_security.UserConfirmationRequestNegativeReply(self.cert_address)
+        self.dut_command_complete_stream.assert_event_occurs(
+            lambda event: event.command_opcode == 0x042d
+        )
+
+        # User passkey request
+        message = hci_facade_pb2.UserPasskeyRequestReplyMessage(
+            remote=self.cert_address,
+            passkey=999999,
+        )
+        self.device_under_test.hci_classic_security.UserPasskeyRequestReply(message)
+        self.dut_command_complete_stream.assert_event_occurs(
+            lambda event: event.command_opcode == 0x042e
+        )
+
+        self.device_under_test.hci_classic_security.UserPasskeyRequestNegativeReply(self.cert_address)
+        self.dut_command_complete_stream.assert_event_occurs(
+            lambda event: event.command_opcode == 0x042f
+        )
+
+        # Remote OOB data request
+        message = hci_facade_pb2.RemoteOobDataRequestReplyMessage(
+            remote=self.cert_address,
+            c=b'\x19\x20\x21\x22\x23\x24\x25\x26\x19\x20\x21\x22\x23\x24\x25\x26',
+            r=b'\x30\x31\x32\x33\x34\x35\x36\x37\x30\x31\x32\x33\x34\x35\x36\x37',
+        )
+        self.device_under_test.hci_classic_security.RemoteOobDataRequestReply(message)
+        self.dut_command_complete_stream.assert_event_occurs(
+            lambda event: event.command_opcode == 0x0430
+        )
+        self.device_under_test.hci_classic_security.RemoteOobDataRequestNegativeReply(self.cert_address)
+        self.dut_command_complete_stream.assert_event_occurs(
+            lambda event: event.command_opcode == 0x0433
+        )
+
+        # Read/Write/Delete link key
+        message = hci_facade_pb2.ReadStoredLinkKeyMessage(
+            remote=self.cert_address,
+            read_all_flag = 0,
+        )
+        self.device_under_test.hci_classic_security.ReadStoredLinkKey(message)
+        self.dut_command_complete_stream.assert_event_occurs(
+            lambda event: event.command_opcode == 0x0c0d
+        )
+
+        message = hci_facade_pb2.WriteStoredLinkKeyMessage(
+            num_keys_to_write=1,
+            remote=self.cert_address,
+            link_keys=bytes("4C68384139F574D836BCF34E9DFB01BF", encoding = "ASCII"),
+        )
+        self.device_under_test.hci_classic_security.WriteStoredLinkKey(message)
+
+        self.dut_command_complete_stream.assert_event_occurs(
+            lambda event: event.command_opcode == 0x0c11
+        )
+
+        message = hci_facade_pb2.DeleteStoredLinkKeyMessage(
+            remote=self.cert_address,
+            delete_all_flag = 0,
+        )
+        self.device_under_test.hci_classic_security.DeleteStoredLinkKey(message)
+        self.dut_command_complete_stream.assert_event_occurs(
+            lambda event: event.command_opcode == 0x0c12
+        )
+
+        # Refresh Encryption Key
+        message = hci_facade_pb2.RefreshEncryptionKeyMessage(
+            connection_handle=self.connection_handle,
+        )
+        self.device_under_test.hci_classic_security.RefreshEncryptionKey(message)
+
+        # Read/Write Simple Pairing Mode
+        self.device_under_test.hci_classic_security.ReadSimplePairingMode(empty_pb2.Empty())
+        self.dut_command_complete_stream.assert_event_occurs(
+            lambda event: event.command_opcode == 0x0c55
+        )
+
+        message = hci_facade_pb2.WriteSimplePairingModeMessage(
+            simple_pairing_mode=1,
+        )
+        self.device_under_test.hci_classic_security.WriteSimplePairingMode(message)
+        self.dut_command_complete_stream.assert_event_occurs(
+            lambda event: event.command_opcode == 0x0c56
+        )
+
+        # Read local oob data
+        self.device_under_test.hci_classic_security.ReadLocalOobData(empty_pb2.Empty())
+        self.dut_command_complete_stream.assert_event_occurs(
+            lambda event: event.command_opcode == 0x0c57
+        )
+
+        # Send keypress notification
+        message = hci_facade_pb2.SendKeypressNotificationMessage(
+            remote=self.cert_address,
+            notification_type=1,
+        )
+        self.device_under_test.hci_classic_security.SendKeypressNotification(message)
+        self.dut_command_complete_stream.assert_event_occurs(
+            lambda event: event.command_opcode == 0x0c60
+        )
+
+        # Read local oob extended data
+        self.device_under_test.hci_classic_security.ReadLocalOobExtendedData(empty_pb2.Empty())
+        self.dut_command_complete_stream.assert_event_occurs(
+            lambda event: event.command_opcode == 0x0c7d
+        )
+
+        # Read Encryption key size
+        message = hci_facade_pb2.ReadEncryptionKeySizeMessage(
+            connection_handle=self.connection_handle,
+        )
+        self.device_under_test.hci_classic_security.ReadEncryptionKeySize(message)
+        self.dut_command_complete_stream.assert_event_occurs(
+            lambda event: event.command_opcode == 0x1408
+        )
+
+        self.dut_command_complete_stream.unsubscribe()
+        self._disconnect_from_dut()
+
+    def test_interal_hci_command(self):
+        self._connect_from_dut()
+        self.device_under_test.hci.TestInternalHciCommands(empty_pb2.Empty())
+        self.device_under_test.hci.TestInternalHciLeCommands(empty_pb2.Empty())
+        self._disconnect_from_dut()
+
+    def test_classic_connection_management_command(self):
+        self._connect_from_dut()
+        self.device_under_test.hci.TestClassicConnectionManagementCommands(self.cert_address)
+        self._disconnect_from_dut()
\ No newline at end of file
diff --git a/gd/common/class_of_device.cc b/gd/hci/class_of_device.cc
similarity index 92%
rename from gd/common/class_of_device.cc
rename to gd/hci/class_of_device.cc
index 8d7ff68..36dd292 100644
--- a/gd/common/class_of_device.cc
+++ b/gd/hci/class_of_device.cc
@@ -26,7 +26,7 @@
 #include "os/log.h"
 
 namespace bluetooth {
-namespace common {
+namespace hci {
 
 static_assert(sizeof(ClassOfDevice) == ClassOfDevice::kLength, "ClassOfDevice must be 3 bytes long!");
 
@@ -36,11 +36,10 @@
 
 std::string ClassOfDevice::ToString() const {
   char buffer[] = "000-0-00";
-  std::snprintf(&buffer[0], sizeof(buffer),
-      "%03x-%01x-%02x", (static_cast<uint16_t>(cod[2]) << 4) | cod[1] >> 4, cod[1] & 0x0f, cod[0]);
+  std::snprintf(&buffer[0], sizeof(buffer), "%03x-%01x-%02x", (static_cast<uint16_t>(cod[2]) << 4) | cod[1] >> 4,
+                cod[1] & 0x0f, cod[0]);
   std::string str(buffer);
   return str;
-
 }
 
 bool ClassOfDevice::FromString(const std::string& from, ClassOfDevice& to) {
@@ -94,5 +93,5 @@
   ClassOfDevice tmp;
   return ClassOfDevice::FromString(cod, tmp);
 }
-}  // namespace common
+}  // namespace hci
 }  // namespace bluetooth
diff --git a/gd/common/class_of_device.h b/gd/hci/class_of_device.h
similarity index 92%
rename from gd/common/class_of_device.h
rename to gd/hci/class_of_device.h
index 983f128..b44a45e 100644
--- a/gd/common/class_of_device.h
+++ b/gd/hci/class_of_device.h
@@ -21,7 +21,7 @@
 #include <string>
 
 namespace bluetooth {
-namespace common {
+namespace hci {
 
 class ClassOfDevice final {
  public:
@@ -36,6 +36,10 @@
     return (std::memcmp(cod, rhs.cod, sizeof(cod)) == 0);
   }
 
+  bool operator!=(const ClassOfDevice& rhs) const {
+    return std::memcmp(cod, rhs.cod, sizeof(cod)) != 0;
+  }
+
   std::string ToString() const;
 
   // Converts |string| to ClassOfDevice and places it in |to|. If |from| does
@@ -55,5 +59,5 @@
   return os;
 }
 
-}  // namespace common
+}  // namespace hci
 }  // namespace bluetooth
diff --git a/gd/common/class_of_device_unittest.cc b/gd/hci/class_of_device_unittest.cc
similarity index 97%
rename from gd/common/class_of_device_unittest.cc
rename to gd/hci/class_of_device_unittest.cc
index abd4a59..85472dd 100644
--- a/gd/common/class_of_device_unittest.cc
+++ b/gd/hci/class_of_device_unittest.cc
@@ -18,9 +18,9 @@
 
 #include <gtest/gtest.h>
 
-#include "common/class_of_device.h"
+#include "hci/class_of_device.h"
 
-using bluetooth::common::ClassOfDevice;
+using bluetooth::hci::ClassOfDevice;
 
 static const char* test_class = "efc-d-ab";
 static const uint8_t test_bytes[]{0xab, 0xcd, 0xef};
diff --git a/gd/hci/classic_device.h b/gd/hci/classic_device.h
new file mode 100644
index 0000000..53ff0ba
--- /dev/null
+++ b/gd/hci/classic_device.h
@@ -0,0 +1,35 @@
+/******************************************************************************
+ *
+ *  Copyright 2019 The Android Open Source Project
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at:
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ ******************************************************************************/
+#pragma once
+
+#include "hci/device.h"
+
+namespace bluetooth::hci {
+
+/**
+ * A device representing a CLASSIC device.
+ *
+ * <p>This can be a CLASSIC only or a piece of a DUAL MODE device.
+ */
+class ClassicDevice : public Device {
+ protected:
+  friend class DeviceDatabase;
+  explicit ClassicDevice(Address address) : Device(address, DeviceType::CLASSIC) {}
+};
+
+}  // namespace bluetooth::hci
diff --git a/gd/hci/classic_security_manager.cc b/gd/hci/classic_security_manager.cc
new file mode 100644
index 0000000..ae9efef
--- /dev/null
+++ b/gd/hci/classic_security_manager.cc
@@ -0,0 +1,364 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "classic_security_manager.h"
+
+#include <future>
+#include <set>
+#include <utility>
+#include "os/log.h"
+
+#include "acl_manager.h"
+#include "common/bidi_queue.h"
+#include "hci/controller.h"
+#include "hci/hci_layer.h"
+
+namespace bluetooth {
+namespace hci {
+
+using common::Bind;
+using common::BindOnce;
+
+struct ClassicSecurityManager::impl {
+  impl(ClassicSecurityManager& classic_security_manager) : classic_security_manager_(classic_security_manager) {}
+
+  void Start() {
+    hci_layer_ = classic_security_manager_.GetDependency<HciLayer>();
+    handler_ = classic_security_manager_.GetHandler();
+    hci_layer_->RegisterEventHandler(EventCode::IO_CAPABILITY_REQUEST,
+                                     Bind(&impl::on_request_event, common::Unretained(this)), handler_);
+    hci_layer_->RegisterEventHandler(EventCode::LINK_KEY_REQUEST,
+                                     Bind(&impl::on_request_event, common::Unretained(this)), handler_);
+    hci_layer_->RegisterEventHandler(EventCode::PIN_CODE_REQUEST,
+                                     Bind(&impl::on_request_event, common::Unretained(this)), handler_);
+    hci_layer_->RegisterEventHandler(EventCode::ENCRYPTION_KEY_REFRESH_COMPLETE,
+                                     Bind(&impl::on_complete_event, common::Unretained(this)), handler_);
+  }
+
+  void Stop() {
+    hci_layer_->UnregisterEventHandler(EventCode::IO_CAPABILITY_REQUEST);
+    handler_ = nullptr;
+    hci_layer_ = nullptr;
+  }
+
+  void handle_register_callbacks(ClassicSecurityCommandCallbacks* callbacks, os::Handler* handler) {
+    ASSERT(client_callbacks_ == nullptr);
+    ASSERT(client_handler_ == nullptr);
+    client_callbacks_ = callbacks;
+    client_handler_ = handler;
+  }
+
+  void link_key_request_reply(Address address, common::LinkKey link_key) {
+    std::array<uint8_t, 16> link_key_array;
+    std::copy(std::begin(link_key.link_key), std::end(link_key.link_key), std::begin(link_key_array));
+
+    std::unique_ptr<LinkKeyRequestReplyBuilder> packet = LinkKeyRequestReplyBuilder::Create(address, link_key_array);
+    hci_layer_->EnqueueCommand(std::move(packet),
+                               common::BindOnce(&impl::on_command_complete, common::Unretained(this)), handler_);
+  }
+
+  void link_key_request_negative_reply(Address address) {
+    std::unique_ptr<LinkKeyRequestNegativeReplyBuilder> packet = LinkKeyRequestNegativeReplyBuilder::Create(address);
+
+    hci_layer_->EnqueueCommand(std::move(packet),
+                               common::BindOnce(&impl::on_command_complete, common::Unretained(this)), handler_);
+  }
+
+  void pin_code_request_reply(Address address, uint8_t len, std::string pin_code) {
+    ASSERT(len > 0 && len <= 16 && pin_code.length() == len);
+    // fill remaining char with 0
+    pin_code.append(std::string(16 - len, '0'));
+    std::array<uint8_t, 16> pin_code_array;
+    std::copy(std::begin(pin_code), std::end(pin_code), std::begin(pin_code_array));
+
+    std::unique_ptr<PinCodeRequestReplyBuilder> packet =
+        PinCodeRequestReplyBuilder::Create(address, len, pin_code_array);
+    hci_layer_->EnqueueCommand(std::move(packet),
+                               common::BindOnce(&impl::on_command_complete, common::Unretained(this)), handler_);
+  }
+
+  void pin_code_request_negative_reply(Address address) {
+    std::unique_ptr<PinCodeRequestNegativeReplyBuilder> packet = PinCodeRequestNegativeReplyBuilder::Create(address);
+    hci_layer_->EnqueueCommand(std::move(packet),
+                               common::BindOnce(&impl::on_command_complete, common::Unretained(this)), handler_);
+  }
+
+  void io_capability_request_reply(Address address, IoCapability io_capability, OobDataPresent oob_present,
+                                   AuthenticationRequirements authentication_requirements) {
+    std::unique_ptr<IoCapabilityRequestReplyBuilder> packet =
+        IoCapabilityRequestReplyBuilder::Create(address, io_capability, oob_present, authentication_requirements);
+    hci_layer_->EnqueueCommand(std::move(packet),
+                               common::BindOnce(&impl::on_command_complete, common::Unretained(this)), handler_);
+  }
+
+  void io_capability_request_negative_reply(Address address, ErrorCode reason) {
+    std::unique_ptr<IoCapabilityRequestNegativeReplyBuilder> packet =
+        IoCapabilityRequestNegativeReplyBuilder::Create(address, reason);
+    hci_layer_->EnqueueCommand(std::move(packet),
+                               common::BindOnce(&impl::on_command_complete, common::Unretained(this)), handler_);
+  }
+
+  void user_confirmation_request_reply(Address address) {
+    std::unique_ptr<UserConfirmationRequestReplyBuilder> packet = UserConfirmationRequestReplyBuilder::Create(address);
+    hci_layer_->EnqueueCommand(std::move(packet),
+                               common::BindOnce(&impl::on_command_complete, common::Unretained(this)), handler_);
+  }
+
+  void user_confirmation_request_negative_reply(Address address) {
+    std::unique_ptr<UserConfirmationRequestNegativeReplyBuilder> packet =
+        UserConfirmationRequestNegativeReplyBuilder::Create(address);
+    hci_layer_->EnqueueCommand(std::move(packet),
+                               common::BindOnce(&impl::on_command_complete, common::Unretained(this)), handler_);
+  }
+
+  void user_passkey_request_reply(Address address, uint32_t passkey) {
+    ASSERT(passkey <= 999999);
+    std::unique_ptr<UserPasskeyRequestReplyBuilder> packet = UserPasskeyRequestReplyBuilder::Create(address, passkey);
+    hci_layer_->EnqueueCommand(std::move(packet),
+                               common::BindOnce(&impl::on_command_complete, common::Unretained(this)), handler_);
+  }
+
+  void user_passkey_request_negative_reply(Address address) {
+    std::unique_ptr<UserPasskeyRequestNegativeReplyBuilder> packet =
+        UserPasskeyRequestNegativeReplyBuilder::Create(address);
+    hci_layer_->EnqueueCommand(std::move(packet),
+                               common::BindOnce(&impl::on_command_complete, common::Unretained(this)), handler_);
+  }
+
+  void remote_oob_data_request_reply(Address address, std::array<uint8_t, 16> c, std::array<uint8_t, 16> r) {
+    std::unique_ptr<RemoteOobDataRequestReplyBuilder> packet = RemoteOobDataRequestReplyBuilder::Create(address, c, r);
+    hci_layer_->EnqueueCommand(std::move(packet),
+                               common::BindOnce(&impl::on_command_complete, common::Unretained(this)), handler_);
+  }
+
+  void remote_oob_data_request_negative_reply(Address address) {
+    std::unique_ptr<RemoteOobDataRequestNegativeReplyBuilder> packet =
+        RemoteOobDataRequestNegativeReplyBuilder::Create(address);
+    hci_layer_->EnqueueCommand(std::move(packet),
+                               common::BindOnce(&impl::on_command_complete, common::Unretained(this)), handler_);
+  }
+
+  void read_stored_link_key(Address address, ReadStoredLinkKeyReadAllFlag read_all_flag) {
+    std::unique_ptr<ReadStoredLinkKeyBuilder> packet = ReadStoredLinkKeyBuilder::Create(address, read_all_flag);
+    hci_layer_->EnqueueCommand(std::move(packet),
+                               common::BindOnce(&impl::on_command_complete, common::Unretained(this)), handler_);
+  }
+
+  void write_stored_link_key(std::vector<KeyAndAddress> keys) {
+    std::unique_ptr<WriteStoredLinkKeyBuilder> packet = WriteStoredLinkKeyBuilder::Create(keys);
+    hci_layer_->EnqueueCommand(std::move(packet),
+                               common::BindOnce(&impl::on_command_complete, common::Unretained(this)), handler_);
+  }
+
+  void delete_stored_link_key(Address address, DeleteStoredLinkKeyDeleteAllFlag delete_all_flag) {
+    std::unique_ptr<DeleteStoredLinkKeyBuilder> packet = DeleteStoredLinkKeyBuilder::Create(address, delete_all_flag);
+    hci_layer_->EnqueueCommand(std::move(packet),
+                               common::BindOnce(&impl::on_command_complete, common::Unretained(this)), handler_);
+  }
+
+  void refresh_encryption_key(uint16_t connection_handle) {
+    std::unique_ptr<RefreshEncryptionKeyBuilder> packet = RefreshEncryptionKeyBuilder::Create(connection_handle);
+    hci_layer_->EnqueueCommand(std::move(packet), common::BindOnce([](CommandStatusView status) { /* TODO: check? */ }),
+                               handler_);
+  }
+
+  void read_simple_pairing_mode() {
+    std::unique_ptr<ReadSimplePairingModeBuilder> packet = ReadSimplePairingModeBuilder::Create();
+    hci_layer_->EnqueueCommand(std::move(packet),
+                               common::BindOnce(&impl::on_command_complete, common::Unretained(this)), handler_);
+  }
+
+  void write_simple_pairing_mode(Enable connection_handle) {
+    std::unique_ptr<WriteSimplePairingModeBuilder> packet = WriteSimplePairingModeBuilder::Create(connection_handle);
+    hci_layer_->EnqueueCommand(std::move(packet),
+                               common::BindOnce(&impl::on_command_complete, common::Unretained(this)), handler_);
+  }
+
+  void read_local_oob_data() {
+    std::unique_ptr<ReadLocalOobDataBuilder> packet = ReadLocalOobDataBuilder::Create();
+    hci_layer_->EnqueueCommand(std::move(packet),
+                               common::BindOnce(&impl::on_command_complete, common::Unretained(this)), handler_);
+  }
+
+  void send_keypress_notification(Address address, KeypressNotificationType notification_type) {
+    std::unique_ptr<SendKeypressNotificationBuilder> packet =
+        SendKeypressNotificationBuilder::Create(address, notification_type);
+    hci_layer_->EnqueueCommand(std::move(packet),
+                               common::BindOnce(&impl::on_command_complete, common::Unretained(this)), handler_);
+  }
+
+  void read_local_oob_extended_data() {
+    std::unique_ptr<ReadLocalOobExtendedDataBuilder> packet = ReadLocalOobExtendedDataBuilder::Create();
+    hci_layer_->EnqueueCommand(std::move(packet),
+                               common::BindOnce(&impl::on_command_complete, common::Unretained(this)), handler_);
+  }
+
+  void read_encryption_key_size(uint16_t connection_handle) {
+    std::unique_ptr<ReadEncryptionKeySizeBuilder> packet = ReadEncryptionKeySizeBuilder::Create(connection_handle);
+    hci_layer_->EnqueueCommand(std::move(packet),
+                               common::BindOnce(&impl::on_command_complete, common::Unretained(this)), handler_);
+  }
+
+  // TODO remove
+  void on_request_event(EventPacketView packet) {
+    EventCode event_code = packet.GetEventCode();
+    LOG_DEBUG("receive request %d", (uint8_t)event_code);
+  }
+
+  // TODO remove
+  void on_complete_event(EventPacketView packet) {
+    EventCode event_code = packet.GetEventCode();
+    LOG_DEBUG("receive complete event %d", (uint8_t)event_code);
+  }
+
+  void on_command_complete(CommandCompleteView status) {
+    if (client_handler_ != nullptr) {
+      client_handler_->Post(common::BindOnce(&ClassicSecurityCommandCallbacks::OnCommandComplete,
+                                             common::Unretained(client_callbacks_), status));
+    }
+  }
+
+  ClassicSecurityManager& classic_security_manager_;
+
+  Controller* controller_ = nullptr;
+
+  HciLayer* hci_layer_ = nullptr;
+  os::Handler* handler_ = nullptr;
+  ClassicSecurityCommandCallbacks* client_callbacks_ = nullptr;
+  os::Handler* client_handler_ = nullptr;
+};
+
+ClassicSecurityManager::ClassicSecurityManager() : pimpl_(std::make_unique<impl>(*this)) {}
+
+bool ClassicSecurityManager::RegisterCallbacks(ClassicSecurityCommandCallbacks* callbacks, os::Handler* handler) {
+  ASSERT(callbacks != nullptr && handler != nullptr);
+  GetHandler()->Post(common::BindOnce(&impl::handle_register_callbacks, common::Unretained(pimpl_.get()),
+                                      common::Unretained(callbacks), common::Unretained(handler)));
+  return true;
+}
+
+void ClassicSecurityManager::LinkKeyRequestReply(Address address, common::LinkKey link_key) {
+  GetHandler()->Post(BindOnce(&impl::link_key_request_reply, common::Unretained(pimpl_.get()), address, link_key));
+}
+
+void ClassicSecurityManager::LinkKeyRequestNegativeReply(Address address) {
+  GetHandler()->Post(BindOnce(&impl::link_key_request_negative_reply, common::Unretained(pimpl_.get()), address));
+}
+
+void ClassicSecurityManager::PinCodeRequestReply(Address address, uint8_t len, std::string pin_code) {
+  GetHandler()->Post(BindOnce(&impl::pin_code_request_reply, common::Unretained(pimpl_.get()), address, len, pin_code));
+}
+
+void ClassicSecurityManager::PinCodeRequestNegativeReply(Address address) {
+  GetHandler()->Post(BindOnce(&impl::pin_code_request_negative_reply, common::Unretained(pimpl_.get()), address));
+}
+
+void ClassicSecurityManager::IoCapabilityRequestReply(Address address, IoCapability io_capability,
+                                                      OobDataPresent oob_present,
+                                                      AuthenticationRequirements authentication_requirements) {
+  GetHandler()->Post(BindOnce(&impl::io_capability_request_reply, common::Unretained(pimpl_.get()), address,
+                              io_capability, oob_present, authentication_requirements));
+}
+
+void ClassicSecurityManager::IoCapabilityRequestNegativeReply(Address address, ErrorCode reason) {
+  GetHandler()->Post(
+      BindOnce(&impl::io_capability_request_negative_reply, common::Unretained(pimpl_.get()), address, reason));
+}
+
+void ClassicSecurityManager::UserConfirmationRequestReply(Address address) {
+  GetHandler()->Post(BindOnce(&impl::user_confirmation_request_reply, common::Unretained(pimpl_.get()), address));
+}
+
+void ClassicSecurityManager::UserConfirmationRequestNegativeReply(Address address) {
+  GetHandler()->Post(
+      BindOnce(&impl::user_confirmation_request_negative_reply, common::Unretained(pimpl_.get()), address));
+}
+
+void ClassicSecurityManager::UserPasskeyRequestReply(bluetooth::hci::Address address, uint32_t passkey) {
+  GetHandler()->Post(BindOnce(&impl::user_passkey_request_reply, common::Unretained(pimpl_.get()), address, passkey));
+}
+
+void ClassicSecurityManager::UserPasskeyRequestNegativeReply(Address address) {
+  GetHandler()->Post(BindOnce(&impl::user_passkey_request_negative_reply, common::Unretained(pimpl_.get()), address));
+}
+
+void ClassicSecurityManager::RemoteOobDataRequestReply(Address address, std::array<uint8_t, 16> c,
+                                                       std::array<uint8_t, 16> r) {
+  GetHandler()->Post(BindOnce(&impl::remote_oob_data_request_reply, common::Unretained(pimpl_.get()), address, c, r));
+}
+
+void ClassicSecurityManager::RemoteOobDataRequestNegativeReply(Address address) {
+  GetHandler()->Post(
+      BindOnce(&impl::remote_oob_data_request_negative_reply, common::Unretained(pimpl_.get()), address));
+}
+
+void ClassicSecurityManager::ReadStoredLinkKey(Address address, ReadStoredLinkKeyReadAllFlag read_all_flag) {
+  GetHandler()->Post(BindOnce(&impl::read_stored_link_key, common::Unretained(pimpl_.get()), address, read_all_flag));
+}
+
+void ClassicSecurityManager::WriteStoredLinkKey(std::vector<KeyAndAddress> keys) {
+  GetHandler()->Post(BindOnce(&impl::write_stored_link_key, common::Unretained(pimpl_.get()), keys));
+}
+
+void ClassicSecurityManager::DeleteStoredLinkKey(Address address, DeleteStoredLinkKeyDeleteAllFlag delete_all_flag) {
+  GetHandler()->Post(
+      BindOnce(&impl::delete_stored_link_key, common::Unretained(pimpl_.get()), address, delete_all_flag));
+}
+
+void ClassicSecurityManager::RefreshEncryptionKey(uint16_t connection_handle) {
+  GetHandler()->Post(BindOnce(&impl::refresh_encryption_key, common::Unretained(pimpl_.get()), connection_handle));
+}
+void ClassicSecurityManager::ReadSimplePairingMode() {
+  GetHandler()->Post(BindOnce(&impl::read_simple_pairing_mode, common::Unretained(pimpl_.get())));
+}
+
+void ClassicSecurityManager::WriteSimplePairingMode(Enable simple_pairing_mode) {
+  GetHandler()->Post(BindOnce(&impl::write_simple_pairing_mode, common::Unretained(pimpl_.get()), simple_pairing_mode));
+}
+
+void ClassicSecurityManager::ReadLocalOobData() {
+  GetHandler()->Post(BindOnce(&impl::read_local_oob_data, common::Unretained(pimpl_.get())));
+}
+
+void ClassicSecurityManager::SendKeypressNotification(Address address, KeypressNotificationType notification_type) {
+  GetHandler()->Post(
+      BindOnce(&impl::send_keypress_notification, common::Unretained(pimpl_.get()), address, notification_type));
+}
+
+void ClassicSecurityManager::ReadLocalOobExtendedData() {
+  GetHandler()->Post(BindOnce(&impl::read_local_oob_extended_data, common::Unretained(pimpl_.get())));
+}
+
+void ClassicSecurityManager::ReadEncryptionKeySize(uint16_t connection_handle) {
+  GetHandler()->Post(BindOnce(&impl::read_encryption_key_size, common::Unretained(pimpl_.get()), connection_handle));
+}
+
+void ClassicSecurityManager::ListDependencies(ModuleList* list) {
+  list->add<HciLayer>();
+}
+
+void ClassicSecurityManager::Start() {
+  pimpl_->Start();
+}
+
+void ClassicSecurityManager::Stop() {
+  pimpl_->Stop();
+}
+
+const ModuleFactory ClassicSecurityManager::Factory = ModuleFactory([]() { return new ClassicSecurityManager(); });
+
+}  // namespace hci
+}  // namespace bluetooth
diff --git a/gd/hci/classic_security_manager.h b/gd/hci/classic_security_manager.h
new file mode 100644
index 0000000..7d2a99e
--- /dev/null
+++ b/gd/hci/classic_security_manager.h
@@ -0,0 +1,79 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#pragma once
+
+#include "common/link_key.h"
+#include "hci/address.h"
+#include "hci/hci_packets.h"
+#include "module.h"
+
+namespace bluetooth {
+namespace hci {
+
+class ClassicSecurityCommandCallbacks {
+ public:
+  virtual ~ClassicSecurityCommandCallbacks() = default;
+  // Invoked when controller sends Command Complete event
+  virtual void OnCommandComplete(CommandCompleteView status) = 0;
+};
+
+class ClassicSecurityManager : public Module {
+ public:
+  ClassicSecurityManager();
+
+  bool RegisterCallbacks(ClassicSecurityCommandCallbacks* callbacks, os::Handler* handler);
+
+  void LinkKeyRequestReply(Address address, common::LinkKey link_key);
+  void LinkKeyRequestNegativeReply(Address address);
+  void PinCodeRequestReply(Address address, uint8_t len, std::string pin_code);
+  void PinCodeRequestNegativeReply(Address address);
+  void IoCapabilityRequestReply(Address address, IoCapability io_capability, OobDataPresent oob_present,
+                                AuthenticationRequirements authentication_requirements);
+  void IoCapabilityRequestNegativeReply(Address address, ErrorCode reason);
+  void UserConfirmationRequestReply(Address address);
+  void UserConfirmationRequestNegativeReply(Address address);
+  void UserPasskeyRequestReply(Address address, uint32_t passkey);
+  void UserPasskeyRequestNegativeReply(Address address);
+  void RemoteOobDataRequestReply(Address address, std::array<uint8_t, 16> c, std::array<uint8_t, 16> r);
+  void RemoteOobDataRequestNegativeReply(Address address);
+  void ReadStoredLinkKey(Address address, ReadStoredLinkKeyReadAllFlag read_all_flag);
+  void WriteStoredLinkKey(std::vector<KeyAndAddress> keys);
+  void DeleteStoredLinkKey(Address address, DeleteStoredLinkKeyDeleteAllFlag delete_all_flag);
+  void RefreshEncryptionKey(uint16_t connection_handle);
+  void ReadSimplePairingMode();
+  void WriteSimplePairingMode(Enable simple_pairing_mode);
+  void ReadLocalOobData();
+  void SendKeypressNotification(Address address, KeypressNotificationType notification_type);
+  void ReadLocalOobExtendedData();
+  void ReadEncryptionKeySize(uint16_t connection_handle);
+
+  static const ModuleFactory Factory;
+
+ protected:
+  void ListDependencies(ModuleList* list) override;
+
+  void Start() override;
+
+  void Stop() override;
+
+ private:
+  struct impl;
+  std::unique_ptr<impl> pimpl_;
+};
+
+}  // namespace hci
+}  // namespace bluetooth
diff --git a/gd/hci/classic_security_manager_test.cc b/gd/hci/classic_security_manager_test.cc
new file mode 100644
index 0000000..b2c936e
--- /dev/null
+++ b/gd/hci/classic_security_manager_test.cc
@@ -0,0 +1,420 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+#include "hci/classic_security_manager.h"
+
+#include <condition_variable>
+#include "gtest/gtest.h"
+
+#include "common/bind.h"
+#include "hci/hci_layer.h"
+#include "os/thread.h"
+#include "packet/raw_builder.h"
+
+namespace bluetooth {
+namespace hci {
+namespace {
+
+using common::BidiQueue;
+using common::BidiQueueEnd;
+using common::OnceCallback;
+using os::Handler;
+using os::Thread;
+using packet::RawBuilder;
+
+PacketView<kLittleEndian> GetPacketView(std::unique_ptr<packet::BasePacketBuilder> packet) {
+  auto bytes = std::make_shared<std::vector<uint8_t>>();
+  BitInserter i(*bytes);
+  bytes->reserve(packet->size());
+  packet->Serialize(i);
+  return packet::PacketView<packet::kLittleEndian>(bytes);
+}
+
+class CommandQueueEntry {
+ public:
+  CommandQueueEntry(std::unique_ptr<CommandPacketBuilder> command_packet,
+                    OnceCallback<void(CommandCompleteView)> on_complete_function, Handler* handler)
+      : command(std::move(command_packet)), waiting_for_status_(false), on_complete(std::move(on_complete_function)),
+        caller_handler(handler) {}
+
+  CommandQueueEntry(std::unique_ptr<CommandPacketBuilder> command_packet,
+                    OnceCallback<void(CommandStatusView)> on_status_function, Handler* handler)
+      : command(std::move(command_packet)), waiting_for_status_(true), on_status(std::move(on_status_function)),
+        caller_handler(handler) {}
+
+  std::unique_ptr<CommandPacketBuilder> command;
+  bool waiting_for_status_;
+  OnceCallback<void(CommandStatusView)> on_status;
+  OnceCallback<void(CommandCompleteView)> on_complete;
+  Handler* caller_handler;
+};
+
+class TestHciLayer : public HciLayer {
+ public:
+  void EnqueueCommand(std::unique_ptr<CommandPacketBuilder> command, OnceCallback<void(CommandStatusView)> on_status,
+                      Handler* handler) override {
+    auto command_queue_entry = std::make_unique<CommandQueueEntry>(std::move(command), std::move(on_status), handler);
+    command_queue_.push(std::move(command_queue_entry));
+  }
+
+  void EnqueueCommand(std::unique_ptr<CommandPacketBuilder> command,
+                      OnceCallback<void(CommandCompleteView)> on_complete, Handler* handler) override {
+    auto command_queue_entry = std::make_unique<CommandQueueEntry>(std::move(command), std::move(on_complete), handler);
+    command_queue_.push(std::move(command_queue_entry));
+  }
+
+  std::unique_ptr<CommandQueueEntry> GetLastCommand() {
+    EXPECT_FALSE(command_queue_.empty());
+    auto last = std::move(command_queue_.front());
+    command_queue_.pop();
+    return last;
+  }
+
+  void RegisterEventHandler(EventCode event_code, common::Callback<void(EventPacketView)> event_handler,
+                            Handler* handler) override {
+    registered_events_[event_code] = event_handler;
+  }
+
+  void UnregisterEventHandler(EventCode event_code) override {
+    registered_events_.erase(event_code);
+  }
+
+  void IncomingEvent(std::unique_ptr<EventPacketBuilder> event_builder) {
+    auto packet = GetPacketView(std::move(event_builder));
+    EventPacketView event = EventPacketView::Create(packet);
+    EXPECT_TRUE(event.IsValid());
+    EventCode event_code = event.GetEventCode();
+    EXPECT_TRUE(registered_events_.find(event_code) != registered_events_.end());
+    registered_events_[event_code].Run(event);
+  }
+
+  void ListDependencies(ModuleList* list) override {}
+  void Start() override {}
+  void Stop() override {}
+
+ private:
+  std::map<EventCode, common::Callback<void(EventPacketView)>> registered_events_;
+  std::queue<std::unique_ptr<CommandQueueEntry>> command_queue_;
+};
+
+class ClassicSecurityManagerTest : public ::testing::Test, public ::bluetooth::hci::ClassicSecurityCommandCallbacks {
+ protected:
+  void SetUp() override {
+    test_hci_layer_ = new TestHciLayer;
+    handler_ = new Handler(&thread_);
+    fake_registry_.InjectTestModule(&TestHciLayer::Factory, test_hci_layer_);
+    fake_registry_.Start<ClassicSecurityManager>(&thread_);
+    classic_security_manager_ =
+        static_cast<ClassicSecurityManager*>(fake_registry_.GetModuleUnderTest(&ClassicSecurityManager::Factory));
+    classic_security_manager_->RegisterCallbacks(this, handler_);
+    test_hci_layer_->RegisterEventHandler(
+        EventCode::COMMAND_COMPLETE, base::Bind(&ClassicSecurityManagerTest::ExpectCommand, common::Unretained(this)),
+        nullptr);
+    test_hci_layer_->RegisterEventHandler(
+        EventCode::COMMAND_STATUS,
+        base::Bind(&ClassicSecurityManagerTest::ExpectCommandStatus, common::Unretained(this)), nullptr);
+
+    Address::FromString("A1:A2:A3:A4:A5:A6", remote);
+  }
+
+  void TearDown() override {
+    handler_->Clear();
+    delete handler_;
+    fake_registry_.SynchronizeModuleHandler(&ClassicSecurityManager::Factory, std::chrono::milliseconds(20));
+    fake_registry_.StopAll();
+    command_complete_ = false;
+  }
+
+  void ExpectCommand(EventPacketView packet) {
+    CommandCompleteView command_complete_view = CommandCompleteView::Create(std::move(packet));
+    auto last_command_queue_entry = test_hci_layer_->GetLastCommand();
+    auto last_command = std::move(last_command_queue_entry->command);
+    auto command_packet = GetPacketView(std::move(last_command));
+    CommandPacketView command_packet_view = CommandPacketView::Create(command_packet);
+
+    // verify command complete event match last command opcode
+    EXPECT_TRUE(command_packet_view.IsValid());
+    EXPECT_TRUE(command_complete_view.IsValid());
+    EXPECT_EQ(command_packet_view.GetOpCode(), command_complete_view.GetCommandOpCode());
+
+    // verify callback triggered
+    auto caller_handler = last_command_queue_entry->caller_handler;
+    caller_handler->Post(BindOnce(std::move(last_command_queue_entry->on_complete), std::move(command_complete_view)));
+    std::unique_lock<std::mutex> lock(mutex_);
+    EXPECT_FALSE(callback_done.wait_for(lock, std::chrono::seconds(3)) == std::cv_status::timeout);
+
+    command_complete_ = true;
+  }
+
+  void ExpectCommandStatus(EventPacketView packet) {
+    CommandStatusView command_status_view = CommandStatusView::Create(std::move(packet));
+    auto last_command_queue_entry = test_hci_layer_->GetLastCommand();
+    auto last_command = std::move(last_command_queue_entry->command);
+    auto command_packet = GetPacketView(std::move(last_command));
+    CommandPacketView command_packet_view = CommandPacketView::Create(command_packet);
+
+    // verify command complete event match last command opcode
+    EXPECT_TRUE(command_packet_view.IsValid());
+    EXPECT_TRUE(command_status_view.IsValid());
+    EXPECT_EQ(command_packet_view.GetOpCode(), command_status_view.GetCommandOpCode());
+
+    command_complete_ = true;
+  }
+
+  void OnCommandComplete(CommandCompleteView status) override {
+    callback_done.notify_one();
+  }
+
+  TestModuleRegistry fake_registry_;
+  TestHciLayer* test_hci_layer_ = nullptr;
+  os::Thread& thread_ = fake_registry_.GetTestThread();
+  Handler* handler_ = nullptr;
+  ClassicSecurityManager* classic_security_manager_ = nullptr;
+  Address remote;
+  mutable std::mutex mutex_;
+  std::condition_variable callback_done;
+  bool command_complete_ = false;
+};
+
+TEST_F(ClassicSecurityManagerTest, startup_teardown) {}
+
+TEST_F(ClassicSecurityManagerTest, send_link_key_request_reply) {
+  common::LinkKey link_key;
+  common::LinkKey::FromString("4c68384139f574d836bcf34e9dfb01bf\0", link_key);
+  classic_security_manager_->LinkKeyRequestReply(remote, link_key);
+  EXPECT_TRUE(fake_registry_.SynchronizeModuleHandler(&ClassicSecurityManager::Factory, std::chrono::milliseconds(20)));
+
+  auto payload = std::make_unique<RawBuilder>();
+  test_hci_layer_->IncomingEvent(
+      CommandCompleteBuilder::Create(0x01, OpCode::LINK_KEY_REQUEST_REPLY, std::move(payload)));
+  EXPECT_TRUE(command_complete_);
+}
+
+TEST_F(ClassicSecurityManagerTest, send_link_key_request_negative_reply) {
+  classic_security_manager_->LinkKeyRequestNegativeReply(remote);
+  EXPECT_TRUE(fake_registry_.SynchronizeModuleHandler(&ClassicSecurityManager::Factory, std::chrono::milliseconds(20)));
+
+  auto payload = std::make_unique<RawBuilder>();
+  test_hci_layer_->IncomingEvent(
+      CommandCompleteBuilder::Create(0x01, OpCode::LINK_KEY_REQUEST_NEGATIVE_REPLY, std::move(payload)));
+  EXPECT_TRUE(command_complete_);
+}
+
+TEST_F(ClassicSecurityManagerTest, send_pin_code_request_reply) {
+  classic_security_manager_->PinCodeRequestReply(remote, 6, "123456");
+  EXPECT_TRUE(fake_registry_.SynchronizeModuleHandler(&ClassicSecurityManager::Factory, std::chrono::milliseconds(20)));
+
+  auto payload = std::make_unique<RawBuilder>();
+  test_hci_layer_->IncomingEvent(
+      CommandCompleteBuilder::Create(0x01, OpCode::PIN_CODE_REQUEST_REPLY, std::move(payload)));
+  EXPECT_TRUE(command_complete_);
+}
+
+TEST_F(ClassicSecurityManagerTest, send_pin_code_request_negative_reply) {
+  classic_security_manager_->PinCodeRequestNegativeReply(remote);
+  EXPECT_TRUE(fake_registry_.SynchronizeModuleHandler(&ClassicSecurityManager::Factory, std::chrono::milliseconds(20)));
+
+  auto payload = std::make_unique<RawBuilder>();
+  test_hci_layer_->IncomingEvent(
+      CommandCompleteBuilder::Create(0x01, OpCode::PIN_CODE_REQUEST_NEGATIVE_REPLY, std::move(payload)));
+  EXPECT_TRUE(command_complete_);
+}
+
+TEST_F(ClassicSecurityManagerTest, send_io_capability_request_reply) {
+  IoCapability io_capability = (IoCapability)0x00;
+  OobDataPresent oob_present = (OobDataPresent)0x00;
+  AuthenticationRequirements authentication_requirements = (AuthenticationRequirements)0x00;
+  classic_security_manager_->IoCapabilityRequestReply(remote, io_capability, oob_present, authentication_requirements);
+  EXPECT_TRUE(fake_registry_.SynchronizeModuleHandler(&ClassicSecurityManager::Factory, std::chrono::milliseconds(20)));
+
+  auto payload = std::make_unique<RawBuilder>();
+  test_hci_layer_->IncomingEvent(
+      CommandCompleteBuilder::Create(0x01, OpCode::IO_CAPABILITY_REQUEST_REPLY, std::move(payload)));
+  EXPECT_TRUE(command_complete_);
+}
+
+TEST_F(ClassicSecurityManagerTest, send_io_capability_request_negative_reply) {
+  ErrorCode reason = (ErrorCode)0x01;
+  classic_security_manager_->IoCapabilityRequestNegativeReply(remote, reason);
+  EXPECT_TRUE(fake_registry_.SynchronizeModuleHandler(&ClassicSecurityManager::Factory, std::chrono::milliseconds(20)));
+
+  auto payload = std::make_unique<RawBuilder>();
+  test_hci_layer_->IncomingEvent(
+      CommandCompleteBuilder::Create(0x01, OpCode::IO_CAPABILITY_REQUEST_NEGATIVE_REPLY, std::move(payload)));
+  EXPECT_TRUE(command_complete_);
+}
+
+TEST_F(ClassicSecurityManagerTest, send_user_confirmation_request_reply) {
+  classic_security_manager_->UserConfirmationRequestReply(remote);
+  EXPECT_TRUE(fake_registry_.SynchronizeModuleHandler(&ClassicSecurityManager::Factory, std::chrono::milliseconds(20)));
+
+  auto payload = std::make_unique<RawBuilder>();
+  test_hci_layer_->IncomingEvent(
+      CommandCompleteBuilder::Create(0x01, OpCode::USER_CONFIRMATION_REQUEST_REPLY, std::move(payload)));
+  EXPECT_TRUE(command_complete_);
+}
+
+TEST_F(ClassicSecurityManagerTest, send_user_confirmation_request_negative_reply) {
+  classic_security_manager_->UserConfirmationRequestNegativeReply(remote);
+  EXPECT_TRUE(fake_registry_.SynchronizeModuleHandler(&ClassicSecurityManager::Factory, std::chrono::milliseconds(20)));
+
+  auto payload = std::make_unique<RawBuilder>();
+  test_hci_layer_->IncomingEvent(
+      CommandCompleteBuilder::Create(0x01, OpCode::USER_CONFIRMATION_REQUEST_NEGATIVE_REPLY, std::move(payload)));
+  EXPECT_TRUE(command_complete_);
+}
+
+TEST_F(ClassicSecurityManagerTest, send_user_passkey_request_reply) {
+  classic_security_manager_->UserPasskeyRequestReply(remote, 999999);
+  EXPECT_TRUE(fake_registry_.SynchronizeModuleHandler(&ClassicSecurityManager::Factory, std::chrono::milliseconds(20)));
+
+  auto payload = std::make_unique<RawBuilder>();
+  test_hci_layer_->IncomingEvent(
+      CommandCompleteBuilder::Create(0x01, OpCode::USER_PASSKEY_REQUEST_REPLY, std::move(payload)));
+  EXPECT_TRUE(command_complete_);
+}
+
+TEST_F(ClassicSecurityManagerTest, send_user_passkey_request_negative_reply) {
+  classic_security_manager_->UserPasskeyRequestNegativeReply(remote);
+  EXPECT_TRUE(fake_registry_.SynchronizeModuleHandler(&ClassicSecurityManager::Factory, std::chrono::milliseconds(20)));
+
+  auto payload = std::make_unique<RawBuilder>();
+  test_hci_layer_->IncomingEvent(
+      CommandCompleteBuilder::Create(0x01, OpCode::USER_PASSKEY_REQUEST_NEGATIVE_REPLY, std::move(payload)));
+  EXPECT_TRUE(command_complete_);
+}
+
+TEST_F(ClassicSecurityManagerTest, send_remote_oob_data_request_reply) {
+  std::array<uint8_t, 16> c;
+  std::array<uint8_t, 16> r;
+  for (int i = 0; i < 16; i++) {
+    c[i] = (uint8_t)i;
+    r[i] = (uint8_t)i + 16;
+  }
+  classic_security_manager_->RemoteOobDataRequestReply(remote, c, r);
+  EXPECT_TRUE(fake_registry_.SynchronizeModuleHandler(&ClassicSecurityManager::Factory, std::chrono::milliseconds(20)));
+
+  auto payload = std::make_unique<RawBuilder>();
+  test_hci_layer_->IncomingEvent(
+      CommandCompleteBuilder::Create(0x01, OpCode::REMOTE_OOB_DATA_REQUEST_REPLY, std::move(payload)));
+  EXPECT_TRUE(command_complete_);
+}
+
+TEST_F(ClassicSecurityManagerTest, send_remote_oob_data_request_negative_reply) {
+  classic_security_manager_->RemoteOobDataRequestNegativeReply(remote);
+  EXPECT_TRUE(fake_registry_.SynchronizeModuleHandler(&ClassicSecurityManager::Factory, std::chrono::milliseconds(20)));
+
+  auto payload = std::make_unique<RawBuilder>();
+  test_hci_layer_->IncomingEvent(
+      CommandCompleteBuilder::Create(0x01, OpCode::REMOTE_OOB_DATA_REQUEST_NEGATIVE_REPLY, std::move(payload)));
+  EXPECT_TRUE(command_complete_);
+}
+
+TEST_F(ClassicSecurityManagerTest, send_read_stored_link_key) {
+  ReadStoredLinkKeyReadAllFlag read_all_flag = (ReadStoredLinkKeyReadAllFlag)0x01;
+  classic_security_manager_->ReadStoredLinkKey(remote, read_all_flag);
+  EXPECT_TRUE(fake_registry_.SynchronizeModuleHandler(&ClassicSecurityManager::Factory, std::chrono::milliseconds(20)));
+
+  auto payload = std::make_unique<RawBuilder>();
+  test_hci_layer_->IncomingEvent(
+      CommandCompleteBuilder::Create(0x01, OpCode::READ_STORED_LINK_KEY, std::move(payload)));
+  EXPECT_TRUE(command_complete_);
+}
+
+TEST_F(ClassicSecurityManagerTest, send_delete_stored_link_key) {
+  DeleteStoredLinkKeyDeleteAllFlag delete_all_flag = (DeleteStoredLinkKeyDeleteAllFlag)0x01;
+  classic_security_manager_->DeleteStoredLinkKey(remote, delete_all_flag);
+  EXPECT_TRUE(fake_registry_.SynchronizeModuleHandler(&ClassicSecurityManager::Factory, std::chrono::milliseconds(20)));
+
+  auto payload = std::make_unique<RawBuilder>();
+  test_hci_layer_->IncomingEvent(
+      CommandCompleteBuilder::Create(0x01, OpCode::DELETE_STORED_LINK_KEY, std::move(payload)));
+  EXPECT_TRUE(command_complete_);
+}
+
+TEST_F(ClassicSecurityManagerTest, send_refresh_encryption_key) {
+  classic_security_manager_->RefreshEncryptionKey(0x01);
+  EXPECT_TRUE(fake_registry_.SynchronizeModuleHandler(&ClassicSecurityManager::Factory, std::chrono::milliseconds(20)));
+
+  auto payload = std::make_unique<RawBuilder>();
+  test_hci_layer_->IncomingEvent(
+      CommandStatusBuilder::Create(ErrorCode::SUCCESS, 0x01, OpCode::REFRESH_ENCRYPTION_KEY, std::move(payload)));
+  EXPECT_TRUE(command_complete_);
+}
+
+TEST_F(ClassicSecurityManagerTest, send_read_simple_pairing_mode) {
+  classic_security_manager_->ReadSimplePairingMode();
+  EXPECT_TRUE(fake_registry_.SynchronizeModuleHandler(&ClassicSecurityManager::Factory, std::chrono::milliseconds(20)));
+
+  auto payload = std::make_unique<RawBuilder>();
+  test_hci_layer_->IncomingEvent(
+      CommandCompleteBuilder::Create(0x01, OpCode::READ_SIMPLE_PAIRING_MODE, std::move(payload)));
+  EXPECT_TRUE(command_complete_);
+}
+
+TEST_F(ClassicSecurityManagerTest, send_write_simple_pairing_mode) {
+  Enable simple_pairing_mode = (Enable)0x01;
+  classic_security_manager_->WriteSimplePairingMode(simple_pairing_mode);
+  EXPECT_TRUE(fake_registry_.SynchronizeModuleHandler(&ClassicSecurityManager::Factory, std::chrono::milliseconds(20)));
+
+  auto payload = std::make_unique<RawBuilder>();
+  test_hci_layer_->IncomingEvent(
+      CommandCompleteBuilder::Create(0x01, OpCode::WRITE_SIMPLE_PAIRING_MODE, std::move(payload)));
+  EXPECT_TRUE(command_complete_);
+}
+
+TEST_F(ClassicSecurityManagerTest, send_read_local_oob_data) {
+  classic_security_manager_->ReadLocalOobData();
+  EXPECT_TRUE(fake_registry_.SynchronizeModuleHandler(&ClassicSecurityManager::Factory, std::chrono::milliseconds(20)));
+
+  auto payload = std::make_unique<RawBuilder>();
+  test_hci_layer_->IncomingEvent(CommandCompleteBuilder::Create(0x01, OpCode::READ_LOCAL_OOB_DATA, std::move(payload)));
+  EXPECT_TRUE(command_complete_);
+}
+
+TEST_F(ClassicSecurityManagerTest, send_keypress_notification) {
+  KeypressNotificationType notification_type = (KeypressNotificationType)0x01;
+  classic_security_manager_->SendKeypressNotification(remote, notification_type);
+  EXPECT_TRUE(fake_registry_.SynchronizeModuleHandler(&ClassicSecurityManager::Factory, std::chrono::milliseconds(20)));
+
+  auto payload = std::make_unique<RawBuilder>();
+  test_hci_layer_->IncomingEvent(
+      CommandCompleteBuilder::Create(0x01, OpCode::SEND_KEYPRESS_NOTIFICATION, std::move(payload)));
+  EXPECT_TRUE(command_complete_);
+}
+
+TEST_F(ClassicSecurityManagerTest, send_read_local_oob_extended_data) {
+  classic_security_manager_->ReadLocalOobExtendedData();
+  EXPECT_TRUE(fake_registry_.SynchronizeModuleHandler(&ClassicSecurityManager::Factory, std::chrono::milliseconds(20)));
+
+  auto payload = std::make_unique<RawBuilder>();
+  test_hci_layer_->IncomingEvent(
+      CommandCompleteBuilder::Create(0x01, OpCode::READ_LOCAL_OOB_EXTENDED_DATA, std::move(payload)));
+  EXPECT_TRUE(command_complete_);
+}
+
+TEST_F(ClassicSecurityManagerTest, send_read_encryption_key_size) {
+  classic_security_manager_->ReadEncryptionKeySize(0x01);
+  EXPECT_TRUE(fake_registry_.SynchronizeModuleHandler(&ClassicSecurityManager::Factory, std::chrono::milliseconds(20)));
+
+  auto payload = std::make_unique<RawBuilder>();
+  test_hci_layer_->IncomingEvent(
+      CommandCompleteBuilder::Create(0x01, OpCode::READ_ENCRYPTION_KEY_SIZE, std::move(payload)));
+  EXPECT_TRUE(command_complete_);
+}
+
+}  // namespace
+}  // namespace hci
+}  // namespace bluetooth
diff --git a/gd/hci/controller.cc b/gd/hci/controller.cc
new file mode 100644
index 0000000..d961064
--- /dev/null
+++ b/gd/hci/controller.cc
@@ -0,0 +1,862 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "hci/controller.h"
+
+#include <future>
+#include <memory>
+#include <utility>
+
+#include "common/bind.h"
+#include "common/callback.h"
+#include "hci/hci_layer.h"
+
+namespace bluetooth {
+namespace hci {
+
+using common::Bind;
+using common::BindOnce;
+using common::Callback;
+using common::Closure;
+using common::OnceCallback;
+using common::OnceClosure;
+using os::Handler;
+
+struct Controller::impl {
+  impl(Controller& module) : module_(module) {}
+
+  void Start(hci::HciLayer* hci) {
+    hci_ = hci;
+    hci_->RegisterEventHandler(EventCode::NUMBER_OF_COMPLETED_PACKETS,
+                               Bind(&Controller::impl::NumberOfCompletedPackets, common::Unretained(this)),
+                               module_.GetHandler());
+
+    hci_->EnqueueCommand(ReadLocalNameBuilder::Create(),
+                         BindOnce(&Controller::impl::read_local_name_complete_handler, common::Unretained(this)),
+                         module_.GetHandler());
+    hci_->EnqueueCommand(
+        ReadLocalVersionInformationBuilder::Create(),
+        BindOnce(&Controller::impl::read_local_version_information_complete_handler, common::Unretained(this)),
+        module_.GetHandler());
+    hci_->EnqueueCommand(
+        ReadLocalSupportedCommandsBuilder::Create(),
+        BindOnce(&Controller::impl::read_local_supported_commands_complete_handler, common::Unretained(this)),
+        module_.GetHandler());
+    hci_->EnqueueCommand(
+        ReadLocalSupportedFeaturesBuilder::Create(),
+        BindOnce(&Controller::impl::read_local_supported_features_complete_handler, common::Unretained(this)),
+        module_.GetHandler());
+
+    // Wait for all extended features read
+    std::promise<void> features_promise;
+    auto features_future = features_promise.get_future();
+    hci_->EnqueueCommand(ReadLocalExtendedFeaturesBuilder::Create(0x00),
+                         BindOnce(&Controller::impl::read_local_extended_features_complete_handler,
+                                  common::Unretained(this), std::move(features_promise)),
+                         module_.GetHandler());
+    features_future.wait();
+
+    hci_->EnqueueCommand(ReadBufferSizeBuilder::Create(),
+                         BindOnce(&Controller::impl::read_buffer_size_complete_handler, common::Unretained(this)),
+                         module_.GetHandler());
+
+    hci_->EnqueueCommand(LeReadBufferSizeBuilder::Create(),
+                         BindOnce(&Controller::impl::le_read_buffer_size_handler, common::Unretained(this)),
+                         module_.GetHandler());
+
+    hci_->EnqueueCommand(
+        LeReadLocalSupportedFeaturesBuilder::Create(),
+        BindOnce(&Controller::impl::le_read_local_supported_features_handler, common::Unretained(this)),
+        module_.GetHandler());
+
+    hci_->EnqueueCommand(LeReadSupportedStatesBuilder::Create(),
+                         BindOnce(&Controller::impl::le_read_supported_states_handler, common::Unretained(this)),
+                         module_.GetHandler());
+
+    if (is_supported(OpCode::LE_READ_MAXIMUM_DATA_LENGTH)) {
+      hci_->EnqueueCommand(LeReadMaximumDataLengthBuilder::Create(),
+                           BindOnce(&Controller::impl::le_read_maximum_data_length_handler, common::Unretained(this)),
+                           module_.GetHandler());
+    }
+    if (is_supported(OpCode::LE_READ_MAXIMUM_ADVERTISING_DATA_LENGTH)) {
+      hci_->EnqueueCommand(
+          LeReadMaximumAdvertisingDataLengthBuilder::Create(),
+          BindOnce(&Controller::impl::le_read_maximum_advertising_data_length_handler, common::Unretained(this)),
+          module_.GetHandler());
+    }
+    if (is_supported(OpCode::LE_READ_NUMBER_OF_SUPPORTED_ADVERTISING_SETS)) {
+      hci_->EnqueueCommand(
+          LeReadNumberOfSupportedAdvertisingSetsBuilder::Create(),
+          BindOnce(&Controller::impl::le_read_number_of_supported_advertising_sets_handler, common::Unretained(this)),
+          module_.GetHandler());
+    }
+
+    hci_->EnqueueCommand(LeGetVendorCapabilitiesBuilder::Create(),
+                         BindOnce(&Controller::impl::le_get_vendor_capabilities_handler, common::Unretained(this)),
+                         module_.GetHandler());
+
+    // We only need to synchronize the last read. Make BD_ADDR to be the last one.
+    std::promise<void> promise;
+    auto future = promise.get_future();
+    hci_->EnqueueCommand(
+        ReadBdAddrBuilder::Create(),
+        BindOnce(&Controller::impl::read_controller_mac_address_handler, common::Unretained(this), std::move(promise)),
+        module_.GetHandler());
+    future.wait();
+  }
+
+  void Stop() {
+    hci_->UnregisterEventHandler(EventCode::NUMBER_OF_COMPLETED_PACKETS);
+    hci_ = nullptr;
+  }
+
+  void NumberOfCompletedPackets(EventPacketView event) {
+    ASSERT(acl_credits_handler_ != nullptr);
+    auto complete_view = NumberOfCompletedPacketsView::Create(event);
+    ASSERT(complete_view.IsValid());
+    for (auto completed_packets : complete_view.GetCompletedPackets()) {
+      uint16_t handle = completed_packets.connection_handle_;
+      uint16_t credits = completed_packets.host_num_of_completed_packets_;
+      acl_credits_handler_->Post(Bind(acl_credits_callback_, handle, credits));
+    }
+  }
+
+  void RegisterCompletedAclPacketsCallback(Callback<void(uint16_t /* handle */, uint16_t /* packets */)> cb,
+                                           Handler* handler) {
+    ASSERT(acl_credits_handler_ == nullptr);
+    acl_credits_callback_ = cb;
+    acl_credits_handler_ = handler;
+  }
+
+  void read_local_name_complete_handler(CommandCompleteView view) {
+    auto complete_view = ReadLocalNameCompleteView::Create(view);
+    ASSERT(complete_view.IsValid());
+    ErrorCode status = complete_view.GetStatus();
+    ASSERT_LOG(status == ErrorCode::SUCCESS, "Status 0x%02hhx, %s", status, ErrorCodeText(status).c_str());
+    std::array<uint8_t, 248> local_name_array = complete_view.GetLocalName();
+
+    local_name_ = std::string(local_name_array.begin(), local_name_array.end());
+    // erase \0
+    local_name_.erase(std::find(local_name_.begin(), local_name_.end(), '\0'), local_name_.end());
+  }
+
+  void read_local_version_information_complete_handler(CommandCompleteView view) {
+    auto complete_view = ReadLocalVersionInformationCompleteView::Create(view);
+    ASSERT(complete_view.IsValid());
+    ErrorCode status = complete_view.GetStatus();
+    ASSERT_LOG(status == ErrorCode::SUCCESS, "Status 0x%02hhx, %s", status, ErrorCodeText(status).c_str());
+
+    local_version_information_ = complete_view.GetLocalVersionInformation();
+  }
+
+  void read_local_supported_commands_complete_handler(CommandCompleteView view) {
+    auto complete_view = ReadLocalSupportedCommandsCompleteView::Create(view);
+    ASSERT(complete_view.IsValid());
+    ErrorCode status = complete_view.GetStatus();
+    ASSERT_LOG(status == ErrorCode::SUCCESS, "Status 0x%02hhx, %s", status, ErrorCodeText(status).c_str());
+    local_supported_commands_ = complete_view.GetSupportedCommands();
+  }
+
+  void read_local_supported_features_complete_handler(CommandCompleteView view) {
+    auto complete_view = ReadLocalSupportedFeaturesCompleteView::Create(view);
+    ASSERT(complete_view.IsValid());
+    ErrorCode status = complete_view.GetStatus();
+    ASSERT_LOG(status == ErrorCode::SUCCESS, "Status 0x%02hhx, %s", status, ErrorCodeText(status).c_str());
+    local_supported_features_ = complete_view.GetLmpFeatures();
+  }
+
+  void read_local_extended_features_complete_handler(std::promise<void> promise, CommandCompleteView view) {
+    auto complete_view = ReadLocalExtendedFeaturesCompleteView::Create(view);
+    ASSERT(complete_view.IsValid());
+    ErrorCode status = complete_view.GetStatus();
+    ASSERT_LOG(status == ErrorCode::SUCCESS, "Status 0x%02hhx, %s", status, ErrorCodeText(status).c_str());
+    uint8_t page_number = complete_view.GetPageNumber();
+    maximum_page_number_ = complete_view.GetMaximumPageNumber();
+    extended_lmp_features_array_.push_back(complete_view.GetExtendedLmpFeatures());
+
+    // Query all extended features
+    if (page_number < maximum_page_number_) {
+      page_number++;
+      hci_->EnqueueCommand(ReadLocalExtendedFeaturesBuilder::Create(page_number),
+                           BindOnce(&Controller::impl::read_local_extended_features_complete_handler,
+                                    common::Unretained(this), std::move(promise)),
+                           module_.GetHandler());
+    } else {
+      promise.set_value();
+    }
+  }
+
+  void read_buffer_size_complete_handler(CommandCompleteView view) {
+    auto complete_view = ReadBufferSizeCompleteView::Create(view);
+    ASSERT(complete_view.IsValid());
+    ErrorCode status = complete_view.GetStatus();
+    ASSERT_LOG(status == ErrorCode::SUCCESS, "Status 0x%02hhx, %s", status, ErrorCodeText(status).c_str());
+    acl_buffer_length_ = complete_view.GetAclDataPacketLength();
+    acl_buffers_ = complete_view.GetTotalNumAclDataPackets();
+
+    sco_buffer_length_ = complete_view.GetSynchronousDataPacketLength();
+    sco_buffers_ = complete_view.GetTotalNumSynchronousDataPackets();
+  }
+
+  void read_controller_mac_address_handler(std::promise<void> promise, CommandCompleteView view) {
+    auto complete_view = ReadBdAddrCompleteView::Create(view);
+    ASSERT(complete_view.IsValid());
+    ErrorCode status = complete_view.GetStatus();
+    ASSERT_LOG(status == ErrorCode::SUCCESS, "Status 0x%02hhx, %s", status, ErrorCodeText(status).c_str());
+    mac_address_ = complete_view.GetBdAddr();
+    promise.set_value();
+  }
+
+  void le_read_buffer_size_handler(CommandCompleteView view) {
+    auto complete_view = LeReadBufferSizeCompleteView::Create(view);
+    ASSERT(complete_view.IsValid());
+    ErrorCode status = complete_view.GetStatus();
+    ASSERT_LOG(status == ErrorCode::SUCCESS, "Status 0x%02hhx, %s", status, ErrorCodeText(status).c_str());
+    le_buffer_size_ = complete_view.GetLeBufferSize();
+  }
+
+  void le_read_local_supported_features_handler(CommandCompleteView view) {
+    auto complete_view = LeReadLocalSupportedFeaturesCompleteView::Create(view);
+    ASSERT(complete_view.IsValid());
+    ErrorCode status = complete_view.GetStatus();
+    ASSERT_LOG(status == ErrorCode::SUCCESS, "Status 0x%02hhx, %s", status, ErrorCodeText(status).c_str());
+    le_local_supported_features_ = complete_view.GetLeFeatures();
+  }
+
+  void le_read_supported_states_handler(CommandCompleteView view) {
+    auto complete_view = LeReadSupportedStatesCompleteView::Create(view);
+    ASSERT(complete_view.IsValid());
+    ErrorCode status = complete_view.GetStatus();
+    ASSERT_LOG(status == ErrorCode::SUCCESS, "Status 0x%02hhx, %s", status, ErrorCodeText(status).c_str());
+    le_supported_states_ = complete_view.GetLeStates();
+  }
+
+  void le_read_maximum_data_length_handler(CommandCompleteView view) {
+    auto complete_view = LeReadMaximumDataLengthCompleteView::Create(view);
+    ASSERT(complete_view.IsValid());
+    ErrorCode status = complete_view.GetStatus();
+    ASSERT_LOG(status == ErrorCode::SUCCESS, "Status 0x%02hhx, %s", status, ErrorCodeText(status).c_str());
+    le_maximum_data_length_ = complete_view.GetLeMaximumDataLength();
+  }
+
+  void le_read_maximum_advertising_data_length_handler(CommandCompleteView view) {
+    auto complete_view = LeReadMaximumAdvertisingDataLengthCompleteView::Create(view);
+    ASSERT(complete_view.IsValid());
+    ErrorCode status = complete_view.GetStatus();
+    ASSERT_LOG(status == ErrorCode::SUCCESS, "Status 0x%02hhx, %s", status, ErrorCodeText(status).c_str());
+    le_maximum_advertising_data_length_ = complete_view.GetMaximumAdvertisingDataLength();
+  }
+
+  void le_read_number_of_supported_advertising_sets_handler(CommandCompleteView view) {
+    auto complete_view = LeReadNumberOfSupportedAdvertisingSetsCompleteView::Create(view);
+    ASSERT(complete_view.IsValid());
+    ErrorCode status = complete_view.GetStatus();
+    ASSERT_LOG(status == ErrorCode::SUCCESS, "Status 0x%02hhx, %s", status, ErrorCodeText(status).c_str());
+    le_number_supported_advertising_sets_ = complete_view.GetNumberSupportedAdvertisingSets();
+  }
+
+  void le_get_vendor_capabilities_handler(CommandCompleteView view) {
+    auto complete_view = LeGetVendorCapabilitiesCompleteView::Create(view);
+
+    vendor_capabilities_.is_supported_ = 0x00;
+    vendor_capabilities_.max_advt_instances_ = 0x00;
+    vendor_capabilities_.offloaded_resolution_of_private_address_ = 0x00;
+    vendor_capabilities_.total_scan_results_storage_ = 0x00;
+    vendor_capabilities_.max_irk_list_sz_ = 0x00;
+    vendor_capabilities_.filtering_support_ = 0x00;
+    vendor_capabilities_.max_filter_ = 0x00;
+    vendor_capabilities_.activity_energy_info_support_ = 0x00;
+    vendor_capabilities_.version_supported_ = 0x00;
+    vendor_capabilities_.version_supported_ = 0x00;
+    vendor_capabilities_.total_num_of_advt_tracked_ = 0x00;
+    vendor_capabilities_.extended_scan_support_ = 0x00;
+    vendor_capabilities_.debug_logging_supported_ = 0x00;
+    vendor_capabilities_.le_address_generation_offloading_support_ = 0x00;
+    vendor_capabilities_.a2dp_source_offload_capability_mask_ = 0x00;
+    vendor_capabilities_.bluetooth_quality_report_support_ = 0x00;
+
+    if (complete_view.IsValid()) {
+      vendor_capabilities_.is_supported_ = 0x01;
+
+      // v0.55
+      BaseVendorCapabilities base_vendor_capabilities = complete_view.GetBaseVendorCapabilities();
+      vendor_capabilities_.max_advt_instances_ = base_vendor_capabilities.max_advt_instances_;
+      vendor_capabilities_.offloaded_resolution_of_private_address_ =
+          base_vendor_capabilities.offloaded_resolution_of_private_address_;
+      vendor_capabilities_.total_scan_results_storage_ = base_vendor_capabilities.total_scan_results_storage_;
+      vendor_capabilities_.max_irk_list_sz_ = base_vendor_capabilities.max_irk_list_sz_;
+      vendor_capabilities_.filtering_support_ = base_vendor_capabilities.filtering_support_;
+      vendor_capabilities_.max_filter_ = base_vendor_capabilities.max_filter_;
+      vendor_capabilities_.activity_energy_info_support_ = base_vendor_capabilities.activity_energy_info_support_;
+      if (complete_view.GetPayload().size() == 0) {
+        vendor_capabilities_.version_supported_ = 55;
+        return;
+      }
+
+      // v0.95
+      auto v95 = LeGetVendorCapabilitiesComplete095View::Create(complete_view);
+      if (!v95.IsValid()) {
+        LOG_ERROR("invalid data for hci requirements v0.95");
+        return;
+      }
+      vendor_capabilities_.version_supported_ = v95.GetVersionSupported();
+      vendor_capabilities_.total_num_of_advt_tracked_ = v95.GetTotalNumOfAdvtTracked();
+      vendor_capabilities_.extended_scan_support_ = v95.GetExtendedScanSupport();
+      vendor_capabilities_.debug_logging_supported_ = v95.GetDebugLoggingSupported();
+      if (vendor_capabilities_.version_supported_ <= 95 || complete_view.GetPayload().size() == 0) {
+        return;
+      }
+
+      // v0.96
+      auto v96 = LeGetVendorCapabilitiesComplete096View::Create(v95);
+      if (!v96.IsValid()) {
+        LOG_ERROR("invalid data for hci requirements v0.96");
+        return;
+      }
+      vendor_capabilities_.le_address_generation_offloading_support_ = v96.GetLeAddressGenerationOffloadingSupport();
+      if (vendor_capabilities_.version_supported_ <= 96 || complete_view.GetPayload().size() == 0) {
+        return;
+      }
+
+      // v0.98
+      auto v98 = LeGetVendorCapabilitiesComplete098View::Create(v96);
+      if (!v98.IsValid()) {
+        LOG_ERROR("invalid data for hci requirements v0.98");
+        return;
+      }
+      vendor_capabilities_.a2dp_source_offload_capability_mask_ = v98.GetA2dpSourceOffloadCapabilityMask();
+      vendor_capabilities_.bluetooth_quality_report_support_ = v98.GetBluetoothQualityReportSupport();
+    }
+  }
+
+  void set_event_mask(uint64_t event_mask) {
+    std::unique_ptr<SetEventMaskBuilder> packet = SetEventMaskBuilder::Create(event_mask);
+    hci_->EnqueueCommand(std::move(packet),
+                         BindOnce(&Controller::impl::check_status<SetEventMaskCompleteView>, common::Unretained(this)),
+                         module_.GetHandler());
+  }
+
+  void reset() {
+    std::unique_ptr<ResetBuilder> packet = ResetBuilder::Create();
+    hci_->EnqueueCommand(std::move(packet),
+                         BindOnce(&Controller::impl::check_status<ResetCompleteView>, common::Unretained(this)),
+                         module_.GetHandler());
+  }
+
+  void set_event_filter(std::unique_ptr<SetEventFilterBuilder> packet) {
+    hci_->EnqueueCommand(
+        std::move(packet),
+        BindOnce(&Controller::impl::check_status<SetEventFilterCompleteView>, common::Unretained(this)),
+        module_.GetHandler());
+  }
+
+  void write_local_name(std::string local_name) {
+    ASSERT(local_name.length() <= 248);
+    // Fill remaining char with 0
+    local_name.append(std::string(248 - local_name.length(), '\0'));
+    std::array<uint8_t, 248> local_name_array;
+    std::copy(std::begin(local_name), std::end(local_name), std::begin(local_name_array));
+
+    std::unique_ptr<WriteLocalNameBuilder> packet = WriteLocalNameBuilder::Create(local_name_array);
+    hci_->EnqueueCommand(
+        std::move(packet),
+        BindOnce(&Controller::impl::check_status<WriteLocalNameCompleteView>, common::Unretained(this)),
+        module_.GetHandler());
+  }
+
+  void host_buffer_size(uint16_t host_acl_data_packet_length, uint8_t host_synchronous_data_packet_length,
+                        uint16_t host_total_num_acl_data_packets, uint16_t host_total_num_synchronous_data_packets) {
+    std::unique_ptr<HostBufferSizeBuilder> packet =
+        HostBufferSizeBuilder::Create(host_acl_data_packet_length, host_synchronous_data_packet_length,
+                                      host_total_num_acl_data_packets, host_total_num_synchronous_data_packets);
+    hci_->EnqueueCommand(
+        std::move(packet),
+        BindOnce(&Controller::impl::check_status<HostBufferSizeCompleteView>, common::Unretained(this)),
+        module_.GetHandler());
+  }
+
+  void le_set_event_mask(uint64_t le_event_mask) {
+    std::unique_ptr<LeSetEventMaskBuilder> packet = LeSetEventMaskBuilder::Create(le_event_mask);
+    hci_->EnqueueCommand(
+        std::move(packet),
+        BindOnce(&Controller::impl::check_status<LeSetEventMaskCompleteView>, common::Unretained(this)),
+        module_.GetHandler());
+  }
+
+  template <class T>
+  void check_status(CommandCompleteView view) {
+    ASSERT(view.IsValid());
+    auto status_view = T::Create(view);
+    ASSERT(status_view.IsValid());
+    ASSERT(status_view.GetStatus() == ErrorCode::SUCCESS);
+  }
+
+#define OP_CODE_MAPPING(name)                                                  \
+  case OpCode::name: {                                                         \
+    uint16_t index = (uint16_t)OpCodeIndex::name;                              \
+    uint16_t byte_index = index / 10;                                          \
+    uint16_t bit_index = index % 10;                                           \
+    bool supported = local_supported_commands_[byte_index] & (1 << bit_index); \
+    if (!supported) {                                                          \
+      LOG_WARN("unsupported command opcode: 0x%04x", (uint16_t)OpCode::name);  \
+    }                                                                          \
+    return supported;                                                          \
+  }
+
+  bool is_supported(OpCode op_code) {
+    switch (op_code) {
+      OP_CODE_MAPPING(INQUIRY)
+      OP_CODE_MAPPING(INQUIRY_CANCEL)
+      OP_CODE_MAPPING(PERIODIC_INQUIRY_MODE)
+      OP_CODE_MAPPING(EXIT_PERIODIC_INQUIRY_MODE)
+      OP_CODE_MAPPING(CREATE_CONNECTION)
+      OP_CODE_MAPPING(DISCONNECT)
+      OP_CODE_MAPPING(CREATE_CONNECTION_CANCEL)
+      OP_CODE_MAPPING(ACCEPT_CONNECTION_REQUEST)
+      OP_CODE_MAPPING(REJECT_CONNECTION_REQUEST)
+      OP_CODE_MAPPING(LINK_KEY_REQUEST_REPLY)
+      OP_CODE_MAPPING(LINK_KEY_REQUEST_NEGATIVE_REPLY)
+      OP_CODE_MAPPING(PIN_CODE_REQUEST_REPLY)
+      OP_CODE_MAPPING(PIN_CODE_REQUEST_NEGATIVE_REPLY)
+      OP_CODE_MAPPING(CHANGE_CONNECTION_PACKET_TYPE)
+      OP_CODE_MAPPING(AUTHENTICATION_REQUESTED)
+      OP_CODE_MAPPING(SET_CONNECTION_ENCRYPTION)
+      OP_CODE_MAPPING(CHANGE_CONNECTION_LINK_KEY)
+      OP_CODE_MAPPING(MASTER_LINK_KEY)
+      OP_CODE_MAPPING(REMOTE_NAME_REQUEST)
+      OP_CODE_MAPPING(REMOTE_NAME_REQUEST_CANCEL)
+      OP_CODE_MAPPING(READ_REMOTE_SUPPORTED_FEATURES)
+      OP_CODE_MAPPING(READ_REMOTE_EXTENDED_FEATURES)
+      OP_CODE_MAPPING(READ_REMOTE_VERSION_INFORMATION)
+      OP_CODE_MAPPING(READ_CLOCK_OFFSET)
+      OP_CODE_MAPPING(READ_LMP_HANDLE)
+      OP_CODE_MAPPING(HOLD_MODE)
+      OP_CODE_MAPPING(SNIFF_MODE)
+      OP_CODE_MAPPING(EXIT_SNIFF_MODE)
+      OP_CODE_MAPPING(QOS_SETUP)
+      OP_CODE_MAPPING(ROLE_DISCOVERY)
+      OP_CODE_MAPPING(SWITCH_ROLE)
+      OP_CODE_MAPPING(READ_LINK_POLICY_SETTINGS)
+      OP_CODE_MAPPING(WRITE_LINK_POLICY_SETTINGS)
+      OP_CODE_MAPPING(READ_DEFAULT_LINK_POLICY_SETTINGS)
+      OP_CODE_MAPPING(WRITE_DEFAULT_LINK_POLICY_SETTINGS)
+      OP_CODE_MAPPING(FLOW_SPECIFICATION)
+      OP_CODE_MAPPING(SET_EVENT_MASK)
+      OP_CODE_MAPPING(RESET)
+      OP_CODE_MAPPING(SET_EVENT_FILTER)
+      OP_CODE_MAPPING(FLUSH)
+      OP_CODE_MAPPING(READ_PIN_TYPE)
+      OP_CODE_MAPPING(WRITE_PIN_TYPE)
+      OP_CODE_MAPPING(READ_STORED_LINK_KEY)
+      OP_CODE_MAPPING(WRITE_STORED_LINK_KEY)
+      OP_CODE_MAPPING(DELETE_STORED_LINK_KEY)
+      OP_CODE_MAPPING(WRITE_LOCAL_NAME)
+      OP_CODE_MAPPING(READ_LOCAL_NAME)
+      OP_CODE_MAPPING(READ_CONNECTION_ACCEPT_TIMEOUT)
+      OP_CODE_MAPPING(WRITE_CONNECTION_ACCEPT_TIMEOUT)
+      OP_CODE_MAPPING(READ_PAGE_TIMEOUT)
+      OP_CODE_MAPPING(WRITE_PAGE_TIMEOUT)
+      OP_CODE_MAPPING(READ_SCAN_ENABLE)
+      OP_CODE_MAPPING(WRITE_SCAN_ENABLE)
+      OP_CODE_MAPPING(READ_PAGE_SCAN_ACTIVITY)
+      OP_CODE_MAPPING(WRITE_PAGE_SCAN_ACTIVITY)
+      OP_CODE_MAPPING(READ_INQUIRY_SCAN_ACTIVITY)
+      OP_CODE_MAPPING(WRITE_INQUIRY_SCAN_ACTIVITY)
+      OP_CODE_MAPPING(READ_AUTHENTICATION_ENABLE)
+      OP_CODE_MAPPING(WRITE_AUTHENTICATION_ENABLE)
+      OP_CODE_MAPPING(READ_CLASS_OF_DEVICE)
+      OP_CODE_MAPPING(WRITE_CLASS_OF_DEVICE)
+      OP_CODE_MAPPING(READ_VOICE_SETTING)
+      OP_CODE_MAPPING(WRITE_VOICE_SETTING)
+      OP_CODE_MAPPING(READ_AUTOMATIC_FLUSH_TIMEOUT)
+      OP_CODE_MAPPING(WRITE_AUTOMATIC_FLUSH_TIMEOUT)
+      OP_CODE_MAPPING(READ_NUM_BROADCAST_RETRANSMITS)
+      OP_CODE_MAPPING(WRITE_NUM_BROADCAST_RETRANSMITS)
+      OP_CODE_MAPPING(READ_HOLD_MODE_ACTIVITY)
+      OP_CODE_MAPPING(WRITE_HOLD_MODE_ACTIVITY)
+      OP_CODE_MAPPING(READ_TRANSMIT_POWER_LEVEL)
+      OP_CODE_MAPPING(READ_SYNCHRONOUS_FLOW_CONTROL_ENABLE)
+      OP_CODE_MAPPING(WRITE_SYNCHRONOUS_FLOW_CONTROL_ENABLE)
+      OP_CODE_MAPPING(SET_CONTROLLER_TO_HOST_FLOW_CONTROL)
+      OP_CODE_MAPPING(HOST_BUFFER_SIZE)
+      OP_CODE_MAPPING(HOST_NUM_COMPLETED_PACKETS)
+      OP_CODE_MAPPING(READ_LINK_SUPERVISION_TIMEOUT)
+      OP_CODE_MAPPING(WRITE_LINK_SUPERVISION_TIMEOUT)
+      OP_CODE_MAPPING(READ_NUMBER_OF_SUPPORTED_IAC)
+      OP_CODE_MAPPING(READ_CURRENT_IAC_LAP)
+      OP_CODE_MAPPING(WRITE_CURRENT_IAC_LAP)
+      OP_CODE_MAPPING(SET_AFH_HOST_CHANNEL_CLASSIFICATION)
+      OP_CODE_MAPPING(READ_INQUIRY_SCAN_TYPE)
+      OP_CODE_MAPPING(WRITE_INQUIRY_SCAN_TYPE)
+      OP_CODE_MAPPING(READ_INQUIRY_MODE)
+      OP_CODE_MAPPING(WRITE_INQUIRY_MODE)
+      OP_CODE_MAPPING(READ_PAGE_SCAN_TYPE)
+      OP_CODE_MAPPING(WRITE_PAGE_SCAN_TYPE)
+      OP_CODE_MAPPING(READ_AFH_CHANNEL_ASSESSMENT_MODE)
+      OP_CODE_MAPPING(WRITE_AFH_CHANNEL_ASSESSMENT_MODE)
+      OP_CODE_MAPPING(READ_LOCAL_VERSION_INFORMATION)
+      OP_CODE_MAPPING(READ_LOCAL_SUPPORTED_FEATURES)
+      OP_CODE_MAPPING(READ_LOCAL_EXTENDED_FEATURES)
+      OP_CODE_MAPPING(READ_BUFFER_SIZE)
+      OP_CODE_MAPPING(READ_BD_ADDR)
+      OP_CODE_MAPPING(READ_FAILED_CONTACT_COUNTER)
+      OP_CODE_MAPPING(RESET_FAILED_CONTACT_COUNTER)
+      OP_CODE_MAPPING(READ_LINK_QUALITY)
+      OP_CODE_MAPPING(READ_RSSI)
+      OP_CODE_MAPPING(READ_AFH_CHANNEL_MAP)
+      OP_CODE_MAPPING(READ_CLOCK)
+      OP_CODE_MAPPING(READ_LOOPBACK_MODE)
+      OP_CODE_MAPPING(WRITE_LOOPBACK_MODE)
+      OP_CODE_MAPPING(ENABLE_DEVICE_UNDER_TEST_MODE)
+      OP_CODE_MAPPING(SETUP_SYNCHRONOUS_CONNECTION)
+      OP_CODE_MAPPING(ACCEPT_SYNCHRONOUS_CONNECTION)
+      OP_CODE_MAPPING(REJECT_SYNCHRONOUS_CONNECTION)
+      OP_CODE_MAPPING(READ_EXTENDED_INQUIRY_RESPONSE)
+      OP_CODE_MAPPING(WRITE_EXTENDED_INQUIRY_RESPONSE)
+      OP_CODE_MAPPING(REFRESH_ENCRYPTION_KEY)
+      OP_CODE_MAPPING(SNIFF_SUBRATING)
+      OP_CODE_MAPPING(READ_SIMPLE_PAIRING_MODE)
+      OP_CODE_MAPPING(WRITE_SIMPLE_PAIRING_MODE)
+      OP_CODE_MAPPING(READ_LOCAL_OOB_DATA)
+      OP_CODE_MAPPING(READ_INQUIRY_RESPONSE_TRANSMIT_POWER_LEVEL)
+      OP_CODE_MAPPING(WRITE_INQUIRY_TRANSMIT_POWER_LEVEL)
+      OP_CODE_MAPPING(IO_CAPABILITY_REQUEST_REPLY)
+      OP_CODE_MAPPING(USER_CONFIRMATION_REQUEST_REPLY)
+      OP_CODE_MAPPING(USER_CONFIRMATION_REQUEST_NEGATIVE_REPLY)
+      OP_CODE_MAPPING(USER_PASSKEY_REQUEST_REPLY)
+      OP_CODE_MAPPING(USER_PASSKEY_REQUEST_NEGATIVE_REPLY)
+      OP_CODE_MAPPING(REMOTE_OOB_DATA_REQUEST_REPLY)
+      OP_CODE_MAPPING(WRITE_SIMPLE_PAIRING_DEBUG_MODE)
+      OP_CODE_MAPPING(REMOTE_OOB_DATA_REQUEST_NEGATIVE_REPLY)
+      OP_CODE_MAPPING(SEND_KEYPRESS_NOTIFICATION)
+      OP_CODE_MAPPING(IO_CAPABILITY_REQUEST_NEGATIVE_REPLY)
+      OP_CODE_MAPPING(READ_ENCRYPTION_KEY_SIZE)
+      OP_CODE_MAPPING(READ_DATA_BLOCK_SIZE)
+      OP_CODE_MAPPING(READ_LE_HOST_SUPPORT)
+      OP_CODE_MAPPING(WRITE_LE_HOST_SUPPORT)
+      OP_CODE_MAPPING(LE_SET_EVENT_MASK)
+      OP_CODE_MAPPING(LE_READ_BUFFER_SIZE)
+      OP_CODE_MAPPING(LE_READ_LOCAL_SUPPORTED_FEATURES)
+      OP_CODE_MAPPING(LE_SET_RANDOM_ADDRESS)
+      OP_CODE_MAPPING(LE_SET_ADVERTISING_PARAMETERS)
+      OP_CODE_MAPPING(LE_READ_ADVERTISING_CHANNEL_TX_POWER)
+      OP_CODE_MAPPING(LE_SET_ADVERTISING_DATA)
+      OP_CODE_MAPPING(LE_SET_SCAN_RESPONSE_DATA)
+      OP_CODE_MAPPING(LE_SET_ADVERTISING_ENABLE)
+      OP_CODE_MAPPING(LE_SET_SCAN_PARAMETERS)
+      OP_CODE_MAPPING(LE_SET_SCAN_ENABLE)
+      OP_CODE_MAPPING(LE_CREATE_CONNECTION)
+      OP_CODE_MAPPING(LE_CREATE_CONNECTION_CANCEL)
+      OP_CODE_MAPPING(LE_READ_WHITE_LIST_SIZE)
+      OP_CODE_MAPPING(LE_CLEAR_WHITE_LIST)
+      OP_CODE_MAPPING(LE_ADD_DEVICE_TO_WHITE_LIST)
+      OP_CODE_MAPPING(LE_REMOVE_DEVICE_FROM_WHITE_LIST)
+      OP_CODE_MAPPING(LE_CONNECTION_UPDATE)
+      OP_CODE_MAPPING(LE_SET_HOST_CHANNEL_CLASSIFICATION)
+      OP_CODE_MAPPING(LE_READ_CHANNEL_MAP)
+      OP_CODE_MAPPING(LE_READ_REMOTE_FEATURES)
+      OP_CODE_MAPPING(LE_ENCRYPT)
+      OP_CODE_MAPPING(LE_RAND)
+      OP_CODE_MAPPING(LE_START_ENCRYPTION)
+      OP_CODE_MAPPING(LE_LONG_TERM_KEY_REQUEST_REPLY)
+      OP_CODE_MAPPING(LE_LONG_TERM_KEY_REQUEST_NEGATIVE_REPLY)
+      OP_CODE_MAPPING(LE_READ_SUPPORTED_STATES)
+      OP_CODE_MAPPING(LE_RECEIVER_TEST)
+      OP_CODE_MAPPING(LE_TRANSMITTER_TEST)
+      OP_CODE_MAPPING(LE_TEST_END)
+      OP_CODE_MAPPING(ENHANCED_SETUP_SYNCHRONOUS_CONNECTION)
+      OP_CODE_MAPPING(ENHANCED_ACCEPT_SYNCHRONOUS_CONNECTION)
+      OP_CODE_MAPPING(READ_LOCAL_SUPPORTED_CODECS)
+      OP_CODE_MAPPING(READ_SECURE_CONNECTIONS_HOST_SUPPORT)
+      OP_CODE_MAPPING(WRITE_SECURE_CONNECTIONS_HOST_SUPPORT)
+      OP_CODE_MAPPING(READ_LOCAL_OOB_EXTENDED_DATA)
+      OP_CODE_MAPPING(WRITE_SECURE_CONNECTIONS_TEST_MODE)
+      OP_CODE_MAPPING(LE_REMOTE_CONNECTION_PARAMETER_REQUEST_REPLY)
+      OP_CODE_MAPPING(LE_REMOTE_CONNECTION_PARAMETER_REQUEST_NEGATIVE_REPLY)
+      OP_CODE_MAPPING(LE_SET_DATA_LENGTH)
+      OP_CODE_MAPPING(LE_READ_SUGGESTED_DEFAULT_DATA_LENGTH)
+      OP_CODE_MAPPING(LE_WRITE_SUGGESTED_DEFAULT_DATA_LENGTH)
+      OP_CODE_MAPPING(LE_READ_LOCAL_P_256_PUBLIC_KEY_COMMAND)
+      OP_CODE_MAPPING(LE_GENERATE_DHKEY_COMMAND)
+      OP_CODE_MAPPING(LE_ADD_DEVICE_TO_RESOLVING_LIST)
+      OP_CODE_MAPPING(LE_REMOVE_DEVICE_FROM_RESOLVING_LIST)
+      OP_CODE_MAPPING(LE_CLEAR_RESOLVING_LIST)
+      OP_CODE_MAPPING(LE_READ_RESOLVING_LIST_SIZE)
+      OP_CODE_MAPPING(LE_READ_PEER_RESOLVABLE_ADDRESS)
+      OP_CODE_MAPPING(LE_READ_LOCAL_RESOLVABLE_ADDRESS)
+      OP_CODE_MAPPING(LE_SET_ADDRESS_RESOLUTION_ENABLE)
+      OP_CODE_MAPPING(LE_SET_RESOLVABLE_PRIVATE_ADDRESS_TIMEOUT)
+      OP_CODE_MAPPING(LE_READ_MAXIMUM_DATA_LENGTH)
+      OP_CODE_MAPPING(LE_READ_PHY)
+      OP_CODE_MAPPING(LE_SET_DEFAULT_PHY)
+      OP_CODE_MAPPING(LE_SET_PHY)
+      OP_CODE_MAPPING(LE_ENHANCED_RECEIVER_TEST)
+      OP_CODE_MAPPING(LE_ENHANCED_TRANSMITTER_TEST)
+      OP_CODE_MAPPING(LE_SET_EXTENDED_ADVERTISING_RANDOM_ADDRESS)
+      OP_CODE_MAPPING(LE_SET_EXTENDED_ADVERTISING_PARAMETERS)
+      OP_CODE_MAPPING(LE_SET_EXTENDED_ADVERTISING_DATA)
+      OP_CODE_MAPPING(LE_SET_EXTENDED_ADVERTISING_SCAN_RESPONSE)
+      OP_CODE_MAPPING(LE_SET_EXTENDED_ADVERTISING_ENABLE)
+      OP_CODE_MAPPING(LE_READ_MAXIMUM_ADVERTISING_DATA_LENGTH)
+      OP_CODE_MAPPING(LE_READ_NUMBER_OF_SUPPORTED_ADVERTISING_SETS)
+      OP_CODE_MAPPING(LE_REMOVE_ADVERTISING_SET)
+      OP_CODE_MAPPING(LE_CLEAR_ADVERTISING_SETS)
+      OP_CODE_MAPPING(LE_SET_PERIODIC_ADVERTISING_PARAM)
+      OP_CODE_MAPPING(LE_SET_PERIODIC_ADVERTISING_DATA)
+      OP_CODE_MAPPING(LE_SET_PERIODIC_ADVERTISING_ENABLE)
+      OP_CODE_MAPPING(LE_SET_EXTENDED_SCAN_PARAMETERS)
+      OP_CODE_MAPPING(LE_SET_EXTENDED_SCAN_ENABLE)
+      OP_CODE_MAPPING(LE_EXTENDED_CREATE_CONNECTION)
+      OP_CODE_MAPPING(LE_PERIODIC_ADVERTISING_CREATE_SYNC)
+      OP_CODE_MAPPING(LE_PERIODIC_ADVERTISING_CREATE_SYNC_CANCEL)
+      OP_CODE_MAPPING(LE_PERIODIC_ADVERTISING_TERMINATE_SYNC)
+      OP_CODE_MAPPING(LE_ADD_DEVICE_TO_PERIODIC_ADVERTISING_LIST)
+      OP_CODE_MAPPING(LE_REMOVE_DEVICE_FROM_PERIODIC_ADVERTISING_LIST)
+      OP_CODE_MAPPING(LE_CLEAR_PERIODIC_ADVERTISING_LIST)
+      OP_CODE_MAPPING(LE_READ_PERIODIC_ADVERTISING_LIST_SIZE)
+      OP_CODE_MAPPING(LE_READ_TRANSMIT_POWER)
+      OP_CODE_MAPPING(LE_READ_RF_PATH_COMPENSATION_POWER)
+      OP_CODE_MAPPING(LE_WRITE_RF_PATH_COMPENSATION_POWER)
+      OP_CODE_MAPPING(LE_SET_PRIVACY_MODE)
+      // vendor specific
+      case OpCode::LE_GET_VENDOR_CAPABILITIES:
+        return vendor_capabilities_.is_supported_ == 0x01;
+      case OpCode::LE_MULTI_ADVT:
+        return vendor_capabilities_.max_advt_instances_ != 0x00;
+      case OpCode::LE_BATCH_SCAN:
+        return vendor_capabilities_.total_scan_results_storage_ != 0x00;
+      case OpCode::LE_ADV_FILTER:
+        return vendor_capabilities_.filtering_support_ == 0x01;
+      case OpCode::LE_TRACK_ADV:
+        return vendor_capabilities_.total_num_of_advt_tracked_ > 0;
+      case OpCode::LE_ENERGY_INFO:
+        return vendor_capabilities_.activity_energy_info_support_ == 0x01;
+      case OpCode::LE_EXTENDED_SCAN_PARAMS:
+        return vendor_capabilities_.extended_scan_support_ == 0x01;
+      case OpCode::CONTROLLER_DEBUG_INFO:
+        return vendor_capabilities_.debug_logging_supported_ == 0x01;
+      case OpCode::CONTROLLER_A2DP_OPCODE:
+        return vendor_capabilities_.a2dp_source_offload_capability_mask_ != 0x00;
+      // undefined in local_supported_commands_
+      case OpCode::CREATE_NEW_UNIT_KEY:
+      case OpCode::READ_LOCAL_SUPPORTED_COMMANDS:
+        return true;
+      case OpCode::NONE:
+        return false;
+    }
+    return false;
+  }
+#undef OP_CODE_MAPPING
+
+  Controller& module_;
+
+  HciLayer* hci_;
+
+  Callback<void(uint16_t, uint16_t)> acl_credits_callback_;
+  Handler* acl_credits_handler_ = nullptr;
+  LocalVersionInformation local_version_information_;
+  std::array<uint8_t, 64> local_supported_commands_;
+  uint64_t local_supported_features_;
+  uint8_t maximum_page_number_;
+  std::vector<uint64_t> extended_lmp_features_array_;
+  uint16_t acl_buffer_length_ = 0;
+  uint16_t acl_buffers_ = 0;
+  uint8_t sco_buffer_length_ = 0;
+  uint16_t sco_buffers_ = 0;
+  Address mac_address_;
+  std::string local_name_;
+  LeBufferSize le_buffer_size_;
+  uint64_t le_local_supported_features_;
+  uint64_t le_supported_states_;
+  LeMaximumDataLength le_maximum_data_length_;
+  uint16_t le_maximum_advertising_data_length_;
+  uint16_t le_number_supported_advertising_sets_;
+  VendorCapabilities vendor_capabilities_;
+};  // namespace hci
+
+Controller::Controller() : impl_(std::make_unique<impl>(*this)) {}
+
+Controller::~Controller() = default;
+
+void Controller::RegisterCompletedAclPacketsCallback(Callback<void(uint16_t /* handle */, uint16_t /* packets */)> cb,
+                                                     Handler* handler) {
+  impl_->RegisterCompletedAclPacketsCallback(cb, handler);  // TODO hsz: why here?
+}
+
+std::string Controller::GetControllerLocalName() const {
+  return impl_->local_name_;
+}
+
+LocalVersionInformation Controller::GetControllerLocalVersionInformation() const {
+  return impl_->local_version_information_;
+}
+
+std::array<uint8_t, 64> Controller::GetControllerLocalSupportedCommands() const {
+  return impl_->local_supported_commands_;
+}
+
+uint8_t Controller::GetControllerLocalExtendedFeaturesMaxPageNumber() const {
+  return impl_->maximum_page_number_;
+}
+
+uint64_t Controller::GetControllerLocalSupportedFeatures() const {
+  return impl_->local_supported_features_;
+}
+
+uint64_t Controller::GetControllerLocalExtendedFeatures(uint8_t page_number) const {
+  if (page_number <= impl_->maximum_page_number_) {
+    return impl_->extended_lmp_features_array_[page_number];
+  }
+  return 0x00;
+}
+
+uint16_t Controller::GetControllerAclPacketLength() const {
+  return impl_->acl_buffer_length_;
+}
+
+uint16_t Controller::GetControllerNumAclPacketBuffers() const {
+  return impl_->acl_buffers_;
+}
+
+uint8_t Controller::GetControllerScoPacketLength() const {
+  return impl_->sco_buffer_length_;
+}
+
+uint16_t Controller::GetControllerNumScoPacketBuffers() const {
+  return impl_->sco_buffers_;
+}
+
+Address Controller::GetControllerMacAddress() const {
+  return impl_->mac_address_;
+}
+
+void Controller::SetEventMask(uint64_t event_mask) {
+  GetHandler()->Post(common::BindOnce(&impl::set_event_mask, common::Unretained(impl_.get()), event_mask));
+}
+
+void Controller::Reset() {
+  GetHandler()->Post(common::BindOnce(&impl::reset, common::Unretained(impl_.get())));
+}
+
+void Controller::SetEventFilterClearAll() {
+  std::unique_ptr<SetEventFilterClearAllBuilder> packet = SetEventFilterClearAllBuilder::Create();
+  GetHandler()->Post(common::BindOnce(&impl::set_event_filter, common::Unretained(impl_.get()), std::move(packet)));
+}
+
+void Controller::SetEventFilterInquiryResultAllDevices() {
+  std::unique_ptr<SetEventFilterInquiryResultAllDevicesBuilder> packet =
+      SetEventFilterInquiryResultAllDevicesBuilder::Create();
+  GetHandler()->Post(common::BindOnce(&impl::set_event_filter, common::Unretained(impl_.get()), std::move(packet)));
+}
+
+void Controller::SetEventFilterInquiryResultClassOfDevice(ClassOfDevice class_of_device,
+                                                          ClassOfDevice class_of_device_mask) {
+  std::unique_ptr<SetEventFilterInquiryResultClassOfDeviceBuilder> packet =
+      SetEventFilterInquiryResultClassOfDeviceBuilder::Create(class_of_device, class_of_device_mask);
+  GetHandler()->Post(common::BindOnce(&impl::set_event_filter, common::Unretained(impl_.get()), std::move(packet)));
+}
+
+void Controller::SetEventFilterInquiryResultAddress(Address address) {
+  std::unique_ptr<SetEventFilterInquiryResultAddressBuilder> packet =
+      SetEventFilterInquiryResultAddressBuilder::Create(address);
+  GetHandler()->Post(common::BindOnce(&impl::set_event_filter, common::Unretained(impl_.get()), std::move(packet)));
+}
+
+void Controller::SetEventFilterConnectionSetupAllDevices(AutoAcceptFlag auto_accept_flag) {
+  std::unique_ptr<SetEventFilterConnectionSetupAllDevicesBuilder> packet =
+      SetEventFilterConnectionSetupAllDevicesBuilder::Create(auto_accept_flag);
+  GetHandler()->Post(common::BindOnce(&impl::set_event_filter, common::Unretained(impl_.get()), std::move(packet)));
+}
+
+void Controller::SetEventFilterConnectionSetupClassOfDevice(ClassOfDevice class_of_device,
+                                                            ClassOfDevice class_of_device_mask,
+                                                            AutoAcceptFlag auto_accept_flag) {
+  std::unique_ptr<SetEventFilterConnectionSetupClassOfDeviceBuilder> packet =
+      SetEventFilterConnectionSetupClassOfDeviceBuilder::Create(class_of_device, class_of_device_mask,
+                                                                auto_accept_flag);
+  GetHandler()->Post(common::BindOnce(&impl::set_event_filter, common::Unretained(impl_.get()), std::move(packet)));
+}
+
+void Controller::SetEventFilterConnectionSetupAddress(Address address, AutoAcceptFlag auto_accept_flag) {
+  std::unique_ptr<SetEventFilterConnectionSetupAddressBuilder> packet =
+      SetEventFilterConnectionSetupAddressBuilder::Create(address, auto_accept_flag);
+  GetHandler()->Post(common::BindOnce(&impl::set_event_filter, common::Unretained(impl_.get()), std::move(packet)));
+}
+
+void Controller::WriteLocalName(std::string local_name) {
+  impl_->local_name_ = local_name;
+  GetHandler()->Post(common::BindOnce(&impl::write_local_name, common::Unretained(impl_.get()), local_name));
+}
+
+void Controller::HostBufferSize(uint16_t host_acl_data_packet_length, uint8_t host_synchronous_data_packet_length,
+                                uint16_t host_total_num_acl_data_packets,
+                                uint16_t host_total_num_synchronous_data_packets) {
+  GetHandler()->Post(common::BindOnce(&impl::host_buffer_size, common::Unretained(impl_.get()),
+                                      host_acl_data_packet_length, host_synchronous_data_packet_length,
+                                      host_total_num_acl_data_packets, host_total_num_synchronous_data_packets));
+}
+
+void Controller::LeSetEventMask(uint64_t le_event_mask) {
+  GetHandler()->Post(common::BindOnce(&impl::le_set_event_mask, common::Unretained(impl_.get()), le_event_mask));
+}
+
+LeBufferSize Controller::GetControllerLeBufferSize() const {
+  return impl_->le_buffer_size_;
+}
+
+uint64_t Controller::GetControllerLeLocalSupportedFeatures() const {
+  return impl_->le_local_supported_features_;
+}
+
+uint64_t Controller::GetControllerLeSupportedStates() const {
+  return impl_->le_supported_states_;
+}
+
+LeMaximumDataLength Controller::GetControllerLeMaximumDataLength() const {
+  return impl_->le_maximum_data_length_;
+}
+
+uint16_t Controller::GetControllerLeMaximumAdvertisingDataLength() const {
+  return impl_->le_maximum_advertising_data_length_;
+}
+
+uint16_t Controller::GetControllerLeNumberOfSupportedAdverisingSets() const {
+  return impl_->le_number_supported_advertising_sets_;
+}
+
+VendorCapabilities Controller::GetControllerVendorCapabilities() const {
+  return impl_->vendor_capabilities_;
+}
+
+bool Controller::IsSupported(bluetooth::hci::OpCode op_code) const {
+  return impl_->is_supported(op_code);
+}
+
+const ModuleFactory Controller::Factory = ModuleFactory([]() { return new Controller(); });
+
+void Controller::ListDependencies(ModuleList* list) {
+  list->add<hci::HciLayer>();
+}
+
+void Controller::Start() {
+  impl_->Start(GetDependency<hci::HciLayer>());
+}
+
+void Controller::Stop() {
+  impl_->Stop();
+}
+}  // namespace hci
+}  // namespace bluetooth
diff --git a/gd/hci/controller.h b/gd/hci/controller.h
new file mode 100644
index 0000000..3f2d2cd
--- /dev/null
+++ b/gd/hci/controller.h
@@ -0,0 +1,120 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#pragma once
+
+#include "common/callback.h"
+#include "hci/address.h"
+#include "hci/hci_packets.h"
+#include "module.h"
+#include "os/handler.h"
+
+namespace bluetooth {
+namespace hci {
+
+class Controller : public Module {
+ public:
+  Controller();
+  virtual ~Controller();
+  DISALLOW_COPY_AND_ASSIGN(Controller);
+
+  virtual void RegisterCompletedAclPacketsCallback(
+      common::Callback<void(uint16_t /* handle */, uint16_t /* num_packets */)> cb, os::Handler* handler);
+
+  virtual std::string GetControllerLocalName() const;
+
+  virtual LocalVersionInformation GetControllerLocalVersionInformation() const;
+
+  virtual std::array<uint8_t, 64> GetControllerLocalSupportedCommands() const;
+
+  virtual uint64_t GetControllerLocalSupportedFeatures() const;
+
+  virtual uint8_t GetControllerLocalExtendedFeaturesMaxPageNumber() const;
+
+  virtual uint64_t GetControllerLocalExtendedFeatures(uint8_t page_number) const;
+
+  virtual uint16_t GetControllerAclPacketLength() const;
+
+  virtual uint16_t GetControllerNumAclPacketBuffers() const;
+
+  virtual uint8_t GetControllerScoPacketLength() const;
+
+  virtual uint16_t GetControllerNumScoPacketBuffers() const;
+
+  virtual Address GetControllerMacAddress() const;
+
+  virtual void SetEventMask(uint64_t event_mask);
+
+  virtual void Reset();
+
+  virtual void SetEventFilterClearAll();
+
+  virtual void SetEventFilterInquiryResultAllDevices();
+
+  virtual void SetEventFilterInquiryResultClassOfDevice(ClassOfDevice class_of_device,
+                                                        ClassOfDevice class_of_device_mask);
+
+  virtual void SetEventFilterInquiryResultAddress(Address address);
+
+  virtual void SetEventFilterConnectionSetupAllDevices(AutoAcceptFlag auto_accept_flag);
+
+  virtual void SetEventFilterConnectionSetupClassOfDevice(ClassOfDevice class_of_device,
+                                                          ClassOfDevice class_of_device_mask,
+                                                          AutoAcceptFlag auto_accept_flag);
+
+  virtual void SetEventFilterConnectionSetupAddress(Address address, AutoAcceptFlag auto_accept_flag);
+
+  virtual void WriteLocalName(std::string local_name);
+
+  virtual void HostBufferSize(uint16_t host_acl_data_packet_length, uint8_t host_synchronous_data_packet_length,
+                              uint16_t host_total_num_acl_data_packets,
+                              uint16_t host_total_num_synchronous_data_packets);
+
+  // LE controller commands
+  virtual void LeSetEventMask(uint64_t le_event_mask);
+
+  virtual LeBufferSize GetControllerLeBufferSize() const;
+
+  virtual uint64_t GetControllerLeLocalSupportedFeatures() const;
+
+  virtual uint64_t GetControllerLeSupportedStates() const;
+
+  virtual LeMaximumDataLength GetControllerLeMaximumDataLength() const;
+
+  virtual uint16_t GetControllerLeMaximumAdvertisingDataLength() const;
+
+  virtual uint16_t GetControllerLeNumberOfSupportedAdverisingSets() const;
+
+  virtual VendorCapabilities GetControllerVendorCapabilities() const;
+
+  virtual bool IsSupported(OpCode op_code) const;
+
+  static const ModuleFactory Factory;
+
+ protected:
+  void ListDependencies(ModuleList* list) override;
+
+  void Start() override;
+
+  void Stop() override;
+
+ private:
+  struct impl;
+  std::unique_ptr<impl> impl_;
+};
+
+}  // namespace hci
+}  // namespace bluetooth
diff --git a/gd/hci/controller_test.cc b/gd/hci/controller_test.cc
new file mode 100644
index 0000000..9d109f8
--- /dev/null
+++ b/gd/hci/controller_test.cc
@@ -0,0 +1,459 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "hci/controller.h"
+
+#include <algorithm>
+#include <chrono>
+#include <future>
+#include <map>
+
+#include <gtest/gtest.h>
+
+#include "common/bind.h"
+#include "common/callback.h"
+#include "hci/address.h"
+#include "hci/hci_layer.h"
+#include "os/thread.h"
+#include "packet/raw_builder.h"
+
+namespace bluetooth {
+namespace hci {
+namespace {
+
+using common::BidiQueue;
+using common::BidiQueueEnd;
+using packet::kLittleEndian;
+using packet::PacketView;
+using packet::RawBuilder;
+
+constexpr uint16_t kHandle1 = 0x123;
+constexpr uint16_t kCredits1 = 0x78;
+constexpr uint16_t kHandle2 = 0x456;
+constexpr uint16_t kCredits2 = 0x9a;
+uint16_t feature_spec_version = 55;
+
+PacketView<kLittleEndian> GetPacketView(std::unique_ptr<packet::BasePacketBuilder> packet) {
+  auto bytes = std::make_shared<std::vector<uint8_t>>();
+  BitInserter i(*bytes);
+  bytes->reserve(packet->size());
+  packet->Serialize(i);
+  return packet::PacketView<packet::kLittleEndian>(bytes);
+}
+
+class TestHciLayer : public HciLayer {
+ public:
+  void EnqueueCommand(std::unique_ptr<CommandPacketBuilder> command,
+                      common::OnceCallback<void(CommandCompleteView)> on_complete, os::Handler* handler) override {
+    GetHandler()->Post(common::BindOnce(&TestHciLayer::HandleCommand, common::Unretained(this), std::move(command),
+                                        std::move(on_complete), common::Unretained(handler)));
+  }
+
+  void EnqueueCommand(std::unique_ptr<CommandPacketBuilder> command,
+                      common::OnceCallback<void(CommandStatusView)> on_status, os::Handler* handler) override {
+    EXPECT_TRUE(false) << "Controller properties should not generate Command Status";
+  }
+
+  void HandleCommand(std::unique_ptr<CommandPacketBuilder> command_builder,
+                     common::OnceCallback<void(CommandCompleteView)> on_complete, os::Handler* handler) {
+    auto packet_view = GetPacketView(std::move(command_builder));
+    CommandPacketView command = CommandPacketView::Create(packet_view);
+    ASSERT(command.IsValid());
+
+    uint8_t num_packets = 1;
+    std::unique_ptr<packet::BasePacketBuilder> event_builder;
+    switch (command.GetOpCode()) {
+      case (OpCode::READ_LOCAL_NAME): {
+        std::array<uint8_t, 248> local_name = {'D', 'U', 'T', '\0'};
+        event_builder = ReadLocalNameCompleteBuilder::Create(num_packets, ErrorCode::SUCCESS, local_name);
+      } break;
+      case (OpCode::READ_LOCAL_VERSION_INFORMATION): {
+        LocalVersionInformation local_version_information;
+        local_version_information.hci_version_ = HciVersion::V_5_0;
+        local_version_information.hci_revision_ = 0x1234;
+        local_version_information.lmp_version_ = LmpVersion::V_4_2;
+        local_version_information.manufacturer_name_ = 0xBAD;
+        local_version_information.lmp_subversion_ = 0x5678;
+        event_builder = ReadLocalVersionInformationCompleteBuilder::Create(num_packets, ErrorCode::SUCCESS,
+                                                                           local_version_information);
+      } break;
+      case (OpCode::READ_LOCAL_SUPPORTED_COMMANDS): {
+        std::array<uint8_t, 64> supported_commands;
+        for (int i = 0; i < 37; i++) {
+          supported_commands[i] = 0xff;
+        }
+        for (int i = 37; i < 64; i++) {
+          supported_commands[i] = 0x00;
+        }
+        event_builder =
+            ReadLocalSupportedCommandsCompleteBuilder::Create(num_packets, ErrorCode::SUCCESS, supported_commands);
+      } break;
+      case (OpCode::READ_LOCAL_SUPPORTED_FEATURES): {
+        uint64_t lmp_features = 0x012345678abcdef;
+        event_builder =
+            ReadLocalSupportedFeaturesCompleteBuilder::Create(num_packets, ErrorCode::SUCCESS, lmp_features);
+      } break;
+      case (OpCode::READ_LOCAL_EXTENDED_FEATURES): {
+        ReadLocalExtendedFeaturesView read_command = ReadLocalExtendedFeaturesView::Create(command);
+        ASSERT(read_command.IsValid());
+        uint8_t page_bumber = read_command.GetPageNumber();
+        uint64_t lmp_features = 0x012345678abcdef;
+        lmp_features += page_bumber;
+        event_builder = ReadLocalExtendedFeaturesCompleteBuilder::Create(num_packets, ErrorCode::SUCCESS, page_bumber,
+                                                                         0x02, lmp_features);
+      } break;
+      case (OpCode::READ_BUFFER_SIZE): {
+        event_builder = ReadBufferSizeCompleteBuilder::Create(
+            num_packets, ErrorCode::SUCCESS, acl_data_packet_length, synchronous_data_packet_length,
+            total_num_acl_data_packets, total_num_synchronous_data_packets);
+      } break;
+      case (OpCode::READ_BD_ADDR): {
+        event_builder = ReadBdAddrCompleteBuilder::Create(num_packets, ErrorCode::SUCCESS, Address::kAny);
+      } break;
+      case (OpCode::LE_READ_BUFFER_SIZE): {
+        LeBufferSize le_buffer_size;
+        le_buffer_size.le_data_packet_length_ = 0x16;
+        le_buffer_size.total_num_le_packets_ = 0x08;
+        event_builder = LeReadBufferSizeCompleteBuilder::Create(num_packets, ErrorCode::SUCCESS, le_buffer_size);
+      } break;
+      case (OpCode::LE_READ_LOCAL_SUPPORTED_FEATURES): {
+        event_builder =
+            LeReadLocalSupportedFeaturesCompleteBuilder::Create(num_packets, ErrorCode::SUCCESS, 0x001f123456789abc);
+      } break;
+      case (OpCode::LE_READ_SUPPORTED_STATES): {
+        event_builder =
+            LeReadSupportedStatesCompleteBuilder::Create(num_packets, ErrorCode::SUCCESS, 0x001f123456789abe);
+      } break;
+      case (OpCode::LE_READ_MAXIMUM_DATA_LENGTH): {
+        LeMaximumDataLength le_maximum_data_length;
+        le_maximum_data_length.supported_max_tx_octets_ = 0x12;
+        le_maximum_data_length.supported_max_tx_time_ = 0x34;
+        le_maximum_data_length.supported_max_rx_octets_ = 0x56;
+        le_maximum_data_length.supported_max_rx_time_ = 0x78;
+        event_builder =
+            LeReadMaximumDataLengthCompleteBuilder::Create(num_packets, ErrorCode::SUCCESS, le_maximum_data_length);
+      } break;
+      case (OpCode::LE_READ_MAXIMUM_ADVERTISING_DATA_LENGTH): {
+        event_builder =
+            LeReadMaximumAdvertisingDataLengthCompleteBuilder::Create(num_packets, ErrorCode::SUCCESS, 0x0672);
+      } break;
+      case (OpCode::LE_READ_NUMBER_OF_SUPPORTED_ADVERTISING_SETS): {
+        event_builder =
+            LeReadNumberOfSupportedAdvertisingSetsCompleteBuilder::Create(num_packets, ErrorCode::SUCCESS, 0xF0);
+      } break;
+      case (OpCode::LE_GET_VENDOR_CAPABILITIES): {
+        BaseVendorCapabilities base_vendor_capabilities;
+        base_vendor_capabilities.max_advt_instances_ = 0x10;
+        base_vendor_capabilities.offloaded_resolution_of_private_address_ = 0x01;
+        base_vendor_capabilities.total_scan_results_storage_ = 0x2800;
+        base_vendor_capabilities.max_irk_list_sz_ = 0x20;
+        base_vendor_capabilities.filtering_support_ = 0x01;
+        base_vendor_capabilities.max_filter_ = 0x10;
+        base_vendor_capabilities.activity_energy_info_support_ = 0x01;
+
+        auto payload = std::make_unique<RawBuilder>();
+        if (feature_spec_version > 55) {
+          std::vector<uint8_t> payload_bytes = {0x20, 0x00, 0x01, 0x00, 0x00, 0x1f, 0x00, 0x00, 0x00, 0x00};
+          payload->AddOctets2(feature_spec_version);
+          payload->AddOctets(payload_bytes);
+        }
+        event_builder = LeGetVendorCapabilitiesCompleteBuilder::Create(num_packets, ErrorCode::SUCCESS,
+                                                                       base_vendor_capabilities, std::move(payload));
+      } break;
+      case (OpCode::SET_EVENT_MASK):
+      case (OpCode::RESET):
+      case (OpCode::SET_EVENT_FILTER):
+      case (OpCode::HOST_BUFFER_SIZE):
+      case (OpCode::LE_SET_EVENT_MASK):
+        command_queue_.push(command);
+        not_empty_.notify_all();
+        return;
+      default:
+        LOG_INFO("Dropping unhandled packet");
+        return;
+    }
+    auto packet = GetPacketView(std::move(event_builder));
+    EventPacketView event = EventPacketView::Create(packet);
+    ASSERT(event.IsValid());
+    CommandCompleteView command_complete = CommandCompleteView::Create(event);
+    ASSERT(command_complete.IsValid());
+    handler->Post(common::BindOnce(std::move(on_complete), std::move(command_complete)));
+  }
+
+  void RegisterEventHandler(EventCode event_code, common::Callback<void(EventPacketView)> event_handler,
+                            os::Handler* handler) override {
+    EXPECT_EQ(event_code, EventCode::NUMBER_OF_COMPLETED_PACKETS) << "Only NUMBER_OF_COMPLETED_PACKETS is needed";
+    number_of_completed_packets_callback_ = event_handler;
+    client_handler_ = handler;
+  }
+
+  void UnregisterEventHandler(EventCode event_code) override {
+    EXPECT_EQ(event_code, EventCode::NUMBER_OF_COMPLETED_PACKETS) << "Only NUMBER_OF_COMPLETED_PACKETS is needed";
+    number_of_completed_packets_callback_ = {};
+    client_handler_ = nullptr;
+  }
+
+  void IncomingCredit() {
+    std::vector<CompletedPackets> completed_packets;
+    CompletedPackets cp;
+    cp.host_num_of_completed_packets_ = kCredits1;
+    cp.connection_handle_ = kHandle1;
+    completed_packets.push_back(cp);
+    cp.host_num_of_completed_packets_ = kCredits2;
+    cp.connection_handle_ = kHandle2;
+    completed_packets.push_back(cp);
+    auto event_builder = NumberOfCompletedPacketsBuilder::Create(completed_packets);
+    auto packet = GetPacketView(std::move(event_builder));
+    EventPacketView event = EventPacketView::Create(packet);
+    ASSERT(event.IsValid());
+    client_handler_->Post(common::BindOnce(number_of_completed_packets_callback_, event));
+  }
+
+  CommandPacketView GetCommand(OpCode op_code) {
+    std::unique_lock<std::mutex> lock(mutex_);
+    std::chrono::milliseconds time = std::chrono::milliseconds(3000);
+
+    // wait for command
+    while (command_queue_.size() == 0) {
+      if (not_empty_.wait_for(lock, time) == std::cv_status::timeout) {
+        break;
+      }
+    }
+    ASSERT(command_queue_.size() > 0);
+    CommandPacketView command = command_queue_.front();
+    EXPECT_EQ(command.GetOpCode(), op_code);
+    command_queue_.pop();
+    return command;
+  }
+
+  void ListDependencies(ModuleList* list) override {}
+  void Start() override {}
+  void Stop() override {}
+
+  constexpr static uint16_t acl_data_packet_length = 1024;
+  constexpr static uint8_t synchronous_data_packet_length = 60;
+  constexpr static uint16_t total_num_acl_data_packets = 10;
+  constexpr static uint16_t total_num_synchronous_data_packets = 12;
+
+ private:
+  common::Callback<void(EventPacketView)> number_of_completed_packets_callback_;
+  os::Handler* client_handler_;
+  std::queue<CommandPacketView> command_queue_;
+  mutable std::mutex mutex_;
+  std::condition_variable not_empty_;
+};
+
+class ControllerTest : public ::testing::Test {
+ protected:
+  void SetUp() override {
+    test_hci_layer_ = new TestHciLayer;
+    fake_registry_.InjectTestModule(&HciLayer::Factory, test_hci_layer_);
+    client_handler_ = fake_registry_.GetTestModuleHandler(&HciLayer::Factory);
+    fake_registry_.Start<Controller>(&thread_);
+    controller_ = static_cast<Controller*>(fake_registry_.GetModuleUnderTest(&Controller::Factory));
+  }
+
+  void TearDown() override {
+    fake_registry_.StopAll();
+  }
+
+  TestModuleRegistry fake_registry_;
+  TestHciLayer* test_hci_layer_ = nullptr;
+  os::Thread& thread_ = fake_registry_.GetTestThread();
+  Controller* controller_ = nullptr;
+  os::Handler* client_handler_ = nullptr;
+};
+
+TEST_F(ControllerTest, startup_teardown) {}
+
+TEST_F(ControllerTest, read_controller_info) {
+  std::promise<void> callback_completed;
+  ASSERT_EQ(controller_->GetControllerAclPacketLength(), test_hci_layer_->acl_data_packet_length);
+  ASSERT_EQ(controller_->GetControllerNumAclPacketBuffers(), test_hci_layer_->total_num_acl_data_packets);
+  ASSERT_EQ(controller_->GetControllerScoPacketLength(), test_hci_layer_->synchronous_data_packet_length);
+  ASSERT_EQ(controller_->GetControllerNumScoPacketBuffers(), test_hci_layer_->total_num_synchronous_data_packets);
+  ASSERT_EQ(controller_->GetControllerMacAddress(), Address::kAny);
+  LocalVersionInformation local_version_information = controller_->GetControllerLocalVersionInformation();
+  ASSERT_EQ(local_version_information.hci_version_, HciVersion::V_5_0);
+  ASSERT_EQ(local_version_information.hci_revision_, 0x1234);
+  ASSERT_EQ(local_version_information.lmp_version_, LmpVersion::V_4_2);
+  ASSERT_EQ(local_version_information.manufacturer_name_, 0xBAD);
+  ASSERT_EQ(local_version_information.lmp_subversion_, 0x5678);
+  std::array<uint8_t, 64> supported_commands;
+  for (int i = 0; i < 37; i++) {
+    supported_commands[i] = 0xff;
+  }
+  for (int i = 37; i < 64; i++) {
+    supported_commands[i] = 0x00;
+  }
+  ASSERT_EQ(controller_->GetControllerLocalSupportedCommands(), supported_commands);
+  ASSERT_EQ(controller_->GetControllerLocalSupportedFeatures(), 0x012345678abcdef);
+  ASSERT_EQ(controller_->GetControllerLocalExtendedFeaturesMaxPageNumber(), 0x02);
+  ASSERT_EQ(controller_->GetControllerLocalExtendedFeatures(0), 0x012345678abcdef);
+  ASSERT_EQ(controller_->GetControllerLocalExtendedFeatures(1), 0x012345678abcdf0);
+  ASSERT_EQ(controller_->GetControllerLocalExtendedFeatures(2), 0x012345678abcdf1);
+  ASSERT_EQ(controller_->GetControllerLocalExtendedFeatures(100), 0x00);
+  ASSERT_EQ(controller_->GetControllerLeBufferSize().le_data_packet_length_, 0x16);
+  ASSERT_EQ(controller_->GetControllerLeBufferSize().total_num_le_packets_, 0x08);
+  ASSERT_EQ(controller_->GetControllerLeLocalSupportedFeatures(), 0x001f123456789abc);
+  ASSERT_EQ(controller_->GetControllerLeSupportedStates(), 0x001f123456789abe);
+  ASSERT_EQ(controller_->GetControllerLeMaximumDataLength().supported_max_tx_octets_, 0x12);
+  ASSERT_EQ(controller_->GetControllerLeMaximumDataLength().supported_max_rx_octets_, 0x56);
+  ASSERT_EQ(controller_->GetControllerLeMaximumAdvertisingDataLength(), 0x0672);
+  ASSERT_EQ(controller_->GetControllerLeNumberOfSupportedAdverisingSets(), 0xF0);
+}
+
+TEST_F(ControllerTest, read_write_local_name) {
+  ASSERT_EQ(controller_->GetControllerLocalName(), "DUT");
+  controller_->WriteLocalName("New name");
+  ASSERT_EQ(controller_->GetControllerLocalName(), "New name");
+}
+
+TEST_F(ControllerTest, send_set_event_mask_command) {
+  controller_->SetEventMask(0x00001FFFFFFFFFFF);
+  auto packet = test_hci_layer_->GetCommand(OpCode::SET_EVENT_MASK);
+  auto command = SetEventMaskView::Create(packet);
+  ASSERT(command.IsValid());
+  ASSERT_EQ(command.GetEventMask(), 0x00001FFFFFFFFFFF);
+}
+
+TEST_F(ControllerTest, send_reset_command) {
+  controller_->Reset();
+  auto packet = test_hci_layer_->GetCommand(OpCode::RESET);
+  auto command = ResetView::Create(packet);
+  ASSERT(command.IsValid());
+}
+
+TEST_F(ControllerTest, send_set_event_filter_command) {
+  controller_->SetEventFilterInquiryResultAllDevices();
+  auto packet = test_hci_layer_->GetCommand(OpCode::SET_EVENT_FILTER);
+  auto set_event_filter_view1 = SetEventFilterView::Create(packet);
+  auto set_event_filter_inquiry_result_view1 = SetEventFilterInquiryResultView::Create(set_event_filter_view1);
+  auto command1 = SetEventFilterInquiryResultAllDevicesView::Create(set_event_filter_inquiry_result_view1);
+  ASSERT(command1.IsValid());
+
+  ClassOfDevice class_of_device({0xab, 0xcd, 0xef});
+  ClassOfDevice class_of_device_mask({0x12, 0x34, 0x56});
+  controller_->SetEventFilterInquiryResultClassOfDevice(class_of_device, class_of_device_mask);
+  packet = test_hci_layer_->GetCommand(OpCode::SET_EVENT_FILTER);
+  auto set_event_filter_view2 = SetEventFilterView::Create(packet);
+  auto set_event_filter_inquiry_result_view2 = SetEventFilterInquiryResultView::Create(set_event_filter_view2);
+  auto command2 = SetEventFilterInquiryResultClassOfDeviceView::Create(set_event_filter_inquiry_result_view2);
+  ASSERT(command2.IsValid());
+  ASSERT_EQ(command2.GetClassOfDevice(), class_of_device);
+
+  Address bdaddr({0x12, 0x34, 0x56, 0x78, 0x9a, 0xbc});
+  controller_->SetEventFilterConnectionSetupAddress(bdaddr, AutoAcceptFlag::AUTO_ACCEPT_ON_ROLE_SWITCH_ENABLED);
+  packet = test_hci_layer_->GetCommand(OpCode::SET_EVENT_FILTER);
+  auto set_event_filter_view3 = SetEventFilterView::Create(packet);
+  auto set_event_filter_connection_setup_view = SetEventFilterConnectionSetupView::Create(set_event_filter_view3);
+  auto command3 = SetEventFilterConnectionSetupAddressView::Create(set_event_filter_connection_setup_view);
+  ASSERT(command3.IsValid());
+  ASSERT_EQ(command3.GetAddress(), bdaddr);
+}
+
+TEST_F(ControllerTest, send_host_buffer_size_command) {
+  controller_->HostBufferSize(0xFF00, 0xF1, 0xFF02, 0xFF03);
+  auto packet = test_hci_layer_->GetCommand(OpCode::HOST_BUFFER_SIZE);
+  auto command = HostBufferSizeView::Create(packet);
+  ASSERT(command.IsValid());
+  ASSERT_EQ(command.GetHostAclDataPacketLength(), 0xFF00);
+  ASSERT_EQ(command.GetHostSynchronousDataPacketLength(), 0xF1);
+  ASSERT_EQ(command.GetHostTotalNumAclDataPackets(), 0xFF02);
+  ASSERT_EQ(command.GetHostTotalNumSynchronousDataPackets(), 0xFF03);
+}
+
+TEST_F(ControllerTest, send_le_set_event_mask_command) {
+  controller_->LeSetEventMask(0x000000000000001F);
+  auto packet = test_hci_layer_->GetCommand(OpCode::LE_SET_EVENT_MASK);
+  auto command = LeSetEventMaskView::Create(packet);
+  ASSERT(command.IsValid());
+  ASSERT_EQ(command.GetLeEventMask(), 0x000000000000001F);
+}
+
+TEST_F(ControllerTest, is_supported_test) {
+  ASSERT_TRUE(controller_->IsSupported(OpCode::INQUIRY));
+  ASSERT_TRUE(controller_->IsSupported(OpCode::REJECT_CONNECTION_REQUEST));
+  ASSERT_TRUE(controller_->IsSupported(OpCode::ACCEPT_CONNECTION_REQUEST));
+  ASSERT_FALSE(controller_->IsSupported(OpCode::LE_REMOVE_ADVERTISING_SET));
+  ASSERT_FALSE(controller_->IsSupported(OpCode::LE_CLEAR_ADVERTISING_SETS));
+  ASSERT_FALSE(controller_->IsSupported(OpCode::LE_SET_PERIODIC_ADVERTISING_PARAM));
+}
+
+TEST_F(ControllerTest, feature_spec_version_055_test) {
+  EXPECT_EQ(controller_->GetControllerVendorCapabilities().version_supported_, 55);
+  EXPECT_TRUE(controller_->IsSupported(OpCode::LE_MULTI_ADVT));
+  EXPECT_FALSE(controller_->IsSupported(OpCode::LE_TRACK_ADV));
+  EXPECT_FALSE(controller_->IsSupported(OpCode::CONTROLLER_DEBUG_INFO));
+  EXPECT_FALSE(controller_->IsSupported(OpCode::CONTROLLER_A2DP_OPCODE));
+  feature_spec_version = 95;
+}
+
+TEST_F(ControllerTest, feature_spec_version_095_test) {
+  EXPECT_EQ(controller_->GetControllerVendorCapabilities().version_supported_, 95);
+  EXPECT_TRUE(controller_->IsSupported(OpCode::LE_MULTI_ADVT));
+  EXPECT_TRUE(controller_->IsSupported(OpCode::LE_TRACK_ADV));
+  EXPECT_FALSE(controller_->IsSupported(OpCode::CONTROLLER_DEBUG_INFO));
+  EXPECT_FALSE(controller_->IsSupported(OpCode::CONTROLLER_A2DP_OPCODE));
+  feature_spec_version = 96;
+}
+
+TEST_F(ControllerTest, feature_spec_version_096_test) {
+  EXPECT_EQ(controller_->GetControllerVendorCapabilities().version_supported_, 96);
+  EXPECT_TRUE(controller_->IsSupported(OpCode::LE_MULTI_ADVT));
+  EXPECT_TRUE(controller_->IsSupported(OpCode::LE_TRACK_ADV));
+  EXPECT_FALSE(controller_->IsSupported(OpCode::CONTROLLER_DEBUG_INFO));
+  EXPECT_FALSE(controller_->IsSupported(OpCode::CONTROLLER_A2DP_OPCODE));
+  feature_spec_version = 98;
+}
+
+TEST_F(ControllerTest, feature_spec_version_098_test) {
+  EXPECT_EQ(controller_->GetControllerVendorCapabilities().version_supported_, 98);
+  EXPECT_TRUE(controller_->IsSupported(OpCode::LE_MULTI_ADVT));
+  EXPECT_TRUE(controller_->IsSupported(OpCode::LE_TRACK_ADV));
+  EXPECT_FALSE(controller_->IsSupported(OpCode::CONTROLLER_DEBUG_INFO));
+  EXPECT_TRUE(controller_->IsSupported(OpCode::CONTROLLER_A2DP_OPCODE));
+}
+
+std::promise<void> credits1_set;
+std::promise<void> credits2_set;
+
+void CheckReceivedCredits(uint16_t handle, uint16_t credits) {
+  switch (handle) {
+    case (kHandle1):
+      ASSERT_EQ(kCredits1, credits);
+      credits1_set.set_value();
+      break;
+    case (kHandle2):
+      ASSERT_EQ(kCredits2, credits);
+      credits2_set.set_value();
+      break;
+    default:
+      ASSERT_LOG(false, "Unknown handle 0x%0hx with 0x%0hx credits", handle, credits);
+  }
+}
+
+TEST_F(ControllerTest, aclCreditCallbacksTest) {
+  controller_->RegisterCompletedAclPacketsCallback(common::Bind(&CheckReceivedCredits), client_handler_);
+
+  test_hci_layer_->IncomingCredit();
+
+  credits1_set.get_future().wait();
+  credits2_set.get_future().wait();
+}
+}  // namespace
+}  // namespace hci
+}  // namespace bluetooth
diff --git a/gd/hci/device.cc b/gd/hci/device.cc
new file mode 100644
index 0000000..d008dae
--- /dev/null
+++ b/gd/hci/device.cc
@@ -0,0 +1,32 @@
+/******************************************************************************
+ *
+ *  Copyright 2019 The Android Open Source Project
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at:
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ ******************************************************************************/
+#include "hci/device.h"
+
+using namespace bluetooth::hci;
+
+std::string Device::generate_uid() {
+  // TODO(optedoblivion): Figure out a good way to do this for what we want
+  // to do
+  // TODO(optedoblivion): Need to make a way to override something for LE pub addr case
+  // Not sure if something like this is needed, but here is the idea (I think it came from mylesgw)
+  // CLASSIC: have all 0s in front for classic then have private address
+  // LE: have first public address in front then all 0s
+  // LE: have first public address in front then private address
+  //
+  return address_.ToString();
+}
diff --git a/gd/hci/device.h b/gd/hci/device.h
new file mode 100644
index 0000000..8324d00
--- /dev/null
+++ b/gd/hci/device.h
@@ -0,0 +1,136 @@
+/******************************************************************************
+ *
+ *  Copyright 2019 The Android Open Source Project
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at:
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ ******************************************************************************/
+#pragma once
+
+#include <string>
+
+#include "hci/address.h"
+#include "hci/class_of_device.h"
+
+namespace bluetooth::hci {
+
+/**
+ * Used to determine device functionality
+ */
+enum DeviceType { DUAL, CLASSIC, LE };
+
+/**
+ * Represents a physical HCI device.
+ *
+ * <p>Contains all of the metadata required to represent a phycial device.
+ *
+ * <p>Devices should only be created and modified by HCI.
+ */
+class Device {
+ public:
+  virtual ~Device() = default;
+
+  Address GetAddress() const {
+    return address_;
+  }
+
+  /**
+   * Returns 1 of 3 enum values for device's type (DUAL, CLASSIC, LE)
+   */
+  DeviceType GetDeviceType() const {
+    return device_type_;
+  }
+
+  /**
+   * Unique identifier for bluetooth devices
+   *
+   * @return string representation of the uuid
+   */
+  std::string /** use UUID when ported */ GetUuid() {
+    return uid_;
+  }
+
+  std::string GetName() {
+    return name_;
+  }
+
+  ClassOfDevice GetClassOfDevice() {
+    return class_of_device_;
+  }
+
+  bool IsBonded() {
+    return is_bonded_;
+  }
+
+  bool operator==(const Device& rhs) const {
+    return this->uid_ == rhs.uid_ && this->address_ == rhs.address_ && this->device_type_ == rhs.device_type_ &&
+           this->is_bonded_ == rhs.is_bonded_;
+  }
+
+ protected:
+  friend class DeviceDatabase;
+  friend class DualDevice;
+
+  /**
+   * @param raw_address the address of the device
+   * @param device_type specify the type of device to create
+   */
+  Device(Address address, DeviceType device_type)
+      : address_(address), device_type_(device_type), uid_(generate_uid()), name_(""), class_of_device_() {}
+
+  /**
+   * Called only by friend class DeviceDatabase
+   *
+   * @param address
+   */
+  virtual void SetAddress(Address address) {
+    address_ = address;
+    uid_ = generate_uid();
+  }
+
+  /**
+   * Set the type of the device.
+   *
+   * <p>Needed by dual mode to arbitrarily set the valure to DUAL for corresponding LE/Classic devices
+   *
+   * @param type of device
+   */
+  void SetDeviceType(DeviceType type) {
+    device_type_ = type;
+  }
+
+  void SetName(std::string& name) {
+    name_ = name;
+  }
+
+  void SetClassOfDevice(ClassOfDevice class_of_device) {
+    class_of_device_ = class_of_device;
+  }
+
+  void SetIsBonded(bool is_bonded) {
+    is_bonded_ = is_bonded;
+  }
+
+ private:
+  Address address_{Address::kEmpty};
+  DeviceType device_type_;
+  std::string uid_;
+  std::string name_;
+  ClassOfDevice class_of_device_;
+  bool is_bonded_ = false;
+
+  /* Uses specific information about the device to calculate a UID */
+  std::string generate_uid();
+};
+
+}  // namespace bluetooth::hci
diff --git a/gd/hci/device_database.cc b/gd/hci/device_database.cc
new file mode 100644
index 0000000..0027074
--- /dev/null
+++ b/gd/hci/device_database.cc
@@ -0,0 +1,276 @@
+/******************************************************************************
+ *
+ *  Copyright 2019 The Android Open Source Project
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at:
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ ******************************************************************************/
+#include "hci/device_database.h"
+
+#include <memory>
+#include <utility>
+
+#include "hci/classic_device.h"
+#include "hci/dual_device.h"
+#include "hci/le_device.h"
+#include "os/log.h"
+
+using namespace bluetooth::hci;
+
+std::shared_ptr<ClassicDevice> DeviceDatabase::CreateClassicDevice(Address address) {
+  ClassicDevice device(address);
+  const std::string uuid = device.GetUuid();
+  AddDeviceToMap(std::move(device));
+  return GetClassicDevice(uuid);
+}
+
+std::shared_ptr<LeDevice> DeviceDatabase::CreateLeDevice(Address address) {
+  LeDevice device(address);
+  const std::string uuid = device.GetUuid();
+  AddDeviceToMap(std::move(device));
+  return GetLeDevice(uuid);
+}
+
+std::shared_ptr<DualDevice> DeviceDatabase::CreateDualDevice(Address address) {
+  auto classic = CreateClassicDevice(address);
+  auto le = CreateLeDevice(address);
+  if (classic && le) {
+    DualDevice device(address, classic, le);
+    std::string uuid = device.GetUuid();
+    AddDeviceToMap(std::move(device));
+    return GetDualDevice(uuid);
+  }
+  LOG_WARN("Attempting to instert a DUAL device that already exists!");
+  return std::shared_ptr<DualDevice>();
+}
+
+bool DeviceDatabase::RemoveDevice(const std::shared_ptr<Device>& device) {
+  const DeviceType type = device->GetDeviceType();
+  bool success;
+  switch (type) {
+    case CLASSIC:
+      success = false;
+      {
+        std::lock_guard<std::mutex> lock(device_map_mutex_);
+        auto classic_it = classic_device_map_.find(device->GetUuid());
+        // If we have a record with the same key
+        if (classic_it != classic_device_map_.end()) {
+          classic_device_map_.erase(device->GetUuid());
+          success = true;
+        }
+      }
+      if (success) {
+        ASSERT_LOG(WriteToDisk(), "Failed to write data to disk!");
+      } else {
+        LOG_WARN("Device not in database!");
+      }
+      return success;
+    case LE:
+      success = false;
+      {
+        std::lock_guard<std::mutex> lock(device_map_mutex_);
+        auto le_it = le_device_map_.find(device->GetUuid());
+        // If we have a record with the same key
+        if (le_it != le_device_map_.end()) {
+          le_device_map_.erase(device->GetUuid());
+          success = true;
+        }
+      }
+      if (success) {
+        ASSERT_LOG(WriteToDisk(), "Failed to write data to disk!");
+      } else {
+        LOG_WARN("Device not in database!");
+      }
+      return success;
+    case DUAL:
+      std::shared_ptr<DualDevice> dual_device = nullptr;
+      {
+        std::lock_guard<std::mutex> lock(device_map_mutex_);
+        auto dual_it = dual_device_map_.find(device->GetUuid());
+        if (dual_it != dual_device_map_.end()) {
+          dual_device = GetDualDevice(device->GetUuid());
+        }
+      }
+      success = false;
+      if (dual_device != nullptr) {
+        if (RemoveDevice(dual_device->GetClassicDevice()) && RemoveDevice(dual_device->GetLeDevice())) {
+          dual_device_map_.erase(device->GetUuid());
+          success = true;
+        }
+      }
+      if (success) {
+        ASSERT_LOG(WriteToDisk(), "Failed to write data to disk!");
+      } else {
+        LOG_WARN("Device not in database!");
+      }
+      return success;
+  }
+}
+
+std::shared_ptr<ClassicDevice> DeviceDatabase::GetClassicDevice(const std::string& uuid) {
+  std::lock_guard<std::mutex> lock(device_map_mutex_);
+  auto it = classic_device_map_.find(uuid);
+  if (it != classic_device_map_.end()) {
+    return it->second;
+  }
+  LOG_WARN("Device '%s' not found!", uuid.c_str());
+  return std::shared_ptr<ClassicDevice>();
+}
+
+std::shared_ptr<LeDevice> DeviceDatabase::GetLeDevice(const std::string& uuid) {
+  std::lock_guard<std::mutex> lock(device_map_mutex_);
+  auto it = le_device_map_.find(uuid);
+  if (it != le_device_map_.end()) {
+    return it->second;
+  }
+  LOG_WARN("Device '%s' not found!", uuid.c_str());
+  return std::shared_ptr<LeDevice>();
+}
+
+std::shared_ptr<DualDevice> DeviceDatabase::GetDualDevice(const std::string& uuid) {
+  std::lock_guard<std::mutex> lock(device_map_mutex_);
+  auto it = dual_device_map_.find(uuid);
+  if (it != dual_device_map_.end()) {
+    return it->second;
+  }
+  LOG_WARN("Device '%s' not found!", uuid.c_str());
+  return std::shared_ptr<DualDevice>();
+}
+
+bool DeviceDatabase::UpdateDeviceAddress(const std::shared_ptr<Device>& device, Address new_address) {
+  // Hold onto device
+  const DeviceType type = device->GetDeviceType();
+  if (type == CLASSIC) {
+    auto classic_device = GetClassicDevice(device->GetUuid());
+    // This gets rid of the shared_ptr in the map
+    ASSERT_LOG(RemoveDevice(device), "Failed to remove the device!");
+    classic_device->SetAddress(new_address);
+    // Move the value located at the pointer
+    return AddDeviceToMap(std::move(*(classic_device.get())));
+  } else if (type == LE) {
+    auto le_device = GetLeDevice(device->GetUuid());
+    // This gets rid of the shared_ptr in the map
+    ASSERT_LOG(RemoveDevice(device), "Failed to remove the device!");
+    le_device->SetAddress(new_address);
+    // Move the value located at the pointer
+    return AddDeviceToMap(std::move(*(le_device.get())));
+  } else if (type == DUAL) {
+    auto dual_device = GetDualDevice(device->GetUuid());
+    // This gets rid of the shared_ptr in the map
+    ASSERT_LOG(RemoveDevice(device), "Failed to remove the device!");
+    dual_device->SetAddress(new_address);
+    // Move the value located at the pointer
+    return AddDeviceToMap(std::move(*(dual_device.get())));
+  }
+  LOG_ALWAYS_FATAL("Someone added a device type but didn't account for it here.");
+  return false;
+}
+
+bool DeviceDatabase::AddDeviceToMap(ClassicDevice&& device) {
+  const std::string uuid = device.GetUuid();
+  bool success = false;
+  {
+    std::lock_guard<std::mutex> lock(device_map_mutex_);
+    auto it = classic_device_map_.find(device.GetUuid());
+    // If we have a record with the same key
+    if (it != classic_device_map_.end()) {
+      // We don't want to insert and overwrite
+      return false;
+    }
+    std::shared_ptr<ClassicDevice> device_ptr = std::make_shared<ClassicDevice>(std::move(device));
+    // returning the boolean value of insert success
+    if (classic_device_map_
+            .insert(std::pair<std::string, std::shared_ptr<ClassicDevice>>(device_ptr->GetUuid(), device_ptr))
+            .second) {
+      success = true;
+    }
+  }
+  if (success) {
+    ASSERT_LOG(WriteToDisk(), "Failed to write data to disk!");
+  } else {
+    LOG_WARN("Failed to add device '%s' to map.", uuid.c_str());
+  }
+  return success;
+}
+
+bool DeviceDatabase::AddDeviceToMap(LeDevice&& device) {
+  const std::string uuid = device.GetUuid();
+  bool success = false;
+  {
+    std::lock_guard<std::mutex> lock(device_map_mutex_);
+    auto it = le_device_map_.find(device.GetUuid());
+    // If we have a record with the same key
+    if (it != le_device_map_.end()) {
+      // We don't want to insert and overwrite
+      return false;
+    }
+    std::shared_ptr<LeDevice> device_ptr = std::make_shared<LeDevice>(std::move(device));
+    // returning the boolean value of insert success
+    if (le_device_map_.insert(std::pair<std::string, std::shared_ptr<LeDevice>>(device_ptr->GetUuid(), device_ptr))
+            .second) {
+      success = true;
+    }
+  }
+  if (success) {
+    ASSERT_LOG(WriteToDisk(), "Failed to write data to disk!");
+  } else {
+    LOG_WARN("Failed to add device '%s' to map.", uuid.c_str());
+  }
+  return success;
+}
+
+bool DeviceDatabase::AddDeviceToMap(DualDevice&& device) {
+  const std::string uuid = device.GetUuid();
+  bool success = false;
+  {
+    std::lock_guard<std::mutex> lock(device_map_mutex_);
+    auto it = dual_device_map_.find(device.GetUuid());
+    // If we have a record with the same key
+    if (it != dual_device_map_.end()) {
+      // We don't want to insert and overwrite
+      return false;
+    }
+    std::shared_ptr<DualDevice> device_ptr = std::make_shared<DualDevice>(std::move(device));
+    // returning the boolean value of insert success
+    if (dual_device_map_.insert(std::pair<std::string, std::shared_ptr<DualDevice>>(device_ptr->GetUuid(), device_ptr))
+            .second) {
+      success = true;
+    }
+  }
+  if (success) {
+    ASSERT_LOG(WriteToDisk(), "Failed to write data to disk!");
+  } else {
+    LOG_WARN("Failed to add device '%s' to map.", uuid.c_str());
+  }
+  return success;
+}
+
+bool DeviceDatabase::WriteToDisk() {
+  // TODO(optedoblivion): Implement
+  // TODO(optedoblivion): FIX ME!
+  // If synchronous stack dies before async write, we can miss adding device
+  // post(WriteToDisk());
+  // Current Solution: Synchronous disk I/O...
+  std::lock_guard<std::mutex> lock(device_map_mutex_);
+  // Collect information to sync to database
+  // Create SQL query for insert/update
+  // submit SQL
+  return true;
+}
+
+bool DeviceDatabase::ReadFromDisk() {
+  // TODO(optedoblivion): Implement
+  // Current Solution: Synchronous disk I/O...
+  std::lock_guard<std::mutex> lock(device_map_mutex_);
+  return true;
+}
diff --git a/gd/hci/device_database.h b/gd/hci/device_database.h
new file mode 100644
index 0000000..88434a4
--- /dev/null
+++ b/gd/hci/device_database.h
@@ -0,0 +1,149 @@
+/******************************************************************************
+ *
+ *  Copyright 2019 The Android Open Source Project
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at:
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ ******************************************************************************/
+#pragma once
+
+#include <map>
+#include <mutex>
+
+#include "hci/classic_device.h"
+#include "hci/device.h"
+#include "hci/dual_device.h"
+#include "hci/le_device.h"
+#include "os/log.h"
+
+namespace bluetooth::hci {
+
+/**
+ * Stores all of the paired or connected devices in the database.
+ *
+ * <p>If a device is stored here it is actively being used by the stack.
+ *
+ * <p>This database is not meant for scan results.
+ */
+class DeviceDatabase {
+ public:
+  DeviceDatabase() : classic_device_map_(), le_device_map_(), dual_device_map_() {
+    if (!ReadFromDisk()) {
+      LOG_WARN("First boot or missing data!");
+    }
+  }
+
+  /**
+   * Adds a device to the internal memory map and triggers a WriteToDisk.
+   *
+   * @param address private address for device
+   * @return weak pointer to the device or empty pointer if device already exists
+   */
+  std::shared_ptr<ClassicDevice> CreateClassicDevice(Address address);
+
+  /**
+   * Adds a device to the internal memory map and triggers a WriteToDisk.
+   *
+   * @param address private address for device
+   * @return weak pointer to the device or empty pointer if device already exists
+   */
+  std::shared_ptr<LeDevice> CreateLeDevice(Address address);
+
+  /**
+   * Adds a device to the internal memory map and triggers a WriteToDisk.
+   *
+   * @param address private address for device
+   * @return weak pointer to the device or empty pointer if device already exists
+   */
+  std::shared_ptr<DualDevice> CreateDualDevice(Address address);
+
+  /**
+   * Fetches a Classic Device matching the given uuid.
+   *
+   * @param uuid generated uuid from a Device
+   * @return a weak reference to the matching Device or empty shared_ptr (nullptr)
+   */
+  std::shared_ptr<ClassicDevice> GetClassicDevice(const std::string& uuid);
+
+  /**
+   * Fetches a Le Device matching the given uuid.
+   *
+   * @param uuid generated uuid from a Device
+   * @return a weak reference to the matching Device or empty shared_ptr (nullptr)
+   */
+  std::shared_ptr<LeDevice> GetLeDevice(const std::string& uuid);
+
+  /**
+   * Fetches a Dual Device matching the given uuid.
+   *
+   * @param uuid generated uuid from a Device
+   * @return a weak reference to the matching Device or empty shared_ptr (nullptr)
+   */
+  std::shared_ptr<DualDevice> GetDualDevice(const std::string& uuid);
+
+  /**
+   * Removes a device from the internal database.
+   *
+   * @param device weak pointer to device to remove from the database
+   * @return <code>true</code> if the device is removed
+   */
+  bool RemoveDevice(const std::shared_ptr<Device>& device);
+
+  /**
+   * Changes an address for a device.
+   *
+   * Also fixes the key mapping for the device.
+   *
+   * @param new_address this will replace the existing address
+   * @return <code>true</code> if updated
+   */
+  bool UpdateDeviceAddress(const std::shared_ptr<Device>& device, Address new_address);
+
+  // TODO(optedoblivion): Make interfaces for device modification
+  // We want to keep the device modification encapsulated to the DeviceDatabase.
+  // Pass around shared_ptr to device, device metadata only accessible via Getters.
+  // Choices:
+  //  a) Have Getters/Setters on device object
+  //  b) Have Getters/Setters on device database accepting a device object
+  //  c) Have Getters on device object and Setters on device database accepting a device object
+  // I chose to go with option c for now as I think it is the best option.
+
+  /**
+   * Fetches a list of classic devices.
+   *
+   * @return vector of weak pointers to classic devices
+   */
+  std::vector<std::shared_ptr<Device>> GetClassicDevices();
+
+  /**
+   * Fetches a list of le devices
+   *
+   * @return vector of weak pointers to le devices
+   */
+  std::vector<std::shared_ptr<Device>> GetLeDevices();
+
+ private:
+  std::mutex device_map_mutex_;
+  std::map<std::string, std::shared_ptr<ClassicDevice>> classic_device_map_;
+  std::map<std::string, std::shared_ptr<LeDevice>> le_device_map_;
+  std::map<std::string, std::shared_ptr<DualDevice>> dual_device_map_;
+
+  bool AddDeviceToMap(ClassicDevice&& device);
+  bool AddDeviceToMap(LeDevice&& device);
+  bool AddDeviceToMap(DualDevice&& device);
+
+  bool WriteToDisk();
+  bool ReadFromDisk();
+};
+
+}  // namespace bluetooth::hci
diff --git a/gd/hci/device_database_test.cc b/gd/hci/device_database_test.cc
new file mode 100644
index 0000000..330571d
--- /dev/null
+++ b/gd/hci/device_database_test.cc
@@ -0,0 +1,134 @@
+/******************************************************************************
+ *
+ *  Copyright 2019 The Android Open Source Project
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at:
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ ******************************************************************************/
+#include "device_database.h"
+#include "classic_device.h"
+
+#include <gtest/gtest.h>
+
+using namespace bluetooth::hci;
+
+namespace bluetooth::hci {
+namespace {
+
+Address address({0x01, 0x02, 0x03, 0x04, 0x05, 0x06});
+std::string address_str = "06:05:04:03:02:01";
+class DeviceDatabaseTest : public ::testing::Test {
+ protected:
+  DeviceDatabaseTest() = default;
+
+  void SetUp() override {}
+
+  void TearDown() override {}
+
+  DeviceDatabase device_database_;
+};
+
+TEST_F(DeviceDatabaseTest, create_classic_device) {
+  auto classic_device = device_database_.CreateClassicDevice(address);
+  ASSERT_TRUE(classic_device);
+  ASSERT_EQ(CLASSIC, classic_device->GetDeviceType());
+  ASSERT_EQ(address_str, classic_device->GetUuid());
+}
+
+TEST_F(DeviceDatabaseTest, create_le_device) {
+  auto le_device = device_database_.CreateLeDevice(address);
+  ASSERT_TRUE(le_device);
+  ASSERT_EQ(LE, le_device->GetDeviceType());
+  ASSERT_EQ(address_str, le_device->GetUuid());
+}
+
+TEST_F(DeviceDatabaseTest, create_dual_device) {
+  auto dual_device = device_database_.CreateDualDevice(address);
+  ASSERT_TRUE(dual_device);
+  ASSERT_EQ(DUAL, dual_device->GetDeviceType());
+  ASSERT_EQ(DUAL, dual_device->GetClassicDevice()->GetDeviceType());
+  ASSERT_EQ(DUAL, dual_device->GetLeDevice()->GetDeviceType());
+  ASSERT_EQ(address_str, dual_device->GetUuid());
+}
+
+// Shouldn't fail when creating twice.  Should just get back a s_ptr the same device
+TEST_F(DeviceDatabaseTest, create_classic_device_twice) {
+  auto classic_device = device_database_.CreateClassicDevice(address);
+  ASSERT_TRUE(classic_device);
+  ASSERT_EQ(CLASSIC, classic_device->GetDeviceType());
+  ASSERT_EQ(address_str, classic_device->GetUuid());
+  ASSERT_TRUE(device_database_.CreateClassicDevice(address));
+}
+
+TEST_F(DeviceDatabaseTest, create_le_device_twice) {
+  auto le_device = device_database_.CreateLeDevice(address);
+  ASSERT_TRUE(le_device);
+  ASSERT_EQ(LE, le_device->GetDeviceType());
+  ASSERT_EQ(address_str, le_device->GetUuid());
+  ASSERT_TRUE(device_database_.CreateLeDevice(address));
+}
+
+TEST_F(DeviceDatabaseTest, create_dual_device_twice) {
+  auto dual_device = device_database_.CreateDualDevice(address);
+  ASSERT_TRUE(dual_device);
+
+  // Dual
+  ASSERT_EQ(DUAL, dual_device->GetDeviceType());
+  ASSERT_EQ(address_str, dual_device->GetUuid());
+
+  // Classic
+  ASSERT_EQ(DUAL, dual_device->GetClassicDevice()->GetDeviceType());
+  ASSERT_EQ(address_str, dual_device->GetClassicDevice()->GetUuid());
+
+  // LE
+  ASSERT_EQ(DUAL, dual_device->GetLeDevice()->GetDeviceType());
+  ASSERT_EQ(address_str, dual_device->GetLeDevice()->GetUuid());
+
+  ASSERT_TRUE(device_database_.CreateDualDevice(address));
+}
+
+TEST_F(DeviceDatabaseTest, remove_device) {
+  std::shared_ptr<Device> created_device = device_database_.CreateClassicDevice(address);
+  ASSERT_TRUE(created_device);
+  ASSERT_TRUE(device_database_.RemoveDevice(created_device));
+  ASSERT_TRUE(device_database_.CreateClassicDevice(address));
+}
+
+TEST_F(DeviceDatabaseTest, remove_device_twice) {
+  std::shared_ptr<Device> created_device = device_database_.CreateClassicDevice(address);
+  ASSERT_TRUE(device_database_.RemoveDevice(created_device));
+  ASSERT_FALSE(device_database_.RemoveDevice(created_device));
+}
+
+TEST_F(DeviceDatabaseTest, get_nonexistent_device) {
+  std::shared_ptr<Device> device_ptr = device_database_.GetClassicDevice(address_str);
+  ASSERT_FALSE(device_ptr);
+}
+
+TEST_F(DeviceDatabaseTest, address_modification_check) {
+  std::shared_ptr<Device> created_device = device_database_.CreateClassicDevice(address);
+  std::shared_ptr<Device> gotten_device = device_database_.GetClassicDevice(address.ToString());
+  ASSERT_TRUE(created_device);
+  ASSERT_TRUE(gotten_device);
+  ASSERT_EQ(address_str, created_device->GetAddress().ToString());
+  ASSERT_EQ(address_str, gotten_device->GetAddress().ToString());
+  device_database_.UpdateDeviceAddress(created_device, Address({0x01, 0x01, 0x01, 0x01, 0x01, 0x01}));
+  ASSERT_EQ("01:01:01:01:01:01", created_device->GetAddress().ToString());
+  ASSERT_EQ("01:01:01:01:01:01", gotten_device->GetAddress().ToString());
+  std::shared_ptr<Device> gotten_modified_device = device_database_.GetClassicDevice("01:01:01:01:01:01");
+  ASSERT_TRUE(gotten_modified_device);
+  ASSERT_TRUE(device_database_.RemoveDevice(gotten_modified_device));
+  ASSERT_FALSE(device_database_.GetClassicDevice("01:01:01:01:01:01"));
+}
+}  // namespace
+}  // namespace bluetooth::hci
diff --git a/gd/hci/device_test.cc b/gd/hci/device_test.cc
new file mode 100644
index 0000000..1b4fafc
--- /dev/null
+++ b/gd/hci/device_test.cc
@@ -0,0 +1,101 @@
+/******************************************************************************
+ *
+ *  Copyright 2019 The Android Open Source Project
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at:
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ ******************************************************************************/
+#include "device.h"
+#include "classic_device.h"
+
+#include <gtest/gtest.h>
+
+using namespace bluetooth::hci;
+
+static const char* test_addr_str = "bc:9a:78:56:34:12";
+static const uint8_t test_addr[] = {0x12, 0x34, 0x56, 0x78, 0x9a, 0xbc};
+static const Address address(test_addr);
+
+namespace bluetooth::hci {
+namespace {
+class TestableDevice : public Device {
+ public:
+  explicit TestableDevice(Address a) : Device(a, CLASSIC) {}
+
+  void SetTheAddress() {
+    Address a({0x01, 0x02, 0x03, 0x04, 0x05, 0x06});
+    this->SetAddress(a);
+  }
+  void SetTheClassOfDevice() {
+    ClassOfDevice class_of_device({0x01, 0x02, 0x03});
+    this->SetClassOfDevice(class_of_device);
+  }
+  void SetTheName() {
+    std::string name = "Some Name";
+    this->SetName(name);
+  }
+  void SetTheIsBonded() {
+    this->SetIsBonded(true);
+  }
+};
+class DeviceTest : public ::testing::Test {
+ public:
+  DeviceTest() : device_(Address(test_addr)) {}
+
+ protected:
+  void SetUp() override {}
+
+  void TearDown() override {}
+  TestableDevice device_;
+};
+
+TEST_F(DeviceTest, initial_integrity) {
+  ASSERT_STREQ(test_addr_str, device_.GetAddress().ToString().c_str());
+  ASSERT_STREQ(test_addr_str, device_.GetUuid().c_str());
+  ASSERT_EQ(DeviceType::CLASSIC, device_.GetDeviceType());
+  ASSERT_EQ("", device_.GetName());
+}
+
+TEST_F(DeviceTest, set_get_class_of_device) {
+  ClassOfDevice class_of_device({0x01, 0x02, 0x03});
+  ASSERT_NE(class_of_device, device_.GetClassOfDevice());
+  device_.SetTheClassOfDevice();
+  ASSERT_EQ(class_of_device, device_.GetClassOfDevice());
+}
+
+TEST_F(DeviceTest, set_get_name) {
+  std::string name = "Some Name";
+  ASSERT_EQ("", device_.GetName());
+  device_.SetTheName();
+  ASSERT_EQ(name, device_.GetName());
+}
+
+TEST_F(DeviceTest, operator_iseq) {
+  TestableDevice d(address);
+  EXPECT_EQ(device_, d);
+}
+
+TEST_F(DeviceTest, set_address) {
+  ASSERT_EQ(test_addr_str, device_.GetAddress().ToString());
+  device_.SetTheAddress();
+  ASSERT_EQ("06:05:04:03:02:01", device_.GetAddress().ToString());
+}
+
+TEST_F(DeviceTest, set_bonded) {
+  ASSERT_FALSE(device_.IsBonded());
+  device_.SetTheIsBonded();
+  ASSERT_TRUE(device_.IsBonded());
+}
+
+}  // namespace
+}  // namespace bluetooth::hci
diff --git a/gd/hci/dual_device.h b/gd/hci/dual_device.h
new file mode 100644
index 0000000..8d08019
--- /dev/null
+++ b/gd/hci/dual_device.h
@@ -0,0 +1,60 @@
+/******************************************************************************
+ *
+ *  Copyright 2019 The Android Open Source Project
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at:
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ ******************************************************************************/
+#pragma once
+
+#include "hci/classic_device.h"
+#include "hci/device.h"
+#include "hci/le_device.h"
+
+namespace bluetooth::hci {
+
+/**
+ * A device representing a DUAL device.
+ *
+ * <p>This can be a DUAL only.
+ */
+class DualDevice : public Device {
+ public:
+  std::shared_ptr<Device> GetClassicDevice() {
+    return classic_device_;
+  }
+
+  std::shared_ptr<Device> GetLeDevice() {
+    return le_device_;
+  }
+
+ protected:
+  friend class DeviceDatabase;
+  DualDevice(Address address, std::shared_ptr<ClassicDevice> classic_device, std::shared_ptr<LeDevice> le_device)
+      : Device(address, DUAL), classic_device_(std::move(classic_device)), le_device_(std::move(le_device)) {
+    classic_device_->SetDeviceType(DUAL);
+    le_device_->SetDeviceType(DUAL);
+  }
+
+  void SetAddress(Address address) override {
+    Device::SetAddress(address);
+    GetClassicDevice()->SetAddress(address);
+    GetLeDevice()->SetAddress(address);
+  }
+
+ private:
+  std::shared_ptr<ClassicDevice> classic_device_;
+  std::shared_ptr<LeDevice> le_device_;
+};
+
+}  // namespace bluetooth::hci
diff --git a/gd/hci/dual_device_test.cc b/gd/hci/dual_device_test.cc
new file mode 100644
index 0000000..1c4c2b0
--- /dev/null
+++ b/gd/hci/dual_device_test.cc
@@ -0,0 +1,81 @@
+/******************************************************************************
+ *
+ *  Copyright 2019 The Android Open Source Project
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at:
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ ******************************************************************************/
+#include "dual_device.h"
+#include "device.h"
+
+#include <gtest/gtest.h>
+
+using namespace bluetooth::hci;
+
+static const char* test_addr_str = "bc:9a:78:56:34:12";
+static const uint8_t test_addr[] = {0x12, 0x34, 0x56, 0x78, 0x9a, 0xbc};
+static const Address address(test_addr);
+
+namespace bluetooth::hci {
+namespace {
+class TestableClassicDevice : public ClassicDevice {
+ public:
+  explicit TestableClassicDevice(Address a) : ClassicDevice(a) {}
+};
+class TestableLeDevice : public LeDevice {
+ public:
+  explicit TestableLeDevice(Address a) : LeDevice(a) {}
+};
+class TestableDevice : public DualDevice {
+ public:
+  TestableDevice(Address a, std::shared_ptr<TestableClassicDevice>& classic_device,
+                 std::shared_ptr<TestableLeDevice>& le_device)
+      : DualDevice(a, classic_device, le_device) {}
+
+  void SetTheAddress() {
+    Address a({0x01, 0x02, 0x03, 0x04, 0x05, 0x06});
+    this->SetAddress(a);
+  }
+};
+std::shared_ptr<TestableClassicDevice> classic_device = std::make_shared<TestableClassicDevice>(address);
+std::shared_ptr<TestableLeDevice> le_device = std::make_shared<TestableLeDevice>(address);
+class DualDeviceTest : public ::testing::Test {
+ public:
+  DualDeviceTest() : device_(Address(test_addr), classic_device, le_device) {}
+
+ protected:
+  void SetUp() override {}
+
+  void TearDown() override {}
+  TestableDevice device_;
+};
+
+TEST_F(DualDeviceTest, initial_integrity) {
+  Address a = device_.GetAddress();
+  ASSERT_EQ(test_addr_str, a.ToString());
+
+  ASSERT_EQ(DUAL, device_.GetClassicDevice()->GetDeviceType());
+  ASSERT_EQ(a.ToString(), device_.GetClassicDevice()->GetAddress().ToString());
+
+  ASSERT_EQ(DUAL, device_.GetLeDevice()->GetDeviceType());
+  ASSERT_EQ(a.ToString(), device_.GetLeDevice()->GetAddress().ToString());
+
+  device_.SetTheAddress();
+
+  ASSERT_EQ("06:05:04:03:02:01", device_.GetAddress().ToString());
+  ASSERT_EQ("06:05:04:03:02:01", device_.GetClassicDevice()->GetAddress().ToString());
+  ASSERT_EQ("06:05:04:03:02:01", device_.GetLeDevice()->GetAddress().ToString());
+}
+
+}  // namespace
+}  // namespace bluetooth::hci
diff --git a/gd/hci/facade.cc b/gd/hci/facade.cc
new file mode 100644
index 0000000..3aebcbb
--- /dev/null
+++ b/gd/hci/facade.cc
@@ -0,0 +1,796 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "hci/facade.h"
+
+#include <condition_variable>
+#include <memory>
+#include <mutex>
+
+#include "common/bind.h"
+#include "common/blocking_queue.h"
+#include "grpc/grpc_event_stream.h"
+#include "hci/acl_manager.h"
+#include "hci/classic_security_manager.h"
+#include "hci/controller.h"
+#include "hci/facade.grpc.pb.h"
+#include "hci/hci_layer.h"
+#include "hci/hci_packets.h"
+#include "packet/raw_builder.h"
+
+using ::grpc::ServerAsyncResponseWriter;
+using ::grpc::ServerAsyncWriter;
+using ::grpc::ServerContext;
+
+using ::bluetooth::facade::EventStreamRequest;
+using ::bluetooth::packet::RawBuilder;
+
+namespace bluetooth {
+namespace hci {
+
+class AclManagerFacadeService : public AclManagerFacade::Service,
+                                public ::bluetooth::hci::ConnectionCallbacks,
+                                public ::bluetooth::hci::ConnectionManagementCallbacks,
+                                public ::bluetooth::hci::AclManagerCallbacks {
+ public:
+  AclManagerFacadeService(AclManager* acl_manager, Controller* controller, HciLayer* hci_layer,
+                          ::bluetooth::os::Handler* facade_handler)
+      : acl_manager_(acl_manager), controller_(controller), hci_layer_(hci_layer), facade_handler_(facade_handler) {
+    acl_manager_->RegisterCallbacks(this, facade_handler_);
+    acl_manager_->RegisterAclManagerCallbacks(this, facade_handler_);
+  }
+
+  using EventStream = ::bluetooth::grpc::GrpcEventStream<AclData, AclPacketView>;
+
+  ::grpc::Status SetPageScanMode(::grpc::ServerContext* context, const ::bluetooth::hci::PageScanMode* request,
+                                 ::google::protobuf::Empty* response) override {
+    ScanEnable scan_enable = request->enabled() ? ScanEnable::PAGE_SCAN_ONLY : ScanEnable::NO_SCANS;
+    std::promise<void> promise;
+    auto future = promise.get_future();
+    hci_layer_->EnqueueCommand(
+        WriteScanEnableBuilder::Create(scan_enable),
+        common::BindOnce([](std::promise<void> promise, CommandCompleteView) { promise.set_value(); },
+                         std::move(promise)),
+        facade_handler_);
+    future.wait();
+    return ::grpc::Status::OK;
+  }
+
+  ::grpc::Status Connect(::grpc::ServerContext* context, const facade::BluetoothAddress* remote,
+                         ::google::protobuf::Empty* response) override {
+    std::unique_lock<std::mutex> lock(mutex_);
+    Address peer;
+    ASSERT(Address::FromString(remote->address(), peer));
+    acl_manager_->CreateConnection(peer);
+    return ::grpc::Status::OK;
+  }
+
+  ::grpc::Status Disconnect(::grpc::ServerContext* context, const facade::BluetoothAddress* request,
+                            ::google::protobuf::Empty* response) override {
+    std::unique_lock<std::mutex> lock(mutex_);
+    Address peer;
+    Address::FromString(request->address(), peer);
+    auto connection = acl_connections_.find(request->address());
+    if (connection == acl_connections_.end()) {
+      LOG_ERROR("Invalid address");
+      return ::grpc::Status(::grpc::StatusCode::INVALID_ARGUMENT, "Invalid address");
+    } else {
+      connection->second->Disconnect(DisconnectReason::REMOTE_USER_TERMINATED_CONNECTION);
+      return ::grpc::Status::OK;
+    }
+  }
+
+  ::grpc::Status AuthenticationRequested(::grpc::ServerContext* context, const facade::BluetoothAddress* request,
+                                         ::google::protobuf::Empty* response) override {
+    Address peer;
+    Address::FromString(request->address(), peer);
+    auto connection = acl_connections_.find(request->address());
+    if (connection == acl_connections_.end()) {
+      LOG_ERROR("Invalid address");
+      return ::grpc::Status(::grpc::StatusCode::INVALID_ARGUMENT, "Invalid address");
+    } else {
+      connection->second->AuthenticationRequested();
+      return ::grpc::Status::OK;
+    }
+  };
+
+  ::grpc::Status SendAclData(::grpc::ServerContext* context, const AclData* request,
+                             ::google::protobuf::Empty* response) override {
+    std::unique_lock<std::mutex> lock(mutex_);
+    std::promise<void> promise;
+    auto future = promise.get_future();
+    acl_connections_[request->remote().address()]->GetAclQueueEnd()->RegisterEnqueue(
+        facade_handler_, common::Bind(&AclManagerFacadeService::enqueue_packet, common::Unretained(this),
+                                      common::Unretained(request), common::Passed(std::move(promise))));
+    future.wait();
+    return ::grpc::Status::OK;
+  }
+
+  std::unique_ptr<BasePacketBuilder> enqueue_packet(const AclData* request, std::promise<void> promise) {
+    acl_connections_[request->remote().address()]->GetAclQueueEnd()->UnregisterEnqueue();
+    std::string req_string = request->payload();
+    std::unique_ptr<RawBuilder> packet = std::make_unique<RawBuilder>();
+    packet->AddOctets(std::vector<uint8_t>(req_string.begin(), req_string.end()));
+    promise.set_value();
+    return packet;
+  }
+
+  ::grpc::Status FetchAclData(::grpc::ServerContext* context, const facade::EventStreamRequest* request,
+                              ::grpc::ServerWriter<AclData>* writer) override {
+    std::unique_lock<std::mutex> lock(mutex_);
+    return acl_stream_.HandleRequest(context, request, writer);
+  }
+
+  ::grpc::Status TestInternalHciCommands(::grpc::ServerContext* context, const ::google::protobuf::Empty* request,
+                                         ::google::protobuf::Empty* response) {
+    LocalVersionInformation local_version_information = controller_->GetControllerLocalVersionInformation();
+    LOG_DEBUG("local name : %s", controller_->GetControllerLocalName().c_str());
+    controller_->WriteLocalName("Device Under Test");
+    LOG_DEBUG("new local name : %s", controller_->GetControllerLocalName().c_str());
+    LOG_DEBUG("manufacturer name : %d", local_version_information.manufacturer_name_);
+    LOG_DEBUG("hci version : %x", (uint16_t)local_version_information.hci_version_);
+    LOG_DEBUG("lmp version : %x", (uint16_t)local_version_information.lmp_version_);
+    LOG_DEBUG("supported commands : %x", controller_->GetControllerLocalSupportedCommands()[0]);
+    LOG_DEBUG("local extended features :");
+
+    controller_->SetEventMask(0x00001FFFFFFFFFFF);
+    controller_->SetEventFilterInquiryResultAllDevices();
+    ClassOfDevice class_of_device({0xab, 0xcd, 0xef});
+    ClassOfDevice class_of_device_mask({0x12, 0x34, 0x56});
+    controller_->SetEventFilterInquiryResultClassOfDevice(class_of_device, class_of_device_mask);
+    Address bdaddr({0x12, 0x34, 0x56, 0x78, 0x9a, 0xbc});
+    controller_->SetEventFilterInquiryResultAddress(bdaddr);
+    controller_->SetEventFilterConnectionSetupAllDevices(AutoAcceptFlag::AUTO_ACCEPT_OFF);
+    controller_->SetEventFilterConnectionSetupClassOfDevice(class_of_device, class_of_device_mask,
+                                                            AutoAcceptFlag::AUTO_ACCEPT_ON_ROLE_SWITCH_DISABLED);
+    controller_->SetEventFilterConnectionSetupAddress(bdaddr, AutoAcceptFlag::AUTO_ACCEPT_ON_ROLE_SWITCH_ENABLED);
+    controller_->SetEventFilterClearAll();
+    controller_->HostBufferSize(0xFF00, 0xF1, 0xFF02, 0xFF03);
+    return ::grpc::Status::OK;
+  }
+
+  ::grpc::Status TestInternalHciLeCommands(::grpc::ServerContext* context, const ::google::protobuf::Empty* request,
+                                           ::google::protobuf::Empty* response) {
+    LOG_DEBUG("le data packet length : %d", controller_->GetControllerLeBufferSize().le_data_packet_length_);
+    LOG_DEBUG("total num le packets : %d", controller_->GetControllerLeBufferSize().total_num_le_packets_);
+    LOG_DEBUG("le supported max tx octets : %d",
+              controller_->GetControllerLeMaximumDataLength().supported_max_tx_octets_);
+    LOG_DEBUG("le supported max tx times : %d", controller_->GetControllerLeMaximumDataLength().supported_max_tx_time_);
+    LOG_DEBUG("le supported max rx octets : %d",
+              controller_->GetControllerLeMaximumDataLength().supported_max_rx_octets_);
+    LOG_DEBUG("le supported max rx times : %d", controller_->GetControllerLeMaximumDataLength().supported_max_rx_time_);
+    LOG_DEBUG("le maximum advertising data length %d", controller_->GetControllerLeMaximumAdvertisingDataLength());
+    LOG_DEBUG("le number of supported advertising sets %d",
+              controller_->GetControllerLeNumberOfSupportedAdverisingSets());
+
+    controller_->LeSetEventMask(0x000000000000001F);
+    return ::grpc::Status::OK;
+  }
+
+  ::grpc::Status TestClassicConnectionManagementCommands(::grpc::ServerContext* context,
+                                                         const facade::BluetoothAddress* request,
+                                                         ::google::protobuf::Empty* response) {
+    Address peer;
+    Address::FromString(request->address(), peer);
+    auto connection = acl_connections_.find(request->address());
+    if (connection == acl_connections_.end()) {
+      LOG_ERROR("Invalid address");
+      return ::grpc::Status(::grpc::StatusCode::INVALID_ARGUMENT, "Invalid address");
+    } else {
+      // TODO add individual grpc command if necessary
+      connection->second->RoleDiscovery();
+      connection->second->WriteLinkPolicySettings(0x07);
+      connection->second->ReadLinkPolicySettings();
+      connection->second->SniffSubrating(0x1234, 0x1234, 0x1234);
+      connection->second->WriteAutomaticFlushTimeout(0x07FF);
+      connection->second->ReadAutomaticFlushTimeout();
+      connection->second->ReadTransmitPowerLevel(TransmitPowerLevelType::CURRENT);
+      connection->second->ReadTransmitPowerLevel(TransmitPowerLevelType::MAXIMUM);
+      connection->second->WriteLinkSupervisionTimeout(0x5678);
+      connection->second->ReadLinkSupervisionTimeout();
+      connection->second->ReadFailedContactCounter();
+      connection->second->ResetFailedContactCounter();
+      connection->second->ReadLinkQuality();
+      connection->second->ReadAfhChannelMap();
+      connection->second->ReadRssi();
+      connection->second->ReadClock(WhichClock::LOCAL);
+      connection->second->ReadClock(WhichClock::PICONET);
+
+      connection->second->ChangeConnectionPacketType(0xEE1C);
+      connection->second->SetConnectionEncryption(Enable::ENABLED);
+      connection->second->ChangeConnectionLinkKey();
+      connection->second->ReadClockOffset();
+      connection->second->HoldMode(0x0500, 0x0020);
+      connection->second->SniffMode(0x0500, 0x0020, 0x0040, 0x0014);
+      connection->second->ExitSniffMode();
+      connection->second->QosSetup(ServiceType::BEST_EFFORT, 0x1234, 0x1233, 0x1232, 0x1231);
+      connection->second->FlowSpecification(FlowDirection::OUTGOING_FLOW, ServiceType::BEST_EFFORT, 0x1234, 0x1233,
+                                            0x1232, 0x1231);
+      connection->second->Flush();
+
+      acl_manager_->MasterLinkKey(KeyFlag::TEMPORARY);
+      acl_manager_->SwitchRole(peer, Role::MASTER);
+      acl_manager_->WriteDefaultLinkPolicySettings(0x07);
+      acl_manager_->ReadDefaultLinkPolicySettings();
+      return ::grpc::Status::OK;
+    }
+  }
+
+  void on_incoming_acl(std::string address) {
+    auto connection = acl_connections_.find(address);
+    if (connection == acl_connections_.end()) {
+      LOG_ERROR("Invalid address");
+      return;
+    }
+
+    auto packet = connection->second->GetAclQueueEnd()->TryDequeue();
+    auto acl_packet = AclPacketView::Create(*packet);
+    AclData acl_data;
+    acl_data.mutable_remote()->set_address(address);
+    std::string data = std::string(acl_packet.begin(), acl_packet.end());
+    acl_data.set_payload(data);
+    acl_stream_.OnIncomingEvent(acl_data);
+  }
+
+  void OnConnectSuccess(std::unique_ptr<::bluetooth::hci::AclConnection> connection) override {
+    std::unique_lock<std::mutex> lock(mutex_);
+    auto addr = connection->GetAddress();
+    std::shared_ptr<::bluetooth::hci::AclConnection> shared_connection = std::move(connection);
+    acl_connections_.emplace(addr.ToString(), shared_connection);
+    shared_connection->RegisterDisconnectCallback(
+        common::BindOnce(&AclManagerFacadeService::on_disconnect, common::Unretained(this), addr.ToString()),
+        facade_handler_);
+    shared_connection->RegisterCallbacks(this, facade_handler_);
+    connection_complete_stream_.OnIncomingEvent(shared_connection);
+  }
+
+  void OnMasterLinkKeyComplete(uint16_t connection_handle, KeyFlag key_flag) override {
+    LOG_DEBUG("OnMasterLinkKeyComplete connection_handle:%d", connection_handle);
+  }
+
+  void OnRoleChange(Address bd_addr, Role new_role) override {
+    LOG_DEBUG("OnRoleChange bd_addr:%s, new_role:%d", bd_addr.ToString().c_str(), (uint8_t)new_role);
+  }
+
+  void OnReadDefaultLinkPolicySettingsComplete(uint16_t default_link_policy_settings) override {
+    LOG_DEBUG("OnReadDefaultLinkPolicySettingsComplete default_link_policy_settings:%d", default_link_policy_settings);
+  }
+
+  void on_disconnect(std::string address, ErrorCode code) {
+    acl_connections_.erase(address);
+    DisconnectionEvent event;
+    event.mutable_remote()->set_address(address);
+    event.set_reason(static_cast<uint32_t>(code));
+    disconnection_stream_.OnIncomingEvent(event);
+  }
+
+  ::grpc::Status FetchConnectionComplete(::grpc::ServerContext* context, const EventStreamRequest* request,
+                                         ::grpc::ServerWriter<ConnectionEvent>* writer) override {
+    return connection_complete_stream_.HandleRequest(context, request, writer);
+  };
+
+  void OnConnectFail(Address address, ::bluetooth::hci::ErrorCode reason) override {
+    std::unique_lock<std::mutex> lock(mutex_);
+    ConnectionFailedEvent event;
+    event.mutable_remote()->set_address(address.ToString());
+    event.set_reason(static_cast<uint32_t>(reason));
+    connection_failed_stream_.OnIncomingEvent(event);
+  }
+
+  void OnConnectionPacketTypeChanged(uint16_t packet_type) override {
+    LOG_DEBUG("OnConnectionPacketTypeChanged packet_type:%d", packet_type);
+  }
+
+  void OnAuthenticationComplete() override {
+    LOG_DEBUG("OnAuthenticationComplete");
+  }
+
+  void OnEncryptionChange(EncryptionEnabled enabled) override {
+    LOG_DEBUG("OnConnectionPacketTypeChanged enabled:%d", (uint8_t)enabled);
+  }
+
+  void OnChangeConnectionLinkKeyComplete() override {
+    LOG_DEBUG("OnChangeConnectionLinkKeyComplete");
+  };
+
+  void OnReadClockOffsetComplete(uint16_t clock_offset) override {
+    LOG_DEBUG("OnReadClockOffsetComplete clock_offset:%d", clock_offset);
+  };
+
+  void OnModeChange(Mode current_mode, uint16_t interval) override {
+    LOG_DEBUG("OnModeChange Mode:%d, interval:%d", (uint8_t)current_mode, interval);
+  };
+
+  void OnQosSetupComplete(ServiceType service_type, uint32_t token_rate, uint32_t peak_bandwidth, uint32_t latency,
+                          uint32_t delay_variation) override {
+    LOG_DEBUG("OnQosSetupComplete service_type:%d, token_rate:%d, peak_bandwidth:%d, latency:%d, delay_variation:%d",
+              (uint8_t)service_type, token_rate, peak_bandwidth, latency, delay_variation);
+  }
+
+  void OnFlowSpecificationComplete(FlowDirection flow_direction, ServiceType service_type, uint32_t token_rate,
+                                   uint32_t token_bucket_size, uint32_t peak_bandwidth,
+                                   uint32_t access_latency) override {
+    LOG_DEBUG(
+        "OnFlowSpecificationComplete flow_direction:%d. service_type:%d, token_rate:%d, token_bucket_size:%d, "
+        "peak_bandwidth:%d, access_latency:%d",
+        (uint8_t)flow_direction, (uint8_t)service_type, token_rate, token_bucket_size, peak_bandwidth, access_latency);
+  }
+
+  void OnFlushOccurred() override {
+    LOG_DEBUG("OnFlushOccurred");
+  }
+
+  void OnRoleDiscoveryComplete(Role current_role) override {
+    LOG_DEBUG("OnRoleDiscoveryComplete current_role:%d", (uint8_t)current_role);
+  }
+
+  void OnReadLinkPolicySettingsComplete(uint16_t link_policy_settings) override {
+    LOG_DEBUG("OnReadLinkPolicySettingsComplete link_policy_settings:%d", link_policy_settings);
+  }
+
+  void OnReadAutomaticFlushTimeoutComplete(uint16_t flush_timeout) override {
+    LOG_DEBUG("OnReadAutomaticFlushTimeoutComplete flush_timeout:%d", flush_timeout);
+  }
+
+  void OnReadTransmitPowerLevelComplete(uint8_t transmit_power_level) override {
+    LOG_DEBUG("OnReadTransmitPowerLevelComplete transmit_power_level:%d", transmit_power_level);
+  }
+
+  void OnReadLinkSupervisionTimeoutComplete(uint16_t link_supervision_timeout) override {
+    LOG_DEBUG("OnReadLinkSupervisionTimeoutComplete link_supervision_timeout:%d", link_supervision_timeout);
+  }
+
+  void OnReadFailedContactCounterComplete(uint16_t failed_contact_counter) override {
+    LOG_DEBUG("OnReadFailedContactCounterComplete failed_contact_counter:%d", failed_contact_counter);
+  }
+
+  void OnReadLinkQualityComplete(uint8_t link_quality) override {
+    LOG_DEBUG("OnReadLinkQualityComplete link_quality:%d", link_quality);
+  }
+
+  void OnReadAfhChannelMapComplete(AfhMode afh_mode, std::array<uint8_t, 10> afh_channel_map) {
+    LOG_DEBUG("OnReadAfhChannelMapComplete afh_mode:%d", (uint8_t)afh_mode);
+  }
+
+  void OnReadRssiComplete(uint8_t rssi) override {
+    LOG_DEBUG("OnReadRssiComplete rssi:%d", rssi);
+  }
+
+  void OnReadClockComplete(uint32_t clock, uint16_t accuracy) override {
+    LOG_DEBUG("OnReadClockComplete clock:%d, accuracy:%d", clock, accuracy);
+  }
+
+  ::grpc::Status FetchConnectionFailed(::grpc::ServerContext* context, const EventStreamRequest* request,
+                                       ::grpc::ServerWriter<ConnectionFailedEvent>* writer) override {
+    return connection_failed_stream_.HandleRequest(context, request, writer);
+  };
+
+  ::grpc::Status FetchDisconnection(::grpc::ServerContext* context,
+                                    const ::bluetooth::facade::EventStreamRequest* request,
+                                    ::grpc::ServerWriter<DisconnectionEvent>* writer) override {
+    return disconnection_stream_.HandleRequest(context, request, writer);
+  }
+
+ private:
+  AclManager* acl_manager_;
+  Controller* controller_;
+  HciLayer* hci_layer_;
+  mutable std::mutex mutex_;
+  ::bluetooth::os::Handler* facade_handler_;
+
+  class ConnectionCompleteStreamCallback
+      : public ::bluetooth::grpc::GrpcEventStreamCallback<ConnectionEvent, std::shared_ptr<AclConnection>> {
+   public:
+    void OnWriteResponse(ConnectionEvent* response, const std::shared_ptr<AclConnection>& connection) override {
+      response->mutable_remote()->set_address(connection->GetAddress().ToString());
+      response->set_connection_handle(connection->GetHandle());
+    }
+  } connection_complete_stream_callback_;
+  ::bluetooth::grpc::GrpcEventStream<ConnectionEvent, std::shared_ptr<AclConnection>> connection_complete_stream_{
+      &connection_complete_stream_callback_};
+
+  class ConnectionFailedStreamCallback
+      : public ::bluetooth::grpc::GrpcEventStreamCallback<ConnectionFailedEvent, ConnectionFailedEvent> {
+   public:
+    void OnWriteResponse(ConnectionFailedEvent* response, const ConnectionFailedEvent& event) override {
+      response->CopyFrom(event);
+    }
+  } connection_failed_stream_callback_;
+  ::bluetooth::grpc::GrpcEventStream<ConnectionFailedEvent, ConnectionFailedEvent> connection_failed_stream_{
+      &connection_failed_stream_callback_};
+
+  class DisconnectionStreamCallback
+      : public ::bluetooth::grpc::GrpcEventStreamCallback<DisconnectionEvent, DisconnectionEvent> {
+   public:
+    void OnWriteResponse(DisconnectionEvent* response, const DisconnectionEvent& event) override {
+      response->CopyFrom(event);
+    }
+  } disconnection_stream_callback_;
+  ::bluetooth::grpc::GrpcEventStream<DisconnectionEvent, DisconnectionEvent> disconnection_stream_{
+      &disconnection_stream_callback_};
+
+  class AclStreamCallback : public ::bluetooth::grpc::GrpcEventStreamCallback<AclData, AclData> {
+   public:
+    AclStreamCallback(AclManagerFacadeService* service) : service_(service) {}
+
+    ~AclStreamCallback() {
+      if (subscribed_) {
+        for (const auto& connection : service_->acl_connections_) {
+          connection.second->GetAclQueueEnd()->UnregisterDequeue();
+        }
+        subscribed_ = false;
+      }
+    }
+
+    void OnSubscribe() override {
+      if (subscribed_) {
+        LOG_WARN("Already subscribed");
+        return;
+      }
+      for (const auto& connection : service_->acl_connections_) {
+        auto remote_address = connection.second->GetAddress().ToString();
+        connection.second->GetAclQueueEnd()->RegisterDequeue(
+            service_->facade_handler_,
+            common::Bind(&AclManagerFacadeService::on_incoming_acl, common::Unretained(service_), remote_address));
+      }
+      subscribed_ = true;
+    }
+
+    void OnUnsubscribe() override {
+      if (!subscribed_) {
+        LOG_WARN("Not subscribed");
+        return;
+      }
+      for (const auto& connection : service_->acl_connections_) {
+        connection.second->GetAclQueueEnd()->UnregisterDequeue();
+      }
+      subscribed_ = false;
+    }
+
+    void OnWriteResponse(AclData* response, const AclData& event) override {
+      response->CopyFrom(event);
+    }
+
+   private:
+    AclManagerFacadeService* service_;
+    bool subscribed_ = false;
+  } acl_stream_callback_{this};
+  ::bluetooth::grpc::GrpcEventStream<AclData, AclData> acl_stream_{&acl_stream_callback_};
+
+  std::map<std::string, std::shared_ptr<AclConnection>> acl_connections_;
+};
+
+void AclManagerFacadeModule::ListDependencies(ModuleList* list) {
+  ::bluetooth::grpc::GrpcFacadeModule::ListDependencies(list);
+  list->add<AclManager>();
+  list->add<Controller>();
+  list->add<HciLayer>();
+}
+
+void AclManagerFacadeModule::Start() {
+  ::bluetooth::grpc::GrpcFacadeModule::Start();
+  service_ = new AclManagerFacadeService(GetDependency<AclManager>(), GetDependency<Controller>(),
+                                         GetDependency<HciLayer>(), GetHandler());
+}
+
+void AclManagerFacadeModule::Stop() {
+  delete service_;
+  ::bluetooth::grpc::GrpcFacadeModule::Stop();
+}
+
+::grpc::Service* AclManagerFacadeModule::GetService() const {
+  return service_;
+}
+
+const ModuleFactory AclManagerFacadeModule::Factory =
+    ::bluetooth::ModuleFactory([]() { return new AclManagerFacadeModule(); });
+
+class ClassicSecurityManagerFacadeService : public ClassicSecurityManagerFacade::Service,
+                                            public ::bluetooth::hci::ClassicSecurityCommandCallbacks {
+ public:
+  ClassicSecurityManagerFacadeService(ClassicSecurityManager* classic_security_manager, Controller* controller,
+                                      HciLayer* hci_layer, ::bluetooth::os::Handler* facade_handler)
+      : classic_security_manager_(classic_security_manager), facade_handler_(facade_handler) {
+    classic_security_manager_->RegisterCallbacks(this, facade_handler_);
+  }
+
+  ::grpc::Status LinkKeyRequestReply(::grpc::ServerContext* context,
+                                     const ::bluetooth::hci::LinkKeyRequestReplyMessage* request,
+                                     ::google::protobuf::Empty* response) {
+    std::unique_lock<std::mutex> lock(mutex_);
+    Address peer;
+    common::LinkKey link_key;
+    ASSERT(Address::FromString(request->remote().address(), peer));
+    ASSERT(common::LinkKey::FromString(request->link_key(), link_key));
+    classic_security_manager_->LinkKeyRequestReply(peer, link_key);
+    return ::grpc::Status::OK;
+  };
+
+  ::grpc::Status LinkKeyRequestNegativeReply(::grpc::ServerContext* context,
+                                             const ::bluetooth::facade::BluetoothAddress* request,
+                                             ::google::protobuf::Empty* response) {
+    std::unique_lock<std::mutex> lock(mutex_);
+    Address peer;
+    ASSERT(Address::FromString(request->address(), peer));
+    classic_security_manager_->LinkKeyRequestNegativeReply(peer);
+    return ::grpc::Status::OK;
+  }
+
+  ::grpc::Status PinCodeRequestReply(::grpc::ServerContext* context,
+                                     const ::bluetooth::hci::PinCodeRequestReplyMessage* request,
+                                     ::google::protobuf::Empty* response) {
+    std::unique_lock<std::mutex> lock(mutex_);
+    Address peer;
+    ASSERT(Address::FromString(request->remote().address(), peer));
+    uint8_t len = request->len();
+    std::string pin_code = request->pin_code();
+    classic_security_manager_->PinCodeRequestReply(peer, len, pin_code);
+    return ::grpc::Status::OK;
+  };
+
+  ::grpc::Status PinCodeRequestNegativeReply(::grpc::ServerContext* context,
+                                             const ::bluetooth::facade::BluetoothAddress* request,
+                                             ::google::protobuf::Empty* response) {
+    std::unique_lock<std::mutex> lock(mutex_);
+    Address peer;
+    ASSERT(Address::FromString(request->address(), peer));
+    classic_security_manager_->PinCodeRequestNegativeReply(peer);
+    return ::grpc::Status::OK;
+  }
+
+  ::grpc::Status IoCapabilityRequestReply(::grpc::ServerContext* context,
+                                          const ::bluetooth::hci::IoCapabilityRequestReplyMessage* request,
+                                          ::google::protobuf::Empty* response) {
+    std::unique_lock<std::mutex> lock(mutex_);
+    Address peer;
+    ASSERT(Address::FromString(request->remote().address(), peer));
+    IoCapability io_capability = (IoCapability)request->io_capability();
+    OobDataPresent oob_present = (OobDataPresent)request->oob_present();
+    AuthenticationRequirements authentication_requirements =
+        (AuthenticationRequirements)request->authentication_requirements();
+    classic_security_manager_->IoCapabilityRequestReply(peer, io_capability, oob_present, authentication_requirements);
+    return ::grpc::Status::OK;
+  };
+
+  ::grpc::Status IoCapabilityRequestNegativeReply(
+      ::grpc::ServerContext* context, const ::bluetooth::hci::IoCapabilityRequestNegativeReplyMessage* request,
+      ::google::protobuf::Empty* response) {
+    std::unique_lock<std::mutex> lock(mutex_);
+    Address peer;
+    ASSERT(Address::FromString(request->remote().address(), peer));
+    ErrorCode reason = (ErrorCode)request->reason();
+    classic_security_manager_->IoCapabilityRequestNegativeReply(peer, reason);
+    return ::grpc::Status::OK;
+  };
+
+  ::grpc::Status UserConfirmationRequestReply(::grpc::ServerContext* context,
+                                              const ::bluetooth::facade::BluetoothAddress* request,
+                                              ::google::protobuf::Empty* response) {
+    std::unique_lock<std::mutex> lock(mutex_);
+    Address peer;
+    ASSERT(Address::FromString(request->address(), peer));
+    classic_security_manager_->UserConfirmationRequestReply(peer);
+    return ::grpc::Status::OK;
+  }
+
+  ::grpc::Status UserConfirmationRequestNegativeReply(::grpc::ServerContext* context,
+                                                      const ::bluetooth::facade::BluetoothAddress* request,
+                                                      ::google::protobuf::Empty* response) {
+    std::unique_lock<std::mutex> lock(mutex_);
+    Address peer;
+    ASSERT(Address::FromString(request->address(), peer));
+    classic_security_manager_->UserConfirmationRequestNegativeReply(peer);
+    return ::grpc::Status::OK;
+  }
+
+  ::grpc::Status UserPasskeyRequestReply(::grpc::ServerContext* context,
+                                         const ::bluetooth::hci::UserPasskeyRequestReplyMessage* request,
+                                         ::google::protobuf::Empty* response) {
+    std::unique_lock<std::mutex> lock(mutex_);
+    Address peer;
+    ASSERT(Address::FromString(request->remote().address(), peer));
+    uint32_t passkey = request->passkey();
+    classic_security_manager_->UserPasskeyRequestReply(peer, passkey);
+    return ::grpc::Status::OK;
+  };
+
+  ::grpc::Status UserPasskeyRequestNegativeReply(::grpc::ServerContext* context,
+                                                 const ::bluetooth::facade::BluetoothAddress* request,
+                                                 ::google::protobuf::Empty* response) {
+    std::unique_lock<std::mutex> lock(mutex_);
+    Address peer;
+    ASSERT(Address::FromString(request->address(), peer));
+    classic_security_manager_->UserPasskeyRequestNegativeReply(peer);
+    return ::grpc::Status::OK;
+  }
+
+  ::grpc::Status RemoteOobDataRequestReply(::grpc::ServerContext* context,
+                                           const ::bluetooth::hci::RemoteOobDataRequestReplyMessage* request,
+                                           ::google::protobuf::Empty* response) {
+    std::unique_lock<std::mutex> lock(mutex_);
+    Address peer;
+    ASSERT(Address::FromString(request->remote().address(), peer));
+    std::string c_string = request->c();
+    std::string r_string = request->r();
+    std::array<uint8_t, 16> c;
+    std::array<uint8_t, 16> r;
+    std::copy(std::begin(c_string), std::end(c_string), std::begin(c));
+    std::copy(std::begin(r_string), std::end(r_string), std::begin(r));
+    classic_security_manager_->RemoteOobDataRequestReply(peer, c, r);
+    return ::grpc::Status::OK;
+  };
+
+  ::grpc::Status RemoteOobDataRequestNegativeReply(::grpc::ServerContext* context,
+                                                   const ::bluetooth::facade::BluetoothAddress* request,
+                                                   ::google::protobuf::Empty* response) {
+    std::unique_lock<std::mutex> lock(mutex_);
+    Address peer;
+    ASSERT(Address::FromString(request->address(), peer));
+    classic_security_manager_->RemoteOobDataRequestNegativeReply(peer);
+    return ::grpc::Status::OK;
+  }
+
+  ::grpc::Status ReadStoredLinkKey(::grpc::ServerContext* context,
+                                   const ::bluetooth::hci::ReadStoredLinkKeyMessage* request,
+                                   ::google::protobuf::Empty* response) {
+    std::unique_lock<std::mutex> lock(mutex_);
+    Address peer;
+    ASSERT(Address::FromString(request->remote().address(), peer));
+    ReadStoredLinkKeyReadAllFlag read_all_flag = (ReadStoredLinkKeyReadAllFlag)request->read_all_flag();
+    classic_security_manager_->ReadStoredLinkKey(peer, read_all_flag);
+    return ::grpc::Status::OK;
+  };
+
+  ::grpc::Status WriteStoredLinkKey(::grpc::ServerContext* context,
+                                    const ::bluetooth::hci::WriteStoredLinkKeyMessage* request,
+                                    ::google::protobuf::Empty* response) {
+    std::unique_lock<std::mutex> lock(mutex_);
+    uint8_t num_keys_to_write = request->num_keys_to_write();
+    std::vector<KeyAndAddress> keys;
+    for (size_t i = 0; i < num_keys_to_write; i++) {
+      KeyAndAddress key;
+      common::LinkKey link_key;
+      ASSERT(Address::FromString(request->remote().address(), key.address_));
+      ASSERT(common::LinkKey::FromString(request->link_keys(), link_key));
+      std::copy(std::begin(link_key.link_key), std::end(link_key.link_key), std::begin(key.link_key_));
+      keys.push_back(key);
+    }
+
+    classic_security_manager_->WriteStoredLinkKey(keys);
+    return ::grpc::Status::OK;
+  };
+
+  ::grpc::Status DeleteStoredLinkKey(::grpc::ServerContext* context,
+                                     const ::bluetooth::hci::DeleteStoredLinkKeyMessage* request,
+                                     ::google::protobuf::Empty* response) {
+    std::unique_lock<std::mutex> lock(mutex_);
+    Address peer;
+    ASSERT(Address::FromString(request->remote().address(), peer));
+    DeleteStoredLinkKeyDeleteAllFlag delete_all_flag = (DeleteStoredLinkKeyDeleteAllFlag)request->delete_all_flag();
+    classic_security_manager_->DeleteStoredLinkKey(peer, delete_all_flag);
+    return ::grpc::Status::OK;
+  };
+
+  ::grpc::Status RefreshEncryptionKey(::grpc::ServerContext* context,
+                                      const ::bluetooth::hci::RefreshEncryptionKeyMessage* request,
+                                      ::google::protobuf::Empty* response) {
+    std::unique_lock<std::mutex> lock(mutex_);
+    classic_security_manager_->RefreshEncryptionKey(request->connection_handle());
+    return ::grpc::Status::OK;
+  };
+
+  ::grpc::Status ReadSimplePairingMode(::grpc::ServerContext* context, const ::google::protobuf::Empty* request,
+                                       ::google::protobuf::Empty* response) {
+    std::unique_lock<std::mutex> lock(mutex_);
+    classic_security_manager_->ReadSimplePairingMode();
+    return ::grpc::Status::OK;
+  };
+
+  ::grpc::Status WriteSimplePairingMode(::grpc::ServerContext* context,
+                                        const ::bluetooth::hci::WriteSimplePairingModeMessage* request,
+                                        ::google::protobuf::Empty* response) {
+    std::unique_lock<std::mutex> lock(mutex_);
+    Enable simple_pairing_mode = (Enable)request->simple_pairing_mode();
+    classic_security_manager_->WriteSimplePairingMode(simple_pairing_mode);
+    return ::grpc::Status::OK;
+  };
+
+  ::grpc::Status ReadLocalOobData(::grpc::ServerContext* context, const ::google::protobuf::Empty* request,
+                                  ::google::protobuf::Empty* response) {
+    std::unique_lock<std::mutex> lock(mutex_);
+    classic_security_manager_->ReadLocalOobData();
+    return ::grpc::Status::OK;
+  };
+
+  ::grpc::Status SendKeypressNotification(::grpc::ServerContext* context,
+                                          const ::bluetooth::hci::SendKeypressNotificationMessage* request,
+                                          ::google::protobuf::Empty* response) {
+    std::unique_lock<std::mutex> lock(mutex_);
+    Address peer;
+    ASSERT(Address::FromString(request->remote().address(), peer));
+    KeypressNotificationType notification_type = (KeypressNotificationType)request->notification_type();
+    classic_security_manager_->SendKeypressNotification(peer, notification_type);
+    return ::grpc::Status::OK;
+  };
+
+  ::grpc::Status ReadLocalOobExtendedData(::grpc::ServerContext* context, const ::google::protobuf::Empty* request,
+                                          ::google::protobuf::Empty* response) {
+    std::unique_lock<std::mutex> lock(mutex_);
+    classic_security_manager_->ReadLocalOobExtendedData();
+    return ::grpc::Status::OK;
+  };
+
+  ::grpc::Status ReadEncryptionKeySize(::grpc::ServerContext* context,
+                                       const ::bluetooth::hci::ReadEncryptionKeySizeMessage* request,
+                                       ::google::protobuf::Empty* response) {
+    std::unique_lock<std::mutex> lock(mutex_);
+    classic_security_manager_->ReadEncryptionKeySize(request->connection_handle());
+    return ::grpc::Status::OK;
+  };
+
+  ::grpc::Status FetchCommandCompleteEvent(::grpc::ServerContext* context, const EventStreamRequest* request,
+                                           ::grpc::ServerWriter<CommandCompleteEvent>* writer) override {
+    return command_complete_stream_.HandleRequest(context, request, writer);
+  };
+
+  void OnCommandComplete(CommandCompleteView status) override {
+    std::unique_lock<std::mutex> lock(mutex_);
+    command_complete_stream_.OnIncomingEvent(status);
+  }
+
+ private:
+  ClassicSecurityManager* classic_security_manager_;
+  mutable std::mutex mutex_;
+  ::bluetooth::os::Handler* facade_handler_;
+
+  class CommandCompleteStreamCallback
+      : public ::bluetooth::grpc::GrpcEventStreamCallback<CommandCompleteEvent, CommandCompleteView> {
+   public:
+    void OnWriteResponse(CommandCompleteEvent* response, CommandCompleteView const& status) override {
+      response->set_command_opcode((uint32_t)status.GetCommandOpCode());
+    }
+  } command_complete_stream_callback_;
+  ::bluetooth::grpc::GrpcEventStream<CommandCompleteEvent, CommandCompleteView> command_complete_stream_{
+      &command_complete_stream_callback_};
+};
+
+void ClassicSecurityManagerFacadeModule::ListDependencies(ModuleList* list) {
+  ::bluetooth::grpc::GrpcFacadeModule::ListDependencies(list);
+  list->add<ClassicSecurityManager>();
+  list->add<Controller>();
+  list->add<HciLayer>();
+}
+
+void ClassicSecurityManagerFacadeModule::Start() {
+  ::bluetooth::grpc::GrpcFacadeModule::Start();
+  service_ = new ClassicSecurityManagerFacadeService(
+      GetDependency<ClassicSecurityManager>(), GetDependency<Controller>(), GetDependency<HciLayer>(), GetHandler());
+}
+
+void ClassicSecurityManagerFacadeModule::Stop() {
+  delete service_;
+  ::bluetooth::grpc::GrpcFacadeModule::Stop();
+}
+
+::grpc::Service* ClassicSecurityManagerFacadeModule::GetService() const {
+  return service_;
+}
+
+const ModuleFactory ClassicSecurityManagerFacadeModule::Factory =
+    ::bluetooth::ModuleFactory([]() { return new ClassicSecurityManagerFacadeModule(); });
+
+}  // namespace hci
+}  // namespace bluetooth
diff --git a/gd/hci/facade.h b/gd/hci/facade.h
new file mode 100644
index 0000000..b38286d
--- /dev/null
+++ b/gd/hci/facade.h
@@ -0,0 +1,58 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#pragma once
+
+#include <grpc++/grpc++.h>
+
+#include "grpc/grpc_module.h"
+#include "hci/acl_manager.h"
+
+namespace bluetooth {
+namespace hci {
+
+class AclManagerFacadeService;
+
+class AclManagerFacadeModule : public ::bluetooth::grpc::GrpcFacadeModule {
+ public:
+  static const ModuleFactory Factory;
+
+  void ListDependencies(ModuleList* list) override;
+  void Start() override;
+  void Stop() override;
+  ::grpc::Service* GetService() const override;
+
+ private:
+  AclManagerFacadeService* service_;
+};
+
+class ClassicSecurityManagerFacadeService;
+
+class ClassicSecurityManagerFacadeModule : public ::bluetooth::grpc::GrpcFacadeModule {
+ public:
+  static const ModuleFactory Factory;
+
+  void ListDependencies(ModuleList* list) override;
+  void Start() override;
+  void Stop() override;
+  ::grpc::Service* GetService() const override;
+
+ private:
+  ClassicSecurityManagerFacadeService* service_;
+};
+
+}  // namespace hci
+}  // namespace bluetooth
diff --git a/gd/hci/facade.proto b/gd/hci/facade.proto
new file mode 100644
index 0000000..b9899e6
--- /dev/null
+++ b/gd/hci/facade.proto
@@ -0,0 +1,158 @@
+syntax = "proto3";
+
+package bluetooth.hci;
+
+import "google/protobuf/empty.proto";
+import "facade/common.proto";
+
+service AclManagerFacade {
+  rpc SetPageScanMode(PageScanMode) returns (google.protobuf.Empty) {}
+  rpc Connect(facade.BluetoothAddress) returns (google.protobuf.Empty) {}
+  rpc Disconnect(facade.BluetoothAddress) returns (google.protobuf.Empty) {}
+  rpc AuthenticationRequested(facade.BluetoothAddress) returns (google.protobuf.Empty) {}
+  rpc FetchConnectionComplete(facade.EventStreamRequest) returns (stream ConnectionEvent) {}
+  rpc FetchDisconnection(facade.EventStreamRequest) returns (stream DisconnectionEvent) {}
+  rpc FetchConnectionFailed(facade.EventStreamRequest) returns (stream ConnectionFailedEvent) {}
+  rpc SendAclData(AclData) returns (google.protobuf.Empty) {}
+  rpc FetchAclData(facade.EventStreamRequest) returns (stream AclData) {}
+  rpc TestInternalHciCommands(google.protobuf.Empty) returns (google.protobuf.Empty) {}
+  rpc TestInternalHciLeCommands(google.protobuf.Empty) returns (google.protobuf.Empty) {}
+  rpc TestClassicConnectionManagementCommands(facade.BluetoothAddress) returns (google.protobuf.Empty) {}
+}
+
+message PageScanMode {
+  bool enabled = 1;
+}
+
+message ConnectionEvent {
+  facade.BluetoothAddress remote = 1;
+  uint32 connection_handle = 2;
+}
+
+message DisconnectionEvent {
+  facade.BluetoothAddress remote = 1;
+  uint32 reason = 2;
+}
+
+message ConnectionFailedEvent {
+  facade.BluetoothAddress remote = 1;
+  uint32 reason = 2;
+}
+
+message AclData {
+  facade.BluetoothAddress remote = 1;
+  bytes payload = 2;
+}
+
+service ClassicPairingFacade {
+  rpc SetPairingMode(PairingMode) returns (google.protobuf.Empty) {}
+  rpc DeletePairing(DeletePairingRequest) returns (google.protobuf.Empty) {}
+}
+
+message PairingMode {
+  bool enabled = 1;
+}
+
+message DeletePairingRequest {
+  bool deleteAll = 1;
+  facade.BluetoothAddress remote = 2;
+}
+
+service ClassicSecurityManagerFacade {
+  rpc LinkKeyRequestReply(LinkKeyRequestReplyMessage) returns (google.protobuf.Empty) {}
+  rpc LinkKeyRequestNegativeReply(facade.BluetoothAddress) returns (google.protobuf.Empty) {}
+  rpc PinCodeRequestReply(PinCodeRequestReplyMessage) returns (google.protobuf.Empty) {}
+  rpc PinCodeRequestNegativeReply(facade.BluetoothAddress) returns (google.protobuf.Empty) {}
+  rpc IoCapabilityRequestReply(IoCapabilityRequestReplyMessage) returns (google.protobuf.Empty) {}
+  rpc IoCapabilityRequestNegativeReply(IoCapabilityRequestNegativeReplyMessage) returns (google.protobuf.Empty) {}
+  rpc UserConfirmationRequestReply(facade.BluetoothAddress) returns (google.protobuf.Empty) {}
+  rpc UserConfirmationRequestNegativeReply(facade.BluetoothAddress) returns (google.protobuf.Empty) {}
+  rpc UserPasskeyRequestReply(UserPasskeyRequestReplyMessage) returns (google.protobuf.Empty) {}
+  rpc UserPasskeyRequestNegativeReply(facade.BluetoothAddress) returns (google.protobuf.Empty) {}
+  rpc RemoteOobDataRequestReply(RemoteOobDataRequestReplyMessage) returns (google.protobuf.Empty) {}
+  rpc RemoteOobDataRequestNegativeReply(facade.BluetoothAddress) returns (google.protobuf.Empty) {}
+  rpc ReadStoredLinkKey(ReadStoredLinkKeyMessage) returns (google.protobuf.Empty) {}
+  rpc WriteStoredLinkKey(WriteStoredLinkKeyMessage) returns (google.protobuf.Empty) {}
+  rpc DeleteStoredLinkKey(DeleteStoredLinkKeyMessage) returns (google.protobuf.Empty) {}
+  rpc RefreshEncryptionKey(RefreshEncryptionKeyMessage) returns (google.protobuf.Empty) {}
+  rpc ReadSimplePairingMode(google.protobuf.Empty) returns (google.protobuf.Empty) {}
+  rpc WriteSimplePairingMode(WriteSimplePairingModeMessage) returns (google.protobuf.Empty) {}
+  rpc ReadLocalOobData(google.protobuf.Empty) returns (google.protobuf.Empty) {}
+  rpc SendKeypressNotification(SendKeypressNotificationMessage) returns (google.protobuf.Empty) {}
+  rpc ReadLocalOobExtendedData(google.protobuf.Empty) returns (google.protobuf.Empty) {}
+  rpc ReadEncryptionKeySize(ReadEncryptionKeySizeMessage) returns (google.protobuf.Empty) {}
+
+  rpc FetchCommandCompleteEvent(facade.EventStreamRequest) returns (stream CommandCompleteEvent) {}
+}
+
+
+message CommandCompleteEvent {
+  uint32 command_opcode = 1;
+}
+
+message LinkKeyRequestReplyMessage {
+  facade.BluetoothAddress remote = 1;
+  bytes link_key = 2;
+}
+
+message PinCodeRequestReplyMessage {
+  facade.BluetoothAddress remote = 1;
+  uint32 len = 2;
+  bytes pin_code = 3;
+}
+
+message IoCapabilityRequestReplyMessage {
+  facade.BluetoothAddress remote = 1;
+  uint32 io_capability = 2;
+  uint32 oob_present = 3;
+  uint32 authentication_requirements = 4;
+}
+
+message IoCapabilityRequestNegativeReplyMessage {
+  facade.BluetoothAddress remote = 1;
+  uint32 reason = 2;
+}
+
+message UserPasskeyRequestReplyMessage {
+  facade.BluetoothAddress remote = 1;
+  uint32 passkey = 2;
+}
+
+message RemoteOobDataRequestReplyMessage {
+  facade.BluetoothAddress remote = 1;
+  bytes c = 2;
+  bytes r = 3;
+}
+
+message ReadStoredLinkKeyMessage {
+  facade.BluetoothAddress remote = 1;
+  uint32 read_all_flag = 2;
+}
+
+message WriteStoredLinkKeyMessage {
+  uint32 num_keys_to_write = 1;
+  facade.BluetoothAddress remote = 2;
+  bytes link_keys = 3;
+}
+
+message DeleteStoredLinkKeyMessage {
+  facade.BluetoothAddress remote = 1;
+  uint32 delete_all_flag = 2;
+}
+
+message RefreshEncryptionKeyMessage {
+  uint32 connection_handle = 1;
+}
+
+message WriteSimplePairingModeMessage {
+  uint32 simple_pairing_mode = 1;
+}
+
+message SendKeypressNotificationMessage {
+  facade.BluetoothAddress remote = 1;
+  uint32 notification_type = 2;
+}
+
+message ReadEncryptionKeySizeMessage {
+  uint32 connection_handle = 1;
+}
\ No newline at end of file
diff --git a/gd/hci/hci_layer.cc b/gd/hci/hci_layer.cc
index 46a35eb..e9fa360 100644
--- a/gd/hci/hci_layer.cc
+++ b/gd/hci/hci_layer.cc
@@ -16,35 +16,60 @@
 
 #include "hci/hci_layer.h"
 
+#include "common/bind.h"
+#include "common/callback.h"
+#include "os/alarm.h"
+#include "os/queue.h"
 #include "packet/packet_builder.h"
 
 namespace {
+using bluetooth::common::Bind;
+using bluetooth::common::BindOnce;
+using bluetooth::common::Callback;
+using bluetooth::common::Closure;
+using bluetooth::common::OnceCallback;
+using bluetooth::common::OnceClosure;
 using bluetooth::hci::CommandCompleteView;
 using bluetooth::hci::CommandPacketBuilder;
 using bluetooth::hci::CommandStatusView;
 using bluetooth::hci::EventPacketView;
+using bluetooth::hci::LeMetaEventView;
 using bluetooth::os::Handler;
 
 class EventHandler {
  public:
   EventHandler() : event_handler(), handler(nullptr) {}
-  EventHandler(std::function<void(EventPacketView)> on_event, Handler* on_event_handler)
-      : event_handler(on_event), handler(on_event_handler) {}
-  std::function<void(EventPacketView)> event_handler;
+  EventHandler(Callback<void(EventPacketView)> on_event, Handler* on_event_handler)
+      : event_handler(std::move(on_event)), handler(on_event_handler) {}
+  Callback<void(EventPacketView)> event_handler;
+  Handler* handler;
+};
+
+class SubeventHandler {
+ public:
+  SubeventHandler() : subevent_handler(), handler(nullptr) {}
+  SubeventHandler(Callback<void(LeMetaEventView)> on_event, Handler* on_event_handler)
+      : subevent_handler(std::move(on_event)), handler(on_event_handler) {}
+  Callback<void(LeMetaEventView)> subevent_handler;
   Handler* handler;
 };
 
 class CommandQueueEntry {
  public:
   CommandQueueEntry(std::unique_ptr<CommandPacketBuilder> command_packet,
-                    std::function<void(CommandStatusView)> on_status_function,
-                    std::function<void(CommandCompleteView)> on_complete_function, Handler* handler)
-      : command(std::move(command_packet)), on_status(on_status_function), on_complete(on_complete_function),
+                    OnceCallback<void(CommandCompleteView)> on_complete_function, Handler* handler)
+      : command(std::move(command_packet)), waiting_for_status_(false), on_complete(std::move(on_complete_function)),
+        caller_handler(handler) {}
+
+  CommandQueueEntry(std::unique_ptr<CommandPacketBuilder> command_packet,
+                    OnceCallback<void(CommandStatusView)> on_status_function, Handler* handler)
+      : command(std::move(command_packet)), waiting_for_status_(true), on_status(std::move(on_status_function)),
         caller_handler(handler) {}
 
   std::unique_ptr<CommandPacketBuilder> command;
-  std::function<void(CommandStatusView)> on_status;
-  std::function<void(CommandCompleteView)> on_complete;
+  bool waiting_for_status_;
+  OnceCallback<void(CommandStatusView)> on_status;
+  OnceCallback<void(CommandCompleteView)> on_complete;
   Handler* caller_handler;
 };
 }  // namespace
@@ -52,102 +77,235 @@
 namespace bluetooth {
 namespace hci {
 
-using common::Address;
 using common::BidiQueue;
 using common::BidiQueueEnd;
+using os::Alarm;
 using os::Handler;
 
-struct HciLayer::impl : public hal::HciHalCallbacks {
-  impl(HciLayer& module) : hal_(nullptr), module_(module) {
-    RegisterEventHandler(EventCode::COMMAND_COMPLETE, [this](EventPacketView event) { CommandCompleteCallback(event); },
-                         module_.GetHandler());
-    RegisterEventHandler(EventCode::COMMAND_STATUS, [this](EventPacketView event) { CommandStatusCallback(event); },
-                         module_.GetHandler());
+namespace {
+using hci::OpCode;
+using hci::ResetCompleteView;
+
+void fail_if_reset_complete_not_success(CommandCompleteView complete) {
+  auto reset_complete = ResetCompleteView::Create(complete);
+  ASSERT(reset_complete.IsValid());
+  ASSERT(reset_complete.GetStatus() == ErrorCode::SUCCESS);
+}
+
+void on_hci_timeout(OpCode op_code) {
+  ASSERT_LOG(false, "Timed out waiting for 0x%02hx (%s)", op_code, OpCodeText(op_code).c_str());
+}
+}  // namespace
+
+class SecurityInterfaceImpl : public SecurityInterface {
+ public:
+  SecurityInterfaceImpl(HciLayer& hci) : hci_(hci) {}
+  virtual ~SecurityInterfaceImpl() = default;
+
+  virtual void EnqueueCommand(std::unique_ptr<SecurityCommandBuilder> command,
+                              common::OnceCallback<void(CommandCompleteView)> on_complete,
+                              os::Handler* handler) override {
+    hci_.EnqueueCommand(std::move(command), std::move(on_complete), handler);
   }
 
+  virtual void EnqueueCommand(std::unique_ptr<SecurityCommandBuilder> command,
+                              common::OnceCallback<void(CommandStatusView)> on_status, os::Handler* handler) override {
+    hci_.EnqueueCommand(std::move(command), std::move(on_status), handler);
+  }
+  HciLayer& hci_;
+};
+
+class LeSecurityInterfaceImpl : public LeSecurityInterface {
+ public:
+  LeSecurityInterfaceImpl(HciLayer& hci) : hci_(hci) {}
+  virtual ~LeSecurityInterfaceImpl() = default;
+
+  virtual void EnqueueCommand(std::unique_ptr<LeSecurityCommandBuilder> command,
+                              common::OnceCallback<void(CommandCompleteView)> on_complete,
+                              os::Handler* handler) override {
+    hci_.EnqueueCommand(std::move(command), std::move(on_complete), handler);
+  }
+
+  virtual void EnqueueCommand(std::unique_ptr<LeSecurityCommandBuilder> command,
+                              common::OnceCallback<void(CommandStatusView)> on_status, os::Handler* handler) override {
+    hci_.EnqueueCommand(std::move(command), std::move(on_status), handler);
+  }
+  HciLayer& hci_;
+};
+
+class LeAdvertisingInterfaceImpl : public LeAdvertisingInterface {
+ public:
+  LeAdvertisingInterfaceImpl(HciLayer& hci) : hci_(hci) {}
+  virtual ~LeAdvertisingInterfaceImpl() = default;
+
+  virtual void EnqueueCommand(std::unique_ptr<LeAdvertisingCommandBuilder> command,
+                              common::OnceCallback<void(CommandCompleteView)> on_complete,
+                              os::Handler* handler) override {
+    hci_.EnqueueCommand(std::move(command), std::move(on_complete), handler);
+  }
+
+  virtual void EnqueueCommand(std::unique_ptr<LeAdvertisingCommandBuilder> command,
+                              common::OnceCallback<void(CommandStatusView)> on_status, os::Handler* handler) override {
+    hci_.EnqueueCommand(std::move(command), std::move(on_status), handler);
+  }
+  HciLayer& hci_;
+};
+
+class LeScanningInterfaceImpl : public LeScanningInterface {
+ public:
+  LeScanningInterfaceImpl(HciLayer& hci) : hci_(hci) {}
+  virtual ~LeScanningInterfaceImpl() = default;
+
+  virtual void EnqueueCommand(std::unique_ptr<LeScanningCommandBuilder> command,
+                              common::OnceCallback<void(CommandCompleteView)> on_complete,
+                              os::Handler* handler) override {
+    hci_.EnqueueCommand(std::move(command), std::move(on_complete), handler);
+  }
+
+  virtual void EnqueueCommand(std::unique_ptr<LeScanningCommandBuilder> command,
+                              common::OnceCallback<void(CommandStatusView)> on_status, os::Handler* handler) override {
+    hci_.EnqueueCommand(std::move(command), std::move(on_status), handler);
+  }
+  HciLayer& hci_;
+};
+
+struct HciLayer::impl : public hal::HciHalCallbacks {
+  impl(HciLayer& module) : hal_(nullptr), module_(module) {}
+
+  ~impl() {}
+
   void Start(hal::HciHal* hal) {
     hal_ = hal;
-    hal_->registerIncomingPacketCallback(this);
+    hci_timeout_alarm_ = new Alarm(module_.GetHandler());
 
-    send_acl_ = [this](std::unique_ptr<hci::BasePacketBuilder> packet) {
-      std::vector<uint8_t> bytes;
-      BitInserter bi(bytes);
-      packet->Serialize(bi);
-      hal_->sendAclData(bytes);
-    };
-    send_sco_ = [this](std::unique_ptr<hci::BasePacketBuilder> packet) {
-      std::vector<uint8_t> bytes;
-      BitInserter bi(bytes);
-      packet->Serialize(bi);
-      hal_->sendScoData(bytes);
-    };
     auto queue_end = acl_queue_.GetDownEnd();
     Handler* handler = module_.GetHandler();
-    queue_end->RegisterDequeue(handler, [queue_end, this]() { send_acl_(queue_end->TryDequeue()); });
+    queue_end->RegisterDequeue(handler, Bind(&impl::dequeue_and_send_acl, common::Unretained(this)));
+    RegisterEventHandler(EventCode::COMMAND_COMPLETE, Bind(&impl::command_complete_callback, common::Unretained(this)),
+                         handler);
+    RegisterEventHandler(EventCode::COMMAND_STATUS, Bind(&impl::command_status_callback, common::Unretained(this)),
+                         handler);
+    RegisterEventHandler(EventCode::LE_META_EVENT, Bind(&impl::le_meta_event_callback, common::Unretained(this)),
+                         handler);
+    // TODO find the right place
+    RegisterEventHandler(EventCode::PAGE_SCAN_REPETITION_MODE_CHANGE, Bind(&impl::drop, common::Unretained(this)),
+                         handler);
+    RegisterEventHandler(EventCode::MAX_SLOTS_CHANGE, Bind(&impl::drop, common::Unretained(this)), handler);
+    RegisterEventHandler(EventCode::VENDOR_SPECIFIC, Bind(&impl::drop, common::Unretained(this)), handler);
+
+    EnqueueCommand(ResetBuilder::Create(), BindOnce(&fail_if_reset_complete_not_success), handler);
+    hal_->registerIncomingPacketCallback(this);
+  }
+
+  void drop(EventPacketView) {}
+
+  void dequeue_and_send_acl() {
+    auto packet = acl_queue_.GetDownEnd()->TryDequeue();
+    send_acl(std::move(packet));
   }
 
   void Stop() {
+    hal_->unregisterIncomingPacketCallback();
     acl_queue_.GetDownEnd()->UnregisterDequeue();
+    incoming_acl_packet_buffer_.Clear();
+    delete hci_timeout_alarm_;
+    command_queue_.clear();
     hal_ = nullptr;
   }
 
-  void CommandStatusCallback(EventPacketView event) {
-    CommandStatusView status_view = CommandStatusView::Create(event);
-    ASSERT(status_view.IsValid());
-    if (command_queue_.size() == 0) {
-      ASSERT_LOG(status_view.GetCommandOpCode() == OpCode::NONE, "Unexpected status event with OpCode 0x%02hx",
-                 status_view.GetCommandOpCode());
-      return;
-    }
-    // TODO: Check whether this is the CommandOpCode we're looking for.
-    auto caller_handler = command_queue_.front().caller_handler;
-    auto on_status = command_queue_.front().on_status;
-    caller_handler->Post([on_status, status_view]() { on_status(status_view); });
-    command_queue_.pop();
+  void send_acl(std::unique_ptr<hci::BasePacketBuilder> packet) {
+    std::vector<uint8_t> bytes;
+    BitInserter bi(bytes);
+    packet->Serialize(bi);
+    hal_->sendAclData(bytes);
   }
 
-  void CommandCompleteCallback(EventPacketView event) {
-    CommandCompleteView complete_view = CommandCompleteView::Create(event);
-    ASSERT(complete_view.IsValid());
-    if (command_queue_.size() == 0) {
-      ASSERT_LOG(complete_view.GetCommandOpCode() == OpCode::NONE,
-                 "Unexpected command complete event with OpCode 0x%02hx", complete_view.GetCommandOpCode());
+  void send_sco(std::unique_ptr<hci::BasePacketBuilder> packet) {
+    std::vector<uint8_t> bytes;
+    BitInserter bi(bytes);
+    packet->Serialize(bi);
+    hal_->sendScoData(bytes);
+  }
+
+  void command_status_callback(EventPacketView event) {
+    CommandStatusView status_view = CommandStatusView::Create(event);
+    ASSERT(status_view.IsValid());
+    command_credits_ = status_view.GetNumHciCommandPackets();
+    OpCode op_code = status_view.GetCommandOpCode();
+    if (op_code == OpCode::NONE) {
+      send_next_command();
       return;
     }
-    // TODO: Check whether this is the CommandOpCode we're looking for.
+    ASSERT_LOG(!command_queue_.empty(), "Unexpected status event with OpCode 0x%02hx (%s)", op_code,
+               OpCodeText(op_code).c_str());
+    ASSERT_LOG(waiting_command_ == op_code, "Waiting for 0x%02hx (%s), got 0x%02hx (%s)", waiting_command_,
+               OpCodeText(waiting_command_).c_str(), op_code, OpCodeText(op_code).c_str());
+    ASSERT_LOG(command_queue_.front().waiting_for_status_,
+               "Waiting for command complete 0x%02hx (%s), got command status for 0x%02hx (%s)", waiting_command_,
+               OpCodeText(waiting_command_).c_str(), op_code, OpCodeText(op_code).c_str());
     auto caller_handler = command_queue_.front().caller_handler;
-    auto on_complete = command_queue_.front().on_complete;
-    caller_handler->Post([on_complete, complete_view]() { on_complete(complete_view); });
-    command_queue_.pop();
+    caller_handler->Post(BindOnce(std::move(command_queue_.front().on_status), std::move(status_view)));
+    command_queue_.pop_front();
+    waiting_command_ = OpCode::NONE;
+    hci_timeout_alarm_->Cancel();
+    send_next_command();
+  }
+
+  void command_complete_callback(EventPacketView event) {
+    CommandCompleteView complete_view = CommandCompleteView::Create(event);
+    ASSERT(complete_view.IsValid());
+    command_credits_ = complete_view.GetNumHciCommandPackets();
+    OpCode op_code = complete_view.GetCommandOpCode();
+    if (op_code == OpCode::NONE) {
+      send_next_command();
+      return;
+    }
+    ASSERT_LOG(command_queue_.size() > 0, "Unexpected command complete with OpCode 0x%02hx (%s)", op_code,
+               OpCodeText(op_code).c_str());
+    ASSERT_LOG(waiting_command_ == op_code, "Waiting for 0x%02hx (%s), got 0x%02hx (%s)", waiting_command_,
+               OpCodeText(waiting_command_).c_str(), op_code, OpCodeText(op_code).c_str());
+    ASSERT_LOG(!command_queue_.front().waiting_for_status_,
+               "Waiting for command status 0x%02hx (%s), got command complete for 0x%02hx (%s)", waiting_command_,
+               OpCodeText(waiting_command_).c_str(), op_code, OpCodeText(op_code).c_str());
+    auto caller_handler = command_queue_.front().caller_handler;
+    caller_handler->Post(BindOnce(std::move(command_queue_.front().on_complete), complete_view));
+    command_queue_.pop_front();
+    waiting_command_ = OpCode::NONE;
+    hci_timeout_alarm_->Cancel();
+    send_next_command();
+  }
+
+  void le_meta_event_callback(EventPacketView event) {
+    LeMetaEventView meta_event_view = LeMetaEventView::Create(event);
+    ASSERT(meta_event_view.IsValid());
+    SubeventCode subevent_code = meta_event_view.GetSubeventCode();
+    ASSERT_LOG(subevent_handlers_.find(subevent_code) != subevent_handlers_.end(),
+               "Unhandled le event of type 0x%02hhx (%s)", subevent_code, SubeventCodeText(subevent_code).c_str());
+    auto& registered_handler = subevent_handlers_[subevent_code].subevent_handler;
+    subevent_handlers_[subevent_code].handler->Post(BindOnce(registered_handler, meta_event_view));
   }
 
   void hciEventReceived(hal::HciPacket event_bytes) override {
     auto packet = packet::PacketView<packet::kLittleEndian>(std::make_shared<std::vector<uint8_t>>(event_bytes));
     EventPacketView event = EventPacketView::Create(packet);
     ASSERT(event.IsValid());
-    EventCode event_code = event.GetEventCode();
+    module_.GetHandler()->Post(
+        BindOnce(&HciLayer::impl::hci_event_received_handler, common::Unretained(this), std::move(event)));
+  }
 
-    Handler* hci_handler = module_.GetHandler();
-    hci_handler->Post([this, event, event_code]() {
-      ASSERT_LOG(event_handlers_.find(event_code) != event_handlers_.end(), "Unhandled event of type 0x%02hhx",
-                 event.GetEventCode());
-      auto& registered_handler = event_handlers_[event_code].event_handler;
-      event_handlers_[event_code].handler->Post([event, registered_handler]() { registered_handler(event); });
-    });
-    // TODO: Credits
+  void hci_event_received_handler(EventPacketView event) {
+    EventCode event_code = event.GetEventCode();
+    ASSERT_LOG(event_handlers_.find(event_code) != event_handlers_.end(), "Unhandled event of type 0x%02hhx (%s)",
+               event_code, EventCodeText(event_code).c_str());
+    auto& registered_handler = event_handlers_[event_code].event_handler;
+    event_handlers_[event_code].handler->Post(BindOnce(registered_handler, std::move(event)));
   }
 
   void aclDataReceived(hal::HciPacket data_bytes) override {
-    module_.GetHandler()->Post([this, data_bytes]() {
-      auto queue_end = acl_queue_.GetDownEnd();
-      Handler* hci_handler = module_.GetHandler();
-      queue_end->RegisterEnqueue(hci_handler, [queue_end, data_bytes]() {
-        auto packet = packet::PacketView<packet::kLittleEndian>(std::make_shared<std::vector<uint8_t>>(data_bytes));
-        AclPacketView acl2 = AclPacketView::Create(packet);
-        queue_end->UnregisterEnqueue();
-        return std::make_unique<AclPacketView>(acl2);
-      });
-    });
+    auto packet =
+        packet::PacketView<packet::kLittleEndian>(std::make_shared<std::vector<uint8_t>>(std::move(data_bytes)));
+    AclPacketView acl = AclPacketView::Create(packet);
+    incoming_acl_packet_buffer_.Enqueue(std::make_unique<AclPacketView>(acl), module_.GetHandler());
   }
 
   void scoDataReceived(hal::HciPacket data_bytes) override {
@@ -155,52 +313,129 @@
     ScoPacketView sco = ScoPacketView::Create(packet);
   }
 
-  void EnqueueCommand(std::unique_ptr<CommandPacketBuilder> command, std::function<void(CommandStatusView)> on_status,
-                      std::function<void(CommandCompleteView)> on_complete, Handler* handler) {
-    command_queue_.emplace(std::move(command), on_status, on_complete, handler);
+  void EnqueueCommand(std::unique_ptr<CommandPacketBuilder> command,
+                      OnceCallback<void(CommandCompleteView)> on_complete, os::Handler* handler) {
+    module_.GetHandler()->Post(common::BindOnce(&impl::handle_enqueue_command_with_complete, common::Unretained(this),
+                                                std::move(command), std::move(on_complete),
+                                                common::Unretained(handler)));
+  }
 
-    if (command_queue_.size() == 1) {
-      std::vector<uint8_t> bytes;
-      BitInserter bi(bytes);
-      command_queue_.front().command->Serialize(bi);
-      hal_->sendHciCommand(bytes);
+  void EnqueueCommand(std::unique_ptr<CommandPacketBuilder> command, OnceCallback<void(CommandStatusView)> on_status,
+                      os::Handler* handler) {
+    module_.GetHandler()->Post(common::BindOnce(&impl::handle_enqueue_command_with_status, common::Unretained(this),
+                                                std::move(command), std::move(on_status), common::Unretained(handler)));
+  }
+
+  void handle_enqueue_command_with_complete(std::unique_ptr<CommandPacketBuilder> command,
+                                            OnceCallback<void(CommandCompleteView)> on_complete, os::Handler* handler) {
+    command_queue_.emplace_back(std::move(command), std::move(on_complete), handler);
+
+    send_next_command();
+  }
+
+  void handle_enqueue_command_with_status(std::unique_ptr<CommandPacketBuilder> command,
+                                          OnceCallback<void(CommandStatusView)> on_status, os::Handler* handler) {
+    command_queue_.emplace_back(std::move(command), std::move(on_status), handler);
+
+    send_next_command();
+  }
+
+  void send_next_command() {
+    if (command_credits_ == 0) {
+      return;
     }
+    if (waiting_command_ != OpCode::NONE) {
+      return;
+    }
+    if (command_queue_.size() == 0) {
+      return;
+    }
+    std::shared_ptr<std::vector<uint8_t>> bytes = std::make_shared<std::vector<uint8_t>>();
+    BitInserter bi(*bytes);
+    command_queue_.front().command->Serialize(bi);
+    hal_->sendHciCommand(*bytes);
+    auto cmd_view = CommandPacketView::Create(bytes);
+    ASSERT(cmd_view.IsValid());
+    OpCode op_code = cmd_view.GetOpCode();
+    waiting_command_ = op_code;
+    command_credits_ = 0;  // Only allow one outstanding command
+    hci_timeout_alarm_->Schedule(BindOnce(&on_hci_timeout, op_code), kHciTimeoutMs);
   }
 
   BidiQueueEnd<AclPacketBuilder, AclPacketView>* GetAclQueueEnd() {
     return acl_queue_.GetUpEnd();
   }
 
-  void RegisterEventHandler(EventCode event_code, std::function<void(EventPacketView)> event_handler,
-                            Handler* handler) {
-    ASSERT_LOG(event_handlers_.count(event_code) == 0, "Can not register a second handler for event_code %02hhx",
-               event_code);
+  void RegisterEventHandler(EventCode event_code, Callback<void(EventPacketView)> event_handler, os::Handler* handler) {
+    module_.GetHandler()->Post(common::BindOnce(&impl::handle_register_event_handler, common::Unretained(this),
+                                                event_code, event_handler, common::Unretained(handler)));
+  }
+
+  void handle_register_event_handler(EventCode event_code, Callback<void(EventPacketView)> event_handler,
+                                     os::Handler* handler) {
+    ASSERT_LOG(event_handlers_.count(event_code) == 0, "Can not register a second handler for event_code %02hhx (%s)",
+               event_code, EventCodeText(event_code).c_str());
     EventHandler to_save(event_handler, handler);
     event_handlers_[event_code] = to_save;
   }
 
   void UnregisterEventHandler(EventCode event_code) {
+    module_.GetHandler()->Post(
+        common::BindOnce(&impl::handle_unregister_event_handler, common::Unretained(this), event_code));
+  }
+
+  void handle_unregister_event_handler(EventCode event_code) {
     event_handlers_.erase(event_code);
   }
 
+  void RegisterLeEventHandler(SubeventCode subevent_code, Callback<void(LeMetaEventView)> event_handler,
+                              os::Handler* handler) {
+    module_.GetHandler()->Post(common::BindOnce(&impl::handle_register_le_event_handler, common::Unretained(this),
+                                                subevent_code, event_handler, common::Unretained(handler)));
+  }
+
+  void handle_register_le_event_handler(SubeventCode subevent_code, Callback<void(LeMetaEventView)> subevent_handler,
+                                        os::Handler* handler) {
+    ASSERT_LOG(subevent_handlers_.count(subevent_code) == 0,
+               "Can not register a second handler for subevent_code %02hhx (%s)", subevent_code,
+               SubeventCodeText(subevent_code).c_str());
+    SubeventHandler to_save(subevent_handler, handler);
+    subevent_handlers_[subevent_code] = to_save;
+  }
+
+  void UnregisterLeEventHandler(SubeventCode subevent_code) {
+    module_.GetHandler()->Post(
+        common::BindOnce(&impl::handle_unregister_le_event_handler, common::Unretained(this), subevent_code));
+  }
+
+  void handle_unregister_le_event_handler(SubeventCode subevent_code) {
+    subevent_handlers_.erase(subevent_code);
+  }
+
   // The HAL
   hal::HciHal* hal_;
 
   // A reference to the HciLayer module
   HciLayer& module_;
 
-  // Conversion functions for sending bytes from Builders
-  std::function<void(std::unique_ptr<hci::BasePacketBuilder>)> send_acl_;
-  std::function<void(std::unique_ptr<hci::BasePacketBuilder>)> send_sco_;
+  // Interfaces
+  SecurityInterfaceImpl security_interface{module_};
+  LeSecurityInterfaceImpl le_security_interface{module_};
+  LeAdvertisingInterfaceImpl le_advertising_interface{module_};
+  LeScanningInterfaceImpl le_scanning_interface{module_};
 
   // Command Handling
-  std::queue<CommandQueueEntry> command_queue_;
+  std::list<CommandQueueEntry> command_queue_;
 
   std::map<EventCode, EventHandler> event_handlers_;
-  OpCode waiting_command_;
+  std::map<SubeventCode, SubeventHandler> subevent_handlers_;
+  OpCode waiting_command_{OpCode::NONE};
+  uint8_t command_credits_{1};  // Send reset first
+  Alarm* hci_timeout_alarm_{nullptr};
 
   // Acl packets
   BidiQueue<AclPacketView, AclPacketBuilder> acl_queue_{3 /* TODO: Set queue depth */};
+  os::EnqueueBuffer<AclPacketView> incoming_acl_packet_buffer_{acl_queue_.GetDownEnd()};
 };
 
 HciLayer::HciLayer() : impl_(std::make_unique<impl>(*this)) {}
@@ -210,24 +445,69 @@
 }
 
 void HciLayer::EnqueueCommand(std::unique_ptr<CommandPacketBuilder> command,
-                              std::function<void(CommandStatusView)> on_status,
-                              std::function<void(CommandCompleteView)> on_complete, Handler* handler) {
-  impl_->EnqueueCommand(std::move(command), on_status, on_complete, handler);
+                              common::OnceCallback<void(CommandCompleteView)> on_complete, os::Handler* handler) {
+  impl_->EnqueueCommand(std::move(command), std::move(on_complete), handler);
+}
+
+void HciLayer::EnqueueCommand(std::unique_ptr<CommandPacketBuilder> command,
+                              common::OnceCallback<void(CommandStatusView)> on_status, os::Handler* handler) {
+  impl_->EnqueueCommand(std::move(command), std::move(on_status), handler);
 }
 
 common::BidiQueueEnd<AclPacketBuilder, AclPacketView>* HciLayer::GetAclQueueEnd() {
   return impl_->GetAclQueueEnd();
 }
 
-void HciLayer::RegisterEventHandler(EventCode event_code, std::function<void(EventPacketView)> event_handler,
-                                    Handler* handler) {
-  impl_->RegisterEventHandler(event_code, event_handler, handler);
+void HciLayer::RegisterEventHandler(EventCode event_code, common::Callback<void(EventPacketView)> event_handler,
+                                    os::Handler* handler) {
+  impl_->RegisterEventHandler(event_code, std::move(event_handler), handler);
 }
 
 void HciLayer::UnregisterEventHandler(EventCode event_code) {
   impl_->UnregisterEventHandler(event_code);
 }
 
+void HciLayer::RegisterLeEventHandler(SubeventCode subevent_code, common::Callback<void(LeMetaEventView)> event_handler,
+                                      os::Handler* handler) {
+  impl_->RegisterLeEventHandler(subevent_code, std::move(event_handler), handler);
+}
+
+void HciLayer::UnregisterLeEventHandler(SubeventCode subevent_code) {
+  impl_->UnregisterLeEventHandler(subevent_code);
+}
+
+SecurityInterface* HciLayer::GetSecurityInterface(common::Callback<void(EventPacketView)> event_handler,
+                                                  os::Handler* handler) {
+  for (const auto event : SecurityInterface::SecurityEvents) {
+    RegisterEventHandler(event, event_handler, handler);
+  }
+  return &impl_->security_interface;
+}
+
+LeSecurityInterface* HciLayer::GetLeSecurityInterface(common::Callback<void(LeMetaEventView)> event_handler,
+                                                      os::Handler* handler) {
+  for (const auto subevent : LeSecurityInterface::LeSecurityEvents) {
+    RegisterLeEventHandler(subevent, event_handler, handler);
+  }
+  return &impl_->le_security_interface;
+}
+
+LeAdvertisingInterface* HciLayer::GetLeAdvertisingInterface(common::Callback<void(LeMetaEventView)> event_handler,
+                                                            os::Handler* handler) {
+  for (const auto subevent : LeAdvertisingInterface::LeAdvertisingEvents) {
+    RegisterLeEventHandler(subevent, event_handler, handler);
+  }
+  return &impl_->le_advertising_interface;
+}
+
+LeScanningInterface* HciLayer::GetLeScanningInterface(common::Callback<void(LeMetaEventView)> event_handler,
+                                                      os::Handler* handler) {
+  for (const auto subevent : LeScanningInterface::LeScanningEvents) {
+    RegisterLeEventHandler(subevent, event_handler, handler);
+  }
+  return &impl_->le_scanning_interface;
+}
+
 const ModuleFactory HciLayer::Factory = ModuleFactory([]() { return new HciLayer(); });
 
 void HciLayer::ListDependencies(ModuleList* list) {
diff --git a/gd/hci/hci_layer.h b/gd/hci/hci_layer.h
index a841a0d..4af585e 100644
--- a/gd/hci/hci_layer.h
+++ b/gd/hci/hci_layer.h
@@ -16,13 +16,19 @@
 
 #pragma once
 
+#include <chrono>
 #include <map>
 
-#include "common/address.h"
+#include "address.h"
+#include "class_of_device.h"
 #include "common/bidi_queue.h"
-#include "common/class_of_device.h"
+#include "common/callback.h"
 #include "hal/hci_hal.h"
 #include "hci/hci_packets.h"
+#include "hci/le_advertising_interface.h"
+#include "hci/le_scanning_interface.h"
+#include "hci/le_security_interface.h"
+#include "hci/security_interface.h"
 #include "module.h"
 #include "os/utils.h"
 
@@ -36,16 +42,34 @@
   DISALLOW_COPY_AND_ASSIGN(HciLayer);
 
   virtual void EnqueueCommand(std::unique_ptr<CommandPacketBuilder> command,
-                              std::function<void(CommandStatusView)> on_status,
-                              std::function<void(CommandCompleteView)> on_complete, os::Handler* handler);
+                              common::OnceCallback<void(CommandCompleteView)> on_complete, os::Handler* handler);
+
+  virtual void EnqueueCommand(std::unique_ptr<CommandPacketBuilder> command,
+                              common::OnceCallback<void(CommandStatusView)> on_status, os::Handler* handler);
 
   virtual common::BidiQueueEnd<AclPacketBuilder, AclPacketView>* GetAclQueueEnd();
 
-  virtual void RegisterEventHandler(EventCode event_code, std::function<void(EventPacketView)> event_handler,
+  virtual void RegisterEventHandler(EventCode event_code, common::Callback<void(EventPacketView)> event_handler,
                                     os::Handler* handler);
 
   virtual void UnregisterEventHandler(EventCode event_code);
 
+  virtual void RegisterLeEventHandler(SubeventCode subevent_code, common::Callback<void(LeMetaEventView)> event_handler,
+                                      os::Handler* handler);
+
+  virtual void UnregisterLeEventHandler(SubeventCode subevent_code);
+
+  SecurityInterface* GetSecurityInterface(common::Callback<void(EventPacketView)> event_handler, os::Handler* handler);
+
+  LeSecurityInterface* GetLeSecurityInterface(common::Callback<void(LeMetaEventView)> event_handler,
+                                              os::Handler* handler);
+
+  LeAdvertisingInterface* GetLeAdvertisingInterface(common::Callback<void(LeMetaEventView)> event_handler,
+                                                    os::Handler* handler);
+
+  LeScanningInterface* GetLeScanningInterface(common::Callback<void(LeMetaEventView)> event_handler,
+                                              os::Handler* handler);
+
   static const ModuleFactory Factory;
 
   void ListDependencies(ModuleList* list) override;
@@ -53,6 +77,7 @@
   void Start() override;
 
   void Stop() override;
+  static constexpr std::chrono::milliseconds kHciTimeoutMs = std::chrono::milliseconds(2000);
 
  private:
   struct impl;
diff --git a/gd/hci/hci_layer_test.cc b/gd/hci/hci_layer_test.cc
index 80360e8..d796488 100644
--- a/gd/hci/hci_layer_test.cc
+++ b/gd/hci/hci_layer_test.cc
@@ -48,23 +48,44 @@
 namespace bluetooth {
 namespace hci {
 
+constexpr std::chrono::milliseconds kTimeout = HciLayer::kHciTimeoutMs / 2;
+constexpr std::chrono::milliseconds kAclTimeout = std::chrono::milliseconds(1000);
+
 class TestHciHal : public hal::HciHal {
  public:
   TestHciHal() : hal::HciHal() {}
 
-  virtual void registerIncomingPacketCallback(hal::HciHalCallbacks* callback) {
+  ~TestHciHal() {
+    ASSERT_LOG(callbacks == nullptr, "unregisterIncomingPacketCallback() must be called");
+  }
+
+  void registerIncomingPacketCallback(hal::HciHalCallbacks* callback) override {
     callbacks = callback;
   }
 
-  virtual void sendHciCommand(hal::HciPacket command) {
+  void unregisterIncomingPacketCallback() override {
+    callbacks = nullptr;
+  }
+
+  void sendHciCommand(hal::HciPacket command) override {
     outgoing_commands_.push_back(std::move(command));
+    if (sent_command_promise_ != nullptr) {
+      auto promise = std::move(sent_command_promise_);
+      sent_command_promise_.reset();
+      promise->set_value();
+    }
   }
 
-  virtual void sendAclData(hal::HciPacket data) {
+  void sendAclData(hal::HciPacket data) override {
     outgoing_acl_.push_front(std::move(data));
+    if (sent_acl_promise_ != nullptr) {
+      auto promise = std::move(sent_acl_promise_);
+      sent_acl_promise_.reset();
+      promise->set_value();
+    }
   }
 
-  virtual void sendScoData(hal::HciPacket data) {
+  void sendScoData(hal::HciPacket data) override {
     outgoing_sco_.push_front(std::move(data));
   }
 
@@ -75,17 +96,29 @@
     return PacketView<kLittleEndian>(shared);
   }
 
-  PacketView<kLittleEndian> GetSentCommand() {
-    while (outgoing_commands_.size() == 0)
-      ;
+  size_t GetNumSentCommands() {
+    return outgoing_commands_.size();
+  }
+
+  std::future<void> GetSentCommandFuture() {
+    ASSERT_LOG(sent_command_promise_ == nullptr, "Promises promises ... Only one at a time");
+    sent_command_promise_ = std::make_unique<std::promise<void>>();
+    return sent_command_promise_->get_future();
+  }
+
+  CommandPacketView GetSentCommand() {
     auto packetview = GetPacketView(std::move(outgoing_commands_.front()));
     outgoing_commands_.pop_front();
-    return packetview;
+    return CommandPacketView::Create(packetview);
+  }
+
+  std::future<void> GetSentAclFuture() {
+    ASSERT_LOG(sent_acl_promise_ == nullptr, "Promises promises ... Only one at a time");
+    sent_acl_promise_ = std::make_unique<std::promise<void>>();
+    return sent_acl_promise_->get_future();
   }
 
   PacketView<kLittleEndian> GetSentAcl() {
-    while (outgoing_acl_.size() == 0)
-      ;
     auto packetview = GetPacketView(std::move(outgoing_acl_.front()));
     outgoing_acl_.pop_front();
     return packetview;
@@ -103,6 +136,8 @@
   std::list<hal::HciPacket> outgoing_commands_;
   std::list<hal::HciPacket> outgoing_acl_;
   std::list<hal::HciPacket> outgoing_sco_;
+  std::unique_ptr<std::promise<void>> sent_command_promise_;
+  std::unique_ptr<std::promise<void>> sent_acl_promise_;
 };
 
 const ModuleFactory TestHciHal::Factory = ModuleFactory([]() { return new TestHciHal(); });
@@ -111,45 +146,87 @@
  public:
   DependsOnHci() : Module() {}
 
-  void SendHciCommand(std::unique_ptr<CommandPacketBuilder> command) {
-    hci_->EnqueueCommand(std::move(command), [this](CommandStatusView status) { incoming_events_.push_back(status); },
-                         [this](CommandCompleteView complete) { incoming_events_.push_back(complete); }, GetHandler());
+  void SendHciCommandExpectingStatus(std::unique_ptr<CommandPacketBuilder> command) {
+    hci_->EnqueueCommand(std::move(command),
+                         common::Bind(&DependsOnHci::handle_event<CommandStatusView>, common::Unretained(this)),
+                         GetHandler());
+  }
+
+  void SendHciCommandExpectingComplete(std::unique_ptr<CommandPacketBuilder> command) {
+    hci_->EnqueueCommand(std::move(command),
+                         common::Bind(&DependsOnHci::handle_event<CommandCompleteView>, common::Unretained(this)),
+                         GetHandler());
+  }
+
+  void SendSecurityCommandExpectingComplete(std::unique_ptr<SecurityCommandBuilder> command) {
+    if (security_interface_ == nullptr) {
+      security_interface_ = hci_->GetSecurityInterface(
+          common::Bind(&DependsOnHci::handle_event<EventPacketView>, common::Unretained(this)), GetHandler());
+    }
+    hci_->EnqueueCommand(std::move(command),
+                         common::Bind(&DependsOnHci::handle_event<CommandCompleteView>, common::Unretained(this)),
+                         GetHandler());
+  }
+
+  void SendLeSecurityCommandExpectingComplete(std::unique_ptr<LeSecurityCommandBuilder> command) {
+    if (le_security_interface_ == nullptr) {
+      le_security_interface_ = hci_->GetLeSecurityInterface(
+          common::Bind(&DependsOnHci::handle_event<LeMetaEventView>, common::Unretained(this)), GetHandler());
+    }
+    hci_->EnqueueCommand(std::move(command),
+                         common::Bind(&DependsOnHci::handle_event<CommandCompleteView>, common::Unretained(this)),
+                         GetHandler());
   }
 
   void SendAclData(std::unique_ptr<AclPacketBuilder> acl) {
-    AclPacketBuilder* raw_acl_pointer = acl.release();
+    outgoing_acl_.push(std::move(acl));
     auto queue_end = hci_->GetAclQueueEnd();
-    queue_end->RegisterEnqueue(GetHandler(), [queue_end, raw_acl_pointer]() -> std::unique_ptr<AclPacketBuilder> {
-      queue_end->UnregisterEnqueue();
-      return std::unique_ptr<AclPacketBuilder>(raw_acl_pointer);
-    });
+    queue_end->RegisterEnqueue(GetHandler(), common::Bind(&DependsOnHci::handle_enqueue, common::Unretained(this)));
+  }
+
+  std::future<void> GetReceivedEventFuture() {
+    ASSERT_LOG(event_promise_ == nullptr, "Promises promises ... Only one at a time");
+    event_promise_ = std::make_unique<std::promise<void>>();
+    return event_promise_->get_future();
   }
 
   EventPacketView GetReceivedEvent() {
-    while (incoming_events_.size() == 0)
-      ;
     EventPacketView packetview = incoming_events_.front();
     incoming_events_.pop_front();
     return packetview;
   }
 
+  std::future<void> GetReceivedAclFuture() {
+    ASSERT_LOG(acl_promise_ == nullptr, "Promises promises ... Only one at a time");
+    acl_promise_ = std::make_unique<std::promise<void>>();
+    return acl_promise_->get_future();
+  }
+
+  size_t GetNumReceivedAclPackets() {
+    return incoming_acl_packets_.size();
+  }
+
   AclPacketView GetReceivedAcl() {
-    auto queue_end = hci_->GetAclQueueEnd();
-    std::unique_ptr<AclPacketView> incoming_acl_ptr;
-    while (incoming_acl_ptr == nullptr) {
-      incoming_acl_ptr = queue_end->TryDequeue();
-    }
-    AclPacketView packetview = *incoming_acl_ptr;
+    AclPacketView packetview = incoming_acl_packets_.front();
+    incoming_acl_packets_.pop_front();
     return packetview;
   }
 
   void Start() {
     hci_ = GetDependency<HciLayer>();
     hci_->RegisterEventHandler(EventCode::CONNECTION_COMPLETE,
-                               [this](EventPacketView event) { incoming_events_.push_back(event); }, GetHandler());
+                               common::Bind(&DependsOnHci::handle_event<EventPacketView>, common::Unretained(this)),
+                               GetHandler());
+    hci_->RegisterLeEventHandler(SubeventCode::CONNECTION_COMPLETE,
+                                 common::Bind(&DependsOnHci::handle_event<LeMetaEventView>, common::Unretained(this)),
+                                 GetHandler());
+    hci_->GetAclQueueEnd()->RegisterDequeue(GetHandler(),
+                                            common::Bind(&DependsOnHci::handle_acl, common::Unretained(this)));
   }
 
-  void Stop() {}
+  void Stop() {
+    hci_->GetAclQueueEnd()->UnregisterDequeue();
+  }
 
   void ListDependencies(ModuleList* list) {
     list->add<HciLayer>();
@@ -159,7 +236,41 @@
 
  private:
   HciLayer* hci_ = nullptr;
+  const SecurityInterface* security_interface_;
+  const LeSecurityInterface* le_security_interface_;
   std::list<EventPacketView> incoming_events_;
+  std::list<AclPacketView> incoming_acl_packets_;
+  std::unique_ptr<std::promise<void>> event_promise_;
+  std::unique_ptr<std::promise<void>> acl_promise_;
+
+  void handle_acl() {
+    auto acl_ptr = hci_->GetAclQueueEnd()->TryDequeue();
+    incoming_acl_packets_.push_back(*acl_ptr);
+    if (acl_promise_ != nullptr) {
+      auto promise = std::move(acl_promise_);
+      acl_promise_.reset();
+      promise->set_value();
+    }
+  }
+
+  template <typename T>
+  void handle_event(T event) {
+    incoming_events_.push_back(event);
+    if (event_promise_ != nullptr) {
+      auto promise = std::move(event_promise_);
+      event_promise_.reset();
+      promise->set_value();
+    }
+  }
+
+  std::queue<std::unique_ptr<AclPacketBuilder>> outgoing_acl_;
+
+  std::unique_ptr<AclPacketBuilder> handle_enqueue() {
+    hci_->GetAclQueueEnd()->UnregisterEnqueue();
+    auto acl = std::move(outgoing_acl_.front());
+    outgoing_acl_.pop();
+    return acl;
+  }
 };
 
 const ModuleFactory DependsOnHci::Factory = ModuleFactory([]() { return new DependsOnHci(); });
@@ -174,11 +285,32 @@
       counting_down_bytes.push_back(~i);
     }
     hal = new TestHciHal();
+
+    auto command_future = hal->GetSentCommandFuture();
+
     fake_registry_.InjectTestModule(&hal::HciHal::Factory, hal);
-    fake_registry_.StartTestModule<DependsOnHci>();
+    fake_registry_.Start<DependsOnHci>(&fake_registry_.GetTestThread());
     hci = static_cast<HciLayer*>(fake_registry_.GetModuleUnderTest(&HciLayer::Factory));
     upper = static_cast<DependsOnHci*>(fake_registry_.GetModuleUnderTest(&DependsOnHci::Factory));
     ASSERT(fake_registry_.IsStarted<HciLayer>());
+
+    auto reset_sent_status = command_future.wait_for(kTimeout);
+    ASSERT_EQ(reset_sent_status, std::future_status::ready);
+
+    // Verify that reset was received
+    ASSERT_EQ(1, hal->GetNumSentCommands());
+
+    auto sent_command = hal->GetSentCommand();
+    auto reset_view = ResetView::Create(CommandPacketView::Create(sent_command));
+    ASSERT_TRUE(reset_view.IsValid());
+
+    // Verify that only one was sent
+    ASSERT_EQ(0, hal->GetNumSentCommands());
+
+    // Send the response event
+    uint8_t num_packets = 1;
+    ErrorCode error_code = ErrorCode::SUCCESS;
+    hal->callbacks->hciEventReceived(GetPacketBytes(ResetCompleteBuilder::Create(num_packets, error_code)));
   }
 
   void TearDown() override {
@@ -201,17 +333,250 @@
 
 TEST_F(HciTest, initAndClose) {}
 
+TEST_F(HciTest, leMetaEvent) {
+  auto event_future = upper->GetReceivedEventFuture();
+
+  // Send an LE event
+  ErrorCode status = ErrorCode::SUCCESS;
+  uint16_t handle = 0x123;
+  Role role = Role::MASTER;
+  AddressType peer_address_type = AddressType::PUBLIC_DEVICE_ADDRESS;
+  Address peer_address = Address::kAny;
+  uint16_t conn_interval = 0x0ABC;
+  uint16_t conn_latency = 0x0123;
+  uint16_t supervision_timeout = 0x0B05;
+  MasterClockAccuracy master_clock_accuracy = MasterClockAccuracy::PPM_50;
+  hal->callbacks->hciEventReceived(GetPacketBytes(
+      LeConnectionCompleteBuilder::Create(status, handle, role, peer_address_type, peer_address, conn_interval,
+                                          conn_latency, supervision_timeout, master_clock_accuracy)));
+
+  // Wait for the event
+  auto event_status = event_future.wait_for(kTimeout);
+  ASSERT_EQ(event_status, std::future_status::ready);
+
+  auto event = upper->GetReceivedEvent();
+  ASSERT(LeConnectionCompleteView::Create(LeMetaEventView::Create(EventPacketView::Create(event))).IsValid());
+}
+
+TEST_F(HciTest, noOpCredits) {
+  ASSERT_EQ(0, hal->GetNumSentCommands());
+
+  // Send 0 credits
+  uint8_t num_packets = 0;
+  hal->callbacks->hciEventReceived(GetPacketBytes(NoCommandCompleteBuilder::Create(num_packets)));
+
+  auto command_future = hal->GetSentCommandFuture();
+  upper->SendHciCommandExpectingComplete(ReadLocalVersionInformationBuilder::Create());
+
+  // Verify that nothing was sent
+  ASSERT_EQ(0, hal->GetNumSentCommands());
+
+  num_packets = 1;
+  hal->callbacks->hciEventReceived(GetPacketBytes(NoCommandCompleteBuilder::Create(num_packets)));
+
+  auto command_sent_status = command_future.wait_for(kTimeout);
+  ASSERT_EQ(command_sent_status, std::future_status::ready);
+
+  // Verify that one was sent
+  ASSERT_EQ(1, hal->GetNumSentCommands());
+
+  auto event_future = upper->GetReceivedEventFuture();
+
+  // Send the response event
+  ErrorCode error_code = ErrorCode::SUCCESS;
+  LocalVersionInformation local_version_information;
+  local_version_information.hci_version_ = HciVersion::V_5_0;
+  local_version_information.hci_revision_ = 0x1234;
+  local_version_information.lmp_version_ = LmpVersion::V_4_2;
+  local_version_information.manufacturer_name_ = 0xBAD;
+  local_version_information.lmp_subversion_ = 0x5678;
+  hal->callbacks->hciEventReceived(GetPacketBytes(
+      ReadLocalVersionInformationCompleteBuilder::Create(num_packets, error_code, local_version_information)));
+
+  // Wait for the event
+  auto event_status = event_future.wait_for(kTimeout);
+  ASSERT_EQ(event_status, std::future_status::ready);
+
+  auto event = upper->GetReceivedEvent();
+  ASSERT(ReadLocalVersionInformationCompleteView::Create(CommandCompleteView::Create(EventPacketView::Create(event)))
+             .IsValid());
+}
+
+TEST_F(HciTest, creditsTest) {
+  ASSERT_EQ(0, hal->GetNumSentCommands());
+
+  auto command_future = hal->GetSentCommandFuture();
+
+  // Send all three commands
+  upper->SendHciCommandExpectingComplete(ReadLocalVersionInformationBuilder::Create());
+  upper->SendHciCommandExpectingComplete(ReadLocalSupportedCommandsBuilder::Create());
+  upper->SendHciCommandExpectingComplete(ReadLocalSupportedFeaturesBuilder::Create());
+
+  auto command_sent_status = command_future.wait_for(kTimeout);
+  ASSERT_EQ(command_sent_status, std::future_status::ready);
+
+  // Verify that the first one is sent
+  ASSERT_EQ(1, hal->GetNumSentCommands());
+
+  auto sent_command = hal->GetSentCommand();
+  auto version_view = ReadLocalVersionInformationView::Create(CommandPacketView::Create(sent_command));
+  ASSERT_TRUE(version_view.IsValid());
+
+  // Verify that only one was sent
+  ASSERT_EQ(0, hal->GetNumSentCommands());
+
+  // Get a new future
+  auto event_future = upper->GetReceivedEventFuture();
+
+  // Send the response event
+  uint8_t num_packets = 1;
+  ErrorCode error_code = ErrorCode::SUCCESS;
+  LocalVersionInformation local_version_information;
+  local_version_information.hci_version_ = HciVersion::V_5_0;
+  local_version_information.hci_revision_ = 0x1234;
+  local_version_information.lmp_version_ = LmpVersion::V_4_2;
+  local_version_information.manufacturer_name_ = 0xBAD;
+  local_version_information.lmp_subversion_ = 0x5678;
+  hal->callbacks->hciEventReceived(GetPacketBytes(
+      ReadLocalVersionInformationCompleteBuilder::Create(num_packets, error_code, local_version_information)));
+
+  // Wait for the event
+  auto event_status = event_future.wait_for(kTimeout);
+  ASSERT_EQ(event_status, std::future_status::ready);
+
+  auto event = upper->GetReceivedEvent();
+  ASSERT(ReadLocalVersionInformationCompleteView::Create(CommandCompleteView::Create(EventPacketView::Create(event)))
+             .IsValid());
+
+  // Verify that the second one is sent
+  command_sent_status = command_future.wait_for(kTimeout);
+  ASSERT_EQ(command_sent_status, std::future_status::ready);
+  ASSERT_EQ(1, hal->GetNumSentCommands());
+
+  sent_command = hal->GetSentCommand();
+  auto supported_commands_view = ReadLocalSupportedCommandsView::Create(CommandPacketView::Create(sent_command));
+  ASSERT_TRUE(supported_commands_view.IsValid());
+
+  // Verify that only one was sent
+  ASSERT_EQ(0, hal->GetNumSentCommands());
+  event_future = upper->GetReceivedEventFuture();
+  command_future = hal->GetSentCommandFuture();
+
+  // Send the response event
+  std::array<uint8_t, 64> supported_commands;
+  for (uint8_t i = 0; i < 64; i++) {
+    supported_commands[i] = i;
+  }
+  hal->callbacks->hciEventReceived(
+      GetPacketBytes(ReadLocalSupportedCommandsCompleteBuilder::Create(num_packets, error_code, supported_commands)));
+  // Wait for the event
+  event_status = event_future.wait_for(kTimeout);
+  ASSERT_EQ(event_status, std::future_status::ready);
+
+  event = upper->GetReceivedEvent();
+  ASSERT(ReadLocalSupportedCommandsCompleteView::Create(CommandCompleteView::Create(EventPacketView::Create(event)))
+             .IsValid());
+  // Verify that the third one is sent
+  command_sent_status = command_future.wait_for(kTimeout);
+  ASSERT_EQ(command_sent_status, std::future_status::ready);
+  ASSERT_EQ(1, hal->GetNumSentCommands());
+
+  sent_command = hal->GetSentCommand();
+  auto supported_features_view = ReadLocalSupportedFeaturesView::Create(CommandPacketView::Create(sent_command));
+  ASSERT_TRUE(supported_features_view.IsValid());
+
+  // Verify that only one was sent
+  ASSERT_EQ(0, hal->GetNumSentCommands());
+  event_future = upper->GetReceivedEventFuture();
+
+  // Send the response event
+  uint64_t lmp_features = 0x012345678abcdef;
+  hal->callbacks->hciEventReceived(
+      GetPacketBytes(ReadLocalSupportedFeaturesCompleteBuilder::Create(num_packets, error_code, lmp_features)));
+
+  // Wait for the event
+  event_status = event_future.wait_for(kTimeout);
+  ASSERT_EQ(event_status, std::future_status::ready);
+  event = upper->GetReceivedEvent();
+  ASSERT(ReadLocalSupportedFeaturesCompleteView::Create(CommandCompleteView::Create(EventPacketView::Create(event)))
+             .IsValid());
+}
+
+TEST_F(HciTest, leSecurityInterfaceTest) {
+  // Send LeRand to the controller
+  auto command_future = hal->GetSentCommandFuture();
+  upper->SendLeSecurityCommandExpectingComplete(LeRandBuilder::Create());
+
+  auto command_sent_status = command_future.wait_for(kTimeout);
+  ASSERT_EQ(command_sent_status, std::future_status::ready);
+
+  // Check the command
+  auto sent_command = hal->GetSentCommand();
+  ASSERT_LT(0, sent_command.size());
+  LeRandView view = LeRandView::Create(LeSecurityCommandView::Create(CommandPacketView::Create(sent_command)));
+  ASSERT_TRUE(view.IsValid());
+
+  // Send a Command Complete to the host
+  auto event_future = upper->GetReceivedEventFuture();
+  uint8_t num_packets = 1;
+  ErrorCode status = ErrorCode::SUCCESS;
+  uint64_t rand = 0x0123456789abcdef;
+  hal->callbacks->hciEventReceived(GetPacketBytes(LeRandCompleteBuilder::Create(num_packets, status, rand)));
+
+  // Verify the event
+  auto event_status = event_future.wait_for(kTimeout);
+  ASSERT_EQ(event_status, std::future_status::ready);
+  auto event = upper->GetReceivedEvent();
+  ASSERT_TRUE(event.IsValid());
+  ASSERT_EQ(EventCode::COMMAND_COMPLETE, event.GetEventCode());
+  ASSERT_TRUE(LeRandCompleteView::Create(CommandCompleteView::Create(event)).IsValid());
+}
+
+TEST_F(HciTest, securityInterfacesTest) {
+  // Send WriteSimplePairingMode to the controller
+  auto command_future = hal->GetSentCommandFuture();
+  Enable enable = Enable::ENABLED;
+  upper->SendSecurityCommandExpectingComplete(WriteSimplePairingModeBuilder::Create(enable));
+
+  auto command_sent_status = command_future.wait_for(kTimeout);
+  ASSERT_EQ(command_sent_status, std::future_status::ready);
+
+  // Check the command
+  auto sent_command = hal->GetSentCommand();
+  ASSERT_LT(0, sent_command.size());
+  auto view = WriteSimplePairingModeView::Create(SecurityCommandView::Create(CommandPacketView::Create(sent_command)));
+  ASSERT_TRUE(view.IsValid());
+
+  // Send a Command Complete to the host
+  auto event_future = upper->GetReceivedEventFuture();
+  uint8_t num_packets = 1;
+  ErrorCode status = ErrorCode::SUCCESS;
+  hal->callbacks->hciEventReceived(GetPacketBytes(WriteSimplePairingModeCompleteBuilder::Create(num_packets, status)));
+
+  // Verify the event
+  auto event_status = event_future.wait_for(kTimeout);
+  ASSERT_EQ(event_status, std::future_status::ready);
+  auto event = upper->GetReceivedEvent();
+  ASSERT_TRUE(event.IsValid());
+  ASSERT_EQ(EventCode::COMMAND_COMPLETE, event.GetEventCode());
+  ASSERT_TRUE(WriteSimplePairingModeCompleteView::Create(CommandCompleteView::Create(event)).IsValid());
+}
+
 TEST_F(HciTest, createConnectionTest) {
   // Send CreateConnection to the controller
-  common::Address bd_addr;
-  ASSERT_TRUE(common::Address::FromString("A1:A2:A3:A4:A5:A6", bd_addr));
+  auto command_future = hal->GetSentCommandFuture();
+  Address bd_addr;
+  ASSERT_TRUE(Address::FromString("A1:A2:A3:A4:A5:A6", bd_addr));
   uint16_t packet_type = 0x1234;
   PageScanRepetitionMode page_scan_repetition_mode = PageScanRepetitionMode::R0;
   uint16_t clock_offset = 0x3456;
   ClockOffsetValid clock_offset_valid = ClockOffsetValid::VALID;
   CreateConnectionRoleSwitch allow_role_switch = CreateConnectionRoleSwitch::ALLOW_ROLE_SWITCH;
-  upper->SendHciCommand(CreateConnectionBuilder::Create(bd_addr, packet_type, page_scan_repetition_mode, clock_offset,
-                                                        clock_offset_valid, allow_role_switch));
+  upper->SendHciCommandExpectingStatus(CreateConnectionBuilder::Create(
+      bd_addr, packet_type, page_scan_repetition_mode, clock_offset, clock_offset_valid, allow_role_switch));
+
+  auto command_sent_status = command_future.wait_for(kTimeout);
+  ASSERT_EQ(command_sent_status, std::future_status::ready);
 
   // Check the command
   auto sent_command = hal->GetSentCommand();
@@ -226,16 +591,30 @@
   ASSERT_EQ(clock_offset_valid, view.GetClockOffsetValid());
   ASSERT_EQ(allow_role_switch, view.GetAllowRoleSwitch());
 
-  // Send a ConnectionComplete to the host
+  // Send a Command Status to the host
+  auto event_future = upper->GetReceivedEventFuture();
   ErrorCode status = ErrorCode::SUCCESS;
   uint16_t handle = 0x123;
   LinkType link_type = LinkType::ACL;
   Enable encryption_enabled = Enable::DISABLED;
+  hal->callbacks->hciEventReceived(GetPacketBytes(CreateConnectionStatusBuilder::Create(ErrorCode::SUCCESS, 1)));
+
+  // Verify the event
+  auto event_status = event_future.wait_for(kTimeout);
+  ASSERT_EQ(event_status, std::future_status::ready);
+  auto event = upper->GetReceivedEvent();
+  ASSERT_TRUE(event.IsValid());
+  ASSERT_EQ(EventCode::COMMAND_STATUS, event.GetEventCode());
+
+  // Send a ConnectionComplete to the host
+  event_future = upper->GetReceivedEventFuture();
   hal->callbacks->hciEventReceived(
       GetPacketBytes(ConnectionCompleteBuilder::Create(status, handle, bd_addr, link_type, encryption_enabled)));
 
   // Verify the event
-  auto event = upper->GetReceivedEvent();
+  event_status = event_future.wait_for(kTimeout);
+  ASSERT_EQ(event_status, std::future_status::ready);
+  event = upper->GetReceivedEvent();
   ASSERT_TRUE(event.IsValid());
   ASSERT_EQ(EventCode::CONNECTION_COMPLETE, event.GetEventCode());
   ConnectionCompleteView connection_complete_view = ConnectionCompleteView::Create(event);
@@ -246,15 +625,18 @@
   ASSERT_EQ(encryption_enabled, connection_complete_view.GetEncryptionEnabled());
 
   // Send an ACL packet from the remote
-  PacketBoundaryFlag packet_boundary_flag = PacketBoundaryFlag::COMPLETE_PDU;
+  PacketBoundaryFlag packet_boundary_flag = PacketBoundaryFlag::FIRST_AUTOMATICALLY_FLUSHABLE;
   BroadcastFlag broadcast_flag = BroadcastFlag::POINT_TO_POINT;
   auto acl_payload = std::make_unique<RawBuilder>();
   acl_payload->AddAddress(bd_addr);
   acl_payload->AddOctets2(handle);
+  auto incoming_acl_future = upper->GetReceivedAclFuture();
   hal->callbacks->aclDataReceived(
       GetPacketBytes(AclPacketBuilder::Create(handle, packet_boundary_flag, broadcast_flag, std::move(acl_payload))));
 
   // Verify the ACL packet
+  auto incoming_acl_status = incoming_acl_future.wait_for(kAclTimeout);
+  ASSERT_EQ(incoming_acl_status, std::future_status::ready);
   auto acl_view = upper->GetReceivedAcl();
   ASSERT_TRUE(acl_view.IsValid());
   ASSERT_EQ(sizeof(bd_addr) + sizeof(handle), acl_view.GetPayload().size());
@@ -263,14 +645,17 @@
   ASSERT_EQ(handle, itr.extract<uint16_t>());
 
   // Send an ACL packet from DependsOnHci
-  PacketBoundaryFlag packet_boundary_flag2 = PacketBoundaryFlag::COMPLETE_PDU;
+  PacketBoundaryFlag packet_boundary_flag2 = PacketBoundaryFlag::FIRST_AUTOMATICALLY_FLUSHABLE;
   BroadcastFlag broadcast_flag2 = BroadcastFlag::POINT_TO_POINT;
   auto acl_payload2 = std::make_unique<RawBuilder>();
   acl_payload2->AddOctets2(handle);
   acl_payload2->AddAddress(bd_addr);
+  auto sent_acl_future = hal->GetSentAclFuture();
   upper->SendAclData(AclPacketBuilder::Create(handle, packet_boundary_flag2, broadcast_flag2, std::move(acl_payload2)));
 
   // Verify the ACL packet
+  auto sent_acl_status = sent_acl_future.wait_for(kAclTimeout);
+  ASSERT_EQ(sent_acl_status, std::future_status::ready);
   auto sent_acl = hal->GetSentAcl();
   ASSERT_LT(0, sent_acl.size());
   AclPacketView sent_acl_view = AclPacketView::Create(sent_acl);
@@ -280,5 +665,65 @@
   ASSERT_EQ(handle, sent_itr.extract<uint16_t>());
   ASSERT_EQ(bd_addr, sent_itr.extract<Address>());
 }
+
+TEST_F(HciTest, receiveMultipleAclPackets) {
+  Address bd_addr;
+  ASSERT_TRUE(Address::FromString("A1:A2:A3:A4:A5:A6", bd_addr));
+  uint16_t handle = 0x0001;
+  uint16_t num_packets = 100;
+  PacketBoundaryFlag packet_boundary_flag = PacketBoundaryFlag::FIRST_AUTOMATICALLY_FLUSHABLE;
+  BroadcastFlag broadcast_flag = BroadcastFlag::POINT_TO_POINT;
+  for (uint16_t i = 0; i < num_packets; i++) {
+    auto acl_payload = std::make_unique<RawBuilder>();
+    acl_payload->AddAddress(bd_addr);
+    acl_payload->AddOctets2(handle);
+    acl_payload->AddOctets2(i);
+    hal->callbacks->aclDataReceived(
+        GetPacketBytes(AclPacketBuilder::Create(handle, packet_boundary_flag, broadcast_flag, std::move(acl_payload))));
+  }
+  auto incoming_acl_future = upper->GetReceivedAclFuture();
+  uint16_t received_packets = 0;
+  while (received_packets < num_packets - 1) {
+    auto incoming_acl_status = incoming_acl_future.wait_for(kAclTimeout);
+    // Get the next future.
+    incoming_acl_future = upper->GetReceivedAclFuture();
+    ASSERT_EQ(incoming_acl_status, std::future_status::ready);
+    size_t num_packets = upper->GetNumReceivedAclPackets();
+    for (size_t i = 0; i < num_packets; i++) {
+      auto acl_view = upper->GetReceivedAcl();
+      ASSERT_TRUE(acl_view.IsValid());
+      ASSERT_EQ(sizeof(bd_addr) + sizeof(handle) + sizeof(received_packets), acl_view.GetPayload().size());
+      auto itr = acl_view.GetPayload().begin();
+      ASSERT_EQ(bd_addr, itr.extract<Address>());
+      ASSERT_EQ(handle, itr.extract<uint16_t>());
+      ASSERT_EQ(received_packets, itr.extract<uint16_t>());
+      received_packets += 1;
+    }
+  }
+
+  // Check to see if this future was already fulfilled.
+  auto acl_race_status = incoming_acl_future.wait_for(std::chrono::milliseconds(1));
+  if (acl_race_status == std::future_status::ready) {
+    // Get the next future.
+    incoming_acl_future = upper->GetReceivedAclFuture();
+  }
+
+  // One last packet to make sure they were all sent.  Already got the future.
+  auto acl_payload = std::make_unique<RawBuilder>();
+  acl_payload->AddAddress(bd_addr);
+  acl_payload->AddOctets2(handle);
+  acl_payload->AddOctets2(num_packets);
+  hal->callbacks->aclDataReceived(
+      GetPacketBytes(AclPacketBuilder::Create(handle, packet_boundary_flag, broadcast_flag, std::move(acl_payload))));
+  auto incoming_acl_status = incoming_acl_future.wait_for(kAclTimeout);
+  ASSERT_EQ(incoming_acl_status, std::future_status::ready);
+  auto acl_view = upper->GetReceivedAcl();
+  ASSERT_TRUE(acl_view.IsValid());
+  ASSERT_EQ(sizeof(bd_addr) + sizeof(handle) + sizeof(received_packets), acl_view.GetPayload().size());
+  auto itr = acl_view.GetPayload().begin();
+  ASSERT_EQ(bd_addr, itr.extract<Address>());
+  ASSERT_EQ(handle, itr.extract<uint16_t>());
+  ASSERT_EQ(received_packets, itr.extract<uint16_t>());
+}
 }  // namespace hci
 }  // namespace bluetooth
diff --git a/gd/hci/hci_packets.pdl b/gd/hci/hci_packets.pdl
index 6d57c95..255306c 100644
--- a/gd/hci/hci_packets.pdl
+++ b/gd/hci/hci_packets.pdl
@@ -1,7 +1,7 @@
 little_endian_packets
 
-custom_field Address : 48 "common/"
-custom_field ClassOfDevice : 24 "common/"
+custom_field Address : 48 "hci/"
+custom_field ClassOfDevice : 24 "hci/"
 
 enum Enable : 8 {
   DISABLED = 0x00,
@@ -9,7 +9,8 @@
 }
 
 // https://www.bluetooth.com/specifications/assigned-numbers/generic-access-profile
-enum GapDataTypes : 8 {
+enum GapDataType : 8 {
+  INVALID = 0x00,
   FLAGS = 0x01,
   INCOMPLETE_LIST_16_BIT_UUIDS = 0x02,
   COMPLETE_LIST_16_BIT_UUIDS = 0x03,
@@ -23,13 +24,18 @@
   CLASS_OF_DEVICE = 0x0D,
 }
 
+struct GapData {
+  _size_(data) : 8, // Including one byte for data_type
+  data_type : GapDataType,
+  data : 8[+1*8],
+}
+
 // HCI ACL Packets
 
 enum PacketBoundaryFlag : 2 {
   FIRST_NON_AUTOMATICALLY_FLUSHABLE = 0,
   CONTINUING_FRAGMENT = 1,
   FIRST_AUTOMATICALLY_FLUSHABLE = 2,
-  COMPLETE_PDU = 3,
 }
 
 enum BroadcastFlag : 2 {
@@ -58,8 +64,8 @@
   handle : 12,
   packet_status_flag : PacketStatusFlag,
   _reserved_ : 2, // BroadcastFlag
-  _size_(_payload_) : 8,
-  _payload_,
+  _size_(data) : 8,
+  data : 8[],
 }
 
 // HCI Command Packets
@@ -191,6 +197,7 @@
 
   READ_SECURE_CONNECTIONS_HOST_SUPPORT = 0x0C79,
   WRITE_SECURE_CONNECTIONS_HOST_SUPPORT = 0x0C7A,
+  READ_LOCAL_OOB_EXTENDED_DATA = 0x0C7D,
 
   // INFORMATIONAL_PARAMETERS
   READ_LOCAL_VERSION_INFORMATION = 0x1001,
@@ -310,6 +317,224 @@
   CONTROLLER_A2DP_OPCODE = 0xFD5D,
 }
 
+// For mapping Local Supported Commands command
+// Value = Octet * 10 + bit
+enum OpCodeIndex : 16 {
+  INQUIRY = 0,
+  INQUIRY_CANCEL = 1,
+  PERIODIC_INQUIRY_MODE = 2,
+  EXIT_PERIODIC_INQUIRY_MODE = 3,
+  CREATE_CONNECTION = 4,
+  DISCONNECT = 5,
+  CREATE_CONNECTION_CANCEL = 7,
+  ACCEPT_CONNECTION_REQUEST = 10,
+  REJECT_CONNECTION_REQUEST = 11,
+  LINK_KEY_REQUEST_REPLY = 12,
+  LINK_KEY_REQUEST_NEGATIVE_REPLY = 13,
+  PIN_CODE_REQUEST_REPLY = 14,
+  PIN_CODE_REQUEST_NEGATIVE_REPLY = 15,
+  CHANGE_CONNECTION_PACKET_TYPE = 16,
+  AUTHENTICATION_REQUESTED = 17,
+  SET_CONNECTION_ENCRYPTION = 20,
+  CHANGE_CONNECTION_LINK_KEY = 21,
+  MASTER_LINK_KEY = 22,
+  REMOTE_NAME_REQUEST = 23,
+  REMOTE_NAME_REQUEST_CANCEL = 24,
+  READ_REMOTE_SUPPORTED_FEATURES = 25,
+  READ_REMOTE_EXTENDED_FEATURES = 26,
+  READ_REMOTE_VERSION_INFORMATION = 27,
+  READ_CLOCK_OFFSET = 30,
+  READ_LMP_HANDLE = 31,
+  HOLD_MODE = 41,
+  SNIFF_MODE = 42,
+  EXIT_SNIFF_MODE = 43,
+  QOS_SETUP = 46,
+  ROLE_DISCOVERY = 47,
+  SWITCH_ROLE = 50,
+  READ_LINK_POLICY_SETTINGS = 51,
+  WRITE_LINK_POLICY_SETTINGS = 52,
+  READ_DEFAULT_LINK_POLICY_SETTINGS = 53,
+  WRITE_DEFAULT_LINK_POLICY_SETTINGS = 54,
+  FLOW_SPECIFICATION = 55,
+  SET_EVENT_MASK = 56,
+  RESET = 57,
+  SET_EVENT_FILTER = 60,
+  FLUSH = 61,
+  READ_PIN_TYPE = 62,
+  WRITE_PIN_TYPE = 63,
+  READ_STORED_LINK_KEY = 65,
+  WRITE_STORED_LINK_KEY = 66,
+  DELETE_STORED_LINK_KEY = 67,
+  WRITE_LOCAL_NAME = 70,
+  READ_LOCAL_NAME = 71,
+  READ_CONNECTION_ACCEPT_TIMEOUT = 72,
+  WRITE_CONNECTION_ACCEPT_TIMEOUT = 73,
+  READ_PAGE_TIMEOUT = 74,
+  WRITE_PAGE_TIMEOUT = 75,
+  READ_SCAN_ENABLE = 76,
+  WRITE_SCAN_ENABLE = 77,
+  READ_PAGE_SCAN_ACTIVITY = 80,
+  WRITE_PAGE_SCAN_ACTIVITY = 81,
+  READ_INQUIRY_SCAN_ACTIVITY = 82,
+  WRITE_INQUIRY_SCAN_ACTIVITY = 83,
+  READ_AUTHENTICATION_ENABLE = 84,
+  WRITE_AUTHENTICATION_ENABLE = 85,
+  READ_CLASS_OF_DEVICE = 90,
+  WRITE_CLASS_OF_DEVICE = 91,
+  READ_VOICE_SETTING = 92,
+  WRITE_VOICE_SETTING = 93,
+  READ_AUTOMATIC_FLUSH_TIMEOUT = 94,
+  WRITE_AUTOMATIC_FLUSH_TIMEOUT = 95,
+  READ_NUM_BROADCAST_RETRANSMITS = 96,
+  WRITE_NUM_BROADCAST_RETRANSMITS = 97,
+  READ_HOLD_MODE_ACTIVITY = 100,
+  WRITE_HOLD_MODE_ACTIVITY = 101,
+  READ_TRANSMIT_POWER_LEVEL = 102,
+  READ_SYNCHRONOUS_FLOW_CONTROL_ENABLE = 103,
+  WRITE_SYNCHRONOUS_FLOW_CONTROL_ENABLE = 104,
+  SET_CONTROLLER_TO_HOST_FLOW_CONTROL = 105,
+  HOST_BUFFER_SIZE = 106,
+  HOST_NUM_COMPLETED_PACKETS = 107,
+  READ_LINK_SUPERVISION_TIMEOUT = 110,
+  WRITE_LINK_SUPERVISION_TIMEOUT = 111,
+  READ_NUMBER_OF_SUPPORTED_IAC = 112,
+  READ_CURRENT_IAC_LAP = 113,
+  WRITE_CURRENT_IAC_LAP = 114,
+  SET_AFH_HOST_CHANNEL_CLASSIFICATION = 121,
+  READ_INQUIRY_SCAN_TYPE = 124,
+  WRITE_INQUIRY_SCAN_TYPE = 125,
+  READ_INQUIRY_MODE = 126,
+  WRITE_INQUIRY_MODE = 127,
+  READ_PAGE_SCAN_TYPE = 130,
+  WRITE_PAGE_SCAN_TYPE = 131,
+  READ_AFH_CHANNEL_ASSESSMENT_MODE = 132,
+  WRITE_AFH_CHANNEL_ASSESSMENT_MODE = 133,
+  READ_LOCAL_VERSION_INFORMATION = 143,
+  READ_LOCAL_SUPPORTED_FEATURES = 145,
+  READ_LOCAL_EXTENDED_FEATURES = 146,
+  READ_BUFFER_SIZE = 147,
+  READ_BD_ADDR = 151,
+  READ_FAILED_CONTACT_COUNTER = 152,
+  RESET_FAILED_CONTACT_COUNTER = 153,
+  READ_LINK_QUALITY = 154,
+  READ_RSSI = 155,
+  READ_AFH_CHANNEL_MAP = 156,
+  READ_CLOCK = 157,
+  READ_LOOPBACK_MODE = 160,
+  WRITE_LOOPBACK_MODE = 161,
+  ENABLE_DEVICE_UNDER_TEST_MODE = 162,
+  SETUP_SYNCHRONOUS_CONNECTION = 163,
+  ACCEPT_SYNCHRONOUS_CONNECTION = 164,
+  REJECT_SYNCHRONOUS_CONNECTION = 165,
+  READ_EXTENDED_INQUIRY_RESPONSE = 170,
+  WRITE_EXTENDED_INQUIRY_RESPONSE = 171,
+  REFRESH_ENCRYPTION_KEY = 172,
+  SNIFF_SUBRATING = 174,
+  READ_SIMPLE_PAIRING_MODE = 175,
+  WRITE_SIMPLE_PAIRING_MODE = 176,
+  READ_LOCAL_OOB_DATA = 177,
+  READ_INQUIRY_RESPONSE_TRANSMIT_POWER_LEVEL = 180,
+  WRITE_INQUIRY_TRANSMIT_POWER_LEVEL = 181,
+  IO_CAPABILITY_REQUEST_REPLY = 187,
+  USER_CONFIRMATION_REQUEST_REPLY = 190,
+  USER_CONFIRMATION_REQUEST_NEGATIVE_REPLY = 191,
+  USER_PASSKEY_REQUEST_REPLY = 192,
+  USER_PASSKEY_REQUEST_NEGATIVE_REPLY = 193,
+  REMOTE_OOB_DATA_REQUEST_REPLY = 194,
+  WRITE_SIMPLE_PAIRING_DEBUG_MODE = 195,
+  REMOTE_OOB_DATA_REQUEST_NEGATIVE_REPLY = 197,
+  SEND_KEYPRESS_NOTIFICATION = 202,
+  IO_CAPABILITY_REQUEST_NEGATIVE_REPLY = 203,
+  READ_ENCRYPTION_KEY_SIZE = 204,
+  READ_DATA_BLOCK_SIZE = 232,
+  READ_LE_HOST_SUPPORT = 245,
+  WRITE_LE_HOST_SUPPORT = 246,
+  LE_SET_EVENT_MASK = 250,
+  LE_READ_BUFFER_SIZE = 251,
+  LE_READ_LOCAL_SUPPORTED_FEATURES = 252,
+  LE_SET_RANDOM_ADDRESS = 254,
+  LE_SET_ADVERTISING_PARAMETERS = 255,
+  LE_READ_ADVERTISING_CHANNEL_TX_POWER = 256,
+  LE_SET_ADVERTISING_DATA = 257,
+  LE_SET_SCAN_RESPONSE_DATA = 260,
+  LE_SET_ADVERTISING_ENABLE = 261,
+  LE_SET_SCAN_PARAMETERS = 262,
+  LE_SET_SCAN_ENABLE = 263,
+  LE_CREATE_CONNECTION = 264,
+  LE_CREATE_CONNECTION_CANCEL = 265,
+  LE_READ_WHITE_LIST_SIZE = 266,
+  LE_CLEAR_WHITE_LIST = 267,
+  LE_ADD_DEVICE_TO_WHITE_LIST = 270,
+  LE_REMOVE_DEVICE_FROM_WHITE_LIST = 271,
+  LE_CONNECTION_UPDATE = 272,
+  LE_SET_HOST_CHANNEL_CLASSIFICATION = 273,
+  LE_READ_CHANNEL_MAP = 274,
+  LE_READ_REMOTE_FEATURES = 275,
+  LE_ENCRYPT = 276,
+  LE_RAND = 277,
+  LE_START_ENCRYPTION = 280,
+  LE_LONG_TERM_KEY_REQUEST_REPLY = 281,
+  LE_LONG_TERM_KEY_REQUEST_NEGATIVE_REPLY = 282,
+  LE_READ_SUPPORTED_STATES = 283,
+  LE_RECEIVER_TEST = 284,
+  LE_TRANSMITTER_TEST = 285,
+  LE_TEST_END = 286,
+  ENHANCED_SETUP_SYNCHRONOUS_CONNECTION = 293,
+  ENHANCED_ACCEPT_SYNCHRONOUS_CONNECTION = 294,
+  READ_LOCAL_SUPPORTED_CODECS = 295,
+  READ_SECURE_CONNECTIONS_HOST_SUPPORT = 322,
+  WRITE_SECURE_CONNECTIONS_HOST_SUPPORT = 323,
+  READ_LOCAL_OOB_EXTENDED_DATA = 326,
+  WRITE_SECURE_CONNECTIONS_TEST_MODE = 327,
+  LE_REMOTE_CONNECTION_PARAMETER_REQUEST_REPLY = 334,
+  LE_REMOTE_CONNECTION_PARAMETER_REQUEST_NEGATIVE_REPLY = 335,
+  LE_SET_DATA_LENGTH = 336,
+  LE_READ_SUGGESTED_DEFAULT_DATA_LENGTH = 337,
+  LE_WRITE_SUGGESTED_DEFAULT_DATA_LENGTH = 340,
+  LE_READ_LOCAL_P_256_PUBLIC_KEY_COMMAND = 341,
+  LE_GENERATE_DHKEY_COMMAND = 342,
+  LE_ADD_DEVICE_TO_RESOLVING_LIST = 343,
+  LE_REMOVE_DEVICE_FROM_RESOLVING_LIST = 344,
+  LE_CLEAR_RESOLVING_LIST = 345,
+  LE_READ_RESOLVING_LIST_SIZE = 346,
+  LE_READ_PEER_RESOLVABLE_ADDRESS = 347,
+  LE_READ_LOCAL_RESOLVABLE_ADDRESS = 350,
+  LE_SET_ADDRESS_RESOLUTION_ENABLE = 351,
+  LE_SET_RESOLVABLE_PRIVATE_ADDRESS_TIMEOUT = 352,
+  LE_READ_MAXIMUM_DATA_LENGTH = 353,
+  LE_READ_PHY = 354,
+  LE_SET_DEFAULT_PHY = 355,
+  LE_SET_PHY = 356,
+  LE_ENHANCED_RECEIVER_TEST = 357,
+  LE_ENHANCED_TRANSMITTER_TEST = 360,
+  LE_SET_EXTENDED_ADVERTISING_RANDOM_ADDRESS = 361,
+  LE_SET_EXTENDED_ADVERTISING_PARAMETERS = 362,
+  LE_SET_EXTENDED_ADVERTISING_DATA = 363,
+  LE_SET_EXTENDED_ADVERTISING_SCAN_RESPONSE = 364,
+  LE_SET_EXTENDED_ADVERTISING_ENABLE = 365,
+  LE_READ_MAXIMUM_ADVERTISING_DATA_LENGTH = 366,
+  LE_READ_NUMBER_OF_SUPPORTED_ADVERTISING_SETS = 367,
+  LE_REMOVE_ADVERTISING_SET = 370,
+  LE_CLEAR_ADVERTISING_SETS = 371,
+  LE_SET_PERIODIC_ADVERTISING_PARAM = 372,
+  LE_SET_PERIODIC_ADVERTISING_DATA = 373,
+  LE_SET_PERIODIC_ADVERTISING_ENABLE = 374,
+  LE_SET_EXTENDED_SCAN_PARAMETERS = 375,
+  LE_SET_EXTENDED_SCAN_ENABLE = 376,
+  LE_EXTENDED_CREATE_CONNECTION = 377,
+  LE_PERIODIC_ADVERTISING_CREATE_SYNC = 380,
+  LE_PERIODIC_ADVERTISING_CREATE_SYNC_CANCEL = 381,
+  LE_PERIODIC_ADVERTISING_TERMINATE_SYNC = 382,
+  LE_ADD_DEVICE_TO_PERIODIC_ADVERTISING_LIST = 383,
+  LE_REMOVE_DEVICE_FROM_PERIODIC_ADVERTISING_LIST = 384,
+  LE_CLEAR_PERIODIC_ADVERTISING_LIST = 385,
+  LE_READ_PERIODIC_ADVERTISING_LIST_SIZE = 386,
+  LE_READ_TRANSMIT_POWER = 387,
+  LE_READ_RF_PATH_COMPENSATION_POWER = 390,
+  LE_WRITE_RF_PATH_COMPENSATION_POWER = 391,
+  LE_SET_PRIVACY_MODE = 392,
+}
+
 packet CommandPacket {
   op_code : OpCode,
   _size_(_payload_) : 8,
@@ -323,6 +548,7 @@
 packet SecurityCommand : CommandPacket { _payload_, }
 packet ScoConnectionCommand : CommandPacket { _payload_, }
 packet LeAdvertisingCommand : CommandPacket { _payload_, }
+packet LeScanningCommand : CommandPacket { _payload_, }
 packet LeConnectionManagementCommand : CommandPacket { _payload_, }
 packet LeSecurityCommand : CommandPacket { _payload_, }
 packet VendorCommand : CommandPacket { _payload_, }
@@ -358,7 +584,7 @@
   DATA_BUFFER_OVERFLOW = 0x1A,
   MAX_SLOTS_CHANGE = 0x1B,
   READ_CLOCK_OFFSET_COMPLETE = 0x1C,
-  CONNECTION_PACKET_TYPE_CHANGE = 0x1D,
+  CONNECTION_PACKET_TYPE_CHANGED = 0x1D,
   QOS_VIOLATION = 0x1E,
   PAGE_SCAN_REPETITION_MODE_CHANGE = 0x20,
   FLOW_SPECIFICATION_COMPLETE = 0x21,
@@ -382,6 +608,7 @@
   REMOTE_HOST_SUPPORTED_FEATURES_NOTIFICATION = 0x3D,
   LE_META_EVENT = 0x3e,
   NUMBER_OF_COMPLETED_DATA_BLOCKS = 0x48,
+  VENDOR_SPECIFIC = 0xFF,
 }
 
 packet EventPacket {
@@ -473,10 +700,19 @@
   _payload_,
 }
 
+  // Credits
+packet NoCommandComplete : CommandComplete (command_op_code = NONE){
+}
+
+struct Lap { // Lower Address Part
+  lap : 6,
+  _reserved_ : 2,
+  _fixed_ = 0x9e8b : 16,
+}
+
   // LINK_CONTROL
 packet Inquiry : DiscoveryCommand (op_code = INQUIRY) {
-  lap0 : 8, // 0x00 - 0x3F
-  _fixed_ = 0x9E8B : 16, // LAP upper bits are _fixed_
+  lap : Lap,
   inquiry_length : 8, // 0x1 - 0x30 (times 1.28s)
   num_responses : 8, // 0x00 unlimited
 }
@@ -492,7 +728,11 @@
 }
 
 packet PeriodicInquiryMode : DiscoveryCommand (op_code = PERIODIC_INQUIRY_MODE) {
-  _payload_,  // placeholder (unimplemented)
+  max_period_length : 16, // Range 0x0003 to 0xffff (times 1.28s)
+  min_period_length : 16, // Range 0x0002 to 0xfffe (times 1.28s)
+  lap : Lap,
+  inquiry_length : 8, // 0x1 - 0x30 (times 1.28s)
+  num_responses : 8, // 0x00 unlimited
 }
 
 packet PeriodicInquiryModeComplete : CommandComplete (command_op_code = PERIODIC_INQUIRY_MODE) {
@@ -592,8 +832,7 @@
 
 packet LinkKeyRequestReply : SecurityCommand (op_code = LINK_KEY_REQUEST_REPLY) {
   bd_addr : Address,
-  link_key_lo : 64,
-  link_key_hi : 64,
+  link_key : 8[16],
 }
 
 packet LinkKeyRequestReplyComplete : CommandComplete (command_op_code = LINK_KEY_REQUEST_REPLY) {
@@ -613,21 +852,7 @@
   bd_addr : Address,
   pin_code_length : 5, // 0x01 - 0x10
   _reserved_ : 3,
-  pin_code_1 : 8, // string parameter, first octet first
-  pin_code_2 : 8,
-  pin_code_3 : 8,
-  pin_code_4 : 8,
-  pin_code_5 : 8,
-  pin_code_6 : 8,
-  pin_code_7 : 8,
-  pin_code_8 : 8,
-  pin_code_9 : 8,
-  pin_code_10 : 8,
-  pin_code_11 : 8,
-  pin_code_12 : 8,
-  pin_code_13 : 8,
-  pin_code_14 : 8,
-  pin_code_15 : 8,
+  pin_code : 8[16], // string parameter, first octet first
 }
 
 packet PinCodeRequestReplyComplete : CommandComplete (command_op_code = PIN_CODE_REQUEST_REPLY) {
@@ -841,7 +1066,9 @@
 }
 
 packet RemoteOobDataRequestReply : SecurityCommand (op_code = REMOTE_OOB_DATA_REQUEST_REPLY) {
-  _payload_,  // placeholder (unimplemented)
+  bd_addr : Address,
+  c : 8[16],
+  r : 8[16],
 }
 
 packet RemoteOobDataRequestReplyComplete : CommandComplete (command_op_code = REMOTE_OOB_DATA_REQUEST_REPLY) {
@@ -879,53 +1106,163 @@
 
   // LINK_POLICY
 packet HoldMode : ConnectionManagementCommand (op_code = HOLD_MODE) {
-  _payload_,  // placeholder (unimplemented)
+  connection_handle : 12,
+  _reserved_ : 4,
+  hold_mode_max_interval: 16, // 0x0002-0xFFFE (1.25ms-40.9s)
+  hold_mode_min_interval: 16, // 0x0002-0xFFFE (1.25ms-40.9s)
 }
 
+packet HoldModeStatus : CommandStatus (command_op_code = HOLD_MODE) {
+}
+
+
 packet SniffMode : ConnectionManagementCommand (op_code = SNIFF_MODE) {
-  _payload_,  // placeholder (unimplemented)
+  connection_handle : 12,
+  _reserved_ : 4,
+  sniff_max_interval: 16, // 0x0002-0xFFFE (1.25ms-40.9s)
+  sniff_min_interval: 16, // 0x0002-0xFFFE (1.25ms-40.9s)
+  sniff_attempt: 16, // 0x0001-0x7FFF (1.25ms-40.9s)
+  sniff_timeout: 16, // 0x0000-0x7FFF (0ms-40.9s)
 }
 
+packet SniffModeStatus : CommandStatus (command_op_code = SNIFF_MODE) {
+}
+
+
 packet ExitSniffMode : ConnectionManagementCommand (op_code = EXIT_SNIFF_MODE) {
-  _payload_,  // placeholder (unimplemented)
+  connection_handle : 12,
+  _reserved_ : 4,
+}
+
+packet ExitSniffModeStatus : CommandStatus (command_op_code = EXIT_SNIFF_MODE) {
+}
+
+enum ServiceType : 8 {
+  NO_TRAFFIC = 0x00,
+  BEST_EFFORT = 0x01,
+  GUARANTEED = 0x02,
 }
 
 packet QosSetup : ConnectionManagementCommand (op_code = QOS_SETUP) {
-  _payload_,  // placeholder (unimplemented)
+  connection_handle : 12,
+  _reserved_ : 4,
+  _reserved_ : 8,
+  service_type : ServiceType,
+  token_rate : 32, // Octets/s
+  peak_bandwidth : 32, // Octets/s
+  latency : 32, // Octets/s
+  delay_variation : 32, // microseconds
+}
+
+packet QosSetupStatus : CommandStatus (command_op_code = QOS_SETUP) {
 }
 
 packet RoleDiscovery : ConnectionManagementCommand (op_code = ROLE_DISCOVERY) {
-  _payload_,  // placeholder (unimplemented)
+  connection_handle : 12,
+  _reserved_ : 4,
+}
+
+enum Role : 8 {
+  MASTER = 0x00,
+  SLAVE = 0x01,
+}
+
+packet RoleDiscoveryComplete : CommandComplete (command_op_code = ROLE_DISCOVERY) {
+  status : ErrorCode,
+  connection_handle : 12,
+  _reserved_ : 4,
+  current_role : Role,
 }
 
 packet SwitchRole : ConnectionManagementCommand (op_code = SWITCH_ROLE) {
-  _payload_,  // placeholder (unimplemented)
+  bd_addr : Address,
+  role : Role,
 }
 
+packet SwitchRoleStatus : CommandStatus (command_op_code = SWITCH_ROLE) {
+}
+
+
 packet ReadLinkPolicySettings : ConnectionManagementCommand (op_code = READ_LINK_POLICY_SETTINGS) {
-  _payload_,  // placeholder (unimplemented)
+  connection_handle : 12,
+  _reserved_ : 4,
+}
+
+enum LinkPolicy : 16 {
+  ENABLE_ROLE_SWITCH = 0x01,
+  ENABLE_HOLD_MODE = 0x02,
+  ENABLE_SNIFF_MODE = 0x04,
+  ENABLE_PARK_MODE = 0x08, // deprecated after 5.0
+}
+
+packet ReadLinkPolicySettingsComplete : CommandComplete (command_op_code = READ_LINK_POLICY_SETTINGS) {
+  status : ErrorCode,
+  connection_handle : 12,
+  _reserved_ : 4,
+  link_policy_settings : 16,
 }
 
 packet WriteLinkPolicySettings : ConnectionManagementCommand (op_code = WRITE_LINK_POLICY_SETTINGS) {
-  _payload_,  // placeholder (unimplemented)
+  connection_handle : 12,
+  _reserved_ : 4,
+  link_policy_settings : 16,
+}
+
+packet WriteLinkPolicySettingsComplete : CommandComplete (command_op_code = WRITE_LINK_POLICY_SETTINGS) {
+  status : ErrorCode,
+  connection_handle : 12,
+  _reserved_ : 4,
 }
 
 packet ReadDefaultLinkPolicySettings : ConnectionManagementCommand (op_code = READ_DEFAULT_LINK_POLICY_SETTINGS) {
-  _payload_,  // placeholder (unimplemented)
+}
+
+packet ReadDefaultLinkPolicySettingsComplete : CommandComplete (command_op_code = READ_DEFAULT_LINK_POLICY_SETTINGS) {
+  status : ErrorCode,
+  default_link_policy_settings : 16,
 }
 
 packet WriteDefaultLinkPolicySettings : ConnectionManagementCommand (op_code = WRITE_DEFAULT_LINK_POLICY_SETTINGS) {
-  _payload_,  // placeholder (unimplemented)
+  default_link_policy_settings : 16,
+}
+
+packet WriteDefaultLinkPolicySettingsComplete : CommandComplete (command_op_code = WRITE_DEFAULT_LINK_POLICY_SETTINGS) {
+  status : ErrorCode,
+}
+
+enum FlowDirection : 8 {
+  OUTGOING_FLOW = 0x00,
+  INCOMING_FLOW = 0x01,
 }
 
 packet FlowSpecification : ConnectionManagementCommand (op_code = FLOW_SPECIFICATION) {
-  _payload_,  // placeholder (unimplemented)
+  connection_handle : 12,
+  _reserved_ : 4,
+  _reserved_ : 8,
+  flow_direction : FlowDirection,
+  service_type : ServiceType,
+  token_rate : 32, // Octets/s
+  token_bucket_size : 32,
+  peak_bandwidth : 32, // Octets/s
+  access_latency : 32, // Octets/s
+}
+
+packet FlowSpecificationStatus : CommandStatus (command_op_code = FLOW_SPECIFICATION) {
 }
 
 packet SniffSubrating : ConnectionManagementCommand (op_code = SNIFF_SUBRATING) {
-  _payload_,  // placeholder (unimplemented)
+  connection_handle : 12,
+  _reserved_ : 4,
+  maximum_latency : 16,  // 0x0002-0xFFFE (1.25ms-40.9s)
+  minimum_remote_timeout : 16, // 0x0000-0xFFFE (0-40.9s)
+  minimum_local_timeout: 16, // 0x0000-0xFFFE (0-40.9s)
 }
 
+packet SniffSubratingComplete : CommandComplete (command_op_code = SNIFF_SUBRATING) {
+  status : ErrorCode,
+  connection_handle : 12,
+  _reserved_ : 4,
+}
 
   // CONTROLLER_AND_BASEBAND
 packet SetEventMask : CommandPacket (op_code = SET_EVENT_MASK) {
@@ -943,12 +1280,82 @@
   status : ErrorCode,
 }
 
+enum FilterType : 8 {
+  CLEAR_ALL_FILTERS = 0x00,
+  INQUIRY_RESULT = 0x01,
+  CONNECTION_SETUP = 0x02,
+}
+
 packet SetEventFilter : CommandPacket (op_code = SET_EVENT_FILTER) {
-  _payload_,  // placeholder (unimplemented)
+  filter_type : FilterType,
+  _body_,
+}
+
+packet SetEventFilterComplete : CommandComplete (command_op_code = SET_EVENT_FILTER) {
+  status : ErrorCode,
+}
+
+packet SetEventFilterClearAll : SetEventFilter (filter_type = CLEAR_ALL_FILTERS) {
+}
+
+enum FilterConditionType : 8 {
+  ALL_DEVICES = 0x00,
+  CLASS_OF_DEVICE = 0x01,
+  ADDRESS = 0x02,
+}
+
+packet SetEventFilterInquiryResult : SetEventFilter (filter_type = INQUIRY_RESULT) {
+  filter_condition_type : FilterConditionType,
+  _body_,
+}
+
+packet SetEventFilterInquiryResultAllDevices : SetEventFilterInquiryResult (filter_condition_type = ALL_DEVICES) {
+}
+
+packet SetEventFilterInquiryResultClassOfDevice : SetEventFilterInquiryResult (filter_condition_type = CLASS_OF_DEVICE) {
+  class_of_device : ClassOfDevice,
+  class_of_device_mask : ClassOfDevice,
+}
+
+packet SetEventFilterInquiryResultAddress : SetEventFilterInquiryResult (filter_condition_type = ADDRESS) {
+  address : Address,
+}
+
+packet SetEventFilterConnectionSetup : SetEventFilter (filter_type = CONNECTION_SETUP) {
+  filter_condition_type : FilterConditionType,
+  _body_,
+}
+
+enum AutoAcceptFlag : 8 {
+  AUTO_ACCEPT_OFF = 0x01,
+  AUTO_ACCEPT_ON_ROLE_SWITCH_DISABLED = 0x02,
+  AUTO_ACCEPT_ON_ROLE_SWITCH_ENABLED = 0x03,
+}
+
+packet SetEventFilterConnectionSetupAllDevices : SetEventFilterConnectionSetup (filter_condition_type = ALL_DEVICES) {
+  auto_accept_flag : AutoAcceptFlag,
+}
+
+packet SetEventFilterConnectionSetupClassOfDevice : SetEventFilterConnectionSetup (filter_condition_type = CLASS_OF_DEVICE) {
+  class_of_device : ClassOfDevice,
+  class_of_device_mask : ClassOfDevice,
+  auto_accept_flag : AutoAcceptFlag,
+}
+
+packet SetEventFilterConnectionSetupAddress : SetEventFilterConnectionSetup (filter_condition_type = ADDRESS) {
+  address : Address,
+  auto_accept_flag : AutoAcceptFlag,
 }
 
 packet Flush : ConnectionManagementCommand (op_code = FLUSH) {
-  _payload_,  // placeholder (unimplemented)
+  connection_handle : 12,
+  _reserved_ : 4,
+}
+
+packet FlushComplete : CommandComplete (command_op_code = FLUSH) {
+  status : ErrorCode,
+  connection_handle : 12,
+  _reserved_ : 4,
 }
 
 packet ReadPinType : CommandPacket (op_code = READ_PIN_TYPE) {
@@ -979,8 +1386,14 @@
   num_keys_read : 16,
 }
 
+struct KeyAndAddress {
+  address : Address,
+  link_key : 8[16],
+}
+
 packet WriteStoredLinkKey : SecurityCommand (op_code = WRITE_STORED_LINK_KEY) {
-  _payload_,
+  _count_(keys_to_write) : 8, // 0x01-0x0B
+  keys_to_write : KeyAndAddress[],
 }
 
 packet WriteStoredLinkKeyComplete : CommandComplete (command_op_code = WRITE_STORED_LINK_KEY) {
@@ -1004,7 +1417,7 @@
 }
 
 packet WriteLocalName : CommandPacket (op_code = WRITE_LOCAL_NAME) {
-  _payload_,
+  local_name : 8[248], // Null-terminated UTF-8 encoded name
 }
 
 packet WriteLocalNameComplete : CommandComplete (command_op_code = WRITE_LOCAL_NAME) {
@@ -1016,7 +1429,7 @@
 
 packet ReadLocalNameComplete : CommandComplete (command_op_code = READ_LOCAL_NAME) {
   status : ErrorCode,
-  _payload_,
+  local_name : 8[248], // Null-terminated UTF-8 encoded name
 }
 
 packet ReadConnectionAcceptTimeout : ConnectionManagementCommand (op_code = READ_CONNECTION_ACCEPT_TIMEOUT) {
@@ -1028,11 +1441,19 @@
 }
 
 packet ReadPageTimeout : DiscoveryCommand (op_code = READ_PAGE_TIMEOUT) {
-  _payload_,  // placeholder (unimplemented)
+}
+
+packet ReadPageTimeoutComplete : CommandComplete (command_op_code = READ_PAGE_TIMEOUT) {
+  status : ErrorCode,
+  page_timeout : 16,
 }
 
 packet WritePageTimeout : DiscoveryCommand (op_code = WRITE_PAGE_TIMEOUT) {
-  _payload_,  // placeholder (unimplemented)
+  page_timeout : 16,
+}
+
+packet WritePageTimeoutComplete : CommandComplete (command_op_code = WRITE_PAGE_TIMEOUT) {
+  status : ErrorCode,
 }
 
 enum ScanEnable : 8 {
@@ -1077,11 +1498,21 @@
 }
 
 packet ReadInquiryScanActivity : DiscoveryCommand (op_code = READ_INQUIRY_SCAN_ACTIVITY) {
-  _payload_,  // placeholder (unimplemented)
+}
+
+packet ReadInquiryScanActivityComplete : CommandComplete (command_op_code = READ_INQUIRY_SCAN_ACTIVITY) {
+  status : ErrorCode,
+  inquiry_scan_interval : 16, // Range: 0x0012 to 0x1000; only even values are valid * 0x625 ms
+  inquiry_scan_window : 16, // Range: 0x0011 to 0x1000
 }
 
 packet WriteInquiryScanActivity : DiscoveryCommand (op_code = WRITE_INQUIRY_SCAN_ACTIVITY) {
-  _payload_,  // placeholder (unimplemented)
+  inquiry_scan_interval : 16, // Range: 0x0012 to 0x1000; only even values are valid * 0x625 ms
+  inquiry_scan_window : 16, // Range: 0x0011 to 0x1000
+}
+
+packet WriteInquiryScanActivityComplete : CommandComplete (command_op_code = WRITE_INQUIRY_SCAN_ACTIVITY) {
+  status : ErrorCode,
 }
 
 enum AuthenticationEnable : 8 {
@@ -1130,11 +1561,27 @@
 }
 
 packet ReadAutomaticFlushTimeout : ConnectionManagementCommand (op_code = READ_AUTOMATIC_FLUSH_TIMEOUT) {
-  _payload_,  // placeholder (unimplemented)
+  connection_handle : 12,
+  _reserved_ : 4,
+}
+
+packet ReadAutomaticFlushTimeoutComplete : CommandComplete (command_op_code = READ_AUTOMATIC_FLUSH_TIMEOUT) {
+  status : ErrorCode,
+  connection_handle : 12,
+  _reserved_ : 4,
+  flush_timeout : 16,
 }
 
 packet WriteAutomaticFlushTimeout : ConnectionManagementCommand (op_code = WRITE_AUTOMATIC_FLUSH_TIMEOUT) {
-  _payload_,  // placeholder (unimplemented)
+  connection_handle : 12,
+  _reserved_ : 4,
+  flush_timeout : 16, // 0x0000-0x07FF Default 0x0000 (No Automatic Flush)
+}
+
+packet WriteAutomaticFlushTimeoutComplete : CommandComplete (command_op_code = WRITE_AUTOMATIC_FLUSH_TIMEOUT) {
+  status : ErrorCode,
+  connection_handle : 12,
+  _reserved_ : 4,
 }
 
 packet ReadNumBroadcastRetransmits : CommandPacket (op_code = READ_NUM_BROADCAST_RETRANSMITS) {
@@ -1153,8 +1600,24 @@
   _payload_,  // placeholder (unimplemented)
 }
 
+
+enum TransmitPowerLevelType : 8 {
+  CURRENT = 0x00,
+  MAXIMUM = 0x01,
+}
+
 packet ReadTransmitPowerLevel : ConnectionManagementCommand (op_code = READ_TRANSMIT_POWER_LEVEL) {
-  _payload_,  // placeholder (unimplemented)
+  connection_handle : 12,
+  _reserved_ : 4,
+  type : TransmitPowerLevelType,
+
+}
+
+packet ReadTransmitPowerLevelComplete : CommandComplete (command_op_code = READ_TRANSMIT_POWER_LEVEL) {
+  status : ErrorCode,
+  connection_handle : 12,
+  _reserved_ : 4,
+  transmit_power_level : 8,
 }
 
 packet ReadSynchronousFlowControlEnable : CommandPacket (op_code = READ_SYNCHRONOUS_FLOW_CONTROL_ENABLE) {
@@ -1180,8 +1643,15 @@
   status : ErrorCode,
 }
 
+struct CompletedPackets {
+  connection_handle : 12,
+  _reserved_ : 4,
+  host_num_of_completed_packets : 16,
+}
+
 packet HostNumCompletedPackets : CommandPacket (op_code = HOST_NUM_COMPLETED_PACKETS) {
-  _payload_,
+  _count_(completed_packets) : 8,
+  completed_packets : CompletedPackets[],
 }
 
 packet HostNumCompletedPacketsError : CommandComplete (command_op_code = HOST_NUM_COMPLETED_PACKETS) {
@@ -1195,7 +1665,7 @@
 
 packet ReadLinkSupervisionTimeoutComplete : CommandComplete (command_op_code = READ_LINK_SUPERVISION_TIMEOUT) {
   status : ErrorCode,
-  handle : 12,
+  connection_handle : 12,
   _reserved_ : 4,
   link_supervision_timeout : 16, // 0x001-0xFFFF (0.625ms-40.9s)
 }
@@ -1208,20 +1678,34 @@
 
 packet WriteLinkSupervisionTimeoutComplete : CommandComplete (command_op_code = WRITE_LINK_SUPERVISION_TIMEOUT) {
   status : ErrorCode,
-  handle : 12,
+  connection_handle : 12,
   _reserved_ : 4,
 }
 
 packet ReadNumberOfSupportedIac : DiscoveryCommand (op_code = READ_NUMBER_OF_SUPPORTED_IAC) {
-  _payload_,  // placeholder (unimplemented)
+}
+
+packet ReadNumberOfSupportedIacComplete : CommandComplete (command_op_code = READ_NUMBER_OF_SUPPORTED_IAC) {
+  status : ErrorCode,
+  num_support_iac : 8,
 }
 
 packet ReadCurrentIacLap : DiscoveryCommand (op_code = READ_CURRENT_IAC_LAP) {
-  _payload_,  // placeholder (unimplemented)
+}
+
+packet ReadCurrentIacLapComplete : CommandComplete (command_op_code = READ_CURRENT_IAC_LAP) {
+  status : ErrorCode,
+  _count_(laps_to_read) : 8,
+  laps_to_read : Lap[],
 }
 
 packet WriteCurrentIacLap : DiscoveryCommand (op_code = WRITE_CURRENT_IAC_LAP) {
-  _payload_,  // placeholder (unimplemented)
+  _count_(laps_to_write) : 8,
+  laps_to_write : Lap[],
+}
+
+packet WriteCurrentIacLapComplete : CommandComplete (command_op_code = WRITE_CURRENT_IAC_LAP) {
+  status : ErrorCode,
 }
 
 packet SetAfhHostChannelClassification : CommandPacket (op_code = SET_AFH_HOST_CHANNEL_CLASSIFICATION) {
@@ -1311,12 +1795,13 @@
 packet ReadExtendedInquiryResponseComplete : CommandComplete (command_op_code = READ_EXTENDED_INQUIRY_RESPONSE) {
   status : ErrorCode,
   fec_required : FecRequired,
-  _payload_,
+  extended_inquiry_response : GapData[],
 }
 
 packet WriteExtendedInquiryResponse : CommandPacket (op_code = WRITE_EXTENDED_INQUIRY_RESPONSE) {
   fec_required : FecRequired,
-  _payload_,
+  extended_inquiry_response : GapData[],
+  _padding_[244], // Zero padding to be 240 octets (GapData[]) + 2 (opcode) + 1 (size) + 1 (FecRequired)
 }
 
 packet WriteExtendedInquiryResponseComplete : CommandComplete (command_op_code = WRITE_EXTENDED_INQUIRY_RESPONSE) {
@@ -1352,10 +1837,8 @@
 
 packet ReadLocalOobDataComplete : CommandComplete (command_op_code = READ_LOCAL_OOB_DATA) {
   status : ErrorCode,
-  clo : 64,
-  chi : 64,
-  rlo : 64,
-  rhi : 64,
+  c : 8[16],
+  r : 8[16],
 }
 
 packet ReadInquiryResponseTransmitPowerLevel : DiscoveryCommand (op_code = READ_INQUIRY_RESPONSE_TRANSMIT_POWER_LEVEL) {
@@ -1430,26 +1913,109 @@
   status : ErrorCode,
 }
 
+packet ReadLocalOobExtendedData : SecurityCommand (op_code = READ_LOCAL_OOB_EXTENDED_DATA) {
+}
+
+packet ReadLocalOobExtendedDataComplete : CommandComplete (command_op_code = READ_LOCAL_OOB_EXTENDED_DATA) {
+  status : ErrorCode,
+  c_192 : 8[16],
+  r_192 : 8[16],
+  c_256 : 8[16],
+  r_256 : 8[16],
+}
+
+
   // INFORMATIONAL_PARAMETERS
 packet ReadLocalVersionInformation : CommandPacket (op_code = READ_LOCAL_VERSION_INFORMATION) {
 }
 
+enum HciVersion : 8 {
+  V_1_0B = 0x00,
+  V_1_1 = 0x01,
+  V_1_2 = 0x02,
+  V_2_0 = 0x03, //  + EDR
+  V_2_1 = 0x04, //  + EDR
+  V_3_0 = 0x05, //  + HS
+  V_4_0 = 0x06,
+  V_4_1 = 0x07,
+  V_4_2 = 0x08,
+  V_5_0 = 0x09,
+  V_5_1 = 0x0a,
+}
+
+enum LmpVersion : 8 {
+  V_1_0B = 0x00, // withdrawn
+  V_1_1 = 0x01, // withdrawn
+  V_1_2 = 0x02, // withdrawn
+  V_2_0 = 0x03, //  + EDR
+  V_2_1 = 0x04, //  + EDR
+  V_3_0 = 0x05, //  + HS
+  V_4_0 = 0x06,
+  V_4_1 = 0x07,
+  V_4_2 = 0x08,
+  V_5_0 = 0x09,
+  V_5_1 = 0x0a,
+}
+
+struct LocalVersionInformation {
+  hci_version : HciVersion,
+  hci_revision : 16,
+  lmp_version : LmpVersion,
+  manufacturer_name : 16,
+  lmp_subversion : 16,
+}
+
+packet ReadLocalVersionInformationComplete : CommandComplete (command_op_code = READ_LOCAL_VERSION_INFORMATION) {
+  status : ErrorCode,
+  local_version_information : LocalVersionInformation,
+}
+
 packet ReadLocalSupportedCommands : CommandPacket (op_code = READ_LOCAL_SUPPORTED_COMMANDS) {
 }
 
+packet ReadLocalSupportedCommandsComplete : CommandComplete (command_op_code = READ_LOCAL_SUPPORTED_COMMANDS) {
+  status : ErrorCode,
+  supported_commands : 8[64],
+}
+
 packet ReadLocalSupportedFeatures : CommandPacket (op_code = READ_LOCAL_SUPPORTED_FEATURES) {
 }
 
+packet ReadLocalSupportedFeaturesComplete : CommandComplete (command_op_code = READ_LOCAL_SUPPORTED_FEATURES) {
+  status : ErrorCode,
+  lmp_features : 64,
+}
+
 packet ReadLocalExtendedFeatures : CommandPacket (op_code = READ_LOCAL_EXTENDED_FEATURES) {
   page_number : 8,
 }
 
+packet ReadLocalExtendedFeaturesComplete : CommandComplete (command_op_code = READ_LOCAL_EXTENDED_FEATURES) {
+  status : ErrorCode,
+  page_number : 8,
+  maximum_page_number : 8,
+  extended_lmp_features : 64,
+}
+
 packet ReadBufferSize : CommandPacket (op_code = READ_BUFFER_SIZE) {
 }
 
+packet ReadBufferSizeComplete : CommandComplete (command_op_code = READ_BUFFER_SIZE) {
+  status : ErrorCode,
+  acl_data_packet_length : 16,
+  synchronous_data_packet_length : 8,
+  total_num_acl_data_packets : 16,
+  total_num_synchronous_data_packets : 16,
+}
+
 packet ReadBdAddr : CommandPacket (op_code = READ_BD_ADDR) {
 }
 
+packet ReadBdAddrComplete : CommandComplete (command_op_code = READ_BD_ADDR) {
+  status : ErrorCode,
+  bd_addr : Address,
+}
+
 packet ReadDataBlockSize : CommandPacket (op_code = READ_DATA_BLOCK_SIZE) {
 }
 
@@ -1459,23 +2025,50 @@
 
   // STATUS_PARAMETERS
 packet ReadFailedContactCounter : ConnectionManagementCommand (op_code = READ_FAILED_CONTACT_COUNTER) {
-  handle : 12,
+  connection_handle : 12,
   _reserved_ : 4,
 }
 
+packet ReadFailedContactCounterComplete : CommandComplete (command_op_code = READ_FAILED_CONTACT_COUNTER) {
+  status : ErrorCode,
+  connection_handle : 12,
+  _reserved_ : 4,
+  failed_contact_counter : 16,
+}
+
 packet ResetFailedContactCounter : ConnectionManagementCommand (op_code = RESET_FAILED_CONTACT_COUNTER) {
-  handle : 12,
+  connection_handle : 12,
+  _reserved_ : 4,
+}
+
+packet ResetFailedContactCounterComplete : CommandComplete (command_op_code = RESET_FAILED_CONTACT_COUNTER) {
+  status : ErrorCode,
+  connection_handle : 12,
   _reserved_ : 4,
 }
 
 packet ReadLinkQuality : ConnectionManagementCommand (op_code = READ_LINK_QUALITY) {
-  handle : 12,
+  connection_handle : 12,
   _reserved_ : 4,
 }
 
-packet ReadRssi : ConnectionManagementCommand (op_code = READ_RSSI) {
-  handle : 12,
+packet ReadLinkQualityComplete : CommandComplete (command_op_code = READ_LINK_QUALITY) {
+  status : ErrorCode,
+  connection_handle : 12,
   _reserved_ : 4,
+  link_quality : 8,
+}
+
+packet ReadRssi : ConnectionManagementCommand (op_code = READ_RSSI) {
+  connection_handle : 12,
+  _reserved_ : 4,
+}
+
+packet ReadRssiComplete : CommandComplete (command_op_code = READ_RSSI) {
+  status : ErrorCode,
+  connection_handle : 12,
+  _reserved_ : 4,
+  rssi : 8,
 }
 
 packet ReadAfhChannelMap : ConnectionManagementCommand (op_code = READ_AFH_CHANNEL_MAP) {
@@ -1483,6 +2076,20 @@
   _reserved_ : 4,
 }
 
+enum AfhMode : 8 {
+  AFH_DISABLED = 0x00,
+  AFH_ENABLED = 0x01,
+}
+
+packet ReadAfhChannelMapComplete : CommandComplete (command_op_code = READ_AFH_CHANNEL_MAP) {
+  status : ErrorCode,
+  connection_handle : 12,
+  _reserved_ : 4,
+  afh_mode : AfhMode,
+  afh_channel_map : 8[10],
+}
+
+
 enum WhichClock : 8 {
   LOCAL = 0x00,
   PICONET = 0x01,
@@ -1494,6 +2101,15 @@
   which_clock : WhichClock,
 }
 
+packet ReadClockComplete : CommandComplete (command_op_code = READ_CLOCK) {
+  status : ErrorCode,
+  connection_handle : 12,
+  _reserved_ : 4,
+  clock : 28,
+  _reserved_ : 4,
+  accuracy : 16,
+}
+
 packet ReadEncryptionKeySize : SecurityCommand (op_code = READ_ENCRYPTION_KEY_SIZE) {
   connection_handle : 12,
   _reserved_ : 4,
@@ -1561,10 +2177,14 @@
 packet LeReadBufferSize : CommandPacket (op_code = LE_READ_BUFFER_SIZE) {
 }
 
+struct LeBufferSize {
+  le_data_packet_length : 16,
+  total_num_le_packets : 8,
+}
+
 packet LeReadBufferSizeComplete : CommandComplete (command_op_code = LE_READ_BUFFER_SIZE) {
   status : ErrorCode,
-  hc_le_data_packet_length : 16,
-  hc_total_num_le_packets : 8,
+  le_buffer_size : LeBufferSize,
 }
 
 packet LeReadLocalSupportedFeatures : CommandPacket (op_code = LE_READ_LOCAL_SUPPORTED_FEATURES) {
@@ -1575,7 +2195,7 @@
   le_features : 64,
 }
 
-packet LeSetRandomAddress : CommandPacket (op_code = LE_SET_RANDOM_ADDRESS) {
+packet LeSetRandomAddress : LeAdvertisingCommand (op_code = LE_SET_RANDOM_ADDRESS) {
   random_address : Address,
 }
 
@@ -1583,9 +2203,11 @@
   status : ErrorCode,
 }
 
-enum AdvertisingFilterPolicy : 1 {
+enum AdvertisingFilterPolicy : 2 {
   ALL_DEVICES = 0, // Default
-  ONLY_WHITE_LISTED_DEVICES = 1,
+  WHITELISTED_SCAN = 1,
+  WHITELISTED_CONNECT = 2,
+  WHITELISTED_SCAN_AND_CONNECT = 3,
 }
 
 enum PeerAddressType : 8 {
@@ -1598,7 +2220,7 @@
   ADV_DIRECT_IND = 0x01,
   ADV_SCAN_IND = 0x02,
   ADV_NONCONN_IND = 0x03,
-  SCAN_RSP = 0x04,
+  ADV_DIRECT_IND_LOW = 0x04,
 }
 
 enum AddressType : 8 {
@@ -1609,15 +2231,14 @@
 }
 
 packet LeSetAdvertisingParameters : LeAdvertisingCommand (op_code = LE_SET_ADVERTISING_PARAMETERS) {
-  advertising_interval_min : 16,
-  advertising_interval_max : 16,
-  advertising_type : AdvertisingEventType,
+  interval_min : 16,
+  interval_max : 16,
+  type : AdvertisingEventType,
   own_address_type : AddressType,
   peer_address_type : PeerAddressType,
   peer_address : Address,
-  advertising_channel_map : 8,
-  connection_filter_policy : AdvertisingFilterPolicy,
-  scan_filter_policy : AdvertisingFilterPolicy,
+  channel_map : 8,
+  filter_policy : AdvertisingFilterPolicy,
   _reserved_ : 6,
 }
 
@@ -1634,7 +2255,9 @@
 }
 
 packet LeSetAdvertisingData : LeAdvertisingCommand (op_code = LE_SET_ADVERTISING_DATA) {
-  _payload_,
+  _size_(advertising_data) : 8,
+  advertising_data : GapData[],
+  _padding_[31], // Zero padding to 31 bytes of advertising_data
 }
 
 packet LeSetAdvertisingDataComplete : CommandComplete (command_op_code = LE_SET_ADVERTISING_DATA) {
@@ -1642,7 +2265,9 @@
 }
 
 packet LeSetScanResponseData : LeAdvertisingCommand (op_code = LE_SET_SCAN_RESPONSE_DATA) {
-  _payload_,
+  _size_(advertising_data) : 8,
+  advertising_data : GapData[],
+  _padding_[31], // Zero padding to 31 bytes of advertising_data
 }
 
 packet LeSetScanResponseDataComplete : CommandComplete (command_op_code = LE_SET_SCAN_RESPONSE_DATA) {
@@ -1669,7 +2294,7 @@
   WHITE_LIST_AND_INITIATORS_IDENTITY = 0x03,
 }
 
-packet LeSetScanParameters : LeAdvertisingCommand (op_code = LE_SET_SCAN_PARAMETERS) {
+packet LeSetScanParameters : LeScanningCommand (op_code = LE_SET_SCAN_PARAMETERS) {
   le_scan_type : LeScanType,
   le_scan_interval : 16, // 0x0004-0x4000 Default 0x10 (10ms)
   le_scan_window : 16, // Default 0x10 (10ms)
@@ -1681,7 +2306,7 @@
   status : ErrorCode,
 }
 
-packet LeSetScanEnable : LeAdvertisingCommand (op_code = LE_SET_SCAN_ENABLE) {
+packet LeSetScanEnable : LeScanningCommand (op_code = LE_SET_SCAN_ENABLE) {
   le_scan_enable : Enable,
   filter_duplicates : Enable,
 }
@@ -1797,15 +2422,23 @@
 }
 
 packet LeRand : LeSecurityCommand (op_code = LE_RAND) {
-  _payload_,  // placeholder (unimplemented)
+}
+
+packet LeRandComplete : CommandComplete (command_op_code = LE_RAND) {
+  status : ErrorCode,
+  random_number : 64,
 }
 
 packet LeStartEncryption : LeSecurityCommand (op_code = LE_START_ENCRYPTION) {
-  _payload_,  // placeholder (unimplemented)
+  connection_handle: 16,
+  rand: 8[8],
+  ediv: 16,
+  ltk: 8[16],
 }
 
 packet LeLongTermKeyRequestReply : LeSecurityCommand (op_code = LE_LONG_TERM_KEY_REQUEST_REPLY) {
-  _payload_,  // placeholder (unimplemented)
+  connection_handle: 16,
+  long_term_key: 8[16],
 }
 
 packet LeLongTermKeyRequestNegativeReply : LeSecurityCommand (op_code = LE_LONG_TERM_KEY_REQUEST_NEGATIVE_REPLY) {
@@ -1813,7 +2446,11 @@
 }
 
 packet LeReadSupportedStates : CommandPacket (op_code = LE_READ_SUPPORTED_STATES) {
-  _payload_,  // placeholder (unimplemented)
+}
+
+packet LeReadSupportedStatesComplete : CommandComplete (command_op_code = LE_READ_SUPPORTED_STATES) {
+  status : ErrorCode,
+  le_states : 64,
 }
 
 packet LeReceiverTest : CommandPacket (op_code = LE_RECEIVER_TEST) {
@@ -1890,7 +2527,19 @@
 }
 
 packet LeReadMaximumDataLength : CommandPacket (op_code = LE_READ_MAXIMUM_DATA_LENGTH) {
-  _payload_,  // placeholder (unimplemented)
+}
+
+struct LeMaximumDataLength {
+  supported_max_tx_octets : 16,
+  supported_max_tx_time: 16,
+  supported_max_rx_octets : 16,
+  supported_max_rx_time: 16,
+}
+
+
+packet LeReadMaximumDataLengthComplete : CommandComplete (command_op_code = LE_READ_MAXIMUM_DATA_LENGTH) {
+  status : ErrorCode,
+  le_maximum_data_length : LeMaximumDataLength,
 }
 
 packet LeReadPhy : LeConnectionManagementCommand (op_code = LE_READ_PHY) {
@@ -1934,11 +2583,19 @@
 }
 
 packet LeReadMaximumAdvertisingDataLength : CommandPacket (op_code = LE_READ_MAXIMUM_ADVERTISING_DATA_LENGTH) {
-  _payload_,  // placeholder (unimplemented)
+}
+
+packet LeReadMaximumAdvertisingDataLengthComplete : CommandComplete (command_op_code = LE_READ_MAXIMUM_ADVERTISING_DATA_LENGTH) {
+  status : ErrorCode,
+  maximum_advertising_data_length : 16,
 }
 
 packet LeReadNumberOfSupportedAdvertisingSets : CommandPacket (op_code = LE_READ_NUMBER_OF_SUPPORTED_ADVERTISING_SETS) {
-  _payload_,  // placeholder (unimplemented)
+}
+
+packet LeReadNumberOfSupportedAdvertisingSetsComplete : CommandComplete (command_op_code = LE_READ_NUMBER_OF_SUPPORTED_ADVERTISING_SETS) {
+  status : ErrorCode,
+  number_supported_advertising_sets : 8,
 }
 
 packet LeRemoveAdvertisingSet : LeAdvertisingCommand (op_code = LE_REMOVE_ADVERTISING_SET) {
@@ -1961,12 +2618,33 @@
   _payload_,  // placeholder (unimplemented)
 }
 
-packet LeSetExtendedScanParameters : LeAdvertisingCommand (op_code = LE_SET_EXTENDED_SCAN_PARAMETERS) {
-  _payload_,  // placeholder (unimplemented)
+packet LeSetExtendedScanParameters : LeScanningCommand (op_code = LE_SET_EXTENDED_SCAN_PARAMETERS) {
+  le_scan_type : LeScanType,
+  le_scan_interval : 32, // 0x0004-0x00FFFFFF Default 0x10 (10ms)
+  le_scan_window : 32, // 0x004-0xFFFF Default 0x10 (10ms)
+  own_address_type : AddressType,
+  scanning_filter_policy : LeSetScanningFilterPolicy,
 }
 
-packet LeSetExtendedScanEnable : LeAdvertisingCommand (op_code = LE_SET_EXTENDED_SCAN_ENABLE) {
-  _payload_,  // placeholder (unimplemented)
+packet LeSetExtendedScanParametersComplete : CommandComplete (command_op_code = LE_SET_EXTENDED_SCAN_PARAMETERS) {
+  status : ErrorCode,
+}
+
+enum FilterDuplicates : 8 {
+  DISABLED = 0,
+  ENABLED = 1,
+  RESET_EACH_PERIOD = 2,
+}
+
+packet LeSetExtendedScanEnable : LeScanningCommand (op_code = LE_SET_EXTENDED_SCAN_ENABLE) {
+  enable : Enable,
+  filter_duplicates : FilterDuplicates,
+  duration : 16, // 0 - Scan continuously,  N * 10 ms
+  period : 16, // 0 - Scan continuously,  N * 1.28 sec
+}
+
+packet LeSetExtendedScanEnableComplete : CommandComplete (command_op_code = LE_SET_EXTENDED_SCAN_ENABLE) {
+  status : ErrorCode,
 }
 
 packet LeExtendedCreateConnection : LeConnectionManagementCommand (op_code = LE_EXTENDED_CREATE_CONNECTION) {
@@ -2020,19 +2698,152 @@
 
   // VENDOR_SPECIFIC
 packet LeGetVendorCapabilities : VendorCommand (op_code = LE_GET_VENDOR_CAPABILITIES) {
-  _payload_,  // placeholder (unimplemented)
 }
 
-packet LeMultiAdvt : VendorCommand (op_code = LE_MULTI_ADVT) {
-  _payload_,  // placeholder (unimplemented)
+struct VendorCapabilities {
+  is_supported : 8,
+  max_advt_instances: 8,
+  offloaded_resolution_of_private_address : 8,
+  total_scan_results_storage: 16,
+  max_irk_list_sz: 8,
+  filtering_support: 8,
+  max_filter: 8,
+  activity_energy_info_support: 8,
+  version_supported: 16,
+  total_num_of_advt_tracked: 16,
+  extended_scan_support: 8,
+  debug_logging_supported: 8,
+  le_address_generation_offloading_support: 8,
+  a2dp_source_offload_capability_mask: 32,
+  bluetooth_quality_report_support: 8
+}
+
+struct BaseVendorCapabilities {
+  max_advt_instances: 8,
+  offloaded_resolution_of_private_address : 8,
+  total_scan_results_storage: 16,
+  max_irk_list_sz: 8,
+  filtering_support: 8,
+  max_filter: 8,
+  activity_energy_info_support: 8,
+}
+
+packet LeGetVendorCapabilitiesComplete : CommandComplete (command_op_code = LE_GET_VENDOR_CAPABILITIES) {
+  status : ErrorCode,
+  base_vendor_capabilities : BaseVendorCapabilities,
+  _payload_,
+}
+packet LeGetVendorCapabilitiesComplete095 : LeGetVendorCapabilitiesComplete {
+  version_supported: 16,
+  total_num_of_advt_tracked: 16,
+  extended_scan_support: 8,
+  debug_logging_supported: 8,
+  _payload_,
+}
+packet LeGetVendorCapabilitiesComplete096 : LeGetVendorCapabilitiesComplete095 {
+  le_address_generation_offloading_support: 8,
+  _payload_,
+}
+
+packet LeGetVendorCapabilitiesComplete098 : LeGetVendorCapabilitiesComplete096 {
+  a2dp_source_offload_capability_mask: 32,
+  bluetooth_quality_report_support: 8
+}
+
+enum SubOcf : 8 {
+  SET_PARAM = 0x01,
+  SET_DATA = 0x02,
+  SET_SCAN_RESP = 0x03,
+  SET_RANDOM_ADDR = 0x04,
+  SET_ENABLE = 0x05,
+}
+
+packet LeMultiAdvt : LeAdvertisingCommand (op_code = LE_MULTI_ADVT) {
+  sub_cmd : SubOcf,
+  _body_,
+}
+
+packet LeMultiAdvtComplete : CommandComplete (command_op_code = LE_MULTI_ADVT) {
+  status : ErrorCode,
+  sub_cmd : SubOcf,
+}
+
+packet LeMultiAdvtParam : LeMultiAdvt (sub_cmd = SET_PARAM) {
+  interval_min : 16,
+  interval_max : 16,
+  type : AdvertisingEventType,
+  own_address_type : AddressType,
+  peer_address_type : PeerAddressType,
+  peer_address : Address,
+  channel_map : 8,
+  filter_policy : AdvertisingFilterPolicy,
+  _reserved_ : 6,
+  instance : 8,
+  tx_power : 8,
+}
+
+packet LeMultiAdvtParamComplete : LeMultiAdvtComplete (sub_cmd = SET_PARAM) {
+}
+
+packet LeMultiAdvtSetData : LeMultiAdvt (sub_cmd = SET_DATA) {
+  _size_(advertising_data) : 8,
+  advertising_data : GapData[],
+  _padding_[31], // Zero padding to 31 bytes of advertising_data
+  advertising_instance : 8,
+}
+
+packet LeMultiAdvtSetDataComplete : LeMultiAdvtComplete (sub_cmd = SET_DATA) {
+}
+
+packet LeMultiAdvtSetScanResp : LeMultiAdvt (sub_cmd = SET_SCAN_RESP) {
+  _size_(advertising_data) : 8,
+  advertising_data : GapData[],
+  _padding_[31], // Zero padding to 31 bytes of advertising_data
+  advertising_instance : 8,
+}
+
+packet LeMultiAdvtSetScanRespComplete : LeMultiAdvtComplete (sub_cmd = SET_SCAN_RESP) {
+}
+
+packet LeMultiAdvtSetRandomAddr : LeMultiAdvt (sub_cmd = SET_RANDOM_ADDR) {
+  random_address : Address,
+  advertising_instance : 8,
+}
+
+packet LeMultiAdvtSetRandomAddrComplete : LeMultiAdvtComplete (sub_cmd = SET_RANDOM_ADDR) {
+}
+
+packet LeMultiAdvtSetEnable : LeMultiAdvt (sub_cmd = SET_ENABLE) {
+  advertising_enable : Enable, // Default DISABLED
+  advertising_instance : 8,
+}
+
+packet LeMultiAdvtSetEnableComplete : LeMultiAdvtComplete (sub_cmd = SET_ENABLE) {
 }
 
 packet LeBatchScan : VendorCommand (op_code = LE_BATCH_SCAN) {
   _payload_,  // placeholder (unimplemented)
 }
 
+enum ApcfOpcode : 8 {
+  ENABLE = 0x00,
+  SET_FILTERING_PARAMETERS = 0x01,
+  BROADCASTER_ADDRESS = 0x02,
+  SERVICE_UUID = 0x03,
+  SERVICE_SOLICITATION_UUID = 0x04,
+  LOCAL_NAME = 0x05,
+  MANUFACTURER_DATA = 0x06,
+  SERVICE_DATA = 0x07,
+}
+
 packet LeAdvFilter : VendorCommand (op_code = LE_ADV_FILTER) {
-  _payload_,  // placeholder (unimplemented)
+  apcf_opcode : ApcfOpcode,
+  _body_,
+}
+
+packet LeAdvFilterComplete : CommandComplete (command_op_code = LE_ADV_FILTER) {
+  status : ErrorCode,
+  apcf_opcode : ApcfOpcode,
 }
 
 packet LeTrackAdv : VendorCommand (op_code = LE_TRACK_ADV) {
@@ -2043,8 +2854,16 @@
   _payload_,  // placeholder (unimplemented)
 }
 
-packet LeExtendedScanParams : VendorCommand (op_code = LE_EXTENDED_SCAN_PARAMS) {
-  _payload_,  // placeholder (unimplemented)
+packet LeExtendedScanParams : LeScanningCommand (op_code = LE_EXTENDED_SCAN_PARAMS) {
+  le_scan_type : LeScanType,
+  le_scan_interval : 32, // 0x0004-0x4000 Default 0x10 (10ms)
+  le_scan_window : 32, // Default 0x10 (10ms)
+  own_address_type : AddressType,
+  scanning_filter_policy : LeSetScanningFilterPolicy,
+}
+
+packet LeExtendedScanParamsComplete : CommandComplete (command_op_code = LE_EXTENDED_SCAN_PARAMS) {
+  status : ErrorCode,
 }
 
 packet ControllerDebugInfo : VendorCommand (op_code = CONTROLLER_DEBUG_INFO) {
@@ -2114,7 +2933,7 @@
 packet RemoteNameRequestComplete : EventPacket (event_code = REMOTE_NAME_REQUEST_COMPLETE){
   status : ErrorCode,
   bd_addr : Address,
-  _payload_,
+  remote_name : 8[248], // UTF-8 encoded user-friendly descriptive name
 }
 
 enum EncryptionEnabled : 8 {
@@ -2159,12 +2978,6 @@
   sub_version : 8,
 }
 
-enum ServiceType : 8 {
-  NO_TRAFFIC = 0x00,
-  BEST_EFFORT = 0x01,
-  GUARANTEED = 0x02,
-}
-
 packet QosSetupComplete : EventPacket (event_code = QOS_SETUP_COMPLETE){
   status : ErrorCode,
   connection_handle : 12,
@@ -2188,11 +3001,6 @@
   _reserved_ : 4,
 }
 
-enum Role : 8 {
-  MASTER = 0x00,
-  SLAVE = 0x01,
-}
-
 packet RoleChange : EventPacket (event_code = ROLE_CHANGE){
   status : ErrorCode,
   bd_addr : Address,
@@ -2200,7 +3008,8 @@
 }
 
 packet NumberOfCompletedPackets : EventPacket (event_code = NUMBER_OF_COMPLETED_PACKETS){
-  _payload_,
+  _count_(completed_packets) : 8,
+  completed_packets : CompletedPackets[],
 }
 
 enum Mode : 8 {
@@ -2255,7 +3064,7 @@
   _reserved_ : 1,
 }
 
-packet ConnectionPacketTypeChange : EventPacket (event_code = CONNECTION_PACKET_TYPE_CHANGE){
+packet ConnectionPacketTypeChanged : EventPacket (event_code = CONNECTION_PACKET_TYPE_CHANGED){
   status : ErrorCode,
   connection_handle : 12,
   _reserved_ : 4,
@@ -2271,7 +3080,16 @@
 }
 
 packet FlowSpecificationComplete : EventPacket (event_code = FLOW_SPECIFICATION_COMPLETE){
-  _payload_, // placeholder (unimplemented)
+  status : ErrorCode,
+  connection_handle : 12,
+  _reserved_ : 4,
+  _reserved_ : 8,
+  flow_direction : FlowDirection,
+  service_type : ServiceType,
+  token_rate : 32, // Octets/s
+  token_bucket_size : 32,
+  peak_bandwidth : 32, // Octets/s
+  access_latency : 32, // Octets/s
 }
 
 packet InquiryResultWithRssi : EventPacket (event_code = INQUIRY_RESULT_WITH_RSSI){
@@ -2321,7 +3139,7 @@
   clock_offset : 15,
   _reserved_ : 1,
   rssi : 8,
-  _payload_,
+  extended_inquiry_response : GapData[],
 }
 
 packet EncryptionKeyRefreshComplete : EventPacket (event_code = ENCRYPTION_KEY_REFRESH_COMPLETE){
@@ -2414,7 +3232,7 @@
   connection_handle : 12,
   _reserved_ : 4,
   role : Role,
-  peer_address_type : PeerAddressType,
+  peer_address_type : AddressType,
   peer_address : Address,
   conn_interval : 16, // 0x006 - 0x0C80 (7.5ms - 4000ms)
   conn_latency : 16,  // Number of connection events
@@ -2422,8 +3240,18 @@
   master_clock_accuracy : MasterClockAccuracy,
 }
 
+struct LeAdvertisingReport {
+  event_type : AdvertisingEventType,
+  address_type : AddressType,
+  address : Address,
+  _size_(advertising_data) : 8,
+  advertising_data : GapData[],
+  rssi : 8,
+}
+
 packet LeAdvertisingReport : LeMetaEvent (subevent_code = ADVERTISING_REPORT) {
-  _payload_,
+  _count_(advertising_reports) : 8,
+  advertising_reports : LeAdvertisingReport[],
 }
 
 packet LeConnectionUpdateComplete : LeMetaEvent (subevent_code = CONNECTION_UPDATE_COMPLETE) {
@@ -2470,12 +3298,12 @@
 
 packet ReadLocalP256PublicKeyComplete : LeMetaEvent (subevent_code = READ_LOCAL_P256_PUBLIC_KEY_COMPLETE) {
   status : ErrorCode,
-  _payload_,
+  local_p_256_public_key : 8[64],
 }
 
 packet GenerateDhKeyComplete : LeMetaEvent (subevent_code = GENERATE_DHKEY_COMPLETE) {
   status : ErrorCode,
-  _payload_,
+  dh_key : 8[32],
 }
 
 packet LeEnhancedConnectionComplete : LeMetaEvent (subevent_code = ENHANCED_CONNECTION_COMPLETE) {
@@ -2483,7 +3311,7 @@
   connection_handle : 12,
   _reserved_ : 4,
   role : Role,
-  peer_address_type : PeerAddressType,
+  peer_address_type : AddressType,
   peer_address : Address,
   local_resolvable_private_address : Address,
   peer_resolvable_private_address : Address,
@@ -2498,6 +3326,7 @@
   RANDOM_DEVICE_ADDRESS = 0x01,
   PUBLIC_IDENTITY_ADDRESS = 0x02,
   RANDOM_IDENTITY_ADDRESS = 0x03,
+  CONTROLLER_UNABLE_TO_RESOLVE = 0xFE,
   NO_ADDRESS = 0xFF,
 }
 
@@ -2509,16 +3338,69 @@
   RANDOM_DEVICE_ADDRESS = 0x01,
 }
 
+struct LeDirectedAdvertisingReport {
+  event_type : DirectAdvertisingEventType,
+  address_type : DirectAdvertisingAddressType,
+  address : Address,
+  direct_address_type : DirectAddressType,
+  direct_address : Address,
+  rssi : 8,
+}
+
 packet LeDirectedAdvertisingReport : LeMetaEvent (subevent_code = DIRECTED_ADVERTISING_REPORT) {
-  _payload_, // placeholder (unimplemented)
+  _count_(advertising_reports) : 8,
+  advertising_reports : LeDirectedAdvertisingReport[],
 }
 
 packet LePhyUpdateComplete : LeMetaEvent (subevent_code = PHY_UPDATE_COMPLETE) {
   _payload_, // placeholder (unimplemented)
 }
 
+enum DataStatus : 2 {
+  COMPLETE = 0x0,
+  CONTINUING = 0x1,
+  TRUNCATED = 0x2,
+  RESERVED = 0x3,
+}
+
+enum PrimaryPhyType : 8 {
+  LE_1M = 0x01,
+  LE_CODED = 0x03,
+}
+
+enum SecondaryPhyType : 8 {
+  NO_PACKETS = 0x00,
+  LE_1M = 0x01,
+  LE_2M = 0x02,
+  LE_CODED = 0x03,
+}
+
+
+struct LeExtendedAdvertisingReport {
+  connectable : 1,
+  scannable : 1,
+  directed : 1,
+  scan_response : 1,
+  data_status : DataStatus,
+  _reserved_ : 10,
+  address_type : DirectAdvertisingAddressType,
+  address : Address,
+  primary_phy : PrimaryPhyType,
+  secondary_phy : SecondaryPhyType,
+  advertising_sid : 4, // SID subfield in the ADI field
+  _reserved_ : 4,
+  tx_power : 8,
+  rssi : 8, // -127 to +20 (0x7F means not available)
+  periodic_advertising_interval : 16, // 0x006 to 0xFFFF (7.5 ms to 82s)
+  direct_address_type : DirectAdvertisingAddressType,
+  direct_address : Address,
+  _size_(advertising_data) : 8,
+  advertising_data : GapData[],
+}
+
 packet LeExtendedAdvertisingReport : LeMetaEvent (subevent_code = EXTENDED_ADVERTISING_REPORT) {
-  _payload_, // placeholder (unimplemented)
+  _count_(advertising_reports) : 8,
+  advertising_reports : LeExtendedAdvertisingReport[],
 }
 
 packet LePeriodicAdvertisingSyncEstablished : LeMetaEvent (subevent_code = PERIODIC_ADVERTISING_SYNC_ESTABLISHED) {
@@ -2537,9 +3419,15 @@
 }
 
 packet LeAdvertisingSetTerminated : LeMetaEvent (subevent_code = ADVERTISING_SET_TERMINATED) {
-  _payload_, // placeholder (unimplemented)
+  status : ErrorCode,
+  advertising_handle : 8,
+  connection_handle : 12,
+  _reserved_ : 4,
+  num_completed_extended_advertising_events : 8,
 }
 
 packet LeScanRequestReceived : LeMetaEvent (subevent_code = SCAN_REQUEST_RECEIVED) {
-  _payload_, // placeholder (unimplemented)
+  advertising_handle : 8,
+  scanner_address_type : AddressType,
+  scanner_address : Address,
 }
diff --git a/gd/hci/hci_packets_fuzz_test.cc b/gd/hci/hci_packets_fuzz_test.cc
new file mode 100644
index 0000000..5ef3ef6
--- /dev/null
+++ b/gd/hci/hci_packets_fuzz_test.cc
@@ -0,0 +1,135 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#define PACKET_FUZZ_TESTING
+#include "hci/hci_packets.h"
+
+#include <memory>
+
+#include "os/log.h"
+#include "packet/bit_inserter.h"
+#include "packet/raw_builder.h"
+
+using bluetooth::packet::BitInserter;
+using bluetooth::packet::RawBuilder;
+using std::vector;
+
+namespace bluetooth {
+namespace hci {
+
+std::vector<void (*)(const uint8_t*, size_t)> hci_packet_fuzz_tests;
+
+DEFINE_AND_REGISTER_ResetReflectionFuzzTest(hci_packet_fuzz_tests);
+
+DEFINE_AND_REGISTER_ResetCompleteReflectionFuzzTest(hci_packet_fuzz_tests);
+
+DEFINE_AND_REGISTER_ReadBufferSizeReflectionFuzzTest(hci_packet_fuzz_tests);
+
+DEFINE_AND_REGISTER_ReadBufferSizeCompleteReflectionFuzzTest(hci_packet_fuzz_tests);
+
+DEFINE_AND_REGISTER_HostBufferSizeReflectionFuzzTest(hci_packet_fuzz_tests);
+
+DEFINE_AND_REGISTER_HostBufferSizeCompleteReflectionFuzzTest(hci_packet_fuzz_tests);
+
+DEFINE_AND_REGISTER_ReadLocalVersionInformationReflectionFuzzTest(hci_packet_fuzz_tests);
+
+DEFINE_AND_REGISTER_ReadLocalVersionInformationCompleteReflectionFuzzTest(hci_packet_fuzz_tests);
+
+DEFINE_AND_REGISTER_ReadBdAddrReflectionFuzzTest(hci_packet_fuzz_tests);
+
+DEFINE_AND_REGISTER_ReadBdAddrCompleteReflectionFuzzTest(hci_packet_fuzz_tests);
+
+DEFINE_AND_REGISTER_ReadLocalSupportedCommandsReflectionFuzzTest(hci_packet_fuzz_tests);
+
+DEFINE_AND_REGISTER_ReadLocalSupportedCommandsCompleteReflectionFuzzTest(hci_packet_fuzz_tests);
+
+DEFINE_AND_REGISTER_WriteSimplePairingModeReflectionFuzzTest(hci_packet_fuzz_tests);
+
+DEFINE_AND_REGISTER_WriteSimplePairingModeCompleteReflectionFuzzTest(hci_packet_fuzz_tests);
+
+DEFINE_AND_REGISTER_WriteLeHostSupportReflectionFuzzTest(hci_packet_fuzz_tests);
+
+DEFINE_AND_REGISTER_WriteLeHostSupportCompleteReflectionFuzzTest(hci_packet_fuzz_tests);
+
+DEFINE_AND_REGISTER_ReadLocalExtendedFeaturesReflectionFuzzTest(hci_packet_fuzz_tests);
+
+DEFINE_AND_REGISTER_ReadLocalExtendedFeaturesCompleteReflectionFuzzTest(hci_packet_fuzz_tests);
+
+DEFINE_AND_REGISTER_WriteSecureConnectionsHostSupportReflectionFuzzTest(hci_packet_fuzz_tests);
+
+DEFINE_AND_REGISTER_WriteSecureConnectionsHostSupportCompleteReflectionFuzzTest(hci_packet_fuzz_tests);
+
+DEFINE_AND_REGISTER_LeReadWhiteListSizeReflectionFuzzTest(hci_packet_fuzz_tests);
+
+DEFINE_AND_REGISTER_LeReadWhiteListSizeCompleteReflectionFuzzTest(hci_packet_fuzz_tests);
+
+DEFINE_AND_REGISTER_LeReadBufferSizeReflectionFuzzTest(hci_packet_fuzz_tests);
+
+DEFINE_AND_REGISTER_LeReadBufferSizeCompleteReflectionFuzzTest(hci_packet_fuzz_tests);
+
+DEFINE_AND_REGISTER_WriteCurrentIacLapReflectionFuzzTest(hci_packet_fuzz_tests);
+
+DEFINE_AND_REGISTER_WriteCurrentIacLapCompleteReflectionFuzzTest(hci_packet_fuzz_tests);
+
+DEFINE_AND_REGISTER_WriteInquiryScanActivityReflectionFuzzTest(hci_packet_fuzz_tests);
+
+DEFINE_AND_REGISTER_WriteInquiryScanActivityCompleteReflectionFuzzTest(hci_packet_fuzz_tests);
+
+DEFINE_AND_REGISTER_ReadInquiryScanActivityReflectionFuzzTest(hci_packet_fuzz_tests);
+
+DEFINE_AND_REGISTER_ReadInquiryScanActivityCompleteReflectionFuzzTest(hci_packet_fuzz_tests);
+
+DEFINE_AND_REGISTER_ReadCurrentIacLapReflectionFuzzTest(hci_packet_fuzz_tests);
+
+DEFINE_AND_REGISTER_ReadCurrentIacLapCompleteReflectionFuzzTest(hci_packet_fuzz_tests);
+
+DEFINE_AND_REGISTER_ReadNumberOfSupportedIacReflectionFuzzTest(hci_packet_fuzz_tests);
+
+DEFINE_AND_REGISTER_ReadNumberOfSupportedIacCompleteReflectionFuzzTest(hci_packet_fuzz_tests);
+
+DEFINE_AND_REGISTER_ReadPageTimeoutReflectionFuzzTest(hci_packet_fuzz_tests);
+
+DEFINE_AND_REGISTER_ReadPageTimeoutCompleteReflectionFuzzTest(hci_packet_fuzz_tests);
+
+DEFINE_AND_REGISTER_WritePageTimeoutReflectionFuzzTest(hci_packet_fuzz_tests);
+
+DEFINE_AND_REGISTER_WritePageTimeoutCompleteReflectionFuzzTest(hci_packet_fuzz_tests);
+
+DEFINE_AND_REGISTER_InquiryReflectionFuzzTest(hci_packet_fuzz_tests);
+
+DEFINE_AND_REGISTER_InquiryStatusReflectionFuzzTest(hci_packet_fuzz_tests);
+
+DEFINE_AND_REGISTER_InquiryCancelReflectionFuzzTest(hci_packet_fuzz_tests);
+
+DEFINE_AND_REGISTER_InquiryCancelCompleteReflectionFuzzTest(hci_packet_fuzz_tests);
+
+DEFINE_AND_REGISTER_PeriodicInquiryModeReflectionFuzzTest(hci_packet_fuzz_tests);
+
+DEFINE_AND_REGISTER_PeriodicInquiryModeCompleteReflectionFuzzTest(hci_packet_fuzz_tests);
+
+DEFINE_AND_REGISTER_ExitPeriodicInquiryModeReflectionFuzzTest(hci_packet_fuzz_tests);
+
+DEFINE_AND_REGISTER_ExitPeriodicInquiryModeCompleteReflectionFuzzTest(hci_packet_fuzz_tests);
+
+}  // namespace hci
+}  // namespace bluetooth
+
+void RunHciPacketFuzzTest(const uint8_t* data, size_t size) {
+  if (data == nullptr) return;
+  for (auto test_function : bluetooth::hci::hci_packet_fuzz_tests) {
+    test_function(data, size);
+  }
+}
\ No newline at end of file
diff --git a/gd/hci/hci_packets_test.cc b/gd/hci/hci_packets_test.cc
new file mode 100644
index 0000000..729513b
--- /dev/null
+++ b/gd/hci/hci_packets_test.cc
@@ -0,0 +1,266 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#define PACKET_TESTING
+#include "hci/hci_packets.h"
+
+#include <gtest/gtest.h>
+#include <forward_list>
+#include <memory>
+
+#include "os/log.h"
+#include "packet/bit_inserter.h"
+#include "packet/raw_builder.h"
+
+using bluetooth::packet::BitInserter;
+using bluetooth::packet::RawBuilder;
+using std::vector;
+
+namespace bluetooth {
+namespace hci {
+
+std::vector<uint8_t> reset = {0x03, 0x0c, 0x00};
+DEFINE_AND_INSTANTIATE_ResetReflectionTest(reset);
+
+std::vector<uint8_t> reset_complete = {0x0e, 0x04, 0x01, 0x03, 0x0c, 0x00};
+DEFINE_AND_INSTANTIATE_ResetCompleteReflectionTest(reset_complete);
+
+std::vector<uint8_t> read_buffer_size = {0x05, 0x10, 0x00};
+DEFINE_AND_INSTANTIATE_ReadBufferSizeReflectionTest(read_buffer_size);
+
+std::vector<uint8_t> read_buffer_size_complete = {0x0e, 0x0b, 0x01, 0x05, 0x10, 0x00, 0x00,
+                                                  0x04, 0x3c, 0x07, 0x00, 0x08, 0x00};
+DEFINE_AND_INSTANTIATE_ReadBufferSizeCompleteReflectionTest(read_buffer_size_complete);
+
+std::vector<uint8_t> host_buffer_size = {0x33, 0x0c, 0x07, 0x9b, 0x06, 0xff, 0x14, 0x00, 0x0a, 0x00};
+DEFINE_AND_INSTANTIATE_HostBufferSizeReflectionTest(host_buffer_size);
+
+std::vector<uint8_t> host_buffer_size_complete = {0x0e, 0x04, 0x01, 0x33, 0x0c, 0x00};
+DEFINE_AND_INSTANTIATE_HostBufferSizeCompleteReflectionTest(host_buffer_size_complete);
+
+std::vector<uint8_t> read_local_version_information = {0x01, 0x10, 0x00};
+DEFINE_AND_INSTANTIATE_ReadLocalVersionInformationReflectionTest(read_local_version_information);
+
+std::vector<uint8_t> read_local_version_information_complete = {0x0e, 0x0c, 0x01, 0x01, 0x10, 0x00, 0x09,
+                                                                0x00, 0x00, 0x09, 0x1d, 0x00, 0xbe, 0x02};
+DEFINE_AND_INSTANTIATE_ReadLocalVersionInformationCompleteReflectionTest(read_local_version_information_complete);
+
+std::vector<uint8_t> read_bd_addr = {0x09, 0x10, 0x00};
+DEFINE_AND_INSTANTIATE_ReadBdAddrReflectionTest(read_bd_addr);
+
+std::vector<uint8_t> read_bd_addr_complete = {0x0e, 0x0a, 0x01, 0x09, 0x10, 0x00, 0x14, 0x8e, 0x61, 0x5f, 0x36, 0x88};
+DEFINE_AND_INSTANTIATE_ReadBdAddrCompleteReflectionTest(read_bd_addr_complete);
+
+std::vector<uint8_t> read_local_supported_commands = {0x02, 0x10, 0x00};
+DEFINE_AND_INSTANTIATE_ReadLocalSupportedCommandsReflectionTest(read_local_supported_commands);
+
+std::vector<uint8_t> read_local_supported_commands_complete = {
+    0x0e, 0x44, 0x01, 0x02, 0x10, 0x00, /* Supported commands start here (total 64 bytes) */
+    0xff, 0xff, 0xff, 0x03, 0xce, 0xff, 0xef, 0xff, 0xff, 0xff, 0xff, 0x7f, 0xf2, 0x0f, 0xe8, 0xfe,
+    0x3f, 0xf7, 0x83, 0xff, 0x1c, 0x00, 0x00, 0x00, 0x61, 0xff, 0xff, 0xff, 0x7f, 0xbe, 0x20, 0xf5,
+    0xff, 0xf0, 0xff, 0xff, 0xff, 0xff, 0xff, 0x07, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00};
+DEFINE_AND_INSTANTIATE_ReadLocalSupportedCommandsCompleteReflectionTest(read_local_supported_commands_complete);
+
+std::vector<uint8_t> read_local_extended_features_0 = {0x04, 0x10, 0x01, 0x00};
+
+std::vector<uint8_t> read_local_extended_features_complete_0 = {0x0e, 0x0e, 0x01, 0x04, 0x10, 0x00, 0x00, 0x02,
+                                                                0xff, 0xfe, 0x8f, 0xfe, 0xd8, 0x3f, 0x5b, 0x87};
+
+std::vector<uint8_t> write_simple_paring_mode = {0x56, 0x0c, 0x01, 0x01};
+DEFINE_AND_INSTANTIATE_WriteSimplePairingModeReflectionTest(write_simple_paring_mode);
+
+std::vector<uint8_t> write_simple_paring_mode_complete = {0x0e, 0x04, 0x01, 0x56, 0x0c, 0x00};
+DEFINE_AND_INSTANTIATE_WriteSimplePairingModeCompleteReflectionTest(write_simple_paring_mode_complete);
+
+std::vector<uint8_t> write_le_host_supported = {0x6d, 0x0c, 0x02, 0x01, 0x01};
+DEFINE_AND_INSTANTIATE_WriteLeHostSupportReflectionTest(write_le_host_supported);
+
+std::vector<uint8_t> write_le_host_supported_complete = {0x0e, 0x04, 0x01, 0x6d, 0x0c, 0x00};
+DEFINE_AND_INSTANTIATE_WriteLeHostSupportCompleteReflectionTest(write_le_host_supported_complete);
+
+std::vector<uint8_t> read_local_extended_features_1 = {0x04, 0x10, 0x01, 0x01};
+
+std::vector<uint8_t> read_local_extended_features_complete_1 = {0x0e, 0x0e, 0x01, 0x04, 0x10, 0x00, 0x01, 0x02,
+                                                                0x07, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00};
+
+std::vector<uint8_t> read_local_extended_features_2 = {0x04, 0x10, 0x01, 0x02};
+DEFINE_AND_INSTANTIATE_ReadLocalExtendedFeaturesReflectionTest(read_local_extended_features_0,
+                                                               read_local_extended_features_1,
+                                                               read_local_extended_features_2);
+
+std::vector<uint8_t> read_local_extended_features_complete_2 = {0x0e, 0x0e, 0x01, 0x04, 0x10, 0x00, 0x02, 0x02,
+                                                                0x45, 0x03, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00};
+DEFINE_AND_INSTANTIATE_ReadLocalExtendedFeaturesCompleteReflectionTest(read_local_extended_features_complete_0,
+                                                                       read_local_extended_features_complete_1,
+                                                                       read_local_extended_features_complete_2);
+
+std::vector<uint8_t> write_secure_connections_host_support = {0x7a, 0x0c, 0x01, 0x01};
+DEFINE_AND_INSTANTIATE_WriteSecureConnectionsHostSupportReflectionTest(write_secure_connections_host_support);
+
+std::vector<uint8_t> write_secure_connections_host_support_complete = {0x0e, 0x04, 0x01, 0x7a, 0x0c, 0x00};
+DEFINE_AND_INSTANTIATE_WriteSecureConnectionsHostSupportCompleteReflectionTest(
+    write_secure_connections_host_support_complete);
+
+std::vector<uint8_t> le_read_white_list_size = {0x0f, 0x20, 0x00};
+DEFINE_AND_INSTANTIATE_LeReadWhiteListSizeReflectionTest(le_read_white_list_size);
+
+std::vector<uint8_t> le_read_white_list_size_complete = {0x0e, 0x05, 0x01, 0x0f, 0x20, 0x00, 0x80};
+DEFINE_AND_INSTANTIATE_LeReadWhiteListSizeCompleteReflectionTest(le_read_white_list_size_complete);
+
+std::vector<uint8_t> le_read_buffer_size = {0x02, 0x20, 0x00};
+DEFINE_AND_INSTANTIATE_LeReadBufferSizeReflectionTest(le_read_buffer_size);
+
+std::vector<uint8_t> le_read_buffer_size_complete = {0x0e, 0x07, 0x01, 0x02, 0x20, 0x00, 0xfb, 0x00, 0x10};
+DEFINE_AND_INSTANTIATE_LeReadBufferSizeCompleteReflectionTest(le_read_buffer_size_complete);
+
+std::vector<uint8_t> write_current_iac_laps = {0x3a, 0x0c, 0x07, 0x02, 0x11, 0x8b, 0x9e, 0x22, 0x8b, 0x9e};
+DEFINE_AND_INSTANTIATE_WriteCurrentIacLapReflectionTest(write_current_iac_laps);
+
+std::vector<uint8_t> write_current_iac_laps_complete = {0x0e, 0x04, 0x01, 0x3a, 0x0c, 0x00};
+DEFINE_AND_INSTANTIATE_WriteCurrentIacLapCompleteReflectionTest(write_current_iac_laps_complete);
+
+std::vector<uint8_t> write_inquiry_scan_activity = {0x1e, 0x0c, 0x04, 0x00, 0x08, 0x12, 0x00};
+DEFINE_AND_INSTANTIATE_WriteInquiryScanActivityReflectionTest(write_inquiry_scan_activity);
+
+std::vector<uint8_t> write_inquiry_scan_activity_complete = {0x0e, 0x04, 0x01, 0x1e, 0x0c, 0x00};
+DEFINE_AND_INSTANTIATE_WriteInquiryScanActivityCompleteReflectionTest(write_inquiry_scan_activity_complete);
+
+std::vector<uint8_t> read_inquiry_scan_activity = {0x1d, 0x0c, 0x00};
+DEFINE_AND_INSTANTIATE_ReadInquiryScanActivityReflectionTest(read_inquiry_scan_activity);
+
+std::vector<uint8_t> read_inquiry_scan_activity_complete = {0x0e, 0x08, 0x01, 0x1d, 0x0c, 0x00, 0xaa, 0xbb, 0xcc, 0xdd};
+DEFINE_AND_INSTANTIATE_ReadInquiryScanActivityCompleteReflectionTest(read_inquiry_scan_activity_complete);
+
+std::vector<uint8_t> read_current_iac_lap = {0x39, 0x0c, 0x00};
+DEFINE_AND_INSTANTIATE_ReadCurrentIacLapReflectionTest(read_current_iac_lap);
+
+std::vector<uint8_t> read_current_iac_lap_complete = {0x0e, 0x0b, 0x01, 0x39, 0x0c, 0x00, 0x02,
+                                                      0x11, 0x8b, 0x9e, 0x22, 0x8b, 0x9e};
+DEFINE_AND_INSTANTIATE_ReadCurrentIacLapCompleteReflectionTest(read_current_iac_lap_complete);
+
+std::vector<uint8_t> read_number_of_supported_iac = {0x38, 0x0c, 0x00};
+DEFINE_AND_INSTANTIATE_ReadNumberOfSupportedIacReflectionTest(read_number_of_supported_iac);
+
+std::vector<uint8_t> read_number_of_supported_iac_complete = {0x0e, 0x05, 0x01, 0x38, 0x0c, 0x00, 0x99};
+DEFINE_AND_INSTANTIATE_ReadNumberOfSupportedIacCompleteReflectionTest(read_number_of_supported_iac_complete);
+
+std::vector<uint8_t> read_page_timeout = {0x17, 0x0c, 0x00};
+DEFINE_AND_INSTANTIATE_ReadPageTimeoutReflectionTest(read_page_timeout);
+
+std::vector<uint8_t> read_page_timeout_complete = {0x0e, 0x06, 0x01, 0x17, 0x0c, 0x00, 0x11, 0x22};
+DEFINE_AND_INSTANTIATE_ReadPageTimeoutCompleteReflectionTest(read_page_timeout_complete);
+
+std::vector<uint8_t> write_page_timeout = {0x18, 0x0c, 0x02, 0x00, 0x20};
+DEFINE_AND_INSTANTIATE_WritePageTimeoutReflectionTest(write_page_timeout);
+
+std::vector<uint8_t> write_page_timeout_complete = {0x0e, 0x04, 0x01, 0x18, 0x0c, 0x00};
+DEFINE_AND_INSTANTIATE_WritePageTimeoutCompleteReflectionTest(write_page_timeout_complete);
+
+std::vector<uint8_t> inquiry = {0x01, 0x04, 0x05, 0x33, 0x8b, 0x9e, 0xaa, 0xbb};
+DEFINE_AND_INSTANTIATE_InquiryReflectionTest(inquiry);
+
+std::vector<uint8_t> inquiry_status = {0x0f, 0x04, 0x00, 0x01, 0x01, 0x04};
+DEFINE_AND_INSTANTIATE_InquiryStatusReflectionTest(inquiry_status);
+
+std::vector<uint8_t> inquiry_cancel = {0x02, 0x04, 0x00};
+DEFINE_AND_INSTANTIATE_InquiryCancelReflectionTest(inquiry_cancel);
+
+std::vector<uint8_t> inquiry_cancel_complete = {0x0e, 0x04, 0x01, 0x02, 0x04, 0x00};
+DEFINE_AND_INSTANTIATE_InquiryCancelCompleteReflectionTest(inquiry_cancel_complete);
+
+std::vector<uint8_t> periodic_inquiry_mode = {0x03, 0x04, 0x09, 0x12, 0x34, 0x56, 0x78, 0x11, 0x8b, 0x9e, 0x9a, 0xbc};
+DEFINE_AND_INSTANTIATE_PeriodicInquiryModeReflectionTest(periodic_inquiry_mode);
+
+std::vector<uint8_t> periodic_inquiry_mode_complete = {0x0e, 0x04, 0x01, 0x03, 0x04, 0x00};
+DEFINE_AND_INSTANTIATE_PeriodicInquiryModeCompleteReflectionTest(periodic_inquiry_mode_complete);
+
+std::vector<uint8_t> exit_periodic_inquiry_mode = {0x04, 0x04, 0x00};
+DEFINE_AND_INSTANTIATE_ExitPeriodicInquiryModeReflectionTest(exit_periodic_inquiry_mode);
+
+std::vector<uint8_t> exit_periodic_inquiry_mode_complete = {0x0e, 0x04, 0x01, 0x04, 0x04, 0x00};
+DEFINE_AND_INSTANTIATE_ExitPeriodicInquiryModeCompleteReflectionTest(exit_periodic_inquiry_mode_complete);
+
+std::vector<uint8_t> pixel_3_xl_write_extended_inquiry_response{
+    0x52, 0x0c, 0xf1, 0x01, 0x0b, 0x09, 0x50, 0x69, 0x78, 0x65, 0x6c, 0x20, 0x33, 0x20, 0x58, 0x4c, 0x19, 0x03, 0x05,
+    0x11, 0x0a, 0x11, 0x0c, 0x11, 0x0e, 0x11, 0x12, 0x11, 0x15, 0x11, 0x16, 0x11, 0x1f, 0x11, 0x2d, 0x11, 0x2f, 0x11,
+    0x00, 0x12, 0x32, 0x11, 0x01, 0x05, 0x81, 0x07, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00};
+
+std::vector<uint8_t> pixel_3_xl_write_extended_inquiry_response_no_uuids{
+    0x52, 0x0c, 0xf1, 0x01, 0x0b, 0x09, 0x50, 0x69, 0x78, 0x65, 0x6c, 0x20, 0x33, 0x20, 0x58, 0x4c, 0x01, 0x03, 0x01,
+    0x05, 0x81, 0x07, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00};
+
+std::vector<uint8_t> pixel_3_xl_write_extended_inquiry_response_no_uuids_just_eir{
+    pixel_3_xl_write_extended_inquiry_response_no_uuids.begin() + 4,  // skip command, size, and fec_required
+    pixel_3_xl_write_extended_inquiry_response_no_uuids.end()};
+
+TEST(HciPacketsTest, testWriteExtendedInquiryResponse) {
+  std::shared_ptr<std::vector<uint8_t>> view_bytes =
+      std::make_shared<std::vector<uint8_t>>(pixel_3_xl_write_extended_inquiry_response);
+
+  PacketView<kLittleEndian> packet_bytes_view(view_bytes);
+  auto view = WriteExtendedInquiryResponseView::Create(CommandPacketView::Create(packet_bytes_view));
+  ASSERT_TRUE(view.IsValid());
+  auto gap_data = view.GetExtendedInquiryResponse();
+  ASSERT_GE(gap_data.size(), 4);
+  ASSERT_EQ(gap_data[0].data_type_, GapDataType::COMPLETE_LOCAL_NAME);
+  ASSERT_EQ(gap_data[0].data_.size(), 10);
+  ASSERT_EQ(gap_data[1].data_type_, GapDataType::COMPLETE_LIST_16_BIT_UUIDS);
+  ASSERT_EQ(gap_data[1].data_.size(), 24);
+  ASSERT_EQ(gap_data[2].data_type_, GapDataType::COMPLETE_LIST_32_BIT_UUIDS);
+  ASSERT_EQ(gap_data[2].data_.size(), 0);
+  ASSERT_EQ(gap_data[3].data_type_, GapDataType::COMPLETE_LIST_128_BIT_UUIDS);
+  ASSERT_EQ(gap_data[3].data_.size(), 128);
+
+  std::vector<GapData> no_padding{gap_data.begin(), gap_data.begin() + 4};
+  auto builder = WriteExtendedInquiryResponseBuilder::Create(view.GetFecRequired(), no_padding);
+
+  std::shared_ptr<std::vector<uint8_t>> packet_bytes = std::make_shared<std::vector<uint8_t>>();
+  BitInserter it(*packet_bytes);
+  builder->Serialize(it);
+
+  EXPECT_EQ(packet_bytes->size(), view_bytes->size());
+  for (size_t i = 0; i < view_bytes->size(); i++) {
+    ASSERT_EQ(packet_bytes->at(i), view_bytes->at(i));
+  }
+}
+
+//  TODO: Revisit reflection tests for EIR
+// DEFINE_AND_INSTANTIATE_WriteExtendedInquiryResponseReflectionTest(pixel_3_xl_write_extended_inquiry_response,
+// pixel_3_xl_write_extended_inquiry_response_no_uuids);
+}  // namespace hci
+}  // namespace bluetooth
diff --git a/gd/hci/le_advertising_interface.h b/gd/hci/le_advertising_interface.h
new file mode 100644
index 0000000..f915c02
--- /dev/null
+++ b/gd/hci/le_advertising_interface.h
@@ -0,0 +1,45 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#pragma once
+
+#include "common/callback.h"
+#include "hci/hci_packets.h"
+#include "os/handler.h"
+#include "os/utils.h"
+
+namespace bluetooth {
+namespace hci {
+
+class LeAdvertisingInterface {
+ public:
+  LeAdvertisingInterface() = default;
+  virtual ~LeAdvertisingInterface() = default;
+  DISALLOW_COPY_AND_ASSIGN(LeAdvertisingInterface);
+
+  virtual void EnqueueCommand(std::unique_ptr<LeAdvertisingCommandBuilder> command,
+                              common::OnceCallback<void(CommandCompleteView)> on_complete, os::Handler* handler) = 0;
+
+  virtual void EnqueueCommand(std::unique_ptr<LeAdvertisingCommandBuilder> command,
+                              common::OnceCallback<void(CommandStatusView)> on_status, os::Handler* handler) = 0;
+
+  static constexpr hci::SubeventCode LeAdvertisingEvents[] = {
+      hci::SubeventCode::SCAN_REQUEST_RECEIVED,
+      hci::SubeventCode::ADVERTISING_SET_TERMINATED,
+  };
+};
+}  // namespace hci
+}  // namespace bluetooth
diff --git a/gd/hci/le_advertising_manager.cc b/gd/hci/le_advertising_manager.cc
new file mode 100644
index 0000000..35e30a7
--- /dev/null
+++ b/gd/hci/le_advertising_manager.cc
@@ -0,0 +1,326 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+#include <memory>
+#include <mutex>
+
+#include "hci/controller.h"
+#include "hci/hci_layer.h"
+#include "hci/hci_packets.h"
+#include "hci/le_advertising_interface.h"
+#include "hci/le_advertising_manager.h"
+#include "module.h"
+#include "os/handler.h"
+#include "os/log.h"
+
+namespace bluetooth {
+namespace hci {
+
+const ModuleFactory LeAdvertisingManager::Factory = ModuleFactory([]() { return new LeAdvertisingManager(); });
+
+enum class AdvertisingApiType {
+  LE_4_0 = 1,
+  ANDROID_HCI = 2,
+  LE_5_0 = 3,
+};
+
+struct Advertiser {
+  os::Handler* handler;
+  common::Callback<void(Address, AddressType)> scan_callback;
+  common::Callback<void(ErrorCode, uint8_t, uint8_t)> set_terminated_callback;
+};
+
+struct LeAdvertisingManager::impl {
+  impl(Module* module) : module_(module), le_advertising_interface_(nullptr), num_instances_(0) {}
+
+  void start(os::Handler* handler, hci::HciLayer* hci_layer, hci::Controller* controller) {
+    module_handler_ = handler;
+    hci_layer_ = hci_layer;
+    controller_ = controller;
+    le_advertising_interface_ = hci_layer_->GetLeAdvertisingInterface(
+        common::Bind(&LeAdvertisingManager::impl::handle_event, common::Unretained(this)), module_handler_);
+    num_instances_ = controller_->GetControllerLeNumberOfSupportedAdverisingSets();
+    if (controller_->IsSupported(hci::OpCode::LE_SET_EXTENDED_ADVERTISING_PARAMETERS)) {
+      advertising_api_type_ = AdvertisingApiType::LE_5_0;
+    } else if (controller_->IsSupported(hci::OpCode::LE_MULTI_ADVT)) {
+      advertising_api_type_ = AdvertisingApiType::ANDROID_HCI;
+    } else {
+      advertising_api_type_ = AdvertisingApiType::LE_4_0;
+    }
+  }
+
+  size_t GetNumberOfAdvertisingInstances() const {
+    return num_instances_;
+  }
+
+  void handle_event(LeMetaEventView event) {
+    switch (event.GetSubeventCode()) {
+      case hci::SubeventCode::SCAN_REQUEST_RECEIVED:
+        handle_scan_request(LeScanRequestReceivedView::Create(event));
+        break;
+      case hci::SubeventCode::ADVERTISING_SET_TERMINATED:
+        handle_set_terminated(LeAdvertisingSetTerminatedView::Create(event));
+        break;
+      default:
+        LOG_INFO("Unknown subevent in scanner %s", hci::SubeventCodeText(event.GetSubeventCode()).c_str());
+    }
+  }
+
+  void handle_scan_request(LeScanRequestReceivedView event_view) {
+    if (!event_view.IsValid()) {
+      LOG_INFO("Dropping invalid scan request event");
+      return;
+    }
+    registered_handler_->Post(
+        common::BindOnce(scan_callback_, event_view.GetScannerAddress(), event_view.GetScannerAddressType()));
+  }
+
+  void handle_set_terminated(LeAdvertisingSetTerminatedView event_view) {
+    if (!event_view.IsValid()) {
+      LOG_INFO("Dropping invalid advertising event");
+      return;
+    }
+    registered_handler_->Post(common::BindOnce(set_terminated_callback_, event_view.GetStatus(),
+                                               event_view.GetAdvertisingHandle(),
+                                               event_view.GetNumCompletedExtendedAdvertisingEvents()));
+  }
+
+  AdvertiserId allocate_advertiser() {
+    AdvertiserId id = 0;
+    {
+      std::unique_lock lock(id_mutex_);
+      while (id < num_instances_ && advertising_sets_.count(id) != 0) {
+        id++;
+      }
+    }
+    if (id == num_instances_) {
+      return kInvalidId;
+    }
+    return id;
+  }
+
+  void remove_advertiser(AdvertiserId id) {
+    std::unique_lock lock(id_mutex_);
+    if (advertising_sets_.count(id) == 0) {
+      return;
+    }
+    advertising_sets_.erase(id);
+  }
+
+  void create_advertiser(AdvertiserId id, const AdvertisingConfig& config,
+                         const common::Callback<void(Address, AddressType)>& scan_callback,
+                         const common::Callback<void(ErrorCode, uint8_t, uint8_t)>& set_terminated_callback,
+                         os::Handler* handler) {
+    advertising_sets_[id].scan_callback = scan_callback;
+    advertising_sets_[id].set_terminated_callback = set_terminated_callback;
+    advertising_sets_[id].handler = handler;
+    switch (advertising_api_type_) {
+      case (AdvertisingApiType::LE_4_0):
+        le_advertising_interface_->EnqueueCommand(
+            hci::LeSetAdvertisingParametersBuilder::Create(
+                config.interval_min, config.interval_max, config.event_type, config.address_type,
+                config.peer_address_type, config.peer_address, config.channel_map, config.filter_policy),
+            common::BindOnce(impl::check_status<LeSetAdvertisingParametersCompleteView>), module_handler_);
+        le_advertising_interface_->EnqueueCommand(hci::LeSetRandomAddressBuilder::Create(config.random_address),
+                                                  common::BindOnce(impl::check_status<LeSetRandomAddressCompleteView>),
+                                                  module_handler_);
+        if (!config.scan_response.empty()) {
+          le_advertising_interface_->EnqueueCommand(
+              hci::LeSetScanResponseDataBuilder::Create(config.scan_response),
+              common::BindOnce(impl::check_status<LeSetScanResponseDataCompleteView>), module_handler_);
+        }
+        le_advertising_interface_->EnqueueCommand(
+            hci::LeSetAdvertisingDataBuilder::Create(config.advertisement),
+            common::BindOnce(impl::check_status<LeSetAdvertisingDataCompleteView>), module_handler_);
+        le_advertising_interface_->EnqueueCommand(
+            hci::LeSetAdvertisingEnableBuilder::Create(Enable::ENABLED),
+            common::BindOnce(impl::check_status<LeSetAdvertisingEnableCompleteView>), module_handler_);
+        break;
+      case (AdvertisingApiType::ANDROID_HCI):
+        le_advertising_interface_->EnqueueCommand(
+            hci::LeMultiAdvtParamBuilder::Create(config.interval_min, config.interval_max, config.event_type,
+                                                 config.address_type, config.peer_address_type, config.peer_address,
+                                                 config.channel_map, config.filter_policy, id, config.tx_power),
+            common::BindOnce(impl::check_status<LeMultiAdvtCompleteView>), module_handler_);
+        le_advertising_interface_->EnqueueCommand(hci::LeMultiAdvtSetDataBuilder::Create(config.advertisement, id),
+                                                  common::BindOnce(impl::check_status<LeMultiAdvtCompleteView>),
+                                                  module_handler_);
+        if (!config.scan_response.empty()) {
+          le_advertising_interface_->EnqueueCommand(
+              hci::LeMultiAdvtSetScanRespBuilder::Create(config.scan_response, id),
+              common::BindOnce(impl::check_status<LeMultiAdvtCompleteView>), module_handler_);
+        }
+        le_advertising_interface_->EnqueueCommand(
+            hci::LeMultiAdvtSetRandomAddrBuilder::Create(config.random_address, id),
+            common::BindOnce(impl::check_status<LeMultiAdvtCompleteView>), module_handler_);
+        le_advertising_interface_->EnqueueCommand(hci::LeMultiAdvtSetEnableBuilder::Create(Enable::ENABLED, id),
+                                                  common::BindOnce(impl::check_status<LeMultiAdvtCompleteView>),
+                                                  module_handler_);
+        break;
+      case (AdvertisingApiType::LE_5_0): {
+        ExtendedAdvertisingConfig new_config;
+        AdvertisingConfig* base_config_ptr = &new_config;
+        *(base_config_ptr) = config;
+        create_extended_advertiser(id, new_config, scan_callback, set_terminated_callback, handler);
+      } break;
+    }
+  }
+
+  void create_extended_advertiser(AdvertiserId id, const ExtendedAdvertisingConfig& config,
+                                  const common::Callback<void(Address, AddressType)>& scan_callback,
+                                  const common::Callback<void(ErrorCode, uint8_t, uint8_t)>& set_terminated_callback,
+                                  os::Handler* handler) {
+    if (advertising_api_type_ != AdvertisingApiType::LE_5_0) {
+      create_advertiser(id, config, scan_callback, set_terminated_callback, handler);
+      return;
+    }
+    LOG_ALWAYS_FATAL("LE_SET_EXTENDED_ADVERTISING_PARAMETERS isn't implemented.");
+
+    /*
+    le_advertising_interface_->EnqueueCommand(hci::LeSetExtendedAdvertisingParametersBuilder::Create(config.interval_min,
+    config.interval_max, config.event_type, config.address_type, config.peer_address_type, config.peer_address,
+    config.channel_map, config.filter_policy, id, config.tx_power), common::BindOnce(impl::check_status),
+    module_handler_);
+     */
+    advertising_sets_[id].scan_callback = scan_callback;
+    advertising_sets_[id].set_terminated_callback = set_terminated_callback;
+    advertising_sets_[id].handler = handler;
+  }
+
+  void stop_advertising(AdvertiserId advertising_set) {
+    if (advertising_sets_.find(advertising_set) == advertising_sets_.end()) {
+      LOG_INFO("Unknown advertising set %u", advertising_set);
+      return;
+    }
+    le_advertising_interface_->EnqueueCommand(hci::LeSetAdvertisingEnableBuilder::Create(Enable::DISABLED),
+                                              common::BindOnce(impl::check_status<LeSetAdvertisingEnableCompleteView>),
+                                              module_handler_);
+    std::unique_lock lock(id_mutex_);
+    advertising_sets_.erase(advertising_set);
+  }
+
+  common::Callback<void(Address, AddressType)> scan_callback_;
+  common::Callback<void(ErrorCode, uint8_t, uint8_t)> set_terminated_callback_;
+  os::Handler* registered_handler_{nullptr};
+  Module* module_;
+  os::Handler* module_handler_;
+  hci::HciLayer* hci_layer_;
+  hci::Controller* controller_;
+  hci::LeAdvertisingInterface* le_advertising_interface_;
+  std::map<AdvertiserId, Advertiser> advertising_sets_;
+
+  std::mutex id_mutex_;
+  size_t num_instances_;
+
+  AdvertisingApiType advertising_api_type_{0};
+
+  template <class View>
+  static void check_status(CommandCompleteView view) {
+    ASSERT(view.IsValid());
+    auto status_view = View::Create(view);
+    ASSERT(status_view.IsValid());
+    if (status_view.GetStatus() != ErrorCode::SUCCESS) {
+      LOG_INFO("SetEnable returned status %s", ErrorCodeText(status_view.GetStatus()).c_str());
+    }
+  }
+};
+
+LeAdvertisingManager::LeAdvertisingManager() {
+  pimpl_ = std::make_unique<impl>(this);
+}
+
+void LeAdvertisingManager::ListDependencies(ModuleList* list) {
+  list->add<hci::HciLayer>();
+  list->add<hci::Controller>();
+}
+
+void LeAdvertisingManager::Start() {
+  pimpl_->start(GetHandler(), GetDependency<hci::HciLayer>(), GetDependency<hci::Controller>());
+}
+
+void LeAdvertisingManager::Stop() {
+  pimpl_.reset();
+}
+
+size_t LeAdvertisingManager::GetNumberOfAdvertisingInstances() const {
+  return pimpl_->GetNumberOfAdvertisingInstances();
+}
+
+AdvertiserId LeAdvertisingManager::CreateAdvertiser(
+    const AdvertisingConfig& config, const common::Callback<void(Address, AddressType)>& scan_callback,
+    const common::Callback<void(ErrorCode, uint8_t, uint8_t)>& set_terminated_callback, os::Handler* handler) {
+  if (config.peer_address == Address::kEmpty) {
+    if (config.address_type == hci::AddressType::PUBLIC_IDENTITY_ADDRESS ||
+        config.address_type == hci::AddressType::RANDOM_IDENTITY_ADDRESS) {
+      LOG_WARN("Peer address can not be empty");
+      return kInvalidId;
+    }
+    if (config.event_type == hci::AdvertisingEventType::ADV_DIRECT_IND ||
+        config.event_type == hci::AdvertisingEventType::ADV_DIRECT_IND_LOW) {
+      LOG_WARN("Peer address can not be empty for directed advertising");
+      return kInvalidId;
+    }
+  }
+  AdvertiserId id = pimpl_->allocate_advertiser();
+  if (id == kInvalidId) {
+    return id;
+  }
+  GetHandler()->Post(common::BindOnce(&impl::create_advertiser, common::Unretained(pimpl_.get()), id, config,
+                                      scan_callback, set_terminated_callback, handler));
+  return id;
+}
+
+AdvertiserId LeAdvertisingManager::CreateAdvertiser(
+    const ExtendedAdvertisingConfig& config, const common::Callback<void(Address, AddressType)>& scan_callback,
+    const common::Callback<void(ErrorCode, uint8_t, uint8_t)>& set_terminated_callback, os::Handler* handler) {
+  if (config.directed) {
+    if (config.peer_address == Address::kEmpty) {
+      LOG_INFO("Peer address can not be empty for directed advertising");
+      return kInvalidId;
+    }
+  }
+  if (config.channel_map == 0) {
+    LOG_INFO("At least one channel must be set in the map");
+    return kInvalidId;
+  }
+  if (!config.legacy_pdus) {
+    if (config.connectable && config.scannable) {
+      LOG_INFO("Extended advertising PDUs can not be connectable and scannable");
+      return kInvalidId;
+    }
+    if (config.high_duty_directed_connectable) {
+      LOG_INFO("Extended advertising PDUs can not be high duty cycle");
+      return kInvalidId;
+    }
+  }
+  if (config.interval_min > config.interval_max) {
+    LOG_INFO("Advertising interval: min (%hu) > max (%hu)", config.interval_min, config.interval_max);
+    return kInvalidId;
+  }
+  AdvertiserId id = pimpl_->allocate_advertiser();
+  if (id == kInvalidId) {
+    return id;
+  }
+  GetHandler()->Post(common::BindOnce(&impl::create_extended_advertiser, common::Unretained(pimpl_.get()), id, config,
+                                      scan_callback, set_terminated_callback, handler));
+  return id;
+}
+
+void LeAdvertisingManager::RemoveAdvertiser(AdvertiserId id) {
+  pimpl_->remove_advertiser(id);
+}
+
+}  // namespace hci
+}  // namespace bluetooth
\ No newline at end of file
diff --git a/gd/hci/le_advertising_manager.h b/gd/hci/le_advertising_manager.h
new file mode 100644
index 0000000..2cbfc59
--- /dev/null
+++ b/gd/hci/le_advertising_manager.h
@@ -0,0 +1,95 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+#pragma once
+
+#include <memory>
+
+#include "hci/hci_packets.h"
+#include "module.h"
+
+namespace bluetooth {
+namespace hci {
+
+class AdvertisingConfig {
+ public:
+  std::vector<GapData> advertisement;
+  std::vector<GapData> scan_response;
+  Address random_address;
+  uint16_t interval_min;
+  uint16_t interval_max;
+  AdvertisingEventType event_type;
+  AddressType address_type;
+  PeerAddressType peer_address_type;
+  Address peer_address;
+  uint8_t channel_map;
+  AdvertisingFilterPolicy filter_policy;
+  uint8_t tx_power;  // -127 to +20 (0x7f is no preference)
+};
+
+class ExtendedAdvertisingConfig : public AdvertisingConfig {
+ public:
+  bool connectable;
+  bool scannable;
+  bool directed;
+  bool high_duty_directed_connectable;
+  bool legacy_pdus;
+  bool anonymous;
+  bool include_tx_power;
+  bool use_le_coded_phy;       // Primary advertisement PHY is LE Coded
+  uint8_t secondary_max_skip;  // maximum advertising events to be skipped, 0x0 send AUX_ADV_IND prior ot the next event
+  uint8_t secondary_advertising_phy;  // 1 = 1M, 2 = 2M, 3 = coded
+  uint8_t sid;
+  bool enable_scan_request_notifications;
+};
+
+using AdvertiserId = int32_t;
+
+class LeAdvertisingManager : public bluetooth::Module {
+ public:
+  static constexpr AdvertiserId kInvalidId = -1;
+  LeAdvertisingManager();
+
+  size_t GetNumberOfAdvertisingInstances() const;
+
+  // Return -1 if the advertiser was not created, otherwise the advertiser ID.
+  AdvertiserId CreateAdvertiser(const AdvertisingConfig& config,
+                                const common::Callback<void(Address, AddressType)>& scan_callback,
+                                const common::Callback<void(ErrorCode, uint8_t, uint8_t)>& set_terminated_callback,
+                                os::Handler* handler);
+  AdvertiserId CreateAdvertiser(const ExtendedAdvertisingConfig& config,
+                                const common::Callback<void(Address, AddressType)>& scan_callback,
+                                const common::Callback<void(ErrorCode, uint8_t, uint8_t)>& set_terminated_callback,
+                                os::Handler* handler);
+
+  void RemoveAdvertiser(AdvertiserId id);
+
+  static const ModuleFactory Factory;
+
+ protected:
+  void ListDependencies(ModuleList* list) override;
+
+  void Start() override;
+
+  void Stop() override;
+
+ private:
+  struct impl;
+  std::unique_ptr<impl> pimpl_;
+  DISALLOW_COPY_AND_ASSIGN(LeAdvertisingManager);
+};
+
+}  // namespace hci
+}  // namespace bluetooth
\ No newline at end of file
diff --git a/gd/hci/le_advertising_manager_test.cc b/gd/hci/le_advertising_manager_test.cc
new file mode 100644
index 0000000..c4f40ad
--- /dev/null
+++ b/gd/hci/le_advertising_manager_test.cc
@@ -0,0 +1,356 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "hci/le_advertising_manager.h"
+
+#include <algorithm>
+#include <chrono>
+#include <future>
+#include <map>
+
+#include <gmock/gmock.h>
+#include <gtest/gtest.h>
+
+#include "common/bind.h"
+#include "hci/address.h"
+#include "hci/controller.h"
+#include "hci/hci_layer.h"
+#include "os/thread.h"
+#include "packet/raw_builder.h"
+
+namespace bluetooth {
+namespace hci {
+namespace {
+
+using packet::kLittleEndian;
+using packet::PacketView;
+using packet::RawBuilder;
+
+PacketView<kLittleEndian> GetPacketView(std::unique_ptr<packet::BasePacketBuilder> packet) {
+  auto bytes = std::make_shared<std::vector<uint8_t>>();
+  BitInserter i(*bytes);
+  bytes->reserve(packet->size());
+  packet->Serialize(i);
+  return packet::PacketView<packet::kLittleEndian>(bytes);
+}
+
+class TestController : public Controller {
+ public:
+  bool IsSupported(OpCode op_code) const override {
+    return supported_opcodes_.count(op_code) == 1;
+  }
+
+  void AddSupported(OpCode op_code) {
+    supported_opcodes_.insert(op_code);
+  }
+
+  uint16_t GetControllerLeNumberOfSupportedAdverisingSets() const override {
+    return num_advertisers;
+  }
+
+  uint16_t num_advertisers{0};
+
+ protected:
+  void Start() override {}
+  void Stop() override {}
+  void ListDependencies(ModuleList* list) override {}
+
+ private:
+  std::set<OpCode> supported_opcodes_{};
+};
+
+class TestHciLayer : public HciLayer {
+ public:
+  TestHciLayer() {
+    RegisterEventHandler(EventCode::COMMAND_COMPLETE,
+                         base::Bind(&TestHciLayer::CommandCompleteCallback, common::Unretained(this)), nullptr);
+    RegisterEventHandler(EventCode::COMMAND_STATUS,
+                         base::Bind(&TestHciLayer::CommandStatusCallback, common::Unretained(this)), nullptr);
+  }
+
+  void EnqueueCommand(std::unique_ptr<CommandPacketBuilder> command,
+                      common::OnceCallback<void(CommandStatusView)> on_status, os::Handler* handler) override {
+    command_queue_.push_back(std::move(command));
+    command_status_callbacks.push_back(std::move(on_status));
+    if (command_promise_ != nullptr) {
+      command_promise_->set_value(command_queue_.size());
+      command_promise_.reset();
+    }
+  }
+
+  void EnqueueCommand(std::unique_ptr<CommandPacketBuilder> command,
+                      common::OnceCallback<void(CommandCompleteView)> on_complete, os::Handler* handler) override {
+    command_queue_.push_back(std::move(command));
+    command_complete_callbacks.push_back(std::move(on_complete));
+    if (command_promise_ != nullptr) {
+      command_promise_->set_value(command_queue_.size());
+      command_promise_.reset();
+    }
+  }
+
+  std::future<size_t> GetCommandFuture() {
+    ASSERT_LOG(command_promise_ == nullptr, "Promises promises ... Only one at a time");
+    command_promise_ = std::make_unique<std::promise<size_t>>();
+    return command_promise_->get_future();
+  }
+
+  std::unique_ptr<CommandPacketBuilder> GetLastCommand() {
+    ASSERT(!command_queue_.empty());
+    auto last = std::move(command_queue_.front());
+    command_queue_.pop_front();
+    return last;
+  }
+
+  ConnectionManagementCommandView GetCommandPacket(OpCode op_code) {
+    auto packet_view = GetPacketView(GetLastCommand());
+    CommandPacketView command_packet_view = CommandPacketView::Create(packet_view);
+    ConnectionManagementCommandView command = ConnectionManagementCommandView::Create(command_packet_view);
+    ASSERT(command.IsValid());
+    EXPECT_EQ(command.GetOpCode(), op_code);
+
+    return command;
+  }
+
+  void RegisterEventHandler(EventCode event_code, common::Callback<void(EventPacketView)> event_handler,
+                            os::Handler* handler) override {
+    registered_events_[event_code] = event_handler;
+  }
+
+  void RegisterLeEventHandler(SubeventCode subevent_code, common::Callback<void(LeMetaEventView)> event_handler,
+                              os::Handler* handler) override {
+    registered_le_events_[subevent_code] = event_handler;
+  }
+
+  void IncomingEvent(std::unique_ptr<EventPacketBuilder> event_builder) {
+    auto packet = GetPacketView(std::move(event_builder));
+    EventPacketView event = EventPacketView::Create(packet);
+    ASSERT_TRUE(event.IsValid());
+    EventCode event_code = event.GetEventCode();
+    ASSERT_TRUE(registered_events_.find(event_code) != registered_events_.end()) << EventCodeText(event_code);
+    registered_events_[event_code].Run(event);
+  }
+
+  void IncomingLeMetaEvent(std::unique_ptr<LeMetaEventBuilder> event_builder) {
+    auto packet = GetPacketView(std::move(event_builder));
+    EventPacketView event = EventPacketView::Create(packet);
+    LeMetaEventView meta_event_view = LeMetaEventView::Create(event);
+    ASSERT_TRUE(meta_event_view.IsValid());
+    SubeventCode subevent_code = meta_event_view.GetSubeventCode();
+    ASSERT_TRUE(registered_le_events_.find(subevent_code) != registered_le_events_.end())
+        << SubeventCodeText(subevent_code);
+    registered_le_events_[subevent_code].Run(meta_event_view);
+  }
+
+  void CommandCompleteCallback(EventPacketView event) {
+    CommandCompleteView complete_view = CommandCompleteView::Create(event);
+    ASSERT(complete_view.IsValid());
+    std::move(command_complete_callbacks.front()).Run(complete_view);
+    command_complete_callbacks.pop_front();
+  }
+
+  void CommandStatusCallback(EventPacketView event) {
+    CommandStatusView status_view = CommandStatusView::Create(event);
+    ASSERT(status_view.IsValid());
+    std::move(command_status_callbacks.front()).Run(status_view);
+    command_status_callbacks.pop_front();
+  }
+
+  void ListDependencies(ModuleList* list) override {}
+  void Start() override {}
+  void Stop() override {}
+
+ private:
+  std::map<EventCode, common::Callback<void(EventPacketView)>> registered_events_;
+  std::map<SubeventCode, common::Callback<void(LeMetaEventView)>> registered_le_events_;
+  std::list<base::OnceCallback<void(CommandCompleteView)>> command_complete_callbacks;
+  std::list<base::OnceCallback<void(CommandStatusView)>> command_status_callbacks;
+
+  std::list<std::unique_ptr<CommandPacketBuilder>> command_queue_;
+  mutable std::mutex mutex_;
+  std::unique_ptr<std::promise<size_t>> command_promise_{};
+};
+
+class LeAdvertisingManagerTest : public ::testing::Test {
+ protected:
+  void SetUp() override {
+    test_hci_layer_ = new TestHciLayer;  // Ownership is transferred to registry
+    test_controller_ = new TestController;
+    test_controller_->AddSupported(param_opcode_);
+    fake_registry_.InjectTestModule(&HciLayer::Factory, test_hci_layer_);
+    fake_registry_.InjectTestModule(&Controller::Factory, test_controller_);
+    client_handler_ = fake_registry_.GetTestModuleHandler(&HciLayer::Factory);
+    ASSERT_NE(client_handler_, nullptr);
+    test_controller_->num_advertisers = 1;
+    fake_registry_.Start<LeAdvertisingManager>(&thread_);
+    le_advertising_manager_ =
+        static_cast<LeAdvertisingManager*>(fake_registry_.GetModuleUnderTest(&LeAdvertisingManager::Factory));
+  }
+
+  void TearDown() override {
+    fake_registry_.SynchronizeModuleHandler(&LeAdvertisingManager::Factory, std::chrono::milliseconds(20));
+    fake_registry_.StopAll();
+  }
+
+  TestModuleRegistry fake_registry_;
+  TestHciLayer* test_hci_layer_ = nullptr;
+  TestController* test_controller_ = nullptr;
+  os::Thread& thread_ = fake_registry_.GetTestThread();
+  LeAdvertisingManager* le_advertising_manager_ = nullptr;
+  os::Handler* client_handler_ = nullptr;
+
+  const common::Callback<void(Address, AddressType)> scan_callback =
+      common::Bind(&LeAdvertisingManagerTest::on_scan, common::Unretained(this));
+  const common::Callback<void(ErrorCode, uint8_t, uint8_t)> set_terminated_callback =
+      common::Bind(&LeAdvertisingManagerTest::on_set_terminated, common::Unretained(this));
+
+  std::future<Address> GetOnScanPromise() {
+    ASSERT_LOG(address_promise_ == nullptr, "Promises promises ... Only one at a time");
+    address_promise_ = std::make_unique<std::promise<Address>>();
+    return address_promise_->get_future();
+  }
+  void on_scan(Address address, AddressType address_type) {
+    if (address_promise_ == nullptr) {
+      return;
+    }
+    address_promise_->set_value(address);
+    address_promise_.reset();
+  }
+
+  std::future<ErrorCode> GetSetTerminatedPromise() {
+    ASSERT_LOG(set_terminated_promise_ == nullptr, "Promises promises ... Only one at a time");
+    set_terminated_promise_ = std::make_unique<std::promise<ErrorCode>>();
+    return set_terminated_promise_->get_future();
+  }
+  void on_set_terminated(ErrorCode error_code, uint8_t, uint8_t) {
+    if (set_terminated_promise_ != nullptr) {
+      return;
+    }
+    set_terminated_promise_->set_value(error_code);
+    set_terminated_promise_.reset();
+  }
+
+  std::unique_ptr<std::promise<Address>> address_promise_{};
+  std::unique_ptr<std::promise<ErrorCode>> set_terminated_promise_{};
+
+  OpCode param_opcode_{OpCode::LE_SET_ADVERTISING_PARAMETERS};
+};
+
+class LeAndroidHciAdvertisingManagerTest : public LeAdvertisingManagerTest {
+ protected:
+  void SetUp() override {
+    param_opcode_ = OpCode::LE_MULTI_ADVT;
+    LeAdvertisingManagerTest::SetUp();
+    test_controller_->num_advertisers = 3;
+  }
+};
+
+class LeExtendedAdvertisingManagerTest : public LeAdvertisingManagerTest {
+ protected:
+  void SetUp() override {
+    param_opcode_ = OpCode::LE_SET_EXTENDED_ADVERTISING_PARAMETERS;
+    LeAdvertisingManagerTest::SetUp();
+    test_controller_->num_advertisers = 5;
+  }
+};
+
+TEST_F(LeAdvertisingManagerTest, startup_teardown) {}
+
+TEST_F(LeAndroidHciAdvertisingManagerTest, startup_teardown) {}
+
+TEST_F(LeExtendedAdvertisingManagerTest, startup_teardown) {}
+
+TEST_F(LeAdvertisingManagerTest, create_advertiser_test) {
+  AdvertisingConfig advertising_config{};
+  advertising_config.event_type = AdvertisingEventType::ADV_IND;
+  advertising_config.address_type = AddressType::PUBLIC_DEVICE_ADDRESS;
+  std::vector<GapData> gap_data{};
+  GapData data_item{};
+  data_item.data_type_ = GapDataType::FLAGS;
+  data_item.data_ = {0x34};
+  gap_data.push_back(data_item);
+  data_item.data_type_ = GapDataType::COMPLETE_LOCAL_NAME;
+  data_item.data_ = {'r', 'a', 'n', 'd', 'o', 'm', ' ', 'd', 'e', 'v', 'i', 'c', 'e'};
+  gap_data.push_back(data_item);
+  advertising_config.advertisement = gap_data;
+  advertising_config.scan_response = gap_data;
+
+  auto next_command_future = test_hci_layer_->GetCommandFuture();
+  auto id = le_advertising_manager_->CreateAdvertiser(advertising_config, scan_callback, set_terminated_callback,
+                                                      client_handler_);
+  ASSERT_NE(LeAdvertisingManager::kInvalidId, id);
+  std::vector<OpCode> adv_opcodes = {
+      OpCode::LE_SET_ADVERTISING_PARAMETERS, OpCode::LE_SET_RANDOM_ADDRESS,     OpCode::LE_SET_SCAN_RESPONSE_DATA,
+      OpCode::LE_SET_ADVERTISING_DATA,       OpCode::LE_SET_ADVERTISING_ENABLE,
+  };
+  auto result = next_command_future.wait_for(std::chrono::duration(std::chrono::milliseconds(100)));
+  ASSERT_NE(std::future_status::timeout, result);
+  size_t num_commands = next_command_future.get();
+  for (size_t i = 0; i < adv_opcodes.size(); i++) {
+    auto packet = test_hci_layer_->GetCommandPacket(adv_opcodes[i]);
+    std::vector<uint8_t> success_vector{static_cast<uint8_t>(ErrorCode::SUCCESS)};
+    test_hci_layer_->IncomingEvent(
+        CommandCompleteBuilder::Create(uint8_t{1}, adv_opcodes[i], std::make_unique<RawBuilder>(success_vector)));
+    if (i < adv_opcodes.size() - 1 && --num_commands == 1) {
+      next_command_future = test_hci_layer_->GetCommandFuture();
+      result = next_command_future.wait_for(std::chrono::duration(std::chrono::milliseconds(100)));
+      ASSERT_NE(std::future_status::timeout, result);
+      num_commands = next_command_future.get();
+    }
+  }
+}
+
+TEST_F(LeAndroidHciAdvertisingManagerTest, create_advertiser_test) {
+  AdvertisingConfig advertising_config{};
+  advertising_config.event_type = AdvertisingEventType::ADV_IND;
+  advertising_config.address_type = AddressType::PUBLIC_DEVICE_ADDRESS;
+  std::vector<GapData> gap_data{};
+  GapData data_item{};
+  data_item.data_type_ = GapDataType::FLAGS;
+  data_item.data_ = {0x34};
+  gap_data.push_back(data_item);
+  data_item.data_type_ = GapDataType::COMPLETE_LOCAL_NAME;
+  data_item.data_ = {'r', 'a', 'n', 'd', 'o', 'm', ' ', 'd', 'e', 'v', 'i', 'c', 'e'};
+  gap_data.push_back(data_item);
+  advertising_config.advertisement = gap_data;
+  advertising_config.scan_response = gap_data;
+
+  auto next_command_future = test_hci_layer_->GetCommandFuture();
+  auto id = le_advertising_manager_->CreateAdvertiser(advertising_config, scan_callback, set_terminated_callback,
+                                                      client_handler_);
+  ASSERT_NE(LeAdvertisingManager::kInvalidId, id);
+  std::vector<SubOcf> sub_ocf = {
+      SubOcf::SET_PARAM, SubOcf::SET_DATA, SubOcf::SET_SCAN_RESP, SubOcf::SET_RANDOM_ADDR, SubOcf::SET_ENABLE,
+  };
+  auto result = next_command_future.wait_for(std::chrono::duration(std::chrono::milliseconds(100)));
+  ASSERT_NE(std::future_status::timeout, result);
+  size_t num_commands = next_command_future.get();
+  for (size_t i = 0; i < sub_ocf.size(); i++) {
+    auto packet = test_hci_layer_->GetCommandPacket(OpCode::LE_MULTI_ADVT);
+    std::vector<uint8_t> success_vector{static_cast<uint8_t>(ErrorCode::SUCCESS), static_cast<uint8_t>(sub_ocf[i])};
+    test_hci_layer_->IncomingEvent(CommandCompleteBuilder::Create(uint8_t{1}, OpCode::LE_MULTI_ADVT,
+                                                                  std::make_unique<RawBuilder>(success_vector)));
+    if (i < sub_ocf.size() - 1 && --num_commands == 1) {
+      next_command_future = test_hci_layer_->GetCommandFuture();
+      result = next_command_future.wait_for(std::chrono::duration(std::chrono::milliseconds(100)));
+      ASSERT_NE(std::future_status::timeout, result);
+      num_commands = next_command_future.get();
+    }
+  }
+}
+
+}  // namespace
+}  // namespace hci
+}  // namespace bluetooth
diff --git a/gd/hci/le_device.h b/gd/hci/le_device.h
new file mode 100644
index 0000000..35a620b
--- /dev/null
+++ b/gd/hci/le_device.h
@@ -0,0 +1,89 @@
+/******************************************************************************
+ *
+ *  Copyright 2019 The Android Open Source Project
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at:
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ ******************************************************************************/
+#pragma once
+
+#include "hci/device.h"
+
+namespace bluetooth::hci {
+
+/**
+ * TODO(optedoblivion): Build out AddressType getter/setter
+ */
+// enum AddressType {};
+
+/**
+ * A device representing a LE device.
+ *
+ * <p>This can be a LE only or a piece of a DUAL MODE device.
+ *
+ * <p>LE specific public address logic goes here.
+ */
+class LeDevice : public Device {
+ public:
+  void SetPublicAddress(Address public_address) {
+    public_address_ = public_address;
+  }
+
+  Address GetPublicAddress() {
+    return public_address_;
+  }
+
+  void SetIrk(uint8_t irk) {
+    irk_ = irk;
+    // TODO(optedoblivion): Set derived Address
+  }
+
+  uint8_t GetIrk() {
+    return irk_;
+  }
+
+ protected:
+  friend class DeviceDatabase;
+  // TODO(optedoblivion): How to set public address.  Do I set it when no IRK is known?
+  // Right now my thought is to do this:
+  // 1. Construct LeDevice with address of all 0s
+  // 2. IF NO IRK AND NO PRIVATE ADDRESS: (i.e. nothing in disk cache)
+  //  a. Hopefully pairing will happen
+  //  b. Pending successful pairing get the IRK and Private Address
+  //  c. Set Both to device.
+  //  (d). If available set IRK to the controller (later iteration)
+  // [#3 should indicate we have a bug]
+  // 3. IF YES IRK AND NO PRIVATE ADDRESS: (Partial Disk Cache Information)
+  //  a. Set IRK
+  //  b. Generate Private Address
+  //  c. Set Private Address to device
+  //  (d). If available set IRK to the controller (later iteration)
+  // 4. IF YES IRK AND YES PRIVATE ADDRESS: (i.e. Disk cache hit)
+  //  a. Construct with private address
+  //  b. Set IRK
+  //  (c). If available set IRK to the controller (later iteration)
+  // 5. IF NO IRK AND YES PRIVATE ADDRESS (we have a bug)
+  //  a1. -Construct with private address-
+  //  b. -Indicate we need to repair or query for IRK?-
+  //
+  //  or
+  //
+  //  a2. Don't use class
+  explicit LeDevice(Address address) : Device(address, DeviceType::LE), public_address_(), irk_(0) {}
+
+ private:
+  Address public_address_;
+  uint8_t irk_;
+};
+
+}  // namespace bluetooth::hci
diff --git a/gd/hci/le_report.h b/gd/hci/le_report.h
new file mode 100644
index 0000000..7dc075f
--- /dev/null
+++ b/gd/hci/le_report.h
@@ -0,0 +1,83 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+#pragma once
+
+#include <memory>
+
+#include "hci/hci_packets.h"
+
+namespace bluetooth::hci {
+
+class LeReport {
+ public:
+  explicit LeReport(const LeAdvertisingReport& advertisement)
+      : report_type_(ReportType::ADVERTISING_EVENT), advertising_event_type_(advertisement.event_type_),
+        address_(advertisement.address_), address_type_(advertisement.address_type_), rssi_(advertisement.rssi_),
+        gap_data_(advertisement.advertising_data_) {}
+  explicit LeReport(const LeDirectedAdvertisingReport& advertisement)
+      : report_type_(ReportType::DIRECTED_ADVERTISING_EVENT), address_(advertisement.address_),
+        rssi_(advertisement.rssi_) {}
+  explicit LeReport(const LeExtendedAdvertisingReport& advertisement)
+      : report_type_(ReportType::EXTENDED_ADVERTISING_EVENT), address_(advertisement.address_),
+        rssi_(advertisement.rssi_), gap_data_(advertisement.advertising_data_) {}
+  virtual ~LeReport() = default;
+
+  enum class ReportType {
+    ADVERTISING_EVENT = 1,
+    DIRECTED_ADVERTISING_EVENT = 2,
+    EXTENDED_ADVERTISING_EVENT = 3,
+  };
+  const ReportType report_type_;
+
+  ReportType GetReportType() const {
+    return report_type_;
+  }
+
+  // Advertising Event
+  const AdvertisingEventType advertising_event_type_{};
+  const Address address_{};
+  const AddressType address_type_{};
+  const uint8_t rssi_;
+  const std::vector<GapData> gap_data_{};
+};
+
+class DirectedLeReport : public LeReport {
+ public:
+  explicit DirectedLeReport(const LeDirectedAdvertisingReport& advertisement)
+      : LeReport(advertisement), direct_address_type_(advertisement.address_type_) {}
+  explicit DirectedLeReport(const LeExtendedAdvertisingReport& advertisement)
+      : LeReport(advertisement), direct_address_type_(advertisement.address_type_) {}
+
+  const DirectAdvertisingAddressType direct_address_type_{};
+};
+
+class ExtendedLeReport : public DirectedLeReport {
+ public:
+  explicit ExtendedLeReport(const LeExtendedAdvertisingReport& advertisement)
+      : DirectedLeReport(advertisement), connectable_(advertisement.connectable_), scannable_(advertisement.scannable_),
+        directed_(advertisement.directed_), scan_response_(advertisement.scan_response_),
+        complete_(advertisement.data_status_ == DataStatus::COMPLETE),
+        truncated_(advertisement.data_status_ == DataStatus::TRUNCATED) {}
+
+  // Extended
+  bool connectable_;
+  bool scannable_;
+  bool directed_;
+  bool scan_response_;
+  bool complete_;
+  bool truncated_;
+};
+}  // namespace bluetooth::hci
\ No newline at end of file
diff --git a/gd/hci/le_scanning_interface.h b/gd/hci/le_scanning_interface.h
new file mode 100644
index 0000000..97a6766
--- /dev/null
+++ b/gd/hci/le_scanning_interface.h
@@ -0,0 +1,50 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#pragma once
+
+#include "common/callback.h"
+#include "hci/hci_packets.h"
+#include "os/handler.h"
+#include "os/utils.h"
+
+namespace bluetooth {
+namespace hci {
+
+class LeScanningInterface {
+ public:
+  LeScanningInterface() = default;
+  virtual ~LeScanningInterface() = default;
+  DISALLOW_COPY_AND_ASSIGN(LeScanningInterface);
+
+  virtual void EnqueueCommand(std::unique_ptr<LeScanningCommandBuilder> command,
+                              common::OnceCallback<void(CommandCompleteView)> on_complete, os::Handler* handler) = 0;
+
+  virtual void EnqueueCommand(std::unique_ptr<LeScanningCommandBuilder> command,
+                              common::OnceCallback<void(CommandStatusView)> on_status, os::Handler* handler) = 0;
+
+  static constexpr hci::SubeventCode LeScanningEvents[] = {
+      hci::SubeventCode::SCAN_TIMEOUT,
+      hci::SubeventCode::ADVERTISING_REPORT,
+      hci::SubeventCode::DIRECTED_ADVERTISING_REPORT,
+      hci::SubeventCode::EXTENDED_ADVERTISING_REPORT,
+      hci::SubeventCode::PERIODIC_ADVERTISING_REPORT,
+      hci::SubeventCode::PERIODIC_ADVERTISING_SYNC_ESTABLISHED,
+      hci::SubeventCode::PERIODIC_ADVERTISING_SYNC_LOST,
+  };
+};
+}  // namespace hci
+}  // namespace bluetooth
diff --git a/gd/hci/le_scanning_manager.cc b/gd/hci/le_scanning_manager.cc
new file mode 100644
index 0000000..1562dd6
--- /dev/null
+++ b/gd/hci/le_scanning_manager.cc
@@ -0,0 +1,247 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+#include <memory>
+#include <mutex>
+#include <set>
+
+#include "hci/controller.h"
+#include "hci/hci_layer.h"
+#include "hci/hci_packets.h"
+#include "hci/le_scanning_interface.h"
+#include "hci/le_scanning_manager.h"
+#include "module.h"
+#include "os/handler.h"
+#include "os/log.h"
+
+namespace bluetooth {
+namespace hci {
+
+const ModuleFactory LeScanningManager::Factory = ModuleFactory([]() { return new LeScanningManager(); });
+
+enum class ScanApiType {
+  LE_4_0 = 1,
+  ANDROID_HCI = 2,
+  LE_5_0 = 3,
+};
+
+struct LeScanningManager::impl {
+  impl(Module* module) : module_(module), le_scanning_interface_(nullptr) {}
+
+  void start(os::Handler* handler, hci::HciLayer* hci_layer, hci::Controller* controller) {
+    module_handler_ = handler;
+    hci_layer_ = hci_layer;
+    controller_ = controller;
+    le_scanning_interface_ = hci_layer_->GetLeScanningInterface(
+        common::Bind(&LeScanningManager::impl::handle_scan_results, common::Unretained(this)), module_handler_);
+    if (controller_->IsSupported(OpCode::LE_SET_EXTENDED_SCAN_PARAMETERS)) {
+      api_type_ = ScanApiType::LE_5_0;
+    } else if (controller_->IsSupported(OpCode::LE_EXTENDED_SCAN_PARAMS)) {
+      api_type_ = ScanApiType::ANDROID_HCI;
+    } else {
+      api_type_ = ScanApiType::LE_4_0;
+    }
+    configure_scan();
+  }
+
+  void handle_scan_results(LeMetaEventView event) {
+    switch (event.GetSubeventCode()) {
+      case hci::SubeventCode::ADVERTISING_REPORT:
+        handle_advertising_report<LeAdvertisingReportView, LeAdvertisingReport, LeReport>(
+            LeAdvertisingReportView::Create(event));
+        break;
+      case hci::SubeventCode::DIRECTED_ADVERTISING_REPORT:
+        handle_advertising_report<LeDirectedAdvertisingReportView, LeDirectedAdvertisingReport, DirectedLeReport>(
+            LeDirectedAdvertisingReportView::Create(event));
+        break;
+      case hci::SubeventCode::EXTENDED_ADVERTISING_REPORT:
+        handle_advertising_report<LeExtendedAdvertisingReportView, LeExtendedAdvertisingReport, ExtendedLeReport>(
+            LeExtendedAdvertisingReportView::Create(event));
+        break;
+      case hci::SubeventCode::SCAN_TIMEOUT:
+        if (registered_callback_ != nullptr) {
+          registered_callback_->handler->Post(
+              common::BindOnce(&LeScanningManagerCallbacks::on_timeout, common::Unretained(registered_callback_)));
+          registered_callback_ = nullptr;
+        }
+        break;
+      default:
+        LOG_ALWAYS_FATAL("Unknown advertising subevent %s", hci::SubeventCodeText(event.GetSubeventCode()).c_str());
+    }
+  }
+
+  template <class EventType, class ReportStructType, class ReportType>
+  void handle_advertising_report(EventType event_view) {
+    if (registered_callback_ == nullptr) {
+      LOG_INFO("Dropping advertising event (no registered handler)");
+      return;
+    }
+    if (!event_view.IsValid()) {
+      LOG_INFO("Dropping invalid advertising event");
+      return;
+    }
+    std::vector<ReportStructType> report_vector = event_view.GetAdvertisingReports();
+    if (report_vector.empty()) {
+      LOG_INFO("Zero results in advertising event");
+      return;
+    }
+    std::vector<std::shared_ptr<LeReport>> param;
+    param.reserve(report_vector.size());
+    for (const ReportStructType& report : report_vector) {
+      param.push_back(std::shared_ptr<LeReport>(static_cast<LeReport*>(new ReportType(report))));
+    }
+    registered_callback_->handler->Post(common::BindOnce(&LeScanningManagerCallbacks::on_advertisements,
+                                                         common::Unretained(registered_callback_), param));
+  }
+
+  void configure_scan() {
+    switch (api_type_) {
+      case ScanApiType::LE_5_0:
+        le_scanning_interface_->EnqueueCommand(
+            hci::LeSetExtendedScanParametersBuilder::Create(LeScanType::ACTIVE, interval_ms_, window_ms_,
+                                                            own_address_type_, filter_policy_),
+            common::BindOnce(impl::check_status), module_handler_);
+        break;
+      case ScanApiType::ANDROID_HCI:
+        le_scanning_interface_->EnqueueCommand(
+            hci::LeExtendedScanParamsBuilder::Create(LeScanType::ACTIVE, interval_ms_, window_ms_, own_address_type_,
+                                                     filter_policy_),
+            common::BindOnce(impl::check_status), module_handler_);
+
+        break;
+      case ScanApiType::LE_4_0:
+        le_scanning_interface_->EnqueueCommand(
+            hci::LeSetScanParametersBuilder::Create(LeScanType::ACTIVE, interval_ms_, window_ms_, own_address_type_,
+                                                    filter_policy_),
+            common::BindOnce(impl::check_status), module_handler_);
+        break;
+    }
+  }
+
+  void start_scan(LeScanningManagerCallbacks* le_scanning_manager_callbacks) {
+    registered_callback_ = le_scanning_manager_callbacks;
+    switch (api_type_) {
+      case ScanApiType::LE_5_0:
+        le_scanning_interface_->EnqueueCommand(
+            hci::LeSetExtendedScanEnableBuilder::Create(Enable::ENABLED,
+                                                        FilterDuplicates::DISABLED /* filter duplicates */, 0, 0),
+            common::BindOnce(impl::check_status), module_handler_);
+        break;
+      case ScanApiType::ANDROID_HCI:
+      case ScanApiType::LE_4_0:
+        le_scanning_interface_->EnqueueCommand(
+            hci::LeSetScanEnableBuilder::Create(Enable::ENABLED, Enable::DISABLED /* filter duplicates */),
+            common::BindOnce(impl::check_status), module_handler_);
+        break;
+    }
+  }
+
+  void stop_scan(common::Callback<void()> on_stopped) {
+    if (registered_callback_ == nullptr) {
+      return;
+    }
+    registered_callback_->handler->Post(std::move(on_stopped));
+    switch (api_type_) {
+      case ScanApiType::LE_5_0:
+        le_scanning_interface_->EnqueueCommand(
+            hci::LeSetExtendedScanEnableBuilder::Create(Enable::DISABLED,
+                                                        FilterDuplicates::DISABLED /* filter duplicates */, 0, 0),
+            common::BindOnce(impl::check_status), module_handler_);
+        registered_callback_->handler = nullptr;
+        break;
+      case ScanApiType::ANDROID_HCI:
+      case ScanApiType::LE_4_0:
+        le_scanning_interface_->EnqueueCommand(
+            hci::LeSetScanEnableBuilder::Create(Enable::DISABLED, Enable::DISABLED /* filter duplicates */),
+            common::BindOnce(impl::check_status), module_handler_);
+        registered_callback_->handler = nullptr;
+        break;
+    }
+  }
+
+  ScanApiType api_type_;
+
+  LeScanningManagerCallbacks* registered_callback_;
+  Module* module_;
+  os::Handler* module_handler_;
+  hci::HciLayer* hci_layer_;
+  hci::Controller* controller_;
+  hci::LeScanningInterface* le_scanning_interface_;
+
+  uint32_t interval_ms_{1000};
+  uint16_t window_ms_{1000};
+  AddressType own_address_type_{AddressType::PUBLIC_DEVICE_ADDRESS};
+  LeSetScanningFilterPolicy filter_policy_{LeSetScanningFilterPolicy::ACCEPT_ALL};
+
+  static void check_status(CommandCompleteView view) {
+    switch (view.GetCommandOpCode()) {
+      case (OpCode::LE_SET_SCAN_ENABLE): {
+        auto status_view = LeSetScanEnableCompleteView::Create(view);
+        ASSERT(status_view.IsValid());
+        ASSERT(status_view.GetStatus() == ErrorCode::SUCCESS);
+      } break;
+      case (OpCode::LE_SET_EXTENDED_SCAN_ENABLE): {
+        auto status_view = LeSetExtendedScanEnableCompleteView::Create(view);
+        ASSERT(status_view.IsValid());
+        ASSERT(status_view.GetStatus() == ErrorCode::SUCCESS);
+      } break;
+      case (OpCode::LE_SET_SCAN_PARAMETERS): {
+        auto status_view = LeSetScanParametersCompleteView::Create(view);
+        ASSERT(status_view.IsValid());
+        ASSERT(status_view.GetStatus() == ErrorCode::SUCCESS);
+      } break;
+      case (OpCode::LE_EXTENDED_SCAN_PARAMS): {
+        auto status_view = LeExtendedScanParamsCompleteView::Create(view);
+        ASSERT(status_view.IsValid());
+        ASSERT(status_view.GetStatus() == ErrorCode::SUCCESS);
+      } break;
+      case (OpCode::LE_SET_EXTENDED_SCAN_PARAMETERS): {
+        auto status_view = LeSetExtendedScanParametersCompleteView::Create(view);
+        ASSERT(status_view.IsValid());
+        ASSERT(status_view.GetStatus() == ErrorCode::SUCCESS);
+      } break;
+      default:
+        LOG_ALWAYS_FATAL("Unhandled event %s", OpCodeText(view.GetCommandOpCode()).c_str());
+    }
+  }
+};
+
+LeScanningManager::LeScanningManager() {
+  pimpl_ = std::make_unique<impl>(this);
+}
+
+void LeScanningManager::ListDependencies(ModuleList* list) {
+  list->add<hci::HciLayer>();
+  list->add<hci::Controller>();
+}
+
+void LeScanningManager::Start() {
+  pimpl_->start(GetHandler(), GetDependency<hci::HciLayer>(), GetDependency<hci::Controller>());
+}
+
+void LeScanningManager::Stop() {
+  pimpl_.reset();
+}
+
+void LeScanningManager::StartScan(LeScanningManagerCallbacks* callbacks) {
+  GetHandler()->Post(common::Bind(&impl::start_scan, common::Unretained(pimpl_.get()), callbacks));
+}
+
+void LeScanningManager::StopScan(common::Callback<void()> on_stopped) {
+  GetHandler()->Post(common::Bind(&impl::stop_scan, common::Unretained(pimpl_.get()), on_stopped));
+}
+
+}  // namespace hci
+}  // namespace bluetooth
\ No newline at end of file
diff --git a/gd/hci/le_scanning_manager.h b/gd/hci/le_scanning_manager.h
new file mode 100644
index 0000000..1de0f08
--- /dev/null
+++ b/gd/hci/le_scanning_manager.h
@@ -0,0 +1,60 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+#pragma once
+
+#include <memory>
+
+#include "common/callback.h"
+#include "hci/hci_packets.h"
+#include "hci/le_report.h"
+#include "module.h"
+
+namespace bluetooth {
+namespace hci {
+
+class LeScanningManagerCallbacks {
+ public:
+  virtual ~LeScanningManagerCallbacks() = default;
+  virtual void on_advertisements(std::vector<std::shared_ptr<LeReport>>) = 0;
+  virtual void on_timeout() = 0;
+  os::Handler* handler;
+};
+
+class LeScanningManager : public bluetooth::Module {
+ public:
+  LeScanningManager();
+
+  void StartScan(LeScanningManagerCallbacks* callbacks);
+
+  void StopScan(common::Callback<void()> on_stopped);
+
+  static const ModuleFactory Factory;
+
+ protected:
+  void ListDependencies(ModuleList* list) override;
+
+  void Start() override;
+
+  void Stop() override;
+
+ private:
+  struct impl;
+  std::unique_ptr<impl> pimpl_;
+  DISALLOW_COPY_AND_ASSIGN(LeScanningManager);
+};
+
+}  // namespace hci
+}  // namespace bluetooth
\ No newline at end of file
diff --git a/gd/hci/le_scanning_manager_test.cc b/gd/hci/le_scanning_manager_test.cc
new file mode 100644
index 0000000..e5e461e
--- /dev/null
+++ b/gd/hci/le_scanning_manager_test.cc
@@ -0,0 +1,336 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "hci/le_scanning_manager.h"
+
+#include <algorithm>
+#include <chrono>
+#include <future>
+#include <map>
+
+#include <gmock/gmock.h>
+#include <gtest/gtest.h>
+
+#include "common/bind.h"
+#include "hci/address.h"
+#include "hci/controller.h"
+#include "hci/hci_layer.h"
+#include "os/thread.h"
+#include "packet/raw_builder.h"
+
+namespace bluetooth {
+namespace hci {
+namespace {
+
+using packet::kLittleEndian;
+using packet::PacketView;
+using packet::RawBuilder;
+
+PacketView<kLittleEndian> GetPacketView(std::unique_ptr<packet::BasePacketBuilder> packet) {
+  auto bytes = std::make_shared<std::vector<uint8_t>>();
+  BitInserter i(*bytes);
+  bytes->reserve(packet->size());
+  packet->Serialize(i);
+  return packet::PacketView<packet::kLittleEndian>(bytes);
+}
+
+class TestController : public Controller {
+ public:
+  bool IsSupported(OpCode op_code) const override {
+    return supported_opcodes_.count(op_code) == 1;
+  }
+
+  void AddSupported(OpCode op_code) {
+    supported_opcodes_.insert(op_code);
+  }
+
+ protected:
+  void Start() override {}
+  void Stop() override {}
+  void ListDependencies(ModuleList* list) override {}
+
+ private:
+  std::set<OpCode> supported_opcodes_{};
+};
+
+class TestHciLayer : public HciLayer {
+ public:
+  TestHciLayer() {
+    RegisterEventHandler(EventCode::COMMAND_COMPLETE,
+                         base::Bind(&TestHciLayer::CommandCompleteCallback, common::Unretained(this)), nullptr);
+    RegisterEventHandler(EventCode::COMMAND_STATUS,
+                         base::Bind(&TestHciLayer::CommandStatusCallback, common::Unretained(this)), nullptr);
+  }
+
+  void EnqueueCommand(std::unique_ptr<CommandPacketBuilder> command,
+                      common::OnceCallback<void(CommandStatusView)> on_status, os::Handler* handler) override {
+    command_queue_.push(std::move(command));
+    command_status_callbacks.push_front(std::move(on_status));
+    if (command_promise_ != nullptr) {
+      command_promise_->set_value();
+      command_promise_.reset();
+    }
+  }
+
+  void EnqueueCommand(std::unique_ptr<CommandPacketBuilder> command,
+                      common::OnceCallback<void(CommandCompleteView)> on_complete, os::Handler* handler) override {
+    command_queue_.push(std::move(command));
+    command_complete_callbacks.push_front(std::move(on_complete));
+    if (command_promise_ != nullptr) {
+      command_promise_->set_value();
+      command_promise_.reset();
+    }
+  }
+
+  std::future<void> GetCommandFuture() {
+    ASSERT_LOG(command_promise_ == nullptr, "Promises promises ... Only one at a time");
+    command_promise_ = std::make_unique<std::promise<void>>();
+    return command_promise_->get_future();
+  }
+
+  std::unique_ptr<CommandPacketBuilder> GetLastCommand() {
+    ASSERT(!command_queue_.empty());
+    auto last = std::move(command_queue_.front());
+    command_queue_.pop();
+    return last;
+  }
+
+  ConnectionManagementCommandView GetCommandPacket(OpCode op_code) {
+    auto packet_view = GetPacketView(GetLastCommand());
+    CommandPacketView command_packet_view = CommandPacketView::Create(packet_view);
+    ConnectionManagementCommandView command = ConnectionManagementCommandView::Create(command_packet_view);
+    ASSERT(command.IsValid());
+    EXPECT_EQ(command.GetOpCode(), op_code);
+
+    return command;
+  }
+
+  void RegisterEventHandler(EventCode event_code, common::Callback<void(EventPacketView)> event_handler,
+                            os::Handler* handler) override {
+    registered_events_[event_code] = event_handler;
+  }
+
+  void RegisterLeEventHandler(SubeventCode subevent_code, common::Callback<void(LeMetaEventView)> event_handler,
+                              os::Handler* handler) override {
+    registered_le_events_[subevent_code] = event_handler;
+  }
+
+  void IncomingEvent(std::unique_ptr<EventPacketBuilder> event_builder) {
+    auto packet = GetPacketView(std::move(event_builder));
+    EventPacketView event = EventPacketView::Create(packet);
+    ASSERT_TRUE(event.IsValid());
+    EventCode event_code = event.GetEventCode();
+    ASSERT_TRUE(registered_events_.find(event_code) != registered_events_.end()) << EventCodeText(event_code);
+    registered_events_[event_code].Run(event);
+  }
+
+  void IncomingLeMetaEvent(std::unique_ptr<LeMetaEventBuilder> event_builder) {
+    auto packet = GetPacketView(std::move(event_builder));
+    EventPacketView event = EventPacketView::Create(packet);
+    LeMetaEventView meta_event_view = LeMetaEventView::Create(event);
+    ASSERT_TRUE(meta_event_view.IsValid());
+    SubeventCode subevent_code = meta_event_view.GetSubeventCode();
+    ASSERT_TRUE(registered_le_events_.find(subevent_code) != registered_le_events_.end())
+        << SubeventCodeText(subevent_code);
+    registered_le_events_[subevent_code].Run(meta_event_view);
+  }
+
+  void CommandCompleteCallback(EventPacketView event) {
+    CommandCompleteView complete_view = CommandCompleteView::Create(event);
+    ASSERT(complete_view.IsValid());
+    std::move(command_complete_callbacks.front()).Run(complete_view);
+    command_complete_callbacks.pop_front();
+  }
+
+  void CommandStatusCallback(EventPacketView event) {
+    CommandStatusView status_view = CommandStatusView::Create(event);
+    ASSERT(status_view.IsValid());
+    std::move(command_status_callbacks.front()).Run(status_view);
+    command_status_callbacks.pop_front();
+  }
+
+  void ListDependencies(ModuleList* list) override {}
+  void Start() override {}
+  void Stop() override {}
+
+ private:
+  std::map<EventCode, common::Callback<void(EventPacketView)>> registered_events_;
+  std::map<SubeventCode, common::Callback<void(LeMetaEventView)>> registered_le_events_;
+  std::list<base::OnceCallback<void(CommandCompleteView)>> command_complete_callbacks;
+  std::list<base::OnceCallback<void(CommandStatusView)>> command_status_callbacks;
+
+  std::queue<std::unique_ptr<CommandPacketBuilder>> command_queue_;
+  mutable std::mutex mutex_;
+  std::unique_ptr<std::promise<void>> command_promise_{};
+};
+
+class LeScanningManagerTest : public ::testing::Test {
+ protected:
+  void SetUp() override {
+    test_hci_layer_ = new TestHciLayer;  // Ownership is transferred to registry
+    test_controller_ = new TestController;
+    test_controller_->AddSupported(param_opcode_);
+    fake_registry_.InjectTestModule(&HciLayer::Factory, test_hci_layer_);
+    fake_registry_.InjectTestModule(&Controller::Factory, test_controller_);
+    client_handler_ = fake_registry_.GetTestModuleHandler(&HciLayer::Factory);
+    ASSERT_NE(client_handler_, nullptr);
+    mock_callbacks_.handler = client_handler_;
+    std::future<void> config_future = test_hci_layer_->GetCommandFuture();
+    fake_registry_.Start<LeScanningManager>(&thread_);
+    le_scanning_manager =
+        static_cast<LeScanningManager*>(fake_registry_.GetModuleUnderTest(&LeScanningManager::Factory));
+    config_future.wait_for(std::chrono::duration(std::chrono::milliseconds(1000)));
+    HandleConfiguration();
+  }
+
+  void TearDown() override {
+    fake_registry_.SynchronizeModuleHandler(&LeScanningManager::Factory, std::chrono::milliseconds(20));
+    fake_registry_.StopAll();
+  }
+
+  virtual void HandleConfiguration() {
+    auto packet = test_hci_layer_->GetCommandPacket(OpCode::LE_SET_SCAN_PARAMETERS);
+    test_hci_layer_->IncomingEvent(LeSetScanParametersCompleteBuilder::Create(1, ErrorCode::SUCCESS));
+  }
+
+  TestModuleRegistry fake_registry_;
+  TestHciLayer* test_hci_layer_ = nullptr;
+  TestController* test_controller_ = nullptr;
+  os::Thread& thread_ = fake_registry_.GetTestThread();
+  LeScanningManager* le_scanning_manager = nullptr;
+  os::Handler* client_handler_ = nullptr;
+
+  class MockLeScanningManagerCallbacks : public LeScanningManagerCallbacks {
+   public:
+    MOCK_METHOD(void, on_advertisements, (std::vector<std::shared_ptr<LeReport>>), (override));
+    MOCK_METHOD(void, on_timeout, (), (override));
+  } mock_callbacks_;
+
+  OpCode param_opcode_{OpCode::LE_SET_ADVERTISING_PARAMETERS};
+};
+
+class LeAndroidHciScanningManagerTest : public LeScanningManagerTest {
+ protected:
+  void SetUp() override {
+    param_opcode_ = OpCode::LE_EXTENDED_SCAN_PARAMS;
+    LeScanningManagerTest::SetUp();
+  }
+
+  void HandleConfiguration() override {
+    auto packet = test_hci_layer_->GetCommandPacket(OpCode::LE_EXTENDED_SCAN_PARAMS);
+    test_hci_layer_->IncomingEvent(LeExtendedScanParamsCompleteBuilder::Create(1, ErrorCode::SUCCESS));
+  }
+};
+
+class LeExtendedScanningManagerTest : public LeScanningManagerTest {
+ protected:
+  void SetUp() override {
+    param_opcode_ = OpCode::LE_SET_EXTENDED_SCAN_PARAMETERS;
+    LeScanningManagerTest::SetUp();
+  }
+
+  void HandleConfiguration() override {
+    auto packet = test_hci_layer_->GetCommandPacket(OpCode::LE_SET_EXTENDED_SCAN_PARAMETERS);
+    test_hci_layer_->IncomingEvent(LeSetExtendedScanParametersCompleteBuilder::Create(1, ErrorCode::SUCCESS));
+  }
+};
+
+TEST_F(LeScanningManagerTest, startup_teardown) {}
+
+TEST_F(LeScanningManagerTest, start_scan_test) {
+  auto next_command_future = test_hci_layer_->GetCommandFuture();
+  le_scanning_manager->StartScan(&mock_callbacks_);
+
+  next_command_future.wait_for(std::chrono::duration(std::chrono::milliseconds(100)));
+  test_hci_layer_->IncomingEvent(LeSetScanEnableCompleteBuilder::Create(uint8_t{1}, ErrorCode::SUCCESS));
+
+  LeAdvertisingReport report{};
+  report.event_type_ = AdvertisingEventType::ADV_IND;
+  report.address_type_ = AddressType::PUBLIC_DEVICE_ADDRESS;
+  Address::FromString("12:34:56:78:9a:bc", report.address_);
+  std::vector<GapData> gap_data{};
+  GapData data_item{};
+  data_item.data_type_ = GapDataType::FLAGS;
+  data_item.data_ = {0x34};
+  gap_data.push_back(data_item);
+  data_item.data_type_ = GapDataType::COMPLETE_LOCAL_NAME;
+  data_item.data_ = {'r', 'a', 'n', 'd', 'o', 'm', ' ', 'd', 'e', 'v', 'i', 'c', 'e'};
+  gap_data.push_back(data_item);
+  report.advertising_data_ = gap_data;
+
+  EXPECT_CALL(mock_callbacks_, on_advertisements);
+
+  test_hci_layer_->IncomingLeMetaEvent(LeAdvertisingReportBuilder::Create({report}));
+}
+
+TEST_F(LeAndroidHciScanningManagerTest, start_scan_test) {
+  auto next_command_future = test_hci_layer_->GetCommandFuture();
+  le_scanning_manager->StartScan(&mock_callbacks_);
+
+  next_command_future.wait_for(std::chrono::duration(std::chrono::milliseconds(100)));
+  test_hci_layer_->IncomingEvent(LeSetScanEnableCompleteBuilder::Create(uint8_t{1}, ErrorCode::SUCCESS));
+
+  LeAdvertisingReport report{};
+  report.event_type_ = AdvertisingEventType::ADV_IND;
+  report.address_type_ = AddressType::PUBLIC_DEVICE_ADDRESS;
+  Address::FromString("12:34:56:78:9a:bc", report.address_);
+  std::vector<GapData> gap_data{};
+  GapData data_item{};
+  data_item.data_type_ = GapDataType::FLAGS;
+  data_item.data_ = {0x34};
+  gap_data.push_back(data_item);
+  data_item.data_type_ = GapDataType::COMPLETE_LOCAL_NAME;
+  data_item.data_ = {'r', 'a', 'n', 'd', 'o', 'm', ' ', 'd', 'e', 'v', 'i', 'c', 'e'};
+  gap_data.push_back(data_item);
+  report.advertising_data_ = gap_data;
+
+  EXPECT_CALL(mock_callbacks_, on_advertisements);
+
+  test_hci_layer_->IncomingLeMetaEvent(LeAdvertisingReportBuilder::Create({report}));
+}
+
+TEST_F(LeExtendedScanningManagerTest, start_scan_test) {
+  auto next_command_future = test_hci_layer_->GetCommandFuture();
+  le_scanning_manager->StartScan(&mock_callbacks_);
+
+  next_command_future.wait_for(std::chrono::duration(std::chrono::milliseconds(100)));
+  auto packet = test_hci_layer_->GetCommandPacket(OpCode::LE_SET_EXTENDED_SCAN_ENABLE);
+
+  test_hci_layer_->IncomingEvent(LeSetScanEnableCompleteBuilder::Create(uint8_t{1}, ErrorCode::SUCCESS));
+
+  LeExtendedAdvertisingReport report{};
+  report.connectable_ = 1;
+  report.scannable_ = 1;
+  report.address_type_ = DirectAdvertisingAddressType::PUBLIC_DEVICE_ADDRESS;
+  Address::FromString("12:34:56:78:9a:bc", report.address_);
+  std::vector<GapData> gap_data{};
+  GapData data_item{};
+  data_item.data_type_ = GapDataType::FLAGS;
+  data_item.data_ = {0x34};
+  gap_data.push_back(data_item);
+  data_item.data_type_ = GapDataType::COMPLETE_LOCAL_NAME;
+  data_item.data_ = {'r', 'a', 'n', 'd', 'o', 'm', ' ', 'd', 'e', 'v', 'i', 'c', 'e'};
+  gap_data.push_back(data_item);
+  report.advertising_data_ = gap_data;
+
+  EXPECT_CALL(mock_callbacks_, on_advertisements);
+
+  test_hci_layer_->IncomingLeMetaEvent(LeExtendedAdvertisingReportBuilder::Create({report}));
+}
+
+}  // namespace
+}  // namespace hci
+}  // namespace bluetooth
diff --git a/gd/hci/le_security_interface.h b/gd/hci/le_security_interface.h
new file mode 100644
index 0000000..13c3ef3
--- /dev/null
+++ b/gd/hci/le_security_interface.h
@@ -0,0 +1,46 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#pragma once
+
+#include "common/callback.h"
+#include "hci/hci_packets.h"
+#include "os/handler.h"
+#include "os/utils.h"
+
+namespace bluetooth {
+namespace hci {
+
+class LeSecurityInterface {
+ public:
+  LeSecurityInterface() = default;
+  virtual ~LeSecurityInterface() = default;
+  DISALLOW_COPY_AND_ASSIGN(LeSecurityInterface);
+
+  virtual void EnqueueCommand(std::unique_ptr<LeSecurityCommandBuilder> command,
+                              common::OnceCallback<void(CommandCompleteView)> on_complete, os::Handler* handler) = 0;
+
+  virtual void EnqueueCommand(std::unique_ptr<LeSecurityCommandBuilder> command,
+                              common::OnceCallback<void(CommandStatusView)> on_status, os::Handler* handler) = 0;
+
+  static constexpr hci::SubeventCode LeSecurityEvents[] = {
+      hci::SubeventCode::LONG_TERM_KEY_REQUEST,
+      hci::SubeventCode::READ_LOCAL_P256_PUBLIC_KEY_COMPLETE,
+      hci::SubeventCode::GENERATE_DHKEY_COMPLETE,
+  };
+};
+}  // namespace hci
+}  // namespace bluetooth
diff --git a/gd/hci/security_interface.h b/gd/hci/security_interface.h
new file mode 100644
index 0000000..efb20d0
--- /dev/null
+++ b/gd/hci/security_interface.h
@@ -0,0 +1,49 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#pragma once
+
+#include "common/callback.h"
+#include "hci/hci_packets.h"
+#include "os/utils.h"
+
+namespace bluetooth {
+namespace hci {
+
+class SecurityInterface {
+ public:
+  SecurityInterface() = default;
+  virtual ~SecurityInterface() = default;
+  DISALLOW_COPY_AND_ASSIGN(SecurityInterface);
+
+  virtual void EnqueueCommand(std::unique_ptr<SecurityCommandBuilder> command,
+                              common::OnceCallback<void(CommandCompleteView)> on_complete, os::Handler* handler) = 0;
+
+  virtual void EnqueueCommand(std::unique_ptr<SecurityCommandBuilder> command,
+                              common::OnceCallback<void(CommandStatusView)> on_status, os::Handler* handler) = 0;
+
+  static constexpr hci::EventCode SecurityEvents[] = {
+      hci::EventCode::ENCRYPTION_CHANGE,         hci::EventCode::CHANGE_CONNECTION_LINK_KEY_COMPLETE,
+      hci::EventCode::MASTER_LINK_KEY_COMPLETE,  hci::EventCode::RETURN_LINK_KEYS,
+      hci::EventCode::PIN_CODE_REQUEST,          hci::EventCode::LINK_KEY_REQUEST,
+      hci::EventCode::LINK_KEY_NOTIFICATION,     hci::EventCode::ENCRYPTION_KEY_REFRESH_COMPLETE,
+      hci::EventCode::IO_CAPABILITY_REQUEST,     hci::EventCode::IO_CAPABILITY_RESPONSE,
+      hci::EventCode::REMOTE_OOB_DATA_REQUEST,   hci::EventCode::SIMPLE_PAIRING_COMPLETE,
+      hci::EventCode::USER_PASSKEY_NOTIFICATION, hci::EventCode::KEYPRESS_NOTIFICATION,
+  };
+};
+}  // namespace hci
+}  // namespace bluetooth
diff --git a/gd/l2cap/Android.bp b/gd/l2cap/Android.bp
index 07808f5..ee86f6e 100644
--- a/gd/l2cap/Android.bp
+++ b/gd/l2cap/Android.bp
@@ -1,7 +1,71 @@
 filegroup {
+    name: "BluetoothL2capSources",
+    srcs: [
+        "fcs.cc",
+        "classic/dynamic_channel.cc",
+        "classic/dynamic_channel_manager.cc",
+        "classic/dynamic_channel_service.cc",
+        "classic/fixed_channel.cc",
+        "classic/fixed_channel_manager.cc",
+        "classic/fixed_channel_service.cc",
+        "classic/internal/dynamic_channel_allocator.cc",
+        "classic/internal/dynamic_channel_impl.cc",
+        "classic/internal/dynamic_channel_service_manager_impl.cc",
+        "classic/internal/fixed_channel_impl.cc",
+        "classic/internal/fixed_channel_service_manager_impl.cc",
+        "classic/internal/link.cc",
+        "classic/internal/link_manager.cc",
+        "classic/internal/signalling_manager.cc",
+        "classic/l2cap_classic_module.cc",
+        "internal/scheduler_fifo.cc",
+        "le/internal/fixed_channel_impl.cc",
+        "le/internal/fixed_channel_service_manager_impl.cc",
+        "le/internal/link_manager.cc",
+        "le/fixed_channel.cc",
+        "le/fixed_channel_manager.cc",
+        "le/fixed_channel_service.cc",
+        "le/l2cap_le_module.cc",
+    ],
+}
+
+filegroup {
     name: "BluetoothL2capTestSources",
     srcs: [
+        "classic/internal/dynamic_channel_allocator_test.cc",
+        "classic/internal/dynamic_channel_impl_test.cc",
+        "classic/internal/dynamic_channel_service_manager_test.cc",
+        "classic/internal/fixed_channel_impl_test.cc",
+        "classic/internal/fixed_channel_service_manager_test.cc",
+        "classic/internal/link_manager_test.cc",
+        "classic/internal/signalling_manager_test.cc",
+        "internal/fixed_channel_allocator_test.cc",
+        "internal/scheduler_fifo_test.cc",
         "l2cap_packet_test.cc",
-        "fcs.cc",
+        "le/internal/fixed_channel_impl_test.cc",
+        "le/internal/fixed_channel_service_manager_test.cc",
+        "le/internal/link_manager_test.cc",
+        "signal_id_test.cc",
+    ],
+}
+
+filegroup {
+    name: "BluetoothFacade_l2cap_layer",
+    srcs: [
+        "classic/facade.cc",
+    ],
+}
+
+filegroup {
+    name: "BluetoothCertSource_l2cap_layer",
+    srcs: [
+        "classic/cert/cert.cc",
+    ],
+}
+
+filegroup {
+    name: "BluetoothL2capFuzzTestSources",
+    srcs: [
+        "classic/internal/dynamic_channel_allocator_fuzz_test.cc",
+        "l2cap_packet_fuzz_test.cc",
     ],
 }
diff --git a/gd/l2cap/cid.h b/gd/l2cap/cid.h
new file mode 100644
index 0000000..9a21abb
--- /dev/null
+++ b/gd/l2cap/cid.h
@@ -0,0 +1,40 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#pragma once
+
+#include <cstdint>
+
+namespace bluetooth {
+namespace l2cap {
+
+using Cid = uint16_t;
+
+constexpr Cid kInvalidCid = 0;
+constexpr Cid kFirstFixedChannel = 1;
+constexpr Cid kLastFixedChannel = 63;
+constexpr Cid kFirstDynamicChannel = kLastFixedChannel + 1;
+constexpr Cid kLastDynamicChannel = (uint16_t)(0xffff);
+
+constexpr Cid kClassicSignallingCid = 1;
+constexpr Cid kConnectionlessCid = 2;
+constexpr Cid kLeAttributeCid = 4;
+constexpr Cid kLeSignallingCid = 5;
+constexpr Cid kSmpCid = 6;
+constexpr Cid kSmpBrCid = 7;
+
+}  // namespace l2cap
+}  // namespace bluetooth
diff --git a/gd/l2cap/classic/cert/api.proto b/gd/l2cap/classic/cert/api.proto
new file mode 100644
index 0000000..a470b23
--- /dev/null
+++ b/gd/l2cap/classic/cert/api.proto
@@ -0,0 +1,64 @@
+syntax = "proto3";
+
+package bluetooth.l2cap.classic.cert;
+
+import "google/protobuf/empty.proto";
+import "facade/common.proto";
+
+service L2capModuleCert {
+  rpc SendL2capPacket(L2capPacket) returns (google.protobuf.Empty) {}
+  rpc FetchL2capData(facade.EventStreamRequest) returns (stream L2capPacket) {}
+  rpc FetchConnectionComplete(facade.EventStreamRequest) returns (stream ConnectionCompleteEvent) {}
+  rpc SetOnIncomingConnectionRequest(SetOnIncomingConnectionRequestRequest)
+      returns (SetOnIncomingConnectionRequestResponse) {}
+  rpc DisconnectLink(DisconnectLinkRequest) returns (google.protobuf.Empty) {}
+  rpc SendConnectionRequest(ConnectionRequest) returns (google.protobuf.Empty) {}
+  rpc SendConfigurationRequest(ConfigurationRequest) returns (SendConfigurationRequestResult) {}
+  rpc SendDisconnectionRequest(DisconnectionRequest) returns (google.protobuf.Empty) {}
+  rpc FetchOpenedChannels(FetchOpenedChannelsRequest) returns (FetchOpenedChannelsResponse) {}
+}
+
+message L2capPacket {
+  facade.BluetoothAddress remote = 1;
+  uint32 channel = 2;
+  bytes payload = 3;
+}
+
+message ConnectionCompleteEvent {
+  facade.BluetoothAddress remote = 1;
+}
+
+message SetOnIncomingConnectionRequestRequest {
+  bool accept = 1;
+}
+
+message SetOnIncomingConnectionRequestResponse {}
+
+message DisconnectLinkRequest {
+  facade.BluetoothAddress remote = 1;
+}
+
+message ConnectionRequest {
+  facade.BluetoothAddress remote = 1;
+  uint32 psm = 2;
+  uint32 scid = 3;
+}
+
+message ConfigurationRequest {
+  uint32 scid = 1;
+}
+
+message SendConfigurationRequestResult {}
+
+message DisconnectionRequest {
+  facade.BluetoothAddress remote = 1;
+  uint32 dcid = 2;
+  uint32 scid = 3;
+}
+
+message FetchOpenedChannelsRequest {}
+
+message FetchOpenedChannelsResponse {
+  repeated uint32 scid = 1;
+  repeated uint32 dcid = 2;
+}
\ No newline at end of file
diff --git a/gd/l2cap/classic/cert/cert.cc b/gd/l2cap/classic/cert/cert.cc
new file mode 100644
index 0000000..26c41ef
--- /dev/null
+++ b/gd/l2cap/classic/cert/cert.cc
@@ -0,0 +1,343 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "l2cap/classic/cert/cert.h"
+
+#include <cstdint>
+#include <memory>
+#include <mutex>
+#include <queue>
+#include <unordered_map>
+
+#include "common/blocking_queue.h"
+#include "grpc/grpc_event_stream.h"
+#include "hci/acl_manager.h"
+#include "hci/cert/cert.h"
+#include "hci/hci_packets.h"
+#include "l2cap/classic/cert/api.grpc.pb.h"
+#include "l2cap/classic/l2cap_classic_module.h"
+#include "l2cap/l2cap_packets.h"
+#include "os/log.h"
+#include "packet/raw_builder.h"
+
+using ::grpc::ServerAsyncResponseWriter;
+using ::grpc::ServerAsyncWriter;
+using ::grpc::ServerContext;
+
+using ::bluetooth::facade::EventStreamRequest;
+using ::bluetooth::packet::RawBuilder;
+
+using ::bluetooth::l2cap::classic::cert::ConnectionCompleteEvent;
+using ::bluetooth::l2cap::classic::cert::L2capPacket;
+
+namespace bluetooth {
+namespace l2cap {
+namespace classic {
+namespace cert {
+
+using namespace facade;
+
+class L2capModuleCertService : public L2capModuleCert::Service {
+ public:
+  L2capModuleCertService(hci::AclManager* acl_manager, os::Handler* facade_handler)
+      : handler_(facade_handler), acl_manager_(acl_manager) {
+    ASSERT(handler_ != nullptr);
+    acl_manager_->RegisterCallbacks(&acl_callbacks, handler_);
+  }
+
+  class ConnectionCompleteCallback
+      : public grpc::GrpcEventStreamCallback<ConnectionCompleteEvent, ConnectionCompleteEvent> {
+   public:
+    void OnWriteResponse(ConnectionCompleteEvent* response, const ConnectionCompleteEvent& event) override {
+      response->CopyFrom(event);
+    }
+
+  } connection_complete_callback_;
+  ::bluetooth::grpc::GrpcEventStream<ConnectionCompleteEvent, ConnectionCompleteEvent> connection_complete_stream_{
+      &connection_complete_callback_};
+
+  ::grpc::Status FetchConnectionComplete(::grpc::ServerContext* context,
+                                         const ::bluetooth::facade::EventStreamRequest* request,
+                                         ::grpc::ServerWriter<ConnectionCompleteEvent>* writer) override {
+    return connection_complete_stream_.HandleRequest(context, request, writer);
+  }
+
+  ::grpc::Status SetOnIncomingConnectionRequest(
+      ::grpc::ServerContext* context,
+      const ::bluetooth::l2cap::classic::cert::SetOnIncomingConnectionRequestRequest* request,
+      ::bluetooth::l2cap::classic::cert::SetOnIncomingConnectionRequestResponse* response) override {
+    accept_incoming_connection_ = request->accept();
+    return ::grpc::Status::OK;
+  }
+
+  bool accept_incoming_connection_ = true;
+
+  ::grpc::Status SendL2capPacket(::grpc::ServerContext* context, const L2capPacket* request,
+                                 ::google::protobuf::Empty* response) override {
+    std::unique_ptr<RawBuilder> packet = std::make_unique<RawBuilder>();
+    auto req_string = request->payload();
+    packet->AddOctets(std::vector<uint8_t>(req_string.begin(), req_string.end()));
+    std::unique_ptr<BasicFrameBuilder> l2cap_builder = BasicFrameBuilder::Create(request->channel(), std::move(packet));
+    outgoing_packet_queue_.push(std::move(l2cap_builder));
+    send_packet_from_queue();
+    return ::grpc::Status::OK;
+  }
+
+  static constexpr Cid kFirstDynamicChannelForIncomingRequest = kFirstDynamicChannel + 0x100;
+
+  ::grpc::Status SendConnectionRequest(::grpc::ServerContext* context, const cert::ConnectionRequest* request,
+                                       ::google::protobuf::Empty* response) override {
+    auto scid = request->scid();
+    if (last_connection_request_scid_ != kInvalidCid) {
+      return ::grpc::Status(::grpc::StatusCode::INVALID_ARGUMENT, "Another connection request is pending");
+    }
+    if (scid >= kFirstDynamicChannelForIncomingRequest) {
+      return ::grpc::Status(::grpc::StatusCode::INVALID_ARGUMENT, "Use scid < kFirstDynamicChannelForIncomingRequest");
+    }
+    for (const auto& cid_pair : open_channels_scid_dcid_) {
+      if (cid_pair.first == scid) {
+        return ::grpc::Status(::grpc::StatusCode::INVALID_ARGUMENT, "SCID already taken");
+      }
+    }
+    auto builder = ConnectionRequestBuilder::Create(1, request->psm(), scid);
+    auto l2cap_builder = BasicFrameBuilder::Create(1, std::move(builder));
+    outgoing_packet_queue_.push(std::move(l2cap_builder));
+    send_packet_from_queue();
+    last_connection_request_scid_ = scid;
+    return ::grpc::Status::OK;
+  }
+  Cid last_connection_request_scid_ = kInvalidCid;
+  Cid next_incoming_request_cid_ = kFirstDynamicChannelForIncomingRequest;
+
+  ::grpc::Status SendConfigurationRequest(
+      ::grpc::ServerContext* context, const ::bluetooth::l2cap::classic::cert::ConfigurationRequest* request,
+      ::bluetooth::l2cap::classic::cert::SendConfigurationRequestResult* response) override {
+    auto builder = ConfigurationRequestBuilder::Create(1, request->scid(), Continuation::END, {});
+    auto l2cap_builder = BasicFrameBuilder::Create(kClassicSignallingCid, std::move(builder));
+    outgoing_packet_queue_.push(std::move(l2cap_builder));
+    send_packet_from_queue();
+    return ::grpc::Status::OK;
+  }
+
+  ::grpc::Status SendDisconnectionRequest(::grpc::ServerContext* context, const cert::DisconnectionRequest* request,
+                                          ::google::protobuf::Empty* response) override {
+    auto builder = DisconnectionRequestBuilder::Create(3, request->dcid(), request->scid());
+    auto l2cap_builder = BasicFrameBuilder::Create(kClassicSignallingCid, std::move(builder));
+    outgoing_packet_queue_.push(std::move(l2cap_builder));
+    send_packet_from_queue();
+
+    return ::grpc::Status::OK;
+  }
+
+  ::grpc::Status FetchOpenedChannels(
+      ::grpc::ServerContext* context, const ::bluetooth::l2cap::classic::cert::FetchOpenedChannelsRequest* request,
+      ::bluetooth::l2cap::classic::cert::FetchOpenedChannelsResponse* response) override {
+    for (const auto& cid_pair : open_channels_scid_dcid_) {
+      response->mutable_scid()->Add(cid_pair.first);
+      response->mutable_dcid()->Add(cid_pair.second);
+    }
+    return ::grpc::Status::OK;
+  }
+  std::vector<std::pair<uint16_t, uint16_t>> open_channels_scid_dcid_;
+
+  std::unique_ptr<packet::BasePacketBuilder> enqueue_packet_to_acl() {
+    auto basic_frame_builder = std::move(outgoing_packet_queue_.front());
+    outgoing_packet_queue_.pop();
+    if (outgoing_packet_queue_.size() == 0) {
+      acl_connection_->GetAclQueueEnd()->UnregisterEnqueue();
+    }
+    return basic_frame_builder;
+  }
+
+  ::grpc::Status FetchL2capData(::grpc::ServerContext* context, const ::bluetooth::facade::EventStreamRequest* request,
+                                ::grpc::ServerWriter<L2capPacket>* writer) override {
+    return l2cap_stream_.HandleRequest(context, request, writer);
+  }
+
+  class L2capStreamCallback : public ::bluetooth::grpc::GrpcEventStreamCallback<L2capPacket, L2capPacket> {
+   public:
+    void OnWriteResponse(L2capPacket* response, const L2capPacket& event) override {
+      response->CopyFrom(event);
+    }
+
+  } l2cap_stream_callback_;
+  ::bluetooth::grpc::GrpcEventStream<L2capPacket, L2capPacket> l2cap_stream_{&l2cap_stream_callback_};
+
+  void on_incoming_packet() {
+    auto packet = acl_connection_->GetAclQueueEnd()->TryDequeue();
+    BasicFrameView basic_frame_view = BasicFrameView::Create(*packet);
+    ASSERT(basic_frame_view.IsValid());
+    L2capPacket l2cap_packet;
+    std::string data = std::string(packet->begin(), packet->end());
+    l2cap_packet.set_payload(data);
+    l2cap_packet.set_channel(basic_frame_view.GetChannelId());
+    l2cap_stream_.OnIncomingEvent(l2cap_packet);
+
+    if (basic_frame_view.GetChannelId() == kClassicSignallingCid) {
+      ControlView control_view = ControlView::Create(basic_frame_view.GetPayload());
+      ASSERT(control_view.IsValid());
+      handle_signalling_packet(control_view);
+    }
+  }
+
+  void send_packet_from_queue() {
+    if (outgoing_packet_queue_.size() == 1) {
+      acl_connection_->GetAclQueueEnd()->RegisterEnqueue(
+          handler_, common::Bind(&L2capModuleCertService::enqueue_packet_to_acl, common::Unretained(this)));
+    }
+  }
+
+  void handle_signalling_packet(ControlView control_view) {
+    auto code = control_view.GetCode();
+    switch (code) {
+      case CommandCode::CONNECTION_REQUEST: {
+        ConnectionRequestView view = ConnectionRequestView::Create(control_view);
+        ASSERT(view.IsValid());
+        auto builder = ConnectionResponseBuilder::Create(
+            view.GetIdentifier(), next_incoming_request_cid_, view.GetSourceCid(),
+            accept_incoming_connection_ ? ConnectionResponseResult::SUCCESS : ConnectionResponseResult::INVALID_CID,
+            ConnectionResponseStatus::NO_FURTHER_INFORMATION_AVAILABLE);
+        auto l2cap_builder = BasicFrameBuilder::Create(kClassicSignallingCid, std::move(builder));
+        outgoing_packet_queue_.push(std::move(l2cap_builder));
+        send_packet_from_queue();
+        open_channels_scid_dcid_.emplace_back(next_incoming_request_cid_, view.GetSourceCid());
+        next_incoming_request_cid_++;
+        break;
+      }
+      case CommandCode::CONNECTION_RESPONSE: {
+        ConnectionResponseView view = ConnectionResponseView::Create(control_view);
+        ASSERT(view.IsValid());
+        open_channels_scid_dcid_.emplace_back(last_connection_request_scid_, view.GetSourceCid());
+        last_connection_request_scid_ = kInvalidCid;
+        break;
+      }
+
+      case CommandCode::CONFIGURATION_REQUEST: {
+        ConfigurationRequestView view = ConfigurationRequestView::Create(control_view);
+        ASSERT(view.IsValid());
+        auto builder =
+            ConfigurationResponseBuilder::Create(view.GetIdentifier(), view.GetDestinationCid(), Continuation::END,
+                                                 ConfigurationResponseResult::SUCCESS, {});
+        auto l2cap_builder = BasicFrameBuilder::Create(kClassicSignallingCid, std::move(builder));
+        outgoing_packet_queue_.push(std::move(l2cap_builder));
+        send_packet_from_queue();
+        break;
+      }
+      case CommandCode::INFORMATION_REQUEST: {
+        InformationRequestView information_request_view = InformationRequestView::Create(control_view);
+        if (!information_request_view.IsValid()) {
+          return;
+        }
+        auto type = information_request_view.GetInfoType();
+        switch (type) {
+          case InformationRequestInfoType::CONNECTIONLESS_MTU: {
+            auto response = InformationResponseConnectionlessMtuBuilder::Create(
+                information_request_view.GetIdentifier(), InformationRequestResult::NOT_SUPPORTED, 0);
+            auto l2cap_builder = BasicFrameBuilder::Create(kClassicSignallingCid, std::move(response));
+            outgoing_packet_queue_.push(std::move(l2cap_builder));
+            send_packet_from_queue();
+            break;
+          }
+          case InformationRequestInfoType::EXTENDED_FEATURES_SUPPORTED: {
+            // TODO: implement this response
+            auto response = InformationResponseExtendedFeaturesBuilder::Create(information_request_view.GetIdentifier(),
+                                                                               InformationRequestResult::NOT_SUPPORTED,
+                                                                               0, 0, 0, 0, 0, 0, 0, 0, 0, 0);
+            auto l2cap_builder = BasicFrameBuilder::Create(kClassicSignallingCid, std::move(response));
+            outgoing_packet_queue_.push(std::move(l2cap_builder));
+            send_packet_from_queue();
+            break;
+          }
+          case InformationRequestInfoType::FIXED_CHANNELS_SUPPORTED: {
+            constexpr uint64_t kSignallingChannelMask = 0x02;
+            auto response = InformationResponseFixedChannelsBuilder::Create(
+                information_request_view.GetIdentifier(), InformationRequestResult::SUCCESS, kSignallingChannelMask);
+            auto l2cap_builder = BasicFrameBuilder::Create(kClassicSignallingCid, std::move(response));
+            outgoing_packet_queue_.push(std::move(l2cap_builder));
+            send_packet_from_queue();
+            break;
+          }
+        }
+        break;
+      }
+      default:
+        return;
+    }
+  }
+
+  std::queue<std::unique_ptr<BasePacketBuilder>> outgoing_packet_queue_;
+  ::bluetooth::os::Handler* handler_;
+  hci::AclManager* acl_manager_;
+  std::unique_ptr<hci::AclConnection> acl_connection_;
+
+  class AclCallbacks : public hci::ConnectionCallbacks {
+   public:
+    AclCallbacks(L2capModuleCertService* module) : module_(module) {}
+    void OnConnectSuccess(std::unique_ptr<hci::AclConnection> connection) override {
+      ConnectionCompleteEvent event;
+      event.mutable_remote()->set_address(connection->GetAddress().ToString());
+      module_->connection_complete_stream_.OnIncomingEvent(event);
+      module_->acl_connection_ = std::move(connection);
+      module_->acl_connection_->RegisterDisconnectCallback(common::BindOnce([](hci::ErrorCode) {}), module_->handler_);
+      module_->acl_connection_->GetAclQueueEnd()->RegisterDequeue(
+          module_->handler_, common::Bind(&L2capModuleCertService::on_incoming_packet, common::Unretained(module_)));
+      dequeue_registered_ = true;
+    }
+    void OnConnectFail(hci::Address address, hci::ErrorCode reason) override {}
+
+    ~AclCallbacks() {
+      if (dequeue_registered_) {
+        module_->acl_connection_->GetAclQueueEnd()->UnregisterDequeue();
+      }
+    }
+
+    bool dequeue_registered_ = false;
+
+    L2capModuleCertService* module_;
+  } acl_callbacks{this};
+
+  std::mutex mutex_;
+};
+
+void L2capModuleCertModule::ListDependencies(ModuleList* list) {
+  ::bluetooth::grpc::GrpcFacadeModule::ListDependencies(list);
+  list->add<hci::AclManager>();
+  list->add<hci::HciLayer>();
+}
+
+void L2capModuleCertModule::Start() {
+  ::bluetooth::grpc::GrpcFacadeModule::Start();
+  GetDependency<hci::HciLayer>()->EnqueueCommand(hci::WriteScanEnableBuilder::Create(hci::ScanEnable::PAGE_SCAN_ONLY),
+                                                 common::BindOnce([](hci::CommandCompleteView) {}), GetHandler());
+  service_ = new L2capModuleCertService(GetDependency<hci::AclManager>(), GetHandler());
+}
+
+void L2capModuleCertModule::Stop() {
+  delete service_;
+  ::bluetooth::grpc::GrpcFacadeModule::Stop();
+}
+
+::grpc::Service* L2capModuleCertModule::GetService() const {
+  return service_;
+}
+
+const ModuleFactory L2capModuleCertModule::Factory =
+    ::bluetooth::ModuleFactory([]() { return new L2capModuleCertModule(); });
+
+}  // namespace cert
+}  // namespace classic
+}  // namespace l2cap
+}  // namespace bluetooth
diff --git a/gd/l2cap/classic/cert/cert.h b/gd/l2cap/classic/cert/cert.h
new file mode 100644
index 0000000..c8015d6
--- /dev/null
+++ b/gd/l2cap/classic/cert/cert.h
@@ -0,0 +1,31 @@
+#pragma once
+
+#include <grpc++/grpc++.h>
+
+#include "grpc/grpc_module.h"
+
+namespace bluetooth {
+namespace l2cap {
+namespace classic {
+namespace cert {
+
+class L2capModuleCertService;
+
+class L2capModuleCertModule : public ::bluetooth::grpc::GrpcFacadeModule {
+ public:
+  static const ModuleFactory Factory;
+
+  void ListDependencies(ModuleList* list) override;
+  void Start() override;
+  void Stop() override;
+
+  ::grpc::Service* GetService() const override;
+
+ private:
+  L2capModuleCertService* service_;
+};
+
+}  // namespace cert
+}  // namespace classic
+}  // namespace l2cap
+}  // namespace bluetooth
\ No newline at end of file
diff --git a/gd/l2cap/classic/cert/simple_l2cap_test.py b/gd/l2cap/classic/cert/simple_l2cap_test.py
new file mode 100644
index 0000000..d8a52cd
--- /dev/null
+++ b/gd/l2cap/classic/cert/simple_l2cap_test.py
@@ -0,0 +1,223 @@
+#!/usr/bin/env python3
+#
+#   Copyright 2019 - The Android Open Source Project
+#
+#   Licensed under the Apache License, Version 2.0 (the "License");
+#   you may not use this file except in compliance with the License.
+#   You may obtain a copy of the License at
+#
+#       http://www.apache.org/licenses/LICENSE-2.0
+#
+#   Unless required by applicable law or agreed to in writing, software
+#   distributed under the License is distributed on an "AS IS" BASIS,
+#   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+#   See the License for the specific language governing permissions and
+#   limitations under the License.
+from __future__ import print_function
+
+import os
+import sys
+sys.path.append(os.environ['ANDROID_BUILD_TOP'] + '/system/bt/gd')
+
+from cert.gd_base_test import GdBaseTestClass
+from cert import rootservice_pb2 as cert_rootservice_pb2
+from facade import common_pb2
+from facade import rootservice_pb2 as facade_rootservice_pb2
+from google.protobuf import empty_pb2
+from l2cap.classic import facade_pb2 as l2cap_facade_pb2
+from l2cap.classic.cert import api_pb2 as l2cap_cert_pb2
+
+import time
+
+ASYNC_OP_TIME_SECONDS = 1  # TODO: Use events to synchronize events instead
+
+class SimpleL2capTest(GdBaseTestClass):
+    def setup_test(self):
+        self.device_under_test = self.gd_devices[0]
+        self.cert_device = self.gd_cert_devices[0]
+        self.device_under_test.rootservice.StartStack(
+            facade_rootservice_pb2.StartStackRequest(
+                module_under_test=facade_rootservice_pb2.BluetoothModule.Value('L2CAP'),
+            )
+        )
+        self.cert_device.rootservice.StartStack(
+            cert_rootservice_pb2.StartStackRequest(
+                module_to_test=cert_rootservice_pb2.BluetoothModule.Value('L2CAP'),
+            )
+        )
+
+        self.device_under_test.wait_channel_ready()
+        self.cert_device.wait_channel_ready()
+
+        dut_address = self.device_under_test.controller_read_only_property.ReadLocalAddress(empty_pb2.Empty()).address
+        self.device_under_test.address = dut_address
+        cert_address = self.cert_device.controller_read_only_property.ReadLocalAddress(empty_pb2.Empty()).address
+        self.cert_device.address = cert_address
+
+        self.dut_address = common_pb2.BluetoothAddress(
+            address=self.device_under_test.address)
+        self.cert_address = common_pb2.BluetoothAddress(
+            address=self.cert_device.address)
+
+    def teardown_test(self):
+        self.device_under_test.rootservice.StopStack(
+            facade_rootservice_pb2.StopStackRequest()
+        )
+        self.cert_device.rootservice.StopStack(
+            cert_rootservice_pb2.StopStackRequest()
+        )
+
+    def test_connect_and_send_data(self):
+        self.device_under_test.l2cap.RegisterChannel(l2cap_facade_pb2.RegisterChannelRequest(channel=2))
+        self.device_under_test.l2cap.SetDynamicChannel(l2cap_facade_pb2.SetEnableDynamicChannelRequest(psm=0x01))
+        dut_packet_stream = self.device_under_test.l2cap.packet_stream
+        cert_packet_stream = self.cert_device.l2cap.packet_stream
+        cert_connection_stream = self.cert_device.l2cap.connection_complete_stream
+        dut_connection_stream = self.device_under_test.l2cap.connection_complete_stream
+        cert_connection_stream.subscribe()
+        dut_connection_stream.subscribe()
+        self.device_under_test.l2cap.Connect(self.cert_address)
+        cert_connection_stream.assert_event_occurs(
+            lambda device: device.remote == self.dut_address
+        )
+        cert_connection_stream.unsubscribe()
+        dut_connection_stream.assert_event_occurs(
+            lambda device: device.remote == self.cert_address
+        )
+        dut_connection_stream.unsubscribe()
+
+        self.cert_device.l2cap.SendConnectionRequest(l2cap_cert_pb2.ConnectionRequest(scid=0x101, psm=1))
+        time.sleep(ASYNC_OP_TIME_SECONDS)
+        open_channels = self.cert_device.l2cap.FetchOpenedChannels(l2cap_cert_pb2.FetchOpenedChannelsRequest())
+        cid = open_channels.dcid[0]
+        self.cert_device.l2cap.SendConfigurationRequest(l2cap_cert_pb2.ConfigurationRequest(scid=cid))
+        time.sleep(ASYNC_OP_TIME_SECONDS)
+
+        dut_packet_stream.subscribe()
+        cert_packet_stream.subscribe()
+
+        self.cert_device.l2cap.SendL2capPacket(l2cap_facade_pb2.L2capPacket(channel=2, payload=b"abc"))
+        dut_packet_stream.assert_event_occurs(
+            lambda packet: b"abc" in packet.payload
+        )
+        self.device_under_test.l2cap.SendL2capPacket(l2cap_facade_pb2.L2capPacket(channel=2, payload=b"123"))
+        cert_packet_stream.assert_event_occurs(
+            lambda packet: b"123" in packet.payload
+        )
+
+        self.cert_device.l2cap.SendL2capPacket(l2cap_facade_pb2.L2capPacket(channel=cid, payload=b"123"))
+        dut_packet_stream.assert_event_occurs(
+            lambda packet: b"123" in packet.payload
+        )
+
+        self.device_under_test.l2cap.SendDynamicChannelPacket(l2cap_facade_pb2.DynamicChannelPacket(psm=1, payload=b'abc'))
+        cert_packet_stream.assert_event_occurs(
+            lambda packet: b"abc" in packet.payload
+        )
+
+        self.cert_device.l2cap.SendDisconnectionRequest(l2cap_cert_pb2.DisconnectionRequest(dcid=0x40, scid=101))
+        time.sleep(ASYNC_OP_TIME_SECONDS)
+        dut_packet_stream.unsubscribe()
+        cert_packet_stream.unsubscribe()
+
+    def test_open_two_channels(self):
+        cert_connection_stream = self.cert_device.l2cap.connection_complete_stream
+        cert_connection_stream.subscribe()
+        self.device_under_test.l2cap.OpenChannel(l2cap_facade_pb2.OpenChannelRequest(remote=self.cert_address, psm=0x01))
+        self.device_under_test.l2cap.OpenChannel(l2cap_facade_pb2.OpenChannelRequest(remote=self.cert_address, psm=0x03))
+        cert_connection_stream.assert_event_occurs(
+            lambda device: device.remote == self.dut_address
+        )
+        cert_connection_stream.unsubscribe()
+        time.sleep(ASYNC_OP_TIME_SECONDS)
+        open_channels = self.cert_device.l2cap.FetchOpenedChannels(l2cap_cert_pb2.FetchOpenedChannelsRequest())
+        assert len(open_channels.dcid) == 2
+
+    def test_accept_disconnect(self):
+        """
+        L2CAP/COS/CED/BV-07-C
+        """
+        self.device_under_test.l2cap.OpenChannel(l2cap_facade_pb2.OpenChannelRequest(remote=self.cert_address, psm=0x01))
+        cert_connection_stream = self.cert_device.l2cap.connection_complete_stream
+        cert_connection_stream.subscribe()
+        self.device_under_test.l2cap.Connect(self.cert_address)
+        cert_connection_stream.assert_event_occurs(
+            lambda device: device.remote == self.dut_address
+        )
+        cert_connection_stream.unsubscribe()
+        time.sleep(ASYNC_OP_TIME_SECONDS)
+        cert_packet_stream = self.cert_device.l2cap.packet_stream
+        cert_packet_stream.subscribe()
+        open_channels = self.cert_device.l2cap.FetchOpenedChannels(l2cap_cert_pb2.FetchOpenedChannelsRequest())
+        cid = open_channels.dcid[0]
+        disconnection_request_packet = b"\x06\x01\x04\x00\x40\x00\x40\x01"
+        disconnection_response_packet = b"\x07\x01\x04\x00\x40\x00\x40\x01"
+        #TODO(b/143374372): Instead of hardcoding this, use packet builder
+        self.cert_device.l2cap.SendL2capPacket(l2cap_facade_pb2.L2capPacket(channel=1, payload=disconnection_request_packet))
+        cert_packet_stream.assert_event_occurs(
+            lambda packet: disconnection_response_packet in packet.payload
+        )
+        cert_packet_stream.unsubscribe()
+        time.sleep(ASYNC_OP_TIME_SECONDS)  # TODO(b/144186649): Remove this line
+
+    def test_basic_operation_request_connection(self):
+        """
+        L2CAP/COS/CED/BV-01-C [Request Connection]
+        Verify that the IUT is able to request the connection establishment for an L2CAP data channel and
+        initiate the configuration procedure.
+        """
+        cert_connection_stream = self.cert_device.l2cap.connection_complete_stream
+        cert_connection_stream.subscribe()
+        self.device_under_test.l2cap.OpenChannel(l2cap_facade_pb2.OpenChannelRequest(remote=self.cert_address, psm=0x01))
+        cert_connection_stream.assert_event_occurs(
+            lambda device: device.remote == self.dut_address
+        )
+        cert_connection_stream.unsubscribe()
+
+    def test_respond_to_echo_request(self):
+        """
+        L2CAP/COS/ECH/BV-01-C [Respond to Echo Request]
+        Verify that the IUT responds to an echo request.
+        """
+        self.device_under_test.l2cap.RegisterChannel(l2cap_facade_pb2.RegisterChannelRequest(channel=2))
+        cert_connection_stream = self.cert_device.l2cap.connection_complete_stream
+        cert_connection_stream.subscribe()
+        self.device_under_test.l2cap.Connect(self.cert_address)
+        cert_connection_stream.assert_event_occurs(
+            lambda device: device.remote == self.dut_address
+        )
+        cert_connection_stream.unsubscribe()
+        cert_packet_stream = self.cert_device.l2cap.packet_stream
+        cert_packet_stream.subscribe()
+        echo_request_packet = b"\x08\x01\x00\x00"
+        echo_response_packet = b"\x09\x01\x00\x00"
+        self.cert_device.l2cap.SendL2capPacket(l2cap_facade_pb2.L2capPacket(channel=1, payload=echo_request_packet))
+        cert_packet_stream.assert_event_occurs(
+            lambda packet: echo_response_packet in packet.payload
+        )
+        cert_packet_stream.unsubscribe()
+        time.sleep(ASYNC_OP_TIME_SECONDS)  # TODO(b/144186649): Remove this line
+
+    def test_reject_unknown_command(self):
+        """
+        L2CAP/COS/CED/BI-01-C
+        """
+        cert_connection_stream = self.cert_device.l2cap.connection_complete_stream
+        cert_connection_stream.subscribe()
+        self.device_under_test.l2cap.RegisterChannel(l2cap_facade_pb2.RegisterChannelRequest(channel=2))
+        self.device_under_test.l2cap.Connect(self.cert_address)
+        cert_connection_stream.assert_event_occurs(
+            lambda device: device.remote == self.dut_address
+        )
+        cert_connection_stream.unsubscribe()
+        cert_packet_stream = self.cert_device.l2cap.packet_stream
+        cert_packet_stream.subscribe()
+        invalid_command_packet = b"\xff\x01\x00\x00"
+        self.cert_device.l2cap.SendL2capPacket(l2cap_facade_pb2.L2capPacket(channel=1, payload=invalid_command_packet))
+        command_reject_packet = b"\x01\x01\x02\x00\x00\x00"
+        cert_packet_stream.assert_event_occurs(
+            lambda packet: command_reject_packet in packet.payload
+        )
+        cert_packet_stream.unsubscribe()
+
+        time.sleep(ASYNC_OP_TIME_SECONDS)  # TODO(b/144186649): Remove this line
diff --git a/gd/l2cap/classic/dynamic_channel.cc b/gd/l2cap/classic/dynamic_channel.cc
new file mode 100644
index 0000000..b888b91
--- /dev/null
+++ b/gd/l2cap/classic/dynamic_channel.cc
@@ -0,0 +1,45 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "l2cap/classic/dynamic_channel.h"
+#include "common/bind.h"
+#include "l2cap/classic/internal/dynamic_channel_impl.h"
+
+namespace bluetooth {
+namespace l2cap {
+namespace classic {
+
+hci::Address DynamicChannel::GetDevice() const {
+  return impl_->GetDevice();
+}
+
+void DynamicChannel::RegisterOnCloseCallback(os::Handler* user_handler,
+                                             DynamicChannel::OnCloseCallback on_close_callback) {
+  l2cap_handler_->Post(common::BindOnce(&internal::DynamicChannelImpl::RegisterOnCloseCallback, impl_, user_handler,
+                                        std::move(on_close_callback)));
+}
+
+void DynamicChannel::Close() {
+  l2cap_handler_->Post(common::BindOnce(&internal::DynamicChannelImpl::Close, impl_));
+}
+
+common::BidiQueueEnd<packet::BasePacketBuilder, packet::PacketView<packet::kLittleEndian>>*
+DynamicChannel::GetQueueUpEnd() const {
+  return impl_->GetQueueUpEnd();
+}
+}  // namespace classic
+}  // namespace l2cap
+}  // namespace bluetooth
\ No newline at end of file
diff --git a/gd/l2cap/classic/dynamic_channel.h b/gd/l2cap/classic/dynamic_channel.h
new file mode 100644
index 0000000..eb52c16
--- /dev/null
+++ b/gd/l2cap/classic/dynamic_channel.h
@@ -0,0 +1,81 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+#pragma once
+
+#include "common/bidi_queue.h"
+#include "common/callback.h"
+#include "hci/acl_manager.h"
+#include "os/handler.h"
+#include "packet/base_packet_builder.h"
+#include "packet/packet_view.h"
+
+namespace bluetooth {
+namespace l2cap {
+namespace classic {
+
+namespace internal {
+class DynamicChannelImpl;
+}  // namespace internal
+
+/**
+ * L2CAP Dynamic channel object. User needs to call Close() when user no longer wants to use it. Otherwise the link
+ * won't be disconnected.
+ */
+class DynamicChannel {
+ public:
+  // Should only be constructed by modules that have access to LinkManager
+  DynamicChannel(std::shared_ptr<internal::DynamicChannelImpl> impl, os::Handler* l2cap_handler)
+      : impl_(std::move(impl)), l2cap_handler_(l2cap_handler) {
+    ASSERT(impl_ != nullptr);
+    ASSERT(l2cap_handler_ != nullptr);
+  }
+
+  hci::Address GetDevice() const;
+
+  /**
+   * Register close callback. If close callback is registered, when a channel is closed, the channel's resource will
+   * only be freed after on_close callback is invoked. Otherwise, if no on_close callback is registered, the channel's
+   * resource will be freed immediately after closing.
+   *
+   * @param user_handler The handler used to invoke the callback on
+   * @param on_close_callback The callback invoked upon channel closing.
+   */
+  using OnCloseCallback = common::OnceCallback<void(hci::ErrorCode)>;
+  void RegisterOnCloseCallback(os::Handler* user_handler, OnCloseCallback on_close_callback);
+
+  /**
+   * Indicate that this Dynamic Channel should be closed. OnCloseCallback will be invoked when channel close is done.
+   * L2cay layer may terminate this ACL connection to free the resource after channel is closed.
+   */
+  void Close();
+
+  /**
+   * This method will retrieve the data channel queue to send and receive packets.
+   *
+   * {@see BidiQueueEnd}
+   *
+   * @return The upper end of a bi-directional queue.
+   */
+  common::BidiQueueEnd<packet::BasePacketBuilder, packet::PacketView<packet::kLittleEndian>>* GetQueueUpEnd() const;
+
+ private:
+  std::shared_ptr<internal::DynamicChannelImpl> impl_;
+  os::Handler* l2cap_handler_;
+};
+
+}  // namespace classic
+}  // namespace l2cap
+}  // namespace bluetooth
diff --git a/gd/l2cap/classic/dynamic_channel_manager.cc b/gd/l2cap/classic/dynamic_channel_manager.cc
new file mode 100644
index 0000000..15a90fb
--- /dev/null
+++ b/gd/l2cap/classic/dynamic_channel_manager.cc
@@ -0,0 +1,56 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "l2cap/classic/dynamic_channel_manager.h"
+#include "l2cap/classic/internal/dynamic_channel_service_impl.h"
+#include "l2cap/classic/internal/dynamic_channel_service_manager_impl.h"
+#include "l2cap/classic/internal/link_manager.h"
+
+namespace bluetooth {
+namespace l2cap {
+namespace classic {
+
+bool DynamicChannelManager::ConnectChannel(hci::Address device, Psm psm, OnConnectionOpenCallback on_connection_open,
+                                           OnConnectionFailureCallback on_fail_callback, os::Handler* handler) {
+  internal::LinkManager::PendingDynamicChannelConnection pending_dynamic_channel_connection{
+      .handler_ = handler,
+      .on_open_callback_ = std::move(on_connection_open),
+      .on_fail_callback_ = std::move(on_fail_callback),
+  };
+  l2cap_layer_handler_->Post(common::BindOnce(&internal::LinkManager::ConnectDynamicChannelServices,
+                                              common::Unretained(link_manager_), device,
+                                              std::move(pending_dynamic_channel_connection), psm));
+
+  return true;
+}
+
+bool DynamicChannelManager::RegisterService(Psm psm, const SecurityPolicy& security_policy,
+                                            OnRegistrationCompleteCallback on_registration_complete,
+                                            OnConnectionOpenCallback on_connection_open, os::Handler* handler) {
+  internal::DynamicChannelServiceImpl::PendingRegistration pending_registration{
+      .user_handler_ = handler,
+      .on_registration_complete_callback_ = std::move(on_registration_complete),
+      .on_connection_open_callback_ = std::move(on_connection_open)};
+  l2cap_layer_handler_->Post(common::BindOnce(&internal::DynamicChannelServiceManagerImpl::Register,
+                                              common::Unretained(service_manager_), psm,
+                                              std::move(pending_registration)));
+
+  return true;
+}
+
+}  // namespace classic
+}  // namespace l2cap
+}  // namespace bluetooth
diff --git a/gd/l2cap/classic/dynamic_channel_manager.h b/gd/l2cap/classic/dynamic_channel_manager.h
new file mode 100644
index 0000000..b6c0518
--- /dev/null
+++ b/gd/l2cap/classic/dynamic_channel_manager.h
@@ -0,0 +1,141 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+#pragma once
+
+#include <string>
+
+#include "hci/acl_manager.h"
+#include "hci/address.h"
+#include "l2cap/classic/dynamic_channel.h"
+#include "l2cap/classic/dynamic_channel_service.h"
+#include "l2cap/l2cap_packets.h"
+#include "l2cap/psm.h"
+#include "l2cap/security_policy.h"
+#include "os/handler.h"
+
+namespace bluetooth {
+namespace l2cap {
+namespace classic {
+
+class L2capClassicModule;
+
+namespace internal {
+class LinkManager;
+class DynamicChannelServiceManagerImpl;
+}  // namespace internal
+
+class DynamicChannelManager {
+ public:
+  enum class ConnectionResultCode {
+    SUCCESS = 0,
+    FAIL_NO_SERVICE_REGISTERED = 1,  // No service is registered
+    FAIL_HCI_ERROR = 2,              // See hci_error
+    FAIL_L2CAP_ERROR = 3,            // See l2cap_connection_response_result
+  };
+
+  struct ConnectionResult {
+    ConnectionResultCode connection_result_code = ConnectionResultCode::SUCCESS;
+    hci::ErrorCode hci_error = hci::ErrorCode::SUCCESS;
+    ConnectionResponseResult l2cap_connection_response_result = ConnectionResponseResult::SUCCESS;
+  };
+  /**
+   * OnConnectionFailureCallback(std::string failure_reason);
+   */
+  using OnConnectionFailureCallback = common::OnceCallback<void(ConnectionResult result)>;
+
+  /**
+   * OnConnectionOpenCallback(DynamicChannel channel);
+   */
+  using OnConnectionOpenCallback = common::Callback<void(std::unique_ptr<DynamicChannel>)>;
+
+  enum class RegistrationResult {
+    SUCCESS = 0,
+    FAIL_DUPLICATE_SERVICE = 1,  // Duplicate service registration for the same PSM
+    FAIL_INVALID_SERVICE = 2,    // Invalid PSM
+  };
+
+  /**
+   * OnRegistrationFailureCallback(RegistrationResult result, DynamicChannelService service);
+   */
+  using OnRegistrationCompleteCallback =
+      common::OnceCallback<void(RegistrationResult, std::unique_ptr<DynamicChannelService>)>;
+
+  /**
+   * Connect to a Dynamic channel on a remote device
+   *
+   * - This method is asynchronous
+   * - When false is returned, the connection fails immediately
+   * - When true is returned, method caller should wait for on_fail_callback or on_open_callback
+   * - If an ACL connection does not exist, this method will create an ACL connection
+   * - If HCI connection failed, on_fail_callback will be triggered with FAIL_HCI_ERROR
+   * - If Dynamic channel on a remote device is already reported as connected via on_open_callback, it won't be
+   *   reported again
+   *
+   * @param device: Remote device to make this connection.
+   * @param psm: Service PSM to connect. PSM is defined in Core spec Vol 3 Part A 4.2.
+   * @param on_open_callback: A callback to indicate success of a connection initiated from a remote device.
+   * @param on_fail_callback: A callback to indicate connection failure along with a status code.
+   * @param handler: The handler context in which to execute the @callback parameters.
+   *
+   * Returns: true if connection was able to be initiated, false otherwise.
+   */
+  bool ConnectChannel(hci::Address device, Psm psm, OnConnectionOpenCallback on_connection_open,
+                      OnConnectionFailureCallback on_fail_callback, os::Handler* handler);
+
+  /**
+   * Register a service to receive incoming connections bound to a specific channel.
+   *
+   * - This method is asynchronous.
+   * - When false is returned, the registration fails immediately.
+   * - When true is returned, method caller should wait for on_service_registered callback that contains a
+   *   DynamicChannelService object. The registered service can be managed from that object.
+   * - If a PSM is already registered or some other error happens, on_registration_complete will be triggered with a
+   *   non-SUCCESS value
+   * - After a service is registered, a DynamicChannel is delivered through on_open_callback when the remote
+   *   initiates a channel open and channel is opened successfully
+   * - on_open_callback, will only be triggered after on_service_registered callback
+   *
+   * @param security_policy: The security policy used for the connection.
+   * @param psm: Service PSM to register. PSM is defined in Core spec Vol 3 Part A 4.2.
+   * @param on_registration_complete: A callback to indicate the service setup has completed. If the return status is
+   *        not SUCCESS, it means service is not registered due to reasons like PSM already take
+   * @param on_open_callback: A callback to indicate success of a connection initiated from a remote device.
+   * @param handler: The handler context in which to execute the @callback parameter.
+   */
+  bool RegisterService(Psm psm, const SecurityPolicy& security_policy,
+                       OnRegistrationCompleteCallback on_registration_complete,
+                       OnConnectionOpenCallback on_connection_open, os::Handler* handler);
+
+  friend class L2capClassicModule;
+
+ private:
+  // The constructor is not to be used by user code
+  DynamicChannelManager(internal::DynamicChannelServiceManagerImpl* service_manager,
+                        internal::LinkManager* link_manager, os::Handler* l2cap_layer_handler)
+      : service_manager_(service_manager), link_manager_(link_manager), l2cap_layer_handler_(l2cap_layer_handler) {
+    ASSERT(service_manager_ != nullptr);
+    ASSERT(link_manager_ != nullptr);
+    ASSERT(l2cap_layer_handler_ != nullptr);
+  }
+  internal::DynamicChannelServiceManagerImpl* service_manager_ = nullptr;
+  internal::LinkManager* link_manager_ = nullptr;
+  os::Handler* l2cap_layer_handler_ = nullptr;
+  DISALLOW_COPY_AND_ASSIGN(DynamicChannelManager);
+};
+
+}  // namespace classic
+}  // namespace l2cap
+}  // namespace bluetooth
diff --git a/gd/l2cap/classic/dynamic_channel_service.cc b/gd/l2cap/classic/dynamic_channel_service.cc
new file mode 100644
index 0000000..ee97d37
--- /dev/null
+++ b/gd/l2cap/classic/dynamic_channel_service.cc
@@ -0,0 +1,38 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "l2cap/classic/dynamic_channel_service.h"
+#include "common/bind.h"
+#include "l2cap/classic/internal/dynamic_channel_service_manager_impl.h"
+
+namespace bluetooth {
+namespace l2cap {
+namespace classic {
+
+void DynamicChannelService::Unregister(OnUnregisteredCallback on_unregistered, os::Handler* on_unregistered_handler) {
+  ASSERT_LOG(manager_ != nullptr, "this service is invalid");
+  l2cap_layer_handler_->Post(common::BindOnce(&internal::DynamicChannelServiceManagerImpl::Unregister,
+                                              common::Unretained(manager_), psm_, std::move(on_unregistered),
+                                              on_unregistered_handler));
+}
+
+Psm DynamicChannelService::GetPsm() const {
+  return psm_;
+}
+
+}  // namespace classic
+}  // namespace l2cap
+}  // namespace bluetooth
diff --git a/gd/l2cap/classic/dynamic_channel_service.h b/gd/l2cap/classic/dynamic_channel_service.h
new file mode 100644
index 0000000..cd24b61
--- /dev/null
+++ b/gd/l2cap/classic/dynamic_channel_service.h
@@ -0,0 +1,65 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#pragma once
+
+#include "common/callback.h"
+#include "l2cap/psm.h"
+#include "os/handler.h"
+#include "os/log.h"
+
+namespace bluetooth {
+namespace l2cap {
+namespace classic {
+
+namespace internal {
+class DynamicChannelServiceManagerImpl;
+}
+
+class DynamicChannelService {
+ public:
+  DynamicChannelService() = default;
+
+  using OnUnregisteredCallback = common::OnceCallback<void()>;
+
+  /**
+   * Unregister a service from L2CAP module. This operation cannot fail.
+   * All channels opened for this service will be closed.
+   *
+   * @param on_unregistered will be triggered when unregistration is complete
+   */
+  void Unregister(OnUnregisteredCallback on_unregistered, os::Handler* on_unregistered_handler);
+
+  friend internal::DynamicChannelServiceManagerImpl;
+
+  Psm GetPsm() const;
+
+ private:
+  DynamicChannelService(Psm psm, internal::DynamicChannelServiceManagerImpl* manager, os::Handler* handler)
+      : psm_(psm), manager_(manager), l2cap_layer_handler_(handler) {
+    ASSERT(IsPsmValid(psm));
+    ASSERT(manager_ != nullptr);
+    ASSERT(l2cap_layer_handler_ != nullptr);
+  }
+  Psm psm_ = kDefaultPsm;
+  internal::DynamicChannelServiceManagerImpl* manager_ = nullptr;
+  os::Handler* l2cap_layer_handler_;
+  DISALLOW_COPY_AND_ASSIGN(DynamicChannelService);
+};
+
+}  // namespace classic
+}  // namespace l2cap
+}  // namespace bluetooth
diff --git a/gd/l2cap/classic/facade.cc b/gd/l2cap/classic/facade.cc
new file mode 100644
index 0000000..f2b2df3
--- /dev/null
+++ b/gd/l2cap/classic/facade.cc
@@ -0,0 +1,358 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+#include <cstdint>
+#include <unordered_map>
+
+#include "common/bidi_queue.h"
+#include "common/bind.h"
+#include "grpc/grpc_event_stream.h"
+#include "hci/address.h"
+#include "hci/facade.h"
+#include "l2cap/classic/facade.grpc.pb.h"
+#include "l2cap/classic/facade.h"
+#include "l2cap/classic/l2cap_classic_module.h"
+#include "l2cap/l2cap_packets.h"
+#include "os/log.h"
+#include "packet/raw_builder.h"
+
+using ::grpc::ServerAsyncResponseWriter;
+using ::grpc::ServerAsyncWriter;
+using ::grpc::ServerContext;
+
+using ::bluetooth::facade::EventStreamRequest;
+using ::bluetooth::packet::RawBuilder;
+
+namespace bluetooth {
+namespace l2cap {
+namespace classic {
+
+class L2capModuleFacadeService : public L2capModuleFacade::Service {
+ public:
+  L2capModuleFacadeService(L2capClassicModule* l2cap_layer, os::Handler* facade_handler)
+      : l2cap_layer_(l2cap_layer), facade_handler_(facade_handler) {
+    ASSERT(l2cap_layer_ != nullptr);
+    ASSERT(facade_handler_ != nullptr);
+  }
+
+  class ConnectionCompleteCallback
+      : public grpc::GrpcEventStreamCallback<ConnectionCompleteEvent, ConnectionCompleteEvent> {
+   public:
+    void OnWriteResponse(ConnectionCompleteEvent* response, const ConnectionCompleteEvent& event) override {
+      response->CopyFrom(event);
+    }
+
+  } connection_complete_callback_;
+  ::bluetooth::grpc::GrpcEventStream<ConnectionCompleteEvent, ConnectionCompleteEvent> connection_complete_stream_{
+      &connection_complete_callback_};
+
+  ::grpc::Status FetchConnectionComplete(::grpc::ServerContext* context,
+                                         const ::bluetooth::facade::EventStreamRequest* request,
+                                         ::grpc::ServerWriter<classic::ConnectionCompleteEvent>* writer) override {
+    return connection_complete_stream_.HandleRequest(context, request, writer);
+  }
+
+  ::grpc::Status Connect(::grpc::ServerContext* context, const facade::BluetoothAddress* request,
+                         ::google::protobuf::Empty* response) override {
+    auto fixed_channel_manager = l2cap_layer_->GetFixedChannelManager();
+    hci::Address peer;
+    ASSERT(hci::Address::FromString(request->address(), peer));
+    fixed_channel_manager->ConnectServices(peer, common::BindOnce([](FixedChannelManager::ConnectionResult) {}),
+                                           facade_handler_);
+    return ::grpc::Status::OK;
+  }
+
+  ::grpc::Status SendL2capPacket(::grpc::ServerContext* context, const classic::L2capPacket* request,
+                                 SendL2capPacketResult* response) override {
+    if (fixed_channel_helper_map_.find(request->channel()) == fixed_channel_helper_map_.end()) {
+      return ::grpc::Status(::grpc::StatusCode::FAILED_PRECONDITION, "Channel not registered");
+    }
+    std::vector<uint8_t> packet(request->payload().begin(), request->payload().end());
+    fixed_channel_helper_map_[request->channel()]->SendPacket(packet);
+    response->set_result_type(SendL2capPacketResultType::OK);
+    return ::grpc::Status::OK;
+  }
+
+  ::grpc::Status SendDynamicChannelPacket(::grpc::ServerContext* context, const DynamicChannelPacket* request,
+                                          ::google::protobuf::Empty* response) override {
+    if (dynamic_channel_helper_map_.find(request->psm()) == dynamic_channel_helper_map_.end()) {
+      return ::grpc::Status(::grpc::StatusCode::FAILED_PRECONDITION, "Psm not registered");
+    }
+    std::vector<uint8_t> packet(request->payload().begin(), request->payload().end());
+    dynamic_channel_helper_map_[request->psm()]->SendPacket(packet);
+    return ::grpc::Status::OK;
+  }
+
+  ::grpc::Status OpenChannel(::grpc::ServerContext* context,
+                             const ::bluetooth::l2cap::classic::OpenChannelRequest* request,
+                             ::google::protobuf::Empty* response) override {
+    auto psm = request->psm();
+    dynamic_channel_helper_map_.emplace(
+        psm, std::make_unique<L2capDynamicChannelHelper>(this, l2cap_layer_, facade_handler_, psm));
+    hci::Address peer;
+    ASSERT(hci::Address::FromString(request->remote().address(), peer));
+    dynamic_channel_helper_map_[psm]->Connect(peer);
+    return ::grpc::Status::OK;
+  }
+
+  ::grpc::Status FetchL2capData(::grpc::ServerContext* context, const ::bluetooth::facade::EventStreamRequest* request,
+                                ::grpc::ServerWriter<classic::L2capPacket>* writer) override {
+    return l2cap_stream_.HandleRequest(context, request, writer);
+  }
+
+  ::grpc::Status RegisterChannel(::grpc::ServerContext* context, const classic::RegisterChannelRequest* request,
+                                 ::google::protobuf::Empty* response) override {
+    if (fixed_channel_helper_map_.find(request->channel()) != fixed_channel_helper_map_.end()) {
+      return ::grpc::Status(::grpc::StatusCode::FAILED_PRECONDITION, "Already registered");
+    }
+    fixed_channel_helper_map_.emplace(request->channel(), std::make_unique<L2capFixedChannelHelper>(
+                                                              this, l2cap_layer_, facade_handler_, request->channel()));
+
+    return ::grpc::Status::OK;
+  }
+
+  class L2capFixedChannelHelper {
+   public:
+    L2capFixedChannelHelper(L2capModuleFacadeService* service, L2capClassicModule* l2cap_layer, os::Handler* handler,
+                            Cid cid)
+        : facade_service_(service), l2cap_layer_(l2cap_layer), handler_(handler), cid_(cid) {
+      fixed_channel_manager_ = l2cap_layer_->GetFixedChannelManager();
+      fixed_channel_manager_->RegisterService(
+          cid, {},
+          common::BindOnce(&L2capFixedChannelHelper::on_l2cap_service_registration_complete, common::Unretained(this)),
+          common::Bind(&L2capFixedChannelHelper::on_connection_open, common::Unretained(this)), handler_);
+    }
+
+    void on_l2cap_service_registration_complete(FixedChannelManager::RegistrationResult registration_result,
+                                                std::unique_ptr<FixedChannelService> service) {
+      service_ = std::move(service);
+    }
+
+    void on_connection_open(std::unique_ptr<FixedChannel> channel) {
+      ConnectionCompleteEvent event;
+      event.mutable_remote()->set_address(channel->GetDevice().ToString());
+      facade_service_->connection_complete_stream_.OnIncomingEvent(event);
+      channel_ = std::move(channel);
+    }
+
+    void SendPacket(std::vector<uint8_t> packet) {
+      if (channel_ == nullptr) {
+        LOG_WARN("Channel is not open");
+        return;
+      }
+      channel_->GetQueueUpEnd()->RegisterEnqueue(
+          handler_, common::Bind(&L2capFixedChannelHelper::enqueue_callback, common::Unretained(this), packet));
+    }
+
+    void on_incoming_packet() {
+      auto packet = channel_->GetQueueUpEnd()->TryDequeue();
+      std::string data = std::string(packet->begin(), packet->end());
+      L2capPacket l2cap_data;
+      l2cap_data.set_channel(cid_);
+      l2cap_data.set_payload(data);
+      facade_service_->l2cap_stream_.OnIncomingEvent(l2cap_data);
+    }
+
+    std::unique_ptr<packet::BasePacketBuilder> enqueue_callback(std::vector<uint8_t> packet) {
+      auto packet_one = std::make_unique<packet::RawBuilder>();
+      packet_one->AddOctets(packet);
+      channel_->GetQueueUpEnd()->UnregisterEnqueue();
+      return packet_one;
+    };
+
+    L2capModuleFacadeService* facade_service_;
+    L2capClassicModule* l2cap_layer_;
+    os::Handler* handler_;
+    std::unique_ptr<FixedChannelManager> fixed_channel_manager_;
+    std::unique_ptr<FixedChannelService> service_;
+    std::unique_ptr<FixedChannel> channel_ = nullptr;
+    Cid cid_;
+  };
+
+  ::grpc::Status SetDynamicChannel(::grpc::ServerContext* context, const SetEnableDynamicChannelRequest* request,
+                                   google::protobuf::Empty* response) override {
+    dynamic_channel_helper_map_.emplace(request->psm(), std::make_unique<L2capDynamicChannelHelper>(
+                                                            this, l2cap_layer_, facade_handler_, request->psm()));
+    return ::grpc::Status::OK;
+  }
+
+  class L2capDynamicChannelHelper {
+   public:
+    L2capDynamicChannelHelper(L2capModuleFacadeService* service, L2capClassicModule* l2cap_layer, os::Handler* handler,
+                              Psm psm)
+        : facade_service_(service), l2cap_layer_(l2cap_layer), handler_(handler), psm_(psm) {
+      dynamic_channel_manager_ = l2cap_layer_->GetDynamicChannelManager();
+      dynamic_channel_manager_->RegisterService(
+          psm, {},
+          common::BindOnce(&L2capDynamicChannelHelper::on_l2cap_service_registration_complete,
+                           common::Unretained(this)),
+          common::Bind(&L2capDynamicChannelHelper::on_connection_open, common::Unretained(this)), handler_);
+    }
+
+    void Connect(hci::Address address) {
+      dynamic_channel_manager_->ConnectChannel(
+          address, psm_, common::Bind(&L2capDynamicChannelHelper::on_connection_open, common::Unretained(this)),
+          common::Bind(&L2capDynamicChannelHelper::on_connect_fail, common::Unretained(this)), handler_);
+    }
+
+    void on_l2cap_service_registration_complete(DynamicChannelManager::RegistrationResult registration_result,
+                                                std::unique_ptr<DynamicChannelService> service) {}
+
+    void on_connection_open(std::unique_ptr<DynamicChannel> channel) {
+      ConnectionCompleteEvent event;
+      event.mutable_remote()->set_address(channel->GetDevice().ToString());
+      facade_service_->connection_complete_stream_.OnIncomingEvent(event);
+      channel_ = std::move(channel);
+    }
+
+    void on_connect_fail(DynamicChannelManager::ConnectionResult result) {}
+
+    void on_incoming_packet() {
+      auto packet = channel_->GetQueueUpEnd()->TryDequeue();
+      std::string data = std::string(packet->begin(), packet->end());
+      L2capPacket l2cap_data;
+      //      l2cap_data.set_channel(cid_);
+      l2cap_data.set_payload(data);
+      facade_service_->l2cap_stream_.OnIncomingEvent(l2cap_data);
+    }
+
+    void SendPacket(std::vector<uint8_t> packet) {
+      if (channel_ == nullptr) {
+        LOG_WARN("Channel is not open");
+        return;
+      }
+      channel_->GetQueueUpEnd()->RegisterEnqueue(
+          handler_, common::Bind(&L2capDynamicChannelHelper::enqueue_callback, common::Unretained(this), packet));
+    }
+
+    std::unique_ptr<packet::BasePacketBuilder> enqueue_callback(std::vector<uint8_t> packet) {
+      auto packet_one = std::make_unique<packet::RawBuilder>();
+      packet_one->AddOctets(packet);
+      channel_->GetQueueUpEnd()->UnregisterEnqueue();
+      return packet_one;
+    };
+
+    L2capModuleFacadeService* facade_service_;
+    L2capClassicModule* l2cap_layer_;
+    os::Handler* handler_;
+    std::unique_ptr<DynamicChannelManager> dynamic_channel_manager_;
+    std::unique_ptr<DynamicChannelService> service_;
+    std::unique_ptr<DynamicChannel> channel_ = nullptr;
+    Psm psm_;
+  };
+
+  L2capClassicModule* l2cap_layer_;
+  ::bluetooth::os::Handler* facade_handler_;
+  std::map<Cid, std::unique_ptr<L2capFixedChannelHelper>> fixed_channel_helper_map_;
+  std::map<Psm, std::unique_ptr<L2capDynamicChannelHelper>> dynamic_channel_helper_map_;
+
+  class L2capStreamCallback : public ::bluetooth::grpc::GrpcEventStreamCallback<L2capPacket, L2capPacket> {
+   public:
+    L2capStreamCallback(L2capModuleFacadeService* service) : service_(service) {}
+
+    ~L2capStreamCallback() {
+      for (const auto& connection : service_->fixed_channel_helper_map_) {
+        if (subscribed_fixed_channel_[connection.first] && connection.second->channel_ != nullptr) {
+          connection.second->channel_->GetQueueUpEnd()->UnregisterDequeue();
+          subscribed_fixed_channel_[connection.first] = false;
+        }
+      }
+
+      for (const auto& connection : service_->dynamic_channel_helper_map_) {
+        if (subscribed_dynamic_channel_[connection.first] && connection.second->channel_ != nullptr) {
+          connection.second->channel_->GetQueueUpEnd()->UnregisterDequeue();
+          subscribed_dynamic_channel_[connection.first] = false;
+        }
+      }
+    }
+
+    void OnSubscribe() override {
+      for (auto& connection : service_->fixed_channel_helper_map_) {
+        if (!subscribed_fixed_channel_[connection.first] && connection.second->channel_ != nullptr) {
+          connection.second->channel_->GetQueueUpEnd()->RegisterDequeue(
+              service_->facade_handler_,
+              common::Bind(&L2capFixedChannelHelper::on_incoming_packet, common::Unretained(connection.second.get())));
+          subscribed_fixed_channel_[connection.first] = true;
+        }
+      }
+
+      for (auto& connection : service_->dynamic_channel_helper_map_) {
+        if (!subscribed_dynamic_channel_[connection.first] && connection.second->channel_ != nullptr) {
+          connection.second->channel_->GetQueueUpEnd()->RegisterDequeue(
+              service_->facade_handler_, common::Bind(&L2capDynamicChannelHelper::on_incoming_packet,
+                                                      common::Unretained(connection.second.get())));
+          subscribed_dynamic_channel_[connection.first] = true;
+        }
+      }
+    }
+
+    void OnUnsubscribe() override {
+      for (const auto& connection : service_->fixed_channel_helper_map_) {
+        if (subscribed_fixed_channel_[connection.first] && connection.second->channel_ != nullptr) {
+          connection.second->channel_->GetQueueUpEnd()->UnregisterDequeue();
+          subscribed_fixed_channel_[connection.first] = false;
+        }
+      }
+
+      for (const auto& connection : service_->dynamic_channel_helper_map_) {
+        if (subscribed_dynamic_channel_[connection.first] && connection.second->channel_ != nullptr) {
+          connection.second->channel_->GetQueueUpEnd()->UnregisterDequeue();
+          subscribed_dynamic_channel_[connection.first] = false;
+        }
+      }
+    }
+
+    void OnWriteResponse(L2capPacket* response, const L2capPacket& event) override {
+      response->CopyFrom(event);
+    }
+
+    L2capModuleFacadeService* service_;
+    std::map<Cid, bool> subscribed_fixed_channel_;
+    std::map<Psm, bool> subscribed_dynamic_channel_;
+
+  } l2cap_stream_callback_{this};
+  ::bluetooth::grpc::GrpcEventStream<L2capPacket, L2capPacket> l2cap_stream_{&l2cap_stream_callback_};
+
+  std::mutex mutex_;
+};
+
+void L2capModuleFacadeModule::ListDependencies(ModuleList* list) {
+  ::bluetooth::grpc::GrpcFacadeModule::ListDependencies(list);
+  list->add<l2cap::classic::L2capClassicModule>();
+  list->add<hci::HciLayer>();
+}
+
+void L2capModuleFacadeModule::Start() {
+  ::bluetooth::grpc::GrpcFacadeModule::Start();
+  GetDependency<hci::HciLayer>()->EnqueueCommand(hci::WriteScanEnableBuilder::Create(hci::ScanEnable::PAGE_SCAN_ONLY),
+                                                 common::BindOnce([](hci::CommandCompleteView) {}), GetHandler());
+  service_ = new L2capModuleFacadeService(GetDependency<l2cap::classic::L2capClassicModule>(), GetHandler());
+}
+
+void L2capModuleFacadeModule::Stop() {
+  delete service_;
+  ::bluetooth::grpc::GrpcFacadeModule::Stop();
+}
+
+::grpc::Service* L2capModuleFacadeModule::GetService() const {
+  return service_;
+}
+
+const ModuleFactory L2capModuleFacadeModule::Factory =
+    ::bluetooth::ModuleFactory([]() { return new L2capModuleFacadeModule(); });
+
+}  // namespace classic
+}  // namespace l2cap
+}  // namespace bluetooth
diff --git a/gd/l2cap/classic/facade.h b/gd/l2cap/classic/facade.h
new file mode 100644
index 0000000..425940a
--- /dev/null
+++ b/gd/l2cap/classic/facade.h
@@ -0,0 +1,43 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+#pragma once
+
+#include <grpc++/grpc++.h>
+#include "grpc/grpc_module.h"
+
+namespace bluetooth {
+namespace l2cap {
+namespace classic {
+
+class L2capModuleFacadeService;
+
+class L2capModuleFacadeModule : public ::bluetooth::grpc::GrpcFacadeModule {
+ public:
+  static const ModuleFactory Factory;
+
+  void ListDependencies(ModuleList* list) override;
+  void Start() override;
+  void Stop() override;
+
+  ::grpc::Service* GetService() const override;
+
+ private:
+  L2capModuleFacadeService* service_;
+};
+
+}  // namespace classic
+}  // namespace l2cap
+}  // namespace bluetooth
\ No newline at end of file
diff --git a/gd/l2cap/classic/facade.proto b/gd/l2cap/classic/facade.proto
new file mode 100644
index 0000000..21add63
--- /dev/null
+++ b/gd/l2cap/classic/facade.proto
@@ -0,0 +1,87 @@
+syntax = "proto3";
+
+package bluetooth.l2cap.classic;
+
+import "google/protobuf/empty.proto";
+import "facade/common.proto";
+
+service L2capModuleFacade {
+  rpc RegisterChannel(RegisterChannelRequest) returns (google.protobuf.Empty) {
+    // Testing Android Bluetooth stack only. Optional for other stack.
+  }
+  rpc FetchConnectionComplete(facade.EventStreamRequest) returns (stream ConnectionCompleteEvent) {
+    // Testing Android Bluetooth stack only. Optional for other stack.
+  }
+  rpc Connect(facade.BluetoothAddress) returns (google.protobuf.Empty) {}
+  rpc OpenChannel(OpenChannelRequest) returns (google.protobuf.Empty) {}
+  rpc ConfigureChannel(ConfigureChannelRequest) returns (google.protobuf.Empty) {}
+  rpc SendL2capPacket(L2capPacket) returns (SendL2capPacketResult) {}
+  rpc FetchL2capData(facade.EventStreamRequest) returns (stream L2capPacket) {}
+  rpc RegisterDynamicChannel(RegisterDynamicChannelRequest) returns (google.protobuf.Empty) {}
+  rpc SetDynamicChannel(SetEnableDynamicChannelRequest) returns (google.protobuf.Empty) {}
+  rpc SendDynamicChannelPacket(DynamicChannelPacket) returns (google.protobuf.Empty) {}
+}
+
+message RegisterChannelRequest {
+  uint32 channel = 1;
+}
+
+message ConnectionCompleteEvent {
+  facade.BluetoothAddress remote = 1;
+}
+
+message OpenChannelRequest {
+  facade.BluetoothAddress remote = 1;
+  uint32 psm = 2;
+}
+
+message ConfigureChannelRequest {
+  facade.BluetoothAddress remote = 1;
+  // Config
+}
+
+message CloseChannelRequest {
+  facade.BluetoothAddress remote = 1;
+  uint32 cid = 2;
+}
+
+enum ChannelSignalEventType {
+  OPEN = 0;
+  CLOSE = 1;
+  CONFIGURE = 2;
+}
+
+message ChannelSignalEvent {
+  uint32 cid = 1;
+  ChannelSignalEventType type = 2;
+}
+
+enum SendL2capPacketResultType {
+  OK = 0;
+  BAD_CID = 1;
+}
+
+message SendL2capPacketResult {
+  SendL2capPacketResultType result_type = 1;
+}
+
+message L2capPacket {
+  facade.BluetoothAddress remote = 1;
+  uint32 channel = 2;
+  bytes payload = 3;
+}
+
+message RegisterDynamicChannelRequest {
+  uint32 psm = 1;
+}
+
+message SetEnableDynamicChannelRequest {
+  uint32 psm = 1;
+  bool enable = 2;
+}
+
+message DynamicChannelPacket {
+  facade.BluetoothAddress remote = 1;
+  uint32 psm = 2;
+  bytes payload = 3;
+}
diff --git a/gd/l2cap/classic/fixed_channel.cc b/gd/l2cap/classic/fixed_channel.cc
new file mode 100644
index 0000000..a90d119
--- /dev/null
+++ b/gd/l2cap/classic/fixed_channel.cc
@@ -0,0 +1,48 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "l2cap/classic/fixed_channel.h"
+#include "common/bind.h"
+#include "l2cap/classic/internal/fixed_channel_impl.h"
+
+namespace bluetooth {
+namespace l2cap {
+namespace classic {
+
+hci::Address FixedChannel::GetDevice() const {
+  return impl_->GetDevice();
+}
+
+void FixedChannel::RegisterOnCloseCallback(os::Handler* user_handler, FixedChannel::OnCloseCallback on_close_callback) {
+  l2cap_handler_->Post(common::BindOnce(&internal::FixedChannelImpl::RegisterOnCloseCallback, impl_, user_handler,
+                                        std::move(on_close_callback)));
+}
+
+void FixedChannel::Acquire() {
+  l2cap_handler_->Post(common::BindOnce(&internal::FixedChannelImpl::Acquire, impl_));
+}
+
+void FixedChannel::Release() {
+  l2cap_handler_->Post(common::BindOnce(&internal::FixedChannelImpl::Release, impl_));
+}
+
+common::BidiQueueEnd<packet::BasePacketBuilder, packet::PacketView<packet::kLittleEndian>>*
+FixedChannel::GetQueueUpEnd() const {
+  return impl_->GetQueueUpEnd();
+}
+}  // namespace classic
+}  // namespace l2cap
+}  // namespace bluetooth
\ No newline at end of file
diff --git a/gd/l2cap/classic/fixed_channel.h b/gd/l2cap/classic/fixed_channel.h
new file mode 100644
index 0000000..bf88e3d
--- /dev/null
+++ b/gd/l2cap/classic/fixed_channel.h
@@ -0,0 +1,90 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+#pragma once
+
+#include "common/bidi_queue.h"
+#include "common/callback.h"
+#include "hci/acl_manager.h"
+#include "l2cap/cid.h"
+#include "os/handler.h"
+#include "packet/base_packet_builder.h"
+#include "packet/packet_view.h"
+
+namespace bluetooth {
+namespace l2cap {
+namespace classic {
+
+namespace internal {
+class FixedChannelImpl;
+}  // namespace internal
+
+/**
+ * L2CAP fixed channel object. When a new object is created, it must be
+ * acquired through calling {@link FixedChannel#Acquire()} within X seconds.
+ * Otherwise, {@link FixedChannel#Release()} will be called automatically.
+ *
+ */
+class FixedChannel {
+ public:
+  // Should only be constructed by modules that have access to LinkManager
+  FixedChannel(std::shared_ptr<internal::FixedChannelImpl> impl, os::Handler* l2cap_handler)
+      : impl_(std::move(impl)), l2cap_handler_(l2cap_handler) {
+    ASSERT(impl_ != nullptr);
+    ASSERT(l2cap_handler_ != nullptr);
+  }
+
+  hci::Address GetDevice() const;
+
+  /**
+   * Register close callback. If close callback is registered, when a channel is closed, the channel's resource will
+   * only be freed after on_close callback is invoked. Otherwise, if no on_close callback is registered, the channel's
+   * resource will be freed immediately after closing.
+   *
+   * @param user_handler The handler used to invoke the callback on
+   * @param on_close_callback The callback invoked upon channel closing.
+   */
+  using OnCloseCallback = common::OnceCallback<void(hci::ErrorCode)>;
+  void RegisterOnCloseCallback(os::Handler* user_handler, OnCloseCallback on_close_callback);
+
+  /**
+   * Indicate that this Fixed Channel is being used. This will prevent ACL connection from being disconnected.
+   */
+  void Acquire();
+
+  /**
+   * Indicate that this Fixed Channel is no longer being used. ACL connection will be disconnected after
+   * kLinkIdleDisconnectTimeout if no other DynamicChannel is connected or no other Fixed Channel is  using this
+   * ACL connection. However a module can still receive data on this channel as long as it remains open.
+   */
+  void Release();
+
+  /**
+   * This method will retrieve the data channel queue to send and receive packets.
+   *
+   * {@see BidiQueueEnd}
+   *
+   * @return The upper end of a bi-directional queue.
+   */
+  common::BidiQueueEnd<packet::BasePacketBuilder, packet::PacketView<packet::kLittleEndian>>* GetQueueUpEnd() const;
+
+ private:
+  std::shared_ptr<internal::FixedChannelImpl> impl_;
+  os::Handler* l2cap_handler_;
+};
+
+}  // namespace classic
+}  // namespace l2cap
+}  // namespace bluetooth
diff --git a/gd/l2cap/classic/fixed_channel_manager.cc b/gd/l2cap/classic/fixed_channel_manager.cc
new file mode 100644
index 0000000..0c3e5c7
--- /dev/null
+++ b/gd/l2cap/classic/fixed_channel_manager.cc
@@ -0,0 +1,53 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "l2cap/classic/fixed_channel_manager.h"
+#include "l2cap/classic/internal/fixed_channel_service_impl.h"
+#include "l2cap/classic/internal/fixed_channel_service_manager_impl.h"
+#include "l2cap/classic/internal/link_manager.h"
+
+namespace bluetooth {
+namespace l2cap {
+namespace classic {
+
+bool FixedChannelManager::ConnectServices(hci::Address device, OnConnectionFailureCallback on_fail_callback,
+                                          os::Handler* handler) {
+  internal::LinkManager::PendingFixedChannelConnection pending_fixed_channel_connection{
+      .handler_ = handler,
+      .on_fail_callback_ = std::move(on_fail_callback),
+  };
+  l2cap_layer_handler_->Post(common::BindOnce(&internal::LinkManager::ConnectFixedChannelServices,
+                                              common::Unretained(link_manager_), device,
+                                              std::move(pending_fixed_channel_connection)));
+  return true;
+}
+
+bool FixedChannelManager::RegisterService(Cid cid, const SecurityPolicy& security_policy,
+                                          OnRegistrationCompleteCallback on_registration_complete,
+                                          OnConnectionOpenCallback on_connection_open, os::Handler* handler) {
+  internal::FixedChannelServiceImpl::PendingRegistration pending_registration{
+      .user_handler_ = handler,
+      .on_registration_complete_callback_ = std::move(on_registration_complete),
+      .on_connection_open_callback_ = std::move(on_connection_open)};
+  l2cap_layer_handler_->Post(common::BindOnce(&internal::FixedChannelServiceManagerImpl::Register,
+                                              common::Unretained(service_manager_), cid,
+                                              std::move(pending_registration)));
+  return true;
+}
+
+}  // namespace classic
+}  // namespace l2cap
+}  // namespace bluetooth
diff --git a/gd/l2cap/classic/fixed_channel_manager.h b/gd/l2cap/classic/fixed_channel_manager.h
new file mode 100644
index 0000000..69812df
--- /dev/null
+++ b/gd/l2cap/classic/fixed_channel_manager.h
@@ -0,0 +1,146 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+#pragma once
+
+#include <string>
+
+#include "hci/acl_manager.h"
+#include "hci/address.h"
+#include "l2cap/cid.h"
+#include "l2cap/classic/fixed_channel.h"
+#include "l2cap/classic/fixed_channel_service.h"
+#include "l2cap/security_policy.h"
+#include "os/handler.h"
+
+namespace bluetooth {
+namespace l2cap {
+namespace classic {
+
+class L2capClassicModule;
+
+namespace internal {
+class LinkManager;
+class FixedChannelServiceManagerImpl;
+}  // namespace internal
+
+class FixedChannelManager {
+ public:
+  enum class ConnectionResultCode {
+    SUCCESS = 0,
+    FAIL_NO_SERVICE_REGISTERED = 1,      // No service is registered
+    FAIL_ALL_SERVICES_HAVE_CHANNEL = 2,  // All registered services already have a channel
+    FAIL_HCI_ERROR = 3,                  // See hci_error
+  };
+
+  struct ConnectionResult {
+    ConnectionResultCode connection_result_code = ConnectionResultCode::SUCCESS;
+    hci::ErrorCode hci_error = hci::ErrorCode::SUCCESS;
+  };
+  /**
+   * OnConnectionFailureCallback(std::string failure_reason);
+   */
+  using OnConnectionFailureCallback = common::OnceCallback<void(ConnectionResult result)>;
+
+  /**
+   * OnConnectionOpenCallback(FixedChannel channel);
+   */
+  using OnConnectionOpenCallback = common::Callback<void(std::unique_ptr<FixedChannel>)>;
+
+  enum class RegistrationResult {
+    SUCCESS = 0,
+    FAIL_DUPLICATE_SERVICE = 1,  // Duplicate service registration for the same CID
+    FAIL_INVALID_SERVICE = 2,    // Invalid CID
+  };
+
+  /**
+   * OnRegistrationFailureCallback(RegistrationResult result, FixedChannelService service);
+   */
+  using OnRegistrationCompleteCallback =
+      common::OnceCallback<void(RegistrationResult, std::unique_ptr<FixedChannelService>)>;
+
+  /**
+   * Connect to ALL fixed channels on a remote device
+   *
+   * - This method is asynchronous
+   * - When false is returned, the connection fails immediately
+   * - When true is returned, method caller should wait for on_fail_callback or on_open_callback registered through
+   *   RegisterService() API.
+   * - If an ACL connection does not exist, this method will create an ACL connection. As a result, on_open_callback
+   *   supplied through RegisterService() will be triggered to provide the actual FixedChannel objects
+   * - If HCI connection failed, on_fail_callback will be triggered with FAIL_HCI_ERROR
+   * - If fixed channel on a remote device is already reported as connected via on_open_callback and has been acquired
+   *   via FixedChannel#Acquire() API, it won't be reported again
+   * - If no service is registered, on_fail_callback will be triggered with FAIL_NO_SERVICE_REGISTERED
+   * - If there is an ACL connection and channels for each service is allocated, on_fail_callback will be triggered with
+   *   FAIL_ALL_SERVICES_HAVE_CHANNEL
+   *
+   * NOTE:
+   * This call will initiate an effort to connect all fixed channel services on a remote device.
+   * Due to the connectionless nature of fixed channels, all fixed channels will be connected together.
+   * If a fixed channel service does not need a particular fixed channel. It should release the received
+   * channel immediately after receiving on_open_callback via FixedChannel#Release()
+   *
+   * A module calling ConnectServices() must have called RegisterService() before.
+   * The callback will come back from on_open_callback in the service that is registered
+   *
+   * @param device: Remote device to make this connection.
+   * @param on_fail_callback: A callback to indicate connection failure along with a status code.
+   * @param handler: The handler context in which to execute the @callback parameters.
+   *
+   * Returns: true if connection was able to be initiated, false otherwise.
+   */
+  bool ConnectServices(hci::Address device, OnConnectionFailureCallback on_fail_callback, os::Handler* handler);
+
+  /**
+   * Register a service to receive incoming connections bound to a specific channel.
+   *
+   * - This method is asynchronous.
+   * - When false is returned, the registration fails immediately.
+   * - When true is returned, method caller should wait for on_service_registered callback that contains a
+   *   FixedChannelService object. The registered service can be managed from that object.
+   * - If a CID is already registered or some other error happens, on_registration_complete will be triggered with a
+   *   non-SUCCESS value
+   * - After a service is registered, any classic ACL connection will create a FixedChannel object that is
+   *   delivered through on_open_callback
+   * - on_open_callback, will only be triggered after on_service_registered callback
+   *
+   * @param cid:  cid used to receive incoming connections
+   * @param security_policy: The security policy used for the connection.
+   * @param on_registration_complete: A callback to indicate the service setup has completed. If the return status is
+   *        not SUCCESS, it means service is not registered due to reasons like CID already take
+   * @param on_open_callback: A callback to indicate success of a connection initiated from a remote device.
+   * @param handler: The handler context in which to execute the @callback parameter.
+   */
+  bool RegisterService(Cid cid, const SecurityPolicy& security_policy,
+                       OnRegistrationCompleteCallback on_registration_complete,
+                       OnConnectionOpenCallback on_connection_open, os::Handler* handler);
+
+  friend class L2capClassicModule;
+
+ private:
+  // The constructor is not to be used by user code
+  FixedChannelManager(internal::FixedChannelServiceManagerImpl* service_manager, internal::LinkManager* link_manager,
+                      os::Handler* l2cap_layer_handler)
+      : service_manager_(service_manager), link_manager_(link_manager), l2cap_layer_handler_(l2cap_layer_handler) {}
+  internal::FixedChannelServiceManagerImpl* service_manager_ = nullptr;
+  internal::LinkManager* link_manager_ = nullptr;
+  os::Handler* l2cap_layer_handler_ = nullptr;
+  DISALLOW_COPY_AND_ASSIGN(FixedChannelManager);
+};
+
+}  // namespace classic
+}  // namespace l2cap
+}  // namespace bluetooth
diff --git a/gd/l2cap/classic/fixed_channel_service.cc b/gd/l2cap/classic/fixed_channel_service.cc
new file mode 100644
index 0000000..49a977d
--- /dev/null
+++ b/gd/l2cap/classic/fixed_channel_service.cc
@@ -0,0 +1,34 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "l2cap/classic/fixed_channel_service.h"
+#include "common/bind.h"
+#include "l2cap/classic/internal/fixed_channel_service_manager_impl.h"
+
+namespace bluetooth {
+namespace l2cap {
+namespace classic {
+
+void FixedChannelService::Unregister(OnUnregisteredCallback on_unregistered, os::Handler* on_unregistered_handler) {
+  ASSERT_LOG(manager_ != nullptr, "this service is invalid");
+  l2cap_layer_handler_->Post(common::BindOnce(&internal::FixedChannelServiceManagerImpl::Unregister,
+                                              common::Unretained(manager_), cid_, std::move(on_unregistered),
+                                              on_unregistered_handler));
+}
+
+}  // namespace classic
+}  // namespace l2cap
+}  // namespace bluetooth
\ No newline at end of file
diff --git a/gd/l2cap/classic/fixed_channel_service.h b/gd/l2cap/classic/fixed_channel_service.h
new file mode 100644
index 0000000..d5d213b
--- /dev/null
+++ b/gd/l2cap/classic/fixed_channel_service.h
@@ -0,0 +1,59 @@
+
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+#pragma once
+
+#include "common/callback.h"
+#include "hci/address.h"
+#include "l2cap/cid.h"
+#include "os/handler.h"
+
+namespace bluetooth {
+namespace l2cap {
+namespace classic {
+
+namespace internal {
+class FixedChannelServiceManagerImpl;
+}  // namespace internal
+
+class FixedChannelService {
+ public:
+  FixedChannelService() = default;
+
+  using OnUnregisteredCallback = common::OnceCallback<void()>;
+
+  /**
+   * Unregister a service from L2CAP module. This operation cannot fail.
+   * All channels opened for this service will be invalidated.
+   *
+   * @param on_unregistered will be triggered when unregistration is complete
+   */
+  void Unregister(OnUnregisteredCallback on_unregistered, os::Handler* on_unregistered_handler);
+
+  friend internal::FixedChannelServiceManagerImpl;
+
+ private:
+  FixedChannelService(Cid cid, internal::FixedChannelServiceManagerImpl* manager, os::Handler* handler)
+      : cid_(cid), manager_(manager), l2cap_layer_handler_(handler) {}
+  Cid cid_ = kInvalidCid;
+  internal::FixedChannelServiceManagerImpl* manager_ = nullptr;
+  os::Handler* l2cap_layer_handler_;
+  DISALLOW_COPY_AND_ASSIGN(FixedChannelService);
+};
+
+}  // namespace classic
+}  // namespace l2cap
+}  // namespace bluetooth
diff --git a/gd/l2cap/classic/internal/dynamic_channel_allocator.cc b/gd/l2cap/classic/internal/dynamic_channel_allocator.cc
new file mode 100644
index 0000000..95830e0
--- /dev/null
+++ b/gd/l2cap/classic/internal/dynamic_channel_allocator.cc
@@ -0,0 +1,140 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <unordered_map>
+
+#include "l2cap/cid.h"
+#include "l2cap/classic/internal/dynamic_channel_allocator.h"
+#include "l2cap/classic/internal/link.h"
+#include "l2cap/security_policy.h"
+#include "os/handler.h"
+#include "os/log.h"
+
+namespace bluetooth {
+namespace l2cap {
+namespace classic {
+namespace internal {
+
+std::shared_ptr<DynamicChannelImpl> DynamicChannelAllocator::AllocateChannel(Psm psm, Cid remote_cid,
+                                                                             SecurityPolicy security_policy) {
+  ASSERT_LOG(!IsPsmUsed((psm)), "Psm 0x%x for device %s is already in use", psm, link_->GetDevice().ToString().c_str());
+  ASSERT_LOG(IsPsmValid(psm), "Psm 0x%x is invalid", psm);
+
+  if (used_remote_cid_.find(remote_cid) != used_remote_cid_.end()) {
+    LOG_INFO("Remote cid 0x%x is used", remote_cid);
+    return nullptr;
+  }
+  Cid cid = kFirstDynamicChannel;
+  for (; cid <= kLastDynamicChannel; cid++) {
+    if (used_cid_.find(cid) == used_cid_.end()) break;
+  }
+  if (cid > kLastDynamicChannel) {
+    LOG_WARN("All cid are used");
+    return nullptr;
+  }
+  auto elem =
+      channels_.try_emplace(cid, std::make_shared<DynamicChannelImpl>(psm, cid, remote_cid, link_, l2cap_handler_));
+  ASSERT_LOG(elem.second, "Failed to create channel for psm 0x%x device %s", psm,
+             link_->GetDevice().ToString().c_str());
+  ASSERT(elem.first->second != nullptr);
+  used_remote_cid_.insert(remote_cid);
+  used_cid_.insert(cid);
+  return elem.first->second;
+}
+
+std::shared_ptr<DynamicChannelImpl> DynamicChannelAllocator::AllocateReservedChannel(Cid reserved_cid, Psm psm,
+                                                                                     Cid remote_cid,
+                                                                                     SecurityPolicy security_policy) {
+  ASSERT_LOG(!IsPsmUsed((psm)), "Psm 0x%x for device %s is already in use", psm, link_->GetDevice().ToString().c_str());
+  ASSERT_LOG(IsPsmValid(psm), "Psm 0x%x is invalid", psm);
+
+  if (used_remote_cid_.find(remote_cid) != used_remote_cid_.end()) {
+    LOG_INFO("Remote cid 0x%x is used", remote_cid);
+    return nullptr;
+  }
+  auto elem = channels_.try_emplace(
+      reserved_cid, std::make_shared<DynamicChannelImpl>(psm, reserved_cid, remote_cid, link_, l2cap_handler_));
+  ASSERT_LOG(elem.second, "Failed to create channel for psm 0x%x device %s", psm,
+             link_->GetDevice().ToString().c_str());
+  ASSERT(elem.first->second != nullptr);
+  used_remote_cid_.insert(remote_cid);
+  return elem.first->second;
+}
+
+Cid DynamicChannelAllocator::ReserveChannel() {
+  Cid cid = kFirstDynamicChannel;
+  for (; cid <= kLastDynamicChannel; cid++) {
+    if (used_cid_.find(cid) == used_cid_.end()) break;
+  }
+  if (cid > kLastDynamicChannel) {
+    LOG_WARN("All cid are used");
+    return kInvalidCid;
+  }
+  used_cid_.insert(cid);
+  return cid;
+}
+
+void DynamicChannelAllocator::FreeChannel(Cid cid) {
+  auto channel = FindChannelByCid(cid);
+  if (channel == nullptr) {
+    LOG_INFO("Channel is not in use: psm %d, device %s", cid, link_->GetDevice().ToString().c_str());
+    return;
+  }
+  used_remote_cid_.erase(channel->GetRemoteCid());
+  channels_.erase(cid);
+  used_cid_.erase(cid);
+}
+
+bool DynamicChannelAllocator::IsPsmUsed(Psm psm) const {
+  for (const auto& channel : channels_) {
+    if (channel.second->GetPsm() == psm) {
+      return true;
+    }
+  }
+  return false;
+}
+
+std::shared_ptr<DynamicChannelImpl> DynamicChannelAllocator::FindChannelByCid(Cid cid) {
+  if (channels_.find(cid) == channels_.end()) {
+    LOG_WARN("Can't find cid %d", cid);
+    return nullptr;
+  }
+  return channels_.find(cid)->second;
+}
+
+std::shared_ptr<DynamicChannelImpl> DynamicChannelAllocator::FindChannelByRemoteCid(Cid remote_cid) {
+  for (auto& channel : channels_) {
+    if (channel.second->GetRemoteCid() == remote_cid) {
+      return channel.second;
+    }
+  }
+  return nullptr;
+}
+
+size_t DynamicChannelAllocator::NumberOfChannels() const {
+  return channels_.size();
+}
+
+void DynamicChannelAllocator::OnAclDisconnected(hci::ErrorCode reason) {
+  for (auto& elem : channels_) {
+    elem.second->OnClosed(reason);
+  }
+}
+
+}  // namespace internal
+}  // namespace classic
+}  // namespace l2cap
+}  // namespace bluetooth
diff --git a/gd/l2cap/classic/internal/dynamic_channel_allocator.h b/gd/l2cap/classic/internal/dynamic_channel_allocator.h
new file mode 100644
index 0000000..57e0f90
--- /dev/null
+++ b/gd/l2cap/classic/internal/dynamic_channel_allocator.h
@@ -0,0 +1,80 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#pragma once
+
+#include <unordered_map>
+#include <unordered_set>
+
+#include "l2cap/cid.h"
+#include "l2cap/classic/internal/dynamic_channel_impl.h"
+#include "l2cap/psm.h"
+#include "l2cap/security_policy.h"
+#include "os/handler.h"
+#include "os/log.h"
+
+namespace bluetooth {
+namespace l2cap {
+namespace classic {
+namespace internal {
+
+class Link;
+
+// Helper class for keeping channels in a Link. It allocates and frees Channel object, and supports querying whether a
+// channel is in use
+class DynamicChannelAllocator {
+ public:
+  DynamicChannelAllocator(Link* link, os::Handler* l2cap_handler) : link_(link), l2cap_handler_(l2cap_handler) {
+    ASSERT(link_ != nullptr);
+    ASSERT(l2cap_handler_ != nullptr);
+  }
+
+  // Allocates a channel. If psm is used, OR the remote cid already exists, return nullptr.
+  // NOTE: The returned DynamicChannelImpl object is still owned by the channel allocator, NOT the client.
+  std::shared_ptr<DynamicChannelImpl> AllocateChannel(Psm psm, Cid remote_cid, SecurityPolicy security_policy);
+
+  std::shared_ptr<DynamicChannelImpl> AllocateReservedChannel(Cid reserved_cid, Psm psm, Cid remote_cid,
+                                                              SecurityPolicy security_policy);
+
+  // Gives an unused Cid to be used for opening a channel. If a channel is used, call AllocateReservedChannel. If no
+  // longer needed, use FreeChannel.
+  Cid ReserveChannel();
+
+  // Frees a channel. If psm doesn't exist, it will crash
+  void FreeChannel(Cid cid);
+
+  bool IsPsmUsed(Psm psm) const;
+
+  std::shared_ptr<DynamicChannelImpl> FindChannelByCid(Cid cid);
+  std::shared_ptr<DynamicChannelImpl> FindChannelByRemoteCid(Cid cid);
+
+  // Returns number of open, but not reserved channels
+  size_t NumberOfChannels() const;
+
+  void OnAclDisconnected(hci::ErrorCode hci_status);
+
+ private:
+  Link* link_;
+  os::Handler* l2cap_handler_;
+  std::unordered_set<Cid> used_cid_;
+  std::unordered_map<Cid, std::shared_ptr<DynamicChannelImpl>> channels_;
+  std::unordered_set<Cid> used_remote_cid_;
+};
+
+}  // namespace internal
+}  // namespace classic
+}  // namespace l2cap
+}  // namespace bluetooth
diff --git a/gd/l2cap/classic/internal/dynamic_channel_allocator_fuzz_test.cc b/gd/l2cap/classic/internal/dynamic_channel_allocator_fuzz_test.cc
new file mode 100644
index 0000000..80d1518
--- /dev/null
+++ b/gd/l2cap/classic/internal/dynamic_channel_allocator_fuzz_test.cc
@@ -0,0 +1,89 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "l2cap/classic/internal/dynamic_channel_allocator.h"
+#include "l2cap/classic/internal/link_mock.h"
+#include "l2cap/internal/parameter_provider_mock.h"
+
+#include <gmock/gmock.h>
+
+namespace bluetooth {
+namespace l2cap {
+namespace classic {
+namespace internal {
+
+using hci::testing::MockAclConnection;
+using l2cap::internal::testing::MockParameterProvider;
+using l2cap::internal::testing::MockScheduler;
+using testing::MockLink;
+using ::testing::NiceMock;
+using ::testing::Return;
+
+const hci::Address device{{0x01, 0x02, 0x03, 0x04, 0x05, 0x06}};
+
+class L2capClassicDynamicChannelAllocatorFuzzTest {
+ public:
+  void RunTests(const uint8_t* data, size_t size) {
+    SetUp();
+    TestPrecondition(data, size);
+    TearDown();
+  }
+
+ private:
+  void SetUp() {
+    thread_ = new os::Thread("test_thread", os::Thread::Priority::NORMAL);
+    handler_ = new os::Handler(thread_);
+    mock_parameter_provider_ = new NiceMock<MockParameterProvider>();
+    mock_classic_link_ =
+        new NiceMock<MockLink>(handler_, mock_parameter_provider_, std::make_unique<NiceMock<MockAclConnection>>(),
+                               std::make_unique<NiceMock<MockScheduler>>());
+    EXPECT_CALL(*mock_classic_link_, GetDevice()).WillRepeatedly(Return(device));
+    channel_allocator_ = std::make_unique<DynamicChannelAllocator>(mock_classic_link_, handler_);
+  }
+
+  void TearDown() {
+    channel_allocator_.reset();
+    delete mock_classic_link_;
+    delete mock_parameter_provider_;
+    handler_->Clear();
+    delete handler_;
+    delete thread_;
+  }
+
+  void TestPrecondition(const uint8_t* data, size_t size) {
+    if (size != 2) {
+      return;
+    }
+    Psm psm = *reinterpret_cast<const Psm*>(data);
+    EXPECT_FALSE(channel_allocator_->IsPsmUsed(psm));
+  }
+
+  os::Thread* thread_{nullptr};
+  os::Handler* handler_{nullptr};
+  NiceMock<MockParameterProvider>* mock_parameter_provider_{nullptr};
+  NiceMock<MockLink>* mock_classic_link_{nullptr};
+  std::unique_ptr<DynamicChannelAllocator> channel_allocator_;
+};
+
+}  // namespace internal
+}  // namespace classic
+}  // namespace l2cap
+}  // namespace bluetooth
+
+void RunL2capClassicDynamicChannelAllocatorFuzzTest(const uint8_t* data, size_t size) {
+  bluetooth::l2cap::classic::internal::L2capClassicDynamicChannelAllocatorFuzzTest test;
+  test.RunTests(data, size);
+}
\ No newline at end of file
diff --git a/gd/l2cap/classic/internal/dynamic_channel_allocator_test.cc b/gd/l2cap/classic/internal/dynamic_channel_allocator_test.cc
new file mode 100644
index 0000000..8e3f66b
--- /dev/null
+++ b/gd/l2cap/classic/internal/dynamic_channel_allocator_test.cc
@@ -0,0 +1,94 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "l2cap/classic/internal/dynamic_channel_allocator.h"
+#include "l2cap/classic/internal/link_mock.h"
+#include "l2cap/internal/parameter_provider_mock.h"
+
+#include <gmock/gmock.h>
+#include <gtest/gtest.h>
+
+namespace bluetooth {
+namespace l2cap {
+namespace classic {
+namespace internal {
+
+using l2cap::internal::testing::MockParameterProvider;
+using testing::MockLink;
+using ::testing::Return;
+
+const hci::Address device{{0x01, 0x02, 0x03, 0x04, 0x05, 0x06}};
+
+class L2capClassicDynamicChannelAllocatorTest : public ::testing::Test {
+ protected:
+  void SetUp() override {
+    thread_ = new os::Thread("test_thread", os::Thread::Priority::NORMAL);
+    handler_ = new os::Handler(thread_);
+    mock_parameter_provider_ = new MockParameterProvider();
+    mock_classic_link_ = new MockLink(handler_, mock_parameter_provider_);
+    EXPECT_CALL(*mock_classic_link_, GetDevice()).WillRepeatedly(Return(device));
+    channel_allocator_ = std::make_unique<DynamicChannelAllocator>(mock_classic_link_, handler_);
+  }
+
+  void TearDown() override {
+    channel_allocator_.reset();
+    delete mock_classic_link_;
+    delete mock_parameter_provider_;
+    handler_->Clear();
+    delete handler_;
+    delete thread_;
+  }
+
+  os::Thread* thread_{nullptr};
+  os::Handler* handler_{nullptr};
+  MockParameterProvider* mock_parameter_provider_{nullptr};
+  MockLink* mock_classic_link_{nullptr};
+  std::unique_ptr<DynamicChannelAllocator> channel_allocator_;
+};
+
+TEST_F(L2capClassicDynamicChannelAllocatorTest, precondition) {
+  Psm psm = 0x03;
+  EXPECT_FALSE(channel_allocator_->IsPsmUsed(psm));
+}
+
+TEST_F(L2capClassicDynamicChannelAllocatorTest, allocate_and_free_channel) {
+  Psm psm = 0x03;
+  Cid remote_cid = kFirstDynamicChannel;
+  auto channel = channel_allocator_->AllocateChannel(psm, remote_cid, {});
+  Cid local_cid = channel->GetCid();
+  EXPECT_TRUE(channel_allocator_->IsPsmUsed(psm));
+  EXPECT_EQ(channel, channel_allocator_->FindChannelByCid(local_cid));
+  ASSERT_NO_FATAL_FAILURE(channel_allocator_->FreeChannel(local_cid));
+  EXPECT_FALSE(channel_allocator_->IsPsmUsed(psm));
+}
+
+TEST_F(L2capClassicDynamicChannelAllocatorTest, reserve_channel) {
+  Psm psm = 0x03;
+  Cid remote_cid = kFirstDynamicChannel;
+  Cid reserved = channel_allocator_->ReserveChannel();
+  auto channel = channel_allocator_->AllocateReservedChannel(reserved, psm, remote_cid, {});
+  Cid local_cid = channel->GetCid();
+  EXPECT_EQ(local_cid, reserved);
+  EXPECT_TRUE(channel_allocator_->IsPsmUsed(psm));
+  EXPECT_EQ(channel, channel_allocator_->FindChannelByCid(local_cid));
+  ASSERT_NO_FATAL_FAILURE(channel_allocator_->FreeChannel(local_cid));
+  EXPECT_FALSE(channel_allocator_->IsPsmUsed(psm));
+}
+
+}  // namespace internal
+}  // namespace classic
+}  // namespace l2cap
+}  // namespace bluetooth
diff --git a/gd/l2cap/classic/internal/dynamic_channel_impl.cc b/gd/l2cap/classic/internal/dynamic_channel_impl.cc
new file mode 100644
index 0000000..d81096d
--- /dev/null
+++ b/gd/l2cap/classic/internal/dynamic_channel_impl.cc
@@ -0,0 +1,95 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <unordered_map>
+
+#include "l2cap/cid.h"
+#include "l2cap/classic/internal/dynamic_channel_impl.h"
+#include "l2cap/classic/internal/link.h"
+#include "l2cap/psm.h"
+#include "l2cap/security_policy.h"
+#include "os/handler.h"
+#include "os/log.h"
+
+namespace bluetooth {
+namespace l2cap {
+namespace classic {
+namespace internal {
+
+DynamicChannelImpl::DynamicChannelImpl(Psm psm, Cid cid, Cid remote_cid, Link* link, os::Handler* l2cap_handler)
+    : psm_(psm), cid_(cid), remote_cid_(remote_cid), link_(link), l2cap_handler_(l2cap_handler),
+      device_(link->GetDevice()) {
+  ASSERT(IsPsmValid(psm_));
+  ASSERT(cid_ > 0);
+  ASSERT(remote_cid_ > 0);
+  ASSERT(link_ != nullptr);
+  ASSERT(l2cap_handler_ != nullptr);
+}
+
+hci::Address DynamicChannelImpl::GetDevice() const {
+  return device_;
+}
+
+void DynamicChannelImpl::RegisterOnCloseCallback(os::Handler* user_handler,
+                                                 DynamicChannel::OnCloseCallback on_close_callback) {
+  ASSERT_LOG(user_handler_ == nullptr, "OnCloseCallback can only be registered once");
+  // If channel is already closed, call the callback immediately without saving it
+  if (closed_) {
+    user_handler->Post(common::BindOnce(std::move(on_close_callback), close_reason_));
+    return;
+  }
+  user_handler_ = user_handler;
+  on_close_callback_ = std::move(on_close_callback);
+}
+
+void DynamicChannelImpl::Close() {
+  link_->SendDisconnectionRequest(cid_, remote_cid_);
+}
+
+void DynamicChannelImpl::OnClosed(hci::ErrorCode status) {
+  ASSERT_LOG(!closed_, "Device %s Cid 0x%x closed twice, old status 0x%x, new status 0x%x", device_.ToString().c_str(),
+             cid_, static_cast<int>(close_reason_), static_cast<int>(status));
+  closed_ = true;
+  close_reason_ = status;
+  link_ = nullptr;
+  l2cap_handler_ = nullptr;
+  if (user_handler_ == nullptr) {
+    return;
+  }
+  // On close callback can only be called once
+  user_handler_->Post(common::BindOnce(std::move(on_close_callback_), status));
+  user_handler_ = nullptr;
+  on_close_callback_.Reset();
+}
+
+std::string DynamicChannelImpl::ToString() {
+  std::ostringstream ss;
+  ss << "Device " << device_ << "Psm 0x" << std::hex << psm_ << " Cid 0x" << std::hex << cid_;
+  return ss.str();
+}
+
+void DynamicChannelImpl::SetOutgoingConfigurationStatus(ConfigurationStatus status) {
+  outgoing_configuration_status_ = status;
+}
+
+void DynamicChannelImpl::SetIncomingConfigurationStatus(ConfigurationStatus status) {
+  incoming_configuration_status_ = status;
+}
+
+}  // namespace internal
+}  // namespace classic
+}  // namespace l2cap
+}  // namespace bluetooth
diff --git a/gd/l2cap/classic/internal/dynamic_channel_impl.h b/gd/l2cap/classic/internal/dynamic_channel_impl.h
new file mode 100644
index 0000000..1f293eb
--- /dev/null
+++ b/gd/l2cap/classic/internal/dynamic_channel_impl.h
@@ -0,0 +1,108 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#pragma once
+
+#include "common/bidi_queue.h"
+#include "hci/address.h"
+#include "l2cap/cid.h"
+#include "l2cap/classic/dynamic_channel.h"
+#include "l2cap/psm.h"
+#include "os/handler.h"
+#include "os/log.h"
+
+namespace bluetooth {
+namespace l2cap {
+namespace classic {
+namespace internal {
+
+class Link;
+
+class DynamicChannelImpl {
+ public:
+  DynamicChannelImpl(Psm psm, Cid cid, Cid remote_cid, Link* link, os::Handler* l2cap_handler);
+
+  virtual ~DynamicChannelImpl() = default;
+
+  hci::Address GetDevice() const;
+
+  virtual void RegisterOnCloseCallback(os::Handler* user_handler, DynamicChannel::OnCloseCallback on_close_callback);
+
+  virtual void Close();
+  virtual void OnClosed(hci::ErrorCode status);
+  virtual std::string ToString();
+
+  common::BidiQueueEnd<packet::BasePacketBuilder, packet::PacketView<packet::kLittleEndian>>* GetQueueUpEnd() {
+    return channel_queue_.GetUpEnd();
+  }
+
+  common::BidiQueueEnd<packet::PacketView<packet::kLittleEndian>, packet::BasePacketBuilder>* GetQueueDownEnd() {
+    return channel_queue_.GetDownEnd();
+  }
+
+  virtual Cid GetCid() const {
+    return cid_;
+  }
+
+  virtual Cid GetRemoteCid() const {
+    return remote_cid_;
+  }
+
+  virtual Psm GetPsm() const {
+    return psm_;
+  }
+
+  enum class ConfigurationStatus { NOT_CONFIGURED, CONFIGURED };
+
+  virtual void SetOutgoingConfigurationStatus(ConfigurationStatus status);
+  virtual void SetIncomingConfigurationStatus(ConfigurationStatus status);
+
+  virtual ConfigurationStatus GetOutgoingConfigurationStatus() const {
+    return outgoing_configuration_status_;
+  }
+
+  virtual ConfigurationStatus GetIncomingConfigurationStatus() const {
+    return incoming_configuration_status_;
+  }
+
+ private:
+  const Psm psm_;
+  const Cid cid_;
+  const Cid remote_cid_;
+  Link* link_;
+  os::Handler* l2cap_handler_;
+  const hci::Address device_;
+
+  // User supported states
+  os::Handler* user_handler_ = nullptr;
+  DynamicChannel::OnCloseCallback on_close_callback_{};
+
+  // Internal states
+  bool closed_ = false;
+  hci::ErrorCode close_reason_ = hci::ErrorCode::SUCCESS;
+  static constexpr size_t kChannelQueueSize = 10;
+  common::BidiQueue<packet::PacketView<packet::kLittleEndian>, packet::BasePacketBuilder> channel_queue_{
+      kChannelQueueSize};
+  ConfigurationStatus outgoing_configuration_status_ = ConfigurationStatus::NOT_CONFIGURED;
+  ConfigurationStatus incoming_configuration_status_ = ConfigurationStatus::NOT_CONFIGURED;
+
+  DISALLOW_COPY_AND_ASSIGN(DynamicChannelImpl);
+};
+
+}  // namespace internal
+}  // namespace classic
+}  // namespace l2cap
+}  // namespace bluetooth
diff --git a/gd/l2cap/classic/internal/dynamic_channel_impl_test.cc b/gd/l2cap/classic/internal/dynamic_channel_impl_test.cc
new file mode 100644
index 0000000..2f6c649
--- /dev/null
+++ b/gd/l2cap/classic/internal/dynamic_channel_impl_test.cc
@@ -0,0 +1,164 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+#include "l2cap/classic/internal/dynamic_channel_impl.h"
+
+#include "common/testing/bind_test_util.h"
+#include "l2cap/cid.h"
+#include "l2cap/classic/internal/link_mock.h"
+#include "l2cap/internal/parameter_provider_mock.h"
+#include "os/handler.h"
+
+#include <gmock/gmock.h>
+#include <gtest/gtest.h>
+
+namespace bluetooth {
+namespace l2cap {
+namespace classic {
+namespace internal {
+
+using l2cap::internal::testing::MockParameterProvider;
+using testing::MockLink;
+using ::testing::Return;
+
+class L2capClassicDynamicChannelImplTest : public ::testing::Test {
+ public:
+  static void SyncHandler(os::Handler* handler) {
+    std::promise<void> promise;
+    auto future = promise.get_future();
+    handler->Post(common::BindOnce(&std::promise<void>::set_value, common::Unretained(&promise)));
+    future.wait_for(std::chrono::milliseconds(3));
+  }
+
+ protected:
+  void SetUp() override {
+    thread_ = new os::Thread("test_thread", os::Thread::Priority::NORMAL);
+    l2cap_handler_ = new os::Handler(thread_);
+  }
+
+  void TearDown() override {
+    l2cap_handler_->Clear();
+    delete l2cap_handler_;
+    delete thread_;
+  }
+
+  os::Thread* thread_ = nullptr;
+  os::Handler* l2cap_handler_ = nullptr;
+};
+
+TEST_F(L2capClassicDynamicChannelImplTest, get_device) {
+  MockParameterProvider mock_parameter_provider;
+  MockLink mock_classic_link(l2cap_handler_, &mock_parameter_provider);
+  hci::Address device{{0x01, 0x02, 0x03, 0x04, 0x05, 0x06}};
+  EXPECT_CALL(mock_classic_link, GetDevice()).WillRepeatedly(Return(device));
+  DynamicChannelImpl dynamic_channel_impl(0x01, kFirstDynamicChannel, kFirstDynamicChannel, &mock_classic_link,
+                                          l2cap_handler_);
+  EXPECT_EQ(device, dynamic_channel_impl.GetDevice());
+}
+
+TEST_F(L2capClassicDynamicChannelImplTest, close_triggers_callback) {
+  MockParameterProvider mock_parameter_provider;
+  MockLink mock_classic_link(l2cap_handler_, &mock_parameter_provider);
+  hci::Address device{{0x01, 0x02, 0x03, 0x04, 0x05, 0x06}};
+  EXPECT_CALL(mock_classic_link, GetDevice()).WillRepeatedly(Return(device));
+  DynamicChannelImpl dynamic_channel_impl(0x01, kFirstDynamicChannel, kFirstDynamicChannel, &mock_classic_link,
+                                          l2cap_handler_);
+
+  // Register on close callback
+  auto user_handler = std::make_unique<os::Handler>(thread_);
+  hci::ErrorCode my_status = hci::ErrorCode::SUCCESS;
+  dynamic_channel_impl.RegisterOnCloseCallback(
+      user_handler.get(), common::testing::BindLambdaForTesting([&](hci::ErrorCode status) { my_status = status; }));
+
+  // Channel closure should trigger such callback
+  dynamic_channel_impl.OnClosed(hci::ErrorCode::REMOTE_USER_TERMINATED_CONNECTION);
+  SyncHandler(user_handler.get());
+  EXPECT_EQ(hci::ErrorCode::REMOTE_USER_TERMINATED_CONNECTION, my_status);
+
+  user_handler->Clear();
+}
+
+TEST_F(L2capClassicDynamicChannelImplTest, register_callback_after_close_should_call_immediately) {
+  MockParameterProvider mock_parameter_provider;
+  MockLink mock_classic_link(l2cap_handler_, &mock_parameter_provider);
+  hci::Address device{{0x01, 0x02, 0x03, 0x04, 0x05, 0x06}};
+  EXPECT_CALL(mock_classic_link, GetDevice()).WillRepeatedly(Return(device));
+  DynamicChannelImpl dynamic_channel_impl(0x01, kFirstDynamicChannel, kFirstDynamicChannel, &mock_classic_link,
+                                          l2cap_handler_);
+
+  // Channel closure should do nothing
+  dynamic_channel_impl.OnClosed(hci::ErrorCode::REMOTE_USER_TERMINATED_CONNECTION);
+
+  // Register on close callback should trigger callback immediately
+  auto user_handler = std::make_unique<os::Handler>(thread_);
+  hci::ErrorCode my_status = hci::ErrorCode::SUCCESS;
+  dynamic_channel_impl.RegisterOnCloseCallback(
+      user_handler.get(), common::testing::BindLambdaForTesting([&](hci::ErrorCode status) { my_status = status; }));
+  SyncHandler(user_handler.get());
+  EXPECT_EQ(hci::ErrorCode::REMOTE_USER_TERMINATED_CONNECTION, my_status);
+
+  user_handler->Clear();
+}
+
+TEST_F(L2capClassicDynamicChannelImplTest, close_twice_should_fail) {
+  MockParameterProvider mock_parameter_provider;
+  MockLink mock_classic_link(l2cap_handler_, &mock_parameter_provider);
+  hci::Address device{{0x01, 0x02, 0x03, 0x04, 0x05, 0x06}};
+  EXPECT_CALL(mock_classic_link, GetDevice()).WillRepeatedly(Return(device));
+  DynamicChannelImpl dynamic_channel_impl(0x01, kFirstDynamicChannel, kFirstDynamicChannel, &mock_classic_link,
+                                          l2cap_handler_);
+
+  // Register on close callback
+  auto user_handler = std::make_unique<os::Handler>(thread_);
+  hci::ErrorCode my_status = hci::ErrorCode::SUCCESS;
+  dynamic_channel_impl.RegisterOnCloseCallback(
+      user_handler.get(), common::testing::BindLambdaForTesting([&](hci::ErrorCode status) { my_status = status; }));
+
+  // Channel closure should trigger such callback
+  dynamic_channel_impl.OnClosed(hci::ErrorCode::REMOTE_USER_TERMINATED_CONNECTION);
+  SyncHandler(user_handler.get());
+  EXPECT_EQ(hci::ErrorCode::REMOTE_USER_TERMINATED_CONNECTION, my_status);
+
+  // 2nd OnClose() callback should fail
+  EXPECT_DEATH(dynamic_channel_impl.OnClosed(hci::ErrorCode::PAGE_TIMEOUT), ".*OnClosed.*");
+
+  user_handler->Clear();
+}
+
+TEST_F(L2capClassicDynamicChannelImplTest, multiple_registeration_should_fail) {
+  MockParameterProvider mock_parameter_provider;
+  MockLink mock_classic_link(l2cap_handler_, &mock_parameter_provider);
+  hci::Address device{{0x01, 0x02, 0x03, 0x04, 0x05, 0x06}};
+  EXPECT_CALL(mock_classic_link, GetDevice()).WillRepeatedly(Return(device));
+  DynamicChannelImpl dynamic_channel_impl(0x01, kFirstDynamicChannel, kFirstDynamicChannel, &mock_classic_link,
+                                          l2cap_handler_);
+
+  // Register on close callback
+  auto user_handler = std::make_unique<os::Handler>(thread_);
+  hci::ErrorCode my_status = hci::ErrorCode::SUCCESS;
+  dynamic_channel_impl.RegisterOnCloseCallback(
+      user_handler.get(), common::testing::BindLambdaForTesting([&](hci::ErrorCode status) { my_status = status; }));
+
+  EXPECT_DEATH(dynamic_channel_impl.RegisterOnCloseCallback(user_handler.get(),
+                                                            common::BindOnce([](hci::ErrorCode status) { FAIL(); })),
+               ".*RegisterOnCloseCallback.*");
+
+  user_handler->Clear();
+}
+
+}  // namespace internal
+}  // namespace classic
+}  // namespace l2cap
+}  // namespace bluetooth
diff --git a/gd/l2cap/classic/internal/dynamic_channel_service_impl.h b/gd/l2cap/classic/internal/dynamic_channel_service_impl.h
new file mode 100644
index 0000000..57e5df4
--- /dev/null
+++ b/gd/l2cap/classic/internal/dynamic_channel_service_impl.h
@@ -0,0 +1,59 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#pragma once
+
+#include "common/bind.h"
+
+#include "l2cap/classic/dynamic_channel.h"
+#include "l2cap/classic/dynamic_channel_manager.h"
+#include "l2cap/classic/dynamic_channel_service.h"
+
+namespace bluetooth {
+namespace l2cap {
+namespace classic {
+namespace internal {
+class DynamicChannelServiceImpl {
+ public:
+  virtual ~DynamicChannelServiceImpl() = default;
+
+  struct PendingRegistration {
+    os::Handler* user_handler_ = nullptr;
+    DynamicChannelManager::OnRegistrationCompleteCallback on_registration_complete_callback_;
+    DynamicChannelManager::OnConnectionOpenCallback on_connection_open_callback_;
+  };
+
+  virtual void NotifyChannelCreation(std::unique_ptr<DynamicChannel> channel) {
+    user_handler_->Post(common::BindOnce(on_connection_open_callback_, std::move(channel)));
+  }
+
+  friend class DynamicChannelServiceManagerImpl;
+
+ protected:
+  // protected access for mocking
+  DynamicChannelServiceImpl(os::Handler* user_handler,
+                            DynamicChannelManager::OnConnectionOpenCallback on_connection_open_callback)
+      : user_handler_(user_handler), on_connection_open_callback_(std::move(on_connection_open_callback)) {}
+
+ private:
+  os::Handler* user_handler_ = nullptr;
+  DynamicChannelManager::OnConnectionOpenCallback on_connection_open_callback_;
+};
+
+}  // namespace internal
+}  // namespace classic
+}  // namespace l2cap
+}  // namespace bluetooth
diff --git a/gd/l2cap/classic/internal/dynamic_channel_service_manager_impl.cc b/gd/l2cap/classic/internal/dynamic_channel_service_manager_impl.cc
new file mode 100644
index 0000000..d40bfae
--- /dev/null
+++ b/gd/l2cap/classic/internal/dynamic_channel_service_manager_impl.cc
@@ -0,0 +1,81 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "l2cap/classic/internal/dynamic_channel_service_manager_impl.h"
+#include "common/bind.h"
+#include "l2cap/classic/internal/dynamic_channel_service_impl.h"
+#include "l2cap/psm.h"
+#include "os/log.h"
+
+namespace bluetooth {
+namespace l2cap {
+namespace classic {
+namespace internal {
+
+void DynamicChannelServiceManagerImpl::Register(Psm psm,
+                                                DynamicChannelServiceImpl::PendingRegistration pending_registration) {
+  if (!IsPsmValid(psm)) {
+    std::unique_ptr<DynamicChannelService> invalid_service(new DynamicChannelService());
+    pending_registration.user_handler_->Post(
+        common::BindOnce(std::move(pending_registration.on_registration_complete_callback_),
+                         DynamicChannelManager::RegistrationResult::FAIL_INVALID_SERVICE, std::move(invalid_service)));
+  } else if (IsServiceRegistered(psm)) {
+    std::unique_ptr<DynamicChannelService> invalid_service(new DynamicChannelService());
+    pending_registration.user_handler_->Post(common::BindOnce(
+        std::move(pending_registration.on_registration_complete_callback_),
+        DynamicChannelManager::RegistrationResult::FAIL_DUPLICATE_SERVICE, std::move(invalid_service)));
+  } else {
+    service_map_.try_emplace(psm,
+                             DynamicChannelServiceImpl(pending_registration.user_handler_,
+                                                       std::move(pending_registration.on_connection_open_callback_)));
+    std::unique_ptr<DynamicChannelService> user_service(new DynamicChannelService(psm, this, l2cap_layer_handler_));
+    pending_registration.user_handler_->Post(
+        common::BindOnce(std::move(pending_registration.on_registration_complete_callback_),
+                         DynamicChannelManager::RegistrationResult::SUCCESS, std::move(user_service)));
+  }
+}
+
+void DynamicChannelServiceManagerImpl::Unregister(Psm psm, DynamicChannelService::OnUnregisteredCallback callback,
+                                                  os::Handler* handler) {
+  if (IsServiceRegistered(psm)) {
+    service_map_.erase(psm);
+    handler->Post(std::move(callback));
+  } else {
+    LOG_ERROR("service not registered psm:%d", psm);
+  }
+}
+
+bool DynamicChannelServiceManagerImpl::IsServiceRegistered(Psm psm) const {
+  return service_map_.find(psm) != service_map_.end();
+}
+
+DynamicChannelServiceImpl* DynamicChannelServiceManagerImpl::GetService(Psm psm) {
+  ASSERT(IsServiceRegistered(psm));
+  return &service_map_.find(psm)->second;
+}
+
+std::vector<std::pair<Psm, DynamicChannelServiceImpl*>> DynamicChannelServiceManagerImpl::GetRegisteredServices() {
+  std::vector<std::pair<Psm, DynamicChannelServiceImpl*>> results;
+  for (auto& elem : service_map_) {
+    results.emplace_back(elem.first, &elem.second);
+  }
+  return results;
+}
+
+}  // namespace internal
+}  // namespace classic
+}  // namespace l2cap
+}  // namespace bluetooth
diff --git a/gd/l2cap/classic/internal/dynamic_channel_service_manager_impl.h b/gd/l2cap/classic/internal/dynamic_channel_service_manager_impl.h
new file mode 100644
index 0000000..c980639
--- /dev/null
+++ b/gd/l2cap/classic/internal/dynamic_channel_service_manager_impl.h
@@ -0,0 +1,54 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#pragma once
+
+#include <unordered_map>
+
+#include "l2cap/classic/dynamic_channel_service.h"
+#include "l2cap/classic/internal/dynamic_channel_service_impl.h"
+#include "l2cap/psm.h"
+#include "os/handler.h"
+#include "os/log.h"
+
+namespace bluetooth {
+namespace l2cap {
+namespace classic {
+namespace internal {
+
+class DynamicChannelServiceManagerImpl {
+ public:
+  explicit DynamicChannelServiceManagerImpl(os::Handler* l2cap_layer_handler)
+      : l2cap_layer_handler_(l2cap_layer_handler) {}
+
+  virtual ~DynamicChannelServiceManagerImpl() = default;
+  //
+  // All APIs must be invoked in L2CAP layer handler
+  //
+  virtual void Register(Psm psm, DynamicChannelServiceImpl::PendingRegistration pending_registration);
+  virtual void Unregister(Psm psm, DynamicChannelService::OnUnregisteredCallback callback, os::Handler* handler);
+  virtual bool IsServiceRegistered(Psm psm) const;
+  virtual DynamicChannelServiceImpl* GetService(Psm psm);
+
+  virtual std::vector<std::pair<Psm, DynamicChannelServiceImpl*>> GetRegisteredServices();
+ private:
+  os::Handler* l2cap_layer_handler_ = nullptr;
+  std::unordered_map<Psm, DynamicChannelServiceImpl> service_map_;
+};
+}  // namespace internal
+}  // namespace classic
+}  // namespace l2cap
+}  // namespace bluetooth
diff --git a/gd/l2cap/classic/internal/dynamic_channel_service_manager_impl_mock.h b/gd/l2cap/classic/internal/dynamic_channel_service_manager_impl_mock.h
new file mode 100644
index 0000000..34363f1
--- /dev/null
+++ b/gd/l2cap/classic/internal/dynamic_channel_service_manager_impl_mock.h
@@ -0,0 +1,46 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+#pragma once
+
+#include "l2cap/classic/internal/dynamic_channel_impl.h"
+#include "l2cap/classic/internal/dynamic_channel_service_manager_impl.h"
+
+#include <gmock/gmock.h>
+
+// Unit test interfaces
+namespace bluetooth {
+namespace l2cap {
+namespace classic {
+namespace internal {
+namespace testing {
+
+class MockDynamicChannelServiceManagerImpl : public DynamicChannelServiceManagerImpl {
+ public:
+  MockDynamicChannelServiceManagerImpl() : DynamicChannelServiceManagerImpl(nullptr) {}
+  MOCK_METHOD(void, Register, (Psm psm, DynamicChannelServiceImpl::PendingRegistration pending_registration),
+              (override));
+  MOCK_METHOD(void, Unregister, (Psm psm, DynamicChannelService::OnUnregisteredCallback callback, os::Handler* handler),
+              (override));
+  MOCK_METHOD(bool, IsServiceRegistered, (Psm psm), (const, override));
+  MOCK_METHOD(DynamicChannelServiceImpl*, GetService, (Psm psm), (override));
+  MOCK_METHOD((std::vector<std::pair<Psm, DynamicChannelServiceImpl*>>), GetRegisteredServices, (), (override));
+};
+
+}  // namespace testing
+}  // namespace internal
+}  // namespace classic
+}  // namespace l2cap
+}  // namespace bluetooth
\ No newline at end of file
diff --git a/gd/l2cap/classic/internal/dynamic_channel_service_manager_test.cc b/gd/l2cap/classic/internal/dynamic_channel_service_manager_test.cc
new file mode 100644
index 0000000..f59dcb6
--- /dev/null
+++ b/gd/l2cap/classic/internal/dynamic_channel_service_manager_test.cc
@@ -0,0 +1,107 @@
+/*
+ * Copyright 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <future>
+
+#include <gtest/gtest.h>
+
+#include "common/bind.h"
+#include "l2cap/cid.h"
+#include "l2cap/classic/dynamic_channel_manager.h"
+#include "l2cap/classic/dynamic_channel_service.h"
+#include "l2cap/classic/internal/dynamic_channel_service_manager_impl.h"
+#include "os/handler.h"
+#include "os/thread.h"
+
+namespace bluetooth {
+namespace l2cap {
+namespace classic {
+namespace internal {
+
+class L2capDynamicServiceManagerTest : public ::testing::Test {
+ public:
+  ~L2capDynamicServiceManagerTest() override = default;
+
+  void OnServiceRegistered(bool expect_success, DynamicChannelManager::RegistrationResult result,
+                           std::unique_ptr<DynamicChannelService> user_service) {
+    EXPECT_EQ(result == DynamicChannelManager::RegistrationResult::SUCCESS, expect_success);
+    service_registered_ = expect_success;
+  }
+
+ protected:
+  void SetUp() override {
+    thread_ = new os::Thread("test_thread", os::Thread::Priority::NORMAL);
+    user_handler_ = new os::Handler(thread_);
+    l2cap_handler_ = new os::Handler(thread_);
+    manager_ = new DynamicChannelServiceManagerImpl{l2cap_handler_};
+  }
+
+  void TearDown() override {
+    delete manager_;
+    l2cap_handler_->Clear();
+    delete l2cap_handler_;
+    user_handler_->Clear();
+    delete user_handler_;
+    delete thread_;
+  }
+
+  void sync_user_handler() {
+    std::promise<void> promise;
+    auto future = promise.get_future();
+    user_handler_->Post(common::BindOnce(&std::promise<void>::set_value, common::Unretained(&promise)));
+    future.wait_for(std::chrono::milliseconds(3));
+  }
+
+  DynamicChannelServiceManagerImpl* manager_ = nullptr;
+  os::Thread* thread_ = nullptr;
+  os::Handler* user_handler_ = nullptr;
+  os::Handler* l2cap_handler_ = nullptr;
+
+  bool service_registered_ = false;
+};
+
+TEST_F(L2capDynamicServiceManagerTest, register_and_unregister_classic_dynamic_channel) {
+  DynamicChannelServiceImpl::PendingRegistration pending_registration{
+      .user_handler_ = user_handler_,
+      .on_registration_complete_callback_ =
+          common::BindOnce(&L2capDynamicServiceManagerTest::OnServiceRegistered, common::Unretained(this), true)};
+  Cid cid = kSmpBrCid;
+  EXPECT_FALSE(manager_->IsServiceRegistered(cid));
+  manager_->Register(cid, std::move(pending_registration));
+  EXPECT_TRUE(manager_->IsServiceRegistered(cid));
+  sync_user_handler();
+  EXPECT_TRUE(service_registered_);
+  manager_->Unregister(cid, common::BindOnce([] {}), user_handler_);
+  EXPECT_FALSE(manager_->IsServiceRegistered(cid));
+}
+
+TEST_F(L2capDynamicServiceManagerTest, register_classic_dynamic_channel_bad_cid) {
+  DynamicChannelServiceImpl::PendingRegistration pending_registration{
+      .user_handler_ = user_handler_,
+      .on_registration_complete_callback_ =
+          common::BindOnce(&L2capDynamicServiceManagerTest::OnServiceRegistered, common::Unretained(this), false)};
+  Cid cid = 0x1000;
+  EXPECT_FALSE(manager_->IsServiceRegistered(cid));
+  manager_->Register(cid, std::move(pending_registration));
+  EXPECT_FALSE(manager_->IsServiceRegistered(cid));
+  sync_user_handler();
+  EXPECT_FALSE(service_registered_);
+}
+
+}  // namespace internal
+}  // namespace classic
+}  // namespace l2cap
+}  // namespace bluetooth
diff --git a/gd/l2cap/classic/internal/fixed_channel_impl.cc b/gd/l2cap/classic/internal/fixed_channel_impl.cc
new file mode 100644
index 0000000..9bfaef8
--- /dev/null
+++ b/gd/l2cap/classic/internal/fixed_channel_impl.cc
@@ -0,0 +1,100 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <unordered_map>
+
+#include "l2cap/cid.h"
+#include "l2cap/classic/internal/fixed_channel_impl.h"
+#include "l2cap/classic/internal/link.h"
+#include "l2cap/security_policy.h"
+#include "os/handler.h"
+#include "os/log.h"
+
+namespace bluetooth {
+namespace l2cap {
+namespace classic {
+namespace internal {
+
+FixedChannelImpl::FixedChannelImpl(Cid cid, Link* link, os::Handler* l2cap_handler)
+    : cid_(cid), device_(link->GetDevice()), link_(link), l2cap_handler_(l2cap_handler) {
+  ASSERT_LOG(cid_ >= kFirstFixedChannel && cid_ <= kLastFixedChannel, "Invalid cid: %d", cid_);
+  ASSERT(link_ != nullptr);
+  ASSERT(l2cap_handler_ != nullptr);
+}
+
+void FixedChannelImpl::RegisterOnCloseCallback(os::Handler* user_handler,
+                                               FixedChannel::OnCloseCallback on_close_callback) {
+  ASSERT_LOG(user_handler_ == nullptr, "OnCloseCallback can only be registered once");
+  // If channel is already closed, call the callback immediately without saving it
+  if (closed_) {
+    user_handler->Post(common::BindOnce(std::move(on_close_callback), close_reason_));
+    return;
+  }
+  user_handler_ = user_handler;
+  on_close_callback_ = std::move(on_close_callback);
+}
+
+void FixedChannelImpl::OnClosed(hci::ErrorCode status) {
+  ASSERT_LOG(!closed_, "Device %s Cid 0x%x closed twice, old status 0x%x, new status 0x%x", device_.ToString().c_str(),
+             cid_, static_cast<int>(close_reason_), static_cast<int>(status));
+  closed_ = true;
+  close_reason_ = status;
+  acquired_ = false;
+  link_ = nullptr;
+  l2cap_handler_ = nullptr;
+  if (user_handler_ == nullptr) {
+    return;
+  }
+  // On close callback can only be called once
+  user_handler_->Post(common::BindOnce(std::move(on_close_callback_), status));
+  user_handler_ = nullptr;
+  on_close_callback_.Reset();
+}
+
+void FixedChannelImpl::Acquire() {
+  ASSERT_LOG(user_handler_ != nullptr, "Must register OnCloseCallback before calling any methods");
+  if (closed_) {
+    LOG_WARN("%s is already closed", ToString().c_str());
+    ASSERT(!acquired_);
+    return;
+  }
+  if (acquired_) {
+    LOG_DEBUG("%s was already acquired", ToString().c_str());
+    return;
+  }
+  acquired_ = true;
+  link_->RefreshRefCount();
+}
+
+void FixedChannelImpl::Release() {
+  ASSERT_LOG(user_handler_ != nullptr, "Must register OnCloseCallback before calling any methods");
+  if (closed_) {
+    LOG_WARN("%s is already closed", ToString().c_str());
+    ASSERT(!acquired_);
+    return;
+  }
+  if (!acquired_) {
+    LOG_DEBUG("%s was already released", ToString().c_str());
+    return;
+  }
+  acquired_ = false;
+  link_->RefreshRefCount();
+}
+
+}  // namespace internal
+}  // namespace classic
+}  // namespace l2cap
+}  // namespace bluetooth
diff --git a/gd/l2cap/classic/internal/fixed_channel_impl.h b/gd/l2cap/classic/internal/fixed_channel_impl.h
new file mode 100644
index 0000000..80a86c5
--- /dev/null
+++ b/gd/l2cap/classic/internal/fixed_channel_impl.h
@@ -0,0 +1,96 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#pragma once
+
+#include "common/bidi_queue.h"
+#include "l2cap/cid.h"
+#include "l2cap/classic/fixed_channel.h"
+#include "os/handler.h"
+#include "os/log.h"
+
+namespace bluetooth {
+namespace l2cap {
+namespace classic {
+namespace internal {
+
+class Link;
+
+class FixedChannelImpl {
+ public:
+  FixedChannelImpl(Cid cid, Link* link, os::Handler* l2cap_handler);
+
+  virtual ~FixedChannelImpl() = default;
+
+  hci::Address GetDevice() const {
+    return device_;
+  }
+
+  virtual void RegisterOnCloseCallback(os::Handler* user_handler, FixedChannel::OnCloseCallback on_close_callback);
+
+  virtual void Acquire();
+
+  virtual void Release();
+
+  virtual bool IsAcquired() const {
+    return acquired_;
+  }
+
+  virtual void OnClosed(hci::ErrorCode status);
+
+  virtual std::string ToString() {
+    std::ostringstream ss;
+    ss << "Device " << device_ << " Cid 0x" << std::hex << cid_;
+    return ss.str();
+  }
+
+  common::BidiQueueEnd<packet::BasePacketBuilder, packet::PacketView<packet::kLittleEndian>>* GetQueueUpEnd() {
+    return channel_queue_.GetUpEnd();
+  }
+
+  common::BidiQueueEnd<packet::PacketView<packet::kLittleEndian>, packet::BasePacketBuilder>* GetQueueDownEnd() {
+    return channel_queue_.GetDownEnd();
+  }
+
+ private:
+  // Constructor states
+  // For logging purpose only
+  const Cid cid_;
+  // For logging purpose only
+  const hci::Address device_;
+  // Needed to handle Acquire() and Release()
+  Link* link_;
+  os::Handler* l2cap_handler_;
+
+  // User supported states
+  os::Handler* user_handler_ = nullptr;
+  FixedChannel::OnCloseCallback on_close_callback_{};
+
+  // Internal states
+  bool acquired_ = false;
+  bool closed_ = false;
+  hci::ErrorCode close_reason_ = hci::ErrorCode::SUCCESS;
+  static constexpr size_t kChannelQueueSize = 10;
+  common::BidiQueue<packet::PacketView<packet::kLittleEndian>, packet::BasePacketBuilder> channel_queue_{
+      kChannelQueueSize};
+
+  DISALLOW_COPY_AND_ASSIGN(FixedChannelImpl);
+};
+
+}  // namespace internal
+}  // namespace classic
+}  // namespace l2cap
+}  // namespace bluetooth
diff --git a/gd/l2cap/classic/internal/fixed_channel_impl_mock.h b/gd/l2cap/classic/internal/fixed_channel_impl_mock.h
new file mode 100644
index 0000000..680bf51
--- /dev/null
+++ b/gd/l2cap/classic/internal/fixed_channel_impl_mock.h
@@ -0,0 +1,44 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+#pragma once
+
+#include "l2cap/classic/internal/fixed_channel_impl.h"
+
+#include <gmock/gmock.h>
+
+// Unit test interfaces
+namespace bluetooth {
+namespace l2cap {
+namespace classic {
+namespace internal {
+namespace testing {
+
+class MockFixedChannelImpl : public FixedChannelImpl {
+ public:
+  MockFixedChannelImpl(Cid cid, Link* link, os::Handler* l2cap_handler) : FixedChannelImpl(cid, link, l2cap_handler) {}
+  MOCK_METHOD(void, RegisterOnCloseCallback,
+              (os::Handler * user_handler, FixedChannel::OnCloseCallback on_close_callback), (override));
+  MOCK_METHOD(void, Acquire, (), (override));
+  MOCK_METHOD(void, Release, (), (override));
+  MOCK_METHOD(bool, IsAcquired, (), (override, const));
+  MOCK_METHOD(void, OnClosed, (hci::ErrorCode status), (override));
+};
+
+}  // namespace testing
+}  // namespace internal
+}  // namespace classic
+}  // namespace l2cap
+}  // namespace bluetooth
\ No newline at end of file
diff --git a/gd/l2cap/classic/internal/fixed_channel_impl_test.cc b/gd/l2cap/classic/internal/fixed_channel_impl_test.cc
new file mode 100644
index 0000000..750473d
--- /dev/null
+++ b/gd/l2cap/classic/internal/fixed_channel_impl_test.cc
@@ -0,0 +1,231 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+#include "l2cap/classic/internal/fixed_channel_impl.h"
+
+#include "common/testing/bind_test_util.h"
+#include "l2cap/cid.h"
+#include "l2cap/classic/internal/link_mock.h"
+#include "l2cap/internal/parameter_provider_mock.h"
+#include "os/handler.h"
+
+#include <gmock/gmock.h>
+#include <gtest/gtest.h>
+
+namespace bluetooth {
+namespace l2cap {
+namespace classic {
+namespace internal {
+
+using l2cap::internal::testing::MockParameterProvider;
+using testing::MockLink;
+using ::testing::Return;
+
+class L2capClassicFixedChannelImplTest : public ::testing::Test {
+ public:
+  static void SyncHandler(os::Handler* handler) {
+    std::promise<void> promise;
+    auto future = promise.get_future();
+    handler->Post(common::BindOnce(&std::promise<void>::set_value, common::Unretained(&promise)));
+    future.wait_for(std::chrono::milliseconds(3));
+  }
+
+ protected:
+  void SetUp() override {
+    thread_ = new os::Thread("test_thread", os::Thread::Priority::NORMAL);
+    l2cap_handler_ = new os::Handler(thread_);
+  }
+
+  void TearDown() override {
+    l2cap_handler_->Clear();
+    delete l2cap_handler_;
+    delete thread_;
+  }
+
+  os::Thread* thread_ = nullptr;
+  os::Handler* l2cap_handler_ = nullptr;
+};
+
+TEST_F(L2capClassicFixedChannelImplTest, get_device) {
+  MockParameterProvider mock_parameter_provider;
+  MockLink mock_classic_link(l2cap_handler_, &mock_parameter_provider);
+  hci::Address device{{0x01, 0x02, 0x03, 0x04, 0x05, 0x06}};
+  EXPECT_CALL(mock_classic_link, GetDevice()).WillRepeatedly(Return(device));
+  FixedChannelImpl fixed_channel_impl(kSmpBrCid, &mock_classic_link, l2cap_handler_);
+  EXPECT_EQ(device, fixed_channel_impl.GetDevice());
+}
+
+TEST_F(L2capClassicFixedChannelImplTest, close_triggers_callback) {
+  MockParameterProvider mock_parameter_provider;
+  MockLink mock_classic_link(l2cap_handler_, &mock_parameter_provider);
+  hci::Address device{{0x01, 0x02, 0x03, 0x04, 0x05, 0x06}};
+  EXPECT_CALL(mock_classic_link, GetDevice()).WillRepeatedly(Return(device));
+  FixedChannelImpl fixed_channel_impl(kSmpBrCid, &mock_classic_link, l2cap_handler_);
+
+  // Register on close callback
+  auto user_handler = std::make_unique<os::Handler>(thread_);
+  hci::ErrorCode my_status = hci::ErrorCode::SUCCESS;
+  fixed_channel_impl.RegisterOnCloseCallback(
+      user_handler.get(), common::testing::BindLambdaForTesting([&](hci::ErrorCode status) { my_status = status; }));
+
+  // Channel closure should trigger such callback
+  fixed_channel_impl.OnClosed(hci::ErrorCode::REMOTE_USER_TERMINATED_CONNECTION);
+  SyncHandler(user_handler.get());
+  EXPECT_EQ(hci::ErrorCode::REMOTE_USER_TERMINATED_CONNECTION, my_status);
+
+  user_handler->Clear();
+}
+
+TEST_F(L2capClassicFixedChannelImplTest, register_callback_after_close_should_call_immediately) {
+  MockParameterProvider mock_parameter_provider;
+  MockLink mock_classic_link(l2cap_handler_, &mock_parameter_provider);
+  hci::Address device{{0x01, 0x02, 0x03, 0x04, 0x05, 0x06}};
+  EXPECT_CALL(mock_classic_link, GetDevice()).WillRepeatedly(Return(device));
+  FixedChannelImpl fixed_channel_impl(kSmpBrCid, &mock_classic_link, l2cap_handler_);
+
+  // Channel closure should do nothing
+  fixed_channel_impl.OnClosed(hci::ErrorCode::REMOTE_USER_TERMINATED_CONNECTION);
+
+  // Register on close callback should trigger callback immediately
+  auto user_handler = std::make_unique<os::Handler>(thread_);
+  hci::ErrorCode my_status = hci::ErrorCode::SUCCESS;
+  fixed_channel_impl.RegisterOnCloseCallback(
+      user_handler.get(), common::testing::BindLambdaForTesting([&](hci::ErrorCode status) { my_status = status; }));
+  SyncHandler(user_handler.get());
+  EXPECT_EQ(hci::ErrorCode::REMOTE_USER_TERMINATED_CONNECTION, my_status);
+
+  user_handler->Clear();
+}
+
+TEST_F(L2capClassicFixedChannelImplTest, close_twice_should_fail) {
+  MockParameterProvider mock_parameter_provider;
+  MockLink mock_classic_link(l2cap_handler_, &mock_parameter_provider);
+  hci::Address device{{0x01, 0x02, 0x03, 0x04, 0x05, 0x06}};
+  EXPECT_CALL(mock_classic_link, GetDevice()).WillRepeatedly(Return(device));
+  FixedChannelImpl fixed_channel_impl(kSmpBrCid, &mock_classic_link, l2cap_handler_);
+
+  // Register on close callback
+  auto user_handler = std::make_unique<os::Handler>(thread_);
+  hci::ErrorCode my_status = hci::ErrorCode::SUCCESS;
+  fixed_channel_impl.RegisterOnCloseCallback(
+      user_handler.get(), common::testing::BindLambdaForTesting([&](hci::ErrorCode status) { my_status = status; }));
+
+  // Channel closure should trigger such callback
+  fixed_channel_impl.OnClosed(hci::ErrorCode::REMOTE_USER_TERMINATED_CONNECTION);
+  SyncHandler(user_handler.get());
+  EXPECT_EQ(hci::ErrorCode::REMOTE_USER_TERMINATED_CONNECTION, my_status);
+
+  // 2nd OnClose() callback should fail
+  EXPECT_DEATH(fixed_channel_impl.OnClosed(hci::ErrorCode::PAGE_TIMEOUT), ".*OnClosed.*");
+
+  user_handler->Clear();
+}
+
+TEST_F(L2capClassicFixedChannelImplTest, multiple_registeration_should_fail) {
+  MockParameterProvider mock_parameter_provider;
+  MockLink mock_classic_link(l2cap_handler_, &mock_parameter_provider);
+  hci::Address device{{0x01, 0x02, 0x03, 0x04, 0x05, 0x06}};
+  EXPECT_CALL(mock_classic_link, GetDevice()).WillRepeatedly(Return(device));
+  FixedChannelImpl fixed_channel_impl(kSmpBrCid, &mock_classic_link, l2cap_handler_);
+
+  // Register on close callback
+  auto user_handler = std::make_unique<os::Handler>(thread_);
+  hci::ErrorCode my_status = hci::ErrorCode::SUCCESS;
+  fixed_channel_impl.RegisterOnCloseCallback(
+      user_handler.get(), common::testing::BindLambdaForTesting([&](hci::ErrorCode status) { my_status = status; }));
+
+  EXPECT_DEATH(fixed_channel_impl.RegisterOnCloseCallback(user_handler.get(),
+                                                          common::BindOnce([](hci::ErrorCode status) { FAIL(); })),
+               ".*RegisterOnCloseCallback.*");
+
+  user_handler->Clear();
+}
+
+TEST_F(L2capClassicFixedChannelImplTest, call_acquire_before_registeration_should_fail) {
+  MockParameterProvider mock_parameter_provider;
+  MockLink mock_classic_link(l2cap_handler_, &mock_parameter_provider);
+  hci::Address device{{0x01, 0x02, 0x03, 0x04, 0x05, 0x06}};
+  EXPECT_CALL(mock_classic_link, GetDevice()).WillRepeatedly(Return(device));
+  FixedChannelImpl fixed_channel_impl(kSmpBrCid, &mock_classic_link, l2cap_handler_);
+  EXPECT_DEATH(fixed_channel_impl.Acquire(), ".*Acquire.*");
+}
+
+TEST_F(L2capClassicFixedChannelImplTest, call_release_before_registeration_should_fail) {
+  MockParameterProvider mock_parameter_provider;
+  MockLink mock_classic_link(l2cap_handler_, &mock_parameter_provider);
+  hci::Address device{{0x01, 0x02, 0x03, 0x04, 0x05, 0x06}};
+  EXPECT_CALL(mock_classic_link, GetDevice()).WillRepeatedly(Return(device));
+  FixedChannelImpl fixed_channel_impl(kSmpBrCid, &mock_classic_link, l2cap_handler_);
+  EXPECT_DEATH(fixed_channel_impl.Release(), ".*Release.*");
+}
+
+TEST_F(L2capClassicFixedChannelImplTest, test_acquire_release_channel) {
+  MockParameterProvider mock_parameter_provider;
+  MockLink mock_classic_link(l2cap_handler_, &mock_parameter_provider);
+  hci::Address device{{0x01, 0x02, 0x03, 0x04, 0x05, 0x06}};
+  EXPECT_CALL(mock_classic_link, GetDevice()).WillRepeatedly(Return(device));
+  FixedChannelImpl fixed_channel_impl(kSmpBrCid, &mock_classic_link, l2cap_handler_);
+
+  // Register on close callback
+  auto user_handler = std::make_unique<os::Handler>(thread_);
+  hci::ErrorCode my_status = hci::ErrorCode::SUCCESS;
+  fixed_channel_impl.RegisterOnCloseCallback(
+      user_handler.get(), common::testing::BindLambdaForTesting([&](hci::ErrorCode status) { my_status = status; }));
+
+  // Default should be false
+  EXPECT_FALSE(fixed_channel_impl.IsAcquired());
+
+  // Should be called 2 times after Acquire() and Release()
+  EXPECT_CALL(mock_classic_link, RefreshRefCount()).Times(2);
+
+  fixed_channel_impl.Acquire();
+  EXPECT_TRUE(fixed_channel_impl.IsAcquired());
+
+  fixed_channel_impl.Release();
+  EXPECT_FALSE(fixed_channel_impl.IsAcquired());
+
+  user_handler->Clear();
+}
+
+TEST_F(L2capClassicFixedChannelImplTest, test_acquire_after_close) {
+  MockParameterProvider mock_parameter_provider;
+  MockLink mock_classic_link(l2cap_handler_, &mock_parameter_provider);
+  hci::Address device{{0x01, 0x02, 0x03, 0x04, 0x05, 0x06}};
+  EXPECT_CALL(mock_classic_link, GetDevice()).WillRepeatedly(Return(device));
+  FixedChannelImpl fixed_channel_impl(kSmpBrCid, &mock_classic_link, l2cap_handler_);
+
+  // Register on close callback
+  auto user_handler = std::make_unique<os::Handler>(thread_);
+  hci::ErrorCode my_status = hci::ErrorCode::SUCCESS;
+  fixed_channel_impl.RegisterOnCloseCallback(
+      user_handler.get(), common::testing::BindLambdaForTesting([&](hci::ErrorCode status) { my_status = status; }));
+
+  // Channel closure should trigger such callback
+  fixed_channel_impl.OnClosed(hci::ErrorCode::REMOTE_USER_TERMINATED_CONNECTION);
+  SyncHandler(user_handler.get());
+  EXPECT_EQ(hci::ErrorCode::REMOTE_USER_TERMINATED_CONNECTION, my_status);
+
+  // Release or Acquire after closing should crash
+  EXPECT_CALL(mock_classic_link, RefreshRefCount()).Times(0);
+  EXPECT_FALSE(fixed_channel_impl.IsAcquired());
+  EXPECT_DEATH(fixed_channel_impl.Acquire(), ".*Acquire.*");
+
+  user_handler->Clear();
+}
+
+}  // namespace internal
+}  // namespace classic
+}  // namespace l2cap
+}  // namespace bluetooth
diff --git a/gd/l2cap/classic/internal/fixed_channel_service_impl.h b/gd/l2cap/classic/internal/fixed_channel_service_impl.h
new file mode 100644
index 0000000..b06983f
--- /dev/null
+++ b/gd/l2cap/classic/internal/fixed_channel_service_impl.h
@@ -0,0 +1,58 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#pragma once
+
+#include "l2cap/classic/fixed_channel.h"
+#include "l2cap/classic/fixed_channel_manager.h"
+#include "l2cap/classic/fixed_channel_service.h"
+
+namespace bluetooth {
+namespace l2cap {
+namespace classic {
+namespace internal {
+
+class FixedChannelServiceImpl {
+ public:
+  virtual ~FixedChannelServiceImpl() = default;
+
+  struct PendingRegistration {
+    os::Handler* user_handler_ = nullptr;
+    FixedChannelManager::OnRegistrationCompleteCallback on_registration_complete_callback_;
+    FixedChannelManager::OnConnectionOpenCallback on_connection_open_callback_;
+  };
+
+  virtual void NotifyChannelCreation(std::unique_ptr<FixedChannel> channel) {
+    user_handler_->Post(common::BindOnce(on_connection_open_callback_, std::move(channel)));
+  }
+
+  friend class FixedChannelServiceManagerImpl;
+
+ protected:
+  // protected access for mocking
+  FixedChannelServiceImpl(os::Handler* user_handler,
+                          FixedChannelManager::OnConnectionOpenCallback on_connection_open_callback)
+      : user_handler_(user_handler), on_connection_open_callback_(std::move(on_connection_open_callback)) {}
+
+ private:
+  os::Handler* user_handler_ = nullptr;
+  FixedChannelManager::OnConnectionOpenCallback on_connection_open_callback_;
+};
+
+}  // namespace internal
+}  // namespace classic
+}  // namespace l2cap
+}  // namespace bluetooth
diff --git a/gd/l2cap/classic/internal/fixed_channel_service_impl_mock.h b/gd/l2cap/classic/internal/fixed_channel_service_impl_mock.h
new file mode 100644
index 0000000..7aeb094
--- /dev/null
+++ b/gd/l2cap/classic/internal/fixed_channel_service_impl_mock.h
@@ -0,0 +1,40 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+#pragma once
+
+#include "l2cap/classic/internal/fixed_channel_impl.h"
+#include "l2cap/classic/internal/fixed_channel_service_manager_impl.h"
+
+#include <gmock/gmock.h>
+
+// Unit test interfaces
+namespace bluetooth {
+namespace l2cap {
+namespace classic {
+namespace internal {
+namespace testing {
+
+class MockFixedChannelServiceImpl : public FixedChannelServiceImpl {
+ public:
+  MockFixedChannelServiceImpl() : FixedChannelServiceImpl(nullptr, FixedChannelManager::OnConnectionOpenCallback()) {}
+  MOCK_METHOD(void, NotifyChannelCreation, (std::unique_ptr<FixedChannel> channel), (override));
+};
+
+}  // namespace testing
+}  // namespace internal
+}  // namespace classic
+}  // namespace l2cap
+}  // namespace bluetooth
\ No newline at end of file
diff --git a/gd/l2cap/classic/internal/fixed_channel_service_manager_impl.cc b/gd/l2cap/classic/internal/fixed_channel_service_manager_impl.cc
new file mode 100644
index 0000000..b557970
--- /dev/null
+++ b/gd/l2cap/classic/internal/fixed_channel_service_manager_impl.cc
@@ -0,0 +1,107 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "l2cap/classic/internal/fixed_channel_service_manager_impl.h"
+
+#include "common/bind.h"
+#include "l2cap/cid.h"
+#include "l2cap/classic/internal/fixed_channel_service_impl.h"
+#include "os/log.h"
+
+namespace bluetooth {
+namespace l2cap {
+namespace classic {
+namespace internal {
+
+void FixedChannelServiceManagerImpl::Register(Cid cid,
+                                              FixedChannelServiceImpl::PendingRegistration pending_registration) {
+  if (cid < kFirstFixedChannel || cid > kLastFixedChannel || cid == kClassicSignallingCid) {
+    std::unique_ptr<FixedChannelService> invalid_service(new FixedChannelService());
+    pending_registration.user_handler_->Post(
+        common::BindOnce(std::move(pending_registration.on_registration_complete_callback_),
+                         FixedChannelManager::RegistrationResult::FAIL_INVALID_SERVICE, std::move(invalid_service)));
+  } else if (IsServiceRegistered(cid)) {
+    std::unique_ptr<FixedChannelService> invalid_service(new FixedChannelService());
+    pending_registration.user_handler_->Post(
+        common::BindOnce(std::move(pending_registration.on_registration_complete_callback_),
+                         FixedChannelManager::RegistrationResult::FAIL_DUPLICATE_SERVICE, std::move(invalid_service)));
+  } else {
+    service_map_.try_emplace(cid,
+                             FixedChannelServiceImpl(pending_registration.user_handler_,
+                                                     std::move(pending_registration.on_connection_open_callback_)));
+    std::unique_ptr<FixedChannelService> user_service(new FixedChannelService(cid, this, l2cap_layer_handler_));
+    pending_registration.user_handler_->Post(
+        common::BindOnce(std::move(pending_registration.on_registration_complete_callback_),
+                         FixedChannelManager::RegistrationResult::SUCCESS, std::move(user_service)));
+  }
+}
+
+void FixedChannelServiceManagerImpl::Unregister(Cid cid, FixedChannelService::OnUnregisteredCallback callback,
+                                                os::Handler* handler) {
+  if (IsServiceRegistered(cid)) {
+    service_map_.erase(cid);
+    handler->Post(std::move(callback));
+  } else {
+    LOG_ERROR("service not registered cid:%d", cid);
+  }
+}
+
+bool FixedChannelServiceManagerImpl::IsServiceRegistered(Cid cid) const {
+  return service_map_.find(cid) != service_map_.end();
+}
+
+FixedChannelServiceImpl* FixedChannelServiceManagerImpl::GetService(Cid cid) {
+  ASSERT(IsServiceRegistered(cid));
+  return &service_map_.find(cid)->second;
+}
+
+std::vector<std::pair<Cid, FixedChannelServiceImpl*>> FixedChannelServiceManagerImpl::GetRegisteredServices() {
+  std::vector<std::pair<Cid, FixedChannelServiceImpl*>> results;
+  for (auto& elem : service_map_) {
+    results.emplace_back(elem.first, &elem.second);
+  }
+  return results;
+}
+
+namespace {
+constexpr uint64_t kSignallingChannelMask = 0x02;
+constexpr uint64_t kConnectionlessReceptionMask = 0x04;
+constexpr uint64_t kBrEdrSecurityManager = 0x80;
+}  // namespace
+
+uint64_t FixedChannelServiceManagerImpl::GetSupportedFixedChannelMask() {
+  uint64_t result = 0;
+  result |= kSignallingChannelMask;  // Signalling channel is mandatory
+  for (const auto& elem : service_map_) {
+    Cid cid = elem.first;
+    switch (cid) {
+      case kConnectionlessCid:
+        result |= kConnectionlessReceptionMask;
+        continue;
+      case kSmpBrCid:
+        result |= kBrEdrSecurityManager;
+        continue;
+      default:
+        LOG_WARN("Unknown fixed channel is registered: 0x%x", cid);
+        continue;
+    }
+  }
+  return result;
+}
+}  // namespace internal
+}  // namespace classic
+}  // namespace l2cap
+}  // namespace bluetooth
diff --git a/gd/l2cap/classic/internal/fixed_channel_service_manager_impl.h b/gd/l2cap/classic/internal/fixed_channel_service_manager_impl.h
new file mode 100644
index 0000000..1e1d21d
--- /dev/null
+++ b/gd/l2cap/classic/internal/fixed_channel_service_manager_impl.h
@@ -0,0 +1,53 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#pragma once
+
+#include <unordered_map>
+
+#include "l2cap/cid.h"
+#include "l2cap/classic/fixed_channel_service.h"
+#include "l2cap/classic/internal/fixed_channel_service_impl.h"
+#include "os/handler.h"
+
+namespace bluetooth {
+namespace l2cap {
+namespace classic {
+namespace internal {
+
+class FixedChannelServiceManagerImpl {
+ public:
+  explicit FixedChannelServiceManagerImpl(os::Handler* l2cap_layer_handler)
+      : l2cap_layer_handler_(l2cap_layer_handler) {}
+  virtual ~FixedChannelServiceManagerImpl() = default;
+
+  // All APIs must be invoked in L2CAP layer handler
+
+  virtual void Register(Cid cid, FixedChannelServiceImpl::PendingRegistration pending_registration);
+  virtual void Unregister(Cid cid, FixedChannelService::OnUnregisteredCallback callback, os::Handler* handler);
+  virtual bool IsServiceRegistered(Cid cid) const;
+  virtual FixedChannelServiceImpl* GetService(Cid cid);
+  virtual std::vector<std::pair<Cid, FixedChannelServiceImpl*>> GetRegisteredServices();
+  virtual uint64_t GetSupportedFixedChannelMask();
+
+ private:
+  os::Handler* l2cap_layer_handler_ = nullptr;
+  std::unordered_map<Cid, FixedChannelServiceImpl> service_map_;
+};
+}  // namespace internal
+}  // namespace classic
+}  // namespace l2cap
+}  // namespace bluetooth
diff --git a/gd/l2cap/classic/internal/fixed_channel_service_manager_impl_mock.h b/gd/l2cap/classic/internal/fixed_channel_service_manager_impl_mock.h
new file mode 100644
index 0000000..55aa4cf
--- /dev/null
+++ b/gd/l2cap/classic/internal/fixed_channel_service_manager_impl_mock.h
@@ -0,0 +1,45 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+#pragma once
+
+#include "l2cap/classic/internal/fixed_channel_impl.h"
+#include "l2cap/classic/internal/fixed_channel_service_manager_impl.h"
+
+#include <gmock/gmock.h>
+
+// Unit test interfaces
+namespace bluetooth {
+namespace l2cap {
+namespace classic {
+namespace internal {
+namespace testing {
+
+class MockFixedChannelServiceManagerImpl : public FixedChannelServiceManagerImpl {
+ public:
+  MockFixedChannelServiceManagerImpl() : FixedChannelServiceManagerImpl(nullptr) {}
+  MOCK_METHOD(void, Register, (Cid cid, FixedChannelServiceImpl::PendingRegistration pending_registration), (override));
+  MOCK_METHOD(void, Unregister, (Cid cid, FixedChannelService::OnUnregisteredCallback callback, os::Handler* handler),
+              (override));
+  MOCK_METHOD(bool, IsServiceRegistered, (Cid cid), (const, override));
+  MOCK_METHOD(FixedChannelServiceImpl*, GetService, (Cid cid), (override));
+  MOCK_METHOD((std::vector<std::pair<Cid, FixedChannelServiceImpl*>>), GetRegisteredServices, (), (override));
+};
+
+}  // namespace testing
+}  // namespace internal
+}  // namespace classic
+}  // namespace l2cap
+}  // namespace bluetooth
\ No newline at end of file
diff --git a/gd/l2cap/classic/internal/fixed_channel_service_manager_test.cc b/gd/l2cap/classic/internal/fixed_channel_service_manager_test.cc
new file mode 100644
index 0000000..d586913
--- /dev/null
+++ b/gd/l2cap/classic/internal/fixed_channel_service_manager_test.cc
@@ -0,0 +1,104 @@
+/*
+ * Copyright 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "l2cap/classic/internal/fixed_channel_service_manager_impl.h"
+
+#include <future>
+
+#include "common/bind.h"
+#include "l2cap/cid.h"
+#include "l2cap/classic/fixed_channel_manager.h"
+#include "l2cap/classic/fixed_channel_service.h"
+#include "os/handler.h"
+#include "os/thread.h"
+
+#include <gtest/gtest.h>
+
+namespace bluetooth {
+namespace l2cap {
+namespace classic {
+namespace internal {
+
+class L2capClassicFixedServiceManagerTest : public ::testing::Test {
+ public:
+  ~L2capClassicFixedServiceManagerTest() override = default;
+
+  void OnServiceRegistered(bool expect_success, FixedChannelManager::RegistrationResult result,
+                           std::unique_ptr<FixedChannelService> user_service) {
+    EXPECT_EQ(result == FixedChannelManager::RegistrationResult::SUCCESS, expect_success);
+    service_registered_ = expect_success;
+  }
+
+ protected:
+  void SetUp() override {
+    manager_ = new FixedChannelServiceManagerImpl{nullptr};
+    thread_ = new os::Thread("test_thread", os::Thread::Priority::NORMAL);
+    user_handler_ = new os::Handler(thread_);
+  }
+
+  void TearDown() override {
+    user_handler_->Clear();
+    delete user_handler_;
+    delete thread_;
+    delete manager_;
+  }
+
+  void sync_user_handler() {
+    std::promise<void> promise;
+    auto future = promise.get_future();
+    user_handler_->Post(common::BindOnce(&std::promise<void>::set_value, common::Unretained(&promise)));
+    future.wait_for(std::chrono::milliseconds(3));
+  }
+
+  FixedChannelServiceManagerImpl* manager_ = nullptr;
+  os::Thread* thread_ = nullptr;
+  os::Handler* user_handler_ = nullptr;
+
+  bool service_registered_ = false;
+};
+
+TEST_F(L2capClassicFixedServiceManagerTest, register_and_unregister_classic_fixed_channel) {
+  FixedChannelServiceImpl::PendingRegistration pending_registration{
+      .user_handler_ = user_handler_,
+      .on_registration_complete_callback_ =
+          common::BindOnce(&L2capClassicFixedServiceManagerTest::OnServiceRegistered, common::Unretained(this), true)};
+  Cid cid = kSmpBrCid;
+  EXPECT_FALSE(manager_->IsServiceRegistered(cid));
+  manager_->Register(cid, std::move(pending_registration));
+  EXPECT_TRUE(manager_->IsServiceRegistered(cid));
+  sync_user_handler();
+  EXPECT_TRUE(service_registered_);
+  manager_->Unregister(cid, common::BindOnce([] {}), user_handler_);
+  EXPECT_FALSE(manager_->IsServiceRegistered(cid));
+}
+
+TEST_F(L2capClassicFixedServiceManagerTest, register_classic_fixed_channel_bad_cid) {
+  FixedChannelServiceImpl::PendingRegistration pending_registration{
+      .user_handler_ = user_handler_,
+      .on_registration_complete_callback_ =
+          common::BindOnce(&L2capClassicFixedServiceManagerTest::OnServiceRegistered, common::Unretained(this), false)};
+  Cid cid = 0x1000;
+  EXPECT_FALSE(manager_->IsServiceRegistered(cid));
+  manager_->Register(cid, std::move(pending_registration));
+  EXPECT_FALSE(manager_->IsServiceRegistered(cid));
+  sync_user_handler();
+  EXPECT_FALSE(service_registered_);
+}
+
+}  // namespace internal
+}  // namespace classic
+}  // namespace l2cap
+}  // namespace bluetooth
diff --git a/gd/l2cap/classic/internal/link.cc b/gd/l2cap/classic/internal/link.cc
new file mode 100644
index 0000000..d59d722
--- /dev/null
+++ b/gd/l2cap/classic/internal/link.cc
@@ -0,0 +1,127 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <chrono>
+#include <memory>
+
+#include "hci/acl_manager.h"
+#include "l2cap/classic/internal/fixed_channel_impl.h"
+#include "l2cap/classic/internal/link.h"
+#include "l2cap/internal/parameter_provider.h"
+#include "l2cap/internal/scheduler.h"
+#include "os/alarm.h"
+
+namespace bluetooth {
+namespace l2cap {
+namespace classic {
+namespace internal {
+
+Link::Link(os::Handler* l2cap_handler, std::unique_ptr<hci::AclConnection> acl_connection,
+           std::unique_ptr<l2cap::internal::Scheduler> scheduler,
+           l2cap::internal::ParameterProvider* parameter_provider,
+           DynamicChannelServiceManagerImpl* dynamic_service_manager,
+           FixedChannelServiceManagerImpl* fixed_service_manager)
+    : l2cap_handler_(l2cap_handler), acl_connection_(std::move(acl_connection)), scheduler_(std::move(scheduler)),
+      parameter_provider_(parameter_provider), dynamic_service_manager_(dynamic_service_manager),
+      fixed_service_manager_(fixed_service_manager),
+      signalling_manager_(l2cap_handler_, this, dynamic_service_manager_, &dynamic_channel_allocator_,
+                          fixed_service_manager_) {
+  ASSERT(l2cap_handler_ != nullptr);
+  ASSERT(acl_connection_ != nullptr);
+  ASSERT(scheduler_ != nullptr);
+  ASSERT(parameter_provider_ != nullptr);
+  link_idle_disconnect_alarm_.Schedule(common::BindOnce(&Link::Disconnect, common::Unretained(this)),
+                                       parameter_provider_->GetClassicLinkIdleDisconnectTimeout());
+}
+
+void Link::OnAclDisconnected(hci::ErrorCode status) {
+  fixed_channel_allocator_.OnAclDisconnected(status);
+  dynamic_channel_allocator_.OnAclDisconnected(status);
+}
+
+void Link::Disconnect() {
+  acl_connection_->Disconnect(hci::DisconnectReason::REMOTE_USER_TERMINATED_CONNECTION);
+}
+
+std::shared_ptr<FixedChannelImpl> Link::AllocateFixedChannel(Cid cid, SecurityPolicy security_policy) {
+  auto channel = fixed_channel_allocator_.AllocateChannel(cid, security_policy);
+  scheduler_->AttachChannel(cid, channel->GetQueueDownEnd(), cid);
+  return channel;
+}
+
+bool Link::IsFixedChannelAllocated(Cid cid) {
+  return fixed_channel_allocator_.IsChannelAllocated(cid);
+}
+
+Cid Link::ReserveDynamicChannel() {
+  return dynamic_channel_allocator_.ReserveChannel();
+}
+
+void Link::SendConnectionRequest(Psm psm, Cid local_cid) {
+  signalling_manager_.SendConnectionRequest(psm, local_cid);
+}
+
+void Link::SendDisconnectionRequest(Cid local_cid, Cid remote_cid) {
+  signalling_manager_.SendDisconnectionRequest(local_cid, remote_cid);
+}
+
+void Link::SendInformationRequest(InformationRequestInfoType type) {
+  signalling_manager_.SendInformationRequest(type);
+}
+
+std::shared_ptr<DynamicChannelImpl> Link::AllocateDynamicChannel(Psm psm, Cid remote_cid,
+                                                                 SecurityPolicy security_policy) {
+  auto channel = dynamic_channel_allocator_.AllocateChannel(psm, remote_cid, security_policy);
+  if (channel != nullptr) {
+    scheduler_->AttachChannel(channel->GetCid(), channel->GetQueueDownEnd(), channel->GetRemoteCid());
+  }
+  return channel;
+}
+
+std::shared_ptr<DynamicChannelImpl> Link::AllocateReservedDynamicChannel(Cid reserved_cid, Psm psm, Cid remote_cid,
+                                                                         SecurityPolicy security_policy) {
+  auto channel = dynamic_channel_allocator_.AllocateReservedChannel(reserved_cid, psm, remote_cid, security_policy);
+  if (channel != nullptr) {
+    scheduler_->AttachChannel(channel->GetCid(), channel->GetQueueDownEnd(), channel->GetRemoteCid());
+  }
+  return channel;
+}
+
+void Link::FreeDynamicChannel(Cid cid) {
+  if (dynamic_channel_allocator_.FindChannelByCid(cid) == nullptr) {
+    return;
+  }
+  scheduler_->DetachChannel(cid);
+  dynamic_channel_allocator_.FreeChannel(cid);
+}
+
+void Link::RefreshRefCount() {
+  int ref_count = 0;
+  ref_count += fixed_channel_allocator_.GetRefCount();
+  ref_count += dynamic_channel_allocator_.NumberOfChannels();
+  ASSERT_LOG(ref_count >= 0, "ref_count %d is less than 0", ref_count);
+  if (ref_count > 0) {
+    link_idle_disconnect_alarm_.Cancel();
+  } else {
+    link_idle_disconnect_alarm_.Schedule(common::BindOnce(&Link::Disconnect, common::Unretained(this)),
+                                         parameter_provider_->GetClassicLinkIdleDisconnectTimeout());
+  }
+}
+
+}  // namespace internal
+}  // namespace classic
+}  // namespace l2cap
+}  // namespace bluetooth
diff --git a/gd/l2cap/classic/internal/link.h b/gd/l2cap/classic/internal/link.h
new file mode 100644
index 0000000..8db82fa
--- /dev/null
+++ b/gd/l2cap/classic/internal/link.h
@@ -0,0 +1,102 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#pragma once
+
+#include <memory>
+
+#include "hci/acl_manager.h"
+#include "l2cap/classic/internal/dynamic_channel_allocator.h"
+#include "l2cap/classic/internal/dynamic_channel_impl.h"
+#include "l2cap/classic/internal/dynamic_channel_service_manager_impl.h"
+#include "l2cap/classic/internal/fixed_channel_impl.h"
+#include "l2cap/classic/internal/fixed_channel_service_manager_impl.h"
+#include "l2cap/internal/fixed_channel_allocator.h"
+#include "l2cap/internal/parameter_provider.h"
+#include "l2cap/internal/scheduler.h"
+#include "os/alarm.h"
+#include "os/handler.h"
+#include "signalling_manager.h"
+
+namespace bluetooth {
+namespace l2cap {
+namespace classic {
+namespace internal {
+
+class Link {
+ public:
+  Link(os::Handler* l2cap_handler, std::unique_ptr<hci::AclConnection> acl_connection,
+       std::unique_ptr<l2cap::internal::Scheduler> scheduler, l2cap::internal::ParameterProvider* parameter_provider,
+       DynamicChannelServiceManagerImpl* dynamic_service_manager,
+       FixedChannelServiceManagerImpl* fixed_service_manager);
+
+  virtual ~Link() = default;
+
+  virtual hci::Address GetDevice() {
+    return acl_connection_->GetAddress();
+  }
+
+  // ACL methods
+
+  virtual void OnAclDisconnected(hci::ErrorCode status);
+
+  virtual void Disconnect();
+
+  // FixedChannel methods
+
+  virtual std::shared_ptr<FixedChannelImpl> AllocateFixedChannel(Cid cid, SecurityPolicy security_policy);
+
+  virtual bool IsFixedChannelAllocated(Cid cid);
+
+  // DynamicChannel methods
+
+  virtual Cid ReserveDynamicChannel();
+
+  virtual void SendConnectionRequest(Psm psm, Cid local_cid);
+
+  virtual void SendInformationRequest(InformationRequestInfoType type);
+
+  virtual void SendDisconnectionRequest(Cid local_cid, Cid remote_cid);
+
+  virtual std::shared_ptr<DynamicChannelImpl> AllocateDynamicChannel(Psm psm, Cid remote_cid,
+                                                                     SecurityPolicy security_policy);
+
+  virtual std::shared_ptr<DynamicChannelImpl> AllocateReservedDynamicChannel(Cid reserved_cid, Psm psm, Cid remote_cid,
+                                                                             SecurityPolicy security_policy);
+
+  virtual void FreeDynamicChannel(Cid cid);
+
+  // Check how many channels are acquired or in use, if zero, start tear down timer, if non-zero, cancel tear down timer
+  virtual void RefreshRefCount();
+
+ private:
+  os::Handler* l2cap_handler_;
+  l2cap::internal::FixedChannelAllocator<FixedChannelImpl, Link> fixed_channel_allocator_{this, l2cap_handler_};
+  DynamicChannelAllocator dynamic_channel_allocator_{this, l2cap_handler_};
+  std::unique_ptr<hci::AclConnection> acl_connection_;
+  std::unique_ptr<l2cap::internal::Scheduler> scheduler_;
+  l2cap::internal::ParameterProvider* parameter_provider_;
+  DynamicChannelServiceManagerImpl* dynamic_service_manager_;
+  FixedChannelServiceManagerImpl* fixed_service_manager_;
+  ClassicSignallingManager signalling_manager_;
+  os::Alarm link_idle_disconnect_alarm_{l2cap_handler_};
+  DISALLOW_COPY_AND_ASSIGN(Link);
+};
+
+}  // namespace internal
+}  // namespace classic
+}  // namespace l2cap
+}  // namespace bluetooth
diff --git a/gd/l2cap/classic/internal/link_manager.cc b/gd/l2cap/classic/internal/link_manager.cc
new file mode 100644
index 0000000..39db68a
--- /dev/null
+++ b/gd/l2cap/classic/internal/link_manager.cc
@@ -0,0 +1,190 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+#include <memory>
+#include <unordered_map>
+
+#include "hci/acl_manager.h"
+#include "hci/address.h"
+#include "l2cap/classic/internal/link.h"
+#include "l2cap/internal/scheduler_fifo.h"
+#include "os/handler.h"
+#include "os/log.h"
+
+#include "l2cap/classic/internal/link_manager.h"
+
+namespace bluetooth {
+namespace l2cap {
+namespace classic {
+namespace internal {
+
+void LinkManager::ConnectFixedChannelServices(hci::Address device,
+                                              PendingFixedChannelConnection pending_fixed_channel_connection) {
+  // Check if there is any service registered
+  auto fixed_channel_services = fixed_channel_service_manager_->GetRegisteredServices();
+  if (fixed_channel_services.empty()) {
+    // If so, return error
+    pending_fixed_channel_connection.handler_->Post(common::BindOnce(
+        std::move(pending_fixed_channel_connection.on_fail_callback_),
+        FixedChannelManager::ConnectionResult{
+            .connection_result_code = FixedChannelManager::ConnectionResultCode::FAIL_NO_SERVICE_REGISTERED}));
+    return;
+  }
+  // Otherwise, check if device has an ACL connection
+  auto* link = GetLink(device);
+  if (link != nullptr) {
+    // If device already have an ACL connection
+    // Check if all registered services have an allocated channel and allocate one if not already allocated
+    int num_new_channels = 0;
+    for (auto& fixed_channel_service : fixed_channel_services) {
+      if (link->IsFixedChannelAllocated(fixed_channel_service.first)) {
+        // This channel is already allocated for this link, do not allocated twice
+        continue;
+      }
+      // Allocate channel for newly registered fixed channels
+      auto fixed_channel_impl = link->AllocateFixedChannel(fixed_channel_service.first, SecurityPolicy());
+      fixed_channel_service.second->NotifyChannelCreation(
+          std::make_unique<FixedChannel>(fixed_channel_impl, l2cap_handler_));
+      num_new_channels++;
+    }
+    // Declare connection failure if no new channels are created
+    if (num_new_channels == 0) {
+      pending_fixed_channel_connection.handler_->Post(common::BindOnce(
+          std::move(pending_fixed_channel_connection.on_fail_callback_),
+          FixedChannelManager::ConnectionResult{
+              .connection_result_code = FixedChannelManager::ConnectionResultCode::FAIL_ALL_SERVICES_HAVE_CHANNEL}));
+    }
+    // No need to create ACL connection, return without saving any pending connections
+    return;
+  }
+  // If not, create new ACL connection
+  // Add request to pending link list first
+  auto pending_link = pending_links_.find(device);
+  if (pending_link == pending_links_.end()) {
+    // Create pending link if not exist
+    pending_links_.try_emplace(device);
+    pending_link = pending_links_.find(device);
+  }
+  pending_link->second.pending_fixed_channel_connections_.push_back(std::move(pending_fixed_channel_connection));
+  // Then create new ACL connection
+  acl_manager_->CreateConnection(device);
+}
+
+void LinkManager::ConnectDynamicChannelServices(hci::Address device,
+                                                PendingDynamicChannelConnection pending_dynamic_channel_connection,
+                                                Psm psm) {
+  auto* link = GetLink(device);
+  if (link == nullptr) {
+    acl_manager_->CreateConnection(device);
+    if (pending_dynamic_channels_.find(device) != pending_dynamic_channels_.end()) {
+      pending_dynamic_channels_[device].push_back(psm);
+      pending_dynamic_channels_callbacks_[device].push_back(std::move(pending_dynamic_channel_connection));
+    } else {
+      pending_dynamic_channels_[device] = {psm};
+      pending_dynamic_channels_callbacks_[device].push_back(std::move(pending_dynamic_channel_connection));
+    }
+    return;
+  }
+  link->SendConnectionRequest(psm, link->ReserveDynamicChannel());
+}
+
+Link* LinkManager::GetLink(const hci::Address device) {
+  if (links_.find(device) == links_.end()) {
+    return nullptr;
+  }
+  return &links_.find(device)->second;
+}
+
+void LinkManager::OnConnectSuccess(std::unique_ptr<hci::AclConnection> acl_connection) {
+  // Same link should not be connected twice
+  hci::Address device = acl_connection->GetAddress();
+  ASSERT_LOG(GetLink(device) == nullptr, "%s is connected twice without disconnection",
+             acl_connection->GetAddress().ToString().c_str());
+  // Register ACL disconnection callback in LinkManager so that we can clean up link resource properly
+  acl_connection->RegisterDisconnectCallback(
+      common::BindOnce(&LinkManager::OnDisconnect, common::Unretained(this), device), l2cap_handler_);
+  auto* link_queue_up_end = acl_connection->GetAclQueueEnd();
+  links_.try_emplace(device, l2cap_handler_, std::move(acl_connection),
+                     std::make_unique<l2cap::internal::Fifo>(link_queue_up_end, l2cap_handler_), parameter_provider_,
+                     dynamic_channel_service_manager_, fixed_channel_service_manager_);
+  auto* link = GetLink(device);
+  ASSERT(link != nullptr);
+  link->SendInformationRequest(InformationRequestInfoType::EXTENDED_FEATURES_SUPPORTED);
+  link->SendInformationRequest(InformationRequestInfoType::FIXED_CHANNELS_SUPPORTED);
+
+  // Allocate and distribute channels for all registered fixed channel services
+  auto fixed_channel_services = fixed_channel_service_manager_->GetRegisteredServices();
+  for (auto& fixed_channel_service : fixed_channel_services) {
+    auto fixed_channel_impl = link->AllocateFixedChannel(fixed_channel_service.first, SecurityPolicy());
+    fixed_channel_service.second->NotifyChannelCreation(
+        std::make_unique<FixedChannel>(fixed_channel_impl, l2cap_handler_));
+  }
+  if (pending_dynamic_channels_.find(device) != pending_dynamic_channels_.end()) {
+    for (Psm psm : pending_dynamic_channels_[device]) {
+      link->SendConnectionRequest(psm, link->ReserveDynamicChannel());
+    }
+    pending_dynamic_channels_.erase(device);
+    pending_dynamic_channels_callbacks_.erase(device);
+  }
+  // Remove device from pending links list, if any
+  auto pending_link = pending_links_.find(device);
+  if (pending_link == pending_links_.end()) {
+    // This an incoming connection, exit
+    return;
+  }
+  // This is an outgoing connection, remove entry in pending link list
+  pending_links_.erase(pending_link);
+}
+
+void LinkManager::OnConnectFail(hci::Address device, hci::ErrorCode reason) {
+  // Notify all pending links for this device
+  auto pending_link = pending_links_.find(device);
+  if (pending_link == pending_links_.end()) {
+    // There is no pending link, exit
+    LOG_DEBUG("Connection to %s failed without a pending link", device.ToString().c_str());
+    if (pending_dynamic_channels_callbacks_.find(device) != pending_dynamic_channels_callbacks_.end()) {
+      for (PendingDynamicChannelConnection& callbacks : pending_dynamic_channels_callbacks_[device]) {
+        callbacks.handler_->Post(common::BindOnce(std::move(callbacks.on_fail_callback_),
+                                                  DynamicChannelManager::ConnectionResult{
+                                                      .hci_error = hci::ErrorCode::CONNECTION_TIMEOUT,
+                                                  }));
+      }
+      pending_dynamic_channels_.erase(device);
+      pending_dynamic_channels_callbacks_.erase(device);
+    }
+    return;
+  }
+  for (auto& pending_fixed_channel_connection : pending_link->second.pending_fixed_channel_connections_) {
+    pending_fixed_channel_connection.handler_->Post(common::BindOnce(
+        std::move(pending_fixed_channel_connection.on_fail_callback_),
+        FixedChannelManager::ConnectionResult{
+            .connection_result_code = FixedChannelManager::ConnectionResultCode::FAIL_HCI_ERROR, .hci_error = reason}));
+  }
+  // Remove entry in pending link list
+  pending_links_.erase(pending_link);
+}
+
+void LinkManager::OnDisconnect(hci::Address device, hci::ErrorCode status) {
+  auto* link = GetLink(device);
+  ASSERT_LOG(link != nullptr, "Device %s is disconnected with reason 0x%x, but not in local database",
+             device.ToString().c_str(), static_cast<uint8_t>(status));
+  link->OnAclDisconnected(status);
+  links_.erase(device);
+}
+
+}  // namespace internal
+}  // namespace classic
+}  // namespace l2cap
+}  // namespace bluetooth
diff --git a/gd/l2cap/classic/internal/link_manager.h b/gd/l2cap/classic/internal/link_manager.h
new file mode 100644
index 0000000..9195b83
--- /dev/null
+++ b/gd/l2cap/classic/internal/link_manager.h
@@ -0,0 +1,100 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#pragma once
+
+#include <memory>
+#include <unordered_map>
+
+#include "hci/acl_manager.h"
+#include "hci/address.h"
+#include "l2cap/classic/dynamic_channel_manager.h"
+#include "l2cap/classic/fixed_channel_manager.h"
+#include "l2cap/classic/internal/dynamic_channel_service_manager_impl.h"
+#include "l2cap/classic/internal/fixed_channel_service_manager_impl.h"
+#include "l2cap/classic/internal/link.h"
+#include "l2cap/internal/parameter_provider.h"
+#include "l2cap/internal/scheduler.h"
+#include "os/handler.h"
+
+namespace bluetooth {
+namespace l2cap {
+namespace classic {
+namespace internal {
+
+class LinkManager : public hci::ConnectionCallbacks {
+ public:
+  LinkManager(os::Handler* l2cap_handler, hci::AclManager* acl_manager,
+              FixedChannelServiceManagerImpl* fixed_channel_service_manager,
+              DynamicChannelServiceManagerImpl* dynamic_channel_service_manager,
+              l2cap::internal::ParameterProvider* parameter_provider)
+      : l2cap_handler_(l2cap_handler), acl_manager_(acl_manager),
+        fixed_channel_service_manager_(fixed_channel_service_manager),
+        dynamic_channel_service_manager_(dynamic_channel_service_manager), parameter_provider_(parameter_provider) {
+    acl_manager_->RegisterCallbacks(this, l2cap_handler_);
+  }
+
+  struct PendingFixedChannelConnection {
+    os::Handler* handler_;
+    FixedChannelManager::OnConnectionFailureCallback on_fail_callback_;
+  };
+
+  struct PendingDynamicChannelConnection {
+    os::Handler* handler_;
+    DynamicChannelManager::OnConnectionOpenCallback on_open_callback_;
+    DynamicChannelManager::OnConnectionFailureCallback on_fail_callback_;
+  };
+
+  struct PendingLink {
+    std::vector<PendingFixedChannelConnection> pending_fixed_channel_connections_;
+  };
+
+  // ACL methods
+
+  Link* GetLink(hci::Address device);
+  void OnConnectSuccess(std::unique_ptr<hci::AclConnection> acl_connection) override;
+  void OnConnectFail(hci::Address device, hci::ErrorCode reason) override;
+  void OnDisconnect(hci::Address device, hci::ErrorCode status);
+
+  // FixedChannelManager methods
+
+  void ConnectFixedChannelServices(hci::Address device, PendingFixedChannelConnection pending_fixed_channel_connection);
+
+  // DynamicChannelManager methods
+
+  void ConnectDynamicChannelServices(hci::Address device,
+                                     PendingDynamicChannelConnection pending_dynamic_channel_connection, Psm psm);
+
+ private:
+  // Dependencies
+  os::Handler* l2cap_handler_;
+  hci::AclManager* acl_manager_;
+  FixedChannelServiceManagerImpl* fixed_channel_service_manager_;
+  DynamicChannelServiceManagerImpl* dynamic_channel_service_manager_;
+  l2cap::internal::ParameterProvider* parameter_provider_;
+
+  // Internal states
+  std::unordered_map<hci::Address, PendingLink> pending_links_;
+  std::unordered_map<hci::Address, Link> links_;
+  std::unordered_map<hci::Address, std::list<Psm>> pending_dynamic_channels_;
+  std::unordered_map<hci::Address, std::list<PendingDynamicChannelConnection>> pending_dynamic_channels_callbacks_;
+  DISALLOW_COPY_AND_ASSIGN(LinkManager);
+};
+
+}  // namespace internal
+}  // namespace classic
+}  // namespace l2cap
+}  // namespace bluetooth
diff --git a/gd/l2cap/classic/internal/link_manager_test.cc b/gd/l2cap/classic/internal/link_manager_test.cc
new file mode 100644
index 0000000..405279d
--- /dev/null
+++ b/gd/l2cap/classic/internal/link_manager_test.cc
@@ -0,0 +1,469 @@
+/*
+ * Copyright 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "l2cap/classic/internal/link_manager.h"
+
+#include <future>
+#include <thread>
+
+#include "common/bind.h"
+#include "common/testing/bind_test_util.h"
+#include "dynamic_channel_service_manager_impl_mock.h"
+#include "hci/acl_manager_mock.h"
+#include "hci/address.h"
+#include "l2cap/cid.h"
+#include "l2cap/classic/fixed_channel_manager.h"
+#include "l2cap/classic/internal/fixed_channel_service_impl_mock.h"
+#include "l2cap/classic/internal/fixed_channel_service_manager_impl_mock.h"
+#include "l2cap/internal/parameter_provider_mock.h"
+#include "os/handler.h"
+#include "os/thread.h"
+
+#include <gmock/gmock.h>
+#include <gtest/gtest.h>
+
+namespace bluetooth {
+namespace l2cap {
+namespace classic {
+namespace internal {
+
+using hci::testing::MockAclConnection;
+using hci::testing::MockAclManager;
+using l2cap::internal::testing::MockParameterProvider;
+using ::testing::_;  // Matcher to any value
+using ::testing::ByMove;
+using ::testing::DoAll;
+using testing::MockDynamicChannelServiceManagerImpl;
+using testing::MockFixedChannelServiceImpl;
+using testing::MockFixedChannelServiceManagerImpl;
+using ::testing::Return;
+using ::testing::SaveArg;
+
+constexpr static auto kTestIdleDisconnectTimeoutLong = std::chrono::milliseconds(1000);
+constexpr static auto kTestIdleDisconnectTimeoutShort = std::chrono::milliseconds(30);
+
+class L2capClassicLinkManagerTest : public ::testing::Test {
+ public:
+  static void SyncHandler(os::Handler* handler) {
+    std::promise<void> promise;
+    auto future = promise.get_future();
+    handler->Post(common::BindOnce(&std::promise<void>::set_value, common::Unretained(&promise)));
+    future.wait_for(std::chrono::milliseconds(3));
+  }
+
+ protected:
+  void SetUp() override {
+    thread_ = new os::Thread("test_thread", os::Thread::Priority::NORMAL);
+    l2cap_handler_ = new os::Handler(thread_);
+    mock_parameter_provider_ = new MockParameterProvider;
+    EXPECT_CALL(*mock_parameter_provider_, GetClassicLinkIdleDisconnectTimeout)
+        .WillRepeatedly(Return(kTestIdleDisconnectTimeoutLong));
+  }
+
+  void TearDown() override {
+    delete mock_parameter_provider_;
+    l2cap_handler_->Clear();
+    delete l2cap_handler_;
+    delete thread_;
+  }
+
+  os::Thread* thread_ = nullptr;
+  os::Handler* l2cap_handler_ = nullptr;
+  MockParameterProvider* mock_parameter_provider_ = nullptr;
+};
+
+TEST_F(L2capClassicLinkManagerTest, connect_fixed_channel_service_without_acl) {
+  MockFixedChannelServiceManagerImpl mock_classic_fixed_channel_service_manager;
+  MockDynamicChannelServiceManagerImpl mock_classic_dynamic_channel_service_manager;
+  MockAclManager mock_acl_manager;
+  hci::Address device{{0x01, 0x02, 0x03, 0x04, 0x05, 0x06}};
+  auto user_handler = std::make_unique<os::Handler>(thread_);
+
+  // Step 1: Verify callback registration with HCI
+  hci::ConnectionCallbacks* hci_connection_callbacks = nullptr;
+  os::Handler* hci_callback_handler = nullptr;
+  EXPECT_CALL(mock_acl_manager, RegisterCallbacks(_, _))
+      .WillOnce(DoAll(SaveArg<0>(&hci_connection_callbacks), SaveArg<1>(&hci_callback_handler)));
+  LinkManager classic_link_manager(l2cap_handler_, &mock_acl_manager, &mock_classic_fixed_channel_service_manager,
+                                   &mock_classic_dynamic_channel_service_manager, mock_parameter_provider_);
+  EXPECT_EQ(hci_connection_callbacks, &classic_link_manager);
+  EXPECT_EQ(hci_callback_handler, l2cap_handler_);
+
+  // Register fake services
+  MockFixedChannelServiceImpl mock_service_1, mock_service_2;
+  std::vector<std::pair<Cid, FixedChannelServiceImpl*>> results;
+  results.emplace_back(kSmpBrCid, &mock_service_1);
+  results.emplace_back(kConnectionlessCid, &mock_service_2);
+  EXPECT_CALL(mock_classic_fixed_channel_service_manager, GetRegisteredServices()).WillRepeatedly(Return(results));
+
+  // Step 2: Connect to fixed channel without ACL connection should trigger ACL connection process
+  EXPECT_CALL(mock_acl_manager, CreateConnection(device)).Times(1);
+  LinkManager::PendingFixedChannelConnection pending_fixed_channel_connection{
+      .handler_ = user_handler.get(),
+      .on_fail_callback_ = common::BindOnce([](FixedChannelManager::ConnectionResult result) { FAIL(); })};
+  classic_link_manager.ConnectFixedChannelServices(device, std::move(pending_fixed_channel_connection));
+
+  // Step 3: ACL connection success event should trigger channel creation for all registered services
+
+  std::unique_ptr<MockAclConnection> acl_connection = std::make_unique<MockAclConnection>();
+  hci::AclConnection::Queue link_queue{10};
+  EXPECT_CALL(*acl_connection, GetAclQueueEnd()).WillRepeatedly((Return(link_queue.GetUpEnd())));
+  EXPECT_CALL(*acl_connection, RegisterDisconnectCallback(_, l2cap_handler_)).Times(1);
+  EXPECT_CALL(*acl_connection, GetAddress()).WillRepeatedly(Return(device));
+  std::unique_ptr<FixedChannel> channel_1, channel_2;
+  EXPECT_CALL(mock_service_1, NotifyChannelCreation(_)).WillOnce([&channel_1](std::unique_ptr<FixedChannel> channel) {
+    channel_1 = std::move(channel);
+  });
+  EXPECT_CALL(mock_service_2, NotifyChannelCreation(_)).WillOnce([&channel_2](std::unique_ptr<FixedChannel> channel) {
+    channel_2 = std::move(channel);
+  });
+  hci_callback_handler->Post(common::BindOnce(&hci::ConnectionCallbacks::OnConnectSuccess,
+                                              common::Unretained(hci_connection_callbacks), std::move(acl_connection)));
+  SyncHandler(hci_callback_handler);
+  EXPECT_NE(channel_1, nullptr);
+  EXPECT_NE(channel_2, nullptr);
+
+  // Step 4: Calling ConnectServices() to the same device will no trigger another connection attempt
+  FixedChannelManager::ConnectionResult my_result;
+  LinkManager::PendingFixedChannelConnection pending_fixed_channel_connection_2{
+      .handler_ = user_handler.get(),
+      .on_fail_callback_ = common::testing::BindLambdaForTesting(
+          [&my_result](FixedChannelManager::ConnectionResult result) { my_result = result; })};
+  classic_link_manager.ConnectFixedChannelServices(device, std::move(pending_fixed_channel_connection_2));
+  SyncHandler(user_handler.get());
+  EXPECT_EQ(my_result.connection_result_code,
+            FixedChannelManager::ConnectionResultCode::FAIL_ALL_SERVICES_HAVE_CHANNEL);
+
+  // Step 5: Register new service will cause new channels to be created during ConnectServices()
+  MockFixedChannelServiceImpl mock_service_3;
+  results.emplace_back(kSmpBrCid + 1, &mock_service_3);
+  EXPECT_CALL(mock_classic_fixed_channel_service_manager, GetRegisteredServices()).WillRepeatedly(Return(results));
+  LinkManager::PendingFixedChannelConnection pending_fixed_channel_connection_3{
+      .handler_ = user_handler.get(),
+      .on_fail_callback_ = common::BindOnce([](FixedChannelManager::ConnectionResult result) { FAIL(); })};
+  std::unique_ptr<FixedChannel> channel_3;
+  EXPECT_CALL(mock_service_3, NotifyChannelCreation(_)).WillOnce([&channel_3](std::unique_ptr<FixedChannel> channel) {
+    channel_3 = std::move(channel);
+  });
+  classic_link_manager.ConnectFixedChannelServices(device, std::move(pending_fixed_channel_connection_3));
+  EXPECT_NE(channel_3, nullptr);
+
+  user_handler->Clear();
+
+  classic_link_manager.OnDisconnect(device, hci::ErrorCode::SUCCESS);
+}
+
+TEST_F(L2capClassicLinkManagerTest, connect_fixed_channel_service_without_acl_with_no_service) {
+  MockFixedChannelServiceManagerImpl mock_classic_fixed_channel_service_manager;
+  MockAclManager mock_acl_manager;
+  hci::Address device{{0x01, 0x02, 0x03, 0x04, 0x05, 0x06}};
+  auto user_handler = std::make_unique<os::Handler>(thread_);
+
+  // Step 1: Verify callback registration with HCI
+  hci::ConnectionCallbacks* hci_connection_callbacks = nullptr;
+  os::Handler* hci_callback_handler = nullptr;
+  EXPECT_CALL(mock_acl_manager, RegisterCallbacks(_, _))
+      .WillOnce(DoAll(SaveArg<0>(&hci_connection_callbacks), SaveArg<1>(&hci_callback_handler)));
+  LinkManager classic_link_manager(l2cap_handler_, &mock_acl_manager, &mock_classic_fixed_channel_service_manager,
+                                   nullptr, mock_parameter_provider_);
+  EXPECT_EQ(hci_connection_callbacks, &classic_link_manager);
+  EXPECT_EQ(hci_callback_handler, l2cap_handler_);
+
+  // Make sure no service is registered
+  std::vector<std::pair<Cid, FixedChannelServiceImpl*>> results;
+  EXPECT_CALL(mock_classic_fixed_channel_service_manager, GetRegisteredServices()).WillRepeatedly(Return(results));
+
+  // Step 2: Connect to fixed channel without any service registered will result in failure
+  EXPECT_CALL(mock_acl_manager, CreateConnection(device)).Times(0);
+  FixedChannelManager::ConnectionResult my_result;
+  LinkManager::PendingFixedChannelConnection pending_fixed_channel_connection{
+      .handler_ = user_handler.get(),
+      .on_fail_callback_ = common::testing::BindLambdaForTesting(
+          [&my_result](FixedChannelManager::ConnectionResult result) { my_result = result; })};
+  classic_link_manager.ConnectFixedChannelServices(device, std::move(pending_fixed_channel_connection));
+  SyncHandler(user_handler.get());
+  EXPECT_EQ(my_result.connection_result_code, FixedChannelManager::ConnectionResultCode::FAIL_NO_SERVICE_REGISTERED);
+
+  user_handler->Clear();
+}
+
+TEST_F(L2capClassicLinkManagerTest, connect_fixed_channel_service_without_acl_with_hci_failure) {
+  MockFixedChannelServiceManagerImpl mock_classic_fixed_channel_service_manager;
+  MockAclManager mock_acl_manager;
+  hci::Address device{{0x01, 0x02, 0x03, 0x04, 0x05, 0x06}};
+  auto user_handler = std::make_unique<os::Handler>(thread_);
+
+  // Step 1: Verify callback registration with HCI
+  hci::ConnectionCallbacks* hci_connection_callbacks = nullptr;
+  os::Handler* hci_callback_handler = nullptr;
+  EXPECT_CALL(mock_acl_manager, RegisterCallbacks(_, _))
+      .WillOnce(DoAll(SaveArg<0>(&hci_connection_callbacks), SaveArg<1>(&hci_callback_handler)));
+  LinkManager classic_link_manager(l2cap_handler_, &mock_acl_manager, &mock_classic_fixed_channel_service_manager,
+                                   nullptr, mock_parameter_provider_);
+  EXPECT_EQ(hci_connection_callbacks, &classic_link_manager);
+  EXPECT_EQ(hci_callback_handler, l2cap_handler_);
+
+  // Register fake services
+  MockFixedChannelServiceImpl mock_service_1;
+  std::vector<std::pair<Cid, FixedChannelServiceImpl*>> results;
+  results.emplace_back(kSmpBrCid, &mock_service_1);
+  EXPECT_CALL(mock_classic_fixed_channel_service_manager, GetRegisteredServices()).WillRepeatedly(Return(results));
+
+  // Step 2: Connect to fixed channel without ACL connection should trigger ACL connection process
+  EXPECT_CALL(mock_acl_manager, CreateConnection(device)).Times(1);
+  FixedChannelManager::ConnectionResult my_result;
+  LinkManager::PendingFixedChannelConnection pending_fixed_channel_connection{
+      .handler_ = user_handler.get(),
+      .on_fail_callback_ = common::testing::BindLambdaForTesting(
+          [&my_result](FixedChannelManager::ConnectionResult result) { my_result = result; })};
+  classic_link_manager.ConnectFixedChannelServices(device, std::move(pending_fixed_channel_connection));
+
+  // Step 3: ACL connection failure event should trigger connection failure callback
+  EXPECT_CALL(mock_service_1, NotifyChannelCreation(_)).Times(0);
+  hci_callback_handler->Post(common::BindOnce(&hci::ConnectionCallbacks::OnConnectFail,
+                                              common::Unretained(hci_connection_callbacks), device,
+                                              hci::ErrorCode::PAGE_TIMEOUT));
+  SyncHandler(hci_callback_handler);
+  SyncHandler(user_handler.get());
+  EXPECT_EQ(my_result.connection_result_code, FixedChannelManager::ConnectionResultCode::FAIL_HCI_ERROR);
+  EXPECT_EQ(my_result.hci_error, hci::ErrorCode::PAGE_TIMEOUT);
+
+  user_handler->Clear();
+}
+
+TEST_F(L2capClassicLinkManagerTest, not_acquiring_channels_should_disconnect_acl_after_timeout) {
+  EXPECT_CALL(*mock_parameter_provider_, GetClassicLinkIdleDisconnectTimeout)
+      .WillRepeatedly(Return(kTestIdleDisconnectTimeoutShort));
+  MockFixedChannelServiceManagerImpl mock_classic_fixed_channel_service_manager;
+  MockAclManager mock_acl_manager;
+  hci::Address device{{0x01, 0x02, 0x03, 0x04, 0x05, 0x06}};
+  auto user_handler = std::make_unique<os::Handler>(thread_);
+
+  // Step 1: Verify callback registration with HCI
+  hci::ConnectionCallbacks* hci_connection_callbacks = nullptr;
+  os::Handler* hci_callback_handler = nullptr;
+  EXPECT_CALL(mock_acl_manager, RegisterCallbacks(_, _))
+      .WillOnce(DoAll(SaveArg<0>(&hci_connection_callbacks), SaveArg<1>(&hci_callback_handler)));
+  LinkManager classic_link_manager(l2cap_handler_, &mock_acl_manager, &mock_classic_fixed_channel_service_manager,
+                                   nullptr, mock_parameter_provider_);
+  EXPECT_EQ(hci_connection_callbacks, &classic_link_manager);
+  EXPECT_EQ(hci_callback_handler, l2cap_handler_);
+
+  // Register fake services
+  MockFixedChannelServiceImpl mock_service_1, mock_service_2;
+  std::vector<std::pair<Cid, FixedChannelServiceImpl*>> results;
+  results.emplace_back(kSmpBrCid, &mock_service_1);
+  results.emplace_back(kConnectionlessCid, &mock_service_2);
+  EXPECT_CALL(mock_classic_fixed_channel_service_manager, GetRegisteredServices()).WillRepeatedly(Return(results));
+
+  // Step 2: Connect to fixed channel without ACL connection should trigger ACL connection process
+  EXPECT_CALL(mock_acl_manager, CreateConnection(device)).Times(1);
+  LinkManager::PendingFixedChannelConnection pending_fixed_channel_connection{
+      .handler_ = user_handler.get(),
+      .on_fail_callback_ = common::BindOnce([](FixedChannelManager::ConnectionResult result) { FAIL(); })};
+  classic_link_manager.ConnectFixedChannelServices(device, std::move(pending_fixed_channel_connection));
+
+  // Step 3: ACL connection success event should trigger channel creation for all registered services
+  auto* raw_acl_connection = new MockAclConnection();
+  std::unique_ptr<MockAclConnection> acl_connection(raw_acl_connection);
+  hci::AclConnection::Queue link_queue{10};
+  EXPECT_CALL(*acl_connection, GetAclQueueEnd()).WillRepeatedly((Return(link_queue.GetUpEnd())));
+  EXPECT_CALL(*acl_connection, GetAddress()).WillRepeatedly(Return(device));
+  std::unique_ptr<FixedChannel> channel_1, channel_2;
+  EXPECT_CALL(mock_service_1, NotifyChannelCreation(_)).WillOnce([&channel_1](std::unique_ptr<FixedChannel> channel) {
+    channel_1 = std::move(channel);
+  });
+  EXPECT_CALL(mock_service_2, NotifyChannelCreation(_)).WillOnce([&channel_2](std::unique_ptr<FixedChannel> channel) {
+    channel_2 = std::move(channel);
+  });
+  hci_callback_handler->Post(common::BindOnce(&hci::ConnectionCallbacks::OnConnectSuccess,
+                                              common::Unretained(hci_connection_callbacks), std::move(acl_connection)));
+  SyncHandler(hci_callback_handler);
+  EXPECT_NE(channel_1, nullptr);
+  EXPECT_NE(channel_2, nullptr);
+  hci::ErrorCode status_1 = hci::ErrorCode::SUCCESS;
+  channel_1->RegisterOnCloseCallback(
+      user_handler.get(), common::testing::BindLambdaForTesting([&](hci::ErrorCode status) { status_1 = status; }));
+  hci::ErrorCode status_2 = hci::ErrorCode::SUCCESS;
+  channel_2->RegisterOnCloseCallback(
+      user_handler.get(), common::testing::BindLambdaForTesting([&](hci::ErrorCode status) { status_2 = status; }));
+
+  // Step 4: Leave channel IDLE long enough, they will disconnect
+  EXPECT_CALL(*raw_acl_connection, Disconnect(hci::DisconnectReason::REMOTE_USER_TERMINATED_CONNECTION)).Times(1);
+  std::this_thread::sleep_for(kTestIdleDisconnectTimeoutShort * 1.2);
+
+  // Step 5: Link disconnect will trigger all callbacks
+  classic_link_manager.OnDisconnect(device, hci::ErrorCode::CONNECTION_TERMINATED_BY_LOCAL_HOST);
+  SyncHandler(user_handler.get());
+  EXPECT_EQ(hci::ErrorCode::CONNECTION_TERMINATED_BY_LOCAL_HOST, status_1);
+  EXPECT_EQ(hci::ErrorCode::CONNECTION_TERMINATED_BY_LOCAL_HOST, status_2);
+
+  user_handler->Clear();
+}
+
+TEST_F(L2capClassicLinkManagerTest, acquiring_channels_should_not_disconnect_acl_after_timeout) {
+  EXPECT_CALL(*mock_parameter_provider_, GetClassicLinkIdleDisconnectTimeout)
+      .WillRepeatedly(Return(kTestIdleDisconnectTimeoutShort));
+  MockFixedChannelServiceManagerImpl mock_classic_fixed_channel_service_manager;
+  MockAclManager mock_acl_manager;
+  hci::Address device{{0x01, 0x02, 0x03, 0x04, 0x05, 0x06}};
+  auto user_handler = std::make_unique<os::Handler>(thread_);
+
+  // Step 1: Verify callback registration with HCI
+  hci::ConnectionCallbacks* hci_connection_callbacks = nullptr;
+  os::Handler* hci_callback_handler = nullptr;
+  EXPECT_CALL(mock_acl_manager, RegisterCallbacks(_, _))
+      .WillOnce(DoAll(SaveArg<0>(&hci_connection_callbacks), SaveArg<1>(&hci_callback_handler)));
+  LinkManager classic_link_manager(l2cap_handler_, &mock_acl_manager, &mock_classic_fixed_channel_service_manager,
+                                   nullptr, mock_parameter_provider_);
+  EXPECT_EQ(hci_connection_callbacks, &classic_link_manager);
+  EXPECT_EQ(hci_callback_handler, l2cap_handler_);
+
+  // Register fake services
+  MockFixedChannelServiceImpl mock_service_1, mock_service_2;
+  std::vector<std::pair<Cid, FixedChannelServiceImpl*>> results;
+  results.emplace_back(kSmpBrCid, &mock_service_1);
+  results.emplace_back(kConnectionlessCid, &mock_service_2);
+  EXPECT_CALL(mock_classic_fixed_channel_service_manager, GetRegisteredServices()).WillRepeatedly(Return(results));
+
+  // Step 2: Connect to fixed channel without ACL connection should trigger ACL connection process
+  EXPECT_CALL(mock_acl_manager, CreateConnection(device)).Times(1);
+  LinkManager::PendingFixedChannelConnection pending_fixed_channel_connection{
+      .handler_ = user_handler.get(),
+      .on_fail_callback_ = common::BindOnce([](FixedChannelManager::ConnectionResult result) { FAIL(); })};
+  classic_link_manager.ConnectFixedChannelServices(device, std::move(pending_fixed_channel_connection));
+
+  // Step 3: ACL connection success event should trigger channel creation for all registered services
+  auto* raw_acl_connection = new MockAclConnection();
+  std::unique_ptr<MockAclConnection> acl_connection(raw_acl_connection);
+  hci::AclConnection::Queue link_queue{10};
+  EXPECT_CALL(*acl_connection, GetAclQueueEnd()).WillRepeatedly((Return(link_queue.GetUpEnd())));
+  EXPECT_CALL(*acl_connection, GetAddress()).WillRepeatedly(Return(device));
+  std::unique_ptr<FixedChannel> channel_1, channel_2;
+  EXPECT_CALL(mock_service_1, NotifyChannelCreation(_)).WillOnce([&channel_1](std::unique_ptr<FixedChannel> channel) {
+    channel_1 = std::move(channel);
+  });
+  EXPECT_CALL(mock_service_2, NotifyChannelCreation(_)).WillOnce([&channel_2](std::unique_ptr<FixedChannel> channel) {
+    channel_2 = std::move(channel);
+  });
+  hci_callback_handler->Post(common::BindOnce(&hci::ConnectionCallbacks::OnConnectSuccess,
+                                              common::Unretained(hci_connection_callbacks), std::move(acl_connection)));
+  SyncHandler(hci_callback_handler);
+  EXPECT_NE(channel_1, nullptr);
+  EXPECT_NE(channel_2, nullptr);
+  hci::ErrorCode status_1 = hci::ErrorCode::SUCCESS;
+  channel_1->RegisterOnCloseCallback(
+      user_handler.get(), common::testing::BindLambdaForTesting([&](hci::ErrorCode status) { status_1 = status; }));
+  hci::ErrorCode status_2 = hci::ErrorCode::SUCCESS;
+  channel_2->RegisterOnCloseCallback(
+      user_handler.get(), common::testing::BindLambdaForTesting([&](hci::ErrorCode status) { status_2 = status; }));
+
+  channel_1->Acquire();
+
+  // Step 4: Leave channel IDLE, it won't disconnect to due acquired channel 1
+  EXPECT_CALL(*raw_acl_connection, Disconnect(hci::DisconnectReason::REMOTE_USER_TERMINATED_CONNECTION)).Times(0);
+  std::this_thread::sleep_for(kTestIdleDisconnectTimeoutShort * 2);
+
+  // Step 5: Link disconnect will trigger all callbacks
+  classic_link_manager.OnDisconnect(device, hci::ErrorCode::CONNECTION_TERMINATED_BY_LOCAL_HOST);
+  SyncHandler(user_handler.get());
+  EXPECT_EQ(hci::ErrorCode::CONNECTION_TERMINATED_BY_LOCAL_HOST, status_1);
+  EXPECT_EQ(hci::ErrorCode::CONNECTION_TERMINATED_BY_LOCAL_HOST, status_2);
+
+  user_handler->Clear();
+}
+
+TEST_F(L2capClassicLinkManagerTest, acquiring_and_releasing_channels_should_eventually_disconnect_acl) {
+  EXPECT_CALL(*mock_parameter_provider_, GetClassicLinkIdleDisconnectTimeout)
+      .WillRepeatedly(Return(kTestIdleDisconnectTimeoutShort));
+  MockFixedChannelServiceManagerImpl mock_classic_fixed_channel_service_manager;
+  MockAclManager mock_acl_manager;
+  hci::Address device{{0x01, 0x02, 0x03, 0x04, 0x05, 0x06}};
+  auto user_handler = std::make_unique<os::Handler>(thread_);
+
+  // Step 1: Verify callback registration with HCI
+  hci::ConnectionCallbacks* hci_connection_callbacks = nullptr;
+  os::Handler* hci_callback_handler = nullptr;
+  EXPECT_CALL(mock_acl_manager, RegisterCallbacks(_, _))
+      .WillOnce(DoAll(SaveArg<0>(&hci_connection_callbacks), SaveArg<1>(&hci_callback_handler)));
+  LinkManager classic_link_manager(l2cap_handler_, &mock_acl_manager, &mock_classic_fixed_channel_service_manager,
+                                   nullptr, mock_parameter_provider_);
+  EXPECT_EQ(hci_connection_callbacks, &classic_link_manager);
+  EXPECT_EQ(hci_callback_handler, l2cap_handler_);
+
+  // Register fake services
+  MockFixedChannelServiceImpl mock_service_1, mock_service_2;
+  std::vector<std::pair<Cid, FixedChannelServiceImpl*>> results;
+  results.emplace_back(kSmpBrCid, &mock_service_1);
+  results.emplace_back(kConnectionlessCid, &mock_service_2);
+  EXPECT_CALL(mock_classic_fixed_channel_service_manager, GetRegisteredServices()).WillRepeatedly(Return(results));
+
+  // Step 2: Connect to fixed channel without ACL connection should trigger ACL connection process
+  EXPECT_CALL(mock_acl_manager, CreateConnection(device)).Times(1);
+  LinkManager::PendingFixedChannelConnection pending_fixed_channel_connection{
+      .handler_ = user_handler.get(),
+      .on_fail_callback_ = common::BindOnce([](FixedChannelManager::ConnectionResult result) { FAIL(); })};
+  classic_link_manager.ConnectFixedChannelServices(device, std::move(pending_fixed_channel_connection));
+
+  // Step 3: ACL connection success event should trigger channel creation for all registered services
+  auto* raw_acl_connection = new MockAclConnection();
+  std::unique_ptr<MockAclConnection> acl_connection(raw_acl_connection);
+  hci::AclConnection::Queue link_queue{10};
+  EXPECT_CALL(*acl_connection, GetAclQueueEnd()).WillRepeatedly((Return(link_queue.GetUpEnd())));
+  EXPECT_CALL(*acl_connection, GetAddress()).WillRepeatedly(Return(device));
+  std::unique_ptr<FixedChannel> channel_1, channel_2;
+  EXPECT_CALL(mock_service_1, NotifyChannelCreation(_)).WillOnce([&channel_1](std::unique_ptr<FixedChannel> channel) {
+    channel_1 = std::move(channel);
+  });
+  EXPECT_CALL(mock_service_2, NotifyChannelCreation(_)).WillOnce([&channel_2](std::unique_ptr<FixedChannel> channel) {
+    channel_2 = std::move(channel);
+  });
+  hci_callback_handler->Post(common::BindOnce(&hci::ConnectionCallbacks::OnConnectSuccess,
+                                              common::Unretained(hci_connection_callbacks), std::move(acl_connection)));
+  SyncHandler(hci_callback_handler);
+  EXPECT_NE(channel_1, nullptr);
+  EXPECT_NE(channel_2, nullptr);
+  hci::ErrorCode status_1 = hci::ErrorCode::SUCCESS;
+  channel_1->RegisterOnCloseCallback(
+      user_handler.get(), common::testing::BindLambdaForTesting([&](hci::ErrorCode status) { status_1 = status; }));
+  hci::ErrorCode status_2 = hci::ErrorCode::SUCCESS;
+  channel_2->RegisterOnCloseCallback(
+      user_handler.get(), common::testing::BindLambdaForTesting([&](hci::ErrorCode status) { status_2 = status; }));
+
+  channel_1->Acquire();
+
+  // Step 4: Leave channel IDLE, it won't disconnect to due acquired channel 1
+  EXPECT_CALL(*raw_acl_connection, Disconnect(hci::DisconnectReason::REMOTE_USER_TERMINATED_CONNECTION)).Times(0);
+  std::this_thread::sleep_for(kTestIdleDisconnectTimeoutShort * 2);
+
+  // Step 5: Leave channel IDLE long enough, they will disconnect
+  channel_1->Release();
+  EXPECT_CALL(*raw_acl_connection, Disconnect(hci::DisconnectReason::REMOTE_USER_TERMINATED_CONNECTION)).Times(1);
+  std::this_thread::sleep_for(kTestIdleDisconnectTimeoutShort * 1.2);
+
+  // Step 6: Link disconnect will trigger all callbacks
+  classic_link_manager.OnDisconnect(device, hci::ErrorCode::CONNECTION_TERMINATED_BY_LOCAL_HOST);
+  SyncHandler(user_handler.get());
+  EXPECT_EQ(hci::ErrorCode::CONNECTION_TERMINATED_BY_LOCAL_HOST, status_1);
+  EXPECT_EQ(hci::ErrorCode::CONNECTION_TERMINATED_BY_LOCAL_HOST, status_2);
+
+  user_handler->Clear();
+}
+
+}  // namespace internal
+}  // namespace classic
+}  // namespace l2cap
+}  // namespace bluetooth
diff --git a/gd/l2cap/classic/internal/link_mock.h b/gd/l2cap/classic/internal/link_mock.h
new file mode 100644
index 0000000..58dbd55
--- /dev/null
+++ b/gd/l2cap/classic/internal/link_mock.h
@@ -0,0 +1,58 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+#pragma once
+
+#include "hci/acl_manager_mock.h"
+#include "hci/address.h"
+#include "l2cap/classic/internal/link.h"
+#include "l2cap/internal/scheduler_mock.h"
+
+#include <gmock/gmock.h>
+
+// Unit test interfaces
+namespace bluetooth {
+namespace l2cap {
+namespace classic {
+namespace internal {
+namespace testing {
+
+using hci::testing::MockAclConnection;
+
+class MockLink : public Link {
+ public:
+  explicit MockLink(os::Handler* handler, l2cap::internal::ParameterProvider* parameter_provider)
+      : Link(handler, std::make_unique<MockAclConnection>(),
+             std::make_unique<l2cap::internal::testing::MockScheduler>(), parameter_provider, nullptr, nullptr){};
+  explicit MockLink(os::Handler* handler, l2cap::internal::ParameterProvider* parameter_provider,
+                    std::unique_ptr<hci::AclConnection> acl_connection,
+                    std::unique_ptr<l2cap::internal::Scheduler> scheduler)
+      : Link(handler, std::move(acl_connection), std::move(scheduler), parameter_provider, nullptr, nullptr){};
+  MOCK_METHOD(hci::Address, GetDevice, (), (override));
+  MOCK_METHOD(void, OnAclDisconnected, (hci::ErrorCode status), (override));
+  MOCK_METHOD(void, Disconnect, (), (override));
+  MOCK_METHOD(std::shared_ptr<FixedChannelImpl>, AllocateFixedChannel, (Cid cid, SecurityPolicy security_policy),
+              (override));
+  MOCK_METHOD(std::shared_ptr<DynamicChannelImpl>, AllocateDynamicChannel,
+              (Psm psm, Cid cid, SecurityPolicy security_policy), (override));
+  MOCK_METHOD(bool, IsFixedChannelAllocated, (Cid cid), (override));
+  MOCK_METHOD(void, RefreshRefCount, (), (override));
+};
+
+}  // namespace testing
+}  // namespace internal
+}  // namespace classic
+}  // namespace l2cap
+}  // namespace bluetooth
\ No newline at end of file
diff --git a/gd/l2cap/classic/internal/signalling_manager.cc b/gd/l2cap/classic/internal/signalling_manager.cc
new file mode 100644
index 0000000..8aa3d30
--- /dev/null
+++ b/gd/l2cap/classic/internal/signalling_manager.cc
@@ -0,0 +1,512 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "l2cap/classic/internal/signalling_manager.h"
+
+#include <chrono>
+
+#include "common/bind.h"
+#include "l2cap/classic/internal/link.h"
+#include "l2cap/l2cap_packets.h"
+#include "os/log.h"
+#include "packet/raw_builder.h"
+
+namespace bluetooth {
+namespace l2cap {
+namespace classic {
+namespace internal {
+static constexpr auto kTimeout = std::chrono::seconds(3);
+
+ClassicSignallingManager::ClassicSignallingManager(os::Handler* handler, Link* link,
+                                                   DynamicChannelServiceManagerImpl* dynamic_service_manager,
+                                                   DynamicChannelAllocator* channel_allocator,
+                                                   FixedChannelServiceManagerImpl* fixed_service_manager)
+    : handler_(handler), link_(link), dynamic_service_manager_(dynamic_service_manager),
+      channel_allocator_(channel_allocator), fixed_service_manager_(fixed_service_manager), alarm_(handler) {
+  ASSERT(handler_ != nullptr);
+  ASSERT(link_ != nullptr);
+  signalling_channel_ = link_->AllocateFixedChannel(kClassicSignallingCid, {});
+  signalling_channel_->GetQueueUpEnd()->RegisterDequeue(
+      handler_, common::Bind(&ClassicSignallingManager::on_incoming_packet, common::Unretained(this)));
+  enqueue_buffer_ =
+      std::make_unique<os::EnqueueBuffer<packet::BasePacketBuilder>>(signalling_channel_->GetQueueUpEnd());
+}
+
+ClassicSignallingManager::~ClassicSignallingManager() {
+  enqueue_buffer_.reset();
+  signalling_channel_->GetQueueUpEnd()->UnregisterDequeue();
+  signalling_channel_ = nullptr;
+}
+
+void ClassicSignallingManager::OnCommandReject(CommandRejectView command_reject_view) {
+  if (pending_commands_.empty()) {
+    LOG_WARN("Unexpected command reject: no pending request");
+    return;
+  }
+  auto last_sent_command = std::move(pending_commands_.front());
+  pending_commands_.pop();
+
+  SignalId signal_id = command_reject_view.GetIdentifier();
+  if (last_sent_command.signal_id_ != signal_id) {
+    LOG_WARN("Unknown command reject");
+    return;
+  }
+  handle_send_next_command();
+
+  LOG_INFO("Command rejected");
+}
+
+void ClassicSignallingManager::SendConnectionRequest(Psm psm, Cid local_cid) {
+  PendingCommand pending_command = {next_signal_id_, CommandCode::CONNECTION_REQUEST, psm, local_cid, {}, {}, {}};
+  next_signal_id_++;
+  pending_commands_.push(std::move(pending_command));
+  if (pending_commands_.size() == 1) {
+    handle_send_next_command();
+  }
+}
+
+void ClassicSignallingManager::SendConfigurationRequest(Cid remote_cid,
+                                                        std::vector<std::unique_ptr<ConfigurationOption>> config) {
+  PendingCommand pending_command = {next_signal_id_,  CommandCode::CONFIGURATION_REQUEST, {}, {}, remote_cid, {},
+                                    std::move(config)};
+  next_signal_id_++;
+  pending_commands_.push(std::move(pending_command));
+  if (pending_commands_.size() == 1) {
+    handle_send_next_command();
+  }
+}
+
+void ClassicSignallingManager::SendDisconnectionRequest(Cid local_cid, Cid remote_cid) {
+  PendingCommand pending_command = {
+      next_signal_id_, CommandCode::DISCONNECTION_REQUEST, {}, local_cid, remote_cid, {}, {}};
+  next_signal_id_++;
+  pending_commands_.push(std::move(pending_command));
+  if (pending_commands_.size() == 1) {
+    handle_send_next_command();
+  }
+}
+
+void ClassicSignallingManager::SendInformationRequest(InformationRequestInfoType type) {
+  PendingCommand pending_command = {next_signal_id_, CommandCode::INFORMATION_REQUEST, {}, {}, {}, type, {}};
+  next_signal_id_++;
+  pending_commands_.push(std::move(pending_command));
+  if (pending_commands_.size() == 1) {
+    handle_send_next_command();
+  }
+}
+
+void ClassicSignallingManager::SendEchoRequest(std::unique_ptr<packet::RawBuilder> payload) {
+  LOG_WARN("Not supported");
+}
+
+void ClassicSignallingManager::OnConnectionRequest(SignalId signal_id, Psm psm, Cid remote_cid) {
+  if (!IsPsmValid(psm)) {
+    LOG_WARN("Invalid psm received from remote psm:%d remote_cid:%d", psm, remote_cid);
+    send_connection_response(signal_id, remote_cid, kInvalidCid, ConnectionResponseResult::PSM_NOT_SUPPORTED,
+                             ConnectionResponseStatus::NO_FURTHER_INFORMATION_AVAILABLE);
+    return;
+  }
+
+  if (remote_cid == kInvalidCid) {
+    LOG_WARN("Invalid remote cid received from remote psm:%d remote_cid:%d", psm, remote_cid);
+    send_connection_response(signal_id, remote_cid, kInvalidCid, ConnectionResponseResult::INVALID_CID,
+                             ConnectionResponseStatus::NO_FURTHER_INFORMATION_AVAILABLE);
+    return;
+  }
+  if (channel_allocator_->IsPsmUsed(psm)) {
+    LOG_WARN("Psm already exists");
+    send_connection_response(signal_id, remote_cid, kInvalidCid, ConnectionResponseResult::PSM_NOT_SUPPORTED,
+                             ConnectionResponseStatus::NO_FURTHER_INFORMATION_AVAILABLE);
+    return;
+  }
+
+  if (!dynamic_service_manager_->IsServiceRegistered(psm)) {
+    LOG_INFO("Service for this psm (%d) is not registered", psm);
+    send_connection_response(signal_id, remote_cid, kInvalidCid, ConnectionResponseResult::PSM_NOT_SUPPORTED,
+                             ConnectionResponseStatus::NO_FURTHER_INFORMATION_AVAILABLE);
+    return;
+  }
+
+  auto new_channel = link_->AllocateDynamicChannel(psm, remote_cid, {});
+  if (new_channel == nullptr) {
+    LOG_WARN("Can't allocate dynamic channel");
+    return;
+  }
+  send_connection_response(signal_id, remote_cid, new_channel->GetCid(), ConnectionResponseResult::SUCCESS,
+                           ConnectionResponseStatus::NO_FURTHER_INFORMATION_AVAILABLE);
+  SendConfigurationRequest(remote_cid, {});
+}
+
+void ClassicSignallingManager::OnConnectionResponse(SignalId signal_id, Cid remote_cid, Cid cid,
+                                                    ConnectionResponseResult result, ConnectionResponseStatus status) {
+  if (pending_commands_.empty()) {
+    LOG_WARN("Unexpected response: no pending request");
+    return;
+  }
+  auto last_sent_command = std::move(pending_commands_.front());
+  pending_commands_.pop();
+  if (last_sent_command.signal_id_ != signal_id || last_sent_command.command_code_ != CommandCode::CONNECTION_REQUEST) {
+    LOG_WARN("Received unexpected connection response");
+    return;
+  }
+  if (last_sent_command.source_cid_ != cid) {
+    LOG_WARN("SCID doesn't match: expected %d, received %d", last_sent_command.source_cid_, cid);
+    handle_send_next_command();
+    return;
+  }
+  if (result != ConnectionResponseResult::SUCCESS) {
+    handle_send_next_command();
+    return;
+  }
+  Psm pending_psm = last_sent_command.psm_;
+  auto new_channel = link_->AllocateReservedDynamicChannel(cid, pending_psm, remote_cid, {});
+  if (new_channel == nullptr) {
+    LOG_WARN("Can't allocate dynamic channel");
+    handle_send_next_command();
+    return;
+  }
+  alarm_.Cancel();
+  SendConfigurationRequest(remote_cid, {});
+  handle_send_next_command();
+}
+
+void ClassicSignallingManager::OnConfigurationRequest(SignalId signal_id, Cid cid, Continuation is_continuation,
+                                                      std::vector<std::unique_ptr<ConfigurationOption>> option) {
+  auto channel = channel_allocator_->FindChannelByCid(cid);
+  if (channel == nullptr) {
+    LOG_WARN("Configuration request for an unknown channel");
+    return;
+  }
+  auto response = ConfigurationResponseBuilder::Create(signal_id.Value(), channel->GetRemoteCid(), is_continuation,
+                                                       ConfigurationResponseResult::SUCCESS, {});
+  enqueue_buffer_->Enqueue(std::move(response), handler_);
+  handle_send_next_command();
+  channel->SetIncomingConfigurationStatus(DynamicChannelImpl::ConfigurationStatus::CONFIGURED);
+  if (channel->GetOutgoingConfigurationStatus() == DynamicChannelImpl::ConfigurationStatus::CONFIGURED) {
+    std::unique_ptr<DynamicChannel> user_channel = std::make_unique<DynamicChannel>(channel, handler_);
+    dynamic_service_manager_->GetService(channel->GetPsm())->NotifyChannelCreation(std::move(user_channel));
+  }
+}
+
+void ClassicSignallingManager::OnConfigurationResponse(SignalId signal_id, Cid cid, Continuation is_continuation,
+                                                       ConfigurationResponseResult result,
+                                                       std::vector<std::unique_ptr<ConfigurationOption>> option) {
+  if (pending_commands_.empty()) {
+    LOG_WARN("Unexpected response: no pending request");
+    return;
+  }
+
+  auto last_sent_command = std::move(pending_commands_.front());
+  pending_commands_.pop();
+
+  auto channel = channel_allocator_->FindChannelByCid(cid);
+  if (channel == nullptr) {
+    LOG_WARN("Configuration request for an unknown channel");
+    handle_send_next_command();
+    return;
+  }
+  channel->SetOutgoingConfigurationStatus(DynamicChannelImpl::ConfigurationStatus::CONFIGURED);
+  if (channel->GetIncomingConfigurationStatus() == DynamicChannelImpl::ConfigurationStatus::CONFIGURED) {
+    std::unique_ptr<DynamicChannel> user_channel = std::make_unique<DynamicChannel>(channel, handler_);
+    dynamic_service_manager_->GetService(channel->GetPsm())->NotifyChannelCreation(std::move(user_channel));
+  }
+  alarm_.Cancel();
+  handle_send_next_command();
+}
+
+void ClassicSignallingManager::OnDisconnectionRequest(SignalId signal_id, Cid cid, Cid remote_cid) {
+  // TODO: check cid match
+  auto channel = channel_allocator_->FindChannelByCid(cid);
+  if (channel == nullptr) {
+    LOG_WARN("Disconnect request for an unknown channel");
+    return;
+  }
+  auto builder = DisconnectionResponseBuilder::Create(signal_id.Value(), cid, remote_cid);
+  enqueue_buffer_->Enqueue(std::move(builder), handler_);
+  channel->OnClosed(hci::ErrorCode::SUCCESS);
+  link_->FreeDynamicChannel(cid);
+  handle_send_next_command();
+}
+
+void ClassicSignallingManager::OnDisconnectionResponse(SignalId signal_id, Cid remote_cid, Cid cid) {
+  if (pending_commands_.empty()) {
+    LOG_WARN("Unexpected response: no pending request");
+    return;
+  }
+  auto last_sent_command = std::move(pending_commands_.front());
+  pending_commands_.pop();
+  alarm_.Cancel();
+
+  if (last_sent_command.signal_id_ != signal_id ||
+      last_sent_command.command_code_ != CommandCode::DISCONNECTION_REQUEST) {
+    return;
+  }
+
+  auto channel = channel_allocator_->FindChannelByCid(cid);
+  if (channel == nullptr) {
+    LOG_WARN("Disconnect response for an unknown channel");
+    handle_send_next_command();
+    return;
+  }
+
+  channel->OnClosed(hci::ErrorCode::SUCCESS);
+  link_->FreeDynamicChannel(cid);
+  handle_send_next_command();
+}
+
+void ClassicSignallingManager::OnEchoRequest(SignalId signal_id, const PacketView<kLittleEndian>& packet) {
+  std::vector<uint8_t> packet_vector{packet.begin(), packet.end()};
+  auto raw_builder = std::make_unique<packet::RawBuilder>();
+  raw_builder->AddOctets(packet_vector);
+  auto builder = EchoResponseBuilder::Create(signal_id.Value(), std::move(raw_builder));
+  enqueue_buffer_->Enqueue(std::move(builder), handler_);
+  handle_send_next_command();
+}
+
+void ClassicSignallingManager::OnEchoResponse(SignalId signal_id, const PacketView<kLittleEndian>& packet) {
+  if (pending_commands_.empty()) {
+    LOG_WARN("Unexpected response: no pending request");
+    return;
+  }
+  auto last_sent_command = std::move(pending_commands_.front());
+  pending_commands_.pop();
+
+  if (last_sent_command.signal_id_ != signal_id || last_sent_command.command_code_ != CommandCode::ECHO_REQUEST) {
+    return;
+  }
+  LOG_INFO("Echo response received");
+  alarm_.Cancel();
+  handle_send_next_command();
+}
+
+void ClassicSignallingManager::OnInformationRequest(SignalId signal_id, InformationRequestInfoType type) {
+  switch (type) {
+    case InformationRequestInfoType::CONNECTIONLESS_MTU: {
+      auto response = InformationResponseConnectionlessMtuBuilder::Create(signal_id.Value(),
+                                                                          InformationRequestResult::NOT_SUPPORTED, 0);
+      enqueue_buffer_->Enqueue(std::move(response), handler_);
+      break;
+    }
+    case InformationRequestInfoType::EXTENDED_FEATURES_SUPPORTED: {
+      // TODO: implement this response
+      auto response = InformationResponseExtendedFeaturesBuilder::Create(
+          signal_id.Value(), InformationRequestResult::NOT_SUPPORTED, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0);
+      enqueue_buffer_->Enqueue(std::move(response), handler_);
+      break;
+    }
+    case InformationRequestInfoType::FIXED_CHANNELS_SUPPORTED: {
+      auto response = InformationResponseFixedChannelsBuilder::Create(
+          signal_id.Value(), InformationRequestResult::SUCCESS, fixed_service_manager_->GetSupportedFixedChannelMask());
+      enqueue_buffer_->Enqueue(std::move(response), handler_);
+      break;
+    }
+  }
+}
+
+void ClassicSignallingManager::OnInformationResponse(SignalId signal_id, const InformationResponseView& view) {
+  if (pending_commands_.empty()) {
+    LOG_WARN("Unexpected response: no pending request");
+    return;
+  }
+  auto last_sent_command = std::move(pending_commands_.front());
+  pending_commands_.pop();
+
+  if (last_sent_command.signal_id_ != signal_id ||
+      last_sent_command.command_code_ != CommandCode::INFORMATION_REQUEST) {
+    return;
+  }
+  // TODO (hsz): Store the information response
+  alarm_.Cancel();
+  handle_send_next_command();
+}
+
+void ClassicSignallingManager::on_incoming_packet() {
+  auto packet = signalling_channel_->GetQueueUpEnd()->TryDequeue();
+  ControlView control_packet_view = ControlView::Create(*packet);
+  if (!control_packet_view.IsValid()) {
+    LOG_WARN("Invalid signalling packet received");
+    return;
+  }
+  auto code = control_packet_view.GetCode();
+  switch (code) {
+    case CommandCode::COMMAND_REJECT: {
+      CommandRejectView command_reject_view = CommandRejectView::Create(control_packet_view);
+      if (!command_reject_view.IsValid()) {
+        return;
+      }
+      OnCommandReject(command_reject_view);
+      return;
+    }
+    case CommandCode::CONNECTION_REQUEST: {
+      ConnectionRequestView connection_request_view = ConnectionRequestView::Create(control_packet_view);
+      if (!connection_request_view.IsValid()) {
+        return;
+      }
+      OnConnectionRequest(control_packet_view.GetIdentifier(), connection_request_view.GetPsm(),
+                          connection_request_view.GetSourceCid());
+      return;
+    }
+    case CommandCode::CONNECTION_RESPONSE: {
+      ConnectionResponseView connection_response_view = ConnectionResponseView::Create(control_packet_view);
+      if (!connection_response_view.IsValid()) {
+        return;
+      }
+      OnConnectionResponse(connection_response_view.GetIdentifier(), connection_response_view.GetDestinationCid(),
+                           connection_response_view.GetSourceCid(), connection_response_view.GetResult(),
+                           connection_response_view.GetStatus());
+      return;
+    }
+    case CommandCode::CONFIGURATION_REQUEST: {
+      ConfigurationRequestView configuration_request_view = ConfigurationRequestView::Create(control_packet_view);
+      if (!configuration_request_view.IsValid()) {
+        return;
+      }
+      OnConfigurationRequest(configuration_request_view.GetIdentifier(), configuration_request_view.GetDestinationCid(),
+                             configuration_request_view.GetContinuation(), configuration_request_view.GetConfig());
+      return;
+    }
+    case CommandCode::CONFIGURATION_RESPONSE: {
+      ConfigurationResponseView configuration_response_view = ConfigurationResponseView::Create(control_packet_view);
+      if (!configuration_response_view.IsValid()) {
+        return;
+      }
+      OnConfigurationResponse(configuration_response_view.GetIdentifier(), configuration_response_view.GetSourceCid(),
+                              configuration_response_view.GetContinuation(), configuration_response_view.GetResult(),
+                              configuration_response_view.GetConfig());
+      return;
+    }
+    case CommandCode::DISCONNECTION_REQUEST: {
+      DisconnectionRequestView disconnection_request_view = DisconnectionRequestView::Create(control_packet_view);
+      if (!disconnection_request_view.IsValid()) {
+        return;
+      }
+      OnDisconnectionRequest(disconnection_request_view.GetIdentifier(), disconnection_request_view.GetDestinationCid(),
+                             disconnection_request_view.GetSourceCid());
+      return;
+    }
+    case CommandCode::DISCONNECTION_RESPONSE: {
+      DisconnectionResponseView disconnection_response_view = DisconnectionResponseView::Create(control_packet_view);
+      if (!disconnection_response_view.IsValid()) {
+        return;
+      }
+      OnDisconnectionResponse(disconnection_response_view.GetIdentifier(),
+                              disconnection_response_view.GetDestinationCid(),
+                              disconnection_response_view.GetSourceCid());
+      return;
+    }
+    case CommandCode::ECHO_REQUEST: {
+      EchoRequestView echo_request_view = EchoRequestView::Create(control_packet_view);
+      if (!echo_request_view.IsValid()) {
+        return;
+      }
+      OnEchoRequest(echo_request_view.GetIdentifier(), echo_request_view.GetPayload());
+      return;
+    }
+    case CommandCode::ECHO_RESPONSE: {
+      EchoResponseView echo_response_view = EchoResponseView::Create(control_packet_view);
+      if (!echo_response_view.IsValid()) {
+        return;
+      }
+      OnEchoResponse(echo_response_view.GetIdentifier(), echo_response_view.GetPayload());
+      return;
+    }
+    case CommandCode::INFORMATION_REQUEST: {
+      InformationRequestView information_request_view = InformationRequestView::Create(control_packet_view);
+      if (!information_request_view.IsValid()) {
+        return;
+      }
+      OnInformationRequest(information_request_view.GetIdentifier(), information_request_view.GetInfoType());
+      return;
+    }
+    case CommandCode::INFORMATION_RESPONSE: {
+      InformationResponseView information_response_view = InformationResponseView::Create(control_packet_view);
+      if (!information_response_view.IsValid()) {
+        return;
+      }
+      OnInformationResponse(information_response_view.GetIdentifier(), information_response_view);
+      return;
+    }
+    default:
+      LOG_WARN("Unhandled event 0x%x", static_cast<int>(code));
+      auto builder = CommandRejectNotUnderstoodBuilder::Create(control_packet_view.GetIdentifier());
+      enqueue_buffer_->Enqueue(std::move(builder), handler_);
+      return;
+  }
+}
+
+void ClassicSignallingManager::send_connection_response(SignalId signal_id, Cid remote_cid, Cid local_cid,
+                                                        ConnectionResponseResult result,
+                                                        ConnectionResponseStatus status) {
+  auto builder = ConnectionResponseBuilder::Create(signal_id.Value(), local_cid, remote_cid, result, status);
+  enqueue_buffer_->Enqueue(std::move(builder), handler_);
+}
+
+void ClassicSignallingManager::on_command_timeout() {
+  LOG_WARN("Response time out");
+  link_->OnAclDisconnected(hci::ErrorCode::SUCCESS);
+}
+
+void ClassicSignallingManager::handle_send_next_command() {
+  if (pending_commands_.empty()) {
+    return;
+  }
+  auto& last_sent_command = pending_commands_.front();
+
+  auto signal_id = last_sent_command.signal_id_;
+  auto psm = last_sent_command.psm_;
+  auto source_cid = last_sent_command.source_cid_;
+  auto destination_cid = last_sent_command.destination_cid_;
+  auto info_type = last_sent_command.info_type_;
+  auto config = std::move(last_sent_command.config_);
+  switch (last_sent_command.command_code_) {
+    case CommandCode::CONNECTION_REQUEST: {
+      auto builder = ConnectionRequestBuilder::Create(signal_id.Value(), psm, source_cid);
+      enqueue_buffer_->Enqueue(std::move(builder), handler_);
+      alarm_.Schedule(common::BindOnce(&ClassicSignallingManager::on_command_timeout, common::Unretained(this)),
+                      kTimeout);
+      break;
+    }
+    case CommandCode::CONFIGURATION_REQUEST: {
+      auto builder =
+          ConfigurationRequestBuilder::Create(signal_id.Value(), destination_cid, Continuation::END, std::move(config));
+      enqueue_buffer_->Enqueue(std::move(builder), handler_);
+      alarm_.Schedule(common::BindOnce(&ClassicSignallingManager::on_command_timeout, common::Unretained(this)),
+                      kTimeout);
+      break;
+    }
+    case CommandCode::DISCONNECTION_REQUEST: {
+      auto builder = DisconnectionRequestBuilder::Create(signal_id.Value(), destination_cid, source_cid);
+      enqueue_buffer_->Enqueue(std::move(builder), handler_);
+      alarm_.Schedule(common::BindOnce(&ClassicSignallingManager::on_command_timeout, common::Unretained(this)),
+                      kTimeout);
+      break;
+    }
+    case CommandCode::INFORMATION_REQUEST: {
+      auto builder = InformationRequestBuilder::Create(signal_id.Value(), info_type);
+      enqueue_buffer_->Enqueue(std::move(builder), handler_);
+      alarm_.Schedule(common::BindOnce(&ClassicSignallingManager::on_command_timeout, common::Unretained(this)),
+                      kTimeout);
+      break;
+    }
+    default:
+      LOG_WARN("Unsupported command code 0x%x", static_cast<int>(last_sent_command.command_code_));
+  }
+}
+
+}  // namespace internal
+}  // namespace classic
+}  // namespace l2cap
+}  // namespace bluetooth
diff --git a/gd/l2cap/classic/internal/signalling_manager.h b/gd/l2cap/classic/internal/signalling_manager.h
new file mode 100644
index 0000000..0ec6a28
--- /dev/null
+++ b/gd/l2cap/classic/internal/signalling_manager.h
@@ -0,0 +1,120 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#pragma once
+
+#include <cstdint>
+#include <queue>
+#include <vector>
+
+#include "l2cap/cid.h"
+#include "l2cap/classic/internal/dynamic_channel_allocator.h"
+#include "l2cap/classic/internal/dynamic_channel_service_manager_impl.h"
+#include "l2cap/classic/internal/fixed_channel_impl.h"
+#include "l2cap/classic/internal/fixed_channel_service_manager_impl.h"
+#include "l2cap/l2cap_packets.h"
+#include "l2cap/psm.h"
+#include "l2cap/signal_id.h"
+#include "os/alarm.h"
+#include "os/handler.h"
+#include "os/queue.h"
+#include "packet/raw_builder.h"
+
+namespace bluetooth {
+namespace l2cap {
+namespace classic {
+namespace internal {
+
+struct PendingCommand {
+  SignalId signal_id_;
+  CommandCode command_code_;
+  Psm psm_;
+  Cid source_cid_;
+  Cid destination_cid_;
+  InformationRequestInfoType info_type_;
+  std::vector<std::unique_ptr<ConfigurationOption>> config_;
+};
+
+class Link;
+
+class ClassicSignallingManager {
+ public:
+  ClassicSignallingManager(os::Handler* handler, Link* link,
+                           classic::internal::DynamicChannelServiceManagerImpl* dynamic_service_manager,
+                           classic::internal::DynamicChannelAllocator* channel_allocator,
+                           classic::internal::FixedChannelServiceManagerImpl* fixed_service_manager);
+
+  virtual ~ClassicSignallingManager();
+
+  void OnCommandReject(CommandRejectView command_reject_view);
+
+  void SendConnectionRequest(Psm psm, Cid local_cid);
+
+  void SendConfigurationRequest(Cid remote_cid, std::vector<std::unique_ptr<ConfigurationOption>> config);
+
+  void SendDisconnectionRequest(Cid local_cid, Cid remote_cid);
+
+  void SendInformationRequest(InformationRequestInfoType type);
+
+  void SendEchoRequest(std::unique_ptr<packet::RawBuilder> payload);
+
+  void OnConnectionRequest(SignalId signal_id, Psm psm, Cid remote_cid);
+
+  void OnConnectionResponse(SignalId signal_id, Cid remote_cid, Cid cid, ConnectionResponseResult result,
+                            ConnectionResponseStatus status);
+
+  void OnDisconnectionRequest(SignalId signal_id, Cid cid, Cid remote_cid);
+
+  void OnDisconnectionResponse(SignalId signal_id, Cid cid, Cid remote_cid);
+
+  void OnConfigurationRequest(SignalId signal_id, Cid cid, Continuation is_continuation,
+                              std::vector<std::unique_ptr<ConfigurationOption>>);
+
+  void OnConfigurationResponse(SignalId signal_id, Cid cid, Continuation is_continuation,
+                               ConfigurationResponseResult result, std::vector<std::unique_ptr<ConfigurationOption>>);
+
+  void OnEchoRequest(SignalId signal_id, const PacketView<kLittleEndian>& packet);
+
+  void OnEchoResponse(SignalId signal_id, const PacketView<kLittleEndian>& packet);
+
+  void OnInformationRequest(SignalId signal_id, InformationRequestInfoType type);
+
+  void OnInformationResponse(SignalId signal_id, const InformationResponseView& view);
+
+ private:
+  void on_incoming_packet();
+  void send_connection_response(SignalId signal_id, Cid remote_cid, Cid local_cid, ConnectionResponseResult result,
+                                ConnectionResponseStatus status);
+  void on_command_timeout();
+  void handle_send_next_command();
+
+  os::Handler* handler_;
+  Link* link_;
+  std::shared_ptr<classic::internal::FixedChannelImpl> signalling_channel_;
+  DynamicChannelServiceManagerImpl* dynamic_service_manager_;
+  DynamicChannelAllocator* channel_allocator_;
+  FixedChannelServiceManagerImpl* fixed_service_manager_;
+  std::unique_ptr<os::EnqueueBuffer<packet::BasePacketBuilder>> enqueue_buffer_;
+  PendingCommand last_sent_command_;
+  std::queue<PendingCommand> pending_commands_;
+  os::Alarm alarm_;
+  SignalId next_signal_id_ = kInitialSignalId;
+};
+
+}  // namespace internal
+}  // namespace classic
+}  // namespace l2cap
+}  // namespace bluetooth
diff --git a/gd/l2cap/classic/internal/signalling_manager_test.cc b/gd/l2cap/classic/internal/signalling_manager_test.cc
new file mode 100644
index 0000000..82aeca8
--- /dev/null
+++ b/gd/l2cap/classic/internal/signalling_manager_test.cc
@@ -0,0 +1,96 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "l2cap/classic/internal/signalling_manager.h"
+
+#include "l2cap/classic/internal/dynamic_channel_service_manager_impl_mock.h"
+#include "l2cap/classic/internal/fixed_channel_service_manager_impl_mock.h"
+#include "l2cap/classic/internal/link_mock.h"
+#include "l2cap/internal/parameter_provider_mock.h"
+
+#include <gmock/gmock.h>
+#include <gtest/gtest.h>
+
+using ::testing::_;
+using ::testing::Return;
+
+namespace bluetooth {
+namespace l2cap {
+namespace classic {
+namespace internal {
+namespace {
+
+class L2capClassicSignallingManagerTest : public ::testing::Test {
+ public:
+  static void SyncHandler(os::Handler* handler) {
+    std::promise<void> promise;
+    auto future = promise.get_future();
+    handler->Post(common::BindOnce(&std::promise<void>::set_value, common::Unretained(&promise)));
+    future.wait_for(std::chrono::milliseconds(3));
+  }
+
+ protected:
+  void SetUp() override {
+    thread_ = new os::Thread("test_thread", os::Thread::Priority::NORMAL);
+    l2cap_handler_ = new os::Handler(thread_);
+  }
+
+  void TearDown() override {
+    l2cap_handler_->Clear();
+    delete l2cap_handler_;
+    delete thread_;
+  }
+
+  os::Thread* thread_ = nullptr;
+  os::Handler* l2cap_handler_ = nullptr;
+};
+
+PacketView<kLittleEndian> GetPacketView(std::unique_ptr<packet::BasePacketBuilder> packet) {
+  auto bytes = std::make_shared<std::vector<uint8_t>>();
+  BitInserter i(*bytes);
+  bytes->reserve(packet->size());
+  packet->Serialize(i);
+  return packet::PacketView<packet::kLittleEndian>(bytes);
+}
+
+TEST_F(L2capClassicSignallingManagerTest, handle_connection_request) {
+  l2cap::internal::testing::MockParameterProvider parameter_provider;
+  testing::MockDynamicChannelServiceManagerImpl dynamic_service_manager_;
+  testing::MockFixedChannelServiceManagerImpl fixed_service_manager_;
+  testing::MockLink link{l2cap_handler_, &parameter_provider};
+  std::shared_ptr<FixedChannelImpl> signalling_channel = std::make_shared<FixedChannelImpl>(1, &link, l2cap_handler_);
+  EXPECT_CALL(link, AllocateFixedChannel(_, _)).WillRepeatedly(Return(signalling_channel));
+  auto service_psm = 0x1;
+  EXPECT_CALL(dynamic_service_manager_, IsServiceRegistered(service_psm)).WillRepeatedly(Return(true));
+  DynamicChannelAllocator channel_allocator{&link, l2cap_handler_};
+  ClassicSignallingManager signalling_manager{l2cap_handler_, &link, &dynamic_service_manager_, &channel_allocator,
+                                              &fixed_service_manager_};
+  auto* down_end = signalling_channel->GetQueueDownEnd();
+  os::EnqueueBuffer<packet::PacketView<kLittleEndian>> enqueue_buffer{down_end};
+  auto dcid = 0x101;
+  auto builder = ConnectionRequestBuilder::Create(1, service_psm, dcid);
+  enqueue_buffer.Enqueue(std::make_unique<PacketView<kLittleEndian>>(GetPacketView(std::move(builder))),
+                         l2cap_handler_);
+  SyncHandler(l2cap_handler_);
+  EXPECT_CALL(link, AllocateDynamicChannel(_, dcid, _));
+  SyncHandler(l2cap_handler_);
+}
+
+}  // namespace
+}  // namespace internal
+}  // namespace classic
+}  // namespace l2cap
+}  // namespace bluetooth
diff --git a/gd/l2cap/classic/l2cap_classic_module.cc b/gd/l2cap/classic/l2cap_classic_module.cc
new file mode 100644
index 0000000..f248ebe
--- /dev/null
+++ b/gd/l2cap/classic/l2cap_classic_module.cc
@@ -0,0 +1,77 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+#define LOG_TAG "l2cap2"
+
+#include <memory>
+
+#include "common/bidi_queue.h"
+#include "hci/acl_manager.h"
+#include "hci/address.h"
+#include "hci/hci_layer.h"
+#include "hci/hci_packets.h"
+#include "l2cap/classic/internal/dynamic_channel_service_manager_impl.h"
+#include "l2cap/classic/internal/fixed_channel_service_manager_impl.h"
+#include "l2cap/classic/internal/link_manager.h"
+#include "l2cap/internal/parameter_provider.h"
+#include "module.h"
+#include "os/handler.h"
+#include "os/log.h"
+
+#include "l2cap/classic/l2cap_classic_module.h"
+
+namespace bluetooth {
+namespace l2cap {
+namespace classic {
+
+const ModuleFactory L2capClassicModule::Factory = ModuleFactory([]() { return new L2capClassicModule(); });
+
+struct L2capClassicModule::impl {
+  impl(os::Handler* l2cap_handler, hci::AclManager* acl_manager)
+      : l2cap_handler_(l2cap_handler), acl_manager_(acl_manager) {}
+  os::Handler* l2cap_handler_;
+  hci::AclManager* acl_manager_;
+  l2cap::internal::ParameterProvider parameter_provider_;
+  internal::FixedChannelServiceManagerImpl fixed_channel_service_manager_impl_{l2cap_handler_};
+  internal::DynamicChannelServiceManagerImpl dynamic_channel_service_manager_impl_{l2cap_handler_};
+  internal::LinkManager link_manager_{l2cap_handler_, acl_manager_, &fixed_channel_service_manager_impl_,
+                                      &dynamic_channel_service_manager_impl_, &parameter_provider_};
+};
+
+void L2capClassicModule::ListDependencies(ModuleList* list) {
+  list->add<hci::AclManager>();
+}
+
+void L2capClassicModule::Start() {
+  pimpl_ = std::make_unique<impl>(GetHandler(), GetDependency<hci::AclManager>());
+}
+
+void L2capClassicModule::Stop() {
+  pimpl_.reset();
+}
+
+std::unique_ptr<FixedChannelManager> L2capClassicModule::GetFixedChannelManager() {
+  return std::unique_ptr<FixedChannelManager>(new FixedChannelManager(&pimpl_->fixed_channel_service_manager_impl_,
+                                                                      &pimpl_->link_manager_, pimpl_->l2cap_handler_));
+}
+
+std::unique_ptr<DynamicChannelManager> L2capClassicModule::GetDynamicChannelManager() {
+  return std::unique_ptr<DynamicChannelManager>(new DynamicChannelManager(
+      &pimpl_->dynamic_channel_service_manager_impl_, &pimpl_->link_manager_, pimpl_->l2cap_handler_));
+}
+
+}  // namespace classic
+}  // namespace l2cap
+}  // namespace bluetooth
\ No newline at end of file
diff --git a/gd/l2cap/classic/l2cap_classic_module.h b/gd/l2cap/classic/l2cap_classic_module.h
new file mode 100644
index 0000000..ef4b771
--- /dev/null
+++ b/gd/l2cap/classic/l2cap_classic_module.h
@@ -0,0 +1,60 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+#pragma once
+
+#include <memory>
+
+#include "l2cap/classic/dynamic_channel_manager.h"
+#include "l2cap/classic/fixed_channel_manager.h"
+#include "module.h"
+
+namespace bluetooth {
+namespace l2cap {
+namespace classic {
+
+class L2capClassicModule : public bluetooth::Module {
+ public:
+  L2capClassicModule() = default;
+  ~L2capClassicModule() = default;
+
+  /**
+   * Get the api to the classic fixed channel l2cap module
+   */
+  std::unique_ptr<FixedChannelManager> GetFixedChannelManager();
+
+  /**
+   * Get the api to the classic dynamic channel l2cap module
+   */
+  std::unique_ptr<DynamicChannelManager> GetDynamicChannelManager();
+
+  static const ModuleFactory Factory;
+
+ protected:
+  void ListDependencies(ModuleList* list) override;
+
+  void Start() override;
+
+  void Stop() override;
+
+ private:
+  struct impl;
+  std::unique_ptr<impl> pimpl_;
+  DISALLOW_COPY_AND_ASSIGN(L2capClassicModule);
+};
+
+}  // namespace classic
+}  // namespace l2cap
+}  // namespace bluetooth
\ No newline at end of file
diff --git a/gd/l2cap/fcs.cc b/gd/l2cap/fcs.cc
index 380ff66..3ad78cc 100644
--- a/gd/l2cap/fcs.cc
+++ b/gd/l2cap/fcs.cc
@@ -44,16 +44,16 @@
 namespace bluetooth {
 namespace l2cap {
 
-void Fcs::Initialize(Fcs& s) {
-  s.crc = 0;
+void Fcs::Initialize() {
+  crc = 0;
 }
 
-void Fcs::AddByte(Fcs& s, uint8_t byte) {
-  s.crc = ((s.crc >> 8) & 0x00ff) ^ crctab[(s.crc & 0x00ff) ^ byte];
+void Fcs::AddByte(uint8_t byte) {
+  crc = ((crc >> 8) & 0x00ff) ^ crctab[(crc & 0x00ff) ^ byte];
 }
 
-uint16_t Fcs::GetChecksum(const Fcs& s) {
-  return s.crc;
+uint16_t Fcs::GetChecksum() const {
+  return crc;
 }
 
 }  // namespace l2cap
diff --git a/gd/l2cap/fcs.h b/gd/l2cap/fcs.h
index 42dd7dc..127fa9d 100644
--- a/gd/l2cap/fcs.h
+++ b/gd/l2cap/fcs.h
@@ -24,11 +24,11 @@
 // Frame Check Sequence from the L2CAP spec.
 class Fcs {
  public:
-  static void Initialize(Fcs& s);
+  void Initialize();
 
-  static void AddByte(Fcs& s, uint8_t byte);
+  void AddByte(uint8_t byte);
 
-  static uint16_t GetChecksum(const Fcs& s);
+  uint16_t GetChecksum() const;
 
  private:
   uint16_t crc;
diff --git a/gd/l2cap/internal/fixed_channel_allocator.h b/gd/l2cap/internal/fixed_channel_allocator.h
new file mode 100644
index 0000000..a421c91
--- /dev/null
+++ b/gd/l2cap/internal/fixed_channel_allocator.h
@@ -0,0 +1,102 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#pragma once
+
+#include <type_traits>
+#include <unordered_map>
+
+#include "hci/hci_packets.h"
+#include "l2cap/cid.h"
+#include "l2cap/security_policy.h"
+#include "os/handler.h"
+#include "os/log.h"
+
+namespace bluetooth {
+namespace l2cap {
+namespace internal {
+
+// Helper class for keeping channels in a Link. It allocates and frees Channel object, and supports querying whether a
+// channel is in use
+template <typename FixedChannelImplType, typename LinkType>
+class FixedChannelAllocator {
+ public:
+  FixedChannelAllocator(LinkType* link, os::Handler* l2cap_handler) : link_(link), l2cap_handler_(l2cap_handler) {
+    ASSERT(link_ != nullptr);
+    ASSERT(l2cap_handler_ != nullptr);
+  }
+
+  virtual ~FixedChannelAllocator() = default;
+
+  // Allocates a channel. If cid is used, return nullptr. NOTE: The returned BaseFixedChannelImpl object is still
+  // owned by the channel allocator, NOT the client.
+  virtual std::shared_ptr<FixedChannelImplType> AllocateChannel(Cid cid, SecurityPolicy security_policy) {
+    ASSERT_LOG(!IsChannelAllocated((cid)), "Cid 0x%x for device %s is already in use", cid,
+               link_->GetDevice().ToString().c_str());
+    ASSERT_LOG(cid >= kFirstFixedChannel && cid <= kLastFixedChannel, "Cid %d out of bound", cid);
+    auto elem = channels_.try_emplace(cid, std::make_shared<FixedChannelImplType>(cid, link_, l2cap_handler_));
+    ASSERT_LOG(elem.second, "Failed to create channel for cid 0x%x device %s", cid,
+               link_->GetDevice().ToString().c_str());
+    ASSERT(elem.first->second != nullptr);
+    return elem.first->second;
+  }
+
+  // Frees a channel. If cid doesn't exist, it will crash
+  virtual void FreeChannel(Cid cid) {
+    ASSERT_LOG(IsChannelAllocated(cid), "Channel is not in use: cid %d, device %s", cid,
+               link_->GetDevice().ToString().c_str());
+    channels_.erase(cid);
+  }
+
+  virtual bool IsChannelAllocated(Cid cid) const {
+    return channels_.find(cid) != channels_.end();
+  }
+
+  virtual std::shared_ptr<FixedChannelImplType> FindChannel(Cid cid) {
+    ASSERT_LOG(IsChannelAllocated(cid), "Channel is not in use: cid %d, device %s", cid,
+               link_->GetDevice().ToString().c_str());
+    return channels_.find(cid)->second;
+  }
+
+  virtual size_t NumberOfChannels() const {
+    return channels_.size();
+  }
+
+  virtual void OnAclDisconnected(hci::ErrorCode hci_status) {
+    for (auto& elem : channels_) {
+      elem.second->OnClosed(hci_status);
+    }
+  }
+
+  virtual int GetRefCount() {
+    int ref_count = 0;
+    for (auto& elem : channels_) {
+      if (elem.second->IsAcquired()) {
+        ref_count++;
+      }
+    }
+    return ref_count;
+  }
+
+ private:
+  LinkType* link_;
+  os::Handler* l2cap_handler_;
+  std::unordered_map<Cid, std::shared_ptr<FixedChannelImplType>> channels_;
+};
+
+}  // namespace internal
+}  // namespace l2cap
+}  // namespace bluetooth
diff --git a/gd/l2cap/internal/fixed_channel_allocator_test.cc b/gd/l2cap/internal/fixed_channel_allocator_test.cc
new file mode 100644
index 0000000..2162d36
--- /dev/null
+++ b/gd/l2cap/internal/fixed_channel_allocator_test.cc
@@ -0,0 +1,81 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "l2cap/internal/fixed_channel_allocator.h"
+#include "l2cap/classic/internal/fixed_channel_impl_mock.h"
+#include "l2cap/classic/internal/link_mock.h"
+#include "l2cap/internal/parameter_provider_mock.h"
+
+#include <gmock/gmock.h>
+#include <gtest/gtest.h>
+
+namespace bluetooth {
+namespace l2cap {
+namespace internal {
+
+using l2cap::classic::internal::testing::MockFixedChannelImpl;
+using l2cap::classic::internal::testing::MockLink;
+using testing::MockParameterProvider;
+using ::testing::Return;
+
+const hci::Address device{{0x01, 0x02, 0x03, 0x04, 0x05, 0x06}};
+
+class L2capFixedChannelAllocatorTest : public ::testing::Test {
+ protected:
+  void SetUp() override {
+    thread_ = new os::Thread("test_thread", os::Thread::Priority::NORMAL);
+    handler_ = new os::Handler(thread_);
+    mock_parameter_provider_ = new MockParameterProvider();
+    mock_classic_link_ = new MockLink(handler_, mock_parameter_provider_);
+    EXPECT_CALL(*mock_classic_link_, GetDevice()).WillRepeatedly(Return(device));
+    // Use classic as a place holder
+    channel_allocator_ =
+        std::make_unique<FixedChannelAllocator<MockFixedChannelImpl, MockLink>>(mock_classic_link_, handler_);
+  }
+
+  void TearDown() override {
+    channel_allocator_.reset();
+    delete mock_classic_link_;
+    delete mock_parameter_provider_;
+    handler_->Clear();
+    delete handler_;
+    delete thread_;
+  }
+
+  os::Thread* thread_{nullptr};
+  os::Handler* handler_{nullptr};
+  MockParameterProvider* mock_parameter_provider_{nullptr};
+  MockLink* mock_classic_link_{nullptr};
+  std::unique_ptr<FixedChannelAllocator<MockFixedChannelImpl, MockLink>> channel_allocator_;
+};
+
+TEST_F(L2capFixedChannelAllocatorTest, precondition) {
+  Cid cid = kFirstFixedChannel;
+  EXPECT_FALSE(channel_allocator_->IsChannelAllocated(cid));
+}
+
+TEST_F(L2capFixedChannelAllocatorTest, allocate_and_free_channel) {
+  Cid cid = kFirstFixedChannel;
+  auto channel = channel_allocator_->AllocateChannel(cid, {});
+  EXPECT_TRUE(channel_allocator_->IsChannelAllocated(cid));
+  EXPECT_EQ(channel, channel_allocator_->FindChannel(cid));
+  ASSERT_NO_FATAL_FAILURE(channel_allocator_->FreeChannel(cid));
+  EXPECT_FALSE(channel_allocator_->IsChannelAllocated(cid));
+}
+
+}  // namespace internal
+}  // namespace l2cap
+}  // namespace bluetooth
diff --git a/gd/l2cap/internal/parameter_provider.h b/gd/l2cap/internal/parameter_provider.h
new file mode 100644
index 0000000..e1db944
--- /dev/null
+++ b/gd/l2cap/internal/parameter_provider.h
@@ -0,0 +1,43 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#pragma once
+
+#include <chrono>
+
+namespace bluetooth {
+namespace l2cap {
+namespace internal {
+
+/**
+ * A class that provide constant parameters to the L2CAP stack
+ *
+ * All methods are virtual so that they can be override in unit tests
+ */
+class ParameterProvider {
+ public:
+  virtual ~ParameterProvider() = default;
+  virtual std::chrono::milliseconds GetClassicLinkIdleDisconnectTimeout() {
+    return std::chrono::seconds(20);
+  }
+  virtual std::chrono::milliseconds GetLeLinkIdleDisconnectTimeout() {
+    return std::chrono::seconds(20);
+  }
+};
+
+}  // namespace internal
+}  // namespace l2cap
+}  // namespace bluetooth
diff --git a/gd/l2cap/internal/parameter_provider_mock.h b/gd/l2cap/internal/parameter_provider_mock.h
new file mode 100644
index 0000000..823cf8a
--- /dev/null
+++ b/gd/l2cap/internal/parameter_provider_mock.h
@@ -0,0 +1,37 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+#pragma once
+
+#include "l2cap/internal/parameter_provider.h"
+
+#include <gmock/gmock.h>
+
+// Unit test interfaces
+namespace bluetooth {
+namespace l2cap {
+namespace internal {
+namespace testing {
+
+class MockParameterProvider : public ParameterProvider {
+ public:
+  MOCK_METHOD(std::chrono::milliseconds, GetClassicLinkIdleDisconnectTimeout, (), (override));
+  MOCK_METHOD(std::chrono::milliseconds, GetLeLinkIdleDisconnectTimeout, (), (override));
+};
+
+}  // namespace testing
+}  // namespace internal
+}  // namespace l2cap
+}  // namespace bluetooth
\ No newline at end of file
diff --git a/gd/l2cap/internal/scheduler.h b/gd/l2cap/internal/scheduler.h
new file mode 100644
index 0000000..32d00cf
--- /dev/null
+++ b/gd/l2cap/internal/scheduler.h
@@ -0,0 +1,72 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#pragma once
+
+#include "common/bidi_queue.h"
+#include "l2cap/cid.h"
+#include "l2cap/l2cap_packets.h"
+#include "packet/base_packet_builder.h"
+#include "packet/packet_view.h"
+
+namespace bluetooth {
+namespace l2cap {
+namespace internal {
+
+/**
+ * Handle the scheduling of packets through the l2cap stack.
+ * For each attached channel, dequeue its outgoing packets and enqueue it to the given LinkQueueUpEnd, according to some
+ * policy (cid). Dequeue incoming packets from LinkQueueUpEnd, and enqueue it to ChannelQueueDownEnd. Note: If a channel
+ * cannot dequeue from ChannelQueueDownEnd so that the buffer for incoming packet is full, further incoming packets will
+ * be dropped.
+ */
+class Scheduler {
+ public:
+  using UpperEnqueue = packet::PacketView<packet::kLittleEndian>;
+  using UpperDequeue = packet::BasePacketBuilder;
+  using UpperQueueDownEnd = common::BidiQueueEnd<UpperEnqueue, UpperDequeue>;
+  using LowerEnqueue = UpperDequeue;
+  using LowerDequeue = UpperEnqueue;
+  using LowerQueueUpEnd = common::BidiQueueEnd<LowerEnqueue, LowerDequeue>;
+  using DemuxPolicy = common::Callback<Cid(const UpperEnqueue&)>;
+
+  /**
+   * Attach the channel with the specified ChannelQueueDownEnd into the scheduler.
+   *
+   * @param cid The channel to attach to the scheduler.
+   * @param channel_down_end The ChannelQueueDownEnd associated with the channel to attach to the scheduler.
+   * @param remote_cid The destination endpoint of the packet.
+   */
+  virtual void AttachChannel(Cid cid, UpperQueueDownEnd* channel_down_end, Cid remote_cid) {}
+
+  /**
+   * Detach the channel from the scheduler.
+   *
+   * @param cid The channel to detach to the scheduler.
+   */
+  virtual void DetachChannel(Cid cid) {}
+
+  /**
+   * Return the lower queue up end, which can be used to enqueue or dequeue.
+   */
+  virtual LowerQueueUpEnd* GetLowerQueueUpEnd() const = 0;
+
+  virtual ~Scheduler() = default;
+};
+
+}  // namespace internal
+}  // namespace l2cap
+}  // namespace bluetooth
diff --git a/gd/l2cap/internal/scheduler_fifo.cc b/gd/l2cap/internal/scheduler_fifo.cc
new file mode 100644
index 0000000..2e26779
--- /dev/null
+++ b/gd/l2cap/internal/scheduler_fifo.cc
@@ -0,0 +1,117 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "l2cap/internal/scheduler_fifo.h"
+#include "l2cap/l2cap_packets.h"
+#include "os/log.h"
+
+namespace bluetooth {
+namespace l2cap {
+namespace internal {
+
+Fifo::~Fifo() {
+  channel_queue_end_map_.clear();
+  link_queue_up_end_->UnregisterDequeue();
+  if (link_queue_enqueue_registered_) {
+    link_queue_up_end_->UnregisterEnqueue();
+  }
+}
+
+void Fifo::AttachChannel(Cid cid, UpperQueueDownEnd* channel_down_end, Cid remote_cid) {
+  ASSERT(channel_queue_end_map_.find(cid) == channel_queue_end_map_.end());
+  channel_queue_end_map_.emplace(std::piecewise_construct, std::forward_as_tuple(cid),
+                                 std::forward_as_tuple(handler_, channel_down_end, this, cid, remote_cid));
+}
+
+void Fifo::DetachChannel(Cid cid) {
+  ASSERT(channel_queue_end_map_.find(cid) != channel_queue_end_map_.end());
+  channel_queue_end_map_.erase(cid);
+}
+
+std::unique_ptr<Fifo::UpperDequeue> Fifo::link_queue_enqueue_callback() {
+  ASSERT(!next_to_dequeue_.empty());
+  auto channel_id = next_to_dequeue_.front();
+  next_to_dequeue_.pop();
+  auto& dequeue_buffer = channel_queue_end_map_.find(channel_id)->second.dequeue_buffer_;
+  auto packet = std::move(dequeue_buffer.front());
+  dequeue_buffer.pop();
+  if (dequeue_buffer.size() < ChannelQueueEndAndBuffer::kBufferSize) {
+    channel_queue_end_map_.find(channel_id)->second.try_register_dequeue();
+  }
+  if (next_to_dequeue_.empty()) {
+    link_queue_up_end_->UnregisterEnqueue();
+    link_queue_enqueue_registered_ = false;
+  }
+  Cid remote_channel_id = channel_queue_end_map_.find(channel_id)->second.remote_channel_id_;
+  return BasicFrameBuilder::Create(remote_channel_id, std::move(packet));
+}
+
+void Fifo::try_register_link_queue_enqueue() {
+  if (link_queue_enqueue_registered_) {
+    return;
+  }
+  link_queue_up_end_->RegisterEnqueue(handler_,
+                                      common::Bind(&Fifo::link_queue_enqueue_callback, common::Unretained(this)));
+  link_queue_enqueue_registered_ = true;
+}
+
+void Fifo::link_queue_dequeue_callback() {
+  auto packet = link_queue_up_end_->TryDequeue();
+  auto base_frame_view = BasicFrameView::Create(*packet);
+  if (!base_frame_view.IsValid()) {
+    return;
+  }
+  Cid cid = static_cast<Cid>(base_frame_view.GetChannelId());
+  auto channel = channel_queue_end_map_.find(cid);
+  if (channel == channel_queue_end_map_.end()) {
+    return;  // Channel is not attached to scheduler
+  }
+  auto& queue_end_and_buffer = channel->second;
+
+  queue_end_and_buffer.enqueue_buffer_.Enqueue(
+      std::make_unique<PacketView<kLittleEndian>>(base_frame_view.GetPayload()), handler_);
+}
+
+void Fifo::ChannelQueueEndAndBuffer::try_register_dequeue() {
+  if (is_dequeue_registered_) {
+    return;
+  }
+  queue_end_->RegisterDequeue(
+      handler_, common::Bind(&Fifo::ChannelQueueEndAndBuffer::dequeue_callback, common::Unretained(this)));
+  is_dequeue_registered_ = true;
+}
+
+void Fifo::ChannelQueueEndAndBuffer::dequeue_callback() {
+  auto packet = queue_end_->TryDequeue();
+  ASSERT(packet != nullptr);
+  dequeue_buffer_.emplace(std::move(packet));
+  if (dequeue_buffer_.size() >= kBufferSize) {
+    queue_end_->UnregisterDequeue();
+    is_dequeue_registered_ = false;
+  }
+  scheduler_->next_to_dequeue_.push(channel_id_);
+  scheduler_->try_register_link_queue_enqueue();
+}
+
+Fifo::ChannelQueueEndAndBuffer::~ChannelQueueEndAndBuffer() {
+  if (is_dequeue_registered_) {
+    queue_end_->UnregisterDequeue();
+  }
+}
+
+}  // namespace internal
+}  // namespace l2cap
+}  // namespace bluetooth
diff --git a/gd/l2cap/internal/scheduler_fifo.h b/gd/l2cap/internal/scheduler_fifo.h
new file mode 100644
index 0000000..3f14c75
--- /dev/null
+++ b/gd/l2cap/internal/scheduler_fifo.h
@@ -0,0 +1,88 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#pragma once
+
+#include <string>
+#include <unordered_map>
+
+#include "common/bidi_queue.h"
+#include "common/bind.h"
+#include "l2cap/cid.h"
+#include "l2cap/internal/scheduler.h"
+#include "os/handler.h"
+#include "os/queue.h"
+#include "packet/base_packet_builder.h"
+#include "packet/packet_view.h"
+
+namespace bluetooth {
+namespace l2cap {
+namespace internal {
+
+class Fifo : public Scheduler {
+ public:
+  Fifo(LowerQueueUpEnd* link_queue_up_end, os::Handler* handler)
+      : link_queue_up_end_(link_queue_up_end), handler_(handler) {
+    ASSERT(link_queue_up_end_ != nullptr && handler_ != nullptr);
+    link_queue_up_end_->RegisterDequeue(handler_,
+                                        common::Bind(&Fifo::link_queue_dequeue_callback, common::Unretained(this)));
+  }
+
+  ~Fifo() override;
+  void AttachChannel(Cid cid, UpperQueueDownEnd* channel_down_end, Cid remote_cid) override;
+  void DetachChannel(Cid cid) override;
+  LowerQueueUpEnd* GetLowerQueueUpEnd() const override {
+    return link_queue_up_end_;
+  }
+
+ private:
+  LowerQueueUpEnd* link_queue_up_end_;
+  os::Handler* handler_;
+
+  struct ChannelQueueEndAndBuffer {
+    ChannelQueueEndAndBuffer(os::Handler* handler, UpperQueueDownEnd* queue_end, Fifo* scheduler, Cid channel_id,
+                             Cid remote_channel_id)
+        : handler_(handler), queue_end_(queue_end), enqueue_buffer_(queue_end), scheduler_(scheduler),
+          channel_id_(channel_id), remote_channel_id_(remote_channel_id) {
+      try_register_dequeue();
+    }
+    os::Handler* handler_;
+    UpperQueueDownEnd* queue_end_;
+    os::EnqueueBuffer<UpperEnqueue> enqueue_buffer_;
+    constexpr static int kBufferSize = 1;
+    std::queue<std::unique_ptr<UpperDequeue>> dequeue_buffer_;
+    Fifo* scheduler_;
+    Cid channel_id_;
+    Cid remote_channel_id_;
+    bool is_dequeue_registered_ = false;
+
+    void try_register_dequeue();
+    void dequeue_callback();
+    ~ChannelQueueEndAndBuffer();
+  };
+
+  std::unordered_map<Cid, ChannelQueueEndAndBuffer> channel_queue_end_map_;
+  std::queue<Cid> next_to_dequeue_;
+  void link_queue_dequeue_callback();
+
+  bool link_queue_enqueue_registered_ = false;
+  void try_register_link_queue_enqueue();
+  std::unique_ptr<LowerEnqueue> link_queue_enqueue_callback();
+};
+
+}  // namespace internal
+}  // namespace l2cap
+}  // namespace bluetooth
diff --git a/gd/l2cap/internal/scheduler_fifo_test.cc b/gd/l2cap/internal/scheduler_fifo_test.cc
new file mode 100644
index 0000000..fe4d149
--- /dev/null
+++ b/gd/l2cap/internal/scheduler_fifo_test.cc
@@ -0,0 +1,131 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "l2cap/internal/scheduler_fifo.h"
+
+#include <gtest/gtest.h>
+#include <future>
+
+#include "l2cap/l2cap_packets.h"
+#include "os/handler.h"
+#include "os/queue.h"
+#include "os/thread.h"
+#include "packet/raw_builder.h"
+
+namespace bluetooth {
+namespace l2cap {
+namespace internal {
+
+std::unique_ptr<BasicFrameBuilder> CreateSampleL2capPacket(Cid cid, std::vector<uint8_t> payload) {
+  auto raw_builder = std::make_unique<packet::RawBuilder>();
+  raw_builder->AddOctets(payload);
+  return BasicFrameBuilder::Create(cid, std::move(raw_builder));
+}
+
+PacketView<kLittleEndian> GetPacketView(std::unique_ptr<packet::BasePacketBuilder> packet) {
+  auto bytes = std::make_shared<std::vector<uint8_t>>();
+  BitInserter i(*bytes);
+  bytes->reserve(packet->size());
+  packet->Serialize(i);
+  return packet::PacketView<packet::kLittleEndian>(bytes);
+}
+void sync_handler(os::Handler* handler) {
+  std::promise<void> promise;
+  auto future = promise.get_future();
+  handler->Post(common::BindOnce(&std::promise<void>::set_value, common::Unretained(&promise)));
+  auto status = future.wait_for(std::chrono::milliseconds(3));
+  EXPECT_EQ(status, std::future_status::ready);
+}
+
+class L2capSchedulerFifoTest : public ::testing::Test {
+ protected:
+  void SetUp() override {
+    thread_ = new os::Thread("test_thread", os::Thread::Priority::NORMAL);
+    user_handler_ = new os::Handler(thread_);
+    queue_handler_ = new os::Handler(thread_);
+    fifo_ = new Fifo(link_queue_.GetUpEnd(), queue_handler_);
+  }
+
+  void TearDown() override {
+    delete fifo_;
+    queue_handler_->Clear();
+    user_handler_->Clear();
+    delete queue_handler_;
+    delete user_handler_;
+    delete thread_;
+  }
+
+  os::Thread* thread_ = nullptr;
+  os::Handler* user_handler_ = nullptr;
+  os::Handler* queue_handler_ = nullptr;
+  common::BidiQueue<Scheduler::LowerDequeue, Scheduler::LowerEnqueue> link_queue_{10};
+  Fifo* fifo_ = nullptr;
+};
+
+TEST_F(L2capSchedulerFifoTest, receive_packet) {
+  common::BidiQueue<Scheduler::UpperEnqueue, Scheduler::UpperDequeue> channel_one_queue_{10};
+  common::BidiQueue<Scheduler::UpperEnqueue, Scheduler::UpperDequeue> channel_two_queue_{10};
+  fifo_->AttachChannel(1, channel_one_queue_.GetDownEnd(), 1);
+  fifo_->AttachChannel(2, channel_two_queue_.GetDownEnd(), 2);
+  os::EnqueueBuffer<Scheduler::UpperEnqueue> link_queue_enqueue_buffer{link_queue_.GetDownEnd()};
+  auto packet_one = CreateSampleL2capPacket(1, {1, 2, 3});
+  auto packet_two = CreateSampleL2capPacket(2, {4, 5, 6, 7});
+  auto packet_one_view = GetPacketView(std::move(packet_one));
+  auto packet_two_view = GetPacketView(std::move(packet_two));
+  link_queue_enqueue_buffer.Enqueue(std::make_unique<Scheduler::UpperEnqueue>(packet_one_view), queue_handler_);
+  link_queue_enqueue_buffer.Enqueue(std::make_unique<Scheduler::UpperEnqueue>(packet_two_view), queue_handler_);
+  sync_handler(queue_handler_);
+  sync_handler(user_handler_);
+  sync_handler(queue_handler_);
+  auto packet = channel_one_queue_.GetUpEnd()->TryDequeue();
+  EXPECT_NE(packet, nullptr);
+  EXPECT_EQ(packet->size(), 3);
+  packet = channel_two_queue_.GetUpEnd()->TryDequeue();
+  EXPECT_NE(packet, nullptr);
+  EXPECT_EQ(packet->size(), 4);
+  fifo_->DetachChannel(1);
+  fifo_->DetachChannel(2);
+}
+
+TEST_F(L2capSchedulerFifoTest, send_packet) {
+  common::BidiQueue<Scheduler::UpperEnqueue, Scheduler::UpperDequeue> channel_one_queue_{10};
+  common::BidiQueue<Scheduler::UpperEnqueue, Scheduler::UpperDequeue> channel_two_queue_{10};
+  fifo_->AttachChannel(1, channel_one_queue_.GetDownEnd(), 1);
+  fifo_->AttachChannel(2, channel_two_queue_.GetDownEnd(), 2);
+  os::EnqueueBuffer<Scheduler::UpperDequeue> channel_one_enqueue_buffer{channel_one_queue_.GetUpEnd()};
+  os::EnqueueBuffer<Scheduler::UpperDequeue> channel_two_enqueue_buffer{channel_two_queue_.GetUpEnd()};
+  auto packet_one = std::make_unique<packet::RawBuilder>();
+  packet_one->AddOctets({1, 2, 3});
+  auto packet_two = std::make_unique<packet::RawBuilder>();
+  packet_two->AddOctets({4, 5, 6, 7});
+  channel_one_enqueue_buffer.Enqueue(std::move(packet_one), user_handler_);
+  channel_two_enqueue_buffer.Enqueue(std::move(packet_two), user_handler_);
+  sync_handler(user_handler_);
+  sync_handler(queue_handler_);
+  sync_handler(user_handler_);
+  auto packet = link_queue_.GetDownEnd()->TryDequeue();
+  EXPECT_NE(packet, nullptr);
+  EXPECT_EQ(packet->size(), 7);
+  packet = link_queue_.GetDownEnd()->TryDequeue();
+  EXPECT_NE(packet, nullptr);
+  EXPECT_EQ(packet->size(), 8);
+  fifo_->DetachChannel(1);
+  fifo_->DetachChannel(2);
+}
+
+}  // namespace internal
+}  // namespace l2cap
+}  // namespace bluetooth
diff --git a/gd/l2cap/internal/scheduler_mock.h b/gd/l2cap/internal/scheduler_mock.h
new file mode 100644
index 0000000..616d156
--- /dev/null
+++ b/gd/l2cap/internal/scheduler_mock.h
@@ -0,0 +1,40 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+#pragma once
+
+#include "l2cap/internal/scheduler.h"
+
+#include <gmock/gmock.h>
+
+// Unit test interfaces
+namespace bluetooth {
+namespace l2cap {
+namespace internal {
+namespace testing {
+
+using hci::testing::MockAclConnection;
+
+class MockScheduler : public Scheduler {
+ public:
+  MOCK_METHOD(void, AttachChannel, (Cid cid, UpperQueueDownEnd* channel_down_end, Cid remote_cid), (override));
+  MOCK_METHOD(void, DetachChannel, (Cid cid), (override));
+  MOCK_METHOD(LowerQueueUpEnd*, GetLowerQueueUpEnd, (), (override, const));
+};
+
+}  // namespace testing
+}  // namespace internal
+}  // namespace l2cap
+}  // namespace bluetooth
diff --git a/gd/l2cap/l2cap_packet_fuzz_test.cc b/gd/l2cap/l2cap_packet_fuzz_test.cc
new file mode 100644
index 0000000..6fecafc
--- /dev/null
+++ b/gd/l2cap/l2cap_packet_fuzz_test.cc
@@ -0,0 +1,53 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#define PACKET_FUZZ_TESTING
+#include "l2cap/l2cap_packets.h"
+
+#include <memory>
+
+#include "os/log.h"
+#include "packet/bit_inserter.h"
+#include "packet/raw_builder.h"
+
+using bluetooth::packet::BitInserter;
+using bluetooth::packet::RawBuilder;
+using std::vector;
+
+namespace bluetooth {
+namespace l2cap {
+
+std::vector<void (*)(const uint8_t*, size_t)> l2cap_packet_fuzz_tests;
+
+DEFINE_AND_REGISTER_ExtendedInformationStartFrameReflectionFuzzTest(l2cap_packet_fuzz_tests);
+
+DEFINE_AND_REGISTER_StandardInformationFrameWithFcsReflectionFuzzTest(l2cap_packet_fuzz_tests);
+
+DEFINE_AND_REGISTER_StandardSupervisoryFrameWithFcsReflectionFuzzTest(l2cap_packet_fuzz_tests);
+
+DEFINE_AND_REGISTER_GroupFrameReflectionFuzzTest(l2cap_packet_fuzz_tests);
+
+DEFINE_AND_REGISTER_ConfigurationRequestReflectionFuzzTest(l2cap_packet_fuzz_tests);
+
+}  // namespace l2cap
+}  // namespace bluetooth
+
+void RunL2capPacketFuzzTest(const uint8_t* data, size_t size) {
+  if (data == nullptr) return;
+  for (auto test_function : bluetooth::l2cap::l2cap_packet_fuzz_tests) {
+    test_function(data, size);
+  }
+}
\ No newline at end of file
diff --git a/gd/l2cap/l2cap_packet_test.cc b/gd/l2cap/l2cap_packet_test.cc
index 683d060..36b8791 100644
--- a/gd/l2cap/l2cap_packet_test.cc
+++ b/gd/l2cap/l2cap_packet_test.cc
@@ -14,6 +14,7 @@
  * limitations under the License.
  */
 
+#define PACKET_TESTING
 #include "l2cap/l2cap_packets.h"
 
 #include <gtest/gtest.h>
@@ -28,139 +29,37 @@
 using bluetooth::packet::RawBuilder;
 using std::vector;
 
-namespace {
-vector<uint8_t> extended_information_start_frame = {
-    0x0B /* First size byte */,
-    0x00 /* Second size byte */,
-    0xc1 /* First ChannelId byte */,
-    0xc2,
-    0x4A /* 0x12 ReqSeq, Final, IFrame */,
-    0xD0 /* 0x13 ReqSeq */,
-    0x89 /* 0x21 TxSeq sar = START */,
-    0x8C /* 0x23 TxSeq  */,
-    0x10 /* first length byte */,
-    0x11,
-    0x01 /* first payload byte */,
-    0x02,
-    0x03,
-    0x04,
-    0x05,
-};
-}  // namespace
-
 namespace bluetooth {
 namespace l2cap {
 
-TEST(L2capPacketTest, extendedInformationStartFrameTest) {
-  uint16_t channel_id = 0xc2c1;
-  uint16_t l2cap_sdu_length = 0x1110;
-  Final f = Final::POLL_RESPONSE;
-  uint16_t req_seq = 0x1312;
-  uint16_t tx_seq = 0x2321;
-
-  std::unique_ptr<RawBuilder> payload = std::make_unique<RawBuilder>();
-  payload->AddOctets4(0x04030201);
-  payload->AddOctets1(0x05);
-
-  auto packet = ExtendedInformationStartFrameBuilder::Create(channel_id, f, req_seq, tx_seq, l2cap_sdu_length,
-                                                             std::move(payload));
-
-  ASSERT_EQ(extended_information_start_frame.size(), packet->size());
-  std::shared_ptr<std::vector<uint8_t>> packet_bytes = std::make_shared<std::vector<uint8_t>>();
-  BitInserter it(*packet_bytes);
-  packet->Serialize(it);
-  PacketView<true> packet_bytes_view(packet_bytes);
-  ASSERT_EQ(extended_information_start_frame.size(), packet_bytes_view.size());
-
-  BasicFrameView basic_frame_view = BasicFrameView::Create(packet_bytes_view);
-  ASSERT_TRUE(basic_frame_view.IsValid());
-  ASSERT_EQ(channel_id, basic_frame_view.GetChannelId());
-
-  StandardFrameView standard_frame_view = StandardFrameView::Create(basic_frame_view);
-  ASSERT_TRUE(standard_frame_view.IsValid());
-  ASSERT_EQ(FrameType::I_FRAME, standard_frame_view.GetFrameType());
-}
-
-vector<uint8_t> i_frame_with_fcs = {
-    0x0E, 0x00, 0x40, 0x00, 0x02, 0x00, 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x38, 0x61,
+std::vector<uint8_t> extended_information_start_frame = {
+    0x0B, /* First size byte */
+    0x00, /* Second size byte */
+    0xc1, /* First ChannelId byte */
+    0xc2, /**/
+    0x4A, /* 0x12 ReqSeq, Final, IFrame */
+    0xD0, /* 0x13 ReqSeq */
+    0x89, /* 0x21 TxSeq sar = START */
+    0x8C, /* 0x23 TxSeq  */
+    0x10, /* first length byte */
+    0x11, /**/
+    0x01, /* first payload byte */
+    0x02, 0x03, 0x04, 0x05,
 };
-TEST(L2capPacketTest, iFrameWithFcsTest) {
-  uint16_t channel_id = 0x0040;
-  SegmentationAndReassembly sar = SegmentationAndReassembly::UNSEGMENTED;  // 0
-  uint16_t req_seq = 0;
-  uint16_t tx_seq = 1;
-  RetransmissionDisable r = RetransmissionDisable::NORMAL;  // 0
 
-  std::unique_ptr<RawBuilder> payload = std::make_unique<RawBuilder>();
-  vector<uint8_t> payload_bytes = {0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09};
-  payload->AddOctets(payload_bytes);
+DEFINE_AND_INSTANTIATE_ExtendedInformationStartFrameReflectionTest(extended_information_start_frame);
 
-  auto packet = StandardInformationFrameWithFcsBuilder::Create(channel_id, tx_seq, r, req_seq, sar, std::move(payload));
+std::vector<uint8_t> i_frame_with_fcs = {0x0E, 0x00, 0x40, 0x00, 0x02, 0x00, 0x00, 0x01, 0x02,
+                                         0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x38, 0x61};
+DEFINE_AND_INSTANTIATE_StandardInformationFrameWithFcsReflectionTest(i_frame_with_fcs);
 
-  ASSERT_EQ(i_frame_with_fcs.size(), packet->size());
-  std::shared_ptr<std::vector<uint8_t>> packet_bytes = std::make_shared<std::vector<uint8_t>>();
-  BitInserter it(*packet_bytes);
-  packet->Serialize(it);
-  PacketView<true> packet_bytes_view(packet_bytes);
-  ASSERT_EQ(i_frame_with_fcs.size(), packet_bytes_view.size());
+std::vector<uint8_t> rr_frame_with_fcs = {0x04, 0x00, 0x40, 0x00, 0x01, 0x01, 0xD4, 0x14};
+DEFINE_AND_INSTANTIATE_StandardSupervisoryFrameWithFcsReflectionTest(rr_frame_with_fcs);
 
-  for (size_t i = 0; i < i_frame_with_fcs.size(); i++) {
-    ASSERT_EQ(i_frame_with_fcs[i], packet_bytes_view[i]);
-  }
+std::vector<uint8_t> g_frame = {0x03, 0x00, 0x02, 0x00, 0x01, 0x02, 0x03};
+DEFINE_AND_INSTANTIATE_GroupFrameReflectionTest(g_frame);
 
-  BasicFrameWithFcsView basic_frame_view = BasicFrameWithFcsView::Create(packet_bytes_view);
-  ASSERT_TRUE(basic_frame_view.IsValid());
-  ASSERT_EQ(channel_id, basic_frame_view.GetChannelId());
-
-  StandardFrameWithFcsView standard_frame_view = StandardFrameWithFcsView::Create(basic_frame_view);
-  ASSERT_TRUE(standard_frame_view.IsValid());
-  ASSERT_EQ(FrameType::I_FRAME, standard_frame_view.GetFrameType());
-
-  StandardInformationFrameWithFcsView information_frame_view =
-      StandardInformationFrameWithFcsView::Create(standard_frame_view);
-  ASSERT_TRUE(information_frame_view.IsValid());
-  ASSERT_EQ(sar, information_frame_view.GetSar());
-  ASSERT_EQ(req_seq, information_frame_view.GetReqSeq());
-  ASSERT_EQ(tx_seq, information_frame_view.GetTxSeq());
-  ASSERT_EQ(r, information_frame_view.GetR());
-}
-
-vector<uint8_t> rr_frame_with_fcs = {
-    0x04, 0x00, 0x40, 0x00, 0x01, 0x01, 0xD4, 0x14,
-};
-TEST(L2capPacketTest, rrFrameWithFcsTest) {
-  uint16_t channel_id = 0x0040;
-  SupervisoryFunction s = SupervisoryFunction::RECEIVER_READY;  // 0
-  RetransmissionDisable r = RetransmissionDisable::NORMAL;      // 0
-  uint16_t req_seq = 1;
-
-  auto packet = StandardSupervisoryFrameWithFcsBuilder::Create(channel_id, s, r, req_seq);
-
-  ASSERT_EQ(rr_frame_with_fcs.size(), packet->size());
-  std::shared_ptr<std::vector<uint8_t>> packet_bytes = std::make_shared<std::vector<uint8_t>>();
-  BitInserter it(*packet_bytes);
-  packet->Serialize(it);
-  PacketView<true> packet_bytes_view(packet_bytes);
-  ASSERT_EQ(rr_frame_with_fcs.size(), packet_bytes_view.size());
-
-  for (size_t i = 0; i < rr_frame_with_fcs.size(); i++) {
-    ASSERT_EQ(rr_frame_with_fcs[i], packet_bytes_view[i]);
-  }
-
-  BasicFrameWithFcsView basic_frame_view = BasicFrameWithFcsView::Create(packet_bytes_view);
-  ASSERT_TRUE(basic_frame_view.IsValid());
-  ASSERT_EQ(channel_id, basic_frame_view.GetChannelId());
-
-  StandardFrameWithFcsView standard_frame_view = StandardFrameWithFcsView::Create(basic_frame_view);
-  ASSERT_TRUE(standard_frame_view.IsValid());
-  ASSERT_EQ(FrameType::S_FRAME, standard_frame_view.GetFrameType());
-
-  StandardSupervisoryFrameWithFcsView supervisory_frame_view =
-      StandardSupervisoryFrameWithFcsView::Create(standard_frame_view);
-  ASSERT_TRUE(supervisory_frame_view.IsValid());
-  ASSERT_EQ(s, supervisory_frame_view.GetS());
-  ASSERT_EQ(r, supervisory_frame_view.GetR());
-  ASSERT_EQ(req_seq, supervisory_frame_view.GetReqSeq());
-}
+std::vector<uint8_t> config_mtu_request = {0x04, 0x05, 0x08, 0x00, 0x41, 0x00, 0x00, 0x00, 0x01, 0x02, 0xa0, 0x02};
+DEFINE_AND_INSTANTIATE_ConfigurationRequestReflectionTest(config_mtu_request);
 }  // namespace l2cap
 }  // namespace bluetooth
diff --git a/gd/l2cap/l2cap_packets.pdl b/gd/l2cap/l2cap_packets.pdl
index dfd18d4..ee9f3ed 100644
--- a/gd/l2cap/l2cap_packets.pdl
+++ b/gd/l2cap/l2cap_packets.pdl
@@ -16,6 +16,11 @@
   fcs : Fcs,
 }
 
+enum Continuation : 1 {
+  END = 0,
+  CONTINUE = 1,
+}
+
 // ChannelId 2 is connectionless
 packet GroupFrame : BasicFrame (channel_id = 0x02) {
   psm : 16,
@@ -225,20 +230,23 @@
 }
 
 packet ControlFrame : BasicFrame (channel_id = 0x0001) {
+  _payload_,
+}
+
+packet Control {
   code : CommandCode,
   identifier : 8,
   _size_(_payload_) : 16,
   _payload_,
 }
 
-
 enum CommandRejectReason : 16 {
   COMMAND_NOT_UNDERSTOOD = 0x0000,
   SIGNALING_MTU_EXCEEDED = 0x0001,
   INVALID_CID_IN_REQUEST = 0x0002,
 }
 
-packet CommandReject : ControlFrame (code = COMMAND_REJECT) {
+packet CommandReject : Control (code = COMMAND_REJECT) {
   reason : CommandRejectReason,
   _body_,
 }
@@ -255,7 +263,7 @@
   remote_channel : 16,
 }
 
-packet ConnectionRequest : ControlFrame (code = CONNECTION_REQUEST) {
+packet ConnectionRequest : Control (code = CONNECTION_REQUEST) {
   psm : 16,
   source_cid : 16,
 }
@@ -276,26 +284,14 @@
   AUTHORIZATION_PENDING = 0x0002,
 }
 
-packet ConnectionResponse : ControlFrame (code = CONNECTION_RESPONSE) {
+packet ConnectionResponse : Control (code = CONNECTION_RESPONSE) {
   destination_cid : 16,
   source_cid : 16,
   result : ConnectionResponseResult,
   status : ConnectionResponseStatus,
 }
 
-enum ConfigurationContinuation : 1 {
-  END = 0,
-  CONTINUES = 1,
-}
-
-packet ConfigurationRequestBase : ControlFrame (code = CONFIGURATION_REQUEST) {
-  destination_cid : 16,
-  continuation : ConfigurationContinuation,
-  _reserved_ : 15,
-  _payload_,
-}
-
-enum ConfigurationOptionsType : 7 {
+enum ConfigurationOptionType : 7 {
   MTU = 0x01,
   FLUSH_TIMEOUT = 0x02,
   QUALITY_OF_SERVICE = 0x03,
@@ -310,18 +306,18 @@
   OPTION_IS_A_HINT = 1,
 }
 
-packet ConfigurationOptions {
-  type : ConfigurationOptionsType,
+struct ConfigurationOption {
+  type : ConfigurationOptionType,
   is_hint : ConfigurationOptionIsHint,
-  _size_(_payload_) : 8,
-  _payload_,
+  length : 8,
+  _body_,
 }
 
-packet MtuConfigurationOption : ConfigurationOptions (type = MTU) {
+struct MtuConfigurationOption : ConfigurationOption (type = MTU, length = 2) {
   mtu : 16,
 }
 
-packet FlushTimeoutConfigurationOption : ConfigurationOptions (type = FLUSH_TIMEOUT) {
+struct FlushTimeoutConfigurationOption : ConfigurationOption (type = FLUSH_TIMEOUT, length = 2) {
   flush_timeout : 16,
 }
 
@@ -331,14 +327,14 @@
   GUARANTEED = 0x02,
 }
 
-packet QualityOfServiceConfigurationOption : ConfigurationOptions (type = QUALITY_OF_SERVICE) {
+struct QualityOfServiceConfigurationOption : ConfigurationOption (type = QUALITY_OF_SERVICE, length = 22) {
   _reserved_ : 8, // Flags
   service_type : QosServiceType,
-  token_rate : 32,        // 0 = ignore, 0xffffffff = max available
+  token_rate : 32,         // 0 = ignore, 0xffffffff = max available
   token_bucket_size : 32,  // 0 = ignore, 0xffffffff = max available
-  peak_bandwidth : 32,    // Octets/second 0 = ignore
-  latency : 32,          // microseconds 0xffffffff = ignore
-  delay_variation : 32,   // microseconds 0xffffffff = ignore
+  peak_bandwidth : 32,     // Octets/second 0 = ignore
+  latency : 32,            // microseconds 0xffffffff = ignore
+  delay_variation : 32,    // microseconds 0xffffffff = ignore
 }
 
 enum RetransmissionAndFlowControlModeOption : 8 {
@@ -350,7 +346,7 @@
 }
 
 
-packet RetransmissionAndFlowControlConfigurationOption : ConfigurationOptions (type = RETRANSMISSION_AND_FLOW_CONTROL) {
+struct RetransmissionAndFlowControlConfigurationOption : ConfigurationOption (type = RETRANSMISSION_AND_FLOW_CONTROL, length = 8) {
   mode : RetransmissionAndFlowControlModeOption,
   tx_window_size : 8, // 1-32 for Flow Control and Retransmission, 1-63 for Enhanced
   max_transmit : 8,
@@ -364,12 +360,12 @@
   DEFAULT = 1,  // 16-bit FCS
 }
 
-packet FrameCheckSequenceOption : ConfigurationOptions (type = FRAME_CHECK_SEQUENCE) {
+struct FrameCheckSequenceOption : ConfigurationOption (type = FRAME_CHECK_SEQUENCE, length = 1) {
   fcs_type : FcsType,
 }
 
 
-packet ExtendedFlowSpecificationOption : ConfigurationOptions (type = EXTENDED_FLOW_SPECIFICATION) {
+struct ExtendedFlowSpecificationOption : ConfigurationOption (type = EXTENDED_FLOW_SPECIFICATION, length = 16) {
   identifier : 8, // Default 0x01, must be 0x01 for Extended Flow-Best-Effort
   service_type : QosServiceType,
   maximum_sdu_size : 16, // Octets
@@ -378,12 +374,15 @@
   flush_timeout : 32, // in microseconds 0x0 = no retransmissions 0xFFFFFFFF = never flushed
 }
 
-packet ExtendedWindowSizeOption : ConfigurationOptions (type = EXTENDED_WINDOW_SIZE) {
+struct ExtendedWindowSizeOption : ConfigurationOption (type = EXTENDED_WINDOW_SIZE, length = 2) {
   max_window_size : 16, // 0x0000 = Valid for streaming, 0x0001-0x3FFF Valid for Enhanced Retransmission
 }
 
-packet ConfigurationRequest : ConfigurationRequestBase {
-  _payload_,
+packet ConfigurationRequest : Control (code = CONFIGURATION_REQUEST) {
+  destination_cid : 16,
+  continuation : Continuation,
+  _reserved_ : 15,
+  config : ConfigurationOption[],
 }
 
 enum ConfigurationResponseResult : 16 {
@@ -395,33 +394,29 @@
   FLOW_SPEC_REJECTED = 0x0005,
 }
 
-packet ConfigurationResponseBase : ControlFrame (code = CONFIGURATION_RESPONSE) {
+packet ConfigurationResponse : Control (code = CONFIGURATION_RESPONSE) {
   source_cid : 16,
-  continuation : ConfigurationContinuation,
+  continuation : Continuation,
   _reserved_ : 15,
   result : ConfigurationResponseResult,
-  _payload_,
+  config : ConfigurationOption[],
 }
 
-packet ConfigurationResponse : ConfigurationResponseBase {
-  _payload_,
-}
-
-packet DisconnectionRequest : ControlFrame (code = DISCONNECTION_REQUEST) {
+packet DisconnectionRequest : Control (code = DISCONNECTION_REQUEST) {
   destination_cid : 16,
   source_cid : 16,
 }
 
-packet DisconnectionResponse : ControlFrame (code = DISCONNECTION_RESPONSE) {
+packet DisconnectionResponse : Control (code = DISCONNECTION_RESPONSE) {
   destination_cid : 16,
   source_cid : 16,
 }
 
-packet EchoRequest : ControlFrame (code = ECHO_REQUEST) {
+packet EchoRequest : Control (code = ECHO_REQUEST) {
   _payload_, // Optional and implementation specific
 }
 
-packet EchoResponse : ControlFrame (code = ECHO_RESPONSE) {
+packet EchoResponse : Control (code = ECHO_RESPONSE) {
   _payload_, // Optional and implementation specific
 }
 
@@ -431,7 +426,7 @@
   FIXED_CHANNELS_SUPPORTED = 0x0003,
 }
 
-packet InformationRequest : ControlFrame (code = INFORMATION_REQUEST) {
+packet InformationRequest : Control (code = INFORMATION_REQUEST) {
   info_type : InformationRequestInfoType,
 }
 
@@ -440,7 +435,7 @@
   NOT_SUPPORTED = 0x0001,
 }
 
-packet InformationResponse : ControlFrame (code = INFORMATION_RESPONSE) {
+packet InformationResponse : Control (code = INFORMATION_RESPONSE) {
   info_type : InformationRequestInfoType,
   result : InformationRequestResult,
   _body_,
@@ -469,7 +464,7 @@
   fixed_channels : 64, // bit 0 must be 0, bit 1 must be 1, all others 1 = supported
 }
 
-packet CreateChannelRequest : ControlFrame (code = CREATE_CHANNEL_REQUEST) {
+packet CreateChannelRequest : Control (code = CREATE_CHANNEL_REQUEST) {
   psm : 16,
   source_cid : 16,
   controller_id : 8,
@@ -492,7 +487,7 @@
   AUTHORIZATION_PENDING = 0x0002,
 }
 
-packet CreateChannelResponse : ControlFrame (code = CREATE_CHANNEL_RESPONSE) {
+packet CreateChannelResponse : Control (code = CREATE_CHANNEL_RESPONSE) {
   destination_cid : 16,
   source_cid : 16,
   result : CreateChannelResponseResult,
@@ -500,7 +495,7 @@
 }
 
 // AMP Only ?
-packet MoveChannelRequest : ControlFrame (code = MOVE_CHANNEL_REQUEST) {
+packet MoveChannelRequest : Control (code = MOVE_CHANNEL_REQUEST) {
   initiator_cid : 16,
   dest_controller_id : 8,
 }
@@ -515,7 +510,7 @@
   CHANNEL_NOT_ALLOWED_TO_BE_MOVED = 0x0006,
 }
 
-packet MoveChannelResponse : ControlFrame (code = MOVE_CHANNEL_RESPONSE) {
+packet MoveChannelResponse : Control (code = MOVE_CHANNEL_RESPONSE) {
   initiator_cid : 16,
   result : MoveChannelResponseResult,
 }
@@ -525,12 +520,12 @@
   FAILURE = 0x0001,
 }
 
-packet MoveChannelConfirmationRequest : ControlFrame (code = MOVE_CHANNEL_CONFIRMATION_REQUEST) {
+packet MoveChannelConfirmationRequest : Control (code = MOVE_CHANNEL_CONFIRMATION_REQUEST) {
   initiator_cid : 16,
   result : MoveChannelConfirmationResult,
 }
 
-packet MoveChannelConfirmationResponse : ControlFrame (code = MOVE_CHANNEL_CONFIRMATION_RESPONSE) {
+packet MoveChannelConfirmationResponse : Control (code = MOVE_CHANNEL_CONFIRMATION_RESPONSE) {
   initiator_cid : 16,
 }
 
@@ -546,13 +541,18 @@
 }
 
 packet LeControlFrame : BasicFrame (channel_id = 0x0005) {
+  _payload_,
+}
+
+packet LeControl {
   code : LeCommandCode,
   identifier : 8, // Must be non-zero
   _size_(_payload_) : 16,
   _payload_,
 }
 
-packet LeCommandReject : LeControlFrame (code = COMMAND_REJECT) {
+
+packet LeCommandReject : LeControl (code = COMMAND_REJECT) {
   reason : CommandRejectReason,
   _payload_,
 }
@@ -569,17 +569,17 @@
   remote_channel : 16,
 }
 
-packet LeDisconnectionRequest : LeControlFrame (code = DISCONNECTION_REQUEST) {
+packet LeDisconnectionRequest : LeControl (code = DISCONNECTION_REQUEST) {
   destination_cid : 16,
   source_cid : 16,
 }
 
-packet LeDisconnectionResponse : LeControlFrame (code = DISCONNECTION_RESPONSE) {
+packet LeDisconnectionResponse : LeControl (code = DISCONNECTION_RESPONSE) {
   destination_cid : 16,
   source_cid : 16,
 }
 
-packet ConnectionParameterUpdateRequest : LeControlFrame (code = CONNECTION_PARAMETER_UPDATE_REQUEST) {
+packet ConnectionParameterUpdateRequest : LeControl (code = CONNECTION_PARAMETER_UPDATE_REQUEST) {
   interval_min : 16,
   interval_max : 16,
   slave_latency : 16,
@@ -591,11 +591,11 @@
   REJECTED = 1,
 }
 
-packet ConnectionParameterUpdateResponse : LeControlFrame (code = CONNECTION_PARAMETER_UPDATE_RESPONSE) {
+packet ConnectionParameterUpdateResponse : LeControl (code = CONNECTION_PARAMETER_UPDATE_RESPONSE) {
   result : ConnectionParameterUpdateResponseResult,
 }
 
-packet LeCreditBasedConnectionRequest : LeControlFrame (code = LE_CREDIT_BASED_CONNECTION_REQUEST) {
+packet LeCreditBasedConnectionRequest : LeControl (code = LE_CREDIT_BASED_CONNECTION_REQUEST) {
   le_psm : 16, // 0x0001-0x007F Fixed, 0x0080-0x00FF Dynamic
   source_cid : 16,
   mtu : 16,
@@ -616,7 +616,7 @@
   UNACCEPTABLE_PARAMETERS = 0x000B,
 }
 
-packet LeCreditBasedConnectionResponse : LeControlFrame (code = LE_CREDIT_BASED_CONNECTION_RESPONSE) {
+packet LeCreditBasedConnectionResponse : LeControl (code = LE_CREDIT_BASED_CONNECTION_RESPONSE) {
   destination_cid : 16,
   mtu : 16,
   mps : 16,
@@ -624,7 +624,7 @@
   result : LeCreditBasedConnectionResponseResult,
 }
 
-packet LeFlowControlCredit : LeControlFrame (code = LE_FLOW_CONTROL_CREDIT) {
+packet LeFlowControlCredit : LeControl (code = LE_FLOW_CONTROL_CREDIT) {
   cid : 16, // Receiver's destination CID
   credits : 16,
 }
diff --git a/gd/l2cap/le/fixed_channel.cc b/gd/l2cap/le/fixed_channel.cc
new file mode 100644
index 0000000..1e6a163
--- /dev/null
+++ b/gd/l2cap/le/fixed_channel.cc
@@ -0,0 +1,52 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "l2cap/le/fixed_channel.h"
+#include "common/bind.h"
+#include "l2cap/le/internal/fixed_channel_impl.h"
+
+namespace bluetooth {
+namespace l2cap {
+namespace le {
+
+hci::AddressWithType FixedChannel::GetDevice() const {
+  return impl_->GetDevice();
+}
+
+hci::Role FixedChannel::GetRole() const {
+  return impl_->GetRole();
+}
+
+void FixedChannel::RegisterOnCloseCallback(os::Handler* user_handler, FixedChannel::OnCloseCallback on_close_callback) {
+  l2cap_handler_->Post(common::BindOnce(&internal::FixedChannelImpl::RegisterOnCloseCallback, impl_, user_handler,
+                                        std::move(on_close_callback)));
+}
+
+void FixedChannel::Acquire() {
+  l2cap_handler_->Post(common::BindOnce(&internal::FixedChannelImpl::Acquire, impl_));
+}
+
+void FixedChannel::Release() {
+  l2cap_handler_->Post(common::BindOnce(&internal::FixedChannelImpl::Release, impl_));
+}
+
+common::BidiQueueEnd<packet::BasePacketBuilder, packet::PacketView<packet::kLittleEndian>>*
+FixedChannel::GetQueueUpEnd() const {
+  return impl_->GetQueueUpEnd();
+}
+}  // namespace le
+}  // namespace l2cap
+}  // namespace bluetooth
\ No newline at end of file
diff --git a/gd/l2cap/le/fixed_channel.h b/gd/l2cap/le/fixed_channel.h
new file mode 100644
index 0000000..ad4674b
--- /dev/null
+++ b/gd/l2cap/le/fixed_channel.h
@@ -0,0 +1,95 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+#pragma once
+
+#include "common/bidi_queue.h"
+#include "common/callback.h"
+#include "hci/acl_manager.h"
+#include "l2cap/cid.h"
+#include "os/handler.h"
+#include "packet/base_packet_builder.h"
+#include "packet/packet_view.h"
+
+namespace bluetooth {
+namespace l2cap {
+namespace le {
+
+namespace internal {
+class FixedChannelImpl;
+}  // namespace internal
+
+/**
+ * L2CAP fixed channel object. When a new object is created, it must be
+ * acquired through calling {@link FixedChannel#Acquire()} within X seconds.
+ * Otherwise, {@link FixedChannel#Release()} will be called automatically.
+ *
+ */
+class FixedChannel {
+ public:
+  // Should only be constructed by modules that have access to LinkManager
+  FixedChannel(std::shared_ptr<internal::FixedChannelImpl> impl, os::Handler* l2cap_handler)
+      : impl_(std::move(impl)), l2cap_handler_(l2cap_handler) {
+    ASSERT(impl_ != nullptr);
+    ASSERT(l2cap_handler_ != nullptr);
+  }
+
+  hci::AddressWithType GetDevice() const;
+
+  /**
+   * Return the role we have in the associated link
+   */
+  hci::Role GetRole() const;
+
+  /**
+   * Register close callback. If close callback is registered, when a channel is closed, the channel's resource will
+   * only be freed after on_close callback is invoked. Otherwise, if no on_close callback is registered, the channel's
+   * resource will be freed immediately after closing.
+   *
+   * @param user_handler The handler used to invoke the callback on
+   * @param on_close_callback The callback invoked upon channel closing.
+   */
+  using OnCloseCallback = common::OnceCallback<void(hci::ErrorCode)>;
+  void RegisterOnCloseCallback(os::Handler* user_handler, OnCloseCallback on_close_callback);
+
+  /**
+   * Indicate that this Fixed Channel is being used. This will prevent ACL connection from being disconnected.
+   */
+  void Acquire();
+
+  /**
+   * Indicate that this Fixed Channel is no longer being used. ACL connection will be disconnected after
+   * kLinkIdleDisconnectTimeout if no other DynamicChannel is connected or no other Fixed Channel is  using this
+   * ACL connection. However a module can still receive data on this channel as long as it remains open.
+   */
+  void Release();
+
+  /**
+   * This method will retrieve the data channel queue to send and receive packets.
+   *
+   * {@see BidiQueueEnd}
+   *
+   * @return The upper end of a bi-directional queue.
+   */
+  common::BidiQueueEnd<packet::BasePacketBuilder, packet::PacketView<packet::kLittleEndian>>* GetQueueUpEnd() const;
+
+ private:
+  std::shared_ptr<internal::FixedChannelImpl> impl_;
+  os::Handler* l2cap_handler_;
+};
+
+}  // namespace le
+}  // namespace l2cap
+}  // namespace bluetooth
diff --git a/gd/l2cap/le/fixed_channel_manager.cc b/gd/l2cap/le/fixed_channel_manager.cc
new file mode 100644
index 0000000..e36a7b4
--- /dev/null
+++ b/gd/l2cap/le/fixed_channel_manager.cc
@@ -0,0 +1,53 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "l2cap/le/fixed_channel_manager.h"
+#include "l2cap/le/internal/fixed_channel_service_impl.h"
+#include "l2cap/le/internal/fixed_channel_service_manager_impl.h"
+#include "l2cap/le/internal/link_manager.h"
+
+namespace bluetooth {
+namespace l2cap {
+namespace le {
+
+bool FixedChannelManager::ConnectServices(hci::AddressWithType address_with_type,
+                                          OnConnectionFailureCallback on_fail_callback, os::Handler* handler) {
+  internal::LinkManager::PendingFixedChannelConnection pending_fixed_channel_connection{
+      .handler_ = handler,
+      .on_fail_callback_ = std::move(on_fail_callback),
+  };
+  l2cap_layer_handler_->Post(common::BindOnce(&internal::LinkManager::ConnectFixedChannelServices,
+                                              common::Unretained(link_manager_), address_with_type,
+                                              std::move(pending_fixed_channel_connection)));
+  return true;
+}
+
+bool FixedChannelManager::RegisterService(Cid cid, const SecurityPolicy& security_policy,
+                                          OnRegistrationCompleteCallback on_registration_complete,
+                                          OnConnectionOpenCallback on_connection_open, os::Handler* handler) {
+  internal::FixedChannelServiceImpl::PendingRegistration pending_registration{
+      .user_handler_ = handler,
+      .on_registration_complete_callback_ = std::move(on_registration_complete),
+      .on_connection_open_callback_ = std::move(on_connection_open)};
+  l2cap_layer_handler_->Post(common::BindOnce(&internal::FixedChannelServiceManagerImpl::Register,
+                                              common::Unretained(service_manager_), cid,
+                                              std::move(pending_registration)));
+  return true;
+}
+
+}  // namespace le
+}  // namespace l2cap
+}  // namespace bluetooth
diff --git a/gd/l2cap/le/fixed_channel_manager.h b/gd/l2cap/le/fixed_channel_manager.h
new file mode 100644
index 0000000..ea1a346
--- /dev/null
+++ b/gd/l2cap/le/fixed_channel_manager.h
@@ -0,0 +1,148 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+#pragma once
+
+#include <string>
+
+#include "hci/acl_manager.h"
+#include "hci/address_with_type.h"
+#include "l2cap/cid.h"
+#include "l2cap/le/fixed_channel.h"
+#include "l2cap/le/fixed_channel_service.h"
+#include "l2cap/security_policy.h"
+#include "os/handler.h"
+
+namespace bluetooth {
+namespace l2cap {
+namespace le {
+
+class L2capLeModule;
+
+namespace internal {
+class LinkManager;
+class FixedChannelServiceManagerImpl;
+}  // namespace internal
+
+class FixedChannelManager {
+ public:
+  enum class ConnectionResultCode {
+    SUCCESS = 0,
+    FAIL_NO_SERVICE_REGISTERED = 1,      // No service is registered
+    FAIL_ALL_SERVICES_HAVE_CHANNEL = 2,  // All registered services already have a channel
+    FAIL_HCI_ERROR = 3,                  // See hci_error
+  };
+
+  struct ConnectionResult {
+    ConnectionResultCode connection_result_code = ConnectionResultCode::SUCCESS;
+    hci::ErrorCode hci_error = hci::ErrorCode::SUCCESS;
+  };
+  /**
+   * OnConnectionFailureCallback(std::string failure_reason);
+   */
+  using OnConnectionFailureCallback = common::OnceCallback<void(ConnectionResult result)>;
+
+  /**
+   * OnConnectionOpenCallback(FixedChannel channel);
+   */
+  using OnConnectionOpenCallback = common::Callback<void(std::unique_ptr<FixedChannel>)>;
+
+  enum class RegistrationResult {
+    SUCCESS = 0,
+    FAIL_DUPLICATE_SERVICE = 1,  // Duplicate service registration for the same CID
+    FAIL_INVALID_SERVICE = 2,    // Invalid CID
+  };
+
+  /**
+   * OnRegistrationFailureCallback(RegistrationResult result, FixedChannelService service);
+   */
+  using OnRegistrationCompleteCallback =
+      common::OnceCallback<void(RegistrationResult, std::unique_ptr<FixedChannelService>)>;
+
+  /**
+   * Connect to ALL fixed channels on a remote device
+   *
+   * - This method is asynchronous
+   * - When false is returned, the connection fails immediately
+   * - When true is returned, method caller should wait for on_fail_callback or on_open_callback registered through
+   *   RegisterService() API.
+   * - If an ACL connection does not exist, this method will create an ACL connection. As a result, on_open_callback
+   *   supplied through RegisterService() will be triggered to provide the actual FixedChannel objects
+   * - If HCI connection failed, on_fail_callback will be triggered with FAIL_HCI_ERROR
+   * - If fixed channel on a remote device is already reported as connected via on_open_callback and has been acquired
+   *   via FixedChannel#Acquire() API, it won't be reported again
+   * - If no service is registered, on_fail_callback will be triggered with FAIL_NO_SERVICE_REGISTERED
+   * - If there is an ACL connection and channels for each service is allocated, on_fail_callback will be triggered with
+   *   FAIL_ALL_SERVICES_HAVE_CHANNEL
+   *
+   * NOTE:
+   * This call will initiate an effort to connect all fixed channel services on a remote device.
+   * Due to the connectionless nature of fixed channels, all fixed channels will be connected together.
+   * If a fixed channel service does not need a particular fixed channel. It should release the received
+   * channel immediately after receiving on_open_callback via FixedChannel#Release()
+   *
+   * A module calling ConnectServices() must have called RegisterService() before.
+   * The callback will come back from on_open_callback in the service that is registered
+   *
+   * @param address_with_type: Remote device with type to make this connection.
+   * @param address_type: Address type of remote device
+   * @param on_fail_callback: A callback to indicate connection failure along with a status code.
+   * @param handler: The handler context in which to execute the @callback parameters.
+   *
+   * Returns: true if connection was able to be initiated, false otherwise.
+   */
+  bool ConnectServices(hci::AddressWithType address_with_type, OnConnectionFailureCallback on_fail_callback,
+                       os::Handler* handler);
+
+  /**
+   * Register a service to receive incoming connections bound to a specific channel.
+   *
+   * - This method is asynchronous.
+   * - When false is returned, the registration fails immediately.
+   * - When true is returned, method caller should wait for on_service_registered callback that contains a
+   *   FixedChannelService object. The registered service can be managed from that object.
+   * - If a CID is already registered or some other error happens, on_registration_complete will be triggered with a
+   *   non-SUCCESS value
+   * - After a service is registered, any classic ACL connection will create a FixedChannel object that is
+   *   delivered through on_open_callback
+   * - on_open_callback, will only be triggered after on_service_registered callback
+   *
+   * @param cid:  cid used to receive incoming connections
+   * @param security_policy: The security policy used for the connection.
+   * @param on_registration_complete: A callback to indicate the service setup has completed. If the return status is
+   *        not SUCCESS, it means service is not registered due to reasons like CID already take
+   * @param on_open_callback: A callback to indicate success of a connection initiated from a remote device.
+   * @param handler: The handler context in which to execute the @callback parameter.
+   */
+  bool RegisterService(Cid cid, const SecurityPolicy& security_policy,
+                       OnRegistrationCompleteCallback on_registration_complete,
+                       OnConnectionOpenCallback on_connection_open, os::Handler* handler);
+
+  friend class L2capLeModule;
+
+ private:
+  // The constructor is not to be used by user code
+  FixedChannelManager(internal::FixedChannelServiceManagerImpl* service_manager, internal::LinkManager* link_manager,
+                      os::Handler* l2cap_layer_handler)
+      : service_manager_(service_manager), link_manager_(link_manager), l2cap_layer_handler_(l2cap_layer_handler) {}
+  internal::FixedChannelServiceManagerImpl* service_manager_ = nullptr;
+  internal::LinkManager* link_manager_ = nullptr;
+  os::Handler* l2cap_layer_handler_ = nullptr;
+  DISALLOW_COPY_AND_ASSIGN(FixedChannelManager);
+};
+
+}  // namespace le
+}  // namespace l2cap
+}  // namespace bluetooth
diff --git a/gd/l2cap/le/fixed_channel_service.cc b/gd/l2cap/le/fixed_channel_service.cc
new file mode 100644
index 0000000..888a741
--- /dev/null
+++ b/gd/l2cap/le/fixed_channel_service.cc
@@ -0,0 +1,33 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "l2cap/le/fixed_channel_service.h"
+#include "l2cap/le/internal/fixed_channel_service_manager_impl.h"
+
+namespace bluetooth {
+namespace l2cap {
+namespace le {
+
+void FixedChannelService::Unregister(OnUnregisteredCallback on_unregistered, os::Handler* on_unregistered_handler) {
+  ASSERT_LOG(manager_ != nullptr, "this service is invalid");
+  l2cap_layer_handler_->Post(common::BindOnce(&internal::FixedChannelServiceManagerImpl::Unregister,
+                                              common::Unretained(manager_), cid_, std::move(on_unregistered),
+                                              on_unregistered_handler));
+}
+
+}  // namespace le
+}  // namespace l2cap
+}  // namespace bluetooth
\ No newline at end of file
diff --git a/gd/l2cap/le/fixed_channel_service.h b/gd/l2cap/le/fixed_channel_service.h
new file mode 100644
index 0000000..0c4556e
--- /dev/null
+++ b/gd/l2cap/le/fixed_channel_service.h
@@ -0,0 +1,59 @@
+
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+#pragma once
+
+#include "common/callback.h"
+#include "hci/address.h"
+#include "l2cap/cid.h"
+#include "os/handler.h"
+
+namespace bluetooth {
+namespace l2cap {
+namespace le {
+
+namespace internal {
+class FixedChannelServiceManagerImpl;
+}
+
+class FixedChannelService {
+ public:
+  FixedChannelService() = default;
+
+  using OnUnregisteredCallback = common::OnceCallback<void()>;
+
+  /**
+   * Unregister a service from L2CAP module. This operation cannot fail.
+   * All channels opened for this service will be invalidated.
+   *
+   * @param on_unregistered will be triggered when unregistration is complete
+   */
+  void Unregister(OnUnregisteredCallback on_unregistered, os::Handler* on_unregistered_handler);
+
+  friend internal::FixedChannelServiceManagerImpl;
+
+ private:
+  FixedChannelService(Cid cid, internal::FixedChannelServiceManagerImpl* manager, os::Handler* handler)
+      : cid_(cid), manager_(manager), l2cap_layer_handler_(handler) {}
+  Cid cid_ = kInvalidCid;
+  internal::FixedChannelServiceManagerImpl* manager_ = nullptr;
+  os::Handler* l2cap_layer_handler_;
+  DISALLOW_COPY_AND_ASSIGN(FixedChannelService);
+};
+
+}  // namespace le
+}  // namespace l2cap
+}  // namespace bluetooth
diff --git a/gd/l2cap/le/internal/fixed_channel_impl.cc b/gd/l2cap/le/internal/fixed_channel_impl.cc
new file mode 100644
index 0000000..4833ae0
--- /dev/null
+++ b/gd/l2cap/le/internal/fixed_channel_impl.cc
@@ -0,0 +1,105 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <unordered_map>
+
+#include "l2cap/cid.h"
+#include "l2cap/le/internal/fixed_channel_impl.h"
+#include "l2cap/le/internal/link.h"
+#include "l2cap/security_policy.h"
+#include "os/handler.h"
+#include "os/log.h"
+
+namespace bluetooth {
+namespace l2cap {
+namespace le {
+namespace internal {
+
+hci::Role FixedChannelImpl::GetRole() const {
+  return link_->GetRole();
+}
+
+FixedChannelImpl::FixedChannelImpl(Cid cid, Link* link, os::Handler* l2cap_handler)
+    : cid_(cid), device_(link->GetDevice()), link_(link), l2cap_handler_(l2cap_handler) {
+  ASSERT_LOG(cid_ >= kFirstFixedChannel && cid_ <= kLastFixedChannel, "Invalid cid: %d", cid_);
+  ASSERT(!device_.GetAddress().IsEmpty());
+  ASSERT(link_ != nullptr);
+  ASSERT(l2cap_handler_ != nullptr);
+}
+
+void FixedChannelImpl::RegisterOnCloseCallback(os::Handler* user_handler,
+                                               FixedChannel::OnCloseCallback on_close_callback) {
+  ASSERT_LOG(user_handler_ == nullptr, "OnCloseCallback can only be registered once");
+  // If channel is already closed, call the callback immediately without saving it
+  if (closed_) {
+    user_handler->Post(common::BindOnce(std::move(on_close_callback), close_reason_));
+    return;
+  }
+  user_handler_ = user_handler;
+  on_close_callback_ = std::move(on_close_callback);
+}
+
+void FixedChannelImpl::OnClosed(hci::ErrorCode status) {
+  ASSERT_LOG(!closed_, "Device %s Cid 0x%x closed twice, old status 0x%x, new status 0x%x", device_.ToString().c_str(),
+             cid_, static_cast<int>(close_reason_), static_cast<int>(status));
+  closed_ = true;
+  close_reason_ = status;
+  acquired_ = false;
+  link_ = nullptr;
+  l2cap_handler_ = nullptr;
+  if (user_handler_ == nullptr) {
+    return;
+  }
+  // On close callback can only be called once
+  user_handler_->Post(common::BindOnce(std::move(on_close_callback_), status));
+  user_handler_ = nullptr;
+  on_close_callback_.Reset();
+}
+
+void FixedChannelImpl::Acquire() {
+  ASSERT_LOG(user_handler_ != nullptr, "Must register OnCloseCallback before calling any methods");
+  if (closed_) {
+    LOG_WARN("%s is already closed", ToString().c_str());
+    ASSERT(!acquired_);
+    return;
+  }
+  if (acquired_) {
+    LOG_DEBUG("%s was already acquired", ToString().c_str());
+    return;
+  }
+  acquired_ = true;
+  link_->RefreshRefCount();
+}
+
+void FixedChannelImpl::Release() {
+  ASSERT_LOG(user_handler_ != nullptr, "Must register OnCloseCallback before calling any methods");
+  if (closed_) {
+    LOG_WARN("%s is already closed", ToString().c_str());
+    ASSERT(!acquired_);
+    return;
+  }
+  if (!acquired_) {
+    LOG_DEBUG("%s was already released", ToString().c_str());
+    return;
+  }
+  acquired_ = false;
+  link_->RefreshRefCount();
+}
+
+}  // namespace internal
+}  // namespace le
+}  // namespace l2cap
+}  // namespace bluetooth
diff --git a/gd/l2cap/le/internal/fixed_channel_impl.h b/gd/l2cap/le/internal/fixed_channel_impl.h
new file mode 100644
index 0000000..b75afb5
--- /dev/null
+++ b/gd/l2cap/le/internal/fixed_channel_impl.h
@@ -0,0 +1,99 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#pragma once
+
+#include "common/bidi_queue.h"
+#include "l2cap/cid.h"
+#include "l2cap/le/fixed_channel.h"
+#include "os/handler.h"
+#include "os/log.h"
+
+namespace bluetooth {
+namespace l2cap {
+namespace le {
+namespace internal {
+
+class Link;
+
+class FixedChannelImpl {
+ public:
+  FixedChannelImpl(Cid cid, Link* link, os::Handler* l2cap_handler);
+
+  virtual ~FixedChannelImpl() = default;
+
+  hci::AddressWithType GetDevice() const {
+    return device_;
+  }
+
+  /* Return the role we have in the associated link */
+  virtual hci::Role GetRole() const;
+
+  virtual void RegisterOnCloseCallback(os::Handler* user_handler, FixedChannel::OnCloseCallback on_close_callback);
+
+  virtual void Acquire();
+
+  virtual void Release();
+
+  virtual bool IsAcquired() const {
+    return acquired_;
+  }
+
+  virtual void OnClosed(hci::ErrorCode status);
+
+  virtual std::string ToString() {
+    std::ostringstream ss;
+    ss << "Device " << device_ << " Cid 0x" << std::hex << cid_;
+    return ss.str();
+  }
+
+  common::BidiQueueEnd<packet::BasePacketBuilder, packet::PacketView<packet::kLittleEndian>>* GetQueueUpEnd() {
+    return channel_queue_.GetUpEnd();
+  }
+
+  common::BidiQueueEnd<packet::PacketView<packet::kLittleEndian>, packet::BasePacketBuilder>* GetQueueDownEnd() {
+    return channel_queue_.GetDownEnd();
+  }
+
+ private:
+  // Constructor states
+  // For logging purpose only
+  const Cid cid_;
+  // For logging purpose only
+  const hci::AddressWithType device_;
+  // Needed to handle Acquire() and Release()
+  Link* link_;
+  os::Handler* l2cap_handler_;
+
+  // User supported states
+  os::Handler* user_handler_ = nullptr;
+  FixedChannel::OnCloseCallback on_close_callback_{};
+
+  // Internal states
+  bool acquired_ = false;
+  bool closed_ = false;
+  hci::ErrorCode close_reason_ = hci::ErrorCode::SUCCESS;
+  static constexpr size_t kChannelQueueSize = 10;
+  common::BidiQueue<packet::PacketView<packet::kLittleEndian>, packet::BasePacketBuilder> channel_queue_{
+      kChannelQueueSize};
+
+  DISALLOW_COPY_AND_ASSIGN(FixedChannelImpl);
+};
+
+}  // namespace internal
+}  // namespace le
+}  // namespace l2cap
+}  // namespace bluetooth
diff --git a/gd/l2cap/le/internal/fixed_channel_impl_mock.h b/gd/l2cap/le/internal/fixed_channel_impl_mock.h
new file mode 100644
index 0000000..5baa7e5
--- /dev/null
+++ b/gd/l2cap/le/internal/fixed_channel_impl_mock.h
@@ -0,0 +1,43 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+#pragma once
+
+#include "l2cap/le/internal/fixed_channel_impl.h"
+
+#include <gmock/gmock.h>
+
+// Unit test interfaces
+namespace bluetooth {
+namespace l2cap {
+namespace le {
+namespace internal {
+namespace testing {
+
+class MockFixedChannelImpl : public FixedChannelImpl {
+ public:
+  MOCK_METHOD(void, RegisterOnCloseCallback,
+              (os::Handler * user_handler, FixedChannel::OnCloseCallback on_close_callback), (override));
+  MOCK_METHOD(void, Acquire, (), (override));
+  MOCK_METHOD(void, Release, (), (override));
+  MOCK_METHOD(bool, IsAcquired, (), (override, const));
+  MOCK_METHOD(void, OnClosed, (hci::ErrorCode status), (override));
+};
+
+}  // namespace testing
+}  // namespace internal
+}  // namespace le
+}  // namespace l2cap
+}  // namespace bluetooth
\ No newline at end of file
diff --git a/gd/l2cap/le/internal/fixed_channel_impl_test.cc b/gd/l2cap/le/internal/fixed_channel_impl_test.cc
new file mode 100644
index 0000000..9874936
--- /dev/null
+++ b/gd/l2cap/le/internal/fixed_channel_impl_test.cc
@@ -0,0 +1,233 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+#include "l2cap/le/internal/fixed_channel_impl.h"
+
+#include "common/testing/bind_test_util.h"
+#include "l2cap/cid.h"
+#include "l2cap/internal/parameter_provider_mock.h"
+#include "l2cap/le/internal/link_mock.h"
+#include "os/handler.h"
+
+#include <gmock/gmock.h>
+#include <gtest/gtest.h>
+
+namespace bluetooth {
+namespace l2cap {
+namespace le {
+namespace internal {
+
+using hci::Address;
+using hci::AddressWithType;
+using l2cap::internal::testing::MockParameterProvider;
+using testing::MockLink;
+using ::testing::Return;
+
+class L2capLeFixedChannelImplTest : public ::testing::Test {
+ public:
+  static void SyncHandler(os::Handler* handler) {
+    std::promise<void> promise;
+    auto future = promise.get_future();
+    handler->Post(common::BindOnce(&std::promise<void>::set_value, common::Unretained(&promise)));
+    future.wait_for(std::chrono::milliseconds(3));
+  }
+
+ protected:
+  void SetUp() override {
+    thread_ = new os::Thread("test_thread", os::Thread::Priority::NORMAL);
+    l2cap_handler_ = new os::Handler(thread_);
+  }
+
+  void TearDown() override {
+    l2cap_handler_->Clear();
+    delete l2cap_handler_;
+    delete thread_;
+  }
+
+  os::Thread* thread_ = nullptr;
+  os::Handler* l2cap_handler_ = nullptr;
+};
+
+TEST_F(L2capLeFixedChannelImplTest, get_device) {
+  MockParameterProvider mock_parameter_provider;
+  MockLink mock_le_link(l2cap_handler_, &mock_parameter_provider);
+  AddressWithType device{{{0x01, 0x02, 0x03, 0x04, 0x05, 0x06}}, hci::AddressType::PUBLIC_DEVICE_ADDRESS};
+  EXPECT_CALL(mock_le_link, GetDevice()).WillRepeatedly(Return(device));
+  FixedChannelImpl fixed_channel_impl(kSmpBrCid, &mock_le_link, l2cap_handler_);
+  EXPECT_EQ(device, fixed_channel_impl.GetDevice());
+}
+
+TEST_F(L2capLeFixedChannelImplTest, close_triggers_callback) {
+  MockParameterProvider mock_parameter_provider;
+  MockLink mock_le_link(l2cap_handler_, &mock_parameter_provider);
+  AddressWithType device{{{0x01, 0x02, 0x03, 0x04, 0x05, 0x06}}, hci::AddressType::PUBLIC_DEVICE_ADDRESS};
+  EXPECT_CALL(mock_le_link, GetDevice()).WillRepeatedly(Return(device));
+  FixedChannelImpl fixed_channel_impl(kSmpBrCid, &mock_le_link, l2cap_handler_);
+
+  // Register on close callback
+  auto user_handler = std::make_unique<os::Handler>(thread_);
+  hci::ErrorCode my_status = hci::ErrorCode::SUCCESS;
+  fixed_channel_impl.RegisterOnCloseCallback(
+      user_handler.get(), common::testing::BindLambdaForTesting([&](hci::ErrorCode status) { my_status = status; }));
+
+  // Channel closure should trigger such callback
+  fixed_channel_impl.OnClosed(hci::ErrorCode::REMOTE_USER_TERMINATED_CONNECTION);
+  SyncHandler(user_handler.get());
+  EXPECT_EQ(hci::ErrorCode::REMOTE_USER_TERMINATED_CONNECTION, my_status);
+
+  user_handler->Clear();
+}
+
+TEST_F(L2capLeFixedChannelImplTest, register_callback_after_close_should_call_immediately) {
+  MockParameterProvider mock_parameter_provider;
+  MockLink mock_le_link(l2cap_handler_, &mock_parameter_provider);
+  AddressWithType device{{{0x01, 0x02, 0x03, 0x04, 0x05, 0x06}}, hci::AddressType::PUBLIC_DEVICE_ADDRESS};
+  EXPECT_CALL(mock_le_link, GetDevice()).WillRepeatedly(Return(device));
+  FixedChannelImpl fixed_channel_impl(kSmpBrCid, &mock_le_link, l2cap_handler_);
+
+  // Channel closure should do nothing
+  fixed_channel_impl.OnClosed(hci::ErrorCode::REMOTE_USER_TERMINATED_CONNECTION);
+
+  // Register on close callback should trigger callback immediately
+  auto user_handler = std::make_unique<os::Handler>(thread_);
+  hci::ErrorCode my_status = hci::ErrorCode::SUCCESS;
+  fixed_channel_impl.RegisterOnCloseCallback(
+      user_handler.get(), common::testing::BindLambdaForTesting([&](hci::ErrorCode status) { my_status = status; }));
+  SyncHandler(user_handler.get());
+  EXPECT_EQ(hci::ErrorCode::REMOTE_USER_TERMINATED_CONNECTION, my_status);
+
+  user_handler->Clear();
+}
+
+TEST_F(L2capLeFixedChannelImplTest, close_twice_should_fail) {
+  MockParameterProvider mock_parameter_provider;
+  MockLink mock_le_link(l2cap_handler_, &mock_parameter_provider);
+  AddressWithType device{{{0x01, 0x02, 0x03, 0x04, 0x05, 0x06}}, hci::AddressType::PUBLIC_DEVICE_ADDRESS};
+  EXPECT_CALL(mock_le_link, GetDevice()).WillRepeatedly(Return(device));
+  FixedChannelImpl fixed_channel_impl(kSmpBrCid, &mock_le_link, l2cap_handler_);
+
+  // Register on close callback
+  auto user_handler = std::make_unique<os::Handler>(thread_);
+  hci::ErrorCode my_status = hci::ErrorCode::SUCCESS;
+  fixed_channel_impl.RegisterOnCloseCallback(
+      user_handler.get(), common::testing::BindLambdaForTesting([&](hci::ErrorCode status) { my_status = status; }));
+
+  // Channel closure should trigger such callback
+  fixed_channel_impl.OnClosed(hci::ErrorCode::REMOTE_USER_TERMINATED_CONNECTION);
+  SyncHandler(user_handler.get());
+  EXPECT_EQ(hci::ErrorCode::REMOTE_USER_TERMINATED_CONNECTION, my_status);
+
+  // 2nd OnClose() callback should fail
+  EXPECT_DEATH(fixed_channel_impl.OnClosed(hci::ErrorCode::PAGE_TIMEOUT), ".*OnClosed.*");
+
+  user_handler->Clear();
+}
+
+TEST_F(L2capLeFixedChannelImplTest, multiple_registeration_should_fail) {
+  MockParameterProvider mock_parameter_provider;
+  MockLink mock_le_link(l2cap_handler_, &mock_parameter_provider);
+  AddressWithType device{{{0x01, 0x02, 0x03, 0x04, 0x05, 0x06}}, hci::AddressType::PUBLIC_DEVICE_ADDRESS};
+  EXPECT_CALL(mock_le_link, GetDevice()).WillRepeatedly(Return(device));
+  FixedChannelImpl fixed_channel_impl(kSmpBrCid, &mock_le_link, l2cap_handler_);
+
+  // Register on close callback
+  auto user_handler = std::make_unique<os::Handler>(thread_);
+  hci::ErrorCode my_status = hci::ErrorCode::SUCCESS;
+  fixed_channel_impl.RegisterOnCloseCallback(
+      user_handler.get(), common::testing::BindLambdaForTesting([&](hci::ErrorCode status) { my_status = status; }));
+
+  EXPECT_DEATH(fixed_channel_impl.RegisterOnCloseCallback(user_handler.get(),
+                                                          common::BindOnce([](hci::ErrorCode status) { FAIL(); })),
+               ".*RegisterOnCloseCallback.*");
+
+  user_handler->Clear();
+}
+
+TEST_F(L2capLeFixedChannelImplTest, call_acquire_before_registeration_should_fail) {
+  MockParameterProvider mock_parameter_provider;
+  MockLink mock_le_link(l2cap_handler_, &mock_parameter_provider);
+  AddressWithType device{{{0x01, 0x02, 0x03, 0x04, 0x05, 0x06}}, hci::AddressType::PUBLIC_DEVICE_ADDRESS};
+  EXPECT_CALL(mock_le_link, GetDevice()).WillRepeatedly(Return(device));
+  FixedChannelImpl fixed_channel_impl(kSmpBrCid, &mock_le_link, l2cap_handler_);
+  EXPECT_DEATH(fixed_channel_impl.Acquire(), ".*Acquire.*");
+}
+
+TEST_F(L2capLeFixedChannelImplTest, call_release_before_registeration_should_fail) {
+  MockParameterProvider mock_parameter_provider;
+  MockLink mock_le_link(l2cap_handler_, &mock_parameter_provider);
+  AddressWithType device{{{0x01, 0x02, 0x03, 0x04, 0x05, 0x06}}, hci::AddressType::PUBLIC_DEVICE_ADDRESS};
+  EXPECT_CALL(mock_le_link, GetDevice()).WillRepeatedly(Return(device));
+  FixedChannelImpl fixed_channel_impl(kSmpBrCid, &mock_le_link, l2cap_handler_);
+  EXPECT_DEATH(fixed_channel_impl.Release(), ".*Release.*");
+}
+
+TEST_F(L2capLeFixedChannelImplTest, test_acquire_release_channel) {
+  MockParameterProvider mock_parameter_provider;
+  MockLink mock_le_link(l2cap_handler_, &mock_parameter_provider);
+  AddressWithType device{{{0x01, 0x02, 0x03, 0x04, 0x05, 0x06}}, hci::AddressType::PUBLIC_DEVICE_ADDRESS};
+  EXPECT_CALL(mock_le_link, GetDevice()).WillRepeatedly(Return(device));
+  FixedChannelImpl fixed_channel_impl(kSmpBrCid, &mock_le_link, l2cap_handler_);
+
+  // Register on close callback
+  auto user_handler = std::make_unique<os::Handler>(thread_);
+  hci::ErrorCode my_status = hci::ErrorCode::SUCCESS;
+  fixed_channel_impl.RegisterOnCloseCallback(
+      user_handler.get(), common::testing::BindLambdaForTesting([&](hci::ErrorCode status) { my_status = status; }));
+
+  // Default should be false
+  EXPECT_FALSE(fixed_channel_impl.IsAcquired());
+
+  // Should be called 2 times after Acquire() and Release()
+  EXPECT_CALL(mock_le_link, RefreshRefCount()).Times(2);
+
+  fixed_channel_impl.Acquire();
+  EXPECT_TRUE(fixed_channel_impl.IsAcquired());
+
+  fixed_channel_impl.Release();
+  EXPECT_FALSE(fixed_channel_impl.IsAcquired());
+
+  user_handler->Clear();
+}
+
+TEST_F(L2capLeFixedChannelImplTest, test_acquire_after_close) {
+  MockParameterProvider mock_parameter_provider;
+  MockLink mock_le_link(l2cap_handler_, &mock_parameter_provider);
+  AddressWithType device{{{0x01, 0x02, 0x03, 0x04, 0x05, 0x06}}, hci::AddressType::PUBLIC_DEVICE_ADDRESS};
+  EXPECT_CALL(mock_le_link, GetDevice()).WillRepeatedly(Return(device));
+  FixedChannelImpl fixed_channel_impl(kSmpBrCid, &mock_le_link, l2cap_handler_);
+
+  // Register on close callback
+  auto user_handler = std::make_unique<os::Handler>(thread_);
+  hci::ErrorCode my_status = hci::ErrorCode::SUCCESS;
+  fixed_channel_impl.RegisterOnCloseCallback(
+      user_handler.get(), common::testing::BindLambdaForTesting([&](hci::ErrorCode status) { my_status = status; }));
+
+  // Channel closure should trigger such callback
+  fixed_channel_impl.OnClosed(hci::ErrorCode::REMOTE_USER_TERMINATED_CONNECTION);
+  SyncHandler(user_handler.get());
+  EXPECT_EQ(hci::ErrorCode::REMOTE_USER_TERMINATED_CONNECTION, my_status);
+
+  // Release or Acquire after closing should crash
+  EXPECT_CALL(mock_le_link, RefreshRefCount()).Times(0);
+  EXPECT_FALSE(fixed_channel_impl.IsAcquired());
+  EXPECT_DEATH(fixed_channel_impl.Acquire(), ".*Acquire.*");
+
+  user_handler->Clear();
+}
+
+}  // namespace internal
+}  // namespace le
+}  // namespace l2cap
+}  // namespace bluetooth
diff --git a/gd/l2cap/le/internal/fixed_channel_service_impl.h b/gd/l2cap/le/internal/fixed_channel_service_impl.h
new file mode 100644
index 0000000..5eed777
--- /dev/null
+++ b/gd/l2cap/le/internal/fixed_channel_service_impl.h
@@ -0,0 +1,58 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#pragma once
+
+#include "l2cap/le/fixed_channel.h"
+#include "l2cap/le/fixed_channel_manager.h"
+#include "l2cap/le/fixed_channel_service.h"
+
+namespace bluetooth {
+namespace l2cap {
+namespace le {
+namespace internal {
+
+class FixedChannelServiceImpl {
+ public:
+  virtual ~FixedChannelServiceImpl() = default;
+
+  struct PendingRegistration {
+    os::Handler* user_handler_ = nullptr;
+    FixedChannelManager::OnRegistrationCompleteCallback on_registration_complete_callback_;
+    FixedChannelManager::OnConnectionOpenCallback on_connection_open_callback_;
+  };
+
+  virtual void NotifyChannelCreation(std::unique_ptr<FixedChannel> channel) {
+    user_handler_->Post(common::BindOnce(on_connection_open_callback_, std::move(channel)));
+  }
+
+  friend class FixedChannelServiceManagerImpl;
+
+ protected:
+  // protected access for mocking
+  FixedChannelServiceImpl(os::Handler* user_handler,
+                          FixedChannelManager::OnConnectionOpenCallback on_connection_open_callback)
+      : user_handler_(user_handler), on_connection_open_callback_(std::move(on_connection_open_callback)) {}
+
+ private:
+  os::Handler* user_handler_ = nullptr;
+  FixedChannelManager::OnConnectionOpenCallback on_connection_open_callback_;
+};
+
+}  // namespace internal
+}  // namespace le
+}  // namespace l2cap
+}  // namespace bluetooth
diff --git a/gd/l2cap/le/internal/fixed_channel_service_impl_mock.h b/gd/l2cap/le/internal/fixed_channel_service_impl_mock.h
new file mode 100644
index 0000000..5a1b65d
--- /dev/null
+++ b/gd/l2cap/le/internal/fixed_channel_service_impl_mock.h
@@ -0,0 +1,40 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+#pragma once
+
+#include "l2cap/le/internal/fixed_channel_impl.h"
+#include "l2cap/le/internal/fixed_channel_service_manager_impl.h"
+
+#include <gmock/gmock.h>
+
+// Unit test interfaces
+namespace bluetooth {
+namespace l2cap {
+namespace le {
+namespace internal {
+namespace testing {
+
+class MockFixedChannelServiceImpl : public FixedChannelServiceImpl {
+ public:
+  MockFixedChannelServiceImpl() : FixedChannelServiceImpl(nullptr, FixedChannelManager::OnConnectionOpenCallback()) {}
+  MOCK_METHOD(void, NotifyChannelCreation, (std::unique_ptr<FixedChannel> channel), (override));
+};
+
+}  // namespace testing
+}  // namespace internal
+}  // namespace le
+}  // namespace l2cap
+}  // namespace bluetooth
\ No newline at end of file
diff --git a/gd/l2cap/le/internal/fixed_channel_service_manager_impl.cc b/gd/l2cap/le/internal/fixed_channel_service_manager_impl.cc
new file mode 100644
index 0000000..3a2de00
--- /dev/null
+++ b/gd/l2cap/le/internal/fixed_channel_service_manager_impl.cc
@@ -0,0 +1,82 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "l2cap/le/internal/fixed_channel_service_manager_impl.h"
+
+#include "common/bind.h"
+#include "l2cap/cid.h"
+#include "l2cap/le/internal/fixed_channel_service_impl.h"
+#include "os/log.h"
+
+namespace bluetooth {
+namespace l2cap {
+namespace le {
+namespace internal {
+
+void FixedChannelServiceManagerImpl::Register(Cid cid,
+                                              FixedChannelServiceImpl::PendingRegistration pending_registration) {
+  if (cid < kFirstFixedChannel || cid > kLastFixedChannel || cid == kLeSignallingCid) {
+    std::unique_ptr<FixedChannelService> invalid_service(new FixedChannelService());
+    pending_registration.user_handler_->Post(
+        common::BindOnce(std::move(pending_registration.on_registration_complete_callback_),
+                         FixedChannelManager::RegistrationResult::FAIL_INVALID_SERVICE, std::move(invalid_service)));
+  } else if (IsServiceRegistered(cid)) {
+    std::unique_ptr<FixedChannelService> invalid_service(new FixedChannelService());
+    pending_registration.user_handler_->Post(
+        common::BindOnce(std::move(pending_registration.on_registration_complete_callback_),
+                         FixedChannelManager::RegistrationResult::FAIL_DUPLICATE_SERVICE, std::move(invalid_service)));
+  } else {
+    service_map_.try_emplace(cid,
+                             FixedChannelServiceImpl(pending_registration.user_handler_,
+                                                     std::move(pending_registration.on_connection_open_callback_)));
+    std::unique_ptr<FixedChannelService> user_service(new FixedChannelService(cid, this, l2cap_layer_handler_));
+    pending_registration.user_handler_->Post(
+        common::BindOnce(std::move(pending_registration.on_registration_complete_callback_),
+                         FixedChannelManager::RegistrationResult::SUCCESS, std::move(user_service)));
+  }
+}
+
+void FixedChannelServiceManagerImpl::Unregister(Cid cid, FixedChannelService::OnUnregisteredCallback callback,
+                                                os::Handler* handler) {
+  if (IsServiceRegistered(cid)) {
+    service_map_.erase(cid);
+    handler->Post(std::move(callback));
+  } else {
+    LOG_ERROR("service not registered cid:%d", cid);
+  }
+}
+
+bool FixedChannelServiceManagerImpl::IsServiceRegistered(Cid cid) const {
+  return service_map_.find(cid) != service_map_.end();
+}
+
+FixedChannelServiceImpl* FixedChannelServiceManagerImpl::GetService(Cid cid) {
+  ASSERT(IsServiceRegistered(cid));
+  return &service_map_.find(cid)->second;
+}
+
+std::vector<std::pair<Cid, FixedChannelServiceImpl*>> FixedChannelServiceManagerImpl::GetRegisteredServices() {
+  std::vector<std::pair<Cid, FixedChannelServiceImpl*>> results;
+  for (auto& elem : service_map_) {
+    results.emplace_back(elem.first, &elem.second);
+  }
+  return results;
+}
+
+}  // namespace internal
+}  // namespace le
+}  // namespace l2cap
+}  // namespace bluetooth
diff --git a/gd/l2cap/le/internal/fixed_channel_service_manager_impl.h b/gd/l2cap/le/internal/fixed_channel_service_manager_impl.h
new file mode 100644
index 0000000..d57c192
--- /dev/null
+++ b/gd/l2cap/le/internal/fixed_channel_service_manager_impl.h
@@ -0,0 +1,52 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#pragma once
+
+#include <unordered_map>
+
+#include "l2cap/cid.h"
+#include "l2cap/le/fixed_channel_service.h"
+#include "l2cap/le/internal/fixed_channel_service_impl.h"
+#include "os/handler.h"
+
+namespace bluetooth {
+namespace l2cap {
+namespace le {
+namespace internal {
+
+class FixedChannelServiceManagerImpl {
+ public:
+  explicit FixedChannelServiceManagerImpl(os::Handler* l2cap_layer_handler)
+      : l2cap_layer_handler_(l2cap_layer_handler) {}
+  virtual ~FixedChannelServiceManagerImpl() = default;
+
+  // All APIs must be invoked in L2CAP layer handler
+
+  virtual void Register(Cid cid, FixedChannelServiceImpl::PendingRegistration pending_registration);
+  virtual void Unregister(Cid cid, FixedChannelService::OnUnregisteredCallback callback, os::Handler* handler);
+  virtual bool IsServiceRegistered(Cid cid) const;
+  virtual FixedChannelServiceImpl* GetService(Cid cid);
+  virtual std::vector<std::pair<Cid, FixedChannelServiceImpl*>> GetRegisteredServices();
+
+ private:
+  os::Handler* l2cap_layer_handler_ = nullptr;
+  std::unordered_map<Cid, FixedChannelServiceImpl> service_map_;
+};
+}  // namespace internal
+}  // namespace le
+}  // namespace l2cap
+}  // namespace bluetooth
diff --git a/gd/l2cap/le/internal/fixed_channel_service_manager_impl_mock.h b/gd/l2cap/le/internal/fixed_channel_service_manager_impl_mock.h
new file mode 100644
index 0000000..068599b
--- /dev/null
+++ b/gd/l2cap/le/internal/fixed_channel_service_manager_impl_mock.h
@@ -0,0 +1,45 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+#pragma once
+
+#include "l2cap/le/internal/fixed_channel_impl.h"
+#include "l2cap/le/internal/fixed_channel_service_manager_impl.h"
+
+#include <gmock/gmock.h>
+
+// Unit test interfaces
+namespace bluetooth {
+namespace l2cap {
+namespace le {
+namespace internal {
+namespace testing {
+
+class MockFixedChannelServiceManagerImpl : public FixedChannelServiceManagerImpl {
+ public:
+  MockFixedChannelServiceManagerImpl() : FixedChannelServiceManagerImpl(nullptr) {}
+  MOCK_METHOD(void, Register, (Cid cid, FixedChannelServiceImpl::PendingRegistration pending_registration), (override));
+  MOCK_METHOD(void, Unregister, (Cid cid, FixedChannelService::OnUnregisteredCallback callback, os::Handler* handler),
+              (override));
+  MOCK_METHOD(bool, IsServiceRegistered, (Cid cid), (const, override));
+  MOCK_METHOD(FixedChannelServiceImpl*, GetService, (Cid cid), (override));
+  MOCK_METHOD((std::vector<std::pair<Cid, FixedChannelServiceImpl*>>), GetRegisteredServices, (), (override));
+};
+
+}  // namespace testing
+}  // namespace internal
+}  // namespace le
+}  // namespace l2cap
+}  // namespace bluetooth
\ No newline at end of file
diff --git a/gd/l2cap/le/internal/fixed_channel_service_manager_test.cc b/gd/l2cap/le/internal/fixed_channel_service_manager_test.cc
new file mode 100644
index 0000000..030933c
--- /dev/null
+++ b/gd/l2cap/le/internal/fixed_channel_service_manager_test.cc
@@ -0,0 +1,104 @@
+/*
+ * Copyright 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "l2cap/le/internal/fixed_channel_service_manager_impl.h"
+
+#include <future>
+
+#include "common/bind.h"
+#include "l2cap/cid.h"
+#include "l2cap/le/fixed_channel_manager.h"
+#include "l2cap/le/fixed_channel_service.h"
+#include "os/handler.h"
+#include "os/thread.h"
+
+#include <gtest/gtest.h>
+
+namespace bluetooth {
+namespace l2cap {
+namespace le {
+namespace internal {
+
+class L2capLeServiceManagerTest : public ::testing::Test {
+ public:
+  ~L2capLeServiceManagerTest() override = default;
+
+  void OnServiceRegistered(bool expect_success, FixedChannelManager::RegistrationResult result,
+                           std::unique_ptr<FixedChannelService> user_service) {
+    EXPECT_EQ(result == FixedChannelManager::RegistrationResult::SUCCESS, expect_success);
+    service_registered_ = expect_success;
+  }
+
+ protected:
+  void SetUp() override {
+    manager_ = new FixedChannelServiceManagerImpl{nullptr};
+    thread_ = new os::Thread("test_thread", os::Thread::Priority::NORMAL);
+    user_handler_ = new os::Handler(thread_);
+  }
+
+  void TearDown() override {
+    user_handler_->Clear();
+    delete user_handler_;
+    delete thread_;
+    delete manager_;
+  }
+
+  void sync_user_handler() {
+    std::promise<void> promise;
+    auto future = promise.get_future();
+    user_handler_->Post(common::BindOnce(&std::promise<void>::set_value, common::Unretained(&promise)));
+    future.wait_for(std::chrono::milliseconds(3));
+  }
+
+  FixedChannelServiceManagerImpl* manager_ = nullptr;
+  os::Thread* thread_ = nullptr;
+  os::Handler* user_handler_ = nullptr;
+
+  bool service_registered_ = false;
+};
+
+TEST_F(L2capLeServiceManagerTest, register_and_unregister_le_fixed_channel) {
+  FixedChannelServiceImpl::PendingRegistration pending_registration{
+      .user_handler_ = user_handler_,
+      .on_registration_complete_callback_ =
+          common::BindOnce(&L2capLeServiceManagerTest::OnServiceRegistered, common::Unretained(this), true)};
+  Cid cid = kSmpBrCid;
+  EXPECT_FALSE(manager_->IsServiceRegistered(cid));
+  manager_->Register(cid, std::move(pending_registration));
+  EXPECT_TRUE(manager_->IsServiceRegistered(cid));
+  sync_user_handler();
+  EXPECT_TRUE(service_registered_);
+  manager_->Unregister(cid, common::BindOnce([] {}), user_handler_);
+  EXPECT_FALSE(manager_->IsServiceRegistered(cid));
+}
+
+TEST_F(L2capLeServiceManagerTest, register_le_fixed_channel_bad_cid) {
+  FixedChannelServiceImpl::PendingRegistration pending_registration{
+      .user_handler_ = user_handler_,
+      .on_registration_complete_callback_ =
+          common::BindOnce(&L2capLeServiceManagerTest::OnServiceRegistered, common::Unretained(this), false)};
+  Cid cid = 0x1000;
+  EXPECT_FALSE(manager_->IsServiceRegistered(cid));
+  manager_->Register(cid, std::move(pending_registration));
+  EXPECT_FALSE(manager_->IsServiceRegistered(cid));
+  sync_user_handler();
+  EXPECT_FALSE(service_registered_);
+}
+
+}  // namespace internal
+}  // namespace le
+}  // namespace l2cap
+}  // namespace bluetooth
diff --git a/gd/l2cap/le/internal/link.h b/gd/l2cap/le/internal/link.h
new file mode 100644
index 0000000..85f0280
--- /dev/null
+++ b/gd/l2cap/le/internal/link.h
@@ -0,0 +1,106 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#pragma once
+
+#include <chrono>
+#include <memory>
+
+#include "hci/acl_manager.h"
+#include "l2cap/internal/fixed_channel_allocator.h"
+#include "l2cap/internal/parameter_provider.h"
+#include "l2cap/internal/scheduler.h"
+#include "l2cap/le/internal/fixed_channel_impl.h"
+#include "os/alarm.h"
+
+namespace bluetooth {
+namespace l2cap {
+namespace le {
+namespace internal {
+
+class Link {
+ public:
+  Link(os::Handler* l2cap_handler, std::unique_ptr<hci::AclConnection> acl_connection,
+       std::unique_ptr<l2cap::internal::Scheduler> scheduler, l2cap::internal::ParameterProvider* parameter_provider)
+      : l2cap_handler_(l2cap_handler), acl_connection_(std::move(acl_connection)), scheduler_(std::move(scheduler)),
+        parameter_provider_(parameter_provider) {
+    ASSERT(l2cap_handler_ != nullptr);
+    ASSERT(acl_connection_ != nullptr);
+    ASSERT(scheduler_ != nullptr);
+    ASSERT(parameter_provider_ != nullptr);
+    link_idle_disconnect_alarm_.Schedule(common::BindOnce(&Link::Disconnect, common::Unretained(this)),
+                                         parameter_provider_->GetLeLinkIdleDisconnectTimeout());
+  }
+
+  virtual ~Link() = default;
+
+  inline virtual hci::AddressWithType GetDevice() {
+    return {acl_connection_->GetAddress(), acl_connection_->GetAddressType()};
+  }
+
+  inline virtual hci::Role GetRole() {
+    return acl_connection_->GetRole();
+  }
+
+  // ACL methods
+
+  virtual void OnAclDisconnected(hci::ErrorCode status) {
+    fixed_channel_allocator_.OnAclDisconnected(status);
+  }
+
+  virtual void Disconnect() {
+    acl_connection_->Disconnect(hci::DisconnectReason::REMOTE_USER_TERMINATED_CONNECTION);
+  }
+
+  // FixedChannel methods
+
+  virtual std::shared_ptr<FixedChannelImpl> AllocateFixedChannel(Cid cid, SecurityPolicy security_policy) {
+    auto channel = fixed_channel_allocator_.AllocateChannel(cid, security_policy);
+    scheduler_->AttachChannel(cid, channel->GetQueueDownEnd(), cid);
+    return channel;
+  }
+
+  virtual bool IsFixedChannelAllocated(Cid cid) {
+    return fixed_channel_allocator_.IsChannelAllocated(cid);
+  }
+
+  // Check how many channels are acquired or in use, if zero, start tear down timer, if non-zero, cancel tear down timer
+  virtual void RefreshRefCount() {
+    int ref_count = 0;
+    ref_count += fixed_channel_allocator_.GetRefCount();
+    ASSERT_LOG(ref_count >= 0, "ref_count %d is less than 0", ref_count);
+    if (ref_count > 0) {
+      link_idle_disconnect_alarm_.Cancel();
+    } else {
+      link_idle_disconnect_alarm_.Schedule(common::BindOnce(&Link::Disconnect, common::Unretained(this)),
+                                           parameter_provider_->GetLeLinkIdleDisconnectTimeout());
+    }
+  }
+
+ private:
+  os::Handler* l2cap_handler_;
+  l2cap::internal::FixedChannelAllocator<FixedChannelImpl, Link> fixed_channel_allocator_{this, l2cap_handler_};
+  std::unique_ptr<hci::AclConnection> acl_connection_;
+  std::unique_ptr<l2cap::internal::Scheduler> scheduler_;
+  l2cap::internal::ParameterProvider* parameter_provider_;
+  os::Alarm link_idle_disconnect_alarm_{l2cap_handler_};
+  DISALLOW_COPY_AND_ASSIGN(Link);
+};
+
+}  // namespace internal
+}  // namespace le
+}  // namespace l2cap
+}  // namespace bluetooth
diff --git a/gd/l2cap/le/internal/link_manager.cc b/gd/l2cap/le/internal/link_manager.cc
new file mode 100644
index 0000000..989cf3d
--- /dev/null
+++ b/gd/l2cap/le/internal/link_manager.cc
@@ -0,0 +1,152 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+#include <memory>
+#include <unordered_map>
+
+#include "hci/acl_manager.h"
+#include "hci/address.h"
+#include "l2cap/internal/scheduler_fifo.h"
+#include "l2cap/le/internal/link.h"
+#include "os/handler.h"
+#include "os/log.h"
+
+#include "l2cap/le/internal/link_manager.h"
+
+namespace bluetooth {
+namespace l2cap {
+namespace le {
+namespace internal {
+
+void LinkManager::ConnectFixedChannelServices(hci::AddressWithType address_with_type,
+                                              PendingFixedChannelConnection pending_fixed_channel_connection) {
+  // Check if there is any service registered
+  auto fixed_channel_services = service_manager_->GetRegisteredServices();
+  if (fixed_channel_services.empty()) {
+    // If so, return error
+    pending_fixed_channel_connection.handler_->Post(common::BindOnce(
+        std::move(pending_fixed_channel_connection.on_fail_callback_),
+        FixedChannelManager::ConnectionResult{
+            .connection_result_code = FixedChannelManager::ConnectionResultCode::FAIL_NO_SERVICE_REGISTERED}));
+    return;
+  }
+  // Otherwise, check if device has an ACL connection
+  auto* link = GetLink(address_with_type);
+  if (link != nullptr) {
+    // If device already have an ACL connection
+    // Check if all registered services have an allocated channel and allocate one if not already allocated
+    int num_new_channels = 0;
+    for (auto& fixed_channel_service : fixed_channel_services) {
+      if (link->IsFixedChannelAllocated(fixed_channel_service.first)) {
+        // This channel is already allocated for this link, do not allocated twice
+        continue;
+      }
+      // Allocate channel for newly registered fixed channels
+      auto fixed_channel_impl = link->AllocateFixedChannel(fixed_channel_service.first, SecurityPolicy());
+      fixed_channel_service.second->NotifyChannelCreation(
+          std::make_unique<FixedChannel>(fixed_channel_impl, l2cap_handler_));
+      num_new_channels++;
+    }
+    // Declare connection failure if no new channels are created
+    if (num_new_channels == 0) {
+      pending_fixed_channel_connection.handler_->Post(common::BindOnce(
+          std::move(pending_fixed_channel_connection.on_fail_callback_),
+          FixedChannelManager::ConnectionResult{
+              .connection_result_code = FixedChannelManager::ConnectionResultCode::FAIL_ALL_SERVICES_HAVE_CHANNEL}));
+    }
+    // No need to create ACL connection, return without saving any pending connections
+    return;
+  }
+  // If not, create new ACL connection
+  // Add request to pending link list first
+  auto pending_link = pending_links_.find(address_with_type);
+  if (pending_link == pending_links_.end()) {
+    // Create pending link if not exist
+    pending_links_.try_emplace(address_with_type);
+    pending_link = pending_links_.find(address_with_type);
+  }
+  pending_link->second.pending_fixed_channel_connections_.push_back(std::move(pending_fixed_channel_connection));
+  // Then create new ACL connection
+  acl_manager_->CreateLeConnection(address_with_type);
+}
+
+Link* LinkManager::GetLink(hci::AddressWithType address_with_type) {
+  if (links_.find(address_with_type) == links_.end()) {
+    return nullptr;
+  }
+  return &links_.find(address_with_type)->second;
+}
+
+void LinkManager::OnLeConnectSuccess(hci::AddressWithType connecting_address_with_type,
+                                     std::unique_ptr<hci::AclConnection> acl_connection) {
+  // Same link should not be connected twice
+  hci::AddressWithType connected_address_with_type(acl_connection->GetAddress(), acl_connection->GetAddressType());
+  ASSERT_LOG(GetLink(connected_address_with_type) == nullptr, "%s is connected twice without disconnection",
+             acl_connection->GetAddress().ToString().c_str());
+  auto* link_queue_up_end = acl_connection->GetAclQueueEnd();
+  // Register ACL disconnection callback in LinkManager so that we can clean up link resource properly
+  acl_connection->RegisterDisconnectCallback(
+      common::BindOnce(&LinkManager::OnDisconnect, common::Unretained(this), connected_address_with_type),
+      l2cap_handler_);
+  links_.try_emplace(connected_address_with_type, l2cap_handler_, std::move(acl_connection),
+                     std::make_unique<l2cap::internal::Fifo>(link_queue_up_end, l2cap_handler_), parameter_provider_);
+  auto* link = GetLink(connected_address_with_type);
+  // Allocate and distribute channels for all registered fixed channel services
+  auto fixed_channel_services = service_manager_->GetRegisteredServices();
+  for (auto& fixed_channel_service : fixed_channel_services) {
+    auto fixed_channel_impl = link->AllocateFixedChannel(fixed_channel_service.first, SecurityPolicy());
+    fixed_channel_service.second->NotifyChannelCreation(
+        std::make_unique<FixedChannel>(fixed_channel_impl, l2cap_handler_));
+  }
+  // Remove device from pending links list, if any
+  auto pending_link = pending_links_.find(connecting_address_with_type);
+  if (pending_link == pending_links_.end()) {
+    // This an incoming connection, exit
+    return;
+  }
+  // This is an outgoing connection, remove entry in pending link list
+  pending_links_.erase(pending_link);
+}
+
+void LinkManager::OnLeConnectFail(hci::AddressWithType address_with_type, hci::ErrorCode reason) {
+  // Notify all pending links for this device
+  auto pending_link = pending_links_.find(address_with_type);
+  if (pending_link == pending_links_.end()) {
+    // There is no pending link, exit
+    LOG_DEBUG("Connection to %s failed without a pending link", address_with_type.ToString().c_str());
+    return;
+  }
+  for (auto& pending_fixed_channel_connection : pending_link->second.pending_fixed_channel_connections_) {
+    pending_fixed_channel_connection.handler_->Post(common::BindOnce(
+        std::move(pending_fixed_channel_connection.on_fail_callback_),
+        FixedChannelManager::ConnectionResult{
+            .connection_result_code = FixedChannelManager::ConnectionResultCode::FAIL_HCI_ERROR, .hci_error = reason}));
+  }
+  // Remove entry in pending link list
+  pending_links_.erase(pending_link);
+}
+
+void LinkManager::OnDisconnect(hci::AddressWithType address_with_type, hci::ErrorCode status) {
+  auto* link = GetLink(address_with_type);
+  ASSERT_LOG(link != nullptr, "Device %s is disconnected with reason 0x%x, but not in local database",
+             address_with_type.ToString().c_str(), static_cast<uint8_t>(status));
+  link->OnAclDisconnected(status);
+  links_.erase(address_with_type);
+}
+
+}  // namespace internal
+}  // namespace le
+}  // namespace l2cap
+}  // namespace bluetooth
diff --git a/gd/l2cap/le/internal/link_manager.h b/gd/l2cap/le/internal/link_manager.h
new file mode 100644
index 0000000..f318b83
--- /dev/null
+++ b/gd/l2cap/le/internal/link_manager.h
@@ -0,0 +1,86 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#pragma once
+
+#include <memory>
+#include <unordered_map>
+#include <utility>
+
+#include "os/handler.h"
+
+#include "hci/acl_manager.h"
+#include "hci/address.h"
+#include "hci/address_with_type.h"
+#include "l2cap/internal/parameter_provider.h"
+#include "l2cap/internal/scheduler.h"
+#include "l2cap/le/fixed_channel_manager.h"
+#include "l2cap/le/internal/fixed_channel_service_manager_impl.h"
+#include "l2cap/le/internal/link.h"
+
+namespace bluetooth {
+namespace l2cap {
+namespace le {
+namespace internal {
+
+class LinkManager : public hci::LeConnectionCallbacks {
+ public:
+  LinkManager(os::Handler* l2cap_handler, hci::AclManager* acl_manager, FixedChannelServiceManagerImpl* service_manager,
+              l2cap::internal::ParameterProvider* parameter_provider)
+      : l2cap_handler_(l2cap_handler), acl_manager_(acl_manager), service_manager_(service_manager),
+        parameter_provider_(parameter_provider) {
+    acl_manager_->RegisterLeCallbacks(this, l2cap_handler_);
+  }
+
+  struct PendingFixedChannelConnection {
+    os::Handler* handler_;
+    FixedChannelManager::OnConnectionFailureCallback on_fail_callback_;
+  };
+
+  struct PendingLink {
+    std::vector<PendingFixedChannelConnection> pending_fixed_channel_connections_;
+  };
+
+  // ACL methods
+
+  Link* GetLink(hci::AddressWithType address_with_type);
+  void OnLeConnectSuccess(hci::AddressWithType connecting_address_with_type,
+                          std::unique_ptr<hci::AclConnection> acl_connection) override;
+  void OnLeConnectFail(hci::AddressWithType address_with_type, hci::ErrorCode reason) override;
+  void OnDisconnect(hci::AddressWithType address_with_type, hci::ErrorCode status);
+
+  // FixedChannelManager methods
+
+  void ConnectFixedChannelServices(hci::AddressWithType address_with_type,
+                                   PendingFixedChannelConnection pending_fixed_channel_connection);
+
+ private:
+  // Dependencies
+  os::Handler* l2cap_handler_;
+  hci::AclManager* acl_manager_;
+  FixedChannelServiceManagerImpl* service_manager_;
+  l2cap::internal::ParameterProvider* parameter_provider_;
+
+  // Internal states
+  std::unordered_map<hci::AddressWithType, PendingLink> pending_links_;
+  std::unordered_map<hci::AddressWithType, Link> links_;
+  DISALLOW_COPY_AND_ASSIGN(LinkManager);
+};
+
+}  // namespace internal
+}  // namespace le
+}  // namespace l2cap
+}  // namespace bluetooth
diff --git a/gd/l2cap/le/internal/link_manager_test.cc b/gd/l2cap/le/internal/link_manager_test.cc
new file mode 100644
index 0000000..82f8729
--- /dev/null
+++ b/gd/l2cap/le/internal/link_manager_test.cc
@@ -0,0 +1,480 @@
+/*
+ * Copyright 2018 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "l2cap/le/internal/link_manager.h"
+
+#include <future>
+#include <thread>
+
+#include "common/bind.h"
+#include "common/testing/bind_test_util.h"
+#include "hci/acl_manager_mock.h"
+#include "hci/address.h"
+#include "l2cap/cid.h"
+#include "l2cap/internal/parameter_provider_mock.h"
+#include "l2cap/le/fixed_channel_manager.h"
+#include "l2cap/le/internal/fixed_channel_service_impl_mock.h"
+#include "l2cap/le/internal/fixed_channel_service_manager_impl_mock.h"
+#include "os/handler.h"
+#include "os/thread.h"
+
+#include <gmock/gmock.h>
+#include <gtest/gtest.h>
+
+namespace bluetooth {
+namespace l2cap {
+namespace le {
+namespace internal {
+
+using hci::testing::MockAclConnection;
+using hci::testing::MockAclManager;
+using l2cap::internal::testing::MockParameterProvider;
+using ::testing::_;  // Matcher to any value
+using ::testing::ByMove;
+using ::testing::DoAll;
+using testing::MockFixedChannelServiceImpl;
+using testing::MockFixedChannelServiceManagerImpl;
+using ::testing::Return;
+using ::testing::SaveArg;
+
+constexpr static auto kTestIdleDisconnectTimeoutLong = std::chrono::milliseconds(1000);
+constexpr static auto kTestIdleDisconnectTimeoutShort = std::chrono::milliseconds(30);
+
+class L2capLeLinkManagerTest : public ::testing::Test {
+ public:
+  static void SyncHandler(os::Handler* handler) {
+    std::promise<void> promise;
+    auto future = promise.get_future();
+    handler->Post(common::BindOnce(&std::promise<void>::set_value, common::Unretained(&promise)));
+    future.wait_for(std::chrono::milliseconds(3));
+  }
+
+ protected:
+  void SetUp() override {
+    thread_ = new os::Thread("test_thread", os::Thread::Priority::NORMAL);
+    l2cap_handler_ = new os::Handler(thread_);
+    mock_parameter_provider_ = new MockParameterProvider;
+    EXPECT_CALL(*mock_parameter_provider_, GetLeLinkIdleDisconnectTimeout)
+        .WillRepeatedly(Return(kTestIdleDisconnectTimeoutLong));
+  }
+
+  void TearDown() override {
+    delete mock_parameter_provider_;
+    l2cap_handler_->Clear();
+    delete l2cap_handler_;
+    delete thread_;
+  }
+
+  os::Thread* thread_ = nullptr;
+  os::Handler* l2cap_handler_ = nullptr;
+  MockParameterProvider* mock_parameter_provider_ = nullptr;
+};
+
+TEST_F(L2capLeLinkManagerTest, connect_fixed_channel_service_without_acl) {
+  MockFixedChannelServiceManagerImpl mock_le_fixed_channel_service_manager;
+  MockAclManager mock_acl_manager;
+  hci::AddressWithType address_with_type({{0x01, 0x02, 0x03, 0x04, 0x05, 0x06}},
+                                         hci::AddressType::RANDOM_DEVICE_ADDRESS);
+  auto user_handler = std::make_unique<os::Handler>(thread_);
+
+  // Step 1: Verify callback registration with HCI
+  hci::LeConnectionCallbacks* hci_le_connection_callbacks = nullptr;
+  os::Handler* hci_callback_handler = nullptr;
+  EXPECT_CALL(mock_acl_manager, RegisterLeCallbacks(_, _))
+      .WillOnce(DoAll(SaveArg<0>(&hci_le_connection_callbacks), SaveArg<1>(&hci_callback_handler)));
+  LinkManager le_link_manager(l2cap_handler_, &mock_acl_manager, &mock_le_fixed_channel_service_manager,
+                              mock_parameter_provider_);
+  EXPECT_EQ(hci_le_connection_callbacks, &le_link_manager);
+  EXPECT_EQ(hci_callback_handler, l2cap_handler_);
+
+  // Register fake services
+  MockFixedChannelServiceImpl mock_service_1, mock_service_2;
+  std::vector<std::pair<Cid, FixedChannelServiceImpl*>> results;
+  results.emplace_back(kSmpBrCid, &mock_service_1);
+  results.emplace_back(kConnectionlessCid, &mock_service_2);
+  EXPECT_CALL(mock_le_fixed_channel_service_manager, GetRegisteredServices()).WillRepeatedly(Return(results));
+
+  // Step 2: Connect to fixed channel without ACL connection should trigger ACL connection process
+  EXPECT_CALL(mock_acl_manager, CreateLeConnection(address_with_type)).Times(1);
+  LinkManager::PendingFixedChannelConnection pending_fixed_channel_connection{
+      .handler_ = user_handler.get(),
+      .on_fail_callback_ = common::BindOnce([](FixedChannelManager::ConnectionResult result) { FAIL(); })};
+  le_link_manager.ConnectFixedChannelServices(address_with_type, std::move(pending_fixed_channel_connection));
+
+  // Step 3: ACL connection success event should trigger channel creation for all registered services
+
+  std::unique_ptr<MockAclConnection> acl_connection = std::make_unique<MockAclConnection>();
+  hci::AclConnection::Queue link_queue{10};
+  EXPECT_CALL(*acl_connection, GetAclQueueEnd()).WillRepeatedly((Return(link_queue.GetUpEnd())));
+  EXPECT_CALL(*acl_connection, RegisterDisconnectCallback(_, l2cap_handler_)).Times(1);
+  EXPECT_CALL(*acl_connection, GetAddress()).WillRepeatedly(Return(address_with_type.GetAddress()));
+  EXPECT_CALL(*acl_connection, GetAddressType()).WillRepeatedly(Return(address_with_type.GetAddressType()));
+  std::unique_ptr<FixedChannel> channel_1, channel_2;
+  EXPECT_CALL(mock_service_1, NotifyChannelCreation(_)).WillOnce([&channel_1](std::unique_ptr<FixedChannel> channel) {
+    channel_1 = std::move(channel);
+  });
+  EXPECT_CALL(mock_service_2, NotifyChannelCreation(_)).WillOnce([&channel_2](std::unique_ptr<FixedChannel> channel) {
+    channel_2 = std::move(channel);
+  });
+  hci_callback_handler->Post(common::BindOnce(&hci::LeConnectionCallbacks::OnLeConnectSuccess,
+                                              common::Unretained(hci_le_connection_callbacks), address_with_type,
+                                              std::move(acl_connection)));
+  SyncHandler(hci_callback_handler);
+  EXPECT_NE(channel_1, nullptr);
+  EXPECT_NE(channel_2, nullptr);
+
+  // Step 4: Calling ConnectServices() to the same device will no trigger another connection attempt
+  FixedChannelManager::ConnectionResult my_result;
+  LinkManager::PendingFixedChannelConnection pending_fixed_channel_connection_2{
+      .handler_ = user_handler.get(),
+      .on_fail_callback_ = common::testing::BindLambdaForTesting(
+          [&my_result](FixedChannelManager::ConnectionResult result) { my_result = result; })};
+  le_link_manager.ConnectFixedChannelServices(address_with_type, std::move(pending_fixed_channel_connection_2));
+  SyncHandler(user_handler.get());
+  EXPECT_EQ(my_result.connection_result_code,
+            FixedChannelManager::ConnectionResultCode::FAIL_ALL_SERVICES_HAVE_CHANNEL);
+
+  // Step 5: Register new service will cause new channels to be created during ConnectServices()
+  MockFixedChannelServiceImpl mock_service_3;
+  results.emplace_back(kSmpBrCid + 1, &mock_service_3);
+  EXPECT_CALL(mock_le_fixed_channel_service_manager, GetRegisteredServices()).WillRepeatedly(Return(results));
+  LinkManager::PendingFixedChannelConnection pending_fixed_channel_connection_3{
+      .handler_ = user_handler.get(),
+      .on_fail_callback_ = common::BindOnce([](FixedChannelManager::ConnectionResult result) { FAIL(); })};
+  std::unique_ptr<FixedChannel> channel_3;
+  EXPECT_CALL(mock_service_3, NotifyChannelCreation(_)).WillOnce([&channel_3](std::unique_ptr<FixedChannel> channel) {
+    channel_3 = std::move(channel);
+  });
+  le_link_manager.ConnectFixedChannelServices(address_with_type, std::move(pending_fixed_channel_connection_3));
+  EXPECT_NE(channel_3, nullptr);
+
+  user_handler->Clear();
+
+  le_link_manager.OnDisconnect(address_with_type, hci::ErrorCode::SUCCESS);
+}
+
+TEST_F(L2capLeLinkManagerTest, connect_fixed_channel_service_without_acl_with_no_service) {
+  MockFixedChannelServiceManagerImpl mock_le_fixed_channel_service_manager;
+  MockAclManager mock_acl_manager;
+  hci::AddressWithType address_with_type({{0x01, 0x02, 0x03, 0x04, 0x05, 0x06}},
+                                         hci::AddressType::PUBLIC_DEVICE_ADDRESS);
+  auto user_handler = std::make_unique<os::Handler>(thread_);
+
+  // Step 1: Verify callback registration with HCI
+  hci::LeConnectionCallbacks* hci_le_connection_callbacks = nullptr;
+  os::Handler* hci_callback_handler = nullptr;
+  EXPECT_CALL(mock_acl_manager, RegisterLeCallbacks(_, _))
+      .WillOnce(DoAll(SaveArg<0>(&hci_le_connection_callbacks), SaveArg<1>(&hci_callback_handler)));
+  LinkManager le_link_manager(l2cap_handler_, &mock_acl_manager, &mock_le_fixed_channel_service_manager,
+                              mock_parameter_provider_);
+  EXPECT_EQ(hci_le_connection_callbacks, &le_link_manager);
+  EXPECT_EQ(hci_callback_handler, l2cap_handler_);
+
+  // Make sure no service is registered
+  std::vector<std::pair<Cid, FixedChannelServiceImpl*>> results;
+  EXPECT_CALL(mock_le_fixed_channel_service_manager, GetRegisteredServices()).WillRepeatedly(Return(results));
+
+  // Step 2: Connect to fixed channel without any service registered will result in failure
+  EXPECT_CALL(mock_acl_manager, CreateLeConnection(address_with_type)).Times(0);
+  FixedChannelManager::ConnectionResult my_result;
+  LinkManager::PendingFixedChannelConnection pending_fixed_channel_connection{
+      .handler_ = user_handler.get(),
+      .on_fail_callback_ = common::testing::BindLambdaForTesting(
+          [&my_result](FixedChannelManager::ConnectionResult result) { my_result = result; })};
+  le_link_manager.ConnectFixedChannelServices(address_with_type, std::move(pending_fixed_channel_connection));
+  SyncHandler(user_handler.get());
+  EXPECT_EQ(my_result.connection_result_code, FixedChannelManager::ConnectionResultCode::FAIL_NO_SERVICE_REGISTERED);
+
+  user_handler->Clear();
+}
+
+TEST_F(L2capLeLinkManagerTest, connect_fixed_channel_service_without_acl_with_hci_failure) {
+  MockFixedChannelServiceManagerImpl mock_le_fixed_channel_service_manager;
+  MockAclManager mock_acl_manager;
+  hci::AddressWithType address_with_type({{0x01, 0x02, 0x03, 0x04, 0x05, 0x06}},
+                                         hci::AddressType::RANDOM_DEVICE_ADDRESS);
+  auto user_handler = std::make_unique<os::Handler>(thread_);
+
+  // Step 1: Verify callback registration with HCI
+  hci::LeConnectionCallbacks* hci_le_connection_callbacks = nullptr;
+  os::Handler* hci_callback_handler = nullptr;
+  EXPECT_CALL(mock_acl_manager, RegisterLeCallbacks(_, _))
+      .WillOnce(DoAll(SaveArg<0>(&hci_le_connection_callbacks), SaveArg<1>(&hci_callback_handler)));
+  LinkManager le_link_manager(l2cap_handler_, &mock_acl_manager, &mock_le_fixed_channel_service_manager,
+                              mock_parameter_provider_);
+  EXPECT_EQ(hci_le_connection_callbacks, &le_link_manager);
+  EXPECT_EQ(hci_callback_handler, l2cap_handler_);
+
+  // Register fake services
+  MockFixedChannelServiceImpl mock_service_1;
+  std::vector<std::pair<Cid, FixedChannelServiceImpl*>> results;
+  results.emplace_back(kSmpBrCid, &mock_service_1);
+  EXPECT_CALL(mock_le_fixed_channel_service_manager, GetRegisteredServices()).WillRepeatedly(Return(results));
+
+  // Step 2: Connect to fixed channel without ACL connection should trigger ACL connection process
+  EXPECT_CALL(mock_acl_manager, CreateLeConnection(address_with_type)).Times(1);
+  FixedChannelManager::ConnectionResult my_result;
+  LinkManager::PendingFixedChannelConnection pending_fixed_channel_connection{
+      .handler_ = user_handler.get(),
+      .on_fail_callback_ = common::testing::BindLambdaForTesting(
+          [&my_result](FixedChannelManager::ConnectionResult result) { my_result = result; })};
+  le_link_manager.ConnectFixedChannelServices(address_with_type, std::move(pending_fixed_channel_connection));
+
+  // Step 3: ACL connection failure event should trigger connection failure callback
+  EXPECT_CALL(mock_service_1, NotifyChannelCreation(_)).Times(0);
+  hci_callback_handler->Post(common::BindOnce(&hci::LeConnectionCallbacks::OnLeConnectFail,
+                                              common::Unretained(hci_le_connection_callbacks), address_with_type,
+                                              hci::ErrorCode::PAGE_TIMEOUT));
+  SyncHandler(hci_callback_handler);
+  SyncHandler(user_handler.get());
+  EXPECT_EQ(my_result.connection_result_code, FixedChannelManager::ConnectionResultCode::FAIL_HCI_ERROR);
+  EXPECT_EQ(my_result.hci_error, hci::ErrorCode::PAGE_TIMEOUT);
+
+  user_handler->Clear();
+}
+
+TEST_F(L2capLeLinkManagerTest, not_acquiring_channels_should_disconnect_acl_after_timeout) {
+  EXPECT_CALL(*mock_parameter_provider_, GetLeLinkIdleDisconnectTimeout)
+      .WillRepeatedly(Return(kTestIdleDisconnectTimeoutShort));
+  MockFixedChannelServiceManagerImpl mock_le_fixed_channel_service_manager;
+  MockAclManager mock_acl_manager;
+  hci::AddressWithType address_with_type({{0x01, 0x02, 0x03, 0x04, 0x05, 0x06}},
+                                         hci::AddressType::RANDOM_DEVICE_ADDRESS);
+  auto user_handler = std::make_unique<os::Handler>(thread_);
+
+  // Step 1: Verify callback registration with HCI
+  hci::LeConnectionCallbacks* hci_le_connection_callbacks = nullptr;
+  os::Handler* hci_callback_handler = nullptr;
+  EXPECT_CALL(mock_acl_manager, RegisterLeCallbacks(_, _))
+      .WillOnce(DoAll(SaveArg<0>(&hci_le_connection_callbacks), SaveArg<1>(&hci_callback_handler)));
+  LinkManager le_link_manager(l2cap_handler_, &mock_acl_manager, &mock_le_fixed_channel_service_manager,
+                              mock_parameter_provider_);
+  EXPECT_EQ(hci_le_connection_callbacks, &le_link_manager);
+  EXPECT_EQ(hci_callback_handler, l2cap_handler_);
+
+  // Register fake services
+  MockFixedChannelServiceImpl mock_service_1, mock_service_2;
+  std::vector<std::pair<Cid, FixedChannelServiceImpl*>> results;
+  results.emplace_back(kSmpBrCid, &mock_service_1);
+  results.emplace_back(kConnectionlessCid, &mock_service_2);
+  EXPECT_CALL(mock_le_fixed_channel_service_manager, GetRegisteredServices()).WillRepeatedly(Return(results));
+
+  // Step 2: Connect to fixed channel without ACL connection should trigger ACL connection process
+  EXPECT_CALL(mock_acl_manager, CreateLeConnection(address_with_type)).Times(1);
+  LinkManager::PendingFixedChannelConnection pending_fixed_channel_connection{
+      .handler_ = user_handler.get(),
+      .on_fail_callback_ = common::BindOnce([](FixedChannelManager::ConnectionResult result) { FAIL(); })};
+  le_link_manager.ConnectFixedChannelServices(address_with_type, std::move(pending_fixed_channel_connection));
+
+  // Step 3: ACL connection success event should trigger channel creation for all registered services
+  auto* raw_acl_connection = new MockAclConnection();
+  std::unique_ptr<MockAclConnection> acl_connection(raw_acl_connection);
+  hci::AclConnection::Queue link_queue{10};
+  EXPECT_CALL(*acl_connection, GetAclQueueEnd()).WillRepeatedly((Return(link_queue.GetUpEnd())));
+  EXPECT_CALL(*acl_connection, GetAddress()).WillRepeatedly(Return(address_with_type.GetAddress()));
+  EXPECT_CALL(*acl_connection, GetAddressType()).WillRepeatedly(Return(address_with_type.GetAddressType()));
+  std::unique_ptr<FixedChannel> channel_1, channel_2;
+  EXPECT_CALL(mock_service_1, NotifyChannelCreation(_)).WillOnce([&channel_1](std::unique_ptr<FixedChannel> channel) {
+    channel_1 = std::move(channel);
+  });
+  EXPECT_CALL(mock_service_2, NotifyChannelCreation(_)).WillOnce([&channel_2](std::unique_ptr<FixedChannel> channel) {
+    channel_2 = std::move(channel);
+  });
+  hci_callback_handler->Post(common::BindOnce(&hci::LeConnectionCallbacks::OnLeConnectSuccess,
+                                              common::Unretained(hci_le_connection_callbacks), address_with_type,
+                                              std::move(acl_connection)));
+  SyncHandler(hci_callback_handler);
+  EXPECT_NE(channel_1, nullptr);
+  EXPECT_NE(channel_2, nullptr);
+  hci::ErrorCode status_1 = hci::ErrorCode::SUCCESS;
+  channel_1->RegisterOnCloseCallback(
+      user_handler.get(), common::testing::BindLambdaForTesting([&](hci::ErrorCode status) { status_1 = status; }));
+  hci::ErrorCode status_2 = hci::ErrorCode::SUCCESS;
+  channel_2->RegisterOnCloseCallback(
+      user_handler.get(), common::testing::BindLambdaForTesting([&](hci::ErrorCode status) { status_2 = status; }));
+
+  // Step 4: ave channel IDLE long enough, they will disconnect
+  EXPECT_CALL(*raw_acl_connection, Disconnect(hci::DisconnectReason::REMOTE_USER_TERMINATED_CONNECTION)).Times(1);
+  std::this_thread::sleep_for(kTestIdleDisconnectTimeoutShort * 1.2);
+
+  // Step 5: Link disconnect will trigger all callbacks
+  le_link_manager.OnDisconnect(address_with_type, hci::ErrorCode::CONNECTION_TERMINATED_BY_LOCAL_HOST);
+  SyncHandler(user_handler.get());
+  EXPECT_EQ(hci::ErrorCode::CONNECTION_TERMINATED_BY_LOCAL_HOST, status_1);
+  EXPECT_EQ(hci::ErrorCode::CONNECTION_TERMINATED_BY_LOCAL_HOST, status_2);
+
+  user_handler->Clear();
+}
+
+TEST_F(L2capLeLinkManagerTest, acquiring_channels_should_not_disconnect_acl_after_timeout) {
+  EXPECT_CALL(*mock_parameter_provider_, GetLeLinkIdleDisconnectTimeout)
+      .WillRepeatedly(Return(kTestIdleDisconnectTimeoutShort));
+  MockFixedChannelServiceManagerImpl mock_le_fixed_channel_service_manager;
+  MockAclManager mock_acl_manager;
+  hci::AddressWithType address_with_type({{0x01, 0x02, 0x03, 0x04, 0x05, 0x06}},
+                                         hci::AddressType::RANDOM_DEVICE_ADDRESS);
+  auto user_handler = std::make_unique<os::Handler>(thread_);
+
+  // Step 1: Verify callback registration with HCI
+  hci::LeConnectionCallbacks* hci_le_connection_callbacks = nullptr;
+  os::Handler* hci_callback_handler = nullptr;
+  EXPECT_CALL(mock_acl_manager, RegisterLeCallbacks(_, _))
+      .WillOnce(DoAll(SaveArg<0>(&hci_le_connection_callbacks), SaveArg<1>(&hci_callback_handler)));
+  LinkManager le_link_manager(l2cap_handler_, &mock_acl_manager, &mock_le_fixed_channel_service_manager,
+                              mock_parameter_provider_);
+  EXPECT_EQ(hci_le_connection_callbacks, &le_link_manager);
+  EXPECT_EQ(hci_callback_handler, l2cap_handler_);
+
+  // Register fake services
+  MockFixedChannelServiceImpl mock_service_1, mock_service_2;
+  std::vector<std::pair<Cid, FixedChannelServiceImpl*>> results;
+  results.emplace_back(kSmpBrCid, &mock_service_1);
+  results.emplace_back(kConnectionlessCid, &mock_service_2);
+  EXPECT_CALL(mock_le_fixed_channel_service_manager, GetRegisteredServices()).WillRepeatedly(Return(results));
+
+  // Step 2: Connect to fixed channel without ACL connection should trigger ACL connection process
+  EXPECT_CALL(mock_acl_manager, CreateLeConnection(address_with_type)).Times(1);
+  LinkManager::PendingFixedChannelConnection pending_fixed_channel_connection{
+      .handler_ = user_handler.get(),
+      .on_fail_callback_ = common::BindOnce([](FixedChannelManager::ConnectionResult result) { FAIL(); })};
+  le_link_manager.ConnectFixedChannelServices(address_with_type, std::move(pending_fixed_channel_connection));
+
+  // Step 3: ACL connection success event should trigger channel creation for all registered services
+  auto* raw_acl_connection = new MockAclConnection();
+  std::unique_ptr<MockAclConnection> acl_connection(raw_acl_connection);
+  hci::AclConnection::Queue link_queue{10};
+  EXPECT_CALL(*acl_connection, GetAclQueueEnd()).WillRepeatedly((Return(link_queue.GetUpEnd())));
+  EXPECT_CALL(*acl_connection, GetAddress()).WillRepeatedly(Return(address_with_type.GetAddress()));
+  EXPECT_CALL(*acl_connection, GetAddressType()).WillRepeatedly(Return(address_with_type.GetAddressType()));
+  std::unique_ptr<FixedChannel> channel_1, channel_2;
+  EXPECT_CALL(mock_service_1, NotifyChannelCreation(_)).WillOnce([&channel_1](std::unique_ptr<FixedChannel> channel) {
+    channel_1 = std::move(channel);
+  });
+  EXPECT_CALL(mock_service_2, NotifyChannelCreation(_)).WillOnce([&channel_2](std::unique_ptr<FixedChannel> channel) {
+    channel_2 = std::move(channel);
+  });
+  hci_callback_handler->Post(common::BindOnce(&hci::LeConnectionCallbacks::OnLeConnectSuccess,
+                                              common::Unretained(hci_le_connection_callbacks), address_with_type,
+                                              std::move(acl_connection)));
+  SyncHandler(hci_callback_handler);
+  EXPECT_NE(channel_1, nullptr);
+  EXPECT_NE(channel_2, nullptr);
+  hci::ErrorCode status_1 = hci::ErrorCode::SUCCESS;
+  channel_1->RegisterOnCloseCallback(
+      user_handler.get(), common::testing::BindLambdaForTesting([&](hci::ErrorCode status) { status_1 = status; }));
+  hci::ErrorCode status_2 = hci::ErrorCode::SUCCESS;
+  channel_2->RegisterOnCloseCallback(
+      user_handler.get(), common::testing::BindLambdaForTesting([&](hci::ErrorCode status) { status_2 = status; }));
+
+  channel_1->Acquire();
+
+  // Step 4: ave channel IDLE, it won't disconnect to due acquired channel 1
+  EXPECT_CALL(*raw_acl_connection, Disconnect(hci::DisconnectReason::REMOTE_USER_TERMINATED_CONNECTION)).Times(0);
+  std::this_thread::sleep_for(kTestIdleDisconnectTimeoutShort * 2);
+
+  // Step 5: Link disconnect will trigger all callbacks
+  le_link_manager.OnDisconnect(address_with_type, hci::ErrorCode::CONNECTION_TERMINATED_BY_LOCAL_HOST);
+  SyncHandler(user_handler.get());
+  EXPECT_EQ(hci::ErrorCode::CONNECTION_TERMINATED_BY_LOCAL_HOST, status_1);
+  EXPECT_EQ(hci::ErrorCode::CONNECTION_TERMINATED_BY_LOCAL_HOST, status_2);
+
+  user_handler->Clear();
+}
+
+TEST_F(L2capLeLinkManagerTest, acquiring_and_releasing_channels_should_eventually_disconnect_acl) {
+  EXPECT_CALL(*mock_parameter_provider_, GetLeLinkIdleDisconnectTimeout)
+      .WillRepeatedly(Return(kTestIdleDisconnectTimeoutShort));
+  MockFixedChannelServiceManagerImpl mock_le_fixed_channel_service_manager;
+  MockAclManager mock_acl_manager;
+  hci::AddressWithType address_with_type({{0x01, 0x02, 0x03, 0x04, 0x05, 0x06}},
+                                         hci::AddressType::PUBLIC_IDENTITY_ADDRESS);
+  auto user_handler = std::make_unique<os::Handler>(thread_);
+
+  // Step 1: Verify callback registration with HCI
+  hci::LeConnectionCallbacks* hci_le_connection_callbacks = nullptr;
+  os::Handler* hci_callback_handler = nullptr;
+  EXPECT_CALL(mock_acl_manager, RegisterLeCallbacks(_, _))
+      .WillOnce(DoAll(SaveArg<0>(&hci_le_connection_callbacks), SaveArg<1>(&hci_callback_handler)));
+  LinkManager le_link_manager(l2cap_handler_, &mock_acl_manager, &mock_le_fixed_channel_service_manager,
+                              mock_parameter_provider_);
+  EXPECT_EQ(hci_le_connection_callbacks, &le_link_manager);
+  EXPECT_EQ(hci_callback_handler, l2cap_handler_);
+
+  // Register fake services
+  MockFixedChannelServiceImpl mock_service_1, mock_service_2;
+  std::vector<std::pair<Cid, FixedChannelServiceImpl*>> results;
+  results.emplace_back(kSmpBrCid, &mock_service_1);
+  results.emplace_back(kConnectionlessCid, &mock_service_2);
+  EXPECT_CALL(mock_le_fixed_channel_service_manager, GetRegisteredServices()).WillRepeatedly(Return(results));
+
+  // Step 2: Connect to fixed channel without ACL connection should trigger ACL connection process
+  EXPECT_CALL(mock_acl_manager, CreateLeConnection(address_with_type)).Times(1);
+  LinkManager::PendingFixedChannelConnection pending_fixed_channel_connection{
+      .handler_ = user_handler.get(),
+      .on_fail_callback_ = common::BindOnce([](FixedChannelManager::ConnectionResult result) { FAIL(); })};
+  le_link_manager.ConnectFixedChannelServices(address_with_type, std::move(pending_fixed_channel_connection));
+
+  // Step 3: ACL connection success event should trigger channel creation for all registered services
+  auto* raw_acl_connection = new MockAclConnection();
+  std::unique_ptr<MockAclConnection> acl_connection(raw_acl_connection);
+  hci::AclConnection::Queue link_queue{10};
+  EXPECT_CALL(*acl_connection, GetAclQueueEnd()).WillRepeatedly((Return(link_queue.GetUpEnd())));
+  EXPECT_CALL(*acl_connection, GetAddress()).WillRepeatedly(Return(address_with_type.GetAddress()));
+  EXPECT_CALL(*acl_connection, GetAddressType()).WillRepeatedly(Return(address_with_type.GetAddressType()));
+  std::unique_ptr<FixedChannel> channel_1, channel_2;
+  EXPECT_CALL(mock_service_1, NotifyChannelCreation(_)).WillOnce([&channel_1](std::unique_ptr<FixedChannel> channel) {
+    channel_1 = std::move(channel);
+  });
+  EXPECT_CALL(mock_service_2, NotifyChannelCreation(_)).WillOnce([&channel_2](std::unique_ptr<FixedChannel> channel) {
+    channel_2 = std::move(channel);
+  });
+  hci_callback_handler->Post(common::BindOnce(&hci::LeConnectionCallbacks::OnLeConnectSuccess,
+                                              common::Unretained(hci_le_connection_callbacks), address_with_type,
+                                              std::move(acl_connection)));
+  SyncHandler(hci_callback_handler);
+  EXPECT_NE(channel_1, nullptr);
+  EXPECT_NE(channel_2, nullptr);
+  hci::ErrorCode status_1 = hci::ErrorCode::SUCCESS;
+  channel_1->RegisterOnCloseCallback(
+      user_handler.get(), common::testing::BindLambdaForTesting([&](hci::ErrorCode status) { status_1 = status; }));
+  hci::ErrorCode status_2 = hci::ErrorCode::SUCCESS;
+  channel_2->RegisterOnCloseCallback(
+      user_handler.get(), common::testing::BindLambdaForTesting([&](hci::ErrorCode status) { status_2 = status; }));
+
+  channel_1->Acquire();
+
+  // Step 4: ave channel IDLE, it won't disconnect to due acquired channel 1
+  EXPECT_CALL(*raw_acl_connection, Disconnect(hci::DisconnectReason::REMOTE_USER_TERMINATED_CONNECTION)).Times(0);
+  std::this_thread::sleep_for(kTestIdleDisconnectTimeoutShort * 2);
+
+  // Step 5: ave channel IDLE long enough, they will disconnect
+  channel_1->Release();
+  EXPECT_CALL(*raw_acl_connection, Disconnect(hci::DisconnectReason::REMOTE_USER_TERMINATED_CONNECTION)).Times(1);
+  std::this_thread::sleep_for(kTestIdleDisconnectTimeoutShort * 1.2);
+
+  // Step 6: Link disconnect will trigger all callbacks
+  le_link_manager.OnDisconnect(address_with_type, hci::ErrorCode::CONNECTION_TERMINATED_BY_LOCAL_HOST);
+  SyncHandler(user_handler.get());
+  EXPECT_EQ(hci::ErrorCode::CONNECTION_TERMINATED_BY_LOCAL_HOST, status_1);
+  EXPECT_EQ(hci::ErrorCode::CONNECTION_TERMINATED_BY_LOCAL_HOST, status_2);
+
+  user_handler->Clear();
+}
+
+}  // namespace internal
+}  // namespace le
+}  // namespace l2cap
+}  // namespace bluetooth
diff --git a/gd/l2cap/le/internal/link_mock.h b/gd/l2cap/le/internal/link_mock.h
new file mode 100644
index 0000000..3411c95
--- /dev/null
+++ b/gd/l2cap/le/internal/link_mock.h
@@ -0,0 +1,53 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+#pragma once
+
+#include "hci/acl_manager_mock.h"
+#include "hci/address.h"
+#include "l2cap/internal/scheduler_mock.h"
+#include "l2cap/le/internal/link.h"
+
+#include <gmock/gmock.h>
+
+// Unit test interfaces
+namespace bluetooth {
+namespace l2cap {
+namespace le {
+namespace internal {
+namespace testing {
+
+using hci::testing::MockAclConnection;
+
+class MockLink : public Link {
+ public:
+  explicit MockLink(os::Handler* handler, l2cap::internal::ParameterProvider* parameter_provider)
+      : Link(handler, std::make_unique<MockAclConnection>(),
+             std::make_unique<l2cap::internal::testing::MockScheduler>(), parameter_provider){};
+  MOCK_METHOD(hci::AddressWithType, GetDevice, (), (override));
+  MOCK_METHOD(hci::Role, GetRole, (), (override));
+  MOCK_METHOD(void, OnAclDisconnected, (hci::ErrorCode status), (override));
+  MOCK_METHOD(void, Disconnect, (), (override));
+  MOCK_METHOD(std::shared_ptr<FixedChannelImpl>, AllocateFixedChannel, (Cid cid, SecurityPolicy security_policy),
+              (override));
+  MOCK_METHOD(bool, IsFixedChannelAllocated, (Cid cid), (override));
+  MOCK_METHOD(void, RefreshRefCount, (), (override));
+};
+
+}  // namespace testing
+}  // namespace internal
+}  // namespace le
+}  // namespace l2cap
+}  // namespace bluetooth
\ No newline at end of file
diff --git a/gd/l2cap/le/l2cap_le_module.cc b/gd/l2cap/le/l2cap_le_module.cc
new file mode 100644
index 0000000..938df8b
--- /dev/null
+++ b/gd/l2cap/le/l2cap_le_module.cc
@@ -0,0 +1,70 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+#define LOG_TAG "l2cap2"
+
+#include <memory>
+
+#include "common/bidi_queue.h"
+#include "hci/acl_manager.h"
+#include "hci/address.h"
+#include "hci/hci_layer.h"
+#include "hci/hci_packets.h"
+#include "l2cap/internal/parameter_provider.h"
+#include "l2cap/le/internal/fixed_channel_service_manager_impl.h"
+#include "l2cap/le/internal/link_manager.h"
+#include "module.h"
+#include "os/handler.h"
+#include "os/log.h"
+
+#include "l2cap/le/l2cap_le_module.h"
+
+namespace bluetooth {
+namespace l2cap {
+namespace le {
+
+const ModuleFactory L2capLeModule::Factory = ModuleFactory([]() { return new L2capLeModule(); });
+
+struct L2capLeModule::impl {
+  impl(os::Handler* l2cap_handler, hci::AclManager* acl_manager)
+      : l2cap_handler_(l2cap_handler), acl_manager_(acl_manager) {}
+  os::Handler* l2cap_handler_;
+  hci::AclManager* acl_manager_;
+  l2cap::internal::ParameterProvider parameter_provider_;
+  internal::FixedChannelServiceManagerImpl fixed_channel_service_manager_impl_{l2cap_handler_};
+  internal::LinkManager link_manager_{l2cap_handler_, acl_manager_, &fixed_channel_service_manager_impl_,
+                                      &parameter_provider_};
+};
+
+void L2capLeModule::ListDependencies(ModuleList* list) {
+  list->add<hci::AclManager>();
+}
+
+void L2capLeModule::Start() {
+  pimpl_ = std::make_unique<impl>(GetHandler(), GetDependency<hci::AclManager>());
+}
+
+void L2capLeModule::Stop() {
+  pimpl_.reset();
+}
+
+std::unique_ptr<FixedChannelManager> L2capLeModule::GetFixedChannelManager() {
+  return std::unique_ptr<FixedChannelManager>(new FixedChannelManager(&pimpl_->fixed_channel_service_manager_impl_,
+                                                                      &pimpl_->link_manager_, pimpl_->l2cap_handler_));
+}
+
+}  // namespace le
+}  // namespace l2cap
+}  // namespace bluetooth
\ No newline at end of file
diff --git a/gd/l2cap/le/l2cap_le_module.h b/gd/l2cap/le/l2cap_le_module.h
new file mode 100644
index 0000000..0185403
--- /dev/null
+++ b/gd/l2cap/le/l2cap_le_module.h
@@ -0,0 +1,54 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+#pragma once
+
+#include <memory>
+
+#include "l2cap/le/fixed_channel_manager.h"
+#include "module.h"
+
+namespace bluetooth {
+namespace l2cap {
+namespace le {
+
+class L2capLeModule : public bluetooth::Module {
+ public:
+  L2capLeModule() = default;
+  ~L2capLeModule() = default;
+
+  /**
+   * Get the api to the LE fixed channel l2cap module
+   */
+  std::unique_ptr<FixedChannelManager> GetFixedChannelManager();
+
+  static const ModuleFactory Factory;
+
+ protected:
+  void ListDependencies(ModuleList* list) override;
+
+  void Start() override;
+
+  void Stop() override;
+
+ private:
+  struct impl;
+  std::unique_ptr<impl> pimpl_;
+  DISALLOW_COPY_AND_ASSIGN(L2capLeModule);
+};
+
+}  // namespace le
+}  // namespace l2cap
+}  // namespace bluetooth
\ No newline at end of file
diff --git a/gd/l2cap/mtu.h b/gd/l2cap/mtu.h
new file mode 100644
index 0000000..edaecd9
--- /dev/null
+++ b/gd/l2cap/mtu.h
@@ -0,0 +1,32 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+#pragma once
+
+#include <cstdint>
+
+namespace bluetooth {
+namespace l2cap {
+
+using mtu_t = uint16_t;
+
+constexpr mtu_t kDefaultMinimumClassicMtu = 48;
+constexpr mtu_t kDefaultMinimumLeMtu = 23;
+constexpr mtu_t kMinimumClassicMtu = 48;
+constexpr mtu_t kDefaultClassicMtu = 672;
+constexpr mtu_t kMinimumLeMtu = 23;
+
+}  // namespace l2cap
+}  // namespace bluetooth
diff --git a/gd/l2cap/psm.h b/gd/l2cap/psm.h
new file mode 100644
index 0000000..0e89e62
--- /dev/null
+++ b/gd/l2cap/psm.h
@@ -0,0 +1,33 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#pragma once
+
+#include <cstdint>
+
+namespace bluetooth {
+namespace l2cap {
+
+using Psm = uint16_t;
+constexpr Psm kDefaultPsm = 0;  // Invalid Psm as a default value
+
+constexpr bool IsPsmValid(Psm psm) {
+  // See Core spec 5.1 Vol 3 Part A 4.2 for definition
+  return (psm & 0x0101u) == 0x0001u;
+}
+
+}  // namespace l2cap
+}  // namespace bluetooth
diff --git a/gd/l2cap/security_policy.h b/gd/l2cap/security_policy.h
new file mode 100644
index 0000000..5a06401
--- /dev/null
+++ b/gd/l2cap/security_policy.h
@@ -0,0 +1,24 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+#pragma once
+
+namespace bluetooth {
+namespace l2cap {
+
+class SecurityPolicy {};
+
+}  // namespace l2cap
+}  // namespace bluetooth
\ No newline at end of file
diff --git a/gd/l2cap/signal_id.h b/gd/l2cap/signal_id.h
new file mode 100644
index 0000000..24372b1
--- /dev/null
+++ b/gd/l2cap/signal_id.h
@@ -0,0 +1,86 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#pragma once
+
+#include <cstdint>
+
+namespace bluetooth {
+namespace l2cap {
+
+struct SignalId {
+ public:
+  constexpr SignalId(uint8_t value) : value_(value) {}
+  constexpr SignalId() : value_(1) {}
+  ~SignalId() = default;
+
+  uint8_t Value() const {
+    return value_;
+  }
+
+  bool IsValid() const {
+    return value_ != 0;
+  }
+
+  friend bool operator==(const SignalId& lhs, const SignalId& rhs);
+  friend bool operator!=(const SignalId& lhs, const SignalId& rhs);
+
+  struct SignalId& operator++();    // Prefix increment operator.
+  struct SignalId operator++(int);  // Postfix increment operator.
+  struct SignalId& operator--();    // Prefix decrement operator.
+  struct SignalId operator--(int);  // Postfix decrement operator.
+
+ private:
+  uint8_t value_;
+};
+
+constexpr SignalId kInvalidSignalId{0};
+constexpr SignalId kInitialSignalId{1};
+
+inline bool operator==(const SignalId& lhs, const SignalId& rhs) {
+  return lhs.value_ == rhs.value_;
+}
+
+inline bool operator!=(const SignalId& lhs, const SignalId& rhs) {
+  return !(lhs == rhs);
+}
+
+inline struct SignalId& SignalId::operator++() {
+  value_++;
+  if (value_ == 0) value_++;
+  return *this;
+}
+
+inline struct SignalId SignalId::operator++(int) {
+  struct SignalId tmp = *this;
+  ++*this;
+  return tmp;
+}
+
+inline struct SignalId& SignalId::operator--() {
+  value_--;
+  if (value_ == 0) value_ = 0xff;
+  return *this;
+}
+
+inline struct SignalId SignalId::operator--(int) {
+  struct SignalId tmp = *this;
+  --*this;
+  return tmp;
+}
+
+}  // namespace l2cap
+}  // namespace bluetooth
diff --git a/gd/l2cap/signal_id_test.cc b/gd/l2cap/signal_id_test.cc
new file mode 100644
index 0000000..cd95425
--- /dev/null
+++ b/gd/l2cap/signal_id_test.cc
@@ -0,0 +1,119 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <gtest/gtest.h>
+#include <cstdint>
+
+#include "l2cap/signal_id.h"
+
+namespace bluetooth {
+namespace l2cap {
+
+TEST(L2capSignalIdTest, valid_values) {
+  int valid = 0;
+  uint8_t i = 0;
+  while (++i != 0) {
+    SignalId signal_id(i);
+    if (signal_id.IsValid()) {
+      valid++;
+    }
+  }
+  ASSERT_TRUE(valid == 255);
+}
+
+TEST(L2capSignalIdTest, zero_invalid) {
+  SignalId signal_id(0);
+  ASSERT_FALSE(signal_id.IsValid());
+}
+
+TEST(L2capSignalIdTest, pre_increment) {
+  SignalId signal_id(0);
+  ASSERT_FALSE(signal_id.IsValid());
+
+  for (uint8_t i = 0; i != 0xff; ++i, ++signal_id) {
+    ASSERT_TRUE(i == signal_id.Value());
+  }
+}
+
+TEST(L2capSignalIdTest, post_increment) {
+  SignalId signal_id(0);
+  ASSERT_FALSE(signal_id.IsValid());
+
+  for (uint8_t i = 0; i != 0xff; i++, signal_id++) {
+    ASSERT_TRUE(i == signal_id.Value());
+  }
+}
+
+TEST(L2capSignalIdTest, almost_wrap_up) {
+  SignalId signal_id(0);
+  ASSERT_FALSE(signal_id.IsValid());
+
+  for (int i = 0; i < 255; i++) {
+    signal_id++;
+  }
+  ASSERT_EQ(0xff, signal_id.Value());
+}
+
+TEST(L2capSignalIdTest, wrap_up) {
+  SignalId signal_id(0);
+  ASSERT_FALSE(signal_id.IsValid());
+
+  for (int i = 0; i < 256; i++) {
+    signal_id++;
+  }
+  ASSERT_EQ(1, signal_id.Value());
+}
+
+TEST(L2capSignalIdTest, pre_decrement) {
+  SignalId signal_id(0);
+  ASSERT_FALSE(signal_id.IsValid());
+
+  for (uint8_t i = 0; i != 0xff; --i, --signal_id) {
+    ASSERT_TRUE(i == signal_id.Value());
+  }
+}
+
+TEST(L2capSignalIdTest, post_decrement) {
+  SignalId signal_id(0);
+  ASSERT_FALSE(signal_id.IsValid());
+
+  for (uint8_t i = 0; i != 0xff; i--, signal_id--) {
+    ASSERT_TRUE(i == signal_id.Value());
+  }
+}
+
+TEST(L2capSignalIdTest, almost_wrap_down) {
+  SignalId signal_id(0);
+  ASSERT_FALSE(signal_id.IsValid());
+
+  for (int i = 0; i < 255; i++) {
+    signal_id--;
+  }
+  ASSERT_EQ(1, signal_id.Value());
+}
+
+TEST(L2capSignalIdTest, wrap_down) {
+  SignalId signal_id(0);
+  ASSERT_FALSE(signal_id.IsValid());
+
+  for (int i = 0; i < 256; i++) {
+    signal_id--;
+  }
+  ASSERT_EQ(0xff, signal_id.Value());
+}
+
+}  // namespace l2cap
+}  // namespace bluetooth
diff --git a/gd/module.cc b/gd/module.cc
index 2833e6a..fe1491a 100644
--- a/gd/module.cc
+++ b/gd/module.cc
@@ -24,11 +24,12 @@
 ModuleFactory::ModuleFactory(std::function<Module*()> ctor) : ctor_(ctor) {
 }
 
-Handler* Module::GetHandler() {
+Handler* Module::GetHandler() const {
+  ASSERT_LOG(handler_ != nullptr, "Can't get handler when it's not started");
   return handler_;
 }
 
-ModuleRegistry* Module::GetModuleRegistry() {
+const ModuleRegistry* Module::GetModuleRegistry() const {
   return registry_;
 }
 
@@ -58,6 +59,11 @@
   }
 }
 
+void ModuleRegistry::set_registry_and_handler(Module* instance, Thread* thread) const {
+  instance->registry_ = this;
+  instance->handler_ = new Handler(thread);
+}
+
 Module* ModuleRegistry::Start(const ModuleFactory* module, Thread* thread) {
   auto started_instance = started_modules_.find(module);
   if (started_instance != started_modules_.end()) {
@@ -65,10 +71,9 @@
   }
 
   Module* instance = module->ctor_();
-  instance->registry_ = this;
-  instance->handler_ = new Handler(thread);
-  instance->ListDependencies(&instance->dependencies_);
+  set_registry_and_handler(instance, thread);
 
+  instance->ListDependencies(&instance->dependencies_);
   Start(&instance->dependencies_, thread);
 
   instance->Start();
@@ -78,12 +83,14 @@
 }
 
 void ModuleRegistry::StopAll() {
-  // Since modules were brought up in dependency order,
-  // it is safe to tear down by going in reverse order.
+  // Since modules were brought up in dependency order, it is safe to tear down by going in reverse order.
   for (auto it = start_order_.rbegin(); it != start_order_.rend(); it++) {
     auto instance = started_modules_.find(*it);
     ASSERT(instance != started_modules_.end());
 
+    // Clear the handler before stopping the module to allow it to shut down gracefully.
+    instance->second->handler_->Clear();
+    instance->second->handler_->WaitUntilStopped(kModuleStopTimeout);
     instance->second->Stop();
 
     delete instance->second->handler_;
diff --git a/gd/module.h b/gd/module.h
index 50f231b..0055d92 100644
--- a/gd/module.h
+++ b/gd/module.h
@@ -21,12 +21,15 @@
 #include <map>
 #include <vector>
 
-#include "os/log.h"
+#include "common/bind.h"
 #include "os/handler.h"
+#include "os/log.h"
 #include "os/thread.h"
 
 namespace bluetooth {
 
+const std::chrono::milliseconds kModuleStopTimeout = std::chrono::milliseconds(20);
+
 class Module;
 class ModuleRegistry;
 
@@ -74,9 +77,9 @@
   // Release all resources, you're about to be deleted
   virtual void Stop() = 0;
 
-  ::bluetooth::os::Handler* GetHandler();
+  ::bluetooth::os::Handler* GetHandler() const;
 
-  ModuleRegistry* GetModuleRegistry();
+  const ModuleRegistry* GetModuleRegistry() const;
 
   template <class T>
   T* GetDependency() const {
@@ -86,9 +89,9 @@
  private:
   Module* GetDependency(const ModuleFactory* module) const;
 
-  ::bluetooth::os::Handler* handler_;
+  ::bluetooth::os::Handler* handler_ = nullptr;
   ModuleList dependencies_;
-  ModuleRegistry* registry_;
+  const ModuleRegistry* registry_;
 };
 
 class ModuleRegistry {
@@ -119,6 +122,8 @@
  protected:
   Module* Get(const ModuleFactory* module) const;
 
+  void set_registry_and_handler(Module* instance, ::bluetooth::os::Thread* thread) const;
+
   os::Handler* GetModuleHandler(const ModuleFactory* module) const;
 
   std::map<const ModuleFactory*, Module*> started_modules_;
@@ -130,6 +135,7 @@
   void InjectTestModule(const ModuleFactory* module, Module* instance) {
     start_order_.push_back(module);
     started_modules_[module] = instance;
+    set_registry_and_handler(instance, &test_thread);
   }
 
   Module* GetModuleUnderTest(const ModuleFactory* module) const {
@@ -144,18 +150,15 @@
     return test_thread;
   }
 
-  template <class T>
-  T* StartTestModule() {
-    return Start<T>(&test_thread);
-  }
-
   bool SynchronizeModuleHandler(const ModuleFactory* module, std::chrono::milliseconds timeout) const {
     std::promise<void> promise;
+    auto future = promise.get_future();
     os::Handler* handler = GetTestModuleHandler(module);
-    handler->Post([&promise] { promise.set_value(); });
-    return promise.get_future().wait_for(timeout) == std::future_status::ready;
+    handler->Post(common::BindOnce(&std::promise<void>::set_value, common::Unretained(&promise)));
+    return future.wait_for(timeout) == std::future_status::ready;
   }
 
+ private:
   os::Thread test_thread{"test_thread", os::Thread::Priority::NORMAL};
 };
 
diff --git a/gd/neighbor/Android.bp b/gd/neighbor/Android.bp
new file mode 100644
index 0000000..0b8b4da
--- /dev/null
+++ b/gd/neighbor/Android.bp
@@ -0,0 +1,18 @@
+filegroup {
+    name: "BluetoothNeighborSources",
+    srcs: [
+            "connectability.cc",
+            "discoverability.cc",
+            "inquiry.cc",
+            "page.cc",
+            "scan.cc",
+    ],
+}
+
+filegroup {
+    name: "BluetoothNeighborTestSources",
+    srcs: [
+            "inquiry_test.cc",
+    ],
+}
+
diff --git a/gd/neighbor/connectability.cc b/gd/neighbor/connectability.cc
new file mode 100644
index 0000000..8a60bdd
--- /dev/null
+++ b/gd/neighbor/connectability.cc
@@ -0,0 +1,104 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+#define LOG_TAG "neighbor2"
+
+#include <memory>
+
+#include "hci/hci_layer.h"
+#include "hci/hci_packets.h"
+#include "module.h"
+#include "neighbor/connectability.h"
+#include "neighbor/scan.h"
+#include "os/handler.h"
+#include "os/log.h"
+
+namespace bluetooth {
+namespace neighbor {
+
+struct ConnectabilityModule::impl {
+  void StartConnectability();
+  void StopConnectability();
+  bool IsConnectable() const;
+
+  void Start();
+  void Stop();
+
+  impl(ConnectabilityModule& connectability_module);
+
+ private:
+  ConnectabilityModule& module_;
+
+  neighbor::ScanModule* scan_module_;
+};
+
+const ModuleFactory neighbor::ConnectabilityModule::Factory =
+    ModuleFactory([]() { return new ConnectabilityModule(); });
+
+neighbor::ConnectabilityModule::impl::impl(neighbor::ConnectabilityModule& module) : module_(module) {}
+
+void neighbor::ConnectabilityModule::impl::StartConnectability() {
+  scan_module_->SetPageScan();
+}
+
+void neighbor::ConnectabilityModule::impl::StopConnectability() {
+  scan_module_->ClearPageScan();
+}
+
+bool neighbor::ConnectabilityModule::impl::IsConnectable() const {
+  return scan_module_->IsPageEnabled();
+}
+
+void neighbor::ConnectabilityModule::impl::Start() {
+  scan_module_ = module_.GetDependency<neighbor::ScanModule>();
+}
+
+void neighbor::ConnectabilityModule::impl::Stop() {}
+
+neighbor::ConnectabilityModule::ConnectabilityModule() : pimpl_(std::make_unique<impl>(*this)) {}
+
+neighbor::ConnectabilityModule::~ConnectabilityModule() {
+  pimpl_.reset();
+}
+
+void neighbor::ConnectabilityModule::StartConnectability() {
+  pimpl_->StartConnectability();
+}
+
+void neighbor::ConnectabilityModule::StopConnectability() {
+  pimpl_->StopConnectability();
+}
+
+bool neighbor::ConnectabilityModule::IsConnectable() const {
+  return pimpl_->IsConnectable();
+}
+
+/**
+ * Module stuff
+ */
+void neighbor::ConnectabilityModule::ListDependencies(ModuleList* list) {
+  list->add<neighbor::ScanModule>();
+}
+
+void neighbor::ConnectabilityModule::Start() {
+  pimpl_->Start();
+}
+
+void neighbor::ConnectabilityModule::Stop() {
+  pimpl_->Stop();
+}
+
+}  // namespace neighbor
+}  // namespace bluetooth
diff --git a/gd/neighbor/connectability.h b/gd/neighbor/connectability.h
new file mode 100644
index 0000000..8cdd643
--- /dev/null
+++ b/gd/neighbor/connectability.h
@@ -0,0 +1,49 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+#pragma once
+
+#include <memory>
+
+#include "module.h"
+
+namespace bluetooth {
+namespace neighbor {
+
+class ConnectabilityModule : public bluetooth::Module {
+ public:
+  void StartConnectability();
+  void StopConnectability();
+  bool IsConnectable() const;
+
+  ConnectabilityModule();
+  ~ConnectabilityModule();
+
+  static const ModuleFactory Factory;
+
+ protected:
+  void ListDependencies(ModuleList* list) override;
+  void Start() override;
+  void Stop() override;
+
+ private:
+  struct impl;
+  std::unique_ptr<impl> pimpl_;
+
+  DISALLOW_COPY_AND_ASSIGN(ConnectabilityModule);
+};
+
+}  // namespace neighbor
+}  // namespace bluetooth
diff --git a/gd/neighbor/discoverability.cc b/gd/neighbor/discoverability.cc
new file mode 100644
index 0000000..3514caf
--- /dev/null
+++ b/gd/neighbor/discoverability.cc
@@ -0,0 +1,193 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+#define LOG_TAG "bt_gd_neigh"
+
+#include <memory>
+
+#include "common/bind.h"
+#include "hci/hci_layer.h"
+#include "hci/hci_packets.h"
+#include "module.h"
+#include "neighbor/discoverability.h"
+#include "neighbor/scan.h"
+#include "os/handler.h"
+#include "os/log.h"
+
+namespace bluetooth {
+namespace neighbor {
+
+static constexpr uint8_t kGeneralInquiryAccessCode = 0x33;
+static constexpr uint8_t kLimitedInquiryAccessCode = 0x00;
+
+struct DiscoverabilityModule::impl {
+  void StartDiscoverability(std::vector<hci::Lap>& laps);
+  void StopDiscoverability();
+
+  bool IsGeneralDiscoverabilityEnabled() const;
+  bool IsLimitedDiscoverabilityEnabled() const;
+
+  void Start();
+
+  impl(DiscoverabilityModule& discoverability_module);
+
+ private:
+  uint8_t num_supported_iac_;
+  std::vector<hci::Lap> laps_;
+
+  void OnCommandComplete(hci::CommandCompleteView status);
+
+  hci::HciLayer* hci_layer_;
+  neighbor::ScanModule* scan_module_;
+  os::Handler* handler_;
+
+  DiscoverabilityModule& module_;
+  void Dump() const;
+};
+
+const ModuleFactory neighbor::DiscoverabilityModule::Factory =
+    ModuleFactory([]() { return new neighbor::DiscoverabilityModule(); });
+
+neighbor::DiscoverabilityModule::impl::impl(neighbor::DiscoverabilityModule& module) : module_(module) {}
+
+void neighbor::DiscoverabilityModule::impl::OnCommandComplete(hci::CommandCompleteView status) {
+  switch (status.GetCommandOpCode()) {
+    case hci::OpCode::READ_CURRENT_IAC_LAP: {
+      auto packet = hci::ReadCurrentIacLapCompleteView::Create(status);
+      ASSERT(packet.IsValid());
+      ASSERT(packet.GetStatus() == hci::ErrorCode::SUCCESS);
+      laps_ = packet.GetLapsToRead();
+    } break;
+
+    case hci::OpCode::WRITE_CURRENT_IAC_LAP: {
+      auto packet = hci::WriteCurrentIacLapCompleteView::Create(status);
+      ASSERT(packet.IsValid());
+      ASSERT(packet.GetStatus() == hci::ErrorCode::SUCCESS);
+    } break;
+
+    case hci::OpCode::READ_NUMBER_OF_SUPPORTED_IAC: {
+      auto packet = hci::ReadNumberOfSupportedIacCompleteView::Create(status);
+      ASSERT(packet.IsValid());
+      ASSERT(packet.GetStatus() == hci::ErrorCode::SUCCESS);
+      num_supported_iac_ = packet.GetNumSupportIac();
+    } break;
+    default:
+      LOG_WARN("Unhandled command:%s", hci::OpCodeText(status.GetCommandOpCode()).c_str());
+      break;
+  }
+}
+
+void neighbor::DiscoverabilityModule::impl::StartDiscoverability(std::vector<hci::Lap>& laps) {
+  ASSERT(laps.size() <= num_supported_iac_);
+  hci_layer_->EnqueueCommand(hci::WriteCurrentIacLapBuilder::Create(laps),
+                             common::BindOnce(&impl::OnCommandComplete, common::Unretained(this)), handler_);
+  hci_layer_->EnqueueCommand(hci::ReadCurrentIacLapBuilder::Create(),
+                             common::BindOnce(&impl::OnCommandComplete, common::Unretained(this)), handler_);
+  scan_module_->SetInquiryScan();
+}
+
+void neighbor::DiscoverabilityModule::impl::StopDiscoverability() {
+  scan_module_->ClearInquiryScan();
+}
+
+bool neighbor::DiscoverabilityModule::impl::IsGeneralDiscoverabilityEnabled() const {
+  return scan_module_->IsInquiryEnabled() && laps_.size() == 1;
+}
+
+bool neighbor::DiscoverabilityModule::impl::IsLimitedDiscoverabilityEnabled() const {
+  return scan_module_->IsInquiryEnabled() && laps_.size() == 2;
+}
+
+void neighbor::DiscoverabilityModule::impl::Start() {
+  hci_layer_ = module_.GetDependency<hci::HciLayer>();
+  scan_module_ = module_.GetDependency<neighbor::ScanModule>();
+  handler_ = module_.GetHandler();
+
+  hci_layer_->EnqueueCommand(hci::ReadCurrentIacLapBuilder::Create(),
+                             common::BindOnce(&impl::OnCommandComplete, common::Unretained(this)), handler_);
+
+  hci_layer_->EnqueueCommand(hci::ReadNumberOfSupportedIacBuilder::Create(),
+                             common::BindOnce(&impl::OnCommandComplete, common::Unretained(this)), handler_);
+  LOG_DEBUG("Started discoverability module");
+}
+
+void neighbor::DiscoverabilityModule::impl::Dump() const {
+  LOG_DEBUG("Number of supported iacs:%hhd", num_supported_iac_);
+  LOG_DEBUG("Number of current iacs:%zd", laps_.size());
+  for (auto it : laps_) {
+    LOG_DEBUG("  discoverability lap:%x", it.lap_);
+  }
+}
+
+neighbor::DiscoverabilityModule::DiscoverabilityModule() : pimpl_(std::make_unique<impl>(*this)) {}
+
+neighbor::DiscoverabilityModule::~DiscoverabilityModule() {
+  pimpl_.reset();
+}
+
+void neighbor::DiscoverabilityModule::StartGeneralDiscoverability() {
+  std::vector<hci::Lap> laps;
+  {
+    hci::Lap lap;
+    lap.lap_ = kGeneralInquiryAccessCode;
+    laps.push_back(lap);
+  }
+  pimpl_->StartDiscoverability(laps);
+}
+
+void neighbor::DiscoverabilityModule::StartLimitedDiscoverability() {
+  std::vector<hci::Lap> laps;
+  {
+    hci::Lap lap;
+    lap.lap_ = kGeneralInquiryAccessCode;
+    laps.push_back(lap);
+  }
+
+  {
+    hci::Lap lap;
+    lap.lap_ = kLimitedInquiryAccessCode;
+    laps.push_back(lap);
+  }
+  pimpl_->StartDiscoverability(laps);
+}
+
+void neighbor::DiscoverabilityModule::StopDiscoverability() {
+  pimpl_->StopDiscoverability();
+}
+
+bool neighbor::DiscoverabilityModule::IsGeneralDiscoverabilityEnabled() const {
+  return pimpl_->IsGeneralDiscoverabilityEnabled();
+}
+
+bool neighbor::DiscoverabilityModule::IsLimitedDiscoverabilityEnabled() const {
+  return pimpl_->IsLimitedDiscoverabilityEnabled();
+}
+
+/**
+ * Module stuff
+ */
+void neighbor::DiscoverabilityModule::ListDependencies(ModuleList* list) {
+  list->add<hci::HciLayer>();
+  list->add<neighbor::ScanModule>();
+}
+
+void neighbor::DiscoverabilityModule::Start() {
+  pimpl_->Start();
+}
+
+void neighbor::DiscoverabilityModule::Stop() {}
+
+}  // namespace neighbor
+}  // namespace bluetooth
diff --git a/gd/neighbor/discoverability.h b/gd/neighbor/discoverability.h
new file mode 100644
index 0000000..124716c
--- /dev/null
+++ b/gd/neighbor/discoverability.h
@@ -0,0 +1,52 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+#pragma once
+
+#include <memory>
+
+#include "module.h"
+
+namespace bluetooth {
+namespace neighbor {
+
+class DiscoverabilityModule : public bluetooth::Module {
+ public:
+  void StartGeneralDiscoverability();
+  void StartLimitedDiscoverability();
+  void StopDiscoverability();
+
+  bool IsGeneralDiscoverabilityEnabled() const;
+  bool IsLimitedDiscoverabilityEnabled() const;
+
+  static const ModuleFactory Factory;
+
+  DiscoverabilityModule();
+  ~DiscoverabilityModule();
+
+ protected:
+  void ListDependencies(ModuleList* list) override;
+  void Start() override;
+  void Stop() override;
+
+ private:
+  struct impl;
+  std::unique_ptr<impl> pimpl_;
+
+  DISALLOW_COPY_AND_ASSIGN(DiscoverabilityModule);
+};
+
+}  // namespace neighbor
+}  // namespace bluetooth
diff --git a/gd/neighbor/inquiry.cc b/gd/neighbor/inquiry.cc
new file mode 100644
index 0000000..eb94701
--- /dev/null
+++ b/gd/neighbor/inquiry.cc
@@ -0,0 +1,528 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+#define LOG_TAG "bt_gd_neigh"
+
+#include "neighbor/inquiry.h"
+
+#include <memory>
+
+#include "common/bind.h"
+#include "hci/hci_layer.h"
+#include "hci/hci_packets.h"
+#include "module.h"
+#include "os/handler.h"
+#include "os/log.h"
+
+namespace bluetooth {
+namespace neighbor {
+
+static constexpr uint8_t kGeneralInquiryAccessCode = 0x33;
+static constexpr uint8_t kLimitedInquiryAccessCode = 0x00;
+
+static inline std::string LapText(uint8_t lap) {
+  switch (lap) {
+    case kGeneralInquiryAccessCode:
+      return "General Lap";
+    case kLimitedInquiryAccessCode:
+      return "Limited Lap";
+    default:
+      return "Unknown Lap";
+  }
+}
+
+static hci::Lap general_lap_;
+static hci::Lap limited_lap_;
+
+struct InquiryModule::impl {
+  void RegisterCallbacks(InquiryCallbacks inquiry_callbacks);
+  void UnregisterCallbacks();
+
+  void StartOneShotInquiry(hci::Lap& lap, InquiryLength inquiry_length, NumResponses num_responses);
+  void StopOneShotInquiry();
+
+  void StartPeriodicInquiry(hci::Lap& lap, InquiryLength inquiry_length, NumResponses num_responses,
+                            PeriodLength max_delay, PeriodLength min_delay);
+  void StopPeriodicInquiry();
+
+  bool IsInquiryActive() const;
+  bool IsOneShotInquiryActive(hci::Lap& lap) const;
+  bool IsPeriodicInquiryActive(hci::Lap& lap) const;
+
+  void SetScanActivity(ScanParameters params);
+  ScanParameters GetScanActivity() const;
+
+  void SetScanType(hci::InquiryScanType scan_type);
+
+  void SetInquiryMode(hci::InquiryMode mode);
+
+  void Start();
+  void Stop();
+
+  bool HasCallbacks() const;
+
+  impl(InquiryModule& inquiry_module);
+
+ private:
+  InquiryCallbacks inquiry_callbacks_;
+
+  InquiryModule& module_;
+
+  hci::Lap* active_one_shot_{nullptr};
+  hci::Lap* active_periodic_{nullptr};
+
+  ScanParameters inquiry_scan_;
+  hci::InquiryMode inquiry_mode_;
+  hci::InquiryScanType inquiry_scan_type_;
+  int8_t inquiry_response_tx_power_;
+
+  void EnqueueCommandComplete(std::unique_ptr<hci::CommandPacketBuilder> command);
+  void EnqueueCommandStatus(std::unique_ptr<hci::CommandPacketBuilder> command);
+  void OnCommandComplete(hci::CommandCompleteView view);
+  void OnCommandStatus(hci::CommandStatusView status);
+
+  void EnqueueCommandCompleteSync(std::unique_ptr<hci::CommandPacketBuilder> command);
+  void OnCommandCompleteSync(hci::CommandCompleteView view);
+
+  void OnEvent(hci::EventPacketView view);
+
+  std::promise<void>* command_sync_{nullptr};
+
+  hci::HciLayer* hci_layer_;
+  os::Handler* handler_;
+};
+
+const ModuleFactory neighbor::InquiryModule::Factory = ModuleFactory([]() { return new neighbor::InquiryModule(); });
+
+neighbor::InquiryModule::impl::impl(neighbor::InquiryModule& module) : module_(module) {
+  general_lap_.lap_ = kGeneralInquiryAccessCode;
+  limited_lap_.lap_ = kLimitedInquiryAccessCode;
+}
+
+void neighbor::InquiryModule::impl::OnCommandCompleteSync(hci::CommandCompleteView view) {
+  OnCommandComplete(view);
+  ASSERT(command_sync_ != nullptr);
+  command_sync_->set_value();
+}
+
+void neighbor::InquiryModule::impl::OnCommandComplete(hci::CommandCompleteView view) {
+  switch (view.GetCommandOpCode()) {
+    case hci::OpCode::INQUIRY_CANCEL: {
+      auto packet = hci::InquiryCancelCompleteView::Create(view);
+      ASSERT(packet.IsValid());
+      ASSERT(packet.GetStatus() == hci::ErrorCode::SUCCESS);
+    } break;
+
+    case hci::OpCode::PERIODIC_INQUIRY_MODE: {
+      auto packet = hci::PeriodicInquiryModeCompleteView::Create(view);
+      ASSERT(packet.IsValid());
+      ASSERT(packet.GetStatus() == hci::ErrorCode::SUCCESS);
+      if (active_periodic_ != nullptr) {
+        LOG_DEBUG("Periodic inquiry started lap:%s", LapText(active_periodic_->lap_).c_str());
+      }
+    } break;
+
+    case hci::OpCode::EXIT_PERIODIC_INQUIRY_MODE: {
+      auto packet = hci::ExitPeriodicInquiryModeCompleteView::Create(view);
+      ASSERT(packet.IsValid());
+      ASSERT(packet.GetStatus() == hci::ErrorCode::SUCCESS);
+    } break;
+
+    case hci::OpCode::WRITE_INQUIRY_MODE: {
+      auto packet = hci::WriteInquiryModeCompleteView::Create(view);
+      ASSERT(packet.IsValid());
+      ASSERT(packet.GetStatus() == hci::ErrorCode::SUCCESS);
+    } break;
+
+    case hci::OpCode::READ_INQUIRY_MODE: {
+      auto packet = hci::ReadInquiryModeCompleteView::Create(view);
+      ASSERT(packet.IsValid());
+      ASSERT(packet.GetStatus() == hci::ErrorCode::SUCCESS);
+      inquiry_mode_ = packet.GetInquiryMode();
+    } break;
+
+    case hci::OpCode::READ_INQUIRY_RESPONSE_TRANSMIT_POWER_LEVEL: {
+      auto packet = hci::ReadInquiryResponseTransmitPowerLevelCompleteView::Create(view);
+      ASSERT(packet.IsValid());
+      ASSERT(packet.GetStatus() == hci::ErrorCode::SUCCESS);
+      inquiry_response_tx_power_ = packet.GetTxPower();
+    } break;
+
+    case hci::OpCode::WRITE_INQUIRY_SCAN_ACTIVITY: {
+      auto packet = hci::WriteInquiryScanActivityCompleteView::Create(view);
+      ASSERT(packet.IsValid());
+      ASSERT(packet.GetStatus() == hci::ErrorCode::SUCCESS);
+    } break;
+
+    case hci::OpCode::READ_INQUIRY_SCAN_ACTIVITY: {
+      auto packet = hci::ReadInquiryScanActivityCompleteView::Create(view);
+      ASSERT(packet.IsValid());
+      ASSERT(packet.GetStatus() == hci::ErrorCode::SUCCESS);
+      inquiry_scan_.interval = packet.GetInquiryScanInterval();
+      inquiry_scan_.window = packet.GetInquiryScanWindow();
+    } break;
+
+    case hci::OpCode::WRITE_INQUIRY_SCAN_TYPE: {
+      auto packet = hci::WriteInquiryScanTypeCompleteView::Create(view);
+      ASSERT(packet.IsValid());
+      ASSERT(packet.GetStatus() == hci::ErrorCode::SUCCESS);
+    } break;
+
+    case hci::OpCode::READ_INQUIRY_SCAN_TYPE: {
+      auto packet = hci::ReadInquiryScanTypeCompleteView::Create(view);
+      ASSERT(packet.IsValid());
+      ASSERT(packet.GetStatus() == hci::ErrorCode::SUCCESS);
+      inquiry_scan_type_ = packet.GetInquiryScanType();
+    } break;
+
+    default:
+      LOG_WARN("Unhandled command:%s", hci::OpCodeText(view.GetCommandOpCode()).c_str());
+      break;
+  }
+}
+
+void neighbor::InquiryModule::impl::OnCommandStatus(hci::CommandStatusView status) {
+  ASSERT(status.GetStatus() == hci::ErrorCode::SUCCESS);
+
+  switch (status.GetCommandOpCode()) {
+    case hci::OpCode::INQUIRY: {
+      auto packet = hci::InquiryStatusView::Create(status);
+      ASSERT(packet.IsValid());
+      if (active_one_shot_ != nullptr) {
+        LOG_DEBUG("Inquiry started lap:%s", LapText(active_one_shot_->lap_).c_str());
+      }
+    } break;
+
+    default:
+      LOG_WARN("Unhandled command:%s", hci::OpCodeText(status.GetCommandOpCode()).c_str());
+      break;
+  }
+}
+
+void neighbor::InquiryModule::impl::OnEvent(hci::EventPacketView view) {
+  switch (view.GetEventCode()) {
+    case hci::EventCode::INQUIRY_COMPLETE: {
+      auto packet = hci::InquiryCompleteView::Create(view);
+      ASSERT(packet.IsValid());
+      LOG_DEBUG("inquiry complete");
+      active_one_shot_ = nullptr;
+      inquiry_callbacks_.complete(packet.GetStatus());
+    } break;
+
+    case hci::EventCode::INQUIRY_RESULT: {
+      auto packet = hci::InquiryResultView::Create(view);
+      ASSERT(packet.IsValid());
+      LOG_DEBUG("Inquiry result size:%zd num_responses:%d addr:%s repetition_mode:%s cod:%s clock_offset:%d",
+                packet.size(), packet.GetNumResponses(), packet.GetBdAddr().ToString().c_str(),
+                hci::PageScanRepetitionModeText(packet.GetPageScanRepetitionMode()).c_str(),
+                packet.GetClassOfDevice().ToString().c_str(), packet.GetClockOffset());
+      inquiry_callbacks_.result(packet);
+    } break;
+
+    case hci::EventCode::INQUIRY_RESULT_WITH_RSSI: {
+      auto packet = hci::InquiryResultWithRssiView::Create(view);
+      ASSERT(packet.IsValid());
+      LOG_DEBUG("Inquiry result with rssi num_responses:%d addr:%s repetition_mode:%s cod:%s clock_offset:%d",
+                packet.GetNumResponses(), packet.GetAddress().ToString().c_str(),
+                hci::PageScanRepetitionModeText(packet.GetPageScanRepetitionMode()).c_str(),
+                packet.GetClassOfDevice().ToString().c_str(), packet.GetClockOffset());
+      inquiry_callbacks_.result_with_rssi(packet);
+    } break;
+
+    case hci::EventCode::EXTENDED_INQUIRY_RESULT: {
+      auto packet = hci::ExtendedInquiryResultView::Create(view);
+      ASSERT(packet.IsValid());
+      LOG_DEBUG("Extended inquiry result addr:%s repetition_mode:%s cod:%s clock_offset:%d rssi:%hhd",
+                packet.GetAddress().ToString().c_str(),
+                hci::PageScanRepetitionModeText(packet.GetPageScanRepetitionMode()).c_str(),
+                packet.GetClassOfDevice().ToString().c_str(), packet.GetClockOffset(), packet.GetRssi());
+      inquiry_callbacks_.extended_result(packet);
+    } break;
+
+    default:
+      LOG_ERROR("Unhandled event:%s", hci::EventCodeText(view.GetEventCode()).c_str());
+      break;
+  }
+}
+
+/**
+ * impl
+ */
+void neighbor::InquiryModule::impl::RegisterCallbacks(InquiryCallbacks callbacks) {
+  inquiry_callbacks_ = callbacks;
+
+  hci_layer_->RegisterEventHandler(hci::EventCode::INQUIRY_RESULT,
+                                   common::Bind(&InquiryModule::impl::OnEvent, common::Unretained(this)), handler_);
+  hci_layer_->RegisterEventHandler(hci::EventCode::INQUIRY_RESULT_WITH_RSSI,
+                                   common::Bind(&InquiryModule::impl::OnEvent, common::Unretained(this)), handler_);
+  hci_layer_->RegisterEventHandler(hci::EventCode::EXTENDED_INQUIRY_RESULT,
+                                   common::Bind(&InquiryModule::impl::OnEvent, common::Unretained(this)), handler_);
+  hci_layer_->RegisterEventHandler(hci::EventCode::INQUIRY_COMPLETE,
+                                   common::Bind(&InquiryModule::impl::OnEvent, common::Unretained(this)), handler_);
+}
+
+void neighbor::InquiryModule::impl::UnregisterCallbacks() {
+  hci_layer_->UnregisterEventHandler(hci::EventCode::INQUIRY_COMPLETE);
+  hci_layer_->UnregisterEventHandler(hci::EventCode::EXTENDED_INQUIRY_RESULT);
+  hci_layer_->UnregisterEventHandler(hci::EventCode::INQUIRY_RESULT_WITH_RSSI);
+  hci_layer_->UnregisterEventHandler(hci::EventCode::INQUIRY_RESULT);
+
+  inquiry_callbacks_ = {nullptr, nullptr, nullptr, nullptr};
+}
+
+void neighbor::InquiryModule::impl::EnqueueCommandComplete(std::unique_ptr<hci::CommandPacketBuilder> command) {
+  hci_layer_->EnqueueCommand(std::move(command), common::BindOnce(&impl::OnCommandComplete, common::Unretained(this)),
+                             handler_);
+}
+
+void neighbor::InquiryModule::impl::EnqueueCommandStatus(std::unique_ptr<hci::CommandPacketBuilder> command) {
+  hci_layer_->EnqueueCommand(std::move(command), common::BindOnce(&impl::OnCommandStatus, common::Unretained(this)),
+                             handler_);
+}
+
+void neighbor::InquiryModule::impl::EnqueueCommandCompleteSync(std::unique_ptr<hci::CommandPacketBuilder> command) {
+  ASSERT(command_sync_ == nullptr);
+  command_sync_ = new std::promise<void>();
+  auto command_received = command_sync_->get_future();
+  hci_layer_->EnqueueCommand(std::move(command),
+                             common::BindOnce(&impl::OnCommandCompleteSync, common::Unretained(this)), handler_);
+  command_received.wait();
+  delete command_sync_;
+  command_sync_ = nullptr;
+}
+
+void neighbor::InquiryModule::impl::StartOneShotInquiry(hci::Lap& lap, InquiryLength inquiry_length,
+                                                        NumResponses num_responses) {
+  ASSERT(HasCallbacks());
+  ASSERT(active_one_shot_ == nullptr);
+  active_one_shot_ = &lap;
+  EnqueueCommandStatus(hci::InquiryBuilder::Create(lap, inquiry_length, num_responses));
+}
+
+void neighbor::InquiryModule::impl::StopOneShotInquiry() {
+  ASSERT(active_one_shot_ != nullptr);
+  active_one_shot_ = nullptr;
+  EnqueueCommandComplete(hci::InquiryCancelBuilder::Create());
+}
+
+bool neighbor::InquiryModule::impl::IsOneShotInquiryActive(hci::Lap& lap) const {
+  return active_one_shot_ == &lap;
+}
+
+void neighbor::InquiryModule::impl::StartPeriodicInquiry(hci::Lap& lap, InquiryLength inquiry_length,
+                                                         NumResponses num_responses, PeriodLength max_delay,
+                                                         PeriodLength min_delay) {
+  ASSERT(HasCallbacks());
+  ASSERT(active_periodic_ == nullptr);
+  active_periodic_ = &lap;
+  EnqueueCommandComplete(
+      hci::PeriodicInquiryModeBuilder::Create(inquiry_length, num_responses, lap, max_delay, min_delay));
+}
+
+void neighbor::InquiryModule::impl::StopPeriodicInquiry() {
+  ASSERT(active_periodic_ != nullptr);
+  active_periodic_ = nullptr;
+  EnqueueCommandComplete(hci::ExitPeriodicInquiryModeBuilder::Create());
+}
+
+bool neighbor::InquiryModule::impl::IsPeriodicInquiryActive(hci::Lap& lap) const {
+  return active_periodic_ == &lap;
+}
+
+bool neighbor::InquiryModule::impl::IsInquiryActive() const {
+  return active_one_shot_ != nullptr || active_periodic_ != nullptr;
+}
+
+void neighbor::InquiryModule::impl::Start() {
+  hci_layer_ = module_.GetDependency<hci::HciLayer>();
+  handler_ = module_.GetHandler();
+
+  EnqueueCommandComplete(hci::ReadInquiryResponseTransmitPowerLevelBuilder::Create());
+  EnqueueCommandComplete(hci::ReadInquiryScanActivityBuilder::Create());
+  EnqueueCommandComplete(hci::ReadInquiryScanTypeBuilder::Create());
+  EnqueueCommandCompleteSync(hci::ReadInquiryModeBuilder::Create());
+
+  LOG_DEBUG("Started inquiry module");
+}
+
+void neighbor::InquiryModule::impl::Stop() {
+  LOG_INFO("Inquiry scan interval:%hu window:%hu", inquiry_scan_.interval, inquiry_scan_.window);
+  LOG_INFO("Inquiry mode:%s scan_type:%s", hci::InquiryModeText(inquiry_mode_).c_str(),
+           hci::InquiryScanTypeText(inquiry_scan_type_).c_str());
+  LOG_INFO("Inquiry response tx power:%hhd", inquiry_response_tx_power_);
+  LOG_DEBUG("Stopped inquiry module");
+}
+
+void neighbor::InquiryModule::impl::SetInquiryMode(hci::InquiryMode mode) {
+  EnqueueCommandComplete(hci::WriteInquiryModeBuilder::Create(mode));
+  inquiry_mode_ = mode;
+  LOG_DEBUG("Set inquiry mode:%s", hci::InquiryModeText(mode).c_str());
+}
+
+void neighbor::InquiryModule::impl::SetScanActivity(ScanParameters params) {
+  EnqueueCommandComplete(hci::WriteInquiryScanActivityBuilder::Create(params.interval, params.window));
+  inquiry_scan_ = params;
+  LOG_DEBUG("Set scan activity interval:0x%x/%.02fms window:0x%x/%.02fms", params.interval,
+            ScanIntervalTimeMs(params.interval), params.window, ScanWindowTimeMs(params.window));
+}
+
+ScanParameters neighbor::InquiryModule::impl::GetScanActivity() const {
+  return inquiry_scan_;
+}
+
+void neighbor::InquiryModule::impl::SetScanType(hci::InquiryScanType scan_type) {
+  EnqueueCommandComplete(hci::WriteInquiryScanTypeBuilder::Create(scan_type));
+  LOG_DEBUG("Set scan type:%s", hci::InquiryScanTypeText(scan_type).c_str());
+}
+
+bool neighbor::InquiryModule::impl::HasCallbacks() const {
+  return inquiry_callbacks_.result != nullptr && inquiry_callbacks_.result_with_rssi != nullptr &&
+         inquiry_callbacks_.extended_result != nullptr && inquiry_callbacks_.complete != nullptr;
+}
+
+/**
+ * General API here
+ */
+neighbor::InquiryModule::InquiryModule() : pimpl_(std::make_unique<impl>(*this)) {}
+
+neighbor::InquiryModule::~InquiryModule() {
+  pimpl_.reset();
+}
+
+void neighbor::InquiryModule::RegisterCallbacks(InquiryCallbacks callbacks) {
+  pimpl_->RegisterCallbacks(callbacks);
+}
+
+void neighbor::InquiryModule::UnregisterCallbacks() {
+  pimpl_->UnregisterCallbacks();
+}
+
+void neighbor::InquiryModule::StartGeneralInquiry(InquiryLength inquiry_length, NumResponses num_responses) {
+  if (pimpl_->IsInquiryActive()) {
+    LOG_WARN("Ignoring start general one shot inquiry as an inquiry is already active");
+    return;
+  }
+  pimpl_->StartOneShotInquiry(general_lap_, inquiry_length, num_responses);
+  LOG_DEBUG("Started general one shot inquiry");
+}
+
+void neighbor::InquiryModule::StartLimitedInquiry(InquiryLength inquiry_length, NumResponses num_responses) {
+  if (pimpl_->IsInquiryActive()) {
+    LOG_WARN("Ignoring start limited one shot inquiry as an inquiry is already active");
+    return;
+  }
+  pimpl_->StartOneShotInquiry(limited_lap_, inquiry_length, num_responses);
+  LOG_DEBUG("Started limited one shot inquiry");
+}
+
+void neighbor::InquiryModule::StopInquiry() {
+  if (!pimpl_->IsInquiryActive()) {
+    LOG_WARN("Ignoring stop one shot inquiry as an inquiry is not active");
+    return;
+  }
+  pimpl_->StopOneShotInquiry();
+  LOG_DEBUG("Stopped one shot inquiry");
+}
+
+bool neighbor::InquiryModule::IsGeneralInquiryActive() const {
+  return pimpl_->IsOneShotInquiryActive(general_lap_);
+}
+
+bool neighbor::InquiryModule::IsLimitedInquiryActive() const {
+  return pimpl_->IsOneShotInquiryActive(limited_lap_);
+}
+
+void neighbor::InquiryModule::StartGeneralPeriodicInquiry(InquiryLength inquiry_length, NumResponses num_responses,
+                                                          PeriodLength max_delay, PeriodLength min_delay) {
+  if (pimpl_->IsInquiryActive()) {
+    LOG_WARN("Ignoring start general periodic inquiry as an inquiry is already active");
+    return;
+  }
+  pimpl_->StartPeriodicInquiry(general_lap_, inquiry_length, num_responses, max_delay, min_delay);
+  LOG_DEBUG("Started general periodic inquiry");
+}
+
+void neighbor::InquiryModule::StartLimitedPeriodicInquiry(InquiryLength inquiry_length, NumResponses num_responses,
+                                                          PeriodLength max_delay, PeriodLength min_delay) {
+  if (pimpl_->IsInquiryActive()) {
+    LOG_WARN("Ignoring start limited periodic inquiry as an inquiry is already active");
+    return;
+  }
+  pimpl_->StartPeriodicInquiry(limited_lap_, inquiry_length, num_responses, max_delay, min_delay);
+  LOG_DEBUG("Started limited periodic inquiry");
+}
+
+void neighbor::InquiryModule::StopPeriodicInquiry() {
+  if (!pimpl_->IsInquiryActive()) {
+    LOG_WARN("Ignoring stop periodic inquiry as an inquiry is not active");
+    return;
+  }
+  pimpl_->StopPeriodicInquiry();
+  LOG_DEBUG("Stopped periodic inquiry");
+}
+
+bool neighbor::InquiryModule::IsGeneralPeriodicInquiryActive() const {
+  return pimpl_->IsPeriodicInquiryActive(general_lap_);
+}
+
+bool neighbor::InquiryModule::IsLimitedPeriodicInquiryActive() const {
+  return pimpl_->IsPeriodicInquiryActive(limited_lap_);
+}
+
+void neighbor::InquiryModule::SetScanActivity(ScanParameters params) {
+  pimpl_->SetScanActivity(params);
+}
+
+ScanParameters neighbor::InquiryModule::GetScanActivity() const {
+  return pimpl_->GetScanActivity();
+}
+
+void neighbor::InquiryModule::SetInterlacedScan() {
+  pimpl_->SetScanType(hci::InquiryScanType::INTERLACED);
+}
+
+void neighbor::InquiryModule::SetStandardScan() {
+  pimpl_->SetScanType(hci::InquiryScanType::STANDARD);
+}
+
+void neighbor::InquiryModule::SetStandardInquiryResultMode() {
+  pimpl_->SetInquiryMode(hci::InquiryMode::STANDARD);
+}
+
+void neighbor::InquiryModule::SetInquiryWithRssiResultMode() {
+  pimpl_->SetInquiryMode(hci::InquiryMode::RSSI);
+}
+
+void neighbor::InquiryModule::SetExtendedInquiryResultMode() {
+  pimpl_->SetInquiryMode(hci::InquiryMode::RSSI_OR_EXTENDED);
+}
+
+/**
+ * Module methods here
+ */
+void neighbor::InquiryModule::ListDependencies(ModuleList* list) {
+  list->add<hci::HciLayer>();
+}
+
+void neighbor::InquiryModule::Start() {
+  pimpl_->Start();
+}
+
+void neighbor::InquiryModule::Stop() {
+  pimpl_->Stop();
+}
+
+}  // namespace neighbor
+}  // namespace bluetooth
diff --git a/gd/neighbor/inquiry.h b/gd/neighbor/inquiry.h
new file mode 100644
index 0000000..2da2a56
--- /dev/null
+++ b/gd/neighbor/inquiry.h
@@ -0,0 +1,90 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+#pragma once
+
+#include <memory>
+
+#include "hci/hci_packets.h"
+#include "module.h"
+#include "neighbor/scan_parameters.h"
+
+namespace bluetooth {
+namespace neighbor {
+
+using InquiryLength = uint8_t;  // Range: 0x01 to 0x30, 1.28 to 61.44s
+using NumResponses = uint8_t;   // Range: 0x01 to 0xff, 0x00 is unlimited
+using PeriodLength = uint16_t;  // Time = N * 1.28 s
+
+using InquiryResultCallback = std::function<void(hci::InquiryResultView view)>;
+using InquiryResultWithRssiCallback = std::function<void(hci::InquiryResultWithRssiView view)>;
+using ExtendedInquiryResultCallback = std::function<void(hci::ExtendedInquiryResultView view)>;
+using InquiryCompleteCallback = std::function<void(hci::ErrorCode status)>;
+
+using InquiryCallbacks = struct {
+  InquiryResultCallback result;
+  InquiryResultWithRssiCallback result_with_rssi;
+  ExtendedInquiryResultCallback extended_result;
+  InquiryCompleteCallback complete;
+};
+
+class InquiryModule : public bluetooth::Module {
+ public:
+  void RegisterCallbacks(InquiryCallbacks inquiry_callbacks);
+  void UnregisterCallbacks();
+
+  void StartGeneralInquiry(InquiryLength inquiry_length, NumResponses num_responses);
+  void StartLimitedInquiry(InquiryLength inquiry_length, NumResponses num_responses);
+  void StopInquiry();
+  bool IsGeneralInquiryActive() const;
+  bool IsLimitedInquiryActive() const;
+
+  void StartGeneralPeriodicInquiry(InquiryLength inquiry_length, NumResponses num_responses, PeriodLength max_delay,
+                                   PeriodLength min_delay);
+  void StartLimitedPeriodicInquiry(InquiryLength inquiry_length, NumResponses num_responses, PeriodLength max_delay,
+                                   PeriodLength min_delay);
+  void StopPeriodicInquiry();
+  bool IsGeneralPeriodicInquiryActive() const;
+  bool IsLimitedPeriodicInquiryActive() const;
+
+  void SetScanActivity(ScanParameters parms);
+  ScanParameters GetScanActivity() const;
+
+  void SetInterlacedScan();
+  void SetStandardScan();
+
+  void SetStandardInquiryResultMode();
+  void SetInquiryWithRssiResultMode();
+  void SetExtendedInquiryResultMode();
+
+  static const ModuleFactory Factory;
+
+  InquiryModule();
+  ~InquiryModule();
+
+ protected:
+  void ListDependencies(ModuleList* list) override;
+  void Start() override;
+  void Stop() override;
+
+ private:
+  struct impl;
+  std::unique_ptr<impl> pimpl_;
+
+  DISALLOW_COPY_AND_ASSIGN(InquiryModule);
+};
+
+}  // namespace neighbor
+}  // namespace bluetooth
diff --git a/gd/neighbor/inquiry_test.cc b/gd/neighbor/inquiry_test.cc
new file mode 100644
index 0000000..05d1a70
--- /dev/null
+++ b/gd/neighbor/inquiry_test.cc
@@ -0,0 +1,490 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "neighbor/inquiry.h"
+
+#include <algorithm>
+#include <chrono>
+#include <future>
+#include <map>
+#include <memory>
+
+#include <unistd.h>
+
+#include <gtest/gtest.h>
+
+#include "common/bind.h"
+#include "common/callback.h"
+#include "hci/address.h"
+#include "hci/class_of_device.h"
+#include "hci/hci_layer.h"
+#include "hci/hci_packets.h"
+#include "os/thread.h"
+#include "packet/raw_builder.h"
+
+namespace bluetooth {
+namespace neighbor {
+namespace {
+
+static const uint8_t kNumberPacketsReadyToReceive = 1;
+
+/**
+ * This structure reflects the current state of the bluetooth chip
+ * at any given time.
+ */
+static const int8_t kInitialInquiryResponseTransmitPowerLevel = 123;
+static const uint16_t kInitialInquiryScanInterval = 1111;
+static const uint16_t kInitialInquiryScanWindow = 2222;
+
+struct HciRegister {
+  bool one_shot_inquiry_active;
+  bool periodic_inquiry_active;
+  int8_t inquiry_response_transmit_power_level;
+  uint16_t inquiry_scan_interval;
+  uint16_t inquiry_scan_window;
+  hci::InquiryScanType inquiry_scan_type;
+  hci::InquiryMode inquiry_mode;
+} hci_register_{
+    .one_shot_inquiry_active = false,
+    .periodic_inquiry_active = false,
+    .inquiry_response_transmit_power_level = kInitialInquiryResponseTransmitPowerLevel,
+    .inquiry_scan_interval = kInitialInquiryScanInterval,
+    .inquiry_scan_window = kInitialInquiryScanWindow,
+    .inquiry_scan_type = hci::InquiryScanType::STANDARD,
+    .inquiry_mode = hci::InquiryMode::STANDARD,
+};
+
+hci::PacketView<hci::kLittleEndian> GetPacketView(std::unique_ptr<packet::BasePacketBuilder> packet) {
+  auto bytes = std::make_shared<std::vector<uint8_t>>();
+  hci::BitInserter i(*bytes);
+  bytes->reserve(packet->size());
+  packet->Serialize(i);
+  return packet::PacketView<packet::kLittleEndian>(bytes);
+}
+
+class TestHciLayer : public hci::HciLayer {
+ public:
+  void EnqueueCommand(std::unique_ptr<hci::CommandPacketBuilder> command,
+                      common::OnceCallback<void(hci::CommandCompleteView)> on_complete, os::Handler* handler) override {
+    GetHandler()->Post(common::BindOnce(&TestHciLayer::HandleCommand, common::Unretained(this), std::move(command),
+                                        std::move(on_complete), common::Unretained(handler)));
+  }
+
+  void EnqueueCommand(std::unique_ptr<hci::CommandPacketBuilder> command,
+                      common::OnceCallback<void(hci::CommandStatusView)> on_status, os::Handler* handler) override {
+    GetHandler()->Post(common::BindOnce(&TestHciLayer::HandleStatus, common::Unretained(this), std::move(command),
+                                        std::move(on_status), common::Unretained(handler)));
+  }
+
+  void HandleCommand(std::unique_ptr<hci::CommandPacketBuilder> command_builder,
+                     common::OnceCallback<void(hci::CommandCompleteView)> on_complete, os::Handler* handler) {
+    hci::CommandPacketView command = hci::CommandPacketView::Create(GetPacketView(std::move(command_builder)));
+    ASSERT(command.IsValid());
+
+    std::unique_ptr<packet::BasePacketBuilder> event_builder;
+    switch (command.GetOpCode()) {
+      case hci::OpCode::INQUIRY_CANCEL:
+        event_builder =
+            hci::InquiryCancelCompleteBuilder::Create(kNumberPacketsReadyToReceive, hci::ErrorCode::SUCCESS);
+        hci_register_.one_shot_inquiry_active = false;
+        break;
+
+      case hci::OpCode::PERIODIC_INQUIRY_MODE:
+        event_builder =
+            hci::PeriodicInquiryModeCompleteBuilder::Create(kNumberPacketsReadyToReceive, hci::ErrorCode::SUCCESS);
+        hci_register_.periodic_inquiry_active = true;
+        break;
+
+      case hci::OpCode::EXIT_PERIODIC_INQUIRY_MODE:
+        event_builder =
+            hci::ExitPeriodicInquiryModeCompleteBuilder::Create(kNumberPacketsReadyToReceive, hci::ErrorCode::SUCCESS);
+        hci_register_.periodic_inquiry_active = false;
+        break;
+
+      case hci::OpCode::WRITE_INQUIRY_MODE:
+        event_builder =
+            hci::WriteInquiryModeCompleteBuilder::Create(kNumberPacketsReadyToReceive, hci::ErrorCode::SUCCESS);
+        {
+          auto view = hci::WriteInquiryModeView::Create(hci::DiscoveryCommandView::Create(command));
+          ASSERT(view.IsValid());
+          hci_register_.inquiry_mode = view.GetInquiryMode();
+        }
+        break;
+
+      case hci::OpCode::READ_INQUIRY_MODE:
+        event_builder = hci::ReadInquiryModeCompleteBuilder::Create(
+            kNumberPacketsReadyToReceive, hci::ErrorCode::SUCCESS, hci_register_.inquiry_mode);
+        break;
+
+      case hci::OpCode::WRITE_INQUIRY_SCAN_ACTIVITY:
+        event_builder =
+            hci::WriteInquiryScanActivityCompleteBuilder::Create(kNumberPacketsReadyToReceive, hci::ErrorCode::SUCCESS);
+        {
+          auto view = hci::WriteInquiryScanActivityView::Create(hci::DiscoveryCommandView::Create(command));
+          ASSERT(view.IsValid());
+          hci_register_.inquiry_scan_interval = view.GetInquiryScanInterval();
+          hci_register_.inquiry_scan_window = view.GetInquiryScanWindow();
+        }
+        break;
+
+      case hci::OpCode::READ_INQUIRY_SCAN_ACTIVITY:
+        event_builder = hci::ReadInquiryScanActivityCompleteBuilder::Create(
+            kNumberPacketsReadyToReceive, hci::ErrorCode::SUCCESS, hci_register_.inquiry_scan_interval,
+            hci_register_.inquiry_scan_window);
+        break;
+
+      case hci::OpCode::WRITE_INQUIRY_SCAN_TYPE:
+        event_builder =
+            hci::WriteInquiryScanTypeCompleteBuilder::Create(kNumberPacketsReadyToReceive, hci::ErrorCode::SUCCESS);
+        {
+          auto view = hci::WriteInquiryScanTypeView::Create(hci::DiscoveryCommandView::Create(command));
+          ASSERT(view.IsValid());
+          hci_register_.inquiry_scan_type = view.GetInquiryScanType();
+        }
+        break;
+
+      case hci::OpCode::READ_INQUIRY_SCAN_TYPE:
+        event_builder = hci::ReadInquiryScanTypeCompleteBuilder::Create(
+            kNumberPacketsReadyToReceive, hci::ErrorCode::SUCCESS, hci_register_.inquiry_scan_type);
+        break;
+
+      case hci::OpCode::READ_INQUIRY_RESPONSE_TRANSMIT_POWER_LEVEL:
+        event_builder = hci::ReadInquiryResponseTransmitPowerLevelCompleteBuilder::Create(
+            kNumberPacketsReadyToReceive, hci::ErrorCode::SUCCESS, hci_register_.inquiry_response_transmit_power_level);
+        break;
+
+      default:
+        LOG_INFO("Dropping unhandled command:%s", hci::OpCodeText(command.GetOpCode()).c_str());
+        return;
+    }
+    hci::EventPacketView event = hci::EventPacketView::Create(GetPacketView(std::move(event_builder)));
+    ASSERT(event.IsValid());
+    hci::CommandCompleteView command_complete = hci::CommandCompleteView::Create(event);
+    ASSERT(command_complete.IsValid());
+    handler->Post(common::BindOnce(std::move(on_complete), std::move(command_complete)));
+
+    if (promise_sync_complete_ != nullptr) {
+      promise_sync_complete_->set_value(true);
+    }
+  }
+
+  void HandleStatus(std::unique_ptr<hci::CommandPacketBuilder> command_builder,
+                    common::OnceCallback<void(hci::CommandStatusView)> on_status, os::Handler* handler) {
+    hci::CommandPacketView command = hci::CommandPacketView::Create(GetPacketView(std::move(command_builder)));
+    ASSERT(command.IsValid());
+
+    std::unique_ptr<packet::BasePacketBuilder> event_builder;
+    switch (command.GetOpCode()) {
+      case hci::OpCode::INQUIRY:
+        event_builder = hci::InquiryStatusBuilder::Create(hci::ErrorCode::SUCCESS, kNumberPacketsReadyToReceive);
+        hci_register_.one_shot_inquiry_active = true;
+        break;
+      default:
+        LOG_INFO("Dropping unhandled status expecting command:%s", hci::OpCodeText(command.GetOpCode()).c_str());
+        return;
+    }
+    hci::EventPacketView event = hci::EventPacketView::Create(GetPacketView(std::move(event_builder)));
+    ASSERT(event.IsValid());
+    hci::CommandStatusView command_status = hci::CommandStatusView::Create(event);
+    ASSERT(command_status.IsValid());
+    handler->Post(common::BindOnce(std::move(on_status), std::move(command_status)));
+
+    if (promise_sync_complete_ != nullptr) {
+      promise_sync_complete_->set_value(true);
+    }
+  }
+
+  void RegisterEventHandler(hci::EventCode event_code, common::Callback<void(hci::EventPacketView)> event_handler,
+                            os::Handler* handler) override {
+    switch (event_code) {
+      case hci::EventCode::INQUIRY_RESULT:
+        inquiry_result_handler_ = handler;
+        inquiry_result_callback_ = event_handler;
+        break;
+      case hci::EventCode::INQUIRY_RESULT_WITH_RSSI:
+        inquiry_result_with_rssi_handler_ = handler;
+        inquiry_result_with_rssi_callback_ = event_handler;
+        break;
+      case hci::EventCode::EXTENDED_INQUIRY_RESULT:
+        extended_inquiry_result_handler_ = handler;
+        extended_inquiry_result_callback_ = event_handler;
+        break;
+      case hci::EventCode::INQUIRY_COMPLETE:
+        inquiry_complete_handler_ = handler;
+        inquiry_complete_callback_ = event_handler;
+        break;
+      default:
+        ASSERT_TRUE(false) << "Unexpected event handler being registered";
+        break;
+    }
+  }
+
+  void UnregisterEventHandler(hci::EventCode event_code) override {
+    if (hci_register_.one_shot_inquiry_active || hci_register_.periodic_inquiry_active) {
+      LOG_ERROR("Event handlers may not be unregistered until inquiry is stopped");
+      return;
+    }
+
+    switch (event_code) {
+      case hci::EventCode::INQUIRY_RESULT:
+        inquiry_result_handler_ = nullptr;
+        inquiry_result_callback_ = {};
+        break;
+      case hci::EventCode::INQUIRY_RESULT_WITH_RSSI:
+        inquiry_result_with_rssi_handler_ = nullptr;
+        inquiry_result_with_rssi_callback_ = {};
+        break;
+      case hci::EventCode::EXTENDED_INQUIRY_RESULT:
+        extended_inquiry_result_handler_ = nullptr;
+        extended_inquiry_result_callback_ = {};
+        break;
+      case hci::EventCode::INQUIRY_COMPLETE:
+        inquiry_complete_handler_ = nullptr;
+        inquiry_complete_callback_ = {};
+        break;
+      default:
+        ASSERT_TRUE(false) << "Unexpected event handler being unregistered";
+        break;
+    }
+  }
+
+  void Synchronize(std::function<void()> func) {
+    ASSERT(promise_sync_complete_ == nullptr);
+    promise_sync_complete_ = new std::promise<bool>();
+    auto future = promise_sync_complete_->get_future();
+    func();
+    future.wait();
+    delete promise_sync_complete_;
+    promise_sync_complete_ = nullptr;
+  }
+
+  void InjectInquiryResult(std::unique_ptr<hci::InquiryResultBuilder> result) {
+    if (inquiry_result_handler_ != nullptr) {
+      hci::EventPacketView view = hci::EventPacketView::Create(GetPacketView(std::move(result)));
+      ASSERT(view.IsValid());
+      inquiry_result_handler_->Post(common::BindOnce(inquiry_result_callback_, std::move(view)));
+    }
+  }
+
+  void ListDependencies(ModuleList* list) override {}
+  void Start() override {}
+  void Stop() override {}
+
+ private:
+  std::promise<bool>* promise_sync_complete_{nullptr};
+
+  os::Handler* inquiry_result_handler_{nullptr};
+  common::Callback<void(hci::EventPacketView)> inquiry_result_callback_;
+  os::Handler* inquiry_result_with_rssi_handler_{nullptr};
+  common::Callback<void(hci::EventPacketView)> inquiry_result_with_rssi_callback_;
+  os::Handler* extended_inquiry_result_handler_{nullptr};
+  common::Callback<void(hci::EventPacketView)> extended_inquiry_result_callback_;
+  os::Handler* inquiry_complete_handler_{nullptr};
+  common::Callback<void(hci::EventPacketView)> inquiry_complete_callback_;
+};
+
+class InquiryTest : public ::testing::Test {
+ public:
+  void Result(hci::InquiryResultView view) {
+    ASSERT(view.size() >= sizeof(uint16_t));
+    promise_result_complete_->set_value(true);
+  }
+
+  void WaitForInquiryResult(std::function<void()> func) {
+    ASSERT(promise_result_complete_ == nullptr);
+    promise_result_complete_ = new std::promise<bool>();
+    auto future = promise_result_complete_->get_future();
+    func();
+    future.wait();
+    delete promise_result_complete_;
+    promise_result_complete_ = nullptr;
+  }
+
+  void ResultWithRssi(hci::InquiryResultWithRssiView view) {
+    ASSERT(view.size() >= sizeof(uint16_t));
+  }
+
+  void ExtendedResult(hci::ExtendedInquiryResultView view) {
+    ASSERT(view.size() >= sizeof(uint16_t));
+  }
+
+  void Complete(hci::ErrorCode status) {}
+
+ protected:
+  void SetUp() override {
+    test_hci_layer_ = new TestHciLayer;
+    fake_registry_.InjectTestModule(&hci::HciLayer::Factory, test_hci_layer_);
+    client_handler_ = fake_registry_.GetTestModuleHandler(&hci::HciLayer::Factory);
+    fake_registry_.Start<InquiryModule>(&thread_);
+
+    inquiry_module_ = static_cast<InquiryModule*>(fake_registry_.GetModuleUnderTest(&InquiryModule::Factory));
+
+    InquiryCallbacks inquiry_callbacks;
+    inquiry_callbacks.result = std::bind(&InquiryTest::Result, this, std::placeholders::_1);
+    inquiry_callbacks.result_with_rssi = std::bind(&InquiryTest::ResultWithRssi, this, std::placeholders::_1);
+    inquiry_callbacks.extended_result = std::bind(&InquiryTest::ExtendedResult, this, std::placeholders::_1);
+    inquiry_callbacks.complete = std::bind(&InquiryTest::Complete, this, std::placeholders::_1);
+    inquiry_module_->RegisterCallbacks(inquiry_callbacks);
+  }
+
+  void TearDown() override {
+    inquiry_module_->UnregisterCallbacks();
+    fake_registry_.StopAll();
+  }
+
+  TestModuleRegistry fake_registry_;
+  TestHciLayer* test_hci_layer_ = nullptr;
+  os::Thread& thread_ = fake_registry_.GetTestThread();
+  InquiryModule* inquiry_module_ = nullptr;
+  os::Handler* client_handler_ = nullptr;
+
+  std::promise<bool>* promise_result_complete_{nullptr};
+};
+
+TEST_F(InquiryTest, Module) {
+  ScanParameters params{
+      .interval = 0,
+      .window = 0,
+  };
+  params = inquiry_module_->GetScanActivity();
+
+  ASSERT_EQ(kInitialInquiryScanInterval, params.interval);
+  ASSERT_EQ(kInitialInquiryScanWindow, params.window);
+}
+
+TEST_F(InquiryTest, SetInquiryModes) {
+  test_hci_layer_->Synchronize([this] { inquiry_module_->SetInquiryWithRssiResultMode(); });
+  ASSERT_EQ(hci_register_.inquiry_mode, hci::InquiryMode::RSSI);
+
+  test_hci_layer_->Synchronize([this] { inquiry_module_->SetExtendedInquiryResultMode(); });
+  ASSERT_EQ(hci_register_.inquiry_mode, hci::InquiryMode::RSSI_OR_EXTENDED);
+
+  test_hci_layer_->Synchronize([this] { inquiry_module_->SetStandardInquiryResultMode(); });
+  ASSERT_EQ(hci_register_.inquiry_mode, hci::InquiryMode::STANDARD);
+}
+
+TEST_F(InquiryTest, SetScanType) {
+  test_hci_layer_->Synchronize([this] { inquiry_module_->SetInterlacedScan(); });
+  ASSERT_EQ(hci_register_.inquiry_scan_type, hci::InquiryScanType::INTERLACED);
+
+  test_hci_layer_->Synchronize([this] { inquiry_module_->SetStandardScan(); });
+  ASSERT_EQ(hci_register_.inquiry_scan_type, hci::InquiryScanType::STANDARD);
+}
+
+TEST_F(InquiryTest, ScanActivity) {
+  ScanParameters params{
+      .interval = 0x1234,
+      .window = 0x5678,
+  };
+
+  test_hci_layer_->Synchronize([this, params] { inquiry_module_->SetScanActivity(params); });
+
+  ASSERT_EQ(0x1234, hci_register_.inquiry_scan_interval);
+  ASSERT_EQ(0x5678, hci_register_.inquiry_scan_window);
+
+  params = inquiry_module_->GetScanActivity();
+
+  EXPECT_EQ(0x1234, params.interval);
+  EXPECT_EQ(0x5678, params.window);
+}
+
+TEST_F(InquiryTest, OneShotGeneralInquiry) {
+  ASSERT(!inquiry_module_->IsGeneralInquiryActive());
+  ASSERT(!inquiry_module_->IsLimitedInquiryActive());
+
+  test_hci_layer_->Synchronize([this] { inquiry_module_->StartGeneralInquiry(128, 100); });
+
+  ASSERT(inquiry_module_->IsGeneralInquiryActive());
+  ASSERT(!inquiry_module_->IsLimitedInquiryActive());
+
+  test_hci_layer_->Synchronize([this] { inquiry_module_->StopInquiry(); });
+
+  ASSERT(!inquiry_module_->IsGeneralInquiryActive());
+  ASSERT(!inquiry_module_->IsLimitedInquiryActive());
+}
+
+TEST_F(InquiryTest, OneShotLimitedInquiry) {
+  ASSERT(!inquiry_module_->IsGeneralInquiryActive());
+  ASSERT(!inquiry_module_->IsLimitedInquiryActive());
+
+  test_hci_layer_->Synchronize([this] { inquiry_module_->StartLimitedInquiry(128, 100); });
+
+  ASSERT(!inquiry_module_->IsGeneralInquiryActive());
+  ASSERT(inquiry_module_->IsLimitedInquiryActive());
+
+  test_hci_layer_->Synchronize([this] { inquiry_module_->StopInquiry(); });
+
+  ASSERT(!inquiry_module_->IsGeneralInquiryActive());
+  ASSERT(!inquiry_module_->IsLimitedInquiryActive());
+}
+
+TEST_F(InquiryTest, GeneralPeriodicInquiry) {
+  ASSERT(!inquiry_module_->IsGeneralPeriodicInquiryActive());
+  ASSERT(!inquiry_module_->IsLimitedPeriodicInquiryActive());
+
+  test_hci_layer_->Synchronize([this] { inquiry_module_->StartGeneralPeriodicInquiry(128, 100, 1100, 200); });
+
+  ASSERT(inquiry_module_->IsGeneralPeriodicInquiryActive());
+  ASSERT(!inquiry_module_->IsLimitedPeriodicInquiryActive());
+
+  test_hci_layer_->Synchronize([this] { inquiry_module_->StopPeriodicInquiry(); });
+
+  ASSERT(!inquiry_module_->IsGeneralPeriodicInquiryActive());
+  ASSERT(!inquiry_module_->IsLimitedPeriodicInquiryActive());
+}
+
+TEST_F(InquiryTest, LimitedPeriodicInquiry) {
+  ASSERT(!inquiry_module_->IsGeneralPeriodicInquiryActive());
+  ASSERT(!inquiry_module_->IsLimitedPeriodicInquiryActive());
+
+  test_hci_layer_->Synchronize([this] { inquiry_module_->StartLimitedPeriodicInquiry(128, 100, 1100, 200); });
+
+  ASSERT(!inquiry_module_->IsGeneralPeriodicInquiryActive());
+  ASSERT(inquiry_module_->IsLimitedPeriodicInquiryActive());
+
+  test_hci_layer_->Synchronize([this] { inquiry_module_->StopPeriodicInquiry(); });
+
+  ASSERT(!inquiry_module_->IsGeneralPeriodicInquiryActive());
+  ASSERT(!inquiry_module_->IsLimitedPeriodicInquiryActive());
+}
+
+TEST_F(InquiryTest, InjectInquiryResult) {
+  ASSERT(!inquiry_module_->IsGeneralInquiryActive());
+  ASSERT(!inquiry_module_->IsLimitedInquiryActive());
+
+  test_hci_layer_->Synchronize([this] { inquiry_module_->StartGeneralInquiry(128, 100); });
+
+  ASSERT(inquiry_module_->IsGeneralInquiryActive());
+  ASSERT(!inquiry_module_->IsLimitedInquiryActive());
+
+  WaitForInquiryResult([this] {
+    uint8_t num_responses = 1;
+    hci::Address bd_addr;
+    hci::Address::FromString("11:22:33:44:55:66", bd_addr);
+    hci::PageScanRepetitionMode page_scan_repetition_mode = hci::PageScanRepetitionMode::R1;
+    hci::ClassOfDevice class_of_device;
+    hci::ClassOfDevice::FromString("00:00:00", class_of_device);
+    uint16_t clock_offset = 0x1234;
+    auto packet = hci::InquiryResultBuilder::Create(num_responses, bd_addr, page_scan_repetition_mode, class_of_device,
+                                                    clock_offset);
+    test_hci_layer_->InjectInquiryResult(std::move(packet));
+  });
+  test_hci_layer_->Synchronize([this] { inquiry_module_->StopInquiry(); });
+}
+
+}  // namespace
+}  // namespace neighbor
+}  // namespace bluetooth
diff --git a/gd/neighbor/page.cc b/gd/neighbor/page.cc
new file mode 100644
index 0000000..4631875
--- /dev/null
+++ b/gd/neighbor/page.cc
@@ -0,0 +1,206 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+#define LOG_TAG "bt_gd_neigh"
+
+#include <memory>
+
+#include "common/bind.h"
+#include "hci/hci_layer.h"
+#include "hci/hci_packets.h"
+#include "module.h"
+#include "neighbor/page.h"
+#include "neighbor/scan_parameters.h"
+#include "os/handler.h"
+#include "os/log.h"
+
+namespace bluetooth {
+namespace neighbor {
+
+struct PageModule::impl {
+  void SetScanActivity(ScanParameters params);
+  ScanParameters GetScanActivity() const;
+
+  void SetScanType(hci::PageScanType type);
+
+  void SetTimeout(PageTimeout timeout);
+
+  void Start();
+  void Stop();
+
+  impl(PageModule& page_module);
+
+ private:
+  PageModule& module_;
+
+  ScanParameters scan_parameters_;
+  hci::PageScanType scan_type_;
+  PageTimeout timeout_;
+
+  void OnCommandComplete(hci::CommandCompleteView status);
+
+  hci::HciLayer* hci_layer_;
+  os::Handler* handler_;
+};
+
+const ModuleFactory neighbor::PageModule::Factory = ModuleFactory([]() { return new neighbor::PageModule(); });
+
+neighbor::PageModule::impl::impl(neighbor::PageModule& module) : module_(module) {}
+
+void neighbor::PageModule::impl::OnCommandComplete(hci::CommandCompleteView view) {
+  switch (view.GetCommandOpCode()) {
+    case hci::OpCode::WRITE_PAGE_SCAN_ACTIVITY: {
+      auto packet = hci::WritePageScanActivityCompleteView::Create(view);
+      ASSERT(packet.IsValid());
+      ASSERT(packet.GetStatus() == hci::ErrorCode::SUCCESS);
+    } break;
+
+    case hci::OpCode::READ_PAGE_SCAN_ACTIVITY: {
+      auto packet = hci::ReadPageScanActivityCompleteView::Create(view);
+      ASSERT(packet.IsValid());
+      ASSERT(packet.GetStatus() == hci::ErrorCode::SUCCESS);
+      scan_parameters_.interval = packet.GetPageScanInterval();
+      scan_parameters_.window = packet.GetPageScanWindow();
+    } break;
+
+    case hci::OpCode::WRITE_PAGE_SCAN_TYPE: {
+      auto packet = hci::WritePageScanTypeCompleteView::Create(view);
+      ASSERT(packet.IsValid());
+      ASSERT(packet.GetStatus() == hci::ErrorCode::SUCCESS);
+    } break;
+
+    case hci::OpCode::READ_PAGE_SCAN_TYPE: {
+      auto packet = hci::ReadPageScanTypeCompleteView::Create(view);
+      ASSERT(packet.IsValid());
+      ASSERT(packet.GetStatus() == hci::ErrorCode::SUCCESS);
+      scan_type_ = packet.GetPageScanType();
+    } break;
+
+    case hci::OpCode::WRITE_PAGE_TIMEOUT: {
+      auto packet = hci::WritePageTimeoutCompleteView::Create(view);
+      ASSERT(packet.IsValid());
+      ASSERT(packet.GetStatus() == hci::ErrorCode::SUCCESS);
+    } break;
+
+    case hci::OpCode::READ_PAGE_TIMEOUT: {
+      auto packet = hci::ReadPageTimeoutCompleteView::Create(view);
+      ASSERT(packet.IsValid());
+      ASSERT(packet.GetStatus() == hci::ErrorCode::SUCCESS);
+      timeout_ = packet.GetPageTimeout();
+    } break;
+
+    default:
+      LOG_ERROR("Unhandled command %s", hci::OpCodeText(view.GetCommandOpCode()).c_str());
+      break;
+  }
+}
+
+void neighbor::PageModule::impl::Start() {
+  hci_layer_ = module_.GetDependency<hci::HciLayer>();
+  handler_ = module_.GetHandler();
+
+  hci_layer_->EnqueueCommand(hci::ReadPageScanActivityBuilder::Create(),
+                             common::BindOnce(&impl::OnCommandComplete, common::Unretained(this)), handler_);
+
+  hci_layer_->EnqueueCommand(hci::ReadPageScanTypeBuilder::Create(),
+                             common::BindOnce(&impl::OnCommandComplete, common::Unretained(this)), handler_);
+
+  hci_layer_->EnqueueCommand(hci::ReadPageTimeoutBuilder::Create(),
+                             common::BindOnce(&impl::OnCommandComplete, common::Unretained(this)), handler_);
+}
+
+void neighbor::PageModule::impl::Stop() {
+  LOG_DEBUG("Page scan interval:%hd window:%hd", scan_parameters_.interval, scan_parameters_.window);
+  LOG_DEBUG("Page scan_type:%s", hci::PageScanTypeText(scan_type_).c_str());
+}
+
+void neighbor::PageModule::impl::SetScanActivity(ScanParameters params) {
+  hci_layer_->EnqueueCommand(hci::WritePageScanActivityBuilder::Create(params.interval, params.window),
+                             common::BindOnce(&impl::OnCommandComplete, common::Unretained(this)), handler_);
+
+  hci_layer_->EnqueueCommand(hci::ReadPageScanActivityBuilder::Create(),
+                             common::BindOnce(&impl::OnCommandComplete, common::Unretained(this)), handler_);
+  LOG_DEBUG("Set page scan activity interval:0x%x/%.02fms window:0x%x/%.02fms", params.interval,
+            ScanIntervalTimeMs(params.interval), params.window, ScanWindowTimeMs(params.window));
+}
+
+ScanParameters neighbor::PageModule::impl::GetScanActivity() const {
+  return scan_parameters_;
+}
+
+void neighbor::PageModule::impl::SetScanType(hci::PageScanType scan_type) {
+  hci_layer_->EnqueueCommand(hci::WritePageScanTypeBuilder::Create(scan_type),
+                             common::BindOnce(&impl::OnCommandComplete, common::Unretained(this)), handler_);
+
+  hci_layer_->EnqueueCommand(hci::ReadPageScanTypeBuilder::Create(),
+                             common::BindOnce(&impl::OnCommandComplete, common::Unretained(this)), handler_);
+  LOG_DEBUG("Set page scan type:%s", hci::PageScanTypeText(scan_type).c_str());
+}
+
+void neighbor::PageModule::impl::SetTimeout(PageTimeout timeout) {
+  hci_layer_->EnqueueCommand(hci::WritePageTimeoutBuilder::Create(timeout),
+                             common::BindOnce(&impl::OnCommandComplete, common::Unretained(this)), handler_);
+
+  hci_layer_->EnqueueCommand(hci::ReadPageTimeoutBuilder::Create(),
+                             common::BindOnce(&impl::OnCommandComplete, common::Unretained(this)), handler_);
+  LOG_DEBUG("Set page scan timeout:0x%x/%.02fms", timeout, PageTimeoutMs(timeout));
+}
+
+/**
+ * General API here
+ */
+neighbor::PageModule::PageModule() : pimpl_(std::make_unique<impl>(*this)) {}
+
+neighbor::PageModule::~PageModule() {
+  pimpl_.reset();
+}
+
+void neighbor::PageModule::SetScanActivity(ScanParameters params) {
+  pimpl_->SetScanActivity(params);
+}
+
+ScanParameters neighbor::PageModule::GetScanActivity() const {
+  return pimpl_->GetScanActivity();
+}
+
+void neighbor::PageModule::SetInterlacedScan() {
+  pimpl_->SetScanType(hci::PageScanType::INTERLACED);
+}
+
+void neighbor::PageModule::SetStandardScan() {
+  pimpl_->SetScanType(hci::PageScanType::STANDARD);
+}
+
+void neighbor::PageModule::SetTimeout(PageTimeout timeout) {
+  pimpl_->SetTimeout(timeout);
+}
+
+/**
+ * Module methods here
+ */
+void neighbor::PageModule::ListDependencies(ModuleList* list) {
+  list->add<hci::HciLayer>();
+}
+
+void neighbor::PageModule::Start() {
+  pimpl_->Start();
+}
+
+void neighbor::PageModule::Stop() {
+  pimpl_->Stop();
+}
+
+}  // namespace neighbor
+}  // namespace bluetooth
diff --git a/gd/neighbor/page.h b/gd/neighbor/page.h
new file mode 100644
index 0000000..075217b
--- /dev/null
+++ b/gd/neighbor/page.h
@@ -0,0 +1,61 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+#pragma once
+
+#include <memory>
+
+#include "hci/hci_packets.h"
+#include "module.h"
+#include "neighbor/scan_parameters.h"
+
+namespace bluetooth {
+namespace neighbor {
+
+using PageTimeout = uint16_t;  // Range = 0x0001 to 0xffff, Time N * 0.625ms
+
+inline double PageTimeoutMs(PageTimeout timeout) {
+  return kTimeTickMs * timeout;
+}
+
+class PageModule : public bluetooth::Module {
+ public:
+  void SetScanActivity(ScanParameters params);
+  ScanParameters GetScanActivity() const;
+
+  void SetInterlacedScan();
+  void SetStandardScan();
+
+  void SetTimeout(PageTimeout timeout);
+
+  static const ModuleFactory Factory;
+
+  PageModule();
+  ~PageModule();
+
+ protected:
+  void ListDependencies(ModuleList* list) override;
+  void Start() override;
+  void Stop() override;
+
+ private:
+  struct impl;
+  std::unique_ptr<impl> pimpl_;
+
+  DISALLOW_COPY_AND_ASSIGN(PageModule);
+};
+
+}  // namespace neighbor
+}  // namespace bluetooth
diff --git a/gd/neighbor/scan.cc b/gd/neighbor/scan.cc
new file mode 100644
index 0000000..5232b08
--- /dev/null
+++ b/gd/neighbor/scan.cc
@@ -0,0 +1,206 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+#define LOG_TAG "bt_gd_neigh"
+
+#include "neighbor/scan.h"
+#include <memory>
+#include "hci/hci_layer.h"
+#include "hci/hci_packets.h"
+#include "module.h"
+#include "os/handler.h"
+#include "os/log.h"
+
+namespace bluetooth {
+namespace neighbor {
+
+struct ScanModule::impl {
+  impl(ScanModule& module);
+
+  void SetInquiryScan(bool enabled);
+  bool IsInquiryEnabled() const;
+
+  void SetPageScan(bool enabled);
+  bool IsPageEnabled() const;
+
+  void Start();
+  void Stop();
+
+ private:
+  ScanModule& module_;
+
+  bool inquiry_scan_enabled_;
+  bool page_scan_enabled_;
+
+  void WriteScanEnable();
+  void ReadScanEnable(hci::ScanEnable);
+
+  void OnCommandComplete(hci::CommandCompleteView status);
+
+  hci::HciLayer* hci_layer_;
+  os::Handler* handler_;
+};
+
+const ModuleFactory neighbor::ScanModule::Factory = ModuleFactory([]() { return new neighbor::ScanModule(); });
+
+neighbor::ScanModule::impl::impl(neighbor::ScanModule& module)
+    : module_(module), inquiry_scan_enabled_(false), page_scan_enabled_(false) {}
+
+void neighbor::ScanModule::impl::OnCommandComplete(hci::CommandCompleteView view) {
+  switch (view.GetCommandOpCode()) {
+    case hci::OpCode::READ_SCAN_ENABLE: {
+      auto packet = hci::ReadScanEnableCompleteView::Create(view);
+      ASSERT(packet.IsValid());
+      ASSERT(packet.GetStatus() == hci::ErrorCode::SUCCESS);
+      ReadScanEnable(packet.GetScanEnable());
+    } break;
+
+    case hci::OpCode::WRITE_SCAN_ENABLE: {
+      auto packet = hci::WriteScanEnableCompleteView::Create(view);
+      ASSERT(packet.IsValid());
+      ASSERT(packet.GetStatus() == hci::ErrorCode::SUCCESS);
+    } break;
+
+    default:
+      LOG_ERROR("Unhandled command %s", hci::OpCodeText(view.GetCommandOpCode()).c_str());
+      break;
+  }
+}
+
+void neighbor::ScanModule::impl::WriteScanEnable() {
+  hci::ScanEnable scan_enable;
+
+  if (inquiry_scan_enabled_ && !page_scan_enabled_) {
+    scan_enable = hci::ScanEnable::INQUIRY_SCAN_ONLY;
+  } else if (!inquiry_scan_enabled_ && page_scan_enabled_) {
+    scan_enable = hci::ScanEnable::PAGE_SCAN_ONLY;
+  } else if (inquiry_scan_enabled_ && page_scan_enabled_) {
+    scan_enable = hci::ScanEnable::INQUIRY_AND_PAGE_SCAN;
+  } else {
+    scan_enable = hci::ScanEnable::NO_SCANS;
+  }
+
+  {
+    std::unique_ptr<hci::WriteScanEnableBuilder> packet = hci::WriteScanEnableBuilder::Create(scan_enable);
+    hci_layer_->EnqueueCommand(std::move(packet), common::BindOnce(&impl::OnCommandComplete, common::Unretained(this)),
+                               handler_);
+  }
+
+  {
+    std::unique_ptr<hci::ReadScanEnableBuilder> packet = hci::ReadScanEnableBuilder::Create();
+    hci_layer_->EnqueueCommand(std::move(packet), common::BindOnce(&impl::OnCommandComplete, common::Unretained(this)),
+                               handler_);
+  }
+}
+
+void neighbor::ScanModule::impl::ReadScanEnable(hci::ScanEnable scan_enable) {
+  switch (scan_enable) {
+    case hci::ScanEnable::INQUIRY_SCAN_ONLY:
+      inquiry_scan_enabled_ = true;
+      page_scan_enabled_ = false;
+      break;
+
+    case hci::ScanEnable::PAGE_SCAN_ONLY:
+      inquiry_scan_enabled_ = false;
+      page_scan_enabled_ = true;
+      break;
+
+    case hci::ScanEnable::INQUIRY_AND_PAGE_SCAN:
+      inquiry_scan_enabled_ = true;
+      page_scan_enabled_ = true;
+      break;
+
+    default:
+      inquiry_scan_enabled_ = false;
+      page_scan_enabled_ = false;
+      break;
+  }
+}
+
+void neighbor::ScanModule::impl::SetInquiryScan(bool enabled) {
+  inquiry_scan_enabled_ = enabled;
+  WriteScanEnable();
+}
+
+void neighbor::ScanModule::impl::SetPageScan(bool enabled) {
+  page_scan_enabled_ = enabled;
+  WriteScanEnable();
+}
+
+bool neighbor::ScanModule::impl::IsInquiryEnabled() const {
+  return inquiry_scan_enabled_;
+}
+
+bool neighbor::ScanModule::impl::IsPageEnabled() const {
+  return page_scan_enabled_;
+}
+
+void neighbor::ScanModule::impl::Start() {
+  hci_layer_ = module_.GetDependency<hci::HciLayer>();
+  handler_ = module_.GetHandler();
+
+  std::unique_ptr<hci::ReadScanEnableBuilder> packet = hci::ReadScanEnableBuilder::Create();
+  hci_layer_->EnqueueCommand(std::move(packet), common::BindOnce(&impl::OnCommandComplete, common::Unretained(this)),
+                             handler_);
+}
+
+void neighbor::ScanModule::impl::Stop() {
+  LOG_DEBUG("inquiry scan enabled:%d page scan enabled:%d", inquiry_scan_enabled_, page_scan_enabled_);
+}
+
+neighbor::ScanModule::ScanModule() : pimpl_(std::make_unique<impl>(*this)) {}
+
+neighbor::ScanModule::~ScanModule() {
+  pimpl_.reset();
+}
+
+void neighbor::ScanModule::SetInquiryScan() {
+  pimpl_->SetInquiryScan(true);
+}
+
+void neighbor::ScanModule::ClearInquiryScan() {
+  pimpl_->SetInquiryScan(false);
+}
+
+void neighbor::ScanModule::SetPageScan() {
+  pimpl_->SetPageScan(true);
+}
+
+void neighbor::ScanModule::ClearPageScan() {
+  pimpl_->SetPageScan(false);
+}
+
+bool neighbor::ScanModule::IsInquiryEnabled() const {
+  return pimpl_->IsInquiryEnabled();
+}
+
+bool neighbor::ScanModule::IsPageEnabled() const {
+  return pimpl_->IsPageEnabled();
+}
+
+void neighbor::ScanModule::ListDependencies(ModuleList* list) {
+  list->add<hci::HciLayer>();
+}
+
+void neighbor::ScanModule::Start() {
+  pimpl_->Start();
+}
+
+void neighbor::ScanModule::Stop() {
+  pimpl_->Stop();
+}
+
+}  // namespace neighbor
+}  // namespace bluetooth
diff --git a/gd/neighbor/scan.h b/gd/neighbor/scan.h
new file mode 100644
index 0000000..b6499d3
--- /dev/null
+++ b/gd/neighbor/scan.h
@@ -0,0 +1,53 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+#pragma once
+
+#include <memory>
+
+#include "module.h"
+
+namespace bluetooth {
+namespace neighbor {
+
+class ScanModule : public bluetooth::Module {
+ public:
+  ScanModule();
+  ~ScanModule();
+
+  void SetInquiryScan();
+  void ClearInquiryScan();
+  bool IsInquiryEnabled() const;
+
+  void SetPageScan();
+  void ClearPageScan();
+  bool IsPageEnabled() const;
+
+  static const ModuleFactory Factory;
+
+ protected:
+  void ListDependencies(ModuleList* list) override;
+  void Start() override;
+  void Stop() override;
+
+ private:
+  struct impl;
+  std::unique_ptr<impl> pimpl_;
+
+  DISALLOW_COPY_AND_ASSIGN(ScanModule);
+};
+
+}  // namespace neighbor
+}  // namespace bluetooth
diff --git a/gd/neighbor/scan_parameters.h b/gd/neighbor/scan_parameters.h
new file mode 100644
index 0000000..8927ee1
--- /dev/null
+++ b/gd/neighbor/scan_parameters.h
@@ -0,0 +1,42 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+#pragma once
+
+#include <cstdint>
+
+namespace bluetooth {
+namespace neighbor {
+
+static constexpr double kTimeTickMs = 0.625;
+
+using ScanInterval = uint16_t;  // Range 0x0012 to 0x1000; only even values valid  11.25 to 2560ms
+using ScanWindow = uint16_t;    // Range 0x0011 to 0x1000;  10.625ms to 2560ms
+
+inline double ScanIntervalTimeMs(ScanInterval interval) {
+  return kTimeTickMs * interval;
+}
+
+inline double ScanWindowTimeMs(ScanWindow window) {
+  return kTimeTickMs * window;
+}
+
+using ScanParameters = struct {
+  ScanInterval interval;
+  ScanWindow window;
+};
+
+}  // namespace neighbor
+}  // namespace bluetooth
diff --git a/gd/os/alarm.h b/gd/os/alarm.h
index c23ec9e..e529fb9 100644
--- a/gd/os/alarm.h
+++ b/gd/os/alarm.h
@@ -20,6 +20,8 @@
 #include <memory>
 #include <mutex>
 
+#include "common/callback.h"
+#include "os/handler.h"
 #include "os/thread.h"
 #include "os/utils.h"
 
@@ -31,11 +33,8 @@
 // itself from the thread.
 class Alarm {
  public:
-  // Create and register a single-shot alarm on given thread
-  explicit Alarm(Thread* thread);
-
-  // Create and register a single-shot alarm with a given reactor
-  explicit Alarm(Reactor* reactor);
+  // Create and register a single-shot alarm on a given handler
+  explicit Alarm(Handler* handler);
 
   // Unregister this alarm from the thread and release resource
   ~Alarm();
@@ -43,14 +42,14 @@
   DISALLOW_COPY_AND_ASSIGN(Alarm);
 
   // Schedule the alarm with given delay
-  void Schedule(Closure task, std::chrono::milliseconds delay);
+  void Schedule(OnceClosure task, std::chrono::milliseconds delay);
 
   // Cancel the alarm. No-op if it's not armed.
   void Cancel();
 
  private:
-  Closure task_;
-  Reactor* reactor_;
+  OnceClosure task_;
+  Handler* handler_;
   int fd_ = 0;
   Reactor::Reactable* token_;
   mutable std::mutex mutex_;
diff --git a/gd/os/alarm_benchmark.cc b/gd/os/alarm_benchmark.cc
index 54b8a38..2150625 100644
--- a/gd/os/alarm_benchmark.cc
+++ b/gd/os/alarm_benchmark.cc
@@ -20,12 +20,15 @@
 
 #include "benchmark/benchmark.h"
 
+#include "common/bind.h"
 #include "os/alarm.h"
 #include "os/repeating_alarm.h"
 #include "os/thread.h"
 
 using ::benchmark::State;
+using ::bluetooth::common::Bind;
 using ::bluetooth::os::Alarm;
+using ::bluetooth::os::Handler;
 using ::bluetooth::os::RepeatingAlarm;
 using ::bluetooth::os::Thread;
 
@@ -34,8 +37,9 @@
   void SetUp(State& st) override {
     ::benchmark::Fixture::SetUp(st);
     thread_ = std::make_unique<Thread>("timer_benchmark", Thread::Priority::REAL_TIME);
-    alarm_ = std::make_unique<Alarm>(thread_.get());
-    repeating_alarm_ = std::make_unique<RepeatingAlarm>(thread_.get());
+    handler_ = std::make_unique<Handler>(thread_.get());
+    alarm_ = std::make_unique<Alarm>(handler_.get());
+    repeating_alarm_ = std::make_unique<RepeatingAlarm>(handler_.get());
     map_.clear();
     scheduled_tasks_ = 0;
     task_length_ = 0;
@@ -47,6 +51,7 @@
   void TearDown(State& st) override {
     alarm_ = nullptr;
     repeating_alarm_ = nullptr;
+    handler_ = nullptr;
     thread_->Stop();
     thread_ = nullptr;
     ::benchmark::Fixture::TearDown(st);
@@ -75,6 +80,7 @@
   std::promise<void> promise_;
   std::chrono::time_point<std::chrono::steady_clock> start_time_;
   std::unique_ptr<Thread> thread_;
+  std::unique_ptr<Handler> handler_;
   std::unique_ptr<Alarm> alarm_;
   std::unique_ptr<RepeatingAlarm> repeating_alarm_;
 };
@@ -83,7 +89,9 @@
   auto milliseconds = static_cast<int>(state.range(0));
   for (auto _ : state) {
     auto start_time_point = std::chrono::steady_clock::now();
-    alarm_->Schedule([this] { return TimerFire(); }, std::chrono::milliseconds(milliseconds));
+    alarm_->Schedule(
+        Bind(&BM_ReactableAlarm_timer_performance_ms_Benchmark::TimerFire, bluetooth::common::Unretained(this)),
+        std::chrono::milliseconds(milliseconds));
     promise_.get_future().get();
     auto end_time_point = std::chrono::steady_clock::now();
     auto duration = std::chrono::duration_cast<std::chrono::nanoseconds>(end_time_point - start_time_point);
@@ -109,7 +117,9 @@
     task_length_ = state.range(1);
     task_interval_ = state.range(2);
     start_time_ = std::chrono::steady_clock::now();
-    repeating_alarm_->Schedule([this] { AlarmSleepAndCountDelayedTime(); }, std::chrono::milliseconds(task_interval_));
+    repeating_alarm_->Schedule(Bind(&BM_ReactableAlarm_periodic_accuracy_Benchmark::AlarmSleepAndCountDelayedTime,
+                                    bluetooth::common::Unretained(this)),
+                               std::chrono::milliseconds(task_interval_));
     promise_.get_future().get();
     repeating_alarm_->Cancel();
   }
diff --git a/gd/os/handler.h b/gd/os/handler.h
index ffc3cb3..d9dea0b 100644
--- a/gd/os/handler.h
+++ b/gd/os/handler.h
@@ -21,6 +21,7 @@
 #include <mutex>
 #include <queue>
 
+#include "common/callback.h"
 #include "os/thread.h"
 #include "os/utils.h"
 
@@ -35,26 +36,33 @@
   // Create and register a handler on given thread
   explicit Handler(Thread* thread);
 
-  // Create and register a handler with a given reactor
-  explicit Handler(Reactor* reactor);
-
   // Unregister this handler from the thread and release resource. Unhandled events will be discarded and not executed.
   ~Handler();
 
   DISALLOW_COPY_AND_ASSIGN(Handler);
 
   // Enqueue a closure to the queue of this handler
-  void Post(Closure closure);
+  void Post(OnceClosure closure);
 
   // Remove all pending events from the queue of this handler
   void Clear();
 
+  // Die if the current reactable doesn't stop before the timeout.  Must be called after Clear()
+  void WaitUntilStopped(std::chrono::milliseconds timeout);
+
   template <typename T>
   friend class Queue;
 
+  friend class Alarm;
+
+  friend class RepeatingAlarm;
+
  private:
-  std::queue<Closure> tasks_;
-  Reactor* reactor_;
+  inline bool was_cleared() const {
+    return tasks_ == nullptr;
+  };
+  std::queue<OnceClosure>* tasks_;
+  Thread* thread_;
   int fd_;
   Reactor::Reactable* reactable_;
   mutable std::mutex mutex_;
diff --git a/gd/os/linux_generic/alarm.cc b/gd/os/linux_generic/alarm.cc
index a3d46a8..a2d895e 100644
--- a/gd/os/linux_generic/alarm.cc
+++ b/gd/os/linux_generic/alarm.cc
@@ -20,6 +20,7 @@
 #include <cstring>
 #include <unistd.h>
 
+#include "common/bind.h"
 #include "os/log.h"
 #include "os/utils.h"
 
@@ -32,23 +33,22 @@
 namespace bluetooth {
 namespace os {
 
-Alarm::Alarm(Reactor* reactor) : reactor_(reactor), fd_(timerfd_create(ALARM_CLOCK, 0)) {
+Alarm::Alarm(Handler* handler) : handler_(handler), fd_(timerfd_create(ALARM_CLOCK, 0)) {
   ASSERT_LOG(fd_ != -1, "cannot create timerfd: %s", strerror(errno));
 
-  token_ = reactor_->Register(fd_, [this] { on_fire(); }, nullptr);
+  token_ = handler_->thread_->GetReactor()->Register(fd_, common::Bind(&Alarm::on_fire, common::Unretained(this)),
+                                                     Closure());
 }
 
-Alarm::Alarm(Thread* thread) : Alarm(thread->GetReactor()) {}
-
 Alarm::~Alarm() {
-  reactor_->Unregister(token_);
+  handler_->thread_->GetReactor()->Unregister(token_);
 
   int close_status;
   RUN_NO_INTR(close_status = close(fd_));
   ASSERT(close_status != -1);
 }
 
-void Alarm::Schedule(Closure task, std::chrono::milliseconds delay) {
+void Alarm::Schedule(OnceClosure task, std::chrono::milliseconds delay) {
   std::lock_guard<std::mutex> lock(mutex_);
   long delay_ms = delay.count();
   itimerspec timer_itimerspec{
@@ -74,7 +74,7 @@
   uint64_t times_invoked;
   auto bytes_read = read(fd_, &times_invoked, sizeof(uint64_t));
   lock.unlock();
-  task();
+  std::move(task).Run();
   ASSERT(bytes_read == static_cast<ssize_t>(sizeof(uint64_t)));
   ASSERT(times_invoked == static_cast<uint64_t>(1));
 }
diff --git a/gd/os/linux_generic/alarm_unittest.cc b/gd/os/linux_generic/alarm_unittest.cc
index 3ffd0d9..b389a82 100644
--- a/gd/os/linux_generic/alarm_unittest.cc
+++ b/gd/os/linux_generic/alarm_unittest.cc
@@ -18,26 +18,33 @@
 
 #include <future>
 
+#include "common/bind.h"
 #include "gtest/gtest.h"
 
 namespace bluetooth {
 namespace os {
 namespace {
 
+using common::BindOnce;
+
 class AlarmTest : public ::testing::Test {
  protected:
   void SetUp() override {
     thread_ = new Thread("test_thread", Thread::Priority::NORMAL);
-    alarm_ = new Alarm(thread_);
+    handler_ = new Handler(thread_);
+    alarm_ = new Alarm(handler_);
   }
 
   void TearDown() override {
     delete alarm_;
+    handler_->Clear();
+    delete handler_;
     delete thread_;
   }
   Alarm* alarm_;
 
  private:
+  Handler* handler_;
   Thread* thread_;
 };
 
@@ -51,7 +58,8 @@
   auto before = std::chrono::steady_clock::now();
   int delay_ms = 10;
   int delay_error_ms = 3;
-  alarm_->Schedule([&promise]() { promise.set_value(); }, std::chrono::milliseconds(delay_ms));
+  alarm_->Schedule(BindOnce(&std::promise<void>::set_value, common::Unretained(&promise)),
+                   std::chrono::milliseconds(delay_ms));
   future.get();
   auto after = std::chrono::steady_clock::now();
   auto duration_ms = std::chrono::duration_cast<std::chrono::milliseconds>(after - before);
@@ -59,26 +67,27 @@
 }
 
 TEST_F(AlarmTest, cancel_alarm) {
-  alarm_->Schedule([]() { ASSERT_TRUE(false) << "Should not happen"; }, std::chrono::milliseconds(3));
+  alarm_->Schedule(BindOnce([]() { ASSERT_TRUE(false) << "Should not happen"; }), std::chrono::milliseconds(3));
   alarm_->Cancel();
   std::this_thread::sleep_for(std::chrono::milliseconds(5));
 }
 
 TEST_F(AlarmTest, cancel_alarm_from_callback) {
-  alarm_->Schedule([this]() { this->alarm_->Cancel(); }, std::chrono::milliseconds(1));
+  alarm_->Schedule(BindOnce(&Alarm::Cancel, common::Unretained(alarm_)), std::chrono::milliseconds(1));
   std::this_thread::sleep_for(std::chrono::milliseconds(5));
 }
 
 TEST_F(AlarmTest, schedule_while_alarm_armed) {
-  alarm_->Schedule([]() { ASSERT_TRUE(false) << "Should not happen"; }, std::chrono::milliseconds(1));
+  alarm_->Schedule(BindOnce([]() { ASSERT_TRUE(false) << "Should not happen"; }), std::chrono::milliseconds(1));
   std::promise<void> promise;
   auto future = promise.get_future();
-  alarm_->Schedule([&promise]() { promise.set_value(); }, std::chrono::milliseconds(10));
+  alarm_->Schedule(BindOnce(&std::promise<void>::set_value, common::Unretained(&promise)),
+                   std::chrono::milliseconds(10));
   future.get();
 }
 
 TEST_F(AlarmTest, delete_while_alarm_armed) {
-  alarm_->Schedule([]() { ASSERT_TRUE(false) << "Should not happen"; }, std::chrono::milliseconds(1));
+  alarm_->Schedule(BindOnce([]() { ASSERT_TRUE(false) << "Should not happen"; }), std::chrono::milliseconds(1));
   delete alarm_;
   alarm_ = nullptr;
   std::this_thread::sleep_for(std::chrono::milliseconds(10));
diff --git a/gd/os/linux_generic/handler.cc b/gd/os/linux_generic/handler.cc
index 8897998..85cbcc3 100644
--- a/gd/os/linux_generic/handler.cc
+++ b/gd/os/linux_generic/handler.cc
@@ -17,9 +17,11 @@
 #include "os/handler.h"
 
 #include <sys/eventfd.h>
-#include <cstring>
 #include <unistd.h>
+#include <cstring>
 
+#include "common/bind.h"
+#include "common/callback.h"
 #include "os/log.h"
 #include "os/reactor.h"
 #include "os/utils.h"
@@ -31,27 +33,31 @@
 namespace bluetooth {
 namespace os {
 
-Handler::Handler(Reactor* reactor) : reactor_(reactor), fd_(eventfd(0, EFD_SEMAPHORE | EFD_NONBLOCK)) {
+Handler::Handler(Thread* thread)
+    : tasks_(new std::queue<OnceClosure>()), thread_(thread), fd_(eventfd(0, EFD_SEMAPHORE | EFD_NONBLOCK)) {
   ASSERT(fd_ != -1);
-
-  reactable_ = reactor_->Register(fd_, [this] { this->handle_next_event(); }, nullptr);
+  reactable_ = thread_->GetReactor()->Register(fd_, common::Bind(&Handler::handle_next_event, common::Unretained(this)),
+                                               common::Closure());
 }
 
-Handler::Handler(Thread* thread) : Handler(thread->GetReactor()) {}
-
 Handler::~Handler() {
-  reactor_->Unregister(reactable_);
-  reactable_ = nullptr;
+  {
+    std::lock_guard<std::mutex> lock(mutex_);
+    ASSERT_LOG(was_cleared(), "Handlers must be cleared before they are destroyed");
+  }
 
   int close_status;
   RUN_NO_INTR(close_status = close(fd_));
   ASSERT(close_status != -1);
 }
 
-void Handler::Post(Closure closure) {
+void Handler::Post(OnceClosure closure) {
   {
     std::lock_guard<std::mutex> lock(mutex_);
-    tasks_.emplace(std::move(closure));
+    if (was_cleared()) {
+      return;
+    }
+    tasks_->emplace(std::move(closure));
   }
   uint64_t val = 1;
   auto write_result = eventfd_write(fd_, val);
@@ -59,34 +65,43 @@
 }
 
 void Handler::Clear() {
-  std::lock_guard<std::mutex> lock(mutex_);
-
-  std::queue<Closure> empty;
-  std::swap(tasks_, empty);
+  std::queue<OnceClosure>* tmp = nullptr;
+  {
+    std::lock_guard<std::mutex> lock(mutex_);
+    ASSERT_LOG(!was_cleared(), "Handlers must only be cleared once");
+    std::swap(tasks_, tmp);
+  }
+  delete tmp;
 
   uint64_t val;
   while (eventfd_read(fd_, &val) == 0) {
   }
+
+  thread_->GetReactor()->Unregister(reactable_);
+  reactable_ = nullptr;
+}
+
+void Handler::WaitUntilStopped(std::chrono::milliseconds timeout) {
+  ASSERT(reactable_ == nullptr);
+  ASSERT(thread_->GetReactor()->WaitForUnregisteredReactable(timeout));
 }
 
 void Handler::handle_next_event() {
-  Closure closure;
-  uint64_t val = 0;
-  auto read_result = eventfd_read(fd_, &val);
-  if (read_result == -1 && errno == EAGAIN) {
-    // We were told there was an item, but it was removed before we got there
-    // (aka the queue was cleared). Not a fatal error, so just bail.
-    return;
-  }
-
-  ASSERT(read_result != -1);
-
+  common::OnceClosure closure;
   {
     std::lock_guard<std::mutex> lock(mutex_);
-    closure = std::move(tasks_.front());
-    tasks_.pop();
+    uint64_t val = 0;
+    auto read_result = eventfd_read(fd_, &val);
+
+    if (was_cleared()) {
+      return;
+    }
+    ASSERT_LOG(read_result != -1, "eventfd read error %d %s", errno, strerror(errno));
+
+    closure = std::move(tasks_->front());
+    tasks_->pop();
   }
-  closure();
+  std::move(closure).Run();
 }
 
 }  // namespace os
diff --git a/gd/os/linux_generic/handler_unittest.cc b/gd/os/linux_generic/handler_unittest.cc
index 7e0488f..80456db 100644
--- a/gd/os/linux_generic/handler_unittest.cc
+++ b/gd/os/linux_generic/handler_unittest.cc
@@ -17,9 +17,13 @@
 #include "os/handler.h"
 
 #include <sys/eventfd.h>
+#include <future>
 #include <thread>
 
+#include "common/bind.h"
+#include "common/callback.h"
 #include "gtest/gtest.h"
+#include "os/log.h"
 
 namespace bluetooth {
 namespace os {
@@ -40,31 +44,103 @@
   Thread* thread_;
 };
 
-TEST_F(HandlerTest, empty) {}
+TEST_F(HandlerTest, empty) {
+  handler_->Clear();
+}
 
 TEST_F(HandlerTest, post_task_invoked) {
   int val = 0;
-  Closure closure = [&val]() { val++; };
-  handler_->Post(closure);
-  std::this_thread::sleep_for(std::chrono::milliseconds(10));
-  EXPECT_EQ(val, 1);
+  std::promise<void> closure_ran;
+  auto future = closure_ran.get_future();
+  OnceClosure closure = common::BindOnce(
+      [](int* val, std::promise<void> closure_ran) {
+        *val = *val + 1;
+        closure_ran.set_value();
+      },
+      common::Unretained(&val), std::move(closure_ran));
+  handler_->Post(std::move(closure));
+  future.wait();
+  ASSERT_EQ(val, 1);
+  handler_->Clear();
 }
 
 TEST_F(HandlerTest, post_task_cleared) {
   int val = 0;
-  Closure closure = [&val]() {
-    val++;
-    std::this_thread::sleep_for(std::chrono::milliseconds(5));
-  };
-  handler_->Post(std::move(closure));
-  closure = []() {
-    ASSERT_TRUE(false);
-  };
-  std::this_thread::sleep_for(std::chrono::milliseconds(5));
-  handler_->Post(std::move(closure));
+  std::promise<void> closure_started;
+  auto closure_started_future = closure_started.get_future();
+  std::promise<void> closure_can_continue;
+  auto can_continue_future = closure_can_continue.get_future();
+  handler_->Post(common::BindOnce(
+      [](int* val, std::promise<void> closure_started, std::future<void> can_continue_future) {
+        closure_started.set_value();
+        *val = *val + 1;
+        can_continue_future.wait();
+      },
+      common::Unretained(&val), std::move(closure_started), std::move(can_continue_future)));
+  handler_->Post(common::BindOnce([]() { ASSERT_TRUE(false); }));
+  closure_started_future.wait();
   handler_->Clear();
-  std::this_thread::sleep_for(std::chrono::milliseconds(10));
-  EXPECT_EQ(val, 1);
+  closure_can_continue.set_value();
+  ASSERT_EQ(val, 1);
+}
+
+void check_int(std::unique_ptr<int> number, std::shared_ptr<int> to_change) {
+  *to_change = *number;
+}
+
+TEST_F(HandlerTest, once_callback) {
+  auto number = std::make_unique<int>(1);
+  auto to_change = std::make_shared<int>(0);
+  auto once_callback = common::BindOnce(&check_int, std::move(number), to_change);
+  std::move(once_callback).Run();
+  EXPECT_EQ(*to_change, 1);
+  handler_->Clear();
+}
+
+TEST_F(HandlerTest, callback_with_promise) {
+  std::promise<void> promise;
+  auto future = promise.get_future();
+  auto once_callback = common::BindOnce(&std::promise<void>::set_value, common::Unretained(&promise));
+  std::move(once_callback).Run();
+  future.wait();
+  handler_->Clear();
+}
+
+// For Death tests, all the threading needs to be done in the ASSERT_DEATH call
+class HandlerDeathTest : public ::testing::Test {
+ protected:
+  void ThreadSetUp() {
+    thread_ = new Thread("test_thread", Thread::Priority::NORMAL);
+    handler_ = new Handler(thread_);
+  }
+
+  void ThreadTearDown() {
+    delete handler_;
+    delete thread_;
+  }
+
+  void ClearTwice() {
+    ThreadSetUp();
+    handler_->Clear();
+    handler_->Clear();
+    ThreadTearDown();
+  }
+
+  void NotCleared() {
+    ThreadSetUp();
+    ThreadTearDown();
+  }
+
+  Handler* handler_;
+  Thread* thread_;
+};
+
+TEST_F(HandlerDeathTest, clear_after_handler_cleared) {
+  ASSERT_DEATH(ClearTwice(), "Handlers must only be cleared once");
+}
+
+TEST_F(HandlerDeathTest, not_cleared_before_destruction) {
+  ASSERT_DEATH(NotCleared(), "Handlers must be cleared");
 }
 
 }  // namespace
diff --git a/gd/os/linux_generic/queue.tpp b/gd/os/linux_generic/queue.tpp
index f8ea329..bd9a292 100644
--- a/gd/os/linux_generic/queue.tpp
+++ b/gd/os/linux_generic/queue.tpp
@@ -29,15 +29,17 @@
   ASSERT(enqueue_.handler_ == nullptr);
   ASSERT(enqueue_.reactable_ == nullptr);
   enqueue_.handler_ = handler;
-  enqueue_.reactable_ = enqueue_.handler_->reactor_->Register(
-      enqueue_.reactive_semaphore_.GetFd(), [this, callback] { EnqueueCallbackInternal(callback); }, nullptr);
+  enqueue_.reactable_ = enqueue_.handler_->thread_->GetReactor()->Register(
+      enqueue_.reactive_semaphore_.GetFd(),
+      base::Bind(&Queue<T>::EnqueueCallbackInternal, base::Unretained(this), std::move(callback)),
+      base::Closure());
 }
 
 template <typename T>
 void Queue<T>::UnregisterEnqueue() {
   std::lock_guard<std::mutex> lock(mutex_);
   ASSERT(enqueue_.reactable_ != nullptr);
-  enqueue_.handler_->reactor_->Unregister(enqueue_.reactable_);
+  enqueue_.handler_->thread_->GetReactor()->Unregister(enqueue_.reactable_);
   enqueue_.reactable_ = nullptr;
   enqueue_.handler_ = nullptr;
 }
@@ -48,15 +50,15 @@
   ASSERT(dequeue_.handler_ == nullptr);
   ASSERT(dequeue_.reactable_ == nullptr);
   dequeue_.handler_ = handler;
-  dequeue_.reactable_ =
-      dequeue_.handler_->reactor_->Register(dequeue_.reactive_semaphore_.GetFd(), [callback] { callback(); }, nullptr);
+  dequeue_.reactable_ = dequeue_.handler_->thread_->GetReactor()->Register(dequeue_.reactive_semaphore_.GetFd(),
+                                                                           callback, base::Closure());
 }
 
 template <typename T>
 void Queue<T>::UnregisterDequeue() {
   std::lock_guard<std::mutex> lock(mutex_);
   ASSERT(dequeue_.reactable_ != nullptr);
-  dequeue_.handler_->reactor_->Unregister(dequeue_.reactable_);
+  dequeue_.handler_->thread_->GetReactor()->Unregister(dequeue_.reactable_);
   dequeue_.reactable_ = nullptr;
   dequeue_.handler_ = nullptr;
 }
@@ -81,7 +83,7 @@
 
 template <typename T>
 void Queue<T>::EnqueueCallbackInternal(EnqueueCallback callback) {
-  std::unique_ptr<T> data = callback();
+  std::unique_ptr<T> data = callback.Run();
   ASSERT(data != nullptr);
   std::lock_guard<std::mutex> lock(mutex_);
   enqueue_.reactive_semaphore_.Decrease();
diff --git a/gd/os/linux_generic/queue_unittest.cc b/gd/os/linux_generic/queue_unittest.cc
index 9c18527..f0ca2bd 100644
--- a/gd/os/linux_generic/queue_unittest.cc
+++ b/gd/os/linux_generic/queue_unittest.cc
@@ -20,6 +20,7 @@
 #include <future>
 #include <unordered_map>
 
+#include "common/bind.h"
 #include "gtest/gtest.h"
 #include "os/reactor.h"
 
@@ -41,8 +42,10 @@
     dequeue_handler_ = new Handler(dequeue_thread_);
   }
   void TearDown() override {
+    enqueue_handler_->Clear();
     delete enqueue_handler_;
     delete enqueue_thread_;
+    dequeue_handler_->Clear();
     delete dequeue_handler_;
     delete dequeue_thread_;
     enqueue_handler_ = nullptr;
@@ -57,44 +60,24 @@
   Handler* dequeue_handler_;
 };
 
-class QueueTestSingleThread : public ::testing::Test {
- protected:
-  void SetUp() override {
-    reactor_ = new Reactor();
-    enqueue_handler_ = new Handler(reactor_);
-    dequeue_handler_ = new Handler(reactor_);
-  }
-  void TearDown() override {
-    delete enqueue_handler_;
-    delete dequeue_handler_;
-    delete reactor_;
-    enqueue_handler_ = nullptr;
-    dequeue_handler_ = nullptr;
-    reactor_ = nullptr;
-  }
-  Reactor* reactor_;
-  Handler* enqueue_handler_;
-  Handler* dequeue_handler_;
-};
-
 class TestEnqueueEnd {
  public:
   explicit TestEnqueueEnd(Queue<std::string>* queue, Handler* handler)
       : count(0), handler_(handler), queue_(queue), delay_(0) {}
 
+  ~TestEnqueueEnd() {}
+
   void RegisterEnqueue(std::unordered_map<int, std::promise<int>>* promise_map) {
     promise_map_ = promise_map;
-    handler_->Post([this] { queue_->RegisterEnqueue(handler_, [this] { return EnqueueCallbackForTest(); }); });
+    handler_->Post(common::BindOnce(&TestEnqueueEnd::handle_register_enqueue, common::Unretained(this)));
   }
 
   void UnregisterEnqueue() {
     std::promise<void> promise;
     auto future = promise.get_future();
 
-    handler_->Post([this, &promise] {
-      queue_->UnregisterEnqueue();
-      promise.set_value();
-    });
+    handler_->Post(
+        common::BindOnce(&TestEnqueueEnd::handle_unregister_enqueue, common::Unretained(this), std::move(promise)));
     future.wait();
   }
 
@@ -131,6 +114,15 @@
   Queue<std::string>* queue_;
   std::unordered_map<int, std::promise<int>>* promise_map_;
   int delay_;
+
+  void handle_register_enqueue() {
+    queue_->RegisterEnqueue(handler_, common::Bind(&TestEnqueueEnd::EnqueueCallbackForTest, common::Unretained(this)));
+  }
+
+  void handle_unregister_enqueue(std::promise<void> promise) {
+    queue_->UnregisterEnqueue();
+    promise.set_value();
+  }
 };
 
 class TestDequeueEnd {
@@ -138,19 +130,19 @@
   explicit TestDequeueEnd(Queue<std::string>* queue, Handler* handler, int capacity)
       : count(0), handler_(handler), queue_(queue), capacity_(capacity), delay_(0) {}
 
+  ~TestDequeueEnd() {}
+
   void RegisterDequeue(std::unordered_map<int, std::promise<int>>* promise_map) {
     promise_map_ = promise_map;
-    handler_->Post([this] { queue_->RegisterDequeue(handler_, [this] { DequeueCallbackForTest(); }); });
+    handler_->Post(common::BindOnce(&TestDequeueEnd::handle_register_dequeue, common::Unretained(this)));
   }
 
   void UnregisterDequeue() {
     std::promise<void> promise;
     auto future = promise.get_future();
 
-    handler_->Post([this, &promise] {
-      queue_->UnregisterDequeue();
-      promise.set_value();
-    });
+    handler_->Post(
+        common::BindOnce(&TestDequeueEnd::handle_unregister_dequeue, common::Unretained(this), std::move(promise)));
     future.wait();
   }
 
@@ -187,6 +179,15 @@
   std::unordered_map<int, std::promise<int>>* promise_map_;
   int capacity_;
   int delay_;
+
+  void handle_register_dequeue() {
+    queue_->RegisterDequeue(handler_, common::Bind(&TestDequeueEnd::DequeueCallbackForTest, common::Unretained(this)));
+  }
+
+  void handle_unregister_dequeue(std::promise<void> promise) {
+    queue_->UnregisterDequeue();
+    promise.set_value();
+  }
 };
 
 // Enqueue end level : 0 -> queue is full, 1 - >  queue isn't full
@@ -211,8 +212,8 @@
   // Register enqueue and expect data move to Queue
   std::unordered_map<int, std::promise<int>> enqueue_promise_map;
   enqueue_promise_map.emplace(std::piecewise_construct, std::forward_as_tuple(0), std::forward_as_tuple());
-  test_enqueue_end.RegisterEnqueue(&enqueue_promise_map);
   auto enqueue_future = enqueue_promise_map[0].get_future();
+  test_enqueue_end.RegisterEnqueue(&enqueue_promise_map);
   enqueue_future.wait();
   EXPECT_EQ(enqueue_future.get(), 0);
   std::this_thread::sleep_for(std::chrono::milliseconds(20));
@@ -250,8 +251,8 @@
   }
   std::unordered_map<int, std::promise<int>> enqueue_promise_map;
   enqueue_promise_map.emplace(std::piecewise_construct, std::forward_as_tuple(0), std::forward_as_tuple());
-  test_enqueue_end.RegisterEnqueue(&enqueue_promise_map);
   auto enqueue_future = enqueue_promise_map[0].get_future();
+  test_enqueue_end.RegisterEnqueue(&enqueue_promise_map);
   enqueue_future.wait();
   EXPECT_EQ(enqueue_future.get(), 0);
 
@@ -285,16 +286,16 @@
   }
   std::unordered_map<int, std::promise<int>> enqueue_promise_map;
   enqueue_promise_map.emplace(std::piecewise_construct, std::forward_as_tuple(0), std::forward_as_tuple());
-  test_enqueue_end.RegisterEnqueue(&enqueue_promise_map);
   auto enqueue_future = enqueue_promise_map[0].get_future();
+  test_enqueue_end.RegisterEnqueue(&enqueue_promise_map);
   enqueue_future.wait();
   EXPECT_EQ(enqueue_future.get(), 0);
 
   // Register dequeue and expect data move to dequeue end buffer
   std::unordered_map<int, std::promise<int>> dequeue_promise_map;
   dequeue_promise_map.emplace(std::piecewise_construct, std::forward_as_tuple(kQueueSize), std::forward_as_tuple());
-  test_dequeue_end.RegisterDequeue(&dequeue_promise_map);
   auto dequeue_future = dequeue_promise_map[kQueueSize].get_future();
+  test_dequeue_end.RegisterDequeue(&dequeue_promise_map);
   dequeue_future.wait();
   EXPECT_EQ(dequeue_future.get(), kQueueSize);
 
@@ -317,8 +318,8 @@
   }
   std::unordered_map<int, std::promise<int>> enqueue_promise_map;
   enqueue_promise_map.emplace(std::piecewise_construct, std::forward_as_tuple(0), std::forward_as_tuple());
-  test_enqueue_end.RegisterEnqueue(&enqueue_promise_map);
   auto enqueue_future = enqueue_promise_map[0].get_future();
+  test_enqueue_end.RegisterEnqueue(&enqueue_promise_map);
   enqueue_future.wait();
   EXPECT_EQ(enqueue_future.get(), 0);
 
@@ -330,8 +331,8 @@
 
   // Register enqueue and expect data move to Queue
   enqueue_promise_map.emplace(std::piecewise_construct, std::forward_as_tuple(0), std::forward_as_tuple());
-  test_enqueue_end.RegisterEnqueue(&enqueue_promise_map);
   enqueue_future = enqueue_promise_map[0].get_future();
+  test_enqueue_end.RegisterEnqueue(&enqueue_promise_map);
   enqueue_future.wait();
   EXPECT_EQ(enqueue_future.get(), 0);
 }
@@ -351,8 +352,8 @@
   }
   std::unordered_map<int, std::promise<int>> enqueue_promise_map;
   enqueue_promise_map.emplace(std::piecewise_construct, std::forward_as_tuple(0), std::forward_as_tuple());
-  test_enqueue_end.RegisterEnqueue(&enqueue_promise_map);
   auto enqueue_future = enqueue_promise_map[0].get_future();
+  test_enqueue_end.RegisterEnqueue(&enqueue_promise_map);
   enqueue_future.wait();
   EXPECT_EQ(enqueue_future.get(), 0);
 
@@ -360,8 +361,8 @@
   std::unordered_map<int, std::promise<int>> dequeue_promise_map;
   dequeue_promise_map.emplace(std::piecewise_construct, std::forward_as_tuple(kHalfOfQueueSize),
                               std::forward_as_tuple());
-  test_dequeue_end.RegisterDequeue(&dequeue_promise_map);
   auto dequeue_future = dequeue_promise_map[kHalfOfQueueSize].get_future();
+  test_dequeue_end.RegisterDequeue(&dequeue_promise_map);
   dequeue_future.wait();
   EXPECT_EQ(dequeue_future.get(), kHalfOfQueueSize);
 
@@ -388,8 +389,8 @@
   // Register enqueue and expect kQueueSize data move to Queue
   std::unordered_map<int, std::promise<int>> enqueue_promise_map;
   enqueue_promise_map.emplace(std::piecewise_construct, std::forward_as_tuple(kQueueSize), std::forward_as_tuple());
-  test_enqueue_end.RegisterEnqueue(&enqueue_promise_map);
   auto enqueue_future = enqueue_promise_map[kQueueSize].get_future();
+  test_enqueue_end.RegisterEnqueue(&enqueue_promise_map);
   enqueue_future.wait();
   EXPECT_EQ(enqueue_future.get(), kQueueSize);
 
@@ -419,15 +420,15 @@
   std::unordered_map<int, std::promise<int>> dequeue_promise_map;
   dequeue_promise_map.emplace(std::piecewise_construct, std::forward_as_tuple(kHalfOfQueueSize),
                               std::forward_as_tuple());
-  test_dequeue_end.RegisterDequeue(&dequeue_promise_map);
   auto dequeue_future = dequeue_promise_map[kHalfOfQueueSize].get_future();
+  test_dequeue_end.RegisterDequeue(&dequeue_promise_map);
 
   // Register enqueue
   std::unordered_map<int, std::promise<int>> enqueue_promise_map;
   enqueue_promise_map.emplace(std::piecewise_construct, std::forward_as_tuple(kHalfOfQueueSize),
                               std::forward_as_tuple());
-  test_enqueue_end.RegisterEnqueue(&enqueue_promise_map);
   auto enqueue_future = enqueue_promise_map[kHalfOfQueueSize].get_future();
+  test_enqueue_end.RegisterEnqueue(&enqueue_promise_map);
 
   // Dequeue end will unregister when buffer size is kHalfOfQueueSize
   dequeue_future.wait();
@@ -460,19 +461,19 @@
   // Set 20 ms delay for callback and register dequeue
   std::unordered_map<int, std::promise<int>> dequeue_promise_map;
   test_dequeue_end.setDelay(20);
-  test_dequeue_end.RegisterDequeue(&dequeue_promise_map);
   auto dequeue_future = dequeue_promise_map[kHalfOfQueueSize].get_future();
+  test_dequeue_end.RegisterDequeue(&dequeue_promise_map);
 
   // Register enqueue
   std::unordered_map<int, std::promise<int>> enqueue_promise_map;
   enqueue_promise_map.emplace(std::piecewise_construct, std::forward_as_tuple(0), std::forward_as_tuple());
-  test_enqueue_end.RegisterEnqueue(&enqueue_promise_map);
   auto enqueue_future = enqueue_promise_map[0].get_future();
+  test_enqueue_end.RegisterEnqueue(&enqueue_promise_map);
 
   // Wait for enqueue buffer empty and expect queue is full
   enqueue_future.wait();
   EXPECT_EQ(enqueue_future.get(), 0);
-  EXPECT_EQ(test_dequeue_end.buffer_.size(), kQueueSize);
+  EXPECT_GE(test_dequeue_end.buffer_.size(), kQueueSize - 1);
 
   test_dequeue_end.UnregisterDequeue();
 }
@@ -494,13 +495,13 @@
   // Register dequeue
   std::unordered_map<int, std::promise<int>> dequeue_promise_map;
   dequeue_promise_map.emplace(std::piecewise_construct, std::forward_as_tuple(kQueueSize), std::forward_as_tuple());
-  test_dequeue_end.RegisterDequeue(&dequeue_promise_map);
   auto dequeue_future = dequeue_promise_map[kQueueSize].get_future();
+  test_dequeue_end.RegisterDequeue(&dequeue_promise_map);
 
   // Register enqueue
   std::unordered_map<int, std::promise<int>> enqueue_promise_map;
-  test_enqueue_end.RegisterEnqueue(&enqueue_promise_map);
   auto enqueue_future = enqueue_promise_map[0].get_future();
+  test_enqueue_end.RegisterEnqueue(&enqueue_promise_map);
 
   // Wait for all data move from enqueue end buffer to dequeue end buffer
   dequeue_future.wait();
@@ -525,8 +526,8 @@
   std::unordered_map<int, std::promise<int>> enqueue_promise_map;
   enqueue_promise_map.emplace(std::piecewise_construct, std::forward_as_tuple(kQueueSize), std::forward_as_tuple());
   enqueue_promise_map.emplace(std::piecewise_construct, std::forward_as_tuple(0), std::forward_as_tuple());
-  test_enqueue_end.RegisterEnqueue(&enqueue_promise_map);
   auto enqueue_future = enqueue_promise_map[kQueueSize].get_future();
+  test_enqueue_end.RegisterEnqueue(&enqueue_promise_map);
   enqueue_future.wait();
   EXPECT_EQ(enqueue_future.get(), kQueueSize);
 
@@ -563,13 +564,13 @@
   // Register dequeue
   std::unordered_map<int, std::promise<int>> dequeue_promise_map;
   dequeue_promise_map.emplace(std::piecewise_construct, std::forward_as_tuple(kQueueSize), std::forward_as_tuple());
-  test_dequeue_end.RegisterDequeue(&dequeue_promise_map);
   auto dequeue_future = dequeue_promise_map[kQueueSize].get_future();
+  test_dequeue_end.RegisterDequeue(&dequeue_promise_map);
 
   // Register enqueue
   std::unordered_map<int, std::promise<int>> enqueue_promise_map;
-  test_enqueue_end.RegisterEnqueue(&enqueue_promise_map);
   auto enqueue_future = enqueue_promise_map[0].get_future();
+  test_enqueue_end.RegisterEnqueue(&enqueue_promise_map);
 
   // Wait for all data move from enqueue end buffer to dequeue end buffer
   dequeue_future.wait();
@@ -595,8 +596,8 @@
   }
   std::unordered_map<int, std::promise<int>> enqueue_promise_map;
   enqueue_promise_map.emplace(std::piecewise_construct, std::forward_as_tuple(0), std::forward_as_tuple());
-  test_enqueue_end.RegisterEnqueue(&enqueue_promise_map);
   auto enqueue_future = enqueue_promise_map[0].get_future();
+  test_enqueue_end.RegisterEnqueue(&enqueue_promise_map);
   enqueue_future.wait();
   EXPECT_EQ(enqueue_future.get(), 0);
 
@@ -604,8 +605,8 @@
   std::unordered_map<int, std::promise<int>> dequeue_promise_map;
   dequeue_promise_map.emplace(std::piecewise_construct, std::forward_as_tuple(kHalfOfQueueSize),
                               std::forward_as_tuple());
-  test_dequeue_end.RegisterDequeue(&dequeue_promise_map);
   auto dequeue_future = dequeue_promise_map[kHalfOfQueueSize].get_future();
+  test_dequeue_end.RegisterDequeue(&dequeue_promise_map);
   dequeue_future.wait();
   EXPECT_EQ(dequeue_future.get(), kHalfOfQueueSize);
 
@@ -629,8 +630,8 @@
   }
   std::unordered_map<int, std::promise<int>> enqueue_promise_map;
   enqueue_promise_map.emplace(std::piecewise_construct, std::forward_as_tuple(0), std::forward_as_tuple());
-  test_enqueue_end.RegisterEnqueue(&enqueue_promise_map);
   auto enqueue_future = enqueue_promise_map[0].get_future();
+  test_enqueue_end.RegisterEnqueue(&enqueue_promise_map);
   enqueue_future.wait();
   EXPECT_EQ(enqueue_future.get(), 0);
 
@@ -644,8 +645,8 @@
   // Register dequeue, expect kQueueSize move to dequeue end buffer
   std::unordered_map<int, std::promise<int>> dequeue_promise_map;
   dequeue_promise_map.emplace(std::piecewise_construct, std::forward_as_tuple(kQueueSize), std::forward_as_tuple());
-  test_dequeue_end.RegisterDequeue(&dequeue_promise_map);
   auto dequeue_future = dequeue_promise_map[kQueueSize].get_future();
+  test_dequeue_end.RegisterDequeue(&dequeue_promise_map);
   dequeue_future.wait();
   EXPECT_EQ(dequeue_future.get(), kQueueSize);
 
@@ -687,47 +688,147 @@
   // Enqueue a string
   std::string valid = "Valid String";
   std::shared_ptr<std::string> shared = std::make_shared<std::string>(valid);
-  queue->RegisterEnqueue(enqueue_handler_, [queue, shared]() {
-    queue->UnregisterEnqueue();
-    return std::make_unique<std::string>(*shared);
-  });
+  queue->RegisterEnqueue(enqueue_handler_, common::Bind(
+                                               [](Queue<std::string>* queue, std::shared_ptr<std::string> shared) {
+                                                 queue->UnregisterEnqueue();
+                                                 return std::make_unique<std::string>(*shared);
+                                               },
+                                               common::Unretained(queue), shared));
 
   // Dequeue the string
-  queue->RegisterDequeue(dequeue_handler_, [queue, valid]() {
-    queue->UnregisterDequeue();
-    auto answer = *queue->TryDequeue();
-    ASSERT_EQ(answer, valid);
-  });
+  queue->RegisterDequeue(dequeue_handler_, common::Bind(
+                                               [](Queue<std::string>* queue, std::string valid) {
+                                                 queue->UnregisterDequeue();
+                                                 auto answer = *queue->TryDequeue();
+                                                 ASSERT_EQ(answer, valid);
+                                               },
+                                               common::Unretained(queue), valid));
 
   // Wait for both handlers to finish and delete the Queue
   std::promise<void> promise;
   auto future = promise.get_future();
 
-  enqueue_handler_->Post([this, queue, &promise]() {
-    dequeue_handler_->Post([queue, &promise] {
-      delete queue;
-      promise.set_value();
-    });
-  });
+  enqueue_handler_->Post(common::BindOnce(
+      [](os::Handler* dequeue_handler, Queue<std::string>* queue, std::promise<void>* promise) {
+        dequeue_handler->Post(common::BindOnce(
+            [](Queue<std::string>* queue, std::promise<void>* promise) {
+              delete queue;
+              promise->set_value();
+            },
+            common::Unretained(queue), common::Unretained(promise)));
+      },
+      common::Unretained(dequeue_handler_), common::Unretained(queue), common::Unretained(&promise)));
   future.wait();
 }
 
-TEST_F(QueueTestSingleThread, no_unregister_enqueue_death_test) {
-  Queue<std::string>* queue = new Queue<std::string>(kQueueSizeOne);
+// Create all threads for death tests in the function that dies
+class QueueDeathTest : public ::testing::Test {
+ public:
+  void RegisterEnqueueAndDelete() {
+    Thread* enqueue_thread = new Thread("enqueue_thread", Thread::Priority::NORMAL);
+    Handler* enqueue_handler = new Handler(enqueue_thread);
+    Queue<std::string>* queue = new Queue<std::string>(kQueueSizeOne);
+    queue->RegisterEnqueue(enqueue_handler,
+                           common::Bind([]() { return std::make_unique<std::string>("A string to fill the queue"); }));
+    delete queue;
+  }
 
-  queue->RegisterEnqueue(enqueue_handler_,
-                         []() { return std::make_unique<std::string>("A string to fill the queue"); });
+  void RegisterDequeueAndDelete() {
+    Thread* dequeue_thread = new Thread("dequeue_thread", Thread::Priority::NORMAL);
+    Handler* dequeue_handler = new Handler(dequeue_thread);
+    Queue<std::string>* queue = new Queue<std::string>(kQueueSizeOne);
+    queue->RegisterDequeue(dequeue_handler, common::Bind([](Queue<std::string>* queue) { queue->TryDequeue(); },
+                                                         common::Unretained(queue)));
+    delete queue;
+  }
+};
 
-  EXPECT_DEATH(delete queue, "nqueue");
+TEST_F(QueueDeathTest, die_if_enqueue_not_unregistered) {
+  EXPECT_DEATH(RegisterEnqueueAndDelete(), "nqueue");
 }
 
-TEST_F(QueueTestSingleThread, no_unregister_dequeue_death_test) {
-  Queue<std::string>* queue = new Queue<std::string>(kQueueSize);
-
-  queue->RegisterDequeue(dequeue_handler_, []() {});
-
-  EXPECT_DEATH(delete queue, "equeue");
+TEST_F(QueueDeathTest, die_if_dequeue_not_unregistered) {
+  EXPECT_DEATH(RegisterDequeueAndDelete(), "equeue");
 }
+
+class MockIQueueEnqueue : public IQueueEnqueue<int> {
+ public:
+  void RegisterEnqueue(Handler* handler, EnqueueCallback callback) override {
+    EXPECT_FALSE(registered_);
+    registered_ = true;
+    handler->Post(common::BindOnce(&MockIQueueEnqueue::handle_register_enqueue, common::Unretained(this), callback));
+  }
+
+  void handle_register_enqueue(EnqueueCallback callback) {
+    if (dont_handle_register_enqueue_) {
+      return;
+    }
+    while (registered_) {
+      std::unique_ptr<int> front = callback.Run();
+      queue_.push(*front);
+    }
+  }
+
+  void UnregisterEnqueue() override {
+    EXPECT_TRUE(registered_);
+    registered_ = false;
+  }
+
+  bool dont_handle_register_enqueue_ = false;
+  bool registered_ = false;
+  std::queue<int> queue_;
+};
+
+class EnqueueBufferTest : public ::testing::Test {
+ protected:
+  void SetUp() override {
+    thread_ = new Thread("test_thread", Thread::Priority::NORMAL);
+    handler_ = new Handler(thread_);
+  }
+
+  void TearDown() override {
+    handler_->Clear();
+    delete handler_;
+    delete thread_;
+  }
+
+  void SynchronizeHandler() {
+    std::promise<void> promise;
+    auto future = promise.get_future();
+    handler_->Post(common::BindOnce([](std::promise<void> promise) { promise.set_value(); }, std::move(promise)));
+    future.wait();
+  }
+
+  MockIQueueEnqueue enqueue_;
+  EnqueueBuffer<int> enqueue_buffer_{&enqueue_};
+  Thread* thread_;
+  Handler* handler_;
+};
+
+TEST_F(EnqueueBufferTest, enqueue) {
+  int num_items = 10;
+  for (int i = 0; i < num_items; i++) {
+    enqueue_buffer_.Enqueue(std::make_unique<int>(i), handler_);
+  }
+  SynchronizeHandler();
+  for (int i = 0; i < num_items; i++) {
+    ASSERT_EQ(enqueue_.queue_.front(), i);
+    enqueue_.queue_.pop();
+  }
+  ASSERT_FALSE(enqueue_.registered_);
+}
+
+TEST_F(EnqueueBufferTest, clear) {
+  enqueue_.dont_handle_register_enqueue_ = true;
+  int num_items = 10;
+  for (int i = 0; i < num_items; i++) {
+    enqueue_buffer_.Enqueue(std::make_unique<int>(i), handler_);
+  }
+  ASSERT_TRUE(enqueue_.registered_);
+  enqueue_buffer_.Clear();
+  ASSERT_FALSE(enqueue_.registered_);
+}
+
 }  // namespace
 }  // namespace os
 }  // namespace bluetooth
diff --git a/gd/os/linux_generic/reactor.cc b/gd/os/linux_generic/reactor.cc
index 5a52fdb..220d3a9 100644
--- a/gd/os/linux_generic/reactor.cc
+++ b/gd/os/linux_generic/reactor.cc
@@ -39,22 +39,21 @@
 class Reactor::Reactable {
  public:
   Reactable(int fd, Closure on_read_ready, Closure on_write_ready)
-      : fd_(fd),
-        on_read_ready_(std::move(on_read_ready)),
-        on_write_ready_(std::move(on_write_ready)),
-        is_executing_(false) {}
+      : fd_(fd), on_read_ready_(std::move(on_read_ready)), on_write_ready_(std::move(on_write_ready)),
+        is_executing_(false), removed_(false) {}
   const int fd_;
   Closure on_read_ready_;
   Closure on_write_ready_;
   bool is_executing_;
-  std::recursive_mutex lock_;
+  bool removed_;
+  std::mutex mutex_;
+  std::unique_ptr<std::promise<void>> finished_promise_;
 };
 
 Reactor::Reactor()
   : epoll_fd_(0),
     control_fd_(0),
-    is_running_(false),
-    reactable_removed_(false) {
+    is_running_(false) {
   RUN_NO_INTR(epoll_fd_ = epoll_create1(EPOLL_CLOEXEC));
   ASSERT_LOG(epoll_fd_ != -1, "could not create epoll fd: %s", strerror(errno));
 
@@ -80,8 +79,8 @@
 }
 
 void Reactor::Run() {
-  bool previously_running = is_running_.exchange(true);
-  ASSERT(!previously_running);
+  bool already_running = is_running_.exchange(true);
+  ASSERT(!already_running);
 
   for (;;) {
     {
@@ -105,28 +104,30 @@
         return;
       }
       auto* reactable = static_cast<Reactor::Reactable*>(event.data.ptr);
-      {
-        std::unique_lock<std::mutex> lock(mutex_);
-        // See if this reactable has been removed in the meantime.
-        if (std::find(invalidation_list_.begin(), invalidation_list_.end(), reactable) != invalidation_list_.end()) {
-          continue;
-        }
+      std::unique_lock<std::mutex> lock(mutex_);
+      // See if this reactable has been removed in the meantime.
+      if (std::find(invalidation_list_.begin(), invalidation_list_.end(), reactable) != invalidation_list_.end()) {
+        continue;
+      }
 
-        std::lock_guard<std::recursive_mutex> reactable_lock(reactable->lock_);
+      {
+        std::lock_guard<std::mutex> reactable_lock(reactable->mutex_);
         lock.unlock();
-        reactable_removed_ = false;
         reactable->is_executing_ = true;
-        if (event.events & (EPOLLIN | EPOLLHUP | EPOLLRDHUP | EPOLLERR) && reactable->on_read_ready_ != nullptr) {
-          reactable->on_read_ready_();
-        }
-        if (!reactable_removed_ && event.events & EPOLLOUT && reactable->on_write_ready_ != nullptr) {
-          reactable->on_write_ready_();
-        }
+      }
+      if (event.events & (EPOLLIN | EPOLLHUP | EPOLLRDHUP | EPOLLERR) && !reactable->on_read_ready_.is_null()) {
+        reactable->on_read_ready_.Run();
+      }
+      if (event.events & EPOLLOUT && !reactable->on_write_ready_.is_null()) {
+        reactable->on_write_ready_.Run();
+      }
+      {
+        std::lock_guard<std::mutex> reactable_lock(reactable->mutex_);
         reactable->is_executing_ = false;
       }
-      if (reactable_removed_) {
+      if (reactable->removed_) {
+        reactable->finished_promise_->set_value();
         delete reactable;
-        reactable_removed_ = false;
       }
     }
   }
@@ -142,16 +143,16 @@
 
 Reactor::Reactable* Reactor::Register(int fd, Closure on_read_ready, Closure on_write_ready) {
   uint32_t poll_event_type = 0;
-  if (on_read_ready != nullptr) {
+  if (!on_read_ready.is_null()) {
     poll_event_type |= (EPOLLIN | EPOLLRDHUP);
   }
-  if (on_write_ready != nullptr) {
+  if (!on_write_ready.is_null()) {
     poll_event_type |= EPOLLOUT;
   }
   auto* reactable = new Reactable(fd, on_read_ready, on_write_ready);
   epoll_event event = {
       .events = poll_event_type,
-      {.ptr = reactable}
+      .data = {.ptr = reactable},
   };
   int register_fd;
   RUN_NO_INTR(register_fd = epoll_ctl(epoll_fd_, EPOLL_CTL_ADD, fd, &event));
@@ -168,7 +169,7 @@
   bool delaying_delete_until_callback_finished = false;
   {
     int result;
-    std::lock_guard<std::recursive_mutex> reactable_lock(reactable->lock_);
+    std::lock_guard<std::mutex> reactable_lock(reactable->mutex_);
     RUN_NO_INTR(result = epoll_ctl(epoll_fd_, EPOLL_CTL_DEL, reactable->fd_, nullptr));
     if (result == -1 && errno == ENOENT) {
       LOG_INFO("reactable is invalid or unregistered");
@@ -176,10 +177,12 @@
       ASSERT(result != -1);
     }
 
-    // If we are unregistering during the callback event from this reactable, we delete it after the callback is executed.
-    // reactable->is_executing_ is protected by reactable->lock_, so it's thread safe.
+    // If we are unregistering during the callback event from this reactable, we delete it after the callback is
+    // executed. reactable->is_executing_ is protected by reactable->mutex_, so it's thread safe.
     if (reactable->is_executing_) {
-      reactable_removed_ = true;
+      reactable->removed_ = true;
+      reactable->finished_promise_ = std::make_unique<std::promise<void>>();
+      executing_reactable_finished_ = std::make_unique<std::future<void>>(reactable->finished_promise_->get_future());
       delaying_delete_until_callback_finished = true;
     }
   }
@@ -189,24 +192,32 @@
   }
 }
 
+bool Reactor::WaitForUnregisteredReactable(std::chrono::milliseconds timeout) {
+  if (executing_reactable_finished_ == nullptr) {
+    return true;
+  }
+  auto stop_status = executing_reactable_finished_->wait_for(timeout);
+  return stop_status == std::future_status::ready;
+}
+
 void Reactor::ModifyRegistration(Reactor::Reactable* reactable, Closure on_read_ready, Closure on_write_ready) {
   ASSERT(reactable != nullptr);
 
   uint32_t poll_event_type = 0;
-  if (on_read_ready != nullptr) {
+  if (!on_read_ready.is_null()) {
     poll_event_type |= (EPOLLIN | EPOLLRDHUP);
   }
-  if (on_write_ready != nullptr) {
+  if (!on_write_ready.is_null()) {
     poll_event_type |= EPOLLOUT;
   }
   {
-    std::lock_guard<std::recursive_mutex> reactable_lock(reactable->lock_);
+    std::lock_guard<std::mutex> reactable_lock(reactable->mutex_);
     reactable->on_read_ready_ = std::move(on_read_ready);
     reactable->on_write_ready_ = std::move(on_write_ready);
   }
   epoll_event event = {
       .events = poll_event_type,
-      {.ptr = reactable}
+      .data = {.ptr = reactable},
   };
   int modify_fd;
   RUN_NO_INTR(modify_fd = epoll_ctl(epoll_fd_, EPOLL_CTL_MOD, reactable->fd_, &event));
diff --git a/gd/os/linux_generic/reactor_unittest.cc b/gd/os/linux_generic/reactor_unittest.cc
index 9143b29..b9cd07d 100644
--- a/gd/os/linux_generic/reactor_unittest.cc
+++ b/gd/os/linux_generic/reactor_unittest.cc
@@ -21,7 +21,10 @@
 #include <future>
 #include <thread>
 
+#include "common/bind.h"
+#include "common/callback.h"
 #include "gtest/gtest.h"
+#include "os/log.h"
 
 namespace bluetooth {
 namespace os {
@@ -29,6 +32,8 @@
 
 constexpr int kReadReadyValue = 100;
 
+using common::Bind;
+
 std::promise<int>* g_promise;
 
 class ReactorTest : public ::testing::Test {
@@ -86,15 +91,18 @@
   }
 
   void OnReadReady() {
+    LOG_INFO();
     uint64_t value = 0;
     auto read_result = eventfd_read(fd_, &value);
+    LOG_INFO("value = %d", (int)value);
     EXPECT_EQ(read_result, 0);
     if (value == kSetPromise && g_promise != nullptr) {
       g_promise->set_value(kReadReadyValue);
     }
     if (value == kRegisterSampleReactable) {
-      reactable_ = reactor_->Register(sample_reactable_.fd_, [this] { this->sample_reactable_.OnReadReady(); },
-                                      [this] { this->sample_reactable_.OnWriteReady(); });
+      reactable_ =
+          reactor_->Register(sample_reactable_.fd_, Bind(&FakeReactable::OnReadReady, common::Unretained(this)),
+                             Bind(&FakeReactable::OnWriteReadyNoOp, common::Unretained(this)));
       g_promise->set_value(kReadReadyValue);
     }
     if (value == kUnregisterSampleReactable) {
@@ -109,6 +117,8 @@
     EXPECT_EQ(write_result, 0);
   }
 
+  void OnWriteReadyNoOp() {}
+
   void UnregisterInCallback() {
     uint64_t value = 0;
     auto read_result = eventfd_read(fd_, &value);
@@ -126,6 +136,33 @@
   uint64_t output_data_ = kSampleOutputValue;
 };
 
+class FakeRunningReactable {
+ public:
+  FakeRunningReactable() : fd_(eventfd(0, 0)) {
+    EXPECT_NE(fd_, -1);
+  }
+
+  ~FakeRunningReactable() {
+    close(fd_);
+  }
+
+  void OnReadReady() {
+    uint64_t value = 0;
+    auto read_result = eventfd_read(fd_, &value);
+    ASSERT_EQ(read_result, 0);
+    started.set_value();
+    can_finish.get_future().wait();
+    finished.set_value();
+  }
+
+  Reactor::Reactable* reactable_ = nullptr;
+  int fd_;
+
+  std::promise<void> started;
+  std::promise<void> can_finish;
+  std::promise<void> finished;
+};
+
 TEST_F(ReactorTest, start_and_stop) {
   auto reactor_thread = std::thread(&Reactor::Run, reactor_);
   reactor_->Stop();
@@ -149,16 +186,16 @@
 
 TEST_F(ReactorTest, cold_register_only) {
   FakeReactable fake_reactable;
-  auto* reactable =
-      reactor_->Register(fake_reactable.fd_, std::bind(&FakeReactable::OnReadReady, &fake_reactable), nullptr);
+  auto* reactable = reactor_->Register(
+      fake_reactable.fd_, Bind(&FakeReactable::OnReadReady, common::Unretained(&fake_reactable)), Closure());
 
   reactor_->Unregister(reactable);
 }
 
 TEST_F(ReactorTest, cold_register) {
   FakeReactable fake_reactable;
-  auto* reactable =
-      reactor_->Register(fake_reactable.fd_, std::bind(&FakeReactable::OnReadReady, &fake_reactable), nullptr);
+  auto* reactable = reactor_->Register(
+      fake_reactable.fd_, Bind(&FakeReactable::OnReadReady, common::Unretained(&fake_reactable)), Closure());
   auto reactor_thread = std::thread(&Reactor::Run, reactor_);
   auto future = g_promise->get_future();
 
@@ -175,8 +212,8 @@
   auto future = g_promise->get_future();
 
   FakeReactable fake_reactable;
-  auto* reactable =
-      reactor_->Register(fake_reactable.fd_, std::bind(&FakeReactable::OnReadReady, &fake_reactable), nullptr);
+  auto* reactable = reactor_->Register(
+      fake_reactable.fd_, Bind(&FakeReactable::OnReadReady, common::Unretained(&fake_reactable)), Closure());
   auto write_result = eventfd_write(fake_reactable.fd_, FakeReactable::kSetPromise);
   EXPECT_EQ(write_result, 0);
   EXPECT_EQ(future.get(), kReadReadyValue);
@@ -186,10 +223,62 @@
   reactor_->Unregister(reactable);
 }
 
+TEST_F(ReactorTest, unregister_from_different_thread_while_task_is_executing_) {
+  FakeRunningReactable fake_reactable;
+  auto* reactable = reactor_->Register(
+      fake_reactable.fd_, Bind(&FakeRunningReactable::OnReadReady, common::Unretained(&fake_reactable)), Closure());
+  auto reactor_thread = std::thread(&Reactor::Run, reactor_);
+  auto write_result = eventfd_write(fake_reactable.fd_, 1);
+  ASSERT_EQ(write_result, 0);
+  fake_reactable.started.get_future().wait();
+  reactor_->Unregister(reactable);
+  fake_reactable.can_finish.set_value();
+  fake_reactable.finished.get_future().wait();
+
+  reactor_->Stop();
+  reactor_thread.join();
+}
+
+TEST_F(ReactorTest, unregister_from_different_thread_while_task_is_executing_wait_fails) {
+  FakeRunningReactable fake_reactable;
+  auto* reactable = reactor_->Register(
+      fake_reactable.fd_, common::Bind(&FakeRunningReactable::OnReadReady, common::Unretained(&fake_reactable)),
+      common::Closure());
+  auto reactor_thread = std::thread(&Reactor::Run, reactor_);
+  auto write_result = eventfd_write(fake_reactable.fd_, 1);
+  ASSERT_EQ(write_result, 0);
+  fake_reactable.started.get_future().wait();
+  reactor_->Unregister(reactable);
+  ASSERT_FALSE(reactor_->WaitForUnregisteredReactable(std::chrono::milliseconds(1)));
+  fake_reactable.can_finish.set_value();
+  fake_reactable.finished.get_future().wait();
+
+  reactor_->Stop();
+  reactor_thread.join();
+}
+
+TEST_F(ReactorTest, unregister_from_different_thread_while_task_is_executing_wait_succeeds) {
+  FakeRunningReactable fake_reactable;
+  auto* reactable = reactor_->Register(
+      fake_reactable.fd_, common::Bind(&FakeRunningReactable::OnReadReady, common::Unretained(&fake_reactable)),
+      common::Closure());
+  auto reactor_thread = std::thread(&Reactor::Run, reactor_);
+  auto write_result = eventfd_write(fake_reactable.fd_, 1);
+  ASSERT_EQ(write_result, 0);
+  fake_reactable.started.get_future().wait();
+  reactor_->Unregister(reactable);
+  fake_reactable.can_finish.set_value();
+  fake_reactable.finished.get_future().wait();
+  ASSERT_TRUE(reactor_->WaitForUnregisteredReactable(std::chrono::milliseconds(1)));
+
+  reactor_->Stop();
+  reactor_thread.join();
+}
+
 TEST_F(ReactorTest, hot_unregister_from_different_thread) {
   FakeReactable fake_reactable;
-  auto* reactable =
-      reactor_->Register(fake_reactable.fd_, std::bind(&FakeReactable::OnReadReady, &fake_reactable), nullptr);
+  auto* reactable = reactor_->Register(
+      fake_reactable.fd_, Bind(&FakeReactable::OnReadReady, common::Unretained(&fake_reactable)), Closure());
   auto reactor_thread = std::thread(&Reactor::Run, reactor_);
   reactor_->Unregister(reactable);
   auto future = g_promise->get_future();
@@ -208,8 +297,8 @@
   auto future = g_promise->get_future();
 
   FakeReactable fake_reactable(reactor_);
-  auto* reactable =
-      reactor_->Register(fake_reactable.fd_, std::bind(&FakeReactable::OnReadReady, &fake_reactable), nullptr);
+  auto* reactable = reactor_->Register(
+      fake_reactable.fd_, Bind(&FakeReactable::OnReadReady, common::Unretained(&fake_reactable)), Closure());
   auto write_result = eventfd_write(fake_reactable.fd_, FakeReactable::kRegisterSampleReactable);
   EXPECT_EQ(write_result, 0);
   EXPECT_EQ(future.get(), kReadReadyValue);
@@ -229,17 +318,19 @@
   auto future = g_promise->get_future();
 
   FakeReactable fake_reactable(reactor_);
-  auto* reactable =
-      reactor_->Register(fake_reactable.fd_, std::bind(&FakeReactable::OnReadReady, &fake_reactable), nullptr);
+  auto* reactable = reactor_->Register(
+      fake_reactable.fd_, Bind(&FakeReactable::OnReadReady, common::Unretained(&fake_reactable)), Closure());
   auto write_result = eventfd_write(fake_reactable.fd_, FakeReactable::kRegisterSampleReactable);
   EXPECT_EQ(write_result, 0);
   EXPECT_EQ(future.get(), kReadReadyValue);
+  LOG_INFO();
   delete g_promise;
   g_promise = new std::promise<int>;
   future = g_promise->get_future();
   write_result = eventfd_write(fake_reactable.fd_, FakeReactable::kUnregisterSampleReactable);
   EXPECT_EQ(write_result, 0);
   EXPECT_EQ(future.get(), kReadReadyValue);
+  LOG_INFO();
   reactor_->Stop();
   reactor_thread.join();
 
@@ -250,12 +341,12 @@
   auto reactor_thread = std::thread(&Reactor::Run, reactor_);
 
   FakeReactable fake_reactable1(reactor_);
-  auto* reactable1 =
-      reactor_->Register(fake_reactable1.fd_, std::bind(&FakeReactable::OnReadReady, &fake_reactable1), nullptr);
+  auto* reactable1 = reactor_->Register(
+      fake_reactable1.fd_, Bind(&FakeReactable::OnReadReady, common::Unretained(&fake_reactable1)), Closure());
 
   FakeReactable fake_reactable2(reactor_);
-  auto* reactable2 = reactor_->Register(fake_reactable2.fd_,
-                                        std::bind(&FakeReactable::UnregisterInCallback, &fake_reactable2), nullptr);
+  auto* reactable2 = reactor_->Register(
+      fake_reactable2.fd_, Bind(&FakeReactable::UnregisterInCallback, common::Unretained(&fake_reactable2)), Closure());
   fake_reactable2.reactable_ = reactable2;
   auto write_result = eventfd_write(fake_reactable2.fd_, 1);
   EXPECT_EQ(write_result, 0);
@@ -270,12 +361,12 @@
   auto future = g_promise->get_future();
 
   FakeReactable fake_reactable1(reactor_);
-  auto* reactable1 =
-      reactor_->Register(fake_reactable1.fd_, std::bind(&FakeReactable::OnReadReady, &fake_reactable1), nullptr);
+  auto* reactable1 = reactor_->Register(
+      fake_reactable1.fd_, Bind(&FakeReactable::OnReadReady, common::Unretained(&fake_reactable1)), Closure());
 
   FakeReactable fake_reactable2(reactor_);
-  auto* reactable2 = reactor_->Register(fake_reactable2.fd_,
-                                        std::bind(&FakeReactable::UnregisterInCallback, &fake_reactable2), nullptr);
+  auto* reactable2 = reactor_->Register(
+      fake_reactable2.fd_, Bind(&FakeReactable::UnregisterInCallback, common::Unretained(&fake_reactable2)), Closure());
   fake_reactable2.reactable_ = reactable2;
   auto write_result = eventfd_write(fake_reactable2.fd_, 1);
   EXPECT_EQ(write_result, 0);
@@ -299,8 +390,8 @@
 
 TEST_F(ReactorTest, on_write_ready) {
   FakeReactable fake_reactable;
-  auto* reactable =
-      reactor_->Register(fake_reactable.fd_, nullptr, std::bind(&FakeReactable::OnWriteReady, &fake_reactable));
+  auto* reactable = reactor_->Register(fake_reactable.fd_, Closure(),
+                                       Bind(&FakeReactable::OnWriteReady, common::Unretained(&fake_reactable)));
   auto reactor_thread = std::thread(&Reactor::Run, reactor_);
   uint64_t value = 0;
   auto read_result = eventfd_read(fake_reactable.fd_, &value);
@@ -315,9 +406,10 @@
 
 TEST_F(ReactorTest, modify_registration) {
   FakeReactable fake_reactable;
-  auto* reactable =
-      reactor_->Register(fake_reactable.fd_, std::bind(&FakeReactable::OnReadReady, &fake_reactable), nullptr);
-  reactor_->ModifyRegistration(reactable, nullptr, std::bind(&FakeReactable::OnWriteReady, &fake_reactable));
+  auto* reactable = reactor_->Register(
+      fake_reactable.fd_, Bind(&FakeReactable::OnReadReady, common::Unretained(&fake_reactable)), Closure());
+  reactor_->ModifyRegistration(reactable, Closure(),
+                               Bind(&FakeReactable::OnWriteReady, common::Unretained(&fake_reactable)));
   auto reactor_thread = std::thread(&Reactor::Run, reactor_);
   uint64_t value = 0;
   auto read_result = eventfd_read(fake_reactable.fd_, &value);
diff --git a/gd/os/linux_generic/repeating_alarm.cc b/gd/os/linux_generic/repeating_alarm.cc
index b4cb4e7..79cda6d 100644
--- a/gd/os/linux_generic/repeating_alarm.cc
+++ b/gd/os/linux_generic/repeating_alarm.cc
@@ -20,6 +20,7 @@
 #include <cstring>
 #include <unistd.h>
 
+#include "common/bind.h"
 #include "os/log.h"
 #include "os/utils.h"
 
@@ -32,16 +33,15 @@
 namespace bluetooth {
 namespace os {
 
-RepeatingAlarm::RepeatingAlarm(Reactor* reactor) : reactor_(reactor), fd_(timerfd_create(ALARM_CLOCK, 0)) {
+RepeatingAlarm::RepeatingAlarm(Handler* handler) : handler_(handler), fd_(timerfd_create(ALARM_CLOCK, 0)) {
   ASSERT(fd_ != -1);
 
-  token_ = reactor_->Register(fd_, [this] { on_fire(); }, nullptr);
+  token_ = handler_->thread_->GetReactor()->Register(
+      fd_, common::Bind(&RepeatingAlarm::on_fire, common::Unretained(this)), common::Closure());
 }
 
-RepeatingAlarm::RepeatingAlarm(Thread* thread) : RepeatingAlarm(thread->GetReactor()) {}
-
 RepeatingAlarm::~RepeatingAlarm() {
-  reactor_->Unregister(token_);
+  handler_->thread_->GetReactor()->Unregister(token_);
 
   int close_status;
   RUN_NO_INTR(close_status = close(fd_));
@@ -74,7 +74,7 @@
   uint64_t times_invoked;
   auto bytes_read = read(fd_, &times_invoked, sizeof(uint64_t));
   lock.unlock();
-  task();
+  task.Run();
   ASSERT(bytes_read == static_cast<ssize_t>(sizeof(uint64_t)));
 }
 
diff --git a/gd/os/linux_generic/repeating_alarm_unittest.cc b/gd/os/linux_generic/repeating_alarm_unittest.cc
index a017f66..d30bbd9 100644
--- a/gd/os/linux_generic/repeating_alarm_unittest.cc
+++ b/gd/os/linux_generic/repeating_alarm_unittest.cc
@@ -18,6 +18,7 @@
 
 #include <future>
 
+#include "common/bind.h"
 #include "gtest/gtest.h"
 
 namespace bluetooth {
@@ -30,11 +31,14 @@
  protected:
   void SetUp() override {
     thread_ = new Thread("test_thread", Thread::Priority::NORMAL);
-    alarm_ = new RepeatingAlarm(thread_);
+    handler_ = new Handler(thread_);
+    alarm_ = new RepeatingAlarm(handler_);
   }
 
   void TearDown() override {
     delete alarm_;
+    handler_->Clear();
+    delete handler_;
     delete thread_;
   }
 
@@ -43,26 +47,33 @@
     auto future = promise.get_future();
     auto start_time = std::chrono::steady_clock::now();
     int counter = 0;
-    alarm_->Schedule(
-        [&counter, &promise, start_time, scheduled_tasks, task_length_ms, interval_between_tasks_ms]() {
-          counter++;
-          auto time_now = std::chrono::steady_clock::now();
-          auto time_delta = time_now - start_time;
-          if (counter == scheduled_tasks) {
-            promise.set_value();
-          }
-          ASSERT_NEAR(time_delta.count(), interval_between_tasks_ms * 1000000 * counter, error_ms * 1000000);
-          std::this_thread::sleep_for(std::chrono::milliseconds(task_length_ms));
-        },
-        std::chrono::milliseconds(interval_between_tasks_ms));
+    alarm_->Schedule(common::Bind(&RepeatingAlarmTest::verify_delayed_tasks, common::Unretained(this),
+                                  common::Unretained(&counter), start_time, scheduled_tasks,
+                                  common::Unretained(&promise), task_length_ms, interval_between_tasks_ms),
+                     std::chrono::milliseconds(interval_between_tasks_ms));
     future.get();
     alarm_->Cancel();
   }
 
+  void verify_delayed_tasks(int* counter, std::chrono::steady_clock::time_point start_time, int scheduled_tasks,
+                            std::promise<void>* promise, int task_length_ms, int interval_between_tasks_ms) {
+    *counter = *counter + 1;
+    auto time_now = std::chrono::steady_clock::now();
+    auto time_delta = time_now - start_time;
+    if (*counter == scheduled_tasks) {
+      promise->set_value();
+    }
+    ASSERT_NEAR(time_delta.count(), interval_between_tasks_ms * 1000000 * *counter, error_ms * 1000000);
+    std::this_thread::sleep_for(std::chrono::milliseconds(task_length_ms));
+  }
+
   RepeatingAlarm* alarm_;
 
+  Closure should_not_happen_ = common::Bind([] { ASSERT_TRUE(false); });
+
  private:
   Thread* thread_;
+  Handler* handler_;
 };
 
 TEST_F(RepeatingAlarmTest, cancel_while_not_armed) {
@@ -74,7 +85,8 @@
   auto future = promise.get_future();
   auto before = std::chrono::steady_clock::now();
   int period_ms = 10;
-  alarm_->Schedule([&promise]() { promise.set_value(); }, std::chrono::milliseconds(period_ms));
+  alarm_->Schedule(common::Bind(&std::promise<void>::set_value, common::Unretained(&promise)),
+                   std::chrono::milliseconds(period_ms));
   future.get();
   alarm_->Cancel();
   auto after = std::chrono::steady_clock::now();
@@ -83,27 +95,29 @@
 }
 
 TEST_F(RepeatingAlarmTest, cancel_alarm) {
-  alarm_->Schedule([]() { ASSERT_TRUE(false); }, std::chrono::milliseconds(1));
+  alarm_->Schedule(should_not_happen_, std::chrono::milliseconds(1));
   alarm_->Cancel();
   std::this_thread::sleep_for(std::chrono::milliseconds(5));
 }
 
 TEST_F(RepeatingAlarmTest, cancel_alarm_from_callback) {
-  alarm_->Schedule([this]() { this->alarm_->Cancel(); }, std::chrono::milliseconds(1));
+  alarm_->Schedule(common::Bind(&RepeatingAlarm::Cancel, common::Unretained(this->alarm_)),
+                   std::chrono::milliseconds(1));
   std::this_thread::sleep_for(std::chrono::milliseconds(5));
 }
 
 TEST_F(RepeatingAlarmTest, schedule_while_alarm_armed) {
-  alarm_->Schedule([]() { ASSERT_TRUE(false); }, std::chrono::milliseconds(1));
+  alarm_->Schedule(should_not_happen_, std::chrono::milliseconds(1));
   std::promise<void> promise;
   auto future = promise.get_future();
-  alarm_->Schedule([&promise]() { promise.set_value(); }, std::chrono::milliseconds(10));
+  alarm_->Schedule(common::Bind(&std::promise<void>::set_value, common::Unretained(&promise)),
+                   std::chrono::milliseconds(10));
   future.get();
   alarm_->Cancel();
 }
 
 TEST_F(RepeatingAlarmTest, delete_while_alarm_armed) {
-  alarm_->Schedule([]() { ASSERT_TRUE(false); }, std::chrono::milliseconds(1));
+  alarm_->Schedule(should_not_happen_, std::chrono::milliseconds(1));
   delete alarm_;
   alarm_ = nullptr;
   std::this_thread::sleep_for(std::chrono::milliseconds(1));
diff --git a/gd/os/linux_generic/thread_unittest.cc b/gd/os/linux_generic/thread_unittest.cc
index 1e16edc..f0b8f24 100644
--- a/gd/os/linux_generic/thread_unittest.cc
+++ b/gd/os/linux_generic/thread_unittest.cc
@@ -18,6 +18,7 @@
 
 #include <sys/eventfd.h>
 
+#include "common/bind.h"
 #include "gtest/gtest.h"
 #include "os/reactor.h"
 
@@ -85,7 +86,8 @@
   Reactor* reactor = thread->GetReactor();
   SampleReactable sample_reactable(thread);
   auto* reactable =
-      reactor->Register(sample_reactable.fd_, std::bind(&SampleReactable::OnReadReady, &sample_reactable), nullptr);
+      reactor->Register(sample_reactable.fd_,
+                        common::Bind(&SampleReactable::OnReadReady, common::Unretained(&sample_reactable)), Closure());
   int fd = sample_reactable.fd_;
   int write_result = eventfd_write(fd, kCheckIsSameThread);
   EXPECT_EQ(write_result, 0);
diff --git a/gd/os/log.h b/gd/os/log.h
index d7c6a8b..3d8a89f 100644
--- a/gd/os/log.h
+++ b/gd/os/log.h
@@ -28,39 +28,43 @@
 
 #include <log/log.h>
 
-#define LOG_VERBOSE(fmt, args...) ALOGV("%s: " fmt, __PRETTY_FUNCTION__, ##args)
-#define LOG_DEBUG(fmt, args...) ALOGD("%s: " fmt, __PRETTY_FUNCTION__, ##args)
-#define LOG_INFO(fmt, args...) ALOGI("%s: " fmt, __PRETTY_FUNCTION__, ##args)
-#define LOG_WARN(fmt, args...) ALOGW("%s: " fmt, __PRETTY_FUNCTION__, ##args)
-#define LOG_ERROR(fmt, args...) ALOGE("%s: " fmt, __PRETTY_FUNCTION__, ##args)
+#define LOG_VERBOSE(fmt, args...) ALOGV("%s:%d %s: " fmt, __FILE__, __LINE__, __func__, ##args)
+#define LOG_DEBUG(fmt, args...) ALOGD("%s:%d %s: " fmt, __FILE__, __LINE__, __func__, ##args)
+#define LOG_INFO(fmt, args...) ALOGI("%s:%d %s: " fmt, __FILE__, __LINE__, __func__, ##args)
+#define LOG_WARN(fmt, args...) ALOGW("%s:%d %s: " fmt, __FILE__, __LINE__, __func__, ##args)
+#define LOG_ERROR(fmt, args...) ALOGE("%s:%d %s: " fmt, __FILE__, __LINE__, __func__, ##args)
 
 #else
 
 /* syslog didn't work well here since we would be redefining LOG_DEBUG. */
 #include <stdio.h>
 
-#define LOGWRAPPER(fmt, args...) fprintf(stderr, "%s - %s: " fmt "\n", LOG_TAG, __PRETTY_FUNCTION__, ##args)
+#define LOGWRAPPER(fmt, args...) \
+  fprintf(stderr, "%s - %s:%d - %s: " fmt "\n", LOG_TAG, __FILE__, __LINE__, __func__, ##args)
 
 #define LOG_VERBOSE(...) LOGWRAPPER(__VA_ARGS__)
 #define LOG_DEBUG(...) LOGWRAPPER(__VA_ARGS__)
 #define LOG_INFO(...) LOGWRAPPER(__VA_ARGS__)
 #define LOG_WARN(...) LOGWRAPPER(__VA_ARGS__)
 #define LOG_ERROR(...) LOGWRAPPER(__VA_ARGS__)
+#define LOG_ALWAYS_FATAL(...) \
+  do {                        \
+    LOGWRAPPER(__VA_ARGS__);  \
+    abort();                  \
+  } while (false)
 
 #endif /* defined(OS_ANDROID) */
 
-#define ASSERT(condition)                                                       \
-  do {                                                                          \
-    if (!(condition)) {                                                         \
-      LOG_ERROR("%s:%d assertion '" #condition "' failed", __FILE__, __LINE__); \
-      abort();                                                                  \
-    }                                                                           \
+#define ASSERT(condition)                                    \
+  do {                                                       \
+    if (!(condition)) {                                      \
+      LOG_ALWAYS_FATAL("assertion '" #condition "' failed"); \
+    }                                                        \
   } while (false)
 
-#define ASSERT_LOG(condition, fmt, args...)                                                    \
-  do {                                                                                         \
-    if (!(condition)) {                                                                        \
-      LOG_ERROR("%s:%d assertion '" #condition "' failed - " fmt, __FILE__, __LINE__, ##args); \
-      abort();                                                                                 \
-    }                                                                                          \
+#define ASSERT_LOG(condition, fmt, args...)                                 \
+  do {                                                                      \
+    if (!(condition)) {                                                     \
+      LOG_ALWAYS_FATAL("assertion '" #condition "' failed - " fmt, ##args); \
+    }                                                                       \
   } while (false)
diff --git a/gd/os/queue.h b/gd/os/queue.h
index ae1ba14..1d2af02 100644
--- a/gd/os/queue.h
+++ b/gd/os/queue.h
@@ -21,6 +21,8 @@
 #include <mutex>
 #include <queue>
 
+#include "common/bind.h"
+#include "common/callback.h"
 #include "os/handler.h"
 #ifdef OS_LINUX_GENERIC
 #include "os/linux_generic/reactive_semaphore.h"
@@ -34,7 +36,7 @@
 template <typename T>
 class IQueueEnqueue {
  public:
-  using EnqueueCallback = std::function<std::unique_ptr<T>()>;
+  using EnqueueCallback = Callback<std::unique_ptr<T>()>;
   virtual ~IQueueEnqueue() = default;
   virtual void RegisterEnqueue(Handler* handler, EnqueueCallback callback) = 0;
   virtual void UnregisterEnqueue() = 0;
@@ -44,7 +46,7 @@
 template <typename T>
 class IQueueDequeue {
  public:
-  using DequeueCallback = std::function<void()>;
+  using DequeueCallback = Callback<void()>;
   virtual ~IQueueDequeue() = default;
   virtual void RegisterDequeue(Handler* handler, DequeueCallback callback) = 0;
   virtual void UnregisterDequeue() = 0;
@@ -56,10 +58,10 @@
  public:
   // A function moving data from enqueue end buffer to queue, it will be continually be invoked until queue
   // is full. Enqueue end should make sure buffer isn't empty and UnregisterEnqueue when buffer become empty.
-  using EnqueueCallback = std::function<std::unique_ptr<T>()>;
+  using EnqueueCallback = Callback<std::unique_ptr<T>()>;
   // A function moving data form queue to dequeue end buffer, it will be continually be invoked until queue
   // is empty. TryDequeue should be use in this function to get data from queue.
-  using DequeueCallback = std::function<void()>;
+  using DequeueCallback = Callback<void()>;
   // Create a queue with |capacity| is the maximum number of messages a queue can contain
   explicit Queue(size_t capacity);
   ~Queue();
@@ -99,6 +101,44 @@
   QueueEndpoint dequeue_;
 };
 
+template <typename T>
+class EnqueueBuffer {
+ public:
+  EnqueueBuffer(IQueueEnqueue<T>* queue) : queue_(queue) {}
+
+  void Enqueue(std::unique_ptr<T> t, os::Handler* handler) {
+    std::lock_guard<std::mutex> lock(mutex_);
+    buffer_.push(std::move(t));
+    if (buffer_.size() == 1) {
+      queue_->RegisterEnqueue(handler, common::Bind(&EnqueueBuffer<T>::enqueue_callback, common::Unretained(this)));
+    }
+  }
+
+  void Clear() {
+    std::lock_guard<std::mutex> lock(mutex_);
+    if (!buffer_.empty()) {
+      queue_->UnregisterEnqueue();
+      std::queue<std::unique_ptr<T>> empty;
+      std::swap(buffer_, empty);
+    }
+  }
+
+ private:
+  std::unique_ptr<T> enqueue_callback() {
+    std::lock_guard<std::mutex> lock(mutex_);
+    std::unique_ptr<T> enqueued_t = std::move(buffer_.front());
+    buffer_.pop();
+    if (buffer_.empty()) {
+      queue_->UnregisterEnqueue();
+    }
+    return enqueued_t;
+  }
+
+  mutable std::mutex mutex_;
+  IQueueEnqueue<T>* queue_;
+  std::queue<std::unique_ptr<T>> buffer_;
+};
+
 #ifdef OS_LINUX_GENERIC
 #include "os/linux_generic/queue.tpp"
 #endif
diff --git a/gd/os/queue_benchmark.cc b/gd/os/queue_benchmark.cc
index 7832a17..0c90fe9 100644
--- a/gd/os/queue_benchmark.cc
+++ b/gd/os/queue_benchmark.cc
@@ -61,7 +61,7 @@
       : count_(count), handler_(handler), queue_(queue), promise_(promise) {}
 
   void RegisterEnqueue() {
-    handler_->Post([this] { queue_->RegisterEnqueue(handler_, [this] { return EnqueueCallbackForTest(); }); });
+    handler_->Post(common::BindOnce(&TestEnqueueEnd::handle_register_enqueue, common::Unretained(this)));
   }
 
   void push(std::string data) {
@@ -99,6 +99,10 @@
   Queue<std::string>* queue_;
   std::promise<void>* promise_;
   std::mutex mutex_;
+
+  void handle_register_enqueue() {
+    queue_->RegisterEnqueue(handler_, common::Bind(&TestEnqueueEnd::EnqueueCallbackForTest, common::Unretained(this)));
+  }
 };
 
 class TestDequeueEnd {
@@ -107,7 +111,7 @@
       : count_(count), handler_(handler), queue_(queue), promise_(promise) {}
 
   void RegisterDequeue() {
-    handler_->Post([this] { queue_->RegisterDequeue(handler_, [this] { DequeueCallbackForTest(); }); });
+    handler_->Post(common::BindOnce(&TestDequeueEnd::handle_register_dequeue, common::Unretained(this)));
   }
 
   void DequeueCallbackForTest() {
@@ -128,6 +132,10 @@
   Handler* handler_;
   Queue<std::string>* queue_;
   std::promise<void>* promise_;
+
+  void handle_register_dequeue() {
+    queue_->RegisterDequeue(handler_, common::Bind(&TestDequeueEnd::DequeueCallbackForTest, common::Unretained(this)));
+  }
 };
 
 BENCHMARK_DEFINE_F(BM_QueuePerformance, send_packet_vary_by_packet_num)(State& state) {
diff --git a/gd/os/reactor.h b/gd/os/reactor.h
index a0de131..7e8476b 100644
--- a/gd/os/reactor.h
+++ b/gd/os/reactor.h
@@ -19,17 +19,21 @@
 #include <sys/epoll.h>
 #include <atomic>
 #include <functional>
+#include <future>
 #include <list>
 #include <mutex>
 #include <thread>
 
+#include "common/callback.h"
 #include "os/utils.h"
 
 namespace bluetooth {
 namespace os {
 
-// Format of closure to be used in the entire stack
-using Closure = std::function<void()>;
+using common::Callback;
+using common::Closure;
+using common::OnceCallback;
+using common::OnceClosure;
 
 // A simple implementation of reactor-style looper.
 // When a reactor is running, the main loop is polling and blocked until at least one registered reactable is ready to
@@ -62,6 +66,9 @@
   // Unregister a reactable from this reactor
   void Unregister(Reactable* reactable);
 
+  // Wait for up to timeout milliseconds, and return true if the reactable finished executing.
+  bool WaitForUnregisteredReactable(std::chrono::milliseconds timeout);
+
   // Modify the registration for a reactable with given reactable
   void ModifyRegistration(Reactable* reactable, Closure on_read_ready, Closure on_write_ready);
 
@@ -71,7 +78,7 @@
   int control_fd_;
   std::atomic<bool> is_running_;
   std::list<Reactable*> invalidation_list_;
-  bool reactable_removed_;
+  std::unique_ptr<std::future<void>> executing_reactable_finished_;
 };
 
 }  // namespace os
diff --git a/gd/os/repeating_alarm.h b/gd/os/repeating_alarm.h
index 2f8a08a..cd91344 100644
--- a/gd/os/repeating_alarm.h
+++ b/gd/os/repeating_alarm.h
@@ -20,6 +20,8 @@
 #include <memory>
 #include <mutex>
 
+#include "common/callback.h"
+#include "os/handler.h"
 #include "os/thread.h"
 #include "os/utils.h"
 
@@ -31,11 +33,8 @@
 // itself from the thread.
 class RepeatingAlarm {
  public:
-  // Create and register a repeating alarm on given thread
-  explicit RepeatingAlarm(Thread* thread);
-
-  // Create and register a repeating alarm on the given reactor
-  explicit RepeatingAlarm(Reactor* reactor);
+  // Create and register a repeating alarm on a given handler
+  explicit RepeatingAlarm(Handler* handler);
 
   // Unregister this alarm from the thread and release resource
   ~RepeatingAlarm();
@@ -50,7 +49,7 @@
 
  private:
   Closure task_;
-  Reactor* reactor_;
+  Handler* handler_;
   int fd_ = 0;
   Reactor::Reactable* token_;
   mutable std::mutex mutex_;
diff --git a/gd/os/thread_benchmark.cc b/gd/os/thread_benchmark.cc
index dc22b9d..8d62889 100644
--- a/gd/os/thread_benchmark.cc
+++ b/gd/os/thread_benchmark.cc
@@ -20,10 +20,12 @@
 
 #include "benchmark/benchmark.h"
 
+#include "common/bind.h"
 #include "os/handler.h"
 #include "os/thread.h"
 
 using ::benchmark::State;
+using ::bluetooth::common::BindOnce;
 using ::bluetooth::os::Handler;
 using ::bluetooth::os::Thread;
 
@@ -79,7 +81,8 @@
     counter_promise_ = std::promise<void>();
     std::future<void> counter_future = counter_promise_.get_future();
     for (int i = 0; i < num_messages_to_send_; i++) {
-      handler_->Post([this]() { callback_batch(); });
+      handler_->Post(BindOnce(&BM_ReactorThread_batch_enque_dequeue_Benchmark::callback_batch,
+                              bluetooth::common::Unretained(this)));
     }
     counter_future.wait();
   }
@@ -99,7 +102,8 @@
     for (int i = 0; i < num_messages_to_send_; i++) {
       counter_promise_ = std::promise<void>();
       std::future<void> counter_future = counter_promise_.get_future();
-      handler_->Post([this]() { callback(); });
+      handler_->Post(
+          BindOnce(&BM_ReactorThread_sequential_execution_Benchmark::callback, bluetooth::common::Unretained(this)));
       counter_future.wait();
     }
   }
diff --git a/gd/packet/Android.bp b/gd/packet/Android.bp
index c65cf8c..c9ddb7a 100644
--- a/gd/packet/Android.bp
+++ b/gd/packet/Android.bp
@@ -5,6 +5,7 @@
         "byte_inserter.cc",
         "byte_observer.cc",
         "iterator.cc",
+        "fragmenting_inserter.cc",
         "packet_view.cc",
         "raw_builder.cc",
         "view.cc",
@@ -15,6 +16,7 @@
     name: "BluetoothPacketTestSources",
     srcs: [
         "bit_inserter_unittest.cc",
+        "fragmenting_inserter_unittest.cc",
         "packet_builder_unittest.cc",
         "packet_view_unittest.cc",
         "raw_builder_unittest.cc",
diff --git a/gd/packet/base_struct.h b/gd/packet/base_struct.h
new file mode 100644
index 0000000..9983229
--- /dev/null
+++ b/gd/packet/base_struct.h
@@ -0,0 +1,45 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#pragma once
+
+#include <cstdint>
+#include <forward_list>
+#include <iterator>
+#include <memory>
+#include <vector>
+
+#include "packet/bit_inserter.h"
+
+namespace bluetooth {
+namespace packet {
+
+// A base struct to provide Serialize() and size() to be overridden.
+class BaseStruct {
+ public:
+  virtual ~BaseStruct() = default;
+
+  virtual size_t size() const = 0;
+
+  // Write to the vector with the given iterator.
+  virtual void Serialize(BitInserter& it) const = 0;
+
+ protected:
+  BaseStruct() = default;
+};
+
+}  // namespace packet
+}  // namespace bluetooth
diff --git a/gd/packet/bit_inserter.cc b/gd/packet/bit_inserter.cc
index 0180cd8..0a8f2bc 100644
--- a/gd/packet/bit_inserter.cc
+++ b/gd/packet/bit_inserter.cc
@@ -29,15 +29,14 @@
 
 void BitInserter::insert_bits(uint8_t byte, size_t num_bits) {
   size_t total_bits = num_bits + num_saved_bits_;
-  uint16_t new_value = saved_bits_ | (static_cast<uint16_t>(byte) << num_saved_bits_);
+  uint16_t new_value = static_cast<uint8_t>(saved_bits_) | (static_cast<uint16_t>(byte) << num_saved_bits_);
   if (total_bits >= 8) {
-    uint8_t new_byte = static_cast<uint8_t>(new_value);
-    ByteInserter::insert_byte(new_byte);
+    ByteInserter::insert_byte(static_cast<uint8_t>(new_value));
     total_bits -= 8;
     new_value = new_value >> 8;
   }
   num_saved_bits_ = total_bits;
-  uint8_t mask = 0xff >> (8 - num_saved_bits_);
+  uint8_t mask = static_cast<uint8_t>(0xff) >> (8 - num_saved_bits_);
   saved_bits_ = static_cast<uint8_t>(new_value) & mask;
 }
 
@@ -45,9 +44,5 @@
   insert_bits(byte, 8);
 }
 
-bool BitInserter::IsByteAligned() {
-  return num_saved_bits_ == 0;
-}
-
 }  // namespace packet
 }  // namespace bluetooth
diff --git a/gd/packet/bit_inserter.h b/gd/packet/bit_inserter.h
index 2aa1ad6..487eba5 100644
--- a/gd/packet/bit_inserter.h
+++ b/gd/packet/bit_inserter.h
@@ -29,15 +29,13 @@
 class BitInserter : public ByteInserter {
  public:
   BitInserter(std::vector<uint8_t>& vector);
-  virtual ~BitInserter();
+  ~BitInserter() override;
 
-  void insert_bits(uint8_t byte, size_t num_bits);
+  virtual void insert_bits(uint8_t byte, size_t num_bits);
 
-  void insert_byte(uint8_t byte);
+  void insert_byte(uint8_t byte) override;
 
-  bool IsByteAligned();
-
- private:
+ protected:
   size_t num_saved_bits_{0};
   uint8_t saved_bits_{0};
 };
diff --git a/gd/packet/byte_inserter.cc b/gd/packet/byte_inserter.cc
index f7fc9c0..b872427 100644
--- a/gd/packet/byte_inserter.cc
+++ b/gd/packet/byte_inserter.cc
@@ -24,10 +24,10 @@
 ByteInserter::ByteInserter(std::vector<uint8_t>& vector) : std::back_insert_iterator<std::vector<uint8_t>>(vector) {}
 
 ByteInserter::~ByteInserter() {
-  ASSERT(registered_observers_.size() == 0);
+  ASSERT(registered_observers_.empty());
 }
 
-void ByteInserter::RegisterObserver(ByteObserver observer) {
+void ByteInserter::RegisterObserver(const ByteObserver& observer) {
   registered_observers_.push_back(observer);
 }
 
@@ -37,10 +37,14 @@
   return observer;
 }
 
-void ByteInserter::insert_byte(uint8_t byte) {
+void ByteInserter::on_byte(uint8_t byte) {
   for (auto& observer : registered_observers_) {
     observer.OnByte(byte);
   }
+}
+
+void ByteInserter::insert_byte(uint8_t byte) {
+  on_byte(byte);
   std::back_insert_iterator<std::vector<uint8_t>>::operator=(byte);
 }
 
diff --git a/gd/packet/byte_inserter.h b/gd/packet/byte_inserter.h
index 2d49b33..6d33aee 100644
--- a/gd/packet/byte_inserter.h
+++ b/gd/packet/byte_inserter.h
@@ -31,12 +31,15 @@
   ByteInserter(std::vector<uint8_t>& vector);
   virtual ~ByteInserter();
 
-  void insert_byte(uint8_t byte);
+  virtual void insert_byte(uint8_t byte);
 
-  void RegisterObserver(ByteObserver observer);
+  void RegisterObserver(const ByteObserver& observer);
 
   ByteObserver UnregisterObserver();
 
+ protected:
+  void on_byte(uint8_t);
+
  private:
   std::vector<ByteObserver> registered_observers_;
 };
diff --git a/gd/packet/endian_inserter.h b/gd/packet/endian_inserter.h
new file mode 100644
index 0000000..317c12c
--- /dev/null
+++ b/gd/packet/endian_inserter.h
@@ -0,0 +1,91 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#pragma once
+
+#include <cstdint>
+#include <forward_list>
+#include <iterator>
+#include <memory>
+#include <vector>
+
+#include "os/log.h"
+#include "packet/bit_inserter.h"
+
+namespace bluetooth {
+namespace packet {
+
+// Abstract base class that is subclassed to provide insert() functions.
+// The template parameter little_endian controls the generation of insert().
+template <bool little_endian>
+class EndianInserter {
+ public:
+  EndianInserter() = default;
+  virtual ~EndianInserter() = default;
+
+ protected:
+  // Write sizeof(FixedWidthIntegerType) bytes using the iterator
+  template <typename FixedWidthPODType, typename std::enable_if<std::is_pod<FixedWidthPODType>::value, int>::type = 0>
+  void insert(FixedWidthPODType value, BitInserter& it) const {
+    uint8_t* raw_bytes = (uint8_t*)&value;
+    for (size_t i = 0; i < sizeof(FixedWidthPODType); i++) {
+      if (little_endian == true) {
+        it.insert_byte(raw_bytes[i]);
+      } else {
+        it.insert_byte(raw_bytes[sizeof(FixedWidthPODType) - i - 1]);
+      }
+    }
+  }
+
+  // Write num_bits bits using the iterator
+  template <typename FixedWidthIntegerType,
+            typename std::enable_if<std::is_pod<FixedWidthIntegerType>::value, int>::type = 0>
+  void insert(FixedWidthIntegerType value, BitInserter& it, size_t num_bits) const {
+    ASSERT(num_bits <= (sizeof(FixedWidthIntegerType) * 8));
+
+    for (size_t i = 0; i < num_bits / 8; i++) {
+      if (little_endian == true) {
+        it.insert_byte(static_cast<uint8_t>(value >> (i * 8)));
+      } else {
+        it.insert_byte(static_cast<uint8_t>(value >> (((num_bits / 8) - i - 1) * 8)));
+      }
+    }
+    if (num_bits % 8) {
+      it.insert_bits(static_cast<uint8_t>(value >> ((num_bits / 8) * 8)), num_bits % 8);
+    }
+  }
+
+  // Specialized insert that allows inserting enums without casting
+  template <typename Enum, typename std::enable_if<std::is_enum_v<Enum>, int>::type = 0>
+  inline void insert(Enum value, BitInserter& it) const {
+    using enum_type = typename std::underlying_type_t<Enum>;
+    static_assert(std::is_unsigned_v<enum_type>, "Enum type is signed. Did you forget to specify the enum size?");
+    insert<enum_type>(static_cast<enum_type>(value), it);
+  }
+
+  // Write a vector of FixedWidthIntegerType using the iterator
+  template <typename FixedWidthIntegerType>
+  void insert_vector(const std::vector<FixedWidthIntegerType>& vec, BitInserter& it) const {
+    static_assert(std::is_pod<FixedWidthIntegerType>::value,
+                  "EndianInserter::insert requires a vector with elements of a fixed-size.");
+    for (const auto& element : vec) {
+      insert(element, it);
+    }
+  }
+};
+
+}  // namespace packet
+}  // namespace bluetooth
diff --git a/gd/packet/fragmenting_inserter.cc b/gd/packet/fragmenting_inserter.cc
new file mode 100644
index 0000000..3d8917c
--- /dev/null
+++ b/gd/packet/fragmenting_inserter.cc
@@ -0,0 +1,57 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "packet/fragmenting_inserter.h"
+
+#include "os/log.h"
+
+namespace bluetooth {
+namespace packet {
+
+FragmentingInserter::FragmentingInserter(size_t mtu,
+                                         std::back_insert_iterator<std::vector<std::unique_ptr<RawBuilder>>> iterator)
+    : BitInserter(to_construct_bit_inserter_), mtu_(mtu), curr_packet_(std::make_unique<RawBuilder>()),
+      iterator_(iterator) {}
+
+void FragmentingInserter::insert_bits(uint8_t byte, size_t num_bits) {
+  ASSERT(curr_packet_ != nullptr);
+  size_t total_bits = num_bits + num_saved_bits_;
+  uint16_t new_value = static_cast<uint8_t>(saved_bits_) | (static_cast<uint16_t>(byte) << num_saved_bits_);
+  if (total_bits >= 8) {
+    uint8_t new_byte = static_cast<uint8_t>(new_value);
+    on_byte(new_byte);
+    curr_packet_->AddOctets1(new_byte);
+    if (curr_packet_->size() >= mtu_) {
+      iterator_ = std::move(curr_packet_);
+      curr_packet_ = std::make_unique<RawBuilder>();
+    }
+    total_bits -= 8;
+    new_value = new_value >> 8;
+  }
+  num_saved_bits_ = total_bits;
+  uint8_t mask = static_cast<uint8_t>(0xff) >> (8 - num_saved_bits_);
+  saved_bits_ = static_cast<uint8_t>(new_value) & mask;
+}
+
+void FragmentingInserter::finalize() {
+  if (curr_packet_->size() != 0) {
+    iterator_ = std::move(curr_packet_);
+  }
+  curr_packet_.reset();
+}
+
+}  // namespace packet
+}  // namespace bluetooth
diff --git a/gd/packet/fragmenting_inserter.h b/gd/packet/fragmenting_inserter.h
new file mode 100644
index 0000000..ff23a09
--- /dev/null
+++ b/gd/packet/fragmenting_inserter.h
@@ -0,0 +1,46 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#pragma once
+
+#include <cstdint>
+#include <iterator>
+#include <memory>
+#include <vector>
+
+#include "packet/bit_inserter.h"
+#include "packet/raw_builder.h"
+
+namespace bluetooth {
+namespace packet {
+
+class FragmentingInserter : public BitInserter {
+ public:
+  FragmentingInserter(size_t mtu, std::back_insert_iterator<std::vector<std::unique_ptr<RawBuilder>>> iterator);
+
+  void insert_bits(uint8_t byte, size_t num_bits) override;
+
+  void finalize();
+
+ protected:
+  std::vector<uint8_t> to_construct_bit_inserter_;
+  size_t mtu_;
+  std::unique_ptr<RawBuilder> curr_packet_;
+  std::back_insert_iterator<std::vector<std::unique_ptr<RawBuilder>>> iterator_;
+};
+
+}  // namespace packet
+}  // namespace bluetooth
diff --git a/gd/packet/fragmenting_inserter_unittest.cc b/gd/packet/fragmenting_inserter_unittest.cc
new file mode 100644
index 0000000..6179959
--- /dev/null
+++ b/gd/packet/fragmenting_inserter_unittest.cc
@@ -0,0 +1,145 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "packet/fragmenting_inserter.h"
+
+#include <gtest/gtest.h>
+#include <memory>
+
+#include "os/log.h"
+
+using bluetooth::packet::FragmentingInserter;
+using std::vector;
+
+namespace bluetooth {
+namespace packet {
+
+TEST(FragmentingInserterTest, addMoreBits) {
+  std::vector<uint8_t> result = {0b00011101 /* 3 2 1 */, 0b00010101 /* 5 4 */, 0b11100011 /* 7 6 */, 0b10000000 /* 8 */,
+                                 0b10100000 /* filled with 1010 */};
+  std::vector<std::unique_ptr<RawBuilder>> fragments;
+
+  FragmentingInserter it(result.size(), std::back_insert_iterator(fragments));
+
+  for (size_t i = 0; i < 9; i++) {
+    it.insert_bits(static_cast<uint8_t>(i), i);
+  }
+  it.insert_bits(static_cast<uint8_t>(0b1010), 4);
+
+  it.finalize();
+
+  ASSERT_EQ(1, fragments.size());
+
+  std::vector<uint8_t> bytes;
+  BitInserter bit_inserter(bytes);
+  fragments[0]->Serialize(bit_inserter);
+
+  ASSERT_EQ(result.size(), bytes.size());
+  for (size_t i = 0; i < bytes.size(); i++) {
+    ASSERT_EQ(result[i], bytes[i]);
+  }
+}
+
+TEST(FragmentingInserterTest, observerTest) {
+  std::vector<uint8_t> result = {0b00011101 /* 3 2 1 */, 0b00010101 /* 5 4 */, 0b11100011 /* 7 6 */, 0b10000000 /* 8 */,
+                                 0b10100000 /* filled with 1010 */};
+  std::vector<std::unique_ptr<RawBuilder>> fragments;
+
+  FragmentingInserter it(result.size() + 1, std::back_insert_iterator(fragments));
+
+  std::vector<uint8_t> copy;
+
+  uint64_t checksum = 0x0123456789abcdef;
+  it.RegisterObserver(ByteObserver([&copy](uint8_t byte) { copy.push_back(byte); }, [checksum]() { return checksum; }));
+
+  for (size_t i = 0; i < 9; i++) {
+    it.insert_bits(static_cast<uint8_t>(i), i);
+  }
+  it.insert_bits(static_cast<uint8_t>(0b1010), 4);
+  it.finalize();
+
+  ASSERT_EQ(1, fragments.size());
+
+  std::vector<uint8_t> bytes;
+  BitInserter bit_inserter(bytes);
+  fragments[0]->Serialize(bit_inserter);
+
+  ASSERT_EQ(result.size(), bytes.size());
+  for (size_t i = 0; i < bytes.size(); i++) {
+    ASSERT_EQ(result[i], bytes[i]);
+  }
+
+  ASSERT_EQ(result.size(), copy.size());
+  for (size_t i = 0; i < copy.size(); i++) {
+    ASSERT_EQ(result[i], copy[i]);
+  }
+
+  ByteObserver observer = it.UnregisterObserver();
+  ASSERT_EQ(checksum, observer.GetValue());
+}
+
+constexpr size_t kPacketSize = 128;
+class FragmentingTest : public ::testing::TestWithParam<size_t> {
+ public:
+  void StartUp() {
+    counts_.reserve(kPacketSize);
+    for (size_t i = 0; i < kPacketSize; i++) {
+      counts_.push_back(static_cast<uint8_t>(i));
+    }
+  }
+  void ShutDown() {
+    counts_.clear();
+  }
+  std::vector<uint8_t> counts_;
+};
+
+TEST_P(FragmentingTest, mtuFragmentTest) {
+  size_t mtu = GetParam();
+  std::vector<std::unique_ptr<RawBuilder>> fragments;
+  FragmentingInserter it(mtu, std::back_insert_iterator(fragments));
+
+  RawBuilder original_packet(counts_);
+  ASSERT_EQ(counts_.size(), original_packet.size());
+
+  original_packet.Serialize(it);
+  it.finalize();
+
+  size_t expected_fragments = counts_.size() / mtu;
+  if (counts_.size() % mtu != 0) {
+    expected_fragments++;
+  }
+  ASSERT_EQ(expected_fragments, fragments.size());
+
+  std::vector<std::vector<uint8_t>> serialized_fragments;
+  for (size_t f = 0; f < fragments.size(); f++) {
+    serialized_fragments.emplace_back(mtu);
+    BitInserter bit_inserter(serialized_fragments[f]);
+    fragments[f]->Serialize(bit_inserter);
+    if (f + 1 == fragments.size() && (counts_.size() % mtu != 0)) {
+      ASSERT_EQ(serialized_fragments[f].size(), counts_.size() % mtu);
+    } else {
+      ASSERT_EQ(serialized_fragments[f].size(), mtu);
+    }
+    for (size_t b = 0; b < serialized_fragments[f].size(); b++) {
+      EXPECT_EQ(counts_[f * mtu + b], serialized_fragments[f][b]);
+    }
+  }
+}
+
+INSTANTIATE_TEST_CASE_P(chopomatic, FragmentingTest, ::testing::Range<size_t>(1, kPacketSize + 1));
+
+}  // namespace packet
+}  // namespace bluetooth
diff --git a/gd/packet/iterator.cc b/gd/packet/iterator.cc
index 5167806..f924b05 100644
--- a/gd/packet/iterator.cc
+++ b/gd/packet/iterator.cc
@@ -25,9 +25,10 @@
 Iterator<little_endian>::Iterator(std::forward_list<View> data, size_t offset) {
   data_ = data;
   index_ = offset;
-  length_ = 0;
+  begin_ = 0;
+  end_ = 0;
   for (auto& view : data) {
-    length_ += view.size();
+    end_ += view.size();
   }
 }
 
@@ -93,9 +94,10 @@
 
 template <bool little_endian>
 Iterator<little_endian>& Iterator<little_endian>::operator=(const Iterator<little_endian>& itr) {
-  data_ = itr.data_;
-  index_ = itr.index_;
-
+  this->data_ = itr.data_;
+  this->begin_ = itr.begin_;
+  this->end_ = itr.end_;
+  this->index_ = itr.index_;
   return *this;
 }
 
@@ -131,7 +133,7 @@
 
 template <bool little_endian>
 uint8_t Iterator<little_endian>::operator*() const {
-  ASSERT_LOG(index_ < length_, "Index %zu out of bounds: %zu", index_, length_);
+  ASSERT_LOG(index_ < end_ && !(begin_ > index_), "Index %zu out of bounds: [%zu,%zu)", index_, begin_, end_);
   size_t index = index_;
 
   for (auto view : data_) {
@@ -146,13 +148,29 @@
 
 template <bool little_endian>
 size_t Iterator<little_endian>::NumBytesRemaining() const {
-  if (length_ > index_) {
-    return length_ - index_;
+  if (end_ > index_ && !(begin_ > index_)) {
+    return end_ - index_;
   } else {
     return 0;
   }
 }
 
+template <bool little_endian>
+Iterator<little_endian> Iterator<little_endian>::Subrange(size_t index, size_t length) const {
+  Iterator<little_endian> to_return(*this);
+  if (to_return.NumBytesRemaining() > index) {
+    to_return.index_ = to_return.index_ + index;
+    to_return.begin_ = to_return.index_;
+    if (to_return.NumBytesRemaining() >= length) {
+      to_return.end_ = to_return.index_ + length;
+    }
+  } else {
+    to_return.end_ = 0;
+  }
+
+  return to_return;
+}
+
 // Explicit instantiations for both types of Iterators.
 template class Iterator<true>;
 template class Iterator<false>;
diff --git a/gd/packet/iterator.h b/gd/packet/iterator.h
index 422c025..f15e561 100644
--- a/gd/packet/iterator.h
+++ b/gd/packet/iterator.h
@@ -60,6 +60,8 @@
 
   size_t NumBytesRemaining() const;
 
+  Iterator Subrange(size_t index, size_t length) const;
+
   // Get the next sizeof(FixedWidthPODType) bytes and return the filled type
   template <typename FixedWidthPODType>
   FixedWidthPODType extract() {
@@ -77,7 +79,8 @@
  private:
   std::forward_list<View> data_;
   size_t index_;
-  size_t length_;
+  size_t begin_;
+  size_t end_;
 };
 
 }  // namespace packet
diff --git a/gd/packet/packet_builder.h b/gd/packet/packet_builder.h
index dec67db..3f6c627 100644
--- a/gd/packet/packet_builder.h
+++ b/gd/packet/packet_builder.h
@@ -25,6 +25,7 @@
 #include "os/log.h"
 #include "packet/base_packet_builder.h"
 #include "packet/bit_inserter.h"
+#include "packet/endian_inserter.h"
 
 namespace bluetooth {
 namespace packet {
@@ -32,63 +33,13 @@
 // Abstract base class that is subclassed to build specifc packets.
 // The template parameter little_endian controls the generation of insert().
 template <bool little_endian>
-class PacketBuilder : public BasePacketBuilder {
+class PacketBuilder : public BasePacketBuilder, protected EndianInserter<little_endian> {
  public:
   PacketBuilder() = default;
   virtual ~PacketBuilder() = default;
 
   // Classes which need fragmentation should define a function like this:
   // std::forward_list<DerivedBuilder>& Fragment(size_t max_size);
-
- protected:
-  // Write sizeof(FixedWidthIntegerType) bytes using the iterator
-  template <typename FixedWidthPODType, typename std::enable_if<std::is_pod<FixedWidthPODType>::value, int>::type = 0>
-  void insert(FixedWidthPODType value, BitInserter& it) const {
-    uint8_t* raw_bytes = (uint8_t*)&value;
-    for (size_t i = 0; i < sizeof(FixedWidthPODType); i++) {
-      if (little_endian == true) {
-        it.insert_byte(raw_bytes[i]);
-      } else {
-        it.insert_byte(raw_bytes[sizeof(FixedWidthPODType) - i - 1]);
-      }
-    }
-  }
-
-  // Write num_bits bits using the iterator
-  template <typename FixedWidthIntegerType,
-            typename std::enable_if<std::is_pod<FixedWidthIntegerType>::value, int>::type = 0>
-  void insert(FixedWidthIntegerType value, BitInserter& it, size_t num_bits) const {
-    ASSERT(num_bits <= (sizeof(FixedWidthIntegerType) * 8));
-
-    for (size_t i = 0; i < num_bits / 8; i++) {
-      if (little_endian == true) {
-        it.insert_byte(static_cast<uint8_t>(value >> (i * 8)));
-      } else {
-        it.insert_byte(static_cast<uint8_t>(value >> (((num_bits / 8) - i - 1) * 8)));
-      }
-    }
-    if (num_bits % 8) {
-      it.insert_bits(static_cast<uint8_t>(value >> ((num_bits / 8) * 8)), num_bits % 8);
-    }
-  }
-
-  // Specialized insert that allows inserting enums without casting
-  template <typename Enum, typename std::enable_if<std::is_enum_v<Enum>, int>::type = 0>
-  inline void insert(Enum value, BitInserter& it) const {
-    using enum_type = typename std::underlying_type_t<Enum>;
-    static_assert(std::is_unsigned_v<enum_type>, "Enum type is signed. Did you forget to specify the enum size?");
-    insert<enum_type>(static_cast<enum_type>(value), it);
-  }
-
-  // Write a vector of FixedWidthIntegerType using the iterator
-  template <typename FixedWidthIntegerType>
-  void insert_vector(const std::vector<FixedWidthIntegerType>& vec, BitInserter& it) const {
-    static_assert(std::is_pod<FixedWidthIntegerType>::value,
-                  "PacketBuilder::insert requires a vector with elements of a fixed-size.");
-    for (const auto& element : vec) {
-      insert(element, it);
-    }
-  }
 };
 
 }  // namespace packet
diff --git a/gd/packet/packet_struct.h b/gd/packet/packet_struct.h
new file mode 100644
index 0000000..19bb0e5
--- /dev/null
+++ b/gd/packet/packet_struct.h
@@ -0,0 +1,43 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#pragma once
+
+#include <cstdint>
+#include <forward_list>
+#include <iterator>
+#include <memory>
+#include <vector>
+
+#include "os/log.h"
+#include "packet/base_struct.h"
+#include "packet/bit_inserter.h"
+#include "packet/endian_inserter.h"
+
+namespace bluetooth {
+namespace packet {
+
+// Abstract base class that is subclassed to build specifc structs.
+// The template parameter little_endian controls the generation of insert().
+template <bool little_endian>
+class PacketStruct : public BaseStruct, protected EndianInserter<little_endian> {
+ public:
+  PacketStruct() = default;
+  virtual ~PacketStruct() = default;
+};
+
+}  // namespace packet
+}  // namespace bluetooth
diff --git a/gd/packet/packet_view.cc b/gd/packet/packet_view.cc
index 94522ae..badd641 100644
--- a/gd/packet/packet_view.cc
+++ b/gd/packet/packet_view.cc
@@ -99,6 +99,24 @@
   return PacketView<false>(GetSubviewList(begin, end));
 }
 
+template <bool little_endian>
+void PacketView<little_endian>::Append(PacketView to_add) {
+  auto insertion_point = fragments_.begin();
+  size_t remaining_length = length_;
+  while (remaining_length > 0) {
+    remaining_length -= insertion_point->size();
+    if (remaining_length > 0) {
+      insertion_point++;
+    }
+  }
+  ASSERT(insertion_point != fragments_.end());
+  for (const auto& fragment : to_add.fragments_) {
+    fragments_.insert_after(insertion_point, fragment);
+    insertion_point++;
+  }
+  length_ += to_add.length_;
+}
+
 // Explicit instantiations for both types of PacketViews.
 template class PacketView<true>;
 template class PacketView<false>;
diff --git a/gd/packet/packet_view.h b/gd/packet/packet_view.h
index 4b2f191..304794c 100644
--- a/gd/packet/packet_view.h
+++ b/gd/packet/packet_view.h
@@ -52,6 +52,9 @@
 
   PacketView<false> GetBigEndianSubview(size_t begin, size_t end) const;
 
+ protected:
+  void Append(PacketView to_add);
+
  private:
   std::forward_list<View> fragments_;
   size_t length_;
diff --git a/gd/packet/packet_view_unittest.cc b/gd/packet/packet_view_unittest.cc
index e88c2cf..0ec2ef4 100644
--- a/gd/packet/packet_view_unittest.cc
+++ b/gd/packet/packet_view_unittest.cc
@@ -20,9 +20,9 @@
 #include <forward_list>
 #include <memory>
 
-#include "common/address.h"
+#include "hci/address.h"
 
-using bluetooth::common::Address;
+using bluetooth::hci::Address;
 using bluetooth::packet::PacketView;
 using bluetooth::packet::View;
 using std::vector;
@@ -91,6 +91,36 @@
  public:
   PacketViewMultiViewTest() = default;
   ~PacketViewMultiViewTest() = default;
+
+  const PacketView<true> single_view =
+      PacketView<true>({View(std::make_shared<const vector<uint8_t>>(count_all), 0, count_all.size())});
+  const PacketView<true> multi_view = PacketView<true>({
+      View(std::make_shared<const vector<uint8_t>>(count_1), 0, count_1.size()),
+      View(std::make_shared<const vector<uint8_t>>(count_2), 0, count_2.size()),
+      View(std::make_shared<const vector<uint8_t>>(count_3), 0, count_3.size()),
+  });
+};
+
+class PacketViewMultiViewAppendTest : public ::testing::Test {
+ public:
+  PacketViewMultiViewAppendTest() = default;
+  ~PacketViewMultiViewAppendTest() = default;
+
+  class AppendedPacketView : public PacketView<true> {
+   public:
+    AppendedPacketView(PacketView<true> first, std::forward_list<PacketView<true>> to_append)
+        : PacketView<true>(first) {
+      for (const auto& packet_view : to_append) {
+        Append(packet_view);
+      }
+    }
+  };
+  const PacketView<true> single_view =
+      PacketView<true>({View(std::make_shared<const vector<uint8_t>>(count_all), 0, count_all.size())});
+  const PacketView<true> multi_view = AppendedPacketView(
+      PacketView<true>({View(std::make_shared<const vector<uint8_t>>(count_1), 0, count_1.size())}),
+      {PacketView<true>({View(std::make_shared<const vector<uint8_t>>(count_2), 0, count_2.size())}),
+       PacketView<true>({View(std::make_shared<const vector<uint8_t>>(count_3), 0, count_3.size())})});
 };
 
 class ViewTest : public ::testing::Test {
@@ -273,7 +303,7 @@
   ASSERT_EQ(0x1f, (*(this->packet))[working_index]);
 }
 
-TYPED_TEST(PacketViewTest, numBytesRemainingTest) {
+TYPED_TEST(IteratorTest, numBytesRemainingTest) {
   auto all = this->packet->begin();
   size_t remaining = all.NumBytesRemaining();
   for (size_t n = remaining; n > 0; n--) {
@@ -288,6 +318,81 @@
   ASSERT_DEATH(*(all++), "");
 }
 
+TYPED_TEST(IteratorTest, subrangeTest) {
+  auto empty = this->packet->begin().Subrange(0, 0);
+  ASSERT_EQ(static_cast<size_t>(0), empty.NumBytesRemaining());
+  ASSERT_DEATH(*empty, "");
+
+  empty = this->packet->begin().Subrange(this->packet->size(), 1);
+  ASSERT_EQ(static_cast<size_t>(0), empty.NumBytesRemaining());
+  ASSERT_DEATH(*empty, "");
+
+  auto all = this->packet->begin();
+  auto fullrange = all.Subrange(0, all.NumBytesRemaining());
+  ASSERT_EQ(all.NumBytesRemaining(), fullrange.NumBytesRemaining());
+  ASSERT_EQ(*(all + 1), 1);
+
+  fullrange = all.Subrange(0, all.NumBytesRemaining() + 1);
+  ASSERT_EQ(all.NumBytesRemaining(), fullrange.NumBytesRemaining());
+  ASSERT_EQ(*(all + 1), 1);
+
+  fullrange = all.Subrange(0, all.NumBytesRemaining() + 10);
+  ASSERT_EQ(all.NumBytesRemaining(), fullrange.NumBytesRemaining());
+  ASSERT_EQ(*(all + 1), 1);
+
+  auto subrange = all.Subrange(0, 1);
+  ASSERT_EQ(1, subrange.NumBytesRemaining());
+  ASSERT_EQ(*(subrange), 0);
+
+  subrange = this->packet->begin().Subrange(0, 4);
+  ASSERT_EQ(4, subrange.NumBytesRemaining());
+  ASSERT_EQ(*(subrange + 1), 1);
+
+  subrange = all.Subrange(0, 3);
+  ASSERT_EQ(3, subrange.NumBytesRemaining());
+  ASSERT_EQ(*(subrange + 1), 1);
+
+  subrange = all.Subrange(0, all.NumBytesRemaining() - 1);
+  ASSERT_EQ(all.NumBytesRemaining() - 1, subrange.NumBytesRemaining());
+  ASSERT_EQ(*(subrange + 1), 1);
+
+  subrange = all.Subrange(0, all.NumBytesRemaining() - 2);
+  ASSERT_EQ(all.NumBytesRemaining() - 2, subrange.NumBytesRemaining());
+  ASSERT_EQ(*(subrange + 1), 1);
+
+  subrange = all.Subrange(1, all.NumBytesRemaining());
+  ASSERT_EQ(all.NumBytesRemaining() - 1, subrange.NumBytesRemaining());
+  ASSERT_EQ(*subrange, 1);
+
+  subrange = all.Subrange(2, all.NumBytesRemaining());
+  ASSERT_EQ(all.NumBytesRemaining() - 2, subrange.NumBytesRemaining());
+  ASSERT_EQ(*subrange, 2);
+
+  subrange = all.Subrange(1, all.NumBytesRemaining() - 1);
+  ASSERT_EQ(all.NumBytesRemaining() - 1, subrange.NumBytesRemaining());
+  ASSERT_EQ(*subrange, 1);
+
+  subrange = all.Subrange(2, all.NumBytesRemaining() - 2);
+  ASSERT_EQ(all.NumBytesRemaining() - 2, subrange.NumBytesRemaining());
+  ASSERT_EQ(*subrange, 2);
+
+  subrange = all.Subrange(1, 1);
+  ASSERT_EQ(1, subrange.NumBytesRemaining());
+  ASSERT_EQ(*(subrange), 1);
+
+  subrange = all.Subrange(1, 2);
+  ASSERT_EQ(2, subrange.NumBytesRemaining());
+  ASSERT_EQ(*(subrange), 1);
+
+  subrange = all.Subrange(2, 1);
+  ASSERT_EQ(1, subrange.NumBytesRemaining());
+  ASSERT_EQ(*(subrange), 2);
+
+  subrange = this->packet->begin().Subrange(this->packet->size() - 1, 2);
+  ASSERT_EQ(static_cast<size_t>(1), subrange.NumBytesRemaining());
+  ASSERT_EQ(*(subrange), this->packet->size() - 1);
+}
+
 using SubviewTestParam = std::pair<size_t, size_t>;
 class SubviewBaseTest : public ::testing::TestWithParam<SubviewTestParam> {
  public:
@@ -408,23 +513,11 @@
   }
 }
 
-TEST(PacketViewMultiViewTest, sizeTest) {
-  PacketView<true> single_view({View(std::make_shared<const vector<uint8_t>>(count_all), 0, count_all.size())});
-  PacketView<true> multi_view({
-      View(std::make_shared<const vector<uint8_t>>(count_1), 0, count_1.size()),
-      View(std::make_shared<const vector<uint8_t>>(count_2), 0, count_2.size()),
-      View(std::make_shared<const vector<uint8_t>>(count_3), 0, count_3.size()),
-  });
+TEST_F(PacketViewMultiViewTest, sizeTest) {
   ASSERT_EQ(single_view.size(), multi_view.size());
 }
 
-TEST(PacketViewMultiViewTest, dereferenceTestLittleEndian) {
-  PacketView<true> single_view({View(std::make_shared<const vector<uint8_t>>(count_all), 0, count_all.size())});
-  PacketView<true> multi_view({
-      View(std::make_shared<const vector<uint8_t>>(count_1), 0, count_1.size()),
-      View(std::make_shared<const vector<uint8_t>>(count_2), 0, count_2.size()),
-      View(std::make_shared<const vector<uint8_t>>(count_3), 0, count_3.size()),
-  });
+TEST_F(PacketViewMultiViewTest, dereferenceTestLittleEndian) {
   auto single_itr = single_view.begin();
   auto multi_itr = multi_view.begin();
   for (size_t i = 0; i < single_view.size(); i++) {
@@ -433,13 +526,7 @@
   ASSERT_DEATH(*multi_itr, "");
 }
 
-TEST(PacketViewMultiViewTest, dereferenceTestBigEndian) {
-  PacketView<false> single_view({View(std::make_shared<const vector<uint8_t>>(count_all), 0, count_all.size())});
-  PacketView<false> multi_view({
-      View(std::make_shared<const vector<uint8_t>>(count_1), 0, count_1.size()),
-      View(std::make_shared<const vector<uint8_t>>(count_2), 0, count_2.size()),
-      View(std::make_shared<const vector<uint8_t>>(count_3), 0, count_3.size()),
-  });
+TEST_F(PacketViewMultiViewTest, dereferenceTestBigEndian) {
   auto single_itr = single_view.begin();
   auto multi_itr = multi_view.begin();
   for (size_t i = 0; i < single_view.size(); i++) {
@@ -448,13 +535,36 @@
   ASSERT_DEATH(*multi_itr, "");
 }
 
-TEST(PacketViewMultiViewTest, arrayOperatorTest) {
-  PacketView<true> single_view({View(std::make_shared<const vector<uint8_t>>(count_all), 0, count_all.size())});
-  PacketView<true> multi_view({
-      View(std::make_shared<const vector<uint8_t>>(count_1), 0, count_1.size()),
-      View(std::make_shared<const vector<uint8_t>>(count_2), 0, count_2.size()),
-      View(std::make_shared<const vector<uint8_t>>(count_3), 0, count_3.size()),
-  });
+TEST_F(PacketViewMultiViewTest, arrayOperatorTest) {
+  for (size_t i = 0; i < single_view.size(); i++) {
+    ASSERT_EQ(single_view[i], multi_view[i]);
+  }
+  ASSERT_DEATH(multi_view[single_view.size()], "");
+}
+
+TEST_F(PacketViewMultiViewAppendTest, sizeTestAppend) {
+  ASSERT_EQ(single_view.size(), multi_view.size());
+}
+
+TEST_F(PacketViewMultiViewAppendTest, dereferenceTestLittleEndianAppend) {
+  auto single_itr = single_view.begin();
+  auto multi_itr = multi_view.begin();
+  for (size_t i = 0; i < single_view.size(); i++) {
+    ASSERT_EQ(*(single_itr++), *(multi_itr++));
+  }
+  ASSERT_DEATH(*multi_itr, "");
+}
+
+TEST_F(PacketViewMultiViewAppendTest, dereferenceTestBigEndianAppend) {
+  auto single_itr = single_view.begin();
+  auto multi_itr = multi_view.begin();
+  for (size_t i = 0; i < single_view.size(); i++) {
+    ASSERT_EQ(*(single_itr++), *(multi_itr++));
+  }
+  ASSERT_DEATH(*multi_itr, "");
+}
+
+TEST_F(PacketViewMultiViewAppendTest, arrayOperatorTestAppend) {
   for (size_t i = 0; i < single_view.size(); i++) {
     ASSERT_EQ(single_view[i], multi_view[i]);
   }
diff --git a/gd/packet/parser/Android.bp b/gd/packet/parser/Android.bp
index 2dbaa4b..97f323a 100644
--- a/gd/packet/parser/Android.bp
+++ b/gd/packet/parser/Android.bp
@@ -1,23 +1,35 @@
 cc_binary_host {
     name: "bluetooth_packetgen",
     srcs: [
+        "fields/array_field.cc",
+        "fields/vector_field.cc",
         "fields/body_field.cc",
         "fields/checksum_field.cc",
         "fields/checksum_start_field.cc",
+        "fields/count_field.cc",
         "fields/custom_field.cc",
+        "fields/custom_field_fixed_size.cc",
         "fields/enum_field.cc",
+        "fields/fixed_enum_field.cc",
         "fields/fixed_field.cc",
+        "fields/fixed_scalar_field.cc",
         "fields/group_field.cc",
         "fields/packet_field.cc",
+        "fields/padding_field.cc",
         "fields/payload_field.cc",
         "fields/reserved_field.cc",
         "fields/scalar_field.cc",
         "fields/size_field.cc",
+        "fields/struct_field.cc",
+        "fields/variable_length_struct_field.cc",
         "checksum_def.cc",
         "custom_field_def.cc",
         "enum_def.cc",
         "enum_gen.cc",
         "packet_def.cc",
+        "parent_def.cc",
+        "struct_def.cc",
+        "struct_parser_generator.cc",
         "main.cc",
         "language_y.yy",
         "language_l.ll",
@@ -26,7 +38,6 @@
         "libc++fs",
     ],
     cppflags: [
-        "-Wno-implicit-fallthrough",
         "-fno-exceptions",
         "-O0",
     ],
diff --git a/gd/packet/parser/README b/gd/packet/parser/README
index f3d9dfb..9006c94 100644
--- a/gd/packet/parser/README
+++ b/gd/packet/parser/README
@@ -34,6 +34,7 @@
 
   - Can't handle size for Body type fields yet since they might not be byte aligned.
 
+  - Currently no arrays of custom types (might change later)
 
 -------
  NOTES
@@ -51,3 +52,8 @@
 Things to cover -
   Constraints
   Inheritence vs Contains
+
+Custom fields need the folowing functions:
+  static void Serialize(const Type&, MutableView&);
+  static std::optional<size_t> Size(Iterator);
+  static Type Parse(Iterator);
diff --git a/gd/packet/parser/checksum_def.cc b/gd/packet/parser/checksum_def.cc
index 38bd946..8cb1803 100644
--- a/gd/packet/parser/checksum_def.cc
+++ b/gd/packet/parser/checksum_def.cc
@@ -15,7 +15,8 @@
  */
 
 #include "checksum_def.h"
-
+#include "checksum_type_checker.h"
+#include "fields/checksum_field.h"
 #include "util.h"
 
 ChecksumDef::ChecksumDef(std::string name, std::string include, int size) : CustomFieldDef(name, include, size) {}
@@ -28,14 +29,6 @@
   return TypeDef::Type::CHECKSUM;
 }
 
-void ChecksumDef::GenInclude(std::ostream& s) const {
-  CustomFieldDef::GenInclude(s);
-}
-
-void ChecksumDef::GenUsing(std::ostream& s) const {
-  CustomFieldDef::GenUsing(s);
-}
-
 void ChecksumDef::GenChecksumCheck(std::ostream& s) const {
   s << "static_assert(ChecksumTypeChecker<" << name_ << "," << util::GetTypeForSize(size_) << ">::value, \"";
   s << name_ << " is not a valid checksum type. Please see README for more details.\");";
diff --git a/gd/packet/parser/checksum_def.h b/gd/packet/parser/checksum_def.h
index d8f9142..f82b8c3 100644
--- a/gd/packet/parser/checksum_def.h
+++ b/gd/packet/parser/checksum_def.h
@@ -18,9 +18,8 @@
 
 #include <iostream>
 
-#include "checksum_type_checker.h"
 #include "custom_field_def.h"
-#include "fields/checksum_field.h"
+#include "fields/packet_field.h"
 #include "parse_location.h"
 #include "type_def.h"
 
@@ -32,10 +31,6 @@
 
   virtual TypeDef::Type GetDefinitionType() const override;
 
-  virtual void GenInclude(std::ostream& s) const override;
-
-  virtual void GenUsing(std::ostream& s) const override;
-
   void GenChecksumCheck(std::ostream& s) const;
 
   const std::string include_;
diff --git a/gd/packet/parser/checksum_type_checker.h b/gd/packet/parser/checksum_type_checker.h
index a19ea59..3e384b1 100644
--- a/gd/packet/parser/checksum_type_checker.h
+++ b/gd/packet/parser/checksum_type_checker.h
@@ -28,13 +28,13 @@
 template <typename T, typename TRET>
 class ChecksumTypeChecker {
  public:
-  template <class C, void (*)(C&)>
+  template <class C, void (C::*)()>
   struct InitializeChecker {};
 
-  template <class C, void (*)(C&, uint8_t byte)>
+  template <class C, void (C::*)(uint8_t byte)>
   struct AddByteChecker {};
 
-  template <class C, typename CRET, CRET (*)(const C&)>
+  template <class C, typename CRET, CRET (C::*)() const>
   struct GetChecksumChecker {};
 
   // If all the methods are defined, this one matches
diff --git a/gd/packet/parser/custom_field_def.cc b/gd/packet/parser/custom_field_def.cc
index 9429e3f..3f2076d 100644
--- a/gd/packet/parser/custom_field_def.cc
+++ b/gd/packet/parser/custom_field_def.cc
@@ -18,6 +18,8 @@
 
 #include "util.h"
 
+CustomFieldDef::CustomFieldDef(std::string name, std::string include) : TypeDef(name), include_(include) {}
+
 CustomFieldDef::CustomFieldDef(std::string name, std::string include, int size)
     : TypeDef(name, size), include_(include) {
   if (size % 8 != 0) {
@@ -26,7 +28,11 @@
 }
 
 PacketField* CustomFieldDef::GetNewField(const std::string& name, ParseLocation loc) const {
-  return new CustomField(name, name_, size_, loc);
+  if (size_ == -1) {
+    return new CustomField(name, name_, loc);
+  } else {
+    return new CustomFieldFixedSize(name, name_, size_, loc);
+  }
 }
 
 TypeDef::Type CustomFieldDef::GetDefinitionType() const {
@@ -50,3 +56,9 @@
   }
   s << GetTypeName() << ";";
 }
+
+void CustomFieldDef::GenCustomFieldCheck(std::ostream& s, bool little_endian) const {
+  s << "static_assert(CustomTypeChecker<" << name_ << ", ";
+  s << (little_endian ? "" : "!") << "kLittleEndian>::value, \"";
+  s << name_ << " is not a valid custom field type. Please see README for more details.\");";
+}
diff --git a/gd/packet/parser/custom_field_def.h b/gd/packet/parser/custom_field_def.h
index 156ac8a..26b954f 100644
--- a/gd/packet/parser/custom_field_def.h
+++ b/gd/packet/parser/custom_field_def.h
@@ -19,20 +19,25 @@
 #include <iostream>
 
 #include "fields/custom_field.h"
+#include "fields/custom_field_fixed_size.h"
 #include "parse_location.h"
 #include "type_def.h"
 
 class CustomFieldDef : public TypeDef {
  public:
+  CustomFieldDef(std::string name, std::string include);
+
   CustomFieldDef(std::string name, std::string include, int size);
 
   virtual PacketField* GetNewField(const std::string& name, ParseLocation loc) const override;
 
   virtual Type GetDefinitionType() const override;
 
-  virtual void GenInclude(std::ostream& s) const;
+  void GenInclude(std::ostream& s) const;
 
-  virtual void GenUsing(std::ostream& s) const;
+  void GenUsing(std::ostream& s) const;
+
+  void GenCustomFieldCheck(std::ostream& s, bool little_endian) const;
 
   const std::string include_;
 };
diff --git a/gd/packet/parser/custom_type_checker.h b/gd/packet/parser/custom_type_checker.h
new file mode 100644
index 0000000..5d99622
--- /dev/null
+++ b/gd/packet/parser/custom_type_checker.h
@@ -0,0 +1,49 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#pragma once
+
+#include <array>
+
+#include "packet/bit_inserter.h"
+#include "packet/iterator.h"
+
+namespace bluetooth {
+namespace packet {
+// Checks a custom type has all the necessary functions with the correct signatures.
+template <typename T, bool packet_little_endian>
+class CustomTypeChecker {
+ public:
+  template <class C, void (C::*)(BitInserter&) const>
+  struct SerializeChecker {};
+
+  template <class C, size_t (C::*)() const>
+  struct SizeChecker {};
+
+  template <class C, bool little_endian, std::optional<Iterator<little_endian>> (*)(C* vec, Iterator<little_endian> it)>
+  struct ParseChecker {};
+
+  template <class C, bool little_endian>
+  static int Test(SerializeChecker<C, &C::Serialize>*, SizeChecker<C, &C::size>*,
+                  ParseChecker<C, little_endian, &C::Parse>*);
+
+  template <class C, bool little_endian>
+  static char Test(...);
+
+  static constexpr bool value = (sizeof(Test<T, packet_little_endian>(0, 0, 0)) == sizeof(int));
+};
+}  // namespace packet
+}  // namespace bluetooth
diff --git a/gd/packet/parser/declarations.h b/gd/packet/parser/declarations.h
index 1a344f0..549ddc4 100644
--- a/gd/packet/parser/declarations.h
+++ b/gd/packet/parser/declarations.h
@@ -25,10 +25,15 @@
 #include "enum_def.h"
 #include "enum_gen.h"
 #include "packet_def.h"
+#include "struct_def.h"
 
 class Declarations {
  public:
   void AddTypeDef(std::string name, TypeDef* def) {
+    auto it = type_defs_.find(name);
+    if (it != type_defs_.end()) {
+      ERROR() << "Redefinition of Type " << name;
+    }
     type_defs_.insert(std::pair(name, def));
     type_defs_queue_.push_back(std::pair(name, def));
   }
@@ -43,6 +48,10 @@
   }
 
   void AddPacketDef(std::string name, PacketDef def) {
+    auto it = packet_defs_.find(name);
+    if (it != packet_defs_.end()) {
+      ERROR() << "Redefinition of Packet " << name;
+    }
     packet_defs_.insert(std::pair(name, def));
     packet_defs_queue_.push_back(std::pair(name, def));
   }
@@ -57,6 +66,10 @@
   }
 
   void AddGroupDef(std::string name, FieldList* group_def) {
+    auto it = group_defs_.find(name);
+    if (it != group_defs_.end()) {
+      ERROR() << "Redefinition of group " << name;
+    }
     group_defs_.insert(std::pair(name, group_def));
   }
 
diff --git a/gd/packet/parser/enum_def.cc b/gd/packet/parser/enum_def.cc
index 410af15..8b90426 100644
--- a/gd/packet/parser/enum_def.cc
+++ b/gd/packet/parser/enum_def.cc
@@ -22,12 +22,15 @@
 #include "fields/enum_field.h"
 #include "util.h"
 
-EnumDef::EnumDef(std::string name, int size) : TypeDef(name, size){};
+EnumDef::EnumDef(std::string name, int size) : TypeDef(name, size) {}
 
 void EnumDef::AddEntry(std::string name, uint32_t value) {
+  if (!util::IsEnumCase(name)) {
+    ERROR() << __func__ << ": Enum " << name << "(" << value << ") should be all uppercase with underscores";
+  }
   if (value > util::GetMaxValueForBits(size_)) {
-    std::cerr << __func__ << ": Value provided is greater than max possible value for enum. " << name_ << "\n";
-    abort();
+    ERROR() << __func__ << ": Value of " << name << "(" << value << ") is greater than the max possible value for enum "
+            << name_ << "(" << util::GetMaxValueForBits(size_) << ")\n";
   }
 
   constants_.insert(std::pair(value, name));
@@ -45,7 +48,3 @@
 TypeDef::Type EnumDef::GetDefinitionType() const {
   return TypeDef::Type::ENUM;
 }
-
-void EnumDef::GenInclude(std::ostream&) const {}
-
-void EnumDef::GenUsing(std::ostream&) const {}
diff --git a/gd/packet/parser/enum_def.h b/gd/packet/parser/enum_def.h
index 97989e6..5698d0f 100644
--- a/gd/packet/parser/enum_def.h
+++ b/gd/packet/parser/enum_def.h
@@ -36,10 +36,6 @@
 
   virtual Type GetDefinitionType() const override;
 
-  virtual void GenInclude(std::ostream& s) const override;
-
-  virtual void GenUsing(std::ostream& s) const override;
-
   // data
   std::map<uint32_t, std::string> constants_;
   std::set<std::string> entries_;
diff --git a/gd/packet/parser/enum_gen.cc b/gd/packet/parser/enum_gen.cc
index 769a43a..50d5f81 100644
--- a/gd/packet/parser/enum_gen.cc
+++ b/gd/packet/parser/enum_gen.cc
@@ -20,7 +20,7 @@
 
 #include "util.h"
 
-EnumGen::EnumGen(EnumDef e) : e_(e){};
+EnumGen::EnumGen(EnumDef e) : e_(e) {}
 
 void EnumGen::GenDefinition(std::ostream& stream) {
   stream << "enum class ";
diff --git a/gd/packet/parser/field_list.h b/gd/packet/parser/field_list.h
index 1cd7df4..81fc0d7 100644
--- a/gd/packet/parser/field_list.h
+++ b/gd/packet/parser/field_list.h
@@ -20,6 +20,7 @@
 #include <set>
 #include <vector>
 
+#include "fields/all_fields.h"
 #include "fields/packet_field.h"
 
 using FieldListIterator = std::vector<PacketField*>::const_iterator;
@@ -70,7 +71,7 @@
     FieldList ret;
     for (auto it = begin(); it != end(); it++) {
       const auto& field = *it;
-      if (field->GetFieldType() == PacketField::Type::PAYLOAD || field->GetFieldType() == PacketField::Type::BODY) {
+      if (field->GetFieldType() == PayloadField::kFieldType || field->GetFieldType() == BodyField::kFieldType) {
         break;
       }
       ret.AppendField(*it);
@@ -83,7 +84,7 @@
     FieldListIterator it;
     for (it = begin(); it != end(); it++) {
       const auto& field = *it;
-      if (field->GetFieldType() == PacketField::Type::PAYLOAD || field->GetFieldType() == PacketField::Type::BODY) {
+      if (field->GetFieldType() == PayloadField::kFieldType || field->GetFieldType() == BodyField::kFieldType) {
         // Increment it once to get first field after payload/body.
         it++;
         break;
@@ -93,7 +94,7 @@
     return FieldList(it, end());
   }
 
-  FieldList GetFieldsWithTypes(std::set<PacketField::Type> field_types) const {
+  FieldList GetFieldsWithTypes(std::set<std::string> field_types) const {
     FieldList ret;
 
     for (const auto& field : field_list_) {
@@ -105,7 +106,7 @@
     return ret;
   }
 
-  FieldList GetFieldsWithoutTypes(std::set<PacketField::Type> field_types) const {
+  FieldList GetFieldsWithoutTypes(std::set<std::string> field_types) const {
     FieldList ret;
 
     for (const auto& field : field_list_) {
@@ -182,20 +183,19 @@
  private:
   void AddField(PacketField* field) {
     if (field_map_.find(field->GetName()) != field_map_.end()) {
-      ERROR(field) << "Field with name \"" << field->GetName() << "\" was "
-                   << "previously defined.\n";
+      ERROR(field) << "Field with name \"" << field->GetName() << "\" was previously defined.\n";
     }
 
-    if (field->GetFieldType() == PacketField::Type::PAYLOAD) {
-      if (HasBody()) {
-        ERROR(field) << "Can not have payload field in packet that already has a body.";
+    if (field->GetFieldType() == PayloadField::kFieldType) {
+      if (has_body_) {
+        ERROR(field) << "Packet already has a body.";
       }
       has_payload_ = true;
     }
 
-    if (field->GetFieldType() == PacketField::Type::BODY) {
-      if (HasPayload()) {
-        ERROR(field) << "Can not have body field in packet that already has a payload.";
+    if (field->GetFieldType() == BodyField::kFieldType) {
+      if (has_payload_) {
+        ERROR(field) << "Packet already has a payload.";
       }
       has_body_ = true;
     }
diff --git a/gd/packet/parser/fields/all_fields.h b/gd/packet/parser/fields/all_fields.h
index 50cc659..8c0aeee 100644
--- a/gd/packet/parser/fields/all_fields.h
+++ b/gd/packet/parser/fields/all_fields.h
@@ -16,14 +16,22 @@
 
 #pragma once
 
+#include "fields/array_field.h"
 #include "fields/body_field.h"
 #include "fields/checksum_field.h"
 #include "fields/checksum_start_field.h"
+#include "fields/count_field.h"
 #include "fields/custom_field.h"
+#include "fields/custom_field_fixed_size.h"
 #include "fields/enum_field.h"
-#include "fields/fixed_field.h"
+#include "fields/fixed_enum_field.h"
+#include "fields/fixed_scalar_field.h"
 #include "fields/group_field.h"
+#include "fields/padding_field.h"
 #include "fields/payload_field.h"
 #include "fields/reserved_field.h"
 #include "fields/scalar_field.h"
 #include "fields/size_field.h"
+#include "fields/struct_field.h"
+#include "fields/variable_length_struct_field.h"
+#include "fields/vector_field.h"
diff --git a/gd/packet/parser/fields/array_field.cc b/gd/packet/parser/fields/array_field.cc
new file mode 100644
index 0000000..2592b6c
--- /dev/null
+++ b/gd/packet/parser/fields/array_field.cc
@@ -0,0 +1,163 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "fields/array_field.h"
+
+#include "fields/custom_field.h"
+#include "fields/scalar_field.h"
+#include "util.h"
+
+const std::string ArrayField::kFieldType = "ArrayField";
+
+ArrayField::ArrayField(std::string name, int element_size, int array_size, ParseLocation loc)
+    : PacketField(name, loc), element_field_(new ScalarField("val", element_size, loc)), element_size_(element_size),
+      array_size_(array_size) {
+  if (element_size > 64 || element_size < 0)
+    ERROR(this) << __func__ << ": Not implemented for element size = " << element_size;
+  if (element_size % 8 != 0) {
+    ERROR(this) << "Can only have arrays with elements that are byte aligned (" << element_size << ")";
+  }
+}
+
+ArrayField::ArrayField(std::string name, TypeDef* type_def, int array_size, ParseLocation loc)
+    : PacketField(name, loc), element_field_(type_def->GetNewField("val", loc)),
+      element_size_(element_field_->GetSize()), array_size_(array_size) {
+  if (!element_size_.empty() && element_size_.bits() % 8 != 0) {
+    ERROR(this) << "Can only have arrays with elements that are byte aligned (" << element_size_ << ")";
+  }
+}
+
+const std::string& ArrayField::GetFieldType() const {
+  return ArrayField::kFieldType;
+}
+
+Size ArrayField::GetSize() const {
+  if (!element_size_.empty() && !element_size_.has_dynamic()) {
+    return Size(array_size_ * element_size_.bits());
+  }
+  return Size();
+}
+
+Size ArrayField::GetBuilderSize() const {
+  if (!element_size_.empty() && !element_size_.has_dynamic()) {
+    return GetSize();
+  } else if (element_field_->BuilderParameterMustBeMoved()) {
+    std::string ret = "[this](){ size_t length = 0; for (const auto& elem : " + GetName() +
+                      "_) { length += elem->size() * 8; } return length; }()";
+    return ret;
+  } else {
+    std::string ret = "[this](){ size_t length = 0; for (const auto& elem : " + GetName() +
+                      "_) { length += elem.size() * 8; } return length; }()";
+    return ret;
+  }
+}
+
+Size ArrayField::GetStructSize() const {
+  if (!element_size_.empty() && !element_size_.has_dynamic()) {
+    return GetSize();
+  } else if (element_field_->BuilderParameterMustBeMoved()) {
+    std::string ret = "[this](){ size_t length = 0; for (const auto& elem : to_fill->" + GetName() +
+                      "_) { length += elem->size() * 8; } return length; }()";
+    return ret;
+  } else {
+    std::string ret = "[this](){ size_t length = 0; for (const auto& elem : to_fill->" + GetName() +
+                      "_) { length += elem.size() * 8; } return length; }()";
+    return ret;
+  }
+}
+
+std::string ArrayField::GetDataType() const {
+  return "std::array<" + element_field_->GetDataType() + "," + std::to_string(array_size_) + ">";
+}
+
+void ArrayField::GenExtractor(std::ostream& s, int num_leading_bits, bool for_struct) const {
+  s << GetDataType() << "::iterator ret_it = " << GetName() << "_ptr->begin();";
+  s << "auto " << element_field_->GetName() << "_it = " << GetName() << "_it;";
+  if (!element_size_.empty()) {
+    s << "while (" << element_field_->GetName() << "_it.NumBytesRemaining() >= " << element_size_.bytes();
+    s << " && ret_it < " << GetName() << "_ptr->end()) {";
+  } else {
+    s << "while (" << element_field_->GetName() << "_it.NumBytesRemaining() > 0 ";
+    s << " && ret_it < " << GetName() << "_ptr->end()) {";
+  }
+  if (element_field_->BuilderParameterMustBeMoved()) {
+    s << element_field_->GetDataType() << " " << element_field_->GetName() << "_ptr;";
+  } else {
+    s << element_field_->GetDataType() << "* " << element_field_->GetName() << "_ptr = ret_it;";
+  }
+  element_field_->GenExtractor(s, num_leading_bits, for_struct);
+  if (element_field_->BuilderParameterMustBeMoved()) {
+    s << "*ret_it = std::move(" << element_field_->GetName() << "_ptr);";
+  }
+  s << "ret_it++;";
+  s << "}";
+}
+
+void ArrayField::GenGetter(std::ostream& s, Size start_offset, Size end_offset) const {
+  s << GetDataType();
+  s << " Get" << util::UnderscoreToCamelCase(GetName()) << "() {";
+  s << "ASSERT(was_validated_);";
+  s << "size_t end_index = size();";
+  s << "auto to_bound = begin();";
+
+  int num_leading_bits = GenBounds(s, start_offset, end_offset, GetSize());
+  s << GetDataType() << " " << GetName() << "_value;";
+  s << GetDataType() << "* " << GetName() << "_ptr = &" << GetName() << "_value;";
+  GenExtractor(s, num_leading_bits, false);
+
+  s << "return " << GetName() << "_value;";
+  s << "}\n";
+}
+
+bool ArrayField::GenBuilderParameter(std::ostream& s) const {
+  if (element_field_->BuilderParameterMustBeMoved()) {
+    s << "std::array<" << element_field_->GetDataType() << "," << array_size_ << "> " << GetName();
+  } else {
+    s << "const std::array<" << element_field_->GetDataType() << "," << array_size_ << ">& " << GetName();
+  }
+  return true;
+}
+
+bool ArrayField::BuilderParameterMustBeMoved() const {
+  return element_field_->BuilderParameterMustBeMoved();
+}
+
+bool ArrayField::GenBuilderMember(std::ostream& s) const {
+  s << "std::array<" << element_field_->GetDataType() << "," << array_size_ << "> " << GetName();
+  return true;
+}
+
+bool ArrayField::HasParameterValidator() const {
+  return false;
+}
+
+void ArrayField::GenParameterValidator(std::ostream&) const {
+  // Array length is validated by the compiler
+}
+
+void ArrayField::GenInserter(std::ostream& s) const {
+  s << "for (const auto& val_ : " << GetName() << "_) {";
+  element_field_->GenInserter(s);
+  s << "}\n";
+}
+
+void ArrayField::GenValidator(std::ostream&) const {
+  // NOTE: We could check if the element size divides cleanly into the array size, but we decided to forgo that
+  // in favor of just returning as many elements as possible in a best effort style.
+  //
+  // Other than that there is nothing that arrays need to be validated on other than length so nothing needs to
+  // be done here.
+}
diff --git a/gd/packet/parser/fields/array_field.h b/gd/packet/parser/fields/array_field.h
new file mode 100644
index 0000000..6e171e6
--- /dev/null
+++ b/gd/packet/parser/fields/array_field.h
@@ -0,0 +1,66 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#pragma once
+
+#include "fields/packet_field.h"
+#include "parse_location.h"
+#include "type_def.h"
+
+class ArrayField : public PacketField {
+ public:
+  ArrayField(std::string name, int element_size, int fixed_size, ParseLocation loc);
+
+  ArrayField(std::string name, TypeDef* type_def, int fixed_size, ParseLocation loc);
+
+  static const std::string kFieldType;
+
+  virtual const std::string& GetFieldType() const override;
+
+  virtual Size GetSize() const override;
+
+  virtual Size GetBuilderSize() const override;
+
+  virtual Size GetStructSize() const override;
+
+  virtual std::string GetDataType() const override;
+
+  virtual void GenExtractor(std::ostream& s, int num_leading_bits, bool for_struct) const override;
+
+  virtual void GenGetter(std::ostream& s, Size start_offset, Size end_offset) const override;
+
+  virtual bool GenBuilderParameter(std::ostream& s) const override;
+
+  virtual bool BuilderParameterMustBeMoved() const override;
+
+  virtual bool GenBuilderMember(std::ostream& s) const override;
+
+  virtual bool HasParameterValidator() const override;
+
+  virtual void GenParameterValidator(std::ostream& s) const override;
+
+  virtual void GenInserter(std::ostream& s) const override;
+
+  virtual void GenValidator(std::ostream&) const override;
+
+  const std::string name_;
+
+  const PacketField* element_field_{nullptr};
+
+  const Size element_size_{};
+
+  const int array_size_{-1};
+};
diff --git a/gd/packet/parser/fields/body_field.cc b/gd/packet/parser/fields/body_field.cc
index 6ed1d24..4457348 100644
--- a/gd/packet/parser/fields/body_field.cc
+++ b/gd/packet/parser/fields/body_field.cc
@@ -16,21 +16,25 @@
 
 #include "fields/body_field.h"
 
-BodyField::BodyField(ParseLocation loc) : PacketField(loc, "body") {}
+const std::string BodyField::kFieldType = "BodyField";
 
-PacketField::Type BodyField::GetFieldType() const {
-  return PacketField::Type::BODY;
+BodyField::BodyField(ParseLocation loc) : PacketField("body", loc) {}
+
+const std::string& BodyField::GetFieldType() const {
+  return BodyField::kFieldType;
 }
 
 Size BodyField::GetSize() const {
   return Size(0);
 }
 
-std::string BodyField::GetType() const {
+std::string BodyField::GetDataType() const {
   ERROR(this) << "No need to know the type of a body field.";
   return "BodyType";
 }
 
+void BodyField::GenExtractor(std::ostream&, int, bool) const {}
+
 void BodyField::GenGetter(std::ostream&, Size, Size) const {}
 
 bool BodyField::GenBuilderParameter(std::ostream&) const {
diff --git a/gd/packet/parser/fields/body_field.h b/gd/packet/parser/fields/body_field.h
index 9cc2301..8a2a90b 100644
--- a/gd/packet/parser/fields/body_field.h
+++ b/gd/packet/parser/fields/body_field.h
@@ -24,11 +24,15 @@
  public:
   BodyField(ParseLocation loc);
 
-  virtual PacketField::Type GetFieldType() const override;
+  static const std::string kFieldType;
+
+  virtual const std::string& GetFieldType() const override;
 
   virtual Size GetSize() const override;
 
-  virtual std::string GetType() const override;
+  virtual std::string GetDataType() const override;
+
+  virtual void GenExtractor(std::ostream& s, int num_leading_bits, bool for_struct) const override;
 
   virtual void GenGetter(std::ostream&, Size, Size) const override;
 
diff --git a/gd/packet/parser/fields/checksum_field.cc b/gd/packet/parser/fields/checksum_field.cc
index 4a29e4d..beab91a 100644
--- a/gd/packet/parser/fields/checksum_field.cc
+++ b/gd/packet/parser/fields/checksum_field.cc
@@ -17,21 +17,21 @@
 #include "fields/checksum_field.h"
 #include "util.h"
 
+const std::string ChecksumField::kFieldType = "ChecksumField";
+
 ChecksumField::ChecksumField(std::string name, std::string type_name, int size, ParseLocation loc)
-    : PacketField(loc, name), type_name_(type_name), size_(size) {}
+    : ScalarField(name, size, loc), type_name_(type_name) {}
 
-PacketField::Type ChecksumField::GetFieldType() const {
-  return PacketField::Type::CHECKSUM;
+const std::string& ChecksumField::GetFieldType() const {
+  return ChecksumField::kFieldType;
 }
 
-Size ChecksumField::GetSize() const {
-  return size_;
-}
-
-std::string ChecksumField::GetType() const {
+std::string ChecksumField::GetDataType() const {
   return type_name_;
 }
 
+void ChecksumField::GenExtractor(std::ostream&, int, bool) const {}
+
 void ChecksumField::GenGetter(std::ostream&, Size, Size) const {}
 
 bool ChecksumField::GenBuilderParameter(std::ostream&) const {
@@ -48,7 +48,7 @@
 
 void ChecksumField::GenInserter(std::ostream& s) const {
   s << "packet::ByteObserver observer = i.UnregisterObserver();";
-  s << "insert(static_cast<" << util::GetTypeForSize(size_) << ">(observer.GetValue()), i);";
+  s << "insert(static_cast<" << util::GetTypeForSize(GetSize().bits()) << ">(observer.GetValue()), i);";
 }
 
 void ChecksumField::GenValidator(std::ostream&) const {
diff --git a/gd/packet/parser/fields/checksum_field.h b/gd/packet/parser/fields/checksum_field.h
index 5bf3923..f6dfe46 100644
--- a/gd/packet/parser/fields/checksum_field.h
+++ b/gd/packet/parser/fields/checksum_field.h
@@ -17,17 +17,20 @@
 #pragma once
 
 #include "fields/packet_field.h"
+#include "fields/scalar_field.h"
 #include "parse_location.h"
 
-class ChecksumField : public PacketField {
+class ChecksumField : public ScalarField {
  public:
   ChecksumField(std::string name, std::string type_name, int size, ParseLocation loc);
 
-  virtual PacketField::Type GetFieldType() const override;
+  static const std::string kFieldType;
 
-  virtual Size GetSize() const override;
+  virtual const std::string& GetFieldType() const override;
 
-  virtual std::string GetType() const override;
+  virtual std::string GetDataType() const override;
+
+  virtual void GenExtractor(std::ostream& s, int num_leading_bits, bool for_struct) const override;
 
   virtual void GenGetter(std::ostream& s, Size start_offset, Size end_offset) const override;
 
@@ -43,7 +46,4 @@
 
  private:
   std::string type_name_;
-
- public:
-  const int size_{-1};
 };
diff --git a/gd/packet/parser/fields/checksum_start_field.cc b/gd/packet/parser/fields/checksum_start_field.cc
index 75438f2..a100aee 100644
--- a/gd/packet/parser/fields/checksum_start_field.cc
+++ b/gd/packet/parser/fields/checksum_start_field.cc
@@ -17,25 +17,28 @@
 #include "fields/checksum_start_field.h"
 #include "util.h"
 
-ChecksumStartField::ChecksumStartField(std::string name, ParseLocation loc)
-    : PacketField(loc, name + "_start"), started_field_name_(name) {}
+const std::string ChecksumStartField::kFieldType = "ChecksumStartField";
 
-PacketField::Type ChecksumStartField::GetFieldType() const {
-  return PacketField::Type::CHECKSUM_START;
+ChecksumStartField::ChecksumStartField(std::string name, ParseLocation loc)
+    : PacketField(name + "_start", loc), started_field_name_(name) {}
+
+const std::string& ChecksumStartField::GetFieldType() const {
+  return ChecksumStartField::kFieldType;
 }
 
 Size ChecksumStartField::GetSize() const {
   return Size(0);
 }
 
-std::string ChecksumStartField::GetType() const {
+std::string ChecksumStartField::GetDataType() const {
   return "There's no type for Checksum Start fields";
 }
 
+void ChecksumStartField::GenExtractor(std::ostream&, int, bool) const {}
+
 void ChecksumStartField::GenGetter(std::ostream&, Size, Size) const {}
 
 bool ChecksumStartField::GenBuilderParameter(std::ostream&) const {
-  // There is no builder parameter for a size field
   return false;
 }
 
diff --git a/gd/packet/parser/fields/checksum_start_field.h b/gd/packet/parser/fields/checksum_start_field.h
index 248c146..18a5956 100644
--- a/gd/packet/parser/fields/checksum_start_field.h
+++ b/gd/packet/parser/fields/checksum_start_field.h
@@ -23,13 +23,17 @@
  public:
   ChecksumStartField(std::string name, ParseLocation loc);
 
+  static const std::string kFieldType;
+
   std::string GetField() const;
 
-  virtual PacketField::Type GetFieldType() const override;
+  virtual const std::string& GetFieldType() const override;
 
   virtual Size GetSize() const override;
 
-  virtual std::string GetType() const override;
+  virtual std::string GetDataType() const override;
+
+  virtual void GenExtractor(std::ostream& s, int num_leading_bits, bool for_struct) const override;
 
   virtual void GenGetter(std::ostream& s, Size start_offset, Size end_offset) const override;
 
diff --git a/gd/packet/parser/fields/count_field.cc b/gd/packet/parser/fields/count_field.cc
new file mode 100644
index 0000000..8e1cf09
--- /dev/null
+++ b/gd/packet/parser/fields/count_field.cc
@@ -0,0 +1,59 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "fields/count_field.h"
+#include "util.h"
+
+const std::string CountField::kFieldType = "CountField";
+
+CountField::CountField(std::string name, int size, ParseLocation loc)
+    : ScalarField(name + "_count", size, loc), sized_field_name_(name) {}
+
+const std::string& CountField::GetFieldType() const {
+  return CountField::kFieldType;
+}
+
+void CountField::GenGetter(std::ostream& s, Size start_offset, Size end_offset) const {
+  s << "protected:";
+  ScalarField::GenGetter(s, start_offset, end_offset);
+  s << "public:\n";
+}
+
+bool CountField::GenBuilderParameter(std::ostream&) const {
+  // There is no builder parameter for a size field
+  return false;
+}
+
+bool CountField::HasParameterValidator() const {
+  return false;
+}
+
+void CountField::GenParameterValidator(std::ostream&) const {
+  // There is no builder parameter for a size field
+  // TODO: Check if the payload fits in the packet?
+}
+
+void CountField::GenInserter(std::ostream&) const {
+  ERROR(this) << __func__ << ": This should not be called for count fields";
+}
+
+void CountField::GenValidator(std::ostream&) const {
+  // Do nothing since the fixed count fields will be handled specially.
+}
+
+std::string CountField::GetSizedFieldName() const {
+  return sized_field_name_;
+}
diff --git a/gd/packet/parser/fields/count_field.h b/gd/packet/parser/fields/count_field.h
new file mode 100644
index 0000000..c9cb673
--- /dev/null
+++ b/gd/packet/parser/fields/count_field.h
@@ -0,0 +1,50 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#pragma once
+
+#include "fields/packet_field.h"
+#include "fields/scalar_field.h"
+#include "parse_location.h"
+
+class CountField : public ScalarField {
+ public:
+  CountField(std::string name, int size, ParseLocation loc);
+
+  static const std::string kFieldType;
+
+  std::string GetField() const;
+
+  virtual const std::string& GetFieldType() const override;
+
+  virtual void GenGetter(std::ostream& s, Size start_offset, Size end_offset) const override;
+
+  virtual bool GenBuilderParameter(std::ostream&) const override;
+
+  virtual bool HasParameterValidator() const override;
+
+  virtual void GenParameterValidator(std::ostream&) const override;
+
+  virtual void GenInserter(std::ostream&) const override;
+
+  virtual void GenValidator(std::ostream&) const override;
+
+  virtual std::string GetSizedFieldName() const;
+
+ private:
+  int size_;
+  std::string sized_field_name_;
+};
diff --git a/gd/packet/parser/fields/custom_field.cc b/gd/packet/parser/fields/custom_field.cc
index 05952ab..3da3b5b 100644
--- a/gd/packet/parser/fields/custom_field.cc
+++ b/gd/packet/parser/fields/custom_field.cc
@@ -17,62 +17,57 @@
 #include "fields/custom_field.h"
 #include "util.h"
 
+const std::string CustomField::kFieldType = "CustomField";
+
 CustomField::CustomField(std::string name, std::string type_name, ParseLocation loc)
-    : PacketField(loc, name), type_name_(type_name) {}
+    : PacketField(name, loc), type_name_(type_name) {}
 
-// Fixed size custom fields.
-CustomField::CustomField(std::string name, std::string type_name, int size, ParseLocation loc)
-    : PacketField(loc, name), type_name_(type_name), size_(size) {}
-
-PacketField::Type CustomField::GetFieldType() const {
-  return PacketField::Type::CUSTOM;
+const std::string& CustomField::GetFieldType() const {
+  return CustomField::kFieldType;
 }
 
 Size CustomField::GetSize() const {
-  return size_;
+  return Size();
 }
 
-std::string CustomField::GetType() const {
+Size CustomField::GetBuilderSize() const {
+  std::string ret = "(" + GetName() + "_.size() * 8) ";
+  return ret;
+}
+
+std::string CustomField::GetDataType() const {
   return type_name_;
 }
 
+void CustomField::GenExtractor(std::ostream& s, int, bool) const {
+  s << "auto optional_it = ";
+  s << GetDataType() << "::Parse( " << GetName() << "_ptr, " << GetName() << "_it);";
+  s << "if (optional_it) {";
+  s << GetName() << "_it = *optional_it;";
+  s << "} else {";
+  s << GetName() << "_it = " << GetName() << "_it + " << GetName() << "_it.NumBytesRemaining();";
+  s << GetName() << "_ptr = nullptr;";
+  s << "}";
+}
+
 void CustomField::GenGetter(std::ostream& s, Size start_offset, Size end_offset) const {
-  s << GetType();
-  s << " Get" << util::UnderscoreToCamelCase(GetName()) << "() const {";
+  s << "std::unique_ptr<" << GetDataType() << "> Get" << util::UnderscoreToCamelCase(GetName()) << "() const {";
+  s << "ASSERT(was_validated_);";
+  s << "size_t end_index = size();";
+  s << "auto to_bound = begin();";
 
-  s << "auto it = ";
-  if (!start_offset.empty()) {
-    // Default to start if available.
-    if (start_offset.bits() % 8 != 0) {
-      ERROR(this) << "Custom Field must be byte aligned.";
-    }
-    s << "begin()";
-    if (start_offset.bits() / 8 != 0) s << " + " << start_offset.bits() / 8;
-    if (start_offset.has_dynamic()) s << " + " << start_offset.dynamic_string();
-  } else if (size_ != -1) {
-    // If the size of the custom field is already known, we can determine it's offset based on end().
-    if (!end_offset.empty()) {
-      if (end_offset.bits() % 8) {
-        ERROR(this) << "Custom Field must be byte aligned.";
-      }
-
-      int byte_offset = (end_offset.bits() + size_) / 8;
-      s << "end() - " << byte_offset;
-      if (end_offset.has_dynamic()) s << " - (" << end_offset.dynamic_string() << ")";
-    } else {
-      ERROR(this) << "Ambiguous offset for fixed size custom field.";
-    }
-  } else {
-    ERROR(this) << "Custom Field offset can not be determined from begin().";
-  }
-  s << ";";
-
-  s << "return it.extract<" << GetType() << ">();";
+  int num_leading_bits = GenBounds(s, start_offset, end_offset, GetSize());
+  s << "std::unique_ptr<" << GetDataType() << "> " << GetName() << "_value";
+  s << " = std::make_unique<" << GetDataType() << ">();";
+  s << GetDataType() << "* " << GetName() << "_ptr = " << GetName() << "_value.get();";
+  GenExtractor(s, num_leading_bits, false);
+  s << "if (" << GetName() << "_ptr == nullptr) {" << GetName() << "_value.reset(); }";
+  s << "return " << GetName() << "_value;";
   s << "}\n";
 }
 
 bool CustomField::GenBuilderParameter(std::ostream& s) const {
-  s << GetType() << " " << GetName();
+  s << GetDataType() << " " << GetName();
   return true;
 }
 
@@ -85,7 +80,7 @@
 }
 
 void CustomField::GenInserter(std::ostream& s) const {
-  s << "insert(" << GetName() << "_, i);";
+  s << GetName() << "_.Serialize(i);";
 }
 
 void CustomField::GenValidator(std::ostream&) const {
diff --git a/gd/packet/parser/fields/custom_field.h b/gd/packet/parser/fields/custom_field.h
index 95a67a1..6e07d94 100644
--- a/gd/packet/parser/fields/custom_field.h
+++ b/gd/packet/parser/fields/custom_field.h
@@ -23,13 +23,17 @@
  public:
   CustomField(std::string name, std::string type_name, ParseLocation loc);
 
-  CustomField(std::string name, std::string type_name, int size, ParseLocation loc);
+  static const std::string kFieldType;
 
-  virtual PacketField::Type GetFieldType() const override;
+  virtual const std::string& GetFieldType() const override;
 
   virtual Size GetSize() const override;
 
-  virtual std::string GetType() const override;
+  virtual Size GetBuilderSize() const override;
+
+  virtual std::string GetDataType() const override;
+
+  virtual void GenExtractor(std::ostream& s, int num_leading_bits, bool for_struct) const override;
 
   virtual void GenGetter(std::ostream& s, Size start_offset, Size end_offset) const override;
 
@@ -45,7 +49,4 @@
 
  private:
   std::string type_name_;
-
- public:
-  const int size_{-1};
 };
diff --git a/gd/packet/parser/fields/custom_field_fixed_size.cc b/gd/packet/parser/fields/custom_field_fixed_size.cc
new file mode 100644
index 0000000..029f0aa
--- /dev/null
+++ b/gd/packet/parser/fields/custom_field_fixed_size.cc
@@ -0,0 +1,60 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "fields/custom_field_fixed_size.h"
+#include "util.h"
+
+const std::string CustomFieldFixedSize::kFieldType = "CustomField";
+
+CustomFieldFixedSize::CustomFieldFixedSize(std::string name, std::string type_name, int size, ParseLocation loc)
+    : ScalarField(name, size, loc), type_name_(type_name) {}
+
+const std::string& CustomFieldFixedSize::GetFieldType() const {
+  return CustomFieldFixedSize::kFieldType;
+}
+
+std::string CustomFieldFixedSize::GetDataType() const {
+  return type_name_;
+}
+
+int CustomFieldFixedSize::GenBounds(std::ostream& s, Size start_offset, Size end_offset, Size size) const {
+  if (!start_offset.empty()) {
+    // Default to start if available.
+    s << "auto " << GetName() << "_it = to_bound + (" << start_offset << ") / 8;";
+  } else if (!end_offset.empty()) {
+    Size byte_offset = size + end_offset;
+    s << "auto " << GetName() << "_it = to_bound (+ to_bound.NumBytesRemaining() - (" << byte_offset << ") / 8);";
+  } else {
+    ERROR(this) << "Ambiguous offset for field.";
+  }
+  return 0;  // num_leading_bits
+}
+
+void CustomFieldFixedSize::GenExtractor(std::ostream& s, int, bool) const {
+  s << "*" << GetName() << "_ptr = " << GetName() << "_it.extract<" << GetDataType() << ">();";
+}
+
+bool CustomFieldFixedSize::HasParameterValidator() const {
+  return false;
+}
+
+void CustomFieldFixedSize::GenParameterValidator(std::ostream&) const {
+  // Do nothing.
+}
+
+void CustomFieldFixedSize::GenValidator(std::ostream&) const {
+  // Do nothing.
+}
diff --git a/gd/packet/parser/fields/custom_field_fixed_size.h b/gd/packet/parser/fields/custom_field_fixed_size.h
new file mode 100644
index 0000000..bd19eb0
--- /dev/null
+++ b/gd/packet/parser/fields/custom_field_fixed_size.h
@@ -0,0 +1,43 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#pragma once
+
+#include "fields/scalar_field.h"
+#include "parse_location.h"
+
+class CustomFieldFixedSize : public ScalarField {
+ public:
+  CustomFieldFixedSize(std::string name, std::string type_name, int size, ParseLocation loc);
+
+  static const std::string kFieldType;
+
+  virtual const std::string& GetFieldType() const override;
+
+  virtual std::string GetDataType() const override;
+
+  virtual int GenBounds(std::ostream& s, Size start_offset, Size end_offset, Size size) const override;
+
+  virtual void GenExtractor(std::ostream& s, int num_leading_bits, bool for_struct) const override;
+
+  virtual bool HasParameterValidator() const override;
+
+  virtual void GenParameterValidator(std::ostream&) const override;
+
+  virtual void GenValidator(std::ostream&) const override;
+
+  std::string type_name_;
+};
diff --git a/gd/packet/parser/fields/enum_field.cc b/gd/packet/parser/fields/enum_field.cc
index 32a31d9..3080d43 100644
--- a/gd/packet/parser/fields/enum_field.cc
+++ b/gd/packet/parser/fields/enum_field.cc
@@ -18,86 +18,23 @@
 
 #include "util.h"
 
+const std::string EnumField::kFieldType = "EnumField";
+
 EnumField::EnumField(std::string name, EnumDef enum_def, std::string value, ParseLocation loc)
-    : PacketField(loc, name), enum_def_(enum_def), value_(value) {}
+    : ScalarField(name, enum_def.size_, loc), enum_def_(enum_def), value_(value) {}
+
+const std::string& EnumField::GetFieldType() const {
+  return EnumField::kFieldType;
+}
 
 EnumDef EnumField::GetEnumDef() {
   return enum_def_;
 }
 
-PacketField::Type EnumField::GetFieldType() const {
-  return PacketField::Type::ENUM;
-}
-
-Size EnumField::GetSize() const {
-  return enum_def_.size_;
-}
-
-std::string EnumField::GetType() const {
+std::string EnumField::GetDataType() const {
   return enum_def_.name_;
 }
 
-void EnumField::GenGetter(std::ostream& s, Size start_offset, Size end_offset) const {
-  s << GetType();
-  s << " Get" << util::UnderscoreToCamelCase(GetName()) << "() const {";
-  s << "ASSERT(was_validated_);";
-
-  // Write the Getter Function Body
-  int num_leading_bits = 0;
-  int field_size = enum_def_.size_;
-
-  // Start from the beginning, if possible.
-  if (!start_offset.empty()) {
-    num_leading_bits = start_offset.bits() % 8;
-    s << "auto it = begin()"
-      << " + " << start_offset.bytes() << " + (" << start_offset.dynamic_string() << ");";
-  } else if (!end_offset.empty()) {
-    int offset_from_end = end_offset.bits() + field_size;
-    num_leading_bits = 8 - (offset_from_end % 8);
-    int byte_offset = (7 + offset_from_end) / 8;
-    s << "auto it = end() - " << byte_offset << " - (" << end_offset.dynamic_string() << ");";
-  } else {
-    ERROR(this) << "Ambiguous offset for field.";
-  }
-
-  // We don't need any masking, just return the extracted value.
-  if (num_leading_bits == 0 && util::RoundSizeUp(field_size) == field_size) {
-    s << "return it.extract<" << GetType() << ">();";
-    s << "}\n";
-    return;
-  }
-
-  // Extract the correct number of bytes. The return type could be different
-  // from the extract type if an earlier field causes the beginning of the
-  // current field to start in the middle of a byte.
-  std::string extract_type = util::GetTypeForSize(field_size + num_leading_bits);
-  s << "auto value = it.extract<" << extract_type << ">();";
-
-  // Right shift the result if necessary.
-  int shift_amount = num_leading_bits;
-  if (shift_amount != 0) {
-    s << "value >>= " << shift_amount << ";";
-  }
-
-  // Mask the result if necessary.
-  if (util::RoundSizeUp(field_size) != field_size) {
-    uint64_t mask = 0;
-    for (int i = 0; i < field_size; i++) {
-      mask <<= 1;
-      mask |= 1;
-    }
-    s << "value &= 0x" << std::hex << mask << std::dec << ";";
-  }
-
-  s << "return static_cast<" << GetType() << ">(value);";
-  s << "}\n";
-}
-
-bool EnumField::GenBuilderParameter(std::ostream& s) const {
-  s << GetType() << " " << GetName();
-  return true;
-}
-
 bool EnumField::HasParameterValidator() const {
   return false;
 }
diff --git a/gd/packet/parser/fields/enum_field.h b/gd/packet/parser/fields/enum_field.h
index 2ab77f1..11c64e0 100644
--- a/gd/packet/parser/fields/enum_field.h
+++ b/gd/packet/parser/fields/enum_field.h
@@ -18,23 +18,20 @@
 
 #include "enum_def.h"
 #include "fields/packet_field.h"
+#include "fields/scalar_field.h"
 #include "parse_location.h"
 
-class EnumField : public PacketField {
+class EnumField : public ScalarField {
  public:
   EnumField(std::string name, EnumDef enum_def, std::string value, ParseLocation loc);
 
   EnumDef GetEnumDef();
 
-  virtual PacketField::Type GetFieldType() const override;
+  static const std::string kFieldType;
 
-  virtual Size GetSize() const override;
+  virtual const std::string& GetFieldType() const override;
 
-  virtual std::string GetType() const override;
-
-  virtual void GenGetter(std::ostream& s, Size start_offset, Size end_offset) const override;
-
-  virtual bool GenBuilderParameter(std::ostream& s) const override;
+  virtual std::string GetDataType() const override;
 
   virtual bool HasParameterValidator() const override;
 
diff --git a/gd/packet/parser/fields/fixed_enum_field.cc b/gd/packet/parser/fields/fixed_enum_field.cc
new file mode 100644
index 0000000..0cc35c0
--- /dev/null
+++ b/gd/packet/parser/fields/fixed_enum_field.cc
@@ -0,0 +1,35 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "fields/fixed_enum_field.h"
+#include "util.h"
+
+const std::string FixedEnumField::kFieldType = "FixedEnumField";
+
+FixedEnumField::FixedEnumField(EnumDef* enum_def, std::string value, ParseLocation loc)
+    : FixedField("fixed_enum", enum_def->size_, loc), enum_(enum_def), value_(value) {}
+
+const std::string& FixedEnumField::GetFieldType() const {
+  return FixedEnumField::kFieldType;
+}
+
+std::string FixedEnumField::GetDataType() const {
+  return enum_->name_;
+}
+
+void FixedEnumField::GenValue(std::ostream& s) const {
+  s << enum_->name_ << "::" << value_;
+}
diff --git a/gd/packet/parser/fields/fixed_enum_field.h b/gd/packet/parser/fields/fixed_enum_field.h
new file mode 100644
index 0000000..2c6c3f3
--- /dev/null
+++ b/gd/packet/parser/fields/fixed_enum_field.h
@@ -0,0 +1,43 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#pragma once
+
+#include <variant>
+
+#include "enum_def.h"
+#include "fields/fixed_field.h"
+#include "fields/packet_field.h"
+#include "parse_location.h"
+
+class FixedEnumField : public FixedField {
+ public:
+  FixedEnumField(EnumDef* enum_def, std::string value, ParseLocation loc);
+
+  static const std::string kFieldType;
+
+  virtual const std::string& GetFieldType() const override;
+
+  virtual std::string GetDataType() const override;
+
+  static const std::string field_type;
+
+ private:
+  void GenValue(std::ostream& s) const;
+
+  EnumDef* enum_;
+  std::string value_;
+};
diff --git a/gd/packet/parser/fields/fixed_field.cc b/gd/packet/parser/fields/fixed_field.cc
index 6b53992..c728797 100644
--- a/gd/packet/parser/fields/fixed_field.cc
+++ b/gd/packet/parser/fields/fixed_field.cc
@@ -19,93 +19,13 @@
 
 int FixedField::unique_id_ = 0;
 
-FixedField::FixedField(int size, int64_t value, ParseLocation loc)
-    : PacketField(loc, "fixed_scalar" + std::to_string(unique_id_++)), type_(Type::FIXED_SCALAR), size_(size),
-      value_(value) {}
-
-FixedField::FixedField(EnumDef* enum_def, std::string value, ParseLocation loc)
-    : PacketField(loc, "fixed_scalar" + std::to_string(unique_id_++)), type_(Type::FIXED_ENUM), enum_(enum_def),
-      value_(value) {}
-
-PacketField::Type FixedField::GetFieldType() const {
-  return type_;
-}
-
-Size FixedField::GetSize() const {
-  if (type_ == PacketField::Type::FIXED_SCALAR) {
-    return size_;
-  }
-
-  return enum_->size_;
-}
-
-std::string FixedField::GetType() const {
-  if (type_ == PacketField::Type::FIXED_SCALAR) {
-    return util::GetTypeForSize(size_);
-  }
-
-  return enum_->name_;
-}
+FixedField::FixedField(std::string name, int size, ParseLocation loc)
+    : ScalarField(name + std::to_string(unique_id_++), size, loc) {}
 
 void FixedField::GenGetter(std::ostream& s, Size start_offset, Size end_offset) const {
-  s << GetType();
-  s << " Get" << util::UnderscoreToCamelCase(GetName()) << "() const {";
-  s << "ASSERT(was_validated_);";
-
-  // Write the Getter Function Body
-  int num_leading_bits = 0;
-  int field_size = GetSize().bits();
-
-  // Handle if to start the iterator at begin or end.
-  if (!start_offset.empty()) {
-    // Default to start if available.
-    num_leading_bits = start_offset.bits() % 8;
-    s << "auto it = begin() + " << start_offset.bytes() << " + (" << start_offset.dynamic_string() << ");";
-  } else if (!end_offset.empty()) {
-    int offset_from_end = end_offset.bits() + field_size;
-    num_leading_bits = 8 - (offset_from_end % 8);
-    // Add 7 so it rounds up
-    int byte_offset = (7 + offset_from_end) / 8;
-    s << "auto it = end() - " << byte_offset << " - (" << end_offset.dynamic_string() << ");";
-  } else {
-    ERROR(this) << "Ambiguous offset for field.\n";
-  }
-
-  // We don't need any masking, just return the extracted value.
-  if (num_leading_bits == 0 && util::RoundSizeUp(field_size) == field_size) {
-    s << "return it.extract<" << GetType() << ">();";
-    s << "}\n";
-    return;
-  }
-
-  // Extract the correct number of bytes. The return type could be different
-  // from the extract type if an earlier field causes the beginning of the
-  // current field to start in the middle of a byte.
-  std::string extract_type = util::GetTypeForSize(field_size + num_leading_bits);
-  s << "auto value = it.extract<" << extract_type << ">();";
-
-  // Right shift to remove leading bits.
-  if (num_leading_bits != 0) {
-    s << "value >>= " << num_leading_bits << ";";
-  }
-
-  // Mask the result if necessary.
-  if (util::RoundSizeUp(field_size) != field_size) {
-    uint64_t mask = 0;
-    for (int i = 0; i < field_size; i++) {
-      mask <<= 1;
-      mask |= 1;
-    }
-    s << "value &= 0x" << std::hex << mask << std::dec << ";";
-  }
-
-  // Cast the result if necessary.
-  if (extract_type != GetType()) {
-    s << "return static_cast<" << GetType() << ">(value);";
-  } else {
-    s << "return value;";
-  }
-  s << "}\n";
+  s << "protected:";
+  ScalarField::GenGetter(s, start_offset, end_offset);
+  s << "public:\n";
 }
 
 bool FixedField::GenBuilderParameter(std::ostream&) const {
@@ -123,13 +43,7 @@
 
 void FixedField::GenInserter(std::ostream& s) const {
   s << "insert(";
-  if (type_ == PacketField::Type::FIXED_SCALAR) {
-    GenValue(s);
-  } else {
-    s << "static_cast<" << util::GetTypeForSize(GetSize().bits()) << ">(";
-    GenValue(s);
-    s << ")";
-  }
+  GenValue(s);
   s << ", i , " << GetSize().bits() << ");";
 }
 
@@ -138,11 +52,3 @@
   GenValue(s);
   s << ") return false;";
 }
-
-void FixedField::GenValue(std::ostream& s) const {
-  if (type_ == PacketField::Type::FIXED_SCALAR) {
-    s << std::get<int64_t>(value_);
-  } else {
-    s << enum_->name_ << "::" << std::get<std::string>(value_);
-  }
-}
diff --git a/gd/packet/parser/fields/fixed_field.h b/gd/packet/parser/fields/fixed_field.h
index f91e50c..41ffa0f 100644
--- a/gd/packet/parser/fields/fixed_field.h
+++ b/gd/packet/parser/fields/fixed_field.h
@@ -20,19 +20,16 @@
 
 #include "enum_def.h"
 #include "fields/packet_field.h"
+#include "fields/scalar_field.h"
 #include "parse_location.h"
 
-class FixedField : public PacketField {
+class FixedField : public ScalarField {
  public:
-  FixedField(int size, int64_t value, ParseLocation loc);
+  FixedField(std::string name, int size, ParseLocation loc);
 
-  FixedField(EnumDef* enum_def, std::string value, ParseLocation loc);
+  static const std::string kFieldType;
 
-  virtual PacketField::Type GetFieldType() const override;
-
-  virtual Size GetSize() const override;
-
-  virtual std::string GetType() const override;
+  virtual std::string GetDataType() const override = 0;
 
   virtual void GenGetter(std::ostream& s, Size start_offset, Size end_offset) const override;
 
@@ -47,12 +44,7 @@
   virtual void GenValidator(std::ostream& s) const override;
 
  private:
-  void GenValue(std::ostream& s) const;
-
-  PacketField::Type type_;
-  int size_;
-  EnumDef* enum_;
-  std::variant<int64_t, std::string> value_;
+  virtual void GenValue(std::ostream& s) const = 0;
 
   static int unique_id_;
 };
diff --git a/gd/packet/parser/fields/fixed_scalar_field.cc b/gd/packet/parser/fields/fixed_scalar_field.cc
new file mode 100644
index 0000000..9bfdf0e
--- /dev/null
+++ b/gd/packet/parser/fields/fixed_scalar_field.cc
@@ -0,0 +1,35 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "fields/fixed_scalar_field.h"
+#include "util.h"
+
+const std::string FixedScalarField::kFieldType = "FixedScalarField";
+
+FixedScalarField::FixedScalarField(int size, int64_t value, ParseLocation loc)
+    : FixedField("fixed_scalar", size, loc), value_(value) {}
+
+const std::string& FixedScalarField::GetFieldType() const {
+  return FixedScalarField::kFieldType;
+}
+
+std::string FixedScalarField::GetDataType() const {
+  return util::GetTypeForSize(GetSize().bits());
+}
+
+void FixedScalarField::GenValue(std::ostream& s) const {
+  s << value_;
+}
diff --git a/gd/packet/parser/fields/fixed_scalar_field.h b/gd/packet/parser/fields/fixed_scalar_field.h
new file mode 100644
index 0000000..0070f6c
--- /dev/null
+++ b/gd/packet/parser/fields/fixed_scalar_field.h
@@ -0,0 +1,42 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#pragma once
+
+#include <variant>
+
+#include "enum_def.h"
+#include "fields/fixed_field.h"
+#include "fields/packet_field.h"
+#include "parse_location.h"
+
+class FixedScalarField : public FixedField {
+ public:
+  FixedScalarField(int size, int64_t value, ParseLocation loc);
+
+  static const std::string kFieldType;
+
+  virtual const std::string& GetFieldType() const override;
+
+  virtual std::string GetDataType() const override;
+
+  static const std::string field_type;
+
+ private:
+  void GenValue(std::ostream& s) const;
+
+  const int64_t value_;
+};
diff --git a/gd/packet/parser/fields/group_field.cc b/gd/packet/parser/fields/group_field.cc
index 7e4caba..95e6428 100644
--- a/gd/packet/parser/fields/group_field.cc
+++ b/gd/packet/parser/fields/group_field.cc
@@ -17,31 +17,37 @@
 #include "fields/group_field.h"
 
 GroupField::GroupField(ParseLocation loc, std::list<PacketField*>* fields)
-    : PacketField(loc, "Groups have no name"), fields_(fields) {}
+    : PacketField("Groups have no name", loc), fields_(fields) {}
 
 GroupField::~GroupField() {
   delete fields_;
 }
 
-PacketField::Type GroupField::GetFieldType() const {
-  return PacketField::Type::GROUP;
-}
+const std::string GroupField::kFieldType = "GroupField";
 
 std::string GroupField::GetName() const {
   ERROR(this) << "GetName should never be called.";
   return "";
 }
 
+const std::string& GroupField::GetFieldType() const {
+  return GroupField::kFieldType;
+}
+
 Size GroupField::GetSize() const {
   ERROR(this) << "GetSize should never be called.";
   return Size();
 }
 
-std::string GroupField::GetType() const {
+std::string GroupField::GetDataType() const {
   ERROR(this) << "GetType should never be called.";
   return "";
 }
 
+void GroupField::GenExtractor(std::ostream&, int, bool) const {
+  ERROR(this) << "GenExtractor should never be called.";
+}
+
 void GroupField::GenGetter(std::ostream&, Size, Size) const {
   ERROR(this) << "GenGetter should never be called.";
 }
diff --git a/gd/packet/parser/fields/group_field.h b/gd/packet/parser/fields/group_field.h
index 73e7e35..b5344a7 100644
--- a/gd/packet/parser/fields/group_field.h
+++ b/gd/packet/parser/fields/group_field.h
@@ -27,13 +27,17 @@
 
   ~GroupField();
 
-  virtual PacketField::Type GetFieldType() const override;
-
   virtual std::string GetName() const override;
 
+  static const std::string kFieldType;
+
+  virtual const std::string& GetFieldType() const override;
+
   virtual Size GetSize() const override;
 
-  virtual std::string GetType() const override;
+  virtual std::string GetDataType() const override;
+
+  virtual void GenExtractor(std::ostream& s, int num_leading_bits, bool for_struct) const override;
 
   virtual void GenGetter(std::ostream&, Size, Size) const override;
 
diff --git a/gd/packet/parser/fields/packet_field.cc b/gd/packet/parser/fields/packet_field.cc
index 677ebfe..026e56f 100644
--- a/gd/packet/parser/fields/packet_field.cc
+++ b/gd/packet/parser/fields/packet_field.cc
@@ -16,50 +16,12 @@
 
 #include "fields/packet_field.h"
 
-PacketField::PacketField(ParseLocation loc, std::string name) : loc_(loc), name_(name) {}
+#include "util.h"
+
+PacketField::PacketField(std::string name, ParseLocation loc) : loc_(loc), name_(name) {}
 
 std::string PacketField::GetDebugName() const {
-  std::string ret = "";
-  switch (GetFieldType()) {
-    case Type::GROUP:
-      ret = "GROUP";
-      break;
-    case Type::FIXED_SCALAR:
-      ret = "FIXED SCALAR";
-      break;
-    case Type::FIXED_ENUM:
-      ret = "FIXED ENUM";
-      break;
-    case Type::RESERVED_SCALAR:
-      ret = "RESERVED SCALAR";
-      break;
-    case Type::SCALAR:
-      ret = "SCALAR";
-      break;
-    case Type::ENUM:
-      ret = "ENUM";
-      break;
-    case Type::SIZE:
-      ret = "SIZE";
-      break;
-    case Type::COUNT:
-      ret = "COUNT";
-      break;
-    case Type::BODY:
-      ret = "BODY";
-      break;
-    case Type::PAYLOAD:
-      ret = "PAYLOAD";
-      break;
-    case Type::CUSTOM:
-      ret = "CUSTOM";
-      break;
-    default:
-      std::cerr << "UNKNOWN DEBUG NAME TYPE\n";
-      abort();
-  }
-
-  return "Field{Type:" + ret + ", Name:" + GetName() + "}";
+  return "Field{Type:" + GetFieldType() + ", Name:" + GetName() + "}";
 }
 
 ParseLocation PacketField::GetLocation() const {
@@ -69,3 +31,55 @@
 std::string PacketField::GetName() const {
   return name_;
 }
+
+Size PacketField::GetBuilderSize() const {
+  return GetSize();
+}
+
+Size PacketField::GetStructSize() const {
+  return GetSize();
+}
+
+int PacketField::GenBounds(std::ostream& s, Size start_offset, Size end_offset, Size size) const {
+  // In order to find field_begin and field_end, we must have two of the three Sizes.
+  if ((start_offset.empty() && size.empty()) || (start_offset.empty() && end_offset.empty()) ||
+      (end_offset.empty() && size.empty())) {
+    ERROR(this) << "GenBounds called without enough information. " << start_offset << end_offset << size;
+  }
+
+  if (start_offset.bits() % 8 != 0 || end_offset.bits() % 8 != 0) {
+    ERROR(this) << "Can not find the bounds of a field at a non byte-aligned offset." << start_offset << end_offset;
+  }
+
+  if (!start_offset.empty()) {
+    s << "size_t field_begin = (" << start_offset << ") / 8;";
+  } else {
+    s << "size_t field_begin = end_index - (" << end_offset << " + " << size << ") / 8;";
+  }
+
+  if (!end_offset.empty()) {
+    s << "size_t field_end = end_index - (" << end_offset << ") / 8;";
+    // If the field has a known size, use the minimum for the end
+    if (!size.empty()) {
+      s << "size_t field_sized_end = field_begin + (" << size << ") / 8;";
+      s << "if (field_sized_end < field_end) { field_end = field_sized_end; }";
+    }
+  } else {
+    s << "size_t field_end = field_begin + (" << size << ") / 8;";
+    s << "if (field_end > end_index) { field_end = end_index; }";
+  }
+  s << "auto " << name_ << "_it = to_bound.Subrange(field_begin, field_end - field_begin); ";
+  return 0;  // num_leading_bits
+}
+
+bool PacketField::BuilderParameterMustBeMoved() const {
+  return false;
+}
+
+bool PacketField::GenBuilderMember(std::ostream& s) const {
+  return GenBuilderParameter(s);
+}
+
+void PacketField::GenBuilderParameterFromView(std::ostream& s) const {
+  s << "view.Get" << util::UnderscoreToCamelCase(GetName()) << "()";
+}
diff --git a/gd/packet/parser/fields/packet_field.h b/gd/packet/parser/fields/packet_field.h
index 5f78c69..55313e6 100644
--- a/gd/packet/parser/fields/packet_field.h
+++ b/gd/packet/parser/fields/packet_field.h
@@ -28,34 +28,31 @@
  public:
   virtual ~PacketField() = default;
 
-  PacketField(ParseLocation loc, std::string name);
+  PacketField(std::string name, ParseLocation loc);
 
-  enum class Type {
-    GROUP,
-    FIXED_SCALAR,
-    FIXED_ENUM,
-    RESERVED_SCALAR,
-    SCALAR,
-    ENUM,
-    SIZE,
-    COUNT,
-    BODY,
-    PAYLOAD,
-    CUSTOM,
-    CHECKSUM,
-    CHECKSUM_START,
-  };
+  // Get the type for this field.
+  virtual const std::string& GetFieldType() const = 0;
 
-  // Get the field type for the field.
-  virtual Type GetFieldType() const = 0;
-
-  // Returns the size of the field in bits and a string that evaluates into
-  // bytes for dynamically sized arrays.
+  // Returns the size of the field in bits.
   virtual Size GetSize() const = 0;
 
+  // Returns the size of the field in bits given the information in the builder.
+  // For most field types, this will be the same as GetSize();
+  virtual Size GetBuilderSize() const;
+
+  // Returns the size of the field in bits given the information in the parsed struct.
+  // For most field types, this will be the same as GetSize();
+  virtual Size GetStructSize() const;
+
   // Get the type of the field to be used in the builders constructor and
   // variables.
-  virtual std::string GetType() const = 0;
+  virtual std::string GetDataType() const = 0;
+
+  // Given an iterator {name}_it, extract the type.
+  virtual void GenExtractor(std::ostream& s, int num_leading_bits, bool for_struct) const = 0;
+
+  // Calculate field_begin and field_end using the given offsets and size, return the number of leading bits
+  virtual int GenBounds(std::ostream& s, Size start_offset, Size end_offset, Size size) const;
 
   // Get parser getter definition. Start_offset points to the first bit of the
   // field. end_offset is the first bit after the field. If an offset is empty
@@ -66,6 +63,15 @@
   // Generate the parameter for Create(), return true if a parameter was added.
   virtual bool GenBuilderParameter(std::ostream& s) const = 0;
 
+  // Return true if the Builder parameter has to be moved.
+  virtual bool BuilderParameterMustBeMoved() const;
+
+  // Generate the actual storage for the parameter, return true if it was added.
+  virtual bool GenBuilderMember(std::ostream& s) const;
+
+  // Helper for reflection tests.
+  virtual void GenBuilderParameterFromView(std::ostream& s) const;
+
   // Returns whether or not the field must be validated.
   virtual bool HasParameterValidator() const = 0;
 
diff --git a/gd/packet/parser/fields/padding_field.cc b/gd/packet/parser/fields/padding_field.cc
new file mode 100644
index 0000000..0ae99c9
--- /dev/null
+++ b/gd/packet/parser/fields/padding_field.cc
@@ -0,0 +1,59 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "fields/padding_field.h"
+#include "util.h"
+
+const std::string PaddingField::kFieldType = "PaddingField";
+
+PaddingField::PaddingField(int size, ParseLocation loc)
+    : PacketField("padding_" + std::to_string(size * 8), loc), size_(size * 8) {}
+
+const std::string& PaddingField::GetFieldType() const {
+  return PaddingField::kFieldType;
+}
+
+Size PaddingField::GetSize() const {
+  return size_;
+}
+
+Size PaddingField::GetBuilderSize() const {
+  return 0;
+}
+
+std::string PaddingField::GetDataType() const {
+  return "There's no type for Padding fields";
+}
+
+void PaddingField::GenExtractor(std::ostream&, int, bool) const {}
+
+void PaddingField::GenGetter(std::ostream&, Size, Size) const {}
+
+bool PaddingField::GenBuilderParameter(std::ostream&) const {
+  return false;
+}
+
+bool PaddingField::HasParameterValidator() const {
+  return false;
+}
+
+void PaddingField::GenParameterValidator(std::ostream&) const {}
+
+void PaddingField::GenInserter(std::ostream&) const {
+  ERROR(this) << __func__ << ": This should not be called for padding fields";
+}
+
+void PaddingField::GenValidator(std::ostream&) const {}
diff --git a/gd/packet/parser/fields/padding_field.h b/gd/packet/parser/fields/padding_field.h
new file mode 100644
index 0000000..5c22c1a
--- /dev/null
+++ b/gd/packet/parser/fields/padding_field.h
@@ -0,0 +1,54 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#pragma once
+
+#include "fields/packet_field.h"
+#include "parse_location.h"
+
+class PaddingField : public PacketField {
+ public:
+  PaddingField(int size, ParseLocation loc);
+
+  static const std::string kFieldType;
+
+  std::string GetField() const;
+
+  virtual const std::string& GetFieldType() const override;
+
+  virtual Size GetSize() const override;
+
+  virtual Size GetBuilderSize() const override;
+
+  virtual std::string GetDataType() const override;
+
+  virtual void GenExtractor(std::ostream& s, int num_leading_bits, bool for_struct) const override;
+
+  virtual void GenGetter(std::ostream& s, Size start_offset, Size end_offset) const override;
+
+  virtual bool GenBuilderParameter(std::ostream&) const override;
+
+  virtual bool HasParameterValidator() const override;
+
+  virtual void GenParameterValidator(std::ostream&) const override;
+
+  virtual void GenInserter(std::ostream&) const override;
+
+  virtual void GenValidator(std::ostream&) const override;
+
+ private:
+  Size size_;
+};
diff --git a/gd/packet/parser/fields/payload_field.cc b/gd/packet/parser/fields/payload_field.cc
index b14085c..a13a6de 100644
--- a/gd/packet/parser/fields/payload_field.cc
+++ b/gd/packet/parser/fields/payload_field.cc
@@ -17,92 +17,62 @@
 #include "fields/payload_field.h"
 #include "util.h"
 
+const std::string PayloadField::kFieldType = "PayloadField";
+
 PayloadField::PayloadField(std::string modifier, ParseLocation loc)
-    : PacketField(loc, "payload"), size_field_(nullptr), size_modifier_(modifier) {}
+    : PacketField("payload", loc), size_field_(nullptr), size_modifier_(modifier) {}
 
 void PayloadField::SetSizeField(const SizeField* size_field) {
   if (size_field_ != nullptr) {
     ERROR(this, size_field_, size_field) << "The size field for the payload has already been assigned.";
   }
 
-  if (size_field->GetFieldType() == PacketField::Type::COUNT) {
-    ERROR(this, size_field) << "Can not use count field to describe a payload.";
-  }
-
   size_field_ = size_field;
 }
 
-PacketField::Type PayloadField::GetFieldType() const {
-  return PacketField::Type::PAYLOAD;
+const std::string& PayloadField::GetFieldType() const {
+  return PayloadField::kFieldType;
 }
 
 Size PayloadField::GetSize() const {
   if (size_field_ == nullptr) {
-    // Require a size field if there is a modifier.
     if (!size_modifier_.empty()) {
       ERROR(this) << "Missing size field for payload with size modifier.";
     }
-
     return Size();
   }
 
-  std::string dynamic_size = "Get" + util::UnderscoreToCamelCase(size_field_->GetName()) + "()";
+  std::string dynamic_size = "(Get" + util::UnderscoreToCamelCase(size_field_->GetName()) + "() * 8)";
   if (!size_modifier_.empty()) {
-    dynamic_size += "- (" + size_modifier_ + ") / 8";
+    dynamic_size += "- (" + size_modifier_ + ")";
   }
 
   return dynamic_size;
 }
 
-std::string PayloadField::GetType() const {
+std::string PayloadField::GetDataType() const {
   return "PacketView";
 }
 
+void PayloadField::GenExtractor(std::ostream&, int, bool) const {
+  ERROR(this) << __func__ << " should never be called. ";
+}
+
 void PayloadField::GenGetter(std::ostream& s, Size start_offset, Size end_offset) const {
-  if (start_offset.empty()) {
-    ERROR(this) << "Can not have a payload that has an ambiguous start offset. "
-                << "Is there a field with an unknown length before the "
-                << "payload?\n";
-  }
-
-  if (start_offset.bits() % 8 != 0 && !GetSize().empty()) {
-    ERROR(this) << "Can not have a sized payload field "
-                << "at a non byte-aligned offset.\n";
-  }
-
-  if (GetSize().empty() && end_offset.empty()) {
-    ERROR(this) << "Ambiguous end offset for payload with no defined size.";
-  }
-
-  s << "PacketView<kLittleEndian> GetPayload() {";
+  s << "PacketView<kLittleEndian> GetPayload() const {";
   s << "ASSERT(was_validated_);";
-
-  s << "size_t payload_begin = " << start_offset.bits() / 8 << " + (" << start_offset.dynamic_string() << ");";
-
-  // If the payload is sized, use the size + payload_begin for payload_end, otherwise use the end_offset.
-  if (!GetSize().empty()) {
-    // If the size isn't empty then it must have a dynamic string only.
-    s << "size_t payload_end = payload_begin + (" << GetSize().dynamic_string() << ");";
-  } else {
-    s << "size_t payload_end = size() - " << end_offset.bits() / 8 << " - (" << end_offset.dynamic_string() << ");";
-  }
-
-  s << "return GetLittleEndianSubview(payload_begin, payload_end);";
+  s << "size_t end_index = size();";
+  s << "auto to_bound = begin();";
+  GenBounds(s, start_offset, end_offset, GetSize());
+  s << "return GetLittleEndianSubview(field_begin, field_end);";
   s << "}\n\n";
 
-  s << "PacketView<!kLittleEndian> GetPayloadBigEndian() {";
-
-  s << "size_t payload_begin = " << start_offset.bits() / 8 << " + (" << start_offset.dynamic_string() << ");";
-
-  // If the payload is sized, use the size + payload_begin for payload_end, otherwise use the end_offset.
-  if (!GetSize().empty()) {
-    // If the size isn't empty then it must have a dynamic string only.
-    s << "size_t payload_end = payload_begin + (" << GetSize().dynamic_string() << ");";
-  } else {
-    s << "size_t payload_end = size() - " << end_offset.bits() / 8 << " - (" << end_offset.dynamic_string() << ");";
-  }
-
-  s << "return GetBigEndianSubview(payload_begin, payload_end);";
+  s << "PacketView<!kLittleEndian> GetPayloadBigEndian() const {";
+  s << "ASSERT(was_validated_);";
+  s << "size_t end_index = size();";
+  s << "auto to_bound = begin();";
+  GenBounds(s, start_offset, end_offset, GetSize());
+  s << "return GetBigEndianSubview(field_begin, field_end);";
   s << "}\n";
 }
 
@@ -111,6 +81,10 @@
   return true;
 }
 
+void PayloadField::GenBuilderParameterFromView(std::ostream& s) const {
+  s << "std::make_unique<RawBuilder>(std::vector<uint8_t>(view.GetPayload().begin(), view.GetPayload().end()))";
+}
+
 bool PayloadField::HasParameterValidator() const {
   return false;
 }
diff --git a/gd/packet/parser/fields/payload_field.h b/gd/packet/parser/fields/payload_field.h
index 8787b41..12cec07 100644
--- a/gd/packet/parser/fields/payload_field.h
+++ b/gd/packet/parser/fields/payload_field.h
@@ -24,18 +24,24 @@
  public:
   PayloadField(std::string modifier, ParseLocation loc);
 
-  void SetSizeField(const SizeField* size_field);
+  static const std::string kFieldType;
 
-  virtual PacketField::Type GetFieldType() const override;
+  virtual const std::string& GetFieldType() const override;
+
+  void SetSizeField(const SizeField* size_field);
 
   virtual Size GetSize() const override;
 
-  virtual std::string GetType() const override;
+  virtual std::string GetDataType() const override;
+
+  virtual void GenExtractor(std::ostream& s, int num_leading_bits, bool for_struct) const override;
 
   virtual void GenGetter(std::ostream& s, Size start_offset, Size end_offset) const override;
 
   virtual bool GenBuilderParameter(std::ostream& s) const override;
 
+  virtual void GenBuilderParameterFromView(std::ostream& s) const override;
+
   virtual bool HasParameterValidator() const override;
 
   virtual void GenParameterValidator(std::ostream&) const override;
diff --git a/gd/packet/parser/fields/reserved_field.cc b/gd/packet/parser/fields/reserved_field.cc
index 3db1527..b0a62f1 100644
--- a/gd/packet/parser/fields/reserved_field.cc
+++ b/gd/packet/parser/fields/reserved_field.cc
@@ -19,22 +19,25 @@
 
 int ReservedField::unique_id_ = 0;
 
-ReservedField::ReservedField(int size, ParseLocation loc)
-    : PacketField(loc, "ReservedScalar" + std::to_string(unique_id_++)), type_(PacketField::Type::RESERVED_SCALAR),
-      size_(size) {}
+const std::string ReservedField::kFieldType = "ReservedField";
 
-PacketField::Type ReservedField::GetFieldType() const {
-  return type_;
+ReservedField::ReservedField(int size, ParseLocation loc)
+    : PacketField("ReservedScalar" + std::to_string(unique_id_++), loc), size_(size) {}
+
+const std::string& ReservedField::GetFieldType() const {
+  return ReservedField::kFieldType;
 }
 
 Size ReservedField::GetSize() const {
   return size_;
 }
 
-std::string ReservedField::GetType() const {
+std::string ReservedField::GetDataType() const {
   return util::GetTypeForSize(size_);
 }
 
+void ReservedField::GenExtractor(std::ostream&, int, bool) const {}
+
 void ReservedField::GenGetter(std::ostream&, Size, Size) const {
   // There is no Getter for a reserved field
 }
diff --git a/gd/packet/parser/fields/reserved_field.h b/gd/packet/parser/fields/reserved_field.h
index 46f7f7b..b2df0f1 100644
--- a/gd/packet/parser/fields/reserved_field.h
+++ b/gd/packet/parser/fields/reserved_field.h
@@ -23,11 +23,15 @@
  public:
   ReservedField(int size, ParseLocation loc);
 
-  virtual PacketField::Type GetFieldType() const override;
+  static const std::string kFieldType;
+
+  virtual const std::string& GetFieldType() const override;
 
   virtual Size GetSize() const override;
 
-  virtual std::string GetType() const override;
+  virtual std::string GetDataType() const override;
+
+  virtual void GenExtractor(std::ostream& s, int num_leading_bits, bool for_struct) const override;
 
   virtual void GenGetter(std::ostream&, Size, Size) const override;
 
@@ -42,7 +46,6 @@
   virtual void GenValidator(std::ostream&) const override;
 
  private:
-  PacketField::Type type_;
   std::string name_;
   int size_;
   static int unique_id_;
diff --git a/gd/packet/parser/fields/scalar_field.cc b/gd/packet/parser/fields/scalar_field.cc
index 91907b2..47b1a43 100644
--- a/gd/packet/parser/fields/scalar_field.cc
+++ b/gd/packet/parser/fields/scalar_field.cc
@@ -15,109 +15,103 @@
  */
 
 #include "fields/scalar_field.h"
+
 #include "util.h"
 
-ScalarField::ScalarField(std::string name, int size, ParseLocation loc) : PacketField(loc, name), size_(size) {}
+const std::string ScalarField::kFieldType = "ScalarField";
 
-PacketField::Type ScalarField::GetFieldType() const {
-  return PacketField::Type::SCALAR;
+ScalarField::ScalarField(std::string name, int size, ParseLocation loc) : PacketField(name, loc), size_(size) {
+  if (size_ > 64 || size_ < 0) {
+    ERROR(this) << "Not implemented for size_ = " << size_;
+  }
+}
+
+const std::string& ScalarField::GetFieldType() const {
+  return ScalarField::kFieldType;
 }
 
 Size ScalarField::GetSize() const {
   return size_;
 }
 
-std::string ScalarField::GetType() const {
+std::string ScalarField::GetDataType() const {
   return util::GetTypeForSize(size_);
 }
 
-void ScalarField::GenGetter(std::ostream& s, Size start_offset, Size end_offset) const {
-  s << GetType();
-  s << " Get" << util::UnderscoreToCamelCase(GetName()) << "() const {";
-  s << "ASSERT(was_validated_);";
+int GetShiftBits(int i) {
+  int bits_past_byte_boundary = i % 8;
+  if (bits_past_byte_boundary == 0) {
+    return 0;
+  } else {
+    return 8 - bits_past_byte_boundary;
+  }
+}
 
-  // Write the Getter Function Body
+int ScalarField::GenBounds(std::ostream& s, Size start_offset, Size end_offset, Size size) const {
   int num_leading_bits = 0;
-  int field_size = size_;
 
-  // Handle if to start the iterator at begin or end.
-  s << "auto it = ";
   if (!start_offset.empty()) {
     // Default to start if available.
     num_leading_bits = start_offset.bits() % 8;
-    s << "begin()";
-    if (start_offset.bits() / 8 != 0) s << " + " << start_offset.bits() / 8;
-    if (start_offset.has_dynamic()) s << " + " << start_offset.dynamic_string();
+    s << "auto " << GetName() << "_it = to_bound + (" << start_offset << ") / 8;";
   } else if (!end_offset.empty()) {
-    num_leading_bits = (8 - ((end_offset.bits() + field_size) % 8)) % 8;
-    // Add 7 so it rounds up
-    int byte_offset = (7 + end_offset.bits() + field_size) / 8;
-    s << "end() - " << byte_offset;
-    if (end_offset.has_dynamic()) s << " - (" << end_offset.dynamic_string() << ")";
+    num_leading_bits = GetShiftBits(end_offset.bits() + size.bits());
+    Size byte_offset = Size(num_leading_bits + size.bits()) + end_offset;
+    s << "auto " << GetName() << "_it = to_bound + (to_bound.NumBytesRemaining() - (" << byte_offset << ") / 8);";
   } else {
     ERROR(this) << "Ambiguous offset for field.";
   }
-  s << ";";
+  return num_leading_bits;
+}
 
-  // We don't need any masking, just return the extracted value.
-  if (num_leading_bits == 0 && util::RoundSizeUp(field_size) == field_size) {
-    s << "return it.extract<" << util::GetTypeForSize(field_size) << ">();";
-    s << "}\n";
-    return;
-  }
-
+void ScalarField::GenExtractor(std::ostream& s, int num_leading_bits, bool) const {
+  Size size = GetSize();
   // Extract the correct number of bytes. The return type could be different
   // from the extract type if an earlier field causes the beginning of the
   // current field to start in the middle of a byte.
-  std::string extract_type = util::GetTypeForSize(field_size + num_leading_bits);
-  s << "auto value = it.extract<" << extract_type << ">();";
+  std::string extract_type = util::GetTypeForSize(size.bits() + num_leading_bits);
+  s << "auto extracted_value = " << GetName() << "_it.extract<" << extract_type << ">();";
 
-  // Right shift the result if necessary.
-  int shift_amount = num_leading_bits;
-  if (shift_amount != 0) {
-    s << "value >>= " << shift_amount << ";";
+  // Right shift the result to remove leading bits.
+  if (num_leading_bits != 0) {
+    s << "extracted_value >>= " << num_leading_bits << ";";
   }
-
   // Mask the result if necessary.
-  if (util::RoundSizeUp(field_size) != field_size) {
+  if (util::RoundSizeUp(size.bits()) != size.bits()) {
     uint64_t mask = 0;
-    for (int i = 0; i < field_size; i++) {
+    for (int i = 0; i < size.bits(); i++) {
       mask <<= 1;
       mask |= 1;
     }
-    s << "value &= 0x" << std::hex << mask << std::dec << ";";
+    s << "extracted_value &= 0x" << std::hex << mask << std::dec << ";";
   }
+  s << "*" << GetName() << "_ptr = static_cast<" << GetDataType() << ">(extracted_value);";
+}
 
-  // Cast the result if necessary.
-  if (extract_type != util::GetTypeForSize(field_size)) {
-    s << "return static_cast<" << GetType() << ">(value);";
-  } else {
-    s << "return value;";
-  }
-  s << "}\n";
+void ScalarField::GenGetter(std::ostream& s, Size start_offset, Size end_offset) const {
+  s << GetDataType();
+  s << " Get" << util::UnderscoreToCamelCase(GetName()) << "() const {";
+  s << "ASSERT(was_validated_);";
+  s << "auto to_bound = begin();";
+  int num_leading_bits = GenBounds(s, start_offset, end_offset, GetSize());
+  s << GetDataType() << " " << GetName() << "_value;";
+  s << GetDataType() << "* " << GetName() << "_ptr = &" << GetName() << "_value;";
+  GenExtractor(s, num_leading_bits, false);
+  s << "return " << GetName() << "_value;";
+  s << "}";
 }
 
 bool ScalarField::GenBuilderParameter(std::ostream& s) const {
-  if (size_ > 64 || size_ < 0) {
-    ERROR(this) << "Not implemented";
-  }
-  std::string param_type = util::GetTypeForSize(size_);
-  s << param_type << " " << GetName();
+  s << GetDataType() << " " << GetName();
   return true;
 }
 
 bool ScalarField::HasParameterValidator() const {
-  const auto bits = GetSize().bits();
-  return util::RoundSizeUp(bits) != bits;
+  return util::RoundSizeUp(GetSize().bits()) != GetSize().bits();
 }
 
 void ScalarField::GenParameterValidator(std::ostream& s) const {
-  const auto bits = GetSize().bits();
-  if (util::RoundSizeUp(bits) == bits) {
-    return;
-  }
-  s << "ASSERT(" << GetName() << " < "
-    << "(static_cast<uint64_t>(1) << " << bits << "));";
+  s << "ASSERT(" << GetName() << " < (static_cast<uint64_t>(1) << " << GetSize().bits() << "));";
 }
 
 void ScalarField::GenInserter(std::ostream& s) const {
@@ -131,5 +125,5 @@
 }
 
 void ScalarField::GenValidator(std::ostream&) const {
-  // Do nothing since the fixed size fields will be handled seperatly.
+  // Do nothing
 }
diff --git a/gd/packet/parser/fields/scalar_field.h b/gd/packet/parser/fields/scalar_field.h
index 4e52fd1..480dc28 100644
--- a/gd/packet/parser/fields/scalar_field.h
+++ b/gd/packet/parser/fields/scalar_field.h
@@ -23,11 +23,17 @@
  public:
   ScalarField(std::string name, int size, ParseLocation loc);
 
-  virtual PacketField::Type GetFieldType() const override;
+  static const std::string kFieldType;
+
+  virtual const std::string& GetFieldType() const override;
 
   virtual Size GetSize() const override;
 
-  virtual std::string GetType() const override;
+  virtual std::string GetDataType() const override;
+
+  virtual int GenBounds(std::ostream& s, Size start_offset, Size end_offset, Size size) const override;
+
+  virtual void GenExtractor(std::ostream& s, int num_leading_bits, bool for_struct) const override;
 
   virtual void GenGetter(std::ostream& s, Size start_offset, Size end_offset) const override;
 
@@ -42,5 +48,5 @@
   virtual void GenValidator(std::ostream&) const override;
 
  private:
-  int size_;
+  const int size_;
 };
diff --git a/gd/packet/parser/fields/size_field.cc b/gd/packet/parser/fields/size_field.cc
index bbb6a73..eafb139 100644
--- a/gd/packet/parser/fields/size_field.cc
+++ b/gd/packet/parser/fields/size_field.cc
@@ -17,83 +17,18 @@
 #include "fields/size_field.h"
 #include "util.h"
 
-SizeField::SizeField(std::string name, int size, bool is_count, ParseLocation loc)
-    : PacketField(loc, name + (is_count ? "_count" : "_size")), size_(size), is_count_(is_count),
-      sized_field_name_(name) {}
+const std::string SizeField::kFieldType = "SizeField";
 
-PacketField::Type SizeField::GetFieldType() const {
-  return (is_count_ ? PacketField::Type::COUNT : PacketField::Type::SIZE);
-}
+SizeField::SizeField(std::string name, int size, ParseLocation loc)
+    : ScalarField(name + "_size", size, loc), sized_field_name_(name) {}
 
-Size SizeField::GetSize() const {
-  return size_;
-}
-
-std::string SizeField::GetType() const {
-  return util::GetTypeForSize(size_);
+const std::string& SizeField::GetFieldType() const {
+  return SizeField::kFieldType;
 }
 
 void SizeField::GenGetter(std::ostream& s, Size start_offset, Size end_offset) const {
   s << "protected:";
-  s << GetType();
-  s << " Get" << util::UnderscoreToCamelCase(GetName()) << "() const {";
-  s << "ASSERT(was_validated_);";
-
-  // Write the Getter Function Body
-  int num_leading_bits = 0;
-
-  // Handle if to start the iterator at begin or end.
-  if (!start_offset.empty()) {
-    // Default to start if available.
-    num_leading_bits = start_offset.bits() % 8;
-    s << "auto it = begin() + " << start_offset.bits() / 8 << " + (" << start_offset.dynamic_string() << ");";
-  } else if (!end_offset.empty()) {
-    int offset_from_end = end_offset.bits() + size_;
-    num_leading_bits = 8 - (offset_from_end % 8);
-    // Add 7 so it rounds up
-    int byte_offset = (7 + offset_from_end) / 8;
-    s << "auto it = end() - " << byte_offset << " - (" << end_offset.dynamic_string() << ");";
-
-  } else {
-    ERROR(this) << "Ambiguous offset for field.";
-  }
-
-  // We don't need any masking, just return the extracted value.
-  if (num_leading_bits == 0 && util::RoundSizeUp(size_) == size_) {
-    s << "return it.extract<" << GetType() << ">();";
-    s << "}\n";
-    s << "public:\n";
-    return;
-  }
-
-  // Extract the correct number of bytes. The return type could be different
-  // from the extract type if an earlier field causes the beginning of the
-  // current field to start in the middle of a byte.
-  std::string extract_type = util::GetTypeForSize(size_ + num_leading_bits);
-  s << "auto value = it.extract<" << extract_type << ">();";
-
-  // Right shift the result to remove leading bits.
-  if (num_leading_bits != 0) {
-    s << "value >>= " << num_leading_bits << ";";
-  }
-
-  // Mask the result if necessary.
-  if (util::RoundSizeUp(size_) != size_) {
-    uint64_t mask = 0;
-    for (int i = 0; i < size_; i++) {
-      mask <<= 1;
-      mask |= 1;
-    }
-    s << "value &= 0x" << std::hex << mask << std::dec << ";";
-  }
-
-  // Cast the result if necessary.
-  if (extract_type != util::GetTypeForSize(size_)) {
-    s << "return static_cast<" << GetType() << ">(value);";
-  } else {
-    s << "return value;";
-  }
-  s << "}\n";
+  ScalarField::GenGetter(s, start_offset, end_offset);
   s << "public:\n";
 }
 
diff --git a/gd/packet/parser/fields/size_field.h b/gd/packet/parser/fields/size_field.h
index 61e8666..859be5a 100644
--- a/gd/packet/parser/fields/size_field.h
+++ b/gd/packet/parser/fields/size_field.h
@@ -17,19 +17,18 @@
 #pragma once
 
 #include "fields/packet_field.h"
+#include "fields/scalar_field.h"
 #include "parse_location.h"
 
-class SizeField : public PacketField {
+class SizeField : public ScalarField {
  public:
-  SizeField(std::string name, int size, bool is_count, ParseLocation loc);
+  SizeField(std::string name, int size, ParseLocation loc);
+
+  static const std::string kFieldType;
 
   std::string GetField() const;
 
-  virtual PacketField::Type GetFieldType() const override;
-
-  virtual Size GetSize() const override;
-
-  virtual std::string GetType() const override;
+  virtual const std::string& GetFieldType() const override;
 
   virtual void GenGetter(std::ostream& s, Size start_offset, Size end_offset) const override;
 
@@ -47,6 +46,5 @@
 
  private:
   int size_;
-  bool is_count_;
   std::string sized_field_name_;
 };
diff --git a/gd/packet/parser/fields/struct_field.cc b/gd/packet/parser/fields/struct_field.cc
new file mode 100644
index 0000000..1a37d24
--- /dev/null
+++ b/gd/packet/parser/fields/struct_field.cc
@@ -0,0 +1,80 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "fields/struct_field.h"
+#include "util.h"
+
+const std::string StructField::kFieldType = "StructField";
+
+StructField::StructField(std::string name, std::string type_name, Size size, ParseLocation loc)
+    : PacketField(name, loc), type_name_(type_name), size_(size) {}
+
+const std::string& StructField::GetFieldType() const {
+  return StructField::kFieldType;
+}
+
+Size StructField::GetSize() const {
+  return size_;
+}
+
+Size StructField::GetBuilderSize() const {
+  std::string ret = "(" + GetName() + "_.size() * 8)";
+  return ret;
+}
+
+std::string StructField::GetDataType() const {
+  return type_name_;
+}
+
+void StructField::GenExtractor(std::ostream& s, int, bool) const {
+  s << GetName() << "_it = ";
+  s << GetDataType() << "::Parse(" << GetName() << "_ptr, " << GetName() << "_it);";
+}
+
+void StructField::GenGetter(std::ostream& s, Size start_offset, Size end_offset) const {
+  s << GetDataType() << " Get" << util::UnderscoreToCamelCase(GetName()) << "() const {";
+  s << "ASSERT(was_validated_);";
+  s << "size_t end_index = size();";
+  s << "auto to_bound = begin();";
+  int num_leading_bits = GenBounds(s, start_offset, end_offset, GetSize());
+  s << GetDataType() << " " << GetName() << "_value;";
+  s << GetDataType() << "* " << GetName() << "_ptr = &" << GetName() << "_value;";
+  GenExtractor(s, num_leading_bits, false);
+
+  s << "return " << GetName() << "_value;";
+  s << "}\n";
+}
+
+bool StructField::GenBuilderParameter(std::ostream& s) const {
+  s << GetDataType() << " " << GetName();
+  return true;
+}
+
+bool StructField::HasParameterValidator() const {
+  return false;
+}
+
+void StructField::GenParameterValidator(std::ostream&) const {
+  // Validated at compile time.
+}
+
+void StructField::GenInserter(std::ostream& s) const {
+  s << GetName() << "_.Serialize(i);";
+}
+
+void StructField::GenValidator(std::ostream&) const {
+  // Do nothing
+}
diff --git a/gd/packet/parser/fields/struct_field.h b/gd/packet/parser/fields/struct_field.h
new file mode 100644
index 0000000..7f1d7d0
--- /dev/null
+++ b/gd/packet/parser/fields/struct_field.h
@@ -0,0 +1,55 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#pragma once
+
+#include "fields/packet_field.h"
+#include "parse_location.h"
+
+class StructField : public PacketField {
+ public:
+  StructField(std::string name, std::string type_name, Size size, ParseLocation loc);
+
+  static const std::string kFieldType;
+
+  virtual const std::string& GetFieldType() const override;
+
+  virtual Size GetSize() const override;
+
+  virtual Size GetBuilderSize() const override;
+
+  virtual std::string GetDataType() const override;
+
+  virtual void GenExtractor(std::ostream& s, int num_leading_bits, bool for_struct) const override;
+
+  virtual void GenGetter(std::ostream& s, Size start_offset, Size end_offset) const override;
+
+  virtual bool GenBuilderParameter(std::ostream& s) const override;
+
+  virtual bool HasParameterValidator() const override;
+
+  virtual void GenParameterValidator(std::ostream&) const override;
+
+  virtual void GenInserter(std::ostream& s) const override;
+
+  virtual void GenValidator(std::ostream&) const override;
+
+ private:
+  std::string type_name_;
+
+ public:
+  const Size size_{};
+};
diff --git a/gd/packet/parser/fields/variable_length_struct_field.cc b/gd/packet/parser/fields/variable_length_struct_field.cc
new file mode 100644
index 0000000..c07bc2c
--- /dev/null
+++ b/gd/packet/parser/fields/variable_length_struct_field.cc
@@ -0,0 +1,87 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "fields/variable_length_struct_field.h"
+#include "util.h"
+
+const std::string VariableLengthStructField::kFieldType = "VariableLengthStructField";
+
+VariableLengthStructField::VariableLengthStructField(std::string name, std::string type_name, ParseLocation loc)
+    : PacketField(name, loc), type_name_(type_name) {}
+
+const std::string& VariableLengthStructField::GetFieldType() const {
+  return VariableLengthStructField::kFieldType;
+}
+
+Size VariableLengthStructField::GetSize() const {
+  return Size();
+}
+
+Size VariableLengthStructField::GetBuilderSize() const {
+  std::string ret = "(" + GetName() + "_->size() * 8) ";
+  return ret;
+}
+
+std::string VariableLengthStructField::GetDataType() const {
+  std::string ret = "std::unique_ptr<" + type_name_ + ">";
+  return ret;
+}
+
+void VariableLengthStructField::GenExtractor(std::ostream& s, int, bool) const {
+  s << GetName() << "_ptr = Parse" << type_name_ << "(" << GetName() << "_it);";
+  s << "if (" << GetName() << "_ptr != nullptr) {";
+  s << GetName() << "_it = " << GetName() << "_it + " << GetName() << "_ptr->size();";
+  s << "} else {";
+  s << GetName() << "_it = " << GetName() << "_it + " << GetName() << "_it.NumBytesRemaining();";
+  s << "}";
+}
+
+void VariableLengthStructField::GenGetter(std::ostream& s, Size start_offset, Size end_offset) const {
+  s << "std::unique_ptr<" << type_name_ << "> Get" << util::UnderscoreToCamelCase(GetName()) << "() const {";
+  s << "ASSERT(was_validated_);";
+  s << "size_t end_index = size();";
+  s << "auto to_bound = begin();";
+  int num_leading_bits = GenBounds(s, start_offset, end_offset, GetSize());
+  s << "std::unique_ptr<" << type_name_ << "> " << GetName() << "_ptr;";
+  GenExtractor(s, num_leading_bits, false);
+  s << "return " << GetName() << "_ptr;";
+  s << "}\n";
+}
+
+bool VariableLengthStructField::GenBuilderParameter(std::ostream& s) const {
+  s << GetDataType() << " " << GetName();
+  return true;
+}
+
+bool VariableLengthStructField::BuilderParameterMustBeMoved() const {
+  return true;
+}
+
+bool VariableLengthStructField::HasParameterValidator() const {
+  return false;
+}
+
+void VariableLengthStructField::GenParameterValidator(std::ostream&) const {
+  // Validated at compile time.
+}
+
+void VariableLengthStructField::GenInserter(std::ostream& s) const {
+  s << GetName() << "_->Serialize(i);";
+}
+
+void VariableLengthStructField::GenValidator(std::ostream&) const {
+  // Do nothing
+}
diff --git a/gd/packet/parser/fields/variable_length_struct_field.h b/gd/packet/parser/fields/variable_length_struct_field.h
new file mode 100644
index 0000000..4b5d62b
--- /dev/null
+++ b/gd/packet/parser/fields/variable_length_struct_field.h
@@ -0,0 +1,54 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#pragma once
+
+#include "fields/packet_field.h"
+#include "parse_location.h"
+
+class VariableLengthStructField : public PacketField {
+ public:
+  VariableLengthStructField(std::string name, std::string type_name, ParseLocation loc);
+
+  static const std::string kFieldType;
+
+  virtual const std::string& GetFieldType() const override;
+
+  virtual Size GetSize() const override;
+
+  virtual Size GetBuilderSize() const override;
+
+  virtual std::string GetDataType() const override;
+
+  virtual void GenExtractor(std::ostream& s, int num_leading_bits, bool for_struct) const override;
+
+  virtual void GenGetter(std::ostream& s, Size start_offset, Size end_offset) const override;
+
+  virtual bool GenBuilderParameter(std::ostream& s) const override;
+
+  virtual bool BuilderParameterMustBeMoved() const override;
+
+  virtual bool HasParameterValidator() const override;
+
+  virtual void GenParameterValidator(std::ostream&) const override;
+
+  virtual void GenInserter(std::ostream& s) const override;
+
+  virtual void GenValidator(std::ostream&) const override;
+
+ private:
+  std::string type_name_;
+};
diff --git a/gd/packet/parser/fields/vector_field.cc b/gd/packet/parser/fields/vector_field.cc
new file mode 100644
index 0000000..77fb546
--- /dev/null
+++ b/gd/packet/parser/fields/vector_field.cc
@@ -0,0 +1,218 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "fields/vector_field.h"
+
+#include "fields/count_field.h"
+#include "fields/custom_field.h"
+#include "util.h"
+
+const std::string VectorField::kFieldType = "VectorField";
+
+VectorField::VectorField(std::string name, int element_size, std::string size_modifier, ParseLocation loc)
+    : PacketField(name, loc), element_field_(new ScalarField("val", element_size, loc)), element_size_(element_size),
+      size_modifier_(size_modifier) {
+  if (element_size > 64 || element_size < 0)
+    ERROR(this) << __func__ << ": Not implemented for element size = " << element_size;
+  if (element_size % 8 != 0) {
+    ERROR(this) << "Can only have arrays with elements that are byte aligned (" << element_size << ")";
+  }
+}
+
+VectorField::VectorField(std::string name, TypeDef* type_def, std::string size_modifier, ParseLocation loc)
+    : PacketField(name, loc), element_field_(type_def->GetNewField("val", loc)),
+      element_size_(element_field_->GetSize()), size_modifier_(size_modifier) {
+  if (!element_size_.empty() && element_size_.bits() % 8 != 0) {
+    ERROR(this) << "Can only have arrays with elements that are byte aligned (" << element_size_ << ")";
+  }
+}
+
+const std::string& VectorField::GetFieldType() const {
+  return VectorField::kFieldType;
+}
+
+Size VectorField::GetSize() const {
+  // If there is no size field, then it is of unknown size.
+  if (size_field_ == nullptr) {
+    return Size();
+  }
+
+  // size_field_ is of type SIZE
+  if (size_field_->GetFieldType() == SizeField::kFieldType) {
+    std::string ret = "(static_cast<size_t>(Get" + util::UnderscoreToCamelCase(size_field_->GetName()) + "()) * 8)";
+    if (!size_modifier_.empty()) ret += size_modifier_;
+    return ret;
+  }
+
+  // size_field_ is of type COUNT and elements have a fixed size
+  if (!element_size_.empty() && !element_size_.has_dynamic()) {
+    return "(static_cast<size_t>(Get" + util::UnderscoreToCamelCase(size_field_->GetName()) + "()) * " +
+           std::to_string(element_size_.bits()) + ")";
+  }
+
+  return Size();
+}
+
+Size VectorField::GetBuilderSize() const {
+  if (!element_size_.empty() && !element_size_.has_dynamic()) {
+    std::string ret = "(static_cast<size_t>(" + GetName() + "_.size()) * " + std::to_string(element_size_.bits()) + ")";
+    return ret;
+  } else if (element_field_->BuilderParameterMustBeMoved()) {
+    std::string ret = "[this](){ size_t length = 0; for (const auto& elem : " + GetName() +
+                      "_) { length += elem->size() * 8; } return length; }()";
+    return ret;
+  } else {
+    std::string ret = "[this](){ size_t length = 0; for (const auto& elem : " + GetName() +
+                      "_) { length += elem.size() * 8; } return length; }()";
+    return ret;
+  }
+}
+
+Size VectorField::GetStructSize() const {
+  // If there is no size field, then it is of unknown size.
+  if (size_field_ == nullptr) {
+    return Size();
+  }
+
+  // size_field_ is of type SIZE
+  if (size_field_->GetFieldType() == SizeField::kFieldType) {
+    std::string ret = "(static_cast<size_t>(" + size_field_->GetName() + "_extracted) * 8)";
+    if (!size_modifier_.empty()) ret += "-" + size_modifier_;
+    return ret;
+  }
+
+  // size_field_ is of type COUNT and elements have a fixed size
+  if (!element_size_.empty() && !element_size_.has_dynamic()) {
+    return "(static_cast<size_t>(" + size_field_->GetName() + "_extracted) * " + std::to_string(element_size_.bits()) +
+           ")";
+  }
+
+  return Size();
+}
+
+std::string VectorField::GetDataType() const {
+  return "std::vector<" + element_field_->GetDataType() + ">";
+}
+
+void VectorField::GenExtractor(std::ostream& s, int num_leading_bits, bool for_struct) const {
+  s << "auto " << element_field_->GetName() << "_it = " << GetName() << "_it;";
+  if (size_field_ != nullptr && size_field_->GetFieldType() == CountField::kFieldType) {
+    s << "size_t " << element_field_->GetName() << "_count = ";
+    if (for_struct) {
+      s << size_field_->GetName() << "_extracted;";
+    } else {
+      s << "Get" << util::UnderscoreToCamelCase(size_field_->GetName()) << "();";
+    }
+  }
+  s << "while (";
+  if (size_field_ != nullptr && size_field_->GetFieldType() == CountField::kFieldType) {
+    s << "(" << element_field_->GetName() << "_count-- > 0) && ";
+  }
+  if (!element_size_.empty()) {
+    s << element_field_->GetName() << "_it.NumBytesRemaining() >= " << element_size_.bytes() << ") {";
+  } else {
+    s << element_field_->GetName() << "_it.NumBytesRemaining() > 0) {";
+  }
+  if (element_field_->BuilderParameterMustBeMoved()) {
+    s << element_field_->GetDataType() << " " << element_field_->GetName() << "_ptr;";
+  } else {
+    s << element_field_->GetDataType() << " " << element_field_->GetName() << "_value;";
+    s << element_field_->GetDataType() << "* " << element_field_->GetName() << "_ptr = &" << element_field_->GetName()
+      << "_value;";
+  }
+  element_field_->GenExtractor(s, num_leading_bits, for_struct);
+  s << "if (" << element_field_->GetName() << "_ptr != nullptr) { ";
+  if (element_field_->BuilderParameterMustBeMoved()) {
+    s << GetName() << "_ptr->push_back(std::move(" << element_field_->GetName() << "_ptr));";
+  } else {
+    s << GetName() << "_ptr->push_back(" << element_field_->GetName() << "_value);";
+  }
+  s << "}";
+  s << "}";
+}
+
+void VectorField::GenGetter(std::ostream& s, Size start_offset, Size end_offset) const {
+  s << GetDataType();
+  s << " Get" << util::UnderscoreToCamelCase(GetName()) << "() {";
+  s << "ASSERT(was_validated_);";
+  s << "size_t end_index = size();";
+  s << "auto to_bound = begin();";
+
+  int num_leading_bits = GenBounds(s, start_offset, end_offset, GetSize());
+  s << GetDataType() << " " << GetName() << "_value;";
+  s << GetDataType() << "* " << GetName() << "_ptr = &" << GetName() << "_value;";
+  GenExtractor(s, num_leading_bits, false);
+
+  s << "return " << GetName() << "_value;";
+  s << "}\n";
+}
+
+bool VectorField::GenBuilderParameter(std::ostream& s) const {
+  if (element_field_->BuilderParameterMustBeMoved()) {
+    s << "std::vector<" << element_field_->GetDataType() << "> " << GetName();
+  } else {
+    s << "const std::vector<" << element_field_->GetDataType() << ">& " << GetName();
+  }
+  return true;
+}
+
+bool VectorField::BuilderParameterMustBeMoved() const {
+  return element_field_->BuilderParameterMustBeMoved();
+}
+
+bool VectorField::GenBuilderMember(std::ostream& s) const {
+  s << "std::vector<" << element_field_->GetDataType() << "> " << GetName();
+  return true;
+}
+
+bool VectorField::HasParameterValidator() const {
+  // Does not have parameter validator yet.
+  // TODO: See comment in GenParameterValidator
+  return false;
+}
+
+void VectorField::GenParameterValidator(std::ostream&) const {
+  // No Parameter validator if its dynamically size.
+  // TODO: Maybe add a validator to ensure that the size isn't larger than what the size field can hold.
+  return;
+}
+
+void VectorField::GenInserter(std::ostream& s) const {
+  s << "for (const auto& val_ : " << GetName() << "_) {";
+  element_field_->GenInserter(s);
+  s << "}\n";
+}
+
+void VectorField::GenValidator(std::ostream&) const {
+  // NOTE: We could check if the element size divides cleanly into the array size, but we decided to forgo that
+  // in favor of just returning as many elements as possible in a best effort style.
+  //
+  // Other than that there is nothing that arrays need to be validated on other than length so nothing needs to
+  // be done here.
+}
+
+void VectorField::SetSizeField(const SizeField* size_field) {
+  if (size_field->GetFieldType() == CountField::kFieldType && !size_modifier_.empty()) {
+    ERROR(this, size_field) << "Can not use count field to describe array with a size modifier."
+                            << " Use size instead";
+  }
+
+  size_field_ = size_field;
+}
+
+const std::string& VectorField::GetSizeModifier() const {
+  return size_modifier_;
+}
diff --git a/gd/packet/parser/fields/vector_field.h b/gd/packet/parser/fields/vector_field.h
new file mode 100644
index 0000000..f8c1578
--- /dev/null
+++ b/gd/packet/parser/fields/vector_field.h
@@ -0,0 +1,75 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#pragma once
+
+#include "fields/packet_field.h"
+#include "fields/size_field.h"
+#include "parse_location.h"
+#include "type_def.h"
+
+class VectorField : public PacketField {
+ public:
+  VectorField(std::string name, int element_size, std::string size_modifier, ParseLocation loc);
+
+  VectorField(std::string name, TypeDef* type_def, std::string size_modifier, ParseLocation loc);
+
+  static const std::string kFieldType;
+
+  virtual const std::string& GetFieldType() const override;
+
+  virtual Size GetSize() const override;
+
+  virtual Size GetBuilderSize() const override;
+
+  virtual Size GetStructSize() const override;
+
+  virtual std::string GetDataType() const override;
+
+  virtual void GenExtractor(std::ostream& s, int num_leading_bits, bool for_struct) const override;
+
+  virtual void GenGetter(std::ostream& s, Size start_offset, Size end_offset) const override;
+
+  virtual bool GenBuilderParameter(std::ostream& s) const override;
+
+  virtual bool BuilderParameterMustBeMoved() const override;
+
+  virtual bool GenBuilderMember(std::ostream& s) const override;
+
+  virtual bool HasParameterValidator() const override;
+
+  virtual void GenParameterValidator(std::ostream& s) const override;
+
+  virtual void GenInserter(std::ostream& s) const override;
+
+  virtual void GenValidator(std::ostream&) const override;
+
+  void SetSizeField(const SizeField* size_field);
+
+  const std::string& GetSizeModifier() const;
+
+  const std::string name_;
+
+  const PacketField* element_field_{nullptr};
+
+  const Size element_size_{};
+
+  // Size is always in bytes, unless it is a count.
+  const SizeField* size_field_{nullptr};
+
+  // Size modifier is only used when size_field_ is of type SIZE and is not used with COUNT.
+  std::string size_modifier_{""};
+};
diff --git a/gd/packet/parser/language_l.ll b/gd/packet/parser/language_l.ll
index 1914ae9..5814ec1 100644
--- a/gd/packet/parser/language_l.ll
+++ b/gd/packet/parser/language_l.ll
@@ -57,12 +57,14 @@
 "_fixed_"               { return(token::FIXED); }
 "_reserved_"            { return(token::RESERVED); }
 "_checksum_start_"      { return(token::CHECKSUM_START); }
+"_padding_"             { return(token::PADDING); }
   /* Types */
 "checksum"              { return(token::CHECKSUM); }
 "custom_field"          { return(token::CUSTOM_FIELD); }
 "enum"                  { return(token::ENUM); }
 "group"                 { return(token::GROUP); }
 "packet"                { return(token::PACKET); }
+"struct"                { return(token::STRUCT); }
 "little_endian_packets" {
                           yylval->integer = 1;
                           return token::IS_LITTLE_ENDIAN;
diff --git a/gd/packet/parser/language_y.yy b/gd/packet/parser/language_y.yy
index 92c7abd..a36abef 100644
--- a/gd/packet/parser/language_y.yy
+++ b/gd/packet/parser/language_y.yy
@@ -44,6 +44,8 @@
   FieldList* packet_field_definitions;
   PacketField* packet_field_type;
 
+  StructDef* struct_definition_value;
+
   std::map<std::string, std::variant<int64_t, std::string>>* constraint_list_t;
   std::pair<std::string, std::variant<int64_t, std::string>>* constraint_t;
 }
@@ -58,6 +60,7 @@
 %token PACKET "packet"
 %token PAYLOAD "payload"
 %token BODY "body"
+%token STRUCT "struct"
 %token SIZE "size"
 %token COUNT "count"
 %token FIXED "fixed"
@@ -66,6 +69,7 @@
 %token CUSTOM_FIELD "custom_field"
 %token CHECKSUM "checksum"
 %token CHECKSUM_START "checksum_start"
+%token PADDING "padding"
 
 %type<enum_definition> enum_definition
 %type<enumeration_values> enumeration_list
@@ -78,11 +82,15 @@
 %type<packet_field_type> type_def_field_definition;
 %type<packet_field_type> scalar_field_definition;
 %type<packet_field_type> checksum_start_field_definition;
+%type<packet_field_type> padding_field_definition;
 %type<packet_field_type> size_field_definition;
 %type<packet_field_type> payload_field_definition;
 %type<packet_field_type> body_field_definition;
 %type<packet_field_type> fixed_field_definition;
 %type<packet_field_type> reserved_field_definition;
+%type<packet_field_type> array_field_definition;
+
+%type<struct_definition_value> struct_definition;
 
 %type<constraint_list_t> constraint_list;
 %type<constraint_t> constraint;
@@ -108,15 +116,20 @@
 declaration
   : enum_definition
     {
-      std::cerr << "FOUND ENUM\n\n";
+      DEBUG() << "FOUND ENUM\n\n";
       decls->AddTypeDef($1->name_, $1);
     }
   | packet_definition
     {
-      std::cerr << "FOUND PACKET\n\n";
+      DEBUG() << "FOUND PACKET\n\n";
       decls->AddPacketDef($1->name_, std::move(*$1));
       delete $1;
     }
+  | struct_definition
+    {
+      DEBUG() << "FOUND STRUCT\n\n";
+      decls->AddTypeDef($1->name_, $1);
+    }
   | group_definition
     {
       // All actions are handled in group_definition
@@ -133,7 +146,7 @@
 enum_definition
   : ENUM IDENTIFIER ':' INTEGER '{' enumeration_list ',' '}'
     {
-      std::cerr << "Enum Declared: name=" << *$2
+      DEBUG() << "Enum Declared: name=" << *$2
                 << " size=" << $4 << "\n";
 
       $$ = new EnumDef(std::move(*$2), $4);
@@ -147,14 +160,14 @@
 enumeration_list
   : enumeration
     {
-      std::cerr << "Enumerator with comma\n";
+      DEBUG() << "Enumerator with comma\n";
       $$ = new std::map<int, std::string>();
       $$->insert(std::move(*$1));
       delete $1;
     }
   | enumeration_list ',' enumeration
     {
-      std::cerr << "Enumerator with list\n";
+      DEBUG() << "Enumerator with list\n";
       $$ = $1;
       $$->insert(std::move(*$3));
       delete $3;
@@ -163,7 +176,7 @@
 enumeration
   : IDENTIFIER '=' INTEGER
     {
-      std::cerr << "Enumerator: name=" << *$1
+      DEBUG() << "Enumerator: name=" << *$1
                 << " value=" << $3 << "\n";
       $$ = new std::pair($3, std::move(*$1));
       delete $1;
@@ -179,7 +192,7 @@
 checksum_definition
   : CHECKSUM IDENTIFIER ':' INTEGER STRING
     {
-      std::cerr << "Checksum field defined\n";
+      DEBUG() << "Checksum field defined\n";
       decls->AddTypeDef(*$2, new ChecksumDef(*$2, *$5, $4));
       delete $2;
       delete $5;
@@ -192,6 +205,88 @@
       delete $2;
       delete $5;
     }
+  | CUSTOM_FIELD IDENTIFIER STRING
+    {
+      decls->AddTypeDef(*$2, new CustomFieldDef(*$2, *$3));
+      delete $2;
+      delete $3;
+    }
+
+struct_definition
+  : STRUCT IDENTIFIER '{' field_definition_list '}'
+    {
+      auto&& struct_name = *$2;
+      auto&& field_definition_list = *$4;
+
+      DEBUG() << "Struct " << struct_name << " with no parent";
+      DEBUG() << "STRUCT FIELD LIST SIZE: " << field_definition_list.size();
+      auto struct_definition = new StructDef(std::move(struct_name), std::move(field_definition_list));
+      struct_definition->AssignSizeFields();
+
+      $$ = struct_definition;
+      delete $2;
+      delete $4;
+    }
+  | STRUCT IDENTIFIER ':' IDENTIFIER '{' field_definition_list '}'
+    {
+      auto&& struct_name = *$2;
+      auto&& parent_struct_name = *$4;
+      auto&& field_definition_list = *$6;
+
+      DEBUG() << "Struct " << struct_name << " with parent " << parent_struct_name << "\n";
+      DEBUG() << "STRUCT FIELD LIST SIZE: " << field_definition_list.size() << "\n";
+
+      auto parent_struct = decls->GetTypeDef(parent_struct_name);
+      if (parent_struct == nullptr) {
+        ERRORLOC(LOC) << "Could not find struct " << parent_struct_name
+                  << " used as parent for " << struct_name;
+      }
+
+      if (parent_struct->GetDefinitionType() != TypeDef::Type::STRUCT) {
+        ERRORLOC(LOC) << parent_struct_name << " is not a struct";
+      }
+      auto struct_definition = new StructDef(std::move(struct_name), std::move(field_definition_list), (StructDef*)parent_struct);
+      struct_definition->AssignSizeFields();
+
+      $$ = struct_definition;
+      delete $2;
+      delete $4;
+      delete $6;
+    }
+  | STRUCT IDENTIFIER ':' IDENTIFIER '(' constraint_list ')' '{' field_definition_list '}'
+    {
+      auto&& struct_name = *$2;
+      auto&& parent_struct_name = *$4;
+      auto&& constraints = *$6;
+      auto&& field_definition_list = *$9;
+
+      auto parent_struct = decls->GetTypeDef(parent_struct_name);
+      if (parent_struct == nullptr) {
+        ERRORLOC(LOC) << "Could not find struct " << parent_struct_name
+                  << " used as parent for " << struct_name;
+      }
+
+      if (parent_struct->GetDefinitionType() != TypeDef::Type::STRUCT) {
+        ERRORLOC(LOC) << parent_struct_name << " is not a struct";
+      }
+
+      auto struct_definition = new StructDef(std::move(struct_name), std::move(field_definition_list), (StructDef*)parent_struct);
+      struct_definition->AssignSizeFields();
+
+      for (const auto& constraint : constraints) {
+        const auto& constraint_name = constraint.first;
+        const auto& constraint_value = constraint.second;
+        DEBUG() << "Parent constraint on " << constraint_name;
+        struct_definition->AddParentConstraint(constraint_name, constraint_value);
+      }
+
+      $$ = struct_definition;
+
+      delete $2;
+      delete $4;
+      delete $6;
+      delete $9;
+    }
 
 packet_definition
   : PACKET IDENTIFIER '{' field_definition_list '}'  /* Packet with no parent */
@@ -269,15 +364,15 @@
 field_definition_list
   : /* empty */
     {
-      std::cerr << "Empty Field definition\n";
+      DEBUG() << "Empty Field definition\n";
       $$ = new FieldList();
     }
   | field_definition
     {
-      std::cerr << "Field definition\n";
+      DEBUG() << "Field definition\n";
       $$ = new FieldList();
 
-      if ($1->GetFieldType() == PacketField::Type::GROUP) {
+      if ($1->GetFieldType() == GroupField::kFieldType) {
         auto group_fields = static_cast<GroupField*>($1)->GetFields();
 	FieldList reversed_fields(group_fields->rbegin(), group_fields->rend());
         for (auto& field : reversed_fields) {
@@ -291,10 +386,10 @@
     }
   | field_definition ',' field_definition_list
     {
-      std::cerr << "Field definition with list\n";
+      DEBUG() << "Field definition with list\n";
       $$ = $3;
 
-      if ($1->GetFieldType() == PacketField::Type::GROUP) {
+      if ($1->GetFieldType() == GroupField::kFieldType) {
         auto group_fields = static_cast<GroupField*>($1)->GetFields();
 	FieldList reversed_fields(group_fields->rbegin(), group_fields->rend());
         for (auto& field : reversed_fields) {
@@ -315,42 +410,52 @@
     }
   | type_def_field_definition
     {
-      std::cerr << "Field with a pre-defined type\n";
+      DEBUG() << "Field with a pre-defined type\n";
       $$ = $1;
     }
   | scalar_field_definition
     {
-      std::cerr << "Scalar field\n";
+      DEBUG() << "Scalar field\n";
       $$ = $1;
     }
   | checksum_start_field_definition
     {
-      std::cerr << "Checksum start field\n";
+      DEBUG() << "Checksum start field\n";
+      $$ = $1;
+    }
+  | padding_field_definition
+    {
+      DEBUG() << "Padding field\n";
       $$ = $1;
     }
   | size_field_definition
     {
-      std::cerr << "Size field\n";
+      DEBUG() << "Size field\n";
       $$ = $1;
     }
   | body_field_definition
     {
-      std::cerr << "Body field\n";
+      DEBUG() << "Body field\n";
       $$ = $1;
     }
   | payload_field_definition
     {
-      std::cerr << "Payload field\n";
+      DEBUG() << "Payload field\n";
       $$ = $1;
     }
   | fixed_field_definition
     {
-      std::cerr << "Fixed field\n";
+      DEBUG() << "Fixed field\n";
       $$ = $1;
     }
   | reserved_field_definition
     {
-      std::cerr << "Reserved field\n";
+      DEBUG() << "Reserved field\n";
+      $$ = $1;
+    }
+  | array_field_definition
+    {
+      DEBUG() << "ARRAY field\n";
       $$ = $1;
     }
 
@@ -369,7 +474,7 @@
     }
   | IDENTIFIER '{' constraint_list '}'
     {
-      std::cerr << "Group with fixed field(s) " << *$1 << "\n";
+      DEBUG() << "Group with fixed field(s) " << *$1 << "\n";
       auto group = decls->GetGroupDef(*$1);
       if (group == nullptr) {
         ERRORLOC(LOC) << "Could not find group with name " << *$1;
@@ -379,24 +484,24 @@
       for (const auto field : *group) {
         const auto constraint = $3->find(field->GetName());
         if (constraint != $3->end()) {
-          if (field->GetFieldType() == PacketField::Type::SCALAR) {
-            std::cerr << "Fixing group scalar value\n";
-            expanded_fields->push_back(new FixedField(field->GetSize().bits(), std::get<int64_t>(constraint->second), LOC));
-          } else if (field->GetFieldType() == PacketField::Type::ENUM) {
-            std::cerr << "Fixing group enum value\n";
+          if (field->GetFieldType() == ScalarField::kFieldType) {
+            DEBUG() << "Fixing group scalar value\n";
+            expanded_fields->push_back(new FixedScalarField(field->GetSize().bits(), std::get<int64_t>(constraint->second), LOC));
+          } else if (field->GetFieldType() == EnumField::kFieldType) {
+            DEBUG() << "Fixing group enum value\n";
 
-            auto type_def = decls->GetTypeDef(field->GetType());
+            auto type_def = decls->GetTypeDef(field->GetDataType());
             EnumDef* enum_def = (type_def->GetDefinitionType() == TypeDef::Type::ENUM ? (EnumDef*)type_def : nullptr);
             if (enum_def == nullptr) {
-              ERRORLOC(LOC) << "No enum found of type " << field->GetType();
+              ERRORLOC(LOC) << "No enum found of type " << field->GetDataType();
             }
             if (!enum_def->HasEntry(std::get<std::string>(constraint->second))) {
-              ERRORLOC(LOC) << "Enum " << field->GetType() << " has no enumeration " << std::get<std::string>(constraint->second);
+              ERRORLOC(LOC) << "Enum " << field->GetDataType() << " has no enumeration " << std::get<std::string>(constraint->second);
             }
 
-            expanded_fields->push_back(new FixedField(enum_def, std::get<std::string>(constraint->second), LOC));
+            expanded_fields->push_back(new FixedEnumField(enum_def, std::get<std::string>(constraint->second), LOC));
           } else {
-            ERRORLOC(LOC) << "Unimplemented constraint of type " << field->GetType();
+            ERRORLOC(LOC) << "Unimplemented constraint of type " << field->GetFieldType();
           }
           $3->erase(constraint);
         } else {
@@ -415,14 +520,14 @@
 constraint_list
   : constraint ',' constraint_list
     {
-      std::cerr << "Group field value list\n";
+      DEBUG() << "Group field value list\n";
       $3->insert(*$1);
       $$ = $3;
       delete($1);
     }
   | constraint
     {
-      std::cerr << "Group field value\n";
+      DEBUG() << "Group field value\n";
       $$ = new std::map<std::string, std::variant<int64_t, std::string>>();
       $$->insert(*$1);
       delete($1);
@@ -431,7 +536,7 @@
 constraint
   : IDENTIFIER '=' INTEGER
     {
-      std::cerr << "Group with a fixed integer value=" << $1 << " value=" << $3 << "\n";
+      DEBUG() << "Group with a fixed integer value=" << $1 << " value=" << $3 << "\n";
 
       $$ = new std::pair(*$1, std::variant<int64_t,std::string>($3));
       delete $1;
@@ -448,7 +553,7 @@
 type_def_field_definition
   : IDENTIFIER ':' IDENTIFIER
     {
-      std::cerr << "Predefined type field " << *$1 << " : " << *$3 << "\n";
+      DEBUG() << "Predefined type field " << *$1 << " : " << *$3 << "\n";
       if (auto type_def = decls->GetTypeDef(*$3)) {
         $$ = type_def->GetNewField(*$1, LOC);
       } else {
@@ -461,7 +566,7 @@
 scalar_field_definition
   : IDENTIFIER ':' INTEGER
     {
-      std::cerr << "Scalar field " << *$1 << " : " << $3 << "\n";
+      DEBUG() << "Scalar field " << *$1 << " : " << $3 << "\n";
       $$ = new ScalarField(*$1, $3, LOC);
       delete $1;
     }
@@ -469,63 +574,62 @@
 body_field_definition
   : BODY
     {
-      std::cerr << "Body field\n";
+      DEBUG() << "Body field\n";
       $$ = new BodyField(LOC);
     }
 
 payload_field_definition
   : PAYLOAD ':' '[' SIZE_MODIFIER ']'
     {
-      std::cerr << "Payload field with modifier " << *$4 << "\n";
+      DEBUG() << "Payload field with modifier " << *$4 << "\n";
       $$ = new PayloadField(*$4, LOC);
       delete $4;
     }
-  | PAYLOAD ':' '[' INTEGER ']'
-    {
-      ERRORLOC(LOC) << "Payload fields can only be dynamically sized.";
-    }
   | PAYLOAD
     {
-      std::cerr << "Payload field\n";
+      DEBUG() << "Payload field\n";
       $$ = new PayloadField("", LOC);
     }
 
 checksum_start_field_definition
   : CHECKSUM_START '(' IDENTIFIER ')'
     {
-      std::cerr << "ChecksumStart field defined\n";
+      DEBUG() << "ChecksumStart field defined\n";
       $$ = new ChecksumStartField(*$3, LOC);
       delete $3;
     }
 
+padding_field_definition
+  : PADDING '[' INTEGER ']'
+    {
+      DEBUG() << "Padding field defined\n";
+      $$ = new PaddingField($3, LOC);
+    }
+
 size_field_definition
   : SIZE '(' IDENTIFIER ')' ':' INTEGER
     {
-      std::cerr << "Size field defined\n";
-      $$ = new SizeField(*$3, $6, false, LOC);
+      DEBUG() << "Size field defined\n";
+      $$ = new SizeField(*$3, $6, LOC);
       delete $3;
     }
   | SIZE '(' PAYLOAD ')' ':' INTEGER
     {
-      std::cerr << "Size for payload defined\n";
-      $$ = new SizeField("payload", $6, false, LOC);
+      DEBUG() << "Size for payload defined\n";
+      $$ = new SizeField("payload", $6, LOC);
     }
   | COUNT '(' IDENTIFIER ')' ':' INTEGER
     {
-      std::cerr << "Count field defined\n";
-      $$ = new SizeField(*$3, $6, true, LOC);
+      DEBUG() << "Count field defined\n";
+      $$ = new CountField(*$3, $6, LOC);
       delete $3;
     }
-  | COUNT '(' PAYLOAD ')' ':' INTEGER
-    {
-      ERRORLOC(LOC) << "Can not use count to describe payload fields.";
-    }
 
 fixed_field_definition
   : FIXED '=' INTEGER ':' INTEGER
     {
-      std::cerr << "Fixed field defined value=" << $3 << " size=" << $5 << "\n";
-      $$ = new FixedField($5, $3, LOC);
+      DEBUG() << "Fixed field defined value=" << $3 << " size=" << $5 << "\n";
+      $$ = new FixedScalarField($5, $3, LOC);
     }
   | FIXED '=' IDENTIFIER ':' IDENTIFIER
     {
@@ -537,7 +641,7 @@
           ERRORLOC(LOC) << "Previously defined enum " << enum_def->GetTypeName() << " has no entry for " << *$3;
         }
 
-        $$ = new FixedField(enum_def, *$3, LOC);
+        $$ = new FixedEnumField(enum_def, *$3, LOC);
       } else {
         ERRORLOC(LOC) << "No enum found with name " << *$5;
       }
@@ -549,14 +653,73 @@
 reserved_field_definition
   : RESERVED ':' INTEGER
     {
-      std::cerr << "Reserved field of size=" << $3 << "\n";
+      DEBUG() << "Reserved field of size=" << $3 << "\n";
       $$ = new ReservedField($3, LOC);
     }
 
+array_field_definition
+  : IDENTIFIER ':' INTEGER '[' ']'
+    {
+      DEBUG() << "Vector field defined name=" << *$1 << " element_size=" << $3;
+      $$ = new VectorField(*$1, $3, "", LOC);
+      delete $1;
+    }
+  | IDENTIFIER ':' INTEGER '[' SIZE_MODIFIER ']'
+    {
+      DEBUG() << "Vector field defined name=" << *$1 << " element_size=" << $3
+             << " size_modifier=" << *$5;
+      $$ = new VectorField(*$1, $3, *$5, LOC);
+      delete $1;
+      delete $5;
+    }
+  | IDENTIFIER ':' INTEGER '[' INTEGER ']'
+    {
+      DEBUG() << "Array field defined name=" << *$1 << " element_size=" << $3
+             << " fixed_size=" << $5;
+      $$ = new ArrayField(*$1, $3, $5, LOC);
+      delete $1;
+    }
+  | IDENTIFIER ':' IDENTIFIER '[' ']'
+    {
+      DEBUG() << "Vector field defined name=" << *$1 << " type=" << *$3;
+      if (auto type_def = decls->GetTypeDef(*$3)) {
+        $$ = new VectorField(*$1, type_def, "", LOC);
+      } else {
+        ERRORLOC(LOC) << "Can't find type used in array field.";
+      }
+      delete $1;
+      delete $3;
+    }
+  | IDENTIFIER ':' IDENTIFIER '[' SIZE_MODIFIER ']'
+    {
+      DEBUG() << "Vector field defined name=" << *$1 << " type=" << *$3
+             << " size_modifier=" << *$5;
+      if (auto type_def = decls->GetTypeDef(*$3)) {
+        $$ = new VectorField(*$1, type_def, *$5, LOC);
+      } else {
+        ERRORLOC(LOC) << "Can't find type used in array field.";
+      }
+      delete $1;
+      delete $3;
+      delete $5;
+    }
+  | IDENTIFIER ':' IDENTIFIER '[' INTEGER ']'
+    {
+      DEBUG() << "Array field defined name=" << *$1 << " type=" << *$3
+             << " fixed_size=" << $5;
+      if (auto type_def = decls->GetTypeDef(*$3)) {
+        $$ = new ArrayField(*$1, type_def, $5, LOC);
+      } else {
+        ERRORLOC(LOC) << "Can't find type used in array field.";
+      }
+      delete $1;
+      delete $3;
+    }
+
 %%
 
 
 void yy::parser::error(const yy::parser::location_type& loc, const std::string& error) {
-  std::cerr << error << " at location " << loc << "\n";
+  ERROR() << error << " at location " << loc << "\n";
   abort();
 }
diff --git a/gd/packet/parser/logging.h b/gd/packet/parser/logging.h
index 8d9e467..a2939ef 100644
--- a/gd/packet/parser/logging.h
+++ b/gd/packet/parser/logging.h
@@ -58,6 +58,8 @@
   }
 
   ~LogMessage() {
+    if (debug_ && suppress_debug_) return;
+
     std::cerr << stream_.str() << "\n";
     for (const auto& token : tokens_) {
       // Bold line number
@@ -79,6 +81,7 @@
  private:
   std::ostringstream stream_;
   bool debug_;
+  bool suppress_debug_{true};
   ParseLocation loc_;
   std::vector<const Loggable*> tokens_;
 };
diff --git a/gd/packet/parser/main.cc b/gd/packet/parser/main.cc
index e3fe16a..8c6e4e1 100644
--- a/gd/packet/parser/main.cc
+++ b/gd/packet/parser/main.cc
@@ -26,6 +26,7 @@
 #include <vector>
 
 #include "declarations.h"
+#include "struct_parser_generator.h"
 
 #include "language_y.h"
 
@@ -36,10 +37,9 @@
 
 namespace {
 
-const std::string kBluetoothTopNamespace = "bluetooth";
-
-void parse_namespace(std::filesystem::path input_file_relative_path, std::vector<std::string>& token) {
-  std::filesystem::path gen_namespace = kBluetoothTopNamespace / input_file_relative_path;
+void parse_namespace(std::string root_namespace, std::filesystem::path input_file_relative_path,
+                     std::vector<std::string>& token) {
+  std::filesystem::path gen_namespace = root_namespace / input_file_relative_path;
   std::string gen_namespace_str = gen_namespace;
   std::regex path_tokenizer("/");
   auto it = std::sregex_token_iterator(gen_namespace_str.cbegin(), gen_namespace_str.cend(), path_tokenizer, -1);
@@ -61,8 +61,8 @@
   }
 }
 
-bool parse_one_file(std::filesystem::path input_file, std::filesystem::path include_dir,
-                    std::filesystem::path out_dir) {
+bool parse_one_file(std::filesystem::path input_file, std::filesystem::path include_dir, std::filesystem::path out_dir,
+                    std::string root_namespace) {
   auto gen_relative_path = input_file.lexically_relative(include_dir).parent_path();
 
   auto input_filename = input_file.filename().string().substr(0, input_file.filename().string().find(".pdl"));
@@ -110,30 +110,42 @@
   out_file << "#include \"os/log.h\"\n";
   out_file << "#include \"packet/base_packet_builder.h\"\n";
   out_file << "#include \"packet/bit_inserter.h\"\n";
+  out_file << "#include \"packet/iterator.h\"\n";
   out_file << "#include \"packet/packet_builder.h\"\n";
+  out_file << "#include \"packet/packet_struct.h\"\n";
   out_file << "#include \"packet/packet_view.h\"\n";
   out_file << "#include \"packet/parser/checksum_type_checker.h\"\n";
+  out_file << "#include \"packet/parser/custom_type_checker.h\"\n";
   out_file << "\n\n";
 
   for (const auto& c : decls.type_defs_queue_) {
-    c.second->GenInclude(out_file);
+    if (c.second->GetDefinitionType() == TypeDef::Type::CUSTOM ||
+        c.second->GetDefinitionType() == TypeDef::Type::CHECKSUM) {
+      ((CustomFieldDef*)c.second)->GenInclude(out_file);
+    }
   }
   out_file << "\n\n";
 
   std::vector<std::string> namespace_list;
-  parse_namespace(gen_relative_path, namespace_list);
+  parse_namespace(root_namespace, gen_relative_path, namespace_list);
   generate_namespace_open(namespace_list, out_file);
   out_file << "\n\n";
 
   for (const auto& c : decls.type_defs_queue_) {
-    c.second->GenUsing(out_file);
+    if (c.second->GetDefinitionType() == TypeDef::Type::CUSTOM ||
+        c.second->GetDefinitionType() == TypeDef::Type::CHECKSUM) {
+      ((CustomFieldDef*)c.second)->GenUsing(out_file);
+    }
   }
   out_file << "\n\n";
 
   out_file << "using ::bluetooth::packet::BasePacketBuilder;";
   out_file << "using ::bluetooth::packet::BitInserter;";
+  out_file << "using ::bluetooth::packet::CustomTypeChecker;";
+  out_file << "using ::bluetooth::packet::Iterator;";
   out_file << "using ::bluetooth::packet::kLittleEndian;";
   out_file << "using ::bluetooth::packet::PacketBuilder;";
+  out_file << "using ::bluetooth::packet::PacketStruct;";
   out_file << "using ::bluetooth::packet::PacketView;";
   out_file << "using ::bluetooth::packet::parser::ChecksumTypeChecker;";
   out_file << "\n\n";
@@ -156,7 +168,28 @@
     if (ch.second->GetDefinitionType() == TypeDef::Type::CHECKSUM) {
       ((ChecksumDef*)ch.second)->GenChecksumCheck(out_file);
     }
-    out_file << "\n/* Done ChecksumChecks */\n";
+  }
+  out_file << "\n/* Done ChecksumChecks */\n";
+
+  for (const auto& c : decls.type_defs_queue_) {
+    if (c.second->GetDefinitionType() == TypeDef::Type::CUSTOM && c.second->size_ == -1 /* Variable Size */) {
+      ((CustomFieldDef*)c.second)->GenCustomFieldCheck(out_file, decls.is_little_endian);
+    }
+  }
+  out_file << "\n";
+
+  for (auto& s : decls.type_defs_queue_) {
+    if (s.second->GetDefinitionType() == TypeDef::Type::STRUCT) {
+      ((StructDef*)s.second)->SetEndianness(decls.is_little_endian);
+      ((StructDef*)s.second)->GenDefinition(out_file);
+      out_file << "\n";
+    }
+  }
+
+  {
+    StructParserGenerator spg(decls);
+    spg.Generate(out_file);
+    out_file << "\n\n";
   }
 
   for (size_t i = 0; i < decls.packet_defs_queue_.size(); i++) {
@@ -180,32 +213,39 @@
 
 }  // namespace
 
+// TODO(b/141583809): stop leaks
+extern "C" const char* __asan_default_options() {
+  return "detect_leaks=0";
+}
+
 int main(int argc, const char** argv) {
   std::filesystem::path out_dir;
   std::filesystem::path include_dir;
+  std::string root_namespace = "bluetooth";
   std::queue<std::filesystem::path> input_files;
   const std::string arg_out = "--out=";
   const std::string arg_include = "--include=";
+  const std::string arg_namespace = "--root_namespace=";
 
   for (int i = 1; i < argc; i++) {
     std::string arg = argv[i];
     if (arg.find(arg_out) == 0) {
-      auto out_path = std::filesystem::path(arg.substr(arg_out.size()));
       out_dir = std::filesystem::current_path() / std::filesystem::path(arg.substr(arg_out.size()));
     } else if (arg.find(arg_include) == 0) {
-      auto include_path = std::filesystem::path(arg.substr(arg_out.size()));
       include_dir = std::filesystem::current_path() / std::filesystem::path(arg.substr(arg_include.size()));
+    } else if (arg.find(arg_namespace) == 0) {
+      root_namespace = arg.substr(arg_namespace.size());
     } else {
       input_files.emplace(std::filesystem::current_path() / std::filesystem::path(arg));
     }
   }
   if (out_dir == std::filesystem::path() || include_dir == std::filesystem::path()) {
-    std::cerr << "Usage: bt-packetgen --out=OUT --include=INCLUDE input_files..." << std::endl;
+    std::cerr << "Usage: bt-packetgen --out=OUT --include=INCLUDE --root=NAMESPACE input_files..." << std::endl;
     return 1;
   }
 
   while (!input_files.empty()) {
-    if (!parse_one_file(input_files.front(), include_dir, out_dir)) {
+    if (!parse_one_file(input_files.front(), include_dir, out_dir, root_namespace)) {
       std::cerr << "Didn't parse " << input_files.front() << " correctly" << std::endl;
       return 2;
     }
diff --git a/gd/packet/parser/packet_def.cc b/gd/packet/parser/packet_def.cc
index 30886cd..1252a1b 100644
--- a/gd/packet/parser/packet_def.cc
+++ b/gd/packet/parser/packet_def.cc
@@ -22,167 +22,11 @@
 #include "fields/all_fields.h"
 #include "util.h"
 
-PacketDef::PacketDef(std::string name, FieldList fields) : name_(name), fields_(fields), parent_(nullptr){};
-PacketDef::PacketDef(std::string name, FieldList fields, PacketDef* parent)
-    : name_(name), fields_(fields), parent_(parent){};
+PacketDef::PacketDef(std::string name, FieldList fields) : ParentDef(name, fields, nullptr) {}
+PacketDef::PacketDef(std::string name, FieldList fields, PacketDef* parent) : ParentDef(name, fields, parent) {}
 
-void PacketDef::AddParentConstraint(std::string field_name, std::variant<int64_t, std::string> value) {
-  // NOTE: This could end up being very slow if there are a lot of constraints.
-  const auto& parent_params = parent_->GetParamList();
-  const auto& constrained_field = parent_params.GetField(field_name);
-  if (constrained_field == nullptr) {
-    ERROR() << "Attempting to constrain field " << field_name << " in parent packet " << parent_->name_
-            << ", but no such field exists.";
-  }
-
-  if (constrained_field->GetFieldType() == PacketField::Type::SCALAR) {
-    if (!std::holds_alternative<int64_t>(value)) {
-      ERROR(constrained_field) << "Attemting to constrain a scalar field using an enum value in packet "
-                               << parent_->name_ << ".";
-    }
-  } else if (constrained_field->GetFieldType() == PacketField::Type::ENUM) {
-    if (!std::holds_alternative<std::string>(value)) {
-      ERROR(constrained_field) << "Attemting to constrain an enum field using an scalar value in packet "
-                               << parent_->name_ << ".";
-    }
-    const auto& enum_def = static_cast<EnumField*>(constrained_field)->GetEnumDef();
-    if (!enum_def.HasEntry(std::get<std::string>(value))) {
-      ERROR(constrained_field) << "No matching enumeration \"" << std::get<std::string>(value)
-                               << "for constraint on enum in parent packet " << parent_->name_ << ".";
-    }
-
-    // For enums, we have to qualify the value using the enum type name.
-    value = enum_def.GetTypeName() + "::" + std::get<std::string>(value);
-  } else {
-    ERROR(constrained_field) << "Field in parent packet " << parent_->name_ << " is not viable for constraining.";
-  }
-
-  parent_constraints_.insert(std::pair(field_name, value));
-}
-
-// Assign all size fields to their corresponding variable length fields.
-// Will crash if
-//  - there aren't any fields that don't match up to a field.
-//  - the size field points to a fixed size field.
-//  - if the size field comes after the variable length field.
-void PacketDef::AssignSizeFields() {
-  for (const auto& field : fields_) {
-    DEBUG() << "field name: " << field->GetName();
-
-    if (field->GetFieldType() != PacketField::Type::SIZE && field->GetFieldType() != PacketField::Type::COUNT) {
-      continue;
-    }
-
-    const SizeField* size_field = nullptr;
-    size_field = static_cast<SizeField*>(field);
-    // Check to see if a corresponding field can be found.
-    const auto& var_len_field = fields_.GetField(size_field->GetSizedFieldName());
-    if (var_len_field == nullptr) {
-      ERROR(field) << "Could not find corresponding field for size/count field.";
-    }
-
-    // Do the ordering check to ensure the size field comes before the
-    // variable length field.
-    for (auto it = fields_.begin(); *it != size_field; it++) {
-      DEBUG() << "field name: " << (*it)->GetName();
-      if (*it == var_len_field) {
-        ERROR(var_len_field, size_field) << "Size/count field must come before the variable length field it describes.";
-      }
-    }
-
-    if (var_len_field->GetFieldType() == PacketField::Type::PAYLOAD) {
-      const auto& payload_field = static_cast<PayloadField*>(var_len_field);
-      payload_field->SetSizeField(size_field);
-      continue;
-    }
-
-    // If we've reached this point then the field wasn't a variable length field.
-    // Check to see if the field is a variable length field
-    std::cerr << "Can not use size/count in reference to a fixed size field.\n";
-    abort();
-  }
-}
-
-void PacketDef::SetEndianness(bool is_little_endian) {
-  is_little_endian_ = is_little_endian;
-}
-
-// Get the size for the packet. You scan specify without_payload in order
-// to exclude payload fields as child packets will be overriding it.
-Size PacketDef::GetSize(bool without_payload) const {
-  auto size = Size();
-
-  for (const auto& field : fields_) {
-    if (without_payload && field->GetFieldType() == PacketField::Type::PAYLOAD) {
-      continue;
-    }
-
-    size += field->GetSize();
-  }
-
-  if (parent_ != nullptr) {
-    size += parent_->GetSize(true);
-  }
-
-  return size;
-}
-
-// Get the offset until the field is reached, if there is no field
-// returns an empty Size. from_end requests the offset to the field
-// starting from the end() iterator. If there is a field with an unknown
-// size along the traversal, then an empty size is returned.
-Size PacketDef::GetOffsetForField(std::string field_name, bool from_end) const {
-  // Check first if the field exists.
-  if (fields_.GetField(field_name) == nullptr) {
-    if (field_name != "payload" && field_name != "body") {
-      ERROR() << "Can't find a field offset for nonexistent field named: " << field_name;
-    } else {
-      return Size();
-    }
-  }
-
-  // We have to use a generic lambda to conditionally change iteration direction
-  // due to iterator and reverse_iterator being different types.
-  auto size_lambda = [&](auto from, auto to) -> Size {
-    auto size = Size(0);
-    for (auto it = from; it != to; it++) {
-      // We've reached the field, end the loop.
-      if ((*it)->GetName() == field_name) break;
-      const auto& field = *it;
-      // If there was a field that wasn't the payload with an unknown size,
-      // return an empty Size.
-      if (field->GetSize().empty()) {
-        return Size();
-      }
-      size += field->GetSize();
-    }
-    return size;
-  };
-
-  // Change iteration direction based on from_end.
-  auto size = Size();
-  if (from_end)
-    size = size_lambda(fields_.rbegin(), fields_.rend());
-  else
-    size = size_lambda(fields_.begin(), fields_.end());
-  if (size.empty()) return Size();
-
-  // For parent packets we need the offset until a payload or body field.
-  if (parent_ != nullptr) {
-    auto parent_payload_offset = parent_->GetOffsetForField("payload", from_end);
-    if (!parent_payload_offset.empty()) {
-      size += parent_payload_offset;
-    } else {
-      parent_payload_offset = parent_->GetOffsetForField("body", from_end);
-      if (!parent_payload_offset.empty()) {
-        size += parent_payload_offset;
-      } else {
-        return Size();
-      }
-    }
-  }
-
-  return size;
+PacketField* PacketDef::GetNewField(const std::string&, ParseLocation) const {
+  return nullptr;  // Packets can't be fields
 }
 
 void PacketDef::GenParserDefinition(std::ostream& s) const {
@@ -203,9 +47,9 @@
     s << "{ return " << name_ << "View(packet); }";
   }
 
-  std::set<PacketField::Type> fixed_types = {
-      PacketField::Type::FIXED_SCALAR,
-      PacketField::Type::FIXED_ENUM,
+  std::set<std::string> fixed_types = {
+      FixedScalarField::kFieldType,
+      FixedEnumField::kFieldType,
   };
 
   // Print all of the public fields which are all the fields minus the fixed fields.
@@ -246,148 +90,24 @@
   auto end_field_offset = GetOffsetForField(field->GetName(), true);
 
   if (start_field_offset.empty() && end_field_offset.empty()) {
-    std::cerr << "Field location for " << field->GetName() << " is ambiguous, "
-              << "no method exists to determine field location from begin() or end().\n";
-    abort();
+    ERROR(field) << "Field location for " << field->GetName() << " is ambiguous, "
+                 << "no method exists to determine field location from begin() or end().\n";
   }
 
   field->GenGetter(s, start_field_offset, end_field_offset);
 }
 
-void PacketDef::GenSerialize(std::ostream& s) const {
-  auto header_fields = fields_.GetFieldsBeforePayloadOrBody();
-  auto footer_fields = fields_.GetFieldsAfterPayloadOrBody();
-
-  s << "protected:";
-  s << "void SerializeHeader(BitInserter&";
-  if (parent_ != nullptr || header_fields.size() != 0) {
-    s << " i ";
-  }
-  s << ") const {";
-
-  if (parent_ != nullptr) {
-    s << parent_->name_ << "Builder::SerializeHeader(i);";
-  }
-
-  for (const auto& field : header_fields) {
-    if (field->GetFieldType() == PacketField::Type::SIZE) {
-      const auto& field_name = ((SizeField*)field)->GetSizedFieldName();
-      const auto& sized_field = fields_.GetField(field_name);
-      if (sized_field == nullptr) {
-        ERROR(field) << __func__ << "Can't find sized field named " << field_name;
-      }
-      if (sized_field->GetFieldType() == PacketField::Type::PAYLOAD) {
-        s << "size_t payload_bytes = GetPayloadSize();";
-        std::string modifier = ((PayloadField*)sized_field)->size_modifier_;
-        if (modifier != "") {
-          s << "static_assert((" << modifier << ")%8 == 0, \"Modifiers must be byte-aligned\");";
-          s << "payload_bytes = payload_bytes + (" << modifier << ") / 8;";
-        }
-        s << "ASSERT(payload_bytes < (static_cast<size_t>(1) << " << field->GetSize().bits() << "));";
-        s << "insert(static_cast<" << field->GetType() << ">(payload_bytes), i," << field->GetSize().bits() << ");";
-      } else {
-        ERROR(field) << __func__ << "Unhandled sized field type for " << field_name;
-      }
-    } else if (field->GetFieldType() == PacketField::Type::CHECKSUM_START) {
-      const auto& field_name = ((ChecksumStartField*)field)->GetStartedFieldName();
-      const auto& started_field = fields_.GetField(field_name);
-      if (started_field == nullptr) {
-        ERROR(field) << __func__ << ": Can't find checksum field named " << field_name << "(" << field->GetName()
-                     << ")";
-      }
-      s << "auto shared_checksum_ptr = std::make_shared<" << started_field->GetType() << ">();";
-      s << started_field->GetType() << "::Initialize(*shared_checksum_ptr);";
-      s << "i.RegisterObserver(packet::ByteObserver(";
-      s << "[shared_checksum_ptr](uint8_t byte){" << started_field->GetType()
-        << "::AddByte(*shared_checksum_ptr, byte);},";
-      s << "[shared_checksum_ptr](){ return static_cast<uint64_t>(" << started_field->GetType()
-        << "::GetChecksum(*shared_checksum_ptr));}));";
-    } else {
-      field->GenInserter(s);
-    }
-  }
-  s << "}\n\n";
-
-  s << "void SerializeFooter(BitInserter&";
-  if (parent_ != nullptr || footer_fields.size() != 0) {
-    s << " i ";
-  }
-  s << ") const {";
-
-  for (const auto& field : footer_fields) {
-    field->GenInserter(s);
-  }
-  if (parent_ != nullptr) {
-    s << parent_->name_ << "Builder::SerializeFooter(i);";
-  }
-  s << "}\n\n";
-
-  s << "public:";
-  s << "virtual void Serialize(BitInserter& i) const override {";
-  s << "SerializeHeader(i);";
-  if (fields_.HasPayload()) {
-    s << "payload_->Serialize(i);";
-  }
-  s << "SerializeFooter(i);";
-
-  s << "}\n";
-}
-
-void PacketDef::GenBuilderSize(std::ostream& s) const {
-  auto header_fields = fields_.GetFieldsBeforePayloadOrBody();
-  auto footer_fields = fields_.GetFieldsAfterPayloadOrBody();
-
-  s << "protected:";
-  s << "size_t BitsOfHeader() const {";
-  s << "return ";
-
-  if (parent_ != nullptr) {
-    s << parent_->name_ << "Builder::BitsOfHeader() + ";
-  }
-
-  size_t header_bits = 0;
-  for (const auto& field : header_fields) {
-    header_bits += field->GetSize().bits();
-  }
-  s << header_bits << ";";
-
-  s << "}\n\n";
-
-  s << "size_t BitsOfFooter() const {";
-  s << "return ";
-  size_t footer_bits = 0;
-  for (const auto& field : footer_fields) {
-    footer_bits += field->GetSize().bits();
-  }
-
-  if (parent_ != nullptr) {
-    s << parent_->name_ << "Builder::BitsOfFooter() + ";
-  }
-  s << footer_bits << ";";
-  s << "}\n\n";
-
-  if (fields_.HasPayload()) {
-    s << "size_t GetPayloadSize() const {";
-    s << "if (payload_ != nullptr) {return payload_->size();}";
-    s << "else { return size() - (BitsOfHeader() + BitsOfFooter()) / 8;}";
-    s << ";}\n\n";
-  }
-
-  s << "public:";
-  s << "virtual size_t size() const override {";
-  s << "return (BitsOfHeader() / 8)";
-  if (fields_.HasPayload()) {
-    s << "+ payload_->size()";
-  }
-  s << " + (BitsOfFooter() / 8);";
-  s << "}\n";
+TypeDef::Type PacketDef::GetDefinitionType() const {
+  return TypeDef::Type::PACKET;
 }
 
 void PacketDef::GenValidator(std::ostream& s) const {
   // Get the static offset for all of our fields.
   int bits_size = 0;
   for (const auto& field : fields_) {
-    bits_size += field->GetSize().bits();
+    if (field->GetFieldType() != PaddingField::kFieldType) {
+      bits_size += field->GetSize().bits();
+    }
   }
 
   // Write the function declaration.
@@ -402,12 +122,12 @@
   // Offset by the parents known size. We know that any dynamic fields can
   // already be called since the parent must have already been validated by
   // this point.
-  auto parent_size = Size();
+  auto parent_size = Size(0);
   if (parent_ != nullptr) {
     parent_size = parent_->GetSize(true);
   }
 
-  s << "auto it = begin() + " << parent_size.bytes() << " + (" << parent_size.dynamic_string() << ");";
+  s << "auto it = begin() + (" << parent_size << ") / 8;";
 
   // Check if you can extract the static fields.
   // At this point you know you can use the size getters without crashing
@@ -418,16 +138,16 @@
 
   // For any variable length fields, use their size check.
   for (const auto& field : fields_) {
-    if (field->GetFieldType() == PacketField::Type::CHECKSUM_START) {
+    if (field->GetFieldType() == ChecksumStartField::kFieldType) {
       auto offset = GetOffsetForField(field->GetName(), false);
       if (!offset.empty()) {
-        s << "size_t sum_index = " << offset.bytes() << " + (" << offset.dynamic_string() << ");";
+        s << "size_t sum_index = (" << offset << ") / 8;";
       } else {
         offset = GetOffsetForField(field->GetName(), true);
         if (offset.empty()) {
           ERROR(field) << "Checksum Start Field offset can not be determined.";
         }
-        s << "size_t sum_index = size() - " << offset.bytes() << " - (" << offset.dynamic_string() << ");";
+        s << "size_t sum_index = size() - (" << offset << ") / 8;";
       }
 
       const auto& field_name = ((ChecksumStartField*)field)->GetStartedFieldName();
@@ -438,25 +158,24 @@
       }
       auto end_offset = GetOffsetForField(started_field->GetName(), false);
       if (!end_offset.empty()) {
-        s << "size_t end_sum_index = " << end_offset.bytes() << " + (" << end_offset.dynamic_string() << ");";
+        s << "size_t end_sum_index = (" << end_offset << ") / 8;";
       } else {
         end_offset = GetOffsetForField(started_field->GetName(), true);
         if (end_offset.empty()) {
           ERROR(started_field) << "Checksum Field end_offset can not be determined.";
         }
-        s << "size_t end_sum_index = size() - " << started_field->GetSize().bytes() << " - " << end_offset.bytes()
-          << " - (" << end_offset.dynamic_string() << ");";
+        s << "size_t end_sum_index = size() - (" << started_field->GetSize() << " - " << end_offset << ") / 8;";
       }
       if (is_little_endian_) {
         s << "auto checksum_view = GetLittleEndianSubview(sum_index, end_sum_index);";
       } else {
         s << "auto checksum_view = GetBigEndianSubview(sum_index, end_sum_index);";
       }
-      s << started_field->GetType() << " checksum;";
-      s << started_field->GetType() << "::Initialize(checksum);";
+      s << started_field->GetDataType() << " checksum;";
+      s << "checksum.Initialize();";
       s << "for (uint8_t byte : checksum_view) { ";
-      s << started_field->GetType() << "::AddByte(checksum, byte);}";
-      s << "if (" << started_field->GetType() << "::GetChecksum(checksum) != (begin() + end_sum_index).extract<"
+      s << "checksum.AddByte(byte);}";
+      s << "if (checksum.GetChecksum() != (begin() + end_sum_index).extract<"
         << util::GetTypeForSize(started_field->GetSize().bits()) << ">()) { return false; }";
 
       continue;
@@ -471,9 +190,7 @@
     // Custom fields with dynamic size must have the offset for the field passed in as well
     // as the end iterator so that they may ensure that they don't try to read past the end.
     // Custom fields with fixed sizes will be handled in the static offset checking.
-    if (field->GetFieldType() == PacketField::Type::CUSTOM) {
-      const auto& custom_size_var = field->GetName() + "_size";
-
+    if (field->GetFieldType() == CustomField::kFieldType) {
       // Check if we can determine offset from begin(), otherwise error because by this point,
       // the size of the custom field is unknown and can't be subtracted from end() to get the
       // offset.
@@ -487,15 +204,16 @@
       }
 
       // Custom fields are special as their size field takes an argument.
+      const auto& custom_size_var = field->GetName() + "_size";
       s << "const auto& " << custom_size_var << " = " << field_size.dynamic_string();
-      s << "(begin() + " << offset.bytes() << " + (" << offset.dynamic_string() << "));";
+      s << "(begin() + (" << offset << ") / 8);";
 
       s << "if (!" << custom_size_var << ".has_value()) { return false; }";
       s << "it += *" << custom_size_var << ";";
       s << "if (it > end()) return false;";
       continue;
     } else {
-      s << "it += " << field_size.dynamic_string() << ";";
+      s << "it += (" << field_size.dynamic_string() << ") / 8;";
       s << "if (it > end()) return false;";
     }
   }
@@ -508,7 +226,7 @@
   for (const auto& constraint : parent_constraints_) {
     s << "if (Get" << util::UnderscoreToCamelCase(constraint.first) << "() != ";
     const auto& field = parent_->GetParamList().GetField(constraint.first);
-    if (field->GetFieldType() == PacketField::Type::SCALAR) {
+    if (field->GetFieldType() == ScalarField::kFieldType) {
       s << std::get<int64_t>(constraint.second);
     } else {
       s << std::get<std::string>(constraint.second);
@@ -552,7 +270,7 @@
   GenSerialize(s);
   s << "\n";
 
-  GenBuilderSize(s);
+  GenSize(s);
   s << "\n";
 
   s << " protected:\n";
@@ -562,31 +280,108 @@
   GenBuilderParameterChecker(s);
   s << "\n";
 
-  GenBuilderMembers(s);
+  GenMembers(s);
   s << "};\n";
+
+  GenTestDefine(s);
+  s << "\n";
+
+  GenFuzzTestDefine(s);
+  s << "\n";
 }
 
-FieldList PacketDef::GetParamList() const {
-  FieldList params;
-
-  std::set<PacketField::Type> param_types = {
-      PacketField::Type::SCALAR, PacketField::Type::ENUM,    PacketField::Type::CUSTOM,
-      PacketField::Type::BODY,   PacketField::Type::PAYLOAD,
-  };
-
-  if (parent_ != nullptr) {
-    auto parent_params = parent_->GetParamList().GetFieldsWithTypes(param_types);
-
-    // Do not include constrained fields in the params
-    for (const auto& field : parent_params) {
-      if (parent_constraints_.find(field->GetName()) == parent_constraints_.end()) {
-        params.AppendField(field);
-      }
+void PacketDef::GenTestDefine(std::ostream& s) const {
+  s << "#ifdef PACKET_TESTING\n";
+  s << "#define DEFINE_AND_INSTANTIATE_" << name_ << "ReflectionTest(...)";
+  s << "class " << name_ << "ReflectionTest : public testing::TestWithParam<std::vector<uint8_t>> { ";
+  s << "public: ";
+  s << "void CompareBytes(std::vector<uint8_t> captured_packet) {";
+  s << "auto vec = std::make_shared<std::vector<uint8_t>>(captured_packet.begin(), captured_packet.end());";
+  s << name_ << "View view = " << name_ << "View::Create(";
+  auto ancestor_ptr = parent_;
+  size_t parent_parens = 0;
+  while (ancestor_ptr != nullptr) {
+    s << ancestor_ptr->name_ << "View::Create(";
+    parent_parens++;
+    ancestor_ptr = ancestor_ptr->parent_;
+  }
+  s << "vec";
+  for (size_t i = 0; i < parent_parens; i++) {
+    s << ")";
+  }
+  s << ");";
+  s << "if (!view.IsValid()) { LOG_INFO(\"Invalid Packet Bytes (size = %zu)\", view.size());";
+  s << "for (size_t i = 0; i < view.size(); i++) { LOG_DEBUG(\"%5zd:%02X\", i, *(view.begin() + i)); }}";
+  s << "ASSERT_TRUE(view.IsValid());";
+  s << "auto packet = " << name_ << "Builder::Create(";
+  FieldList params = GetParamList().GetFieldsWithoutTypes({
+      BodyField::kFieldType,
+  });
+  for (int i = 0; i < params.size(); i++) {
+    params[i]->GenBuilderParameterFromView(s);
+    if (i != params.size() - 1) {
+      s << ", ";
     }
   }
+  s << ");";
+  s << "std::shared_ptr<std::vector<uint8_t>> packet_bytes = std::make_shared<std::vector<uint8_t>>();";
+  s << "packet_bytes->reserve(packet->size());";
+  s << "BitInserter it(*packet_bytes);";
+  s << "packet->Serialize(it);";
+  s << "ASSERT_EQ(*packet_bytes, *vec);";
+  s << "}";
+  s << "};";
+  s << "TEST_P(" << name_ << "ReflectionTest, generatedReflectionTest) {";
+  s << "CompareBytes(GetParam());";
+  s << "}";
+  s << "INSTANTIATE_TEST_SUITE_P(" << name_ << "_reflection, ";
+  s << name_ << "ReflectionTest, testing::Values(__VA_ARGS__))";
+  s << "\n#endif";
+}
 
-  // Add the parameters for this packet.
-  return params.Merge(fields_.GetFieldsWithTypes(param_types));
+void PacketDef::GenFuzzTestDefine(std::ostream& s) const {
+  s << "#ifdef PACKET_FUZZ_TESTING\n";
+  s << "#define DEFINE_AND_REGISTER_" << name_ << "ReflectionFuzzTest(REGISTRY) ";
+  s << "void Run" << name_ << "ReflectionFuzzTest(const uint8_t* data, size_t size) {";
+  s << "auto vec = std::make_shared<std::vector<uint8_t>>(data, data + size);";
+  s << name_ << "View view = " << name_ << "View::Create(";
+  auto ancestor_ptr = parent_;
+  size_t parent_parens = 0;
+  while (ancestor_ptr != nullptr) {
+    s << ancestor_ptr->name_ << "View::Create(";
+    parent_parens++;
+    ancestor_ptr = ancestor_ptr->parent_;
+  }
+  s << "vec";
+  for (size_t i = 0; i < parent_parens; i++) {
+    s << ")";
+  }
+  s << ");";
+  s << "if (!view.IsValid()) { return; }";
+  s << "auto packet = " << name_ << "Builder::Create(";
+  FieldList params = GetParamList().GetFieldsWithoutTypes({
+      BodyField::kFieldType,
+  });
+  for (int i = 0; i < params.size(); i++) {
+    params[i]->GenBuilderParameterFromView(s);
+    if (i != params.size() - 1) {
+      s << ", ";
+    }
+  }
+  s << ");";
+  s << "std::shared_ptr<std::vector<uint8_t>> packet_bytes = std::make_shared<std::vector<uint8_t>>();";
+  s << "packet_bytes->reserve(packet->size());";
+  s << "BitInserter it(*packet_bytes);";
+  s << "packet->Serialize(it);";
+  s << "}";
+  s << " class " << name_ << "ReflectionFuzzTestRegistrant {";
+  s << "public: ";
+  s << "explicit " << name_
+    << "ReflectionFuzzTestRegistrant(std::vector<void(*)(const uint8_t*, size_t)>& fuzz_test_registry) {";
+  s << "fuzz_test_registry.push_back(Run" << name_ << "ReflectionFuzzTest);";
+  s << "}}; ";
+  s << name_ << "ReflectionFuzzTestRegistrant " << name_ << "_reflection_fuzz_test_registrant(REGISTRY);";
+  s << "\n#endif";
 }
 
 FieldList PacketDef::GetParametersToValidate() const {
@@ -615,12 +410,16 @@
   s << "auto builder = std::unique_ptr<" << name_ << "Builder>(new " << name_ << "Builder(";
 
   params = params.GetFieldsWithoutTypes({
-      PacketField::Type::PAYLOAD,
-      PacketField::Type::BODY,
+      PayloadField::kFieldType,
+      BodyField::kFieldType,
   });
   // Add the parameters.
   for (int i = 0; i < params.size(); i++) {
-    s << params[i]->GetName();
+    if (params[i]->BuilderParameterMustBeMoved()) {
+      s << "std::move(" << params[i]->GetName() << ")";
+    } else {
+      s << params[i]->GetName();
+    }
     if (i != params.size() - 1) {
       s << ", ";
     }
@@ -664,8 +463,8 @@
 
   // Generate the constructor parameters.
   auto params = GetParamList().GetFieldsWithoutTypes({
-      PacketField::Type::PAYLOAD,
-      PacketField::Type::BODY,
+      PayloadField::kFieldType,
+      BodyField::kFieldType,
   });
   for (int i = 0; i < params.size(); i++) {
     params[i]->GenBuilderParameter(s);
@@ -673,7 +472,11 @@
       s << ", ";
     }
   }
-  s << ") :";
+  if (params.size() > 0 || parent_constraints_.size() > 0) {
+    s << ") :";
+  } else {
+    s << ")";
+  }
 
   // Get the list of parent params to call the parent constructor with.
   FieldList parent_params;
@@ -681,8 +484,8 @@
     // Pass parameters to the parent constructor
     s << parent_->name_ << "Builder(";
     parent_params = parent_->GetParamList().GetFieldsWithoutTypes({
-        PacketField::Type::PAYLOAD,
-        PacketField::Type::BODY,
+        PayloadField::kFieldType,
+        BodyField::kFieldType,
     });
 
     // Go through all the fields and replace constrained fields with fixed values
@@ -691,9 +494,9 @@
       const auto& field = parent_params[i];
       const auto& constraint = parent_constraints_.find(field->GetName());
       if (constraint != parent_constraints_.end()) {
-        if (field->GetFieldType() == PacketField::Type::SCALAR) {
+        if (field->GetFieldType() == ScalarField::kFieldType) {
           s << std::get<int64_t>(constraint->second);
-        } else if (field->GetFieldType() == PacketField::Type::ENUM) {
+        } else if (field->GetFieldType() == EnumField::kFieldType) {
           s << std::get<std::string>(constraint->second);
         } else {
           ERROR(field) << "Constraints on non enum/scalar fields should be impossible.";
@@ -723,7 +526,11 @@
   }
   for (int i = 0; i < saved_params.size(); i++) {
     const auto& saved_param_name = saved_params[i]->GetName();
-    s << saved_param_name << "_(" << saved_param_name << ")";
+    if (saved_params[i]->BuilderParameterMustBeMoved()) {
+      s << saved_param_name << "_(std::move(" << saved_param_name << "))";
+    } else {
+      s << saved_param_name << "_(" << saved_param_name << ")";
+    }
     if (i != saved_params.size() - 1) {
       s << ",";
     }
@@ -745,12 +552,3 @@
 
   s << "}\n";
 }
-
-void PacketDef::GenBuilderMembers(std::ostream& s) const {
-  // Add the parameter list.
-  for (int i = 0; i < fields_.size(); i++) {
-    if (fields_[i]->GenBuilderParameter(s)) {
-      s << "_;";
-    }
-  }
-}
diff --git a/gd/packet/parser/packet_def.h b/gd/packet/parser/packet_def.h
index 647fc4d..1dc2f8a 100644
--- a/gd/packet/parser/packet_def.h
+++ b/gd/packet/parser/packet_def.h
@@ -22,46 +22,28 @@
 #include "enum_def.h"
 #include "field_list.h"
 #include "fields/packet_field.h"
+#include "parent_def.h"
 
-class PacketDef {
+class PacketDef : public ParentDef {
  public:
   PacketDef(std::string name, FieldList fields);
   PacketDef(std::string name, FieldList fields, PacketDef* parent);
 
-  void AddParentConstraint(std::string field_name, std::variant<int64_t, std::string> value);
-
-  // Assign all size fields to their corresponding variable length fields.
-  // Will crash if
-  //  - there aren't any fields that don't match up to a field.
-  //  - the size field points to a fixed size field.
-  //  - if the size field comes after the variable length field.
-  void AssignSizeFields();
-
-  void SetEndianness(bool is_little_endian);
-
-  // Get the size for the packet. You scan specify without_payload in order
-  // to exclude payload fields as child packets will be overriding it.
-  Size GetSize(bool without_payload = false) const;
-
-  // Get the offset until the field is reached, if there is no field
-  // returns an empty Size. from_end requests the offset to the field
-  // starting from the end() iterator. If there is a field with an unknown
-  // size along the traversal, then an empty size is returned.
-  Size GetOffsetForField(std::string field_name, bool from_end = false) const;
+  PacketField* GetNewField(const std::string& name, ParseLocation loc) const;
 
   void GenParserDefinition(std::ostream& s) const;
 
   void GenParserFieldGetter(std::ostream& s, const PacketField* field) const;
 
-  void GenSerialize(std::ostream& s) const;
-
-  void GenBuilderSize(std::ostream& s) const;
-
   void GenValidator(std::ostream& s) const;
 
+  TypeDef::Type GetDefinitionType() const;
+
   void GenBuilderDefinition(std::ostream& s) const;
 
-  FieldList GetParamList() const;
+  void GenTestDefine(std::ostream& s) const;
+
+  void GenFuzzTestDefine(std::ostream& s) const;
 
   FieldList GetParametersToValidate() const;
 
@@ -70,17 +52,4 @@
   void GenBuilderParameterChecker(std::ostream& s) const;
 
   void GenBuilderConstructor(std::ostream& s) const;
-
-  void GenBuilderMembers(std::ostream& s) const;
-
-  std::string name_;
-  FieldList fields_;
-
-  std::variant<std::monostate, std::string, EnumDef*> specialize_on_;
-  std::variant<std::monostate, int, std::string> specialization_value_;
-
-  PacketDef* parent_;  // Parent packet type
-
-  std::map<std::string, std::variant<int64_t, std::string>> parent_constraints_;
-  bool is_little_endian_;
 };
diff --git a/gd/packet/parser/parent_def.cc b/gd/packet/parser/parent_def.cc
new file mode 100644
index 0000000..1557bf6
--- /dev/null
+++ b/gd/packet/parser/parent_def.cc
@@ -0,0 +1,461 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "parent_def.h"
+
+#include "fields/all_fields.h"
+#include "util.h"
+
+ParentDef::ParentDef(std::string name, FieldList fields) : ParentDef(name, fields, nullptr) {}
+ParentDef::ParentDef(std::string name, FieldList fields, ParentDef* parent)
+    : TypeDef(name), fields_(fields), parent_(parent) {}
+
+void ParentDef::AddParentConstraint(std::string field_name, std::variant<int64_t, std::string> value) {
+  // NOTE: This could end up being very slow if there are a lot of constraints.
+  const auto& parent_params = parent_->GetParamList();
+  const auto& constrained_field = parent_params.GetField(field_name);
+  if (constrained_field == nullptr) {
+    ERROR() << "Attempting to constrain field " << field_name << " in parent " << parent_->name_
+            << ", but no such field exists.";
+  }
+
+  if (constrained_field->GetFieldType() == ScalarField::kFieldType) {
+    if (!std::holds_alternative<int64_t>(value)) {
+      ERROR(constrained_field) << "Attempting to constrain a scalar field to an enum value in " << parent_->name_;
+    }
+  } else if (constrained_field->GetFieldType() == EnumField::kFieldType) {
+    if (!std::holds_alternative<std::string>(value)) {
+      ERROR(constrained_field) << "Attempting to constrain an enum field to a scalar value in " << parent_->name_;
+    }
+    const auto& enum_def = static_cast<EnumField*>(constrained_field)->GetEnumDef();
+    if (!enum_def.HasEntry(std::get<std::string>(value))) {
+      ERROR(constrained_field) << "No matching enumeration \"" << std::get<std::string>(value)
+                               << "\" for constraint on enum in parent " << parent_->name_ << ".";
+    }
+
+    // For enums, we have to qualify the value using the enum type name.
+    value = enum_def.GetTypeName() + "::" + std::get<std::string>(value);
+  } else {
+    ERROR(constrained_field) << "Field in parent " << parent_->name_ << " is not viable for constraining.";
+  }
+
+  parent_constraints_.insert(std::pair(field_name, value));
+}
+
+// Assign all size fields to their corresponding variable length fields.
+// Will crash if
+//  - there aren't any fields that don't match up to a field.
+//  - the size field points to a fixed size field.
+//  - if the size field comes after the variable length field.
+void ParentDef::AssignSizeFields() {
+  for (const auto& field : fields_) {
+    DEBUG() << "field name: " << field->GetName();
+
+    if (field->GetFieldType() != SizeField::kFieldType && field->GetFieldType() != CountField::kFieldType) {
+      continue;
+    }
+
+    const SizeField* size_field = static_cast<SizeField*>(field);
+    // Check to see if a corresponding field can be found.
+    const auto& var_len_field = fields_.GetField(size_field->GetSizedFieldName());
+    if (var_len_field == nullptr) {
+      ERROR(field) << "Could not find corresponding field for size/count field.";
+    }
+
+    // Do the ordering check to ensure the size field comes before the
+    // variable length field.
+    for (auto it = fields_.begin(); *it != size_field; it++) {
+      DEBUG() << "field name: " << (*it)->GetName();
+      if (*it == var_len_field) {
+        ERROR(var_len_field, size_field) << "Size/count field must come before the variable length field it describes.";
+      }
+    }
+
+    if (var_len_field->GetFieldType() == PayloadField::kFieldType) {
+      const auto& payload_field = static_cast<PayloadField*>(var_len_field);
+      payload_field->SetSizeField(size_field);
+      continue;
+    }
+
+    if (var_len_field->GetFieldType() == VectorField::kFieldType) {
+      const auto& vector_field = static_cast<VectorField*>(var_len_field);
+      vector_field->SetSizeField(size_field);
+      continue;
+    }
+
+    // If we've reached this point then the field wasn't a variable length field.
+    // Check to see if the field is a variable length field
+    ERROR(field, size_field) << "Can not use size/count in reference to a fixed size field.\n";
+  }
+}
+
+void ParentDef::SetEndianness(bool is_little_endian) {
+  is_little_endian_ = is_little_endian;
+}
+
+// Get the size. You scan specify without_payload in order to exclude payload fields as children will be overriding it.
+Size ParentDef::GetSize(bool without_payload) const {
+  auto size = Size(0);
+
+  for (const auto& field : fields_) {
+    if (without_payload &&
+        (field->GetFieldType() == PayloadField::kFieldType || field->GetFieldType() == BodyField::kFieldType)) {
+      continue;
+    }
+
+    // The offset to the field must be passed in as an argument for dynamically sized custom fields.
+    if (field->GetFieldType() == CustomField::kFieldType && field->GetSize().has_dynamic()) {
+      std::stringstream custom_field_size;
+
+      // Custom fields are special as their size field takes an argument.
+      custom_field_size << field->GetSize().dynamic_string() << "(begin()";
+
+      // Check if we can determine offset from begin(), otherwise error because by this point,
+      // the size of the custom field is unknown and can't be subtracted from end() to get the
+      // offset.
+      auto offset = GetOffsetForField(field->GetName(), false);
+      if (offset.empty()) {
+        ERROR(field) << "Custom Field offset can not be determined from begin().";
+      }
+
+      if (offset.bits() % 8 != 0) {
+        ERROR(field) << "Custom fields must be byte aligned.";
+      }
+      if (offset.has_bits()) custom_field_size << " + " << offset.bits() / 8;
+      if (offset.has_dynamic()) custom_field_size << " + " << offset.dynamic_string();
+      custom_field_size << ")";
+
+      size += custom_field_size.str();
+      continue;
+    }
+
+    size += field->GetSize();
+  }
+
+  if (parent_ != nullptr) {
+    size += parent_->GetSize(true);
+  }
+
+  return size;
+}
+
+// Get the offset until the field is reached, if there is no field
+// returns an empty Size. from_end requests the offset to the field
+// starting from the end() iterator. If there is a field with an unknown
+// size along the traversal, then an empty size is returned.
+Size ParentDef::GetOffsetForField(std::string field_name, bool from_end) const {
+  // Check first if the field exists.
+  if (fields_.GetField(field_name) == nullptr) {
+    ERROR() << "Can't find a field offset for nonexistent field named: " << field_name << " in " << name_;
+  }
+
+  // We have to use a generic lambda to conditionally change iteration direction
+  // due to iterator and reverse_iterator being different types.
+  auto size_lambda = [&](auto from, auto to) -> Size {
+    auto size = Size(0);
+    for (auto it = from; it != to; it++) {
+      // We've reached the field, end the loop.
+      if ((*it)->GetName() == field_name) break;
+      const auto& field = *it;
+      // If there is a field with an unknown size before the field, return an empty Size.
+      if (field->GetSize().empty()) {
+        return Size();
+      }
+      if (field->GetFieldType() != PaddingField::kFieldType || !from_end) {
+        size += field->GetSize();
+      }
+    }
+    return size;
+  };
+
+  // Change iteration direction based on from_end.
+  auto size = Size();
+  if (from_end)
+    size = size_lambda(fields_.rbegin(), fields_.rend());
+  else
+    size = size_lambda(fields_.begin(), fields_.end());
+  if (size.empty()) return size;
+
+  // We need the offset until a payload or body field.
+  if (parent_ != nullptr) {
+    if (parent_->fields_.HasPayload()) {
+      auto parent_payload_offset = parent_->GetOffsetForField("payload", from_end);
+      if (parent_payload_offset.empty()) {
+        ERROR() << "Empty offset for payload in " << parent_->name_ << " finding the offset for field: " << field_name;
+      }
+      size += parent_payload_offset;
+    } else {
+      auto parent_body_offset = parent_->GetOffsetForField("body", from_end);
+      if (parent_body_offset.empty()) {
+        ERROR() << "Empty offset for body in " << parent_->name_ << " finding the offset for field: " << field_name;
+      }
+      size += parent_body_offset;
+    }
+  }
+
+  return size;
+}
+
+FieldList ParentDef::GetParamList() const {
+  FieldList params;
+
+  std::set<std::string> param_types = {
+      ScalarField::kFieldType,
+      EnumField::kFieldType,
+      ArrayField::kFieldType,
+      VectorField::kFieldType,
+      CustomField::kFieldType,
+      StructField::kFieldType,
+      VariableLengthStructField::kFieldType,
+      PayloadField::kFieldType,
+  };
+
+  if (parent_ != nullptr) {
+    auto parent_params = parent_->GetParamList().GetFieldsWithTypes(param_types);
+
+    // Do not include constrained fields in the params
+    for (const auto& field : parent_params) {
+      if (parent_constraints_.find(field->GetName()) == parent_constraints_.end()) {
+        params.AppendField(field);
+      }
+    }
+  }
+  // Add our parameters.
+  return params.Merge(fields_.GetFieldsWithTypes(param_types));
+}
+
+void ParentDef::GenMembers(std::ostream& s) const {
+  // Add the parameter list.
+  for (int i = 0; i < fields_.size(); i++) {
+    if (fields_[i]->GenBuilderMember(s)) {
+      s << "_;";
+    }
+  }
+}
+
+void ParentDef::GenSize(std::ostream& s) const {
+  auto header_fields = fields_.GetFieldsBeforePayloadOrBody();
+  auto footer_fields = fields_.GetFieldsAfterPayloadOrBody();
+
+  s << "protected:";
+  s << "size_t BitsOfHeader() const {";
+  s << "return 0";
+
+  if (parent_ != nullptr) {
+    if (parent_->GetDefinitionType() == Type::PACKET) {
+      s << " + " << parent_->name_ << "Builder::BitsOfHeader() ";
+    } else {
+      s << " + " << parent_->name_ << "::BitsOfHeader() ";
+    }
+  }
+
+  for (const auto& field : header_fields) {
+    s << " + " << field->GetBuilderSize();
+  }
+  s << ";";
+
+  s << "}\n\n";
+
+  s << "size_t BitsOfFooter() const {";
+  s << "return 0";
+  for (const auto& field : footer_fields) {
+    s << " + " << field->GetBuilderSize();
+  }
+
+  if (parent_ != nullptr) {
+    if (parent_->GetDefinitionType() == Type::PACKET) {
+      s << " + " << parent_->name_ << "Builder::BitsOfFooter() ";
+    } else {
+      s << " + " << parent_->name_ << "::BitsOfFooter() ";
+    }
+  }
+  s << ";";
+  s << "}\n\n";
+
+  if (fields_.HasPayload()) {
+    s << "size_t GetPayloadSize() const {";
+    s << "if (payload_ != nullptr) {return payload_->size();}";
+    s << "else { return size() - (BitsOfHeader() + BitsOfFooter()) / 8;}";
+    s << ";}\n\n";
+  }
+
+  Size padded_size;
+  for (const auto& field : header_fields) {
+    if (field->GetFieldType() == PaddingField::kFieldType) {
+      if (!padded_size.empty()) {
+        ERROR() << "Only one padding field is allowed.  Second field: " << field->GetName();
+      }
+      padded_size = field->GetSize();
+    }
+  }
+
+  s << "public:";
+  s << "virtual size_t size() const override {";
+  if (!padded_size.empty()) {
+    s << "return " << padded_size.bytes() << ";}";
+    s << "size_t unpadded_size() const {";
+  }
+  s << "return (BitsOfHeader() / 8)";
+  if (fields_.HasPayload()) {
+    s << "+ payload_->size()";
+  }
+  s << " + (BitsOfFooter() / 8);";
+  s << "}\n";
+}
+
+void ParentDef::GenSerialize(std::ostream& s) const {
+  auto header_fields = fields_.GetFieldsBeforePayloadOrBody();
+  auto footer_fields = fields_.GetFieldsAfterPayloadOrBody();
+
+  s << "protected:";
+  s << "void SerializeHeader(BitInserter&";
+  if (parent_ != nullptr || header_fields.size() != 0) {
+    s << " i ";
+  }
+  s << ") const {";
+
+  if (parent_ != nullptr) {
+    if (parent_->GetDefinitionType() == Type::PACKET) {
+      s << parent_->name_ << "Builder::SerializeHeader(i);";
+    } else {
+      s << parent_->name_ << "::SerializeHeader(i);";
+    }
+  }
+
+  for (const auto& field : header_fields) {
+    if (field->GetFieldType() == SizeField::kFieldType) {
+      const auto& field_name = ((SizeField*)field)->GetSizedFieldName();
+      const auto& sized_field = fields_.GetField(field_name);
+      if (sized_field == nullptr) {
+        ERROR(field) << __func__ << ": Can't find sized field named " << field_name;
+      }
+      if (sized_field->GetFieldType() == PayloadField::kFieldType) {
+        s << "size_t payload_bytes = GetPayloadSize();";
+        std::string modifier = ((PayloadField*)sized_field)->size_modifier_;
+        if (modifier != "") {
+          s << "static_assert((" << modifier << ")%8 == 0, \"Modifiers must be byte-aligned\");";
+          s << "payload_bytes = payload_bytes + (" << modifier << ") / 8;";
+        }
+        s << "ASSERT(payload_bytes < (static_cast<size_t>(1) << " << field->GetSize().bits() << "));";
+        s << "insert(static_cast<" << field->GetDataType() << ">(payload_bytes), i," << field->GetSize().bits() << ");";
+      } else {
+        if (sized_field->GetFieldType() != VectorField::kFieldType) {
+          ERROR(field) << __func__ << ": Unhandled sized field type for " << field_name;
+        }
+        const auto& vector_name = field_name + "_";
+        const VectorField* vector = (VectorField*)sized_field;
+        s << "size_t " << vector_name + "bytes = 0;";
+        if (vector->element_size_.empty() || vector->element_size_.has_dynamic()) {
+          s << "for (auto elem : " << vector_name << ") {";
+          s << vector_name + "bytes += elem.size(); }";
+        } else {
+          s << vector_name + "bytes = ";
+          s << vector_name << ".size() * ((" << vector->element_size_ << ") / 8);";
+        }
+        std::string modifier = vector->GetSizeModifier();
+        if (modifier != "") {
+          s << "static_assert((" << modifier << ")%8 == 0, \"Modifiers must be byte-aligned\");";
+          s << vector_name << "bytes = ";
+          s << vector_name << "bytes + (" << modifier << ") / 8;";
+        }
+        s << "ASSERT(" << vector_name + "bytes < (1 << " << field->GetSize().bits() << "));";
+        s << "insert(" << vector_name << "bytes, i, ";
+        s << field->GetSize().bits() << ");";
+      }
+    } else if (field->GetFieldType() == ChecksumStartField::kFieldType) {
+      const auto& field_name = ((ChecksumStartField*)field)->GetStartedFieldName();
+      const auto& started_field = fields_.GetField(field_name);
+      if (started_field == nullptr) {
+        ERROR(field) << __func__ << ": Can't find checksum field named " << field_name << "(" << field->GetName()
+                     << ")";
+      }
+      s << "auto shared_checksum_ptr = std::make_shared<" << started_field->GetDataType() << ">();";
+      s << "shared_checksum_ptr->Initialize();";
+      s << "i.RegisterObserver(packet::ByteObserver(";
+      s << "[shared_checksum_ptr](uint8_t byte){ shared_checksum_ptr->AddByte(byte);},";
+      s << "[shared_checksum_ptr](){ return static_cast<uint64_t>(shared_checksum_ptr->GetChecksum());}));";
+    } else if (field->GetFieldType() == PaddingField::kFieldType) {
+      s << "ASSERT(unpadded_size() <= " << field->GetSize().bytes() << ");";
+      s << "size_t padding_bytes = ";
+      s << field->GetSize().bytes() << " - unpadded_size();";
+      s << "for (size_t padding = 0; padding < padding_bytes; padding++) {i.insert_byte(0);}";
+    } else if (field->GetFieldType() == CountField::kFieldType) {
+      const auto& vector_name = ((SizeField*)field)->GetSizedFieldName() + "_";
+      s << "insert(" << vector_name << ".size(), i, " << field->GetSize().bits() << ");";
+    } else {
+      field->GenInserter(s);
+    }
+  }
+  s << "}\n\n";
+
+  s << "void SerializeFooter(BitInserter&";
+  if (parent_ != nullptr || footer_fields.size() != 0) {
+    s << " i ";
+  }
+  s << ") const {";
+
+  for (const auto& field : footer_fields) {
+    field->GenInserter(s);
+  }
+  if (parent_ != nullptr) {
+    if (parent_->GetDefinitionType() == Type::PACKET) {
+      s << parent_->name_ << "Builder::SerializeFooter(i);";
+    } else {
+      s << parent_->name_ << "::SerializeFooter(i);";
+    }
+  }
+  s << "}\n\n";
+
+  s << "public:";
+  s << "virtual void Serialize(BitInserter& i) const override {";
+  s << "SerializeHeader(i);";
+  if (fields_.HasPayload()) {
+    s << "payload_->Serialize(i);";
+  }
+  s << "SerializeFooter(i);";
+
+  s << "}\n";
+}
+
+void ParentDef::GenInstanceOf(std::ostream& s) const {
+  if (parent_ != nullptr && parent_constraints_.size() > 0) {
+    s << "static bool IsInstance(const " << parent_->name_ << "& parent) {";
+    // Get the list of parent params.
+    FieldList parent_params = parent_->GetParamList().GetFieldsWithoutTypes({
+        PayloadField::kFieldType,
+        BodyField::kFieldType,
+    });
+
+    // Check if constrained parent fields are set to their correct values.
+    for (int i = 0; i < parent_params.size(); i++) {
+      const auto& field = parent_params[i];
+      const auto& constraint = parent_constraints_.find(field->GetName());
+      if (constraint != parent_constraints_.end()) {
+        s << "if (parent." << field->GetName() << "_ != ";
+        if (field->GetFieldType() == ScalarField::kFieldType) {
+          s << std::get<int64_t>(constraint->second) << ")";
+          s << "{ return false;}";
+        } else if (field->GetFieldType() == EnumField::kFieldType) {
+          s << std::get<std::string>(constraint->second) << ")";
+          s << "{ return false;}";
+        } else {
+          ERROR(field) << "Constraints on non enum/scalar fields should be impossible.";
+        }
+      }
+    }
+    s << "return true;}";
+  }
+}
diff --git a/gd/packet/parser/parent_def.h b/gd/packet/parser/parent_def.h
new file mode 100644
index 0000000..a293a26
--- /dev/null
+++ b/gd/packet/parser/parent_def.h
@@ -0,0 +1,70 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#pragma once
+
+#include <map>
+#include <variant>
+
+#include "enum_def.h"
+#include "field_list.h"
+#include "fields/all_fields.h"
+#include "fields/packet_field.h"
+#include "parse_location.h"
+#include "type_def.h"
+
+class ParentDef : public TypeDef {
+ public:
+  ParentDef(std::string name, FieldList fields);
+  ParentDef(std::string name, FieldList fields, ParentDef* parent);
+
+  void AddParentConstraint(std::string field_name, std::variant<int64_t, std::string> value);
+
+  // Assign all size fields to their corresponding variable length fields.
+  // Will crash if
+  //  - there aren't any fields that don't match up to a field.
+  //  - the size field points to a fixed size field.
+  //  - if the size field comes after the variable length field.
+  void AssignSizeFields();
+
+  void SetEndianness(bool is_little_endian);
+
+  // Get the size. You scan specify without_payload to exclude payload and body fields as children override them.
+  Size GetSize(bool without_payload = false) const;
+
+  // Get the offset until the field is reached, if there is no field
+  // returns an empty Size. from_end requests the offset to the field
+  // starting from the end() iterator. If there is a field with an unknown
+  // size along the traversal, then an empty size is returned.
+  Size GetOffsetForField(std::string field_name, bool from_end = false) const;
+
+  FieldList GetParamList() const;
+
+  void GenMembers(std::ostream& s) const;
+
+  void GenSize(std::ostream& s) const;
+
+  void GenSerialize(std::ostream& s) const;
+
+  void GenInstanceOf(std::ostream& s) const;
+
+  FieldList fields_;
+
+  ParentDef* parent_{nullptr};
+
+  std::map<std::string, std::variant<int64_t, std::string>> parent_constraints_;
+  bool is_little_endian_;
+};
diff --git a/gd/packet/parser/size.h b/gd/packet/parser/size.h
index 926d12c..e73bff0 100644
--- a/gd/packet/parser/size.h
+++ b/gd/packet/parser/size.h
@@ -14,6 +14,8 @@
  * limitations under the License.
  */
 
+#pragma once
+
 #include <iterator>
 #include <sstream>
 #include <string>
@@ -45,8 +47,8 @@
     dynamic_ = size.dynamic_;
   }
 
-  std::string dynamic_string() {
-    if (dynamic_.empty()) return " 0 /* dynamic */ ";
+  std::string dynamic_string() const {
+    if (dynamic_.empty()) return "0";
 
     std::stringstream result;
     // Print everything but the last element then append it manually to avoid
@@ -60,23 +62,23 @@
     return dynamic_;
   }
 
-  bool empty() {
+  bool empty() const {
     return !is_valid_;
   }
 
-  bool has_bits() {
+  bool has_bits() const {
     return bits_ != 0;
   }
 
-  bool has_dynamic() {
+  bool has_dynamic() const {
     return !dynamic_.empty();
   }
 
-  int bits() {
+  int bits() const {
     return bits_;
   }
 
-  int bytes() {
+  int bytes() const {
     return bits_ / 8;
   }
 
@@ -93,8 +95,8 @@
   }
 
   Size operator+(const Size& rhs) {
-    auto ret = Size(bits_ += rhs.bits_);
-    ret.is_valid_ = true;
+    auto ret = Size(bits_ + rhs.bits_);
+    ret.is_valid_ = is_valid_ && rhs.is_valid_;
     ret.dynamic_.insert(ret.dynamic_.end(), dynamic_.begin(), dynamic_.end());
     ret.dynamic_.insert(ret.dynamic_.end(), rhs.dynamic_.begin(), rhs.dynamic_.end());
     return ret;
@@ -113,19 +115,25 @@
   }
 
   Size& operator+=(const Size& rhs) {
-    is_valid_ = true;
+    is_valid_ = is_valid_ && rhs.is_valid_;
     bits_ += rhs.bits_;
     dynamic_.insert(dynamic_.end(), rhs.dynamic_.begin(), rhs.dynamic_.end());
     return *this;
   }
 
-  std::string ToString() {
+  std::string ToString() const {
     std::stringstream str;
-    str << "Bits: " << bits_ << " | "
-        << "Dynamic: " << dynamic_string();
+    str << "/* Bits: */ " << bits_ << " + /* Dynamic: */ " << dynamic_string();
+    if (!is_valid_) {
+      str << " (invalid) ";
+    }
     return str.str();
   }
 
+  friend std::ostream& operator<<(std::ostream& os, const Size& rhs) {
+    return os << rhs.ToString();
+  }
+
  private:
   bool is_valid_ = false;
   int bits_ = 0;
diff --git a/gd/packet/parser/struct_def.cc b/gd/packet/parser/struct_def.cc
new file mode 100644
index 0000000..3691192
--- /dev/null
+++ b/gd/packet/parser/struct_def.cc
@@ -0,0 +1,242 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "struct_def.h"
+
+#include "fields/all_fields.h"
+#include "util.h"
+
+StructDef::StructDef(std::string name, FieldList fields) : StructDef(name, fields, nullptr) {}
+StructDef::StructDef(std::string name, FieldList fields, StructDef* parent)
+    : ParentDef(name, fields, parent), total_size_(GetSize(true)) {}
+
+PacketField* StructDef::GetNewField(const std::string& name, ParseLocation loc) const {
+  if (fields_.HasBody()) {
+    return new VariableLengthStructField(name, name_, loc);
+  } else {
+    return new StructField(name, name_, total_size_, loc);
+  }
+}
+
+TypeDef::Type StructDef::GetDefinitionType() const {
+  return TypeDef::Type::STRUCT;
+}
+
+void StructDef::GenSpecialize(std::ostream& s) const {
+  if (parent_ == nullptr) {
+    return;
+  }
+  s << "static " << name_ << "* Specialize(" << parent_->name_ << "* parent) {";
+  s << "ASSERT(" << name_ << "::IsInstance(*parent));";
+  s << "return static_cast<" << name_ << "*>(parent);";
+  s << "}";
+}
+
+void StructDef::GenParse(std::ostream& s) const {
+  std::string iterator = (is_little_endian_ ? "Iterator<kLittleEndian>" : "Iterator<!kLittleEndian>");
+
+  if (fields_.HasBody()) {
+    s << "static std::optional<" << iterator << ">";
+  } else {
+    s << "static " << iterator;
+  }
+
+  s << " Parse(" << name_ << "* to_fill, " << iterator << " struct_begin_it ";
+
+  if (parent_ != nullptr) {
+    s << ", bool fill_parent = true) {";
+  } else {
+    s << ") {";
+  }
+  s << "auto to_bound = struct_begin_it;";
+
+  if (parent_ != nullptr) {
+    s << "if (fill_parent) {";
+    std::string parent_param = (parent_->parent_ == nullptr ? "" : ", true");
+    if (parent_->fields_.HasBody()) {
+      s << "auto parent_optional_it = " << parent_->name_ << "::Parse(to_fill, to_bound" << parent_param << ");";
+      if (fields_.HasBody()) {
+        s << "if (!parent_optional_it) { return {}; }";
+      } else {
+        s << "ASSERT(parent_optional_it);";
+      }
+    } else {
+      s << parent_->name_ << "::Parse(to_fill, to_bound" << parent_param << ");";
+    }
+    s << "}";
+  }
+
+  if (!fields_.HasBody()) {
+    s << "size_t end_index = struct_begin_it.NumBytesRemaining();";
+    if (parent_ != nullptr) {
+      s << "if (end_index < " << GetSize().bytes() << " - to_fill->" << parent_->name_ << "::size())";
+    } else {
+      s << "if (end_index < " << GetSize().bytes() << ")";
+    }
+    s << "{ return struct_begin_it.Subrange(0,0);}";
+  }
+
+  for (const auto& field : fields_) {
+    if (field->GetFieldType() != ReservedField::kFieldType && field->GetFieldType() != BodyField::kFieldType &&
+        field->GetFieldType() != FixedScalarField::kFieldType && field->GetFieldType() != SizeField::kFieldType &&
+        field->GetFieldType() != ChecksumStartField::kFieldType && field->GetFieldType() != ChecksumField::kFieldType &&
+        field->GetFieldType() != CountField::kFieldType) {
+      s << "{";
+      s << "if (to_bound.NumBytesRemaining() < " << field->GetSize().bytes() << ")";
+      if (!fields_.HasBody()) {
+        s << "{ return to_bound.Subrange(to_bound.NumBytesRemaining(),0);}";
+      } else {
+        s << "{ return {};}";
+      }
+      int num_leading_bits =
+          field->GenBounds(s, GetStructOffsetForField(field->GetName()), Size(), field->GetStructSize());
+      s << "auto " << field->GetName() << "_ptr = &to_fill->" << field->GetName() << "_;";
+      field->GenExtractor(s, num_leading_bits, true);
+      s << "}";
+    }
+    if (field->GetFieldType() == CountField::kFieldType || field->GetFieldType() == SizeField::kFieldType) {
+      s << field->GetDataType() << " " << field->GetName() << "_extracted;";
+      s << "{";
+      s << "if (to_bound.NumBytesRemaining() < " << field->GetSize().bytes() << ")";
+      if (!fields_.HasBody()) {
+        s << "{ return to_bound.Subrange(to_bound.NumBytesRemaining(),0);}";
+      } else {
+        s << "{ return {};}";
+      }
+      int num_leading_bits =
+          field->GenBounds(s, GetStructOffsetForField(field->GetName()), Size(), field->GetStructSize());
+      s << "auto " << field->GetName() << "_ptr = &" << field->GetName() << "_extracted;";
+      field->GenExtractor(s, num_leading_bits, true);
+      s << "}";
+    }
+  }
+  s << "return struct_begin_it + to_fill->" << name_ << "::size();";
+  s << "}";
+}
+
+void StructDef::GenParseFunctionPrototype(std::ostream& s) const {
+  s << "std::unique_ptr<" << name_ << "> Parse" << name_ << "(";
+  if (is_little_endian_) {
+    s << "Iterator<kLittleEndian>";
+  } else {
+    s << "Iterator<!kLittleEndian>";
+  }
+  s << "it);";
+}
+
+void StructDef::GenDefinition(std::ostream& s) const {
+  s << "class " << name_;
+  if (parent_ != nullptr) {
+    s << " : public " << parent_->name_;
+  } else {
+    if (is_little_endian_) {
+      s << " : public PacketStruct<kLittleEndian>";
+    } else {
+      s << " : public PacketStruct<!kLittleEndian>";
+    }
+  }
+  s << " {";
+  s << " public:";
+
+  GenConstructor(s);
+
+  s << " public:\n";
+  s << "  virtual ~" << name_ << "() override = default;\n";
+
+  GenSerialize(s);
+  s << "\n";
+
+  GenParse(s);
+  s << "\n";
+
+  GenSize(s);
+  s << "\n";
+
+  GenInstanceOf(s);
+  s << "\n";
+
+  GenSpecialize(s);
+  s << "\n";
+
+  GenMembers(s);
+  s << "};\n";
+
+  if (fields_.HasBody()) {
+    GenParseFunctionPrototype(s);
+  }
+  s << "\n";
+}
+
+void StructDef::GenConstructor(std::ostream& s) const {
+  if (parent_ != nullptr) {
+    s << name_ << "(const " << parent_->name_ << "& parent) : " << parent_->name_ << "(parent) {}";
+    s << name_ << "() : " << parent_->name_ << "() {";
+  } else {
+    s << name_ << "() {";
+  }
+
+  // Get the list of parent params.
+  FieldList parent_params;
+  if (parent_ != nullptr) {
+    parent_params = parent_->GetParamList().GetFieldsWithoutTypes({
+        PayloadField::kFieldType,
+        BodyField::kFieldType,
+    });
+
+    // Set constrained parent fields to their correct values.
+    for (int i = 0; i < parent_params.size(); i++) {
+      const auto& field = parent_params[i];
+      const auto& constraint = parent_constraints_.find(field->GetName());
+      if (constraint != parent_constraints_.end()) {
+        s << parent_->name_ << "::" << field->GetName() << "_ = ";
+        if (field->GetFieldType() == ScalarField::kFieldType) {
+          s << std::get<int64_t>(constraint->second) << ";";
+        } else if (field->GetFieldType() == EnumField::kFieldType) {
+          s << std::get<std::string>(constraint->second) << ";";
+        } else {
+          ERROR(field) << "Constraints on non enum/scalar fields should be impossible.";
+        }
+      }
+    }
+  }
+
+  s << "}\n";
+}
+
+Size StructDef::GetStructOffsetForField(std::string field_name) const {
+  auto size = Size(0);
+  for (auto it = fields_.begin(); it != fields_.end(); it++) {
+    // We've reached the field, end the loop.
+    if ((*it)->GetName() == field_name) break;
+    const auto& field = *it;
+    // When we need to parse this field, all previous fields should already be parsed.
+    if (field->GetStructSize().empty()) {
+      ERROR() << "Empty size for field " << (*it)->GetName() << " finding the offset for field: " << field_name;
+    }
+    size += field->GetStructSize();
+  }
+
+  // We need the offset until a body field.
+  if (parent_ != nullptr) {
+    auto parent_body_offset = static_cast<StructDef*>(parent_)->GetStructOffsetForField("body");
+    if (parent_body_offset.empty()) {
+      ERROR() << "Empty offset for body in " << parent_->name_ << " finding the offset for field: " << field_name;
+    }
+    size += parent_body_offset;
+  }
+
+  return size;
+}
diff --git a/gd/packet/parser/struct_def.h b/gd/packet/parser/struct_def.h
new file mode 100644
index 0000000..c06c472
--- /dev/null
+++ b/gd/packet/parser/struct_def.h
@@ -0,0 +1,51 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#pragma once
+
+#include <map>
+#include <variant>
+
+#include "field_list.h"
+#include "fields/packet_field.h"
+#include "parent_def.h"
+#include "parse_location.h"
+#include "type_def.h"
+
+class StructDef : public ParentDef {
+ public:
+  StructDef(std::string name, FieldList fields);
+  StructDef(std::string name, FieldList fields, StructDef* parent);
+
+  PacketField* GetNewField(const std::string& name, ParseLocation loc) const;
+
+  TypeDef::Type GetDefinitionType() const;
+
+  void GenSpecialize(std::ostream& s) const;
+
+  void GenParse(std::ostream& s) const;
+
+  void GenParseFunctionPrototype(std::ostream& s) const;
+
+  void GenDefinition(std::ostream& s) const;
+
+  void GenConstructor(std::ostream& s) const;
+
+  Size GetStructOffsetForField(std::string field_name) const;
+
+ private:
+  Size total_size_;
+};
diff --git a/gd/packet/parser/struct_parser_generator.cc b/gd/packet/parser/struct_parser_generator.cc
new file mode 100644
index 0000000..c5ccb88
--- /dev/null
+++ b/gd/packet/parser/struct_parser_generator.cc
@@ -0,0 +1,96 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "struct_parser_generator.h"
+
+StructParserGenerator::StructParserGenerator(Declarations& decls) {
+  is_little_endian = decls.is_little_endian;
+  for (auto& s : decls.type_defs_queue_) {
+    if (s.second->GetDefinitionType() == TypeDef::Type::STRUCT) {
+      variable_struct_fields_.push_back((StructDef*)s.second);
+    }
+  }
+  for (const auto& node : variable_struct_fields_) {
+    if (node.struct_def_->parent_ != nullptr) {
+      for (auto& parent : variable_struct_fields_) {
+        if (node.struct_def_->parent_->name_ == parent.struct_def_->name_) {
+          parent.children_.push_back(&node);
+        }
+      }
+    }
+  }
+}
+
+void StructParserGenerator::explore_children(const TreeNode& node, std::ostream& s) const {
+  auto field = node.packet_field_;
+  if (node.children_.size() > 0) {
+    s << "bool " << field->GetName() << "_child_found = false; /* Greedy match */";
+  }
+  for (const auto child : node.children_) {
+    s << "if (!" << field->GetName() << "_child_found && ";
+    s << child->struct_def_->name_ << "::IsInstance(*" << field->GetName() << "_value.get())) {";
+    s << field->GetName() << "_child_found = true;";
+    s << "std::unique_ptr<" << child->struct_def_->name_ << "> " << child->packet_field_->GetName() << "_value;";
+    s << child->packet_field_->GetName() << "_value.reset(new ";
+    s << child->struct_def_->name_ << "(*" << field->GetName() << "_value));";
+    if (child->struct_def_->fields_.HasBody()) {
+      s << "auto optional_it = ";
+      s << child->struct_def_->name_ << "::Parse( " << child->packet_field_->GetName() << "_value.get(), ";
+      s << "to_bound, false);";
+      s << "if (optional_it) {";
+      s << "} else { return " << field->GetName() << "_value;}";
+    } else {
+      s << child->struct_def_->name_ << "::Parse( " << child->packet_field_->GetName() << "_value.get(), ";
+      s << "to_bound, false);";
+    }
+    explore_children(*child, s);
+    s << field->GetName() << "_value = std::move(" << child->packet_field_->GetName() << "_value);";
+
+    s << " }";
+  }
+}
+
+void StructParserGenerator::Generate(std::ostream& s) const {
+  for (const auto& node : variable_struct_fields_) {
+    if (node.children_.size() > 0) {
+      auto field = node.packet_field_;
+      s << "inline std::unique_ptr<" << node.struct_def_->name_ << "> Parse" << node.struct_def_->name_;
+      if (is_little_endian) {
+        s << "(Iterator<kLittleEndian> to_bound) {";
+      } else {
+        s << "(Iterator<!kLittleEndian> to_bound) {";
+      }
+      s << field->GetDataType() << " " << field->GetName() << "_value = ";
+      s << "std::make_unique<" << node.struct_def_->name_ << ">();";
+
+      s << "auto " << field->GetName() << "_it = to_bound;";
+      s << "auto optional_it = ";
+      s << node.struct_def_->name_ << "::Parse( " << field->GetName() << "_value.get(), ";
+      s << field->GetName() << "_it";
+      if (node.struct_def_->parent_ != nullptr) {
+        s << ", true);";
+      } else {
+        s << ");";
+      }
+      s << "if (optional_it) {";
+      s << field->GetName() << "_it = *optional_it;";
+      s << "} else { return nullptr; }";
+
+      explore_children(node, s);
+      s << "return " << field->GetName() << "_value; }";
+    }
+  }
+}
diff --git a/gd/packet/parser/struct_parser_generator.h b/gd/packet/parser/struct_parser_generator.h
new file mode 100644
index 0000000..2c1ff6d
--- /dev/null
+++ b/gd/packet/parser/struct_parser_generator.h
@@ -0,0 +1,44 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#pragma once
+
+#include <iostream>
+
+#include "declarations.h"
+#include "fields/packet_field.h"
+#include "parse_location.h"
+
+class StructParserGenerator {
+ public:
+  StructParserGenerator(Declarations& declarations);
+
+  void Generate(std::ostream& s) const;
+
+ private:
+  class TreeNode {
+   public:
+    TreeNode(const StructDef* s)
+        : struct_def_(s), packet_field_(s->GetNewField(s->name_ + "_parse", ParseLocation())) {}
+    const StructDef* struct_def_;
+    const PacketField* packet_field_;
+    std::list<const TreeNode*> children_;
+  };
+  std::list<TreeNode> variable_struct_fields_;
+  bool is_little_endian;
+
+  void explore_children(const TreeNode& node, std::ostream& s) const;
+};
diff --git a/gd/packet/parser/test/Android.bp b/gd/packet/parser/test/Android.bp
index a5849b3..65b2f3e 100644
--- a/gd/packet/parser/test/Android.bp
+++ b/gd/packet/parser/test/Android.bp
@@ -6,16 +6,19 @@
     cmd: "$(location bluetooth_packetgen) --include=system/bt/gd --out=$(genDir) $(in)",
     srcs: [
         "test_packets.pdl",
+        "big_endian_test_packets.pdl",
     ],
     out: [
         "packet/parser/test/test_packets.h",
+        "packet/parser/test/big_endian_test_packets.h",
     ],
 }
 
 filegroup {
     name: "BluetoothPacketParserTestPacketTestSources",
     srcs: [
-        "six_bytes.cc",
         "generated_packet_test.cc",
+        "six_bytes.cc",
+        "variable.cc",
     ],
 }
diff --git a/gd/packet/parser/test/big_endian_test_packets.pdl b/gd/packet/parser/test/big_endian_test_packets.pdl
new file mode 100644
index 0000000..5647ea6
--- /dev/null
+++ b/gd/packet/parser/test/big_endian_test_packets.pdl
@@ -0,0 +1,266 @@
+big_endian_packets
+
+custom_field SixBytes : 48 "packet/parser/test/"
+custom_field Variable "packet/parser/test/"
+
+packet ParentBe {
+  _fixed_ = 0x12 : 8,
+  _size_(_payload_) : 8,
+  _payload_,
+  footer : 8,
+}
+
+packet ChildBe  : ParentBe {
+  field_name : 16,
+}
+
+enum FourBitsBe : 4 {
+  ONE = 1,
+  TWO = 2,
+  THREE = 3,
+  FIVE = 5,
+  TEN = 10,
+  LAZY_ME = 15,
+}
+
+packet ParentTwoBe {
+  _reserved_ : 4,
+  four_bits : FourBitsBe,
+  _payload_,
+}
+
+packet ChildTwoThreeBe  : ParentTwoBe (four_bits = THREE) {
+  more_bits : FourBitsBe,
+  _reserved_ : 4,
+  sixteen_bits : 16
+}
+
+packet ChildTwoTwoBe  : ParentTwoBe (four_bits = TWO) {
+  more_bits : FourBitsBe,
+  _reserved_ : 4,
+}
+
+packet ChildTwoTwoThreeBe  :ChildTwoTwoBe (more_bits = THREE) {
+}
+
+enum TwoBitsBe : 2 {
+  ZERO = 0,
+  ONE = 1,
+  TWO = 2,
+  THREE = 3,
+}
+
+packet MiddleFourBitsBe {
+  low_two : TwoBitsBe,
+  next_four : FourBitsBe,
+  straddle : FourBitsBe,
+  four_more : FourBitsBe,
+  high_two : TwoBitsBe,
+}
+
+packet ParentWithSixBytesBe {
+  two_bytes : 16,
+  six_bytes : SixBytes,
+  _payload_,
+}
+
+packet ChildWithSixBytesBe  : ParentWithSixBytesBe (two_bytes = 0x1234) {
+  child_six_bytes : SixBytes,
+}
+
+checksum SimpleSum : 16 "packet/parser/test/"
+
+packet ParentWithSumBe {
+  two_bytes : 16,
+  _checksum_start_(example_checksum),
+  sum_bytes : 16,
+  _payload_,
+  example_checksum : SimpleSum,
+}
+
+packet ChildWithSumBe  : ParentWithSumBe {
+  more_bytes : 32,
+  another_byte : 8,
+}
+
+packet ChildWithNestedSumBe  : ParentWithSumBe {
+  _checksum_start_(nested_checksum),
+  more_bytes : 32,
+  nested_checksum : SimpleSum,
+}
+
+packet ParentSizeModifierBe {
+  _size_(_payload_) : 8,
+  _payload_ : [+2*8], // Include two_bytes in the size
+  two_bytes : 16,
+}
+
+packet ChildSizeModifierBe  : ParentSizeModifierBe (two_bytes = 0x1211) {
+  more_bytes : 32,
+}
+
+enum ForArraysBe : 16 {
+  ONE = 0x0001,
+  TWO = 0x0002,
+  ONE_TWO = 0x0201,
+  TWO_THREE = 0x0302,
+  FFFF = 0xffff,
+}
+
+packet FixedArrayEnumBe {
+  enum_array : ForArraysBe[5],
+}
+
+packet SizedArrayEnumBe {
+  _size_(enum_array) : 16,
+  enum_array : ForArraysBe[],
+}
+
+packet CountArrayEnumBe {
+  _count_(enum_array) : 8,
+  enum_array : ForArraysBe[],
+}
+
+packet SizedArrayCustomBe {
+  _size_(six_bytes_array) : 8,
+  an_extra_byte : 8,
+  six_bytes_array : SixBytes[+1*8],
+}
+
+packet FixedArrayCustomBe {
+  six_bytes_array : SixBytes[5],
+}
+
+packet CountArrayCustomBe {
+  _count_(six_bytes_array) : 8,
+  six_bytes_array : SixBytes[],
+}
+
+packet PacketWithFixedArraysOfBytesBe {
+  fixed_256bit_in_bytes : 8[32],
+  fixed_256bit_in_words : 32[8],
+}
+
+packet OneVariableBe {
+  one : Variable,
+}
+
+packet SizedArrayVariableBe {
+  _size_(variable_array) : 8,
+  variable_array : Variable[],
+}
+
+packet FixedArrayVariableBe {
+  variable_array : Variable[5],
+}
+
+packet CountArrayVariableBe {
+  _count_(variable_array) : 8,
+  variable_array : Variable[],
+}
+
+struct TwoRelatedNumbersBe {
+  id : 8,
+  count : 16,
+}
+
+packet OneStructBe {
+  one : TwoRelatedNumbersBe,
+}
+
+packet TwoStructsBe {
+  one : TwoRelatedNumbersBe,
+  two : TwoRelatedNumbersBe,
+}
+
+packet ArrayOfStructBe {
+  _count_(array) : 8,
+  array : TwoRelatedNumbersBe[],
+}
+
+struct StructWithFixedTypesBe {
+  four_bits : FourBitsBe,
+  _reserved_ : 4,
+  _checksum_start_(example_checksum),
+  _fixed_ = 0xf3 : 8,
+  id : 8,
+  array : 8[3],
+  example_checksum : SimpleSum,
+  six_bytes : SixBytes,
+}
+
+packet OneFixedTypesStructBe {
+  one : StructWithFixedTypesBe,
+}
+
+packet ArrayOfStructAndAnotherBe {
+  _count_(array) : 8,
+  array : TwoRelatedNumbersBe[],
+  another : TwoRelatedNumbersBe,
+}
+
+group BitFieldGroupBe {
+  seven_bits : 7,
+  straddle : 4,
+  five_bits : 5,
+}
+
+packet BitFieldGroupPacketBe {
+  BitFieldGroupBe,
+}
+
+packet BitFieldGroupAfterPayloadPacketBe {
+  _payload_,
+  BitFieldGroupBe,
+}
+
+packet BitFieldGroupAfterUnsizedArrayPacketBe  : BitFieldGroupAfterPayloadPacketBe {
+  array : 8[],
+}
+
+struct BitFieldBe {
+  seven_bits : 7,
+  straddle : 4,
+  five_bits : 5,
+}
+
+packet BitFieldPacketBe {
+  bit_field : BitFieldBe,
+}
+
+packet BitFieldAfterPayloadPacketBe {
+  _payload_,
+  bit_field : BitFieldBe,
+}
+
+packet BitFieldAfterUnsizedArrayPacketBe  : BitFieldAfterPayloadPacketBe {
+  array : 8[],
+}
+
+packet BitFieldArrayPacketBe {
+  _size_(array): 8,
+  array : BitFieldBe[],
+}
+
+struct VersionlessStructBe {
+  one_number : 8,
+}
+
+packet OneVersionlessStructPacketBe {
+  versionless : VersionlessStructBe,
+  _payload_,
+}
+
+packet OneVersionedStructPacketBe  : OneVersionlessStructPacketBe {
+  version : 8,
+  _payload_,
+}
+
+packet OneVersionOneStructPacketBe  : OneVersionedStructPacketBe (version = 0x01) {
+  just_one_number : 8,
+}
+
+packet OneVersionTwoStructPacketBe  : OneVersionedStructPacketBe (version = 0x02) {
+  one_number : 8,
+  another_number : 8,
+}
diff --git a/gd/packet/parser/test/generated_packet_test.cc b/gd/packet/parser/test/generated_packet_test.cc
index 6d80ef6..06f60b5 100644
--- a/gd/packet/parser/test/generated_packet_test.cc
+++ b/gd/packet/parser/test/generated_packet_test.cc
@@ -14,6 +14,8 @@
  * limitations under the License.
  */
 
+#define PACKET_TESTING
+#include "packet/parser/test/big_endian_test_packets.h"
 #include "packet/parser/test/test_packets.h"
 
 #include <gtest/gtest.h>
@@ -212,6 +214,41 @@
   ASSERT_DEATH(child_view.GetFieldName(), "validated");
 }
 
+vector<uint8_t> middle_four_bits = {
+    0x95,  // low_two = ONE, next_four = FIVE, straddle = TEN
+    0x8a,  // straddle = TEN, four_more = TWO, high_two = TWO
+};
+
+TEST(GeneratedPacketTest, testMiddleFourBitsPacket) {
+  TwoBits low_two = TwoBits::ONE;
+  FourBits next_four = FourBits::FIVE;
+  FourBits straddle = FourBits::TEN;
+  FourBits four_more = FourBits::TWO;
+  TwoBits high_two = TwoBits::TWO;
+
+  auto packet = MiddleFourBitsBuilder::Create(low_two, next_four, straddle, four_more, high_two);
+
+  ASSERT_EQ(middle_four_bits.size(), packet->size());
+
+  std::shared_ptr<std::vector<uint8_t>> packet_bytes = std::make_shared<std::vector<uint8_t>>();
+  BitInserter it(*packet_bytes);
+  packet->Serialize(it);
+
+  ASSERT_EQ(packet_bytes->size(), middle_four_bits.size());
+  for (size_t i = 0; i < middle_four_bits.size(); i++) {
+    ASSERT_EQ(packet_bytes->at(i), middle_four_bits[i]);
+  }
+
+  PacketView<kLittleEndian> packet_bytes_view(packet_bytes);
+  MiddleFourBitsView view = MiddleFourBitsView::Create(packet_bytes_view);
+  ASSERT_TRUE(view.IsValid());
+  ASSERT_EQ(low_two, view.GetLowTwo());
+  ASSERT_EQ(next_four, view.GetNextFour());
+  ASSERT_EQ(straddle, view.GetStraddle());
+  ASSERT_EQ(four_more, view.GetFourMore());
+  ASSERT_EQ(high_two, view.GetHighTwo());
+}
+
 TEST(GeneratedPacketTest, testChildWithSixBytes) {
   SixBytes six_bytes_a{{0xa1, 0xa2, 0xa3, 0xa4, 0xa5, 0xa6}};
   SixBytes six_bytes_b{{0xb1, 0xb2, 0xb3, 0xb4, 0xb5, 0xb6}};
@@ -391,6 +428,1403 @@
 
   ASSERT_EQ(more_bytes, child_view.GetMoreBytes());
 }
+
+namespace {
+vector<uint8_t> fixed_array_enum{
+    0x01,  // ONE
+    0x00,
+    0x02,  // TWO
+    0x00,
+    0x01,  // ONE_TWO
+    0x02,
+    0x02,  // TWO_THREE
+    0x03,
+    0xff,  // FFFF
+    0xff,
+};
+}
+
+TEST(GeneratedPacketTest, testFixedArrayEnum) {
+  std::array<ForArrays, 5> fixed_array{
+      {ForArrays::ONE, ForArrays::TWO, ForArrays::ONE_TWO, ForArrays::TWO_THREE, ForArrays::FFFF}};
+  auto packet = FixedArrayEnumBuilder::Create(fixed_array);
+  ASSERT_EQ(fixed_array_enum.size(), packet->size());
+
+  // Verify that the packet is independent from the array.
+  std::array<ForArrays, 5> copy_array(fixed_array);
+  fixed_array[1] = ForArrays::ONE;
+
+  std::shared_ptr<std::vector<uint8_t>> packet_bytes = std::make_shared<std::vector<uint8_t>>();
+  BitInserter it(*packet_bytes);
+  packet->Serialize(it);
+
+  ASSERT_EQ(fixed_array_enum.size(), packet_bytes->size());
+  for (size_t i = 0; i < fixed_array_enum.size(); i++) {
+    ASSERT_EQ(fixed_array_enum[i], packet_bytes->at(i));
+  }
+
+  PacketView<kLittleEndian> packet_bytes_view(packet_bytes);
+  auto view = FixedArrayEnumView::Create(packet_bytes_view);
+  ASSERT_TRUE(view.IsValid());
+  auto array = view.GetEnumArray();
+  ASSERT_EQ(copy_array.size(), array.size());
+  for (size_t i = 0; i < copy_array.size(); i++) {
+    ASSERT_EQ(array[i], copy_array[i]);
+  }
+}
+
+namespace {
+vector<uint8_t> sized_array_enum{
+    0x0a,  // _size_
+    0x00,
+    0x01,  // ONE
+    0x00,
+    0x02,  // TWO
+    0x00,
+    0x01,  // ONE_TWO
+    0x02,
+    0x02,  // TWO_THREE
+    0x03,
+    0xff,  // FFFF
+    0xff,
+};
+}
+
+TEST(GeneratedPacketTest, testSizedArrayEnum) {
+  std::vector<ForArrays> sized_array{
+      {ForArrays::ONE, ForArrays::TWO, ForArrays::ONE_TWO, ForArrays::TWO_THREE, ForArrays::FFFF}};
+  auto packet = SizedArrayEnumBuilder::Create(sized_array);
+  ASSERT_EQ(sized_array_enum.size(), packet->size());
+
+  // Copy the original vector and modify it to make sure the packet is independent.
+  std::vector<ForArrays> copy_array(sized_array);
+  sized_array[1] = ForArrays::ONE;
+
+  std::shared_ptr<std::vector<uint8_t>> packet_bytes = std::make_shared<std::vector<uint8_t>>();
+  BitInserter it(*packet_bytes);
+  packet->Serialize(it);
+
+  ASSERT_EQ(sized_array_enum.size(), packet_bytes->size());
+  for (size_t i = 0; i < sized_array_enum.size(); i++) {
+    ASSERT_EQ(sized_array_enum[i], packet_bytes->at(i));
+  }
+
+  PacketView<kLittleEndian> packet_bytes_view(packet_bytes);
+  auto view = SizedArrayEnumView::Create(packet_bytes_view);
+  ASSERT_TRUE(view.IsValid());
+  auto array = view.GetEnumArray();
+  ASSERT_EQ(copy_array.size(), array.size());
+  for (size_t i = 0; i < copy_array.size(); i++) {
+    ASSERT_EQ(array[i], copy_array[i]);
+  }
+}
+
+namespace {
+vector<uint8_t> count_array_enum{
+    0x03,  // _count_
+    0x01,  // ONE
+    0x00,
+    0x02,  // TWO_THREE
+    0x03,
+    0xff,  // FFFF
+    0xff,
+};
+}
+
+TEST(GeneratedPacketTest, testCountArrayEnum) {
+  std::vector<ForArrays> count_array{{ForArrays::ONE, ForArrays::TWO_THREE, ForArrays::FFFF}};
+  auto packet = CountArrayEnumBuilder::Create(count_array);
+  ASSERT_EQ(count_array_enum.size(), packet->size());
+
+  std::shared_ptr<std::vector<uint8_t>> packet_bytes = std::make_shared<std::vector<uint8_t>>();
+  BitInserter it(*packet_bytes);
+  packet->Serialize(it);
+
+  ASSERT_EQ(count_array_enum.size(), packet_bytes->size());
+  for (size_t i = 0; i < count_array_enum.size(); i++) {
+    ASSERT_EQ(count_array_enum[i], packet_bytes->at(i));
+  }
+
+  PacketView<kLittleEndian> packet_bytes_view(packet_bytes);
+  auto view = CountArrayEnumView::Create(packet_bytes_view);
+  ASSERT_TRUE(view.IsValid());
+  auto array = view.GetEnumArray();
+  ASSERT_EQ(count_array.size(), array.size());
+  for (size_t i = 0; i < count_array.size(); i++) {
+    ASSERT_EQ(array[i], count_array[i]);
+  }
+}
+
+TEST(GeneratedPacketTest, testFixedSizeByteArray) {
+  constexpr std::size_t byte_array_size = 32;
+  std::array<uint8_t, byte_array_size> byte_array;
+  for (uint8_t i = 0; i < byte_array_size; i++) byte_array[i] = i;
+
+  constexpr int word_array_size = 8;
+  std::array<uint32_t, word_array_size> word_array;
+  for (uint32_t i = 0; i < word_array_size; i++) word_array[i] = i;
+
+  auto packet = PacketWithFixedArraysOfBytesBuilder::Create(byte_array, word_array);
+  ASSERT_EQ(2 * (256 / 8), packet->size());
+
+  std::shared_ptr<std::vector<uint8_t>> packet_bytes = std::make_shared<std::vector<uint8_t>>();
+  BitInserter it(*packet_bytes);
+  packet->Serialize(it);
+
+  ASSERT_EQ(byte_array_size + word_array_size * sizeof(uint32_t), packet_bytes->size());
+
+  for (size_t i = 0; i < byte_array_size; i++) {
+    ASSERT_EQ(byte_array[i], packet_bytes->at(i));
+  }
+
+  PacketView<kLittleEndian> packet_bytes_view(packet_bytes);
+  auto view = PacketWithFixedArraysOfBytesView::Create(packet_bytes_view);
+  ASSERT_TRUE(view.IsValid());
+  auto array = view.GetFixed256bitInBytes();
+  ASSERT_EQ(byte_array.size(), array.size());
+  for (size_t i = 0; i < array.size(); i++) {
+    ASSERT_EQ(array[i], byte_array[i]);
+  }
+
+  auto decoded_word_array = view.GetFixed256bitInWords();
+  ASSERT_EQ(word_array.size(), decoded_word_array.size());
+  for (size_t i = 0; i < decoded_word_array.size(); i++) {
+    ASSERT_EQ(word_array[i], decoded_word_array[i]);
+  }
+}
+
+vector<uint8_t> one_variable{
+    0x03, 'o', 'n', 'e',  // "one"
+};
+
+TEST(GeneratedPacketTest, testOneVariableField) {
+  Variable variable_one{"one"};
+
+  auto packet = OneVariableBuilder::Create(variable_one);
+  ASSERT_EQ(one_variable.size(), packet->size());
+
+  std::shared_ptr<std::vector<uint8_t>> packet_bytes = std::make_shared<std::vector<uint8_t>>();
+  BitInserter it(*packet_bytes);
+  packet->Serialize(it);
+
+  ASSERT_EQ(one_variable.size(), packet_bytes->size());
+  for (size_t i = 0; i < one_variable.size(); i++) {
+    ASSERT_EQ(one_variable[i], packet_bytes->at(i));
+  }
+
+  PacketView<kLittleEndian> packet_bytes_view(packet_bytes);
+  auto view = OneVariableView::Create(packet_bytes_view);
+  ASSERT_TRUE(view.IsValid());
+  auto one = view.GetOne();
+  ASSERT_EQ(one->data, variable_one.data);
+}
+
+vector<uint8_t> fou_variable{
+    0x04, 'f', 'o', 'u',  // too short
+};
+
+TEST(GeneratedPacketTest, testOneVariableFieldTooShort) {
+  std::shared_ptr<std::vector<uint8_t>> packet_bytes = std::make_shared<std::vector<uint8_t>>(fou_variable);
+  PacketView<kLittleEndian> packet_bytes_view(packet_bytes);
+  auto view = OneVariableView::Create(packet_bytes_view);
+  ASSERT_TRUE(view.IsValid());
+  auto one = view.GetOne();
+  ASSERT_EQ(one, nullptr);
+}
+
+vector<uint8_t> sized_array_variable{
+    0x0e,                           // _size_
+    0x03, 'o', 'n', 'e',            // "one"
+    0x03, 't', 'w', 'o',            // "two"
+    0x05, 't', 'h', 'r', 'e', 'e',  // "three"
+};
+
+TEST(GeneratedPacketTest, testSizedArrayVariableLength) {
+  std::vector<Variable> sized_array;
+  sized_array.emplace_back("one");
+  sized_array.emplace_back("two");
+  sized_array.emplace_back("three");
+
+  auto packet = SizedArrayVariableBuilder::Create(sized_array);
+  ASSERT_EQ(sized_array_variable.size(), packet->size());
+
+  std::shared_ptr<std::vector<uint8_t>> packet_bytes = std::make_shared<std::vector<uint8_t>>();
+  BitInserter it(*packet_bytes);
+  packet->Serialize(it);
+
+  ASSERT_EQ(sized_array_variable.size(), packet_bytes->size());
+  for (size_t i = 0; i < sized_array_variable.size(); i++) {
+    ASSERT_EQ(sized_array_variable[i], packet_bytes->at(i));
+  }
+
+  PacketView<kLittleEndian> packet_bytes_view(packet_bytes);
+  auto view = SizedArrayVariableView::Create(packet_bytes_view);
+  ASSERT_TRUE(view.IsValid());
+  auto array = view.GetVariableArray();
+  ASSERT_EQ(sized_array.size(), array.size());
+  for (size_t i = 0; i < sized_array.size(); i++) {
+    ASSERT_EQ(array[i].data, sized_array[i].data);
+  }
+}
+
+vector<uint8_t> sized_array_variable_too_short{
+    0x0e,                           // _size_
+    0x03, 'o', 'n', 'e',            // "one"
+    0x03, 't', 'w', 'o',            // "two"
+    0x06, 't', 'h', 'r', 'e', 'e',  // "three" needs another letter to be length 6
+};
+
+TEST(GeneratedPacketTest, testSizedArrayVariableLengthLastBad) {
+  std::vector<Variable> sized_array;
+  sized_array.emplace_back("one");
+  sized_array.emplace_back("two");
+
+  std::shared_ptr<std::vector<uint8_t>> packet_bytes =
+      std::make_shared<std::vector<uint8_t>>(sized_array_variable_too_short);
+
+  PacketView<kLittleEndian> packet_bytes_view(packet_bytes);
+  auto view = SizedArrayVariableView::Create(packet_bytes_view);
+  ASSERT_TRUE(view.IsValid());
+  auto array = view.GetVariableArray();
+  ASSERT_EQ(sized_array.size(), array.size());
+  for (size_t i = 0; i < sized_array.size(); i++) {
+    ASSERT_EQ(array[i].data, sized_array[i].data);
+  }
+}
+
+vector<uint8_t> sized_array_variable_first_too_short{
+    0x0e,                           // _size_
+    0x02, 'o', 'n', 'e',            // "on"
+    0x03, 't', 'w', 'o',            // "two"
+    0x05, 't', 'h', 'r', 'e', 'e',  // "three"
+};
+
+TEST(GeneratedPacketTest, testSizedArrayVariableLengthFirstBad) {
+  std::vector<Variable> sized_array;
+  sized_array.emplace_back("on");
+
+  std::shared_ptr<std::vector<uint8_t>> packet_bytes =
+      std::make_shared<std::vector<uint8_t>>(sized_array_variable_first_too_short);
+
+  PacketView<kLittleEndian> packet_bytes_view(packet_bytes);
+  auto view = SizedArrayVariableView::Create(packet_bytes_view);
+  ASSERT_TRUE(view.IsValid());
+  auto array = view.GetVariableArray();
+  ASSERT_EQ(sized_array.size(), array.size());
+  for (size_t i = 0; i < sized_array.size(); i++) {
+    ASSERT_EQ(array[i].data, sized_array[i].data);
+  }
+}
+
+vector<uint8_t> fixed_array_variable{
+    0x03, 'o', 'n', 'e',            // "one"
+    0x03, 't', 'w', 'o',            // "two"
+    0x05, 't', 'h', 'r', 'e', 'e',  // "three"
+    0x04, 'f', 'o', 'u', 'r',       // "four"
+    0x04, 'f', 'i', 'v', 'e',       // "five"
+};
+
+TEST(GeneratedPacketTest, testFixedArrayVariableLength) {
+  std::array<Variable, 5> fixed_array{std::string("one"), std::string("two"), std::string("three"), std::string("four"),
+                                      std::string("five")};
+
+  auto packet = FixedArrayVariableBuilder::Create(fixed_array);
+  ASSERT_EQ(fixed_array_variable.size(), packet->size());
+
+  std::shared_ptr<std::vector<uint8_t>> packet_bytes = std::make_shared<std::vector<uint8_t>>();
+  BitInserter it(*packet_bytes);
+  packet->Serialize(it);
+
+  ASSERT_EQ(fixed_array_variable.size(), packet_bytes->size());
+  for (size_t i = 0; i < fixed_array_variable.size(); i++) {
+    ASSERT_EQ(fixed_array_variable[i], packet_bytes->at(i));
+  }
+
+  PacketView<kLittleEndian> packet_bytes_view(packet_bytes);
+  auto view = FixedArrayVariableView::Create(packet_bytes_view);
+  ASSERT_TRUE(view.IsValid());
+  auto array = view.GetVariableArray();
+  ASSERT_EQ(fixed_array.size(), array.size());
+  for (size_t i = 0; i < fixed_array.size(); i++) {
+    ASSERT_EQ(array[i].data, fixed_array[i].data);
+  }
+}
+
+vector<uint8_t> fixed_array_variable_too_short{
+    0x03, 'o', 'n', 'e',            // "one"
+    0x03, 't', 'w', 'o',            // "two"
+    0x05, 't', 'h', 'r', 'e', 'e',  // "three"
+    0x04, 'f', 'o', 'u', 'r',       // "four"
+    0x05, 'f', 'i', 'v', 'e',       // "five"
+};
+
+TEST(GeneratedPacketTest, testFixedArrayVariableLengthTooShort) {
+  std::array<Variable, 5> fixed_array{std::string("one"), std::string("two"), std::string("three"),
+                                      std::string("four")};
+
+  std::shared_ptr<std::vector<uint8_t>> packet_bytes =
+      std::make_shared<std::vector<uint8_t>>(fixed_array_variable_too_short);
+
+  PacketView<kLittleEndian> packet_bytes_view(packet_bytes);
+  auto view = FixedArrayVariableView::Create(packet_bytes_view);
+  ASSERT_TRUE(view.IsValid());
+  auto array = view.GetVariableArray();
+  ASSERT_EQ(fixed_array.size(), array.size());
+  for (size_t i = 0; i < fixed_array.size(); i++) {
+    ASSERT_EQ(array[i].data, fixed_array[i].data);
+  }
+}
+
+vector<uint8_t> count_array_variable{
+    0x04,                           // _count_
+    0x03, 'o', 'n', 'e',            // "one"
+    0x03, 't', 'w', 'o',            // "two"
+    0x05, 't', 'h', 'r', 'e', 'e',  // "three"
+    0x04, 'f', 'o', 'u', 'r',       // "four"
+};
+
+TEST(GeneratedPacketTest, testCountArrayVariableLength) {
+  std::vector<Variable> count_array;
+  count_array.emplace_back("one");
+  count_array.emplace_back("two");
+  count_array.emplace_back("three");
+  count_array.emplace_back("four");
+
+  auto packet = CountArrayVariableBuilder::Create(count_array);
+  ASSERT_EQ(count_array_variable.size(), packet->size());
+
+  std::shared_ptr<std::vector<uint8_t>> packet_bytes = std::make_shared<std::vector<uint8_t>>();
+  BitInserter it(*packet_bytes);
+  packet->Serialize(it);
+
+  ASSERT_EQ(count_array_variable.size(), packet_bytes->size());
+  for (size_t i = 0; i < count_array_variable.size(); i++) {
+    ASSERT_EQ(count_array_variable[i], packet_bytes->at(i));
+  }
+
+  PacketView<kLittleEndian> packet_bytes_view(packet_bytes);
+  auto view = CountArrayVariableView::Create(packet_bytes_view);
+  ASSERT_TRUE(view.IsValid());
+  auto array = view.GetVariableArray();
+  ASSERT_EQ(count_array.size(), array.size());
+  for (size_t i = 0; i < count_array.size(); i++) {
+    ASSERT_EQ(array[i].data, count_array[i].data);
+  }
+}
+
+vector<uint8_t> count_array_variable_extra{
+    0x04,                           // _count_
+    0x03, 'o', 'n', 'e',            // "one"
+    0x03, 't', 'w', 'o',            // "two"
+    0x05, 't', 'h', 'r', 'e', 'e',  // "three"
+    0x04, 'f', 'o', 'u', 'r',       // "four"
+    0x04, 'x', 't', 'r', 'a',       // "xtra"
+};
+
+TEST(GeneratedPacketTest, testCountArrayVariableLengthExtraData) {
+  std::vector<Variable> count_array;
+  count_array.emplace_back("one");
+  count_array.emplace_back("two");
+  count_array.emplace_back("three");
+  count_array.emplace_back("four");
+
+  std::shared_ptr<std::vector<uint8_t>> packet_bytes =
+      std::make_shared<std::vector<uint8_t>>(count_array_variable_extra);
+
+  PacketView<kLittleEndian> packet_bytes_view(packet_bytes);
+  auto view = CountArrayVariableView::Create(packet_bytes_view);
+  ASSERT_TRUE(view.IsValid());
+  auto array = view.GetVariableArray();
+  ASSERT_EQ(count_array.size(), array.size());
+  for (size_t i = 0; i < count_array.size(); i++) {
+    ASSERT_EQ(array[i].data, count_array[i].data);
+  }
+}
+
+vector<uint8_t> count_array_variable_too_few{
+    0x04,                           // _count_
+    0x03, 'o', 'n', 'e',            // "one"
+    0x03, 't', 'w', 'o',            // "two"
+    0x05, 't', 'h', 'r', 'e', 'e',  // "three"
+};
+
+TEST(GeneratedPacketTest, testCountArrayVariableLengthMissingData) {
+  std::vector<Variable> count_array;
+  count_array.emplace_back("one");
+  count_array.emplace_back("two");
+  count_array.emplace_back("three");
+
+  std::shared_ptr<std::vector<uint8_t>> packet_bytes =
+      std::make_shared<std::vector<uint8_t>>(count_array_variable_too_few);
+
+  PacketView<kLittleEndian> packet_bytes_view(packet_bytes);
+  auto view = CountArrayVariableView::Create(packet_bytes_view);
+  ASSERT_TRUE(view.IsValid());
+  auto array = view.GetVariableArray();
+  ASSERT_EQ(count_array.size(), array.size());
+  for (size_t i = 0; i < count_array.size(); i++) {
+    ASSERT_EQ(array[i].data, count_array[i].data);
+  }
+}
+
+vector<uint8_t> one_struct{
+    0x01, 0x02, 0x03,  // id = 0x01, count = 0x0302
+};
+
+TEST(GeneratedPacketTest, testOneStruct) {
+  TwoRelatedNumbers trn;
+  trn.id_ = 1;
+  trn.count_ = 0x0302;
+
+  auto packet = OneStructBuilder::Create(trn);
+  ASSERT_EQ(one_struct.size(), packet->size());
+
+  // Copy the original struct, then modify it to verify independence from the packet.
+  TwoRelatedNumbers copy_trn(trn);
+  trn.id_ = 2;
+
+  std::shared_ptr<std::vector<uint8_t>> packet_bytes = std::make_shared<std::vector<uint8_t>>();
+  BitInserter it(*packet_bytes);
+  packet->Serialize(it);
+
+  ASSERT_EQ(one_struct.size(), packet_bytes->size());
+  for (size_t i = 0; i < one_struct.size(); i++) {
+    ASSERT_EQ(one_struct[i], packet_bytes->at(i));
+  }
+
+  PacketView<kLittleEndian> packet_bytes_view(packet_bytes);
+  auto view = OneStructView::Create(packet_bytes_view);
+  ASSERT_TRUE(view.IsValid());
+  auto one = view.GetOne();
+  ASSERT_EQ(one.id_, copy_trn.id_);
+  ASSERT_EQ(one.count_, copy_trn.count_);
+}
+
+vector<uint8_t> two_structs{
+    0x01, 0x01, 0x02,  // id, id * 0x0201
+    0x02, 0x02, 0x04,
+};
+
+TEST(GeneratedPacketTest, testTwoStructs) {
+  std::vector<TwoRelatedNumbers> count_array;
+  for (uint8_t i = 1; i < 3; i++) {
+    TwoRelatedNumbers trn;
+    trn.id_ = i;
+    trn.count_ = 0x0201 * i;
+    count_array.push_back(trn);
+  }
+
+  auto packet = TwoStructsBuilder::Create(count_array[0], count_array[1]);
+  ASSERT_EQ(two_structs.size(), packet->size());
+
+  std::shared_ptr<std::vector<uint8_t>> packet_bytes = std::make_shared<std::vector<uint8_t>>();
+  BitInserter it(*packet_bytes);
+  packet->Serialize(it);
+
+  ASSERT_EQ(two_structs.size(), packet_bytes->size());
+  for (size_t i = 0; i < two_structs.size(); i++) {
+    ASSERT_EQ(two_structs[i], packet_bytes->at(i));
+  }
+
+  PacketView<kLittleEndian> packet_bytes_view(packet_bytes);
+  auto view = TwoStructsView::Create(packet_bytes_view);
+  ASSERT_TRUE(view.IsValid());
+  auto one = view.GetOne();
+  ASSERT_EQ(one.id_, count_array[0].id_);
+  ASSERT_EQ(one.count_, count_array[0].count_);
+  auto two = view.GetTwo();
+  ASSERT_EQ(two.id_, count_array[1].id_);
+  ASSERT_EQ(two.count_, count_array[1].count_);
+}
+
+vector<uint8_t> array_or_vector_of_struct{
+    0x04,              // _count_
+    0x01, 0x01, 0x02,  // id, id * 0x0201
+    0x02, 0x02, 0x04, 0x03, 0x03, 0x06, 0x04, 0x04, 0x08,
+};
+
+TEST(GeneratedPacketTest, testVectorOfStruct) {
+  std::vector<TwoRelatedNumbers> count_array;
+  for (uint8_t i = 1; i < 5; i++) {
+    TwoRelatedNumbers trn;
+    trn.id_ = i;
+    trn.count_ = 0x0201 * i;
+    count_array.push_back(trn);
+  }
+
+  // Make a copy
+  std::vector<TwoRelatedNumbers> copy_array(count_array);
+
+  auto packet = VectorOfStructBuilder::Create(count_array);
+
+  // Change the original vector to make sure a copy was made.
+  count_array[0].id_ = count_array[0].id_ + 1;
+
+  ASSERT_EQ(array_or_vector_of_struct.size(), packet->size());
+
+  std::shared_ptr<std::vector<uint8_t>> packet_bytes = std::make_shared<std::vector<uint8_t>>();
+  BitInserter it(*packet_bytes);
+  packet->Serialize(it);
+
+  ASSERT_EQ(array_or_vector_of_struct.size(), packet_bytes->size());
+  for (size_t i = 0; i < array_or_vector_of_struct.size(); i++) {
+    ASSERT_EQ(array_or_vector_of_struct[i], packet_bytes->at(i));
+  }
+
+  PacketView<kLittleEndian> packet_bytes_view(packet_bytes);
+  auto view = VectorOfStructView::Create(packet_bytes_view);
+  ASSERT_TRUE(view.IsValid());
+  auto array = view.GetArray();
+  ASSERT_EQ(copy_array.size(), array.size());
+  for (size_t i = 0; i < copy_array.size(); i++) {
+    ASSERT_EQ(array[i].id_, copy_array[i].id_);
+    ASSERT_EQ(array[i].count_, copy_array[i].count_);
+  }
+}
+
+TEST(GeneratedPacketTest, testArrayOfStruct) {
+  std::array<TwoRelatedNumbers, 4> count_array;
+  for (uint8_t i = 1; i < 5; i++) {
+    TwoRelatedNumbers trn;
+    trn.id_ = i;
+    trn.count_ = 0x0201 * i;
+    count_array[i - 1] = trn;
+  }
+
+  // Make a copy
+  std::array<TwoRelatedNumbers, 4> copy_array(count_array);
+
+  auto packet = ArrayOfStructBuilder::Create(4, count_array);
+
+  // Change the original vector to make sure a copy was made.
+  count_array[0].id_ = count_array[0].id_ + 1;
+
+  ASSERT_EQ(array_or_vector_of_struct.size(), packet->size());
+
+  std::shared_ptr<std::vector<uint8_t>> packet_bytes = std::make_shared<std::vector<uint8_t>>();
+  BitInserter it(*packet_bytes);
+  packet->Serialize(it);
+
+  ASSERT_EQ(array_or_vector_of_struct.size(), packet_bytes->size());
+  for (size_t i = 0; i < array_or_vector_of_struct.size(); i++) {
+    ASSERT_EQ(array_or_vector_of_struct[i], packet_bytes->at(i));
+  }
+
+  PacketView<kLittleEndian> packet_bytes_view(packet_bytes);
+  auto view = ArrayOfStructView::Create(packet_bytes_view);
+  ASSERT_TRUE(view.IsValid());
+  auto array = view.GetArray();
+  ASSERT_EQ(copy_array.size(), array.size());
+  for (size_t i = 0; i < copy_array.size(); i++) {
+    ASSERT_EQ(array[i].id_, copy_array[i].id_);
+    ASSERT_EQ(array[i].count_, copy_array[i].count_);
+  }
+}
+
+vector<uint8_t> one_fixed_types_struct{
+    0x05,                                // four_bits = FIVE, reserved
+    0xf3,                                // _fixed_
+    0x0d,                                // id = 0x0d
+    0x01, 0x02, 0x03,                    // array = { 1, 2, 3}
+    0x06, 0x01,                          // example_checksum
+    0xa1, 0xa2, 0xa3, 0xa4, 0xa5, 0xa6,  // six_bytes
+};
+
+TEST(GeneratedPacketTest, testOneFixedTypesStruct) {
+  StructWithFixedTypes swf;
+  swf.four_bits_ = FourBits::FIVE;
+  swf.id_ = 0x0d;
+  swf.array_ = {{0x01, 0x02, 0x03}};
+  swf.six_bytes_ = SixBytes{{0xa1, 0xa2, 0xa3, 0xa4, 0xa5, 0xa6}};
+
+  auto packet = OneFixedTypesStructBuilder::Create(swf);
+  ASSERT_EQ(one_fixed_types_struct.size(), packet->size());
+
+  std::shared_ptr<std::vector<uint8_t>> packet_bytes = std::make_shared<std::vector<uint8_t>>();
+  BitInserter it(*packet_bytes);
+  packet->Serialize(it);
+
+  ASSERT_EQ(one_fixed_types_struct.size(), packet_bytes->size());
+  for (size_t i = 0; i < one_fixed_types_struct.size(); i++) {
+    ASSERT_EQ(one_fixed_types_struct[i], packet_bytes->at(i));
+  }
+
+  PacketView<kLittleEndian> packet_bytes_view(packet_bytes);
+  auto view = OneFixedTypesStructView::Create(packet_bytes_view);
+  ASSERT_TRUE(view.IsValid());
+  auto one = view.GetOne();
+  ASSERT_EQ(one.four_bits_, swf.four_bits_);
+  ASSERT_EQ(one.id_, swf.id_);
+  ASSERT_EQ(one.array_, swf.array_);
+  ASSERT_EQ(one.six_bytes_, swf.six_bytes_);
+}
+
+vector<uint8_t> array_of_struct_and_another{
+    0x03,              // _count_
+    0x01, 0x01, 0x02,  // id, id * 0x0201
+    0x02, 0x02, 0x04,  // 2
+    0x03, 0x03, 0x06,  // 3
+    0x04, 0x04, 0x08,  // Another
+};
+
+TEST(GeneratedPacketTest, testArrayOfStructAndAnother) {
+  std::vector<TwoRelatedNumbers> count_array;
+  for (uint8_t i = 1; i < 4; i++) {
+    TwoRelatedNumbers trn;
+    trn.id_ = i;
+    trn.count_ = 0x0201 * i;
+    count_array.push_back(trn);
+  }
+  TwoRelatedNumbers another;
+  another.id_ = 4;
+  another.count_ = 0x0201 * 4;
+
+  auto packet = ArrayOfStructAndAnotherBuilder::Create(count_array, another);
+  ASSERT_EQ(array_or_vector_of_struct.size(), packet->size());
+
+  std::shared_ptr<std::vector<uint8_t>> packet_bytes = std::make_shared<std::vector<uint8_t>>();
+  BitInserter it(*packet_bytes);
+  packet->Serialize(it);
+
+  ASSERT_EQ(array_of_struct_and_another.size(), packet_bytes->size());
+  for (size_t i = 0; i < array_of_struct_and_another.size(); i++) {
+    ASSERT_EQ(array_of_struct_and_another[i], packet_bytes->at(i));
+  }
+
+  PacketView<kLittleEndian> packet_bytes_view(packet_bytes);
+  auto view = ArrayOfStructAndAnotherView::Create(packet_bytes_view);
+  ASSERT_TRUE(view.IsValid());
+  auto array = view.GetArray();
+  ASSERT_EQ(count_array.size(), array.size());
+  for (size_t i = 0; i < count_array.size(); i++) {
+    ASSERT_EQ(array[i].id_, count_array[i].id_);
+    ASSERT_EQ(array[i].count_, count_array[i].count_);
+  }
+  auto nother = view.GetAnother();
+  ASSERT_EQ(nother.id_, another.id_);
+  ASSERT_EQ(nother.count_, another.count_);
+}
+
+DEFINE_AND_INSTANTIATE_OneArrayOfStructAndAnotherStructReflectionTest(array_of_struct_and_another);
+
+TEST(GeneratedPacketTest, testOneArrayOfStructAndAnotherStruct) {
+  std::shared_ptr<std::vector<uint8_t>> packet_bytes =
+      std::make_shared<std::vector<uint8_t>>(array_of_struct_and_another);
+
+  PacketView<kLittleEndian> packet_bytes_view(packet_bytes);
+  auto view = OneArrayOfStructAndAnotherStructView::Create(packet_bytes_view);
+  ASSERT_TRUE(view.IsValid());
+  auto one = view.GetOne();
+  ASSERT_EQ(one.array_.size(), 3);
+  ASSERT_EQ(one.another_.id_, 4);
+  ASSERT_EQ(one.another_.count_, 0x0804);
+}
+
+vector<uint8_t> sized_array_of_struct_and_another{
+    0x09,              // _size_
+    0x01, 0x01, 0x02,  // id, id * 0x0201
+    0x02, 0x02, 0x04,  // 2
+    0x03, 0x03, 0x06,  // 3
+    0x04, 0x04, 0x08,  // Another
+};
+
+DEFINE_AND_INSTANTIATE_OneSizedArrayOfStructAndAnotherStructReflectionTest(sized_array_of_struct_and_another);
+
+vector<uint8_t> bit_field_group_packet{
+    // seven_bits_ = 0x77, straddle_ = 0x5, five_bits_ = 0x15
+    0xf7,  // 0x77 | (0x5 & 0x1) << 7
+    0xaa,  //  0x15 << 3 | (0x5 >> 1)
+};
+
+TEST(GeneratedPacketTest, testBitFieldGroupPacket) {
+  uint8_t seven_bits = 0x77;
+  uint8_t straddle = 0x5;
+  uint8_t five_bits = 0x15;
+
+  auto packet = BitFieldGroupPacketBuilder::Create(seven_bits, straddle, five_bits);
+  ASSERT_EQ(bit_field_group_packet.size(), packet->size());
+
+  std::shared_ptr<std::vector<uint8_t>> packet_bytes = std::make_shared<std::vector<uint8_t>>();
+  BitInserter it(*packet_bytes);
+  packet->Serialize(it);
+
+  ASSERT_EQ(bit_field_group_packet.size(), packet_bytes->size());
+  for (size_t i = 0; i < bit_field_group_packet.size(); i++) {
+    ASSERT_EQ(bit_field_group_packet[i], packet_bytes->at(i));
+  }
+
+  PacketView<kLittleEndian> packet_bytes_view(packet_bytes);
+  auto view = BitFieldGroupPacketView::Create(packet_bytes_view);
+  ASSERT_TRUE(view.IsValid());
+  ASSERT_EQ(seven_bits, view.GetSevenBits());
+  ASSERT_EQ(straddle, view.GetStraddle());
+  ASSERT_EQ(five_bits, view.GetFiveBits());
+}
+
+vector<uint8_t> bit_field_packet{
+    // seven_bits_ = 0x77, straddle_ = 0x5, five_bits_ = 0x15
+    0xf7,  // 0x77 | (0x5 & 0x1) << 7
+    0xaa,  //  0x15 << 3 | (0x5 >> 1)
+};
+
+TEST(GeneratedPacketTest, testBitFieldPacket) {
+  BitField bit_field;
+  bit_field.seven_bits_ = 0x77;
+  bit_field.straddle_ = 0x5;
+  bit_field.five_bits_ = 0x15;
+
+  auto packet = BitFieldPacketBuilder::Create(bit_field);
+  ASSERT_EQ(bit_field_packet.size(), packet->size());
+
+  std::shared_ptr<std::vector<uint8_t>> packet_bytes = std::make_shared<std::vector<uint8_t>>();
+  BitInserter it(*packet_bytes);
+  packet->Serialize(it);
+
+  ASSERT_EQ(bit_field_packet.size(), packet_bytes->size());
+  for (size_t i = 0; i < bit_field_packet.size(); i++) {
+    ASSERT_EQ(bit_field_packet[i], packet_bytes->at(i));
+  }
+
+  PacketView<kLittleEndian> packet_bytes_view(packet_bytes);
+  auto view = BitFieldPacketView::Create(packet_bytes_view);
+  ASSERT_TRUE(view.IsValid());
+  BitField bf = view.GetBitField();
+  ASSERT_EQ(bf.seven_bits_, bit_field.seven_bits_);
+  ASSERT_EQ(bf.straddle_, bit_field.straddle_);
+  ASSERT_EQ(bf.five_bits_, bit_field.five_bits_);
+}
+
+vector<uint8_t> bit_field_group_after_unsized_array_packet{
+    0x01, 0x02, 0x03, 0x04,  // byte array
+    // seven_bits_ = 0x77, straddle_ = 0x5, five_bits_ = 0x15
+    0xf7,  // 0x77 | (0x5 & 0x1) << 7
+    0xaa,  //  0x15 << 3 | (0x5 >> 1)
+};
+
+TEST(GeneratedPacketTest, testBitFieldGroupAfterUnsizedArrayPacket) {
+  std::vector<uint8_t> count_array;
+  for (uint8_t i = 1; i < 5; i++) {
+    count_array.push_back(i);
+  }
+  uint8_t seven_bits = 0x77;
+  uint8_t straddle = 0x5;
+  uint8_t five_bits = 0x15;
+
+  auto packet = BitFieldGroupAfterUnsizedArrayPacketBuilder::Create(count_array, seven_bits, straddle, five_bits);
+  ASSERT_EQ(bit_field_group_after_unsized_array_packet.size(), packet->size());
+
+  std::shared_ptr<std::vector<uint8_t>> packet_bytes = std::make_shared<std::vector<uint8_t>>();
+  BitInserter it(*packet_bytes);
+  packet->Serialize(it);
+
+  ASSERT_EQ(bit_field_group_after_unsized_array_packet.size(), packet_bytes->size());
+  for (size_t i = 0; i < bit_field_group_after_unsized_array_packet.size(); i++) {
+    ASSERT_EQ(bit_field_group_after_unsized_array_packet[i], packet_bytes->at(i));
+  }
+
+  PacketView<kLittleEndian> packet_bytes_view(packet_bytes);
+  auto payload_view = BitFieldGroupAfterPayloadPacketView::Create(packet_bytes_view);
+  ASSERT_TRUE(payload_view.IsValid());
+  EXPECT_EQ(seven_bits, payload_view.GetSevenBits());
+  EXPECT_EQ(straddle, payload_view.GetStraddle());
+  EXPECT_EQ(five_bits, payload_view.GetFiveBits());
+
+  auto view = BitFieldGroupAfterUnsizedArrayPacketView::Create(payload_view);
+  ASSERT_TRUE(view.IsValid());
+  auto array = view.GetArray();
+  ASSERT_EQ(count_array.size(), array.size());
+  for (size_t i = 0; i < count_array.size(); i++) {
+    ASSERT_EQ(array[i], count_array[i]);
+  }
+  ASSERT_EQ(seven_bits, view.GetSevenBits());
+  ASSERT_EQ(straddle, view.GetStraddle());
+  ASSERT_EQ(five_bits, view.GetFiveBits());
+}
+
+vector<uint8_t> bit_field_after_unsized_array_packet{
+    0x01, 0x02, 0x03, 0x04,  // byte array
+    // seven_bits_ = 0x77, straddle_ = 0x5, five_bits_ = 0x15
+    0xf7,  // 0x77 | (0x5 & 0x1) << 7
+    0xaa,  //  0x15 << 3 | (0x5 >> 1)
+};
+
+TEST(GeneratedPacketTest, testBitFieldAfterUnsizedArrayPacket) {
+  std::vector<uint8_t> count_array;
+  for (uint8_t i = 1; i < 5; i++) {
+    count_array.push_back(i);
+  }
+  BitField bit_field;
+  bit_field.seven_bits_ = 0x77;
+  bit_field.straddle_ = 0x5;
+  bit_field.five_bits_ = 0x15;
+
+  auto packet = BitFieldAfterUnsizedArrayPacketBuilder::Create(count_array, bit_field);
+  ASSERT_EQ(bit_field_after_unsized_array_packet.size(), packet->size());
+
+  std::shared_ptr<std::vector<uint8_t>> packet_bytes = std::make_shared<std::vector<uint8_t>>();
+  BitInserter it(*packet_bytes);
+  packet->Serialize(it);
+
+  ASSERT_EQ(bit_field_after_unsized_array_packet.size(), packet_bytes->size());
+  for (size_t i = 0; i < bit_field_after_unsized_array_packet.size(); i++) {
+    ASSERT_EQ(bit_field_after_unsized_array_packet[i], packet_bytes->at(i));
+  }
+
+  PacketView<kLittleEndian> packet_bytes_view(packet_bytes);
+  auto payload_view = BitFieldAfterPayloadPacketView::Create(packet_bytes_view);
+  ASSERT_TRUE(payload_view.IsValid());
+  BitField parent_bf = payload_view.GetBitField();
+  ASSERT_EQ(parent_bf.seven_bits_, bit_field.seven_bits_);
+  ASSERT_EQ(parent_bf.straddle_, bit_field.straddle_);
+  ASSERT_EQ(parent_bf.five_bits_, bit_field.five_bits_);
+
+  auto view = BitFieldAfterUnsizedArrayPacketView::Create(payload_view);
+  ASSERT_TRUE(view.IsValid());
+  auto array = view.GetArray();
+  ASSERT_EQ(count_array.size(), array.size());
+  for (size_t i = 0; i < count_array.size(); i++) {
+    ASSERT_EQ(array[i], count_array[i]);
+  }
+  BitField bf = view.GetBitField();
+  ASSERT_EQ(bf.seven_bits_, bit_field.seven_bits_);
+  ASSERT_EQ(bf.straddle_, bit_field.straddle_);
+  ASSERT_EQ(bf.five_bits_, bit_field.five_bits_);
+}
+
+vector<uint8_t> bit_field_array_packet{
+    0x06,  // _size_(array)
+    // seven_bits_ = 0x77, straddle_ = 0x5, five_bits_ = 0x15
+    0xf7,  // 0x77 | (0x5 & 0x1) << 7
+    0xaa,  //  0x15 << 3 | (0x5 >> 1)
+
+    // seven_bits_ = 0x78, straddle_ = 0x6, five_bits_ = 0x16
+    0x78,  // 0x78 | (0x6 & 0x1) << 7
+    0xb3,  //  0x16 << 3 | (0x6 >> 1)
+
+    // seven_bits_ = 0x79, straddle_ = 0x7, five_bits_ = 0x17
+    0xf9,  // 0x79 | (0x7 & 0x1) << 7
+    0xbb,  //  0x17 << 3 | (0x7 >> 1)
+};
+
+TEST(GeneratedPacketTest, testBitFieldArrayPacket) {
+  std::vector<BitField> count_array;
+  for (size_t i = 0; i < 3; i++) {
+    BitField bf;
+    bf.seven_bits_ = 0x77 + i;
+    bf.straddle_ = 0x5 + i;
+    bf.five_bits_ = 0x15 + i;
+    count_array.push_back(bf);
+  }
+
+  auto packet = BitFieldArrayPacketBuilder::Create(count_array);
+  ASSERT_EQ(bit_field_array_packet.size(), packet->size());
+
+  std::shared_ptr<std::vector<uint8_t>> packet_bytes = std::make_shared<std::vector<uint8_t>>();
+  BitInserter it(*packet_bytes);
+  packet->Serialize(it);
+
+  ASSERT_EQ(bit_field_array_packet.size(), packet_bytes->size());
+  for (size_t i = 0; i < bit_field_array_packet.size(); i++) {
+    ASSERT_EQ(bit_field_array_packet[i], packet_bytes->at(i));
+  }
+
+  PacketView<kLittleEndian> packet_bytes_view(packet_bytes);
+  auto view = BitFieldArrayPacketView::Create(packet_bytes_view);
+  ASSERT_TRUE(view.IsValid());
+  auto array = view.GetArray();
+  ASSERT_EQ(count_array.size(), array.size());
+  for (size_t i = 0; i < count_array.size(); i++) {
+    ASSERT_EQ(array[i].seven_bits_, count_array[i].seven_bits_);
+    ASSERT_EQ(array[i].straddle_, count_array[i].straddle_);
+    ASSERT_EQ(array[i].five_bits_, count_array[i].five_bits_);
+  }
+}
+
+TEST(GeneratedPacketTest, testNewBitFieldArrayPacket) {
+  PacketView<kLittleEndian> packet_bytes_view(std::make_shared<std::vector<uint8_t>>(bit_field_array_packet));
+  auto view = BitFieldArrayPacketView::Create(packet_bytes_view);
+  ASSERT_TRUE(view.IsValid());
+
+  auto packet = BitFieldArrayPacketBuilder::Create(view.GetArray());
+  ASSERT_EQ(bit_field_array_packet.size(), packet->size());
+
+  std::shared_ptr<std::vector<uint8_t>> packet_bytes = std::make_shared<std::vector<uint8_t>>();
+  BitInserter it(*packet_bytes);
+  packet->Serialize(it);
+
+  ASSERT_EQ(*packet_bytes, bit_field_array_packet);
+}
+
+std::vector<uint8_t> child_two_two_two_ = {0x20, 0x02};
+std::vector<uint8_t> child_two_two_three_ = {0x20, 0x03};
+std::vector<uint8_t> child_two_two_four_ = {0x20, 0x04};
+
+DEFINE_AND_INSTANTIATE_ParentTwoReflectionTest(child_two_two_two_, child_two_two_three_, child_two_two_four_);
+
+DEFINE_AND_INSTANTIATE_ChildTwoTwoReflectionTest(child_two_two_two_, child_two_two_three_, child_two_two_four_);
+
+DEFINE_AND_INSTANTIATE_ChildTwoTwoThreeReflectionTest(child_two_two_three_);
+
+std::vector<uint8_t> one_versionless_struct_packet = {0x01};
+std::vector<uint8_t> one_versioned_struct_packet = {0x02, 0x03 /* version */, 0x04, 0x05, 0x06};
+std::vector<uint8_t> one_version_one_struct_packet = {0x03, 0x01 /* version */, 0x02};
+std::vector<uint8_t> one_version_two_struct_packet = {0x03, 0x02 /* version */, 0x03, 0x04};
+DEFINE_AND_INSTANTIATE_OneVersionlessStructPacketReflectionTest(one_versionless_struct_packet,
+                                                                one_versioned_struct_packet,
+                                                                one_version_one_struct_packet,
+                                                                one_version_two_struct_packet);
+DEFINE_AND_INSTANTIATE_OneVersionedStructPacketReflectionTest(one_versioned_struct_packet,
+                                                              one_version_one_struct_packet,
+                                                              one_version_two_struct_packet);
+DEFINE_AND_INSTANTIATE_OneVersionOneStructPacketReflectionTest(one_version_one_struct_packet);
+DEFINE_AND_INSTANTIATE_OneVersionTwoStructPacketReflectionTest(one_version_two_struct_packet);
+
+vector<uint8_t> one_struct_be{
+    0x01, 0x02, 0x03,  // id = 0x01, count = 0x0203
+};
+
+TEST(GeneratedPacketTest, testOneStructBe) {
+  TwoRelatedNumbersBe trn;
+  trn.id_ = 1;
+  trn.count_ = 0x0203;
+
+  auto packet = OneStructBeBuilder::Create(trn);
+  ASSERT_EQ(one_struct_be.size(), packet->size());
+
+  std::shared_ptr<std::vector<uint8_t>> packet_bytes = std::make_shared<std::vector<uint8_t>>();
+  BitInserter it(*packet_bytes);
+  packet->Serialize(it);
+
+  ASSERT_EQ(one_struct_be.size(), packet_bytes->size());
+  for (size_t i = 0; i < one_struct_be.size(); i++) {
+    ASSERT_EQ(one_struct_be[i], packet_bytes->at(i));
+  }
+
+  PacketView<!kLittleEndian> packet_bytes_view(packet_bytes);
+  auto view = OneStructBeView::Create(packet_bytes_view);
+  ASSERT_TRUE(view.IsValid());
+  auto one = view.GetOne();
+  ASSERT_EQ(one.id_, trn.id_);
+  ASSERT_EQ(one.count_, trn.count_);
+}
+
+vector<uint8_t> two_structs_be{
+    0x01, 0x01, 0x02,  // id, id * 0x0102
+    0x02, 0x02, 0x04,
+};
+
+TEST(GeneratedPacketTest, testTwoStructsBe) {
+  std::vector<TwoRelatedNumbersBe> count_array;
+  for (uint8_t i = 1; i < 3; i++) {
+    TwoRelatedNumbersBe trn;
+    trn.id_ = i;
+    trn.count_ = 0x0102 * i;
+    count_array.push_back(trn);
+  }
+
+  auto packet = TwoStructsBeBuilder::Create(count_array[0], count_array[1]);
+  ASSERT_EQ(two_structs_be.size(), packet->size());
+
+  std::shared_ptr<std::vector<uint8_t>> packet_bytes = std::make_shared<std::vector<uint8_t>>();
+  BitInserter it(*packet_bytes);
+  packet->Serialize(it);
+
+  ASSERT_EQ(two_structs_be.size(), packet_bytes->size());
+  for (size_t i = 0; i < two_structs_be.size(); i++) {
+    ASSERT_EQ(two_structs_be[i], packet_bytes->at(i));
+  }
+
+  PacketView<!kLittleEndian> packet_bytes_view(packet_bytes);
+  auto view = TwoStructsBeView::Create(packet_bytes_view);
+  ASSERT_TRUE(view.IsValid());
+  auto one = view.GetOne();
+  ASSERT_EQ(one.id_, count_array[0].id_);
+  ASSERT_EQ(one.count_, count_array[0].count_);
+  auto two = view.GetTwo();
+  ASSERT_EQ(two.id_, count_array[1].id_);
+  ASSERT_EQ(two.count_, count_array[1].count_);
+}
+
+vector<uint8_t> array_of_struct_be{
+    0x04,              // _count_
+    0x01, 0x01, 0x02,  // id, id * 0x0102
+    0x02, 0x02, 0x04, 0x03, 0x03, 0x06, 0x04, 0x04, 0x08,
+};
+
+TEST(GeneratedPacketTest, testArrayOfStructBe) {
+  std::vector<TwoRelatedNumbersBe> count_array;
+  for (uint8_t i = 1; i < 5; i++) {
+    TwoRelatedNumbersBe trn;
+    trn.id_ = i;
+    trn.count_ = 0x0102 * i;
+    count_array.push_back(trn);
+  }
+
+  auto packet = ArrayOfStructBeBuilder::Create(count_array);
+
+  ASSERT_EQ(array_of_struct_be.size(), packet->size());
+
+  std::shared_ptr<std::vector<uint8_t>> packet_bytes = std::make_shared<std::vector<uint8_t>>();
+  BitInserter it(*packet_bytes);
+  packet->Serialize(it);
+
+  ASSERT_EQ(array_of_struct_be.size(), packet_bytes->size());
+  for (size_t i = 0; i < array_of_struct_be.size(); i++) {
+    ASSERT_EQ(array_of_struct_be[i], packet_bytes->at(i));
+  }
+
+  PacketView<!kLittleEndian> packet_bytes_view(packet_bytes);
+  auto view = ArrayOfStructBeView::Create(packet_bytes_view);
+  ASSERT_TRUE(view.IsValid());
+  auto array = view.GetArray();
+  ASSERT_EQ(count_array.size(), array.size());
+  for (size_t i = 0; i < count_array.size(); i++) {
+    ASSERT_EQ(array[i].id_, count_array[i].id_);
+    ASSERT_EQ(array[i].count_, count_array[i].count_);
+  }
+}
+
+vector<uint8_t> one_four_byte_struct{
+    0x04,                    // struct_type_ = FourByte
+    0xd1, 0xd2, 0xd3, 0xd4,  // four_bytes_
+};
+
+TEST(GeneratedPacketTest, testOneFourByteStruct) {
+  FourByteStruct four_byte_struct;
+  four_byte_struct.four_bytes_ = 0xd4d3d2d1;
+
+  auto packet = OneFourByteStructBuilder::Create(four_byte_struct);
+  ASSERT_EQ(one_four_byte_struct.size(), packet->size());
+
+  std::shared_ptr<std::vector<uint8_t>> packet_bytes = std::make_shared<std::vector<uint8_t>>();
+  BitInserter it(*packet_bytes);
+  packet->Serialize(it);
+
+  ASSERT_EQ(one_four_byte_struct.size(), packet_bytes->size());
+  for (size_t i = 0; i < one_four_byte_struct.size(); i++) {
+    ASSERT_EQ(one_four_byte_struct[i], packet_bytes->at(i));
+  }
+
+  PacketView<kLittleEndian> packet_bytes_view(packet_bytes);
+  auto view = OneFourByteStructView::Create(packet_bytes_view);
+  ASSERT_TRUE(view.IsValid());
+  ASSERT_EQ(StructType::FOUR_BYTE, view.GetOneStruct().struct_type_);
+  ASSERT_EQ(four_byte_struct.four_bytes_, view.GetOneStruct().four_bytes_);
+}
+
+vector<uint8_t> generic_struct_two{
+    0x02,        // struct_type_ = TwoByte
+    0x01, 0x02,  // two_bytes_
+};
+
+TEST(GeneratedPacketTest, testOneGenericStructTwo) {
+  TwoByteStruct two_byte_struct;
+  two_byte_struct.two_bytes_ = 0x0201;
+  std::unique_ptr<TwoByteStruct> two_byte_struct_ptr = std::make_unique<TwoByteStruct>(two_byte_struct);
+
+  auto packet = OneGenericStructBuilder::Create(std::move(two_byte_struct_ptr));
+  ASSERT_EQ(generic_struct_two.size(), packet->size());
+
+  std::shared_ptr<std::vector<uint8_t>> packet_bytes = std::make_shared<std::vector<uint8_t>>();
+  BitInserter it(*packet_bytes);
+  packet->Serialize(it);
+
+  ASSERT_EQ(generic_struct_two.size(), packet_bytes->size());
+  for (size_t i = 0; i < generic_struct_two.size(); i++) {
+    ASSERT_EQ(generic_struct_two[i], packet_bytes->at(i));
+  }
+
+  PacketView<kLittleEndian> packet_bytes_view(packet_bytes);
+  auto view = OneGenericStructView::Create(packet_bytes_view);
+  ASSERT_TRUE(view.IsValid());
+  auto base_struct = view.GetBaseStruct();
+  ASSERT_NE(nullptr, base_struct);
+  ASSERT_TRUE(TwoByteStruct::IsInstance(*base_struct));
+  TwoByteStruct* two_byte = static_cast<TwoByteStruct*>(base_struct.get());
+  ASSERT_NE(nullptr, two_byte);
+  ASSERT_TRUE(TwoByteStruct::IsInstance(*two_byte));
+  ASSERT_EQ(two_byte_struct.two_bytes_, 0x0201);
+  uint16_t val = two_byte->two_bytes_;
+  ASSERT_EQ(val, 0x0201);
+  ASSERT_EQ(two_byte_struct.two_bytes_, ((TwoByteStruct*)base_struct.get())->two_bytes_);
+}
+
+vector<uint8_t> generic_struct_four{
+    0x04,                    // struct_type_ = FourByte
+    0x01, 0x02, 0x03, 0x04,  // four_bytes_
+};
+
+TEST(GeneratedPacketTest, testOneGenericStructFour) {
+  FourByteStruct four_byte_struct;
+  four_byte_struct.four_bytes_ = 0x04030201;
+  std::unique_ptr<FourByteStruct> four_byte_struct_p = std::make_unique<FourByteStruct>(four_byte_struct);
+  ASSERT_EQ(four_byte_struct.four_bytes_, four_byte_struct_p->four_bytes_);
+
+  auto packet = OneGenericStructBuilder::Create(std::move(four_byte_struct_p));
+  ASSERT_EQ(generic_struct_four.size(), packet->size());
+
+  std::shared_ptr<std::vector<uint8_t>> packet_bytes = std::make_shared<std::vector<uint8_t>>();
+  BitInserter it(*packet_bytes);
+  packet->Serialize(it);
+
+  ASSERT_EQ(generic_struct_four.size(), packet_bytes->size());
+  for (size_t i = 0; i < generic_struct_four.size(); i++) {
+    ASSERT_EQ(generic_struct_four[i], packet_bytes->at(i));
+  }
+
+  PacketView<kLittleEndian> packet_bytes_view(packet_bytes);
+  auto view = OneGenericStructView::Create(packet_bytes_view);
+  ASSERT_TRUE(view.IsValid());
+  auto base_struct = view.GetBaseStruct();
+  ASSERT_NE(nullptr, base_struct);
+  ASSERT_EQ(StructType::FOUR_BYTE, base_struct->struct_type_);
+  ASSERT_EQ(four_byte_struct.four_bytes_, ((FourByteStruct*)base_struct.get())->four_bytes_);
+}
+
+vector<uint8_t> one_struct_array{
+    0x04,                    // struct_type_ = FourByte
+    0xa1, 0xa2, 0xa3, 0xa4,  // four_bytes_
+    0x04,                    // struct_type_ = FourByte
+    0xb2, 0xb2, 0xb3, 0xb4,  // four_bytes_
+    0x02,                    // struct_type_ = TwoByte
+    0xc3, 0xc2,              // two_bytes_
+    0x04,                    // struct_type_ = TwoByte
+    0xd4, 0xd2, 0xd3, 0xd4,  // four_bytes_
+};
+
+TEST(GeneratedPacketTest, testOneGenericStructArray) {
+  std::vector<std::unique_ptr<UnusedParentStruct>> parent_vector;
+  std::unique_ptr<FourByteStruct> fbs;
+  std::unique_ptr<TwoByteStruct> tbs;
+  fbs = std::make_unique<FourByteStruct>();
+  fbs->four_bytes_ = 0xa4a3a2a1;
+  parent_vector.push_back(std::move(fbs));
+  fbs = std::make_unique<FourByteStruct>();
+  fbs->four_bytes_ = 0xb4b3b2b2;
+  parent_vector.push_back(std::move(fbs));
+  tbs = std::make_unique<TwoByteStruct>();
+  tbs->two_bytes_ = 0xc2c3;
+  parent_vector.push_back(std::move(tbs));
+  fbs = std::make_unique<FourByteStruct>();
+  fbs->four_bytes_ = 0xd4d3d2d4;
+  parent_vector.push_back(std::move(fbs));
+
+  std::vector<std::unique_ptr<UnusedParentStruct>> vector_copy;
+  for (auto& s : parent_vector) {
+    if (s->struct_type_ == StructType::TWO_BYTE) {
+      vector_copy.push_back(std::make_unique<TwoByteStruct>(*(TwoByteStruct*)s.get()));
+    }
+    if (s->struct_type_ == StructType::FOUR_BYTE) {
+      vector_copy.push_back(std::make_unique<FourByteStruct>(*(FourByteStruct*)s.get()));
+    }
+  }
+
+  auto packet = OneGenericStructArrayBuilder::Create(std::move(parent_vector));
+  ASSERT_EQ(one_struct_array.size(), packet->size());
+
+  std::shared_ptr<std::vector<uint8_t>> packet_bytes = std::make_shared<std::vector<uint8_t>>();
+  BitInserter it(*packet_bytes);
+  packet->Serialize(it);
+
+  ASSERT_EQ(one_struct_array.size(), packet_bytes->size());
+  for (size_t i = 0; i < one_struct_array.size(); i++) {
+    ASSERT_EQ(one_struct_array[i], packet_bytes->at(i));
+  }
+
+  PacketView<kLittleEndian> packet_bytes_view(packet_bytes);
+  auto view = OneGenericStructArrayView::Create(packet_bytes_view);
+  ASSERT_TRUE(view.IsValid());
+  auto an_array = view.GetAnArray();
+  ASSERT_EQ(vector_copy.size(), an_array.size());
+  for (size_t i = 0; i < vector_copy.size(); i++) {
+    ASSERT_NE(nullptr, an_array[i]);
+    ASSERT_EQ(vector_copy[i]->struct_type_, an_array[i]->struct_type_);
+    if (vector_copy[i]->struct_type_ == StructType::FOUR_BYTE) {
+      ASSERT_EQ(FourByteStruct::Specialize(vector_copy[i].get())->four_bytes_,
+                FourByteStruct::Specialize(an_array[i].get())->four_bytes_);
+    } else {
+      ASSERT_EQ(TwoByteStruct::Specialize(vector_copy[i].get())->two_bytes_,
+                TwoByteStruct::Specialize(an_array[i].get())->two_bytes_);
+    }
+  }
+}
+
+TEST(GeneratedPacketTest, testOneGenericStructFourArray) {
+  std::array<std::unique_ptr<UnusedParentStruct>, 4> parent_vector;
+  std::unique_ptr<FourByteStruct> fbs;
+  std::unique_ptr<TwoByteStruct> tbs;
+  fbs = std::make_unique<FourByteStruct>();
+  fbs->four_bytes_ = 0xa4a3a2a1;
+  parent_vector[0] = std::move(fbs);
+  fbs = std::make_unique<FourByteStruct>();
+  fbs->four_bytes_ = 0xb4b3b2b2;
+  parent_vector[1] = std::move(fbs);
+  tbs = std::make_unique<TwoByteStruct>();
+  tbs->two_bytes_ = 0xc2c3;
+  parent_vector[2] = std::move(tbs);
+  fbs = std::make_unique<FourByteStruct>();
+  fbs->four_bytes_ = 0xd4d3d2d4;
+  parent_vector[3] = std::move(fbs);
+
+  std::array<std::unique_ptr<UnusedParentStruct>, 4> vector_copy;
+  size_t i = 0;
+  for (auto& s : parent_vector) {
+    if (s->struct_type_ == StructType::TWO_BYTE) {
+      vector_copy[i] = std::make_unique<TwoByteStruct>(*(TwoByteStruct*)s.get());
+    }
+    if (s->struct_type_ == StructType::FOUR_BYTE) {
+      vector_copy[i] = std::make_unique<FourByteStruct>(*(FourByteStruct*)s.get());
+    }
+    i++;
+  }
+
+  auto packet = OneGenericStructFourArrayBuilder::Create(std::move(parent_vector));
+  ASSERT_EQ(one_struct_array.size(), packet->size());
+
+  std::shared_ptr<std::vector<uint8_t>> packet_bytes = std::make_shared<std::vector<uint8_t>>();
+  BitInserter it(*packet_bytes);
+  packet->Serialize(it);
+
+  ASSERT_EQ(one_struct_array.size(), packet_bytes->size());
+  for (size_t i = 0; i < one_struct_array.size(); i++) {
+    ASSERT_EQ(one_struct_array[i], packet_bytes->at(i));
+  }
+
+  PacketView<kLittleEndian> packet_bytes_view(packet_bytes);
+  auto view = OneGenericStructFourArrayView::Create(packet_bytes_view);
+  ASSERT_TRUE(view.IsValid());
+  auto an_array = view.GetAnArray();
+  ASSERT_EQ(vector_copy.size(), an_array.size());
+  for (size_t i = 0; i < vector_copy.size(); i++) {
+    ASSERT_NE(nullptr, an_array[i]);
+    ASSERT_EQ(vector_copy[i]->struct_type_, an_array[i]->struct_type_);
+    if (vector_copy[i]->struct_type_ == StructType::FOUR_BYTE) {
+      ASSERT_EQ(FourByteStruct::Specialize(vector_copy[i].get())->four_bytes_,
+                FourByteStruct::Specialize(an_array[i].get())->four_bytes_);
+    } else {
+      ASSERT_EQ(TwoByteStruct::Specialize(vector_copy[i].get())->two_bytes_,
+                TwoByteStruct::Specialize(an_array[i].get())->two_bytes_);
+    }
+  }
+}
+
+vector<uint8_t> one_struct_array_after_fixed{
+    0x01, 0x02,              // two_bytes = 0x0201
+    0x04,                    // struct_type_ = FourByte
+    0xa1, 0xa2, 0xa3, 0xa4,  // four_bytes_
+    0x04,                    // struct_type_ = FourByte
+    0xb2, 0xb2, 0xb3, 0xb4,  // four_bytes_
+    0x02,                    // struct_type_ = TwoByte
+    0xc3, 0xc2,              // two_bytes_
+    0x04,                    // struct_type_ = TwoByte
+    0xd4, 0xd2, 0xd3, 0xd4,  // four_bytes_
+};
+
+DEFINE_AND_INSTANTIATE_OneGenericStructArrayAfterFixedReflectionTest(one_struct_array_after_fixed);
+
+vector<uint8_t> one_length_type_value_struct{
+    // _size_(value):16 type value
+    0x04, 0x00, 0x01, 'o', 'n', 'e',            // ONE
+    0x04, 0x00, 0x02, 't', 'w', 'o',            // TWO
+    0x06, 0x00, 0x03, 't', 'h', 'r', 'e', 'e',  // THREE
+};
+
+DEFINE_AND_INSTANTIATE_OneLengthTypeValueStructReflectionTest(one_length_type_value_struct);
+
+TEST(GeneratedPacketTest, testOneLengthTypeValueStruct) {
+  std::shared_ptr<std::vector<uint8_t>> packet_bytes =
+      std::make_shared<std::vector<uint8_t>>(one_length_type_value_struct);
+
+  PacketView<kLittleEndian> packet_bytes_view(packet_bytes);
+  auto view = OneLengthTypeValueStructView::Create(packet_bytes_view);
+  ASSERT_TRUE(view.IsValid());
+  auto one = view.GetOneArray();
+  size_t entry_id = 0;
+  for (const auto& entry : one) {
+    switch (entry_id++) {
+      case 0:
+        ASSERT_EQ(entry.type_, DataType::ONE);
+        ASSERT_EQ(entry.value_, std::vector<uint8_t>({'o', 'n', 'e'}));
+        break;
+      case 1:
+        ASSERT_EQ(entry.type_, DataType::TWO);
+        ASSERT_EQ(entry.value_, std::vector<uint8_t>({'t', 'w', 'o'}));
+        break;
+      case 2:
+        ASSERT_EQ(entry.type_, DataType::THREE);
+        ASSERT_EQ(entry.value_, std::vector<uint8_t>({'t', 'h', 'r', 'e', 'e'}));
+        break;
+      default:
+        ASSERT_EQ(entry.type_, DataType::UNUSED);
+    }
+  }
+}
+
+vector<uint8_t> one_length_type_value_struct_padded_20{
+    0x27,  // _size_(payload),
+    // _size_(value):16 type value
+    0x04, 0x00, 0x01, 'o', 'n', 'e',                             // ONE
+    0x04, 0x00, 0x02, 't', 'w', 'o',                             // TWO
+    0x06, 0x00, 0x03, 't', 'h', 'r', 'e', 'e',                   // THREE
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,        // padding to 30
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,  // padding to 40
+};
+
+vector<uint8_t> one_length_type_value_struct_padded_28{
+    0x27,  // _size_(payload),
+    // _size_(value):16 type value
+    0x04, 0x00, 0x01, 'o', 'n', 'e',                             // ONE
+    0x04, 0x00, 0x02, 't', 'w', 'o',                             // TWO
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,                    // padding to 20
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,  // padding to 30
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,  // padding to 40
+};
+
+// TODO: Revisit LTV parsing.  Right now, the padding bytes are parsed
+// DEFINE_AND_INSTANTIATE_OneLengthTypeValueStructPaddedReflectionTest(one_length_type_value_struct_padded_20,
+// one_length_type_value_struct_padded_28);
+
+TEST(GeneratedPacketTest, testOneLengthTypeValueStructPaddedGeneration) {
+  std::vector<LengthTypeValueStruct> ltv_vector;
+  LengthTypeValueStruct ltv;
+  ltv.type_ = DataType::ONE;
+  ltv.value_ = {
+      'o',
+      'n',
+      'e',
+  };
+  ltv_vector.push_back(ltv);
+  ltv.type_ = DataType::TWO;
+  ltv.value_ = {
+      't',
+      'w',
+      'o',
+  };
+  ltv_vector.push_back(ltv);
+
+  auto packet = OneLengthTypeValueStructPaddedBuilder::Create(ltv_vector);
+  ASSERT_EQ(one_length_type_value_struct_padded_28.size(), packet->size());
+
+  std::shared_ptr<std::vector<uint8_t>> packet_bytes = std::make_shared<std::vector<uint8_t>>();
+  BitInserter it(*packet_bytes);
+  packet->Serialize(it);
+
+  ASSERT_EQ(one_length_type_value_struct_padded_28.size(), packet_bytes->size());
+  for (size_t i = 0; i < one_length_type_value_struct_padded_28.size(); i++) {
+    ASSERT_EQ(one_length_type_value_struct_padded_28[i], packet_bytes->at(i));
+  }
+
+  PacketView<kLittleEndian> packet_bytes_view(packet_bytes);
+  auto view = OneLengthTypeValueStructPaddedView::Create(SizedParentView::Create(packet_bytes_view));
+  ASSERT_TRUE(view.IsValid());
+  auto an_array = view.GetOneArray();
+  // TODO: Revisit LTV parsing.  Right now, the padding bytes are parsed
+  // ASSERT_EQ(ltv_vector.size(), an_array.size());
+  for (size_t i = 0; i < ltv_vector.size(); i++) {
+    ASSERT_EQ(ltv_vector[i].type_, an_array[i].type_);
+    ASSERT_EQ(ltv_vector[i].value_, an_array[i].value_);
+  }
+}
 }  // namespace parser
 }  // namespace packet
 }  // namespace bluetooth
diff --git a/gd/packet/parser/test/simple_sum.h b/gd/packet/parser/test/simple_sum.h
index b66cb9a..95c4888 100644
--- a/gd/packet/parser/test/simple_sum.h
+++ b/gd/packet/parser/test/simple_sum.h
@@ -25,16 +25,16 @@
 
 class SimpleSum {
  public:
-  static void Initialize(SimpleSum& s) {
-    s.sum = 0;
+  void Initialize() {
+    sum = 0;
   }
 
-  static void AddByte(SimpleSum& s, uint8_t byte) {
-    s.sum += byte;
+  void AddByte(uint8_t byte) {
+    sum += byte;
   }
 
-  static uint16_t GetChecksum(const SimpleSum& s) {
-    return s.sum;
+  uint16_t GetChecksum() const {
+    return sum;
   }
 
  private:
diff --git a/gd/packet/parser/test/test_packets.pdl b/gd/packet/parser/test/test_packets.pdl
index d4bcd24..3c24509 100644
--- a/gd/packet/parser/test/test_packets.pdl
+++ b/gd/packet/parser/test/test_packets.pdl
@@ -1,6 +1,7 @@
 little_endian_packets
 
 custom_field SixBytes : 48 "packet/parser/test/"
+custom_field Variable "packet/parser/test/"
 
 packet Parent {
   _fixed_ = 0x12 : 8,
@@ -17,6 +18,8 @@
   ONE = 1,
   TWO = 2,
   THREE = 3,
+  FIVE = 5,
+  TEN = 10,
   LAZY_ME = 15,
 }
 
@@ -40,6 +43,21 @@
 packet ChildTwoTwoThree :ChildTwoTwo (more_bits = THREE) {
 }
 
+enum TwoBits : 2 {
+  ZERO = 0,
+  ONE = 1,
+  TWO = 2,
+  THREE = 3,
+}
+
+packet MiddleFourBits {
+  low_two : TwoBits,
+  next_four : FourBits,
+  straddle : FourBits,
+  four_more : FourBits,
+  high_two : TwoBits,
+}
+
 packet ParentWithSixBytes {
   two_bytes : 16,
   six_bytes : SixBytes,
@@ -87,3 +105,292 @@
   field_10 : 16,
   field_11 : 16,
 }
+
+enum ForArrays : 16 {
+  ONE = 0x0001,
+  TWO = 0x0002,
+  ONE_TWO = 0x0201,
+  TWO_THREE = 0x0302,
+  FFFF = 0xffff,
+}
+
+packet FixedArrayEnum {
+  enum_array : ForArrays[5],
+}
+
+packet SizedArrayEnum {
+  _size_(enum_array) : 16,
+  enum_array : ForArrays[],
+}
+
+packet CountArrayEnum {
+  _count_(enum_array) : 8,
+  enum_array : ForArrays[],
+}
+
+packet SizedArrayCustom {
+  _size_(six_bytes_array) : 8,
+  an_extra_byte : 8,
+  six_bytes_array : SixBytes[+1*8],
+}
+
+packet FixedArrayCustom {
+  six_bytes_array : SixBytes[5],
+}
+
+packet CountArrayCustom {
+  _count_(six_bytes_array) : 8,
+  six_bytes_array : SixBytes[],
+}
+
+packet PacketWithFixedArraysOfBytes {
+  fixed_256bit_in_bytes : 8[32],
+  fixed_256bit_in_words : 32[8],
+}
+
+packet OneVariable {
+  one : Variable,
+}
+
+packet SizedArrayVariable {
+  _size_(variable_array) : 8,
+  variable_array : Variable[],
+}
+
+packet FixedArrayVariable {
+  variable_array : Variable[5],
+}
+
+packet CountArrayVariable {
+  _count_(variable_array) : 8,
+  variable_array : Variable[],
+}
+
+struct TwoRelatedNumbers {
+  id : 8,
+  count : 16,
+}
+
+packet OneStruct {
+  one : TwoRelatedNumbers,
+}
+
+packet TwoStructs {
+  one : TwoRelatedNumbers,
+  two : TwoRelatedNumbers,
+}
+
+packet VectorOfStruct {
+  _count_(array) : 8,
+  array : TwoRelatedNumbers[],
+}
+
+packet ArrayOfStruct {
+  the_count : 8,
+  array : TwoRelatedNumbers[4],
+}
+
+struct StructWithFixedTypes {
+  four_bits : FourBits,
+  _reserved_ : 4,
+  _checksum_start_(example_checksum),
+  _fixed_ = 0xf3 : 8,
+  id : 8,
+  array : 8[3],
+  example_checksum : SimpleSum,
+  six_bytes : SixBytes,
+}
+
+packet OneFixedTypesStruct {
+  one : StructWithFixedTypes,
+}
+
+packet ArrayOfStructAndAnother {
+  _count_(array) : 8,
+  array : TwoRelatedNumbers[],
+  another : TwoRelatedNumbers,
+}
+
+packet SizedArrayOfStructAndAnother {
+  _size_(array) : 8,
+  array : TwoRelatedNumbers[],
+  another : TwoRelatedNumbers,
+}
+
+struct ArrayOfStructAndAnotherStruct {
+  _count_(array) : 8,
+  array : TwoRelatedNumbers[],
+  another : TwoRelatedNumbers,
+}
+
+struct SizedArrayOfStructAndAnotherStruct {
+  _size_(array) : 8,
+  array : TwoRelatedNumbers[],
+  another : TwoRelatedNumbers,
+}
+
+packet OneArrayOfStructAndAnotherStruct {
+  one : ArrayOfStructAndAnotherStruct,
+}
+
+packet OneSizedArrayOfStructAndAnotherStruct {
+  one : SizedArrayOfStructAndAnotherStruct,
+}
+
+group BitFieldGroup {
+  seven_bits : 7,
+  straddle : 4,
+  five_bits : 5,
+}
+
+packet BitFieldGroupPacket {
+  BitFieldGroup,
+}
+
+packet BitFieldGroupAfterPayloadPacket {
+  _payload_,
+  BitFieldGroup,
+}
+
+packet BitFieldGroupAfterUnsizedArrayPacket : BitFieldGroupAfterPayloadPacket {
+  array : 8[],
+}
+
+struct BitField {
+  seven_bits : 7,
+  straddle : 4,
+  five_bits : 5,
+}
+
+packet BitFieldPacket {
+  bit_field : BitField,
+}
+
+packet BitFieldAfterPayloadPacket {
+  _payload_,
+  bit_field : BitField,
+}
+
+packet BitFieldAfterUnsizedArrayPacket : BitFieldAfterPayloadPacket {
+  array : 8[],
+}
+
+packet BitFieldArrayPacket {
+  _size_(array): 8,
+  array : BitField[],
+}
+
+struct VersionlessStruct {
+  one_number : 8,
+}
+
+packet OneVersionlessStructPacket {
+  versionless : VersionlessStruct,
+  _payload_,
+}
+
+packet OneVersionedStructPacket : OneVersionlessStructPacket {
+  version : 8,
+  _payload_,
+}
+
+packet OneVersionOneStructPacket : OneVersionedStructPacket(version = 0x01) {
+  just_one_number : 8,
+}
+
+packet OneVersionTwoStructPacket : OneVersionedStructPacket(version = 0x02) {
+  one_number : 8,
+  another_number : 8,
+}
+
+enum StructType : 8 {
+  ZERO_BYTE = 0x00,
+  TWO_BYTE = 0x02,
+  FOUR_BYTE = 0x04,
+  AT_LEAST_FOUR_BYTE = 0x05,
+  VARIABLE = 0x06,
+}
+
+struct UnusedParentStruct {
+  struct_type : StructType,
+  _body_,
+}
+
+struct TwoByteStruct : UnusedParentStruct (struct_type = TWO_BYTE) {
+  two_bytes : 16,
+}
+
+struct FourByteStruct : UnusedParentStruct (struct_type = FOUR_BYTE) {
+  four_bytes : 32,
+}
+
+struct AtLeastFourByteStruct : UnusedParentStruct (struct_type = AT_LEAST_FOUR_BYTE) {
+  four_bytes : 32,
+  struct_type : StructType,
+  _body_,
+}
+
+struct OnlyFourByteStruct : AtLeastFourByteStruct (struct_type = ZERO_BYTE) {
+}
+
+struct SixByteStruct : AtLeastFourByteStruct (struct_type = TWO_BYTE) {
+  two_bytes : 16,
+}
+
+struct EightByteStruct : AtLeastFourByteStruct (struct_type = FOUR_BYTE) {
+  four_bytes : 32,
+}
+
+packet OneFourByteStruct {
+  one_struct : FourByteStruct,
+}
+
+packet OneGenericStruct {
+  base_struct : UnusedParentStruct,
+}
+
+packet OneGenericStructArray {
+  an_array : UnusedParentStruct[],
+}
+
+packet OneGenericStructFourArray {
+  an_array : UnusedParentStruct[4],
+}
+
+packet ParentWithOnlyFixed {
+  two_bytes : 16,
+  _body_,
+}
+
+packet OneGenericStructArrayAfterFixed : ParentWithOnlyFixed {
+  an_array : UnusedParentStruct[],
+}
+
+enum DataType : 8 {
+  ONE = 0x01,
+  TWO = 0x02,
+  THREE = 0x03,
+  FOUR = 0x04,
+  FIVE = 0x05,
+  UNUSED = 0x06,
+}
+
+struct LengthTypeValueStruct {
+  _size_(value) : 16,
+  type : DataType,
+  value : 8[+1*8],
+}
+
+packet OneLengthTypeValueStruct {
+  one_array : LengthTypeValueStruct[],
+}
+
+packet SizedParent {
+  _size_(payload) : 8,
+  _payload_,
+}
+
+packet OneLengthTypeValueStructPadded : SizedParent {
+  one_array : LengthTypeValueStruct[],
+  _padding_[40],
+}
diff --git a/gd/packet/parser/test/variable.cc b/gd/packet/parser/test/variable.cc
new file mode 100644
index 0000000..23443bf
--- /dev/null
+++ b/gd/packet/parser/test/variable.cc
@@ -0,0 +1,48 @@
+/******************************************************************************
+ *
+ *  Copyright 2019 The Android Open Source Project
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at:
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ ******************************************************************************/
+
+#include "variable.h"
+
+#include <stdio.h>
+#include <sstream>
+
+namespace bluetooth {
+namespace packet {
+namespace parser {
+namespace test {
+
+Variable::Variable(const std::string& str) : data(str) {}
+
+void Variable::Serialize(BitInserter& bi) const {
+  if (data.size() > 255) {
+    fprintf(stderr, "data.size() > 255: (%zu)", data.size());
+    abort();
+  }
+  bi.insert_byte((uint8_t)data.size());
+  for (auto byte : data) {
+    bi.insert_byte(byte);
+  }
+}
+
+size_t Variable::size() const {
+  return data.size() + 1;
+}
+}  // namespace test
+}  // namespace parser
+}  // namespace packet
+}  // namespace bluetooth
diff --git a/gd/packet/parser/test/variable.h b/gd/packet/parser/test/variable.h
new file mode 100644
index 0000000..c452a37
--- /dev/null
+++ b/gd/packet/parser/test/variable.h
@@ -0,0 +1,70 @@
+/******************************************************************************
+ *
+ *  Copyright 2019 The Android Open Source Project
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at:
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ ******************************************************************************/
+
+#pragma once
+
+#include <stdint.h>
+#include <optional>
+#include <sstream>
+#include <string>
+
+#include "packet/bit_inserter.h"
+#include "packet/iterator.h"
+
+namespace bluetooth {
+namespace packet {
+namespace parser {
+namespace test {
+
+class Variable final {
+ public:
+  std::string data;
+
+  Variable() = default;
+  Variable(const Variable&) = default;
+  Variable(const std::string& str);
+
+  void Serialize(BitInserter& bi) const;
+
+  size_t size() const;
+
+  template <bool little_endian>
+  static std::optional<Iterator<little_endian>> Parse(Variable* instance, Iterator<little_endian> it) {
+    if (it.NumBytesRemaining() < 1) {
+      return {};
+    }
+    size_t data_length = it.template extract<uint8_t>();
+    if (data_length > 255) {
+      return {};
+    }
+    if (it.NumBytesRemaining() < data_length) {
+      return {};
+    }
+    std::stringstream ss;
+    for (size_t i = 0; i < data_length; i++) {
+      ss << it.template extract<char>();
+    }
+    *instance = ss.str();
+    return it;
+  }
+};
+
+}  // namespace test
+}  // namespace parser
+}  // namespace packet
+}  // namespace bluetooth
diff --git a/gd/packet/parser/type_def.h b/gd/packet/parser/type_def.h
index ceaf069..811dca8 100644
--- a/gd/packet/parser/type_def.h
+++ b/gd/packet/parser/type_def.h
@@ -19,7 +19,6 @@
 #include <iostream>
 
 #include "fields/packet_field.h"
-#include "fields/reserved_field.h"
 
 class TypeDef {
  public:
@@ -38,16 +37,14 @@
     ENUM,
     CHECKSUM,
     CUSTOM,
+    PACKET,
+    STRUCT,
   };
 
   virtual Type GetDefinitionType() const = 0;
 
   virtual PacketField* GetNewField(const std::string& name, ParseLocation loc) const = 0;
 
-  virtual void GenInclude(std::ostream& s) const = 0;
-
-  virtual void GenUsing(std::ostream& s) const = 0;
-
   const std::string name_;
   const int size_{-1};
 };
diff --git a/gd/packet/parser/util.h b/gd/packet/parser/util.h
index b274e16..982d39a 100644
--- a/gd/packet/parser/util.h
+++ b/gd/packet/parser/util.h
@@ -56,13 +56,8 @@
     ERROR() << __func__ << ": Cannot use a type larger than 64 bits. (" << bits << ")\n";
   }
 
-  uint64_t max = 0;
-  for (int i = 0; i < bits; i++) {
-    max <<= 1;
-    max |= 1;
-  }
-
-  return max;
+  // Set all the bits to 1, then shift off extras.
+  return ~(static_cast<uint64_t>(0)) >> (64 - bits);
 }
 
 inline std::string CamelCaseToUnderScore(std::string value) {
@@ -108,4 +103,15 @@
   return camel_case.str();
 }
 
+inline bool IsEnumCase(std::string value) {
+  if (value[0] < 'A' || value[0] > 'Z') {
+    return false;
+  }
+
+  // Use static to avoid compiling the regex more than once.
+  static const std::regex enum_regex("[A-Z][A-Z0-9_]*");
+
+  return std::regex_match(value, enum_regex);
+}
+
 }  // namespace util
diff --git a/gd/packet/raw_builder.cc b/gd/packet/raw_builder.cc
index fd61417..ec5159b 100644
--- a/gd/packet/raw_builder.cc
+++ b/gd/packet/raw_builder.cc
@@ -20,13 +20,14 @@
 
 #include "os/log.h"
 
+using bluetooth::hci::Address;
 using std::vector;
-using bluetooth::common::Address;
 
 namespace bluetooth {
 namespace packet {
 
 RawBuilder::RawBuilder(size_t max_bytes) : max_bytes_(max_bytes) {}
+RawBuilder::RawBuilder(std::vector<uint8_t> vec) : max_bytes_(vec.size()), payload_(vec) {}
 
 bool RawBuilder::AddOctets(size_t octets, const vector<uint8_t>& bytes) {
   if (payload_.size() + octets > max_bytes_) return false;
diff --git a/gd/packet/raw_builder.h b/gd/packet/raw_builder.h
index 8f9edf5..9b0e959 100644
--- a/gd/packet/raw_builder.h
+++ b/gd/packet/raw_builder.h
@@ -19,7 +19,7 @@
 #include <cstdint>
 #include <vector>
 
-#include "common/address.h"
+#include "hci/address.h"
 #include "packet/bit_inserter.h"
 #include "packet/packet_builder.h"
 
@@ -30,6 +30,7 @@
  public:
   RawBuilder() = default;
   RawBuilder(size_t max_bytes);
+  RawBuilder(std::vector<uint8_t> vec);
   virtual ~RawBuilder() = default;
 
   virtual size_t size() const override;
@@ -38,7 +39,7 @@
 
   // Add |address| to the payload.  Return true if:
   // - the new size of the payload is still <= |max_bytes_|
-  bool AddAddress(const common::Address& address);
+  bool AddAddress(const hci::Address& address);
 
   // Return true if |num_bytes| can be added to the payload.
   bool CanAddOctets(size_t num_bytes) const;
diff --git a/gd/packet/raw_builder_unittest.cc b/gd/packet/raw_builder_unittest.cc
index 27cecd6..5210fb6 100644
--- a/gd/packet/raw_builder_unittest.cc
+++ b/gd/packet/raw_builder_unittest.cc
@@ -20,9 +20,9 @@
 #include <forward_list>
 #include <memory>
 
-#include "common/address.h"
+#include "hci/address.h"
 
-using bluetooth::common::Address;
+using bluetooth::hci::Address;
 using bluetooth::packet::BitInserter;
 using std::vector;
 
diff --git a/gd/security/Android.bp b/gd/security/Android.bp
new file mode 100644
index 0000000..7762461
--- /dev/null
+++ b/gd/security/Android.bp
@@ -0,0 +1,26 @@
+filegroup {
+    name: "BluetoothSecuritySources",
+    srcs: [
+        "ecc/multprecision.cc",
+        "ecc/p_256_ecc_pp.cc",
+        "ecdh_keys.cc",
+        "pairing_handler_le.cc",
+        "pairing_handler_le_legacy.cc",
+        "pairing_handler_le_secure_connections.cc",
+        "security_manager.cc",
+        "internal/security_manager_impl.cc",
+        "security_module.cc",
+        ":BluetoothSecurityChannelSources",
+    ],
+}
+
+filegroup {
+    name: "BluetoothSecurityTestSources",
+    srcs: [
+        "ecc/multipoint_test.cc",
+        "pairing_handler_le_unittest.cc",
+        "test/fake_l2cap_test.cc",
+        "test/pairing_handler_le_pair_test.cc",
+        ":BluetoothSecurityChannelTestSources",
+    ],
+}
diff --git a/gd/security/channel/Android.bp b/gd/security/channel/Android.bp
new file mode 100644
index 0000000..653902b
--- /dev/null
+++ b/gd/security/channel/Android.bp
@@ -0,0 +1,13 @@
+filegroup {
+    name: "BluetoothSecurityChannelSources",
+    srcs: [
+        "security_manager_channel.cc",
+    ]
+}
+
+filegroup {
+    name: "BluetoothSecurityChannelTestSources",
+    srcs: [
+        "security_manager_channel_unittest.cc",
+    ]
+}
diff --git a/gd/security/channel/security_manager_channel.cc b/gd/security/channel/security_manager_channel.cc
new file mode 100644
index 0000000..419386d
--- /dev/null
+++ b/gd/security/channel/security_manager_channel.cc
@@ -0,0 +1,93 @@
+/******************************************************************************
+ *
+ *  Copyright 2019 The Android Open Source Project
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at:
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ ******************************************************************************/
+#include "security_manager_channel.h"
+
+#include "security/smp_packets.h"
+
+using namespace bluetooth::hci;
+using namespace bluetooth::packet;
+using namespace bluetooth::security::channel;
+
+void SecurityManagerChannel::SendCommand(std::shared_ptr<hci::Device> device,
+                                         std::unique_ptr<SecurityCommandBuilder> command) {
+  hci_security_interface_->EnqueueCommand(
+      std::move(command), common::BindOnce(&SecurityManagerChannel::OnCommandComplete, common::Unretained(this)),
+      handler_);
+}
+
+void SecurityManagerChannel::OnCommandComplete(CommandCompleteView packet) {
+  ASSERT_LOG(packet.IsValid(), "Received invalid packet: %hx", packet.GetCommandOpCode());
+  // TODO(optedoblivion): Verify HCI commands
+}
+
+void SecurityManagerChannel::OnHciEventReceived(EventPacketView packet) {
+  ASSERT_LOG(listener_ != nullptr, "No listener set!");
+  std::shared_ptr<Device> device = nullptr;
+  auto event = EventPacketView::Create(std::move(packet));
+  ASSERT_LOG(event.IsValid(), "Received invalid packet: %hhx", event.GetEventCode());
+  const hci::EventCode code = event.GetEventCode();
+  switch (code) {
+    case hci::EventCode::CHANGE_CONNECTION_LINK_KEY_COMPLETE:
+      listener_->OnChangeConnectionLinkKeyComplete(device,
+                                                   hci::ChangeConnectionLinkKeyCompleteView::Create(std::move(event)));
+      break;
+    case hci::EventCode::MASTER_LINK_KEY_COMPLETE:
+      listener_->OnMasterLinkKeyComplete(device, hci::MasterLinkKeyCompleteView::Create(std::move(event)));
+      break;
+    case hci::EventCode::PIN_CODE_REQUEST:
+      listener_->OnPinCodeRequest(device, hci::PinCodeRequestView::Create(std::move(event)));
+      break;
+    case hci::EventCode::LINK_KEY_REQUEST:
+      listener_->OnLinkKeyRequest(device, hci::LinkKeyRequestView::Create(std::move(event)));
+      break;
+    case hci::EventCode::LINK_KEY_NOTIFICATION:
+      listener_->OnLinkKeyNotification(device, hci::LinkKeyNotificationView::Create(std::move(event)));
+      break;
+    case hci::EventCode::IO_CAPABILITY_REQUEST:
+      listener_->OnIoCapabilityRequest(device, hci::IoCapabilityRequestView::Create(std::move(event)));
+      break;
+    case hci::EventCode::IO_CAPABILITY_RESPONSE:
+      listener_->OnIoCapabilityResponse(device, IoCapabilityResponseView::Create(std::move(event)));
+      break;
+    case hci::EventCode::SIMPLE_PAIRING_COMPLETE:
+      listener_->OnSimplePairingComplete(device, SimplePairingCompleteView::Create(std::move(event)));
+      break;
+    case hci::EventCode::RETURN_LINK_KEYS:
+      listener_->OnReturnLinkKeys(device, hci::ReturnLinkKeysView::Create(std::move(event)));
+      break;
+    case hci::EventCode::ENCRYPTION_CHANGE:
+      listener_->OnEncryptionChange(device, hci::EncryptionChangeView::Create(std::move(event)));
+      break;
+    case hci::EventCode::ENCRYPTION_KEY_REFRESH_COMPLETE:
+      listener_->OnEncryptionKeyRefreshComplete(device,
+                                                hci::EncryptionKeyRefreshCompleteView::Create(std::move(event)));
+      break;
+    case hci::EventCode::REMOTE_OOB_DATA_REQUEST:
+      listener_->OnRemoteOobDataRequest(device, hci::RemoteOobDataRequestView::Create(std::move(event)));
+      break;
+    case hci::EventCode::USER_PASSKEY_NOTIFICATION:
+      //      listener_->OnUserPasskeyNotification(device, <packet>);
+      break;
+    case hci::EventCode::KEYPRESS_NOTIFICATION:
+      //      listener_->OnSendKeypressNotification(device, <packet>);
+      break;
+    default:
+      ASSERT_LOG(false, "Invalid packet received: %hhx", code);
+      break;
+  }
+}
diff --git a/gd/security/channel/security_manager_channel.h b/gd/security/channel/security_manager_channel.h
new file mode 100644
index 0000000..6a2b624
--- /dev/null
+++ b/gd/security/channel/security_manager_channel.h
@@ -0,0 +1,113 @@
+/******************************************************************************
+ *
+ *  Copyright 2019 The Android Open Source Project
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at:
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0;
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ ******************************************************************************/
+#pragma once
+
+#include <memory>
+#include <vector>
+
+#include "hci/classic_device.h"
+#include "hci/hci_layer.h"
+#include "hci/security_interface.h"
+#include "security/smp_packets.h"
+
+namespace bluetooth {
+namespace security {
+namespace channel {
+
+using hci::CommandCompleteView;
+using hci::EventPacketView;
+using hci::SecurityCommandBuilder;
+using hci::SecurityCommandView;
+
+/**
+ * Interface for listening to the channel for SMP commands.
+ */
+class ISecurityManagerChannelListener {
+ public:
+  virtual ~ISecurityManagerChannelListener() = default;
+
+  virtual void OnChangeConnectionLinkKeyComplete(std::shared_ptr<hci::Device> device,
+                                                 hci::ChangeConnectionLinkKeyCompleteView packet) = 0;
+  virtual void OnMasterLinkKeyComplete(std::shared_ptr<hci::Device> device, hci::MasterLinkKeyCompleteView packet) = 0;
+  virtual void OnPinCodeRequest(std::shared_ptr<hci::Device> device, hci::PinCodeRequestView packet) = 0;
+  virtual void OnLinkKeyRequest(std::shared_ptr<hci::Device> device, hci::LinkKeyRequestView packet) = 0;
+  virtual void OnLinkKeyNotification(std::shared_ptr<hci::Device> device, hci::LinkKeyNotificationView packet) = 0;
+  virtual void OnIoCapabilityRequest(std::shared_ptr<hci::Device> device, hci::IoCapabilityRequestView packet) = 0;
+  virtual void OnIoCapabilityResponse(std::shared_ptr<hci::Device> device, hci::IoCapabilityResponseView packet) = 0;
+  virtual void OnSimplePairingComplete(std::shared_ptr<hci::Device> device, hci::SimplePairingCompleteView packet) = 0;
+  virtual void OnReturnLinkKeys(std::shared_ptr<hci::Device> device, hci::ReturnLinkKeysView packet) = 0;
+  virtual void OnEncryptionChange(std::shared_ptr<hci::Device> device, hci::EncryptionChangeView packet) = 0;
+  virtual void OnEncryptionKeyRefreshComplete(std::shared_ptr<hci::Device> device,
+                                              hci::EncryptionKeyRefreshCompleteView packet) = 0;
+  virtual void OnRemoteOobDataRequest(std::shared_ptr<hci::Device> device, hci::RemoteOobDataRequestView packet) = 0;
+};
+
+/**
+ * Channel for consolidating traffic and making the transport agnostic.
+ */
+class SecurityManagerChannel {
+ public:
+  explicit SecurityManagerChannel(os::Handler* handler, hci::HciLayer* hci_layer)
+      : listener_(nullptr),
+        hci_security_interface_(hci_layer->GetSecurityInterface(
+            common::Bind(&SecurityManagerChannel::OnHciEventReceived, common::Unretained(this)), handler)),
+        handler_(handler) {}
+  ~SecurityManagerChannel() {
+    delete listener_;
+  }
+
+  /**
+   * Send a given SMP command over the SecurityManagerChannel
+   *
+   * @param device target where command will be sent
+   * @param command smp command to send
+   */
+  void SendCommand(std::shared_ptr<hci::Device> device, std::unique_ptr<SecurityCommandBuilder> command);
+
+  /**
+   * Sets the listener to listen for channel events
+   *
+   * @param listener the caller interested in events
+   */
+  void SetChannelListener(ISecurityManagerChannelListener* listener) {
+    listener_ = listener;
+  }
+
+  /**
+   * Called when an incoming HCI event happens
+   *
+   * @param event_packet
+   */
+  void OnHciEventReceived(EventPacketView packet);
+
+  /**
+   * Called when an HCI command is completed
+   *
+   * @param on_complete
+   */
+  void OnCommandComplete(CommandCompleteView packet);
+
+ private:
+  ISecurityManagerChannelListener* listener_;
+  hci::SecurityInterface* hci_security_interface_;
+  os::Handler* handler_;
+};
+
+}  // namespace channel
+}  // namespace security
+}  // namespace bluetooth
diff --git a/gd/security/channel/security_manager_channel_unittest.cc b/gd/security/channel/security_manager_channel_unittest.cc
new file mode 100644
index 0000000..f346255
--- /dev/null
+++ b/gd/security/channel/security_manager_channel_unittest.cc
@@ -0,0 +1,276 @@
+/******************************************************************************
+ *
+ *  Copyright 2019 The Android Open Source Project
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at:
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ ******************************************************************************/
+#include "security_manager_channel.h"
+
+#include <gtest/gtest.h>
+
+#include "hci/device.h"
+#include "hci/device_database.h"
+#include "hci/hci_packets.h"
+#include "packet/raw_builder.h"
+#include "security/smp_packets.h"
+#include "security/test/fake_hci_layer.h"
+
+namespace bluetooth {
+namespace security {
+namespace channel {
+namespace {
+
+using bluetooth::security::channel::SecurityManagerChannel;
+using hci::AuthenticationRequirements;
+using hci::CommandCompleteBuilder;
+using hci::Device;
+using hci::DeviceDatabase;
+using hci::IoCapabilityRequestReplyBuilder;
+using hci::IoCapabilityRequestView;
+using hci::OobDataPresent;
+using hci::OpCode;
+using os::Handler;
+using os::Thread;
+using packet::RawBuilder;
+
+static DeviceDatabase kDeviceDatabase;
+
+class TestPayloadBuilder : public PacketBuilder<kLittleEndian> {
+ public:
+  ~TestPayloadBuilder() override = default;
+  size_t size() const override {
+    return 1;
+  }
+  void Serialize(BitInserter& inserter) const override {}
+  static std::unique_ptr<TestPayloadBuilder> Create() {
+    return std::unique_ptr<TestPayloadBuilder>(new TestPayloadBuilder());
+  }
+
+ private:
+  TestPayloadBuilder() : PacketBuilder<kLittleEndian>(){};
+};
+
+class SecurityManagerChannelCallback : public ISecurityManagerChannelListener {
+ public:
+  // HCI
+  bool receivedChangeConnectionLinkKeyComplete = false;
+  bool receivedMasterLinkKeyComplete = false;
+  bool receivedPinCodeRequest = false;
+  bool receivedLinkKeyRequest = false;
+  bool receivedLinkKeyNotification = false;
+  bool receivedIoCapabilityRequest = false;
+  bool receivedIoCapabilityResponse = false;
+  bool receivedSimplePairingComplete = false;
+  bool receivedReturnLinkKeys = false;
+  bool receivedEncryptionChange = false;
+  bool receivedEncryptionKeyRefreshComplete = false;
+  bool receivedRemoteOobDataRequest = false;
+
+  void OnChangeConnectionLinkKeyComplete(std::shared_ptr<hci::Device> device,
+                                         hci::ChangeConnectionLinkKeyCompleteView packet) {
+    EXPECT_TRUE(packet.IsValid());
+    receivedChangeConnectionLinkKeyComplete = true;
+  }
+  void OnMasterLinkKeyComplete(std::shared_ptr<hci::Device> device, hci::MasterLinkKeyCompleteView packet) {
+    EXPECT_TRUE(packet.IsValid());
+    receivedMasterLinkKeyComplete = true;
+  }
+  void OnPinCodeRequest(std::shared_ptr<hci::Device> device, hci::PinCodeRequestView packet) {
+    EXPECT_TRUE(packet.IsValid());
+    receivedPinCodeRequest = true;
+  }
+  void OnLinkKeyRequest(std::shared_ptr<hci::Device> device, hci::LinkKeyRequestView packet) {
+    EXPECT_TRUE(packet.IsValid());
+    receivedLinkKeyRequest = true;
+  }
+  void OnLinkKeyNotification(std::shared_ptr<hci::Device> device, hci::LinkKeyNotificationView packet) {
+    EXPECT_TRUE(packet.IsValid());
+    receivedLinkKeyNotification = true;
+  }
+  void OnIoCapabilityRequest(std::shared_ptr<Device> device, hci::IoCapabilityRequestView packet) {
+    EXPECT_TRUE(packet.IsValid());
+    receivedIoCapabilityRequest = true;
+  }
+  void OnIoCapabilityResponse(std::shared_ptr<Device> device, hci::IoCapabilityResponseView packet) {
+    EXPECT_TRUE(packet.IsValid());
+    receivedIoCapabilityResponse = true;
+  }
+  void OnSimplePairingComplete(std::shared_ptr<Device> device, hci::SimplePairingCompleteView packet) {
+    EXPECT_TRUE(packet.IsValid());
+    receivedSimplePairingComplete = true;
+  }
+  void OnReturnLinkKeys(std::shared_ptr<Device> device, hci::ReturnLinkKeysView packet) {
+    EXPECT_TRUE(packet.IsValid());
+    receivedReturnLinkKeys = true;
+  }
+  void OnEncryptionChange(std::shared_ptr<Device> device, hci::EncryptionChangeView packet) {
+    EXPECT_TRUE(packet.IsValid());
+    receivedEncryptionChange = true;
+  }
+  void OnEncryptionKeyRefreshComplete(std::shared_ptr<Device> device, hci::EncryptionKeyRefreshCompleteView packet) {
+    EXPECT_TRUE(packet.IsValid());
+    receivedEncryptionKeyRefreshComplete = true;
+  }
+  void OnRemoteOobDataRequest(std::shared_ptr<Device> device, hci::RemoteOobDataRequestView packet) {
+    EXPECT_TRUE(packet.IsValid());
+    receivedRemoteOobDataRequest = true;
+  }
+};
+
+class SecurityManagerChannelTest : public ::testing::Test {
+ protected:
+  void SetUp() override {
+    device_ = kDeviceDatabase.CreateClassicDevice(hci::Address({0x01, 0x02, 0x03, 0x04, 0x05, 0x06}));
+    handler_ = new Handler(&thread_);
+    callback_ = new SecurityManagerChannelCallback();
+    hci_layer_ = new FakeHciLayer();
+    fake_registry_.InjectTestModule(&FakeHciLayer::Factory, hci_layer_);
+    fake_registry_.Start<FakeHciLayer>(&thread_);
+    channel_ = new SecurityManagerChannel(handler_, hci_layer_);
+    channel_->SetChannelListener(callback_);
+  }
+
+  void TearDown() override {
+    channel_->SetChannelListener(nullptr);
+    handler_->Clear();
+    fake_registry_.SynchronizeModuleHandler(&FakeHciLayer::Factory, std::chrono::milliseconds(20));
+    fake_registry_.StopAll();
+    delete handler_;
+    delete channel_;
+    delete callback_;
+  }
+
+  TestModuleRegistry fake_registry_;
+  Thread& thread_ = fake_registry_.GetTestThread();
+  Handler* handler_ = nullptr;
+  FakeHciLayer* hci_layer_ = nullptr;
+  SecurityManagerChannel* channel_ = nullptr;
+  SecurityManagerChannelCallback* callback_ = nullptr;
+  std::shared_ptr<Device> device_ = nullptr;
+};
+
+TEST_F(SecurityManagerChannelTest, setup_teardown) {}
+
+TEST_F(SecurityManagerChannelTest, recv_io_cap_request) {
+  hci_layer_->IncomingEvent(hci::IoCapabilityRequestBuilder::Create(device_->GetAddress()));
+  EXPECT_TRUE(callback_->receivedIoCapabilityRequest);
+}
+
+TEST_F(SecurityManagerChannelTest, send_io_cap_request_reply) {
+  // Arrange
+  hci::IoCapability io_capability = (hci::IoCapability)0x00;
+  OobDataPresent oob_present = (OobDataPresent)0x00;
+  AuthenticationRequirements authentication_requirements = (AuthenticationRequirements)0x00;
+  auto packet = hci::IoCapabilityRequestReplyBuilder::Create(device_->GetAddress(), io_capability, oob_present,
+                                                             authentication_requirements);
+
+  // Act
+  channel_->SendCommand(device_, std::move(packet));
+  auto last_command = std::move(hci_layer_->GetLastCommand()->command);
+  auto command_packet = GetPacketView(std::move(last_command));
+  hci::CommandPacketView packet_view = hci::CommandPacketView::Create(command_packet);
+
+  // Assert
+  EXPECT_TRUE(packet_view.IsValid());
+  EXPECT_EQ(OpCode::IO_CAPABILITY_REQUEST_REPLY, packet_view.GetOpCode());
+}
+
+TEST_F(SecurityManagerChannelTest, send_io_cap_request_neg_reply) {
+  // Arrange
+  auto packet =
+      hci::IoCapabilityRequestNegativeReplyBuilder::Create(device_->GetAddress(), hci::ErrorCode::COMMAND_DISALLOWED);
+
+  // Act
+  channel_->SendCommand(device_, std::move(packet));
+  auto last_command = std::move(hci_layer_->GetLastCommand()->command);
+  auto command_packet = GetPacketView(std::move(last_command));
+  hci::CommandPacketView packet_view = hci::CommandPacketView::Create(command_packet);
+
+  // Assert
+  EXPECT_TRUE(packet_view.IsValid());
+  EXPECT_EQ(OpCode::IO_CAPABILITY_REQUEST_NEGATIVE_REPLY, packet_view.GetOpCode());
+}
+
+TEST_F(SecurityManagerChannelTest, recv_io_cap_response) {
+  hci::IoCapability io_capability = (hci::IoCapability)0x00;
+  OobDataPresent oob_present = (OobDataPresent)0x00;
+  AuthenticationRequirements authentication_requirements = (AuthenticationRequirements)0x00;
+  hci_layer_->IncomingEvent(hci::IoCapabilityResponseBuilder::Create(device_->GetAddress(), io_capability, oob_present,
+                                                                     authentication_requirements));
+  EXPECT_TRUE(callback_->receivedIoCapabilityResponse);
+}
+
+TEST_F(SecurityManagerChannelTest, recv_pin_code_request) {
+  hci_layer_->IncomingEvent(hci::PinCodeRequestBuilder::Create(device_->GetAddress()));
+  EXPECT_TRUE(callback_->receivedPinCodeRequest);
+}
+
+TEST_F(SecurityManagerChannelTest, send_pin_code_request_reply) {}
+
+TEST_F(SecurityManagerChannelTest, send_pin_code_request_neg_reply) {}
+
+TEST_F(SecurityManagerChannelTest, recv_user_passkey_notification) {}
+
+TEST_F(SecurityManagerChannelTest, send_user_confirmation_request_reply) {}
+
+TEST_F(SecurityManagerChannelTest, send_user_confirmation_request_neg_reply) {}
+
+TEST_F(SecurityManagerChannelTest, recv_remote_oob_data_request) {}
+
+TEST_F(SecurityManagerChannelTest, send_remote_oob_data_request_reply) {}
+
+TEST_F(SecurityManagerChannelTest, send_remote_oob_data_request_neg_reply) {}
+
+TEST_F(SecurityManagerChannelTest, send_read_local_oob_data) {}
+
+TEST_F(SecurityManagerChannelTest, send_read_local_oob_extended_data) {}
+
+TEST_F(SecurityManagerChannelTest, recv_link_key_request) {}
+
+TEST_F(SecurityManagerChannelTest, recv_link_key_notification) {}
+
+TEST_F(SecurityManagerChannelTest, recv_master_link_complete) {}
+
+TEST_F(SecurityManagerChannelTest, recv_change_connection_link_key_complete) {}
+
+TEST_F(SecurityManagerChannelTest, recv_return_link_keys) {}
+
+TEST_F(SecurityManagerChannelTest, send_link_key_reply) {}
+
+TEST_F(SecurityManagerChannelTest, send_link_key_neg_reply) {}
+
+TEST_F(SecurityManagerChannelTest, send_read_stored_link_key) {}
+
+TEST_F(SecurityManagerChannelTest, send_write_stored_link_key) {}
+
+TEST_F(SecurityManagerChannelTest, send_delete_stored_link_key) {}
+
+TEST_F(SecurityManagerChannelTest, recv_encryption_change) {}
+
+TEST_F(SecurityManagerChannelTest, send_refresh_encryption_key) {}
+
+TEST_F(SecurityManagerChannelTest, send_read_encryption_key_size) {}
+
+TEST_F(SecurityManagerChannelTest, recv_simple_pairing_complete) {}
+
+TEST_F(SecurityManagerChannelTest, send_read_simple_pairing_mode) {}
+
+TEST_F(SecurityManagerChannelTest, send_write_simple_pairing_mode) {}
+
+TEST_F(SecurityManagerChannelTest, send_keypress_notification) {}
+
+}  // namespace
+}  // namespace channel
+}  // namespace security
+}  // namespace bluetooth
diff --git a/gd/smp/ecc/multipoint_test.cc b/gd/security/ecc/multipoint_test.cc
similarity index 96%
rename from gd/smp/ecc/multipoint_test.cc
rename to gd/security/ecc/multipoint_test.cc
index ebed658..95e43d4 100644
--- a/gd/smp/ecc/multipoint_test.cc
+++ b/gd/security/ecc/multipoint_test.cc
@@ -18,10 +18,10 @@
 
 #include <gtest/gtest.h>
 
-#include "smp/ecc/p_256_ecc_pp.h"
+#include "security/ecc/p_256_ecc_pp.h"
 
 namespace bluetooth {
-namespace smp {
+namespace security {
 namespace ecc {
 
 // Test ECC point validation
@@ -108,5 +108,5 @@
 }
 
 }  // namespace ecc
-}  // namespace smp
+}  // namespace security
 }  // namespace bluetooth
diff --git a/gd/smp/ecc/multprecision.cc b/gd/security/ecc/multprecision.cc
similarity index 98%
rename from gd/smp/ecc/multprecision.cc
rename to gd/security/ecc/multprecision.cc
index 38b6f3f..c2583ed 100644
--- a/gd/smp/ecc/multprecision.cc
+++ b/gd/security/ecc/multprecision.cc
@@ -22,11 +22,11 @@
  *
  ******************************************************************************/
 
-#include "smp/ecc/multprecision.h"
+#include "security/ecc/multprecision.h"
 #include <string.h>
 
 namespace bluetooth {
-namespace smp {
+namespace security {
 namespace ecc {
 
 #define DWORD_BITS 32
@@ -500,5 +500,5 @@
 }
 
 }  // namespace ecc
-}  // namespace smp
+}  // namespace security
 }  // namespace bluetooth
\ No newline at end of file
diff --git a/gd/smp/ecc/multprecision.h b/gd/security/ecc/multprecision.h
similarity index 97%
rename from gd/smp/ecc/multprecision.h
rename to gd/security/ecc/multprecision.h
index 01bb9ad..ad149cd 100644
--- a/gd/smp/ecc/multprecision.h
+++ b/gd/security/ecc/multprecision.h
@@ -26,7 +26,7 @@
 #include <cstdint>
 
 namespace bluetooth {
-namespace smp {
+namespace security {
 namespace ecc {
 
 #define KEY_LENGTH_DWORDS_P256 8
@@ -52,5 +52,5 @@
 void multiprecision_fast_mod_P256(uint32_t* c, const uint32_t* a, const uint32_t* modp);
 
 }  // namespace ecc
-}  // namespace smp
+}  // namespace security
 }  // namespace bluetooth
\ No newline at end of file
diff --git a/gd/smp/ecc/p_256_ecc_pp.cc b/gd/security/ecc/p_256_ecc_pp.cc
similarity index 96%
rename from gd/smp/ecc/p_256_ecc_pp.cc
rename to gd/security/ecc/p_256_ecc_pp.cc
index 648e906..ecb805c 100644
--- a/gd/smp/ecc/p_256_ecc_pp.cc
+++ b/gd/security/ecc/p_256_ecc_pp.cc
@@ -22,14 +22,14 @@
  *  Cryptography for private public key
  *
  ******************************************************************************/
-#include "smp/ecc/p_256_ecc_pp.h"
+#include "security/ecc/p_256_ecc_pp.h"
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
-#include "smp/ecc/multprecision.h"
+#include "security/ecc/multprecision.h"
 
 namespace bluetooth {
-namespace smp {
+namespace security {
 namespace ecc {
 
 const uint32_t* modp = curve_p256.p;
@@ -196,7 +196,7 @@
 }
 
 // Binary Non-Adjacent Form for point multiplication
-void ECC_PointMult_Bin_NAF(Point* q, Point* p, uint32_t* n) {
+void ECC_PointMult_Bin_NAF(Point* q, const Point* p, uint32_t* n) {
   uint32_t sign;
   uint8_t naf[256 / 4 + 1];
   uint32_t NumNaf;
@@ -204,8 +204,6 @@
   Point r;
 
   p_256_init_point(&r);
-  multiprecision_init(p->z);
-  p->z[0] = 1;
 
   // initialization
   p_256_init_point(q);
@@ -262,5 +260,5 @@
 }
 
 }  // namespace ecc
-}  // namespace smp
+}  // namespace security
 }  // namespace bluetooth
\ No newline at end of file
diff --git a/gd/smp/ecc/p_256_ecc_pp.h b/gd/security/ecc/p_256_ecc_pp.h
similarity index 93%
rename from gd/smp/ecc/p_256_ecc_pp.h
rename to gd/security/ecc/p_256_ecc_pp.h
index ea1758f..93af7ee 100644
--- a/gd/smp/ecc/p_256_ecc_pp.h
+++ b/gd/security/ecc/p_256_ecc_pp.h
@@ -25,10 +25,10 @@
 
 #pragma once
 
-#include "smp/ecc/multprecision.h"
+#include "security/ecc/multprecision.h"
 
 namespace bluetooth {
-namespace smp {
+namespace security {
 namespace ecc {
 
 struct Point {
@@ -54,10 +54,10 @@
 
 // P-256 elliptic curve, as per BT Spec 5.1 Vol 2, Part H 7.6
 static constexpr elliptic_curve_t curve_p256{
-    .p = {0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0x0, 0x0, 0x0, 0x00000001, 0xFFFFFFFF},
-    .omega = {0},
     .a = {0},
     .b = {0x27d2604b, 0x3bce3c3e, 0xcc53b0f6, 0x651d06b0, 0x769886bc, 0xb3ebbd55, 0xaa3a93e7, 0x5ac635d8},
+    .p = {0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0x0, 0x0, 0x0, 0x00000001, 0xFFFFFFFF},
+    .omega = {0},
 
     .G = {.x = {0xd898c296, 0xf4a13945, 0x2deb33a0, 0x77037d81, 0x63a440f2, 0xf8bce6e5, 0xe12c4247, 0x6b17d1f2},
           .y = {0x37bf51f5, 0xcbb64068, 0x6b315ece, 0x2bce3357, 0x7c0f9e16, 0x8ee7eb4a, 0xfe1a7f9b, 0x4fe342e2}},
@@ -66,10 +66,10 @@
 /* This function checks that point is on the elliptic curve*/
 bool ECC_ValidatePoint(const Point& point);
 
-void ECC_PointMult_Bin_NAF(Point* q, Point* p, uint32_t* n);
+void ECC_PointMult_Bin_NAF(Point* q, const Point* p, uint32_t* n);
 
 #define ECC_PointMult(q, p, n) ECC_PointMult_Bin_NAF(q, p, n)
 
 }  // namespace ecc
-}  // namespace smp
-}  // namespace bluetooth
\ No newline at end of file
+}  // namespace security
+}  // namespace bluetooth
diff --git a/gd/security/ecdh_keys.cc b/gd/security/ecdh_keys.cc
new file mode 100644
index 0000000..fa3d794
--- /dev/null
+++ b/gd/security/ecdh_keys.cc
@@ -0,0 +1,82 @@
+/******************************************************************************
+ *
+ *  Copyright 2019 The Android Open Source Project
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at:
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ ******************************************************************************/
+
+#include "security/ecdh_keys.h"
+
+/**********************************************************************************************************************
+ TODO: We should have random number management in separate file, and we
+       should honour all the random number requirements from the spec!!
+**********************************************************************************************************************/
+#include <chrono>
+#include <cstdlib>
+
+#include "security/ecc/p_256_ecc_pp.h"
+
+namespace {
+template <size_t SIZE>
+static std::array<uint8_t, SIZE> GenerateRandom() {
+  // TODO:  We need a proper  random number generator here.
+  // use current time as seed for random generator
+  std::srand(std::time(nullptr));
+  std::array<uint8_t, SIZE> r;
+  for (size_t i = 0; i < SIZE; i++) r[i] = std::rand();
+  return r;
+}
+}  // namespace
+/*********************************************************************************************************************/
+
+namespace bluetooth {
+namespace security {
+
+std::pair<std::array<uint8_t, 32>, EcdhPublicKey> GenerateECDHKeyPair() {
+  std::array<uint8_t, 32> private_key = GenerateRandom<32>();
+  ecc::Point public_key;
+
+  ECC_PointMult(&public_key, &(ecc::curve_p256.G), (uint32_t*)private_key.data());
+
+  EcdhPublicKey pk;
+  memcpy(pk.x.data(), public_key.x, 32);
+  memcpy(pk.y.data(), public_key.y, 32);
+
+  /* private_key, public key pair */
+  return std::make_pair<std::array<uint8_t, 32>, EcdhPublicKey>(std::move(private_key), std::move(pk));
+}
+
+bool ValidateECDHPoint(EcdhPublicKey pk) {
+  ecc::Point public_key;
+  memcpy(public_key.x, pk.x.data(), 32);
+  memcpy(public_key.y, pk.y.data(), 32);
+  memset(public_key.z, 0, 32);
+  return ECC_ValidatePoint(public_key);
+}
+
+std::array<uint8_t, 32> ComputeDHKey(std::array<uint8_t, 32> my_private_key, EcdhPublicKey remote_public_key) {
+  ecc::Point peer_publ_key, new_publ_key;
+  uint32_t private_key[8];
+  memcpy(private_key, my_private_key.data(), 32);
+  memcpy(peer_publ_key.x, remote_public_key.x.data(), 32);
+  memcpy(peer_publ_key.y, remote_public_key.y.data(), 32);
+  ECC_PointMult(&new_publ_key, &peer_publ_key, (uint32_t*)private_key);
+
+  std::array<uint8_t, 32> dhkey;
+  memcpy(dhkey.data(), new_publ_key.x, 32);
+  return dhkey;
+}
+
+}  // namespace security
+}  // namespace bluetooth
diff --git a/gd/security/ecdh_keys.h b/gd/security/ecdh_keys.h
new file mode 100644
index 0000000..8ec25a8
--- /dev/null
+++ b/gd/security/ecdh_keys.h
@@ -0,0 +1,40 @@
+/******************************************************************************
+ *
+ *  Copyright 2019 The Android Open Source Project
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at:
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ ******************************************************************************/
+#pragma once
+
+#include <array>
+
+namespace bluetooth {
+namespace security {
+
+struct EcdhPublicKey {
+  std::array<uint8_t, 32> x;
+  std::array<uint8_t, 32> y;
+};
+
+/* this generates private and public Eliptic Curve Diffie Helman keys */
+std::pair<std::array<uint8_t, 32>, EcdhPublicKey> GenerateECDHKeyPair();
+
+/* This function validates that the given public key (point) lays on the special
+ * Bluetooth curve */
+bool ValidateECDHPoint(EcdhPublicKey pk);
+
+std::array<uint8_t, 32> ComputeDHKey(std::array<uint8_t, 32> my_private_key, EcdhPublicKey remote_public_key);
+
+}  // namespace security
+}  // namespace bluetooth
diff --git a/gd/security/initial_informations.h b/gd/security/initial_informations.h
new file mode 100644
index 0000000..db560bd
--- /dev/null
+++ b/gd/security/initial_informations.h
@@ -0,0 +1,112 @@
+/******************************************************************************
+ *
+ *  Copyright 2019 The Android Open Source Project
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at:
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ ******************************************************************************/
+
+#pragma once
+
+#include <optional>
+
+#include "common/bidi_queue.h"
+#include "common/callback.h"
+#include "crypto_toolbox/crypto_toolbox.h"
+#include "hci/address_with_type.h"
+#include "hci/le_security_interface.h"
+#include "os/handler.h"
+#include "packet/base_packet_builder.h"
+#include "packet/packet_view.h"
+#include "security/pairing_failure.h"
+#include "security/smp_packets.h"
+#include "security/ui.h"
+
+namespace bluetooth {
+namespace security {
+
+using DistributedKeys =
+    std::tuple<std::optional<crypto_toolbox::Octet16> /* ltk */, std::optional<uint16_t> /*ediv*/,
+               std::optional<std::array<uint8_t, 8>> /* rand */, std::optional<Address> /* Identity address */,
+               AddrType, std::optional<crypto_toolbox::Octet16> /* IRK */,
+               std::optional<crypto_toolbox::Octet16>> /* Signature Key */;
+
+/* This class represents the result of pairing, as returned from Pairing Handler */
+struct PairingResult {
+  hci::AddressWithType connection_address;
+  DistributedKeys distributed_keys;
+};
+
+using PairingResultOrFailure = std::variant<PairingResult, PairingFailure>;
+
+/* Data we use for Out Of Band Pairing */
+struct MyOobData {
+  /*  private key is just for this single pairing only, so it might be safe to
+   * expose it to other parts of stack. It should not be exposed to upper
+   * layers though */
+  std::array<uint8_t, 32> private_key;
+  EcdhPublicKey public_key;
+  crypto_toolbox::Octet16 c;
+  crypto_toolbox::Octet16 r;
+};
+
+/* This structure is filled and send to PairingHandlerLe to initiate the Pairing process with remote device */
+struct InitialInformations {
+  hci::Role my_role;
+  hci::AddressWithType my_connection_address;
+
+  /* My capabilities, as in pairing request/response */
+  struct {
+    IoCapability io_capability;
+    OobDataFlag oob_data_flag;
+    uint8_t auth_req;
+    uint8_t maximum_encryption_key_size;
+    uint8_t initiator_key_distribution;
+    uint8_t responder_key_distribution;
+  } myPairingCapabilities;
+
+  /* was it remote device that initiated the Pairing ? */
+  bool remotely_initiated;
+  uint16_t connection_handle;
+  hci::AddressWithType remote_connection_address;
+  std::string remote_name;
+
+  /* contains pairing request, if the pairing was remotely initiated */
+  std::optional<PairingRequestView> pairing_request;
+
+  struct out_of_band_data {
+    crypto_toolbox::Octet16 le_sc_c; /* LE Secure Connections Confirmation Value */
+    crypto_toolbox::Octet16 le_sc_r; /* LE Secure Connections Random Value */
+
+    crypto_toolbox::Octet16 security_manager_tk_value; /* OOB data for LE Legacy Pairing */
+  };
+
+  // If we received OOB data from remote device, this field contains it.
+  std::optional<out_of_band_data> remote_oob_data;
+  std::optional<MyOobData> my_oob_data;
+
+  /* Used by Pairing Handler to present user with requests*/
+  UI* ui_handler;
+
+  /* HCI interface to use */
+  hci::LeSecurityInterface* le_security_interface;
+
+  os::EnqueueBuffer<packet::BasePacketBuilder>* proper_l2cap_interface;
+  os::Handler* l2cap_handler;
+
+  /* Callback to execute once the Pairing process is finished */
+  std::function<void(PairingResultOrFailure)> OnPairingFinished;
+};
+
+}  // namespace security
+}  // namespace bluetooth
diff --git a/gd/security/internal/security_manager_impl.cc b/gd/security/internal/security_manager_impl.cc
new file mode 100644
index 0000000..21d8151
--- /dev/null
+++ b/gd/security/internal/security_manager_impl.cc
@@ -0,0 +1,152 @@
+/******************************************************************************
+ *
+ *  Copyright 2019 The Android Open Source Project
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at:
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ ******************************************************************************/
+#include "security_manager_impl.h"
+
+#include <iostream>
+#include <unordered_map>
+
+#include "os/log.h"
+#include "security/pairing/classic_pairing_handler.h"
+
+using namespace bluetooth::security::internal;
+using bluetooth::hci::Device;
+using bluetooth::hci::DeviceType;
+using bluetooth::security::pairing::PairingHandler;
+
+namespace {
+std::unordered_map<std::shared_ptr<Device>, std::unique_ptr<PairingHandler>> pairing_handler_map_;
+
+void dispatch_new_pairing_handler(std::shared_ptr<bluetooth::security::record::SecurityRecord> record) {
+  auto entry = pairing_handler_map_.find(record->GetDevice());
+  if (entry != pairing_handler_map_.end()) {
+    LOG_WARN("Device already has a pairing handler, and is in the middle of pairing!");
+    return;
+  }
+  std::unique_ptr<PairingHandler> pairing_handler = nullptr;
+  switch (record->GetDevice()->GetDeviceType()) {
+    case DeviceType::CLASSIC:
+      pairing_handler = std::make_unique<bluetooth::security::pairing::ClassicPairingHandler>(record);
+      break;
+    default:
+      ASSERT_LOG(false, "Pairing type %d not implemented!", record->GetDevice()->GetDeviceType());
+  }
+  auto new_entry = std::pair<std::shared_ptr<Device>, std::unique_ptr<PairingHandler>>(record->GetDevice(),
+                                                                                       std::move(pairing_handler));
+  pairing_handler_map_.insert(std::move(new_entry));
+}
+}  // namespace
+
+void SecurityManagerImpl::Init() {
+  // TODO(optedoblivion): Populate security record memory map from disk
+  //  security_manager_channel_->SetChannelListener(this);
+}
+
+void SecurityManagerImpl::CreateBond(std::shared_ptr<hci::ClassicDevice> device) {
+  std::string uuid = device->GetUuid();
+  // Security record check
+  //  if (device_database_->GetDeviceById(uuid) != nullptr) {
+  //    LOG_WARN("Device already exists in the database");
+  // TODO(optedoblivion): Check security record if device is already bonded
+  // if no security record, need to initiate bonding
+  // if security record and not bonded, need to initiate bonding
+  // if security record and is bonded, then do nothing
+  //  }
+
+  // device_database_->AddDevice(device);
+  // Create security record
+  // Pass to pairing handler
+  std::shared_ptr<record::SecurityRecord> record = std::make_shared<record::SecurityRecord>(device);
+  dispatch_new_pairing_handler(record);
+  // init the pairing handler
+  // Update bonded flag on security record
+  // Update bonded flag on device to BONDING (pairing handler does this)
+}
+
+void SecurityManagerImpl::CancelBond(std::shared_ptr<hci::ClassicDevice> device) {
+  auto entry = pairing_handler_map_.find(device);
+  if (entry != pairing_handler_map_.end()) {
+    pairing_handler_map_.erase(device);
+  }
+  // Remove from DB
+  // device_database_->RemoveDevice(device);
+  // Remove from map, no longer will the event queue use it
+  // If currently bonding, cancel pairing handler job
+  // else, cancel fails
+}
+
+void SecurityManagerImpl::RemoveBond(std::shared_ptr<hci::ClassicDevice> device) {
+  CancelBond(device);
+  // Update bonded flag on device to UNBONDED
+  // Signal disconnect
+  // Signal unbonding
+  // Remove security record
+  // Signal Remove from database
+}
+
+void SecurityManagerImpl::RegisterCallbackListener(ISecurityManagerListener* listener) {
+  if (listeners_.size() < 1) {
+    listeners_.push_back(listener);
+  } else {
+    bool found = false;
+    for (auto it = listeners_.begin(); it != listeners_.end(); ++it) {
+      found = *it == listener;
+      if (found) break;
+    }
+
+    if (found) {
+      LOG_ERROR("Listener has already been registered!");
+    } else {
+      listeners_.push_back(listener);
+    }
+  }
+}
+
+void SecurityManagerImpl::UnregisterCallbackListener(ISecurityManagerListener* listener) {
+  if (listeners_.size() < 1) {
+    LOG_ERROR("Listener has not been registered!");
+  } else {
+    bool found = false;
+    auto it = listeners_.begin();
+    while (it != listeners_.end()) {
+      found = *it == listener;
+      if (found) break;
+      ++it;
+    }
+    if (found) {
+      listeners_.erase(it);
+    }
+  }
+}
+
+void SecurityManagerImpl::FireDeviceBondedCallbacks(std::shared_ptr<Device> device) {
+  for (auto& iter : listeners_) {
+    iter->handler_->Post(common::Bind(&ISecurityManagerListener::OnDeviceBonded, common::Unretained(iter), device));
+  }
+}
+
+void SecurityManagerImpl::FireBondFailedCallbacks(std::shared_ptr<Device> device) {
+  for (auto& iter : listeners_) {
+    iter->handler_->Post(common::Bind(&ISecurityManagerListener::OnDeviceBondFailed, common::Unretained(iter), device));
+  }
+}
+
+void SecurityManagerImpl::FireUnbondCallbacks(std::shared_ptr<Device> device) {
+  for (auto& iter : listeners_) {
+    iter->handler_->Post(common::Bind(&ISecurityManagerListener::OnDeviceUnbonded, common::Unretained(iter), device));
+  }
+}
diff --git a/gd/security/internal/security_manager_impl.h b/gd/security/internal/security_manager_impl.h
new file mode 100644
index 0000000..13d66b9
--- /dev/null
+++ b/gd/security/internal/security_manager_impl.h
@@ -0,0 +1,155 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#pragma once
+
+#include "hci/classic_device.h"
+#include "l2cap/classic/l2cap_classic_module.h"
+#include "l2cap/le/l2cap_le_module.h"
+#include "os/handler.h"
+#include "security/channel/security_manager_channel.h"
+
+namespace bluetooth {
+namespace security {
+namespace internal {
+
+/**
+ * Interface for listening to the channel for SMP commands.
+ */
+class ISecurityManagerListener {
+ public:
+  ISecurityManagerListener(os::Handler* handler) : handler_(handler) {}
+  virtual ~ISecurityManagerListener() = default;
+
+  /**
+   * Called when a device is successfully bonded.
+   *
+   * @param device pointer to the bonded device
+   */
+  virtual void OnDeviceBonded(std::shared_ptr<bluetooth::hci::Device> device);
+
+  /**
+   * Called when a device is successfully un-bonded.
+   *
+   * @param device pointer to the device that is no longer bonded
+   */
+  virtual void OnDeviceUnbonded(std::shared_ptr<bluetooth::hci::Device> device);
+
+  /**
+   * Called as a result of a failure during the bonding process.
+   *
+   * @param device pointer to the device that is no longer bonded
+   */
+  virtual void OnDeviceBondFailed(std::shared_ptr<bluetooth::hci::Device> device);
+
+  bool operator==(const ISecurityManagerListener& rhs) const {
+    return &*this == &rhs;
+  }
+
+  os::Handler* handler_ = nullptr;
+};
+
+class SecurityManagerImpl /*: public channel::ISecurityManagerChannelListener*/ {
+ public:
+  explicit SecurityManagerImpl(os::Handler* security_handler, l2cap::le::L2capLeModule* l2cap_le_module,
+                               l2cap::classic::L2capClassicModule* l2cap_classic_module,
+                               channel::SecurityManagerChannel* security_manager_channel)
+      : security_handler_(security_handler), l2cap_le_module_(l2cap_le_module),
+        l2cap_classic_module_(l2cap_classic_module), security_manager_channel_(security_manager_channel) {}
+  virtual ~SecurityManagerImpl() = default;
+
+  // All APIs must be invoked in SM layer handler
+
+  /**
+   * Initialize the security record map from an internal device database.
+   */
+  void Init();
+
+  /**
+   * Checks the device for existing bond, if not bonded, initiates pairing.
+   *
+   * @param device pointer to device we want to bond with
+   * @return true if bonded or pairing started successfully, false if currently pairing
+   */
+  void CreateBond(std::shared_ptr<hci::ClassicDevice> device);
+
+  /* void CreateBond(std::shared_ptr<hci::LeDevice> device); */
+
+  /**
+   * Cancels the pairing process for this device.
+   *
+   * @param device pointer to device with which we want to cancel our bond
+   * @return <code>true</code> if successfully stopped
+   */
+  void CancelBond(std::shared_ptr<bluetooth::hci::ClassicDevice> device);
+
+  /* void CancelBond(std::shared_ptr<hci::LeDevice> device); */
+
+  /**
+   * Disassociates the device and removes the persistent LTK
+   *
+   * @param device pointer to device we want to forget
+   * @return true if removed
+   */
+  void RemoveBond(std::shared_ptr<bluetooth::hci::ClassicDevice> device);
+
+  /* void RemoveBond(std::shared_ptr<hci::LeDevice> device); */
+
+  /**
+   * Register to listen for callback events from SecurityManager
+   *
+   * @param listener ISecurityManagerListener instance to handle callbacks
+   */
+  void RegisterCallbackListener(ISecurityManagerListener* listener);
+
+  /**
+   * Unregister listener for callback events from SecurityManager
+   *
+   * @param listener ISecurityManagerListener instance to unregister
+   */
+  void UnregisterCallbackListener(ISecurityManagerListener* listener);
+
+ protected:
+  std::vector<ISecurityManagerListener*> listeners_;
+  void FireDeviceBondedCallbacks(std::shared_ptr<bluetooth::hci::Device> device);
+  void FireBondFailedCallbacks(std::shared_ptr<bluetooth::hci::Device> device);
+  void FireUnbondCallbacks(std::shared_ptr<bluetooth::hci::Device> device);
+
+  // ISecurityManagerChannel
+  void OnChangeConnectionLinkKeyComplete(std::shared_ptr<hci::Device> device,
+                                         hci::ChangeConnectionLinkKeyCompleteView packet);
+  void OnMasterLinkKeyComplete(std::shared_ptr<hci::Device> device, hci::MasterLinkKeyCompleteView packet);
+  void OnPinCodeRequest(std::shared_ptr<hci::Device> device, hci::PinCodeRequestView packet);
+  void OnLinkKeyRequest(std::shared_ptr<hci::Device> device, hci::LinkKeyRequestView packet);
+  void OnLinkKeyNotification(std::shared_ptr<hci::Device> device, hci::LinkKeyNotificationView packet);
+  void OnIoCapabilityRequest(std::shared_ptr<hci::Device> device, hci::IoCapabilityRequestView packet);
+  void OnIoCapabilityResponse(std::shared_ptr<hci::Device> device, hci::IoCapabilityResponseView packet);
+  void OnSimplePairingComplete(std::shared_ptr<hci::Device> device, hci::SimplePairingCompleteView packet);
+  void OnReturnLinkKeys(std::shared_ptr<hci::Device> device, hci::ReturnLinkKeysView packet);
+  void OnEncryptionChange(std::shared_ptr<hci::Device> device, hci::EncryptionChangeView packet);
+  void OnEncryptionKeyRefreshComplete(std::shared_ptr<hci::Device> device,
+                                      hci::EncryptionKeyRefreshCompleteView packet);
+  void OnRemoteOobDataRequest(std::shared_ptr<hci::Device> device, hci::RemoteOobDataRequestView packet);
+
+ private:
+  os::Handler* security_handler_ __attribute__((unused));
+  l2cap::le::L2capLeModule* l2cap_le_module_ __attribute__((unused));
+  l2cap::classic::L2capClassicModule* l2cap_classic_module_ __attribute__((unused));
+  channel::SecurityManagerChannel* security_manager_channel_ __attribute__((unused));
+};
+}  // namespace internal
+}  // namespace security
+}  // namespace bluetooth
diff --git a/gd/security/pairing/classic_pairing_handler.h b/gd/security/pairing/classic_pairing_handler.h
new file mode 100644
index 0000000..fc8eed4
--- /dev/null
+++ b/gd/security/pairing/classic_pairing_handler.h
@@ -0,0 +1,42 @@
+/******************************************************************************
+ *
+ *  Copyright 2019 The Android Open Source Project
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License") override;
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at:
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ ******************************************************************************/
+#pragma once
+
+#include "pairing_handler.h"
+
+#include "security/smp_packets.h"
+
+using namespace bluetooth::security::pairing;
+
+namespace bluetooth {
+namespace security {
+namespace pairing {
+
+class ClassicPairingHandler : public PairingHandler {
+ public:
+  explicit ClassicPairingHandler(std::shared_ptr<record::SecurityRecord> record) : PairingHandler(record) {}
+
+  void Init() {
+    // Set auth required
+    // Connect to device
+  }
+};
+
+}  // namespace pairing
+}  // namespace security
+}  // namespace bluetooth
diff --git a/gd/security/pairing/pairing_handler.h b/gd/security/pairing/pairing_handler.h
new file mode 100644
index 0000000..61cad62
--- /dev/null
+++ b/gd/security/pairing/pairing_handler.h
@@ -0,0 +1,52 @@
+/******************************************************************************
+ *
+ *  Copyright 2019 The Android Open Source Project
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at:
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ ******************************************************************************/
+#pragma once
+
+#include <memory>
+#include <vector>
+
+#include "hci/device.h"
+#include "security/channel/security_manager_channel.h"
+#include "security/record/security_record.h"
+#include "security/smp_packets.h"
+
+namespace bluetooth {
+namespace security {
+namespace pairing {
+
+/**
+ * Base structure for handling pairing events.
+ *
+ * <p>Extend this class in order to implement a new style of pairing.
+ */
+class PairingHandler {
+ public:
+  PairingHandler(std::shared_ptr<record::SecurityRecord> record) : record_(record){};
+  virtual ~PairingHandler() = default;
+
+  std::shared_ptr<record::SecurityRecord> GetRecord() {
+    return record_;
+  }
+
+ private:
+  std::shared_ptr<record::SecurityRecord> record_ __attribute__((unused));
+};
+
+}  // namespace pairing
+}  // namespace security
+}  // namespace bluetooth
diff --git a/gd/security/pairing_failure.h b/gd/security/pairing_failure.h
new file mode 100644
index 0000000..f7bbbae
--- /dev/null
+++ b/gd/security/pairing_failure.h
@@ -0,0 +1,57 @@
+/******************************************************************************
+ *
+ *  Copyright 2019 The Android Open Source Project
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at:
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ ******************************************************************************/
+
+#pragma once
+
+#include <string>
+
+#include "security/smp_packets.h"
+
+namespace bluetooth {
+namespace security {
+
+/* This structure holds the information about the failure in case of airing failure */
+struct PairingFailure {
+  /* A place in code that triggered this failure. It can be modified by functions that pass the error to a location that
+   * better reflect the current state of flow. i.e. instead of generic location responsible for waiting for packet,
+   * replace it with location of receiving specific packet in a specific flow */
+  // base::Location location;
+
+  /* This is the failure message, that will be passed, either into upper layers,
+   * or to the metrics in future */
+  std::string message;
+
+  /* If failure is due to mismatch of received code, this contains the received opcode */
+  Code received_code_;
+
+  /* if the failure is due to "SMP failure", this field contains the reson code
+   */
+  PairingFailedReason reason;
+
+  PairingFailure(/*const base::Location& location, */ const std::string& message)
+      : /*location(location), */ message(message) {}
+
+  PairingFailure(/*const base::Location& location, */ const std::string& message, Code received_code)
+      : /*location(location), */ message(message), received_code_(received_code) {}
+
+  PairingFailure(/*const base::Location& location, */ const std::string& message, PairingFailedReason reason)
+      : /*location(location),*/ message(message), reason(reason) {}
+};
+
+}  // namespace security
+}  // namespace bluetooth
\ No newline at end of file
diff --git a/gd/security/pairing_handler_le.cc b/gd/security/pairing_handler_le.cc
new file mode 100644
index 0000000..0484971
--- /dev/null
+++ b/gd/security/pairing_handler_le.cc
@@ -0,0 +1,391 @@
+/******************************************************************************
+ *
+ *  Copyright 2019 The Android Open Source Project
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at:
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ ******************************************************************************/
+
+#include "security/pairing_handler_le.h"
+
+namespace bluetooth {
+namespace security {
+
+void PairingHandlerLe::PairingMain(InitialInformations i) {
+  LOG_INFO("Pairing Started");
+
+  if (i.remotely_initiated) {
+    LOG_INFO("Was remotely initiated, presenting user with the accept prompt");
+    i.ui_handler->DisplayPairingPrompt(i.remote_connection_address, i.remote_name);
+
+    // If pairing was initiated by remote device, wait for the user to accept
+    // the request from the UI.
+    LOG_INFO("Waiting for the prompt response");
+    std::optional<PairingEvent> pairingAccepted = WaitUiPairingAccept();
+    if (!pairingAccepted || pairingAccepted->ui_value == 0) {
+      LOG_INFO("User either did not accept the remote pairing, or the prompt timed out");
+      SendL2capPacket(i, PairingFailedBuilder::Create(PairingFailedReason::UNSPECIFIED_REASON));
+      i.OnPairingFinished(PairingFailure("User either did not accept the remote pairing, or the prompt timed out"));
+      return;
+    }
+
+    LOG_INFO("Pairing prompt accepted");
+  }
+
+  /************************************************ PHASE 1 *********************************************************/
+  Phase1ResultOrFailure phase_1_result = ExchangePairingFeature(i);
+  if (std::holds_alternative<PairingFailure>(phase_1_result)) {
+    LOG_WARN("Pairing failed in phase 1");
+    // We already send pairing fialed in lower layer. Which one should do that ? how about disconneciton?
+    // SendL2capPacket(i, PairingFailedBuilder::Create(PairingFailedReason::UNSPECIFIED_REASON));
+    // TODO: disconnect?
+    i.OnPairingFinished(std::get<PairingFailure>(phase_1_result));
+    return;
+  }
+
+  auto [pairing_request, pairing_response] = std::get<Phase1Result>(phase_1_result);
+
+  /************************************************ PHASE 2 *********************************************************/
+  if (pairing_request.GetAuthReq() & pairing_response.GetAuthReq() & AuthReqMaskSc) {
+    // 2.3.5.6 LE Secure Connections pairing phase 2
+    LOG_INFO("Pairing Phase 2 LE Secure connections Started");
+
+    /*
+    TODO: what to do with this piece of spec ?
+    If Secure Connections pairing has been initiated over BR/EDR, the
+    following fields of the SM Pairing Request PDU are reserved for future use:
+     • the IO Capability field,
+     • the OOB data flag field, and
+     • all bits in the Auth Req field except the CT2 bit.
+    */
+
+    OobDataFlag remote_have_oob_data =
+        IAmMaster(i) ? pairing_response.GetOobDataFlag() : pairing_request.GetOobDataFlag();
+
+    auto key_exchange_result = ExchangePublicKeys(i, remote_have_oob_data);
+    if (std::holds_alternative<PairingFailure>(key_exchange_result)) {
+      LOG_ERROR("Public key exchange failed");
+      i.OnPairingFinished(std::get<PairingFailure>(key_exchange_result));
+      return;
+    }
+    auto [PKa, PKb, dhkey] = std::get<KeyExchangeResult>(key_exchange_result);
+
+    // Public key exchange finished, Diffie-Hellman key computed.
+
+    Stage1ResultOrFailure stage1result = DoSecureConnectionsStage1(i, PKa, PKb, pairing_request, pairing_response);
+    if (std::holds_alternative<PairingFailure>(stage1result)) {
+      i.OnPairingFinished(std::get<PairingFailure>(stage1result));
+      return;
+    }
+
+    Stage2ResultOrFailure stage_2_result = DoSecureConnectionsStage2(i, PKa, PKb, pairing_request, pairing_response,
+                                                                     std::get<Stage1Result>(stage1result), dhkey);
+    if (std::holds_alternative<PairingFailure>(stage_2_result)) {
+      i.OnPairingFinished(std::get<PairingFailure>(stage_2_result));
+      return;
+    }
+
+    Octet16 ltk = std::get<Octet16>(stage_2_result);
+    if (IAmMaster(i)) {
+      SendHciLeStartEncryption(i, i.connection_handle, {0}, {0}, ltk);
+    }
+
+  } else {
+    // 2.3.5.5 LE legacy pairing phase 2
+    LOG_INFO("Pairing Phase 2 LE legacy pairing Started");
+
+    LegacyStage1ResultOrFailure stage1result = DoLegacyStage1(i, pairing_request, pairing_response);
+    if (std::holds_alternative<PairingFailure>(stage1result)) {
+      LOG_ERROR("Phase 1 failed");
+      i.OnPairingFinished(std::get<PairingFailure>(stage1result));
+      return;
+    }
+
+    Octet16 tk = std::get<Octet16>(stage1result);
+    StkOrFailure stage2result = DoLegacyStage2(i, pairing_request, pairing_response, tk);
+    if (std::holds_alternative<PairingFailure>(stage2result)) {
+      LOG_ERROR("stage 2 failed");
+      i.OnPairingFinished(std::get<PairingFailure>(stage2result));
+      return;
+    }
+
+    Octet16 stk = std::get<Octet16>(stage2result);
+    if (IAmMaster(i)) {
+      SendHciLeStartEncryption(i, i.connection_handle, {0}, {0}, stk);
+    }
+  }
+
+  /************************************************ PHASE 3 *********************************************************/
+  auto encryption_change_result = WaitEncryptionChanged();
+  if (std::holds_alternative<PairingFailure>(encryption_change_result)) {
+    LOG_ERROR("encryption change failed");
+    i.OnPairingFinished(std::get<PairingFailure>(encryption_change_result));
+    return;
+  } else if (std::holds_alternative<EncryptionChangeView>(encryption_change_result)) {
+    EncryptionChangeView encryption_changed = std::get<EncryptionChangeView>(encryption_change_result);
+    if (encryption_changed.GetStatus() != hci::ErrorCode::SUCCESS ||
+        encryption_changed.GetEncryptionEnabled() != hci::EncryptionEnabled::ON) {
+      i.OnPairingFinished(PairingFailure("Encryption change failed"));
+    }
+  } else if (std::holds_alternative<EncryptionKeyRefreshCompleteView>(encryption_change_result)) {
+    EncryptionKeyRefreshCompleteView encryption_changed =
+        std::get<EncryptionKeyRefreshCompleteView>(encryption_change_result);
+    if (encryption_changed.GetStatus() != hci::ErrorCode::SUCCESS) {
+      i.OnPairingFinished(PairingFailure("Encryption key refresh failed"));
+    }
+  } else {
+    i.OnPairingFinished(PairingFailure("Unknown case of encryption change result"));
+  }
+
+  DistributedKeysOrFailure keyExchangeStatus = DistributeKeys(i, pairing_response);
+  if (std::holds_alternative<PairingFailure>(keyExchangeStatus)) {
+    i.OnPairingFinished(std::get<PairingFailure>(keyExchangeStatus));
+    LOG_ERROR("Key exchange failed");
+    return;
+  }
+
+  i.OnPairingFinished(PairingResult{
+      .connection_address = i.remote_connection_address,
+      .distributed_keys = std::get<DistributedKeys>(keyExchangeStatus),
+  });
+}
+
+Phase1ResultOrFailure PairingHandlerLe::ExchangePairingFeature(const InitialInformations& i) {
+  LOG_INFO("Phase 1 start");
+
+  if (IAmMaster(i)) {
+    // Send Pairing Request
+    const auto& x = i.myPairingCapabilities;
+    auto pairing_request_builder =
+        PairingRequestBuilder::Create(x.io_capability, x.oob_data_flag, x.auth_req, x.maximum_encryption_key_size,
+                                      x.initiator_key_distribution, x.responder_key_distribution);
+    // basically pairing_request = myPairingCapabilities;
+
+    // Convert builder to view
+    std::shared_ptr<std::vector<uint8_t>> packet_bytes = std::make_shared<std::vector<uint8_t>>();
+    BitInserter it(*packet_bytes);
+    pairing_request_builder->Serialize(it);
+    PacketView<kLittleEndian> packet_bytes_view(packet_bytes);
+    auto temp_cmd_view = CommandView::Create(packet_bytes_view);
+    auto pairing_request = PairingRequestView::Create(temp_cmd_view);
+    ASSERT(pairing_request.IsValid());
+
+    LOG_INFO("Sending Pairing Request");
+    SendL2capPacket(i, std::move(pairing_request_builder));
+
+    LOG_INFO("Waiting for Pairing Response");
+    auto response = WaitPairingResponse();
+
+    /* There is a potential collision where the slave initiates the pairing at the same time we initiate it, by sending
+     * security request. */
+    if (std::holds_alternative<PairingFailure>(response) &&
+        std::get<PairingFailure>(response).received_code_ == Code::SECURITY_REQUEST) {
+      LOG_INFO("Received security request, waiting for Pairing Response again...");
+      response = WaitPairingResponse();
+    }
+
+    if (std::holds_alternative<PairingFailure>(response)) {
+      // TODO: should the failure reason be different in some cases ? How about
+      // when we lost connection ? Don't send anything at all, or have L2CAP
+      // layer ignore it?
+      SendL2capPacket(i, PairingFailedBuilder::Create(PairingFailedReason::UNSPECIFIED_REASON));
+      return std::get<PairingFailure>(response);
+    }
+
+    auto pairing_response = std::get<PairingResponseView>(response);
+
+    LOG_INFO("Phase 1 finish");
+    return Phase1Result{pairing_request, pairing_response};
+  } else {
+    std::optional<PairingRequestView> pairing_request;
+
+    if (i.remotely_initiated) {
+      if (!i.pairing_request.has_value()) {
+        return PairingFailure("You must pass PairingRequest as a initial information to slave!");
+      }
+
+      pairing_request = i.pairing_request.value();
+
+      if (!pairing_request->IsValid()) return PairingFailure("Malformed PairingRequest");
+    } else {
+      SendL2capPacket(i, SecurityRequestBuilder::Create(i.myPairingCapabilities.auth_req));
+
+      LOG_INFO("Waiting for Pairing Request");
+      auto request = WaitPairingRequest();
+      if (std::holds_alternative<PairingFailure>(request)) {
+        LOG_INFO("%s", std::get<PairingFailure>(request).message.c_str());
+        SendL2capPacket(i, PairingFailedBuilder::Create(PairingFailedReason::UNSPECIFIED_REASON));
+        return std::get<PairingFailure>(request);
+      }
+
+      pairing_request = std::get<PairingRequestView>(request);
+    }
+
+    // Send Pairing Request
+    const auto& x = i.myPairingCapabilities;
+    // basically pairing_response_builder = my_first_packet;
+    // We are not allowed to enable bits that the remote did not allow us to set in initiator_key_dist and
+    // responder_key_distribution
+    auto pairing_response_builder =
+        PairingResponseBuilder::Create(x.io_capability, x.oob_data_flag, x.auth_req, x.maximum_encryption_key_size,
+                                       x.initiator_key_distribution & pairing_request->GetInitiatorKeyDistribution(),
+                                       x.responder_key_distribution & pairing_request->GetResponderKeyDistribution());
+
+    // Convert builder to view
+    std::shared_ptr<std::vector<uint8_t>> packet_bytes = std::make_shared<std::vector<uint8_t>>();
+    BitInserter it(*packet_bytes);
+    pairing_response_builder->Serialize(it);
+    PacketView<kLittleEndian> packet_bytes_view(packet_bytes);
+    auto temp_cmd_view = CommandView::Create(packet_bytes_view);
+    auto pairing_response = PairingResponseView::Create(temp_cmd_view);
+    ASSERT(pairing_response.IsValid());
+
+    LOG_INFO("Sending Pairing Response");
+    SendL2capPacket(i, std::move(pairing_response_builder));
+
+    LOG_INFO("Phase 1 finish");
+    return Phase1Result{pairing_request.value(), pairing_response};
+  }
+}
+
+DistributedKeysOrFailure PairingHandlerLe::DistributeKeys(const InitialInformations& i,
+                                                          const PairingResponseView& pairing_response) {
+  LOG_INFO("Key distribution start");
+
+  const uint8_t& keys_i_receive =
+      IAmMaster(i) ? pairing_response.GetResponderKeyDistribution() : pairing_response.GetInitiatorKeyDistribution();
+  const uint8_t& keys_i_send =
+      IAmMaster(i) ? pairing_response.GetInitiatorKeyDistribution() : pairing_response.GetResponderKeyDistribution();
+
+  // TODO: obtain actual values!
+
+  Octet16 my_ltk = {0};
+  uint16_t my_ediv{0};
+  std::array<uint8_t, 8> my_rand = {0};
+
+  Octet16 my_irk = {0x01};
+  Address my_identity_address;
+  AddrType my_identity_address_type = AddrType::PUBLIC;
+  Octet16 my_signature_key{0};
+
+  if (IAmMaster(i)) {
+    // EncKey is unused for LE Secure Connections
+    DistributedKeysOrFailure keys = ReceiveKeys(keys_i_receive);
+    if (std::holds_alternative<PairingFailure>(keys)) {
+      return keys;
+    }
+
+    SendKeys(i, keys_i_send, my_ltk, my_ediv, my_rand, my_irk, my_identity_address, my_identity_address_type,
+             my_signature_key);
+    LOG_INFO("Key distribution finish");
+    return keys;
+  } else {
+    SendKeys(i, keys_i_send, my_ltk, my_ediv, my_rand, my_irk, my_identity_address, my_identity_address_type,
+             my_signature_key);
+
+    DistributedKeysOrFailure keys = ReceiveKeys(keys_i_receive);
+    if (std::holds_alternative<PairingFailure>(keys)) {
+      return keys;
+    }
+    LOG_INFO("Key distribution finish");
+    return keys;
+  }
+}
+
+DistributedKeysOrFailure PairingHandlerLe::ReceiveKeys(const uint8_t& keys_i_receive) {
+  std::optional<Octet16> ltk;                 /* Legacy only */
+  std::optional<uint16_t> ediv;               /* Legacy only */
+  std::optional<std::array<uint8_t, 8>> rand; /* Legacy only */
+  std::optional<Address> identity_address;
+  AddrType identity_address_type;
+  std::optional<Octet16> irk;
+  std::optional<Octet16> signature_key;
+
+  if (keys_i_receive & KeyMaskEnc) {
+    {
+      auto packet = WaitEncryptionInformation();
+      if (std::holds_alternative<PairingFailure>(packet)) {
+        LOG_ERROR(" Was expecting Encryption Information but did not receive!");
+        return std::get<PairingFailure>(packet);
+      }
+      ltk = std::get<EncryptionInformationView>(packet).GetLongTermKey();
+    }
+
+    {
+      auto packet = WaitMasterIdentification();
+      if (std::holds_alternative<PairingFailure>(packet)) {
+        LOG_ERROR(" Was expecting Master Identification but did not receive!");
+        return std::get<PairingFailure>(packet);
+      }
+      ediv = std::get<MasterIdentificationView>(packet).GetEdiv();
+      rand = std::get<MasterIdentificationView>(packet).GetRand();
+    }
+  }
+
+  if (keys_i_receive & KeyMaskId) {
+    auto packet = WaitIdentityInformation();
+    if (std::holds_alternative<PairingFailure>(packet)) {
+      LOG_ERROR(" Was expecting Identity Information but did not receive!");
+      return std::get<PairingFailure>(packet);
+    }
+
+    LOG_INFO("Received Identity Information");
+    irk = std::get<IdentityInformationView>(packet).GetIdentityResolvingKey();
+
+    auto iapacket = WaitIdentityAddressInformation();
+    if (std::holds_alternative<PairingFailure>(iapacket)) {
+      LOG_ERROR(
+          "Was expecting Identity Address Information but did "
+          "not receive!");
+      return std::get<PairingFailure>(iapacket);
+    }
+    LOG_INFO("Received Identity Address Information");
+    identity_address = std::get<IdentityAddressInformationView>(iapacket).GetBdAddr();
+    identity_address_type = std::get<IdentityAddressInformationView>(iapacket).GetAddrType();
+  }
+
+  if (keys_i_receive & KeyMaskSign) {
+    auto packet = WaitSigningInformation();
+    if (std::holds_alternative<PairingFailure>(packet)) {
+      LOG_ERROR(" Was expecting Signing Information but did not receive!");
+      return std::get<PairingFailure>(packet);
+    }
+
+    LOG_INFO("Received Signing Information");
+    signature_key = std::get<SigningInformationView>(packet).GetSignatureKey();
+  }
+
+  return DistributedKeys{ltk, ediv, rand, identity_address, identity_address_type, irk, signature_key};
+}
+
+void PairingHandlerLe::SendKeys(const InitialInformations& i, const uint8_t& keys_i_send, Octet16 ltk, uint16_t ediv,
+                                std::array<uint8_t, 8> rand, Octet16 irk, Address identity_address,
+                                AddrType identity_addres_type, Octet16 signature_key) {
+  if (keys_i_send & KeyMaskEnc) {
+    SendL2capPacket(i, EncryptionInformationBuilder::Create(ltk));
+    SendL2capPacket(i, MasterIdentificationBuilder::Create(ediv, rand));
+  }
+
+  if (keys_i_send & KeyMaskId) {
+    SendL2capPacket(i, IdentityInformationBuilder::Create(irk));
+
+    SendL2capPacket(i, IdentityAddressInformationBuilder::Create(identity_addres_type, identity_address));
+  }
+
+  if (keys_i_send & KeyMaskSign) {
+    SendL2capPacket(i, SigningInformationBuilder::Create(signature_key));
+  }
+}
+
+}  // namespace security
+}  // namespace bluetooth
\ No newline at end of file
diff --git a/gd/security/pairing_handler_le.h b/gd/security/pairing_handler_le.h
new file mode 100644
index 0000000..4c7fc0c
--- /dev/null
+++ b/gd/security/pairing_handler_le.h
@@ -0,0 +1,493 @@
+/******************************************************************************
+ *
+ *  Copyright 2019 The Android Open Source Project
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at:
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ ******************************************************************************/
+
+#pragma once
+
+#include <array>
+#include <chrono>
+#include <condition_variable>
+#include <mutex>
+#include <optional>
+#include <queue>
+#include <thread>
+#include <variant>
+
+#include "common/bind.h"
+#include "crypto_toolbox/crypto_toolbox.h"
+#include "hci/hci_packets.h"
+#include "hci/le_security_interface.h"
+#include "packet/packet_view.h"
+#include "security/ecdh_keys.h"
+#include "security/initial_informations.h"
+#include "security/pairing_failure.h"
+#include "security/smp_packets.h"
+#include "security/ui.h"
+
+// Code generated by PDL does not allow us ot do || and && operations on bits
+// efficiently. Use those masks on fields requiring them until this is solved
+constexpr uint8_t AuthReqMaskBondingFlag = 0x01;
+constexpr uint8_t AuthReqMaskMitm = 0x02;
+constexpr uint8_t AuthReqMaskSc = 0x04;
+constexpr uint8_t AuthReqMaskKeypress = 0x08;
+constexpr uint8_t AuthReqMaskCt2 = 0x10;
+
+constexpr uint8_t KeyMaskEnc = 0x01;
+constexpr uint8_t KeyMaskId = 0x02;
+constexpr uint8_t KeyMaskSign = 0x04;
+constexpr uint8_t KeyMaskLink = 0x08;
+
+using bluetooth::hci::EncryptionChangeView;
+using bluetooth::hci::EncryptionKeyRefreshCompleteView;
+
+namespace bluetooth {
+namespace security {
+
+using crypto_toolbox::Octet16;
+
+/* This class represents an event send from other subsystems into SMP Pairing Handler,
+ * i.e. user request from the UI, L2CAP or HCI interaction */
+class PairingEvent {
+ public:
+  enum TYPE { EXIT, L2CAP, HCI_EVENT, UI };
+  TYPE type;
+
+  std::optional<CommandView> l2cap_packet;
+
+  std::optional<hci::EventPacketView> hci_event;
+
+  enum UI_ACTION_TYPE { PAIRING_ACCEPTED, CONFIRM_YESNO, PASSKEY };
+  UI_ACTION_TYPE ui_action;
+  uint32_t ui_value;
+
+  PairingEvent(TYPE type) : type(type) {}
+  PairingEvent(CommandView l2cap_packet) : type(L2CAP), l2cap_packet(l2cap_packet) {}
+  PairingEvent(UI_ACTION_TYPE ui_action, uint32_t ui_value) : type(UI), ui_action(ui_action), ui_value(ui_value) {}
+  PairingEvent(hci::EventPacketView hci_event) : type(HCI_EVENT), hci_event(hci_event) {}
+};
+
+constexpr int SMP_TIMEOUT = 30;
+
+using CommandViewOrFailure = std::variant<CommandView, PairingFailure>;
+using Phase1Result = std::pair<PairingRequestView /* pairning_request*/, PairingResponseView /* pairing_response */>;
+using Phase1ResultOrFailure = std::variant<PairingFailure, Phase1Result>;
+using KeyExchangeResult =
+    std::tuple<EcdhPublicKey /* PKa */, EcdhPublicKey /* PKb */, std::array<uint8_t, 32> /*dhkey*/>;
+using Stage1Result = std::tuple<Octet16, Octet16, Octet16, Octet16>;
+using Stage1ResultOrFailure = std::variant<PairingFailure, Stage1Result>;
+using Stage2ResultOrFailure = std::variant<PairingFailure, Octet16 /* LTK */>;
+using DistributedKeysOrFailure = std::variant<PairingFailure, DistributedKeys, std::monostate>;
+
+using LegacyStage1Result = Octet16 /*TK*/;
+using LegacyStage1ResultOrFailure = std::variant<PairingFailure, LegacyStage1Result>;
+using StkOrFailure = std::variant<PairingFailure, Octet16 /* STK */>;
+
+/* PairingHandlerLe takes care of the Pairing process. Pairing is strictly defined
+ * exchange of messages and UI interactions, divided into PHASES.
+ *
+ * Each PairingHandlerLe have a thread executing |PairingMain| method. Thread is
+ * blocked when waiting for UI/L2CAP/HCI interactions, and moves through all the
+ * phases.
+ */
+class PairingHandlerLe {
+ public:
+  // This is the phase of pairing as defined in BT Spec (with exception of
+  // accept prompt)
+  // * ACCEPT_PROMPT - we're waiting for the user to accept remotely initiated pairing
+  // * PHASE1 - feature exchange
+  // * PHASE2 - authentication
+  // * PHASE3 - key exchange
+  enum PAIRING_PHASE { ACCEPT_PROMPT, PHASE1, PHASE2, PHASE3 };
+  PAIRING_PHASE phase;
+
+  // All the knowledge to initiate the pairing process must be passed into this function
+  PairingHandlerLe(PAIRING_PHASE phase, InitialInformations informations)
+      : phase(phase), queue_guard(), thread_(&PairingHandlerLe::PairingMain, this, informations) {}
+
+  ~PairingHandlerLe() {
+    SendExitSignal();
+    // we need ot check if thread is joinable, because tests call join form
+    // within WaitUntilPairingFinished
+    if (thread_.joinable()) thread_.join();
+  }
+
+  void PairingMain(InitialInformations i);
+
+  Phase1ResultOrFailure ExchangePairingFeature(const InitialInformations& i);
+
+  void SendL2capPacket(const InitialInformations& i, std::unique_ptr<bluetooth::security::CommandBuilder> command) {
+    i.proper_l2cap_interface->Enqueue(std::move(command), i.l2cap_handler);
+  }
+
+  void SendHciLeStartEncryption(const InitialInformations& i, uint16_t conn_handle, const std::array<uint8_t, 8>& rand,
+                                const uint16_t& ediv, const Octet16& ltk) {
+    i.le_security_interface->EnqueueCommand(hci::LeStartEncryptionBuilder::Create(conn_handle, rand, ediv, ltk),
+                                            common::BindOnce([](hci::CommandStatusView) {
+                                              // TODO: handle command status. It's important - can show we are not
+                                              // connected any more.
+                                            }),
+                                            nullptr);
+  }
+
+  std::variant<PairingFailure, EncryptionChangeView, EncryptionKeyRefreshCompleteView> WaitEncryptionChanged() {
+    PairingEvent e = WaitForEvent();
+    if (e.type != PairingEvent::HCI_EVENT) return PairingFailure("Was expecting HCI event but received something else");
+
+    if (!e.hci_event->IsValid()) return PairingFailure("Received invalid HCI event");
+
+    if (e.hci_event->GetEventCode() == hci::EventCode::ENCRYPTION_CHANGE) {
+      EncryptionChangeView enc_chg_packet = EncryptionChangeView::Create(*e.hci_event);
+      if (!enc_chg_packet.IsValid()) {
+        return PairingFailure("Invalid EncryptionChange packet received");
+      }
+      return enc_chg_packet;
+    }
+
+    if (e.hci_event->GetEventCode() == hci::EventCode::ENCRYPTION_KEY_REFRESH_COMPLETE) {
+      hci::EncryptionKeyRefreshCompleteView enc_packet = EncryptionKeyRefreshCompleteView::Create(*e.hci_event);
+      if (!enc_packet.IsValid()) {
+        return PairingFailure("Invalid EncryptionChange packet received");
+      }
+      return enc_packet;
+    }
+
+    return PairingFailure("Was expecting Encryption Change or Key Refresh Complete but received something else");
+  }
+
+  inline bool IAmMaster(const InitialInformations& i) {
+    return i.my_role == hci::Role::MASTER;
+  }
+
+  /* This function generates data that should be passed to remote device, except
+     the private key. */
+  static MyOobData GenerateOobData() {
+    MyOobData data;
+    std::tie(data.private_key, data.public_key) = GenerateECDHKeyPair();
+
+    data.r = GenerateRandom<16>();
+    data.c = crypto_toolbox::f4(data.public_key.x.data(), data.public_key.x.data(), data.r, 0);
+    return data;
+  }
+
+  std::variant<PairingFailure, KeyExchangeResult> ExchangePublicKeys(const InitialInformations& i,
+                                                                     OobDataFlag remote_have_oob_data);
+
+  Stage1ResultOrFailure DoSecureConnectionsStage1(const InitialInformations& i, const EcdhPublicKey& PKa,
+                                                  const EcdhPublicKey& PKb, const PairingRequestView& pairing_request,
+                                                  const PairingResponseView& pairing_response);
+
+  Stage1ResultOrFailure SecureConnectionsNumericComparison(const InitialInformations& i, const EcdhPublicKey& PKa,
+                                                           const EcdhPublicKey& PKb);
+
+  Stage1ResultOrFailure SecureConnectionsJustWorks(const InitialInformations& i, const EcdhPublicKey& PKa,
+                                                   const EcdhPublicKey& PKb);
+
+  Stage1ResultOrFailure SecureConnectionsPasskeyEntry(const InitialInformations& i, const EcdhPublicKey& PKa,
+                                                      const EcdhPublicKey& PKb, IoCapability my_iocaps,
+                                                      IoCapability remote_iocaps);
+
+  Stage1ResultOrFailure SecureConnectionsOutOfBand(const InitialInformations& i, const EcdhPublicKey& Pka,
+                                                   const EcdhPublicKey& Pkb, OobDataFlag my_oob_flag,
+                                                   OobDataFlag remote_oob_flag);
+
+  Stage2ResultOrFailure DoSecureConnectionsStage2(const InitialInformations& i, const EcdhPublicKey& PKa,
+                                                  const EcdhPublicKey& PKb, const PairingRequestView& pairing_request,
+                                                  const PairingResponseView& pairing_response,
+                                                  const Stage1Result stage1result,
+                                                  const std::array<uint8_t, 32>& dhkey);
+
+  DistributedKeysOrFailure DistributeKeys(const InitialInformations& i, const PairingResponseView& pairing_response);
+
+  DistributedKeysOrFailure ReceiveKeys(const uint8_t& keys_i_receive);
+
+  LegacyStage1ResultOrFailure DoLegacyStage1(const InitialInformations& i, const PairingRequestView& pairing_request,
+                                             const PairingResponseView& pairing_response);
+  LegacyStage1ResultOrFailure LegacyOutOfBand(const InitialInformations& i);
+  LegacyStage1ResultOrFailure LegacyJustWorks();
+  LegacyStage1ResultOrFailure LegacyPasskeyEntry(const InitialInformations& i, const IoCapability& my_iocaps,
+                                                 const IoCapability& remote_iocaps);
+  StkOrFailure DoLegacyStage2(const InitialInformations& i, const PairingRequestView& pairing_request,
+                              const PairingResponseView& pairing_response, const Octet16& tk);
+
+  void SendKeys(const InitialInformations& i, const uint8_t& keys_i_send, Octet16 ltk, uint16_t ediv,
+                std::array<uint8_t, 8> rand, Octet16 irk, Address identity_address, AddrType identity_addres_type,
+                Octet16 signature_key);
+
+  /* This can be called from any thread to immediately finish the pairing in progress. */
+  void SendExitSignal() {
+    {
+      std::unique_lock<std::mutex> lock(queue_guard);
+      queue.push(PairingEvent(PairingEvent::EXIT));
+    }
+    pairing_thread_blocker_.notify_one();
+  }
+
+  /* SMP Command received from remote device */
+  void OnCommandView(CommandView packet) {
+    {
+      std::unique_lock<std::mutex> lock(queue_guard);
+      queue.push(PairingEvent(std::move(packet)));
+    }
+    pairing_thread_blocker_.notify_one();
+  }
+
+  /* SMP Command received from remote device */
+  void OnHciEvent(hci::EventPacketView hci_event) {
+    {
+      std::unique_lock<std::mutex> lock(queue_guard);
+      queue.push(PairingEvent(std::move(hci_event)));
+    }
+    pairing_thread_blocker_.notify_one();
+  }
+
+  /* Interaction from user */
+  void OnUiAction(PairingEvent::UI_ACTION_TYPE ui_action, uint32_t ui_value) {
+    {
+      std::unique_lock<std::mutex> lock(queue_guard);
+      queue.push(PairingEvent(ui_action, ui_value));
+    }
+    pairing_thread_blocker_.notify_one();
+  }
+
+  /* Blocks the pairing process until some external interaction, or timeout happens */
+  PairingEvent WaitForEvent() {
+    std::unique_lock<std::mutex> lock(queue_guard);
+    do {
+      if (!queue.empty()) {
+        PairingEvent e = queue.front();
+        queue.pop();
+        return e;
+      }
+      // This releases the lock while blocking.
+      if (pairing_thread_blocker_.wait_for(lock, std::chrono::seconds(SMP_TIMEOUT)) == std::cv_status::timeout) {
+        return PairingEvent(PairingEvent::EXIT);
+      }
+
+    } while (true);
+  }
+
+  std::optional<PairingEvent> WaitUiPairingAccept() {
+    PairingEvent e = WaitForEvent();
+    if (e.type == PairingEvent::UI & e.ui_action == PairingEvent::PAIRING_ACCEPTED) {
+      return e;
+    } else {
+      return std::nullopt;
+    }
+  }
+
+  std::optional<PairingEvent> WaitUiConfirmYesNo() {
+    PairingEvent e = WaitForEvent();
+    if (e.type == PairingEvent::UI & e.ui_action == PairingEvent::CONFIRM_YESNO) {
+      return e;
+    } else {
+      return std::nullopt;
+    }
+  }
+
+  std::optional<PairingEvent> WaitUiPasskey() {
+    PairingEvent e = WaitForEvent();
+    if (e.type == PairingEvent::UI & e.ui_action == PairingEvent::PASSKEY) {
+      return e;
+    } else {
+      return std::nullopt;
+    }
+  }
+
+  template <Code C>
+  struct CodeToPacketView;
+  template <>
+  struct CodeToPacketView<Code::PAIRING_REQUEST> {
+    typedef PairingRequestView type;
+  };
+  template <>
+  struct CodeToPacketView<Code::PAIRING_RESPONSE> {
+    typedef PairingResponseView type;
+  };
+  template <>
+  struct CodeToPacketView<Code::PAIRING_CONFIRM> {
+    typedef PairingConfirmView type;
+  };
+  template <>
+  struct CodeToPacketView<Code::PAIRING_RANDOM> {
+    typedef PairingRandomView type;
+  };
+  template <>
+  struct CodeToPacketView<Code::PAIRING_FAILED> {
+    typedef PairingFailedView type;
+  };
+  template <>
+  struct CodeToPacketView<Code::ENCRYPTION_INFORMATION> {
+    typedef EncryptionInformationView type;
+  };
+  template <>
+  struct CodeToPacketView<Code::MASTER_IDENTIFICATION> {
+    typedef MasterIdentificationView type;
+  };
+  template <>
+  struct CodeToPacketView<Code::IDENTITY_INFORMATION> {
+    typedef IdentityInformationView type;
+  };
+  template <>
+  struct CodeToPacketView<Code::IDENTITY_ADDRESS_INFORMATION> {
+    typedef IdentityAddressInformationView type;
+  };
+  template <>
+  struct CodeToPacketView<Code::SIGNING_INFORMATION> {
+    typedef SigningInformationView type;
+  };
+  template <>
+  struct CodeToPacketView<Code::SECURITY_REQUEST> {
+    typedef SecurityRequestView type;
+  };
+  template <>
+  struct CodeToPacketView<Code::PAIRING_PUBLIC_KEY> {
+    typedef PairingPublicKeyView type;
+  };
+  template <>
+  struct CodeToPacketView<Code::PAIRING_DH_KEY_CHECK> {
+    typedef PairingDhKeyCheckView type;
+  };
+  template <>
+  struct CodeToPacketView<Code::PAIRING_KEYPRESS_NOTIFICATION> {
+    typedef PairingKeypressNotificationView type;
+  };
+
+  template <Code CODE>
+  std::variant<typename CodeToPacketView<CODE>::type, PairingFailure> WaitPacket() {
+    PairingEvent e = WaitForEvent();
+    switch (e.type) {
+      case PairingEvent::EXIT:
+        return PairingFailure(
+            /*FROM_HERE,*/ "Was expecting L2CAP Packet " + CodeText(CODE) + ", but received EXIT instead");
+
+      case PairingEvent::HCI_EVENT:
+        return PairingFailure(
+            /*FROM_HERE,*/ "Was expecting L2CAP Packet " + CodeText(CODE) + ", but received HCI_EVENT instead");
+
+      case PairingEvent::UI:
+        return PairingFailure(
+            /*FROM_HERE,*/ "Was expecting L2CAP Packet " + CodeText(CODE) + ", but received UI instead");
+
+      case PairingEvent::L2CAP: {
+        auto l2cap_packet = e.l2cap_packet.value();
+        if (!l2cap_packet.IsValid()) {
+          return PairingFailure("Malformed L2CAP packet received!");
+        }
+
+        const auto& received_code = l2cap_packet.GetCode();
+        if (received_code != CODE) {
+          if (received_code == Code::PAIRING_FAILED) {
+            auto pkt = PairingFailedView::Create(l2cap_packet);
+            if (!pkt.IsValid()) return PairingFailure("Malformed " + CodeText(CODE) + " packet");
+            return PairingFailure(/*FROM_HERE,*/
+                                  "Was expecting " + CodeText(CODE) + ", but received PAIRING_FAILED instead",
+                                  pkt.GetReason());
+          }
+
+          return PairingFailure(/*FROM_HERE,*/
+                                "Was expecting " + CodeText(CODE) + ", but received " + CodeText(received_code) +
+                                    " instead",
+                                received_code);
+        }
+
+        auto pkt = CodeToPacketView<CODE>::type::Create(l2cap_packet);
+        if (!pkt.IsValid()) return PairingFailure("Malformed " + CodeText(CODE) + " packet");
+        return pkt;
+      }
+    }
+  }
+
+  auto WaitPairingRequest() {
+    return WaitPacket<Code::PAIRING_REQUEST>();
+  }
+
+  auto WaitPairingResponse() {
+    return WaitPacket<Code::PAIRING_RESPONSE>();
+  }
+
+  auto WaitPairingConfirm() {
+    return WaitPacket<Code::PAIRING_CONFIRM>();
+  }
+
+  auto WaitPairingRandom() {
+    return WaitPacket<Code::PAIRING_RANDOM>();
+  }
+
+  auto WaitPairingPublicKey() {
+    return WaitPacket<Code::PAIRING_PUBLIC_KEY>();
+  }
+
+  auto WaitPairingDHKeyCheck() {
+    return WaitPacket<Code::PAIRING_DH_KEY_CHECK>();
+  }
+
+  auto WaitEncryptionInformationRequest() {
+    return WaitPacket<Code::ENCRYPTION_INFORMATION>();
+  }
+
+  auto WaitEncryptionInformation() {
+    return WaitPacket<Code::ENCRYPTION_INFORMATION>();
+  }
+
+  auto WaitMasterIdentification() {
+    return WaitPacket<Code::MASTER_IDENTIFICATION>();
+  }
+
+  auto WaitIdentityInformation() {
+    return WaitPacket<Code::IDENTITY_INFORMATION>();
+  }
+
+  auto WaitIdentityAddressInformation() {
+    return WaitPacket<Code::IDENTITY_ADDRESS_INFORMATION>();
+  }
+
+  auto WaitSigningInformation() {
+    return WaitPacket<Code::SIGNING_INFORMATION>();
+  }
+
+  template <size_t SIZE>
+  static std::array<uint8_t, SIZE> GenerateRandom() {
+    // TODO:  We need a proper  random number generator here.
+    // use current time as seed for random generator
+    std::srand(std::time(nullptr));
+    std::array<uint8_t, SIZE> r;
+    for (size_t i = 0; i < SIZE; i++) r[i] = std::rand();
+    return r;
+  }
+
+  uint32_t GenerateRandom() {
+    // TODO:  We need a proper  random number generator here.
+    // use current time as seed for random generator
+    std::srand(std::time(nullptr));
+    return std::rand();
+  }
+
+  /* This is just for test, never use in production code! */
+  void WaitUntilPairingFinished() {
+    thread_.join();
+  }
+
+ private:
+  std::condition_variable pairing_thread_blocker_;
+
+  std::mutex queue_guard;
+  std::queue<PairingEvent> queue;
+
+  std::thread thread_;
+};
+}  // namespace security
+}  // namespace bluetooth
\ No newline at end of file
diff --git a/gd/security/pairing_handler_le_legacy.cc b/gd/security/pairing_handler_le_legacy.cc
new file mode 100644
index 0000000..0c3a73b
--- /dev/null
+++ b/gd/security/pairing_handler_le_legacy.cc
@@ -0,0 +1,234 @@
+/******************************************************************************
+ *
+ *  Copyright 2019 The Android Open Source Project
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at:
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ ******************************************************************************/
+
+#include "security/pairing_handler_le.h"
+
+namespace bluetooth {
+namespace security {
+
+LegacyStage1ResultOrFailure PairingHandlerLe::DoLegacyStage1(const InitialInformations& i,
+                                                             const PairingRequestView& pairing_request,
+                                                             const PairingResponseView& pairing_response) {
+  if (((pairing_request.GetAuthReq() | pairing_response.GetAuthReq()) & AuthReqMaskMitm) == 0) {
+    // If both devices have not set MITM option, Just Works shall be used
+    return LegacyJustWorks();
+  }
+
+  if (pairing_request.GetOobDataFlag() == OobDataFlag::PRESENT &&
+      pairing_response.GetOobDataFlag() == OobDataFlag::PRESENT) {
+    // OobDataFlag remote_oob_flag = IAmMaster(i) ? pairing_response.GetOobDataFlag() :
+    // pairing_request.GetOobDataFlag(); OobDataFlag my_oob_flag = IAmMaster(i) ? pairing_request.GetOobDataFlag() :
+    // pairing_response.GetOobDataFlag();
+    return LegacyOutOfBand(i);
+  }
+
+  const auto& iom = pairing_request.GetIoCapability();
+  const auto& ios = pairing_response.GetIoCapability();
+
+  if (iom == IoCapability::NO_INPUT_NO_OUTPUT || ios == IoCapability::NO_INPUT_NO_OUTPUT) {
+    return LegacyJustWorks();
+  }
+
+  if ((iom == IoCapability::DISPLAY_ONLY || iom == IoCapability::DISPLAY_YES_NO) &&
+      (ios == IoCapability::DISPLAY_ONLY || ios == IoCapability::DISPLAY_YES_NO)) {
+    return LegacyJustWorks();
+  }
+
+  // This if() should not be needed, these are only combinations left.
+  if (iom == IoCapability::KEYBOARD_DISPLAY || iom == IoCapability::KEYBOARD_ONLY ||
+      ios == IoCapability::KEYBOARD_DISPLAY || ios == IoCapability::KEYBOARD_ONLY) {
+    IoCapability my_iocaps = IAmMaster(i) ? iom : ios;
+    IoCapability remote_iocaps = IAmMaster(i) ? ios : iom;
+    return LegacyPasskeyEntry(i, my_iocaps, remote_iocaps);
+  }
+
+  // We went through all possble combinations.
+  LOG_ALWAYS_FATAL("This should never happen");
+}
+
+LegacyStage1ResultOrFailure PairingHandlerLe::LegacyJustWorks() {
+  LOG_INFO("Legacy Just Works start");
+  return Octet16{0};
+}
+
+LegacyStage1ResultOrFailure PairingHandlerLe::LegacyPasskeyEntry(const InitialInformations& i,
+                                                                 const IoCapability& my_iocaps,
+                                                                 const IoCapability& remote_iocaps) {
+  bool i_am_displaying = false;
+  if (my_iocaps == IoCapability::DISPLAY_ONLY || my_iocaps == IoCapability::DISPLAY_YES_NO) {
+    i_am_displaying = true;
+  } else if (IAmMaster(i) && remote_iocaps == IoCapability::KEYBOARD_DISPLAY &&
+             my_iocaps == IoCapability::KEYBOARD_DISPLAY) {
+    i_am_displaying = true;
+  } else if (my_iocaps == IoCapability::KEYBOARD_DISPLAY && remote_iocaps == IoCapability::KEYBOARD_ONLY) {
+    i_am_displaying = true;
+  }
+
+  LOG_INFO("Passkey Entry start %s", i_am_displaying ? "displaying" : "accepting");
+
+  uint32_t passkey;
+  if (i_am_displaying) {
+    // generate passkey in a valid range
+    passkey = GenerateRandom();
+    passkey &= 0x0fffff; /* maximum 20 significant bits */
+    constexpr uint32_t PASSKEY_MAX = 999999;
+    if (passkey > PASSKEY_MAX) passkey >>= 1;
+
+    i.ui_handler->DisplayConfirmValue(passkey);
+  } else {
+    i.ui_handler->DisplayEnterPasskeyDialog();
+    std::optional<PairingEvent> response = WaitUiPasskey();
+    if (!response) return PairingFailure("Passkey did not arrive!");
+
+    passkey = response->ui_value;
+  }
+
+  Octet16 tk{0};
+  tk[0] = (uint8_t)(passkey);
+  tk[1] = (uint8_t)(passkey >> 8);
+  tk[2] = (uint8_t)(passkey >> 16);
+  tk[3] = (uint8_t)(passkey >> 24);
+
+  LOG_INFO("Passkey Entry finish");
+  return tk;
+}
+
+LegacyStage1ResultOrFailure PairingHandlerLe::LegacyOutOfBand(const InitialInformations& i) {
+  return i.remote_oob_data->security_manager_tk_value;
+}
+
+StkOrFailure PairingHandlerLe::DoLegacyStage2(const InitialInformations& i, const PairingRequestView& pairing_request,
+                                              const PairingResponseView& pairing_response, const Octet16& tk) {
+  LOG_INFO("Legacy Step 2 start");
+  std::vector<uint8_t> preq(pairing_request.begin(), pairing_request.end());
+  std::vector<uint8_t> pres(pairing_response.begin(), pairing_response.end());
+
+  Octet16 mrand, srand;
+  if (IAmMaster(i)) {
+    mrand = GenerateRandom<16>();
+
+    // LOG(INFO) << +(IAmMaster(i)) << " tk = " << base::HexEncode(tk.data(), tk.size());
+    // LOG(INFO) << +(IAmMaster(i)) << " mrand = " << base::HexEncode(mrand.data(), mrand.size());
+    // LOG(INFO) << +(IAmMaster(i)) << " preq = " << base::HexEncode(preq.data(), preq.size());
+    // LOG(INFO) << +(IAmMaster(i)) << " pres = " << base::HexEncode(pres.data(), pres.size());
+    // LOG(INFO) << +(IAmMaster(i)) << " i.remote_connection_address_type = " << +i.remote_connection_address_type;
+    // LOG(INFO) << +(IAmMaster(i)) << " i.i.remote_connection_address.address = " << i.remote_connection_address;
+    // LOG(INFO) << +(IAmMaster(i)) << " i.my_connection_address_type = " << +i.my_connection_address_type;
+    // LOG(INFO) << +(IAmMaster(i)) << " i.i.my_connection_address.address = " << i.my_connection_address;
+    Octet16 mconfirm = crypto_toolbox::c1(
+        tk, mrand, preq.data(), pres.data(), (uint8_t)i.my_connection_address.GetAddressType(),
+        i.my_connection_address.GetAddress().address, (uint8_t)i.remote_connection_address.GetAddressType(),
+        i.remote_connection_address.GetAddress().address);
+
+    LOG_INFO("Master sends Mconfirm");
+    SendL2capPacket(i, PairingConfirmBuilder::Create(mconfirm));
+
+    LOG_INFO("Master waits for the Sconfirm");
+    auto sconfirm_pkt = WaitPairingConfirm();
+    if (std::holds_alternative<PairingFailure>(sconfirm_pkt)) {
+      return std::get<PairingFailure>(sconfirm_pkt);
+    }
+    Octet16 sconfirm = std::get<PairingConfirmView>(sconfirm_pkt).GetConfirmValue();
+
+    LOG_INFO("Master sends Mrand");
+    SendL2capPacket(i, PairingRandomBuilder::Create(mrand));
+
+    LOG_INFO("Master waits for Srand");
+    auto random_pkt = WaitPairingRandom();
+    if (std::holds_alternative<PairingFailure>(random_pkt)) {
+      return std::get<PairingFailure>(random_pkt);
+    }
+    srand = std::get<PairingRandomView>(random_pkt).GetRandomValue();
+
+    // LOG(INFO) << +(IAmMaster(i)) << " tk = " << base::HexEncode(tk.data(), tk.size());
+    // LOG(INFO) << +(IAmMaster(i)) << " srand = " << base::HexEncode(srand.data(), srand.size());
+    // LOG(INFO) << +(IAmMaster(i)) << " preq = " << base::HexEncode(preq.data(), preq.size());
+    // LOG(INFO) << +(IAmMaster(i)) << " pres = " << base::HexEncode(pres.data(), pres.size());
+    // LOG(INFO) << +(IAmMaster(i)) << " i.my_connection_address_type = " << +i.my_connection_address_type;
+    // LOG(INFO) << +(IAmMaster(i)) << " i.i.my_connection_address.address = " << i.my_connection_address;
+    // LOG(INFO) << +(IAmMaster(i)) << " i.remote_connection_address_type = " << +i.remote_connection_address_type;
+    // LOG(INFO) << +(IAmMaster(i)) << " i.i.remote_connection_address.address = " << i.remote_connection_address;
+    Octet16 sconfirm_generated = crypto_toolbox::c1(
+        tk, srand, preq.data(), pres.data(), (uint8_t)i.my_connection_address.GetAddressType(),
+        i.my_connection_address.GetAddress().address, (uint8_t)i.remote_connection_address.GetAddressType(),
+        i.remote_connection_address.GetAddress().address);
+
+    if (sconfirm != sconfirm_generated) {
+      LOG_INFO("sconfirm does not match generated value");
+
+      SendL2capPacket(i, PairingFailedBuilder::Create(PairingFailedReason::CONFIRM_VALUE_FAILED));
+      return PairingFailure("sconfirm does not match generated value");
+    }
+  } else {
+    srand = GenerateRandom<16>();
+
+    std::vector<uint8_t> preq(pairing_request.begin(), pairing_request.end());
+    std::vector<uint8_t> pres(pairing_response.begin(), pairing_response.end());
+
+    Octet16 sconfirm = crypto_toolbox::c1(
+        tk, srand, preq.data(), pres.data(), (uint8_t)i.remote_connection_address.GetAddressType(),
+        i.remote_connection_address.GetAddress().address, (uint8_t)i.my_connection_address.GetAddressType(),
+        i.my_connection_address.GetAddress().address);
+
+    LOG_INFO("Slave waits for the Mconfirm");
+    auto mconfirm_pkt = WaitPairingConfirm();
+    if (std::holds_alternative<PairingFailure>(mconfirm_pkt)) {
+      return std::get<PairingFailure>(mconfirm_pkt);
+    }
+    Octet16 mconfirm = std::get<PairingConfirmView>(mconfirm_pkt).GetConfirmValue();
+
+    LOG_INFO("Slave sends Sconfirm");
+    SendL2capPacket(i, PairingConfirmBuilder::Create(sconfirm));
+
+    LOG_INFO("Slave waits for Mrand");
+    auto random_pkt = WaitPairingRandom();
+    if (std::holds_alternative<PairingFailure>(random_pkt)) {
+      return std::get<PairingFailure>(random_pkt);
+    }
+    mrand = std::get<PairingRandomView>(random_pkt).GetRandomValue();
+
+    // LOG(INFO) << +(IAmMaster(i)) << " tk = " << base::HexEncode(tk.data(), tk.size());
+    // LOG(INFO) << +(IAmMaster(i)) << " mrand = " << base::HexEncode(mrand.data(), mrand.size());
+    // LOG(INFO) << +(IAmMaster(i)) << " preq = " << base::HexEncode(preq.data(), preq.size());
+    // LOG(INFO) << +(IAmMaster(i)) << " pres = " << base::HexEncode(pres.data(), pres.size());
+    // LOG(INFO) << +(IAmMaster(i)) << " i.my_connection_address_type = " << +i.my_connection_address_type;
+    // LOG(INFO) << +(IAmMaster(i)) << " i.i.my_connection_address.address = " << i.my_connection_address;
+    // LOG(INFO) << +(IAmMaster(i)) << " i.remote_connection_address_type = " << +i.remote_connection_address_type;
+    // LOG(INFO) << +(IAmMaster(i)) << " i.i.remote_connection_address.address = " << i.remote_connection_address;
+    Octet16 mconfirm_generated = crypto_toolbox::c1(
+        tk, mrand, preq.data(), pres.data(), (uint8_t)i.remote_connection_address.GetAddressType(),
+        i.remote_connection_address.GetAddress().address, (uint8_t)i.my_connection_address.GetAddressType(),
+        i.my_connection_address.GetAddress().address);
+
+    if (mconfirm != mconfirm_generated) {
+      LOG_INFO("mconfirm does not match generated value");
+      SendL2capPacket(i, PairingFailedBuilder::Create(PairingFailedReason::CONFIRM_VALUE_FAILED));
+      return PairingFailure("mconfirm does not match generated value");
+    }
+
+    LOG_INFO("Slave sends Srand");
+    SendL2capPacket(i, PairingRandomBuilder::Create(srand));
+  }
+
+  LOG_INFO("Legacy stage 2 finish");
+
+  /* STK */
+  return crypto_toolbox::s1(tk, srand, mrand);
+}
+}  // namespace security
+}  // namespace bluetooth
\ No newline at end of file
diff --git a/gd/security/pairing_handler_le_secure_connections.cc b/gd/security/pairing_handler_le_secure_connections.cc
new file mode 100644
index 0000000..f5b0a0f
--- /dev/null
+++ b/gd/security/pairing_handler_le_secure_connections.cc
@@ -0,0 +1,472 @@
+/******************************************************************************
+ *
+ *  Copyright 2019 The Android Open Source Project
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at:
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ ******************************************************************************/
+
+#include "security/pairing_handler_le.h"
+
+namespace bluetooth {
+namespace security {
+
+std::variant<PairingFailure, KeyExchangeResult> PairingHandlerLe::ExchangePublicKeys(const InitialInformations& i,
+                                                                                     OobDataFlag remote_have_oob_data) {
+  // Generate ECDH, or use one that was used for OOB data
+  const auto [private_key, public_key] = (remote_have_oob_data == OobDataFlag::NOT_PRESENT || !i.my_oob_data)
+                                             ? GenerateECDHKeyPair()
+                                             : std::make_pair(i.my_oob_data->private_key, i.my_oob_data->public_key);
+
+  LOG_INFO("Public key exchange start");
+  std::unique_ptr<PairingPublicKeyBuilder> myPublicKey = PairingPublicKeyBuilder::Create(public_key.x, public_key.y);
+
+  if (!ValidateECDHPoint(public_key)) {
+    LOG_ERROR("Can't validate my own public key!!!");
+    return PairingFailure("Can't validate my own public key");
+  }
+
+  if (IAmMaster(i)) {
+    // Send pairing public key
+    LOG_INFO("Master sends out public key");
+    SendL2capPacket(i, std::move(myPublicKey));
+  }
+
+  LOG_INFO(" Waiting for Public key...");
+  auto response = WaitPairingPublicKey();
+  LOG_INFO(" Received public key");
+  if (std::holds_alternative<PairingFailure>(response)) {
+    return std::get<PairingFailure>(response);
+  }
+
+  EcdhPublicKey remote_public_key;
+  auto ppkv = std::get<PairingPublicKeyView>(response);
+  remote_public_key.x = ppkv.GetPublicKeyX();
+  remote_public_key.y = ppkv.GetPublicKeyY();
+  LOG_INFO("Received Public key from remote");
+
+  // validate received public key
+  if (!ValidateECDHPoint(remote_public_key)) {
+    // TODO: Spec is unclear what should happend when the point is not on
+    // the correct curve: A device that detects an invalid public key from
+    // the peer at any point during the LE Secure Connections pairing
+    // process shall not use the resulting LTK, if any.
+    LOG_INFO("Can't validate remote public key");
+    return PairingFailure("Can't validate remote public key");
+  }
+
+  if (!IAmMaster(i)) {
+    LOG_INFO("Slave sends out public key");
+    // Send pairing public key
+    SendL2capPacket(i, std::move(myPublicKey));
+  }
+
+  LOG_INFO("Public key exchange finish");
+
+  std::array<uint8_t, 32> dhkey = ComputeDHKey(private_key, remote_public_key);
+
+  const EcdhPublicKey& PKa = IAmMaster(i) ? public_key : remote_public_key;
+  const EcdhPublicKey& PKb = IAmMaster(i) ? remote_public_key : public_key;
+
+  return KeyExchangeResult{PKa, PKb, dhkey};
+}
+
+Stage1ResultOrFailure PairingHandlerLe::DoSecureConnectionsStage1(const InitialInformations& i,
+                                                                  const EcdhPublicKey& PKa, const EcdhPublicKey& PKb,
+                                                                  const PairingRequestView& pairing_request,
+                                                                  const PairingResponseView& pairing_response) {
+  if ((pairing_request.GetAuthReq() & pairing_response.GetAuthReq() & AuthReqMaskMitm) == 0) {
+    // If both devices have not set MITM option, Just Works shall be used
+    return SecureConnectionsJustWorks(i, PKa, PKb);
+  }
+
+  if (pairing_request.GetOobDataFlag() == OobDataFlag::PRESENT ||
+      pairing_response.GetOobDataFlag() == OobDataFlag::PRESENT) {
+    OobDataFlag remote_oob_flag = IAmMaster(i) ? pairing_response.GetOobDataFlag() : pairing_request.GetOobDataFlag();
+    OobDataFlag my_oob_flag = IAmMaster(i) ? pairing_request.GetOobDataFlag() : pairing_response.GetOobDataFlag();
+    return SecureConnectionsOutOfBand(i, PKa, PKb, my_oob_flag, remote_oob_flag);
+  }
+
+  const auto& iom = pairing_request.GetIoCapability();
+  const auto& ios = pairing_response.GetIoCapability();
+
+  if ((iom == IoCapability::KEYBOARD_DISPLAY || iom == IoCapability::DISPLAY_YES_NO) &&
+      (ios == IoCapability::KEYBOARD_DISPLAY || ios == IoCapability::DISPLAY_YES_NO)) {
+    return SecureConnectionsNumericComparison(i, PKa, PKb);
+  }
+
+  if (iom == IoCapability::NO_INPUT_NO_OUTPUT || ios == IoCapability::NO_INPUT_NO_OUTPUT) {
+    return SecureConnectionsJustWorks(i, PKa, PKb);
+  }
+
+  if ((iom == IoCapability::DISPLAY_ONLY || iom == IoCapability::DISPLAY_YES_NO) &&
+      (ios == IoCapability::DISPLAY_ONLY || ios == IoCapability::DISPLAY_YES_NO)) {
+    return SecureConnectionsJustWorks(i, PKa, PKb);
+  }
+
+  IoCapability my_iocaps = IAmMaster(i) ? iom : ios;
+  IoCapability remote_iocaps = IAmMaster(i) ? ios : iom;
+  return SecureConnectionsPasskeyEntry(i, PKa, PKb, my_iocaps, remote_iocaps);
+}
+
+Stage2ResultOrFailure PairingHandlerLe::DoSecureConnectionsStage2(const InitialInformations& i,
+                                                                  const EcdhPublicKey& PKa, const EcdhPublicKey& PKb,
+                                                                  const PairingRequestView& pairing_request,
+                                                                  const PairingResponseView& pairing_response,
+                                                                  const Stage1Result stage1result,
+                                                                  const std::array<uint8_t, 32>& dhkey) {
+  LOG_INFO("Authentication stage 2 started");
+
+  auto [Na, Nb, ra, rb] = stage1result;
+
+  // 2.3.5.6.5 Authentication stage 2 long term key calculation
+  uint8_t a[7];
+  uint8_t b[7];
+
+  if (IAmMaster(i)) {
+    memcpy(a, i.my_connection_address.GetAddress().address, 6);
+    a[6] = (uint8_t)i.my_connection_address.GetAddressType();
+    memcpy(b, i.remote_connection_address.GetAddress().address, 6);
+    b[6] = (uint8_t)i.remote_connection_address.GetAddressType();
+  } else {
+    memcpy(a, i.remote_connection_address.GetAddress().address, 6);
+    a[6] = (uint8_t)i.remote_connection_address.GetAddressType();
+    memcpy(b, i.my_connection_address.GetAddress().address, 6);
+    b[6] = (uint8_t)i.my_connection_address.GetAddressType();
+  }
+
+  Octet16 ltk, mac_key;
+  crypto_toolbox::f5((uint8_t*)dhkey.data(), Na, Nb, a, b, &mac_key, &ltk);
+
+  // DHKey exchange and check
+
+  std::array<uint8_t, 3> iocapA{static_cast<uint8_t>(pairing_request.GetIoCapability()),
+                                static_cast<uint8_t>(pairing_request.GetOobDataFlag()), pairing_request.GetAuthReq()};
+  std::array<uint8_t, 3> iocapB{static_cast<uint8_t>(pairing_response.GetIoCapability()),
+                                static_cast<uint8_t>(pairing_response.GetOobDataFlag()), pairing_response.GetAuthReq()};
+
+  // LOG(INFO) << +(IAmMaster(i)) << " LTK = " << base::HexEncode(ltk.data(), ltk.size());
+  // LOG(INFO) << +(IAmMaster(i)) << " MAC_KEY = " << base::HexEncode(mac_key.data(), mac_key.size());
+  // LOG(INFO) << +(IAmMaster(i)) << " Na = " << base::HexEncode(Na.data(), Na.size());
+  // LOG(INFO) << +(IAmMaster(i)) << " Nb = " << base::HexEncode(Nb.data(), Nb.size());
+  // LOG(INFO) << +(IAmMaster(i)) << " ra = " << base::HexEncode(ra.data(), ra.size());
+  // LOG(INFO) << +(IAmMaster(i)) << " rb = " << base::HexEncode(rb.data(), rb.size());
+  // LOG(INFO) << +(IAmMaster(i)) << " iocapA = " << base::HexEncode(iocapA.data(), iocapA.size());
+  // LOG(INFO) << +(IAmMaster(i)) << " iocapB = " << base::HexEncode(iocapB.data(), iocapB.size());
+  // LOG(INFO) << +(IAmMaster(i)) << " a = " << base::HexEncode(a, 7);
+  // LOG(INFO) << +(IAmMaster(i)) << " b = " << base::HexEncode(b, 7);
+
+  Octet16 Ea = crypto_toolbox::f6(mac_key, Na, Nb, rb, iocapA.data(), a, b);
+
+  Octet16 Eb = crypto_toolbox::f6(mac_key, Nb, Na, ra, iocapB.data(), b, a);
+
+  if (IAmMaster(i)) {
+    // send Pairing DHKey Check
+    SendL2capPacket(i, PairingDhKeyCheckBuilder::Create(Ea));
+
+    auto response = WaitPairingDHKeyCheck();
+    if (std::holds_alternative<PairingFailure>(response)) {
+      return std::get<PairingFailure>(response);
+    }
+
+    if (std::get<PairingDhKeyCheckView>(response).GetDhKeyCheck() != Eb) {
+      LOG_INFO("Ea != Eb, aborting!");
+      SendL2capPacket(i, PairingFailedBuilder::Create(PairingFailedReason::DHKEY_CHECK_FAILED));
+      return PairingFailure("Ea != Eb");
+    }
+  } else {
+    auto response = WaitPairingDHKeyCheck();
+    if (std::holds_alternative<PairingFailure>(response)) {
+      return std::get<PairingFailure>(response);
+    }
+
+    if (std::get<PairingDhKeyCheckView>(response).GetDhKeyCheck() != Ea) {
+      LOG_INFO("Ea != Eb, aborting!");
+      SendL2capPacket(i, PairingFailedBuilder::Create(PairingFailedReason::DHKEY_CHECK_FAILED));
+      return PairingFailure("Ea != Eb");
+    }
+
+    // send Pairing DHKey Check
+    SendL2capPacket(i, PairingDhKeyCheckBuilder::Create(Eb));
+  }
+
+  LOG_INFO("Authentication stage 2 (DHKey checks) finished");
+  return ltk;
+}
+
+Stage1ResultOrFailure PairingHandlerLe::SecureConnectionsOutOfBand(const InitialInformations& i,
+                                                                   const EcdhPublicKey& Pka, const EcdhPublicKey& Pkb,
+                                                                   OobDataFlag my_oob_flag,
+                                                                   OobDataFlag remote_oob_flag) {
+  LOG_INFO("Out Of Band start");
+
+  Octet16 zeros{0};
+  Octet16 localR = (remote_oob_flag == OobDataFlag::PRESENT && i.my_oob_data) ? i.my_oob_data->r : zeros;
+  Octet16 remoteR;
+
+  if (my_oob_flag == OobDataFlag::NOT_PRESENT || (my_oob_flag == OobDataFlag::PRESENT && !i.remote_oob_data)) {
+    /* we have send the OOB data, but not received them. remote will check if
+     * C value is correct */
+    remoteR = zeros;
+  } else {
+    remoteR = i.remote_oob_data->le_sc_r;
+    Octet16 remoteC = i.remote_oob_data->le_sc_c;
+
+    Octet16 remoteC2;
+    if (IAmMaster(i)) {
+      remoteC2 = crypto_toolbox::f4((uint8_t*)Pkb.x.data(), (uint8_t*)Pkb.x.data(), remoteR, 0);
+    } else {
+      remoteC2 = crypto_toolbox::f4((uint8_t*)Pka.x.data(), (uint8_t*)Pka.x.data(), remoteR, 0);
+    }
+
+    if (remoteC2 != remoteC) {
+      LOG_ERROR("C_computed != C_from_remote, aborting!");
+      return PairingFailure("C_computed != C_from_remote, aborting");
+    }
+  }
+
+  Octet16 Na, Nb, ra, rb;
+  if (IAmMaster(i)) {
+    ra = localR;
+    rb = remoteR;
+    Na = GenerateRandom<16>();
+    // Send Pairing Random
+    SendL2capPacket(i, PairingRandomBuilder::Create(Na));
+
+    LOG_INFO("Master waits for Nb");
+    auto random = WaitPairingRandom();
+    if (std::holds_alternative<PairingFailure>(random)) {
+      return std::get<PairingFailure>(random);
+    }
+    Nb = std::get<PairingRandomView>(random).GetRandomValue();
+  } else {
+    ra = remoteR;
+    rb = localR;
+    Nb = GenerateRandom<16>();
+
+    LOG_INFO("Slave waits for random");
+    auto random = WaitPairingRandom();
+    if (std::holds_alternative<PairingFailure>(random)) {
+      return std::get<PairingFailure>(random);
+    }
+    Na = std::get<PairingRandomView>(random).GetRandomValue();
+
+    SendL2capPacket(i, PairingRandomBuilder::Create(Nb));
+  }
+
+  return Stage1Result{Na, Nb, ra, rb};
+}
+
+Stage1ResultOrFailure PairingHandlerLe::SecureConnectionsPasskeyEntry(const InitialInformations& i,
+                                                                      const EcdhPublicKey& PKa,
+                                                                      const EcdhPublicKey& PKb, IoCapability my_iocaps,
+                                                                      IoCapability remote_iocaps) {
+  LOG_INFO("Passkey Entry start");
+  Octet16 Na, Nb, ra{0}, rb{0};
+
+  uint32_t passkey;
+
+  if (my_iocaps == IoCapability::DISPLAY_ONLY || remote_iocaps == IoCapability::KEYBOARD_ONLY) {
+    // I display
+    passkey = GenerateRandom();
+    passkey &= 0x0fffff; /* maximum 20 significant bytes */
+    constexpr uint32_t PASSKEY_MAX = 999999;
+    while (passkey > PASSKEY_MAX) passkey >>= 1;
+
+    i.ui_handler->DisplayPasskey(passkey);
+
+  } else if (my_iocaps == IoCapability::KEYBOARD_ONLY || remote_iocaps == IoCapability::DISPLAY_ONLY) {
+    i.ui_handler->DisplayEnterPasskeyDialog();
+    std::optional<PairingEvent> response = WaitUiPasskey();
+    if (!response) return PairingFailure("Passkey did not arrive!");
+
+    passkey = response->ui_value;
+
+    /*TODO: shall we send "Keypress Notification" after each key ? This would
+     * have impact on the SMP timeout*/
+
+  } else {
+    LOG(FATAL) << "THIS SHOULD NEVER HAPPEN";
+    return PairingFailure("FATAL!");
+  }
+
+  uint32_t bitmask = 0x01;
+  for (int loop = 0; loop < 20; loop++, bitmask <<= 1) {
+    LOG_INFO("Iteration no %d", loop);
+    bool bit_set = ((bitmask & passkey) != 0);
+    uint8_t ri = bit_set ? 0x81 : 0x80;
+
+    Octet16 Cai, Cbi, Nai, Nbi;
+    if (IAmMaster(i)) {
+      Nai = GenerateRandom<16>();
+
+      Cai = crypto_toolbox::f4((uint8_t*)PKa.x.data(), (uint8_t*)PKb.x.data(), Nai, ri);
+
+      // Send Pairing Confirm
+      LOG_INFO("Master sends Cai");
+      SendL2capPacket(i, PairingConfirmBuilder::Create(Cai));
+
+      LOG_INFO("Master waits for the Cbi");
+      auto confirm = WaitPairingConfirm();
+      if (std::holds_alternative<PairingFailure>(confirm)) {
+        return std::get<PairingFailure>(confirm);
+      }
+      Cbi = std::get<PairingConfirmView>(confirm).GetConfirmValue();
+
+      // Send Pairing Random
+      SendL2capPacket(i, PairingRandomBuilder::Create(Nai));
+
+      LOG_INFO("Master waits for Nbi");
+      auto random = WaitPairingRandom();
+      if (std::holds_alternative<PairingFailure>(random)) {
+        return std::get<PairingFailure>(random);
+      }
+      Nbi = std::get<PairingRandomView>(random).GetRandomValue();
+
+      Octet16 Cbi2 = crypto_toolbox::f4((uint8_t*)PKb.x.data(), (uint8_t*)PKa.x.data(), Nbi, ri);
+      if (Cbi != Cbi2) {
+        LOG_INFO("Cai != Cbi, aborting!");
+        SendL2capPacket(i, PairingFailedBuilder::Create(PairingFailedReason::CONFIRM_VALUE_FAILED));
+        return PairingFailure("Cai != Cbi");
+      }
+    } else {
+      Nbi = GenerateRandom<16>();
+      // Compute confirm
+      Cbi = crypto_toolbox::f4((uint8_t*)PKb.x.data(), (uint8_t*)PKa.x.data(), Nbi, ri);
+
+      LOG_INFO("Slave waits for the Cai");
+      auto confirm = WaitPairingConfirm();
+      if (std::holds_alternative<PairingFailure>(confirm)) {
+        return std::get<PairingFailure>(confirm);
+      }
+      Cai = std::get<PairingConfirmView>(confirm).GetConfirmValue();
+
+      // Send Pairing Confirm
+      LOG_INFO("Slave sends confirmation");
+      SendL2capPacket(i, PairingConfirmBuilder::Create(Cbi));
+
+      LOG_INFO("Slave waits for random");
+      auto random = WaitPairingRandom();
+      if (std::holds_alternative<PairingFailure>(random)) {
+        return std::get<PairingFailure>(random);
+      }
+      Nai = std::get<PairingRandomView>(random).GetRandomValue();
+
+      Octet16 Cai2 = crypto_toolbox::f4((uint8_t*)PKa.x.data(), (uint8_t*)PKb.x.data(), Nai, ri);
+      if (Cai != Cai2) {
+        LOG_INFO("Cai != Cai2, aborting!");
+        SendL2capPacket(i, PairingFailedBuilder::Create(PairingFailedReason::CONFIRM_VALUE_FAILED));
+        return PairingFailure("Cai != Cai2");
+      }
+
+      // Send Pairing Random
+      SendL2capPacket(i, PairingRandomBuilder::Create(Nbi));
+    }
+
+    if (loop == 19) {
+      Na = Nai;
+      Nb = Nbi;
+    }
+  }
+
+  ra[0] = (uint8_t)(passkey);
+  ra[1] = (uint8_t)(passkey >> 8);
+  ra[2] = (uint8_t)(passkey >> 16);
+  ra[3] = (uint8_t)(passkey >> 24);
+  rb = ra;
+
+  return Stage1Result{Na, Nb, ra, rb};
+}
+
+Stage1ResultOrFailure PairingHandlerLe::SecureConnectionsNumericComparison(const InitialInformations& i,
+                                                                           const EcdhPublicKey& PKa,
+                                                                           const EcdhPublicKey& PKb) {
+  LOG_INFO("Numeric Comparison start");
+  Stage1ResultOrFailure result = SecureConnectionsJustWorks(i, PKa, PKb);
+  if (std::holds_alternative<PairingFailure>(result)) {
+    return std::get<PairingFailure>(result);
+  }
+
+  const auto [Na, Nb, ra, rb] = std::get<Stage1Result>(result);
+
+  uint32_t number_to_display = crypto_toolbox::g2((uint8_t*)PKa.x.data(), (uint8_t*)PKb.x.data(), Na, Nb);
+
+  i.ui_handler->DisplayConfirmValue(number_to_display);
+
+  std::optional<PairingEvent> confirmyesno = WaitUiConfirmYesNo();
+  if (!confirmyesno || confirmyesno->ui_value == 0) {
+    LOG_INFO("Was expecting the user value confirm");
+    return PairingFailure("Was expecting the user value confirm");
+  }
+
+  return result;
+}
+
+Stage1ResultOrFailure PairingHandlerLe::SecureConnectionsJustWorks(const InitialInformations& i,
+                                                                   const EcdhPublicKey& PKa, const EcdhPublicKey& PKb) {
+  Octet16 Ca, Cb, Na, Nb, ra, rb;
+
+  ra = rb = {0};
+
+  if (IAmMaster(i)) {
+    Na = GenerateRandom<16>();
+    LOG_INFO("Master waits for confirmation");
+    auto confirm = WaitPairingConfirm();
+    if (std::holds_alternative<PairingFailure>(confirm)) {
+      return std::get<PairingFailure>(confirm);
+    }
+    Cb = std::get<PairingConfirmView>(confirm).GetConfirmValue();
+
+    // Send Pairing Random
+    SendL2capPacket(i, PairingRandomBuilder::Create(Na));
+
+    LOG_INFO("Master waits for Random");
+    auto random = WaitPairingRandom();
+    if (std::holds_alternative<PairingFailure>(random)) {
+      return std::get<PairingFailure>(random);
+    }
+    Nb = std::get<PairingRandomView>(random).GetRandomValue();
+
+    // Compute confirm
+    Ca = crypto_toolbox::f4((uint8_t*)PKb.x.data(), (uint8_t*)PKa.x.data(), Nb, 0);
+
+    if (Ca != Cb) {
+      LOG_INFO("Ca != Cb, aborting!");
+      SendL2capPacket(i, PairingFailedBuilder::Create(PairingFailedReason::CONFIRM_VALUE_FAILED));
+      return PairingFailure("Ca != Cb");
+    }
+  } else {
+    Nb = GenerateRandom<16>();
+    // Compute confirm
+    Cb = crypto_toolbox::f4((uint8_t*)PKb.x.data(), (uint8_t*)PKa.x.data(), Nb, 0);
+
+    // Send Pairing Confirm
+    LOG_INFO("Slave sends confirmation");
+    SendL2capPacket(i, PairingConfirmBuilder::Create(Cb));
+
+    LOG_INFO("Slave waits for random");
+    auto random = WaitPairingRandom();
+    if (std::holds_alternative<PairingFailure>(random)) {
+      return std::get<PairingFailure>(random);
+    }
+    Na = std::get<PairingRandomView>(random).GetRandomValue();
+
+    // Send Pairing Random
+    SendL2capPacket(i, PairingRandomBuilder::Create(Nb));
+  }
+
+  return Stage1Result{Na, Nb, ra, rb};
+}
+
+}  // namespace security
+}  // namespace bluetooth
\ No newline at end of file
diff --git a/gd/security/pairing_handler_le_unittest.cc b/gd/security/pairing_handler_le_unittest.cc
new file mode 100644
index 0000000..3610700
--- /dev/null
+++ b/gd/security/pairing_handler_le_unittest.cc
@@ -0,0 +1,335 @@
+/******************************************************************************
+ *
+ *  Copyright 2019 The Android Open Source Project
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at:
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ ******************************************************************************/
+
+#include <gmock/gmock.h>
+#include <gtest/gtest.h>
+#include <memory>
+
+#include "os/log.h"
+#include "security/pairing_handler_le.h"
+#include "security/test/mocks.h"
+
+using ::testing::_;
+using ::testing::Eq;
+using ::testing::Field;
+using ::testing::VariantWith;
+
+using bluetooth::security::CommandView;
+
+namespace bluetooth {
+namespace security {
+
+namespace {
+
+CommandView BuilderToView(std::unique_ptr<BasePacketBuilder> builder) {
+  std::shared_ptr<std::vector<uint8_t>> packet_bytes = std::make_shared<std::vector<uint8_t>>();
+  BitInserter it(*packet_bytes);
+  builder->Serialize(it);
+  PacketView<kLittleEndian> packet_bytes_view(packet_bytes);
+  auto temp_cmd_view = CommandView::Create(packet_bytes_view);
+  return CommandView::Create(temp_cmd_view);
+}
+
+std::condition_variable outgoing_l2cap_blocker_;
+std::optional<bluetooth::security::CommandView> outgoing_l2cap_packet_;
+
+bool WaitForOutgoingL2capPacket() {
+  std::mutex mutex;
+  std::unique_lock<std::mutex> lock(mutex);
+  if (outgoing_l2cap_blocker_.wait_for(lock, std::chrono::seconds(5)) == std::cv_status::timeout) {
+    return false;
+  }
+  return true;
+}
+
+class PairingResultHandlerMock {
+ public:
+  MOCK_CONST_METHOD1(OnPairingFinished, void(PairingResultOrFailure));
+};
+
+std::unique_ptr<PairingResultHandlerMock> pairingResult;
+LeSecurityInterfaceMock leSecurityMock;
+UIMock uiMock;
+
+void OnPairingFinished(PairingResultOrFailure r) {
+  if (std::holds_alternative<PairingResult>(r)) {
+    LOG(INFO) << "pairing with " << std::get<PairingResult>(r).connection_address << " finished successfully!";
+  } else {
+    LOG(INFO) << "pairing with ... failed!";
+  }
+  pairingResult->OnPairingFinished(r);
+}
+}  // namespace
+
+class PairingHandlerUnitTest : public testing::Test {
+ protected:
+  void SetUp() {
+    thread_ = new os::Thread("test_thread", os::Thread::Priority::NORMAL);
+    handler_ = new os::Handler(thread_);
+
+    bidi_queue_ =
+        std::make_unique<common::BidiQueue<packet::PacketView<packet::kLittleEndian>, packet::BasePacketBuilder>>(10);
+    up_buffer_ = std::make_unique<os::EnqueueBuffer<packet::BasePacketBuilder>>(bidi_queue_->GetUpEnd());
+
+    bidi_queue_->GetDownEnd()->RegisterDequeue(
+        handler_, common::Bind(&PairingHandlerUnitTest::L2CAP_SendSmp, common::Unretained(this)));
+
+    pairingResult.reset(new PairingResultHandlerMock);
+  }
+  void TearDown() {
+    pairingResult.reset();
+    bidi_queue_->GetDownEnd()->UnregisterDequeue();
+    handler_->Clear();
+    delete handler_;
+    delete thread_;
+
+    ::testing::Mock::VerifyAndClearExpectations(&leSecurityMock);
+    ::testing::Mock::VerifyAndClearExpectations(&uiMock);
+  }
+
+  void L2CAP_SendSmp() {
+    std::unique_ptr<packet::BasePacketBuilder> builder = bidi_queue_->GetDownEnd()->TryDequeue();
+
+    outgoing_l2cap_packet_ = BuilderToView(std::move(builder));
+    outgoing_l2cap_packet_->IsValid();
+
+    outgoing_l2cap_blocker_.notify_one();
+  }
+
+ public:
+  os::Thread* thread_;
+  os::Handler* handler_;
+  std::unique_ptr<common::BidiQueue<packet::PacketView<packet::kLittleEndian>, packet::BasePacketBuilder>> bidi_queue_;
+  std::unique_ptr<os::EnqueueBuffer<packet::BasePacketBuilder>> up_buffer_;
+};
+
+InitialInformations initial_informations{
+    .my_role = hci::Role::MASTER,
+    .my_connection_address = {{}, hci::AddressType::PUBLIC_DEVICE_ADDRESS},
+
+    .myPairingCapabilities = {.io_capability = IoCapability::NO_INPUT_NO_OUTPUT,
+                              .oob_data_flag = OobDataFlag::NOT_PRESENT,
+                              .auth_req = AuthReqMaskBondingFlag | AuthReqMaskMitm | AuthReqMaskSc,
+                              .maximum_encryption_key_size = 16,
+                              .initiator_key_distribution = 0x03,
+                              .responder_key_distribution = 0x03},
+
+    .remotely_initiated = false,
+    .remote_connection_address = {{}, hci::AddressType::RANDOM_DEVICE_ADDRESS},
+    .ui_handler = &uiMock,
+    .le_security_interface = &leSecurityMock,
+    .OnPairingFinished = OnPairingFinished,
+};
+
+TEST_F(PairingHandlerUnitTest, test_phase_1_failure) {
+  initial_informations.proper_l2cap_interface = up_buffer_.get();
+  initial_informations.l2cap_handler = handler_;
+
+  std::unique_ptr<PairingHandlerLe> pairing_handler =
+      std::make_unique<PairingHandlerLe>(PairingHandlerLe::PHASE1, initial_informations);
+
+  EXPECT_TRUE(WaitForOutgoingL2capPacket());
+  EXPECT_EQ(outgoing_l2cap_packet_->GetCode(), Code::PAIRING_REQUEST);
+
+  EXPECT_CALL(*pairingResult, OnPairingFinished(VariantWith<PairingFailure>(_))).Times(1);
+
+  // SMP will waith for Pairing Response, once bad packet is received, it should stop the Pairing
+  CommandView bad_pairing_response = BuilderToView(PairingRandomBuilder::Create({}));
+  bad_pairing_response.IsValid();
+  pairing_handler->OnCommandView(bad_pairing_response);
+
+  EXPECT_TRUE(WaitForOutgoingL2capPacket());
+  EXPECT_EQ(outgoing_l2cap_packet_->GetCode(), Code::PAIRING_FAILED);
+}
+
+TEST_F(PairingHandlerUnitTest, test_secure_connections_just_works) {
+  initial_informations.proper_l2cap_interface = up_buffer_.get();
+  initial_informations.l2cap_handler = handler_;
+
+  // we keep the pairing_handler as unique_ptr to better mimick how it's used
+  // in the real world
+  std::unique_ptr<PairingHandlerLe> pairing_handler =
+      std::make_unique<PairingHandlerLe>(PairingHandlerLe::PHASE1, initial_informations);
+
+  EXPECT_TRUE(WaitForOutgoingL2capPacket());
+  EXPECT_EQ(outgoing_l2cap_packet_->GetCode(), Code::PAIRING_REQUEST);
+  CommandView pairing_request = outgoing_l2cap_packet_.value();
+
+  auto pairing_response = BuilderToView(
+      PairingResponseBuilder::Create(IoCapability::KEYBOARD_DISPLAY, OobDataFlag::NOT_PRESENT,
+                                     AuthReqMaskBondingFlag | AuthReqMaskMitm | AuthReqMaskSc, 16, 0x03, 0x03));
+  pairing_handler->OnCommandView(pairing_response);
+  // Phase 1 finished.
+
+  // pairing public key
+  EXPECT_TRUE(WaitForOutgoingL2capPacket());
+  EXPECT_EQ(Code::PAIRING_PUBLIC_KEY, outgoing_l2cap_packet_->GetCode());
+  EcdhPublicKey my_public_key;
+  auto ppkv = PairingPublicKeyView::Create(outgoing_l2cap_packet_.value());
+  ppkv.IsValid();
+  my_public_key.x = ppkv.GetPublicKeyX();
+  my_public_key.y = ppkv.GetPublicKeyY();
+
+  const auto [private_key, public_key] = GenerateECDHKeyPair();
+
+  pairing_handler->OnCommandView(BuilderToView(PairingPublicKeyBuilder::Create(public_key.x, public_key.y)));
+  // DHKey exchange finished
+  std::array<uint8_t, 32> dhkey = ComputeDHKey(private_key, my_public_key);
+
+  // Phasae 2 Stage 1 start
+  Octet16 ra, rb;
+  ra = rb = {0};
+
+  Octet16 Nb = PairingHandlerLe::GenerateRandom<16>();
+
+  // Compute confirm
+  Octet16 Cb = crypto_toolbox::f4((uint8_t*)my_public_key.x.data(), (uint8_t*)public_key.x.data(), Nb, 0);
+
+  pairing_handler->OnCommandView(BuilderToView(PairingConfirmBuilder::Create(Cb)));
+
+  // random
+  EXPECT_TRUE(WaitForOutgoingL2capPacket());
+  EXPECT_EQ(Code::PAIRING_RANDOM, outgoing_l2cap_packet_->GetCode());
+  auto prv = PairingRandomView::Create(outgoing_l2cap_packet_.value());
+  prv.IsValid();
+  Octet16 Na = prv.GetRandomValue();
+
+  // Compute Ca, compare
+  Octet16 Ca = crypto_toolbox::f4((uint8_t*)my_public_key.x.data(), (uint8_t*)public_key.x.data(), Na, 0);
+
+  EXPECT_EQ(Ca, Cb);
+
+  pairing_handler->OnCommandView(BuilderToView(PairingRandomBuilder::Create(Nb)));
+
+  // Start of authentication stage 2
+  uint8_t a[7];
+  uint8_t b[7];
+  memcpy(b, initial_informations.remote_connection_address.GetAddress().address, 6);
+  b[6] = (uint8_t)initial_informations.remote_connection_address.GetAddressType();
+  memcpy(a, initial_informations.my_connection_address.GetAddress().address, 6);
+  a[6] = (uint8_t)initial_informations.my_connection_address.GetAddressType();
+
+  Octet16 ltk, mac_key;
+  crypto_toolbox::f5(dhkey.data(), Na, Nb, a, b, &mac_key, &ltk);
+
+  PairingRequestView preqv = PairingRequestView::Create(pairing_request);
+  PairingResponseView prspv = PairingResponseView::Create(pairing_response);
+
+  preqv.IsValid();
+  prspv.IsValid();
+  std::array<uint8_t, 3> iocapA{static_cast<uint8_t>(preqv.GetIoCapability()),
+                                static_cast<uint8_t>(preqv.GetOobDataFlag()), preqv.GetAuthReq()};
+  std::array<uint8_t, 3> iocapB{static_cast<uint8_t>(prspv.GetIoCapability()),
+                                static_cast<uint8_t>(prspv.GetOobDataFlag()), prspv.GetAuthReq()};
+
+  Octet16 Ea = crypto_toolbox::f6(mac_key, Na, Nb, rb, iocapA.data(), a, b);
+  Octet16 Eb = crypto_toolbox::f6(mac_key, Nb, Na, ra, iocapB.data(), b, a);
+
+  EXPECT_TRUE(WaitForOutgoingL2capPacket());
+  EXPECT_EQ(Code::PAIRING_DH_KEY_CHECK, outgoing_l2cap_packet_->GetCode());
+  auto pdhkcv = PairingDhKeyCheckView::Create(outgoing_l2cap_packet_.value());
+  pdhkcv.IsValid();
+  EXPECT_EQ(pdhkcv.GetDhKeyCheck(), Ea);
+
+  pairing_handler->OnCommandView(BuilderToView(PairingDhKeyCheckBuilder::Create(Eb)));
+
+  // Phase 2 finished
+  // We don't care for the rest of the flow, let it die.
+}
+
+InitialInformations initial_informations_trsi{
+    .my_role = hci::Role::MASTER,
+    .my_connection_address = hci::AddressWithType(),
+
+    .myPairingCapabilities = {.io_capability = IoCapability::NO_INPUT_NO_OUTPUT,
+                              .oob_data_flag = OobDataFlag::NOT_PRESENT,
+                              .auth_req = AuthReqMaskBondingFlag | AuthReqMaskMitm | AuthReqMaskSc,
+                              .maximum_encryption_key_size = 16,
+                              .initiator_key_distribution = 0x03,
+                              .responder_key_distribution = 0x03},
+
+    .remotely_initiated = true,
+    .remote_connection_address = hci::AddressWithType(),
+    .ui_handler = &uiMock,
+    .le_security_interface = &leSecurityMock,
+    .OnPairingFinished = OnPairingFinished,
+};
+
+/* This test verifies that when remote slave device sends security request , and user
+ * does accept the prompt, we do send pairing request */
+TEST_F(PairingHandlerUnitTest, test_remote_slave_initiating) {
+  initial_informations_trsi.proper_l2cap_interface = up_buffer_.get();
+  initial_informations_trsi.l2cap_handler = handler_;
+
+  std::unique_ptr<PairingHandlerLe> pairing_handler =
+      std::make_unique<PairingHandlerLe>(PairingHandlerLe::ACCEPT_PROMPT, initial_informations_trsi);
+
+  // Simulate user accepting the pairing in UI
+  pairing_handler->OnUiAction(PairingEvent::PAIRING_ACCEPTED, 0x01 /* Non-zero value means success */);
+
+  EXPECT_TRUE(WaitForOutgoingL2capPacket());
+  EXPECT_EQ(Code::PAIRING_REQUEST, outgoing_l2cap_packet_->GetCode());
+
+  // We don't care for the rest of the flow, let it die.
+  pairing_handler.reset();
+}
+
+InitialInformations initial_informations_trmi{
+    .my_role = hci::Role::SLAVE,
+    .my_connection_address = hci::AddressWithType(),
+
+    .myPairingCapabilities = {.io_capability = IoCapability::NO_INPUT_NO_OUTPUT,
+                              .oob_data_flag = OobDataFlag::NOT_PRESENT,
+                              .auth_req = AuthReqMaskBondingFlag | AuthReqMaskMitm | AuthReqMaskSc,
+                              .maximum_encryption_key_size = 16,
+                              .initiator_key_distribution = 0x03,
+                              .responder_key_distribution = 0x03},
+
+    .remotely_initiated = true,
+    .remote_connection_address = hci::AddressWithType(),
+    .pairing_request = PairingRequestView::Create(BuilderToView(
+        PairingRequestBuilder::Create(IoCapability::NO_INPUT_NO_OUTPUT, OobDataFlag::NOT_PRESENT,
+                                      AuthReqMaskBondingFlag | AuthReqMaskMitm | AuthReqMaskSc, 16, 0x03, 0x03))),
+    .ui_handler = &uiMock,
+    .le_security_interface = &leSecurityMock,
+
+    .OnPairingFinished = OnPairingFinished,
+};
+
+/* This test verifies that when remote device sends pairing request, and user does accept the prompt, we do send proper
+ * reply back */
+TEST_F(PairingHandlerUnitTest, test_remote_master_initiating) {
+  initial_informations_trmi.proper_l2cap_interface = up_buffer_.get();
+  initial_informations_trmi.l2cap_handler = handler_;
+
+  std::unique_ptr<PairingHandlerLe> pairing_handler =
+      std::make_unique<PairingHandlerLe>(PairingHandlerLe::ACCEPT_PROMPT, initial_informations_trmi);
+
+  // Simulate user accepting the pairing in UI
+  pairing_handler->OnUiAction(PairingEvent::PAIRING_ACCEPTED, 0x01 /* Non-zero value means success */);
+
+  EXPECT_TRUE(WaitForOutgoingL2capPacket());
+  EXPECT_EQ(Code::PAIRING_RESPONSE, outgoing_l2cap_packet_->GetCode());
+  // Phase 1 finished.
+
+  // We don't care for the rest of the flow, it's handled in in other tests. let it die.
+  pairing_handler.reset();
+}
+
+}  // namespace security
+}  // namespace bluetooth
diff --git a/gd/security/record/security_record.h b/gd/security/record/security_record.h
new file mode 100644
index 0000000..0c78113
--- /dev/null
+++ b/gd/security/record/security_record.h
@@ -0,0 +1,60 @@
+/******************************************************************************
+ *
+ *  Copyright 2019 The Android Open Source Project
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at:
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ ******************************************************************************/
+
+#pragma once
+
+#include <memory>
+
+#include "hci/device.h"
+
+namespace bluetooth {
+namespace security {
+namespace record {
+
+enum BondState { NOT_BONDED, PAIRING, BONDED };
+
+class SecurityRecord {
+ public:
+  SecurityRecord(std::shared_ptr<hci::Device> device) : device_(device), state_(NOT_BONDED) {}
+
+  /**
+   * Returns true if the device is bonded to another device
+   */
+  bool IsBonded() {
+    return state_ == BONDED;
+  }
+
+  /**
+   * Returns true if a device is currently pairing to another device
+   */
+  bool IsPairing() {
+    return state_ == PAIRING;
+  }
+
+  std::shared_ptr<hci::Device> GetDevice() {
+    return device_;
+  }
+
+ private:
+  const std::shared_ptr<hci::Device> device_;
+  BondState state_;
+};
+
+}  // namespace record
+}  // namespace security
+}  // namespace bluetooth
diff --git a/gd/security/security_manager.cc b/gd/security/security_manager.cc
new file mode 100644
index 0000000..9a7df85
--- /dev/null
+++ b/gd/security/security_manager.cc
@@ -0,0 +1,57 @@
+/******************************************************************************
+ *
+ *  Copyright 2019 The Android Open Source Project
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at:
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ ******************************************************************************/
+#include "security_manager.h"
+
+#include "os/log.h"
+
+using namespace bluetooth::security;
+
+void SecurityManager::Init() {
+  security_handler_->Post(
+      common::BindOnce(&internal::SecurityManagerImpl::Init, common::Unretained(security_manager_impl_)));
+}
+
+void SecurityManager::CreateBond(std::shared_ptr<hci::ClassicDevice> device) {
+  security_handler_->Post(common::BindOnce(&internal::SecurityManagerImpl::CreateBond,
+                                           common::Unretained(security_manager_impl_),
+                                           std::forward<std::shared_ptr<hci::ClassicDevice>>(device)));
+}
+
+void SecurityManager::CancelBond(std::shared_ptr<hci::ClassicDevice> device) {
+  security_handler_->Post(common::BindOnce(&internal::SecurityManagerImpl::CancelBond,
+                                           common::Unretained(security_manager_impl_),
+                                           std::forward<std::shared_ptr<hci::ClassicDevice>>(device)));
+}
+
+void SecurityManager::RemoveBond(std::shared_ptr<hci::ClassicDevice> device) {
+  security_handler_->Post(common::BindOnce(&internal::SecurityManagerImpl::RemoveBond,
+                                           common::Unretained(security_manager_impl_),
+                                           std::forward<std::shared_ptr<hci::ClassicDevice>>(device)));
+}
+
+void SecurityManager::RegisterCallbackListener(internal::ISecurityManagerListener* listener) {
+  security_handler_->Post(common::BindOnce(&internal::SecurityManagerImpl::RegisterCallbackListener,
+                                           common::Unretained(security_manager_impl_),
+                                           std::forward<internal::ISecurityManagerListener*>(listener)));
+}
+
+void SecurityManager::UnregisterCallbackListener(internal::ISecurityManagerListener* listener) {
+  security_handler_->Post(common::BindOnce(&internal::SecurityManagerImpl::UnregisterCallbackListener,
+                                           common::Unretained(security_manager_impl_),
+                                           std::forward<internal::ISecurityManagerListener*>(listener)));
+}
diff --git a/gd/security/security_manager.h b/gd/security/security_manager.h
new file mode 100644
index 0000000..bc09c00
--- /dev/null
+++ b/gd/security/security_manager.h
@@ -0,0 +1,90 @@
+/******************************************************************************
+ *
+ *  Copyright 2019 The Android Open Source Project
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at:
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ ******************************************************************************/
+
+#pragma once
+
+#include <memory>
+#include <vector>
+
+#include "hci/device.h"
+#include "hci/device_database.h"
+#include "security/internal/security_manager_impl.h"
+
+namespace bluetooth {
+namespace security {
+
+/**
+ * Manages the security attributes, pairing, bonding of devices, and the
+ * encryption/decryption of communications.
+ */
+class SecurityManager {
+ public:
+  friend class SecurityModule;
+
+  /**
+   * Initialize the security record map from an internal device database.
+   */
+  void Init();
+
+  /**
+   * Checks the device for existing bond, if not bonded, initiates pairing.
+   *
+   * @param device pointer to device we want to bond with
+   */
+  void CreateBond(std::shared_ptr<hci::ClassicDevice> device);
+
+  /**
+   * Cancels the pairing process for this device.
+   *
+   * @param device pointer to device with which we want to cancel our bond
+   */
+  void CancelBond(std::shared_ptr<bluetooth::hci::ClassicDevice> device);
+
+  /**
+   * Disassociates the device and removes the persistent LTK
+   *
+   * @param device pointer to device we want to forget
+   */
+  void RemoveBond(std::shared_ptr<bluetooth::hci::ClassicDevice> device);
+
+  /**
+   * Register to listen for callback events from SecurityManager
+   *
+   * @param listener ISecurityManagerListener instance to handle callbacks
+   */
+  void RegisterCallbackListener(internal::ISecurityManagerListener* listener);
+
+  /**
+   * Unregister listener for callback events from SecurityManager
+   *
+   * @param listener ISecurityManagerListener instance to unregister
+   */
+  void UnregisterCallbackListener(internal::ISecurityManagerListener* listener);
+
+ protected:
+  SecurityManager(os::Handler* security_handler, internal::SecurityManagerImpl* security_manager_impl)
+      : security_handler_(security_handler), security_manager_impl_(security_manager_impl) {}
+
+ private:
+  os::Handler* security_handler_ = nullptr;
+  internal::SecurityManagerImpl* security_manager_impl_;
+  DISALLOW_COPY_AND_ASSIGN(SecurityManager);
+};
+
+}  // namespace security
+}  // namespace bluetooth
diff --git a/gd/security/security_module.cc b/gd/security/security_module.cc
new file mode 100644
index 0000000..e1d01d7
--- /dev/null
+++ b/gd/security/security_module.cc
@@ -0,0 +1,71 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#define LOG_TAG "security"
+
+#include <memory>
+#include "module.h"
+#include "os/handler.h"
+#include "os/log.h"
+
+#include "hci/hci_layer.h"
+#include "l2cap/le/l2cap_le_module.h"
+#include "security/channel/security_manager_channel.h"
+#include "security/internal/security_manager_impl.h"
+#include "security/security_module.h"
+
+namespace bluetooth {
+namespace security {
+
+const ModuleFactory SecurityModule::Factory = ModuleFactory([]() { return new SecurityModule(); });
+
+struct SecurityModule::impl {
+  impl(os::Handler* security_handler, l2cap::le::L2capLeModule* l2cap_le_module,
+       l2cap::classic::L2capClassicModule* l2cap_classic_module, hci::HciLayer* hci_layer)
+      : security_handler_(security_handler), l2cap_le_module_(l2cap_le_module),
+        l2cap_classic_module_(l2cap_classic_module),
+        security_manager_channel_(new channel::SecurityManagerChannel(security_handler_, hci_layer)) {}
+
+  os::Handler* security_handler_;
+  l2cap::le::L2capLeModule* l2cap_le_module_;
+  l2cap::classic::L2capClassicModule* l2cap_classic_module_;
+  channel::SecurityManagerChannel* security_manager_channel_;
+  internal::SecurityManagerImpl security_manager_impl{security_handler_, l2cap_le_module_, l2cap_classic_module_,
+                                                      security_manager_channel_};
+};
+
+void SecurityModule::ListDependencies(ModuleList* list) {
+  list->add<l2cap::le::L2capLeModule>();
+  list->add<l2cap::classic::L2capClassicModule>();
+  list->add<hci::HciLayer>();
+}
+
+void SecurityModule::Start() {
+  pimpl_ = std::make_unique<impl>(GetHandler(), GetDependency<l2cap::le::L2capLeModule>(),
+                                  GetDependency<l2cap::classic::L2capClassicModule>(), GetDependency<hci::HciLayer>());
+}
+
+void SecurityModule::Stop() {
+  pimpl_.reset();
+}
+
+std::unique_ptr<SecurityManager> SecurityModule::GetSecurityManager() {
+  return std::unique_ptr<SecurityManager>(
+      new SecurityManager(pimpl_->security_handler_, &pimpl_->security_manager_impl));
+}
+
+}  // namespace security
+}  // namespace bluetooth
\ No newline at end of file
diff --git a/gd/security/security_module.h b/gd/security/security_module.h
new file mode 100644
index 0000000..04f85c0
--- /dev/null
+++ b/gd/security/security_module.h
@@ -0,0 +1,52 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+#pragma once
+
+#include <memory>
+
+#include "module.h"
+#include "security/security_manager.h"
+
+namespace bluetooth {
+namespace security {
+
+class SecurityModule : public bluetooth::Module {
+ public:
+  SecurityModule() = default;
+  ~SecurityModule() = default;
+
+  /**
+   * Get the api to the SecurityManager
+   */
+  std::unique_ptr<SecurityManager> GetSecurityManager();
+
+  static const ModuleFactory Factory;
+
+ protected:
+  void ListDependencies(ModuleList* list) override;
+
+  void Start() override;
+
+  void Stop() override;
+
+ private:
+  struct impl;
+  std::unique_ptr<impl> pimpl_;
+  DISALLOW_COPY_AND_ASSIGN(SecurityModule);
+};
+
+}  // namespace security
+}  // namespace bluetooth
diff --git a/gd/smp/smp_packets.pdl b/gd/security/smp_packets.pdl
similarity index 73%
rename from gd/smp/smp_packets.pdl
rename to gd/security/smp_packets.pdl
index 4229168..69269dd 100644
--- a/gd/smp/smp_packets.pdl
+++ b/gd/security/smp_packets.pdl
@@ -42,33 +42,14 @@
   BONDING = 1,
 }
 
-group AuthReq {
-  bonding_flags : BondingFlags,
-  mitm : 1, // Man-in-the-middle protection required
-  sc : 1, // Secure Connections
-  keypress : 1,  // Only used in Passkey Entry
-  ct2 : 1, // Support for the h7 function.
-  _reserved_ : 2,
-}
-
 group PairingInfo {
   io_capability : IoCapability,
   oob_data_flag : OobDataFlag,
-  AuthReq,
+  auth_req: 8,
   maximum_encryption_key_size : 5, // 7 - 16
   _reserved_ : 3,
-  // InitiatorKeyDistribution
-  initiator_enc_key : 1,
-  initiator_id_key : 1,
-  initiator_sign_key : 1,
-  initiator_link_key : 1,
-  _reserved_ : 4,
-  // ResponderKeyDistribution
-  responder_enc_key : 1,
-  responder_id_key : 1,
-  responder_sign_key : 1,
-  responder_link_key : 1,
-  _reserved_ : 4,
+  initiator_key_distribution : 8,
+  responder_key_distribution : 8,
 }
 
 packet PairingRequest : Command (code = PAIRING_REQUEST) {
@@ -80,13 +61,11 @@
 }
 
 packet PairingConfirm : Command (code = PAIRING_CONFIRM) {
-//  confirm_value : 8[16],  // Initiating device sends Mconfirm, responding device sends Sconfirm
-  _payload_,
+  confirm_value : 8[16],  // Initiating device sends Mconfirm, responding device sends Sconfirm
 }
 
 packet PairingRandom : Command (code = PAIRING_RANDOM) {
-//  random_value : 8[16],  // Initiating device sends Mrand, responding device sends Srand
-  _payload_,
+  random_value : 8[16],  // Initiating device sends Mrand, responding device sends Srand
 }
 
 enum PairingFailedReason : 8 {
@@ -111,18 +90,16 @@
 }
 
 packet EncryptionInformation : Command (code = ENCRYPTION_INFORMATION) {
-  // long_term_key : 8[16],
-  _payload_,
+ long_term_key : 8[16],
 }
 
 packet MasterIdentification : Command (code = MASTER_IDENTIFICATION) {
   ediv : 16,
-  rand : 64,
+  rand : 8[8],
 }
 
 packet IdentityInformation : Command (code = IDENTITY_INFORMATION) {
-//  identity_resolving_key : 8[16],
-  _payload_,
+  identity_resolving_key : 8[16],
 }
 
 enum AddrType : 8 {
@@ -136,23 +113,20 @@
 }
 
 packet SigningInformation : Command (code = SIGNING_INFORMATION) {
-//  signature_key : 8[16],
-  _payload_,
+  signature_key : 8[16],
 }
 
 packet SecurityRequest : Command (code = SECURITY_REQUEST) {
-  AuthReq,
+  auth_req: 8,
 }
 
 packet PairingPublicKey : Command (code = PAIRING_PUBLIC_KEY) {
-//  public_key_x : 8[32],
-//  public_key_y : 8[32],
-  _payload_,
+  public_key_x : 8[32],
+  public_key_y : 8[32],
 }
 
 packet PairingDhKeyCheck : Command (code = PAIRING_DH_KEY_CHECK) {
-//  dh_key_check : 8[16],
-  _payload_,
+  dh_key_check : 8[16],
 }
 
 enum KeypressNotificationType : 8 {
diff --git a/gd/security/test/fake_hci_layer.h b/gd/security/test/fake_hci_layer.h
new file mode 100644
index 0000000..310a75c
--- /dev/null
+++ b/gd/security/test/fake_hci_layer.h
@@ -0,0 +1,115 @@
+/******************************************************************************
+ *
+ *  Copyright 2019 The Android Open Source Project
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at:
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ ******************************************************************************/
+
+#include "common/bind.h"
+#include "hci/hci_layer.h"
+
+namespace bluetooth {
+namespace security {
+
+using common::OnceCallback;
+using hci::CommandCompleteView;
+using hci::CommandPacketBuilder;
+using hci::CommandStatusView;
+using hci::EventCode;
+using hci::EventPacketBuilder;
+using hci::EventPacketView;
+using hci::HciLayer;
+using os::Handler;
+
+namespace {
+
+PacketView<kLittleEndian> GetPacketView(std::unique_ptr<packet::BasePacketBuilder> packet) {
+  auto bytes = std::make_shared<std::vector<uint8_t>>();
+  BitInserter i(*bytes);
+  bytes->reserve(packet->size());
+  packet->Serialize(i);
+  return packet::PacketView<packet::kLittleEndian>(bytes);
+}
+
+class CommandQueueEntry {
+ public:
+  CommandQueueEntry(std::unique_ptr<CommandPacketBuilder> command_packet,
+                    OnceCallback<void(CommandCompleteView)> on_complete_function, Handler* handler)
+      : command(std::move(command_packet)), waiting_for_status_(false), on_complete(std::move(on_complete_function)),
+        caller_handler(handler) {}
+
+  CommandQueueEntry(std::unique_ptr<CommandPacketBuilder> command_packet,
+                    OnceCallback<void(CommandStatusView)> on_status_function, Handler* handler)
+      : command(std::move(command_packet)), waiting_for_status_(true), on_status(std::move(on_status_function)),
+        caller_handler(handler) {}
+
+  std::unique_ptr<CommandPacketBuilder> command;
+  bool waiting_for_status_;
+  OnceCallback<void(CommandStatusView)> on_status;
+  OnceCallback<void(CommandCompleteView)> on_complete;
+  Handler* caller_handler;
+};
+
+}  // namespace
+
+class FakeHciLayer : public HciLayer {
+ public:
+  void EnqueueCommand(std::unique_ptr<CommandPacketBuilder> command, OnceCallback<void(CommandStatusView)> on_status,
+                      Handler* handler) override {
+    auto command_queue_entry = std::make_unique<CommandQueueEntry>(std::move(command), std::move(on_status), handler);
+    command_queue_.push(std::move(command_queue_entry));
+  }
+
+  void EnqueueCommand(std::unique_ptr<CommandPacketBuilder> command,
+                      OnceCallback<void(CommandCompleteView)> on_complete, Handler* handler) override {
+    auto command_queue_entry = std::make_unique<CommandQueueEntry>(std::move(command), std::move(on_complete), handler);
+    command_queue_.push(std::move(command_queue_entry));
+  }
+
+  std::unique_ptr<CommandQueueEntry> GetLastCommand() {
+    EXPECT_FALSE(command_queue_.empty());
+    auto last = std::move(command_queue_.front());
+    command_queue_.pop();
+    return last;
+  }
+
+  void RegisterEventHandler(EventCode event_code, common::Callback<void(EventPacketView)> event_handler,
+                            Handler* handler) override {
+    registered_events_[event_code] = event_handler;
+  }
+
+  void UnregisterEventHandler(EventCode event_code) override {
+    registered_events_.erase(event_code);
+  }
+
+  void IncomingEvent(std::unique_ptr<EventPacketBuilder> event_builder) {
+    auto packet = GetPacketView(std::move(event_builder));
+    EventPacketView event = EventPacketView::Create(packet);
+    EXPECT_TRUE(event.IsValid());
+    EventCode event_code = event.GetEventCode();
+    EXPECT_TRUE(registered_events_.find(event_code) != registered_events_.end());
+    registered_events_[event_code].Run(event);
+  }
+
+  void ListDependencies(ModuleList* list) override {}
+  void Start() override {}
+  void Stop() override {}
+
+ private:
+  std::map<EventCode, common::Callback<void(EventPacketView)>> registered_events_;
+  std::queue<std::unique_ptr<CommandQueueEntry>> command_queue_;
+};
+
+}  // namespace security
+}  // namespace bluetooth
diff --git a/gd/security/test/fake_l2cap_test.cc b/gd/security/test/fake_l2cap_test.cc
new file mode 100644
index 0000000..2d885e7
--- /dev/null
+++ b/gd/security/test/fake_l2cap_test.cc
@@ -0,0 +1,131 @@
+/******************************************************************************
+ *
+ *  Copyright 2019 The Android Open Source Project
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at:
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ ******************************************************************************/
+
+#include <gmock/gmock.h>
+#include <gtest/gtest.h>
+
+#include <memory>
+
+#include "hci/le_security_interface.h"
+#include "packet/raw_builder.h"
+#include "security/pairing_handler_le.h"
+#include "security/test/mocks.h"
+
+#include "os/handler.h"
+#include "os/queue.h"
+#include "os/thread.h"
+
+using namespace std::chrono_literals;
+using testing::_;
+using testing::Invoke;
+using testing::InvokeWithoutArgs;
+using testing::Matcher;
+using testing::SaveArg;
+
+using bluetooth::hci::CommandCompleteView;
+using bluetooth::hci::CommandStatusView;
+using bluetooth::hci::EncryptionChangeBuilder;
+using bluetooth::hci::EncryptionEnabled;
+using bluetooth::hci::ErrorCode;
+using bluetooth::hci::EventPacketBuilder;
+using bluetooth::hci::EventPacketView;
+using bluetooth::hci::LeSecurityCommandBuilder;
+
+namespace bluetooth {
+namespace security {
+
+namespace {
+
+template <class T>
+PacketView<kLittleEndian> GetPacketView(std::unique_ptr<T> packet) {
+  auto bytes = std::make_shared<std::vector<uint8_t>>();
+  BitInserter i(*bytes);
+  bytes->reserve(packet->size());
+  packet->Serialize(i);
+  return packet::PacketView<packet::kLittleEndian>(bytes);
+}
+
+void sync_handler(os::Handler* handler) {
+  std::promise<void> promise;
+  auto future = promise.get_future();
+  handler->Post(common::BindOnce(&std::promise<void>::set_value, common::Unretained(&promise)));
+  auto status = future.wait_for(std::chrono::milliseconds(3));
+  EXPECT_EQ(status, std::future_status::ready);
+}
+}  // namespace
+
+class FakeL2capTest : public testing::Test {
+ protected:
+  void SetUp() {}
+
+  void TearDown() {}
+
+ public:
+};
+
+void my_enqueue_callback() {
+  LOG_INFO("packet ready for dequeue!");
+}
+
+/* This test verifies that Just Works pairing flow works.
+ * Both simulated devices specify capabilities as NO_INPUT_NO_OUTPUT, and secure connecitons support */
+TEST_F(FakeL2capTest, test_bidi_queue_example) {
+  os::Thread* thread_ = new os::Thread("test_thread", os::Thread::Priority::NORMAL);
+  os::Handler* handler_ = new os::Handler(thread_);
+
+  common::BidiQueue<packet::BasePacketBuilder, packet::PacketView<packet::kLittleEndian>> bidi_queue{10};
+
+  os::EnqueueBuffer<packet::BasePacketBuilder> enqueue_buffer{bidi_queue.GetDownEnd()};
+
+  // This is test packet we are sending down the queue to the other end;
+  auto test_packet = EncryptionChangeBuilder::Create(ErrorCode::SUCCESS, 0x0020, EncryptionEnabled::ON);
+
+  // send the packet through the queue
+  enqueue_buffer.Enqueue(std::move(test_packet), handler_);
+
+  // give queue some time to push the packet through
+  sync_handler(handler_);
+
+  // packet is through the queue, receive it on the other end.
+  auto test_packet_from_other_end = bidi_queue.GetUpEnd()->TryDequeue();
+
+  EXPECT_TRUE(test_packet_from_other_end != nullptr);
+
+  // This is how we receive data
+  os::EnqueueBuffer<packet::PacketView<packet::kLittleEndian>> up_end_enqueue_buffer{bidi_queue.GetUpEnd()};
+  bidi_queue.GetDownEnd()->RegisterDequeue(handler_, common::Bind(&my_enqueue_callback));
+
+  auto packet_one = std::make_unique<packet::RawBuilder>();
+  packet_one->AddOctets({1, 2, 3});
+
+  up_end_enqueue_buffer.Enqueue(std::make_unique<PacketView<kLittleEndian>>(GetPacketView(std::move(packet_one))),
+                                handler_);
+
+  sync_handler(handler_);
+
+  auto other_end_packet = bidi_queue.GetDownEnd()->TryDequeue();
+  EXPECT_TRUE(other_end_packet != nullptr);
+
+  bidi_queue.GetDownEnd()->UnregisterDequeue();
+  handler_->Clear();
+  delete handler_;
+  delete thread_;
+}
+
+}  // namespace security
+}  // namespace bluetooth
\ No newline at end of file
diff --git a/gd/security/test/mocks.h b/gd/security/test/mocks.h
new file mode 100644
index 0000000..812c9a1
--- /dev/null
+++ b/gd/security/test/mocks.h
@@ -0,0 +1,56 @@
+/******************************************************************************
+ *
+ *  Copyright 2019 The Android Open Source Project
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at:
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ ******************************************************************************/
+
+#pragma once
+
+#include <gmock/gmock.h>
+
+#include "hci/address.h"
+#include "hci/le_security_interface.h"
+#include "security/ui.h"
+
+namespace bluetooth {
+namespace security {
+
+class UIMock : public UI {
+ public:
+  UIMock() {}
+  ~UIMock() override = default;
+
+  MOCK_METHOD2(DisplayPairingPrompt, void(const bluetooth::hci::AddressWithType&, std::string&));
+  MOCK_METHOD1(CancelPairingPrompt, void(const bluetooth::hci::AddressWithType&));
+  MOCK_METHOD1(DisplayConfirmValue, void(uint32_t));
+  MOCK_METHOD0(DisplayEnterPasskeyDialog, void());
+  MOCK_METHOD1(DisplayPasskey, void(uint32_t));
+
+ private:
+  DISALLOW_COPY_AND_ASSIGN(UIMock);
+};
+
+class LeSecurityInterfaceMock : public hci::LeSecurityInterface {
+ public:
+  MOCK_METHOD3(EnqueueCommand,
+               void(std::unique_ptr<hci::LeSecurityCommandBuilder> command,
+                    common::OnceCallback<void(hci::CommandCompleteView)> on_complete, os::Handler* handler));
+  MOCK_METHOD3(EnqueueCommand,
+               void(std::unique_ptr<hci::LeSecurityCommandBuilder> command,
+                    common::OnceCallback<void(hci::CommandStatusView)> on_status, os::Handler* handler));
+};
+
+}  // namespace security
+}  // namespace bluetooth
\ No newline at end of file
diff --git a/gd/security/test/pairing_handler_le_pair_test.cc b/gd/security/test/pairing_handler_le_pair_test.cc
new file mode 100644
index 0000000..1bed89c
--- /dev/null
+++ b/gd/security/test/pairing_handler_le_pair_test.cc
@@ -0,0 +1,638 @@
+/******************************************************************************
+ *
+ *  Copyright 2019 The Android Open Source Project
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at:
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ ******************************************************************************/
+
+#include <gmock/gmock.h>
+#include <gtest/gtest.h>
+
+#include <memory>
+
+#include "common/testing/wired_pair_of_bidi_queues.h"
+#include "hci/le_security_interface.h"
+#include "packet/raw_builder.h"
+#include "security/pairing_handler_le.h"
+#include "security/test/mocks.h"
+
+using namespace std::chrono_literals;
+using testing::_;
+using testing::Invoke;
+using testing::InvokeWithoutArgs;
+using testing::Matcher;
+using testing::SaveArg;
+
+using bluetooth::hci::Address;
+using bluetooth::hci::AddressType;
+using bluetooth::hci::CommandCompleteView;
+using bluetooth::hci::CommandStatusView;
+using bluetooth::hci::EncryptionChangeBuilder;
+using bluetooth::hci::EncryptionEnabled;
+using bluetooth::hci::ErrorCode;
+using bluetooth::hci::EventPacketBuilder;
+using bluetooth::hci::EventPacketView;
+using bluetooth::hci::LeSecurityCommandBuilder;
+
+// run:
+// out/host/linux-x86/nativetest/bluetooth_test_gd/bluetooth_test_gd --gtest_filter=Pairing*
+// adb shell /data/nativetest/bluetooth_test_gd/bluetooth_test_gd  --gtest_filter=PairingHandlerPairTest.*
+// --gtest_repeat=10 --gtest_shuffle
+
+namespace bluetooth {
+namespace security {
+CommandView CommandBuilderToView(std::unique_ptr<BasePacketBuilder> builder) {
+  std::shared_ptr<std::vector<uint8_t>> packet_bytes = std::make_shared<std::vector<uint8_t>>();
+  BitInserter it(*packet_bytes);
+  builder->Serialize(it);
+  PacketView<kLittleEndian> packet_bytes_view(packet_bytes);
+  auto temp_cmd_view = CommandView::Create(packet_bytes_view);
+  return CommandView::Create(temp_cmd_view);
+}
+
+EventPacketView EventBuilderToView(std::unique_ptr<EventPacketBuilder> builder) {
+  std::shared_ptr<std::vector<uint8_t>> packet_bytes = std::make_shared<std::vector<uint8_t>>();
+  BitInserter it(*packet_bytes);
+  builder->Serialize(it);
+  PacketView<kLittleEndian> packet_bytes_view(packet_bytes);
+  auto temp_evt_view = EventPacketView::Create(packet_bytes_view);
+  return EventPacketView::Create(temp_evt_view);
+}
+}  // namespace security
+}  // namespace bluetooth
+
+namespace {
+
+constexpr uint16_t CONN_HANDLE_MASTER = 0x31, CONN_HANDLE_SLAVE = 0x32;
+std::unique_ptr<bluetooth::security::PairingHandlerLe> pairing_handler_a, pairing_handler_b;
+
+}  // namespace
+
+namespace bluetooth {
+namespace security {
+
+namespace {
+Address ADDRESS_MASTER{{0x26, 0x64, 0x76, 0x86, 0xab, 0xba}};
+AddressType ADDRESS_TYPE_MASTER = AddressType::RANDOM_DEVICE_ADDRESS;
+
+Address ADDRESS_SLAVE{{0x33, 0x58, 0x24, 0x76, 0x11, 0x89}};
+AddressType ADDRESS_TYPE_SLAVE = AddressType::RANDOM_DEVICE_ADDRESS;
+
+std::optional<PairingResultOrFailure> pairing_result_master;
+std::optional<PairingResultOrFailure> pairing_result_slave;
+
+void OnPairingFinishedMaster(PairingResultOrFailure r) {
+  pairing_result_master = r;
+  if (std::holds_alternative<PairingResult>(r)) {
+    LOG_INFO("pairing finished successfully with %s", std::get<PairingResult>(r).connection_address.ToString().c_str());
+  } else {
+    LOG_INFO("pairing with ... failed: %s", std::get<PairingFailure>(r).message.c_str());
+  }
+}
+
+void OnPairingFinishedSlave(PairingResultOrFailure r) {
+  pairing_result_slave = r;
+  if (std::holds_alternative<PairingResult>(r)) {
+    LOG_INFO("pairing finished successfully with %s", std::get<PairingResult>(r).connection_address.ToString().c_str());
+  } else {
+    LOG_INFO("pairing with ... failed: %s", std::get<PairingFailure>(r).message.c_str());
+  }
+}
+
+};  // namespace
+
+// We obtain this mutex when we start initializing the handlers, and relese it when both handlers are initialized
+std::mutex handlers_initialization_guard;
+
+class PairingHandlerPairTest : public testing::Test {
+  void dequeue_callback_master() {
+    auto packet_bytes_view = l2cap_->GetQueueAUpEnd()->TryDequeue();
+    if (!packet_bytes_view) LOG_ERROR("Received dequeue, but no data ready...");
+
+    auto temp_cmd_view = CommandView::Create(*packet_bytes_view);
+    if (!first_command_sent) {
+      first_command = std::make_unique<CommandView>(CommandView::Create(temp_cmd_view));
+      first_command_sent = true;
+      return;
+    }
+
+    if (!pairing_handler_a) LOG_ALWAYS_FATAL("Slave handler not initlized yet!");
+
+    pairing_handler_a->OnCommandView(CommandView::Create(temp_cmd_view));
+  }
+
+  void dequeue_callback_slave() {
+    auto packet_bytes_view = l2cap_->GetQueueBUpEnd()->TryDequeue();
+    if (!packet_bytes_view) LOG_ERROR("Received dequeue, but no data ready...");
+
+    auto temp_cmd_view = CommandView::Create(*packet_bytes_view);
+    if (!first_command_sent) {
+      first_command = std::make_unique<CommandView>(CommandView::Create(temp_cmd_view));
+      first_command_sent = true;
+      return;
+    }
+
+    if (!pairing_handler_b) LOG_ALWAYS_FATAL("Master handler not initlized yet!");
+
+    pairing_handler_b->OnCommandView(CommandView::Create(temp_cmd_view));
+  }
+
+ protected:
+  void SetUp() {
+    thread_ = new os::Thread("test_thread", os::Thread::Priority::NORMAL);
+    handler_ = new os::Handler(thread_);
+
+    l2cap_ = new common::testing::WiredPairOfL2capQueues(handler_);
+    // master sends it's packet into l2cap->down_buffer_b_
+    // slave sends it's packet into l2cap->down_buffer_a_
+    l2cap_->GetQueueAUpEnd()->RegisterDequeue(
+        handler_, common::Bind(&PairingHandlerPairTest::dequeue_callback_master, common::Unretained(this)));
+    l2cap_->GetQueueBUpEnd()->RegisterDequeue(
+        handler_, common::Bind(&PairingHandlerPairTest::dequeue_callback_slave, common::Unretained(this)));
+
+    up_buffer_a_ = std::make_unique<os::EnqueueBuffer<packet::BasePacketBuilder>>(l2cap_->GetQueueAUpEnd());
+    up_buffer_b_ = std::make_unique<os::EnqueueBuffer<packet::BasePacketBuilder>>(l2cap_->GetQueueBUpEnd());
+
+    master_setup = {
+        .my_role = hci::Role::MASTER,
+        .my_connection_address = {ADDRESS_MASTER, ADDRESS_TYPE_MASTER},
+
+        .myPairingCapabilities = {.io_capability = IoCapability::NO_INPUT_NO_OUTPUT,
+                                  .oob_data_flag = OobDataFlag::NOT_PRESENT,
+                                  .auth_req = AuthReqMaskBondingFlag | AuthReqMaskMitm | AuthReqMaskSc,
+                                  .maximum_encryption_key_size = 16,
+                                  .initiator_key_distribution = KeyMaskId | KeyMaskSign,
+                                  .responder_key_distribution = KeyMaskId | KeyMaskSign},
+
+        .remotely_initiated = false,
+        .connection_handle = CONN_HANDLE_MASTER,
+        .remote_connection_address = {ADDRESS_SLAVE, ADDRESS_TYPE_SLAVE},
+        .ui_handler = &master_ui_handler,
+        .le_security_interface = &master_le_security_mock,
+        .proper_l2cap_interface = up_buffer_a_.get(),
+        .l2cap_handler = handler_,
+        .OnPairingFinished = OnPairingFinishedMaster,
+    };
+
+    slave_setup = {
+        .my_role = hci::Role::SLAVE,
+
+        .my_connection_address = {ADDRESS_SLAVE, ADDRESS_TYPE_SLAVE},
+        .myPairingCapabilities = {.io_capability = IoCapability::NO_INPUT_NO_OUTPUT,
+                                  .oob_data_flag = OobDataFlag::NOT_PRESENT,
+                                  .auth_req = AuthReqMaskBondingFlag | AuthReqMaskMitm | AuthReqMaskSc,
+                                  .maximum_encryption_key_size = 16,
+                                  .initiator_key_distribution = KeyMaskId | KeyMaskSign,
+                                  .responder_key_distribution = KeyMaskId | KeyMaskSign},
+        .remotely_initiated = true,
+        .connection_handle = CONN_HANDLE_SLAVE,
+        .remote_connection_address = {ADDRESS_MASTER, ADDRESS_TYPE_MASTER},
+        .ui_handler = &slave_ui_handler,
+        .le_security_interface = &slave_le_security_mock,
+        .proper_l2cap_interface = up_buffer_b_.get(),
+        .l2cap_handler = handler_,
+        .OnPairingFinished = OnPairingFinishedSlave,
+    };
+
+    RecordSuccessfulEncryptionComplete();
+  }
+
+  void TearDown() {
+    ::testing::Mock::VerifyAndClearExpectations(&slave_ui_handler);
+    ::testing::Mock::VerifyAndClearExpectations(&master_ui_handler);
+    ::testing::Mock::VerifyAndClearExpectations(&slave_le_security_mock);
+    ::testing::Mock::VerifyAndClearExpectations(&master_le_security_mock);
+
+    pairing_handler_a.reset();
+    pairing_handler_b.reset();
+    pairing_result_master.reset();
+    pairing_result_slave.reset();
+
+    first_command_sent = false;
+    first_command.reset();
+
+    l2cap_->GetQueueAUpEnd()->UnregisterDequeue();
+    l2cap_->GetQueueBUpEnd()->UnregisterDequeue();
+
+    delete l2cap_;
+    handler_->Clear();
+    delete handler_;
+    delete thread_;
+  }
+
+  void RecordPairingPromptHandling(UIMock& ui_mock, std::unique_ptr<PairingHandlerLe>* handler) {
+    EXPECT_CALL(ui_mock, DisplayPairingPrompt(_, _)).Times(1).WillOnce(InvokeWithoutArgs([handler]() {
+      LOG_INFO("UI mock received pairing prompt");
+
+      {
+        // By grabbing the lock, we ensure initialization of both pairing handlers is finished.
+        std::lock_guard<std::mutex> lock(handlers_initialization_guard);
+      }
+
+      if (!(*handler)) LOG_ALWAYS_FATAL("handler not initalized yet!");
+      // Simulate user accepting the pairing in UI
+      (*handler)->OnUiAction(PairingEvent::PAIRING_ACCEPTED, 0x01 /* Non-zero value means success */);
+    }));
+  }
+
+  void RecordSuccessfulEncryptionComplete() {
+    // For now, all tests are succeeding to go through Encryption. Record that in the setup.
+    //  Once we test failure cases, move this to each test
+    EXPECT_CALL(master_le_security_mock,
+                EnqueueCommand(_, Matcher<common::OnceCallback<void(CommandStatusView)>>(_), _))
+        .Times(1)
+        .WillOnce([](std::unique_ptr<LeSecurityCommandBuilder> command,
+                     common::OnceCallback<void(CommandStatusView)> on_status, os::Handler* handler) {
+          // TODO: on_status.Run();
+
+          pairing_handler_a->OnHciEvent(EventBuilderToView(
+              EncryptionChangeBuilder::Create(ErrorCode::SUCCESS, CONN_HANDLE_MASTER, EncryptionEnabled::ON)));
+
+          pairing_handler_b->OnHciEvent(EventBuilderToView(
+              EncryptionChangeBuilder::Create(ErrorCode::SUCCESS, CONN_HANDLE_SLAVE, EncryptionEnabled::ON)));
+        });
+  }
+
+ public:
+  std::unique_ptr<bluetooth::security::CommandView> WaitFirstL2capCommand() {
+    while (!first_command_sent) {
+      std::this_thread::sleep_for(1ms);
+      LOG_INFO("waiting for first command...");
+    }
+
+    return std::move(first_command);
+  }
+
+  InitialInformations master_setup;
+  InitialInformations slave_setup;
+  UIMock master_ui_handler;
+  UIMock slave_ui_handler;
+  LeSecurityInterfaceMock master_le_security_mock;
+  LeSecurityInterfaceMock slave_le_security_mock;
+
+  uint16_t first_command_sent = false;
+  std::unique_ptr<bluetooth::security::CommandView> first_command;
+
+  os::Thread* thread_;
+  os::Handler* handler_;
+  common::testing::WiredPairOfL2capQueues* l2cap_;
+
+  std::unique_ptr<os::EnqueueBuffer<packet::BasePacketBuilder>> up_buffer_a_;
+  std::unique_ptr<os::EnqueueBuffer<packet::BasePacketBuilder>> up_buffer_b_;
+};
+
+/* This test verifies that Just Works pairing flow works.
+ * Both simulated devices specify capabilities as NO_INPUT_NO_OUTPUT, and secure connecitons support */
+TEST_F(PairingHandlerPairTest, test_secure_connections_just_works) {
+  master_setup.myPairingCapabilities.io_capability = IoCapability::NO_INPUT_NO_OUTPUT;
+  master_setup.myPairingCapabilities.oob_data_flag = OobDataFlag::NOT_PRESENT;
+  slave_setup.myPairingCapabilities.io_capability = IoCapability::NO_INPUT_NO_OUTPUT;
+  slave_setup.myPairingCapabilities.oob_data_flag = OobDataFlag::NOT_PRESENT;
+
+  {
+    std::unique_lock<std::mutex> lock(handlers_initialization_guard);
+
+    pairing_handler_a = std::make_unique<PairingHandlerLe>(PairingHandlerLe::PHASE1, master_setup);
+
+    auto first_pkt = WaitFirstL2capCommand();
+    slave_setup.pairing_request = PairingRequestView::Create(*first_pkt);
+
+    EXPECT_CALL(slave_ui_handler, DisplayPairingPrompt(_, _)).Times(1).WillOnce(InvokeWithoutArgs([] {
+      LOG_INFO("UI mock received pairing prompt");
+
+      {
+        // By grabbing the lock, we ensure initialization of both pairing handlers is finished.
+        std::lock_guard<std::mutex> lock(handlers_initialization_guard);
+      }
+
+      if (!pairing_handler_b) LOG_ALWAYS_FATAL("handler not initalized yet!");
+
+      // Simulate user accepting the pairing in UI
+      pairing_handler_b->OnUiAction(PairingEvent::PAIRING_ACCEPTED, 0x01 /* Non-zero value means success */);
+    }));
+
+    pairing_handler_b = std::make_unique<PairingHandlerLe>(PairingHandlerLe::PHASE1, slave_setup);
+  }
+
+  pairing_handler_a->WaitUntilPairingFinished();
+  pairing_handler_b->WaitUntilPairingFinished();
+
+  EXPECT_TRUE(std::holds_alternative<PairingResult>(pairing_result_master.value()));
+  EXPECT_TRUE(std::holds_alternative<PairingResult>(pairing_result_slave.value()));
+}
+
+TEST_F(PairingHandlerPairTest, test_secure_connections_just_works_slave_initiated) {
+  master_setup = {
+      .my_role = hci::Role::MASTER,
+      .my_connection_address = {ADDRESS_MASTER, ADDRESS_TYPE_MASTER},
+      .myPairingCapabilities = {.io_capability = IoCapability::NO_INPUT_NO_OUTPUT,
+                                .oob_data_flag = OobDataFlag::NOT_PRESENT,
+                                .auth_req = AuthReqMaskBondingFlag | AuthReqMaskMitm | AuthReqMaskSc,
+                                .maximum_encryption_key_size = 16,
+                                .initiator_key_distribution = KeyMaskId | KeyMaskSign,
+                                .responder_key_distribution = KeyMaskId | KeyMaskSign},
+      .remotely_initiated = true,
+      .connection_handle = CONN_HANDLE_MASTER,
+      .remote_connection_address = {ADDRESS_SLAVE, ADDRESS_TYPE_SLAVE},
+      .ui_handler = &master_ui_handler,
+      .le_security_interface = &master_le_security_mock,
+      .proper_l2cap_interface = up_buffer_a_.get(),
+      .l2cap_handler = handler_,
+      .OnPairingFinished = OnPairingFinishedMaster,
+  };
+
+  slave_setup = {
+      .my_role = hci::Role::SLAVE,
+      .my_connection_address = {ADDRESS_SLAVE, ADDRESS_TYPE_SLAVE},
+      .myPairingCapabilities = {.io_capability = IoCapability::NO_INPUT_NO_OUTPUT,
+                                .oob_data_flag = OobDataFlag::NOT_PRESENT,
+                                .auth_req = AuthReqMaskBondingFlag | AuthReqMaskMitm | AuthReqMaskSc,
+                                .maximum_encryption_key_size = 16,
+                                .initiator_key_distribution = KeyMaskId | KeyMaskSign,
+                                .responder_key_distribution = KeyMaskId | KeyMaskSign},
+      .remotely_initiated = false,
+      .connection_handle = CONN_HANDLE_SLAVE,
+      .remote_connection_address = {ADDRESS_MASTER, ADDRESS_TYPE_MASTER},
+      .ui_handler = &slave_ui_handler,
+      .le_security_interface = &slave_le_security_mock,
+      .proper_l2cap_interface = up_buffer_b_.get(),
+      .l2cap_handler = handler_,
+      .OnPairingFinished = OnPairingFinishedSlave,
+  };
+
+  std::unique_ptr<bluetooth::security::CommandView> first_pkt;
+  {
+    std::unique_lock<std::mutex> lock(handlers_initialization_guard);
+    pairing_handler_b = std::make_unique<PairingHandlerLe>(PairingHandlerLe::PHASE1, slave_setup);
+
+    first_pkt = WaitFirstL2capCommand();
+
+    EXPECT_CALL(master_ui_handler, DisplayPairingPrompt(_, _)).Times(1).WillOnce(InvokeWithoutArgs([&first_pkt, this] {
+      LOG_INFO("UI mock received pairing prompt");
+
+      {
+        // By grabbing the lock, we ensure initialization of both pairing handlers is finished.
+        std::lock_guard<std::mutex> lock(handlers_initialization_guard);
+      }
+      if (!pairing_handler_a) LOG_ALWAYS_FATAL("handler not initalized yet!");
+      // Simulate user accepting the pairing in UI
+      pairing_handler_a->OnUiAction(PairingEvent::PAIRING_ACCEPTED, 0x01 /* Non-zero value means success */);
+
+      // Send the first packet from the slave to master
+      auto view_to_packet = std::make_unique<packet::RawBuilder>();
+      view_to_packet->AddOctets(std::vector(first_pkt->begin(), first_pkt->end()));
+      up_buffer_b_->Enqueue(std::move(view_to_packet), handler_);
+    }));
+    pairing_handler_a = std::make_unique<PairingHandlerLe>(PairingHandlerLe::PHASE1, master_setup);
+  }
+
+  pairing_handler_a->WaitUntilPairingFinished();
+  pairing_handler_b->WaitUntilPairingFinished();
+
+  EXPECT_TRUE(std::holds_alternative<PairingResult>(pairing_result_master.value()));
+  EXPECT_TRUE(std::holds_alternative<PairingResult>(pairing_result_slave.value()));
+}
+
+TEST_F(PairingHandlerPairTest, test_secure_connections_numeric_comparison) {
+  master_setup.myPairingCapabilities.io_capability = IoCapability::DISPLAY_YES_NO;
+  master_setup.myPairingCapabilities.oob_data_flag = OobDataFlag::NOT_PRESENT;
+  master_setup.myPairingCapabilities.auth_req = AuthReqMaskBondingFlag | AuthReqMaskMitm | AuthReqMaskSc;
+
+  slave_setup.myPairingCapabilities.io_capability = IoCapability::DISPLAY_YES_NO;
+  slave_setup.myPairingCapabilities.oob_data_flag = OobDataFlag::NOT_PRESENT;
+  slave_setup.myPairingCapabilities.auth_req = AuthReqMaskBondingFlag | AuthReqMaskMitm | AuthReqMaskSc;
+
+  uint32_t num_value_slave = 0;
+  {
+    std::unique_lock<std::mutex> lock(handlers_initialization_guard);
+    // Initiator must be initialized after the responder.
+    pairing_handler_a = std::make_unique<PairingHandlerLe>(PairingHandlerLe::PHASE1, master_setup);
+
+    while (!first_command_sent) {
+      std::this_thread::sleep_for(1ms);
+      LOG_INFO("waiting for first command...");
+    }
+    slave_setup.pairing_request = PairingRequestView::Create(*first_command);
+
+    RecordPairingPromptHandling(slave_ui_handler, &pairing_handler_b);
+
+    EXPECT_CALL(slave_ui_handler, DisplayConfirmValue(_)).WillOnce(SaveArg<0>(&num_value_slave));
+    EXPECT_CALL(master_ui_handler, DisplayConfirmValue(_)).WillOnce(Invoke([&](uint32_t num_value) {
+      EXPECT_EQ(num_value_slave, num_value);
+      if (num_value_slave == num_value) {
+        pairing_handler_a->OnUiAction(PairingEvent::CONFIRM_YESNO, 0x01);
+        pairing_handler_b->OnUiAction(PairingEvent::CONFIRM_YESNO, 0x01);
+      }
+    }));
+
+    pairing_handler_b = std::make_unique<PairingHandlerLe>(PairingHandlerLe::PHASE1, slave_setup);
+  }
+  pairing_handler_a->WaitUntilPairingFinished();
+  pairing_handler_b->WaitUntilPairingFinished();
+
+  EXPECT_TRUE(std::holds_alternative<PairingResult>(pairing_result_master.value()));
+  EXPECT_TRUE(std::holds_alternative<PairingResult>(pairing_result_slave.value()));
+}
+
+TEST_F(PairingHandlerPairTest, test_secure_connections_passkey_entry) {
+  master_setup.myPairingCapabilities.io_capability = IoCapability::KEYBOARD_ONLY;
+  master_setup.myPairingCapabilities.oob_data_flag = OobDataFlag::NOT_PRESENT;
+  master_setup.myPairingCapabilities.auth_req = AuthReqMaskBondingFlag | AuthReqMaskMitm | AuthReqMaskSc;
+
+  slave_setup.myPairingCapabilities.io_capability = IoCapability::DISPLAY_ONLY;
+  slave_setup.myPairingCapabilities.oob_data_flag = OobDataFlag::NOT_PRESENT;
+  slave_setup.myPairingCapabilities.auth_req = AuthReqMaskBondingFlag | AuthReqMaskMitm | AuthReqMaskSc;
+
+  uint32_t passkey = std::numeric_limits<uint32_t>::max();
+  {
+    std::unique_lock<std::mutex> lock(handlers_initialization_guard);
+    pairing_handler_a = std::make_unique<PairingHandlerLe>(PairingHandlerLe::PHASE1, master_setup);
+
+    while (!first_command_sent) {
+      std::this_thread::sleep_for(1ms);
+      LOG_INFO("waiting for first command...");
+    }
+    slave_setup.pairing_request = PairingRequestView::Create(*first_command);
+
+    RecordPairingPromptHandling(slave_ui_handler, &pairing_handler_b);
+
+    EXPECT_CALL(slave_ui_handler, DisplayPasskey(_)).WillOnce(SaveArg<0>(&passkey));
+    EXPECT_CALL(master_ui_handler, DisplayEnterPasskeyDialog()).WillOnce(Invoke([&]() {
+      LOG_INFO("Passkey prompt displayed entering passkey: %08x", passkey);
+      std::this_thread::sleep_for(1ms);
+
+      // handle case where prompts are displayed in different order in the test!
+      if (passkey == std::numeric_limits<uint32_t>::max()) FAIL();
+
+      pairing_handler_a->OnUiAction(PairingEvent::PASSKEY, passkey);
+    }));
+
+    pairing_handler_b = std::make_unique<PairingHandlerLe>(PairingHandlerLe::PHASE1, slave_setup);
+  }
+  // Initiator must be initialized after the responder.
+  pairing_handler_a->WaitUntilPairingFinished();
+  pairing_handler_b->WaitUntilPairingFinished();
+
+  EXPECT_TRUE(std::holds_alternative<PairingResult>(pairing_result_master.value()));
+  EXPECT_TRUE(std::holds_alternative<PairingResult>(pairing_result_slave.value()));
+}
+
+TEST_F(PairingHandlerPairTest, test_secure_connections_out_of_band) {
+  master_setup.myPairingCapabilities.io_capability = IoCapability::KEYBOARD_ONLY;
+  master_setup.myPairingCapabilities.oob_data_flag = OobDataFlag::NOT_PRESENT;
+  master_setup.myPairingCapabilities.auth_req = AuthReqMaskBondingFlag | AuthReqMaskMitm | AuthReqMaskSc,
+
+  slave_setup.myPairingCapabilities.io_capability = IoCapability::DISPLAY_ONLY;
+  slave_setup.myPairingCapabilities.oob_data_flag = OobDataFlag::PRESENT;
+  slave_setup.myPairingCapabilities.auth_req = AuthReqMaskBondingFlag | AuthReqMaskMitm | AuthReqMaskSc,
+
+  master_setup.my_oob_data = std::make_optional<MyOobData>(PairingHandlerLe::GenerateOobData());
+  slave_setup.remote_oob_data =
+      std::make_optional<InitialInformations::out_of_band_data>(InitialInformations::out_of_band_data{
+          .le_sc_c = master_setup.my_oob_data->c,
+          .le_sc_r = master_setup.my_oob_data->r,
+      });
+
+  {
+    std::unique_lock<std::mutex> lock(handlers_initialization_guard);
+    pairing_handler_a = std::make_unique<PairingHandlerLe>(PairingHandlerLe::PHASE1, master_setup);
+    while (!first_command_sent) {
+      std::this_thread::sleep_for(1ms);
+      LOG_INFO("waiting for first command...");
+    }
+    slave_setup.pairing_request = PairingRequestView::Create(*first_command);
+
+    RecordPairingPromptHandling(slave_ui_handler, &pairing_handler_b);
+
+    pairing_handler_b = std::make_unique<PairingHandlerLe>(PairingHandlerLe::PHASE1, slave_setup);
+  }
+  pairing_handler_a->WaitUntilPairingFinished();
+  pairing_handler_b->WaitUntilPairingFinished();
+
+  EXPECT_TRUE(std::holds_alternative<PairingResult>(pairing_result_master.value()));
+  EXPECT_TRUE(std::holds_alternative<PairingResult>(pairing_result_slave.value()));
+}
+
+TEST_F(PairingHandlerPairTest, test_secure_connections_out_of_band_two_way) {
+  master_setup.myPairingCapabilities.io_capability = IoCapability::KEYBOARD_ONLY;
+  master_setup.myPairingCapabilities.oob_data_flag = OobDataFlag::PRESENT;
+  master_setup.myPairingCapabilities.auth_req = AuthReqMaskBondingFlag | AuthReqMaskMitm | AuthReqMaskSc,
+
+  slave_setup.myPairingCapabilities.io_capability = IoCapability::DISPLAY_ONLY;
+  slave_setup.myPairingCapabilities.oob_data_flag = OobDataFlag::PRESENT;
+  slave_setup.myPairingCapabilities.auth_req = AuthReqMaskBondingFlag | AuthReqMaskMitm | AuthReqMaskSc,
+
+  master_setup.my_oob_data = std::make_optional<MyOobData>(PairingHandlerLe::GenerateOobData());
+  slave_setup.remote_oob_data =
+      std::make_optional<InitialInformations::out_of_band_data>(InitialInformations::out_of_band_data{
+          .le_sc_c = master_setup.my_oob_data->c,
+          .le_sc_r = master_setup.my_oob_data->r,
+      });
+
+  slave_setup.my_oob_data = std::make_optional<MyOobData>(PairingHandlerLe::GenerateOobData());
+  master_setup.remote_oob_data =
+      std::make_optional<InitialInformations::out_of_band_data>(InitialInformations::out_of_band_data{
+          .le_sc_c = slave_setup.my_oob_data->c,
+          .le_sc_r = slave_setup.my_oob_data->r,
+      });
+
+  {
+    std::unique_lock<std::mutex> lock(handlers_initialization_guard);
+    pairing_handler_a = std::make_unique<PairingHandlerLe>(PairingHandlerLe::PHASE1, master_setup);
+    while (!first_command_sent) {
+      std::this_thread::sleep_for(1ms);
+      LOG_INFO("waiting for first command...");
+    }
+    slave_setup.pairing_request = PairingRequestView::Create(*first_command);
+
+    RecordPairingPromptHandling(slave_ui_handler, &pairing_handler_b);
+
+    pairing_handler_b = std::make_unique<PairingHandlerLe>(PairingHandlerLe::PHASE1, slave_setup);
+  }
+  pairing_handler_a->WaitUntilPairingFinished();
+  pairing_handler_b->WaitUntilPairingFinished();
+
+  EXPECT_TRUE(std::holds_alternative<PairingResult>(pairing_result_master.value()));
+  EXPECT_TRUE(std::holds_alternative<PairingResult>(pairing_result_slave.value()));
+}
+
+TEST_F(PairingHandlerPairTest, test_legacy_just_works) {
+  master_setup.myPairingCapabilities.io_capability = IoCapability::NO_INPUT_NO_OUTPUT;
+  master_setup.myPairingCapabilities.oob_data_flag = OobDataFlag::NOT_PRESENT;
+  master_setup.myPairingCapabilities.auth_req = AuthReqMaskBondingFlag | AuthReqMaskMitm,
+
+  slave_setup.myPairingCapabilities.io_capability = IoCapability::NO_INPUT_NO_OUTPUT;
+  slave_setup.myPairingCapabilities.oob_data_flag = OobDataFlag::NOT_PRESENT;
+  slave_setup.myPairingCapabilities.auth_req = AuthReqMaskBondingFlag | AuthReqMaskMitm;
+
+  {
+    std::unique_lock<std::mutex> lock(handlers_initialization_guard);
+    pairing_handler_a = std::make_unique<PairingHandlerLe>(PairingHandlerLe::PHASE1, master_setup);
+    while (!first_command_sent) {
+      std::this_thread::sleep_for(1ms);
+      LOG_INFO("waiting for first command...");
+    }
+    slave_setup.pairing_request = PairingRequestView::Create(*first_command);
+
+    RecordPairingPromptHandling(slave_ui_handler, &pairing_handler_b);
+
+    pairing_handler_b = std::make_unique<PairingHandlerLe>(PairingHandlerLe::PHASE1, slave_setup);
+  }
+  pairing_handler_a->WaitUntilPairingFinished();
+  pairing_handler_b->WaitUntilPairingFinished();
+
+  EXPECT_TRUE(std::holds_alternative<PairingResult>(pairing_result_master.value()));
+  EXPECT_TRUE(std::holds_alternative<PairingResult>(pairing_result_slave.value()));
+}
+
+TEST_F(PairingHandlerPairTest, test_legacy_passkey_entry) {
+  master_setup.myPairingCapabilities.io_capability = IoCapability::KEYBOARD_DISPLAY;
+  master_setup.myPairingCapabilities.oob_data_flag = OobDataFlag::NOT_PRESENT;
+  master_setup.myPairingCapabilities.auth_req = AuthReqMaskBondingFlag | AuthReqMaskMitm,
+
+  slave_setup.myPairingCapabilities.io_capability = IoCapability::KEYBOARD_ONLY;
+  slave_setup.myPairingCapabilities.oob_data_flag = OobDataFlag::NOT_PRESENT;
+  slave_setup.myPairingCapabilities.auth_req = AuthReqMaskBondingFlag | AuthReqMaskMitm;
+
+  {
+    std::unique_lock<std::mutex> lock(handlers_initialization_guard);
+    pairing_handler_a = std::make_unique<PairingHandlerLe>(PairingHandlerLe::PHASE1, master_setup);
+    while (!first_command_sent) {
+      std::this_thread::sleep_for(1ms);
+      LOG_INFO("waiting for first command...");
+    }
+    slave_setup.pairing_request = PairingRequestView::Create(*first_command);
+
+    RecordPairingPromptHandling(slave_ui_handler, &pairing_handler_b);
+
+    EXPECT_CALL(slave_ui_handler, DisplayEnterPasskeyDialog());
+    EXPECT_CALL(master_ui_handler, DisplayConfirmValue(_)).WillOnce(Invoke([&](uint32_t passkey) {
+      LOG_INFO("Passkey prompt displayed entering passkey: %08x", passkey);
+      std::this_thread::sleep_for(1ms);
+
+      // TODO: handle case where prompts are displayed in different order in the test!
+      pairing_handler_b->OnUiAction(PairingEvent::PASSKEY, passkey);
+    }));
+
+    pairing_handler_b = std::make_unique<PairingHandlerLe>(PairingHandlerLe::PHASE1, slave_setup);
+  }
+  pairing_handler_a->WaitUntilPairingFinished();
+  pairing_handler_b->WaitUntilPairingFinished();
+
+  EXPECT_TRUE(std::holds_alternative<PairingResult>(pairing_result_master.value()));
+  EXPECT_TRUE(std::holds_alternative<PairingResult>(pairing_result_slave.value()));
+}
+
+}  // namespace security
+}  // namespace bluetooth
diff --git a/gd/security/ui.h b/gd/security/ui.h
new file mode 100644
index 0000000..83041de
--- /dev/null
+++ b/gd/security/ui.h
@@ -0,0 +1,58 @@
+/******************************************************************************
+ *
+ *  Copyright 2019 The Android Open Source Project
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at:
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ ******************************************************************************/
+
+#pragma once
+
+#include "hci/address_with_type.h"
+
+// Through this interface we talk to the user, asking for confirmations/acceptance.
+class UI {
+ public:
+  virtual ~UI(){};
+
+  /* Remote device tries to initiate pairing, ask user to confirm */
+  virtual void DisplayPairingPrompt(const bluetooth::hci::AddressWithType& address, std::string& name) = 0;
+
+  /* Remove the pairing prompt from DisplayPairingPrompt, i.e. remote device disconnected, or some application requested
+   * bond with this device */
+  virtual void CancelPairingPrompt(const bluetooth::hci::AddressWithType& address) = 0;
+
+  /* Display value for Comprision */
+  virtual void DisplayConfirmValue(uint32_t numeric_value) = 0;
+
+  /* Display a dialog box that will let user enter the Passkey */
+  virtual void DisplayEnterPasskeyDialog() = 0;
+
+  /* Present the passkey value to the user */
+  virtual void DisplayPasskey(uint32_t passkey) = 0;
+};
+
+/* Through this interface, UI provides us with user choices. */
+class UICallbacks {
+ public:
+  virtual ~UICallbacks() = 0;
+
+  /* User accepted pairing prompt */
+  virtual void OnPairingPromptAccepted(const bluetooth::hci::Address& address) = 0;
+
+  /* User confirmed that displayed value matches the value on the other device */
+  virtual void OnConfirmYesNo(const bluetooth::hci::Address& address, bool conformed) = 0;
+
+  /* User typed the value displayed on the other device. This is either Passkey or the Confirm value */
+  virtual void OnPasskeyEntry(const bluetooth::hci::Address& address, uint32_t passkey) = 0;
+};
diff --git a/gd/shim/Android.bp b/gd/shim/Android.bp
new file mode 100644
index 0000000..4ef329d
--- /dev/null
+++ b/gd/shim/Android.bp
@@ -0,0 +1,21 @@
+filegroup {
+    name: "BluetoothShimSources",
+    srcs: [
+            "controller.cc",
+            "connectability.cc",
+            "discoverability.cc",
+            "hci_layer.cc",
+            "inquiry.cc",
+            "l2cap.cc",
+            "page.cc",
+            "stack.cc",
+    ],
+}
+
+filegroup {
+    name: "BluetoothShimTestSources",
+    srcs: [
+    ],
+}
+
+
diff --git a/gd/shim/connectability.cc b/gd/shim/connectability.cc
new file mode 100644
index 0000000..2b779fd
--- /dev/null
+++ b/gd/shim/connectability.cc
@@ -0,0 +1,69 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+#define LOG_TAG "bt_gd_shim"
+
+#include <memory>
+
+#include "common/bidi_queue.h"
+#include "hci/address.h"
+#include "hci/controller.h"
+#include "hci/hci_packets.h"
+#include "module.h"
+#include "neighbor/connectability.h"
+#include "os/handler.h"
+#include "os/log.h"
+#include "shim/connectability.h"
+
+namespace bluetooth {
+namespace shim {
+
+const ModuleFactory Connectability::Factory = ModuleFactory([]() { return new Connectability(); });
+
+struct Connectability::impl {
+  impl(neighbor::ConnectabilityModule* module) : module_(module) {}
+
+  neighbor::ConnectabilityModule* module_{nullptr};
+};
+
+void Connectability::StartConnectability() {
+  pimpl_->module_->StartConnectability();
+}
+
+void Connectability::StopConnectability() {
+  pimpl_->module_->StopConnectability();
+}
+
+bool Connectability::IsConnectable() const {
+  return pimpl_->module_->IsConnectable();
+}
+
+/**
+ * Module methods
+ */
+void Connectability::ListDependencies(ModuleList* list) {
+  list->add<neighbor::ConnectabilityModule>();
+}
+
+void Connectability::Start() {
+  pimpl_ = std::make_unique<impl>(GetDependency<neighbor::ConnectabilityModule>());
+}
+
+void Connectability::Stop() {
+  pimpl_.reset();
+}
+
+}  // namespace shim
+}  // namespace bluetooth
diff --git a/gd/shim/connectability.h b/gd/shim/connectability.h
new file mode 100644
index 0000000..780b5be
--- /dev/null
+++ b/gd/shim/connectability.h
@@ -0,0 +1,49 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+#pragma once
+
+#include <memory>
+
+#include "module.h"
+#include "shim/iconnectability.h"
+
+namespace bluetooth {
+namespace shim {
+
+class Connectability : public bluetooth::Module, public bluetooth::shim::IConnectability {
+ public:
+  void StartConnectability() override;
+  void StopConnectability() override;
+  bool IsConnectable() const override;
+
+  Connectability() = default;
+  ~Connectability() = default;
+
+  static const ModuleFactory Factory;
+
+ protected:
+  void ListDependencies(ModuleList* list) override;  // Module
+  void Start() override;                             // Module
+  void Stop() override;                              // Module
+
+ private:
+  struct impl;
+  std::unique_ptr<impl> pimpl_;
+  DISALLOW_COPY_AND_ASSIGN(Connectability);
+};
+
+}  // namespace shim
+}  // namespace bluetooth
diff --git a/gd/shim/controller.cc b/gd/shim/controller.cc
new file mode 100644
index 0000000..6b82bb6
--- /dev/null
+++ b/gd/shim/controller.cc
@@ -0,0 +1,109 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+#define LOG_TAG "bt_gd_shim"
+
+#include <memory>
+
+#include "common/bidi_queue.h"
+#include "hci/address.h"
+#include "hci/controller.h"
+#include "hci/hci_packets.h"
+#include "module.h"
+#include "os/handler.h"
+#include "os/log.h"
+#include "shim/controller.h"
+
+namespace bluetooth {
+namespace shim {
+
+const ModuleFactory Controller::Factory = ModuleFactory([]() { return new Controller(); });
+
+struct Controller::impl {
+  impl(hci::Controller* hci_controller) : hci_controller_(hci_controller) {}
+
+  hci::Controller* hci_controller_{nullptr};
+};
+
+bool Controller::IsCommandSupported(int op_code) const {
+  return pimpl_->hci_controller_->IsSupported((bluetooth::hci::OpCode)op_code);
+}
+
+uint16_t Controller::GetControllerAclPacketLength() const {
+  return pimpl_->hci_controller_->GetControllerAclPacketLength();
+}
+
+LeBufferSize Controller::GetControllerLeBufferSize() const {
+  LeBufferSize le_buffer_size;
+  hci::LeBufferSize hci_le_buffer_size = pimpl_->hci_controller_->GetControllerLeBufferSize();
+
+  le_buffer_size.le_data_packet_length = hci_le_buffer_size.le_data_packet_length_;
+  le_buffer_size.total_num_le_packets = hci_le_buffer_size.total_num_le_packets_;
+  return le_buffer_size;
+}
+
+LeMaximumDataLength Controller::GetControllerLeMaximumDataLength() const {
+  LeMaximumDataLength maximum_data_length;
+  hci::LeMaximumDataLength hci_maximum_data_length = pimpl_->hci_controller_->GetControllerLeMaximumDataLength();
+
+  maximum_data_length.supported_max_tx_octets = hci_maximum_data_length.supported_max_tx_octets_;
+  maximum_data_length.supported_max_tx_time = hci_maximum_data_length.supported_max_tx_time_;
+  maximum_data_length.supported_max_rx_octets = hci_maximum_data_length.supported_max_rx_octets_;
+  maximum_data_length.supported_max_rx_time = hci_maximum_data_length.supported_max_rx_time_;
+  return maximum_data_length;
+}
+
+uint16_t Controller::GetControllerNumAclPacketBuffers() const {
+  return pimpl_->hci_controller_->GetControllerNumAclPacketBuffers();
+}
+
+uint64_t Controller::GetControllerLeLocalSupportedFeatures() const {
+  return pimpl_->hci_controller_->GetControllerLeLocalSupportedFeatures();
+}
+
+uint64_t Controller::GetControllerLocalExtendedFeatures(uint8_t page_number) const {
+  return pimpl_->hci_controller_->GetControllerLocalExtendedFeatures(page_number);
+}
+
+std::string Controller::GetControllerMacAddress() const {
+  return pimpl_->hci_controller_->GetControllerMacAddress().ToString();
+}
+
+uint64_t Controller::GetControllerLeSupportedStates() const {
+  return pimpl_->hci_controller_->GetControllerLeSupportedStates();
+}
+
+uint8_t Controller::GetControllerLocalExtendedFeaturesMaxPageNumber() const {
+  return pimpl_->hci_controller_->GetControllerLocalExtendedFeaturesMaxPageNumber();
+}
+
+/**
+ * Module methods
+ */
+void Controller::ListDependencies(ModuleList* list) {
+  list->add<hci::Controller>();
+}
+
+void Controller::Start() {
+  LOG_INFO("%s Starting controller shim layer", __func__);
+  pimpl_ = std::make_unique<impl>(GetDependency<hci::Controller>());
+}
+
+void Controller::Stop() {
+  pimpl_.reset();
+}
+
+}  // namespace shim
+}  // namespace bluetooth
diff --git a/gd/shim/controller.h b/gd/shim/controller.h
new file mode 100644
index 0000000..39bd440
--- /dev/null
+++ b/gd/shim/controller.h
@@ -0,0 +1,65 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+#pragma once
+
+#include <memory>
+#include <string>
+
+#include "module.h"
+#include "shim/icontroller.h"
+
+/**
+ * Gd shim controller module that depends upon the Gd controller module.
+ *
+ * Wraps the Gd controller module to expose a sufficient API to allow
+ * proper operation of the legacy shim controller interface.
+ *
+ */
+namespace bluetooth {
+namespace shim {
+
+class Controller : public bluetooth::Module, public bluetooth::shim::IController {
+ public:
+  Controller() = default;
+  ~Controller() = default;
+
+  static const ModuleFactory Factory;
+
+  // Exported controller methods from IController for shim layer
+  bool IsCommandSupported(int op_code) const override;
+  LeBufferSize GetControllerLeBufferSize() const override;
+  LeMaximumDataLength GetControllerLeMaximumDataLength() const override;
+  std::string GetControllerMacAddress() const override;
+  uint16_t GetControllerAclPacketLength() const override;
+  uint16_t GetControllerNumAclPacketBuffers() const override;
+  uint64_t GetControllerLeLocalSupportedFeatures() const override;
+  uint64_t GetControllerLeSupportedStates() const override;
+  uint64_t GetControllerLocalExtendedFeatures(uint8_t page_number) const override;
+  uint8_t GetControllerLocalExtendedFeaturesMaxPageNumber() const override;
+
+ protected:
+  void ListDependencies(ModuleList* list) override;  // Module
+  void Start() override;                             // Module
+  void Stop() override;                              // Module
+
+ private:
+  struct impl;
+  std::unique_ptr<impl> pimpl_;
+  DISALLOW_COPY_AND_ASSIGN(Controller);
+};
+
+}  // namespace shim
+}  // namespace bluetooth
diff --git a/gd/shim/discoverability.cc b/gd/shim/discoverability.cc
new file mode 100644
index 0000000..5754882
--- /dev/null
+++ b/gd/shim/discoverability.cc
@@ -0,0 +1,77 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+#define LOG_TAG "bt_gd_shim"
+
+#include <memory>
+
+#include "common/bidi_queue.h"
+#include "hci/address.h"
+#include "hci/controller.h"
+#include "hci/hci_packets.h"
+#include "module.h"
+#include "neighbor/discoverability.h"
+#include "os/handler.h"
+#include "os/log.h"
+#include "shim/discoverability.h"
+
+namespace bluetooth {
+namespace shim {
+
+const ModuleFactory Discoverability::Factory = ModuleFactory([]() { return new Discoverability(); });
+
+struct Discoverability::impl {
+  impl(neighbor::DiscoverabilityModule* module) : module_(module) {}
+
+  neighbor::DiscoverabilityModule* module_{nullptr};
+};
+
+void Discoverability::StopDiscoverability() {
+  return pimpl_->module_->StopDiscoverability();
+}
+
+void Discoverability::StartLimitedDiscoverability() {
+  return pimpl_->module_->StartLimitedDiscoverability();
+}
+
+void Discoverability::StartGeneralDiscoverability() {
+  return pimpl_->module_->StartGeneralDiscoverability();
+}
+
+bool Discoverability::IsGeneralDiscoverabilityEnabled() const {
+  return pimpl_->module_->IsGeneralDiscoverabilityEnabled();
+}
+
+bool Discoverability::IsLimitedDiscoverabilityEnabled() const {
+  return pimpl_->module_->IsLimitedDiscoverabilityEnabled();
+}
+
+/**
+ * Module methods
+ */
+void Discoverability::ListDependencies(ModuleList* list) {
+  list->add<neighbor::DiscoverabilityModule>();
+}
+
+void Discoverability::Start() {
+  pimpl_ = std::make_unique<impl>(GetDependency<neighbor::DiscoverabilityModule>());
+}
+
+void Discoverability::Stop() {
+  pimpl_.reset();
+}
+
+}  // namespace shim
+}  // namespace bluetooth
diff --git a/gd/shim/discoverability.h b/gd/shim/discoverability.h
new file mode 100644
index 0000000..34ad49a
--- /dev/null
+++ b/gd/shim/discoverability.h
@@ -0,0 +1,52 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+#pragma once
+
+#include <memory>
+
+#include "module.h"
+#include "shim/idiscoverability.h"
+
+namespace bluetooth {
+namespace shim {
+
+class Discoverability : public bluetooth::Module, public bluetooth::shim::IDiscoverability {
+ public:
+  void StartGeneralDiscoverability() override;
+  void StartLimitedDiscoverability() override;
+  void StopDiscoverability() override;
+
+  bool IsGeneralDiscoverabilityEnabled() const override;
+  bool IsLimitedDiscoverabilityEnabled() const override;
+
+  Discoverability() = default;
+  ~Discoverability() = default;
+
+  static const ModuleFactory Factory;
+
+ protected:
+  void ListDependencies(ModuleList* list) override;  // Module
+  void Start() override;                             // Module
+  void Stop() override;                              // Module
+
+ private:
+  struct impl;
+  std::unique_ptr<impl> pimpl_;
+  DISALLOW_COPY_AND_ASSIGN(Discoverability);
+};
+
+}  // namespace shim
+}  // namespace bluetooth
diff --git a/gd/shim/hci_layer.cc b/gd/shim/hci_layer.cc
new file mode 100644
index 0000000..e11454b
--- /dev/null
+++ b/gd/shim/hci_layer.cc
@@ -0,0 +1,233 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+#define LOG_TAG "bt_gd_shim"
+
+#include <cstdint>
+#include <memory>
+#include <queue>
+#include <unordered_map>
+#include <vector>
+
+#include "hci/hci_layer.h"
+#include "hci/hci_packets.h"
+#include "module.h"
+#include "os/handler.h"
+#include "os/log.h"
+#include "packet/raw_builder.h"
+#include "shim/hci_layer.h"
+
+namespace bluetooth {
+namespace shim {
+
+using TokenQueue = std::queue<const void*>;
+using OpCodeTokenQueueMap = std::unordered_map<hci::OpCode, TokenQueue>;
+
+const ModuleFactory HciLayer::Factory = ModuleFactory([]() { return new HciLayer(); });
+
+struct HciLayer::impl {
+  impl(os::Handler* handler, hci::HciLayer* hci_layer) : handler_(handler), hci_layer_(hci_layer) {}
+
+  void OnTransmitPacketCommandComplete(hci::CommandCompleteView view) {
+    if (command_complete_callback_ == nullptr) {
+      LOG_WARN("%s Received packet complete with no complete callback registered", __func__);
+      return;
+    }
+
+    uint16_t command_op_code = static_cast<uint16_t>(view.GetCommandOpCode());
+    std::vector<const uint8_t> data(view.begin(), view.end());
+
+    if (op_code_token_queue_map_.count(view.GetCommandOpCode()) == 0) {
+      LOG_WARN("%s Received unexpected command complete for opcode:0x%04x", __func__, command_op_code);
+      return;
+    }
+    const void* token = op_code_token_queue_map_[view.GetCommandOpCode()].front();
+    if (token == nullptr) {
+      LOG_WARN("%s Received expected command status but no token for opcode:0x%04x", __func__, command_op_code);
+      return;
+    }
+
+    op_code_token_queue_map_[view.GetCommandOpCode()].pop();
+    command_complete_callback_(command_op_code, data, token);
+  }
+
+  void OnTransmitPacketStatus(hci::CommandStatusView view) {
+    if (command_status_callback_ == nullptr) {
+      LOG_WARN("%s Received packet complete with no status callback registered", __func__);
+      return;
+    }
+
+    uint16_t command_op_code = static_cast<uint16_t>(view.GetCommandOpCode());
+    std::vector<const uint8_t> data(view.begin(), view.end());
+
+    if (op_code_token_queue_map_.count(view.GetCommandOpCode()) == 0) {
+      LOG_WARN("%s Received unexpected command status for opcode:0x%04x", __func__, command_op_code);
+      return;
+    }
+    const void* token = op_code_token_queue_map_[view.GetCommandOpCode()].front();
+    if (token == nullptr) {
+      LOG_WARN("%s Received expected command status but no token for opcode:0x%04x", __func__, command_op_code);
+      return;
+    }
+
+    op_code_token_queue_map_[view.GetCommandOpCode()].pop();
+    uint8_t status = static_cast<uint8_t>(view.GetStatus());
+    command_status_callback_(command_op_code, data, token, status);
+  }
+
+  void TransmitCommand(uint16_t command, const uint8_t* data, size_t len, const void* token) {
+    ASSERT(data != nullptr);
+    ASSERT(token != nullptr);
+
+    const hci::OpCode op_code = static_cast<const hci::OpCode>(command);
+
+    auto payload = MakeUniquePacket(data, len);
+    auto packet = hci::CommandPacketBuilder::Create(op_code, std::move(payload));
+
+    op_code_token_queue_map_[op_code].push(token);
+    if (IsCommandStatusOpcode(op_code)) {
+      hci_layer_->EnqueueCommand(std::move(packet),
+                                 common::BindOnce(&impl::OnTransmitPacketStatus, common::Unretained(this)), handler_);
+    } else {
+      hci_layer_->EnqueueCommand(std::move(packet),
+                                 common::BindOnce(&impl::OnTransmitPacketCommandComplete, common::Unretained(this)),
+                                 handler_);
+    }
+  }
+
+  void RegisterCommandComplete(CommandCompleteCallback callback) {
+    ASSERT(command_complete_callback_ == nullptr);
+    command_complete_callback_ = callback;
+  }
+
+  void UnregisterCommandComplete() {
+    ASSERT(command_complete_callback_ != nullptr);
+    command_complete_callback_ = nullptr;
+  }
+
+  void RegisterCommandStatus(CommandStatusCallback callback) {
+    ASSERT(command_status_callback_ == nullptr);
+    command_status_callback_ = callback;
+  }
+
+  void UnregisterCommandStatus() {
+    ASSERT(command_status_callback_ != nullptr);
+    command_status_callback_ = nullptr;
+  }
+
+ private:
+  os::Handler* handler_{nullptr};
+  hci::HciLayer* hci_layer_{nullptr};
+
+  CommandCompleteCallback command_complete_callback_;
+  CommandStatusCallback command_status_callback_;
+
+  OpCodeTokenQueueMap op_code_token_queue_map_;
+
+  /**
+   * Returns true if expecting command complete, false otherwise
+   */
+  bool IsCommandStatusOpcode(hci::OpCode op_code) {
+    switch (op_code) {
+      case hci::OpCode::INQUIRY:
+      case hci::OpCode::CREATE_CONNECTION:
+      case hci::OpCode::DISCONNECT:
+      case hci::OpCode::ACCEPT_CONNECTION_REQUEST:
+      case hci::OpCode::REJECT_CONNECTION_REQUEST:
+      case hci::OpCode::CHANGE_CONNECTION_PACKET_TYPE:
+      case hci::OpCode::AUTHENTICATION_REQUESTED:
+      case hci::OpCode::SET_CONNECTION_ENCRYPTION:
+      case hci::OpCode::CHANGE_CONNECTION_LINK_KEY:
+      case hci::OpCode::MASTER_LINK_KEY:
+      case hci::OpCode::REMOTE_NAME_REQUEST:
+      case hci::OpCode::READ_REMOTE_SUPPORTED_FEATURES:
+      case hci::OpCode::READ_REMOTE_EXTENDED_FEATURES:
+      case hci::OpCode::READ_REMOTE_VERSION_INFORMATION:
+      case hci::OpCode::READ_CLOCK_OFFSET:
+      case hci::OpCode::SETUP_SYNCHRONOUS_CONNECTION:
+      case hci::OpCode::ACCEPT_SYNCHRONOUS_CONNECTION:
+      case hci::OpCode::REJECT_SYNCHRONOUS_CONNECTION:
+      case hci::OpCode::ENHANCED_SETUP_SYNCHRONOUS_CONNECTION:
+      case hci::OpCode::ENHANCED_ACCEPT_SYNCHRONOUS_CONNECTION:
+      case hci::OpCode::HOLD_MODE:
+      case hci::OpCode::SNIFF_MODE:
+      case hci::OpCode::EXIT_SNIFF_MODE:
+      case hci::OpCode::QOS_SETUP:
+      case hci::OpCode::SWITCH_ROLE:
+      case hci::OpCode::FLOW_SPECIFICATION:
+      case hci::OpCode::REFRESH_ENCRYPTION_KEY:
+      case hci::OpCode::LE_CREATE_CONNECTION:
+      case hci::OpCode::LE_CONNECTION_UPDATE:
+      case hci::OpCode::LE_READ_REMOTE_FEATURES:
+      case hci::OpCode::LE_READ_LOCAL_P_256_PUBLIC_KEY_COMMAND:
+      case hci::OpCode::LE_GENERATE_DHKEY_COMMAND:
+      case hci::OpCode::LE_SET_PHY:
+      case hci::OpCode::LE_EXTENDED_CREATE_CONNECTION:
+      case hci::OpCode::LE_PERIODIC_ADVERTISING_CREATE_SYNC:
+        return true;
+      default:
+        return false;
+    }
+  }
+
+  std::unique_ptr<packet::RawBuilder> MakeUniquePacket(const uint8_t* data, size_t len) {
+    packet::RawBuilder builder;
+    std::vector<uint8_t> bytes(data, data + len);
+
+    auto payload = std::make_unique<packet::RawBuilder>();
+    payload->AddOctets(bytes);
+
+    return payload;
+  }
+};
+
+void HciLayer::TransmitCommand(uint16_t op_code, const uint8_t* data, size_t len, const void* token) {
+  pimpl_->TransmitCommand(op_code, data, len, std::move(token));
+}
+
+void HciLayer::RegisterCommandComplete(CommandCompleteCallback callback) {
+  pimpl_->RegisterCommandComplete(callback);
+}
+
+void HciLayer::UnregisterCommandComplete() {
+  pimpl_->UnregisterCommandComplete();
+}
+
+void HciLayer::RegisterCommandStatus(CommandStatusCallback callback) {
+  pimpl_->RegisterCommandStatus(callback);
+}
+
+void HciLayer::UnregisterCommandStatus() {
+  pimpl_->UnregisterCommandStatus();
+}
+
+/**
+ * Module methods
+ */
+void HciLayer::ListDependencies(ModuleList* list) {
+  list->add<hci::HciLayer>();
+}
+
+void HciLayer::Start() {
+  LOG_INFO("%s Starting controller shim layer", __func__);
+  pimpl_ = std::make_unique<impl>(GetHandler(), GetDependency<hci::HciLayer>());
+}
+
+void HciLayer::Stop() {
+  pimpl_.reset();
+}
+
+}  // namespace shim
+}  // namespace bluetooth
diff --git a/gd/shim/hci_layer.h b/gd/shim/hci_layer.h
new file mode 100644
index 0000000..bcd7fed
--- /dev/null
+++ b/gd/shim/hci_layer.h
@@ -0,0 +1,60 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#pragma once
+
+#include <cstdint>
+#include <memory>
+#include <string>
+
+#include "module.h"
+#include "shim/ihci_layer.h"
+
+/**
+ * The hci layer shim module that depends on the Gd hci layer module.
+ */
+namespace bluetooth {
+namespace shim {
+
+class HciLayer : public ::bluetooth::Module, public ::bluetooth::shim::IHciLayer {
+ public:
+  HciLayer() = default;
+  ~HciLayer() = default;
+
+  void TransmitCommand(uint16_t op_code, const uint8_t* data, size_t len,
+                       const void* token);  // IHciLayer
+
+  void RegisterCommandComplete(CommandCompleteCallback callback);  // IHciLayer
+  void UnregisterCommandComplete();                                // IHciLayer
+
+  void RegisterCommandStatus(CommandStatusCallback callback);  // IHciLayer
+  void UnregisterCommandStatus();                              // IHciLayer
+
+  static const ModuleFactory Factory;
+
+ protected:
+  void ListDependencies(ModuleList* list) override;  // Module
+  void Start() override;                             // Module
+  void Stop() override;                              // Module
+
+ private:
+  struct impl;
+  std::unique_ptr<impl> pimpl_;
+  DISALLOW_COPY_AND_ASSIGN(HciLayer);
+};
+
+}  // namespace shim
+}  // namespace bluetooth
diff --git a/gd/shim/iconnectability.h b/gd/shim/iconnectability.h
new file mode 100644
index 0000000..fbfaaa3
--- /dev/null
+++ b/gd/shim/iconnectability.h
@@ -0,0 +1,33 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+#pragma once
+
+/**
+ * The gd API exported to the legacy api
+ */
+namespace bluetooth {
+namespace shim {
+
+struct IConnectability {
+  virtual void StartConnectability() = 0;
+  virtual void StopConnectability() = 0;
+  virtual bool IsConnectable() const = 0;
+
+  virtual ~IConnectability() {}
+};
+
+}  // namespace shim
+}  // namespace bluetooth
diff --git a/gd/shim/icontroller.h b/gd/shim/icontroller.h
new file mode 100644
index 0000000..0accc66
--- /dev/null
+++ b/gd/shim/icontroller.h
@@ -0,0 +1,55 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+#pragma once
+
+#include <cstdint>
+#include <string>
+
+/**
+ * The shim controller module that depends on the Gd controller module
+ */
+namespace bluetooth {
+namespace shim {
+
+typedef struct {
+  uint16_t le_data_packet_length;
+  uint8_t total_num_le_packets;
+} LeBufferSize;
+
+typedef struct {
+  uint16_t supported_max_tx_octets;
+  uint16_t supported_max_tx_time;
+  uint16_t supported_max_rx_octets;
+  uint16_t supported_max_rx_time;
+} LeMaximumDataLength;
+
+struct IController {
+  virtual bool IsCommandSupported(int op_code) const = 0;
+  virtual LeBufferSize GetControllerLeBufferSize() const = 0;
+  virtual LeMaximumDataLength GetControllerLeMaximumDataLength() const = 0;
+  virtual std::string GetControllerMacAddress() const = 0;
+  virtual uint16_t GetControllerAclPacketLength() const = 0;
+  virtual uint16_t GetControllerNumAclPacketBuffers() const = 0;
+  virtual uint64_t GetControllerLeLocalSupportedFeatures() const = 0;
+  virtual uint64_t GetControllerLeSupportedStates() const = 0;
+  virtual uint64_t GetControllerLocalExtendedFeatures(uint8_t page_number) const = 0;
+  virtual uint8_t GetControllerLocalExtendedFeaturesMaxPageNumber() const = 0;
+
+  virtual ~IController() {}
+};
+
+}  // namespace shim
+}  // namespace bluetooth
diff --git a/gd/shim/idiscoverability.h b/gd/shim/idiscoverability.h
new file mode 100644
index 0000000..2a2e4a8
--- /dev/null
+++ b/gd/shim/idiscoverability.h
@@ -0,0 +1,36 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+#pragma once
+
+/**
+ * The gd API exported to the legacy api
+ */
+namespace bluetooth {
+namespace shim {
+
+struct IDiscoverability {
+  virtual void StartGeneralDiscoverability() = 0;
+  virtual void StartLimitedDiscoverability() = 0;
+  virtual void StopDiscoverability() = 0;
+
+  virtual bool IsGeneralDiscoverabilityEnabled() const = 0;
+  virtual bool IsLimitedDiscoverabilityEnabled() const = 0;
+
+  virtual ~IDiscoverability() {}
+};
+
+}  // namespace shim
+}  // namespace bluetooth
diff --git a/gd/shim/ihci_layer.h b/gd/shim/ihci_layer.h
new file mode 100644
index 0000000..5bb8e8f
--- /dev/null
+++ b/gd/shim/ihci_layer.h
@@ -0,0 +1,46 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#pragma once
+
+#include <cstdint>
+#include <vector>
+
+/**
+ * Legacy interface and API into the Gd shim hci layer module.
+ */
+using CommandCompleteCallback =
+    std::function<void(uint16_t command_op_code, std::vector<const uint8_t> data, const void* token)>;
+using CommandStatusCallback =
+    std::function<void(uint16_t command_op_code, std::vector<const uint8_t> data, const void* token, uint8_t status)>;
+
+namespace bluetooth {
+namespace shim {
+
+struct IHciLayer {
+  virtual void TransmitCommand(uint16_t op_code, const uint8_t* data, size_t len, const void* token) = 0;
+
+  virtual void RegisterCommandComplete(CommandCompleteCallback callback) = 0;
+  virtual void UnregisterCommandComplete() = 0;
+
+  virtual void RegisterCommandStatus(CommandStatusCallback callback) = 0;
+  virtual void UnregisterCommandStatus() = 0;
+
+  virtual ~IHciLayer() {}
+};
+
+}  // namespace shim
+}  // namespace bluetooth
diff --git a/gd/shim/iinquiry.h b/gd/shim/iinquiry.h
new file mode 100644
index 0000000..97fd1b1
--- /dev/null
+++ b/gd/shim/iinquiry.h
@@ -0,0 +1,74 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+#pragma once
+
+#include <cstdint>
+#include <functional>
+#include <vector>
+
+/**
+ * The gd API exported to the legacy api
+ */
+namespace bluetooth {
+namespace shim {
+
+using InquiryResultCallback = std::function<void(std::vector<const uint8_t> data)>;
+using InquiryResultWithRssiCallback = std::function<void(std::vector<const uint8_t> data)>;
+using ExtendedInquiryResultCallback = std::function<void(std::vector<const uint8_t> data)>;
+using InquiryCompleteCallback = std::function<void(uint16_t status)>;
+using InquiryCancelCompleteCallback = std::function<void(uint8_t mode)>;
+
+struct IInquiry {
+  virtual void StartGeneralInquiry(uint8_t duration, uint8_t max_responses) = 0;
+  virtual void StartLimitedInquiry(uint8_t duration, uint8_t max_responses) = 0;
+  virtual void StopInquiry() = 0;
+  virtual bool IsGeneralInquiryActive() const = 0;
+  virtual bool IsLimitedInquiryActive() const = 0;
+
+  virtual void StartGeneralPeriodicInquiry(uint8_t duration, uint8_t max_responses, uint16_t max_delay,
+                                           uint16_t min_delay) = 0;
+  virtual void StartLimitedPeriodicInquiry(uint8_t duration, uint8_t max_responses, uint16_t max_delay,
+                                           uint16_t min_delay) = 0;
+  virtual void StopPeriodicInquiry() = 0;
+  virtual bool IsGeneralPeriodicInquiryActive() const = 0;
+  virtual bool IsLimitedPeriodicInquiryActive() const = 0;
+
+  virtual void SetInterlacedScan() = 0;
+  virtual void SetStandardScan() = 0;
+
+  virtual void SetScanActivity(uint16_t interval, uint16_t window) = 0;
+  virtual void GetScanActivity(uint16_t& interval, uint16_t& window) const = 0;
+
+  virtual void SetStandardInquiryResultMode() = 0;
+  virtual void SetInquiryWithRssiResultMode() = 0;
+  virtual void SetExtendedInquiryResultMode() = 0;
+
+  virtual void RegisterInquiryResult(InquiryResultCallback callback) = 0;
+  virtual void UnregisterInquiryResult() = 0;
+  virtual void RegisterInquiryResultWithRssi(InquiryResultWithRssiCallback callback) = 0;
+  virtual void UnregisterInquiryResultWithRssi() = 0;
+  virtual void RegisterExtendedInquiryResult(ExtendedInquiryResultCallback callback) = 0;
+  virtual void UnregisterExtendedInquiryResult() = 0;
+  virtual void RegisterInquiryComplete(InquiryCompleteCallback callback) = 0;
+  virtual void UnregisterInquiryComplete() = 0;
+  virtual void RegisterInquiryCancelComplete(InquiryCancelCompleteCallback callback) = 0;
+  virtual void UnregisterInquiryCancelComplete() = 0;
+
+  virtual ~IInquiry() {}
+};
+
+}  // namespace shim
+}  // namespace bluetooth
diff --git a/gd/shim/il2cap.h b/gd/shim/il2cap.h
new file mode 100644
index 0000000..c4e7463
--- /dev/null
+++ b/gd/shim/il2cap.h
@@ -0,0 +1,54 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+#pragma once
+
+#include <cstdint>
+#include <functional>
+#include <future>
+#include <string>
+#include <vector>
+
+/**
+ * The gd API exported to the legacy api
+ */
+namespace bluetooth {
+namespace shim {
+
+using ConnectionClosedCallback = std::function<void(uint16_t cid, int error_code)>;
+using Postable = std::function<void(std::function<void(uint16_t cid)>)>;
+using ConnectionOpenCallback = std::function<void(uint16_t psm, uint16_t cid, Postable postable)>;
+using ReadDataReadyCallback = std::function<void(uint16_t cid, std::vector<const uint8_t> data)>;
+
+struct IL2cap {
+  virtual void RegisterService(uint16_t psm, ConnectionOpenCallback on_open, std::promise<void> completed) = 0;
+  virtual void UnregisterService(uint16_t psm) = 0;
+
+  virtual void CreateConnection(uint16_t psm, const std::string address, std::promise<uint16_t> completed) = 0;
+  virtual void CloseConnection(uint16_t cid) = 0;
+
+  virtual void SetReadDataReadyCallback(uint16_t cid, ReadDataReadyCallback on_data_ready) = 0;
+  virtual void SetConnectionClosedCallback(uint16_t cid, ConnectionClosedCallback on_closed) = 0;
+
+  virtual bool Write(uint16_t cid, const uint8_t* data, size_t len) = 0;
+  virtual bool WriteFlushable(uint16_t cid, const uint8_t* data, size_t len) = 0;
+  virtual bool WriteNonFlushable(uint16_t cid, const uint8_t* data, size_t len) = 0;
+
+  virtual bool IsCongested(uint16_t cid) = 0;
+  virtual ~IL2cap() {}
+};
+
+}  // namespace shim
+}  // namespace bluetooth
diff --git a/gd/shim/inquiry.cc b/gd/shim/inquiry.cc
new file mode 100644
index 0000000..4c3a174
--- /dev/null
+++ b/gd/shim/inquiry.cc
@@ -0,0 +1,309 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+#define LOG_TAG "bt_gd_shim"
+
+#include <functional>
+#include <memory>
+
+#include "common/bidi_queue.h"
+#include "hci/address.h"
+#include "hci/controller.h"
+#include "hci/hci_packets.h"
+#include "module.h"
+#include "neighbor/inquiry.h"
+#include "neighbor/scan_parameters.h"
+#include "os/handler.h"
+#include "os/log.h"
+#include "shim/inquiry.h"
+
+namespace bluetooth {
+namespace shim {
+
+struct Inquiry::impl {
+  void Result(hci::InquiryResultView view);
+  void ResultWithRssi(hci::InquiryResultWithRssiView view);
+  void ExtendedResult(hci::ExtendedInquiryResultView view);
+  void Complete(hci::ErrorCode status);
+
+  void RegisterInquiryResult(InquiryResultCallback callback);
+  void UnregisterInquiryResult();
+  void RegisterInquiryResultWithRssi(InquiryResultWithRssiCallback callback);
+  void UnregisterInquiryResultWithRssi();
+  void RegisterExtendedInquiryResult(ExtendedInquiryResultCallback callback);
+  void UnregisterExtendedInquiryResult();
+  void RegisterInquiryComplete(InquiryCompleteCallback callback);
+  void UnregisterInquiryComplete();
+  void RegisterInquiryCancelComplete(InquiryCancelCompleteCallback callback);
+  void UnregisterInquiryCancelComplete();
+
+  InquiryResultCallback shim_result_callback_;
+  InquiryResultWithRssiCallback shim_result_with_rssi_callback_;
+  ExtendedInquiryResultCallback shim_extended_result_callback_;
+  InquiryCompleteCallback shim_complete_callback_;
+  InquiryCancelCompleteCallback shim_cancel_complete_callback_;
+
+  neighbor::InquiryModule* module_{nullptr};
+
+  impl(neighbor::InquiryModule* module);
+  ~impl();
+};
+
+const ModuleFactory Inquiry::Factory = ModuleFactory([]() { return new Inquiry(); });
+
+void Inquiry::impl::Result(hci::InquiryResultView view) {
+  ASSERT(view.size() >= sizeof(uint16_t));
+  ASSERT(shim_result_callback_ != nullptr);
+  std::vector<const uint8_t> v(view.begin() + sizeof(uint16_t), view.end());
+  shim_result_callback_(v);
+}
+
+void Inquiry::impl::ResultWithRssi(hci::InquiryResultWithRssiView view) {
+  ASSERT(view.size() >= sizeof(uint16_t));
+  ASSERT(shim_result_with_rssi_callback_ != nullptr);
+  std::vector<const uint8_t> v(view.begin() + sizeof(uint16_t), view.end());
+  shim_result_with_rssi_callback_(v);
+}
+
+void Inquiry::impl::ExtendedResult(hci::ExtendedInquiryResultView view) {
+  ASSERT(view.size() >= sizeof(uint16_t));
+  ASSERT(shim_extended_result_callback_ != nullptr);
+  std::vector<const uint8_t> v(view.begin() + sizeof(uint16_t), view.end());
+  shim_extended_result_callback_(v);
+}
+
+void Inquiry::impl::Complete(hci::ErrorCode status) {
+  ASSERT(shim_complete_callback_ != nullptr);
+  shim_complete_callback_(static_cast<uint16_t>(status));
+}
+
+void Inquiry::impl::RegisterInquiryResult(shim::InquiryResultCallback callback) {
+  if (shim_result_callback_ != nullptr) {
+    LOG_WARN("Registering inquiry result without unregistering");
+  }
+  shim_result_callback_ = callback;
+}
+
+void Inquiry::impl::UnregisterInquiryResult() {
+  if (shim_result_callback_ == nullptr) {
+    LOG_WARN("Unregistering inquiry result without registering");
+  }
+  shim_result_callback_ = nullptr;
+}
+
+void Inquiry::impl::RegisterInquiryResultWithRssi(shim::InquiryResultWithRssiCallback callback) {
+  if (shim_result_with_rssi_callback_ != nullptr) {
+    LOG_WARN("Registering inquiry result with rssi without unregistering");
+  }
+  shim_result_with_rssi_callback_ = callback;
+}
+
+void Inquiry::impl::UnregisterInquiryResultWithRssi() {
+  if (shim_result_with_rssi_callback_ == nullptr) {
+    LOG_WARN("Unregistering inquiry result with rssi without registering");
+  }
+  shim_result_with_rssi_callback_ = nullptr;
+}
+
+void Inquiry::impl::RegisterExtendedInquiryResult(shim::ExtendedInquiryResultCallback callback) {
+  if (shim_result_with_rssi_callback_ != nullptr) {
+    LOG_WARN("Registering extended inquiry result without unregistering");
+  }
+  shim_extended_result_callback_ = callback;
+}
+
+void Inquiry::impl::UnregisterExtendedInquiryResult() {
+  if (shim_extended_result_callback_ == nullptr) {
+    LOG_WARN("Unregistering extended inquiry result without registering");
+  }
+  shim_extended_result_callback_ = nullptr;
+}
+
+void Inquiry::impl::RegisterInquiryComplete(shim::InquiryCompleteCallback callback) {
+  if (shim_result_with_rssi_callback_ != nullptr) {
+    LOG_WARN("Registering inquiry complete without unregistering");
+  }
+  shim_complete_callback_ = callback;
+}
+
+void Inquiry::impl::UnregisterInquiryComplete() {
+  if (shim_result_with_rssi_callback_ == nullptr) {
+    LOG_WARN("Unregistering inquiry complete without registering");
+  }
+  shim_complete_callback_ = nullptr;
+}
+
+void Inquiry::impl::RegisterInquiryCancelComplete(shim::InquiryCancelCompleteCallback callback) {
+  if (shim_cancel_complete_callback_ != nullptr) {
+    LOG_WARN("Registering inquiry cancel complete without unregistering");
+  }
+  shim_cancel_complete_callback_ = callback;
+}
+
+void Inquiry::impl::UnregisterInquiryCancelComplete() {
+  if (shim_cancel_complete_callback_ == nullptr) {
+    LOG_WARN("Unregistering inquiry cancel complete without registering");
+  }
+  shim_cancel_complete_callback_ = nullptr;
+}
+
+Inquiry::impl::impl(neighbor::InquiryModule* inquiry_module) : module_(inquiry_module) {
+  neighbor::InquiryCallbacks inquiry_callbacks;
+  inquiry_callbacks.result = std::bind(&Inquiry::impl::Result, this, std::placeholders::_1);
+  inquiry_callbacks.result_with_rssi = std::bind(&Inquiry::impl::ResultWithRssi, this, std::placeholders::_1);
+  inquiry_callbacks.extended_result = std::bind(&Inquiry::impl::ExtendedResult, this, std::placeholders::_1);
+  inquiry_callbacks.complete = std::bind(&Inquiry::impl::Complete, this, std::placeholders::_1);
+
+  module_->RegisterCallbacks(inquiry_callbacks);
+}
+
+Inquiry::impl::~impl() {
+  module_->UnregisterCallbacks();
+}
+
+void Inquiry::StartGeneralInquiry(uint8_t inquiry_length, uint8_t num_responses) {
+  return pimpl_->module_->StartGeneralInquiry(inquiry_length, num_responses);
+}
+
+void Inquiry::StartLimitedInquiry(uint8_t inquiry_length, uint8_t num_responses) {
+  return pimpl_->module_->StartLimitedInquiry(inquiry_length, num_responses);
+}
+
+void Inquiry::StopInquiry() {
+  return pimpl_->module_->StopInquiry();
+}
+
+bool Inquiry::IsGeneralInquiryActive() const {
+  return pimpl_->module_->IsGeneralInquiryActive();
+}
+
+bool Inquiry::IsLimitedInquiryActive() const {
+  return pimpl_->module_->IsLimitedInquiryActive();
+}
+
+void Inquiry::StartGeneralPeriodicInquiry(uint8_t inquiry_length, uint8_t num_responses, uint16_t max_delay,
+                                          uint16_t min_delay) {
+  return pimpl_->module_->StartGeneralPeriodicInquiry(inquiry_length, num_responses, max_delay, min_delay);
+}
+
+void Inquiry::StartLimitedPeriodicInquiry(uint8_t inquiry_length, uint8_t num_responses, uint16_t max_delay,
+                                          uint16_t min_delay) {
+  return pimpl_->module_->StartLimitedPeriodicInquiry(inquiry_length, num_responses, max_delay, min_delay);
+}
+
+void Inquiry::StopPeriodicInquiry() {
+  return pimpl_->module_->StopPeriodicInquiry();
+}
+
+bool Inquiry::IsGeneralPeriodicInquiryActive() const {
+  return pimpl_->module_->IsGeneralPeriodicInquiryActive();
+}
+
+bool Inquiry::IsLimitedPeriodicInquiryActive() const {
+  return pimpl_->module_->IsLimitedPeriodicInquiryActive();
+}
+
+void Inquiry::SetInterlacedScan() {
+  pimpl_->module_->SetInterlacedScan();
+}
+
+void Inquiry::SetStandardScan() {
+  pimpl_->module_->SetStandardScan();
+}
+
+void Inquiry::SetScanActivity(uint16_t interval, uint16_t window) {
+  neighbor::ScanParameters params{
+      .interval = static_cast<neighbor::ScanInterval>(interval),
+      .window = static_cast<neighbor::ScanWindow>(window),
+  };
+  pimpl_->module_->SetScanActivity(params);
+}
+
+void Inquiry::GetScanActivity(uint16_t& interval, uint16_t& window) const {
+  neighbor::ScanParameters params = pimpl_->module_->GetScanActivity();
+
+  interval = static_cast<uint16_t>(params.interval);
+  window = static_cast<uint16_t>(params.window);
+}
+
+void Inquiry::SetStandardInquiryResultMode() {
+  pimpl_->module_->SetStandardInquiryResultMode();
+}
+
+void Inquiry::SetInquiryWithRssiResultMode() {
+  pimpl_->module_->SetInquiryWithRssiResultMode();
+}
+
+void Inquiry::SetExtendedInquiryResultMode() {
+  pimpl_->module_->SetExtendedInquiryResultMode();
+}
+
+void Inquiry::RegisterInquiryResult(shim::InquiryResultCallback callback) {
+  pimpl_->RegisterInquiryResult(callback);
+}
+
+void Inquiry::UnregisterInquiryResult() {
+  pimpl_->UnregisterInquiryResult();
+}
+
+void Inquiry::RegisterInquiryResultWithRssi(shim::InquiryResultWithRssiCallback callback) {
+  pimpl_->RegisterInquiryResultWithRssi(callback);
+}
+
+void Inquiry::UnregisterInquiryResultWithRssi() {
+  pimpl_->UnregisterInquiryResultWithRssi();
+}
+
+void Inquiry::RegisterExtendedInquiryResult(shim::ExtendedInquiryResultCallback callback) {
+  pimpl_->RegisterExtendedInquiryResult(callback);
+}
+
+void Inquiry::UnregisterExtendedInquiryResult() {
+  pimpl_->UnregisterExtendedInquiryResult();
+}
+
+void Inquiry::RegisterInquiryComplete(InquiryCompleteCallback callback) {
+  pimpl_->RegisterInquiryComplete(callback);
+}
+
+void Inquiry::UnregisterInquiryComplete() {
+  pimpl_->UnregisterInquiryComplete();
+}
+
+void Inquiry::RegisterInquiryCancelComplete(InquiryCancelCompleteCallback callback) {
+  pimpl_->RegisterInquiryCancelComplete(callback);
+}
+
+void Inquiry::UnregisterInquiryCancelComplete() {
+  pimpl_->UnregisterInquiryCancelComplete();
+}
+
+/**
+ * Module methods
+ */
+void Inquiry::ListDependencies(ModuleList* list) {
+  list->add<neighbor::InquiryModule>();
+}
+
+void Inquiry::Start() {
+  pimpl_ = std::make_unique<impl>(GetDependency<neighbor::InquiryModule>());
+}
+
+void Inquiry::Stop() {
+  pimpl_.reset();
+}
+
+}  // namespace shim
+}  // namespace bluetooth
diff --git a/gd/shim/inquiry.h b/gd/shim/inquiry.h
new file mode 100644
index 0000000..9051d70
--- /dev/null
+++ b/gd/shim/inquiry.h
@@ -0,0 +1,81 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+#pragma once
+
+#include <memory>
+#include <string>
+
+#include "module.h"
+#include "shim/iinquiry.h"
+
+namespace bluetooth {
+namespace shim {
+
+class Inquiry : public bluetooth::Module, public bluetooth::shim::IInquiry {
+ public:
+  void StartGeneralInquiry(uint8_t duration, uint8_t max_responses) override;
+  void StartLimitedInquiry(uint8_t duration, uint8_t max_responses) override;
+  void StopInquiry() override;
+  bool IsGeneralInquiryActive() const override;
+  bool IsLimitedInquiryActive() const override;
+
+  void StartGeneralPeriodicInquiry(uint8_t duration, uint8_t max_responses, uint16_t max_delay,
+                                   uint16_t min_delay) override;
+  void StartLimitedPeriodicInquiry(uint8_t duration, uint8_t max_responses, uint16_t max_delay,
+                                   uint16_t min_delay) override;
+  void StopPeriodicInquiry() override;
+  bool IsGeneralPeriodicInquiryActive() const override;
+  bool IsLimitedPeriodicInquiryActive() const override;
+
+  void SetInterlacedScan() override;
+  void SetStandardScan() override;
+
+  void SetScanActivity(uint16_t interval, uint16_t window) override;
+  void GetScanActivity(uint16_t& interval, uint16_t& window) const override;
+
+  void SetStandardInquiryResultMode() override;
+  void SetInquiryWithRssiResultMode() override;
+  void SetExtendedInquiryResultMode() override;
+
+  void RegisterInquiryResult(InquiryResultCallback callback) override;
+  void UnregisterInquiryResult() override;
+  void RegisterInquiryResultWithRssi(InquiryResultWithRssiCallback callback) override;
+  void UnregisterInquiryResultWithRssi() override;
+  void RegisterExtendedInquiryResult(ExtendedInquiryResultCallback callback) override;
+  void UnregisterExtendedInquiryResult() override;
+  void RegisterInquiryComplete(InquiryCompleteCallback callback) override;
+  void UnregisterInquiryComplete() override;
+  void RegisterInquiryCancelComplete(InquiryCancelCompleteCallback callback) override;
+  void UnregisterInquiryCancelComplete() override;
+
+  Inquiry() = default;
+  ~Inquiry() = default;
+
+  static const ModuleFactory Factory;
+
+ protected:
+  void ListDependencies(ModuleList* list) override;  // Module
+  void Start() override;                             // Module
+  void Stop() override;                              // Module
+
+ private:
+  struct impl;
+  std::unique_ptr<impl> pimpl_;
+  DISALLOW_COPY_AND_ASSIGN(Inquiry);
+};
+
+}  // namespace shim
+}  // namespace bluetooth
diff --git a/gd/shim/ipage.h b/gd/shim/ipage.h
new file mode 100644
index 0000000..28c2762
--- /dev/null
+++ b/gd/shim/ipage.h
@@ -0,0 +1,37 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+#pragma once
+
+#include <cstdint>
+
+/**
+ * The gd API exported to the legacy api
+ */
+namespace bluetooth {
+namespace shim {
+
+struct IPage {
+  virtual void SetScanActivity(uint16_t interval, uint16_t window) = 0;
+  virtual void GetScanActivity(uint16_t& interval, uint16_t& window) const = 0;
+
+  virtual void SetInterlacedScan() = 0;
+  virtual void SetStandardScan() = 0;
+
+  virtual ~IPage() {}
+};
+
+}  // namespace shim
+}  // namespace bluetooth
diff --git a/gd/shim/istack.h b/gd/shim/istack.h
new file mode 100644
index 0000000..af2b62d
--- /dev/null
+++ b/gd/shim/istack.h
@@ -0,0 +1,52 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#pragma once
+
+/**
+ * Legacy stack manipulation methods to allow the legacy stack to start
+ * and stop the stack, and to provide Gd shim stack module API access.
+ */
+namespace bluetooth {
+namespace shim {
+
+struct IController;
+struct IConnectability;
+struct IDiscoverability;
+struct IHciLayer;
+struct IInquiry;
+struct IL2cap;
+struct IPage;
+
+struct IStack {
+  virtual void Start() = 0;
+  virtual void Stop() = 0;
+
+  virtual IController* GetController() = 0;
+  virtual IConnectability* GetConnectability() = 0;
+  virtual IDiscoverability* GetDiscoverability() = 0;
+  virtual IHciLayer* GetHciLayer() = 0;
+  virtual IInquiry* GetInquiry() = 0;
+  virtual IL2cap* GetL2cap() = 0;
+  virtual IPage* GetPage() = 0;
+
+  virtual ~IStack() {}
+};
+
+IStack* GetGabeldorscheStack();
+
+}  // namespace shim
+}  // namespace bluetooth
diff --git a/gd/shim/l2cap.cc b/gd/shim/l2cap.cc
new file mode 100644
index 0000000..58b10b5
--- /dev/null
+++ b/gd/shim/l2cap.cc
@@ -0,0 +1,504 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+#define LOG_TAG "bt_gd_shim"
+
+#include <cstdint>
+#include <functional>
+#include <future>
+#include <memory>
+#include <mutex>
+#include <queue>
+#include <unordered_map>
+#include <vector>
+
+#include "common/bind.h"
+#include "hci/address.h"
+#include "hci/hci_packets.h"
+#include "l2cap/classic/dynamic_channel_manager.h"
+#include "l2cap/classic/l2cap_classic_module.h"
+#include "l2cap/psm.h"
+#include "l2cap/security_policy.h"
+#include "module.h"
+#include "os/handler.h"
+#include "os/log.h"
+#include "packet/packet_view.h"
+#include "packet/raw_builder.h"
+#include "shim/l2cap.h"
+
+namespace bluetooth {
+namespace shim {
+
+const ModuleFactory L2cap::Factory = ModuleFactory([]() { return new L2cap(); });
+
+using ConnectionInterfaceDescriptor = uint16_t;
+static const ConnectionInterfaceDescriptor kInvalidConnectionInterfaceDescriptor = 0;
+static const ConnectionInterfaceDescriptor kStartConnectionInterfaceDescriptor = 64;
+static const ConnectionInterfaceDescriptor kMaxConnections = UINT16_MAX - kStartConnectionInterfaceDescriptor - 1;
+
+using ServiceInterfaceCallback =
+    std::function<void(l2cap::Psm psm, l2cap::classic::DynamicChannelManager::RegistrationResult result)>;
+using ConnectionInterfaceCallback =
+    std::function<void(l2cap::Psm psm, std::unique_ptr<l2cap::classic::DynamicChannel>)>;
+
+std::unique_ptr<packet::RawBuilder> MakeUniquePacket(const uint8_t* data, size_t len) {
+  packet::RawBuilder builder;
+  std::vector<uint8_t> bytes(data, data + len);
+  auto payload = std::make_unique<packet::RawBuilder>();
+  payload->AddOctets(bytes);
+  return payload;
+}
+
+class ConnectionInterface {
+ public:
+  ConnectionInterface(ConnectionInterfaceDescriptor cid, std::unique_ptr<l2cap::classic::DynamicChannel> channel,
+                      os::Handler* handler)
+      : cid_(cid), channel_(std::move(channel)), handler_(handler), on_data_ready_callback_(nullptr),
+        on_connection_closed_callback_(nullptr), address_(channel_->GetDevice()) {
+    channel_->RegisterOnCloseCallback(
+        handler_, common::BindOnce(&ConnectionInterface::OnConnectionClosed, common::Unretained(this)));
+    channel_->GetQueueUpEnd()->RegisterDequeue(
+        handler_, common::Bind(&ConnectionInterface::OnReadReady, common::Unretained(this)));
+    dequeue_registered_ = true;
+  }
+
+  ~ConnectionInterface() {
+    ASSERT(!dequeue_registered_);
+  }
+
+  void OnReadReady() {
+    std::unique_ptr<packet::PacketView<packet::kLittleEndian>> packet = channel_->GetQueueUpEnd()->TryDequeue();
+    if (packet == nullptr) {
+      LOG_WARN("Got read ready from gd l2cap but no packet is ready");
+      return;
+    }
+    std::vector<const uint8_t> data(packet->begin(), packet->end());
+    ASSERT(on_data_ready_callback_ != nullptr);
+    on_data_ready_callback_(cid_, data);
+  }
+
+  void SetReadDataReadyCallback(ReadDataReadyCallback on_data_ready) {
+    ASSERT(on_data_ready != nullptr);
+    ASSERT(on_data_ready_callback_ == nullptr);
+    on_data_ready_callback_ = on_data_ready;
+  }
+
+  std::unique_ptr<packet::BasePacketBuilder> WriteReady() {
+    auto data = std::move(write_queue_.front());
+    write_queue_.pop();
+    if (write_queue_.empty()) {
+      channel_->GetQueueUpEnd()->UnregisterEnqueue();
+      enqueue_registered_ = false;
+    }
+    return data;
+  }
+
+  void Write(std::unique_ptr<packet::RawBuilder> packet) {
+    LOG_DEBUG("Writing packet cid:%hd size:%zd", cid_, packet->size());
+    write_queue_.push(std::move(packet));
+    if (!enqueue_registered_) {
+      enqueue_registered_ = true;
+      channel_->GetQueueUpEnd()->RegisterEnqueue(
+          handler_, common::Bind(&ConnectionInterface::WriteReady, common::Unretained(this)));
+    }
+  }
+
+  void Close() {
+    if (dequeue_registered_) {
+      channel_->GetQueueUpEnd()->UnregisterDequeue();
+      dequeue_registered_ = false;
+    }
+    ASSERT(write_queue_.empty());
+    channel_->Close();
+  }
+
+  void OnConnectionClosed(hci::ErrorCode error_code) {
+    LOG_DEBUG("Channel interface closed reason:%s cid:%hd device:%s", hci::ErrorCodeText(error_code).c_str(), cid_,
+              address_.ToString().c_str());
+    ASSERT(on_connection_closed_callback_ != nullptr);
+    on_connection_closed_callback_(cid_, static_cast<int>(error_code));
+  }
+
+  void SetConnectionClosedCallback(::bluetooth::shim::ConnectionClosedCallback on_connection_closed) {
+    ASSERT(on_connection_closed != nullptr);
+    ASSERT(on_connection_closed_callback_ == nullptr);
+    on_connection_closed_callback_ = std::move(on_connection_closed);
+  }
+
+ private:
+  const ConnectionInterfaceDescriptor cid_;
+  const std::unique_ptr<l2cap::classic::DynamicChannel> channel_;
+  os::Handler* handler_;
+
+  ReadDataReadyCallback on_data_ready_callback_;
+  ConnectionClosedCallback on_connection_closed_callback_;
+
+  const hci::Address address_;
+
+  std::queue<std::unique_ptr<packet::PacketBuilder<hci::kLittleEndian>>> write_queue_;
+
+  bool enqueue_registered_{false};
+  bool dequeue_registered_{false};
+};
+
+struct ConnectionInterfaceManager {
+ public:
+  ConnectionInterfaceDescriptor AddChannel(std::unique_ptr<l2cap::classic::DynamicChannel> channel);
+  void RemoveConnection(ConnectionInterfaceDescriptor cid);
+
+  void SetReadDataReadyCallback(ConnectionInterfaceDescriptor cid, ReadDataReadyCallback on_data_ready);
+  void SetConnectionClosedCallback(ConnectionInterfaceDescriptor cid, ConnectionClosedCallback on_closed);
+
+  bool Write(ConnectionInterfaceDescriptor cid, std::unique_ptr<packet::RawBuilder> packet);
+
+  void SetHandler(os::Handler* handler) {
+    handler_ = handler;
+  }
+
+  size_t NumberOfActiveConnections() const {
+    return cid_to_interface_map_.size();
+  }
+
+  ConnectionInterfaceManager();
+
+ private:
+  std::unordered_map<ConnectionInterfaceDescriptor, std::unique_ptr<ConnectionInterface>> cid_to_interface_map_;
+  ConnectionInterfaceDescriptor current_connection_interface_descriptor_;
+  os::Handler* handler_;
+
+  bool HasResources() const;
+  bool Exists(ConnectionInterfaceDescriptor id) const;
+  ConnectionInterfaceDescriptor AllocateConnectionInterfaceDescriptor();
+};
+
+ConnectionInterfaceManager::ConnectionInterfaceManager()
+    : current_connection_interface_descriptor_(kStartConnectionInterfaceDescriptor) {}
+
+bool ConnectionInterfaceManager::Exists(ConnectionInterfaceDescriptor cid) const {
+  return cid_to_interface_map_.find(cid) != cid_to_interface_map_.end();
+}
+
+ConnectionInterfaceDescriptor ConnectionInterfaceManager::AllocateConnectionInterfaceDescriptor() {
+  ASSERT(HasResources());
+  while (Exists(current_connection_interface_descriptor_)) {
+    if (++current_connection_interface_descriptor_ == kInvalidConnectionInterfaceDescriptor) {
+      current_connection_interface_descriptor_ = kStartConnectionInterfaceDescriptor;
+    }
+  }
+  return current_connection_interface_descriptor_++;
+}
+
+ConnectionInterfaceDescriptor ConnectionInterfaceManager::AddChannel(
+    std::unique_ptr<l2cap::classic::DynamicChannel> channel) {
+  if (!HasResources()) {
+    return kInvalidConnectionInterfaceDescriptor;
+  }
+  ConnectionInterfaceDescriptor cid = AllocateConnectionInterfaceDescriptor();
+
+  auto channel_interface = std::make_unique<ConnectionInterface>(cid, std::move(channel), handler_);
+  cid_to_interface_map_[cid] = std::move(channel_interface);
+  return cid;
+}
+
+void ConnectionInterfaceManager::RemoveConnection(ConnectionInterfaceDescriptor cid) {
+  ASSERT(cid_to_interface_map_.count(cid) == 1);
+  cid_to_interface_map_.find(cid)->second->Close();
+  cid_to_interface_map_.erase(cid);
+}
+
+bool ConnectionInterfaceManager::HasResources() const {
+  return cid_to_interface_map_.size() < kMaxConnections;
+}
+
+void ConnectionInterfaceManager::SetReadDataReadyCallback(ConnectionInterfaceDescriptor cid,
+                                                          ReadDataReadyCallback on_data_ready) {
+  ASSERT(Exists(cid));
+  return cid_to_interface_map_[cid]->SetReadDataReadyCallback(on_data_ready);
+}
+
+void ConnectionInterfaceManager::SetConnectionClosedCallback(ConnectionInterfaceDescriptor cid,
+                                                             ConnectionClosedCallback on_closed) {
+  ASSERT(Exists(cid));
+  return cid_to_interface_map_[cid]->SetConnectionClosedCallback(on_closed);
+}
+
+bool ConnectionInterfaceManager::Write(ConnectionInterfaceDescriptor cid, std::unique_ptr<packet::RawBuilder> packet) {
+  if (!Exists(cid)) {
+    return false;
+  }
+  cid_to_interface_map_[cid]->Write(std::move(packet));
+  return true;
+}
+
+class ServiceInterface {
+ public:
+  ServiceInterface(uint16_t psm, ServiceInterfaceCallback register_callback,
+                   ConnectionInterfaceCallback connection_callback)
+      : psm_(psm), register_callback_(register_callback), connection_callback_(connection_callback) {}
+
+  void OnRegistrationComplete(l2cap::classic::DynamicChannelManager::RegistrationResult result,
+                              std::unique_ptr<l2cap::classic::DynamicChannelService> service) {
+    ASSERT(service_ == nullptr);
+    ASSERT(psm_ == service->GetPsm());
+    LOG_DEBUG("Registration is complete for psm:%hd", psm_);
+    service_ = std::move(service);
+    register_callback_(psm_, result);
+  }
+
+  void OnConnectionOpen(std::unique_ptr<l2cap::classic::DynamicChannel> channel) {
+    LOG_DEBUG("Connection is open to device:%s for psm:%hd", channel->GetDevice().ToString().c_str(), psm_);
+    connection_callback_(psm_, std::move(channel));
+  }
+
+  l2cap::SecurityPolicy GetSecurityPolicy() const {
+    return security_policy_;
+  }
+
+  void RegisterService(
+      std::function<void(l2cap::Psm, l2cap::SecurityPolicy security_policy,
+                         l2cap::classic::DynamicChannelManager::OnRegistrationCompleteCallback on_registration_complete,
+                         l2cap::classic::DynamicChannelManager::OnConnectionOpenCallback on_connection_open)>
+          func) {
+    func(psm_, security_policy_, common::BindOnce(&ServiceInterface::OnRegistrationComplete, common::Unretained(this)),
+         common::Bind(&ServiceInterface::OnConnectionOpen, common::Unretained(this)));
+  }
+
+ private:
+  const l2cap::Psm psm_;
+  std::unique_ptr<l2cap::classic::DynamicChannelService> service_;
+  const l2cap::SecurityPolicy security_policy_;
+  ServiceInterfaceCallback register_callback_;
+  ConnectionInterfaceCallback connection_callback_;
+};
+
+struct L2cap::impl {
+  void RegisterService(l2cap::Psm psm, ConnectionOpenCallback on_open, std::promise<void> completed);
+  void UnregisterService(l2cap::Psm psm);
+
+  void CreateConnection(l2cap::Psm psm, hci::Address address, std::promise<uint16_t> completed);
+  void CloseConnection(ConnectionInterfaceDescriptor cid);
+
+  void OnConnectionOpenNever(std::unique_ptr<l2cap::classic::DynamicChannel> channel);
+  void OnConnectionFailureNever(l2cap::classic::DynamicChannelManager::ConnectionResult result);
+
+  bool Write(ConnectionInterfaceDescriptor cid, std::unique_ptr<packet::RawBuilder> packet);
+
+  impl(L2cap& module, l2cap::classic::L2capClassicModule* l2cap_module);
+  ConnectionInterfaceManager connection_interface_manager_;
+
+  void OpenConnection(l2cap::Psm psm, ConnectionInterfaceDescriptor cid);
+
+ private:
+  L2cap& module_;
+  l2cap::classic::L2capClassicModule* l2cap_module_{nullptr};
+  std::unique_ptr<l2cap::classic::DynamicChannelManager> dynamic_channel_manager_;
+
+  std::unordered_map<l2cap::Psm, std::shared_ptr<ServiceInterface>> psm_to_service_interface_map_;
+  std::unordered_map<l2cap::Psm, ConnectionOpenCallback> psm_to_on_open_map_;
+
+  std::mutex mutex_;
+  std::unordered_map<l2cap::Psm, std::promise<void>> psm_to_register_complete_map_;
+  std::unordered_map<l2cap::Psm, std::queue<std::promise<uint16_t>>> psm_to_connect_completed_queue_;
+
+  os::Handler* handler_;
+};
+
+L2cap::impl::impl(L2cap& module, l2cap::classic::L2capClassicModule* l2cap_module)
+    : module_(module), l2cap_module_(l2cap_module) {
+  handler_ = module_.GetHandler();
+  dynamic_channel_manager_ = l2cap_module_->GetDynamicChannelManager();
+  connection_interface_manager_.SetHandler(handler_);
+}
+
+void L2cap::impl::OnConnectionOpenNever(std::unique_ptr<l2cap::classic::DynamicChannel> channel) {
+  ASSERT(false);
+}
+
+void L2cap::impl::OnConnectionFailureNever(l2cap::classic::DynamicChannelManager::ConnectionResult result) {
+  ASSERT(false);
+  switch (result.connection_result_code) {
+    case l2cap::classic::DynamicChannelManager::ConnectionResultCode::SUCCESS:
+      LOG_WARN("Connection failed result:success hci:%s", hci::ErrorCodeText(result.hci_error).c_str());
+      break;
+    case l2cap::classic::DynamicChannelManager::ConnectionResultCode::FAIL_NO_SERVICE_REGISTERED:
+      LOG_DEBUG("Connection failed result:no service registered hci:%s", hci::ErrorCodeText(result.hci_error).c_str());
+      break;
+    case l2cap::classic::DynamicChannelManager::ConnectionResultCode::FAIL_HCI_ERROR:
+      LOG_DEBUG("Connection failed result:hci error hci:%s", hci::ErrorCodeText(result.hci_error).c_str());
+      break;
+    case l2cap::classic::DynamicChannelManager::ConnectionResultCode::FAIL_L2CAP_ERROR:
+      LOG_DEBUG("Connection failed result:l2cap error hci:%s l2cap:%s", hci::ErrorCodeText(result.hci_error).c_str(),
+                l2cap::ConnectionResponseResultText(result.l2cap_connection_response_result).c_str());
+      break;
+  }
+}
+
+void L2cap::impl::OpenConnection(l2cap::Psm psm, ConnectionInterfaceDescriptor cid) {
+  LOG_INFO("About to call back to client indicating open connection psm:%hd cid:%hd", psm, cid);
+  psm_to_on_open_map_[psm](psm, cid, [cid](std::function<void(uint16_t cid)> func) {
+    LOG_DEBUG("About to run postable on this thread and inform sdp that connection is open");
+    func(cid);
+  });
+}
+
+void L2cap::impl::RegisterService(l2cap::Psm psm, ConnectionOpenCallback on_open, std::promise<void> completed) {
+  ASSERT(psm_to_service_interface_map_.find(psm) == psm_to_service_interface_map_.end());
+  ASSERT(psm_to_register_complete_map_.find(psm) == psm_to_register_complete_map_.end());
+  ASSERT(psm_to_on_open_map_.find(psm) == psm_to_on_open_map_.end());
+
+  psm_to_on_open_map_[psm] = on_open;
+
+  psm_to_service_interface_map_.emplace(
+      psm, std::make_shared<ServiceInterface>(
+               psm,
+               [this](l2cap::Psm psm, l2cap::classic::DynamicChannelManager::RegistrationResult result) {
+                 LOG_DEBUG("Service has been registered");
+                 ASSERT(psm_to_register_complete_map_.find(psm) != psm_to_register_complete_map_.end());
+                 {
+                   std::unique_lock<std::mutex> lock(mutex_);
+                   auto completed = std::move(psm_to_register_complete_map_[psm]);
+                   psm_to_register_complete_map_.erase(psm);
+                   completed.set_value();
+                 }
+               },
+
+               [this](l2cap::Psm psm, std::unique_ptr<l2cap::classic::DynamicChannel> channel) {
+                 ConnectionInterfaceDescriptor cid = connection_interface_manager_.AddChannel(std::move(channel));
+                 LOG_DEBUG("Connection has been opened cid:%hd psm:%hd", cid, psm);
+                 {
+                   // If initiated locally unblock requestor that
+                   // we now have a connection by providing the
+                   // cid.
+                   std::unique_lock<std::mutex> lock(mutex_);
+                   if (psm_to_connect_completed_queue_.find(psm) != psm_to_connect_completed_queue_.end()) {
+                     if (!psm_to_connect_completed_queue_[psm].empty()) {
+                       LOG_DEBUG("Locally initiated, so inform waiting client of the cid %hd", cid);
+                       auto completed = std::move(psm_to_connect_completed_queue_[psm].front());
+                       psm_to_connect_completed_queue_[psm].pop();
+                       completed.set_value(cid);
+                     }
+                   }
+                   std::this_thread::yield();
+                 }
+                 if (cid != kInvalidConnectionInterfaceDescriptor) {
+                   handler_->Post(common::BindOnce(&L2cap::impl::OpenConnection, common::Unretained(this), psm, cid));
+                 }
+                 usleep(10);
+               }));
+
+  psm_to_service_interface_map_.find(psm)->second->RegisterService(
+      [this](l2cap::Psm psm, l2cap::SecurityPolicy security_policy,
+             l2cap::classic::DynamicChannelManager::OnRegistrationCompleteCallback on_registration_complete,
+             l2cap::classic::DynamicChannelManager::OnConnectionOpenCallback on_connection_open) {
+        bool rc = dynamic_channel_manager_->RegisterService(psm, security_policy, std::move(on_registration_complete),
+                                                            on_connection_open, handler_);
+        ASSERT_LOG(rc == true, "Failed to register classic service");
+      });
+}
+
+void L2cap::impl::UnregisterService(l2cap::Psm psm) {
+  psm_to_service_interface_map_.erase(psm);
+}
+
+void L2cap::impl::CreateConnection(l2cap::Psm psm, hci::Address address, std::promise<uint16_t> completed) {
+  LOG_INFO("Creating connection to psm:%hd device:%s", psm, address.ToString().c_str());
+  {
+    std::unique_lock<std::mutex> lock(mutex_);
+    psm_to_connect_completed_queue_[psm].push(std::move(completed));
+  }
+  bool rc = dynamic_channel_manager_->ConnectChannel(
+      address, psm, common::Bind(&L2cap::impl::OnConnectionOpenNever, common::Unretained(this)),
+      common::Bind(&L2cap::impl::OnConnectionFailureNever, common::Unretained(this)), handler_);
+  ASSERT_LOG(rc == true, "Failed to create classic connection channel");
+}
+
+void L2cap::impl::CloseConnection(ConnectionInterfaceDescriptor cid) {
+  connection_interface_manager_.RemoveConnection(cid);
+}
+
+bool L2cap::impl::Write(ConnectionInterfaceDescriptor cid, std::unique_ptr<packet::RawBuilder> packet) {
+  return connection_interface_manager_.Write(cid, std::move(packet));
+}
+
+void L2cap::RegisterService(uint16_t raw_psm, ConnectionOpenCallback on_open, std::promise<void> completed) {
+  l2cap::Psm psm{raw_psm};
+  pimpl_->RegisterService(psm, on_open, std::move(completed));
+}
+
+void L2cap::UnregisterService(uint16_t raw_psm) {
+  l2cap::Psm psm{raw_psm};
+  pimpl_->UnregisterService(psm);
+}
+
+void L2cap::CreateConnection(uint16_t raw_psm, const std::string address_string, std::promise<uint16_t> completed) {
+  l2cap::Psm psm{raw_psm};
+  hci::Address address;
+  hci::Address::FromString(address_string, address);
+
+  return pimpl_->CreateConnection(psm, address, std::move(completed));
+}
+
+void L2cap::CloseConnection(uint16_t raw_cid) {
+  ConnectionInterfaceDescriptor cid(raw_cid);
+  return pimpl_->CloseConnection(cid);
+}
+
+void L2cap::SetReadDataReadyCallback(uint16_t cid, ReadDataReadyCallback on_data_ready) {
+  pimpl_->connection_interface_manager_.SetReadDataReadyCallback(static_cast<ConnectionInterfaceDescriptor>(cid),
+                                                                 on_data_ready);
+}
+
+void L2cap::SetConnectionClosedCallback(uint16_t cid, ConnectionClosedCallback on_closed) {
+  pimpl_->connection_interface_manager_.SetConnectionClosedCallback(static_cast<ConnectionInterfaceDescriptor>(cid),
+                                                                    on_closed);
+}
+
+bool L2cap::Write(uint16_t cid, const uint8_t* data, size_t len) {
+  auto packet = MakeUniquePacket(data, len);
+  return pimpl_->Write(static_cast<ConnectionInterfaceDescriptor>(cid), std::move(packet));
+}
+
+bool L2cap::WriteFlushable(uint16_t cid, const uint8_t* data, size_t len) {
+  LOG_WARN("UNIMPLEMENTED Write flushable");
+  return false;
+}
+
+bool L2cap::WriteNonFlushable(uint16_t cid, const uint8_t* data, size_t len) {
+  LOG_WARN("UNIMPLEMENTED Write non flushable");
+  return false;
+}
+
+bool L2cap::IsCongested(ConnectionInterfaceDescriptor cid) {
+  LOG_WARN("UNIMPLEMENTED Congestion check on channels or links");
+  return false;
+}
+
+/**
+ * Module methods
+ */
+void L2cap::ListDependencies(ModuleList* list) {
+  list->add<l2cap::classic::L2capClassicModule>();
+}
+
+void L2cap::Start() {
+  pimpl_ = std::make_unique<impl>(*this, GetDependency<l2cap::classic::L2capClassicModule>());
+}
+
+void L2cap::Stop() {
+  pimpl_.reset();
+}
+
+}  // namespace shim
+}  // namespace bluetooth
diff --git a/gd/shim/l2cap.h b/gd/shim/l2cap.h
new file mode 100644
index 0000000..67a75d9
--- /dev/null
+++ b/gd/shim/l2cap.h
@@ -0,0 +1,64 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+#pragma once
+
+#include <cstdint>
+#include <functional>
+#include <future>
+#include <memory>
+#include <string>
+
+#include "module.h"
+#include "shim/il2cap.h"
+
+namespace bluetooth {
+namespace shim {
+
+class L2cap : public bluetooth::Module, public bluetooth::shim::IL2cap {
+ public:
+  void RegisterService(uint16_t psm, ConnectionOpenCallback on_open, std::promise<void> completed) override;
+  void UnregisterService(uint16_t psm) override;
+
+  void CreateConnection(uint16_t psm, const std::string address, std::promise<uint16_t> completed) override;
+  void CloseConnection(uint16_t cid) override;
+
+  void SetReadDataReadyCallback(uint16_t cid, ReadDataReadyCallback on_data_ready) override;
+  void SetConnectionClosedCallback(uint16_t cid, ConnectionClosedCallback on_closed) override;
+
+  bool Write(uint16_t cid, const uint8_t* data, size_t len) override;
+  bool WriteFlushable(uint16_t cid, const uint8_t* data, size_t len) override;
+  bool WriteNonFlushable(uint16_t cid, const uint8_t* data, size_t len) override;
+
+  bool IsCongested(uint16_t cid) override;
+
+  L2cap() = default;
+  ~L2cap() = default;
+
+  static const ModuleFactory Factory;
+
+ protected:
+  void ListDependencies(ModuleList* list) override;  // Module
+  void Start() override;                             // Module
+  void Stop() override;                              // Module
+
+ private:
+  struct impl;
+  std::unique_ptr<impl> pimpl_;
+  DISALLOW_COPY_AND_ASSIGN(L2cap);
+};
+
+}  // namespace shim
+}  // namespace bluetooth
diff --git a/gd/shim/only_include_this_file_into_legacy_stack___ever.h b/gd/shim/only_include_this_file_into_legacy_stack___ever.h
new file mode 100644
index 0000000..bce2a66
--- /dev/null
+++ b/gd/shim/only_include_this_file_into_legacy_stack___ever.h
@@ -0,0 +1,34 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#pragma once
+
+/**
+ * This common file provides the only visibility from the legacy stack into GD stack.
+ *
+ * Only interfaces or APIs should be exported.
+ *
+ * Only common data structures should be used to pass data between the stacks.
+ *
+ */
+#include "gd/shim/iconnectability.h"
+#include "gd/shim/icontroller.h"
+#include "gd/shim/idiscoverability.h"
+#include "gd/shim/ihci_layer.h"
+#include "gd/shim/iinquiry.h"
+#include "gd/shim/il2cap.h"
+#include "gd/shim/ipage.h"
+#include "gd/shim/istack.h"
diff --git a/gd/shim/page.cc b/gd/shim/page.cc
new file mode 100644
index 0000000..aa79d29
--- /dev/null
+++ b/gd/shim/page.cc
@@ -0,0 +1,84 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+#define LOG_TAG "bt_gd_shim"
+
+#include <functional>
+#include <memory>
+
+#include "common/bidi_queue.h"
+#include "hci/address.h"
+#include "hci/controller.h"
+#include "hci/hci_packets.h"
+#include "module.h"
+#include "neighbor/page.h"
+#include "neighbor/scan_parameters.h"
+#include "os/handler.h"
+#include "os/log.h"
+#include "shim/page.h"
+
+namespace bluetooth {
+namespace shim {
+
+const ModuleFactory Page::Factory = ModuleFactory([]() { return new Page(); });
+
+struct Page::impl {
+  impl(neighbor::PageModule* module);
+  ~impl();
+
+  neighbor::PageModule* module_{nullptr};
+};
+
+Page::impl::impl(neighbor::PageModule* module) : module_(module) {}
+
+Page::impl::~impl() {}
+
+void Page::SetScanActivity(uint16_t interval, uint16_t window) {
+  neighbor::ScanParameters params{.interval = static_cast<neighbor::ScanInterval>(interval),
+                                  .window = static_cast<neighbor::ScanWindow>(window)};
+  return pimpl_->module_->SetScanActivity(params);
+}
+
+void Page::GetScanActivity(uint16_t& interval, uint16_t& window) const {
+  neighbor::ScanParameters params = pimpl_->module_->GetScanActivity();
+
+  interval = static_cast<uint16_t>(params.interval);
+  window = static_cast<uint16_t>(params.window);
+}
+
+void Page::SetInterlacedScan() {
+  return pimpl_->module_->SetInterlacedScan();
+}
+void Page::SetStandardScan() {
+  return pimpl_->module_->SetStandardScan();
+}
+
+/**
+ * Module methods
+ */
+void Page::ListDependencies(ModuleList* list) {
+  list->add<neighbor::PageModule>();
+}
+
+void Page::Start() {
+  pimpl_ = std::make_unique<impl>(GetDependency<neighbor::PageModule>());
+}
+
+void Page::Stop() {
+  pimpl_.reset();
+}
+
+}  // namespace shim
+}  // namespace bluetooth
diff --git a/gd/shim/page.h b/gd/shim/page.h
new file mode 100644
index 0000000..b4e71cd
--- /dev/null
+++ b/gd/shim/page.h
@@ -0,0 +1,51 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+#pragma once
+
+#include <memory>
+
+#include "module.h"
+#include "shim/ipage.h"
+
+namespace bluetooth {
+namespace shim {
+
+class Page : public bluetooth::Module, public bluetooth::shim::IPage {
+ public:
+  void SetScanActivity(uint16_t interval, uint16_t window) override;
+  void GetScanActivity(uint16_t& interval, uint16_t& window) const override;
+
+  void SetInterlacedScan() override;
+  void SetStandardScan() override;
+
+  Page() = default;
+  ~Page() = default;
+
+  static const ModuleFactory Factory;
+
+ protected:
+  void ListDependencies(ModuleList* list) override;  // Module
+  void Start() override;                             // Module
+  void Stop() override;                              // Module
+
+ private:
+  struct impl;
+  std::unique_ptr<impl> pimpl_;
+  DISALLOW_COPY_AND_ASSIGN(Page);
+};
+
+}  // namespace shim
+}  // namespace bluetooth
diff --git a/gd/shim/stack.cc b/gd/shim/stack.cc
new file mode 100644
index 0000000..8b02e6b
--- /dev/null
+++ b/gd/shim/stack.cc
@@ -0,0 +1,169 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#define LOG_TAG "bt_gd_shim"
+
+#include "shim/stack.h"
+#include "hal/hci_hal.h"
+#include "hci/acl_manager.h"
+#include "hci/classic_security_manager.h"
+#include "l2cap/classic/l2cap_classic_module.h"
+#include "l2cap/le/l2cap_le_module.h"
+#include "neighbor/connectability.h"
+#include "neighbor/discoverability.h"
+#include "neighbor/inquiry.h"
+#include "neighbor/page.h"
+#include "neighbor/scan.h"
+#include "os/log.h"
+#include "os/thread.h"
+#include "security/security_module.h"
+#include "shim/connectability.h"
+#include "shim/controller.h"
+#include "shim/discoverability.h"
+#include "shim/hci_layer.h"
+#include "shim/inquiry.h"
+#include "shim/l2cap.h"
+#include "shim/page.h"
+#include "stack_manager.h"
+
+using ::bluetooth::os::Thread;
+
+struct bluetooth::shim::Stack::impl {
+  void Start() {
+    if (is_running_) {
+      LOG_ERROR("%s Gd stack already running", __func__);
+      return;
+    }
+
+    LOG_INFO("%s Starting Gd stack", __func__);
+    ModuleList modules;
+    modules.add<::bluetooth::hal::HciHal>();
+    modules.add<::bluetooth::hci::AclManager>();
+    modules.add<::bluetooth::l2cap::classic::L2capClassicModule>();
+    modules.add<::bluetooth::l2cap::le::L2capLeModule>();
+    modules.add<::bluetooth::neighbor::ConnectabilityModule>();
+    modules.add<::bluetooth::neighbor::DiscoverabilityModule>();
+    modules.add<::bluetooth::neighbor::InquiryModule>();
+    modules.add<::bluetooth::neighbor::PageModule>();
+    modules.add<::bluetooth::neighbor::ScanModule>();
+    modules.add<::bluetooth::shim::Controller>();
+    modules.add<::bluetooth::shim::HciLayer>();
+    modules.add<::bluetooth::security::SecurityModule>();
+    modules.add<::bluetooth::shim::Connectability>();
+    modules.add<::bluetooth::shim::Discoverability>();
+    modules.add<::bluetooth::shim::Inquiry>();
+    modules.add<::bluetooth::shim::L2cap>();
+    modules.add<::bluetooth::shim::Page>();
+
+    stack_thread_ = new Thread("gd_stack_thread", Thread::Priority::NORMAL);
+    stack_manager_.StartUp(&modules, stack_thread_);
+    // TODO(cmanton) Gd stack has spun up another thread with no
+    // ability to ascertain the completion
+    is_running_ = true;
+    LOG_INFO("%s Successfully toggled Gd stack", __func__);
+  }
+
+  void Stop() {
+    if (!is_running_) {
+      LOG_ERROR("%s Gd stack not running", __func__);
+      return;
+    }
+
+    stack_manager_.ShutDown();
+    delete stack_thread_;
+    is_running_ = false;
+    LOG_INFO("%s Successfully shut down Gd stack", __func__);
+  }
+
+  IController* GetController() {
+    return stack_manager_.GetInstance<bluetooth::shim::Controller>();
+  }
+
+  IConnectability* GetConnectability() {
+    return stack_manager_.GetInstance<bluetooth::shim::Connectability>();
+  }
+
+  IDiscoverability* GetDiscoverability() {
+    return stack_manager_.GetInstance<bluetooth::shim::Discoverability>();
+  }
+
+  IHciLayer* GetHciLayer() {
+    return stack_manager_.GetInstance<bluetooth::shim::HciLayer>();
+  }
+
+  IInquiry* GetInquiry() {
+    return stack_manager_.GetInstance<bluetooth::shim::Inquiry>();
+  }
+
+  IL2cap* GetL2cap() {
+    return stack_manager_.GetInstance<bluetooth::shim::L2cap>();
+  }
+
+  IPage* GetPage() {
+    return stack_manager_.GetInstance<bluetooth::shim::Page>();
+  }
+
+ private:
+  os::Thread* stack_thread_ = nullptr;
+  bool is_running_ = false;
+  StackManager stack_manager_;
+};
+
+bluetooth::shim::Stack::Stack() {
+  pimpl_ = std::make_unique<impl>();
+  LOG_INFO("%s Created gd stack", __func__);
+}
+
+void bluetooth::shim::Stack::Start() {
+  pimpl_->Start();
+}
+
+void bluetooth::shim::Stack::Stop() {
+  pimpl_->Stop();
+}
+
+bluetooth::shim::IConnectability* bluetooth::shim::Stack::GetConnectability() {
+  return pimpl_->GetConnectability();
+}
+
+bluetooth::shim::IController* bluetooth::shim::Stack::GetController() {
+  return pimpl_->GetController();
+}
+
+bluetooth::shim::IDiscoverability* bluetooth::shim::Stack::GetDiscoverability() {
+  return pimpl_->GetDiscoverability();
+}
+
+bluetooth::shim::IHciLayer* bluetooth::shim::Stack::GetHciLayer() {
+  return pimpl_->GetHciLayer();
+}
+
+bluetooth::shim::IInquiry* bluetooth::shim::Stack::GetInquiry() {
+  return pimpl_->GetInquiry();
+}
+
+bluetooth::shim::IL2cap* bluetooth::shim::Stack::GetL2cap() {
+  return pimpl_->GetL2cap();
+}
+
+bluetooth::shim::IPage* bluetooth::shim::Stack::GetPage() {
+  return pimpl_->GetPage();
+}
+
+bluetooth::shim::IStack* bluetooth::shim::GetGabeldorscheStack() {
+  static IStack* instance = new Stack();
+  return instance;
+}
diff --git a/gd/shim/stack.h b/gd/shim/stack.h
new file mode 100644
index 0000000..f56852a
--- /dev/null
+++ b/gd/shim/stack.h
@@ -0,0 +1,61 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#pragma once
+
+#include <memory>
+
+#include "shim/iconnectability.h"
+#include "shim/icontroller.h"
+#include "shim/idiscoverability.h"
+#include "shim/ihci_layer.h"
+#include "shim/iinquiry.h"
+#include "shim/il2cap.h"
+#include "shim/ipage.h"
+#include "shim/istack.h"
+
+/**
+ * The shim layer implementation on the Gd stack side.
+ */
+namespace bluetooth {
+namespace shim {
+
+class Stack : public IStack {
+ public:
+  Stack();
+  ~Stack() = default;
+
+  void Start() override;  // IStack
+  void Stop() override;   // IStack
+
+  IController* GetController() override;  // IStack
+  IConnectability* GetConnectability() override;  // IStack
+  IHciLayer* GetHciLayer() override;      // IStack
+  IDiscoverability* GetDiscoverability() override;  // IStack
+  IInquiry* GetInquiry() override;                  // IStack
+  IL2cap* GetL2cap() override;                      // IStack
+  IPage* GetPage() override;                        // IStack
+
+ private:
+  struct impl;
+  std::unique_ptr<impl> pimpl_;
+
+  Stack(const Stack&) = delete;
+  void operator=(const Stack&) = delete;
+};
+
+}  // namespace shim
+}  // namespace bluetooth
diff --git a/gd/smp/Android.bp b/gd/smp/Android.bp
deleted file mode 100644
index b67878f..0000000
--- a/gd/smp/Android.bp
+++ /dev/null
@@ -1,14 +0,0 @@
-filegroup {
-    name: "BluetoothSmpSources",
-    srcs: [
-        "ecc/multprecision.cc",
-        "ecc/p_256_ecc_pp.cc",
-    ]
-}
-
-filegroup {
-    name: "BluetoothSmpTestSources",
-    srcs: [
-        "ecc/multipoint_test.cc",
-    ]
-}
\ No newline at end of file
diff --git a/gd/stack_manager.cc b/gd/stack_manager.cc
index ad83674..9c01d56 100644
--- a/gd/stack_manager.cc
+++ b/gd/stack_manager.cc
@@ -20,11 +20,12 @@
 #include <future>
 #include <queue>
 
+#include "common/bind.h"
 #include "hal/hci_hal.h"
-#include "os/thread.h"
+#include "module.h"
 #include "os/handler.h"
 #include "os/log.h"
-#include "module.h"
+#include "os/thread.h"
 
 using ::bluetooth::os::Handler;
 using ::bluetooth::os::Thread;
@@ -35,33 +36,39 @@
   management_thread_ = new Thread("management_thread", Thread::Priority::NORMAL);
   handler_ = new Handler(management_thread_);
 
-  std::promise<void>* promise = new std::promise<void>();
-  handler_->Post([this, promise, modules, stack_thread]() {
-    registry_.Start(modules, stack_thread);
-    promise->set_value();
-  });
+  std::promise<void> promise;
+  auto future = promise.get_future();
+  handler_->Post(common::BindOnce(&StackManager::handle_start_up, common::Unretained(this), modules, stack_thread,
+                                  std::move(promise)));
 
-  auto future = promise->get_future();
   auto init_status = future.wait_for(std::chrono::seconds(3));
   ASSERT_LOG(init_status == std::future_status::ready, "Can't start stack");
-  delete promise;
 
   LOG_INFO("init complete");
 }
 
-void StackManager::ShutDown() {
-  std::promise<void>* promise = new std::promise<void>();
-  handler_->Post([this, promise]() {
-    registry_.StopAll();
-    promise->set_value();
-  });
+void StackManager::handle_start_up(ModuleList* modules, Thread* stack_thread, std::promise<void> promise) {
+  registry_.Start(modules, stack_thread);
+  promise.set_value();
+}
 
-  auto future = promise->get_future();
+void StackManager::ShutDown() {
+  std::promise<void> promise;
+  auto future = promise.get_future();
+  handler_->Post(common::BindOnce(&StackManager::handle_shut_down, common::Unretained(this), std::move(promise)));
+
   auto stop_status = future.wait_for(std::chrono::seconds(3));
   ASSERT_LOG(stop_status == std::future_status::ready, "Can't stop stack");
 
-  delete promise;
+  handler_->Clear();
+  handler_->WaitUntilStopped(std::chrono::milliseconds(20));
   delete handler_;
   delete management_thread_;
 }
+
+void StackManager::handle_shut_down(std::promise<void> promise) {
+  registry_.StopAll();
+  promise.set_value();
+}
+
 }  // namespace bluetooth
diff --git a/gd/stack_manager.h b/gd/stack_manager.h
index 2f971cb..9a86480 100644
--- a/gd/stack_manager.h
+++ b/gd/stack_manager.h
@@ -33,9 +33,12 @@
   }
 
  private:
-  os::Thread* management_thread_;
-  os::Handler* handler_;
+  os::Thread* management_thread_ = nullptr;
+  os::Handler* handler_ = nullptr;
   ModuleRegistry registry_;
+
+  void handle_start_up(ModuleList* modules, os::Thread* stack_thread, std::promise<void> promise);
+  void handle_shut_down(std::promise<void> promise);
 };
 
 }  // namespace bluetooth
diff --git a/gd/stack_manager_unittest.cc b/gd/stack_manager_unittest.cc
new file mode 100644
index 0000000..e79a94f
--- /dev/null
+++ b/gd/stack_manager_unittest.cc
@@ -0,0 +1,56 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "stack_manager.h"
+
+#include "gtest/gtest.h"
+#include "os/thread.h"
+
+namespace bluetooth {
+namespace {
+
+TEST(StackManagerTest, start_and_shutdown_no_module) {
+  StackManager stack_manager;
+  ModuleList module_list;
+  os::Thread thread{"test_thread", os::Thread::Priority::NORMAL};
+  stack_manager.StartUp(&module_list, &thread);
+  stack_manager.ShutDown();
+}
+
+class TestModuleNoDependency : public Module {
+ public:
+  static const ModuleFactory Factory;
+
+ protected:
+  void ListDependencies(ModuleList* list) override {}
+  void Start() override {}
+  void Stop() override {}
+};
+
+const ModuleFactory TestModuleNoDependency::Factory = ModuleFactory([]() { return new TestModuleNoDependency(); });
+
+TEST(StackManagerTest, get_module_instance) {
+  StackManager stack_manager;
+  ModuleList module_list;
+  module_list.add<TestModuleNoDependency>();
+  os::Thread thread{"test_thread", os::Thread::Priority::NORMAL};
+  stack_manager.StartUp(&module_list, &thread);
+  EXPECT_NE(stack_manager.GetInstance<TestModuleNoDependency>(), nullptr);
+  stack_manager.ShutDown();
+}
+
+}  // namespace
+}  // namespace bluetooth
diff --git a/hci/Android.bp b/hci/Android.bp
index 635d939..6d57ebf 100644
--- a/hci/Android.bp
+++ b/hci/Android.bp
@@ -4,8 +4,6 @@
     shared_libs: [
         "android.hardware.bluetooth@1.0",
         "libhidlbase",
-        "libhidltransport",
-        "libhwbinder",
     ],
 }
 
diff --git a/hci/include/btsnoop.h b/hci/include/btsnoop.h
index e897a96..476c62d 100644
--- a/hci/include/btsnoop.h
+++ b/hci/include/btsnoop.h
@@ -29,6 +29,28 @@
   // true, the packet is marked as incoming. Otherwise, the packet is marked
   // as outgoing.
   void (*capture)(const BT_HDR* packet, bool is_received);
+
+  // Set a L2CAP channel as whitelisted, allowing packets with that L2CAP CID
+  // to show up in the snoop logs.
+  void (*whitelist_l2c_channel)(uint16_t conn_handle, uint16_t local_cid,
+                                uint16_t remote_cid);
+
+  // Set a RFCOMM dlci as whitelisted, allowing packets with that RFCOMM CID
+  // to show up in the snoop logs. The local_cid is used to associate it with
+  // its corrisponding ACL connection. The dlci is the channel with direction
+  // so there is no chance of a collision if two services are using the same
+  // channel but in different directions.
+  void (*whitelist_rfc_dlci)(uint16_t local_cid, uint8_t dlci);
+
+  // Indicate that the provided L2CAP channel is being used for RFCOMM.
+  // If packets with the provided L2CAP CID are encountered, they will be
+  // filtered on RFCOMM based on channels provided to |filter_rfc_channel|.
+  void (*add_rfc_l2c_channel)(uint16_t conn_handle, uint16_t local_cid,
+                              uint16_t remote_cid);
+
+  // Clear an L2CAP channel from being filtered.
+  void (*clear_l2cap_whitelist)(uint16_t conn_handle, uint16_t local_cid,
+                                uint16_t remote_cid);
 } btsnoop_t;
 
 const btsnoop_t* btsnoop_get_interface(void);
diff --git a/hci/include/hci_layer.h b/hci/include/hci_layer.h
index 5eb2bd5..cc74469 100644
--- a/hci/include/hci_layer.h
+++ b/hci/include/hci_layer.h
@@ -83,6 +83,11 @@
   void (*transmit_downward)(uint16_t type, void* data);
 } hci_t;
 
+namespace bluetooth {
+namespace legacy {
+const hci_t* hci_layer_get_interface();
+}  // namespace legacy
+}  // namespace bluetooth
 const hci_t* hci_layer_get_interface();
 
 const hci_t* hci_layer_get_test_interface(
diff --git a/hci/src/btsnoop.cc b/hci/src/btsnoop.cc
index 6938725..ad06ac7 100644
--- a/hci/src/btsnoop.cc
+++ b/hci/src/btsnoop.cc
@@ -21,6 +21,7 @@
 #include <mutex>
 
 #include <arpa/inet.h>
+#include <base/logging.h>
 #include <errno.h>
 #include <fcntl.h>
 #include <inttypes.h>
@@ -34,14 +35,21 @@
 #include <sys/time.h>
 #include <sys/uio.h>
 #include <unistd.h>
+#include <mutex>
+#include <unordered_map>
+#include <unordered_set>
 
 #include "bt_types.h"
 #include "common/time_util.h"
 #include "hci/include/btsnoop.h"
 #include "hci/include/btsnoop_mem.h"
 #include "hci_layer.h"
+#include "internal_include/bt_trace.h"
 #include "osi/include/log.h"
 #include "osi/include/properties.h"
+#include "stack/include/hcimsgs.h"
+#include "stack/include/rfcdefs.h"
+#include "stack/l2cap/l2c_int.h"
 #include "stack_config.h"
 
 // The number of of packets per btsnoop file before we rotate to the next
@@ -50,7 +58,14 @@
 // property
 #define DEFAULT_BTSNOOP_SIZE 0xffff
 
-#define BTSNOOP_ENABLE_PROPERTY "persist.bluetooth.btsnoopenable"
+#define IS_DEBUGGABLE_PROPERTY "ro.debuggable"
+
+#define BTSNOOP_LOG_MODE_PROPERTY "persist.bluetooth.btsnooplogmode"
+#define BTSNOOP_DEFAULT_MODE_PROPERTY "persist.bluetooth.btsnoopdefaultmode"
+#define BTSNOOP_MODE_DISABLED "disabled"
+#define BTSNOOP_MODE_FILTERED "filtered"
+#define BTSNOOP_MODE_FULL "full"
+
 #define BTSNOOP_PATH_PROPERTY "persist.bluetooth.btsnooppath"
 #define DEFAULT_BTSNOOP_PATH "/data/misc/bluetooth/logs/btsnoop_hci.log"
 #define BTSNOOP_MAX_PACKETS_PROPERTY "persist.bluetooth.btsnoopsize"
@@ -65,33 +80,138 @@
 // Epoch in microseconds since 01/01/0000.
 static const uint64_t BTSNOOP_EPOCH_DELTA = 0x00dcddb30f2f8000ULL;
 
+// Number of bytes into a packet where you can find the value for a channel.
+static const size_t ACL_CHANNEL_OFFSET = 0;
+static const size_t L2C_CHANNEL_OFFSET = 6;
+static const size_t RFC_CHANNEL_OFFSET = 8;
+static const size_t RFC_EVENT_OFFSET = 9;
+
+// The size of the L2CAP header. All information past this point is removed from
+// a filtered packet.
+static const uint32_t L2C_HEADER_SIZE = 9;
+
 static int logfile_fd = INVALID_FD;
 static std::mutex btsnoop_mutex;
 
 static int32_t packets_per_file;
 static int32_t packet_counter;
 
+// Channel tracking variables for filtering.
+
+// Keeps track of L2CAP channels that need to be filtered out of the snoop
+// logs.
+class FilterTracker {
+ public:
+  // NOTE: 1 is used as a static CID for L2CAP signaling
+  std::unordered_set<uint16_t> l2c_local_cid = {1};
+  std::unordered_set<uint16_t> l2c_remote_cid = {1};
+  uint16_t rfc_local_cid = 0;
+  uint16_t rfc_remote_cid = 0;
+  std::unordered_set<uint16_t> rfc_channels = {0};
+
+  // Adds L2C channel to whitelist.
+  void addL2cCid(uint16_t local_cid, uint16_t remote_cid) {
+    l2c_local_cid.insert(local_cid);
+    l2c_remote_cid.insert(remote_cid);
+  }
+
+  // Sets L2CAP channel that RFCOMM uses.
+  void setRfcCid(uint16_t local_cid, uint16_t remote_cid) {
+    rfc_local_cid = local_cid;
+    rfc_remote_cid = remote_cid;
+  }
+
+  // Remove L2C channel from whitelist.
+  void removeL2cCid(uint16_t local_cid, uint16_t remote_cid) {
+    if (rfc_local_cid == local_cid) {
+      rfc_channels.clear();
+      rfc_channels.insert(0);
+      rfc_local_cid = 0;
+      rfc_remote_cid = 0;
+    }
+
+    l2c_local_cid.erase(local_cid);
+    l2c_remote_cid.erase(remote_cid);
+  }
+
+  void addRfcDlci(uint8_t channel) { rfc_channels.insert(channel); }
+
+  bool isWhitelistedL2c(bool local, uint16_t cid) {
+    const auto& set = local ? l2c_local_cid : l2c_remote_cid;
+    return (set.find(cid) != set.end());
+  }
+
+  bool isRfcChannel(bool local, uint16_t cid) {
+    const auto& channel = local ? rfc_local_cid : rfc_remote_cid;
+    return cid == channel;
+  }
+
+  bool isWhitelistedDlci(uint8_t dlci) {
+    return rfc_channels.find(dlci) != rfc_channels.end();
+  }
+};
+
+std::mutex filter_list_mutex;
+std::unordered_map<uint16_t, FilterTracker> filter_list;
+std::unordered_map<uint16_t, uint16_t> local_cid_to_acl;
+
+// Cached value for whether full snoop logs are enabled. So the property isn't
+// checked for every packet.
+static bool is_btsnoop_enabled;
+static bool is_btsnoop_filtered;
+
 // TODO(zachoverflow): merge btsnoop and btsnoop_net together
 void btsnoop_net_open();
 void btsnoop_net_close();
 void btsnoop_net_write(const void* data, size_t length);
 
-static void delete_btsnoop_files();
-static bool is_btsnoop_enabled();
-static char* get_btsnoop_log_path(char* log_path);
-static char* get_btsnoop_last_log_path(char* last_log_path, char* log_path);
+static void delete_btsnoop_files(bool filtered);
+static std::string get_btsnoop_log_path(bool filtered);
+static std::string get_btsnoop_last_log_path(std::string log_path);
 static void open_next_snoop_file();
 static void btsnoop_write_packet(packet_type_t type, uint8_t* packet,
                                  bool is_received, uint64_t timestamp_us);
 
 // Module lifecycle functions
 
-static future_t* start_up(void) {
+static future_t* start_up() {
+  std::array<char, PROPERTY_VALUE_MAX> property = {};
   std::lock_guard<std::mutex> lock(btsnoop_mutex);
 
-  if (!is_btsnoop_enabled()) {
-    delete_btsnoop_files();
+  // Default mode is FILTERED on userdebug/eng build, DISABLED on user build.
+  // It can also be overwritten by modifying the global setting.
+  int is_debuggable = osi_property_get_int32(IS_DEBUGGABLE_PROPERTY, 0);
+  std::string default_mode = BTSNOOP_MODE_DISABLED;
+  if (is_debuggable) {
+    int len = osi_property_get(BTSNOOP_DEFAULT_MODE_PROPERTY, property.data(),
+                               BTSNOOP_MODE_DISABLED);
+    default_mode = std::string(property.data(), len);
+  }
+
+  // Get the actual mode
+  int len = osi_property_get(BTSNOOP_LOG_MODE_PROPERTY, property.data(),
+                             default_mode.c_str());
+  std::string btsnoop_mode(property.data(), len);
+
+  if (btsnoop_mode == BTSNOOP_MODE_FILTERED) {
+    LOG(INFO) << __func__ << ": Filtered Snoop Logs enabled";
+    is_btsnoop_enabled = true;
+    is_btsnoop_filtered = true;
+    delete_btsnoop_files(false);
+  } else if (btsnoop_mode == BTSNOOP_MODE_FULL) {
+    LOG(INFO) << __func__ << ": Snoop Logs fully enabled";
+    is_btsnoop_enabled = true;
+    is_btsnoop_filtered = false;
+    delete_btsnoop_files(true);
   } else {
+    LOG(INFO) << __func__ << ": Snoop Logs disabled";
+    is_btsnoop_enabled = false;
+    is_btsnoop_filtered = false;
+    delete_btsnoop_files(true);
+    delete_btsnoop_files(false);
+  }
+
+  if (is_btsnoop_enabled) {
     open_next_snoop_file();
     packets_per_file = osi_property_get_int32(BTSNOOP_MAX_PACKETS_PROPERTY,
                                               DEFAULT_BTSNOOP_SIZE);
@@ -104,14 +224,21 @@
 static future_t* shut_down(void) {
   std::lock_guard<std::mutex> lock(btsnoop_mutex);
 
-  if (!is_btsnoop_enabled()) {
-    delete_btsnoop_files();
+  if (is_btsnoop_enabled) {
+    if (is_btsnoop_filtered) {
+      delete_btsnoop_files(false);
+    } else {
+      delete_btsnoop_files(true);
+    }
+  } else {
+    delete_btsnoop_files(true);
+    delete_btsnoop_files(false);
   }
 
   if (logfile_fd != INVALID_FD) close(logfile_fd);
   logfile_fd = INVALID_FD;
 
-  btsnoop_net_close();
+  if (is_btsnoop_enabled) btsnoop_net_close();
 
   return NULL;
 }
@@ -129,7 +256,12 @@
   uint8_t* p = const_cast<uint8_t*>(buffer->data + buffer->offset);
 
   std::lock_guard<std::mutex> lock(btsnoop_mutex);
-  uint64_t timestamp_us = bluetooth::common::time_gettimeofday_us();
+
+  struct timespec ts_now = {};
+  clock_gettime(CLOCK_REALTIME, &ts_now);
+  uint64_t timestamp_us =
+      ((uint64_t)ts_now.tv_sec * 1000000L) + ((uint64_t)ts_now.tv_nsec / 1000);
+
   btsnoop_mem_capture(buffer, timestamp_us);
 
   if (logfile_fd == INVALID_FD) return;
@@ -152,39 +284,75 @@
   }
 }
 
-static const btsnoop_t interface = {capture};
+static void whitelist_l2c_channel(uint16_t conn_handle, uint16_t local_cid,
+                                  uint16_t remote_cid) {
+  LOG(INFO) << __func__
+            << ": Whitelisting l2cap channel. conn_handle=" << conn_handle
+            << " cid=" << loghex(local_cid) << ":" << loghex(remote_cid);
+  std::lock_guard lock(filter_list_mutex);
 
-const btsnoop_t* btsnoop_get_interface() {
-  return &interface;
+  // This will create the entry if there is no associated filter with the
+  // connection.
+  filter_list[conn_handle].addL2cCid(local_cid, remote_cid);
 }
 
-// Internal functions
-static void delete_btsnoop_files() {
-  LOG_VERBOSE(LOG_TAG, "Deleting snoop log if it exists");
-  char log_path[PROPERTY_VALUE_MAX];
-  char last_log_path[PROPERTY_VALUE_MAX + sizeof(".last")];
-  get_btsnoop_log_path(log_path);
-  get_btsnoop_last_log_path(last_log_path, log_path);
-  remove(log_path);
-  remove(last_log_path);
+static void whitelist_rfc_dlci(uint16_t local_cid, uint8_t dlci) {
+  LOG(INFO) << __func__
+            << ": Whitelisting rfcomm channel. L2CAP CID=" << loghex(local_cid)
+            << " DLCI=" << loghex(dlci);
+  std::lock_guard lock(filter_list_mutex);
+
+  tL2C_CCB* p_ccb = l2cu_find_ccb_by_cid(nullptr, local_cid);
+  filter_list[p_ccb->p_lcb->handle].addRfcDlci(dlci);
 }
 
-static bool is_btsnoop_enabled() {
-  char btsnoop_enabled[PROPERTY_VALUE_MAX] = {0};
-  osi_property_get(BTSNOOP_ENABLE_PROPERTY, btsnoop_enabled, "false");
-  return strncmp(btsnoop_enabled, "true", 4) == 0;
+static void add_rfc_l2c_channel(uint16_t conn_handle, uint16_t local_cid,
+                                uint16_t remote_cid) {
+  LOG(INFO) << __func__
+            << ": rfcomm data going over l2cap channel. conn_handle="
+            << conn_handle << " cid=" << loghex(local_cid) << ":"
+            << loghex(remote_cid);
+  std::lock_guard lock(filter_list_mutex);
+
+  filter_list[conn_handle].setRfcCid(local_cid, remote_cid);
+  local_cid_to_acl.insert({local_cid, conn_handle});
 }
 
-static char* get_btsnoop_log_path(char* btsnoop_path) {
+static void clear_l2cap_whitelist(uint16_t conn_handle, uint16_t local_cid,
+                                  uint16_t remote_cid) {
+  LOG(INFO) << __func__
+            << ": Clearing whitelist from l2cap channel. conn_handle="
+            << conn_handle << " cid=" << local_cid << ":" << remote_cid;
+
+  std::lock_guard lock(filter_list_mutex);
+  filter_list[conn_handle].removeL2cCid(local_cid, remote_cid);
+}
+
+static const btsnoop_t interface = {capture, whitelist_l2c_channel,
+                                    whitelist_rfc_dlci, add_rfc_l2c_channel,
+                                    clear_l2cap_whitelist};
+
+const btsnoop_t* btsnoop_get_interface() { return &interface; }
+
+static void delete_btsnoop_files(bool filtered) {
+  LOG(INFO) << __func__
+            << ": Deleting snoop logs if they exist. filtered = " << filtered;
+  auto log_path = get_btsnoop_log_path(filtered);
+  remove(log_path.c_str());
+  remove(get_btsnoop_last_log_path(log_path).c_str());
+}
+
+std::string get_btsnoop_log_path(bool filtered) {
+  char btsnoop_path[PROPERTY_VALUE_MAX];
   osi_property_get(BTSNOOP_PATH_PROPERTY, btsnoop_path, DEFAULT_BTSNOOP_PATH);
-  return btsnoop_path;
+  std::string result(btsnoop_path);
+  if (filtered) result = result.append(".filtered");
+
+  return result;
 }
 
-static char* get_btsnoop_last_log_path(char* last_log_path,
-                                       char* btsnoop_path) {
-  snprintf(last_log_path, PROPERTY_VALUE_MAX + sizeof(".last"), "%s.last",
-           btsnoop_path);
-  return last_log_path;
+std::string get_btsnoop_last_log_path(std::string btsnoop_path) {
+  return btsnoop_path.append(".last");
 }
 
 static void open_next_snoop_file() {
@@ -195,22 +363,20 @@
     logfile_fd = INVALID_FD;
   }
 
-  char log_path[PROPERTY_VALUE_MAX];
-  char last_log_path[PROPERTY_VALUE_MAX + sizeof(".last")];
-  get_btsnoop_log_path(log_path);
-  get_btsnoop_last_log_path(last_log_path, log_path);
+  auto log_path = get_btsnoop_log_path(is_btsnoop_filtered);
+  auto last_log_path = get_btsnoop_last_log_path(log_path);
 
-  if (rename(log_path, last_log_path) != 0 && errno != ENOENT)
-    LOG_ERROR(LOG_TAG, "%s unable to rename '%s' to '%s': %s", __func__,
-              log_path, last_log_path, strerror(errno));
+  if (rename(log_path.c_str(), last_log_path.c_str()) != 0 && errno != ENOENT)
+    LOG(ERROR) << __func__ << ": unable to rename '" << log_path << "' to '"
+               << last_log_path << "' : " << strerror(errno);
 
   mode_t prevmask = umask(0);
-  logfile_fd = open(log_path, O_WRONLY | O_CREAT | O_TRUNC,
+  logfile_fd = open(log_path.c_str(), O_WRONLY | O_CREAT | O_TRUNC,
                     S_IRUSR | S_IWUSR | S_IRGRP | S_IWGRP | S_IROTH);
   umask(prevmask);
   if (logfile_fd == INVALID_FD) {
-    LOG_ERROR(LOG_TAG, "%s unable to open '%s': %s", __func__, log_path,
-              strerror(errno));
+    LOG(ERROR) << __func__ << ": unable to open '" << log_path
+               << "' : " << strerror(errno);
     return;
   }
 
@@ -235,6 +401,32 @@
   return ll;
 }
 
+static bool should_filter_log(bool is_received, uint8_t* packet) {
+  uint16_t acl_handle =
+      HCID_GET_HANDLE((((uint16_t)packet[ACL_CHANNEL_OFFSET + 1]) << 8) +
+                      packet[ACL_CHANNEL_OFFSET]);
+
+  std::lock_guard lock(filter_list_mutex);
+  auto& filters = filter_list[acl_handle];
+  uint16_t l2c_channel =
+      (packet[L2C_CHANNEL_OFFSET + 1] << 8) + packet[L2C_CHANNEL_OFFSET];
+  if (filters.isRfcChannel(is_received, l2c_channel)) {
+    uint8_t rfc_event = packet[RFC_EVENT_OFFSET] & 0b11101111;
+    if (rfc_event == RFCOMM_SABME || rfc_event == RFCOMM_UA) {
+      return false;
+    }
+
+    uint8_t rfc_dlci = packet[RFC_CHANNEL_OFFSET] >> 2;
+    if (!filters.isWhitelistedDlci(rfc_dlci)) {
+      return true;
+    }
+  } else if (!filters.isWhitelistedL2c(is_received, l2c_channel)) {
+    return true;
+  }
+
+  return false;
+}
+
 static void btsnoop_write_packet(packet_type_t type, uint8_t* packet,
                                  bool is_received, uint64_t timestamp_us) {
   uint32_t length_he = 0;
@@ -261,7 +453,15 @@
 
   btsnoop_header_t header;
   header.length_original = htonl(length_he);
-  header.length_captured = header.length_original;
+
+  bool blacklisted = false;
+  if (is_btsnoop_filtered && type == kAclPacket) {
+    blacklisted = should_filter_log(is_received, packet);
+  }
+
+  header.length_captured =
+      blacklisted ? htonl(L2C_HEADER_SIZE) : header.length_original;
+  if (blacklisted) length_he = L2C_HEADER_SIZE;
   header.flags = htonl(flags);
   header.dropped_packets = 0;
   header.timestamp = htonll(timestamp_us + BTSNOOP_EPOCH_DELTA);
diff --git a/hci/src/hci_layer.cc b/hci/src/hci_layer.cc
index ed2908c..1a4f703 100644
--- a/hci/src/hci_layer.cc
+++ b/hci/src/hci_layer.cc
@@ -44,6 +44,7 @@
 #include "hci_internals.h"
 #include "hcidefs.h"
 #include "hcimsgs.h"
+#include "main/shim/shim.h"
 #include "osi/include/alarm.h"
 #include "osi/include/list.h"
 #include "osi/include/log.h"
@@ -510,8 +511,7 @@
 
   uint8_t* hci_packet = reinterpret_cast<uint8_t*>(bt_hdr + 1);
 
-  UINT16_TO_STREAM(hci_packet,
-                   HCI_GRP_VENDOR_SPECIFIC | HCI_CONTROLLER_DEBUG_INFO_OCF);
+  UINT16_TO_STREAM(hci_packet, HCI_CONTROLLER_DEBUG_INFO);
   UINT8_TO_STREAM(hci_packet, 0);  // No parameters
 
   hci_firmware_log_fd = hci_open_firmware_log_file();
@@ -720,7 +720,21 @@
   }
 }
 
+namespace bluetooth {
+namespace shim {
+const hci_t* hci_layer_get_interface();
+}  // namespace shim
+}  // namespace bluetooth
+
 const hci_t* hci_layer_get_interface() {
+  if (bluetooth::shim::is_gd_shim_enabled()) {
+    return bluetooth::shim::hci_layer_get_interface();
+  } else {
+    return bluetooth::legacy::hci_layer_get_interface();
+  }
+}
+
+const hci_t* bluetooth::legacy::hci_layer_get_interface() {
   buffer_allocator = buffer_allocator_get_interface();
   btsnoop = btsnoop_get_interface();
   packet_fragmenter = packet_fragmenter_get_interface();
diff --git a/hci/src/packet_fragmenter.cc b/hci/src/packet_fragmenter.cc
index 921ac82..f688982 100644
--- a/hci/src/packet_fragmenter.cc
+++ b/hci/src/packet_fragmenter.cc
@@ -123,12 +123,10 @@
   if ((packet->event & MSG_EVT_MASK) == MSG_HC_TO_STACK_HCI_ACL) {
     uint8_t* stream = packet->data;
     uint16_t handle;
-    uint16_t l2cap_length;
     uint16_t acl_length;
 
     STREAM_TO_UINT16(handle, stream);
     STREAM_TO_UINT16(acl_length, stream);
-    STREAM_TO_UINT16(l2cap_length, stream);
 
     CHECK(acl_length == packet->len - HCI_ACL_PREAMBLE_SIZE);
 
@@ -136,6 +134,13 @@
     handle = handle & HANDLE_MASK;
 
     if (boundary_flag == START_PACKET_BOUNDARY) {
+      if (acl_length < 2) {
+        LOG_WARN(LOG_TAG, "%s invalid acl_length %d", __func__, acl_length);
+        buffer_allocator->free(packet);
+        return;
+      }
+      uint16_t l2cap_length;
+      STREAM_TO_UINT16(l2cap_length, stream);
       auto map_iter = partial_packets.find(handle);
       if (map_iter != partial_packets.end()) {
         LOG_WARN(LOG_TAG,
@@ -216,7 +221,7 @@
                  "%s got packet which would exceed expected length of %d. "
                  "Truncating.",
                  __func__, partial_packet->len);
-        packet->len = partial_packet->len - partial_packet->offset;
+        packet->len = (partial_packet->len - partial_packet->offset) + packet->offset;
         projected_offset = partial_packet->len;
       }
 
diff --git a/include/Android.bp b/include/Android.bp
index 01a01b5..1f35206 100644
--- a/include/Android.bp
+++ b/include/Android.bp
@@ -1,7 +1,6 @@
 cc_library_headers {
     name: "avrcp_headers",
     defaults: ["libchrome_support_defaults"],
-    include_dirs: ["system/bt/internal_include"],
     export_include_dirs: ["./hardware/avrcp/"],
     header_libs: ["internal_include_headers"],
     export_header_lib_headers: ["internal_include_headers"],
diff --git a/include/hardware/bluetooth.h b/include/hardware/bluetooth.h
index f97e116..063abf9 100644
--- a/include/hardware/bluetooth.h
+++ b/include/hardware/bluetooth.h
@@ -466,11 +466,16 @@
   /**
    * Opens the interface and provides the callback routines
    * to the implemenation of this interface.
+   * The |start_restricted| flag inits the adapter in restricted mode. In
+   * restricted mode, bonds that are created are marked as restricted in the
+   * config file. These devices are deleted upon leaving restricted mode.
+   * The |is_single_user_mode| flag inits the adapter in NIAP mode.
    */
-  int (*init)(bt_callbacks_t* callbacks);
+  int (*init)(bt_callbacks_t* callbacks, bool guest_mode,
+              bool is_single_user_mode);
 
   /** Enable Bluetooth. */
-  int (*enable)(bool guest_mode);
+  int (*enable)();
 
   /** Disable Bluetooth. */
   int (*disable)(void);
diff --git a/include/hardware/bt_hf_client.h b/include/hardware/bt_hf_client.h
index a31de0f..d8f3a50 100644
--- a/include/hardware/bt_hf_client.h
+++ b/include/hardware/bt_hf_client.h
@@ -292,6 +292,12 @@
  */
 typedef void (*bthf_client_ring_indication_callback)(const RawAddress* bd_addr);
 
+/**
+ * Callback for sending unknown (vendor specific) event
+ */
+typedef void (*bthf_client_unknown_event_callback)(const RawAddress* bd_addr,
+                                                   const char* unknow_event);
+
 /** BT-HF callback structure. */
 typedef struct {
   /** set to sizeof(BtHfClientCallbacks) */
@@ -317,6 +323,7 @@
   bthf_client_in_band_ring_tone_callback in_band_ring_tone_cb;
   bthf_client_last_voice_tag_number_callback last_voice_tag_number_callback;
   bthf_client_ring_indication_callback ring_indication_cb;
+  bthf_client_unknown_event_callback unknown_event_cb;
 } bthf_client_callbacks_t;
 
 /** Represents the standard BT-HF interface. */
diff --git a/internal_include/bt_target.h b/internal_include/bt_target.h
index 67a67c5..1356d2e 100644
--- a/internal_include/bt_target.h
+++ b/internal_include/bt_target.h
@@ -108,7 +108,7 @@
 #endif
 
 #ifndef BTA_DM_SDP_DB_SIZE
-#define BTA_DM_SDP_DB_SIZE 8000
+#define BTA_DM_SDP_DB_SIZE 20000
 #endif
 
 #ifndef HL_INCLUDED
@@ -534,7 +534,7 @@
 
 /* Whether link wants to be the master or the slave. */
 #ifndef L2CAP_DESIRED_LINK_ROLE
-#define L2CAP_DESIRED_LINK_ROLE HCI_ROLE_SLAVE
+#define L2CAP_DESIRED_LINK_ROLE HCI_ROLE_MASTER
 #endif
 
 /* Include Non-Flushable Packet Boundary Flag feature of Lisbon */
diff --git a/main/Android.bp b/main/Android.bp
index f90d89d..fec6644 100644
--- a/main/Android.bp
+++ b/main/Android.bp
@@ -1,18 +1,32 @@
 // Bluetooth main HW module / shared library for target
 // ========================================================
+filegroup {
+    name: "LibBluetoothSources",
+    srcs: [
+        "bte_conf.cc",
+        "bte_init.cc",
+        "bte_init_cpp_logging.cc",
+        "bte_logmsg.cc",
+        "bte_main.cc",
+        "shim/btm.cc",
+        "shim/btm_api.cc",
+        "shim/controller.cc",
+        "shim/entry.cc",
+        "shim/hci_layer.cc",
+        "shim/l2c_api.cc",
+        "shim/l2cap.cc",
+        "shim/shim.cc",
+        "stack_config.cc",
+    ]
+}
+
 cc_library_shared {
     name: "libbluetooth",
     defaults: ["fluoride_defaults"],
     header_libs: ["libbluetooth_headers"],
     export_header_lib_headers: ["libbluetooth_headers"],
     srcs: [
-        // platform specific
-        "bte_conf.cc",
-        "bte_init.cc",
-        "bte_init_cpp_logging.cc",
-        "bte_logmsg.cc",
-        "bte_main.cc",
-        "stack_config.cc",
+        ":LibBluetoothSources",
     ],
     include_dirs: [
         "system/bt",
@@ -34,6 +48,8 @@
         "system/bt/embdrv/sbc/encoder/include",
         "system/bt/embdrv/sbc/decoder/include",
         "system/bt/utils/include",
+        "system/security/keystore/include",
+        "hardware/interfaces/keymaster/4.0/support/include",
     ],
     logtags: ["../EventLogTags.logtags"],
     shared_libs: [
@@ -45,8 +61,6 @@
         "libdl",
         "libfmq",
         "libhidlbase",
-        "libhidltransport",
-        "libhwbinder",
         "liblog",
         "libprocessgroup",
         "libprotobuf-cpp-lite",
@@ -54,6 +68,12 @@
         "libtinyxml2",
         "libz",
         "libcrypto",
+        "android.hardware.keymaster@4.0",
+        "android.hardware.keymaster@3.0",
+        "libkeymaster4support",
+        "libkeystore_aidl",
+        "libkeystore_binder",
+        "libkeystore_parcelables",
     ],
     static_libs: [
         "libbt-sbc-decoder",
@@ -61,6 +81,7 @@
         "libFraunhoferAAC",
         "libg722codec",
         "libudrv-uipc",
+        "libbluetooth_gd", // Gabeldorsche
     ],
     whole_static_libs: [
         "libbt-bta",
@@ -89,6 +110,9 @@
     cflags: [
         "-DBUILDCFG",
     ],
+    sanitize: {
+        scs: true,
+    },
 }
 
 cc_library_static {
@@ -96,13 +120,10 @@
     defaults: ["fluoride_defaults"],
 
     srcs: [
-        "bte_conf.cc",
-        "bte_init.cc",
-        "bte_init_cpp_logging.cc",
-        "bte_logmsg.cc",
-        "bte_main.cc",
-        "stack_config.cc",
+        ":LibBluetoothSources",
+        "shim/entry_for_test.cc",
     ],
+    host_supported: true,
     include_dirs: [
         "system/bt",
         "system/bt/bta/include",
@@ -117,3 +138,33 @@
         "-DBUILDCFG",
     ],
 }
+
+filegroup {
+    name: "BluetoothLegacyShimTestSources",
+    srcs: [
+        "shim/l2cap_test.cc",
+        "shim/test_stack.cc",
+    ]
+}
+
+cc_test {
+    name: "bluetooth_test_legacy",
+    defaults: ["fluoride_defaults",
+               "fluoride_osi_defaults",
+    ],
+    test_suites: ["device-tests"],
+    host_supported: true,
+    srcs: [
+        ":BluetoothLegacyShimTestSources",
+    ],
+    static_libs: [
+        "libgmock",
+        "libbluetooth-for-tests",
+        "libosi",
+    ],
+    shared_libs: [
+        "libchrome",
+        "liblog",
+    ],
+}
+
diff --git a/main/bte_main.cc b/main/bte_main.cc
index 0498439..1628976 100644
--- a/main/bte_main.cc
+++ b/main/bte_main.cc
@@ -53,6 +53,8 @@
 #include "osi/include/future.h"
 #include "osi/include/log.h"
 #include "osi/include/osi.h"
+#include "shim/hci_layer.h"
+#include "shim/shim.h"
 #include "stack_config.h"
 
 /*******************************************************************************
@@ -155,8 +157,14 @@
 void bte_main_enable() {
   APPL_TRACE_DEBUG("%s", __func__);
 
-  module_start_up(get_module(BTSNOOP_MODULE));
-  module_start_up(get_module(HCI_MODULE));
+  if (bluetooth::shim::is_gd_shim_enabled()) {
+    LOG_INFO(LOG_TAG, "%s Gd shim module enabled", __func__);
+    module_start_up(get_module(GD_SHIM_MODULE));
+    module_start_up(get_module(GD_HCI_MODULE));
+  } else {
+    module_start_up(get_module(BTSNOOP_MODULE));
+    module_start_up(get_module(HCI_MODULE));
+  }
 
   BTU_StartUp();
 }
@@ -174,8 +182,14 @@
 void bte_main_disable(void) {
   APPL_TRACE_DEBUG("%s", __func__);
 
-  module_shut_down(get_module(HCI_MODULE));
-  module_shut_down(get_module(BTSNOOP_MODULE));
+  if (bluetooth::shim::is_gd_shim_enabled()) {
+    LOG_INFO(LOG_TAG, "%s Gd shim module enabled", __func__);
+    module_shut_down(get_module(GD_HCI_MODULE));
+    module_shut_down(get_module(GD_SHIM_MODULE));
+  } else {
+    module_shut_down(get_module(HCI_MODULE));
+    module_shut_down(get_module(BTSNOOP_MODULE));
+  }
 
   BTU_ShutDown();
 }
diff --git a/main/shim/btm.cc b/main/shim/btm.cc
new file mode 100644
index 0000000..35f5f43
--- /dev/null
+++ b/main/shim/btm.cc
@@ -0,0 +1,345 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#define LOG_TAG "bt_shim_btm"
+
+#include <algorithm>
+
+#include "main/shim/btm.h"
+#include "main/shim/entry.h"
+#include "main/shim/shim.h"
+#include "osi/include/log.h"
+
+bluetooth::shim::Btm::Btm() {}
+
+static constexpr size_t kMaxInquiryResultSize = 4096;
+static uint8_t inquiry_result_buf[kMaxInquiryResultSize];
+
+static int inquiry_type_ = 0;
+
+static constexpr uint8_t kInquiryResultMode = 0;
+static constexpr uint8_t kInquiryResultWithRssiMode = 1;
+static constexpr uint8_t kExtendedInquiryResultMode = 2;
+
+extern void btm_process_cancel_complete(uint8_t status, uint8_t mode);
+extern void btm_process_inq_complete(uint8_t status, uint8_t result_type);
+extern void btm_process_inq_results(uint8_t* p, uint8_t result_mode);
+
+/**
+ * Inquiry
+ */
+void bluetooth::shim::Btm::OnInquiryResult(std::vector<const uint8_t> result) {
+  CHECK(result.size() < kMaxInquiryResultSize);
+
+  std::copy(result.begin(), result.end(), inquiry_result_buf);
+  btm_process_inq_results(inquiry_result_buf, kInquiryResultMode);
+}
+
+void bluetooth::shim::Btm::OnInquiryResultWithRssi(
+    std::vector<const uint8_t> result) {
+  CHECK(result.size() < kMaxInquiryResultSize);
+
+  std::copy(result.begin(), result.end(), inquiry_result_buf);
+  btm_process_inq_results(inquiry_result_buf, kInquiryResultWithRssiMode);
+}
+
+void bluetooth::shim::Btm::OnExtendedInquiryResult(
+    std::vector<const uint8_t> result) {
+  CHECK(result.size() < kMaxInquiryResultSize);
+
+  std::copy(result.begin(), result.end(), inquiry_result_buf);
+  btm_process_inq_results(inquiry_result_buf, kExtendedInquiryResultMode);
+}
+
+void bluetooth::shim::Btm::OnInquiryComplete(uint16_t status) {
+  btm_process_inq_complete(status, inquiry_type_);
+}
+
+bool bluetooth::shim::Btm::SetInquiryFilter(uint8_t mode, uint8_t type,
+                                            tBTM_INQ_FILT_COND data) {
+  switch (mode) {
+    case kInquiryModeOff:
+      break;
+    case kLimitedInquiryMode:
+      LOG_WARN(LOG_TAG, "UNIMPLEMENTED %s", __func__);
+      break;
+    case kGeneralInquiryMode:
+      LOG_WARN(LOG_TAG, "UNIMPLEMENTED %s", __func__);
+      break;
+    default:
+      LOG_WARN(LOG_TAG, "%s Unknown inquiry mode:%d", __func__, mode);
+      return false;
+  }
+  return true;
+}
+
+void bluetooth::shim::Btm::SetFilterInquiryOnAddress() {
+  LOG_WARN(LOG_TAG, "UNIMPLEMENTED %s", __func__);
+}
+
+void bluetooth::shim::Btm::SetFilterInquiryOnDevice() {
+  LOG_WARN(LOG_TAG, "UNIMPLEMENTED %s", __func__);
+}
+
+void bluetooth::shim::Btm::ClearInquiryFilter() {
+  LOG_WARN(LOG_TAG, "UNIMPLEMENTED %s", __func__);
+}
+
+bool bluetooth::shim::Btm::SetStandardInquiryResultMode() {
+  bluetooth::shim::GetInquiry()->SetStandardInquiryResultMode();
+  return true;
+}
+
+bool bluetooth::shim::Btm::SetInquiryWithRssiResultMode() {
+  bluetooth::shim::GetInquiry()->SetInquiryWithRssiResultMode();
+  return true;
+}
+
+bool bluetooth::shim::Btm::SetExtendedInquiryResultMode() {
+  bluetooth::shim::GetInquiry()->SetExtendedInquiryResultMode();
+  return true;
+}
+
+void bluetooth::shim::Btm::SetInterlacedInquiryScan() {
+  bluetooth::shim::GetInquiry()->SetInterlacedScan();
+}
+
+void bluetooth::shim::Btm::SetStandardInquiryScan() {
+  bluetooth::shim::GetInquiry()->SetStandardScan();
+}
+
+bool bluetooth::shim::Btm::IsInterlacedScanSupported() const {
+  // TODO(cmanton) This is a controller query
+  LOG_WARN(LOG_TAG, "UNIMPLEMENTED %s", __func__);
+  return true;
+}
+
+/**
+ * One shot inquiry
+ */
+bool bluetooth::shim::Btm::StartInquiry(uint8_t mode, uint8_t duration,
+                                        uint8_t max_responses) {
+  switch (mode) {
+    case kInquiryModeOff:
+      LOG_DEBUG(LOG_TAG, "%s Stopping inquiry mode", __func__);
+      bluetooth::shim::GetInquiry()->StopInquiry();
+      bluetooth::shim::GetInquiry()->UnregisterInquiryResult();
+      bluetooth::shim::GetInquiry()->UnregisterInquiryResultWithRssi();
+      bluetooth::shim::GetInquiry()->UnregisterExtendedInquiryResult();
+      bluetooth::shim::GetInquiry()->UnregisterInquiryComplete();
+      break;
+
+    case kLimitedInquiryMode:
+    case kGeneralInquiryMode:
+      bluetooth::shim::GetInquiry()->RegisterInquiryResult(
+          std::bind(&Btm::OnInquiryResult, this, std::placeholders::_1));
+      bluetooth::shim::GetInquiry()->RegisterInquiryResultWithRssi(std::bind(
+          &Btm::OnInquiryResultWithRssi, this, std::placeholders::_1));
+      bluetooth::shim::GetInquiry()->RegisterExtendedInquiryResult(std::bind(
+          &Btm::OnExtendedInquiryResult, this, std::placeholders::_1));
+      bluetooth::shim::GetInquiry()->RegisterInquiryComplete(
+          std::bind(&Btm::OnInquiryComplete, this, std::placeholders::_1));
+
+      if (mode == kLimitedInquiryMode) {
+        LOG_DEBUG(
+            LOG_TAG,
+            "%s Starting limited inquiry mode duration:%hhd max responses:%hhd",
+            __func__, duration, max_responses);
+        bluetooth::shim::GetInquiry()->StartLimitedInquiry(duration,
+                                                           max_responses);
+      } else {
+        LOG_DEBUG(
+            LOG_TAG,
+            "%s Starting general inquiry mode duration:%hhd max responses:%hhd",
+            __func__, duration, max_responses);
+        bluetooth::shim::GetInquiry()->StartGeneralInquiry(duration,
+                                                           max_responses);
+      }
+      break;
+
+    default:
+      LOG_WARN(LOG_TAG, "%s Unknown inquiry mode:%d", __func__, mode);
+      return false;
+  }
+  return true;
+}
+
+void bluetooth::shim::Btm::CancelInquiry() {
+  bluetooth::shim::GetInquiry()->StopInquiry();
+}
+
+bool bluetooth::shim::Btm::IsInquiryActive() const {
+  return IsGeneralInquiryActive() || IsLimitedInquiryActive();
+}
+
+bool bluetooth::shim::Btm::IsGeneralInquiryActive() const {
+  return bluetooth::shim::GetInquiry()->IsGeneralInquiryActive();
+}
+
+bool bluetooth::shim::Btm::IsLimitedInquiryActive() const {
+  return bluetooth::shim::GetInquiry()->IsLimitedInquiryActive();
+}
+
+/**
+ * Periodic Inquiry
+ */
+bool bluetooth::shim::Btm::StartPeriodicInquiry(
+    uint8_t mode, uint8_t duration, uint8_t max_responses, uint16_t max_delay,
+    uint16_t min_delay, tBTM_INQ_RESULTS_CB* p_results_cb) {
+  switch (mode) {
+    case kInquiryModeOff:
+      bluetooth::shim::GetInquiry()->StopPeriodicInquiry();
+      break;
+
+    case kLimitedInquiryMode:
+    case kGeneralInquiryMode:
+      if (mode == kLimitedInquiryMode) {
+        LOG_DEBUG(LOG_TAG, "%s Starting limited periodic inquiry mode",
+                  __func__);
+        bluetooth::shim::GetInquiry()->StartLimitedPeriodicInquiry(
+            duration, max_responses, max_delay, min_delay);
+      } else {
+        LOG_DEBUG(LOG_TAG, "%s Starting general periodic inquiry mode",
+                  __func__);
+        bluetooth::shim::GetInquiry()->StartGeneralPeriodicInquiry(
+            duration, max_responses, max_delay, min_delay);
+      }
+      break;
+
+    default:
+      LOG_WARN(LOG_TAG, "%s Unknown inquiry mode:%d", __func__, mode);
+      return false;
+  }
+  return true;
+}
+
+void bluetooth::shim::Btm::CancelPeriodicInquiry() {
+  bluetooth::shim::GetInquiry()->StopPeriodicInquiry();
+}
+
+bool bluetooth::shim::Btm::IsGeneralPeriodicInquiryActive() const {
+  return bluetooth::shim::GetInquiry()->IsGeneralPeriodicInquiryActive();
+}
+
+bool bluetooth::shim::Btm::IsLimitedPeriodicInquiryActive() const {
+  return bluetooth::shim::GetInquiry()->IsLimitedPeriodicInquiryActive();
+}
+
+/**
+ * Discoverability
+ */
+void bluetooth::shim::Btm::SetClassicGeneralDiscoverability(uint16_t window,
+                                                            uint16_t interval) {
+  bluetooth::shim::GetInquiry()->SetScanActivity(interval, window);
+  bluetooth::shim::GetDiscoverability()->StartGeneralDiscoverability();
+}
+
+void bluetooth::shim::Btm::SetClassicLimitedDiscoverability(uint16_t window,
+                                                            uint16_t interval) {
+  bluetooth::shim::GetInquiry()->SetScanActivity(interval, window);
+  bluetooth::shim::GetDiscoverability()->StartLimitedDiscoverability();
+}
+
+void bluetooth::shim::Btm::SetClassicDiscoverabilityOff() {
+  bluetooth::shim::GetDiscoverability()->StopDiscoverability();
+}
+
+DiscoverabilityState bluetooth::shim::Btm::GetClassicDiscoverabilityState()
+    const {
+  DiscoverabilityState state{.mode = BTM_NON_DISCOVERABLE};
+  bluetooth::shim::GetInquiry()->GetScanActivity(state.interval, state.window);
+
+  if (bluetooth::shim::GetDiscoverability()
+          ->IsGeneralDiscoverabilityEnabled()) {
+    state.mode = BTM_GENERAL_DISCOVERABLE;
+  } else if (bluetooth::shim::GetDiscoverability()
+                 ->IsLimitedDiscoverabilityEnabled()) {
+    state.mode = BTM_LIMITED_DISCOVERABLE;
+  }
+  return state;
+}
+
+void bluetooth::shim::Btm::SetLeGeneralDiscoverability() {
+  LOG_WARN(LOG_TAG, "UNIMPLEMENTED %s", __func__);
+}
+
+void bluetooth::shim::Btm::SetLeLimitedDiscoverability() {
+  LOG_WARN(LOG_TAG, "UNIMPLEMENTED %s", __func__);
+}
+
+void bluetooth::shim::Btm::SetLeDiscoverabilityOff() {
+  LOG_WARN(LOG_TAG, "UNIMPLEMENTED %s", __func__);
+}
+
+DiscoverabilityState bluetooth::shim::Btm::GetLeDiscoverabilityState() const {
+  DiscoverabilityState state{
+      .mode = kDiscoverableModeOff,
+      .interval = 0,
+      .window = 0,
+  };
+  LOG_WARN(LOG_TAG, "UNIMPLEMENTED %s", __func__);
+  return state;
+}
+
+/**
+ * Connectability
+ */
+void bluetooth::shim::Btm::SetClassicConnectibleOn() {
+  bluetooth::shim::GetConnectability()->StartConnectability();
+}
+
+void bluetooth::shim::Btm::SetClassicConnectibleOff() {
+  bluetooth::shim::GetConnectability()->StopConnectability();
+}
+
+ConnectabilityState bluetooth::shim::Btm::GetClassicConnectabilityState()
+    const {
+  ConnectabilityState state;
+  bluetooth::shim::GetPage()->GetScanActivity(state.interval, state.window);
+
+  if (bluetooth::shim::GetConnectability()->IsConnectable()) {
+    state.mode = BTM_CONNECTABLE;
+  } else {
+    state.mode = BTM_NON_CONNECTABLE;
+  }
+  return state;
+}
+
+void bluetooth::shim::Btm::SetInterlacedPageScan() {
+  bluetooth::shim::GetPage()->SetInterlacedScan();
+}
+
+void bluetooth::shim::Btm::SetStandardPageScan() {
+  bluetooth::shim::GetPage()->SetStandardScan();
+}
+
+void bluetooth::shim::Btm::SetLeConnectibleOn() {
+  LOG_WARN(LOG_TAG, "UNIMPLEMENTED %s", __func__);
+}
+
+void bluetooth::shim::Btm::SetLeConnectibleOff() {
+  LOG_WARN(LOG_TAG, "UNIMPLEMENTED %s", __func__);
+}
+
+ConnectabilityState bluetooth::shim::Btm::GetLeConnectabilityState() const {
+  ConnectabilityState state{
+      .mode = kConnectibleModeOff,
+      .interval = 0,
+      .window = 0,
+  };
+  LOG_WARN(LOG_TAG, "UNIMPLEMENTED %s", __func__);
+  return state;
+}
diff --git a/main/shim/btm.h b/main/shim/btm.h
new file mode 100644
index 0000000..aa92bf6
--- /dev/null
+++ b/main/shim/btm.h
@@ -0,0 +1,136 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#pragma once
+
+#include <cstdint>
+#include <unordered_map>
+#include <vector>
+
+#include "stack/include/btm_api_types.h"
+
+/* Discoverable modes */
+static constexpr int kDiscoverableModeOff = 0;
+static constexpr int kLimitedDiscoverableMode = 1;
+static constexpr int kGeneralDiscoverableMode = 2;
+
+/* Inquiry modes */
+// NOTE: The inquiry general/limited are reversed from the discoverability
+// constants
+static constexpr int kInquiryModeOff = 0;
+static constexpr int kGeneralInquiryMode = 1;
+static constexpr int kLimitedInquiryMode = 2;
+
+/* Connectable modes */
+static constexpr int kConnectibleModeOff = 0;
+static constexpr int kConnectibleModeOn = 1;
+
+/* Inquiry and page scan modes */
+static constexpr int kStandardScanType = 0;
+static constexpr int kInterlacedScanType = 1;
+
+/* Inquiry result modes */
+static constexpr int kStandardInquiryResult = 0;
+static constexpr int kInquiryResultWithRssi = 1;
+static constexpr int kExtendedInquiryResult = 2;
+
+/* Inquiry filter types */
+static constexpr int kClearInquiryFilter = 0;
+static constexpr int kFilterOnDeviceClass = 1;
+static constexpr int kFilterOnAddress = 2;
+
+using DiscoverabilityState = struct {
+  int mode;
+  uint16_t interval;
+  uint16_t window;
+};
+using ConnectabilityState = DiscoverabilityState;
+
+namespace bluetooth {
+namespace shim {
+
+class Btm {
+ public:
+  Btm();
+
+  // Callbacks
+  void OnInquiryResult(std::vector<const uint8_t> result);
+  void OnInquiryResultWithRssi(std::vector<const uint8_t> result);
+  void OnExtendedInquiryResult(std::vector<const uint8_t> result);
+  void OnInquiryComplete(uint16_t status);
+
+  // Inquiry API
+  bool SetInquiryFilter(uint8_t mode, uint8_t type, tBTM_INQ_FILT_COND data);
+  void SetFilterInquiryOnAddress();
+  void SetFilterInquiryOnDevice();
+  void ClearInquiryFilter();
+
+  bool SetStandardInquiryResultMode();
+  bool SetInquiryWithRssiResultMode();
+  bool SetExtendedInquiryResultMode();
+
+  void SetInterlacedInquiryScan();
+  void SetStandardInquiryScan();
+  bool IsInterlacedScanSupported() const;
+
+  bool StartInquiry(uint8_t mode, uint8_t duration, uint8_t max_responses);
+  void CancelInquiry();
+  bool IsInquiryActive() const;
+  bool IsGeneralInquiryActive() const;
+  bool IsLimitedInquiryActive() const;
+
+  bool StartPeriodicInquiry(uint8_t mode, uint8_t duration,
+                            uint8_t max_responses, uint16_t max_delay,
+                            uint16_t min_delay,
+                            tBTM_INQ_RESULTS_CB* p_results_cb);
+  void CancelPeriodicInquiry();
+  bool IsGeneralPeriodicInquiryActive() const;
+  bool IsLimitedPeriodicInquiryActive() const;
+
+  void SetClassicGeneralDiscoverability(uint16_t window, uint16_t interval);
+  void SetClassicLimitedDiscoverability(uint16_t window, uint16_t interval);
+  void SetClassicDiscoverabilityOff();
+  DiscoverabilityState GetClassicDiscoverabilityState() const;
+
+  void SetLeGeneralDiscoverability();
+  void SetLeLimitedDiscoverability();
+  void SetLeDiscoverabilityOff();
+  DiscoverabilityState GetLeDiscoverabilityState() const;
+
+  void SetClassicConnectibleOn();
+  void SetClassicConnectibleOff();
+  ConnectabilityState GetClassicConnectabilityState() const;
+  void SetInterlacedPageScan();
+  void SetStandardPageScan();
+
+  void SetLeConnectibleOn();
+  void SetLeConnectibleOff();
+  ConnectabilityState GetLeConnectabilityState() const;
+
+ private:
+  //  DiscoverabilityState classic_;
+  //  DiscoverabilityState le_;
+
+  //  ConnectabilityState classic_connectibility_state_;
+  //  ConnectabilityState le_connectibility_state_;
+
+  //  bool DoSetEventFilter();
+  //  void DoSetDiscoverability();
+  //  bool DoSetInquiryMode();
+};
+
+}  // namespace shim
+}  // namespace bluetooth
diff --git a/main/shim/btm_api.cc b/main/shim/btm_api.cc
new file mode 100644
index 0000000..ee3b0cf
--- /dev/null
+++ b/main/shim/btm_api.cc
@@ -0,0 +1,1405 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#define LOG_TAG "bt_shim_btm"
+
+#include <base/callback.h>
+
+#include "main/shim/btm.h"
+#include "main/shim/btm_api.h"
+#include "osi/include/log.h"
+#include "stack/btm/btm_int_types.h"
+
+static bluetooth::shim::Btm shim_btm;
+
+/*******************************************************************************
+ *
+ * Function         BTM_StartInquiry
+ *
+ * Description      This function is called to start an inquiry.
+ *
+ * Parameters:      p_inqparms - pointer to the inquiry information
+ *                      mode - GENERAL or LIMITED inquiry, BR/LE bit mask
+ *                             seperately
+ *                      duration - length in 1.28 sec intervals (If '0', the
+ *                                 inquiry is CANCELLED)
+ *                      max_resps - maximum amount of devices to search for
+ *                                  before ending the inquiry
+ *                      filter_cond_type - BTM_CLR_INQUIRY_FILTER,
+ *                                         BTM_FILTER_COND_DEVICE_CLASS, or
+ *                                         BTM_FILTER_COND_BD_ADDR
+ *                      filter_cond - value for the filter (based on
+ *                                                          filter_cond_type)
+ *
+ *                  p_results_cb   - Pointer to the callback routine which gets
+ *                                called upon receipt of an inquiry result. If
+ *                                this field is NULL, the application is not
+ *                                notified.
+ *
+ *                  p_cmpl_cb   - Pointer to the callback routine which gets
+ *                                called upon completion.  If this field is
+ *                                NULL, the application is not notified when
+ *                                completed.
+ * Returns          tBTM_STATUS
+ *                  BTM_CMD_STARTED if successfully initiated
+ *                  BTM_BUSY if already in progress
+ *                  BTM_ILLEGAL_VALUE if parameter(s) are out of range
+ *                  BTM_NO_RESOURCES if could not allocate resources to start
+ *                                   the command
+ *                  BTM_WRONG_MODE if the device is not up.
+ *
+ ******************************************************************************/
+tBTM_STATUS bluetooth::shim::BTM_StartInquiry(tBTM_INQ_PARMS* p_inqparms,
+                                              tBTM_INQ_RESULTS_CB* p_results_cb,
+                                              tBTM_CMPL_CB* p_cmpl_cb) {
+  CHECK(p_inqparms != nullptr);
+  CHECK(p_results_cb != nullptr);
+  CHECK(p_cmpl_cb != nullptr);
+
+  uint8_t classic_mode = p_inqparms->mode & 0x0f;
+  // TODO(cmanton) Setup the LE portion too
+  uint8_t le_mode = p_inqparms->mode >> 4;
+
+  LOG_INFO(LOG_TAG, "%s Start inquiry mode classic:%hhd le:%hhd", __func__,
+           classic_mode, le_mode);
+
+  if (!shim_btm.SetInquiryFilter(classic_mode, p_inqparms->filter_cond_type,
+                                 p_inqparms->filter_cond)) {
+    LOG_WARN(LOG_TAG, "%s Unable to set inquiry filter", __func__);
+    return BTM_ERR_PROCESSING;
+  }
+
+  if (!shim_btm.StartInquiry(classic_mode, p_inqparms->duration,
+                             p_inqparms->max_resps)) {
+    LOG_WARN(LOG_TAG, "%s Unable to start inquiry", __func__);
+    return BTM_ERR_PROCESSING;
+  }
+  return BTM_CMD_STARTED;
+}
+
+/*******************************************************************************
+ *
+ * Function         BTM_SetPeriodicInquiryMode
+ *
+ * Description      This function is called to set the device periodic inquiry
+ *                  mode. If the duration is zero, the periodic inquiry mode is
+ *                  cancelled.
+ *
+ *                  Note: We currently do not allow concurrent inquiry and
+ *                  periodic inquiry.
+ *
+ * Parameters:      p_inqparms - pointer to the inquiry information
+ *                      mode - GENERAL or LIMITED inquiry
+ *                      duration - length in 1.28 sec intervals (If '0', the
+ *                                 inquiry is CANCELLED)
+ *                      max_resps - maximum amount of devices to search for
+ *                                  before ending the inquiry
+ *                      filter_cond_type - BTM_CLR_INQUIRY_FILTER,
+ *                                         BTM_FILTER_COND_DEVICE_CLASS, or
+ *                                         BTM_FILTER_COND_BD_ADDR
+ *                      filter_cond - value for the filter (based on
+ *                                                          filter_cond_type)
+ *
+ *                  max_delay - maximum amount of time between successive
+ *                              inquiries
+ *                  min_delay - minimum amount of time between successive
+ *                              inquiries
+ *                  p_results_cb - callback returning pointer to results
+ *                              (tBTM_INQ_RESULTS)
+ *
+ * Returns          BTM_CMD_STARTED if successfully started
+ *                  BTM_ILLEGAL_VALUE if a bad parameter is detected
+ *                  BTM_NO_RESOURCES if could not allocate a message buffer
+ *                  BTM_SUCCESS - if cancelling the periodic inquiry
+ *                  BTM_BUSY - if an inquiry is already active
+ *                  BTM_WRONG_MODE if the device is not up.
+ *
+ ******************************************************************************/
+tBTM_STATUS bluetooth::shim::BTM_SetPeriodicInquiryMode(
+    tBTM_INQ_PARMS* p_inqparms, uint16_t max_delay, uint16_t min_delay,
+    tBTM_INQ_RESULTS_CB* p_results_cb) {
+  CHECK(p_inqparms != nullptr);
+  CHECK(p_results_cb != nullptr);
+
+  if (p_inqparms->duration < BTM_MIN_INQUIRY_LEN ||
+      p_inqparms->duration > BTM_MAX_INQUIRY_LENGTH ||
+      min_delay <= p_inqparms->duration ||
+      min_delay < BTM_PER_INQ_MIN_MIN_PERIOD ||
+      min_delay > BTM_PER_INQ_MAX_MIN_PERIOD || max_delay <= min_delay ||
+      max_delay < BTM_PER_INQ_MIN_MAX_PERIOD) {
+    return (BTM_ILLEGAL_VALUE);
+  }
+
+  if (shim_btm.IsInquiryActive()) {
+    return BTM_BUSY;
+  }
+
+  switch (p_inqparms->filter_cond_type) {
+    case kClearInquiryFilter:
+      shim_btm.ClearInquiryFilter();
+      return BTM_SUCCESS;
+      break;
+    case kFilterOnDeviceClass:
+      shim_btm.SetFilterInquiryOnDevice();
+      return BTM_SUCCESS;
+      break;
+    case kFilterOnAddress:
+      shim_btm.SetFilterInquiryOnAddress();
+      return BTM_SUCCESS;
+      break;
+    default:
+      return BTM_ILLEGAL_VALUE;
+  }
+  return BTM_MODE_UNSUPPORTED;
+}
+
+/*******************************************************************************
+ *
+ * Function         BTM_SetDiscoverability
+ *
+ * Description      This function is called to set the device into or out of
+ *                  discoverable mode. Discoverable mode means inquiry
+ *                  scans are enabled.  If a value of '0' is entered for window
+ *                  or interval, the default values are used.
+ *
+ * Returns          BTM_SUCCESS if successful
+ *                  BTM_BUSY if a setting of the filter is already in progress
+ *                  BTM_NO_RESOURCES if couldn't get a memory pool buffer
+ *                  BTM_ILLEGAL_VALUE if a bad parameter was detected
+ *                  BTM_WRONG_MODE if the device is not up.
+ *
+ ******************************************************************************/
+tBTM_STATUS bluetooth::shim::BTM_SetDiscoverability(uint16_t discoverable_mode,
+                                                    uint16_t window,
+                                                    uint16_t interval) {
+  uint16_t classic_discoverable_mode = discoverable_mode & 0xff;
+  uint16_t le_discoverable_mode = discoverable_mode >> 8;
+
+  if (window == 0) window = BTM_DEFAULT_DISC_WINDOW;
+  if (interval == 0) interval = BTM_DEFAULT_DISC_INTERVAL;
+
+  switch (le_discoverable_mode) {
+    case kDiscoverableModeOff:
+      shim_btm.SetLeDiscoverabilityOff();
+      break;
+    case kLimitedDiscoverableMode:
+      shim_btm.SetLeLimitedDiscoverability();
+      break;
+    case kGeneralDiscoverableMode:
+      shim_btm.SetLeGeneralDiscoverability();
+      break;
+  }
+
+  switch (classic_discoverable_mode) {
+    case kDiscoverableModeOff:
+      shim_btm.SetClassicDiscoverabilityOff();
+      break;
+    case kLimitedDiscoverableMode:
+      shim_btm.SetClassicLimitedDiscoverability(window, interval);
+      break;
+    case kGeneralDiscoverableMode:
+      shim_btm.SetClassicGeneralDiscoverability(window, interval);
+      break;
+  }
+
+  return BTM_SUCCESS;
+}
+
+/*******************************************************************************
+ *
+ * Function         BTM_SetInquiryScanType
+ *
+ * Description      This function is called to set the iquiry scan-type to
+ *                  standard or interlaced.
+ *
+ * Returns          BTM_SUCCESS if successful
+ *                  BTM_MODE_UNSUPPORTED if not a 1.2 device
+ *                  BTM_WRONG_MODE if the device is not up.
+ *
+ ******************************************************************************/
+tBTM_STATUS bluetooth::shim::BTM_SetInquiryScanType(uint16_t scan_type) {
+  switch (scan_type) {
+    case kInterlacedScanType:
+      shim_btm.SetInterlacedInquiryScan();
+      return BTM_SUCCESS;
+      break;
+    case kStandardScanType:
+      shim_btm.SetStandardInquiryScan();
+      return BTM_SUCCESS;
+      break;
+    default:
+      return BTM_ILLEGAL_VALUE;
+  }
+  return BTM_WRONG_MODE;
+}
+
+/*******************************************************************************
+ *
+ * Function         BTM_SetPageScanType
+ *
+ * Description      This function is called to set the page scan-type to
+ *                  standard or interlaced.
+ *
+ * Returns          BTM_SUCCESS if successful
+ *                  BTM_MODE_UNSUPPORTED if not a 1.2 device
+ *                  BTM_WRONG_MODE if the device is not up.
+ *
+ ******************************************************************************/
+tBTM_STATUS bluetooth::shim::BTM_SetPageScanType(uint16_t scan_type) {
+  switch (scan_type) {
+    case kInterlacedScanType:
+      if (!shim_btm.IsInterlacedScanSupported()) {
+        return BTM_MODE_UNSUPPORTED;
+      }
+      shim_btm.SetInterlacedPageScan();
+      return BTM_SUCCESS;
+      break;
+    case kStandardScanType:
+      shim_btm.SetStandardPageScan();
+      return BTM_SUCCESS;
+      break;
+    default:
+      return BTM_ILLEGAL_VALUE;
+  }
+  return BTM_WRONG_MODE;
+}
+
+/*******************************************************************************
+ *
+ * Function         BTM_SetInquiryMode
+ *
+ * Description      This function is called to set standard or with RSSI
+ *                  mode of the inquiry for local device.
+ *
+ * Output Params:   mode - standard, with RSSI, extended
+ *
+ * Returns          BTM_SUCCESS if successful
+ *                  BTM_NO_RESOURCES if couldn't get a memory pool buffer
+ *                  BTM_ILLEGAL_VALUE if a bad parameter was detected
+ *                  BTM_WRONG_MODE if the device is not up.
+ *
+ ******************************************************************************/
+tBTM_STATUS bluetooth::shim::BTM_SetInquiryMode(uint8_t inquiry_mode) {
+  switch (inquiry_mode) {
+    case kStandardInquiryResult:
+      if (shim_btm.SetStandardInquiryResultMode()) {
+        return BTM_SUCCESS;
+      }
+      break;
+    case kInquiryResultWithRssi:
+      if (shim_btm.SetInquiryWithRssiResultMode()) {
+        return BTM_SUCCESS;
+      }
+      break;
+    case kExtendedInquiryResult:
+      if (shim_btm.SetExtendedInquiryResultMode()) {
+        return BTM_SUCCESS;
+      }
+      break;
+    default:
+      return BTM_ILLEGAL_VALUE;
+  }
+  return BTM_MODE_UNSUPPORTED;
+}
+
+/*******************************************************************************
+ *
+ * Function         BTM_ReadDiscoverability
+ *
+ * Description      This function is called to read the current discoverability
+ *                  mode of the device.
+ *
+ * Output Params:   p_window - current inquiry scan duration
+ *                  p_interval - current inquiry scan interval
+ *
+ * Returns          BTM_NON_DISCOVERABLE, BTM_LIMITED_DISCOVERABLE, or
+ *                  BTM_GENERAL_DISCOVERABLE
+ *
+ ******************************************************************************/
+uint16_t bluetooth::shim::BTM_ReadDiscoverability(uint16_t* p_window,
+                                                  uint16_t* p_interval) {
+  DiscoverabilityState state = shim_btm.GetClassicDiscoverabilityState();
+
+  if (p_interval) *p_interval = state.interval;
+  if (p_window) *p_window = state.window;
+
+  return state.mode;
+}
+
+/*******************************************************************************
+ *
+ * Function         BTM_CancelPeriodicInquiry
+ *
+ * Description      This function cancels a periodic inquiry
+ *
+ * Returns
+ *                  BTM_NO_RESOURCES if could not allocate a message buffer
+ *                  BTM_SUCCESS - if cancelling the periodic inquiry
+ *                  BTM_WRONG_MODE if the device is not up.
+ *
+ ******************************************************************************/
+tBTM_STATUS bluetooth::shim::BTM_CancelPeriodicInquiry(void) {
+  shim_btm.CancelPeriodicInquiry();
+  return BTM_SUCCESS;
+}
+
+/*******************************************************************************
+ *
+ * Function         BTM_SetConnectability
+ *
+ * Description      This function is called to set the device into or out of
+ *                  connectable mode. Discoverable mode means page scans are
+ *                  enabled.
+ *
+ * Returns          BTM_SUCCESS if successful
+ *                  BTM_ILLEGAL_VALUE if a bad parameter is detected
+ *                  BTM_NO_RESOURCES if could not allocate a message buffer
+ *                  BTM_WRONG_MODE if the device is not up.
+ *
+ ******************************************************************************/
+tBTM_STATUS bluetooth::shim::BTM_SetConnectability(uint16_t page_mode,
+                                                   uint16_t window,
+                                                   uint16_t interval) {
+  uint16_t classic_connectible_mode = page_mode & 0xff;
+  uint16_t le_connectible_mode = page_mode >> 8;
+
+  if (!window) window = BTM_DEFAULT_CONN_WINDOW;
+  if (!interval) interval = BTM_DEFAULT_CONN_INTERVAL;
+
+  switch (le_connectible_mode) {
+    case kConnectibleModeOff:
+      shim_btm.SetLeConnectibleOff();
+      break;
+    case kConnectibleModeOn:
+      shim_btm.SetLeConnectibleOn();
+      break;
+    default:
+      return BTM_ILLEGAL_VALUE;
+      break;
+  }
+
+  switch (classic_connectible_mode) {
+    case kConnectibleModeOff:
+      shim_btm.SetClassicConnectibleOff();
+      break;
+    case kConnectibleModeOn:
+      shim_btm.SetClassicConnectibleOn();
+      break;
+    default:
+      return BTM_ILLEGAL_VALUE;
+      break;
+  }
+  return BTM_SUCCESS;
+}
+
+/*******************************************************************************
+ *
+ * Function         BTM_ReadConnectability
+ *
+ * Description      This function is called to read the current discoverability
+ *                  mode of the device.
+ * Output Params    p_window - current page scan duration
+ *                  p_interval - current time between page scans
+ *
+ * Returns          BTM_NON_CONNECTABLE or BTM_CONNECTABLE
+ *
+ ******************************************************************************/
+uint16_t bluetooth::shim::BTM_ReadConnectability(uint16_t* p_window,
+                                                 uint16_t* p_interval) {
+  ConnectabilityState state = shim_btm.GetClassicConnectabilityState();
+
+  if (p_window) *p_window = state.window;
+  if (p_interval) *p_interval = state.interval;
+
+  return state.mode;
+}
+
+/*******************************************************************************
+ *
+ * Function         BTM_IsInquiryActive
+ *
+ * Description      This function returns a bit mask of the current inquiry
+ *                  state
+ *
+ * Returns          BTM_INQUIRY_INACTIVE if inactive (0)
+ *                  BTM_LIMITED_INQUIRY_ACTIVE if a limted inquiry is active
+ *                  BTM_GENERAL_INQUIRY_ACTIVE if a general inquiry is active
+ *                  BTM_PERIODIC_INQUIRY_ACTIVE if a periodic inquiry is active
+ *
+ ******************************************************************************/
+uint16_t bluetooth::shim::BTM_IsInquiryActive(void) {
+  if (shim_btm.IsLimitedInquiryActive()) {
+    return BTM_LIMITED_INQUIRY_ACTIVE;
+  } else if (shim_btm.IsGeneralInquiryActive()) {
+    return BTM_GENERAL_INQUIRY_ACTIVE;
+  } else if (shim_btm.IsGeneralPeriodicInquiryActive() ||
+             shim_btm.IsLimitedPeriodicInquiryActive()) {
+    return BTM_PERIODIC_INQUIRY_ACTIVE;
+  }
+  return BTM_INQUIRY_INACTIVE;
+}
+
+/*******************************************************************************
+ *
+ * Function         BTM_CancelInquiry
+ *
+ * Description      This function cancels an inquiry if active
+ *
+ * Returns          BTM_SUCCESS if successful
+ *                  BTM_NO_RESOURCES if could not allocate a message buffer
+ *                  BTM_WRONG_MODE if the device is not up.
+ *
+ ******************************************************************************/
+tBTM_STATUS bluetooth::shim::BTM_CancelInquiry(void) {
+  shim_btm.CancelInquiry();
+  return BTM_SUCCESS;
+}
+
+/*******************************************************************************
+ *
+ * Function         BTM_ReadRemoteDeviceName
+ *
+ * Description      This function initiates a remote device HCI command to the
+ *                  controller and calls the callback when the process has
+ *                  completed.
+ *
+ * Input Params:    remote_bda      - device address of name to retrieve
+ *                  p_cb            - callback function called when
+ *                                    BTM_CMD_STARTED is returned.
+ *                                    A pointer to tBTM_REMOTE_DEV_NAME is
+ *                                    passed to the callback.
+ *
+ * Returns
+ *                  BTM_CMD_STARTED is returned if the request was successfully
+ *                                  sent to HCI.
+ *                  BTM_BUSY if already in progress
+ *                  BTM_UNKNOWN_ADDR if device address is bad
+ *                  BTM_NO_RESOURCES if could not allocate resources to start
+ *                                   the command
+ *                  BTM_WRONG_MODE if the device is not up.
+ *
+ ******************************************************************************/
+tBTM_STATUS bluetooth::shim::BTM_ReadRemoteDeviceName(
+    const RawAddress& remote_bda, tBTM_CMPL_CB* p_cb, tBT_TRANSPORT transport) {
+  if (transport == BT_TRANSPORT_LE) {
+    LOG_INFO(LOG_TAG, "UNIMPLEMENTED %s", __func__);
+    return BTM_NO_RESOURCES;
+  }
+
+  LOG_INFO(LOG_TAG, "UNIMPLEMENTED %s", __func__);
+  return BTM_NO_RESOURCES;
+  CHECK(p_cb != nullptr);
+}
+
+/*******************************************************************************
+ *
+ * Function         BTM_CancelRemoteDeviceName
+ *
+ * Description      This function initiates the cancel request for the specified
+ *                  remote device.
+ *
+ * Input Params:    None
+ *
+ * Returns
+ *                  BTM_CMD_STARTED is returned if the request was successfully
+ *                                  sent to HCI.
+ *                  BTM_NO_RESOURCES if could not allocate resources to start
+ *                                   the command
+ *                  BTM_WRONG_MODE if there is not an active remote name
+ *                                 request.
+ *
+ ******************************************************************************/
+tBTM_STATUS bluetooth::shim::BTM_CancelRemoteDeviceName(void) {
+  LOG_INFO(LOG_TAG, "UNIMPLEMENTED %s", __func__);
+  return BTM_NO_RESOURCES;
+}
+
+/*******************************************************************************
+ *
+ * Function         BTM_InqDbRead
+ *
+ * Description      This function looks through the inquiry database for a match
+ *                  based on Bluetooth Device Address. This is the application's
+ *                  interface to get the inquiry details of a specific BD
+ *                  address.
+ *
+ * Returns          pointer to entry, or NULL if not found
+ *
+ ******************************************************************************/
+tBTM_INQ_INFO* bluetooth::shim::BTM_InqDbRead(const RawAddress& p_bda) {
+  LOG_INFO(LOG_TAG, "UNIMPLEMENTED %s", __func__);
+  return nullptr;
+}
+
+/*******************************************************************************
+ *
+ * Function         BTM_InqDbFirst
+ *
+ * Description      This function looks through the inquiry database for the
+ *                  first used entry, and returns that. This is used in
+ *                  conjunction with
+ *                  BTM_InqDbNext by applications as a way to walk through the
+ *                  inquiry database.
+ *
+ * Returns          pointer to first in-use entry, or NULL if DB is empty
+ *
+ ******************************************************************************/
+tBTM_INQ_INFO* bluetooth::shim::BTM_InqDbFirst(void) {
+  LOG_INFO(LOG_TAG, "UNIMPLEMENTED %s", __func__);
+  return nullptr;
+}
+
+/*******************************************************************************
+ *
+ * Function         BTM_InqDbNext
+ *
+ * Description      This function looks through the inquiry database for the
+ *                  next used entry, and returns that.  If the input parameter
+ *                  is NULL, the first entry is returned.
+ *
+ * Returns          pointer to next in-use entry, or NULL if no more found.
+ *
+ ******************************************************************************/
+tBTM_INQ_INFO* bluetooth::shim::BTM_InqDbNext(tBTM_INQ_INFO* p_cur) {
+  LOG_INFO(LOG_TAG, "UNIMPLEMENTED %s", __func__);
+  CHECK(p_cur != nullptr);
+  return nullptr;
+}
+
+/*******************************************************************************
+ *
+ * Function         BTM_ClearInqDb
+ *
+ * Description      This function is called to clear out a device or all devices
+ *                  from the inquiry database.
+ *
+ * Parameter        p_bda - (input) BD_ADDR ->  Address of device to clear
+ *                                              (NULL clears all entries)
+ *
+ * Returns          BTM_BUSY if an inquiry, get remote name, or event filter
+ *                          is active, otherwise BTM_SUCCESS
+ *
+ ******************************************************************************/
+tBTM_STATUS bluetooth::shim::BTM_ClearInqDb(const RawAddress* p_bda) {
+  LOG_INFO(LOG_TAG, "UNIMPLEMENTED %s", __func__);
+  if (p_bda == nullptr) {
+    // clear all entries
+  } else {
+    // clear specific entry
+  }
+  return BTM_NO_RESOURCES;
+}
+
+/*******************************************************************************
+ *
+ * Function         BTM_ReadInquiryRspTxPower
+ *
+ * Description      This command will read the inquiry Transmit Power level used
+ *                  to transmit the FHS and EIR data packets. This can be used
+ *                  directly in the Tx Power Level EIR data type.
+ *
+ * Returns          BTM_SUCCESS if successful
+ *
+ ******************************************************************************/
+tBTM_STATUS bluetooth::shim::BTM_ReadInquiryRspTxPower(tBTM_CMPL_CB* p_cb) {
+  LOG_INFO(LOG_TAG, "UNIMPLEMENTED %s", __func__);
+  CHECK(p_cb != nullptr);
+  return BTM_NO_RESOURCES;
+}
+
+/*******************************************************************************
+ *
+ * Function         BTM_WriteEIR
+ *
+ * Description      This function is called to write EIR data to controller.
+ *
+ * Parameters       p_buff - allocated HCI command buffer including extended
+ *                           inquriry response
+ *
+ * Returns          BTM_SUCCESS  - if successful
+ *                  BTM_MODE_UNSUPPORTED - if local device cannot support it
+ *
+ ******************************************************************************/
+tBTM_STATUS bluetooth::shim::BTM_WriteEIR(BT_HDR* p_buff) {
+  LOG_INFO(LOG_TAG, "UNIMPLEMENTED %s", __func__);
+  CHECK(p_buff != nullptr);
+  return BTM_NO_RESOURCES;
+}
+
+/*******************************************************************************
+ *
+ * Function         BTM_HasEirService
+ *
+ * Description      This function is called to know if UUID in bit map of UUID.
+ *
+ * Parameters       p_eir_uuid - bit map of UUID list
+ *                  uuid16 - UUID 16-bit
+ *
+ * Returns          true - if found
+ *                  false - if not found
+ *
+ ******************************************************************************/
+bool bluetooth::shim::BTM_HasEirService(const uint32_t* p_eir_uuid,
+                                        uint16_t uuid16) {
+  LOG_INFO(LOG_TAG, "UNIMPLEMENTED %s", __func__);
+  CHECK(p_eir_uuid != nullptr);
+  return false;
+}
+
+/*******************************************************************************
+ *
+ * Function         BTM_HasInquiryEirService
+ *
+ * Description      This function is called to know if UUID in bit map of UUID
+ *                  list.
+ *
+ * Parameters       p_results - inquiry results
+ *                  uuid16 - UUID 16-bit
+ *
+ * Returns          BTM_EIR_FOUND - if found
+ *                  BTM_EIR_NOT_FOUND - if not found and it is complete list
+ *                  BTM_EIR_UNKNOWN - if not found and it is not complete list
+ *
+ ******************************************************************************/
+tBTM_EIR_SEARCH_RESULT bluetooth::shim::BTM_HasInquiryEirService(
+    tBTM_INQ_RESULTS* p_results, uint16_t uuid16) {
+  LOG_INFO(LOG_TAG, "UNIMPLEMENTED %s", __func__);
+  CHECK(p_results != nullptr);
+  return BTM_EIR_UNKNOWN;
+}
+
+/*******************************************************************************
+ *
+ * Function         BTM_AddEirService
+ *
+ * Description      This function is called to add a service in bit map of UUID
+ *                  list.
+ *
+ * Parameters       p_eir_uuid - bit mask of UUID list for EIR
+ *                  uuid16 - UUID 16-bit
+ *
+ * Returns          None
+ *
+ ******************************************************************************/
+void bluetooth::shim::BTM_AddEirService(uint32_t* p_eir_uuid, uint16_t uuid16) {
+  LOG_INFO(LOG_TAG, "UNIMPLEMENTED %s", __func__);
+  CHECK(p_eir_uuid != nullptr);
+}
+
+/*******************************************************************************
+ *
+ * Function         BTM_RemoveEirService
+ *
+ * Description      This function is called to remove a service in bit map of
+ *                  UUID list.
+ *
+ * Parameters       p_eir_uuid - bit mask of UUID list for EIR
+ *                  uuid16 - UUID 16-bit
+ *
+ * Returns          None
+ *
+ ******************************************************************************/
+void bluetooth::shim::BTM_RemoveEirService(uint32_t* p_eir_uuid,
+                                           uint16_t uuid16) {
+  LOG_INFO(LOG_TAG, "UNIMPLEMENTED %s", __func__);
+  CHECK(p_eir_uuid != nullptr);
+}
+
+/*******************************************************************************
+ *
+ * Function         BTM_GetEirSupportedServices
+ *
+ * Description      This function is called to get UUID list from bit map of
+ *                  UUID list.
+ *
+ * Parameters       p_eir_uuid - bit mask of UUID list for EIR
+ *                  p - reference of current pointer of EIR
+ *                  max_num_uuid16 - max number of UUID can be written in EIR
+ *                  num_uuid16 - number of UUID have been written in EIR
+ *
+ * Returns          BTM_EIR_MORE_16BITS_UUID_TYPE, if it has more than max
+ *                  BTM_EIR_COMPLETE_16BITS_UUID_TYPE, otherwise
+ *
+ ******************************************************************************/
+uint8_t bluetooth::shim::BTM_GetEirSupportedServices(uint32_t* p_eir_uuid,
+                                                     uint8_t** p,
+                                                     uint8_t max_num_uuid16,
+                                                     uint8_t* p_num_uuid16) {
+  LOG_INFO(LOG_TAG, "UNIMPLEMENTED %s", __func__);
+  CHECK(p_eir_uuid != nullptr);
+  CHECK(p != nullptr);
+  CHECK(*p != nullptr);
+  CHECK(p_num_uuid16 != nullptr);
+  return BTM_NO_RESOURCES;
+}
+
+/*******************************************************************************
+ *
+ * Function         BTM_GetEirUuidList
+ *
+ * Description      This function parses EIR and returns UUID list.
+ *
+ * Parameters       p_eir - EIR
+ *                  eir_len - EIR len
+ *                  uuid_size - Uuid::kNumBytes16, Uuid::kNumBytes32,
+ *                              Uuid::kNumBytes128
+ *                  p_num_uuid - return number of UUID in found list
+ *                  p_uuid_list - return UUID list
+ *                  max_num_uuid - maximum number of UUID to be returned
+ *
+ * Returns          0 - if not found
+ *                  BTM_EIR_COMPLETE_16BITS_UUID_TYPE
+ *                  BTM_EIR_MORE_16BITS_UUID_TYPE
+ *                  BTM_EIR_COMPLETE_32BITS_UUID_TYPE
+ *                  BTM_EIR_MORE_32BITS_UUID_TYPE
+ *                  BTM_EIR_COMPLETE_128BITS_UUID_TYPE
+ *                  BTM_EIR_MORE_128BITS_UUID_TYPE
+ *
+ ******************************************************************************/
+uint8_t bluetooth::shim::BTM_GetEirUuidList(uint8_t* p_eir, size_t eir_len,
+                                            uint8_t uuid_size,
+                                            uint8_t* p_num_uuid,
+                                            uint8_t* p_uuid_list,
+                                            uint8_t max_num_uuid) {
+  LOG_INFO(LOG_TAG, "UNIMPLEMENTED %s", __func__);
+  CHECK(p_eir != nullptr);
+  CHECK(p_num_uuid != nullptr);
+  CHECK(p_uuid_list != nullptr);
+  return 0;
+}
+
+/**
+ *
+ * BLE API HERE
+ *
+ */
+
+bool bluetooth::shim::BTM_SecAddBleDevice(const RawAddress& bd_addr,
+                                          BD_NAME bd_name,
+                                          tBT_DEVICE_TYPE dev_type,
+                                          tBLE_ADDR_TYPE addr_type) {
+  LOG_INFO(LOG_TAG, "UNIMPLEMENTED %s", __func__);
+  return false;
+}
+
+/*******************************************************************************
+ *
+ * Function         BTM_SecAddBleKey
+ *
+ * Description      Add/modify LE device information.  This function will be
+ *                  normally called during host startup to restore all required
+ *                  information stored in the NVRAM.
+ *
+ * Parameters:      bd_addr          - BD address of the peer
+ *                  p_le_key         - LE key values.
+ *                  key_type         - LE SMP key type.
+ *
+ * Returns          true if added OK, else false
+ *
+ ******************************************************************************/
+bool bluetooth::shim::BTM_SecAddBleKey(const RawAddress& bd_addr,
+                                       tBTM_LE_KEY_VALUE* p_le_key,
+                                       tBTM_LE_KEY_TYPE key_type) {
+  LOG_INFO(LOG_TAG, "UNIMPLEMENTED %s", __func__);
+  CHECK(p_le_key != nullptr);
+  return false;
+}
+
+/*******************************************************************************
+ *
+ * Function         BTM_BleLoadLocalKeys
+ *
+ * Description      Local local identity key, encryption root or sign counter.
+ *
+ * Parameters:      key_type: type of key, can be BTM_BLE_KEY_TYPE_ID,
+ *                                                BTM_BLE_KEY_TYPE_ER
+ *                                             or BTM_BLE_KEY_TYPE_COUNTER.
+ *                  p_key: pointer to the key.
+ *
+ * Returns          non2.
+ *
+ ******************************************************************************/
+void bluetooth::shim::BTM_BleLoadLocalKeys(uint8_t key_type,
+                                           tBTM_BLE_LOCAL_KEYS* p_key) {
+  LOG_INFO(LOG_TAG, "UNIMPLEMENTED %s", __func__);
+  CHECK(p_key != nullptr);
+}
+
+static Octet16 bogus_root;
+
+/** Returns local device encryption root (ER) */
+const Octet16& bluetooth::shim::BTM_GetDeviceEncRoot() {
+  LOG_INFO(LOG_TAG, "UNIMPLEMENTED %s", __func__);
+  return bogus_root;
+}
+
+/** Returns local device identity root (IR). */
+const Octet16& bluetooth::shim::BTM_GetDeviceIDRoot() {
+  LOG_INFO(LOG_TAG, "UNIMPLEMENTED %s", __func__);
+  return bogus_root;
+}
+
+/** Return local device DHK. */
+const Octet16& bluetooth::shim::BTM_GetDeviceDHK() {
+  LOG_INFO(LOG_TAG, "UNIMPLEMENTED %s", __func__);
+  return bogus_root;
+}
+
+/*******************************************************************************
+ *
+ * Function         BTM_ReadConnectionAddr
+ *
+ * Description      This function is called to get the local device address
+ *                  information.
+ *
+ * Returns          void
+ *
+ ******************************************************************************/
+void bluetooth::shim::BTM_ReadConnectionAddr(const RawAddress& remote_bda,
+                                             RawAddress& local_conn_addr,
+                                             tBLE_ADDR_TYPE* p_addr_type) {
+  LOG_INFO(LOG_TAG, "UNIMPLEMENTED %s", __func__);
+  CHECK(p_addr_type != nullptr);
+}
+
+/*******************************************************************************
+ *
+ * Function         BTM_IsBleConnection
+ *
+ * Description      This function is called to check if the connection handle
+ *                  for an LE link
+ *
+ * Returns          true if connection is LE link, otherwise false.
+ *
+ ******************************************************************************/
+bool bluetooth::shim::BTM_IsBleConnection(uint16_t conn_handle) {
+  LOG_INFO(LOG_TAG, "UNIMPLEMENTED %s", __func__);
+  return false;
+}
+
+/*******************************************************************************
+ *
+ * Function       BTM_ReadRemoteConnectionAddr
+ *
+ * Description    This function is read the remote device address currently used
+ *
+ * Parameters     pseudo_addr: pseudo random address available
+ *                conn_addr:connection address used
+ *                p_addr_type : BD Address type, Public or Random of the address
+ *                              used
+ *
+ * Returns        bool, true if connection to remote device exists, else false
+ *
+ ******************************************************************************/
+bool bluetooth::shim::BTM_ReadRemoteConnectionAddr(
+    const RawAddress& pseudo_addr, RawAddress& conn_addr,
+    tBLE_ADDR_TYPE* p_addr_type) {
+  LOG_INFO(LOG_TAG, "UNIMPLEMENTED %s", __func__);
+  CHECK(p_addr_type != nullptr);
+  return false;
+}
+/*******************************************************************************
+ *
+ * Function         BTM_SecurityGrant
+ *
+ * Description      This function is called to grant security process.
+ *
+ * Parameters       bd_addr - peer device bd address.
+ *                  res     - result of the operation BTM_SUCCESS if success.
+ *                            Otherwise, BTM_REPEATED_ATTEMPTS if too many
+ *                            attempts.
+ *
+ * Returns          None
+ *
+ ******************************************************************************/
+void bluetooth::shim::BTM_SecurityGrant(const RawAddress& bd_addr,
+                                        uint8_t res) {
+  LOG_INFO(LOG_TAG, "UNIMPLEMENTED %s", __func__);
+}
+
+/*******************************************************************************
+ *
+ * Function         BTM_BlePasskeyReply
+ *
+ * Description      This function is called after Security Manager submitted
+ *                  passkey request to the application.
+ *
+ * Parameters:      bd_addr - Address of the device for which passkey was
+ *                            requested
+ *                  res     - result of the operation BTM_SUCCESS if success
+ *                  key_len - length in bytes of the Passkey
+ *                  p_passkey    - pointer to array with the passkey
+ *                  trusted_mask - bitwise OR of trusted services (array of
+ *                                 uint32_t)
+ *
+ ******************************************************************************/
+void bluetooth::shim::BTM_BlePasskeyReply(const RawAddress& bd_addr,
+                                          uint8_t res, uint32_t passkey) {
+  LOG_INFO(LOG_TAG, "UNIMPLEMENTED %s", __func__);
+}
+
+/*******************************************************************************
+ *
+ * Function         BTM_BleConfirmReply
+ *
+ * Description      This function is called after Security Manager submitted
+ *                  numeric comparison request to the application.
+ *
+ * Parameters:      bd_addr      - Address of the device with which numeric
+ *                                 comparison was requested
+ *                  res          - comparison result BTM_SUCCESS if success
+ *
+ ******************************************************************************/
+void bluetooth::shim::BTM_BleConfirmReply(const RawAddress& bd_addr,
+                                          uint8_t res) {
+  LOG_INFO(LOG_TAG, "UNIMPLEMENTED %s", __func__);
+}
+
+/*******************************************************************************
+ *
+ * Function         BTM_BleOobDataReply
+ *
+ * Description      This function is called to provide the OOB data for
+ *                  SMP in response to BTM_LE_OOB_REQ_EVT
+ *
+ * Parameters:      bd_addr     - Address of the peer device
+ *                  res         - result of the operation SMP_SUCCESS if success
+ *                  p_data      - oob data, depending on transport and
+ *                                capabilities.
+ *                                Might be "Simple Pairing Randomizer", or
+ *                                "Security Manager TK Value".
+ *
+ ******************************************************************************/
+void bluetooth::shim::BTM_BleOobDataReply(const RawAddress& bd_addr,
+                                          uint8_t res, uint8_t len,
+                                          uint8_t* p_data) {
+  LOG_INFO(LOG_TAG, "UNIMPLEMENTED %s", __func__);
+  CHECK(p_data != nullptr);
+}
+
+/*******************************************************************************
+ *
+ * Function         BTM_BleSecureConnectionOobDataReply
+ *
+ * Description      This function is called to provide the OOB data for
+ *                  SMP in response to BTM_LE_OOB_REQ_EVT when secure connection
+ *                  data is available
+ *
+ * Parameters:      bd_addr     - Address of the peer device
+ *                  p_c         - pointer to Confirmation.
+ *                  p_r         - pointer to Randomizer
+ *
+ ******************************************************************************/
+void bluetooth::shim::BTM_BleSecureConnectionOobDataReply(
+    const RawAddress& bd_addr, uint8_t* p_c, uint8_t* p_r) {
+  LOG_INFO(LOG_TAG, "UNIMPLEMENTED %s", __func__);
+  CHECK(p_c != nullptr);
+  CHECK(p_r != nullptr);
+}
+
+/******************************************************************************
+ *
+ * Function         BTM_BleSetConnScanParams
+ *
+ * Description      Set scan parameter used in BLE connection request
+ *
+ * Parameters:      scan_interval: scan interval
+ *                  scan_window: scan window
+ *
+ * Returns          void
+ *
+ ******************************************************************************/
+void bluetooth::shim::BTM_BleSetConnScanParams(uint32_t scan_interval,
+                                               uint32_t scan_window) {
+  LOG_INFO(LOG_TAG, "UNIMPLEMENTED %s", __func__);
+}
+
+/********************************************************
+ *
+ * Function         BTM_BleSetPrefConnParams
+ *
+ * Description      Set a peripheral's preferred connection parameters
+ *
+ * Parameters:      bd_addr          - BD address of the peripheral
+ *                  scan_interval: scan interval
+ *                  scan_window: scan window
+ *                  min_conn_int     - minimum preferred connection interval
+ *                  max_conn_int     - maximum preferred connection interval
+ *                  slave_latency    - preferred slave latency
+ *                  supervision_tout - preferred supervision timeout
+ *
+ * Returns          void
+ *
+ ******************************************************************************/
+void bluetooth::shim::BTM_BleSetPrefConnParams(const RawAddress& bd_addr,
+                                               uint16_t min_conn_int,
+                                               uint16_t max_conn_int,
+                                               uint16_t slave_latency,
+                                               uint16_t supervision_tout) {
+  LOG_INFO(LOG_TAG, "UNIMPLEMENTED %s", __func__);
+}
+
+/*******************************************************************************
+ *
+ * Function         BTM_ReadDevInfo
+ *
+ * Description      This function is called to read the device/address type
+ *                  of BD address.
+ *
+ * Parameter        remote_bda: remote device address
+ *                  p_dev_type: output parameter to read the device type.
+ *                  p_addr_type: output parameter to read the address type.
+ *
+ ******************************************************************************/
+void bluetooth::shim::BTM_ReadDevInfo(const RawAddress& remote_bda,
+                                      tBT_DEVICE_TYPE* p_dev_type,
+                                      tBLE_ADDR_TYPE* p_addr_type) {
+  LOG_INFO(LOG_TAG, "UNIMPLEMENTED %s", __func__);
+  CHECK(p_dev_type != nullptr);
+  CHECK(p_addr_type != nullptr);
+}
+
+/*******************************************************************************
+ *
+ * Function         BTM_ReadConnectedTransportAddress
+ *
+ * Description      This function is called to read the paired device/address
+ *                  type of other device paired corresponding to the BD_address
+ *
+ * Parameter        remote_bda: remote device address, carry out the transport
+ *                              address
+ *                  transport: active transport
+ *
+ * Return           true if an active link is identified; false otherwise
+ *
+ ******************************************************************************/
+bool bluetooth::shim::BTM_ReadConnectedTransportAddress(
+    RawAddress* remote_bda, tBT_TRANSPORT transport) {
+  LOG_INFO(LOG_TAG, "UNIMPLEMENTED %s", __func__);
+  CHECK(remote_bda != nullptr);
+  return false;
+}
+
+/*******************************************************************************
+ *
+ * Function         BTM_BleReceiverTest
+ *
+ * Description      This function is called to start the LE Receiver test
+ *
+ * Parameter       rx_freq - Frequency Range
+ *               p_cmd_cmpl_cback - Command Complete callback
+ *
+ ******************************************************************************/
+void bluetooth::shim::BTM_BleReceiverTest(uint8_t rx_freq,
+                                          tBTM_CMPL_CB* p_cmd_cmpl_cback) {
+  LOG_INFO(LOG_TAG, "UNIMPLEMENTED %s", __func__);
+  CHECK(p_cmd_cmpl_cback != nullptr);
+}
+
+/*******************************************************************************
+ *
+ * Function         BTM_BleTransmitterTest
+ *
+ * Description      This function is called to start the LE Transmitter test
+ *
+ * Parameter       tx_freq - Frequency Range
+ *                       test_data_len - Length in bytes of payload data in each
+ *                                       packet
+ *                       packet_payload - Pattern to use in the payload
+ *                       p_cmd_cmpl_cback - Command Complete callback
+ *
+ ******************************************************************************/
+void bluetooth::shim::BTM_BleTransmitterTest(uint8_t tx_freq,
+                                             uint8_t test_data_len,
+                                             uint8_t packet_payload,
+                                             tBTM_CMPL_CB* p_cmd_cmpl_cback) {
+  LOG_INFO(LOG_TAG, "UNIMPLEMENTED %s", __func__);
+  CHECK(p_cmd_cmpl_cback != nullptr);
+}
+
+/*******************************************************************************
+ *
+ * Function         BTM_BleTestEnd
+ *
+ * Description      This function is called to stop the in-progress TX or RX
+ *                  test
+ *
+ * Parameter       p_cmd_cmpl_cback - Command complete callback
+ *
+ ******************************************************************************/
+void bluetooth::shim::BTM_BleTestEnd(tBTM_CMPL_CB* p_cmd_cmpl_cback) {
+  LOG_INFO(LOG_TAG, "UNIMPLEMENTED %s", __func__);
+  CHECK(p_cmd_cmpl_cback != nullptr);
+}
+
+/*******************************************************************************
+ *
+ * Function         BTM_UseLeLink
+ *
+ * Description      This function is to select the underlying physical link to
+ *                  use.
+ *
+ * Returns          true to use LE, false use BR/EDR.
+ *
+ ******************************************************************************/
+bool bluetooth::shim::BTM_UseLeLink(const RawAddress& bd_addr) {
+  LOG_INFO(LOG_TAG, "UNIMPLEMENTED %s", __func__);
+  return false;
+}
+
+/*******************************************************************************
+ *
+ * Function         BTM_SetBleDataLength
+ *
+ * Description      This function is to set maximum BLE transmission packet size
+ *
+ * Returns          BTM_SUCCESS if success; otherwise failed.
+ *
+ ******************************************************************************/
+tBTM_STATUS bluetooth::shim::BTM_SetBleDataLength(const RawAddress& bd_addr,
+                                                  uint16_t tx_pdu_length) {
+  LOG_INFO(LOG_TAG, "UNIMPLEMENTED %s", __func__);
+  return BTM_NO_RESOURCES;
+}
+
+/*******************************************************************************
+ *
+ * Function         BTM_BleReadPhy
+ *
+ * Description      To read the current PHYs for specified LE connection
+ *
+ *
+ * Returns          BTM_SUCCESS if command successfully sent to controller,
+ *                  BTM_MODE_UNSUPPORTED if local controller doesn't support LE
+ *                  2M or LE Coded PHY,
+ *                  BTM_WRONG_MODE if Device in wrong mode for request.
+ *
+ ******************************************************************************/
+void bluetooth::shim::BTM_BleReadPhy(
+    const RawAddress& bd_addr,
+    base::Callback<void(uint8_t tx_phy, uint8_t rx_phy, uint8_t status)> cb) {
+  LOG_INFO(LOG_TAG, "UNIMPLEMENTED %s", __func__);
+}
+
+/*******************************************************************************
+ *
+ * Function         BTM_BleSetDefaultPhy
+ *
+ * Description      To set preferred PHY for ensuing LE connections
+ *
+ *
+ * Returns          BTM_SUCCESS if command successfully sent to controller,
+ *                  BTM_MODE_UNSUPPORTED if local controller doesn't support LE
+ *                  2M or LE Coded PHY
+ *
+ ******************************************************************************/
+tBTM_STATUS bluetooth::shim::BTM_BleSetDefaultPhy(uint8_t all_phys,
+                                                  uint8_t tx_phys,
+                                                  uint8_t rx_phys) {
+  LOG_INFO(LOG_TAG, "UNIMPLEMENTED %s", __func__);
+  return BTM_NO_RESOURCES;
+}
+
+/*******************************************************************************
+ *
+ * Function         BTM_BleSetPhy
+ *
+ * Description      To set PHY preferences for specified LE connection
+ *
+ *
+ * Returns          BTM_SUCCESS if command successfully sent to controller,
+ *                  BTM_MODE_UNSUPPORTED if local controller doesn't support LE
+ *                  2M or LE Coded PHY,
+ *                  BTM_ILLEGAL_VALUE if specified remote doesn't support LE 2M
+ *                  or LE Coded PHY,
+ *                  BTM_WRONG_MODE if Device in wrong mode for request.
+ *
+ ******************************************************************************/
+void bluetooth::shim::BTM_BleSetPhy(const RawAddress& bd_addr, uint8_t tx_phys,
+                                    uint8_t rx_phys, uint16_t phy_options) {
+  LOG_INFO(LOG_TAG, "UNIMPLEMENTED %s", __func__);
+}
+
+/*******************************************************************************
+ *
+ * Function         BTM_BleDataSignature
+ *
+ * Description      This function is called to sign the data using AES128 CMAC
+ *                  algorith.
+ *
+ * Parameter        bd_addr: target device the data to be signed for.
+ *                  p_text: singing data
+ *                  len: length of the data to be signed.
+ *                  signature: output parameter where data signature is going to
+ *                             be stored.
+ *
+ * Returns          true if signing sucessul, otherwise false.
+ *
+ ******************************************************************************/
+bool bluetooth::shim::BTM_BleDataSignature(const RawAddress& bd_addr,
+                                           uint8_t* p_text, uint16_t len,
+                                           BLE_SIGNATURE signature) {
+  LOG_INFO(LOG_TAG, "UNIMPLEMENTED %s", __func__);
+  CHECK(p_text != nullptr);
+  return false;
+}
+
+/*******************************************************************************
+ *
+ * Function         BTM_BleVerifySignature
+ *
+ * Description      This function is called to verify the data signature
+ *
+ * Parameter        bd_addr: target device the data to be signed for.
+ *                  p_orig:  original data before signature.
+ *                  len: length of the signing data
+ *                  counter: counter used when doing data signing
+ *                  p_comp: signature to be compared against.
+
+ * Returns          true if signature verified correctly; otherwise false.
+ *
+ ******************************************************************************/
+bool bluetooth::shim::BTM_BleVerifySignature(const RawAddress& bd_addr,
+                                             uint8_t* p_orig, uint16_t len,
+                                             uint32_t counter,
+                                             uint8_t* p_comp) {
+  LOG_INFO(LOG_TAG, "UNIMPLEMENTED %s", __func__);
+  CHECK(p_orig != nullptr);
+  CHECK(p_comp != nullptr);
+  return false;
+}
+
+/*******************************************************************************
+ *
+ * Function         BTM_GetLeSecurityState
+ *
+ * Description      This function is called to get security mode 1 flags and
+ *                  encryption key size for LE peer.
+ *
+ * Returns          bool    true if LE device is found, false otherwise.
+ *
+ ******************************************************************************/
+bool bluetooth::shim::BTM_GetLeSecurityState(const RawAddress& bd_addr,
+                                             uint8_t* p_le_dev_sec_flags,
+                                             uint8_t* p_le_key_size) {
+  LOG_INFO(LOG_TAG, "UNIMPLEMENTED %s", __func__);
+  CHECK(p_le_dev_sec_flags != nullptr);
+  CHECK(p_le_key_size != nullptr);
+  return false;
+}
+
+/*******************************************************************************
+ *
+ * Function         BTM_BleSecurityProcedureIsRunning
+ *
+ * Description      This function indicates if LE security procedure is
+ *                  currently running with the peer.
+ *
+ * Returns          bool    true if security procedure is running, false
+ *                  otherwise.
+ *
+ ******************************************************************************/
+bool bluetooth::shim::BTM_BleSecurityProcedureIsRunning(
+    const RawAddress& bd_addr) {
+  LOG_INFO(LOG_TAG, "UNIMPLEMENTED %s", __func__);
+  return false;
+}
+
+/*******************************************************************************
+ *
+ * Function         BTM_BleGetSupportedKeySize
+ *
+ * Description      This function gets the maximum encryption key size in bytes
+ *                  the local device can suport.
+ *                  record.
+ *
+ * Returns          the key size or 0 if the size can't be retrieved.
+ *
+ ******************************************************************************/
+uint8_t bluetooth::shim::BTM_BleGetSupportedKeySize(const RawAddress& bd_addr) {
+  LOG_INFO(LOG_TAG, "UNIMPLEMENTED %s", __func__);
+  return 0;
+}
+
+/**
+ * This function update(add,delete or clear) the adv local name filtering
+ * condition.
+ */
+void bluetooth::shim::BTM_LE_PF_local_name(tBTM_BLE_SCAN_COND_OP action,
+                                           tBTM_BLE_PF_FILT_INDEX filt_index,
+                                           std::vector<uint8_t> name,
+                                           tBTM_BLE_PF_CFG_CBACK cb) {
+  LOG_INFO(LOG_TAG, "UNIMPLEMENTED %s", __func__);
+}
+
+void bluetooth::shim::BTM_LE_PF_srvc_data(tBTM_BLE_SCAN_COND_OP action,
+                                          tBTM_BLE_PF_FILT_INDEX filt_index) {
+  LOG_INFO(LOG_TAG, "UNIMPLEMENTED %s", __func__);
+}
+
+void bluetooth::shim::BTM_LE_PF_manu_data(
+    tBTM_BLE_SCAN_COND_OP action, tBTM_BLE_PF_FILT_INDEX filt_index,
+    uint16_t company_id, uint16_t company_id_mask, std::vector<uint8_t> data,
+    std::vector<uint8_t> data_mask, tBTM_BLE_PF_CFG_CBACK cb) {
+  LOG_INFO(LOG_TAG, "UNIMPLEMENTED %s", __func__);
+}
+
+void bluetooth::shim::BTM_LE_PF_srvc_data_pattern(
+    tBTM_BLE_SCAN_COND_OP action, tBTM_BLE_PF_FILT_INDEX filt_index,
+    std::vector<uint8_t> data, std::vector<uint8_t> data_mask,
+    tBTM_BLE_PF_CFG_CBACK cb) {
+  LOG_INFO(LOG_TAG, "UNIMPLEMENTED %s", __func__);
+}
+
+void bluetooth::shim::BTM_LE_PF_addr_filter(tBTM_BLE_SCAN_COND_OP action,
+                                            tBTM_BLE_PF_FILT_INDEX filt_index,
+                                            tBLE_BD_ADDR addr,
+                                            tBTM_BLE_PF_CFG_CBACK cb) {
+  LOG_INFO(LOG_TAG, "UNIMPLEMENTED %s", __func__);
+}
+
+void bluetooth::shim::BTM_LE_PF_uuid_filter(tBTM_BLE_SCAN_COND_OP action,
+                                            tBTM_BLE_PF_FILT_INDEX filt_index,
+                                            tBTM_BLE_PF_COND_TYPE filter_type,
+                                            const bluetooth::Uuid& uuid,
+                                            tBTM_BLE_PF_LOGIC_TYPE cond_logic,
+                                            const bluetooth::Uuid& uuid_mask,
+                                            tBTM_BLE_PF_CFG_CBACK cb) {
+  LOG_INFO(LOG_TAG, "UNIMPLEMENTED %s", __func__);
+}
+
+void bluetooth::shim::BTM_LE_PF_set(tBTM_BLE_PF_FILT_INDEX filt_index,
+                                    std::vector<ApcfCommand> commands,
+                                    tBTM_BLE_PF_CFG_CBACK cb) {
+  LOG_INFO(LOG_TAG, "UNIMPLEMENTED %s", __func__);
+}
+
+void bluetooth::shim::BTM_LE_PF_clear(tBTM_BLE_PF_FILT_INDEX filt_index,
+                                      tBTM_BLE_PF_CFG_CBACK cb) {
+  LOG_INFO(LOG_TAG, "UNIMPLEMENTED %s", __func__);
+}
+
+void bluetooth::shim::BTM_BleAdvFilterParamSetup(
+    int action, tBTM_BLE_PF_FILT_INDEX filt_index,
+    std::unique_ptr<btgatt_filt_param_setup_t> p_filt_params,
+    tBTM_BLE_PF_PARAM_CB cb) {
+  LOG_INFO(LOG_TAG, "UNIMPLEMENTED %s", __func__);
+}
+
+void bluetooth::shim::BTM_BleEnableDisableFilterFeature(
+    uint8_t enable, tBTM_BLE_PF_STATUS_CBACK p_stat_cback) {
+  LOG_INFO(LOG_TAG, "UNIMPLEMENTED %s", __func__);
+}
diff --git a/main/shim/btm_api.h b/main/shim/btm_api.h
new file mode 100644
index 0000000..6cd1fc4
--- /dev/null
+++ b/main/shim/btm_api.h
@@ -0,0 +1,2785 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#pragma once
+
+#include "stack/include/btm_api_types.h"
+#include "stack/include/btm_ble_api_types.h"
+
+namespace bluetooth {
+namespace shim {
+
+/*******************************************************************************
+ *
+ * Function         BTM_DeviceReset
+ *
+ * Description      This function is called to reset the controller.  The
+ *                  Callback function if provided is called when startup of the
+ *                  device has completed.
+ *
+ * Returns          void
+ *
+ ******************************************************************************/
+void BTM_DeviceReset(tBTM_CMPL_CB* p_cb);
+
+/*******************************************************************************
+ *
+ * Function         BTM_IsDeviceUp
+ *
+ * Description      This function is called to check if the device is up.
+ *
+ * Returns          true if device is up, else false
+ *
+ ******************************************************************************/
+bool BTM_IsDeviceUp(void);
+
+/*******************************************************************************
+ *
+ * Function         BTM_SetLocalDeviceName
+ *
+ * Description      This function is called to set the local device name.
+ *
+ * Returns          BTM_CMD_STARTED if successful, otherwise an error
+ *
+ ******************************************************************************/
+tBTM_STATUS BTM_SetLocalDeviceName(char* p_name);
+
+/*******************************************************************************
+ *
+ * Function         BTM_SetDeviceClass
+ *
+ * Description      This function is called to set the local device class
+ *
+ * Returns          BTM_SUCCESS if successful, otherwise an error
+ *
+ ******************************************************************************/
+tBTM_STATUS BTM_SetDeviceClass(DEV_CLASS dev_class);
+
+/*******************************************************************************
+ *
+ * Function         BTM_ReadLocalDeviceName
+ *
+ * Description      This function is called to read the local device name.
+ *
+ * Returns          status of the operation
+ *                  If success, BTM_SUCCESS is returned and p_name points stored
+ *                              local device name
+ *                  If BTM doesn't store local device name, BTM_NO_RESOURCES is
+ *                              is returned and p_name is set to NULL
+ *
+ ******************************************************************************/
+tBTM_STATUS BTM_ReadLocalDeviceName(char** p_name);
+
+/*******************************************************************************
+ *
+ * Function         BTM_ReadLocalDeviceNameFromController
+ *
+ * Description      Get local device name from controller. Do not use cached
+ *                  name (used to get chip-id prior to btm reset complete).
+ *
+ * Returns          BTM_CMD_STARTED if successful, otherwise an error
+ *
+ ******************************************************************************/
+tBTM_STATUS BTM_ReadLocalDeviceNameFromController(
+    tBTM_CMPL_CB* p_rln_cmpl_cback);
+
+/*******************************************************************************
+ *
+ * Function         BTM_ReadDeviceClass
+ *
+ * Description      This function is called to read the local device class
+ *
+ * Returns          pointer to the device class
+ *
+ ******************************************************************************/
+uint8_t* BTM_ReadDeviceClass(void);
+
+/*******************************************************************************
+ *
+ * Function         BTM_ReadLocalFeatures
+ *
+ * Description      This function is called to read the local features
+ *
+ * Returns          pointer to the local features string
+ *
+ ******************************************************************************/
+uint8_t* BTM_ReadLocalFeatures(void);
+
+/*******************************************************************************
+ *
+ * Function         BTM_RegisterForDeviceStatusNotif
+ *
+ * Description      This function is called to register for device status
+ *                  change notifications.
+ *
+ * Returns          pointer to previous caller's callback function or NULL if
+ *                  first registration.
+ *
+ ******************************************************************************/
+tBTM_DEV_STATUS_CB* BTM_RegisterForDeviceStatusNotif(tBTM_DEV_STATUS_CB* p_cb);
+
+/*******************************************************************************
+ *
+ * Function         BTM_RegisterForVSEvents
+ *
+ * Description      This function is called to register/deregister for vendor
+ *                  specific HCI events.
+ *
+ *                  If is_register=true, then the function will be registered;
+ *                  otherwise the function will be deregistered.
+ *
+ * Returns          BTM_SUCCESS if successful,
+ *                  BTM_BUSY if maximum number of callbacks have already been
+ *                           registered.
+ *
+ ******************************************************************************/
+tBTM_STATUS BTM_RegisterForVSEvents(tBTM_VS_EVT_CB* p_cb, bool is_register);
+
+/*******************************************************************************
+ *
+ * Function         BTM_VendorSpecificCommand
+ *
+ * Description      Send a vendor specific HCI command to the controller.
+ *
+ ******************************************************************************/
+void BTM_VendorSpecificCommand(uint16_t opcode, uint8_t param_len,
+                               uint8_t* p_param_buf, tBTM_VSC_CMPL_CB* p_cb);
+
+/*******************************************************************************
+ *
+ * Function         BTM_AllocateSCN
+ *
+ * Description      Look through the Server Channel Numbers for a free one to be
+ *                  used with an RFCOMM connection.
+ *
+ * Returns          Allocated SCN number or 0 if none.
+ *
+ ******************************************************************************/
+uint8_t BTM_AllocateSCN(void);
+
+/*******************************************************************************
+ *
+ * Function         BTM_TryAllocateSCN
+ *
+ * Description      Try to allocate a fixed server channel
+ *
+ * Returns          Returns true if server channel was available
+ *
+ ******************************************************************************/
+bool BTM_TryAllocateSCN(uint8_t scn);
+
+/*******************************************************************************
+ *
+ * Function         BTM_FreeSCN
+ *
+ * Description      Free the specified SCN.
+ *
+ * Returns          true if successful, false if SCN is not in use or invalid
+ *
+ ******************************************************************************/
+bool BTM_FreeSCN(uint8_t scn);
+
+/*******************************************************************************
+ *
+ * Function         BTM_SetTraceLevel
+ *
+ * Description      This function sets the trace level for BTM.  If called with
+ *                  a value of 0xFF, it simply returns the current trace level.
+ *
+ * Returns          The new or current trace level
+ *
+ ******************************************************************************/
+uint8_t BTM_SetTraceLevel(uint8_t new_level);
+
+/*******************************************************************************
+ *
+ * Function         BTM_WritePageTimeout
+ *
+ * Description      Send HCI Wite Page Timeout.
+ *
+ ******************************************************************************/
+void BTM_WritePageTimeout(uint16_t timeout);
+
+/*******************************************************************************
+ *
+ * Function         BTM_WriteVoiceSettings
+ *
+ * Description      Send HCI Write Voice Settings command.
+ *                  See hcidefs.h for settings bitmask values.
+ *
+ ******************************************************************************/
+void BTM_WriteVoiceSettings(uint16_t settings);
+
+/*******************************************************************************
+ *
+ * Function         BTM_EnableTestMode
+ *
+ * Description      Send HCI the enable device under test command.
+ *
+ *                  Note: Controller can only be taken out of this mode by
+ *                      resetting the controller.
+ *
+ * Returns
+ *      BTM_SUCCESS         Command sent.
+ *      BTM_NO_RESOURCES    If out of resources to send the command.
+ *
+ *
+ ******************************************************************************/
+tBTM_STATUS BTM_EnableTestMode(void);
+
+/*******************************************************************************
+ * DEVICE DISCOVERY FUNCTIONS - Inquiry, Remote Name, Discovery, Class of Device
+ ******************************************************************************/
+
+/*******************************************************************************
+ *
+ * Function         BTM_SetDiscoverability
+ *
+ * Description      This function is called to set the device into or out of
+ *                  discoverable mode. Discoverable mode means inquiry
+ *                  scans are enabled.  If a value of '0' is entered for window
+ *                  or interval, the default values are used.
+ *
+ * Returns          BTM_SUCCESS if successful
+ *                  BTM_BUSY if a setting of the filter is already in progress
+ *                  BTM_NO_RESOURCES if couldn't get a memory pool buffer
+ *                  BTM_ILLEGAL_VALUE if a bad parameter was detected
+ *                  BTM_WRONG_MODE if the device is not up.
+ *
+ ******************************************************************************/
+tBTM_STATUS BTM_SetDiscoverability(uint16_t inq_mode, uint16_t window,
+                                   uint16_t interval);
+
+/*******************************************************************************
+ *
+ * Function         BTM_ReadDiscoverability
+ *
+ * Description      This function is called to read the current discoverability
+ *                  mode of the device.
+ *
+ * Output Params:   p_window - current inquiry scan duration
+ *                  p_interval - current inquiry scan interval
+ *
+ * Returns          BTM_NON_DISCOVERABLE, BTM_LIMITED_DISCOVERABLE, or
+ *                  BTM_GENERAL_DISCOVERABLE
+ *
+ ******************************************************************************/
+uint16_t BTM_ReadDiscoverability(uint16_t* p_window, uint16_t* p_interval);
+
+/*******************************************************************************
+ *
+ * Function         BTM_SetPeriodicInquiryMode
+ *
+ * Description      This function is called to set the device periodic inquiry
+ *                  mode. If the duration is zero, the periodic inquiry mode is
+ *                  cancelled.
+ *
+ * Parameters:      p_inqparms - pointer to the inquiry information
+ *                      mode - GENERAL or LIMITED inquiry
+ *                      duration - length in 1.28 sec intervals (If '0', the
+ *                                 inquiry is CANCELLED)
+ *                      max_resps - maximum amount of devices to search for
+ *                                  before ending the inquiry
+ *                      filter_cond_type - BTM_CLR_INQUIRY_FILTER,
+ *                                         BTM_FILTER_COND_DEVICE_CLASS, or
+ *                                         BTM_FILTER_COND_BD_ADDR
+ *                      filter_cond - value for the filter (based on
+ *                                                          filter_cond_type)
+ *
+ *                  max_delay - maximum amount of time between successive
+ *                              inquiries
+ *                  min_delay - minimum amount of time between successive
+ *                              inquiries
+ *                  p_results_cb - callback returning pointer to results
+ *                              (tBTM_INQ_RESULTS)
+ *
+ * Returns          BTM_CMD_STARTED if successfully started
+ *                  BTM_ILLEGAL_VALUE if a bad parameter is detected
+ *                  BTM_NO_RESOURCES if could not allocate a message buffer
+ *                  BTM_SUCCESS - if cancelling the periodic inquiry
+ *                  BTM_BUSY - if an inquiry is already active
+ *                  BTM_WRONG_MODE if the device is not up.
+ *
+ ******************************************************************************/
+tBTM_STATUS BTM_SetPeriodicInquiryMode(tBTM_INQ_PARMS* p_inqparms,
+                                       uint16_t max_delay, uint16_t min_delay,
+                                       tBTM_INQ_RESULTS_CB* p_results_cb);
+
+/*******************************************************************************
+ *
+ * Function         BTM_StartInquiry
+ *
+ * Description      This function is called to start an inquiry.
+ *
+ * Parameters:      p_inqparms - pointer to the inquiry information
+ *                      mode - GENERAL or LIMITED inquiry
+ *                      duration - length in 1.28 sec intervals (If '0', the
+ *                                 inquiry is CANCELLED)
+ *                      max_resps - maximum amount of devices to search for
+ *                                  before ending the inquiry
+ *                      filter_cond_type - BTM_CLR_INQUIRY_FILTER,
+ *                                         BTM_FILTER_COND_DEVICE_CLASS, or
+ *                                         BTM_FILTER_COND_BD_ADDR
+ *                      filter_cond - value for the filter (based on
+ *                                                          filter_cond_type)
+ *
+ *                  p_results_cb  - Pointer to the callback routine which gets
+ *                                called upon receipt of an inquiry result. If
+ *                                this field is NULL, the application is not
+ *                                notified.
+ *
+ *                  p_cmpl_cb   - Pointer to the callback routine which gets
+ *                                called upon completion.  If this field is
+ *                                NULL, the application is not notified when
+ *                                completed.
+ * Returns          tBTM_STATUS
+ *                  BTM_CMD_STARTED if successfully initiated
+ *                  BTM_BUSY if already in progress
+ *                  BTM_ILLEGAL_VALUE if parameter(s) are out of range
+ *                  BTM_NO_RESOURCES if could not allocate resources to start
+ *                                   the command
+ *                  BTM_WRONG_MODE if the device is not up.
+ *
+ ******************************************************************************/
+tBTM_STATUS BTM_StartInquiry(tBTM_INQ_PARMS* p_inqparms,
+                             tBTM_INQ_RESULTS_CB* p_results_cb,
+                             tBTM_CMPL_CB* p_cmpl_cb);
+
+/*******************************************************************************
+ *
+ * Function         BTM_IsInquiryActive
+ *
+ * Description      Return a bit mask of the current inquiry state
+ *
+ * Returns          BTM_INQUIRY_INACTIVE if inactive (0)
+ *                  BTM_LIMITED_INQUIRY_ACTIVE if a limted inquiry is active
+ *                  BTM_GENERAL_INQUIRY_ACTIVE if a general inquiry is active
+ *                  BTM_PERIODIC_INQUIRY_ACTIVE if a periodic inquiry is active
+ *
+ ******************************************************************************/
+uint16_t BTM_IsInquiryActive(void);
+
+/*******************************************************************************
+ *
+ * Function         BTM_CancelInquiry
+ *
+ * Description      This function cancels an inquiry if active
+ *
+ * Returns          BTM_SUCCESS if successful
+ *                  BTM_NO_RESOURCES if could not allocate a message buffer
+ *                  BTM_WRONG_MODE if the device is not up.
+ *
+ ******************************************************************************/
+tBTM_STATUS BTM_CancelInquiry(void);
+
+/*******************************************************************************
+ *
+ * Function         BTM_CancelPeriodicInquiry
+ *
+ * Description      This function cancels a periodic inquiry
+ *
+ * Returns
+ *                  BTM_NO_RESOURCES if could not allocate a message buffer
+ *                  BTM_SUCCESS - if cancelling the periodic inquiry
+ *                  BTM_WRONG_MODE if the device is not up.
+ *
+ ******************************************************************************/
+tBTM_STATUS BTM_CancelPeriodicInquiry(void);
+
+/*******************************************************************************
+ *
+ * Function         BTM_SetConnectability
+ *
+ * Description      This function is called to set the device into or out of
+ *                  connectable mode. Discoverable mode means page scans are
+ *                  enabled.
+ *
+ * Returns          BTM_SUCCESS if successful
+ *                  BTM_ILLEGAL_VALUE if a bad parameter is detected
+ *                  BTM_NO_RESOURCES if could not allocate a message buffer
+ *                  BTM_WRONG_MODE if the device is not up.
+ *
+ ******************************************************************************/
+tBTM_STATUS BTM_SetConnectability(uint16_t page_mode, uint16_t window,
+                                  uint16_t interval);
+
+/*******************************************************************************
+ *
+ * Function         BTM_ReadConnectability
+ *
+ * Description      This function is called to read the current discoverability
+ *                  mode of the device.
+ * Output Params    p_window - current page scan duration
+ *                  p_interval - current time between page scans
+ *
+ * Returns          BTM_NON_CONNECTABLE or BTM_CONNECTABLE
+ *
+ ******************************************************************************/
+uint16_t BTM_ReadConnectability(uint16_t* p_window, uint16_t* p_interval);
+
+/*******************************************************************************
+ *
+ * Function         BTM_SetInquiryMode
+ *
+ * Description      This function is called to set standard, with RSSI
+ *                  mode or extended of the inquiry for local device.
+ *
+ * Input Params:    BTM_INQ_RESULT_STANDARD, BTM_INQ_RESULT_WITH_RSSI or
+ *                  BTM_INQ_RESULT_EXTENDED
+ *
+ * Returns          BTM_SUCCESS if successful
+ *                  BTM_NO_RESOURCES if couldn't get a memory pool buffer
+ *                  BTM_ILLEGAL_VALUE if a bad parameter was detected
+ *                  BTM_WRONG_MODE if the device is not up.
+ *
+ ******************************************************************************/
+tBTM_STATUS BTM_SetInquiryMode(uint8_t mode);
+
+/*******************************************************************************
+ *
+ * Function         BTM_SetInquiryScanType
+ *
+ * Description      This function is called to set the iquiry scan-type to
+ *                  standard or interlaced.
+ *
+ * Input Params:    BTM_SCAN_TYPE_STANDARD or BTM_SCAN_TYPE_INTERLACED
+ *
+ * Returns          BTM_SUCCESS if successful
+ *                  BTM_MODE_UNSUPPORTED if not a 1.2 device
+ *                  BTM_WRONG_MODE if the device is not up.
+ *
+ ******************************************************************************/
+tBTM_STATUS BTM_SetInquiryScanType(uint16_t scan_type);
+
+/*******************************************************************************
+ *
+ * Function         BTM_SetPageScanType
+ *
+ * Description      This function is called to set the page scan-type to
+ *                  standard or interlaced.
+ *
+ * Input Params:    BTM_SCAN_TYPE_STANDARD or BTM_SCAN_TYPE_INTERLACED
+ *
+ * Returns          BTM_SUCCESS if successful
+ *                  BTM_MODE_UNSUPPORTED if not a 1.2 device
+ *                  BTM_WRONG_MODE if the device is not up.
+ *
+ ******************************************************************************/
+
+tBTM_STATUS BTM_SetPageScanType(uint16_t scan_type);
+
+/*******************************************************************************
+ *
+ * Function         BTM_ReadRemoteDeviceName
+ *
+ * Description      This function initiates a remote device HCI command to the
+ *                  controller and calls the callback when the process has
+ *                  completed.
+ *
+ * Input Params:    remote_bda      - device address of name to retrieve
+ *                  p_cb            - callback function called when
+ *                                    BTM_CMD_STARTED is returned.
+ *                                    A pointer to tBTM_REMOTE_DEV_NAME is
+ *                                    passed to the callback.
+ *
+ * Returns
+ *                  BTM_CMD_STARTED is returned if the request was successfully
+ *                                  sent to HCI.
+ *                  BTM_BUSY if already in progress
+ *                  BTM_UNKNOWN_ADDR if device address is bad
+ *                  BTM_NO_RESOURCES if resources could not be allocated to
+ *                                   start the command
+ *                  BTM_WRONG_MODE if the device is not up.
+ *
+ ******************************************************************************/
+tBTM_STATUS BTM_ReadRemoteDeviceName(const RawAddress& remote_bda,
+                                     tBTM_CMPL_CB* p_cb,
+                                     tBT_TRANSPORT transport);
+
+/*******************************************************************************
+ *
+ * Function         BTM_CancelRemoteDeviceName
+ *
+ * Description      This function initiates the cancel request for the specified
+ *                  remote device.
+ *
+ * Input Params:    None
+ *
+ * Returns
+ *                  BTM_CMD_STARTED is returned if the request was successfully
+ *                                  sent to HCI.
+ *                  BTM_NO_RESOURCES if resources could not be allocated to
+ *                                   start the command
+ *                  BTM_WRONG_MODE if there is no active remote name request.
+ *
+ ******************************************************************************/
+tBTM_STATUS BTM_CancelRemoteDeviceName(void);
+
+/*******************************************************************************
+ *
+ * Function         BTM_ReadRemoteVersion
+ *
+ * Description      This function is called to read a remote device's version
+ *
+ * Returns          BTM_SUCCESS if successful, otherwise an error
+ *
+ ******************************************************************************/
+tBTM_STATUS BTM_ReadRemoteVersion(const RawAddress& addr, uint8_t* lmp_version,
+                                  uint16_t* manufacturer,
+                                  uint16_t* lmp_sub_version);
+
+/*******************************************************************************
+ *
+ * Function         BTM_ReadRemoteFeatures
+ *
+ * Description      This function is called to read a remote device's
+ *                  supported features mask (features mask located at page 0)
+ *
+ *                  Note: The size of device features mask page is
+ *                  BTM_FEATURE_BYTES_PER_PAGE bytes.
+ *
+ * Returns          pointer to the remote supported features mask
+ *
+ ******************************************************************************/
+uint8_t* BTM_ReadRemoteFeatures(const RawAddress& addr);
+
+/*******************************************************************************
+ *
+ * Function         BTM_ReadRemoteExtendedFeatures
+ *
+ * Description      This function is called to read a specific extended features
+ *                  page of the remote device
+ *
+ *                  Note1: The size of device features mask page is
+ *                  BTM_FEATURE_BYTES_PER_PAGE bytes.
+ *                  Note2: The valid device features mask page number depends on
+ *                  the remote device capabilities. It is expected to be in the
+ *                  range [0 - BTM_EXT_FEATURES_PAGE_MAX].
+
+ * Returns          pointer to the remote extended features mask
+ *                  or NULL if page_number is not valid
+ *
+ ******************************************************************************/
+uint8_t* BTM_ReadRemoteExtendedFeatures(const RawAddress& addr,
+                                        uint8_t page_number);
+
+/*******************************************************************************
+ *
+ * Function         BTM_ReadNumberRemoteFeaturesPages
+ *
+ * Description      This function is called to retrieve the number of feature
+ *                  pages read from the remote device
+ *
+ * Returns          number of features pages read from the remote device
+ *
+ ******************************************************************************/
+uint8_t BTM_ReadNumberRemoteFeaturesPages(const RawAddress& addr);
+
+/*******************************************************************************
+ *
+ * Function         BTM_ReadAllRemoteFeatures
+ *
+ * Description      Read all the features of the remote device
+ *
+ * Returns          pointer to the byte[0] of the page[0] of the remote device
+ *                  feature mask.
+ *
+ * Note:            the function returns the pointer to the array of the size
+ *                  BTM_FEATURE_BYTES_PER_PAGE * (BTM_EXT_FEATURES_PAGE_MAX + 1)
+ *
+ ******************************************************************************/
+uint8_t* BTM_ReadAllRemoteFeatures(const RawAddress& addr);
+
+/*******************************************************************************
+ *
+ * Function         BTM_InqDbRead
+ *
+ * Description      This function looks through the inquiry database for a match
+ *                  based on Bluetooth Device Address. This is the application's
+ *                  interface to get the inquiry details of a specific BD
+ *                  address.
+ *
+ * Returns          pointer to entry, or NULL if not found
+ *
+ ******************************************************************************/
+tBTM_INQ_INFO* BTM_InqDbRead(const RawAddress& p_bda);
+
+/*******************************************************************************
+ *
+ * Function         BTM_InqDbFirst
+ *
+ * Description      This function looks through the inquiry database for the
+ *                  first used entry, and returns that. This is used in
+ *                  conjunction with BTM_InqDbNext by applications as a way to
+ *                  walk through the inquiry database.
+ *
+ * Returns          pointer to first in-use entry, or NULL if DB is empty
+ *
+ ******************************************************************************/
+tBTM_INQ_INFO* BTM_InqDbFirst(void);
+
+/*******************************************************************************
+ *
+ * Function         BTM_InqDbNext
+ *
+ * Description      This function looks through the inquiry database for the
+ *                  next used entry, and returns that.  If the input parameter
+ *                  is NULL, the first entry is returned.
+ *
+ * Returns          pointer to next in-use entry, or NULL if no more found.
+ *
+ ******************************************************************************/
+tBTM_INQ_INFO* BTM_InqDbNext(tBTM_INQ_INFO* p_cur);
+
+/*******************************************************************************
+ *
+ * Function         BTM_ClearInqDb
+ *
+ * Description      This function is called to clear out a device or all devices
+ *                  from the inquiry database.
+ *
+ * Parameter        p_bda - (input) BD_ADDR ->  Address of device to clear
+ *                                              (NULL clears all entries)
+ *
+ * Returns          BTM_BUSY if an inquiry, get remote name, or event filter
+ *                          is active, otherwise BTM_SUCCESS
+ *
+ ******************************************************************************/
+tBTM_STATUS BTM_ClearInqDb(const RawAddress* p_bda);
+
+/*******************************************************************************
+ *
+ * Function         BTM_ReadInquiryRspTxPower
+ *
+ * Description      This command will read the inquiry Transmit Power level used
+ *                  to transmit the FHS and EIR data packets.
+ *                  This can be used directly in the Tx Power Level EIR data
+ *                  type.
+ *
+ * Returns          BTM_SUCCESS if successful
+ *
+ ******************************************************************************/
+tBTM_STATUS BTM_ReadInquiryRspTxPower(tBTM_CMPL_CB* p_cb);
+
+/*****************************************************************************
+ *  ACL CHANNEL MANAGEMENT FUNCTIONS
+ ****************************************************************************/
+/*******************************************************************************
+ *
+ * Function         BTM_SetLinkPolicy
+ *
+ * Description      Create and send HCI "Write Policy Set" command
+ *
+ * Returns          BTM_CMD_STARTED if successfully initiated, otherwise error
+ *
+ ******************************************************************************/
+tBTM_STATUS BTM_SetLinkPolicy(const RawAddress& remote_bda, uint16_t* settings);
+
+/*******************************************************************************
+ *
+ * Function         BTM_SetDefaultLinkPolicy
+ *
+ * Description      Set the default value for HCI "Write Policy Set" command
+ *                  to use when an ACL link is created.
+ *
+ * Returns          void
+ *
+ ******************************************************************************/
+void BTM_SetDefaultLinkPolicy(uint16_t settings);
+
+/*******************************************************************************
+ *
+ * Function         BTM_SetDefaultLinkSuperTout
+ *
+ * Description      Set the default value for HCI "Write Link Supervision
+ *                  Timeout" command to use when an ACL link is created.
+ *
+ * Returns          void
+ *
+ ******************************************************************************/
+void BTM_SetDefaultLinkSuperTout(uint16_t timeout);
+
+/*******************************************************************************
+ *
+ * Function         BTM_SetLinkSuperTout
+ *
+ * Description      Create and send HCI "Write Link Supervision Timeout" command
+ *
+ * Returns          BTM_CMD_STARTED if successfully initiated, otherwise error
+ *
+ ******************************************************************************/
+tBTM_STATUS BTM_SetLinkSuperTout(const RawAddress& remote_bda,
+                                 uint16_t timeout);
+/*******************************************************************************
+ *
+ * Function         BTM_GetLinkSuperTout
+ *
+ * Description      Read the link supervision timeout value of the connection
+ *
+ * Returns          status of the operation
+ *
+ ******************************************************************************/
+tBTM_STATUS BTM_GetLinkSuperTout(const RawAddress& remote_bda,
+                                 uint16_t* p_timeout);
+
+/*******************************************************************************
+ *
+ * Function         BTM_IsAclConnectionUp
+ *
+ * Description      This function is called to check if an ACL connection exists
+ *                  to a specific remote BD Address.
+ *
+ * Returns          true if connection is up, else false.
+ *
+ ******************************************************************************/
+bool BTM_IsAclConnectionUp(const RawAddress& remote_bda,
+                           tBT_TRANSPORT transport);
+
+/*******************************************************************************
+ *
+ * Function         BTM_GetRole
+ *
+ * Description      This function is called to get the role of the local device
+ *                  for the ACL connection with the specified remote device
+ *
+ * Returns          BTM_SUCCESS if connection exists.
+ *                  BTM_UNKNOWN_ADDR if no active link with bd addr specified
+ *
+ ******************************************************************************/
+tBTM_STATUS BTM_GetRole(const RawAddress& remote_bd_addr, uint8_t* p_role);
+
+/*******************************************************************************
+ *
+ * Function         BTM_SwitchRole
+ *
+ * Description      This function is called to switch role between master and
+ *                  slave.  If role is already set it will do nothing.  If the
+ *                  command was initiated, the callback function is called upon
+ *                  completion.
+ *
+ * Returns          BTM_SUCCESS if already in specified role.
+ *                  BTM_CMD_STARTED if command issued to controller.
+ *                  BTM_NO_RESOURCES if memory couldn't be allocated to issue
+ *                                   the command
+ *                  BTM_UNKNOWN_ADDR if no active link with bd addr specified
+ *                  BTM_MODE_UNSUPPORTED if the local device does not support
+ *                                       role switching
+ *
+ ******************************************************************************/
+tBTM_STATUS BTM_SwitchRole(const RawAddress& remote_bd_addr, uint8_t new_role,
+                           tBTM_CMPL_CB* p_cb);
+
+/*******************************************************************************
+ *
+ * Function         BTM_ReadRSSI
+ *
+ * Description      This function is called to read the link policy settings.
+ *                  The address of link policy results are returned in the
+ *                  callback. (tBTM_RSSI_RESULT)
+ *
+ * Returns          BTM_CMD_STARTED if command issued to controller.
+ *                  BTM_NO_RESOURCES if memory couldn't be allocated to issue
+ *                                   the command
+ *                  BTM_UNKNOWN_ADDR if no active link with bd addr specified
+ *                  BTM_BUSY if command is already in progress
+ *
+ ******************************************************************************/
+tBTM_STATUS BTM_ReadRSSI(const RawAddress& remote_bda, tBTM_CMPL_CB* p_cb);
+
+/*******************************************************************************
+ *
+ * Function         BTM_ReadFailedContactCounter
+ *
+ * Description      This function is called to read the failed contact counter.
+ *                  The result is returned in the callback.
+ *                  (tBTM_FAILED_CONTACT_COUNTER_RESULT)
+ *
+ * Returns          BTM_CMD_STARTED if command issued to controller.
+ *                  BTM_NO_RESOURCES if memory couldn't be allocated to issue
+ *                                   the command
+ *                  BTM_UNKNOWN_ADDR if no active link with bd addr specified
+ *                  BTM_BUSY if command is already in progress
+ *
+ ******************************************************************************/
+tBTM_STATUS BTM_ReadFailedContactCounter(const RawAddress& remote_bda,
+                                         tBTM_CMPL_CB* p_cb);
+
+/*******************************************************************************
+ *
+ * Function         BTM_ReadAutomaticFlushTimeout
+ *
+ * Description      This function is called to read the automatic flush timeout.
+ *                  The result is returned in the callback.
+ *                  (tBTM_AUTOMATIC_FLUSH_TIMEOUT_RESULT)
+ *
+ * Returns          BTM_CMD_STARTED if command issued to controller.
+ *                  BTM_NO_RESOURCES if memory couldn't be allocated to issue
+ *                                   the command
+ *                  BTM_UNKNOWN_ADDR if no active link with bd addr specified
+ *                  BTM_BUSY if command is already in progress
+ *
+ ******************************************************************************/
+tBTM_STATUS BTM_ReadAutomaticFlushTimeout(const RawAddress& remote_bda,
+                                          tBTM_CMPL_CB* p_cb);
+
+/*******************************************************************************
+ *
+ * Function         BTM_ReadTxPower
+ *
+ * Description      This function is called to read the current connection
+ *                  TX power of the connection. The TX power level results
+ *                  are returned in the callback.
+ *                  (tBTM_RSSI_RESULT)
+ *
+ * Returns          BTM_CMD_STARTED if command issued to controller.
+ *                  BTM_NO_RESOURCES if memory couldn't be allocated to issue
+ *                                   the command
+ *                  BTM_UNKNOWN_ADDR if no active link with bd addr specified
+ *                  BTM_BUSY if command is already in progress
+ *
+ ******************************************************************************/
+tBTM_STATUS BTM_ReadTxPower(const RawAddress& remote_bda,
+                            tBT_TRANSPORT transport, tBTM_CMPL_CB* p_cb);
+
+/*******************************************************************************
+ *
+ * Function         BTM_ReadLinkQuality
+ *
+ * Description      This function is called to read the link quality.
+ *                  The value of the link quality is returned in the callback.
+ *                  (tBTM_LINK_QUALITY_RESULT)
+ *
+ * Returns          BTM_CMD_STARTED if command issued to controller.
+ *                  BTM_NO_RESOURCES if memory couldn't be allocated to issue
+ *                                   the command
+ *                  BTM_UNKNOWN_ADDR if no active link with bd addr specified
+ *                  BTM_BUSY if command is already in progress
+ *
+ ******************************************************************************/
+tBTM_STATUS BTM_ReadLinkQuality(const RawAddress& remote_bda,
+                                tBTM_CMPL_CB* p_cb);
+
+/*******************************************************************************
+ *
+ * Function         BTM_RegBusyLevelNotif
+ *
+ * Description      This function is called to register a callback to receive
+ *                  busy level change events.
+ *
+ * Returns          BTM_SUCCESS if successfully registered, otherwise error
+ *
+ ******************************************************************************/
+tBTM_STATUS BTM_RegBusyLevelNotif(tBTM_BL_CHANGE_CB* p_cb, uint8_t* p_level,
+                                  tBTM_BL_EVENT_MASK evt_mask);
+
+/*******************************************************************************
+ *
+ * Function         BTM_AclRegisterForChanges
+ *
+ * Description      This function is called to register a callback to receive
+ *                  ACL database change events, i.e. new connection or removed.
+ *
+ * Returns          BTM_SUCCESS if successfully initiated, otherwise error
+ *
+ ******************************************************************************/
+tBTM_STATUS BTM_AclRegisterForChanges(tBTM_ACL_DB_CHANGE_CB* p_cb);
+
+/*******************************************************************************
+ *
+ * Function         BTM_GetNumAclLinks
+ *
+ * Description      This function is called to count the number of
+ *                  ACL links that are active.
+ *
+ * Returns          uint16_t Number of active ACL links
+ *
+ ******************************************************************************/
+uint16_t BTM_GetNumAclLinks(void);
+
+/*******************************************************************************
+ *
+ * Function         BTM_SetQoS
+ *
+ * Description      This function is called to setup QoS
+ *
+ * Returns          BTM_CMD_STARTED if successfully initiated, otherwise error
+ *
+ ******************************************************************************/
+tBTM_STATUS BTM_SetQoS(const RawAddress& bd, FLOW_SPEC* p_flow,
+                       tBTM_CMPL_CB* p_cb);
+
+/*****************************************************************************
+ *  (e)SCO CHANNEL MANAGEMENT FUNCTIONS
+ ****************************************************************************/
+/*******************************************************************************
+ *
+ * Function         BTM_CreateSco
+ *
+ * Description      This function is called to create an SCO connection. If the
+ *                  "is_orig" flag is true, the connection will be originated,
+ *                  otherwise BTM will wait for the other side to connect.
+ *
+ * Returns          BTM_UNKNOWN_ADDR if the ACL connection is not up
+ *                  BTM_BUSY         if another SCO being set up to
+ *                                   the same BD address
+ *                  BTM_NO_RESOURCES if the max SCO limit has been reached
+ *                  BTM_CMD_STARTED  if the connection establishment is started.
+ *                                   In this case, "*p_sco_inx" is filled in
+ *                                   with the sco index used for the connection.
+ *
+ ******************************************************************************/
+tBTM_STATUS BTM_CreateSco(const RawAddress* remote_bda, bool is_orig,
+                          uint16_t pkt_types, uint16_t* p_sco_inx,
+                          tBTM_SCO_CB* p_conn_cb, tBTM_SCO_CB* p_disc_cb);
+
+/*******************************************************************************
+ *
+ * Function         BTM_RemoveSco
+ *
+ * Description      This function is called to remove a specific SCO connection.
+ *
+ * Returns          BTM_CMD_STARTED if successfully initiated, otherwise error
+ *
+ ******************************************************************************/
+tBTM_STATUS BTM_RemoveSco(uint16_t sco_inx);
+
+/*******************************************************************************
+ *
+ * Function         BTM_SetScoPacketTypes
+ *
+ * Description      This function is called to set the packet types used for
+ *                  a specific SCO connection,
+ *
+ * Parameters       pkt_types - One or more of the following
+ *                  BTM_SCO_PKT_TYPES_MASK_HV1
+ *                  BTM_SCO_PKT_TYPES_MASK_HV2
+ *                  BTM_SCO_PKT_TYPES_MASK_HV3
+ *                  BTM_SCO_PKT_TYPES_MASK_EV3
+ *                  BTM_SCO_PKT_TYPES_MASK_EV4
+ *                  BTM_SCO_PKT_TYPES_MASK_EV5
+ *
+ *                  BTM_SCO_LINK_ALL_MASK   - enables all supported types
+ *
+ * Returns          BTM_CMD_STARTED if successfully initiated, otherwise error
+ *
+ ******************************************************************************/
+tBTM_STATUS BTM_SetScoPacketTypes(uint16_t sco_inx, uint16_t pkt_types);
+
+/*******************************************************************************
+ *
+ * Function         BTM_ReadScoPacketTypes
+ *
+ * Description      This function is read the packet types used for a specific
+ *                  SCO connection.
+ *
+ * Returns       One or more of the following (bitmask)
+ *                  BTM_SCO_PKT_TYPES_MASK_HV1
+ *                  BTM_SCO_PKT_TYPES_MASK_HV2
+ *                  BTM_SCO_PKT_TYPES_MASK_HV3
+ *                  BTM_SCO_PKT_TYPES_MASK_EV3
+ *                  BTM_SCO_PKT_TYPES_MASK_EV4
+ *                  BTM_SCO_PKT_TYPES_MASK_EV5
+ *
+ * Returns          packet types supported for the connection
+ *
+ ******************************************************************************/
+uint16_t BTM_ReadScoPacketTypes(uint16_t sco_inx);
+
+/*******************************************************************************
+ *
+ * Function         BTM_ReadDeviceScoPacketTypes
+ *
+ * Description      This function is read the SCO packet types that
+ *                  the device supports.
+ *
+ * Returns          packet types supported by the device.
+ *
+ ******************************************************************************/
+uint16_t BTM_ReadDeviceScoPacketTypes(void);
+
+/*******************************************************************************
+ *
+ * Function         BTM_ReadScoHandle
+ *
+ * Description      Reead the HCI handle used for a specific SCO connection,
+ *
+ * Returns          handle for the connection, or 0xFFFF if invalid SCO index.
+ *
+ ******************************************************************************/
+uint16_t BTM_ReadScoHandle(uint16_t sco_inx);
+
+/*******************************************************************************
+ *
+ * Function         BTM_ReadScoBdAddr
+ *
+ * Description      This function is read the remote BD Address for a specific
+ *                  SCO connection,
+ *
+ * Returns          pointer to BD address or NULL if not known
+ *
+ ******************************************************************************/
+const RawAddress* BTM_ReadScoBdAddr(uint16_t sco_inx);
+
+/*******************************************************************************
+ *
+ * Function         BTM_ReadScoDiscReason
+ *
+ * Description      This function is returns the reason why an (e)SCO connection
+ *                  has been removed. It contains the value until read, or until
+ *                  another (e)SCO connection has disconnected.
+ *
+ * Returns          HCI reason or BTM_INVALID_SCO_DISC_REASON if not set.
+ *
+ ******************************************************************************/
+uint16_t BTM_ReadScoDiscReason(void);
+
+/*******************************************************************************
+ *
+ * Function         BTM_SetEScoMode
+ *
+ * Description      This function sets up the negotiated parameters for SCO or
+ *                  eSCO, and sets as the default mode used for calls to
+ *                  BTM_CreateSco.  It can be called only when there are no
+ *                  active (e)SCO links.
+ *
+ * Returns          BTM_SUCCESS if the successful.
+ *                  BTM_BUSY if there are one or more active (e)SCO links.
+ *
+ ******************************************************************************/
+tBTM_STATUS BTM_SetEScoMode(enh_esco_params_t* p_parms);
+
+/*******************************************************************************
+ *
+ * Function         BTM_SetWBSCodec
+ *
+ * Description      This function sends command to the controller to setup
+ *                  WBS codec for the upcoming eSCO connection.
+ *
+ * Returns          BTM_SUCCESS.
+ *
+ *
+ ******************************************************************************/
+tBTM_STATUS BTM_SetWBSCodec(tBTM_SCO_CODEC_TYPE codec_type);
+
+/*******************************************************************************
+ *
+ * Function         BTM_RegForEScoEvts
+ *
+ * Description      This function registers a SCO event callback with the
+ *                  specified instance.  It should be used to received
+ *                  connection indication events and change of link parameter
+ *                  events.
+ *
+ * Returns          BTM_SUCCESS if the successful.
+ *                  BTM_ILLEGAL_VALUE if there is an illegal sco_inx
+ *
+ ******************************************************************************/
+tBTM_STATUS BTM_RegForEScoEvts(uint16_t sco_inx, tBTM_ESCO_CBACK* p_esco_cback);
+
+/*******************************************************************************
+ *
+ * Function         BTM_ReadEScoLinkParms
+ *
+ * Description      This function returns the current eSCO link parameters for
+ *                  the specified handle.  This can be called anytime a
+ *                  connection is active, but is typically called after
+ *                  receiving the SCO opened callback.
+ *
+ *                  Note: If called over a 1.1 controller, only the packet types
+ *                        field has meaning.
+ *                  Note: If the upper layer doesn't know the current sco index,
+ *                  BTM_FIRST_ACTIVE_SCO_INDEX can be used as the first
+ *                  parameter to find the first active SCO index
+ *
+ * Returns          BTM_SUCCESS if returned data is valid connection.
+ *                  BTM_ILLEGAL_VALUE if no connection for specified sco_inx.
+ *                  BTM_MODE_UNSUPPORTED if local controller does not support
+ *                      1.2 specification.
+ *
+ ******************************************************************************/
+tBTM_STATUS BTM_ReadEScoLinkParms(uint16_t sco_inx, tBTM_ESCO_DATA* p_parms);
+
+/*******************************************************************************
+ *
+ * Function         BTM_ChangeEScoLinkParms
+ *
+ * Description      This function requests renegotiation of the parameters on
+ *                  the current eSCO Link.  If any of the changes are accepted
+ *                  by the controllers, the BTM_ESCO_CHG_EVT event is sent in
+ *                  the tBTM_ESCO_CBACK function with the current settings of
+ *                  the link. The callback is registered through the call to
+ *                  BTM_SetEScoMode.
+ *
+ *
+ * Returns          BTM_CMD_STARTED if command is successfully initiated.
+ *                  BTM_ILLEGAL_VALUE if no connection for specified sco_inx.
+ *                  BTM_NO_RESOURCES - not enough resources to initiate command.
+ *                  BTM_MODE_UNSUPPORTED if local controller does not support
+ *                      1.2 specification.
+ *
+ ******************************************************************************/
+tBTM_STATUS BTM_ChangeEScoLinkParms(uint16_t sco_inx,
+                                    tBTM_CHG_ESCO_PARAMS* p_parms);
+
+/*******************************************************************************
+ *
+ * Function         BTM_EScoConnRsp
+ *
+ * Description      This function is called upon receipt of an (e)SCO connection
+ *                  request event (BTM_ESCO_CONN_REQ_EVT) to accept or reject
+ *                  the request. Parameters used to negotiate eSCO links.
+ *                  If p_parms is NULL, then values set through BTM_SetEScoMode
+ *                  are used.
+ *                  If the link type of the incoming request is SCO, then only
+ *                  the tx_bw, max_latency, content format, and packet_types are
+ *                  valid.  The hci_status parameter should be
+ *                  ([0x0] to accept, [0x0d..0x0f] to reject)
+ *
+ *
+ * Returns          void
+ *
+ ******************************************************************************/
+void BTM_EScoConnRsp(uint16_t sco_inx, uint8_t hci_status,
+                     enh_esco_params_t* p_parms);
+
+/*******************************************************************************
+ *
+ * Function         BTM_GetNumScoLinks
+ *
+ * Description      This function returns the number of active SCO links.
+ *
+ * Returns          uint8_t
+ *
+ ******************************************************************************/
+uint8_t BTM_GetNumScoLinks(void);
+
+/*****************************************************************************
+ *  SECURITY MANAGEMENT FUNCTIONS
+ ****************************************************************************/
+/*******************************************************************************
+ *
+ * Function         BTM_SecRegister
+ *
+ * Description      Application manager calls this function to register for
+ *                  security services.  There can be one and only one
+ *                  application saving link keys.  BTM allows only first
+ *                  registration.
+ *
+ * Returns          true if registered OK, else false
+ *
+ ******************************************************************************/
+bool BTM_SecRegister(const tBTM_APPL_INFO* p_cb_info);
+
+/*******************************************************************************
+ *
+ * Function         BTM_SecRegisterLinkKeyNotificationCallback
+ *
+ * Description      Profiles can register to be notified when a new Link Key
+ *                  is generated per connection.
+ *
+ * Returns          true if registered OK, else false
+ *
+ ******************************************************************************/
+bool BTM_SecRegisterLinkKeyNotificationCallback(
+    tBTM_LINK_KEY_CALLBACK* p_callback);
+
+/*******************************************************************************
+ *
+ * Function         BTM_SecAddRmtNameNotifyCallback
+ *
+ * Description      Profiles can register to be notified when name of the
+ *                  remote device is resolved (up to
+ *                  BTM_SEC_MAX_RMT_NAME_CALLBACKS).
+ *
+ * Returns          true if registered OK, else false
+ *
+ ******************************************************************************/
+bool BTM_SecAddRmtNameNotifyCallback(tBTM_RMT_NAME_CALLBACK* p_callback);
+
+/*******************************************************************************
+ *
+ * Function         BTM_SecDeleteRmtNameNotifyCallback
+ *
+ * Description      A profile can deregister notification when a new Link Key
+ *                  is generated per connection.
+ *
+ * Returns          true if OK, else false
+ *
+ ******************************************************************************/
+bool BTM_SecDeleteRmtNameNotifyCallback(tBTM_RMT_NAME_CALLBACK* p_callback);
+
+/*******************************************************************************
+ *
+ * Function         BTM_GetSecurityFlags
+ *
+ * Description      Get security flags for the device
+ *
+ * Returns          bool    true or false is device found
+ *
+ ******************************************************************************/
+bool BTM_GetSecurityFlags(const RawAddress& bd_addr, uint8_t* p_sec_flags);
+
+/*******************************************************************************
+ *
+ * Function         BTM_GetSecurityFlagsByTransport
+ *
+ * Description      Get security flags for the device on a particular transport
+ *
+ * Parameters      bd_addr: BD address of remote device
+ *                  p_sec_flags : Out parameter to be filled with security
+ *                                flags for the connection
+ *                  transport :  Physical transport of the connection
+ *                               (BR/EDR or LE)
+ *
+ * Returns          bool    true or false is device found
+ *
+ ******************************************************************************/
+bool BTM_GetSecurityFlagsByTransport(const RawAddress& bd_addr,
+                                     uint8_t* p_sec_flags,
+                                     tBT_TRANSPORT transport);
+
+/*******************************************************************************
+ *
+ * Function         BTM_ReadTrustedMask
+ *
+ * Description      Get trusted mask for the device
+ *
+ * Returns          NULL, if the device record is not found.
+ *                  otherwise, the trusted mask
+ *
+ ******************************************************************************/
+uint32_t* BTM_ReadTrustedMask(const RawAddress& bd_addr);
+
+/*******************************************************************************
+ *
+ * Function         BTM_SetPinType
+ *
+ * Description      Set PIN type for the device.
+ *
+ * Returns          void
+ *
+ ******************************************************************************/
+void BTM_SetPinType(uint8_t pin_type, PIN_CODE pin_code, uint8_t pin_code_len);
+
+/*******************************************************************************
+ *
+ * Function         BTM_SetPairableMode
+ *
+ * Description      Enable or disable pairing
+ *
+ * Parameters       allow_pairing - (true or false) whether or not the device
+ *                      allows pairing.
+ *                  connect_only_paired - (true or false) whether or not to
+ *                      only allow paired devices to connect.
+ *
+ * Returns          void
+ *
+ ******************************************************************************/
+void BTM_SetPairableMode(bool allow_pairing, bool connect_only_paired);
+
+/*******************************************************************************
+ *
+ * Function         BTM_SetSecureConnectionsOnly
+ *
+ * Description      Enable or disable default treatment for Mode 4 Level 0
+ *                  services
+ *
+ * Parameter        secure_connections_only_mode - (true or false)
+ *                  true means that the device should treat Mode 4 Level 0
+ *                  services as services of other levels.
+ *                  false means that the device should provide default
+ *                  treatment for Mode 4 Level 0 services.
+ *
+ * Returns          void
+ *
+ ******************************************************************************/
+void BTM_SetSecureConnectionsOnly(bool secure_connections_only_mode);
+
+/*******************************************************************************
+ *
+ * Function         BTM_SetSecurityLevel
+ *
+ * Description      Register service security level with Security Manager.  Each
+ *                  service must register its requirements regardless of the
+ *                  security level that is used.  This API is called once for
+ *                  originators and again for acceptors of connections.
+ *
+ * Returns          true if registered OK, else false
+ *
+ ******************************************************************************/
+bool BTM_SetSecurityLevel(bool is_originator, const char* p_name,
+                          uint8_t service_id, uint16_t sec_level, uint16_t psm,
+                          uint32_t mx_proto_id, uint32_t mx_chan_id);
+
+/*******************************************************************************
+ *
+ * Function         BTM_SetOutService
+ *
+ * Description      This function is called to set the service for
+ *                  outgoing connection.
+ *
+ * Returns          void
+ *
+ ******************************************************************************/
+void BTM_SetOutService(const RawAddress& bd_addr, uint8_t service_id,
+                       uint32_t mx_chan_id);
+
+/*******************************************************************************
+ *
+ * Function         BTM_SecClrService
+ *
+ * Description      Removes specified service record(s) from the security
+ *                  database. All service records with the specified name are
+ *                  removed. Typically used only by devices with limited RAM
+ *                  so that it can reuse an old security service record.
+ *
+ * Returns          Number of records that were freed.
+ *
+ ******************************************************************************/
+uint8_t BTM_SecClrService(uint8_t service_id);
+
+/*******************************************************************************
+ *
+ * Function         BTM_SecAddDevice
+ *
+ * Description      Add/modify device.  This function will be normally called
+ *                  during host startup to restore all required information
+ *                  stored in the NVRAM.
+ *                  dev_class, bd_name, link_key, and features are NULL if
+ *                  unknown
+ *
+ * Returns          true if added OK, else false
+ *
+ ******************************************************************************/
+bool BTM_SecAddDevice(const RawAddress& bd_addr, DEV_CLASS dev_class,
+                      BD_NAME bd_name, uint8_t* features,
+                      uint32_t trusted_mask[], LinkKey* link_key,
+                      uint8_t key_type, tBTM_IO_CAP io_cap, uint8_t pin_length);
+
+/** Free resources associated with the device associated with |bd_addr| address.
+ *
+ * *** WARNING ***
+ * tBTM_SEC_DEV_REC associated with bd_addr becomes invalid after this function
+ * is called, also any of it's fields. i.e. if you use p_dev_rec->bd_addr, it is
+ * no longer valid!
+ * *** WARNING ***
+ *
+ * Returns true if removed OK, false if not found or ACL link is active.
+ */
+bool BTM_SecDeleteDevice(const RawAddress& bd_addr);
+
+/*******************************************************************************
+ *
+ * Function         BTM_SecClearSecurityFlags
+ *
+ * Description      Reset the security flags (mark as not-paired) for a given
+ *                  remove device.
+ *
+ ******************************************************************************/
+void BTM_SecClearSecurityFlags(const RawAddress& bd_addr);
+
+/*******************************************************************************
+ *
+ * Function         BTM_SecGetDeviceLinkKey
+ *
+ * Description      This function is called to obtain link key for the device
+ *                  it returns BTM_SUCCESS if link key is available, or
+ *                  BTM_UNKNOWN_ADDR if Security Manager does not know about
+ *                  the device or device record does not contain link key info
+ *
+ * Returns          BTM_SUCCESS if successful, otherwise error code
+ *
+ ******************************************************************************/
+tBTM_STATUS BTM_SecGetDeviceLinkKey(const RawAddress& bd_addr,
+                                    LinkKey* link_key);
+
+/*******************************************************************************
+ *
+ * Function         BTM_SecGetDeviceLinkKeyType
+ *
+ * Description      This function is called to obtain link key type for the
+ *                  device.
+ *                  it returns BTM_SUCCESS if link key is available, or
+ *                  BTM_UNKNOWN_ADDR if Security Manager does not know about
+ *                  the device or device record does not contain link key info
+ *
+ * Returns          BTM_LKEY_TYPE_IGNORE if link key is unknown, link type
+ *                  otherwise.
+ *
+ ******************************************************************************/
+tBTM_LINK_KEY_TYPE BTM_SecGetDeviceLinkKeyType(const RawAddress& bd_addr);
+
+/*******************************************************************************
+ *
+ * Function         BTM_PINCodeReply
+ *
+ * Description      This function is called after Security Manager submitted
+ *                  PIN code request to the UI.
+ *
+ * Parameters:      bd_addr      - Address of the device for which PIN was
+ *                                 requested
+ *                  res          - result of the operation BTM_SUCCESS if
+ *                                 success
+ *                  pin_len      - length in bytes of the PIN Code
+ *                  p_pin        - pointer to array with the PIN Code
+ *                  trusted_mask - bitwise OR of trusted services
+ *                                 (array of uint32_t)
+ *
+ * Returns          void
+ *
+ ******************************************************************************/
+void BTM_PINCodeReply(const RawAddress& bd_addr, uint8_t res, uint8_t pin_len,
+                      uint8_t* p_pin, uint32_t trusted_mask[]);
+
+/*******************************************************************************
+ *
+ * Function         BTM_SecBond
+ *
+ * Description      This function is called to perform bonding with peer device.
+ *
+ * Parameters:      bd_addr      - Address of the device to bond
+ *                  pin_len      - length in bytes of the PIN Code
+ *                  p_pin        - pointer to array with the PIN Code
+ *                  trusted_mask - bitwise OR of trusted services
+ *                                 (array of uint32_t)
+ * Returns          BTM_CMD_STARTED if successfully initiated, otherwise error
+ *
+ ******************************************************************************/
+tBTM_STATUS BTM_SecBond(const RawAddress& bd_addr, uint8_t pin_len,
+                        uint8_t* p_pin, uint32_t trusted_mask[]);
+
+/*******************************************************************************
+ *
+ * Function         BTM_SecBondByTransport
+ *
+ * Description      Perform bonding by designated transport
+ *
+ * Parameters:      bd_addr      - Address of the device to bond
+ *                  pin_len      - length in bytes of the PIN Code
+ *                  p_pin        - pointer to array with the PIN Code
+ *                  trusted_mask - bitwise OR of trusted services
+ *                                 (array of uint32_t)
+ *                  transport :  Physical transport to use for bonding
+ *                               (BR/EDR or LE)
+ *
+ * Returns          BTM_CMD_STARTED if successfully initiated, otherwise error
+ *
+ ******************************************************************************/
+tBTM_STATUS BTM_SecBondByTransport(const RawAddress& bd_addr,
+                                   tBT_TRANSPORT transport, uint8_t pin_len,
+                                   uint8_t* p_pin, uint32_t trusted_mask[]);
+
+/*******************************************************************************
+ *
+ * Function         BTM_SecBondCancel
+ *
+ * Description      This function is called to cancel ongoing bonding process
+ *                  with peer device.
+ *
+ * Returns          BTM_CMD_STARTED if successfully initiated, otherwise error
+ *
+ ******************************************************************************/
+tBTM_STATUS BTM_SecBondCancel(const RawAddress& bd_addr);
+
+/*******************************************************************************
+ *
+ * Function         BTM_SetEncryption
+ *
+ * Description      This function is called to ensure that connection is
+ *                  encrypted.  Should be called only on an open connection.
+ *                  Typically only needed for connections that first want to
+ *                  bring up unencrypted links, then later encrypt them.
+ *
+ * Parameters:      bd_addr       - Address of the peer device
+ *                  transport     - Link transport
+ *                  p_callback    - Pointer to callback function called if
+ *                                  this function returns PENDING after required
+ *                                  procedures are completed.  Can be set to
+ *                                  NULL if status is not desired.
+ *                  p_ref_data    - pointer to any data the caller wishes to
+ *                                  receive in the callback function upon
+ *                                  completion.
+ *                                  can be set to NULL if not used.
+ *                  sec_act       - LE security action, unused for BR/EDR
+ *
+ * Returns          BTM_SUCCESS   - already encrypted
+ *                  BTM_PENDING   - command will be returned in the callback
+ *                  BTM_WRONG_MODE- connection not up.
+ *                  BTM_BUSY      - security procedures are currently active
+ *                  BTM_MODE_UNSUPPORTED - if security manager not linked in.
+ *
+ ******************************************************************************/
+tBTM_STATUS BTM_SetEncryption(const RawAddress& bd_addr,
+                              tBT_TRANSPORT transport,
+                              tBTM_SEC_CBACK* p_callback, void* p_ref_data,
+                              tBTM_BLE_SEC_ACT sec_act);
+
+/*******************************************************************************
+ *
+ * Function         BTM_ConfirmReqReply
+ *
+ * Description      This function is called to confirm the numeric value for
+ *                  Simple Pairing in response to BTM_SP_CFM_REQ_EVT
+ *
+ * Parameters:      res           - result of the operation BTM_SUCCESS if
+ *                                  success
+ *                  bd_addr       - Address of the peer device
+ *
+ ******************************************************************************/
+void BTM_ConfirmReqReply(tBTM_STATUS res, const RawAddress& bd_addr);
+
+/*******************************************************************************
+ *
+ * Function         BTM_PasskeyReqReply
+ *
+ * Description      This function is called to provide the passkey for
+ *                  Simple Pairing in response to BTM_SP_KEY_REQ_EVT
+ *
+ * Parameters:      res           - result of the operation BTM_SUCCESS if
+ *                                  success
+ *                  bd_addr       - Address of the peer device
+ *                  passkey       - numeric value in the range of
+ *                                  0 - 999999(0xF423F).
+ *
+ ******************************************************************************/
+void BTM_PasskeyReqReply(tBTM_STATUS res, const RawAddress& bd_addr,
+                         uint32_t passkey);
+
+/*******************************************************************************
+ *
+ * Function         BTM_SendKeypressNotif
+ *
+ * Description      This function is used during the passkey entry model
+ *                  by a device with KeyboardOnly IO capabilities
+ *                  (very likely to be a HID Device).
+ *                  It is called by a HID Device to inform the remote device
+ *                  when a key has been entered or erased.
+ *
+ * Parameters:      bd_addr - Address of the peer device
+ *                  type - notification type
+ *
+ ******************************************************************************/
+void BTM_SendKeypressNotif(const RawAddress& bd_addr, tBTM_SP_KEY_TYPE type);
+
+/*******************************************************************************
+ *
+ * Function         BTM_IoCapRsp
+ *
+ * Description      This function is called in response to BTM_SP_IO_REQ_EVT
+ *                  When the event data io_req.oob_data is set to
+ *                  BTM_OOB_UNKNOWN by the tBTM_SP_CALLBACK implementation, this
+ *                  function is called to provide the actual response
+ *
+ * Parameters:      bd_addr - Address of the peer device
+ *                  io_cap  - The IO capability of local device.
+ *                  oob     - BTM_OOB_NONE or BTM_OOB_PRESENT.
+ *                  auth_req- MITM protection required or not.
+ *
+ ******************************************************************************/
+void BTM_IoCapRsp(const RawAddress& bd_addr, tBTM_IO_CAP io_cap,
+                  tBTM_OOB_DATA oob, tBTM_AUTH_REQ auth_req);
+
+/*******************************************************************************
+ *
+ * Function         BTM_ReadLocalOobData
+ *
+ * Description      This function is called to read the local OOB data from
+ *                  LM
+ *
+ ******************************************************************************/
+void BTM_ReadLocalOobData(void);
+
+/*******************************************************************************
+ *
+ * Function         BTM_RemoteOobDataReply
+ *
+ * Description      This function is called to provide the remote OOB data for
+ *                  Simple Pairing in response to BTM_SP_RMT_OOB_EVT
+ *
+ * Parameters:      bd_addr     - Address of the peer device
+ *                  c           - simple pairing Hash C.
+ *                  r           - simple pairing Randomizer  C.
+ *
+ ******************************************************************************/
+void BTM_RemoteOobDataReply(tBTM_STATUS res, const RawAddress& bd_addr,
+                            const Octet16& c, const Octet16& r);
+
+/*******************************************************************************
+ *
+ * Function         BTM_BuildOobData
+ *
+ * Description      This function is called to build the OOB data payload to
+ *                  be sent over OOB (non-Bluetooth) link
+ *
+ * Parameters:      p_data  - the location for OOB data
+ *                  max_len - p_data size.
+ *                  c       - simple pairing Hash C.
+ *                  r       - simple pairing Randomizer  C.
+ *                  name_len- 0, local device name would not be included.
+ *                            otherwise, the local device name is included for
+ *                            up to this specified length
+ *
+ * Returns          Number of bytes in p_data.
+ *
+ ******************************************************************************/
+uint16_t BTM_BuildOobData(uint8_t* p_data, uint16_t max_len, const Octet16& c,
+                          const Octet16& r, uint8_t name_len);
+
+/*******************************************************************************
+ *
+ * Function         BTM_BothEndsSupportSecureConnections
+ *
+ * Description      This function is called to check if both the local device
+ *                  and the peer device specified by bd_addr support BR/EDR
+ *                  Secure Connections.
+ *
+ * Parameters:      bd_addr - address of the peer
+ *
+ * Returns          true if BR/EDR Secure Connections are supported by both
+ *                  local and the remote device.
+ *                  else false.
+ *
+ ******************************************************************************/
+bool BTM_BothEndsSupportSecureConnections(const RawAddress& bd_addr);
+
+/*******************************************************************************
+ *
+ * Function         BTM_PeerSupportsSecureConnections
+ *
+ * Description      This function is called to check if the peer supports
+ *                  BR/EDR Secure Connections.
+ *
+ * Parameters:      bd_addr - address of the peer
+ *
+ * Returns          true if BR/EDR Secure Connections are supported by the peer,
+ *                  else false.
+ *
+ ******************************************************************************/
+bool BTM_PeerSupportsSecureConnections(const RawAddress& bd_addr);
+
+/*******************************************************************************
+ *
+ * Function         BTM_ReadOobData
+ *
+ * Description      This function is called to parse the OOB data payload
+ *                  received over OOB (non-Bluetooth) link
+ *
+ * Parameters:      p_data  - the location for OOB data
+ *                  eir_tag - The associated EIR tag to read the data.
+ *                  *p_len(output) - the length of the data with the given tag.
+ *
+ * Returns          the beginning of the data with the given tag.
+ *                  NULL, if the tag is not found.
+ *
+ ******************************************************************************/
+uint8_t* BTM_ReadOobData(uint8_t* p_data, uint8_t eir_tag, uint8_t* p_len);
+
+/*******************************************************************************
+ *
+ * Function         BTM_SecReadDevName
+ *
+ * Description      Looks for the device name in the security database for the
+ *                  specified BD address.
+ *
+ * Returns          Pointer to the name or NULL
+ *
+ ******************************************************************************/
+char* BTM_SecReadDevName(const RawAddress& bd_addr);
+
+/*****************************************************************************
+ *  POWER MANAGEMENT FUNCTIONS
+ ****************************************************************************/
+/*******************************************************************************
+ *
+ * Function         BTM_PmRegister
+ *
+ * Description      register or deregister with power manager
+ *
+ * Returns          BTM_SUCCESS if successful,
+ *                  BTM_NO_RESOURCES if no room to hold registration
+ *                  BTM_ILLEGAL_VALUE
+ *
+ ******************************************************************************/
+tBTM_STATUS BTM_PmRegister(uint8_t mask, uint8_t* p_pm_id,
+                           tBTM_PM_STATUS_CBACK* p_cb);
+
+/*******************************************************************************
+ *
+ * Function         BTM_SetPowerMode
+ *
+ * Description      store the mode in control block or
+ *                  alter ACL connection behavior.
+ *
+ * Returns          BTM_SUCCESS if successful,
+ *                  BTM_UNKNOWN_ADDR if bd addr is not active or bad
+ *
+ ******************************************************************************/
+tBTM_STATUS BTM_SetPowerMode(uint8_t pm_id, const RawAddress& remote_bda,
+                             const tBTM_PM_PWR_MD* p_mode);
+
+/*******************************************************************************
+ *
+ * Function         BTM_ReadPowerMode
+ *
+ * Description      This returns the current mode for a specific
+ *                  ACL connection.
+ *
+ * Input Param      remote_bda - device address of desired ACL connection
+ *
+ * Output Param     p_mode - address where the current mode is copied into.
+ *                          BTM_ACL_MODE_NORMAL
+ *                          BTM_ACL_MODE_HOLD
+ *                          BTM_ACL_MODE_SNIFF
+ *                          BTM_ACL_MODE_PARK
+ *                          (valid only if return code is BTM_SUCCESS)
+ *
+ * Returns          BTM_SUCCESS if successful,
+ *                  BTM_UNKNOWN_ADDR if bd addr is not active or bad
+ *
+ ******************************************************************************/
+tBTM_STATUS BTM_ReadPowerMode(const RawAddress& remote_bda,
+                              tBTM_PM_MODE* p_mode);
+
+/*******************************************************************************
+ *
+ * Function         BTM_SetSsrParams
+ *
+ * Description      This sends the given SSR parameters for the given ACL
+ *                  connection if it is in ACTIVE mode.
+ *
+ * Input Param      remote_bda - device address of desired ACL connection
+ *                  max_lat    - maximum latency (in 0.625ms)(0-0xFFFE)
+ *                  min_rmt_to - minimum remote timeout
+ *                  min_loc_to - minimum local timeout
+ *
+ *
+ * Returns          BTM_SUCCESS if the HCI command is issued successful,
+ *                  BTM_UNKNOWN_ADDR if bd addr is not active or bad
+ *                  BTM_CMD_STORED if the command is stored
+ *
+ ******************************************************************************/
+tBTM_STATUS BTM_SetSsrParams(const RawAddress& remote_bda, uint16_t max_lat,
+                             uint16_t min_rmt_to, uint16_t min_loc_to);
+
+/*******************************************************************************
+ *
+ * Function         BTM_GetHCIConnHandle
+ *
+ * Description      This function is called to get the handle for an ACL
+ *                  connection to a specific remote BD Address.
+ *
+ * Returns          the handle of the connection, or 0xFFFF if none.
+ *
+ ******************************************************************************/
+uint16_t BTM_GetHCIConnHandle(const RawAddress& remote_bda,
+                              tBT_TRANSPORT transport);
+
+/*******************************************************************************
+ *
+ * Function         BTM_DeleteStoredLinkKey
+ *
+ * Description      This function is called to delete link key for the specified
+ *                  device addresses from the NVRAM storage attached to the
+ *                  Bluetooth controller.
+ *
+ * Parameters:      bd_addr      - Addresses of the devices
+ *                  p_cb         - Call back function to be called to return
+ *                                 the results
+ *
+ ******************************************************************************/
+tBTM_STATUS BTM_DeleteStoredLinkKey(const RawAddress* bd_addr,
+                                    tBTM_CMPL_CB* p_cb);
+
+/*******************************************************************************
+ *
+ * Function         BTM_WriteEIR
+ *
+ * Description      This function is called to write EIR data to controller.
+ *
+ * Parameters       p_buff - allocated HCI command buffer including extended
+ *                           inquriry response
+ *
+ * Returns          BTM_SUCCESS  - if successful
+ *                  BTM_MODE_UNSUPPORTED - if local device cannot support it
+ *
+ ******************************************************************************/
+tBTM_STATUS BTM_WriteEIR(BT_HDR* p_buff);
+
+/*******************************************************************************
+ *
+ * Function         BTM_HasEirService
+ *
+ * Description      This function is called to know if UUID in bit map of UUID.
+ *
+ * Parameters       p_eir_uuid - bit map of UUID list
+ *                  uuid16 - UUID 16-bit
+ *
+ * Returns          true - if found
+ *                  false - if not found
+ *
+ ******************************************************************************/
+bool BTM_HasEirService(const uint32_t* p_eir_uuid, uint16_t uuid16);
+
+/*******************************************************************************
+ *
+ * Function         BTM_HasInquiryEirService
+ *
+ * Description      Return if a UUID is in the bit map of a UUID list.
+ *
+ * Parameters       p_results - inquiry results
+ *                  uuid16 - UUID 16-bit
+ *
+ * Returns          BTM_EIR_FOUND - if found
+ *                  BTM_EIR_NOT_FOUND - if not found and it is a complete list
+ *                  BTM_EIR_UNKNOWN - if not found and it is not complete list
+ *
+ ******************************************************************************/
+tBTM_EIR_SEARCH_RESULT BTM_HasInquiryEirService(tBTM_INQ_RESULTS* p_results,
+                                                uint16_t uuid16);
+
+/*******************************************************************************
+ *
+ * Function         BTM_AddEirService
+ *
+ * Description      This function is called to add a service in the bit map UUID
+ *                  list.
+ *
+ * Parameters       p_eir_uuid - bit mask of UUID list for EIR
+ *                  uuid16 - UUID 16-bit
+ *
+ * Returns          None
+ *
+ ******************************************************************************/
+void BTM_AddEirService(uint32_t* p_eir_uuid, uint16_t uuid16);
+
+/*******************************************************************************
+ *
+ * Function         BTM_RemoveEirService
+ *
+ * Description      This function is called to remove a service from the bit map
+ *                  UUID list.
+ *
+ * Parameters       p_eir_uuid - bit mask of UUID list for EIR
+ *                  uuid16 - UUID 16-bit
+ *
+ * Returns          None
+ *
+ ******************************************************************************/
+void BTM_RemoveEirService(uint32_t* p_eir_uuid, uint16_t uuid16);
+
+/*******************************************************************************
+ *
+ * Function         BTM_GetEirSupportedServices
+ *
+ * Description      This function is called to get UUID list from bit map UUID
+ *                  list.
+ *
+ * Parameters       p_eir_uuid - bit mask of UUID list for EIR
+ *                  p - reference of current pointer of EIR
+ *                  max_num_uuid16 - max number of UUID can be written in EIR
+ *                  num_uuid16 - number of UUID have been written in EIR
+ *
+ * Returns          BTM_EIR_MORE_16BITS_UUID_TYPE, if it has more than max
+ *                  BTM_EIR_COMPLETE_16BITS_UUID_TYPE, otherwise
+ *
+ ******************************************************************************/
+uint8_t BTM_GetEirSupportedServices(uint32_t* p_eir_uuid, uint8_t** p,
+                                    uint8_t max_num_uuid16,
+                                    uint8_t* p_num_uuid16);
+
+/*******************************************************************************
+ *
+ * Function         BTM_GetEirUuidList
+ *
+ * Description      This function parses EIR and returns UUID list.
+ *
+ * Parameters       p_eir - EIR
+ *                  eirl_len - EIR len
+ *                  uuid_size - Uuid::kNumBytes16, Uuid::kNumBytes32,
+ *                              Uuid::kNumBytes128
+ *                  p_num_uuid - return number of UUID in found list
+ *                  p_uuid_list - return UUID 16-bit list
+ *                  max_num_uuid - maximum number of UUID to be returned
+ *
+ * Returns          0 - if not found
+ *                  BTM_EIR_COMPLETE_16BITS_UUID_TYPE
+ *                  BTM_EIR_MORE_16BITS_UUID_TYPE
+ *                  BTM_EIR_COMPLETE_32BITS_UUID_TYPE
+ *                  BTM_EIR_MORE_32BITS_UUID_TYPE
+ *                  BTM_EIR_COMPLETE_128BITS_UUID_TYPE
+ *                  BTM_EIR_MORE_128BITS_UUID_TYPE
+ *
+ ******************************************************************************/
+uint8_t BTM_GetEirUuidList(uint8_t* p_eir, size_t eir_len, uint8_t uuid_size,
+                           uint8_t* p_num_uuid, uint8_t* p_uuid_list,
+                           uint8_t max_num_uuid);
+
+/*****************************************************************************
+ *  SCO OVER HCI
+ ****************************************************************************/
+/*******************************************************************************
+ *
+ * Function         BTM_ConfigScoPath
+ *
+ * Description      This function enable/disable SCO over HCI and registers SCO
+ *                  data callback if SCO over HCI is enabled.
+ *
+ * Parameter        path: SCO or HCI
+ *                  p_sco_data_cb: callback function or SCO data if path is set
+ *                                 to transport.
+ *                  p_pcm_param: pointer to the PCM interface parameter. If a
+ *                               NULL pointer is used, the PCM parameter
+ *                               maintained in the control block will be used;
+ *                               otherwise update the control block value.
+ *                  err_data_rpt: Lisbon feature to enable the erronous data
+ *                                report or not.
+ *
+ * Returns          BTM_SUCCESS if the successful.
+ *                  BTM_NO_RESOURCES: no rsource to start the command.
+ *                  BTM_ILLEGAL_VALUE: invalid callback function pointer.
+ *                  BTM_CMD_STARTED : Command sent. Waiting for command
+ *                                    complete event.
+ *
+ *
+ ******************************************************************************/
+tBTM_STATUS BTM_ConfigScoPath(esco_data_path_t path,
+                              tBTM_SCO_DATA_CB* p_sco_data_cb,
+                              tBTM_SCO_PCM_PARAM* p_pcm_param,
+                              bool err_data_rpt);
+
+/*******************************************************************************
+ *
+ * Function         BTM_WriteScoData
+ *
+ * Description      This function write SCO data to a specified instance. The
+ *                  data to be written p_buf needs to carry an offset of
+ *                  HCI_SCO_PREAMBLE_SIZE bytes, and the data length can not
+ *                  exceed BTM_SCO_DATA_SIZE_MAX bytes, whose default value is
+ *                  set to 60 and is configurable. Data longer than the maximum
+ *                  bytes will be truncated.
+ *
+ * Returns          BTM_SUCCESS: data write is successful
+ *                  BTM_ILLEGAL_VALUE: SCO data contains illegal offset value.
+ *                  BTM_SCO_BAD_LENGTH: SCO data length exceeds the max SCO
+ *                                      packet size.
+ *                  BTM_NO_RESOURCES: no resources.
+ *                  BTM_UNKNOWN_ADDR: unknown SCO connection handle, or SCO is
+ *                                    not routed via HCI.
+ *
+ *
+ ******************************************************************************/
+tBTM_STATUS BTM_WriteScoData(uint16_t sco_inx, BT_HDR* p_buf);
+
+/*******************************************************************************
+ *
+ * Function         BTM_SetARCMode
+ *
+ * Description      Send Audio Routing Control command.
+ *
+ * Returns          void
+ *
+ ******************************************************************************/
+void BTM_SetARCMode(uint8_t iface, uint8_t arc_mode,
+                    tBTM_VSC_CMPL_CB* p_arc_cb);
+
+/*******************************************************************************
+ *
+ * Function         BTM_PCM2Setup_Write
+ *
+ * Description      Send PCM2_Setup write command.
+ *
+ * Returns          void
+ *
+ ******************************************************************************/
+void BTM_PCM2Setup_Write(bool clk_master, tBTM_VSC_CMPL_CB* p_arc_cb);
+
+/*******************************************************************************
+ *
+ * Function         BTM_PM_ReadControllerState
+ *
+ * Description      This function is called to obtain the controller state
+ *
+ * Returns          Controller state (BTM_CONTRL_ACTIVE, BTM_CONTRL_SCAN, and
+ *                                    BTM_CONTRL_IDLE)
+ *
+ ******************************************************************************/
+tBTM_CONTRL_STATE BTM_PM_ReadControllerState(void);
+
+/**
+ *
+ * BLE API
+ */
+/*******************************************************************************
+ *
+ * Function         BTM_SecAddBleDevice
+ *
+ * Description      Add/modify device.  This function will be normally called
+ *                  during host startup to restore all required information
+ *                  for a LE device stored in the NVRAM.
+ *
+ * Parameters:      bd_addr          - BD address of the peer
+ *                  bd_name          - Name of the peer device. NULL if unknown.
+ *                  dev_type         - Remote device's device type.
+ *                  addr_type        - LE device address type.
+ *
+ * Returns          true if added OK, else false
+ *
+ ******************************************************************************/
+bool BTM_SecAddBleDevice(const RawAddress& bd_addr, BD_NAME bd_name,
+                         tBT_DEVICE_TYPE dev_type, tBLE_ADDR_TYPE addr_type);
+
+/*******************************************************************************
+ *
+ * Function         BTM_SecAddBleKey
+ *
+ * Description      Add/modify LE device information.  This function will be
+ *                  normally called during host startup to restore all required
+ *                  information stored in the NVRAM.
+ *
+ * Parameters:      bd_addr          - BD address of the peer
+ *                  p_le_key         - LE key values.
+ *                  key_type         - LE SMP key type.
+ *
+ * Returns          true if added OK, else false
+ *
+ ******************************************************************************/
+bool BTM_SecAddBleKey(const RawAddress& bd_addr, tBTM_LE_KEY_VALUE* p_le_key,
+                      tBTM_LE_KEY_TYPE key_type);
+
+/*******************************************************************************
+ *
+ * Function         BTM_BleObtainVendorCapabilities
+ *
+ * Description      This function is called to obatin vendor capabilties
+ *
+ * Parameters       p_cmn_vsc_cb - Returns the vednor capabilities
+ *
+ * Returns          void
+ *
+ ******************************************************************************/
+void BTM_BleObtainVendorCapabilities(tBTM_BLE_VSC_CB* p_cmn_vsc_cb);
+
+/**
+ * This function is called to set scan parameters. |cb| is called with operation
+ * status
+ **/
+void BTM_BleSetScanParams(uint32_t scan_interval, uint32_t scan_window,
+                          tBLE_SCAN_MODE scan_type,
+                          base::Callback<void(uint8_t)> cb);
+
+/*******************************************************************************
+ *
+ * Function         BTM_BleGetVendorCapabilities
+ *
+ * Description      This function reads local LE features
+ *
+ * Parameters       p_cmn_vsc_cb : Locala LE capability structure
+ *
+ * Returns          void
+ *
+ ******************************************************************************/
+void BTM_BleGetVendorCapabilities(tBTM_BLE_VSC_CB* p_cmn_vsc_cb);
+/*******************************************************************************
+ *
+ * Function         BTM_BleSetStorageConfig
+ *
+ * Description      This function is called to setup storage configuration and
+ *                  setup callbacks.
+ *
+ * Parameters       uint8_t batch_scan_full_max -Batch scan full maximum
+                    uint8_t batch_scan_trunc_max - Batch scan truncated value
+ maximum
+                    uint8_t batch_scan_notify_threshold - Threshold value
+                    cb - Setup callback
+                    tBTM_BLE_SCAN_THRESHOLD_CBACK *p_thres_cback -Threshold
+ callback
+                    void *p_ref - Reference value
+ *
+ *
+ ******************************************************************************/
+void BTM_BleSetStorageConfig(uint8_t batch_scan_full_max,
+                             uint8_t batch_scan_trunc_max,
+                             uint8_t batch_scan_notify_threshold,
+                             base::Callback<void(uint8_t /* status */)> cb,
+                             tBTM_BLE_SCAN_THRESHOLD_CBACK* p_thres_cback,
+                             tBTM_BLE_REF_VALUE ref_value);
+
+/* This function is called to enable batch scan */
+void BTM_BleEnableBatchScan(tBTM_BLE_BATCH_SCAN_MODE scan_mode,
+                            uint32_t scan_interval, uint32_t scan_window,
+                            tBTM_BLE_DISCARD_RULE discard_rule,
+                            tBLE_ADDR_TYPE addr_type,
+                            base::Callback<void(uint8_t /* status */)> cb);
+
+/* This function is called to disable batch scanning */
+void BTM_BleDisableBatchScan(base::Callback<void(uint8_t /* status */)> cb);
+
+/* This function is called to read batch scan reports */
+void BTM_BleReadScanReports(tBLE_SCAN_MODE scan_mode,
+                            tBTM_BLE_SCAN_REP_CBACK cb);
+
+/* This function is called to setup the callback for tracking */
+void BTM_BleTrackAdvertiser(tBTM_BLE_TRACK_ADV_CBACK* p_track_cback,
+                            tBTM_BLE_REF_VALUE ref_value);
+
+/*******************************************************************************
+ *
+ * Function         BTM_BleWriteScanRsp
+ *
+ * Description      This function is called to write LE scan response.
+ *
+ * Parameters:      p_scan_rsp: scan response.
+ *
+ * Returns          status
+ *
+ ******************************************************************************/
+void BTM_BleWriteScanRsp(uint8_t* data, uint8_t length,
+                         tBTM_BLE_ADV_DATA_CMPL_CBACK* p_adv_data_cback);
+
+/*******************************************************************************
+ *
+ * Function         BTM_BleObserve
+ *
+ * Description      This procedure keep the device listening for advertising
+ *                  events from a broadcast device.
+ *
+ * Parameters       start: start or stop observe.
+ *
+ * Returns          void
+ *
+ ******************************************************************************/
+tBTM_STATUS BTM_BleObserve(bool start, uint8_t duration,
+                           tBTM_INQ_RESULTS_CB* p_results_cb,
+                           tBTM_CMPL_CB* p_cmpl_cb);
+
+/** Returns local device encryption root (ER) */
+const Octet16& BTM_GetDeviceEncRoot();
+
+/** Returns local device identity root (IR) */
+const Octet16& BTM_GetDeviceIDRoot();
+
+/** Return local device DHK. */
+const Octet16& BTM_GetDeviceDHK();
+
+/*******************************************************************************
+ *
+ * Function         BTM_SecurityGrant
+ *
+ * Description      This function is called to grant security process.
+ *
+ * Parameters       bd_addr - peer device bd address.
+ *                  res     - result of the operation BTM_SUCCESS if success.
+ *                            Otherwise, BTM_REPEATED_ATTEMPTS is too many
+ *                            attempts.
+ *
+ * Returns          None
+ *
+ ******************************************************************************/
+void BTM_SecurityGrant(const RawAddress& bd_addr, uint8_t res);
+
+/*******************************************************************************
+ *
+ * Function         BTM_BlePasskeyReply
+ *
+ * Description      This function is called after Security Manager submitted
+ *                  passkey request to the application.
+ *
+ * Parameters:      bd_addr - Address of the device for which passkey was
+ *                            requested
+ *                  res     - result of the operation SMP_SUCCESS if success
+ *                  passkey - numeric value in the range of
+ *                               BTM_MIN_PASSKEY_VAL(0) -
+ *                               BTM_MAX_PASSKEY_VAL(999999(0xF423F)).
+ *
+ ******************************************************************************/
+void BTM_BlePasskeyReply(const RawAddress& bd_addr, uint8_t res,
+                         uint32_t passkey);
+
+/*******************************************************************************
+ *
+ * Function         BTM_BleConfirmReply
+ *
+ * Description      This function is called after Security Manager submitted
+ *                  numeric comparison request to the application.
+ *
+ * Parameters:      bd_addr      - Address of the device with which numeric
+ *                                 comparison was requested
+ *                  res          - comparison result BTM_SUCCESS if success
+ *
+ ******************************************************************************/
+void BTM_BleConfirmReply(const RawAddress& bd_addr, uint8_t res);
+
+/*******************************************************************************
+ *
+ * Function         BTM_LeOobDataReply
+ *
+ * Description      This function is called to provide the OOB data for
+ *                  SMP in response to BTM_LE_OOB_REQ_EVT
+ *
+ * Parameters:      bd_addr     - Address of the peer device
+ *                  res         - result of the operation SMP_SUCCESS if success
+ *                  p_data      - simple pairing Randomizer  C.
+ *
+ ******************************************************************************/
+void BTM_BleOobDataReply(const RawAddress& bd_addr, uint8_t res, uint8_t len,
+                         uint8_t* p_data);
+
+/*******************************************************************************
+ *
+ * Function         BTM_BleSecureConnectionOobDataReply
+ *
+ * Description      This function is called to provide the OOB data for
+ *                  SMP in response to BTM_LE_OOB_REQ_EVT when secure connection
+ *                  data is available
+ *
+ * Parameters:      bd_addr     - Address of the peer device
+ *                  p_c         - pointer to Confirmation
+ *                  p_r         - pointer to Randomizer.
+ *
+ ******************************************************************************/
+void BTM_BleSecureConnectionOobDataReply(const RawAddress& bd_addr,
+                                         uint8_t* p_c, uint8_t* p_r);
+
+/*******************************************************************************
+ *
+ * Function         BTM_BleDataSignature
+ *
+ * Description      This function is called to sign the data using AES128 CMAC
+ *                  algorith.
+ *
+ * Parameter        bd_addr: target device the data to be signed for.
+ *                  p_text: singing data
+ *                  len: length of the signing data
+ *                  signature: output parameter where data signature is going to
+ *                             be stored.
+ *
+ * Returns          true if signing sucessul, otherwise false.
+ *
+ ******************************************************************************/
+bool BTM_BleDataSignature(const RawAddress& bd_addr, uint8_t* p_text,
+                          uint16_t len, BLE_SIGNATURE signature);
+
+/*******************************************************************************
+ *
+ * Function         BTM_BleVerifySignature
+ *
+ * Description      This function is called to verify the data signature
+ *
+ * Parameter        bd_addr: target device the data to be signed for.
+ *                  p_orig:  original data before signature.
+ *                  len: length of the signing data
+ *                  counter: counter used when doing data signing
+ *                  p_comp: signature to be compared against.
+
+ * Returns          true if signature verified correctly; otherwise false.
+ *
+ ******************************************************************************/
+bool BTM_BleVerifySignature(const RawAddress& bd_addr, uint8_t* p_orig,
+                            uint16_t len, uint32_t counter, uint8_t* p_comp);
+
+/*******************************************************************************
+ *
+ * Function         BTM_ReadConnectionAddr
+ *
+ * Description      Read the local device random address.
+ *
+ * Returns          void
+ *
+ ******************************************************************************/
+void BTM_ReadConnectionAddr(const RawAddress& remote_bda,
+                            RawAddress& local_conn_addr,
+                            tBLE_ADDR_TYPE* p_addr_type);
+
+/*******************************************************************************
+ *
+ * Function         BTM_IsBleConnection
+ *
+ * Description      This function is called to check if the connection handle
+ *                  for an LE link
+ *
+ * Returns          true if connection is LE link, otherwise false.
+ *
+ ******************************************************************************/
+bool BTM_IsBleConnection(uint16_t conn_handle);
+
+/*******************************************************************************
+ *
+ * Function         BTM_ReadRemoteConnectionAddr
+ *
+ * Description      Read the remote device address currently used.
+ *
+ * Returns          void
+ *
+ ******************************************************************************/
+bool BTM_ReadRemoteConnectionAddr(const RawAddress& pseudo_addr,
+                                  RawAddress& conn_addr,
+                                  tBLE_ADDR_TYPE* p_addr_type);
+
+/*******************************************************************************
+ *
+ * Function         BTM_BleLoadLocalKeys
+ *
+ * Description      Local local identity key, encryption root or sign counter.
+ *
+ * Parameters:      key_type: type of key, can be BTM_BLE_KEY_TYPE_ID,
+ *                            BTM_BLE_KEY_TYPE_ER
+ *                            or BTM_BLE_KEY_TYPE_COUNTER.
+ *                  p_key: pointer to the key.
+ *
+ * Returns          non2.
+ *
+ ******************************************************************************/
+void BTM_BleLoadLocalKeys(uint8_t key_type, tBTM_BLE_LOCAL_KEYS* p_key);
+
+/********************************************************
+ *
+ * Function         BTM_BleSetPrefConnParams
+ *
+ * Description      Set a peripheral's preferred connection parameters. When
+ *                  any of the value does not want to be updated while others
+ *                  do, use BTM_BLE_CONN_PARAM_UNDEF for the ones want to
+ *                  leave untouched.
+ *
+ * Parameters:      bd_addr          - BD address of the peripheral
+ *                  min_conn_int     - minimum preferred connection interval
+ *                  max_conn_int     - maximum preferred connection interval
+ *                  slave_latency    - preferred slave latency
+ *                  supervision_tout - preferred supervision timeout
+ *
+ * Returns          void
+ *
+ ******************************************************************************/
+void BTM_BleSetPrefConnParams(const RawAddress& bd_addr, uint16_t min_conn_int,
+                              uint16_t max_conn_int, uint16_t slave_latency,
+                              uint16_t supervision_tout);
+
+/******************************************************************************
+ *
+ * Function         BTM_BleSetConnScanParams
+ *
+ * Description      Set scan parameters used in BLE connection request
+ *
+ * Parameters:      scan_interval    - scan interval
+ *                  scan_window      - scan window
+ *
+ * Returns          void
+ *
+ ******************************************************************************/
+void BTM_BleSetConnScanParams(uint32_t scan_interval, uint32_t scan_window);
+
+/******************************************************************************
+ *
+ * Function         BTM_BleReadControllerFeatures
+ *
+ * Description      Reads BLE specific controller features
+ *
+ * Parameters:      tBTM_BLE_CTRL_FEATURES_CBACK : Callback to notify when
+ *                  features are read
+ *
+ * Returns          void
+ *
+ ******************************************************************************/
+void BTM_BleReadControllerFeatures(tBTM_BLE_CTRL_FEATURES_CBACK* p_vsc_cback);
+
+/*******************************************************************************
+ *
+ * Function         BTM__BLEReadDiscoverability
+ *
+ * Description      This function is called to read the current LE
+ *                  discoverability mode of the device.
+ *
+ * Returns          BTM_BLE_NON_DISCOVERABLE ,BTM_BLE_LIMITED_DISCOVERABLE or
+ *                     BTM_BLE_GENRAL_DISCOVERABLE
+ *
+ ******************************************************************************/
+uint16_t BTM_BleReadDiscoverability();
+
+/*******************************************************************************
+ *
+ * Function         BTM__BLEReadConnectability
+ *
+ * Description      This function is called to read the current LE
+ *                  connectibility mode of the device.
+ *
+ * Returns          BTM_BLE_NON_CONNECTABLE or BTM_BLE_CONNECTABLE
+ *
+ ******************************************************************************/
+uint16_t BTM_BleReadConnectability();
+
+/*******************************************************************************
+ *
+ * Function         BTM_ReadDevInfo
+ *
+ * Description      This function is called to read the device/address type
+ *                  of BD address.
+ *
+ * Parameter        remote_bda: remote device address
+ *                  p_dev_type: output parameter to read the device type.
+ *                  p_addr_type: output parameter to read the address type.
+ *
+ ******************************************************************************/
+void BTM_ReadDevInfo(const RawAddress& remote_bda, tBT_DEVICE_TYPE* p_dev_type,
+                     tBLE_ADDR_TYPE* p_addr_type);
+
+/*******************************************************************************
+ *
+ * Function         BTM_ReadConnectedTransportAddress
+ *
+ * Description      This function is called to read the paired device/address
+ *                  type of other device paired corresponding to the BD_address
+ *
+ * Parameter        remote_bda: remote device address, carry out the transport
+ *                              address
+ *                  transport: active transport
+ *
+ * Return           true if an active link is identified; false otherwise
+ *
+ ******************************************************************************/
+bool BTM_ReadConnectedTransportAddress(RawAddress* remote_bda,
+                                       tBT_TRANSPORT transport);
+
+/*******************************************************************************
+ *
+ * Function         BTM_BleConfigPrivacy
+ *
+ * Description      This function is called to enable or disable the privacy in
+ *                  the local device.
+ *
+ * Parameters       enable: true to enable it; false to disable it.
+ *
+ * Returns          bool    privacy mode set success; otherwise failed.
+ *
+ ******************************************************************************/
+bool BTM_BleConfigPrivacy(bool enable);
+
+/*******************************************************************************
+ *
+ * Function         BTM_BleLocalPrivacyEnabled
+ *
+ * Description        Checks if local device supports private address
+ *
+ * Returns          Return true if local privacy is enabled else false
+ *
+ ******************************************************************************/
+bool BTM_BleLocalPrivacyEnabled(void);
+
+/*******************************************************************************
+ *
+ * Function         BTM_BleEnableMixedPrivacyMode
+ *
+ * Description      This function is called to enabled Mixed mode if privacy 1.2
+ *                  is applicable in controller.
+ *
+ * Parameters       mixed_on:  mixed mode to be used or not.
+ *
+ * Returns          void
+ *
+ ******************************************************************************/
+void BTM_BleEnableMixedPrivacyMode(bool mixed_on);
+
+/*******************************************************************************
+ *
+ * Function          BTM_BleMaxMultiAdvInstanceCount
+ *
+ * Description      Returns the maximum number of multi adv instances supported
+ *                  by the controller.
+ *
+ * Returns          Max multi adv instance count
+ *
+ ******************************************************************************/
+uint8_t BTM_BleMaxMultiAdvInstanceCount();
+
+/*******************************************************************************
+ *
+ * Function         BTM_BleSetConnectableMode
+ *
+ * Description      This function is called to set BLE connectable mode for a
+ *                  peripheral device.
+ *
+ * Parameters       connectable_mode:  directed connectable mode, or
+ *                                     non-directed. It can be
+ *                                     BTM_BLE_CONNECT_EVT,
+ *                                     BTM_BLE_CONNECT_DIR_EVT or
+ *                                     BTM_BLE_CONNECT_LO_DUTY_DIR_EVT
+ *
+ * Returns          BTM_ILLEGAL_VALUE if controller does not support BLE.
+ *                  BTM_SUCCESS is status set successfully; otherwise failure.
+ *
+ ******************************************************************************/
+tBTM_STATUS BTM_BleSetConnectableMode(tBTM_BLE_CONN_MODE connectable_mode);
+
+/*******************************************************************************
+ *
+ * Function         BTM_BleTurnOnPrivacyOnRemote
+ *
+ * Description      This function is called to enable or disable the privacy on
+ *                  the remote device.
+ *
+ * Parameters       bd_addr: remote device address.
+ *                  privacy_on: true to enable it; false to disable it.
+ *
+ * Returns          void
+ *
+ ******************************************************************************/
+void BTM_BleTurnOnPrivacyOnRemote(const RawAddress& bd_addr, bool privacy_on);
+
+/*******************************************************************************
+ *
+ * Function         BTM_BleUpdateAdvFilterPolicy
+ *
+ * Description      This function update the filter policy of advertiser.
+ *
+ * Parameter        adv_policy: advertising filter policy
+ *
+ * Return           void
+ ******************************************************************************/
+void BTM_BleUpdateAdvFilterPolicy(tBTM_BLE_AFP adv_policy);
+
+/*******************************************************************************
+ *
+ * Function         BTM_BleReceiverTest
+ *
+ * Description      This function is called to start the LE Receiver test
+ *
+ * Parameter       rx_freq - Frequency Range
+ *               p_cmd_cmpl_cback - Command Complete callback
+ *
+ ******************************************************************************/
+void BTM_BleReceiverTest(uint8_t rx_freq, tBTM_CMPL_CB* p_cmd_cmpl_cback);
+
+/*******************************************************************************
+ *
+ * Function         BTM_BleTransmitterTest
+ *
+ * Description      This function is called to start the LE Transmitter test
+ *
+ * Parameter       tx_freq - Frequency Range
+ *                       test_data_len - Length in bytes of payload data in each
+ *                                       packet
+ *                       packet_payload - Pattern to use in the payload
+ *                       p_cmd_cmpl_cback - Command Complete callback
+ *
+ ******************************************************************************/
+void BTM_BleTransmitterTest(uint8_t tx_freq, uint8_t test_data_len,
+                            uint8_t packet_payload,
+                            tBTM_CMPL_CB* p_cmd_cmpl_cback);
+
+/*******************************************************************************
+ *
+ * Function         BTM_BleTestEnd
+ *
+ * Description     This function is called to stop the in-progress TX or RX test
+ *
+ * Parameter       p_cmd_cmpl_cback - Command complete callback
+ *
+ ******************************************************************************/
+void BTM_BleTestEnd(tBTM_CMPL_CB* p_cmd_cmpl_cback);
+
+/*******************************************************************************
+ *
+ * Function         BTM_UseLeLink
+ *
+ * Description      Select the underlying physical link to use.
+ *
+ * Returns          true to use LE, false use BR/EDR.
+ *
+ ******************************************************************************/
+bool BTM_UseLeLink(const RawAddress& bd_addr);
+
+/*******************************************************************************
+ *
+ * Function         BTM_BleStackEnable
+ *
+ * Description      Enable/Disable BLE functionality on stack regardless of
+ *                  controller capability.
+ *
+ * Parameters:      enable: true to enable, false to disable.
+ *
+ * Returns          true if added OK, else false
+ *
+ ******************************************************************************/
+tBTM_STATUS BTM_BleStackEnable(bool enable);
+
+/*******************************************************************************
+ *
+ * Function         BTM_GetLeSecurityState
+ *
+ * Description      This function is called to get security mode 1 flags and
+ *                  encryption key size for LE peer.
+ *
+ * Returns          bool    true if LE device is found, false otherwise.
+ *
+ ******************************************************************************/
+bool BTM_GetLeSecurityState(const RawAddress& bd_addr,
+                            uint8_t* p_le_dev_sec_flags,
+                            uint8_t* p_le_key_size);
+
+/*******************************************************************************
+ *
+ * Function         BTM_BleSecurityProcedureIsRunning
+ *
+ * Description      This function indicates if LE security procedure is
+ *                  currently running with the peer.
+ *
+ * Returns          bool true if security procedure is running, false otherwise.
+ *
+ ******************************************************************************/
+bool BTM_BleSecurityProcedureIsRunning(const RawAddress& bd_addr);
+
+/*******************************************************************************
+ *
+ * Function         BTM_BleGetSupportedKeySize
+ *
+ * Description      This function gets the maximum encryption key size in bytes
+ *                  the local device can suport.
+ *                  record.
+ *
+ * Returns          the key size or 0 if the size can't be retrieved.
+ *
+ ******************************************************************************/
+uint8_t BTM_BleGetSupportedKeySize(const RawAddress& bd_addr);
+
+/*******************************************************************************
+ *
+ * Function         BTM_BleAdvFilterParamSetup
+ *
+ * Description      This function is called to setup the adv data payload filter
+ *                  condition.
+ *
+ ******************************************************************************/
+void BTM_BleAdvFilterParamSetup(
+    int action, tBTM_BLE_PF_FILT_INDEX filt_index,
+    std::unique_ptr<btgatt_filt_param_setup_t> p_filt_params,
+    tBTM_BLE_PF_PARAM_CB cb);
+
+/**
+ * This functions are called to configure the adv data payload filter condition
+ */
+void BTM_LE_PF_set(tBTM_BLE_PF_FILT_INDEX filt_index,
+                   std::vector<ApcfCommand> commands, tBTM_BLE_PF_CFG_CBACK cb);
+void BTM_LE_PF_clear(tBTM_BLE_PF_FILT_INDEX filt_index,
+                     tBTM_BLE_PF_CFG_CBACK cb);
+
+/*******************************************************************************
+ *
+ * Function         BTM_BleEnableDisableFilterFeature
+ *
+ * Description      Enable or disable the APCF feature
+ *
+ * Parameters       enable - true - enables APCF, false - disables APCF
+ *
+ ******************************************************************************/
+void BTM_BleEnableDisableFilterFeature(uint8_t enable,
+                                       tBTM_BLE_PF_STATUS_CBACK p_stat_cback);
+
+/*******************************************************************************
+ *
+ * Function         BTM_BleGetEnergyInfo
+ *
+ * Description      This function obtains the energy info
+ *
+ * Parameters       p_ener_cback - Callback pointer
+ *
+ * Returns          status
+ *
+ ******************************************************************************/
+tBTM_STATUS BTM_BleGetEnergyInfo(tBTM_BLE_ENERGY_INFO_CBACK* p_ener_cback);
+
+/*******************************************************************************
+ *
+ * Function         BTM_SetBleDataLength
+ *
+ * Description      Set the maximum BLE transmission packet size
+ *
+ * Returns          BTM_SUCCESS if success; otherwise failed.
+ *
+ ******************************************************************************/
+tBTM_STATUS BTM_SetBleDataLength(const RawAddress& bd_addr,
+                                 uint16_t tx_pdu_length);
+
+/*******************************************************************************
+ *
+ * Function         BTM_BleReadPhy
+ *
+ * Description      To read the current PHYs for specified LE connection
+ *
+ *
+ * Returns          BTM_SUCCESS if success; otherwise failed.
+ *
+ ******************************************************************************/
+void BTM_BleReadPhy(
+    const RawAddress& bd_addr,
+    base::Callback<void(uint8_t tx_phy, uint8_t rx_phy, uint8_t status)> cb);
+
+/*******************************************************************************
+ *
+ * Function         BTM_BleSetDefaultPhy
+ *
+ * Description      To set preferred PHY for ensuing LE connections
+ *
+ *
+ * Returns          BTM_SUCCESS if success; otherwise failed.
+ *
+ ******************************************************************************/
+tBTM_STATUS BTM_BleSetDefaultPhy(uint8_t all_phys, uint8_t tx_phys,
+                                 uint8_t rx_phys);
+
+/*******************************************************************************
+ *
+ * Function         BTM_BleSetPhy
+ *
+ * Description      To set PHY preferences for specified LE connection
+ *
+ *
+ * Returns          BTM_SUCCESS if success; otherwise failed.
+ *
+ ******************************************************************************/
+void BTM_BleSetPhy(const RawAddress& bd_addr, uint8_t tx_phys, uint8_t rx_phys,
+                   uint16_t phy_options);
+
+void BTM_LE_PF_local_name(tBTM_BLE_SCAN_COND_OP action,
+                          tBTM_BLE_PF_FILT_INDEX filt_index,
+                          std::vector<uint8_t> name, tBTM_BLE_PF_CFG_CBACK cb);
+
+void BTM_LE_PF_srvc_data(tBTM_BLE_SCAN_COND_OP action,
+                         tBTM_BLE_PF_FILT_INDEX filt_index);
+
+void BTM_LE_PF_manu_data(tBTM_BLE_SCAN_COND_OP action,
+                         tBTM_BLE_PF_FILT_INDEX filt_index, uint16_t company_id,
+                         uint16_t company_id_mask, std::vector<uint8_t> data,
+                         std::vector<uint8_t> data_mask,
+                         tBTM_BLE_PF_CFG_CBACK cb);
+
+void BTM_LE_PF_srvc_data_pattern(tBTM_BLE_SCAN_COND_OP action,
+                                 tBTM_BLE_PF_FILT_INDEX filt_index,
+                                 std::vector<uint8_t> data,
+                                 std::vector<uint8_t> data_mask,
+                                 tBTM_BLE_PF_CFG_CBACK cb);
+
+void BTM_LE_PF_addr_filter(tBTM_BLE_SCAN_COND_OP action,
+                           tBTM_BLE_PF_FILT_INDEX filt_index, tBLE_BD_ADDR addr,
+                           tBTM_BLE_PF_CFG_CBACK cb);
+
+void BTM_LE_PF_uuid_filter(tBTM_BLE_SCAN_COND_OP action,
+                           tBTM_BLE_PF_FILT_INDEX filt_index,
+                           tBTM_BLE_PF_COND_TYPE filter_type,
+                           const bluetooth::Uuid& uuid,
+                           tBTM_BLE_PF_LOGIC_TYPE cond_logic,
+                           const bluetooth::Uuid& uuid_mask,
+                           tBTM_BLE_PF_CFG_CBACK cb);
+
+}  // namespace shim
+}  // namespace bluetooth
diff --git a/main/shim/controller.cc b/main/shim/controller.cc
new file mode 100644
index 0000000..284d360
--- /dev/null
+++ b/main/shim/controller.cc
@@ -0,0 +1,341 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#define LOG_TAG "bt_shim_controller"
+
+#include "main/shim/controller.h"
+#include "btcore/include/module.h"
+#include "main/shim/entry.h"
+#include "main/shim/shim.h"
+#include "osi/include/future.h"
+#include "osi/include/log.h"
+
+using ::bluetooth::shim::GetController;
+
+constexpr uint8_t kPageZero = 0;
+constexpr uint8_t kPageOne = 1;
+constexpr uint8_t kPageTwo = 2;
+constexpr uint8_t kMaxFeaturePage = 3;
+
+constexpr int kMaxSupportedCodecs = 8;  // MAX_LOCAL_SUPPORTED_CODECS_SIZE
+
+constexpr uint8_t kPhyLe1M = 0x01;
+
+/**
+ * Interesting commands supported by controller
+ */
+constexpr int kReadRemoteExtendedFeatures = 0x41c;
+constexpr int kEnhancedSetupSynchronousConnection = 0x428;
+constexpr int kEnhancedAcceptSynchronousConnection = 0x429;
+constexpr int kLeSetPrivacyMode = 0x204e;
+
+constexpr int kHciDataPreambleSize = 4;  // #define HCI_DATA_PREAMBLE_SIZE 4
+
+// Module lifecycle functions
+static future_t* start_up(void);
+static future_t* shut_down(void);
+
+EXPORT_SYMBOL extern const module_t gd_controller_module = {
+    .name = GD_CONTROLLER_MODULE,
+    .init = nullptr,
+    .start_up = start_up,
+    .shut_down = shut_down,
+    .clean_up = nullptr,
+    .dependencies = {GD_SHIM_MODULE, nullptr}};
+
+struct {
+  bool ready;
+  uint64_t feature[kMaxFeaturePage];
+  uint64_t le_feature[kMaxFeaturePage];
+  RawAddress raw_address;
+  bt_version_t bt_version;
+  uint8_t local_supported_codecs[kMaxSupportedCodecs];
+  uint8_t number_of_local_supported_codecs;
+  uint64_t le_supported_states;
+  uint8_t phy;
+} data_;
+
+static future_t* start_up(void) {
+  LOG_INFO(LOG_TAG, "%s Starting up", __func__);
+  data_.ready = true;
+
+  std::string string_address = GetController()->GetControllerMacAddress();
+  RawAddress::FromString(string_address, data_.raw_address);
+
+  data_.le_supported_states =
+      bluetooth::shim::GetController()->GetControllerLeSupportedStates();
+
+  LOG_INFO(LOG_TAG, "Mac address:%s", string_address.c_str());
+
+  data_.phy = kPhyLe1M;
+
+  return future_new_immediate(FUTURE_SUCCESS);
+}
+
+static future_t* shut_down(void) {
+  data_.ready = false;
+  return future_new_immediate(FUTURE_SUCCESS);
+}
+
+/**
+ * Module methods
+ */
+#define BIT(x) (0x1ULL << (x))
+
+static bool get_is_ready(void) { return data_.ready; }
+
+static const RawAddress* get_address(void) { return &data_.raw_address; }
+
+static const bt_version_t* get_bt_version(void) { return &data_.bt_version; }
+
+static const bt_device_features_t* get_features_classic(int index) {
+  CHECK(index >= 0 && index < kMaxFeaturePage);
+  data_.feature[index] =
+      bluetooth::shim::GetController()->GetControllerLocalExtendedFeatures(
+          index);
+  return (const bt_device_features_t*)&data_.feature[index];
+}
+
+static uint8_t get_last_features_classic_index(void) {
+  return bluetooth::shim::GetController()
+      ->GetControllerLocalExtendedFeaturesMaxPageNumber();
+}
+
+static uint8_t* get_local_supported_codecs(uint8_t* number_of_codecs) {
+  CHECK(number_of_codecs != nullptr);
+  if (data_.number_of_local_supported_codecs != 0) {
+    *number_of_codecs = data_.number_of_local_supported_codecs;
+    return data_.local_supported_codecs;
+  }
+  return (uint8_t*)nullptr;
+}
+
+static const bt_device_features_t* get_features_ble(void) {
+  return (const bt_device_features_t*)&data_.le_feature[0];
+}
+
+static const uint8_t* get_ble_supported_states(void) {
+  return (const uint8_t*)&data_.le_supported_states;
+}
+
+static bool supports_simple_pairing(void) {
+  return GetController()->GetControllerLocalExtendedFeatures(kPageOne) &
+         BIT(51);
+}
+
+static bool supports_secure_connections(void) {
+  return GetController()->GetControllerLocalExtendedFeatures(kPageTwo) & BIT(8);
+}
+
+static bool supports_simultaneous_le_bredr(void) {
+  return GetController()->GetControllerLocalExtendedFeatures(kPageZero) &
+         BIT(49);
+}
+
+static bool supports_reading_remote_extended_features(void) {
+  return GetController()->IsCommandSupported(kReadRemoteExtendedFeatures);
+}
+
+static bool supports_interlaced_inquiry_scan(void) {
+  return GetController()->GetControllerLocalExtendedFeatures(kPageZero) &
+         BIT(28);
+}
+
+static bool supports_rssi_with_inquiry_results(void) {
+  return GetController()->GetControllerLocalExtendedFeatures(kPageZero) &
+         BIT(28);
+}
+
+static bool supports_extended_inquiry_response(void) {
+  return GetController()->GetControllerLocalExtendedFeatures(kPageZero) &
+         BIT(48);
+}
+
+static bool supports_master_slave_role_switch(void) {
+  return GetController()->GetControllerLocalExtendedFeatures(kPageZero) &
+         BIT(5);
+}
+
+static bool supports_enhanced_setup_synchronous_connection(void) {
+  return GetController()->IsCommandSupported(
+      kEnhancedSetupSynchronousConnection);
+}
+
+static bool supports_enhanced_accept_synchronous_connection(void) {
+  return GetController()->IsCommandSupported(
+      kEnhancedAcceptSynchronousConnection);
+}
+
+static bool supports_ble(void) {
+  return GetController()->GetControllerLocalExtendedFeatures(kPageOne) & BIT(1);
+}
+
+static bool supports_ble_privacy(void) {
+  return GetController()->GetControllerLeLocalSupportedFeatures() & BIT(6);
+}
+
+static bool supports_ble_set_privacy_mode() {
+  return GetController()->IsCommandSupported(kLeSetPrivacyMode);
+}
+
+static bool supports_ble_packet_extension(void) {
+  return GetController()->GetControllerLeLocalSupportedFeatures() & BIT(5);
+}
+
+static bool supports_ble_connection_parameters_request(void) {
+  return GetController()->GetControllerLeLocalSupportedFeatures() & BIT(2);
+}
+
+static bool supports_ble_2m_phy(void) {
+  return GetController()->GetControllerLeLocalSupportedFeatures() & BIT(8);
+}
+
+static bool supports_ble_coded_phy(void) {
+  return GetController()->GetControllerLeLocalSupportedFeatures() & BIT(11);
+}
+
+static bool supports_ble_extended_advertising(void) {
+  return GetController()->GetControllerLeLocalSupportedFeatures() & BIT(12);
+}
+
+static bool supports_ble_periodic_advertising(void) {
+  return GetController()->GetControllerLeLocalSupportedFeatures() & BIT(13);
+}
+
+static uint16_t get_acl_data_size_classic(void) {
+  return GetController()->GetControllerAclPacketLength();
+}
+
+static uint16_t get_acl_data_size_ble(void) {
+  ::bluetooth::shim::LeBufferSize le_buffer_size =
+      GetController()->GetControllerLeBufferSize();
+  return le_buffer_size.le_data_packet_length;
+}
+
+static uint16_t get_acl_packet_size_classic(void) {
+  return get_acl_data_size_classic() + kHciDataPreambleSize;
+}
+
+static uint16_t get_acl_packet_size_ble(void) {
+  return get_acl_data_size_ble() + kHciDataPreambleSize;
+}
+
+static uint16_t get_ble_suggested_default_data_length(void) {
+  LOG_WARN(LOG_TAG, "%s TODO Unimplemented", __func__);
+  return 0;
+}
+
+static uint16_t get_ble_maximum_tx_data_length(void) {
+  ::bluetooth::shim::LeMaximumDataLength le_maximum_data_length =
+      GetController()->GetControllerLeMaximumDataLength();
+  return le_maximum_data_length.supported_max_tx_octets;
+}
+
+static uint16_t get_ble_maxium_advertising_data_length(void) {
+  LOG_WARN(LOG_TAG, "%s TODO Unimplemented", __func__);
+  return 0;
+}
+
+static uint8_t get_ble_number_of_supported_advertising_sets(void) {
+  LOG_WARN(LOG_TAG, "%s TODO Unimplemented", __func__);
+  return 0;
+}
+
+static uint16_t get_acl_buffer_count_classic(void) {
+  return GetController()->GetControllerNumAclPacketBuffers();
+}
+
+static uint8_t get_acl_buffer_count_ble(void) {
+  LOG_WARN(LOG_TAG, "%s TODO Unimplemented", __func__);
+  return 0;
+}
+
+static uint8_t get_ble_white_list_size(void) {
+  LOG_WARN(LOG_TAG, "%s TODO Unimplemented", __func__);
+  return 0;
+}
+
+static uint8_t get_ble_resolving_list_max_size(void) {
+  LOG_WARN(LOG_TAG, "%s TODO Unimplemented", __func__);
+  return 0;
+}
+
+static void set_ble_resolving_list_max_size(int resolving_list_max_size) {
+  LOG_WARN(LOG_TAG, "%s TODO Unimplemented", __func__);
+}
+
+static uint8_t get_le_all_initiating_phys() { return data_.phy; }
+
+static const controller_t interface = {
+    get_is_ready,
+
+    get_address,
+    get_bt_version,
+
+    get_features_classic,
+    get_last_features_classic_index,
+
+    get_features_ble,
+    get_ble_supported_states,
+
+    supports_simple_pairing,
+    supports_secure_connections,
+    supports_simultaneous_le_bredr,
+    supports_reading_remote_extended_features,
+    supports_interlaced_inquiry_scan,
+    supports_rssi_with_inquiry_results,
+    supports_extended_inquiry_response,
+    supports_master_slave_role_switch,
+    supports_enhanced_setup_synchronous_connection,
+    supports_enhanced_accept_synchronous_connection,
+
+    supports_ble,
+    supports_ble_packet_extension,
+    supports_ble_connection_parameters_request,
+    supports_ble_privacy,
+    supports_ble_set_privacy_mode,
+    supports_ble_2m_phy,
+    supports_ble_coded_phy,
+    supports_ble_extended_advertising,
+    supports_ble_periodic_advertising,
+
+    get_acl_data_size_classic,
+    get_acl_data_size_ble,
+
+    get_acl_packet_size_classic,
+    get_acl_packet_size_ble,
+    get_ble_suggested_default_data_length,
+    get_ble_maximum_tx_data_length,
+    get_ble_maxium_advertising_data_length,
+    get_ble_number_of_supported_advertising_sets,
+
+    get_acl_buffer_count_classic,
+    get_acl_buffer_count_ble,
+
+    get_ble_white_list_size,
+
+    get_ble_resolving_list_max_size,
+    set_ble_resolving_list_max_size,
+    get_local_supported_codecs,
+    get_le_all_initiating_phys};
+
+const controller_t* bluetooth::shim::controller_get_interface() {
+  static bool loaded = false;
+  if (!loaded) {
+    loaded = true;
+  }
+  return &interface;
+}
diff --git a/main/shim/controller.h b/main/shim/controller.h
new file mode 100644
index 0000000..6b77982
--- /dev/null
+++ b/main/shim/controller.h
@@ -0,0 +1,29 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#pragma once
+
+#include "device/include/controller.h"
+
+static const char GD_CONTROLLER_MODULE[] = "gd_controller_module";
+
+namespace bluetooth {
+namespace shim {
+
+const controller_t* controller_get_interface();
+
+}  // namespace shim
+}  // namespace bluetooth
diff --git a/main/shim/entry.cc b/main/shim/entry.cc
new file mode 100644
index 0000000..8768818
--- /dev/null
+++ b/main/shim/entry.cc
@@ -0,0 +1,59 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "main/shim/entry.h"
+#include "gd/shim/only_include_this_file_into_legacy_stack___ever.h"
+#include "osi/include/future.h"
+
+using bluetooth::shim::GetGabeldorscheStack;
+
+future_t* bluetooth::shim::StartGabeldorscheStack() {
+  GetGabeldorscheStack()->Start();
+  return (future_t*)nullptr;
+}
+
+future_t* bluetooth::shim::StopGabeldorscheStack() {
+  GetGabeldorscheStack()->Stop();
+  return (future_t*)nullptr;
+}
+
+bluetooth::shim::IController* bluetooth::shim::GetController() {
+  return GetGabeldorscheStack()->GetController();
+}
+
+bluetooth::shim::IConnectability* bluetooth::shim::GetConnectability() {
+  return GetGabeldorscheStack()->GetConnectability();
+}
+
+bluetooth::shim::IDiscoverability* bluetooth::shim::GetDiscoverability() {
+  return GetGabeldorscheStack()->GetDiscoverability();
+}
+
+bluetooth::shim::IInquiry* bluetooth::shim::GetInquiry() {
+  return GetGabeldorscheStack()->GetInquiry();
+}
+
+bluetooth::shim::IHciLayer* bluetooth::shim::GetHciLayer() {
+  return GetGabeldorscheStack()->GetHciLayer();
+}
+
+bluetooth::shim::IL2cap* bluetooth::shim::GetL2cap() {
+  return GetGabeldorscheStack()->GetL2cap();
+}
+
+bluetooth::shim::IPage* bluetooth::shim::GetPage() {
+  return GetGabeldorscheStack()->GetPage();
+}
diff --git a/main/shim/entry.h b/main/shim/entry.h
new file mode 100644
index 0000000..a4d4cf4
--- /dev/null
+++ b/main/shim/entry.h
@@ -0,0 +1,50 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#pragma once
+
+/**
+ * Entrypoints called into Gabeldorsche from legacy stack
+ *
+ * Any marshalling/unmarshalling, data transformation of APIs to
+ * or from the Gabeldorsche stack may be placed here.
+ *
+ * The idea is to effectively provide a binary interface to prevent cross
+ * contamination of data structures and the like between the stacks.
+ *
+ * **ABSOLUTELY** No reference to Gabeldorsche stack other than well defined
+ * interfaces may be made here
+ */
+
+#include "gd/shim/only_include_this_file_into_legacy_stack___ever.h"
+#include "osi/include/future.h"
+
+namespace bluetooth {
+namespace shim {
+
+future_t* StartGabeldorscheStack();
+future_t* StopGabeldorscheStack();
+
+bluetooth::shim::IController* GetController();
+bluetooth::shim::IDiscoverability* GetDiscoverability();
+bluetooth::shim::IConnectability* GetConnectability();
+bluetooth::shim::IInquiry* GetInquiry();
+bluetooth::shim::IHciLayer* GetHciLayer();
+bluetooth::shim::IL2cap* GetL2cap();
+bluetooth::shim::IPage* GetPage();
+
+}  // namespace shim
+}  // namespace bluetooth
diff --git a/main/shim/entry_for_test.cc b/main/shim/entry_for_test.cc
new file mode 100644
index 0000000..26b9b22
--- /dev/null
+++ b/main/shim/entry_for_test.cc
@@ -0,0 +1,27 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "gd/shim/only_include_this_file_into_legacy_stack___ever.h"
+#include "main/shim/entry.h"
+
+/**
+ * Entrypoints for stubbed bluetooth test library
+ *
+ * Gd stack is not supported using legacy test modes
+ */
+bluetooth::shim::IStack* bluetooth::shim::GetGabeldorscheStack() {
+  return (bluetooth::shim::IStack*)nullptr;
+}
diff --git a/main/shim/hci_layer.cc b/main/shim/hci_layer.cc
new file mode 100644
index 0000000..ba21cae
--- /dev/null
+++ b/main/shim/hci_layer.cc
@@ -0,0 +1,146 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#define LOG_TAG "bt_shim_hci"
+
+#include <base/bind.h>
+#include <frameworks/base/core/proto/android/bluetooth/hci/enums.pb.h>
+#include <algorithm>
+#include <cstdint>
+
+#include "btcore/include/module.h"
+#include "main/shim/hci_layer.h"
+#include "main/shim/shim.h"
+#include "osi/include/allocator.h"
+#include "osi/include/future.h"
+#include "stack/include/bt_types.h"
+
+/**
+ * Callback data wrapped as opaque token bundled with the command
+ * transmit request to the Gd layer.
+ *
+ * Upon completion a token for a corresponding command transmit.
+ * request is returned from the Gd layer.
+ */
+using CommandCallbackData = struct {
+  void* context;
+  command_complete_cb complete_callback;
+  command_status_cb status_callback;
+};
+
+constexpr size_t kBtHdrSize = sizeof(BT_HDR);
+constexpr size_t kCommandLengthSize = sizeof(uint8_t);
+constexpr size_t kCommandOpcodeSize = sizeof(uint16_t);
+
+static hci_t interface;
+static base::Callback<void(const base::Location&, BT_HDR*)> send_data_upwards;
+
+static future_t* hci_module_shut_down(void);
+static future_t* hci_module_start_up(void);
+
+static void OnCommandComplete(uint16_t command_op_code,
+                              std::vector<const uint8_t> data,
+                              const void* token) {
+  BT_HDR* response = static_cast<BT_HDR*>(osi_calloc(data.size() + kBtHdrSize));
+  std::copy(data.begin(), data.end(), response->data);
+  response->len = data.size();
+
+  const CommandCallbackData* command_callback_data =
+      static_cast<const CommandCallbackData*>(token);
+  CHECK(command_callback_data->complete_callback != nullptr);
+
+  command_callback_data->complete_callback(response,
+                                           command_callback_data->context);
+  delete command_callback_data;
+}
+
+static void OnCommandStatus(uint16_t command_op_code,
+                            std::vector<const uint8_t> data, const void* token,
+                            uint8_t status) {
+  BT_HDR* response = static_cast<BT_HDR*>(osi_calloc(data.size() + kBtHdrSize));
+  std::copy(data.begin(), data.end(), response->data);
+  response->len = data.size();
+
+  const CommandCallbackData* command_callback_data =
+      static_cast<const CommandCallbackData*>(token);
+  CHECK(command_callback_data->status_callback != nullptr);
+
+  command_callback_data->status_callback(status, response,
+                                         command_callback_data->context);
+  delete command_callback_data;
+}
+
+EXPORT_SYMBOL extern const module_t gd_hci_module = {
+    .name = GD_HCI_MODULE,
+    .init = nullptr,
+    .start_up = hci_module_start_up,
+    .shut_down = hci_module_shut_down,
+    .clean_up = nullptr,
+    .dependencies = {GD_SHIM_MODULE, nullptr}};
+
+static future_t* hci_module_start_up(void) {
+  bluetooth::shim::GetHciLayer()->RegisterCommandComplete(OnCommandComplete);
+  bluetooth::shim::GetHciLayer()->RegisterCommandStatus(OnCommandStatus);
+  return nullptr;
+}
+
+static future_t* hci_module_shut_down(void) {
+  bluetooth::shim::GetHciLayer()->UnregisterCommandComplete();
+  bluetooth::shim::GetHciLayer()->UnregisterCommandStatus();
+  return nullptr;
+}
+
+static void set_data_cb(
+    base::Callback<void(const base::Location&, BT_HDR*)> send_data_cb) {
+  send_data_upwards = std::move(send_data_cb);
+}
+
+static void transmit_command(BT_HDR* command,
+                             command_complete_cb complete_callback,
+                             command_status_cb status_callback, void* context) {
+  CHECK(command != nullptr);
+  uint8_t* data = command->data + command->offset;
+  size_t len = command->len;
+  CHECK(len >= (kCommandOpcodeSize + kCommandLengthSize));
+
+  // little endian command opcode
+  uint16_t command_op_code = (data[1] << 8 | data[0]);
+  // Gd stack API requires opcode specification and calculates length, so
+  // no need to provide opcode or length here.
+  data += (kCommandOpcodeSize + kCommandLengthSize);
+  len -= (kCommandOpcodeSize + kCommandLengthSize);
+
+  const CommandCallbackData* command_callback_data = new CommandCallbackData{
+      context,
+      complete_callback,
+      status_callback,
+  };
+  bluetooth::shim::GetHciLayer()->TransmitCommand(
+      command_op_code, const_cast<const uint8_t*>(data), len,
+      static_cast<const void*>(command_callback_data));
+}
+
+const hci_t* bluetooth::shim::hci_layer_get_interface() {
+  static bool loaded = false;
+  if (!loaded) {
+    loaded = true;
+    interface.set_data_cb = set_data_cb;
+    interface.transmit_command = transmit_command;
+    interface.transmit_command_futured = nullptr;
+    interface.transmit_downward = nullptr;
+  }
+  return &interface;
+}
diff --git a/main/shim/hci_layer.h b/main/shim/hci_layer.h
new file mode 100644
index 0000000..6b0bbcc
--- /dev/null
+++ b/main/shim/hci_layer.h
@@ -0,0 +1,32 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * Gd shim layer to legacy hci layer stack
+ */
+#pragma once
+
+#include "hci/include/hci_layer.h"
+
+static const char GD_HCI_MODULE[] = "gd_hci_module";
+
+namespace bluetooth {
+namespace shim {
+
+const hci_t* hci_layer_get_interface();
+
+}  // namespace shim
+}  // namespace bluetooth
diff --git a/main/shim/l2c_api.cc b/main/shim/l2c_api.cc
new file mode 100644
index 0000000..7623df1
--- /dev/null
+++ b/main/shim/l2c_api.cc
@@ -0,0 +1,426 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#define LOG_TAG "bt_shim_l2cap"
+
+#include "main/shim/l2c_api.h"
+#include "main/shim/l2cap.h"
+#include "main/shim/shim.h"
+#include "osi/include/log.h"
+
+static bluetooth::legacy::shim::L2cap shim_l2cap;
+
+/**
+ * Classic Service Registration APIs
+ */
+uint16_t bluetooth::shim::L2CA_Register(uint16_t client_psm,
+                                        tL2CAP_APPL_INFO* callbacks,
+                                        bool enable_snoop) {
+  if (L2C_INVALID_PSM(client_psm)) {
+    LOG_ERROR(LOG_TAG, "%s Invalid classic psm:%hd", __func__, client_psm);
+    return 0;
+  }
+
+  if ((callbacks->pL2CA_ConfigCfm_Cb == nullptr) ||
+      (callbacks->pL2CA_ConfigInd_Cb == nullptr) ||
+      (callbacks->pL2CA_DataInd_Cb == nullptr) ||
+      (callbacks->pL2CA_DisconnectInd_Cb == nullptr)) {
+    LOG_ERROR(LOG_TAG, "%s Invalid classic callbacks psm:%hd", __func__,
+              client_psm);
+    return 0;
+  }
+
+  /**
+   * Check if this is a registration for an outgoing-only connection.
+   */
+  bool is_outgoing_connection_only = callbacks->pL2CA_ConnectInd_Cb == nullptr;
+  uint16_t psm = shim_l2cap.ConvertClientToRealPsm(client_psm,
+                                                   is_outgoing_connection_only);
+
+  if (shim_l2cap.Classic().IsPsmRegistered(psm)) {
+    LOG_ERROR(LOG_TAG, "%s Already registered classic client_psm:%hd psm:%hd",
+              __func__, client_psm, psm);
+    return 0;
+  }
+  shim_l2cap.Classic().RegisterPsm(psm, callbacks);
+
+  LOG_INFO(LOG_TAG, "%s classic client_psm:%hd psm:%hd", __func__, client_psm,
+           psm);
+
+  shim_l2cap.RegisterService(psm, callbacks, enable_snoop);
+
+  return client_psm;
+}
+
+void bluetooth::shim::L2CA_Deregister(uint16_t client_psm) {
+  if (L2C_INVALID_PSM(client_psm)) {
+    LOG_ERROR(LOG_TAG, "%s Invalid classic client_psm:%hd", __func__,
+              client_psm);
+    return;
+  }
+  uint16_t psm = shim_l2cap.ConvertClientToRealPsm(client_psm);
+
+  if (!shim_l2cap.Classic().IsPsmRegistered(psm)) {
+    LOG_ERROR(LOG_TAG,
+              "%s Not previously registered classic client_psm:%hd psm:%hd",
+              __func__, client_psm, psm);
+    return;
+  }
+  shim_l2cap.Classic().UnregisterPsm(psm);
+  shim_l2cap.RemoveClientPsm(psm);
+}
+
+uint16_t bluetooth::shim::L2CA_AllocatePSM(void) {
+  uint16_t psm = shim_l2cap.GetNextDynamicClassicPsm();
+  shim_l2cap.Classic().AllocatePsm(psm);
+  return psm;
+}
+
+uint16_t bluetooth::shim::L2CA_AllocateLePSM(void) {
+  uint16_t psm = shim_l2cap.GetNextDynamicLePsm();
+  shim_l2cap.Le().AllocatePsm(psm);
+  return psm;
+}
+
+void bluetooth::shim::L2CA_FreeLePSM(uint16_t psm) {
+  if (!shim_l2cap.Le().IsPsmAllocated(psm)) {
+    LOG_ERROR(LOG_TAG, "%s Not previously allocated le psm:%hd", __func__, psm);
+    return;
+  }
+  if (!shim_l2cap.Le().IsPsmRegistered(psm)) {
+    LOG_ERROR(LOG_TAG, "%s Must deregister psm before deallocation psm:%hd",
+              __func__, psm);
+    return;
+  }
+  shim_l2cap.Le().DeallocatePsm(psm);
+}
+
+/**
+ * Classic Connection Oriented Channel APIS
+ */
+uint16_t bluetooth::shim::L2CA_ErtmConnectReq(uint16_t psm,
+                                              const RawAddress& raw_address,
+                                              tL2CAP_ERTM_INFO* p_ertm_info) {
+  CHECK(p_ertm_info == nullptr)
+      << "UNIMPLEMENTED set enhanced retransmission mode config";
+  return shim_l2cap.CreateConnection(psm, raw_address);
+}
+
+uint16_t bluetooth::shim::L2CA_ConnectReq(uint16_t psm,
+                                          const RawAddress& raw_address) {
+  return bluetooth::shim::L2CA_ErtmConnectReq(psm, raw_address, nullptr);
+}
+
+bool bluetooth::shim::L2CA_ErtmConnectRsp(const RawAddress& p_bd_addr,
+                                          uint8_t id, uint16_t lcid,
+                                          uint16_t result, uint16_t status,
+                                          tL2CAP_ERTM_INFO* p_ertm_info) {
+  LOG_INFO(LOG_TAG,
+           "UNIMPLEMENTED %s addr:%s id:%hhd lcid:%hd result:%hd status:%hd "
+           "p_ertm_info:%p",
+           __func__, p_bd_addr.ToString().c_str(), id, lcid, result, status,
+           p_ertm_info);
+  return false;
+}
+
+bool bluetooth::shim::L2CA_ConnectRsp(const RawAddress& p_bd_addr, uint8_t id,
+                                      uint16_t lcid, uint16_t result,
+                                      uint16_t status) {
+  return bluetooth::shim::L2CA_ErtmConnectRsp(p_bd_addr, id, lcid, result,
+                                              status, NULL);
+}
+
+bool bluetooth::shim::L2CA_ConfigReq(uint16_t cid, tL2CAP_CFG_INFO* cfg_info) {
+  return shim_l2cap.ConfigRequest(cid, cfg_info);
+}
+
+bool bluetooth::shim::L2CA_ConfigRsp(uint16_t cid, tL2CAP_CFG_INFO* cfg_info) {
+  return shim_l2cap.ConfigResponse(cid, cfg_info);
+}
+
+bool bluetooth::shim::L2CA_DisconnectReq(uint16_t cid) {
+  return shim_l2cap.DisconnectRequest(cid);
+}
+
+bool bluetooth::shim::L2CA_DisconnectRsp(uint16_t cid) {
+  return shim_l2cap.DisconnectResponse(cid);
+}
+
+/**
+ * Le Connection Oriented Channel APIs
+ */
+uint16_t bluetooth::shim::L2CA_RegisterLECoc(uint16_t psm,
+                                             tL2CAP_APPL_INFO* callbacks) {
+  LOG_INFO(LOG_TAG, "UNIMPLEMENTED %s psm:%hd callbacks:%p", __func__, psm,
+           callbacks);
+  return 0;
+}
+
+void bluetooth::shim::L2CA_DeregisterLECoc(uint16_t psm) {
+  LOG_INFO(LOG_TAG, "UNIMPLEMENTED %s psm:%hd", __func__, psm);
+}
+
+uint16_t bluetooth::shim::L2CA_ConnectLECocReq(uint16_t psm,
+                                               const RawAddress& p_bd_addr,
+                                               tL2CAP_LE_CFG_INFO* p_cfg) {
+  LOG_INFO(LOG_TAG, "UNIMPLEMENTED %s psm:%hd addr:%s p_cfg:%p", __func__, psm,
+           p_bd_addr.ToString().c_str(), p_cfg);
+  return 0;
+}
+
+bool bluetooth::shim::L2CA_ConnectLECocRsp(const RawAddress& p_bd_addr,
+                                           uint8_t id, uint16_t lcid,
+                                           uint16_t result, uint16_t status,
+                                           tL2CAP_LE_CFG_INFO* p_cfg) {
+  LOG_INFO(LOG_TAG,
+           "UNIMPLEMENTED %s addr:%s id:%hhd lcid:%hd result:%hd status:%hd "
+           "p_cfg:%p",
+           __func__, p_bd_addr.ToString().c_str(), id, lcid, result, status,
+           p_cfg);
+  return false;
+}
+
+bool bluetooth::shim::L2CA_GetPeerLECocConfig(uint16_t lcid,
+                                              tL2CAP_LE_CFG_INFO* peer_cfg) {
+  LOG_INFO(LOG_TAG, "UNIMPLEMENTED %s lcid:%hd peer_cfg:%p", __func__, lcid,
+           peer_cfg);
+  return false;
+}
+
+/**
+ * Channel Data Writes
+ */
+bool bluetooth::shim::L2CA_SetConnectionCallbacks(
+    uint16_t cid, const tL2CAP_APPL_INFO* callbacks) {
+  return shim_l2cap.SetCallbacks(cid, callbacks);
+}
+
+uint8_t bluetooth::shim::L2CA_DataWriteEx(uint16_t cid, BT_HDR* bt_hdr,
+                                          uint16_t flags) {
+  if (shim_l2cap.IsCongested(cid)) {
+    return L2CAP_DW_CONGESTED;
+  }
+
+  bool write_success = false;
+  switch (flags) {
+    case L2CAP_FLUSHABLE_CH_BASED:
+      write_success = shim_l2cap.Write(cid, bt_hdr);
+      break;
+    case L2CAP_FLUSHABLE_PKT:
+      write_success = shim_l2cap.WriteFlushable(cid, bt_hdr);
+      break;
+    case L2CAP_NON_FLUSHABLE_PKT:
+      write_success = shim_l2cap.WriteNonFlushable(cid, bt_hdr);
+      break;
+  }
+  return write_success ? L2CAP_DW_SUCCESS : L2CAP_DW_FAILED;
+}
+
+uint8_t bluetooth::shim::L2CA_DataWrite(uint16_t cid, BT_HDR* p_data) {
+  return bluetooth::shim::L2CA_DataWriteEx(cid, p_data,
+                                           L2CAP_FLUSHABLE_CH_BASED);
+}
+
+/**
+ * L2cap Layer APIs
+ */
+uint8_t bluetooth::shim::L2CA_SetDesireRole(uint8_t new_role) {
+  LOG_INFO(LOG_TAG, "UNIMPLEMENTED %s", __func__);
+  return 0;
+}
+
+/**
+ * Ping APIs
+ */
+bool bluetooth::shim::L2CA_Ping(const RawAddress& p_bd_addr,
+                                tL2CA_ECHO_RSP_CB* p_callback) {
+  LOG_INFO(LOG_TAG, "UNIMPLEMENTED %s addr:%s p_callback:%p", __func__,
+           p_bd_addr.ToString().c_str(), p_callback);
+  return false;
+}
+
+bool bluetooth::shim::L2CA_Echo(const RawAddress& p_bd_addr, BT_HDR* p_data,
+                                tL2CA_ECHO_DATA_CB* p_callback) {
+  LOG_INFO(LOG_TAG, "UNIMPLEMENTED %s addr:%s p_callback:%p", __func__,
+           p_bd_addr.ToString().c_str(), p_callback);
+  return false;
+}
+
+/**
+ * Link APIs
+ */
+bool bluetooth::shim::L2CA_SetIdleTimeoutByBdAddr(const RawAddress& bd_addr,
+                                                  uint16_t timeout,
+                                                  tBT_TRANSPORT transport) {
+  LOG_INFO(LOG_TAG, "UNIMPLEMENTED %s", __func__);
+  return false;
+}
+
+uint16_t bluetooth::shim::L2CA_LocalLoopbackReq(uint16_t psm, uint16_t handle,
+                                                const RawAddress& p_bd_addr) {
+  LOG_INFO(LOG_TAG, "UNIMPLEMENTED %s", __func__);
+  return 0;
+}
+
+bool bluetooth::shim::L2CA_SetAclPriority(const RawAddress& bd_addr,
+                                          uint8_t priority) {
+  LOG_INFO(LOG_TAG, "UNIMPLEMENTED %s", __func__);
+  return false;
+}
+
+bool bluetooth::shim::L2CA_SetFlushTimeout(const RawAddress& bd_addr,
+                                           uint16_t flush_tout) {
+  LOG_INFO(LOG_TAG, "UNIMPLEMENTED %s", __func__);
+  return false;
+}
+
+bool bluetooth::shim::L2CA_GetPeerFeatures(const RawAddress& bd_addr,
+                                           uint32_t* p_ext_feat,
+                                           uint8_t* p_chnl_mask) {
+  LOG_INFO(LOG_TAG, "UNIMPLEMENTED %s", __func__);
+  return false;
+}
+
+bool bluetooth::shim::L2CA_GetBDAddrbyHandle(uint16_t handle,
+                                             RawAddress& bd_addr) {
+  LOG_INFO(LOG_TAG, "UNIMPLEMENTED %s", __func__);
+  return false;
+}
+
+/**
+ * Fixed Channel APIs
+ */
+bool bluetooth::shim::L2CA_RegisterFixedChannel(uint16_t fixed_cid,
+                                                tL2CAP_FIXED_CHNL_REG* p_freg) {
+  LOG_INFO(LOG_TAG, "UNIMPLEMENTED %s", __func__);
+  return false;
+}
+
+bool bluetooth::shim::L2CA_ConnectFixedChnl(uint16_t fixed_cid,
+                                            const RawAddress& rem_bda) {
+  LOG_INFO(LOG_TAG, "UNIMPLEMENTED %s", __func__);
+  return false;
+}
+
+bool bluetooth::shim::L2CA_ConnectFixedChnl(uint16_t fixed_cid,
+                                            const RawAddress& rem_bda,
+                                            uint8_t initiating_phys) {
+  LOG_INFO(LOG_TAG, "UNIMPLEMENTED %s", __func__);
+  return false;
+}
+
+uint16_t bluetooth::shim::L2CA_SendFixedChnlData(uint16_t fixed_cid,
+                                                 const RawAddress& rem_bda,
+                                                 BT_HDR* p_buf) {
+  LOG_INFO(LOG_TAG, "UNIMPLEMENTED %s", __func__);
+  return 0;
+}
+
+bool bluetooth::shim::L2CA_RemoveFixedChnl(uint16_t fixed_cid,
+                                           const RawAddress& rem_bda) {
+  LOG_INFO(LOG_TAG, "UNIMPLEMENTED %s", __func__);
+  return false;
+}
+
+/**
+ * Channel Configuration API
+ */
+bool bluetooth::shim::L2CA_GetCurrentConfig(
+    uint16_t lcid, tL2CAP_CFG_INFO** pp_our_cfg,
+    tL2CAP_CH_CFG_BITS* p_our_cfg_bits, tL2CAP_CFG_INFO** pp_peer_cfg,
+    tL2CAP_CH_CFG_BITS* p_peer_cfg_bits) {
+  LOG_INFO(LOG_TAG, "UNIMPLEMENTED %s", __func__);
+  return false;
+}
+
+bool bluetooth::shim::L2CA_GetConnectionConfig(uint16_t lcid, uint16_t* mtu,
+                                               uint16_t* rcid,
+                                               uint16_t* handle) {
+  LOG_INFO(LOG_TAG, "UNIMPLEMENTED %s", __func__);
+  return false;
+}
+
+/**
+ * Channel hygiene APIs
+ */
+bool bluetooth::shim::L2CA_GetIdentifiers(uint16_t lcid, uint16_t* rcid,
+                                          uint16_t* handle) {
+  LOG_INFO(LOG_TAG, "UNIMPLEMENTED %s", __func__);
+  return false;
+}
+
+bool bluetooth::shim::L2CA_SetIdleTimeout(uint16_t cid, uint16_t timeout,
+                                          bool is_global) {
+  LOG_INFO(LOG_TAG, "UNIMPLEMENTED %s", __func__);
+  return false;
+}
+
+bool bluetooth::shim::L2CA_FlowControl(uint16_t cid, bool data_enabled) {
+  LOG_INFO(LOG_TAG, "UNIMPLEMENTED %s", __func__);
+  return false;
+}
+
+bool bluetooth::shim::L2CA_SendTestSFrame(uint16_t cid, uint8_t sup_type,
+                                          uint8_t back_track) {
+  LOG_INFO(LOG_TAG, "UNIMPLEMENTED %s", __func__);
+  return false;
+}
+
+bool bluetooth::shim::L2CA_SetTxPriority(uint16_t cid,
+                                         tL2CAP_CHNL_PRIORITY priority) {
+  LOG_INFO(LOG_TAG, "UNIMPLEMENTED %s", __func__);
+  return false;
+}
+
+bool bluetooth::shim::L2CA_SetChnlDataRate(uint16_t cid,
+                                           tL2CAP_CHNL_DATA_RATE tx,
+                                           tL2CAP_CHNL_DATA_RATE rx) {
+  LOG_INFO(LOG_TAG, "UNIMPLEMENTED %s", __func__);
+  return false;
+}
+
+uint8_t bluetooth::shim::L2CA_GetChnlFcrMode(uint16_t lcid) {
+  LOG_INFO(LOG_TAG, "UNIMPLEMENTED %s", __func__);
+  return 0;
+}
+
+bool bluetooth::shim::L2CA_SetFixedChannelTout(const RawAddress& rem_bda,
+                                               uint16_t fixed_cid,
+                                               uint16_t idle_tout) {
+  LOG_INFO(LOG_TAG, "UNIMPLEMENTED %s", __func__);
+  return false;
+}
+
+bool bluetooth::shim::L2CA_SetChnlFlushability(uint16_t cid,
+                                               bool is_flushable) {
+  LOG_INFO(LOG_TAG, "UNIMPLEMENTED %s", __func__);
+  return false;
+}
+
+uint16_t bluetooth::shim::L2CA_FlushChannel(uint16_t lcid,
+                                            uint16_t num_to_flush) {
+  LOG_INFO(LOG_TAG, "UNIMPLEMENTED %s", __func__);
+  return 0;
+}
+
+/**
+ * Misc APIs
+ */
+bool bluetooth::shim::L2CA_RegForNoCPEvt(tL2CA_NOCP_CB* p_cb,
+                                         const RawAddress& p_bda) {
+  LOG_INFO(LOG_TAG, "UNIMPLEMENTED %s", __func__);
+  return false;
+}
diff --git a/main/shim/l2c_api.h b/main/shim/l2c_api.h
new file mode 100644
index 0000000..83f3afa
--- /dev/null
+++ b/main/shim/l2c_api.h
@@ -0,0 +1,874 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#pragma once
+
+#include <set>
+#include <unordered_map>
+
+#include "stack/include/l2c_api.h"
+#include "stack/l2cap/l2c_int.h"
+
+namespace bluetooth {
+namespace shim {
+
+/*******************************************************************************
+ *
+ * Function         L2CA_Register
+ *
+ * Description      Other layers call this function to register for L2CAP
+ *                  services.
+ *
+ * Returns          PSM to use or zero if error. Typically, the PSM returned
+ *                  is the same as was passed in, but for an outgoing-only
+ *                  connection to a dynamic PSM, a "virtual" PSM is returned
+ *                  and should be used in the calls to L2CA_ConnectReq() and
+ *                  BTM_SetSecurityLevel().
+ *
+ ******************************************************************************/
+uint16_t L2CA_Register(uint16_t psm, tL2CAP_APPL_INFO* p_cb_info,
+                       bool enable_snoop);
+
+/*******************************************************************************
+ *
+ * Function         L2CA_Deregister
+ *
+ * Description      Other layers call this function to deregister for L2CAP
+ *                  services.
+ *
+ * Returns          void
+ *
+ ******************************************************************************/
+void L2CA_Deregister(uint16_t psm);
+
+/*******************************************************************************
+ *
+ * Function         L2CA_AllocatePSM
+ *
+ * Description      Other layers call this function to find an unused PSM for
+ *                  L2CAP services.
+ *
+ * Returns          PSM to use.
+ *
+ ******************************************************************************/
+uint16_t L2CA_AllocatePSM(void);
+
+/*******************************************************************************
+ *
+ * Function         L2CA_AllocateLePSM
+ *
+ * Description      Other layers call this function to find an unused LE PSM for
+ *                  L2CAP services.
+ *
+ * Returns          LE_PSM to use if success. Otherwise returns 0.
+ *
+ ******************************************************************************/
+uint16_t L2CA_AllocateLePSM(void);
+
+/*******************************************************************************
+ *
+ * Function         L2CA_FreeLePSM
+ *
+ * Description      Free an assigned LE PSM.
+ *
+ * Returns          void
+ *
+ ******************************************************************************/
+void L2CA_FreeLePSM(uint16_t psm);
+
+/*******************************************************************************
+ *
+ * Function         L2CA_ConnectReq
+ *
+ * Description      Higher layers call this function to create an L2CAP
+ *                  connection.
+ *                  Note that the connection is not established at this time,
+ *                  but connection establishment gets started. The callback
+ *                  will be invoked when connection establishes or fails.
+ *
+ * Returns          the CID of the connection, or 0 if it failed to start
+ *
+ ******************************************************************************/
+uint16_t L2CA_ConnectReq(uint16_t psm, const RawAddress& p_bd_addr);
+
+/*******************************************************************************
+ *
+ * Function         L2CA_ConnectRsp
+ *
+ * Description      Higher layers call this function to accept an incoming
+ *                  L2CAP connection, for which they had gotten an connect
+ *                  indication callback.
+ *
+ * Returns          true for success, false for failure
+ *
+ ******************************************************************************/
+bool L2CA_ConnectRsp(const RawAddress& p_bd_addr, uint8_t id, uint16_t lcid,
+                     uint16_t result, uint16_t status);
+
+/*******************************************************************************
+ *
+ * Function         L2CA_ErtmConnectReq
+ *
+ * Description      Higher layers call this function to create an L2CAP
+ *                  connection that needs to use Enhanced Retransmission Mode.
+ *                  Note that the connection is not established at this time,
+ *                  but connection establishment gets started. The callback
+ *                  will be invoked when connection establishes or fails.
+ *
+ * Returns          the CID of the connection, or 0 if it failed to start
+ *
+ ******************************************************************************/
+uint16_t L2CA_ErtmConnectReq(uint16_t psm, const RawAddress& p_bd_addr,
+                             tL2CAP_ERTM_INFO* p_ertm_info);
+
+/*******************************************************************************
+ *
+ * Function         L2CA_RegisterLECoc
+ *
+ * Description      Other layers call this function to register for L2CAP
+ *                  Connection Oriented Channel.
+ *
+ * Returns          PSM to use or zero if error. Typically, the PSM returned
+ *                  is the same as was passed in, but for an outgoing-only
+ *                  connection to a dynamic PSM, a "virtual" PSM is returned
+ *                  and should be used in the calls to L2CA_ConnectLECocReq()
+ *                  and BTM_SetSecurityLevel().
+ *
+ ******************************************************************************/
+uint16_t L2CA_RegisterLECoc(uint16_t psm, tL2CAP_APPL_INFO* p_cb_info);
+
+/*******************************************************************************
+ *
+ * Function         L2CA_DeregisterLECoc
+ *
+ * Description      Other layers call this function to deregister for L2CAP
+ *                  Connection Oriented Channel.
+ *
+ * Returns          void
+ *
+ ******************************************************************************/
+void L2CA_DeregisterLECoc(uint16_t psm);
+
+/*******************************************************************************
+ *
+ * Function         L2CA_ConnectLECocReq
+ *
+ * Description      Higher layers call this function to create an L2CAP LE COC.
+ *                  Note that the connection is not established at this time,
+ *                  but connection establishment gets started. The callback
+ *                  will be invoked when connection establishes or fails.
+ *
+ * Returns          the CID of the connection, or 0 if it failed to start
+ *
+ ******************************************************************************/
+uint16_t L2CA_ConnectLECocReq(uint16_t psm, const RawAddress& p_bd_addr,
+                              tL2CAP_LE_CFG_INFO* p_cfg);
+
+/*******************************************************************************
+ *
+ * Function         L2CA_ConnectLECocRsp
+ *
+ * Description      Higher layers call this function to accept an incoming
+ *                  L2CAP LE COC connection, for which they had gotten a connect
+ *                  indication callback.
+ *
+ * Returns          true for success, false for failure
+ *
+ ******************************************************************************/
+bool L2CA_ConnectLECocRsp(const RawAddress& p_bd_addr, uint8_t id,
+                          uint16_t lcid, uint16_t result, uint16_t status,
+                          tL2CAP_LE_CFG_INFO* p_cfg);
+
+/*******************************************************************************
+ *
+ *  Function         L2CA_GetPeerLECocConfig
+ *
+ *  Description      Get peers configuration for LE Connection Oriented Channel.
+ *
+ *  Return value:    true if peer is connected
+ *
+ ******************************************************************************/
+bool L2CA_GetPeerLECocConfig(uint16_t lcid, tL2CAP_LE_CFG_INFO* peer_cfg);
+
+// This function sets the callback routines for the L2CAP connection referred to
+// by |local_cid|. The callback routines can only be modified for outgoing
+// connections established by |L2CA_ConnectReq| or accepted incoming
+// connections. |callbacks| must not be NULL. This function returns true if the
+// callbacks could be updated, false if not (e.g. |local_cid| was not found).
+bool L2CA_SetConnectionCallbacks(uint16_t local_cid,
+                                 const tL2CAP_APPL_INFO* callbacks);
+
+/*******************************************************************************
+ *
+ * Function         L2CA_ErtmConnectRsp
+ *
+ * Description      Higher layers call this function to accept an incoming
+ *                  L2CAP connection, for which they had gotten an connect
+ *                  indication callback, and for which the higher layer wants
+ *                  to use Enhanced Retransmission Mode.
+ *
+ * Returns          true for success, false for failure
+ *
+ ******************************************************************************/
+bool L2CA_ErtmConnectRsp(const RawAddress& p_bd_addr, uint8_t id, uint16_t lcid,
+                         uint16_t result, uint16_t status,
+                         tL2CAP_ERTM_INFO* p_ertm_info);
+
+/*******************************************************************************
+ *
+ * Function         L2CA_ConfigReq
+ *
+ * Description      Higher layers call this function to send configuration.
+ *
+ * Returns          true if configuration sent, else false
+ *
+ ******************************************************************************/
+bool L2CA_ConfigReq(uint16_t cid, tL2CAP_CFG_INFO* p_cfg);
+
+/*******************************************************************************
+ *
+ * Function         L2CA_ConfigRsp
+ *
+ * Description      Higher layers call this function to send a configuration
+ *                  response.
+ *
+ * Returns          true if configuration response sent, else false
+ *
+ ******************************************************************************/
+bool L2CA_ConfigRsp(uint16_t cid, tL2CAP_CFG_INFO* p_cfg);
+
+/*******************************************************************************
+ *
+ * Function         L2CA_DisconnectReq
+ *
+ * Description      Higher layers call this function to disconnect a channel.
+ *
+ * Returns          true if disconnect sent, else false
+ *
+ ******************************************************************************/
+bool L2CA_DisconnectReq(uint16_t cid);
+
+/*******************************************************************************
+ *
+ * Function         L2CA_DisconnectRsp
+ *
+ * Description      Higher layers call this function to acknowledge the
+ *                  disconnection of a channel.
+ *
+ * Returns          void
+ *
+ ******************************************************************************/
+bool L2CA_DisconnectRsp(uint16_t cid);
+
+/*******************************************************************************
+ *
+ * Function         L2CA_DataWrite
+ *
+ * Description      Higher layers call this function to write data.
+ *
+ * Returns          L2CAP_DW_SUCCESS, if data accepted, else false
+ *                  L2CAP_DW_CONGESTED, if data accepted and the channel is
+ *                                      congested
+ *                  L2CAP_DW_FAILED, if error
+ *
+ ******************************************************************************/
+uint8_t L2CA_DataWrite(uint16_t cid, BT_HDR* p_data);
+
+/*******************************************************************************
+ *
+ * Function         L2CA_Ping
+ *
+ * Description      Higher layers call this function to send an echo request.
+ *
+ * Returns          true if echo request sent, else false.
+ *
+ ******************************************************************************/
+bool L2CA_Ping(const RawAddress& p_bd_addr, tL2CA_ECHO_RSP_CB* p_cb);
+
+/*******************************************************************************
+ *
+ * Function         L2CA_Echo
+ *
+ * Description      Higher layers call this function to send an echo request
+ *                  with application-specific data.
+ *
+ * Returns          true if echo request sent, else false.
+ *
+ ******************************************************************************/
+bool L2CA_Echo(const RawAddress& p_bd_addr, BT_HDR* p_data,
+               tL2CA_ECHO_DATA_CB* p_callback);
+
+// Given a local channel identifier, |lcid|, this function returns the bound
+// remote channel identifier, |rcid|, and the ACL link handle, |handle|. If
+// |lcid| is not known or is invalid, this function returns false and does not
+// modify the values pointed at by |rcid| and |handle|. |rcid| and |handle| may
+// be NULL.
+bool L2CA_GetIdentifiers(uint16_t lcid, uint16_t* rcid, uint16_t* handle);
+
+/*******************************************************************************
+ *
+ * Function         L2CA_SetIdleTimeout
+ *
+ * Description      Higher layers call this function to set the idle timeout for
+ *                  a connection, or for all future connections. The "idle
+ *                  timeout" is the amount of time that a connection can remain
+ *                  up with no L2CAP channels on it. A timeout of zero means
+ *                  that the connection will be torn down immediately when the
+ *                  last channel is removed. A timeout of 0xFFFF means no
+ *                  timeout. Values are in seconds.
+ *
+ * Returns          true if command succeeded, false if failed
+ *
+ ******************************************************************************/
+bool L2CA_SetIdleTimeout(uint16_t cid, uint16_t timeout, bool is_global);
+
+/*******************************************************************************
+ *
+ * Function         L2CA_SetIdleTimeoutByBdAddr
+ *
+ * Description      Higher layers call this function to set the idle timeout for
+ *                  a connection. The "idle timeout" is the amount of time that
+ *                  a connection can remain up with no L2CAP channels on it.
+ *                  A timeout of zero means that the connection will be torn
+ *                  down immediately when the last channel is removed.
+ *                  A timeout of 0xFFFF means no timeout. Values are in seconds.
+ *                  A bd_addr is the remote BD address. If bd_addr =
+ *                  RawAddress::kAny, then the idle timeouts for all active
+ *                  l2cap links will be changed.
+ *
+ * Returns          true if command succeeded, false if failed
+ *
+ * NOTE             This timeout applies to all logical channels active on the
+ *                  ACL link.
+ ******************************************************************************/
+bool L2CA_SetIdleTimeoutByBdAddr(const RawAddress& bd_addr, uint16_t timeout,
+                                 tBT_TRANSPORT transport);
+
+/*******************************************************************************
+ *
+ * Function         L2CA_SetTraceLevel
+ *
+ * Description      This function sets the trace level for L2CAP. If called with
+ *                  a value of 0xFF, it simply reads the current trace level.
+ *
+ * Returns          the new (current) trace level
+ *
+ ******************************************************************************/
+uint8_t L2CA_SetTraceLevel(uint8_t trace_level);
+
+/*******************************************************************************
+ *
+ * Function     L2CA_SetDesireRole
+ *
+ * Description  This function sets the desire role for L2CAP.
+ *              If the new role is L2CAP_ROLE_ALLOW_SWITCH, allow switch on
+ *              HciCreateConnection.
+ *              If the new role is L2CAP_ROLE_DISALLOW_SWITCH, do not allow
+ *              switch on HciCreateConnection.
+ *
+ *              If the new role is a valid role (HCI_ROLE_MASTER or
+ *              HCI_ROLE_SLAVE), the desire role is set to the new value.
+ *              Otherwise, it is not changed.
+ *
+ * Returns      the new (current) role
+ *
+ ******************************************************************************/
+uint8_t L2CA_SetDesireRole(uint8_t new_role);
+
+/*******************************************************************************
+ *
+ * Function     L2CA_LocalLoopbackReq
+ *
+ * Description  This function sets up a CID for local loopback
+ *
+ * Returns      CID of 0 if none.
+ *
+ ******************************************************************************/
+uint16_t L2CA_LocalLoopbackReq(uint16_t psm, uint16_t handle,
+                               const RawAddress& p_bd_addr);
+
+/*******************************************************************************
+ *
+ * Function     L2CA_FlushChannel
+ *
+ * Description  This function flushes none, some or all buffers queued up
+ *              for xmission for a particular CID. If called with
+ *              L2CAP_FLUSH_CHANS_GET (0), it simply returns the number
+ *              of buffers queued for that CID L2CAP_FLUSH_CHANS_ALL (0xffff)
+ *              flushes all buffers.  All other values specifies the maximum
+ *              buffers to flush.
+ *
+ * Returns      Number of buffers left queued for that CID
+ *
+ ******************************************************************************/
+uint16_t L2CA_FlushChannel(uint16_t lcid, uint16_t num_to_flush);
+
+/*******************************************************************************
+ *
+ * Function         L2CA_SetAclPriority
+ *
+ * Description      Sets the transmission priority for an ACL channel.
+ *                  (For initial implementation only two values are valid.
+ *                  L2CAP_PRIORITY_NORMAL and L2CAP_PRIORITY_HIGH).
+ *
+ * Returns          true if a valid channel, else false
+ *
+ ******************************************************************************/
+bool L2CA_SetAclPriority(const RawAddress& bd_addr, uint8_t priority);
+
+/*******************************************************************************
+ *
+ * Function         L2CA_FlowControl
+ *
+ * Description      Higher layers call this function to flow control a channel.
+ *
+ *                  data_enabled - true data flows, false data is stopped
+ *
+ * Returns          true if valid channel, else false
+ *
+ ******************************************************************************/
+bool L2CA_FlowControl(uint16_t cid, bool data_enabled);
+
+/*******************************************************************************
+ *
+ * Function         L2CA_SendTestSFrame
+ *
+ * Description      Higher layers call this function to send a test S-frame.
+ *
+ * Returns          true if valid Channel, else false
+ *
+ ******************************************************************************/
+bool L2CA_SendTestSFrame(uint16_t cid, uint8_t sup_type, uint8_t back_track);
+
+/*******************************************************************************
+ *
+ * Function         L2CA_SetTxPriority
+ *
+ * Description      Sets the transmission priority for a channel. (FCR Mode)
+ *
+ * Returns          true if a valid channel, else false
+ *
+ ******************************************************************************/
+bool L2CA_SetTxPriority(uint16_t cid, tL2CAP_CHNL_PRIORITY priority);
+
+/*******************************************************************************
+ *
+ * Function         L2CA_RegForNoCPEvt
+ *
+ * Description      Register callback for Number of Completed Packets event.
+ *
+ * Input Param      p_cb - callback for Number of completed packets event
+ *                  p_bda - BT address of remote device
+ *
+ * Returns
+ *
+ ******************************************************************************/
+bool L2CA_RegForNoCPEvt(tL2CA_NOCP_CB* p_cb, const RawAddress& p_bda);
+
+/*******************************************************************************
+ *
+ * Function         L2CA_SetChnlDataRate
+ *
+ * Description      Sets the tx/rx data rate for a channel.
+ *
+ * Returns          true if a valid channel, else false
+ *
+ ******************************************************************************/
+bool L2CA_SetChnlDataRate(uint16_t cid, tL2CAP_CHNL_DATA_RATE tx,
+                          tL2CAP_CHNL_DATA_RATE rx);
+
+typedef void(tL2CA_RESERVE_CMPL_CBACK)(void);
+
+/*******************************************************************************
+ *
+ * Function         L2CA_SetFlushTimeout
+ *
+ * Description      This function set the automatic flush time out in Baseband
+ *                  for ACL-U packets.
+ *                  BdAddr : the remote BD address of ACL link. If it is
+ *                           BT_DB_ANY then the flush time out will be applied
+ *                           to all ACL link.
+ *                  FlushTimeout: flush time out in ms
+ *                           0x0000 : No automatic flush
+ *                           L2CAP_NO_RETRANSMISSION : No retransmission
+ *                           0x0002 - 0xFFFE : flush time out, if
+ *                                             (flush_tout * 8) + 3 / 5) <=
+ *                                             HCI_MAX_AUTOMATIC_FLUSH_TIMEOUT
+ *                                             (in 625us slot).
+ *                                    Otherwise, return false.
+ *                           L2CAP_NO_AUTOMATIC_FLUSH : No automatic flush
+ *
+ * Returns          true if command succeeded, false if failed
+ *
+ * NOTE             This flush timeout applies to all logical channels active on
+ *                  the ACL link.
+ ******************************************************************************/
+bool L2CA_SetFlushTimeout(const RawAddress& bd_addr, uint16_t flush_tout);
+
+/*******************************************************************************
+ *
+ * Function         L2CA_DataWriteEx
+ *
+ * Description      Higher layers call this function to write data with extended
+ *                  flags.
+ *                  flags : L2CAP_FLUSHABLE_CH_BASED
+ *                          L2CAP_FLUSHABLE_PKT
+ *                          L2CAP_NON_FLUSHABLE_PKT
+ *
+ * Returns          L2CAP_DW_SUCCESS, if data accepted, else false
+ *                  L2CAP_DW_CONGESTED, if data accepted and the channel is
+ *                                      congested
+ *                  L2CAP_DW_FAILED, if error
+ *
+ ******************************************************************************/
+uint8_t L2CA_DataWriteEx(uint16_t cid, BT_HDR* p_data, uint16_t flags);
+
+/*******************************************************************************
+ *
+ * Function         L2CA_SetChnlFlushability
+ *
+ * Description      Higher layers call this function to set a channels
+ *                  flushability flags
+ *
+ * Returns          true if CID found, else false
+ *
+ ******************************************************************************/
+bool L2CA_SetChnlFlushability(uint16_t cid, bool is_flushable);
+
+/*******************************************************************************
+ *
+ *  Function         L2CA_GetPeerFeatures
+ *
+ *  Description      Get a peers features and fixed channel map
+ *
+ *  Parameters:      BD address of the peer
+ *                   Pointers to features and channel mask storage area
+ *
+ *  Return value:    true if peer is connected
+ *
+ ******************************************************************************/
+bool L2CA_GetPeerFeatures(const RawAddress& bd_addr, uint32_t* p_ext_feat,
+                          uint8_t* p_chnl_mask);
+
+/*******************************************************************************
+ *
+ *  Function         L2CA_GetBDAddrbyHandle
+ *
+ *  Description      Get BD address for the given HCI handle
+ *
+ *  Parameters:      HCI handle
+ *                   BD address of the peer
+ *
+ *  Return value:    true if found lcb for the given handle, false otherwise
+ *
+ ******************************************************************************/
+bool L2CA_GetBDAddrbyHandle(uint16_t handle, RawAddress& bd_addr);
+
+/*******************************************************************************
+ *
+ *  Function         L2CA_GetChnlFcrMode
+ *
+ *  Description      Get the channel FCR mode
+ *
+ *  Parameters:      Local CID
+ *
+ *  Return value:    Channel mode
+ *
+ ******************************************************************************/
+uint8_t L2CA_GetChnlFcrMode(uint16_t lcid);
+
+/*******************************************************************************
+ *
+ *  Function        L2CA_UcdRegister
+ *
+ *  Description     Register PSM on UCD.
+ *
+ *  Parameters:     tL2CAP_UCD_CB_INFO
+ *
+ *  Return value:   true if successs
+ *
+ ******************************************************************************/
+bool L2CA_UcdRegister(uint16_t psm, tL2CAP_UCD_CB_INFO* p_cb_info);
+
+/*******************************************************************************
+ *
+ *  Function        L2CA_UcdDeregister
+ *
+ *  Description     Deregister PSM on UCD.
+ *
+ *  Parameters:     PSM
+ *
+ *  Return value:   true if successs
+ *
+ ******************************************************************************/
+bool L2CA_UcdDeregister(uint16_t psm);
+
+/*******************************************************************************
+ *
+ *  Function        L2CA_UcdDiscover
+ *
+ *  Description     Discover UCD of remote device.
+ *
+ *  Parameters:     PSM
+ *                  BD_ADDR of remote device
+ *                  info_type : L2CAP_UCD_INFO_TYPE_RECEPTION
+ *                              L2CAP_UCD_INFO_TYPE_MTU
+ *
+ *
+ *  Return value:   true if successs
+ *
+ ******************************************************************************/
+bool L2CA_UcdDiscover(uint16_t psm, const RawAddress& rem_bda,
+                      uint8_t info_type);
+
+/*******************************************************************************
+ *
+ *  Function        L2CA_UcdDataWrite
+ *
+ *  Description     Send UCD to remote device
+ *
+ *  Parameters:     PSM
+ *                  BD Address of remote
+ *                  Pointer to buffer of type BT_HDR
+ *                  flags : L2CAP_FLUSHABLE_CH_BASED
+ *                          L2CAP_FLUSHABLE_PKT
+ *                          L2CAP_NON_FLUSHABLE_PKT
+ *
+ * Return value     L2CAP_DW_SUCCESS, if data accepted
+ *                  L2CAP_DW_FAILED,  if error
+ *
+ ******************************************************************************/
+uint16_t L2CA_UcdDataWrite(uint16_t psm, const RawAddress& rem_bda,
+                           BT_HDR* p_buf, uint16_t flags);
+
+/*******************************************************************************
+ *
+ *  Function        L2CA_UcdSetIdleTimeout
+ *
+ *  Description     Set UCD Idle timeout.
+ *
+ *  Parameters:     BD Addr
+ *                  Timeout in second
+ *
+ *  Return value:   true if successs
+ *
+ ******************************************************************************/
+bool L2CA_UcdSetIdleTimeout(const RawAddress& rem_bda, uint16_t timeout);
+
+/*******************************************************************************
+ *
+ * Function         L2CA_UCDSetTxPriority
+ *
+ * Description      Sets the transmission priority for a connectionless channel.
+ *
+ * Returns          true if a valid channel, else false
+ *
+ ******************************************************************************/
+bool L2CA_UCDSetTxPriority(const RawAddress& rem_bda,
+                           tL2CAP_CHNL_PRIORITY priority);
+
+/*******************************************************************************
+ *
+ *  Function        L2CA_RegisterFixedChannel
+ *
+ *  Description     Register a fixed channel.
+ *
+ *  Parameters:     Fixed Channel #
+ *                  Channel Callbacks and config
+ *
+ *  Return value:   true if registered OK
+ *
+ ******************************************************************************/
+bool L2CA_RegisterFixedChannel(uint16_t fixed_cid,
+                               tL2CAP_FIXED_CHNL_REG* p_freg);
+
+/*******************************************************************************
+ *
+ *  Function        L2CA_ConnectFixedChnl
+ *
+ *  Description     Connect an fixed signalling channel to a remote device.
+ *
+ *  Parameters:     Fixed CID
+ *                  BD Address of remote
+ *
+ *  Return value:   true if connection started
+ *
+ ******************************************************************************/
+bool L2CA_ConnectFixedChnl(uint16_t fixed_cid, const RawAddress& bd_addr);
+bool L2CA_ConnectFixedChnl(uint16_t fixed_cid, const RawAddress& bd_addr,
+                           uint8_t initiating_phys);
+
+/*******************************************************************************
+ *
+ *  Function        L2CA_SendFixedChnlData
+ *
+ *  Description     Write data on a fixed signalling channel.
+ *
+ *  Parameters:     Fixed CID
+ *                  BD Address of remote
+ *                  Pointer to buffer of type BT_HDR
+ *
+ * Return value     L2CAP_DW_SUCCESS, if data accepted
+ *                  L2CAP_DW_FAILED,  if error
+ *
+ ******************************************************************************/
+uint16_t L2CA_SendFixedChnlData(uint16_t fixed_cid, const RawAddress& rem_bda,
+                                BT_HDR* p_buf);
+
+/*******************************************************************************
+ *
+ *  Function        L2CA_RemoveFixedChnl
+ *
+ *  Description     Remove a fixed channel to a remote device.
+ *
+ *  Parameters:     Fixed CID
+ *                  BD Address of remote
+ *                  Idle timeout to use (or 0xFFFF if don't care)
+ *
+ *  Return value:   true if channel removed
+ *
+ ******************************************************************************/
+bool L2CA_RemoveFixedChnl(uint16_t fixed_cid, const RawAddress& rem_bda);
+
+/*******************************************************************************
+ *
+ * Function         L2CA_SetFixedChannelTout
+ *
+ * Description      Higher layers call this function to set the idle timeout for
+ *                  a fixed channel. The "idle timeout" is the amount of time
+ *                  that a connection can remain up with no L2CAP channels on
+ *                  it. A timeout of zero means that the connection will be torn
+ *                  down immediately when the last channel is removed.
+ *                  A timeout of 0xFFFF means no timeout. Values are in seconds.
+ *                  A bd_addr is the remote BD address. If bd_addr =
+ *                  RawAddress::kAny, then the idle timeouts for all active
+ *                  l2cap links will be changed.
+ *
+ * Returns          true if command succeeded, false if failed
+ *
+ ******************************************************************************/
+bool L2CA_SetFixedChannelTout(const RawAddress& rem_bda, uint16_t fixed_cid,
+                              uint16_t idle_tout);
+
+/*******************************************************************************
+ *
+ * Function     L2CA_GetCurrentConfig
+ *
+ * Description  This function returns configurations of L2CAP channel
+ *              pp_our_cfg : pointer of our saved configuration options
+ *              p_our_cfg_bits : valid config in bitmap
+ *              pp_peer_cfg: pointer of peer's saved configuration options
+ *              p_peer_cfg_bits : valid config in bitmap
+ *
+ * Returns      true if successful
+ *
+ ******************************************************************************/
+bool L2CA_GetCurrentConfig(uint16_t lcid, tL2CAP_CFG_INFO** pp_our_cfg,
+                           tL2CAP_CH_CFG_BITS* p_our_cfg_bits,
+                           tL2CAP_CFG_INFO** pp_peer_cfg,
+                           tL2CAP_CH_CFG_BITS* p_peer_cfg_bits);
+
+/*******************************************************************************
+ *
+ * Function     L2CA_GetConnectionConfig
+ *
+ * Description  This function polulates the mtu, remote cid & lm_handle for
+ *              a given local L2CAP channel
+ *
+ * Returns      true if successful
+ *
+ ******************************************************************************/
+bool L2CA_GetConnectionConfig(uint16_t lcid, uint16_t* mtu, uint16_t* rcid,
+                              uint16_t* handle);
+
+/*******************************************************************************
+ *
+ *  Function        L2CA_CancelBleConnectReq
+ *
+ *  Description     Cancel a pending connection attempt to a BLE device.
+ *
+ *  Parameters:     BD Address of remote
+ *
+ *  Return value:   true if connection was cancelled
+ *
+ ******************************************************************************/
+bool L2CA_CancelBleConnectReq(const RawAddress& rem_bda);
+
+/*******************************************************************************
+ *
+ *  Function        L2CA_UpdateBleConnParams
+ *
+ *  Description     Update BLE connection parameters.
+ *
+ *  Parameters:     BD Address of remote
+ *
+ *  Return value:   true if update started
+ *
+ ******************************************************************************/
+bool L2CA_UpdateBleConnParams(const RawAddress& rem_bdRa, uint16_t min_int,
+                              uint16_t max_int, uint16_t latency,
+                              uint16_t timeout);
+bool L2CA_UpdateBleConnParams(const RawAddress& rem_bda, uint16_t min_int,
+                              uint16_t max_int, uint16_t latency,
+                              uint16_t timeout, uint16_t min_ce_len,
+                              uint16_t max_ce_len);
+
+/*******************************************************************************
+ *
+ *  Function        L2CA_EnableUpdateBleConnParams
+ *
+ *  Description     Update BLE connection parameters.
+ *
+ *  Parameters:     BD Address of remote
+ *                  enable flag
+ *
+ *  Return value:   true if update started
+ *
+ ******************************************************************************/
+bool L2CA_EnableUpdateBleConnParams(const RawAddress& rem_bda, bool enable);
+
+/*******************************************************************************
+ *
+ * Function         L2CA_GetBleConnRole
+ *
+ * Description      This function returns the connection role.
+ *
+ * Returns          link role.
+ *
+ ******************************************************************************/
+uint8_t L2CA_GetBleConnRole(const RawAddress& bd_addr);
+
+/*******************************************************************************
+ *
+ * Function         L2CA_GetDisconnectReason
+ *
+ * Description      This function returns the disconnect reason code.
+ *
+ *  Parameters:     BD Address of remote
+ *                  Physical transport for the L2CAP connection (BR/EDR or LE)
+ *
+ * Returns          disconnect reason
+ *
+ ******************************************************************************/
+uint16_t L2CA_GetDisconnectReason(const RawAddress& remote_bda,
+                                  tBT_TRANSPORT transport);
+
+void L2CA_AdjustConnectionIntervals(uint16_t* min_interval,
+                                    uint16_t* max_interval,
+                                    uint16_t floor_interval);
+
+}  // namespace shim
+}  // namespace bluetooth
diff --git a/main/shim/l2cap.cc b/main/shim/l2cap.cc
new file mode 100644
index 0000000..5cf3b92
--- /dev/null
+++ b/main/shim/l2cap.cc
@@ -0,0 +1,353 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+#define LOG_TAG "bt_shim_l2cap"
+
+#include <cstdint>
+
+#include "main/shim/entry.h"
+#include "main/shim/l2cap.h"
+#include "main/shim/shim.h"
+#include "osi/include/allocator.h"
+#include "osi/include/log.h"
+
+constexpr size_t kBtHdrSize = sizeof(BT_HDR);
+constexpr uint16_t kInvalidConnectionInterfaceDescriptor = 0;
+
+bool bluetooth::legacy::shim::PsmData::IsPsmAllocated(uint16_t psm) const {
+  return psm_to_callback_map_.find(psm) != psm_to_callback_map_.end();
+}
+
+bool bluetooth::legacy::shim::PsmData::IsPsmRegistered(uint16_t psm) const {
+  return IsPsmAllocated(psm) && psm_to_callback_map_.at(psm) != nullptr;
+}
+
+void bluetooth::legacy::shim::PsmData::AllocatePsm(uint16_t psm) {
+  RegisterPsm(psm, nullptr);
+}
+
+void bluetooth::legacy::shim::PsmData::RegisterPsm(
+    uint16_t psm, const tL2CAP_APPL_INFO* callbacks) {
+  psm_to_callback_map_[psm] = callbacks;
+}
+
+void bluetooth::legacy::shim::PsmData::UnregisterPsm(uint16_t psm) {
+  psm_to_callback_map_[psm] = nullptr;
+}
+
+void bluetooth::legacy::shim::PsmData::DeallocatePsm(uint16_t psm) {
+  psm_to_callback_map_.erase(psm);
+}
+
+const tL2CAP_APPL_INFO* bluetooth::legacy::shim::PsmData::Callbacks(
+    uint16_t psm) {
+  if (psm_to_callback_map_.find(psm) == psm_to_callback_map_.end()) {
+    LOG_WARN(LOG_TAG, "Accessing unknown psm:%hd:", psm);
+    return nullptr;
+  }
+  return psm_to_callback_map_[psm];
+}
+
+bluetooth::legacy::shim::L2cap::L2cap()
+    : classic_dynamic_psm_(kInitialClassicDynamicPsm),
+      le_dynamic_psm_(kInitialLeDynamicPsm),
+      classic_virtual_psm_(kInitialClassicVirtualPsm) {}
+
+bluetooth::legacy::shim::PsmData& bluetooth::legacy::shim::L2cap::Le() {
+  return le_;
+}
+
+bluetooth::legacy::shim::PsmData& bluetooth::legacy::shim::L2cap::Classic() {
+  return classic_;
+}
+
+bool bluetooth::legacy::shim::L2cap::ConnectionExists(uint16_t cid) const {
+  return cid_to_psm_map_.find(cid) != cid_to_psm_map_.end();
+}
+
+uint16_t bluetooth::legacy::shim::L2cap::ConvertClientToRealPsm(
+    uint16_t client_psm, bool is_outgoing_only_connection) {
+  if (!is_outgoing_only_connection) {
+    return client_psm;
+  }
+  return GetNextVirtualPsm(client_psm);
+}
+
+uint16_t bluetooth::legacy::shim::L2cap::ConvertClientToRealPsm(
+    uint16_t client_psm) {
+  if (client_psm_to_real_psm_map_.find(client_psm) ==
+      client_psm_to_real_psm_map_.end()) {
+    return client_psm;
+  }
+  return client_psm_to_real_psm_map_.at(client_psm);
+}
+
+void bluetooth::legacy::shim::L2cap::RemoveClientPsm(uint16_t client_psm) {
+  if (client_psm_to_real_psm_map_.find(client_psm) !=
+      client_psm_to_real_psm_map_.end()) {
+    client_psm_to_real_psm_map_.erase(client_psm);
+  }
+}
+
+uint16_t bluetooth::legacy::shim::L2cap::GetNextVirtualPsm(uint16_t real_psm) {
+  if (real_psm < kInitialClassicDynamicPsm) {
+    return real_psm;
+  }
+
+  while (Classic().IsPsmAllocated(classic_virtual_psm_)) {
+    classic_virtual_psm_ += 2;
+    if (classic_virtual_psm_ >= kFinalClassicVirtualPsm) {
+      classic_virtual_psm_ = kInitialClassicVirtualPsm;
+    }
+  }
+  return classic_virtual_psm_;
+}
+
+uint16_t bluetooth::legacy::shim::L2cap::GetNextDynamicLePsm() {
+  while (Le().IsPsmAllocated(le_dynamic_psm_)) {
+    le_dynamic_psm_++;
+    if (le_dynamic_psm_ > kFinalLeDynamicPsm) {
+      le_dynamic_psm_ = kInitialLeDynamicPsm;
+    }
+  }
+  return le_dynamic_psm_;
+}
+
+uint16_t bluetooth::legacy::shim::L2cap::GetNextDynamicClassicPsm() {
+  while (Classic().IsPsmAllocated(classic_dynamic_psm_)) {
+    classic_dynamic_psm_ += 2;
+    if (classic_dynamic_psm_ > kFinalClassicDynamicPsm) {
+      classic_dynamic_psm_ = kInitialClassicDynamicPsm;
+    } else if (classic_dynamic_psm_ & 0x0100) {
+      /* the upper byte must be even */
+      classic_dynamic_psm_ += 0x0100;
+    }
+
+    /* if psm is in range of reserved BRCM Aware features */
+    if ((BRCM_RESERVED_PSM_START <= classic_dynamic_psm_) &&
+        (classic_dynamic_psm_ <= BRCM_RESERVED_PSM_END)) {
+      classic_dynamic_psm_ = BRCM_RESERVED_PSM_END + 2;
+    }
+  }
+  return classic_dynamic_psm_;
+}
+
+void bluetooth::legacy::shim::L2cap::RegisterService(
+    uint16_t psm, const tL2CAP_APPL_INFO* callbacks, bool enable_snoop) {
+  LOG_DEBUG(LOG_TAG, "Registering service on psm:%hd", psm);
+
+  if (!enable_snoop) {
+    LOG_WARN(LOG_TAG, "UNIMPLEMENTED Cannot disable snooping on psm:%d", psm);
+  }
+
+  Classic().RegisterPsm(psm, callbacks);
+
+  std::promise<void> register_completed;
+  auto completed = register_completed.get_future();
+  bluetooth::shim::GetL2cap()->RegisterService(
+      psm,
+      std::bind(&bluetooth::legacy::shim::L2cap::OnConnectionReady, this,
+                std::placeholders::_1, std::placeholders::_2,
+                std::placeholders::_3),
+      std::move(register_completed));
+  completed.wait();
+  LOG_DEBUG(LOG_TAG, "Successfully registered service on psm:%hd", psm);
+}
+
+uint16_t bluetooth::legacy::shim::L2cap::CreateConnection(
+    uint16_t psm, const RawAddress& raw_address) {
+  LOG_DEBUG(LOG_TAG, "Requesting connection to psm:%hd address:%s", psm,
+            raw_address.ToString().c_str());
+
+  if (!Classic().IsPsmRegistered(psm)) {
+    LOG_WARN(LOG_TAG, "Service must be registered in order to connect psm:%hd",
+             psm);
+    return kInvalidConnectionInterfaceDescriptor;
+  }
+
+  std::promise<uint16_t> connect_completed;
+  auto completed = connect_completed.get_future();
+  bluetooth::shim::GetL2cap()->CreateConnection(psm, raw_address.ToString(),
+                                                std::move(connect_completed));
+  uint16_t cid = completed.get();
+  if (cid == kInvalidConnectionInterfaceDescriptor) {
+    LOG_WARN(LOG_TAG,
+             "Failed to allocate resources to connect to psm:%hd address:%s",
+             psm, raw_address.ToString().c_str());
+  } else {
+    LOG_DEBUG(LOG_TAG,
+              "Successfully started connection to psm:%hd address:%s"
+              " connection_interface_descriptor:%hd",
+              psm, raw_address.ToString().c_str(), cid);
+    CHECK(cid_to_psm_map_.find(cid) == cid_to_psm_map_.end());
+    cid_to_psm_map_[cid] = psm;
+    SetCallbacks(cid, Classic().Callbacks(psm));
+    const tL2CAP_APPL_INFO* callbacks = Classic().Callbacks(psm);
+    CHECK(callbacks != nullptr);
+  }
+  return cid;
+}
+
+void bluetooth::legacy::shim::L2cap::OnConnectionReady(
+    uint16_t psm, uint16_t cid,
+    std::function<void(std::function<void(uint16_t c)>)> func) {
+  LOG_DEBUG(
+      LOG_TAG,
+      "l2cap got new connection psm:%hd connection_interface_descriptor:%hd",
+      psm, cid);
+  const tL2CAP_APPL_INFO* callbacks = Classic().Callbacks(psm);
+  if (callbacks == nullptr) {
+    return;
+  }
+  LOG_DEBUG(LOG_TAG, "%s Setting postable map for cid:%d", __func__, cid);
+  cid_to_postable_map_[cid] = func;
+  func([&cid, &callbacks](uint16_t cid2) {
+    LOG_WARN(LOG_TAG,
+             "Queuing up the connection confirm to the upper stack but really "
+             "a connection has already been done Cid:%hd Cid2:%hd",
+             cid, cid2);
+    callbacks->pL2CA_ConnectCfm_Cb(cid2, 0);
+  });
+}
+
+bool bluetooth::legacy::shim::L2cap::IsCongested(uint16_t cid) const {
+  CHECK(ConnectionExists(cid));
+  LOG_WARN(LOG_TAG, "Ignoring checks for congestion on cid:%hd", cid);
+  return false;
+}
+
+bool bluetooth::legacy::shim::L2cap::Write(uint16_t cid, BT_HDR* bt_hdr) {
+  CHECK(ConnectionExists(cid));
+  CHECK(bt_hdr != nullptr);
+  const uint8_t* data = bt_hdr->data + bt_hdr->offset;
+  size_t len = bt_hdr->len;
+  LOG_DEBUG(LOG_TAG, "Writing data cid:%hd len:%zd", cid, len);
+  return bluetooth::shim::GetL2cap()->Write(cid, data, len);
+}
+
+bool bluetooth::legacy::shim::L2cap::WriteFlushable(uint16_t cid,
+                                                    BT_HDR* bt_hdr) {
+  CHECK(ConnectionExists(cid));
+  CHECK(bt_hdr != nullptr);
+  const uint8_t* data = bt_hdr->data + bt_hdr->offset;
+  size_t len = bt_hdr->len;
+  return bluetooth::shim::GetL2cap()->WriteFlushable(cid, data, len);
+}
+
+bool bluetooth::legacy::shim::L2cap::WriteNonFlushable(uint16_t cid,
+                                                       BT_HDR* bt_hdr) {
+  CHECK(ConnectionExists(cid));
+  CHECK(bt_hdr != nullptr);
+  const uint8_t* data = bt_hdr->data + bt_hdr->offset;
+  size_t len = bt_hdr->len;
+  return bluetooth::shim::GetL2cap()->WriteNonFlushable(cid, data, len);
+}
+
+bool bluetooth::legacy::shim::L2cap::SetCallbacks(
+    uint16_t cid, const tL2CAP_APPL_INFO* callbacks) {
+  CHECK(callbacks != nullptr);
+  CHECK(ConnectionExists(cid));
+  LOG_ASSERT(cid_to_callback_map_.find(cid) == cid_to_callback_map_.end())
+      << "Already have callbacks registered for "
+         "connection_interface_descriptor:"
+      << cid;
+  cid_to_callback_map_[cid] = callbacks;
+
+  bluetooth::shim::GetL2cap()->SetReadDataReadyCallback(
+      cid, [this](uint16_t cid, std::vector<const uint8_t> data) {
+        LOG_DEBUG(LOG_TAG, "OnDataReady cid:%hd len:%zd", cid, data.size());
+        BT_HDR* bt_hdr =
+            static_cast<BT_HDR*>(osi_calloc(data.size() + kBtHdrSize));
+        std::copy(data.begin(), data.end(), bt_hdr->data);
+        bt_hdr->len = data.size();
+        cid_to_callback_map_[cid]->pL2CA_DataInd_Cb(cid, bt_hdr);
+      });
+
+  bluetooth::shim::GetL2cap()->SetConnectionClosedCallback(
+      cid, [this](uint16_t cid, int error_code) {
+        LOG_DEBUG(LOG_TAG, "OnChannel closed callback cid:%hd", cid);
+        cid_to_callback_map_[cid]->pL2CA_DisconnectInd_Cb(cid, true);
+      });
+  return true;
+}
+
+void bluetooth::legacy::shim::L2cap::ClearCallbacks(uint16_t cid) {
+  CHECK(ConnectionExists(cid));
+  cid_to_callback_map_.erase(cid);
+}
+
+bool bluetooth::legacy::shim::L2cap::ConnectResponse(
+    const RawAddress& raw_address, uint8_t signal_id, uint16_t cid,
+    uint16_t result, uint16_t status, tL2CAP_ERTM_INFO* ertm_info) {
+  CHECK(ConnectionExists(cid));
+  LOG_DEBUG(LOG_TAG,
+            "%s Silently dropping client connect response as channel is "
+            "already connected",
+            __func__);
+  return true;
+}
+
+bool bluetooth::legacy::shim::L2cap::ConfigRequest(
+    uint16_t cid, const tL2CAP_CFG_INFO* config_info) {
+  CHECK(ConnectionExists(cid));
+  LOG_INFO(LOG_TAG, "Received config request from upper layer");
+  CHECK(cid_to_psm_map_.find(cid) != cid_to_psm_map_.end());
+  const tL2CAP_APPL_INFO* callbacks = Classic().Callbacks(cid_to_psm_map_[cid]);
+  CHECK(callbacks != nullptr);
+  CHECK(cid_to_postable_map_.count(cid) == 1);
+
+  auto func = cid_to_postable_map_[cid];
+  func([&cid, &callbacks](uint16_t cid2) {
+    tL2CAP_CFG_INFO cfg_info{
+        .result = L2CAP_CFG_OK,
+        .mtu_present = false,
+        .qos_present = false,
+        .flush_to_present = false,
+        .fcr_present = false,
+        .fcs_present = false,
+        .ext_flow_spec_present = false,
+        .flags = 0,
+    };
+    LOG_INFO(LOG_TAG, "Config request lambda");
+    callbacks->pL2CA_ConfigCfm_Cb(cid, &cfg_info);
+    callbacks->pL2CA_ConfigInd_Cb(cid, &cfg_info);
+  });
+  return true;
+}
+
+bool bluetooth::legacy::shim::L2cap::ConfigResponse(
+    uint16_t cid, const tL2CAP_CFG_INFO* config_info) {
+  CHECK(ConnectionExists(cid));
+  LOG_DEBUG(
+      LOG_TAG,
+      "%s Silently dropping client config response as channel is already open",
+      __func__);
+  return true;
+}
+
+bool bluetooth::legacy::shim::L2cap::DisconnectRequest(uint16_t cid) {
+  CHECK(ConnectionExists(cid));
+  bluetooth::shim::GetL2cap()->CloseConnection(cid);
+  return true;
+}
+
+bool bluetooth::legacy::shim::L2cap::DisconnectResponse(uint16_t cid) {
+  CHECK(ConnectionExists(cid));
+  LOG_DEBUG(LOG_TAG,
+            "%s Silently dropping client disconnect response as channel is "
+            "already disconnected",
+            __func__);
+  return true;
+}
diff --git a/main/shim/l2cap.h b/main/shim/l2cap.h
new file mode 100644
index 0000000..d238a0b
--- /dev/null
+++ b/main/shim/l2cap.h
@@ -0,0 +1,115 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#pragma once
+
+#include <cstdint>
+#include <unordered_map>
+
+#include "stack/include/l2c_api.h"
+
+namespace bluetooth {
+namespace legacy {
+namespace shim {
+
+static constexpr uint16_t kInitialClassicDynamicPsm = 0x1001;
+static constexpr uint16_t kFinalClassicDynamicPsm = 0xfeff;
+static constexpr uint16_t kInitialClassicVirtualPsm = kInitialClassicDynamicPsm;
+static constexpr uint16_t kFinalClassicVirtualPsm = 0x8000;
+static constexpr uint16_t kInitialLeDynamicPsm = 0x0080;
+static constexpr uint16_t kFinalLeDynamicPsm = 0x00ff;
+
+using PsmData = struct {
+  bool IsPsmAllocated(uint16_t psm) const;
+  bool IsPsmRegistered(uint16_t psm) const;
+
+  void AllocatePsm(uint16_t psm);
+  void RegisterPsm(uint16_t psm, const tL2CAP_APPL_INFO* callbacks);
+
+  void UnregisterPsm(uint16_t psm);
+  void DeallocatePsm(uint16_t psm);
+
+  const tL2CAP_APPL_INFO* Callbacks(uint16_t psm);
+
+ private:
+  std::unordered_map<uint16_t, const tL2CAP_APPL_INFO*> psm_to_callback_map_;
+};
+
+class L2cap {
+ public:
+  void RegisterService(uint16_t psm, const tL2CAP_APPL_INFO* callbacks,
+                       bool enable_snoop);
+  uint16_t CreateConnection(uint16_t psm, const RawAddress& raw_address);
+  void OnConnectionReady(
+      uint16_t psm, uint16_t cid,
+      std::function<void(std::function<void(uint16_t cid)>)> func);
+
+  bool Write(uint16_t cid, BT_HDR* bt_hdr);
+  bool WriteFlushable(uint16_t cid, BT_HDR* bt_hdr);
+  bool WriteNonFlushable(uint16_t cid, BT_HDR* bt_hdr);
+  bool IsCongested(uint16_t cid) const;
+
+  bool SetCallbacks(uint16_t cid, const tL2CAP_APPL_INFO* callbacks);
+  void ClearCallbacks(uint16_t cid);
+
+  uint16_t GetNextDynamicClassicPsm();
+  uint16_t GetNextDynamicLePsm();
+
+  uint16_t ConvertClientToRealPsm(uint16_t psm,
+                                  bool is_outgoing_only_connection);
+  uint16_t ConvertClientToRealPsm(uint16_t psm);
+  void RemoveClientPsm(uint16_t client_psm);
+
+  // Legacy API entry points
+  bool ConnectResponse(const RawAddress& raw_address, uint8_t signal_id,
+                       uint16_t cid, uint16_t result, uint16_t status,
+                       tL2CAP_ERTM_INFO* ertm_info);
+  bool ConfigRequest(uint16_t cid, const tL2CAP_CFG_INFO* config_info);
+  bool ConfigResponse(uint16_t cid, const tL2CAP_CFG_INFO* config_info);
+  bool DisconnectRequest(uint16_t cid);
+  bool DisconnectResponse(uint16_t cid);
+
+  void Test(void* context);
+  void Test2();
+
+  L2cap();
+
+  PsmData& Classic();
+  PsmData& Le();
+
+ private:
+  uint16_t GetNextVirtualPsm(uint16_t real_psm);
+
+  PsmData classic_;
+  PsmData le_;
+
+  bool ConnectionExists(uint16_t cid) const;
+
+  uint16_t classic_dynamic_psm_;
+  uint16_t le_dynamic_psm_;
+  uint16_t classic_virtual_psm_;
+
+  std::unordered_map<uint16_t,
+                     std::function<void(std::function<void(uint16_t c)>)>>
+      cid_to_postable_map_;
+  std::unordered_map<uint16_t, uint16_t> cid_to_psm_map_;
+  std::unordered_map<uint16_t, uint16_t> client_psm_to_real_psm_map_;
+  std::unordered_map<uint16_t, const tL2CAP_APPL_INFO*> cid_to_callback_map_;
+};
+
+}  // namespace shim
+}  // namespace legacy
+}  // namespace bluetooth
diff --git a/main/shim/l2cap_test.cc b/main/shim/l2cap_test.cc
new file mode 100644
index 0000000..c0f9a7b
--- /dev/null
+++ b/main/shim/l2cap_test.cc
@@ -0,0 +1,254 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <gtest/gtest.h>
+#include <cstdint>
+
+#define LOG_TAG "bt_shim_test"
+
+#include "osi/include/log.h"
+#include "shim/l2cap.h"
+#include "shim/test_stack.h"
+#include "types/raw_address.h"
+
+TestStack test_stack_;
+
+bluetooth::shim::IStack* bluetooth::shim::GetGabeldorscheStack() {
+  return (bluetooth::shim::IStack*)&test_stack_;
+}
+
+namespace bluetooth {
+namespace legacy {
+
+namespace {
+
+constexpr uint16_t kPsm = 123;
+constexpr uint16_t kCid = 987;
+constexpr size_t kDataBufferSize = 1024;
+
+uint8_t bt_hdr_data[] = {
+    0x00, 0x00,                                     /* event */
+    0x08, 0x00,                                     /* len */
+    0x00, 0x00,                                     /* offset */
+    0x00, 0x00,                                     /* layer specific */
+    0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77, 0x88, /* data */
+    0xff, 0xee, 0xdd, 0xcc, 0xbb, 0xaa, 0x99, 0x88, /* data */
+};
+
+class L2capTest;
+L2capTest* l2cap_test_ = nullptr;
+
+class L2capTest : public ::testing::Test {
+ public:
+  static shim::L2cap* l2cap_;
+
+  struct {
+    int L2caConnectCfmCb;
+    int L2caConnectPndCb;
+    int L2caConfigIndCb;
+    int L2caConfigCfmCb;
+    int L2caDisconnectIndCb;
+    int L2caDisconnectCfmCb;
+    int L2caQosViolationIndCb;
+    int L2caDataIndCb;
+    int L2caCongestionStatusCb;
+    int L2caTxCompleteCb;
+    int L2caCreditsReceivedCb;
+  } cnt_{
+      .L2caConnectCfmCb = 0,
+      .L2caConnectPndCb = 0,
+      .L2caConfigIndCb = 0,
+      .L2caConfigCfmCb = 0,
+      .L2caDisconnectIndCb = 0,
+      .L2caDisconnectCfmCb = 0,
+      .L2caQosViolationIndCb = 0,
+      .L2caDataIndCb = 0,
+      .L2caCongestionStatusCb = 0,
+      .L2caTxCompleteCb = 0,
+      .L2caCreditsReceivedCb = 0,
+  };
+
+ protected:
+  void SetUp() override {
+    l2cap_ = new shim::L2cap();
+    l2cap_test_ = this;
+  }
+
+  void TearDown() override {
+    delete l2cap_;
+    l2cap_ = nullptr;
+  }
+
+  uint8_t data_buffer_[kDataBufferSize];
+};
+
+shim::L2cap* L2capTest::l2cap_ = nullptr;
+// Indication of remotely initiated connection response sent
+void L2caConnectIndCb(const RawAddress& raw_address, uint16_t a, uint16_t b,
+                      uint8_t c) {
+  LOG_INFO(LOG_TAG, "%s", __func__);
+}
+
+// Confirms locally initiated connection request completed
+void L2caConnectCfmCb(uint16_t cid, uint16_t result) {
+  l2cap_test_->cnt_.L2caConnectCfmCb++;
+  LOG_INFO(LOG_TAG, "%s cid:%hd result:%hd", __func__, cid, result);
+}
+
+void L2caConnectPndCb(uint16_t cid) {
+  l2cap_test_->cnt_.L2caConnectPndCb++;
+  LOG_INFO(LOG_TAG, "%s", __func__);
+}
+
+// Indication of remotely initiated configuration response sent
+void L2caConfigIndCb(uint16_t cid, tL2CAP_CFG_INFO* callbacks) {
+  l2cap_test_->cnt_.L2caConfigIndCb++;
+  LOG_INFO(LOG_TAG, "%s", __func__);
+}
+
+// Confirms locally initiated config request completed
+void L2caConfigCfmCb(uint16_t cid, tL2CAP_CFG_INFO* callbacks) {
+  l2cap_test_->cnt_.L2caConfigCfmCb++;
+  LOG_INFO(LOG_TAG, "%s", __func__);
+}
+
+// Indication of remotely initiated disconnection response sent
+void L2caDisconnectIndCb(uint16_t cid, bool needs_ack) {
+  l2cap_test_->cnt_.L2caDisconnectIndCb++;
+  LOG_INFO(LOG_TAG, "%s", __func__);
+}
+
+// Confirms locally initiated disconnect request completed
+void L2caDisconnectCfmCb(uint16_t cid, uint16_t result) {
+  l2cap_test_->cnt_.L2caDisconnectCfmCb++;
+  LOG_INFO(LOG_TAG, "%s", __func__);
+}
+
+void L2caQosViolationIndCb(const RawAddress& raw_address) {
+  l2cap_test_->cnt_.L2caQosViolationIndCb++;
+  LOG_INFO(LOG_TAG, "%s", __func__);
+}
+
+void L2caDataIndCb(uint16_t cid, BT_HDR* bt_hdr) {
+  l2cap_test_->cnt_.L2caDataIndCb++;
+  LOG_INFO(LOG_TAG, "%s", __func__);
+}
+
+void L2caCongestionStatusCb(uint16_t cid, bool is_congested) {
+  l2cap_test_->cnt_.L2caCongestionStatusCb++;
+  LOG_INFO(LOG_TAG, "%s", __func__);
+}
+
+void L2caTxCompleteCb(uint16_t cid, uint16_t sdu_cnt) {
+  l2cap_test_->cnt_.L2caTxCompleteCb++;
+  LOG_INFO(LOG_TAG, "%s", __func__);
+}
+
+void L2caCreditsReceivedCb(uint16_t cid, uint16_t credits_received,
+                           uint16_t credit_count) {
+  l2cap_test_->cnt_.L2caCreditsReceivedCb++;
+  LOG_INFO(LOG_TAG, "%s", __func__);
+}
+
+tL2CAP_APPL_INFO test_callbacks{
+    .pL2CA_ConnectInd_Cb = L2caConnectIndCb,
+    .pL2CA_ConnectCfm_Cb = L2caConnectCfmCb,
+    .pL2CA_ConnectPnd_Cb = L2caConnectPndCb,
+    .pL2CA_ConfigInd_Cb = L2caConfigIndCb,
+    .pL2CA_ConfigCfm_Cb = L2caConfigCfmCb,
+    .pL2CA_DisconnectInd_Cb = L2caDisconnectIndCb,
+    .pL2CA_DisconnectCfm_Cb = L2caDisconnectCfmCb,
+    .pL2CA_QoSViolationInd_Cb = L2caQosViolationIndCb,
+    .pL2CA_DataInd_Cb = L2caDataIndCb,
+    .pL2CA_CongestionStatus_Cb = L2caCongestionStatusCb,
+    .pL2CA_TxComplete_Cb = L2caTxCompleteCb,
+    .pL2CA_CreditsReceived_Cb = L2caCreditsReceivedCb,
+};
+
+TEST_F(L2capTest, Base) { LOG_INFO(LOG_TAG, "Got test %p", &test_callbacks); }
+
+TEST_F(L2capTest, Callbacks) {
+  bool rc = l2cap_->SetCallbacks(kPsm, &test_callbacks);
+  CHECK(rc == true);
+}
+
+TEST_F(L2capTest, RegisterService) {
+  l2cap_->RegisterService(123, &test_callbacks, false);
+}
+
+TEST_F(L2capTest, CreateConnection_NotRegistered) {
+  RawAddress raw_address;
+  std::string string_address("11:22:33:44:55:66");
+  RawAddress::FromString(string_address, raw_address);
+  uint16_t cid = l2cap_->CreateConnection(123, raw_address);
+  CHECK(cid == 0);
+}
+
+TEST_F(L2capTest, CreateConnection_Registered) {
+  test_stack_.test_l2cap_.cid_ = kCid;
+  l2cap_->RegisterService(123, &test_callbacks, false);
+
+  RawAddress raw_address;
+  std::string string_address("11:22:33:44:55:66");
+  RawAddress::FromString(string_address, raw_address);
+  uint16_t cid = l2cap_->CreateConnection(123, raw_address);
+  CHECK(cid != 0);
+}
+
+TEST_F(L2capTest, CreateConnection_WithHandshake) {
+  test_stack_.test_l2cap_.cid_ = kCid;
+  l2cap_->RegisterService(kPsm, &test_callbacks, false);
+
+  RawAddress raw_address;
+  std::string string_address("11:22:33:44:55:66");
+  RawAddress::FromString(string_address, raw_address);
+  uint16_t cid = l2cap_->CreateConnection(kPsm, raw_address);
+  CHECK(cid != 0);
+
+  {
+    // Simulate a successful connection response
+    l2cap_->OnConnectionReady(kPsm, kCid,
+                              [&cid](std::function<void(uint16_t)> func) {
+                                LOG_INFO(LOG_TAG, "In closure cid:%d", cid);
+                                func(cid);
+                              });
+  }
+  CHECK(cnt_.L2caConnectCfmCb == 1);
+
+  CHECK(l2cap_->ConfigRequest(cid, nullptr) == true);
+  CHECK(cnt_.L2caConfigCfmCb == 1);
+
+  BT_HDR* bt_hdr = (BT_HDR*)bt_hdr_data;
+
+  test_stack_.test_l2cap_.data_buffer_ = data_buffer_;
+  test_stack_.test_l2cap_.data_buffer_size_ = kDataBufferSize;
+
+  l2cap_->Write(cid, bt_hdr);
+
+  CHECK(data_buffer_[0] == 0x11);
+  CHECK(data_buffer_[1] == 0x22);
+  CHECK(data_buffer_[2] == 0x33);
+  CHECK(data_buffer_[3] == 0x44);
+  CHECK(data_buffer_[4] == 0x55);
+  CHECK(data_buffer_[5] == 0x66);
+  CHECK(data_buffer_[6] == 0x77);
+  CHECK(data_buffer_[7] == 0x88);
+  CHECK(data_buffer_[8] == 0x00);
+}
+
+}  // namespace
+}  // namespace legacy
+}  // namespace bluetooth
diff --git a/main/shim/shim.cc b/main/shim/shim.cc
new file mode 100644
index 0000000..9af17d6
--- /dev/null
+++ b/main/shim/shim.cc
@@ -0,0 +1,42 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <cstdint>
+
+#include "main/shim/entry.h"
+#include "main/shim/shim.h"
+#include "osi/include/properties.h"
+
+static const char* kPropertyKey = "bluetooth.gd.enabled";
+
+static bool gd_shim_enabled_ = false;
+static bool gd_shim_property_checked_ = false;
+
+EXPORT_SYMBOL extern const module_t gd_shim_module = {
+    .name = GD_SHIM_MODULE,
+    .init = nullptr,
+    .start_up = bluetooth::shim::StartGabeldorscheStack,
+    .shut_down = bluetooth::shim::StopGabeldorscheStack,
+    .clean_up = NULL,
+    .dependencies = {NULL}};
+
+bool bluetooth::shim::is_gd_shim_enabled() {
+  if (!gd_shim_property_checked_) {
+    gd_shim_property_checked_ = true;
+    gd_shim_enabled_ = (osi_property_get_int32(kPropertyKey, 0) == 1);
+  }
+  return gd_shim_enabled_;
+}
diff --git a/main/shim/shim.h b/main/shim/shim.h
new file mode 100644
index 0000000..38fb208
--- /dev/null
+++ b/main/shim/shim.h
@@ -0,0 +1,33 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#pragma once
+
+/**
+ * Gabeldorsche related legacy-only-stack-side expansion and support code.
+ */
+#include "btcore/include/module.h"
+#include "main/shim/entry.h"
+
+static const char GD_SHIM_MODULE[] = "gd_shim_module";
+
+namespace bluetooth {
+namespace shim {
+
+bool is_gd_shim_enabled();
+
+}  // namespace shim
+}  // namespace bluetooth
diff --git a/main/shim/test_stack.cc b/main/shim/test_stack.cc
new file mode 100644
index 0000000..7769fa0
--- /dev/null
+++ b/main/shim/test_stack.cc
@@ -0,0 +1,91 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+#include <cstdint>
+#include <future>
+
+#include "gd/shim/only_include_this_file_into_legacy_stack___ever.h"
+#include "main/shim/entry.h"
+#include "main/shim/test_stack.h"
+#include "osi/include/log.h"
+
+#define ASSERT(condition)                                    \
+  do {                                                       \
+    if (!(condition)) {                                      \
+      LOG_ALWAYS_FATAL("assertion '" #condition "' failed"); \
+    }                                                        \
+  } while (false)
+
+void TestGdShimL2cap::RegisterService(
+    uint16_t psm, bluetooth::shim::ConnectionOpenCallback on_open,
+    std::promise<void> completed) {
+  completed.set_value();
+}
+
+void TestGdShimL2cap::UnregisterService(uint16_t psm) {}
+
+void TestGdShimL2cap::CreateConnection(uint16_t psm, const std::string address,
+                                       std::promise<uint16_t> completed) {
+  completed.set_value(cid_);
+}
+
+void TestGdShimL2cap::CloseConnection(uint16_t cid) {}
+
+void TestGdShimL2cap::SetReadDataReadyCallback(
+    uint16_t cid, bluetooth::shim::ReadDataReadyCallback on_data_ready) {}
+
+void TestGdShimL2cap::SetConnectionClosedCallback(
+    uint16_t cid, bluetooth::shim::ConnectionClosedCallback on_closed) {}
+
+bool TestGdShimL2cap::Write(uint16_t cid, const uint8_t* data, size_t len) {
+  ASSERT(data_buffer_ != nullptr);
+  ASSERT(data_buffer_size_ > len);
+  memcpy(data_buffer_, data, len);
+  return write_success_;
+}
+
+bool TestGdShimL2cap::WriteFlushable(uint16_t cid, const uint8_t* data,
+                                     size_t len) {
+  return write_success_;
+}
+
+bool TestGdShimL2cap::WriteNonFlushable(uint16_t cid, const uint8_t* data,
+                                        size_t len) {
+  return write_success_;
+}
+
+bool TestGdShimL2cap::IsCongested(uint16_t cid) { return is_congested_; }
+
+void TestStack::Start() {}
+
+void TestStack::Stop() {}
+
+bluetooth::shim::IController* TestStack::GetController() { return nullptr; }
+
+bluetooth::shim::IConnectability* TestStack::GetConnectability() {
+  return nullptr;
+}
+
+bluetooth::shim::IDiscoverability* TestStack::GetDiscoverability() {
+  return nullptr;
+}
+
+bluetooth::shim::IHciLayer* TestStack::GetHciLayer() { return nullptr; }
+
+bluetooth::shim::IInquiry* TestStack::GetInquiry() { return nullptr; }
+
+bluetooth::shim::IL2cap* TestStack::GetL2cap() { return &test_l2cap_; }
+
+bluetooth::shim::IPage* TestStack::GetPage() { return nullptr; }
diff --git a/main/shim/test_stack.h b/main/shim/test_stack.h
new file mode 100644
index 0000000..9f90199
--- /dev/null
+++ b/main/shim/test_stack.h
@@ -0,0 +1,66 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+#include <cstdint>
+#include <future>
+
+#include "gd/shim/only_include_this_file_into_legacy_stack___ever.h"
+#include "main/shim/entry.h"
+
+class TestGdShimL2cap : public bluetooth::shim::IL2cap {
+ public:
+  uint16_t cid_{0};
+  bool write_success_{false};
+  bool is_congested_{false};
+  uint8_t* data_buffer_{nullptr};
+  size_t data_buffer_size_{0};
+
+  void RegisterService(uint16_t psm,
+                       bluetooth::shim::ConnectionOpenCallback on_open,
+                       std::promise<void> completed) override;
+  void UnregisterService(uint16_t psm);
+  void CreateConnection(uint16_t psm, const std::string address,
+                        std::promise<uint16_t> completed) override;
+  void CloseConnection(uint16_t cid);
+  void SetReadDataReadyCallback(
+      uint16_t cid,
+      bluetooth::shim::ReadDataReadyCallback on_data_ready) override;
+  void SetConnectionClosedCallback(
+      uint16_t cid,
+      bluetooth::shim::ConnectionClosedCallback on_closed) override;
+  bool Write(uint16_t cid, const uint8_t* data, size_t len) override;
+  bool WriteFlushable(uint16_t cid, const uint8_t* data, size_t len) override;
+  bool WriteNonFlushable(uint16_t cid, const uint8_t* data,
+                         size_t len) override;
+  bool IsCongested(uint16_t cid) override;
+};
+
+class TestStack : public bluetooth::shim::IStack {
+ public:
+  TestStack() = default;
+
+  bluetooth::shim::IController* GetController();
+  bluetooth::shim::IConnectability* GetConnectability();
+  bluetooth::shim::IDiscoverability* GetDiscoverability();
+  bluetooth::shim::IHciLayer* GetHciLayer();
+  bluetooth::shim::IInquiry* GetInquiry();
+  bluetooth::shim::IL2cap* GetL2cap();
+  bluetooth::shim::IPage* GetPage();
+
+  TestGdShimL2cap test_l2cap_;
+
+  void Start();
+  void Stop();
+};
diff --git a/osi/include/config.h b/osi/include/config.h
index 55adecb..47c3a3e 100644
--- a/osi/include/config.h
+++ b/osi/include/config.h
@@ -49,6 +49,9 @@
 // file on the filesystem.
 std::unique_ptr<config_t> config_new(const char* filename);
 
+// Read the checksum from the |filename|
+std::string checksum_read(const char* filename);
+
 // Clones |src|, including all of it's sections, keys, and values.
 // Returns a new config which is a copy and separated from the original;
 // changes to the new config are not reflected in any way in the original.
@@ -133,3 +136,8 @@
 // |config_save|, all comments and special formatting in the original file will
 // be lost. Neither |config| nor |filename| may be NULL.
 bool config_save(const config_t& config, const std::string& filename);
+
+// Saves the encrypted |checksum| of config file to a given |filename| Note
+// that this could be a destructive operation: if |filename| already exists,
+// it will be overwritten.
+bool checksum_save(const std::string& checksum, const std::string& filename);
diff --git a/osi/src/alarm.cc b/osi/src/alarm.cc
index ea075db..bc1eee5 100644
--- a/osi/src/alarm.cc
+++ b/osi/src/alarm.cc
@@ -91,7 +91,7 @@
   // potentially long-running callback is executing. |alarm_cancel| uses this
   // mutex to provide a guarantee to its caller that the callback will not be
   // in progress when it returns.
-  std::recursive_mutex* callback_mutex;
+  std::shared_ptr<std::recursive_mutex> callback_mutex;
   uint64_t creation_time_ms;
   uint64_t period_ms;
   uint64_t deadline_ms;
@@ -174,7 +174,8 @@
 
   alarm_t* ret = static_cast<alarm_t*>(osi_calloc(sizeof(alarm_t)));
 
-  ret->callback_mutex = new std::recursive_mutex;
+  std::shared_ptr<std::recursive_mutex> ptr(new std::recursive_mutex());
+  ret->callback_mutex = ptr;
   ret->is_periodic = is_periodic;
   ret->stats.name = osi_strdup(name);
 
@@ -191,7 +192,7 @@
   if (!alarm) return;
 
   alarm_cancel(alarm);
-  delete alarm->callback_mutex;
+
   osi_free((void*)alarm->stats.name);
   alarm->closure.~CancelableClosureInStruct();
   osi_free(alarm);
@@ -245,13 +246,15 @@
   CHECK(alarms != NULL);
   if (!alarm) return;
 
+  std::shared_ptr<std::recursive_mutex> local_mutex_ref;
   {
     std::lock_guard<std::mutex> lock(alarms_mutex);
+    local_mutex_ref = alarm->callback_mutex;
     alarm_cancel_internal(alarm);
   }
 
   // If the callback for |alarm| is in progress, wait here until it completes.
-  std::lock_guard<std::recursive_mutex> lock(*alarm->callback_mutex);
+  std::lock_guard<std::recursive_mutex> lock(*local_mutex_ref);
 }
 
 // Internal implementation of canceling an alarm.
@@ -583,7 +586,10 @@
     alarm->queue = NULL;
   }
 
-  std::lock_guard<std::recursive_mutex> cb_lock(*alarm->callback_mutex);
+  // Increment the reference count of the mutex so it doesn't get freed
+  // before the callback gets finished executing.
+  std::shared_ptr<std::recursive_mutex> local_mutex_ref = alarm->callback_mutex;
+  std::lock_guard<std::recursive_mutex> cb_lock(*local_mutex_ref);
   lock.unlock();
 
   // Update the statistics
diff --git a/osi/src/config.cc b/osi/src/config.cc
index e937959..de7e6e6 100644
--- a/osi/src/config.cc
+++ b/osi/src/config.cc
@@ -18,7 +18,7 @@
 
 #include "osi/include/config.h"
 
-#include <base/files/file_path.h>
+#include <base/files/file_util.h>
 #include <base/logging.h>
 #include <ctype.h>
 #include <errno.h>
@@ -84,6 +84,19 @@
   return config;
 }
 
+std::string checksum_read(const char* filename) {
+  base::FilePath path(filename);
+  if (!base::PathExists(path)) {
+    LOG(ERROR) << __func__ << ": unable to locate file '" << filename << "'";
+    return "";
+  }
+  std::string encrypted_hash;
+  if (!base::ReadFileToString(path, &encrypted_hash)) {
+    LOG(ERROR) << __func__ << ": unable to read file '" << filename << "'";
+  }
+  return encrypted_hash;
+}
+
 std::unique_ptr<config_t> config_new_clone(const config_t& src) {
   std::unique_ptr<config_t> ret = config_new_empty();
 
@@ -332,6 +345,107 @@
   return false;
 }
 
+bool checksum_save(const std::string& checksum, const std::string& filename) {
+  CHECK(!checksum.empty()) << __func__ << ": checksum cannot be empty";
+  CHECK(!filename.empty()) << __func__ << ": filename cannot be empty";
+
+  // Steps to ensure content of config checksum file gets to disk:
+  //
+  // 1) Open and write to temp file (e.g.
+  // bt_config.conf.encrypted-checksum.new). 2) Sync the temp file to disk with
+  // fsync(). 3) Rename temp file to actual config checksum file (e.g.
+  // bt_config.conf.encrypted-checksum).
+  //    This ensures atomic update.
+  // 4) Sync directory that has the conf file with fsync().
+  //    This ensures directory entries are up-to-date.
+  FILE* fp = nullptr;
+  int dir_fd = -1;
+
+  // Build temp config checksum file based on config checksum file (e.g.
+  // bt_config.conf.encrypted-checksum.new).
+  const std::string temp_filename = filename + ".new";
+  base::FilePath path(temp_filename);
+
+  // Extract directory from file path (e.g. /data/misc/bluedroid).
+  const std::string directoryname = base::FilePath(filename).DirName().value();
+  if (directoryname.empty()) {
+    LOG(ERROR) << __func__ << ": error extracting directory from '" << filename
+               << "': " << strerror(errno);
+    goto error2;
+  }
+
+  dir_fd = open(directoryname.c_str(), O_RDONLY);
+  if (dir_fd < 0) {
+    LOG(ERROR) << __func__ << ": unable to open dir '" << directoryname
+               << "': " << strerror(errno);
+    goto error2;
+  }
+
+  if (base::WriteFile(path, checksum.data(), checksum.size()) !=
+      (int)checksum.size()) {
+    LOG(ERROR) << __func__ << ": unable to write file '" << filename.c_str();
+    goto error2;
+  }
+
+  fp = fopen(temp_filename.c_str(), "rb");
+  if (!fp) {
+    LOG(ERROR) << __func__ << ": unable to write to file '" << temp_filename
+               << "': " << strerror(errno);
+    goto error2;
+  }
+
+  // Sync written temp file out to disk. fsync() is blocking until data makes it
+  // to disk.
+  if (fsync(fileno(fp)) < 0) {
+    LOG(WARNING) << __func__ << ": unable to fsync file '" << temp_filename
+                 << "': " << strerror(errno);
+  }
+
+  if (fclose(fp) == EOF) {
+    LOG(ERROR) << __func__ << ": unable to close file '" << temp_filename
+               << "': " << strerror(errno);
+    goto error2;
+  }
+  fp = nullptr;
+
+  // Change the file's permissions to Read/Write by User and Group
+  if (chmod(temp_filename.c_str(), S_IRUSR | S_IWUSR | S_IRGRP | S_IWGRP) ==
+      -1) {
+    LOG(ERROR) << __func__ << ": unable to change file permissions '"
+               << filename << "': " << strerror(errno);
+    goto error2;
+  }
+
+  // Rename written temp file to the actual config file.
+  if (rename(temp_filename.c_str(), filename.c_str()) == -1) {
+    LOG(ERROR) << __func__ << ": unable to commit file '" << filename
+               << "': " << strerror(errno);
+    goto error2;
+  }
+
+  // This should ensure the directory is updated as well.
+  if (fsync(dir_fd) < 0) {
+    LOG(WARNING) << __func__ << ": unable to fsync dir '" << directoryname
+                 << "': " << strerror(errno);
+  }
+
+  if (close(dir_fd) < 0) {
+    LOG(ERROR) << __func__ << ": unable to close dir '" << directoryname
+               << "': " << strerror(errno);
+    goto error2;
+  }
+
+  return true;
+
+error2:
+  // This indicates there is a write issue.  Unlink as partial data is not
+  // acceptable.
+  unlink(temp_filename.c_str());
+  if (fp) fclose(fp);
+  if (dir_fd != -1) close(dir_fd);
+  return false;
+}
+
 static char* trim(char* str) {
   while (isspace(*str)) ++str;
 
diff --git a/osi/test/alarm_test.cc b/osi/test/alarm_test.cc
index dbd63a0..fb55dc7 100644
--- a/osi/test/alarm_test.cc
+++ b/osi/test/alarm_test.cc
@@ -344,3 +344,17 @@
   }
   alarm_cleanup();
 }
+
+static void remove_cb(void* data) {
+  alarm_free((alarm_t*)data);
+  semaphore_post(semaphore);
+}
+
+TEST_F(AlarmTest, test_delete_during_callback) {
+  for (int i = 0; i < 1000; ++i) {
+    alarm_t* alarm = alarm_new("alarm_test.test_delete_during_callback");
+    alarm_set(alarm, 0, remove_cb, alarm);
+    semaphore_wait(semaphore);
+  }
+  alarm_cleanup();
+}
diff --git a/osi/test/config_test.cc b/osi/test/config_test.cc
index 7c689c9..32858fd 100644
--- a/osi/test/config_test.cc
+++ b/osi/test/config_test.cc
@@ -1,3 +1,4 @@
+#include <base/files/file_util.h>
 #include <gtest/gtest.h>
 
 #include "AllocationTestHarness.h"
@@ -173,3 +174,24 @@
   std::unique_ptr<config_t> config = config_new(CONFIG_FILE);
   EXPECT_TRUE(config_save(*config, CONFIG_FILE));
 }
+
+TEST_F(ConfigTest, checksum_read) {
+  std::string filename = "/data/misc/bluedroid/test.checksum";
+  std::string checksum = "0x1234";
+  base::FilePath file_path(filename);
+
+  EXPECT_EQ(base::WriteFile(file_path, checksum.data(), checksum.size()),
+            (int)checksum.size());
+
+  EXPECT_EQ(checksum_read(filename.c_str()), checksum.c_str());
+}
+
+TEST_F(ConfigTest, checksum_save) {
+  std::string filename = "/data/misc/bluedroid/test.checksum";
+  std::string checksum = "0x1234";
+  base::FilePath file_path(filename);
+
+  EXPECT_TRUE(checksum_save(checksum, filename));
+
+  EXPECT_TRUE(base::PathExists(file_path));
+}
diff --git a/packet/avrcp/general_reject_packet.cc b/packet/avrcp/general_reject_packet.cc
index cde0031..db3d31a 100644
--- a/packet/avrcp/general_reject_packet.cc
+++ b/packet/avrcp/general_reject_packet.cc
@@ -19,11 +19,9 @@
 namespace bluetooth {
 namespace avrcp {
 
-std::unique_ptr<GeneralRejectBuilder> GeneralRejectBuilder::MakeBuilder(
-    BrowsePdu pdu, Status reason) {
+std::unique_ptr<GeneralRejectBuilder> GeneralRejectBuilder::MakeBuilder(Status reason) {
   std::unique_ptr<GeneralRejectBuilder> builder =
-      std::unique_ptr<GeneralRejectBuilder>(
-          new GeneralRejectBuilder(pdu, reason));
+      std::unique_ptr<GeneralRejectBuilder>(new GeneralRejectBuilder(reason));
 
   return builder;
 }
diff --git a/packet/avrcp/general_reject_packet.h b/packet/avrcp/general_reject_packet.h
index 4058fd4..b3fb2fe 100644
--- a/packet/avrcp/general_reject_packet.h
+++ b/packet/avrcp/general_reject_packet.h
@@ -25,8 +25,7 @@
  public:
   virtual ~GeneralRejectBuilder() = default;
 
-  static std::unique_ptr<GeneralRejectBuilder> MakeBuilder(BrowsePdu pdu,
-                                                           Status reason);
+  static std::unique_ptr<GeneralRejectBuilder> MakeBuilder(Status reason);
 
   virtual size_t size() const override;
   virtual bool Serialize(
@@ -35,8 +34,7 @@
  protected:
   Status reason_;
 
-  GeneralRejectBuilder(BrowsePdu pdu, Status reason)
-      : BrowsePacketBuilder(pdu), reason_(reason){};
+  GeneralRejectBuilder(Status reason) : BrowsePacketBuilder(BrowsePdu::GENERAL_REJECT), reason_(reason){};
 };
 
 }  // namespace avrcp
diff --git a/packet/avrcp/register_notification_packet.cc b/packet/avrcp/register_notification_packet.cc
index adb5e59..6bbd16a 100644
--- a/packet/avrcp/register_notification_packet.cc
+++ b/packet/avrcp/register_notification_packet.cc
@@ -39,8 +39,9 @@
 bool RegisterNotificationResponse::IsValid() const {
   if (!VendorPacket::IsValid()) return false;
   if (size() < kMinSize()) return false;
-  if (GetCType() != CType::INTERIM && GetCType() != CType::CHANGED)
+  if (GetCType() != CType::INTERIM && GetCType() != CType::CHANGED && GetCType() != CType::REJECTED) {
     return false;
+  }
 
   switch (GetEvent()) {
     case Event::VOLUME_CHANGED:
diff --git a/packet/tests/avrcp/avrcp_test_packets.h b/packet/tests/avrcp/avrcp_test_packets.h
index 13994d0..14e30e7 100644
--- a/packet/tests/avrcp/avrcp_test_packets.h
+++ b/packet/tests/avrcp/avrcp_test_packets.h
@@ -106,8 +106,8 @@
     0x00, 0x05, 0x0d, 0x00, 0x00, 0x00, 0x00};
 
 // AVRCP Register Notification without any parameter
-std::vector<uint8_t> register_notification_invalid = {
-    0x03, 0x48, 0x00, 0x00, 0x19, 0x58, 0x31, 0x00, 0x00, 0x05};
+std::vector<uint8_t> register_notification_invalid = {0x03, 0x48, 0x00, 0x00, 0x19, 0x58, 0x31,
+                                                      0x00, 0x00, 0x04, 0x00, 0x00, 0x00, 0x00};
 
 // AVRCP Interim Playback Status Notification
 std::vector<uint8_t> interim_play_status_notification = {
@@ -208,9 +208,8 @@
 //    start_item = 0x00
 //    end_item = 0x05
 //    attributes_requested: All Items
-std::vector<uint8_t> get_folder_items_request_now_playing = {
-    0x71, 0x00, 0x0e, 0x03, 0x00, 0x00, 0x00,
-    0x00, 0x00, 0x00, 0x00, 0x05, 0x00};
+std::vector<uint8_t> get_folder_items_request_now_playing = {0x71, 0x00, 0x0a, 0x03, 0x00, 0x00, 0x00,
+                                                             0x00, 0x00, 0x00, 0x00, 0x05, 0x00};
 
 // AVRCP Browse Get Folder Items Response packet with range out of bounds error
 std::vector<uint8_t> get_folder_items_error_response = {0x71, 0x00, 0x01, 0x0b};
@@ -356,4 +355,36 @@
 std::vector<uint8_t> set_absolute_volume_response = {
     0x09, 0x48, 0x00, 0x00, 0x19, 0x58, 0x50, 0x00, 0x00, 0x01, 0x43};
 
+// Invalid Packets
+// Short Vendor Packet
+std::vector<uint8_t> short_vendor_packet = {0x01, 0x48, 0x00, 0x00, 0x19, 0x58, 0x10, 0x00, 0x00, 0x01};
+
+// Short Get Capabilities Request Packet
+std::vector<uint8_t> short_get_capabilities_request = {0x01, 0x48, 0x00, 0x00, 0x19, 0x58, 0x10, 0x00, 0x00, 0x00};
+
+// Short Get Element Attributes Request Packet
+std::vector<uint8_t> short_get_element_attributes_request = {0x01, 0x48, 0x00, 0x00, 0x19,
+                                                             0x58, 0x20, 0x00, 0x00, 0x00};
+
+// Short Play Item Request Packet
+std::vector<uint8_t> short_play_item_request = {0x00, 0x48, 0x00, 0x00, 0x19, 0x58, 0x74, 0x00, 0x00, 0x00};
+
+// Short Set Addressed Player Request Packet
+std::vector<uint8_t> short_set_addressed_player_request = {0x00, 0x48, 0x00, 0x00, 0x19, 0x58, 0x60, 0x00, 0x00, 0x00};
+
+// Short Browse Packet
+std::vector<uint8_t> short_browse_packet = {0x71, 0x00, 0x0a};
+
+// Short Get Folder Items Request Packet
+std::vector<uint8_t> short_get_folder_items_request = {0x71, 0x00, 0x00};
+
+// Short Get Total Number of Items Request Packet
+std::vector<uint8_t> short_get_total_number_of_items_request = {0x75, 0x00, 0x00};
+
+// Short Change Path Request Packet
+std::vector<uint8_t> short_change_path_request = {0x72, 0x00, 0x00};
+
+// Short Get Item Attributes Request Packet
+std::vector<uint8_t> short_get_item_attributes_request = {0x73, 0x00, 0x00};
+
 }  // namespace
diff --git a/packet/tests/avrcp/general_reject_packet_test.cc b/packet/tests/avrcp/general_reject_packet_test.cc
index e27d0b7..4d73dba 100644
--- a/packet/tests/avrcp/general_reject_packet_test.cc
+++ b/packet/tests/avrcp/general_reject_packet_test.cc
@@ -26,8 +26,7 @@
 using TestGeneralRejectPacket = TestPacketType<BrowsePacket>;
 
 TEST(GeneralRejectPacketBuilderTest, buildPacketTest) {
-  auto builder = GeneralRejectBuilder::MakeBuilder(BrowsePdu::GENERAL_REJECT,
-                                                   Status::INVALID_COMMAND);
+  auto builder = GeneralRejectBuilder::MakeBuilder(Status::INVALID_COMMAND);
 
   ASSERT_EQ(builder->size(), general_reject_invalid_command_packet.size());
 
diff --git a/profile/avrcp/Android.bp b/profile/avrcp/Android.bp
index d73a5fb..515f513 100644
--- a/profile/avrcp/Android.bp
+++ b/profile/avrcp/Android.bp
@@ -62,3 +62,35 @@
 
     cflags: ["-DBUILDCFG"],
 }
+
+cc_fuzz {
+    name: "avrcp_device_fuzz",
+    host_supported: true,
+    defaults: [
+        "fluoride_defaults_fuzzable",
+    ],
+    srcs: [
+        "tests/avrcp_device_fuzz/avrcp_device_fuzz.cc",
+    ],
+    include_dirs: [
+        "system/bt",
+        "system/bt/packet/tests",
+        "system/bt/btcore/include",
+        "system/bt/internal_include",
+        "system/bt/stack/include",
+    ],
+    static_libs: [
+        "avrcp-target-service",
+        "lib-bt-packets",
+        "libbase",
+        "libchrome",
+        "libcutils",
+        "libevent",
+        "liblog",
+        "libstatslog",
+    ],
+    header_libs: ["libbluetooth_headers"],
+    corpus: [
+        "tests/avrcp_device_fuzz/corpus/*",
+    ],
+}
diff --git a/profile/avrcp/connection_handler.cc b/profile/avrcp/connection_handler.cc
index 9d19098..7b2765a 100644
--- a/profile/avrcp/connection_handler.cc
+++ b/profile/avrcp/connection_handler.cc
@@ -138,9 +138,7 @@
 bool ConnectionHandler::DisconnectDevice(const RawAddress& bdaddr) {
   for (auto it = device_map_.begin(); it != device_map_.end(); it++) {
     if (bdaddr == it->second->GetAddress()) {
-      it->second->DeviceDisconnected();
       uint8_t handle = it->first;
-      device_map_.erase(handle);
       return avrc_->Close(handle) == AVRC_SUCCESS;
     }
   }
diff --git a/profile/avrcp/device.cc b/profile/avrcp/device.cc
index cf94cfc..4ca624b 100644
--- a/profile/avrcp/device.cc
+++ b/profile/avrcp/device.cc
@@ -80,6 +80,13 @@
   CHECK(media_interface_);
   DEVICE_VLOG(3) << __func__ << ": pdu=" << pkt->GetCommandPdu();
 
+  if (!pkt->IsValid()) {
+    DEVICE_LOG(WARNING) << __func__ << ": Request packet is not valid";
+    auto response = RejectBuilder::MakeBuilder(static_cast<CommandPdu>(0), Status::INVALID_COMMAND);
+    send_message(label, false, std::move(response));
+    return;
+  }
+
   // All CTypes at and above NOT_IMPLEMENTED are all response types.
   if (pkt->GetCType() == CType::NOT_IMPLEMENTED) {
     return;
@@ -125,9 +132,15 @@
     } break;
 
     case CommandPdu::GET_ELEMENT_ATTRIBUTES: {
-      media_interface_->GetSongInfo(base::Bind(
-          &Device::GetElementAttributesResponse, weak_ptr_factory_.GetWeakPtr(),
-          label, Packet::Specialize<GetElementAttributesRequest>(pkt)));
+      auto get_element_attributes_request_pkt = Packet::Specialize<GetElementAttributesRequest>(pkt);
+
+      if (!get_element_attributes_request_pkt->IsValid()) {
+        DEVICE_LOG(WARNING) << __func__ << ": Request packet is not valid";
+        auto response = RejectBuilder::MakeBuilder(pkt->GetCommandPdu(), Status::INVALID_PARAMETER);
+        send_message(label, false, std::move(response));
+      }
+      media_interface_->GetSongInfo(base::Bind(&Device::GetElementAttributesResponse, weak_ptr_factory_.GetWeakPtr(),
+                                               label, get_element_attributes_request_pkt));
     } break;
 
     case CommandPdu::GET_PLAY_STATUS: {
@@ -145,9 +158,17 @@
       // this currently since the current implementation only has one
       // player and the player will never change, but we need it for a
       // more complete implementation.
-      media_interface_->GetMediaPlayerList(base::Bind(
-          &Device::HandleSetAddressedPlayer, weak_ptr_factory_.GetWeakPtr(),
-          label, Packet::Specialize<SetAddressedPlayerRequest>(pkt)));
+      auto set_addressed_player_request = Packet::Specialize<SetAddressedPlayerRequest>(pkt);
+
+      if (!set_addressed_player_request->IsValid()) {
+        DEVICE_LOG(WARNING) << __func__ << ": Request packet is not valid";
+        auto response = RejectBuilder::MakeBuilder(pkt->GetCommandPdu(), Status::INVALID_PARAMETER);
+        send_message(label, false, std::move(response));
+        return;
+      }
+
+      media_interface_->GetMediaPlayerList(base::Bind(&Device::HandleSetAddressedPlayer, weak_ptr_factory_.GetWeakPtr(),
+                                                      label, set_addressed_player_request));
     } break;
 
     default: {
@@ -164,6 +185,13 @@
   DEVICE_VLOG(4) << __func__
                  << ": capability=" << pkt->GetCapabilityRequested();
 
+  if (!pkt->IsValid()) {
+    DEVICE_LOG(WARNING) << __func__ << ": Request packet is not valid";
+    auto response = RejectBuilder::MakeBuilder(pkt->GetCommandPdu(), Status::INVALID_PARAMETER);
+    send_message(label, false, std::move(response));
+    return;
+  }
+
   switch (pkt->GetCapabilityRequested()) {
     case Capability::COMPANY_ID: {
       auto response =
@@ -202,7 +230,7 @@
 void Device::HandleNotification(
     uint8_t label, const std::shared_ptr<RegisterNotificationRequest>& pkt) {
   if (!pkt->IsValid()) {
-    DEVICE_LOG(ERROR) << __func__ << ": Request packet is not valid";
+    DEVICE_LOG(WARNING) << __func__ << ": Request packet is not valid";
     auto response = RejectBuilder::MakeBuilder(pkt->GetCommandPdu(),
                                                Status::INVALID_PARAMETER);
     send_message(label, false, std::move(response));
@@ -307,6 +335,17 @@
 void Device::HandleVolumeChanged(
     uint8_t label, const std::shared_ptr<RegisterNotificationResponse>& pkt) {
   DEVICE_VLOG(1) << __func__ << ": interim=" << pkt->IsInterim();
+
+  if (!pkt->IsValid()) {
+    DEVICE_LOG(WARNING) << __func__ << ": Request packet is not valid";
+    auto response = RejectBuilder::MakeBuilder(pkt->GetCommandPdu(), Status::INVALID_PARAMETER);
+    send_message(label, false, std::move(response));
+    active_labels_.erase(label);
+    volume_interface_ = nullptr;
+    volume_ = VOL_REGISTRATION_FAILED;
+    return;
+  }
+
   if (volume_interface_ == nullptr) return;
 
   if (pkt->GetCType() == CType::REJECTED) {
@@ -546,6 +585,7 @@
     uint8_t label, std::shared_ptr<GetElementAttributesRequest> pkt,
     SongInfo info) {
   DEVICE_VLOG(2) << __func__;
+
   auto get_element_attributes_pkt = pkt;
   auto attributes_requested =
       get_element_attributes_pkt->GetAttributesRequested();
@@ -570,10 +610,15 @@
 }
 
 void Device::MessageReceived(uint8_t label, std::shared_ptr<Packet> pkt) {
+  if (!pkt->IsValid()) {
+    DEVICE_LOG(WARNING) << __func__ << ": Request packet is not valid";
+    auto response = RejectBuilder::MakeBuilder(static_cast<CommandPdu>(0), Status::INVALID_COMMAND);
+    send_message(label, false, std::move(response));
+    return;
+  }
+
   DEVICE_VLOG(4) << __func__ << ": opcode=" << pkt->GetOpcode();
-
   active_labels_.insert(label);
-
   switch (pkt->GetOpcode()) {
     // TODO (apanicke): Remove handling of UNIT_INFO and SUBUNIT_INFO from
     // the AVRC_API and instead handle it here to reduce fragmentation.
@@ -583,6 +628,14 @@
     } break;
     case Opcode::PASS_THROUGH: {
       auto pass_through_packet = Packet::Specialize<PassThroughPacket>(pkt);
+
+      if (!pass_through_packet->IsValid()) {
+        DEVICE_LOG(WARNING) << __func__ << ": Request packet is not valid";
+        auto response = RejectBuilder::MakeBuilder(static_cast<CommandPdu>(0), Status::INVALID_COMMAND);
+        send_message(label, false, std::move(response));
+        return;
+      }
+
       auto response = PassThroughPacketBuilder::MakeBuilder(
           true, pass_through_packet->GetKeyState() == KeyState::PUSHED,
           pass_through_packet->GetOperationId());
@@ -633,6 +686,13 @@
   DEVICE_VLOG(2) << __func__ << ": scope=" << pkt->GetScope()
                  << " uid=" << pkt->GetUid();
 
+  if (!pkt->IsValid()) {
+    DEVICE_LOG(WARNING) << __func__ << ": Request packet is not valid";
+    auto response = RejectBuilder::MakeBuilder(pkt->GetCommandPdu(), Status::INVALID_PARAMETER);
+    send_message(label, false, std::move(response));
+    return;
+  }
+
   std::string media_id = "";
   switch (pkt->GetScope()) {
     case Scope::NOW_PLAYING:
@@ -680,6 +740,13 @@
 
 void Device::BrowseMessageReceived(uint8_t label,
                                    std::shared_ptr<BrowsePacket> pkt) {
+  if (!pkt->IsValid()) {
+    DEVICE_LOG(WARNING) << __func__ << ": Request packet is not valid";
+    auto response = GeneralRejectBuilder::MakeBuilder(Status::INVALID_COMMAND);
+    send_message(label, false, std::move(response));
+    return;
+  }
+
   DEVICE_VLOG(1) << __func__ << ": pdu=" << pkt->GetPdu();
 
   switch (pkt->GetPdu()) {
@@ -704,8 +771,7 @@
       break;
     default:
       DEVICE_LOG(WARNING) << __func__ << ": " << pkt->GetPdu();
-      auto response = GeneralRejectBuilder::MakeBuilder(
-          BrowsePdu::GENERAL_REJECT, Status::INVALID_COMMAND);
+      auto response = GeneralRejectBuilder::MakeBuilder(Status::INVALID_COMMAND);
       send_message(label, true, std::move(response));
 
       break;
@@ -714,6 +780,15 @@
 
 void Device::HandleGetFolderItems(uint8_t label,
                                   std::shared_ptr<GetFolderItemsRequest> pkt) {
+  if (!pkt->IsValid()) {
+    // The specific get folder items builder is unimportant on failure.
+    DEVICE_LOG(WARNING) << __func__ << ": Get folder items request packet is not valid";
+    auto response =
+        GetFolderItemsResponseBuilder::MakePlayerListBuilder(Status::INVALID_PARAMETER, 0x0000, browse_mtu_);
+    send_message(label, true, std::move(response));
+    return;
+  }
+
   DEVICE_VLOG(2) << __func__ << ": scope=" << pkt->GetScope();
 
   switch (pkt->GetScope()) {
@@ -735,12 +810,21 @@
       break;
     default:
       DEVICE_LOG(ERROR) << __func__ << ": " << pkt->GetScope();
+      auto response = GetFolderItemsResponseBuilder::MakePlayerListBuilder(Status::INVALID_PARAMETER, 0, browse_mtu_);
+      send_message(label, true, std::move(response));
       break;
   }
 }
 
 void Device::HandleGetTotalNumberOfItems(
     uint8_t label, std::shared_ptr<GetTotalNumberOfItemsRequest> pkt) {
+  if (!pkt->IsValid()) {
+    DEVICE_LOG(WARNING) << __func__ << ": Request packet is not valid";
+    auto response = GetTotalNumberOfItemsResponseBuilder::MakeBuilder(Status::INVALID_PARAMETER, 0x0000, 0);
+    send_message(label, true, std::move(response));
+    return;
+  }
+
   DEVICE_VLOG(2) << __func__ << ": scope=" << pkt->GetScope();
 
   switch (pkt->GetScope()) {
@@ -796,6 +880,13 @@
 
 void Device::HandleChangePath(uint8_t label,
                               std::shared_ptr<ChangePathRequest> pkt) {
+  if (!pkt->IsValid()) {
+    DEVICE_LOG(WARNING) << __func__ << ": Request packet is not valid";
+    auto response = ChangePathResponseBuilder::MakeBuilder(Status::INVALID_PARAMETER, 0);
+    send_message(label, true, std::move(response));
+    return;
+  }
+
   DEVICE_VLOG(2) << __func__ << ": direction=" << pkt->GetDirection()
                  << " uid=" << loghex(pkt->GetUid());
 
@@ -846,6 +937,13 @@
 
 void Device::HandleGetItemAttributes(
     uint8_t label, std::shared_ptr<GetItemAttributesRequest> pkt) {
+  if (!pkt->IsValid()) {
+    DEVICE_LOG(WARNING) << __func__ << ": Request packet is not valid";
+    auto builder = GetItemAttributesResponseBuilder::MakeBuilder(Status::INVALID_PARAMETER, browse_mtu_);
+    send_message(label, true, std::move(builder));
+    return;
+  }
+
   DEVICE_VLOG(2) << __func__ << ": scope=" << pkt->GetScope()
                  << " uid=" << loghex(pkt->GetUid())
                  << " uid counter=" << loghex(pkt->GetUidCounter());
@@ -856,6 +954,7 @@
     send_message(label, true, std::move(builder));
     return;
   }
+
   switch (pkt->GetScope()) {
     case Scope::NOW_PLAYING: {
       media_interface_->GetNowPlayingList(
@@ -1121,6 +1220,13 @@
 
 void Device::HandleSetBrowsedPlayer(
     uint8_t label, std::shared_ptr<SetBrowsedPlayerRequest> pkt) {
+  if (!pkt->IsValid()) {
+    DEVICE_LOG(WARNING) << __func__ << ": Request packet is not valid";
+    auto response = SetBrowsedPlayerResponseBuilder::MakeBuilder(Status::INVALID_PARAMETER, 0x0000, 0, 0, "");
+    send_message(label, true, std::move(response));
+    return;
+  }
+
   DEVICE_VLOG(2) << __func__ << ": player_id=" << pkt->GetPlayerId();
   media_interface_->SetBrowsedPlayer(
       pkt->GetPlayerId(),
diff --git a/profile/avrcp/tests/avrcp_connection_handler_test.cc b/profile/avrcp/tests/avrcp_connection_handler_test.cc
index 15ea55e..5a811b2 100644
--- a/profile/avrcp/tests/avrcp_connection_handler_test.cc
+++ b/profile/avrcp/tests/avrcp_connection_handler_test.cc
@@ -56,7 +56,7 @@
         .p_next_attr = nullptr,
         .attr_id = 0,
         .attr_len_type = 0,
-        .attr_value.v.u16 = 0,
+        .attr_value = {.v = {.u16 = 0}},
     };
 
     if (browsing) fake_features.attr_value.v.u16 |= AVRC_SUPF_CT_BROWSE;
diff --git a/profile/avrcp/tests/avrcp_device_fuzz/avrcp_device_fuzz.cc b/profile/avrcp/tests/avrcp_device_fuzz/avrcp_device_fuzz.cc
new file mode 100644
index 0000000..24a794d
--- /dev/null
+++ b/profile/avrcp/tests/avrcp_device_fuzz/avrcp_device_fuzz.cc
@@ -0,0 +1,86 @@
+#include <cstddef>
+#include <cstdint>
+
+#include "avrcp_packet.h"
+#include "device.h"
+#include "packet_test_helper.h"
+#include "stack_config.h"
+
+namespace bluetooth {
+namespace avrcp {
+class FakeMediaInterface : public MediaInterface {
+ public:
+  virtual void SendKeyEvent(uint8_t key, KeyState state) {}
+  using SongInfoCallback = base::Callback<void(SongInfo)>;
+  virtual void GetSongInfo(SongInfoCallback info_cb) {}
+  using PlayStatusCallback = base::Callback<void(PlayStatus)>;
+  virtual void GetPlayStatus(PlayStatusCallback status_cb) {}
+  using NowPlayingCallback =
+      base::Callback<void(std::string, std::vector<SongInfo>)>;
+  virtual void GetNowPlayingList(NowPlayingCallback now_playing_cb) {}
+  using MediaListCallback =
+      base::Callback<void(uint16_t curr_player, std::vector<MediaPlayerInfo>)>;
+  virtual void GetMediaPlayerList(MediaListCallback list_cb) {}
+  using FolderItemsCallback = base::Callback<void(std::vector<ListItem>)>;
+  virtual void GetFolderItems(uint16_t player_id, std::string media_id,
+                              FolderItemsCallback folder_cb) {}
+  using SetBrowsedPlayerCallback = base::Callback<void(
+      bool success, std::string root_id, uint32_t num_items)>;
+  virtual void SetBrowsedPlayer(uint16_t player_id,
+                                SetBrowsedPlayerCallback browse_cb) {}
+  virtual void PlayItem(uint16_t player_id, bool now_playing,
+                        std::string media_id) {}
+  virtual void SetActiveDevice(const RawAddress& address) {}
+  virtual void RegisterUpdateCallback(MediaCallbacks* callback) {}
+  virtual void UnregisterUpdateCallback(MediaCallbacks* callback) {}
+};
+
+class FakeVolumeInterface : public VolumeInterface {
+ public:
+  virtual void DeviceConnected(const RawAddress& bdaddr) {}
+  virtual void DeviceConnected(const RawAddress& bdaddr, VolumeChangedCb cb) {}
+  virtual void DeviceDisconnected(const RawAddress& bdaddr) {}
+  virtual void SetVolume(int8_t volume) {}
+};
+
+class FakeA2dpInterface : public A2dpInterface {
+ public:
+  virtual RawAddress active_peer() { return RawAddress(); }
+  virtual bool is_peer_in_silence_mode(const RawAddress& peer_address) {
+    return false;
+  }
+};
+
+bool get_pts_avrcp_test(void) { return false; }
+
+const stack_config_t interface = {
+    nullptr, get_pts_avrcp_test, nullptr, nullptr, nullptr, nullptr, nullptr,
+    nullptr};
+
+void Callback(uint8_t, bool, std::unique_ptr<::bluetooth::PacketBuilder>) {}
+
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t* Data, size_t Size) {
+  FakeMediaInterface fmi;
+  FakeVolumeInterface fvi;
+  FakeA2dpInterface fai;
+
+  std::vector<uint8_t> Packet(Data, Data + Size);
+  Device device(RawAddress::kAny, true,
+                base::Bind([](uint8_t, bool,
+                              std::unique_ptr<::bluetooth::PacketBuilder>) {}),
+                0xFFFF, 0xFFFF);
+  device.RegisterInterfaces(&fmi, &fai, &fvi);
+
+  auto browse_request = TestPacketType<BrowsePacket>::Make(Packet);
+  device.BrowseMessageReceived(1, browse_request);
+
+  auto avrcp_request = TestPacketType<avrcp::Packet>::Make(Packet);
+  device.MessageReceived(1, avrcp_request);
+  return 0;
+}
+}  // namespace avrcp
+}  // namespace bluetooth
+
+const stack_config_t* stack_config_get_interface(void) {
+  return &bluetooth::avrcp::interface;
+}
\ No newline at end of file
diff --git a/profile/avrcp/tests/avrcp_device_fuzz/corpus/change_path_error_response b/profile/avrcp/tests/avrcp_device_fuzz/corpus/change_path_error_response
new file mode 100644
index 0000000..f5f982c
--- /dev/null
+++ b/profile/avrcp/tests/avrcp_device_fuzz/corpus/change_path_error_response
Binary files differ
diff --git a/profile/avrcp/tests/avrcp_device_fuzz/corpus/change_path_request b/profile/avrcp/tests/avrcp_device_fuzz/corpus/change_path_request
new file mode 100644
index 0000000..581327a
--- /dev/null
+++ b/profile/avrcp/tests/avrcp_device_fuzz/corpus/change_path_request
Binary files differ
diff --git a/profile/avrcp/tests/avrcp_device_fuzz/corpus/change_path_response b/profile/avrcp/tests/avrcp_device_fuzz/corpus/change_path_response
new file mode 100644
index 0000000..10c7576
--- /dev/null
+++ b/profile/avrcp/tests/avrcp_device_fuzz/corpus/change_path_response
Binary files differ
diff --git a/profile/avrcp/tests/avrcp_device_fuzz/corpus/change_path_up_request b/profile/avrcp/tests/avrcp_device_fuzz/corpus/change_path_up_request
new file mode 100644
index 0000000..a222657
--- /dev/null
+++ b/profile/avrcp/tests/avrcp_device_fuzz/corpus/change_path_up_request
Binary files differ
diff --git a/profile/avrcp/tests/avrcp_device_fuzz/corpus/changed_play_pos_notification b/profile/avrcp/tests/avrcp_device_fuzz/corpus/changed_play_pos_notification
new file mode 100644
index 0000000..6ee7661
--- /dev/null
+++ b/profile/avrcp/tests/avrcp_device_fuzz/corpus/changed_play_pos_notification
Binary files differ
diff --git a/profile/avrcp/tests/avrcp_device_fuzz/corpus/changed_volume_changed_notification b/profile/avrcp/tests/avrcp_device_fuzz/corpus/changed_volume_changed_notification
new file mode 100644
index 0000000..31d50fb
--- /dev/null
+++ b/profile/avrcp/tests/avrcp_device_fuzz/corpus/changed_volume_changed_notification
Binary files differ
diff --git a/profile/avrcp/tests/avrcp_device_fuzz/corpus/general_reject_invalid_command_packet b/profile/avrcp/tests/avrcp_device_fuzz/corpus/general_reject_invalid_command_packet
new file mode 100644
index 0000000..83fa427
--- /dev/null
+++ b/profile/avrcp/tests/avrcp_device_fuzz/corpus/general_reject_invalid_command_packet
Binary files differ
diff --git a/profile/avrcp/tests/avrcp_device_fuzz/corpus/get_capabilities_request b/profile/avrcp/tests/avrcp_device_fuzz/corpus/get_capabilities_request
new file mode 100644
index 0000000..3968c03
--- /dev/null
+++ b/profile/avrcp/tests/avrcp_device_fuzz/corpus/get_capabilities_request
Binary files differ
diff --git a/profile/avrcp/tests/avrcp_device_fuzz/corpus/get_capabilities_request_company_id b/profile/avrcp/tests/avrcp_device_fuzz/corpus/get_capabilities_request_company_id
new file mode 100644
index 0000000..f3966ed
--- /dev/null
+++ b/profile/avrcp/tests/avrcp_device_fuzz/corpus/get_capabilities_request_company_id
Binary files differ
diff --git a/profile/avrcp/tests/avrcp_device_fuzz/corpus/get_capabilities_request_unknown b/profile/avrcp/tests/avrcp_device_fuzz/corpus/get_capabilities_request_unknown
new file mode 100644
index 0000000..eada547
--- /dev/null
+++ b/profile/avrcp/tests/avrcp_device_fuzz/corpus/get_capabilities_request_unknown
Binary files differ
diff --git a/profile/avrcp/tests/avrcp_device_fuzz/corpus/get_capabilities_response_company_id b/profile/avrcp/tests/avrcp_device_fuzz/corpus/get_capabilities_response_company_id
new file mode 100644
index 0000000..21889ca
--- /dev/null
+++ b/profile/avrcp/tests/avrcp_device_fuzz/corpus/get_capabilities_response_company_id
Binary files differ
diff --git a/profile/avrcp/tests/avrcp_device_fuzz/corpus/get_capabilities_response_events_supported b/profile/avrcp/tests/avrcp_device_fuzz/corpus/get_capabilities_response_events_supported
new file mode 100644
index 0000000..d2cf8a8
--- /dev/null
+++ b/profile/avrcp/tests/avrcp_device_fuzz/corpus/get_capabilities_response_events_supported
Binary files differ
diff --git a/profile/avrcp/tests/avrcp_device_fuzz/corpus/get_element_attributes_request_full b/profile/avrcp/tests/avrcp_device_fuzz/corpus/get_element_attributes_request_full
new file mode 100644
index 0000000..d79c1d3
--- /dev/null
+++ b/profile/avrcp/tests/avrcp_device_fuzz/corpus/get_element_attributes_request_full
Binary files differ
diff --git a/profile/avrcp/tests/avrcp_device_fuzz/corpus/get_element_attributes_request_partial b/profile/avrcp/tests/avrcp_device_fuzz/corpus/get_element_attributes_request_partial
new file mode 100644
index 0000000..c37c9b6
--- /dev/null
+++ b/profile/avrcp/tests/avrcp_device_fuzz/corpus/get_element_attributes_request_partial
Binary files differ
diff --git a/profile/avrcp/tests/avrcp_device_fuzz/corpus/get_elements_attributes_response_full b/profile/avrcp/tests/avrcp_device_fuzz/corpus/get_elements_attributes_response_full
new file mode 100644
index 0000000..2e63feb
--- /dev/null
+++ b/profile/avrcp/tests/avrcp_device_fuzz/corpus/get_elements_attributes_response_full
Binary files differ
diff --git a/profile/avrcp/tests/avrcp_device_fuzz/corpus/get_folder_items_error_response b/profile/avrcp/tests/avrcp_device_fuzz/corpus/get_folder_items_error_response
new file mode 100644
index 0000000..a09361b
--- /dev/null
+++ b/profile/avrcp/tests/avrcp_device_fuzz/corpus/get_folder_items_error_response
Binary files differ
diff --git a/profile/avrcp/tests/avrcp_device_fuzz/corpus/get_folder_items_folder_response b/profile/avrcp/tests/avrcp_device_fuzz/corpus/get_folder_items_folder_response
new file mode 100644
index 0000000..f58889a
--- /dev/null
+++ b/profile/avrcp/tests/avrcp_device_fuzz/corpus/get_folder_items_folder_response
Binary files differ
diff --git a/profile/avrcp/tests/avrcp_device_fuzz/corpus/get_folder_items_media_player_response b/profile/avrcp/tests/avrcp_device_fuzz/corpus/get_folder_items_media_player_response
new file mode 100644
index 0000000..ed25c8c
--- /dev/null
+++ b/profile/avrcp/tests/avrcp_device_fuzz/corpus/get_folder_items_media_player_response
Binary files differ
diff --git a/profile/avrcp/tests/avrcp_device_fuzz/corpus/get_folder_items_request b/profile/avrcp/tests/avrcp_device_fuzz/corpus/get_folder_items_request
new file mode 100644
index 0000000..098fa05
--- /dev/null
+++ b/profile/avrcp/tests/avrcp_device_fuzz/corpus/get_folder_items_request
Binary files differ
diff --git a/profile/avrcp/tests/avrcp_device_fuzz/corpus/get_folder_items_request_no_attrs b/profile/avrcp/tests/avrcp_device_fuzz/corpus/get_folder_items_request_no_attrs
new file mode 100644
index 0000000..7e27ff9
--- /dev/null
+++ b/profile/avrcp/tests/avrcp_device_fuzz/corpus/get_folder_items_request_no_attrs
Binary files differ
diff --git a/profile/avrcp/tests/avrcp_device_fuzz/corpus/get_folder_items_request_now_playing b/profile/avrcp/tests/avrcp_device_fuzz/corpus/get_folder_items_request_now_playing
new file mode 100644
index 0000000..9eaa355
--- /dev/null
+++ b/profile/avrcp/tests/avrcp_device_fuzz/corpus/get_folder_items_request_now_playing
Binary files differ
diff --git a/profile/avrcp/tests/avrcp_device_fuzz/corpus/get_folder_items_request_title b/profile/avrcp/tests/avrcp_device_fuzz/corpus/get_folder_items_request_title
new file mode 100644
index 0000000..0108fc7
--- /dev/null
+++ b/profile/avrcp/tests/avrcp_device_fuzz/corpus/get_folder_items_request_title
Binary files differ
diff --git a/profile/avrcp/tests/avrcp_device_fuzz/corpus/get_folder_items_request_vfs b/profile/avrcp/tests/avrcp_device_fuzz/corpus/get_folder_items_request_vfs
new file mode 100644
index 0000000..e8cc867
--- /dev/null
+++ b/profile/avrcp/tests/avrcp_device_fuzz/corpus/get_folder_items_request_vfs
Binary files differ
diff --git a/profile/avrcp/tests/avrcp_device_fuzz/corpus/get_folder_items_song_response b/profile/avrcp/tests/avrcp_device_fuzz/corpus/get_folder_items_song_response
new file mode 100644
index 0000000..f7472e0
--- /dev/null
+++ b/profile/avrcp/tests/avrcp_device_fuzz/corpus/get_folder_items_song_response
Binary files differ
diff --git a/profile/avrcp/tests/avrcp_device_fuzz/corpus/get_item_attributes_request_all_attributes b/profile/avrcp/tests/avrcp_device_fuzz/corpus/get_item_attributes_request_all_attributes
new file mode 100644
index 0000000..7d706b8
--- /dev/null
+++ b/profile/avrcp/tests/avrcp_device_fuzz/corpus/get_item_attributes_request_all_attributes
Binary files differ
diff --git a/profile/avrcp/tests/avrcp_device_fuzz/corpus/get_item_attributes_request_all_attributes_invalid b/profile/avrcp/tests/avrcp_device_fuzz/corpus/get_item_attributes_request_all_attributes_invalid
new file mode 100644
index 0000000..d55d0c4
--- /dev/null
+++ b/profile/avrcp/tests/avrcp_device_fuzz/corpus/get_item_attributes_request_all_attributes_invalid
Binary files differ
diff --git a/profile/avrcp/tests/avrcp_device_fuzz/corpus/get_item_attributes_song_response b/profile/avrcp/tests/avrcp_device_fuzz/corpus/get_item_attributes_song_response
new file mode 100644
index 0000000..3553664
--- /dev/null
+++ b/profile/avrcp/tests/avrcp_device_fuzz/corpus/get_item_attributes_song_response
Binary files differ
diff --git a/profile/avrcp/tests/avrcp_device_fuzz/corpus/get_play_status_request b/profile/avrcp/tests/avrcp_device_fuzz/corpus/get_play_status_request
new file mode 100644
index 0000000..2311a47
--- /dev/null
+++ b/profile/avrcp/tests/avrcp_device_fuzz/corpus/get_play_status_request
Binary files differ
diff --git a/profile/avrcp/tests/avrcp_device_fuzz/corpus/get_play_status_response b/profile/avrcp/tests/avrcp_device_fuzz/corpus/get_play_status_response
new file mode 100644
index 0000000..240136f
--- /dev/null
+++ b/profile/avrcp/tests/avrcp_device_fuzz/corpus/get_play_status_response
Binary files differ
diff --git a/profile/avrcp/tests/avrcp_device_fuzz/corpus/get_total_number_of_items_request_media_players b/profile/avrcp/tests/avrcp_device_fuzz/corpus/get_total_number_of_items_request_media_players
new file mode 100644
index 0000000..a5b85b7
--- /dev/null
+++ b/profile/avrcp/tests/avrcp_device_fuzz/corpus/get_total_number_of_items_request_media_players
Binary files differ
diff --git a/profile/avrcp/tests/avrcp_device_fuzz/corpus/get_total_number_of_items_request_now_playing b/profile/avrcp/tests/avrcp_device_fuzz/corpus/get_total_number_of_items_request_now_playing
new file mode 100644
index 0000000..a4a6654
--- /dev/null
+++ b/profile/avrcp/tests/avrcp_device_fuzz/corpus/get_total_number_of_items_request_now_playing
Binary files differ
diff --git a/profile/avrcp/tests/avrcp_device_fuzz/corpus/get_total_number_of_items_request_vfs b/profile/avrcp/tests/avrcp_device_fuzz/corpus/get_total_number_of_items_request_vfs
new file mode 100644
index 0000000..0f9ad75
--- /dev/null
+++ b/profile/avrcp/tests/avrcp_device_fuzz/corpus/get_total_number_of_items_request_vfs
Binary files differ
diff --git a/profile/avrcp/tests/avrcp_device_fuzz/corpus/get_total_number_of_items_response b/profile/avrcp/tests/avrcp_device_fuzz/corpus/get_total_number_of_items_response
new file mode 100644
index 0000000..742da96
--- /dev/null
+++ b/profile/avrcp/tests/avrcp_device_fuzz/corpus/get_total_number_of_items_response
Binary files differ
diff --git a/profile/avrcp/tests/avrcp_device_fuzz/corpus/interim_addressed_player_notification b/profile/avrcp/tests/avrcp_device_fuzz/corpus/interim_addressed_player_notification
new file mode 100644
index 0000000..2f6044b
--- /dev/null
+++ b/profile/avrcp/tests/avrcp_device_fuzz/corpus/interim_addressed_player_notification
Binary files differ
diff --git a/profile/avrcp/tests/avrcp_device_fuzz/corpus/interim_available_players_notification b/profile/avrcp/tests/avrcp_device_fuzz/corpus/interim_available_players_notification
new file mode 100644
index 0000000..b643cf4
--- /dev/null
+++ b/profile/avrcp/tests/avrcp_device_fuzz/corpus/interim_available_players_notification
Binary files differ
diff --git a/profile/avrcp/tests/avrcp_device_fuzz/corpus/interim_now_playing_notification b/profile/avrcp/tests/avrcp_device_fuzz/corpus/interim_now_playing_notification
new file mode 100644
index 0000000..ea6675e
--- /dev/null
+++ b/profile/avrcp/tests/avrcp_device_fuzz/corpus/interim_now_playing_notification
Binary files differ
diff --git a/profile/avrcp/tests/avrcp_device_fuzz/corpus/interim_play_status_notification b/profile/avrcp/tests/avrcp_device_fuzz/corpus/interim_play_status_notification
new file mode 100644
index 0000000..0fb233d
--- /dev/null
+++ b/profile/avrcp/tests/avrcp_device_fuzz/corpus/interim_play_status_notification
Binary files differ
diff --git a/profile/avrcp/tests/avrcp_device_fuzz/corpus/interim_track_changed_notification b/profile/avrcp/tests/avrcp_device_fuzz/corpus/interim_track_changed_notification
new file mode 100644
index 0000000..b23cf6e
--- /dev/null
+++ b/profile/avrcp/tests/avrcp_device_fuzz/corpus/interim_track_changed_notification
Binary files differ
diff --git a/profile/avrcp/tests/avrcp_device_fuzz/corpus/interim_uids_notificaiton b/profile/avrcp/tests/avrcp_device_fuzz/corpus/interim_uids_notificaiton
new file mode 100644
index 0000000..cac9b4a
--- /dev/null
+++ b/profile/avrcp/tests/avrcp_device_fuzz/corpus/interim_uids_notificaiton
Binary files differ
diff --git a/profile/avrcp/tests/avrcp_device_fuzz/corpus/interim_volume_changed_notification b/profile/avrcp/tests/avrcp_device_fuzz/corpus/interim_volume_changed_notification
new file mode 100644
index 0000000..101bae6
--- /dev/null
+++ b/profile/avrcp/tests/avrcp_device_fuzz/corpus/interim_volume_changed_notification
Binary files differ
diff --git a/profile/avrcp/tests/avrcp_device_fuzz/corpus/pass_through_command_play_pushed b/profile/avrcp/tests/avrcp_device_fuzz/corpus/pass_through_command_play_pushed
new file mode 100644
index 0000000..9e002d2
--- /dev/null
+++ b/profile/avrcp/tests/avrcp_device_fuzz/corpus/pass_through_command_play_pushed
Binary files differ
diff --git a/profile/avrcp/tests/avrcp_device_fuzz/corpus/pass_through_command_play_released b/profile/avrcp/tests/avrcp_device_fuzz/corpus/pass_through_command_play_released
new file mode 100644
index 0000000..5c100e8
--- /dev/null
+++ b/profile/avrcp/tests/avrcp_device_fuzz/corpus/pass_through_command_play_released
Binary files differ
diff --git a/profile/avrcp/tests/avrcp_device_fuzz/corpus/play_item_request b/profile/avrcp/tests/avrcp_device_fuzz/corpus/play_item_request
new file mode 100644
index 0000000..538a7c0
--- /dev/null
+++ b/profile/avrcp/tests/avrcp_device_fuzz/corpus/play_item_request
Binary files differ
diff --git a/profile/avrcp/tests/avrcp_device_fuzz/corpus/play_item_response b/profile/avrcp/tests/avrcp_device_fuzz/corpus/play_item_response
new file mode 100644
index 0000000..1180bcc
--- /dev/null
+++ b/profile/avrcp/tests/avrcp_device_fuzz/corpus/play_item_response
Binary files differ
diff --git a/profile/avrcp/tests/avrcp_device_fuzz/corpus/register_notification_invalid b/profile/avrcp/tests/avrcp_device_fuzz/corpus/register_notification_invalid
new file mode 100644
index 0000000..2a213f0
--- /dev/null
+++ b/profile/avrcp/tests/avrcp_device_fuzz/corpus/register_notification_invalid
Binary files differ
diff --git a/profile/avrcp/tests/avrcp_device_fuzz/corpus/register_play_status_notification b/profile/avrcp/tests/avrcp_device_fuzz/corpus/register_play_status_notification
new file mode 100644
index 0000000..fa40de4
--- /dev/null
+++ b/profile/avrcp/tests/avrcp_device_fuzz/corpus/register_play_status_notification
Binary files differ
diff --git a/profile/avrcp/tests/avrcp_device_fuzz/corpus/register_volume_changed_notification b/profile/avrcp/tests/avrcp_device_fuzz/corpus/register_volume_changed_notification
new file mode 100644
index 0000000..3e7209b
--- /dev/null
+++ b/profile/avrcp/tests/avrcp_device_fuzz/corpus/register_volume_changed_notification
Binary files differ
diff --git a/profile/avrcp/tests/avrcp_device_fuzz/corpus/reject_player_app_settings_response b/profile/avrcp/tests/avrcp_device_fuzz/corpus/reject_player_app_settings_response
new file mode 100644
index 0000000..82cc047
--- /dev/null
+++ b/profile/avrcp/tests/avrcp_device_fuzz/corpus/reject_player_app_settings_response
Binary files differ
diff --git a/profile/avrcp/tests/avrcp_device_fuzz/corpus/rejected_volume_changed_notification b/profile/avrcp/tests/avrcp_device_fuzz/corpus/rejected_volume_changed_notification
new file mode 100644
index 0000000..5119a2d
--- /dev/null
+++ b/profile/avrcp/tests/avrcp_device_fuzz/corpus/rejected_volume_changed_notification
Binary files differ
diff --git a/profile/avrcp/tests/avrcp_device_fuzz/corpus/set_absolute_volume_request b/profile/avrcp/tests/avrcp_device_fuzz/corpus/set_absolute_volume_request
new file mode 100644
index 0000000..5403b84
--- /dev/null
+++ b/profile/avrcp/tests/avrcp_device_fuzz/corpus/set_absolute_volume_request
Binary files differ
diff --git a/profile/avrcp/tests/avrcp_device_fuzz/corpus/set_absolute_volume_response b/profile/avrcp/tests/avrcp_device_fuzz/corpus/set_absolute_volume_response
new file mode 100644
index 0000000..b30cde2
--- /dev/null
+++ b/profile/avrcp/tests/avrcp_device_fuzz/corpus/set_absolute_volume_response
Binary files differ
diff --git a/profile/avrcp/tests/avrcp_device_fuzz/corpus/set_addressed_player_id_1_request b/profile/avrcp/tests/avrcp_device_fuzz/corpus/set_addressed_player_id_1_request
new file mode 100644
index 0000000..ebe224e
--- /dev/null
+++ b/profile/avrcp/tests/avrcp_device_fuzz/corpus/set_addressed_player_id_1_request
Binary files differ
diff --git a/profile/avrcp/tests/avrcp_device_fuzz/corpus/set_addressed_player_request b/profile/avrcp/tests/avrcp_device_fuzz/corpus/set_addressed_player_request
new file mode 100644
index 0000000..a38cfb7
--- /dev/null
+++ b/profile/avrcp/tests/avrcp_device_fuzz/corpus/set_addressed_player_request
Binary files differ
diff --git a/profile/avrcp/tests/avrcp_device_fuzz/corpus/set_addressed_player_response b/profile/avrcp/tests/avrcp_device_fuzz/corpus/set_addressed_player_response
new file mode 100644
index 0000000..4230524
--- /dev/null
+++ b/profile/avrcp/tests/avrcp_device_fuzz/corpus/set_addressed_player_response
Binary files differ
diff --git a/profile/avrcp/tests/avrcp_device_fuzz/corpus/set_browsed_player_request b/profile/avrcp/tests/avrcp_device_fuzz/corpus/set_browsed_player_request
new file mode 100644
index 0000000..667137b
--- /dev/null
+++ b/profile/avrcp/tests/avrcp_device_fuzz/corpus/set_browsed_player_request
Binary files differ
diff --git a/profile/avrcp/tests/avrcp_device_fuzz/corpus/set_browsed_player_response b/profile/avrcp/tests/avrcp_device_fuzz/corpus/set_browsed_player_response
new file mode 100644
index 0000000..c3a3c93
--- /dev/null
+++ b/profile/avrcp/tests/avrcp_device_fuzz/corpus/set_browsed_player_response
Binary files differ
diff --git a/profile/avrcp/tests/avrcp_device_fuzz/corpus/short_browse_packet b/profile/avrcp/tests/avrcp_device_fuzz/corpus/short_browse_packet
new file mode 100644
index 0000000..b866ef0
--- /dev/null
+++ b/profile/avrcp/tests/avrcp_device_fuzz/corpus/short_browse_packet
Binary files differ
diff --git a/profile/avrcp/tests/avrcp_device_fuzz/corpus/short_change_path_request b/profile/avrcp/tests/avrcp_device_fuzz/corpus/short_change_path_request
new file mode 100644
index 0000000..365d337
--- /dev/null
+++ b/profile/avrcp/tests/avrcp_device_fuzz/corpus/short_change_path_request
Binary files differ
diff --git a/profile/avrcp/tests/avrcp_device_fuzz/corpus/short_get_capabilities_request b/profile/avrcp/tests/avrcp_device_fuzz/corpus/short_get_capabilities_request
new file mode 100644
index 0000000..c7c5b33
--- /dev/null
+++ b/profile/avrcp/tests/avrcp_device_fuzz/corpus/short_get_capabilities_request
Binary files differ
diff --git a/profile/avrcp/tests/avrcp_device_fuzz/corpus/short_get_element_attributes_request b/profile/avrcp/tests/avrcp_device_fuzz/corpus/short_get_element_attributes_request
new file mode 100644
index 0000000..102d788
--- /dev/null
+++ b/profile/avrcp/tests/avrcp_device_fuzz/corpus/short_get_element_attributes_request
Binary files differ
diff --git a/profile/avrcp/tests/avrcp_device_fuzz/corpus/short_get_folder_items_request b/profile/avrcp/tests/avrcp_device_fuzz/corpus/short_get_folder_items_request
new file mode 100644
index 0000000..4ab0aa8
--- /dev/null
+++ b/profile/avrcp/tests/avrcp_device_fuzz/corpus/short_get_folder_items_request
Binary files differ
diff --git a/profile/avrcp/tests/avrcp_device_fuzz/corpus/short_get_item_attributes_request b/profile/avrcp/tests/avrcp_device_fuzz/corpus/short_get_item_attributes_request
new file mode 100644
index 0000000..7467555
--- /dev/null
+++ b/profile/avrcp/tests/avrcp_device_fuzz/corpus/short_get_item_attributes_request
Binary files differ
diff --git a/profile/avrcp/tests/avrcp_device_fuzz/corpus/short_get_total_number_of_items_request b/profile/avrcp/tests/avrcp_device_fuzz/corpus/short_get_total_number_of_items_request
new file mode 100644
index 0000000..bc634e2
--- /dev/null
+++ b/profile/avrcp/tests/avrcp_device_fuzz/corpus/short_get_total_number_of_items_request
Binary files differ
diff --git a/profile/avrcp/tests/avrcp_device_fuzz/corpus/short_play_item_request b/profile/avrcp/tests/avrcp_device_fuzz/corpus/short_play_item_request
new file mode 100644
index 0000000..a138dc4
--- /dev/null
+++ b/profile/avrcp/tests/avrcp_device_fuzz/corpus/short_play_item_request
Binary files differ
diff --git a/profile/avrcp/tests/avrcp_device_fuzz/corpus/short_set_addressed_player_request b/profile/avrcp/tests/avrcp_device_fuzz/corpus/short_set_addressed_player_request
new file mode 100644
index 0000000..4872d6b
--- /dev/null
+++ b/profile/avrcp/tests/avrcp_device_fuzz/corpus/short_set_addressed_player_request
Binary files differ
diff --git a/profile/avrcp/tests/avrcp_device_fuzz/corpus/short_vendor_packet b/profile/avrcp/tests/avrcp_device_fuzz/corpus/short_vendor_packet
new file mode 100644
index 0000000..0c2a66e
--- /dev/null
+++ b/profile/avrcp/tests/avrcp_device_fuzz/corpus/short_vendor_packet
Binary files differ
diff --git a/profile/avrcp/tests/avrcp_device_test.cc b/profile/avrcp/tests/avrcp_device_test.cc
index 206e7e2..d221e1b 100644
--- a/profile/avrcp/tests/avrcp_device_test.cc
+++ b/profile/avrcp/tests/avrcp_device_test.cc
@@ -1358,6 +1358,126 @@
   SendMessage(1, reg_notif_request);
 }
 
+TEST_F(AvrcpDeviceTest, invalidVendorPacketTest) {
+  MockMediaInterface interface;
+  NiceMock<MockA2dpInterface> a2dp_interface;
+
+  test_device->RegisterInterfaces(&interface, &a2dp_interface, nullptr);
+
+  auto rsp = RejectBuilder::MakeBuilder(static_cast<CommandPdu>(0), Status::INVALID_COMMAND);
+  EXPECT_CALL(response_cb, Call(1, false, matchPacket(std::move(rsp)))).Times(1);
+  auto short_packet = TestAvrcpPacket::Make(short_vendor_packet);
+  SendMessage(1, short_packet);
+}
+
+TEST_F(AvrcpDeviceTest, invalidCapabilitiesPacketTest) {
+  MockMediaInterface interface;
+  NiceMock<MockA2dpInterface> a2dp_interface;
+
+  test_device->RegisterInterfaces(&interface, &a2dp_interface, nullptr);
+
+  auto rsp = RejectBuilder::MakeBuilder(CommandPdu::GET_CAPABILITIES, Status::INVALID_PARAMETER);
+  EXPECT_CALL(response_cb, Call(1, false, matchPacket(std::move(rsp)))).Times(1);
+  auto short_packet = TestAvrcpPacket::Make(short_get_capabilities_request);
+  SendMessage(1, short_packet);
+}
+
+TEST_F(AvrcpDeviceTest, invalidGetElementAttributesPacketTest) {
+  MockMediaInterface interface;
+  NiceMock<MockA2dpInterface> a2dp_interface;
+
+  test_device->RegisterInterfaces(&interface, &a2dp_interface, nullptr);
+
+  auto rsp = RejectBuilder::MakeBuilder(CommandPdu::GET_ELEMENT_ATTRIBUTES, Status::INVALID_PARAMETER);
+  EXPECT_CALL(response_cb, Call(1, false, matchPacket(std::move(rsp)))).Times(1);
+  auto short_packet = TestAvrcpPacket::Make(short_get_element_attributes_request);
+  SendMessage(1, short_packet);
+}
+
+TEST_F(AvrcpDeviceTest, invalidPlayItemPacketTest) {
+  MockMediaInterface interface;
+  NiceMock<MockA2dpInterface> a2dp_interface;
+
+  test_device->RegisterInterfaces(&interface, &a2dp_interface, nullptr);
+
+  auto rsp = RejectBuilder::MakeBuilder(CommandPdu::PLAY_ITEM, Status::INVALID_PARAMETER);
+  EXPECT_CALL(response_cb, Call(1, false, matchPacket(std::move(rsp)))).Times(1);
+  auto short_packet = TestAvrcpPacket::Make(short_play_item_request);
+  SendMessage(1, short_packet);
+}
+
+TEST_F(AvrcpDeviceTest, invalidSetAddressedPlayerPacketTest) {
+  MockMediaInterface interface;
+  NiceMock<MockA2dpInterface> a2dp_interface;
+
+  test_device->RegisterInterfaces(&interface, &a2dp_interface, nullptr);
+
+  auto rsp = RejectBuilder::MakeBuilder(CommandPdu::SET_ADDRESSED_PLAYER, Status::INVALID_PARAMETER);
+  EXPECT_CALL(response_cb, Call(1, false, matchPacket(std::move(rsp)))).Times(1);
+  auto short_packet = TestAvrcpPacket::Make(short_set_addressed_player_request);
+  SendMessage(1, short_packet);
+}
+
+TEST_F(AvrcpDeviceTest, invalidBrowsePacketTest) {
+  MockMediaInterface interface;
+  NiceMock<MockA2dpInterface> a2dp_interface;
+
+  test_device->RegisterInterfaces(&interface, &a2dp_interface, nullptr);
+
+  auto rsp = GeneralRejectBuilder::MakeBuilder(Status::INVALID_COMMAND);
+  EXPECT_CALL(response_cb, Call(1, false, matchPacket(std::move(rsp)))).Times(1);
+  auto short_packet = TestBrowsePacket::Make(short_browse_packet);
+  SendBrowseMessage(1, short_packet);
+}
+
+TEST_F(AvrcpDeviceTest, invalidGetFolderItemsPacketTest) {
+  MockMediaInterface interface;
+  NiceMock<MockA2dpInterface> a2dp_interface;
+
+  test_device->RegisterInterfaces(&interface, &a2dp_interface, nullptr);
+
+  auto rsp = GetFolderItemsResponseBuilder::MakePlayerListBuilder(Status::INVALID_PARAMETER, 0x0000, 0xFFFF);
+  EXPECT_CALL(response_cb, Call(1, true, matchPacket(std::move(rsp)))).Times(1);
+  auto short_packet = TestBrowsePacket::Make(short_get_folder_items_request);
+  SendBrowseMessage(1, short_packet);
+}
+
+TEST_F(AvrcpDeviceTest, invalidGetTotalNumberOfItemsPacketTest) {
+  MockMediaInterface interface;
+  NiceMock<MockA2dpInterface> a2dp_interface;
+
+  test_device->RegisterInterfaces(&interface, &a2dp_interface, nullptr);
+
+  auto rsp = GetTotalNumberOfItemsResponseBuilder::MakeBuilder(Status::INVALID_PARAMETER, 0x0000, 0xFFFF);
+  EXPECT_CALL(response_cb, Call(1, true, matchPacket(std::move(rsp)))).Times(1);
+  auto short_packet = TestBrowsePacket::Make(short_get_total_number_of_items_request);
+  SendBrowseMessage(1, short_packet);
+}
+
+TEST_F(AvrcpDeviceTest, invalidChangePathPacketTest) {
+  MockMediaInterface interface;
+  NiceMock<MockA2dpInterface> a2dp_interface;
+
+  test_device->RegisterInterfaces(&interface, &a2dp_interface, nullptr);
+
+  auto rsp = ChangePathResponseBuilder::MakeBuilder(Status::INVALID_PARAMETER, 0);
+  EXPECT_CALL(response_cb, Call(1, true, matchPacket(std::move(rsp)))).Times(1);
+  auto short_packet = TestBrowsePacket::Make(short_change_path_request);
+  SendBrowseMessage(1, short_packet);
+}
+
+TEST_F(AvrcpDeviceTest, invalidGetItemAttributesPacketTest) {
+  MockMediaInterface interface;
+  NiceMock<MockA2dpInterface> a2dp_interface;
+
+  test_device->RegisterInterfaces(&interface, &a2dp_interface, nullptr);
+
+  auto rsp = GetItemAttributesResponseBuilder::MakeBuilder(Status::INVALID_PARAMETER, 0xFFFF);
+  EXPECT_CALL(response_cb, Call(1, true, matchPacket(std::move(rsp)))).Times(1);
+  auto short_packet = TestBrowsePacket::Make(short_get_item_attributes_request);
+  SendBrowseMessage(1, short_packet);
+}
+
 }  // namespace avrcp
 }  // namespace bluetooth
 
diff --git a/service/adapter.cc b/service/adapter.cc
index 669aeff..4d414dd 100644
--- a/service/adapter.cc
+++ b/service/adapter.cc
@@ -230,7 +230,7 @@
 
   bool IsEnabled() const override { return state_.load() == ADAPTER_STATE_ON; }
 
-  bool Enable(bool start_restricted) override {
+  bool Enable() override {
     AdapterState current_state = GetState();
     if (current_state != ADAPTER_STATE_OFF) {
       LOG(INFO) << "Adapter not disabled - state: "
@@ -243,8 +243,7 @@
     state_ = ADAPTER_STATE_TURNING_ON;
     NotifyAdapterStateChanged(current_state, state_);
 
-    int status = hal::BluetoothInterface::Get()->GetHALInterface()->enable(
-        start_restricted);
+    int status = hal::BluetoothInterface::Get()->GetHALInterface()->enable();
     if (status != BT_STATUS_SUCCESS) {
       LOG(ERROR) << "Failed to enable Bluetooth - status: "
                  << BtStatusText((const bt_status_t)status);
diff --git a/service/adapter.h b/service/adapter.h
index edb8afe..a4e517c 100644
--- a/service/adapter.h
+++ b/service/adapter.h
@@ -119,10 +119,7 @@
   // to the controller, otherwise returns false. A successful call to this
   // method only means that the enable request has been sent to the Bluetooth
   // controller and does not imply that the operation itself succeeded.
-  // The |start_restricted| flag enables the adapter in restricted mode. In
-  // restricted mode, bonds that are created are marked as restricted in the
-  // config file. These devices are deleted upon leaving restricted mode.
-  virtual bool Enable(bool start_restricted) = 0;
+  virtual bool Enable() = 0;
 
   // Powers off the Bluetooth radio. Returns true, if the disable request was
   // successfully sent to the Bluetooth controller.
diff --git a/service/client/main.cc b/service/client/main.cc
index 43228a4..6458b2d 100644
--- a/service/client/main.cc
+++ b/service/client/main.cc
@@ -389,25 +389,8 @@
 }
 
 void HandleEnable(IBluetooth* bt_iface, const vector<string>& args) {
-  bool is_restricted_mode = false;
-
-  for (const auto& iter : args) {
-    const std::string& arg = iter;
-    if (arg == "-h") {
-      static const char kUsage[] =
-          "Usage: start-adv [flags]\n"
-          "\n"
-          "Flags:\n"
-          "\t--restricted|-r\tStart in restricted mode\n";
-      cout << kUsage << endl;
-      return;
-    } else if (arg == "--restricted" || arg == "-r") {
-      is_restricted_mode = true;
-    }
-  }
-
   bool status;
-  bt_iface->Enable(is_restricted_mode, &status);
+  bt_iface->Enable(&status);
   PrintCommandStatus(status);
 }
 
diff --git a/service/common/android/bluetooth/IBluetooth.aidl b/service/common/android/bluetooth/IBluetooth.aidl
index 3986ad7..46c7654 100644
--- a/service/common/android/bluetooth/IBluetooth.aidl
+++ b/service/common/android/bluetooth/IBluetooth.aidl
@@ -32,7 +32,7 @@
 interface IBluetooth {
   boolean IsEnabled();
   int GetState();
-  boolean Enable(boolean startRestricted);
+  boolean Enable();
   boolean EnableNoAutoConnect();
   boolean Disable();
 
diff --git a/service/daemon.cc b/service/daemon.cc
index a64c2d8..439c2c2 100644
--- a/service/daemon.cc
+++ b/service/daemon.cc
@@ -59,7 +59,7 @@
   // ipc::IPCManager::Delegate implementation:
   void OnIPCHandlerStarted(ipc::IPCManager::Type /* type */) override {
     if (!settings_->EnableOnStart()) return;
-    adapter_->Enable(false /* start_restricted */);
+    adapter_->Enable();
   }
 
   void OnIPCHandlerStopped(ipc::IPCManager::Type /* type */) override {
diff --git a/service/gatt_server.cc b/service/gatt_server.cc
index 52fd1ed..08c4f83 100644
--- a/service/gatt_server.cc
+++ b/service/gatt_server.cc
@@ -68,18 +68,20 @@
 
   std::vector<btgatt_db_element_t> svc;
 
-  svc.push_back({.type = (service.primary() ? BTGATT_DB_PRIMARY_SERVICE
-                                            : BTGATT_DB_SECONDARY_SERVICE),
-                 .uuid = service.uuid()});
+  svc.push_back({
+      .uuid = service.uuid(),
+      .type = (service.primary() ? BTGATT_DB_PRIMARY_SERVICE
+                                 : BTGATT_DB_SECONDARY_SERVICE),
+  });
 
   for (const auto& characteristic : service.characteristics()) {
-    svc.push_back({.type = BTGATT_DB_CHARACTERISTIC,
-                   .uuid = characteristic.uuid(),
+    svc.push_back({.uuid = characteristic.uuid(),
+                   .type = BTGATT_DB_CHARACTERISTIC,
                    .properties = characteristic.properties(),
                    .permissions = characteristic.permissions()});
     for (const auto& descriptor : characteristic.descriptors())
-      svc.push_back({.type = BTGATT_DB_DESCRIPTOR,
-                     .uuid = descriptor.uuid(),
+      svc.push_back({.uuid = descriptor.uuid(),
+                     .type = BTGATT_DB_DESCRIPTOR,
                      .permissions = descriptor.permissions()});
   }
 
diff --git a/service/gatt_server_old.cc b/service/gatt_server_old.cc
index b583d93..cfc394c 100644
--- a/service/gatt_server_old.cc
+++ b/service/gatt_server_old.cc
@@ -136,8 +136,10 @@
 
   g_internal->server_if = server_if;
 
-  pending_svc_decl.push_back(
-      {.type = BTGATT_DB_PRIMARY_SERVICE, .uuid = app_uuid});
+  pending_svc_decl.push_back({
+      .uuid = app_uuid,
+      .type = BTGATT_DB_PRIMARY_SERVICE,
+  });
 }
 
 void ServiceAddedCallback(int status, int server_if,
@@ -502,8 +504,8 @@
 bt_status_t ServerInternals::AddCharacteristic(const Uuid& uuid,
                                                uint8_t properties,
                                                uint16_t permissions) {
-  pending_svc_decl.push_back({.type = BTGATT_DB_CHARACTERISTIC,
-                              .uuid = uuid,
+  pending_svc_decl.push_back({.uuid = uuid,
+                              .type = BTGATT_DB_CHARACTERISTIC,
                               .properties = properties,
                               .permissions = permissions});
   return BT_STATUS_SUCCESS;
diff --git a/service/hal/bluetooth_interface.cc b/service/hal/bluetooth_interface.cc
index a08fb7b..5ca220c 100644
--- a/service/hal/bluetooth_interface.cc
+++ b/service/hal/bluetooth_interface.cc
@@ -254,7 +254,7 @@
 
     // Initialize the Bluetooth interface. Set up the adapter (Bluetooth DM) API
     // callbacks.
-    status = hal_iface_->init(&bt_callbacks);
+    status = hal_iface_->init(&bt_callbacks, false, false);
     if (status != BT_STATUS_SUCCESS) {
       LOG(ERROR) << "Failed to initialize Bluetooth stack";
       return false;
diff --git a/service/hal/fake_bluetooth_interface.cc b/service/hal/fake_bluetooth_interface.cc
index 7979155..f1d03ad 100644
--- a/service/hal/fake_bluetooth_interface.cc
+++ b/service/hal/fake_bluetooth_interface.cc
@@ -23,7 +23,7 @@
 
 FakeBluetoothInterface::Manager g_hal_manager;
 
-int FakeHALEnable(bool start_restricted) {
+int FakeHALEnable() {
   return g_hal_manager.enable_succeed ? BT_STATUS_SUCCESS : BT_STATUS_FAIL;
 }
 
diff --git a/service/ipc/binder/bluetooth_binder_server.cc b/service/ipc/binder/bluetooth_binder_server.cc
index ca36019..097abb7 100644
--- a/service/ipc/binder/bluetooth_binder_server.cc
+++ b/service/ipc/binder/bluetooth_binder_server.cc
@@ -64,10 +64,9 @@
   return Status::ok();
 }
 
-Status BluetoothBinderServer::Enable(bool start_restricted,
-                                     bool* _aidl_return) {
+Status BluetoothBinderServer::Enable(bool* _aidl_return) {
   VLOG(2) << __func__;
-  *_aidl_return = adapter_->Enable(start_restricted);
+  *_aidl_return = adapter_->Enable();
   return Status::ok();
 }
 
diff --git a/service/ipc/binder/bluetooth_binder_server.h b/service/ipc/binder/bluetooth_binder_server.h
index bfeb589..7131e8b 100644
--- a/service/ipc/binder/bluetooth_binder_server.h
+++ b/service/ipc/binder/bluetooth_binder_server.h
@@ -71,7 +71,7 @@
   // IBluetooth overrides:
   Status IsEnabled(bool* _aidl_return) override;
   Status GetState(int32_t* _aidl_return) override;
-  Status Enable(bool start_restricted, bool* _aidl_return) override;
+  Status Enable(bool* _aidl_return) override;
   Status EnableNoAutoConnect(bool* _aidl_return) override;
   Status Disable(bool* _aidl_return) override;
 
diff --git a/service/low_energy_client.cc b/service/low_energy_client.cc
index cc127c3..cb8bcf1 100644
--- a/service/low_energy_client.cc
+++ b/service/low_energy_client.cc
@@ -188,8 +188,8 @@
 
   if (!bda) return;
 
-  const char* addr = BtAddrString(bda).c_str();
-  if (delegate_) delegate_->OnMtuChanged(this, status, addr, mtu);
+  std::string addr = BtAddrString(bda);
+  if (delegate_) delegate_->OnMtuChanged(this, status, addr.c_str(), mtu);
 }
 
 // LowEnergyClientFactory implementation
diff --git a/service/test/adapter_unittest.cc b/service/test/adapter_unittest.cc
index e6f5d10..b1cedc1 100644
--- a/service/test/adapter_unittest.cc
+++ b/service/test/adapter_unittest.cc
@@ -124,12 +124,12 @@
   EXPECT_EQ(bluetooth::ADAPTER_STATE_OFF, adapter_->GetState());
 
   // Enable fails at HAL level
-  EXPECT_FALSE(adapter_->Enable(false));
+  EXPECT_FALSE(adapter_->Enable());
   EXPECT_EQ(bluetooth::ADAPTER_STATE_OFF, adapter_->GetState());
 
   // Enable success
   fake_hal_manager_->enable_succeed = true;
-  EXPECT_TRUE(adapter_->Enable(false));
+  EXPECT_TRUE(adapter_->Enable());
 
   // Should have received a state update.
   EXPECT_EQ(bluetooth::ADAPTER_STATE_OFF, observer.prev_state());
@@ -137,7 +137,7 @@
 
   // Enable fails because not disabled
   EXPECT_EQ(bluetooth::ADAPTER_STATE_TURNING_ON, adapter_->GetState());
-  EXPECT_FALSE(adapter_->Enable(false));
+  EXPECT_FALSE(adapter_->Enable());
 
   // Adapter state updates properly
   fake_hal_iface_->NotifyAdapterStateChanged(BT_STATE_ON);
@@ -148,7 +148,7 @@
   EXPECT_EQ(bluetooth::ADAPTER_STATE_ON, observer.cur_state());
 
   // Enable fails because already enabled
-  EXPECT_FALSE(adapter_->Enable(false));
+  EXPECT_FALSE(adapter_->Enable());
 }
 
 TEST_F(AdapterTest, Disable) {
diff --git a/service/test/gatt_server_unittest.cc b/service/test/gatt_server_unittest.cc
index 7d7fec2..e19742d 100644
--- a/service/test/gatt_server_unittest.cc
+++ b/service/test/gatt_server_unittest.cc
@@ -267,14 +267,14 @@
     desc_handle_ = 0x0004;
 
     std::vector<btgatt_db_element_t> service_with_handles = {
-        {.type = BTGATT_DB_PRIMARY_SERVICE,
-         .uuid = uuid0,
+        {.uuid = uuid0,
+         .type = BTGATT_DB_PRIMARY_SERVICE,
          .attribute_handle = srvc_handle_},
-        {.type = BTGATT_DB_CHARACTERISTIC,
-         .uuid = uuid1,
+        {.uuid = uuid1,
+         .type = BTGATT_DB_CHARACTERISTIC,
          .attribute_handle = char_handle_},
-        {.type = BTGATT_DB_DESCRIPTOR,
-         .uuid = uuid2,
+        {.uuid = uuid2,
+         .type = BTGATT_DB_DESCRIPTOR,
          .attribute_handle = desc_handle_},
     };
 
diff --git a/service/test/mock_adapter.h b/service/test/mock_adapter.h
index 2c496b1..b652026 100644
--- a/service/test/mock_adapter.h
+++ b/service/test/mock_adapter.h
@@ -32,7 +32,7 @@
   MOCK_METHOD1(RemoveObserver, void(Observer*));
   MOCK_CONST_METHOD0(GetState, AdapterState());
   MOCK_CONST_METHOD0(IsEnabled, bool());
-  MOCK_METHOD1(Enable, bool(bool));
+  MOCK_METHOD0(Enable, bool());
   MOCK_METHOD0(Disable, bool());
   MOCK_CONST_METHOD0(GetName, std::string());
   MOCK_METHOD1(SetName, bool(const std::string&));
diff --git a/stack/Android.bp b/stack/Android.bp
index 53076bb..825459b 100644
--- a/stack/Android.bp
+++ b/stack/Android.bp
@@ -46,7 +46,6 @@
         "system/bt/bta/sys",
         "system/bt/utils/include",
     ],
-    cflags: ["-Wno-implicit-fallthrough"],
     srcs: crypto_toolbox_srcs + [
         "a2dp/a2dp_aac.cc",
         "a2dp/a2dp_aac_decoder.cc",
@@ -202,23 +201,44 @@
         "test/stack_a2dp_test.cc",
     ],
     shared_libs: [
-        "libcrypto",
+        "android.hardware.bluetooth@1.0",
+        "android.hardware.bluetooth.a2dp@1.0",
+        "android.hardware.bluetooth.audio@2.0",
+        "libaudioclient",
+        "libcutils",
+        "libdl",
+        "libfmq",
         "libhidlbase",
         "liblog",
+        "libprocessgroup",
         "libprotobuf-cpp-lite",
-        "libcutils",
         "libutils",
+        "libtinyxml2",
+        "libz",
+        "libcrypto",
+        "android.hardware.keymaster@4.0",
+        "android.hardware.keymaster@3.0",
+        "libkeymaster4support",
+        "libkeystore_aidl",
+        "libkeystore_binder",
+        "libkeystore_parcelables",
     ],
     static_libs: [
+        "libbt-audio-hal-interface",
+        "libbtcore",
         "libbt-bta",
         "libbt-stack",
         "libbt-common",
         "libbt-sbc-decoder",
         "libbt-sbc-encoder",
+        "libbt-utils",
+        "libbtif",
         "libFraunhoferAAC",
+        "libg722codec",
         "libbtdevice",
         "libbt-hci",
         "libosi",
+        "libudrv-uipc",
         "libbt-protos-lite",
     ],
     whole_static_libs: [
@@ -257,6 +277,7 @@
         "rfcomm/rfc_ts_frames.cc",
         "rfcomm/rfc_utils.cc",
         "test/common/mock_btm_layer.cc",
+        "test/common/mock_btsnoop_module.cc",
         "test/common/mock_btu_layer.cc",
         "test/common/mock_l2cap_layer.cc",
         "test/common/stack_test_packet_utils.cc",
diff --git a/stack/a2dp/a2dp_vendor_aptx_encoder.cc b/stack/a2dp/a2dp_vendor_aptx_encoder.cc
index e7d0145..0d605c0 100644
--- a/stack/a2dp/a2dp_vendor_aptx_encoder.cc
+++ b/stack/a2dp/a2dp_vendor_aptx_encoder.cc
@@ -26,7 +26,6 @@
 #include "a2dp_vendor.h"
 #include "a2dp_vendor_aptx.h"
 #include "bt_common.h"
-#include "common/scoped_scs_exit.h"
 #include "common/time_util.h"
 #include "osi/include/log.h"
 #include "osi/include/osi.h"
@@ -55,25 +54,6 @@
 static tAPTX_ENCODER_ENCODE_STEREO aptx_encoder_encode_stereo_func;
 static tAPTX_ENCODER_SIZEOF_PARAMS aptx_encoder_sizeof_params_func;
 
-__attribute__((no_sanitize("shadow-call-stack")))
-static int aptx_encoder_init(void* state, short endian) {
-  ScopedSCSExit x;
-  return aptx_encoder_init_func(state, endian);
-}
-
-__attribute__((no_sanitize("shadow-call-stack")))
-static int aptx_encoder_encode_stereo(void* state, void* pcmL, void* pcmR,
-                                      void* buffer) {
-  ScopedSCSExit x;
-  return aptx_encoder_encode_stereo_func(state, pcmL, pcmR, buffer);
-}
-
-__attribute__((no_sanitize("shadow-call-stack")))
-static int aptx_encoder_sizeof_params() {
-  ScopedSCSExit x;
-  return aptx_encoder_sizeof_params_func();
-}
-
 // offset
 #if (BTA_AV_CO_CP_SCMS_T == TRUE)
 #define A2DP_APTX_OFFSET (AVDT_MEDIA_OFFSET + 1)
@@ -212,9 +192,9 @@
 #endif
 
   a2dp_aptx_encoder_cb.aptx_encoder_state =
-      osi_malloc(aptx_encoder_sizeof_params());
+      osi_malloc(aptx_encoder_sizeof_params_func());
   if (a2dp_aptx_encoder_cb.aptx_encoder_state != NULL) {
-    aptx_encoder_init(a2dp_aptx_encoder_cb.aptx_encoder_state, 0);
+    aptx_encoder_init_func(a2dp_aptx_encoder_cb.aptx_encoder_state, 0);
   } else {
     LOG_ERROR(LOG_TAG, "%s: Cannot allocate aptX encoder state", __func__);
     // TODO: Return an error?
@@ -486,8 +466,8 @@
       pcmR[i] = (uint16_t) * (data16_in + ((2 * j) + 1));
     }
 
-    aptx_encoder_encode_stereo(a2dp_aptx_encoder_cb.aptx_encoder_state, &pcmL,
-                               &pcmR, &encoded_sample);
+    aptx_encoder_encode_stereo_func(a2dp_aptx_encoder_cb.aptx_encoder_state,
+                                    &pcmL, &pcmR, &encoded_sample);
 
     data_out[*data_out_index + 0] = (uint8_t)((encoded_sample[0] >> 8) & 0xff);
     data_out[*data_out_index + 1] = (uint8_t)((encoded_sample[0] >> 0) & 0xff);
diff --git a/stack/a2dp/a2dp_vendor_aptx_hd_encoder.cc b/stack/a2dp/a2dp_vendor_aptx_hd_encoder.cc
index d271e0d..fb782dd 100644
--- a/stack/a2dp/a2dp_vendor_aptx_hd_encoder.cc
+++ b/stack/a2dp/a2dp_vendor_aptx_hd_encoder.cc
@@ -26,7 +26,6 @@
 #include "a2dp_vendor.h"
 #include "a2dp_vendor_aptx_hd.h"
 #include "bt_common.h"
-#include "common/scoped_scs_exit.h"
 #include "common/time_util.h"
 #include "osi/include/log.h"
 #include "osi/include/osi.h"
@@ -56,25 +55,6 @@
 static tAPTX_HD_ENCODER_ENCODE_STEREO aptx_hd_encoder_encode_stereo_func;
 static tAPTX_HD_ENCODER_SIZEOF_PARAMS aptx_hd_encoder_sizeof_params_func;
 
-__attribute__((no_sanitize("shadow-call-stack")))
-static int aptx_hd_encoder_init(void* state, short endian) {
-  ScopedSCSExit x;
-  return aptx_hd_encoder_init_func(state, endian);
-}
-
-__attribute__((no_sanitize("shadow-call-stack")))
-static int aptx_hd_encoder_encode_stereo(void* state, void* pcmL, void* pcmR,
-                                         void* buffer) {
-  ScopedSCSExit x;
-  return aptx_hd_encoder_encode_stereo_func(state, pcmL, pcmR, buffer);
-}
-
-__attribute__((no_sanitize("shadow-call-stack")))
-static int aptx_hd_encoder_sizeof_params() {
-  ScopedSCSExit x;
-  return aptx_hd_encoder_sizeof_params_func();
-}
-
 // offset
 #if (BTA_AV_CO_CP_SCMS_T == TRUE)
 #define A2DP_APTX_HD_OFFSET (AVDT_MEDIA_OFFSET + 1)
@@ -213,9 +193,9 @@
 #endif
 
   a2dp_aptx_hd_encoder_cb.aptx_hd_encoder_state =
-      osi_malloc(aptx_hd_encoder_sizeof_params());
+      osi_malloc(aptx_hd_encoder_sizeof_params_func());
   if (a2dp_aptx_hd_encoder_cb.aptx_hd_encoder_state != NULL) {
-    aptx_hd_encoder_init(a2dp_aptx_hd_encoder_cb.aptx_hd_encoder_state, 0);
+    aptx_hd_encoder_init_func(a2dp_aptx_hd_encoder_cb.aptx_hd_encoder_state, 0);
   } else {
     LOG_ERROR(LOG_TAG, "%s: Cannot allocate aptX-HD encoder state", __func__);
     // TODO: Return an error?
@@ -480,7 +460,7 @@
       p += 3;
     }
 
-    aptx_hd_encoder_encode_stereo(
+    aptx_hd_encoder_encode_stereo_func(
         a2dp_aptx_hd_encoder_cb.aptx_hd_encoder_state, &pcmL, &pcmR,
         &encoded_sample);
 
diff --git a/stack/avct/avct_api.cc b/stack/avct/avct_api.cc
index 5ced71f..51e2daf 100644
--- a/stack/avct/avct_api.cc
+++ b/stack/avct/avct_api.cc
@@ -56,7 +56,8 @@
   AVCT_TRACE_API("AVCT_Register");
 
   /* register PSM with L2CAP */
-  L2CA_Register(AVCT_PSM, (tL2CAP_APPL_INFO*)&avct_l2c_appl);
+  L2CA_Register(AVCT_PSM, (tL2CAP_APPL_INFO*)&avct_l2c_appl,
+                true /* enable_snoop */);
 
   /* set security level */
   BTM_SetSecurityLevel(true, "", BTM_SEC_SERVICE_AVCTP, sec_mask, AVCT_PSM, 0,
@@ -68,7 +69,8 @@
   memset(&avct_cb, 0, sizeof(tAVCT_CB));
 
   /* Include the browsing channel which uses eFCR */
-  L2CA_Register(AVCT_BR_PSM, (tL2CAP_APPL_INFO*)&avct_l2c_br_appl);
+  L2CA_Register(AVCT_BR_PSM, (tL2CAP_APPL_INFO*)&avct_l2c_br_appl,
+                true /*enable_snoop*/);
 
   /* AVCTP browsing channel uses the same security service as AVCTP control
    * channel */
diff --git a/stack/avct/avct_lcb_act.cc b/stack/avct/avct_lcb_act.cc
index faa098b..eec049d 100644
--- a/stack/avct/avct_lcb_act.cc
+++ b/stack/avct/avct_lcb_act.cc
@@ -53,6 +53,12 @@
   uint8_t pkt_type;
   BT_HDR* p_ret;
 
+  if (p_buf->len < 1) {
+    osi_free(p_buf);
+    p_ret = NULL;
+    return p_ret;
+  }
+
   /* parse the message header */
   p = (uint8_t*)(p_buf + 1) + p_buf->offset;
   pkt_type = AVCT_PKT_TYPE(p);
diff --git a/stack/avdt/avdt_api.cc b/stack/avdt/avdt_api.cc
index 903862e..9350c31 100644
--- a/stack/avdt/avdt_api.cc
+++ b/stack/avdt/avdt_api.cc
@@ -90,7 +90,8 @@
  ******************************************************************************/
 void AVDT_Register(AvdtpRcb* p_reg, tAVDT_CTRL_CBACK* p_cback) {
   /* register PSM with L2CAP */
-  L2CA_Register(AVDT_PSM, (tL2CAP_APPL_INFO*)&avdt_l2c_appl);
+  L2CA_Register(AVDT_PSM, (tL2CAP_APPL_INFO*)&avdt_l2c_appl,
+                true /* enable_snoop */);
 
   /* set security level */
   BTM_SetSecurityLevel(true, "", BTM_SEC_SERVICE_AVDTP, p_reg->sec_mask,
diff --git a/stack/avdt/avdt_msg.cc b/stack/avdt/avdt_msg.cc
index 0ac9b64..853f369 100644
--- a/stack/avdt/avdt_msg.cc
+++ b/stack/avdt/avdt_msg.cc
@@ -586,6 +586,10 @@
     /* parse individual information elements with additional parameters */
     switch (elem) {
       case AVDT_CAT_RECOV:
+        if ((p_end - p) < 3) {
+          err = AVDT_ERR_PAYLOAD;
+          break;
+        }
         p_cfg->recov_type = *p++;
         p_cfg->recov_mrws = *p++;
         p_cfg->recov_mnmp = *p++;
@@ -617,6 +621,10 @@
         break;
 
       case AVDT_CAT_HDRCMP:
+        if ((p_end - p) < 1) {
+          err = AVDT_ERR_PAYLOAD;
+          break;
+        }
         p_cfg->hdrcmp_mask = *p++;
         break;
 
@@ -1191,6 +1199,14 @@
 
   /* parse the message header */
   p = (uint8_t*)(p_buf + 1) + p_buf->offset;
+
+  /* Check if is valid length */
+  if (p_buf->len < 1) {
+    android_errorWriteLog(0x534e4554, "78287084");
+    osi_free(p_buf);
+    p_ret = NULL;
+    return p_ret;
+  }
   AVDT_MSG_PRS_PKT_TYPE(p, pkt_type);
 
   /* quick sanity check on length */
@@ -1499,8 +1515,8 @@
   uint8_t pkt_type;
   uint8_t msg_type;
   uint8_t sig = 0;
-  tAVDT_MSG msg;
-  AvdtpSepConfig cfg;
+  tAVDT_MSG msg{};
+  AvdtpSepConfig cfg{};
   uint8_t err;
   uint8_t evt = 0;
   uint8_t scb_hdl;
diff --git a/stack/avrc/avrc_bld_tg.cc b/stack/avrc/avrc_bld_tg.cc
index b28c9e2..1dac160 100644
--- a/stack/avrc/avrc_bld_tg.cc
+++ b/stack/avrc/avrc_bld_tg.cc
@@ -1338,8 +1338,7 @@
     case AVRC_OP_VENDOR:
       /* reserved 0, packet_type 0 */
       UINT8_TO_BE_STREAM(p_data, 0);
-    /* continue to the next "case to add length */
-
+      [[fallthrough]];
     case AVRC_OP_BROWSE:
       /* add fixed lenth - 0 */
       UINT16_TO_BE_STREAM(p_data, 0);
diff --git a/stack/avrc/avrc_pars_ct.cc b/stack/avrc/avrc_pars_ct.cc
index 80dc882..39ed921 100644
--- a/stack/avrc/avrc_pars_ct.cc
+++ b/stack/avrc/avrc_pars_ct.cc
@@ -806,7 +806,7 @@
       if (len < min_len) goto length_error;
       BE_STREAM_TO_UINT32(p_result->get_play_status.song_len, p);
       BE_STREAM_TO_UINT32(p_result->get_play_status.song_pos, p);
-      BE_STREAM_TO_UINT8(p_result->get_play_status.status, p);
+      BE_STREAM_TO_UINT8(p_result->get_play_status.play_status, p);
       break;
 
     case AVRC_PDU_SET_ADDRESSED_PLAYER:
diff --git a/stack/avrc/avrc_pars_tg.cc b/stack/avrc/avrc_pars_tg.cc
index c0504ee..22471bd 100644
--- a/stack/avrc/avrc_pars_tg.cc
+++ b/stack/avrc/avrc_pars_tg.cc
@@ -135,15 +135,16 @@
       if (!AVRC_IS_VALID_CAP_ID(p_result->get_caps.capability_id))
         status = AVRC_STS_BAD_PARAM;
       else if (len != 1)
-        status = AVRC_STS_INTERNAL_ERR;
+        return AVRC_STS_INTERNAL_ERR;
       break;
 
     case AVRC_PDU_LIST_PLAYER_APP_ATTR: /* 0x11 */
       /* no additional parameters */
-      if (len != 0) status = AVRC_STS_INTERNAL_ERR;
+      if (len != 0) return AVRC_STS_INTERNAL_ERR;
       break;
 
     case AVRC_PDU_LIST_PLAYER_APP_VALUES: /* 0x12 */
+      if (len == 0) return AVRC_STS_INTERNAL_ERR;
       p_result->list_app_values.attr_id = *p++;
       if (!AVRC_IS_VALID_ATTRIBUTE(p_result->list_app_values.attr_id))
         status = AVRC_STS_BAD_PARAM;
@@ -153,6 +154,7 @@
 
     case AVRC_PDU_GET_CUR_PLAYER_APP_VALUE: /* 0x13 */
     case AVRC_PDU_GET_PLAYER_APP_ATTR_TEXT: /* 0x15 */
+      if (len == 0) return AVRC_STS_INTERNAL_ERR;
       BE_STREAM_TO_UINT8(p_result->get_cur_app_val.num_attr, p);
       if (len != (p_result->get_cur_app_val.num_attr + 1)) {
         status = AVRC_STS_INTERNAL_ERR;
@@ -177,6 +179,7 @@
       break;
 
     case AVRC_PDU_SET_PLAYER_APP_VALUE: /* 0x14 */
+      if (len == 0) return AVRC_STS_INTERNAL_ERR;
       BE_STREAM_TO_UINT8(p_result->set_app_val.num_val, p);
       size_needed = sizeof(tAVRC_APP_SETTING);
       if (p_buf && (len == ((p_result->set_app_val.num_val << 1) + 1))) {
@@ -208,7 +211,7 @@
 
     case AVRC_PDU_GET_PLAYER_APP_VALUE_TEXT: /* 0x16 */
       if (len < 3)
-        status = AVRC_STS_INTERNAL_ERR;
+        return AVRC_STS_INTERNAL_ERR;
       else {
         BE_STREAM_TO_UINT8(p_result->get_app_val_txt.attr_id, p);
         if (!AVRC_IS_VALID_ATTRIBUTE(p_result->get_app_val_txt.attr_id))
@@ -240,7 +243,7 @@
 
     case AVRC_PDU_INFORM_DISPLAY_CHARSET: /* 0x17 */
       if (len < 3)
-        status = AVRC_STS_INTERNAL_ERR;
+        return AVRC_STS_INTERNAL_ERR;
       else {
         BE_STREAM_TO_UINT8(p_result->inform_charset.num_id, p);
         if ((len - 1 /* num_id */) != p_result->inform_charset.num_id * 2)
@@ -258,7 +261,7 @@
 
     case AVRC_PDU_INFORM_BATTERY_STAT_OF_CT: /* 0x18 */
       if (len != 1)
-        status = AVRC_STS_INTERNAL_ERR;
+        return AVRC_STS_INTERNAL_ERR;
       else {
         p_result->inform_battery_status.battery_status = *p++;
         if (!AVRC_IS_VALID_BATTERY_STATUS(
@@ -269,7 +272,7 @@
 
     case AVRC_PDU_GET_ELEMENT_ATTR: /* 0x20 */
       if (len < 9)                  /* UID/8 and num_attr/1 */
-        status = AVRC_STS_INTERNAL_ERR;
+        return AVRC_STS_INTERNAL_ERR;
       else {
         BE_STREAM_TO_UINT32(u32, p);
         BE_STREAM_TO_UINT32(u32_2, p);
@@ -293,12 +296,12 @@
 
     case AVRC_PDU_GET_PLAY_STATUS: /* 0x30 */
       /* no additional parameters */
-      if (len != 0) status = AVRC_STS_INTERNAL_ERR;
+      if (len != 0) return AVRC_STS_INTERNAL_ERR;
       break;
 
     case AVRC_PDU_REGISTER_NOTIFICATION: /* 0x31 */
       if (len != 5)
-        status = AVRC_STS_INTERNAL_ERR;
+        return AVRC_STS_INTERNAL_ERR;
       else {
         BE_STREAM_TO_UINT8(p_result->reg_notif.event_id, p);
         BE_STREAM_TO_UINT32(p_result->reg_notif.param, p);
@@ -307,21 +310,21 @@
 
     case AVRC_PDU_SET_ABSOLUTE_VOLUME: /* 0x50 */
       if (len != 1)
-        status = AVRC_STS_INTERNAL_ERR;
+        return AVRC_STS_INTERNAL_ERR;
       else
         p_result->volume.volume = *p++;
       break;
 
     case AVRC_PDU_REQUEST_CONTINUATION_RSP: /* 0x40 */
       if (len != 1) {
-        status = AVRC_STS_INTERNAL_ERR;
+        return AVRC_STS_INTERNAL_ERR;
       }
       BE_STREAM_TO_UINT8(p_result->continu.target_pdu, p);
       break;
 
     case AVRC_PDU_ABORT_CONTINUATION_RSP: /* 0x41 */
       if (len != 1) {
-        status = AVRC_STS_INTERNAL_ERR;
+        return AVRC_STS_INTERNAL_ERR;
       }
       BE_STREAM_TO_UINT8(p_result->abort.target_pdu, p);
       break;
@@ -330,14 +333,14 @@
       if (len != 2) {
         AVRC_TRACE_ERROR("AVRC_PDU_SET_ADDRESSED_PLAYER length is incorrect:%d",
                          len);
-        status = AVRC_STS_INTERNAL_ERR;
+        return AVRC_STS_INTERNAL_ERR;
       }
       BE_STREAM_TO_UINT16(p_result->addr_player.player_id, p);
       break;
 
     case AVRC_PDU_PLAY_ITEM:          /* 0x74 */
     case AVRC_PDU_ADD_TO_NOW_PLAYING: /* 0x90 */
-      if (len != (AVRC_UID_SIZE + 3)) status = AVRC_STS_INTERNAL_ERR;
+      if (len != (AVRC_UID_SIZE + 3)) return AVRC_STS_INTERNAL_ERR;
       BE_STREAM_TO_UINT8(p_result->play_item.scope, p);
       if (p_result->play_item.scope > AVRC_SCOPE_NOW_PLAYING) {
         status = AVRC_STS_BAD_SCOPE;
diff --git a/stack/bnep/bnep_api.cc b/stack/bnep/bnep_api.cc
index 0e7b692..809d0b2 100644
--- a/stack/bnep/bnep_api.cc
+++ b/stack/bnep/bnep_api.cc
@@ -340,7 +340,7 @@
   p_bcb = &(bnep_cb.bcb[handle - 1]);
   /* Check MTU size */
   if (p_buf->len > BNEP_MTU_SIZE) {
-    BNEP_TRACE_ERROR("BNEP_Write() length %d exceeded MTU %d", p_buf->len,
+    BNEP_TRACE_ERROR("%s length %d exceeded MTU %d", __func__, p_buf->len,
                      BNEP_MTU_SIZE);
     osi_free(p_buf);
     return (BNEP_MTU_EXCEDED);
@@ -349,7 +349,7 @@
   /* Check if the packet should be filtered out */
   p_data = (uint8_t*)(p_buf + 1) + p_buf->offset;
   if (bnep_is_packet_allowed(p_bcb, p_dest_addr, protocol, fw_ext_present,
-                             p_data) != BNEP_SUCCESS) {
+                             p_data, p_buf->len) != BNEP_SUCCESS) {
     /*
     ** If packet is filtered and ext headers are present
     ** drop the data and forward the ext headers
@@ -361,6 +361,11 @@
       org_len = p_buf->len;
       new_len = 0;
       do {
+        if ((new_len + 2) > org_len) {
+          osi_free(p_buf);
+          return BNEP_IGNORE_CMD;
+        }
+
         ext = *p_data++;
         length = *p_data++;
         p_data += length;
@@ -437,7 +442,7 @@
 
   /* Check MTU size. Consider the possibility of having extension headers */
   if (len > BNEP_MTU_SIZE) {
-    BNEP_TRACE_ERROR("BNEP_Write() length %d exceeded MTU %d", len,
+    BNEP_TRACE_ERROR("%s length %d exceeded MTU %d", __func__, len,
                      BNEP_MTU_SIZE);
     return (BNEP_MTU_EXCEDED);
   }
@@ -448,7 +453,7 @@
 
   /* Check if the packet should be filtered out */
   if (bnep_is_packet_allowed(p_bcb, p_dest_addr, protocol, fw_ext_present,
-                             p_data) != BNEP_SUCCESS) {
+                             p_data, len) != BNEP_SUCCESS) {
     /*
     ** If packet is filtered and ext headers are present
     ** drop the data and forward the ext headers
@@ -461,6 +466,10 @@
       new_len = 0;
       p = p_data;
       do {
+        if ((new_len + 2) > org_len) {
+          return BNEP_IGNORE_CMD;
+        }
+
         ext = *p_data++;
         length = *p_data++;
         p_data += length;
diff --git a/stack/bnep/bnep_int.h b/stack/bnep/bnep_int.h
index 2587147..5bba15d 100644
--- a/stack/bnep/bnep_int.h
+++ b/stack/bnep/bnep_int.h
@@ -229,7 +229,7 @@
 extern tBNEP_RESULT bnep_is_packet_allowed(tBNEP_CONN* p_bcb,
                                            const RawAddress& p_dest_addr,
                                            uint16_t protocol,
-                                           bool fw_ext_present,
-                                           uint8_t* p_data);
+                                           bool fw_ext_present, uint8_t* p_data,
+                                           uint16_t org_len);
 
 #endif
diff --git a/stack/bnep/bnep_main.cc b/stack/bnep/bnep_main.cc
index ae6c51b..265ec79 100644
--- a/stack/bnep/bnep_main.cc
+++ b/stack/bnep/bnep_main.cc
@@ -94,7 +94,8 @@
   bnep_cb.reg_info.pL2CA_CongestionStatus_Cb = bnep_congestion_ind;
 
   /* Now, register with L2CAP */
-  if (!L2CA_Register(BT_PSM_BNEP, &bnep_cb.reg_info)) {
+  if (!L2CA_Register(BT_PSM_BNEP, &bnep_cb.reg_info,
+                     false /* enable_snoop */)) {
     BNEP_TRACE_ERROR("BNEP - Registration failed");
     return BNEP_SECURITY_FAIL;
   }
diff --git a/stack/bnep/bnep_utils.cc b/stack/bnep/bnep_utils.cc
index 6d6d709..ac74ce0 100644
--- a/stack/bnep/bnep_utils.cc
+++ b/stack/bnep/bnep_utils.cc
@@ -1259,23 +1259,33 @@
 tBNEP_RESULT bnep_is_packet_allowed(tBNEP_CONN* p_bcb,
                                     const RawAddress& p_dest_addr,
                                     uint16_t protocol, bool fw_ext_present,
-                                    uint8_t* p_data) {
+                                    uint8_t* p_data, uint16_t org_len) {
   if (p_bcb->rcvd_num_filters) {
     uint16_t i, proto;
 
     /* Findout the actual protocol to check for the filtering */
     proto = protocol;
     if (proto == BNEP_802_1_P_PROTOCOL) {
+      uint16_t new_len = 0;
       if (fw_ext_present) {
         uint8_t len, ext;
         /* parse the extension headers and findout actual protocol */
         do {
+          if ((new_len + 2) > org_len) {
+            return BNEP_IGNORE_CMD;
+          }
+
           ext = *p_data++;
           len = *p_data++;
           p_data += len;
 
+          new_len += (len + 2);
+
         } while (ext & 0x80);
       }
+      if ((new_len + 4) > org_len) {
+        return BNEP_IGNORE_CMD;
+      }
       p_data += 2;
       BE_STREAM_TO_UINT16(proto, p_data);
     }
diff --git a/stack/btm/ble_advertiser_hci_interface.cc b/stack/btm/ble_advertiser_hci_interface.cc
index dddf8d4..fbf8d27 100644
--- a/stack/btm/ble_advertiser_hci_interface.cc
+++ b/stack/btm/ble_advertiser_hci_interface.cc
@@ -97,7 +97,7 @@
 class BleAdvertiserVscHciInterfaceImpl : public BleAdvertiserHciInterface {
   void SendAdvCmd(const base::Location& posted_from, uint8_t param_len,
                   uint8_t* param_buf, status_cb command_complete) {
-    btu_hcif_send_cmd_with_cb(posted_from, HCI_BLE_MULTI_ADV_OCF, param_buf,
+    btu_hcif_send_cmd_with_cb(posted_from, HCI_BLE_MULTI_ADV, param_buf,
                               param_len,
                               base::Bind(&btm_ble_multi_adv_vsc_cmpl_cback,
                                          param_buf[0], command_complete));
diff --git a/stack/btm/btm_acl.cc b/stack/btm/btm_acl.cc
index dcb2fb4..868a2a4 100644
--- a/stack/btm/btm_acl.cc
+++ b/stack/btm/btm_acl.cc
@@ -2607,7 +2607,7 @@
   } else {
     if (!BTM_ACL_IS_CONNECTED(bda)) {
       VLOG(1) << "connecting_bda: " << btm_cb.connecting_bda;
-      if (btm_cb.paging && bda != btm_cb.connecting_bda) {
+      if (btm_cb.paging && bda == btm_cb.connecting_bda) {
         fixed_queue_enqueue(btm_cb.page_queue, p);
       } else {
         p_dev_rec = btm_find_or_alloc_dev(bda);
diff --git a/stack/btm/btm_ble.cc b/stack/btm/btm_ble.cc
index 3f67876..1c4aa37 100644
--- a/stack/btm/btm_ble.cc
+++ b/stack/btm/btm_ble.cc
@@ -39,8 +39,10 @@
 #include "gap_api.h"
 #include "gatt_api.h"
 #include "hcimsgs.h"
-#include "log/log.h"
 #include "l2c_int.h"
+#include "log/log.h"
+#include "main/shim/btm_api.h"
+#include "main/shim/shim.h"
 #include "osi/include/log.h"
 #include "osi/include/osi.h"
 #include "stack/crypto_toolbox/crypto_toolbox.h"
@@ -69,6 +71,11 @@
  ******************************************************************************/
 bool BTM_SecAddBleDevice(const RawAddress& bd_addr, BD_NAME bd_name,
                          tBT_DEVICE_TYPE dev_type, tBLE_ADDR_TYPE addr_type) {
+  if (bluetooth::shim::is_gd_shim_enabled()) {
+    return bluetooth::shim::BTM_SecAddBleDevice(bd_addr, bd_name, dev_type,
+                                                addr_type);
+  }
+
   BTM_TRACE_DEBUG("%s: dev_type=0x%x", __func__, dev_type);
 
   tBTM_SEC_DEV_REC* p_dev_rec = btm_find_dev(bd_addr);
@@ -130,6 +137,10 @@
  ******************************************************************************/
 bool BTM_SecAddBleKey(const RawAddress& bd_addr, tBTM_LE_KEY_VALUE* p_le_key,
                       tBTM_LE_KEY_TYPE key_type) {
+  if (bluetooth::shim::is_gd_shim_enabled()) {
+    return bluetooth::shim::BTM_SecAddBleKey(bd_addr, p_le_key, key_type);
+  }
+
   tBTM_SEC_DEV_REC* p_dev_rec;
   BTM_TRACE_DEBUG("BTM_SecAddBleKey");
   p_dev_rec = btm_find_dev(bd_addr);
@@ -170,6 +181,10 @@
  *
  ******************************************************************************/
 void BTM_BleLoadLocalKeys(uint8_t key_type, tBTM_BLE_LOCAL_KEYS* p_key) {
+  if (bluetooth::shim::is_gd_shim_enabled()) {
+    return bluetooth::shim::BTM_BleLoadLocalKeys(key_type, p_key);
+  }
+
   tBTM_DEVCB* p_devcb = &btm_cb.devcb;
   BTM_TRACE_DEBUG("%s", __func__);
   if (p_key != NULL) {
@@ -192,14 +207,27 @@
 
 /** Returns local device encryption root (ER) */
 const Octet16& BTM_GetDeviceEncRoot() {
+  if (bluetooth::shim::is_gd_shim_enabled()) {
+    return bluetooth::shim::BTM_GetDeviceEncRoot();
+  }
   return btm_cb.devcb.ble_encryption_key_value;
 }
 
 /** Returns local device identity root (IR). */
-const Octet16& BTM_GetDeviceIDRoot() { return btm_cb.devcb.id_keys.irk; }
+const Octet16& BTM_GetDeviceIDRoot() {
+  if (bluetooth::shim::is_gd_shim_enabled()) {
+    return bluetooth::shim::BTM_GetDeviceIDRoot();
+  }
+  return btm_cb.devcb.id_keys.irk;
+}
 
 /** Return local device DHK. */
-const Octet16& BTM_GetDeviceDHK() { return btm_cb.devcb.id_keys.dhk; }
+const Octet16& BTM_GetDeviceDHK() {
+  if (bluetooth::shim::is_gd_shim_enabled()) {
+    return bluetooth::shim::BTM_GetDeviceDHK();
+  }
+  return btm_cb.devcb.id_keys.dhk;
+}
 
 /*******************************************************************************
  *
@@ -214,6 +242,10 @@
 void BTM_ReadConnectionAddr(const RawAddress& remote_bda,
                             RawAddress& local_conn_addr,
                             tBLE_ADDR_TYPE* p_addr_type) {
+  if (bluetooth::shim::is_gd_shim_enabled()) {
+    return bluetooth::shim::BTM_ReadConnectionAddr(remote_bda, local_conn_addr,
+                                                   p_addr_type);
+  }
   tACL_CONN* p_acl = btm_bda_to_acl(remote_bda, BT_TRANSPORT_LE);
 
   if (p_acl == NULL) {
@@ -238,6 +270,9 @@
  *
  ******************************************************************************/
 bool BTM_IsBleConnection(uint16_t conn_handle) {
+  if (bluetooth::shim::is_gd_shim_enabled()) {
+    return bluetooth::shim::BTM_IsBleConnection(conn_handle);
+  }
   uint8_t xx;
   tACL_CONN* p;
 
@@ -268,6 +303,10 @@
 bool BTM_ReadRemoteConnectionAddr(const RawAddress& pseudo_addr,
                                   RawAddress& conn_addr,
                                   tBLE_ADDR_TYPE* p_addr_type) {
+  if (bluetooth::shim::is_gd_shim_enabled()) {
+    return bluetooth::shim::BTM_ReadRemoteConnectionAddr(pseudo_addr, conn_addr,
+                                                         p_addr_type);
+  }
   bool st = true;
 #if (BLE_PRIVACY_SPT == TRUE)
   tACL_CONN* p = btm_bda_to_acl(pseudo_addr, BT_TRANSPORT_LE);
@@ -306,6 +345,9 @@
  *
  ******************************************************************************/
 void BTM_SecurityGrant(const RawAddress& bd_addr, uint8_t res) {
+  if (bluetooth::shim::is_gd_shim_enabled()) {
+    return bluetooth::shim::BTM_SecurityGrant(bd_addr, res);
+  }
   tSMP_STATUS res_smp =
       (res == BTM_SUCCESS) ? SMP_SUCCESS : SMP_REPEATED_ATTEMPTS;
   BTM_TRACE_DEBUG("BTM_SecurityGrant");
@@ -330,6 +372,9 @@
  ******************************************************************************/
 void BTM_BlePasskeyReply(const RawAddress& bd_addr, uint8_t res,
                          uint32_t passkey) {
+  if (bluetooth::shim::is_gd_shim_enabled()) {
+    return bluetooth::shim::BTM_BlePasskeyReply(bd_addr, res, passkey);
+  }
   tBTM_SEC_DEV_REC* p_dev_rec = btm_find_dev(bd_addr);
   tSMP_STATUS res_smp =
       (res == BTM_SUCCESS) ? SMP_SUCCESS : SMP_PASSKEY_ENTRY_FAIL;
@@ -357,6 +402,9 @@
  *
  ******************************************************************************/
 void BTM_BleConfirmReply(const RawAddress& bd_addr, uint8_t res) {
+  if (bluetooth::shim::is_gd_shim_enabled()) {
+    return bluetooth::shim::BTM_BleConfirmReply(bd_addr, res);
+  }
   tBTM_SEC_DEV_REC* p_dev_rec = btm_find_dev(bd_addr);
   tSMP_STATUS res_smp =
       (res == BTM_SUCCESS) ? SMP_SUCCESS : SMP_PASSKEY_ENTRY_FAIL;
@@ -388,6 +436,9 @@
  ******************************************************************************/
 void BTM_BleOobDataReply(const RawAddress& bd_addr, uint8_t res, uint8_t len,
                          uint8_t* p_data) {
+  if (bluetooth::shim::is_gd_shim_enabled()) {
+    return bluetooth::shim::BTM_BleOobDataReply(bd_addr, res, len, p_data);
+  }
   tSMP_STATUS res_smp = (res == BTM_SUCCESS) ? SMP_SUCCESS : SMP_OOB_FAIL;
   tBTM_SEC_DEV_REC* p_dev_rec = btm_find_dev(bd_addr);
 
@@ -417,6 +468,10 @@
  ******************************************************************************/
 void BTM_BleSecureConnectionOobDataReply(const RawAddress& bd_addr,
                                          uint8_t* p_c, uint8_t* p_r) {
+  if (bluetooth::shim::is_gd_shim_enabled()) {
+    return bluetooth::shim::BTM_BleSecureConnectionOobDataReply(bd_addr, p_c,
+                                                                p_r);
+  }
   tBTM_SEC_DEV_REC* p_dev_rec = btm_find_dev(bd_addr);
 
   BTM_TRACE_DEBUG("%s:", __func__);
@@ -453,6 +508,10 @@
  *
  ******************************************************************************/
 void BTM_BleSetConnScanParams(uint32_t scan_interval, uint32_t scan_window) {
+  if (bluetooth::shim::is_gd_shim_enabled()) {
+    return bluetooth::shim::BTM_BleSetConnScanParams(scan_interval,
+                                                     scan_window);
+  }
   tBTM_BLE_CB* p_ble_cb = &btm_cb.ble_ctr_cb;
   bool new_param = false;
 
@@ -498,6 +557,10 @@
 void BTM_BleSetPrefConnParams(const RawAddress& bd_addr, uint16_t min_conn_int,
                               uint16_t max_conn_int, uint16_t slave_latency,
                               uint16_t supervision_tout) {
+  if (bluetooth::shim::is_gd_shim_enabled()) {
+    return bluetooth::shim::BTM_BleSetPrefConnParams(
+        bd_addr, min_conn_int, max_conn_int, slave_latency, supervision_tout);
+  }
   tBTM_SEC_DEV_REC* p_dev_rec = btm_find_dev(bd_addr);
 
   BTM_TRACE_API(
@@ -617,6 +680,10 @@
  ******************************************************************************/
 bool BTM_ReadConnectedTransportAddress(RawAddress* remote_bda,
                                        tBT_TRANSPORT transport) {
+  if (bluetooth::shim::is_gd_shim_enabled()) {
+    return bluetooth::shim::BTM_ReadConnectedTransportAddress(remote_bda,
+                                                              transport);
+  }
   tBTM_SEC_DEV_REC* p_dev_rec = btm_find_dev(*remote_bda);
 
   /* if no device can be located, return */
@@ -655,6 +722,9 @@
  *
  ******************************************************************************/
 void BTM_BleReceiverTest(uint8_t rx_freq, tBTM_CMPL_CB* p_cmd_cmpl_cback) {
+  if (bluetooth::shim::is_gd_shim_enabled()) {
+    return bluetooth::shim::BTM_BleReceiverTest(rx_freq, p_cmd_cmpl_cback);
+  }
   btm_cb.devcb.p_le_test_cmd_cmpl_cb = p_cmd_cmpl_cback;
 
   btsnd_hcic_ble_receiver_test(rx_freq);
@@ -676,6 +746,10 @@
 void BTM_BleTransmitterTest(uint8_t tx_freq, uint8_t test_data_len,
                             uint8_t packet_payload,
                             tBTM_CMPL_CB* p_cmd_cmpl_cback) {
+  if (bluetooth::shim::is_gd_shim_enabled()) {
+    return bluetooth::shim::BTM_BleTransmitterTest(
+        tx_freq, test_data_len, packet_payload, p_cmd_cmpl_cback);
+  }
   btm_cb.devcb.p_le_test_cmd_cmpl_cb = p_cmd_cmpl_cback;
   btsnd_hcic_ble_transmitter_test(tx_freq, test_data_len, packet_payload);
 }
@@ -691,6 +765,9 @@
  *
  ******************************************************************************/
 void BTM_BleTestEnd(tBTM_CMPL_CB* p_cmd_cmpl_cback) {
+  if (bluetooth::shim::is_gd_shim_enabled()) {
+    return bluetooth::shim::BTM_BleTestEnd(p_cmd_cmpl_cback);
+  }
   btm_cb.devcb.p_le_test_cmd_cmpl_cb = p_cmd_cmpl_cback;
 
   btsnd_hcic_ble_test_end();
@@ -720,6 +797,9 @@
  *
  ******************************************************************************/
 bool BTM_UseLeLink(const RawAddress& bd_addr) {
+  if (bluetooth::shim::is_gd_shim_enabled()) {
+    return bluetooth::shim::BTM_UseLeLink(bd_addr);
+  }
   tACL_CONN* p;
   tBT_DEVICE_TYPE dev_type;
   tBLE_ADDR_TYPE addr_type;
@@ -751,6 +831,9 @@
  ******************************************************************************/
 tBTM_STATUS BTM_SetBleDataLength(const RawAddress& bd_addr,
                                  uint16_t tx_pdu_length) {
+  if (bluetooth::shim::is_gd_shim_enabled()) {
+    return bluetooth::shim::BTM_SetBleDataLength(bd_addr, tx_pdu_length);
+  }
   tACL_CONN* p_acl = btm_bda_to_acl(bd_addr, BT_TRANSPORT_LE);
   uint16_t tx_time = BTM_BLE_DATA_TX_TIME_MAX_LEGACY;
 
@@ -819,6 +902,9 @@
 void BTM_BleReadPhy(
     const RawAddress& bd_addr,
     base::Callback<void(uint8_t tx_phy, uint8_t rx_phy, uint8_t status)> cb) {
+  if (bluetooth::shim::is_gd_shim_enabled()) {
+    return bluetooth::shim::BTM_BleReadPhy(bd_addr, cb);
+  }
   BTM_TRACE_DEBUG("%s", __func__);
 
   tACL_CONN* p_acl = btm_bda_to_acl(bd_addr, BT_TRANSPORT_LE);
@@ -866,6 +952,9 @@
  ******************************************************************************/
 tBTM_STATUS BTM_BleSetDefaultPhy(uint8_t all_phys, uint8_t tx_phys,
                                  uint8_t rx_phys) {
+  if (bluetooth::shim::is_gd_shim_enabled()) {
+    return bluetooth::shim::BTM_BleSetDefaultPhy(all_phys, tx_phys, rx_phys);
+  }
   BTM_TRACE_DEBUG("%s: all_phys = 0x%02x, tx_phys = 0x%02x, rx_phys = 0x%02x",
                   __func__, all_phys, tx_phys, rx_phys);
 
@@ -905,6 +994,10 @@
  ******************************************************************************/
 void BTM_BleSetPhy(const RawAddress& bd_addr, uint8_t tx_phys, uint8_t rx_phys,
                    uint16_t phy_options) {
+  if (bluetooth::shim::is_gd_shim_enabled()) {
+    return bluetooth::shim::BTM_BleSetPhy(bd_addr, tx_phys, rx_phys,
+                                          phy_options);
+  }
   tACL_CONN* p_acl = btm_bda_to_acl(bd_addr, BT_TRANSPORT_LE);
 
   if (p_acl == NULL) {
@@ -1670,7 +1763,9 @@
   if (p_dev_rec->p_callback && enc_cback) {
     if (encr_enable)
       btm_sec_dev_rec_cback_event(p_dev_rec, BTM_SUCCESS, true);
-    else if (p_dev_rec->role_master)
+    else if (p_dev_rec->sec_flags & ~BTM_SEC_LE_LINK_KEY_KNOWN) {
+      btm_sec_dev_rec_cback_event(p_dev_rec, BTM_FAILED_ON_SECURITY, true);
+    } else if (p_dev_rec->role_master)
       btm_sec_dev_rec_cback_event(p_dev_rec, BTM_ERR_PROCESSING, true);
   }
   /* to notify GATT to send data if any request is pending */
@@ -2033,6 +2128,10 @@
  ******************************************************************************/
 bool BTM_BleDataSignature(const RawAddress& bd_addr, uint8_t* p_text,
                           uint16_t len, BLE_SIGNATURE signature) {
+  if (bluetooth::shim::is_gd_shim_enabled()) {
+    return bluetooth::shim::BTM_BleDataSignature(bd_addr, p_text, len,
+                                                 signature);
+  }
   tBTM_SEC_DEV_REC* p_rec = btm_find_dev(bd_addr);
 
   BTM_TRACE_DEBUG("%s", __func__);
@@ -2091,6 +2190,10 @@
  ******************************************************************************/
 bool BTM_BleVerifySignature(const RawAddress& bd_addr, uint8_t* p_orig,
                             uint16_t len, uint32_t counter, uint8_t* p_comp) {
+  if (bluetooth::shim::is_gd_shim_enabled()) {
+    return bluetooth::shim::BTM_BleVerifySignature(bd_addr, p_orig, len,
+                                                   counter, p_comp);
+  }
   bool verified = false;
   tBTM_SEC_DEV_REC* p_rec = btm_find_dev(bd_addr);
   uint8_t p_mac[BTM_CMAC_TLEN_SIZE];
@@ -2128,6 +2231,10 @@
 bool BTM_GetLeSecurityState(const RawAddress& bd_addr,
                             uint8_t* p_le_dev_sec_flags,
                             uint8_t* p_le_key_size) {
+  if (bluetooth::shim::is_gd_shim_enabled()) {
+    return bluetooth::shim::BTM_GetLeSecurityState(bd_addr, p_le_dev_sec_flags,
+                                                   p_le_key_size);
+  }
   tBTM_SEC_DEV_REC* p_dev_rec;
   uint16_t dev_rec_sec_flags;
 
@@ -2184,6 +2291,9 @@
  *
  ******************************************************************************/
 bool BTM_BleSecurityProcedureIsRunning(const RawAddress& bd_addr) {
+  if (bluetooth::shim::is_gd_shim_enabled()) {
+    return bluetooth::shim::BTM_BleSecurityProcedureIsRunning(bd_addr);
+  }
   tBTM_SEC_DEV_REC* p_dev_rec = btm_find_dev(bd_addr);
 
   if (p_dev_rec == NULL) {
@@ -2208,6 +2318,9 @@
  *
  ******************************************************************************/
 extern uint8_t BTM_BleGetSupportedKeySize(const RawAddress& bd_addr) {
+  if (bluetooth::shim::is_gd_shim_enabled()) {
+    return bluetooth::shim::BTM_BleGetSupportedKeySize(bd_addr);
+  }
 #if (L2CAP_LE_COC_INCLUDED == TRUE)
   tBTM_SEC_DEV_REC* p_dev_rec = btm_find_dev(bd_addr);
   tBTM_LE_EVT_DATA btm_le_evt_data;
diff --git a/stack/btm/btm_ble_adv_filter.cc b/stack/btm/btm_ble_adv_filter.cc
index f69f1a2..708e7c2 100644
--- a/stack/btm/btm_ble_adv_filter.cc
+++ b/stack/btm/btm_ble_adv_filter.cc
@@ -316,7 +316,7 @@
 
   /* send local name filter */
   btu_hcif_send_cmd_with_cb(
-      FROM_HERE, HCI_BLE_ADV_FILTER_OCF, param, len,
+      FROM_HERE, HCI_BLE_ADV_FILTER, param, len,
       base::Bind(&btm_flt_update_cb, BTM_BLE_META_PF_LOCAL_NAME, cb));
 
   memset(&btm_ble_adv_filt_cb.cur_filter_target, 0, sizeof(tBLE_BD_ADDR));
@@ -379,7 +379,7 @@
   }
 
   btu_hcif_send_cmd_with_cb(
-      FROM_HERE, HCI_BLE_ADV_FILTER_OCF, param, len,
+      FROM_HERE, HCI_BLE_ADV_FILTER, param, len,
       base::Bind(&btm_flt_update_cb, BTM_BLE_META_PF_MANU_DATA, cb));
 
   memset(&btm_ble_adv_filt_cb.cur_filter_target, 0, sizeof(tBLE_BD_ADDR));
@@ -417,7 +417,7 @@
   }
 
   btu_hcif_send_cmd_with_cb(
-      FROM_HERE, HCI_BLE_ADV_FILTER_OCF, param, len,
+      FROM_HERE, HCI_BLE_ADV_FILTER, param, len,
       base::Bind(&btm_flt_update_cb, BTM_BLE_META_PF_SRVC_DATA, cb));
 
   memset(&btm_ble_adv_filt_cb.cur_filter_target, 0, sizeof(tBLE_BD_ADDR));
@@ -520,7 +520,7 @@
 
   /* send address filter */
   btu_hcif_send_cmd_with_cb(
-      FROM_HERE, HCI_BLE_ADV_FILTER_OCF, param, len,
+      FROM_HERE, HCI_BLE_ADV_FILTER, param, len,
       base::Bind(&btm_flt_update_cb, BTM_BLE_META_PF_ADDR, cb));
 
   memset(&btm_ble_adv_filt_cb.cur_filter_target, 0, sizeof(tBLE_BD_ADDR));
@@ -591,7 +591,7 @@
   }
 
   /* send UUID filter update */
-  btu_hcif_send_cmd_with_cb(FROM_HERE, HCI_BLE_ADV_FILTER_OCF, param, len,
+  btu_hcif_send_cmd_with_cb(FROM_HERE, HCI_BLE_ADV_FILTER, param, len,
                             base::Bind(&btm_flt_update_cb, evt_type, cb));
   memset(&btm_ble_adv_filt_cb.cur_filter_target, 0, sizeof(tBLE_BD_ADDR));
 }
@@ -716,7 +716,7 @@
   UINT8_TO_STREAM(p, BTM_BLE_PF_LOGIC_OR);
 
   btu_hcif_send_cmd_with_cb(
-      FROM_HERE, HCI_BLE_ADV_FILTER_OCF, param, len,
+      FROM_HERE, HCI_BLE_ADV_FILTER, param, len,
       base::Bind(&btm_flt_update_cb, BTM_BLE_META_PF_FEAT_SEL, cb));
 
   memset(&btm_ble_adv_filt_cb.cur_filter_target, 0, sizeof(tBLE_BD_ADDR));
@@ -801,7 +801,7 @@
             BTM_BLE_ADV_FILT_TRACK_NUM;
 
     btu_hcif_send_cmd_with_cb(
-        FROM_HERE, HCI_BLE_ADV_FILTER_OCF, param, len,
+        FROM_HERE, HCI_BLE_ADV_FILTER, param, len,
         base::Bind(&btm_flt_update_cb, BTM_BLE_META_PF_FEAT_SEL, cb));
   } else if (BTM_BLE_SCAN_COND_DELETE == action) {
     /* select feature based on control block settings */
@@ -811,7 +811,7 @@
     UINT8_TO_STREAM(p, filt_index);
 
     btu_hcif_send_cmd_with_cb(
-        FROM_HERE, HCI_BLE_ADV_FILTER_OCF, param,
+        FROM_HERE, HCI_BLE_ADV_FILTER, param,
         (uint8_t)(BTM_BLE_ADV_FILT_META_HDR_LENGTH),
         base::Bind(&btm_flt_update_cb, BTM_BLE_META_PF_FEAT_SEL, cb));
   } else if (BTM_BLE_SCAN_COND_CLEAR == action) {
@@ -823,7 +823,7 @@
     UINT8_TO_STREAM(p, BTM_BLE_SCAN_COND_CLEAR);
 
     btu_hcif_send_cmd_with_cb(
-        FROM_HERE, HCI_BLE_ADV_FILTER_OCF, param,
+        FROM_HERE, HCI_BLE_ADV_FILTER, param,
         (uint8_t)(BTM_BLE_ADV_FILT_META_HDR_LENGTH - 1),
         base::Bind(&btm_flt_update_cb, BTM_BLE_META_PF_FEAT_SEL, cb));
   }
@@ -874,7 +874,7 @@
   UINT8_TO_STREAM(p, BTM_BLE_META_PF_ENABLE);
   UINT8_TO_STREAM(p, enable);
 
-  btu_hcif_send_cmd_with_cb(FROM_HERE, HCI_BLE_ADV_FILTER_OCF, param,
+  btu_hcif_send_cmd_with_cb(FROM_HERE, HCI_BLE_ADV_FILTER, param,
                             BTM_BLE_PCF_ENABLE_LEN,
                             base::Bind(&enable_cmpl_cback, p_stat_cback));
 }
diff --git a/stack/btm/btm_ble_batchscan.cc b/stack/btm/btm_ble_batchscan.cc
index 89b3e6c..f7d5d3c 100644
--- a/stack/btm/btm_ble_batchscan.cc
+++ b/stack/btm/btm_ble_batchscan.cc
@@ -240,7 +240,7 @@
   UINT8_TO_STREAM(pp, BTM_BLE_BATCH_SCAN_READ_RESULTS);
   UINT8_TO_STREAM(pp, scan_mode);
 
-  btu_hcif_send_cmd_with_cb(FROM_HERE, HCI_BLE_BATCH_SCAN_OCF, param, len, cb);
+  btu_hcif_send_cmd_with_cb(FROM_HERE, HCI_BLE_BATCH_SCAN, param, len, cb);
 }
 
 /* read reports. data is accumulated in |data_all|, number of records is
@@ -311,7 +311,7 @@
   UINT8_TO_STREAM(pp, batch_scan_trunc_max);
   UINT8_TO_STREAM(pp, batch_scan_notify_threshold);
 
-  btu_hcif_send_cmd_with_cb(FROM_HERE, HCI_BLE_BATCH_SCAN_OCF, param, len, cb);
+  btu_hcif_send_cmd_with_cb(FROM_HERE, HCI_BLE_BATCH_SCAN, param, len, cb);
 }
 
 /* This function writes the batch scan params in controller */
@@ -336,7 +336,7 @@
   UINT8_TO_STREAM(p, addr_type);
   UINT8_TO_STREAM(p, discard_rule);
 
-  btu_hcif_send_cmd_with_cb(FROM_HERE, HCI_BLE_BATCH_SCAN_OCF, param, len, cb);
+  btu_hcif_send_cmd_with_cb(FROM_HERE, HCI_BLE_BATCH_SCAN, param, len, cb);
 }
 
 /* This function enables the customer specific feature in controller */
@@ -349,7 +349,7 @@
   UINT8_TO_STREAM(p, BTM_BLE_BATCH_SCAN_ENB_DISAB_CUST_FEATURE);
   UINT8_TO_STREAM(p, 0x01 /* enable */);
 
-  btu_hcif_send_cmd_with_cb(FROM_HERE, HCI_BLE_BATCH_SCAN_OCF, param, len, cb);
+  btu_hcif_send_cmd_with_cb(FROM_HERE, HCI_BLE_BATCH_SCAN, param, len, cb);
 }
 
 }  // namespace
diff --git a/stack/btm/btm_ble_bgconn.cc b/stack/btm/btm_ble_bgconn.cc
index 73256c8..dbeb103 100644
--- a/stack/btm/btm_ble_bgconn.cc
+++ b/stack/btm/btm_ble_bgconn.cc
@@ -39,6 +39,7 @@
     uint16_t conn_timeout, uint16_t min_ce_len, uint16_t max_ce_len,
     uint8_t phy);
 extern void btm_ble_create_conn_cancel();
+void wl_remove_complete(uint8_t* p_data, uint16_t /* evt_len */);
 
 // Unfortunately (for now?) we have to maintain a copy of the device whitelist
 // on the host to determine if a device is pending to be connected or not. This
@@ -72,7 +73,14 @@
         BackgroundConnection{address, addr_type, false, 0, false};
   } else {
     BackgroundConnection* connection = &map_iter->second;
-    connection->addr_type = addr_type;
+    if (addr_type != connection->addr_type) {
+      LOG(INFO) << __func__ << " Addr type mismatch " << address;
+      btsnd_hcic_ble_remove_from_white_list(
+        connection->addr_type_in_wl, connection->address,
+        base::Bind(&wl_remove_complete));
+      connection->addr_type = addr_type;
+      connection->in_controller_wl = false;
+    }
     connection->pending_removal = false;
   }
 }
@@ -170,8 +178,7 @@
     return true;
 
   // bonded device with identity address known
-  if (p_dev_rec->ble.identity_addr != address &&
-      !p_dev_rec->ble.identity_addr.IsEmpty()) {
+  if (!p_dev_rec->ble.identity_addr.IsEmpty()) {
     return true;
   }
 
@@ -197,8 +204,7 @@
 
   if (p_dev_rec != NULL && p_dev_rec->device_type & BT_DEVICE_TYPE_BLE) {
     if (to_add) {
-      if (p_dev_rec->ble.identity_addr != bd_addr &&
-          !p_dev_rec->ble.identity_addr.IsEmpty()) {
+      if (!p_dev_rec->ble.identity_addr.IsEmpty()) {
         background_connection_add(p_dev_rec->ble.identity_addr_type,
                                   p_dev_rec->ble.identity_addr);
       } else {
@@ -212,8 +218,7 @@
 
       p_dev_rec->ble.in_controller_list |= BTM_WHITE_LIST_BIT;
     } else {
-      if (!p_dev_rec->ble.identity_addr.IsEmpty() &&
-          p_dev_rec->ble.identity_addr != bd_addr) {
+      if (!p_dev_rec->ble.identity_addr.IsEmpty()) {
         background_connection_remove(p_dev_rec->ble.identity_addr);
       } else {
         background_connection_remove(bd_addr);
@@ -306,6 +311,14 @@
   BTM_TRACE_DEBUG("%s white_list_size = %d", __func__, white_list_size);
 }
 
+uint8_t BTM_GetWhiteListSize() {
+  const controller_t* controller = controller_get_interface();
+  if (!controller->supports_ble()) {
+    return 0;
+  }
+  return controller->get_ble_white_list_size();
+}
+
 bool BTM_SetLeConnectionModeToFast() {
   VLOG(2) << __func__;
   tBTM_BLE_CB* p_cb = &btm_cb.ble_ctr_cb;
diff --git a/stack/btm/btm_ble_bgconn.h b/stack/btm/btm_ble_bgconn.h
index 45ab2ec..407f513 100644
--- a/stack/btm/btm_ble_bgconn.h
+++ b/stack/btm/btm_ble_bgconn.h
@@ -25,6 +25,9 @@
 /** Removes the device from white list */
 extern void BTM_WhiteListRemove(const RawAddress& address);
 
+/** Get max white list size supports of the Bluetooth controller */
+extern uint8_t BTM_GetWhiteListSize();
+
 /** Clear the whitelist, end any pending whitelist connections */
 extern void BTM_WhiteListClear();
 
@@ -37,4 +40,4 @@
 /* Use slow scan window/interval for LE connection establishment.
  * This does not send any requests to controller, instead it changes the
  * parameters that will be used after next add/remove request */
-extern void BTM_SetLeConnectionModeToSlow();
\ No newline at end of file
+extern void BTM_SetLeConnectionModeToSlow();
diff --git a/stack/btm/btm_ble_connection_establishment.cc b/stack/btm/btm_ble_connection_establishment.cc
index c0d7791..77bc00f 100644
--- a/stack/btm/btm_ble_connection_establishment.cc
+++ b/stack/btm/btm_ble_connection_establishment.cc
@@ -159,6 +159,7 @@
         if (!btm_ble_init_pseudo_addr(match_rec, bda)) {
           /* assign the original address to be the current report address */
           bda = match_rec->ble.pseudo_addr;
+          bda_type = match_rec->ble.ble_addr_type;
         } else {
           bda = match_rec->bd_addr;
         }
diff --git a/stack/btm/btm_ble_cont_energy.cc b/stack/btm/btm_ble_cont_energy.cc
index 4e87308..23fe709 100644
--- a/stack/btm/btm_ble_cont_energy.cc
+++ b/stack/btm/btm_ble_cont_energy.cc
@@ -93,7 +93,7 @@
   }
 
   ble_energy_info_cb.p_ener_cback = p_ener_cback;
-  BTM_VendorSpecificCommand(HCI_BLE_ENERGY_INFO_OCF, 0, NULL,
+  BTM_VendorSpecificCommand(HCI_BLE_ENERGY_INFO, 0, NULL,
                             btm_ble_cont_energy_cmpl_cback);
   return BTM_CMD_STARTED;
 }
diff --git a/stack/btm/btm_ble_gap.cc b/stack/btm/btm_ble_gap.cc
index ca40a2b..3bb29d1 100644
--- a/stack/btm/btm_ble_gap.cc
+++ b/stack/btm/btm_ble_gap.cc
@@ -58,7 +58,10 @@
 
 #define BTM_EXT_BLE_RMT_NAME_TIMEOUT_MS (30 * 1000)
 #define MIN_ADV_LENGTH 2
-#define BTM_VSC_CHIP_CAPABILITY_RSP_LEN_L_RELEASE 9
+#define BTM_VSC_CHIP_CAPABILITY_RSP_LEN 9
+#define BTM_VSC_CHIP_CAPABILITY_RSP_LEN_L_RELEASE \
+  BTM_VSC_CHIP_CAPABILITY_RSP_LEN
+#define BTM_VSC_CHIP_CAPABILITY_RSP_LEN_M_RELEASE 15
 
 namespace {
 
@@ -472,7 +475,7 @@
  *
  * Function         btm_vsc_brcm_features_complete
  *
- * Description      Command Complete callback for HCI_BLE_VENDOR_CAP_OCF
+ * Description      Command Complete callback for HCI_BLE_VENDOR_CAP
  *
  * Returns          void
  *
@@ -485,7 +488,7 @@
   BTM_TRACE_DEBUG("%s", __func__);
 
   /* Check status of command complete event */
-  CHECK(p_vcs_cplt_params->opcode == HCI_BLE_VENDOR_CAP_OCF);
+  CHECK(p_vcs_cplt_params->opcode == HCI_BLE_VENDOR_CAP);
   CHECK(p_vcs_cplt_params->param_len > 0);
 
   p = p_vcs_cplt_params->p_param_buf;
@@ -495,6 +498,7 @@
     BTM_TRACE_DEBUG("%s: Status = 0x%02x (0 is success)", __func__, status);
     return;
   }
+  CHECK(p_vcs_cplt_params->param_len >= BTM_VSC_CHIP_CAPABILITY_RSP_LEN);
   STREAM_TO_UINT8(btm_cb.cmn_ble_vsc_cb.adv_inst_max, p);
   STREAM_TO_UINT8(btm_cb.cmn_ble_vsc_cb.rpa_offloading, p);
   STREAM_TO_UINT16(btm_cb.cmn_ble_vsc_cb.tot_scan_results_strg, p);
@@ -512,6 +516,7 @@
 
   if (btm_cb.cmn_ble_vsc_cb.version_supported >=
       BTM_VSC_CHIP_CAPABILITY_M_VERSION) {
+    CHECK(p_vcs_cplt_params->param_len >= BTM_VSC_CHIP_CAPABILITY_RSP_LEN_M_RELEASE);
     STREAM_TO_UINT16(btm_cb.cmn_ble_vsc_cb.total_trackable_advertisers, p);
     STREAM_TO_UINT8(btm_cb.cmn_ble_vsc_cb.extended_scan_support, p);
     STREAM_TO_UINT8(btm_cb.cmn_ble_vsc_cb.debug_logging_supported, p);
@@ -582,7 +587,7 @@
   BTM_TRACE_DEBUG("BTM_BleReadControllerFeatures");
 
   p_ctrl_le_feature_rd_cmpl_cback = p_vsc_cback;
-  BTM_VendorSpecificCommand(HCI_BLE_VENDOR_CAP_OCF, 0, NULL,
+  BTM_VendorSpecificCommand(HCI_BLE_VENDOR_CAP, 0, NULL,
                             btm_ble_vendor_capability_vsc_cmpl_cback);
 }
 #else
@@ -1473,7 +1478,7 @@
   if (!adv_data.empty()) {
     const uint8_t* p_flag = AdvertiseDataParser::GetFieldByType(
         adv_data, BTM_BLE_AD_TYPE_FLAG, &data_len);
-    if (p_flag != NULL) {
+    if (p_flag != NULL && data_len != 0) {
       flag = *p_flag;
 
       if ((btm_cb.btm_inq_vars.inq_active & BTM_BLE_GENERAL_INQUIRY) &&
@@ -1659,7 +1664,7 @@
   if (!data.empty()) {
     const uint8_t* p_flag =
         AdvertiseDataParser::GetFieldByType(data, BTM_BLE_AD_TYPE_FLAG, &len);
-    if (p_flag != NULL) p_cur->flag = *p_flag;
+    if (p_flag != NULL && len != 0) p_cur->flag = *p_flag;
   }
 
   if (!data.empty()) {
@@ -1750,6 +1755,7 @@
       } else {
         // Assign the original address to be the current report address
         bda = match_rec->ble.pseudo_addr;
+        *addr_type = match_rec->ble.ble_addr_type;
       }
     }
   }
diff --git a/stack/btm/btm_devctl.cc b/stack/btm/btm_devctl.cc
index bc3fb56..5d4a4aa 100644
--- a/stack/btm/btm_devctl.cc
+++ b/stack/btm/btm_devctl.cc
@@ -43,6 +43,9 @@
 #include "stack/gatt/connection_manager.h"
 
 #include "gatt_int.h"
+#include "main/shim/btm_api.h"
+#include "main/shim/controller.h"
+#include "main/shim/shim.h"
 
 extern bluetooth::common::MessageLoopThread bt_startup_thread;
 
@@ -231,8 +234,13 @@
   /* Clear the callback, so application would not hang on reset */
   btm_db_reset();
 
-  module_start_up_callbacked_wrapper(get_module(CONTROLLER_MODULE),
-                                     &bt_startup_thread, reset_complete);
+  if (bluetooth::shim::is_gd_shim_enabled()) {
+    module_start_up_callbacked_wrapper(get_module(GD_CONTROLLER_MODULE),
+                                       &bt_startup_thread, reset_complete);
+  } else {
+    module_start_up_callbacked_wrapper(get_module(CONTROLLER_MODULE),
+                                       &bt_startup_thread, reset_complete);
+  }
 }
 
 /*******************************************************************************
@@ -272,6 +280,7 @@
  ******************************************************************************/
 static void btm_decode_ext_features_page(uint8_t page_number,
                                          const uint8_t* p_features) {
+  CHECK(p_features != nullptr);
   BTM_TRACE_DEBUG("btm_decode_ext_features_page page: %d", page_number);
   switch (page_number) {
     /* Extended (Legacy) Page 0 */
diff --git a/stack/btm/btm_inq.cc b/stack/btm/btm_inq.cc
index 1a5d7f5..aaadd2b 100644
--- a/stack/btm/btm_inq.cc
+++ b/stack/btm/btm_inq.cc
@@ -42,6 +42,8 @@
 #include "btu.h"
 #include "hcidefs.h"
 #include "hcimsgs.h"
+#include "main/shim/btm_api.h"
+#include "main/shim/shim.h"
 
 using bluetooth::Uuid;
 
@@ -142,6 +144,10 @@
  ******************************************************************************/
 tBTM_STATUS BTM_SetDiscoverability(uint16_t inq_mode, uint16_t window,
                                    uint16_t interval) {
+  if (bluetooth::shim::is_gd_shim_enabled()) {
+    return bluetooth::shim::BTM_SetDiscoverability(inq_mode, window, interval);
+  }
+
   uint8_t scan_mode = 0;
   uint16_t service_class;
   uint8_t* p_cod;
@@ -252,6 +258,10 @@
  *
  ******************************************************************************/
 tBTM_STATUS BTM_SetInquiryScanType(uint16_t scan_type) {
+  if (bluetooth::shim::is_gd_shim_enabled()) {
+    return bluetooth::shim::BTM_SetInquiryScanType(scan_type);
+  }
+
   BTM_TRACE_API("BTM_SetInquiryScanType");
   if (scan_type != BTM_SCAN_TYPE_STANDARD &&
       scan_type != BTM_SCAN_TYPE_INTERLACED)
@@ -285,6 +295,10 @@
  *
  ******************************************************************************/
 tBTM_STATUS BTM_SetPageScanType(uint16_t scan_type) {
+  if (bluetooth::shim::is_gd_shim_enabled()) {
+    return bluetooth::shim::BTM_SetPageScanType(scan_type);
+  }
+
   BTM_TRACE_API("BTM_SetPageScanType");
   if (scan_type != BTM_SCAN_TYPE_STANDARD &&
       scan_type != BTM_SCAN_TYPE_INTERLACED)
@@ -321,6 +335,10 @@
  *
  ******************************************************************************/
 tBTM_STATUS BTM_SetInquiryMode(uint8_t mode) {
+  if (bluetooth::shim::is_gd_shim_enabled()) {
+    return bluetooth::shim::BTM_SetInquiryMode(mode);
+  }
+
   const controller_t* controller = controller_get_interface();
   BTM_TRACE_API("BTM_SetInquiryMode");
   if (mode == BTM_INQ_RESULT_STANDARD) {
@@ -356,6 +374,10 @@
  *
  ******************************************************************************/
 uint16_t BTM_ReadDiscoverability(uint16_t* p_window, uint16_t* p_interval) {
+  if (bluetooth::shim::is_gd_shim_enabled()) {
+    return bluetooth::shim::BTM_ReadDiscoverability(p_window, p_interval);
+  }
+
   BTM_TRACE_API("BTM_ReadDiscoverability");
   if (p_window) *p_window = btm_cb.btm_inq_vars.inq_scan_window;
 
@@ -405,6 +427,11 @@
 tBTM_STATUS BTM_SetPeriodicInquiryMode(tBTM_INQ_PARMS* p_inqparms,
                                        uint16_t max_delay, uint16_t min_delay,
                                        tBTM_INQ_RESULTS_CB* p_results_cb) {
+  if (bluetooth::shim::is_gd_shim_enabled()) {
+    return bluetooth::shim::BTM_SetPeriodicInquiryMode(p_inqparms, max_delay,
+                                                       min_delay, p_results_cb);
+  }
+
   tBTM_STATUS status;
   tBTM_INQUIRY_VAR_ST* p_inq = &btm_cb.btm_inq_vars;
 
@@ -492,6 +519,10 @@
  *
  ******************************************************************************/
 tBTM_STATUS BTM_CancelPeriodicInquiry(void) {
+  if (bluetooth::shim::is_gd_shim_enabled()) {
+    return bluetooth::shim::BTM_CancelPeriodicInquiry();
+  }
+
   tBTM_INQUIRY_VAR_ST* p_inq = &btm_cb.btm_inq_vars;
   tBTM_STATUS status = BTM_SUCCESS;
   BTM_TRACE_API("BTM_CancelPeriodicInquiry called");
@@ -534,6 +565,10 @@
  ******************************************************************************/
 tBTM_STATUS BTM_SetConnectability(uint16_t page_mode, uint16_t window,
                                   uint16_t interval) {
+  if (bluetooth::shim::is_gd_shim_enabled()) {
+    return bluetooth::shim::BTM_SetConnectability(page_mode, window, interval);
+  }
+
   uint8_t scan_mode = 0;
   tBTM_INQUIRY_VAR_ST* p_inq = &btm_cb.btm_inq_vars;
 
@@ -608,6 +643,10 @@
  *
  ******************************************************************************/
 uint16_t BTM_ReadConnectability(uint16_t* p_window, uint16_t* p_interval) {
+  if (bluetooth::shim::is_gd_shim_enabled()) {
+    return bluetooth::shim::BTM_ReadConnectability(p_window, p_interval);
+  }
+
   BTM_TRACE_API("BTM_ReadConnectability");
   if (p_window) *p_window = btm_cb.btm_inq_vars.page_scan_window;
 
@@ -630,6 +669,10 @@
  *
  ******************************************************************************/
 uint16_t BTM_IsInquiryActive(void) {
+  if (bluetooth::shim::is_gd_shim_enabled()) {
+    return bluetooth::shim::BTM_IsInquiryActive();
+  }
+
   BTM_TRACE_API("BTM_IsInquiryActive");
 
   return (btm_cb.btm_inq_vars.inq_active);
@@ -647,6 +690,10 @@
  *
  ******************************************************************************/
 tBTM_STATUS BTM_CancelInquiry(void) {
+  if (bluetooth::shim::is_gd_shim_enabled()) {
+    return bluetooth::shim::BTM_CancelInquiry();
+  }
+
   tBTM_STATUS status = BTM_SUCCESS;
   tBTM_INQUIRY_VAR_ST* p_inq = &btm_cb.btm_inq_vars;
   BTM_TRACE_API("BTM_CancelInquiry called");
@@ -733,6 +780,19 @@
                              tBTM_CMPL_CB* p_cmpl_cb) {
   tBTM_INQUIRY_VAR_ST* p_inq = &btm_cb.btm_inq_vars;
 
+  if (bluetooth::shim::is_gd_shim_enabled()) {
+    p_inq->state = BTM_INQ_ACTIVE_STATE;
+    p_inq->p_inq_cmpl_cb = p_cmpl_cb;
+    p_inq->p_inq_results_cb = p_results_cb;
+    p_inq->inq_cmpl_info.num_resp = 0; /* Clear the results counter */
+    p_inq->inq_active = p_inqparms->mode;
+
+    btm_acl_update_busy_level(BTM_BLI_INQ_EVT);
+
+    return bluetooth::shim::BTM_StartInquiry(p_inqparms, p_results_cb,
+                                             p_cmpl_cb);
+  }
+
   BTM_TRACE_API("BTM_StartInquiry: mode: %d, dur: %d, rsps: %d, flt: %d",
                 p_inqparms->mode, p_inqparms->duration, p_inqparms->max_resps,
                 p_inqparms->filter_cond_type);
@@ -878,6 +938,11 @@
 tBTM_STATUS BTM_ReadRemoteDeviceName(const RawAddress& remote_bda,
                                      tBTM_CMPL_CB* p_cb,
                                      tBT_TRANSPORT transport) {
+  if (bluetooth::shim::is_gd_shim_enabled()) {
+    return bluetooth::shim::BTM_ReadRemoteDeviceName(remote_bda, p_cb,
+                                                     transport);
+  }
+
   VLOG(1) << __func__ << ": bd addr " << remote_bda;
   /* Use LE transport when LE is the only available option */
   if (transport == BT_TRANSPORT_LE) {
@@ -1039,6 +1104,10 @@
  *
  ******************************************************************************/
 tBTM_STATUS BTM_ReadInquiryRspTxPower(tBTM_CMPL_CB* p_cb) {
+  if (bluetooth::shim::is_gd_shim_enabled()) {
+    return bluetooth::shim::BTM_ReadInquiryRspTxPower(p_cb);
+  }
+
   if (btm_cb.devcb.p_inq_tx_power_cmpl_cb) return (BTM_BUSY);
 
   btm_cb.devcb.p_inq_tx_power_cmpl_cb = p_cb;
@@ -1655,7 +1724,6 @@
     }
 
     p_i = btm_inq_db_find(bda);
-
     /* Only process the num_resp is smaller than max_resps.
        If results are queued to BTU task while canceling inquiry,
        or when more than one result is in this response, > max_resp
@@ -1675,8 +1743,8 @@
 
     /* Check if this address has already been processed for this inquiry */
     if (btm_inq_find_bdaddr(bda)) {
-      /* BTM_TRACE_DEBUG("BDA seen before [%02x%02x %02x%02x %02x%02x]",
-                      bda[0], bda[1], bda[2], bda[3], bda[4], bda[5]);*/
+      /* BTM_TRACE_DEBUG("BDA seen before %s", bda.ToString().c_str()); */
+
       /* By default suppose no update needed */
       i_rssi = (int8_t)rssi;
 
@@ -1783,9 +1851,12 @@
         p_eir_data = NULL;
 
       /* If a callback is registered, call it with the results */
-      if (p_inq_results_cb)
+      if (p_inq_results_cb) {
         (p_inq_results_cb)((tBTM_INQ_RESULTS*)p_cur, p_eir_data,
                            HCI_EXT_INQ_RESPONSE_LEN);
+      } else {
+        BTM_TRACE_DEBUG("No callback is registered");
+      }
     }
   }
 }
diff --git a/stack/btm/btm_sec.cc b/stack/btm/btm_sec.cc
index 33990a1..935903d 100644
--- a/stack/btm/btm_sec.cc
+++ b/stack/btm/btm_sec.cc
@@ -26,6 +26,7 @@
 
 #include <frameworks/base/core/proto/android/bluetooth/enums.pb.h>
 #include <frameworks/base/core/proto/android/bluetooth/hci/enums.pb.h>
+#include <log/log.h>
 #include <stdarg.h>
 #include <stdio.h>
 #include <string.h>
@@ -54,6 +55,7 @@
 
 extern void btm_ble_advertiser_notify_terminated_legacy(
     uint8_t status, uint16_t connection_handle);
+extern void bta_dm_remove_device(const RawAddress& bd_addr);
 
 /*******************************************************************************
  *             L O C A L    F U N C T I O N     P R O T O T Y P E S            *
@@ -3772,6 +3774,7 @@
   tBTM_PAIRING_STATE old_state = btm_cb.pairing_state;
   tBTM_SEC_DEV_REC* p_dev_rec = btm_find_dev_by_handle(handle);
   bool are_bonding = false;
+  bool was_authenticating = false;
 
   if (p_dev_rec) {
     VLOG(2) << __func__ << ": Security Manager: in state: "
@@ -3812,16 +3815,35 @@
 
   if (!p_dev_rec) return;
 
-  if ((btm_cb.pairing_state != BTM_PAIR_STATE_IDLE) &&
-      (btm_cb.pairing_flags & BTM_PAIR_FLAGS_WE_STARTED_DD) &&
-      (p_dev_rec->bd_addr == btm_cb.pairing_bda))
-    are_bonding = true;
+  if (p_dev_rec->sec_state == BTM_SEC_STATE_AUTHENTICATING) {
+    p_dev_rec->sec_state = BTM_SEC_STATE_IDLE;
+    was_authenticating = true;
+    /* There can be a race condition, when we are starting authentication
+     * and the peer device is doing encryption.
+     * If first we receive encryption change up, then initiated
+     * authentication can not be performed.
+     * According to the spec we can not do authentication on the
+     * encrypted link, so device is correct.
+     */
+    if ((status == HCI_ERR_COMMAND_DISALLOWED) &&
+        ((p_dev_rec->sec_flags & (BTM_SEC_AUTHENTICATED | BTM_SEC_ENCRYPTED)) ==
+         (BTM_SEC_AUTHENTICATED | BTM_SEC_ENCRYPTED))) {
+      status = HCI_SUCCESS;
+    }
+    if (status == HCI_SUCCESS) {
+      p_dev_rec->sec_flags |= BTM_SEC_AUTHENTICATED;
+    }
+  }
 
   if ((btm_cb.pairing_state != BTM_PAIR_STATE_IDLE) &&
-      (p_dev_rec->bd_addr == btm_cb.pairing_bda))
+      (p_dev_rec->bd_addr == btm_cb.pairing_bda)) {
+    if (btm_cb.pairing_flags & BTM_PAIR_FLAGS_WE_STARTED_DD) {
+      are_bonding = true;
+    }
     btm_sec_change_pairing_state(BTM_PAIR_STATE_IDLE);
+  }
 
-  if (p_dev_rec->sec_state != BTM_SEC_STATE_AUTHENTICATING) {
+  if (was_authenticating == false) {
     if ((btm_cb.api.p_auth_complete_callback && status != HCI_SUCCESS) &&
         (old_state != BTM_PAIR_STATE_IDLE)) {
       (*btm_cb.api.p_auth_complete_callback)(p_dev_rec->bd_addr,
@@ -3831,17 +3853,6 @@
     return;
   }
 
-  /* There can be a race condition, when we are starting authentication and
-  ** the peer device is doing encryption.
-  ** If first we receive encryption change up, then initiated authentication
-  ** can not be performed.  According to the spec we can not do authentication
-  ** on the encrypted link, so device is correct.
-  */
-  if ((status == HCI_ERR_COMMAND_DISALLOWED) &&
-      ((p_dev_rec->sec_flags & (BTM_SEC_AUTHENTICATED | BTM_SEC_ENCRYPTED)) ==
-       (BTM_SEC_AUTHENTICATED | BTM_SEC_ENCRYPTED))) {
-    status = HCI_SUCCESS;
-  }
   /* Currently we do not notify user if it is a keyboard which connects */
   /* User probably Disabled the keyboard while it was asleap.  Let her try */
   if (btm_cb.api.p_auth_complete_callback) {
@@ -3852,8 +3863,6 @@
                                              p_dev_rec->sec_bd_name, status);
   }
 
-  p_dev_rec->sec_state = BTM_SEC_STATE_IDLE;
-
   /* If this is a bonding procedure can disconnect the link now */
   if (are_bonding) {
     p_dev_rec->security_required &= ~BTM_SEC_OUT_AUTHENTICATE;
@@ -3899,8 +3908,6 @@
     return;
   }
 
-  p_dev_rec->sec_flags |= BTM_SEC_AUTHENTICATED;
-
   if (p_dev_rec->pin_code_length >= 16 ||
       p_dev_rec->link_key_type == BTM_LKEY_TYPE_AUTH_COMB ||
       p_dev_rec->link_key_type == BTM_LKEY_TYPE_AUTH_COMB_P_256) {
@@ -4303,12 +4310,15 @@
       }
     }
 
-    if (!addr_matched) {
-      /* Don't callback unless this Connection-Complete-failure event has the
-       * same mac address as the bonding device */
+    /* p_auth_complete_callback might have freed the p_dev_rec, ensure it exists
+     * before accessing */
+    p_dev_rec = btm_find_dev(bda);
+    if (!p_dev_rec) {
+      /* Don't callback when device security record was removed */
       VLOG(1) << __func__
-              << ": Different mac addresses: pairing_bda=" << btm_cb.pairing_bda
-              << ", bda=" << bda << ", do not callback";
+              << ": device security record associated with this bda has been "
+                 "removed! bda="
+              << bda << ", do not callback!";
       return;
     }
 
@@ -4544,6 +4554,17 @@
       p_dev_rec->sec_flags &= ~(BTM_SEC_LINK_KEY_KNOWN);
   }
 
+  /* Some devices hardcode sample LTK value from spec, instead of generating
+   * one. Treat such devices as insecure, and remove such bonds on
+   * disconnection.
+   */
+  if (is_sample_ltk(p_dev_rec->ble.keys.pltk)) {
+    android_errorWriteLog(0x534e4554, "128437297");
+    LOG(INFO) << __func__ << " removing bond to device that used sample LTK: " << p_dev_rec->bd_addr;
+
+    bta_dm_remove_device(p_dev_rec->bd_addr);
+  }
+
   BTM_TRACE_EVENT("%s after update sec_flags=0x%x", __func__,
                   p_dev_rec->sec_flags);
 
diff --git a/stack/btu/btu_hcif.cc b/stack/btu/btu_hcif.cc
index d9c31b6..2035cc6 100644
--- a/stack/btu/btu_hcif.cc
+++ b/stack/btu/btu_hcif.cc
@@ -34,6 +34,7 @@
 #include <base/threading/thread.h>
 #include <frameworks/base/core/proto/android/bluetooth/enums.pb.h>
 #include <frameworks/base/core/proto/android/bluetooth/hci/enums.pb.h>
+#include <log/log.h>
 #include <statslog.h>
 #include <stdio.h>
 #include <stdlib.h>
@@ -56,6 +57,7 @@
 using base::Location;
 
 extern void btm_process_cancel_complete(uint8_t status, uint8_t mode);
+extern void btm_process_inq_results2(uint8_t* p, uint8_t inq_res_mode);
 extern void btm_ble_test_command_complete(uint8_t* p);
 extern void smp_cancel_start_encryption_attempt();
 
@@ -791,6 +793,16 @@
       bluetooth::common::LogClassicPairingEvent(RawAddress::kEmpty, bluetooth::common::kUnknownConnectionHandle, opcode,
                                                 hci_event, status, reason, 0);
       break;
+    case HCI_READ_ENCR_KEY_SIZE: {
+      uint16_t handle;
+      uint8_t key_size;
+      STREAM_TO_UINT8(status, p_return_params);
+      STREAM_TO_UINT16(handle, p_return_params);
+      STREAM_TO_UINT8(key_size, p_return_params);
+      bluetooth::common::LogClassicPairingEvent(RawAddress::kEmpty, handle, opcode, hci_event, status, reason,
+                                                key_size);
+      break;
+    }
     case HCI_LINK_KEY_REQUEST_REPLY:
     case HCI_LINK_KEY_REQUEST_NEG_REPLY:
     case HCI_IO_CAPABILITY_REQUEST_REPLY:
@@ -1116,6 +1128,37 @@
   btm_sec_rmt_name_request_complete(&bd_addr, p, status);
 }
 
+constexpr uint8_t MIN_KEY_SIZE = 7;
+
+static void read_encryption_key_size_complete_after_encryption_change(uint8_t status, uint16_t handle,
+                                                                      uint8_t key_size) {
+  if (status == HCI_ERR_INSUFFCIENT_SECURITY) {
+    /* If remote device stop the encryption before we call "Read Encryption Key
+     * Size", we might receive Insufficient Security, which means that link is
+     * no longer encrypted. */
+    LOG(INFO) << __func__ << ": encryption stopped on link: " << loghex(handle);
+    return;
+  }
+
+  if (status != HCI_SUCCESS) {
+    LOG(INFO) << __func__ << ": disconnecting, status: " << loghex(status);
+    btsnd_hcic_disconnect(handle, HCI_ERR_PEER_USER);
+    return;
+  }
+
+  if (key_size < MIN_KEY_SIZE) {
+    android_errorWriteLog(0x534e4554, "124301137");
+    LOG(ERROR) << __func__ << " encryption key too short, disconnecting. handle: " << loghex(handle)
+               << " key_size: " << +key_size;
+
+    btsnd_hcic_disconnect(handle, HCI_ERR_HOST_REJECT_SECURITY);
+    return;
+  }
+
+  // good key size - succeed
+  btm_acl_encrypt_change(handle, status, 1 /* enable */);
+  btm_sec_encrypt_change(handle, status, 1 /* enable */);
+}
 /*******************************************************************************
  *
  * Function         btu_hcif_encryption_change_evt
@@ -1134,13 +1177,17 @@
   STREAM_TO_UINT16(handle, p);
   STREAM_TO_UINT8(encr_enable, p);
 
-  if (status == HCI_ERR_CONNECTION_TOUT) {
-    smp_cancel_start_encryption_attempt();
-    return;
-  }
+  if (status != HCI_SUCCESS || encr_enable == 0 || BTM_IsBleConnection(handle)) {
+    if (status == HCI_ERR_CONNECTION_TOUT) {
+      smp_cancel_start_encryption_attempt();
+      return;
+    }
 
-  btm_acl_encrypt_change(handle, status, encr_enable);
-  btm_sec_encrypt_change(handle, status, encr_enable);
+    btm_acl_encrypt_change(handle, status, encr_enable);
+    btm_sec_encrypt_change(handle, status, encr_enable);
+  } else {
+    btsnd_hcic_read_encryption_key_size(handle, base::Bind(&read_encryption_key_size_complete_after_encryption_change));
+  }
 }
 
 /*******************************************************************************
@@ -2012,22 +2059,51 @@
  * End of Simple Pairing Events
  **********************************************/
 
-/**********************************************
- * BLE Events
- **********************************************/
+static void read_encryption_key_size_complete_after_key_refresh(uint8_t status, uint16_t handle, uint8_t key_size) {
+  if (status == HCI_ERR_INSUFFCIENT_SECURITY) {
+    /* If remote device stop the encryption before we call "Read Encryption Key
+     * Size", we might receive Insufficient Security, which means that link is
+     * no longer encrypted. */
+    LOG(INFO) << __func__ << ": encryption stopped on link: " << loghex(handle);
+    return;
+  }
+
+  if (status != HCI_SUCCESS) {
+    LOG(INFO) << __func__ << ": disconnecting, status: " << loghex(status);
+    btsnd_hcic_disconnect(handle, HCI_ERR_PEER_USER);
+    return;
+  }
+
+  if (key_size < MIN_KEY_SIZE) {
+    android_errorWriteLog(0x534e4554, "124301137");
+    LOG(ERROR) << __func__ << " encryption key too short, disconnecting. handle: " << loghex(handle)
+               << " key_size: " << +key_size;
+
+    btsnd_hcic_disconnect(handle, HCI_ERR_HOST_REJECT_SECURITY);
+    return;
+  }
+
+  btm_sec_encrypt_change(handle, status, 1 /* enc_enable */);
+}
+
 static void btu_hcif_encryption_key_refresh_cmpl_evt(uint8_t* p) {
   uint8_t status;
-  uint8_t enc_enable = 0;
   uint16_t handle;
 
   STREAM_TO_UINT8(status, p);
   STREAM_TO_UINT16(handle, p);
 
-  if (status == HCI_SUCCESS) enc_enable = 1;
-
-  btm_sec_encrypt_change(handle, status, enc_enable);
+  if (status != HCI_SUCCESS || BTM_IsBleConnection(handle)) {
+    btm_sec_encrypt_change(handle, status, (status == HCI_SUCCESS) ? 1 : 0);
+  } else {
+    btsnd_hcic_read_encryption_key_size(handle, base::Bind(&read_encryption_key_size_complete_after_key_refresh));
+  }
 }
 
+/**********************************************
+ * BLE Events
+ **********************************************/
+
 static void btu_ble_ll_conn_complete_evt(uint8_t* p, uint16_t evt_len) {
   btm_ble_conn_complete(p, evt_len, false);
 }
diff --git a/stack/gap/gap_ble.cc b/stack/gap/gap_ble.cc
index cce62d4..e71238f 100644
--- a/stack/gap/gap_ble.cc
+++ b/stack/gap/gap_ble.cc
@@ -411,23 +411,26 @@
   Uuid addr_res_uuid = Uuid::From16Bit(GATT_UUID_GAP_CENTRAL_ADDR_RESOL);
 
   btgatt_db_element_t service[] = {
-    {.type = BTGATT_DB_PRIMARY_SERVICE, .uuid = svc_uuid},
-    {.type = BTGATT_DB_CHARACTERISTIC,
-     .uuid = name_uuid,
+    {
+        .uuid = svc_uuid,
+        .type = BTGATT_DB_PRIMARY_SERVICE,
+    },
+    {.uuid = name_uuid,
+     .type = BTGATT_DB_CHARACTERISTIC,
      .properties = GATT_CHAR_PROP_BIT_READ,
      .permissions = GATT_PERM_READ},
-    {.type = BTGATT_DB_CHARACTERISTIC,
-     .uuid = icon_uuid,
+    {.uuid = icon_uuid,
+     .type = BTGATT_DB_CHARACTERISTIC,
      .properties = GATT_CHAR_PROP_BIT_READ,
      .permissions = GATT_PERM_READ},
-    {.type = BTGATT_DB_CHARACTERISTIC,
-     .uuid = addr_res_uuid,
+    {.uuid = addr_res_uuid,
+     .type = BTGATT_DB_CHARACTERISTIC,
      .properties = GATT_CHAR_PROP_BIT_READ,
      .permissions = GATT_PERM_READ}
 #if (BTM_PERIPHERAL_ENABLED == TRUE) /* Only needed for peripheral testing */
     ,
-    {.type = BTGATT_DB_CHARACTERISTIC,
-     .uuid = Uuid::From16Bit(GATT_UUID_GAP_PREF_CONN_PARAM),
+    {.uuid = Uuid::From16Bit(GATT_UUID_GAP_PREF_CONN_PARAM),
+     .type = BTGATT_DB_CHARACTERISTIC,
      .properties = GATT_CHAR_PROP_BIT_READ,
      .permissions = GATT_PERM_READ}
 #endif
diff --git a/stack/gap/gap_conn.cc b/stack/gap/gap_conn.cc
index 72183bb..15d3ddb 100644
--- a/stack/gap/gap_conn.cc
+++ b/stack/gap/gap_conn.cc
@@ -235,8 +235,7 @@
 
   /* Register the PSM with L2CAP */
   if (transport == BT_TRANSPORT_BR_EDR) {
-    p_ccb->psm = L2CA_REGISTER(
-        psm, &conn.reg_info, AMP_AUTOSWITCH_ALLOWED | AMP_USE_AMP_IF_POSSIBLE);
+    p_ccb->psm = L2CA_REGISTER(psm, &conn.reg_info, false /* enable_snoop */);
     if (p_ccb->psm == 0) {
       LOG(ERROR) << StringPrintf("%s: Failure registering PSM 0x%04x", __func__,
                                  psm);
diff --git a/stack/gatt/connection_manager.cc b/stack/gatt/connection_manager.cc
index cfbb02e..9454be0 100644
--- a/stack/gatt/connection_manager.cc
+++ b/stack/gatt/connection_manager.cc
@@ -267,12 +267,11 @@
 void dump(int fd) {
   dprintf(fd, "\nconnection_manager state:\n");
   if (bgconn_dev.empty()) {
-    dprintf(fd, "\n\tno Low Energy connection attempts\n");
+    dprintf(fd, "\tno Low Energy connection attempts\n");
     return;
   }
 
-  dprintf(fd, "\n\tdevices attempting connection: %d\n",
-          (int)bgconn_dev.size());
+  dprintf(fd, "\tdevices attempting connection: %d", (int)bgconn_dev.size());
   for (const auto& entry : bgconn_dev) {
     dprintf(fd, "\n\t * %s: ", entry.first.ToString().c_str());
 
@@ -283,13 +282,14 @@
       }
     }
 
-    if (entry.second.doing_bg_conn.empty()) {
+    if (!entry.second.doing_bg_conn.empty()) {
       dprintf(fd, "\n\t\tapps doing background connect: ");
       for (const auto& id : entry.second.doing_bg_conn) {
         dprintf(fd, "%d, ", id);
       }
     }
   }
+  dprintf(fd, "\n");
 }
 
 }  // namespace connection_manager
diff --git a/stack/gatt/gatt_api.cc b/stack/gatt/gatt_api.cc
index 4195548..5fe9a37 100644
--- a/stack/gatt/gatt_api.cc
+++ b/stack/gatt/gatt_api.cc
@@ -382,6 +382,7 @@
   if (it == gatt_cb.srv_list_info->end()) {
     LOG(ERROR) << __func__ << ": service_handle=" << loghex(service_handle)
                << " is not in use";
+    return;
   }
 
   if (it->sdp_handle) {
@@ -707,6 +708,7 @@
   p_clcb->op_subtype = type;
   p_clcb->auth_req = p_read->by_handle.auth_req;
   p_clcb->counter = 0;
+  p_clcb->read_req_current_mtu = p_tcb->payload_size;
 
   switch (type) {
     case GATT_READ_BY_TYPE:
diff --git a/stack/gatt/gatt_attr.cc b/stack/gatt/gatt_attr.cc
index 8861a7a..1acfd81 100644
--- a/stack/gatt/gatt_attr.cc
+++ b/stack/gatt/gatt_attr.cc
@@ -285,11 +285,16 @@
   Uuid char_uuid = Uuid::From16Bit(GATT_UUID_GATT_SRV_CHGD);
 
   btgatt_db_element_t service[] = {
-      {.type = BTGATT_DB_PRIMARY_SERVICE, .uuid = service_uuid},
-      {.type = BTGATT_DB_CHARACTERISTIC,
-       .uuid = char_uuid,
-       .properties = GATT_CHAR_PROP_BIT_INDICATE,
-       .permissions = 0}};
+      {
+          .uuid = service_uuid,
+          .type = BTGATT_DB_PRIMARY_SERVICE,
+      },
+      {
+          .uuid = char_uuid,
+          .type = BTGATT_DB_CHARACTERISTIC,
+          .properties = GATT_CHAR_PROP_BIT_INDICATE,
+          .permissions = 0,
+      }};
 
   GATTS_AddService(gatt_cb.gatt_if, service,
                    sizeof(service) / sizeof(btgatt_db_element_t));
diff --git a/stack/gatt/gatt_cl.cc b/stack/gatt/gatt_cl.cc
index 2650a30..6bc01e1 100644
--- a/stack/gatt/gatt_cl.cc
+++ b/stack/gatt/gatt_cl.cc
@@ -627,6 +627,10 @@
   memset(&value, 0, sizeof(value));
   STREAM_TO_UINT16(value.handle, p);
   value.len = len - 2;
+  if (value.len > GATT_MAX_ATTR_LEN) {
+    LOG(ERROR) << "value.len larger than GATT_MAX_ATTR_LEN, discard";
+    return;
+  }
   memcpy(value.value, p, value.len);
 
   if (!GATT_HANDLE_IS_VALID(value.handle)) {
@@ -909,11 +913,18 @@
 
         memcpy(p_clcb->p_attr_buf + offset, p, len);
 
-        /* send next request if needed  */
+        /* full packet for read or read blob rsp */
+        bool packet_is_full;
+        if (tcb.payload_size == p_clcb->read_req_current_mtu) {
+          packet_is_full = (len == (tcb.payload_size - 1));
+        } else {
+          packet_is_full = (len == (p_clcb->read_req_current_mtu - 1) ||
+                            len == (tcb.payload_size - 1));
+          p_clcb->read_req_current_mtu = tcb.payload_size;
+        }
 
-        if (len == (tcb.payload_size -
-                    1) && /* full packet for read or read blob rsp */
-            len + offset < GATT_MAX_ATTR_LEN) {
+        /* send next request if needed  */
+        if (packet_is_full && (len + offset < GATT_MAX_ATTR_LEN)) {
           VLOG(1) << StringPrintf(
               "full pkt issue read blob for remianing bytes old offset=%d "
               "len=%d new offset=%d",
diff --git a/stack/gatt/gatt_int.h b/stack/gatt/gatt_int.h
index 2c00fd7..e072a47 100644
--- a/stack/gatt/gatt_int.h
+++ b/stack/gatt/gatt_int.h
@@ -323,6 +323,8 @@
   bool in_use;
   alarm_t* gatt_rsp_timer_ent; /* peer response timer */
   uint8_t retry_count;
+  uint16_t read_req_current_mtu; /* This is the MTU value that the read was
+                                    initiated with */
 };
 
 typedef struct {
diff --git a/stack/gatt/gatt_main.cc b/stack/gatt/gatt_main.cc
index 87bae6e..ed8d3fd 100644
--- a/stack/gatt/gatt_main.cc
+++ b/stack/gatt/gatt_main.cc
@@ -124,7 +124,8 @@
   L2CA_RegisterFixedChannel(L2CAP_ATT_CID, &fixed_reg);
 
   /* Now, register with L2CAP for ATT PSM over BR/EDR */
-  if (!L2CA_Register(BT_PSM_ATT, (tL2CAP_APPL_INFO*)&dyn_info)) {
+  if (!L2CA_Register(BT_PSM_ATT, (tL2CAP_APPL_INFO*)&dyn_info,
+                     false /* enable_snoop */)) {
     LOG(ERROR) << "ATT Dynamic Registration failed";
   }
 
@@ -204,25 +205,9 @@
     return p_tcb->att_lcid != 0;
   }
 
-  // Already connected, send the callback, mark the link as used
+  // Already connected, mark the link as used
   if (gatt_get_ch_state(p_tcb) == GATT_CH_OPEN) {
-    /*  very similar to gatt_send_conn_cback, but no good way to reuse the code
-     */
-
-    /* notifying application about the connection up event */
-    for (int i = 0; i < GATT_MAX_APPS; i++) {
-      tGATT_REG* p_reg = &gatt_cb.cl_rcb[i];
-
-      if (!p_reg->in_use || p_reg->gatt_if != gatt_if) continue;
-
-      gatt_update_app_use_link_flag(p_reg->gatt_if, p_tcb, true, true);
-      if (p_reg->app_cb.p_conn_cb) {
-        uint16_t conn_id = GATT_CREATE_CONN_ID(p_tcb->tcb_idx, p_reg->gatt_if);
-        (*p_reg->app_cb.p_conn_cb)(p_reg->gatt_if, p_tcb->peer_bda, conn_id,
-                                   true, 0, p_tcb->transport);
-      }
-    }
-
+    gatt_update_app_use_link_flag(gatt_if, p_tcb, true, true);
     return true;
   }
 
@@ -838,6 +823,9 @@
     }
   }
 
+  /* Remove the direct connection */
+  connection_manager::on_connection_complete(p_tcb->peer_bda);
+
   if (!p_tcb->app_hold_link.empty() && p_tcb->att_lcid == L2CAP_ATT_CID) {
     /* disable idle timeout if one or more clients are holding the link disable
      * the idle timer */
diff --git a/stack/hcic/hcicmds.cc b/stack/hcic/hcicmds.cc
index 4656591..23a8648 100644
--- a/stack/hcic/hcicmds.cc
+++ b/stack/hcic/hcicmds.cc
@@ -1309,6 +1309,30 @@
   btu_hcif_send_cmd(LOCAL_BR_EDR_CONTROLLER_ID, p);
 }
 
+static void read_encryption_key_size_complete(ReadEncKeySizeCb cb, uint8_t* return_parameters,
+                                              uint16_t return_parameters_length) {
+  uint8_t status;
+  uint16_t handle;
+  uint8_t key_size;
+  STREAM_TO_UINT8(status, return_parameters);
+  STREAM_TO_UINT16(handle, return_parameters);
+  STREAM_TO_UINT8(key_size, return_parameters);
+
+  std::move(cb).Run(status, handle, key_size);
+}
+
+void btsnd_hcic_read_encryption_key_size(uint16_t handle, ReadEncKeySizeCb cb) {
+  constexpr uint8_t len = 2;
+  uint8_t param[len];
+  memset(param, 0, len);
+
+  uint8_t* p = param;
+  UINT16_TO_STREAM(p, handle);
+
+  btu_hcif_send_cmd_with_cb(FROM_HERE, HCI_READ_ENCR_KEY_SIZE, param, len,
+                            base::Bind(&read_encryption_key_size_complete, base::Passed(&cb)));
+}
+
 void btsnd_hcic_read_failed_contact_counter(uint16_t handle) {
   BT_HDR* p = (BT_HDR*)osi_malloc(HCI_CMD_BUF_SIZE);
   uint8_t* pp = (uint8_t*)(p + 1);
diff --git a/stack/hid/hidd_api.cc b/stack/hid/hidd_api.cc
index f93511e..cd40c2c 100644
--- a/stack/hid/hidd_api.cc
+++ b/stack/hid/hidd_api.cc
@@ -33,7 +33,6 @@
 #include "hidd_api.h"
 #include "hidd_int.h"
 #include "hiddefs.h"
-#include "log/log.h"
 
 tHID_DEV_CTB hd_cb;
 
@@ -321,10 +320,6 @@
       UINT8_TO_BE_STREAM(p, desc_len);
       ARRAY_TO_BE_STREAM(p, p_desc_data, (int)desc_len);
 
-      if (desc_len > HIDD_APP_DESCRIPTOR_LEN - 6) {
-        android_errorWriteLog(0x534e4554, "113572366");
-      }
-
       result &= SDP_AddAttribute(handle, ATTR_ID_HID_DESCRIPTOR_LIST,
                                  DATA_ELE_SEQ_DESC_TYPE, p - p_buf, p_buf);
 
diff --git a/stack/hid/hidd_conn.cc b/stack/hid/hidd_conn.cc
index e4525f9..55ec3b2 100644
--- a/stack/hid/hidd_conn.cc
+++ b/stack/hid/hidd_conn.cc
@@ -614,6 +614,12 @@
 
   HIDD_TRACE_EVENT("%s: cid=%04x", __func__, cid);
 
+  if (p_msg->len < 1) {
+    HIDD_TRACE_ERROR("Invalid data length, ignore");
+    osi_free(p_msg);
+    return;
+  }
+
   p_hcon = &hd_cb.device.conn;
 
   if (p_hcon->conn_state == HID_CONN_STATE_UNUSED ||
@@ -756,12 +762,14 @@
   hd_cb.l2cap_intr_cfg.flush_to_present = TRUE;
   hd_cb.l2cap_intr_cfg.flush_to = HID_DEV_FLUSH_TO;
 
-  if (!L2CA_Register(HID_PSM_CONTROL, (tL2CAP_APPL_INFO*)&dev_reg_info)) {
+  if (!L2CA_Register(HID_PSM_CONTROL, (tL2CAP_APPL_INFO*)&dev_reg_info,
+                     false /* enable_snoop */)) {
     HIDD_TRACE_ERROR("HID Control (device) registration failed");
     return (HID_ERR_L2CAP_FAILED);
   }
 
-  if (!L2CA_Register(HID_PSM_INTERRUPT, (tL2CAP_APPL_INFO*)&dev_reg_info)) {
+  if (!L2CA_Register(HID_PSM_INTERRUPT, (tL2CAP_APPL_INFO*)&dev_reg_info,
+                     false /* enable_snoop */)) {
     L2CA_Deregister(HID_PSM_CONTROL);
     HIDD_TRACE_ERROR("HID Interrupt (device) registration failed");
     return (HID_ERR_L2CAP_FAILED);
diff --git a/stack/hid/hidh_conn.cc b/stack/hid/hidh_conn.cc
index 6b729e5..3c694f0 100644
--- a/stack/hid/hidh_conn.cc
+++ b/stack/hid/hidh_conn.cc
@@ -97,11 +97,13 @@
   hh_cb.l2cap_cfg.flush_to = HID_HOST_FLUSH_TO;
 
   /* Now, register with L2CAP */
-  if (!L2CA_Register(HID_PSM_CONTROL, (tL2CAP_APPL_INFO*)&hst_reg_info)) {
+  if (!L2CA_Register(HID_PSM_CONTROL, (tL2CAP_APPL_INFO*)&hst_reg_info,
+                     false /* enable_snoop */)) {
     HIDH_TRACE_ERROR("HID-Host Control Registration failed");
     return (HID_ERR_L2CAP_FAILED);
   }
-  if (!L2CA_Register(HID_PSM_INTERRUPT, (tL2CAP_APPL_INFO*)&hst_reg_info)) {
+  if (!L2CA_Register(HID_PSM_INTERRUPT, (tL2CAP_APPL_INFO*)&hst_reg_info,
+                     false /* enable_snoop */)) {
     L2CA_Deregister(HID_PSM_CONTROL);
     HIDH_TRACE_ERROR("HID-Host Interrupt Registration failed");
     return (HID_ERR_L2CAP_FAILED);
diff --git a/stack/include/advertise_data_parser.h b/stack/include/advertise_data_parser.h
index b62dbb3..a1ac17b 100644
--- a/stack/include/advertise_data_parser.h
+++ b/stack/include/advertise_data_parser.h
@@ -34,7 +34,8 @@
     auto data_start = ad.begin() + position;
 
     // Traxxas - bad name length
-    if (std::equal(data_start, data_start + 3, trx_quirk.begin()) &&
+    if ((ad.size() - position) >= 18 &&
+        std::equal(data_start, data_start + 3, trx_quirk.begin()) &&
         std::equal(data_start + 5, data_start + 11, trx_quirk.begin() + 5) &&
         std::equal(data_start + 12, data_start + 18, trx_quirk.begin() + 12)) {
       return true;
diff --git a/stack/include/bt_types.h b/stack/include/bt_types.h
index 0dd14b6..7804328 100644
--- a/stack/include/bt_types.h
+++ b/stack/include/bt_types.h
@@ -576,6 +576,14 @@
 constexpr int LINK_KEY_LEN = OCTET16_LEN;
 typedef Octet16 LinkKey; /* Link Key */
 
+/* Sample LTK from BT Spec 5.1 | Vol 6, Part C 1
+ * 0x4C68384139F574D836BCF34E9DFB01BF */
+constexpr Octet16 SAMPLE_LTK = {0xbf, 0x01, 0xfb, 0x9d, 0x4e, 0xf3, 0xbc, 0x36,
+                                0xd8, 0x74, 0xf5, 0x39, 0x41, 0x38, 0x68, 0x4c};
+inline bool is_sample_ltk(const Octet16& ltk) {
+  return ltk == SAMPLE_LTK;
+}
+
 #endif
 
 #define PIN_CODE_LEN 16
diff --git a/stack/include/btm_api_types.h b/stack/include/btm_api_types.h
old mode 100644
new mode 100755
index 965087c..d14b754
--- a/stack/include/btm_api_types.h
+++ b/stack/include/btm_api_types.h
@@ -611,7 +611,7 @@
 constexpr uint8_t PHY_LE_NO_PACKET = 0x00;
 constexpr uint8_t PHY_LE_1M = 0x01;
 constexpr uint8_t PHY_LE_2M = 0x02;
-constexpr uint8_t PHY_LE_CODED = 0x03;
+constexpr uint8_t PHY_LE_CODED = 0x04;
 
 constexpr uint8_t NO_ADI_PRESENT = 0xFF;
 constexpr uint8_t TX_POWER_NOT_PRESENT = 0x7F;
diff --git a/stack/include/btm_ble_api.h b/stack/include/btm_ble_api.h
index 12a2222..5bf325a 100644
--- a/stack/include/btm_ble_api.h
+++ b/stack/include/btm_ble_api.h
@@ -321,6 +321,18 @@
 
 /*******************************************************************************
  *
+ * Function         BTM_IsBleConnection
+ *
+ * Description      This function is called to check if the connection handle
+ *                  for an LE link
+ *
+ * Returns          true if connection is LE link, otherwise false.
+ *
+ ******************************************************************************/
+extern bool BTM_IsBleConnection(uint16_t conn_handle);
+
+/*******************************************************************************
+ *
  * Function         BTM_ReadRemoteConnectionAddr
  *
  * Description      Read the remote device address currently used.
diff --git a/stack/include/hcidefs.h b/stack/include/hcidefs.h
index ef87b5b..22df8af 100644
--- a/stack/include/hcidefs.h
+++ b/stack/include/hcidefs.h
@@ -396,35 +396,35 @@
 #define HCI_BLE_WRITE_RF_COMPENS_POWER (0x004D | HCI_GRP_BLE_CMDS)
 #define HCI_BLE_SET_PRIVACY_MODE (0x004E | HCI_GRP_BLE_CMDS)
 
-/* LE Get Vendor Capabilities Command OCF */
-#define HCI_BLE_VENDOR_CAP_OCF (0x0153 | HCI_GRP_VENDOR_SPECIFIC)
+/* LE Get Vendor Capabilities Command opcode */
+#define HCI_BLE_VENDOR_CAP (0x0153 | HCI_GRP_VENDOR_SPECIFIC)
 
-/* Multi adv OCF */
-#define HCI_BLE_MULTI_ADV_OCF (0x0154 | HCI_GRP_VENDOR_SPECIFIC)
+/* Multi adv opcode */
+#define HCI_BLE_MULTI_ADV (0x0154 | HCI_GRP_VENDOR_SPECIFIC)
 
-/* Batch scan OCF */
-#define HCI_BLE_BATCH_SCAN_OCF (0x0156 | HCI_GRP_VENDOR_SPECIFIC)
+/* Batch scan opcode */
+#define HCI_BLE_BATCH_SCAN (0x0156 | HCI_GRP_VENDOR_SPECIFIC)
 
-/* ADV filter OCF */
-#define HCI_BLE_ADV_FILTER_OCF (0x0157 | HCI_GRP_VENDOR_SPECIFIC)
+/* ADV filter opcode */
+#define HCI_BLE_ADV_FILTER (0x0157 | HCI_GRP_VENDOR_SPECIFIC)
 
-/* Tracking OCF */
-#define HCI_BLE_TRACK_ADV_OCF (0x0158 | HCI_GRP_VENDOR_SPECIFIC)
+/* Tracking opcode */
+#define HCI_BLE_TRACK_ADV (0x0158 | HCI_GRP_VENDOR_SPECIFIC)
 
-/* Energy info OCF */
-#define HCI_BLE_ENERGY_INFO_OCF (0x0159 | HCI_GRP_VENDOR_SPECIFIC)
+/* Energy info opcode */
+#define HCI_BLE_ENERGY_INFO (0x0159 | HCI_GRP_VENDOR_SPECIFIC)
 
-/* Extended BLE Scan parameters OCF */
-#define HCI_BLE_EXTENDED_SCAN_PARAMS_OCF (0x015A | HCI_GRP_VENDOR_SPECIFIC)
+/* Extended BLE Scan parameters opcode */
+#define HCI_BLE_EXTENDED_SCAN_PARAMS (0x015A | HCI_GRP_VENDOR_SPECIFIC)
 
-/* Controller debug info OCF */
-#define HCI_CONTROLLER_DEBUG_INFO_OCF (0x015B | HCI_GRP_VENDOR_SPECIFIC)
+/* Controller debug info opcode */
+#define HCI_CONTROLLER_DEBUG_INFO (0x015B | HCI_GRP_VENDOR_SPECIFIC)
 
-/* A2DP offload OCF */
-#define HCI_CONTROLLER_A2DP_OPCODE_OCF (0x015D | HCI_GRP_VENDOR_SPECIFIC)
+/* A2DP offload opcode */
+#define HCI_CONTROLLER_A2DP (0x015D | HCI_GRP_VENDOR_SPECIFIC)
 
-/* Bluetooth Quality Report OCF */
-#define HCI_CONTROLLER_BQR_OPCODE_OCF (0x015E | HCI_GRP_VENDOR_SPECIFIC)
+/* Bluetooth Quality Report opcode */
+#define HCI_CONTROLLER_BQR (0x015E | HCI_GRP_VENDOR_SPECIFIC)
 
 /* subcode for multi adv feature */
 #define BTM_BLE_MULTI_ADV_SET_PARAM 0x01
diff --git a/stack/include/hcimsgs.h b/stack/include/hcimsgs.h
index a586775..285ae41 100644
--- a/stack/include/hcimsgs.h
+++ b/stack/include/hcimsgs.h
@@ -610,6 +610,8 @@
 
 extern void btsnd_hcic_get_link_quality(uint16_t handle); /* Get Link Quality */
 extern void btsnd_hcic_read_rssi(uint16_t handle);        /* Read RSSI */
+using ReadEncKeySizeCb = base::OnceCallback<void(uint8_t, uint16_t, uint8_t)>;
+extern void btsnd_hcic_read_encryption_key_size(uint16_t handle, ReadEncKeySizeCb cb);
 extern void btsnd_hcic_read_failed_contact_counter(uint16_t handle);
 extern void btsnd_hcic_read_automatic_flush_timeout(uint16_t handle);
 extern void btsnd_hcic_enable_test_mode(
diff --git a/stack/include/l2c_api.h b/stack/include/l2c_api.h
index 88121af..8f364e7 100644
--- a/stack/include/l2c_api.h
+++ b/stack/include/l2c_api.h
@@ -328,7 +328,7 @@
 
 } tL2CAP_ERTM_INFO;
 
-#define L2CA_REGISTER(a, b, c) L2CA_Register(a, (tL2CAP_APPL_INFO*)(b))
+#define L2CA_REGISTER(a, b, c) L2CA_Register(a, (tL2CAP_APPL_INFO*)(b), c)
 #define L2CA_DEREGISTER(a) L2CA_Deregister(a)
 #define L2CA_CONNECT_REQ(a, b, c) L2CA_ErtmConnectReq(a, b, c)
 #define L2CA_CONNECT_RSP(a, b, c, d, e, f) L2CA_ErtmConnectRsp(a, b, c, d, e, f)
@@ -362,7 +362,8 @@
  *                  BTM_SetSecurityLevel().
  *
  ******************************************************************************/
-extern uint16_t L2CA_Register(uint16_t psm, tL2CAP_APPL_INFO* p_cb_info);
+extern uint16_t L2CA_Register(uint16_t psm, tL2CAP_APPL_INFO* p_cb_info,
+                              bool enable_snoop);
 
 /*******************************************************************************
  *
diff --git a/stack/l2cap/l2c_api.cc b/stack/l2cap/l2c_api.cc
index 6dc41de..feab995 100644
--- a/stack/l2cap/l2c_api.cc
+++ b/stack/l2cap/l2c_api.cc
@@ -39,6 +39,8 @@
 #include "hcimsgs.h"
 #include "l2c_int.h"
 #include "l2cdefs.h"
+#include "main/shim/l2c_api.h"
+#include "main/shim/shim.h"
 #include "osi/include/allocator.h"
 #include "osi/include/log.h"
 
@@ -58,7 +60,12 @@
  *                  L2CA_ErtmConnectReq() and L2CA_Deregister()
  *
  ******************************************************************************/
-uint16_t L2CA_Register(uint16_t psm, tL2CAP_APPL_INFO* p_cb_info) {
+uint16_t L2CA_Register(uint16_t psm, tL2CAP_APPL_INFO* p_cb_info,
+                       bool enable_snoop) {
+  if (bluetooth::shim::is_gd_shim_enabled()) {
+    return bluetooth::shim::L2CA_Register(psm, p_cb_info, enable_snoop);
+  }
+
   tL2C_RCB* p_rcb;
   uint16_t vpsm = psm;
 
@@ -104,6 +111,7 @@
     }
   }
 
+  p_rcb->log_packets = enable_snoop;
   p_rcb->api = *p_cb_info;
   p_rcb->real_psm = psm;
 
@@ -121,6 +129,10 @@
  *
  ******************************************************************************/
 void L2CA_Deregister(uint16_t psm) {
+  if (bluetooth::shim::is_gd_shim_enabled()) {
+    return bluetooth::shim::L2CA_Deregister(psm);
+  }
+
   tL2C_RCB* p_rcb;
   tL2C_CCB* p_ccb;
   tL2C_LCB* p_lcb;
@@ -167,6 +179,10 @@
  *
  ******************************************************************************/
 uint16_t L2CA_AllocatePSM(void) {
+  if (bluetooth::shim::is_gd_shim_enabled()) {
+    return bluetooth::shim::L2CA_AllocatePSM();
+  }
+
   bool done = false;
   uint16_t psm = l2cb.dyn_psm;
 
@@ -202,6 +218,10 @@
  *
  ******************************************************************************/
 uint16_t L2CA_AllocateLePSM(void) {
+  if (bluetooth::shim::is_gd_shim_enabled()) {
+    return bluetooth::shim::L2CA_AllocateLePSM();
+  }
+
   bool done = false;
   uint16_t psm = l2cb.le_dyn_psm;
   uint16_t count = 0;
@@ -248,6 +268,10 @@
  *
  ******************************************************************************/
 void L2CA_FreeLePSM(uint16_t psm) {
+  if (bluetooth::shim::is_gd_shim_enabled()) {
+    return bluetooth::shim::L2CA_FreeLePSM(psm);
+  }
+
   L2CAP_TRACE_API("%s: to free psm=%d", __func__, psm);
 
   if ((psm < LE_DYNAMIC_PSM_START) || (psm > LE_DYNAMIC_PSM_END)) {
@@ -275,6 +299,10 @@
  *
  ******************************************************************************/
 uint16_t L2CA_ConnectReq(uint16_t psm, const RawAddress& p_bd_addr) {
+  if (bluetooth::shim::is_gd_shim_enabled()) {
+    return bluetooth::shim::L2CA_ConnectReq(psm, p_bd_addr);
+  }
+
   return L2CA_ErtmConnectReq(psm, p_bd_addr, nullptr);
 }
 
@@ -297,6 +325,10 @@
  ******************************************************************************/
 uint16_t L2CA_ErtmConnectReq(uint16_t psm, const RawAddress& p_bd_addr,
                              tL2CAP_ERTM_INFO* p_ertm_info) {
+  if (bluetooth::shim::is_gd_shim_enabled()) {
+    return bluetooth::shim::L2CA_ErtmConnectReq(psm, p_bd_addr, p_ertm_info);
+  }
+
   VLOG(1) << __func__ << "BDA " << p_bd_addr
           << StringPrintf(" PSM: 0x%04x allowed:0x%x preferred:%d", psm,
                           (p_ertm_info) ? p_ertm_info->allowed_modes : 0,
@@ -398,6 +430,10 @@
  *
  ******************************************************************************/
 uint16_t L2CA_RegisterLECoc(uint16_t psm, tL2CAP_APPL_INFO* p_cb_info) {
+  if (bluetooth::shim::is_gd_shim_enabled()) {
+    return bluetooth::shim::L2CA_RegisterLECoc(psm, p_cb_info);
+  }
+
   L2CAP_TRACE_API("%s called for LE PSM: 0x%04x", __func__, psm);
 
   /* Verify that the required callback info has been filled in
@@ -462,6 +498,10 @@
  *
  ******************************************************************************/
 void L2CA_DeregisterLECoc(uint16_t psm) {
+  if (bluetooth::shim::is_gd_shim_enabled()) {
+    return bluetooth::shim::L2CA_DeregisterLECoc(psm);
+  }
+
   L2CAP_TRACE_API("%s called for PSM: 0x%04x", __func__, psm);
 
   tL2C_RCB* p_rcb = l2cu_find_ble_rcb_by_psm(psm);
@@ -508,6 +548,10 @@
  ******************************************************************************/
 uint16_t L2CA_ConnectLECocReq(uint16_t psm, const RawAddress& p_bd_addr,
                               tL2CAP_LE_CFG_INFO* p_cfg) {
+  if (bluetooth::shim::is_gd_shim_enabled()) {
+    return bluetooth::shim::L2CA_ConnectLECocReq(psm, p_bd_addr, p_cfg);
+  }
+
   VLOG(1) << __func__ << " BDA: " << p_bd_addr
           << StringPrintf(" PSM: 0x%04x", psm);
 
@@ -596,6 +640,11 @@
 bool L2CA_ConnectLECocRsp(const RawAddress& p_bd_addr, uint8_t id,
                           uint16_t lcid, uint16_t result, uint16_t status,
                           tL2CAP_LE_CFG_INFO* p_cfg) {
+  if (bluetooth::shim::is_gd_shim_enabled()) {
+    return bluetooth::shim::L2CA_ConnectLECocRsp(p_bd_addr, id, lcid, result,
+                                                 status, p_cfg);
+  }
+
   VLOG(1) << __func__ << " BDA: " << p_bd_addr
           << StringPrintf(" CID: 0x%04x Result: %d Status: %d", lcid, result,
                           status);
@@ -654,6 +703,10 @@
  *
  ******************************************************************************/
 bool L2CA_GetPeerLECocConfig(uint16_t lcid, tL2CAP_LE_CFG_INFO* peer_cfg) {
+  if (bluetooth::shim::is_gd_shim_enabled()) {
+    return bluetooth::shim::L2CA_GetPeerLECocConfig(lcid, peer_cfg);
+  }
+
   L2CAP_TRACE_API("%s CID: 0x%04x", __func__, lcid);
 
   tL2C_CCB* p_ccb = l2cu_find_ccb_by_cid(NULL, lcid);
@@ -670,6 +723,10 @@
 
 bool L2CA_SetConnectionCallbacks(uint16_t local_cid,
                                  const tL2CAP_APPL_INFO* callbacks) {
+  if (bluetooth::shim::is_gd_shim_enabled()) {
+    return bluetooth::shim::L2CA_SetConnectionCallbacks(local_cid, callbacks);
+  }
+
   CHECK(callbacks != NULL);
   CHECK(callbacks->pL2CA_ConnectInd_Cb == NULL);
   CHECK(callbacks->pL2CA_ConnectCfm_Cb != NULL);
@@ -719,6 +776,11 @@
  ******************************************************************************/
 bool L2CA_ConnectRsp(const RawAddress& p_bd_addr, uint8_t id, uint16_t lcid,
                      uint16_t result, uint16_t status) {
+  if (bluetooth::shim::is_gd_shim_enabled()) {
+    return bluetooth::shim::L2CA_ConnectRsp(p_bd_addr, id, lcid, result,
+                                            status);
+  }
+
   return L2CA_ErtmConnectRsp(p_bd_addr, id, lcid, result, status, NULL);
 }
 
@@ -736,6 +798,11 @@
 bool L2CA_ErtmConnectRsp(const RawAddress& p_bd_addr, uint8_t id, uint16_t lcid,
                          uint16_t result, uint16_t status,
                          tL2CAP_ERTM_INFO* p_ertm_info) {
+  if (bluetooth::shim::is_gd_shim_enabled()) {
+    return bluetooth::shim::L2CA_ErtmConnectRsp(p_bd_addr, id, lcid, result,
+                                                status, p_ertm_info);
+  }
+
   tL2C_LCB* p_lcb;
   tL2C_CCB* p_ccb;
 
@@ -815,6 +882,10 @@
  *
  ******************************************************************************/
 bool L2CA_ConfigReq(uint16_t cid, tL2CAP_CFG_INFO* p_cfg) {
+  if (bluetooth::shim::is_gd_shim_enabled()) {
+    return bluetooth::shim::L2CA_ConfigReq(cid, p_cfg);
+  }
+
   tL2C_CCB* p_ccb;
 
   L2CAP_TRACE_API(
@@ -864,6 +935,10 @@
  *
  ******************************************************************************/
 bool L2CA_ConfigRsp(uint16_t cid, tL2CAP_CFG_INFO* p_cfg) {
+  if (bluetooth::shim::is_gd_shim_enabled()) {
+    return bluetooth::shim::L2CA_ConfigRsp(cid, p_cfg);
+  }
+
   tL2C_CCB* p_ccb;
 
   L2CAP_TRACE_API(
@@ -907,6 +982,10 @@
  *
  ******************************************************************************/
 bool L2CA_DisconnectReq(uint16_t cid) {
+  if (bluetooth::shim::is_gd_shim_enabled()) {
+    return bluetooth::shim::L2CA_DisconnectReq(cid);
+  }
+
   tL2C_CCB* p_ccb;
 
   L2CAP_TRACE_API("L2CA_DisconnectReq()  CID: 0x%04x", cid);
@@ -934,6 +1013,10 @@
  *
  ******************************************************************************/
 bool L2CA_DisconnectRsp(uint16_t cid) {
+  if (bluetooth::shim::is_gd_shim_enabled()) {
+    return bluetooth::shim::L2CA_DisconnectRsp(cid);
+  }
+
   tL2C_CCB* p_ccb;
 
   L2CAP_TRACE_API("L2CA_DisconnectRsp()  CID: 0x%04x", cid);
@@ -960,6 +1043,10 @@
  *
  ******************************************************************************/
 bool L2CA_Ping(const RawAddress& p_bd_addr, tL2CA_ECHO_RSP_CB* p_callback) {
+  if (bluetooth::shim::is_gd_shim_enabled()) {
+    return bluetooth::shim::L2CA_Ping(p_bd_addr, p_callback);
+  }
+
   tL2C_LCB* p_lcb;
 
   VLOG(1) << __func__ << " BDA: " << p_bd_addr;
@@ -1023,6 +1110,10 @@
  ******************************************************************************/
 bool L2CA_Echo(const RawAddress& p_bd_addr, BT_HDR* p_data,
                tL2CA_ECHO_DATA_CB* p_callback) {
+  if (bluetooth::shim::is_gd_shim_enabled()) {
+    return bluetooth::shim::L2CA_Echo(p_bd_addr, p_data, p_callback);
+  }
+
   tL2C_LCB* p_lcb;
   uint8_t* pp;
 
@@ -1063,6 +1154,10 @@
 }
 
 bool L2CA_GetIdentifiers(uint16_t lcid, uint16_t* rcid, uint16_t* handle) {
+  if (bluetooth::shim::is_gd_shim_enabled()) {
+    return bluetooth::shim::L2CA_GetIdentifiers(lcid, rcid, handle);
+  }
+
   tL2C_CCB* control_block = l2cu_find_ccb_by_cid(NULL, lcid);
   if (!control_block) return false;
 
@@ -1092,6 +1187,10 @@
  *                  set up.
  ******************************************************************************/
 bool L2CA_SetIdleTimeout(uint16_t cid, uint16_t timeout, bool is_global) {
+  if (bluetooth::shim::is_gd_shim_enabled()) {
+    return bluetooth::shim::L2CA_SetIdleTimeout(cid, timeout, is_global);
+  }
+
   tL2C_CCB* p_ccb;
   tL2C_LCB* p_lcb;
 
@@ -1138,6 +1237,11 @@
  ******************************************************************************/
 bool L2CA_SetIdleTimeoutByBdAddr(const RawAddress& bd_addr, uint16_t timeout,
                                  tBT_TRANSPORT transport) {
+  if (bluetooth::shim::is_gd_shim_enabled()) {
+    return bluetooth::shim::L2CA_SetIdleTimeoutByBdAddr(bd_addr, timeout,
+                                                        transport);
+  }
+
   tL2C_LCB* p_lcb;
 
   if (RawAddress::kAny != bd_addr) {
@@ -1198,6 +1302,10 @@
  *
  ******************************************************************************/
 uint8_t L2CA_SetDesireRole(uint8_t new_role) {
+  if (bluetooth::shim::is_gd_shim_enabled()) {
+    return bluetooth::shim::L2CA_SetDesireRole(new_role);
+  }
+
   L2CAP_TRACE_API("L2CA_SetDesireRole() new:x%x, disallow_switch:%d", new_role,
                   l2cb.disallow_switch);
 
@@ -1228,6 +1336,10 @@
  ******************************************************************************/
 uint16_t L2CA_LocalLoopbackReq(uint16_t psm, uint16_t handle,
                                const RawAddress& p_bd_addr) {
+  if (bluetooth::shim::is_gd_shim_enabled()) {
+    return bluetooth::shim::L2CA_LocalLoopbackReq(psm, handle, p_bd_addr);
+  }
+
   tL2C_LCB* p_lcb;
   tL2C_CCB* p_ccb;
   tL2C_RCB* p_rcb;
@@ -1286,6 +1398,10 @@
  *
  ******************************************************************************/
 bool L2CA_SetAclPriority(const RawAddress& bd_addr, uint8_t priority) {
+  if (bluetooth::shim::is_gd_shim_enabled()) {
+    return bluetooth::shim::L2CA_SetAclPriority(bd_addr, priority);
+  }
+
   VLOG(1) << __func__ << " BDA: " << bd_addr
           << ", priority: " << std::to_string(priority);
   return (l2cu_set_acl_priority(bd_addr, priority, false));
@@ -1303,6 +1419,10 @@
  *
  ******************************************************************************/
 bool L2CA_FlowControl(uint16_t cid, bool data_enabled) {
+  if (bluetooth::shim::is_gd_shim_enabled()) {
+    return bluetooth::shim::L2CA_FlowControl(cid, data_enabled);
+  }
+
   tL2C_CCB* p_ccb;
   bool on_off = !data_enabled;
 
@@ -1346,6 +1466,10 @@
  *
  ******************************************************************************/
 bool L2CA_SendTestSFrame(uint16_t cid, uint8_t sup_type, uint8_t back_track) {
+  if (bluetooth::shim::is_gd_shim_enabled()) {
+    return bluetooth::shim::L2CA_SendTestSFrame(cid, sup_type, back_track);
+  }
+
   tL2C_CCB* p_ccb;
 
   L2CAP_TRACE_API(
@@ -1382,6 +1506,10 @@
  *
  ******************************************************************************/
 bool L2CA_SetTxPriority(uint16_t cid, tL2CAP_CHNL_PRIORITY priority) {
+  if (bluetooth::shim::is_gd_shim_enabled()) {
+    return bluetooth::shim::L2CA_SetTxPriority(cid, priority);
+  }
+
   tL2C_CCB* p_ccb;
 
   L2CAP_TRACE_API("L2CA_SetTxPriority()  CID: 0x%04x, priority:%d", cid,
@@ -1412,6 +1540,10 @@
  ******************************************************************************/
 bool L2CA_SetChnlDataRate(uint16_t cid, tL2CAP_CHNL_DATA_RATE tx,
                           tL2CAP_CHNL_DATA_RATE rx) {
+  if (bluetooth::shim::is_gd_shim_enabled()) {
+    return bluetooth::shim::L2CA_SetChnlDataRate(cid, tx, rx);
+  }
+
   tL2C_CCB* p_ccb;
 
   L2CAP_TRACE_API("L2CA_SetChnlDataRate()  CID: 0x%04x, tx:%d, rx:%d", cid, tx,
@@ -1459,6 +1591,10 @@
  *                  the ACL link.
  ******************************************************************************/
 bool L2CA_SetFlushTimeout(const RawAddress& bd_addr, uint16_t flush_tout) {
+  if (bluetooth::shim::is_gd_shim_enabled()) {
+    return bluetooth::shim::L2CA_SetFlushTimeout(bd_addr, flush_tout);
+  }
+
   tL2C_LCB* p_lcb;
   uint16_t hci_flush_to;
   uint32_t temp;
@@ -1543,6 +1679,11 @@
  ******************************************************************************/
 bool L2CA_GetPeerFeatures(const RawAddress& bd_addr, uint32_t* p_ext_feat,
                           uint8_t* p_chnl_mask) {
+  if (bluetooth::shim::is_gd_shim_enabled()) {
+    return bluetooth::shim::L2CA_GetPeerFeatures(bd_addr, p_ext_feat,
+                                                 p_chnl_mask);
+  }
+
   tL2C_LCB* p_lcb;
 
   /* We must already have a link to the remote */
@@ -1576,6 +1717,10 @@
  *
  ******************************************************************************/
 bool L2CA_GetBDAddrbyHandle(uint16_t handle, RawAddress& bd_addr) {
+  if (bluetooth::shim::is_gd_shim_enabled()) {
+    return bluetooth::shim::L2CA_GetBDAddrbyHandle(handle, bd_addr);
+  }
+
   tL2C_LCB* p_lcb = NULL;
   bool found_dev = false;
 
@@ -1600,6 +1745,10 @@
  *
  ******************************************************************************/
 uint8_t L2CA_GetChnlFcrMode(uint16_t lcid) {
+  if (bluetooth::shim::is_gd_shim_enabled()) {
+    return bluetooth::shim::L2CA_GetChnlFcrMode(lcid);
+  }
+
   tL2C_CCB* p_ccb = l2cu_find_ccb_by_cid(NULL, lcid);
 
   if (p_ccb) {
@@ -1627,6 +1776,10 @@
  ******************************************************************************/
 bool L2CA_RegisterFixedChannel(uint16_t fixed_cid,
                                tL2CAP_FIXED_CHNL_REG* p_freg) {
+  if (bluetooth::shim::is_gd_shim_enabled()) {
+    return bluetooth::shim::L2CA_RegisterFixedChannel(fixed_cid, p_freg);
+  }
+
   if ((fixed_cid < L2CAP_FIRST_FIXED_CHNL) ||
       (fixed_cid > L2CAP_LAST_FIXED_CHNL)) {
     L2CAP_TRACE_ERROR("L2CA_RegisterFixedChannel()  Invalid CID: 0x%04x",
@@ -1652,12 +1805,21 @@
  *
  ******************************************************************************/
 bool L2CA_ConnectFixedChnl(uint16_t fixed_cid, const RawAddress& rem_bda) {
+  if (bluetooth::shim::is_gd_shim_enabled()) {
+    return bluetooth::shim::L2CA_ConnectFixedChnl(fixed_cid, rem_bda);
+  }
+
   uint8_t phy = controller_get_interface()->get_le_all_initiating_phys();
   return L2CA_ConnectFixedChnl(fixed_cid, rem_bda, phy);
 }
 
 bool L2CA_ConnectFixedChnl(uint16_t fixed_cid, const RawAddress& rem_bda,
                            uint8_t initiating_phys) {
+  if (bluetooth::shim::is_gd_shim_enabled()) {
+    return bluetooth::shim::L2CA_ConnectFixedChnl(fixed_cid, rem_bda,
+                                                  initiating_phys);
+  }
+
   tL2C_LCB* p_lcb;
   tBT_TRANSPORT transport = BT_TRANSPORT_BR_EDR;
 
@@ -1770,6 +1932,10 @@
  ******************************************************************************/
 uint16_t L2CA_SendFixedChnlData(uint16_t fixed_cid, const RawAddress& rem_bda,
                                 BT_HDR* p_buf) {
+  if (bluetooth::shim::is_gd_shim_enabled()) {
+    return bluetooth::shim::L2CA_SendFixedChnlData(fixed_cid, rem_bda, p_buf);
+  }
+
   tL2C_LCB* p_lcb;
   tBT_TRANSPORT transport = BT_TRANSPORT_BR_EDR;
 
@@ -1883,6 +2049,10 @@
  *
  ******************************************************************************/
 bool L2CA_RemoveFixedChnl(uint16_t fixed_cid, const RawAddress& rem_bda) {
+  if (bluetooth::shim::is_gd_shim_enabled()) {
+    return bluetooth::shim::L2CA_RemoveFixedChnl(fixed_cid, rem_bda);
+  }
+
   tL2C_LCB* p_lcb;
   tL2C_CCB* p_ccb;
   tBT_TRANSPORT transport = BT_TRANSPORT_BR_EDR;
@@ -1950,6 +2120,11 @@
  ******************************************************************************/
 bool L2CA_SetFixedChannelTout(const RawAddress& rem_bda, uint16_t fixed_cid,
                               uint16_t idle_tout) {
+  if (bluetooth::shim::is_gd_shim_enabled()) {
+    return bluetooth::shim::L2CA_SetFixedChannelTout(rem_bda, fixed_cid,
+                                                     idle_tout);
+  }
+
   tL2C_LCB* p_lcb;
   tBT_TRANSPORT transport = BT_TRANSPORT_BR_EDR;
 
@@ -1997,6 +2172,11 @@
                            tL2CAP_CH_CFG_BITS* p_our_cfg_bits,
                            tL2CAP_CFG_INFO** pp_peer_cfg,
                            tL2CAP_CH_CFG_BITS* p_peer_cfg_bits) {
+  if (bluetooth::shim::is_gd_shim_enabled()) {
+    return bluetooth::shim::L2CA_GetCurrentConfig(
+        lcid, pp_our_cfg, p_our_cfg_bits, pp_peer_cfg, p_peer_cfg_bits);
+  }
+
   tL2C_CCB* p_ccb;
 
   L2CAP_TRACE_API("L2CA_GetCurrentConfig()  CID: 0x%04x", lcid);
@@ -2039,6 +2219,10 @@
  ******************************************************************************/
 bool L2CA_GetConnectionConfig(uint16_t lcid, uint16_t* mtu, uint16_t* rcid,
                               uint16_t* handle) {
+  if (bluetooth::shim::is_gd_shim_enabled()) {
+    return bluetooth::shim::L2CA_GetConnectionConfig(lcid, mtu, rcid, handle);
+  }
+
   tL2C_CCB* p_ccb = l2cu_find_ccb_by_cid(NULL, lcid);
   ;
 
@@ -2070,6 +2254,10 @@
  *
  ******************************************************************************/
 bool L2CA_RegForNoCPEvt(tL2CA_NOCP_CB* p_cb, const RawAddress& p_bda) {
+  if (bluetooth::shim::is_gd_shim_enabled()) {
+    return bluetooth::shim::L2CA_RegForNoCPEvt(p_cb, p_bda);
+  }
+
   tL2C_LCB* p_lcb;
 
   /* Find the link that is associated with this remote bdaddr */
@@ -2096,6 +2284,10 @@
  *
  ******************************************************************************/
 uint8_t L2CA_DataWrite(uint16_t cid, BT_HDR* p_data) {
+  if (bluetooth::shim::is_gd_shim_enabled()) {
+    return bluetooth::shim::L2CA_DataWrite(cid, p_data);
+  }
+
   L2CAP_TRACE_API("L2CA_DataWrite()  CID: 0x%04x  Len: %d", cid, p_data->len);
   return l2c_data_write(cid, p_data, L2CAP_FLUSHABLE_CH_BASED);
 }
@@ -2111,8 +2303,11 @@
  *
  ******************************************************************************/
 bool L2CA_SetChnlFlushability(uint16_t cid, bool is_flushable) {
-#if (L2CAP_NON_FLUSHABLE_PB_INCLUDED == TRUE)
+  if (bluetooth::shim::is_gd_shim_enabled()) {
+    return bluetooth::shim::L2CA_SetChnlFlushability(cid, is_flushable);
+  }
 
+#if (L2CAP_NON_FLUSHABLE_PB_INCLUDED == TRUE)
   tL2C_CCB* p_ccb;
 
   /* Find the channel control block. We don't know the link it is on. */
@@ -2150,6 +2345,10 @@
  *
  ******************************************************************************/
 uint8_t L2CA_DataWriteEx(uint16_t cid, BT_HDR* p_data, uint16_t flags) {
+  if (bluetooth::shim::is_gd_shim_enabled()) {
+    return bluetooth::shim::L2CA_DataWriteEx(cid, p_data, flags);
+  }
+
   L2CAP_TRACE_API("L2CA_DataWriteEx()  CID: 0x%04x  Len: %d Flags:0x%04X", cid,
                   p_data->len, flags);
   return l2c_data_write(cid, p_data, flags);
@@ -2170,6 +2369,10 @@
  *
  ******************************************************************************/
 uint16_t L2CA_FlushChannel(uint16_t lcid, uint16_t num_to_flush) {
+  if (bluetooth::shim::is_gd_shim_enabled()) {
+    return bluetooth::shim::L2CA_FlushChannel(lcid, num_to_flush);
+  }
+
   tL2C_CCB* p_ccb;
   tL2C_LCB* p_lcb;
   uint16_t num_left = 0, num_flushed1 = 0, num_flushed2 = 0;
diff --git a/stack/l2cap/l2c_fcr.cc b/stack/l2cap/l2c_fcr.cc
index 857a0bf..920448b 100644
--- a/stack/l2cap/l2c_fcr.cc
+++ b/stack/l2cap/l2c_fcr.cc
@@ -2163,23 +2163,29 @@
           /* Peer wants ERTM and we support it */
           if ((peer_mode == L2CAP_FCR_ERTM_MODE) &&
               (p_ccb->ertm_info.allowed_modes & L2CAP_FCR_CHAN_OPT_ERTM)) {
-            L2CAP_TRACE_DEBUG("l2c_fcr_renegotiate_chan(Trying ERTM)");
+            L2CAP_TRACE_DEBUG("%s(Trying ERTM)", __func__);
             p_ccb->our_cfg.fcr.mode = L2CAP_FCR_ERTM_MODE;
             can_renegotiate = true;
-          } else /* Falls through */
-
-          case L2CAP_FCR_ERTM_MODE: {
+          } else if (p_ccb->ertm_info.allowed_modes &
+                     L2CAP_FCR_CHAN_OPT_BASIC) {
             /* We can try basic for any other peer mode if we support it */
-            if (p_ccb->ertm_info.allowed_modes & L2CAP_FCR_CHAN_OPT_BASIC) {
-              L2CAP_TRACE_DEBUG("l2c_fcr_renegotiate_chan(Trying Basic)");
-              can_renegotiate = true;
-              p_ccb->our_cfg.fcr.mode = L2CAP_FCR_BASIC_MODE;
-            }
-          } break;
+            L2CAP_TRACE_DEBUG("%s(Trying Basic)", __func__);
+            can_renegotiate = true;
+            p_ccb->our_cfg.fcr.mode = L2CAP_FCR_BASIC_MODE;
+          }
+          break;
+        case L2CAP_FCR_ERTM_MODE:
+          /* We can try basic for any other peer mode if we support it */
+          if (p_ccb->ertm_info.allowed_modes & L2CAP_FCR_CHAN_OPT_BASIC) {
+            L2CAP_TRACE_DEBUG("%s(Trying Basic)", __func__);
+            can_renegotiate = true;
+            p_ccb->our_cfg.fcr.mode = L2CAP_FCR_BASIC_MODE;
+          }
+          break;
 
-          default:
-            /* All other scenarios cannot be renegotiated */
-            break;
+        default:
+          /* All other scenarios cannot be renegotiated */
+          break;
       }
 
       if (can_renegotiate) {
diff --git a/stack/l2cap/l2c_int.h b/stack/l2cap/l2c_int.h
index 0b71a19..53b6f32 100644
--- a/stack/l2cap/l2c_int.h
+++ b/stack/l2cap/l2c_int.h
@@ -241,6 +241,7 @@
 
 typedef struct {
   bool in_use;
+  bool log_packets;
   uint16_t psm;
   uint16_t real_psm; /* This may be a dummy RCB for an o/b connection but */
                      /* this is the real PSM that we need to connect to */
diff --git a/stack/l2cap/l2c_link.cc b/stack/l2cap/l2c_link.cc
index 8e04c6e..7f6d5b9 100644
--- a/stack/l2cap/l2c_link.cc
+++ b/stack/l2cap/l2c_link.cc
@@ -170,7 +170,12 @@
     p_lcb->link_state = LST_CONNECTING;
   }
 
-  if (p_lcb->link_state != LST_CONNECTING) {
+  if ((p_lcb->link_state == LST_CONNECTED) &&
+      (status == HCI_ERR_CONNECTION_EXISTS)) {
+    L2CAP_TRACE_WARNING("%s: An ACL connection already exists. Handle:%d",
+                        __func__, handle);
+    return (true);
+  } else if (p_lcb->link_state != LST_CONNECTING) {
     L2CAP_TRACE_ERROR("L2CAP got conn_comp in bad state: %d  status: 0x%d",
                       p_lcb->link_state, status);
 
@@ -675,6 +680,8 @@
   uint16_t num_hipri_links = 0;
   uint16_t controller_xmit_quota = l2cb.num_lm_acl_bufs;
   uint16_t high_pri_link_quota = L2CAP_HIGH_PRI_MIN_XMIT_QUOTA_A;
+  bool is_share_buffer =
+      (l2cb.num_lm_ble_bufs == L2C_DEF_NUM_BLE_BUF_SHARED) ? true : false;
 
   /* If no links active, reset buffer quotas and controller buffers */
   if (l2cb.num_links_active == 0) {
@@ -685,7 +692,8 @@
 
   /* First, count the links */
   for (yy = 0, p_lcb = &l2cb.lcb_pool[0]; yy < MAX_L2CAP_LINKS; yy++, p_lcb++) {
-    if (p_lcb->in_use) {
+    if (p_lcb->in_use &&
+        (is_share_buffer || p_lcb->transport != BT_TRANSPORT_LE)) {
       if (p_lcb->acl_priority == L2CAP_PRIORITY_HIGH)
         num_hipri_links++;
       else
@@ -732,7 +740,8 @@
 
   /* Now, assign the quotas to each link */
   for (yy = 0, p_lcb = &l2cb.lcb_pool[0]; yy < MAX_L2CAP_LINKS; yy++, p_lcb++) {
-    if (p_lcb->in_use) {
+    if (p_lcb->in_use &&
+        (is_share_buffer || p_lcb->transport != BT_TRANSPORT_LE)) {
       if (p_lcb->acl_priority == L2CAP_PRIORITY_HIGH) {
         p_lcb->link_xmit_quota = high_pri_link_quota;
       } else {
diff --git a/stack/l2cap/l2c_main.cc b/stack/l2cap/l2c_main.cc
index 74e7135..128f60e 100644
--- a/stack/l2cap/l2c_main.cc
+++ b/stack/l2cap/l2c_main.cc
@@ -33,6 +33,7 @@
 #include "btm_int.h"
 #include "btu.h"
 #include "device/include/controller.h"
+#include "hci/include/btsnoop.h"
 #include "hcimsgs.h"
 #include "l2c_api.h"
 #include "l2c_int.h"
@@ -79,8 +80,8 @@
 
   uint16_t hci_len;
   STREAM_TO_UINT16(hci_len, p);
-  if (hci_len < L2CAP_PKT_OVERHEAD) {
-    /* Must receive at least the L2CAP length and CID */
+  if (hci_len < L2CAP_PKT_OVERHEAD || hci_len != p_msg->len - 4) {
+    /* Remote-declared packet size must match HCI_ACL size - ACL header (4) */
     L2CAP_TRACE_WARNING("L2CAP - got incorrect hci header");
     osi_free(p_msg);
     return;
@@ -396,6 +397,14 @@
         p_ccb->p_rcb = p_rcb;
         p_ccb->remote_cid = rcid;
 
+        if (p_rcb->psm == BT_PSM_RFCOMM) {
+          btsnoop_get_interface()->add_rfc_l2c_channel(
+              p_lcb->handle, p_ccb->local_cid, p_ccb->remote_cid);
+        } else if (p_rcb->log_packets) {
+          btsnoop_get_interface()->whitelist_l2c_channel(
+              p_lcb->handle, p_ccb->local_cid, p_ccb->remote_cid);
+        }
+
         l2c_csm_execute(p_ccb, L2CEVT_L2CAP_CONNECT_REQ, &con_info);
         break;
       }
@@ -427,6 +436,15 @@
         else
           l2c_csm_execute(p_ccb, L2CEVT_L2CAP_CONNECT_RSP_NEG, &con_info);
 
+        tL2C_RCB* p_rcb = p_ccb->p_rcb;
+        if (p_rcb->psm == BT_PSM_RFCOMM) {
+          btsnoop_get_interface()->add_rfc_l2c_channel(
+              p_lcb->handle, p_ccb->local_cid, p_ccb->remote_cid);
+        } else if (p_rcb->log_packets) {
+          btsnoop_get_interface()->whitelist_l2c_channel(
+              p_lcb->handle, p_ccb->local_cid, p_ccb->remote_cid);
+        }
+
         break;
       }
 
@@ -763,6 +781,10 @@
 #if (L2CAP_NUM_FIXED_CHNLS > 0)
         if (info_type == L2CAP_FIXED_CHANNELS_INFO_TYPE) {
           if (result == L2CAP_INFO_RESP_RESULT_SUCCESS) {
+            if (p + L2CAP_FIXED_CHNL_ARRAY_SIZE > p_next_cmd) {
+              android_errorWriteLog(0x534e4554, "111215173");
+              return;
+            }
             memcpy(p_lcb->peer_chnl_mask, p, L2CAP_FIXED_CHNL_ARRAY_SIZE);
           }
 
diff --git a/stack/l2cap/l2c_utils.cc b/stack/l2cap/l2c_utils.cc
index 448acaa..593f12f 100644
--- a/stack/l2cap/l2c_utils.cc
+++ b/stack/l2cap/l2c_utils.cc
@@ -33,6 +33,7 @@
 #include "btm_int.h"
 #include "btu.h"
 #include "device/include/controller.h"
+#include "hci/include/btsnoop.h"
 #include "hcidefs.h"
 #include "hcimsgs.h"
 #include "l2c_int.h"
@@ -1569,6 +1570,9 @@
   /* If already released, could be race condition */
   if (!p_ccb->in_use) return;
 
+  btsnoop_get_interface()->clear_l2cap_whitelist(
+      p_lcb->handle, p_ccb->local_cid, p_ccb->remote_cid);
+
   if (p_rcb && (p_rcb->psm != p_rcb->real_psm)) {
     btm_sec_clr_service_by_psm(p_rcb->psm);
   }
diff --git a/stack/l2cap/l2cap_client.cc b/stack/l2cap/l2cap_client.cc
index 76e4138..b3f3737 100644
--- a/stack/l2cap/l2cap_client.cc
+++ b/stack/l2cap/l2cap_client.cc
@@ -70,8 +70,8 @@
     .pL2CA_ConfigCfm_Cb = config_completed_cb,
     .pL2CA_DisconnectInd_Cb = disconnect_request_cb,
     .pL2CA_DisconnectCfm_Cb = disconnect_completed_cb,
-    .pL2CA_CongestionStatus_Cb = congestion_cb,
     .pL2CA_DataInd_Cb = read_ready_cb,
+    .pL2CA_CongestionStatus_Cb = congestion_cb,
     .pL2CA_TxComplete_Cb = write_completed_cb,
 };
 
diff --git a/stack/rfcomm/rfc_l2cap_if.cc b/stack/rfcomm/rfc_l2cap_if.cc
index 3275d77..3dc4ec2 100644
--- a/stack/rfcomm/rfc_l2cap_if.cc
+++ b/stack/rfcomm/rfc_l2cap_if.cc
@@ -30,6 +30,7 @@
 #include "osi/include/osi.h"
 
 #include "bt_utils.h"
+#include "hci/include/btsnoop.h"
 #include "l2c_api.h"
 #include "l2cdefs.h"
 #include "port_api.h"
@@ -73,7 +74,7 @@
   p_l2c->pL2CA_CongestionStatus_Cb = RFCOMM_CongestionStatusInd;
   p_l2c->pL2CA_TxComplete_Cb = NULL;
 
-  L2CA_Register(BT_PSM_RFCOMM, p_l2c);
+  L2CA_Register(BT_PSM_RFCOMM, p_l2c, true /* enable_snoop */);
 }
 
 /*******************************************************************************
diff --git a/stack/rfcomm/rfc_port_fsm.cc b/stack/rfcomm/rfc_port_fsm.cc
index f486bdd..1b82ddf 100644
--- a/stack/rfcomm/rfc_port_fsm.cc
+++ b/stack/rfcomm/rfc_port_fsm.cc
@@ -34,6 +34,14 @@
 #include "rfc_int.h"
 #include "rfcdefs.h"
 
+#include <set>
+#include "hci/include/btsnoop.h"
+
+static const std::set<uint16_t> uuid_logging_whitelist = {
+    UUID_SERVCLASS_HEADSET_AUDIO_GATEWAY,
+    UUID_SERVCLASS_AG_HANDSFREE,
+};
+
 /******************************************************************************/
 /*            L O C A L    F U N C T I O N     P R O T O T Y P E S            */
 /******************************************************************************/
@@ -206,6 +214,13 @@
     case RFC_EVENT_UA:
       rfc_port_timer_stop(p_port);
       p_port->rfc.state = RFC_STATE_OPENED;
+
+      if (uuid_logging_whitelist.find(p_port->uuid) !=
+          uuid_logging_whitelist.end()) {
+        btsnoop_get_interface()->whitelist_rfc_dlci(p_port->rfc.p_mcb->lcid,
+                                                    p_port->dlci);
+      }
+
       PORT_DlcEstablishCnf(p_port->rfc.p_mcb, p_port->dlci,
                            p_port->rfc.p_mcb->peer_l2cap_mtu, RFCOMM_SUCCESS);
       return;
@@ -317,6 +332,12 @@
       } else {
         rfc_send_ua(p_port->rfc.p_mcb, p_port->dlci);
         p_port->rfc.state = RFC_STATE_OPENED;
+
+        if (uuid_logging_whitelist.find(p_port->uuid) !=
+            uuid_logging_whitelist.end()) {
+          btsnoop_get_interface()->whitelist_rfc_dlci(p_port->rfc.p_mcb->lcid,
+                                                      p_port->dlci);
+        }
       }
       return;
   }
diff --git a/stack/rfcomm/rfc_ts_frames.cc b/stack/rfcomm/rfc_ts_frames.cc
index d253b40..7bc98a2 100644
--- a/stack/rfcomm/rfc_ts_frames.cc
+++ b/stack/rfcomm/rfc_ts_frames.cc
@@ -533,12 +533,21 @@
     return RFC_EVENT_BAD_FRAME;
   }
 
+  if (p_buf->len < (3 + !ead + !eal + 1)) {
+    android_errorWriteLog(0x534e4554, "120255805");
+    RFCOMM_TRACE_ERROR("Bad Length: %d", p_buf->len);
+    return RFC_EVENT_BAD_FRAME;
+  }
   p_buf->len -= (3 + !ead + !eal + 1); /* Additional 1 for FCS */
   p_buf->offset += (3 + !ead + !eal);
 
   /* handle credit if credit based flow control */
   if ((p_mcb->flow == PORT_FC_CREDIT) && (p_frame->type == RFCOMM_UIH) &&
       (p_frame->dlci != RFCOMM_MX_DLCI) && (p_frame->pf == 1)) {
+    if (p_buf->len < sizeof(uint8_t)) {
+      RFCOMM_TRACE_ERROR("Bad Length in flow control: %d", p_buf->len);
+      return RFC_EVENT_BAD_FRAME;
+    }
     p_frame->credit = *p_data++;
     p_buf->len--;
     p_buf->offset++;
diff --git a/stack/sdp/sdp_db.cc b/stack/sdp/sdp_db.cc
index 28eae10..ea5b84d 100644
--- a/stack/sdp/sdp_db.cc
+++ b/stack/sdp/sdp_db.cc
@@ -117,7 +117,11 @@
 
   while (p < p_end) {
     type = *p++;
-    p = sdpu_get_len_from_type(p, type, &len);
+    p = sdpu_get_len_from_type(p, p_end, type, &len);
+    if (p == NULL || (p + len) > p_end) {
+      SDP_TRACE_WARNING("%s: bad length", __func__);
+      break;
+    }
     type = type >> 3;
     if (type == UUID_DESC_TYPE) {
       if (sdpu_compare_uuid_arrays(p, len, p_uuid, uuid_len)) return (true);
diff --git a/stack/sdp/sdp_discovery.cc b/stack/sdp/sdp_discovery.cc
index 29377b0..55259ca 100644
--- a/stack/sdp/sdp_discovery.cc
+++ b/stack/sdp/sdp_discovery.cc
@@ -217,6 +217,12 @@
   p = (uint8_t*)(p_msg + 1) + p_msg->offset;
   uint8_t* p_end = p + p_msg->len;
 
+  if (p_msg->len < 1) {
+    android_errorWriteLog(0x534e4554, "79883568");
+    sdp_disconnect(p_ccb, SDP_GENERIC_ERROR);
+    return;
+  }
+
   BE_STREAM_TO_UINT8(rsp_pdu, p);
 
   p_msg->len--;
@@ -336,18 +342,24 @@
   unsigned int cpy_len, rem_len;
   uint32_t list_len;
   uint8_t* p;
+  uint8_t* p_end;
   uint8_t type;
 
   if (p_ccb->p_db->raw_data) {
     cpy_len = p_ccb->p_db->raw_size - p_ccb->p_db->raw_used;
     list_len = p_ccb->list_len;
     p = &p_ccb->rsp_list[0];
+    p_end = &p_ccb->rsp_list[0] + list_len;
 
     if (offset) {
       cpy_len -= 1;
       type = *p++;
       uint8_t* old_p = p;
-      p = sdpu_get_len_from_type(p, type, &list_len);
+      p = sdpu_get_len_from_type(p, p_end, type, &list_len);
+      if (p == NULL || (p + list_len) > p_end) {
+        SDP_TRACE_WARNING("%s: bad length", __func__);
+        return;
+      }
       if ((int)cpy_len < (p - old_p)) {
         SDP_TRACE_WARNING("%s: no bytes left for data", __func__);
         return;
@@ -362,11 +374,6 @@
       SDP_TRACE_WARNING("rem_len :%d less than cpy_len:%d", rem_len, cpy_len);
       cpy_len = rem_len;
     }
-    SDP_TRACE_WARNING(
-        "%s: list_len:%d cpy_len:%d p:%p p_ccb:%p p_db:%p raw_size:%d "
-        "raw_used:%d raw_data:%p",
-        __func__, list_len, cpy_len, p, p_ccb, p_ccb->p_db,
-        p_ccb->p_db->raw_size, p_ccb->p_db->raw_used, p_ccb->p_db->raw_data);
     memcpy(&p_ccb->p_db->raw_data[p_ccb->p_db->raw_used], p, cpy_len);
     p_ccb->p_db->raw_used += cpy_len;
   }
@@ -391,6 +398,12 @@
 
   /* If p_reply is NULL, we were called after the records handles were read */
   if (p_reply) {
+    if (p_reply + 4 /* transaction ID and length */ + sizeof(list_byte_count) >
+        p_reply_end) {
+      sdp_disconnect(p_ccb, SDP_INVALID_PDU_SIZE);
+      return;
+    }
+
     /* Skip transaction ID and length */
     p_reply += 4;
 
@@ -631,8 +644,11 @@
     SDP_TRACE_WARNING("SDP - Wrong type: 0x%02x in attr_rsp", type);
     return;
   }
-  p = sdpu_get_len_from_type(p, type, &seq_len);
-
+  p = sdpu_get_len_from_type(p, p + p_ccb->list_len, type, &seq_len);
+  if (p == NULL || (p + seq_len) > (p + p_ccb->list_len)) {
+    SDP_TRACE_WARNING("%s: bad length", __func__);
+    return;
+  }
   p_end = &p_ccb->rsp_list[p_ccb->list_len];
 
   if ((p + seq_len) != p_end) {
@@ -675,9 +691,8 @@
     SDP_TRACE_WARNING("SDP - Wrong type: 0x%02x in attr_rsp", type);
     return (NULL);
   }
-
-  p = sdpu_get_len_from_type(p, type, &seq_len);
-  if ((p + seq_len) > p_msg_end) {
+  p = sdpu_get_len_from_type(p, p_msg_end, type, &seq_len);
+  if (p == NULL || (p + seq_len) > p_msg_end) {
     SDP_TRACE_WARNING("SDP - Bad len in attr_rsp %d", seq_len);
     return (NULL);
   }
@@ -694,7 +709,11 @@
   while (p < p_seq_end) {
     /* First get the attribute ID */
     type = *p++;
-    p = sdpu_get_len_from_type(p, type, &attr_len);
+    p = sdpu_get_len_from_type(p, p_msg_end, type, &attr_len);
+    if (p == NULL || (p + attr_len) > p_seq_end) {
+      SDP_TRACE_WARNING("%s: Bad len in attr_rsp %d", __func__, attr_len);
+      return (NULL);
+    }
     if (((type >> 3) != UINT_DESC_TYPE) || (attr_len != 2)) {
       SDP_TRACE_WARNING("SDP - Bad type: 0x%02x or len: %d in attr_rsp", type,
                         attr_len);
@@ -778,8 +797,11 @@
   nest_level &= ~(SDP_ADDITIONAL_LIST_MASK);
 
   type = *p++;
-  p = sdpu_get_len_from_type(p, type, &attr_len);
-
+  p = sdpu_get_len_from_type(p, p_end, type, &attr_len);
+  if (p == NULL || (p + attr_len) > p_end) {
+    SDP_TRACE_WARNING("%s: bad length in attr_rsp", __func__);
+    return NULL;
+  }
   attr_len &= SDP_DISC_ATTR_LEN_MASK;
   attr_type = (type >> 3) & 0x0f;
 
diff --git a/stack/sdp/sdp_main.cc b/stack/sdp/sdp_main.cc
index 3df37c5..2211c39 100644
--- a/stack/sdp/sdp_main.cc
+++ b/stack/sdp/sdp_main.cc
@@ -121,7 +121,7 @@
   sdp_cb.reg_info.pL2CA_TxComplete_Cb = NULL;
 
   /* Now, register with L2CAP */
-  if (!L2CA_Register(SDP_PSM, &sdp_cb.reg_info)) {
+  if (!L2CA_Register(SDP_PSM, &sdp_cb.reg_info, true /* enable_snoop */)) {
     SDP_TRACE_ERROR("SDP Registration failed");
   }
 }
diff --git a/stack/sdp/sdp_utils.cc b/stack/sdp/sdp_utils.cc
index 2c3aee2..33f30b0 100644
--- a/stack/sdp/sdp_utils.cc
+++ b/stack/sdp/sdp_utils.cc
@@ -784,7 +784,8 @@
  * Returns          void
  *
  ******************************************************************************/
-uint8_t* sdpu_get_len_from_type(uint8_t* p, uint8_t type, uint32_t* p_len) {
+uint8_t* sdpu_get_len_from_type(uint8_t* p, uint8_t* p_end, uint8_t type,
+                                uint32_t* p_len) {
   uint8_t u8;
   uint16_t u16;
   uint32_t u32;
@@ -806,14 +807,26 @@
       *p_len = 16;
       break;
     case SIZE_IN_NEXT_BYTE:
+      if (p + 1 > p_end) {
+        *p_len = 0;
+        return NULL;
+      }
       BE_STREAM_TO_UINT8(u8, p);
       *p_len = u8;
       break;
     case SIZE_IN_NEXT_WORD:
+      if (p + 2 > p_end) {
+        *p_len = 0;
+        return NULL;
+      }
       BE_STREAM_TO_UINT16(u16, p);
       *p_len = u16;
       break;
     case SIZE_IN_NEXT_LONG:
+      if (p + 4 > p_end) {
+        *p_len = 0;
+        return NULL;
+      }
       BE_STREAM_TO_UINT32(u32, p);
       *p_len = (uint16_t)u32;
       break;
diff --git a/stack/sdp/sdpint.h b/stack/sdp/sdpint.h
index 6ba9597..20c6fbd 100644
--- a/stack/sdp/sdpint.h
+++ b/stack/sdp/sdpint.h
@@ -265,7 +265,7 @@
 extern uint8_t* sdpu_extract_uid_seq(uint8_t* p, uint16_t param_len,
                                      tSDP_UUID_SEQ* p_seq);
 
-extern uint8_t* sdpu_get_len_from_type(uint8_t* p, uint8_t type,
+extern uint8_t* sdpu_get_len_from_type(uint8_t* p, uint8_t* p_end, uint8_t type,
                                        uint32_t* p_len);
 extern bool sdpu_is_base_uuid(uint8_t* p_uuid);
 extern bool sdpu_compare_uuid_arrays(uint8_t* p_uuid1, uint32_t len1,
diff --git a/stack/smp/smp_act.cc b/stack/smp/smp_act.cc
index db6ed66..21b960b 100644
--- a/stack/smp/smp_act.cc
+++ b/stack/smp/smp_act.cc
@@ -16,6 +16,7 @@
  *
  ******************************************************************************/
 
+#include <cutils/log.h>
 #include <log/log.h>
 #include <string.h>
 #include "btif_common.h"
@@ -488,7 +489,15 @@
  ******************************************************************************/
 void smp_proc_pair_fail(tSMP_CB* p_cb, tSMP_INT_DATA* p_data) {
   SMP_TRACE_DEBUG("%s", __func__);
-  p_cb->status = p_data->status;
+
+  if (p_cb->rcvd_cmd_len < 2) {
+    android_errorWriteLog(0x534e4554, "111214739");
+    SMP_TRACE_WARNING("%s: rcvd_cmd_len %d too short: must be at least 2",
+                      __func__, p_cb->rcvd_cmd_len);
+    p_cb->status = SMP_INVALID_PARAMETERS;
+  } else {
+    p_cb->status = p_data->status;
+  }
 
   /* Cancel pending auth complete timer if set */
   alarm_cancel(p_cb->delayed_auth_timer_ent);
@@ -511,6 +520,14 @@
 
   p_cb->flags |= SMP_PAIR_FLAG_ENC_AFTER_PAIR;
 
+  if (smp_command_has_invalid_length(p_cb)) {
+    tSMP_INT_DATA smp_int_data;
+    smp_int_data.status = SMP_INVALID_PARAMETERS;
+    android_errorWriteLog(0x534e4554, "111850706");
+    smp_sm_event(p_cb, SMP_AUTH_CMPL_EVT, &smp_int_data);
+    return;
+  }
+
   STREAM_TO_UINT8(p_cb->peer_io_caps, p);
   STREAM_TO_UINT8(p_cb->peer_oob_flag, p);
   STREAM_TO_UINT8(p_cb->peer_auth_req, p);
@@ -779,6 +796,14 @@
 
   p_cb->flags |= SMP_PAIR_FLAG_ENC_AFTER_PAIR;
 
+  if (smp_command_has_invalid_length(p_cb)) {
+    tSMP_INT_DATA smp_int_data;
+    smp_int_data.status = SMP_INVALID_PARAMETERS;
+    android_errorWriteLog(0x534e4554, "111213909");
+    smp_br_state_machine_event(p_cb, SMP_BR_AUTH_CMPL_EVT, &smp_int_data);
+    return;
+  }
+
   STREAM_TO_UINT8(p_cb->peer_io_caps, p);
   STREAM_TO_UINT8(p_cb->peer_oob_flag, p);
   STREAM_TO_UINT8(p_cb->peer_auth_req, p);
@@ -942,7 +967,7 @@
   STREAM_TO_ARRAY(le_key.penc_key.rand, p, BT_OCTET8_LEN);
 
   /* store the encryption keys from peer device */
-  le_key.lenc_key.ltk = p_cb->ltk;
+  le_key.penc_key.ltk = p_cb->ltk;
   le_key.penc_key.sec_level = p_cb->sec_level;
   le_key.penc_key.key_size = p_cb->loc_enc_size;
 
@@ -977,6 +1002,15 @@
   tBTM_LE_KEY_VALUE pid_key;
 
   SMP_TRACE_DEBUG("%s", __func__);
+
+  if (smp_command_has_invalid_parameters(p_cb)) {
+    tSMP_INT_DATA smp_int_data;
+    smp_int_data.status = SMP_INVALID_PARAMETERS;
+    android_errorWriteLog(0x534e4554, "111214770");
+    smp_sm_event(p_cb, SMP_AUTH_CMPL_EVT, &smp_int_data);
+    return;
+  }
+
   smp_update_key_mask(p_cb, SMP_SEC_KEY_TYPE_ID, true);
 
   STREAM_TO_UINT8(pid_key.pid_key.identity_addr_type, p);
@@ -1000,6 +1034,15 @@
   tBTM_LE_KEY_VALUE le_key;
 
   SMP_TRACE_DEBUG("%s", __func__);
+
+  if (smp_command_has_invalid_parameters(p_cb)) {
+    tSMP_INT_DATA smp_int_data;
+    smp_int_data.status = SMP_INVALID_PARAMETERS;
+    android_errorWriteLog(0x534e4554, "111214470");
+    smp_sm_event(p_cb, SMP_AUTH_CMPL_EVT, &smp_int_data);
+    return;
+  }
+
   smp_update_key_mask(p_cb, SMP_SEC_KEY_TYPE_CSRK, true);
 
   /* save CSRK to security record */
diff --git a/stack/smp/smp_int.h b/stack/smp/smp_int.h
index 9886d4f..72fdf55 100644
--- a/stack/smp/smp_int.h
+++ b/stack/smp/smp_int.h
@@ -450,6 +450,7 @@
 extern void smp_mask_enc_key(uint8_t loc_enc_size, Octet16* p_data);
 extern void smp_rsp_timeout(void* data);
 extern void smp_delayed_auth_complete_timeout(void* data);
+extern bool smp_command_has_invalid_length(tSMP_CB* p_cb);
 extern bool smp_command_has_invalid_parameters(tSMP_CB* p_cb);
 extern void smp_reject_unexpected_pairing_command(const RawAddress& bd_addr);
 extern tSMP_ASSO_MODEL smp_select_association_model(tSMP_CB* p_cb);
diff --git a/stack/smp/smp_l2c.cc b/stack/smp/smp_l2c.cc
index b6881e6..2daeb21 100644
--- a/stack/smp/smp_l2c.cc
+++ b/stack/smp/smp_l2c.cc
@@ -22,6 +22,7 @@
  *
  ******************************************************************************/
 
+#include <cutils/log.h>
 #include "bt_target.h"
 
 #include <string.h>
@@ -142,6 +143,14 @@
   uint8_t* p = (uint8_t*)(p_buf + 1) + p_buf->offset;
   uint8_t cmd;
 
+  if (p_buf->len < 1) {
+    android_errorWriteLog(0x534e4554, "111215315");
+    SMP_TRACE_WARNING("%s: smp packet length %d too short: must be at least 1",
+                      __func__, p_buf->len);
+    osi_free(p_buf);
+    return;
+  }
+
   STREAM_TO_UINT8(cmd, p);
 
   SMP_TRACE_EVENT("%s: SMDBG l2c, cmd=0x%x", __func__, cmd);
@@ -286,6 +295,14 @@
   uint8_t cmd;
   SMP_TRACE_EVENT("SMDBG l2c %s", __func__);
 
+  if (p_buf->len < 1) {
+    android_errorWriteLog(0x534e4554, "111215315");
+    SMP_TRACE_WARNING("%s: smp packet length %d too short: must be at least 1",
+                      __func__, p_buf->len);
+    osi_free(p_buf);
+    return;
+  }
+
   STREAM_TO_UINT8(cmd, p);
 
   /* sanity check */
diff --git a/stack/smp/smp_utils.cc b/stack/smp/smp_utils.cc
index f81e21d..b5da5ba 100644
--- a/stack/smp/smp_utils.cc
+++ b/stack/smp/smp_utils.cc
@@ -955,6 +955,33 @@
 
 /*******************************************************************************
  *
+ * Function         smp_command_has_invalid_length
+ *
+ * Description      Checks if the received SMP command has invalid length
+ *                  It returns true if the command has invalid length.
+ *
+ * Returns          true if the command has invalid length, false otherwise.
+ *
+ ******************************************************************************/
+bool smp_command_has_invalid_length(tSMP_CB* p_cb) {
+  uint8_t cmd_code = p_cb->rcvd_cmd_code;
+
+  if ((cmd_code > (SMP_OPCODE_MAX + 1 /* for SMP_OPCODE_PAIR_COMMITM */)) ||
+      (cmd_code < SMP_OPCODE_MIN)) {
+    SMP_TRACE_WARNING("%s: Received command with RESERVED code 0x%02x",
+                      __func__, cmd_code);
+    return true;
+  }
+
+  if (!smp_command_has_valid_fixed_length(p_cb)) {
+    return true;
+  }
+
+  return false;
+}
+
+/*******************************************************************************
+ *
  * Function         smp_command_has_invalid_parameters
  *
  * Description      Checks if the received SMP command has invalid parameters
diff --git a/stack/test/common/mock_btsnoop_module.cc b/stack/test/common/mock_btsnoop_module.cc
new file mode 100644
index 0000000..7a5c5ae
--- /dev/null
+++ b/stack/test/common/mock_btsnoop_module.cc
@@ -0,0 +1,42 @@
+/******************************************************************************
+ *
+ *  Copyright 2019 The Android Open Source Project
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at:
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ ******************************************************************************/
+
+#include "hci/include/btsnoop.h"
+
+static void capture(const BT_HDR*, bool) { /* do nothing */
+}
+
+static void whitelist_l2c_channel(uint16_t, uint16_t,
+                                  uint16_t) { /* do nothing */
+}
+
+static void whitelist_rfc_dlci(uint16_t, uint8_t) { /* do nothing */
+}
+
+static void add_rfc_l2c_channel(uint16_t, uint16_t, uint16_t) { /* do nothing */
+}
+
+static void clear_l2cap_whitelist(uint16_t, uint16_t,
+                                  uint16_t) { /* do nothing */
+}
+
+static const btsnoop_t fake_snoop = {capture, whitelist_l2c_channel,
+                                     whitelist_rfc_dlci, add_rfc_l2c_channel,
+                                     clear_l2cap_whitelist};
+
+const btsnoop_t* btsnoop_get_interface() { return &fake_snoop; }
diff --git a/stack/test/common/mock_l2cap_layer.cc b/stack/test/common/mock_l2cap_layer.cc
index 9f08d56..4756f17 100644
--- a/stack/test/common/mock_l2cap_layer.cc
+++ b/stack/test/common/mock_l2cap_layer.cc
@@ -24,9 +24,11 @@
   l2cap_interface = mock_l2cap_interface;
 }
 
-uint16_t L2CA_Register(uint16_t psm, tL2CAP_APPL_INFO* p_cb_info) {
-  VLOG(1) << __func__ << ": psm=" << psm << ", p_cb_info=" << p_cb_info;
-  return l2cap_interface->Register(psm, p_cb_info);
+uint16_t L2CA_Register(uint16_t psm, tL2CAP_APPL_INFO* p_cb_info,
+                       bool enable_snoop) {
+  VLOG(1) << __func__ << ": psm=" << psm << ", p_cb_info=" << p_cb_info
+          << ", enable_snoop=" << enable_snoop;
+  return l2cap_interface->Register(psm, p_cb_info, enable_snoop);
 }
 
 uint16_t L2CA_ConnectReq(uint16_t psm, const RawAddress& bd_addr) {
diff --git a/stack/test/common/mock_l2cap_layer.h b/stack/test/common/mock_l2cap_layer.h
index 78c8a9c..ade7585 100644
--- a/stack/test/common/mock_l2cap_layer.h
+++ b/stack/test/common/mock_l2cap_layer.h
@@ -26,7 +26,8 @@
 
 class L2capInterface {
  public:
-  virtual uint16_t Register(uint16_t psm, tL2CAP_APPL_INFO* p_cb_info) = 0;
+  virtual uint16_t Register(uint16_t psm, tL2CAP_APPL_INFO* p_cb_info,
+                            bool enable_snoop) = 0;
   virtual uint16_t ConnectRequest(uint16_t psm, const RawAddress& bd_addr) = 0;
   virtual bool ConnectResponse(const RawAddress& bd_addr, uint8_t id,
                                uint16_t lcid, uint16_t result,
@@ -41,7 +42,8 @@
 
 class MockL2capInterface : public L2capInterface {
  public:
-  MOCK_METHOD2(Register, uint16_t(uint16_t psm, tL2CAP_APPL_INFO* p_cb_info));
+  MOCK_METHOD3(Register, uint16_t(uint16_t psm, tL2CAP_APPL_INFO* p_cb_info,
+                                  bool enable_snoop));
   MOCK_METHOD2(ConnectRequest,
                uint16_t(uint16_t psm, const RawAddress& bd_addr));
   MOCK_METHOD5(ConnectResponse,
diff --git a/stack/test/rfcomm/stack_rfcomm_test.cc b/stack/test/rfcomm/stack_rfcomm_test.cc
index 3d9da3f..52e1170 100644
--- a/stack/test/rfcomm/stack_rfcomm_test.cc
+++ b/stack/test/rfcomm/stack_rfcomm_test.cc
@@ -453,7 +453,7 @@
         &btm_security_internal_interface_);
     bluetooth::l2cap::SetMockInterface(&l2cap_interface_);
     rfcomm_callback = &rfcomm_callback_;
-    EXPECT_CALL(l2cap_interface_, Register(BT_PSM_RFCOMM, _))
+    EXPECT_CALL(l2cap_interface_, Register(BT_PSM_RFCOMM, _, _))
         .WillOnce(
             DoAll(SaveArgPointee<1>(&l2cap_appl_info_), Return(BT_PSM_RFCOMM)));
     RFCOMM_Init();
diff --git a/test/rootcanal/Android.bp b/test/rootcanal/Android.bp
index e312c0e..206f363 100644
--- a/test/rootcanal/Android.bp
+++ b/test/rootcanal/Android.bp
@@ -28,9 +28,7 @@
         "libbase",
         "libchrome",
         "libcutils",
-        "libhwbinder",
         "libhidlbase",
-        "libhidltransport",
         "liblog",
         "libutils",
     ],
@@ -49,6 +47,7 @@
     ],
     include_dirs: [
         "system/bt",
+        "system/bt/gd",
         "system/bt/hci/include",
         "system/bt/internal_include",
         "system/bt/stack/include",
@@ -71,7 +70,6 @@
         "libchrome",
         "libcutils",
         "libhidlbase",
-        "libhidltransport",
         "liblog",
         "libutils",
     ],
@@ -89,6 +87,7 @@
     ],
     include_dirs: [
         "system/bt",
+        "system/bt/gd",
         "system/bt/hci/include",
         "system/bt/internal_include",
         "system/bt/stack/include",
diff --git a/test/rootcanal/bluetooth_hci.cc b/test/rootcanal/bluetooth_hci.cc
index c8352da..9978556 100644
--- a/test/rootcanal/bluetooth_hci.cc
+++ b/test/rootcanal/bluetooth_hci.cc
@@ -18,14 +18,13 @@
 
 #include "bluetooth_hci.h"
 
-#include <base/logging.h>
 #include <cutils/properties.h>
 #include <netdb.h>
 #include <netinet/in.h>
 #include <string.h>
-#include <utils/Log.h>
 
 #include "hci_internals.h"
+#include "os/log.h"
 
 namespace android {
 namespace hardware {
@@ -54,7 +53,7 @@
   void serviceDied(
       uint64_t /* cookie */,
       const wp<::android::hidl::base::V1_0::IBase>& /* who */) override {
-    ALOGE("BluetoothDeathRecipient::serviceDied - Bluetooth service died");
+    LOG_ERROR("BluetoothDeathRecipient::serviceDied - Bluetooth service died");
     has_died_ = true;
     mHci->close();
   }
@@ -73,10 +72,10 @@
 BluetoothHci::BluetoothHci() : death_recipient_(new BluetoothDeathRecipient(this)) {}
 
 Return<void> BluetoothHci::initialize(const sp<IBluetoothHciCallbacks>& cb) {
-  ALOGI("%s", __func__);
+  LOG_INFO("%s", __func__);
 
   if (cb == nullptr) {
-    ALOGE("cb == nullptr! -> Unable to call initializationComplete(ERR)");
+    LOG_ERROR("cb == nullptr! -> Unable to call initializationComplete(ERR)");
     return Void();
   }
 
@@ -143,6 +142,11 @@
   // Add the controller as a device in the model.
   test_model_.Add(controller_);
 
+  // Send responses to logcat if the test channel is not configured.
+  test_channel_.RegisterSendResponse([](const std::string& response) {
+    LOG_INFO("No test channel yet: %s", response.c_str());
+  });
+
   if (BtTestConsoleEnabled()) {
     SetUpTestChannel(6111);
     SetUpHciServer(6211,
@@ -151,9 +155,19 @@
         6311, [this](int fd) { test_model_.IncomingLinkLayerConnection(fd); });
   }
 
+  // Add some default devices for easier debugging
+  test_channel_.AddDefaults();
+
+  // This should be configurable in the future.
+  LOG_INFO("Adding Beacons so the scan list is not empty.");
+  test_channel_.Add({"beacon", "be:ac:10:00:00:01", "1000"});
+  test_channel_.AddDeviceToPhy({"2", "1"});
+  test_channel_.Add({"beacon", "be:ac:10:00:00:02", "1000"});
+  test_channel_.AddDeviceToPhy({"3", "1"});
+
   unlink_cb_ = [this, cb](sp<BluetoothDeathRecipient>& death_recipient) {
     if (death_recipient->getHasDied())
-      ALOGI("Skipping unlink call, service died.");
+      LOG_INFO("Skipping unlink call, service died.");
     else {
       auto ret = cb->unlinkToDeath(death_recipient);
       if (!ret.isOk()) {
@@ -172,7 +186,7 @@
 }
 
 Return<void> BluetoothHci::close() {
-  ALOGI("%s", __func__);
+  LOG_INFO("%s", __func__);
   return Void();
 }
 
@@ -206,18 +220,19 @@
 void BluetoothHci::SetUpHciServer(int port, const std::function<void(int)>& connection_callback) {
   int socket_fd = remote_hci_transport_.SetUp(port);
 
-  test_channel_.RegisterSendResponse(
-      [](const std::string& response) { ALOGI("No HCI Response channel: %s", response.c_str()); });
+  test_channel_.RegisterSendResponse([](const std::string& response) {
+    LOG_INFO("No HCI Response channel: %s", response.c_str());
+  });
 
   if (socket_fd == -1) {
-    ALOGE("Remote HCI channel SetUp(%d) failed.", port);
+    LOG_ERROR("Remote HCI channel SetUp(%d) failed.", port);
     return;
   }
 
   async_manager_.WatchFdForNonBlockingReads(socket_fd, [this, connection_callback](int socket_fd) {
     int conn_fd = remote_hci_transport_.Accept(socket_fd);
     if (conn_fd < 0) {
-      ALOGE("Error watching remote HCI channel fd.");
+      LOG_ERROR("Error watching remote HCI channel fd.");
       return;
     }
     int flags = fcntl(conn_fd, F_GETFL, NULL);
@@ -232,18 +247,19 @@
 void BluetoothHci::SetUpLinkLayerServer(int port, const std::function<void(int)>& connection_callback) {
   int socket_fd = remote_link_layer_transport_.SetUp(port);
 
-  test_channel_.RegisterSendResponse(
-      [](const std::string& response) { ALOGI("No LinkLayer Response channel: %s", response.c_str()); });
+  test_channel_.RegisterSendResponse([](const std::string& response) {
+    LOG_INFO("No LinkLayer Response channel: %s", response.c_str());
+  });
 
   if (socket_fd == -1) {
-    ALOGE("Remote LinkLayer channel SetUp(%d) failed.", port);
+    LOG_ERROR("Remote LinkLayer channel SetUp(%d) failed.", port);
     return;
   }
 
   async_manager_.WatchFdForNonBlockingReads(socket_fd, [this, connection_callback](int socket_fd) {
     int conn_fd = remote_link_layer_transport_.Accept(socket_fd);
     if (conn_fd < 0) {
-      ALOGE("Error watching remote LinkLayer channel fd.");
+      LOG_ERROR("Error watching remote LinkLayer channel fd.");
       return;
     }
     int flags = fcntl(conn_fd, F_GETFL, NULL);
@@ -257,14 +273,15 @@
 int BluetoothHci::ConnectToRemoteServer(const std::string& server, int port) {
   int socket_fd = socket(AF_INET, SOCK_STREAM, 0);
   if (socket_fd < 1) {
-    ALOGI("socket() call failed: %s", strerror(errno));
+    LOG_INFO("socket() call failed: %s", strerror(errno));
     return -1;
   }
 
   struct hostent* host;
   host = gethostbyname(server.c_str());
   if (host == NULL) {
-    ALOGI("gethostbyname() failed for %s: %s", server.c_str(), strerror(errno));
+    LOG_INFO("gethostbyname() failed for %s: %s", server.c_str(),
+             strerror(errno));
     return -1;
   }
 
@@ -276,7 +293,8 @@
 
   int result = connect(socket_fd, (struct sockaddr*)&serv_addr, sizeof(serv_addr));
   if (result < 0) {
-    ALOGI("connect() failed for %s@%d: %s", server.c_str(), port, strerror(errno));
+    LOG_INFO("connect() failed for %s@%d: %s", server.c_str(), port,
+             strerror(errno));
     return -1;
   }
 
@@ -290,32 +308,23 @@
 void BluetoothHci::SetUpTestChannel(int port) {
   int socket_fd = test_channel_transport_.SetUp(port);
 
-  test_channel_.RegisterSendResponse(
-      [](const std::string& response) { ALOGI("No test channel: %s", response.c_str()); });
-
-  // Add some default devices for easier debugging
-  test_channel_.AddDefaults();
-
-  // This should be configurable in the future.
-  ALOGI("Adding Beacons so the scan list is not empty.");
-  test_channel_.Add({"beacon", "be:ac:10:00:00:01", "1000"});
-  test_channel_.AddDeviceToPhy({"1", "0"});
-  test_channel_.Add({"beacon", "be:ac:10:00:00:02", "1000"});
-  test_channel_.AddDeviceToPhy({"2", "0"});
+  test_channel_.RegisterSendResponse([](const std::string& response) {
+    LOG_INFO("No test channel: %s", response.c_str());
+  });
 
   if (socket_fd == -1) {
-    ALOGE("Test channel SetUp(%d) failed.", port);
+    LOG_ERROR("Test channel SetUp(%d) failed.", port);
     return;
   }
 
-  ALOGI("Test channel SetUp() successful");
+  LOG_INFO("Test channel SetUp() successful");
   async_manager_.WatchFdForNonBlockingReads(socket_fd, [this](int socket_fd) {
     int conn_fd = test_channel_transport_.Accept(socket_fd);
     if (conn_fd < 0) {
-      ALOGE("Error watching test channel fd.");
+      LOG_ERROR("Error watching test channel fd.");
       return;
     }
-    ALOGI("Test channel connection accepted.");
+    LOG_INFO("Test channel connection accepted.");
     test_channel_.RegisterSendResponse(
         [this, conn_fd](const std::string& response) { test_channel_transport_.SendResponse(conn_fd, response); });
 
diff --git a/test/rootcanal/bluetooth_hci.h b/test/rootcanal/bluetooth_hci.h
index 96d0ed8..130b85c 100644
--- a/test/rootcanal/bluetooth_hci.h
+++ b/test/rootcanal/bluetooth_hci.h
@@ -16,6 +16,8 @@
 
 #pragma once
 
+#include "os/log.h"
+
 #include <android/hardware/bluetooth/1.0/IBluetoothHci.h>
 
 #include <hidl/MQDescriptor.h>
diff --git a/test/rootcanal/service.cc b/test/rootcanal/service.cc
index 64fa9c7..1abfb7a 100644
--- a/test/rootcanal/service.cc
+++ b/test/rootcanal/service.cc
@@ -16,10 +16,11 @@
 
 #define LOG_TAG "android.hardware.bluetooth@1.0-service.sim"
 
+#include "os/log.h"
+
 #include <android/hardware/bluetooth/1.0/IBluetoothHci.h>
 #include <hidl/HidlSupport.h>
 #include <hidl/HidlTransportSupport.h>
-#include <utils/Log.h>
 
 #include "bluetooth_hci.h"
 
@@ -36,5 +37,5 @@
   if (status == android::OK)
     joinRpcThreadpool();
   else
-    ALOGE("Could not register as a service!");
+    LOG_ERROR("Could not register as a service!");
 }
diff --git a/test/suite/Android.bp b/test/suite/Android.bp
index 85b46fa..1d919ed 100644
--- a/test/suite/Android.bp
+++ b/test/suite/Android.bp
@@ -15,6 +15,8 @@
     shared_libs: [
         "liblog",
         "libcutils",
+        "libbinder",
+        "libutils",
     ],
     static_libs: [
         "libbtcore",
@@ -40,6 +42,8 @@
     shared_libs: [
         "liblog",
         "libcutils",
+        "libbinder",
+        "libutils",
     ],
     static_libs: [
         "libbtcore",
diff --git a/test/suite/adapter/adapter_unittest.cc b/test/suite/adapter/adapter_unittest.cc
index 24ca3e5..7a26e28 100644
--- a/test/suite/adapter/adapter_unittest.cc
+++ b/test/suite/adapter/adapter_unittest.cc
@@ -35,7 +35,7 @@
   EXPECT_EQ(GetState(), BT_STATE_OFF)
       << "Test should be run with Adapter disabled";
 
-  EXPECT_EQ(bt_interface()->enable(false), BT_STATUS_SUCCESS);
+  EXPECT_EQ(bt_interface()->enable(), BT_STATUS_SUCCESS);
   semaphore_wait(adapter_state_changed_callback_sem_);
   EXPECT_EQ(GetState(), BT_STATE_ON) << "Adapter did not turn on.";
 
@@ -49,7 +49,7 @@
       << "Test should be run with Adapter disabled";
 
   for (int i = 0; i < kTestRepeatCount; ++i) {
-    EXPECT_EQ(bt_interface()->enable(false), BT_STATUS_SUCCESS);
+    EXPECT_EQ(bt_interface()->enable(), BT_STATUS_SUCCESS);
     semaphore_wait(adapter_state_changed_callback_sem_);
     EXPECT_EQ(GetState(), BT_STATE_ON) << "Adapter did not turn on.";
 
@@ -62,7 +62,7 @@
 TEST_F(BluetoothTest, AdapterSetGetName) {
   bt_property_t* new_name = property_new_name("BluetoothTestName1");
 
-  EXPECT_EQ(bt_interface()->enable(false), BT_STATUS_SUCCESS);
+  EXPECT_EQ(bt_interface()->enable(), BT_STATUS_SUCCESS);
   semaphore_wait(adapter_state_changed_callback_sem_);
   EXPECT_EQ(GetState(), BT_STATE_ON)
       << "Test should be run with Adapter enabled";
@@ -114,7 +114,7 @@
 }
 
 TEST_F(BluetoothTest, AdapterStartDiscovery) {
-  EXPECT_EQ(bt_interface()->enable(false), BT_STATUS_SUCCESS);
+  EXPECT_EQ(bt_interface()->enable(), BT_STATUS_SUCCESS);
   semaphore_wait(adapter_state_changed_callback_sem_);
   EXPECT_EQ(GetState(), BT_STATE_ON)
       << "Test should be run with Adapter enabled";
@@ -130,7 +130,7 @@
 }
 
 TEST_F(BluetoothTest, AdapterCancelDiscovery) {
-  EXPECT_EQ(bt_interface()->enable(false), BT_STATUS_SUCCESS);
+  EXPECT_EQ(bt_interface()->enable(), BT_STATUS_SUCCESS);
   semaphore_wait(adapter_state_changed_callback_sem_);
   EXPECT_EQ(GetState(), BT_STATE_ON)
       << "Test should be run with Adapter enabled";
@@ -155,7 +155,7 @@
   RawAddress bdaddr = {{0x22, 0x22, 0x22, 0x22, 0x22, 0x22}};
 
   for (int i = 0; i < kTestRepeatCount; ++i) {
-    EXPECT_EQ(bt_interface()->enable(false), BT_STATUS_SUCCESS);
+    EXPECT_EQ(bt_interface()->enable(), BT_STATUS_SUCCESS);
     semaphore_wait(adapter_state_changed_callback_sem_);
     EXPECT_EQ(GetState(), BT_STATE_ON) << "Adapter did not turn on.";
 
@@ -179,8 +179,8 @@
   ASSERT_TRUE(bt_callbacks != nullptr);
 
   for (int i = 0; i < kTestRepeatCount; ++i) {
-    bt_interface()->init(bt_callbacks);
-    EXPECT_EQ(bt_interface()->enable(false), BT_STATUS_SUCCESS);
+    bt_interface()->init(bt_callbacks, false, false);
+    EXPECT_EQ(bt_interface()->enable(), BT_STATUS_SUCCESS);
     semaphore_wait(adapter_state_changed_callback_sem_);
     EXPECT_EQ(GetState(), BT_STATE_ON) << "Adapter did not turn on.";
 
diff --git a/test/suite/adapter/bluetooth_test.cc b/test/suite/adapter/bluetooth_test.cc
index 02132f1..626ac42 100644
--- a/test/suite/adapter/bluetooth_test.cc
+++ b/test/suite/adapter/bluetooth_test.cc
@@ -17,6 +17,8 @@
  ******************************************************************************/
 
 #include "adapter/bluetooth_test.h"
+#include <binder/ProcessState.h>
+#include <stdio.h>
 #include <mutex>
 #include "btcore/include/property.h"
 
@@ -31,6 +33,7 @@
 namespace bttest {
 
 void BluetoothTest::SetUp() {
+  android::ProcessState::self()->startThreadPool();
   bt_interface_ = nullptr;
   state_ = BT_STATE_OFF;
   properties_changed_count_ = 0;
@@ -46,6 +49,9 @@
   adapter_state_changed_callback_sem_ = semaphore_new(0);
   discovery_state_changed_callback_sem_ = semaphore_new(0);
 
+  remove("/data/misc/bluedroid/bt_config.conf.encrypted-checksum");
+  remove("/data/misc/bluedroid/bt_config.bak.encrypted-checksum");
+
   bluetooth::hal::BluetoothInterface::Initialize();
   ASSERT_TRUE(bluetooth::hal::BluetoothInterface::IsInitialized());
   auto bt_hal_interface = bluetooth::hal::BluetoothInterface::Get();
diff --git a/test/suite/gatt/gatt_test.cc b/test/suite/gatt/gatt_test.cc
index e3546d3..8c8f1ab 100644
--- a/test/suite/gatt/gatt_test.cc
+++ b/test/suite/gatt/gatt_test.cc
@@ -33,7 +33,7 @@
   status_ = 0;
 
   BluetoothTest::SetUp();
-  ASSERT_EQ(bt_interface()->enable(false), BT_STATUS_SUCCESS);
+  ASSERT_EQ(bt_interface()->enable(), BT_STATUS_SUCCESS);
   semaphore_wait(adapter_state_changed_callback_sem_);
   EXPECT_TRUE(GetState() == BT_STATE_ON);
 
diff --git a/test/suite/gatt/gatt_unittest.cc b/test/suite/gatt/gatt_unittest.cc
index 26fd850..b02c96a 100644
--- a/test/suite/gatt/gatt_unittest.cc
+++ b/test/suite/gatt/gatt_unittest.cc
@@ -69,12 +69,21 @@
   int server_if = server_interface_id();
 
   std::vector<btgatt_db_element_t> service = {
-      {.type = BTGATT_DB_PRIMARY_SERVICE, .uuid = srvc_uuid},
-      {.type = BTGATT_DB_CHARACTERISTIC,
-       .uuid = char_uuid,
-       .properties = 0x10 /* notification */,
-       .permissions = 0x01 /* read only */},
-      {.type = BTGATT_DB_DESCRIPTOR, .uuid = desc_uuid, .permissions = 0x01}};
+      {
+          .uuid = srvc_uuid,
+          .type = BTGATT_DB_PRIMARY_SERVICE,
+      },
+      {
+          .uuid = char_uuid,
+          .type = BTGATT_DB_CHARACTERISTIC,
+          .properties = 0x10,  /* notification */
+          .permissions = 0x01, /* read only */
+      },
+      {
+          .uuid = desc_uuid,
+          .type = BTGATT_DB_DESCRIPTOR,
+          .permissions = 0x01,
+      }};
 
   gatt_server_interface()->add_service(server_if, service);
   semaphore_wait(service_added_callback_sem_);
diff --git a/test/suite/rfcomm/rfcomm_test.cc b/test/suite/rfcomm/rfcomm_test.cc
index 01d9fed..d5baf35 100644
--- a/test/suite/rfcomm/rfcomm_test.cc
+++ b/test/suite/rfcomm/rfcomm_test.cc
@@ -28,7 +28,7 @@
 void RFCommTest::SetUp() {
   BluetoothTest::SetUp();
 
-  ASSERT_EQ(bt_interface()->enable(false), BT_STATUS_SUCCESS);
+  ASSERT_EQ(bt_interface()->enable(), BT_STATUS_SUCCESS);
   semaphore_wait(adapter_state_changed_callback_sem_);
   ASSERT_TRUE(GetState() == BT_STATE_ON);
   socket_interface_ =
diff --git a/udrv/ulinux/uipc.cc b/udrv/ulinux/uipc.cc
index e2f2950..24fa711 100644
--- a/udrv/ulinux/uipc.cc
+++ b/udrv/ulinux/uipc.cc
@@ -621,15 +621,15 @@
 uint32_t UIPC_Read(tUIPC_STATE& uipc, tUIPC_CH_ID ch_id,
                    UNUSED_ATTR uint16_t* p_msg_evt, uint8_t* p_buf,
                    uint32_t len) {
-  int n_read = 0;
-  int fd = uipc.ch[ch_id].fd;
-  struct pollfd pfd;
-
   if (ch_id >= UIPC_CH_NUM) {
     BTIF_TRACE_ERROR("UIPC_Read : invalid ch id %d", ch_id);
     return 0;
   }
 
+  int n_read = 0;
+  int fd = uipc.ch[ch_id].fd;
+  struct pollfd pfd;
+
   if (fd == UIPC_DISCONNECTED) {
     BTIF_TRACE_ERROR("UIPC_Read : channel %d closed", ch_id);
     return 0;
diff --git a/vendor_libs/linux/interface/Android.bp b/vendor_libs/linux/interface/Android.bp
index c4b6041..fd4f513 100644
--- a/vendor_libs/linux/interface/Android.bp
+++ b/vendor_libs/linux/interface/Android.bp
@@ -34,7 +34,6 @@
         "libbase",
         "libcutils",
         "libhidlbase",
-        "libhidltransport",
         "liblog",
         "libutils",
     ],
diff --git a/vendor_libs/test_vendor_lib/Android.bp b/vendor_libs/test_vendor_lib/Android.bp
index aded1c3..d4d554d 100644
--- a/vendor_libs/test_vendor_lib/Android.bp
+++ b/vendor_libs/test_vendor_lib/Android.bp
@@ -47,15 +47,9 @@
         "include",
         ".",
     ],
-    header_libs: [
-        "libbluetooth_headers",
-    ],
     include_dirs: [
         "system/bt",
-        "system/bt/utils/include",
-        "system/bt/hci/include",
-        "system/bt/internal_include",
-        "system/bt/stack/include",
+        "system/bt/gd",
     ],
     shared_libs: [
         "libbase",
@@ -90,9 +84,7 @@
     ],
     include_dirs: [
         "system/bt",
-        "system/bt/utils/include",
-        "system/bt/hci/include",
-        "system/bt/stack/include",
+        "system/bt/gd",
     ],
     shared_libs: [
         "liblog",
@@ -126,9 +118,7 @@
     ],
     include_dirs: [
         "system/bt",
-        "system/bt/utils/include",
-        "system/bt/hci/include",
-        "system/bt/stack/include",
+        "system/bt/gd",
     ],
     shared_libs: [
         "liblog",
diff --git a/vendor_libs/test_vendor_lib/data/controller_properties.json b/vendor_libs/test_vendor_lib/data/controller_properties.json
index 32adc52..814efd3 100644
--- a/vendor_libs/test_vendor_lib/data/controller_properties.json
+++ b/vendor_libs/test_vendor_lib/data/controller_properties.json
@@ -1,5 +1,6 @@
 {
   "AclDataPacketSize": "1024",
+  "EncryptionKeySize": "10",
   "ScoDataPacketSize": "255",
   "NumAclDataPackets": "10",
   "NumScoDataPackets": "10",
diff --git a/vendor_libs/test_vendor_lib/desktop/root_canal_main.cc b/vendor_libs/test_vendor_lib/desktop/root_canal_main.cc
index 5432292..95bbfd3 100644
--- a/vendor_libs/test_vendor_lib/desktop/root_canal_main.cc
+++ b/vendor_libs/test_vendor_lib/desktop/root_canal_main.cc
@@ -14,15 +14,11 @@
 // limitations under the License.
 //
 
-#define LOG_TAG "root_canal"
-
 #include "test_environment.h"
 
-#include <base/logging.h>
-#include <utils/Log.h>
 #include <future>
 
-#include "hci_internals.h"
+#include "os/log.h"
 
 using ::android::bluetooth::root_canal::TestEnvironment;
 
@@ -31,16 +27,16 @@
 constexpr uint16_t kLinkServerPort = 6403;
 
 int main(int argc, char** argv) {
-  ALOGI("main");
+  LOG_INFO("main");
   uint16_t test_port = kTestPort;
   uint16_t hci_server_port = kHciServerPort;
   uint16_t link_server_port = kLinkServerPort;
 
   for (int arg = 0; arg < argc; arg++) {
     int port = atoi(argv[arg]);
-    ALOGI("%d: %s (%d)", arg, argv[arg], port);
+    LOG_INFO("%d: %s (%d)", arg, argv[arg], port);
     if (port < 0 || port > 0xffff) {
-      ALOGW("%s out of range", argv[arg]);
+      LOG_WARN("%s out of range", argv[arg]);
     } else {
       switch (arg) {
         case 0:  // executable name
@@ -55,7 +51,7 @@
           link_server_port = port;
           break;
         default:
-          ALOGW("Ignored option %s", argv[arg]);
+          LOG_WARN("Ignored option %s", argv[arg]);
       }
     }
   }
diff --git a/vendor_libs/test_vendor_lib/desktop/test_environment.cc b/vendor_libs/test_vendor_lib/desktop/test_environment.cc
index 2822335..f787c51 100644
--- a/vendor_libs/test_vendor_lib/desktop/test_environment.cc
+++ b/vendor_libs/test_vendor_lib/desktop/test_environment.cc
@@ -14,17 +14,15 @@
 // limitations under the License.
 //
 
-#define LOG_TAG "root_canal"
-
 #include "test_environment.h"
 
-#include <base/logging.h>
+#include <fcntl.h>
 #include <netdb.h>
 #include <netinet/in.h>
 #include <string.h>
-#include <utils/Log.h>
+#include <unistd.h>
 
-#include "hci_internals.h"
+#include "os/log.h"
 
 namespace android {
 namespace bluetooth {
@@ -35,7 +33,7 @@
 using test_vendor_lib::TaskCallback;
 
 void TestEnvironment::initialize(std::promise<void> barrier) {
-  ALOGI("%s", __func__);
+  LOG_INFO("%s", __func__);
 
   barrier_ = std::move(barrier);
 
@@ -50,34 +48,34 @@
   SetUpHciServer([this](int fd) { test_model_.IncomingHciConnection(fd); });
   SetUpLinkLayerServer([this](int fd) { test_model_.IncomingLinkLayerConnection(fd); });
 
-  ALOGI("%s: Finished", __func__);
+  LOG_INFO("%s: Finished", __func__);
 }
 
 void TestEnvironment::close() {
-  ALOGI("%s", __func__);
+  LOG_INFO("%s", __func__);
 }
 
 void TestEnvironment::SetUpHciServer(const std::function<void(int)>& connection_callback) {
   int socket_fd = remote_hci_transport_.SetUp(hci_server_port_);
 
   test_channel_.RegisterSendResponse(
-      [](const std::string& response) { ALOGI("No HCI Response channel: %s", response.c_str()); });
+      [](const std::string& response) { LOG_INFO("No HCI Response channel: %s", response.c_str()); });
 
   if (socket_fd == -1) {
-    ALOGE("Remote HCI channel SetUp(%d) failed.", hci_server_port_);
+    LOG_ERROR("Remote HCI channel SetUp(%d) failed.", hci_server_port_);
     return;
   }
 
   async_manager_.WatchFdForNonBlockingReads(socket_fd, [this, connection_callback](int socket_fd) {
     int conn_fd = remote_hci_transport_.Accept(socket_fd);
     if (conn_fd < 0) {
-      ALOGE("Error watching remote HCI channel fd.");
+      LOG_ERROR("Error watching remote HCI channel fd.");
       return;
     }
     int flags = fcntl(conn_fd, F_GETFL, NULL);
     int ret;
     ret = fcntl(conn_fd, F_SETFL, flags | O_NONBLOCK);
-    CHECK(ret != -1) << "Error setting O_NONBLOCK " << strerror(errno);
+    ASSERT_LOG(ret != -1, "Error setting O_NONBLOCK %s", strerror(errno));
 
     connection_callback(conn_fd);
   });
@@ -87,22 +85,22 @@
   int socket_fd = remote_link_layer_transport_.SetUp(link_server_port_);
 
   test_channel_.RegisterSendResponse(
-      [](const std::string& response) { ALOGI("No LinkLayer Response channel: %s", response.c_str()); });
+      [](const std::string& response) { LOG_INFO("No LinkLayer Response channel: %s", response.c_str()); });
 
   if (socket_fd == -1) {
-    ALOGE("Remote LinkLayer channel SetUp(%d) failed.", link_server_port_);
+    LOG_ERROR("Remote LinkLayer channel SetUp(%d) failed.", link_server_port_);
     return;
   }
 
   async_manager_.WatchFdForNonBlockingReads(socket_fd, [this, connection_callback](int socket_fd) {
     int conn_fd = remote_link_layer_transport_.Accept(socket_fd);
     if (conn_fd < 0) {
-      ALOGE("Error watching remote LinkLayer channel fd.");
+      LOG_ERROR("Error watching remote LinkLayer channel fd.");
       return;
     }
     int flags = fcntl(conn_fd, F_GETFL, NULL);
     int ret = fcntl(conn_fd, F_SETFL, flags | O_NONBLOCK);
-    CHECK(ret != -1) << "Error setting O_NONBLOCK " << strerror(errno);
+    ASSERT_LOG(ret != -1, "Error setting O_NONBLOCK %s", strerror(errno));
 
     connection_callback(conn_fd);
   });
@@ -111,14 +109,14 @@
 int TestEnvironment::ConnectToRemoteServer(const std::string& server, int port) {
   int socket_fd = socket(AF_INET, SOCK_STREAM, 0);
   if (socket_fd < 1) {
-    ALOGI("socket() call failed: %s", strerror(errno));
+    LOG_INFO("socket() call failed: %s", strerror(errno));
     return -1;
   }
 
   struct hostent* host;
   host = gethostbyname(server.c_str());
   if (host == NULL) {
-    ALOGI("gethostbyname() failed for %s: %s", server.c_str(), strerror(errno));
+    LOG_INFO("gethostbyname() failed for %s: %s", server.c_str(), strerror(errno));
     return -1;
   }
 
@@ -130,13 +128,13 @@
 
   int result = connect(socket_fd, (struct sockaddr*)&serv_addr, sizeof(serv_addr));
   if (result < 0) {
-    ALOGI("connect() failed for %s@%d: %s", server.c_str(), port, strerror(errno));
+    LOG_INFO("connect() failed for %s@%d: %s", server.c_str(), port, strerror(errno));
     return -1;
   }
 
   int flags = fcntl(socket_fd, F_GETFL, NULL);
   int ret = fcntl(socket_fd, F_SETFL, flags | O_NONBLOCK);
-  CHECK(ret != -1) << "Error setting O_NONBLOCK " << strerror(errno);
+  ASSERT_LOG(ret != -1, "Error setting O_NONBLOCK %s", strerror(errno));
 
   return socket_fd;
 }
@@ -145,26 +143,26 @@
   int socket_fd = test_channel_transport_.SetUp(test_port_);
   test_channel_.AddPhy({"BR_EDR"});
   test_channel_.AddPhy({"LOW_ENERGY"});
-  test_channel_.SetTimerPeriod({"100"});
+  test_channel_.SetTimerPeriod({"10"});
   test_channel_.StartTimer({});
 
   test_channel_.RegisterSendResponse(
-      [](const std::string& response) { ALOGI("No test channel: %s", response.c_str()); });
+      [](const std::string& response) { LOG_INFO("No test channel: %s", response.c_str()); });
 
   if (socket_fd == -1) {
-    ALOGE("Test channel SetUp(%d) failed.", test_port_);
+    LOG_ERROR("Test channel SetUp(%d) failed.", test_port_);
     return;
   }
 
-  ALOGI("Test channel SetUp() successful");
+  LOG_INFO("Test channel SetUp() successful");
   async_manager_.WatchFdForNonBlockingReads(socket_fd, [this](int socket_fd) {
     int conn_fd = test_channel_transport_.Accept(socket_fd);
     if (conn_fd < 0) {
-      ALOGE("Error watching test channel fd.");
+      LOG_ERROR("Error watching test channel fd.");
       barrier_.set_value();
       return;
     }
-    ALOGI("Test channel connection accepted.");
+    LOG_INFO("Test channel connection accepted.");
     test_channel_.RegisterSendResponse(
         [this, conn_fd](const std::string& response) { test_channel_transport_.SendResponse(conn_fd, response); });
 
diff --git a/vendor_libs/test_vendor_lib/include/hci.h b/vendor_libs/test_vendor_lib/include/hci.h
index 11eb029..a2e696b 100644
--- a/vendor_libs/test_vendor_lib/include/hci.h
+++ b/vendor_libs/test_vendor_lib/include/hci.h
@@ -59,5 +59,10 @@
   V5_0 = 9,
 };
 
+enum class Role : uint8_t {
+  MASTER = 0x00,
+  SLAVE = 0x01,
+};
+
 }  // namespace hci
 }  // namespace test_vendor_lib
diff --git a/vendor_libs/test_vendor_lib/include/hci/event_code.h b/vendor_libs/test_vendor_lib/include/hci/event_code.h
index c0bdcbc..306e522 100644
--- a/vendor_libs/test_vendor_lib/include/hci/event_code.h
+++ b/vendor_libs/test_vendor_lib/include/hci/event_code.h
@@ -49,7 +49,7 @@
   DATA_BUFFER_OVERFLOW = 0x1A,
   MAX_SLOTS_CHANGE = 0x1B,
   READ_CLOCK_OFFSET_COMPLETE = 0x1C,
-  CONNECTION_PACKET_TYPE_CHANGE = 0x1D,
+  CONNECTION_PACKET_TYPE_CHANGED = 0x1D,
   QOS_VIOLATION = 0x1E,
   PAGE_SCAN_REPETITION_MODE_CHANGE = 0x20,
   FLOW_SPECIFICATION_COMPLETE = 0x21,
diff --git a/vendor_libs/test_vendor_lib/include/hci/op_code.h b/vendor_libs/test_vendor_lib/include/hci/op_code.h
index 931145d..64f9947 100644
--- a/vendor_libs/test_vendor_lib/include/hci/op_code.h
+++ b/vendor_libs/test_vendor_lib/include/hci/op_code.h
@@ -193,7 +193,7 @@
   LE_SET_ADVERTISING_PARAMETERS = LE_CONTROLLER | 0x0006,
   LE_READ_ADVERTISING_CHANNEL_TX_POWER = LE_CONTROLLER | 0x0007,
   LE_SET_ADVERTISING_DATA = LE_CONTROLLER | 0x0008,
-  LE_SET_SCAN_RSPONSE_DATA = LE_CONTROLLER | 0x0009,
+  LE_SET_SCAN_RESPONSE_DATA = LE_CONTROLLER | 0x0009,
   LE_SET_ADVERTISING_ENABLE = LE_CONTROLLER | 0x000A,
   LE_SET_SCAN_PARAMETERS = LE_CONTROLLER | 0x000B,
   LE_SET_SCAN_ENABLE = LE_CONTROLLER | 0x000C,
diff --git a/vendor_libs/test_vendor_lib/include/link.h b/vendor_libs/test_vendor_lib/include/link.h
index 1c60e3d..798bba7 100644
--- a/vendor_libs/test_vendor_lib/include/link.h
+++ b/vendor_libs/test_vendor_lib/include/link.h
@@ -36,10 +36,13 @@
     IO_CAPABILITY_RESPONSE,
     IO_CAPABILITY_NEGATIVE_RESPONSE,
     LE_ADVERTISEMENT,
+    LE_CONNECT,
+    LE_CONNECT_COMPLETE,
     LE_SCAN,
     LE_SCAN_RESPONSE,
     PAGE,
     PAGE_RESPONSE,
+    PAGE_REJECT,
     RESPONSE,
     SCO,
   };
diff --git a/vendor_libs/test_vendor_lib/model/controller/acl_connection.cc b/vendor_libs/test_vendor_lib/model/controller/acl_connection.cc
index 460f550..7e14db6 100644
--- a/vendor_libs/test_vendor_lib/model/controller/acl_connection.cc
+++ b/vendor_libs/test_vendor_lib/model/controller/acl_connection.cc
@@ -14,14 +14,8 @@
  * limitations under the License.
  */
 
-#define LOG_TAG "acl_connection"
-
 #include "acl_connection.h"
 
-#include "base/logging.h"
-
-#include "osi/include/log.h"
-
 using std::shared_ptr;
 
 namespace test_vendor_lib {}  // namespace test_vendor_lib
diff --git a/vendor_libs/test_vendor_lib/model/controller/acl_connection.h b/vendor_libs/test_vendor_lib/model/controller/acl_connection.h
index 796d04e..8c27f04 100644
--- a/vendor_libs/test_vendor_lib/model/controller/acl_connection.h
+++ b/vendor_libs/test_vendor_lib/model/controller/acl_connection.h
@@ -25,17 +25,10 @@
 // Model the connection of a device to the controller.
 class AclConnection {
  public:
-  AclConnection(const Address& addr) : address_(addr), connected_(false), encrypted_(false) {}
+  AclConnection(Address addr) : address_(addr), address_type_(0), own_address_type_(0) {}
 
   virtual ~AclConnection() = default;
 
-  void SetConnected(bool connected) {
-    connected_ = connected;
-  };
-  bool IsConnected() const {
-    return connected_;
-  };
-
   void Encrypt() {
     encrypted_ = true;
   };
@@ -43,19 +36,33 @@
     return encrypted_;
   };
 
-  const Address& GetAddress() const {
+  Address GetAddress() const {
     return address_;
   }
-  void SetAddress(const Address& address) {
+  void SetAddress(Address address) {
     address_ = address;
   }
 
+  uint8_t GetAddressType() const {
+    return address_type_;
+  }
+  void SetAddressType(uint8_t address_type) {
+    address_type_ = address_type;
+  }
+  uint8_t GetOwnAddressType() const {
+    return own_address_type_;
+  }
+  void SetOwnAddressType(uint8_t address_type) {
+    own_address_type_ = address_type;
+  }
+
  private:
   Address address_;
+  uint8_t address_type_;
+  uint8_t own_address_type_;
 
   // State variables
-  bool connected_;
-  bool encrypted_;
+  bool encrypted_{false};
 };
 
 }  // namespace test_vendor_lib
diff --git a/vendor_libs/test_vendor_lib/model/controller/acl_connection_handler.cc b/vendor_libs/test_vendor_lib/model/controller/acl_connection_handler.cc
index 2d5ff97..6ad54ff 100644
--- a/vendor_libs/test_vendor_lib/model/controller/acl_connection_handler.cc
+++ b/vendor_libs/test_vendor_lib/model/controller/acl_connection_handler.cc
@@ -14,13 +14,10 @@
  * limitations under the License.
  */
 
-#define LOG_TAG "acl_connection_handler"
-
 #include "acl_connection_handler.h"
 
-#include "base/logging.h"
+#include "os/log.h"
 
-#include "osi/include/log.h"
 #include "types/address.h"
 
 using std::shared_ptr;
@@ -35,40 +32,82 @@
 }
 
 uint16_t AclConnectionHandler::GetUnusedHandle() {
-  static uint16_t sNextHandle = acl::kReservedHandle - 2;
-  while (acl_connections_.count(sNextHandle) == 1) {
-    sNextHandle = (sNextHandle + 1) % acl::kReservedHandle;
+  while (acl_connections_.count(last_handle_) == 1) {
+    last_handle_ = (last_handle_ + 1) % acl::kReservedHandle;
   }
-  uint16_t unused_handle = sNextHandle;
-  sNextHandle = (sNextHandle + 1) % acl::kReservedHandle;
+  uint16_t unused_handle = last_handle_;
+  last_handle_ = (last_handle_ + 1) % acl::kReservedHandle;
   return unused_handle;
 }
 
-bool AclConnectionHandler::CreatePendingConnection(const Address& addr) {
-  if ((pending_connections_.size() + 1 > max_pending_connections_) || HasPendingConnection(addr)) {
+bool AclConnectionHandler::CreatePendingConnection(Address addr) {
+  if (classic_connection_pending_) {
     return false;
   }
-  pending_connections_.insert(addr);
+  classic_connection_pending_ = true;
+  pending_connection_address_ = addr;
   return true;
 }
 
-bool AclConnectionHandler::HasPendingConnection(const Address& addr) {
-  return pending_connections_.count(addr) == 1;
+bool AclConnectionHandler::HasPendingConnection(Address addr) {
+  return classic_connection_pending_ && pending_connection_address_ == addr;
 }
 
-bool AclConnectionHandler::CancelPendingConnection(const Address& addr) {
-  if (!HasPendingConnection(addr)) {
+bool AclConnectionHandler::CancelPendingConnection(Address addr) {
+  if (!classic_connection_pending_ || pending_connection_address_ != addr) {
     return false;
   }
-  pending_connections_.erase(addr);
+  classic_connection_pending_ = false;
+  pending_connection_address_ = Address::kEmpty;
   return true;
 }
 
-uint16_t AclConnectionHandler::CreateConnection(const Address& addr) {
+bool AclConnectionHandler::CreatePendingLeConnection(Address addr, uint8_t address_type) {
+  if (IsDeviceConnected(addr, address_type)) {
+    LOG_INFO("%s: %s (type %hhx) is already connected", __func__, addr.ToString().c_str(), address_type);
+    return false;
+  }
+  if (le_connection_pending_) {
+    LOG_INFO("%s: connection already pending", __func__);
+    return false;
+  }
+  le_connection_pending_ = true;
+  pending_le_connection_address_ = addr;
+  pending_le_connection_address_type_ = address_type;
+  return true;
+}
+
+bool AclConnectionHandler::HasPendingLeConnection(Address addr, uint8_t address_type) {
+  return le_connection_pending_ && pending_le_connection_address_ == addr &&
+         pending_le_connection_address_type_ == address_type;
+}
+
+bool AclConnectionHandler::CancelPendingLeConnection(Address addr, uint8_t address_type) {
+  if (!le_connection_pending_ || pending_le_connection_address_ != addr ||
+      pending_le_connection_address_type_ != address_type) {
+    return false;
+  }
+  le_connection_pending_ = false;
+  pending_le_connection_address_ = Address::kEmpty;
+  pending_le_connection_address_type_ = 0xba;
+  return true;
+}
+
+uint16_t AclConnectionHandler::CreateConnection(Address addr) {
   if (CancelPendingConnection(addr)) {
     uint16_t handle = GetUnusedHandle();
     acl_connections_.emplace(handle, addr);
-    SetConnected(handle, true);
+    return handle;
+  }
+  return acl::kReservedHandle;
+}
+
+uint16_t AclConnectionHandler::CreateLeConnection(Address addr, uint8_t address_type, uint8_t own_address_type) {
+  if (CancelPendingLeConnection(addr, address_type)) {
+    uint16_t handle = GetUnusedHandle();
+    acl_connections_.emplace(handle, addr);
+    set_own_address_type(handle, own_address_type);
+    SetAddress(handle, addr, address_type);
     return handle;
   }
   return acl::kReservedHandle;
@@ -78,7 +117,7 @@
   return acl_connections_.erase(handle) > 0;
 }
 
-uint16_t AclConnectionHandler::GetHandle(const Address& addr) const {
+uint16_t AclConnectionHandler::GetHandle(Address addr) const {
   for (auto pair : acl_connections_) {
     if (std::get<AclConnection>(pair).GetAddress() == addr) {
       return std::get<0>(pair);
@@ -87,23 +126,41 @@
   return acl::kReservedHandle;
 }
 
-const Address& AclConnectionHandler::GetAddress(uint16_t handle) const {
-  CHECK(HasHandle(handle)) << "Handle unknown " << handle;
+Address AclConnectionHandler::GetAddress(uint16_t handle) const {
+  ASSERT_LOG(HasHandle(handle), "Handle unknown %hd", handle);
   return acl_connections_.at(handle).GetAddress();
 }
 
-void AclConnectionHandler::SetConnected(uint16_t handle, bool connected) {
-  if (!HasHandle(handle)) {
-    return;
-  }
-  acl_connections_.at(handle).SetConnected(connected);
+uint8_t AclConnectionHandler::GetAddressType(uint16_t handle) const {
+  ASSERT_LOG(HasHandle(handle), "Handle unknown %hd", handle);
+  return acl_connections_.at(handle).GetAddressType();
+}
+
+void AclConnectionHandler::set_own_address_type(uint16_t handle, uint8_t address_type) {
+  ASSERT_LOG(HasHandle(handle), "Handle unknown %hd", handle);
+  acl_connections_.at(handle).SetOwnAddressType(address_type);
+}
+
+uint8_t AclConnectionHandler::GetOwnAddressType(uint16_t handle) const {
+  ASSERT_LOG(HasHandle(handle), "Handle unknown %hd", handle);
+  return acl_connections_.at(handle).GetOwnAddressType();
 }
 
 bool AclConnectionHandler::IsConnected(uint16_t handle) const {
   if (!HasHandle(handle)) {
     return false;
   }
-  return acl_connections_.at(handle).IsConnected();
+  return true;
+}
+
+bool AclConnectionHandler::IsDeviceConnected(Address addr, uint8_t address_type) const {
+  for (auto pair : acl_connections_) {
+    auto connection = std::get<AclConnection>(pair);
+    if (connection.GetAddress() == addr && connection.GetAddressType() == address_type) {
+      return true;
+    }
+  }
+  return false;
 }
 
 void AclConnectionHandler::Encrypt(uint16_t handle) {
@@ -120,11 +177,13 @@
   return acl_connections_.at(handle).IsEncrypted();
 }
 
-void AclConnectionHandler::SetAddress(uint16_t handle, const Address& address) {
+void AclConnectionHandler::SetAddress(uint16_t handle, Address address, uint8_t address_type) {
   if (!HasHandle(handle)) {
     return;
   }
-  acl_connections_.at(handle).SetAddress(address);
+  auto connection = acl_connections_.at(handle);
+  connection.SetAddress(address);
+  connection.SetAddressType(address_type);
 }
 
 }  // namespace test_vendor_lib
diff --git a/vendor_libs/test_vendor_lib/model/controller/acl_connection_handler.h b/vendor_libs/test_vendor_lib/model/controller/acl_connection_handler.h
index fda1d3d..447aac6 100644
--- a/vendor_libs/test_vendor_lib/model/controller/acl_connection_handler.h
+++ b/vendor_libs/test_vendor_lib/model/controller/acl_connection_handler.h
@@ -28,34 +28,48 @@
 
 class AclConnectionHandler {
  public:
-  AclConnectionHandler(size_t max_pending_connections = 1) : max_pending_connections_(max_pending_connections) {}
+  AclConnectionHandler() = default;
 
   virtual ~AclConnectionHandler() = default;
 
-  bool CreatePendingConnection(const Address& addr);
-  bool HasPendingConnection(const Address& addr);
-  bool CancelPendingConnection(const Address& addr);
+  bool CreatePendingConnection(Address addr);
+  bool HasPendingConnection(Address addr);
+  bool CancelPendingConnection(Address addr);
 
-  uint16_t CreateConnection(const Address& addr);
+  bool CreatePendingLeConnection(Address addr, uint8_t addr_type);
+  bool HasPendingLeConnection(Address addr, uint8_t addr_type);
+  bool CancelPendingLeConnection(Address addr, uint8_t addr_type);
+
+  uint16_t CreateConnection(Address addr);
+  uint16_t CreateLeConnection(Address addr, uint8_t address_type, uint8_t own_address_type);
   bool Disconnect(uint16_t handle);
   bool HasHandle(uint16_t handle) const;
 
-  uint16_t GetHandle(const Address& addr) const;
-  const Address& GetAddress(uint16_t handle) const;
+  uint16_t GetHandle(Address addr) const;
+  Address GetAddress(uint16_t handle) const;
+  uint8_t GetAddressType(uint16_t handle) const;
+  uint8_t GetOwnAddressType(uint16_t handle) const;
 
   void SetConnected(uint16_t handle, bool connected);
   bool IsConnected(uint16_t handle) const;
 
+  bool IsDeviceConnected(Address addr, uint8_t address_type = 0) const;
+
   void Encrypt(uint16_t handle);
   bool IsEncrypted(uint16_t handle) const;
 
-  void SetAddress(uint16_t handle, const Address& address);
+  void SetAddress(uint16_t handle, Address address, uint8_t address_type = 0);  // default to public
 
  private:
   std::unordered_map<uint16_t, AclConnection> acl_connections_;
-  size_t max_pending_connections_;
-  std::set<Address> pending_connections_;
+  bool classic_connection_pending_{false};
+  Address pending_connection_address_;
+  bool le_connection_pending_{false};
+  Address pending_le_connection_address_;
+  uint8_t pending_le_connection_address_type_;
   uint16_t GetUnusedHandle();
+  uint16_t last_handle_{acl::kReservedHandle - 2};
+  void set_own_address_type(uint16_t handle, uint8_t own_address_type);
 };
 
 }  // namespace test_vendor_lib
diff --git a/vendor_libs/test_vendor_lib/model/controller/dual_mode_controller.cc b/vendor_libs/test_vendor_lib/model/controller/dual_mode_controller.cc
index 0c55e47..6e9e775 100644
--- a/vendor_libs/test_vendor_lib/model/controller/dual_mode_controller.cc
+++ b/vendor_libs/test_vendor_lib/model/controller/dual_mode_controller.cc
@@ -14,19 +14,15 @@
  * limitations under the License.
  */
 
-#define LOG_TAG "dual_mode_controller"
-
 #include "dual_mode_controller.h"
 
 #include <memory>
 
 #include <base/files/file_util.h>
 #include <base/json/json_reader.h>
-#include <base/logging.h>
 #include <base/values.h>
 
-#include "osi/include/log.h"
-#include "osi/include/osi.h"
+#include "os/log.h"
 
 #include "hci.h"
 #include "packets/hci/acl_packet_view.h"
@@ -60,7 +56,11 @@
   if (args.size() < 2) return;
 
   Address addr;
-  if (Address::FromString(args[1], addr)) properties_.SetAddress(addr);
+  if (Address::FromString(args[1], addr)) {
+    properties_.SetAddress(addr);
+  } else {
+    LOG_ALWAYS_FATAL("Invalid address: %s", args[1].c_str());
+  }
 };
 
 std::string DualModeController::GetTypeString() const {
@@ -75,28 +75,6 @@
   link_layer_controller_.TimerTick();
 }
 
-void DualModeController::SendLinkLayerPacket(std::shared_ptr<packets::LinkLayerPacketBuilder> to_send,
-                                             Phy::Type phy_type) {
-  for (auto phy_pair : phy_layers_) {
-    auto phy_list = std::get<1>(phy_pair);
-    if (phy_type != std::get<0>(phy_pair)) {
-      continue;
-    }
-    for (auto phy : phy_list) {
-      phy->Send(to_send);
-    }
-  }
-}
-
-/*
-void DualModeController::AddConnectionAction(const TaskCallback& task,
-                                             uint16_t handle) {
-  for (size_t i = 0; i < connections_.size(); i++)
-    if (connections_[i]->GetHandle() == handle)
-connections_[i]->AddAction(task);
-}
-*/
-
 void DualModeController::SendCommandCompleteSuccess(OpCode command_opcode) const {
   send_event_(packets::EventPacketBuilder::CreateCommandCompleteOnlyStatusEvent(command_opcode, hci::Status::SUCCESS)
                   ->ToVector());
@@ -129,7 +107,7 @@
   loopback_mode_ = hci::LoopbackMode::NO;
 
   Address public_address;
-  CHECK(Address::FromString("3C:5A:B4:04:05:06", public_address));
+  ASSERT(Address::FromString("3C:5A:B4:04:05:06", public_address));
   properties_.SetAddress(public_address);
 
   link_layer_controller_.RegisterRemoteChannel(
@@ -143,12 +121,15 @@
   SET_HANDLER(OpCode::READ_BUFFER_SIZE, HciReadBufferSize);
   SET_HANDLER(OpCode::HOST_BUFFER_SIZE, HciHostBufferSize);
   SET_HANDLER(OpCode::SNIFF_SUBRATING, HciSniffSubrating);
+  SET_HANDLER(OpCode::READ_ENCRYPTION_KEY_SIZE, HciReadEncryptionKeySize);
   SET_HANDLER(OpCode::READ_LOCAL_VERSION_INFORMATION, HciReadLocalVersionInformation);
   SET_HANDLER(OpCode::READ_BD_ADDR, HciReadBdAddr);
   SET_HANDLER(OpCode::READ_LOCAL_SUPPORTED_COMMANDS, HciReadLocalSupportedCommands);
+  SET_HANDLER(OpCode::READ_LOCAL_SUPPORTED_FEATURES, HciReadLocalSupportedFeatures);
   SET_HANDLER(OpCode::READ_LOCAL_SUPPORTED_CODECS, HciReadLocalSupportedCodecs);
   SET_HANDLER(OpCode::READ_LOCAL_EXTENDED_FEATURES, HciReadLocalExtendedFeatures);
   SET_HANDLER(OpCode::READ_REMOTE_EXTENDED_FEATURES, HciReadRemoteExtendedFeatures);
+  SET_HANDLER(OpCode::SWITCH_ROLE, HciSwitchRole);
   SET_HANDLER(OpCode::READ_REMOTE_SUPPORTED_FEATURES, HciReadRemoteSupportedFeatures);
   SET_HANDLER(OpCode::READ_CLOCK_OFFSET, HciReadClockOffset);
   SET_HANDLER(OpCode::IO_CAPABILITY_REQUEST_REPLY, HciIoCapabilityRequestReply);
@@ -157,23 +138,33 @@
   SET_HANDLER(OpCode::IO_CAPABILITY_REQUEST_NEGATIVE_REPLY, HciIoCapabilityRequestNegativeReply);
   SET_HANDLER(OpCode::WRITE_SIMPLE_PAIRING_MODE, HciWriteSimplePairingMode);
   SET_HANDLER(OpCode::WRITE_LE_HOST_SUPPORT, HciWriteLeHostSupport);
+  SET_HANDLER(OpCode::WRITE_SECURE_CONNECTIONS_HOST_SUPPORT,
+              HciWriteSecureConnectionHostSupport);
   SET_HANDLER(OpCode::SET_EVENT_MASK, HciSetEventMask);
   SET_HANDLER(OpCode::WRITE_INQUIRY_MODE, HciWriteInquiryMode);
   SET_HANDLER(OpCode::WRITE_PAGE_SCAN_TYPE, HciWritePageScanType);
   SET_HANDLER(OpCode::WRITE_INQUIRY_SCAN_TYPE, HciWriteInquiryScanType);
   SET_HANDLER(OpCode::AUTHENTICATION_REQUESTED, HciAuthenticationRequested);
   SET_HANDLER(OpCode::SET_CONNECTION_ENCRYPTION, HciSetConnectionEncryption);
+  SET_HANDLER(OpCode::CHANGE_CONNECTION_LINK_KEY, HciChangeConnectionLinkKey);
+  SET_HANDLER(OpCode::MASTER_LINK_KEY, HciMasterLinkKey);
   SET_HANDLER(OpCode::WRITE_AUTHENTICATION_ENABLE, HciWriteAuthenticationEnable);
   SET_HANDLER(OpCode::READ_AUTHENTICATION_ENABLE, HciReadAuthenticationEnable);
   SET_HANDLER(OpCode::WRITE_CLASS_OF_DEVICE, HciWriteClassOfDevice);
   SET_HANDLER(OpCode::WRITE_PAGE_TIMEOUT, HciWritePageTimeout);
   SET_HANDLER(OpCode::WRITE_LINK_SUPERVISION_TIMEOUT, HciWriteLinkSupervisionTimeout);
+  SET_HANDLER(OpCode::HOLD_MODE, HciHoldMode);
+  SET_HANDLER(OpCode::SNIFF_MODE, HciSniffMode);
+  SET_HANDLER(OpCode::EXIT_SNIFF_MODE, HciExitSniffMode);
+  SET_HANDLER(OpCode::QOS_SETUP, HciQosSetup);
   SET_HANDLER(OpCode::WRITE_DEFAULT_LINK_POLICY_SETTINGS, HciWriteDefaultLinkPolicySettings);
+  SET_HANDLER(OpCode::FLOW_SPECIFICATION, HciFlowSpecification);
   SET_HANDLER(OpCode::WRITE_LINK_POLICY_SETTINGS, HciWriteLinkPolicySettings);
   SET_HANDLER(OpCode::CHANGE_CONNECTION_PACKET_TYPE, HciChangeConnectionPacketType);
   SET_HANDLER(OpCode::WRITE_LOCAL_NAME, HciWriteLocalName);
   SET_HANDLER(OpCode::READ_LOCAL_NAME, HciReadLocalName);
   SET_HANDLER(OpCode::WRITE_EXTENDED_INQUIRY_RESPONSE, HciWriteExtendedInquiryResponse);
+  SET_HANDLER(OpCode::REFRESH_ENCRYPTION_KEY, HciRefreshEncryptionKey);
   SET_HANDLER(OpCode::WRITE_VOICE_SETTING, HciWriteVoiceSetting);
   SET_HANDLER(OpCode::WRITE_CURRENT_IAC_LAP, HciWriteCurrentIacLap);
   SET_HANDLER(OpCode::WRITE_INQUIRY_SCAN_ACTIVITY, HciWriteInquiryScanActivity);
@@ -191,8 +182,10 @@
   SET_HANDLER(OpCode::LE_READ_BUFFER_SIZE, HciLeReadBufferSize);
   SET_HANDLER(OpCode::LE_READ_LOCAL_SUPPORTED_FEATURES, HciLeReadLocalSupportedFeatures);
   SET_HANDLER(OpCode::LE_SET_RANDOM_ADDRESS, HciLeSetRandomAddress);
-  SET_HANDLER(OpCode::LE_SET_ADVERTISING_DATA, HciLeSetAdvertisingData);
   SET_HANDLER(OpCode::LE_SET_ADVERTISING_PARAMETERS, HciLeSetAdvertisingParameters);
+  SET_HANDLER(OpCode::LE_SET_ADVERTISING_DATA, HciLeSetAdvertisingData);
+  SET_HANDLER(OpCode::LE_SET_SCAN_RESPONSE_DATA, HciLeSetScanResponseData);
+  SET_HANDLER(OpCode::LE_SET_ADVERTISING_ENABLE, HciLeSetAdvertisingEnable);
   SET_HANDLER(OpCode::LE_SET_SCAN_PARAMETERS, HciLeSetScanParameters);
   SET_HANDLER(OpCode::LE_SET_SCAN_ENABLE, HciLeSetScanEnable);
   SET_HANDLER(OpCode::LE_CREATE_CONNECTION, HciLeCreateConnection);
@@ -214,6 +207,12 @@
   SET_HANDLER(OpCode::READ_REMOTE_VERSION_INFORMATION, HciReadRemoteVersionInformation);
   SET_HANDLER(OpCode::LE_CONNECTION_UPDATE, HciLeConnectionUpdate);
   SET_HANDLER(OpCode::LE_START_ENCRYPTION, HciLeStartEncryption);
+  SET_HANDLER(OpCode::LE_ADD_DEVICE_TO_RESOLVING_LIST,
+              HciLeAddDeviceToResolvingList);
+  SET_HANDLER(OpCode::LE_REMOVE_DEVICE_FROM_RESOLVING_LIST,
+              HciLeRemoveDeviceFromResolvingList);
+  SET_HANDLER(OpCode::LE_CLEAR_RESOLVING_LIST, HciLeClearResolvingList);
+  SET_HANDLER(OpCode::LE_SET_PRIVACY_MODE, HciLeSetPrivacyMode);
   // Testing Commands
   SET_HANDLER(OpCode::READ_LOOPBACK_MODE, HciReadLoopbackMode);
   SET_HANDLER(OpCode::WRITE_LOOPBACK_MODE, HciWriteLoopbackMode);
@@ -221,7 +220,7 @@
 }
 
 void DualModeController::HciSniffSubrating(packets::PacketView<true> args) {
-  CHECK(args.size() == 8) << __func__ << " size=" << args.size();
+  ASSERT_LOG(args.size() == 8, "%s size=%zu", __func__, args.size());
 
   uint16_t handle = args.begin().extract<uint16_t>();
 
@@ -280,7 +279,7 @@
     active_hci_commands_[opcode](command_packet.GetPayload());
   } else {
     SendCommandCompleteUnknownOpCodeEvent(opcode);
-    LOG_INFO(LOG_TAG, "Command opcode: 0x%04X, OGF: 0x%04X, OCF: 0x%04X", opcode, opcode & 0xFC00, opcode & 0x03FF);
+    LOG_INFO("Command opcode: 0x%04X, OGF: 0x%04X, OCF: 0x%04X", opcode, (opcode & 0xFC00) >> 10, opcode & 0x03FF);
   }
 }
 
@@ -303,7 +302,7 @@
 }
 
 void DualModeController::HciReset(packets::PacketView<true> args) {
-  CHECK(args.size() == 0) << __func__ << " size=" << args.size();
+  ASSERT_LOG(args.size() == 0, "%s  size=%zu", __func__, args.size());
   link_layer_controller_.Reset();
   if (loopback_mode_ == hci::LoopbackMode::LOCAL) {
     loopback_mode_ = hci::LoopbackMode::NO;
@@ -313,7 +312,7 @@
 }
 
 void DualModeController::HciReadBufferSize(packets::PacketView<true> args) {
-  CHECK(args.size() == 0) << __func__ << " size=" << args.size();
+  ASSERT_LOG(args.size() == 0, "%s  size=%zu", __func__, args.size());
   std::shared_ptr<packets::EventPacketBuilder> command_complete =
       packets::EventPacketBuilder::CreateCommandCompleteReadBufferSize(
           hci::Status::SUCCESS, properties_.GetAclDataPacketSize(), properties_.GetSynchronousDataPacketSize(),
@@ -322,13 +321,26 @@
   send_event_(command_complete->ToVector());
 }
 
+void DualModeController::HciReadEncryptionKeySize(
+    packets::PacketView<true> args) {
+  ASSERT_LOG(args.size() == 2, "%s  size=%zu", __func__, args.size());
+
+  uint16_t handle = args.begin().extract<uint16_t>();
+
+  std::shared_ptr<packets::EventPacketBuilder> command_complete =
+      packets::EventPacketBuilder::CreateCommandCompleteReadEncryptionKeySize(
+          hci::Status::SUCCESS, handle, properties_.GetEncryptionKeySize());
+
+  send_event_(command_complete->ToVector());
+}
+
 void DualModeController::HciHostBufferSize(packets::PacketView<true> args) {
-  CHECK(args.size() == 7) << __func__ << " size=" << args.size();
+  ASSERT_LOG(args.size() == 7, "%s  size=%zu", __func__, args.size());
   SendCommandCompleteSuccess(OpCode::HOST_BUFFER_SIZE);
 }
 
 void DualModeController::HciReadLocalVersionInformation(packets::PacketView<true> args) {
-  CHECK(args.size() == 0) << __func__ << " size=" << args.size();
+  ASSERT_LOG(args.size() == 0, "%s  size=%zu", __func__, args.size());
   std::shared_ptr<packets::EventPacketBuilder> command_complete =
       packets::EventPacketBuilder::CreateCommandCompleteReadLocalVersionInformation(
           hci::Status::SUCCESS, properties_.GetVersion(), properties_.GetRevision(), properties_.GetLmpPalVersion(),
@@ -337,7 +349,7 @@
 }
 
 void DualModeController::HciReadRemoteVersionInformation(packets::PacketView<true> args) {
-  CHECK(args.size() == 2) << __func__ << " size=" << args.size();
+  ASSERT_LOG(args.size() == 2, "%s  size=%zu", __func__, args.size());
 
   uint16_t handle = args.begin().extract<uint16_t>();
 
@@ -348,22 +360,30 @@
 }
 
 void DualModeController::HciReadBdAddr(packets::PacketView<true> args) {
-  CHECK(args.size() == 0) << __func__ << " size=" << args.size();
+  ASSERT_LOG(args.size() == 0, "%s  size=%zu", __func__, args.size());
   std::shared_ptr<packets::EventPacketBuilder> command_complete =
       packets::EventPacketBuilder::CreateCommandCompleteReadBdAddr(hci::Status::SUCCESS, properties_.GetAddress());
   send_event_(command_complete->ToVector());
 }
 
 void DualModeController::HciReadLocalSupportedCommands(packets::PacketView<true> args) {
-  CHECK(args.size() == 0) << __func__ << " size=" << args.size();
+  ASSERT_LOG(args.size() == 0, "%s  size=%zu", __func__, args.size());
   std::shared_ptr<packets::EventPacketBuilder> command_complete =
       packets::EventPacketBuilder::CreateCommandCompleteReadLocalSupportedCommands(hci::Status::SUCCESS,
                                                                                    properties_.GetSupportedCommands());
   send_event_(command_complete->ToVector());
 }
 
+void DualModeController::HciReadLocalSupportedFeatures(packets::PacketView<true> args) {
+  ASSERT_LOG(args.size() == 0, "%s  size=%zu", __func__, args.size());
+  std::shared_ptr<packets::EventPacketBuilder> command_complete =
+      packets::EventPacketBuilder::CreateCommandCompleteReadLocalSupportedFeatures(hci::Status::SUCCESS,
+                                                                                   properties_.GetSupportedFeatures());
+  send_event_(command_complete->ToVector());
+}
+
 void DualModeController::HciReadLocalSupportedCodecs(packets::PacketView<true> args) {
-  CHECK(args.size() == 0) << __func__ << " size=" << args.size();
+  ASSERT_LOG(args.size() == 0, "%s  size=%zu", __func__, args.size());
   std::shared_ptr<packets::EventPacketBuilder> command_complete =
       packets::EventPacketBuilder::CreateCommandCompleteReadLocalSupportedCodecs(
           hci::Status::SUCCESS, properties_.GetSupportedCodecs(), properties_.GetVendorSpecificCodecs());
@@ -371,7 +391,7 @@
 }
 
 void DualModeController::HciReadLocalExtendedFeatures(packets::PacketView<true> args) {
-  CHECK(args.size() == 1) << __func__ << " size=" << args.size();
+  ASSERT_LOG(args.size() == 1, "%s  size=%zu", __func__, args.size());
   uint8_t page_number = args.begin().extract<uint8_t>();
   send_event_(packets::EventPacketBuilder::CreateCommandCompleteReadLocalExtendedFeatures(
                   hci::Status::SUCCESS, page_number, properties_.GetExtendedFeaturesMaximumPageNumber(),
@@ -380,7 +400,7 @@
 }
 
 void DualModeController::HciReadRemoteExtendedFeatures(packets::PacketView<true> args) {
-  CHECK(args.size() == 3) << __func__ << " size=" << args.size();
+  ASSERT_LOG(args.size() == 3, "%s  size=%zu", __func__, args.size());
 
   uint16_t handle = args.begin().extract<uint16_t>();
 
@@ -390,8 +410,19 @@
   SendCommandStatus(status, OpCode::READ_REMOTE_EXTENDED_FEATURES);
 }
 
+void DualModeController::HciSwitchRole(packets::PacketView<true> args) {
+  ASSERT_LOG(args.size() == 7, "%s  size=%zu", __func__, args.size());
+
+  Address address = args.begin().extract<Address>();
+  uint8_t role = args.begin().extract<uint8_t>();
+
+  hci::Status status = link_layer_controller_.SwitchRole(address, role);
+
+  SendCommandStatus(status, OpCode::SWITCH_ROLE);
+}
+
 void DualModeController::HciReadRemoteSupportedFeatures(packets::PacketView<true> args) {
-  CHECK(args.size() == 2) << __func__ << " size=" << args.size();
+  ASSERT_LOG(args.size() == 2, "%s  size=%zu", __func__, args.size());
 
   uint16_t handle = args.begin().extract<uint16_t>();
 
@@ -402,7 +433,7 @@
 }
 
 void DualModeController::HciReadClockOffset(packets::PacketView<true> args) {
-  CHECK(args.size() == 2) << __func__ << " size=" << args.size();
+  ASSERT_LOG(args.size() == 2, "%s  size=%zu", __func__, args.size());
 
   uint16_t handle = args.begin().extract<uint16_t>();
 
@@ -412,7 +443,7 @@
 }
 
 void DualModeController::HciIoCapabilityRequestReply(packets::PacketView<true> args) {
-  CHECK(args.size() == 9) << __func__ << " size=" << args.size();
+  ASSERT_LOG(args.size() == 9, "%s  size=%zu", __func__, args.size());
 
   auto args_itr = args.begin();
   Address peer = args_itr.extract<Address>();
@@ -427,7 +458,7 @@
 }
 
 void DualModeController::HciUserConfirmationRequestReply(packets::PacketView<true> args) {
-  CHECK(args.size() == 6) << __func__ << " size=" << args.size();
+  ASSERT_LOG(args.size() == 6, "%s  size=%zu", __func__, args.size());
 
   Address peer = args.begin().extract<Address>();
 
@@ -437,7 +468,7 @@
 }
 
 void DualModeController::HciUserConfirmationRequestNegativeReply(packets::PacketView<true> args) {
-  CHECK(args.size() == 6) << __func__ << " size=" << args.size();
+  ASSERT_LOG(args.size() == 6, "%s  size=%zu", __func__, args.size());
 
   Address peer = args.begin().extract<Address>();
 
@@ -447,7 +478,7 @@
 }
 
 void DualModeController::HciUserPasskeyRequestReply(packets::PacketView<true> args) {
-  CHECK(args.size() == 10) << __func__ << " size=" << args.size();
+  ASSERT_LOG(args.size() == 10, "%s  size=%zu", __func__, args.size());
 
   auto args_itr = args.begin();
   Address peer = args_itr.extract<Address>();
@@ -459,7 +490,7 @@
 }
 
 void DualModeController::HciUserPasskeyRequestNegativeReply(packets::PacketView<true> args) {
-  CHECK(args.size() == 6) << __func__ << " size=" << args.size();
+  ASSERT_LOG(args.size() == 6, "%s  size=%zu", __func__, args.size());
 
   Address peer = args.begin().extract<Address>();
 
@@ -469,7 +500,7 @@
 }
 
 void DualModeController::HciRemoteOobDataRequestReply(packets::PacketView<true> args) {
-  CHECK(args.size() == 38) << __func__ << " size=" << args.size();
+  ASSERT_LOG(args.size() == 38, "%s  size=%zu", __func__, args.size());
 
   auto args_itr = args.begin();
   Address peer = args_itr.extract<Address>();
@@ -487,7 +518,7 @@
 }
 
 void DualModeController::HciRemoteOobDataRequestNegativeReply(packets::PacketView<true> args) {
-  CHECK(args.size() == 6) << __func__ << " size=" << args.size();
+  ASSERT_LOG(args.size() == 6, "%s  size=%zu", __func__, args.size());
 
   Address peer = args.begin().extract<Address>();
 
@@ -497,7 +528,7 @@
 }
 
 void DualModeController::HciIoCapabilityRequestNegativeReply(packets::PacketView<true> args) {
-  CHECK(args.size() == 7) << __func__ << " size=" << args.size();
+  ASSERT_LOG(args.size() == 7, "%s  size=%zu", __func__, args.size());
 
   auto args_itr = args.begin();
   Address peer = args_itr.extract<Address>();
@@ -509,14 +540,14 @@
 }
 
 void DualModeController::HciWriteSimplePairingMode(packets::PacketView<true> args) {
-  CHECK(args.size() == 1) << __func__ << " size=" << args.size();
-  CHECK(args[0] == 1 || args[0] == 0);
+  ASSERT_LOG(args.size() == 1, "%s  size=%zu", __func__, args.size());
+  ASSERT(args[0] == 1 || args[0] == 0);
   link_layer_controller_.WriteSimplePairingMode(args[0] == 1);
   SendCommandCompleteSuccess(OpCode::WRITE_SIMPLE_PAIRING_MODE);
 }
 
 void DualModeController::HciChangeConnectionPacketType(packets::PacketView<true> args) {
-  CHECK(args.size() == 4) << __func__ << " size=" << args.size();
+  ASSERT_LOG(args.size() == 4, "%s  size=%zu", __func__, args.size());
   auto args_itr = args.begin();
   uint16_t handle = args_itr.extract<uint16_t>();
   uint16_t packet_type = args_itr.extract<uint16_t>();
@@ -527,33 +558,39 @@
 }
 
 void DualModeController::HciWriteLeHostSupport(packets::PacketView<true> args) {
-  CHECK(args.size() == 2) << __func__ << " size=" << args.size();
+  ASSERT_LOG(args.size() == 2, "%s  size=%zu", __func__, args.size());
   SendCommandCompleteSuccess(OpCode::WRITE_LE_HOST_SUPPORT);
 }
 
+void DualModeController::HciWriteSecureConnectionHostSupport(
+    packets::PacketView<true> args) {
+  ASSERT_LOG(args.size() == 1, "%s  size=%zu", __func__, args.size());
+  SendCommandCompleteSuccess(OpCode::WRITE_SECURE_CONNECTIONS_HOST_SUPPORT);
+}
+
 void DualModeController::HciSetEventMask(packets::PacketView<true> args) {
-  CHECK(args.size() == 8) << __func__ << " size=" << args.size();
+  ASSERT_LOG(args.size() == 8, "%s  size=%zu", __func__, args.size());
   SendCommandCompleteSuccess(OpCode::SET_EVENT_MASK);
 }
 
 void DualModeController::HciWriteInquiryMode(packets::PacketView<true> args) {
-  CHECK(args.size() == 1) << __func__ << " size=" << args.size();
+  ASSERT_LOG(args.size() == 1, "%s  size=%zu", __func__, args.size());
   link_layer_controller_.SetInquiryMode(args[0]);
   SendCommandCompleteSuccess(OpCode::WRITE_INQUIRY_MODE);
 }
 
 void DualModeController::HciWritePageScanType(packets::PacketView<true> args) {
-  CHECK(args.size() == 1) << __func__ << " size=" << args.size();
+  ASSERT_LOG(args.size() == 1, "%s  size=%zu", __func__, args.size());
   SendCommandCompleteSuccess(OpCode::WRITE_PAGE_SCAN_TYPE);
 }
 
 void DualModeController::HciWriteInquiryScanType(packets::PacketView<true> args) {
-  CHECK(args.size() == 1) << __func__ << " size=" << args.size();
+  ASSERT_LOG(args.size() == 1, "%s  size=%zu", __func__, args.size());
   SendCommandCompleteSuccess(OpCode::WRITE_INQUIRY_SCAN_TYPE);
 }
 
 void DualModeController::HciAuthenticationRequested(packets::PacketView<true> args) {
-  CHECK(args.size() == 2) << __func__ << " size=" << args.size();
+  ASSERT_LOG(args.size() == 2, "%s  size=%zu", __func__, args.size());
   uint16_t handle = args.begin().extract<uint16_t>();
   hci::Status status = link_layer_controller_.AuthenticationRequested(handle);
 
@@ -561,7 +598,7 @@
 }
 
 void DualModeController::HciSetConnectionEncryption(packets::PacketView<true> args) {
-  CHECK(args.size() == 3) << __func__ << " size=" << args.size();
+  ASSERT_LOG(args.size() == 3, "%s  size=%zu", __func__, args.size());
   auto args_itr = args.begin();
   uint16_t handle = args_itr.extract<uint16_t>();
   uint8_t encryption_enable = args_itr.extract<uint8_t>();
@@ -570,14 +607,34 @@
   SendCommandStatus(status, OpCode::SET_CONNECTION_ENCRYPTION);
 }
 
+void DualModeController::HciChangeConnectionLinkKey(packets::PacketView<true> args) {
+  ASSERT_LOG(args.size() == 2, "%s  size=%zu", __func__, args.size());
+  auto args_itr = args.begin();
+  uint16_t handle = args_itr.extract<uint16_t>();
+
+  hci::Status status = link_layer_controller_.ChangeConnectionLinkKey(handle);
+
+  SendCommandStatus(status, OpCode::CHANGE_CONNECTION_LINK_KEY);
+}
+
+void DualModeController::HciMasterLinkKey(packets::PacketView<true> args) {
+  ASSERT_LOG(args.size() == 1, "%s  size=%zu", __func__, args.size());
+  auto args_itr = args.begin();
+  uint8_t key_flag = args_itr.extract<uint8_t>();
+
+  hci::Status status = link_layer_controller_.MasterLinkKey(key_flag);
+
+  SendCommandStatus(status, OpCode::MASTER_LINK_KEY);
+}
+
 void DualModeController::HciWriteAuthenticationEnable(packets::PacketView<true> args) {
-  CHECK(args.size() == 1) << __func__ << " size=" << args.size();
+  ASSERT_LOG(args.size() == 1, "%s  size=%zu", __func__, args.size());
   properties_.SetAuthenticationEnable(args[0]);
   SendCommandCompleteSuccess(OpCode::WRITE_AUTHENTICATION_ENABLE);
 }
 
 void DualModeController::HciReadAuthenticationEnable(packets::PacketView<true> args) {
-  CHECK(args.size() == 0) << __func__ << " size=" << args.size();
+  ASSERT_LOG(args.size() == 0, "%s  size=%zu", __func__, args.size());
   std::shared_ptr<packets::EventPacketBuilder> command_complete =
       packets::EventPacketBuilder::CreateCommandCompleteReadAuthenticationEnable(hci::Status::SUCCESS,
                                                                                  properties_.GetAuthenticationEnable());
@@ -585,23 +642,95 @@
 }
 
 void DualModeController::HciWriteClassOfDevice(packets::PacketView<true> args) {
-  CHECK(args.size() == 3) << __func__ << " size=" << args.size();
+  ASSERT_LOG(args.size() == 3, "%s  size=%zu", __func__, args.size());
   properties_.SetClassOfDevice(args[0], args[1], args[2]);
   SendCommandCompleteSuccess(OpCode::WRITE_CLASS_OF_DEVICE);
 }
 
 void DualModeController::HciWritePageTimeout(packets::PacketView<true> args) {
-  CHECK(args.size() == 2) << __func__ << " size=" << args.size();
+  ASSERT_LOG(args.size() == 2, "%s  size=%zu", __func__, args.size());
   SendCommandCompleteSuccess(OpCode::WRITE_PAGE_TIMEOUT);
 }
 
+void DualModeController::HciHoldMode(packets::PacketView<true> args) {
+  ASSERT_LOG(args.size() == 6, "%s  size=%zu", __func__, args.size());
+  auto args_itr = args.begin();
+  uint16_t handle = args_itr.extract<uint16_t>();
+  uint16_t hold_mode_max_interval = args_itr.extract<uint16_t>();
+  uint16_t hold_mode_min_interval = args_itr.extract<uint16_t>();
+
+  hci::Status status = link_layer_controller_.HoldMode(handle, hold_mode_max_interval, hold_mode_min_interval);
+
+  SendCommandStatus(status, OpCode::HOLD_MODE);
+}
+
+void DualModeController::HciSniffMode(packets::PacketView<true> args) {
+  ASSERT_LOG(args.size() == 10, "%s  size=%zu", __func__, args.size());
+  auto args_itr = args.begin();
+  uint16_t handle = args_itr.extract<uint16_t>();
+  uint16_t sniff_max_interval = args_itr.extract<uint16_t>();
+  uint16_t sniff_min_interval = args_itr.extract<uint16_t>();
+  uint16_t sniff_attempt = args_itr.extract<uint16_t>();
+  uint16_t sniff_timeout = args_itr.extract<uint16_t>();
+
+  hci::Status status =
+      link_layer_controller_.SniffMode(handle, sniff_max_interval, sniff_min_interval, sniff_attempt, sniff_timeout);
+
+  SendCommandStatus(status, OpCode::SNIFF_MODE);
+}
+
+void DualModeController::HciExitSniffMode(packets::PacketView<true> args) {
+  ASSERT_LOG(args.size() == 2, "%s  size=%zu", __func__, args.size());
+  auto args_itr = args.begin();
+  uint16_t handle = args_itr.extract<uint16_t>();
+
+  hci::Status status = link_layer_controller_.ExitSniffMode(handle);
+
+  SendCommandStatus(status, OpCode::EXIT_SNIFF_MODE);
+}
+
+void DualModeController::HciQosSetup(packets::PacketView<true> args) {
+  ASSERT_LOG(args.size() == 20, "%s  size=%zu", __func__, args.size());
+  auto args_itr = args.begin();
+  uint16_t handle = args_itr.extract<uint16_t>();
+  args_itr.extract<uint8_t>();  // unused
+  uint8_t service_type = args_itr.extract<uint8_t>();
+  uint32_t token_rate = args_itr.extract<uint32_t>();
+  uint32_t peak_bandwidth = args_itr.extract<uint32_t>();
+  uint32_t latency = args_itr.extract<uint32_t>();
+  uint32_t delay_variation = args_itr.extract<uint32_t>();
+
+  hci::Status status =
+      link_layer_controller_.QosSetup(handle, service_type, token_rate, peak_bandwidth, latency, delay_variation);
+
+  SendCommandStatus(status, OpCode::QOS_SETUP);
+}
+
 void DualModeController::HciWriteDefaultLinkPolicySettings(packets::PacketView<true> args) {
-  CHECK(args.size() == 2) << __func__ << " size=" << args.size();
+  ASSERT_LOG(args.size() == 2, "%s  size=%zu", __func__, args.size());
   SendCommandCompleteSuccess(OpCode::WRITE_DEFAULT_LINK_POLICY_SETTINGS);
 }
 
+void DualModeController::HciFlowSpecification(packets::PacketView<true> args) {
+  ASSERT_LOG(args.size() == 21, "%s  size=%zu", __func__, args.size());
+  auto args_itr = args.begin();
+  uint16_t handle = args_itr.extract<uint16_t>();
+  args_itr.extract<uint8_t>();  // unused
+  uint8_t flow_direction = args_itr.extract<uint8_t>();
+  uint8_t service_type = args_itr.extract<uint8_t>();
+  uint32_t token_rate = args_itr.extract<uint32_t>();
+  uint32_t token_bucket_size = args_itr.extract<uint32_t>();
+  uint32_t peak_bandwidth = args_itr.extract<uint32_t>();
+  uint32_t access_latency = args_itr.extract<uint32_t>();
+
+  hci::Status status = link_layer_controller_.FlowSpecification(handle, flow_direction, service_type, token_rate,
+                                                                token_bucket_size, peak_bandwidth, access_latency);
+
+  SendCommandStatus(status, OpCode::FLOW_SPECIFICATION);
+}
+
 void DualModeController::HciWriteLinkPolicySettings(packets::PacketView<true> args) {
-  CHECK(args.size() == 4) << __func__ << " size=" << args.size();
+  ASSERT_LOG(args.size() == 4, "%s  size=%zu", __func__, args.size());
 
   auto args_itr = args.begin();
   uint16_t handle = args_itr.extract<uint16_t>();
@@ -613,7 +742,7 @@
 }
 
 void DualModeController::HciWriteLinkSupervisionTimeout(packets::PacketView<true> args) {
-  CHECK(args.size() == 4) << __func__ << " size=" << args.size();
+  ASSERT_LOG(args.size() == 4, "%s  size=%zu", __func__, args.size());
 
   auto args_itr = args.begin();
   uint16_t handle = args_itr.extract<uint16_t>();
@@ -626,61 +755,71 @@
 }
 
 void DualModeController::HciReadLocalName(packets::PacketView<true> args) {
-  CHECK(args.size() == 0) << __func__ << " size=" << args.size();
+  ASSERT_LOG(args.size() == 0, "%s  size=%zu", __func__, args.size());
   std::shared_ptr<packets::EventPacketBuilder> command_complete =
       packets::EventPacketBuilder::CreateCommandCompleteReadLocalName(hci::Status::SUCCESS, properties_.GetName());
   send_event_(command_complete->ToVector());
 }
 
 void DualModeController::HciWriteLocalName(packets::PacketView<true> args) {
-  CHECK(args.size() == 248) << __func__ << " size=" << args.size();
+  ASSERT_LOG(args.size() == 248, "%s  size=%zu", __func__, args.size());
   std::vector<uint8_t> clipped(args.begin(), args.begin() + LastNonZero(args) + 1);
   properties_.SetName(clipped);
   SendCommandCompleteSuccess(OpCode::WRITE_LOCAL_NAME);
 }
 
 void DualModeController::HciWriteExtendedInquiryResponse(packets::PacketView<true> args) {
-  CHECK(args.size() == 241) << __func__ << " size=" << args.size();
+  ASSERT_LOG(args.size() == 241, "%s  size=%zu", __func__, args.size());
   // Strip FEC byte and trailing zeros
   std::vector<uint8_t> clipped(args.begin() + 1, args.begin() + LastNonZero(args) + 1);
   properties_.SetExtendedInquiryData(clipped);
-  LOG_WARN(LOG_TAG, "Write EIR Inquiry - Size = %d (%d)", static_cast<int>(properties_.GetExtendedInquiryData().size()),
+  LOG_WARN("Write EIR Inquiry - Size = %d (%d)", static_cast<int>(properties_.GetExtendedInquiryData().size()),
            static_cast<int>(clipped.size()));
   SendCommandCompleteSuccess(OpCode::WRITE_EXTENDED_INQUIRY_RESPONSE);
 }
 
+void DualModeController::HciRefreshEncryptionKey(packets::PacketView<true> args) {
+  ASSERT_LOG(args.size() == 2, "%s  size=%zu", __func__, args.size());
+  auto args_itr = args.begin();
+  uint16_t handle = args_itr.extract<uint16_t>();
+  SendCommandStatusSuccess(OpCode::REFRESH_ENCRYPTION_KEY);
+  // TODO: Support this in the link layer
+  hci::Status status = hci::Status::SUCCESS;
+  send_event_(packets::EventPacketBuilder::CreateEncryptionKeyRefreshCompleteEvent(status, handle)->ToVector());
+}
+
 void DualModeController::HciWriteVoiceSetting(packets::PacketView<true> args) {
-  CHECK(args.size() == 2) << __func__ << " size=" << args.size();
+  ASSERT_LOG(args.size() == 2, "%s  size=%zu", __func__, args.size());
   SendCommandCompleteSuccess(OpCode::WRITE_VOICE_SETTING);
 }
 
 void DualModeController::HciWriteCurrentIacLap(packets::PacketView<true> args) {
-  CHECK(args.size() > 0);
-  CHECK(args.size() == 1 + (3 * args[0]));  // count + 3-byte IACs
+  ASSERT(args.size() > 0);
+  ASSERT(args.size() == 1 + (3 * args[0]));  // count + 3-byte IACs
 
   SendCommandCompleteSuccess(OpCode::WRITE_CURRENT_IAC_LAP);
 }
 
 void DualModeController::HciWriteInquiryScanActivity(packets::PacketView<true> args) {
-  CHECK(args.size() == 4) << __func__ << " size=" << args.size();
+  ASSERT_LOG(args.size() == 4, "%s  size=%zu", __func__, args.size());
   SendCommandCompleteSuccess(OpCode::WRITE_INQUIRY_SCAN_ACTIVITY);
 }
 
 void DualModeController::HciWriteScanEnable(packets::PacketView<true> args) {
-  CHECK(args.size() == 1) << __func__ << " size=" << args.size();
+  ASSERT_LOG(args.size() == 1, "%s  size=%zu", __func__, args.size());
   link_layer_controller_.SetInquiryScanEnable(args[0] & 0x1);
   link_layer_controller_.SetPageScanEnable(args[0] & 0x2);
   SendCommandCompleteSuccess(OpCode::WRITE_SCAN_ENABLE);
 }
 
 void DualModeController::HciSetEventFilter(packets::PacketView<true> args) {
-  CHECK(args.size() > 0);
+  ASSERT(args.size() > 0);
   SendCommandCompleteSuccess(OpCode::SET_EVENT_FILTER);
 }
 
 void DualModeController::HciInquiry(packets::PacketView<true> args) {
-  CHECK(args.size() == 5) << __func__ << " size=" << args.size();
-  link_layer_controller_.SetInquiryLAP(args[0] | (args[1] << 8) | (args[2] << 16));
+  ASSERT_LOG(args.size() == 5, "%s  size=%zu", __func__, args.size());
+  link_layer_controller_.SetInquiryLAP(args[0] | (args[1], 8) | (args[2], 16));
   link_layer_controller_.SetInquiryMaxResponses(args[4]);
   link_layer_controller_.StartInquiry(std::chrono::milliseconds(args[3] * 1280));
 
@@ -688,13 +827,13 @@
 }
 
 void DualModeController::HciInquiryCancel(packets::PacketView<true> args) {
-  CHECK(args.size() == 0) << __func__ << " size=" << args.size();
+  ASSERT_LOG(args.size() == 0, "%s  size=%zu", __func__, args.size());
   link_layer_controller_.InquiryCancel();
   SendCommandCompleteSuccess(OpCode::INQUIRY_CANCEL);
 }
 
 void DualModeController::HciAcceptConnectionRequest(packets::PacketView<true> args) {
-  CHECK(args.size() == 7) << __func__ << " size=" << args.size();
+  ASSERT_LOG(args.size() == 7, "%s  size=%zu", __func__, args.size());
   Address addr = args.begin().extract<Address>();
   bool try_role_switch = args[6] == 0;
   hci::Status status = link_layer_controller_.AcceptConnectionRequest(addr, try_role_switch);
@@ -702,7 +841,7 @@
 }
 
 void DualModeController::HciRejectConnectionRequest(packets::PacketView<true> args) {
-  CHECK(args.size() == 7) << __func__ << " size=" << args.size();
+  ASSERT_LOG(args.size() == 7, "%s  size=%zu", __func__, args.size());
   auto args_itr = args.begin();
   Address addr = args_itr.extract<Address>();
   uint8_t reason = args_itr.extract<uint8_t>();
@@ -711,7 +850,7 @@
 }
 
 void DualModeController::HciLinkKeyRequestReply(packets::PacketView<true> args) {
-  CHECK(args.size() == 22) << __func__ << " size=" << args.size();
+  ASSERT_LOG(args.size() == 22, "%s  size=%zu", __func__, args.size());
   Address addr = args.begin().extract<Address>();
   packets::PacketView<true> key = args.SubViewLittleEndian(6, 22);
   hci::Status status = link_layer_controller_.LinkKeyRequestReply(addr, key);
@@ -719,14 +858,14 @@
 }
 
 void DualModeController::HciLinkKeyRequestNegativeReply(packets::PacketView<true> args) {
-  CHECK(args.size() == 6) << __func__ << " size=" << args.size();
+  ASSERT_LOG(args.size() == 6, "%s  size=%zu", __func__, args.size());
   Address addr = args.begin().extract<Address>();
   hci::Status status = link_layer_controller_.LinkKeyRequestNegativeReply(addr);
   send_event_(packets::EventPacketBuilder::CreateCommandCompleteLinkKeyRequestNegativeReply(status, addr)->ToVector());
 }
 
 void DualModeController::HciDeleteStoredLinkKey(packets::PacketView<true> args) {
-  CHECK(args.size() == 7) << __func__ << " size=" << args.size();
+  ASSERT_LOG(args.size() == 7, "%s  size=%zu", __func__, args.size());
 
   uint16_t deleted_keys = 0;
 
@@ -744,7 +883,7 @@
 }
 
 void DualModeController::HciRemoteNameRequest(packets::PacketView<true> args) {
-  CHECK(args.size() == 10) << __func__ << " size=" << args.size();
+  ASSERT_LOG(args.size() == 10, "%s  size=%zu", __func__, args.size());
 
   Address remote_addr = args.begin().extract<Address>();
 
@@ -755,7 +894,7 @@
 }
 
 void DualModeController::HciLeSetEventMask(packets::PacketView<true> args) {
-  CHECK(args.size() == 8) << __func__ << " size=" << args.size();
+  ASSERT_LOG(args.size() == 8, "%s  size=%zu", __func__, args.size());
   /*
     uint64_t mask = args.begin().extract<uint64_t>();
     link_layer_controller_.SetLeEventMask(mask);
@@ -764,7 +903,7 @@
 }
 
 void DualModeController::HciLeReadBufferSize(packets::PacketView<true> args) {
-  CHECK(args.size() == 0) << __func__ << " size=" << args.size();
+  ASSERT_LOG(args.size() == 0, "%s  size=%zu", __func__, args.size());
   std::shared_ptr<packets::EventPacketBuilder> command_complete =
       packets::EventPacketBuilder::CreateCommandCompleteLeReadBufferSize(
           hci::Status::SUCCESS, properties_.GetLeDataPacketLength(), properties_.GetTotalNumLeDataPackets());
@@ -772,7 +911,7 @@
 }
 
 void DualModeController::HciLeReadLocalSupportedFeatures(packets::PacketView<true> args) {
-  CHECK(args.size() == 0) << __func__ << " size=" << args.size();
+  ASSERT_LOG(args.size() == 0, "%s  size=%zu", __func__, args.size());
   std::shared_ptr<packets::EventPacketBuilder> command_complete =
       packets::EventPacketBuilder::CreateCommandCompleteLeReadLocalSupportedFeatures(
           hci::Status::SUCCESS, properties_.GetLeSupportedFeatures());
@@ -780,42 +919,63 @@
 }
 
 void DualModeController::HciLeSetRandomAddress(packets::PacketView<true> args) {
-  CHECK(args.size() == 6) << __func__ << " size=" << args.size();
+  ASSERT_LOG(args.size() == 6, "%s  size=%zu", __func__, args.size());
   properties_.SetLeAddress(args.begin().extract<Address>());
   SendCommandCompleteSuccess(OpCode::LE_SET_RANDOM_ADDRESS);
 }
 
 void DualModeController::HciLeSetAdvertisingParameters(packets::PacketView<true> args) {
-  CHECK(args.size() == 15) << __func__ << " size=" << args.size();
+  ASSERT_LOG(args.size() == 15, "%s  size=%zu", __func__, args.size());
+  auto args_itr = args.begin();
+  properties_.SetLeAdvertisingParameters(
+      args_itr.extract<uint16_t>() /* AdverisingIntervalMin */,
+      args_itr.extract<uint16_t>() /* AdverisingIntervalMax */, args_itr.extract<uint8_t>() /* AdverisingType */,
+      args_itr.extract<uint8_t>() /* OwnAddressType */, args_itr.extract<uint8_t>() /* PeerAddressType */,
+      args_itr.extract<Address>() /* PeerAddress */, args_itr.extract<uint8_t>() /* AdvertisingChannelMap */,
+      args_itr.extract<uint8_t>() /* AdvertisingFilterPolicy */
+  );
 
   SendCommandCompleteSuccess(OpCode::LE_SET_ADVERTISING_PARAMETERS);
 }
 
 void DualModeController::HciLeSetAdvertisingData(packets::PacketView<true> args) {
-  CHECK(args.size() > 0);
+  ASSERT_LOG(args.size() == 32, "%s  size=%zu", __func__, args.size());
+  properties_.SetLeAdvertisement(std::vector<uint8_t>(args.begin() + 1, args.end()));
   SendCommandCompleteSuccess(OpCode::LE_SET_ADVERTISING_DATA);
 }
 
+void DualModeController::HciLeSetScanResponseData(packets::PacketView<true> args) {
+  ASSERT_LOG(args.size() == 32, "%s  size=%zu", __func__, args.size());
+  properties_.SetLeScanResponse(std::vector<uint8_t>(args.begin() + 1, args.end()));
+  SendCommandCompleteSuccess(OpCode::LE_SET_SCAN_RESPONSE_DATA);
+}
+
+void DualModeController::HciLeSetAdvertisingEnable(packets::PacketView<true> args) {
+  ASSERT_LOG(args.size() == 1, "%s  size=%zu", __func__, args.size());
+  hci::Status status = link_layer_controller_.SetLeAdvertisingEnable(args.begin().extract<uint8_t>());
+  SendCommandCompleteOnlyStatus(OpCode::LE_SET_ADVERTISING_ENABLE, status);
+}
+
 void DualModeController::HciLeSetScanParameters(packets::PacketView<true> args) {
-  CHECK(args.size() == 7) << __func__ << " size=" << args.size();
+  ASSERT_LOG(args.size() == 7, "%s  size=%zu", __func__, args.size());
   link_layer_controller_.SetLeScanType(args[0]);
-  link_layer_controller_.SetLeScanInterval(args[1] | (args[2] << 8));
-  link_layer_controller_.SetLeScanWindow(args[3] | (args[4] << 8));
+  link_layer_controller_.SetLeScanInterval(args[1] | (args[2], 8));
+  link_layer_controller_.SetLeScanWindow(args[3] | (args[4], 8));
   link_layer_controller_.SetLeAddressType(args[5]);
   link_layer_controller_.SetLeScanFilterPolicy(args[6]);
   SendCommandCompleteSuccess(OpCode::LE_SET_SCAN_PARAMETERS);
 }
 
 void DualModeController::HciLeSetScanEnable(packets::PacketView<true> args) {
-  CHECK(args.size() == 2) << __func__ << " size=" << args.size();
-  LOG_INFO(LOG_TAG, "SetScanEnable: %d %d", args[0], args[1]);
+  ASSERT_LOG(args.size() == 2, "%s  size=%zu", __func__, args.size());
+  LOG_INFO("SetScanEnable: %d %d", args[0], args[1]);
   link_layer_controller_.SetLeScanEnable(args[0]);
   link_layer_controller_.SetLeFilterDuplicates(args[1]);
   SendCommandCompleteSuccess(OpCode::LE_SET_SCAN_ENABLE);
 }
 
 void DualModeController::HciLeCreateConnection(packets::PacketView<true> args) {
-  CHECK(args.size() == 25) << __func__ << " size=" << args.size();
+  ASSERT_LOG(args.size() == 25, "%s  size=%zu", __func__, args.size());
   auto args_itr = args.begin();
   link_layer_controller_.SetLeScanInterval(args_itr.extract<uint16_t>());
   link_layer_controller_.SetLeScanWindow(args_itr.extract<uint16_t>());
@@ -842,7 +1002,7 @@
 }
 
 void DualModeController::HciLeConnectionUpdate(packets::PacketView<true> args) {
-  CHECK(args.size() == 14) << __func__ << " size=" << args.size();
+  ASSERT_LOG(args.size() == 14, "%s  size=%zu", __func__, args.size());
 
   SendCommandStatus(hci::Status::CONNECTION_REJECTED_UNACCEPTABLE_BD_ADDR, OpCode::LE_CONNECTION_UPDATE);
 
@@ -852,7 +1012,7 @@
 }
 
 void DualModeController::HciCreateConnection(packets::PacketView<true> args) {
-  CHECK(args.size() == 13) << __func__ << " size=" << args.size();
+  ASSERT_LOG(args.size() == 13, "%s  size=%zu", __func__, args.size());
 
   auto args_itr = args.begin();
   Address address = args_itr.extract<Address>();
@@ -868,7 +1028,7 @@
 }
 
 void DualModeController::HciDisconnect(packets::PacketView<true> args) {
-  CHECK(args.size() == 3) << __func__ << " size=" << args.size();
+  ASSERT_LOG(args.size() == 3, "%s  size=%zu", __func__, args.size());
 
   auto args_itr = args.begin();
   uint16_t handle = args_itr.extract<uint16_t>();
@@ -880,7 +1040,7 @@
 }
 
 void DualModeController::HciLeConnectionCancel(packets::PacketView<true> args) {
-  CHECK(args.size() == 0) << __func__ << " size=" << args.size();
+  ASSERT_LOG(args.size() == 0, "%s  size=%zu", __func__, args.size());
   link_layer_controller_.SetLeConnect(false);
   SendCommandStatusSuccess(OpCode::LE_CREATE_CONNECTION_CANCEL);
   /* For testing Jakub's patch:  Figure out a neat way to call this without
@@ -892,7 +1052,7 @@
 }
 
 void DualModeController::HciLeReadWhiteListSize(packets::PacketView<true> args) {
-  CHECK(args.size() == 0) << __func__ << " size=" << args.size();
+  ASSERT_LOG(args.size() == 0, "%s  size=%zu", __func__, args.size());
   std::shared_ptr<packets::EventPacketBuilder> command_complete =
       packets::EventPacketBuilder::CreateCommandCompleteLeReadWhiteListSize(hci::Status::SUCCESS,
                                                                             properties_.GetLeWhiteListSize());
@@ -900,13 +1060,13 @@
 }
 
 void DualModeController::HciLeClearWhiteList(packets::PacketView<true> args) {
-  CHECK(args.size() == 0) << __func__ << " size=" << args.size();
+  ASSERT_LOG(args.size() == 0, "%s  size=%zu", __func__, args.size());
   link_layer_controller_.LeWhiteListClear();
   SendCommandCompleteSuccess(OpCode::LE_CLEAR_WHITE_LIST);
 }
 
 void DualModeController::HciLeAddDeviceToWhiteList(packets::PacketView<true> args) {
-  CHECK(args.size() == 7) << __func__ << " size=" << args.size();
+  ASSERT_LOG(args.size() == 7, "%s  size=%zu", __func__, args.size());
 
   if (link_layer_controller_.LeWhiteListFull()) {
     SendCommandCompleteOnlyStatus(OpCode::LE_ADD_DEVICE_TO_WHITE_LIST, hci::Status::MEMORY_CAPACITY_EXCEEDED);
@@ -920,7 +1080,7 @@
 }
 
 void DualModeController::HciLeRemoveDeviceFromWhiteList(packets::PacketView<true> args) {
-  CHECK(args.size() == 7) << __func__ << " size=" << args.size();
+  ASSERT_LOG(args.size() == 7, "%s  size=%zu", __func__, args.size());
 
   auto args_itr = args.begin();
   uint8_t addr_type = args_itr.extract<uint8_t>();
@@ -929,6 +1089,70 @@
   SendCommandCompleteSuccess(OpCode::LE_REMOVE_DEVICE_FROM_WHITE_LIST);
 }
 
+void DualModeController::HciLeClearResolvingList(
+    packets::PacketView<true> args) {
+  ASSERT_LOG(args.size() == 0, "%s  size=%zu", __func__, args.size());
+  link_layer_controller_.LeResolvingListClear();
+  SendCommandCompleteSuccess(OpCode::LE_CLEAR_RESOLVING_LIST);
+}
+
+void DualModeController::HciLeAddDeviceToResolvingList(
+    packets::PacketView<true> args) {
+  ASSERT_LOG(args.size() == 39, "%s  size=%zu", __func__, args.size());
+
+  if (link_layer_controller_.LeResolvingListFull()) {
+    SendCommandCompleteOnlyStatus(OpCode::LE_ADD_DEVICE_TO_RESOLVING_LIST,
+                                  hci::Status::MEMORY_CAPACITY_EXCEEDED);
+    return;
+  }
+  auto args_itr = args.begin();
+  uint8_t addr_type = args_itr.extract<uint8_t>();
+  Address address = args_itr.extract<Address>();
+  std::array<uint8_t, LinkLayerController::kIrk_size> peerIrk;
+  std::array<uint8_t, LinkLayerController::kIrk_size> localIrk;
+  for (size_t irk_ind = 0; irk_ind < LinkLayerController::kIrk_size;
+       irk_ind++) {
+    peerIrk[irk_ind] = args_itr.extract<uint8_t>();
+  }
+
+  for (size_t irk_ind = 0; irk_ind < LinkLayerController::kIrk_size;
+       irk_ind++) {
+    localIrk[irk_ind] = args_itr.extract<uint8_t>();
+  }
+
+  link_layer_controller_.LeResolvingListAddDevice(address, addr_type, peerIrk,
+                                                  localIrk);
+  SendCommandCompleteSuccess(OpCode::LE_ADD_DEVICE_TO_RESOLVING_LIST);
+}
+
+void DualModeController::HciLeRemoveDeviceFromResolvingList(
+    packets::PacketView<true> args) {
+  ASSERT_LOG(args.size() == 7, "%s  size=%zu", __func__, args.size());
+
+  auto args_itr = args.begin();
+  uint8_t addr_type = args_itr.extract<uint8_t>();
+  Address address = args_itr.extract<Address>();
+  link_layer_controller_.LeResolvingListRemoveDevice(address, addr_type);
+  SendCommandCompleteSuccess(OpCode::LE_REMOVE_DEVICE_FROM_RESOLVING_LIST);
+}
+
+void DualModeController::HciLeSetPrivacyMode(packets::PacketView<true> args) {
+  ASSERT_LOG(args.size() == 8, "%s  size=%zu", __func__, args.size());
+
+  auto args_itr = args.begin();
+  uint8_t peer_identity_address_type = args_itr.extract<uint8_t>();
+  Address peer_identity_address = args_itr.extract<Address>();
+  uint8_t privacy_mode = args_itr.extract<uint8_t>();
+
+  if (link_layer_controller_.LeResolvingListContainsDevice(
+          peer_identity_address, peer_identity_address_type)) {
+    link_layer_controller_.LeSetPrivacyMode(
+        peer_identity_address_type, peer_identity_address, privacy_mode);
+  }
+
+  SendCommandCompleteSuccess(OpCode::LE_SET_PRIVACY_MODE);
+}
+
 /*
 void DualModeController::HciLeReadRemoteUsedFeaturesRsp(uint16_t handle,
                                                         uint64_t features) {
@@ -940,7 +1164,7 @@
 */
 
 void DualModeController::HciLeReadRemoteFeatures(packets::PacketView<true> args) {
-  CHECK(args.size() == 2) << __func__ << " size=" << args.size();
+  ASSERT_LOG(args.size() == 2, "%s  size=%zu", __func__, args.size());
 
   uint16_t handle = args.begin().extract<uint16_t>();
 
@@ -951,7 +1175,7 @@
 }
 
 void DualModeController::HciLeRand(packets::PacketView<true> args) {
-  CHECK(args.size() == 0) << __func__ << " size=" << args.size();
+  ASSERT_LOG(args.size() == 0, "%s  size=%zu", __func__, args.size());
   uint64_t random_val = 0;
   for (size_t rand_bytes = 0; rand_bytes < sizeof(uint64_t); rand_bytes += sizeof(RAND_MAX)) {
     random_val = (random_val << (8 * sizeof(RAND_MAX))) | random();
@@ -962,7 +1186,7 @@
 }
 
 void DualModeController::HciLeReadSupportedStates(packets::PacketView<true> args) {
-  CHECK(args.size() == 0) << __func__ << " size=" << args.size();
+  ASSERT_LOG(args.size() == 0, "%s  size=%zu", __func__, args.size());
   std::shared_ptr<packets::EventPacketBuilder> command_complete =
       packets::EventPacketBuilder::CreateCommandCompleteLeReadSupportedStates(hci::Status::SUCCESS,
                                                                               properties_.GetLeSupportedStates());
@@ -970,7 +1194,7 @@
 }
 
 void DualModeController::HciLeVendorCap(packets::PacketView<true> args) {
-  CHECK(args.size() == 0) << __func__ << " size=" << args.size();
+  ASSERT_LOG(args.size() == 0, "%s  size=%zu", __func__, args.size());
   vector<uint8_t> caps = properties_.GetLeVendorCap();
   if (caps.size() == 0) {
     SendCommandCompleteOnlyStatus(OpCode::LE_GET_VENDOR_CAPABILITIES, hci::Status::UNKNOWN_COMMAND);
@@ -984,27 +1208,27 @@
 }
 
 void DualModeController::HciLeVendorMultiAdv(packets::PacketView<true> args) {
-  CHECK(args.size() > 0);
+  ASSERT(args.size() > 0);
   SendCommandCompleteOnlyStatus(OpCode::LE_MULTI_ADVT, hci::Status::UNKNOWN_COMMAND);
 }
 
 void DualModeController::HciLeAdvertisingFilter(packets::PacketView<true> args) {
-  CHECK(args.size() > 0);
+  ASSERT(args.size() > 0);
   SendCommandCompleteOnlyStatus(OpCode::LE_ADV_FILTER, hci::Status::UNKNOWN_COMMAND);
 }
 
 void DualModeController::HciLeEnergyInfo(packets::PacketView<true> args) {
-  CHECK(args.size() > 0);
+  ASSERT(args.size() > 0);
   SendCommandCompleteOnlyStatus(OpCode::LE_ENERGY_INFO, hci::Status::UNKNOWN_COMMAND);
 }
 
 void DualModeController::HciLeExtendedScanParams(packets::PacketView<true> args) {
-  CHECK(args.size() > 0);
+  ASSERT(args.size() > 0);
   SendCommandCompleteOnlyStatus(OpCode::LE_EXTENDED_SCAN_PARAMS, hci::Status::UNKNOWN_COMMAND);
 }
 
 void DualModeController::HciLeStartEncryption(packets::PacketView<true> args) {
-  CHECK(args.size() == 28) << __func__ << " size=" << args.size();
+  ASSERT_LOG(args.size() == 28, "%s  size=%zu", __func__, args.size());
 
   auto args_itr = args.begin();
   uint16_t handle = args_itr.extract<uint16_t>();
@@ -1072,13 +1296,13 @@
 }
 
 void DualModeController::HciReadLoopbackMode(packets::PacketView<true> args) {
-  CHECK(args.size() == 0) << __func__ << " size=" << args.size();
+  ASSERT_LOG(args.size() == 0, "%s size=%zu", __func__, args.size());
   send_event_(packets::EventPacketBuilder::CreateCommandCompleteReadLoopbackMode(hci::Status::SUCCESS, loopback_mode_)
                   ->ToVector());
 }
 
 void DualModeController::HciWriteLoopbackMode(packets::PacketView<true> args) {
-  CHECK(args.size() == 1) << __func__ << " size=" << args.size();
+  ASSERT_LOG(args.size() == 1, "%s size=%zu", __func__, args.size());
   loopback_mode_ = static_cast<hci::LoopbackMode>(args[0]);
   // ACL channel
   uint16_t acl_handle = 0x123;
diff --git a/vendor_libs/test_vendor_lib/model/controller/dual_mode_controller.h b/vendor_libs/test_vendor_lib/model/controller/dual_mode_controller.h
index f33bbb8..cd3dcfc 100644
--- a/vendor_libs/test_vendor_lib/model/controller/dual_mode_controller.h
+++ b/vendor_libs/test_vendor_lib/model/controller/dual_mode_controller.h
@@ -64,9 +64,6 @@
 
   virtual void TimerTick() override;
 
-  // Send packets to remote devices
-  void SendLinkLayerPacket(std::shared_ptr<packets::LinkLayerPacketBuilder> to_send, Phy::Type phy_type);
-
   // Route commands and data from the stack.
   void HandleAcl(std::shared_ptr<std::vector<uint8_t>> acl_packet);
   void HandleCommand(std::shared_ptr<std::vector<uint8_t>> command_packet);
@@ -127,9 +124,18 @@
   // 7.1.16
   void HciSetConnectionEncryption(packets::PacketView<true> args);
 
+  // 7.1.17
+  void HciChangeConnectionLinkKey(packets::PacketView<true> args);
+
+  // 7.1.18
+  void HciMasterLinkKey(packets::PacketView<true> args);
+
   // 7.1.19
   void HciRemoteNameRequest(packets::PacketView<true> args);
 
+  // 7.2.8
+  void HciSwitchRole(packets::PacketView<true> args);
+
   // 7.1.21
   void HciReadRemoteSupportedFeatures(packets::PacketView<true> args);
 
@@ -169,12 +175,27 @@
   // Link Policy Commands
   // Bluetooth Core Specification Version 4.2 Volume 2 Part E 7.2
 
+  // 7.2.1
+  void HciHoldMode(packets::PacketView<true> args);
+
+  // 7.2.2
+  void HciSniffMode(packets::PacketView<true> args);
+
+  // 7.2.3
+  void HciExitSniffMode(packets::PacketView<true> args);
+
+  // 7.2.6
+  void HciQosSetup(packets::PacketView<true> args);
+
   // 7.2.10
   void HciWriteLinkPolicySettings(packets::PacketView<true> args);
 
   // 7.2.12
   void HciWriteDefaultLinkPolicySettings(packets::PacketView<true> args);
 
+  // 7.2.13
+  void HciFlowSpecification(packets::PacketView<true> args);
+
   // 7.2.14
   void HciSniffSubrating(packets::PacketView<true> args);
 
@@ -241,12 +262,18 @@
   // 7.3.56
   void HciWriteExtendedInquiryResponse(packets::PacketView<true> args);
 
+  // 7.3.57
+  void HciRefreshEncryptionKey(packets::PacketView<true> args);
+
   // 7.3.59
   void HciWriteSimplePairingMode(packets::PacketView<true> args);
 
   // 7.3.79
   void HciWriteLeHostSupport(packets::PacketView<true> args);
 
+  // 7.3.92
+  void HciWriteSecureConnectionHostSupport(packets::PacketView<true> args);
+
   // Informational Parameters Commands
   // Bluetooth Core Specification Version 4.2 Volume 2 Part E 7.4
 
@@ -262,6 +289,9 @@
   // 7.4.2
   void HciReadLocalSupportedCommands(packets::PacketView<true> args);
 
+  // 7.4.3
+  void HciReadLocalSupportedFeatures(packets::PacketView<true> args);
+
   // 7.4.4
   void HciReadLocalExtendedFeatures(packets::PacketView<true> args);
 
@@ -271,6 +301,9 @@
   // Status Parameters Commands
   // Bluetooth Core Specification Version 4.2 Volume 2 Part E 7.5
 
+  // 7.5.7
+  void HciReadEncryptionKeySize(packets::PacketView<true> args);
+
   // Test Commands
   // Bluetooth Core Specification Version 4.2 Volume 2 Part E 7.7
 
@@ -301,6 +334,12 @@
   // 7.8.7
   void HciLeSetAdvertisingData(packets::PacketView<true> args);
 
+  // 7.8.8
+  void HciLeSetScanResponseData(packets::PacketView<true> args);
+
+  // 7.8.9
+  void HciLeSetAdvertisingEnable(packets::PacketView<true> args);
+
   // 7.8.10
   void HciLeSetScanParameters(packets::PacketView<true> args);
 
@@ -340,6 +379,18 @@
   // 7.8.27
   void HciLeReadSupportedStates(packets::PacketView<true> args);
 
+  // 7.8.38
+  void HciLeAddDeviceToResolvingList(packets::PacketView<true> args);
+
+  // 7.8.39
+  void HciLeRemoveDeviceFromResolvingList(packets::PacketView<true> args);
+
+  // 7.8.40
+  void HciLeClearResolvingList(packets::PacketView<true> args);
+
+  // 7.8.77
+  void HciLeSetPrivacyMode(packets::PacketView<true> args);
+
   // Vendor-specific Commands
 
   void HciLeVendorSleepMode(packets::PacketView<true> args);
diff --git a/vendor_libs/test_vendor_lib/model/controller/link_layer_controller.cc b/vendor_libs/test_vendor_lib/model/controller/link_layer_controller.cc
index 03a494c..93b06dd 100644
--- a/vendor_libs/test_vendor_lib/model/controller/link_layer_controller.cc
+++ b/vendor_libs/test_vendor_lib/model/controller/link_layer_controller.cc
@@ -14,14 +14,10 @@
  * limitations under the License.
  */
 
-#define LOG_TAG "link_layer_controller"
-
 #include "link_layer_controller.h"
 
-#include <base/logging.h>
-
 #include "hci.h"
-#include "osi/include/log.h"
+#include "os/log.h"
 #include "packets/hci/acl_packet_builder.h"
 #include "packets/hci/command_packet_view.h"
 #include "packets/hci/event_packet_builder.h"
@@ -34,6 +30,9 @@
 #include "packets/link_layer/inquiry_view.h"
 #include "packets/link_layer/io_capability_view.h"
 #include "packets/link_layer/le_advertisement_view.h"
+#include "packets/link_layer/le_connect_complete_view.h"
+#include "packets/link_layer/le_connect_view.h"
+#include "packets/link_layer/page_reject_view.h"
 #include "packets/link_layer/page_response_view.h"
 #include "packets/link_layer/page_view.h"
 #include "packets/link_layer/response_view.h"
@@ -54,20 +53,12 @@
   return -(rssi);
 }
 
-void LinkLayerController::SendLELinkLayerPacket(std::shared_ptr<LinkLayerPacketBuilder> packet) {
-  if (schedule_task_) {
-    schedule_task_(milliseconds(50), [this, packet]() { send_to_remote_(packet, Phy::Type::LOW_ENERGY); });
-  } else {
-    send_to_remote_(packet, Phy::Type::LOW_ENERGY);
-  }
+void LinkLayerController::SendLeLinkLayerPacket(std::shared_ptr<LinkLayerPacketBuilder> packet) {
+  ScheduleTask(milliseconds(50), [this, packet]() { send_to_remote_(packet, Phy::Type::LOW_ENERGY); });
 }
 
 void LinkLayerController::SendLinkLayerPacket(std::shared_ptr<LinkLayerPacketBuilder> packet) {
-  if (schedule_task_) {
-    schedule_task_(milliseconds(50), [this, packet]() { send_to_remote_(packet, Phy::Type::BR_EDR); });
-  } else {
-    send_to_remote_(packet, Phy::Type::BR_EDR);
-  }
+  ScheduleTask(milliseconds(50), [this, packet]() { send_to_remote_(packet, Phy::Type::BR_EDR); });
 }
 
 hci::Status LinkLayerController::SendCommandToRemoteByAddress(hci::OpCode opcode, PacketView<true> args,
@@ -89,28 +80,32 @@
                                                              uint16_t handle) {
   // TODO: Handle LE connections
   bool use_public_address = true;
-  if (!classic_connections_.HasHandle(handle)) {
+  if (!connections_.HasHandle(handle)) {
     return hci::Status::UNKNOWN_CONNECTION;
   }
-  return SendCommandToRemoteByAddress(opcode, args, classic_connections_.GetAddress(handle), use_public_address);
+  return SendCommandToRemoteByAddress(opcode, args, connections_.GetAddress(handle), use_public_address);
 }
 
 hci::Status LinkLayerController::SendAclToRemote(AclPacketView acl_packet) {
-  // TODO: Handle LE connections
   uint16_t handle = acl_packet.GetHandle();
-  if (!classic_connections_.HasHandle(handle)) {
+  if (!connections_.HasHandle(handle)) {
     return hci::Status::UNKNOWN_CONNECTION;
   }
 
   std::unique_ptr<ViewForwarderBuilder> acl_builder = ViewForwarderBuilder::Create(acl_packet);
 
-  std::shared_ptr<LinkLayerPacketBuilder> acl = LinkLayerPacketBuilder::WrapAcl(
-      std::move(acl_builder), properties_.GetAddress(), classic_connections_.GetAddress(handle));
+  Address my_address = properties_.GetAddress();
+  Address destination = connections_.GetAddress(handle);
+  if (connections_.GetOwnAddressType(handle) != 0) {  // If it's not public, it must be LE
+    my_address = properties_.GetLeAddress();
+  }
+  std::shared_ptr<LinkLayerPacketBuilder> acl =
+      LinkLayerPacketBuilder::WrapAcl(std::move(acl_builder), my_address, destination);
 
-  LOG_INFO(LOG_TAG, "%s(%s): handle 0x%x size %d", __func__, properties_.GetAddress().ToString().c_str(), handle,
+  LOG_INFO("%s(%s): handle 0x%x size %d", __func__, properties_.GetAddress().ToString().c_str(), handle,
            static_cast<int>(acl_packet.size()));
 
-  schedule_task_(milliseconds(5), [this, handle]() {
+  ScheduleTask(milliseconds(5), [this, handle]() {
     send_event_(EventPacketBuilder::CreateNumberOfCompletedPacketsEvent(handle, 1)->ToVector());
   });
   SendLinkLayerPacket(acl);
@@ -164,6 +159,12 @@
         IncomingLeAdvertisementPacket(incoming);
       }
       break;
+    case Link::PacketType::LE_CONNECT:
+      IncomingLeConnectPacket(incoming);
+      break;
+    case Link::PacketType::LE_CONNECT_COMPLETE:
+      IncomingLeConnectCompletePacket(incoming);
+      break;
     case Link::PacketType::LE_SCAN:
       // TODO: Check Advertising flags and see if we are scannable.
       IncomingLeScanPacket(incoming);
@@ -178,6 +179,9 @@
         IncomingPagePacket(incoming);
       }
       break;
+    case Link::PacketType::PAGE_REJECT:
+      IncomingPageRejectPacket(incoming);
+      break;
     case Link::PacketType::PAGE_RESPONSE:
       IncomingPageResponsePacket(incoming);
       break;
@@ -185,25 +189,22 @@
       IncomingResponsePacket(incoming);
       break;
     default:
-      LOG_WARN(LOG_TAG, "Dropping unhandled packet of type %d", static_cast<int32_t>(incoming.GetType()));
+      LOG_WARN("Dropping unhandled packet of type %d", static_cast<int32_t>(incoming.GetType()));
   }
 }
 
 void LinkLayerController::IncomingAclPacket(LinkLayerPacketView incoming) {
-  LOG_INFO(LOG_TAG, "Acl Packet %s -> %s", incoming.GetSourceAddress().ToString().c_str(),
+  LOG_INFO("Acl Packet %s -> %s", incoming.GetSourceAddress().ToString().c_str(),
            incoming.GetDestinationAddress().ToString().c_str());
   AclPacketView acl_view = AclPacketView::Create(incoming.GetPayload());
-  LOG_INFO(LOG_TAG, "%s: remote handle 0x%x size %d", __func__, acl_view.GetHandle(),
-           static_cast<int>(acl_view.size()));
-  uint16_t local_handle = classic_connections_.GetHandle(incoming.GetSourceAddress());
-  LOG_INFO(LOG_TAG, "%s: local handle 0x%x", __func__, local_handle);
+  LOG_INFO("%s: remote handle 0x%x size %d", __func__, acl_view.GetHandle(), static_cast<int>(acl_view.size()));
+  uint16_t local_handle = connections_.GetHandle(incoming.GetSourceAddress());
+  LOG_INFO("%s: local handle 0x%x", __func__, local_handle);
 
   acl::PacketBoundaryFlagsType boundary_flags = acl_view.GetPacketBoundaryFlags();
   acl::BroadcastFlagsType broadcast_flags = acl_view.GetBroadcastFlags();
   std::unique_ptr<ViewForwarderBuilder> builder = ViewForwarderBuilder::Create(acl_view.GetPayload());
-  std::unique_ptr<AclPacketBuilder> local_acl =
-      AclPacketBuilder::Create(local_handle, boundary_flags, broadcast_flags, std::move(builder));
-  send_acl_(local_acl->ToVector());
+  send_acl_(AclPacketBuilder::Create(local_handle, boundary_flags, broadcast_flags, std::move(builder))->ToVector());
 }
 
 void LinkLayerController::IncomingCommandPacket(LinkLayerPacketView incoming) {
@@ -216,7 +217,7 @@
   switch (opcode) {
     case (hci::OpCode::REMOTE_NAME_REQUEST): {
       std::vector<uint8_t> name = properties_.GetName();
-      LOG_INFO(LOG_TAG, "Remote Name (Local Name) %d", static_cast<int>(name.size()));
+      LOG_INFO("Remote Name (Local Name) %d", static_cast<int>(name.size()));
       response_data.push_back(static_cast<uint8_t>(hci::Status::SUCCESS));
       response_data.push_back(name.size());
       uint64_t word = 0;
@@ -230,7 +231,7 @@
       response_data.push_back(word);
     } break;
     case (hci::OpCode::READ_REMOTE_SUPPORTED_FEATURES):
-      LOG_INFO(LOG_TAG, "(%s) Remote Supported Features Requested by: %s %x",
+      LOG_INFO("(%s) Remote Supported Features Requested by: %s %x",
                incoming.GetDestinationAddress().ToString().c_str(), incoming.GetSourceAddress().ToString().c_str(),
                static_cast<int>(properties_.GetSupportedFeatures()));
       response_data.push_back(static_cast<uint8_t>(hci::Status::SUCCESS));
@@ -238,9 +239,8 @@
       break;
     case (hci::OpCode::READ_REMOTE_EXTENDED_FEATURES): {
       uint8_t page_number = (args + 2).extract<uint8_t>();  // skip the handle
-      LOG_INFO(LOG_TAG, "(%s) Remote Extended Features %d Requested by: %s",
-               incoming.GetDestinationAddress().ToString().c_str(), page_number,
-               incoming.GetSourceAddress().ToString().c_str());
+      LOG_INFO("(%s) Remote Extended Features %d Requested by: %s", incoming.GetDestinationAddress().ToString().c_str(),
+               page_number, incoming.GetSourceAddress().ToString().c_str());
       uint8_t max_page_number = properties_.GetExtendedFeaturesMaximumPageNumber();
       if (page_number > max_page_number) {
         response_data.push_back(static_cast<uint8_t>(hci::Status::INVALID_HCI_COMMAND_PARAMETERS));
@@ -265,7 +265,7 @@
       response_data.push_back(properties_.GetClockOffset());
       break;
     default:
-      LOG_INFO(LOG_TAG, "Dropping unhandled command 0x%04x", static_cast<uint16_t>(opcode));
+      LOG_INFO("Dropping unhandled command 0x%04x", static_cast<uint16_t>(opcode));
       return;
   }
   SendLinkLayerPacket(
@@ -274,27 +274,27 @@
 }
 
 void LinkLayerController::IncomingDisconnectPacket(LinkLayerPacketView incoming) {
-  LOG_INFO(LOG_TAG, "Disconnect Packet");
+  LOG_INFO("Disconnect Packet");
   DisconnectView disconnect = DisconnectView::GetDisconnect(incoming);
   Address peer = incoming.GetSourceAddress();
-  uint16_t handle = classic_connections_.GetHandle(peer);
+  uint16_t handle = connections_.GetHandle(peer);
   if (handle == acl::kReservedHandle) {
-    LOG_INFO(LOG_TAG, "%s: Unknown connection @%s", __func__, peer.ToString().c_str());
+    LOG_INFO("%s: Unknown connection @%s", __func__, peer.ToString().c_str());
     return;
   }
-  CHECK(classic_connections_.Disconnect(handle)) << "GetHandle() returned invalid handle " << handle;
+  ASSERT_LOG(connections_.Disconnect(handle), "GetHandle() returned invalid handle %hx", handle);
 
   uint8_t reason = disconnect.GetReason();
-  schedule_task_(milliseconds(20), [this, handle, reason]() { DisconnectCleanup(handle, reason); });
+  ScheduleTask(milliseconds(20), [this, handle, reason]() { DisconnectCleanup(handle, reason); });
 }
 
 void LinkLayerController::IncomingEncryptConnection(LinkLayerPacketView incoming) {
-  LOG_INFO(LOG_TAG, "%s", __func__);
+  LOG_INFO("%s", __func__);
   // TODO: Check keys
   Address peer = incoming.GetSourceAddress();
-  uint16_t handle = classic_connections_.GetHandle(peer);
+  uint16_t handle = connections_.GetHandle(peer);
   if (handle == acl::kReservedHandle) {
-    LOG_INFO(LOG_TAG, "%s: Unknown connection @%s", __func__, peer.ToString().c_str());
+    LOG_INFO("%s: Unknown connection @%s", __func__, peer.ToString().c_str());
     return;
   }
   send_event_(EventPacketBuilder::CreateEncryptionChange(hci::Status::SUCCESS, handle, 1)->ToVector());
@@ -303,11 +303,11 @@
 }
 
 void LinkLayerController::IncomingEncryptConnectionResponse(LinkLayerPacketView incoming) {
-  LOG_INFO(LOG_TAG, "%s", __func__);
+  LOG_INFO("%s", __func__);
   // TODO: Check keys
-  uint16_t handle = classic_connections_.GetHandle(incoming.GetSourceAddress());
+  uint16_t handle = connections_.GetHandle(incoming.GetSourceAddress());
   if (handle == acl::kReservedHandle) {
-    LOG_INFO(LOG_TAG, "%s: Unknown connection @%s", __func__, incoming.GetSourceAddress().ToString().c_str());
+    LOG_INFO("%s: Unknown connection @%s", __func__, incoming.GetSourceAddress().ToString().c_str());
     return;
   }
   send_event_(EventPacketBuilder::CreateEncryptionChange(hci::Status::SUCCESS, handle, 1)->ToVector());
@@ -334,7 +334,7 @@
           GetRssi(), properties_.GetExtendedInquiryData());
       break;
     default:
-      LOG_WARN(LOG_TAG, "Unhandled Incoming Inquiry of type %d", static_cast<int>(inquiry.GetType()));
+      LOG_WARN("Unhandled Incoming Inquiry of type %d", static_cast<int>(inquiry.GetType()));
       return;
   }
   SendLinkLayerPacket(LinkLayerPacketBuilder::WrapInquiryResponse(std::move(inquiry_response), properties_.GetAddress(),
@@ -348,18 +348,18 @@
 
   switch (inquiry_response.GetType()) {
     case (Inquiry::InquiryType::STANDARD): {
-      LOG_WARN(LOG_TAG, "Incoming Standard Inquiry Response");
+      LOG_WARN("Incoming Standard Inquiry Response");
       // TODO: Support multiple inquiries in the same packet.
       std::unique_ptr<EventPacketBuilder> inquiry_result = EventPacketBuilder::CreateInquiryResultEvent();
       bool result_added =
           inquiry_result->AddInquiryResult(incoming.GetSourceAddress(), inquiry_response.GetPageScanRepetitionMode(),
                                            inquiry_response.GetClassOfDevice(), inquiry_response.GetClockOffset());
-      CHECK(result_added);
+      ASSERT(result_added);
       send_event_(inquiry_result->ToVector());
     } break;
 
     case (Inquiry::InquiryType::RSSI):
-      LOG_WARN(LOG_TAG, "Incoming RSSI Inquiry Response");
+      LOG_WARN("Incoming RSSI Inquiry Response");
       send_event_(EventPacketBuilder::CreateExtendedInquiryResultEvent(
                       incoming.GetSourceAddress(), inquiry_response.GetPageScanRepetitionMode(),
                       inquiry_response.GetClassOfDevice(), inquiry_response.GetClockOffset(), GetRssi(), eir)
@@ -367,10 +367,10 @@
       break;
 
     case (Inquiry::InquiryType::EXTENDED): {
-      LOG_WARN(LOG_TAG, "Incoming Extended Inquiry Response");
+      LOG_WARN("Incoming Extended Inquiry Response");
       auto eir_itr = inquiry_response.GetExtendedData();
       size_t eir_bytes = eir_itr.NumBytesRemaining();
-      LOG_WARN(LOG_TAG, "Payload size = %d", static_cast<int>(eir_bytes));
+      LOG_WARN("Payload size = %d", static_cast<int>(eir_bytes));
       for (size_t i = 0; i < eir_bytes; i++) {
         eir.push_back(eir_itr.extract<uint8_t>());
       }
@@ -380,14 +380,14 @@
                       ->ToVector());
     } break;
     default:
-      LOG_WARN(LOG_TAG, "Unhandled Incoming Inquiry Response of type %d", static_cast<int>(inquiry_response.GetType()));
+      LOG_WARN("Unhandled Incoming Inquiry Response of type %d", static_cast<int>(inquiry_response.GetType()));
   }
 }
 
 void LinkLayerController::IncomingIoCapabilityRequestPacket(LinkLayerPacketView incoming) {
-  LOG_DEBUG(LOG_TAG, "%s", __func__);
+  LOG_DEBUG("%s", __func__);
   if (!simple_pairing_mode_enabled_) {
-    LOG_WARN(LOG_TAG, "%s: Only simple pairing mode is implemented", __func__);
+    LOG_WARN("%s: Only simple pairing mode is implemented", __func__);
     return;
   }
   auto request = IoCapabilityView::GetIoCapability(incoming);
@@ -397,9 +397,9 @@
   uint8_t oob_data_present = request.GetOobDataPresent();
   uint8_t authentication_requirements = request.GetAuthenticationRequirements();
 
-  uint16_t handle = classic_connections_.GetHandle(peer);
+  uint16_t handle = connections_.GetHandle(peer);
   if (handle == acl::kReservedHandle) {
-    LOG_INFO(LOG_TAG, "%s: Device not connected %s", __func__, peer.ToString().c_str());
+    LOG_INFO("%s: Device not connected %s", __func__, peer.ToString().c_str());
     return;
   }
 
@@ -415,7 +415,7 @@
 }
 
 void LinkLayerController::IncomingIoCapabilityResponsePacket(LinkLayerPacketView incoming) {
-  LOG_DEBUG(LOG_TAG, "%s", __func__);
+  LOG_DEBUG("%s", __func__);
   auto response = IoCapabilityView::GetIoCapability(incoming);
   Address peer = incoming.GetSourceAddress();
   uint8_t io_capability = response.GetIoCapability();
@@ -430,115 +430,131 @@
 
   PairingType pairing_type = security_manager_.GetSimplePairingType();
   if (pairing_type != PairingType::INVALID) {
-    schedule_task_(milliseconds(5), [this, peer, pairing_type]() { AuthenticateRemoteStage1(peer, pairing_type); });
+    ScheduleTask(milliseconds(5), [this, peer, pairing_type]() { AuthenticateRemoteStage1(peer, pairing_type); });
   } else {
-    LOG_INFO(LOG_TAG, "%s: Security Manager returned INVALID", __func__);
+    LOG_INFO("%s: Security Manager returned INVALID", __func__);
   }
 }
 
 void LinkLayerController::IncomingIoCapabilityNegativeResponsePacket(LinkLayerPacketView incoming) {
-  LOG_DEBUG(LOG_TAG, "%s", __func__);
+  LOG_DEBUG("%s", __func__);
   Address peer = incoming.GetSourceAddress();
 
-  CHECK(security_manager_.GetAuthenticationAddress() == peer);
+  ASSERT(security_manager_.GetAuthenticationAddress() == peer);
 
   security_manager_.InvalidateIoCapabilities();
 }
 
 void LinkLayerController::IncomingLeAdvertisementPacket(LinkLayerPacketView incoming) {
-  LOG_INFO(LOG_TAG, "LE Advertisement Packet");
   // TODO: Handle multiple advertisements per packet.
 
+  Address address = incoming.GetSourceAddress();
   LeAdvertisementView advertisement = LeAdvertisementView::GetLeAdvertisementView(incoming);
   LeAdvertisement::AdvertisementType adv_type = advertisement.GetAdvertisementType();
-  LeAdvertisement::AddressType addr_type = advertisement.GetAddressType();
+  LeAdvertisement::AddressType address_type = advertisement.GetAddressType();
 
   if (le_scan_enable_) {
     vector<uint8_t> ad;
     auto itr = advertisement.GetData();
     size_t ad_size = itr.NumBytesRemaining();
-    LOG_INFO(LOG_TAG, "Sending advertisement %d", static_cast<int>(ad_size));
     for (size_t i = 0; i < ad_size; i++) {
       ad.push_back(itr.extract<uint8_t>());
     }
     std::unique_ptr<EventPacketBuilder> le_adverts = EventPacketBuilder::CreateLeAdvertisingReportEvent();
 
-    if (!le_adverts->AddLeAdvertisingReport(adv_type, addr_type, incoming.GetSourceAddress(), ad, GetRssi())) {
-      LOG_INFO(LOG_TAG, "Couldn't add the advertising report.");
+    if (!le_adverts->AddLeAdvertisingReport(adv_type, address_type, address, ad, GetRssi())) {
+      LOG_INFO("Couldn't add the advertising report.");
     } else {
       send_event_(le_adverts->ToVector());
     }
   }
 
-#if 0
-      // Connect
-      if (le_connect_ && (adv_type == BTM_BLE_CONNECT_EVT ||
-                          adv_type == BTM_BLE_CONNECT_DIR_EVT)) {
-        LOG_INFO(LOG_TAG, "Connecting to device %d", static_cast<int>(dev));
-        if (le_peer_address_ == addr && le_peer_address_type_ == addr_type &&
-            remote_devices_[dev]->LeConnect()) {
-          uint16_t handle = LeGetHandle();
-          send_event_(EventPacketBuilder::CreateLeConnectionCompleteEvent(
-              hci::Status::SUCCESS, handle, HCI_ROLE_MASTER, addr_type, addr, 1,
-              2, 3)->ToVector());
-
-          // TODO: LeGetConnInterval(), LeGetConnLatency(),
-          // LeGetSupervisionTimeout()));
-          le_connect_ = false;
-
-          std::shared_ptr<Connection> new_connection =
-              std::make_shared<Connection>(remote_devices_[dev], handle);
-          /*
-          connections_.push_back(new_connection);
-
-          remote_devices_[dev]->SetConnection(new_connection);
-          */
-        }
-
-        if (LeWhiteListContainsDevice(addr, addr_type) &&
-            remote_devices_[dev]->LeConnect()) {
-          LOG_INFO(LOG_TAG, "White List Connecting to device %d",
-                   static_cast<int>(dev));
-          uint16_t handle = LeGetHandle();
-          send_event_(EventPacketBuilder::CreateLeConnectionCompleteEvent(
-              hci::Status::SUCCESS, handle, HCI_ROLE_MASTER, addr_type, addr, 1,
-              2, 3)->ToVector());
-          // TODO: LeGetConnInterval(), LeGetConnLatency(),
-          // LeGetSupervisionTimeout()));
-          le_connect_ = false;
-
-          std::shared_ptr<Connection> new_connection =
-              std::make_shared<Connection>(remote_devices_[dev], handle);
-          /*
-          connections_.push_back(new_connection);
-          remote_devices_[dev]->SetConnection(new_connection);
-          */
-        }
-      }
-#endif
-
   // Active scanning
   if (le_scan_enable_ && le_scan_type_ == 1) {
-    LOG_INFO(LOG_TAG, "Send Scan Packet");
     std::shared_ptr<LinkLayerPacketBuilder> to_send =
-        LinkLayerPacketBuilder::WrapLeScan(properties_.GetLeAddress(), incoming.GetSourceAddress());
-    SendLELinkLayerPacket(to_send);
+        LinkLayerPacketBuilder::WrapLeScan(properties_.GetLeAddress(), address);
+    SendLeLinkLayerPacket(to_send);
+  }
+
+  // Connect
+  if ((le_connect_ && le_peer_address_ == address && le_peer_address_type_ == static_cast<uint8_t>(address_type) &&
+       (adv_type == LeAdvertisement::AdvertisementType::ADV_IND ||
+        adv_type == LeAdvertisement::AdvertisementType::ADV_DIRECT_IND)) ||
+      (LeWhiteListContainsDevice(address, static_cast<uint8_t>(address_type)))) {
+    if (!connections_.CreatePendingLeConnection(incoming.GetSourceAddress(), static_cast<uint8_t>(address_type))) {
+      LOG_WARN("%s: CreatePendingLeConnection failed for connection to %s (type %hhx)", __func__,
+               incoming.GetSourceAddress().ToString().c_str(), address_type);
+    }
+    LOG_INFO("%s: connecting to %s (type %hhx)", __func__, incoming.GetSourceAddress().ToString().c_str(),
+             address_type);
+    le_connect_ = false;
+    le_scan_enable_ = false;
+
+    std::shared_ptr<LinkLayerPacketBuilder> to_send = LinkLayerPacketBuilder::WrapLeConnect(
+        LeConnectBuilder::Create(le_connection_interval_min_, le_connection_interval_max_, le_connection_latency_,
+                                 le_connection_supervision_timeout_, static_cast<uint8_t>(le_address_type_)),
+        properties_.GetLeAddress(), incoming.GetSourceAddress());
+    SendLeLinkLayerPacket(to_send);
   }
 }
 
+void LinkLayerController::HandleLeConnection(Address address, uint8_t address_type, uint8_t own_address_type,
+                                             uint8_t role, uint16_t connection_interval, uint16_t connection_latency,
+                                             uint16_t supervision_timeout) {
+  // TODO: Choose between LeConnectionComplete and LeEnhancedConnectionComplete
+  uint16_t handle = connections_.CreateLeConnection(address, address_type, own_address_type);
+  if (handle == acl::kReservedHandle) {
+    LOG_WARN("%s: No pending connection for connection from %s (type %hhx)", __func__, address.ToString().c_str(),
+             address_type);
+    return;
+  }
+  send_event_(EventPacketBuilder::CreateLeConnectionCompleteEvent(
+                  hci::Status::SUCCESS, handle, role, static_cast<uint8_t>(address_type), address, connection_interval,
+                  connection_latency, supervision_timeout)
+                  ->ToVector());
+}
+
+void LinkLayerController::IncomingLeConnectPacket(LinkLayerPacketView incoming) {
+  auto connect = LeConnectView::GetLeConnect(incoming);
+  uint16_t connection_interval = (connect.GetLeConnectionIntervalMax() + connect.GetLeConnectionIntervalMin()) / 2;
+  if (!connections_.CreatePendingLeConnection(incoming.GetSourceAddress(),
+                                              static_cast<uint8_t>(connect.GetAddressType()))) {
+    LOG_WARN("%s: CreatePendingLeConnection failed for connection from %s (type %hhx)", __func__,
+             incoming.GetSourceAddress().ToString().c_str(), connect.GetAddressType());
+    return;
+  }
+  HandleLeConnection(incoming.GetSourceAddress(), static_cast<uint8_t>(connect.GetAddressType()),
+                     static_cast<uint8_t>(properties_.GetLeAdvertisingOwnAddressType()),
+                     static_cast<uint8_t>(hci::Role::SLAVE), connection_interval, connect.GetLeConnectionLatency(),
+                     connect.GetLeConnectionSupervisionTimeout());
+  std::shared_ptr<LinkLayerPacketBuilder> to_send = LinkLayerPacketBuilder::WrapLeConnectComplete(
+      LeConnectCompleteBuilder::Create(connection_interval, connect.GetLeConnectionLatency(),
+                                       connect.GetLeConnectionSupervisionTimeout(),
+                                       properties_.GetLeAdvertisingOwnAddressType()),
+      incoming.GetDestinationAddress(), incoming.GetSourceAddress());
+  SendLeLinkLayerPacket(to_send);
+}
+
+void LinkLayerController::IncomingLeConnectCompletePacket(LinkLayerPacketView incoming) {
+  auto complete = LeConnectCompleteView::GetLeConnectComplete(incoming);
+  HandleLeConnection(incoming.GetSourceAddress(), static_cast<uint8_t>(complete.GetAddressType()),
+                     static_cast<uint8_t>(le_address_type_), static_cast<uint8_t>(hci::Role::MASTER),
+                     complete.GetLeConnectionInterval(), complete.GetLeConnectionLatency(),
+                     complete.GetLeConnectionSupervisionTimeout());
+}
+
 void LinkLayerController::IncomingLeScanPacket(LinkLayerPacketView incoming) {
-  LOG_INFO(LOG_TAG, "LE Scan Packet");
+  LOG_INFO("LE Scan Packet");
   std::unique_ptr<LeAdvertisementBuilder> response = LeAdvertisementBuilder::Create(
       static_cast<LeAdvertisement::AddressType>(properties_.GetLeAddressType()),
       static_cast<LeAdvertisement::AdvertisementType>(properties_.GetLeAdvertisementType()),
       properties_.GetLeScanResponse());
   std::shared_ptr<LinkLayerPacketBuilder> to_send = LinkLayerPacketBuilder::WrapLeScanResponse(
       std::move(response), properties_.GetLeAddress(), incoming.GetSourceAddress());
-  SendLELinkLayerPacket(to_send);
+  SendLeLinkLayerPacket(to_send);
 }
 
 void LinkLayerController::IncomingLeScanResponsePacket(LinkLayerPacketView incoming) {
-  LOG_INFO(LOG_TAG, "LE Scan Response Packet");
   LeAdvertisementView scan_response = LeAdvertisementView::GetLeAdvertisementView(incoming);
   vector<uint8_t> ad;
   auto itr = scan_response.GetData();
@@ -551,20 +567,20 @@
 
   if (!le_adverts->AddLeAdvertisingReport(scan_response.GetAdvertisementType(), scan_response.GetAddressType(),
                                           incoming.GetSourceAddress(), ad, GetRssi())) {
-    LOG_INFO(LOG_TAG, "Couldn't add the scan response.");
+    LOG_INFO("Couldn't add the scan response.");
   } else {
-    LOG_INFO(LOG_TAG, "Sending scan response");
     send_event_(le_adverts->ToVector());
   }
 }
 
 void LinkLayerController::IncomingPagePacket(LinkLayerPacketView incoming) {
   PageView page = PageView::GetPage(incoming);
-  LOG_INFO(LOG_TAG, "%s from %s", __func__, incoming.GetSourceAddress().ToString().c_str());
+  LOG_INFO("%s from %s", __func__, incoming.GetSourceAddress().ToString().c_str());
 
-  if (!classic_connections_.CreatePendingConnection(incoming.GetSourceAddress())) {
+  if (!connections_.CreatePendingConnection(incoming.GetSourceAddress())) {
     // Send a response to indicate that we're busy, or drop the packet?
-    LOG_WARN(LOG_TAG, "%s: Failed to create a pending connection", __func__);
+    LOG_WARN("%s: Failed to create a pending connection for %s", __func__,
+             incoming.GetSourceAddress().ToString().c_str());
   }
 
   send_event_(EventPacketBuilder::CreateConnectionRequestEvent(incoming.GetSourceAddress(), page.GetClassOfDevice(),
@@ -572,14 +588,22 @@
                   ->ToVector());
 }
 
+void LinkLayerController::IncomingPageRejectPacket(LinkLayerPacketView incoming) {
+  LOG_INFO("%s: %s", __func__, incoming.GetSourceAddress().ToString().c_str());
+  PageRejectView reject = PageRejectView::GetPageReject(incoming);
+  LOG_INFO("%s: Sending CreateConnectionComplete", __func__);
+  send_event_(EventPacketBuilder::CreateConnectionCompleteEvent(static_cast<hci::Status>(reject.GetReason()), 0x0eff,
+                                                                incoming.GetSourceAddress(), hci::LinkType::ACL, false)
+                  ->ToVector());
+}
+
 void LinkLayerController::IncomingPageResponsePacket(LinkLayerPacketView incoming) {
-  LOG_INFO(LOG_TAG, "%s: %s", __func__, incoming.GetSourceAddress().ToString().c_str());
-  uint16_t handle = classic_connections_.CreateConnection(incoming.GetSourceAddress());
+  LOG_INFO("%s: %s", __func__, incoming.GetSourceAddress().ToString().c_str());
+  uint16_t handle = connections_.CreateConnection(incoming.GetSourceAddress());
   if (handle == acl::kReservedHandle) {
-    LOG_WARN(LOG_TAG, "%s: No free handles", __func__);
+    LOG_WARN("%s: No free handles", __func__);
     return;
   }
-  LOG_INFO(LOG_TAG, "%s: Sending CreateConnectionComplete", __func__);
   send_event_(EventPacketBuilder::CreateConnectionCompleteEvent(hci::Status::SUCCESS, handle,
                                                                 incoming.GetSourceAddress(), hci::LinkType::ACL, false)
                   ->ToVector());
@@ -594,7 +618,7 @@
   auto args = response.GetResponseData();
   hci::Status status = static_cast<hci::Status>(args.extract<uint64_t>());
 
-  uint16_t handle = classic_connections_.GetHandle(incoming.GetSourceAddress());
+  uint16_t handle = connections_.GetHandle(incoming.GetSourceAddress());
 
   switch (opcode) {
     case (hci::OpCode::REMOTE_NAME_REQUEST): {
@@ -629,22 +653,51 @@
       send_event_(EventPacketBuilder::CreateReadRemoteVersionInformationEvent(
                       status, handle, args.extract<uint64_t>(), args.extract<uint64_t>(), args.extract<uint64_t>())
                       ->ToVector());
-      LOG_INFO(LOG_TAG, "Read remote version handle 0x%04x", handle);
+      LOG_INFO("Read remote version handle 0x%04x", handle);
     } break;
     case (hci::OpCode::READ_CLOCK_OFFSET): {
       send_event_(EventPacketBuilder::CreateReadClockOffsetEvent(status, handle, args.extract<uint64_t>())->ToVector());
     } break;
     default:
-      LOG_INFO(LOG_TAG, "Unhandled response to command 0x%04x", static_cast<uint16_t>(opcode));
+      LOG_INFO("Unhandled response to command 0x%04x", static_cast<uint16_t>(opcode));
   }
 }
 
 void LinkLayerController::TimerTick() {
   if (inquiry_state_ == Inquiry::InquiryState::INQUIRY) Inquiry();
   if (inquiry_state_ == Inquiry::InquiryState::INQUIRY) PageScan();
+  LeAdvertising();
   Connections();
 }
 
+void LinkLayerController::LeAdvertising() {
+  if (!le_advertising_enable_) {
+    return;
+  }
+  steady_clock::time_point now = steady_clock::now();
+  if (duration_cast<milliseconds>(now - last_le_advertisement_) < milliseconds(200)) {
+    return;
+  }
+  last_le_advertisement_ = now;
+
+  LeAdvertisement::AddressType own_address_type =
+      static_cast<LeAdvertisement::AddressType>(properties_.GetLeAdvertisingOwnAddressType());
+  std::shared_ptr<packets::LinkLayerPacketBuilder> to_send;
+  std::unique_ptr<packets::LeAdvertisementBuilder> ad;
+  Address advertising_address = Address::kEmpty;
+  if (own_address_type == LeAdvertisement::AddressType::PUBLIC) {
+    advertising_address = properties_.GetAddress();
+  } else if (own_address_type == LeAdvertisement::AddressType::RANDOM) {
+    advertising_address = properties_.GetLeAddress();
+  }
+  ASSERT(advertising_address != Address::kEmpty);
+  ad = packets::LeAdvertisementBuilder::Create(own_address_type,
+                                               static_cast<LeAdvertisement::AdvertisementType>(own_address_type),
+                                               properties_.GetLeAdvertisement());
+  to_send = packets::LinkLayerPacketBuilder::WrapLeAdvertisement(std::move(ad), advertising_address);
+  SendLeLinkLayerPacket(to_send);
+}
+
 void LinkLayerController::Connections() {
   // TODO: Keep connections alive?
 }
@@ -674,21 +727,36 @@
   schedule_task_ = event_scheduler;
 }
 
+AsyncTaskId LinkLayerController::ScheduleTask(milliseconds delay_ms, const TaskCallback& callback) {
+  if (schedule_task_) {
+    return schedule_task_(delay_ms, callback);
+  } else {
+    callback();
+    return 0;
+  }
+}
+
 void LinkLayerController::RegisterPeriodicTaskScheduler(
     std::function<AsyncTaskId(milliseconds, milliseconds, const TaskCallback&)> periodic_event_scheduler) {
   schedule_periodic_task_ = periodic_event_scheduler;
 }
 
+void LinkLayerController::CancelScheduledTask(AsyncTaskId task_id) {
+  if (schedule_task_ && cancel_task_) {
+    cancel_task_(task_id);
+  }
+}
+
 void LinkLayerController::RegisterTaskCancel(std::function<void(AsyncTaskId)> task_cancel) {
   cancel_task_ = task_cancel;
 }
 
 void LinkLayerController::AddControllerEvent(milliseconds delay, const TaskCallback& task) {
-  controller_events_.push_back(schedule_task_(delay, task));
+  controller_events_.push_back(ScheduleTask(delay, task));
 }
 
 void LinkLayerController::WriteSimplePairingMode(bool enabled) {
-  CHECK(enabled) << "The spec says don't disable this!";
+  ASSERT_LOG(enabled, "The spec says don't disable this!");
   simple_pairing_mode_enabled_ = enabled;
 }
 
@@ -703,35 +771,35 @@
 }
 
 void LinkLayerController::AuthenticateRemoteStage1(const Address& peer, PairingType pairing_type) {
-  CHECK(security_manager_.GetAuthenticationAddress() == peer);
+  ASSERT(security_manager_.GetAuthenticationAddress() == peer);
   // TODO: Public key exchange first?
   switch (pairing_type) {
     case PairingType::AUTO_CONFIRMATION:
       send_event_(EventPacketBuilder::CreateUserConfirmationRequestEvent(peer, 123456)->ToVector());
       break;
     case PairingType::CONFIRM_Y_N:
-      CHECK(false) << __func__ << "Unimplemented PairingType" << static_cast<int>(pairing_type);
+      LOG_ALWAYS_FATAL("Unimplemented PairingType %d", static_cast<int>(pairing_type));
       break;
     case PairingType::DISPLAY_PIN:
-      CHECK(false) << __func__ << "Unimplemented PairingType" << static_cast<int>(pairing_type);
+      LOG_ALWAYS_FATAL("Unimplemented PairingType %d", static_cast<int>(pairing_type));
       break;
     case PairingType::DISPLAY_AND_CONFIRM:
-      CHECK(false) << __func__ << "Unimplemented PairingType" << static_cast<int>(pairing_type);
+      LOG_ALWAYS_FATAL("Unimplemented PairingType %d", static_cast<int>(pairing_type));
       break;
     case PairingType::INPUT_PIN:
-      CHECK(false) << __func__ << "Unimplemented PairingType" << static_cast<int>(pairing_type);
+      LOG_ALWAYS_FATAL("Unimplemented PairingType %d", static_cast<int>(pairing_type));
       break;
     case PairingType::INVALID:
-      CHECK(false) << __func__ << "Unimplemented PairingType" << static_cast<int>(pairing_type);
+      LOG_ALWAYS_FATAL("Unimplemented PairingType %d", static_cast<int>(pairing_type));
       break;
     default:
-      CHECK(false) << __func__ << ": Invalid PairingType " << static_cast<int>(pairing_type);
+      LOG_ALWAYS_FATAL("Invalid PairingType %d", static_cast<int>(pairing_type));
   }
 }
 
 void LinkLayerController::AuthenticateRemoteStage2(const Address& peer) {
   uint16_t handle = security_manager_.GetAuthenticationHandle();
-  CHECK(security_manager_.GetAuthenticationAddress() == peer);
+  ASSERT(security_manager_.GetAuthenticationAddress() == peer);
   // Check key in security_manager_ ?
   send_event_(EventPacketBuilder::CreateAuthenticationCompleteEvent(hci::Status::SUCCESS, handle)->ToVector());
 }
@@ -741,7 +809,7 @@
   security_manager_.WriteKey(peer, key_vec);
   security_manager_.AuthenticationRequestFinished();
 
-  schedule_task_(milliseconds(5), [this, peer]() { AuthenticateRemoteStage2(peer); });
+  ScheduleTask(milliseconds(5), [this, peer]() { AuthenticateRemoteStage2(peer); });
 
   return hci::Status::SUCCESS;
 }
@@ -749,15 +817,15 @@
 hci::Status LinkLayerController::LinkKeyRequestNegativeReply(const Address& address) {
   security_manager_.DeleteKey(address);
   // Simple pairing to get a key
-  uint16_t handle = classic_connections_.GetHandle(address);
+  uint16_t handle = connections_.GetHandle(address);
   if (handle == acl::kReservedHandle) {
-    LOG_INFO(LOG_TAG, "%s: Device not connected %s", __func__, address.ToString().c_str());
+    LOG_INFO("%s: Device not connected %s", __func__, address.ToString().c_str());
     return hci::Status::UNKNOWN_CONNECTION;
   }
 
   security_manager_.AuthenticationRequest(address, handle);
 
-  schedule_task_(milliseconds(5), [this, address]() { StartSimplePairing(address); });
+  ScheduleTask(milliseconds(5), [this, address]() { StartSimplePairing(address); });
   return hci::Status::SUCCESS;
 }
 
@@ -768,12 +836,12 @@
 
   PairingType pairing_type = security_manager_.GetSimplePairingType();
   if (pairing_type != PairingType::INVALID) {
-    schedule_task_(milliseconds(5), [this, peer, pairing_type]() { AuthenticateRemoteStage1(peer, pairing_type); });
+    ScheduleTask(milliseconds(5), [this, peer, pairing_type]() { AuthenticateRemoteStage1(peer, pairing_type); });
     SendLinkLayerPacket(LinkLayerPacketBuilder::WrapIoCapabilityResponse(
         IoCapabilityBuilder::Create(io_capability, oob_data_present_flag, authentication_requirements),
         properties_.GetAddress(), peer));
   } else {
-    LOG_INFO(LOG_TAG, "%s: Requesting remote capability", __func__);
+    LOG_INFO("%s: Requesting remote capability", __func__);
     SendLinkLayerPacket(LinkLayerPacketBuilder::WrapIoCapabilityRequest(
         IoCapabilityBuilder::Create(io_capability, oob_data_present_flag, authentication_requirements),
         properties_.GetAddress(), peer));
@@ -805,7 +873,7 @@
 
   security_manager_.AuthenticationRequestFinished();
 
-  schedule_task_(milliseconds(5), [this, peer]() { AuthenticateRemoteStage2(peer); });
+  ScheduleTask(milliseconds(5), [this, peer]() { AuthenticateRemoteStage2(peer); });
   return hci::Status::SUCCESS;
 }
 
@@ -820,7 +888,7 @@
   if (security_manager_.GetAuthenticationAddress() != peer) {
     return hci::Status::AUTHENTICATION_FAILURE;
   }
-  LOG_INFO(LOG_TAG, "TODO:Do something with the passkey %06d", numeric_value);
+  LOG_INFO("TODO:Do something with the passkey %06d", numeric_value);
   return hci::Status::SUCCESS;
 }
 
@@ -836,7 +904,7 @@
   if (security_manager_.GetAuthenticationAddress() != peer) {
     return hci::Status::AUTHENTICATION_FAILURE;
   }
-  LOG_INFO(LOG_TAG, "TODO:Do something with the OOB data c=%d r=%d", c[0], r[0]);
+  LOG_INFO("TODO:Do something with the OOB data c=%d r=%d", c[0], r[0]);
   return hci::Status::SUCCESS;
 }
 
@@ -859,14 +927,14 @@
 }
 
 hci::Status LinkLayerController::AuthenticationRequested(uint16_t handle) {
-  if (!classic_connections_.HasHandle(handle)) {
-    LOG_INFO(LOG_TAG, "Authentication Requested for unknown handle %04x", handle);
+  if (!connections_.HasHandle(handle)) {
+    LOG_INFO("Authentication Requested for unknown handle %04x", handle);
     return hci::Status::UNKNOWN_CONNECTION;
   }
 
-  Address remote = classic_connections_.GetAddress(handle);
+  Address remote = connections_.GetAddress(handle);
 
-  schedule_task_(milliseconds(5), [this, remote, handle]() { HandleAuthenticationRequest(remote, handle); });
+  ScheduleTask(milliseconds(5), [this, remote, handle]() { HandleAuthenticationRequest(remote, handle); });
 
   return hci::Status::SUCCESS;
 }
@@ -875,7 +943,7 @@
                                                         uint8_t encryption_enable) {
   // TODO: Block ACL traffic or at least guard against it
 
-  if (classic_connections_.IsEncrypted(handle) && encryption_enable) {
+  if (connections_.IsEncrypted(handle) && encryption_enable) {
     send_event_(
         EventPacketBuilder::CreateEncryptionChange(hci::Status::SUCCESS, handle, encryption_enable)->ToVector());
     return;
@@ -886,32 +954,35 @@
 }
 
 hci::Status LinkLayerController::SetConnectionEncryption(uint16_t handle, uint8_t encryption_enable) {
-  if (!classic_connections_.HasHandle(handle)) {
-    LOG_INFO(LOG_TAG, "Authentication Requested for unknown handle %04x", handle);
+  if (!connections_.HasHandle(handle)) {
+    LOG_INFO("Set Connection Encryption for unknown handle %04x", handle);
     return hci::Status::UNKNOWN_CONNECTION;
   }
 
-  if (classic_connections_.IsEncrypted(handle) && !encryption_enable) {
+  if (connections_.IsEncrypted(handle) && !encryption_enable) {
     return hci::Status::ENCRYPTION_MODE_NOT_ACCEPTABLE;
   }
-  Address remote = classic_connections_.GetAddress(handle);
+  Address remote = connections_.GetAddress(handle);
 
-  schedule_task_(milliseconds(5), [this, remote, handle, encryption_enable]() {
+  if (security_manager_.ReadKey(remote) == 0) {
+    return hci::Status::PIN_OR_KEY_MISSING;
+  }
+
+  ScheduleTask(milliseconds(5), [this, remote, handle, encryption_enable]() {
     HandleSetConnectionEncryption(remote, handle, encryption_enable);
   });
-
   return hci::Status::SUCCESS;
 }
 
 hci::Status LinkLayerController::AcceptConnectionRequest(const Address& addr, bool try_role_switch) {
-  if (!classic_connections_.HasPendingConnection(addr)) {
-    LOG_INFO(LOG_TAG, "%s: No pending connection", __func__);
+  if (!connections_.HasPendingConnection(addr)) {
+    LOG_INFO("%s: No pending connection for %s", __func__, addr.ToString().c_str());
     return hci::Status::UNKNOWN_CONNECTION;
   }
 
-  LOG_INFO(LOG_TAG, "%s: Accept in 200ms", __func__);
-  schedule_task_(milliseconds(200), [this, addr, try_role_switch]() {
-    LOG_INFO(LOG_TAG, "%s: Accepted", __func__);
+  LOG_INFO("%s: Accept in 200ms", __func__);
+  ScheduleTask(milliseconds(200), [this, addr, try_role_switch]() {
+    LOG_INFO("%s: Accepted", __func__);
     MakeSlaveConnection(addr, try_role_switch);
   });
 
@@ -921,29 +992,29 @@
 void LinkLayerController::MakeSlaveConnection(const Address& addr, bool try_role_switch) {
   std::shared_ptr<LinkLayerPacketBuilder> to_send = LinkLayerPacketBuilder::WrapPageResponse(
       PageResponseBuilder::Create(try_role_switch), properties_.GetAddress(), addr);
-  LOG_INFO(LOG_TAG, "%s sending page response to %s", __func__, addr.ToString().c_str());
+  LOG_INFO("%s sending page response to %s", __func__, addr.ToString().c_str());
   SendLinkLayerPacket(to_send);
 
-  uint16_t handle = classic_connections_.CreateConnection(addr);
+  uint16_t handle = connections_.CreateConnection(addr);
   if (handle == acl::kReservedHandle) {
-    LOG_INFO(LOG_TAG, "%s CreateConnection failed", __func__);
+    LOG_INFO("%s CreateConnection failed", __func__);
     return;
   }
-  LOG_INFO(LOG_TAG, "%s CreateConnection returned handle 0x%x", __func__, handle);
+  LOG_INFO("%s CreateConnection returned handle 0x%x", __func__, handle);
   send_event_(
       EventPacketBuilder::CreateConnectionCompleteEvent(hci::Status::SUCCESS, handle, addr, hci::LinkType::ACL, false)
           ->ToVector());
 }
 
 hci::Status LinkLayerController::RejectConnectionRequest(const Address& addr, uint8_t reason) {
-  if (!classic_connections_.HasPendingConnection(addr)) {
-    LOG_INFO(LOG_TAG, "%s: No pending connection", __func__);
+  if (!connections_.HasPendingConnection(addr)) {
+    LOG_INFO("%s: No pending connection for %s", __func__, addr.ToString().c_str());
     return hci::Status::UNKNOWN_CONNECTION;
   }
 
-  LOG_INFO(LOG_TAG, "%s: Reject in 200ms", __func__);
-  schedule_task_(milliseconds(200), [this, addr, reason]() {
-    LOG_INFO(LOG_TAG, "%s: Reject", __func__);
+  LOG_INFO("%s: Reject in 200ms", __func__);
+  ScheduleTask(milliseconds(200), [this, addr, reason]() {
+    LOG_INFO("%s: Reject", __func__);
     RejectSlaveConnection(addr, reason);
   });
 
@@ -951,7 +1022,12 @@
 }
 
 void LinkLayerController::RejectSlaveConnection(const Address& addr, uint8_t reason) {
-  CHECK(reason > 0x0f || reason < 0x0d);
+  std::shared_ptr<LinkLayerPacketBuilder> to_send =
+      LinkLayerPacketBuilder::WrapPageReject(PageRejectBuilder::Create(reason), properties_.GetAddress(), addr);
+  LOG_INFO("%s sending page reject to %s", __func__, addr.ToString().c_str());
+  SendLinkLayerPacket(to_send);
+
+  ASSERT(reason >= 0x0d && reason <= 0x0f);
   send_event_(EventPacketBuilder::CreateConnectionCompleteEvent(static_cast<hci::Status>(reason), 0xeff, addr,
                                                                 hci::LinkType::ACL, false)
                   ->ToVector());
@@ -959,7 +1035,7 @@
 
 hci::Status LinkLayerController::CreateConnection(const Address& addr, uint16_t, uint8_t, uint16_t,
                                                   uint8_t allow_role_switch) {
-  if (!classic_connections_.CreatePendingConnection(addr)) {
+  if (!connections_.CreatePendingConnection(addr)) {
     return hci::Status::CONTROLLER_BUSY;
   }
 
@@ -970,7 +1046,7 @@
 }
 
 hci::Status LinkLayerController::CreateConnectionCancel(const Address& addr) {
-  if (!classic_connections_.CancelPendingConnection(addr)) {
+  if (!connections_.CancelPendingConnection(addr)) {
     return hci::Status::UNKNOWN_CONNECTION;
   }
   return hci::Status::SUCCESS;
@@ -978,17 +1054,17 @@
 
 hci::Status LinkLayerController::Disconnect(uint16_t handle, uint8_t reason) {
   // TODO: Handle LE
-  if (!classic_connections_.HasHandle(handle)) {
+  if (!connections_.HasHandle(handle)) {
     return hci::Status::UNKNOWN_CONNECTION;
   }
 
-  const Address& remote = classic_connections_.GetAddress(handle);
+  const Address& remote = connections_.GetAddress(handle);
   std::shared_ptr<LinkLayerPacketBuilder> to_send =
       LinkLayerPacketBuilder::WrapDisconnect(DisconnectBuilder::Create(reason), properties_.GetAddress(), remote);
   SendLinkLayerPacket(to_send);
-  CHECK(classic_connections_.Disconnect(handle)) << "Disconnecting " << handle;
+  ASSERT_LOG(connections_.Disconnect(handle), "Disconnecting %hx", handle);
 
-  schedule_task_(milliseconds(20), [this, handle]() {
+  ScheduleTask(milliseconds(20), [this, handle]() {
     DisconnectCleanup(handle, static_cast<uint8_t>(hci::Status::CONNECTION_TERMINATED_BY_LOCAL_HOST));
   });
 
@@ -1001,30 +1077,113 @@
 }
 
 hci::Status LinkLayerController::ChangeConnectionPacketType(uint16_t handle, uint16_t types) {
-  if (!classic_connections_.HasHandle(handle)) {
+  if (!connections_.HasHandle(handle)) {
     return hci::Status::UNKNOWN_CONNECTION;
   }
   std::unique_ptr<EventPacketBuilder> packet =
       EventPacketBuilder::CreateConnectionPacketTypeChangedEvent(hci::Status::SUCCESS, handle, types);
   std::shared_ptr<std::vector<uint8_t>> raw_packet = packet->ToVector();
-  if (schedule_task_) {
-    schedule_task_(milliseconds(20), [this, raw_packet]() { send_event_(raw_packet); });
-  } else {
-    send_event_(raw_packet);
-  }
+  ScheduleTask(milliseconds(20), [this, raw_packet]() { send_event_(raw_packet); });
 
   return hci::Status::SUCCESS;
 }
 
+hci::Status LinkLayerController::ChangeConnectionLinkKey(uint16_t handle) {
+  if (!connections_.HasHandle(handle)) {
+    return hci::Status::UNKNOWN_CONNECTION;
+  }
+
+  // TODO: implement real logic
+  return hci::Status::COMMAND_DISALLOWED;
+}
+
+hci::Status LinkLayerController::MasterLinkKey(uint8_t /* key_flag */) {
+  // TODO: implement real logic
+  return hci::Status::COMMAND_DISALLOWED;
+}
+
+hci::Status LinkLayerController::HoldMode(uint16_t handle, uint16_t hold_mode_max_interval,
+                                          uint16_t hold_mode_min_interval) {
+  if (!connections_.HasHandle(handle)) {
+    return hci::Status::UNKNOWN_CONNECTION;
+  }
+
+  if (hold_mode_max_interval < hold_mode_min_interval) {
+    return hci::Status::INVALID_HCI_COMMAND_PARAMETERS;
+  }
+
+  // TODO: implement real logic
+  return hci::Status::COMMAND_DISALLOWED;
+}
+
+hci::Status LinkLayerController::SniffMode(uint16_t handle, uint16_t sniff_max_interval, uint16_t sniff_min_interval,
+                                           uint16_t sniff_attempt, uint16_t sniff_timeout) {
+  if (!connections_.HasHandle(handle)) {
+    return hci::Status::UNKNOWN_CONNECTION;
+  }
+
+  if (sniff_max_interval < sniff_min_interval || sniff_attempt < 0x0001 || sniff_attempt > 0x7FFF ||
+      sniff_timeout > 0x7FFF) {
+    return hci::Status::INVALID_HCI_COMMAND_PARAMETERS;
+  }
+
+  // TODO: implement real logic
+  return hci::Status::COMMAND_DISALLOWED;
+}
+
+hci::Status LinkLayerController::ExitSniffMode(uint16_t handle) {
+  if (!connections_.HasHandle(handle)) {
+    return hci::Status::UNKNOWN_CONNECTION;
+  }
+
+  // TODO: implement real logic
+  return hci::Status::COMMAND_DISALLOWED;
+}
+
+hci::Status LinkLayerController::QosSetup(uint16_t handle, uint8_t service_type, uint32_t /* token_rate */,
+                                          uint32_t /* peak_bandwidth */, uint32_t /* latency */,
+                                          uint32_t /* delay_variation */) {
+  if (!connections_.HasHandle(handle)) {
+    return hci::Status::UNKNOWN_CONNECTION;
+  }
+
+  if (service_type > 0x02) {
+    return hci::Status::INVALID_HCI_COMMAND_PARAMETERS;
+  }
+
+  // TODO: implement real logic
+  return hci::Status::COMMAND_DISALLOWED;
+}
+
+hci::Status LinkLayerController::SwitchRole(Address /* bd_addr */, uint8_t /* role */) {
+  // TODO: implement real logic
+  return hci::Status::COMMAND_DISALLOWED;
+}
+
 hci::Status LinkLayerController::WriteLinkPolicySettings(uint16_t handle, uint16_t) {
-  if (!classic_connections_.HasHandle(handle)) {
+  if (!connections_.HasHandle(handle)) {
     return hci::Status::UNKNOWN_CONNECTION;
   }
   return hci::Status::SUCCESS;
 }
 
+hci::Status LinkLayerController::FlowSpecification(uint16_t handle, uint8_t flow_direction, uint8_t service_type,
+                                                   uint32_t /* token_rate */, uint32_t /* token_bucket_size */,
+                                                   uint32_t /* peak_bandwidth */, uint32_t /* access_latency */) {
+  if (!connections_.HasHandle(handle)) {
+    return hci::Status::UNKNOWN_CONNECTION;
+  }
+
+  if (flow_direction > 0x01 || service_type > 0x02) {
+    return hci::Status::INVALID_HCI_COMMAND_PARAMETERS;
+  }
+
+  // TODO: implement real logic
+  return hci::Status::COMMAND_DISALLOWED;
+}
+
 hci::Status LinkLayerController::WriteLinkSupervisionTimeout(uint16_t handle, uint16_t) {
-  if (!classic_connections_.HasHandle(handle)) {
+  if (!connections_.HasHandle(handle)) {
     return hci::Status::UNKNOWN_CONNECTION;
   }
   return hci::Status::SUCCESS;
@@ -1034,6 +1193,8 @@
   le_white_list_.clear();
 }
 
+void LinkLayerController::LeResolvingListClear() { le_resolving_list_.clear(); }
+
 void LinkLayerController::LeWhiteListAddDevice(Address addr, uint8_t addr_type) {
   std::tuple<Address, uint8_t> new_tuple = std::make_tuple(addr, addr_type);
   for (auto dev : le_white_list_) {
@@ -1044,6 +1205,30 @@
   le_white_list_.emplace_back(new_tuple);
 }
 
+void LinkLayerController::LeResolvingListAddDevice(
+    Address addr, uint8_t addr_type, std::array<uint8_t, kIrk_size> peerIrk,
+    std::array<uint8_t, kIrk_size> localIrk) {
+  std::tuple<Address, uint8_t, std::array<uint8_t, kIrk_size>,
+             std::array<uint8_t, kIrk_size>>
+      new_tuple = std::make_tuple(addr, addr_type, peerIrk, localIrk);
+  for (size_t i = 0; i < le_white_list_.size(); i++) {
+    auto curr = le_white_list_[i];
+    if (std::get<0>(curr) == addr && std::get<1>(curr) == addr_type) {
+      le_resolving_list_[i] = new_tuple;
+      return;
+    }
+  }
+  le_resolving_list_.emplace_back(new_tuple);
+}
+
+void LinkLayerController::LeSetPrivacyMode(uint8_t address_type, Address addr,
+                                           uint8_t mode) {
+  // set mode for addr
+  LOG_INFO("address type = %d ", address_type);
+  LOG_INFO("address = %s ", addr.ToString().c_str());
+  LOG_INFO("mode = %d ", mode);
+}
+
 void LinkLayerController::LeWhiteListRemoveDevice(Address addr, uint8_t addr_type) {
   // TODO: Add checks to see if advertising, scanning, or a connection request
   // with the white list is ongoing.
@@ -1055,6 +1240,18 @@
   }
 }
 
+void LinkLayerController::LeResolvingListRemoveDevice(Address addr,
+                                                      uint8_t addr_type) {
+  // TODO: Add checks to see if advertising, scanning, or a connection request
+  // with the white list is ongoing.
+  for (size_t i = 0; i < le_white_list_.size(); i++) {
+    auto curr = le_white_list_[i];
+    if (std::get<0>(curr) == addr && std::get<1>(curr) == addr_type) {
+      le_resolving_list_.erase(le_resolving_list_.begin() + i);
+    }
+  }
+}
+
 bool LinkLayerController::LeWhiteListContainsDevice(Address addr, uint8_t addr_type) {
   std::tuple<Address, uint8_t> sought_tuple = std::make_tuple(addr, addr_type);
   for (size_t i = 0; i < le_white_list_.size(); i++) {
@@ -1065,27 +1262,43 @@
   return false;
 }
 
+bool LinkLayerController::LeResolvingListContainsDevice(Address addr,
+                                                        uint8_t addr_type) {
+  for (size_t i = 0; i < le_white_list_.size(); i++) {
+    auto curr = le_white_list_[i];
+    if (std::get<0>(curr) == addr && std::get<1>(curr) == addr_type) {
+      return true;
+    }
+  }
+  return false;
+}
+
 bool LinkLayerController::LeWhiteListFull() {
   return le_white_list_.size() >= properties_.GetLeWhiteListSize();
 }
 
+bool LinkLayerController::LeResolvingListFull() {
+  return le_resolving_list_.size() >= properties_.GetLeResolvingListSize();
+}
+
 void LinkLayerController::Reset() {
   inquiry_state_ = Inquiry::InquiryState::STANDBY;
   last_inquiry_ = steady_clock::now();
   le_scan_enable_ = 0;
+  le_advertising_enable_ = 0;
   le_connect_ = 0;
 }
 
 void LinkLayerController::PageScan() {}
 
 void LinkLayerController::StartInquiry(milliseconds timeout) {
-  schedule_task_(milliseconds(timeout), [this]() { LinkLayerController::InquiryTimeout(); });
+  ScheduleTask(milliseconds(timeout), [this]() { LinkLayerController::InquiryTimeout(); });
   inquiry_state_ = Inquiry::InquiryState::INQUIRY;
-  LOG_INFO(LOG_TAG, "InquiryState = %d ", static_cast<int>(inquiry_state_));
+  LOG_INFO("InquiryState = %d ", static_cast<int>(inquiry_state_));
 }
 
 void LinkLayerController::InquiryCancel() {
-  CHECK(inquiry_state_ == Inquiry::InquiryState::INQUIRY);
+  ASSERT(inquiry_state_ == Inquiry::InquiryState::INQUIRY);
   inquiry_state_ = Inquiry::InquiryState::STANDBY;
 }
 
@@ -1113,7 +1326,7 @@
   if (duration_cast<milliseconds>(now - last_inquiry_) < milliseconds(2000)) {
     return;
   }
-  LOG_INFO(LOG_TAG, "Inquiry ");
+  LOG_INFO("Inquiry ");
   std::unique_ptr<InquiryBuilder> inquiry = InquiryBuilder::Create(inquiry_mode_);
   std::shared_ptr<LinkLayerPacketBuilder> to_send =
       LinkLayerPacketBuilder::WrapInquiry(std::move(inquiry), properties_.GetAddress());
@@ -1129,18 +1342,4 @@
   page_scans_enabled_ = enable;
 }
 
-/* TODO: Connection handling
-  // TODO: Handle in the link manager.
-  uint16_t handle = LeGetHandle();
-
-  std::shared_ptr<Connection> new_connection =
-      std::make_shared<Connection>(peer, handle);
-  connections_.push_back(new_connection);
-  peer->SetConnection(new_connection);
-
-  send_event_(EventPacketBuilder::CreateLeEnhancedConnectionCompleteEvent(
-      hci::Status::SUCCESS, handle, 0x00,  // role
-      le_peer_address_type_, le_peer_address_, Address::kEmpty,
-  Address::kEmpty, 0x0024, 0x0000, 0x01f4)->ToVector());
-*/
 }  // namespace test_vendor_lib
diff --git a/vendor_libs/test_vendor_lib/model/controller/link_layer_controller.h b/vendor_libs/test_vendor_lib/model/controller/link_layer_controller.h
index 5cec196..9adb714 100644
--- a/vendor_libs/test_vendor_lib/model/controller/link_layer_controller.h
+++ b/vendor_libs/test_vendor_lib/model/controller/link_layer_controller.h
@@ -34,6 +34,8 @@
 
 class LinkLayerController {
  public:
+  static constexpr size_t kIrk_size = 16;
+
   LinkLayerController(const DeviceProperties& properties) : properties_(properties) {}
   hci::Status SendCommandToRemoteByAddress(hci::OpCode opcode, packets::PacketView<true> args, const Address& remote,
                                            bool use_public_address);
@@ -79,6 +81,10 @@
 
   void TimerTick();
 
+  AsyncTaskId ScheduleTask(std::chrono::milliseconds delay_ms, const TaskCallback& task);
+
+  void CancelScheduledTask(AsyncTaskId task);
+
   // Set the callbacks for sending packets to the HCI.
   void RegisterEventChannel(const std::function<void(std::shared_ptr<std::vector<uint8_t>>)>& send_event);
 
@@ -104,11 +110,30 @@
   void PageScan();
   void Connections();
 
+  void LeAdvertising();
+
+  void HandleLeConnection(Address addr, uint8_t addr_type, uint8_t own_addr_type, uint8_t role,
+                          uint16_t connection_interval, uint16_t connection_latency, uint16_t supervision_timeout);
+
   void LeWhiteListClear();
   void LeWhiteListAddDevice(Address addr, uint8_t addr_type);
   void LeWhiteListRemoveDevice(Address addr, uint8_t addr_type);
   bool LeWhiteListContainsDevice(Address addr, uint8_t addr_type);
   bool LeWhiteListFull();
+  void LeResolvingListClear();
+  void LeResolvingListAddDevice(Address addr, uint8_t addr_type,
+                                std::array<uint8_t, kIrk_size> peerIrk,
+                                std::array<uint8_t, kIrk_size> localIrk);
+  void LeResolvingListRemoveDevice(Address addr, uint8_t addr_type);
+  bool LeResolvingListContainsDevice(Address addr, uint8_t addr_type);
+  bool LeResolvingListFull();
+  void LeSetPrivacyMode(uint8_t address_type, Address addr, uint8_t mode);
+
+  hci::Status SetLeAdvertisingEnable(uint8_t le_advertising_enable) {
+    le_advertising_enable_ = le_advertising_enable;
+    // TODO: Check properties and return errors
+    return hci::Status::SUCCESS;
+  }
 
   void SetLeScanEnable(uint8_t le_scan_enable) {
     le_scan_enable_ = le_scan_enable;
@@ -176,11 +201,22 @@
   void SetPageScanEnable(bool enable);
 
   hci::Status ChangeConnectionPacketType(uint16_t handle, uint16_t types);
+  hci::Status ChangeConnectionLinkKey(uint16_t handle);
+  hci::Status MasterLinkKey(uint8_t key_flag);
+  hci::Status HoldMode(uint16_t handle, uint16_t hold_mode_max_interval, uint16_t hold_mode_min_interval);
+  hci::Status SniffMode(uint16_t handle, uint16_t sniff_max_interval, uint16_t sniff_min_interval,
+                        uint16_t sniff_attempt, uint16_t sniff_timeout);
+  hci::Status ExitSniffMode(uint16_t handle);
+  hci::Status QosSetup(uint16_t handle, uint8_t service_type, uint32_t token_rate, uint32_t peak_bandwidth,
+                       uint32_t latency, uint32_t delay_variation);
+  hci::Status SwitchRole(Address bd_addr, uint8_t role);
   hci::Status WriteLinkPolicySettings(uint16_t handle, uint16_t settings);
+  hci::Status FlowSpecification(uint16_t handle, uint8_t flow_direction, uint8_t service_type, uint32_t token_rate,
+                                uint32_t token_bucket_size, uint32_t peak_bandwidth, uint32_t access_latency);
   hci::Status WriteLinkSupervisionTimeout(uint16_t handle, uint16_t timeout);
 
  protected:
-  void SendLELinkLayerPacket(std::shared_ptr<packets::LinkLayerPacketBuilder> packet);
+  void SendLeLinkLayerPacket(std::shared_ptr<packets::LinkLayerPacketBuilder> packet);
   void SendLinkLayerPacket(std::shared_ptr<packets::LinkLayerPacketBuilder> packet);
   void IncomingAclPacket(packets::LinkLayerPacketView packet);
   void IncomingAclAckPacket(packets::LinkLayerPacketView packet);
@@ -195,15 +231,18 @@
   void IncomingIoCapabilityResponsePacket(packets::LinkLayerPacketView packet);
   void IncomingIoCapabilityNegativeResponsePacket(packets::LinkLayerPacketView packet);
   void IncomingLeAdvertisementPacket(packets::LinkLayerPacketView packet);
+  void IncomingLeConnectPacket(packets::LinkLayerPacketView packet);
+  void IncomingLeConnectCompletePacket(packets::LinkLayerPacketView packet);
   void IncomingLeScanPacket(packets::LinkLayerPacketView packet);
   void IncomingLeScanResponsePacket(packets::LinkLayerPacketView packet);
   void IncomingPagePacket(packets::LinkLayerPacketView packet);
+  void IncomingPageRejectPacket(packets::LinkLayerPacketView packet);
   void IncomingPageResponsePacket(packets::LinkLayerPacketView packet);
   void IncomingResponsePacket(packets::LinkLayerPacketView packet);
 
  private:
   const DeviceProperties& properties_;
-  AclConnectionHandler classic_connections_;
+  AclConnectionHandler connections_;
   // Add timestamps?
   std::vector<std::shared_ptr<packets::LinkLayerPacketBuilder>> commands_awaiting_responses_;
 
@@ -230,8 +269,14 @@
   std::vector<uint8_t> le_event_mask_;
 
   std::vector<std::tuple<Address, uint8_t>> le_white_list_;
+  std::vector<std::tuple<Address, uint8_t, std::array<uint8_t, kIrk_size>,
+                         std::array<uint8_t, kIrk_size>>>
+      le_resolving_list_;
 
-  uint8_t le_scan_enable_;
+  uint8_t le_advertising_enable_{false};
+  std::chrono::steady_clock::time_point last_le_advertisement_;
+
+  uint8_t le_scan_enable_{false};
   uint8_t le_scan_type_;
   uint16_t le_scan_interval_;
   uint16_t le_scan_window_;
@@ -239,7 +284,7 @@
   uint8_t le_scan_filter_duplicates_;
   uint8_t le_address_type_;
 
-  bool le_connect_;
+  bool le_connect_{false};
   uint16_t le_connection_interval_min_;
   uint16_t le_connection_interval_max_;
   uint16_t le_connection_latency_;
diff --git a/vendor_libs/test_vendor_lib/model/controller/security_manager.cc b/vendor_libs/test_vendor_lib/model/controller/security_manager.cc
index 6ab1351..bd3072c 100644
--- a/vendor_libs/test_vendor_lib/model/controller/security_manager.cc
+++ b/vendor_libs/test_vendor_lib/model/controller/security_manager.cc
@@ -14,11 +14,9 @@
  * limitations under the License.
  */
 
-#define LOG_TAG "security_manager"
-
 #include "security_manager.h"
 
-#include "base/logging.h"
+#include "os/log.h"
 
 using std::vector;
 
@@ -55,7 +53,7 @@
 }
 
 const std::vector<uint8_t>& SecurityManager::GetKey(const Address& addr) const {
-  CHECK(ReadKey(addr)) << "No such key";
+  ASSERT_LOG(ReadKey(addr), "No such key");
   return key_store_.at(addr.ToString());
 }
 
@@ -83,7 +81,7 @@
 
 void SecurityManager::SetPeerIoCapability(const Address& addr, uint8_t io_capability, uint8_t oob_present_flag,
                                           uint8_t authentication_requirements) {
-  CHECK_EQ(addr, peer_address_);
+  ASSERT(addr == peer_address_);
   peer_capabilities_valid_ = true;
   if (io_capability <= static_cast<uint8_t>(IoCapabilityType::NO_INPUT_NO_OUTPUT)) {
     peer_io_capability_ = static_cast<IoCapabilityType>(io_capability);
@@ -102,12 +100,12 @@
 
 void SecurityManager::SetLocalIoCapability(const Address& peer, uint8_t io_capability, uint8_t oob_present_flag,
                                            uint8_t authentication_requirements) {
-  CHECK_EQ(peer, peer_address_);
-  CHECK(io_capability <= static_cast<uint8_t>(IoCapabilityType::NO_INPUT_NO_OUTPUT))
-      << "io_capability = " << io_capability;
-  CHECK(oob_present_flag <= 1) << "oob_present_flag = " << oob_present_flag;
-  CHECK(authentication_requirements <= static_cast<uint8_t>(AuthenticationType::GENERAL_BONDING_MITM))
-      << "authentication_requirements = " << authentication_requirements;
+  ASSERT(peer == peer_address_);
+  ASSERT_LOG(io_capability <= static_cast<uint8_t>(IoCapabilityType::NO_INPUT_NO_OUTPUT), "io_capability = %d",
+             static_cast<int>(io_capability));
+  ASSERT_LOG(oob_present_flag <= 1, "oob_present_flag = %hhx ", oob_present_flag);
+  ASSERT_LOG(authentication_requirements <= static_cast<uint8_t>(AuthenticationType::GENERAL_BONDING_MITM),
+             "authentication_requirements = %d", static_cast<int>(authentication_requirements));
   host_io_capability_ = static_cast<IoCapabilityType>(io_capability);
   host_oob_present_flag_ = (oob_present_flag == 1);
   host_authentication_requirements_ = static_cast<AuthenticationType>(authentication_requirements);
diff --git a/vendor_libs/test_vendor_lib/model/devices/beacon.cc b/vendor_libs/test_vendor_lib/model/devices/beacon.cc
index 1adaf29..46f3069 100644
--- a/vendor_libs/test_vendor_lib/model/devices/beacon.cc
+++ b/vendor_libs/test_vendor_lib/model/devices/beacon.cc
@@ -14,31 +14,27 @@
  * limitations under the License.
  */
 
-#define LOG_TAG "beacon"
-
 #include "beacon.h"
 
-#include "le_advertisement.h"
 #include "model/setup/device_boutique.h"
-#include "osi/include/log.h"
 
 using std::vector;
 
 namespace test_vendor_lib {
 
-bool Beacon::registered_ = DeviceBoutique::Register(LOG_TAG, &Beacon::Create);
+bool Beacon::registered_ = DeviceBoutique::Register("beacon", &Beacon::Create);
 
 Beacon::Beacon() {
   advertising_interval_ms_ = std::chrono::milliseconds(1280);
-  properties_.SetLeAdvertisementType(BTM_BLE_NON_CONNECT_EVT);
+  properties_.SetLeAdvertisementType(0x03 /* NON_CONNECT */);
   properties_.SetLeAdvertisement({0x0F,  // Length
-                                  BTM_BLE_AD_TYPE_NAME_CMPL, 'g', 'D', 'e', 'v', 'i', 'c', 'e', '-', 'b', 'e', 'a', 'c',
+                                  0x09 /* TYPE_NAME_CMPL */, 'g', 'D', 'e', 'v', 'i', 'c', 'e', '-', 'b', 'e', 'a', 'c',
                                   'o', 'n',
                                   0x02,  // Length
-                                  BTM_BLE_AD_TYPE_FLAG, BTM_BLE_BREDR_NOT_SPT | BTM_BLE_GEN_DISC_FLAG});
+                                  0x01 /* TYPE_FLAG */, 0x4 /* BREDR_NOT_SPT */ | 0x2 /* GEN_DISC_FLAG */});
 
   properties_.SetLeScanResponse({0x05,  // Length
-                                 BTM_BLE_AD_TYPE_NAME_SHORT, 'b', 'e', 'a', 'c'});
+                                 0x08 /* TYPE_NAME_SHORT */, 'b', 'e', 'a', 'c'});
 }
 
 std::string Beacon::GetTypeString() const {
@@ -63,9 +59,7 @@
 }
 
 void Beacon::TimerTick() {
-  LOG_INFO(LOG_TAG, "TimerTick()");
   if (IsAdvertisementAvailable(std::chrono::milliseconds(5000))) {
-    LOG_INFO(LOG_TAG, "Generating Advertisement %d", static_cast<int>(properties_.GetLeAdvertisement().size()));
     std::unique_ptr<packets::LeAdvertisementBuilder> ad = packets::LeAdvertisementBuilder::Create(
         LeAdvertisement::AddressType::PUBLIC,
         static_cast<LeAdvertisement::AdvertisementType>(properties_.GetLeAdvertisementType()),
@@ -74,16 +68,13 @@
         packets::LinkLayerPacketBuilder::WrapLeAdvertisement(std::move(ad), properties_.GetLeAddress());
     std::vector<std::shared_ptr<PhyLayer>> le_phys = phy_layers_[Phy::Type::LOW_ENERGY];
     for (std::shared_ptr<PhyLayer> phy : le_phys) {
-      LOG_INFO(LOG_TAG, "Sending Advertisement on a Phy");
       phy->Send(to_send);
     }
   }
 }
 
 void Beacon::IncomingPacket(packets::LinkLayerPacketView packet) {
-  LOG_INFO(LOG_TAG, "Got a packet of type %d", static_cast<int>(packet.GetType()));
   if (packet.GetDestinationAddress() == properties_.GetLeAddress() && packet.GetType() == Link::PacketType::LE_SCAN) {
-    LOG_INFO(LOG_TAG, "Got a scan");
     std::unique_ptr<packets::LeAdvertisementBuilder> scan_response = packets::LeAdvertisementBuilder::Create(
         LeAdvertisement::AddressType::PUBLIC, LeAdvertisement::AdvertisementType::SCAN_RESPONSE,
         properties_.GetLeScanResponse());
@@ -91,7 +82,6 @@
         std::move(scan_response), properties_.GetLeAddress(), packet.GetSourceAddress());
     std::vector<std::shared_ptr<PhyLayer>> le_phys = phy_layers_[Phy::Type::LOW_ENERGY];
     for (auto phy : le_phys) {
-      LOG_INFO(LOG_TAG, "Sending a Scan Response on a Phy");
       phy->Send(to_send);
     }
   }
diff --git a/vendor_libs/test_vendor_lib/model/devices/beacon.h b/vendor_libs/test_vendor_lib/model/devices/beacon.h
index faac5cc..8499ab8 100644
--- a/vendor_libs/test_vendor_lib/model/devices/beacon.h
+++ b/vendor_libs/test_vendor_lib/model/devices/beacon.h
@@ -20,7 +20,6 @@
 #include <vector>
 
 #include "device.h"
-#include "stack/include/btm_ble_api.h"
 
 namespace test_vendor_lib {
 
diff --git a/vendor_libs/test_vendor_lib/model/devices/beacon_swarm.cc b/vendor_libs/test_vendor_lib/model/devices/beacon_swarm.cc
index a065c36..c9f17f1 100644
--- a/vendor_libs/test_vendor_lib/model/devices/beacon_swarm.cc
+++ b/vendor_libs/test_vendor_lib/model/devices/beacon_swarm.cc
@@ -14,8 +14,6 @@
  * limitations under the License.
  */
 
-#define LOG_TAG "beacon_swarm"
-
 #include "beacon_swarm.h"
 
 #include "model/setup/device_boutique.h"
@@ -23,14 +21,14 @@
 using std::vector;
 
 namespace test_vendor_lib {
-bool BeaconSwarm::registered_ = DeviceBoutique::Register(LOG_TAG, &BeaconSwarm::Create);
+bool BeaconSwarm::registered_ = DeviceBoutique::Register("beacon_swarm", &BeaconSwarm::Create);
 
 BeaconSwarm::BeaconSwarm() {
   advertising_interval_ms_ = std::chrono::milliseconds(1280);
-  properties_.SetLeAdvertisementType(BTM_BLE_NON_CONNECT_EVT);
+  properties_.SetLeAdvertisementType(0x03 /* NON_CONNECT */);
   properties_.SetLeAdvertisement({
       0x15,  // Length
-      BTM_BLE_AD_TYPE_NAME_CMPL,
+      0x09 /* TYPE_NAME_CMPL */,
       'g',
       'D',
       'e',
@@ -52,12 +50,12 @@
       'r',
       'm',
       0x02,  // Length
-      BTM_BLE_AD_TYPE_FLAG,
-      BTM_BLE_BREDR_NOT_SPT | BTM_BLE_GEN_DISC_FLAG,
+      0x01 /* TYPE_FLAG */,
+      0x4 /* BREDR_NOT_SPT */ | 0x2 /* GEN_DISC_FLAG */,
   });
 
   properties_.SetLeScanResponse({0x06,  // Length
-                                 BTM_BLE_AD_TYPE_NAME_SHORT, 'c', 'b', 'e', 'a', 'c'});
+                                 0x08 /* TYPE_NAME_SHORT */, 'c', 'b', 'e', 'a', 'c'});
 }
 
 void BeaconSwarm::Initialize(const vector<std::string>& args) {
diff --git a/vendor_libs/test_vendor_lib/model/devices/broken_adv.cc b/vendor_libs/test_vendor_lib/model/devices/broken_adv.cc
index c7d6822..32c5ebb 100644
--- a/vendor_libs/test_vendor_lib/model/devices/broken_adv.cc
+++ b/vendor_libs/test_vendor_lib/model/devices/broken_adv.cc
@@ -14,54 +14,36 @@
  * limitations under the License.
  */
 
-#define LOG_TAG "broken_adv"
-
 #include "broken_adv.h"
 
 #include "model/setup/device_boutique.h"
-#include "osi/include/log.h"
 
 using std::vector;
 
 namespace test_vendor_lib {
 
-bool BrokenAdv::registered_ = DeviceBoutique::Register(LOG_TAG, &BrokenAdv::Create);
+bool BrokenAdv::registered_ = DeviceBoutique::Register("broken_adv", &BrokenAdv::Create);
 
 BrokenAdv::BrokenAdv() {
   advertising_interval_ms_ = std::chrono::milliseconds(1280);
-  properties_.SetLeAdvertisementType(BTM_BLE_NON_CONNECT_EVT);
+  properties_.SetLeAdvertisementType(0x03 /* NON_CONNECT */);
   constant_adv_data_ = {
-      0x02,  // Length
-      BTM_BLE_AD_TYPE_FLAG,
-      BTM_BLE_BREDR_NOT_SPT | BTM_BLE_GEN_DISC_FLAG,
-      0x13,  // Length
-      BTM_BLE_AD_TYPE_NAME_CMPL,
-      'g',
-      'D',
-      'e',
-      'v',
-      'i',
-      'c',
-      'e',
-      '-',
-      'b',
-      'r',
-      'o',
-      'k',
-      'e',
-      'n',
-      '_',
-      'a',
-      'd',
-      'v',
+      0x02,       // Length
+      0x01,       // TYPE_FLAG
+      0x4 | 0x2,  // BREDR_NOT_SPT |  GEN_DISC_FLAG
+      0x13,       // Length
+      0x09,       // TYPE_NAME_CMPL
+      'g',       'D', 'e', 'v', 'i', 'c', 'e', '-', 'b', 'r', 'o', 'k', 'e', 'n', '_', 'a', 'd', 'v',
   };
   properties_.SetLeAdvertisement(constant_adv_data_);
 
   properties_.SetLeScanResponse({0x0b,  // Length
-                                 BTM_BLE_AD_TYPE_NAME_SHORT, 'b', 'r', 'o', 'k', 'e', 'n', 'n', 'e', 's', 's'});
+                                 0x08,  // TYPE_NAME_SHORT
+                                 'b', 'r', 'o', 'k', 'e', 'n', 'n', 'e', 's', 's'});
 
   properties_.SetExtendedInquiryData({0x07,  // Length
-                                      BT_EIR_COMPLETE_LOCAL_NAME_TYPE, 'B', 'R', '0', 'K', '3', 'N'});
+                                      0x09,  // TYPE_NAME_COMPLETE
+                                      'B', 'R', '0', 'K', '3', 'N'});
   properties_.SetPageScanRepetitionMode(0);
   page_scan_delay_ms_ = std::chrono::milliseconds(600);
 }
@@ -106,7 +88,7 @@
 
   switch ((randomness & 0xf000000) >> 24) {
     case (0):
-      return BTM_EIR_MANUFACTURER_SPECIFIC_TYPE;
+      return 0xff;  // TYPE_MANUFACTURER_SPECIFIC
     case (1):
       return (randomness & 0xff);
     default:
diff --git a/vendor_libs/test_vendor_lib/model/devices/car_kit.cc b/vendor_libs/test_vendor_lib/model/devices/car_kit.cc
index 5f7fa4a..dcf977f 100644
--- a/vendor_libs/test_vendor_lib/model/devices/car_kit.cc
+++ b/vendor_libs/test_vendor_lib/model/devices/car_kit.cc
@@ -14,19 +14,16 @@
  * limitations under the License.
  */
 
-#define LOG_TAG "car_kit"
-
 #include "car_kit.h"
 
-#include "osi/include/log.h"
-
 #include "model/setup/device_boutique.h"
+#include "os/log.h"
 
 using std::vector;
 
 namespace test_vendor_lib {
 
-bool CarKit::registered_ = DeviceBoutique::Register(LOG_TAG, &CarKit::Create);
+bool CarKit::registered_ = DeviceBoutique::Register("car_kit", &CarKit::Create);
 
 CarKit::CarKit() : Device(kCarKitPropertiesFile) {
   advertising_interval_ms_ = std::chrono::milliseconds(0);
@@ -82,7 +79,7 @@
 
   Address addr;
   if (Address::FromString(args[1], addr)) properties_.SetAddress(addr);
-  LOG_INFO(LOG_TAG, "%s SetAddress %s", ToString().c_str(), addr.ToString().c_str());
+  LOG_INFO("%s SetAddress %s", ToString().c_str(), addr.ToString().c_str());
 
   if (args.size() < 3) return;
 
@@ -94,7 +91,7 @@
 }
 
 void CarKit::IncomingPacket(packets::LinkLayerPacketView packet) {
-  LOG_WARN(LOG_TAG, "Incoming Packet");
+  LOG_WARN("Incoming Packet");
   link_layer_controller_.IncomingPacket(packet);
 }
 
diff --git a/vendor_libs/test_vendor_lib/model/devices/classic.cc b/vendor_libs/test_vendor_lib/model/devices/classic.cc
index a8f8a99..0838bd5 100644
--- a/vendor_libs/test_vendor_lib/model/devices/classic.cc
+++ b/vendor_libs/test_vendor_lib/model/devices/classic.cc
@@ -14,24 +14,21 @@
  * limitations under the License.
  */
 
-#define LOG_TAG "classic"
-
 #include "classic.h"
 #include "model/setup/device_boutique.h"
-#include "osi/include/log.h"
 
 using std::vector;
 
 namespace test_vendor_lib {
 
-bool Classic::registered_ = DeviceBoutique::Register(LOG_TAG, &Classic::Create);
+bool Classic::registered_ = DeviceBoutique::Register("classic", &Classic::Create);
 
 Classic::Classic() {
   advertising_interval_ms_ = std::chrono::milliseconds(0);
   properties_.SetClassOfDevice(0x30201);
 
-  properties_.SetExtendedInquiryData({0x10,                             // Length
-                                      BT_EIR_COMPLETE_LOCAL_NAME_TYPE,  // Type
+  properties_.SetExtendedInquiryData({0x10,  // Length
+                                      0x09,  // TYPE_NAME_CMPL
                                       'g', 'D', 'e', 'v', 'i', 'c', 'e', '-', 'c', 'l', 'a', 's', 's', 'i', 'c',
                                       '\0'});  // End of data
   properties_.SetPageScanRepetitionMode(0);
diff --git a/vendor_libs/test_vendor_lib/model/devices/device.cc b/vendor_libs/test_vendor_lib/model/devices/device.cc
index 52a37c1..cd7368c 100644
--- a/vendor_libs/test_vendor_lib/model/devices/device.cc
+++ b/vendor_libs/test_vendor_lib/model/devices/device.cc
@@ -14,8 +14,6 @@
  * limitations under the License.
  */
 
-#define LOG_TAG "device"
-
 #include <vector>
 
 #include "device.h"
@@ -34,13 +32,20 @@
   phy_layers_[phy->GetType()].push_back(phy);
 }
 
-void Device::UnregisterPhyLayer(std::shared_ptr<PhyLayer> phy) {
+void Device::UnregisterPhyLayers() {
   for (auto phy_pair : phy_layers_) {
     auto phy_list = std::get<1>(phy_pair);
-    for (size_t i = 0; i < phy_list.size(); i++) {
-      if (phy == phy_list[i]) {
-        phy_list.erase(phy_list.begin() + i);
-      }
+    for (auto phy : phy_list) {
+      phy->Unregister();
+    }
+  }
+}
+
+void Device::UnregisterPhyLayer(Phy::Type phy_type, uint32_t factory_id) {
+  for (size_t i = 0; i < phy_layers_[phy_type].size(); i++) {
+    if (phy_layers_[phy_type][i]->IsFactoryId(factory_id)) {
+      phy_layers_[phy_type][i]->Unregister();
+      phy_layers_[phy_type].erase(phy_layers_[phy_type].begin() + i);
     }
   }
 }
@@ -59,8 +64,7 @@
 }
 
 void Device::SendLinkLayerPacket(std::shared_ptr<packets::LinkLayerPacketBuilder> to_send, Phy::Type phy_type) {
-  auto phy_list = phy_layers_[phy_type];
-  for (auto phy : phy_list) {
+  for (auto phy : phy_layers_[phy_type]) {
     phy->Send(to_send);
   }
 }
diff --git a/vendor_libs/test_vendor_lib/model/devices/device.h b/vendor_libs/test_vendor_lib/model/devices/device.h
index 18842cd..277ebe1 100644
--- a/vendor_libs/test_vendor_lib/model/devices/device.h
+++ b/vendor_libs/test_vendor_lib/model/devices/device.h
@@ -28,8 +28,6 @@
 #include "packets/link_layer/link_layer_packet_view.h"
 #include "types/address.h"
 
-#include "stack/include/btm_ble_api.h"
-
 namespace test_vendor_lib {
 
 // Represent a Bluetooth Device
@@ -71,7 +69,9 @@
 
   void RegisterPhyLayer(std::shared_ptr<PhyLayer> phy);
 
-  void UnregisterPhyLayer(std::shared_ptr<PhyLayer> phy);
+  void UnregisterPhyLayers();
+
+  void UnregisterPhyLayer(Phy::Type phy_type, uint32_t factory_id);
 
   virtual void IncomingPacket(packets::LinkLayerPacketView){};
 
diff --git a/vendor_libs/test_vendor_lib/model/devices/device_properties.cc b/vendor_libs/test_vendor_lib/model/devices/device_properties.cc
index 164160a..2a4a970 100644
--- a/vendor_libs/test_vendor_lib/model/devices/device_properties.cc
+++ b/vendor_libs/test_vendor_lib/model/devices/device_properties.cc
@@ -14,19 +14,16 @@
  * limitations under the License.
  */
 
-#define LOG_TAG "device_properties"
-
 #include "device_properties.h"
 
 #include <memory>
 
-#include <base/logging.h>
 #include "base/files/file_util.h"
 #include "base/json/json_reader.h"
 #include "base/values.h"
 
 #include "hci.h"
-#include "osi/include/log.h"
+#include "os/log.h"
 #include "osi/include/osi.h"
 
 using std::vector;
@@ -48,20 +45,32 @@
 namespace test_vendor_lib {
 
 DeviceProperties::DeviceProperties(const std::string& file_name)
-    : acl_data_packet_size_(1024), sco_data_packet_size_(255), num_acl_data_packets_(10), num_sco_data_packets_(10),
-      version_(static_cast<uint8_t>(hci::Version::V4_1)), revision_(0),
-      lmp_pal_version_(static_cast<uint8_t>(hci::Version::V4_1)), manufacturer_name_(0), lmp_pal_subversion_(0),
-      le_data_packet_length_(27), num_le_data_packets_(15), le_white_list_size_(15) {
+    : acl_data_packet_size_(1024),
+      sco_data_packet_size_(255),
+      num_acl_data_packets_(10),
+      num_sco_data_packets_(10),
+      version_(static_cast<uint8_t>(hci::Version::V4_1)),
+      revision_(0),
+      lmp_pal_version_(static_cast<uint8_t>(hci::Version::V4_1)),
+      manufacturer_name_(0),
+      lmp_pal_subversion_(0),
+      le_data_packet_length_(27),
+      num_le_data_packets_(15),
+      le_white_list_size_(15),
+      le_resolving_list_size_(15) {
   std::string properties_raw;
 
-  CHECK(Address::FromString("BB:BB:BB:BB:BB:AD", address_));
-  CHECK(Address::FromString("BB:BB:BB:BB:AD:1E", le_address_));
+  ASSERT(Address::FromString("BB:BB:BB:BB:BB:AD", address_));
+  ASSERT(Address::FromString("BB:BB:BB:BB:AD:1E", le_address_));
   name_ = {'D', 'e', 'f', 'a', 'u', 'l', 't'};
 
   supported_codecs_ = {0};  // Only SBC is supported.
   vendor_specific_codecs_ = {};
 
-  for (int i = 0; i < 64; i++) supported_commands_.push_back(0xff);
+  for (int i = 0; i < 35; i++) supported_commands_.push_back(0xff);
+  // Mark HCI_LE_Transmitter_Test[v2] and newer commands as unsupported
+  // TODO: Implement a better mapping.
+  for (int i = 35; i < 64; i++) supported_commands_.push_back(0x00);
 
   le_supported_features_ = 0x1f;
   le_supported_states_ = 0x3ffffffffff;
@@ -70,15 +79,14 @@
   if (file_name.size() == 0) {
     return;
   }
-  LOG_INFO(LOG_TAG, "Reading controller properties from %s.", file_name.c_str());
+  LOG_INFO("Reading controller properties from %s.", file_name.c_str());
   if (!base::ReadFileToString(base::FilePath(file_name), &properties_raw)) {
-    LOG_ERROR(LOG_TAG, "Error reading controller properties from file.");
+    LOG_ERROR("Error reading controller properties from file.");
     return;
   }
 
   std::unique_ptr<base::Value> properties_value_ptr = base::JSONReader::Read(properties_raw);
-  if (properties_value_ptr.get() == nullptr)
-    LOG_INFO(LOG_TAG, "Error controller properties may consist of ill-formed JSON.");
+  if (properties_value_ptr.get() == nullptr) LOG_INFO("Error controller properties may consist of ill-formed JSON.");
 
   // Get the underlying base::Value object, which is of type
   // base::Value::TYPE_DICTIONARY, and read it into member variables.
@@ -86,7 +94,7 @@
   base::JSONValueConverter<DeviceProperties> converter;
 
   if (!converter.Convert(properties_dictionary, this))
-    LOG_INFO(LOG_TAG, "Error converting JSON properties into Properties object.");
+    LOG_INFO("Error converting JSON properties into Properties object.");
 }
 
 // static
@@ -98,6 +106,7 @@
   converter->RegisterCustomField<uint16_t>(field_name, &DeviceProperties::field, &ParseUint16t);
   REGISTER_UINT16_T("AclDataPacketSize", acl_data_packet_size_);
   REGISTER_UINT8_T("ScoDataPacketSize", sco_data_packet_size_);
+  REGISTER_UINT8_T("EncryptionKeySize", encryption_key_size_);
   REGISTER_UINT16_T("NumAclDataPackets", num_acl_data_packets_);
   REGISTER_UINT16_T("NumScoDataPackets", num_sco_data_packets_);
   REGISTER_UINT8_T("Version", version_);
diff --git a/vendor_libs/test_vendor_lib/model/devices/device_properties.h b/vendor_libs/test_vendor_lib/model/devices/device_properties.h
index 6960553..fed710a 100644
--- a/vendor_libs/test_vendor_lib/model/devices/device_properties.h
+++ b/vendor_libs/test_vendor_lib/model/devices/device_properties.h
@@ -21,6 +21,7 @@
 #include <vector>
 
 #include "base/json/json_value_converter.h"
+#include "os/log.h"
 #include "types/address.h"
 #include "types/class_of_device.h"
 
@@ -55,7 +56,7 @@
   }
 
   uint64_t GetExtendedFeatures(uint8_t page_number) const {
-    CHECK(page_number < extended_features_.size());
+    ASSERT(page_number < extended_features_.size());
     return extended_features_[page_number];
   }
 
@@ -68,6 +69,8 @@
     return sco_data_packet_size_;
   }
 
+  uint8_t GetEncryptionKeySize() const { return encryption_key_size_; }
+
   uint16_t GetTotalNumAclDataPackets() const {
     return num_acl_data_packets_;
   }
@@ -190,6 +193,47 @@
     return le_advertisement_type_;
   }
 
+  uint16_t GetLeAdvertisingIntervalMin() const {
+    return le_advertising_interval_min_;
+  }
+
+  uint16_t GetLeAdvertisingIntervalMax() const {
+    return le_advertising_interval_max_;
+  }
+
+  uint8_t GetLeAdvertisingOwnAddressType() const {
+    return le_advertising_own_address_type_;
+  }
+
+  uint8_t GetLeAdvertisingPeerAddressType() const {
+    return le_advertising_peer_address_type_;
+  }
+
+  Address GetLeAdvertisingPeerAddress() const {
+    return le_advertising_peer_address_;
+  }
+
+  uint8_t GetLeAdvertisingChannelMap() const {
+    return le_advertising_channel_map_;
+  }
+
+  uint8_t GetLeAdvertisingFilterPolicy() const {
+    return le_advertising_filter_policy_;
+  }
+
+  void SetLeAdvertisingParameters(uint16_t interval_min, uint16_t interval_max, uint8_t ad_type,
+                                  uint8_t own_address_type, uint8_t peer_address_type, Address peer_address,
+                                  uint8_t channel_map, uint8_t filter_policy) {
+    le_advertisement_type_ = ad_type;
+    le_advertising_interval_min_ = interval_min;
+    le_advertising_interval_max_ = interval_max;
+    le_advertising_own_address_type_ = own_address_type;
+    le_advertising_peer_address_type_ = peer_address_type;
+    le_advertising_peer_address_ = peer_address;
+    le_advertising_channel_map_ = channel_map;
+    le_advertising_filter_policy_ = filter_policy;
+  }
+
   void SetLeAdvertisementType(uint8_t ad_type) {
     le_advertisement_type_ = ad_type;
   }
@@ -238,6 +282,9 @@
     return le_supported_states_;
   }
 
+  // Specification Version 4.2, Volume 2, Part E, Section 7.8.41
+  uint8_t GetLeResolvingListSize() const { return le_resolving_list_size_; }
+
   // Vendor-specific commands
   const std::vector<uint8_t>& GetLeVendorCap() const {
     return le_vendor_cap_;
@@ -268,16 +315,26 @@
   Address address_;
   uint8_t page_scan_repetition_mode_;
   uint16_t clock_offset_;
+  uint8_t encryption_key_size_;
 
   // Low Energy
   uint16_t le_data_packet_length_;
   uint8_t num_le_data_packets_;
   uint8_t le_white_list_size_;
+  uint8_t le_resolving_list_size_;
   uint64_t le_supported_features_{0x075b3fd8fe8ffeff};
   uint64_t le_supported_states_;
   std::vector<uint8_t> le_vendor_cap_;
   Address le_address_;
   uint8_t le_address_type_;
+
+  uint16_t le_advertising_interval_min_;
+  uint16_t le_advertising_interval_max_;
+  uint8_t le_advertising_own_address_type_;
+  uint8_t le_advertising_peer_address_type_;
+  Address le_advertising_peer_address_;
+  uint8_t le_advertising_channel_map_;
+  uint8_t le_advertising_filter_policy_;
   uint8_t le_advertisement_type_;
   std::vector<uint8_t> le_advertisement_;
   std::vector<uint8_t> le_scan_response_;
diff --git a/vendor_libs/test_vendor_lib/model/devices/h4_packetizer.cc b/vendor_libs/test_vendor_lib/model/devices/h4_packetizer.cc
index 49e8727..3591fbb 100644
--- a/vendor_libs/test_vendor_lib/model/devices/h4_packetizer.cc
+++ b/vendor_libs/test_vendor_lib/model/devices/h4_packetizer.cc
@@ -16,15 +16,14 @@
 
 #include "h4_packetizer.h"
 
-#define LOG_TAG "h4_packetizer"
-
 #include <dlfcn.h>
 #include <errno.h>
 #include <fcntl.h>
-#include <log/log.h>
 #include <sys/uio.h>
 #include <unistd.h>
 
+#include "os/log.h"
+
 namespace test_vendor_lib {
 namespace hci {
 constexpr size_t H4Packetizer::COMMAND_PREAMBLE_SIZE;
@@ -53,8 +52,9 @@
 }
 
 H4Packetizer::H4Packetizer(int fd, PacketReadCallback command_cb, PacketReadCallback event_cb,
-                           PacketReadCallback acl_cb, PacketReadCallback sco_cb)
-    : uart_fd_(fd), command_cb_(command_cb), event_cb_(event_cb), acl_cb_(acl_cb), sco_cb_(sco_cb) {}
+                           PacketReadCallback acl_cb, PacketReadCallback sco_cb, ClientDisconnectCallback disconnect_cb)
+    : uart_fd_(fd), command_cb_(command_cb), event_cb_(event_cb), acl_cb_(acl_cb), sco_cb_(sco_cb),
+      disconnect_cb_(disconnect_cb) {}
 
 size_t H4Packetizer::Send(uint8_t type, const uint8_t* data, size_t length) {
   struct iovec iov[] = {{&type, sizeof(type)}, {const_cast<uint8_t*>(data), length}};
@@ -64,16 +64,15 @@
   } while (-1 == ret && EAGAIN == errno);
 
   if (ret == -1) {
-    ALOGE("%s error writing to UART (%s)", __func__, strerror(errno));
+    LOG_ERROR("%s error writing to UART (%s)", __func__, strerror(errno));
   } else if (ret < static_cast<ssize_t>(length + 1)) {
-    ALOGE("%s: %d / %d bytes written - something went wrong...", __func__, static_cast<int>(ret),
-          static_cast<int>(length + 1));
+    LOG_ERROR("%s: %d / %d bytes written - something went wrong...", __func__, static_cast<int>(ret),
+              static_cast<int>(length + 1));
   }
   return ret;
 }
 
 void H4Packetizer::OnPacketReady() {
-  ALOGE("%s: before switch", __func__);
   switch (hci_packet_type_) {
     case hci::PacketType::COMMAND:
       command_cb_(packet_);
@@ -98,20 +97,19 @@
   if (hci_packet_type_ == hci::PacketType::UNKNOWN) {
     uint8_t buffer[1] = {0};
     ssize_t bytes_read = TEMP_FAILURE_RETRY(read(fd, buffer, 1));
-    if (bytes_read != 1) {
-      if (bytes_read == 0) {
-        ALOGI("%s: Nothing ready, will retry!", __func__);
+    if (bytes_read == 0) {
+      LOG_INFO("%s: remote disconnected!", __func__);
+      disconnect_cb_();
+      return;
+    } else if (bytes_read < 0) {
+      if (errno == EAGAIN) {
+        // No data, try again later.
         return;
-      } else if (bytes_read < 0) {
-        if (errno == EAGAIN) {
-          // No data, try again later.
-          return;
-        } else {
-          LOG_ALWAYS_FATAL("%s: Read packet type error: %s", __func__, strerror(errno));
-        }
       } else {
-        LOG_ALWAYS_FATAL("%s: More bytes read than expected (%u)!", __func__, static_cast<unsigned int>(bytes_read));
+        LOG_ALWAYS_FATAL("%s: Read packet type error: %s", __func__, strerror(errno));
       }
+    } else if (bytes_read > 1) {
+      LOG_ALWAYS_FATAL("%s: More bytes read than expected (%u)!", __func__, static_cast<unsigned int>(bytes_read));
     }
     hci_packet_type_ = static_cast<hci::PacketType>(buffer[0]);
     if (hci_packet_type_ != hci::PacketType::ACL && hci_packet_type_ != hci::PacketType::SCO &&
@@ -132,7 +130,7 @@
         size_t preamble_bytes = preamble_size[static_cast<size_t>(hci_packet_type_)];
         ssize_t bytes_read = TEMP_FAILURE_RETRY(read(fd, preamble_ + bytes_read_, preamble_bytes - bytes_read_));
         if (bytes_read == 0) {
-          ALOGE("%s: Will try again to read the header!", __func__);
+          LOG_ERROR("%s: Will try again to read the header!", __func__);
           return;
         }
         if (bytes_read < 0) {
@@ -147,8 +145,6 @@
           size_t packet_length = HciGetPacketLengthForType(hci_packet_type_, preamble_);
           packet_.resize(preamble_bytes + packet_length);
           memcpy(packet_.data(), preamble_, preamble_bytes);
-          ALOGI("%s: Read a preamble of size %d length %d %0x %0x %0x", __func__, static_cast<int>(bytes_read_),
-                static_cast<int>(packet_length), preamble_[0], preamble_[1], preamble_[2]);
           bytes_remaining_ = packet_length;
           if (bytes_remaining_ == 0) {
             OnPacketReady();
@@ -167,7 +163,7 @@
         ssize_t bytes_read =
             TEMP_FAILURE_RETRY(read(fd, packet_.data() + preamble_bytes + bytes_read_, bytes_remaining_));
         if (bytes_read == 0) {
-          ALOGI("%s: Will try again to read the payload!", __func__);
+          LOG_INFO("%s: Will try again to read the payload!", __func__);
           return;
         }
         if (bytes_read < 0) {
diff --git a/vendor_libs/test_vendor_lib/model/devices/h4_packetizer.h b/vendor_libs/test_vendor_lib/model/devices/h4_packetizer.h
index f81cf77..c8b7917 100644
--- a/vendor_libs/test_vendor_lib/model/devices/h4_packetizer.h
+++ b/vendor_libs/test_vendor_lib/model/devices/h4_packetizer.h
@@ -26,11 +26,12 @@
 namespace hci {
 
 using HciPacketReadyCallback = std::function<void(void)>;
+using ClientDisconnectCallback = std::function<void()>;
 
 class H4Packetizer : public HciProtocol {
  public:
   H4Packetizer(int fd, PacketReadCallback command_cb, PacketReadCallback event_cb, PacketReadCallback acl_cb,
-               PacketReadCallback sco_cb);
+               PacketReadCallback sco_cb, ClientDisconnectCallback disconnect_cb);
 
   size_t Send(uint8_t type, const uint8_t* data, size_t length);
 
@@ -46,6 +47,8 @@
   PacketReadCallback acl_cb_;
   PacketReadCallback sco_cb_;
 
+  ClientDisconnectCallback disconnect_cb_;
+
   hci::PacketType hci_packet_type_{hci::PacketType::UNKNOWN};
 
   // 2 bytes for opcode, 1 byte for parameter length (Volume 2, Part E, 5.4.1)
diff --git a/vendor_libs/test_vendor_lib/model/devices/h4_protocol.cc b/vendor_libs/test_vendor_lib/model/devices/h4_protocol.cc
index c4704ea..7ba432d 100644
--- a/vendor_libs/test_vendor_lib/model/devices/h4_protocol.cc
+++ b/vendor_libs/test_vendor_lib/model/devices/h4_protocol.cc
@@ -16,14 +16,13 @@
 
 #include "h4_protocol.h"
 
-#define LOG_TAG "hci-h4_protocol"
-
 #include <errno.h>
 #include <fcntl.h>
-#include <log/log.h>
 #include <sys/uio.h>
 #include <unistd.h>
 
+#include "os/log.h"
+
 namespace test_vendor_lib {
 namespace hci {
 
@@ -31,7 +30,7 @@
                        PacketReadCallback sco_cb)
     : uart_fd_(fd), command_cb_(command_cb), event_cb_(event_cb), acl_cb_(acl_cb), sco_cb_(sco_cb),
       hci_packetizer_([this]() {
-        ALOGI("in lambda");
+        LOG_INFO("in lambda");
         this->OnPacketReady();
       }) {}
 
@@ -43,16 +42,16 @@
   } while (-1 == ret && EAGAIN == errno);
 
   if (ret == -1) {
-    ALOGE("%s error writing to UART (%s)", __func__, strerror(errno));
+    LOG_ERROR("%s error writing to UART (%s)", __func__, strerror(errno));
   } else if (ret < static_cast<ssize_t>(length + 1)) {
-    ALOGE("%s: %d / %d bytes written - something went wrong...", __func__, static_cast<int>(ret),
-          static_cast<int>(length + 1));
+    LOG_ERROR("%s: %d / %d bytes written - something went wrong...", __func__, static_cast<int>(ret),
+              static_cast<int>(length + 1));
   }
   return ret;
 }
 
 void H4Protocol::OnPacketReady() {
-  ALOGE("%s: before switch", __func__);
+  LOG_ERROR("%s: before switch", __func__);
   switch (hci_packet_type_) {
     case hci::PacketType::COMMAND:
       command_cb_(hci_packetizer_.GetPacket());
@@ -79,7 +78,7 @@
     ssize_t bytes_read = TEMP_FAILURE_RETRY(read(fd, buffer, 1));
     if (bytes_read != 1) {
       if (bytes_read == 0) {
-        ALOGI("%s: Nothing ready, will retry!", __func__);
+        LOG_INFO("%s: Nothing ready, will retry!", __func__);
         return;
       } else if (bytes_read < 0) {
         if (errno == EAGAIN) {
diff --git a/vendor_libs/test_vendor_lib/model/devices/hci_packetizer.cc b/vendor_libs/test_vendor_lib/model/devices/hci_packetizer.cc
index cca7780..e0c4e4a 100644
--- a/vendor_libs/test_vendor_lib/model/devices/hci_packetizer.cc
+++ b/vendor_libs/test_vendor_lib/model/devices/hci_packetizer.cc
@@ -16,14 +16,13 @@
 
 #include "hci_packetizer.h"
 
-#define LOG_TAG "hci_packetizer"
-
 #include <dlfcn.h>
 #include <errno.h>
 #include <fcntl.h>
-#include <log/log.h>
 #include <unistd.h>
 
+#include "os/log.h"
+
 namespace test_vendor_lib {
 namespace hci {
 constexpr size_t HciPacketizer::COMMAND_PREAMBLE_SIZE;
@@ -69,7 +68,7 @@
       ssize_t bytes_read = TEMP_FAILURE_RETRY(
           read(fd, preamble_ + bytes_read_, preamble_size[static_cast<uint8_t>(packet_type)] - bytes_read_));
       if (bytes_read == 0) {
-        ALOGE("%s: Will try again to read the header!", __func__);
+        LOG_ERROR("%s: Will try again to read the header!", __func__);
         return;
       }
       if (bytes_read < 0) {
@@ -77,15 +76,15 @@
         if (errno == EAGAIN) {
           return;
         }
-        LOG_ALWAYS_FATAL("%s: Read header error: %s", __func__, strerror(errno));
+        LOG_ALWAYS_FATAL("Read header error: %s", strerror(errno));
       }
       bytes_read_ += bytes_read;
       if (bytes_read_ == preamble_size[static_cast<uint8_t>(packet_type)]) {
         size_t packet_length = HciGetPacketLengthForType(packet_type, preamble_);
         packet_.resize(preamble_size[static_cast<uint8_t>(packet_type)] + packet_length);
         memcpy(packet_.data(), preamble_, preamble_size[static_cast<uint8_t>(packet_type)]);
-        ALOGI("%s: Read a preamble of size %d length %d %0x %0x %0x", __func__, static_cast<int>(bytes_read_),
-              static_cast<int>(packet_length), preamble_[0], preamble_[1], preamble_[2]);
+        LOG_INFO("%s: Read a preamble of size %d length %d %0x %0x %0x", __func__, static_cast<int>(bytes_read_),
+                 static_cast<int>(packet_length), preamble_[0], preamble_[1], preamble_[2]);
         bytes_remaining_ = packet_length;
         if (bytes_remaining_ == 0) {
           packet_ready_cb_();
@@ -103,7 +102,7 @@
       ssize_t bytes_read = TEMP_FAILURE_RETRY(
           read(fd, packet_.data() + preamble_size[static_cast<uint8_t>(packet_type)] + bytes_read_, bytes_remaining_));
       if (bytes_read == 0) {
-        ALOGI("%s: Will try again to read the payload!", __func__);
+        LOG_INFO("Will try again to read the payload!");
         return;
       }
       if (bytes_read < 0) {
@@ -111,7 +110,7 @@
         if (errno == EAGAIN) {
           return;
         }
-        LOG_ALWAYS_FATAL("%s: Read payload error: %s", __func__, strerror(errno));
+        LOG_ALWAYS_FATAL("Read payload error: %s", strerror(errno));
       }
       bytes_remaining_ -= bytes_read;
       bytes_read_ += bytes_read;
diff --git a/vendor_libs/test_vendor_lib/model/devices/hci_protocol.cc b/vendor_libs/test_vendor_lib/model/devices/hci_protocol.cc
index e01bfa5..d2ef535 100644
--- a/vendor_libs/test_vendor_lib/model/devices/hci_protocol.cc
+++ b/vendor_libs/test_vendor_lib/model/devices/hci_protocol.cc
@@ -16,13 +16,13 @@
 
 #include "hci_protocol.h"
 
-#define LOG_TAG "hci-hci_protocol"
 #include <assert.h>
 #include <errno.h>
 #include <fcntl.h>
-#include <log/log.h>
 #include <unistd.h>
 
+#include "os/log.h"
+
 namespace test_vendor_lib {
 namespace hci {
 
@@ -33,12 +33,12 @@
 
     if (ret == -1) {
       if (errno == EAGAIN) continue;
-      ALOGE("%s error writing to UART (%s)", __func__, strerror(errno));
+      LOG_ERROR("%s error writing to UART (%s)", __func__, strerror(errno));
       break;
 
     } else if (ret == 0) {
       // Nothing written :(
-      ALOGE("%s zero bytes written - something went wrong...", __func__);
+      LOG_ERROR("%s zero bytes written - something went wrong...", __func__);
       break;
     }
 
diff --git a/vendor_libs/test_vendor_lib/model/devices/hci_socket_device.cc b/vendor_libs/test_vendor_lib/model/devices/hci_socket_device.cc
index e146fcc..c94a964 100644
--- a/vendor_libs/test_vendor_lib/model/devices/hci_socket_device.cc
+++ b/vendor_libs/test_vendor_lib/model/devices/hci_socket_device.cc
@@ -14,24 +14,21 @@
  * limitations under the License.
  */
 
-#define LOG_TAG "hci_socket_device"
-
 #include "hci_socket_device.h"
 
 #include <fcntl.h>
 #include <netinet/in.h>
 #include <sys/socket.h>
 
-#include "osi/include/log.h"
-
 #include "model/setup/device_boutique.h"
+#include "os/log.h"
 
 using std::vector;
 
 namespace test_vendor_lib {
 
 HciSocketDevice::HciSocketDevice(int file_descriptor) : socket_file_descriptor_(file_descriptor) {
-  advertising_interval_ms_ = std::chrono::milliseconds(0);
+  advertising_interval_ms_ = std::chrono::milliseconds(1000);
 
   page_scan_delay_ms_ = std::chrono::milliseconds(600);
 
@@ -77,57 +74,53 @@
   h4_ = hci::H4Packetizer(
       socket_file_descriptor_,
       [this](const std::vector<uint8_t>& raw_command) {
-        LOG_INFO(LOG_TAG, "Rx Command");
         std::shared_ptr<std::vector<uint8_t>> packet_copy = std::make_shared<std::vector<uint8_t>>(raw_command);
         HandleCommand(packet_copy);
       },
-      [](const std::vector<uint8_t>&) { CHECK(false) << "Unexpected Event in HciSocketDevice!"; },
+      [](const std::vector<uint8_t>&) { LOG_ALWAYS_FATAL("Unexpected Event in HciSocketDevice!"); },
       [this](const std::vector<uint8_t>& raw_acl) {
-        LOG_INFO(LOG_TAG, "Rx ACL");
         std::shared_ptr<std::vector<uint8_t>> packet_copy = std::make_shared<std::vector<uint8_t>>(raw_acl);
         HandleAcl(packet_copy);
       },
       [this](const std::vector<uint8_t>& raw_sco) {
-        LOG_INFO(LOG_TAG, "Rx SCO");
         std::shared_ptr<std::vector<uint8_t>> packet_copy = std::make_shared<std::vector<uint8_t>>(raw_sco);
         HandleSco(packet_copy);
+      },
+      [this]() {
+        LOG_INFO("HCI socket device disconnected");
+        close_callback_();
       });
 
-  RegisterEventChannel([this](std::shared_ptr<std::vector<uint8_t>> packet) {
-    LOG_INFO(LOG_TAG, "Tx Event");
-    SendHci(hci::PacketType::EVENT, packet);
-  });
-  RegisterAclChannel([this](std::shared_ptr<std::vector<uint8_t>> packet) {
-    LOG_INFO(LOG_TAG, "Tx ACL");
-    SendHci(hci::PacketType::ACL, packet);
-  });
-  RegisterScoChannel([this](std::shared_ptr<std::vector<uint8_t>> packet) {
-    LOG_INFO(LOG_TAG, "Tx SCO");
-    SendHci(hci::PacketType::SCO, packet);
-  });
+  RegisterEventChannel(
+      [this](std::shared_ptr<std::vector<uint8_t>> packet) { SendHci(hci::PacketType::EVENT, packet); });
+  RegisterAclChannel([this](std::shared_ptr<std::vector<uint8_t>> packet) { SendHci(hci::PacketType::ACL, packet); });
+  RegisterScoChannel([this](std::shared_ptr<std::vector<uint8_t>> packet) { SendHci(hci::PacketType::SCO, packet); });
 }
 
 void HciSocketDevice::TimerTick() {
-  LOG_INFO(LOG_TAG, "TimerTick fd = %d", socket_file_descriptor_);
   h4_.OnDataReady(socket_file_descriptor_);
   DualModeController::TimerTick();
 }
 
 void HciSocketDevice::SendHci(hci::PacketType packet_type, const std::shared_ptr<std::vector<uint8_t>> packet) {
   if (socket_file_descriptor_ == -1) {
-    LOG_INFO(LOG_TAG, "socket_file_descriptor == -1");
+    LOG_INFO("socket_file_descriptor == -1");
     return;
   }
   uint8_t type = static_cast<uint8_t>(packet_type);
   int bytes_written;
   bytes_written = write(socket_file_descriptor_, &type, sizeof(type));
   if (bytes_written != sizeof(type)) {
-    LOG_INFO(LOG_TAG, "bytes_written %d != sizeof(type)", bytes_written);
+    LOG_WARN("bytes_written %d != sizeof(type)", bytes_written);
   }
   bytes_written = write(socket_file_descriptor_, packet->data(), packet->size());
   if (static_cast<size_t>(bytes_written) != packet->size()) {
-    LOG_INFO(LOG_TAG, "bytes_written %d != packet->size", bytes_written);
+    LOG_WARN("bytes_written %d != packet->size", bytes_written);
   }
 }
 
+void HciSocketDevice::RegisterCloseCallback(std::function<void()> close_callback) {
+  close_callback_ = close_callback;
+}
+
 }  // namespace test_vendor_lib
diff --git a/vendor_libs/test_vendor_lib/model/devices/hci_socket_device.h b/vendor_libs/test_vendor_lib/model/devices/hci_socket_device.h
index 11eddae..0a3bb3b 100644
--- a/vendor_libs/test_vendor_lib/model/devices/hci_socket_device.h
+++ b/vendor_libs/test_vendor_lib/model/devices/hci_socket_device.h
@@ -45,10 +45,18 @@
 
   void SendHci(hci::PacketType packet_type, const std::shared_ptr<std::vector<uint8_t>> packet);
 
+  void RegisterCloseCallback(std::function<void()>);
+
  private:
   int socket_file_descriptor_{-1};
-  hci::H4Packetizer h4_{socket_file_descriptor_, [](const std::vector<uint8_t>&) {}, [](const std::vector<uint8_t>&) {},
-                        [](const std::vector<uint8_t>&) {}, [](const std::vector<uint8_t>&) {}};
+  hci::H4Packetizer h4_{socket_file_descriptor_,
+                        [](const std::vector<uint8_t>&) {},
+                        [](const std::vector<uint8_t>&) {},
+                        [](const std::vector<uint8_t>&) {},
+                        [](const std::vector<uint8_t>&) {},
+                        [] {}};
+
+  std::function<void()> close_callback_;
 };
 
 }  // namespace test_vendor_lib
diff --git a/vendor_libs/test_vendor_lib/model/devices/keyboard.cc b/vendor_libs/test_vendor_lib/model/devices/keyboard.cc
index 2cfc992..1daa05d 100644
--- a/vendor_libs/test_vendor_lib/model/devices/keyboard.cc
+++ b/vendor_libs/test_vendor_lib/model/devices/keyboard.cc
@@ -14,8 +14,6 @@
  * limitations under the License.
  */
 
-#define LOG_TAG "keyboard"
-
 #include "keyboard.h"
 
 #include "model/setup/device_boutique.h"
@@ -23,12 +21,12 @@
 using std::vector;
 
 namespace test_vendor_lib {
-bool Keyboard::registered_ = DeviceBoutique::Register(LOG_TAG, &Keyboard::Create);
+bool Keyboard::registered_ = DeviceBoutique::Register("keyboard", &Keyboard::Create);
 
 Keyboard::Keyboard() {
-  properties_.SetLeAdvertisementType(BTM_BLE_CONNECT_EVT);
+  properties_.SetLeAdvertisementType(0x00 /* CONNECTABLE */);
   properties_.SetLeAdvertisement({0x11,  // Length
-                                  BTM_BLE_AD_TYPE_NAME_CMPL,
+                                  0x09 /* TYPE_NAME_CMPL */,
                                   'g',
                                   'D',
                                   'e',
@@ -54,11 +52,11 @@
                                   0x12,
                                   0x18,
                                   0x02,  // Length
-                                  BTM_BLE_AD_TYPE_FLAG,
-                                  BTM_BLE_BREDR_NOT_SPT | BTM_BLE_GEN_DISC_FLAG});
+                                  0x01 /* TYPE_FLAGS */,
+                                  0x04 /* BREDR_NOT_SPT */ | 0x02 /* GEN_DISC_FLAG */});
 
   properties_.SetLeScanResponse({0x04,  // Length
-                                 BTM_BLE_AD_TYPE_NAME_SHORT, 'k', 'e', 'y'});
+                                 0x08 /* TYPE_NAME_SHORT */, 'k', 'e', 'y'});
 }
 
 std::string Keyboard::GetTypeString() const {
diff --git a/vendor_libs/test_vendor_lib/model/devices/link_layer_socket_device.cc b/vendor_libs/test_vendor_lib/model/devices/link_layer_socket_device.cc
index 9ccfd61..99f0c9d 100644
--- a/vendor_libs/test_vendor_lib/model/devices/link_layer_socket_device.cc
+++ b/vendor_libs/test_vendor_lib/model/devices/link_layer_socket_device.cc
@@ -14,13 +14,10 @@
  * limitations under the License.
  */
 
-#define LOG_TAG "link_layer_socket_device"
-
 #include "link_layer_socket_device.h"
 
 #include <unistd.h>
 
-#include "osi/include/log.h"
 #include "packets/link_layer/link_layer_packet_builder.h"
 #include "packets/link_layer/link_layer_packet_view.h"
 #include "packets/packet_view.h"
@@ -40,7 +37,7 @@
     if (bytes_received == 0) {
       return;
     }
-    CHECK(bytes_received == Link::kSizeBytes) << "bytes_received == " << bytes_received;
+    ASSERT_LOG(bytes_received == Link::kSizeBytes, "bytes_received == %d", static_cast<int>(bytes_received));
     packets::PacketView<true> size({packets::View(received_, 0, Link::kSizeBytes)});
     bytes_left_ = size.begin().extract<uint32_t>();
     received_->resize(Link::kSizeBytes + bytes_left_);
diff --git a/vendor_libs/test_vendor_lib/model/devices/loopback.cc b/vendor_libs/test_vendor_lib/model/devices/loopback.cc
index 4d9078e..18af1c1 100644
--- a/vendor_libs/test_vendor_lib/model/devices/loopback.cc
+++ b/vendor_libs/test_vendor_lib/model/devices/loopback.cc
@@ -14,47 +14,33 @@
  * limitations under the License.
  */
 
-#define LOG_TAG "loopback"
-
 #include "loopback.h"
 
 #include "le_advertisement.h"
 #include "model/setup/device_boutique.h"
-#include "osi/include/log.h"
+#include "os/log.h"
 
 using std::vector;
 
 namespace test_vendor_lib {
 
-bool Loopback::registered_ = DeviceBoutique::Register(LOG_TAG, &Loopback::Create);
+bool Loopback::registered_ = DeviceBoutique::Register("loopback", &Loopback::Create);
 
 Loopback::Loopback() {
   advertising_interval_ms_ = std::chrono::milliseconds(1280);
-  properties_.SetLeAdvertisementType(BTM_BLE_NON_CONNECT_EVT);
-  properties_.SetLeAdvertisement({0x11,  // Length
-                                  BTM_BLE_AD_TYPE_NAME_CMPL,
-                                  'g',
-                                  'D',
-                                  'e',
-                                  'v',
-                                  'i',
-                                  'c',
-                                  'e',
-                                  '-',
-                                  'l',
-                                  'o',
-                                  'o',
-                                  'p',
-                                  'b',
-                                  'a',
-                                  'c',
-                                  'k',
-                                  0x02,  // Length
-                                  BTM_BLE_AD_TYPE_FLAG,
-                                  BTM_BLE_BREDR_NOT_SPT | BTM_BLE_GEN_DISC_FLAG});
+  properties_.SetLeAdvertisementType(0x03);  // NON_CONNECT
+  properties_.SetLeAdvertisement({
+      0x11,  // Length
+      0x09,  // NAME_CMPL
+      'g',         'D', 'e', 'v', 'i', 'c', 'e', '-', 'l', 'o', 'o', 'p', 'b', 'a', 'c', 'k',
+      0x02,         // Length
+      0x01,         // TYPE_FLAG
+      0x04 | 0x02,  // BREDR_NOT_SPT | GEN_DISC
+  });
 
   properties_.SetLeScanResponse({0x05,  // Length
-                                 BTM_BLE_AD_TYPE_NAME_SHORT, 'l', 'o', 'o', 'p'});
+                                 0x08,  // NAME_SHORT
+                                 'l', 'o', 'o', 'p'});
 }
 
 std::string Loopback::GetTypeString() const {
@@ -81,9 +67,9 @@
 void Loopback::TimerTick() {}
 
 void Loopback::IncomingPacket(packets::LinkLayerPacketView packet) {
-  LOG_INFO(LOG_TAG, "Got a packet of type %d", static_cast<int>(packet.GetType()));
+  LOG_INFO("Got a packet of type %d", static_cast<int>(packet.GetType()));
   if (packet.GetDestinationAddress() == properties_.GetLeAddress() && packet.GetType() == Link::PacketType::LE_SCAN) {
-    LOG_INFO(LOG_TAG, "Got a scan");
+    LOG_INFO("Got a scan");
     std::unique_ptr<packets::LeAdvertisementBuilder> scan_response = packets::LeAdvertisementBuilder::Create(
         LeAdvertisement::AddressType::PUBLIC, LeAdvertisement::AdvertisementType::SCAN_RESPONSE,
         properties_.GetLeScanResponse());
@@ -91,7 +77,7 @@
         std::move(scan_response), properties_.GetLeAddress(), packet.GetSourceAddress());
     std::vector<std::shared_ptr<PhyLayer>> le_phys = phy_layers_[Phy::Type::LOW_ENERGY];
     for (auto phy : le_phys) {
-      LOG_INFO(LOG_TAG, "Sending a Scan Response on a Phy");
+      LOG_INFO("Sending a Scan Response on a Phy");
       phy->Send(to_send);
     }
   }
diff --git a/vendor_libs/test_vendor_lib/model/devices/polled_socket.cc b/vendor_libs/test_vendor_lib/model/devices/polled_socket.cc
index 5719132..2f96665 100644
--- a/vendor_libs/test_vendor_lib/model/devices/polled_socket.cc
+++ b/vendor_libs/test_vendor_lib/model/devices/polled_socket.cc
@@ -14,11 +14,8 @@
  * limitations under the License.
  */
 
-#define LOG_TAG "polled_socket"
-
 #include "polled_socket.h"
 
-#include <base/logging.h>
 #include <fcntl.h>
 #include <netdb.h>
 #include <netinet/in.h>
@@ -26,7 +23,7 @@
 #include <sys/types.h>
 #include <sys/uio.h>
 
-#include "osi/include/log.h"
+#include "os/log.h"
 
 namespace test_vendor_lib {
 namespace net {
@@ -60,7 +57,7 @@
   }
   int ret = write(file_descriptor_, copy.data(), copy.size());
   if (ret == -1) {
-    ALOGW("%s error %s", __func__, strerror(errno));
+    LOG_WARN("%s error %s", __func__, strerror(errno));
     return 0;
   } else {
     return static_cast<size_t>(ret);
@@ -100,7 +97,7 @@
     if (errno == EAGAIN) {
       return 0;
     } else {
-      ALOGW("%s error %s", __func__, strerror(errno));
+      LOG_WARN("%s error %s", __func__, strerror(errno));
       CleanUp();
       return 0;
     }
diff --git a/vendor_libs/test_vendor_lib/model/devices/remote_loopback_device.cc b/vendor_libs/test_vendor_lib/model/devices/remote_loopback_device.cc
index 787e2f7..82cf04f 100644
--- a/vendor_libs/test_vendor_lib/model/devices/remote_loopback_device.cc
+++ b/vendor_libs/test_vendor_lib/model/devices/remote_loopback_device.cc
@@ -14,13 +14,10 @@
  * limitations under the License.
  */
 
-#define LOG_TAG "remote_loopback_device"
-
 #include "remote_loopback_device.h"
 
 #include "model/setup/device_boutique.h"
-
-#include "osi/include/log.h"
+#include "os/log.h"
 #include "packets/link_layer/link_layer_packet_builder.h"
 #include "packets/link_layer/link_layer_packet_view.h"
 
@@ -32,7 +29,7 @@
 using packets::LinkLayerPacketView;
 using packets::PageResponseBuilder;
 
-bool RemoteLoopbackDevice::registered_ = DeviceBoutique::Register(LOG_TAG, &RemoteLoopbackDevice::Create);
+bool RemoteLoopbackDevice::registered_ = DeviceBoutique::Register("remote_loopback", &RemoteLoopbackDevice::Create);
 
 RemoteLoopbackDevice::RemoteLoopbackDevice() {}
 
@@ -60,7 +57,7 @@
                           Phy::Type::BR_EDR);
       break;
     default: {
-      ALOGW("Resend = %d", static_cast<int>(packet.size()));
+      LOG_WARN("Resend = %d", static_cast<int>(packet.size()));
       std::shared_ptr<std::vector<uint8_t>> extracted_packet = std::make_shared<std::vector<uint8_t>>();
       extracted_packet->reserve(packet.size());
       for (const auto byte : packet) {
diff --git a/vendor_libs/test_vendor_lib/model/devices/server_port_factory.cc b/vendor_libs/test_vendor_lib/model/devices/server_port_factory.cc
index 72008a6..b0b2165 100644
--- a/vendor_libs/test_vendor_lib/model/devices/server_port_factory.cc
+++ b/vendor_libs/test_vendor_lib/model/devices/server_port_factory.cc
@@ -14,13 +14,9 @@
  * limitations under the License.
  */
 
-#define LOG_TAG "server_port_factory"
-
 #include "server_port_factory.h"
 
-#include <base/logging.h>
-
-#include "osi/include/log.h"
+#include "os/log.h"
 #include "osi/include/osi.h"
 
 #include <netinet/in.h>
@@ -43,23 +39,23 @@
 
   OSI_NO_INTR(listen_fd_ = socket(AF_INET, SOCK_STREAM, 0));
   if (listen_fd_ < 0) {
-    LOG_INFO(LOG_TAG, "Error creating socket for test channel.");
+    LOG_INFO("Error creating socket for test channel.");
     return -1;
   }
 
-  LOG_INFO(LOG_TAG, "port: %d", port);
+  LOG_INFO("port: %d", port);
   listen_address.sin_family = AF_INET;
   listen_address.sin_port = htons(port);
   listen_address.sin_addr.s_addr = htonl(INADDR_ANY);
 
   if (bind(listen_fd_, reinterpret_cast<sockaddr*>(&listen_address), sockaddr_in_size) < 0) {
-    LOG_INFO(LOG_TAG, "Error binding test channel listener socket to address.");
+    LOG_INFO("Error binding test channel listener socket to address.");
     close(listen_fd_);
     return -1;
   }
 
   if (listen(listen_fd_, 1) < 0) {
-    LOG_INFO(LOG_TAG, "Error listening for test channel.");
+    LOG_INFO("Error listening for test channel.");
     close(listen_fd_);
     return -1;
   }
@@ -71,7 +67,7 @@
     return;
   }
   if (close(listen_fd_)) {
-    LOG_ERROR(LOG_TAG, "Error closing listen_fd_.");
+    LOG_ERROR("Error closing listen_fd_.");
   }
   listen_fd_ = -1;
 }
@@ -84,16 +80,16 @@
 
   OSI_NO_INTR(accept_fd = accept(listen_fd_, reinterpret_cast<sockaddr*>(&test_channel_address), &sockaddr_in_size));
   if (accept_fd < 0) {
-    LOG_INFO(LOG_TAG, "Error accepting test channel connection errno=%d (%s).", errno, strerror(errno));
+    LOG_INFO("Error accepting test channel connection errno=%d (%s).", errno, strerror(errno));
 
     if (errno != EAGAIN && errno != EWOULDBLOCK) {
-      LOG_ERROR(LOG_TAG, "Closing listen_fd_ (won't try again).");
+      LOG_ERROR("Closing listen_fd_ (won't try again).");
       close(listen_fd_);
       return -1;
     }
   }
 
-  LOG_INFO(LOG_TAG, "accept_fd = %d.", accept_fd);
+  LOG_INFO("accept_fd = %d.", accept_fd);
 
   return accept_fd;
 }
@@ -107,7 +103,7 @@
   std::string command_name(command_name_raw.begin(), command_name_raw.end());
 
   if (command_name == "CLOSE_TEST_CHANNEL" || command_name == "") {
-    LOG_INFO(LOG_TAG, "Test channel closed");
+    LOG_INFO("Test channel closed");
     unwatch();
     close(fd);
     return;
@@ -137,9 +133,9 @@
   char size_buf[4] = {static_cast<uint8_t>(size & 0xff), static_cast<uint8_t>((size >> 8) & 0xff),
                       static_cast<uint8_t>((size >> 16) & 0xff), static_cast<uint8_t>((size >> 24) & 0xff)};
   int written = write(fd, size_buf, 4);
-  CHECK(written == 4) << "What happened? written = " << written << "errno =" << errno;
+  ASSERT_LOG(written == 4, "What happened? written = %d errno = %d", written, errno);
   written = write(fd, response.c_str(), size);
-  CHECK(written == static_cast<int>(size)) << "What happened? written = " << written << "errno =" << errno;
+  ASSERT_LOG(written == static_cast<int>(size), "What happened? written = %d errno = %d", written, errno);
 }
 
 void ServerPortFactory::RegisterCommandHandler(
diff --git a/vendor_libs/test_vendor_lib/model/devices/sniffer.cc b/vendor_libs/test_vendor_lib/model/devices/sniffer.cc
index 903ecac..ba47893 100644
--- a/vendor_libs/test_vendor_lib/model/devices/sniffer.cc
+++ b/vendor_libs/test_vendor_lib/model/devices/sniffer.cc
@@ -14,19 +14,16 @@
  * limitations under the License.
  */
 
-#define LOG_TAG "sniffer"
-
 #include "sniffer.h"
 
-#include "osi/include/log.h"
-
 #include "model/setup/device_boutique.h"
+#include "os/log.h"
 
 using std::vector;
 
 namespace test_vendor_lib {
 
-bool Sniffer::registered_ = DeviceBoutique::Register(LOG_TAG, &Sniffer::Create);
+bool Sniffer::registered_ = DeviceBoutique::Register("sniffer", &Sniffer::Create);
 
 Sniffer::Sniffer() {}
 
@@ -50,8 +47,8 @@
   if (!match_source && !match_dest) {
     return;
   }
-  LOG_INFO(LOG_TAG, "%s %s -> %s (Type %d)", (match_source ? (match_dest ? "<->" : "<--") : "-->"),
-           source.ToString().c_str(), dest.ToString().c_str(), static_cast<int>(packet.GetType()));
+  LOG_INFO("%s %s -> %s (Type %d)", (match_source ? (match_dest ? "<->" : "<--") : "-->"), source.ToString().c_str(),
+           dest.ToString().c_str(), static_cast<int>(packet.GetType()));
 }
 
 }  // namespace test_vendor_lib
diff --git a/vendor_libs/test_vendor_lib/model/setup/async_manager.cc b/vendor_libs/test_vendor_lib/model/setup/async_manager.cc
index fb9b1ad..092271d 100644
--- a/vendor_libs/test_vendor_lib/model/setup/async_manager.cc
+++ b/vendor_libs/test_vendor_lib/model/setup/async_manager.cc
@@ -14,19 +14,17 @@
  * limitations under the License.
  */
 
-#define LOG_TAG "async_manager"
-
 #include "async_manager.h"
 
-#include "osi/include/log.h"
-
 #include <algorithm>
 #include <atomic>
 #include <condition_variable>
 #include <mutex>
 #include <thread>
 #include <vector>
+
 #include "fcntl.h"
+#include "os/log.h"
 #include "sys/select.h"
 #include "unistd.h"
 
@@ -105,7 +103,7 @@
     // start the thread if not started yet
     int started = tryStartThread();
     if (started != 0) {
-      LOG_ERROR(LOG_TAG, "%s: Unable to start thread", __func__);
+      LOG_ERROR("%s: Unable to start thread", __func__);
       return started;
     }
 
@@ -134,7 +132,7 @@
     if (std::this_thread::get_id() != thread_.get_id()) {
       thread_.join();
     } else {
-      LOG_WARN(LOG_TAG, "%s: Starting thread stop from inside the reading thread itself", __func__);
+      LOG_WARN("%s: Starting thread stop from inside the reading thread itself", __func__);
     }
 
     {
@@ -158,10 +156,10 @@
     // set up the communication channel
     int pipe_fds[2];
     if (pipe2(pipe_fds, O_NONBLOCK)) {
-      LOG_ERROR(LOG_TAG,
-                "%s:Unable to establish a communication channel to the reading "
-                "thread",
-                __func__);
+      LOG_ERROR(
+          "%s:Unable to establish a communication channel to the reading "
+          "thread",
+          __func__);
       return -1;
     }
     notification_listen_fd_ = pipe_fds[0];
@@ -169,7 +167,7 @@
 
     thread_ = std::thread([this]() { ThreadRoutine(); });
     if (!thread_.joinable()) {
-      LOG_ERROR(LOG_TAG, "%s: Unable to start reading thread", __func__);
+      LOG_ERROR("%s: Unable to start reading thread", __func__);
       return -1;
     }
     return 0;
@@ -178,7 +176,7 @@
   int notifyThread() {
     char buffer = '0';
     if (TEMP_FAILURE_RETRY(write(notification_write_fd_, &buffer, 1)) < 0) {
-      LOG_ERROR(LOG_TAG, "%s: Unable to send message to reading thread", __func__);
+      LOG_ERROR("%s: Unable to send message to reading thread", __func__);
       return -1;
     }
     return 0;
@@ -239,10 +237,10 @@
       // wait until there is data available to read on some FD
       int retval = select(nfds + 1, &read_fds, NULL, NULL, NULL);
       if (retval <= 0) {  // there was some error or a timeout
-        LOG_ERROR(LOG_TAG,
-                  "%s: There was an error while waiting for data on the file "
-                  "descriptors: %s",
-                  __func__, strerror(errno));
+        LOG_ERROR(
+            "%s: There was an error while waiting for data on the file "
+            "descriptors: %s",
+            __func__, strerror(errno));
         continue;
       }
 
@@ -310,7 +308,7 @@
     if (std::this_thread::get_id() != thread_.get_id()) {
       thread_.join();
     } else {
-      LOG_WARN(LOG_TAG, "%s: Starting thread stop from inside the task thread itself", __func__);
+      LOG_WARN("%s: Starting thread stop from inside the task thread itself", __func__);
     }
     return 0;
   }
@@ -371,7 +369,7 @@
     // start thread if necessary
     int started = tryStartThread();
     if (started != 0) {
-      LOG_ERROR(LOG_TAG, "%s: Unable to start thread", __func__);
+      LOG_ERROR("%s: Unable to start thread", __func__);
       return kInvalidTaskId;
     }
     // notify the thread so that it knows of the new task
@@ -395,7 +393,7 @@
     running_ = true;
     thread_ = std::thread([this]() { ThreadRoutine(); });
     if (!thread_.joinable()) {
-      LOG_ERROR(LOG_TAG, "%s: Unable to start task thread", __func__);
+      LOG_ERROR("%s: Unable to start task thread", __func__);
       return -1;
     }
     return 0;
diff --git a/vendor_libs/test_vendor_lib/model/setup/device_boutique.cc b/vendor_libs/test_vendor_lib/model/setup/device_boutique.cc
index 18de1b1..de3b1cc 100644
--- a/vendor_libs/test_vendor_lib/model/setup/device_boutique.cc
+++ b/vendor_libs/test_vendor_lib/model/setup/device_boutique.cc
@@ -14,12 +14,9 @@
  * limitations under the License.
  */
 
-#define LOG_TAG "device_boutique"
-
 #include "device_boutique.h"
 
-#include "base/logging.h"
-#include "osi/include/log.h"
+#include "os/log.h"
 
 using std::vector;
 
@@ -33,16 +30,16 @@
 // Register a constructor for a device type.
 bool DeviceBoutique::Register(const std::string& device_type,
                               const std::function<std::shared_ptr<Device>()> device_constructor) {
-  LOG_INFO(LOG_TAG, "Registering %s", device_type.c_str());
+  LOG_INFO("Registering %s", device_type.c_str());
   GetMap()[device_type] = device_constructor;
   return true;
 }
 
 std::shared_ptr<Device> DeviceBoutique::Create(const vector<std::string>& args) {
-  CHECK(!args.empty());
+  ASSERT(!args.empty());
 
   if (GetMap().find(args[0]) == GetMap().end()) {
-    LOG_WARN(LOG_TAG, "No constructor registered for %s", args[0].c_str());
+    LOG_WARN("No constructor registered for %s", args[0].c_str());
     return std::shared_ptr<Device>(nullptr);
   }
 
diff --git a/vendor_libs/test_vendor_lib/model/setup/phy_layer.h b/vendor_libs/test_vendor_lib/model/setup/phy_layer.h
index 84e4cba..e49c412 100644
--- a/vendor_libs/test_vendor_lib/model/setup/phy_layer.h
+++ b/vendor_libs/test_vendor_lib/model/setup/phy_layer.h
@@ -33,6 +33,10 @@
 
   virtual void TimerTick() = 0;
 
+  virtual bool IsFactoryId(uint32_t factory_id) = 0;
+
+  virtual void Unregister() = 0;
+
   Phy::Type GetType() {
     return phy_type_;
   }
diff --git a/vendor_libs/test_vendor_lib/model/setup/phy_layer_factory.cc b/vendor_libs/test_vendor_lib/model/setup/phy_layer_factory.cc
index 182416a..654962e 100644
--- a/vendor_libs/test_vendor_lib/model/setup/phy_layer_factory.cc
+++ b/vendor_libs/test_vendor_lib/model/setup/phy_layer_factory.cc
@@ -14,22 +14,21 @@
  * limitations under the License.
  */
 
-#define LOG_TAG "phy_layer_factory"
-
 #include "phy_layer_factory.h"
 
-#include "base/logging.h"
-
-#include "osi/include/log.h"
-
 namespace test_vendor_lib {
 
-PhyLayerFactory::PhyLayerFactory(Phy::Type phy_type) : phy_type_(phy_type) {}
+PhyLayerFactory::PhyLayerFactory(Phy::Type phy_type, uint32_t factory_id)
+    : phy_type_(phy_type), factory_id_(factory_id) {}
 
 Phy::Type PhyLayerFactory::GetType() {
   return phy_type_;
 }
 
+uint32_t PhyLayerFactory::GetFactoryId() {
+  return factory_id_;
+}
+
 std::shared_ptr<PhyLayer> PhyLayerFactory::GetPhyLayer(
     const std::function<void(packets::LinkLayerPacketView)>& device_receive) {
   std::shared_ptr<PhyLayer> new_phy =
@@ -89,14 +88,21 @@
     : PhyLayer(phy_type, id, device_receive), factory_(factory) {}
 
 PhyLayerImpl::~PhyLayerImpl() {
-  factory_->UnregisterPhyLayer(GetId());
-  PhyLayer::~PhyLayer();
+  Unregister();
 }
 
 void PhyLayerImpl::Send(const std::shared_ptr<packets::LinkLayerPacketBuilder> packet) {
   factory_->Send(packet, GetId());
 }
 
+void PhyLayerImpl::Unregister() {
+  factory_->UnregisterPhyLayer(GetId());
+}
+
+bool PhyLayerImpl::IsFactoryId(uint32_t id) {
+  return factory_->GetFactoryId() == id;
+}
+
 void PhyLayerImpl::Receive(packets::LinkLayerPacketView packet) {
   transmit_to_device_(packet);
 }
diff --git a/vendor_libs/test_vendor_lib/model/setup/phy_layer_factory.h b/vendor_libs/test_vendor_lib/model/setup/phy_layer_factory.h
index 018ff78..aaf14f8 100644
--- a/vendor_libs/test_vendor_lib/model/setup/phy_layer_factory.h
+++ b/vendor_libs/test_vendor_lib/model/setup/phy_layer_factory.h
@@ -30,12 +30,14 @@
   friend class PhyLayerImpl;
 
  public:
-  PhyLayerFactory(Phy::Type phy_type);
+  PhyLayerFactory(Phy::Type phy_type, uint32_t factory_id);
 
   virtual ~PhyLayerFactory() = default;
 
   Phy::Type GetType();
 
+  uint32_t GetFactoryId();
+
   std::shared_ptr<PhyLayer> GetPhyLayer(const std::function<void(packets::LinkLayerPacketView)>& device_receive);
 
   void UnregisterPhyLayer(uint32_t id);
@@ -51,6 +53,7 @@
   Phy::Type phy_type_;
   std::vector<std::shared_ptr<PhyLayer>> phy_layers_;
   uint32_t next_id_{1};
+  const uint32_t factory_id_;
 };
 
 class PhyLayerImpl : public PhyLayer {
@@ -61,6 +64,8 @@
 
   virtual void Send(const std::shared_ptr<packets::LinkLayerPacketBuilder> packet) override;
   virtual void Receive(packets::LinkLayerPacketView packet) override;
+  virtual void Unregister() override;
+  virtual bool IsFactoryId(uint32_t factory_id) override;
   virtual void TimerTick() override;
 
  private:
diff --git a/vendor_libs/test_vendor_lib/model/setup/test_channel_transport.cc b/vendor_libs/test_vendor_lib/model/setup/test_channel_transport.cc
index d291896..d42bc72 100644
--- a/vendor_libs/test_vendor_lib/model/setup/test_channel_transport.cc
+++ b/vendor_libs/test_vendor_lib/model/setup/test_channel_transport.cc
@@ -14,17 +14,16 @@
  * limitations under the License.
  */
 
-#define LOG_TAG "test_channel_transport"
-
 #include "test_channel_transport.h"
 
-#include <base/logging.h>
-
-#include "osi/include/log.h"
+#include "os/log.h"
 #include "osi/include/osi.h"
 
+#include <errno.h>
+#include <fcntl.h>
 #include <netinet/in.h>
 #include <sys/socket.h>
+#include <unistd.h>
 
 using std::vector;
 
@@ -37,23 +36,28 @@
 
   OSI_NO_INTR(listen_fd_ = socket(AF_INET, SOCK_STREAM, 0));
   if (listen_fd_ < 0) {
-    LOG_INFO(LOG_TAG, "Error creating socket for test channel.");
+    LOG_INFO("Error creating socket for test channel.");
     return -1;
   }
 
-  LOG_INFO(LOG_TAG, "port: %d", port);
+  int enable = 1;
+  if (setsockopt(listen_fd_, SOL_SOCKET, SO_REUSEADDR, &enable, sizeof(int)) < 0) {
+    LOG_ERROR("setsockopt(SO_REUSEADDR) failed: %s", strerror(errno));
+  }
+
+  LOG_INFO("port: %d", port);
   listen_address.sin_family = AF_INET;
   listen_address.sin_port = htons(port);
   listen_address.sin_addr.s_addr = htonl(INADDR_ANY);
 
   if (bind(listen_fd_, reinterpret_cast<sockaddr*>(&listen_address), sockaddr_in_size) < 0) {
-    LOG_INFO(LOG_TAG, "Error binding test channel listener socket to address.");
+    LOG_INFO("Error binding test channel listener socket to address: %s", strerror(errno));
     close(listen_fd_);
     return -1;
   }
 
   if (listen(listen_fd_, 1) < 0) {
-    LOG_INFO(LOG_TAG, "Error listening for test channel.");
+    LOG_INFO("Error listening for test channel: %s", strerror(errno));
     close(listen_fd_);
     return -1;
   }
@@ -65,7 +69,7 @@
     return;
   }
   if (close(listen_fd_)) {
-    LOG_ERROR(LOG_TAG, "Error closing listen_fd_.");
+    LOG_ERROR("Error closing listen_fd_.");
   }
   listen_fd_ = -1;
 }
@@ -76,16 +80,16 @@
   OSI_NO_INTR(accept_fd = accept(listen_fd_, NULL, NULL));
 
   if (accept_fd < 0) {
-    LOG_INFO(LOG_TAG, "Error accepting test channel connection errno=%d (%s).", errno, strerror(errno));
+    LOG_INFO("Error accepting test channel connection errno=%d (%s).", errno, strerror(errno));
 
     if (errno != EAGAIN && errno != EWOULDBLOCK) {
-      LOG_ERROR(LOG_TAG, "Closing listen_fd_ (won't try again).");
+      LOG_ERROR("Closing listen_fd_ (won't try again).");
       close(listen_fd_);
       return -1;
     }
   }
 
-  LOG_INFO(LOG_TAG, "accept_fd = %d.", accept_fd);
+  LOG_INFO("accept_fd = %d.", accept_fd);
 
   return accept_fd;
 }
@@ -94,18 +98,18 @@
   uint8_t command_name_size = 0;
   int bytes_read = read(fd, &command_name_size, 1);
   if (bytes_read != 1) {
-    LOG_INFO(LOG_TAG, "Unexpected (command_name_size) bytes_read: %d != %d", bytes_read, 1);
+    LOG_INFO("Unexpected (command_name_size) bytes_read: %d != %d", bytes_read, 1);
   }
   vector<uint8_t> command_name_raw;
   command_name_raw.resize(command_name_size);
   bytes_read = read(fd, &command_name_raw[0], command_name_size);
   if (bytes_read != command_name_size) {
-    LOG_INFO(LOG_TAG, "Unexpected (command_name) bytes_read: %d != %d", bytes_read, command_name_size);
+    LOG_INFO("Unexpected (command_name) bytes_read: %d != %d", bytes_read, command_name_size);
   }
   std::string command_name(command_name_raw.begin(), command_name_raw.end());
 
   if (command_name == "CLOSE_TEST_CHANNEL" || command_name == "") {
-    LOG_INFO(LOG_TAG, "Test channel closed");
+    LOG_INFO("Test channel closed");
     unwatch();
     close(fd);
     return;
@@ -114,20 +118,20 @@
   uint8_t num_args = 0;
   bytes_read = read(fd, &num_args, 1);
   if (bytes_read != 1) {
-    LOG_INFO(LOG_TAG, "Unexpected (num_args) bytes_read: %d != %d", bytes_read, 1);
+    LOG_INFO("Unexpected (num_args) bytes_read: %d != %d", bytes_read, 1);
   }
   vector<std::string> args;
   for (uint8_t i = 0; i < num_args; ++i) {
     uint8_t arg_size = 0;
     bytes_read = read(fd, &arg_size, 1);
     if (bytes_read != 1) {
-      LOG_INFO(LOG_TAG, "Unexpected (arg_size) bytes_read: %d != %d", bytes_read, 1);
+      LOG_INFO("Unexpected (arg_size) bytes_read: %d != %d", bytes_read, 1);
     }
     vector<uint8_t> arg;
     arg.resize(arg_size);
     bytes_read = read(fd, &arg[0], arg_size);
     if (bytes_read != arg_size) {
-      LOG_INFO(LOG_TAG, "Unexpected (arg) bytes_read: %d != %d", bytes_read, arg_size);
+      LOG_INFO("Unexpected (arg) bytes_read: %d != %d", bytes_read, arg_size);
     }
     args.push_back(std::string(arg.begin(), arg.end()));
   }
@@ -144,9 +148,9 @@
   uint8_t size_buf[4] = {static_cast<uint8_t>(size & 0xff), static_cast<uint8_t>((size >> 8) & 0xff),
                          static_cast<uint8_t>((size >> 16) & 0xff), static_cast<uint8_t>((size >> 24) & 0xff)};
   int written = write(fd, size_buf, 4);
-  CHECK(written == 4) << "What happened? written = " << written << "errno =" << errno;
+  ASSERT_LOG(written == 4, "What happened? written = %d errno = %d", written, errno);
   written = write(fd, response.c_str(), size);
-  CHECK(written == static_cast<int>(size)) << "What happened? written = " << written << "errno =" << errno;
+  ASSERT_LOG(written == static_cast<int>(size), "What happened? written = %d errno = %d", written, errno);
 }
 
 void TestChannelTransport::RegisterCommandHandler(
diff --git a/vendor_libs/test_vendor_lib/model/setup/test_command_handler.cc b/vendor_libs/test_vendor_lib/model/setup/test_command_handler.cc
index ad8689d..b334ce8 100644
--- a/vendor_libs/test_vendor_lib/model/setup/test_command_handler.cc
+++ b/vendor_libs/test_vendor_lib/model/setup/test_command_handler.cc
@@ -14,8 +14,6 @@
  * limitations under the License.
  */
 
-#define LOG_TAG "test_command_handler"
-
 #include "test_command_handler.h"
 #include "device_boutique.h"
 #include "phy.h"
@@ -24,12 +22,11 @@
 
 #include <stdlib.h>
 
-#include <base/logging.h>
 #include "base/files/file_util.h"
 #include "base/json/json_reader.h"
 #include "base/values.h"
 
-#include "osi/include/log.h"
+#include "os/log.h"
 #include "osi/include/osi.h"
 
 using std::vector;
@@ -59,29 +56,29 @@
   AddPhy({"BR_EDR"});
 
   // Add the controller to the Phys
-  AddDeviceToPhy({"0", "0"});
-  AddDeviceToPhy({"0", "1"});
+  AddDeviceToPhy({"1", "1"});
+  AddDeviceToPhy({"1", "2"});
 
   // Add default test devices and add the devices to the phys
   // Add({"beacon", "be:ac:10:00:00:01", "1000"});
-  // AddDeviceToPhy({"1", "0"});
+  // AddDeviceToPhy({"2", "1"});
 
   // Add({"keyboard", "cc:1c:eb:0a:12:d1", "500"});
-  // AddDeviceToPhy({"2", "0"});
-
-  // Add({"classic", "c1:a5:51:c0:00:01", "22"});
   // AddDeviceToPhy({"3", "1"});
 
+  // Add({"classic", "c1:a5:51:c0:00:01", "22"});
+  // AddDeviceToPhy({"4", "2"});
+
   // Add({"car_kit", "ca:12:1c:17:00:01", "238"});
-  // AddDeviceToPhy({"4", "1"});
+  // AddDeviceToPhy({"5", "2"});
 
   // Add({"sniffer", "ca:12:1c:17:00:01"});
-  // AddDeviceToPhy({"5", "1"});
+  // AddDeviceToPhy({"6", "2"});
 
   // Add({"sniffer", "3c:5a:b4:04:05:06"});
-  // AddDeviceToPhy({"1", "1"});
+  // AddDeviceToPhy({"7", "2"});
   // Add({"remote_loopback_device", "10:0d:00:ba:c1:06"});
-  // AddDeviceToPhy({"2", "1"});
+  // AddDeviceToPhy({"8", "2"});
   List({});
 
   SetTimerPeriod({"10"});
@@ -113,11 +110,11 @@
   if (new_dev == NULL) {
     response_string_ = "TestCommandHandler 'add' " + args[0] + " failed!";
     send_response_(response_string_);
-    LOG_WARN(LOG_TAG, "%s", response_string_.c_str());
+    LOG_WARN("%s", response_string_.c_str());
     return;
   }
 
-  LOG_INFO(LOG_TAG, "Add %s", new_dev->ToString().c_str());
+  LOG_INFO("Add %s", new_dev->ToString().c_str());
   size_t dev_index = model_.Add(new_dev);
   response_string_ = std::to_string(dev_index) + std::string(":") + new_dev->ToString();
   send_response_(response_string_);
@@ -160,11 +157,9 @@
 
 void TestCommandHandler::AddPhy(const vector<std::string>& args) {
   if (args[0] == "LOW_ENERGY") {
-    std::shared_ptr<PhyLayerFactory> new_phy = std::make_shared<PhyLayerFactory>(Phy::Type::LOW_ENERGY);
-    model_.AddPhy(new_phy);
+    model_.AddPhy(Phy::Type::LOW_ENERGY);
   } else if (args[0] == "BR_EDR") {
-    std::shared_ptr<PhyLayerFactory> new_phy = std::make_shared<PhyLayerFactory>(Phy::Type::BR_EDR);
-    model_.AddPhy(new_phy);
+    model_.AddPhy(Phy::Type::BR_EDR);
   } else {
     response_string_ = "TestCommandHandler 'add_phy' with unrecognized type " + args[0];
     send_response_(response_string_);
@@ -211,7 +206,7 @@
 
 void TestCommandHandler::List(const vector<std::string>& args) {
   if (args.size() > 0) {
-    LOG_INFO(LOG_TAG, "Unused args: arg[0] = %s", args[0].c_str());
+    LOG_INFO("Unused args: arg[0] = %s", args[0].c_str());
     return;
   }
   send_response_(model_.List());
@@ -219,7 +214,7 @@
 
 void TestCommandHandler::SetTimerPeriod(const vector<std::string>& args) {
   if (args.size() != 1) {
-    LOG_INFO(LOG_TAG, "SetTimerPeriod takes 1 argument");
+    LOG_INFO("SetTimerPeriod takes 1 argument");
   }
   size_t period = std::stoi(args[0]);
   model_.SetTimerPeriod(std::chrono::milliseconds(period));
@@ -227,14 +222,14 @@
 
 void TestCommandHandler::StartTimer(const vector<std::string>& args) {
   if (args.size() > 0) {
-    LOG_INFO(LOG_TAG, "Unused args: arg[0] = %s", args[0].c_str());
+    LOG_INFO("Unused args: arg[0] = %s", args[0].c_str());
   }
   model_.StartTimer();
 }
 
 void TestCommandHandler::StopTimer(const vector<std::string>& args) {
   if (args.size() > 0) {
-    LOG_INFO(LOG_TAG, "Unused args: arg[0] = %s", args[0].c_str());
+    LOG_INFO("Unused args: arg[0] = %s", args[0].c_str());
   }
   model_.StopTimer();
 }
diff --git a/vendor_libs/test_vendor_lib/model/setup/test_model.cc b/vendor_libs/test_vendor_lib/model/setup/test_model.cc
index 3572761..05500a1 100644
--- a/vendor_libs/test_vendor_lib/model/setup/test_model.cc
+++ b/vendor_libs/test_vendor_lib/model/setup/test_model.cc
@@ -14,8 +14,6 @@
  * limitations under the License.
  */
 
-#define LOG_TAG "test_model"
-
 #include "test_model.h"
 
 // TODO: Remove when registration works
@@ -30,13 +28,14 @@
 #include <memory>
 
 #include <stdlib.h>
+#include <iomanip>
+#include <iostream>
 
-#include <base/logging.h>
 #include "base/files/file_util.h"
 #include "base/json/json_reader.h"
 #include "base/values.h"
 
-#include "osi/include/log.h"
+#include "os/log.h"
 #include "osi/include/osi.h"
 
 #include "device_boutique.h"
@@ -78,73 +77,84 @@
 }
 
 void TestModel::StartTimer() {
-  LOG_INFO(LOG_TAG, "StartTimer()");
+  LOG_INFO("StartTimer()");
   timer_tick_task_ =
       schedule_periodic_task_(std::chrono::milliseconds(0), timer_period_, [this]() { TestModel::TimerTick(); });
 }
 
 void TestModel::StopTimer() {
-  LOG_INFO(LOG_TAG, "StopTimer()");
+  LOG_INFO("StopTimer()");
   cancel_task_(timer_tick_task_);
   timer_tick_task_ = kInvalidTaskId;
 }
 
 size_t TestModel::Add(std::shared_ptr<Device> new_dev) {
-  devices_.push_back(new_dev);
-  return devices_.size() - 1;
+  devices_counter_++;
+  devices_[devices_counter_] = new_dev;
+  return devices_counter_;
 }
 
 void TestModel::Del(size_t dev_index) {
-  if (dev_index >= devices_.size()) {
-    LOG_WARN(LOG_TAG, "del: index out of range!");
+  auto device = devices_.find(dev_index);
+  if (device == devices_.end()) {
+    LOG_WARN("Del: can't find device!");
     return;
   }
-  devices_.erase(devices_.begin() + dev_index);
+  devices_.erase(dev_index);
 }
 
-size_t TestModel::AddPhy(std::shared_ptr<PhyLayerFactory> new_phy) {
-  phys_.push_back(new_phy);
-  return phys_.size() - 1;
+size_t TestModel::AddPhy(Phy::Type phy_type) {
+  phys_counter_++;
+  std::shared_ptr<PhyLayerFactory> new_phy = std::make_shared<PhyLayerFactory>(phy_type, phys_counter_);
+  phys_[phys_counter_] = new_phy;
+  return phys_counter_;
 }
 
 void TestModel::DelPhy(size_t phy_index) {
-  if (phy_index >= phys_.size()) {
-    LOG_WARN(LOG_TAG, "del_phy: index %d out of range: ", static_cast<int>(phy_index));
+  auto phy = phys_.find(phy_index);
+  if (phy == phys_.end()) {
+    LOG_WARN("DelPhy: can't find device!");
     return;
   }
+  phys_.erase(phy_index);
 }
 
 void TestModel::AddDeviceToPhy(size_t dev_index, size_t phy_index) {
-  if (dev_index >= devices_.size()) {
-    LOG_WARN(LOG_TAG, "add_device_to_phy: device out of range: ");
+  auto device = devices_.find(dev_index);
+  if (device == devices_.end()) {
+    LOG_WARN("%s: can't find device!", __func__);
     return;
   }
-  if (phy_index >= phys_.size()) {
-    LOG_WARN(LOG_TAG, "add_device_to_phy: phy out of range: ");
+  auto phy = phys_.find(phy_index);
+  if (phy == phys_.end()) {
+    LOG_WARN("%s: can't find phy!", __func__);
     return;
   }
-  std::shared_ptr<Device> dev = devices_[dev_index];
+  auto dev = device->second;
   dev->RegisterPhyLayer(
-      phys_[phy_index]->GetPhyLayer([dev](packets::LinkLayerPacketView packet) { dev->IncomingPacket(packet); }));
+      phy->second->GetPhyLayer([dev](packets::LinkLayerPacketView packet) { dev->IncomingPacket(packet); }));
 }
 
 void TestModel::DelDeviceFromPhy(size_t dev_index, size_t phy_index) {
-  if (dev_index >= devices_.size()) {
-    LOG_WARN(LOG_TAG, "del_device_from_phy: device out of range: ");
+  auto device = devices_.find(dev_index);
+  if (device == devices_.end()) {
+    LOG_WARN("%s: can't find device!", __func__);
     return;
   }
-  if (phy_index >= phys_.size()) {
-    LOG_WARN(LOG_TAG, "del_device_from_phy: phy out of range: ");
+  auto phy = phys_.find(phy_index);
+  if (phy == phys_.end()) {
+    LOG_WARN("%s: can't find phy!", __func__);
     return;
   }
+  device->second->UnregisterPhyLayer(phy->second->GetType(), phy->second->GetFactoryId());
 }
 
 void TestModel::AddLinkLayerConnection(int socket_fd, Phy::Type phy_type) {
   std::shared_ptr<Device> dev = LinkLayerSocketDevice::Create(socket_fd, phy_type);
   int index = Add(dev);
-  for (size_t phy_index = 0; phy_index < phys_.size(); phy_index++) {
-    if (phy_type == phys_[phy_index]->GetType()) {
-      AddDeviceToPhy(index, phy_index);
+  for (auto& phy : phys_) {
+    if (phy_type == phy.second->GetType()) {
+      AddDeviceToPhy(index, phy.first);
     }
   }
 }
@@ -163,40 +173,55 @@
 }
 
 void TestModel::IncomingHciConnection(int socket_fd) {
-  std::shared_ptr<HciSocketDevice> dev = HciSocketDevice::Create(socket_fd);
-  // TODO: Auto-increment addresses?
-  static int hci_devs = 0;
-  int index = Add(std::static_pointer_cast<Device>(dev));
-  std::string addr = "da:4c:10:de:17:0";  // Da HCI dev
-  CHECK(hci_devs < 10) << "Why do you need more than 9?";
-  addr += '0' + hci_devs++;
+  auto dev = HciSocketDevice::Create(socket_fd);
+  size_t index = Add(std::static_pointer_cast<Device>(dev));
+  std::string addr = "da:4c:10:de:17:";  // Da HCI dev
+  std::stringstream stream;
+  stream << std::setfill('0') << std::setw(2) << std::hex << (index % 256);
+  addr += stream.str();
+
   dev->Initialize({"IgnoredTypeName", addr});
-  // TODO: Add device to all phys?  For now, just the first two.
-  for (size_t phy = 0; phy < 2 && phy < phys_.size(); phy++) {
-    AddDeviceToPhy(index, phy);
+  LOG_INFO("initialized %s", addr.c_str());
+  for (auto& phy : phys_) {
+    AddDeviceToPhy(index, phy.first);
   }
   dev->RegisterTaskScheduler(schedule_task_);
   dev->RegisterTaskCancel(cancel_task_);
+  dev->RegisterCloseCallback([this, socket_fd, index] { OnHciConnectionClosed(socket_fd, index); });
+}
+
+void TestModel::OnHciConnectionClosed(int socket_fd, size_t index) {
+  auto device = devices_.find(index);
+  if (device == devices_.end()) {
+    LOG_WARN("OnHciConnectionClosed: can't find device!");
+    return;
+  }
+  int close_result = close(socket_fd);
+  ASSERT_LOG(close_result == 0, "can't close: %s", strerror(errno));
+  device->second->UnregisterPhyLayers();
+  devices_.erase(index);
 }
 
 const std::string& TestModel::List() {
   list_string_ = "";
   list_string_ += " Devices: \r\n";
-  for (size_t dev = 0; dev < devices_.size(); dev++) {
-    list_string_ += "  " + std::to_string(dev) + ":";
-    list_string_ += devices_[dev]->ToString() + " \r\n";
+  for (auto& dev : devices_) {
+    list_string_ += "  " + std::to_string(dev.first) + ":";
+    list_string_ += dev.second->ToString() + " \r\n";
   }
   list_string_ += " Phys: \r\n";
-  for (size_t phy = 0; phy < phys_.size(); phy++) {
-    list_string_ += "  " + std::to_string(phy) + ":";
-    list_string_ += phys_[phy]->ToString() + " \r\n";
+  for (auto& phy : phys_) {
+    list_string_ += "  " + std::to_string(phy.first) + ":";
+    list_string_ += phy.second->ToString() + " \r\n";
   }
   return list_string_;
 }
 
 void TestModel::TimerTick() {
-  for (size_t dev = 0; dev < devices_.size(); dev++) {
-    devices_[dev]->TimerTick();
+  for (auto dev = devices_.begin(); dev != devices_.end();) {
+    auto tmp = dev;
+    dev++;
+    tmp->second->TimerTick();
   }
 }
 
diff --git a/vendor_libs/test_vendor_lib/model/setup/test_model.h b/vendor_libs/test_vendor_lib/model/setup/test_model.h
index c799f3f..4d95d91 100644
--- a/vendor_libs/test_vendor_lib/model/setup/test_model.h
+++ b/vendor_libs/test_vendor_lib/model/setup/test_model.h
@@ -47,7 +47,7 @@
   void Del(size_t device_index);
 
   // Add phy, return its index
-  size_t AddPhy(std::shared_ptr<PhyLayerFactory> phy);
+  size_t AddPhy(Phy::Type phy_type);
 
   // Remove phy by index
   void DelPhy(size_t phy_index);
@@ -63,6 +63,9 @@
   void IncomingLinkLayerConnection(int socket_fd);
   void IncomingHciConnection(int socket_fd);
 
+  // Handle closed remote connections
+  void OnHciConnectionClosed(int socket_fd, size_t index);
+
   // Connect to a remote device
   void AddRemote(const std::string& server, int port, Phy::Type phy_type);
 
@@ -79,8 +82,10 @@
   void Reset();
 
  private:
-  std::vector<std::shared_ptr<PhyLayerFactory>> phys_;
-  std::vector<std::shared_ptr<Device>> devices_;
+  std::map<size_t, std::shared_ptr<PhyLayerFactory>> phys_;
+  size_t phys_counter_ = 0;
+  std::map<size_t, std::shared_ptr<Device>> devices_;
+  size_t devices_counter_ = 0;
   std::string list_string_;
 
   // Callbacks to schedule tasks.
diff --git a/vendor_libs/test_vendor_lib/packets/Android.bp b/vendor_libs/test_vendor_lib/packets/Android.bp
index 8a73a64..9378492 100644
--- a/vendor_libs/test_vendor_lib/packets/Android.bp
+++ b/vendor_libs/test_vendor_lib/packets/Android.bp
@@ -38,6 +38,7 @@
         "system/bt/vendor_libs/test_vendor_lib/include",
         "system/bt/vendor_libs/test_vendor_lib/",
         "system/bt/",
+        "system/bt/gd",
     ],
     shared_libs: [
         "libbase",
@@ -69,6 +70,7 @@
     ],
     include_dirs: [
         "system/bt",
+        "system/bt/gd",
         "system/bt/hci/include",
         "system/bt/vendor_libs/test_vendor_lib",
         "system/bt/vendor_libs/test_vendor_lib/include",
diff --git a/vendor_libs/test_vendor_lib/packets/hci/acl_packet_builder.cc b/vendor_libs/test_vendor_lib/packets/hci/acl_packet_builder.cc
index 00b0ba8..3c74ad6 100644
--- a/vendor_libs/test_vendor_lib/packets/hci/acl_packet_builder.cc
+++ b/vendor_libs/test_vendor_lib/packets/hci/acl_packet_builder.cc
@@ -16,7 +16,7 @@
 
 #include "packets/hci/acl_packet_builder.h"
 
-#include <base/logging.h>
+#include "os/log.h"
 
 using std::vector;
 using test_vendor_lib::acl::BroadcastFlagsType;
@@ -48,8 +48,8 @@
          it);
   uint16_t payload_size = payload_->size();
 
-  CHECK(static_cast<size_t>(payload_size) == payload_->size())
-      << "Payload too large for an ACL packet: " << payload_->size();
+  ASSERT_LOG(static_cast<size_t>(payload_size) == payload_->size(), "Payload too large for an ACL packet: %d",
+             static_cast<int>(payload_->size()));
   insert(payload_size, it);
   payload_->Serialize(it);
 }
diff --git a/vendor_libs/test_vendor_lib/packets/hci/acl_packet_builder.h b/vendor_libs/test_vendor_lib/packets/hci/acl_packet_builder.h
index cd2a607..9599130 100644
--- a/vendor_libs/test_vendor_lib/packets/hci/acl_packet_builder.h
+++ b/vendor_libs/test_vendor_lib/packets/hci/acl_packet_builder.h
@@ -16,7 +16,6 @@
 
 #pragma once
 
-#include <base/logging.h>
 #include <cstdint>
 #include <memory>
 #include <vector>
diff --git a/vendor_libs/test_vendor_lib/packets/hci/acl_packet_view.cc b/vendor_libs/test_vendor_lib/packets/hci/acl_packet_view.cc
index bfec835..4e41a73 100644
--- a/vendor_libs/test_vendor_lib/packets/hci/acl_packet_view.cc
+++ b/vendor_libs/test_vendor_lib/packets/hci/acl_packet_view.cc
@@ -16,7 +16,7 @@
 
 #include "packets/hci/acl_packet_view.h"
 
-#include <base/logging.h>
+#include "os/log.h"
 
 using std::vector;
 using test_vendor_lib::acl::BroadcastFlagsType;
@@ -51,8 +51,9 @@
 
 PacketView<true> AclPacketView::GetPayload() const {
   uint16_t payload_size = (begin() + sizeof(uint16_t)).extract<uint16_t>();
-  CHECK(static_cast<uint16_t>(size() - 2 * sizeof(uint16_t)) == payload_size)
-      << "Malformed ACL packet payload_size " << payload_size << " + 4 != " << size();
+  ASSERT_LOG(static_cast<uint16_t>(size() - 2 * sizeof(uint16_t)) == payload_size,
+             "Malformed ACL packet payload_size %d + 4 != %d", static_cast<int>(payload_size),
+             static_cast<int>(size()));
   return SubViewLittleEndian(2 * sizeof(uint16_t), size());
 }
 
diff --git a/vendor_libs/test_vendor_lib/packets/hci/command_packet_builder.cc b/vendor_libs/test_vendor_lib/packets/hci/command_packet_builder.cc
index 7074309..b422bb8 100644
--- a/vendor_libs/test_vendor_lib/packets/hci/command_packet_builder.cc
+++ b/vendor_libs/test_vendor_lib/packets/hci/command_packet_builder.cc
@@ -16,7 +16,7 @@
 
 #include "packets/hci/command_packet_builder.h"
 
-#include <base/logging.h>
+#include "os/log.h"
 
 using std::vector;
 using test_vendor_lib::hci::OpCode;
@@ -35,8 +35,8 @@
   insert(static_cast<uint16_t>(opcode_), it);
   uint8_t payload_size = static_cast<uint8_t>(payload_->size());
 
-  CHECK(static_cast<size_t>(payload_size) == payload_->size())
-      << "Payload too large for a command packet: " << payload_->size();
+  ASSERT_LOG(static_cast<size_t>(payload_size) == payload_->size(), "Payload too large for a command packet: %d",
+             static_cast<int>(payload_->size()));
   insert(payload_size, it);
   payload_->Serialize(it);
 }
diff --git a/vendor_libs/test_vendor_lib/packets/hci/command_packet_builder.h b/vendor_libs/test_vendor_lib/packets/hci/command_packet_builder.h
index d8e86a0..d59cf79 100644
--- a/vendor_libs/test_vendor_lib/packets/hci/command_packet_builder.h
+++ b/vendor_libs/test_vendor_lib/packets/hci/command_packet_builder.h
@@ -16,7 +16,6 @@
 
 #pragma once
 
-#include <base/logging.h>
 #include <cstdint>
 #include <memory>
 #include <vector>
diff --git a/vendor_libs/test_vendor_lib/packets/hci/command_packet_view.cc b/vendor_libs/test_vendor_lib/packets/hci/command_packet_view.cc
index f0876c1..b0d27e6 100644
--- a/vendor_libs/test_vendor_lib/packets/hci/command_packet_view.cc
+++ b/vendor_libs/test_vendor_lib/packets/hci/command_packet_view.cc
@@ -16,7 +16,7 @@
 
 #include "packets/hci/command_packet_view.h"
 
-#include <base/logging.h>
+#include "os/log.h"
 
 using std::vector;
 
@@ -35,8 +35,9 @@
 
 PacketView<true> CommandPacketView::GetPayload() const {
   uint8_t payload_size = (begin() + sizeof(uint16_t)).extract<uint8_t>();
-  CHECK(static_cast<uint8_t>(size() - sizeof(uint16_t) - sizeof(uint8_t)) == payload_size)
-      << "Malformed Command packet payload_size " << payload_size << " + 2 != " << size();
+  ASSERT_LOG(static_cast<uint8_t>(size() - sizeof(uint16_t) - sizeof(uint8_t)) == payload_size,
+             "Malformed Command packet payload_size %d + 2 != %d", static_cast<int>(payload_size),
+             static_cast<int>(size()));
   return SubViewLittleEndian(sizeof(uint16_t) + sizeof(uint8_t), size());
 }
 
diff --git a/vendor_libs/test_vendor_lib/packets/hci/event_packet_builder.cc b/vendor_libs/test_vendor_lib/packets/hci/event_packet_builder.cc
index 8d095a7..2dd1cd6 100644
--- a/vendor_libs/test_vendor_lib/packets/hci/event_packet_builder.cc
+++ b/vendor_libs/test_vendor_lib/packets/hci/event_packet_builder.cc
@@ -16,8 +16,8 @@
 
 #include "packets/hci/event_packet_builder.h"
 
-#include <base/logging.h>
 #include "hci.h"
+#include "os/log.h"
 #include "packets/hci/le_meta_event_builder.h"
 
 using std::vector;
@@ -38,7 +38,7 @@
 std::unique_ptr<EventPacketBuilder> EventPacketBuilder::CreateInquiryCompleteEvent(hci::Status status) {
   std::unique_ptr<EventPacketBuilder> evt_ptr =
       std::unique_ptr<EventPacketBuilder>(new EventPacketBuilder(EventCode::INQUIRY_COMPLETE));
-  CHECK(evt_ptr->AddPayloadOctets1(static_cast<uint8_t>(status)));
+  ASSERT(evt_ptr->AddPayloadOctets1(static_cast<uint8_t>(status)));
 
   return evt_ptr;
 }
@@ -49,9 +49,9 @@
   std::unique_ptr<EventPacketBuilder> evt_ptr =
       std::unique_ptr<EventPacketBuilder>(new EventPacketBuilder(EventCode::COMMAND_COMPLETE));
 
-  CHECK(evt_ptr->AddPayloadOctets1(1));  // num_hci_command_packets
-  CHECK(evt_ptr->AddPayloadOctets2(static_cast<uint16_t>(command_opcode)));
-  CHECK(evt_ptr->AddPayloadOctets(event_return_parameters));
+  ASSERT(evt_ptr->AddPayloadOctets1(1));  // num_hci_command_packets
+  ASSERT(evt_ptr->AddPayloadOctets2(static_cast<uint16_t>(command_opcode)));
+  ASSERT(evt_ptr->AddPayloadOctets(event_return_parameters));
 
   return evt_ptr;
 }
@@ -61,9 +61,9 @@
   std::unique_ptr<EventPacketBuilder> evt_ptr =
       std::unique_ptr<EventPacketBuilder>(new EventPacketBuilder(EventCode::COMMAND_COMPLETE));
 
-  CHECK(evt_ptr->AddPayloadOctets1(1));  // num_hci_command_packets
-  CHECK(evt_ptr->AddPayloadOctets2(static_cast<uint16_t>(command_opcode)));
-  CHECK(evt_ptr->AddPayloadOctets1(static_cast<uint8_t>(status)));
+  ASSERT(evt_ptr->AddPayloadOctets1(1));  // num_hci_command_packets
+  ASSERT(evt_ptr->AddPayloadOctets2(static_cast<uint16_t>(command_opcode)));
+  ASSERT(evt_ptr->AddPayloadOctets1(static_cast<uint8_t>(status)));
 
   return evt_ptr;
 }
@@ -73,10 +73,10 @@
   std::unique_ptr<EventPacketBuilder> evt_ptr =
       std::unique_ptr<EventPacketBuilder>(new EventPacketBuilder(EventCode::COMMAND_COMPLETE));
 
-  CHECK(evt_ptr->AddPayloadOctets1(1));  // num_hci_command_packets
-  CHECK(evt_ptr->AddPayloadOctets2(static_cast<uint16_t>(command_opcode)));
-  CHECK(evt_ptr->AddPayloadOctets1(static_cast<uint8_t>(status)));
-  CHECK(evt_ptr->AddPayloadAddress(address));
+  ASSERT(evt_ptr->AddPayloadOctets1(1));  // num_hci_command_packets
+  ASSERT(evt_ptr->AddPayloadOctets2(static_cast<uint16_t>(command_opcode)));
+  ASSERT(evt_ptr->AddPayloadOctets1(static_cast<uint8_t>(status)));
+  ASSERT(evt_ptr->AddPayloadAddress(address));
 
   return evt_ptr;
 }
@@ -86,9 +86,9 @@
   std::unique_ptr<EventPacketBuilder> evt_ptr =
       std::unique_ptr<EventPacketBuilder>(new EventPacketBuilder(EventCode::COMMAND_COMPLETE));
 
-  CHECK(evt_ptr->AddPayloadOctets1(1));  // num_hci_command_packets
-  CHECK(evt_ptr->AddPayloadOctets2(static_cast<uint16_t>(command_opcode)));
-  CHECK(evt_ptr->AddPayloadOctets1(static_cast<uint8_t>(Status::UNKNOWN_COMMAND)));
+  ASSERT(evt_ptr->AddPayloadOctets1(1));  // num_hci_command_packets
+  ASSERT(evt_ptr->AddPayloadOctets2(static_cast<uint16_t>(command_opcode)));
+  ASSERT(evt_ptr->AddPayloadOctets1(static_cast<uint8_t>(Status::UNKNOWN_COMMAND)));
 
   return evt_ptr;
 }
@@ -99,9 +99,9 @@
   std::unique_ptr<EventPacketBuilder> evt_ptr =
       std::unique_ptr<EventPacketBuilder>(new EventPacketBuilder(EventCode::COMMAND_STATUS));
 
-  CHECK(evt_ptr->AddPayloadOctets1(static_cast<uint8_t>(status)));
-  CHECK(evt_ptr->AddPayloadOctets1(1));  // num_hci_command_packets
-  CHECK(evt_ptr->AddPayloadOctets2(static_cast<uint16_t>(command_opcode)));
+  ASSERT(evt_ptr->AddPayloadOctets1(static_cast<uint8_t>(status)));
+  ASSERT(evt_ptr->AddPayloadOctets1(1));  // num_hci_command_packets
+  ASSERT(evt_ptr->AddPayloadOctets2(static_cast<uint16_t>(command_opcode)));
 
   return evt_ptr;
 }
@@ -119,11 +119,11 @@
 }
 
 void EventPacketBuilder::AddCompletedPackets(uint16_t handle, uint16_t num_completed_packets) {
-  CHECK(event_code_ == EventCode::NUMBER_OF_COMPLETED_PACKETS);
+  ASSERT(event_code_ == EventCode::NUMBER_OF_COMPLETED_PACKETS);
 
   std::unique_ptr<RawBuilder> handle_pair = std::make_unique<RawBuilder>();
-  CHECK(handle_pair->AddOctets2(handle));
-  CHECK(handle_pair->AddOctets2(num_completed_packets));
+  ASSERT(handle_pair->AddOctets2(handle));
+  ASSERT(handle_pair->AddOctets2(num_completed_packets));
   AddBuilder(std::move(handle_pair));
 }
 
@@ -133,7 +133,7 @@
   std::unique_ptr<EventPacketBuilder> evt_ptr =
       EventPacketBuilder::CreateCommandCompleteOnlyStatusEvent(OpCode::DELETE_STORED_LINK_KEY, status);
 
-  CHECK(evt_ptr->AddPayloadOctets2(num_keys_deleted));
+  ASSERT(evt_ptr->AddPayloadOctets2(num_keys_deleted));
 
   return evt_ptr;
 }
@@ -148,9 +148,9 @@
   if (len > 247) {
     len = 247;
   }
-  CHECK(evt_ptr->AddPayloadOctets(len, local_name));
-  CHECK(evt_ptr->AddPayloadOctets1(0));  // Null terminated
-  for (size_t i = 0; i < 248 - len - 1; i++) CHECK(evt_ptr->AddPayloadOctets1(0xFF));
+  ASSERT(evt_ptr->AddPayloadOctets(len, local_name));
+  ASSERT(evt_ptr->AddPayloadOctets1(0));  // Null terminated
+  for (size_t i = 0; i < 248 - len - 1; i++) ASSERT(evt_ptr->AddPayloadOctets1(0xFF));
 
   return evt_ptr;
 }
@@ -160,7 +160,7 @@
     hci::Status status, uint8_t enable) {
   std::unique_ptr<EventPacketBuilder> evt_ptr =
       EventPacketBuilder::CreateCommandCompleteOnlyStatusEvent(OpCode::READ_LOCAL_NAME, status);
-  CHECK(evt_ptr->AddPayloadOctets1(enable));
+  ASSERT(evt_ptr->AddPayloadOctets1(enable));
   return evt_ptr;
 }
 
@@ -171,11 +171,11 @@
   std::unique_ptr<EventPacketBuilder> evt_ptr =
       EventPacketBuilder::CreateCommandCompleteOnlyStatusEvent(OpCode::READ_LOCAL_VERSION_INFORMATION, status);
 
-  CHECK(evt_ptr->AddPayloadOctets1(hci_version));
-  CHECK(evt_ptr->AddPayloadOctets2(hci_revision));
-  CHECK(evt_ptr->AddPayloadOctets1(lmp_pal_version));
-  CHECK(evt_ptr->AddPayloadOctets2(manufacturer_name));
-  CHECK(evt_ptr->AddPayloadOctets2(lmp_pal_subversion));
+  ASSERT(evt_ptr->AddPayloadOctets1(hci_version));
+  ASSERT(evt_ptr->AddPayloadOctets2(hci_revision));
+  ASSERT(evt_ptr->AddPayloadOctets1(lmp_pal_version));
+  ASSERT(evt_ptr->AddPayloadOctets2(manufacturer_name));
+  ASSERT(evt_ptr->AddPayloadOctets2(lmp_pal_subversion));
 
   return evt_ptr;
 }
@@ -186,11 +186,11 @@
   std::unique_ptr<EventPacketBuilder> evt_ptr =
       std::unique_ptr<EventPacketBuilder>(new EventPacketBuilder(EventCode::READ_REMOTE_VERSION_INFORMATION_COMPLETE));
 
-  CHECK(evt_ptr->AddPayloadOctets1(static_cast<uint8_t>(status)));
-  CHECK(evt_ptr->AddPayloadOctets2(connection_handle));
-  CHECK(evt_ptr->AddPayloadOctets1(lmp_pal_version));
-  CHECK(evt_ptr->AddPayloadOctets2(manufacturer_name));
-  CHECK(evt_ptr->AddPayloadOctets2(lmp_pal_subversion));
+  ASSERT(evt_ptr->AddPayloadOctets1(static_cast<uint8_t>(status)));
+  ASSERT(evt_ptr->AddPayloadOctets2(connection_handle));
+  ASSERT(evt_ptr->AddPayloadOctets1(lmp_pal_version));
+  ASSERT(evt_ptr->AddPayloadOctets2(manufacturer_name));
+  ASSERT(evt_ptr->AddPayloadOctets2(lmp_pal_subversion));
 
   return evt_ptr;
 }
@@ -200,7 +200,18 @@
   std::unique_ptr<EventPacketBuilder> evt_ptr =
       EventPacketBuilder::CreateCommandCompleteOnlyStatusEvent(OpCode::READ_LOCAL_SUPPORTED_COMMANDS, status);
 
-  CHECK(evt_ptr->AddPayloadOctets(64, supported_commands));
+  ASSERT(evt_ptr->AddPayloadOctets(64, supported_commands));
+
+  return evt_ptr;
+}
+
+// Bluetooth Core Specification Version 4.2, Volume 2, Part E, Section 7.4.3
+std::unique_ptr<EventPacketBuilder> EventPacketBuilder::CreateCommandCompleteReadLocalSupportedFeatures(
+    hci::Status status, uint64_t supported_features) {
+  std::unique_ptr<EventPacketBuilder> evt_ptr =
+      EventPacketBuilder::CreateCommandCompleteOnlyStatusEvent(OpCode::READ_LOCAL_SUPPORTED_FEATURES, status);
+
+  ASSERT(evt_ptr->AddPayloadOctets8(supported_features));
 
   return evt_ptr;
 }
@@ -211,9 +222,9 @@
   std::unique_ptr<EventPacketBuilder> evt_ptr =
       EventPacketBuilder::CreateCommandCompleteOnlyStatusEvent(OpCode::READ_LOCAL_EXTENDED_FEATURES, status);
 
-  CHECK(evt_ptr->AddPayloadOctets1(page_number));
-  CHECK(evt_ptr->AddPayloadOctets1(maximum_page_number));
-  CHECK(evt_ptr->AddPayloadOctets8(extended_lmp_features));
+  ASSERT(evt_ptr->AddPayloadOctets1(page_number));
+  ASSERT(evt_ptr->AddPayloadOctets1(maximum_page_number));
+  ASSERT(evt_ptr->AddPayloadOctets8(extended_lmp_features));
 
   return evt_ptr;
 }
@@ -224,11 +235,11 @@
   std::unique_ptr<EventPacketBuilder> evt_ptr =
       std::unique_ptr<EventPacketBuilder>(new EventPacketBuilder(EventCode::READ_REMOTE_EXTENDED_FEATURES_COMPLETE));
 
-  CHECK(evt_ptr->AddPayloadOctets1(static_cast<uint8_t>(status)));
-  CHECK(evt_ptr->AddPayloadOctets2(handle));
-  CHECK(evt_ptr->AddPayloadOctets1(page_number));
-  CHECK(evt_ptr->AddPayloadOctets1(maximum_page_number));
-  CHECK(evt_ptr->AddPayloadOctets8(extended_lmp_features));
+  ASSERT(evt_ptr->AddPayloadOctets1(static_cast<uint8_t>(status)));
+  ASSERT(evt_ptr->AddPayloadOctets2(handle));
+  ASSERT(evt_ptr->AddPayloadOctets1(page_number));
+  ASSERT(evt_ptr->AddPayloadOctets1(maximum_page_number));
+  ASSERT(evt_ptr->AddPayloadOctets8(extended_lmp_features));
 
   return evt_ptr;
 }
@@ -240,10 +251,10 @@
   std::unique_ptr<EventPacketBuilder> evt_ptr =
       EventPacketBuilder::CreateCommandCompleteOnlyStatusEvent(OpCode::READ_BUFFER_SIZE, status);
 
-  CHECK(evt_ptr->AddPayloadOctets2(hc_acl_data_packet_length));
-  CHECK(evt_ptr->AddPayloadOctets1(hc_synchronous_data_packet_length));
-  CHECK(evt_ptr->AddPayloadOctets2(hc_total_num_acl_data_packets));
-  CHECK(evt_ptr->AddPayloadOctets2(hc_total_synchronous_data_packets));
+  ASSERT(evt_ptr->AddPayloadOctets2(hc_acl_data_packet_length));
+  ASSERT(evt_ptr->AddPayloadOctets1(hc_synchronous_data_packet_length));
+  ASSERT(evt_ptr->AddPayloadOctets2(hc_total_num_acl_data_packets));
+  ASSERT(evt_ptr->AddPayloadOctets2(hc_total_synchronous_data_packets));
 
   return evt_ptr;
 }
@@ -254,7 +265,7 @@
   std::unique_ptr<EventPacketBuilder> evt_ptr =
       EventPacketBuilder::CreateCommandCompleteOnlyStatusEvent(OpCode::READ_BD_ADDR, status);
 
-  CHECK(evt_ptr->AddPayloadAddress(address));
+  ASSERT(evt_ptr->AddPayloadAddress(address));
 
   return evt_ptr;
 }
@@ -265,11 +276,25 @@
   std::unique_ptr<EventPacketBuilder> evt_ptr =
       EventPacketBuilder::CreateCommandCompleteOnlyStatusEvent(OpCode::READ_LOCAL_SUPPORTED_CODECS, status);
 
-  CHECK(evt_ptr->AddPayloadOctets1(supported_codecs.size()));
-  CHECK(evt_ptr->AddPayloadOctets(supported_codecs));
-  CHECK(evt_ptr->AddPayloadOctets1(vendor_specific_codecs.size()));
+  ASSERT(evt_ptr->AddPayloadOctets1(supported_codecs.size()));
+  ASSERT(evt_ptr->AddPayloadOctets(supported_codecs));
+  ASSERT(evt_ptr->AddPayloadOctets1(vendor_specific_codecs.size()));
   for (size_t i = 0; i < vendor_specific_codecs.size(); i++)
-    CHECK(evt_ptr->AddPayloadOctets4(vendor_specific_codecs[i]));
+    ASSERT(evt_ptr->AddPayloadOctets4(vendor_specific_codecs[i]));
+
+  return evt_ptr;
+}
+
+// Bluetooth Core Specification Version 5.1, Volume 2, Part E, Section 7.5.7
+std::unique_ptr<EventPacketBuilder>
+EventPacketBuilder::CreateCommandCompleteReadEncryptionKeySize(
+    hci::Status status, uint16_t handle, uint8_t key_size) {
+  std::unique_ptr<EventPacketBuilder> evt_ptr =
+      EventPacketBuilder::CreateCommandCompleteOnlyStatusEvent(
+          OpCode::READ_ENCRYPTION_KEY_SIZE, status);
+
+  ASSERT(evt_ptr->AddPayloadOctets2(handle));
+  ASSERT(evt_ptr->AddPayloadOctets1(key_size));
 
   return evt_ptr;
 }
@@ -279,7 +304,7 @@
                                                                                               hci::LoopbackMode mode) {
   std::unique_ptr<EventPacketBuilder> evt_ptr =
       EventPacketBuilder::CreateCommandCompleteOnlyStatusEvent(OpCode::READ_LOOPBACK_MODE, status);
-  CHECK(evt_ptr->AddPayloadOctets1(static_cast<uint8_t>(mode)));
+  ASSERT(evt_ptr->AddPayloadOctets1(static_cast<uint8_t>(mode)));
 
   return evt_ptr;
 }
@@ -294,20 +319,20 @@
 
 bool EventPacketBuilder::AddInquiryResult(const Address& address, uint8_t page_scan_repetition_mode,
                                           ClassOfDevice class_of_device, uint16_t clock_offset) {
-  CHECK(event_code_ == EventCode::INQUIRY_RESULT);
+  ASSERT(event_code_ == EventCode::INQUIRY_RESULT);
 
   if (!CanAddPayloadOctets(14)) return false;
 
   std::unique_ptr<RawBuilder> result = std::make_unique<RawBuilder>();
 
-  CHECK(result->AddAddress(address));
-  CHECK(result->AddOctets1(page_scan_repetition_mode));
-  CHECK(result->AddOctets2(0));  // Reserved
-  CHECK(result->AddOctets1(class_of_device.cod[0]));
-  CHECK(result->AddOctets1(class_of_device.cod[1]));
-  CHECK(result->AddOctets1(class_of_device.cod[2]));
-  CHECK(!(clock_offset & 0x8000));
-  CHECK(result->AddOctets2(clock_offset));
+  ASSERT(result->AddAddress(address));
+  ASSERT(result->AddOctets1(page_scan_repetition_mode));
+  ASSERT(result->AddOctets2(0));  // Reserved
+  ASSERT(result->AddOctets1(class_of_device.cod[0]));
+  ASSERT(result->AddOctets1(class_of_device.cod[1]));
+  ASSERT(result->AddOctets1(class_of_device.cod[2]));
+  ASSERT(!(clock_offset & 0x8000));
+  ASSERT(result->AddOctets2(clock_offset));
   AddBuilder(std::move(result));
   return true;
 }
@@ -318,12 +343,12 @@
   std::unique_ptr<EventPacketBuilder> evt_ptr =
       std::unique_ptr<EventPacketBuilder>(new EventPacketBuilder(EventCode::CONNECTION_COMPLETE));
 
-  CHECK(evt_ptr->AddPayloadOctets1(static_cast<uint8_t>(status)));
-  CHECK((handle & 0xf000) == 0);  // Handles are 12-bit values.
-  CHECK(evt_ptr->AddPayloadOctets2(handle));
-  CHECK(evt_ptr->AddPayloadAddress(address));
-  CHECK(evt_ptr->AddPayloadOctets1(static_cast<uint8_t>(link_type)));
-  CHECK(evt_ptr->AddPayloadOctets1(encryption_enabled ? 1 : 0));
+  ASSERT(evt_ptr->AddPayloadOctets1(static_cast<uint8_t>(status)));
+  ASSERT((handle & 0xf000) == 0);  // Handles are 12-bit values.
+  ASSERT(evt_ptr->AddPayloadOctets2(handle));
+  ASSERT(evt_ptr->AddPayloadAddress(address));
+  ASSERT(evt_ptr->AddPayloadOctets1(static_cast<uint8_t>(link_type)));
+  ASSERT(evt_ptr->AddPayloadOctets1(encryption_enabled ? 1 : 0));
 
   return evt_ptr;
 }
@@ -335,11 +360,11 @@
   std::unique_ptr<EventPacketBuilder> evt_ptr =
       std::unique_ptr<EventPacketBuilder>(new EventPacketBuilder(EventCode::CONNECTION_REQUEST));
 
-  CHECK(evt_ptr->AddPayloadAddress(address));
-  CHECK(evt_ptr->AddPayloadOctets1(class_of_device.cod[0]));
-  CHECK(evt_ptr->AddPayloadOctets1(class_of_device.cod[1]));
-  CHECK(evt_ptr->AddPayloadOctets1(class_of_device.cod[2]));
-  CHECK(evt_ptr->AddPayloadOctets1(static_cast<uint8_t>(link_type)));
+  ASSERT(evt_ptr->AddPayloadAddress(address));
+  ASSERT(evt_ptr->AddPayloadOctets1(class_of_device.cod[0]));
+  ASSERT(evt_ptr->AddPayloadOctets1(class_of_device.cod[1]));
+  ASSERT(evt_ptr->AddPayloadOctets1(class_of_device.cod[2]));
+  ASSERT(evt_ptr->AddPayloadOctets1(static_cast<uint8_t>(link_type)));
 
   return evt_ptr;
 }
@@ -351,10 +376,10 @@
   std::unique_ptr<EventPacketBuilder> evt_ptr =
       std::unique_ptr<EventPacketBuilder>(new EventPacketBuilder(EventCode::DISCONNECTION_COMPLETE));
 
-  CHECK(evt_ptr->AddPayloadOctets1(static_cast<uint8_t>(status)));
-  CHECK((handle & 0xf000) == 0);  // Handles are 12-bit values.
-  CHECK(evt_ptr->AddPayloadOctets2(handle));
-  CHECK(evt_ptr->AddPayloadOctets1(reason));
+  ASSERT(evt_ptr->AddPayloadOctets1(static_cast<uint8_t>(status)));
+  ASSERT((handle & 0xf000) == 0);  // Handles are 12-bit values.
+  ASSERT(evt_ptr->AddPayloadOctets2(handle));
+  ASSERT(evt_ptr->AddPayloadOctets1(reason));
 
   return evt_ptr;
 }
@@ -364,9 +389,9 @@
                                                                                           uint16_t handle) {
   std::unique_ptr<EventPacketBuilder> evt_ptr =
       std::unique_ptr<EventPacketBuilder>(new EventPacketBuilder(EventCode::AUTHENTICATION_COMPLETE));
-  CHECK(evt_ptr->AddPayloadOctets1(static_cast<uint8_t>(status)));
-  CHECK((handle & 0xf000) == 0);  // Handles are 12-bit values.
-  CHECK(evt_ptr->AddPayloadOctets2(handle));
+  ASSERT(evt_ptr->AddPayloadOctets1(static_cast<uint8_t>(status)));
+  ASSERT((handle & 0xf000) == 0);  // Handles are 12-bit values.
+  ASSERT(evt_ptr->AddPayloadOctets2(handle));
   return evt_ptr;
 }
 
@@ -376,11 +401,11 @@
   std::unique_ptr<EventPacketBuilder> evt_ptr =
       std::unique_ptr<EventPacketBuilder>(new EventPacketBuilder(EventCode::REMOTE_NAME_REQUEST_COMPLETE));
 
-  CHECK(evt_ptr->AddPayloadOctets1(static_cast<uint8_t>(status)));
-  CHECK(evt_ptr->AddPayloadAddress(address));
-  for (size_t i = 0; i < remote_name.length(); i++) CHECK(evt_ptr->AddPayloadOctets1(remote_name[i]));
-  CHECK(evt_ptr->AddPayloadOctets1(0));  // Null terminated
-  for (size_t i = 0; i < 248 - remote_name.length() - 1; i++) CHECK(evt_ptr->AddPayloadOctets1(0xFF));
+  ASSERT(evt_ptr->AddPayloadOctets1(static_cast<uint8_t>(status)));
+  ASSERT(evt_ptr->AddPayloadAddress(address));
+  for (size_t i = 0; i < remote_name.length(); i++) ASSERT(evt_ptr->AddPayloadOctets1(remote_name[i]));
+  ASSERT(evt_ptr->AddPayloadOctets1(0));  // Null terminated
+  for (size_t i = 0; i < 248 - remote_name.length() - 1; i++) ASSERT(evt_ptr->AddPayloadOctets1(0xFF));
 
   return evt_ptr;
 }
@@ -389,7 +414,7 @@
 std::unique_ptr<EventPacketBuilder> EventPacketBuilder::CreateLinkKeyRequestEvent(const Address& remote) {
   std::unique_ptr<EventPacketBuilder> evt_ptr =
       std::unique_ptr<EventPacketBuilder>(new EventPacketBuilder(EventCode::LINK_KEY_REQUEST));
-  CHECK(evt_ptr->AddPayloadAddress(remote));
+  ASSERT(evt_ptr->AddPayloadAddress(remote));
   return evt_ptr;
 }
 
@@ -399,10 +424,10 @@
                                                                                        uint8_t key_type) {
   std::unique_ptr<EventPacketBuilder> evt_ptr =
       std::unique_ptr<EventPacketBuilder>(new EventPacketBuilder(EventCode::LINK_KEY_NOTIFICATION));
-  CHECK(evt_ptr->AddPayloadAddress(remote));
-  CHECK(key.size() == 16);
-  CHECK(evt_ptr->AddPayloadOctets(key));
-  CHECK(evt_ptr->AddPayloadOctets1(key_type));
+  ASSERT(evt_ptr->AddPayloadAddress(remote));
+  ASSERT(key.size() == 16);
+  ASSERT(evt_ptr->AddPayloadOctets(key));
+  ASSERT(evt_ptr->AddPayloadOctets1(key_type));
   return evt_ptr;
 }
 
@@ -411,8 +436,8 @@
                                                                                    PacketView<true> payload) {
   std::unique_ptr<EventPacketBuilder> evt_ptr =
       std::unique_ptr<EventPacketBuilder>(new EventPacketBuilder(EventCode::LOOPBACK_COMMAND));
-  CHECK(evt_ptr->AddPayloadOctets2(static_cast<uint16_t>(opcode)));
-  CHECK(evt_ptr->AddPayloadOctets1(static_cast<uint8_t>(payload.size())));
+  ASSERT(evt_ptr->AddPayloadOctets2(static_cast<uint16_t>(opcode)));
+  ASSERT(evt_ptr->AddPayloadOctets1(static_cast<uint8_t>(payload.size())));
   for (const auto& payload_byte : payload)  // Fill the packet.
     evt_ptr->AddPayloadOctets1(payload_byte);
   return evt_ptr;
@@ -423,9 +448,9 @@
                                                                                    uint16_t offset) {
   std::unique_ptr<EventPacketBuilder> evt_ptr =
       std::unique_ptr<EventPacketBuilder>(new EventPacketBuilder(EventCode::READ_CLOCK_OFFSET_COMPLETE));
-  CHECK(evt_ptr->AddPayloadOctets1(static_cast<uint8_t>(status)));
-  CHECK(evt_ptr->AddPayloadOctets2(handle));
-  CHECK(evt_ptr->AddPayloadOctets2(offset));
+  ASSERT(evt_ptr->AddPayloadOctets1(static_cast<uint8_t>(status)));
+  ASSERT(evt_ptr->AddPayloadOctets2(handle));
+  ASSERT(evt_ptr->AddPayloadOctets2(offset));
   return evt_ptr;
 }
 
@@ -434,10 +459,10 @@
                                                                                                uint16_t handle,
                                                                                                uint16_t packet_type) {
   std::unique_ptr<EventPacketBuilder> evt_ptr =
-      std::unique_ptr<EventPacketBuilder>(new EventPacketBuilder(EventCode::CONNECTION_PACKET_TYPE_CHANGE));
-  CHECK(evt_ptr->AddPayloadOctets1(static_cast<uint8_t>(status)));
-  CHECK(evt_ptr->AddPayloadOctets2(handle));
-  CHECK(evt_ptr->AddPayloadOctets2(packet_type));
+      std::unique_ptr<EventPacketBuilder>(new EventPacketBuilder(EventCode::CONNECTION_PACKET_TYPE_CHANGED));
+  ASSERT(evt_ptr->AddPayloadOctets1(static_cast<uint8_t>(status)));
+  ASSERT(evt_ptr->AddPayloadOctets2(handle));
+  ASSERT(evt_ptr->AddPayloadOctets2(packet_type));
   return evt_ptr;
 }
 
@@ -447,7 +472,7 @@
   std::unique_ptr<EventPacketBuilder> evt_ptr =
       EventPacketBuilder::CreateCommandCompleteOnlyStatusEvent(OpCode::SNIFF_SUBRATING, status);
 
-  CHECK(evt_ptr->AddPayloadOctets2(handle));
+  ASSERT(evt_ptr->AddPayloadOctets2(handle));
   return evt_ptr;
 }
 
@@ -458,30 +483,40 @@
   std::unique_ptr<EventPacketBuilder> evt_ptr =
       std::unique_ptr<EventPacketBuilder>(new EventPacketBuilder(EventCode::EXTENDED_INQUIRY_RESULT));
 
-  CHECK(evt_ptr->AddPayloadOctets1(1));  // Always contains a single response
+  ASSERT(evt_ptr->AddPayloadOctets1(1));  // Always contains a single response
 
-  CHECK(evt_ptr->AddPayloadAddress(address));
-  CHECK(evt_ptr->AddPayloadOctets1(page_scan_repetition_mode));
-  CHECK(evt_ptr->AddPayloadOctets1(0));  // Reserved
-  CHECK(evt_ptr->AddPayloadOctets1(class_of_device.cod[0]));
-  CHECK(evt_ptr->AddPayloadOctets1(class_of_device.cod[1]));
-  CHECK(evt_ptr->AddPayloadOctets1(class_of_device.cod[2]));
-  CHECK(!(clock_offset & 0x8000));
-  CHECK(evt_ptr->AddPayloadOctets2(clock_offset));
-  CHECK(evt_ptr->AddPayloadOctets1(rssi));
-  CHECK(evt_ptr->AddPayloadOctets(extended_inquiry_response));
+  ASSERT(evt_ptr->AddPayloadAddress(address));
+  ASSERT(evt_ptr->AddPayloadOctets1(page_scan_repetition_mode));
+  ASSERT(evt_ptr->AddPayloadOctets1(0));  // Reserved
+  ASSERT(evt_ptr->AddPayloadOctets1(class_of_device.cod[0]));
+  ASSERT(evt_ptr->AddPayloadOctets1(class_of_device.cod[1]));
+  ASSERT(evt_ptr->AddPayloadOctets1(class_of_device.cod[2]));
+  ASSERT(!(clock_offset & 0x8000));
+  ASSERT(evt_ptr->AddPayloadOctets2(clock_offset));
+  ASSERT(evt_ptr->AddPayloadOctets1(rssi));
+  ASSERT(evt_ptr->AddPayloadOctets(extended_inquiry_response));
   evt_ptr->AddPayloadOctets1(0x00);  // End marker
   while (evt_ptr->AddPayloadOctets1(0x00))
     ;  // Fill packet
   return evt_ptr;
 }
 
+// Bluetooth Core Specification Version 4.2, Volume 2, Part E, Section 7.7.38
+std::unique_ptr<EventPacketBuilder> EventPacketBuilder::CreateEncryptionKeyRefreshCompleteEvent(hci::Status status,
+                                                                                                uint16_t handle) {
+  std::unique_ptr<EventPacketBuilder> evt_ptr =
+      std::unique_ptr<EventPacketBuilder>(new EventPacketBuilder(EventCode::ENCRYPTION_KEY_REFRESH_COMPLETE));
+  ASSERT(evt_ptr->AddPayloadOctets1(static_cast<uint8_t>(status)));
+  ASSERT(evt_ptr->AddPayloadOctets2(handle));
+  return evt_ptr;
+}
+
 // Bluetooth Core Specification Version 4.2, Volume 2, Part E, Section 7.7.40
 std::unique_ptr<EventPacketBuilder> EventPacketBuilder::CreateIoCapabilityRequestEvent(const Address& peer) {
   std::unique_ptr<EventPacketBuilder> evt_ptr =
       std::unique_ptr<EventPacketBuilder>(new EventPacketBuilder(EventCode::IO_CAPABILITY_REQUEST));
 
-  CHECK(evt_ptr->AddPayloadAddress(peer));
+  ASSERT(evt_ptr->AddPayloadAddress(peer));
   return evt_ptr;
 }  // namespace packets
 
@@ -491,10 +526,10 @@
   std::unique_ptr<EventPacketBuilder> evt_ptr =
       std::unique_ptr<EventPacketBuilder>(new EventPacketBuilder(EventCode::IO_CAPABILITY_RESPONSE));
 
-  CHECK(evt_ptr->AddPayloadAddress(peer));
-  CHECK(evt_ptr->AddPayloadOctets1(io_capability));
-  CHECK(evt_ptr->AddPayloadOctets1(oob_data_present));
-  CHECK(evt_ptr->AddPayloadOctets1(authentication_requirements));
+  ASSERT(evt_ptr->AddPayloadAddress(peer));
+  ASSERT(evt_ptr->AddPayloadOctets1(io_capability));
+  ASSERT(evt_ptr->AddPayloadOctets1(oob_data_present));
+  ASSERT(evt_ptr->AddPayloadOctets1(authentication_requirements));
   return evt_ptr;
 }  // namespace test_vendor_lib
 
@@ -504,8 +539,8 @@
   std::unique_ptr<EventPacketBuilder> evt_ptr =
       std::unique_ptr<EventPacketBuilder>(new EventPacketBuilder(EventCode::USER_CONFIRMATION_REQUEST));
 
-  CHECK(evt_ptr->AddPayloadAddress(peer));
-  CHECK(evt_ptr->AddPayloadOctets4(numeric_value));
+  ASSERT(evt_ptr->AddPayloadAddress(peer));
+  ASSERT(evt_ptr->AddPayloadOctets4(numeric_value));
   return evt_ptr;
 }
 
@@ -514,7 +549,7 @@
   std::unique_ptr<EventPacketBuilder> evt_ptr =
       std::unique_ptr<EventPacketBuilder>(new EventPacketBuilder(EventCode::USER_PASSKEY_REQUEST));
 
-  CHECK(evt_ptr->AddPayloadAddress(peer));
+  ASSERT(evt_ptr->AddPayloadAddress(peer));
   return evt_ptr;
 }
 
@@ -523,7 +558,7 @@
   std::unique_ptr<EventPacketBuilder> evt_ptr =
       std::unique_ptr<EventPacketBuilder>(new EventPacketBuilder(EventCode::REMOTE_OOB_DATA_REQUEST));
 
-  CHECK(evt_ptr->AddPayloadAddress(peer));
+  ASSERT(evt_ptr->AddPayloadAddress(peer));
   return evt_ptr;
 }
 
@@ -533,8 +568,8 @@
   std::unique_ptr<EventPacketBuilder> evt_ptr =
       std::unique_ptr<EventPacketBuilder>(new EventPacketBuilder(EventCode::SIMPLE_PAIRING_COMPLETE));
 
-  CHECK(evt_ptr->AddPayloadOctets1(static_cast<uint8_t>(status)));
-  CHECK(evt_ptr->AddPayloadAddress(peer));
+  ASSERT(evt_ptr->AddPayloadOctets1(static_cast<uint8_t>(status)));
+  ASSERT(evt_ptr->AddPayloadAddress(peer));
   return evt_ptr;
 }
 
@@ -544,8 +579,8 @@
   std::unique_ptr<EventPacketBuilder> evt_ptr =
       std::unique_ptr<EventPacketBuilder>(new EventPacketBuilder(EventCode::USER_PASSKEY_NOTIFICATION));
 
-  CHECK(evt_ptr->AddPayloadAddress(peer));
-  CHECK(evt_ptr->AddPayloadOctets4(passkey));
+  ASSERT(evt_ptr->AddPayloadAddress(peer));
+  ASSERT(evt_ptr->AddPayloadOctets4(passkey));
   return evt_ptr;
 }
 
@@ -555,8 +590,8 @@
   std::unique_ptr<EventPacketBuilder> evt_ptr =
       std::unique_ptr<EventPacketBuilder>(new EventPacketBuilder(EventCode::KEYPRESS_NOTIFICATION));
 
-  CHECK(evt_ptr->AddPayloadAddress(peer));
-  CHECK(evt_ptr->AddPayloadOctets1(notification_type));
+  ASSERT(evt_ptr->AddPayloadAddress(peer));
+  ASSERT(evt_ptr->AddPayloadOctets1(notification_type));
   return evt_ptr;
 }
 
@@ -599,7 +634,7 @@
 bool EventPacketBuilder::AddLeAdvertisingReport(LeAdvertisement::AdvertisementType event_type,
                                                 LeAdvertisement::AddressType addr_type, const Address& addr,
                                                 const vector<uint8_t>& data, uint8_t rssi) {
-  CHECK(event_code_ == EventCode::LE_META_EVENT);
+  ASSERT(event_code_ == EventCode::LE_META_EVENT);
 
   // Upcast the payload to add the next report.
   LeMetaEventBuilder* meta_ptr = static_cast<LeMetaEventBuilder*>(payload_.get());
@@ -620,9 +655,9 @@
   std::unique_ptr<EventPacketBuilder> evt_ptr =
       std::unique_ptr<EventPacketBuilder>(new EventPacketBuilder(EventCode::READ_REMOTE_SUPPORTED_FEATURES_COMPLETE));
 
-  CHECK(evt_ptr->AddPayloadOctets1(static_cast<uint8_t>(status)));
-  CHECK(evt_ptr->AddPayloadOctets2(handle));
-  CHECK(evt_ptr->AddPayloadOctets8(features));
+  ASSERT(evt_ptr->AddPayloadOctets1(static_cast<uint8_t>(status)));
+  ASSERT(evt_ptr->AddPayloadOctets2(handle));
+  ASSERT(evt_ptr->AddPayloadOctets8(features));
 
   return evt_ptr;
 }
@@ -632,7 +667,7 @@
   std::unique_ptr<EventPacketBuilder> evt_ptr =
       EventPacketBuilder::CreateCommandCompleteOnlyStatusEvent(OpCode::LINK_KEY_REQUEST_REPLY, status);
 
-  CHECK(evt_ptr->AddPayloadAddress(address));
+  ASSERT(evt_ptr->AddPayloadAddress(address));
 
   return evt_ptr;
 }
@@ -642,7 +677,7 @@
   std::unique_ptr<EventPacketBuilder> evt_ptr =
       EventPacketBuilder::CreateCommandCompleteOnlyStatusEvent(OpCode::LINK_KEY_REQUEST_NEGATIVE_REPLY, status);
 
-  CHECK(evt_ptr->AddPayloadAddress(address));
+  ASSERT(evt_ptr->AddPayloadAddress(address));
 
   return evt_ptr;
 }
@@ -652,7 +687,7 @@
   std::unique_ptr<EventPacketBuilder> evt_ptr =
       EventPacketBuilder::CreateCommandCompleteOnlyStatusEvent(OpCode::WRITE_LINK_POLICY_SETTINGS, status);
 
-  CHECK(evt_ptr->AddPayloadOctets2(handle));
+  ASSERT(evt_ptr->AddPayloadOctets2(handle));
 
   return evt_ptr;
 }
@@ -662,7 +697,7 @@
   std::unique_ptr<EventPacketBuilder> evt_ptr =
       EventPacketBuilder::CreateCommandCompleteOnlyStatusEvent(OpCode::WRITE_LINK_SUPERVISION_TIMEOUT, status);
 
-  CHECK(evt_ptr->AddPayloadOctets2(handle));
+  ASSERT(evt_ptr->AddPayloadOctets2(handle));
 
   return evt_ptr;
 }
@@ -673,8 +708,8 @@
   std::unique_ptr<EventPacketBuilder> evt_ptr =
       EventPacketBuilder::CreateCommandCompleteOnlyStatusEvent(OpCode::LE_READ_BUFFER_SIZE, status);
 
-  CHECK(evt_ptr->AddPayloadOctets2(hc_le_data_packet_length));
-  CHECK(evt_ptr->AddPayloadOctets1(hc_total_num_le_data_packets));
+  ASSERT(evt_ptr->AddPayloadOctets2(hc_le_data_packet_length));
+  ASSERT(evt_ptr->AddPayloadOctets1(hc_total_num_le_data_packets));
 
   return evt_ptr;
 }
@@ -685,7 +720,7 @@
   std::unique_ptr<EventPacketBuilder> evt_ptr =
       EventPacketBuilder::CreateCommandCompleteOnlyStatusEvent(OpCode::LE_READ_LOCAL_SUPPORTED_FEATURES, status);
 
-  CHECK(evt_ptr->AddPayloadOctets8(le_features));
+  ASSERT(evt_ptr->AddPayloadOctets8(le_features));
 
   return evt_ptr;
 }
@@ -696,7 +731,7 @@
   std::unique_ptr<EventPacketBuilder> evt_ptr =
       EventPacketBuilder::CreateCommandCompleteOnlyStatusEvent(OpCode::LE_READ_WHITE_LIST_SIZE, status);
 
-  CHECK(evt_ptr->AddPayloadOctets8(white_list_size));
+  ASSERT(evt_ptr->AddPayloadOctets8(white_list_size));
 
   return evt_ptr;
 }
@@ -707,7 +742,7 @@
   std::unique_ptr<EventPacketBuilder> evt_ptr =
       EventPacketBuilder::CreateCommandCompleteOnlyStatusEvent(OpCode::LE_RAND, status);
 
-  CHECK(evt_ptr->AddPayloadOctets8(random_val));
+  ASSERT(evt_ptr->AddPayloadOctets8(random_val));
 
   return evt_ptr;
 }
@@ -718,7 +753,7 @@
   std::unique_ptr<EventPacketBuilder> evt_ptr =
       EventPacketBuilder::CreateCommandCompleteOnlyStatusEvent(OpCode::LE_READ_SUPPORTED_STATES, status);
 
-  CHECK(evt_ptr->AddPayloadOctets8(le_states));
+  ASSERT(evt_ptr->AddPayloadOctets8(le_states));
 
   return evt_ptr;
 }
@@ -730,7 +765,7 @@
   std::unique_ptr<EventPacketBuilder> evt_ptr =
       EventPacketBuilder::CreateCommandCompleteOnlyStatusEvent(OpCode::LE_GET_VENDOR_CAPABILITIES, status);
 
-  CHECK(evt_ptr->AddPayloadOctets(vendor_cap));
+  ASSERT(evt_ptr->AddPayloadOctets(vendor_cap));
 
   return evt_ptr;
 }
@@ -740,9 +775,9 @@
   std::unique_ptr<EventPacketBuilder> evt_ptr =
       std::unique_ptr<EventPacketBuilder>(new EventPacketBuilder(EventCode::ENCRYPTION_CHANGE));
 
-  CHECK(evt_ptr->AddPayloadOctets1(static_cast<uint8_t>(status)));
-  CHECK(evt_ptr->AddPayloadOctets2(handle));
-  CHECK(evt_ptr->AddPayloadOctets1(encryption_enable));
+  ASSERT(evt_ptr->AddPayloadOctets1(static_cast<uint8_t>(status)));
+  ASSERT(evt_ptr->AddPayloadOctets2(handle));
+  ASSERT(evt_ptr->AddPayloadOctets1(encryption_enable));
 
   return evt_ptr;
 }
@@ -755,7 +790,8 @@
 void EventPacketBuilder::Serialize(std::back_insert_iterator<std::vector<uint8_t>> it) const {
   insert(static_cast<uint8_t>(event_code_), it);
   uint8_t payload_size = size() - 2;  // Event code and payload size
-  CHECK(size() - 2 == static_cast<size_t>(payload_size)) << "Payload too large for an event: " << size();
+  ASSERT_LOG(size() - 2 == static_cast<size_t>(payload_size), "Payload too large for an event: %d",
+             static_cast<int>(size()));
   insert(payload_size, it);
   payload_->Serialize(it);
 }
diff --git a/vendor_libs/test_vendor_lib/packets/hci/event_packet_builder.h b/vendor_libs/test_vendor_lib/packets/hci/event_packet_builder.h
index 495e47a..c0fe633 100644
--- a/vendor_libs/test_vendor_lib/packets/hci/event_packet_builder.h
+++ b/vendor_libs/test_vendor_lib/packets/hci/event_packet_builder.h
@@ -16,7 +16,6 @@
 
 #pragma once
 
-#include <base/logging.h>
 #include <cstdint>
 #include <memory>
 #include <string>
@@ -107,6 +106,10 @@
   static std::unique_ptr<EventPacketBuilder> CreateCommandCompleteReadLocalSupportedCommands(
       hci::Status status, const std::vector<uint8_t>& supported_commands);
 
+  // Bluetooth Core Specification Version 4.2, Volume 2, Part E, Section 7.4.3
+  static std::unique_ptr<EventPacketBuilder> CreateCommandCompleteReadLocalSupportedFeatures(
+      hci::Status status, uint64_t supported_features);
+
   // Bluetooth Core Specification Version 4.2, Volume 2, Part E, Section 7.4.4
   static std::unique_ptr<EventPacketBuilder> CreateCommandCompleteReadLocalExtendedFeatures(
       hci::Status status, uint8_t page_number, uint8_t maximum_page_number, uint64_t extended_lmp_features);
@@ -125,6 +128,11 @@
       hci::Status status, const std::vector<uint8_t>& supported_codecs,
       const std::vector<uint32_t>& vendor_specific_codecs);
 
+  // Bluetooth Core Specification Version 5.1, Volume 2, Part E, Section 7.5.7
+  static std::unique_ptr<EventPacketBuilder>
+  CreateCommandCompleteReadEncryptionKeySize(hci::Status status,
+                                             uint16_t handle, uint8_t key_size);
+
   // Bluetooth Core Specification Version 4.2, Volume 2, Part E, Section 7.6.1
   static std::unique_ptr<EventPacketBuilder> CreateCommandCompleteReadLoopbackMode(hci::Status status,
                                                                                    hci::LoopbackMode mode);
@@ -203,6 +211,10 @@
       const Address& bt_address, uint8_t page_scan_repetition_mode, ClassOfDevice class_of_device,
       uint16_t clock_offset, uint8_t rssi, const std::vector<uint8_t>& extended_inquiry_response);
 
+  // Bluetooth Core Specification Version 4.2, Volume 2, Part E, Section 7.7.39
+  static std::unique_ptr<EventPacketBuilder> CreateEncryptionKeyRefreshCompleteEvent(hci::Status status,
+                                                                                     uint16_t handle);
+
   // Bluetooth Core Specification Version 4.2, Volume 2, Part E, Section 7.7.40
   static std::unique_ptr<EventPacketBuilder> CreateIoCapabilityRequestEvent(const Address& peer);
 
diff --git a/vendor_libs/test_vendor_lib/packets/hci/event_payload_builder.cc b/vendor_libs/test_vendor_lib/packets/hci/event_payload_builder.cc
index dd866a2..9c9bdc5 100644
--- a/vendor_libs/test_vendor_lib/packets/hci/event_payload_builder.cc
+++ b/vendor_libs/test_vendor_lib/packets/hci/event_payload_builder.cc
@@ -16,7 +16,6 @@
 
 #include "event_payload_builder.h"
 
-#include <base/logging.h>
 #include <algorithm>
 
 using std::vector;
diff --git a/vendor_libs/test_vendor_lib/packets/hci/le_meta_event_builder.cc b/vendor_libs/test_vendor_lib/packets/hci/le_meta_event_builder.cc
index f0599a7..caaf136 100644
--- a/vendor_libs/test_vendor_lib/packets/hci/le_meta_event_builder.cc
+++ b/vendor_libs/test_vendor_lib/packets/hci/le_meta_event_builder.cc
@@ -16,7 +16,7 @@
 
 #include "packets/hci/le_meta_event_builder.h"
 
-#include <base/logging.h>
+#include "os/log.h"
 
 using std::vector;
 using test_vendor_lib::hci::LeSubEventCode;
@@ -34,19 +34,19 @@
 // Bluetooth Core Specification Version 4.2, Volume 2, Part E, Section 7.7.65.1
 std::unique_ptr<LeMetaEventBuilder> LeMetaEventBuilder::CreateLeConnectionCompleteEvent(
     Status status, uint16_t handle, uint8_t role, uint8_t peer_address_type, const Address& peer, uint16_t interval,
-    uint16_t latency, uint16_t supervision_timeout) {
+    uint16_t latency, uint16_t supervision_timeout, uint8_t master_clock_accuracy) {
   std::unique_ptr<LeMetaEventBuilder> evt_ptr =
       std::unique_ptr<LeMetaEventBuilder>(new LeMetaEventBuilder(LeSubEventCode::CONNECTION_COMPLETE));
 
-  CHECK(evt_ptr->AddOctets1(static_cast<uint8_t>(status)));
-  CHECK(evt_ptr->AddOctets2(handle));
-  CHECK(evt_ptr->AddOctets1(role));
-  CHECK(evt_ptr->AddOctets1(peer_address_type));
-  CHECK(evt_ptr->AddAddress(peer));
-  CHECK(evt_ptr->AddOctets2(interval));
-  CHECK(evt_ptr->AddOctets2(latency));
-  CHECK(evt_ptr->AddOctets2(supervision_timeout));
-  CHECK(evt_ptr->AddOctets1(0x00));  // Master Clock Accuracy (unused for master)
+  ASSERT(evt_ptr->AddOctets1(static_cast<uint8_t>(status)));
+  ASSERT(evt_ptr->AddOctets2(handle));
+  ASSERT(evt_ptr->AddOctets1(role));
+  ASSERT(evt_ptr->AddOctets1(peer_address_type));
+  ASSERT(evt_ptr->AddAddress(peer));
+  ASSERT(evt_ptr->AddOctets2(interval));
+  ASSERT(evt_ptr->AddOctets2(latency));
+  ASSERT(evt_ptr->AddOctets2(supervision_timeout));
+  ASSERT(evt_ptr->AddOctets1(master_clock_accuracy));
 
   return evt_ptr;
 }
@@ -58,17 +58,17 @@
   std::unique_ptr<LeMetaEventBuilder> evt_ptr =
       std::unique_ptr<LeMetaEventBuilder>(new LeMetaEventBuilder(LeSubEventCode::ENHANCED_CONNECTION_COMPLETE));
 
-  CHECK(evt_ptr->AddOctets1(static_cast<uint8_t>(status)));
-  CHECK(evt_ptr->AddOctets2(handle));
-  CHECK(evt_ptr->AddOctets1(role));
-  CHECK(evt_ptr->AddOctets1(peer_address_type));
-  CHECK(evt_ptr->AddAddress(peer));
-  CHECK(evt_ptr->AddAddress(local_private_address));
-  CHECK(evt_ptr->AddAddress(peer_private_address));
-  CHECK(evt_ptr->AddOctets2(interval));
-  CHECK(evt_ptr->AddOctets2(latency));
-  CHECK(evt_ptr->AddOctets2(supervision_timeout));
-  CHECK(evt_ptr->AddOctets1(0x00));  // Master Clock Accuracy (unused for master)
+  ASSERT(evt_ptr->AddOctets1(static_cast<uint8_t>(status)));
+  ASSERT(evt_ptr->AddOctets2(handle));
+  ASSERT(evt_ptr->AddOctets1(role));
+  ASSERT(evt_ptr->AddOctets1(peer_address_type));
+  ASSERT(evt_ptr->AddAddress(peer));
+  ASSERT(evt_ptr->AddAddress(local_private_address));
+  ASSERT(evt_ptr->AddAddress(peer_private_address));
+  ASSERT(evt_ptr->AddOctets2(interval));
+  ASSERT(evt_ptr->AddOctets2(latency));
+  ASSERT(evt_ptr->AddOctets2(supervision_timeout));
+  ASSERT(evt_ptr->AddOctets1(0x00));  // Master Clock Accuracy (unused for master)
 
   return evt_ptr;
 }
@@ -78,11 +78,11 @@
   std::unique_ptr<LeMetaEventBuilder> evt_ptr =
       std::unique_ptr<LeMetaEventBuilder>(new LeMetaEventBuilder(LeSubEventCode::CONNECTION_UPDATE_COMPLETE));
 
-  CHECK(evt_ptr->AddOctets1(static_cast<uint8_t>(status)));
-  CHECK(evt_ptr->AddOctets2(handle));
-  CHECK(evt_ptr->AddOctets2(interval));
-  CHECK(evt_ptr->AddOctets2(latency));
-  CHECK(evt_ptr->AddOctets2(supervision_timeout));
+  ASSERT(evt_ptr->AddOctets1(static_cast<uint8_t>(status)));
+  ASSERT(evt_ptr->AddOctets2(handle));
+  ASSERT(evt_ptr->AddOctets2(interval));
+  ASSERT(evt_ptr->AddOctets2(latency));
+  ASSERT(evt_ptr->AddOctets2(supervision_timeout));
 
   return evt_ptr;
 }
@@ -100,16 +100,16 @@
                                                 const vector<uint8_t>& data, uint8_t rssi) {
   if (!CanAddOctets(10 + data.size())) return false;
 
-  CHECK(sub_event_code_ == LeSubEventCode::ADVERTISING_REPORT);
+  ASSERT(sub_event_code_ == LeSubEventCode::ADVERTISING_REPORT);
 
   std::unique_ptr<RawBuilder> ad = std::make_unique<RawBuilder>();
 
-  CHECK(ad->AddOctets1(static_cast<uint8_t>(event_type)));
-  CHECK(ad->AddOctets1(static_cast<uint8_t>(addr_type)));
-  CHECK(ad->AddAddress(addr));
-  CHECK(ad->AddOctets1(data.size()));
-  CHECK(ad->AddOctets(data));
-  CHECK(ad->AddOctets1(rssi));
+  ASSERT(ad->AddOctets1(static_cast<uint8_t>(event_type)));
+  ASSERT(ad->AddOctets1(static_cast<uint8_t>(addr_type)));
+  ASSERT(ad->AddAddress(addr));
+  ASSERT(ad->AddOctets1(data.size()));
+  ASSERT(ad->AddOctets(data));
+  ASSERT(ad->AddOctets1(rssi));
   AddBuilder(std::move(ad));
   return true;
 }
@@ -120,21 +120,23 @@
   std::unique_ptr<LeMetaEventBuilder> evt_ptr =
       std::unique_ptr<LeMetaEventBuilder>(new LeMetaEventBuilder(LeSubEventCode::READ_REMOTE_FEATURES_COMPLETE));
 
-  CHECK(evt_ptr->AddOctets1(static_cast<uint8_t>(status)));
-  CHECK(evt_ptr->AddOctets2(handle));
-  CHECK(evt_ptr->AddOctets8(features));
+  ASSERT(evt_ptr->AddOctets1(static_cast<uint8_t>(status)));
+  ASSERT(evt_ptr->AddOctets2(handle));
+  ASSERT(evt_ptr->AddOctets8(features));
 
   return evt_ptr;
 }
 
 size_t LeMetaEventBuilder::size() const {
-  return 1 + payload_->size();  // Add the sub_event_code
+  return 1 + RawBuilder::size() + payload_->size();  // Add the sub_event_code
 }
 
 void LeMetaEventBuilder::Serialize(std::back_insert_iterator<std::vector<uint8_t>> it) const {
   insert(static_cast<uint8_t>(sub_event_code_), it);
   uint8_t payload_size = size() - sizeof(uint8_t);
-  CHECK(size() - sizeof(uint8_t) == static_cast<size_t>(payload_size)) << "Payload too large for an event: " << size();
+  ASSERT_LOG(size() - sizeof(uint8_t) == static_cast<size_t>(payload_size), "Payload too large for an event: %d",
+             static_cast<int>(size()));
+  RawBuilder::Serialize(it);
   payload_->Serialize(it);
 }
 
diff --git a/vendor_libs/test_vendor_lib/packets/hci/le_meta_event_builder.h b/vendor_libs/test_vendor_lib/packets/hci/le_meta_event_builder.h
index b1d713d..a56700c 100644
--- a/vendor_libs/test_vendor_lib/packets/hci/le_meta_event_builder.h
+++ b/vendor_libs/test_vendor_lib/packets/hci/le_meta_event_builder.h
@@ -16,7 +16,6 @@
 
 #pragma once
 
-#include <base/logging.h>
 #include <cstdint>
 #include <memory>
 #include <string>
@@ -43,11 +42,9 @@
 
   // Bluetooth Core Specification Version 4.2, Volume 2, Part E, Section
   // 7.7.65.1
-  static std::unique_ptr<LeMetaEventBuilder> CreateLeConnectionCompleteEvent(hci::Status status, uint16_t handle,
-                                                                             uint8_t role, uint8_t peer_address_type,
-                                                                             const Address& peer, uint16_t interval,
-                                                                             uint16_t latency,
-                                                                             uint16_t supervision_timeout);
+  static std::unique_ptr<LeMetaEventBuilder> CreateLeConnectionCompleteEvent(
+      hci::Status status, uint16_t handle, uint8_t role, uint8_t peer_address_type, const Address& peer,
+      uint16_t interval, uint16_t latency, uint16_t supervision_timeout, uint8_t master_clock_accuracy = 0);
 
   // Bluetooth Core Specification Version 4.2, Volume 2, Part E, Section
   // 7.7.65.2
diff --git a/vendor_libs/test_vendor_lib/packets/hci/sco_packet_builder.cc b/vendor_libs/test_vendor_lib/packets/hci/sco_packet_builder.cc
index 57203ed..ae61124 100644
--- a/vendor_libs/test_vendor_lib/packets/hci/sco_packet_builder.cc
+++ b/vendor_libs/test_vendor_lib/packets/hci/sco_packet_builder.cc
@@ -16,7 +16,7 @@
 
 #include "packets/hci/sco_packet_builder.h"
 
-#include <base/logging.h>
+#include "os/log.h"
 
 using std::vector;
 using test_vendor_lib::sco::PacketStatusFlagsType;
@@ -36,8 +36,8 @@
   insert(static_cast<uint16_t>((handle_ & 0xfff) | (static_cast<uint16_t>(packet_status_flags_) << 12)), it);
   uint8_t payload_size = payload_->size();
 
-  CHECK(static_cast<size_t>(payload_size) == payload_->size())
-      << "Payload too large for a SCO packet: " << payload_->size();
+  ASSERT_LOG(static_cast<size_t>(payload_size) == payload_->size(), "Payload too large for a SCO packet: %d",
+             static_cast<int>(payload_->size()));
   insert(payload_size, it);
   payload_->Serialize(it);
 }
diff --git a/vendor_libs/test_vendor_lib/packets/hci/sco_packet_builder.h b/vendor_libs/test_vendor_lib/packets/hci/sco_packet_builder.h
index a2d8561..94a71f5 100644
--- a/vendor_libs/test_vendor_lib/packets/hci/sco_packet_builder.h
+++ b/vendor_libs/test_vendor_lib/packets/hci/sco_packet_builder.h
@@ -16,7 +16,6 @@
 
 #pragma once
 
-#include <base/logging.h>
 #include <cstdint>
 #include <memory>
 #include <vector>
diff --git a/vendor_libs/test_vendor_lib/packets/hci/sco_packet_view.cc b/vendor_libs/test_vendor_lib/packets/hci/sco_packet_view.cc
index 9516ef4..415ce05 100644
--- a/vendor_libs/test_vendor_lib/packets/hci/sco_packet_view.cc
+++ b/vendor_libs/test_vendor_lib/packets/hci/sco_packet_view.cc
@@ -16,7 +16,7 @@
 
 #include "packets/hci/sco_packet_view.h"
 
-#include <base/logging.h>
+#include "os/log.h"
 
 using test_vendor_lib::sco::PacketStatusFlagsType;
 
@@ -39,8 +39,9 @@
 
 PacketView<true> ScoPacketView::GetPayload() const {
   uint8_t payload_size = (begin() + sizeof(uint16_t)).extract<uint8_t>();
-  CHECK(static_cast<uint8_t>(size() - sizeof(uint16_t) - sizeof(uint8_t)) == payload_size)
-      << "Malformed SCO packet payload_size " << payload_size << " + 4 != " << size();
+  ASSERT_LOG(static_cast<uint8_t>(size() - sizeof(uint16_t) - sizeof(uint8_t)) == payload_size,
+             "Malformed SCO packet payload_size %d + 4 != %d", static_cast<int>(payload_size),
+             static_cast<int>(size()));
   return SubViewLittleEndian(sizeof(uint16_t) + sizeof(uint8_t), size());
 }
 
diff --git a/vendor_libs/test_vendor_lib/packets/hci/sco_packet_view.h b/vendor_libs/test_vendor_lib/packets/hci/sco_packet_view.h
index 26b9489..3fb24b0 100644
--- a/vendor_libs/test_vendor_lib/packets/hci/sco_packet_view.h
+++ b/vendor_libs/test_vendor_lib/packets/hci/sco_packet_view.h
@@ -16,7 +16,6 @@
 
 #pragma once
 
-#include <base/logging.h>
 #include <cstdint>
 #include <memory>
 #include <vector>
diff --git a/vendor_libs/test_vendor_lib/packets/iterator.cc b/vendor_libs/test_vendor_lib/packets/iterator.cc
index 65173ee..dca3c82 100644
--- a/vendor_libs/test_vendor_lib/packets/iterator.cc
+++ b/vendor_libs/test_vendor_lib/packets/iterator.cc
@@ -16,7 +16,7 @@
 
 #include "iterator.h"
 
-#include <base/logging.h>
+#include "os/log.h"
 
 namespace test_vendor_lib {
 namespace packets {
@@ -131,7 +131,7 @@
 
 template <bool little_endian>
 uint8_t Iterator<little_endian>::operator*() const {
-  CHECK(index_ < length_) << "Index " << index_ << " out of bounds: " << length_;
+  ASSERT_LOG(index_ < length_, "Index %d out of bounds: %d", static_cast<int>(index_), static_cast<int>(length_));
   size_t index = index_;
 
   for (auto view : data_) {
@@ -140,7 +140,7 @@
     }
     index -= view.size();
   }
-  CHECK(false) << "Out of fragments searching for Index " << index_;
+  LOG_ALWAYS_FATAL("Out of fragments searching for Index %d", static_cast<int>(index_));
   return 0;
 }
 
diff --git a/vendor_libs/test_vendor_lib/packets/link_layer/command_builder.h b/vendor_libs/test_vendor_lib/packets/link_layer/command_builder.h
index 15a4ab8..ea3a1a2 100644
--- a/vendor_libs/test_vendor_lib/packets/link_layer/command_builder.h
+++ b/vendor_libs/test_vendor_lib/packets/link_layer/command_builder.h
@@ -19,8 +19,6 @@
 #include <cstdint>
 #include <memory>
 
-#include "base/logging.h"
-
 #include "packets/packet_builder.h"
 #include "packets/packet_view.h"
 
diff --git a/vendor_libs/test_vendor_lib/packets/link_layer/command_view.h b/vendor_libs/test_vendor_lib/packets/link_layer/command_view.h
index 0aa5683..6e83051 100644
--- a/vendor_libs/test_vendor_lib/packets/link_layer/command_view.h
+++ b/vendor_libs/test_vendor_lib/packets/link_layer/command_view.h
@@ -18,8 +18,7 @@
 
 #include <cstdint>
 
-#include <log/log.h>
-
+#include "os/log.h"
 #include "packets/link_layer/link_layer_packet_view.h"
 #include "packets/packet_view.h"
 
@@ -32,7 +31,7 @@
   virtual ~CommandView() = default;
 
   static CommandView GetCommand(const LinkLayerPacketView& view) {
-    CHECK(view.GetType() == Link::PacketType::COMMAND);
+    ASSERT(view.GetType() == Link::PacketType::COMMAND);
     return CommandView(view.GetPayload());
   }
 
diff --git a/vendor_libs/test_vendor_lib/packets/link_layer/disconnect_builder.h b/vendor_libs/test_vendor_lib/packets/link_layer/disconnect_builder.h
index 3c5a9f4..8083c85 100644
--- a/vendor_libs/test_vendor_lib/packets/link_layer/disconnect_builder.h
+++ b/vendor_libs/test_vendor_lib/packets/link_layer/disconnect_builder.h
@@ -19,8 +19,6 @@
 #include <cstdint>
 #include <memory>
 
-#include "base/logging.h"
-
 #include "packets/packet_builder.h"
 
 namespace test_vendor_lib {
diff --git a/vendor_libs/test_vendor_lib/packets/link_layer/disconnect_view.h b/vendor_libs/test_vendor_lib/packets/link_layer/disconnect_view.h
index cdfcdc5..3e72513 100644
--- a/vendor_libs/test_vendor_lib/packets/link_layer/disconnect_view.h
+++ b/vendor_libs/test_vendor_lib/packets/link_layer/disconnect_view.h
@@ -30,7 +30,7 @@
   virtual ~DisconnectView() = default;
 
   static DisconnectView GetDisconnect(const LinkLayerPacketView& view) {
-    CHECK(view.GetType() == Link::PacketType::DISCONNECT);
+    ASSERT(view.GetType() == Link::PacketType::DISCONNECT);
     return DisconnectView(view.GetPayload());
   }
 
diff --git a/vendor_libs/test_vendor_lib/packets/link_layer/encrypt_connection_builder.h b/vendor_libs/test_vendor_lib/packets/link_layer/encrypt_connection_builder.h
index 329ecdb..702d2b4 100644
--- a/vendor_libs/test_vendor_lib/packets/link_layer/encrypt_connection_builder.h
+++ b/vendor_libs/test_vendor_lib/packets/link_layer/encrypt_connection_builder.h
@@ -19,8 +19,6 @@
 #include <cstdint>
 #include <memory>
 
-#include "base/logging.h"
-
 #include "packets/packet_builder.h"
 
 namespace test_vendor_lib {
diff --git a/vendor_libs/test_vendor_lib/packets/link_layer/encrypt_connection_view.h b/vendor_libs/test_vendor_lib/packets/link_layer/encrypt_connection_view.h
index 665fe98..22006d0 100644
--- a/vendor_libs/test_vendor_lib/packets/link_layer/encrypt_connection_view.h
+++ b/vendor_libs/test_vendor_lib/packets/link_layer/encrypt_connection_view.h
@@ -30,8 +30,8 @@
   virtual ~EncryptConnectionView() = default;
 
   static EncryptConnectionView GetEncryptConnection(const LinkLayerPacketView& view) {
-    CHECK(view.GetType() == Link::PacketType::ENCRYPT_CONNECTION ||
-          view.GetType() == Link::PacketType::ENCRYPT_CONNECTION_RESPONSE);
+    ASSERT(view.GetType() == Link::PacketType::ENCRYPT_CONNECTION ||
+           view.GetType() == Link::PacketType::ENCRYPT_CONNECTION_RESPONSE);
     return EncryptConnectionView(view.GetPayload());
   }
 
diff --git a/vendor_libs/test_vendor_lib/packets/link_layer/inquiry_builder.h b/vendor_libs/test_vendor_lib/packets/link_layer/inquiry_builder.h
index 6703316..4c60ce0 100644
--- a/vendor_libs/test_vendor_lib/packets/link_layer/inquiry_builder.h
+++ b/vendor_libs/test_vendor_lib/packets/link_layer/inquiry_builder.h
@@ -19,8 +19,6 @@
 #include <cstdint>
 #include <memory>
 
-#include "base/logging.h"
-
 #include "inquiry.h"
 #include "packets/packet_builder.h"
 
diff --git a/vendor_libs/test_vendor_lib/packets/link_layer/inquiry_response_builder.h b/vendor_libs/test_vendor_lib/packets/link_layer/inquiry_response_builder.h
index 694fe71..5db0be5 100644
--- a/vendor_libs/test_vendor_lib/packets/link_layer/inquiry_response_builder.h
+++ b/vendor_libs/test_vendor_lib/packets/link_layer/inquiry_response_builder.h
@@ -19,8 +19,6 @@
 #include <cstdint>
 #include <memory>
 
-#include "base/logging.h"
-
 #include "include/inquiry.h"
 #include "packets/packet_builder.h"
 #include "types/class_of_device.h"
diff --git a/vendor_libs/test_vendor_lib/packets/link_layer/inquiry_response_view.h b/vendor_libs/test_vendor_lib/packets/link_layer/inquiry_response_view.h
index aac0585..f963134 100644
--- a/vendor_libs/test_vendor_lib/packets/link_layer/inquiry_response_view.h
+++ b/vendor_libs/test_vendor_lib/packets/link_layer/inquiry_response_view.h
@@ -31,7 +31,7 @@
   virtual ~InquiryResponseView() = default;
 
   static InquiryResponseView GetInquiryResponse(const LinkLayerPacketView& view) {
-    CHECK(view.GetType() == Link::PacketType::INQUIRY_RESPONSE);
+    ASSERT(view.GetType() == Link::PacketType::INQUIRY_RESPONSE);
     return InquiryResponseView(view.GetPayload());
   }
 
diff --git a/vendor_libs/test_vendor_lib/packets/link_layer/inquiry_view.h b/vendor_libs/test_vendor_lib/packets/link_layer/inquiry_view.h
index eee861c..ea8fac9 100644
--- a/vendor_libs/test_vendor_lib/packets/link_layer/inquiry_view.h
+++ b/vendor_libs/test_vendor_lib/packets/link_layer/inquiry_view.h
@@ -31,7 +31,7 @@
   virtual ~InquiryView() = default;
 
   static InquiryView GetInquiry(const LinkLayerPacketView& view) {
-    CHECK(view.GetType() == Link::PacketType::INQUIRY);
+    ASSERT(view.GetType() == Link::PacketType::INQUIRY);
     return InquiryView(view.GetPayload());
   }
 
diff --git a/vendor_libs/test_vendor_lib/packets/link_layer/io_capability_builder.h b/vendor_libs/test_vendor_lib/packets/link_layer/io_capability_builder.h
index 79efb50..16843d1 100644
--- a/vendor_libs/test_vendor_lib/packets/link_layer/io_capability_builder.h
+++ b/vendor_libs/test_vendor_lib/packets/link_layer/io_capability_builder.h
@@ -19,8 +19,6 @@
 #include <cstdint>
 #include <memory>
 
-#include "base/logging.h"
-
 #include "packets/packet_builder.h"
 
 namespace test_vendor_lib {
diff --git a/vendor_libs/test_vendor_lib/packets/link_layer/io_capability_negative_response_builder.h b/vendor_libs/test_vendor_lib/packets/link_layer/io_capability_negative_response_builder.h
index c9e7601..cd86314 100644
--- a/vendor_libs/test_vendor_lib/packets/link_layer/io_capability_negative_response_builder.h
+++ b/vendor_libs/test_vendor_lib/packets/link_layer/io_capability_negative_response_builder.h
@@ -19,8 +19,6 @@
 #include <cstdint>
 #include <memory>
 
-#include "base/logging.h"
-
 #include "packets/packet_builder.h"
 
 namespace test_vendor_lib {
diff --git a/vendor_libs/test_vendor_lib/packets/link_layer/io_capability_negative_response_view.h b/vendor_libs/test_vendor_lib/packets/link_layer/io_capability_negative_response_view.h
index 27c888f..5997814 100644
--- a/vendor_libs/test_vendor_lib/packets/link_layer/io_capability_negative_response_view.h
+++ b/vendor_libs/test_vendor_lib/packets/link_layer/io_capability_negative_response_view.h
@@ -30,7 +30,7 @@
   virtual ~IoCapabilityNegativeResponseView() = default;
 
   static IoCapabilityNegativeResponseView GetIoCapabilityNegativeResponse(const LinkLayerPacketView& view) {
-    CHECK(view.GetType() == Link::PacketType::IO_CAPABILITY_NEGATIVE_RESPONSE);
+    ASSERT(view.GetType() == Link::PacketType::IO_CAPABILITY_NEGATIVE_RESPONSE);
     return IoCapabilityNegativeResponseView(view.GetPayload());
   }
 
diff --git a/vendor_libs/test_vendor_lib/packets/link_layer/io_capability_view.h b/vendor_libs/test_vendor_lib/packets/link_layer/io_capability_view.h
index 66c7564..90a162c 100644
--- a/vendor_libs/test_vendor_lib/packets/link_layer/io_capability_view.h
+++ b/vendor_libs/test_vendor_lib/packets/link_layer/io_capability_view.h
@@ -30,8 +30,8 @@
   virtual ~IoCapabilityView() = default;
 
   static IoCapabilityView GetIoCapability(const LinkLayerPacketView& view) {
-    CHECK(view.GetType() == Link::PacketType::IO_CAPABILITY_RESPONSE ||
-          view.GetType() == Link::PacketType::IO_CAPABILITY_REQUEST);
+    ASSERT(view.GetType() == Link::PacketType::IO_CAPABILITY_RESPONSE ||
+           view.GetType() == Link::PacketType::IO_CAPABILITY_REQUEST);
     return IoCapabilityView(view.GetPayload());
   }
 
diff --git a/vendor_libs/test_vendor_lib/packets/link_layer/le_advertisement_builder.h b/vendor_libs/test_vendor_lib/packets/link_layer/le_advertisement_builder.h
index 18b3167..8c0e71b 100644
--- a/vendor_libs/test_vendor_lib/packets/link_layer/le_advertisement_builder.h
+++ b/vendor_libs/test_vendor_lib/packets/link_layer/le_advertisement_builder.h
@@ -19,8 +19,6 @@
 #include <cstdint>
 #include <memory>
 
-#include "base/logging.h"
-
 #include "include/le_advertisement.h"
 #include "packets/packet_builder.h"
 
diff --git a/vendor_libs/test_vendor_lib/packets/link_layer/le_advertisement_view.h b/vendor_libs/test_vendor_lib/packets/link_layer/le_advertisement_view.h
index 80e0367..574af28 100644
--- a/vendor_libs/test_vendor_lib/packets/link_layer/le_advertisement_view.h
+++ b/vendor_libs/test_vendor_lib/packets/link_layer/le_advertisement_view.h
@@ -18,8 +18,6 @@
 
 #include <cstdint>
 
-#include <log/log.h>
-
 #include "include/link.h"
 #include "packets/link_layer/link_layer_packet_view.h"
 #include "packets/packet_view.h"
@@ -33,7 +31,8 @@
   virtual ~LeAdvertisementView() = default;
 
   static LeAdvertisementView GetLeAdvertisementView(const LinkLayerPacketView& view) {
-    CHECK(view.GetType() == Link::PacketType::LE_ADVERTISEMENT || view.GetType() == Link::PacketType::LE_SCAN_RESPONSE);
+    ASSERT(view.GetType() == Link::PacketType::LE_ADVERTISEMENT ||
+           view.GetType() == Link::PacketType::LE_SCAN_RESPONSE);
     return LeAdvertisementView(view.GetPayload());
   }
 
diff --git a/vendor_libs/test_vendor_lib/packets/link_layer/le_connect_builder.h b/vendor_libs/test_vendor_lib/packets/link_layer/le_connect_builder.h
new file mode 100644
index 0000000..f33fc42
--- /dev/null
+++ b/vendor_libs/test_vendor_lib/packets/link_layer/le_connect_builder.h
@@ -0,0 +1,71 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#pragma once
+
+#include <cstdint>
+#include <memory>
+
+#include "packets/packet_builder.h"
+
+namespace test_vendor_lib {
+namespace packets {
+
+class LeConnectBuilder : public PacketBuilder<true> {
+ public:
+  virtual ~LeConnectBuilder() = default;
+
+  static std::unique_ptr<LeConnectBuilder> Create(uint16_t le_connection_interval_min,
+                                                  uint16_t le_connection_interval_max, uint16_t le_connection_latency,
+                                                  uint16_t le_connection_supervision_timeout,
+                                                  uint8_t peer_address_type) {
+    return std::unique_ptr<LeConnectBuilder>(
+        new LeConnectBuilder(le_connection_interval_min, le_connection_interval_max, le_connection_latency,
+                             le_connection_supervision_timeout, peer_address_type));
+  }
+
+  virtual size_t size() const override {
+    return sizeof(le_connection_interval_min_) + sizeof(le_connection_interval_max_) + sizeof(le_connection_latency_) +
+           sizeof(le_connection_supervision_timeout_) + sizeof(peer_address_type_);
+  }
+
+ protected:
+  virtual void Serialize(std::back_insert_iterator<std::vector<uint8_t>> it) const override {
+    insert(le_connection_interval_min_, it);
+    insert(le_connection_interval_max_, it);
+    insert(le_connection_latency_, it);
+    insert(le_connection_supervision_timeout_, it);
+    insert(peer_address_type_, it);
+  }
+
+ private:
+  explicit LeConnectBuilder(uint16_t le_connection_interval_min, uint16_t le_connection_interval_max,
+                            uint16_t le_connection_latency, uint16_t le_connection_supervision_timeout,
+                            uint8_t peer_address_type)
+      : le_connection_interval_min_(le_connection_interval_min),
+        le_connection_interval_max_(le_connection_interval_max), le_connection_latency_(le_connection_latency),
+        le_connection_supervision_timeout_(le_connection_supervision_timeout), peer_address_type_(peer_address_type)
+
+  {}
+  uint16_t le_connection_interval_min_;
+  uint16_t le_connection_interval_max_;
+  uint16_t le_connection_latency_;
+  uint16_t le_connection_supervision_timeout_;
+  uint8_t peer_address_type_;
+};
+
+}  // namespace packets
+}  // namespace test_vendor_lib
diff --git a/vendor_libs/test_vendor_lib/packets/link_layer/le_connect_complete_builder.h b/vendor_libs/test_vendor_lib/packets/link_layer/le_connect_complete_builder.h
new file mode 100644
index 0000000..379c3d4
--- /dev/null
+++ b/vendor_libs/test_vendor_lib/packets/link_layer/le_connect_complete_builder.h
@@ -0,0 +1,66 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#pragma once
+
+#include <cstdint>
+#include <memory>
+
+#include "packets/packet_builder.h"
+
+namespace test_vendor_lib {
+namespace packets {
+
+class LeConnectCompleteBuilder : public PacketBuilder<true> {
+ public:
+  virtual ~LeConnectCompleteBuilder() = default;
+
+  static std::unique_ptr<LeConnectCompleteBuilder> Create(uint16_t le_connection_interval,
+                                                          uint16_t le_connection_latency,
+                                                          uint16_t le_connection_supervision_timeout,
+                                                          uint8_t peer_address_type) {
+    return std::unique_ptr<LeConnectCompleteBuilder>(new LeConnectCompleteBuilder(
+        le_connection_interval, le_connection_latency, le_connection_supervision_timeout, peer_address_type));
+  }
+
+  virtual size_t size() const override {
+    return sizeof(le_connection_interval_) + sizeof(le_connection_latency_) +
+           sizeof(le_connection_supervision_timeout_) + sizeof(peer_address_type_);
+  }
+
+ protected:
+  virtual void Serialize(std::back_insert_iterator<std::vector<uint8_t>> it) const override {
+    insert(le_connection_interval_, it);
+    insert(le_connection_latency_, it);
+    insert(le_connection_supervision_timeout_, it);
+    insert(peer_address_type_, it);
+  }
+
+ private:
+  explicit LeConnectCompleteBuilder(uint16_t le_connection_interval, uint16_t le_connection_latency,
+                                    uint16_t le_connection_supervision_timeout, uint8_t peer_address_type)
+      : le_connection_interval_(le_connection_interval), le_connection_latency_(le_connection_latency),
+        le_connection_supervision_timeout_(le_connection_supervision_timeout), peer_address_type_(peer_address_type)
+
+  {}
+  uint16_t le_connection_interval_;
+  uint16_t le_connection_latency_;
+  uint16_t le_connection_supervision_timeout_;
+  uint8_t peer_address_type_;
+};
+
+}  // namespace packets
+}  // namespace test_vendor_lib
diff --git a/vendor_libs/test_vendor_lib/packets/link_layer/le_connect_complete_view.h b/vendor_libs/test_vendor_lib/packets/link_layer/le_connect_complete_view.h
new file mode 100644
index 0000000..88f5075
--- /dev/null
+++ b/vendor_libs/test_vendor_lib/packets/link_layer/le_connect_complete_view.h
@@ -0,0 +1,59 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#pragma once
+
+#include <cstdint>
+
+#include "packets/link_layer/link_layer_packet_view.h"
+#include "packets/packet_view.h"
+
+namespace test_vendor_lib {
+namespace packets {
+
+class LeConnectCompleteView : public PacketView<true> {
+ public:
+  LeConnectCompleteView(const LeConnectCompleteView&) = default;
+  virtual ~LeConnectCompleteView() = default;
+
+  static LeConnectCompleteView GetLeConnectComplete(const LinkLayerPacketView& view) {
+    ASSERT(view.GetType() == Link::PacketType::LE_CONNECT_COMPLETE);
+    return LeConnectCompleteView(view.GetPayload());
+  }
+
+  uint16_t GetLeConnectionInterval() {
+    return begin().extract<uint16_t>();
+  }
+
+  uint16_t GetLeConnectionLatency() {
+    return (begin() + 2).extract<uint16_t>();
+  }
+
+  uint16_t GetLeConnectionSupervisionTimeout() {
+    return (begin() + 4).extract<uint16_t>();
+  }
+
+  uint8_t GetAddressType() {
+    return (begin() + 6).extract<uint8_t>();
+  }
+
+ private:
+  LeConnectCompleteView() = delete;
+  LeConnectCompleteView(const PacketView<true>& view) : PacketView(view) {}
+};
+
+}  // namespace packets
+}  // namespace test_vendor_lib
diff --git a/vendor_libs/test_vendor_lib/packets/link_layer/le_connect_view.h b/vendor_libs/test_vendor_lib/packets/link_layer/le_connect_view.h
new file mode 100644
index 0000000..3fca36e
--- /dev/null
+++ b/vendor_libs/test_vendor_lib/packets/link_layer/le_connect_view.h
@@ -0,0 +1,63 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#pragma once
+
+#include <cstdint>
+
+#include "packets/link_layer/link_layer_packet_view.h"
+#include "packets/packet_view.h"
+
+namespace test_vendor_lib {
+namespace packets {
+
+class LeConnectView : public PacketView<true> {
+ public:
+  LeConnectView(const LeConnectView&) = default;
+  virtual ~LeConnectView() = default;
+
+  static LeConnectView GetLeConnect(const LinkLayerPacketView& view) {
+    ASSERT(view.GetType() == Link::PacketType::LE_CONNECT);
+    return LeConnectView(view.GetPayload());
+  }
+
+  uint16_t GetLeConnectionIntervalMin() {
+    return begin().extract<uint16_t>();
+  }
+
+  uint16_t GetLeConnectionIntervalMax() {
+    return (begin() + 2).extract<uint16_t>();
+  }
+
+  uint16_t GetLeConnectionLatency() {
+    return (begin() + 4).extract<uint16_t>();
+  }
+
+  uint16_t GetLeConnectionSupervisionTimeout() {
+    return (begin() + 6).extract<uint16_t>();
+  }
+
+  uint8_t GetAddressType() {
+    return (begin() + 8).extract<uint8_t>();
+  }
+
+ private:
+  LeConnectView() = delete;
+  LeConnectView(const PacketView<true>& view) : PacketView(view) {}
+};
+
+}  // namespace packets
+}  // namespace test_vendor_lib
diff --git a/vendor_libs/test_vendor_lib/packets/link_layer/link_layer_packet_builder.cc b/vendor_libs/test_vendor_lib/packets/link_layer/link_layer_packet_builder.cc
index 426244f..816e444 100644
--- a/vendor_libs/test_vendor_lib/packets/link_layer/link_layer_packet_builder.cc
+++ b/vendor_libs/test_vendor_lib/packets/link_layer/link_layer_packet_builder.cc
@@ -17,8 +17,6 @@
 #include "link_layer_packet_builder.h"
 #include "link_layer_packet_view.h"
 
-#include "base/logging.h"
-
 using std::vector;
 
 namespace test_vendor_lib {
@@ -104,6 +102,19 @@
       new LinkLayerPacketBuilder(Link::PacketType::LE_ADVERTISEMENT, std::move(advertisement), source));
 }
 
+std::shared_ptr<LinkLayerPacketBuilder> LinkLayerPacketBuilder::WrapLeConnect(std::unique_ptr<LeConnectBuilder> connect,
+                                                                              const Address& source,
+                                                                              const Address& dest) {
+  return std::shared_ptr<LinkLayerPacketBuilder>(
+      new LinkLayerPacketBuilder(Link::PacketType::LE_CONNECT, std::move(connect), source, dest));
+}
+
+std::shared_ptr<LinkLayerPacketBuilder> LinkLayerPacketBuilder::WrapLeConnectComplete(
+    std::unique_ptr<LeConnectCompleteBuilder> connect_complete, const Address& source, const Address& dest) {
+  return std::shared_ptr<LinkLayerPacketBuilder>(
+      new LinkLayerPacketBuilder(Link::PacketType::LE_CONNECT_COMPLETE, std::move(connect_complete), source, dest));
+}
+
 std::shared_ptr<LinkLayerPacketBuilder> LinkLayerPacketBuilder::WrapLeScan(const Address& source, const Address& dest) {
   return std::shared_ptr<LinkLayerPacketBuilder>(new LinkLayerPacketBuilder(Link::PacketType::LE_SCAN, source, dest));
 }
@@ -120,6 +131,12 @@
       new LinkLayerPacketBuilder(Link::PacketType::PAGE, std::move(page), source, dest));
 }
 
+std::shared_ptr<LinkLayerPacketBuilder> LinkLayerPacketBuilder::WrapPageReject(
+    std::unique_ptr<PageRejectBuilder> page_reject, const Address& source, const Address& dest) {
+  return std::shared_ptr<LinkLayerPacketBuilder>(
+      new LinkLayerPacketBuilder(Link::PacketType::PAGE_REJECT, std::move(page_reject), source, dest));
+}
+
 std::shared_ptr<LinkLayerPacketBuilder> LinkLayerPacketBuilder::WrapPageResponse(
     std::unique_ptr<PageResponseBuilder> page_response, const Address& source, const Address& dest) {
   return std::shared_ptr<LinkLayerPacketBuilder>(
diff --git a/vendor_libs/test_vendor_lib/packets/link_layer/link_layer_packet_builder.h b/vendor_libs/test_vendor_lib/packets/link_layer/link_layer_packet_builder.h
index a9d7741..3101155 100644
--- a/vendor_libs/test_vendor_lib/packets/link_layer/link_layer_packet_builder.h
+++ b/vendor_libs/test_vendor_lib/packets/link_layer/link_layer_packet_builder.h
@@ -29,7 +29,10 @@
 #include "packets/link_layer/io_capability_builder.h"
 #include "packets/link_layer/io_capability_negative_response_builder.h"
 #include "packets/link_layer/le_advertisement_builder.h"
+#include "packets/link_layer/le_connect_builder.h"
+#include "packets/link_layer/le_connect_complete_builder.h"
 #include "packets/link_layer/page_builder.h"
+#include "packets/link_layer/page_reject_builder.h"
 #include "packets/link_layer/page_response_builder.h"
 #include "packets/link_layer/response_builder.h"
 #include "packets/link_layer/view_forwarder_builder.h"
@@ -67,11 +70,17 @@
       const Address& dest);
   static std::shared_ptr<LinkLayerPacketBuilder> WrapLeAdvertisement(
       std::unique_ptr<LeAdvertisementBuilder> advertisement, const Address& source);
+  static std::shared_ptr<LinkLayerPacketBuilder> WrapLeConnect(std::unique_ptr<LeConnectBuilder> connect,
+                                                               const Address& source, const Address& dest);
+  static std::shared_ptr<LinkLayerPacketBuilder> WrapLeConnectComplete(
+      std::unique_ptr<LeConnectCompleteBuilder> connect_complete, const Address& source, const Address& dest);
   static std::shared_ptr<LinkLayerPacketBuilder> WrapLeScan(const Address& source, const Address& dest);
   static std::shared_ptr<LinkLayerPacketBuilder> WrapLeScanResponse(
       std::unique_ptr<LeAdvertisementBuilder> scan_response, const Address& source, const Address& dest);
   static std::shared_ptr<LinkLayerPacketBuilder> WrapPage(std::unique_ptr<PageBuilder> page, const Address& source,
                                                           const Address& dest);
+  static std::shared_ptr<LinkLayerPacketBuilder> WrapPageReject(std::unique_ptr<PageRejectBuilder> page_response,
+                                                                const Address& source, const Address& dest);
   static std::shared_ptr<LinkLayerPacketBuilder> WrapPageResponse(std::unique_ptr<PageResponseBuilder> page_response,
                                                                   const Address& source, const Address& dest);
   static std::shared_ptr<LinkLayerPacketBuilder> WrapResponse(const std::unique_ptr<ResponseBuilder> response,
diff --git a/vendor_libs/test_vendor_lib/packets/link_layer/link_layer_packet_view.cc b/vendor_libs/test_vendor_lib/packets/link_layer/link_layer_packet_view.cc
index 04518ca..31cbdbf 100644
--- a/vendor_libs/test_vendor_lib/packets/link_layer/link_layer_packet_view.cc
+++ b/vendor_libs/test_vendor_lib/packets/link_layer/link_layer_packet_view.cc
@@ -15,7 +15,8 @@
  */
 
 #include "link_layer_packet_view.h"
-#include "base/logging.h"
+
+#include "os/log.h"
 
 namespace test_vendor_lib {
 constexpr size_t Link::kSizeBytes;
@@ -25,7 +26,7 @@
 LinkLayerPacketView::LinkLayerPacketView(std::shared_ptr<std::vector<uint8_t>> raw) : PacketView<true>(raw) {}
 
 LinkLayerPacketView LinkLayerPacketView::Create(std::shared_ptr<std::vector<uint8_t>> raw) {
-  CHECK(raw->size() >= Link::kSizeBytes + Link::kTypeBytes + 2 * Address::kLength);
+  ASSERT(raw->size() >= Link::kSizeBytes + Link::kTypeBytes + 2 * Address::kLength);
   return LinkLayerPacketView(raw);
 }
 
diff --git a/vendor_libs/test_vendor_lib/packets/link_layer/page_builder.h b/vendor_libs/test_vendor_lib/packets/link_layer/page_builder.h
index 0e18cb3..9b219d7 100644
--- a/vendor_libs/test_vendor_lib/packets/link_layer/page_builder.h
+++ b/vendor_libs/test_vendor_lib/packets/link_layer/page_builder.h
@@ -19,8 +19,6 @@
 #include <cstdint>
 #include <memory>
 
-#include <base/logging.h>
-
 #include "packets/packet_builder.h"
 #include "types/class_of_device.h"
 
diff --git a/vendor_libs/test_vendor_lib/packets/link_layer/page_reject_builder.h b/vendor_libs/test_vendor_lib/packets/link_layer/page_reject_builder.h
new file mode 100644
index 0000000..ebf84d2
--- /dev/null
+++ b/vendor_libs/test_vendor_lib/packets/link_layer/page_reject_builder.h
@@ -0,0 +1,50 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#pragma once
+
+#include <cstdint>
+#include <memory>
+
+#include "packets/packet_builder.h"
+
+namespace test_vendor_lib {
+namespace packets {
+
+class PageRejectBuilder : public PacketBuilder<true> {
+ public:
+  virtual ~PageRejectBuilder() = default;
+
+  static std::unique_ptr<PageRejectBuilder> Create(uint8_t reason) {
+    return std::unique_ptr<PageRejectBuilder>(new PageRejectBuilder(reason));
+  }
+
+  virtual size_t size() const override {
+    return sizeof(reason_);
+  }
+
+ protected:
+  virtual void Serialize(std::back_insert_iterator<std::vector<uint8_t>> it) const override {
+    insert(reason_, it);
+  }
+
+ private:
+  explicit PageRejectBuilder(uint8_t reason) : reason_(reason) {}
+  uint8_t reason_;
+};
+
+}  // namespace packets
+}  // namespace test_vendor_lib
diff --git a/vendor_libs/test_vendor_lib/packets/link_layer/page_reject_view.h b/vendor_libs/test_vendor_lib/packets/link_layer/page_reject_view.h
new file mode 100644
index 0000000..0c7611c
--- /dev/null
+++ b/vendor_libs/test_vendor_lib/packets/link_layer/page_reject_view.h
@@ -0,0 +1,47 @@
+/*
+ * Copyright 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#pragma once
+
+#include <cstdint>
+
+#include "packets/link_layer/link_layer_packet_view.h"
+#include "packets/packet_view.h"
+
+namespace test_vendor_lib {
+namespace packets {
+
+class PageRejectView : public PacketView<true> {
+ public:
+  PageRejectView(const PageRejectView&) = default;
+  virtual ~PageRejectView() = default;
+
+  static PageRejectView GetPageReject(const LinkLayerPacketView& view) {
+    ASSERT(view.GetType() == Link::PacketType::PAGE_REJECT);
+    return PageRejectView(view.GetPayload());
+  }
+
+  uint8_t GetReason() {
+    return at(0);
+  }
+
+ private:
+  PageRejectView() = delete;
+  PageRejectView(const PacketView<true>& view) : PacketView(view) {}
+};
+
+}  // namespace packets
+}  // namespace test_vendor_lib
diff --git a/vendor_libs/test_vendor_lib/packets/link_layer/page_response_builder.h b/vendor_libs/test_vendor_lib/packets/link_layer/page_response_builder.h
index 78f9a80..da7c853 100644
--- a/vendor_libs/test_vendor_lib/packets/link_layer/page_response_builder.h
+++ b/vendor_libs/test_vendor_lib/packets/link_layer/page_response_builder.h
@@ -19,8 +19,6 @@
 #include <cstdint>
 #include <memory>
 
-#include "base/logging.h"
-
 #include "packets/packet_builder.h"
 
 namespace test_vendor_lib {
diff --git a/vendor_libs/test_vendor_lib/packets/link_layer/page_response_view.h b/vendor_libs/test_vendor_lib/packets/link_layer/page_response_view.h
index 20f0b68..1510528 100644
--- a/vendor_libs/test_vendor_lib/packets/link_layer/page_response_view.h
+++ b/vendor_libs/test_vendor_lib/packets/link_layer/page_response_view.h
@@ -30,7 +30,7 @@
   virtual ~PageResponseView() = default;
 
   static PageResponseView GetPageResponse(const LinkLayerPacketView& view) {
-    CHECK(view.GetType() == Link::PacketType::PAGE_RESPONSE);
+    ASSERT(view.GetType() == Link::PacketType::PAGE_RESPONSE);
     return PageResponseView(view.GetPayload());
   }
 
diff --git a/vendor_libs/test_vendor_lib/packets/link_layer/page_view.h b/vendor_libs/test_vendor_lib/packets/link_layer/page_view.h
index a26446d..7f54b89 100644
--- a/vendor_libs/test_vendor_lib/packets/link_layer/page_view.h
+++ b/vendor_libs/test_vendor_lib/packets/link_layer/page_view.h
@@ -30,7 +30,7 @@
   virtual ~PageView() = default;
 
   static PageView GetPage(const LinkLayerPacketView& view) {
-    CHECK(view.GetType() == Link::PacketType::PAGE);
+    ASSERT(view.GetType() == Link::PacketType::PAGE);
     return PageView(view.GetPayload());
   }
 
diff --git a/vendor_libs/test_vendor_lib/packets/link_layer/response_view.h b/vendor_libs/test_vendor_lib/packets/link_layer/response_view.h
index f1ff7c9..60316a8 100644
--- a/vendor_libs/test_vendor_lib/packets/link_layer/response_view.h
+++ b/vendor_libs/test_vendor_lib/packets/link_layer/response_view.h
@@ -18,8 +18,6 @@
 
 #include <cstdint>
 
-#include <log/log.h>
-
 #include "packets/link_layer/link_layer_packet_view.h"
 #include "packets/packet_view.h"
 
@@ -32,7 +30,7 @@
   virtual ~ResponseView() = default;
 
   static ResponseView GetResponse(const LinkLayerPacketView& view) {
-    CHECK(view.GetType() == Link::PacketType::RESPONSE);
+    ASSERT(view.GetType() == Link::PacketType::RESPONSE);
     return ResponseView(view.GetPayload());
   }
 
diff --git a/vendor_libs/test_vendor_lib/packets/link_layer/view_forwarder_builder.h b/vendor_libs/test_vendor_lib/packets/link_layer/view_forwarder_builder.h
index da0d827..81f7b5b 100644
--- a/vendor_libs/test_vendor_lib/packets/link_layer/view_forwarder_builder.h
+++ b/vendor_libs/test_vendor_lib/packets/link_layer/view_forwarder_builder.h
@@ -19,8 +19,6 @@
 #include <cstdint>
 #include <memory>
 
-#include "base/logging.h"
-
 #include "packets/packet_builder.h"
 #include "packets/packet_view.h"
 
diff --git a/vendor_libs/test_vendor_lib/packets/packet_view.cc b/vendor_libs/test_vendor_lib/packets/packet_view.cc
index 7ffe71a..65cd4e7 100644
--- a/vendor_libs/test_vendor_lib/packets/packet_view.cc
+++ b/vendor_libs/test_vendor_lib/packets/packet_view.cc
@@ -18,7 +18,7 @@
 
 #include <algorithm>
 
-#include <base/logging.h>
+#include "os/log.h"
 
 namespace test_vendor_lib {
 namespace packets {
@@ -52,14 +52,14 @@
 
 template <bool little_endian>
 uint8_t PacketView<little_endian>::at(size_t index) const {
-  CHECK(index < length_) << "Index " << index << " out of bounds";
+  ASSERT_LOG(index < length_, "Index %d out of bounds", static_cast<int>(index));
   for (const auto& fragment : fragments_) {
     if (index < fragment.size()) {
       return fragment[index];
     }
     index -= fragment.size();
   }
-  CHECK(false) << "Out of fragments searching for Index " << index;
+  LOG_ALWAYS_FATAL("Out of fragments searching for Index %d", static_cast<int>(index));
   return 0;
 }
 
@@ -70,8 +70,8 @@
 
 template <bool little_endian>
 std::forward_list<View> PacketView<little_endian>::SubViewList(size_t begin, size_t end) const {
-  CHECK(begin <= end) << "Begin " << begin << " is past end";
-  CHECK(end <= length_) << "End " << end << " is too large";
+  ASSERT_LOG(begin <= end, "Begin %d is past end %d", static_cast<int>(begin), static_cast<int>(end));
+  ASSERT_LOG(end <= length_, "End %d is too large", static_cast<int>(end));
   std::forward_list<View> view_list;
   std::forward_list<View>::iterator it = view_list.before_begin();
   size_t length = end - begin;
diff --git a/vendor_libs/test_vendor_lib/packets/raw_builder.cc b/vendor_libs/test_vendor_lib/packets/raw_builder.cc
index 794fbb7..2ba2198 100644
--- a/vendor_libs/test_vendor_lib/packets/raw_builder.cc
+++ b/vendor_libs/test_vendor_lib/packets/raw_builder.cc
@@ -16,7 +16,6 @@
 
 #include "raw_builder.h"
 
-#include <base/logging.h>
 #include <algorithm>
 
 using std::vector;
diff --git a/vendor_libs/test_vendor_lib/packets/test/link_layer_packet_builder_test.cc b/vendor_libs/test_vendor_lib/packets/test/link_layer_packet_builder_test.cc
index 22ef70f..3a14142 100644
--- a/vendor_libs/test_vendor_lib/packets/test/link_layer_packet_builder_test.cc
+++ b/vendor_libs/test_vendor_lib/packets/test/link_layer_packet_builder_test.cc
@@ -33,8 +33,6 @@
 #include "packets/link_layer/page_view.h"
 #include "packets/link_layer/response_view.h"
 
-#include "base/logging.h"
-
 using std::vector;
 
 namespace {
diff --git a/vendor_libs/test_vendor_lib/packets/test/packet_builder_test.cc b/vendor_libs/test_vendor_lib/packets/test/packet_builder_test.cc
index 6fab56d..a2b3569 100644
--- a/vendor_libs/test_vendor_lib/packets/test/packet_builder_test.cc
+++ b/vendor_libs/test_vendor_lib/packets/test/packet_builder_test.cc
@@ -65,8 +65,7 @@
     return packet;
   }
 
-  void Serialize(
-      std::back_insert_iterator<std::vector<uint8_t>> it) const override {
+  void Serialize(std::back_insert_iterator<std::vector<uint8_t>> it) const override {
     PacketBuilder<little_endian>::insert(signature_, it);
     PacketBuilder<little_endian>::insert(byte_, it);
     PacketBuilder<little_endian>::insert(two_bytes_, it);
@@ -104,7 +103,9 @@
   }
   ~VectorBuilder() override = default;
 
-  size_t size() const override { return vect_.size() * sizeof(T); }
+  size_t size() const override {
+    return vect_.size() * sizeof(T);
+  }
 
   virtual const std::unique_ptr<std::vector<uint8_t>> FinalPacket() {
     std::unique_ptr<std::vector<uint8_t>> packet = std::make_unique<std::vector<uint8_t>>();
@@ -114,8 +115,7 @@
     return packet;
   }
 
-  void Serialize(
-      std::back_insert_iterator<std::vector<uint8_t>> it) const override {
+  void Serialize(std::back_insert_iterator<std::vector<uint8_t>> it) const override {
     PacketBuilder<true>::insert_vector(vect_, it);
   }
 
@@ -133,7 +133,9 @@
   }
   ~InsertElementsBuilder() override = default;
 
-  size_t size() const override { return vect_.size() * sizeof(T); }
+  size_t size() const override {
+    return vect_.size() * sizeof(T);
+  }
 
   virtual const std::unique_ptr<std::vector<uint8_t>> FinalPacket() {
     std::unique_ptr<std::vector<uint8_t>> packet = std::make_unique<std::vector<uint8_t>>();
@@ -143,8 +145,7 @@
     return packet;
   }
 
-  void Serialize(
-      std::back_insert_iterator<std::vector<uint8_t>> it) const override {
+  void Serialize(std::back_insert_iterator<std::vector<uint8_t>> it) const override {
     for (T elem : vect_) {
       PacketBuilder<true>::insert(elem, it);
     }
@@ -211,8 +212,7 @@
     return packet;
   }
 
-  void Serialize(
-      std::back_insert_iterator<std::vector<uint8_t>> it) const override {
+  void Serialize(std::back_insert_iterator<std::vector<uint8_t>> it) const override {
     PacketBuilder<true>::insert(level_, it);
     if (payload_) {
       payload_->Serialize(it);
diff --git a/vendor_libs/test_vendor_lib/packets/test/packet_view_test.cc b/vendor_libs/test_vendor_lib/packets/test/packet_view_test.cc
index b234c20..760388e 100644
--- a/vendor_libs/test_vendor_lib/packets/test/packet_view_test.cc
+++ b/vendor_libs/test_vendor_lib/packets/test/packet_view_test.cc
@@ -58,7 +58,9 @@
     packet = std::shared_ptr<T>(new T({View(std::make_shared<const vector<uint8_t>>(count_all), 0, count_all.size())}));
   }
 
-  void TearDown() override { packet.reset(); }
+  void TearDown() override {
+    packet.reset();
+  }
 
   std::shared_ptr<T> packet;
 };
diff --git a/vendor_libs/test_vendor_lib/packets/view.cc b/vendor_libs/test_vendor_lib/packets/view.cc
index 7dbd8bd..a358169 100644
--- a/vendor_libs/test_vendor_lib/packets/view.cc
+++ b/vendor_libs/test_vendor_lib/packets/view.cc
@@ -16,7 +16,7 @@
 
 #include "view.h"
 
-#include <base/logging.h>
+#include "os/log.h"
 
 namespace test_vendor_lib {
 namespace packets {
@@ -33,7 +33,7 @@
 }
 
 uint8_t View::operator[](size_t i) const {
-  CHECK(i + begin_ < end_) << "Out of bounds access at " << i;
+  ASSERT_LOG(i + begin_ < end_, "Out of bounds access at %d", static_cast<int>(i));
   return data_->operator[](i + begin_);
 }
 
diff --git a/vendor_libs/test_vendor_lib/scripts/simple_stack.py b/vendor_libs/test_vendor_lib/scripts/simple_stack.py
index 4f42bf2..95d973a 100644
--- a/vendor_libs/test_vendor_lib/scripts/simple_stack.py
+++ b/vendor_libs/test_vendor_lib/scripts/simple_stack.py
@@ -146,7 +146,7 @@
 
   def receive_response(self):
     ready_to_read, ready_to_write, in_error = \
-               select.select(
+               select(
                   [ self._connection._socket ],
                   [ ],
                   [ self._connection._socket ],
diff --git a/vendor_libs/test_vendor_lib/test/iterator_test.cc b/vendor_libs/test_vendor_lib/test/iterator_test.cc
index b65b60f..0e7b67c 100644
--- a/vendor_libs/test_vendor_lib/test/iterator_test.cc
+++ b/vendor_libs/test_vendor_lib/test/iterator_test.cc
@@ -52,7 +52,9 @@
     packet = TestPacket::make_new_packet(complete_l2cap_packet);
   }
 
-  void TearDown() override { packet.reset(); }
+  void TearDown() override {
+    packet.reset();
+  }
 
   std::shared_ptr<TestPacket> packet;
 };
diff --git a/vendor_libs/test_vendor_lib/test/packet_builder_test.cc b/vendor_libs/test_vendor_lib/test/packet_builder_test.cc
index 6fab56d..a2b3569 100644
--- a/vendor_libs/test_vendor_lib/test/packet_builder_test.cc
+++ b/vendor_libs/test_vendor_lib/test/packet_builder_test.cc
@@ -65,8 +65,7 @@
     return packet;
   }
 
-  void Serialize(
-      std::back_insert_iterator<std::vector<uint8_t>> it) const override {
+  void Serialize(std::back_insert_iterator<std::vector<uint8_t>> it) const override {
     PacketBuilder<little_endian>::insert(signature_, it);
     PacketBuilder<little_endian>::insert(byte_, it);
     PacketBuilder<little_endian>::insert(two_bytes_, it);
@@ -104,7 +103,9 @@
   }
   ~VectorBuilder() override = default;
 
-  size_t size() const override { return vect_.size() * sizeof(T); }
+  size_t size() const override {
+    return vect_.size() * sizeof(T);
+  }
 
   virtual const std::unique_ptr<std::vector<uint8_t>> FinalPacket() {
     std::unique_ptr<std::vector<uint8_t>> packet = std::make_unique<std::vector<uint8_t>>();
@@ -114,8 +115,7 @@
     return packet;
   }
 
-  void Serialize(
-      std::back_insert_iterator<std::vector<uint8_t>> it) const override {
+  void Serialize(std::back_insert_iterator<std::vector<uint8_t>> it) const override {
     PacketBuilder<true>::insert_vector(vect_, it);
   }
 
@@ -133,7 +133,9 @@
   }
   ~InsertElementsBuilder() override = default;
 
-  size_t size() const override { return vect_.size() * sizeof(T); }
+  size_t size() const override {
+    return vect_.size() * sizeof(T);
+  }
 
   virtual const std::unique_ptr<std::vector<uint8_t>> FinalPacket() {
     std::unique_ptr<std::vector<uint8_t>> packet = std::make_unique<std::vector<uint8_t>>();
@@ -143,8 +145,7 @@
     return packet;
   }
 
-  void Serialize(
-      std::back_insert_iterator<std::vector<uint8_t>> it) const override {
+  void Serialize(std::back_insert_iterator<std::vector<uint8_t>> it) const override {
     for (T elem : vect_) {
       PacketBuilder<true>::insert(elem, it);
     }
@@ -211,8 +212,7 @@
     return packet;
   }
 
-  void Serialize(
-      std::back_insert_iterator<std::vector<uint8_t>> it) const override {
+  void Serialize(std::back_insert_iterator<std::vector<uint8_t>> it) const override {
     PacketBuilder<true>::insert(level_, it);
     if (payload_) {
       payload_->Serialize(it);